[IR] add fn attr for no_stack_protector; prevent inlining on mismatch

[nickdesaulniers]

Summary

It's currently ambiguous in IR whether the source language explicitly
did not want a stack a stack protector (in C, via function attribute
no_stack_protector) or doesn't care for any given function.

It's common for code that manipulates the stack via inline assembly or
that has to set up its own stack canary (such as the Linux kernel) would
like to avoid stack protectors in certain functions. In this case, we've
been bitten by numerous bugs where a callee with a stack protector is
inlined into an attribute((no_stack_protector)) caller, which
generally breaks the caller's assumptions about not having a stack
protector. LTO exacerbates the issue.

While developers can avoid this by putting all no_stack_protector
functions in one translation unit together and compiling those with
-fno-stack-protector, it's generally not very ergonomic or as
ergonomic as a function attribute, and still doesn't work for LTO. See also:
https://lore.kernel.org/linux-pm/[e-mail]/
https://lore.kernel.org/lkml/[e-mail]/T/#u

Typically, when inlining a callee into a caller, the caller will be
upgraded in its level of stack protection (see adjustCallerSSPLevel()).
By adding an explicit attribute in the IR when the function attribute is
used in the source language, we can now identify such cases and prevent
inlining. Block inlining when the callee and caller differ in the case that one
contains nossp when the other has ssp, sspstrong, or sspreq.

Fixes pr/47479.

[nickdesaulniers]

Not ready for review yet, posting a WIP fix for https://bugs.llvm.org/show_bug.cgi?id=47479.

TODO next week:

• tests, tests, and more tests.
• interaction with __attribute__((always_inline)).
• fix TODOs in code.
• IR verifier that the attributes never have more than one ssp attr; they should be mutually exclusive.

[nickdesaulniers]

• add tests, make fn attrs mutually exclusive

[nickdesaulniers]

I obviously have a few todos left to resolve, but CC'ing reviewers now for general feedback.

One thing I'm unsure of; it felt curious to me that nothing was enforcing that these different levels of stack protection were mutually exclusive. I've added that here, though I could fork that out to a separate patch. I do think it would be better if this was a "key"="value" attribute, which would simplify ensuring these were mutually exclusive (I think). I guess that would run afoul that previous IR would no longer be forward compatible; does LLVM have a policy on IR "breaks" like that? I guess making the mutually exclusive technically is a subtle change in behavior...should I not do that? Or if I do, should I document that somewhere else in addition?

Does the patch itself seem to be in good shape; and does the problem it solves make sense?

[nickdesaulniers]

clang/test/CodeGen/stack-protector.c

39

should be attributes plural.

llvm/include/llvm/Bitcode/LLVMBitCodes.h

610

any comments from reviewers before I go and do a tedious reordering of these enum values?

llvm/lib/IR/Attributes.cpp

1946–1947

This should be an anomalous situation due to the added verifier check. Should I make it an assert instead?

llvm/lib/Transforms/Utils/InlineFunction.cpp

1687

Is there a better way to emit an OptimizationRemark? Having this feedback in -Rpass=inline might be nice.

[nickdesaulniers]

bumping for review

[void]

llvm/lib/Transforms/Utils/InlineFunction.cpp

1679

s/the/that/

1682

Should we check whether the function with nossp needs an ssp before issuing the error?

[nickdesaulniers]

• address todos and review feedback

llvm/include/llvm/Bitcode/LLVMBitCodes.h

610

Oof, it looks like inserting ATTR_KIND_NO_STACK_PROTECT = 26 then reordering the rest causes the following tests to fail:

Failed Tests (17):
  LLVM :: Bitcode/DIExpression-aggresult.ll
  LLVM :: Bitcode/DITemplateParameter-5.0.ll
  LLVM :: Bitcode/PR23310.test
  LLVM :: Bitcode/apple-clang-700-compat.test
  LLVM :: Bitcode/attributes-3.3.ll
  LLVM :: Bitcode/case-ranges-3.3.ll
  LLVM :: Bitcode/compatibility-3.6.ll
  LLVM :: Bitcode/compatibility-3.7.ll
  LLVM :: Bitcode/compatibility-3.8.ll
  LLVM :: Bitcode/compatibility-3.9.ll
  LLVM :: Bitcode/compatibility-4.0.ll
  LLVM :: Bitcode/compatibility-5.0.ll
  LLVM :: Bitcode/compatibility-6.0.ll
  LLVM :: Bitcode/drop-debug-info.3.5.ll
  LLVM :: Bitcode/invalid-functionptr-align.ll
  LLVM :: Object/nm-bitcode.test
  LLVM :: tools/llvm-nm/X86/IRobj.test

under the assumption that new fn attr's should get monotonically increasing numbers, I'll stick this new one at the end. That should preserve bitcode compatibility, at the cost of the similar function routines not being grouped in successive order (which is a stylistic or subjective complaint).

llvm/lib/IR/Attributes.cpp

1954–1955

I should update this comment to say they're not mutually exclusive.

llvm/lib/Transforms/Utils/InlineFunction.cpp

1682

No; it should never be the case that "the function with nossp needs an ssp" since nossp and ssp are now mutually exclusive, nossp means "I know what I'm doing, and accept the consequences," and StackProtector::RequiresStackProtector will always return false in that case after my changes (even if it was a static method we could easily access, and not a private method of a separate pass).

[nickdesaulniers]

• add -passes='cgscc(inline)' to inline_nossp.ll

[nickdesaulniers]

llvm/docs/BitCodeFormat.rst

953

ah, I should remove this; this block is legacy encodings which I do not modify.

llvm/lib/IR/Verifier.cpp

1978–1985

I'd love to cast these booleans to unsigned and add them, but I find that all of the static_casts don't really make this more concise. Thoughts?

[nickdesaulniers]

• remove modification to docs about legacy fn attr encoding

[nickdesaulniers]

bumping for review

[void]

llvm/docs/LangRef.rst

1833

Do we care about the opposite situation where a function requiring a stack protector doesn't inline a function with the nossp attribute?

llvm/lib/IR/Attributes.cpp

1946–1947

If it should never happen, then please make it an assert.

llvm/lib/IR/Verifier.cpp

1978–1985

I think what you have is fine.

1987

Could use stronger language here. :-)

"nssp, ssp, sspreq, and sspstrong fn attrs are mutually exclusive."

