Add restrict annotations to all functions that require it

Message ID CAA42iKx9UWADYaMRGTVrnR==P8yTQzOWLV3TY65QEWLW9v-ehQ@mail.gmail.com
State Changes Requested, archived
Headers
Series Add restrict annotations to all functions that require it |

Checks

Context Check Description
dj/TryBot-apply_patch fail Patch failed to apply to master at the time it was sent
dj/TryBot-32bit fail Patch series failed to apply

Commit Message

Seija K. Nov. 27, 2022, 12:56 a.m. UTC
  The format value has to be a string literal, every time. Otherwise, you are
not using these functions correctly. To reinforce this fact, I put
__restrict over every example of this I could find.
---
 argp/argp-fmtstream.c                         |   2 +-
 argp/argp-help.c                              |   8 +-
 assert/assert.c                               |   8 +-
 elf/dl-exception.c                            |   6 +-
 elf/dl-printf.c                               |  14 +-
 include/argp.h                                |   4 +-
 include/assert.h                              |   2 +-
 include/programs/xasprintf.h                  |   2 +-
 include/sys/syslog.h                          |   2 +-
 include/time.h                                |   4 +-
 libio/libioP.h                                |   2 +-
 libio/tst-memstream3.c                        |   2 +-
 locale/programs/linereader.h                  |   2 +-
 misc/syslog.c                                 |  10 +-
 nscd/dbg_log.c                                |   2 +-
 nscd/selinux.c                                |   4 +-
 posix/bug-getopt1.c                           |   2 +-
 posix/bug-getopt2.c                           |   2 +-
 posix/bug-getopt3.c                           |   2 +-
 posix/bug-getopt4.c                           |   2 +-
 posix/bug-getopt5.c                           |   2 +-
 posix/tst-gnuglob-skeleton.c                  |   4 +-
 stdio-common/bug-vfprintf-nargs.c             |   2 +-
 stdio-common/fxprintf.c                       |   8 +-
 stdio-common/printf-prs.c                     |   2 +-
 stdio-common/scanf16.c                        |   6 +-
 stdio-common/scanf16a.c                       |   6 +-
 stdio-common/scanf17.c                        |   6 +-
 stdio-common/tst-printf-round.c               |   8 +-
 stdio-common/tst-printf.c                     |   6 +-
 stdlib/strfmon_l.c                            |   6 +-
 stdlib/tst-swapcontext1.c                     |   4 +-
 string/memccpy.c                              |   2 +-
 string/memchr.c                               |   2 +-
 string/memcpy.c                               |   6 +-
 string/memfrob.c                              |   2 +-
 string/mempcpy.c                              |   2 +-
 string/memrchr.c                              |   5 +-
 string/memset.c                               |   2 +-
 string/stpcpy.c                               |   2 +-
 string/stpncpy.c                              |   4 +-
 string/strcat.c                               |   2 +-
 string/strcpy.c                               |   2 +-
 string/strlen.c                               |   5 +-
 string/strncat.c                              |   2 +-
 string/strncpy.c                              |   2 +-
 string/strsep.c                               |   2 +-
 string/strtok.c                               |   2 +-
 string/strtok_r.c                             |   2 +-
 string/strxfrm.c                              |   2 +-
 string/strxfrm_l.c                            |   8 +-
 string/swab.c                                 |   8 +-
 support/support.h                             |   2 +-
 sysdeps/generic/ldsodefs.h                    |  14 +-
 .../ldbl-128ibm-compat/ieee128-argp-help.c    |   4 +-
 .../ldbl-128ibm-compat/ieee128-syslog.c       |   8 +-
 sysdeps/ieee754/ldbl-opt/nldbl-asprintf.c     |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-asprintf_chk.c |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-compat.c       | 176 +++++++++---------
 sysdeps/ieee754/ldbl-opt/nldbl-dprintf.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-dprintf_chk.c  |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-fprintf.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-fprintf_chk.c  |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-fscanf.c       |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-iovfscanf.c    |   2 +-
 .../ieee754/ldbl-opt/nldbl-isoc99_fscanf.c    |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-isoc99_scanf.c |   2 +-
 .../ieee754/ldbl-opt/nldbl-isoc99_sscanf.c    |   2 +-
 .../ieee754/ldbl-opt/nldbl-isoc99_vfscanf.c   |   2 +-
 .../ieee754/ldbl-opt/nldbl-isoc99_vscanf.c    |   2 +-
 .../ieee754/ldbl-opt/nldbl-isoc99_vsscanf.c   |   2 +-
 .../ieee754/ldbl-opt/nldbl-obstack_printf.c   |   2 +-
 .../ldbl-opt/nldbl-obstack_printf_chk.c       |   2 +-
 .../ieee754/ldbl-opt/nldbl-obstack_vprintf.c  |   2 +-
 .../ldbl-opt/nldbl-obstack_vprintf_chk.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-printf.c       |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-printf_chk.c   |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-scanf.c        |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-snprintf.c     |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-snprintf_chk.c |   4 +-
 sysdeps/ieee754/ldbl-opt/nldbl-sprintf.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-sprintf_chk.c  |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-sscanf.c       |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-syslog.c       |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-syslog_chk.c   |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vasprintf.c    |   2 +-
 .../ieee754/ldbl-opt/nldbl-vasprintf_chk.c    |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vdprintf.c     |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vdprintf_chk.c |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vfprintf.c     |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vfprintf_chk.c |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vfscanf.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vprintf.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vprintf_chk.c  |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vscanf.c       |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf.c    |   2 +-
 .../ieee754/ldbl-opt/nldbl-vsnprintf_chk.c    |   4 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vsprintf.c     |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vsprintf_chk.c |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vsscanf.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vsyslog.c      |   2 +-
 sysdeps/ieee754/ldbl-opt/nldbl-vsyslog_chk.c  |   2 +-
 sysdeps/posix/libc_fatal.c                    |   2 +-
 sysdeps/x86_64/dl-machine.h                   |  17 +-
 time/strptime.c                               |   2 +-
 time/strptime_l.c                             |   8 +-
 time/tst-strftime.c                           |   2 +-
 107 files changed, 265 insertions(+), 270 deletions(-)
  

Comments

Mike Frysinger Nov. 27, 2022, 11:44 a.m. UTC | #1
On 26 Nov 2022 19:56, Seija K. via Libc-alpha wrote:
> The format value has to be a string literal, every time. Otherwise, you are
> not using these functions correctly. To reinforce this fact, I put
> __restrict over every example of this I could find.

there's at least some redundant settings in here that aren't needed.  for
example, the strptime prototype in time/time.h has restrict on fmt already,
so it isn't needed in time/strptime.c.
-mike
  
Alejandro Colomar Nov. 27, 2022, noon UTC | #2
Hi,

On 11/27/22 12:44, Mike Frysinger via Libc-alpha wrote:
> On 26 Nov 2022 19:56, Seija K. via Libc-alpha wrote:
>> The format value has to be a string literal, every time. Otherwise, you are
>> not using these functions correctly. To reinforce this fact, I put
>> __restrict over every example of this I could find.
> 
> there's at least some redundant settings in here that aren't needed.  for
> example, the strptime prototype in time/time.h has restrict on fmt already,
> so it isn't needed in time/strptime.c.
> -mike

I just confirmed that neither clang(1) nor clang-tidy(1) emit any warnings (with 
warnings to -Weverything and checks to *) at all if only the prototype has 
restrict.  So yes, it seems redundant.

Cheers,

Alex

-- 
<http://www.alejandro-colomar.es/>
  
Alejandro Colomar Nov. 27, 2022, 12:04 p.m. UTC | #3
Hi Seija,

On 11/27/22 01:56, Seija K. via Libc-alpha wrote:
> The format value has to be a string literal, every time. Otherwise, you are
> not using these functions correctly. To reinforce this fact, I put
> __restrict over every example of this I could find.

The subject and the rest of the commit message seem to say different things. 
The subject says that _all_ functions have been fixed, but when I read the rest 
of the commit message, it seems that only the format strings have been fixed. 
Which of both is true?

 From reading the patch, it seems all of them have been fixed; not only format 
strings.  Could you maybe reword to be a little bit more precise?

Cheers,

Alex
-- 
<http://www.alejandro-colomar.es/>
  
Alejandro Colomar Nov. 27, 2022, 12:30 p.m. UTC | #4
[CC += all CCs from man-pages patches]

Hi Seija,

On 11/27/22 01:56, Seija K. via Libc-alpha wrote:
> The format value has to be a string literal, every time. Otherwise, you are
> not using these functions correctly. To reinforce this fact, I put
> __restrict over every example of this I could find.


I like this change.  In fact, when I added 'restrict' to the Linux man-pages, I 
had to check that in some cases POSIX and glibc matched, but in others, either 
glibc or POSIX had restrict while the other didn't:

Linux man-pages commits:

-  746d60af802a4462055c4f87a62681f7254325d8 [strptime(3)]
    -  You fixed this one in the patch; fine.
-  0864c240797e3b793a88ee6be5710dd9a8df9b45 [posix_spawnp(3)]
    -  This one hasn't been changed in you patch; please check.
    -  Bug reported here: <https://sourceware.org/bugzilla/show_bug.cgi?id=27529>
    -  See some proof below.
-  c445280cf371cda66916c4e5e0fdb168db3a5ad6 [lio_listio(3)]
    -  This one hasn't been changed in you patch; please check.
    -  Bug reported here: <https://sourceware.org/bugzilla/show_bug.cgi?id=16747>
    -  See some proof below.

I might have missed other cases by accident, but I think those 3 are all the 
cases where POSIX uses restrict and glibc doesn't (there are many more cases of 
the opposite, but that's OK for your patch), as far as I documented back then 
when I added restrict to the man-pages.

Cheers,

Alex

P.S.: I'm neutral to having the 'restrict' keyword in function definitions, if 
they are already in function prototypes (Mike reported this).

--- posix_spawnp(3):

$ man 3p posix_spawnp |sed -n '/^SYNOPSIS/,/;/p'
SYNOPSIS
        #include <spawn.h>

        int posix_spawnp(pid_t *restrict pid, const char *restrict file,
            const posix_spawn_file_actions_t *file_actions,
            const posix_spawnattr_t *restrict attrp,
            char *const argv[restrict], char *const envp[restrict]);
$ grepc posix_spawnp /usr/include
/usr/include/spawn.h:85:
extern int posix_spawnp (pid_t *__pid, const char *__file,
			 const posix_spawn_file_actions_t *__file_actions,
			 const posix_spawnattr_t *__attrp,
			 char *const __argv[], char *const __envp[])
     __nonnull ((2, 5));

--- lio_listio(3):

$ man 3p lio_listio |sed -n '/^SYNOPSIS/,/;/p'
SYNOPSIS
        #include <aio.h>

        int lio_listio(int mode, struct aiocb *restrict const list[restrict],
            int nent, struct sigevent *restrict sig);
$ grepc lio_listio /usr/include
/usr/include/aio.h:148:
extern int lio_listio (int __mode,
		       struct aiocb *const __list[__restrict_arr],
		       int __nent, struct sigevent *__restrict __sig)
   __THROW __nonnull ((2));


/usr/include/aio.h:214:
#  define lio_listio lio_listio64
-- 
<http://www.alejandro-colomar.es/>
  
Alejandro Colomar Nov. 27, 2022, 12:39 p.m. UTC | #5
[CC += Andreas]

On 11/27/22 13:30, Alejandro Colomar wrote:
> [CC += all CCs from man-pages patches]
> 
> Hi Seija,
> 
> On 11/27/22 01:56, Seija K. via Libc-alpha wrote:
>> The format value has to be a string literal, every time. Otherwise, you are
>> not using these functions correctly. To reinforce this fact, I put
>> __restrict over every example of this I could find.
> 
> 
> I like this change.  In fact, when I added 'restrict' to the Linux man-pages, I 
> had to check that in some cases POSIX and glibc matched, but in others, either 
> glibc or POSIX had restrict while the other didn't:
> 
> Linux man-pages commits:
> 
> -  746d60af802a4462055c4f87a62681f7254325d8 [strptime(3)]
>     -  You fixed this one in the patch; fine.
> -  0864c240797e3b793a88ee6be5710dd9a8df9b45 [posix_spawnp(3)]
>     -  This one hasn't been changed in you patch; please check.
>     -  Bug reported here: <https://sourceware.org/bugzilla/show_bug.cgi?id=27529>
>     -  See some proof below.
> -  c445280cf371cda66916c4e5e0fdb168db3a5ad6 [lio_listio(3)]
>     -  This one hasn't been changed in you patch; please check.
>     -  Bug reported here: <https://sourceware.org/bugzilla/show_bug.cgi?id=16747>
>     -  See some proof below.
> 
> I might have missed other cases by accident, but I think those 3 are all the 
> cases where POSIX uses restrict and glibc doesn't (there are many more cases of 
> the opposite, but that's OK for your patch), as far as I documented back then 
> when I added restrict to the man-pages.
> 
> Cheers,
> 
> Alex
> 
> P.S.: I'm neutral to having the 'restrict' keyword in function definitions, if 
> they are already in function prototypes (Mike reported this).
> 
> --- posix_spawnp(3):
> 
> $ man 3p posix_spawnp |sed -n '/^SYNOPSIS/,/;/p'
> SYNOPSIS
>         #include <spawn.h>
> 
>         int posix_spawnp(pid_t *restrict pid, const char *restrict file,
>             const posix_spawn_file_actions_t *file_actions,
>             const posix_spawnattr_t *restrict attrp,
>             char *const argv[restrict], char *const envp[restrict]);
> $ grepc posix_spawnp /usr/include
> /usr/include/spawn.h:85:
> extern int posix_spawnp (pid_t *__pid, const char *__file,
>               const posix_spawn_file_actions_t *__file_actions,
>               const posix_spawnattr_t *__attrp,
>               char *const __argv[], char *const __envp[])
>      __nonnull ((2, 5));
> 
> --- lio_listio(3):
> 
> $ man 3p lio_listio |sed -n '/^SYNOPSIS/,/;/p'
> SYNOPSIS
>         #include <aio.h>
> 
>         int lio_listio(int mode, struct aiocb *restrict const list[restrict],
>             int nent, struct sigevent *restrict sig);
> $ grepc lio_listio /usr/include
> /usr/include/aio.h:148:
> extern int lio_listio (int __mode,
>                 struct aiocb *const __list[__restrict_arr],
>                 int __nent, struct sigevent *__restrict __sig)
>    __THROW __nonnull ((2));
> 
> 
> /usr/include/aio.h:214:
> #  define lio_listio lio_listio64

-- 
<http://www.alejandro-colomar.es/>
  
Joseph Myers Nov. 28, 2022, 9:17 p.m. UTC | #6
On Sat, 26 Nov 2022, Seija K. via Libc-alpha wrote:

> The format value has to be a string literal, every time. Otherwise, you are
> not using these functions correctly. To reinforce this fact, I put
> __restrict over every example of this I could find.

There are several other changes in this patch that aren't adding 
__restrict.  Maybe they are a good idea, maybe they aren't, but they 
aren't described by the proposed commit message, and a patch should do one 
thing and do it well (so if those other changes are desirable, they should 
go in a separate patch with its own commit message explaining them).

For both patches, it would also be helpful to know whether they result in 
any changes to installed stripped shared libraries.

