[Inline] prevent inlining on stack protector mismatch

[nickdesaulniers]

Summary

It's common for code that manipulates the stack via inline assembly or
that has to set up its own stack canary (such as the Linux kernel) would
like to avoid stack protectors in certain functions. In this case, we've
been bitten by numerous bugs where a callee with a stack protector is
inlined into an attribute((no_stack_protector)) caller, which
generally breaks the caller's assumptions about not having a stack
protector. LTO exacerbates the issue.

While developers can avoid this by putting all no_stack_protector
functions in one translation unit together and compiling those with
-fno-stack-protector, it's generally not very ergonomic or as
ergonomic as a function attribute, and still doesn't work for LTO. See also:
https://lore.kernel.org/linux-pm/[e-mail]/
https://lore.kernel.org/lkml/[e-mail]/T/#u

SSP attributes can be ordered by strength. Weakest to strongest, they
are: ssp, sspstrong, sspreq. Callees with differing SSP attributes may be
inlined into each other, and the strongest attribute will be applied to the
caller. (No change)

After this change:

• A callee with no SSP attributes will no longer be inlined into a caller with SSP attributes.
• The reverse is also true: a callee with an SSP attribute will not be inlined into a caller with no SSP attributes.
• The alwaysinline attribute overrides these rules.

Functions that get synthesized by the compiler may not get inlined as a
result if they are not created with the same stack protector function
attribute as their callers.

Alternative approach to https://reviews.llvm.org/D87956.

Fixes ps/47479.

Signed-off-by: Nick Desaulniers <[e-mail]>

[void]

Are there tests to ensure that the appropriate stack protector level is added to the function after inlining?

[nickdesaulniers]

In D91816#2407426, @void wrote:

Are there tests to ensure that the appropriate stack protector level is added to the function after inlining?

This patch doesn't change the behavior when inlining occurs. (adjustCallerSSPLevel is what's called post successful inline, which adds the appropriate stack protection level) This patch prevents inlining when the caller and callee do not match (when one does not have ssp, sspstrong, or sspreq fn attr), such that adjustCallerSSPLevel is not run on the caller.

So adjustCallerSSPLevel should already have existing code coverage for this behavior? Does it? Digging through git history, it looks like you wrote adjustCallerSSPLevel in d154e283f28525a5fcfb063d4b527bb9a68a8608 in 2013. It looks like you wrote llvm/test/Transforms/Inline/inline_ssp.ll which tests this behavior, which I've modified here. So my changes to llvm/test/Transforms/Inline/inline_ssp.ll are probably what you're looking for. Those should be carefully reviewed; basically, callers no longer get upgraded from "no ssp fn attrs" to their callees ssp fn attrs because inlining was blocked/prevented.

EDIT: last sentence should have read: callers no longer get upgraded from "no ssp fn attrs" to their callees ssp fn attrs because inlining was blocked/prevented.

[rnk]

I'm not super familiar with the SSP stuff, so let me try to restate how this is supposed to work to see if I understand it.

• SSP attributes can be ordered by strength. Weakest to strongest, they are: ssp, sspstrong, sspreq.
• After this change, a callee that lacks any SSP attribute can no longer be inlined into a caller that has any SSP attribute.
  • The alwaysinline attribute overrides this rule, though.
• Callees with differing SSP attributes may be inlined into each other, and the strongest attribute will be applied to the caller. (No change)

Is that more or less right?

llvm/test/ThinLTO/X86/nossp.ll

3

I have recently discovered the new split-file utility, and I like it more than adding files to the Inputs directory. Think it's worth giving it a try here? Up to you. It was added mainly for linker test cases, where you want to test linking multiple inputs together.

[nickdesaulniers]

In D91816#2415127, @rnk wrote:

I'm not super familiar with the SSP stuff, so let me try to restate how this is supposed to work to see if I understand it.

• SSP attributes can be ordered by strength. Weakest to strongest, they are: ssp, sspstrong, sspreq.
• After this change, a callee that lacks any SSP attribute can no longer be inlined into a caller that has any SSP attribute.
  • The alwaysinline attribute overrides this rule, though.
• Callees with differing SSP attributes may be inlined into each other, and the strongest attribute will be applied to the caller. (No change)

Is that more or less right?

Yes, that's precise. I can include that in the commit message if you wouldn't mind and if it helps makes think closer?

llvm/test/ThinLTO/X86/nossp.ll

3

@MaskRay suggested that in a previous version of this patch as well. I will look into it. Is the idea that I would concat llvm/test/ThinLTO/X86/Inputs/nossp.ll to this, then use split-file to split it off?

