Snap for 8558685 from bbe7c690f1fbe714fe06c2107cb3e4d25bc791f2 to tm-frc-networking-releaset_frc_net_330443000android13-frc-networking-release

Change-Id: I91abd1e21c578efbdbe63280120c646694ac54af

123 files changed, 2464 insertions, 433 deletions

diff --git a/OWNERS b/OWNERS
index e02ad9f94..670f88df7 100644
--- a/OWNERS
+++ b/OWNERS
@@ -2,9 +2,5 @@ enh@google.com
 
 cferris@google.com
 danalbert@google.com
-hhb@google.com
 rprichard@google.com
 yabinc@google.com
-
-# Still the best reviewer for changes related to the dynamic linker.
-dimitry@google.com
diff --git a/README.md b/README.md
index d96608e4f..f397fee14 100644
--- a/README.md
+++ b/README.md
@@ -147,11 +147,11 @@ this system call?". The answer is usually "no".
 The answer is "yes" if the system call is part of the POSIX standard.
 
 The answer is probably "yes" if the system call has a wrapper in at
-least one other C library.
+least one other C library (typically glibc/musl or Apple's libc).
 
 The answer may be "yes" if the system call has three/four distinct
-users in different projects, and there isn't a more specific library
-that would make more sense as the place to add the wrapper.
+users in different projects, and there isn't a more specific higher-level
+library that would make more sense as the place to add the wrapper.
 
 In all other cases, you should use
 [syscall(3)](http://man7.org/linux/man-pages/man2/syscall.2.html) instead.
@@ -166,14 +166,47 @@ Adding a system call usually involves:
      the appropriate POSIX header file in libc/include/ includes the
      relevant file or files.
   3. Add function declarations to the appropriate header file. Don't forget
-     to include the appropriate `__INTRODUCED_IN()`.
-  4. Add the function name to the correct section in libc/libc.map.txt.
-  5. Add at least basic tests. Even a test that deliberately supplies
-     an invalid argument helps check that we're generating the right symbol
-     and have the right declaration in the header file, and that you correctly
-     updated the maps in step 5. (You can use strace(1) to confirm that the
-     correct system call is being made.)
-
+     to include the appropriate `__INTRODUCED_IN()`. If you need to create a new
+     header file, libc/include/sys/sysinfo.h is a good short example to copy and
+     paste from.
+  4. Add basic documentation to the header file. libc/include/sys/sysinfo.h is a
+     good short example that shows the expected style. Most of the detail
+     should actually be left to the man7.org page, with only a brief
+     one-sentence explanation in our documentation. Alway include the return
+     value/error reporting details. Explicitly say which version of Android the
+     function was added to. Explicitly call out any Android-specific
+     changes/additions/limitations because they won't be on the man7.org page.
+  5. Add the function name to the correct section in libc/libc.map.txt.
+  6. Add a basic test. Don't try to test everything; concentrate on just testing
+     the code that's actually in *bionic*, not all the functionality that's
+     implemented in the kernel. For simple syscalls, that's just the
+     auto-generated argument and return value marshalling.
+
+     A trivial test that deliberately supplies an invalid argument helps check
+     that we're generating the right symbol and have the right declaration in
+     the header file, and that the change to libc.map.txt from step 5 is
+     correct. (You can use strace(1) manually to confirm that the correct
+     system call is being made.)
+
+     For testing the *kernel* side of things, we should prefer to rely on
+     https://github.com/linux-test-project/ltp for kernel testing, but you'll
+     want to check that external/ltp does contain tests for the syscall you're
+     adding. Also check that external/ltp is using the libc wrapper for the
+     syscall rather than calling it "directly" via syscall(3)!
+
+Some system calls are harder than others. The most common problem is a 64-bit
+argument such as `off64_t` (a *pointer* to a 64-bit argument is fine, since
+pointers are always the "natural" size for the architecture regardless of the
+size of the thing they point to). Whenever you have a function that takes
+`off_t` or `off64_t`, you'll need to consider whether you actually need a foo()
+and a foo64(), and whether they will use the same underlying system call or are
+implemented as two different system calls. It's usually easiest to find a
+similar system call and copy and paste from that. You'll definitely need to test
+both on 32-bit and 64-bit. (These special cases warrant more testing than the
+easy cases, even if only manual testing with strace. Sadly it isn't always
+feasible to write a working test for the interesting cases -- offsets larger
+than 2GiB, say -- so you may end up just writing a "meaningless" program whose
+only purpose is to give you patterns to look for when run under strace(1).)
 
 ## Updating kernel header files
 
diff --git a/TEST_MAPPING b/TEST_MAPPING
index 8b01c4e5e..2db0efe0d 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -13,6 +13,9 @@
       "name": "CtsBionicTestCases"
     },
     {
+      "name": "CtsGwpAsanTestCases"
+    },
+    {
       "name": "CtsTaggingHostTestCases"
     },
     {
@@ -37,10 +40,39 @@
       "name": "memunreachable_unit_test"
     }
   ],
-
-  "hwasan-postsubmit": [
+  "hwasan-presubmit": [
+    {
+      "name": "bionic-unit-tests"
+    },
+    {
+      "name": "bionic-unit-tests-static"
+    },
+    {
+      "name": "linker-unit-tests"
+    },
     {
       "name": "CtsBionicTestCases"
+    },
+    {
+      "name": "CtsGwpAsanTestCases"
+    },
+    {
+      "name": "debuggerd_test"
+    },
+    {
+      "name": "fdtrack_test"
+    },
+    {
+      "name": "gwp_asan_unittest"
+    },
+    {
+      "name": "malloc_debug_unit_tests"
+    },
+    {
+      "name": "malloc_debug_system_tests"
+    },
+    {
+      "name": "malloc_hooks_system_tests"
     }
   ]
 }
diff --git a/benchmarks/spawn/Android.bp b/benchmarks/spawn/Android.bp
index 89d22e3f7..61e7bf634 100644
--- a/benchmarks/spawn/Android.bp
+++ b/benchmarks/spawn/Android.bp
@@ -43,6 +43,9 @@ cc_defaults {
         linux_glibc_x86: {
             enabled: false,
         },
+        linux_musl_x86: {
+            enabled: false,
+        },
     },
 }
 
@@ -103,6 +106,11 @@ cc_defaults {
                 "-Wl,--rpath,${ORIGIN}/../../lib64",
             ],
         },
+        linux_musl_x86_64: {
+            ldflags: [
+                "-Wl,--rpath,${ORIGIN}/../../lib64",
+            ],
+        },
     },
 }
 
diff --git a/docs/status.md b/docs/status.md
index 9521da85d..bf246a60e 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -50,7 +50,7 @@ list of POSIX functions implemented by glibc but not by bionic.
 
 Current libc symbols: https://android.googlesource.com/platform/bionic/+/master/libc/libc.map.txt
 
-New libc functions in T (API level 32):
+New libc functions in T (API level 33):
   * `backtrace`, `backtrace_symbols`, `backtrace_symbols_fd` (`<execinfo.h>`).
   * New system call wrappers: `preadv2`, `preadv64v2`, `pwritev2`,
     `pwritev64v2`.
diff --git a/libc/Android.bp b/libc/Android.bp
index f45b044b2..97146aa6f 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -28,6 +28,7 @@ libc_common_src_files = [
     "bionic/isatty.c",
     "bionic/sched_cpualloc.c",
     "bionic/sched_cpucount.c",
+    "bionic/sysprop_helpers.cpp",
     "stdio/fmemopen.cpp",
     "stdio/parsefloat.c",
     "stdio/refill.c",
@@ -1724,7 +1725,7 @@ cc_library {
                 // special for arm
                 cflags: ["-DCRT_LEGACY_WORKAROUND"],
                 // For backwards-compatibility, some arm32 builtins are exported from libc.so.
-                static_libs: ["libclang_rt.builtins-arm-android-exported"],
+                static_libs: ["libclang_rt.builtins-exported"],
             },
 
             // Arm 32 bit does not produce complete exidx unwind information
@@ -1754,7 +1755,7 @@ cc_library {
 
             shared: {
                 // For backwards-compatibility, some x86 builtins are exported from libc.so.
-                static_libs: ["libclang_rt.builtins-i686-android-exported"],
+                static_libs: ["libclang_rt.builtins-exported"],
             },
 
             // Leave the symbols in the shared library so that stack unwinders can produce
@@ -2324,6 +2325,8 @@ ndk_library {
     name: "libc",
     symbol_file: "libc.map.txt",
     first_version: "9",
+    // APIs implemented in asm don't have debug info: http://b/190554910.
+    allow_untyped_symbols: true,
 }
 
 ndk_library {
@@ -2615,10 +2618,6 @@ cc_library_host_static {
     stl: "none",
 }
 
-subdirs = [
-    "bionic/scudo",
-]
-
 // Export kernel uapi headers to be used in the musl sysroot.
 // Also include the execinfo headers for the libexecinfo and the
 // b64 headers for libb64 embedded in musl libc.
@@ -2639,8 +2638,6 @@ cc_genrule {
         "execinfo/include/**/*.h",
         "b64/include/**/*.h",
 
-        // This file is used to identify the location of the bionic/libc directory
-        // to simplify accessing the rest of the files.
         "NOTICE",
 
         ":libc_musl_sysroot_bionic_arch_headers",
@@ -2653,6 +2650,8 @@ cc_genrule {
     ],
     cmd: "BIONIC_LIBC_DIR=$$(dirname $(location NOTICE)) && " +
         "$(location soong_zip) -o $(genDir)/sysroot.zip -symlinks=false" +
+        // NOTICE
+        " -j -f $(location NOTICE) " +
         // headers
         " -P include " +
         "  -C $${BIONIC_LIBC_DIR}/kernel/uapi " +
@@ -2666,7 +2665,11 @@ cc_genrule {
         "  -C $${BIONIC_LIBC_DIR}/b64/include " +
         "  -D $${BIONIC_LIBC_DIR}/b64/include " +
         " && " +
-        "$(location merge_zips) $(out) $(location :libc_musl_sysroot_bionic_arch_headers) $(genDir)/sysroot.zip",
+        "$(location zip2zip) -i $(genDir)/sysroot.zip -o $(genDir)/sysroot-renamed.zip " +
+        " include/**/*:include/ " +
+        " NOTICE:NOTICE.bionic " +
+        " && " +
+        "$(location merge_zips) $(out) $(location :libc_musl_sysroot_bionic_arch_headers) $(genDir)/sysroot-renamed.zip",
 }
 
 // The architecture-specific bits have to be handled separately because the label varies based
diff --git a/libc/SECCOMP_ALLOWLIST_COMMON.TXT b/libc/SECCOMP_ALLOWLIST_COMMON.TXT
index 6650d7e32..0366fdf0f 100644
--- a/libc/SECCOMP_ALLOWLIST_COMMON.TXT
+++ b/libc/SECCOMP_ALLOWLIST_COMMON.TXT
@@ -31,6 +31,8 @@ int	seccomp:seccomp(unsigned int operation, unsigned int flags, void *args)	all
 int open:open(const char*, int, ...)  arm,x86,x86_64
 int stat64:stat64(const char*, struct stat64*)  arm,x86
 ssize_t readlink:readlink(const char*, char*, size_t)  arm,x86,x86_64
+# Needed by ubsan in T? (http://b/229989971)
+int stat(const char*, struct stat*)  arm,x86,x86_64
 
 #
 # Useful new syscalls which we don't yet use in bionic.
@@ -74,3 +76,5 @@ int futex_time64(int*, int, int, const timespec64*, int*, int) lp32
 int sched_rr_get_interval_time64(pid_t, timespec64*) lp32
 # Since Linux 5.4, not in glibc. Probed for and conditionally used by ART.
 int userfaultfd(int) all
+# Since Linux 5.9, used by POSIX_SPAWN_CLOEXEC_DEFAULT
+int close_range(unsigned int, unsigned int, int) all
diff --git a/libc/async_safe/Android.bp b/libc/async_safe/Android.bp
index e4a583774..531317d15 100644
--- a/libc/async_safe/Android.bp
+++ b/libc/async_safe/Android.bp
@@ -36,6 +36,7 @@ cc_library_static {
         "com.android.art.debug",
         "com.android.media",
         "com.android.media.swcodec",
+        "com.android.virt",
     ],
     min_sdk_version: "apex_inherit",
 }
diff --git a/libc/async_safe/async_safe_log.cpp b/libc/async_safe/async_safe_log.cpp
index 8b2a32b14..2380e686d 100644
--- a/libc/async_safe/async_safe_log.cpp
+++ b/libc/async_safe/async_safe_log.cpp
@@ -251,6 +251,7 @@ static void out_vformat(Out& o, const char* format, va_list args) {
     char sign = '\0';
     int width = -1;
     int prec = -1;
+    bool alternate = false;
     size_t bytelen = sizeof(int);
     int slen;
     char buffer[32]; /* temporary buffer used to format numbers */
@@ -293,6 +294,9 @@ static void out_vformat(Out& o, const char* format, va_list args) {
       } else if (c == ' ' || c == '+') {
         sign = c;
         continue;
+      } else if (c == '#') {
+        alternate = true;
+        continue;
       }
       break;
     }
@@ -344,9 +348,6 @@ static void out_vformat(Out& o, const char* format, va_list args) {
     if (c == 's') {
       /* string */
       str = va_arg(args, const char*);
-      if (str == nullptr) {
-        str = "(null)";
-      }
     } else if (c == 'c') {
       /* character */
       /* NOTE: char is promoted to int when passed through the stack */
@@ -357,6 +358,9 @@ static void out_vformat(Out& o, const char* format, va_list args) {
       buffer[0] = '0';
       buffer[1] = 'x';
       format_integer(buffer + 2, sizeof(buffer) - 2, value, 'x');
+    } else if (c == 'm') {
+      char buf[256];
+      str = strerror_r(errno, buf, sizeof(buf));
     } else if (c == 'd' || c == 'i' || c == 'o' || c == 'u' || c == 'x' || c == 'X') {
       /* integers - first read value from stack */
       uint64_t value;
@@ -388,8 +392,19 @@ static void out_vformat(Out& o, const char* format, va_list args) {
         value = static_cast<uint64_t>((static_cast<int64_t>(value << shift)) >> shift);
       }
 
-      /* format the number properly into our buffer */
-      format_integer(buffer, sizeof(buffer), value, c);
+      if (alternate && value != 0 && (c == 'x' || c == 'o')) {
+        if (c == 'x') {
+          buffer[0] = '0';
+          buffer[1] = 'x';
+          format_integer(buffer + 2, sizeof(buffer) - 2, value, c);
+        } else {
+          buffer[0] = '0';
+          format_integer(buffer + 1, sizeof(buffer) - 1, value, c);
+        }
+      } else {
+        /* format the number properly into our buffer */
+        format_integer(buffer, sizeof(buffer), value, c);
+      }
     } else if (c == '%') {
       buffer[0] = '%';
       buffer[1] = '\0';
@@ -397,6 +412,10 @@ static void out_vformat(Out& o, const char* format, va_list args) {
       __assert(__FILE__, __LINE__, "conversion specifier unsupported");
     }
 
+    if (str == nullptr) {
+      str = "(null)";
+    }
+
     /* if we are here, 'str' points to the content that must be
      * outputted. handle padding and alignment now */
 
diff --git a/libc/bionic/android_set_abort_message.cpp b/libc/bionic/android_set_abort_message.cpp
index 2ea12ee54..d5f8cb97f 100644
--- a/libc/bionic/android_set_abort_message.cpp
+++ b/libc/bionic/android_set_abort_message.cpp
@@ -77,6 +77,10 @@ void android_set_abort_message(const char* msg) {
     return;
   }
 
+  if (msg == nullptr) {
+    msg = "(null)";
+  }
+
   size_t size = sizeof(magic_abort_msg_t) + strlen(msg) + 1;
   void* map = mmap(nullptr, size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);
   if (map == MAP_FAILED) {
diff --git a/libc/bionic/gwp_asan_wrappers.cpp b/libc/bionic/gwp_asan_wrappers.cpp
index 8c513475d..7e19b311e 100644
--- a/libc/bionic/gwp_asan_wrappers.cpp
+++ b/libc/bionic/gwp_asan_wrappers.cpp
@@ -26,21 +26,27 @@
  * SUCH DAMAGE.
  */
 
-#include <platform/bionic/android_unsafe_frame_pointer_chase.h>
-#include <platform/bionic/malloc.h>
-#include <private/bionic_arc4random.h>
-#include <private/bionic_globals.h>
-#include <private/bionic_malloc_dispatch.h>
+#include <alloca.h>
+#include <assert.h>
+#include <ctype.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 #include <sys/types.h>
 
-#include "bionic/gwp_asan_wrappers.h"
 #include "gwp_asan/guarded_pool_allocator.h"
 #include "gwp_asan/options.h"
+#include "gwp_asan_wrappers.h"
 #include "malloc_common.h"
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+#include "platform/bionic/malloc.h"
+#include "private/bionic_arc4random.h"
+#include "private/bionic_globals.h"
+#include "private/bionic_malloc_dispatch.h"
+#include "sys/system_properties.h"
+#include "sysprop_helpers.h"
 
 #ifndef LIBC_STATIC
 #include "bionic/malloc_common_dynamic.h"
@@ -49,59 +55,14 @@
 static gwp_asan::GuardedPoolAllocator GuardedAlloc;
 static const MallocDispatch* prev_dispatch;
 
+using Action = android_mallopt_gwp_asan_options_t::Action;
 using Options = gwp_asan::options::Options;
 
-// ============================================================================
-// Implementation of gFunctions.
-// ============================================================================
-
-// This function handles initialisation as asked for by MallocInitImpl. This
-// should always be called in a single-threaded context.
-bool gwp_asan_initialize(const MallocDispatch* dispatch, bool*, const char*) {
-  prev_dispatch = dispatch;
-
-  Options Opts;
-  Opts.Enabled = true;
-  Opts.MaxSimultaneousAllocations = 32;
-  Opts.SampleRate = 2500;
-  Opts.InstallSignalHandlers = false;
-  Opts.InstallForkHandlers = true;
-  Opts.Backtrace = android_unsafe_frame_pointer_chase;
-
-  GuardedAlloc.init(Opts);
-  // TODO(b/149790891): The log line below causes ART tests to fail as they're
-  // not expecting any output. Disable the output for now.
-  // info_log("GWP-ASan has been enabled.");
-
-  __libc_shared_globals()->gwp_asan_state = GuardedAlloc.getAllocatorState();
-  __libc_shared_globals()->gwp_asan_metadata = GuardedAlloc.getMetadataRegion();
-  return true;
-}
-
-void gwp_asan_finalize() {
-}
-
-void gwp_asan_get_malloc_leak_info(uint8_t**, size_t*, size_t*, size_t*, size_t*) {
-}
-
-void gwp_asan_free_malloc_leak_info(uint8_t*) {
-}
-
-ssize_t gwp_asan_malloc_backtrace(void*, uintptr_t*, size_t) {
-  // TODO(mitchp): GWP-ASan might be able to return the backtrace for the
-  // provided address.
-  return -1;
-}
+// basename() is a mess, see the manpage. Let's be explicit what handling we
+// want (don't touch my string!).
+extern "C" const char* __gnu_basename(const char* path);
 
-bool gwp_asan_write_malloc_leak_info(FILE*) {
-  return false;
-}
-
-void* gwp_asan_gfunctions[] = {
-  (void*)gwp_asan_initialize,           (void*)gwp_asan_finalize,
-  (void*)gwp_asan_get_malloc_leak_info, (void*)gwp_asan_free_malloc_leak_info,
-  (void*)gwp_asan_malloc_backtrace,     (void*)gwp_asan_write_malloc_leak_info,
-};
+namespace {
 
 // ============================================================================
 // Implementation of GWP-ASan malloc wrappers.
@@ -144,10 +105,21 @@ size_t gwp_asan_malloc_usable_size(const void* mem) {
 }
 
 void* gwp_asan_realloc(void* old_mem, size_t bytes) {
+  // GPA::pointerIsMine(p) always returns false where `p == nullptr` (and thus
+  // malloc(bytes) is requested). We always fall back to the backing allocator,
+  // technically missing some coverage, but reducing an extra conditional
+  // branch.
   if (__predict_false(GuardedAlloc.pointerIsMine(old_mem))) {
-    size_t old_size = GuardedAlloc.getSize(old_mem);
+    if (__predict_false(bytes == 0)) {
+      GuardedAlloc.deallocate(old_mem);
+      return nullptr;
+    }
     void* new_ptr = gwp_asan_malloc(bytes);
-    if (new_ptr) memcpy(new_ptr, old_mem, (bytes < old_size) ? bytes : old_size);
+    // If malloc() fails, then don't destroy the old memory.
+    if (__predict_false(new_ptr == nullptr)) return nullptr;
+
+    size_t old_size = GuardedAlloc.getSize(old_mem);
+    memcpy(new_ptr, old_mem, (bytes < old_size) ? bytes : old_size);
     GuardedAlloc.deallocate(old_mem);
     return new_ptr;
   }
@@ -175,66 +147,202 @@ void gwp_asan_malloc_enable() {
   prev_dispatch->malloc_enable();
 }
 
-static const MallocDispatch gwp_asan_dispatch __attribute__((unused)) = {
-  gwp_asan_calloc,
-  gwp_asan_free,
-  Malloc(mallinfo),
-  gwp_asan_malloc,
-  gwp_asan_malloc_usable_size,
-  Malloc(memalign),
-  Malloc(posix_memalign),
+const MallocDispatch gwp_asan_dispatch __attribute__((unused)) = {
+    gwp_asan_calloc,
+    gwp_asan_free,
+    Malloc(mallinfo),
+    gwp_asan_malloc,
+    gwp_asan_malloc_usable_size,
+    Malloc(memalign),
+    Malloc(posix_memalign),
 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-  Malloc(pvalloc),
+    Malloc(pvalloc),
 #endif
-  gwp_asan_realloc,
+    gwp_asan_realloc,
 #if defined(HAVE_DEPRECATED_MALLOC_FUNCS)
-  Malloc(valloc),
+    Malloc(valloc),
 #endif
-  gwp_asan_malloc_iterate,
-  gwp_asan_malloc_disable,
-  gwp_asan_malloc_enable,
-  Malloc(mallopt),
-  Malloc(aligned_alloc),
-  Malloc(malloc_info),
+    gwp_asan_malloc_iterate,
+    gwp_asan_malloc_disable,
+    gwp_asan_malloc_enable,
+    Malloc(mallopt),
+    Malloc(aligned_alloc),
+    Malloc(malloc_info),
 };
 
-// The probability (1 / kProcessSampleRate) that a process will be ranodmly
-// selected for sampling. kProcessSampleRate should always be a power of two to
-// avoid modulo bias.
-static constexpr uint8_t kProcessSampleRate = 128;
+bool isPowerOfTwo(uint64_t x) {
+  assert(x != 0);
+  return (x & (x - 1)) == 0;
+}
+
+bool ShouldGwpAsanSampleProcess(unsigned sample_rate) {
+  if (!isPowerOfTwo(sample_rate)) {
+    warning_log(
+        "GWP-ASan process sampling rate of %u is not a power-of-two, and so modulo bias occurs.",
+        sample_rate);
+  }
 