> diff --git a/string/memcpy.c b/string/memcpy.c
> index 9cf64530e73..920683e3d8c 100644
> --- a/string/memcpy.c
> +++ b/string/memcpy.c
> @@ -25,10 +25,10 @@
>  #endif
> 
>  void *
> -MEMCPY (void *dstpp, const void *srcpp, size_t len)
> +MEMCPY (void *__restrict dstpp, const void *__restrict srcpp, size_t len)
>  {
> -  unsigned long int dstp = (long int) dstpp;
> -  unsigned long int srcp = (long int) srcpp;
> +  unsigned long int dstp = (unsigned long int) dstpp;
> +  unsigned long int srcp = (unsigned long int) srcpp;

This is an example of the other changes.

> diff --git a/string/memfrob.c b/string/memfrob.c
> index 9707cb9fda1..025929f90cb 100644
> --- a/string/memfrob.c
> +++ b/string/memfrob.c
> @@ -22,7 +22,7 @@ memfrob (void *s, size_t n)
>  {
>    char *p = (char *) s;
> 
> -  while (n-- > 0)
> +  for (; n; n--)
>      *p++ ^= 42;

Likewise.

> diff --git a/string/memrchr.c b/string/memrchr.c
> index 8eb6829e458..7fd7f666c84 100644
> --- a/string/memrchr.c
> +++ b/string/memrchr.c
> @@ -63,9 +63,8 @@ MEMRCHR
>    const unsigned char *char_ptr;
>    const unsigned long int *longword_ptr;
>    unsigned long int longword, magic_bits, charmask;
> -  unsigned char c;
> 
> -  c = (unsigned char) c_in;
> +  const unsigned char c = (const unsigned char) c_in;
> 
>    /* Handle the last few characters by reading one character at a time.
>       Do this until CHAR_PTR is aligned on a longword boundary.  */
> @@ -182,7 +181,7 @@ MEMRCHR
> 
>    char_ptr = (const unsigned char *) longword_ptr;
> 
> -  while (n-- > 0)
> +  for (; n > 0; --n)

Likewise.

> diff --git a/string/memset.c b/string/memset.c
> index 1303dd7ad36..273bd5d6ff0 100644
> --- a/string/memset.c
> +++ b/string/memset.c
> @@ -26,7 +26,7 @@ void *
>  inhibit_loop_to_libcall
>  MEMSET (void *dstpp, int c, size_t len)
>  {
> -  long int dstp = (long int) dstpp;
> +  unsigned long int dstp = (unsigned long int) dstpp;

Likewise.

> diff --git a/string/stpncpy.c b/string/stpncpy.c
> index 61f0134fb20..7346d790a1a 100644
> --- a/string/stpncpy.c
> +++ b/string/stpncpy.c
> @@ -37,9 +37,9 @@ weak_alias (__stpncpy, stpncpy)
>  /* Copy no more than N characters of SRC to DEST, returning the address of
>     the terminating '\0' in DEST, if any, or else DEST + N.  */
>  char *
> -STPNCPY (char *dest, const char *src, size_t n)
> +STPNCPY (char * __restrict dest, const char * __restrict src, size_t n)
>  {
> -  size_t size = __strnlen (src, n);
> +  const size_t size = __strnlen (src, n);

Likewise.

> diff --git a/string/strlen.c b/string/strlen.c
> index 54f3fb8167a..f443fd16d86 100644
> --- a/string/strlen.c
> +++ b/string/strlen.c
> @@ -33,6 +33,9 @@ STRLEN (const char *str)
>    const unsigned long int *longword_ptr;
>    unsigned long int longword, himagic, lomagic;
> 
> +  if (sizeof (longword) > 8)
> +    abort ();
> +
>    /* Handle the first few characters by reading one character at a time.
>       Do this until CHAR_PTR is aligned on a longword boundary.  */
>    for (char_ptr = str; ((unsigned long int) char_ptr
> @@ -59,8 +62,6 @@ STRLEN (const char *str)
>        himagic = ((himagic << 16) << 16) | himagic;
>        lomagic = ((lomagic << 16) << 16) | lomagic;
>      }
> -  if (sizeof (longword) > 8)
> -    abort ();

Likewise (and if you change anything here, surely using a static assertion 
is better than this "if").

> diff --git a/string/strxfrm_l.c b/string/strxfrm_l.c
> index 188a3d826a6..79596a9c6de 100644
> --- a/string/strxfrm_l.c
> +++ b/string/strxfrm_l.c
> @@ -441,7 +441,7 @@ do_xfrm_cached (STRING_TYPE *dest, size_t n, const
> locale_data_t *l_data,
>    len = weights[idxarr[backw]++];
> 
>    if (needed + len < n)
> -    while (len-- > 0)
> +    for (; len; --len)
>        dest[needed++] = weights[idxarr[backw]++];
>    else
>      {
> @@ -457,7 +457,7 @@ do_xfrm_cached (STRING_TYPE *dest, size_t n, const
> locale_data_t *l_data,
>    /* Now handle the forward element.  */
>    len = weights[idxarr[idxcnt]++];
>    if (needed + len < n)
> -    while (len-- > 0)
> +    for (; len; --len)
>        dest[needed++] = weights[idxarr[idxcnt]++];
>    else
>      {
> @@ -488,7 +488,7 @@ do_xfrm_cached (STRING_TYPE *dest, size_t n, const
> locale_data_t *l_data,
>    size_t len = weights[idxarr[--backw]++];
> 
>    if (needed + len < n)
> -    while (len-- > 0)
> +    for (; len; --len)
>        dest[needed++] = weights[idxarr[backw]++];
>    else

Likewise.

> diff --git a/string/swab.c b/string/swab.c
> index 083a80091f7..6aecb93c5eb 100644
> --- a/string/swab.c
> +++ b/string/swab.c
> @@ -18,15 +18,15 @@
>  #include <unistd.h>
> 
>  void
> -swab (const void *bfrom, void *bto, ssize_t n)
> +swab (const void *__restrict bfrom, void *__restrict bto, ssize_t n)
>  {
> -  const char *from = (const char *) bfrom;
> -  char *to = (char *) bto;
> +  const unsigned char *from = (const unsigned char *) bfrom;
> +  unsigned char *to = (unsigned char *) bto;
> 
>    n &= ~((ssize_t) 1);
>    while (n > 1)
>      {
> -      const char b0 = from[--n], b1 = from[--n];
> +      const unsigned char b0 = from[--n], b1 = from[--n];

Likewise.

> diff --git a/sysdeps/x86_64/dl-machine.h b/sysdeps/x86_64/dl-machine.h
> index 005d089501f..922eed6deae 100644
> --- a/sysdeps/x86_64/dl-machine.h
> +++ b/sysdeps/x86_64/dl-machine.h
> @@ -416,17 +416,14 @@ and creates an unsatisfiable circular dependency.\n",
>    value += reloc->r_addend;
>    *(unsigned int *) reloc_addr = value;
> 
> -  const char *fmt;

Likewise; lots of changes here with nothing apparently to do with 
restrict.
  
Alejandro Colomar Dec. 3, 2022, 2:32 p.m. UTC | #7
Hi Mike and Seija,

On 11/27/22 13:00, Alejandro Colomar wrote:
> Hi,
> 
> On 11/27/22 12:44, Mike Frysinger via Libc-alpha wrote:
>> On 26 Nov 2022 19:56, Seija K. via Libc-alpha wrote:
>>> The format value has to be a string literal, every time. Otherwise, you are
>>> not using these functions correctly. To reinforce this fact, I put
>>> __restrict over every example of this I could find.
>>
>> there's at least some redundant settings in here that aren't needed.  for
>> example, the strptime prototype in time/time.h has restrict on fmt already,
>> so it isn't needed in time/strptime.c.
>> -mike
> 
> I just confirmed that neither clang(1) nor clang-tidy(1) emit any warnings (with 
> warnings to -Weverything and checks to *) at all if only the prototype has 
> restrict.  So yes, it seems redundant.

I've been thinking about this...  I changed my mind; I'm not neutral anymore 
about this.  I think it's better to add it, even if "redundant" to the compiler 
in most cases.

There are cases where it's not redundant:

$ cat restrict.c
void *f(int *restrict *restrict p, int *q);

void *f(int **p, int *q)
{
	return *p ?: q;
}

$ cc -Wall -Wextra restrict.c
restrict.c:3:7: error: conflicting types for ‘f’; have ‘void *(int **, int *)’
     3 | void *f(int **p, int *q)
       |       ^
restrict.c:1:7: note: previous declaration of ‘f’ with type ‘void *(int * 
restrict* restrict,  int *)’
     1 | void *f(int *restrict *restrict p, int *q);
       |       ^


This happens at least once in libc functions (although glibc differs from POSIX 
here), in lio_listio(3):

SYNOPSIS
        #include <aio.h>

        int lio_listio(int mode,
                       struct aiocb *restrict const aiocb_list[restrict],
                       int nitems, struct sigevent *restrict sevp);


So, the thing seems to be similar to 'const' being irrelevant for variables and 
pointers (but not pointees), which is why it is rarely used in function 
declarators.  When it is used, it only has a meaning in the function definition, 
since it makes the local variable const, but to the caller it's just noise, 
which is why it's never used in prototypes.

With 'restrict', the compiler seems to accept compatibility of types with the 
same rules, but this qualifier is meaningful to both the caller and the function 
definition.  In the prototype, it reminds the caller that the arguments should 
not alias, and maybe can help catch a few silly mistakes.  In the function 
definition, it reminds the implementor that it has some more freedom to 
implement the function.  So, even if it is redundant to the compiler, it is not 
to the programmer, and I think it would make sense to add a compiler warning 
that warns about mismatching restrict in function declarators.

For example, this would be nonsense (and I honestly don't know what the compiler 
would understand from it):

void broken(int *restrict a, int *b, int *c);
void broken(int *a, int *restrict b, int *c);

Does this mean that all parameters are really restrict?  That's the only logical 
conclusion in my head, but it is so braindead that it may just be implemented as 
UB.  A warning would be nice, to catch typos/thinkos while typing them.


Cheers,

Alex

-- 
<http://www.alejandro-colomar.es/>
  
Joseph Myers Dec. 6, 2022, 11:57 p.m. UTC | #8
On Sat, 3 Dec 2022, Alejandro Colomar via Libc-alpha wrote:

> For example, this would be nonsense (and I honestly don't know what the
> compiler would understand from it):
> 
> void broken(int *restrict a, int *b, int *c);
> void broken(int *a, int *restrict b, int *c);

Qualifiers on parameters in a function declarator that is not part of a 
definition of that function have no semantic effect; restrict on function 
parameters only has a semantic effect in the definition of the function.
  
Alejandro Colomar Dec. 7, 2022, 11:59 a.m. UTC | #9
Hi Joseph!

On 12/7/22 00:57, Joseph Myers wrote:
> On Sat, 3 Dec 2022, Alejandro Colomar via Libc-alpha wrote:
> 
>> For example, this would be nonsense (and I honestly don't know what the
>> compiler would understand from it):
>>
>> void broken(int *restrict a, int *b, int *c);
>> void broken(int *a, int *restrict b, int *c);
> 
> Qualifiers on parameters in a function declarator that is not part of a
> definition of that function have no semantic effect; restrict on function
> parameters only has a semantic effect in the definition of the function.
> 

Having restrict in the prototype may not change the semantics, but it is 
meaningful to the warnings:


$ cat restrict.c
void broken(int *restrict a, int *b, int *c);
void broken(int *a, int *restrict b, int *c);

void f(int *restrict p, int *restrict q, int *restrict r)
{
	broken(p, p, q);
	broken(p, q, p);
	broken(p, q, r);
}

$ cc -Wall -Wextra -S restrict.c
restrict.c: In function ‘f’:
restrict.c:6:9: warning: passing argument 1 to ‘restrict’-qualified parameter 
aliases with argument 2 [-Wrestrict]
     6 |         broken(p, p, q);
       |         ^~~~~~
restrict.c:7:9: warning: passing argument 1 to ‘restrict’-qualified parameter 
aliases with argument 3 [-Wrestrict]
     7 |         broken(p, q, p);
       |         ^~~~~~


By not having semantic effect you mean that the compiler (optimizer) won't take 
advantage of those if the prototype with restrict is seen in the translation 
unit where the function definition is compiled, given that the function 
definition doesn't specify restrict?

Whatever is the semantic result, I believe GCC should have a warning for 
mismatching restrict qualifiers.  The above doubt is reasonable, and a warning 
would help make sure that it's not relevant, because code should't do that 
normally, and with the help of the warning, that can be enforced.

Cheers,

Alex

-- 
<http://www.alejandro-colomar.es/>
  
Joseph Myers Dec. 7, 2022, 7:05 p.m. UTC | #10
On Wed, 7 Dec 2022, Alejandro Colomar via Libc-alpha wrote:

> Whatever is the semantic result, I believe GCC should have a warning for
> mismatching restrict qualifiers.

Yes, such a warning makes sense - although the mismatch is valid, it's 
still suspicious and potentially confusing for users.
  

Patch

diff --git a/argp/argp-fmtstream.c b/argp/argp-fmtstream.c
index 2f74bde2ab3..03729414e00 100644
--- a/argp/argp-fmtstream.c
+++ b/argp/argp-fmtstream.c
@@ -397,7 +397,7 @@  __argp_fmtstream_ensure (struct argp_fmtstream *fs,
size_t amount)
 }

 ssize_t
-__argp_fmtstream_printf (struct argp_fmtstream *fs, const char *fmt, ...)
+__argp_fmtstream_printf (struct argp_fmtstream *fs, const char *__restrict
fmt, ...)
 {
   int out;
   size_t avail;
diff --git a/argp/argp-help.c b/argp/argp-help.c
index 90a2795cefd..078103c35b1 100644
--- a/argp/argp-help.c
+++ b/argp/argp-help.c
@@ -1863,7 +1863,7 @@  weak_alias (__argp_state_help, argp_state_help)
    by the program name and `:', to stderr, and followed by a `Try ...
--help'
    message, then exit (1).  */
 void
-__argp_error_internal (const struct argp_state *state, const char *fmt,
+__argp_error_internal (const struct argp_state *state, const char
*__restrict fmt,
        va_list ap, unsigned int mode_flags)
 {
   if (!state || !(state->flags & ARGP_NO_ERRS))
@@ -1906,7 +1906,7 @@  __argp_error_internal (const struct argp_state
*state, const char *fmt,
     }
 }
 void
-__argp_error (const struct argp_state *state, const char *fmt, ...)
+__argp_error (const struct argp_state *state, const char *__restrict fmt,
...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -1927,7 +1927,7 @@  weak_alias (__argp_error, argp_error)
    parsing but don't reflect a (syntactic) problem with the input.  */
 void
 __argp_failure_internal (const struct argp_state *state, int status,
- int errnum, const char *fmt, va_list ap,
+ int errnum, const char *__restrict fmt, va_list ap,
  unsigned int mode_flags)
 {
   if (!state || !(state->flags & ARGP_NO_ERRS))
@@ -2003,7 +2003,7 @@  __argp_failure_internal (const struct argp_state
*state, int status,
 }
 void
 __argp_failure (const struct argp_state *state, int status, int errnum,
- const char *fmt, ...)
+ const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
diff --git a/assert/assert.c b/assert/assert.c
index aa77e250b4c..84f9060f800 100644
--- a/assert/assert.c
+++ b/assert/assert.c
@@ -44,8 +44,8 @@  extern const char *__progname;


 void
-__assert_fail_base (const char *fmt, const char *assertion, const char
*file,
-    unsigned int line, const char *function)
+__assert_fail_base (const char *__restrict fmt, const char *__restrict
assertion, const char *__restrict file,
+    unsigned int line, const char *__restrict function)
 {
   char *str;

