<div dir="ltr"><div>Hi,</div><div><br></div><div><div><div>If this is mainly x86, you can use @llvm.addressofreturnaddress to get what you need, I think. It says it only works on that platform, but it kind of does exactly what you want. I think the Value of Function is the address of the function when used in that manner, so it can be stored in a constant and used. Similarly if you narrow the blocks containing calls to the function you're modifying down to the call and a branch to the rest of the block (and have a reasonable idea of how parameters will be pushed onto the stack before the call), you can take the address of the block the CallInst is in and come up with a very narrow range the return address is allowed to point to. For fixed length instruction sets you should be able to do it almost perfectly with just a target triple. Doing it with the block addresses as global constants and performing similar constant calculations on them will generate them as label references with the calculations added on in the assembly and constants + relocations the output files. That's probably easier than basing things on the functions. Blocks with their addresses taken and the address used shouldn't be removed by any optimization passes, so it sort of follows that the constant / block won't be removed unless both the callee and caller are dead and can be eliminated. <br></div><div><br></div><div> Otherwise @llvm.stacksave prior to allocas / @llvm.stackrestore at end will get rid of local allocs (and maybe the frame pointer save?) so potentially you only have to deal with a saved frame pointer on ARM / MIPS / etc. On those platforms you won't need to do this unless the function saves LR or equivalent to the stack, but since this is usually only done on functions that call other functions it shouldn't be hard to determine. </div><div><br></div><div>@llvm.localescape (after allocas) and @llvm.localrecover might be useful as well. The docs mention a localaddress intrinsic as well in the section on those two things, but nowhere else. <br></div></div><br></div><div>I'm pretty sure this would be the way to start, from the docs at least. I haven't tried this and haven't needed to play with this sort of thing in a while now. <br></div><div><br></div><div>Cheers,</div><div>-G<br></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Sep 6, 2018 at 7:45 PM PenYiWang via llvm-dev <<a href="mailto:llvm-dev@lists.llvm.org">llvm-dev@lists.llvm.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr">Thanks for your reply.<div><br></div><div>What I want to do is that check the return address at every return site (for some security issue) . <br><div><br></div><div>(I will also do some analysis to get some candidate return target)</div><div><br></div><div>So the "ret" instruction will be transformed to </div></div><div><br></div><div>mov eax,[esp] // get the return address at the top of stack</div><div>cmp eax,0x08040000 // candidate 1</div><div>je 0x08040000</div><div>cmp eax,0x08040004 // candidate 2</div><div>je 0x08040004</div><div>cmp eax,0x08040008 // candidate 3</div><div>je 0x08040008</div><div><br></div><div>So if I want to do this transform at llvm ir level rather than backend,</div><div><br></div><div>I need to get the return address of current function in FunctionPass, right?</div><div><br></div><div>I found that intrinisc::returnaddress only returns a *void pointer. </div><div><br></div><div>c code:</div><div><br></div><div><div>int main(){</div><div> int a = __builtin_return_address(0);</div><div>}</div></div><div><br></div><div>llvm ir:</div><div><br></div><div><div>define i32 @main() #0 {</div><div>entry:</div><div> %a = alloca i32, align 4</div><div> %0 = call i8* @llvm.returnaddress(i32 0)</div><div> %1 = ptrtoint i8* %0 to i32</div><div> store i32 %1, i32* %a, align 4</div><div> ret i32 0</div><div>}</div></div><div><br></div><div>Can I use the return value of intrinisc::returnaddress to compare with "Function" class in llvm ir?</div><div><br></div><div>(Otherwise, I need to modify backend to do my intrumentation.)</div><div><br></div><div>Thanks</div></div></div></div><br><div class="gmail_quote"><div dir="ltr">Bekket McClane <<a href="mailto:bekket.mcclane@gmail.com" target="_blank">bekket.mcclane@gmail.com</a>> 於 2018年9月5日 週三 下午9:41寫道：<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Correct...you can always call that intrinsic explicitly. However, I don't think it would help the original question, since the question is how to get the return address inside a LLVM Pass, instead of getting the return address after executing the program with Intrinsic::returnaddress inside.</div><div>Also, executing a program containing Intrinsic::returnaddress won't get you anything - even failed to pass the linking stage - without special support, since the intrinsic is just a function declaration.</div><div><br></div><div>Bests,</div><div>Bekket<br></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Sep 5, 2018 at 5:00 AM <a href="http://mayuyu.io" target="_blank">mayuyu.io</a> <<a href="mailto:admin@mayuyu.io" target="_blank">admin@mayuyu.io</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">To my knowledge that intrinsic IS generated by frontends like Clang when using _builtin_return_address(), i could be wrong though<br>
<br>
Zhang<br>
<br>
> 在 2018年9月5日，10:47，Bekket McClane via llvm-dev <<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a>> 写道：<br>
> <br>
> and<br>
<br>
</blockquote></div>
</blockquote></div>
_______________________________________________<br>
LLVM Developers mailing list<br>
<a href="mailto:llvm-dev@lists.llvm.org" target="_blank">llvm-dev@lists.llvm.org</a><br>
<a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev" rel="noreferrer" target="_blank">http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a><br>
</blockquote></div>