-bool ShouldGwpAsanSampleProcess() {
   uint8_t random_number;
   __libc_safe_arc4random_buf(&random_number, sizeof(random_number));
-  return random_number % kProcessSampleRate == 0;
+  return random_number % sample_rate == 0;
 }
 
-bool MaybeInitGwpAsanFromLibc(libc_globals* globals) {
-  // Never initialize the Zygote here. A Zygote chosen for sampling would also
-  // have all of its children sampled. Instead, the Zygote child will choose
-  // whether it samples or not just after the Zygote forks. For
-  // libc_scudo-preloaded executables (like mediaswcodec), the program name
-  // might not be available yet. The zygote never uses dynamic libc_scudo.
-  const char* progname = getprogname();
-  if (progname && strncmp(progname, "app_process", 11) == 0) {
+bool GwpAsanInitialized = false;
+
+// The probability (1 / SampleRate) that an allocation gets chosen to be put
+// into the special GWP-ASan pool.
+using SampleRate_t = typeof(gwp_asan::options::Options::SampleRate);
+constexpr SampleRate_t kDefaultSampleRate = 2500;
+static const char* kSampleRateSystemSysprop = "libc.debug.gwp_asan.sample_rate.system_default";
+static const char* kSampleRateAppSysprop = "libc.debug.gwp_asan.sample_rate.app_default";
+static const char* kSampleRateTargetedSyspropPrefix = "libc.debug.gwp_asan.sample_rate.";
+static const char* kSampleRateEnvVar = "GWP_ASAN_SAMPLE_RATE";
+
+// The probability (1 / ProcessSampling) that a process will be randomly
+// selected for sampling, for system apps and system processes. The process
+// sampling rate should always be a power of two to avoid modulo bias.
+constexpr unsigned kDefaultProcessSampling = 128;
+static const char* kProcessSamplingSystemSysprop =
+    "libc.debug.gwp_asan.process_sampling.system_default";
+static const char* kProcessSamplingAppSysprop = "libc.debug.gwp_asan.process_sampling.app_default";
+static const char* kProcessSamplingTargetedSyspropPrefix = "libc.debug.gwp_asan.process_sampling.";
+static const char* kProcessSamplingEnvVar = "GWP_ASAN_PROCESS_SAMPLING";
+
+// The upper limit of simultaneous allocations supported by GWP-ASan. Any
+// allocations in excess of this limit will be passed to the backing allocator
+// and can't be sampled. This value, if unspecified, will be automatically
+// calculated to keep the same ratio as the default (2500 sampling : 32 allocs).
+// So, if you specify GWP_ASAN_SAMPLE_RATE=1250 (i.e. twice as frequent), we'll
+// automatically calculate that we need double the slots (64).
+using SimultaneousAllocations_t = typeof(gwp_asan::options::Options::MaxSimultaneousAllocations);
+constexpr SimultaneousAllocations_t kDefaultMaxAllocs = 32;
+static const char* kMaxAllocsSystemSysprop = "libc.debug.gwp_asan.max_allocs.system_default";
+static const char* kMaxAllocsAppSysprop = "libc.debug.gwp_asan.max_allocs.app_default";
+static const char* kMaxAllocsTargetedSyspropPrefix = "libc.debug.gwp_asan.max_allocs.";
+static const char* kMaxAllocsEnvVar = "GWP_ASAN_MAX_ALLOCS";
+
+void SetDefaultGwpAsanOptions(Options* options, unsigned* process_sample_rate,
+                              const android_mallopt_gwp_asan_options_t& mallopt_options) {
+  options->Enabled = true;
+  options->InstallSignalHandlers = false;
+  options->InstallForkHandlers = true;
+  options->Backtrace = android_unsafe_frame_pointer_chase;
+  options->SampleRate = kDefaultSampleRate;
+  options->MaxSimultaneousAllocations = kDefaultMaxAllocs;
+
+  *process_sample_rate = 1;
+  if (mallopt_options.desire == Action::TURN_ON_WITH_SAMPLING) {
+    *process_sample_rate = kDefaultProcessSampling;
+  }
+}
+
+bool GetGwpAsanOption(unsigned long long* result,
+                      const android_mallopt_gwp_asan_options_t& mallopt_options,
+                      const char* system_sysprop, const char* app_sysprop,
+                      const char* targeted_sysprop_prefix, const char* env_var,
+                      const char* descriptive_name) {
+  const char* basename = "";
+  if (mallopt_options.program_name) basename = __gnu_basename(mallopt_options.program_name);
+
+  size_t program_specific_sysprop_size = strlen(targeted_sysprop_prefix) + strlen(basename) + 1;
+  char* program_specific_sysprop_name = static_cast<char*>(alloca(program_specific_sysprop_size));
+  async_safe_format_buffer(program_specific_sysprop_name, program_specific_sysprop_size, "%s%s",
+                           targeted_sysprop_prefix, basename);
+
+  const char* sysprop_names[2] = {nullptr, nullptr};
+  // Tests use a blank program name to specify that system properties should not
+  // be used. Tests still continue to use the environment variable though.
+  if (*basename != '\0') {
+    sysprop_names[0] = program_specific_sysprop_name;
+    if (mallopt_options.desire == Action::TURN_ON_FOR_APP) {
+      sysprop_names[1] = app_sysprop;
+    } else {
+      sysprop_names[1] = system_sysprop;
+    }
+  }
+
+  char settings_buf[PROP_VALUE_MAX];
+  if (!get_config_from_env_or_sysprops(env_var, sysprop_names,
+                                       /* sys_prop_names_size */ 2, settings_buf, PROP_VALUE_MAX)) {
+    return false;
+  }
+
+  char* end;
+  unsigned long long value = strtoull(settings_buf, &end, 10);
+  if (value == ULLONG_MAX || *end != '\0') {
+    warning_log("Invalid GWP-ASan %s: \"%s\". Using default value instead.", descriptive_name,
+                settings_buf);
     return false;
   }
-  return MaybeInitGwpAsan(globals);
+
+  *result = value;
+  return true;
 }
 
-static bool GwpAsanInitialized = false;
+// Initialize the GWP-ASan options structure in *options, taking into account whether someone has
+// asked for specific GWP-ASan settings. The order of priority is:
+//  1. Environment variables.
+//  2. Process-specific system properties.
+//  3. Global system properties.
+// If any of these overrides are found, we return true. Otherwise, use the default values, and
+// return false.
+bool GetGwpAsanOptions(Options* options, unsigned* process_sample_rate,
+                       const android_mallopt_gwp_asan_options_t& mallopt_options) {
+  SetDefaultGwpAsanOptions(options, process_sample_rate, mallopt_options);
+
+  bool had_overrides = false;
+
+  unsigned long long buf;
+  if (GetGwpAsanOption(&buf, mallopt_options, kSampleRateSystemSysprop, kSampleRateAppSysprop,
+                       kSampleRateTargetedSyspropPrefix, kSampleRateEnvVar, "sample rate")) {
+    options->SampleRate = buf;
+    had_overrides = true;
+  }
+
+  if (GetGwpAsanOption(&buf, mallopt_options, kProcessSamplingSystemSysprop,
+                       kProcessSamplingAppSysprop, kProcessSamplingTargetedSyspropPrefix,
+                       kProcessSamplingEnvVar, "process sampling rate")) {
+    *process_sample_rate = buf;
+    had_overrides = true;
+  }
 
-// Maybe initializes GWP-ASan. Called by android_mallopt() and libc's
-// initialisation. This should always be called in a single-threaded context.
-bool MaybeInitGwpAsan(libc_globals* globals, bool force_init) {
+  if (GetGwpAsanOption(&buf, mallopt_options, kMaxAllocsSystemSysprop, kMaxAllocsAppSysprop,
+                       kMaxAllocsTargetedSyspropPrefix, kMaxAllocsEnvVar,
+                       "maximum simultaneous allocations")) {
+    options->MaxSimultaneousAllocations = buf;
+    had_overrides = true;
+  } else if (had_overrides) {
+    // Multiply the number of slots available, such that the ratio between
+    // sampling rate and slots is kept the same as the default. For example, a
+    // sampling rate of 1000 is 2.5x more frequent than default, and so
+    // requires 80 slots (32 * 2.5).
+    float frequency_multiplier = static_cast<float>(options->SampleRate) / kDefaultSampleRate;
+    options->MaxSimultaneousAllocations =
+        /* default */ kDefaultMaxAllocs / frequency_multiplier;
+  }
+  return had_overrides;
+}
+
+bool MaybeInitGwpAsan(libc_globals* globals,
+                      const android_mallopt_gwp_asan_options_t& mallopt_options) {
   if (GwpAsanInitialized) {
     error_log("GWP-ASan was already initialized for this process.");
     return false;
   }
 
-  // If the caller hasn't forced GWP-ASan on, check whether we should sample
-  // this process.
-  if (!force_init && !ShouldGwpAsanSampleProcess()) {
+  Options options;
+  unsigned process_sample_rate = kDefaultProcessSampling;
+  if (!GetGwpAsanOptions(&options, &process_sample_rate, mallopt_options) &&
+      mallopt_options.desire == Action::DONT_TURN_ON_UNLESS_OVERRIDDEN) {
+    return false;
+  }
+
+  if (options.SampleRate == 0 || process_sample_rate == 0 ||
+      options.MaxSimultaneousAllocations == 0) {
+    return false;
+  }
+
+  if (!ShouldGwpAsanSampleProcess(process_sample_rate)) {
     return false;
   }
 
@@ -263,28 +371,48 @@ bool MaybeInitGwpAsan(libc_globals* globals, bool force_init) {
     atomic_store(&globals->current_dispatch_table, &gwp_asan_dispatch);
   }
 
-#ifndef LIBC_STATIC
-  SetGlobalFunctions(gwp_asan_gfunctions);
-#endif  // LIBC_STATIC
-
   GwpAsanInitialized = true;
 
-  gwp_asan_initialize(NativeAllocatorDispatch(), nullptr, nullptr);
+  prev_dispatch = NativeAllocatorDispatch();
+
+  GuardedAlloc.init(options);
+
+  __libc_shared_globals()->gwp_asan_state = GuardedAlloc.getAllocatorState();
+  __libc_shared_globals()->gwp_asan_metadata = GuardedAlloc.getMetadataRegion();
 
   return true;
 }
+};  // anonymous namespace
+
+bool MaybeInitGwpAsanFromLibc(libc_globals* globals) {
+  // Never initialize the Zygote here. A Zygote chosen for sampling would also
+  // have all of its children sampled. Instead, the Zygote child will choose
+  // whether it samples or not just after the Zygote forks. Note that the Zygote
+  // changes its name after it's started, at this point it's still called
+  // "app_process" or "app_process64".
+  static const char kAppProcessNamePrefix[] = "app_process";
+  const char* progname = getprogname();
+  if (strncmp(progname, kAppProcessNamePrefix, sizeof(kAppProcessNamePrefix) - 1) == 0)
+    return false;
+
+  android_mallopt_gwp_asan_options_t mallopt_options;
+  mallopt_options.program_name = progname;
+  mallopt_options.desire = Action::TURN_ON_WITH_SAMPLING;
+
+  return MaybeInitGwpAsan(globals, mallopt_options);
+}
 
 bool DispatchIsGwpAsan(const MallocDispatch* dispatch) {
   return dispatch == &gwp_asan_dispatch;
 }
 
-bool EnableGwpAsan(bool force_init) {
+bool EnableGwpAsan(const android_mallopt_gwp_asan_options_t& options) {
   if (GwpAsanInitialized) {
     return true;
   }
 
   bool ret_value;
   __libc_globals.mutate(
-      [&](libc_globals* globals) { ret_value = MaybeInitGwpAsan(globals, force_init); });
+      [&](libc_globals* globals) { ret_value = MaybeInitGwpAsan(globals, options); });
   return ret_value;
 }
diff --git a/libc/bionic/gwp_asan_wrappers.h b/libc/bionic/gwp_asan_wrappers.h
index c568681e2..219da9fc5 100644
--- a/libc/bionic/gwp_asan_wrappers.h
+++ b/libc/bionic/gwp_asan_wrappers.h
@@ -28,19 +28,20 @@
 
 #pragma once
 
-#include <private/bionic_globals.h>
-#include <private/bionic_malloc_dispatch.h>
 #include <stddef.h>
 
-// Enable GWP-ASan, used by android_mallopt.
-bool EnableGwpAsan(bool force_init);
+#include "gwp_asan/options.h"
+#include "platform/bionic/malloc.h"
+#include "private/bionic_globals.h"
+#include "private/bionic_malloc_dispatch.h"
+
+// Enable GWP-ASan, used by android_mallopt. Should always be called in a
+// single-threaded context.
+bool EnableGwpAsan(const android_mallopt_gwp_asan_options_t& options);
 
 // Hooks for libc to possibly install GWP-ASan.
 bool MaybeInitGwpAsanFromLibc(libc_globals* globals);
 
-// Maybe initialize GWP-ASan. Set force_init to true to bypass process sampling.
-bool MaybeInitGwpAsan(libc_globals* globals, bool force_init = false);
-
 // Returns whether GWP-ASan is the provided dispatch table pointer. Used in
 // heapprofd's signal-initialization sequence to determine the intermediate
 // dispatch pointer to use when initing.
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index 815b9388f..575da626d 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -38,6 +38,7 @@
 
 #include "libc_init_common.h"
 #include "pthread_internal.h"
+#include "sysprop_helpers.h"
 
 #include "platform/bionic/macros.h"
 #include "platform/bionic/mte.h"
@@ -164,30 +165,6 @@ static void layout_static_tls(KernelArgumentBlock& args) {
   layout.finish_layout();
 }
 
-// Get the presiding config string, in the following order of priority:
-//   1. Environment variables.
-//   2. System properties, in the order they're specified in sys_prop_names.
-// If neither of these options are specified, this function returns false.
-// Otherwise, it returns true, and the presiding options string is written to
-// the `options` buffer of size `size`. If this function returns true, `options`
-// is guaranteed to be null-terminated. `options_size` should be at least
-// PROP_VALUE_MAX.
-bool get_config_from_env_or_sysprops(const char* env_var_name, const char* const* sys_prop_names,
-                                     size_t sys_prop_names_size, char* options,
-                                     size_t options_size) {
-  const char* env = getenv(env_var_name);
-  if (env && *env != '\0') {
-    strncpy(options, env, options_size);
-    options[options_size - 1] = '\0'; // Ensure null-termination.
-    return true;
-  }
-
-  for (size_t i = 0; i < sys_prop_names_size; ++i) {
-    if (__system_property_get(sys_prop_names[i], options) && *options != '\0') return true;
-  }
-  return false;
-}
-
 #ifdef __aarch64__
 static bool __read_memtag_note(const ElfW(Nhdr)* note, const char* name, const char* desc,
                                unsigned* result) {
diff --git a/libc/bionic/malloc_common.cpp b/libc/bionic/malloc_common.cpp
index 38168eeec..9744968fc 100644
--- a/libc/bionic/malloc_common.cpp
+++ b/libc/bionic/malloc_common.cpp
@@ -326,12 +326,12 @@ extern "C" bool android_mallopt(int opcode, void* arg, size_t arg_size) {
     return LimitEnable(arg, arg_size);
   }
   if (opcode == M_INITIALIZE_GWP_ASAN) {
-    if (arg == nullptr || arg_size != sizeof(bool)) {
+    if (arg == nullptr || arg_size != sizeof(android_mallopt_gwp_asan_options_t)) {
       errno = EINVAL;
       return false;
     }
 
-    return EnableGwpAsan(*reinterpret_cast<bool*>(arg));
+    return EnableGwpAsan(*reinterpret_cast<android_mallopt_gwp_asan_options_t*>(arg));
   }
   errno = ENOTSUP;
   return false;
diff --git a/libc/bionic/malloc_common_dynamic.cpp b/libc/bionic/malloc_common_dynamic.cpp
index 1f58fdaca..6c2f4d941 100644
--- a/libc/bionic/malloc_common_dynamic.cpp
+++ b/libc/bionic/malloc_common_dynamic.cpp
@@ -526,12 +526,12 @@ extern "C" bool android_mallopt(int opcode, void* arg, size_t arg_size) {
     return FreeMallocLeakInfo(reinterpret_cast<android_mallopt_leak_info_t*>(arg));
   }
   if (opcode == M_INITIALIZE_GWP_ASAN) {
-    if (arg == nullptr || arg_size != sizeof(bool)) {
+    if (arg == nullptr || arg_size != sizeof(android_mallopt_gwp_asan_options_t)) {
       errno = EINVAL;
       return false;
     }
 
-    return EnableGwpAsan(*reinterpret_cast<bool*>(arg));
+    return EnableGwpAsan(*reinterpret_cast<android_mallopt_gwp_asan_options_t*>(arg));
   }
   // Try heapprofd's mallopt, as it handles options not covered here.
   return HeapprofdMallopt(opcode, arg, arg_size);
diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
index 08fb187dc..121b26f82 100644
--- a/libc/bionic/pthread_create.cpp
+++ b/libc/bionic/pthread_create.cpp
@@ -45,7 +45,6 @@
 #include "private/bionic_defs.h"
 #include "private/bionic_globals.h"
 #include "platform/bionic/macros.h"
-#include "platform/bionic/pac.h"
 #include "private/bionic_ssp.h"
 #include "private/bionic_systrace.h"
 #include "private/bionic_tls.h"
@@ -332,9 +331,11 @@ void __set_stack_and_tls_vma_name(bool is_main_thread) {
 extern "C" int __rt_sigprocmask(int, const sigset64_t*, sigset64_t*, size_t);
 
 __attribute__((no_sanitize("hwaddress")))
+#ifdef __aarch64__
 // This function doesn't return, but it does appear in stack traces. Avoid using return PAC in this
 // function because we may end up resetting IA, which may confuse unwinders due to mismatching keys.
-__BIONIC_DISABLE_PAUTH
+__attribute__((target("branch-protection=bti")))
+#endif
 static int __pthread_start(void* arg) {
   pthread_internal_t* thread = reinterpret_cast<pthread_internal_t*>(arg);
 
diff --git a/libc/bionic/spawn.cpp b/libc/bionic/spawn.cpp
index e73828f32..59f763138 100644
--- a/libc/bionic/spawn.cpp
+++ b/libc/bionic/spawn.cpp
@@ -30,9 +30,12 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/close_range.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
 #include <unistd.h>
 
 #include <android/fdsan.h>
@@ -40,6 +43,28 @@
 #include "private/ScopedSignalBlocker.h"
 #include "private/SigSetConverter.h"
 
+static int set_cloexec(int i) {
+  int v = fcntl(i, F_GETFD);
+  if (v == -1) return -1;  // almost certainly: errno == EBADF
+  return fcntl(i, F_SETFD, v | FD_CLOEXEC);
+}
+
+// mark all open fds except stdin/out/err as close-on-exec
+static int cloexec_except_stdioe() {
+  // requires 5.11+ or ACK 5.10-T kernel, otherwise returns ENOSYS or EINVAL
+  if (!syscall(SYS_close_range, 3, ~0U, CLOSE_RANGE_CLOEXEC)) return 0;
+
+  // unfortunately getrlimit can lie:
+  // - both soft and hard limits can be lowered to 0, with fds still open, so it can underestimate
+  // - in practice it usually is some really large value (like 32K or more)
+  //   even though only a handful of small fds are actually open (ie. < 500),
+  //   this results in poor performance when trying to act on all possibly open fds
+  struct rlimit m;
+  int max = getrlimit(RLIMIT_NOFILE, &m) ? 1000000 : m.rlim_max;
+  for (int i = 3; i < max; ++i) set_cloexec(i);
+  return 0;
+}
+
 enum Action {
   kOpen,
   kClose,
@@ -69,7 +94,17 @@ struct __posix_spawn_file_action {
       // Failure to close is ignored.
       close(fd);
     } else {
-      if (dup2(fd, new_fd) == -1) _exit(127);
+      // It's a dup2.
+      if (fd == new_fd) {
+        // dup2(2) is a no-op if fd == new_fd, but POSIX suggests that we should
+        // manually remove the O_CLOEXEC flag in that case (because otherwise
+        // what use is the dup?).
+        // See https://www.austingroupbugs.net/view.php?id=411 for details.
+        int flags = fcntl(fd, F_GETFD, 0);
+        if (flags == -1 || fcntl(fd, F_SETFD, flags & ~FD_CLOEXEC) == -1) _exit(127);
+      } else {
+        if (dup2(fd, new_fd) == -1) _exit(127);
+      }
     }
   }
 };
@@ -131,6 +166,10 @@ static void ApplyAttrs(short flags, const posix_spawnattr_t* attr) {
   if ((flags & POSIX_SPAWN_SETSIGMASK) != 0) {
     if (sigprocmask64(SIG_SETMASK, &(*attr)->sigmask.sigset64, nullptr)) _exit(127);
   }
+
+  if ((flags & POSIX_SPAWN_CLOEXEC_DEFAULT) != 0) {
+    if (cloexec_except_stdioe()) _exit(127);
+  }
 }
 
 static int posix_spawn(pid_t* pid_ptr,
@@ -189,7 +228,7 @@ int posix_spawnattr_destroy(posix_spawnattr_t* attr) {
 int posix_spawnattr_setflags(posix_spawnattr_t* attr, short flags) {
   if ((flags & ~(POSIX_SPAWN_RESETIDS | POSIX_SPAWN_SETPGROUP | POSIX_SPAWN_SETSIGDEF |
                  POSIX_SPAWN_SETSIGMASK | POSIX_SPAWN_SETSCHEDPARAM | POSIX_SPAWN_SETSCHEDULER |
-                 POSIX_SPAWN_USEVFORK | POSIX_SPAWN_SETSID)) != 0) {
+                 POSIX_SPAWN_USEVFORK | POSIX_SPAWN_SETSID | POSIX_SPAWN_CLOEXEC_DEFAULT)) != 0) {
     return EINVAL;
   }
   (*attr)->flags = flags;
diff --git a/libc/bionic/sysprop_helpers.cpp b/libc/bionic/sysprop_helpers.cpp
new file mode 100644
index 000000000..edae6cc84
--- /dev/null
+++ b/libc/bionic/sysprop_helpers.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "sysprop_helpers.h"
+
+#include <assert.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include "sys/system_properties.h"
+
+static bool get_property_value(const char* property_name, char* dest, size_t dest_size) {
+  assert(property_name && dest && dest_size != 0);
+  const prop_info* prop = __system_property_find(property_name);
+  if (!prop) return false;
+
+  struct PropCbCookie {
+    char* dest;
+    size_t size;
+  };
+  *dest = '\0';
+  PropCbCookie cb_cookie = {dest, dest_size};
+
+  __system_property_read_callback(
+      prop,
+      [](void* cookie, const char* /* name */, const char* value, uint32_t /* serial */) {
+        auto* cb_cookie = reinterpret_cast<PropCbCookie*>(cookie);
+        strncpy(cb_cookie->dest, value, cb_cookie->size);
+      },
+      &cb_cookie);
+  if (*dest != '\0' && *dest != '0') return true;
+
+  return false;
+}
+
+bool get_config_from_env_or_sysprops(const char* env_var_name, const char* const* sys_prop_names,
+                                     size_t sys_prop_names_size, char* options,
+                                     size_t options_size) {
+  const char* env = getenv(env_var_name);
+  if (env && *env != '\0') {
+    strncpy(options, env, options_size);
+    options[options_size - 1] = '\0';  // Ensure null-termination.
+    return true;
+  }
+
+  for (size_t i = 0; i < sys_prop_names_size; ++i) {
+    if (sys_prop_names[i] == nullptr) continue;
+    if (get_property_value(sys_prop_names[i], options, options_size)) return true;
+  }
+  return false;
+}
diff --git a/libc/bionic/sysprop_helpers.h b/libc/bionic/sysprop_helpers.h
new file mode 100644
index 000000000..a02c2dc41
--- /dev/null
+++ b/libc/bionic/sysprop_helpers.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+
+// Get the presiding config string, in the following order of priority:
+//   1. Environment variables.
+//   2. System properties, in the order they're specified in sys_prop_names.
+// If neither of these options are specified (or they're both an empty string),
+// this function returns false. Otherwise, it returns true, and the presiding
+// options string is written to the `options` buffer of size `size`. If this
+// function returns true, `options` is guaranteed to be null-terminated.
+// `options_size` should be at least PROP_VALUE_MAX.
+__LIBC_HIDDEN__ bool get_config_from_env_or_sysprops(const char* env_var_name,
+                                                     const char* const* sys_prop_names,
+                                                     size_t sys_prop_names_size, char* options,
+                                                     size_t options_size);
diff --git a/libc/include/android/legacy_signal_inlines.h b/libc/include/android/legacy_signal_inlines.h
index 95c2320db..f2bdcf695 100644
--- a/libc/include/android/legacy_signal_inlines.h
+++ b/libc/include/android/legacy_signal_inlines.h
@@ -89,7 +89,7 @@ static __inline int sigismember(const sigset_t *set, int signum) {
     errno = EINVAL;
     return -1;
   }
-  return (int)((local_set[bit / LONG_BIT] >> (bit % LONG_BIT)) & 1);
+  return (int)((local_set[bit / (8 * sizeof(long))] >> (bit % (8 * sizeof(long)))) & 1);
 }
 
 static __inline int sigaddset(sigset_t *set, int signum) {
@@ -100,7 +100,7 @@ static __inline int sigaddset(sigset_t *set, int signum) {
     errno = EINVAL;
     return -1;
   }
-  local_set[bit / LONG_BIT] |= 1UL << (bit % LONG_BIT);
+  local_set[bit / (8 * sizeof(long))] |= 1UL << (bit % (8 * sizeof(long)));
   return 0;
 }
 
