Implemented bound check support for string/memory routines for x86_64.

TODO: Fix bound check support in strcmp-sse2 and implement in strspn, strstr and strcspn.

argp/argp-help.c

@@ -867,7 +867,10 @@ hol_append (struct hol *hol, struct hol *more)
 
 	  /* Fix up the short options pointers from HOL.  */
 	  for (e = entries, left = hol->num_entries; left > 0; e++, left--)
-	    e->short_options += (short_options - hol->short_options);
+	   {
+	     unsigned long offset = e->short_options - hol->short_options;
+		  e->short_options = (char *)(short_options + offset);
+		}
 
 	  /* Now add the short options from MORE, fixing up its entries
 	     too.  */

bits/dirent.h

@@ -32,7 +32,7 @@ struct dirent
     unsigned char d_namlen;	/* Length of the file name.  */
 
     /* Only this member is in the POSIX standard.  */
-    char d_name[1];		/* File name (actually longer).  */
+    char d_name[1] __attribute__((bnd_variable_size));		/* File name (actually longer).  */
   };
 
 #ifdef __USE_LARGEFILE64
@@ -43,7 +43,7 @@ struct dirent64
     unsigned char d_type;
     unsigned char d_namlen;
 
-    char d_name[1];
+    char d_name[1] __attribute__((bnd_variable_size));
   };
 #endif
 

bits/sched.h

@@ -65,7 +65,7 @@ typedef unsigned long int __cpu_mask;
 /* Data structure to describe CPU mask.  */
 typedef struct
 {
-  __cpu_mask __bits[__CPU_SETSIZE / __NCPUBITS];
+  __cpu_mask __bits[__CPU_SETSIZE / __NCPUBITS] __attribute__((bnd_variable_size));
 } cpu_set_t;
 
 /* Access functions for CPU masks.  */

config.make.in

@@ -96,12 +96,15 @@ build-nscd = @build_nscd@
 use-nscd = @use_nscd@
 build-hardcoded-path-in-tests= @hardcoded_path_in_tests@
 build-pt-chown = @build_pt_chown@
+enable-mpx = @enable_mpx@
+enable-mpx-write-only = @enable_mpx_write_only@
 
 # Build tools.
 CC = @CC@
 CXX = @CXX@
 BUILD_CC = @BUILD_CC@
 CFLAGS = @CFLAGS@
+ASFLAGS = @ASFLAGS@
 CPPFLAGS-config = @CPPFLAGS@
 CPPUNDEFS = @CPPUNDEFS@
 ASFLAGS-config = @ASFLAGS_config@

configure

@@ -653,6 +653,9 @@ link_obsolete_rpc
 libc_cv_nss_crypt
 all_warnings
 force_install
+ASFLAGS
+enable_mpx_write_only
+enable_mpx
 bindnow
 hardcoded_path_in_tests
 oldest_abi
@@ -747,6 +750,8 @@ enable_lock_elision
 enable_add_ons
 enable_hidden_plt
 enable_bind_now
+enable_mpx
+enable_mpx_write_only
 enable_static_nss
 enable_force_install
 enable_kernel
@@ -1409,6 +1414,8 @@ Optional Features:
                           for add-ons if no parameter given
   --disable-hidden-plt    do not hide internal function calls to avoid PLT
   --enable-bind-now       disable lazy relocations in DSOs
+  --enable-mpx            turn on Intel MPX extension
+  --enable-mpx-write-only turn on Intel MPX extension
   --enable-static-nss     build static NSS modules [default=no]
   --disable-force-install don't force installation of files from this package,
                           even if they are older than the installed files
@@ -3519,6 +3526,37 @@ fi
 
 
 
+# Check whether --enable-mpx was given.
+if test "${enable_mpx+set}" = set; then :
+  enableval=$enable_mpx; enable_mpx=$enableval
+else
+  enable_mpx=no
+fi
+
+
+
+# Check whether --enable-mpx-write-only was given.
+if test "${enable_mpx_write_only+set}" = set; then :
+  enableval=$enable_mpx_write_only; enable_mpx_write_only=$enableval
+else
+  enable_mpx_write_only=no
+fi
+
+
+
+
+
+if test "$enable_mpx" = yes ; then
+	CFLAGS="$CFLAGS -g -fcheck-pointers -mmpx -fno-chkp-check-incomplete-type -fchkp-zero-input-bounds-for-main";
+   ASFLAGS="$ASFLAGS -g -D__CHKP__ -mmpx -Wa,-madd-bnd-prefix"
+fi
+
+if test "$enable_mpx_write_only" = yes ; then
+	CFLAGS="$CFLAGS -g -fcheck-pointers -fno-chkp-check-read -mmpx -fno-chkp-check-incomplete-type -fchkp-zero-input-bounds-for-main";
+	ASFLAGS="$ASFLAGS -g -D__CHKWR__ -mmpx -Wa,-madd-bnd-prefix"
+	enable_mpx=yes
+fi
+
 # Check whether --enable-static-nss was given.
 if test "${enable_static_nss+set}" = set; then :
   enableval=$enable_static_nss; static_nss=$enableval

configure.in

@@ -216,6 +216,33 @@ AC_ARG_ENABLE([bind-now],
 	      [bindnow=no])
 AC_SUBST(bindnow)
 
+AC_ARG_ENABLE([mpx],
+	      AC_HELP_STRING([--enable-mpx],
+			     [turn on Intel MPX extension]),
+	      [enable_mpx=$enableval],
+	      [enable_mpx=no])
+AC_SUBST(enable_mpx)
+
+AC_ARG_ENABLE([mpx-write-only],
+	      AC_HELP_STRING([--enable-mpx-write-only],
+			     [turn on Intel MPX extension]),
+	      [enable_mpx_write_only=$enableval],
+	      [enable_mpx_write_only=no])
+AC_SUBST(enable_mpx_write_only)
+
+AC_SUBST(ASFLAGS)
+
+if test "$enable_mpx" = yes ; then
+	CFLAGS="$CFLAGS -g -fcheck-pointers -mmpx -fno-chkp-check-incomplete-type -fchkp-zero-input-bounds-for-main";
+   ASFLAGS="$ASFLAGS -g -D__CHKP__ -mmpx -Wa,-madd-bnd-prefix"
+fi
+
+if test "$enable_mpx_write_only" = yes ; then
+	CFLAGS="$CFLAGS -g -fcheck-pointers -fno-chkp-check-read -mmpx -fno-chkp-check-incomplete-type -fchkp-zero-input-bounds-for-main";
+	ASFLAGS="$ASFLAGS -g -D__CHKWR__ -mmpx -Wa,-madd-bnd-prefix"
+	enable_mpx=yes
+fi
+
 dnl On some platforms we cannot use dynamic loading.  We must provide
 dnl static NSS modules.
 AC_ARG_ENABLE([static-nss],

crypt/crypt.c

@@ -43,7 +43,13 @@ _ufc_doit_r(itr, __data, res)
   int i;
   long32 s, *k;
   long32 *sb01 = (long32*)__data->sb0;
+#ifdef __CHKP__
+  sb01 = __bnd_set_ptr_bounds (sb01, sizeof(__data->sb0) + sizeof(__data->sb1));
+#endif
   long32 *sb23 = (long32*)__data->sb2;
+#ifdef __CHKP__
+  sb23 = __bnd_set_ptr_bounds (sb23, sizeof(__data->sb2) + sizeof(__data->sb3));
+#endif
   long32 l1, l2, r1, r2;
 
   l1 = (long32)res[0]; l2 = (long32)res[1];
@@ -89,7 +95,13 @@ _ufc_doit_r(itr, __data, res)
   int i;
   long64 l, r, s, *k;
   long64 *sb01 = (long64*)__data->sb0;
+#ifdef __CHKP__
+  sb01 = __bnd_set_ptr_bounds (sb01, sizeof(__data->sb0) + sizeof(__data->sb1));
+#endif
   long64 *sb23 = (long64*)__data->sb2;
+#ifdef __CHKP__
+  sb23 = __bnd_set_ptr_bounds (sb23, sizeof(__data->sb2) + sizeof(__data->sb3));
+#endif
 
   l = (((long64)res[0]) << 32) | ((long64)res[1]);
   r = (((long64)res[2]) << 32) | ((long64)res[3]);

crypt/crypt_util.c

@@ -487,7 +487,7 @@ small_tables_done:
    * DES round.
    *
    */
-
+#ifndef __CHKP__
   if (__data->sb0 + sizeof (__data->sb0) == __data->sb1
       && __data->sb1 + sizeof (__data->sb1) == __data->sb2
       && __data->sb2 + sizeof (__data->sb2) == __data->sb3)
@@ -497,11 +497,14 @@ small_tables_done:
 		  + (int)sizeof(__data->sb2)
 		  + (int)sizeof(__data->sb3));
   else {
+#endif
     _ufc_clearmem(__data->sb0, (int)sizeof(__data->sb0));
     _ufc_clearmem(__data->sb1, (int)sizeof(__data->sb1));
     _ufc_clearmem(__data->sb2, (int)sizeof(__data->sb2));
     _ufc_clearmem(__data->sb3, (int)sizeof(__data->sb3));
+#ifndef __CHKP__
   }
+#endif
 
   for(sg = 0; sg < 4; sg++) {
     int j1, j2;

debug/strcpy_chk.c

@@ -27,6 +27,7 @@ __strcpy_chk (dest, src, destlen)
      char *dest;
      const char *src;
      size_t destlen;
+#ifndef __CHKP__
 {
   char c;
   char *s = (char *) src;
@@ -65,3 +66,45 @@ __strcpy_chk (dest, src, destlen)
 
   return dest;
 }
+#else
+{
+  char c;
+  char *s = (char *) src;
+  char *d = (char *) dest;
+
+  while (__builtin_expect (destlen >= 4, 0))
+    {
+      c = s[0];
+      d[0] = c;
+      if (c == '\0')
+        return dest;
+      c = s[1];
+      d[1] = c;
+      if (c == '\0')
+        return dest;
+      c = s[2];
+      d[2] = c;
+      if (c == '\0')
+        return dest;
+      c = s[3];
+      d[3] = c;
+      if (c == '\0')
+        return dest;
+      destlen -= 4;
+      d += 4;
+      s += 4;
+    }
+
+  do
+    {
+      if (__builtin_expect (destlen-- == 0, 0))
+        __chk_fail ();
+      c = *s;
+      *(d++) = c;
+      s++;
+    }
+  while (c != '\0');
+
+  return dest;
+}
+#endif

debug/tst-chk1.c

@@ -137,8 +137,8 @@ do_test (void)
     }
   setenv ("LIBC_FATAL_STDERR_", "1", 1);
 
-  struct A { char buf1[9]; char buf2[1]; } a;
-  struct wA { wchar_t buf1[9]; wchar_t buf2[1]; } wa;
+  struct A { char buf1[9] __attribute__((bnd_variable_size)); char buf2[1]; } a;
+  struct wA { wchar_t buf1[9] __attribute__((bnd_variable_size)); wchar_t buf2[1]; } wa;
 
   printf ("Test checking routines at fortify level %d\n",
 #ifdef __USE_FORTIFY_LEVEL

debug/wcpcpy_chk.c

@@ -26,6 +26,7 @@
    DEST.  Check for overflows.  */
 wchar_t *
 __wcpcpy_chk (wchar_t *dest, const wchar_t *src, size_t destlen)
+#ifndef __CHKP__
 {
   wchar_t *wcp = (wchar_t *) dest - 1;
   wint_t c;
@@ -42,3 +43,21 @@ __wcpcpy_chk (wchar_t *dest, const wchar_t *src, size_t destlen)
 
   return wcp;
 }
+#else
+{
+  dest--;
+  wint_t c;
+
+  do
+    {
+      if (__builtin_expect (destlen-- == 0, 0))
+	__chk_fail ();
+      c = src[0];
+      *++dest = c;
+      ++src;
+    }
+  while (c != L'\0');
+
+  return dest;
+}
+#endif

debug/wcscpy_chk.c

@@ -23,6 +23,7 @@
 /* Copy SRC to DEST.  */
 wchar_t *
 __wcscpy_chk (wchar_t *dest, const wchar_t *src, size_t n)
+#ifndef __CHKP__
 {
   wint_t c;
   wchar_t *wcp;
@@ -58,3 +59,22 @@ __wcscpy_chk (wchar_t *dest, const wchar_t *src, size_t n)
 
   return dest;
 }
+#else
+{
+  const wchar_t *result = dest;
+  dest--;
+  wint_t c;
+
+  do
+	{
+	  if (__builtin_expect (n-- == 0, 0))
+	     __chk_fail ();
+	  c = src[0];
+	  *++dest = c;
+	  ++src;
+	}
+  while (c != L'\0');
+
+  return result;
+}
+#endif

dlfcn/dlfcn.h

@@ -180,7 +180,7 @@ typedef struct
 {
   size_t dls_size;		/* Size in bytes of the whole buffer.  */
   unsigned int dls_cnt;		/* Number of elements in `dls_serpath'.  */
-  Dl_serpath dls_serpath[1];	/* Actually longer, dls_cnt elements.  */
+  Dl_serpath dls_serpath[1] __attribute__((bnd_variable_size));	/* Actually longer, dls_cnt elements.  */
 } Dl_serinfo;
 #endif /* __USE_GNU */
 

elf/Makefile

@@ -50,6 +50,10 @@ CFLAGS-dl-runtime.c = -fexceptions -fasynchronous-unwind-tables
 CFLAGS-dl-lookup.c = -fexceptions -fasynchronous-unwind-tables
 CFLAGS-dl-iterate-phdr.c = $(uses-callbacks)
 
+ifeq ($(enable-mpx), yes)
+CFLAGS-dl-init.c = -fno-check-pointers
+endif
+
 ifeq ($(unwind-find-fde),yes)
 routines += unwind-dw2-fde-glibc
 shared-only-routines += unwind-dw2-fde-glibc

elf/dl-close.c

@@ -347,6 +347,10 @@ _dl_close_worker (struct link_map *map)
 		struct link_map *tmap = (struct link_map *)
 		  ((char *) imap->l_scope[cnt]
 		   - offsetof (struct link_map, l_searchlist));
+#ifdef __CHKP__
+		tmap = __bnd_set_ptr_bounds(tmap, sizeof(struct link_map));
+#endif
+
 		assert (tmap->l_ns == nsid);
 		if (tmap->l_idx == IDX_STILL_USED)
 		  ++remain;
@@ -393,6 +397,9 @@ _dl_close_worker (struct link_map *map)
 		      struct link_map *tmap = (struct link_map *)
 			((char *) imap->l_scope[cnt]
 			 - offsetof (struct link_map, l_searchlist));
+#ifdef __CHKP__
+			tmap = __bnd_set_ptr_bounds(tmap, sizeof(struct link_map));
+#endif
 		      if (tmap->l_idx != IDX_STILL_USED)
 			{
 			  /* Remove the scope.  Or replace with own map's

elf/dl-tls.c

@@ -767,6 +767,9 @@ update_get_addr (GET_ADDR_ARGS)
 void *
 __tls_get_addr (GET_ADDR_ARGS)
 {
+#ifdef __CHKP__
+  GET_ADDR_PARAM  = __bnd_init_ptr_bounds(GET_ADDR_PARAM);
+#endif
   dtv_t *dtv = THREAD_DTV ();
 
   if (__builtin_expect (dtv[0].counter != GL(dl_tls_generation), 0))

include/link.h

@@ -318,7 +318,7 @@ struct link_map
     {
       uintptr_t cookie;
       unsigned int bindflags;
-    } l_audit[0];
+    } l_audit[0] __attribute__((bnd_variable_size));
   };
 
 

inet/netinet/in.h

@@ -319,7 +319,7 @@ struct ip_msfilter
     /* Number of source addresses.  */
     uint32_t imsf_numsrc;
     /* Source addresses.  */
-    struct in_addr imsf_slist[1];
+    struct in_addr imsf_slist[1] __attribute__((bnd_variable_size));
   };
 
 #define IP_MSFILTER_SIZE(numsrc) (sizeof (struct ip_msfilter) \
@@ -340,7 +340,7 @@ struct group_filter
     /* Number of source addresses.  */
     uint32_t gf_numsrc;
     /* Source addresses.  */
-    struct sockaddr_storage gf_slist[1];
+    struct sockaddr_storage gf_slist[1] __attribute__((bnd_variable_size));
 };
 
 #define GROUP_FILTER_SIZE(numsrc) (sizeof (struct group_filter) \

inet/protocols/routed.h

@@ -52,8 +52,8 @@ struct rip {
 	u_char	rip_vers;		/* protocol version # */
 	u_char	rip_res1[2];		/* pad to 32-bit boundary */
 	union {
-		struct	netinfo ru_nets[1];	/* variable length... */
-		char	ru_tracefile[1];	/* ditto ... */
+		struct	netinfo ru_nets[1] __attribute__((bnd_variable_size));	/* variable length... */
+		char	ru_tracefile[1] __attribute__((bnd_variable_size));	/* ditto ... */
 	} ripun;
 #define	rip_nets	ripun.ru_nets
 #define	rip_tracefile	ripun.ru_tracefile

intl/dcigettext.c

@@ -204,7 +204,7 @@ struct known_translation_t
   /* Pointer to the string in question.  */
   union
     {
-      char appended[ZERO];  /* used if domain != NULL */
+      char appended[ZERO] __attribute__((bnd_variable_size));  /* used if domain != NULL */
       const char *ptr;      /* used if domain == NULL */
     }
   msgid;
@@ -342,7 +342,7 @@ struct block_list
 typedef struct transmem_list
 {
   struct transmem_list *next;
-  char data[ZERO];
+  char data[ZERO] __attribute__((bnd_variable_size));
 } transmem_block_t;
 static struct transmem_list *transmem_list;
 #else

intl/gettextP.h

@@ -160,7 +160,7 @@ struct binding
   struct binding *next;
   char *dirname;
   char *codeset;
-  char domainname[ZERO];
+  char domainname[ZERO] __attribute__((bnd_variable_size));
 };
 
 /* A counter which is incremented each time some previous translations

intl/gmo.h

@@ -137,7 +137,7 @@ struct sysdep_string
     nls_uint32 segsize;
     /* Reference to system dependent string segment, or ~0 at the end.  */
     nls_uint32 sysdepref;
-  } segments[1];
+  } segments[1] __attribute__((bnd_variable_size));
 };
 
 /* Marker for the end of the segments[] array.  This has the value 0xFFFFFFFF,

intl/loadinfo.h

@@ -58,7 +58,7 @@ struct loaded_l10nfile
   const void *data;
 
   struct loaded_l10nfile *next;
-  struct loaded_l10nfile *successor[1];
+  struct loaded_l10nfile *successor[1] __attribute__((bnd_variable_size));
 };
 
 

io/fts.h

@@ -116,7 +116,7 @@ typedef struct _ftsent {
 	u_short fts_instr;		/* fts_set() instructions */
 
 	struct stat *fts_statp;		/* stat(2) information */
-	char fts_name[1];		/* file name */
+	char fts_name[1] __attribute__((bnd_variable_size));		/* file name */
 } FTSENT;
 
 __BEGIN_DECLS

libio/fileops.c

@@ -758,6 +758,9 @@ decide_maybe_mmap (_IO_FILE *fp)
       void *p;
 
       p = __mmap64 (NULL, st.st_size, PROT_READ, MAP_SHARED, fp->_fileno, 0);
+#ifdef __CHKP__
+		p = __bnd_init_ptr_bounds(p);
+#endif
       if (p != MAP_FAILED)
 	{
 	  /* OK, we managed to map the file.  Set the buffer up and use a

locale/localeinfo.h

@@ -84,7 +84,7 @@ struct __locale_data
     const char *string;
     unsigned int word;		/* Note endian issues vs 64-bit pointers.  */
   }
-  values __flexarr;	/* Items, usually pointers into `filedata'.  */
+  values __flexarr __attribute__((bnd_variable_size));	/* Items, usually pointers into `filedata'.  */
 };
 
 /* We know three kinds of collation sorting rules.  */
@@ -185,7 +185,7 @@ extern const union catnamestr_t
 #include "categories.def"
 #undef DEFINE_CATEGORY
   };
-  char str[0];
+  char str[0] __attribute__((bnd_variable_size));
 } _nl_category_names attribute_hidden;
 extern const uint8_t _nl_category_name_idxs[__LC_LAST] attribute_hidden;
 extern const uint8_t _nl_category_name_sizes[__LC_LAST] attribute_hidden;

malloc/arena.c

@@ -131,9 +131,15 @@ int __malloc_initialized = -1;
 #endif
 
 /* find the heap and corresponding arena for a given ptr */
-
-#define heap_for_ptr(ptr) \
+#ifndef __CHKP__
+# define heap_for_ptr(ptr) \
  ((heap_info *)((unsigned long)(ptr) & ~(HEAP_MAX_SIZE-1)))
+#else
+static heap_info *heap_for_ptr (void *ptr) {
+  heap_info *t = (heap_info *)((unsigned long)(ptr) & ~(HEAP_MAX_SIZE-1));
+  return __bnd_set_ptr_bounds(t, sizeof(heap_info));
+}
+#endif
 #define arena_for_chunk(ptr) \
  (chunk_non_main_arena(ptr) ? heap_for_ptr(ptr)->ar_ptr : &main_arena)
 

malloc/hooks.c

@@ -171,6 +171,9 @@ mem2chunk_check(void* mem, unsigned char **magic_p)
 			    next_chunk(prev_chunk(p))!=p) ))
       return NULL;
     magic = MAGICBYTE(p);
+#ifdef __CHKP__
+	 p = (mchunkptr) __bnd_set_ptr_bounds(p, sz + SIZE_SZ);
+#endif
     for(sz += SIZE_SZ-1; (c = ((unsigned char*)p)[sz]) != magic; sz -= c) {
       if(c<=0 || sz<(c+2*SIZE_SZ)) return NULL;
     }

malloc/malloc.c

@@ -218,7 +218,6 @@
 
 #include <malloc-machine.h>
 #include <malloc-sysdep.h>
-
 #include <atomic.h>
 #include <_itoa.h>
 #include <bits/wordsize.h>
@@ -1222,11 +1221,12 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 /*
   ---------- Size and alignment checks and conversions ----------
 */
-
+#ifndef __CHKP__
 /* conversion from malloc headers to user pointers, and back */
 
-#define chunk2mem(p)   ((void*)((char*)(p) + 2*SIZE_SZ))
-#define mem2chunk(mem) ((mchunkptr)((char*)(mem) - 2*SIZE_SZ))
+# define chunk2mem(p)   ((void*)((char*)(p) + 2*SIZE_SZ))
+# define mem2chunk(mem) ((mchunkptr)((char*)(mem) - 2*SIZE_SZ))
+#endif
 
 /* The smallest possible chunk */
 #define MIN_CHUNK_SIZE        (offsetof(struct malloc_chunk, fd_nextsize))
@@ -1239,12 +1239,11 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 /* Check if m has acceptable alignment */
 
 #define aligned_OK(m)  (((unsigned long)(m) & MALLOC_ALIGN_MASK) == 0)
+#define aligned_chunk_OK(p)  (((unsigned long)((char *)(p) + 2 * SIZE_SZ) & MALLOC_ALIGN_MASK) == 0)
 
 #define misaligned_chunk(p) \
-  ((uintptr_t)(MALLOC_ALIGNMENT == 2 * SIZE_SZ ? (p) : chunk2mem (p)) \
+  ((uintptr_t)(MALLOC_ALIGNMENT == 2 * SIZE_SZ ? (p) : ((char *)(p)  + 2 * SIZE_SZ)) \
    & MALLOC_ALIGN_MASK)
-
-
 /*
    Check if a request is so large that it would wrap around zero when
    padded and aligned. To simplify some other code, the bound is made
@@ -1312,49 +1311,116 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 /* Get size, ignoring use bits */
 #define chunksize(p)         ((p)->size & ~(SIZE_BITS))
 
+#ifdef __CHKP__
+static void* chunk2mem (void *p) {
+  void *t = p + 2 * SIZE_SZ;
+  if (chunk_is_mmapped((mchunkptr)p))
+    return (void *) __bnd_narrow_ptr_bounds (t, t, chunksize((mchunkptr)p) - 2 * SIZE_SZ);
+  /* prev_size field of the next chunk can be used */
+  return (void *) __bnd_set_ptr_bounds(t, chunksize((mchunkptr)p) - SIZE_SZ);
+}
 
-/* Ptr to next physical malloc_chunk. */
-#define next_chunk(p) ((mchunkptr)( ((char*)(p)) + ((p)->size & ~SIZE_BITS) ))
+static mchunkptr mem2chunk(void *mem) {
+  mchunkptr temp = (mchunkptr)((char *)(mem) - 2 * SIZE_SZ);
+  temp = __bnd_set_ptr_bounds (temp, sizeof (struct malloc_chunk));
+  return  __bnd_set_ptr_bounds (temp, chunksize(temp) > sizeof(struct malloc_chunk) ?
+         chunksize(temp) : sizeof(struct malloc_chunk));
+}
+
+static mchunkptr next_chunk (mchunkptr p) {
+  mchunkptr temp = (mchunkptr)((char*) p + chunksize(p));
+  return (mchunkptr) __bnd_set_ptr_bounds ((void *) temp, sizeof(struct malloc_chunk));
+}
+
+static mchunkptr prev_chunk (mchunkptr p) {
+  mchunkptr temp = (mchunkptr)((char*) p - p->prev_size);
+  return (mchunkptr) __bnd_set_ptr_bounds ((void *) temp, sizeof(struct malloc_chunk));
+}
+
+static mchunkptr chunk_at_offset (mchunkptr p, INTERNAL_SIZE_T s) {
+  mchunkptr temp = (mchunkptr)((char*) p + s);
+  return (mchunkptr) __bnd_set_ptr_bounds ((void *) temp, sizeof(struct malloc_chunk));
+}
+
+static int inuse (mchunkptr p) {
+  return next_chunk(p)->size & PREV_INUSE;
+}
+
+static int  inuse_bit_at_offset (mchunkptr p, INTERNAL_SIZE_T s) {
+  return chunk_at_offset(p, s)->size & PREV_INUSE;
+}
+
+static void set_inuse_bit_at_offset (mchunkptr p, INTERNAL_SIZE_T s) {
+  chunk_at_offset(p, s)->size |= PREV_INUSE;
+}
+
+static void clear_inuse_bit_at_offset (mchunkptr p, INTERNAL_SIZE_T s) {
+  chunk_at_offset(p, s)->size &= ~(PREV_INUSE);
+}
+
+/* Set size at head, without disturbing its use bit */
+# define set_head_size(p, s)                                              \
+{                                                                        \
+  (p) = (__typeof(p)) __bnd_set_ptr_bounds ((void *) (p), (s) > sizeof (__typeof(p)) ? \
+        (s) : sizeof(__typeof(p)));                              \
+  (p)->size = ((p)->size & SIZE_BITS) | (s);                             \
+}
+
+/* Set size/use field */
+# define set_head(p, s)                                           \
+({                                                                 \
+  (p) = (__typeof(p)) __bnd_set_ptr_bounds ((void *) (p),          \
+       ((s) & ~(SIZE_BITS)) > sizeof (__typeof(p)) ?               \
+            ((s) & ~(SIZE_BITS)): sizeof (__typeof(p)));           \
+  (p)->size = (s);                                                 \
+})
+
+/* Set size at footer (only when chunk is not in use) */
+static void set_foot (mchunkptr p, INTERNAL_SIZE_T s) {
+   chunk_at_offset(p, s)->prev_size = s;
+}
+#else
+/* Ptr to next physicaly100y malloc_chunk. */
+# define next_chunk(p) ((mchunkptr)( ((char*)(p)) + ((p)->size & ~SIZE_BITS) ))
 