[rnk]

lgtm

In D91816#2415141, @nickdesaulniers wrote:

In D91816#2415127, @rnk wrote:

I'm not super familiar with the SSP stuff, so let me try to restate how this is supposed to work to see if I understand it.

• SSP attributes can be ordered by strength. Weakest to strongest, they are: ssp, sspstrong, sspreq.
• After this change, a callee that lacks any SSP attribute can no longer be inlined into a caller that has any SSP attribute.
  • The alwaysinline attribute overrides this rule, though.
• Callees with differing SSP attributes may be inlined into each other, and the strongest attribute will be applied to the caller. (No change)

Is that more or less right?

Yes, that's precise. I can include that in the commit message if you wouldn't mind and if it helps makes think closer?

Sure, go for it. After reading it again, I think you also disallow inlining when the callee has SSP attrs, and the caller does not. IIUC, that is the problematic case for the Linux kernel. Here's how I'd try to work that into the wording:

• SSP attributes can be ordered by strength. Weakest to strongest, they are: ssp, sspstrong, sspreq.
• After this change, a callee with no SSP attributes will no longer be inlined into a caller with SSP attributes.
• The reverse is also true: a callee with an SSP attribute will not be inlined into a caller with no SSP attributes.
• The alwaysinline attribute overrides these rules.
• Callees with differing SSP attributes may be inlined into each other, and the strongest attribute will be applied to the caller. (No change)

[MaskRay]

llvm/lib/Analysis/InlineCost.cpp

2435

Is the block unrelated changes?

[MaskRay]

llvm/lib/IR/Attributes.cpp

1942

Hmm. Perhaps if (!Callee.hasFnAttribute(Attribute::AlwaysInline)) { assert(); assert(); } can simplify the conditions a bit.

llvm/test/CodeGen/X86/stack-protector-2.ll

165

Does the comment apply to bar_sspstrong? I don't get the meaning...

llvm/test/ThinLTO/X86/nossp.ll

3

Right. https://llvm.org/docs/TestingGuide.html#extra-files Inlining the extra file makes it slightly more readable.

[nickdesaulniers]

llvm/lib/IR/Attributes.cpp

1942

Oh, sure, the two ifs I added share that condition. Should I wrap that in #ifndef NDEBUG?

[MaskRay]

llvm/lib/IR/Attributes.cpp

1942

LG

[nickdesaulniers]

• rebase on https://reviews.llvm.org/D92350, use split-file, simplify assert condition, rewrite unclear comment.

[nickdesaulniers]

Cool, that should be all of the feedback addressed. How does it look?

llvm/lib/Analysis/InlineCost.cpp

2435

https://reviews.llvm.org/D92350

llvm/test/CodeGen/X86/stack-protector-2.ll

165

reworded, WDYT?

llvm/include/llvm/IR/Function.h

public:
   ///                             to use during code generation.
   bool hasGC() const {
     return getSubclassDataFromValue() & (1<<14);
   }
   const std::string &getGC() const;
   void setGC(std::string Str);
   void clearGC();
 
+  /// Returns true if the function has ssp, sspstrong, or sspreq fn attrs.
+  bool hasStackProtectorFnAttr() const;
+
   /// adds the attribute to the list of attributes.
   void addAttribute(unsigned i, Attribute::AttrKind Kind);
 
   /// adds the attribute to the list of attributes.
   void addAttribute(unsigned i, Attribute Attr);
 
   /// adds the attributes to the list of attributes.
   void addAttributes(unsigned i, const AttrBuilder &Attrs);

llvm/lib/Analysis/InlineCost.cpp

Optional<InlineResult> llvm::getAttributeBasedInliningDecision(
   // Don't inline functions marked noinline.
   if (Callee->hasFnAttribute(Attribute::NoInline))
     return InlineResult::failure("noinline function attribute");
 
   // Don't inline call sites marked noinline.
   if (Call.isNoInline())
     return InlineResult::failure("noinline call site attribute");
 
+  // Don't inline functions if one does not have any stack protector attribute
+  // but the other does.
+  if (Caller->hasStackProtectorFnAttr() && !Callee->hasStackProtectorFnAttr())
+    return InlineResult::failure(
+        "stack protected caller but callee requested no stack protector");
+  if (Callee->hasStackProtectorFnAttr() && !Caller->hasStackProtectorFnAttr())
+    return InlineResult::failure(
+        "stack protected callee but caller requested no stack protector");
+
   return None;
 }
 