@@ -95,8 +95,8 @@  __assert_fail_base (const char *fmt, const char
*assertion, const char *file,

 #undef __assert_fail
 void
-__assert_fail (const char *assertion, const char *file, unsigned int line,
-       const char *function)
+__assert_fail (const char *__restrict assertion, const char *__restrict
file, unsigned int line,
+       const char *__restrict function)
 {
   __assert_fail_base (_("%s%s%s:%u: %s%sAssertion `%s' failed.\n%n"),
       assertion, file, line, function);
diff --git a/elf/dl-exception.c b/elf/dl-exception.c
index 1d5dc6855f6..416297bf345 100644
--- a/elf/dl-exception.c
+++ b/elf/dl-exception.c
@@ -79,7 +79,7 @@  adjust_message_buffer (struct dl_exception *exception)
 }

 void
-_dl_exception_create (struct dl_exception *exception, const char *objname,
+_dl_exception_create (struct dl_exception *exception, const char
*__restrict objname,
                       const char *errstring)
 {
   if (objname == NULL)
@@ -102,8 +102,8 @@  _dl_exception_create (struct dl_exception *exception,
const char *objname,
 rtld_hidden_def (_dl_exception_create)

 void
-_dl_exception_create_format (struct dl_exception *exception, const char
*objname,
-                             const char *fmt, ...)
+_dl_exception_create_format (struct dl_exception *exception, const char
*__restrict objname,
+                             const char *__restrict fmt, ...)
 {
   if (objname == NULL)
     objname = "";
diff --git a/elf/dl-printf.c b/elf/dl-printf.c
index 1b55c87cfd8..e333f490574 100644
--- a/elf/dl-printf.c
+++ b/elf/dl-printf.c
@@ -33,7 +33,7 @@ 
    the formats and flags needed and can handle only up to 64 stripes in
    the output.  */
 static void
-_dl_debug_vdprintf (int fd, int tag_p, const char *fmt, va_list arg)
+_dl_debug_vdprintf (int fd, int tag_p, const char *__restrict fmt, va_list
arg)
 {
 # define NIOVMAX 64
   struct iovec iov[NIOVMAX];
@@ -228,7 +228,7 @@  _dl_debug_vdprintf (int fd, int tag_p, const char *fmt,
va_list arg)

 /* Write to debug file.  */
 void
-_dl_debug_printf (const char *fmt, ...)
+_dl_debug_printf (const char *__restrict fmt, ...)
 {
   va_list arg;

@@ -240,7 +240,7 @@  _dl_debug_printf (const char *fmt, ...)

 /* Write to debug file but don't start with a tag.  */
 void
-_dl_debug_printf_c (const char *fmt, ...)
+_dl_debug_printf_c (const char *__restrict fmt, ...)
 {
   va_list arg;

@@ -252,7 +252,7 @@  _dl_debug_printf_c (const char *fmt, ...)

 /* Write the given file descriptor.  */
 void
-_dl_dprintf (int fd, const char *fmt, ...)
+_dl_dprintf (int fd, const char *__restrict fmt, ...)
 {
   va_list arg;

@@ -262,7 +262,7 @@  _dl_dprintf (int fd, const char *fmt, ...)
 }

 void
-_dl_printf (const char *fmt, ...)
+_dl_printf (const char *__restrict fmt, ...)
 {
   va_list arg;

@@ -272,7 +272,7 @@  _dl_printf (const char *fmt, ...)
 }

 void
-_dl_error_printf (const char *fmt, ...)
+_dl_error_printf (const char *__restrict fmt, ...)
 {
   va_list arg;

@@ -282,7 +282,7 @@  _dl_error_printf (const char *fmt, ...)
 }

 void
-_dl_fatal_printf (const char *fmt, ...)
+_dl_fatal_printf (const char *__restrict fmt, ...)
 {
   va_list arg;

diff --git a/include/argp.h b/include/argp.h
index 7077471d990..a7ad5875be3 100644
--- a/include/argp.h
+++ b/include/argp.h
@@ -4,12 +4,12 @@ 
 /* Prototypes for internal argp.h functions.  */
 #include <stdarg.h>
 void
-__argp_error_internal (const struct argp_state *state, const char *fmt,
+__argp_error_internal (const struct argp_state *state, const char
*__restrict fmt,
        va_list ap, unsigned int mode_flags);

 void
 __argp_failure_internal (const struct argp_state *state, int status,
- int errnum, const char *fmt, va_list ap,
+ int errnum, const char *__restrict fmt, va_list ap,
  unsigned int mode_flags);

 #ifndef _ISOMAC
diff --git a/include/assert.h b/include/assert.h
index c812808f9b7..cb61d5c2d8d 100644
--- a/include/assert.h
+++ b/include/assert.h
@@ -15,7 +15,7 @@  extern void __assert_perror_fail (int __errnum, const
char *__file,
      __THROW __attribute__ ((__noreturn__));

 /* The real implementation of the two functions above.  */
-extern void __assert_fail_base (const char *fmt, const char *assertion,
+extern void __assert_fail_base (const char *__restrict fmt, const char
*assertion,
  const char *file, unsigned int line,
  const char *function)
      __THROW  __attribute__ ((__noreturn__)) attribute_hidden;
diff --git a/include/programs/xasprintf.h b/include/programs/xasprintf.h
index 98dd34001c0..84ac4e3d09d 100644
--- a/include/programs/xasprintf.h
+++ b/include/programs/xasprintf.h
@@ -18,7 +18,7 @@ 
 #ifndef _XASPRINTF_H
 #define _XASPRINTF_H 1

-extern char *xasprintf (const char *format, ...)
+extern char *xasprintf (const char *__restrict format, ...)
     __attribute__ ((__format__ (__printf__, 1, 2),
__warn_unused_result__));

 #endif /* xasprintf.h */
diff --git a/include/sys/syslog.h b/include/sys/syslog.h
index 44422eab13e..39e7e0872b0 100644
--- a/include/sys/syslog.h
+++ b/include/sys/syslog.h
@@ -7,7 +7,7 @@  libc_hidden_ldbl_proto (syslog)

 /* __vsyslog_internal uses the same mode_flags bits as
    __v*printf_internal; see libio/libioP.h.  */
-extern void __vsyslog_internal (int pri, const char *fmt, __gnuc_va_list
ap,
+extern void __vsyslog_internal (int pri, const char *__restrict fmt,
__gnuc_va_list ap,
  unsigned int mode_flags)
      attribute_hidden
      __attribute__ ((__format__ (__printf__, 2, 0)));
diff --git a/include/time.h b/include/time.h
index f599eeed4e2..2792ecdf4f8 100644
--- a/include/time.h
+++ b/include/time.h
@@ -302,8 +302,8 @@  extern int __getclktck (void) attribute_hidden;


 /* strptime support.  */
-extern char * __strptime_internal (const char *rp, const char *fmt,
-   struct tm *tm, void *statep,
+extern char * __strptime_internal (const char *__restrictrp, const char
*__restrict fmt,
+   struct tm *__restrict tm, void *__restrict statep,
    locale_t locparam) attribute_hidden;

 #if __TIMESIZE == 64
diff --git a/libio/libioP.h b/libio/libioP.h
index 3a5498bd658..51488e6ce80 100644
--- a/libio/libioP.h
+++ b/libio/libioP.h
@@ -678,7 +678,7 @@  extern int __vasprintf_internal (char **result_ptr,
const char *format,
 extern int __vdprintf_internal (int d, const char *format, va_list ap,
  unsigned int mode_flags)
     attribute_hidden;
-extern int __obstack_vprintf_internal (struct obstack *ob, const char *fmt,
+extern int __obstack_vprintf_internal (struct obstack *ob, const char
*__restrict fmt,
        va_list ap, unsigned int mode_flags)
     attribute_hidden;

diff --git a/libio/tst-memstream3.c b/libio/tst-memstream3.c
index 61b84140d31..7bdd21a6e66 100644
--- a/libio/tst-memstream3.c
+++ b/libio/tst-memstream3.c
@@ -45,7 +45,7 @@  mcheck_abort (enum mcheck_status ev)
 }

 static void
-error_printf (int line, const char *fmt, ...)
+error_printf (int line, const char *__restrict fmt, ...)
 {
   va_list ap;

diff --git a/locale/programs/linereader.h b/locale/programs/linereader.h
index 653a71d2d16..c8280bdf0a1 100644
--- a/locale/programs/linereader.h
+++ b/locale/programs/linereader.h
@@ -97,7 +97,7 @@  extern void lr_ignore_rest (struct linereader *lr, int
verbose);

 static inline void
 __attribute__ ((__format__ (__printf__, 2, 3), nonnull (1, 2)))
-lr_error (struct linereader *lr, const char *fmt, ...)
+lr_error (struct linereader *lr, const char *__restrict fmt, ...)
 {
   char *str;
   va_list arg;
diff --git a/misc/syslog.c b/misc/syslog.c
index f67d4b58a44..569b729e647 100644
--- a/misc/syslog.c
+++ b/misc/syslog.c
@@ -82,7 +82,7 @@  cancel_handler (void *ptr)
  * print message on log file; output is intended for syslogd(8).
  */
 void
-__syslog (int pri, const char *fmt, ...)
+__syslog (int pri, const char *__restrict fmt, ...)
 {
   va_list ap;

@@ -94,14 +94,14 @@  ldbl_hidden_def (__syslog, syslog)
 ldbl_strong_alias (__syslog, syslog)

 void
-__vsyslog (int pri, const char *fmt, va_list ap)
+__vsyslog (int pri, const char *__restrict fmt, va_list ap)
 {
   __vsyslog_internal (pri, fmt, ap, 0);
 }
 ldbl_weak_alias (__vsyslog, vsyslog)

 void
-__syslog_chk (int pri, int flag, const char *fmt, ...)
+__syslog_chk (int pri, int flag, const char *__restrict fmt, ...)
 {
   va_list ap;

@@ -111,13 +111,13 @@  __syslog_chk (int pri, int flag, const char *fmt, ...)
 }

 void
-__vsyslog_chk (int pri, int flag, const char *fmt, va_list ap)
+__vsyslog_chk (int pri, int flag, const char *__restrict fmt, va_list ap)
 {
   __vsyslog_internal (pri, fmt, ap, (flag > 0) ? PRINTF_FORTIFY : 0);
 }

 void
-__vsyslog_internal (int pri, const char *fmt, va_list ap,
+__vsyslog_internal (int pri, const char *__restrict fmt, va_list ap,
     unsigned int mode_flags)
 {
   /* Try to use a static buffer as an optimization.  */
diff --git a/nscd/dbg_log.c b/nscd/dbg_log.c
index 7cb4b97348c..91bd2ee9e7d 100644
--- a/nscd/dbg_log.c
+++ b/nscd/dbg_log.c
@@ -48,7 +48,7 @@  init_logfile (void)
 }

 void
-dbg_log (const char *fmt,...)
+dbg_log (const char *__restrict fmt,...)
 {
   va_list ap;
   char msg2[512];
diff --git a/nscd/selinux.c b/nscd/selinux.c
index 986ce352bc6..f25aac15f2a 100644
--- a/nscd/selinux.c
+++ b/nscd/selinux.c
@@ -77,7 +77,7 @@  static pthread_t avc_notify_thread;

 #ifdef HAVE_LIBAUDIT
 /* Prototype for supporting the audit daemon */
-static void log_callback (const char *fmt, ...);
+static void log_callback (const char *__restrict fmt, ...);
 #endif

 /* Prototypes for AVC callback functions.  */
@@ -117,7 +117,7 @@  static int audit_fd = -1;

 /* When an avc denial occurs, log it to audit system */
 static void
-log_callback (const char *fmt, ...)
+log_callback (const char *__restrict fmt, ...)
 {
   if (audit_fd >= 0)
     {
diff --git a/posix/bug-getopt1.c b/posix/bug-getopt1.c
index a5a37116d2e..dcd111a3a62 100644
--- a/posix/bug-getopt1.c
+++ b/posix/bug-getopt1.c
@@ -4,7 +4,7 @@ 
 #include <stdlib.h>

 static int
-one_test (const char *fmt, int argc, char *argv[], int expected[argc - 1])
+one_test (const char *__restrict fmt, int argc, char *argv[], int
expected[argc - 1])
 {
   optind = 1;

diff --git a/posix/bug-getopt2.c b/posix/bug-getopt2.c
index 8f92f0c6ee0..a4495296db0 100644
--- a/posix/bug-getopt2.c
+++ b/posix/bug-getopt2.c
@@ -4,7 +4,7 @@ 
 #include <stdlib.h>

 static int
-one_test (const char *fmt, int argc, char *argv[], int expected[argc - 1])
+one_test (const char *__restrict fmt, int argc, char *argv[], int
expected[argc - 1])
 {
   int res = 0;
   for (int i = 0; i < argc - 1; ++i)
diff --git a/posix/bug-getopt3.c b/posix/bug-getopt3.c
index 45a8d3ec3dd..d01c1acea43 100644
--- a/posix/bug-getopt3.c
+++ b/posix/bug-getopt3.c
@@ -12,7 +12,7 @@  static const struct option opts[] =
   };

 static int
-one_test (const char *fmt, int argc, char *argv[], int n, int expected[n],
+one_test (const char *__restrict fmt, int argc, char *argv[], int n, int
expected[n],
   int out[n])
 {
   optind = 1;
diff --git a/posix/bug-getopt4.c b/posix/bug-getopt4.c
index c5e3c1497a5..226284e02f0 100644
--- a/posix/bug-getopt4.c
+++ b/posix/bug-getopt4.c
@@ -11,7 +11,7 @@  static const struct option opts[] =
   };

 static int
-one_test (const char *fmt, int argc, char *argv[], int n, int expected[n])
+one_test (const char *__restrict fmt, int argc, char *argv[], int n, int
expected[n])
 {
   optind = 1;

diff --git a/posix/bug-getopt5.c b/posix/bug-getopt5.c
index 4f67d9b2ece..b4fc491b138 100644
--- a/posix/bug-getopt5.c
+++ b/posix/bug-getopt5.c
@@ -12,7 +12,7 @@  static const struct option opts[] =
   };

 static int
-one_test (const char *fmt, int argc, char *argv[], int n, int expected[n])
+one_test (const char *__restrict fmt, int argc, char *argv[], int n, int
expected[n])
 {
   optind = 1;

diff --git a/posix/tst-gnuglob-skeleton.c b/posix/tst-gnuglob-skeleton.c
index dcfba1ad13b..a498e026efe 100644
--- a/posix/tst-gnuglob-skeleton.c
+++ b/posix/tst-gnuglob-skeleton.c
@@ -344,7 +344,7 @@  errstr (int val)


 static int
-test_result (const char *fmt, int flags, GLOB_TYPE *gl, const char *str[])
+test_result (const char *__restrict fmt, int flags, GLOB_TYPE *gl, const
char *str[])
 {
   size_t cnt;
   int result = 0;
@@ -391,7 +391,7 @@  do_test (void)
   GLOB_TYPE gl;
   int errval;
   int result = 0;
-  const char *fmt;
+  const char *__restrict fmt;
   int flags;