 /* Ptr to previous physical malloc_chunk */
-#define prev_chunk(p) ((mchunkptr)( ((char*)(p)) - ((p)->prev_size) ))
+# define prev_chunk(p) ((mchunkptr)( ((char*)(p)) - ((p)->prev_size) ))
 
 /* Treat space at ptr + offset as a chunk */
-#define chunk_at_offset(p, s)  ((mchunkptr)(((char*)(p)) + (s)))
+# define chunk_at_offset(p, s)  ((mchunkptr)(((char*)(p)) + (s)))
 
 /* extract p's inuse bit */
-#define inuse(p)\
+# define inuse(p)\
 ((((mchunkptr)(((char*)(p))+((p)->size & ~SIZE_BITS)))->size) & PREV_INUSE)
 
 /* set/clear chunk as being inuse without otherwise disturbing */
-#define set_inuse(p)\
+# define set_inuse(p)\
 ((mchunkptr)(((char*)(p)) + ((p)->size & ~SIZE_BITS)))->size |= PREV_INUSE
 
-#define clear_inuse(p)\
+# define clear_inuse(p)\
 ((mchunkptr)(((char*)(p)) + ((p)->size & ~SIZE_BITS)))->size &= ~(PREV_INUSE)
 
 
 /* check/set/clear inuse bits in known places */
-#define inuse_bit_at_offset(p, s)\
+# define inuse_bit_at_offset(p, s)\
  (((mchunkptr)(((char*)(p)) + (s)))->size & PREV_INUSE)
 
-#define set_inuse_bit_at_offset(p, s)\
+# define set_inuse_bit_at_offset(p, s)\
  (((mchunkptr)(((char*)(p)) + (s)))->size |= PREV_INUSE)
 
-#define clear_inuse_bit_at_offset(p, s)\
+# define clear_inuse_bit_at_offset(p, s)\
  (((mchunkptr)(((char*)(p)) + (s)))->size &= ~(PREV_INUSE))
 
 
 /* Set size at head, without disturbing its use bit */
-#define set_head_size(p, s)  ((p)->size = (((p)->size & SIZE_BITS) | (s)))
+# define set_head_size(p, s)  ((p)->size = (((p)->size & SIZE_BITS) | (s)))
 
 /* Set size/use field */
-#define set_head(p, s)       ((p)->size = (s))
+# define set_head(p, s)       ((p)->size = (s))
 
 /* Set size at footer (only when chunk is not in use) */
-#define set_foot(p, s)       (((mchunkptr)((char*)(p) + (s)))->prev_size = (s))
-
-
+# define set_foot(p, s)       (((mchunkptr)((char*)(p) + (s)))->prev_size = (s))
+#endif
 /*
   -------------------- Internal data structures --------------------
 
@@ -1945,7 +2011,7 @@ static void do_check_chunk(mstate av, mchunkptr p)
     /* chunk is page-aligned */
     assert(((p->prev_size + sz) & (GLRO(dl_pagesize)-1)) == 0);
     /* mem is aligned */
-    assert(aligned_OK(chunk2mem(p)));
+    assert(aligned_chunk_OK(p));
   }
 }
 
@@ -1968,7 +2034,7 @@ static void do_check_free_chunk(mstate av, mchunkptr p)
   if ((unsigned long)(sz) >= MINSIZE)
   {
     assert((sz & MALLOC_ALIGN_MASK) == 0);
-    assert(aligned_OK(chunk2mem(p)));
+    assert(aligned_chunk_OK(p));
     /* ... matching footer field */
     assert(next->prev_size == sz);
     /* ... and is fully consolidated */
@@ -2042,7 +2108,7 @@ static void do_check_remalloced_chunk(mstate av, mchunkptr p, INTERNAL_SIZE_T s)
   assert((sz & MALLOC_ALIGN_MASK) == 0);
   assert((unsigned long)(sz) >= MINSIZE);
   /* ... and alignment */
-  assert(aligned_OK(chunk2mem(p)));
+  assert(aligned_chunk_OK(p));
   /* chunk is less than MINSIZE more than request */
   assert((long)(sz) - (long)(s) >= 0);
   assert((long)(sz) - (long)(s + MINSIZE) < 0);
@@ -2313,16 +2379,16 @@ static void* sysmalloc(INTERNAL_SIZE_T nb, mstate av)
 	    /* For glibc, chunk2mem increases the address by 2*SIZE_SZ and
 	       MALLOC_ALIGN_MASK is 2*SIZE_SZ-1.  Each mmap'ed area is page
 	       aligned and therefore definitely MALLOC_ALIGN_MASK-aligned.  */
-	    assert (((INTERNAL_SIZE_T)chunk2mem(mm) & MALLOC_ALIGN_MASK) == 0);
+	    assert (((INTERNAL_SIZE_T)((void *)mm + 2 * SIZE_SZ) & MALLOC_ALIGN_MASK) == 0);
 	    front_misalign = 0;
 	  }
 	else
-	  front_misalign = (INTERNAL_SIZE_T)chunk2mem(mm) & MALLOC_ALIGN_MASK;
+	  front_misalign = (INTERNAL_SIZE_T)((void *)mm + 2 * SIZE_SZ) & MALLOC_ALIGN_MASK;
 	if (front_misalign > 0) {
 	  correction = MALLOC_ALIGNMENT - front_misalign;
 	  p = (mchunkptr)(mm + correction);
-	  p->prev_size = correction;
 	  set_head(p, (size - correction) |IS_MMAPPED);
+	  p->prev_size = correction;
 	}
 	else
 	  {
@@ -2349,7 +2415,11 @@ static void* sysmalloc(INTERNAL_SIZE_T nb, mstate av)
   /* Record incoming configuration of top */
 
   old_top  = av->top;
-  old_size = chunksize(old_top);
+  if (old_top == initial_top(av)) {
+		  old_size = 0;
+  } else {
+        old_size = chunksize(old_top);
+  }
   old_end  = (char*)(chunk_at_offset(old_top, old_size));
 
   brk = snd_brk = (char*)(MORECORE_FAILURE);
@@ -2399,9 +2469,9 @@ static void* sysmalloc(INTERNAL_SIZE_T nb, mstate av)
 	 become the top chunk again later.  Note that a footer is set
 	 up, too, although the chunk is marked in use. */
       old_size = (old_size - MINSIZE) & ~MALLOC_ALIGN_MASK;
-      set_head(chunk_at_offset(old_top, old_size + 2*SIZE_SZ), 0|PREV_INUSE);
+      chunk_at_offset(old_top, old_size + 2*SIZE_SZ)->size = 0|PREV_INUSE;
       if (old_size >= MINSIZE) {
-	set_head(chunk_at_offset(old_top, old_size), (2*SIZE_SZ)|PREV_INUSE);
+         chunk_at_offset(old_top, old_size)->size = (2*SIZE_SZ)|PREV_INUSE;
 	set_foot(chunk_at_offset(old_top, old_size), (2*SIZE_SZ));
 	set_head(old_top, old_size|PREV_INUSE|NON_MAIN_ARENA);
 	_int_free(av, old_top, 1);
@@ -2545,7 +2615,7 @@ static void* sysmalloc(INTERNAL_SIZE_T nb, mstate av)
 
 	/* Guarantee alignment of first new chunk made from this space */
 
-	front_misalign = (INTERNAL_SIZE_T)chunk2mem(brk) & MALLOC_ALIGN_MASK;
+	front_misalign = (INTERNAL_SIZE_T)((void *)brk + 2*SIZE_SZ) & MALLOC_ALIGN_MASK;
 	if (front_misalign > 0) {
 
 	  /*
@@ -2599,9 +2669,9 @@ static void* sysmalloc(INTERNAL_SIZE_T nb, mstate av)
       else {
 	if (MALLOC_ALIGNMENT == 2 * SIZE_SZ)
 	  /* MORECORE/mmap must correctly align */
-	  assert(((unsigned long)chunk2mem(brk) & MALLOC_ALIGN_MASK) == 0);
+	  assert(((unsigned long)((void *)brk + 2*SIZE_SZ) & MALLOC_ALIGN_MASK) == 0);
 	else {
-	  front_misalign = (INTERNAL_SIZE_T)chunk2mem(brk) & MALLOC_ALIGN_MASK;
+	  front_misalign = (INTERNAL_SIZE_T)((void *)brk + 2*SIZE_SZ) & MALLOC_ALIGN_MASK;
 	  if (front_misalign > 0) {
 
 	    /*
@@ -2676,8 +2746,12 @@ static void* sysmalloc(INTERNAL_SIZE_T nb, mstate av)
 
   /* finally, do the allocation */
   p = av->top;
-  size = chunksize(p);
-
+  if (p != initial_top(av)) {
+    size = chunksize(p);
+  }
+  else {
+    size = 0;
+  }
   /* check that one of the above allocation paths succeeded */
   if ((unsigned long)(size) >= (unsigned long)(nb + MINSIZE)) {
     remainder_size = size - nb;
@@ -2820,11 +2894,10 @@ mremap_chunk(mchunkptr p, size_t new_size)
 
   p = (mchunkptr)(cp + offset);
 
-  assert(aligned_OK(chunk2mem(p)));
-
-  assert((p->prev_size == offset));
+  assert(aligned_chunk_OK(p));
   set_head(p, (new_size - offset)|IS_MMAPPED);
 
+  assert((p->prev_size == offset));
   mp_.mmapped_mem -= size + offset;
   mp_.mmapped_mem += new_size;
   if ((unsigned long)mp_.mmapped_mem > (unsigned long)mp_.max_mmapped_mem)
@@ -2863,7 +2936,11 @@ __libc_malloc(size_t bytes)
     (void)mutex_unlock(&ar_ptr->mutex);
   assert(!victim || chunk_is_mmapped(mem2chunk(victim)) ||
 	 ar_ptr == arena_for_chunk(mem2chunk(victim)));
+#ifndef __CHKP__
   return victim;
+#else
+  return __bnd_narrow_ptr_bounds (victim, victim, bytes);
+#endif
 }
 libc_hidden_def(__libc_malloc)
 
@@ -2951,7 +3028,12 @@ __libc_realloc(void* oldmem, size_t bytes)
     if(newp) return chunk2mem(newp);
 #endif
     /* Note the extra SIZE_SZ overhead. */
-    if(oldsize - SIZE_SZ >= nb) return oldmem; /* do nothing */
+    if(oldsize - SIZE_SZ >= nb)
+#ifndef __CHKP__
+		 return oldmem; /* do nothing */
+#else
+		 return __bnd_narrow_ptr_bounds(oldmem, oldmem, bytes); /* do nothing */
+#endif
     /* Must alloc, copy, free. */
     newmem = __libc_malloc(bytes);
     if (newmem == 0) return 0; /* propagate failure */
@@ -2993,8 +3075,11 @@ __libc_realloc(void* oldmem, size_t bytes)
 	  _int_free(ar_ptr, oldp, 0);
 	}
     }
-
+#ifndef __CHKP__
   return newp;
+#else
+  return __bnd_narrow_ptr_bounds(newp, newp, bytes);
+#endif
 }
 libc_hidden_def (__libc_realloc)
 
@@ -3029,7 +3114,11 @@ __libc_memalign(size_t alignment, size_t bytes)
     (void)mutex_unlock(&ar_ptr->mutex);
   assert(!p || chunk_is_mmapped(mem2chunk(p)) ||
 	 ar_ptr == arena_for_chunk(mem2chunk(p)));
+#ifndef __CHKP__
   return p;
+#else
+  return __bnd_narrow_ptr_bounds(p, p, bytes);
+#endif
 }
 /* For ISO C11.  */
 weak_alias (__libc_memalign, aligned_alloc)
@@ -3065,8 +3154,11 @@ __libc_valloc(size_t bytes)
     (void)mutex_unlock (&ar_ptr->mutex);
   assert(!p || chunk_is_mmapped(mem2chunk(p)) ||
 	 ar_ptr == arena_for_chunk(mem2chunk(p)));
-
+#ifndef __CHKP__
   return p;
+#else
+  return __bnd_narrow_ptr_bounds(p, p, bytes);
+#endif
 }
 
 void*
@@ -3100,7 +3192,11 @@ __libc_pvalloc(size_t bytes)
   assert(!p || chunk_is_mmapped(mem2chunk(p)) ||
 	 ar_ptr == arena_for_chunk(mem2chunk(p)));
 
+#ifndef __CHKP__
   return p;
+#else
+  return __bnd_narrow_ptr_bounds(p, p, bytes);
+#endif
 }
 
 void*
@@ -3132,6 +3228,9 @@ __libc_calloc(size_t n, size_t elem_size)
     mem = (*hook)(sz, RETURN_ADDRESS (0));
     if(mem == 0)
       return 0;
+#ifdef __CHKP__
+    mem = __bnd_narrow_ptr_bounds(mem, mem, sz);
+#endif
     return memset(mem, 0, sz);
   }
 
@@ -3145,7 +3244,12 @@ __libc_calloc(size_t n, size_t elem_size)
      need to clear. */
 #if MORECORE_CLEARS
   oldtop = top(av);
-  oldtopsize = chunksize(top(av));
+  if (oldtop == initial_top(av))
+  {
+	  oldtopsize = 0;
+  } else {
+     oldtopsize = chunksize(top(av));
+  }
 #if MORECORE_CLEARS < 2
   /* Only newly allocated memory is guaranteed to be cleared.  */
   if (av == &main_arena &&
@@ -3179,6 +3283,9 @@ __libc_calloc(size_t n, size_t elem_size)
   /* Two optional cases in which clearing not necessary */
   if (chunk_is_mmapped (p))
     {
+#ifdef __CHKP__
+      mem =  __bnd_narrow_ptr_bounds(mem, mem, sz);
+#endif
       if (__builtin_expect (perturb_byte, 0))
 	MALLOC_ZERO (mem, sz);
       return mem;
@@ -3221,8 +3328,11 @@ __libc_calloc(size_t n, size_t elem_size)
       }
     }
   }
-
+#ifndef __CHKP__
   return mem;
+#else
+  return __bnd_narrow_ptr_bounds(mem, mem, sz);
+#endif
 }
 
 /*
@@ -3676,7 +3786,11 @@ _int_malloc(mstate av, size_t bytes)
     */
 
     victim = av->top;
-    size = chunksize(victim);
+    if (victim == initial_top(av)) {
+       size = 0;
+    } else {
+       size = chunksize(victim);
+    }
 
     if ((unsigned long)(size) >= (unsigned long)(nb + MINSIZE)) {
       remainder_size = size - nb;
@@ -4051,6 +4165,9 @@ static void malloc_consolidate(mstate av)
       p = atomic_exchange_acq (fb, 0);
       if (p != 0) {
 	do {
+#ifdef __CHKP__
+	  p = __bnd_set_ptr_bounds(p, sizeof (struct malloc_chunk));
+#endif
 	  check_inuse_chunk(av, p);
 	  nextp = p->fd;
 
@@ -4336,8 +4453,8 @@ _int_memalign(mstate av, size_t alignment, size_t bytes)
 
     /* For mmapped chunks, just adjust offset */
     if (chunk_is_mmapped(p)) {
-      newp->prev_size = p->prev_size + leadsize;
       set_head(newp, newsize|IS_MMAPPED);
+      newp->prev_size = p->prev_size + leadsize;
       return chunk2mem(newp);
     }
 
@@ -4350,7 +4467,7 @@ _int_memalign(mstate av, size_t alignment, size_t bytes)
     p = newp;
 
     assert (newsize >= nb &&
-	    (((unsigned long)(chunk2mem(p))) % alignment) == 0);
+	    (((unsigned long)((char *)p + 2 * SIZE_SZ) % alignment) == 0));
   }
 
   /* Also give back spare room at the end */
@@ -4430,7 +4547,7 @@ static int mtrim(mstate av, size_t pad)
 						+ sizeof (struct malloc_chunk)
 						+ psm1) & ~psm1);
 
-		assert ((char *) chunk2mem (p) + 4 * SIZE_SZ <= paligned_mem);
+      assert ((char *) (p) + 6 * SIZE_SZ <= paligned_mem);
 		assert ((char *) p + size > paligned_mem);
 
 		/* This is the size we could potentially free.  */
@@ -4932,7 +5049,6 @@ __posix_memalign (void **memptr, size_t alignment, size_t size)
 }
 weak_alias (__posix_memalign, posix_memalign)
 
-
 int
 malloc_info (int options, FILE *fp)
 {
@@ -5121,7 +5237,6 @@ malloc_info (int options, FILE *fp)
   return 0;
 }
 
-
 strong_alias (__libc_calloc, __calloc) weak_alias (__libc_calloc, calloc)
 strong_alias (__libc_free, __cfree) weak_alias (__libc_free, cfree)
 strong_alias (__libc_free, __free) strong_alias (__libc_free, free)

malloc/obstack.h

@@ -143,7 +143,7 @@ struct _obstack_chunk		/* Lives at front of each chunk. */
 {
   char  *limit;			/* 1 past end of this chunk */
   struct _obstack_chunk *prev;	/* address of prior chunk or NULL */
-  char	contents[4];		/* objects begin here */
+  char	contents[4] __attribute__((bnd_variable_size));		/* objects begin here */
 };
 
 struct obstack		/* control current object in current chunk */

manual/install.texi

@@ -177,6 +177,12 @@ setuid and owned by @code{root}.  The use of @file{pt_chown} introduces
 additional security risks to the system and you should enable it only if
 you understand and accept those risks.
 
+@item --enable-mpx
+By default, Intel MPX extension is disabled. This option turns it on.
+@item --enable-mpx-write-only
+By default, Intel MPX extension is disabled. This option turns it on for
+write only checks.
+
 @item --build=@var{build-system}
 @itemx --host=@var{host-system}
 These options are for cross-compiling.  If you specify both options and

misc/search.h

@@ -35,7 +35,7 @@ struct qelem
   {
     struct qelem *q_forw;
     struct qelem *q_back;
-    char q_data[1];
+    char q_data[1] __attribute__((bnd_variable_size));
   };
 # endif
 

nptl/descr.h

@@ -162,7 +162,7 @@ struct pthread
   };
 
   /* This descriptor's link on the `stack_used' or `__stack_user' list.  */
-  list_t list;
+  list_t list __attribute__((bnd_variable_size));
 
   /* Thread ID - which is also a 'is this thread descriptor (and
      therefore stack) used' flag.  */
@@ -174,7 +174,10 @@ struct pthread
   /* List of robust mutexes the thread is holding.  */
 #ifdef __PTHREAD_MUTEX_HAVE_PREV
   void *robust_prev;
-  struct robust_list_head robust_head;
+  struct robust_list_head robust_head __attribute__((bnd_variable_size));
+  /* sometimes we want to cast pair {robust_prev (void *) and the
+   * first field of struct robust_list_head (void *)}
+   * to __pthread_list_t (struct consists of two pointers: __prev, __next) */
 
   /* The list above is strange.  It is basically a double linked list
      but the pointer to the next/previous element of the list points
@@ -186,7 +189,7 @@ struct pthread
 # define ENQUEUE_MUTEX_BOTH(mutex, val)					      \
   do {									      \
     __pthread_list_t *next = (__pthread_list_t *)			      \
-      ((((uintptr_t) THREAD_GETMEM (THREAD_SELF, robust_head.list)) & ~1ul)   \
+      ((char *)(((uintptr_t) THREAD_GETMEM (THREAD_SELF, robust_head.list)) & ~1ul)   \
        - QUEUE_PTR_ADJUST);						      \
     next->__prev = (void *) &mutex->__data.__list.__next;		      \
     mutex->__data.__list.__next = THREAD_GETMEM (THREAD_SELF,		      \

nptl/sysdeps/i386/tls.h

@@ -259,11 +259,24 @@ union user_desc_init
    assignments like
 	pthread_descr self = thread_self();
    do not get optimized away.  */
-# define THREAD_SELF \
+
+# ifndef __CHKP__
+#  define THREAD_SELF \
   ({ struct pthread *__self;						      \
      asm ("movl %%gs:%c1,%0" : "=r" (__self)				      \
 	  : "i" (offsetof (struct pthread, header.self)));		      \
      __self;})
+# else
+#  define THREAD_SELF \
+  ({ struct pthread *__self;						      \
+     asm ("movl %%gs:%c1,%0" : "=r" (__self)				      \
+	  : "i" (offsetof (struct pthread, header.self)));	 	      \
+    /* Set first minimum bounds to make possible reading stackblock and stackblock_size. */ \
+	  __self = __bnd_set_ptr_bounds(__self, TLS_INIT_TCB_SIZE);	 	      \
+    /* Set actual correct bounds. */ \
+     (struct pthread*) __bnd_copy_ptr_bounds(__self, __bnd_set_ptr_bounds(__self->stackblock, \
+      __self->stackblock_size)); })
+# endif
 
 /* Magic for libthread_db to know how to do THREAD_SELF.  */
 # define DB_THREAD_SELF \
@@ -272,7 +285,8 @@ union user_desc_init
 
 
 /* Read member of the thread descriptor directly.  */
-# define THREAD_GETMEM(descr, member) \
+# ifndef __CHKP__
+#  define THREAD_GETMEM(descr, member) \
   ({ __typeof (descr->member) __value;					      \
      if (sizeof (__value) == 1)						      \
        asm volatile ("movb %%gs:%P2,%b0"				      \
@@ -296,10 +310,15 @@ union user_desc_init
 			 "i" (offsetof (struct pthread, member) + 4));	      \
        }								      \
      __value; })
-
+# else
+#  define THREAD_GETMEM(descr, member) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member; })
+# endif
 
 /* Same as THREAD_GETMEM, but the member offset can be non-constant.  */
-# define THREAD_GETMEM_NC(descr, member, idx) \
+# ifndef __CHKP__
+#  define THREAD_GETMEM_NC(descr, member, idx) \
   ({ __typeof (descr->member[0]) __value;				      \
      if (sizeof (__value) == 1)						      \
        asm volatile ("movb %%gs:%P2(%3),%b0"				      \
@@ -325,10 +344,15 @@ union user_desc_init
 			  "r" (idx));					      \
        }								      \
      __value; })
-
+# else
+#  define THREAD_GETMEM_NC(descr, member, idx) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member[idx]; })
+# endif
 
 /* Same as THREAD_SETMEM, but the member offset can be non-constant.  */
-# define THREAD_SETMEM(descr, member, value) \
+# ifndef __CHKP__
+#  define THREAD_SETMEM(descr, member, value) \
   ({ if (sizeof (descr->member) == 1)					      \
        asm volatile ("movb %b0,%%gs:%P1" :				      \
 		     : "iq" (value),					      \
@@ -350,10 +374,15 @@ union user_desc_init
 			 "i" (offsetof (struct pthread, member)),	      \
 			 "i" (offsetof (struct pthread, member) + 4));	      \
        }})
-
+# else
+#  define THREAD_SETMEM(descr, member, value) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member = value; })
+#endif
 
 /* Set member of the thread descriptor directly.  */
-# define THREAD_SETMEM_NC(descr, member, idx, value) \
+# ifndef __CHKP__
+#  define THREAD_SETMEM_NC(descr, member, idx, value) \
   ({ if (sizeof (descr->member[0]) == 1)				      \
        asm volatile ("movb %b0,%%gs:%P1(%2)" :				      \
 		     : "iq" (value),					      \
@@ -377,7 +406,11 @@ union user_desc_init
 			 "i" (offsetof (struct pthread, member)),	      \
 			 "r" (idx));					      \
        }})
-
+# else
+#  define THREAD_SETMEM_NC(descr, member, idx, value) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member[idx] = value; })
+# endif
 
 /* Atomic compare and exchange on TLS, returning old value.  */
 #define THREAD_ATOMIC_CMPXCHG_VAL(descr, member, newval, oldval) \
@@ -417,7 +450,8 @@ union user_desc_init
 
 
 /* Call the user-provided thread function.  */
-#define CALL_THREAD_FCT(descr) \
+#ifndef __CHKP__
+# define CALL_THREAD_FCT(descr) \
   ({ void *__res;							      \
      int __ignore1, __ignore2;						      \
      asm volatile ("pushl %%eax\n\t"					      \
@@ -430,7 +464,11 @@ union user_desc_init
 		   : "i" (offsetof (struct pthread, start_routine)),	      \
 		     "i" (offsetof (struct pthread, arg)));		      \
      __res; })
-
+# else
+#  define CALL_THREAD_FCT(descr) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->start_routine(__self->arg); })
+# endif
 
 /* Set the stack guard field in TCB head.  */
 #define THREAD_SET_STACK_GUARD(value) \

nptl/sysdeps/pthread/gai_misc.h

@@ -82,6 +82,9 @@ __gai_start_notify_thread (void)
   sigset_t ss;
   sigemptyset (&ss);
   INTERNAL_SYSCALL_DECL (err);
+#ifdef __CHKP__
+  __sigdelset(&ss, SIGSEGV);
+#endif
   INTERNAL_SYSCALL (rt_sigprocmask, err, 4, SIG_SETMASK, &ss, NULL, _NSIG / 8);
 }
 
