Adding nocf_check attribute for cf-protection fine tuning

[oren_ben_simhon]

Summary

The patch adds nocf_check target independent attribute for disabling checks that were enabled by cf-protection flag.
The attribute can be appertained to functions and function pointers.
Attribute name follows GCC's similar attribute name.

Please see the following for more information:
https://reviews.llvm.org/D41879

[oren_ben_simhon]

ping

[craig.topper]

lib/Sema/SemaDeclAttr.cpp

1994

Why did this get renamed?

2002

Wy did this get renamed?

[aaron.ballman]

include/clang/Basic/Attr.td

2089

This attribute doesn't appear to be supported by GCC. Did you mean to use the Clang spelling instead?

include/clang/Basic/AttrDocs.td

2876

tampering with addresses

2878

bytes in the binary

lib/Sema/SemaDeclAttr.cpp

1985–1987

attr doesn't follow the proper naming conventions.

1986–1987

Why do you need to manually check the attribute has no args -- doesn't the common handling in handleCommonAttributeFeatures() already cover that?

1989–1997

I think all of this can be replaced by setting the proper subject on the attribute (FunctionLike) in Attr.td.

test/Sema/attr-nocf_check.c

8–10

How is this mismatched?

[oren_ben_simhon]

include/clang/Basic/Attr.td

2089

Attribute documentation can be found here:
https://gcc.gnu.org/onlinedocs/gcc/x86-Function-Attributes.html#x86-Function-Attributes

lib/Sema/SemaDeclAttr.cpp

1994

To remove multiple code fragments. Same as CheckAttrNoArgs.

2002

To reuse existing code. The same check is performed in several attributes so instead of writing this block for every attribute i only call this function.

[oren_ben_simhon]

Implemented comments posted until 2/14 (Thanks Aaron and Craig)

[aaron.ballman]

One thing I notice is that GCC trunk requires passing the -fcf-protection flag in order to enable the attribute. Do we wish to do the same?

include/clang/Basic/Attr.td

2089

Ah, it was hiding in there -- my apologies!

lib/Sema/SemaDeclAttr.cpp

1967–1968

I think this can be removed entirely -- it should be handled automatically by the common handler (double-check that there's test coverage for it).

1977–1978

I think you can drop the CheckAttrNoArgs() call from here as well. And once CheckAttrTarget() is moved to the common handler, this function can also be replaced by a call to handleSimpleAttribute<>()

1985–1987

Please don't name the parameter variable after a type -- that can confuse some editors.

1985–1987

Once you move the target check into the common predicate function, this function can go away and you can use handleSimpleAttribute<>() instead.

2002

I think this may be the wrong approach -- this code seems like it should be handled automatically in handleCommonAttributeFeatures(). We already check whether the attribute appertains to its subjects and other table-gennable predicate checks, and this seems like it would be another instance of that kind of situation.

I think you need to retain this function (because it's called for type attributes, which don't have automated checking yet), but call it from handleCommonAttributeFeatures() rather than call it manually.

test/Sema/attr-nocf_check.c

19–21

These are an error in GCC and I think we should match that behavior. https://godbolt.org/g/r3pf4X

[oren_ben_simhon]

lib/Sema/SemaDeclAttr.cpp

1985–1987

I am following the same convention that other functions are using.

test/Sema/attr-nocf_check.c

19–21

I will create a warning however in LLVM we don't create an error upon incompatible pointer due to function attribute types.

[oren_ben_simhon]

Implemented comments posted until 02/15 (Thanks Aaron)

[aaron.ballman]

lib/Sema/SemaDeclAttr.cpp

1985–1987

I am following the same convention that other functions are using.

They're doing it wrong. I can clean those up in a separate patch.

test/Sema/attr-nocf_check.c

19–21

It should be an error -- Clang does error on this sort of thing when appropriate (which I believe it is, here). For instance, calling convention attributes do this: https://godbolt.org/g/mkTGLg

[oren_ben_simhon]

lib/Sema/SemaDeclAttr.cpp

1985–1987

Its OK i can make the change.

test/Sema/attr-nocf_check.c

19–21

In Clang there is Sema::IncompatiblePointer in case to pointers are not compatible. This flag emits warning message. In the time i check for pointer incompatibility (checkPointerTypesForAssignment()), i don;t have a handle to the attributes. Any suggestion how to implement the exception for nocf_check attribute?

[aaron.ballman]

lib/Sema/SemaDeclAttr.cpp

1985–1987

I've commit a cleanup in r325256 that fixes the identifiers in the file (along with several other coding standard issues).

test/Sema/attr-nocf_check.c

19–21

I believe this is handled in ASTContext::mergeFunctionType(). See:

// Compatible functions must have compatible calling conventions
if (lbaseInfo.getCC() != rbaseInfo.getCC())
  return QualType();

Somewhere around there is likely where you should be.

[oren_ben_simhon]

test/Sema/attr-nocf_check.c

19–21

I already added there getnocfcheck.

After double checking, I see that nocf_check behavior is identical to other function attributes.
For some reason in the clang tests they give warning but in godbolt it gives an error.
I am not sure what is the difference between the flags in godbolt and in my test but this is what causing the warning/error message difference.

So basically my behavior is identical to other function type attributes (e.g. no_caller_saved_registers). I believe it is also identical to GCC but i can't prove it because i don't know the flags that godbolt is using.

[aaron.ballman]

test/Sema/attr-nocf_check.c

19–21

You can see the flags being passed in godbolt by passing -v on the command line. FWIW, I get the same error behavior elsewhere as well:

http://coliru.stacked-crooked.com/a/d28234385fa68374
https://wandbox.org/permlink/SRLM82l2uJ8q3o1Q

I think you should do some more investigation into what's going on there. Ultimately, I want to avoid clang accepting the nocf_check attribute (even with a warning) in cases where GCC doesn't accept it, because that leads to incompatibilities when switching between the two compilers. We should accept what GCC accepts and reject what GCC rejects unless there's a good reason to deviate.

[aaron.ballman]

test/Sema/attr-nocf_check.c

19–21

Ah, I think the distinction here is C++ vs C code. In C, this code should warn, in C++ this code should err. I'm guessing that if you add a C++ test case, the behavior will be to err on this without any other code changes.

[oren_ben_simhon]

Implemented comments posted until 02/22 (Thanks Aaron).

[oren_ben_simhon]

I added a comment ignoring nocf_check attribute in case -fcf-protection is not set.
Now LLVM is identical to GCC.

test/Sema/attr-nocf_check.c

19–21

Indeed the difference is C++ Vs C. I added a new test that checks for C++ as well.

[aaron.ballman]

include/clang/Basic/DiagnosticSemaKinds.td

2691

Diagnostics are not complete sentences, so the punctuation and capitalization should go away. Typo in the flag spelling. The attribute name should be quoted. I'd go with: "'nocf_check' attribute ignored; use -fcf-protection to enable the attribute"

include/clang/CodeGen/CGFunctionInfo.h

519

This is unfortunate -- it bumps the bit-field over 32 bits. Can the bit be stolen from elsewhere?

include/clang/Sema/Sema.h

3331–3333

Please don't name the parameter after a type.

lib/Frontend/CompilerInvocation.cpp

1999

Can elide some parens.

lib/Sema/SemaDeclAttr.cpp

1979–1980

Can you use the LangOpts field to specify this in Attr.td? Then you can go back to the simple handler.