 InlineCost llvm::getInlineCost(
     CallBase &Call, Function *Callee, const InlineParams &Params,
     TargetTransformInfo &CalleeTTI,
     function_ref<AssumptionCache &(Function &)> GetAssumptionCache,
     function_ref<const TargetLibraryInfo &(Function &)> GetTLI,
InlineCost llvm::getInlineCost(
   if (ShouldInline.isSuccess() && CA.getCost() >= CA.getThreshold())
     return InlineCost::getAlways("empty function");
 
   return llvm::InlineCost::get(CA.getCost(), CA.getThreshold());
 }
 
 InlineResult llvm::isInlineViable(Function &F) {
   bool ReturnsTwice = F.hasFnAttribute(Attribute::ReturnsTwice);
   for (BasicBlock &BB : F) {
     // Disallow inlining of functions which contain indirect branches.
     if (isa<IndirectBrInst>(BB.getTerminator()))
       return InlineResult::failure("contains indirect branches");
 
     // Disallow inlining of blockaddresses which are used by non-callbr
     // instructions.
     if (BB.hasAddressTaken())
       for (User *U : BlockAddress::get(&BB)->users())
         if (!isa<CallBrInst>(*U))
           return InlineResult::failure("blockaddress used outside of callbr");
 
     for (auto &II : BB) {
       CallBase *Call = dyn_cast<CallBase>(&II);
       if (!Call)
         continue;
 
       // Disallow recursive calls.
-      if (&F == Call->getCalledFunction())
+      Function *Callee = Call->getCalledFunction();
+      if (&F == Callee)
         return InlineResult::failure("recursive call");
 
       // Disallow calls which expose returns-twice to a function not previously
       // attributed as such.
       if (!ReturnsTwice && isa<CallInst>(Call) &&
           cast<CallInst>(Call)->canReturnTwice())
         return InlineResult::failure("exposes returns-twice attribute");
 
-      if (Call->getCalledFunction())
-        switch (Call->getCalledFunction()->getIntrinsicID()) {
+      if (Callee)
+        switch (Callee->getIntrinsicID()) {
         default:
           break;
         case llvm::Intrinsic::icall_branch_funnel:
           // Disallow inlining of @llvm.icall.branch.funnel because current
           // backend can't separate call targets from call arguments.
           return InlineResult::failure(
               "disallowed inlining of @llvm.icall.branch.funnel");
         case llvm::Intrinsic::localescape:

llvm/lib/CodeGen/StackProtector.cpp

 /// strong heuristic will add a guard variables to functions that call alloca
 /// regardless of size, functions with any buffer regardless of type and size,
 /// functions with aggregates that contain any buffer regardless of type and
 /// size, and functions that contain stack-based variables that have had their
 /// address taken.
 bool StackProtector::RequiresStackProtector() {
   bool Strong = false;
   bool NeedsProtector = false;
-  HasPrologue = findStackProtectorIntrinsic(*F);
 
   if (F->hasFnAttribute(Attribute::SafeStack))
     return false;
 
   // We are constructing the OptimizationRemarkEmitter on the fly rather than
   // using the analysis pass to avoid building DominatorTree and LoopInfo which
   // are not available this late in the IR pipeline.
   OptimizationRemarkEmitter ORE(F);
 
   if (F->hasFnAttribute(Attribute::StackProtectReq)) {
     ORE.emit([&]() {
       return OptimizationRemark(DEBUG_TYPE, "StackProtectorRequested", F)
              << "Stack protection applied to function "
              << ore::NV("Function", F)
              << " due to a function attribute or command-line switch";
     });
     NeedsProtector = true;
     Strong = true; // Use the same heuristic as strong to determine SSPLayout
   } else if (F->hasFnAttribute(Attribute::StackProtectStrong))
     Strong = true;
-  else if (HasPrologue)
-    NeedsProtector = true;
   else if (!F->hasFnAttribute(Attribute::StackProtect))
     return false;
 
   for (const BasicBlock &BB : *F) {
     for (const Instruction &I : BB) {
       if (const AllocaInst *AI = dyn_cast<AllocaInst>(&I)) {
         if (AI->isArrayAllocation()) {
           auto RemarkBuilder = [&]() {

llvm/lib/IR/Attributes.cpp

static void setOR(Function &Caller, const Function &Callee) {
   if (!AttrClass::isSet(Caller, AttrClass::getKind()) &&
       AttrClass::isSet(Callee, AttrClass::getKind()))
     AttrClass::set(Caller, AttrClass::getKind(), true);
 }
 