@@ -106,6 +109,9 @@ __gai_create_helper_thread (pthread_t *threadp, void *(*tf) (void *),
   sigset_t oss;
   sigfillset (&ss);
   INTERNAL_SYSCALL_DECL (err);
+#ifdef __CHKP__
+  __sigdelset(&ss, SIGSEGV);
+#endif
   INTERNAL_SYSCALL (rt_sigprocmask, err, 4, SIG_SETMASK, &ss, &oss, _NSIG / 8);
 
   int ret = pthread_create (threadp, &attr, tf, arg);

nptl/sysdeps/unix/sysv/linux/aio_misc.h

@@ -32,6 +32,9 @@ __aio_start_notify_thread (void)
   sigset_t ss;
   sigemptyset (&ss);
   INTERNAL_SYSCALL_DECL (err);
+#ifdef __CHKP__
+  __sigdelset(&ss, SIGSEGV);
+#endif
   INTERNAL_SYSCALL (rt_sigprocmask, err, 4, SIG_SETMASK, &ss, NULL, _NSIG / 8);
 }
 
@@ -54,6 +57,9 @@ __aio_create_helper_thread (pthread_t *threadp, void *(*tf) (void *),
   sigset_t oss;
   sigfillset (&ss);
   INTERNAL_SYSCALL_DECL (err);
+#ifdef __CHKP__
+  __sigdelset(&ss, SIGSEGV);
+#endif
   INTERNAL_SYSCALL (rt_sigprocmask, err, 4, SIG_SETMASK, &ss, &oss, _NSIG / 8);
 
   int ret = pthread_create (threadp, &attr, tf, arg);

nptl/sysdeps/unix/sysv/linux/i386/i486/pthread_cond_timedwait.S

@@ -94,6 +94,13 @@ __pthread_cond_timedwait:
 	je	.Lreltmo
 #endif
 
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	(%esp,%ebx,1), %bnd0
+	bndldx	28(%esp,%ebp,1), %bnd2
+	bndmov	%bnd0, 48(%esp)
+	bndmov	%bnd2, 80(%esp)
+#endif
+
 	/* Get internal lock.  */
 	movl	$1, %edx
 	xorl	%eax, %eax
@@ -109,12 +116,24 @@ __pthread_cond_timedwait:
 	   different value in there this is a bad user bug.  */
 2:	cmpl	$-1, dep_mutex(%ebx)
 	movl	24(%esp), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	4(%esp,%eax,1), %bnd1
+	bndmov	%bnd1, 64(%esp)
+#endif
 	je	17f
 	movl	%eax, dep_mutex(%ebx)
 
 	/* Unlock the mutex.  */
 17:	xorl	%edx, %edx
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 
 	testl	%eax, %eax
 	jne	16f
@@ -296,9 +315,25 @@ __pthread_cond_timedwait:
 	   should always succeed or else the kernel did not lock the mutex
 	   correctly.  */
 	movl	dep_mutex(%ebx), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 	xorl	%edx, %edx
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 	jmp	8b
 
 28:	addl	$1, wakeup_seq(%ebx)
@@ -356,8 +391,15 @@ __pthread_cond_timedwait:
 	movl	16(%esp), %ecx
 	testl	%ecx, %ecx
 	jnz	27f
-
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_cond_lock
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 26:	addl	$FRAME_SIZE, %esp
 	cfi_adjust_cfa_offset(-FRAME_SIZE)
 
@@ -388,7 +430,16 @@ __pthread_cond_timedwait:
 
 	cfi_restore_state
 
-27:	call	__pthread_mutex_cond_lock_adjust
+27:
+#if defined __CHKP__ || defined __CHKWR__
+        bndmov %bnd1, %bnd0
+#endif
+	call	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 	xorl	%eax, %eax
 	jmp	26b
 
@@ -529,7 +580,15 @@ __pthread_cond_timedwait:
 
 	/* Unlock the mutex.  */
 117:	xorl	%edx, %edx
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 
 	testl	%eax, %eax
 	jne	16b
@@ -899,10 +958,27 @@ __condvar_tw_cleanup:
 	cmpl	%ebx, %gs:TID
 	jne	8f
 	/* We managed to get the lock.  Fix it up before returning.  */
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 	jmp	9f
 
-8:	call	__pthread_mutex_cond_lock
+8:
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
+	call	__pthread_mutex_cond_lock
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 48(%esp), %bnd0
+	bndmov 64(%esp), %bnd1
+	bndmov 80(%esp), %bnd2
+#endif
 
 9:	movl	%esi, (%esp)
 .LcallUR:

nptl/sysdeps/unix/sysv/linux/i386/i486/pthread_cond_wait.S

@@ -60,6 +60,10 @@ __pthread_cond_wait:
 
 	xorl	%esi, %esi
 	movl	20(%esp), %ebx
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	(%esp,%ebx,1), %bnd0
+	bndmov	%bnd0, 32(%esp)
+#endif
 
 	LIBC_PROBE (cond_wait, 2, 24(%esp), %ebx)
 
@@ -78,12 +82,23 @@ __pthread_cond_wait:
 	   different value in there this is a bad user bug.  */
 2:	cmpl	$-1, dep_mutex(%ebx)
 	movl	24(%esp), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	4(%esp,%eax,1), %bnd1
+	bndmov	%bnd1, 48(%esp)
+#endif
 	je	15f
 	movl	%eax, dep_mutex(%ebx)
 
 	/* Unlock the mutex.  */
 15:	xorl	%edx, %edx
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 
 	testl	%eax, %eax
 	jne	12f
@@ -270,7 +285,14 @@ __pthread_cond_wait:
 	testl	%ecx, %ecx
 	jnz	21f
 
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_cond_lock
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 20:	addl	$FRAME_SIZE, %esp
 	cfi_adjust_cfa_offset(-FRAME_SIZE);
 
@@ -292,7 +314,15 @@ __pthread_cond_wait:
 
 	cfi_restore_state
 
-21:	call	__pthread_mutex_cond_lock_adjust
+21:
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
+	call	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 	xorl	%eax, %eax
 	jmp	20b
 
@@ -308,9 +338,23 @@ __pthread_cond_wait:
 	   should always succeed or else the kernel did not lock the mutex
 	   correctly.  */
 	movl	dep_mutex(%ebx), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call    __pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 	xorl	%edx, %edx
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 	jmp	8b
 
 	/* Initial locking failed.  */
@@ -581,10 +625,25 @@ __condvar_w_cleanup:
 	cmpl	%ebx, %gs:TID
 	jne	8f
 	/* We managed to get the lock.  Fix it up before returning.  */
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	call	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 	jmp	9f
 
-8:	call	__pthread_mutex_cond_lock
+8:
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
+	call	__pthread_mutex_cond_lock
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%esp), %bnd0
+	bndmov 48(%esp), %bnd1
+#endif
 
 9:	movl	%esi, (%esp)
 .LcallUR:

nptl/sysdeps/unix/sysv/linux/i386/pthread_once.S

@@ -114,6 +114,9 @@ __pthread_once:
 	jne	7f
 
 	leal	8(%esp), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	8(%esp,%eax,1), %bnd0
+#endif
 	call	HIDDEN_JUMPTARGET(__pthread_register_cancel)
 
 	/* Call the user-provided initialization function.  */
@@ -121,6 +124,9 @@ __pthread_once:
 
 	/* Pop the cleanup handler.  */
 	leal	8(%esp), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	8(%esp,%eax,1), %bnd0
+#endif
 	call	HIDDEN_JUMPTARGET(__pthread_unregister_cancel)
 	addl	$UNWINDBUFSIZE+8, %esp
 	cfi_adjust_cfa_offset (-UNWINDBUFSIZE-8)
@@ -168,6 +174,9 @@ __pthread_once:
 	ENTER_KERNEL
 
 	leal	8(%esp), %eax
+#if defined __CHKP__ || defined __CHKWR__
+	bndldx	8(%esp,%eax,1), %bnd0
+#endif
 	call	HIDDEN_JUMPTARGET (__pthread_unwind_next)
 	/* NOTREACHED */
 	hlt

nptl/sysdeps/unix/sysv/linux/mq_notify.c

@@ -78,6 +78,9 @@ change_sigmask (int how, sigset_t *oss)
 {
   sigset_t ss;
   sigfillset (&ss);
+#ifdef __CHKP__
+  sigdelset (&ss, SIGSEGV);
+#endif
   return pthread_sigmask (how, &ss, oss);
 }
 

nptl/sysdeps/unix/sysv/linux/timer_routines.c

@@ -174,6 +174,9 @@ __start_helper_thread (void)
   sigset_t oss;
   sigfillset (&ss);
   __sigaddset (&ss, SIGCANCEL);
+#ifdef __CHKP__
+  __sigdelset (&ss, SIGSEGV);
+#endif
   INTERNAL_SYSCALL_DECL (err);
   INTERNAL_SYSCALL (rt_sigprocmask, err, 4, SIG_SETMASK, &ss, &oss, _NSIG / 8);
 

nptl/sysdeps/unix/sysv/linux/x86/bits/pthreadtypes.h

@@ -75,7 +75,7 @@ typedef union pthread_attr_t pthread_attr_t;
 typedef struct __pthread_internal_list
 {
   struct __pthread_internal_list *__prev;
-  struct __pthread_internal_list *__next;
+  struct __pthread_internal_list *__next __attribute__((bnd_variable_size));
 } __pthread_list_t;
 #else
 typedef struct __pthread_internal_slist

nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S

@@ -99,6 +99,12 @@ __pthread_cond_timedwait:
 	movq	%rsi, 16(%rsp)
 	movq	%rdx, %r13
 
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd0, 72(%rsp)
+	bndmov %bnd1, 88(%rsp)
+	bndmov %bnd2, 104(%rsp)
+#endif
+
 	je	22f
 	mov	%RSI_LP, dep_mutex(%rdi)
 
@@ -128,7 +134,15 @@ __pthread_cond_timedwait:
 	/* Unlock the mutex.  */
 32:	movq	16(%rsp), %rdi
 	xorl	%esi, %esi
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 72(%rsp), %bnd0
+	bndmov 88(%rsp), %bnd1
+	bndmov 104(%rsp), %bnd2
+#endif
 
 	testl	%eax, %eax
 	jne	46f
@@ -338,7 +352,15 @@ __pthread_cond_timedwait:
 	testb	%r15b, %r15b
 	jnz	64f
 
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_cond_lock
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 72(%rsp), %bnd0
+	bndmov 88(%rsp), %bnd1
+	bndmov 104(%rsp), %bnd2
+#endif
 
 63:	testq	%rax, %rax
 	cmoveq	%r14, %rax
@@ -362,7 +384,16 @@ __pthread_cond_timedwait:
 
 	cfi_restore_state
 
-64:	callq	__pthread_mutex_cond_lock_adjust
+64:
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
+	callq	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 72(%rsp), %bnd0
+	bndmov 88(%rsp), %bnd1
+	bndmov 104(%rsp), %bnd2
+#endif
 	movq	%r14, %rax
 	jmp	48b
 
@@ -457,7 +488,15 @@ __pthread_cond_timedwait:
 	/* Unlock the mutex.  */
 2:	movq	16(%rsp), %rdi
 	xorl	%esi, %esi
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 72(%rsp), %bnd0
+	bndmov 88(%rsp), %bnd1
+	bndmov 104(%rsp), %bnd2
+#endif
 
 	testl	%eax, %eax
 	jne	46b
@@ -786,7 +825,15 @@ __condvar_cleanup2:
 	cmpl	%eax, %fs:TID
 	jne	7f
 	/* We managed to get the lock.  Fix it up before returning.  */
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 72(%rsp), %bnd0
+	bndmov 88(%rsp), %bnd1
+	bndmov 104(%rsp), %bnd2
+#endif
 	jmp	8f
 
 7:	callq	__pthread_mutex_cond_lock

nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S

@@ -74,6 +74,11 @@ __pthread_cond_wait:
 	movq	%rdi, 8(%rsp)
 	movq	%rsi, 16(%rsp)
 
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd0, 32(%rsp)
+	bndmov %bnd1, 48(%rsp)
+#endif
+
 	je	15f
 	mov	%RSI_LP, dep_mutex(%rdi)
 
@@ -91,7 +96,14 @@ __pthread_cond_wait:
 	/* Unlock the mutex.  */
 2:	movq	16(%rsp), %rdi
 	xorl	%esi, %esi
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_unlock_usercnt
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%rsp), %bnd0
+	bndmov 48(%rsp), %bnd1
+#endif
 
 	testl	%eax, %eax
 	jne	12f
@@ -256,7 +268,14 @@ __pthread_cond_wait:
 	testb	%r8b, %r8b
 	jnz	18f
 
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_cond_lock
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%rsp), %bnd0
+	bndmov 48(%rsp), %bnd1
+#endif
 
 14:	leaq	FRAME_SIZE(%rsp), %rsp
 	cfi_adjust_cfa_offset(-FRAME_SIZE)
@@ -266,7 +285,15 @@ __pthread_cond_wait:
 
 	cfi_adjust_cfa_offset(FRAME_SIZE)
 
-18:	callq	__pthread_mutex_cond_lock_adjust
+18:
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
+	callq	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%rsp), %bnd0
+	bndmov 48(%rsp), %bnd1
+#endif
 	xorl	%eax, %eax
 	jmp	14b
 
@@ -510,10 +537,16 @@ __condvar_cleanup1:
 	cmpl	%eax, %fs:TID
 	jne	7f
 	/* We managed to get the lock.  Fix it up before returning.  */
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov %bnd1, %bnd0
+#endif
 	callq	__pthread_mutex_cond_lock_adjust
+#if defined __CHKP__ || defined __CHKWR__
+	bndmov 32(%rsp), %bnd0
+	bndmov 48(%rsp), %bnd1
+#endif
 	jmp	8f
 
-
 7:	callq	__pthread_mutex_cond_lock
 
 8:	movq	24(%rsp), %rdi

nptl/sysdeps/x86_64/tls.h

@@ -89,6 +89,7 @@ typedef struct
 
 
 #ifndef __ASSEMBLER__
+
 /* Get system call information.  */
 # include <sysdep.h>
 
@@ -166,10 +167,15 @@ typedef struct
 
 
 /* Return the address of the dtv for the current thread.  */
-# define THREAD_DTV() \
+# ifndef __CHKP__
+#  define THREAD_DTV() \
   ({ struct pthread *__pd;						      \
      THREAD_GETMEM (__pd, header.dtv); })
-
+# else
+#  define THREAD_DTV() \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      GET_DTV(__self); })
+# endif
 
 /* Return the thread descriptor for the current thread.
 
@@ -177,18 +183,31 @@ typedef struct
    assignments like
 	pthread_descr self = thread_self();
    do not get optimized away.  */
-# define THREAD_SELF \
+# ifndef __CHKP__
+#  define THREAD_SELF \
   ({ struct pthread *__self;						      \
      asm ("mov %%fs:%c1,%0" : "=r" (__self)				      \
 	  : "i" (offsetof (struct pthread, header.self)));	 	      \
-     __self;})
+     __self; })
+# else
+#  define THREAD_SELF \
+  ({ struct pthread *__self;						      \
+     asm ("mov %%fs:%c1,%0" : "=r" (__self)				      \
+	  : "i" (offsetof (struct pthread, header.self)));	 	      \
+    /* Set first minimum bounds to make possible reading stackblock and stackblock_size. */ \
+	  __self = __bnd_set_ptr_bounds(__self, TLS_INIT_TCB_SIZE);	 	      \
+    /* Set actual correct bounds. */ \
+     (struct pthread*) __bnd_copy_ptr_bounds(__self, __bnd_set_ptr_bounds(__self->stackblock, \
+      __self->stackblock_size)); })
+# endif
 
 /* Magic for libthread_db to know how to do THREAD_SELF.  */
 # define DB_THREAD_SELF_INCLUDE  <sys/reg.h> /* For the FS constant.  */
 # define DB_THREAD_SELF CONST_THREAD_AREA (64, FS)
 
 /* Read member of the thread descriptor directly.  */
-# define THREAD_GETMEM(descr, member) \
+# ifndef __CHKP__
+#  define THREAD_GETMEM(descr, member) \
   ({ __typeof (descr->member) __value;					      \
      if (sizeof (__value) == 1)						      \
        asm volatile ("movb %%fs:%P2,%b0"				      \
@@ -202,7 +221,7 @@ typedef struct
        {								      \
 	 if (sizeof (__value) != 8)					      \
 	   /* There should not be any value with a size other than 1,	      \
-	      4 or 8.  */						      \
+	      4 or 8.  */ 						      \
 	   abort ();							      \
 									      \
 	 asm volatile ("movq %%fs:%P1,%q0"				      \
@@ -210,10 +229,15 @@ typedef struct
 		       : "i" (offsetof (struct pthread, member)));	      \
        }								      \
      __value; })
-
+# else
+#  define THREAD_GETMEM(descr, member) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member; })
+# endif
 
 /* Same as THREAD_GETMEM, but the member offset can be non-constant.  */
-# define THREAD_GETMEM_NC(descr, member, idx) \
+# ifndef __CHKP__
+#  define THREAD_GETMEM_NC(descr, member, idx) \
   ({ __typeof (descr->member[0]) __value;				      \
      if (sizeof (__value) == 1)						      \
        asm volatile ("movb %%fs:%P2(%q3),%b0"				      \
@@ -228,7 +252,7 @@ typedef struct
        {								      \
 	 if (sizeof (__value) != 8)					      \
 	   /* There should not be any value with a size other than 1,	      \
-	      4 or 8.  */						      \
+	      4 or 8.  */  						      \
 	   abort ();							      \
 									      \
 	 asm volatile ("movq %%fs:%P1(,%q2,8),%q0"			      \
@@ -237,7 +261,11 @@ typedef struct
 			 "r" (idx));					      \
        }								      \
      __value; })
-
+# else
+#  define THREAD_GETMEM_NC(descr, member, idx) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member[idx]; })
+# endif
 
 /* Loading addresses of objects on x86-64 needs to be treated special
    when generating PIC code.  */
@@ -249,7 +277,8 @@ typedef struct
 
 
 /* Same as THREAD_SETMEM, but the member offset can be non-constant.  */
-# define THREAD_SETMEM(descr, member, value) \
+# ifndef __CHKP__
+#  define THREAD_SETMEM(descr, member, value) \
   ({ if (sizeof (descr->member) == 1)					      \
        asm volatile ("movb %b0,%%fs:%P1" :				      \
 		     : "iq" (value),					      \
@@ -262,17 +291,22 @@ typedef struct
        {								      \
 	 if (sizeof (descr->member) != 8)				      \
 	   /* There should not be any value with a size other than 1,	      \
-	      4 or 8.  */						      \
+	      4 or 8.	*/					      \
 	   abort ();							      \
 									      \
 	 asm volatile ("movq %q0,%%fs:%P1" :				      \
 		       : IMM_MODE ((uint64_t) cast_to_integer (value)),	      \
 			 "i" (offsetof (struct pthread, member)));	      \
        }})
-
+# else
+#  define THREAD_SETMEM(descr, member, value) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member = value; })
+# endif
 
 /* Set member of the thread descriptor directly.  */
-# define THREAD_SETMEM_NC(descr, member, idx, value) \
+# ifndef __CHKP__
+#  define THREAD_SETMEM_NC(descr, member, idx, value) \
   ({ if (sizeof (descr->member[0]) == 1)				      \
        asm volatile ("movb %b0,%%fs:%P1(%q2)" :				      \
 		     : "iq" (value),					      \
@@ -287,7 +321,7 @@ typedef struct
        {								      \
 	 if (sizeof (descr->member[0]) != 8)				      \
 	   /* There should not be any value with a size other than 1,	      \
-	      4 or 8.  */						      \
+	      4 or 8.	*/				      \
 	   abort ();							      \
 									      \
 	 asm volatile ("movq %q0,%%fs:%P1(,%q2,8)" :			      \
@@ -295,7 +329,11 @@ typedef struct
 			 "i" (offsetof (struct pthread, member[0])),	      \
 			 "r" (idx));					      \
        }})
-
+# else
+#  define THREAD_SETMEM_NC(descr, member, idx, value) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->member[idx] = value; })
+# endif
 
 /* Atomic compare and exchange on TLS, returning old value.  */
 # define THREAD_ATOMIC_CMPXCHG_VAL(descr, member, newval, oldval) \
@@ -333,8 +371,8 @@ typedef struct
 	      /* Not necessary for other sizes in the moment.  */	      \
 	      abort (); })
 
-
-# define CALL_THREAD_FCT(descr) \
+# ifndef __CHKP__
+#  define CALL_THREAD_FCT(descr) \
   ({ void *__res;							      \
      asm volatile ("movq %%fs:%P2, %%rdi\n\t"				      \
 		   "callq *%%fs:%P1"					      \
@@ -344,7 +382,11 @@ typedef struct
 		   : "di", "si", "cx", "dx", "r8", "r9", "r10", "r11",	      \
 		     "memory", "cc");					      \
      __res; })
-
+# else
+#  define CALL_THREAD_FCT(descr) \
+   ({ struct pthread *__self = THREAD_SELF;  \
+      __self->start_routine(__self->arg); })
+# endif
 
 /* Set the stack guard field in TCB head.  */
 # define THREAD_SET_STACK_GUARD(value) \

nptl/tst-cancel7.c

@@ -65,6 +65,9 @@ sl (void)
 
   sigset_t ss;
   sigfillset (&ss);
+#ifdef __CHKP__
+  sigdelset (&ss, SIGSEGV);
+#endif
   sigsuspend (&ss);
   exit (0);
 }

nptl/tst-signal1.c

@@ -68,6 +68,9 @@ receiver (void)
 
   sigfillset (&ss);
 
+#ifdef __CHKP__
+  sigdelset(&ss, SIGSEGV);
+#endif
   if (pthread_sigmask (SIG_SETMASK, &ss, NULL) != 0)
     {
       puts ("1st pthread_sigmask failed");

nptl/tst-signal2.c

@@ -71,6 +71,9 @@ receiver (void)
   alarm (10);
 
   sigfillset (&ss);
+#ifdef __CHKP__
+  sigdelset(&ss, SIGSEGV);
+#endif
 
   if (pthread_sigmask (SIG_SETMASK, &ss, NULL) != 0)
     {

nptl/tst-signal3.c

@@ -96,6 +96,9 @@ do_test (void)
   /* Block all signals.  */
   sigset_t ss;
   sigfillset (&ss);
+#ifdef __CHKP__
+  sigdelset(&ss, SIGSEGV);
+#endif
 
   th_main = pthread_self ();
 
@@ -118,6 +121,9 @@ do_test (void)
 	};
       sigfillset (&sa.sa_mask);
 
+#ifdef __CHKP__
+       sigdelset(&ss, SIGSEGV);
+#endif
       if (sigaction (sig0 + i, &sa, NULL) != 0)
 	{
 	  printf ("sigaction for signal %d failed\n", i);

posix/fnmatch_loop.c

@@ -313,7 +313,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 		      /* Invalid character class name.  */
 		      return FNM_NOMATCH;
 
-# if defined _LIBC && ! WIDE_CHAR_VERSION
+# if defined _LIBC && ! WIDE_CHAR_VERSION && !defined __CHKP__
 		    /* The following code is glibc specific but does
 		       there a good job in speeding up the code since
 		       we can avoid the btowc() call.  */

stdio-common/psiginfo-define.h

@@ -3,7 +3,7 @@ static const union C(codestrs_t_, NOW) {
 #define P(n, s) char MF(__LINE__)[sizeof (s)];
 #include "psiginfo-data.h"
   };
-  char str[0];
+  char str[0] __attribute__((bnd_variable_size));
 } C(codestrs_, NOW) = { {
 #define P(n, s) s,
 #include "psiginfo-data.h"

stdio-common/scanf13.c

@@ -59,6 +59,7 @@ main (void)
     }
 
   memset (buf, '/', sizeof (buf));
+  buf[sizeof(buf) - 1] = 0;
   buf[0] = '\t';
   buf[1] = ' ';
   buf[2] = 0xc3;

stdlib/strtod_l.c

@@ -1752,7 +1752,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group, loc)
 	      got_limb;
 	    }
 
-	  for (i = densize; num[i] == 0 && i >= 0; --i)
+	  for (i = densize; i >= 0 && num[i] == 0; --i)
 	    ;
 	  return round_and_return (retval, exponent - 1, negative,
 				   quot, BITS_PER_MP_LIMB - 1 - used,

string/strcpy.c

@@ -26,6 +26,7 @@ char *
 strcpy (dest, src)
      char *dest;
      const char *src;
+#ifndef __CHKP__
 {
   char c;
   char *s = (char *) src;
@@ -40,4 +41,12 @@ strcpy (dest, src)
 
   return dest;
 }
+#else
+{
+  const char  *ret = dest;
+  while ((*dest++ = *src++) != '\0');
+  return ret;
+}
+#endif
+
 libc_hidden_builtin_def (strcpy)

string/test-strchr.c

@@ -219,9 +219,14 @@ do_random_tests (void)
 static void
 check1 (void)
 {
-  char s[] __attribute__((aligned(16))) = "\xff";
-  char c = '\xfe';
-  char *exp_result = stupid_STRCHR (s, c);
+  CHAR s[] __attribute__((aligned(16))) =
+#ifdef WIDE
+  L"\xff";
+#else
+  "\xff";
+#endif
+  CHAR c = '\xfe';
+  CHAR *exp_result = stupid_STRCHR (s, c);
 
   FOR_EACH_IMPL (impl, 0)
     check_result (impl, s, c, exp_result);

sunrpc/clnt_udp.c

@@ -96,7 +96,7 @@ struct cu_data
     u_int cu_sendsz;
     char *cu_outbuf;
     u_int cu_recvsz;
-    char cu_inbuf[1];
+    char cu_inbuf[1] __attribute__((bnd_variable_size)) ;
   };
 