1985–1987

Don't name the parameter after a type.

test/Sema/attr-nocf_check.cpp

2

For better test coverage, you can switch to the [[gnu::nocf_check]] spelling in this file and pass -std=c++11

[aaron.ballman]

test/Sema/attr-nocf_check.c

2

You likely need to specify an explicit triple here, or some of the bots fail this test because the attribute isn't supported on that architecture. You should also add a test that verifies the attribute isn't supported on non-x86 platforms.

test/Sema/attr-nocf_check.cpp

2

This one also likely needs an explicit triple.

[oren_ben_simhon]

include/clang/CodeGen/CGFunctionInfo.h

519

The field is orthogonal to the other fields moreover i think that double meaning of the same field will lead to future bugs. The class is not a compact packed structure, so i don't feel it worth the confusion.

lib/Sema/SemaDeclAttr.cpp

1979–1980

When using LangOpts field in Attr.td, the diagnostic warning will not be descriptive as i use here (use -fcf-protection flag...).

test/Sema/attr-nocf_check.cpp

2

Since it doesn't test the functionality of this specific attribute, I believe it is an overkill to switch to [[gnu::nocf_check]] spelling.

[oren_ben_simhon]

Implemented comments posted until 02/26 (Thanks Aaron)

[aaron.ballman]

include/clang/CodeGen/CGFunctionInfo.h

519

The class packs its fields for space savings because it's used fairly frequently; if we can keep the size from having to use another allocation unit, that's better. I wasn't suggesting we make a bit have double meaning, I was wondering if we could reduce the size of one of the other fields. For instance, I'd be surprised if we need all 8 bits for calling conventions, so we might be able to reduce that to a 7-bit field.

lib/Sema/SemaDeclAttr.cpp

1979–1980

That's true, and this code is fine for now. However, it does suggest that the declarative handler could be improved to support this sort of thing -- the same issue is present with *all* attributes gated on a language option.

test/Sema/attr-nocf_check.cpp

2

Since it doesn't test the functionality of this specific attribute, I believe it is an overkill to switch to [[gnu::nocf_check]] spelling.

C++ attribute spellings have slightly different code paths than GNU attribute spellings, so the test isn't overkill. Also, this is a C++ test file that already uses C++11, so adding the C++11 spelling is an improvement over using the GNU spelling (that's already covered with C tests).

It's not critical, but it's still a strict improvement.

[erichkeane]

include/clang/CodeGen/CGFunctionInfo.h

519

Note that LLVM::CallingConv (http://llvm.org/doxygen/namespacellvm_1_1CallingConv.html) only uses up to 96, yet has a 'MaxID' of 1023 for some reason. It seems that backing this down to 255 would be more than reasonable and would prevent issues here, but wouldn't save any bits here. We could possibly make it '127' in LLVM, but I fear that would limit the values pretty harshly.

HOWEVER, clang::CallingConv (https://clang.llvm.org/doxygen/Specifiers_8h_source.html#l00233) only has 17 items. Because of this, 7 bits is 1 more than necessary. We could save a bit from ASTCallingConvention, and still permit nearly doubling calling conventions.

[oren_ben_simhon]

lib/Sema/SemaDeclAttr.cpp

1979–1980

I agree. I believe such a change is out of the scope of the review.

[oren_ben_simhon]

Implemented comments posted until 02/27 (Thanks Aaron and Erich)

[aaron.ballman]

Aside from some minor testing nits, I think this LGTM. However, you should wait to see if Richard has comments as well before committing.

test/Sema/attr-nocf_check.cpp

14

Can you slide the attribute after i so it applies to the parameter (should still diagnose as not appertaining to that)?

test/Sema/nocf_check_attr_not_allowed.c

3

Can you add another RUN line for when -fcf-protection is not supplied so that we have test coverage for that custom diagnostic?

[oren_ben_simhon]

Implemented commented posted by Aaron (Thanks)

include/clang/AST/Type.h

protected:
   class FunctionTypeBitfields {
     friend class FunctionProtoType;
     friend class FunctionType;
 
     unsigned : NumTypeBits;
 
     /// Extra information which affects how the function is called, like
     /// regparm and the calling convention.
-    unsigned ExtInfo : 11;
+    unsigned ExtInfo : 12;
 
     /// Used only by FunctionProtoType, put here to pack with the
     /// other bitfields.
     /// The qualifiers are part of FunctionProtoType because...
     ///
     /// C++ 8.3.5p4: The return type, the parameter type list and the
     /// cv-qualifier-seq, [...], are part of the function type.
     unsigned TypeQuals : 4;
public:
   // * FunctionNoProtoType::Profile
   // * FunctionProtoType::Profile
   // * TypePrinter::PrintFunctionProto
   // * AST read and write
   // * Codegen
   class ExtInfo {
     friend class FunctionType;
 
-    // Feel free to rearrange or add bits, but if you go over 11,
+    // Feel free to rearrange or add bits, but if you go over 12,
     // you'll need to adjust both the Bits field below and
     // Type::FunctionTypeBitfields.
 
-    //   |  CC  |noreturn|produces|nocallersavedregs|regparm|
-    //   |0 .. 4|   5    |    6   |       7         |8 .. 10|
+    //   |  CC  |noreturn|produces|nocallersavedregs|regparm|nocfcheck|
+    //   |0 .. 4|   5    |    6   |       7         |8 .. 10|    11   |
     //
     // regparm is either 0 (no regparm attribute) or the regparm value+1.
     enum { CallConvMask = 0x1F };
     enum { NoReturnMask = 0x20 };
     enum { ProducesResultMask = 0x40 };
     enum { NoCallerSavedRegsMask = 0x80 };
+    enum { NoCfCheckMask = 0x800 };
     enum {
       RegParmMask = ~(CallConvMask | NoReturnMask | ProducesResultMask |
-                      NoCallerSavedRegsMask),
+                      NoCallerSavedRegsMask | NoCfCheckMask),
       RegParmOffset = 8
     }; // Assumed to be the last field
-
     uint16_t Bits = CC_C;
 
     ExtInfo(unsigned Bits) : Bits(static_cast<uint16_t>(Bits)) {}
 
    public:
      // Constructor with no defaults. Use this when you know that you
      // have all the elements (when reading an AST file for example).
      ExtInfo(bool noReturn, bool hasRegParm, unsigned regParm, CallingConv cc,
-             bool producesResult, bool noCallerSavedRegs) {
+             bool producesResult, bool noCallerSavedRegs, bool NoCfCheck) {
        assert((!hasRegParm || regParm < 7) && "Invalid regparm value");
        Bits = ((unsigned)cc) | (noReturn ? NoReturnMask : 0) |
               (producesResult ? ProducesResultMask : 0) |
               (noCallerSavedRegs ? NoCallerSavedRegsMask : 0) |
-              (hasRegParm ? ((regParm + 1) << RegParmOffset) : 0);
+              (hasRegParm ? ((regParm + 1) << RegParmOffset) : 0) | 
+              (NoCfCheck ? NoCfCheckMask : 0);
     }
 
     // Constructor with all defaults. Use when for example creating a
     // function known to use defaults.
     ExtInfo() = default;
 