[nickdesaulniers]

• rebase, use stronger language about mutual exclusion, prefer assert

[nickdesaulniers]

llvm/docs/LangRef.rst

1833

oh, shoot, you're right. I should have thought of that case. I need to address that in this patch. Ok, let me add more tests/code/docs for that.

[nickdesaulniers]

llvm/lib/Transforms/Utils/InlineFunction.cpp

1687

See llvm::setInlineRemark for how these are set.

[nickdesaulniers]

llvm/lib/Transforms/Utils/InlineFunction.cpp

1687

InlineAdvisor::recordUnsuccessfulInliningImpl already handles this.

[nickdesaulniers]

• handle additional case of ssp caller w/ nossp callee, update docs, add -Rpass-missed=inline test

[nickdesaulniers]

Started a thread with GCC folks (@marxin @jakubjelinek ) on this topic as well: https://lore.kernel.org/linux-toolchains/CAKwvOdnUB-SrPRXEF-oHpPvUfbuRL06Zd7LT9=[e-mail]/T/#u

[void]

Only a couple of nits, but I think this looks good.

llvm/docs/BitCodeFormat.rst

1072

I'm tempted to say that these two adds should be a separate commit, but it's a nit and I'll leave it up to you.

llvm/lib/Transforms/Utils/InlineFunction.cpp

1691

Suggestion: Improve the failure message to be a bit more descriptive. I.e. mention that it can't inline a function with stack protection into a function without stack protection and vice versa.

[nickdesaulniers]

llvm/lib/IR/Attributes.cpp

1946–1947

Ah this assertion is not quite right; we still would like to permit nossp callee being inlined into nossp caller. Let me add a test case for that, then make the assertion more precise about a mismatch between caller and callee.

[nickdesaulniers]

In phab here, it looks like my newly added clang/test/Frontend/optimization-remark-missed-inline-stack-protectors.c fails on windows because I redirect stdout to /dev/null. How does that work for other tests? I see other tests in that dir write to /dev/null. Oh, I guess -o /dev/null will just create a file called "/dev/null" on Windows? So I should do that rather than 1> /dev/null?

[void]

In D87956#2348433, @nickdesaulniers wrote:

In phab here, it looks like my newly added clang/test/Frontend/optimization-remark-missed-inline-stack-protectors.c fails on windows because I redirect stdout to /dev/null. How does that work for other tests? I see other tests in that dir write to /dev/null. Oh, I guess -o /dev/null will just create a file called "/dev/null" on Windows? So I should do that rather than 1> /dev/null?

Why not just use "expected-error" and the like?

[nickdesaulniers]

• rebase, add alwaysinline tests, use expected-remark, improve remarks

[nickdesaulniers]

In D87956#2348446, @void wrote:

Why not just use "expected-error" and the like?

Ah, brilliant! Thank you! Will wait to submit until tomorrow morning.

llvm/docs/BitCodeFormat.rst

1072

Done in rG4abaf0ec0a3c

[nickdesaulniers]

As a follow up, I probably want to make -fno-stack-protector sprinkle this new fn attr nossp all over everything; that and this should fix our LTO bug with no changes to the source, otherwise we can add __attribute__((no_stack_protector)) to the source (though GCC only landed support for that TODAY, so portability would be an issue there)..

[nickdesaulniers]

I missed adding to llvm/lib/Bitcode/Reader/BitcodeReader.cpp, so LTO is broken with this fn attribute...todo...fix

diff --git a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
index f8069b93103f..a99d6baa8d9d 100644
--- a/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
+++ b/llvm/lib/Bitcode/Reader/BitcodeReader.cpp
@@ -1537,6 +1537,8 @@ static Attribute::AttrKind getAttrFromCode(uint64_t Code) {
     return Attribute::ByRef;
   case bitc::ATTR_KIND_MUSTPROGRESS:
     return Attribute::MustProgress;
+  case bitc::ATTR_KIND_NO_STACK_PROTECT:
+    return Attribute::NoStackProtect;
   }
 }

[MaskRay]

clang/test/Frontend/optimization-remark-missed-inline-stack-protectors.c

1

Emm. I am a bit unsure that we need the clang/test/Frontend test. The inlining decision logic is coded into Utils/InlineFunction.cpp and tested by Transforms/Inline/inline_nossp.ll

clang is at a higher layer and does not need to understand the inlining decision.

llvm/docs/LangRef.rst

1827

Would this be confusing now that both nossp and ssp exist?

Is there an alternative design which can make this extensible? @jdoerfert

[aeubanks]

llvm/test/Transforms/Inline/inline_nossp.ll

3

This test fails with the NPM,
opt -passes=always-inline ...

Does llvm::isInlineViable() need to be updated?

[nickdesaulniers]

llvm/test/Transforms/Inline/inline_nossp.ll

3

Thanks for the report. Is there a Cmake configuration I need to explicitly set to reproduce? LLVM_USE_NEWPM?

[aeubanks]

llvm/test/Transforms/Inline/inline_nossp.ll

3

Just a new RUN line: RUN: opt -passes=always-inline -o - -S %s | FileCheck %s

[nickdesaulniers]

llvm/test/Transforms/Inline/inline_nossp.ll

3

I think I'm going to back out this patch and the fix ups, and pursue a much simpler approach: https://github.com/ClangBuiltLinux/llvm-project/commit/501847c5239be52bbe32a9c5bd0723e4d0ad2990.

[nickdesaulniers]

llvm/test/Transforms/Inline/inline_nossp.ll

3

reverted in f4c6080ab820219c5bf78b0c2143e7fa194da296

[nickdesaulniers]

Simpler approach: https://reviews.llvm.org/D91816

clang/include/clang/Basic/AttrDocs.td

 
 .. code-block:: c
 
     int __attribute__((no_stack_protector))
     foo (int x); // stack protection will be disabled for foo.
 
     int bar(int y); // bar can be built with the stack protector.
 