 /*

sysdeps/generic/unwind-dw2-fde.h

@@ -147,7 +147,7 @@ typedef struct dwarf_fde fde;
 static inline struct dwarf_cie *
 get_cie (struct dwarf_fde *f)
 {
-  return (void *)&f->CIE_delta - f->CIE_delta;
+  return (char *)f + offsetof (struct dwarf_fde, CIE_delta)  - f->CIE_delta;
 }
 
 static inline fde *

sysdeps/gnu/netinet/ip_icmp.h

@@ -189,7 +189,7 @@ struct icmp
     } id_ip;
     struct icmp_ra_addr id_radv;
     u_int32_t   id_mask;
-    u_int8_t    id_data[1];
+    u_int8_t    id_data[1] __attribute__((bnd_variable_size));
   } icmp_dun;
 #define	icmp_otime	icmp_dun.id_ts.its_otime
 #define	icmp_rtime	icmp_dun.id_ts.its_rtime

sysdeps/gnu/unwind-resume.c

@@ -46,6 +46,9 @@ init (void)
 void
 _Unwind_Resume (struct _Unwind_Exception *exc)
 {
+#ifdef __CHKP__
+  exc = (struct _Unwind_Exception *) __bnd_set_ptr_bounds (exc, sizeof (struct _Unwind_Exception));
+#endif
   if (__builtin_expect (libgcc_s_resume == NULL, 0))
     init ();
   libgcc_s_resume (exc);

sysdeps/i386/dl-trampoline.S

@@ -31,9 +31,29 @@ _dl_runtime_resolve:
 	cfi_adjust_cfa_offset (4)
 	pushl %edx
 	cfi_adjust_cfa_offset (4)
+#if !defined  __CHKP__ && !defined __CHKWR__
 	movl 16(%esp), %edx	# Copy args pushed by PLT in register.  Note
 	movl 12(%esp), %eax	# that `fixup' takes its parameters in regs.
+#else
+	subl $32, %esp
+	cfi_adjust_cfa_offset (32)
+	bndmov %bnd0, (%esp)
+	bndmov %bnd1, 8(%esp)
+	bndmov %bnd2, 16(%esp)
+	bndmov %bnd3, 24(%esp)
+	movl 48(%esp), %edx	# Copy args pushed by PLT in register.  Note
+	movl 44(%esp), %eax	# that `fixup' takes its parameters in regs.
+	bndldx 44(%esp, %eax), %bnd0
+#endif
 	call _dl_fixup		# Call resolver.
+#if defined  __CHKP__ || defined __CHKWR__
+	bndmov 24(%esp), %bnd3
+	bndmov 16(%esp), %bnd2
+	bndmov 8(%esp), %bnd1
+	bndmov (%esp), %bnd0
+	addl $32, %esp
+	cfi_adjust_cfa_offset (-32)
+#endif
 	popl %edx		# Get register content back.
 	cfi_adjust_cfa_offset (-4)
 	movl (%esp), %ecx

sysdeps/i386/i486/strcat.S

@@ -35,9 +35,19 @@ ENTRY (strcat)
 
 	movl DEST(%esp), %edx
 	movl SRC(%esp), %ecx
+#ifdef __CHKP__
+	bndldx DEST(%esp,%edx,1), %bnd0
+	bndldx SRC(%esp,%ecx,1), %bnd1
+	bndcl (%ecx), %bnd1
+	bndcu (%ecx), %bnd1
+#endif
 
 	testb $0xff, (%ecx)	/* Is source string empty? */
 	jz L(8)			/* yes => return */
+#ifdef __CHKP__
+	bndcl (%edx), %bnd0
+	bndcu (%edx), %bnd0
+#endif
 
 	/* Test the first bytes separately until destination is aligned.  */
 	testl $3, %edx		/* destination pointer aligned? */
@@ -66,7 +76,11 @@ ENTRY (strcat)
 
 L(4):	addl $16,%edx		/* increment destination pointer for round */
 
-L(1):	movl (%edx), %eax	/* get word (= 4 bytes) in question */
+L(1):
+#ifdef __CHKP__
+	bndcu (%edx), %bnd0
+#endif
+	movl (%edx), %eax	/* get word (= 4 bytes) in question */
 	movl $0xfefefeff, %edi	/* magic value */
 
 	/* If you compare this with the algorithm in memchr.S you will
@@ -98,6 +112,9 @@ L(1):	movl (%edx), %eax	/* get word (= 4 bytes) in question */
 	/* If at least one byte of the word is C we don't get 0 in %ecx.  */
 	jnz L(3)
 
+#ifdef __CHKP__
+	bndcu 4(%edx), %bnd0
+#endif
 	movl 4(%edx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
@@ -110,6 +127,9 @@ L(1):	movl (%edx), %eax	/* get word (= 4 bytes) in question */
 				   the addition will not result in 0.  */
 	jnz L(5)		/* one byte is NUL => stop copying */
 
+#ifdef __CHKP__
+	bndcu 8(%edx), %bnd0
+#endif
 	movl 8(%edx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
@@ -122,6 +142,9 @@ L(1):	movl (%edx), %eax	/* get word (= 4 bytes) in question */
 				   the addition will not result in 0.  */
 	jnz L(6)		/* one byte is NUL => stop copying */
 
+#ifdef __CHKP__
+	bndcu 12(%edx), %bnd0
+#endif
 	movl 12(%edx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
@@ -155,6 +178,10 @@ L(2):	subl %ecx, %edx		/* reduce number of loop variants */
 	/* Now we have to align the source pointer.  */
 	testl $3, %ecx		/* pointer correctly aligned? */
 	jz L(29)		/* yes => start copy loop */
+#ifdef __CHKP__
+	bndcu (%ecx), %bnd1
+	bndcu (%ecx, %edx), %bnd0
+#endif
 	movb (%ecx), %al	/* get first byte */
 	movb %al, (%ecx,%edx)	/* and store it */
 	andb %al, %al		/* is byte NUL? */
@@ -163,6 +190,10 @@ L(2):	subl %ecx, %edx		/* reduce number of loop variants */
 
 	testl $3, %ecx		/* pointer correctly aligned? */
 	jz L(29)		/* yes => start copy loop */
+#ifdef __CHKP__
+	bndcu (%ecx), %bnd1
+	bndcu (%ecx, %edx), %bnd0
+#endif
 	movb (%ecx), %al	/* get first byte */
 	movb %al, (%ecx,%edx)	/* and store it */
 	andb %al, %al		/* is byte NUL? */
@@ -171,6 +202,10 @@ L(2):	subl %ecx, %edx		/* reduce number of loop variants */
 
 	testl $3, %ecx		/* pointer correctly aligned? */
 	jz L(29)		/* yes => start copy loop */
+#ifdef __CHKP__
+	bndcu (%ecx), %bnd1
+	bndcu (%ecx, %edx), %bnd0
+#endif
 	movb (%ecx), %al	/* get first byte */
 	movb %al, (%ecx,%edx)	/* and store it */
 	andb %al, %al		/* is byte NUL? */
@@ -182,10 +217,18 @@ L(2):	subl %ecx, %edx		/* reduce number of loop variants */
 
 	ALIGN(4)
 
-L(28):	movl %eax, 12(%ecx,%edx)/* store word at destination */
+L(28):
+#ifdef __CHKP__
+	bndcu 12(%ecx, %edx), %bnd0
+#endif
+	movl %eax, 12(%ecx,%edx)/* store word at destination */
 	addl $16, %ecx		/* adjust pointer for full round */
 
-L(29):	movl (%ecx), %eax	/* get word from source */
+L(29):
+#ifdef __CHKP__
+	bndcu (%ecx), %bnd1
+#endif
+	movl (%ecx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
 				   carry bits reported for each byte which
@@ -196,8 +239,14 @@ L(29):	movl (%ecx), %eax	/* get word from source */
 	incl %edi		/* add 1: if one carry bit was *not* set
 				   the addition will not result in 0.  */
 	jnz L(9)		/* one byte is NUL => stop copying */
+#ifdef __CHKP__
+	bndcu (%ecx, %edx), %bnd0
+#endif
 	movl %eax, (%ecx,%edx)	/* store word to destination */
 
+#ifdef __CHKP__
+	bndcu 4(%ecx), %bnd1
+#endif
 	movl 4(%ecx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
@@ -209,8 +258,14 @@ L(29):	movl (%ecx), %eax	/* get word from source */
 	incl %edi		/* add 1: if one carry bit was *not* set
 				   the addition will not result in 0.  */
 	jnz L(91)		/* one byte is NUL => stop copying */
+#ifdef __CHKP__
+	bndcu 4(%ecx, %edx), %bnd0
+#endif
 	movl %eax, 4(%ecx,%edx)	/* store word to destination */
 
+#ifdef __CHKP__
+	bndcu 8(%ecx), %bnd1
+#endif
 	movl 8(%ecx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
@@ -222,8 +277,14 @@ L(29):	movl (%ecx), %eax	/* get word from source */
 	incl %edi		/* add 1: if one carry bit was *not* set
 				   the addition will not result in 0.  */
 	jnz L(92)		/* one byte is NUL => stop copying */
+#ifdef __CHKP__
+	bndcu 8(%ecx, %edx), %bnd0
+#endif
 	movl %eax, 8(%ecx,%edx)	/* store word to destination */
 
+#ifdef __CHKP__
+	bndcu 12(%ecx), %bnd1
+#endif
 	movl 12(%ecx), %eax	/* get word from source */
 	movl $0xfefefeff, %edi	/* magic value */
 	addl %eax, %edi		/* add the magic value to the word.  We get
@@ -240,15 +301,25 @@ L(93):	addl $4, %ecx		/* adjust pointer */
 L(92):	addl $4, %ecx
 L(91):	addl $4, %ecx
 
-L(9):	movb %al, (%ecx,%edx)	/* store first byte of last word */
+L(9):
+#ifdef __CHKP__
+	bndcu (%ecx, %edx), %bnd0
+#endif
+	movb %al, (%ecx,%edx)	/* store first byte of last word */
 	orb %al, %al		/* is it NUL? */
 	jz L(8)			/* yes => return */
 
+#ifdef __CHKP__
+	bndcu 1(%ecx, %edx), %bnd0
+#endif
 	movb %ah, 1(%ecx,%edx)	/* store second byte of last word */
 	orb %ah, %ah		/* is it NUL? */
 	jz L(8)			/* yes => return */
 
 	shrl $16, %eax		/* make upper bytes accessible */
+#ifdef __CHKP__
+	bndcu 2(%ecx, %edx), %bnd0
+#endif
 	movb %al, 2(%ecx,%edx)	/* store third byte of last word */
 	orb %al, %al		/* is it NUL? */
 	jz L(8)			/* yes => return */

sysdeps/i386/i586/strchr.S

@@ -54,6 +54,10 @@ ENTRY (strchr)
 
 	movl STR(%esp), %eax
 	movl CHR(%esp), %edx
+#ifdef __CHKP__
+	bndldx 	STR(%esp,%eax,1), %bnd0
+	bndcl  	(%eax), %bnd0
+#endif
 
 	movl %eax, %edi		/* duplicate string pointer for later */
 	cfi_rel_offset (edi, 12)
@@ -83,6 +87,9 @@ ENTRY (strchr)
 	xorb %dl, %cl		/* load single byte and test for NUL */
 	je L(3)			/* yes => return NULL */
 
+#ifdef __CHKP__
+	bndcu 1(%eax), %bnd0
+#endif
 	movb 1(%eax), %cl	/* load single byte */
 	incl %eax
 
@@ -97,7 +104,11 @@ ENTRY (strchr)
 
 	jne L(11)
 
-L(0):	movb (%eax), %cl	/* load single byte */
+L(0):
+#ifdef __CHKP__
+	bndcu (%eax), %bnd0
+#endif
+	movb (%eax), %cl	/* load single byte */
 
 	cmpb %cl, %dl		/* is byte == C? */
 	je L(out)		/* aligned => return pointer */
@@ -115,7 +126,11 @@ L(0):	movb (%eax), %cl	/* load single byte */
 	   four instruction up to `L1' will not be executed in the loop
 	   because the same code is found at the end of the loop, but
 	   there it is executed in parallel with other instructions.  */
-L(11):	movl (%eax), %ecx
+L(11):
+#ifdef __CHKP__
+	bndcu (%eax), %bnd0
+#endif
+	movl (%eax), %ecx
 	movl $magic, %ebp
 
 	movl $magic, %edi
@@ -159,6 +174,9 @@ L(1):	xorl %ecx, %ebp			/* (word^magic) */
 		movl $magic, %esi	/* load magic value */
 		xorl %edx, %ebx		/* clear words which are C */
 
+#ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+#endif
 					movl (%eax), %ecx
 		addl %ebx, %esi		/* (word+magic) */
 
@@ -189,6 +207,9 @@ L(1):	xorl %ecx, %ebp			/* (word^magic) */
 						movl $magic, %esi
 						xorl %edx, %ebx
 
+#ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+#endif
 	movl (%eax), %ecx
 						addl %ebx, %esi
 
@@ -219,6 +240,9 @@ L(1):	xorl %ecx, %ebp			/* (word^magic) */
 		movl $magic, %esi
 		xorl %edx, %ebx
 
+#ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+#endif
 					movl (%eax), %ecx
 		addl %ebx, %esi
 
@@ -249,6 +273,9 @@ L(1):	xorl %ecx, %ebp			/* (word^magic) */
 						movl $magic, %esi
 						xorl %edx, %ebx
 
+#ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+#endif
 	movl (%eax), %ecx
 						addl %ebx, %esi
 

sysdeps/i386/i586/strcpy.S

@@ -45,6 +45,10 @@ ENTRY (STRCPY)
 	cfi_rel_offset (edi, 8)
 	movl	SRC(%esp), %esi
 	cfi_rel_offset (esi, 4)
+#ifdef __CHKP__
+	bndldx	DEST(%esp,%edi,1), %bnd0
+	bndldx	SRC(%esp,%esi,1), %bnd1
+#endif
 
 	xorl	%eax, %eax
 	leal	-1(%esi), %ecx
@@ -61,6 +65,9 @@ ENTRY (STRCPY)
 	/* 0xb is the distance between 2: and 1: but we avoid writing
 	   1f-2b because the assembler generates worse code.  */
 	leal	0xb(%edx,%ecx,8), %ecx
+# ifdef __CHKP__
+	jmp	L(1)
+# endif
 #else
 	leal	1f(,%ecx,8), %ecx
 #endif

sysdeps/i386/i586/strlen.S

@@ -41,6 +41,10 @@
 ENTRY (strlen)
 
 	movl STR(%esp), %eax
+#ifdef __CHKP__
+	bndldx STR(%esp,%eax,1), %bnd0
+	bndcu (%eax),%bnd0
+#endif
 	movl $3, %edx		/* load mask (= 3) */
 
 	andl %eax, %edx		/* separate last two bits of address */
@@ -48,10 +52,16 @@ ENTRY (strlen)
 	jz L(1)			/* aligned => start loop */
 	jp L(0)			/* exactly two bits set */
 
+#ifdef __CHKP__
+	bndcu (%eax),%bnd0
+#endif
 	cmpb %dh, (%eax)	/* is byte NUL? */
 	je L(2)			/* yes => return */
 
 	incl %eax		/* increment pointer */
+#ifdef __CHKP__
+	bndcu (%eax),%bnd0
+#endif
 	cmpb %dh, (%eax)	/* is byte NUL? */
 
 	je L(2)			/* yes => return */
@@ -61,7 +71,11 @@ ENTRY (strlen)
 
 	jz L(1)
 
-L(0):	cmpb %dh, (%eax)	/* is byte NUL? */
+L(0):
+#ifdef __CHKP__
+	bndcu (%eax),%bnd0
+#endif
+	cmpb %dh, (%eax)	/* is byte NUL? */
 	je L(2)			/* yes => return */
 
 	incl %eax		/* increment pointer */
@@ -174,7 +188,11 @@ L(3):	subl $4, %eax		/* correct too early pointer increment */
 
 	incl %eax		/* increment pointer */
 
-L(2):	subl STR(%esp), %eax	/* now compute the length as difference
+L(2):
+#ifdef __CHKP__
+	bndcu (%eax),%bnd0
+#endif
+	subl STR(%esp), %eax	/* now compute the length as difference
 				   between start and terminating NUL
 				   character */
 	ret

sysdeps/i386/i686/memcmp.S

@@ -48,9 +48,19 @@ ENTRY (memcmp)
 	movl	BLK1(%esp), %eax
 	movl	BLK2(%esp), %edx
 	movl	LEN(%esp), %ecx
+#ifdef __CHKP__
+	bndldx	BLK1(%esp,%eax,1), %bnd0
+	bndldx	BLK2(%esp,%edx,1), %bnd1
+#endif
 
 	cmpl 	$1, %ecx
 	jne	L(not_1)
+#ifdef __CHKP__
+	bndcl	(%eax), %bnd0
+	bndcu	(%eax), %bnd0
+	bndcl	(%edx), %bnd1
+	bndcu	(%edx), %bnd1
+#endif
 	movzbl	(%eax), %ecx		/* LEN == 1  */
 	cmpb	(%edx), %cl
 	jne	L(neq)
@@ -69,6 +79,12 @@ L(neq):
 	cfi_rel_offset (ebx, 0)
 L(not_1):
 	jl	L(bye)			/* LEN == 0  */
+#ifdef __CHKP__
+	bndcl	(%eax), %bnd0
+	bndcu	(%eax), %bnd0
+	bndcl	(%edx), %bnd1
+	bndcu	(%edx), %bnd1
+#endif
 
 	pushl	%esi
 	cfi_adjust_cfa_offset (4)
@@ -84,36 +100,64 @@ L(not_1):
 
 	ALIGN (4)
 L(28bytes):
+#ifdef __CHKP__
+	bndcu	-28(%esi), %bnd0
+	bndcu	-28(%edx), %bnd1
+#endif
 	movl	-28(%esi), %eax
 	movl	-28(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(24bytes):
+#ifdef __CHKP__
+	bndcu	-24(%esi), %bnd0
+	bndcu	-24(%edx), %bnd1
+#endif
 	movl	-24(%esi), %eax
 	movl	-24(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(20bytes):
+#ifdef __CHKP__
+	bndcu	-20(%esi), %bnd0
+	bndcu	-20(%edx), %bnd1
+#endif
 	movl	-20(%esi), %eax
 	movl	-20(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(16bytes):
+#ifdef __CHKP__
+	bndcu	-16(%esi), %bnd0
+	bndcu	-16(%edx), %bnd1
+#endif
 	movl	-16(%esi), %eax
 	movl	-16(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(12bytes):
+#ifdef __CHKP__
+	bndcu	-12(%esi), %bnd0
+	bndcu	-12(%edx), %bnd1
+#endif
 	movl	-12(%esi), %eax
 	movl	-12(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(8bytes):
+#ifdef __CHKP__
+	bndcu	-8(%esi), %bnd0
+	bndcu	-8(%edx), %bnd1
+#endif
 	movl	-8(%esi), %eax
 	movl	-8(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(4bytes):
+#ifdef __CHKP__
+	bndcu	-4(%esi), %bnd0
+	bndcu	-4(%edx), %bnd1
+#endif
 	movl	-4(%esi), %eax
 	movl	-4(%edx), %ecx
 	cmpl	%ecx, %eax
@@ -129,41 +173,73 @@ L(0bytes):
 	cfi_rel_offset (esi, 0)
 	cfi_rel_offset (ebx, 4)
 L(29bytes):
+#ifdef __CHKP__
+	bndcu	-29(%esi), %bnd0
+	bndcu	-29(%edx), %bnd1
+#endif
 	movl	-29(%esi), %eax
 	movl	-29(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(25bytes):
+#ifdef __CHKP__
+	bndcu	-25(%esi), %bnd0
+	bndcu	-25(%edx), %bnd1
+#endif
 	movl	-25(%esi), %eax
 	movl	-25(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(21bytes):
+#ifdef __CHKP__
+	bndcu	-21(%esi), %bnd0
+	bndcu	-21(%edx), %bnd1
+#endif
 	movl	-21(%esi), %eax
 	movl	-21(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(17bytes):
+#ifdef __CHKP__
+	bndcu	-17(%esi), %bnd0
+	bndcu	-17(%edx), %bnd1
+#endif
 	movl	-17(%esi), %eax
 	movl	-17(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(13bytes):
+#ifdef __CHKP__
+	bndcu	-13(%esi), %bnd0
+	bndcu	-13(%edx), %bnd1
+#endif
 	movl	-13(%esi), %eax
 	movl	-13(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(9bytes):
+#ifdef __CHKP__
+	bndcu	-9(%esi), %bnd0
+	bndcu	-9(%edx), %bnd1
+#endif
 	movl	-9(%esi), %eax
 	movl	-9(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(5bytes):
+#ifdef __CHKP__
+	bndcu	-5(%esi), %bnd0
+	bndcu	-5(%edx), %bnd1
+#endif
 	movl	-5(%esi), %eax
 	movl	-5(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(1bytes):
+#ifdef __CHKP__
+	bndcu	-1(%esi), %bnd0
+	bndcu	-1(%edx), %bnd1
+#endif
 	movzbl	-1(%esi), %eax
 	cmpb	-1(%edx), %al
 	jne	L(set)
@@ -177,41 +253,73 @@ L(1bytes):
 	cfi_rel_offset (esi, 0)
 	cfi_rel_offset (ebx, 4)
 L(30bytes):
+#ifdef __CHKP__
+	bndcu	-30(%esi), %bnd0
+	bndcu	-30(%edx), %bnd1
+#endif
 	movl	-30(%esi), %eax
 	movl	-30(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(26bytes):
+#ifdef __CHKP__
+	bndcu	-26(%esi), %bnd0
+	bndcu	-26(%edx), %bnd1
+#endif
 	movl	-26(%esi), %eax
 	movl	-26(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(22bytes):
+#ifdef __CHKP__
+	bndcu	-22(%esi), %bnd0
+	bndcu	-22(%edx), %bnd1
+#endif
 	movl	-22(%esi), %eax
 	movl	-22(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(18bytes):
+#ifdef __CHKP__
+	bndcu	-18(%esi), %bnd0
+	bndcu	-18(%edx), %bnd1
+#endif
 	movl	-18(%esi), %eax
 	movl	-18(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(14bytes):
+#ifdef __CHKP__
+	bndcu	-14(%esi), %bnd0
+	bndcu	-14(%edx), %bnd1
+#endif
 	movl	-14(%esi), %eax
 	movl	-14(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(10bytes):
+#ifdef __CHKP__
+	bndcu	-10(%esi), %bnd0
+	bndcu	-10(%edx), %bnd1
+#endif
 	movl	-10(%esi), %eax
 	movl	-10(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(6bytes):
+#ifdef __CHKP__
+	bndcu	-6(%esi), %bnd0
+	bndcu	-6(%edx), %bnd1
+#endif
 	movl	-6(%esi), %eax
 	movl	-6(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(2bytes):
+#ifdef __CHKP__
+	bndcu	-2(%esi), %bnd0
+	bndcu	-2(%edx), %bnd1
+#endif
 	movzwl	-2(%esi), %eax
 	movzwl	-2(%edx), %ecx
 	cmpb	%cl, %al
@@ -228,41 +336,73 @@ L(2bytes):
 	cfi_rel_offset (esi, 0)
 	cfi_rel_offset (ebx, 4)
 L(31bytes):
+#ifdef __CHKP__
+	bndcu	-31(%esi), %bnd0
+	bndcu	-31(%edx), %bnd1
+#endif
 	movl	-31(%esi), %eax
 	movl	-31(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(27bytes):
+#ifdef __CHKP__
+	bndcu	-27(%esi), %bnd0
+	bndcu	-27(%edx), %bnd1
+#endif
 	movl	-27(%esi), %eax
 	movl	-27(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(23bytes):
+#ifdef __CHKP__
+	bndcu	-23(%esi), %bnd0
+	bndcu	-23(%edx), %bnd1
+#endif
 	movl	-23(%esi), %eax
 	movl	-23(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(19bytes):
+#ifdef __CHKP__
+	bndcu	-19(%esi), %bnd0
+	bndcu	-19(%edx), %bnd1
+#endif
 	movl	-19(%esi), %eax
 	movl	-19(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(15bytes):
+#ifdef __CHKP__
+	bndcu	-15(%esi), %bnd0
+	bndcu	-15(%edx), %bnd1
+#endif
 	movl	-15(%esi), %eax
 	movl	-15(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(11bytes):
+#ifdef __CHKP__
+	bndcu	-11(%esi), %bnd0
+	bndcu	-11(%edx), %bnd1
+#endif
 	movl	-11(%esi), %eax
 	movl	-11(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(7bytes):
+#ifdef __CHKP__
+	bndcu	-7(%esi), %bnd0
+	bndcu	-7(%edx), %bnd1
+#endif
 	movl	-7(%esi), %eax
 	movl	-7(%edx), %ecx
 	cmpl	%ecx, %eax
 	jne	L(find_diff)
 L(3bytes):
+#ifdef __CHKP__
+	bndcu	-3(%esi), %bnd0
+	bndcu	-3(%edx), %bnd1
+#endif
 	movzwl	-3(%esi), %eax
 	movzwl	-3(%edx), %ecx
 	cmpb	%cl, %al
@@ -286,34 +426,66 @@ L(3bytes):
 L(32bytesormore):
 	subl	$32, %ecx
 
+#ifdef __CHKP__
+	bndcu	(%esi), %bnd0
+	bndcu	(%edx), %bnd1
+#endif
 	movl	(%esi), %eax
 	cmpl	(%edx), %eax
 	jne	L(load_ecx)
 
+#ifdef __CHKP__
+	bndcu	4(%esi), %bnd0
+	bndcu	4(%edx), %bnd1
+#endif
 	movl	4(%esi), %eax
 	cmpl	4(%edx), %eax
 	jne	L(load_ecx_4)
 
+#ifdef __CHKP__
+	bndcu	8(%esi), %bnd0
+	bndcu	8(%edx), %bnd1
+#endif
 	movl	8(%esi), %eax
 	cmpl	8(%edx), %eax
 	jne	L(load_ecx_8)
 
+#ifdef __CHKP__
+	bndcu	12(%esi), %bnd0
+	bndcu	12(%edx), %bnd1
+#endif
 	movl	12(%esi), %eax
 	cmpl	12(%edx), %eax
 	jne	L(load_ecx_12)
 
+#ifdef __CHKP__
+	bndcu	16(%esi), %bnd0
+	bndcu	16(%edx), %bnd1
+#endif
 	movl	16(%esi), %eax
 	cmpl	16(%edx), %eax
 	jne	L(load_ecx_16)
 
+#ifdef __CHKP__
+	bndcu	20(%esi), %bnd0
+	bndcu	20(%edx), %bnd1
+#endif
 	movl	20(%esi), %eax
 	cmpl	20(%edx), %eax
 	jne	L(load_ecx_20)
 
+#ifdef __CHKP__
+	bndcu	24(%esi), %bnd0
+	bndcu	24(%edx), %bnd1
+#endif
 	movl	24(%esi), %eax
 	cmpl	24(%edx), %eax
 	jne	L(load_ecx_24)
 