     // Constructor with just the calling convention, which is an important part
     // of the canonical type.
     ExtInfo(CallingConv CC) : Bits(CC) {}
 
     bool getNoReturn() const { return Bits & NoReturnMask; }
     bool getProducesResult() const { return Bits & ProducesResultMask; }
     bool getNoCallerSavedRegs() const { return Bits & NoCallerSavedRegsMask; }
+    bool getNoCfCheck() const { return Bits & NoCfCheckMask; }
     bool getHasRegParm() const { return (Bits >> RegParmOffset) != 0; }
 
     unsigned getRegParm() const {
-      unsigned RegParm = Bits >> RegParmOffset;
+      unsigned RegParm = (Bits & RegParmMask) >> RegParmOffset;
       if (RegParm > 0)
         --RegParm;
       return RegParm;
     }
 
     CallingConv getCC() const { return CallingConv(Bits & CallConvMask); }
 
     bool operator==(ExtInfo Other) const {
public:
 
     ExtInfo withNoCallerSavedRegs(bool noCallerSavedRegs) const {
       if (noCallerSavedRegs)
         return ExtInfo(Bits | NoCallerSavedRegsMask);
       else
         return ExtInfo(Bits & ~NoCallerSavedRegsMask);
     }
 
+    ExtInfo withNoCfCheck(bool noCfCheck) const {
+      if (noCfCheck)
+        return ExtInfo(Bits | NoCfCheckMask);
+      else
+        return ExtInfo(Bits & ~NoCfCheckMask);
+    }
+
     ExtInfo withRegParm(unsigned RegParm) const {
       assert(RegParm < 7 && "Invalid regparm value");
       return ExtInfo((Bits & ~RegParmMask) |
                      ((RegParm + 1) << RegParmOffset));
     }
 
     ExtInfo withCallingConv(CallingConv cc) const {
       return ExtInfo((Bits & ~CallConvMask) | (unsigned) cc);
enum Kind {
     attr_pcs,
     attr_pcs_vfp,
 
     FirstEnumOperandKind = attr_objc_gc,
     LastEnumOperandKind = attr_pcs_vfp,
 
     // No operand.
     attr_noreturn,
+    attr_nocf_check,
     attr_cdecl,
     attr_fastcall,
     attr_stdcall,
     attr_thiscall,
     attr_regcall,
     attr_pascal,
     attr_swiftcall,
     attr_vectorcall,

include/clang/Basic/Attr.td

 }
 
 def AnyX86NoCallerSavedRegisters : InheritableAttr,
                                    TargetSpecificAttr<TargetAnyX86> {
   let Spellings = [GCC<"no_caller_saved_registers">];
   let Documentation = [AnyX86NoCallerSavedRegistersDocs];
 }
 
+def AnyX86NoCfCheck : InheritableAttr, TargetSpecificAttr<TargetAnyX86>{
+  let Spellings = [GCC<"nocf_check">];
+  let Subjects = SubjectList<[FunctionLike]>;
+  let Documentation = [AnyX86NoCfCheckDocs];
+}
+
 def X86ForceAlignArgPointer : InheritableAttr, TargetSpecificAttr<TargetAnyX86> {
   let Spellings = [GCC<"force_align_arg_pointer">];
   // Technically, this appertains to a FunctionDecl, but the target-specific
   // code silently allows anything function-like (such as typedefs or function
   // pointers), but does not apply the attribute to them.
   let Documentation = [X86ForceAlignArgPointerDocs];
 }
 

include/clang/Basic/AttrDocs.td

.. code-block:: c
     __attribute__ ((force_align_arg_pointer))
     void f () {
       ...
     }
 
   }];
 }
 
+def AnyX86NoCfCheckDocs : Documentation{
+  let Category = DocCatFunction;
+  let Content = [{
+Jump Oriented Programming attacks rely on tampering with addresses used by
+indirect call / jmp, e.g. redirect control-flow to non-programmer
+intended bytes in the binary.
+X86 Supports Indirect Branch Tracking (IBT) as part of Control-Flow
+Enforcement Technology (CET). IBT instruments ENDBR instructions used to
+specify valid targets of indirect call / jmp.
+The ``nocf_check`` attribute has two roles:
+1. Appertains to a function - do not add ENDBR instruction at the
+    beginning of the function.
+2. Appertains to a function pointer - do not track the target
+    function of this pointer (by adding nocf_check prefix to the
+    indirect-call instruction).
+}];
+}
+
 def SwiftCallDocs : Documentation {
   let Category = DocCatVariable;
   let Content = [{
 The ``swiftcall`` attribute indicates that a function should be called
 using the Swift calling convention for a function or function pointer.
 
 The lowering for the Swift calling convention, as described by the Swift
 ABI documentation, occurs in multiple phases.  The first, "high-level"

include/clang/Basic/DiagnosticSemaKinds.td

 def warn_dllimport_dropped_from_inline_function : Warning<
   "%q0 redeclared inline; %1 attribute ignored">,
   InGroup<IgnoredAttributes>;
 def warn_attribute_ignored : Warning<"%0 attribute ignored">,
   InGroup<IgnoredAttributes>;
 def warn_attribute_ignored_on_inline :
   Warning<"%0 attribute ignored on inline function">,
   InGroup<IgnoredAttributes>;
+def warn_nocf_check_attribute_ignored :
+  Warning<"'nocf_check' attribute ignored; use -fcf-protection to enable the attribute">,
+  InGroup<IgnoredAttributes>;
 def warn_attribute_after_definition_ignored : Warning<
   "attribute %0 after definition is ignored">,
    InGroup<IgnoredAttributes>;
 def warn_unknown_attribute_ignored : Warning<
   "unknown attribute %0 ignored">, InGroup<UnknownAttributes>;
 def warn_cxx11_gnu_attribute_on_type : Warning<
   "attribute %0 ignored, because it cannot be applied to a type">,
   InGroup<IgnoredAttributes>;

include/clang/Basic/LangOptions.def

 /// \brief FP_CONTRACT mode (on/off/fast).
 ENUM_LANGOPT(DefaultFPContractMode, FPContractModeKind, 2, FPC_Off, "FP contraction type")
 LANGOPT(NoBitFieldTypeAlign , 1, 0, "bit-field type alignment")
 LANGOPT(HexagonQdsp6Compat , 1, 0, "hexagon-qdsp6 backward compatibility")
 LANGOPT(ObjCAutoRefCount , 1, 0, "Objective-C automated reference counting")
 LANGOPT(ObjCWeakRuntime     , 1, 0, "__weak support in the ARC runtime")
 LANGOPT(ObjCWeak            , 1, 0, "Objective-C __weak in ARC and MRC files")
 LANGOPT(ObjCSubscriptingLegacyRuntime         , 1, 0, "Subscripting support in legacy ObjectiveC runtime")
+LANGOPT(CFProtectionBranch , 1, 0, "Control-Flow Branch Protection enabled")
 LANGOPT(FakeAddressSpaceMap , 1, 0, "OpenCL fake address space map")
 ENUM_LANGOPT(AddressSpaceMapMangling , AddrSpaceMapMangling, 2, ASMM_Target, "OpenCL address space map mangling mode")
 LANGOPT(IncludeDefaultHeader, 1, 0, "Include default header file for OpenCL")
 BENIGN_LANGOPT(DelayedTemplateParsing , 1, 0, "delayed template parsing")
 LANGOPT(BlocksRuntimeOptional , 1, 0, "optional blocks runtime")
 
 ENUM_LANGOPT(GC, GCMode, 2, NonGC, "Objective-C Garbage Collection mode")
 ENUM_LANGOPT(ValueVisibilityMode, Visibility, 3, DefaultVisibility,

include/clang/CodeGen/CGFunctionInfo.h

class CGFunctionInfo final
 
   /// Whether this function saved caller registers.
   unsigned NoCallerSavedRegs : 1;
 
