[syscalls] Remove static analysis attributes

We previously worked on static analysis including markup and
compiler-assistance, however it has since rotted and is not being
actively used. Remove the markup and the documentation references until
we are able to properly support it again.

Bug: 33668

Change-Id: I960d92ac3e65d0329843ab5326ce5b612ffb4e97
diff --git a/docs/zircon/README.md b/docs/zircon/README.md
index 5ed8fcf..d126dbc 100644
--- a/docs/zircon/README.md
+++ b/docs/zircon/README.md
@@ -65,7 +65,6 @@
 + [Entropy collection TODOs](entropy_collection_todos.md)
 + [Memory usage analysis tools](memory.md)
 + [Symbolizer](symbolizer_markup.md)
-+ [Static analysis](static_analysis.md)
 + [Relationship with LK](zx_and_lk.md)
 + [Micro-benchmarks](benchmarks/microbenchmarks.md)
 + [Avoiding a problem with the SYSRET instruction](sysret_problem.md)
diff --git a/docs/zircon/_toc.yaml b/docs/zircon/_toc.yaml
index ffa91c3..8aff759 100644
--- a/docs/zircon/_toc.yaml
+++ b/docs/zircon/_toc.yaml
@@ -161,9 +161,6 @@
 - title: "Symbolizer markup format"
   path: /docs/zircon/symbolizer_markup.md
 
-- title: "Static Analysis"
-  path: /docs/zircon/static_analysis.md
-
 - title: "Zircon and LK"
   path: /docs/zircon/zx_and_lk.md
 