+A callee that has a stack protector will not be inlined into a
+``__attribute__((no_stack_protector))`` caller, and vice-versa, even if the
+callee is marked ``__attribute__((always_inline))``.
+
     }];
 }
 
 def NotTailCalledDocs : Documentation {
   let Category = DocCatFunction;
   let Content = [{
 The ``not_tail_called`` attribute prevents tail-call optimization on statically
 bound calls. It has no effect on indirect calls. Virtual functions, objective-c

clang/lib/CodeGen/CodeGenModule.cpp

if (CodeGenOpts.UnwindTables)
     B.addAttribute(llvm::Attribute::UWTable);
 
   if (CodeGenOpts.StackClashProtector)
     B.addAttribute("probe-stack", "inline-asm");
 
   if (!hasUnwindExceptions(LangOpts))
     B.addAttribute(llvm::Attribute::NoUnwind);
 
-  if (!D || !D->hasAttr<NoStackProtectorAttr>()) {
-    if (LangOpts.getStackProtector() == LangOptions::SSPOn)
-      B.addAttribute(llvm::Attribute::StackProtect);
-    else if (LangOpts.getStackProtector() == LangOptions::SSPStrong)
-      B.addAttribute(llvm::Attribute::StackProtectStrong);
-    else if (LangOpts.getStackProtector() == LangOptions::SSPReq)
-      B.addAttribute(llvm::Attribute::StackProtectReq);
-  }
+  if (D && D->hasAttr<NoStackProtectorAttr>())
+    B.addAttribute(llvm::Attribute::NoStackProtect);
+  else if (LangOpts.getStackProtector() == LangOptions::SSPOn)
 
   if (!D) {
     // If we don't have a declaration to control inlining, the function isn't
     // explicitly marked as alwaysinline for semantic reasons, and inlining is
     // disabled, mark the function as noinline.
     if (!F->hasFnAttribute(llvm::Attribute::AlwaysInline) &&
         CodeGenOpts.getInlining() == CodeGenOptions::OnlyAlwaysInlining)
       B.addAttribute(llvm::Attribute::NoInline);

clang/test/CodeGen/stack-protector.c

 }
 
 // NOSSP-NOT: attributes #[[A]] = {{.*}} ssp
 // SSP: attributes #[[A]] = {{.*}} ssp{{ }}
 // SSPSTRONG: attributes #[[A]] = {{.*}} sspstrong
 // SSPREQ: attributes #[[A]] = {{.*}} sspreq
 
 // SAFESTACK-NOSSP: attributes #[[A]] = {{.*}} safestack
-// SAFESTACK-NOSSP-NOT: ssp
+// SAFESTACK-NOSSP-NOT: attributes #[[A]] = {{.*}} ssp
 
 // SAFESTACK-SSP: attributes #[[A]] = {{.*}} safestack ssp{{ }}
 // SAFESTACK-SSPSTRONG: attributes #[[A]] = {{.*}} safestack sspstrong
 // SAFESTACK-SSPREQ: attributes #[[A]] = {{.*}} safestack sspreq
 
 // NOSSP-NOT: attributes #[[B]] = {{.*}} ssp
 // SSP-NOT: attributes #[[B]] = {{.*}} ssp{{ }}
 // SSPSTRONG-NOT: attributes #[[B]] = {{.*}} sspstrong
 // SSPREQ-NOT: attributes #[[B]] = {{.*}} sspreq
 
+// NOSSP: attributes #[[B]] = {{.*}} nossp
+// SSP: attributes #[[B]] = {{.*}} nossp
+// SSPSTRONG: attributes #[[B]] = {{.*}} nossp
+// SSPREQ: attributes #[[B]] = {{.*}} nossp
+
 // SAFESTACK-SSP: attributes #[[B]] = {{.*}} safestack
 // SAFESTACK-SSP-NOT: attributes #[[B]] = {{.*}} safestack ssp{{ }}
 // SAFESTACK-SSPSTRONG: attributes #[[B]] = {{.*}} safestack
 // SAFESTACK-SSPSTRONG-NOT: attributes #[[B]] = {{.*}} safestack sspstrong
 // SAFESTACK-SSPREQ: attributes #[[B]] = {{.*}} safestack
 // SAFESTACK-SSPREQ-NOT: attributes #[[B]] = {{.*}} safestack sspreq

clang/test/Frontend/optimization-remark-missed-inline-stack-protectors.c

+// RUN: %clang_cc1 -stack-protector 2 -Rpass-missed=inline -O2 -verify %s -emit-llvm-only
+
+void side_effect(void);
+
+void foo(void) {
+  side_effect();
+}
+
+// expected-remark@+3 {{foo will not be inlined into bar: stack protected callee but caller requested no stack protector}}
+__attribute__((no_stack_protector))
+void bar(void) {
+  foo();
+}
+
+// expected-remark@+2 {{bar will not be inlined into baz: stack protected caller but callee requested no stack protector}}
+void baz(void) {
+  bar();
+}
+
+void ssp_callee(void);
+
+// No issue; matching stack protections.
+void ssp_caller(void) {
+  ssp_callee();
+}
+
+__attribute__((no_stack_protector))
+void nossp_callee(void);
+
+// No issue; matching stack protections.
+__attribute__((no_stack_protector))
+void nossp_caller(void) {
+  nossp_callee();
+}

llvm/bindings/go/llvm/ir_test.go

attrTests := []string{
     "optnone",
     "optsize",
     "readnone",
     "readonly",
     "returned",
     "returns_twice",
     "signext",
     "safestack",
+    "nossp",
     "ssp",
     "sspreq",
     "sspstrong",
     "sanitize_thread",
     "sanitize_memory",
     "uwtable",
     "zeroext",
     "cold",

llvm/bindings/ocaml/llvm/llvm.ml

module Attribute = struct
   | Noalias
   | Byval
   | Nest
   | Readnone
   | Readonly
   | Noinline
   | Alwaysinline
   | Optsize
+  | Nossp
   | Ssp
   | Sspreq
   | Alignment of int
   | Nocapture
   | Noredzone
   | Noimplicitfloat
   | Naked
   | Inlinehint

llvm/docs/BitCodeFormat.rst

 * bits 16-31: ``align n``
 * bit 32: ``nocapture``
 * bit 33: ``noredzone``
 * bit 34: ``noimplicitfloat``
 * bit 35: ``naked``
 * bit 36: ``inlinehint``
 * bits 37-39: ``alignstack n``, represented as the logarithm
   base 2 of the requested alignment, plus 1
 
 .. _PARAMATTR_GROUP_BLOCK:
 
 PARAMATTR_GROUP_BLOCK Contents
 ------------------------------
 
 The ``PARAMATTR_GROUP_BLOCK`` block (id 10) contains a table of entries
 describing the attribute groups present in the module. These entries can be
 referenced within ``PARAMATTR_CODE_ENTRY`` entries.