@@ -112,7 +112,7 @@ static __inline int sigdelset(sigset_t *set, int signum) {
     errno = EINVAL;
     return -1;
   }
-  local_set[bit / LONG_BIT] &= ~(1UL << (bit % LONG_BIT));
+  local_set[bit / (8 * sizeof(long))] &= ~(1UL << (bit % (8 * sizeof(long))));
   return 0;
 }
 
diff --git a/libc/include/bits/glibc-syscalls.h b/libc/include/bits/glibc-syscalls.h
index d17dc12bb..c1449193c 100644
--- a/libc/include/bits/glibc-syscalls.h
+++ b/libc/include/bits/glibc-syscalls.h
@@ -1023,6 +1023,9 @@
 #if defined(__NR_set_mempolicy)
   #define SYS_set_mempolicy __NR_set_mempolicy
 #endif
+#if defined(__NR_set_mempolicy_home_node)
+  #define SYS_set_mempolicy_home_node __NR_set_mempolicy_home_node
+#endif
 #if defined(__NR_set_robust_list)
   #define SYS_set_robust_list __NR_set_robust_list
 #endif
diff --git a/libc/include/bits/signal_types.h b/libc/include/bits/signal_types.h
index e1a155f5b..699e2572d 100644
--- a/libc/include/bits/signal_types.h
+++ b/libc/include/bits/signal_types.h
@@ -61,7 +61,7 @@ typedef __sighandler_t sighandler_t; /* glibc compatibility. */
 #if defined(__LP64__)
 typedef sigset_t sigset64_t;
 #else
-typedef struct { unsigned long __bits[_KERNEL__NSIG/LONG_BIT]; } sigset64_t;
+typedef struct { unsigned long __bits[_KERNEL__NSIG/(8*sizeof(long))]; } sigset64_t;
 #endif
 
 #if defined(__LP64__)
diff --git a/libc/include/spawn.h b/libc/include/spawn.h
index 2e239bfc2..e4454530e 100644
--- a/libc/include/spawn.h
+++ b/libc/include/spawn.h
@@ -46,6 +46,8 @@ __BEGIN_DECLS
 #define POSIX_SPAWN_USEVFORK 64
 #define POSIX_SPAWN_SETSID 128
 #endif
+// mark all fds (except stdin/out/err) as close-on-exec prior to executing registered file actions
+#define POSIX_SPAWN_CLOEXEC_DEFAULT 256
 
 typedef struct __posix_spawnattr* posix_spawnattr_t;
 typedef struct __posix_spawn_file_actions* posix_spawn_file_actions_t;
diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
index 99a200a01..5b9d99b3a 100644
--- a/libc/include/sys/cdefs.h
+++ b/libc/include/sys/cdefs.h
@@ -327,12 +327,7 @@
 
 #define __overloadable __attribute__((overloadable))
 
-// TODO(pirama) Remove this version check after switching to clang-r445002
-#if __clang_major__ == 14 && __clang_patchlevel__ >= 2
 #define __diagnose_as_builtin(...) __attribute__((diagnose_as_builtin(__VA_ARGS__)))
-#else
-#define __diagnose_as_builtin(...)
-#endif
 