diff --git a/docs/zircon/static_analysis.md b/docs/zircon/static_analysis.md
deleted file mode 100644
index 7ba1521..0000000
--- a/docs/zircon/static_analysis.md
+++ /dev/null
@@ -1,145 +0,0 @@
-# Static Analysis in Zircon
-
-This document describes:
-
-* How to perform static analysis with the Clang Static Analyzer in Zircon;
-* How to enable ZirconHandleChecker;
-* How to add/modify annotate attributes to syscalls/functions and use annotate attributes to suppress false positives.
-
-## Steps to run Clang Static Analyzer
-
-Assuming you already obtained a local copy of Fuchsia workspace according to the instructions written in [getting_started.md](/docs/getting_started.md) and the source tree of fuchsia is located at `$LOCAL_DIR/fuchsia` and current working directory is `$LOCAL_DIR/fuchsia/zircon`. The Clang Static Analayzer can be run on Zircon by following commands:
-
-```sh
-./scripts/download-prebuilt
-./scripts/analyze-zircon
-```
-
-The Clang Static Analyzer will be run on Zircon code base with default checkers. After the finish of the analysis, you can see an output in stdout similar to the one below:
-
-```
-scan-build: Run 'scan-view $LOCAL_DIR/fuchsia/zircon/AnalysisResult/scan-build-2017-08-08-11-26-25-914570-SKSE39' to examine bug reports.
-```
-
-Just type the command start with `scan-view` in a terminal and it will open your web browser and show the analysis reports.
-
-## Steps to enable ZirconHandleChecker
-
-At the time this document is written, all Zircon related checkers are still under review by upstream LLVM community:
-
- * MutexInInterruptContext [D27854](https://reviews.llvm.org/D27854)
- * SpinLockChecker [D26340](https://reviews.llvm.org/D26340)
- * MutexChecker [D26342](https://reviews.llvm.org/D26342)
- * ZirconHandleChecker [D35968](https://reviews.llvm.org/D35968) [D36022](https://reviews.llvm.org/D36022) [D36023](https://reviews.llvm.org/D36023) [D36024](https://reviews.llvm.org/D36024) [D36251](https://reviews.llvm.org/D36251) [D36475](https://reviews.llvm.org/D36475))
-
-They are enabled by default when you executed the 'analyze-zircon' script. We will update the 'analyze-zircon' script to enable them by default once they get landed.
-
-In the mean time, if you would like to try ZirconHandleChecker now, you can download the source code of LLVM with Clang and apply the patch from the diffs above and follow the instructions in [toolchain.md](/docs/development/build/toolchain.md) to build your own toolchain. Assuming you have built your own toolchain and it is located at `$LOCAL_TOOLCHAIN_PREFIX` and `$LOCAL_TOOLCHAIN_PREFIX/bin/clang` is the path to the `clang` command. The Clang Static Analyzer can be run with ZirconHandleChecker and other default checkers enabled by following command:
-
-```
-./scripts/analyze-zircon -p $LOCAL_TOOLCHAIN_PREFIX -m all
-```
-
-If you want to enable ZirconHandleChecker and disable other default checkers, please run following command:
-
-```
-./scripts/analyze-zircon -p $LOCAL_TOOLCHAIN_PREFIX -m zircon
-```
-
-The 'analyze-zircon' scripts have additional options such as changing the output directories and changing build targets, please refer the to help information printed by `./scripts/analyze-zircon -h`.
-
-## Steps to add/modify annotate attributes to syscalls/functions
-
-In Zircon code base, raw annotations like `__attribute__((annotate("string")))` should never be used in Zircon code base, all zircon related annotations should be wrapped by macros. In this section, we will discuss how to add or modify annotations in Zircon code base.
-
-### Annotations in syscall declaration
-
-As header files of Zircon syscalls are generated from syscalls.abigen, in order to add/modify annotations of syscalls, the syscalls.abigen should be modified directly.
-Let’s use `zx_channel_create syscall` as example. This syscall will allocate two handles when it is successfully executed. Without annotations, its declaration in abigen will be like:
-
-```c
-syscall channel_create
-    (options: uint32_t)
-    returns (zx_status_t, out0: zx_handle_t, out1: zx_handle_t);
-```
-
-As argument `out0` and `out1` will be allocated handles, we should add `handle_acquire` annotation to these arguments:
-
-```c
-syscall channel_create
-    (options: uint32_t)
-    returns (zx_status_t, out0: zx_handle_t handle_acquire,
-             out1: zx_handle_t handle_acquire);
-```
-
-This syscall declaration will be processed by abigen and converted to:
-
-```c
-extern zx_status_t zx_channel_create(
-uint32_t options,
-    ZX_SYSCALL_PARAM_ATTR(handle_acquire) zx_handle_t* out0,
-    ZX_SYSCALL_PARAM_ATTR(handle_acquire) zx_handle_t* out1));
-```
-
-The declaration of macro can be found in system/public/zircon/syscalls.h, which is:
-
-```c
-#if defined(__clang__)
-#define ZX_SYSCALL_PARAM_ATTR(x)   __attribute__((annotate("zx_" #x)))
-#else
-#define ZX_SYSCALL_PARAM_ATTR(x)   // no-op
-#endif
-```
-
-According to the definition of `ZX_SYSCALL_PARAM_ATTR`, the `zx_channel_create` will be parsed into:
-
-```c
-extern zx_status_t zx_channel_create(uint32_t options,
-__attribute__((annotate("zx_handle_acquire"))) zx_handle_t* out0,
-__attribute__((annotate("zx_handle_acquire"))) zx_handle_t* out1) __attribute__((__leaf__));;
-```
-
-The reason that we use macros to wrap these annotations is that annotate attribute is not supported by compilers other than Clang, e.g. GCC. Furthermore, it would be convenient if we decide to use annotation solutions other than the annotate attributes in the future. Otherwise we need to change each annotation one by one.
-
-### Annotations in other functions
-
-For functions other than syscalls, if `system/public/zircon/syscalls.h` is in current include path, you can use `ZX_SYSCALL_PARAM_ATTR` macro to wrap your annotations. If not, you should use macros similar to this one. The reason that functions other than syscalls may require annotations is that some functions contain known false positives and we can use annotation to suppress the warnings of these false positives. For example, in ZirconHandleChecker’s test file we have:
-
-```c
-#if defined(__clang__)
-#define ZX_ANALYZER_SUPPRESS   __attribute__((annotate("zx_suppress_warning)))
-#else
-#define ZX_ANALYZER_SUPPRESS   // no-op
-#endif
-void checkSuppressWarning() ZX_ANALYZER_SUPPRESS {
-  zx_handle_t sa, sb;
-  if (zx_channel_create(0, &sa, &sb) < 0) {
-    return;
-  }
-  zx_handle_close(sa); // Should not report any bugs here
-}
-```
-
-The analyzer will suppress the warnings on the bug it discovered in `checkSuppressWarning` function. If you don’t want to define your own macro for this purpose, and the `syscalls.h` is in the include path, you can use `_SYSCALL_PARAM_ATTR(suppress_warning)` instead, it will suppress the warnings of all bugs discovered in the functions with this annotation.
-
-Similar to `zx_suppress_warning` annotation, we have `zx_create_sink` annotation which currently used to suppress warnings on assertion failures. This annotation is unlikely to be used for other purpose, however, if you would like to know how it works, please refer to the discussions in CL[46428](https://fuchsia-review.googlesource.com/c/46428).
-
-To manually annotate non-syscall functions, the "ZX_SYSCALL_PARAM_ATTR" macro can be applied to function arguments, emulating the effect of the abigen attributes. For example, here, we annotate a regular function which might be used to call the "zx_create_channel" function without passing the "options" argument:
-
-```c
-zx_status_t create_channel(
-  ZX_SYSCALL_PARAM_ATTR(handle_acquire) zx_handle_t* out0,
-  ZX_SYSCALL_PARAM_ATTR(handle_acquire) zx_handle_t* out1);
-```
-
-Another example, we have another function `takeover_handle` that will take care the lifecycle of a handle if it is successfully executed and do nothing if it failed, we can declare this function in header file like this:
-
-```c
-zx_status_t takeover_handle(
-  ZX_SYSCALL_PARAM_ATTR(handle_escape) zx_handle_t in)
-  ZX_SYSCALL_PARAM_ATTR(may_fail);
-```
-
-The `zx_may_fail` annotation here will cause state bifurcation when ZirconHandleChecker is evaluating calls to this function. So both succeeded and failed states will be covered.
-
-If the `ZX_SYSCALL_PARAM_ATTR` is not available in the file that declares the function, you can define your own macros, as long as it will not expanded into annotate attribute if it is not compiled by Clang.
diff --git a/zircon/kernel/syscalls/priv.h b/zircon/kernel/syscalls/priv.h
index 4878daf..ebb17bf 100644
--- a/zircon/kernel/syscalls/priv.h
+++ b/zircon/kernel/syscalls/priv.h
@@ -14,7 +14,6 @@
 // Forward declaration so it can be used in abigen-generated sys_* prototypes.
 class user_out_handle;
 