   mtrace ();
diff --git a/stdio-common/bug-vfprintf-nargs.c
b/stdio-common/bug-vfprintf-nargs.c
index aaf3f4e7f92..ebb15ea0c7e 100644
--- a/stdio-common/bug-vfprintf-nargs.c
+++ b/stdio-common/bug-vfprintf-nargs.c
@@ -25,7 +25,7 @@ 
 #include <signal.h>

 static int
-format_failed (const char *fmt, const char *expected)
+format_failed (const char *__restrict fmt, const char *expected)
 {
   char output[80];

diff --git a/stdio-common/fxprintf.c b/stdio-common/fxprintf.c
index 61e6484c005..bacd6361482 100644
--- a/stdio-common/fxprintf.c
+++ b/stdio-common/fxprintf.c
@@ -23,7 +23,7 @@ 
 #include <libioP.h>

 static int
-locked_vfxprintf (FILE *fp, const char *fmt, va_list ap,
+locked_vfxprintf (FILE *__restrict fp, const char *__restrict fmt, va_list
ap,
   unsigned int mode_flags)
 {
   if (_IO_fwide (fp, 0) <= 0)
@@ -62,7 +62,7 @@  locked_vfxprintf (FILE *fp, const char *fmt, va_list ap,
 }

 int
-__vfxprintf (FILE *fp, const char *fmt, va_list ap,
+__vfxprintf (FILE *fp, const char *__restrict fmt, va_list ap,
      unsigned int mode_flags)
 {
   if (fp == NULL)
@@ -74,7 +74,7 @@  __vfxprintf (FILE *fp, const char *fmt, va_list ap,
 }

 int
-__fxprintf (FILE *fp, const char *fmt, ...)
+__fxprintf (FILE *fp, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -84,7 +84,7 @@  __fxprintf (FILE *fp, const char *fmt, ...)
 }

 int
-__fxprintf_nocancel (FILE *fp, const char *fmt, ...)
+__fxprintf_nocancel (FILE *fp, const char *__restrict fmt, ...)
 {
   if (fp == NULL)
     fp = stderr;
diff --git a/stdio-common/printf-prs.c b/stdio-common/printf-prs.c
index f2fb9182b83..accf772ea62 100644
--- a/stdio-common/printf-prs.c
+++ b/stdio-common/printf-prs.c
@@ -57,7 +57,7 @@ 


 size_t
-parse_printf_format (const char *fmt, size_t n, int *argtypes)
+parse_printf_format (const char *__restrict fmt, size_t n, int *argtypes)
 {
   size_t nargs; /* Number of arguments.  */
   size_t max_ref_arg; /* Highest index used in a positional arg.  */
diff --git a/stdio-common/scanf16.c b/stdio-common/scanf16.c
index 5b5d4b2d8ae..9044504a8a2 100644
--- a/stdio-common/scanf16.c
+++ b/stdio-common/scanf16.c
@@ -32,7 +32,7 @@ 
   } while (0)

 static int __attribute__ ((format (scanf, 2, 3)))
-xsscanf (const char *str, const char *fmt, ...)
+xsscanf (const char *str, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -42,7 +42,7 @@  xsscanf (const char *str, const char *fmt, ...)
 }

 static int __attribute__ ((format (scanf, 1, 2)))
-xscanf (const char *fmt, ...)
+xscanf (const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -52,7 +52,7 @@  xscanf (const char *fmt, ...)
 }

 static int __attribute__ ((format (scanf, 2, 3)))
-xfscanf (FILE *f, const char *fmt, ...)
+xfscanf (FILE *f, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
diff --git a/stdio-common/scanf16a.c b/stdio-common/scanf16a.c
index 256c048d5df..d9cfae37a1e 100644
--- a/stdio-common/scanf16a.c
+++ b/stdio-common/scanf16a.c
@@ -37,7 +37,7 @@ 
   } while (0)

 static int __attribute__ ((format (scanf, 2, 3)))
-xsscanf (const char *str, const char *fmt, ...)
+xsscanf (const char *str, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -47,7 +47,7 @@  xsscanf (const char *str, const char *fmt, ...)
 }

 static int __attribute__ ((format (scanf, 1, 2)))
-xscanf (const char *fmt, ...)
+xscanf (const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -57,7 +57,7 @@  xscanf (const char *fmt, ...)
 }

 static int __attribute__ ((format (scanf, 2, 3)))
-xfscanf (FILE *f, const char *fmt, ...)
+xfscanf (FILE *f, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
diff --git a/stdio-common/scanf17.c b/stdio-common/scanf17.c
index bd01cb599c2..b991bd2043f 100644
--- a/stdio-common/scanf17.c
+++ b/stdio-common/scanf17.c
@@ -32,7 +32,7 @@ 
   } while (0)

 static int
-xsscanf (const char *str, const char *fmt, ...)
+xsscanf (const char *str, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -42,7 +42,7 @@  xsscanf (const char *str, const char *fmt, ...)
 }

 static int
-xscanf (const char *fmt, ...)
+xscanf (const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -52,7 +52,7 @@  xscanf (const char *fmt, ...)
 }

 static int
-xfscanf (FILE *f, const char *fmt, ...)
+xfscanf (FILE *f, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
diff --git a/stdio-common/tst-printf-round.c
b/stdio-common/tst-printf-round.c
index 5b9975ac802..78bd53d7d6a 100644
--- a/stdio-common/tst-printf-round.c
+++ b/stdio-common/tst-printf-round.c
@@ -23,7 +23,7 @@ 

 struct dec_test {
   double d;
-  const char *fmt;
+  const char *__restrict fmt;
   const char *rd, *rn, *rz, *ru;
 };

@@ -49,7 +49,7 @@  static const struct dec_test dec_tests[] = {
 };

 static int
-test_dec_in_one_mode (double d, const char *fmt, const char *expected,
+test_dec_in_one_mode (double d, const char *__restrict fmt, const char
*expected,
       const char *mode_name)
 {
   char buf[100];
@@ -72,7 +72,7 @@  test_dec_in_one_mode (double d, const char *fmt, const
char *expected,
 struct hex_test
 {
   double d;
-  const char *fmt;
+  const char *__restrict fmt;
   const char *rd[4], *rn[4], *rz[4], *ru[4];
 };

@@ -137,7 +137,7 @@  static const struct hex_test hex_tests[] =
   };

 static int
-test_hex_in_one_mode (double d, const char *fmt, const char *const
expected[4],
+test_hex_in_one_mode (double d, const char *__restrict fmt, const char
*const expected[4],
       const char *mode_name)
 {
   char buf[100];
diff --git a/stdio-common/tst-printf.c b/stdio-common/tst-printf.c
index 0e7557f1307..b133f267995 100644
--- a/stdio-common/tst-printf.c
+++ b/stdio-common/tst-printf.c
@@ -44,7 +44,7 @@  static void rfg3 (void);


 static void
-fmtchk (const char *fmt)
+fmtchk (const char *__restrict fmt)
 {
   (void) fputs(fmt, stdout);
   (void) printf(":\t`");
@@ -53,7 +53,7 @@  fmtchk (const char *fmt)
 }

 static void
-fmtst1chk (const char *fmt)
+fmtst1chk (const char *__restrict fmt)
 {
   (void) fputs(fmt, stdout);
   (void) printf(":\t`");
@@ -62,7 +62,7 @@  fmtst1chk (const char *fmt)
 }

 static void
-fmtst2chk (const char *fmt)
+fmtst2chk (const char *__restrict fmt)
 {
   (void) fputs(fmt, stdout);
   (void) printf(":\t`");
diff --git a/stdlib/strfmon_l.c b/stdlib/strfmon_l.c
index d9b22088c7a..19af8e79e3a 100644
--- a/stdlib/strfmon_l.c
+++ b/stdlib/strfmon_l.c
@@ -76,8 +76,8 @@ 
    too.  Some of the information contradicts the information which can
    be specified in format string.  */
 ssize_t
-__vstrfmon_l_internal (char *s, size_t maxsize, locale_t loc,
-       const char *format, va_list ap, unsigned int flags)
+__vstrfmon_l_internal (char *__restrict s, size_t maxsize, locale_t loc,
+       const char *__restrict format, va_list ap, unsigned int flags)
 {
   struct __locale_data *current = loc->__locales[LC_MONETARY];
   _IO_strfile f;
@@ -624,7 +624,7 @@  __vstrfmon_l_internal (char *s, size_t maxsize,
locale_t loc,
 }

 ssize_t
-___strfmon_l (char *s, size_t maxsize, locale_t loc, const char *format,
...)
+___strfmon_l (char *__restrict s, size_t maxsize, locale_t loc, const char
*__restrict format, ...)
 {
   va_list ap;

diff --git a/stdlib/tst-swapcontext1.c b/stdlib/tst-swapcontext1.c
index 8850279ec33..5939c12b613 100644
--- a/stdlib/tst-swapcontext1.c
+++ b/stdlib/tst-swapcontext1.c
@@ -31,7 +31,7 @@  const char *fmt2 = "\e[34m";

 __attribute__((noinline, noclone))
 static void
-func4(ucontext_t *uocp, ucontext_t *ucp, const char *str, const char *fmt)
+func4(ucontext_t *uocp, ucontext_t *ucp, const char *__restrict str, const
char *__restrict fmt)
 {
   printf("      %sfunc4: %s\e[0m\n", fmt, str);
   if (swapcontext(uocp, ucp) == -1)
@@ -41,7 +41,7 @@  func4(ucontext_t *uocp, ucontext_t *ucp, const char *str,
const char *fmt)

 __attribute__((noinline, noclone))
 static void
-func3(ucontext_t *uocp, ucontext_t *ucp, const char *str, const char *fmt)
+func3(ucontext_t *uocp, ucontext_t *ucp, const char *__restrict str, const
char *__restrict fmt)
 {
   printf("    %sfunc3: func4(uocp, ucp, str)\e[0m\n", fmt);
   func4(uocp, ucp, str, fmt);
diff --git a/string/memccpy.c b/string/memccpy.c
index 40ea81dcb60..5c8bb201fe5 100644
--- a/string/memccpy.c
+++ b/string/memccpy.c
@@ -28,7 +28,7 @@ 
    Return the position in DEST one byte past where C was copied, or
    NULL if C was not found in the first N bytes of SRC.  */
 void *
-__memccpy (void *dest, const void *src, int c, size_t n)
+__memccpy (void *__restrict dest, const void *__restrict src, int c,
size_t n)
 {
   void *p = memchr (src, c, n);

diff --git a/string/memchr.c b/string/memchr.c
index 422bcd0cd64..932acc7313e 100644
--- a/string/memchr.c
+++ b/string/memchr.c
@@ -45,7 +45,7 @@ 

 /* Search no more than N bytes of S for C.  */
 void *
-MEMCHR (void const *s, int c_in, size_t n)
+MEMCHR (const void *s, int c_in, size_t n)
 {
   /* On 32-bit hardware, choosing longword to be a 32-bit unsigned
      long instead of a 64-bit uintmax_t tends to give better
diff --git a/string/memcpy.c b/string/memcpy.c
index 9cf64530e73..920683e3d8c 100644
--- a/string/memcpy.c
+++ b/string/memcpy.c
@@ -25,10 +25,10 @@ 
 #endif

 void *
-MEMCPY (void *dstpp, const void *srcpp, size_t len)
+MEMCPY (void *__restrict dstpp, const void *__restrict srcpp, size_t len)
 {
-  unsigned long int dstp = (long int) dstpp;
-  unsigned long int srcp = (long int) srcpp;
+  unsigned long int dstp = (unsigned long int) dstpp;
+  unsigned long int srcp = (unsigned long int) srcpp;

   /* Copy from the beginning to the end.  */

diff --git a/string/memfrob.c b/string/memfrob.c
index 9707cb9fda1..025929f90cb 100644
--- a/string/memfrob.c
+++ b/string/memfrob.c
@@ -22,7 +22,7 @@  memfrob (void *s, size_t n)
 {
   char *p = (char *) s;

-  while (n-- > 0)
+  for (; n; n--)
     *p++ ^= 42;

   return s;
diff --git a/string/mempcpy.c b/string/mempcpy.c
index 0a11e30b6f7..a0a93b08bf5 100644
--- a/string/mempcpy.c
+++ b/string/mempcpy.c
@@ -30,7 +30,7 @@ 
 #endif

 void *
-MEMPCPY (void *dest, const void *src, size_t len)
+MEMPCPY (void *__restrict dest, const void *__restrict src, size_t len)
 {
   return memcpy (dest, src, len) + len;
 }
diff --git a/string/memrchr.c b/string/memrchr.c
index 8eb6829e458..7fd7f666c84 100644
--- a/string/memrchr.c
+++ b/string/memrchr.c
@@ -63,9 +63,8 @@  MEMRCHR
   const unsigned char *char_ptr;
   const unsigned long int *longword_ptr;
   unsigned long int longword, magic_bits, charmask;
-  unsigned char c;

-  c = (unsigned char) c_in;
+  const unsigned char c = (const unsigned char) c_in;

   /* Handle the last few characters by reading one character at a time.
      Do this until CHAR_PTR is aligned on a longword boundary.  */
@@ -182,7 +181,7 @@  MEMRCHR

   char_ptr = (const unsigned char *) longword_ptr;

-  while (n-- > 0)
+  for (; n > 0; --n)
     {
       if (*--char_ptr == c)
  return (void *) char_ptr;
diff --git a/string/memset.c b/string/memset.c
index 1303dd7ad36..273bd5d6ff0 100644
--- a/string/memset.c
+++ b/string/memset.c
@@ -26,7 +26,7 @@  void *
 inhibit_loop_to_libcall
 MEMSET (void *dstpp, int c, size_t len)
 {
-  long int dstp = (long int) dstpp;
+  unsigned long int dstp = (unsigned long int) dstpp;

   if (len >= 8)
     {
diff --git a/string/stpcpy.c b/string/stpcpy.c
index 3d9ec2d4fcd..9ce6ba6b8df 100644
--- a/string/stpcpy.c
+++ b/string/stpcpy.c
@@ -31,7 +31,7 @@ 

 /* Copy SRC to DEST, returning the address of the terminating '\0' in
DEST.  */
 char *
-STPCPY (char *dest, const char *src)
+STPCPY (char *__restrict dest, const char *__restrict src)
 {
   size_t len = strlen (src);
   return memcpy (dest, src, len + 1) + len;
diff --git a/string/stpncpy.c b/string/stpncpy.c
index 61f0134fb20..7346d790a1a 100644
--- a/string/stpncpy.c
+++ b/string/stpncpy.c
@@ -37,9 +37,9 @@  weak_alias (__stpncpy, stpncpy)
 /* Copy no more than N characters of SRC to DEST, returning the address of
    the terminating '\0' in DEST, if any, or else DEST + N.  */
 char *
-STPNCPY (char *dest, const char *src, size_t n)
+STPNCPY (char * __restrict dest, const char * __restrict src, size_t n)
 {
-  size_t size = __strnlen (src, n);
+  const size_t size = __strnlen (src, n);
   memcpy (dest, src, size);
   dest += size;
   if (size == n)
diff --git a/string/strcat.c b/string/strcat.c
index de6f0400474..a3ac5fe47e3 100644
--- a/string/strcat.c
+++ b/string/strcat.c
@@ -25,7 +25,7 @@ 