 * code 62: ``nofree``
 * code 63: ``nosync``
 * code 64: ``sanitize_memtag``
 * code 65: ``preallocated``
 * code 66: ``no_merge``
 * code 67: ``null_pointer_is_valid``
 * code 68: ``noundef``
 * code 69: ``byref``
 * code 70: ``mustprogress``
+* code 71: ``nossp``
 
 .. note::
   The ``allocsize`` attribute has a special encoding for its arguments. Its two
   arguments, which are 32-bit integers, are packed into one 64-bit integer value
   (i.e. ``(EltSizeParam << 32) | NumEltsParam``), with ``NumEltsParam`` taking on
   the sentinel value -1 if it is not specified.
 
 .. _TYPE_BLOCK:

llvm/docs/LangRef.rst

``speculatable``
     Note that ``speculatable`` is not enough to conclude that along any
     particular execution path the number of calls to this function will not be
     externally observable. This attribute is only valid on functions
     and declarations, not on individual call sites. If a function is
     incorrectly marked as speculatable and really does exhibit
     undefined behavior, the undefined behavior may be observed even
     if the call site is dead code.
 
+``nossp``
+    This attribute indicates the function should not emit a stack smashing
+    protector. This is useful for code that intentionally manipulates the stack
+    canary, such as operating system kernel code that must save/restore such
+    canary values on context switch.
+
+    If a function with the ``nossp`` attribute calls a callee function that has
+    a stack protector function attribute, such as ``ssp``, ``sspreq``, or
+    ``sspstrong`` (or vice-versa), then the callee will not be inline
+    substituted into the caller. Even when the callee is ``alwaysinline``, the
+    above holds.
+
+    Such inlining might break assumptions in the function that was built
+    without stack protection. This permits the functions that would have stack
+    protection to retain their stack protector.
+
 ``ssp``
     This attribute indicates that the function should emit a stack
     smashing protector. It is in the form of a "canary" --- a random value
     placed on the stack before the local variables that's checked upon
     return from the function to see if it has been overwritten. A
     heuristic is used to determine if a function needs stack protectors
     or not. The heuristic used will enable protectors for functions with:
 

llvm/include/llvm/Bitcode/LLVMBitCodes.h

enum AttributeKindCodes {
   ATTR_KIND_OPTIMIZE_FOR_SIZE = 19,
   ATTR_KIND_READ_NONE = 20,
   ATTR_KIND_READ_ONLY = 21,
   ATTR_KIND_RETURNED = 22,
   ATTR_KIND_RETURNS_TWICE = 23,
   ATTR_KIND_S_EXT = 24,
   ATTR_KIND_STACK_ALIGNMENT = 25,
   ATTR_KIND_STACK_PROTECT = 26,
   ATTR_KIND_STACK_PROTECT_REQ = 27,
   ATTR_KIND_STACK_PROTECT_STRONG = 28,
   ATTR_KIND_STRUCT_RET = 29,
   ATTR_KIND_SANITIZE_ADDRESS = 30,
   ATTR_KIND_SANITIZE_THREAD = 31,
   ATTR_KIND_SANITIZE_MEMORY = 32,
   ATTR_KIND_UW_TABLE = 33,
   ATTR_KIND_Z_EXT = 34,
   ATTR_KIND_BUILTIN = 35,
enum AttributeKindCodes {
   ATTR_KIND_NOSYNC = 63,
   ATTR_KIND_SANITIZE_MEMTAG = 64,
   ATTR_KIND_PREALLOCATED = 65,
   ATTR_KIND_NO_MERGE = 66,
   ATTR_KIND_NULL_POINTER_IS_VALID = 67,
   ATTR_KIND_NOUNDEF = 68,
   ATTR_KIND_BYREF = 69,
   ATTR_KIND_MUSTPROGRESS = 70,
+  ATTR_KIND_NO_STACK_PROTECT = 71,
 };
 
 enum ComdatSelectionKindCodes {
   COMDAT_SELECTION_KIND_ANY = 1,
   COMDAT_SELECTION_KIND_EXACT_MATCH = 2,
   COMDAT_SELECTION_KIND_LARGEST = 3,
   COMDAT_SELECTION_KIND_NO_DUPLICATES = 4,
   COMDAT_SELECTION_KIND_SAME_SIZE = 5,

llvm/include/llvm/IR/Attributes.td

 
 /// Alignment of stack for function (3 bits)  stored as log2 of alignment with
 /// +1 bias 0 means unaligned (different from alignstack=(1)).
 def StackAlignment : IntAttr<"alignstack">;
 
 /// Function can be speculated.
 def Speculatable : EnumAttr<"speculatable">;
 
+/// Stack protection explicitly disabled.
+def NoStackProtect : EnumAttr<"nossp">;
+
 /// Stack protection.
 def StackProtect : EnumAttr<"ssp">;
 
 /// Stack protection required.
 def StackProtectReq : EnumAttr<"sspreq">;
 
 /// Strong Stack protection.
 def StackProtectStrong : EnumAttr<"sspstrong">;

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(preallocated);
   KEYWORD(readnone);
   KEYWORD(readonly);
   KEYWORD(returned);
   KEYWORD(returns_twice);
   KEYWORD(signext);
   KEYWORD(speculatable);
   KEYWORD(sret);
+  KEYWORD(nossp);
   KEYWORD(ssp);
   KEYWORD(sspreq);
   KEYWORD(sspstrong);
   KEYWORD(strictfp);
   KEYWORD(safestack);
   KEYWORD(shadowcallstack);
   KEYWORD(sanitize_address);
   KEYWORD(sanitize_hwaddress);