-#define ZX_SYSCALL_PARAM_ATTR(x)
 #include <zircon/syscall-definitions.h>
 
 #include <object/handle.h>
diff --git a/zircon/system/public/zircon/syscalls.banjo b/zircon/system/public/zircon/syscalls.banjo
index 3b65193..a442e4fc 100644
--- a/zircon/system/public/zircon/syscalls.banjo
+++ b/zircon/system/public/zircon/syscalls.banjo
@@ -120,8 +120,7 @@
     system_get_physmem() -> (uint64 physmem);
 
     /// Get supported hardware capabilities.
-    [vdsocall,
-     argtype="features features"]
+    [vdsocall]
     system_get_features(uint32 kind) -> (zx.status status, uint32 features);
 
     /// Retrieve a handle to a system event.
@@ -146,8 +145,7 @@
     //
 
     /// Close a handle.
-    [rights="None.",
-     argtype="handle handle_release_always"]
+    [rights="None."]
     handle_close(handle handle) -> (zx.status status);
 
     /// Close a number of handles.
@@ -156,14 +154,11 @@
     handle_close_many(array<handle>:num_handles handles, usize num_handles) -> (zx.status status);
 
     /// Duplicate a handle.
-    [rights="handle must have ZX_RIGHT_DUPLICATE.",
-     argtype="out handle_acquire"]
+    [rights="handle must have ZX_RIGHT_DUPLICATE."]
     handle_duplicate(handle handle, zx.rights rights) -> (zx.status status, handle out);
 
     /// Replace a handle.
-    [rights="None.",
-     argtype="handle handle_release_always",
-     argtype="out handle_acquire"]
+    [rights="None."]
     handle_replace(handle handle, zx.rights rights) -> (zx.status status, handle out);
 
     //
@@ -270,8 +265,6 @@
     //
 
     /// Create a channel.
-    [argtype="out0 handle_acquire",
-     argtype="out1 handle_acquire"]
     channel_create(uint32 options) -> (zx.status status, handle out0, handle out1);
 
     /// Read a message from a channel.
@@ -350,8 +343,6 @@
     //
 
     /// Create a socket.
-    [argtype="out0 handle_acquire",
-     argtype="out1 handle_acquire"]
     socket_create(uint32 options) -> (zx.status status, handle out0, handle out1);
 