 /* Append SRC on the end of DEST.  */
 char *
-STRCAT (char *dest, const char *src)
+STRCAT (char *__restrict dest, const char *__restrict src)
 {
   strcpy (dest + strlen (dest), src);
   return dest;
diff --git a/string/strcpy.c b/string/strcpy.c
index 5ab16b8c036..63425f32ec7 100644
--- a/string/strcpy.c
+++ b/string/strcpy.c
@@ -26,7 +26,7 @@ 

 /* Copy SRC to DEST.  */
 char *
-STRCPY (char *dest, const char *src)
+STRCPY (char *__restrict dest, const char *__restrict src)
 {
   return memcpy (dest, src, strlen (src) + 1);
 }
diff --git a/string/strlen.c b/string/strlen.c
index 54f3fb8167a..f443fd16d86 100644
--- a/string/strlen.c
+++ b/string/strlen.c
@@ -33,6 +33,9 @@  STRLEN (const char *str)
   const unsigned long int *longword_ptr;
   unsigned long int longword, himagic, lomagic;

+  if (sizeof (longword) > 8)
+    abort ();
+
   /* Handle the first few characters by reading one character at a time.
      Do this until CHAR_PTR is aligned on a longword boundary.  */
   for (char_ptr = str; ((unsigned long int) char_ptr
@@ -59,8 +62,6 @@  STRLEN (const char *str)
       himagic = ((himagic << 16) << 16) | himagic;
       lomagic = ((lomagic << 16) << 16) | lomagic;
     }
-  if (sizeof (longword) > 8)
-    abort ();

   /* Instead of the traditional loop which tests each character,
      we will test a longword at a time.  The tricky part is testing
diff --git a/string/strncat.c b/string/strncat.c
index 8c937867c13..2f00a50f288 100644
--- a/string/strncat.c
+++ b/string/strncat.c
@@ -24,7 +24,7 @@ 
 #endif

 char *
-STRNCAT (char *s1, const char *s2, size_t n)
+STRNCAT (char *__restrict s1, const char *__restrict s2, size_t n)
 {
   char *s = s1;

diff --git a/string/strncpy.c b/string/strncpy.c
index 83fb6106088..e9cae174e31 100644
--- a/string/strncpy.c
+++ b/string/strncpy.c
@@ -24,7 +24,7 @@ 
 #endif

 char *
-STRNCPY (char *s1, const char *s2, size_t n)
+STRNCPY (char *__restrict s1, const char *__restrict s2, size_t n)
 {
   size_t size = __strnlen (s2, n);
   if (size != n)
diff --git a/string/strsep.c b/string/strsep.c
index b534a1ec17f..695542d0c5a 100644
--- a/string/strsep.c
+++ b/string/strsep.c
@@ -21,7 +21,7 @@ 
 #undef strsep

 char *
-__strsep (char **stringp, const char *delim)
+__strsep (char **__restrict stringp, const char *__restrict delim)
 {
   char *begin, *end;

diff --git a/string/strtok.c b/string/strtok.c
index 409056226c2..ea11156212b 100644
--- a/string/strtok.c
+++ b/string/strtok.c
@@ -28,7 +28,7 @@ 
  // s = "abc\0=-def\0"
 */
 char *
-strtok (char *s, const char *delim)
+strtok (char *__restrict s, const char *__restrict delim)
 {
   static char *olds;
   return __strtok_r (s, delim, &olds);
diff --git a/string/strtok_r.c b/string/strtok_r.c
index fd3a842c998..17048032207 100644
--- a/string/strtok_r.c
+++ b/string/strtok_r.c
@@ -39,7 +39,7 @@ 
  // s = "abc\0-def\0"
 */
 char *
-__strtok_r (char *s, const char *delim, char **save_ptr)
+__strtok_r (char *__restrict s, const char *__restrict delim, char
**__restrict save_ptr)
 {
   char *end;

diff --git a/string/strxfrm.c b/string/strxfrm.c
index 44d2a80e44f..bf5b924e44b 100644
--- a/string/strxfrm.c
+++ b/string/strxfrm.c
@@ -25,7 +25,7 @@ 
 #endif

 size_t
-STRXFRM (STRING_TYPE *dest, const STRING_TYPE *src, size_t n)
+STRXFRM (STRING_TYPE *__restrict dest, const STRING_TYPE *__restrict src,
size_t n)
 {
   return STRXFRM_L (dest, src, n, _NL_CURRENT_LOCALE);
 }
diff --git a/string/strxfrm_l.c b/string/strxfrm_l.c
index 188a3d826a6..79596a9c6de 100644
--- a/string/strxfrm_l.c
+++ b/string/strxfrm_l.c
@@ -441,7 +441,7 @@  do_xfrm_cached (STRING_TYPE *dest, size_t n, const
locale_data_t *l_data,
   len = weights[idxarr[backw]++];

   if (needed + len < n)
-    while (len-- > 0)
+    for (; len; --len)
       dest[needed++] = weights[idxarr[backw]++];
   else
     {
@@ -457,7 +457,7 @@  do_xfrm_cached (STRING_TYPE *dest, size_t n, const
locale_data_t *l_data,
   /* Now handle the forward element.  */
   len = weights[idxarr[idxcnt]++];
   if (needed + len < n)
-    while (len-- > 0)
+    for (; len; --len)
       dest[needed++] = weights[idxarr[idxcnt]++];
   else
     {
@@ -488,7 +488,7 @@  do_xfrm_cached (STRING_TYPE *dest, size_t n, const
locale_data_t *l_data,
   size_t len = weights[idxarr[--backw]++];

   if (needed + len < n)
-    while (len-- > 0)
+    for (; len; --len)
       dest[needed++] = weights[idxarr[backw]++];
   else
     {
@@ -664,7 +664,7 @@  do_xfrm_cached (STRING_TYPE *dest, size_t n, const
locale_data_t *l_data,
 }

 size_t
-STRXFRM (STRING_TYPE *dest, const STRING_TYPE *src, size_t n, locale_t l)
+STRXFRM (STRING_TYPE *__restrict dest, const STRING_TYPE *__restrict src,
size_t n, locale_t l)
 {
   locale_data_t l_data;
   struct __locale_data *current = l->__locales[LC_COLLATE];
diff --git a/string/swab.c b/string/swab.c
index 083a80091f7..6aecb93c5eb 100644
--- a/string/swab.c
+++ b/string/swab.c
@@ -18,15 +18,15 @@ 
 #include <unistd.h>

 void
-swab (const void *bfrom, void *bto, ssize_t n)
+swab (const void *__restrict bfrom, void *__restrict bto, ssize_t n)
 {
-  const char *from = (const char *) bfrom;
-  char *to = (char *) bto;
+  const unsigned char *from = (const unsigned char *) bfrom;
+  unsigned char *to = (unsigned char *) bto;

   n &= ~((ssize_t) 1);
   while (n > 1)
     {
-      const char b0 = from[--n], b1 = from[--n];
+      const unsigned char b0 = from[--n], b1 = from[--n];
       to[n] = b0;
       to[n + 1] = b1;
     }
diff --git a/support/support.h b/support/support.h
index d20051da4d4..05e4372e143 100644
--- a/support/support.h
+++ b/support/support.h
@@ -112,7 +112,7 @@  extern char *xstrdup (const char *)
__attribute_malloc__ __attr_dealloc_free
 void *xposix_memalign (size_t alignment, size_t n)
   __attribute_malloc__ __attribute_alloc_align__ ((1))
   __attribute_alloc_size__ ((2)) __attr_dealloc_free __returns_nonnull;
-char *xasprintf (const char *format, ...)
+char *xasprintf (const char *__restrict format, ...)
   __attribute__ ((format (printf, 1, 2), malloc)) __attr_dealloc_free
   __returns_nonnull;
 char *xstrdup (const char *) __attr_dealloc_free __returns_nonnull;
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index 9dae72b1edc..c6ee80440d2 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -761,19 +761,19 @@  extern void *_dl_random attribute_hidden
attribute_relro;
 /* Write message on the debug file descriptor.  The parameters are
    interpreted as for a `printf' call.  All the lines start with a
    tag showing the PID.  */
-extern void _dl_debug_printf (const char *fmt, ...)
+extern void _dl_debug_printf (const char *__restrict fmt, ...)
      __attribute__ ((__format__ (__printf__, 1, 2))) attribute_hidden;

 /* Write message on the debug file descriptor.  The parameters are
    interpreted as for a `printf' call.  All the lines buf the first
    start with a tag showing the PID.  */
-extern void _dl_debug_printf_c (const char *fmt, ...)
+extern void _dl_debug_printf_c (const char *__restrict fmt, ...)
      __attribute__ ((__format__ (__printf__, 1, 2))) attribute_hidden;


 /* Write a message on the specified descriptor FD.  The parameters are
    interpreted as for a `printf' call.  */
-extern void _dl_dprintf (int fd, const char *fmt, ...)
+extern void _dl_dprintf (int fd, const char *__restrict fmt, ...)
      __attribute__ ((__format__ (__printf__, 2, 3)))
      attribute_hidden;

@@ -785,17 +785,17 @@  ssize_t _dl_write (int fd, const void *buffer, size_t
length)

 /* Write a message on the specified descriptor standard output.  The
    parameters are interpreted as for a `printf' call.  */
-void _dl_printf (const char *fmt, ...)
+void _dl_printf (const char *__restrict fmt, ...)
   attribute_hidden __attribute__ ((__format__ (__printf__, 1, 2)));

 /* Write a message on the specified descriptor standard error.  The
    parameters are interpreted as for a `printf' call.  */
-void _dl_error_printf (const char *fmt, ...)
+void _dl_error_printf (const char *__restrict fmt, ...)
   attribute_hidden __attribute__ ((__format__ (__printf__, 1, 2)));

 /* Write a message on the specified descriptor standard error and exit
    the program.  The parameters are interpreted as for a `printf' call.  */
-void _dl_fatal_printf (const char *fmt, ...)
+void _dl_fatal_printf (const char *__restrict fmt, ...)
   __attribute__ ((__format__ (__printf__, 1, 2), __noreturn__));
 rtld_hidden_proto (_dl_fatal_printf)

@@ -830,7 +830,7 @@  void _dl_error_free (void *ptr) attribute_hidden;
    string FMT.  Currently, only "%s" and "%%" are supported as format
    directives.  */
 void _dl_exception_create_format (struct dl_exception *, const char
*objname,
-  const char *fmt, ...)
+  const char *__restrict fmt, ...)
   __attribute__ ((nonnull (1, 3), format (printf, 3, 4)));
 rtld_hidden_proto (_dl_exception_create_format)

diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-argp-help.c
b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-argp-help.c
index b1206504e80..289bbb8b806 100644
--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-argp-help.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-argp-help.c
@@ -20,7 +20,7 @@ 
 #include <libio/libioP.h>

 void
-___ieee128_argp_error (const struct argp_state *state, const char *fmt,
...)
+___ieee128_argp_error (const struct argp_state *state, const char
*__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -31,7 +31,7 @@  strong_alias (___ieee128_argp_error, __argp_errorieee128)

 void
 ___ieee128_argp_failure (const struct argp_state *state, int status,
- int errnum, const char *fmt, ...)
+ int errnum, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
diff --git a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-syslog.c
b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-syslog.c
index e7bc822bcb4..fe20fc6262b 100644
--- a/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-syslog.c
+++ b/sysdeps/ieee754/ldbl-128ibm-compat/ieee128-syslog.c
@@ -21,7 +21,7 @@ 
 #include <syslog.h>

 void
-___ieee128_syslog (int pri, const char *fmt, ...)
+___ieee128_syslog (int pri, const char *__restrict fmt, ...)
 {
   va_list ap;

@@ -33,14 +33,14 @@  strong_alias (___ieee128_syslog, __syslogieee128)
 hidden_def (___ieee128_syslog)

 void
-___ieee128_vsyslog (int pri, const char *fmt, va_list ap)
+___ieee128_vsyslog (int pri, const char *__restrict fmt, va_list ap)
 {
   __vsyslog_internal (pri, fmt, ap, PRINTF_LDBL_USES_FLOAT128);
 }
 strong_alias (___ieee128_vsyslog, __vsyslogieee128)

 void
-___ieee128_syslog_chk (int pri, int flag, const char *fmt, ...)
+___ieee128_syslog_chk (int pri, int flag, const char *__restrict fmt, ...)
 {
   va_list ap;

@@ -55,7 +55,7 @@  ___ieee128_syslog_chk (int pri, int flag, const char
*fmt, ...)
 strong_alias (___ieee128_syslog_chk, __syslog_chkieee128)

 void
-___ieee128_vsyslog_chk (int pri, int flag, const char *fmt, va_list ap)
+___ieee128_vsyslog_chk (int pri, int flag, const char *__restrict fmt,
va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_USES_FLOAT128;
   if (flag > 0)
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-asprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-asprintf.c
index 4be216d610f..aa1abcefa1b 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-asprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-asprintf.c
@@ -2,7 +2,7 @@ 

 attribute_hidden
 int
-__asprintf (char **string_ptr, const char *fmt, ...)
+__asprintf (char **__restrict string_ptr, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-asprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-asprintf_chk.c
index b520181db75..f51d48150ac 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-asprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-asprintf_chk.c
@@ -2,7 +2,7 @@ 

 attribute_hidden
 int
-__asprintf_chk (char **string_ptr, int flag, const char *fmt, ...)
+__asprintf_chk (char **__restrict string_ptr, int flag, const char
*__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
b/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
index 2b1261acc75..71345b4d68f 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-compat.c
@@ -53,7 +53,7 @@  libc_hidden_proto (__nldbl___isoc99_vfwscanf)

 int
 attribute_compat_text_section
-__nldbl___asprintf (char **string_ptr, const char *fmt, ...)
+__nldbl___asprintf (char **__restrict string_ptr, const char *__restrict
fmt, ...)
 {
   va_list ap;
   int ret;
@@ -68,7 +68,7 @@  weak_alias (__nldbl___asprintf, __nldbl_asprintf)

 int
 attribute_compat_text_section
-__nldbl_dprintf (int d, const char *fmt, ...)
+__nldbl_dprintf (int d, const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -82,7 +82,7 @@  __nldbl_dprintf (int d, const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl_fprintf (FILE *stream, const char *fmt, ...)
+__nldbl_fprintf (FILE *stream, const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -111,7 +111,7 @@  __nldbl_fwprintf (FILE *stream, const wchar_t *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl_printf (const char *fmt, ...)
+__nldbl_printf (const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -126,7 +126,7 @@  strong_alias (__nldbl_printf, __nldbl__IO_printf)

 int
 attribute_compat_text_section
-__nldbl_sprintf (char *s, const char *fmt, ...)
+__nldbl_sprintf (char *s, const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -141,7 +141,7 @@  strong_alias (__nldbl_sprintf, __nldbl__IO_sprintf)

 int
 attribute_compat_text_section
-__nldbl_vfprintf (FILE *s, const char *fmt, va_list ap)
+__nldbl_vfprintf (FILE *__restrict s, const char *__restrict fmt, va_list
ap)
 {
   return __vfprintf_internal (s, fmt, ap, PRINTF_LDBL_IS_DBL);
 }
@@ -149,7 +149,7 @@  strong_alias (__nldbl_vfprintf, __nldbl__IO_vfprintf)

 int
 attribute_compat_text_section
-__nldbl___vsprintf (char *string, const char *fmt, va_list ap)
+__nldbl___vsprintf (char *__restrict string, const char *__restrict fmt,
va_list ap)
 {
   return __vsprintf_internal (string, -1, fmt, ap, PRINTF_LDBL_IS_DBL);
 }
@@ -158,7 +158,7 @@  weak_alias (__nldbl___vsprintf, __nldbl_vsprintf)

 int
 attribute_compat_text_section
-__nldbl_obstack_vprintf (struct obstack *obstack, const char *fmt,
+__nldbl_obstack_vprintf (struct obstack *obstack, const char *__restrict
fmt,
  va_list ap)
 {
   return __obstack_vprintf_internal (obstack, fmt, ap, PRINTF_LDBL_IS_DBL);
@@ -166,7 +166,7 @@  __nldbl_obstack_vprintf (struct obstack *obstack, const
char *fmt,

 int
 attribute_compat_text_section
-__nldbl_obstack_printf (struct obstack *obstack, const char *fmt, ...)
+__nldbl_obstack_printf (struct obstack *obstack, const char *__restrict
fmt, ...)
 {
   int ret;
   va_list ap;
@@ -178,7 +178,7 @@  __nldbl_obstack_printf (struct obstack *obstack, const
char *fmt, ...)