llvm/lib/AsmParser/LLParser.cpp

case lltok::kw_optforfuzzing:
       B.addAttribute(Attribute::OptForFuzzing); break;
     case lltok::kw_optnone: B.addAttribute(Attribute::OptimizeNone); break;
     case lltok::kw_optsize: B.addAttribute(Attribute::OptimizeForSize); break;
     case lltok::kw_readnone: B.addAttribute(Attribute::ReadNone); break;
     case lltok::kw_readonly: B.addAttribute(Attribute::ReadOnly); break;
     case lltok::kw_returns_twice:
       B.addAttribute(Attribute::ReturnsTwice); break;
     case lltok::kw_speculatable: B.addAttribute(Attribute::Speculatable); break;
+    case lltok::kw_nossp:
+      B.addAttribute(Attribute::NoStackProtect);
+      break;
     case lltok::kw_ssp: B.addAttribute(Attribute::StackProtect); break;
     case lltok::kw_sspreq: B.addAttribute(Attribute::StackProtectReq); break;
     case lltok::kw_sspstrong:
       B.addAttribute(Attribute::StackProtectStrong); break;
     case lltok::kw_safestack: B.addAttribute(Attribute::SafeStack); break;
     case lltok::kw_shadowcallstack:
       B.addAttribute(Attribute::ShadowCallStack); break;
     case lltok::kw_sanitize_address:
while (true) {
     case lltok::kw_optsize:
     case lltok::kw_returns_twice:
     case lltok::kw_sanitize_address:
     case lltok::kw_sanitize_hwaddress:
     case lltok::kw_sanitize_memtag:
     case lltok::kw_sanitize_memory:
     case lltok::kw_sanitize_thread:
     case lltok::kw_speculative_load_hardening:
+    case lltok::kw_nossp:
     case lltok::kw_ssp:
     case lltok::kw_sspreq:
     case lltok::kw_sspstrong:
     case lltok::kw_safestack:
     case lltok::kw_shadowcallstack:
     case lltok::kw_strictfp:
     case lltok::kw_uwtable:
       HaveError |= Error(Lex.getLoc(), "invalid use of function-only attribute");
while (true) {
     case lltok::kw_optsize:
     case lltok::kw_returns_twice:
     case lltok::kw_sanitize_address:
     case lltok::kw_sanitize_hwaddress:
     case lltok::kw_sanitize_memtag:
     case lltok::kw_sanitize_memory:
     case lltok::kw_sanitize_thread:
     case lltok::kw_speculative_load_hardening:
+    case lltok::kw_nossp:
     case lltok::kw_ssp:
     case lltok::kw_sspreq:
     case lltok::kw_sspstrong:
     case lltok::kw_safestack:
     case lltok::kw_shadowcallstack:
     case lltok::kw_strictfp:
     case lltok::kw_uwtable:
       HaveError |= Error(Lex.getLoc(), "invalid use of function-only attribute");

llvm/lib/AsmParser/LLToken.h

enum Kind {
   kw_optsize,
   kw_preallocated,
   kw_readnone,
   kw_readonly,
   kw_returned,
   kw_returns_twice,
   kw_signext,
   kw_speculatable,
+  kw_nossp,
   kw_ssp,
   kw_sspreq,
   kw_sspstrong,
   kw_safestack,
   kw_shadowcallstack,
   kw_sret,
   kw_sanitize_thread,
   kw_sanitize_memory,

llvm/lib/Bitcode/Writer/BitcodeWriter.cpp

static uint64_t getAttrKindEncoding(Attribute::AttrKind Kind) {
   case Attribute::ReturnsTwice:
     return bitc::ATTR_KIND_RETURNS_TWICE;
   case Attribute::SExt:
     return bitc::ATTR_KIND_S_EXT;
   case Attribute::Speculatable:
     return bitc::ATTR_KIND_SPECULATABLE;
   case Attribute::StackAlignment:
     return bitc::ATTR_KIND_STACK_ALIGNMENT;
+  case Attribute::NoStackProtect:
+    return bitc::ATTR_KIND_NO_STACK_PROTECT;
   case Attribute::StackProtect:
     return bitc::ATTR_KIND_STACK_PROTECT;
   case Attribute::StackProtectReq:
     return bitc::ATTR_KIND_STACK_PROTECT_REQ;
   case Attribute::StackProtectStrong:
     return bitc::ATTR_KIND_STACK_PROTECT_STRONG;
   case Attribute::SafeStack:
     return bitc::ATTR_KIND_SAFESTACK;

llvm/lib/CodeGen/StackProtector.cpp

 /// The standard heuristic which will add a guard variable to functions that
 /// call alloca with a either a variable size or a size >= SSPBufferSize,
 /// functions with character buffers larger than SSPBufferSize, and functions
 /// with aggregates containing character buffers larger than SSPBufferSize. The
 /// strong heuristic will add a guard variables to functions that call alloca
 /// regardless of size, functions with any buffer regardless of type and size,
 /// functions with aggregates that contain any buffer regardless of type and
 /// size, and functions that contain stack-based variables that have had their
-/// address taken.
+/// address taken. The heuristic will be disregarded for functions explicitly
+/// marked nossp.
 bool StackProtector::RequiresStackProtector() {
   bool Strong = false;
   bool NeedsProtector = false;
   HasPrologue = findStackProtectorIntrinsic(*F);
 
-  if (F->hasFnAttribute(Attribute::SafeStack))
+  if (F->hasFnAttribute(Attribute::SafeStack) ||
+      F->hasFnAttribute(Attribute::NoStackProtect))
     return false;
 
   // We are constructing the OptimizationRemarkEmitter on the fly rather than
   // using the analysis pass to avoid building DominatorTree and LoopInfo which
   // are not available this late in the IR pipeline.
   OptimizationRemarkEmitter ORE(F);
 
   if (F->hasFnAttribute(Attribute::StackProtectReq)) {

llvm/lib/IR/Attributes.cpp

std::string Attribute::getAsString(bool InAttrGrp) const {
   if (hasAttribute(Attribute::ReturnsTwice))
     return "returns_twice";
   if (hasAttribute(Attribute::SExt))
     return "signext";
   if (hasAttribute(Attribute::SpeculativeLoadHardening))
     return "speculative_load_hardening";
   if (hasAttribute(Attribute::Speculatable))
     return "speculatable";
+  if (hasAttribute(Attribute::NoStackProtect))
+    return "nossp";
   if (hasAttribute(Attribute::StackProtect))
     return "ssp";
   if (hasAttribute(Attribute::StackProtectReq))
     return "sspreq";
   if (hasAttribute(Attribute::StackProtectStrong))
     return "sspstrong";
   if (hasAttribute(Attribute::SafeStack))
     return "safestack";
static void setOR(Function &Caller, const Function &Callee) {
   if (!AttrClass::isSet(Caller, AttrClass::getKind()) &&
       AttrClass::isSet(Callee, AttrClass::getKind()))
     AttrClass::set(Caller, AttrClass::getKind(), true);
 }
 