+#ifdef __CHKP__
+	bndcu	28(%esi), %bnd0
+	bndcu	28(%edx), %bnd1
+#endif
 	movl	28(%esi), %eax
 	cmpl	28(%edx), %eax
 	jne	L(load_ecx_28)

sysdeps/i386/i686/memset.S

@@ -50,6 +50,11 @@ ENTRY (memset)
 	cfi_adjust_cfa_offset (4)
 	movl	DEST(%esp), %edx
 	movl	LEN(%esp), %ecx
+#ifdef __CHKP__
+	bndldx  DEST(%esp,%edx,1),%bnd0
+	bndcl  	(%edx), %bnd0
+	bndcu  	-1(%edx, %ecx), %bnd0
+#endif
 #if BZERO_P
 	xorl	%eax, %eax	/* fill with 0 */
 #else

sysdeps/i386/i686/multiarch/Makefile

@@ -6,9 +6,7 @@ endif
 
 ifeq ($(subdir),string)
 gen-as-const-headers += locale-defines.sym
-sysdep_routines += bzero-sse2 memset-sse2 memcpy-ssse3 mempcpy-ssse3 \
-		   memmove-ssse3 memcpy-ssse3-rep mempcpy-ssse3-rep \
-		   memmove-ssse3-rep bcopy-ssse3 bcopy-ssse3-rep \
+sysdep_routines += bzero-sse2 memset-sse2 \
 		   memset-sse2-rep bzero-sse2-rep strcmp-ssse3 \
 		   strcmp-sse4 strncmp-c strncmp-ssse3 strncmp-sse4 \
 		   memcmp-ssse3 memcmp-sse4 strcasestr-nonascii varshift \
@@ -23,7 +21,8 @@ sysdep_routines += bzero-sse2 memset-sse2 memcpy-ssse3 mempcpy-ssse3 \
 		   strnlen-sse2 strnlen-c \
 		   strcasecmp_l-c strcasecmp-c strcasecmp_l-ssse3 \
 		   strncase_l-c strncase-c strncase_l-ssse3 \
-		   strcasecmp_l-sse4 strncase_l-sse4
+		   strcasecmp_l-sse4 strncase_l-sse4 mpx_memcpy_nobnd \
+			mpx_mempcpy_nobnd mpx_memmove_nobnd
 ifeq (yes,$(config-cflags-sse4))
 sysdep_routines += strcspn-c strpbrk-c strspn-c strstr-c strcasestr-c
 CFLAGS-varshift.c += -msse4

sysdeps/i386/i686/multiarch/Versions

@@ -2,4 +2,11 @@ libc {
   GLIBC_PRIVATE {
     __get_cpu_features;
   }
+%ifdef __CHKP__
+  GLIBC_2.14 {
+   mpx_memcpy_nobnd;
+   mpx_memmove_nobnd;
+   mpx_mempcpy_nobnd;
+  }
+%endif
 }

sysdeps/i386/i686/multiarch/bcopy.c

@@ -0,0 +1,7 @@
+#include <stddef.h>
+
+void
+bcopy (const void *src, void *dst, size_t n)
+{
+  memmove (dst, src, n);
+}

sysdeps/i386/i686/multiarch/ifunc-impl-list.c

@@ -37,11 +37,11 @@ __libc_ifunc_impl_list (const char *name, struct libc_ifunc_impl *array,
   size_t i = 0;
 
   /* Support sysdeps/i386/i686/multiarch/bcopy.S.  */
-  IFUNC_IMPL (i, name, bcopy,
-	      IFUNC_IMPL_ADD (array, i, bcopy, HAS_SSSE3,
-			      __bcopy_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, bcopy, HAS_SSSE3, __bcopy_ssse3)
-	      IFUNC_IMPL_ADD (array, i, bcopy, 1, __bcopy_ia32))
+//  IFUNC_IMPL (i, name, bcopy,
+//	      IFUNC_IMPL_ADD (array, i, bcopy, HAS_SSSE3,
+//			      __bcopy_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, bcopy, HAS_SSSE3, __bcopy_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, bcopy, 1, __bcopy_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/bzero.S.  */
   IFUNC_IMPL (i, name, bzero,
@@ -64,21 +64,21 @@ __libc_ifunc_impl_list (const char *name, struct libc_ifunc_impl *array,
 	      IFUNC_IMPL_ADD (array, i, memcmp, 1, __memcmp_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/memmove_chk.S.  */
-  IFUNC_IMPL (i, name, __memmove_chk,
-	      IFUNC_IMPL_ADD (array, i, __memmove_chk, HAS_SSSE3,
-			      __memmove_chk_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, __memmove_chk, HAS_SSSE3,
-			      __memmove_chk_ssse3)
-	      IFUNC_IMPL_ADD (array, i, __memmove_chk, 1,
-			      __memmove_chk_ia32))
+//  IFUNC_IMPL (i, name, __memmove_chk,
+//	      IFUNC_IMPL_ADD (array, i, __memmove_chk, HAS_SSSE3,
+//			      __memmove_chk_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, __memmove_chk, HAS_SSSE3,
+//			      __memmove_chk_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, __memmove_chk, 1,
+//			      __memmove_chk_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/memmove.S.  */
-  IFUNC_IMPL (i, name, memmove,
-	      IFUNC_IMPL_ADD (array, i, memmove, HAS_SSSE3,
-			      __memmove_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, memmove, HAS_SSSE3,
-			      __memmove_ssse3)
-	      IFUNC_IMPL_ADD (array, i, memmove, 1, __memmove_ia32))
+//  IFUNC_IMPL (i, name, memmove,
+//	      IFUNC_IMPL_ADD (array, i, memmove, HAS_SSSE3,
+//			      __memmove_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, memmove, HAS_SSSE3,
+//			      __memmove_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, memmove, 1, __memmove_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/memrchr.S.  */
   IFUNC_IMPL (i, name, memrchr,
@@ -274,37 +274,37 @@ __libc_ifunc_impl_list (const char *name, struct libc_ifunc_impl *array,
 
 #ifdef SHARED
   /* Support sysdeps/i386/i686/multiarch/memcpy_chk.S.  */
-  IFUNC_IMPL (i, name, __memcpy_chk,
-	      IFUNC_IMPL_ADD (array, i, __memcpy_chk, HAS_SSSE3,
-			      __memcpy_chk_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, __memcpy_chk, HAS_SSSE3,
-			      __memcpy_chk_ssse3)
-	      IFUNC_IMPL_ADD (array, i, __memcpy_chk, 1,
-			      __memcpy_chk_ia32))
+//  IFUNC_IMPL (i, name, __memcpy_chk,
+//	      IFUNC_IMPL_ADD (array, i, __memcpy_chk, HAS_SSSE3,
+//			      __memcpy_chk_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, __memcpy_chk, HAS_SSSE3,
+//			      __memcpy_chk_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, __memcpy_chk, 1,
+//			      __memcpy_chk_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/memcpy.S.  */
-  IFUNC_IMPL (i, name, memcpy,
-	      IFUNC_IMPL_ADD (array, i, memcpy, HAS_SSSE3,
-			      __memcpy_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, memcpy, HAS_SSSE3, __memcpy_ssse3)
-	      IFUNC_IMPL_ADD (array, i, memcpy, 1, __memcpy_ia32))
+//  IFUNC_IMPL (i, name, memcpy,
+//	      IFUNC_IMPL_ADD (array, i, memcpy, HAS_SSSE3,
+//			      __memcpy_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, memcpy, HAS_SSSE3, __memcpy_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, memcpy, 1, __memcpy_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/mempcpy_chk.S.  */
-  IFUNC_IMPL (i, name, __mempcpy_chk,
-	      IFUNC_IMPL_ADD (array, i, __mempcpy_chk, HAS_SSSE3,
-			      __mempcpy_chk_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, __mempcpy_chk, HAS_SSSE3,
-			      __mempcpy_chk_ssse3)
-	      IFUNC_IMPL_ADD (array, i, __mempcpy_chk, 1,
-			      __mempcpy_chk_ia32))
+//  IFUNC_IMPL (i, name, __mempcpy_chk,
+//	      IFUNC_IMPL_ADD (array, i, __mempcpy_chk, HAS_SSSE3,
+//			      __mempcpy_chk_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, __mempcpy_chk, HAS_SSSE3,
+//			      __mempcpy_chk_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, __mempcpy_chk, 1,
+//			      __mempcpy_chk_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/mempcpy.S.  */
-  IFUNC_IMPL (i, name, mempcpy,
-	      IFUNC_IMPL_ADD (array, i, mempcpy, HAS_SSSE3,
-			      __mempcpy_ssse3_rep)
-	      IFUNC_IMPL_ADD (array, i, mempcpy, HAS_SSSE3,
-			      __mempcpy_ssse3)
-	      IFUNC_IMPL_ADD (array, i, mempcpy, 1, __mempcpy_ia32))
+//  IFUNC_IMPL (i, name, mempcpy,
+//	      IFUNC_IMPL_ADD (array, i, mempcpy, HAS_SSSE3,
+//			      __mempcpy_ssse3_rep)
+//	      IFUNC_IMPL_ADD (array, i, mempcpy, HAS_SSSE3,
+//			      __mempcpy_ssse3)
+//	      IFUNC_IMPL_ADD (array, i, mempcpy, 1, __mempcpy_ia32))
 
   /* Support sysdeps/i386/i686/multiarch/strlen.S.  */
   IFUNC_IMPL (i, name, strlen,

sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S

@@ -58,6 +58,12 @@ ENTRY (MEMCHR)
 # endif
 	mov	%ecx, %eax
 
+# ifdef __CHKP__
+	bndldx	STR1(%esp,%ecx,1), %bnd0
+	bndcl 	(%ecx), %bnd0
+	bndcu 	(%ecx), %bnd0
+# endif
+
 	punpcklbw %xmm1, %xmm1
 	punpcklbw %xmm1, %xmm1
 
@@ -79,9 +85,18 @@ ENTRY (MEMCHR)
 # ifndef USE_AS_RAWMEMCHR
 	sub	%ecx, %edx
 	jbe	L(return_null_1)
-# endif
 	add	%ecx, %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	ret
+# else
+	add	%ecx, %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
+	ret
+# endif
 
 	.p2align 4
 L(unaligned_no_match_1):
@@ -163,8 +178,15 @@ L(loop_prolog):
 # ifndef USE_AS_RAWMEMCHR
 	sub	$64, %edx
 	jbe	L(exit_loop)
+#  ifdef __CHKP__
+	bndcu   (%edi), %bnd0
+#  endif
 	movdqa	(%edi), %xmm0
 # else
+
+#  ifdef __CHKP__
+	bndcu   (%edx), %bnd0
+#  endif
 	movdqa	(%edx), %xmm0
 # endif
 	pcmpeqb	%xmm1, %xmm0
@@ -173,8 +195,15 @@ L(loop_prolog):
 	jnz	L(matches)
 
 # ifndef USE_AS_RAWMEMCHR
+#  ifdef __CHKP__
+	bndcu   16(%edi), %bnd0
+#  endif
 	movdqa	16(%edi), %xmm2
 # else
+
+#  ifdef __CHKP__
+	bndcu   16(%edx), %bnd0
+#  endif
 	movdqa	16(%edx), %xmm2
 # endif
 	pcmpeqb	%xmm1, %xmm2
@@ -183,8 +212,15 @@ L(loop_prolog):
 	jnz	L(matches16)
 
 # ifndef USE_AS_RAWMEMCHR
+#  ifdef __CHKP__
+	bndcu   32(%edi), %bnd0
+#  endif
 	movdqa	32(%edi), %xmm3
 # else
+
+#  ifdef __CHKP__
+	bndcu   32(%edx), %bnd0
+#  endif
 	movdqa	32(%edx), %xmm3
 # endif
 	pcmpeqb	%xmm1, %xmm3
@@ -193,8 +229,15 @@ L(loop_prolog):
 	jnz	L(matches32)
 
 # ifndef USE_AS_RAWMEMCHR
+#  ifdef __CHKP__
+	bndcu   48(%edi), %bnd0
+#  endif
 	movdqa	48(%edi), %xmm4
 # else
+
+#  ifdef __CHKP__
+	bndcu   48(%edx), %bnd0
+#  endif
 	movdqa	48(%edx), %xmm4
 # endif
 	pcmpeqb	%xmm1, %xmm4
@@ -277,11 +320,18 @@ L(align64_loop):
 # ifndef USE_AS_RAWMEMCHR
 	sub	$64, %edx
 	jbe	L(exit_loop)
+#  ifdef __CHKP__
+	bndcu   (%edi), %bnd0
+#  endif
 	movdqa	(%edi), %xmm0
 	movdqa	16(%edi), %xmm2
 	movdqa	32(%edi), %xmm3
 	movdqa	48(%edi), %xmm4
 # else
+
+#  ifdef __CHKP__
+	bndcu   (%edx), %bnd0
+#  endif
 	movdqa	(%edx), %xmm0
 	movdqa	16(%edx), %xmm2
 	movdqa	32(%edx), %xmm3
@@ -342,9 +392,15 @@ L(align64_loop):
 
 # ifndef USE_AS_RAWMEMCHR
 	lea	48(%edi, %eax), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	RETURN
 # else
 	lea	48(%edx, %eax), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	ret
 # endif
 
@@ -404,9 +460,15 @@ L(matches0):
 	bsf	%eax, %eax
 # ifndef USE_AS_RAWMEMCHR
 	lea	-16(%eax, %edi), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	RETURN
 # else
 	lea	-16(%eax, %edx), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	ret
 # endif
 
@@ -415,9 +477,15 @@ L(matches):
 	bsf	%eax, %eax
 # ifndef USE_AS_RAWMEMCHR
 	add	%edi, %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	RETURN
 # else
 	add	%edx, %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	ret
 # endif
 
@@ -426,9 +494,15 @@ L(matches16):
 	bsf	%eax, %eax
 # ifndef USE_AS_RAWMEMCHR
 	lea	16(%eax, %edi), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	RETURN
 # else
 	lea	16(%eax, %edx), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	ret
 # endif
 
@@ -437,9 +511,15 @@ L(matches32):
 	bsf	%eax, %eax
 # ifndef USE_AS_RAWMEMCHR
 	lea	32(%eax, %edi), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	RETURN
 # else
 	lea	32(%eax, %edx), %eax
+#  ifdef __CHKP__
+	bndcu 	(%eax), %bnd0
+#  endif
 	ret
 # endif
 

sysdeps/i386/i686/multiarch/memcmp-sse4.S

@@ -91,6 +91,15 @@ ENTRY (MEMCMP)
 	jbe	L(less1bytes)
 # endif
 
+# ifdef __CHKP__
+	bndldx 	BLK1(%esp,%eax,1), %bnd0
+	bndldx 	BLK2(%esp,%edx,1), %bnd1
+	bndcl	(%eax), %bnd0
+	bndcl	(%edx), %bnd1
+	bndcu	(%eax), %bnd0
+	bndcu	(%edx), %bnd1
+# endif
+
 	pxor	%xmm0, %xmm0
 	cmp	$64, %ecx
 	ja	L(64bytesormore)
@@ -115,6 +124,10 @@ L(less8bytes):
 	cmpb	(%edx), %bl
 	jne	L(nonzero)
 
+# ifdef __CHKP__
+	bndcu	1(%eax), %bnd0
+	bndcu	1(%edx), %bnd1
+# endif
 	mov	1(%eax), %bl
 	cmpb	1(%edx), %bl
 	jne	L(nonzero)
@@ -122,6 +135,10 @@ L(less8bytes):
 	cmp	$2, %ecx
 	jz	L(0bytes)
 
+# ifdef __CHKP__
+	bndcu	2(%eax), %bnd0
+	bndcu	2(%edx), %bnd1
+# endif
 	mov	2(%eax), %bl
 	cmpb	2(%edx), %bl
 	jne	L(nonzero)
@@ -129,6 +146,10 @@ L(less8bytes):
 	cmp	$3, %ecx
 	jz	L(0bytes)
 
+# ifdef __CHKP__
+	bndcu	3(%eax), %bnd0
+	bndcu	3(%edx), %bnd1
+# endif
 	mov	3(%eax), %bl
 	cmpb	3(%edx), %bl
 	jne	L(nonzero)
@@ -136,6 +157,10 @@ L(less8bytes):
 	cmp	$4, %ecx
 	jz	L(0bytes)
 
+# ifdef __CHKP__
+	bndcu	4(%eax), %bnd0
+	bndcu	4(%edx), %bnd1
+# endif
 	mov	4(%eax), %bl
 	cmpb	4(%edx), %bl
 	jne	L(nonzero)
@@ -143,6 +168,10 @@ L(less8bytes):
 	cmp	$5, %ecx
 	jz	L(0bytes)
 
+# ifdef __CHKP__
+	bndcu	5(%eax), %bnd0
+	bndcu	5(%edx), %bnd1
+# endif
 	mov	5(%eax), %bl
 	cmpb	5(%edx), %bl
 	jne	L(nonzero)
@@ -150,6 +179,10 @@ L(less8bytes):
 	cmp	$6, %ecx
 	jz	L(0bytes)
 
+# ifdef __CHKP__
+	bndcu	6(%eax), %bnd0
+	bndcu	6(%edx), %bnd1
+# endif
 	mov	6(%eax), %bl
 	cmpb	6(%edx), %bl
 	je	L(0bytes)
@@ -198,6 +231,14 @@ L(return0):
 	.p2align 4
 L(less1bytes):
 	jb	L(0bytesend)
+# ifdef __CHKP__
+	bndldx 	BLK1(%esp,%eax,1), %bnd0
+	bndldx 	BLK2(%esp,%edx,1), %bnd1
+	bndcl	(%eax), %bnd0
+	bndcl	(%edx), %bnd1
+	bndcu	(%eax), %bnd0
+	bndcu	(%edx), %bnd1
+# endif
 	movzbl	(%eax), %eax
 	movzbl	(%edx), %edx
 	sub	%edx, %eax
@@ -221,18 +262,30 @@ L(64bytesormore_loop):
 	ptest	%xmm2, %xmm0
 	jnc	L(find_16diff)
 
+# ifdef __CHKP__
+	bndcu	16(%eax), %bnd0
+	bndcu	16(%edx), %bnd1
+# endif
 	movdqu	16(%eax), %xmm1
 	movdqu	16(%edx), %xmm2
 	pxor	%xmm1, %xmm2
 	ptest	%xmm2, %xmm0
 	jnc	L(find_32diff)
 
+# ifdef __CHKP__
+	bndcu	32(%eax), %bnd0
+	bndcu	32(%edx), %bnd1
+# endif
 	movdqu	32(%eax), %xmm1
 	movdqu	32(%edx), %xmm2
 	pxor	%xmm1, %xmm2
 	ptest	%xmm2, %xmm0
 	jnc	L(find_48diff)
 
+# ifdef __CHKP__
+	bndcu	48(%eax), %bnd0
+	bndcu	48(%edx), %bnd1
+# endif
 	movdqu	48(%eax), %xmm1
 	movdqu	48(%edx), %xmm2
 	pxor	%xmm1, %xmm2

sysdeps/i386/i686/multiarch/memcpy.c

@@ -0,0 +1,40 @@
+#include <stddef.h>
+
+void *
+__memcpy (void *dst, const void *src, size_t n)
+{
+  const char *s = src;
+  char *d = dst;
+  void *ret = dst;
+  size_t offset_src = ((size_t) s) & (sizeof(size_t) - 1);
+  size_t offset_dst = ((size_t) d) & (sizeof(size_t) - 1);
+
+  if (offset_src != offset_dst)
+  {
+    while (n--)
+      *d++ = *s++;
+  }
+  else
+  {
+	 if (offset_src) offset_src = sizeof(size_t) - offset_src;
+    while (n-- && offset_src--)
+      *d++ = *s++;
+    n++;
+    if (!n) return ret;
+    void **d1 = (void **)d;
+    void **s1 = (void **)s;
+    while (n >= sizeof(void *))
+    {
+      n -= sizeof(void *);
+      *d1++ = *s1++;
+    }
+    s = (char *)s1;
+    d = (char *)d1;
+    while (n--)
+      *d++ = *s++;
+  }
+  return ret;
+}
+
+weak_alias (__memcpy, __GI_memcpy)
+weak_alias (__memcpy, memcpy)

sysdeps/i386/i686/multiarch/memcpy_chk.c

@@ -0,0 +1 @@
+#include <debug/memcpy_chk.c>

sysdeps/i386/i686/multiarch/memmove.c

@@ -0,0 +1,76 @@
+#include <stddef.h>
+
+void *
+__memmove (void *dst, const void *src, size_t n)
+{
+  const char *s = src;
+  char *d = dst;
+  void *ret = dst;
+  size_t offset_src = ((size_t) s) & (sizeof(size_t) - 1);
+  size_t offset_dst = ((size_t) d) & (sizeof(size_t) - 1);
+
+  if (offset_src != offset_dst)
+  {
+    if (s < d)
+    {
+      // backward copying
+      d += n;
+      s += n;
+      while (n--)
+        *--d = *--s;
+    }
+    else
+      // forward copying
+      while (n--)
+        *d++ = *s++;
+  }
+  else
+  {
+    if (s < d)
+    {
+		offset_src = (offset_src + (size_t)src) & (sizeof(size_t) - 1);
+      // backward copying
+      d += n;
+      s += n;
+      while (n-- && offset_src--)
+        *--d = *--s;
+      n++;
+      if (!n) return ret;
+      void **d1 = (void **)d;
+      void **s1 = (void **)s;
+      while (n >= sizeof(void *))
+      {
+        n -= sizeof(void *);
+        *--d1 = *--s1;
+      }
+      s = (char *)s1;
+      d = (char *)d1;
+      while (n--)
+        *--d = *--s;
+    }
+    else
+    {
+		if (offset_src) offset_src = sizeof(size_t) - offset_src;
+      // forward copying
+      while (n-- && offset_src--)
+        *d++ = *s++;
+      n++;
+      if (!n) return ret;
+      void **d1 = (void **)d;
+      void **s1 = (void **)s;
+      while (n >= sizeof(void *))
+      {
+        n -= sizeof(void *);
+        *d1++ = *s1++;
+      }
+      s = (char *)s1;
+      d = (char *)d1;
+      while (n--)
+        *d++ = *s++;
+    }
+  }
+  return ret;
+}
+
+weak_alias (__memmove, __GI_memmove)
+weak_alias (__memmove, memmove)

sysdeps/i386/i686/multiarch/memmove_chk.c

@@ -0,0 +1 @@
+#include <debug/memmove_chk.c>

sysdeps/i386/i686/multiarch/mempcpy.c

@@ -0,0 +1,40 @@
+#include <stddef.h>
+
+void *
+mempcpy (void *dst, const void *src, size_t n)
+{
+  const char *s = src;
+  char *d = dst;
+  void *ret = dst + n;
+  size_t offset_src = ((size_t) s) & (sizeof(size_t) - 1);
+  size_t offset_dst = ((size_t) d) & (sizeof(size_t) - 1);
+
+  if (offset_src != offset_dst)
+  {
+    while (n--)
+      *d++ = *s++;
+  }
+  else
+  {
+	 if (offset_src) offset_src = sizeof(size_t) - offset_src;
+    while (n-- && offset_src--)
+      *d++ = *s++;
+    n++;
+    if (!n) return ret;
+    void **d1 = (void **)d;
+    void **s1 = (void **)s;
+    while (n >= sizeof(void *))
+    {
+      n -= sizeof(void *);
+      *d1++ = *s1++;
+    }
+    s = (char *)s1;
+    d = (char *)d1;
+    while (n--)
+      *d++ = *s++;
+  }
+  return ret;
+}
+
+weak_alias (mempcpy, __GI_mempcpy)
+weak_alias (mempcpy, __mempcpy)

sysdeps/i386/i686/multiarch/mempcpy_chk.c

@@ -0,0 +1 @@
+#include <debug/mempcpy_chk.c>

sysdeps/i386/i686/multiarch/memrchr-sse2-bsf.S

@@ -45,6 +45,12 @@ ENTRY (MEMCHR)
 	movd	STR2(%esp), %xmm1
 	mov	LEN(%esp), %edx
 
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%ecx,1), %bnd0
+	bndcl  	(%ecx), %bnd0
+	bndcu  	-1(%ecx, %edx), %bnd0
+# endif
+
 	sub	$16, %edx
 	jbe	L(length_less16)
 

sysdeps/i386/i686/multiarch/memset-sse2-rep.S

@@ -90,6 +90,7 @@ ENTRY (__memset_sse2_rep)
 	ENTRANCE
 
 	movl	LEN(%esp), %ecx
+
 #ifdef USE_AS_BZERO
 	xor	%eax, %eax
 #else
@@ -101,6 +102,11 @@ ENTRY (__memset_sse2_rep)
 	or	%edx, %eax
 #endif
 	movl	DEST(%esp), %edx
+#ifdef __CHKP__
+	bndldx  DEST(%esp,%edx,1),%bnd0
+	bndcl  	(%edx), %bnd0
+	bndcu  	-1(%edx, %ecx), %bnd0
+#endif
 	cmp	$32, %ecx
 	jae	L(32bytesormore)
 

sysdeps/i386/i686/multiarch/mpx_memmove_nobnd.S

@@ -0,0 +1,3 @@
+#define USE_AS_MEMMOVE
+#define MEMCPY		mpx_memmove_nobnd
+#include "mpx_memcpy_nobnd.S"

sysdeps/i386/i686/multiarch/mpx_mempcpy_nobnd.S

@@ -0,0 +1,3 @@
+#define USE_AS_MEMPCPY
+#define MEMCPY		mpx_mempcpy_nobnd
+#include "mpx_memcpy_nobnd.S"

sysdeps/i386/i686/multiarch/strcat-sse2.S

@@ -94,11 +94,21 @@ ENTRY (STRCAT)
 	movl	LEN(%esp), %ebx
 	test	%ebx, %ebx
 	jz	L(ExitZero)
+# endif
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%eax,1), %bnd0
+	bndldx 	STR2(%esp,%esi,1), %bnd1
+	bndcl  	(%esi), %bnd1
+	bndcu  	(%esi), %bnd1
 # endif
 	cmpb	$0, (%esi)
 	mov	%esi, %ecx
 	mov	%eax, %edx
 	jz	L(ExitZero)
+# ifdef __CHKP__
+	bndcl  	(%eax), %bnd0
+	bndcu  	(%eax), %bnd0
+# endif
 
 	and	$63, %ecx
 	and	$63, %edx
@@ -113,6 +123,9 @@ ENTRY (STRCAT)
 	movdqu	(%eax), %xmm1
 	movdqu	(%esi), %xmm5
 	pcmpeqb	%xmm1, %xmm0
+# ifdef __CHKP__
+	bndcu  	16(%esi), %bnd1
+# endif
 	movdqu	16(%esi), %xmm6
 	pmovmskb %xmm0, %ecx
 	pcmpeqb	%xmm5, %xmm4
@@ -132,6 +145,9 @@ L(alignment_prolog):
 	and	$-16, %eax
 	pcmpeqb	(%eax), %xmm0
 	movdqu	(%esi), %xmm5
+# ifdef __CHKP__
+	bndcu  	16(%esi), %bnd1
+# endif
 	movdqu	16(%esi), %xmm6
 	pmovmskb %xmm0, %edx
 	pcmpeqb	%xmm5, %xmm4
@@ -148,21 +164,33 @@ L(loop_prolog):
 	pxor	%xmm3, %xmm3
 	.p2align 4
 L(align16_loop):
+# ifdef __CHKP__
+	bndcu  	16(%eax), %bnd0
+# endif
 	pcmpeqb	16(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	jnz	L(exit16)
 