 /// If the inlined function had a higher stack protection level than the
 /// calling function, then bump up the caller's stack protection level.
 static void adjustCallerSSPLevel(Function &Caller, const Function &Callee) {
+#ifndef NDEBUG
+  if (!Callee.hasFnAttribute(Attribute::AlwaysInline)) {
+    assert(!(!Callee.hasStackProtectorFnAttr() &&
+             Caller.hasStackProtectorFnAttr()) &&
+           "stack protected caller but callee requested no stack protector");
+    assert(!(!Caller.hasStackProtectorFnAttr() &&
+             Callee.hasStackProtectorFnAttr()) &&
+           "stack protected callee but caller requested no stack protector");
+  }
+#endif
   // If upgrading the SSP attribute, clear out the old SSP Attributes first.
   // Having multiple SSP attributes doesn't actually hurt, but it adds useless
   // clutter to the IR.
   AttrBuilder OldSSPAttr;
   OldSSPAttr.addAttribute(Attribute::StackProtect)
       .addAttribute(Attribute::StackProtectStrong)
       .addAttribute(Attribute::StackProtectReq);
 

llvm/lib/IR/Function.cpp

 
 void Function::clearGC() {
   if (!hasGC())
     return;
   getContext().deleteGC(*this);
   setValueSubclassDataBit(14, false);
 }
 
+bool Function::hasStackProtectorFnAttr() const {
+  return hasFnAttribute(Attribute::StackProtect) ||
+         hasFnAttribute(Attribute::StackProtectStrong) ||
+         hasFnAttribute(Attribute::StackProtectReq);
+}
+
 /// Copy all additional attributes (those not needed to create a Function) from
 /// the Function Src to this one.
 void Function::copyAttributesFrom(const Function *Src) {
   GlobalObject::copyAttributesFrom(Src);
   setCallingConv(Src->getCallingConv());
   setAttributes(Src->getAttributes());
   if (Src->hasGC())
     setGC(Src->getGC());

llvm/test/CodeGen/AArch64/stack-guard-remat-bitcast.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
 ; RUN: llc < %s -mtriple=arm64-apple-ios -relocation-model=pic -frame-pointer=all | FileCheck %s
 
 @__stack_chk_guard = external global i64*
 
 ; PR20558
 
-; CHECK: adrp [[R0:x[0-9]+]], ___stack_chk_guard@GOTPAGE
-; CHECK: ldr  [[R1:x[0-9]+]], {{\[}}[[R0]], ___stack_chk_guard@GOTPAGEOFF{{\]}}
+define i32 @test_stack_guard_remat2() ssp {
+; CHECK-LABEL: test_stack_guard_remat2:
+; CHECK:       ; %bb.0: ; %entry
+; CHECK-NEXT:    sub sp, sp, #64 ; =64
+; CHECK-NEXT:    stp x29, x30, [sp, #48] ; 16-byte Folded Spill
+; CHECK-NEXT:    add x29, sp, #48 ; =48
+; CHECK-NEXT:    .cfi_def_cfa w29, 16
+; CHECK-NEXT:    .cfi_offset w30, -8
+; CHECK-NEXT:    .cfi_offset w29, -16
+; CHECK-NEXT:  Lloh0:
+; CHECK-NEXT:    adrp x8, ___stack_chk_guard@GOTPAGE
+; CHECK-NEXT:  Lloh1:
 ; Load the stack guard for the second time, just in case the previous value gets spilled.
-; CHECK: adrp [[GUARD_PAGE:x[0-9]+]], ___stack_chk_guard@GOTPAGE
-; CHECK: ldr  [[R2:x[0-9]+]], {{\[}}[[R1]]{{\]}}
-; CHECK: stur [[R2]], {{\[}}x29, [[SLOT0:[0-9#\-]+]]{{\]}}
-; CHECK: ldur [[R3:x[0-9]+]], {{\[}}x29, [[SLOT0]]{{\]}}
-; CHECK: ldr  [[GUARD_ADDR:x[0-9]+]], {{\[}}[[GUARD_PAGE]], ___stack_chk_guard@GOTPAGEOFF{{\]}}
-; CHECK: ldr  [[GUARD:x[0-9]+]], {{\[}}[[GUARD_ADDR]]{{\]}}
-; CHECK: cmp  [[GUARD]], [[R3]]
-; CHECK: b.ne LBB
-
-define i32 @test_stack_guard_remat2() {
+; CHECK-NEXT:    adrp x9, ___stack_chk_guard@GOTPAGE
+; CHECK-NEXT:  Lloh2:
+; CHECK-NEXT:    ldr x8, [x8, ___stack_chk_guard@GOTPAGEOFF]
+; CHECK-NEXT:  Lloh3:
+; CHECK-NEXT:    ldr x9, [x9, ___stack_chk_guard@GOTPAGEOFF]
+; CHECK-NEXT:  Lloh4:
+; CHECK-NEXT:    ldr x8, [x8]
+; CHECK-NEXT:  Lloh5:
+; CHECK-NEXT:    ldr x9, [x9]
+; CHECK-NEXT:    str x8, [sp]
+; CHECK-NEXT:    stur x9, [x29, #-8]
+; CHECK-NEXT:  Lloh6:
+; CHECK-NEXT:    adrp x9, ___stack_chk_guard@GOTPAGE
+; CHECK-NEXT:    ldur x8, [x29, #-8]
+; CHECK-NEXT:  Lloh7:
+; CHECK-NEXT:    ldr x9, [x9, ___stack_chk_guard@GOTPAGEOFF]
+; CHECK-NEXT:  Lloh8:
+; CHECK-NEXT:    ldr x9, [x9]
+; CHECK-NEXT:    cmp x9, x8
+; CHECK-NEXT:    b.ne LBB0_2
+; CHECK-NEXT:  ; %bb.1: ; %entry
+; CHECK-NEXT:    ldp x29, x30, [sp, #48] ; 16-byte Folded Reload
+; CHECK-NEXT:    mov w0, #-1
+; CHECK-NEXT:    add sp, sp, #64 ; =64
+; CHECK-NEXT:    ret
+; CHECK-NEXT:  LBB0_2: ; %entry
+; CHECK-NEXT:    bl ___stack_chk_fail
+; CHECK-NEXT:    .loh AdrpLdrGotLdr Lloh6, Lloh7, Lloh8
+; CHECK-NEXT:    .loh AdrpLdrGotLdr Lloh1, Lloh3, Lloh5
+; CHECK-NEXT:    .loh AdrpLdrGotLdr Lloh0, Lloh2, Lloh4
 entry:
   %StackGuardSlot = alloca i8*
   %StackGuard = load i8*, i8** bitcast (i64** @__stack_chk_guard to i8**)
   call void @llvm.stackprotector(i8* %StackGuard, i8** %StackGuardSlot)
   %container = alloca [32 x i8], align 1
   call void @llvm.stackprotectorcheck(i8** bitcast (i64** @__stack_chk_guard to i8**))
   ret i32 -1
 }
 