 /* Used to tag non-static symbols that are private and never exposed by the shared library. */
 #define __LIBC_HIDDEN__ __attribute__((visibility("hidden")))
diff --git a/libc/kernel/uapi/asm-arm/asm/unistd-eabi.h b/libc/kernel/uapi/asm-arm/asm/unistd-eabi.h
index 2af0e9743..71b25e75d 100644
--- a/libc/kernel/uapi/asm-arm/asm/unistd-eabi.h
+++ b/libc/kernel/uapi/asm-arm/asm/unistd-eabi.h
@@ -420,4 +420,5 @@
 #define __NR_landlock_restrict_self (__NR_SYSCALL_BASE + 446)
 #define __NR_process_mrelease (__NR_SYSCALL_BASE + 448)
 #define __NR_futex_waitv (__NR_SYSCALL_BASE + 449)
+#define __NR_set_mempolicy_home_node (__NR_SYSCALL_BASE + 450)
 #endif
diff --git a/libc/kernel/uapi/asm-arm/asm/unistd-oabi.h b/libc/kernel/uapi/asm-arm/asm/unistd-oabi.h
index 20870bb71..08b3b9a4c 100644
--- a/libc/kernel/uapi/asm-arm/asm/unistd-oabi.h
+++ b/libc/kernel/uapi/asm-arm/asm/unistd-oabi.h
@@ -432,4 +432,5 @@
 #define __NR_landlock_restrict_self (__NR_SYSCALL_BASE + 446)
 #define __NR_process_mrelease (__NR_SYSCALL_BASE + 448)
 #define __NR_futex_waitv (__NR_SYSCALL_BASE + 449)
+#define __NR_set_mempolicy_home_node (__NR_SYSCALL_BASE + 450)
 #endif
diff --git a/libc/kernel/uapi/asm-arm64/asm/hwcap.h b/libc/kernel/uapi/asm-arm64/asm/hwcap.h
index d4d432402..431672479 100644
--- a/libc/kernel/uapi/asm-arm64/asm/hwcap.h
+++ b/libc/kernel/uapi/asm-arm64/asm/hwcap.h
@@ -70,4 +70,6 @@
 #define HWCAP2_BTI (1 << 17)
 #define HWCAP2_MTE (1 << 18)
 #define HWCAP2_ECV (1 << 19)
+#define HWCAP2_AFP (1 << 20)
+#define HWCAP2_RPRES (1 << 21)
 #endif
diff --git a/libc/kernel/uapi/asm-arm64/asm/kvm.h b/libc/kernel/uapi/asm-arm64/asm/kvm.h
index 74aa7c6ee..c53ee8768 100644
--- a/libc/kernel/uapi/asm-arm64/asm/kvm.h
+++ b/libc/kernel/uapi/asm-arm64/asm/kvm.h
@@ -167,6 +167,10 @@ struct kvm_arm_copy_mte_tags {
 #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL 2
 #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED 3
 #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4)
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3 KVM_REG_ARM_FW_REG(3)
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL 0
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL 1
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED 2
 #define KVM_REG_ARM64_SVE (0x15 << KVM_REG_ARM_COPROC_SHIFT)
 #define KVM_REG_ARM64_SVE_ZREG_BASE 0
 #define KVM_REG_ARM64_SVE_PREG_BASE 0x400
diff --git a/libc/kernel/uapi/asm-generic/unistd.h b/libc/kernel/uapi/asm-generic/unistd.h
index 1e14ee5c4..4b9f1740f 100644
--- a/libc/kernel/uapi/asm-generic/unistd.h
+++ b/libc/kernel/uapi/asm-generic/unistd.h
@@ -412,8 +412,9 @@
 #endif
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
+#define __NR_set_mempolicy_home_node 450
 #undef __NR_syscalls
-#define __NR_syscalls 450
+#define __NR_syscalls 451
 #if __BITS_PER_LONG == 64 && !defined(__SYSCALL_COMPAT)
 #define __NR_fcntl __NR3264_fcntl
 #define __NR_statfs __NR3264_statfs
diff --git a/libc/kernel/uapi/asm-x86/asm/kvm.h b/libc/kernel/uapi/asm-x86/asm/kvm.h
index fd0f5f801..caf8fc0be 100644
--- a/libc/kernel/uapi/asm-x86/asm/kvm.h
+++ b/libc/kernel/uapi/asm-x86/asm/kvm.h
@@ -322,6 +322,7 @@ struct kvm_debugregs {
 };
 struct kvm_xsave {
   __u32 region[1024];
+  __u32 extra[0];
 };
 #define KVM_MAX_XCRS 16
 struct kvm_xcr {
@@ -361,6 +362,7 @@ struct kvm_sync_regs {
 #define KVM_STATE_NESTED_VMX_VMCS_SIZE 0x1000
 #define KVM_STATE_NESTED_SVM_VMCB_SIZE 0x1000
 #define KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE 0x00000001
+#define KVM_X86_XCOMP_GUEST_SUPP 0
 struct kvm_vmx_nested_state_data {
   __u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
   __u8 shadow_vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
diff --git a/libc/kernel/uapi/asm-x86/asm/prctl.h b/libc/kernel/uapi/asm-x86/asm/prctl.h
index d8014b1cf..c5ba2d605 100644
--- a/libc/kernel/uapi/asm-x86/asm/prctl.h
+++ b/libc/kernel/uapi/asm-x86/asm/prctl.h
@@ -27,6 +27,8 @@
 #define ARCH_GET_XCOMP_SUPP 0x1021
 #define ARCH_GET_XCOMP_PERM 0x1022
 #define ARCH_REQ_XCOMP_PERM 0x1023
+#define ARCH_GET_XCOMP_GUEST_PERM 0x1024
+#define ARCH_REQ_XCOMP_GUEST_PERM 0x1025
 #define ARCH_MAP_VDSO_X32 0x2001
 #define ARCH_MAP_VDSO_32 0x2002
 #define ARCH_MAP_VDSO_64 0x2003
diff --git a/libc/kernel/uapi/asm-x86/asm/unistd_32.h b/libc/kernel/uapi/asm-x86/asm/unistd_32.h
index 3a353fef2..8e5751612 100644
--- a/libc/kernel/uapi/asm-x86/asm/unistd_32.h
+++ b/libc/kernel/uapi/asm-x86/asm/unistd_32.h
@@ -457,4 +457,5 @@
 #define __NR_memfd_secret 447
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
+#define __NR_set_mempolicy_home_node 450
 #endif
diff --git a/libc/kernel/uapi/asm-x86/asm/unistd_64.h b/libc/kernel/uapi/asm-x86/asm/unistd_64.h
index 5fa4d2c61..54ff16fa4 100644
--- a/libc/kernel/uapi/asm-x86/asm/unistd_64.h
+++ b/libc/kernel/uapi/asm-x86/asm/unistd_64.h
@@ -379,4 +379,5 @@
 #define __NR_memfd_secret 447
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
+#define __NR_set_mempolicy_home_node 450
 #endif
diff --git a/libc/kernel/uapi/asm-x86/asm/unistd_x32.h b/libc/kernel/uapi/asm-x86/asm/unistd_x32.h
index b7abf1285..1e05d75e3 100644
--- a/libc/kernel/uapi/asm-x86/asm/unistd_x32.h
+++ b/libc/kernel/uapi/asm-x86/asm/unistd_x32.h
@@ -332,6 +332,7 @@
 #define __NR_memfd_secret (__X32_SYSCALL_BIT + 447)
 #define __NR_process_mrelease (__X32_SYSCALL_BIT + 448)
 #define __NR_futex_waitv (__X32_SYSCALL_BIT + 449)
+#define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/libc/kernel/uapi/drm/drm_fourcc.h b/libc/kernel/uapi/drm/drm_fourcc.h
index 2b5d202d2..e845c8cd8 100644
--- a/libc/kernel/uapi/drm/drm_fourcc.h
+++ b/libc/kernel/uapi/drm/drm_fourcc.h
@@ -123,6 +123,7 @@ extern "C" {
 #define DRM_FORMAT_P010 fourcc_code('P', '0', '1', '0')
 #define DRM_FORMAT_P012 fourcc_code('P', '0', '1', '2')
 #define DRM_FORMAT_P016 fourcc_code('P', '0', '1', '6')
+#define DRM_FORMAT_P030 fourcc_code('P', '0', '3', '0')
 #define DRM_FORMAT_Q410 fourcc_code('Q', '4', '1', '0')
 #define DRM_FORMAT_Q401 fourcc_code('Q', '4', '0', '1')
 #define DRM_FORMAT_YUV410 fourcc_code('Y', 'U', 'V', '9')
diff --git a/libc/kernel/uapi/drm/vmwgfx_drm.h b/libc/kernel/uapi/drm/vmwgfx_drm.h
index f3a67e118..395743bd8 100644
--- a/libc/kernel/uapi/drm/vmwgfx_drm.h
+++ b/libc/kernel/uapi/drm/vmwgfx_drm.h
@@ -75,6 +75,7 @@ extern "C" {
 #define DRM_VMW_PARAM_HW_CAPS2 13
 #define DRM_VMW_PARAM_SM4_1 14
 #define DRM_VMW_PARAM_SM5 15
+#define DRM_VMW_PARAM_GL43 16
 enum drm_vmw_handle_type {
   DRM_VMW_HANDLE_LEGACY = 0,
   DRM_VMW_HANDLE_PRIME = 1
diff --git a/libc/kernel/uapi/linux/audit.h b/libc/kernel/uapi/linux/audit.h
index 342c7ce26..30a94af77 100644
--- a/libc/kernel/uapi/linux/audit.h
+++ b/libc/kernel/uapi/linux/audit.h
@@ -377,6 +377,6 @@ struct audit_rule_data {
   __u32 values[AUDIT_MAX_FIELDS];
   __u32 fieldflags[AUDIT_MAX_FIELDS];
   __u32 buflen;
-  char buf[0];
+  char buf[];
 };
 #endif
diff --git a/libc/kernel/uapi/linux/bpf.h b/libc/kernel/uapi/linux/bpf.h
index 833f00e9b..d363e8117 100644
--- a/libc/kernel/uapi/linux/bpf.h
+++ b/libc/kernel/uapi/linux/bpf.h
@@ -360,8 +360,10 @@ union bpf_attr {
       __u32 attach_prog_fd;
       __u32 attach_btf_obj_fd;
     };
-    __u32 : 32;
+    __u32 core_relo_cnt;
     __aligned_u64 fd_array;
+    __aligned_u64 core_relos;
+    __u32 core_relo_rec_size;
   };
   struct {
     __aligned_u64 pathname;
@@ -478,7 +480,7 @@ union bpf_attr {
     __u32 flags;
   } prog_bind_map;
 } __attribute__((aligned(8)));
-#define __BPF_FUNC_MAPPER(FN) FN(unspec), FN(map_lookup_elem), FN(map_update_elem), FN(map_delete_elem), FN(probe_read), FN(ktime_get_ns), FN(trace_printk), FN(get_prandom_u32), FN(get_smp_processor_id), FN(skb_store_bytes), FN(l3_csum_replace), FN(l4_csum_replace), FN(tail_call), FN(clone_redirect), FN(get_current_pid_tgid), FN(get_current_uid_gid), FN(get_current_comm), FN(get_cgroup_classid), FN(skb_vlan_push), FN(skb_vlan_pop), FN(skb_get_tunnel_key), FN(skb_set_tunnel_key), FN(perf_event_read), FN(redirect), FN(get_route_realm), FN(perf_event_output), FN(skb_load_bytes), FN(get_stackid), FN(csum_diff), FN(skb_get_tunnel_opt), FN(skb_set_tunnel_opt), FN(skb_change_proto), FN(skb_change_type), FN(skb_under_cgroup), FN(get_hash_recalc), FN(get_current_task), FN(probe_write_user), FN(current_task_under_cgroup), FN(skb_change_tail), FN(skb_pull_data), FN(csum_update), FN(set_hash_invalid), FN(get_numa_node_id), FN(skb_change_head), FN(xdp_adjust_head), FN(probe_read_str), FN(get_socket_cookie), FN(get_socket_uid), FN(set_hash), FN(setsockopt), FN(skb_adjust_room), FN(redirect_map), FN(sk_redirect_map), FN(sock_map_update), FN(xdp_adjust_meta), FN(perf_event_read_value), FN(perf_prog_read_value), FN(getsockopt), FN(override_return), FN(sock_ops_cb_flags_set), FN(msg_redirect_map), FN(msg_apply_bytes), FN(msg_cork_bytes), FN(msg_pull_data), FN(bind), FN(xdp_adjust_tail), FN(skb_get_xfrm_state), FN(get_stack), FN(skb_load_bytes_relative), FN(fib_lookup), FN(sock_hash_update), FN(msg_redirect_hash), FN(sk_redirect_hash), FN(lwt_push_encap), FN(lwt_seg6_store_bytes), FN(lwt_seg6_adjust_srh), FN(lwt_seg6_action), FN(rc_repeat), FN(rc_keydown), FN(skb_cgroup_id), FN(get_current_cgroup_id), FN(get_local_storage), FN(sk_select_reuseport), FN(skb_ancestor_cgroup_id), FN(sk_lookup_tcp), FN(sk_lookup_udp), FN(sk_release), FN(map_push_elem), FN(map_pop_elem), FN(map_peek_elem), FN(msg_push_data), FN(msg_pop_data), FN(rc_pointer_rel), FN(spin_lock), FN(spin_unlock), FN(sk_fullsock), FN(tcp_sock), FN(skb_ecn_set_ce), FN(get_listener_sock), FN(skc_lookup_tcp), FN(tcp_check_syncookie), FN(sysctl_get_name), FN(sysctl_get_current_value), FN(sysctl_get_new_value), FN(sysctl_set_new_value), FN(strtol), FN(strtoul), FN(sk_storage_get), FN(sk_storage_delete), FN(send_signal), FN(tcp_gen_syncookie), FN(skb_output), FN(probe_read_user), FN(probe_read_kernel), FN(probe_read_user_str), FN(probe_read_kernel_str), FN(tcp_send_ack), FN(send_signal_thread), FN(jiffies64), FN(read_branch_records), FN(get_ns_current_pid_tgid), FN(xdp_output), FN(get_netns_cookie), FN(get_current_ancestor_cgroup_id), FN(sk_assign), FN(ktime_get_boot_ns), FN(seq_printf), FN(seq_write), FN(sk_cgroup_id), FN(sk_ancestor_cgroup_id), FN(ringbuf_output), FN(ringbuf_reserve), FN(ringbuf_submit), FN(ringbuf_discard), FN(ringbuf_query), FN(csum_level), FN(skc_to_tcp6_sock), FN(skc_to_tcp_sock), FN(skc_to_tcp_timewait_sock), FN(skc_to_tcp_request_sock), FN(skc_to_udp6_sock), FN(get_task_stack), FN(load_hdr_opt), FN(store_hdr_opt), FN(reserve_hdr_opt), FN(inode_storage_get), FN(inode_storage_delete), FN(d_path), FN(copy_from_user), FN(snprintf_btf), FN(seq_printf_btf), FN(skb_cgroup_classid), FN(redirect_neigh), FN(per_cpu_ptr), FN(this_cpu_ptr), FN(redirect_peer), FN(task_storage_get), FN(task_storage_delete), FN(get_current_task_btf), FN(bprm_opts_set), FN(ktime_get_coarse_ns), FN(ima_inode_hash), FN(sock_from_file), FN(check_mtu), FN(for_each_map_elem), FN(snprintf), FN(sys_bpf), FN(btf_find_by_name_kind), FN(sys_close), FN(timer_init), FN(timer_set_callback), FN(timer_start), FN(timer_cancel), FN(get_func_ip), FN(get_attach_cookie), FN(task_pt_regs), FN(get_branch_snapshot), FN(trace_vprintk), FN(skc_to_unix_sock), FN(kallsyms_lookup_name),
+#define __BPF_FUNC_MAPPER(FN) FN(unspec), FN(map_lookup_elem), FN(map_update_elem), FN(map_delete_elem), FN(probe_read), FN(ktime_get_ns), FN(trace_printk), FN(get_prandom_u32), FN(get_smp_processor_id), FN(skb_store_bytes), FN(l3_csum_replace), FN(l4_csum_replace), FN(tail_call), FN(clone_redirect), FN(get_current_pid_tgid), FN(get_current_uid_gid), FN(get_current_comm), FN(get_cgroup_classid), FN(skb_vlan_push), FN(skb_vlan_pop), FN(skb_get_tunnel_key), FN(skb_set_tunnel_key), FN(perf_event_read), FN(redirect), FN(get_route_realm), FN(perf_event_output), FN(skb_load_bytes), FN(get_stackid), FN(csum_diff), FN(skb_get_tunnel_opt), FN(skb_set_tunnel_opt), FN(skb_change_proto), FN(skb_change_type), FN(skb_under_cgroup), FN(get_hash_recalc), FN(get_current_task), FN(probe_write_user), FN(current_task_under_cgroup), FN(skb_change_tail), FN(skb_pull_data), FN(csum_update), FN(set_hash_invalid), FN(get_numa_node_id), FN(skb_change_head), FN(xdp_adjust_head), FN(probe_read_str), FN(get_socket_cookie), FN(get_socket_uid), FN(set_hash), FN(setsockopt), FN(skb_adjust_room), FN(redirect_map), FN(sk_redirect_map), FN(sock_map_update), FN(xdp_adjust_meta), FN(perf_event_read_value), FN(perf_prog_read_value), FN(getsockopt), FN(override_return), FN(sock_ops_cb_flags_set), FN(msg_redirect_map), FN(msg_apply_bytes), FN(msg_cork_bytes), FN(msg_pull_data), FN(bind), FN(xdp_adjust_tail), FN(skb_get_xfrm_state), FN(get_stack), FN(skb_load_bytes_relative), FN(fib_lookup), FN(sock_hash_update), FN(msg_redirect_hash), FN(sk_redirect_hash), FN(lwt_push_encap), FN(lwt_seg6_store_bytes), FN(lwt_seg6_adjust_srh), FN(lwt_seg6_action), FN(rc_repeat), FN(rc_keydown), FN(skb_cgroup_id), FN(get_current_cgroup_id), FN(get_local_storage), FN(sk_select_reuseport), FN(skb_ancestor_cgroup_id), FN(sk_lookup_tcp), FN(sk_lookup_udp), FN(sk_release), FN(map_push_elem), FN(map_pop_elem), FN(map_peek_elem), FN(msg_push_data), FN(msg_pop_data), FN(rc_pointer_rel), FN(spin_lock), FN(spin_unlock), FN(sk_fullsock), FN(tcp_sock), FN(skb_ecn_set_ce), FN(get_listener_sock), FN(skc_lookup_tcp), FN(tcp_check_syncookie), FN(sysctl_get_name), FN(sysctl_get_current_value), FN(sysctl_get_new_value), FN(sysctl_set_new_value), FN(strtol), FN(strtoul), FN(sk_storage_get), FN(sk_storage_delete), FN(send_signal), FN(tcp_gen_syncookie), FN(skb_output), FN(probe_read_user), FN(probe_read_kernel), FN(probe_read_user_str), FN(probe_read_kernel_str), FN(tcp_send_ack), FN(send_signal_thread), FN(jiffies64), FN(read_branch_records), FN(get_ns_current_pid_tgid), FN(xdp_output), FN(get_netns_cookie), FN(get_current_ancestor_cgroup_id), FN(sk_assign), FN(ktime_get_boot_ns), FN(seq_printf), FN(seq_write), FN(sk_cgroup_id), FN(sk_ancestor_cgroup_id), FN(ringbuf_output), FN(ringbuf_reserve), FN(ringbuf_submit), FN(ringbuf_discard), FN(ringbuf_query), FN(csum_level), FN(skc_to_tcp6_sock), FN(skc_to_tcp_sock), FN(skc_to_tcp_timewait_sock), FN(skc_to_tcp_request_sock), FN(skc_to_udp6_sock), FN(get_task_stack), FN(load_hdr_opt), FN(store_hdr_opt), FN(reserve_hdr_opt), FN(inode_storage_get), FN(inode_storage_delete), FN(d_path), FN(copy_from_user), FN(snprintf_btf), FN(seq_printf_btf), FN(skb_cgroup_classid), FN(redirect_neigh), FN(per_cpu_ptr), FN(this_cpu_ptr), FN(redirect_peer), FN(task_storage_get), FN(task_storage_delete), FN(get_current_task_btf), FN(bprm_opts_set), FN(ktime_get_coarse_ns), FN(ima_inode_hash), FN(sock_from_file), FN(check_mtu), FN(for_each_map_elem), FN(snprintf), FN(sys_bpf), FN(btf_find_by_name_kind), FN(sys_close), FN(timer_init), FN(timer_set_callback), FN(timer_start), FN(timer_cancel), FN(get_func_ip), FN(get_attach_cookie), FN(task_pt_regs), FN(get_branch_snapshot), FN(trace_vprintk), FN(skc_to_unix_sock), FN(kallsyms_lookup_name), FN(find_vma), FN(loop), FN(strncmp), FN(get_func_arg), FN(get_func_ret), FN(get_func_arg_cnt),
 #define __BPF_ENUM_FN(x) BPF_FUNC_ ##x
 enum bpf_func_id {
   __BPF_FUNC_MAPPER(__BPF_ENUM_FN) __BPF_FUNC_MAX_ID,
@@ -1162,6 +1164,7 @@ struct bpf_sk_lookup {
   __u32 local_ip4;
   __u32 local_ip6[4];
   __u32 local_port;
+  __u32 ingress_ifindex;
 };
 struct btf_ptr {
   void * ptr;
@@ -1174,4 +1177,24 @@ enum {
   BTF_F_PTR_RAW = (1ULL << 2),
   BTF_F_ZERO = (1ULL << 3),
 };
+enum bpf_core_relo_kind {
+  BPF_CORE_FIELD_BYTE_OFFSET = 0,
+  BPF_CORE_FIELD_BYTE_SIZE = 1,
+  BPF_CORE_FIELD_EXISTS = 2,
+  BPF_CORE_FIELD_SIGNED = 3,
+  BPF_CORE_FIELD_LSHIFT_U64 = 4,
+  BPF_CORE_FIELD_RSHIFT_U64 = 5,
+  BPF_CORE_TYPE_ID_LOCAL = 6,
+  BPF_CORE_TYPE_ID_TARGET = 7,
+  BPF_CORE_TYPE_EXISTS = 8,
+  BPF_CORE_TYPE_SIZE = 9,
+  BPF_CORE_ENUMVAL_EXISTS = 10,
+  BPF_CORE_ENUMVAL_VALUE = 11,
+};
+struct bpf_core_relo {
+  __u32 insn_off;
+  __u32 type_id;
+  __u32 access_str_off;
+  enum bpf_core_relo_kind kind;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/btf.h b/libc/kernel/uapi/linux/btf.h
index 1bb64db46..fc57d3c79 100644
--- a/libc/kernel/uapi/linux/btf.h
+++ b/libc/kernel/uapi/linux/btf.h
@@ -64,6 +64,7 @@ enum {
   BTF_KIND_DATASEC = 15,
   BTF_KIND_FLOAT = 16,
   BTF_KIND_DECL_TAG = 17,
+  BTF_KIND_TYPE_TAG = 18,
   NR_BTF_KINDS,
   BTF_KIND_MAX = NR_BTF_KINDS - 1,
 };
diff --git a/libc/kernel/uapi/linux/can/netlink.h b/libc/kernel/uapi/linux/can/netlink.h