     /// Write data to a socket.
@@ -386,8 +377,7 @@
 
     /// Create a thread.
     [rights="process must be of type ZX_OBJ_TYPE_PROCESS and have ZX_RIGHT_MANAGE_THREAD.",
-     argtype="name IN",
-     argtype="out handle_acquire"]
+     argtype="name IN"]
     thread_create(handle<process> process,
                   string:name_size name,
                   usize name_size,
@@ -426,9 +416,7 @@
 
     /// Create a new process.
     [rights="job must be of type ZX_OBJ_TYPE_JOB and have ZX_RIGHT_MANAGE_PROCESS.",
-     argtype="name IN",
-     argtype="proc_handle handle_acquire",
-     argtype="vmar_handle handle_acquire"]
+     argtype="name IN"]
     // TODO(ZX-2967): job with ZX_RIGHT_WRITE is also accepted.
     process_create(handle<job> job, string:name_size name, usize name_size, uint32 options) ->
         (zx.status status, handle<process> proc_handle, handle<vmar> vmar_handle);
@@ -436,8 +424,7 @@
     /// Start execution on a process.
     [rights="handle must be of type ZX_OBJ_TYPE_PROCESS and have ZX_RIGHT_WRITE.",
      rights="thread must be of type ZX_OBJ_TYPE_THREAD and have ZX_RIGHT_WRITE.",
-     rights="arg1 must have ZX_RIGHT_TRANSFER.",
-     argtype="arg1 handle_release_always"]
+     rights="arg1 must have ZX_RIGHT_TRANSFER."]
     process_start(handle<process> handle, handle<thread> thread,
                   zx.vaddr entry, zx.vaddr stack,
                   handle arg1, uintptr_t arg2) ->
@@ -465,8 +452,7 @@
     //
 
     /// Create a new job.
-    [rights="parent_job must be of type ZX_OBJ_TYPE_JOB and have ZX_RIGHT_MANAGE_JOB.",
-     argtype="out handle_acquire"]
+    [rights="parent_job must be of type ZX_OBJ_TYPE_JOB and have ZX_RIGHT_MANAGE_JOB."]
     // TODO(ZX-2967): parent_job with ZX_RIGHT_WRITE is also accepted.
     job_create(handle<job> parent_job, uint32 options) -> (zx.status status, handle<job> out);
 
@@ -492,14 +478,12 @@
         (zx.status status);
 
     /// Suspend the given task. Currently only thread or process handles may be suspended.
-    [rights="handle must be of type ZX_OBJ_TYPE_THREAD or ZX_OBJ_TYPE_PROCESS and have ZX_RIGHT_WRITE.",
-     argtype="token handle_acquire"]
+    [rights="handle must be of type ZX_OBJ_TYPE_THREAD or ZX_OBJ_TYPE_PROCESS and have ZX_RIGHT_WRITE."]
     // TODO(banjo): handle<task>?
     task_suspend(handle handle) -> (zx.status status, handle token);
 
     /// Suspend the given task. Currently only thread or process handles may be suspended.
-    [rights="handle must be of type ZX_OBJ_TYPE_THREAD or ZX_OBJ_TYPE_PROCESS and have ZX_RIGHT_WRITE.",
-     argtype="token handle_acquire"]
+    [rights="handle must be of type ZX_OBJ_TYPE_THREAD or ZX_OBJ_TYPE_PROCESS and have ZX_RIGHT_WRITE."]
     // TODO(banjo): handle<task>?
     task_suspend_token(handle handle) -> (zx.status status, handle token);
 
@@ -513,8 +497,7 @@
 
     /// Create an exception channel for a given job, process, or thread.
     [rights="handle must have ZX_RIGHT_INSPECT and have ZX_RIGHT_DUPLICATE and have ZX_RIGHT_TRANSFER and have ZX_RIGHT_MANAGE_THREAD.",
-     rights="If handle is of type ZX_OBJ_TYPE_JOB or ZX_OBJ_TYPE_PROCESS, it must have ZX_RIGHT_ENUMERATE.",
-     argtype="out handle_acquire"]
+     rights="If handle is of type ZX_OBJ_TYPE_JOB or ZX_OBJ_TYPE_PROCESS, it must have ZX_RIGHT_ENUMERATE."]
     // TODO(banjo): handle<task>?
     // TODO(banjo): is out a real handle<channel> or just something similar?
     task_create_exception_channel(handle handle, uint32 options) ->
@@ -532,14 +515,12 @@
     //
 