 /// If the inlined function had a higher stack protection level than the
 /// calling function, then bump up the caller's stack protection level.
 static void adjustCallerSSPLevel(Function &Caller, const Function &Callee) {
+  assert(!(Callee.hasFnAttribute(Attribute::NoStackProtect) &&
+           (Caller.hasFnAttribute(Attribute::StackProtect) ||
+            Caller.hasFnAttribute(Attribute::StackProtectStrong) ||
+            Caller.hasFnAttribute(Attribute::StackProtectReq))) &&
+         "stack protected caller but callee requested no stack protector");
+  assert(!(Caller.hasFnAttribute(Attribute::NoStackProtect) &&
+           (Callee.hasFnAttribute(Attribute::StackProtect) ||
+            Callee.hasFnAttribute(Attribute::StackProtectStrong) ||
+            Callee.hasFnAttribute(Attribute::StackProtectReq))) &&
+         "stack protected callee but caller requested no stack protector");
   // If upgrading the SSP attribute, clear out the old SSP Attributes first.
-  // Having multiple SSP attributes doesn't actually hurt, but it adds useless
-  // clutter to the IR.
   AttrBuilder OldSSPAttr;
   OldSSPAttr.addAttribute(Attribute::StackProtect)
       .addAttribute(Attribute::StackProtectStrong)
       .addAttribute(Attribute::StackProtectReq);
 
   if (Callee.hasFnAttribute(Attribute::StackProtectReq)) {
     Caller.removeAttributes(AttributeList::FunctionIndex, OldSSPAttr);
     Caller.addFnAttr(Attribute::StackProtectReq);
   } else if (Callee.hasFnAttribute(Attribute::StackProtectStrong) &&

llvm/lib/IR/Verifier.cpp

static bool isFuncOnlyAttr(Attribute::AttrKind Kind) {
   case Attribute::NoReturn:
   case Attribute::NoSync:
   case Attribute::WillReturn:
   case Attribute::NoCfCheck:
   case Attribute::NoUnwind:
   case Attribute::NoInline:
   case Attribute::AlwaysInline:
   case Attribute::OptimizeForSize:
+  case Attribute::NoStackProtect:
   case Attribute::StackProtect:
   case Attribute::StackProtectReq:
   case Attribute::StackProtectStrong:
   case Attribute::SafeStack:
   case Attribute::ShadowCallStack:
   case Attribute::NoRedZone:
   case Attribute::NoImplicitFloat:
   case Attribute::Naked:
StringRef S = Attrs
                       .getAttribute(AttributeList::FunctionIndex,
                                     "patchable-function-entry")
                       .getValueAsString();
     unsigned N;
     if (S.getAsInteger(10, N))
       CheckFailed(
           "\"patchable-function-entry\" takes an unsigned integer: " + S, V);
   }
+  {
+    unsigned N = 0;
+    if (Attrs.hasFnAttribute(Attribute::NoStackProtect))
+      ++N;
+    if (Attrs.hasFnAttribute(Attribute::StackProtect))
+      ++N;
+    if (Attrs.hasFnAttribute(Attribute::StackProtectReq))
+      ++N;
+    if (Attrs.hasFnAttribute(Attribute::StackProtectStrong))
+      ++N;
+    Assert(N < 2,
+           "nossp, ssp, sspreq, sspstrong fn attrs are mutually exclusive", V);
+  }
 }
 
 void Verifier::verifyFunctionMetadata(
     ArrayRef<std::pair<unsigned, MDNode *>> MDs) {
   for (const auto &Pair : MDs) {
     if (Pair.first == LLVMContext::MD_prof) {
       MDNode *MD = Pair.second;
       Assert(MD->getNumOperands() >= 2,

llvm/lib/Transforms/IPO/ForceFunctionAttrs.cpp

return StringSwitch<Attribute::AttrKind>(Kind)
       .Case("safestack", Attribute::SafeStack)
       .Case("shadowcallstack", Attribute::ShadowCallStack)
       .Case("sanitize_address", Attribute::SanitizeAddress)
       .Case("sanitize_hwaddress", Attribute::SanitizeHWAddress)
       .Case("sanitize_memory", Attribute::SanitizeMemory)
       .Case("sanitize_thread", Attribute::SanitizeThread)
       .Case("sanitize_memtag", Attribute::SanitizeMemTag)
       .Case("speculative_load_hardening", Attribute::SpeculativeLoadHardening)
+      .Case("nossp", Attribute::NoStackProtect)
       .Case("ssp", Attribute::StackProtect)
       .Case("sspreq", Attribute::StackProtectReq)
       .Case("sspstrong", Attribute::StackProtectStrong)
       .Case("strictfp", Attribute::StrictFP)
       .Case("uwtable", Attribute::UWTable)
       .Default(Attribute::None);
 }
 

llvm/lib/Transforms/Utils/CodeExtractor.cpp

if (Attr.isStringAttribute()) {
       case Attribute::SafeStack:
       case Attribute::ShadowCallStack:
       case Attribute::SanitizeAddress:
       case Attribute::SanitizeMemory:
       case Attribute::SanitizeThread:
       case Attribute::SanitizeHWAddress:
       case Attribute::SanitizeMemTag:
       case Attribute::SpeculativeLoadHardening:
+      case Attribute::NoStackProtect:
       case Attribute::StackProtect:
       case Attribute::StackProtectReq:
       case Attribute::StackProtectStrong:
       case Attribute::StrictFP:
       case Attribute::UWTable:
       case Attribute::NoCfCheck:
       case Attribute::MustProgress:
         break;

llvm/lib/Transforms/Utils/InlineFunction.cpp

llvm::InlineResult llvm::InlineFunction(CallBase &CB, InlineFunctionInfo &IFI,
   //  2. If the caller has a differing GC, it is invalid to inline.
   if (CalledFunc->hasGC()) {
     if (!Caller->hasGC())
       Caller->setGC(CalledFunc->getGC());
     else if (CalledFunc->getGC() != Caller->getGC())
       return InlineResult::failure("incompatible GC");
   }
 
+  // Inlining a function that explicitly should not have a stack protector may
+  // break the code if inlined into a function that does have a stack
+  // protector.
+  if (LLVM_UNLIKELY(Caller->hasFnAttribute(Attribute::NoStackProtect)))
+    if (CalledFunc->hasFnAttribute(Attribute::StackProtect) ||
+        CalledFunc->hasFnAttribute(Attribute::StackProtectStrong) ||
+        CalledFunc->hasFnAttribute(Attribute::StackProtectReq))
+      return InlineResult::failure(
+          "stack protected callee but caller requested no stack protector");
+  if (LLVM_UNLIKELY(CalledFunc->hasFnAttribute(Attribute::NoStackProtect)))
+    if (Caller->hasFnAttribute(Attribute::StackProtect) ||
+        Caller->hasFnAttribute(Attribute::StackProtectStrong) ||
+        Caller->hasFnAttribute(Attribute::StackProtectReq))
+      return InlineResult::failure(
+          "stack protected caller but callee requested no stack protector");
+
   // Get the personality function from the callee if it contains a landing pad.
   Constant *CalledPersonality =
       CalledFunc->hasPersonalityFn()
           ? CalledFunc->getPersonalityFn()->stripPointerCasts()
           : nullptr;
 