index 5ea6346a0..f4086c0d0 100644
--- a/libc/kernel/uapi/linux/can/netlink.h
+++ b/libc/kernel/uapi/linux/can/netlink.h
@@ -97,6 +97,7 @@ enum {
   IFLA_CAN_DATA_BITRATE_CONST,
   IFLA_CAN_BITRATE_MAX,
   IFLA_CAN_TDC,
+  IFLA_CAN_CTRLMODE_EXT,
   __IFLA_CAN_MAX,
   IFLA_CAN_MAX = __IFLA_CAN_MAX - 1
 };
@@ -114,5 +115,11 @@ enum {
   __IFLA_CAN_TDC,
   IFLA_CAN_TDC_MAX = __IFLA_CAN_TDC - 1
 };
+enum {
+  IFLA_CAN_CTRLMODE_UNSPEC,
+  IFLA_CAN_CTRLMODE_SUPPORTED,
+  __IFLA_CAN_CTRLMODE,
+  IFLA_CAN_CTRLMODE_MAX = __IFLA_CAN_CTRLMODE - 1
+};
 #define CAN_TERMINATION_DISABLED 0
 #endif
diff --git a/libc/kernel/uapi/linux/comedi.h b/libc/kernel/uapi/linux/comedi.h
new file mode 100644
index 000000000..e0d015a3a
--- /dev/null
+++ b/libc/kernel/uapi/linux/comedi.h
@@ -0,0 +1,669 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef _COMEDI_H
+#define _COMEDI_H
+#define COMEDI_MAJORVERSION 0
+#define COMEDI_MINORVERSION 7
+#define COMEDI_MICROVERSION 76
+#define VERSION "0.7.76"
+#define COMEDI_MAJOR 98
+#define COMEDI_NDEVICES 16
+#define COMEDI_NDEVCONFOPTS 32
+#define COMEDI_DEVCONF_AUX_DATA3_LENGTH 25
+#define COMEDI_DEVCONF_AUX_DATA2_LENGTH 26
+#define COMEDI_DEVCONF_AUX_DATA1_LENGTH 27
+#define COMEDI_DEVCONF_AUX_DATA0_LENGTH 28
+#define COMEDI_DEVCONF_AUX_DATA_HI 29
+#define COMEDI_DEVCONF_AUX_DATA_LO 30
+#define COMEDI_DEVCONF_AUX_DATA_LENGTH 31
+#define COMEDI_NAMELEN 20
+#define CR_PACK(chan,rng,aref) ((((aref) & 0x3) << 24) | (((rng) & 0xff) << 16) | (chan))
+#define CR_PACK_FLAGS(chan,range,aref,flags) (CR_PACK(chan, range, aref) | ((flags) & CR_FLAGS_MASK))
+#define CR_CHAN(a) ((a) & 0xffff)
+#define CR_RANGE(a) (((a) >> 16) & 0xff)
+#define CR_AREF(a) (((a) >> 24) & 0x03)
+#define CR_FLAGS_MASK 0xfc000000
+#define CR_ALT_FILTER 0x04000000
+#define CR_DITHER CR_ALT_FILTER
+#define CR_DEGLITCH CR_ALT_FILTER
+#define CR_ALT_SOURCE 0x08000000
+#define CR_EDGE 0x40000000
+#define CR_INVERT 0x80000000
+#define AREF_GROUND 0x00
+#define AREF_COMMON 0x01
+#define AREF_DIFF 0x02
+#define AREF_OTHER 0x03
+#define GPCT_RESET 0x0001
+#define GPCT_SET_SOURCE 0x0002
+#define GPCT_SET_GATE 0x0004
+#define GPCT_SET_DIRECTION 0x0008
+#define GPCT_SET_OPERATION 0x0010
+#define GPCT_ARM 0x0020
+#define GPCT_DISARM 0x0040
+#define GPCT_GET_INT_CLK_FRQ 0x0080
+#define GPCT_INT_CLOCK 0x0001
+#define GPCT_EXT_PIN 0x0002
+#define GPCT_NO_GATE 0x0004
+#define GPCT_UP 0x0008
+#define GPCT_DOWN 0x0010
+#define GPCT_HWUD 0x0020
+#define GPCT_SIMPLE_EVENT 0x0040
+#define GPCT_SINGLE_PERIOD 0x0080
+#define GPCT_SINGLE_PW 0x0100
+#define GPCT_CONT_PULSE_OUT 0x0200
+#define GPCT_SINGLE_PULSE_OUT 0x0400
+#define INSN_MASK_WRITE 0x8000000
+#define INSN_MASK_READ 0x4000000
+#define INSN_MASK_SPECIAL 0x2000000
+#define INSN_READ (0 | INSN_MASK_READ)
+#define INSN_WRITE (1 | INSN_MASK_WRITE)
+#define INSN_BITS (2 | INSN_MASK_READ | INSN_MASK_WRITE)
+#define INSN_CONFIG (3 | INSN_MASK_READ | INSN_MASK_WRITE)
+#define INSN_DEVICE_CONFIG (INSN_CONFIG | INSN_MASK_SPECIAL)
+#define INSN_GTOD (4 | INSN_MASK_READ | INSN_MASK_SPECIAL)
+#define INSN_WAIT (5 | INSN_MASK_WRITE | INSN_MASK_SPECIAL)
+#define INSN_INTTRIG (6 | INSN_MASK_WRITE | INSN_MASK_SPECIAL)
+#define CMDF_BOGUS 0x00000001
+#define CMDF_PRIORITY 0x00000008
+#define CMDF_WAKE_EOS 0x00000020
+#define CMDF_WRITE 0x00000040
+#define CMDF_RAWDATA 0x00000080
+#define CMDF_ROUND_MASK 0x00030000
+#define CMDF_ROUND_NEAREST 0x00000000
+#define CMDF_ROUND_DOWN 0x00010000
+#define CMDF_ROUND_UP 0x00020000
+#define CMDF_ROUND_UP_NEXT 0x00030000
+#define COMEDI_EV_START 0x00040000
+#define COMEDI_EV_SCAN_BEGIN 0x00080000
+#define COMEDI_EV_CONVERT 0x00100000
+#define COMEDI_EV_SCAN_END 0x00200000
+#define COMEDI_EV_STOP 0x00400000
+#define TRIG_BOGUS CMDF_BOGUS
+#define TRIG_RT CMDF_PRIORITY
+#define TRIG_WAKE_EOS CMDF_WAKE_EOS
+#define TRIG_WRITE CMDF_WRITE
+#define TRIG_ROUND_MASK CMDF_ROUND_MASK
+#define TRIG_ROUND_NEAREST CMDF_ROUND_NEAREST
+#define TRIG_ROUND_DOWN CMDF_ROUND_DOWN
+#define TRIG_ROUND_UP CMDF_ROUND_UP
+#define TRIG_ROUND_UP_NEXT CMDF_ROUND_UP_NEXT
+#define TRIG_ANY 0xffffffff
+#define TRIG_INVALID 0x00000000
+#define TRIG_NONE 0x00000001
+#define TRIG_NOW 0x00000002
+#define TRIG_FOLLOW 0x00000004
+#define TRIG_TIME 0x00000008
+#define TRIG_TIMER 0x00000010
+#define TRIG_COUNT 0x00000020
+#define TRIG_EXT 0x00000040
+#define TRIG_INT 0x00000080
+#define TRIG_OTHER 0x00000100
+#define SDF_BUSY 0x0001
+#define SDF_BUSY_OWNER 0x0002
+#define SDF_LOCKED 0x0004
+#define SDF_LOCK_OWNER 0x0008
+#define SDF_MAXDATA 0x0010
+#define SDF_FLAGS 0x0020
+#define SDF_RANGETYPE 0x0040
+#define SDF_PWM_COUNTER 0x0080
+#define SDF_PWM_HBRIDGE 0x0100
+#define SDF_CMD 0x1000
+#define SDF_SOFT_CALIBRATED 0x2000
+#define SDF_CMD_WRITE 0x4000
+#define SDF_CMD_READ 0x8000
+#define SDF_READABLE 0x00010000
+#define SDF_WRITABLE 0x00020000
+#define SDF_WRITEABLE SDF_WRITABLE
+#define SDF_INTERNAL 0x00040000
+#define SDF_GROUND 0x00100000
+#define SDF_COMMON 0x00200000
+#define SDF_DIFF 0x00400000
+#define SDF_OTHER 0x00800000
+#define SDF_DITHER 0x01000000
+#define SDF_DEGLITCH 0x02000000
+#define SDF_MMAP 0x04000000
+#define SDF_RUNNING 0x08000000
+#define SDF_LSAMPL 0x10000000
+#define SDF_PACKED 0x20000000
+enum comedi_subdevice_type {
+  COMEDI_SUBD_UNUSED,
+  COMEDI_SUBD_AI,
+  COMEDI_SUBD_AO,
+  COMEDI_SUBD_DI,
+  COMEDI_SUBD_DO,
+  COMEDI_SUBD_DIO,
+  COMEDI_SUBD_COUNTER,
+  COMEDI_SUBD_TIMER,
+  COMEDI_SUBD_MEMORY,
+  COMEDI_SUBD_CALIB,
+  COMEDI_SUBD_PROC,
+  COMEDI_SUBD_SERIAL,
+  COMEDI_SUBD_PWM
+};
+enum comedi_io_direction {
+  COMEDI_INPUT = 0,
+  COMEDI_OUTPUT = 1,
+  COMEDI_OPENDRAIN = 2
+};
+enum configuration_ids {
+  INSN_CONFIG_DIO_INPUT = COMEDI_INPUT,
+  INSN_CONFIG_DIO_OUTPUT = COMEDI_OUTPUT,
+  INSN_CONFIG_DIO_OPENDRAIN = COMEDI_OPENDRAIN,
+  INSN_CONFIG_ANALOG_TRIG = 16,
+  INSN_CONFIG_ALT_SOURCE = 20,
+  INSN_CONFIG_DIGITAL_TRIG = 21,
+  INSN_CONFIG_BLOCK_SIZE = 22,
+  INSN_CONFIG_TIMER_1 = 23,
+  INSN_CONFIG_FILTER = 24,
+  INSN_CONFIG_CHANGE_NOTIFY = 25,
+  INSN_CONFIG_SERIAL_CLOCK = 26,
+  INSN_CONFIG_BIDIRECTIONAL_DATA = 27,
+  INSN_CONFIG_DIO_QUERY = 28,
+  INSN_CONFIG_PWM_OUTPUT = 29,
+  INSN_CONFIG_GET_PWM_OUTPUT = 30,
+  INSN_CONFIG_ARM = 31,
+  INSN_CONFIG_DISARM = 32,
+  INSN_CONFIG_GET_COUNTER_STATUS = 33,
+  INSN_CONFIG_RESET = 34,
+  INSN_CONFIG_GPCT_SINGLE_PULSE_GENERATOR = 1001,
+  INSN_CONFIG_GPCT_PULSE_TRAIN_GENERATOR = 1002,
+  INSN_CONFIG_GPCT_QUADRATURE_ENCODER = 1003,
+  INSN_CONFIG_SET_GATE_SRC = 2001,
+  INSN_CONFIG_GET_GATE_SRC = 2002,
+  INSN_CONFIG_SET_CLOCK_SRC = 2003,
+  INSN_CONFIG_GET_CLOCK_SRC = 2004,
+  INSN_CONFIG_SET_OTHER_SRC = 2005,
+  INSN_CONFIG_GET_HARDWARE_BUFFER_SIZE = 2006,
+  INSN_CONFIG_SET_COUNTER_MODE = 4097,
+  INSN_CONFIG_8254_SET_MODE = INSN_CONFIG_SET_COUNTER_MODE,
+  INSN_CONFIG_8254_READ_STATUS = 4098,
+  INSN_CONFIG_SET_ROUTING = 4099,
+  INSN_CONFIG_GET_ROUTING = 4109,
+  INSN_CONFIG_PWM_SET_PERIOD = 5000,
+  INSN_CONFIG_PWM_GET_PERIOD = 5001,
+  INSN_CONFIG_GET_PWM_STATUS = 5002,
+  INSN_CONFIG_PWM_SET_H_BRIDGE = 5003,
+  INSN_CONFIG_PWM_GET_H_BRIDGE = 5004,
+  INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS = 5005,
+};
+enum device_config_route_ids {
+  INSN_DEVICE_CONFIG_TEST_ROUTE = 0,
+  INSN_DEVICE_CONFIG_CONNECT_ROUTE = 1,
+  INSN_DEVICE_CONFIG_DISCONNECT_ROUTE = 2,
+  INSN_DEVICE_CONFIG_GET_ROUTES = 3,
+};
+enum comedi_digital_trig_op {
+  COMEDI_DIGITAL_TRIG_DISABLE = 0,
+  COMEDI_DIGITAL_TRIG_ENABLE_EDGES = 1,
+  COMEDI_DIGITAL_TRIG_ENABLE_LEVELS = 2
+};
+enum comedi_support_level {
+  COMEDI_UNKNOWN_SUPPORT = 0,
+  COMEDI_SUPPORTED,
+  COMEDI_UNSUPPORTED
+};
+enum comedi_counter_status_flags {
+  COMEDI_COUNTER_ARMED = 0x1,
+  COMEDI_COUNTER_COUNTING = 0x2,
+  COMEDI_COUNTER_TERMINAL_COUNT = 0x4,
+};
+#define CIO 'd'
+#define COMEDI_DEVCONFIG _IOW(CIO, 0, struct comedi_devconfig)
+#define COMEDI_DEVINFO _IOR(CIO, 1, struct comedi_devinfo)
+#define COMEDI_SUBDINFO _IOR(CIO, 2, struct comedi_subdinfo)
+#define COMEDI_CHANINFO _IOR(CIO, 3, struct comedi_chaninfo)
+#define COMEDI_LOCK _IO(CIO, 5)
+#define COMEDI_UNLOCK _IO(CIO, 6)
+#define COMEDI_CANCEL _IO(CIO, 7)
+#define COMEDI_RANGEINFO _IOR(CIO, 8, struct comedi_rangeinfo)
+#define COMEDI_CMD _IOR(CIO, 9, struct comedi_cmd)
+#define COMEDI_CMDTEST _IOR(CIO, 10, struct comedi_cmd)
+#define COMEDI_INSNLIST _IOR(CIO, 11, struct comedi_insnlist)
+#define COMEDI_INSN _IOR(CIO, 12, struct comedi_insn)
+#define COMEDI_BUFCONFIG _IOR(CIO, 13, struct comedi_bufconfig)
+#define COMEDI_BUFINFO _IOWR(CIO, 14, struct comedi_bufinfo)
+#define COMEDI_POLL _IO(CIO, 15)
+#define COMEDI_SETRSUBD _IO(CIO, 16)
+#define COMEDI_SETWSUBD _IO(CIO, 17)
+struct comedi_insn {
+  unsigned int insn;
+  unsigned int n;
+  unsigned int __user * data;
+  unsigned int subdev;
+  unsigned int chanspec;
+  unsigned int unused[3];
+};
+struct comedi_insnlist {
+  unsigned int n_insns;
+  struct comedi_insn __user * insns;
+};
+struct comedi_cmd {
+  unsigned int subdev;
+  unsigned int flags;
+  unsigned int start_src;
+  unsigned int start_arg;
+  unsigned int scan_begin_src;
+  unsigned int scan_begin_arg;
+  unsigned int convert_src;
+  unsigned int convert_arg;
+  unsigned int scan_end_src;
+  unsigned int scan_end_arg;
+  unsigned int stop_src;
+  unsigned int stop_arg;
+  unsigned int * chanlist;
+  unsigned int chanlist_len;
+  short __user * data;
+  unsigned int data_len;
+};
+struct comedi_chaninfo {
+  unsigned int subdev;
+  unsigned int __user * maxdata_list;
+  unsigned int __user * flaglist;
+  unsigned int __user * rangelist;
+  unsigned int unused[4];
+};
+struct comedi_rangeinfo {
+  unsigned int range_type;
+  void __user * range_ptr;
+};
+struct comedi_krange {
+  int min;
+  int max;
+  unsigned int flags;
+};
+struct comedi_subdinfo {
+  unsigned int type;
+  unsigned int n_chan;
+  unsigned int subd_flags;
+  unsigned int timer_type;
+  unsigned int len_chanlist;
+  unsigned int maxdata;
+  unsigned int flags;
+  unsigned int range_type;
+  unsigned int settling_time_0;
+  unsigned int insn_bits_support;
+  unsigned int unused[8];
+};
+struct comedi_devinfo {
+  unsigned int version_code;
+  unsigned int n_subdevs;
+  char driver_name[COMEDI_NAMELEN];
+  char board_name[COMEDI_NAMELEN];
+  int read_subdevice;
+  int write_subdevice;
+  int unused[30];
+};
+struct comedi_devconfig {
+  char board_name[COMEDI_NAMELEN];
+  int options[COMEDI_NDEVCONFOPTS];
+};
+struct comedi_bufconfig {
+  unsigned int subdevice;
+  unsigned int flags;
+  unsigned int maximum_size;
+  unsigned int size;
+  unsigned int unused[4];
+};
+struct comedi_bufinfo {
+  unsigned int subdevice;
+  unsigned int bytes_read;
+  unsigned int buf_write_ptr;
+  unsigned int buf_read_ptr;
+  unsigned int buf_write_count;
+  unsigned int buf_read_count;
+  unsigned int bytes_written;
+  unsigned int unused[4];
+};
+#define __RANGE(a,b) ((((a) & 0xffff) << 16) | ((b) & 0xffff))
+#define RANGE_OFFSET(a) (((a) >> 16) & 0xffff)
+#define RANGE_LENGTH(b) ((b) & 0xffff)
+#define RF_UNIT(flags) ((flags) & 0xff)
+#define RF_EXTERNAL 0x100
+#define UNIT_volt 0
+#define UNIT_mA 1
+#define UNIT_none 2
+#define COMEDI_MIN_SPEED 0xffffffffu
+enum i8254_mode {
+  I8254_MODE0 = (0 << 1),
+  I8254_MODE1 = (1 << 1),
+  I8254_MODE2 = (2 << 1),
+  I8254_MODE3 = (3 << 1),
+  I8254_MODE4 = (4 << 1),
+  I8254_MODE5 = (5 << 1),
+  I8254_BCD = 1,
+  I8254_BINARY = 0
+};
+#define NI_NAMES_BASE 0x8000u
+#define _TERM_N(base,n,x) ((base) + ((x) & ((n) - 1)))
+#define NI_PFI(x) _TERM_N(NI_NAMES_BASE, 64, x)
+#define TRIGGER_LINE(x) _TERM_N(NI_PFI(- 1) + 1, 8, x)
+#define NI_RTSI_BRD(x) _TERM_N(TRIGGER_LINE(- 1) + 1, 4, x)
+#define NI_MAX_COUNTERS 8
+#define NI_COUNTER_NAMES_BASE (NI_RTSI_BRD(- 1) + 1)
+#define NI_CtrSource(x) _TERM_N(NI_COUNTER_NAMES_BASE, NI_MAX_COUNTERS, x)
+#define NI_GATES_NAMES_BASE (NI_CtrSource(- 1) + 1)
+#define NI_CtrGate(x) _TERM_N(NI_GATES_NAMES_BASE, NI_MAX_COUNTERS, x)
+#define NI_CtrAux(x) _TERM_N(NI_CtrGate(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrA(x) _TERM_N(NI_CtrAux(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrB(x) _TERM_N(NI_CtrA(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrZ(x) _TERM_N(NI_CtrB(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_GATES_NAMES_MAX NI_CtrZ(- 1)
+#define NI_CtrArmStartTrigger(x) _TERM_N(NI_CtrZ(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrInternalOutput(x) _TERM_N(NI_CtrArmStartTrigger(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrOut(x) _TERM_N(NI_CtrInternalOutput(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_CtrSampleClock(x) _TERM_N(NI_CtrOut(- 1) + 1, NI_MAX_COUNTERS, x)
+#define NI_COUNTER_NAMES_MAX NI_CtrSampleClock(- 1)
+enum ni_common_signal_names {
+  PXI_Star = NI_COUNTER_NAMES_MAX + 1,
+  PXI_Clk10,
+  PXIe_Clk100,
+  NI_AI_SampleClock,
+  NI_AI_SampleClockTimebase,
+  NI_AI_StartTrigger,
+  NI_AI_ReferenceTrigger,
+  NI_AI_ConvertClock,
+  NI_AI_ConvertClockTimebase,
+  NI_AI_PauseTrigger,
+  NI_AI_HoldCompleteEvent,
+  NI_AI_HoldComplete,
+  NI_AI_ExternalMUXClock,
+  NI_AI_STOP,
+  NI_AO_SampleClock,
+  NI_AO_SampleClockTimebase,
+  NI_AO_StartTrigger,
+  NI_AO_PauseTrigger,
+  NI_DI_SampleClock,
+  NI_DI_SampleClockTimebase,
+  NI_DI_StartTrigger,
+  NI_DI_ReferenceTrigger,
+  NI_DI_PauseTrigger,
+  NI_DI_InputBufferFull,
+  NI_DI_ReadyForStartEvent,
+  NI_DI_ReadyForTransferEventBurst,
+  NI_DI_ReadyForTransferEventPipelined,
+  NI_DO_SampleClock,
+  NI_DO_SampleClockTimebase,
+  NI_DO_StartTrigger,
+  NI_DO_PauseTrigger,
+  NI_DO_OutputBufferFull,
+  NI_DO_DataActiveEvent,
+  NI_DO_ReadyForStartEvent,
+  NI_DO_ReadyForTransferEvent,
+  NI_MasterTimebase,
+  NI_20MHzTimebase,
+  NI_80MHzTimebase,
+  NI_100MHzTimebase,
+  NI_200MHzTimebase,
+  NI_100kHzTimebase,
+  NI_10MHzRefClock,
+  NI_FrequencyOutput,
+  NI_ChangeDetectionEvent,
+  NI_AnalogComparisonEvent,
+  NI_WatchdogExpiredEvent,
+  NI_WatchdogExpirationTrigger,
+  NI_SCXI_Trig1,
+  NI_LogicLow,
+  NI_LogicHigh,
+  NI_ExternalStrobe,
+  NI_PFI_DO,
+  NI_CaseGround,
+  NI_RGOUT0,
+  _NI_NAMES_MAX_PLUS_1,
+  NI_NUM_NAMES = _NI_NAMES_MAX_PLUS_1 - NI_NAMES_BASE,
+};
+#define NI_USUAL_PFI_SELECT(x) (((x) < 10) ? (0x1 + (x)) : (0xb + (x)))
+#define NI_USUAL_RTSI_SELECT(x) (((x) < 7) ? (0xb + (x)) : 0x1b)
+#define NI_GPCT_COUNTING_MODE_SHIFT 16
+#define NI_GPCT_INDEX_PHASE_BITSHIFT 20
+#define NI_GPCT_COUNTING_DIRECTION_SHIFT 24
+enum ni_gpct_mode_bits {
+  NI_GPCT_GATE_ON_BOTH_EDGES_BIT = 0x4,
+  NI_GPCT_EDGE_GATE_MODE_MASK = 0x18,
+  NI_GPCT_EDGE_GATE_STARTS_STOPS_BITS = 0x0,
+  NI_GPCT_EDGE_GATE_STOPS_STARTS_BITS = 0x8,
+  NI_GPCT_EDGE_GATE_STARTS_BITS = 0x10,
+  NI_GPCT_EDGE_GATE_NO_STARTS_NO_STOPS_BITS = 0x18,
+  NI_GPCT_STOP_MODE_MASK = 0x60,
+  NI_GPCT_STOP_ON_GATE_BITS = 0x00,
+  NI_GPCT_STOP_ON_GATE_OR_TC_BITS = 0x20,
+  NI_GPCT_STOP_ON_GATE_OR_SECOND_TC_BITS = 0x40,
+  NI_GPCT_LOAD_B_SELECT_BIT = 0x80,
+  NI_GPCT_OUTPUT_MODE_MASK = 0x300,
+  NI_GPCT_OUTPUT_TC_PULSE_BITS = 0x100,
+  NI_GPCT_OUTPUT_TC_TOGGLE_BITS = 0x200,
+  NI_GPCT_OUTPUT_TC_OR_GATE_TOGGLE_BITS = 0x300,
+  NI_GPCT_HARDWARE_DISARM_MASK = 0xc00,
+  NI_GPCT_NO_HARDWARE_DISARM_BITS = 0x000,
+  NI_GPCT_DISARM_AT_TC_BITS = 0x400,
+  NI_GPCT_DISARM_AT_GATE_BITS = 0x800,
+  NI_GPCT_DISARM_AT_TC_OR_GATE_BITS = 0xc00,
+  NI_GPCT_LOADING_ON_TC_BIT = 0x1000,
+  NI_GPCT_LOADING_ON_GATE_BIT = 0x4000,
+  NI_GPCT_COUNTING_MODE_MASK = 0x7 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_COUNTING_MODE_NORMAL_BITS = 0x0 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_COUNTING_MODE_QUADRATURE_X1_BITS = 0x1 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_COUNTING_MODE_QUADRATURE_X2_BITS = 0x2 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_COUNTING_MODE_QUADRATURE_X4_BITS = 0x3 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_COUNTING_MODE_TWO_PULSE_BITS = 0x4 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_COUNTING_MODE_SYNC_SOURCE_BITS = 0x6 << NI_GPCT_COUNTING_MODE_SHIFT,
+  NI_GPCT_INDEX_PHASE_MASK = 0x3 << NI_GPCT_INDEX_PHASE_BITSHIFT,
+  NI_GPCT_INDEX_PHASE_LOW_A_LOW_B_BITS = 0x0 << NI_GPCT_INDEX_PHASE_BITSHIFT,
+  NI_GPCT_INDEX_PHASE_LOW_A_HIGH_B_BITS = 0x1 << NI_GPCT_INDEX_PHASE_BITSHIFT,
+  NI_GPCT_INDEX_PHASE_HIGH_A_LOW_B_BITS = 0x2 << NI_GPCT_INDEX_PHASE_BITSHIFT,
+  NI_GPCT_INDEX_PHASE_HIGH_A_HIGH_B_BITS = 0x3 << NI_GPCT_INDEX_PHASE_BITSHIFT,
+  NI_GPCT_INDEX_ENABLE_BIT = 0x400000,
+  NI_GPCT_COUNTING_DIRECTION_MASK = 0x3 << NI_GPCT_COUNTING_DIRECTION_SHIFT,