   /// How many arguments to pass inreg.
   unsigned HasRegParm : 1;
   unsigned RegParm : 3;
 
+  /// Whether this function has nocf_check attribute.
+  unsigned NoCfCheck : 1;
+
   RequiredArgs Required;
 
   /// The struct representing all arguments passed in memory.  Only used when
   /// passing non-trivial types with inalloca.  Not part of the profile.
   llvm::StructType *ArgStruct;
   unsigned ArgStructAlign : 31;
   unsigned HasExtParameterInfos : 1;
 
public:
 
   /// In ARC, whether this function retains its return value.  This
   /// is not always reliable for call sites.
   bool isReturnsRetained() const { return ReturnsRetained; }
 
   /// Whether this function no longer saves caller registers.
   bool isNoCallerSavedRegs() const { return NoCallerSavedRegs; }
 
+  /// Whether this function has nocf_check attribute.
+  bool isNoCfCheck() const { return NoCfCheck; }
+
   /// getASTCallingConvention() - Return the AST-specified calling
   /// convention.
   CallingConv getASTCallingConvention() const {
     return CallingConv(ASTCallingConvention);
   }
 
   /// getCallingConvention - Return the user specified calling
   /// convention, which has been translated into an LLVM CC.
public:
   }
 
   bool getHasRegParm() const { return HasRegParm; }
   unsigned getRegParm() const { return RegParm; }
 
   FunctionType::ExtInfo getExtInfo() const {
     return FunctionType::ExtInfo(isNoReturn(), getHasRegParm(), getRegParm(),
                                  getASTCallingConvention(), isReturnsRetained(),
-                                 isNoCallerSavedRegs());
+                                 isNoCallerSavedRegs(), isNoCfCheck());
   }
 
   CanQualType getReturnType() const { return getArgsBuffer()[0].type; }
 
   ABIArgInfo &getReturnInfo() { return getArgsBuffer()[0].info; }
   const ABIArgInfo &getReturnInfo() const { return getArgsBuffer()[0].info; }
 
   ArrayRef<ExtParameterInfo> getExtParameterInfos() const {
void Profile(llvm::FoldingSetNodeID &ID) {
     ID.AddInteger(getASTCallingConvention());
     ID.AddBoolean(InstanceMethod);
     ID.AddBoolean(ChainCall);
     ID.AddBoolean(NoReturn);
     ID.AddBoolean(ReturnsRetained);
     ID.AddBoolean(NoCallerSavedRegs);
     ID.AddBoolean(HasRegParm);
     ID.AddInteger(RegParm);
+    ID.AddBoolean(NoCfCheck);
     ID.AddInteger(Required.getOpaqueData());
     ID.AddBoolean(HasExtParameterInfos);
     if (HasExtParameterInfos) {
       for (auto paramInfo : getExtParameterInfos())
         ID.AddInteger(paramInfo.getOpaqueValue());
     }
     getReturnType().Profile(ID);
     for (const auto &I : arguments())
static void Profile(llvm::FoldingSetNodeID &ID,
     ID.AddInteger(info.getCC());
     ID.AddBoolean(InstanceMethod);
     ID.AddBoolean(ChainCall);
     ID.AddBoolean(info.getNoReturn());
     ID.AddBoolean(info.getProducesResult());
     ID.AddBoolean(info.getNoCallerSavedRegs());
     ID.AddBoolean(info.getHasRegParm());
     ID.AddInteger(info.getRegParm());
+    ID.AddBoolean(info.getNoCfCheck());
     ID.AddInteger(required.getOpaqueData());
     ID.AddBoolean(!paramInfos.empty());
     if (!paramInfos.empty()) {
       for (auto paramInfo : paramInfos)
         ID.AddInteger(paramInfo.getOpaqueValue());
     }
     resultType.Profile(ID);
     for (ArrayRef<CanQualType>::iterator

include/clang/Sema/Sema.h

public:
   /// attributes. By default, we look through references (the behavior used by
   /// nonnull), but if the second parameter is true, then we treat a reference
   /// type as valid.
   bool isValidPointerAttrType(QualType T, bool RefOkay = false);
 
   bool CheckRegparmAttr(const AttributeList &attr, unsigned &value);
   bool CheckCallingConvAttr(const AttributeList &attr, CallingConv &CC,
                             const FunctionDecl *FD = nullptr);
-  bool CheckNoReturnAttr(const AttributeList &attr);
-  bool CheckNoCallerSavedRegsAttr(const AttributeList &attr);
+  bool CheckAttrTarget(const AttributeList &CurrAttr);
+  bool CheckAttrNoArgs(const AttributeList &CurrAttr);
   bool checkStringLiteralArgumentAttr(const AttributeList &Attr,
                                       unsigned ArgNum, StringRef &Str,
                                       SourceLocation *ArgLocation = nullptr);
   bool checkSectionName(SourceLocation LiteralLoc, StringRef Str);
   bool checkTargetAttr(SourceLocation LiteralLoc, StringRef Str);
   bool checkMSInheritanceAttrOnDefinition(
       CXXRecordDecl *RD, SourceRange Range, bool BestCase,
       MSInheritanceAttr::Spelling SemanticSpelling);
 

lib/AST/ASTContext.cpp

if (lbaseInfo.getHasRegParm() != rbaseInfo.getHasRegParm())
     return QualType();
   if (lbaseInfo.getRegParm() != rbaseInfo.getRegParm())
     return QualType();
 
   if (lbaseInfo.getProducesResult() != rbaseInfo.getProducesResult())
     return QualType();
   if (lbaseInfo.getNoCallerSavedRegs() != rbaseInfo.getNoCallerSavedRegs())
     return QualType();
+  if (lbaseInfo.getNoCfCheck() != rbaseInfo.getNoCfCheck())
+    return QualType();
 
   // FIXME: some uses, e.g. conditional exprs, really want this to be 'both'.
   bool NoReturn = lbaseInfo.getNoReturn() || rbaseInfo.getNoReturn();
 
   if (lbaseInfo.getNoReturn() != NoReturn)
     allLTypes = false;
   if (rbaseInfo.getNoReturn() != NoReturn)
     allRTypes = false;

lib/AST/Type.cpp

bool AttributedType::isQualifier() const {
   case AttributedType::attr_ms_abi:
   case AttributedType::attr_sysv_abi:
   case AttributedType::attr_ptr32:
   case AttributedType::attr_ptr64:
   case AttributedType::attr_sptr:
   case AttributedType::attr_uptr:
   case AttributedType::attr_objc_kindof:
   case AttributedType::attr_ns_returns_retained:
+  case AttributedType::attr_nocf_check:
     return false;
   }
   llvm_unreachable("bad attributed type kind");
 }
 
 bool AttributedType::isMSTypeSpec() const {
   switch (getAttrKind()) {
   default:  return false;
bool AttributedType::isCallingConv() const {
   case attr_objc_ownership:
   case attr_objc_inert_unsafe_unretained:
   case attr_noreturn:
   case attr_nonnull:
   case attr_ns_returns_retained:
   case attr_nullable:
   case attr_null_unspecified:
   case attr_objc_kindof:
+  case attr_nocf_check:
     return false;
 
   case attr_pcs:
   case attr_pcs_vfp:
   case attr_cdecl:
   case attr_fastcall:
   case attr_stdcall:
   case attr_thiscall:

lib/AST/TypePrinter.cpp

if (Info.getNoReturn())
     OS << " __attribute__((noreturn))";
   if (Info.getProducesResult())
     OS << " __attribute__((ns_returns_retained))";
   if (Info.getRegParm())
     OS << " __attribute__((regparm ("
        << Info.getRegParm() << ")))";
   if (Info.getNoCallerSavedRegs())
     OS << " __attribute__((no_caller_saved_registers))";
+  if (Info.getNoCfCheck())
+    OS << " __attribute__((nocf_check))";
 }
 
 void TypePrinter::printFunctionNoProtoBefore(const FunctionNoProtoType *T, 
                                              raw_ostream &OS) { 
   // If needed for precedence reasons, wrap the inner part in grouping parens.
   SaveAndRestore<bool> PrevPHIsEmpty(HasEmptyPlaceHolder, false);
   printBefore(T->getReturnType(), OS);
   if (!PrevPHIsEmpty.get())
void TypePrinter::printAttributedAfter(const AttributedType *T,
 
   case AttributedType::attr_ns_returns_retained:
     OS << "ns_returns_retained";
     break;
 