+# ifdef __CHKP__
+	bndcu  	32(%eax), %bnd0
+# endif
 	pcmpeqb	32(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	test	%edx, %edx
 	jnz	L(exit32)
 
+# ifdef __CHKP__
+	bndcu  	48(%eax), %bnd0
+# endif
 	pcmpeqb	48(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	test	%edx, %edx
 	jnz	L(exit48)
 
+# ifdef __CHKP__
+	bndcu  	64(%eax), %bnd0
+# endif
 	pcmpeqb	64(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	lea	64(%eax), %eax
@@ -212,6 +240,9 @@ L(StartStrcpyPart):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesTail1)
 
+# ifdef __CHKP__
+	bndcu  	15(%eax), %bnd0
+# endif
 	movdqu	%xmm5, (%eax)
 	pmovmskb %xmm7, %edx
 # ifdef USE_AS_STRNCAT
@@ -250,21 +281,33 @@ L(StrlenCore7_1):
 
 	.p2align 4
 L(align16_loop_1):
+# ifdef __CHKP__
+	bndcu  	16(%eax), %bnd0
+# endif
 	pcmpeqb	16(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	jnz	L(exit16_1)
 
+# ifdef __CHKP__
+	bndcu  	32(%eax), %bnd0
+# endif
 	pcmpeqb	32(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	test	%edx, %edx
 	jnz	L(exit32_1)
 
+# ifdef __CHKP__
+	bndcu  	48(%eax), %bnd0
+# endif
 	pcmpeqb	48(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	test	%edx, %edx
 	jnz	L(exit48_1)
 
+# ifdef __CHKP__
+	bndcu  	64(%eax), %bnd0
+# endif
 	pcmpeqb	64(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	lea	64(%eax), %eax
@@ -323,6 +366,9 @@ L(StartStrcpyPart_1):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesTail)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi), %bnd1
+# endif
 	pcmpeqb	16(%esi), %xmm0
 	pmovmskb %xmm0, %edx
 # ifdef USE_AS_STRNCAT
@@ -341,6 +387,9 @@ L(Unalign16Both):
 	mov	$16, %ecx
 	movdqa	(%esi, %ecx), %xmm1
 	movaps	16(%esi, %ecx), %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movdqu	%xmm1, (%eax, %ecx)
 	pcmpeqb	%xmm2, %xmm0
 	pmovmskb %xmm0, %edx
@@ -352,6 +401,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16Bytes)
 L(Unalign16BothBigN):
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm3
 	movdqu	%xmm2, (%eax, %ecx)
 	pcmpeqb	%xmm3, %xmm0
@@ -364,6 +417,10 @@ L(Unalign16BothBigN):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm4
 	movdqu	%xmm3, (%eax, %ecx)
 	pcmpeqb	%xmm4, %xmm0
@@ -376,6 +433,10 @@ L(Unalign16BothBigN):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm1
 	movdqu	%xmm4, (%eax, %ecx)
 	pcmpeqb	%xmm1, %xmm0
@@ -388,6 +449,10 @@ L(Unalign16BothBigN):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm2
 	movdqu	%xmm1, (%eax, %ecx)
 	pcmpeqb	%xmm2, %xmm0
@@ -400,6 +465,10 @@ L(Unalign16BothBigN):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm3
 	movdqu	%xmm2, (%eax, %ecx)
 	pcmpeqb	%xmm3, %xmm0
@@ -412,6 +481,9 @@ L(Unalign16BothBigN):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movdqu	%xmm3, (%eax, %ecx)
 	mov	%esi, %edx
 	lea	16(%esi, %ecx), %esi
@@ -420,6 +492,9 @@ L(Unalign16BothBigN):
 	sub	%edx, %eax
 # ifdef USE_AS_STRNCAT
 	lea	128(%ebx, %edx), %ebx
+# endif
+# ifdef __CHKP__
+	bndcu  	(%esi), %bnd1
 # endif
 	movaps	(%esi), %xmm2
 	movaps	%xmm2, %xmm4
@@ -443,6 +518,10 @@ L(Unalign16BothBigN):
 L(Unaligned64Loop_start):
 	add	$64, %eax
 	add	$64, %esi
+# ifdef __CHKP__
+	bndcu  	(%esi), %bnd1
+	bndcu  	-1(%eax), %bnd0
+# endif
 	movdqu	%xmm4, -64(%eax)
 	movaps	(%esi), %xmm2
 	movdqa	%xmm2, %xmm4
@@ -485,11 +564,18 @@ L(Unaligned64Leave):
 	jnz	L(CopyFrom1To16BytesUnaligned_32)
 
 	bsf	%ecx, %edx
+# ifdef __CHKP__
+	bndcu  	47(%eax), %bnd0
+# endif
 	movdqu	%xmm4, (%eax)
 	movdqu	%xmm5, 16(%eax)
 	movdqu	%xmm6, 32(%eax)
 	add	$48, %esi
 	add	$48, %eax
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 # ifdef USE_AS_STRNCAT
@@ -501,12 +587,18 @@ L(BigN):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesTail)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi), %bnd1
+# endif
 	pcmpeqb	16(%esi), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	jnz	L(CopyFrom1To32Bytes)
 
 	movdqu	(%esi, %ecx), %xmm1   /* copy 16 bytes */
+# ifdef __CHKP__
+	bndcu  	15(%eax), %bnd0
+# endif
 	movdqu	%xmm1, (%eax)
 	sub	%ecx, %eax
 	sub     $48, %ebx
@@ -515,6 +607,9 @@ L(BigN):
 	mov	$16, %ecx
 	movdqa	(%esi, %ecx), %xmm1
 	movaps	16(%esi, %ecx), %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%eax, %ecx), %bnd0
+# endif
 	movdqu	%xmm1, (%eax, %ecx)
 	pcmpeqb	%xmm2, %xmm0
 	pmovmskb %xmm0, %edx
@@ -532,12 +627,20 @@ L(CopyFrom1To16Bytes):
 	add	%ecx, %eax
 	add	%ecx, %esi
 	bsf	%edx, %edx
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 	.p2align 4
 L(CopyFrom1To16BytesTail):
 	add	%ecx, %esi
 	bsf	%edx, %edx
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 	.p2align 4
@@ -546,6 +649,10 @@ L(CopyFrom1To32Bytes1):
 	add	$16, %eax
 L(CopyFrom1To16BytesTail1):
 	bsf	%edx, %edx
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 	.p2align 4
@@ -554,34 +661,60 @@ L(CopyFrom1To32Bytes):
 	add	%ecx, %esi
 	add	$16, %edx
 	sub	%ecx, %edx
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 	.p2align 4
 L(CopyFrom1To16BytesUnaligned_0):
 	bsf	%edx, %edx
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 	.p2align 4
 L(CopyFrom1To16BytesUnaligned_16):
 	bsf	%ecx, %edx
+# ifdef __CHKP__
+	bndcu  	15(%eax), %bnd0
+# endif
 	movdqu	%xmm4, (%eax)
 	add	$16, %esi
 	add	$16, %eax
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 	.p2align 4
 L(CopyFrom1To16BytesUnaligned_32):
 	bsf	%edx, %edx
+# ifdef __CHKP__
+	bndcu  	31(%eax), %bnd0
+# endif
 	movdqu	%xmm4, (%eax)
 	movdqu	%xmm5, 16(%eax)
 	add	$32, %esi
 	add	$32, %eax
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 # ifdef USE_AS_STRNCAT
 
 	.p2align 4
 L(CopyFrom1To16BytesExit):
+# ifdef __CHKP__
+	bndcu  	(%eax, %edx), %bnd0
+	bndcu  	(%esi, %edx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
 /* Case2 */
@@ -594,6 +727,10 @@ L(CopyFrom1To16BytesCase2):
 	bsf	%edx, %edx
 	cmp	%ebx, %edx
 	jb	L(CopyFrom1To16BytesExit)
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 	.p2align 4
@@ -605,6 +742,10 @@ L(CopyFrom1To32BytesCase2):
 	sub	%ecx, %edx
 	cmp	%ebx, %edx
 	jb	L(CopyFrom1To16BytesExit)
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 L(CopyFrom1To16BytesTailCase2):
@@ -613,12 +754,20 @@ L(CopyFrom1To16BytesTailCase2):
 	bsf	%edx, %edx
 	cmp	%ebx, %edx
 	jb	L(CopyFrom1To16BytesExit)
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 L(CopyFrom1To16BytesTail1Case2):
 	bsf	%edx, %edx
 	cmp	%ebx, %edx
 	jb	L(CopyFrom1To16BytesExit)
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 /* Case2 or Case3,  Case3 */
@@ -631,6 +780,10 @@ L(CopyFrom1To16BytesCase3):
 	add	$16, %ebx
 	add	%ecx, %eax
 	add	%ecx, %esi
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 	.p2align 4
@@ -639,6 +792,10 @@ L(CopyFrom1To32BytesCase2OrCase3):
 	jnz	L(CopyFrom1To32BytesCase2)
 	sub	%ecx, %ebx
 	add	%ecx, %esi
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 	.p2align 4
@@ -647,6 +804,10 @@ L(CopyFrom1To16BytesTailCase2OrCase3):
 	jnz	L(CopyFrom1To16BytesTailCase2)
 	sub	%ecx, %ebx
 	add	%ecx, %esi
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 	.p2align 4
@@ -657,6 +818,10 @@ L(CopyFrom1To32Bytes1Case2OrCase3):
 L(CopyFrom1To16BytesTail1Case2OrCase3):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesTail1Case2)
+# ifdef __CHKP__
+	bndcu  	1(%eax, %ebx), %bnd0
+	bndcu  	1(%esi, %ebx), %bnd1
+# endif
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitStrncatTable), %ebx, 4)
 
 # endif
@@ -1110,15 +1275,27 @@ L(Unaligned64LeaveCase3):
 	and	$-16, %ecx
 	add	$48, %ebx
 	jl	L(CopyFrom1To16BytesCase3)
+# ifdef __CHKP__
+	bndcu  	15(%eax), %bnd0
+# endif
 	movdqu	%xmm4, (%eax)
 	sub	$16, %ebx
 	jb	L(CopyFrom1To16BytesCase3)
+# ifdef __CHKP__
+	bndcu  	31(%eax), %bnd0
+# endif
 	movdqu	%xmm5, 16(%eax)
 	sub	$16, %ebx
 	jb	L(CopyFrom1To16BytesCase3)
+# ifdef __CHKP__
+	bndcu  	47(%eax), %bnd0
+# endif
 	movdqu	%xmm6, 32(%eax)
 	sub	$16, %ebx
 	jb	L(CopyFrom1To16BytesCase3)
+# ifdef __CHKP__
+	bndcu  	63(%eax), %bnd0
+# endif
 	movdqu	%xmm7, 48(%eax)
 	xor	%bh, %bh
 	movb	%bh, 64(%eax)
@@ -1137,6 +1314,9 @@ L(Unaligned64LeaveCase2):
 
 	pcmpeqb	%xmm5, %xmm0
 	pmovmskb %xmm0, %edx
+# ifdef __CHKP__
+	bndcu  	15(%eax), %bnd0
+# endif
 	movdqu	%xmm4, (%eax)
 	add	$16, %ecx
 	sub	$16, %ebx
@@ -1146,6 +1326,9 @@ L(Unaligned64LeaveCase2):
 
 	pcmpeqb	%xmm6, %xmm0
 	pmovmskb %xmm0, %edx
+# ifdef __CHKP__
+	bndcu  	31(%eax), %bnd0
+# endif
 	movdqu	%xmm5, 16(%eax)
 	add	$16, %ecx
 	sub	$16, %ebx
@@ -1155,6 +1338,9 @@ L(Unaligned64LeaveCase2):
 
 	pcmpeqb	%xmm7, %xmm0
 	pmovmskb %xmm0, %edx
+# ifdef __CHKP__
+	bndcu  	47(%eax), %bnd0
+# endif
 	movdqu	%xmm6, 32(%eax)
 	lea	16(%eax, %ecx), %eax
 	lea	16(%esi, %ecx), %esi

sysdeps/i386/i686/multiarch/strchr-sse2-bsf.S

@@ -46,6 +46,12 @@ ENTRY (__strchr_sse2_bsf)
 	mov	STR1(%esp), %ecx
 	movd	STR2(%esp), %xmm1
 
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%ecx,1), %bnd0
+	bndcl  	(%ecx), %bnd0
+	bndcu  	(%ecx), %bnd0
+# endif
+
 	pxor	%xmm2, %xmm2
 	mov	%ecx, %edi
 	punpcklbw %xmm1, %xmm1
@@ -81,6 +87,9 @@ ENTRY (__strchr_sse2_bsf)
 L(unaligned_match):
 	add	%edi, %eax
 	add	%ecx, %eax
+# ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+# endif
 	RETURN
 
 	.p2align 4
@@ -94,6 +103,9 @@ L(unaligned_no_match):
 	.p2align 4
 /* Loop start on aligned string.  */
 L(loop):
+# ifdef __CHKP__
+	bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -103,6 +115,9 @@ L(loop):
 	or	%eax, %edx
 	jnz	L(matches)
 
+# ifdef __CHKP__
+	bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -112,6 +127,9 @@ L(loop):
 	or	%eax, %edx
 	jnz	L(matches)
 
+# ifdef __CHKP__
+	bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -121,6 +139,9 @@ L(loop):
 	or	%eax, %edx
 	jnz	L(matches)
 
+# ifdef __CHKP__
+	bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -146,6 +167,9 @@ L(matches):
 L(match):
 	sub	$16, %edi
 	add	%edi, %eax
+# ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+# endif
 	RETURN
 
 /* Return NULL.  */

sysdeps/i386/i686/multiarch/strcmp-sse4.S

@@ -221,6 +221,12 @@ L(ascii):
 	movl	CNT(%esp), REM
 	test	REM, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndldx 	STR1(%esp,%edx,1), %bnd0
+	bndldx 	STR2(%esp,%eax,1), %bnd1
+	bndcl  	(%edx), %bnd0
+	bndcl  	(%eax), %bnd1
 #endif
 	mov	%dx, %cx
 	and	$0xfff, %cx
@@ -280,6 +286,10 @@ L(ascii):
 	add	$16, %edx
 	add	$16, %eax
 L(first4bytes):
+#ifdef __CHKP__
+	bndcu  	(%edx), %bnd0
+	bndcu  	(%eax), %bnd1
+#endif
 	movzbl	(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
 	movzbl	(%edx), %edi
@@ -303,6 +313,10 @@ L(first4bytes):
 	je	L(eq)
 #endif
 
+#ifdef __CHKP__
+	bndcu  	1(%edx), %bnd0
+	bndcu  	1(%eax), %bnd1
+#endif
 	movzbl	1(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
 	movzbl	1(%edx), %edi
@@ -324,6 +338,10 @@ L(first4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$2, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	2(%edx), %bnd0
+	bndcu  	2(%eax), %bnd1
 #endif
 	movzbl	2(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -346,6 +364,10 @@ L(first4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$3, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	3(%edx), %bnd0
+	bndcu  	3(%eax), %bnd1
 #endif
 	movzbl	3(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -368,6 +390,10 @@ L(first4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$4, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	4(%edx), %bnd0
+	bndcu  	4(%eax), %bnd1
 #endif
 	movzbl	4(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -390,6 +416,10 @@ L(first4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$5, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	5(%edx), %bnd0
+	bndcu  	5(%eax), %bnd1
 #endif
 	movzbl	5(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -412,6 +442,10 @@ L(first4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$6, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	6(%edx), %bnd0
+	bndcu  	6(%eax), %bnd1
 #endif
 	movzbl	6(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -434,6 +468,10 @@ L(first4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$7, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+	bndcu  	7(%eax), %bnd1
 #endif
 	movzbl	7(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -483,6 +521,10 @@ L(check_offset):
 	testl	%edx, %edx
 	jg	L(crosspage)
 L(loop):
+#ifdef __CHKP__
+	bndcu  	(%edi,%edx), %bnd0
+	bndcu  	(%esi,%edx), %bnd1
+#endif
 	movdqu	(%esi,%edx), %xmm2
 	movdqu	(%edi,%edx), %xmm1
 	TOLOWER (%xmm2, %xmm1)
@@ -497,6 +539,10 @@ L(loop):
 	add	$16, %edx
 	jle	L(loop)
 L(crosspage):
+#ifdef __CHKP__
+	bndcu  	(%edi,%edx), %bnd0
+	bndcu  	(%esi,%edx), %bnd1
+#endif
 	movzbl	(%edi,%edx), %eax
 	movzbl	(%esi,%edx), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -625,6 +671,10 @@ L(less16bytes):
 	add	$8, %eax
 L(less4bytes):
 
+#ifdef __CHKP__
+	bndcu  	(%edx), %bnd0
+	bndcu  	(%eax), %bnd1
+#endif
 	movzbl	(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
 	movzbl	(%edx), %edi
@@ -646,6 +696,10 @@ L(less4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$1, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	1(%edx), %bnd0
+	bndcu  	1(%eax), %bnd1
 #endif
 	movzbl	1(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -670,6 +724,10 @@ L(less4bytes):
 	je	L(eq)
 #endif
 
+#ifdef __CHKP__
+	bndcu  	2(%edx), %bnd0
+	bndcu  	2(%eax), %bnd1
+#endif
 	movzbl	2(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
 	movzbl	2(%edx), %edi
@@ -691,6 +749,10 @@ L(less4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$3, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	3(%edx), %bnd0
+	bndcu  	3(%eax), %bnd1
 #endif
 	movzbl	3(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -714,6 +776,10 @@ L(more4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$4, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	4(%edx), %bnd0
+	bndcu  	4(%eax), %bnd1
 #endif
 	movzbl	4(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -737,6 +803,10 @@ L(more4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$5, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	5(%edx), %bnd0
+	bndcu  	5(%eax), %bnd1
 #endif
 	movzbl	5(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -759,6 +829,10 @@ L(more4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$6, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	6(%edx), %bnd0
+	bndcu  	6(%eax), %bnd1
 #endif
 	movzbl	6(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L
@@ -781,6 +855,10 @@ L(more4bytes):
 #if defined USE_AS_STRNCMP || defined USE_AS_STRNCASECMP_L
 	cmp	$7, REM
 	je	L(eq)
+#endif
+#ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+	bndcu  	7(%eax), %bnd1
 #endif
 	movzbl	7(%eax), %ecx
 #if defined USE_AS_STRCASECMP_L || defined USE_AS_STRNCASECMP_L

sysdeps/i386/i686/multiarch/strcpy-sse2.S

@@ -85,6 +85,14 @@ ENTRY (STRCPY)
 	movl	LEN(%esp), %ebx
 	test	%ebx, %ebx
 	jz	L(ExitZero)
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%edi,1), %bnd0
+	bndldx 	STR2(%esp,%esi,1), %bnd1
+	bndcl  	(%esi), %bnd1
+	bndcu  	(%esi), %bnd1
+	bndcl  	(%edi), %bnd0
+	bndcu  	-1(%edi, %ebx), %bnd0
+# endif
 
 	mov	%esi, %ecx
 # ifndef USE_AS_STPCPY
@@ -111,6 +119,9 @@ ENTRY (STRCPY)
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesTail)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi), %bnd1
+# endif
 	pcmpeqb	16(%esi), %xmm0
 	pmovmskb %xmm0, %edx
 # ifdef USE_AS_STPCPY
@@ -124,6 +135,9 @@ ENTRY (STRCPY)
 	jnz	L(CopyFrom1To32Bytes)
 
 	movdqu	(%esi, %ecx), %xmm1   /* copy 16 bytes */
+# ifdef __CHKP__
+	bndcu  	15(%edi), %bnd0
+# endif
 	movdqu	%xmm1, (%edi)
 
 	sub	%ecx, %edi
@@ -132,6 +146,10 @@ ENTRY (STRCPY)
 	.p2align 4
 L(Unalign16Both):
 	mov	$16, %ecx
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movdqa	(%esi, %ecx), %xmm1
 	movaps	16(%esi, %ecx), %xmm2
 	movdqu	%xmm1, (%edi, %ecx)
@@ -143,6 +161,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesUnalignedXmm2)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm3
 	movdqu	%xmm2, (%edi, %ecx)
 	pcmpeqb	%xmm3, %xmm0
@@ -153,6 +175,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesUnalignedXmm3)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm4
 	movdqu	%xmm3, (%edi, %ecx)
 	pcmpeqb	%xmm4, %xmm0
@@ -163,6 +189,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesUnalignedXmm4)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm1
 	movdqu	%xmm4, (%edi, %ecx)
 	pcmpeqb	%xmm1, %xmm0
@@ -173,6 +203,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesUnalignedXmm1)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm2
 	movdqu	%xmm1, (%edi, %ecx)
 	pcmpeqb	%xmm2, %xmm0
@@ -183,6 +217,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesUnalignedXmm2)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movaps	16(%esi, %ecx), %xmm3
 	movdqu	%xmm2, (%edi, %ecx)
 	pcmpeqb	%xmm3, %xmm0
@@ -193,6 +231,10 @@ L(Unalign16Both):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesUnalignedXmm3)
 
+# ifdef __CHKP__
+	bndcu  	16(%esi, %ecx), %bnd1
+	bndcu  	15(%edi, %ecx), %bnd0
+# endif
 	movdqu	%xmm3, (%edi, %ecx)
 	mov	%esi, %edx
 	lea	16(%esi, %ecx), %esi
@@ -202,6 +244,9 @@ L(Unalign16Both):
 	lea	128(%ebx, %edx), %ebx
 
 L(Unaligned64Loop):
+# ifdef __CHKP__
+	bndcu  	48(%esi), %bnd1
+# endif
 	movaps	(%esi), %xmm2
 	movaps	%xmm2, %xmm4
 	movaps	16(%esi), %xmm5
@@ -220,6 +265,10 @@ L(Unaligned64Loop):
 L(Unaligned64Loop_start):
 	add	$64, %edi
 	add	$64, %esi
+# ifdef __CHKP__
+	bndcu  	(%esi), %bnd1
+	bndcu  	(%edi), %bnd0
+# endif
 	movdqu	%xmm4, -64(%edi)
 	movaps	(%esi), %xmm2
 	movdqa	%xmm2, %xmm4
@@ -259,15 +308,27 @@ L(Unaligned64Leave):
 	jnz	L(CopyFrom1To16BytesUnaligned_32)
 
 	bsf	%ecx, %edx
+# ifdef __CHKP__
+	bndcu  	47(%edi), %bnd0
+# endif
 	movdqu	%xmm4, (%edi)
 	movdqu	%xmm5, 16(%edi)
 	movdqu	%xmm6, 32(%edi)
 # ifdef USE_AS_STPCPY
+#  ifdef __CHKP__
+	bndcu  	48(%edi, %edx), %bnd0
+#  endif
 	lea	48(%edi, %edx), %eax
+# endif
+# ifdef __CHKP__
+	bndcu  	63(%edi), %bnd0
 # endif
 	movdqu	%xmm7, 48(%edi)
 	add	$15, %ebx
 	sub	%edx, %ebx
+#  ifdef __CHKP__
+	bndcu  	49(%edi, %edx), %bnd0
+#  endif
 	lea	49(%edi, %edx), %edi
 	jmp	L(StrncpyFillTailWithZero)
 
@@ -288,6 +349,10 @@ L(SourceStringAlignmentZero):
 	test	%edx, %edx
 	jnz	L(CopyFrom1To16BytesTail1)
 
+# ifdef __CHKP__
+	bndcu  	15(%edi), %bnd0
+	bndcu  	16(%esi), %bnd1
+# endif
 	pcmpeqb	16(%esi), %xmm0
 	movdqu	%xmm1, (%edi)
 	pmovmskb %xmm0, %edx
@@ -313,7 +378,7 @@ L(CopyFrom1To16BytesTail):
 	bsf	%edx, %edx
 	BRANCH_TO_JMPTBL_ENTRY (L(ExitTable), %edx, 4)
 