-declare void @llvm.stackprotector(i8*, i8**)
-declare void @llvm.stackprotectorcheck(i8**)
+declare void @llvm.stackprotector(i8*, i8**) ssp
+declare void @llvm.stackprotectorcheck(i8**) ssp

llvm/test/CodeGen/X86/stack-protector-2.ll

entry:
   %i.ptr = bitcast i32* %i to i8*
   %count = load i64, i64* %c.addr, align 8
   call void @llvm.memset.p0i8.i64(i8* align 4 %i.ptr, i8 0, i64 %count, i1 false)
   ret void
 }
 
 declare void @llvm.memset.p0i8.i64(i8* nocapture writeonly, i8, i64, i1 immarg)
 
+; Intentionally does not have any fn attrs.
+declare dso_local void @foo(i8*)
+
+; @bar_sspstrong and @bar_nossp are the same function, but differ only in
+; function attributes. Test that a callee without stack protector function
+; attribute does not trigger a stack guard slot in a caller that also does not
+; have a stack protector slot.
+define dso_local void @bar_sspstrong(i64 %0) #0 {
+; CHECK-LABEL: @bar_sspstrong
+; CHECK-NEXT: %StackGuardSlot = alloca i8*
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
+; Intentionally does not have any fn attrs.
+define dso_local void @bar_nossp(i64 %0) {
+; CHECK-LABEL: @bar_nossp
+; CHECK-NEXT: %2 = alloca i64
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
 attributes #0 = { sspstrong }