     /// Create a handle for the exception's thread.
-    [rights="handle must be of type ZX_OBJ_TYPE_EXCEPTION.",
-     argtype="out handle_acquire"]
+    [rights="handle must be of type ZX_OBJ_TYPE_EXCEPTION."]
     // TODO(banjo): handle as handle<exception>
     exception_get_thread(handle handle) -> (zx.status status, handle<thread> out);
 
     /// Create a handle for the exception's process.
-    [rights="handle must be of type ZX_OBJ_TYPE_EXCEPTION.",
-     argtype="out handle_acquire"]
+    [rights="handle must be of type ZX_OBJ_TYPE_EXCEPTION."]
     // TODO(banjo): handle as handle<exception>
     exception_get_process(handle handle) -> (zx.status status, handle<process> out);
 
@@ -550,12 +531,9 @@
     //
 
     /// Create an event.
-    [argtype="out handle_acquire"]
     event_create(uint32 options) -> (zx.status status, handle<event> out);
 
     /// Create an event pair.
-    [argtype="out0 handle_acquire",
-     argtype="out1 handle_acquire"]
     eventpair_create(uint32 options) ->
         (zx.status status, handle<eventpair> out0, handle<eventpair> out1);
 
@@ -612,7 +590,6 @@
     //
 
     /// Create an IO port.
-    [argtype="out handle_acquire"]
     port_create(uint32 options) -> (zx.status status, handle<port> out);
 
     /// Queue a packet to a port.
@@ -639,7 +616,6 @@
     //
 
     /// Create a timer.
-    [argtype="out handle_acquire"]
     timer_create(uint32 options, zx.clock clock_id) -> (zx.status status, handle<timer> out);
 
     /// Start a timer.
@@ -657,7 +633,6 @@
     //
 
     /// Create a VM object.
-    [argtype="out handle_acquire"]
     vmo_create(uint64 size, uint32 options) -> (zx.status status, handle<vmo> out);
 
     /// Read bytes from the VMO.
@@ -702,8 +677,7 @@
         (zx.status status);
 
     /// Create a child of a VM Object.
-    [rights="handle must be of type ZX_OBJ_TYPE_VMO and have ZX_RIGHT_DUPLICATE and have ZX_RIGHT_READ.",
-     argtype="out handle_acquire"]
+    [rights="handle must be of type ZX_OBJ_TYPE_VMO and have ZX_RIGHT_DUPLICATE and have ZX_RIGHT_READ."]
     vmo_create_child(handle<vmo> handle, uint32 options, uint64 offset, uint64 size) ->
         (zx.status status, handle<vmo> out);
 
@@ -713,9 +687,7 @@
 
     /// Add execute rights to a VMO.
     [rights="handle must be of type ZX_OBJ_TYPE_VMO.",
-     rights="vmex must have resource kind ZX_RSRC_KIND_VMEX.",
-     argtype="handle handle_release_always",
-     argtype="out handle_acquire"]
+     rights="vmex must have resource kind ZX_RSRC_KIND_VMEX."]
     // TODO(ZX-2967): handle: No rights required, ZX_RIGHT_EXECUTE added to dup out
     // TODO(ZX-2967): vmex == ZX_HANDLE_INVALID also accepted.
     vmo_replace_as_executable(handle<vmo> handle, handle<resource> vmex) ->
@@ -731,8 +703,7 @@
     /// Allocate a new subregion.
     [rights="If options & ZX_VM_CAN_MAP_READ, parent_vmar must be of type ZX_OBJ_TYPE_VMAR and have ZX_RIGHT_READ.",
      rights="If options & ZX_VM_CAN_MAP_WRITE, parent_vmar must be of type ZX_OBJ_TYPE_VMAR and have ZX_RIGHT_WRITE.",
-     rights="If options & ZX_VM_CAN_MAP_EXECUTE, parent_vmar must be of type ZX_OBJ_TYPE_VMAR and have ZX_RIGHT_EXECUTE.",
-     argtype="child_vmar handle_acquire"]
+     rights="If options & ZX_VM_CAN_MAP_EXECUTE, parent_vmar must be of type ZX_OBJ_TYPE_VMAR and have ZX_RIGHT_EXECUTE."]
     vmar_allocate(handle<vmar> parent_vmar, zx.vm_option options, uint64 offset, uint64 size) ->
         (zx.status status, handle<vmar> child_vmar, zx.vaddr child_addr);
 