-	.p2align 4
+	.p2align 9
 L(CopyFrom1To32Bytes1):
 	add	$16, %esi
 	add	$16, %edi
@@ -336,6 +401,9 @@ L(CopyFrom1To16BytesUnaligned_0):
 	bsf	%edx, %edx
 # ifdef USE_AS_STPCPY
 	lea	(%edi, %edx), %eax
+# endif
+# ifdef __CHKP__
+        bndcu   15(%edi), %bnd0
 # endif
 	movdqu	%xmm4, (%edi)
 	add	$63, %ebx
@@ -349,6 +417,9 @@ L(CopyFrom1To16BytesUnaligned_16):
 	movdqu	%xmm4, (%edi)
 # ifdef USE_AS_STPCPY
 	lea	16(%edi, %edx), %eax
+# endif
+# ifdef __CHKP__
+        bndcu   31(%edi), %bnd0
 # endif
 	movdqu	%xmm5, 16(%edi)
 	add	$47, %ebx
@@ -363,6 +434,9 @@ L(CopyFrom1To16BytesUnaligned_32):
 	movdqu	%xmm5, 16(%edi)
 # ifdef USE_AS_STPCPY
 	lea	32(%edi, %edx), %eax
+# endif
+# ifdef __CHKP__
+        bndcu   47(%edi), %bnd0
 # endif
 	movdqu	%xmm6, 32(%edi)
 	add	$31, %ebx
@@ -495,6 +569,9 @@ L(Exit1):
 	.p2align 4
 L(Exit2):
 	movw	(%esi), %dx
+# ifdef __CHKP__
+        bndcu   1(%edi), %bnd0
+# endif
 	movw	%dx, (%edi)
 # ifdef USE_AS_STPCPY
 	lea	1(%edi), %eax
@@ -507,6 +584,9 @@ L(Exit2):
 	.p2align 4
 L(Exit3):
 	movw	(%esi), %cx
+# ifdef __CHKP__
+        bndcu   2(%edi), %bnd0
+# endif
 	movw	%cx, (%edi)
 	movb	%dh, 2(%edi)
 # ifdef USE_AS_STPCPY
@@ -520,6 +600,9 @@ L(Exit3):
 	.p2align 4
 L(Exit4):
 	movl	(%esi), %edx
+# ifdef __CHKP__
+        bndcu   3(%edi), %bnd0
+# endif
 	movl	%edx, (%edi)
 # ifdef USE_AS_STPCPY
 	lea	3(%edi), %eax
@@ -532,6 +615,9 @@ L(Exit4):
 	.p2align 4
 L(Exit5):
 	movl	(%esi), %ecx
+# ifdef __CHKP__
+        bndcu   4(%edi), %bnd0
+# endif
 	movb	%dh, 4(%edi)
 	movl	%ecx, (%edi)
 # ifdef USE_AS_STPCPY
@@ -546,6 +632,9 @@ L(Exit5):
 L(Exit6):
 	movl	(%esi), %ecx
 	movw	4(%esi), %dx
+# ifdef __CHKP__
+        bndcu   5(%edi), %bnd0
+# endif
 	movl	%ecx, (%edi)
 	movw	%dx, 4(%edi)
 # ifdef USE_AS_STPCPY
@@ -560,6 +649,9 @@ L(Exit6):
 L(Exit7):
 	movl	(%esi), %ecx
 	movl	3(%esi), %edx
+# ifdef __CHKP__
+        bndcu   6(%edi), %bnd0
+# endif
 	movl	%ecx, (%edi)
 	movl	%edx, 3(%edi)
 # ifdef USE_AS_STPCPY
@@ -573,6 +665,9 @@ L(Exit7):
 	.p2align 4
 L(Exit8):
 	movlpd	(%esi), %xmm0
+# ifdef __CHKP__
+        bndcu   7(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 # ifdef USE_AS_STPCPY
 	lea	7(%edi), %eax
@@ -585,6 +680,9 @@ L(Exit8):
 	.p2align 4
 L(Exit9):
 	movlpd	(%esi), %xmm0
+# ifdef __CHKP__
+        bndcu   8(%edi), %bnd0
+# endif
 	movb	%dh, 8(%edi)
 	movlpd	%xmm0, (%edi)
 # ifdef USE_AS_STPCPY
@@ -599,6 +697,9 @@ L(Exit9):
 L(Exit10):
 	movlpd	(%esi), %xmm0
 	movw	8(%esi), %dx
+# ifdef __CHKP__
+        bndcu   9(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 	movw	%dx, 8(%edi)
 # ifdef USE_AS_STPCPY
@@ -613,6 +714,9 @@ L(Exit10):
 L(Exit11):
 	movlpd	(%esi), %xmm0
 	movl	7(%esi), %edx
+# ifdef __CHKP__
+        bndcu   10(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 	movl	%edx, 7(%edi)
 # ifdef USE_AS_STPCPY
@@ -627,6 +731,9 @@ L(Exit11):
 L(Exit12):
 	movlpd	(%esi), %xmm0
 	movl	8(%esi), %edx
+# ifdef __CHKP__
+        bndcu   11(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 	movl	%edx, 8(%edi)
 # ifdef USE_AS_STPCPY
@@ -641,6 +748,9 @@ L(Exit12):
 L(Exit13):
 	movlpd	(%esi), %xmm0
 	movlpd	5(%esi), %xmm1
+# ifdef __CHKP__
+        bndcu   12(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 	movlpd	%xmm1, 5(%edi)
 # ifdef USE_AS_STPCPY
@@ -655,6 +765,9 @@ L(Exit13):
 L(Exit14):
 	movlpd	(%esi), %xmm0
 	movlpd	6(%esi), %xmm1
+# ifdef __CHKP__
+        bndcu   13(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 	movlpd	%xmm1, 6(%edi)
 # ifdef USE_AS_STPCPY
@@ -669,6 +782,9 @@ L(Exit14):
 L(Exit15):
 	movlpd	(%esi), %xmm0
 	movlpd	7(%esi), %xmm1
+# ifdef __CHKP__
+        bndcu   14(%edi), %bnd0
+# endif
 	movlpd	%xmm0, (%edi)
 	movlpd	%xmm1, 7(%edi)
 # ifdef USE_AS_STPCPY
@@ -682,6 +798,9 @@ L(Exit15):
 	.p2align 4
 L(Exit16):
 	movdqu	(%esi), %xmm0
+# ifdef __CHKP__
+        bndcu   15(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 # ifdef USE_AS_STPCPY
 	lea	15(%edi), %eax
@@ -694,6 +813,9 @@ L(Exit16):
 	.p2align 4
 L(Exit17):
 	movdqu	(%esi), %xmm0
+# ifdef __CHKP__
+        bndcu   16(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movb	%dh, 16(%edi)
 # ifdef USE_AS_STPCPY
@@ -708,6 +830,9 @@ L(Exit17):
 L(Exit18):
 	movdqu	(%esi), %xmm0
 	movw	16(%esi), %cx
+# ifdef __CHKP__
+        bndcu   17(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movw	%cx, 16(%edi)
 # ifdef USE_AS_STPCPY
@@ -722,6 +847,9 @@ L(Exit18):
 L(Exit19):
 	movdqu	(%esi), %xmm0
 	movl	15(%esi), %ecx
+# ifdef __CHKP__
+        bndcu   18(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movl	%ecx, 15(%edi)
 # ifdef USE_AS_STPCPY
@@ -736,6 +864,9 @@ L(Exit19):
 L(Exit20):
 	movdqu	(%esi), %xmm0
 	movl	16(%esi), %ecx
+# ifdef __CHKP__
+        bndcu   19(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movl	%ecx, 16(%edi)
 # ifdef USE_AS_STPCPY
@@ -750,6 +881,9 @@ L(Exit20):
 L(Exit21):
 	movdqu	(%esi), %xmm0
 	movl	16(%esi), %ecx
+# ifdef __CHKP__
+        bndcu   20(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movl	%ecx, 16(%edi)
 	movb	%dh, 20(%edi)
@@ -765,6 +899,9 @@ L(Exit21):
 L(Exit22):
 	movdqu	(%esi), %xmm0
 	movlpd	14(%esi), %xmm3
+# ifdef __CHKP__
+        bndcu   21(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm3, 14(%edi)
 # ifdef USE_AS_STPCPY
@@ -779,6 +916,9 @@ L(Exit22):
 L(Exit23):
 	movdqu	(%esi), %xmm0
 	movlpd	15(%esi), %xmm3
+# ifdef __CHKP__
+        bndcu   22(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm3, 15(%edi)
 # ifdef USE_AS_STPCPY
@@ -793,6 +933,9 @@ L(Exit23):
 L(Exit24):
 	movdqu	(%esi), %xmm0
 	movlpd	16(%esi), %xmm2
+# ifdef __CHKP__
+        bndcu   23(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm2, 16(%edi)
 # ifdef USE_AS_STPCPY
@@ -807,6 +950,9 @@ L(Exit24):
 L(Exit25):
 	movdqu	(%esi), %xmm0
 	movlpd	16(%esi), %xmm2
+# ifdef __CHKP__
+        bndcu   24(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm2, 16(%edi)
 	movb	%dh, 24(%edi)
@@ -823,6 +969,9 @@ L(Exit26):
 	movdqu	(%esi), %xmm0
 	movlpd	16(%esi), %xmm2
 	movw	24(%esi), %cx
+# ifdef __CHKP__
+        bndcu   25(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm2, 16(%edi)
 	movw	%cx, 24(%edi)
@@ -839,6 +988,9 @@ L(Exit27):
 	movdqu	(%esi), %xmm0
 	movlpd	16(%esi), %xmm2
 	movl	23(%esi), %ecx
+# ifdef __CHKP__
+        bndcu   26(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm2, 16(%edi)
 	movl	%ecx, 23(%edi)
@@ -855,6 +1007,9 @@ L(Exit28):
 	movdqu	(%esi), %xmm0
 	movlpd	16(%esi), %xmm2
 	movl	24(%esi), %ecx
+# ifdef __CHKP__
+        bndcu   27(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movlpd	%xmm2, 16(%edi)
 	movl	%ecx, 24(%edi)
@@ -870,6 +1025,9 @@ L(Exit28):
 L(Exit29):
 	movdqu	(%esi), %xmm0
 	movdqu	13(%esi), %xmm2
+# ifdef __CHKP__
+        bndcu   28(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movdqu	%xmm2, 13(%edi)
 # ifdef USE_AS_STPCPY
@@ -884,6 +1042,9 @@ L(Exit29):
 L(Exit30):
 	movdqu	(%esi), %xmm0
 	movdqu	14(%esi), %xmm2
+# ifdef __CHKP__
+        bndcu   29(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movdqu	%xmm2, 14(%edi)
 # ifdef USE_AS_STPCPY
@@ -899,6 +1060,9 @@ L(Exit30):
 L(Exit31):
 	movdqu	(%esi), %xmm0
 	movdqu	15(%esi), %xmm2
+# ifdef __CHKP__
+        bndcu   30(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movdqu	%xmm2, 15(%edi)
 # ifdef USE_AS_STPCPY
@@ -913,6 +1077,9 @@ L(Exit31):
 L(Exit32):
 	movdqu	(%esi), %xmm0
 	movdqu	16(%esi), %xmm2
+# ifdef __CHKP__
+        bndcu   31(%edi), %bnd0
+# endif
 	movdqu	%xmm0, (%edi)
 	movdqu	%xmm2, 16(%edi)
 # ifdef USE_AS_STPCPY
@@ -1612,37 +1779,90 @@ ENTRY (STRCPY)
 	ENTRANCE
 	mov	STR1(%esp), %edx
 	mov	STR2(%esp), %ecx
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%edx,1), %bnd0
+	bndldx 	STR2(%esp,%ecx,1), %bnd1
+	bndcl  	(%ecx), %bnd1
+	bndcu  	(%ecx), %bnd1
+	bndcl  	(%edx), %bnd0
+	bndcu  	(%edx), %bnd0
+# endif
 
 	cmpb	$0, (%ecx)
 	jz	L(ExitTail1)
+# ifdef __CHKP__
+	bndcu  	1(%ecx), %bnd1
+# endif
 	cmpb	$0, 1(%ecx)
 	jz	L(ExitTail2)
+# ifdef __CHKP__
+	bndcu  	2(%ecx), %bnd1
+# endif
 	cmpb	$0, 2(%ecx)
 	jz	L(ExitTail3)
+# ifdef __CHKP__
+	bndcu  	3(%ecx), %bnd1
+# endif
 	cmpb	$0, 3(%ecx)
 	jz	L(ExitTail4)
+# ifdef __CHKP__
+	bndcu  	4(%ecx), %bnd1
+# endif
 	cmpb	$0, 4(%ecx)
 	jz	L(ExitTail5)
+# ifdef __CHKP__
+	bndcu  	5(%ecx), %bnd1
+# endif
 	cmpb	$0, 5(%ecx)
 	jz	L(ExitTail6)
+# ifdef __CHKP__
+	bndcu  	6(%ecx), %bnd1
+# endif
 	cmpb	$0, 6(%ecx)
 	jz	L(ExitTail7)
+# ifdef __CHKP__
+	bndcu  	7(%ecx), %bnd1
+# endif
 	cmpb	$0, 7(%ecx)
 	jz	L(ExitTail8)
+# ifdef __CHKP__
+	bndcu  	8(%ecx), %bnd1
+# endif
 	cmpb	$0, 8(%ecx)
 	jz	L(ExitTail9)
+# ifdef __CHKP__
+	bndcu  	9(%ecx), %bnd1
+# endif
 	cmpb	$0, 9(%ecx)
 	jz	L(ExitTail10)
+# ifdef __CHKP__
+	bndcu  	10(%ecx), %bnd1
+# endif
 	cmpb	$0, 10(%ecx)
 	jz	L(ExitTail11)
+# ifdef __CHKP__
+	bndcu  	11(%ecx), %bnd1
+# endif
 	cmpb	$0, 11(%ecx)
 	jz	L(ExitTail12)
+# ifdef __CHKP__
+	bndcu  	12(%ecx), %bnd1
+# endif
 	cmpb	$0, 12(%ecx)
 	jz	L(ExitTail13)
+# ifdef __CHKP__
+	bndcu  	13(%ecx), %bnd1
+# endif
 	cmpb	$0, 13(%ecx)
 	jz	L(ExitTail14)
+# ifdef __CHKP__
+	bndcu  	14(%ecx), %bnd1
+# endif
 	cmpb	$0, 14(%ecx)
 	jz	L(ExitTail15)
+# ifdef __CHKP__
+	bndcu  	15(%ecx), %bnd1
+# endif
 	cmpb	$0, 15(%ecx)
 	jz	L(ExitTail16)
 
@@ -1654,6 +1874,9 @@ ENTRY (STRCPY)
 	and	$-16, %ebx
 	pxor	%xmm0, %xmm0
 	movdqu	(%ecx), %xmm1
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movdqu	%xmm1, (%edx)
 	pcmpeqb	(%ebx), %xmm0
 	pmovmskb %xmm0, %eax
@@ -1669,6 +1892,10 @@ ENTRY (STRCPY)
 	xor	%ebx, %ebx
 
 	.p2align 4
+# ifdef __CHKP__
+	bndcu  	16(%ecx), %bnd1
+	bndcu  	15(%edx), %bnd0
+# endif
 	movdqa	(%ecx), %xmm1
 	movaps	16(%ecx), %xmm2
 	movdqu	%xmm1, (%edx)
@@ -1678,6 +1905,10 @@ ENTRY (STRCPY)
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%ecx, %ebx), %bnd1
+	bndcu  	15(%edx, %ebx), %bnd0
+# endif
 	movaps	16(%ecx, %ebx), %xmm3
 	movdqu	%xmm2, (%edx, %ebx)
 	pcmpeqb	%xmm3, %xmm0
@@ -1686,6 +1917,10 @@ ENTRY (STRCPY)
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%ecx, %ebx), %bnd1
+	bndcu  	15(%edx, %ebx), %bnd0
+# endif
 	movaps	16(%ecx, %ebx), %xmm4
 	movdqu	%xmm3, (%edx, %ebx)
 	pcmpeqb	%xmm4, %xmm0
@@ -1694,6 +1929,10 @@ ENTRY (STRCPY)
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%ecx, %ebx), %bnd1
+	bndcu  	15(%edx, %ebx), %bnd0
+# endif
 	movaps	16(%ecx, %ebx), %xmm1
 	movdqu	%xmm4, (%edx, %ebx)
 	pcmpeqb	%xmm1, %xmm0
@@ -1702,6 +1941,10 @@ ENTRY (STRCPY)
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%ecx, %ebx), %bnd1
+	bndcu  	15(%edx, %ebx), %bnd0
+# endif
 	movaps	16(%ecx, %ebx), %xmm2
 	movdqu	%xmm1, (%edx, %ebx)
 	pcmpeqb	%xmm2, %xmm0
@@ -1710,6 +1953,10 @@ ENTRY (STRCPY)
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	16(%ecx, %ebx), %bnd1
+	bndcu  	15(%edx, %ebx), %bnd0
+# endif
 	movaps	16(%ecx, %ebx), %xmm3
 	movdqu	%xmm2, (%edx, %ebx)
 	pcmpeqb	%xmm3, %xmm0
@@ -1718,6 +1965,9 @@ ENTRY (STRCPY)
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %ebx), %bnd0
+# endif
 	movdqu	%xmm3, (%edx, %ebx)
 	mov	%ecx, %eax
 	lea	16(%ecx, %ebx), %ecx
@@ -1726,6 +1976,9 @@ ENTRY (STRCPY)
 	sub	%eax, %edx
 
 L(Aligned64Loop):
+# ifdef __CHKP__
+	bndcu  	(%ecx), %bnd1
+# endif
 	movaps	(%ecx), %xmm2
 	movaps	%xmm2, %xmm4
 	movaps	16(%ecx), %xmm5
@@ -1742,6 +1995,10 @@ L(Aligned64Loop):
 	test	%eax, %eax
 	jnz	L(Aligned64Leave)
 L(Aligned64Loop_start):
+# ifdef __CHKP__
+	bndcu  	(%ecx), %bnd1
+	bndcu  	-1(%edx), %bnd0
+# endif
 	movdqu	%xmm4, -64(%edx)
 	movaps	(%ecx), %xmm2
 	movdqa	%xmm2, %xmm4
@@ -1771,6 +2028,9 @@ L(Aligned64Leave):
 
 	pcmpeqb	%xmm5, %xmm0
 	pmovmskb %xmm0, %eax
+# ifdef __CHKP__
+	bndcu  	-49(%edx), %bnd0
+# endif
 	movdqu	%xmm4, -64(%edx)
 	test	%eax, %eax
 	lea	16(%ebx), %ebx
@@ -1778,11 +2038,17 @@ L(Aligned64Leave):
 
 	pcmpeqb	%xmm6, %xmm0
 	pmovmskb %xmm0, %eax
+# ifdef __CHKP__
+	bndcu  	-33(%edx), %bnd0
+# endif
 	movdqu	%xmm5, -48(%edx)
 	test	%eax, %eax
 	lea	16(%ebx), %ebx
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	-17(%edx), %bnd0
+# endif
 	movdqu	%xmm6, -32(%edx)
 	pcmpeqb	%xmm7, %xmm0
 	pmovmskb %xmm0, %eax
@@ -1813,6 +2079,10 @@ L(CopyFrom1To16Bytes):
 	test	$0x40, %al
 	jnz	L(Exit7)
 	/* Exit 8 */
+# ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+	bndcu  	7(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
@@ -1841,6 +2111,10 @@ L(ExitHigh):
 	test	$0x40, %ah
 	jnz	L(Exit15)
 	/* Exit 16 */
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	15(%ecx), %bnd1
+# endif
 	movlpd	(%ecx), %xmm0
 	movlpd	%xmm0, (%edx)
 	movlpd	8(%ecx), %xmm0
@@ -1854,6 +2128,10 @@ L(ExitHigh):
 
 	.p2align 4
 L(Exit1):
+# ifdef __CHKP__
+	bndcu  	(%edx), %bnd0
+	bndcu  	(%ecx), %bnd1
+# endif
 	movb	(%ecx), %al
 	movb	%al, (%edx)
 # ifdef USE_AS_STPCPY
@@ -1865,6 +2143,10 @@ L(Exit1):
 
 	.p2align 4
 L(Exit2):
+# ifdef __CHKP__
+	bndcu  	1(%edx), %bnd0
+	bndcu  	1(%ecx), %bnd1
+# endif
 	movw	(%ecx), %ax
 	movw	%ax, (%edx)
 # ifdef USE_AS_STPCPY
@@ -1876,6 +2158,10 @@ L(Exit2):
 
 	.p2align 4
 L(Exit3):
+# ifdef __CHKP__
+	bndcu  	2(%edx), %bnd0
+	bndcu  	2(%ecx), %bnd1
+# endif
 	movw	(%ecx), %ax
 	movw	%ax, (%edx)
 	movb	2(%ecx), %al
@@ -1889,6 +2175,10 @@ L(Exit3):
 
 	.p2align 4
 L(Exit4):
+# ifdef __CHKP__
+	bndcu  	3(%edx), %bnd0
+	bndcu  	3(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 # ifdef USE_AS_STPCPY
@@ -1900,6 +2190,10 @@ L(Exit4):
 
 	.p2align 4
 L(Exit5):
+# ifdef __CHKP__
+	bndcu  	4(%edx), %bnd0
+	bndcu  	4(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movb	4(%ecx), %al
@@ -1913,6 +2207,10 @@ L(Exit5):
 
 	.p2align 4
 L(Exit6):
+# ifdef __CHKP__
+	bndcu  	5(%edx), %bnd0
+	bndcu  	5(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movw	4(%ecx), %ax
@@ -1926,6 +2224,10 @@ L(Exit6):
 
 	.p2align 4
 L(Exit7):
+# ifdef __CHKP__
+	bndcu  	6(%edx), %bnd0
+	bndcu  	6(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	3(%ecx), %eax
@@ -1939,6 +2241,10 @@ L(Exit7):
 
 	.p2align 4
 L(Exit9):
+# ifdef __CHKP__
+	bndcu  	8(%edx), %bnd0
+	bndcu  	8(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
@@ -1954,6 +2260,10 @@ L(Exit9):
 
 	.p2align 4
 L(Exit10):
+# ifdef __CHKP__
+	bndcu  	9(%edx), %bnd0
+	bndcu  	9(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
@@ -1969,6 +2279,10 @@ L(Exit10):
 
 	.p2align 4
 L(Exit11):
+# ifdef __CHKP__
+	bndcu  	10(%edx), %bnd0
+	bndcu  	10(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
@@ -1984,6 +2298,10 @@ L(Exit11):
 
 	.p2align 4
 L(Exit12):
+# ifdef __CHKP__
+	bndcu  	11(%edx), %bnd0
+	bndcu  	11(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
@@ -1999,6 +2317,10 @@ L(Exit12):
 
 	.p2align 4
 L(Exit13):
+# ifdef __CHKP__
+	bndcu  	12(%edx), %bnd0
+	bndcu  	12(%ecx), %bnd1
+# endif
 	movlpd	(%ecx), %xmm0
 	movlpd	%xmm0, (%edx)
 	movlpd	5(%ecx), %xmm0
@@ -2012,6 +2334,10 @@ L(Exit13):
 
 	.p2align 4
 L(Exit14):
+# ifdef __CHKP__
+	bndcu  	13(%edx), %bnd0
+	bndcu  	13(%ecx), %bnd1
+# endif
 	movlpd	(%ecx), %xmm0
 	movlpd	%xmm0, (%edx)
 	movlpd	6(%ecx), %xmm0
@@ -2025,6 +2351,10 @@ L(Exit14):
 
 	.p2align 4
 L(Exit15):
+# ifdef __CHKP__
+	bndcu  	14(%edx), %bnd0
+	bndcu  	14(%ecx), %bnd1
+# endif
 	movlpd	(%ecx), %xmm0
 	movlpd	%xmm0, (%edx)
 	movlpd	7(%ecx), %xmm0
@@ -2040,6 +2370,9 @@ CFI_POP (%edi)
 
 	.p2align 4
 L(ExitTail1):
+# ifdef __CHKP__
+	bndcu  	(%edx), %bnd0
+# endif
 	movb	(%ecx), %al
 	movb	%al, (%edx)
 	movl	%edx, %eax
@@ -2048,6 +2381,9 @@ L(ExitTail1):
 	.p2align 4
 L(ExitTail2):
 	movw	(%ecx), %ax
+# ifdef __CHKP__
+	bndcu  	1(%edx), %bnd0
+# endif
 	movw	%ax, (%edx)
 # ifdef USE_AS_STPCPY
 	lea	1(%edx), %eax
@@ -2059,6 +2395,9 @@ L(ExitTail2):
 	.p2align 4
 L(ExitTail3):
 	movw	(%ecx), %ax
+# ifdef __CHKP__
+	bndcu  	2(%edx), %bnd0
+# endif
 	movw	%ax, (%edx)
 	movb	2(%ecx), %al
 	movb	%al, 2(%edx)
@@ -2072,6 +2411,9 @@ L(ExitTail3):
 	.p2align 4
 L(ExitTail4):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	3(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 # ifdef USE_AS_STPCPY
 	lea	3(%edx), %eax
@@ -2083,6 +2425,9 @@ L(ExitTail4):
 	.p2align 4
 L(ExitTail5):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	4(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movb	4(%ecx), %al
 	movb	%al, 4(%edx)
@@ -2096,6 +2441,9 @@ L(ExitTail5):
 	.p2align 4
 L(ExitTail6):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	5(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movw	4(%ecx), %ax
 	movw	%ax, 4(%edx)
@@ -2109,6 +2457,9 @@ L(ExitTail6):
 	.p2align 4
 L(ExitTail7):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	6(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	3(%ecx), %eax
 	movl	%eax, 3(%edx)
@@ -2122,6 +2473,9 @@ L(ExitTail7):
 	.p2align 4
 L(ExitTail8):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
 	movl	%eax, 4(%edx)
@@ -2135,6 +2489,9 @@ L(ExitTail8):
 	.p2align 4
 L(ExitTail9):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	8(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
 	movl	%eax, 4(%edx)
@@ -2150,6 +2507,9 @@ L(ExitTail9):
 	.p2align 4
 L(ExitTail10):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	9(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
 	movl	%eax, 4(%edx)
@@ -2165,6 +2525,9 @@ L(ExitTail10):
 	.p2align 4
 L(ExitTail11):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	10(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
 	movl	%eax, 4(%edx)
@@ -2180,6 +2543,9 @@ L(ExitTail11):
 	.p2align 4
 L(ExitTail12):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	11(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	4(%ecx), %eax
 	movl	%eax, 4(%edx)
@@ -2195,6 +2561,9 @@ L(ExitTail12):
 	.p2align 4
 L(ExitTail13):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	12(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movlpd	5(%ecx), %xmm0
 	movlpd	%xmm0, 5(%edx)
@@ -2208,6 +2577,9 @@ L(ExitTail13):
 	.p2align 4
 L(ExitTail14):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	13(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movlpd	6(%ecx), %xmm0
 	movlpd	%xmm0, 6(%edx)
@@ -2221,6 +2593,9 @@ L(ExitTail14):
 	.p2align 4
 L(ExitTail15):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	14(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movlpd	7(%ecx), %xmm0
 	movlpd	%xmm0, 7(%edx)
@@ -2234,6 +2609,9 @@ L(ExitTail15):
 	.p2align 4
 L(ExitTail16):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movlpd	8(%ecx), %xmm0
 	movlpd	%xmm0, 8(%edx)

sysdeps/i386/i686/multiarch/strlen-sse2-bsf.S

@@ -41,6 +41,11 @@
 ENTRY ( __strlen_sse2_bsf)
 	ENTRANCE
 	mov	STR(%esp), %edi
+#ifdef __CHKP__
+	bndldx 	STR(%esp,%edi,1), %bnd0
+	bndcl  	(%edi),%bnd0
+	bndcu  	(%edi),%bnd0
+#endif
 	xor	%eax, %eax
 	mov	%edi, %ecx
 	and	$0x3f, %ecx
@@ -73,21 +78,33 @@ L(align16_start):
 	pxor	%xmm3, %xmm3
 	.p2align 4
 L(align16_loop):
+#ifdef __CHKP__
+        bndcu   16(%eax), %bnd0
+#endif
 	pcmpeqb	16(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	jnz	L(exit16)
 
+#ifdef __CHKP__
+        bndcu   32(%eax), %bnd0
+#endif
 	pcmpeqb	32(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	test	%edx, %edx
 	jnz	L(exit32)
 