   // FIXME: When Sema learns to form this AttributedType, avoid printing the
   // attribute again in printFunctionProtoAfter.
   case AttributedType::attr_noreturn: OS << "noreturn"; break;
-
+  case AttributedType::attr_nocf_check: OS << "nocf_check"; break;
   case AttributedType::attr_cdecl: OS << "cdecl"; break;
   case AttributedType::attr_fastcall: OS << "fastcall"; break;
   case AttributedType::attr_stdcall: OS << "stdcall"; break;
   case AttributedType::attr_thiscall: OS << "thiscall"; break;
   case AttributedType::attr_swiftcall: OS << "swiftcall"; break;
   case AttributedType::attr_vectorcall: OS << "vectorcall"; break;
   case AttributedType::attr_pascal: OS << "pascal"; break;
   case AttributedType::attr_ms_abi: OS << "ms_abi"; break;

lib/CodeGen/CGCall.cpp

CGFunctionInfo *CGFunctionInfo::create(unsigned llvmCC,
   FI->CallingConvention = llvmCC;
   FI->EffectiveCallingConvention = llvmCC;
   FI->ASTCallingConvention = info.getCC();
   FI->InstanceMethod = instanceMethod;
   FI->ChainCall = chainCall;
   FI->NoReturn = info.getNoReturn();
   FI->ReturnsRetained = info.getProducesResult();
   FI->NoCallerSavedRegs = info.getNoCallerSavedRegs();
+  FI->NoCfCheck = info.getNoCfCheck();
   FI->Required = required;
   FI->HasRegParm = info.getHasRegParm();
   FI->RegParm = info.getRegParm();
   FI->ArgStruct = nullptr;
   FI->ArgStructAlign = 0;
   FI->NumArgs = argTypes.size();
   FI->HasExtParameterInfos = !paramInfos.empty();
   FI->getArgsBuffer()[0].type = resultType;
if (TargetDecl->hasAttr<ConstAttr>()) {
       FuncAttrs.addAttribute(llvm::Attribute::NoUnwind);
     }
     if (TargetDecl->hasAttr<RestrictAttr>())
       RetAttrs.addAttribute(llvm::Attribute::NoAlias);
     if (TargetDecl->hasAttr<ReturnsNonNullAttr>())
       RetAttrs.addAttribute(llvm::Attribute::NonNull);
     if (TargetDecl->hasAttr<AnyX86NoCallerSavedRegistersAttr>())
       FuncAttrs.addAttribute("no_caller_saved_registers");
+    if (TargetDecl->hasAttr<AnyX86NoCfCheckAttr>())
+      FuncAttrs.addAttribute(llvm::Attribute::NoCfCheck);
 
     HasOptnone = TargetDecl->hasAttr<OptimizeNoneAttr>();
     if (auto *AllocSize = TargetDecl->getAttr<AllocSizeAttr>()) {
       Optional<unsigned> NumElemsParam;
       // alloc_size args are base-1, 0 means not present.
       if (unsigned N = AllocSize->getNumElemsParam())
         NumElemsParam = N - 1;
       FuncAttrs.addAllocSizeAttr(AllocSize->getElemSizeParam() - 1,

lib/Frontend/CompilerInvocation.cpp

#include "clang/Frontend/LangStandards.def"
       const LangStandard &Std = LangStandard::getLangStandardForKind(LangStd);
       if (!IsInputCompatibleWithStandard(IK, Std)) {
         Diags.Report(diag::err_drv_argument_not_allowed_with)
           << A->getAsString(Args) << GetInputKindName(IK);
       }
     }
   }
 
+  if (const Arg *A = Args.getLastArg(OPT_fcf_protection_EQ)) {
+    StringRef Name = A->getValue();
+    if (Name == "full" || Name == "branch") {
+      Opts.CFProtectionBranch = 1;
+    }
+  }
   // -cl-std only applies for OpenCL language standards.
   // Override the -std option in this case.
   if (const Arg *A = Args.getLastArg(OPT_cl_std_EQ)) {
     LangStandard::Kind OpenCLLangStd
       = llvm::StringSwitch<LangStandard::Kind>(A->getValue())
         .Cases("cl", "CL", LangStandard::lang_opencl10)
         .Cases("cl1.1", "CL1.1", LangStandard::lang_opencl11)
         .Cases("cl1.2", "CL1.2", LangStandard::lang_opencl12)

lib/Sema/SemaDeclAttr.cpp

static void handleNakedAttr(Sema &S, Decl *D, const AttributeList &Attr) {
   }
 
   D->addAttr(::new (S.Context) NakedAttr(Attr.getRange(), S.Context,
                                          Attr.getAttributeSpellingListIndex()));
 }
 
 static void handleNoReturnAttr(Sema &S, Decl *D, const AttributeList &Attrs) {
   if (hasDeclarator(D)) return;
 
-  if (S.CheckNoReturnAttr(Attrs))
-    return;
-
   if (!isa<ObjCMethodDecl>(D)) {
     S.Diag(Attrs.getLoc(), diag::warn_attribute_wrong_decl_type)
         << Attrs.getName() << ExpectedFunctionOrMethod;
     return;
   }
 
   D->addAttr(::new (S.Context) NoReturnAttr(
       Attrs.getRange(), S.Context, Attrs.getAttributeSpellingListIndex()));
 }
 
-static void handleNoCallerSavedRegsAttr(Sema &S, Decl *D,
-                                        const AttributeList &Attr) {
-  if (S.CheckNoCallerSavedRegsAttr(Attr))
-    return;
-
-  D->addAttr(::new (S.Context) AnyX86NoCallerSavedRegistersAttr(
-      Attr.getRange(), S.Context, Attr.getAttributeSpellingListIndex()));
+static void handleNoCfCheckAttr(Sema &S, Decl *D, const AttributeList &CurrAttr) {
+  if (!S.getLangOpts().CFProtectionBranch)
+    S.Diag(CurrAttr.getLoc(), diag::warn_nocf_check_attribute_ignored);
+  else
+    handleSimpleAttribute<AnyX86NoCfCheckAttr>(S, D, CurrAttr);
 }
 