   // Find the personality function used by the landing pads of the caller. If it
   // exists, then check to see that it matches the personality function used in

llvm/test/CodeGen/X86/stack-protector-2.ll

 ; RUN: llc -mtriple=x86_64-pc-linux-gnu -start-before=stack-protector -stop-after=stack-protector -o - < %s | FileCheck %s
-; Bugs 42238/43308: Test some additional situations not caught previously.
+; Bugs 42238/43308/47479: Test some additional situations not caught previously.
 
 define void @store_captures() #0 {
 ; CHECK-LABEL: @store_captures(
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[STACKGUARDSLOT:%.*]] = alloca i8*
 ; CHECK-NEXT:    [[STACKGUARD:%.*]] = load volatile i8*, i8* addrspace(257)* inttoptr (i32 40 to i8* addrspace(257)*)
 ; CHECK-NEXT:    call void @llvm.stackprotector(i8* [[STACKGUARD]], i8** [[STACKGUARDSLOT]])
 ; CHECK-NEXT:    [[RETVAL:%.*]] = alloca i32, align 4
entry:
   %i.ptr = bitcast i32* %i to i8*
   %count = load i64, i64* %c.addr, align 8
   call void @llvm.memset.p0i8.i64(i8* align 4 %i.ptr, i8 0, i64 %count, i1 false)
   ret void
 }
 
 declare void @llvm.memset.p0i8.i64(i8* nocapture writeonly, i8, i64, i1 immarg)
 
+
+; Test that the same function does not get a canary if nossp fn attr is set.
+declare dso_local void @foo(i8*)
+
+define dso_local void @bar_sspstrong(i64 %0) #0 {
+; CHECK-LABEL: @bar_sspstrong
+; CHECK-NEXT: %StackGuardSlot = alloca i8*
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
+define dso_local void @bar_nossp(i64 %0) #1 {
+; CHECK-LABEL: @bar_nossp
+; CHECK-NEXT: %2 = alloca i64
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
 attributes #0 = { sspstrong }
+attributes #1 = { nossp }

llvm/test/Transforms/CodeExtractor/PartialInlineAttributes.ll

 
 ; CHECK: define internal void @callee_writeonly.1.if.then(i32 %v, i32* %sub.out) { 
 ; CHECK: define internal void @callee_most.2.if.then(i32 %v, i32* %sub.out)  [[FN_ATTRS:#[0-9]+]]
 
 ; attributes to preserve
 attributes #0 = {
   inlinehint minsize noduplicate noimplicitfloat norecurse noredzone nounwind
   nonlazybind optsize safestack sanitize_address sanitize_hwaddress sanitize_memory
-  sanitize_thread ssp sspreq sspstrong strictfp uwtable "foo"="bar"
+  sanitize_thread sspstrong strictfp uwtable "foo"="bar"
   "patchable-function"="prologue-short-redirect" "probe-stack"="_foo_guard" "stack-probe-size"="4096" }
 
-; CHECK: attributes [[FN_ATTRS]] = { inlinehint minsize noduplicate noimplicitfloat norecurse noredzone nounwind nonlazybind optsize safestack sanitize_address sanitize_hwaddress sanitize_memory sanitize_thread ssp sspreq sspstrong strictfp uwtable "foo"="bar" "patchable-function"="prologue-short-redirect" "probe-stack"="_foo_guard" "stack-probe-size"="4096" }
+; CHECK: attributes [[FN_ATTRS]] = { inlinehint minsize noduplicate noimplicitfloat norecurse noredzone nounwind nonlazybind optsize safestack sanitize_address sanitize_hwaddress sanitize_memory sanitize_thread sspstrong strictfp uwtable "foo"="bar" "patchable-function"="prologue-short-redirect" "probe-stack"="_foo_guard" "stack-probe-size"="4096" }
 
 ; attributes to drop
 attributes #1 = {
   alignstack=16 convergent inaccessiblememonly inaccessiblemem_or_argmemonly naked
   noreturn readonly argmemonly returns_twice speculatable "thunk"
 }

llvm/test/Transforms/Inline/inline_nossp.ll

+; RUN: opt -inline -o - -S %s | FileCheck %s
+; RUN: opt -passes='cgscc(inline)' %s -S | FileCheck %s
+; RUN: opt -always-inline -o - -S %s | FileCheck %s
+
+declare dso_local void @foo(i8*)
+
+define dso_local void @ssp(i64 %0) #0 {
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
+define dso_local void @ssp_alwaysinline(i64 %0) #1 {
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
+define dso_local void @nossp() #2 {
+; Check that the calls to @ssp and @ssp_alwaysinline are not inlined into
+; @nossp, since @nossp does not want a stack protector.
+; CHECK-LABEL: @nossp
+; CHECK-NEXT: call void @ssp
+; CHECK-NEXT: call void @ssp_alwaysinline
+  call void @ssp(i64 1024)
+  call void @ssp_alwaysinline(i64 1024)
+  ret void
+}
+
+define dso_local void @nossp_alwaysinline() #3 {
+  call void @ssp(i64 1024)
+  call void @ssp_alwaysinline(i64 1024)
+  ret void
+}
+
+define dso_local void @nossp_caller() #2 {
+; Permit nossp callee to be inlined into nossp caller.
+; CHECK-LABEL: @nossp_caller
+; CHECK-NEXT: call void @ssp
+; CHECK-NEXT: call void @ssp_alwaysinline
+; CHECK-NOT: call void @nossp_alwaysinline
+  call void @nossp_alwaysinline()
+  ret void
+}
+
+define dso_local void @ssp2() #0 {
+; Check the call to @nossp is not inlined, since @nossp should not have a stack
+; protector.
+; CHECK-LABEL: @ssp2
+; CHECK-NEXT: call void @nossp
+  call void @nossp()
+  ret void
+}
+
+attributes #0 = { sspstrong }
+attributes #1 = { sspstrong alwaysinline }
+attributes #2 = { nossp }
+attributes #3 = { nossp alwaysinline}

llvm/test/Transforms/Inline/inline_ssp.ll

 ; RUN: opt -inline %s -S | FileCheck %s
 ; RUN: opt -passes='cgscc(inline)' %s -S | FileCheck %s
 ; Ensure SSP attributes are propagated correctly when inlining.
+; This test case covers callers that are unspecified in their level of stack
+; protection. See also llvm/test/Transforms/Inline/inline_nossp.ll
+; which tests callers with ``nossp`` function attribute which is stack
+; protection explicitly disabled.
 