llvm/test/ThinLTO/X86/nossp.ll

+; RUN: split-file %s %t
+; RUN: opt -module-summary %t/a.ll -o %a.bc
+; RUN: opt -module-summary %t/b.ll -o %b.bc
+; RUN: llvm-lto2 run %a.bc %b.bc -o %c.bc -save-temps \
+; RUN:   -r=%a.bc,nossp_caller,px \
+; RUN:   -r=%a.bc,ssp_caller,px \
+; RUN:   -r=%a.bc,nossp_caller2,px \
+; RUN:   -r=%a.bc,ssp_caller2,px \
+; RUN:   -r=%a.bc,nossp_callee,x \
+; RUN:   -r=%a.bc,ssp_callee,x \
+; RUN:   -r=%b.bc,nossp_callee,px \
+; RUN:   -r=%b.bc,ssp_callee,px \
+; RUN:   -r=%b.bc,foo
+; RUN: llvm-dis %c.bc.1.4.opt.bc -o - | FileCheck %s
+
+;--- a.ll
+
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-pc-linux-gnu"
+
+declare void @nossp_callee()
+declare void @ssp_callee() ssp
+
+; nossp caller should be able to inline nossp callee.
+define void @nossp_caller() {
+; CHECK-LABEL: @nossp_caller
+; CHECK-NEXT: tail call void @foo
+  tail call void @nossp_callee()
+  ret void
+}
+
+; ssp caller should be able to inline ssp callee.
+define void @ssp_caller() ssp {
+; CHECK-LABEL: @ssp_caller
+; CHECK-NEXT: tail call void @foo
+  tail call void @ssp_callee()
+  ret void
+}
+
+; nossp caller should *NOT* be able to inline ssp callee.
+define void @nossp_caller2() {
+; CHECK-LABEL: @nossp_caller2
+; CHECK-NEXT: tail call void @ssp_callee
+  tail call void @ssp_callee()
+  ret void
+}
+
+; ssp caller should *NOT* be able to inline nossp callee.
+define void @ssp_caller2() ssp {
+; CHECK-LABEL: @ssp_caller2
+; CHECK-NEXT: tail call void @nossp_callee
+  tail call void @nossp_callee()
+  ret void
+}
+
+;--- b.ll
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-pc-linux-gnu"
+
+declare void @foo()
+
+define void @nossp_callee() {
+  call void @foo()
+  ret void
+}
+
+define void @ssp_callee() ssp {
+  call void @foo()
+  ret void
+}

llvm/test/Transforms/CodeExtractor/PartialInlineAttributes.ll

if.then2:
   br label %if.end
 
 if.end:
   %v2 = phi i32 [ %v, %entry ], [ %sub, %if.then2 ]
   %add = add nsw i32 %v2, 200
   ret i32 %add
 }
 
-define i32 @callee_writeonly(i32 %v) writeonly {
+define i32 @callee_writeonly(i32 %v) writeonly ssp {
 entry:
   %cmp = icmp sgt i32 %v, 2000
   br i1 %cmp, label %if.then, label %if.end
 
 if.then:
   br label %if.then2
 
 if.then2:
   %sub = sub i32 %v, 10
   br label %if.end
 
 if.end:
   %v2 = phi i32 [ %v, %entry ], [ %sub, %if.then2 ]
   %add = add nsw i32 %v2, 200
   ret i32 %add
 }
 ; CHECK-LABEL: @caller
 ; CHECK: call void @callee_most.2.if.then(i32 %v
 ; CHECK: call i32 @callee_noinline(i32 %v)
 ; CHECK: call void @callee_writeonly.1.if.then(i32 %v
-define i32 @caller(i32 %v) {
+define i32 @caller(i32 %v) ssp {
 entry:
   %c1 = call i32 @callee_most(i32 %v)
   %c2 = call i32 @callee_noinline(i32 %v)
   %c3 = call i32 @callee_writeonly(i32 %v)
   ret i32 %c3
 }
 
-; CHECK: define internal void @callee_writeonly.1.if.then(i32 %v, i32* %sub.out) { 
+; CHECK: define internal void @callee_writeonly.1.if.then(i32 %v, i32* %sub.out) [[FN_ATTRS0:#[0-9]+]]
 ; CHECK: define internal void @callee_most.2.if.then(i32 %v, i32* %sub.out)  [[FN_ATTRS:#[0-9]+]]
 
 ; attributes to preserve
 attributes #0 = {
   inlinehint minsize noduplicate noimplicitfloat norecurse noredzone nounwind
   nonlazybind optsize safestack sanitize_address sanitize_hwaddress sanitize_memory
   sanitize_thread ssp sspreq sspstrong strictfp uwtable "foo"="bar"
   "patchable-function"="prologue-short-redirect" "probe-stack"="_foo_guard" "stack-probe-size"="4096" }
 
+; CHECK: attributes [[FN_ATTRS0]] = { ssp
 ; CHECK: attributes [[FN_ATTRS]] = { inlinehint minsize noduplicate noimplicitfloat norecurse noredzone nounwind nonlazybind optsize safestack sanitize_address sanitize_hwaddress sanitize_memory sanitize_thread ssp sspreq sspstrong strictfp uwtable "foo"="bar" "patchable-function"="prologue-short-redirect" "probe-stack"="_foo_guard" "stack-probe-size"="4096" }
 