 int
 attribute_compat_text_section weak_function
-__nldbl_snprintf (char *s, size_t maxlen, const char *fmt, ...)
+__nldbl_snprintf (char *__restrict s, size_t maxlen, const char
*__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -192,7 +192,7 @@  __nldbl_snprintf (char *s, size_t maxlen, const char
*fmt, ...)

 int
 attribute_compat_text_section
-__nldbl_swprintf (wchar_t *s, size_t n, const wchar_t *fmt, ...)
+__nldbl_swprintf (wchar_t *__restrict s, size_t n, const wchar_t
*__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -206,35 +206,35 @@  __nldbl_swprintf (wchar_t *s, size_t n, const wchar_t
*fmt, ...)

 int
 attribute_compat_text_section weak_function
-__nldbl_vasprintf (char **result_ptr, const char *fmt, va_list ap)
+__nldbl_vasprintf (char **__restrict result_ptr, const char *__restrict
fmt, va_list ap)
 {
   return __vasprintf_internal (result_ptr, fmt, ap, PRINTF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section
-__nldbl_vdprintf (int d, const char *fmt, va_list ap)
+__nldbl_vdprintf (int d, const char *__restrict fmt, va_list ap)
 {
   return __vdprintf_internal (d, fmt, ap, PRINTF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section weak_function
-__nldbl_vfwprintf (FILE *s, const wchar_t *fmt, va_list ap)
+__nldbl_vfwprintf (FILE *__restrict s, const wchar_t *__restrict fmt,
va_list ap)
 {
   return __vfwprintf_internal (s, fmt, ap, PRINTF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section
-__nldbl_vprintf (const char *fmt, va_list ap)
+__nldbl_vprintf (const char *__restrict fmt, va_list ap)
 {
   return __vfprintf_internal (stdout, fmt, ap, PRINTF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section
-__nldbl_vsnprintf (char *string, size_t maxlen, const char *fmt,
+__nldbl_vsnprintf (char *__restrict string, size_t maxlen, const char
*__restrict fmt,
    va_list ap)
 {
   return __vsnprintf_internal (string, maxlen, fmt, ap,
PRINTF_LDBL_IS_DBL);
@@ -243,7 +243,7 @@  weak_alias (__nldbl_vsnprintf, __nldbl___vsnprintf)

 int
 attribute_compat_text_section weak_function
-__nldbl_vswprintf (wchar_t *string, size_t maxlen, const wchar_t *fmt,
+__nldbl_vswprintf (wchar_t *__restrict string, size_t maxlen, const
wchar_t *__restrict fmt,
    va_list ap)
 {
   return __vswprintf_internal (string, maxlen, fmt, ap,
PRINTF_LDBL_IS_DBL);
@@ -251,14 +251,14 @@  __nldbl_vswprintf (wchar_t *string, size_t maxlen,
const wchar_t *fmt,

 int
 attribute_compat_text_section
-__nldbl_vwprintf (const wchar_t *fmt, va_list ap)
+__nldbl_vwprintf (const wchar_t *__restrict fmt, va_list ap)
 {
   return __vfwprintf_internal (stdout, fmt, ap, PRINTF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section
-__nldbl_wprintf (const wchar_t *fmt, ...)
+__nldbl_wprintf (const wchar_t *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -273,7 +273,7 @@  __nldbl_wprintf (const wchar_t *fmt, ...)
 #if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_29)
 int
 attribute_compat_text_section
-__nldbl__IO_vfscanf (FILE *s, const char *fmt, va_list ap, int *errp)
+__nldbl__IO_vfscanf (FILE *__restrict , const char *__restrict fmt,
va_list ap, int *errp)
 {
   int ret = __vfscanf_internal (s, fmt, ap, SCANF_LDBL_IS_DBL);
   if (__glibc_unlikely (errp != 0))
@@ -284,7 +284,7 @@  __nldbl__IO_vfscanf (FILE *s, const char *fmt, va_list
ap, int *errp)

 int
 attribute_compat_text_section
-__nldbl___vfscanf (FILE *s, const char *fmt, va_list ap)
+__nldbl___vfscanf (FILE *__restrict s, const char *__restrict fmt, va_list
ap)
 {
   return __vfscanf_internal (s, fmt, ap, SCANF_LDBL_IS_DBL);
 }
@@ -293,7 +293,7 @@  libc_hidden_def (__nldbl_vfscanf)

 int
 attribute_compat_text_section
-__nldbl_sscanf (const char *s, const char *fmt, ...)
+__nldbl_sscanf (const char *__restrict s, const char *__restrict fmt, ...)
 {
   _IO_strfile sf;
   FILE *f = _IO_strfile_read (&sf, s);
@@ -310,7 +310,7 @@  strong_alias (__nldbl_sscanf, __nldbl__IO_sscanf)

 int
 attribute_compat_text_section
-__nldbl___vsscanf (const char *s, const char *fmt, va_list ap)
+__nldbl___vsscanf (const char *__restrict s, const char *__restrict fmt,
va_list ap)
 {
   _IO_strfile sf;
   FILE *f = _IO_strfile_read (&sf, s);
@@ -321,14 +321,14 @@  libc_hidden_def (__nldbl_vsscanf)

 int
 attribute_compat_text_section weak_function
-__nldbl_vscanf (const char *fmt, va_list ap)
+__nldbl_vscanf (const char *__restrict fmt, va_list ap)
 {
   return __vfscanf_internal (stdin, fmt, ap, SCANF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section
-__nldbl_fscanf (FILE *stream, const char *fmt, ...)
+__nldbl_fscanf (FILE *__restrict stream, const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -342,7 +342,7 @@  __nldbl_fscanf (FILE *stream, const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl_scanf (const char *fmt, ...)
+__nldbl_scanf (const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -356,7 +356,7 @@  __nldbl_scanf (const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl_vfwscanf (FILE *s, const wchar_t *fmt, va_list ap)
+__nldbl_vfwscanf (FILE *__restrict s, const wchar_t *__restrict fmt,
va_list ap)
 {
   return __vfwscanf_internal (s, fmt, ap, SCANF_LDBL_IS_DBL);
 }
@@ -364,7 +364,7 @@  libc_hidden_def (__nldbl_vfwscanf)

 int
 attribute_compat_text_section
-__nldbl_swscanf (const wchar_t *s, const wchar_t *fmt, ...)
+__nldbl_swscanf (const wchar_t *__restrict s, const wchar_t *__restrict
fmt, ...)
 {
   _IO_strfile sf;
   struct _IO_wide_data wd;
@@ -381,7 +381,7 @@  __nldbl_swscanf (const wchar_t *s, const wchar_t *fmt,
...)

 int
 attribute_compat_text_section
-__nldbl_vswscanf (const wchar_t *s, const wchar_t *fmt, va_list ap)
+__nldbl_vswscanf (const wchar_t *__restrict s, const wchar_t *__restrict
fmt, va_list ap)
 {
   _IO_strfile sf;
   struct _IO_wide_data wd;
@@ -393,14 +393,14 @@  libc_hidden_def (__nldbl_vswscanf)

 int
 attribute_compat_text_section weak_function
-__nldbl_vwscanf (const wchar_t *fmt, va_list ap)
+__nldbl_vwscanf (const wchar_t *__restrict fmt, va_list ap)
 {
   return __vfwscanf_internal (stdin, fmt, ap, SCANF_LDBL_IS_DBL);
 }

 int
 attribute_compat_text_section
-__nldbl_fwscanf (FILE *stream, const wchar_t *fmt, ...)
+__nldbl_fwscanf (FILE *__restrict stream, const wchar_t *__restrict fmt,
...)
 {
   va_list ap;
   int ret;
@@ -414,7 +414,7 @@  __nldbl_fwscanf (FILE *stream, const wchar_t *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl_wscanf (const wchar_t *fmt, ...)
+__nldbl_wscanf (const wchar_t *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -428,7 +428,7 @@  __nldbl_wscanf (const wchar_t *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___fprintf_chk (FILE *stream, int flag, const char *fmt, ...)
+__nldbl___fprintf_chk (FILE *__restrict stream, int flag, const char
*__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -445,7 +445,7 @@  __nldbl___fprintf_chk (FILE *stream, int flag, const
char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___fwprintf_chk (FILE *stream, int flag, const wchar_t *fmt, ...)
+__nldbl___fwprintf_chk (FILE *__restrict stream, int flag, const wchar_t
*__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -462,7 +462,7 @@  __nldbl___fwprintf_chk (FILE *stream, int flag, const
wchar_t *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___printf_chk (int flag, const char *fmt, ...)
+__nldbl___printf_chk (int flag, const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -479,8 +479,8 @@  __nldbl___printf_chk (int flag, const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___snprintf_chk (char *s, size_t maxlen, int flag, size_t slen,
- const char *fmt, ...)
+__nldbl___snprintf_chk (char *__restrict s, size_t maxlen, int flag,
size_t slen,
+ const char *__restrict fmt, ...)
 {
   if (__glibc_unlikely (slen < maxlen))
     __chk_fail ();
@@ -500,7 +500,7 @@  __nldbl___snprintf_chk (char *s, size_t maxlen, int
flag, size_t slen,

 int
 attribute_compat_text_section
-__nldbl___sprintf_chk (char *s, int flag, size_t slen, const char *fmt,
...)
+__nldbl___sprintf_chk (char *__restrict s, int flag, size_t slen, const
char *__restrict fmt, ...)
 {
   if (slen == 0)
     __chk_fail ();
@@ -520,8 +520,8 @@  __nldbl___sprintf_chk (char *s, int flag, size_t slen,
const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___swprintf_chk (wchar_t *s, size_t maxlen, int flag, size_t slen,
- const wchar_t *fmt, ...)
+__nldbl___swprintf_chk (wchar_t *__restrict s, size_t maxlen, int flag,
size_t slen,
+ const wchar_t *__restrict fmt, ...)
 {
   if (__glibc_unlikely (slen < maxlen))
     __chk_fail ();
@@ -541,7 +541,7 @@  __nldbl___swprintf_chk (wchar_t *s, size_t maxlen, int
flag, size_t slen,

 int
 attribute_compat_text_section
-__nldbl___vfprintf_chk (FILE *s, int flag, const char *fmt, va_list ap)
+__nldbl___vfprintf_chk (FILE *__restrict s, int flag, const char
*__restrict fmt, va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -552,7 +552,7 @@  __nldbl___vfprintf_chk (FILE *s, int flag, const char
*fmt, va_list ap)

 int
 attribute_compat_text_section
-__nldbl___vfwprintf_chk (FILE *s, int flag, const wchar_t *fmt, va_list ap)
+__nldbl___vfwprintf_chk (FILE *__restrict s, int flag, const wchar_t *fmt,
va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -563,7 +563,7 @@  __nldbl___vfwprintf_chk (FILE *s, int flag, const
wchar_t *fmt, va_list ap)

 int
 attribute_compat_text_section
-__nldbl___vprintf_chk (int flag, const char *fmt, va_list ap)
+__nldbl___vprintf_chk (int flag, const char *__restrict fmt, va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -574,8 +574,8 @@  __nldbl___vprintf_chk (int flag, const char *fmt,
va_list ap)

 int
 attribute_compat_text_section
-__nldbl___vsnprintf_chk (char *string, size_t maxlen, int flag, size_t
slen,
- const char *fmt, va_list ap)
+__nldbl___vsnprintf_chk (char *__restrict string, size_t maxlen, int flag,
size_t slen,
+ const char *__restrict fmt, va_list ap)
 {
   if (__glibc_unlikely (slen < maxlen))
     __chk_fail ();
@@ -589,7 +589,7 @@  __nldbl___vsnprintf_chk (char *string, size_t maxlen,
int flag, size_t slen,

 int
 attribute_compat_text_section
-__nldbl___vsprintf_chk (char *string, int flag, size_t slen, const char
*fmt,
+__nldbl___vsprintf_chk (char *__restrict string, int flag, size_t slen,
const char *__restrict fmt,
  va_list ap)
 {
   if (slen == 0)
@@ -604,8 +604,8 @@  __nldbl___vsprintf_chk (char *string, int flag, size_t
slen, const char *fmt,

 int
 attribute_compat_text_section
-__nldbl___vswprintf_chk (wchar_t *string, size_t maxlen, int flag, size_t
slen,
- const wchar_t *fmt, va_list ap)
+__nldbl___vswprintf_chk (wchar_t *__restrict string, size_t maxlen, int
flag, size_t slen,
+ const wchar_t *__restrict fmt, va_list ap)
 {
   if (__glibc_unlikely (slen < maxlen))
     __chk_fail ();
@@ -619,7 +619,7 @@  __nldbl___vswprintf_chk (wchar_t *string, size_t
maxlen, int flag, size_t slen,

 int
 attribute_compat_text_section
-__nldbl___vwprintf_chk (int flag, const wchar_t *fmt, va_list ap)
+__nldbl___vwprintf_chk (int flag, const wchar_t *__restrict fmt, va_list
ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -630,7 +630,7 @@  __nldbl___vwprintf_chk (int flag, const wchar_t *fmt,
va_list ap)

 int
 attribute_compat_text_section
-__nldbl___wprintf_chk (int flag, const wchar_t *fmt, ...)
+__nldbl___wprintf_chk (int flag, const wchar_t *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -647,7 +647,7 @@  __nldbl___wprintf_chk (int flag, const wchar_t *fmt,
...)