-bool Sema::CheckNoReturnAttr(const AttributeList &Attrs) {
-  if (!checkAttributeNumArgs(*this, Attrs, 0)) {
-    Attrs.setInvalid();
+bool Sema::CheckAttrNoArgs(const AttributeList &CurrAttr) {
+  if (!checkAttributeNumArgs(*this, CurrAttr, 0)) {
+    CurrAttr.setInvalid();
     return true;
   }
 
   return false;
 }
 
-bool Sema::CheckNoCallerSavedRegsAttr(const AttributeList &Attr) {
+bool Sema::CheckAttrTarget(const AttributeList &Attr) {
   // Check whether the attribute is valid on the current target.
   if (!Attr.existsInTarget(Context.getTargetInfo())) {
     Diag(Attr.getLoc(), diag::warn_unknown_attribute_ignored) << Attr.getName();
     Attr.setInvalid();
     return true;
   }
 
-  if (!checkAttributeNumArgs(*this, Attr, 0)) {
-    Attr.setInvalid();
-    return true;
-  }
-
   return false;
 }
 
 static void handleAnalyzerNoReturnAttr(Sema &S, Decl *D,
                                        const AttributeList &Attr) {
   
   // The checking path for 'noreturn' and 'analyzer_noreturn' are different
   // because 'analyzer_noreturn' does not impact the type.
   if (!isFunctionOrMethodOrBlock(D)) {
if (Attr.getMinArgs() == Attr.getMaxArgs()) {
     if (Attr.getMinArgs() &&
         !checkAttributeAtLeastNumArgs(S, Attr, Attr.getMinArgs()))
       return true;
     else if (!Attr.hasVariadicArg() && Attr.getMaxArgs() &&
              !checkAttributeAtMostNumArgs(S, Attr, Attr.getMaxArgs()))
       return true;
   }
 
+  if (S.CheckAttrTarget(Attr))
+    return true;
+
   return false;
 }
 
 static void handleOpenCLAccessAttr(Sema &S, Decl *D,
                                    const AttributeList &Attr) {
   if (D->isInvalidDecl())
     return;
 
case AttributeList::AT_Hot:
     handleHotAttr(S, D, Attr);
     break;
   case AttributeList::AT_Naked:
     handleNakedAttr(S, D, Attr);
     break;
   case AttributeList::AT_NoReturn:
     handleNoReturnAttr(S, D, Attr);
     break;
+  case AttributeList::AT_AnyX86NoCfCheck:
+    handleNoCfCheckAttr(S, D, Attr);
+    break;
   case AttributeList::AT_NoThrow:
     handleSimpleAttribute<NoThrowAttr>(S, D, Attr);
     break;
   case AttributeList::AT_CUDAShared:
     handleSharedAttr(S, D, Attr);
     break;
   case AttributeList::AT_VecReturn:
     handleVecReturnAttr(S, D, Attr);
static void ProcessDeclAttribute(Sema &S, Scope *scope, Decl *D,
   // Type safety attributes.
   case AttributeList::AT_ArgumentWithTypeTag:
     handleArgumentWithTypeTagAttr(S, D, Attr);
     break;
   case AttributeList::AT_TypeTagForDatatype:
     handleTypeTagForDatatypeAttr(S, D, Attr);
     break;
   case AttributeList::AT_AnyX86NoCallerSavedRegisters:
-    handleNoCallerSavedRegsAttr(S, D, Attr);
+    handleSimpleAttribute<AnyX86NoCallerSavedRegistersAttr>(S, D, Attr);
     break;
   case AttributeList::AT_RenderScriptKernel:
     handleSimpleAttribute<RenderScriptKernelAttr>(S, D, Attr);
     break;
   // XRay attributes.
   case AttributeList::AT_XRayInstrument:
     handleSimpleAttribute<XRayInstrumentAttr>(S, D, Attr);
     break;

lib/Sema/SemaType.cpp

#define CALLING_CONV_ATTRS_CASELIST \
     case AttributeList::AT_PreserveAll
 
 // Function type attributes.
 #define FUNCTION_TYPE_ATTRS_CASELIST \
   case AttributeList::AT_NSReturnsRetained: \
   case AttributeList::AT_NoReturn: \
   case AttributeList::AT_Regparm: \
   case AttributeList::AT_AnyX86NoCallerSavedRegisters: \
+  case AttributeList::AT_AnyX86NoCfCheck: \
     CALLING_CONV_ATTRS_CASELIST
 
 // Microsoft-specific type qualifiers.
 #define MS_TYPE_ATTRS_CASELIST  \
     case AttributeList::AT_Ptr32: \
     case AttributeList::AT_Ptr64: \
     case AttributeList::AT_SPtr: \
     case AttributeList::AT_UPtr
case AttributedType::attr_neon_polyvector_type:
     return AttributeList::AT_NeonPolyVectorType;
   case AttributedType::attr_objc_gc:
     return AttributeList::AT_ObjCGC;
   case AttributedType::attr_objc_ownership:
   case AttributedType::attr_objc_inert_unsafe_unretained:
     return AttributeList::AT_ObjCOwnership;
   case AttributedType::attr_noreturn:
     return AttributeList::AT_NoReturn;
+  case AttributedType::attr_nocf_check:
+    return AttributeList::AT_AnyX86NoCfCheck;
   case AttributedType::attr_cdecl:
     return AttributeList::AT_CDecl;
   case AttributedType::attr_fastcall:
     return AttributeList::AT_FastCall;
   case AttributedType::attr_stdcall:
     return AttributeList::AT_StdCall;
   case AttributedType::attr_thiscall:
     return AttributeList::AT_ThisCall;

 static bool handleFunctionTypeAttr(TypeProcessingState &state,
                                    AttributeList &attr,
                                    QualType &type) {
   Sema &S = state.getSema();
 
   FunctionTypeUnwrapper unwrapped(S, type);
 
   if (attr.getKind() == AttributeList::AT_NoReturn) {
-    if (S.CheckNoReturnAttr(attr))
+    if (S.CheckAttrNoArgs(attr))
       return true;
 
     // Delay if this is not a function type.
     if (!unwrapped.isFunctionType())
       return false;
 
     // Otherwise we can process right away.
     FunctionType::ExtInfo EI = unwrapped.get()->getExtInfo().withNoReturn(true);
if (state.getSema().getLangOpts().ObjCAutoRefCount) {
       type = unwrapped.wrap(S, S.Context.adjustFunctionType(unwrapped.get(), EI));
     }
     type = S.Context.getAttributedType(AttributedType::attr_ns_returns_retained,
                                        origType, type);
     return true;
   }
 
   if (attr.getKind() == AttributeList::AT_AnyX86NoCallerSavedRegisters) {
-    if (S.CheckNoCallerSavedRegsAttr(attr))
+    if (S.CheckAttrTarget(attr) || S.CheckAttrNoArgs(attr))
       return true;
 
     // Delay if this is not a function type.
     if (!unwrapped.isFunctionType())
       return false;
 
     FunctionType::ExtInfo EI =
         unwrapped.get()->getExtInfo().withNoCallerSavedRegs(true);
     type = unwrapped.wrap(S, S.Context.adjustFunctionType(unwrapped.get(), EI));
     return true;
   }
 
+  if (attr.getKind() == AttributeList::AT_AnyX86NoCfCheck) {
+    if (!S.getLangOpts().CFProtectionBranch) {
+      S.Diag(attr.getLoc(), diag::warn_nocf_check_attribute_ignored);
+      return true;
+    }
+
+    if (S.CheckAttrTarget(attr) || S.CheckAttrNoArgs(attr))
+      return true;
+
+    // If this is not a function type, warning will be asserted by subject 
+    // check.
+    if (!unwrapped.isFunctionType())
+      return true;
+
+    FunctionType::ExtInfo EI =
+      unwrapped.get()->getExtInfo().withNoCfCheck(true);
+    type = unwrapped.wrap(S, S.Context.adjustFunctionType(unwrapped.get(), EI));
+    return true;
+  }
+
   if (attr.getKind() == AttributeList::AT_Regparm) {
     unsigned value;
     if (S.CheckRegparmAttr(attr, value))
       return true;
 