+  NI_GPCT_COUNTING_DIRECTION_DOWN_BITS = 0x00 << NI_GPCT_COUNTING_DIRECTION_SHIFT,
+  NI_GPCT_COUNTING_DIRECTION_UP_BITS = 0x1 << NI_GPCT_COUNTING_DIRECTION_SHIFT,
+  NI_GPCT_COUNTING_DIRECTION_HW_UP_DOWN_BITS = 0x2 << NI_GPCT_COUNTING_DIRECTION_SHIFT,
+  NI_GPCT_COUNTING_DIRECTION_HW_GATE_BITS = 0x3 << NI_GPCT_COUNTING_DIRECTION_SHIFT,
+  NI_GPCT_RELOAD_SOURCE_MASK = 0xc000000,
+  NI_GPCT_RELOAD_SOURCE_FIXED_BITS = 0x0,
+  NI_GPCT_RELOAD_SOURCE_SWITCHING_BITS = 0x4000000,
+  NI_GPCT_RELOAD_SOURCE_GATE_SELECT_BITS = 0x8000000,
+  NI_GPCT_OR_GATE_BIT = 0x10000000,
+  NI_GPCT_INVERT_OUTPUT_BIT = 0x20000000
+};
+enum ni_gpct_clock_source_bits {
+  NI_GPCT_CLOCK_SRC_SELECT_MASK = 0x3f,
+  NI_GPCT_TIMEBASE_1_CLOCK_SRC_BITS = 0x0,
+  NI_GPCT_TIMEBASE_2_CLOCK_SRC_BITS = 0x1,
+  NI_GPCT_TIMEBASE_3_CLOCK_SRC_BITS = 0x2,
+  NI_GPCT_LOGIC_LOW_CLOCK_SRC_BITS = 0x3,
+  NI_GPCT_NEXT_GATE_CLOCK_SRC_BITS = 0x4,
+  NI_GPCT_NEXT_TC_CLOCK_SRC_BITS = 0x5,
+  NI_GPCT_SOURCE_PIN_i_CLOCK_SRC_BITS = 0x6,
+  NI_GPCT_PXI10_CLOCK_SRC_BITS = 0x7,
+  NI_GPCT_PXI_STAR_TRIGGER_CLOCK_SRC_BITS = 0x8,
+  NI_GPCT_ANALOG_TRIGGER_OUT_CLOCK_SRC_BITS = 0x9,
+  NI_GPCT_PRESCALE_MODE_CLOCK_SRC_MASK = 0x30000000,
+  NI_GPCT_NO_PRESCALE_CLOCK_SRC_BITS = 0x0,
+  NI_GPCT_PRESCALE_X2_CLOCK_SRC_BITS = 0x10000000,
+  NI_GPCT_PRESCALE_X8_CLOCK_SRC_BITS = 0x20000000,
+  NI_GPCT_INVERT_CLOCK_SRC_BIT = 0x80000000
+};
+#define NI_GPCT_SOURCE_PIN_CLOCK_SRC_BITS(x) (0x10 + (x))
+#define NI_GPCT_RTSI_CLOCK_SRC_BITS(x) (0x18 + (x))
+#define NI_GPCT_PFI_CLOCK_SRC_BITS(x) (0x20 + (x))
+enum ni_gpct_gate_select {
+  NI_GPCT_TIMESTAMP_MUX_GATE_SELECT = 0x0,
+  NI_GPCT_AI_START2_GATE_SELECT = 0x12,
+  NI_GPCT_PXI_STAR_TRIGGER_GATE_SELECT = 0x13,
+  NI_GPCT_NEXT_OUT_GATE_SELECT = 0x14,
+  NI_GPCT_AI_START1_GATE_SELECT = 0x1c,
+  NI_GPCT_NEXT_SOURCE_GATE_SELECT = 0x1d,
+  NI_GPCT_ANALOG_TRIGGER_OUT_GATE_SELECT = 0x1e,
+  NI_GPCT_LOGIC_LOW_GATE_SELECT = 0x1f,
+  NI_GPCT_SOURCE_PIN_i_GATE_SELECT = 0x100,
+  NI_GPCT_GATE_PIN_i_GATE_SELECT = 0x101,
+  NI_GPCT_UP_DOWN_PIN_i_GATE_SELECT = 0x201,
+  NI_GPCT_SELECTED_GATE_GATE_SELECT = 0x21e,
+  NI_GPCT_DISABLED_GATE_SELECT = 0x8000,
+};
+#define NI_GPCT_GATE_PIN_GATE_SELECT(x) (0x102 + (x))
+#define NI_GPCT_RTSI_GATE_SELECT(x) NI_USUAL_RTSI_SELECT(x)
+#define NI_GPCT_PFI_GATE_SELECT(x) NI_USUAL_PFI_SELECT(x)
+#define NI_GPCT_UP_DOWN_PIN_GATE_SELECT(x) (0x202 + (x))
+enum ni_gpct_other_index {
+  NI_GPCT_SOURCE_ENCODER_A,
+  NI_GPCT_SOURCE_ENCODER_B,
+  NI_GPCT_SOURCE_ENCODER_Z
+};
+enum ni_gpct_other_select {
+  NI_GPCT_DISABLED_OTHER_SELECT = 0x8000,
+};
+#define NI_GPCT_PFI_OTHER_SELECT(x) NI_USUAL_PFI_SELECT(x)
+enum ni_gpct_arm_source {
+  NI_GPCT_ARM_IMMEDIATE = 0x0,
+  NI_GPCT_ARM_PAIRED_IMMEDIATE = 0x1,
+  NI_GPCT_HW_ARM = 0x1000,
+  NI_GPCT_ARM_UNKNOWN = NI_GPCT_HW_ARM,
+};
+enum ni_gpct_filter_select {
+  NI_GPCT_FILTER_OFF = 0x0,
+  NI_GPCT_FILTER_TIMEBASE_3_SYNC = 0x1,
+  NI_GPCT_FILTER_100x_TIMEBASE_1 = 0x2,
+  NI_GPCT_FILTER_20x_TIMEBASE_1 = 0x3,
+  NI_GPCT_FILTER_10x_TIMEBASE_1 = 0x4,
+  NI_GPCT_FILTER_2x_TIMEBASE_1 = 0x5,
+  NI_GPCT_FILTER_2x_TIMEBASE_3 = 0x6
+};
+enum ni_pfi_filter_select {
+  NI_PFI_FILTER_OFF = 0x0,
+  NI_PFI_FILTER_125ns = 0x1,
+  NI_PFI_FILTER_6425ns = 0x2,
+  NI_PFI_FILTER_2550us = 0x3
+};
+enum ni_mio_clock_source {
+  NI_MIO_INTERNAL_CLOCK = 0,
+  NI_MIO_RTSI_CLOCK = 1,
+  NI_MIO_PLL_PXI_STAR_TRIGGER_CLOCK = 2,
+  NI_MIO_PLL_PXI10_CLOCK = 3,
+  NI_MIO_PLL_RTSI0_CLOCK = 4
+};
+#define NI_MIO_PLL_RTSI_CLOCK(x) (NI_MIO_PLL_RTSI0_CLOCK + (x))
+enum ni_rtsi_routing {
+  NI_RTSI_OUTPUT_ADR_START1 = 0,
+  NI_RTSI_OUTPUT_ADR_START2 = 1,
+  NI_RTSI_OUTPUT_SCLKG = 2,
+  NI_RTSI_OUTPUT_DACUPDN = 3,
+  NI_RTSI_OUTPUT_DA_START1 = 4,
+  NI_RTSI_OUTPUT_G_SRC0 = 5,
+  NI_RTSI_OUTPUT_G_GATE0 = 6,
+  NI_RTSI_OUTPUT_RGOUT0 = 7,
+  NI_RTSI_OUTPUT_RTSI_BRD_0 = 8,
+  NI_RTSI_OUTPUT_RTSI_OSC = 12
+};
+#define NI_RTSI_OUTPUT_RTSI_BRD(x) (NI_RTSI_OUTPUT_RTSI_BRD_0 + (x))
+enum ni_pfi_routing {
+  NI_PFI_OUTPUT_PFI_DEFAULT = 0,
+  NI_PFI_OUTPUT_AI_START1 = 1,
+  NI_PFI_OUTPUT_AI_START2 = 2,
+  NI_PFI_OUTPUT_AI_CONVERT = 3,
+  NI_PFI_OUTPUT_G_SRC1 = 4,
+  NI_PFI_OUTPUT_G_GATE1 = 5,
+  NI_PFI_OUTPUT_AO_UPDATE_N = 6,
+  NI_PFI_OUTPUT_AO_START1 = 7,
+  NI_PFI_OUTPUT_AI_START_PULSE = 8,
+  NI_PFI_OUTPUT_G_SRC0 = 9,
+  NI_PFI_OUTPUT_G_GATE0 = 10,
+  NI_PFI_OUTPUT_EXT_STROBE = 11,
+  NI_PFI_OUTPUT_AI_EXT_MUX_CLK = 12,
+  NI_PFI_OUTPUT_GOUT0 = 13,
+  NI_PFI_OUTPUT_GOUT1 = 14,
+  NI_PFI_OUTPUT_FREQ_OUT = 15,
+  NI_PFI_OUTPUT_PFI_DO = 16,
+  NI_PFI_OUTPUT_I_ATRIG = 17,
+  NI_PFI_OUTPUT_RTSI0 = 18,
+  NI_PFI_OUTPUT_PXI_STAR_TRIGGER_IN = 26,
+  NI_PFI_OUTPUT_SCXI_TRIG1 = 27,
+  NI_PFI_OUTPUT_DIO_CHANGE_DETECT_RTSI = 28,
+  NI_PFI_OUTPUT_CDI_SAMPLE = 29,
+  NI_PFI_OUTPUT_CDO_UPDATE = 30
+};
+#define NI_PFI_OUTPUT_RTSI(x) (NI_PFI_OUTPUT_RTSI0 + (x))
+enum ni_660x_pfi_routing {
+  NI_660X_PFI_OUTPUT_COUNTER = 1,
+  NI_660X_PFI_OUTPUT_DIO = 2,
+};
+#define NI_EXT_PFI(x) (NI_USUAL_PFI_SELECT(x) - 1)
+#define NI_EXT_RTSI(x) (NI_USUAL_RTSI_SELECT(x) - 1)
+enum ni_m_series_cdio_scan_begin_src {
+  NI_CDIO_SCAN_BEGIN_SRC_GROUND = 0,
+  NI_CDIO_SCAN_BEGIN_SRC_AI_START = 18,
+  NI_CDIO_SCAN_BEGIN_SRC_AI_CONVERT = 19,
+  NI_CDIO_SCAN_BEGIN_SRC_PXI_STAR_TRIGGER = 20,
+  NI_CDIO_SCAN_BEGIN_SRC_G0_OUT = 28,
+  NI_CDIO_SCAN_BEGIN_SRC_G1_OUT = 29,
+  NI_CDIO_SCAN_BEGIN_SRC_ANALOG_TRIGGER = 30,
+  NI_CDIO_SCAN_BEGIN_SRC_AO_UPDATE = 31,
+  NI_CDIO_SCAN_BEGIN_SRC_FREQ_OUT = 32,
+  NI_CDIO_SCAN_BEGIN_SRC_DIO_CHANGE_DETECT_IRQ = 33
+};
+#define NI_CDIO_SCAN_BEGIN_SRC_PFI(x) NI_USUAL_PFI_SELECT(x)
+#define NI_CDIO_SCAN_BEGIN_SRC_RTSI(x) NI_USUAL_RTSI_SELECT(x)
+#define NI_AO_SCAN_BEGIN_SRC_PFI(x) NI_USUAL_PFI_SELECT(x)
+#define NI_AO_SCAN_BEGIN_SRC_RTSI(x) NI_USUAL_RTSI_SELECT(x)
+enum ni_freq_out_clock_source_bits {
+  NI_FREQ_OUT_TIMEBASE_1_DIV_2_CLOCK_SRC,
+  NI_FREQ_OUT_TIMEBASE_2_CLOCK_SRC
+};
+enum amplc_dio_clock_source {
+  AMPLC_DIO_CLK_CLKN,
+  AMPLC_DIO_CLK_10MHZ,
+  AMPLC_DIO_CLK_1MHZ,
+  AMPLC_DIO_CLK_100KHZ,
+  AMPLC_DIO_CLK_10KHZ,
+  AMPLC_DIO_CLK_1KHZ,
+  AMPLC_DIO_CLK_OUTNM1,
+  AMPLC_DIO_CLK_EXT,
+  AMPLC_DIO_CLK_VCC,
+  AMPLC_DIO_CLK_GND,
+  AMPLC_DIO_CLK_PAT_PRESENT,
+  AMPLC_DIO_CLK_20MHZ
+};
+enum amplc_dio_ts_clock_src {
+  AMPLC_DIO_TS_CLK_1GHZ,
+  AMPLC_DIO_TS_CLK_1MHZ,
+  AMPLC_DIO_TS_CLK_1KHZ
+};
+enum amplc_dio_gate_source {
+  AMPLC_DIO_GAT_VCC,
+  AMPLC_DIO_GAT_GND,
+  AMPLC_DIO_GAT_GATN,
+  AMPLC_DIO_GAT_NOUTNM2,
+  AMPLC_DIO_GAT_RESERVED4,
+  AMPLC_DIO_GAT_RESERVED5,
+  AMPLC_DIO_GAT_RESERVED6,
+  AMPLC_DIO_GAT_RESERVED7,
+  AMPLC_DIO_GAT_NGATN = 6,
+  AMPLC_DIO_GAT_OUTNM2,
+  AMPLC_DIO_GAT_PAT_PRESENT,
+  AMPLC_DIO_GAT_PAT_OCCURRED,
+  AMPLC_DIO_GAT_PAT_GONE,
+  AMPLC_DIO_GAT_NPAT_PRESENT,
+  AMPLC_DIO_GAT_NPAT_OCCURRED,
+  AMPLC_DIO_GAT_NPAT_GONE
+};
+enum ke_counter_clock_source {
+  KE_CLK_20MHZ,
+  KE_CLK_4MHZ,
+  KE_CLK_EXT
+};
+#endif
diff --git a/libc/kernel/uapi/linux/cyclades.h b/libc/kernel/uapi/linux/cyclades.h
new file mode 100644
index 000000000..c0aa7aa0a
--- /dev/null
+++ b/libc/kernel/uapi/linux/cyclades.h
@@ -0,0 +1,47 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef _UAPI_LINUX_CYCLADES_H
+#define _UAPI_LINUX_CYCLADES_H
+#warning "Support for features provided by this header has been removed"
+#warning "Please consider updating your code"
+struct cyclades_monitor {
+  unsigned long int_count;
+  unsigned long char_count;
+  unsigned long char_max;
+  unsigned long char_last;
+};
+#define CYGETMON 0x435901
+#define CYGETTHRESH 0x435902
+#define CYSETTHRESH 0x435903
+#define CYGETDEFTHRESH 0x435904
+#define CYSETDEFTHRESH 0x435905
+#define CYGETTIMEOUT 0x435906
+#define CYSETTIMEOUT 0x435907
+#define CYGETDEFTIMEOUT 0x435908
+#define CYSETDEFTIMEOUT 0x435909
+#define CYSETRFLOW 0x43590a
+#define CYGETRFLOW 0x43590b
+#define CYSETRTSDTR_INV 0x43590c
+#define CYGETRTSDTR_INV 0x43590d
+#define CYZSETPOLLCYCLE 0x43590e
+#define CYZGETPOLLCYCLE 0x43590f
+#define CYGETCD1400VER 0x435910
+#define CYSETWAIT 0x435912
+#define CYGETWAIT 0x435913
+#endif
diff --git a/libc/kernel/uapi/linux/ethtool.h b/libc/kernel/uapi/linux/ethtool.h
index baf417d0b..741ea2a54 100644
--- a/libc/kernel/uapi/linux/ethtool.h
+++ b/libc/kernel/uapi/linux/ethtool.h
@@ -78,6 +78,7 @@ enum tunable_id {
   ETHTOOL_RX_COPYBREAK,
   ETHTOOL_TX_COPYBREAK,
   ETHTOOL_PFC_PREVENTION_TOUT,
+  ETHTOOL_TX_COPYBREAK_BUF_SIZE,
   __ETHTOOL_TUNABLE_COUNT,
 };
 enum tunable_type_id {
diff --git a/libc/kernel/uapi/linux/ethtool_netlink.h b/libc/kernel/uapi/linux/ethtool_netlink.h
index 95d69b468..7dcae22b4 100644
--- a/libc/kernel/uapi/linux/ethtool_netlink.h
+++ b/libc/kernel/uapi/linux/ethtool_netlink.h
@@ -250,6 +250,7 @@ enum {
   ETHTOOL_A_RINGS_RX_MINI,
   ETHTOOL_A_RINGS_RX_JUMBO,
   ETHTOOL_A_RINGS_TX,
+  ETHTOOL_A_RINGS_RX_BUF_LEN,
   __ETHTOOL_A_RINGS_CNT,
   ETHTOOL_A_RINGS_MAX = (__ETHTOOL_A_RINGS_CNT - 1)
 };
diff --git a/libc/kernel/uapi/linux/fanotify.h b/libc/kernel/uapi/linux/fanotify.h
index b9a936491..6249292a8 100644
--- a/libc/kernel/uapi/linux/fanotify.h
+++ b/libc/kernel/uapi/linux/fanotify.h
@@ -38,6 +38,7 @@
 #define FAN_ACCESS_PERM 0x00020000
 #define FAN_OPEN_EXEC_PERM 0x00040000
 #define FAN_EVENT_ON_CHILD 0x08000000
+#define FAN_RENAME 0x10000000
 #define FAN_ONDIR 0x40000000
 #define FAN_CLOSE (FAN_CLOSE_WRITE | FAN_CLOSE_NOWRITE)
 #define FAN_MOVE (FAN_MOVED_FROM | FAN_MOVED_TO)
@@ -55,7 +56,9 @@
 #define FAN_REPORT_FID 0x00000200
 #define FAN_REPORT_DIR_FID 0x00000400
 #define FAN_REPORT_NAME 0x00000800
+#define FAN_REPORT_TARGET_FID 0x00001000
 #define FAN_REPORT_DFID_NAME (FAN_REPORT_DIR_FID | FAN_REPORT_NAME)
+#define FAN_REPORT_DFID_NAME_TARGET (FAN_REPORT_DFID_NAME | FAN_REPORT_FID | FAN_REPORT_TARGET_FID)
 #define FAN_ALL_INIT_FLAGS (FAN_CLOEXEC | FAN_NONBLOCK | FAN_ALL_CLASS_BITS | FAN_UNLIMITED_QUEUE | FAN_UNLIMITED_MARKS)
 #define FAN_MARK_ADD 0x00000001
 #define FAN_MARK_REMOVE 0x00000002
@@ -86,6 +89,8 @@ struct fanotify_event_metadata {
 #define FAN_EVENT_INFO_TYPE_DFID 3
 #define FAN_EVENT_INFO_TYPE_PIDFD 4
 #define FAN_EVENT_INFO_TYPE_ERROR 5
+#define FAN_EVENT_INFO_TYPE_OLD_DFID_NAME 10
+#define FAN_EVENT_INFO_TYPE_NEW_DFID_NAME 12
 struct fanotify_event_info_header {
   __u8 info_type;
   __u8 pad;
diff --git a/libc/kernel/uapi/linux/fuse.h b/libc/kernel/uapi/linux/fuse.h
index 358db192d..144e960c6 100644
--- a/libc/kernel/uapi/linux/fuse.h
+++ b/libc/kernel/uapi/linux/fuse.h
@@ -20,7 +20,7 @@
 #define _LINUX_FUSE_H
 #include <stdint.h>
 #define FUSE_KERNEL_VERSION 7
-#define FUSE_KERNEL_MINOR_VERSION 35
+#define FUSE_KERNEL_MINOR_VERSION 36
 #define FUSE_ROOT_ID 1
 struct fuse_attr {
   uint64_t ino;
@@ -106,7 +106,15 @@ struct fuse_file_lock {
 #define FUSE_SUBMOUNTS (1 << 27)
 #define FUSE_HANDLE_KILLPRIV_V2 (1 << 28)
 #define FUSE_SETXATTR_EXT (1 << 29)
+#define FUSE_INIT_EXT (1 << 30)
+#define FUSE_INIT_RESERVED (1 << 31)
+#define FUSE_SECURITY_CTX (1ULL << 32)
+#define FUSE_HAS_INODE_DAX (1ULL << 33)
+#if FUSE_KERNEL_VERSION > 7 || FUSE_KERNEL_VERSION == 7 && FUSE_KERNEL_MINOR_VERSION >= 36
+#define FUSE_PASSTHROUGH (1ULL << 63)
+#else
 #define FUSE_PASSTHROUGH (1 << 31)
+#endif
 #define CUSE_UNRESTRICTED_IOCTL (1 << 0)
 #define FUSE_RELEASE_FLUSH (1 << 0)
 #define FUSE_RELEASE_FLOCK_UNLOCK (1 << 1)
@@ -127,6 +135,7 @@ struct fuse_file_lock {
 #define FUSE_POLL_SCHEDULE_NOTIFY (1 << 0)
 #define FUSE_FSYNC_FDATASYNC (1 << 0)
 #define FUSE_ATTR_SUBMOUNT (1 << 0)
+#define FUSE_ATTR_DAX (1 << 1)
 #define FUSE_OPEN_KILL_SUIDGID (1 << 0)
 #define FUSE_SETXATTR_ACL_KILL_SGID (1 << 0)
 enum fuse_opcode {
@@ -359,6 +368,8 @@ struct fuse_init_in {
   uint32_t minor;
   uint32_t max_readahead;
   uint32_t flags;
+  uint32_t flags2;
+  uint32_t unused[11];
 };
 #define FUSE_COMPAT_INIT_OUT_SIZE 8
 #define FUSE_COMPAT_22_INIT_OUT_SIZE 24
@@ -373,7 +384,8 @@ struct fuse_init_out {
   uint32_t time_gran;
   uint16_t max_pages;
   uint16_t map_alignment;
-  uint32_t unused[8];
+  uint32_t flags2;
+  uint32_t unused[7];
 };
 #define CUSE_INIT_INFO_MAX 4096
 struct cuse_init_in {
@@ -464,8 +476,9 @@ struct fuse_dirent {
   uint32_t type;
   char name[];
 };
+#define FUSE_REC_ALIGN(x) (((x) + sizeof(uint64_t) - 1) & ~(sizeof(uint64_t) - 1))
 #define FUSE_NAME_OFFSET offsetof(struct fuse_dirent, name)
-#define FUSE_DIRENT_ALIGN(x) (((x) + sizeof(uint64_t) - 1) & ~(sizeof(uint64_t) - 1))
+#define FUSE_DIRENT_ALIGN(x) FUSE_REC_ALIGN(x)
 #define FUSE_DIRENT_SIZE(d) FUSE_DIRENT_ALIGN(FUSE_NAME_OFFSET + (d)->namelen)
 struct fuse_direntplus {
   struct fuse_entry_out entry_out;
@@ -512,7 +525,7 @@ struct fuse_notify_retrieve_in {
 };
 #define FUSE_DEV_IOC_MAGIC 229
 #define FUSE_DEV_IOC_CLONE _IOR(FUSE_DEV_IOC_MAGIC, 0, uint32_t)
-#define FUSE_DEV_IOC_PASSTHROUGH_OPEN _IOW(FUSE_DEV_IOC_MAGIC, 126, __u32)
+#define FUSE_DEV_IOC_PASSTHROUGH_OPEN _IOW(FUSE_DEV_IOC_MAGIC, 126, uint32_t)
 struct fuse_lseek_in {
   uint64_t fh;
   uint64_t offset;
@@ -551,4 +564,12 @@ struct fuse_removemapping_one {
 struct fuse_syncfs_in {
   uint64_t padding;
 };
+struct fuse_secctx {
+  uint32_t size;
+  uint32_t padding;
+};
+struct fuse_secctx_header {
+  uint32_t size;
+  uint32_t nr_secctx;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/idxd.h b/libc/kernel/uapi/linux/idxd.h
index 2966447f0..ad9ed4868 100644
--- a/libc/kernel/uapi/linux/idxd.h
+++ b/libc/kernel/uapi/linux/idxd.h
@@ -37,6 +37,7 @@ enum idxd_scmd_stat {
   IDXD_SCMD_WQ_NONE_CONFIGURED = 0x800d0000,
   IDXD_SCMD_WQ_NO_SIZE = 0x800e0000,
   IDXD_SCMD_WQ_NO_PRIV = 0x800f0000,
+  IDXD_SCMD_WQ_IRQ_ERR = 0x80100000,
 };
 #define IDXD_SCMD_SOFTERR_MASK 0x80000000
 #define IDXD_SCMD_SOFTERR_SHIFT 16
diff --git a/libc/kernel/uapi/linux/if_link.h b/libc/kernel/uapi/linux/if_link.h
index 6a1d89f64..7e413ae3c 100644
--- a/libc/kernel/uapi/linux/if_link.h
+++ b/libc/kernel/uapi/linux/if_link.h
@@ -150,6 +150,7 @@ enum {
   IFLA_PROTO_DOWN_REASON,
   IFLA_PARENT_DEV_NAME,
   IFLA_PARENT_DEV_BUS_NAME,
+  IFLA_GRO_MAX_SIZE,
   __IFLA_MAX
 };
 #define IFLA_MAX (__IFLA_MAX - 1)
@@ -556,6 +557,7 @@ enum {
   IFLA_BOND_TLB_DYNAMIC_LB,
   IFLA_BOND_PEER_NOTIF_DELAY,
   IFLA_BOND_AD_LACP_ACTIVE,
+  IFLA_BOND_MISSED_MAX,
   __IFLA_BOND_MAX,
 };
 #define IFLA_BOND_MAX (__IFLA_BOND_MAX - 1)
diff --git a/libc/kernel/uapi/linux/input-event-codes.h b/libc/kernel/uapi/linux/input-event-codes.h
index b283f5684..34cd23c5c 100644
--- a/libc/kernel/uapi/linux/input-event-codes.h
+++ b/libc/kernel/uapi/linux/input-event-codes.h
@@ -248,7 +248,8 @@
 #define KEY_PAUSECD 201
 #define KEY_PROG3 202
 #define KEY_PROG4 203
-#define KEY_DASHBOARD 204
+#define KEY_ALL_APPLICATIONS 204
+#define KEY_DASHBOARD KEY_ALL_APPLICATIONS
 #define KEY_SUSPEND 205
 #define KEY_CLOSE 206
 #define KEY_PLAY 207
@@ -549,6 +550,7 @@
 #define KEY_ASSISTANT 0x247
 #define KEY_KBD_LAYOUT_NEXT 0x248
 #define KEY_EMOJI_PICKER 0x249
+#define KEY_DICTATE 0x24a
 #define KEY_BRIGHTNESS_MIN 0x250
 #define KEY_BRIGHTNESS_MAX 0x251
 #define KEY_KBDINPUTASSIST_PREV 0x260
diff --git a/libc/kernel/uapi/linux/io_uring.h b/libc/kernel/uapi/linux/io_uring.h
index f6e825006..96944f863 100644
--- a/libc/kernel/uapi/linux/io_uring.h
+++ b/libc/kernel/uapi/linux/io_uring.h
@@ -71,6 +71,7 @@ enum {
   IOSQE_IO_HARDLINK_BIT,
   IOSQE_ASYNC_BIT,
   IOSQE_BUFFER_SELECT_BIT,
+  IOSQE_CQE_SKIP_SUCCESS_BIT,
 };
 #define IOSQE_FIXED_FILE (1U << IOSQE_FIXED_FILE_BIT)
 #define IOSQE_IO_DRAIN (1U << IOSQE_IO_DRAIN_BIT)
@@ -78,6 +79,7 @@ enum {
 #define IOSQE_IO_HARDLINK (1U << IOSQE_IO_HARDLINK_BIT)
 #define IOSQE_ASYNC (1U << IOSQE_ASYNC_BIT)
 #define IOSQE_BUFFER_SELECT (1U << IOSQE_BUFFER_SELECT_BIT)
+#define IOSQE_CQE_SKIP_SUCCESS (1U << IOSQE_CQE_SKIP_SUCCESS_BIT)
 #define IORING_SETUP_IOPOLL (1U << 0)
 #define IORING_SETUP_SQPOLL (1U << 1)
 #define IORING_SETUP_SQ_AFF (1U << 2)
@@ -206,6 +208,7 @@ struct io_uring_params {
 #define IORING_FEAT_EXT_ARG (1U << 8)
 #define IORING_FEAT_NATIVE_WORKERS (1U << 9)
 #define IORING_FEAT_RSRC_TAGS (1U << 10)
+#define IORING_FEAT_CQE_SKIP (1U << 11)
 enum {
   IORING_REGISTER_BUFFERS = 0,
   IORING_UNREGISTER_BUFFERS = 1,
diff --git a/libc/kernel/uapi/linux/kfd_sysfs.h b/libc/kernel/uapi/linux/kfd_sysfs.h
new file mode 100644
index 000000000..9604b0357
--- /dev/null
+++ b/libc/kernel/uapi/linux/kfd_sysfs.h
@@ -0,0 +1,83 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef KFD_SYSFS_H_INCLUDED
+#define KFD_SYSFS_H_INCLUDED
+#define HSA_CAP_HOT_PLUGGABLE 0x00000001
+#define HSA_CAP_ATS_PRESENT 0x00000002
+#define HSA_CAP_SHARED_WITH_GRAPHICS 0x00000004