 int
 attribute_compat_text_section
-__nldbl___vasprintf_chk (char **ptr, int flag, const char *fmt, va_list ap)
+__nldbl___vasprintf_chk (char **__restrict ptr, int flag, const char
*__restrict fmt, va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -658,7 +658,7 @@  __nldbl___vasprintf_chk (char **ptr, int flag, const
char *fmt, va_list ap)

 int
 attribute_compat_text_section
-__nldbl___asprintf_chk (char **ptr, int flag, const char *fmt, ...)
+__nldbl___asprintf_chk (char **__restrict ptr, int flag, const char
*__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -675,7 +675,7 @@  __nldbl___asprintf_chk (char **ptr, int flag, const
char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___vdprintf_chk (int d, int flag, const char *fmt, va_list ap)
+__nldbl___vdprintf_chk (int d, int flag, const char *__restrict fmt,
va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -686,7 +686,7 @@  __nldbl___vdprintf_chk (int d, int flag, const char
*fmt, va_list ap)

 int
 attribute_compat_text_section
-__nldbl___dprintf_chk (int d, int flag, const char *fmt, ...)
+__nldbl___dprintf_chk (int d, int flag, const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -704,7 +704,7 @@  __nldbl___dprintf_chk (int d, int flag, const char
*fmt, ...)
 int
 attribute_compat_text_section
 __nldbl___obstack_vprintf_chk (struct obstack *obstack, int flag,
-       const char *fmt, va_list ap)
+       const char *__restrict fmt, va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -716,7 +716,7 @@  __nldbl___obstack_vprintf_chk (struct obstack *obstack,
int flag,
 int
 attribute_compat_text_section
 __nldbl___obstack_printf_chk (struct obstack *obstack, int flag,
-      const char *fmt, ...)
+      const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -759,7 +759,7 @@  __nldbl___printf_fp (FILE *fp, const struct printf_info
*info,

 ssize_t
 attribute_compat_text_section
-__nldbl_strfmon (char *s, size_t maxsize, const char *format, ...)
+__nldbl_strfmon (char *__restrict s, size_t maxsize, const char
*__restrict format, ...)
 {
   va_list ap;
   ssize_t ret;
@@ -773,8 +773,8 @@  __nldbl_strfmon (char *s, size_t maxsize, const char
*format, ...)

 ssize_t
 attribute_compat_text_section
-__nldbl___strfmon_l (char *s, size_t maxsize, locale_t loc,
-     const char *format, ...)
+__nldbl___strfmon_l (char *__restrict s, size_t maxsize, locale_t loc,
+     const char *__restrict format, ...)
 {
   va_list ap;
   ssize_t ret;
@@ -789,7 +789,7 @@  weak_alias (__nldbl___strfmon_l, __nldbl_strfmon_l)

 ssize_t
 attribute_compat_text_section
-__nldbl___vstrfmon (char *s, size_t maxsize, const char *format, va_list
ap)
+__nldbl___vstrfmon (char *__restrict s, size_t maxsize, const char
*__restrict format, va_list ap)
 {
   return __vstrfmon_l_internal (s, maxsize, _NL_CURRENT_LOCALE, format, ap,
  STRFMON_LDBL_IS_DBL);
@@ -797,8 +797,8 @@  __nldbl___vstrfmon (char *s, size_t maxsize, const char
*format, va_list ap)

 ssize_t
 attribute_compat_text_section
-__nldbl___vstrfmon_l (char *s, size_t maxsize, locale_t loc,
-      const char *format, va_list ap)
+__nldbl___vstrfmon_l (char *__restrict s, size_t maxsize, locale_t loc,
+      const char *__restrict format, va_list ap)
 {
   return __vstrfmon_l_internal (s, maxsize, loc, format, ap,
  STRFMON_LDBL_IS_DBL);
@@ -806,7 +806,7 @@  __nldbl___vstrfmon_l (char *s, size_t maxsize, locale_t
loc,

 void
 attribute_compat_text_section
-__nldbl_syslog (int pri, const char *fmt, ...)
+__nldbl_syslog (int pri, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -816,14 +816,14 @@  __nldbl_syslog (int pri, const char *fmt, ...)

 void
 attribute_compat_text_section
-__nldbl_vsyslog (int pri, const char *fmt, va_list ap)
+__nldbl_vsyslog (int pri, const char *__restrict fmt, va_list ap)
 {
   __vsyslog_internal (pri, fmt, ap, PRINTF_LDBL_IS_DBL);
 }

 void
 attribute_compat_text_section
-__nldbl___syslog_chk (int pri, int flag, const char *fmt, ...)
+__nldbl___syslog_chk (int pri, int flag, const char *__restrict fmt, ...)
 {
   va_list ap;
   unsigned int mode = PRINTF_LDBL_IS_DBL;
@@ -837,7 +837,7 @@  __nldbl___syslog_chk (int pri, int flag, const char
*fmt, ...)

 void
 attribute_compat_text_section
-__nldbl___vsyslog_chk (int pri, int flag, const char *fmt, va_list ap)
+__nldbl___vsyslog_chk (int pri, int flag, const char *__restrict fmt,
va_list ap)
 {
   unsigned int mode = PRINTF_LDBL_IS_DBL;
   if (flag > 0)
@@ -848,7 +848,7 @@  __nldbl___vsyslog_chk (int pri, int flag, const char
*fmt, va_list ap)

 int
 attribute_compat_text_section
-__nldbl___isoc99_vfscanf (FILE *s, const char *fmt, va_list ap)
+__nldbl___isoc99_vfscanf (FILE *s, const char *__restrict fmt, va_list ap)
 {
   return __vfscanf_internal (s, fmt, ap, SCANF_LDBL_IS_DBL |
SCANF_ISOC99_A);
 }
@@ -856,7 +856,7 @@  libc_hidden_def (__nldbl___isoc99_vfscanf)

 int
 attribute_compat_text_section
-__nldbl___isoc99_sscanf (const char *s, const char *fmt, ...)
+__nldbl___isoc99_sscanf (const char *s, const char *__restrict fmt, ...)
 {
   _IO_strfile sf;
   FILE *f = _IO_strfile_read (&sf, s);
@@ -872,7 +872,7 @@  __nldbl___isoc99_sscanf (const char *s, const char
*fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___isoc99_vsscanf (const char *s, const char *fmt, va_list ap)
+__nldbl___isoc99_vsscanf (const char *__restrict s, const char *__restrict
fmt, va_list ap)
 {
   _IO_strfile sf;
   FILE *f = _IO_strfile_read (&sf, s);
@@ -883,7 +883,7 @@  libc_hidden_def (__nldbl___isoc99_vsscanf)

 int
 attribute_compat_text_section
-__nldbl___isoc99_vscanf (const char *fmt, va_list ap)
+__nldbl___isoc99_vscanf (const char *__restrict fmt, va_list ap)
 {
   return __vfscanf_internal (stdin, fmt, ap,
      SCANF_LDBL_IS_DBL | SCANF_ISOC99_A);
@@ -891,7 +891,7 @@  __nldbl___isoc99_vscanf (const char *fmt, va_list ap)

 int
 attribute_compat_text_section
-__nldbl___isoc99_fscanf (FILE *s, const char *fmt, ...)
+__nldbl___isoc99_fscanf (FILE *__restrict s, const char *__restrict fmt,
...)
 {
   va_list ap;
   int ret;
@@ -905,7 +905,7 @@  __nldbl___isoc99_fscanf (FILE *s, const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___isoc99_scanf (const char *fmt, ...)
+__nldbl___isoc99_scanf (const char *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -920,7 +920,7 @@  __nldbl___isoc99_scanf (const char *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___isoc99_vfwscanf (FILE *s, const wchar_t *fmt, va_list ap)
+__nldbl___isoc99_vfwscanf (FILE *__restrict s, const wchar_t *__restrict
fmt, va_list ap)
 {
   return __vfwscanf_internal (s, fmt, ap, SCANF_LDBL_IS_DBL |
SCANF_ISOC99_A);
 }
@@ -928,7 +928,7 @@  libc_hidden_def (__nldbl___isoc99_vfwscanf)

 int
 attribute_compat_text_section
-__nldbl___isoc99_swscanf (const wchar_t *s, const wchar_t *fmt, ...)
+__nldbl___isoc99_swscanf (const wchar_t *__restrict s, const wchar_t
*__restrict fmt, ...)
 {
   _IO_strfile sf;
   struct _IO_wide_data wd;
@@ -945,7 +945,7 @@  __nldbl___isoc99_swscanf (const wchar_t *s, const
wchar_t *fmt, ...)

 int
 attribute_compat_text_section
-__nldbl___isoc99_vswscanf (const wchar_t *s, const wchar_t *fmt, va_list
ap)
+__nldbl___isoc99_vswscanf (const wchar_t *__restrict s, const wchar_t
*__restrict fmt, va_list ap)
 {
   _IO_strfile sf;
   struct _IO_wide_data wd;
@@ -957,7 +957,7 @@  libc_hidden_def (__nldbl___isoc99_vswscanf)

 int
 attribute_compat_text_section
-__nldbl___isoc99_vwscanf (const wchar_t *fmt, va_list ap)
+__nldbl___isoc99_vwscanf (const wchar_t *__restrict fmt, va_list ap)
 {
   return __vfwscanf_internal (stdin, fmt, ap,
      SCANF_LDBL_IS_DBL | SCANF_ISOC99_A);
@@ -965,7 +965,7 @@  __nldbl___isoc99_vwscanf (const wchar_t *fmt, va_list
ap)

 int
 attribute_compat_text_section
-__nldbl___isoc99_fwscanf (FILE *s, const wchar_t *fmt, ...)
+__nldbl___isoc99_fwscanf (FILE *__restrict s, const wchar_t *__restrict
fmt, ...)
 {
   va_list ap;
   int ret;
@@ -979,7 +979,7 @@  __nldbl___isoc99_fwscanf (FILE *s, const wchar_t *fmt,
...)

 int
 attribute_compat_text_section
-__nldbl___isoc99_wscanf (const wchar_t *fmt, ...)
+__nldbl___isoc99_wscanf (const wchar_t *__restrict fmt, ...)
 {
   va_list ap;
   int ret;
@@ -993,7 +993,7 @@  __nldbl___isoc99_wscanf (const wchar_t *fmt, ...)
 }

 void
-__nldbl_argp_error (const struct argp_state *state, const char *fmt, ...)
+__nldbl_argp_error (const struct argp_state *state, const char *__restrict
fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -1003,7 +1003,7 @@  __nldbl_argp_error (const struct argp_state *state,
const char *fmt, ...)

 void
 __nldbl_argp_failure (const struct argp_state *state, int status,
- int errnum, const char *fmt, ...)
+ int errnum, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
@@ -1021,53 +1021,53 @@  __nldbl_argp_failure (const struct argp_state
*state, int status,
 }

 void
-__nldbl_err (int status, const char *format, ...)
+__nldbl_err (int status, const char *__restrict format, ...)
 {
   VA_CALL (__vwarn_internal)
   exit (status);
 }

 void
-__nldbl_errx (int status, const char *format, ...)
+__nldbl_errx (int status, const char *__restrict format, ...)
 {
   VA_CALL (__vwarnx_internal)
   exit (status);
 }

 void
-__nldbl_verr (int status, const char *format, __gnuc_va_list ap)
+__nldbl_verr (int status, const char *__restrict format, __gnuc_va_list ap)
 {
   __vwarn_internal (format, ap, PRINTF_LDBL_IS_DBL);
   exit (status);
 }

 void
-__nldbl_verrx (int status, const char *format, __gnuc_va_list ap)
+__nldbl_verrx (int status, const char *__restrict format, __gnuc_va_list
ap)
 {
   __vwarnx_internal (format, ap, PRINTF_LDBL_IS_DBL);
   exit (status);
 }

 void
-__nldbl_warn (const char *format, ...)
+__nldbl_warn (const char *__restrict format, ...)
 {
   VA_CALL (__vwarn_internal)
 }

 void
-__nldbl_warnx (const char *format, ...)
+__nldbl_warnx (const char *__restrict format, ...)
 {
   VA_CALL (__vwarnx_internal)
 }

 void
-__nldbl_vwarn (const char *format, __gnuc_va_list ap)
+__nldbl_vwarn (const char *__restrict format, __gnuc_va_list ap)
 {
   __vwarn_internal (format, ap, PRINTF_LDBL_IS_DBL);
 }

 void
-__nldbl_vwarnx (const char *format, __gnuc_va_list ap)
+__nldbl_vwarnx (const char *__restrict format, __gnuc_va_list ap)
 {
   __vwarnx_internal (format, ap, PRINTF_LDBL_IS_DBL);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-dprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-dprintf.c
index 6e26db2a247..ae4e3352fbd 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-dprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-dprintf.c
@@ -2,7 +2,7 @@ 

 attribute_hidden
 int
-dprintf (int d, const char *fmt, ...)
+dprintf (int d, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-dprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-dprintf_chk.c
index b3e23591281..3e15cb375f9 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-dprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-dprintf_chk.c
@@ -2,7 +2,7 @@ 

 attribute_hidden
 int
-__dprintf_chk (int d, int flag, const char *fmt, ...)
+__dprintf_chk (int d, int flag, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-fprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-fprintf.c
index 9df4c4bc346..e15600d68c4 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-fprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-fprintf.c
@@ -2,7 +2,7 @@ 

 attribute_hidden
 int
-fprintf (FILE *stream, const char *fmt, ...)
+fprintf (FILE *__restrict stream, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-fprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-fprintf_chk.c
index 43a76181836..d8c2403896b 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-fprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-fprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__fprintf_chk (FILE *stream, int flag, const char *fmt, ...)
+__fprintf_chk (FILE *__restrict stream, int flag, const char *__restrict
fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-fscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-fscanf.c
index 00507187f3e..bb1e384efbc 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-fscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-fscanf.c
@@ -7,7 +7,7 @@ 

 int
 attribute_hidden
-fscanf (FILE *stream, const char *fmt, ...)
+fscanf (FILE *__restrict stream, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-iovfscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-iovfscanf.c
index 6ed9b486249..3b5aa2e381e 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-iovfscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-iovfscanf.c
@@ -7,7 +7,7 @@ 

 int
 attribute_hidden
-_IO_vfscanf (FILE *s, const char *fmt, va_list ap, int *errp)
+_IO_vfscanf (FILE *__restrict s, const char *__restrict fmt, va_list ap,
int *errp)
 {
   return __nldbl__IO_vfscanf (s, fmt, ap, errp);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_fscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_fscanf.c
index 1d736668a48..f7819fed9a3 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_fscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_fscanf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__isoc99_fscanf (FILE *stream, const char *fmt, ...)
+__isoc99_fscanf (FILE *__restrict stream, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_scanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_scanf.c
index ec2ec53291d..0c569f246b6 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_scanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_scanf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__isoc99_scanf (const char *fmt, ...)
+__isoc99_scanf (const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_sscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_sscanf.c
index 52e1bd5d2a6..b624bb1f881 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_sscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_sscanf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__isoc99_sscanf (const char *s, const char *fmt, ...)
+__isoc99_sscanf (const char *__restrict s, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vfscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vfscanf.c
index 55556c375c8..76d683b758f 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vfscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vfscanf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__isoc99_vfscanf (FILE *s, const char *fmt, va_list ap)
+__isoc99_vfscanf (FILE *__restrict s, const char *__restrict fmt, va_list
ap)
 {
   return __nldbl___isoc99_vfscanf (s, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vscanf.c
index 6284c9339bf..671a936f847 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vscanf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__isoc99_vscanf (const char *fmt, va_list ap)
+__isoc99_vscanf (const char *__restrict fmt, va_list ap)
 {
   return __nldbl___isoc99_vfscanf (stdin, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vsscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vsscanf.c
index 0c19032b156..aa40eada621 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vsscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-isoc99_vsscanf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__isoc99_vsscanf (const char *string, const char *fmt, va_list ap)
+__isoc99_vsscanf (const char *__restrict string, const char *__restrict
fmt, va_list ap)
 {
   return __nldbl___isoc99_vsscanf (string, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf.c
index 4abff2dc0d6..e79e169e4e8 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-obstack_printf (struct obstack *obstack, const char *fmt, ...)
+obstack_printf (struct obstack *obstack, const char *__restrict fmt, ...)
 {
   int result;
   va_list ap;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf_chk.c
index 8e7d8eb4ad9..687479695bf 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_printf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__obstack_printf_chk (struct obstack *obstack, int flag, const char *fmt,
...)
+__obstack_printf_chk (struct obstack *obstack, int flag, const char
*__restrict fmt, ...)
 {
   int result;
   va_list ap;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf.c
index 228a50726b9..87981f6759e 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-obstack_vprintf (struct obstack *obstack, const char *fmt, va_list ap)
+obstack_vprintf (struct obstack *obstack, const char *__restrict fmt,
va_list ap)
 {
   return __nldbl_obstack_vprintf (obstack, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf_chk.c
index a06f6bf9b4a..592a7021537 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-obstack_vprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__obstack_vprintf_chk (struct obstack *obstack, int flag, const char *fmt,
+__obstack_vprintf_chk (struct obstack *obstack, int flag, const char
*__restrict fmt,
        va_list ap)
 {
   return __nldbl___obstack_vprintf_chk (obstack, flag, fmt, ap);
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-printf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-printf.c
index e4b0fbae0cc..26a6e85b66b 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-printf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-printf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-printf (const char *fmt, ...)
+printf (const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-printf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-printf_chk.c
index 926db412f94..7a6b311edaf 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-printf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-printf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__printf_chk (int flag, const char *fmt, ...)
+__printf_chk (int flag, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-scanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-scanf.c
index c10da284f2e..aac04f613ea 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-scanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-scanf.c
@@ -7,7 +7,7 @@ 