     // Delay if this is not a function type.
     if (!unwrapped.isFunctionType())
       return false;

lib/Serialization/ASTReader.cpp

case TYPE_EXT_VECTOR: {
     }
 
     QualType ElementType = readType(*Loc.F, Record, Idx);
     unsigned NumElements = Record[1];
     return Context.getExtVectorType(ElementType, NumElements);
   }
 
   case TYPE_FUNCTION_NO_PROTO: {
-    if (Record.size() != 7) {
+    if (Record.size() != 8) {
       Error("incorrect encoding of no-proto function type");
       return QualType();
     }
     QualType ResultType = readType(*Loc.F, Record, Idx);
     FunctionType::ExtInfo Info(Record[1], Record[2], Record[3],
-                               (CallingConv)Record[4], Record[5], Record[6]);
+                               (CallingConv)Record[4], Record[5], Record[6], 
+                               Record[7]);
     return Context.getFunctionNoProtoType(ResultType, Info);
   }
 
   case TYPE_FUNCTION_PROTO: {
     QualType ResultType = readType(*Loc.F, Record, Idx);
 
     FunctionProtoType::ExtProtoInfo EPI;
     EPI.ExtInfo = FunctionType::ExtInfo(/*noreturn*/ Record[1],
                                         /*hasregparm*/ Record[2],
                                         /*regparm*/ Record[3],
                                         static_cast<CallingConv>(Record[4]),
                                         /*produces*/ Record[5],
-                                        /*nocallersavedregs*/ Record[6]);
+                                        /*nocallersavedregs*/ Record[6],
+                                        /*nocfcheck*/ Record[7]);
 
-    unsigned Idx = 7;
+    unsigned Idx = 8;
 
     EPI.Variadic = Record[Idx++];
     EPI.HasTrailingReturn = Record[Idx++];
     EPI.TypeQuals = Record[Idx++];
     EPI.RefQualifier = static_cast<RefQualifierKind>(Record[Idx++]);
     SmallVector<QualType, 8> ExceptionStorage;
     readExceptionSpec(*Loc.F, ExceptionStorage, EPI.ExceptionSpec, Record, Idx);
 

lib/Serialization/ASTWriter.cpp

void ASTTypeWriter::VisitFunctionType(const FunctionType *T) {
   FunctionType::ExtInfo C = T->getExtInfo();
   Record.push_back(C.getNoReturn());
   Record.push_back(C.getHasRegParm());
   Record.push_back(C.getRegParm());
   // FIXME: need to stabilize encoding of calling convention...
   Record.push_back(C.getCC());
   Record.push_back(C.getProducesResult());
   Record.push_back(C.getNoCallerSavedRegs());
+  Record.push_back(C.getNoCfCheck());
 
   if (C.getHasRegParm() || C.getRegParm() || C.getProducesResult())
     AbbrevToUse = 0;
 }
 
 void ASTTypeWriter::VisitFunctionNoProtoType(const FunctionNoProtoType *T) {
   VisitFunctionType(T);
   Code = TYPE_FUNCTION_NO_PROTO;
void ASTWriter::WriteTypeAbbrevs() {
   // FunctionType
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::VBR, 6));   // ReturnType
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Fixed, 1)); // NoReturn
   Abv->Add(BitCodeAbbrevOp(0));                         // HasRegParm
   Abv->Add(BitCodeAbbrevOp(0));                         // RegParm
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Fixed, 4)); // CC
   Abv->Add(BitCodeAbbrevOp(0));                         // ProducesResult
   Abv->Add(BitCodeAbbrevOp(0));                         // NoCallerSavedRegs
+  Abv->Add(BitCodeAbbrevOp(0));                         // NoCfCheck
   // FunctionProtoType
   Abv->Add(BitCodeAbbrevOp(0));                         // IsVariadic
   Abv->Add(BitCodeAbbrevOp(0));                         // HasTrailingReturn
   Abv->Add(BitCodeAbbrevOp(0));                         // TypeQuals
   Abv->Add(BitCodeAbbrevOp(0));                         // RefQualifier
   Abv->Add(BitCodeAbbrevOp(EST_None));                  // ExceptionSpec
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::VBR, 6));   // NumParams
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Array));

test/CodeGen/attributes.c

-// RUN: %clang_cc1 -emit-llvm -triple i386-linux-gnu -o %t %s
+// RUN: %clang_cc1 -emit-llvm -fcf-protection=branch -target-feature +ibt -triple i386-linux-gnu -o %t %s
 // RUN: FileCheck --input-file=%t %s
 
 // CHECK: @t5 = weak global i32 2
 int t5 __attribute__((weak)) = 2;
 
 // CHECK: @t13 = global %struct.s0 zeroinitializer, section "SECT"
 struct s0 { int x; };
 struct s0 t13 __attribute__((section("SECT"))) = { 0 };

 
 // PR9356: We might want to err on this, but for now at least make sure we
 // use the section in the definition.
 void __attribute__((section(".foo"))) t22(void);
 void __attribute__((section(".bar"))) t22(void) {}
 
 // CHECK: define void @t22() [[NUW]] section ".bar"
 
+// CHECK: define void @t23() [[NOCF_CHECK_FUNC:#[0-9]+]]
+void __attribute__((nocf_check)) t23(void) {}
+
+// CHECK: call void %{{[a-z0-9]+}}() [[NOCF_CHECK_CALL:#[0-9]+]]
+typedef void (*f_t)(void);
+void t24(f_t f1) {
+  __attribute__((nocf_check)) f_t p = f1;
+  (*p)();
+}
+
 // CHECK: attributes [[NUW]] = { noinline nounwind{{.*}} }
 // CHECK: attributes [[NR]] = { noinline noreturn nounwind{{.*}} }
 // CHECK: attributes [[COLDDEF]] = { cold {{.*}}}
 // CHECK: attributes [[COLDDECL]] = { cold {{.*}}}
+// CHECK: attributes [[NOCF_CHECK_FUNC]] = { nocf_check {{.*}}}
 // CHECK: attributes [[COLDSITE]] = { cold {{.*}}}
+// CHECK: attributes [[NOCF_CHECK_CALL]] = { nocf_check }

test/CodeGen/cetintrin.c

-// RUN: %clang_cc1 -ffreestanding %s -triple=i386-apple-darwin -target-feature +shstk -emit-llvm -o - -Wall -Werror | FileCheck %s
-// RUN: %clang_cc1 -ffreestanding %s -triple=x86_64-apple-darwin -target-feature +shstk  -emit-llvm -o - -Wall -Werror | FileCheck %s --check-prefix=X86_64
+// RUN: %clang_cc1 -ffreestanding %s -triple=i386-unknown-unknown -target-feature +shstk -emit-llvm -o - -Wall -Werror | FileCheck %s
+// RUN: %clang_cc1 -ffreestanding %s -triple=x86_64-unknown-unknown -target-feature +shstk  -emit-llvm -o - -Wall -Werror | FileCheck %s --check-prefix=X86_64
 