+#define HSA_CAP_QUEUE_SIZE_POW2 0x00000008
+#define HSA_CAP_QUEUE_SIZE_32BIT 0x00000010
+#define HSA_CAP_QUEUE_IDLE_EVENT 0x00000020
+#define HSA_CAP_VA_LIMIT 0x00000040
+#define HSA_CAP_WATCH_POINTS_SUPPORTED 0x00000080
+#define HSA_CAP_WATCH_POINTS_TOTALBITS_MASK 0x00000f00
+#define HSA_CAP_WATCH_POINTS_TOTALBITS_SHIFT 8
+#define HSA_CAP_DOORBELL_TYPE_TOTALBITS_MASK 0x00003000
+#define HSA_CAP_DOORBELL_TYPE_TOTALBITS_SHIFT 12
+#define HSA_CAP_DOORBELL_TYPE_PRE_1_0 0x0
+#define HSA_CAP_DOORBELL_TYPE_1_0 0x1
+#define HSA_CAP_DOORBELL_TYPE_2_0 0x2
+#define HSA_CAP_AQL_QUEUE_DOUBLE_MAP 0x00004000
+#define HSA_CAP_RESERVED_WAS_SRAM_EDCSUPPORTED 0x00080000
+#define HSA_CAP_MEM_EDCSUPPORTED 0x00100000
+#define HSA_CAP_RASEVENTNOTIFY 0x00200000
+#define HSA_CAP_ASIC_REVISION_MASK 0x03c00000
+#define HSA_CAP_ASIC_REVISION_SHIFT 22
+#define HSA_CAP_SRAM_EDCSUPPORTED 0x04000000
+#define HSA_CAP_SVMAPI_SUPPORTED 0x08000000
+#define HSA_CAP_FLAGS_COHERENTHOSTACCESS 0x10000000
+#define HSA_CAP_RESERVED 0xe00f8000
+#define HSA_MEM_HEAP_TYPE_SYSTEM 0
+#define HSA_MEM_HEAP_TYPE_FB_PUBLIC 1
+#define HSA_MEM_HEAP_TYPE_FB_PRIVATE 2
+#define HSA_MEM_HEAP_TYPE_GPU_GDS 3
+#define HSA_MEM_HEAP_TYPE_GPU_LDS 4
+#define HSA_MEM_HEAP_TYPE_GPU_SCRATCH 5
+#define HSA_MEM_FLAGS_HOT_PLUGGABLE 0x00000001
+#define HSA_MEM_FLAGS_NON_VOLATILE 0x00000002
+#define HSA_MEM_FLAGS_RESERVED 0xfffffffc
+#define HSA_CACHE_TYPE_DATA 0x00000001
+#define HSA_CACHE_TYPE_INSTRUCTION 0x00000002
+#define HSA_CACHE_TYPE_CPU 0x00000004
+#define HSA_CACHE_TYPE_HSACU 0x00000008
+#define HSA_CACHE_TYPE_RESERVED 0xfffffff0
+#define HSA_IOLINK_TYPE_UNDEFINED 0
+#define HSA_IOLINK_TYPE_HYPERTRANSPORT 1
+#define HSA_IOLINK_TYPE_PCIEXPRESS 2
+#define HSA_IOLINK_TYPE_AMBA 3
+#define HSA_IOLINK_TYPE_MIPI 4
+#define HSA_IOLINK_TYPE_QPI_1_1 5
+#define HSA_IOLINK_TYPE_RESERVED1 6
+#define HSA_IOLINK_TYPE_RESERVED2 7
+#define HSA_IOLINK_TYPE_RAPID_IO 8
+#define HSA_IOLINK_TYPE_INFINIBAND 9
+#define HSA_IOLINK_TYPE_RESERVED3 10
+#define HSA_IOLINK_TYPE_XGMI 11
+#define HSA_IOLINK_TYPE_XGOP 12
+#define HSA_IOLINK_TYPE_GZ 13
+#define HSA_IOLINK_TYPE_ETHERNET_RDMA 14
+#define HSA_IOLINK_TYPE_RDMA_OTHER 15
+#define HSA_IOLINK_TYPE_OTHER 16
+#define HSA_IOLINK_FLAGS_ENABLED (1 << 0)
+#define HSA_IOLINK_FLAGS_NON_COHERENT (1 << 1)
+#define HSA_IOLINK_FLAGS_NO_ATOMICS_32_BIT (1 << 2)
+#define HSA_IOLINK_FLAGS_NO_ATOMICS_64_BIT (1 << 3)
+#define HSA_IOLINK_FLAGS_NO_PEER_TO_PEER_DMA (1 << 4)
+#define HSA_IOLINK_FLAGS_RESERVED 0xffffffe0
+#endif
diff --git a/libc/kernel/uapi/linux/kvm.h b/libc/kernel/uapi/linux/kvm.h
index 4e815cc52..1cf71827c 100644
--- a/libc/kernel/uapi/linux/kvm.h
+++ b/libc/kernel/uapi/linux/kvm.h
@@ -886,6 +886,10 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_EXIT_ON_EMULATION_FAILURE 204
 #define KVM_CAP_ARM_MTE 205
 #define KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM 206
+#define KVM_CAP_VM_GPA_BITS 207
+#define KVM_CAP_XSAVE2 208
+#define KVM_CAP_SYS_ATTRIBUTES 209
+#define KVM_CAP_PPC_AIL_MODE_3 210
 #ifdef KVM_CAP_IRQ_ROUTING
 struct kvm_irq_routing_irqchip {
   __u32 irqchip;
@@ -911,10 +915,17 @@ struct kvm_irq_routing_hv_sint {
   __u32 vcpu;
   __u32 sint;
 };
+struct kvm_irq_routing_xen_evtchn {
+  __u32 port;
+  __u32 vcpu;
+  __u32 priority;
+};
+#define KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL ((__u32) (- 1))
 #define KVM_IRQ_ROUTING_IRQCHIP 1
 #define KVM_IRQ_ROUTING_MSI 2
 #define KVM_IRQ_ROUTING_S390_ADAPTER 3
 #define KVM_IRQ_ROUTING_HV_SINT 4
+#define KVM_IRQ_ROUTING_XEN_EVTCHN 5
 struct kvm_irq_routing_entry {
   __u32 gsi;
   __u32 type;
@@ -925,6 +936,7 @@ struct kvm_irq_routing_entry {
     struct kvm_irq_routing_msi msi;
     struct kvm_irq_routing_s390_adapter adapter;
     struct kvm_irq_routing_hv_sint hv_sint;
+    struct kvm_irq_routing_xen_evtchn xen_evtchn;
     __u32 pad[8];
   } u;
 };
@@ -950,6 +962,7 @@ struct kvm_x86_mce {
 #define KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL (1 << 1)
 #define KVM_XEN_HVM_CONFIG_SHARED_INFO (1 << 2)
 #define KVM_XEN_HVM_CONFIG_RUNSTATE (1 << 3)
+#define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL (1 << 4)
 struct kvm_xen_hvm_config {
   __u32 flags;
   __u32 msr;
@@ -1504,4 +1517,5 @@ struct kvm_stats_desc {
   char name[];
 };
 #define KVM_GET_STATS_FD _IO(KVMIO, 0xce)
+#define KVM_GET_XSAVE2 _IOR(KVMIO, 0xcf, struct kvm_xsave)
 #endif
diff --git a/libc/kernel/uapi/linux/magic.h b/libc/kernel/uapi/linux/magic.h
index 6d583f38e..656341105 100644
--- a/libc/kernel/uapi/linux/magic.h
+++ b/libc/kernel/uapi/linux/magic.h
@@ -22,6 +22,7 @@
 #define AFFS_SUPER_MAGIC 0xadff
 #define AFS_SUPER_MAGIC 0x5346414F
 #define AUTOFS_SUPER_MAGIC 0x0187
+#define CEPH_SUPER_MAGIC 0x00c36400
 #define CODA_SUPER_MAGIC 0x73757245
 #define CRAMFS_MAGIC 0x28cd3d45
 #define CRAMFS_MAGIC_WEND 0x453dcd28
@@ -51,12 +52,14 @@
 #define EFIVARFS_MAGIC 0xde5e81e4
 #define HOSTFS_SUPER_MAGIC 0x00c0ffee
 #define OVERLAYFS_SUPER_MAGIC 0x794c7630
+#define FUSE_SUPER_MAGIC 0x65735546
 #define MINIX_SUPER_MAGIC 0x137F
 #define MINIX_SUPER_MAGIC2 0x138F
 #define MINIX2_SUPER_MAGIC 0x2468
 #define MINIX2_SUPER_MAGIC2 0x2478
 #define MINIX3_SUPER_MAGIC 0x4d5a
 #define MSDOS_SUPER_MAGIC 0x4d44
+#define EXFAT_SUPER_MAGIC 0x2011BAB0
 #define NCP_SUPER_MAGIC 0x564c
 #define NFS_SUPER_MAGIC 0x6969
 #define OCFS2_SUPER_MAGIC 0x7461636f
@@ -69,6 +72,8 @@
 #define REISER2FS_SUPER_MAGIC_STRING "ReIsEr2Fs"
 #define REISER2FS_JR_SUPER_MAGIC_STRING "ReIsEr3Fs"
 #define SMB_SUPER_MAGIC 0x517B
+#define CIFS_SUPER_MAGIC 0xFF534D42
+#define SMB2_SUPER_MAGIC 0xFE534D42
 #define CGROUP_SUPER_MAGIC 0x27e0eb
 #define CGROUP2_SUPER_MAGIC 0x63677270
 #define RDTGROUP_SUPER_MAGIC 0x7655821
diff --git a/libc/kernel/uapi/linux/module.h b/libc/kernel/uapi/linux/module.h
index f08dc67d0..34a4c5640 100644
--- a/libc/kernel/uapi/linux/module.h
+++ b/libc/kernel/uapi/linux/module.h
@@ -20,4 +20,5 @@
 #define _UAPI_LINUX_MODULE_H
 #define MODULE_INIT_IGNORE_MODVERSIONS 1
 #define MODULE_INIT_IGNORE_VERMAGIC 2
+#define MODULE_INIT_COMPRESSED_FILE 4
 #endif
diff --git a/libc/kernel/uapi/linux/net_tstamp.h b/libc/kernel/uapi/linux/net_tstamp.h
index 949bcadf8..510c0da41 100644
--- a/libc/kernel/uapi/linux/net_tstamp.h
+++ b/libc/kernel/uapi/linux/net_tstamp.h
@@ -50,6 +50,12 @@ struct hwtstamp_config {
   int tx_type;
   int rx_filter;
 };
+enum hwtstamp_flags {
+  HWTSTAMP_FLAG_BONDED_PHC_INDEX = (1 << 0),
+#define HWTSTAMP_FLAG_BONDED_PHC_INDEX HWTSTAMP_FLAG_BONDED_PHC_INDEX
+  HWTSTAMP_FLAG_LAST = HWTSTAMP_FLAG_BONDED_PHC_INDEX,
+  HWTSTAMP_FLAG_MASK = (HWTSTAMP_FLAG_LAST - 1) | HWTSTAMP_FLAG_LAST
+};
 enum hwtstamp_tx_types {
   HWTSTAMP_TX_OFF,
   HWTSTAMP_TX_ON,
diff --git a/libc/kernel/uapi/linux/nl80211.h b/libc/kernel/uapi/linux/nl80211.h
index edcda8af1..e9021789f 100644
--- a/libc/kernel/uapi/linux/nl80211.h
+++ b/libc/kernel/uapi/linux/nl80211.h
@@ -184,6 +184,7 @@ enum nl80211_commands {
   NL80211_CMD_COLOR_CHANGE_ABORTED,
   NL80211_CMD_COLOR_CHANGE_COMPLETED,
   NL80211_CMD_SET_FILS_AAD,
+  NL80211_CMD_ASSOC_COMEBACK,
   __NL80211_CMD_AFTER_LAST,
   NL80211_CMD_MAX = __NL80211_CMD_AFTER_LAST - 1
 };
@@ -508,6 +509,8 @@ enum nl80211_attrs {
   NL80211_ATTR_COLOR_CHANGE_ELEMS,
   NL80211_ATTR_MBSSID_CONFIG,
   NL80211_ATTR_MBSSID_ELEMS,
+  NL80211_ATTR_RADAR_BACKGROUND,
+  NL80211_ATTR_AP_SETTINGS_FLAGS,
   __NL80211_ATTR_AFTER_LAST,
   NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
   NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
@@ -1373,6 +1376,9 @@ enum nl80211_tdls_operation {
   NL80211_TDLS_ENABLE_LINK,
   NL80211_TDLS_DISABLE_LINK,
 };
+enum nl80211_ap_sme_features {
+  NL80211_AP_SME_SA_QUERY_OFFLOAD = 1 << 0,
+};
 enum nl80211_feature_flags {
   NL80211_FEATURE_SK_TX_STATUS = 1 << 0,
   NL80211_FEATURE_HT_IBSS = 1 << 1,
@@ -1468,6 +1474,7 @@ enum nl80211_ext_feature_index {
   NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
   NL80211_EXT_FEATURE_BSS_COLOR,
   NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+  NL80211_EXT_FEATURE_RADAR_BACKGROUND,
   NUM_NL80211_EXT_FEATURES,
   MAX_NL80211_EXT_FEATURES = NUM_NL80211_EXT_FEATURES - 1
 };
@@ -1859,4 +1866,8 @@ enum nl80211_mbssid_config_attributes {
   __NL80211_MBSSID_CONFIG_ATTR_LAST,
   NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
 };
+enum nl80211_ap_settings_flags {
+  NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT = 1 << 0,
+  NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT = 1 << 1,
+};
 #endif
diff --git a/libc/kernel/uapi/linux/pci_regs.h b/libc/kernel/uapi/linux/pci_regs.h
index 5920633f1..46612da1e 100644
--- a/libc/kernel/uapi/linux/pci_regs.h
+++ b/libc/kernel/uapi/linux/pci_regs.h
@@ -245,21 +245,21 @@
 #define PCI_SID_ESR_NSLOTS 0x1f
 #define PCI_SID_ESR_FIC 0x20
 #define PCI_SID_CHASSIS_NR 3
-#define PCI_MSI_FLAGS 2
+#define PCI_MSI_FLAGS 0x02
 #define PCI_MSI_FLAGS_ENABLE 0x0001
 #define PCI_MSI_FLAGS_QMASK 0x000e
 #define PCI_MSI_FLAGS_QSIZE 0x0070
 #define PCI_MSI_FLAGS_64BIT 0x0080
 #define PCI_MSI_FLAGS_MASKBIT 0x0100
 #define PCI_MSI_RFU 3
-#define PCI_MSI_ADDRESS_LO 4
-#define PCI_MSI_ADDRESS_HI 8
-#define PCI_MSI_DATA_32 8
-#define PCI_MSI_MASK_32 12
-#define PCI_MSI_PENDING_32 16
-#define PCI_MSI_DATA_64 12
-#define PCI_MSI_MASK_64 16
-#define PCI_MSI_PENDING_64 20
+#define PCI_MSI_ADDRESS_LO 0x04
+#define PCI_MSI_ADDRESS_HI 0x08
+#define PCI_MSI_DATA_32 0x08
+#define PCI_MSI_MASK_32 0x0c
+#define PCI_MSI_PENDING_32 0x10
+#define PCI_MSI_DATA_64 0x0c
+#define PCI_MSI_MASK_64 0x10
+#define PCI_MSI_PENDING_64 0x14
 #define PCI_MSIX_FLAGS 2
 #define PCI_MSIX_FLAGS_QSIZE 0x07FF
 #define PCI_MSIX_FLAGS_MASKALL 0x4000
@@ -273,10 +273,10 @@
 #define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR
 #define PCI_CAP_MSIX_SIZEOF 12
 #define PCI_MSIX_ENTRY_SIZE 16
-#define PCI_MSIX_ENTRY_LOWER_ADDR 0
-#define PCI_MSIX_ENTRY_UPPER_ADDR 4
-#define PCI_MSIX_ENTRY_DATA 8
-#define PCI_MSIX_ENTRY_VECTOR_CTRL 12
+#define PCI_MSIX_ENTRY_LOWER_ADDR 0x0
+#define PCI_MSIX_ENTRY_UPPER_ADDR 0x4
+#define PCI_MSIX_ENTRY_DATA 0x8
+#define PCI_MSIX_ENTRY_VECTOR_CTRL 0xc
 #define PCI_MSIX_ENTRY_CTRL_MASKBIT 0x00000001
 #define PCI_CHSWP_CSR 2
 #define PCI_CHSWP_DHA 0x01
@@ -379,7 +379,7 @@
 #define PCI_X_BRIDGE_STATUS 4
 #define PCI_SSVID_VENDOR_ID 4
 #define PCI_SSVID_DEVICE_ID 6
-#define PCI_EXP_FLAGS 2
+#define PCI_EXP_FLAGS 0x02
 #define PCI_EXP_FLAGS_VERS 0x000f
 #define PCI_EXP_FLAGS_TYPE 0x00f0
 #define PCI_EXP_TYPE_ENDPOINT 0x0
@@ -393,7 +393,7 @@
 #define PCI_EXP_TYPE_RC_EC 0xa
 #define PCI_EXP_FLAGS_SLOT 0x0100
 #define PCI_EXP_FLAGS_IRQ 0x3e00
-#define PCI_EXP_DEVCAP 4
+#define PCI_EXP_DEVCAP 0x04
 #define PCI_EXP_DEVCAP_PAYLOAD 0x00000007
 #define PCI_EXP_DEVCAP_PHANTOM 0x00000018
 #define PCI_EXP_DEVCAP_EXT_TAG 0x00000020
@@ -406,7 +406,7 @@
 #define PCI_EXP_DEVCAP_PWR_VAL 0x03fc0000
 #define PCI_EXP_DEVCAP_PWR_SCL 0x0c000000
 #define PCI_EXP_DEVCAP_FLR 0x10000000
-#define PCI_EXP_DEVCTL 8
+#define PCI_EXP_DEVCTL 0x08
 #define PCI_EXP_DEVCTL_CERE 0x0001
 #define PCI_EXP_DEVCTL_NFERE 0x0002
 #define PCI_EXP_DEVCTL_FERE 0x0004
@@ -431,7 +431,7 @@
 #define PCI_EXP_DEVCTL_READRQ_2048B 0x4000
 #define PCI_EXP_DEVCTL_READRQ_4096B 0x5000
 #define PCI_EXP_DEVCTL_BCR_FLR 0x8000
-#define PCI_EXP_DEVSTA 10
+#define PCI_EXP_DEVSTA 0x0a
 #define PCI_EXP_DEVSTA_CED 0x0001
 #define PCI_EXP_DEVSTA_NFED 0x0002
 #define PCI_EXP_DEVSTA_FED 0x0004
@@ -439,7 +439,7 @@
 #define PCI_EXP_DEVSTA_AUXPD 0x0010
 #define PCI_EXP_DEVSTA_TRPND 0x0020
 #define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V1 12
-#define PCI_EXP_LNKCAP 12
+#define PCI_EXP_LNKCAP 0x0c
 #define PCI_EXP_LNKCAP_SLS 0x0000000f
 #define PCI_EXP_LNKCAP_SLS_2_5GB 0x00000001
 #define PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002
@@ -458,7 +458,7 @@
 #define PCI_EXP_LNKCAP_DLLLARC 0x00100000
 #define PCI_EXP_LNKCAP_LBNC 0x00200000
 #define PCI_EXP_LNKCAP_PN 0xff000000
-#define PCI_EXP_LNKCTL 16
+#define PCI_EXP_LNKCTL 0x10
 #define PCI_EXP_LNKCTL_ASPMC 0x0003
 #define PCI_EXP_LNKCTL_ASPM_L0S 0x0001
 #define PCI_EXP_LNKCTL_ASPM_L1 0x0002
@@ -471,7 +471,7 @@
 #define PCI_EXP_LNKCTL_HAWD 0x0200
 #define PCI_EXP_LNKCTL_LBMIE 0x0400
 #define PCI_EXP_LNKCTL_LABIE 0x0800
-#define PCI_EXP_LNKSTA 18
+#define PCI_EXP_LNKSTA 0x12
 #define PCI_EXP_LNKSTA_CLS 0x000f
 #define PCI_EXP_LNKSTA_CLS_2_5GB 0x0001
 #define PCI_EXP_LNKSTA_CLS_5_0GB 0x0002
@@ -491,7 +491,7 @@
 #define PCI_EXP_LNKSTA_LBMS 0x4000
 #define PCI_EXP_LNKSTA_LABS 0x8000
 #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V1 20
-#define PCI_EXP_SLTCAP 20
+#define PCI_EXP_SLTCAP 0x14
 #define PCI_EXP_SLTCAP_ABP 0x00000001
 #define PCI_EXP_SLTCAP_PCP 0x00000002
 #define PCI_EXP_SLTCAP_MRLSP 0x00000004
@@ -504,7 +504,7 @@
 #define PCI_EXP_SLTCAP_EIP 0x00020000
 #define PCI_EXP_SLTCAP_NCCS 0x00040000
 #define PCI_EXP_SLTCAP_PSN 0xfff80000
-#define PCI_EXP_SLTCTL 24
+#define PCI_EXP_SLTCTL 0x18
 #define PCI_EXP_SLTCTL_ABPE 0x0001
 #define PCI_EXP_SLTCTL_PFDE 0x0002
 #define PCI_EXP_SLTCTL_MRLSCE 0x0004
@@ -526,7 +526,7 @@
 #define PCI_EXP_SLTCTL_EIC 0x0800
 #define PCI_EXP_SLTCTL_DLLSCE 0x1000
 #define PCI_EXP_SLTCTL_IBPD_DISABLE 0x4000
-#define PCI_EXP_SLTSTA 26
+#define PCI_EXP_SLTSTA 0x1a
 #define PCI_EXP_SLTSTA_ABP 0x0001
 #define PCI_EXP_SLTSTA_PFD 0x0002
 #define PCI_EXP_SLTSTA_MRLSC 0x0004
@@ -536,18 +536,18 @@
 #define PCI_EXP_SLTSTA_PDS 0x0040
 #define PCI_EXP_SLTSTA_EIS 0x0080
 #define PCI_EXP_SLTSTA_DLLSC 0x0100
-#define PCI_EXP_RTCTL 28
+#define PCI_EXP_RTCTL 0x1c
 #define PCI_EXP_RTCTL_SECEE 0x0001
 #define PCI_EXP_RTCTL_SENFEE 0x0002
 #define PCI_EXP_RTCTL_SEFEE 0x0004
 #define PCI_EXP_RTCTL_PMEIE 0x0008
 #define PCI_EXP_RTCTL_CRSSVE 0x0010
-#define PCI_EXP_RTCAP 30
+#define PCI_EXP_RTCAP 0x1e
 #define PCI_EXP_RTCAP_CRSVIS 0x0001
-#define PCI_EXP_RTSTA 32
+#define PCI_EXP_RTSTA 0x20
 #define PCI_EXP_RTSTA_PME 0x00010000
 #define PCI_EXP_RTSTA_PENDING 0x00020000
-#define PCI_EXP_DEVCAP2 36
+#define PCI_EXP_DEVCAP2 0x24
 #define PCI_EXP_DEVCAP2_COMP_TMOUT_DIS 0x00000010
 #define PCI_EXP_DEVCAP2_ARI 0x00000020
 #define PCI_EXP_DEVCAP2_ATOMIC_ROUTE 0x00000040
@@ -559,7 +559,7 @@
 #define PCI_EXP_DEVCAP2_OBFF_MSG 0x00040000
 #define PCI_EXP_DEVCAP2_OBFF_WAKE 0x00080000
 #define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000
-#define PCI_EXP_DEVCTL2 40
+#define PCI_EXP_DEVCTL2 0x28
 #define PCI_EXP_DEVCTL2_COMP_TIMEOUT 0x000f
 #define PCI_EXP_DEVCTL2_COMP_TMOUT_DIS 0x0010
 #define PCI_EXP_DEVCTL2_ARI 0x0020
@@ -571,9 +571,9 @@
 #define PCI_EXP_DEVCTL2_OBFF_MSGA_EN 0x2000
 #define PCI_EXP_DEVCTL2_OBFF_MSGB_EN 0x4000
 #define PCI_EXP_DEVCTL2_OBFF_WAKE_EN 0x6000
-#define PCI_EXP_DEVSTA2 42
-#define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V2 44
-#define PCI_EXP_LNKCAP2 44
+#define PCI_EXP_DEVSTA2 0x2a
+#define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V2 0x2c
+#define PCI_EXP_LNKCAP2 0x2c
 #define PCI_EXP_LNKCAP2_SLS_2_5GB 0x00000002
 #define PCI_EXP_LNKCAP2_SLS_5_0GB 0x00000004
 #define PCI_EXP_LNKCAP2_SLS_8_0GB 0x00000008
@@ -581,7 +581,7 @@
 #define PCI_EXP_LNKCAP2_SLS_32_0GB 0x00000020
 #define PCI_EXP_LNKCAP2_SLS_64_0GB 0x00000040
 #define PCI_EXP_LNKCAP2_CROSSLINK 0x00000100
-#define PCI_EXP_LNKCTL2 48
+#define PCI_EXP_LNKCTL2 0x30
 #define PCI_EXP_LNKCTL2_TLS 0x000f
 #define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001
 #define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002
@@ -592,12 +592,12 @@
 #define PCI_EXP_LNKCTL2_ENTER_COMP 0x0010
 #define PCI_EXP_LNKCTL2_TX_MARGIN 0x0380
 #define PCI_EXP_LNKCTL2_HASD 0x0020
-#define PCI_EXP_LNKSTA2 50
-#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52
-#define PCI_EXP_SLTCAP2 52
+#define PCI_EXP_LNKSTA2 0x32
+#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 0x32
+#define PCI_EXP_SLTCAP2 0x34
 #define PCI_EXP_SLTCAP2_IBPD 0x00000001
-#define PCI_EXP_SLTCTL2 56
-#define PCI_EXP_SLTSTA2 58
+#define PCI_EXP_SLTCTL2 0x38
+#define PCI_EXP_SLTSTA2 0x3a
 #define PCI_EXT_CAP_ID(header) (header & 0x0000ffff)
 #define PCI_EXT_CAP_VER(header) ((header >> 16) & 0xf)
 #define PCI_EXT_CAP_NEXT(header) ((header >> 20) & 0xffc)
@@ -637,7 +637,7 @@
 #define PCI_EXT_CAP_ID_MAX PCI_EXT_CAP_ID_PL_16GT
 #define PCI_EXT_CAP_DSN_SIZEOF 12
 #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
-#define PCI_ERR_UNCOR_STATUS 4
+#define PCI_ERR_UNCOR_STATUS 0x04
 #define PCI_ERR_UNC_UND 0x00000001
 #define PCI_ERR_UNC_DLP 0x00000010
 #define PCI_ERR_UNC_SURPDN 0x00000020