@@ -789,8 +760,6 @@
     //
 
     /// Create a fifo.
-    [argtype="out0 handle_acquire",
-     argtype="out1 handle_acquire"]
     fifo_create(usize elem_count, usize elem_size, uint32 options) ->
         (zx.status status, handle<fifo> out0, handle<fifo> out1);
 
@@ -819,8 +788,7 @@
 
     /// Create a scheduler profile.
     [rights="root_job must be of type ZX_OBJ_TYPE_JOB and have ZX_RIGHT_MANAGE_PROCESS.",
-     argtype="profile IN",
-     argtype="out handle_acquire"]
+     argtype="profile IN"]
     profile_create(handle<job> root_job, uint32 options, array<zx_profile_info_t>:1 profile) ->
         (zx.status status, handle<profile> out);
 
@@ -832,8 +800,7 @@
     //
 
     /// Unmap memory, close handle, exit.
-    [vdsocall,
-     argtype="close_handle handle_release"]
+    [vdsocall]
     // TODO(ZX-2399): ???
     vmar_unmap_handle_close_thread_exit(handle<vmar> vmar_handle,
                                         zx.vaddr addr, usize size,
@@ -843,8 +810,7 @@
     /// Write to futex, wake futex, close handle, exit.
     [vdsocall,
      noreturn,
-     argtype="value_ptr IN",
-     argtype="close_handle handle_release"]
+     argtype="value_ptr IN"]
     futex_wake_handle_close_thread_exit(array<zx_futex_t>:1 value_ptr,
                                         uint32 wake_count,
                                         int32 new_value,
@@ -858,8 +824,7 @@
     //
 
     // TODO(ZX-2967): handle == ZX_HANDLE_INVALID accepted.
-    [rights="resource must have resource kind ZX_RSRC_KIND_ROOT.",
-     argtype="out handle_acquire"]
+    [rights="resource must have resource kind ZX_RSRC_KIND_ROOT."]
     debuglog_create(handle<resource> resource, uint32 options) ->
         (zx.status status, handle<debuglog> out);
 
@@ -986,14 +951,12 @@
     [rights="resource must have resource kind ZX_RSRC_KIND_IOPORT."]
     ioports_release(handle<resource> resource, uint16 io_addr, uint32 len) -> (zx.status status);
 
-    [rights="bti must be of type ZX_OBJ_TYPE_BTI and have ZX_RIGHT_MAP.",
-     argtype="out handle_acquire"]
+    [rights="bti must be of type ZX_OBJ_TYPE_BTI and have ZX_RIGHT_MAP."]
     vmo_create_contiguous(handle<bti> bti, usize size, uint32 alignment_log2) ->
         (zx.status status, handle<vmo> out);
 
     /// Create a VM object referring to a specific contiguous range of physical memory.
-    [rights="resource must have resource kind ZX_RSRC_KIND_MMIO.",
-     argtype="out handle_acquire"]
+    [rights="resource must have resource kind ZX_RSRC_KIND_MMIO."]
     vmo_create_physical(handle<vmo> resource, zx.paddr paddr, usize size) ->
         (zx.status status, handle<vmo> out);
 
@@ -1007,15 +970,13 @@
 
     /// Create a new IOMMU object in the kernel.
     [rights="resource must have resource kind ZX_RSRC_KIND_ROOT.",
-     argtype="desc IN",
-     argtype="out handle_acquire"]
+     argtype="desc IN"]
     iommu_create(handle<resource> resource, uint32 type,
                  array<voidptr>:desc_size desc, usize desc_size) ->
         (zx.status status, handle<iommu> out);
 
     /// Create a new bus transaction initiator.
-    [rights="iommu must be of type ZX_OBJ_TYPE_IOMMU and have ZX_RIGHT_NONE.",
-     argtype="out handle_acquire"]
+    [rights="iommu must be of type ZX_OBJ_TYPE_IOMMU and have ZX_RIGHT_NONE."]
     // TODO(ZX-2967): This is unusual.
     bti_create(handle<iommu> iommu, uint32 options, uint64 bti_id) ->
         (zx.status status, handle<bti> out);
@@ -1027,8 +988,7 @@
      rights="If options & ZX_BTI_PERM_WRITE, vmo must be of type ZX_OBJ_TYPE_VMO and have ZX_RIGHT_WRITE.",
     // READ is intentional in the following EXECUTE condition.
      rights="If options & ZX_BTI_PERM_EXECUTE, vmo must be of type ZX_OBJ_TYPE_VMO and have ZX_RIGHT_READ.",
-     argtype="addrs OUT",
-     argtype="pmt handle_acquire"]
+     argtype="addrs OUT"]
     bti_pin(handle<bti> handle, uint32 options, handle<vmo> vmo, uint64 offset, uint64 size,
             array<zx.paddr>:addrs_count addrs, usize addrs_count) ->
         (zx.status status, handle<pmt> pmt);
@@ -1038,7 +998,6 @@
     bti_release_quarantine(handle<bti> handle) -> (zx.status status);
 