 #include <immintrin.h>
 
 void test_incsspd(int a) {
   // CHECK-LABEL: @test_incsspd
   // CHECK:       call void @llvm.x86.incsspd(i32 %{{[0-9]+}})
   _incsspd(a);
 }

test/CodeGen/x86-cf-protection.c

-// RUN: not %clang_cc1 -fsyntax-only -S -emit-llvm -o %t -triple i386-unknown-unknown -fcf-protection=return %s 2>&1 | FileCheck %s --check-prefix=RETURN
-// RUN: not %clang_cc1 -fsyntax-only -S -emit-llvm -o %t -triple i386-unknown-unknown -fcf-protection=branch %s 2>&1 | FileCheck %s --check-prefix=BRANCH
+// RUN: not %clang_cc1 -fsyntax-only -S -o %t -triple i386-unknown-unknown -fcf-protection=return %s 2>&1 | FileCheck %s --check-prefix=RETURN
+// RUN: not %clang_cc1 -fsyntax-only -S -o %t -triple i386-unknown-unknown -fcf-protection=branch %s 2>&1 | FileCheck %s --check-prefix=BRANCH
 
 // RETURN: error: option 'cf-protection=return' cannot be specified without '-mshstk'
 // BRANCH: error: option 'cf-protection=branch' cannot be specified without '-mibt'
 void foo() {}

test/Misc/pragma-attribute-supported-attributes-list.test

 // RUN: clang-tblgen -gen-clang-test-pragma-attribute-supported-attributes -I%src_include_dir %src_include_dir/clang/Basic/Attr.td -o - | FileCheck %s
 
 // The number of supported attributes should never go down!
 
-// CHECK: #pragma clang attribute supports 66 attributes:
+// CHECK: #pragma clang attribute supports 67 attributes:
 // CHECK-NEXT: AMDGPUFlatWorkGroupSize (SubjectMatchRule_function)
 // CHECK-NEXT: AMDGPUNumSGPR (SubjectMatchRule_function)
 // CHECK-NEXT: AMDGPUNumVGPR (SubjectMatchRule_function)
 // CHECK-NEXT: AMDGPUWavesPerEU (SubjectMatchRule_function)
 // CHECK-NEXT: AVRSignal (SubjectMatchRule_function)
 // CHECK-NEXT: AbiTag (SubjectMatchRule_record_not_is_union, SubjectMatchRule_variable, SubjectMatchRule_function, SubjectMatchRule_namespace)
 // CHECK-NEXT: AlignValue (SubjectMatchRule_variable, SubjectMatchRule_type_alias)
 // CHECK-NEXT: AllocSize (SubjectMatchRule_function)
 // CHECK-NEXT: Annotate ()
+// CHECK-NEXT: AnyX86NoCfCheck (SubjectMatchRule_hasType_functionType)
 // CHECK-NEXT: AssumeAligned (SubjectMatchRule_objc_method, SubjectMatchRule_function)
 // CHECK-NEXT: Availability ((SubjectMatchRule_record, SubjectMatchRule_enum, SubjectMatchRule_enum_constant, SubjectMatchRule_field, SubjectMatchRule_function, SubjectMatchRule_namespace, SubjectMatchRule_objc_category, SubjectMatchRule_objc_interface, SubjectMatchRule_objc_method, SubjectMatchRule_objc_property, SubjectMatchRule_objc_protocol, SubjectMatchRule_record, SubjectMatchRule_type_alias, SubjectMatchRule_variable))
 // CHECK-NEXT: CXX11NoReturn (SubjectMatchRule_function)
 // CHECK-NEXT: CallableWhen (SubjectMatchRule_function_is_member)
 // CHECK-NEXT: CarriesDependency (SubjectMatchRule_variable_is_parameter, SubjectMatchRule_objc_method, SubjectMatchRule_function)
 // CHECK-NEXT: Consumable (SubjectMatchRule_record)
 // CHECK-NEXT: Convergent (SubjectMatchRule_function)
 // CHECK-NEXT: DLLExport (SubjectMatchRule_function, SubjectMatchRule_variable, SubjectMatchRule_record, SubjectMatchRule_objc_interface)

test/Sema/attr-nocf_check.c

+// RUN: %clang_cc1 -triple=x86_64-unknown-unknown -verify -fcf-protection=branch -target-feature +ibt -fsyntax-only %s
+
+// Function pointer definition.
+typedef void (*FuncPointerWithNoCfCheck)(void) __attribute__((nocf_check)); // no-warning
+typedef void (*FuncPointer)(void);
+
+// Dont allow function declaration and definition mismatch.
+void __attribute__((nocf_check)) testNoCfCheck();   // expected-note {{previous declaration is here}}
+void testNoCfCheck(){}; //  expected-error {{conflicting types for 'testNoCfCheck'}}
+
+// No variable or parameter declaration
+__attribute__((nocf_check)) int i;                              // expected-warning {{'nocf_check' attribute only applies to function}}
+void testNoCfCheckImpl(double __attribute__((nocf_check)) i) {} // expected-warning {{'nocf_check' attribute only applies to function}}
+
+// Allow attributed function pointers as well as casting between attributed
+// and non-attributed function pointers.
+void testNoCfCheckMismatch(FuncPointer f) {
+  FuncPointerWithNoCfCheck fNoCfCheck = f; // expected-warning {{incompatible function pointer types}}
+  (*fNoCfCheck)();                         // no-warning
+}
+
+// 'nocf_check' Attribute has no parameters.
+int testNoCfCheckParams() __attribute__((nocf_check(1))); // expected-error {{'nocf_check' attribute takes no arguments}}

test/Sema/attr-nocf_check.cpp

+// RUN: %clang_cc1 -triple=i386-unknown-unknown -verify -fcf-protection=branch -target-feature +ibt -std=c++11 -fsyntax-only %s
+
+// Function pointer definition.
+typedef void (*FuncPointerWithNoCfCheck)(void) __attribute__((nocf_check)); // no-warning
+typedef void (*FuncPointer)(void);
+
+// Dont allow function declaration and definition mismatch.
+void __attribute__((nocf_check)) testNoCfCheck();   // expected-note {{previous declaration is here}}
+void testNoCfCheck(){}; //  expected-error {{conflicting types for 'testNoCfCheck'}}
+
+// No variable or parameter declaration
+__attribute__((nocf_check)) int i;                              // expected-warning {{'nocf_check' attribute only applies to function}}
+void testNoCfCheckImpl(double __attribute__((nocf_check)) i) {} // expected-warning {{'nocf_check' attribute only applies to function}}
+
+// Allow attributed function pointers as well as casting between attributed
+// and non-attributed function pointers.
+void testNoCfCheckMismatch(FuncPointer f) {
+  FuncPointerWithNoCfCheck fNoCfCheck = f; // expected-error {{cannot initialize a variable of type 'FuncPointerWithNoCfCheck'}}
+  (*fNoCfCheck)();                         // no-warning
+}
+
+// 'nocf_check' Attribute has no parameters.
+int testNoCfCheckParams() __attribute__((nocf_check(1))); // expected-error {{'nocf_check' attribute takes no arguments}}

test/Sema/nocf_check_attr_not_allowed.c

+// RUN: %clang_cc1 -triple powerpc-unknown-linux-gnu -fsyntax-only -verify -fcf-protection=branch %s
+// RUN: %clang_cc1 -triple arm-unknown-linux-gnu -fsyntax-only -verify -fcf-protection=branch %s
+
+void __attribute__((nocf_check)) foo(); // expected-warning {{unknown attribute 'nocf_check' ignored}}