 ; attributes to drop
 attributes #1 = {
   alignstack=16 convergent inaccessiblememonly inaccessiblemem_or_argmemonly naked
   noreturn readonly argmemonly returns_twice speculatable "thunk"
 }

llvm/test/Transforms/Inline/devirtualize.ll

cast.end:                                         ; preds = %entry, %cast.notnull
   ret i32 %call
 }
 
 define linkonce_odr i32 @_ZN1D1fEv(%struct.C* %this) ssp align 2 {
 entry:
   ret i32 4
 }
 
-define linkonce_odr i32 @_ZThn8_N1D1fEv(%struct.C* %this) {
+define linkonce_odr i32 @_ZThn8_N1D1fEv(%struct.C* %this) ssp {
 entry:
   %0 = bitcast %struct.C* %this to i8*            ; <i8*> [#uses=1]
   %1 = getelementptr inbounds i8, i8* %0, i64 -8      ; <i8*> [#uses=1]
   %2 = bitcast i8* %1 to %struct.C*               ; <%struct.C*> [#uses=1]
   %call = call i32 @_ZN1D1fEv(%struct.C* %2)      ; <i32> [#uses=1]
   ret i32 %call
 }
 

llvm/test/Transforms/Inline/inline-byval-bonus.ll

 target triple = "x86_64-apple-macosx10.8.0"
 
 %struct.sphere = type { %struct.vec3, double, %struct.material, %struct.sphere* }
 %struct.vec3 = type { double, double, double }
 %struct.material = type { %struct.vec3, double, double }
 %struct.ray = type { %struct.vec3, %struct.vec3 }
 %struct.spoint = type { %struct.vec3, %struct.vec3, %struct.vec3, double }
 
-define i32 @caller(%struct.sphere* %i) {
+define i32 @caller(%struct.sphere* %i) ssp {
   %shadow_ray = alloca %struct.ray, align 8
   call void @fix(%struct.ray* %shadow_ray)
 
   %call = call i32 @ray_sphere(%struct.sphere* %i, %struct.ray* byval(%struct.ray) align 8 %shadow_ray, %struct.spoint* null)
   ret i32 %call
 
