[llvm-dev] Altering the return address , for a function with multiple return paths

James Y Knight via llvm-dev llvm-dev at lists.llvm.org
Sun Jul 21 09:29:41 PDT 2019


Yes, indeed!

The SBCL lisp compiler (not llvm based) used to emit functions which would
return either via ret to the usual instruction after the call, or else load
the return-address from the stack, then jump 2 bytes later (which would
skip over either a nop or a short jmp at original target location). Which
one it used depended upon whether the function was doing a multi-valued
return (in which case it used ret) or a single-valued return (in which case
it did the jmp retpc+2).

While this seems like a clever and efficient hack, it actually has an
absolutely awful effect on performance, due to the unpaired call vs return,
and the unexpected return address.

SBCL stopped doing this in 2006, a decade later than it should've -- the
Pentium1 MMX from 1997 already had a hardware return stack which made this
a really bad idea!

What it does now is have the called function set or clear the carry flag
(using STC and CLC) immediately before the return. If the caller cares,
then the caller emits JNC as the first instruction after the call. (but
callers typically do not care -- most calls only consume a single value,
and any extra return-values are silently ignored).


On Sun, Jul 21, 2019, 6:18 AM Jacob Lifshay via llvm-dev <
llvm-dev at lists.llvm.org> wrote:

> one (non-LLVM) problem you will run into is that almost all processors
> are optimized to have functions return to the instruction right after
> the instruction that called them.
>
> The most common method is to predict where the return instruction will
> jump to by using a processor-internal stack of return addresses, which
> is separate from the in-memory call stack. This enables the processor
> to fetch, decode, and execute instructions following (in program
> order) the return instruction before the processor knows for sure what
> address the return instruction will branch to. If the return address
> turns out to be different than the processor predicted, it has to
> throw out all the instructions it started executing that it thought
> came after the return, causing massive slow-downs.
>
> For an interesting application of changing the return address, lookup
> retpolines.
>
> On Sun, Jul 21, 2019 at 2:07 AM Tsur Herman via llvm-dev
> <llvm-dev at lists.llvm.org> wrote:
> >
> > Playing around with calling conventions naked functions and
> epilogue/prologue...
> > Is it possible/expressible/feasible to alter the return address the
> function will return to?
> >
> > For example, when a function may return an Int8 or a Float64, depending
> on some external state
> > (user, or random variable), instead of checking the returned type in the
> calling function, is it possible
> > to pass 2 potential return addresses one suitable for Int8 and one
> suitable for Float64 and let the function return to the right place?
> >
> > if it is possible, what are the implications? do these inhibit the
> optimization opportunities somehow?
> > _______________________________________________
> > LLVM Developers mailing list
> > llvm-dev at lists.llvm.org
> > https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev
> _______________________________________________
> LLVM Developers mailing list
> llvm-dev at lists.llvm.org
> https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20190721/f6a48f5b/attachment.html>


More information about the llvm-dev mailing list