     /// Unpin pages and revoke device access to them.
-    [argtype="handle handle_release_always"]
     // TODO(ZX-2967): handle ZX_OBJ_TYPE_PMT; No rights required?
     pmt_unpin(handle<pmt> handle) -> (zx.status status);
 
@@ -1067,8 +1026,7 @@
     //
     //
 
-    [rights="handle must have resource kind ZX_RSRC_KIND_ROOT.",
-     argtype="out_handle handle_acquire"]
+    [rights="handle must have resource kind ZX_RSRC_KIND_ROOT."]
     // TODO(banjo): out_handle as handle<device>
     pci_get_nth_device(handle<resource> handle, uint32 index) ->
         (zx.status status, zx_pcie_device_info_t out_info, handle out_handle);
@@ -1098,15 +1056,13 @@
         (zx.status status);
 
     [rights="handle must be of type ZX_OBJ_TYPE_PCI_DEVICE and have ZX_RIGHT_READ and have ZX_RIGHT_WRITE.",
-     argtype="out_bar OUT",
-     argtype="out_handle handle_acquire"]
+     argtype="out_bar OUT"]
     // TODO(banjo): handle as handle<device>
     // TODO(banjo): type of out_handle?
     pci_get_bar(handle handle, uint32 bar_num, array<zx_pci_bar_t>:1 out_bar) ->
         (zx.status status, handle out_handle);
 
-    [rights="handle must be of type ZX_OBJ_TYPE_PCI_DEVICE and have ZX_RIGHT_READ.",
-     argtype="out_handle handle_acquire"]
+    [rights="handle must be of type ZX_OBJ_TYPE_PCI_DEVICE and have ZX_RIGHT_READ."]
     // TODO(banjo): handle as handle<device>
     pci_map_interrupt(handle handle, int32 which_irq) -> (zx.status status, handle out_handle);
 
@@ -1162,8 +1118,7 @@
 
     /// Create a resource object.
     [rights="parent_rsrc must be of type ZX_OBJ_TYPE_RESOURCE and have ZX_RIGHT_WRITE.",
-     argtype="name IN",
-     argtype="resource_out handle_acquire"]
+     argtype="name IN"]
     resource_create(handle<resource> parent_rsrc, uint32 options, uint64 base, usize size,
                     string:name_size name, usize name_size) ->
         (zx.status status, handle<resource> resource_out);
@@ -1176,9 +1131,7 @@
     //
 
     /// Create a guest.
-    [rights="resource must have resource kind ZX_RSRC_KIND_HYPERVISOR.",
-     argtype="guest_handle handle_acquire",
-     argtype="vmar_handle handle_acquire"]
+    [rights="resource must have resource kind ZX_RSRC_KIND_HYPERVISOR."]
     guest_create(handle<resource> resource, uint32 options) ->
         (zx.status status, handle<guest> guest_handle, handle<vmar> vmar_handle);
 
@@ -1190,8 +1143,7 @@
         (zx.status status);
 
     /// Create a VCPU.
-    [rights="guest must be of type ZX_OBJ_TYPE_GUEST and have ZX_RIGHT_MANAGE_PROCESS.",
-     argtype="out handle_acquire"]
+    [rights="guest must be of type ZX_OBJ_TYPE_GUEST and have ZX_RIGHT_MANAGE_PROCESS."]
     vcpu_create(handle<guest> guest, uint32 options, zx.vaddr entry) ->
         (zx.status status, handle<vcpu> out);
 
@@ -1255,14 +1207,12 @@
     //
 
     /// Create a new pager object.
-    [rights="None.",
-     argtype="out handle_acquire"]
+    [rights="None."]
     pager_create(uint32 options) -> (zx.status status, handle<pager> out);
 