 ; CHECK-LABEL: @caller(
 ; CHECK-NOT: call i32 @ray_sphere

llvm/test/Transforms/Inline/inline_nossp.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt -inline -o - -S %s | FileCheck %s
+; RUN: opt -passes='cgscc(inline)' %s -S | FileCheck %s
+; RUN: opt -always-inline -o - -S %s | FileCheck %s
+; RUN: opt -passes=always-inline -o - -S %s | FileCheck %s
+
+declare dso_local void @foo(i8*)
+
+; Not interesting to test.
+define dso_local void @ssp(i64 %0) #0 {
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
+; Not interesting to test.
+define dso_local void @ssp_alwaysinline(i64 %0) #1 {
+  %2 = alloca i64, align 8
+  store i64 %0, i64* %2, align 8
+  %3 = load i64, i64* %2, align 8
+  %4 = alloca i8, i64 %3, align 16
+  call void @foo(i8* %4)
+  ret void
+}
+
+; @ssp should not be inlined due to mismatch stack protector.
+; @ssp_alwaysinline should be inlined due to alwaysinline.
+define dso_local void @nossp() {
+; CHECK-LABEL: @nossp(
+; CHECK-NEXT:    [[TMP1:%.*]] = alloca i64, align 8
+; CHECK-NEXT:    call void @ssp(i64 1024)
+; CHECK-NEXT:    [[SAVEDSTACK:%.*]] = call i8* @llvm.stacksave()
+; CHECK-NEXT:    [[TMP2:%.*]] = bitcast i64* [[TMP1]] to i8*
+; CHECK-NEXT:    call void @llvm.lifetime.start.p0i8(i64 8, i8* [[TMP2]])
+; CHECK-NEXT:    store i64 1024, i64* [[TMP1]], align 8
+; CHECK-NEXT:    [[TMP3:%.*]] = load i64, i64* [[TMP1]], align 8
+; CHECK-NEXT:    [[TMP4:%.*]] = alloca i8, i64 [[TMP3]], align 16
+; CHECK-NEXT:    call void @foo(i8* [[TMP4]])
+; CHECK-NEXT:    [[TMP5:%.*]] = bitcast i64* [[TMP1]] to i8*
+; CHECK-NEXT:    call void @llvm.lifetime.end.p0i8(i64 8, i8* [[TMP5]])
+; CHECK-NEXT:    call void @llvm.stackrestore(i8* [[SAVEDSTACK]])
+; CHECK-NEXT:    ret void
+;
+  call void @ssp(i64 1024)
+  call void @ssp_alwaysinline(i64 1024)
+  ret void
+}
+
+; This is the same case as @nossp above. That the caller has alwaysinline is
+; irrelevant.  Not interesting to test.
+define dso_local void @nossp_alwaysinline() #2 {
+  call void @ssp(i64 1024)
+  call void @ssp_alwaysinline(i64 1024)
+  ret void
+}
+
+; @nossp_alwaysinline should be inlined due to alwaysinline.
+; @ssp should not be inlined due to mismatch stack protector.
+; @ssp_alwaysinline should be inlined due to alwaysinline.
+define dso_local void @nossp_caller() {
+; CHECK-LABEL: @nossp_caller(
+; CHECK-NEXT:    [[TMP1:%.*]] = alloca i64, align 8
+; CHECK-NEXT:    [[SAVEDSTACK:%.*]] = call i8* @llvm.stacksave()
+; CHECK-NEXT:    call void @ssp(i64 1024)
+; CHECK-NEXT:    [[SAVEDSTACK_I:%.*]] = call i8* @llvm.stacksave()
+; CHECK-NEXT:    [[TMP2:%.*]] = bitcast i64* [[TMP1]] to i8*
+; CHECK-NEXT:    call void @llvm.lifetime.start.p0i8(i64 8, i8* [[TMP2]])
+; CHECK-NEXT:    store i64 1024, i64* [[TMP1]], align 8
+; CHECK-NEXT:    [[TMP3:%.*]] = load i64, i64* [[TMP1]], align 8
+; CHECK-NEXT:    [[TMP4:%.*]] = alloca i8, i64 [[TMP3]], align 16
+; CHECK-NEXT:    call void @foo(i8* [[TMP4]])
+; CHECK-NEXT:    [[TMP5:%.*]] = bitcast i64* [[TMP1]] to i8*
+; CHECK-NEXT:    call void @llvm.lifetime.end.p0i8(i64 8, i8* [[TMP5]])
+; CHECK-NEXT:    call void @llvm.stackrestore(i8* [[SAVEDSTACK_I]])
+; CHECK-NEXT:    call void @llvm.stackrestore(i8* [[SAVEDSTACK]])
+; CHECK-NEXT:    ret void
+;
+  call void @nossp_alwaysinline()
+  ret void
+}
+
+; @nossp should not be inlined due to mismatch stack protector.
+define dso_local void @ssp2() #0 {
+; CHECK-LABEL: @ssp2(
+; CHECK-NEXT:    call void @nossp()
+; CHECK-NEXT:    ret void
+;
+  call void @nossp()
+  ret void
+}
+
+attributes #0 = { sspstrong }
+attributes #1 = { sspstrong alwaysinline }
+attributes #2 = { alwaysinline}

llvm/test/Transforms/Inline/inline_ssp.ll

 entry:
 ; CHECK: @inline_req_ssp() #0
   call void @fun_sspreq()
   ret void
 }
 
 define void @inline_req_nossp() nounwind uwtable {
 entry:
-; CHECK: @inline_req_nossp() #0
+; CHECK: @inline_req_nossp() #3
   call void @fun_sspreq()
   ret void
 }
 
 define void @inline_strong_req() nounwind sspreq uwtable {
 entry:
 ; CHECK: @inline_strong_req() #0
   call void @fun_sspstrong()

 entry:
 ; CHECK: @inline_strong_ssp() #1
   call void @fun_sspstrong()
   ret void
 }
 
 define void @inline_strong_nossp() nounwind uwtable {
 entry:
-; CHECK: @inline_strong_nossp() #1
+; CHECK: @inline_strong_nossp() #3
   call void @fun_sspstrong()
   ret void
 }
 
 define void @inline_ssp_req() nounwind sspreq uwtable {
 entry:
 ; CHECK: @inline_ssp_req() #0
   call void @fun_ssp()

 entry:
 ; CHECK: @inline_ssp_ssp() #2
   call void @fun_ssp()
   ret void
 }
 
 define void @inline_ssp_nossp() nounwind uwtable {
 entry:
-; CHECK: @inline_ssp_nossp() #2
+; CHECK: @inline_ssp_nossp() #3
   call void @fun_ssp()
   ret void
 }
 
 define void @inline_nossp_req() nounwind uwtable sspreq {
 entry:
 ; CHECK: @inline_nossp_req() #0
   call void @fun_nossp()