 int
 attribute_hidden
-scanf (const char *fmt, ...)
+scanf (const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-snprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-snprintf.c
index ef6fb96a2c2..93ef61a7a6d 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-snprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-snprintf.c
@@ -3,7 +3,7 @@ 
 int
 attribute_hidden
 weak_function
-snprintf (char *s, size_t maxlen, const char *fmt, ...)
+snprintf (char *__restrict s, size_t maxlen, const char *__restrict fmt,
...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-snprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-snprintf_chk.c
index 944d3de9dba..949b40bc25a 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-snprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-snprintf_chk.c
@@ -2,8 +2,8 @@ 

 int
 attribute_hidden
-__snprintf_chk (char *s, size_t maxlen, int flag, size_t slen,
- const char *fmt, ...)
+__snprintf_chk (char *__restrict s, size_t maxlen, int flag, size_t slen,
+ const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-sprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-sprintf.c
index 5d37a7e7f07..0fec7dee595 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-sprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-sprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-sprintf (char *s, const char *fmt, ...)
+sprintf (char *__restrict s, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-sprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-sprintf_chk.c
index 349b7c5c22a..275b6ff9735 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-sprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-sprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__sprintf_chk (char *s, int flag, size_t slen, const char *fmt, ...)
+__sprintf_chk (char *__restrict s, int flag, size_t slen, const char
*__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-sscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-sscanf.c
index 34e18be0a16..ab77e1ab94c 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-sscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-sscanf.c
@@ -7,7 +7,7 @@ 

 int
 attribute_hidden
-sscanf (const char *s, const char *fmt, ...)
+sscanf (const char *__restrict s, const char *__restrict fmt, ...)
 {
   va_list arg;
   int done;
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-syslog.c
b/sysdeps/ieee754/ldbl-opt/nldbl-syslog.c
index 8687e9f5409..90ee6cf1569 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-syslog.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-syslog.c
@@ -2,7 +2,7 @@ 

 void
 attribute_hidden
-syslog (int pri, const char *fmt, ...)
+syslog (int pri, const char *__restrict fmt, ...)
 {
   va_list ap;
   va_start (ap, fmt);
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-syslog_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-syslog_chk.c
index 31ea6a8b9d1..b93b98678c7 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-syslog_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-syslog_chk.c
@@ -2,7 +2,7 @@ 

 void
 attribute_hidden
-__syslog_chk (int pri, int flag, const char *fmt, ...)
+__syslog_chk (int pri, int flag, const char *__restrict fmt, ...)
 {
   va_list ap;

diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf.c
index 52fa18cceec..4599b32c15c 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf.c
@@ -3,7 +3,7 @@ 
 int
 attribute_hidden
 weak_function
-vasprintf (char **result_ptr, const char *fmt, va_list ap)
+vasprintf (char **__restrict result_ptr, const char *__restrict fmt,
va_list ap)
 {
   return __nldbl_vasprintf (result_ptr, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf_chk.c
index 4f5391a9d74..79f8e20ac6c 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vasprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__vasprintf_chk (char **result_ptr, int flag, const char *fmt, va_list ap)
+__vasprintf_chk (char **__restrict result_ptr, int flag, const char
*__restrict fmt, va_list ap)
 {
   return __nldbl___vasprintf_chk (result_ptr, flag, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf.c
index 1acbd406253..a7eae9d603a 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-vdprintf (int d, const char *fmt, va_list arg)
+vdprintf (int d, const char *__restrict fmt, va_list arg)
 {
   return __nldbl_vdprintf (d, fmt, arg);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf_chk.c
index ca1ce018789..f7fc758a229 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vdprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__vdprintf_chk (int d, int flag, const char *fmt, va_list arg)
+__vdprintf_chk (int d, int flag, const char *__restrict fmt, va_list arg)
 {
   return __nldbl___vdprintf_chk (d, flag, fmt, arg);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf.c
index 6ca8437b284..c5ac4d1796c 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-vfprintf (FILE *s, const char *fmt, va_list ap)
+vfprintf (FILE *__restrict s, const char *__restrict fmt, va_list ap)
 {
   return __nldbl_vfprintf (s, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf_chk.c
index 0f6820af63b..ef13c8b08c1 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vfprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__vfprintf_chk (FILE *s, int flag, const char *fmt, va_list ap)
+__vfprintf_chk (FILE *__restrict s, int flag, const char *__restrict fmt,
va_list ap)
 {
   return __nldbl___vfprintf_chk (s, flag, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vfscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vfscanf.c
index 6f5ebc30454..b30ebe73c35 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vfscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vfscanf.c
@@ -7,7 +7,7 @@ 

 int
 attribute_hidden
-__vfscanf (FILE *s, const char *fmt, va_list ap)
+__vfscanf (FILE *__restrict s, const char *__restrict fmt, va_list ap)
 {
   return __nldbl__IO_vfscanf (s, fmt, ap, NULL);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vprintf.c
index ed0d27d9a00..8f0895f9971 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-vprintf (const char *fmt, va_list ap)
+vprintf (const char *__restrict fmt, va_list ap)
 {
   return __nldbl_vfprintf (stdout, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vprintf_chk.c
index 63b3e8f9654..568ba63e538 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__vprintf_chk (int flag, const char *fmt, va_list ap)
+__vprintf_chk (int flag, const char *__restrict fmt, va_list ap)
 {
   return __nldbl___vfprintf_chk (stdout, flag, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vscanf.c
index 38f654aa730..c2f9045f94a 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vscanf.c
@@ -8,7 +8,7 @@ 
 int
 attribute_hidden
 weak_function
-vscanf (const char *fmt, va_list ap)
+vscanf (const char *__restrict fmt, va_list ap)
 {
   return __nldbl__IO_vfscanf (stdin, fmt, ap, NULL);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf.c
index 5a9bcbcaeec..147726412fa 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-vsnprintf (char *string, size_t maxlen, const char *fmt, va_list ap)
+vsnprintf (char *__restrict string, size_t maxlen, const char *__restrict
fmt, va_list ap)
 {
   return __nldbl_vsnprintf (string, maxlen, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf_chk.c
index 19380291a3b..a10c1be12b5 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsnprintf_chk.c
@@ -2,8 +2,8 @@ 

 int
 attribute_hidden
-__vsnprintf_chk (char *string, size_t maxlen, int flag, size_t slen,
- const char *fmt, va_list ap)
+__vsnprintf_chk (char *__restrict string, size_t maxlen, int flag, size_t
slen,
+ const char *__restrict fmt, va_list ap)
 {
   return __nldbl___vsnprintf_chk (string, maxlen, flag, slen, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf.c
index 04406d0f6e2..181eb703a87 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-_IO_vsprintf (char *string, const char *fmt, va_list ap)
+_IO_vsprintf (char *__restrict string, const char *__restrict fmt, va_list
ap)
 {
   return __nldbl_vsprintf (string, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf_chk.c
index 9df143fcef8..1f0bad54da0 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsprintf_chk.c
@@ -2,7 +2,7 @@ 

 int
 attribute_hidden
-__vsprintf_chk (char *string, int flag, size_t slen, const char *fmt,
+__vsprintf_chk (char *__restrict string, int flag, size_t slen, const char
*__restrict fmt,
  va_list ap)
 {
   return __nldbl___vsprintf_chk (string, flag, slen, fmt, ap);
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsscanf.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsscanf.c
index 33e10e49a91..340e5af3405 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsscanf.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsscanf.c
@@ -7,7 +7,7 @@ 

 int
 attribute_hidden
-__vsscanf (const char *string, const char *fmt, va_list ap)
+__vsscanf (const char *__restrict string, const char *__restrict fmt,
va_list ap)
 {
   return __nldbl_vsscanf (string, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog.c
index eed1010eeac..f62e8ce8077 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog.c
@@ -2,7 +2,7 @@ 

 attribute_hidden
 void
-vsyslog (int pri, const char *fmt, va_list ap)
+vsyslog (int pri, const char *__restrict fmt, va_list ap)
 {
   __nldbl_vsyslog (pri, fmt, ap);
 }
diff --git a/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog_chk.c
b/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog_chk.c
index 2221474f97e..753dfec5b58 100644
--- a/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog_chk.c
+++ b/sysdeps/ieee754/ldbl-opt/nldbl-vsyslog_chk.c
@@ -2,7 +2,7 @@ 

 void
 attribute_hidden
-__vsyslog_chk (int pri, int flag, const char *fmt, va_list ap)
+__vsyslog_chk (int pri, int flag, const char *__restrict fmt, va_list ap)
 {
   __nldbl___vsyslog_chk (pri, flag, fmt, ap);
 }
diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
index e8e582e0cf5..b7c05927664 100644
--- a/sysdeps/posix/libc_fatal.c
+++ b/sysdeps/posix/libc_fatal.c
@@ -54,7 +54,7 @@  struct str_list

 /* Abort with an error message.  */
 void
-__libc_message (const char *fmt, ...)
+__libc_message (const char *__restrict fmt, ...)
 {
   va_list ap;
   int fd = -1;
diff --git a/sysdeps/x86_64/dl-machine.h b/sysdeps/x86_64/dl-machine.h
index 005d089501f..922eed6deae 100644
--- a/sysdeps/x86_64/dl-machine.h
+++ b/sysdeps/x86_64/dl-machine.h
@@ -416,17 +416,14 @@  and creates an unsatisfiable circular dependency.\n",
   value += reloc->r_addend;
   *(unsigned int *) reloc_addr = value;

-  const char *fmt;
   if (__glibc_unlikely (value > UINT_MAX))
     {
       const char *strtab;

-      fmt = "\
-%s: Symbol `%s' causes overflow in R_X86_64_32 relocation\n";
-    print_err:
       strtab = (const char *) D_PTR (map, l_info[DT_STRTAB]);

-      _dl_error_printf (fmt, RTLD_PROGNAME, strtab + refsym->st_name);
+      _dl_error_printf ("\
+  %s: Symbol `%s' causes overflow in R_X86_64_32 relocation\n",
RTLD_PROGNAME, strtab + refsym->st_name);
     }
   break;
   /* Not needed for dl-conflict.c.  */
@@ -435,9 +432,8 @@  and creates an unsatisfiable circular dependency.\n",
   *(unsigned int *) reloc_addr = value;
   if (__glibc_unlikely (value != (int) value))
     {
-      fmt = "\
-%s: Symbol `%s' causes overflow in R_X86_64_PC32 relocation\n";
-      goto print_err;
+  _dl_error_printf ("\
+  %s: Symbol `%s' causes overflow in R_X86_64_PC32 relocation\n",
RTLD_PROGNAME, strtab + refsym->st_name);
     }
   break;
  case R_X86_64_COPY:
@@ -451,9 +447,8 @@  and creates an unsatisfiable circular dependency.\n",
       || (__glibc_unlikely (sym->st_size < refsym->st_size)
   && GLRO(dl_verbose)))
     {
-      fmt = "\
-%s: Symbol `%s' has different size in shared object, consider
re-linking\n";
-      goto print_err;
+  _dl_error_printf ("\
+  %s: Symbol `%s' has different size in shared object, consider
re-linking\n", RTLD_PROGNAME, strtab + refsym->st_name);
     }
   break;
  case R_X86_64_IRELATIVE:
diff --git a/time/strptime.c b/time/strptime.c
index a355249c1f3..025c66318a9 100644
--- a/time/strptime.c
+++ b/time/strptime.c
@@ -27,7 +27,7 @@ 


 char *
-strptime (const char *buf, const char *format, struct tm *tm)
+strptime (const char *__restrict buf, const char *__restrict format,
struct tm *__restrict tm)
 {
   return __strptime_internal (buf, format, tm, NULL, _NL_CURRENT_LOCALE);
 }
diff --git a/time/strptime_l.c b/time/strptime_l.c
index a3c5681fc2d..91962852565 100644
--- a/time/strptime_l.c
+++ b/time/strptime_l.c
@@ -238,7 +238,7 @@  char *
 #else
 static char *
 #endif
-__strptime_internal (const char *rp, const char *fmt, struct tm *tmp,
+__strptime_internal (const char *rp, const char *__restrict fmt, struct tm
*tmp,
      void *statep LOCALE_PARAM)
 {
 #ifdef _LIBC
@@ -821,7 +821,7 @@  __strptime_internal (const char *rp, const char *fmt,
struct tm *tmp,
       /* Match locale's alternate date and time format.  */
       if (s.decided != raw)
  {
-  const char *fmt = _NL_CURRENT (LC_TIME, ERA_D_T_FMT);
+  const char *__restrict fmt = _NL_CURRENT (LC_TIME, ERA_D_T_FMT);

   if (*fmt == '\0')
     fmt = _NL_CURRENT (LC_TIME, D_T_FMT);
@@ -992,7 +992,7 @@  __strptime_internal (const char *rp, const char *fmt,
struct tm *tmp,
     case 'x':
       if (s.decided != raw)
  {
-  const char *fmt = _NL_CURRENT (LC_TIME, ERA_D_FMT);
+  const char *__restrict fmt = _NL_CURRENT (LC_TIME, ERA_D_FMT);

   if (*fmt == '\0')
     fmt = _NL_CURRENT (LC_TIME, D_FMT);
@@ -1018,7 +1018,7 @@  __strptime_internal (const char *rp, const char *fmt,
struct tm *tmp,
     case 'X':
       if (s.decided != raw)
  {
-  const char *fmt = _NL_CURRENT (LC_TIME, ERA_T_FMT);
+  const char *__restrict fmt = _NL_CURRENT (LC_TIME, ERA_T_FMT);

   if (*fmt == '\0')
     fmt = _NL_CURRENT (LC_TIME, T_FMT);
diff --git a/time/tst-strftime.c b/time/tst-strftime.c
index 482cd16c39c..d5469dd4f5d 100644
--- a/time/tst-strftime.c
+++ b/time/tst-strftime.c
@@ -126,7 +126,7 @@  do_test (void)
     };
   const struct
   {
-    const char *fmt;
+    const char *__restrict fmt;
     const char *exp;
     size_t n;
   } ftests[] =