+#ifdef __CHKP__
+        bndcu   48(%eax), %bnd0
+#endif
 	pcmpeqb	48(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	test	%edx, %edx
 	jnz	L(exit48)
 
+#ifdef __CHKP__
+        bndcu   64(%eax), %bnd0
+#endif
 	pcmpeqb	64(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	lea	64(%eax), %eax
@@ -98,24 +115,36 @@ L(exit):
 L(exit_less16):
 	bsf	%edx, %edx
 	add	%edx, %eax
+#ifdef __CHKP__
+	bndcu 	-1(%edi, %eax), %bnd0
+#endif
 	RETURN
 L(exit16):
 	sub	%edi, %eax
 	bsf	%edx, %edx
 	add	%edx, %eax
 	add	$16, %eax
+#ifdef __CHKP__
+	bndcu 	-1(%edi, %eax), %bnd0
+#endif
 	RETURN
 L(exit32):
 	sub	%edi, %eax
 	bsf	%edx, %edx
 	add	%edx, %eax
 	add	$32, %eax
+#ifdef __CHKP__
+	bndcu 	-1(%edi, %eax), %bnd0
+#endif
 	RETURN
 L(exit48):
 	sub	%edi, %eax
 	bsf	%edx, %edx
 	add	%edx, %eax
 	add	$48, %eax
+#ifdef __CHKP__
+	bndcu	-1(%edi, %eax), %bnd0
+#endif
 	POP (%edi)
 	POP (%esi)
 	ret

sysdeps/i386/i686/multiarch/strlen-sse2.S

@@ -41,7 +41,10 @@
 #   define PUSH(REG)	pushl	REG;	CFI_PUSH (REG)
 #   define POP(REG)	popl	REG;	CFI_POP (REG)
 #   undef RETURN
-#   define RETURN	POP (%edi); CFI_PUSH(%edi); ret
+#   define RETURN	\
+	mov STR+4(%esp),%edx; 	\
+	bndcu -1(%edx,%eax), %bnd0; \
+	POP (%edi); CFI_PUSH(%edi); ret
 #  endif
 
 #  ifndef STRLEN
@@ -51,12 +54,19 @@
 	atom_text_section
 ENTRY (STRLEN)
 	mov	STR(%esp), %edx
+#  ifdef __CHKP__
+	bndldx 	STR(%esp,%edx,1), %bnd0
+#  endif
 #  ifdef USE_AS_STRNLEN
 	PUSH	(%edi)
 	movl	LEN(%esp), %edi
 	sub	$4, %edi
 	jbe	L(len_less4_prolog)
 #  endif
+#  ifdef __CHKP__
+	bndcl  	(%edx),%bnd0
+	bndcu  	(%edx),%bnd0
+#  endif
 # endif
 	xor	%eax, %eax
 	cmpb	$0, (%edx)
@@ -122,6 +132,9 @@ ENTRY (STRLEN)
 	jbe	L(len_less64)
 # endif
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	pxor	%xmm1, %xmm1
@@ -129,6 +142,9 @@ ENTRY (STRLEN)
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	pxor	%xmm2, %xmm2
@@ -136,6 +152,9 @@ ENTRY (STRLEN)
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	pxor	%xmm3, %xmm3
@@ -143,6 +162,9 @@ ENTRY (STRLEN)
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	test	%edx, %edx
@@ -154,24 +176,36 @@ ENTRY (STRLEN)
 	jbe	L(len_less64)
 # endif
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	test	%edx, %edx
@@ -183,24 +217,36 @@ ENTRY (STRLEN)
 	jbe	L(len_less64)
 # endif
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	test	%edx, %edx
@@ -212,24 +258,36 @@ ENTRY (STRLEN)
 	jbe	L(len_less64)
 # endif
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm0
 	pmovmskb %xmm0, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm1
 	pmovmskb %xmm1, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm2
 	pmovmskb %xmm2, %edx
 	test	%edx, %edx
 	lea	16(%eax), %eax
 	jnz	L(exit)
 
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	pcmpeqb	(%eax), %xmm3
 	pmovmskb %xmm3, %edx
 	test	%edx, %edx
@@ -250,6 +308,9 @@ L(aligned_64_loop):
 	sub	$64, %edi
 	jbe	L(len_less64)
 # endif
+#ifdef __CHKP__
+        bndcu   (%eax), %bnd0
+#endif
 	movaps	(%eax), %xmm0
 	movaps	16(%eax), %xmm1
 	movaps	32(%eax), %xmm2
@@ -535,6 +596,10 @@ L(len_less4_prolog):
 	add	$4, %edi
 	jz	L(exit_tail0)
 
+#  ifdef __CHKP__
+	bndcl  	(%edx),%bnd0
+	bndcu  	(%edx),%bnd0
+#  endif
 	cmpb	$0, (%edx)
 	jz	L(exit_tail0)
 	cmp	$1, %edi

sysdeps/i386/i686/multiarch/strrchr-sse2-bsf.S

@@ -42,6 +42,12 @@ ENTRY (__strrchr_sse2_bsf)
 	mov	STR1(%esp), %ecx
 	movd	STR2(%esp), %xmm1
 
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%ecx,1), %bnd0
+	bndcl  	(%ecx), %bnd0
+	bndcu  	(%ecx), %bnd0
+# endif
+
 	PUSH	(%edi)
 	pxor	%xmm2, %xmm2
 	mov	%ecx, %edi
@@ -90,6 +96,9 @@ L(unaligned_return_value1):
 	jz	L(return_null)
 	bsr	%eax, %eax
 	add	%edi, %eax
+# ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+# endif
 	POP	(%edi)
 	ret
 	CFI_PUSH	(%edi)
@@ -156,6 +165,9 @@ L(unaligned_return_value):
 	jz	L(return_null)
 	bsr	%eax, %eax
 	add	%edi, %eax
+# ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+# endif
 	POP	(%edi)
 	ret
 	CFI_PUSH	(%edi)
@@ -175,6 +187,9 @@ L(unaligned_match):
 /* Loop start on aligned string.  */
 	.p2align 4
 L(loop):
+# ifdef __CHKP__
+        bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -184,6 +199,9 @@ L(loop):
 	or	%eax, %ecx
 	jnz	L(matches)
 
+# ifdef __CHKP__
+        bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -193,6 +211,9 @@ L(loop):
 	or	%eax, %ecx
 	jnz	L(matches)
 
+# ifdef __CHKP__
+        bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -202,6 +223,9 @@ L(loop):
 	or	%eax, %ecx
 	jnz	L(matches)
 
+# ifdef __CHKP__
+        bndcu   (%edi), %bnd0
+# endif
 	movdqa	(%edi), %xmm0
 	pcmpeqb	%xmm0, %xmm2
 	add	$16, %edi
@@ -224,6 +248,9 @@ L(return_value):
 	POP	(%esi)
 
 	sub	$16, %eax
+# ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+# endif
 	POP	(%edi)
 	ret
 
@@ -255,6 +282,9 @@ L(return_value_1):
 	bsr	%eax, %eax
 	add	%edi, %eax
 	sub	$16, %eax
+# ifdef __CHKP__
+	bndcu   (%eax), %bnd0
+# endif
 	POP	(%edi)
 	ret
 

sysdeps/i386/i686/multiarch/wcschr-sse2.S

@@ -40,7 +40,11 @@ ENTRY (__wcschr_sse2)
 
 	mov	STR1(%esp), %ecx
 	movd	STR2(%esp), %xmm1
-
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%ecx,1), %bnd0
+	bndcl  	(%ecx),%bnd0
+	bndcu  	(%ecx),%bnd0
+# endif
 	mov	%ecx, %eax
 	punpckldq %xmm1, %xmm1
 	pxor	%xmm2, %xmm2
@@ -90,6 +94,9 @@ L(cross_cache):
 	test	$15, %dl
 	jnz	L(return_null)
 	lea	4(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	CFI_PUSH (%edi)
@@ -108,6 +115,9 @@ L(unaligned_no_match):
 	.p2align 4
 L(loop):
 	add	$16, %ecx
+# ifdef __CHKP__
+	bndcu  	(%ecx),%bnd0
+# endif
 	movdqa	(%ecx), %xmm0
 	pcmpeqd	%xmm0, %xmm2
 	pcmpeqd	%xmm1, %xmm0
@@ -117,6 +127,9 @@ L(loop):
 	jnz	L(matches)
 	add	$16, %ecx
 
+# ifdef __CHKP__
+	bndcu  	(%ecx),%bnd0
+# endif
 	movdqa	(%ecx), %xmm0
 	pcmpeqd	%xmm0, %xmm2
 	pcmpeqd	%xmm1, %xmm0
@@ -126,6 +139,9 @@ L(loop):
 	jnz	L(matches)
 	add	$16, %ecx
 
+# ifdef __CHKP__
+	bndcu  	(%ecx),%bnd0
+# endif
 	movdqa	(%ecx), %xmm0
 	pcmpeqd	%xmm0, %xmm2
 	pcmpeqd	%xmm1, %xmm0
@@ -135,6 +151,9 @@ L(loop):
 	jnz	L(matches)
 	add	$16, %ecx
 
+# ifdef __CHKP__
+	bndcu  	(%ecx),%bnd0
+# endif
 	movdqa	(%ecx), %xmm0
 	pcmpeqd	%xmm0, %xmm2
 	pcmpeqd	%xmm1, %xmm0
@@ -160,11 +179,17 @@ L(match_case2):
 	test	$15, %dl
 	jnz	L(return_null)
 	lea	4(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
 L(match_case2_4):
 	mov	%ecx, %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
@@ -176,11 +201,17 @@ L(match_higth_case2):
 	test	$15, %dh
 	jnz	L(return_null)
 	lea	12(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
 L(match_case2_12):
 	lea	8(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
@@ -191,6 +222,9 @@ L(match_case1):
 	test	$0x01, %al
 	jnz	L(exit0)
 	lea	4(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
@@ -198,16 +232,25 @@ L(match_higth_case1):
 	test	$0x01, %ah
 	jnz	L(exit3)
 	lea	12(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
 L(exit0):
 	mov	%ecx, %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4
 L(exit3):
 	lea	8(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	(%eax),%bnd0
+# endif
 	ret
 
 	.p2align 4

sysdeps/i386/i686/multiarch/wcscmp-sse2.S

@@ -47,6 +47,14 @@ ENTRY (__wcscmp_sse2)
 */
 	mov	STR1(%esp), %edx
 	mov	STR2(%esp), %eax
+#ifdef __CHKP__
+	bndldx 	STR1(%esp,%edx,1), %bnd0
+	bndldx 	STR2(%esp,%eax,1), %bnd1
+	bndcl  	(%edx), %bnd0
+	bndcl  	(%eax), %bnd1
+	bndcu  	(%edx), %bnd0
+	bndcu  	(%eax), %bnd1
+#endif
 
 	mov	(%eax), %ecx
 	cmp	%ecx, (%edx)

sysdeps/i386/i686/multiarch/wcscpy-ssse3.S

@@ -41,13 +41,29 @@
 ENTRY (__wcscpy_ssse3)
 	mov	STR1(%esp), %edx
 	mov	STR2(%esp), %ecx
+# ifdef __CHKP__
+	bndldx 	STR1(%esp,%edx,1), %bnd0
+	bndldx 	STR2(%esp,%ecx,1), %bnd1
+	bndcl  	(%edx), %bnd0
+	bndcl  	(%ecx), %bnd1
+	bndcu  	(%ecx), %bnd1
+# endif
 
 	cmp	$0, (%ecx)
 	jz	L(ExitTail4)
+# ifdef __CHKP__
+	bndcu  	4(%ecx), %bnd1
+# endif
 	cmp	$0, 4(%ecx)
 	jz	L(ExitTail8)
+# ifdef __CHKP__
+	bndcu  	8(%ecx), %bnd1
+# endif
 	cmp	$0, 8(%ecx)
 	jz	L(ExitTail12)
+# ifdef __CHKP__
+	bndcu  	12(%ecx), %bnd1
+# endif
 	cmp	$0, 12(%ecx)
 	jz	L(ExitTail16)
 
@@ -61,6 +77,9 @@ ENTRY (__wcscpy_ssse3)
 	pxor	%xmm0, %xmm0
 	pcmpeqd	(%esi), %xmm0
 	movdqu	(%ecx), %xmm1
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movdqu	%xmm1, (%edx)
 
 	pmovmskb %xmm0, %eax
@@ -87,6 +106,10 @@ ENTRY (__wcscpy_ssse3)
 	jmp	L(Shl12)
 
 L(Align16Both):
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	16(%ecx), %bnd1
+# endif
 	movaps	(%ecx), %xmm1
 	movaps	16(%ecx), %xmm2
 	movaps	%xmm1, (%edx)
@@ -97,6 +120,10 @@ L(Align16Both):
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %esi), %bnd0
+	bndcu  	16(%ecx, %esi), %bnd1
+# endif
 	movaps	16(%ecx, %esi), %xmm3
 	movaps	%xmm2, (%edx, %esi)
 	pcmpeqd	%xmm3, %xmm0
@@ -106,6 +133,10 @@ L(Align16Both):
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %esi), %bnd0
+	bndcu  	16(%ecx, %esi), %bnd1
+# endif
 	movaps	16(%ecx, %esi), %xmm4
 	movaps	%xmm3, (%edx, %esi)
 	pcmpeqd	%xmm4, %xmm0
@@ -115,6 +146,10 @@ L(Align16Both):
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %esi), %bnd0
+	bndcu  	16(%ecx, %esi), %bnd1
+# endif
 	movaps	16(%ecx, %esi), %xmm1
 	movaps	%xmm4, (%edx, %esi)
 	pcmpeqd	%xmm1, %xmm0
@@ -124,6 +159,10 @@ L(Align16Both):
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %esi), %bnd0
+	bndcu  	16(%ecx, %esi), %bnd1
+# endif
 	movaps	16(%ecx, %esi), %xmm2
 	movaps	%xmm1, (%edx, %esi)
 	pcmpeqd	%xmm2, %xmm0
@@ -133,6 +172,10 @@ L(Align16Both):
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %esi), %bnd0
+	bndcu  	16(%ecx, %esi), %bnd1
+# endif
 	movaps	16(%ecx, %esi), %xmm3
 	movaps	%xmm2, (%edx, %esi)
 	pcmpeqd	%xmm3, %xmm0
@@ -142,6 +185,9 @@ L(Align16Both):
 	test	%eax, %eax
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	15(%edx, %esi), %bnd0
+# endif
 	movaps	%xmm3, (%edx, %esi)
 	mov	%ecx, %eax
 	lea	16(%ecx, %esi), %ecx
@@ -152,6 +198,9 @@ L(Align16Both):
 	mov	$-0x40, %esi
 
 L(Aligned64Loop):
+# ifdef __CHKP__
+	bndcu  	(%ecx), %bnd1
+# endif
 	movaps	(%ecx), %xmm2
 	movaps	32(%ecx), %xmm3
 	movaps	%xmm2, %xmm4
@@ -168,6 +217,9 @@ L(Aligned64Loop):
 
 	test	%eax, %eax
 	jnz	L(Aligned64Leave)
+# ifdef __CHKP__
+	bndcu  	-1(%edx), %bnd0
+# endif
 	movaps	%xmm4, -64(%edx)
 	movaps	%xmm5, -48(%edx)
 	movaps	%xmm6, -32(%edx)
@@ -182,6 +234,9 @@ L(Aligned64Leave):
 
 	pcmpeqd	%xmm5, %xmm0
 	pmovmskb %xmm0, %eax
+# ifdef __CHKP__
+	bndcu  	-49(%edx), %bnd0
+# endif
 	movaps	%xmm4, -64(%edx)
 	test	%eax, %eax
 	lea	16(%esi), %esi
@@ -189,11 +244,17 @@ L(Aligned64Leave):
 
 	pcmpeqd	%xmm6, %xmm0
 	pmovmskb %xmm0, %eax
+# ifdef __CHKP__
+	bndcu  	-33(%edx), %bnd0
+# endif
 	movaps	%xmm5, -48(%edx)
 	test	%eax, %eax
 	lea	16(%esi), %esi
 	jnz	L(CopyFrom1To16Bytes)
 
+# ifdef __CHKP__
+	bndcu  	-17(%edx), %bnd0
+# endif
 	movaps	%xmm6, -32(%edx)
 	pcmpeqd	%xmm7, %xmm0
 	pmovmskb %xmm0, %eax
@@ -202,11 +263,17 @@ L(Aligned64Leave):
 	jnz	L(CopyFrom1To16Bytes)
 
 	mov	$-0x40, %esi
+# ifdef __CHKP__
+	bndcu  	-1(%edx), %bnd0
+# endif
 	movaps	%xmm7, -16(%edx)
 	jmp	L(Aligned64Loop)
 
 	.p2align 4
 L(Shl4):
+# ifdef __CHKP__
+	bndcu  	12(%ecx), %bnd1
+# endif
 	movaps	-4(%ecx), %xmm1
 	movaps	12(%ecx), %xmm2
 L(Shl4Start):
@@ -218,6 +285,10 @@ L(Shl4Start):
 	jnz	L(Shl4LoopExit)
 
 	palignr	$4, %xmm1, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	28(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	28(%ecx), %xmm2
 
@@ -231,6 +302,10 @@ L(Shl4Start):
 	jnz	L(Shl4LoopExit)
 
 	palignr	$4, %xmm3, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	28(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	28(%ecx), %xmm2
 
@@ -244,6 +319,10 @@ L(Shl4Start):
 	jnz	L(Shl4LoopExit)
 
 	palignr	$4, %xmm1, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	28(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	28(%ecx), %xmm2
 
@@ -256,6 +335,10 @@ L(Shl4Start):
 	jnz	L(Shl4LoopExit)
 
 	palignr	$4, %xmm3, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	28(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	lea	28(%ecx), %ecx
 	lea	16(%edx), %edx
@@ -269,6 +352,9 @@ L(Shl4Start):
 	movaps	-4(%ecx), %xmm1
 
 L(Shl4LoopStart):
+# ifdef __CHKP__
+	bndcu  	12(%ecx), %bnd1
+# endif
 	movaps	12(%ecx), %xmm2
 	movaps	28(%ecx), %xmm3
 	movaps	%xmm3, %xmm6
@@ -290,6 +376,9 @@ L(Shl4LoopStart):
 	lea	64(%ecx), %ecx
 	palignr	$4, %xmm1, %xmm2
 	movaps	%xmm7, %xmm1
+# ifdef __CHKP__
+	bndcu  	63(%edx), %bnd0
+# endif
 	movaps	%xmm5, 48(%edx)
 	movaps	%xmm4, 32(%edx)
 	movaps	%xmm3, 16(%edx)
@@ -300,6 +389,10 @@ L(Shl4LoopStart):
 L(Shl4LoopExit):
 	movlpd	(%ecx), %xmm0
 	movl	8(%ecx), %esi
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
+	movaps	%xmm2, (%edx)
 	movlpd	%xmm0, (%edx)
 	movl	%esi, 8(%edx)
 	POP	(%esi)
@@ -310,6 +403,9 @@ L(Shl4LoopExit):
 	test	$0x01, %al
 	jnz	L(Exit4)
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movl	%edi, %eax
 	RETURN
@@ -318,6 +414,9 @@ L(Shl4LoopExit):
 
 	.p2align 4
 L(Shl8):
+# ifdef __CHKP__
+	bndcu  	8(%ecx), %bnd1
+# endif
 	movaps	-8(%ecx), %xmm1
 	movaps	8(%ecx), %xmm2
 L(Shl8Start):
@@ -329,6 +428,10 @@ L(Shl8Start):
 	jnz	L(Shl8LoopExit)
 
 	palignr	$8, %xmm1, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	24(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	24(%ecx), %xmm2
 
@@ -342,6 +445,10 @@ L(Shl8Start):
 	jnz	L(Shl8LoopExit)
 
 	palignr	$8, %xmm3, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	24(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	24(%ecx), %xmm2
 
@@ -355,6 +462,10 @@ L(Shl8Start):
 	jnz	L(Shl8LoopExit)
 
 	palignr	$8, %xmm1, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	24(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	24(%ecx), %xmm2
 
@@ -367,6 +478,9 @@ L(Shl8Start):
 	jnz	L(Shl8LoopExit)
 
 	palignr	$8, %xmm3, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movaps	%xmm2, (%edx)
 	lea	24(%ecx), %ecx
 	lea	16(%edx), %edx
@@ -380,6 +494,9 @@ L(Shl8Start):
 	movaps	-8(%ecx), %xmm1
 
 L(Shl8LoopStart):
+# ifdef __CHKP__
+	bndcu  	8(%ecx), %bnd1
+# endif
 	movaps	8(%ecx), %xmm2
 	movaps	24(%ecx), %xmm3
 	movaps	%xmm3, %xmm6
@@ -401,6 +518,9 @@ L(Shl8LoopStart):
 	lea	64(%ecx), %ecx
 	palignr	$8, %xmm1, %xmm2
 	movaps	%xmm7, %xmm1
+# ifdef __CHKP__
+	bndcu  	63(%edx), %bnd0
+# endif
 	movaps	%xmm5, 48(%edx)
 	movaps	%xmm4, 32(%edx)
 	movaps	%xmm3, 16(%edx)
@@ -410,6 +530,9 @@ L(Shl8LoopStart):
 
 L(Shl8LoopExit):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	POP	(%esi)
 	add	$8, %edx
@@ -419,6 +542,9 @@ L(Shl8LoopExit):
 	test	$0x01, %al
 	jnz	L(Exit4)
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movl	%edi, %eax
 	RETURN
@@ -427,6 +553,9 @@ L(Shl8LoopExit):
 
 	.p2align 4
 L(Shl12):
+# ifdef __CHKP__
+	bndcu  	4(%ecx), %bnd1
+# endif
 	movaps	-12(%ecx), %xmm1
 	movaps	4(%ecx), %xmm2
 L(Shl12Start):
@@ -438,6 +567,10 @@ L(Shl12Start):
 	jnz	L(Shl12LoopExit)
 
 	palignr	$12, %xmm1, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	20(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	20(%ecx), %xmm2
 
@@ -451,6 +584,10 @@ L(Shl12Start):
 	jnz	L(Shl12LoopExit)
 
 	palignr	$12, %xmm3, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	20(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	20(%ecx), %xmm2
 
@@ -464,6 +601,10 @@ L(Shl12Start):
 	jnz	L(Shl12LoopExit)
 
 	palignr	$12, %xmm1, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	20(%ecx), %bnd1
+# endif
 	movaps	%xmm2, (%edx)
 	movaps	20(%ecx), %xmm2
 
@@ -476,6 +617,9 @@ L(Shl12Start):
 	jnz	L(Shl12LoopExit)
 
 	palignr	$12, %xmm3, %xmm2
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movaps	%xmm2, (%edx)
 	lea	20(%ecx), %ecx
 	lea	16(%edx), %edx
@@ -489,6 +633,9 @@ L(Shl12Start):
 	movaps	-12(%ecx), %xmm1
 
 L(Shl12LoopStart):
+# ifdef __CHKP__
+	bndcu  	4(%ecx), %bnd1
+# endif
 	movaps	4(%ecx), %xmm2
 	movaps	20(%ecx), %xmm3
 	movaps	%xmm3, %xmm6
@@ -510,6 +657,9 @@ L(Shl12LoopStart):
 	lea	64(%ecx), %ecx
 	palignr	$12, %xmm1, %xmm2
 	movaps	%xmm7, %xmm1
+# ifdef __CHKP__
+	bndcu  	63(%edx), %bnd0
+# endif
 	movaps	%xmm5, 48(%edx)
 	movaps	%xmm4, 32(%edx)
 	movaps	%xmm3, 16(%edx)
@@ -519,6 +669,9 @@ L(Shl12LoopStart):
 
 L(Shl12LoopExit):
 	movl	(%ecx), %esi
+# ifdef __CHKP__
+	bndcu	3(%edx), %bnd0
+# endif
 	movl	%esi, (%edx)
 	mov	$4, %esi
 
@@ -533,6 +686,10 @@ L(CopyFrom1To16Bytes):
 	test	$0x01, %al
 	jnz	L(Exit4)
 L(Exit8):
+# ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+	bndcu  	7(%ecx), %bnd1
+# endif
 	movlpd	(%ecx), %xmm0
 	movlpd	%xmm0, (%edx)
 	movl	%edi, %eax
@@ -543,6 +700,10 @@ L(ExitHigh):
 	test	$0x01, %ah
 	jnz	L(Exit12)
 L(Exit16):
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+	bndcu  	15(%ecx), %bnd1
+# endif
 	movdqu	(%ecx), %xmm0
 	movdqu	%xmm0, (%edx)
 	movl	%edi, %eax
@@ -550,6 +711,10 @@ L(Exit16):
 
 	.p2align 4
 L(Exit4):
+# ifdef __CHKP__
+	bndcu  	3(%edx), %bnd0
+	bndcu  	3(%ecx), %bnd1
+# endif
 	movl	(%ecx), %eax
 	movl	%eax, (%edx)
 	movl	%edi, %eax
@@ -557,6 +722,10 @@ L(Exit4):
 
 	.p2align 4
 L(Exit12):
+# ifdef __CHKP__
+	bndcu  	11(%edx), %bnd0
+	bndcu  	11(%ecx), %bnd1
+# endif
 	movlpd	(%ecx), %xmm0
 	movlpd	%xmm0, (%edx)
 	movl	8(%ecx), %eax
@@ -569,6 +738,9 @@ CFI_POP	(%edi)
 	.p2align 4
 L(ExitTail4):
 	movl	(%ecx), %eax
+# ifdef __CHKP__
+	bndcu  	3(%edx), %bnd0
+# endif
 	movl	%eax, (%edx)
 	movl	%edx, %eax
 	ret
@@ -576,6 +748,9 @@ L(ExitTail4):
 	.p2align 4
 L(ExitTail8):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	7(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movl	%edx, %eax
 	ret
@@ -583,6 +758,9 @@ L(ExitTail8):
 	.p2align 4
 L(ExitTail12):
 	movlpd	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	11(%edx), %bnd0
+# endif
 	movlpd	%xmm0, (%edx)
 	movl	8(%ecx), %eax
 	movl	%eax, 8(%edx)
@@ -592,6 +770,9 @@ L(ExitTail12):
 	.p2align 4
 L(ExitTail16):
 	movdqu	(%ecx), %xmm0
+# ifdef __CHKP__
+	bndcu  	15(%edx), %bnd0
+# endif
 	movdqu	%xmm0, (%edx)
 	movl	%edx, %eax
 	ret