     /// Create a pager owned vmo.
     [rights="pager must be of type ZX_OBJ_TYPE_PAGER.",
-     rights="port must be of type ZX_OBJ_TYPE_PORT and have ZX_RIGHT_WRITE.",
-     argtype="out handle_acquire"]
+     rights="port must be of type ZX_OBJ_TYPE_PORT and have ZX_RIGHT_WRITE."]
     pager_create_vmo(handle<pager> pager, uint32 options,
                      handle<port> port, uint64 key, uint64 size) ->
         (zx.status status, handle<vmo> out);
@@ -1312,7 +1262,6 @@
 
     syscall_test_wrapper(int32 a, int32 b, int32 c) -> (zx.status status);
 
-    [argtype="out handle_acquire"]
     syscall_test_handle_create(zx.status return_value) -> (zx.status status, handle<event> out);
 };
 
diff --git a/zircon/system/public/zircon/syscalls.h b/zircon/system/public/zircon/syscalls.h
index 1544468..b5eb9ea 100644
--- a/zircon/system/public/zircon/syscalls.h
+++ b/zircon/system/public/zircon/syscalls.h
@@ -14,12 +14,6 @@
 
 __BEGIN_CDECLS
 
-#if defined(__clang__)
-#define ZX_SYSCALL_PARAM_ATTR(x) __attribute__((annotate("zx_" #x)))
-#else
-#define ZX_SYSCALL_PARAM_ATTR(x)  // no-op
-#endif
-
 #include <zircon/syscalls/definitions.h>
 
 // Compatibility wrappers for deprecated syscalls also go here, when
diff --git a/zircon/tools/abigen/generator.cc b/zircon/tools/abigen/generator.cc
index 723375c..5d76c627 100644
--- a/zircon/tools/abigen/generator.cc
+++ b/zircon/tools/abigen/generator.cc
@@ -11,8 +11,6 @@
 using std::string;
 
 static constexpr char kAuthors[] = "The Fuchsia Authors";
-static constexpr char kWrapMacro[] = "ZX_SYSCALL_PARAM_ATTR";
-static constexpr char kDefaultHandleAnnotation[] = "handle_use";
 bool is_identifier_keyword(const string& iden);
 
 bool Generator::header(ofstream& os) {
@@ -125,7 +123,6 @@
       os << inter_arg;
     }
     first = false;
-    write_argument_annotation(os, arg);
     os << arg.as_cpp_declaration(wrap_pointers_with_user_ptr) << ",";
   });
 
@@ -165,17 +162,3 @@
 
   os << ");\n";
 }
-
-void write_argument_annotation(std::ofstream& os, const TypeSpec& arg) {
-  bool has_annotation = false;
-  for (const auto& a : arg.attributes) {
-    if (!a.empty() && !is_identifier_keyword(a)) {
-      has_annotation = true;
-      os << kWrapMacro << "(" << a << ") ";
-    }
-  }
-  // If arg type is a handle (not an array) and no annotation is present, use default annotation
-  if (!has_annotation && arg.type == "zx_handle_t" && arg.arr_spec == nullptr) {
-    os << kWrapMacro << "(" << kDefaultHandleAnnotation << ") ";
-  }
-}
diff --git a/zircon/tools/abigen/generator.h b/zircon/tools/abigen/generator.h
index f3555e6..586df36 100644
--- a/zircon/tools/abigen/generator.h
+++ b/zircon/tools/abigen/generator.h
@@ -143,6 +143,4 @@
 void write_syscall_invocation(std::ofstream& os, const Syscall& sc, const std::string& return_var,
                               const std::string& name_prefix);
 
-void write_argument_annotation(std::ofstream& os, const TypeSpec& arg);
-
 #endif  // ZIRCON_TOOLS_ABIGEN_GENERATOR_H_
diff --git a/zircon/tools/abigen/header_generator.cc b/zircon/tools/abigen/header_generator.cc
index ecdbdaf..de7d3fb 100644
--- a/zircon/tools/abigen/header_generator.cc
+++ b/zircon/tools/abigen/header_generator.cc
@@ -60,9 +60,6 @@
         os << a << " ";
     }
 
-    if (sc.ret_spec.size() > 0)
-      write_argument_annotation(os, sc.ret_spec[0]);
-
     os.seekp(-1, std::ios_base::end);
 
     os << ";\n\n";