 @.str = private unnamed_addr constant [11 x i8] c"fun_nossp\0A\00", align 1
 @.str1 = private unnamed_addr constant [9 x i8] c"fun_ssp\0A\00", align 1
 @.str2 = private unnamed_addr constant [15 x i8] c"fun_sspstrong\0A\00", align 1
 @.str3 = private unnamed_addr constant [12 x i8] c"fun_sspreq\0A\00", align 1
 
 ; These first four functions (@fun_sspreq, @fun_sspstrong, @fun_ssp, @fun_nossp)
 ; are used by the remaining functions to ensure that the SSP attributes are

llvm/test/Verifier/function-attribute-nossp-ssp-sspreq-sspstrong.ll

+; RUN: not opt -verify -o - %s 2>&1 | FileCheck %s
+define void @test_1 () #1 { ret void }
+define void @test_2 () #2 { ret void }
+define void @test_3 () #3 { ret void }
+define void @test_4 () #4 { ret void }
+define void @test_5 () #5 { ret void }
+define void @test_6 () #6 { ret void }
+define void @test_7 () #7 { ret void }
+define void @test_8 () #8 { ret void }
+define void @test_9 () #9 { ret void }
+define void @test_10 () #10 { ret void }
+define void @test_11 () #10 { ret void }
+define void @test_12 () #10 { ret void }
+define void @test_13 () #10 { ret void }
+define void @test_14 () #10 { ret void }
+
+attributes #0 = { nossp }
+attributes #1 = { ssp }
+attributes #2 = { sspreq }
+attributes #3 = { sspstrong }
+
+attributes #4 = { nossp ssp }
+attributes #5 = { nossp sspreq }
+attributes #6 = { nossp sspstrong }
+
+attributes #7 = { ssp sspreq }
+attributes #8 = { ssp sspstrong }
+
+attributes #9 = { sspreq sspstrong }
+
+attributes #10 = { nossp ssp sspreq }
+attributes #11 = { nossp ssp sspstrong }
+attributes #12 = { nossp sspreq sspstrong }
+attributes #13 = { ssp sspreq sspstrong }
+attributes #14 = { nossp ssp sspreq sspstrong }
+
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_4
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_5
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_6
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_7
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_8
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_9
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_10
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_11
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_12
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_13
+; CHECK: fn attrs are mutually exclusive
+; CHECK-NEXT: void ()* @test_14

llvm/utils/emacs/llvm-mode.el

 (defvar llvm-font-lock-keywords
   (list
    ;; Attributes
    `(,(regexp-opt
        '("alwaysinline" "argmemonly" "builtin" "cold" "convergent" "inaccessiblememonly"
          "inaccessiblemem_or_argmemonly" "inlinehint" "jumptable" "minsize" "mustprogress" "naked" "nobuiltin"
          "noduplicate" "nofree" "noimplicitfloat" "noinline" "nonlazybind" "noredzone" "noreturn"
          "norecurse" "noundef" "nounwind" "optnone" "optsize" "readnone" "readonly" "returns_twice"
-         "speculatable" "ssp" "sspreq" "sspstrong" "safestack" "sanitize_address" "sanitize_hwaddress" "sanitize_memtag"
+         "speculatable" "nossp" "ssp" "sspreq" "sspstrong" "safestack" "sanitize_address" "sanitize_hwaddress" "sanitize_memtag"
          "sanitize_thread" "sanitize_memory" "strictfp" "uwtable" "willreturn" "writeonly" "immarg") 'symbols) . font-lock-constant-face)
    ;; Variables
    '("%[-a-zA-Z$._][-a-zA-Z$._0-9]*" . font-lock-variable-name-face)
    ;; Labels
    '("[-a-zA-Z$._0-9]+:" . font-lock-variable-name-face)
    ;; Unnamed variable slots
    '("%[-]?[0-9]+" . font-lock-variable-name-face)
    ;; Types

llvm/utils/kate/llvm.xml

<list name="function-attributes">
       <item> noinline </item>
       <item> noredzone </item>
       <item> noreturn </item>
       <item> nounwind </item>
       <item> optnone </item>
       <item> optsize </item>
       <item> readnone </item>
       <item> readonly </item>
+      <item> nossp </item>
       <item> ssp </item>
       <item> sspreq </item>
       <item> sspstrong </item>
     </list>
     <list name="types">
       <item> addrspace </item>
       <item> half </item>
       <item> float </item>

llvm/utils/llvm.grm

  | signext
  | readnone
  | readonly
  | inlinehint
  | alignstack
  | noinline
  | alwaysinline
  | optsize
+ | nossp
  | ssp
  | sspreq
  | returns_twice
  | nonlazybind
  | sanitize_address
  | sanitize_thread
  | sanitize_memory
  | mustprogress

llvm/utils/vim/syntax/llvm.vim

syn keyword llvmKeyword
       \ sideeffect
       \ signext
       \ syncscope
       \ source_filename
       \ speculatable
       \ spir_func
       \ spir_kernel
       \ sret
+      \ nossp
       \ ssp
       \ sspreq
       \ sspstrong
       \ strictfp
       \ swiftcc
       \ swiftself
       \ tail
       \ target

llvm/utils/vscode/llvm/syntaxes/ll.tmLanguage.yaml

- match: "\\bacq_rel\\b|\
             \\bsideeffect\\b|\
             \\bsignext\\b|\
             \\bsyncscope\\b|\
             \\bsource_filename\\b|\
             \\bspeculatable\\b|\
             \\bspir_func\\b|\
             \\bspir_kernel\\b|\
             \\bsret\\b|\
+            \\bnossp\\b|\
             \\bssp\\b|\
             \\bsspreq\\b|\
             \\bsspstrong\\b|\
             \\bstrictfp\\b|\
             \\bswiftcc\\b|\
             \\bswiftself\\b|\
             \\btail\\b|\
             \\btarget\\b|\