@@ -655,9 +655,9 @@
 #define PCI_ERR_UNC_MCBTLP 0x00800000
 #define PCI_ERR_UNC_ATOMEG 0x01000000
 #define PCI_ERR_UNC_TLPPRE 0x02000000
-#define PCI_ERR_UNCOR_MASK 8
-#define PCI_ERR_UNCOR_SEVER 12
-#define PCI_ERR_COR_STATUS 16
+#define PCI_ERR_UNCOR_MASK 0x08
+#define PCI_ERR_UNCOR_SEVER 0x0c
+#define PCI_ERR_COR_STATUS 0x10
 #define PCI_ERR_COR_RCVR 0x00000001
 #define PCI_ERR_COR_BAD_TLP 0x00000040
 #define PCI_ERR_COR_BAD_DLLP 0x00000080
@@ -666,19 +666,19 @@
 #define PCI_ERR_COR_ADV_NFAT 0x00002000
 #define PCI_ERR_COR_INTERNAL 0x00004000
 #define PCI_ERR_COR_LOG_OVER 0x00008000
-#define PCI_ERR_COR_MASK 20
-#define PCI_ERR_CAP 24
-#define PCI_ERR_CAP_FEP(x) ((x) & 31)
+#define PCI_ERR_COR_MASK 0x14
+#define PCI_ERR_CAP 0x18
+#define PCI_ERR_CAP_FEP(x) ((x) & 0x1f)
 #define PCI_ERR_CAP_ECRC_GENC 0x00000020
 #define PCI_ERR_CAP_ECRC_GENE 0x00000040
 #define PCI_ERR_CAP_ECRC_CHKC 0x00000080
 #define PCI_ERR_CAP_ECRC_CHKE 0x00000100
-#define PCI_ERR_HEADER_LOG 28
-#define PCI_ERR_ROOT_COMMAND 44
+#define PCI_ERR_HEADER_LOG 0x1c
+#define PCI_ERR_ROOT_COMMAND 0x2c
 #define PCI_ERR_ROOT_CMD_COR_EN 0x00000001
 #define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002
 #define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004
-#define PCI_ERR_ROOT_STATUS 48
+#define PCI_ERR_ROOT_STATUS 0x30
 #define PCI_ERR_ROOT_COR_RCV 0x00000001
 #define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002
 #define PCI_ERR_ROOT_UNCOR_RCV 0x00000004
@@ -687,48 +687,48 @@
 #define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020
 #define PCI_ERR_ROOT_FATAL_RCV 0x00000040
 #define PCI_ERR_ROOT_AER_IRQ 0xf8000000
-#define PCI_ERR_ROOT_ERR_SRC 52
-#define PCI_VC_PORT_CAP1 4
+#define PCI_ERR_ROOT_ERR_SRC 0x34
+#define PCI_VC_PORT_CAP1 0x04
 #define PCI_VC_CAP1_EVCC 0x00000007
 #define PCI_VC_CAP1_LPEVCC 0x00000070
 #define PCI_VC_CAP1_ARB_SIZE 0x00000c00
-#define PCI_VC_PORT_CAP2 8
+#define PCI_VC_PORT_CAP2 0x08
 #define PCI_VC_CAP2_32_PHASE 0x00000002
 #define PCI_VC_CAP2_64_PHASE 0x00000004
 #define PCI_VC_CAP2_128_PHASE 0x00000008
 #define PCI_VC_CAP2_ARB_OFF 0xff000000
-#define PCI_VC_PORT_CTRL 12
+#define PCI_VC_PORT_CTRL 0x0c
 #define PCI_VC_PORT_CTRL_LOAD_TABLE 0x00000001
-#define PCI_VC_PORT_STATUS 14
+#define PCI_VC_PORT_STATUS 0x0e
 #define PCI_VC_PORT_STATUS_TABLE 0x00000001
-#define PCI_VC_RES_CAP 16
+#define PCI_VC_RES_CAP 0x10
 #define PCI_VC_RES_CAP_32_PHASE 0x00000002
 #define PCI_VC_RES_CAP_64_PHASE 0x00000004
 #define PCI_VC_RES_CAP_128_PHASE 0x00000008
 #define PCI_VC_RES_CAP_128_PHASE_TB 0x00000010
 #define PCI_VC_RES_CAP_256_PHASE 0x00000020
 #define PCI_VC_RES_CAP_ARB_OFF 0xff000000
-#define PCI_VC_RES_CTRL 20
+#define PCI_VC_RES_CTRL 0x14
 #define PCI_VC_RES_CTRL_LOAD_TABLE 0x00010000
 #define PCI_VC_RES_CTRL_ARB_SELECT 0x000e0000
 #define PCI_VC_RES_CTRL_ID 0x07000000
 #define PCI_VC_RES_CTRL_ENABLE 0x80000000
-#define PCI_VC_RES_STATUS 26
+#define PCI_VC_RES_STATUS 0x1a
 #define PCI_VC_RES_STATUS_TABLE 0x00000001
 #define PCI_VC_RES_STATUS_NEGO 0x00000002
 #define PCI_CAP_VC_BASE_SIZEOF 0x10
-#define PCI_CAP_VC_PER_VC_SIZEOF 0x0C
-#define PCI_PWR_DSR 4
-#define PCI_PWR_DATA 8
+#define PCI_CAP_VC_PER_VC_SIZEOF 0x0c
+#define PCI_PWR_DSR 0x04
+#define PCI_PWR_DATA 0x08
 #define PCI_PWR_DATA_BASE(x) ((x) & 0xff)
 #define PCI_PWR_DATA_SCALE(x) (((x) >> 8) & 3)
 #define PCI_PWR_DATA_PM_SUB(x) (((x) >> 10) & 7)
 #define PCI_PWR_DATA_PM_STATE(x) (((x) >> 13) & 3)
 #define PCI_PWR_DATA_TYPE(x) (((x) >> 15) & 7)
 #define PCI_PWR_DATA_RAIL(x) (((x) >> 18) & 7)
-#define PCI_PWR_CAP 12
+#define PCI_PWR_CAP 0x0c
 #define PCI_PWR_CAP_BUDGET(x) ((x) & 1)
-#define PCI_EXT_CAP_PWR_SIZEOF 16
+#define PCI_EXT_CAP_PWR_SIZEOF 0x10
 #define PCI_RCEC_RCIEP_BITMAP 4
 #define PCI_RCEC_BUSN 8
 #define PCI_RCEC_BUSN_REG_VER 0x02
@@ -828,7 +828,7 @@
 #define PCI_SRIOV_VFM_MI 0x1
 #define PCI_SRIOV_VFM_MO 0x2
 #define PCI_SRIOV_VFM_AV 0x3
-#define PCI_EXT_CAP_SRIOV_SIZEOF 64
+#define PCI_EXT_CAP_SRIOV_SIZEOF 0x40
 #define PCI_LTR_MAX_SNOOP_LAT 0x4
 #define PCI_LTR_MAX_NOSNOOP_LAT 0x6
 #define PCI_LTR_VALUE_MASK 0x000003ff
@@ -871,25 +871,25 @@
 #define PCI_TPH_LOC_MSIX 0x400
 #define PCI_TPH_CAP_ST_MASK 0x07FF0000
 #define PCI_TPH_CAP_ST_SHIFT 16
-#define PCI_TPH_BASE_SIZEOF 12
-#define PCI_EXP_DPC_CAP 4
+#define PCI_TPH_BASE_SIZEOF 0xc
+#define PCI_EXP_DPC_CAP 0x04
 #define PCI_EXP_DPC_IRQ 0x001F
 #define PCI_EXP_DPC_CAP_RP_EXT 0x0020
 #define PCI_EXP_DPC_CAP_POISONED_TLP 0x0040
 #define PCI_EXP_DPC_CAP_SW_TRIGGER 0x0080
 #define PCI_EXP_DPC_RP_PIO_LOG_SIZE 0x0F00
 #define PCI_EXP_DPC_CAP_DL_ACTIVE 0x1000
-#define PCI_EXP_DPC_CTL 6
+#define PCI_EXP_DPC_CTL 0x06
 #define PCI_EXP_DPC_CTL_EN_FATAL 0x0001
 #define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002
 #define PCI_EXP_DPC_CTL_INT_EN 0x0008
-#define PCI_EXP_DPC_STATUS 8
+#define PCI_EXP_DPC_STATUS 0x08
 #define PCI_EXP_DPC_STATUS_TRIGGER 0x0001
 #define PCI_EXP_DPC_STATUS_TRIGGER_RSN 0x0006
 #define PCI_EXP_DPC_STATUS_INTERRUPT 0x0008
 #define PCI_EXP_DPC_RP_BUSY 0x0010
 #define PCI_EXP_DPC_STATUS_TRIGGER_RSN_EXT 0x0060
-#define PCI_EXP_DPC_SOURCE_ID 10
+#define PCI_EXP_DPC_SOURCE_ID 0x0A
 #define PCI_EXP_DPC_RP_PIO_STATUS 0x0C
 #define PCI_EXP_DPC_RP_PIO_MASK 0x10
 #define PCI_EXP_DPC_RP_PIO_SEVERITY 0x14
@@ -926,7 +926,11 @@
 #define PCI_L1SS_CTL1_LTR_L12_TH_SCALE 0xe0000000
 #define PCI_L1SS_CTL2 0x0c
 #define PCI_DVSEC_HEADER1 0x4
+#define PCI_DVSEC_HEADER1_VID(x) ((x) & 0xffff)
+#define PCI_DVSEC_HEADER1_REV(x) (((x) >> 16) & 0xf)
+#define PCI_DVSEC_HEADER1_LEN(x) (((x) >> 20) & 0xfff)
 #define PCI_DVSEC_HEADER2 0x8
+#define PCI_DVSEC_HEADER2_ID(x) ((x) & 0xffff)
 #define PCI_DLF_CAP 0x04
 #define PCI_DLF_EXCHANGE_ENABLE 0x80000000
 #define PCI_PL_16GT_LE_CTRL 0x20
diff --git a/libc/kernel/uapi/linux/perf_event.h b/libc/kernel/uapi/linux/perf_event.h
index dee8cd709..b02258615 100644
--- a/libc/kernel/uapi/linux/perf_event.h
+++ b/libc/kernel/uapi/linux/perf_event.h
@@ -462,6 +462,9 @@ union perf_mem_data_src {
 #define PERF_MEM_BLK_ADDR 0x04
 #define PERF_MEM_BLK_SHIFT 40
 #define PERF_MEM_HOPS_0 0x01
+#define PERF_MEM_HOPS_1 0x02
+#define PERF_MEM_HOPS_2 0x03
+#define PERF_MEM_HOPS_3 0x04
 #define PERF_MEM_HOPS_SHIFT 43
 #define PERF_MEM_S(a,s) (((__u64) PERF_MEM_ ##a ##_ ##s) << PERF_MEM_ ##a ##_SHIFT)
 struct perf_branch_entry {
diff --git a/libc/kernel/uapi/linux/pfkeyv2.h b/libc/kernel/uapi/linux/pfkeyv2.h
index 8f65681fa..d1e548645 100644
--- a/libc/kernel/uapi/linux/pfkeyv2.h
+++ b/libc/kernel/uapi/linux/pfkeyv2.h
@@ -243,6 +243,7 @@ struct sadb_x_filter {
 #define SADB_X_AALG_SHA2_512HMAC 7
 #define SADB_X_AALG_RIPEMD160HMAC 8
 #define SADB_X_AALG_AES_XCBC_MAC 9
+#define SADB_X_AALG_SM3_256HMAC 10
 #define SADB_X_AALG_NULL 251
 #define SADB_AALG_MAX 251
 #define SADB_EALG_NONE 0
@@ -261,6 +262,7 @@ struct sadb_x_filter {
 #define SADB_X_EALG_AES_GCM_ICV16 20
 #define SADB_X_EALG_CAMELLIACBC 22
 #define SADB_X_EALG_NULL_AES_GMAC 23
+#define SADB_X_EALG_SM4CBC 24
 #define SADB_EALG_MAX 253
 #define SADB_X_EALG_SERPENTCBC 252
 #define SADB_X_EALG_TWOFISHCBC 253
diff --git a/libc/kernel/uapi/linux/pfrut.h b/libc/kernel/uapi/linux/pfrut.h
new file mode 100644
index 000000000..14f713fbb
--- /dev/null
+++ b/libc/kernel/uapi/linux/pfrut.h
@@ -0,0 +1,95 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef __PFRUT_H__
+#define __PFRUT_H__
+#include <linux/ioctl.h>
+#include <linux/types.h>
+#define PFRUT_IOCTL_MAGIC 0xEE
+#define PFRU_IOC_SET_REV _IOW(PFRUT_IOCTL_MAGIC, 0x01, unsigned int)
+#define PFRU_IOC_STAGE _IOW(PFRUT_IOCTL_MAGIC, 0x02, unsigned int)
+#define PFRU_IOC_ACTIVATE _IOW(PFRUT_IOCTL_MAGIC, 0x03, unsigned int)
+#define PFRU_IOC_STAGE_ACTIVATE _IOW(PFRUT_IOCTL_MAGIC, 0x04, unsigned int)
+#define PFRU_IOC_QUERY_CAP _IOR(PFRUT_IOCTL_MAGIC, 0x05, struct pfru_update_cap_info)
+struct pfru_payload_hdr {
+  __u32 sig;
+  __u32 hdr_version;
+  __u32 hdr_size;
+  __u32 hw_ver;
+  __u32 rt_ver;
+  __u8 platform_id[16];
+};
+enum pfru_dsm_status {
+  DSM_SUCCEED = 0,
+  DSM_FUNC_NOT_SUPPORT = 1,
+  DSM_INVAL_INPUT = 2,
+  DSM_HARDWARE_ERR = 3,
+  DSM_RETRY_SUGGESTED = 4,
+  DSM_UNKNOWN = 5,
+  DSM_FUNC_SPEC_ERR = 6,
+};
+struct pfru_update_cap_info {
+  __u32 status;
+  __u32 update_cap;
+  __u8 code_type[16];
+  __u32 fw_version;
+  __u32 code_rt_version;
+  __u8 drv_type[16];
+  __u32 drv_rt_version;
+  __u32 drv_svn;
+  __u8 platform_id[16];
+  __u8 oem_id[16];
+  __u32 oem_info_len;
+};
+struct pfru_com_buf_info {
+  __u32 status;
+  __u32 ext_status;
+  __u64 addr_lo;
+  __u64 addr_hi;
+  __u32 buf_size;
+};
+struct pfru_updated_result {
+  __u32 status;
+  __u32 ext_status;
+  __u64 low_auth_time;
+  __u64 high_auth_time;
+  __u64 low_exec_time;
+  __u64 high_exec_time;
+};
+struct pfrt_log_data_info {
+  __u32 status;
+  __u32 ext_status;
+  __u64 chunk1_addr_lo;
+  __u64 chunk1_addr_hi;
+  __u64 chunk2_addr_lo;
+  __u64 chunk2_addr_hi;
+  __u32 max_data_size;
+  __u32 chunk1_size;
+  __u32 chunk2_size;
+  __u32 rollover_cnt;
+  __u32 reset_cnt;
+};
+struct pfrt_log_info {
+  __u32 log_level;
+  __u32 log_type;
+  __u32 log_revid;
+};
+#define PFRT_LOG_IOC_SET_INFO _IOW(PFRUT_IOCTL_MAGIC, 0x06, struct pfrt_log_info)
+#define PFRT_LOG_IOC_GET_INFO _IOR(PFRUT_IOCTL_MAGIC, 0x07, struct pfrt_log_info)
+#define PFRT_LOG_IOC_GET_DATA_INFO _IOR(PFRUT_IOCTL_MAGIC, 0x08, struct pfrt_log_data_info)
+#endif
diff --git a/libc/kernel/uapi/linux/pkt_cls.h b/libc/kernel/uapi/linux/pkt_cls.h
index 4907a78c8..9fd89e0b8 100644
--- a/libc/kernel/uapi/linux/pkt_cls.h
+++ b/libc/kernel/uapi/linux/pkt_cls.h
@@ -32,9 +32,12 @@ enum {
   TCA_ACT_FLAGS,
   TCA_ACT_HW_STATS,
   TCA_ACT_USED_HW_STATS,
+  TCA_ACT_IN_HW_COUNT,
   __TCA_ACT_MAX
 };
-#define TCA_ACT_FLAGS_NO_PERCPU_STATS 1
+#define TCA_ACT_FLAGS_NO_PERCPU_STATS (1 << 0)
+#define TCA_ACT_FLAGS_SKIP_HW (1 << 1)
+#define TCA_ACT_FLAGS_SKIP_SW (1 << 2)
 #define TCA_ACT_HW_STATS_IMMEDIATE (1 << 0)
 #define TCA_ACT_HW_STATS_DELAYED (1 << 1)
 #define TCA_ACT_MAX __TCA_ACT_MAX
diff --git a/libc/kernel/uapi/linux/rtnetlink.h b/libc/kernel/uapi/linux/rtnetlink.h
index b3d082ac0..91c3ee4b8 100644
--- a/libc/kernel/uapi/linux/rtnetlink.h
+++ b/libc/kernel/uapi/linux/rtnetlink.h
@@ -559,6 +559,8 @@ enum rtnetlink_groups {
 #define RTNLGRP_NEXTHOP RTNLGRP_NEXTHOP
   RTNLGRP_BRVLAN,
 #define RTNLGRP_BRVLAN RTNLGRP_BRVLAN
+  RTNLGRP_MCTP_IFADDR,
+#define RTNLGRP_MCTP_IFADDR RTNLGRP_MCTP_IFADDR
   __RTNLGRP_MAX
 };
 #define RTNLGRP_MAX (__RTNLGRP_MAX - 1)
diff --git a/libc/kernel/uapi/linux/smc.h b/libc/kernel/uapi/linux/smc.h
index 5c0720788..01494da37 100644
--- a/libc/kernel/uapi/linux/smc.h
+++ b/libc/kernel/uapi/linux/smc.h
@@ -107,6 +107,8 @@ enum {
   SMC_NLA_LGR_R_CONNS_NUM,
   SMC_NLA_LGR_R_V2_COMMON,
   SMC_NLA_LGR_R_V2,
+  SMC_NLA_LGR_R_NET_COOKIE,
+  SMC_NLA_LGR_R_PAD,
   __SMC_NLA_LGR_R_MAX,
   SMC_NLA_LGR_R_MAX = __SMC_NLA_LGR_R_MAX - 1
 };
diff --git a/libc/kernel/uapi/linux/taskstats.h b/libc/kernel/uapi/linux/taskstats.h
index 5f9d0cc48..efa5b4aa2 100644
--- a/libc/kernel/uapi/linux/taskstats.h
+++ b/libc/kernel/uapi/linux/taskstats.h
@@ -19,7 +19,7 @@
 #ifndef _LINUX_TASKSTATS_H
 #define _LINUX_TASKSTATS_H
 #include <linux/types.h>
-#define TASKSTATS_VERSION 10
+#define TASKSTATS_VERSION 11
 #define TS_COMM_LEN 32
 struct taskstats {
   __u16 version;
@@ -69,6 +69,8 @@ struct taskstats {
   __u64 thrashing_count;
   __u64 thrashing_delay_total;
   __u64 ac_btime64;
+  __u64 compact_count;
+  __u64 compact_delay_total;
 };
 enum {
   TASKSTATS_CMD_UNSPEC = 0,
diff --git a/libc/kernel/uapi/linux/tty.h b/libc/kernel/uapi/linux/tty.h
index 48fa90875..dcce572ce 100644
--- a/libc/kernel/uapi/linux/tty.h
+++ b/libc/kernel/uapi/linux/tty.h
@@ -47,4 +47,5 @@
 #define N_NCI 25
 #define N_SPEAKUP 26
 #define N_NULL 27
+#define N_MCTP 28
 #endif
diff --git a/libc/kernel/uapi/linux/v4l2-controls.h b/libc/kernel/uapi/linux/v4l2-controls.h
index 5233c856d..1a11355b0 100644
--- a/libc/kernel/uapi/linux/v4l2-controls.h
+++ b/libc/kernel/uapi/linux/v4l2-controls.h
@@ -90,6 +90,7 @@ enum v4l2_colorfx {
   V4L2_COLORFX_SOLARIZATION = 13,
   V4L2_COLORFX_ANTIQUE = 14,
   V4L2_COLORFX_SET_CBCR = 15,
+  V4L2_COLORFX_SET_RGB = 16,
 };
 #define V4L2_CID_AUTOBRIGHTNESS (V4L2_CID_BASE + 32)
 #define V4L2_CID_BAND_STOP_FILTER (V4L2_CID_BASE + 33)
@@ -102,7 +103,8 @@ enum v4l2_colorfx {
 #define V4L2_CID_MIN_BUFFERS_FOR_OUTPUT (V4L2_CID_BASE + 40)
 #define V4L2_CID_ALPHA_COMPONENT (V4L2_CID_BASE + 41)
 #define V4L2_CID_COLORFX_CBCR (V4L2_CID_BASE + 42)
-#define V4L2_CID_LASTP1 (V4L2_CID_BASE + 43)
+#define V4L2_CID_COLORFX_RGB (V4L2_CID_BASE + 43)
+#define V4L2_CID_LASTP1 (V4L2_CID_BASE + 44)
 #define V4L2_CID_USER_MEYE_BASE (V4L2_CID_USER_BASE + 0x1000)
 #define V4L2_CID_USER_BTTV_BASE (V4L2_CID_USER_BASE + 0x1010)
 #define V4L2_CID_USER_S2255_BASE (V4L2_CID_USER_BASE + 0x1030)
@@ -1349,6 +1351,130 @@ struct v4l2_ctrl_hdr10_mastering_display {
   __u32 max_display_mastering_luminance;
   __u32 min_display_mastering_luminance;
 };
+#define V4L2_VP9_LOOP_FILTER_FLAG_DELTA_ENABLED 0x1
+#define V4L2_VP9_LOOP_FILTER_FLAG_DELTA_UPDATE 0x2
+struct v4l2_vp9_loop_filter {
+  __s8 ref_deltas[4];
+  __s8 mode_deltas[2];
+  __u8 level;
+  __u8 sharpness;
+  __u8 flags;
+  __u8 reserved[7];
+};
+struct v4l2_vp9_quantization {
+  __u8 base_q_idx;
+  __s8 delta_q_y_dc;
+  __s8 delta_q_uv_dc;
+  __s8 delta_q_uv_ac;
+  __u8 reserved[4];
+};
+#define V4L2_VP9_SEGMENTATION_FLAG_ENABLED 0x01
+#define V4L2_VP9_SEGMENTATION_FLAG_UPDATE_MAP 0x02
+#define V4L2_VP9_SEGMENTATION_FLAG_TEMPORAL_UPDATE 0x04
+#define V4L2_VP9_SEGMENTATION_FLAG_UPDATE_DATA 0x08
+#define V4L2_VP9_SEGMENTATION_FLAG_ABS_OR_DELTA_UPDATE 0x10
+#define V4L2_VP9_SEG_LVL_ALT_Q 0
+#define V4L2_VP9_SEG_LVL_ALT_L 1
+#define V4L2_VP9_SEG_LVL_REF_FRAME 2
+#define V4L2_VP9_SEG_LVL_SKIP 3
+#define V4L2_VP9_SEG_LVL_MAX 4
+#define V4L2_VP9_SEGMENT_FEATURE_ENABLED(id) (1 << (id))
+#define V4L2_VP9_SEGMENT_FEATURE_ENABLED_MASK 0xf
+struct v4l2_vp9_segmentation {
+  __s16 feature_data[8][4];
+  __u8 feature_enabled[8];
+  __u8 tree_probs[7];
+  __u8 pred_probs[3];
+  __u8 flags;
+  __u8 reserved[5];
+};
+#define V4L2_VP9_FRAME_FLAG_KEY_FRAME 0x001
+#define V4L2_VP9_FRAME_FLAG_SHOW_FRAME 0x002
+#define V4L2_VP9_FRAME_FLAG_ERROR_RESILIENT 0x004
+#define V4L2_VP9_FRAME_FLAG_INTRA_ONLY 0x008
+#define V4L2_VP9_FRAME_FLAG_ALLOW_HIGH_PREC_MV 0x010
+#define V4L2_VP9_FRAME_FLAG_REFRESH_FRAME_CTX 0x020
+#define V4L2_VP9_FRAME_FLAG_PARALLEL_DEC_MODE 0x040
+#define V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING 0x080
+#define V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING 0x100
+#define V4L2_VP9_FRAME_FLAG_COLOR_RANGE_FULL_SWING 0x200
+#define V4L2_VP9_SIGN_BIAS_LAST 0x1
+#define V4L2_VP9_SIGN_BIAS_GOLDEN 0x2
+#define V4L2_VP9_SIGN_BIAS_ALT 0x4
+#define V4L2_VP9_RESET_FRAME_CTX_NONE 0
+#define V4L2_VP9_RESET_FRAME_CTX_SPEC 1
+#define V4L2_VP9_RESET_FRAME_CTX_ALL 2
+#define V4L2_VP9_INTERP_FILTER_EIGHTTAP 0
+#define V4L2_VP9_INTERP_FILTER_EIGHTTAP_SMOOTH 1
+#define V4L2_VP9_INTERP_FILTER_EIGHTTAP_SHARP 2
+#define V4L2_VP9_INTERP_FILTER_BILINEAR 3
+#define V4L2_VP9_INTERP_FILTER_SWITCHABLE 4
+#define V4L2_VP9_REFERENCE_MODE_SINGLE_REFERENCE 0
+#define V4L2_VP9_REFERENCE_MODE_COMPOUND_REFERENCE 1
+#define V4L2_VP9_REFERENCE_MODE_SELECT 2
+#define V4L2_VP9_PROFILE_MAX 3
+#define V4L2_CID_STATELESS_VP9_FRAME (V4L2_CID_CODEC_STATELESS_BASE + 300)
+struct v4l2_ctrl_vp9_frame {
+  struct v4l2_vp9_loop_filter lf;
+  struct v4l2_vp9_quantization quant;
+  struct v4l2_vp9_segmentation seg;
+  __u32 flags;
+  __u16 compressed_header_size;
+  __u16 uncompressed_header_size;
+  __u16 frame_width_minus_1;
+  __u16 frame_height_minus_1;
+  __u16 render_width_minus_1;
+  __u16 render_height_minus_1;
+  __u64 last_frame_ts;
+  __u64 golden_frame_ts;
+  __u64 alt_frame_ts;
+  __u8 ref_frame_sign_bias;
+  __u8 reset_frame_context;
+  __u8 frame_context_idx;
+  __u8 profile;
+  __u8 bit_depth;
+  __u8 interpolation_filter;
+  __u8 tile_cols_log2;
+  __u8 tile_rows_log2;
+  __u8 reference_mode;
+  __u8 reserved[7];
+};
+#define V4L2_VP9_NUM_FRAME_CTX 4
+struct v4l2_vp9_mv_probs {
+  __u8 joint[3];
+  __u8 sign[2];
+  __u8 classes[2][10];
+  __u8 class0_bit[2];
+  __u8 bits[2][10];
+  __u8 class0_fr[2][2][3];
+  __u8 fr[2][3];
+  __u8 class0_hp[2];
+  __u8 hp[2];
+};
+#define V4L2_CID_STATELESS_VP9_COMPRESSED_HDR (V4L2_CID_CODEC_STATELESS_BASE + 301)
+#define V4L2_VP9_TX_MODE_ONLY_4X4 0
+#define V4L2_VP9_TX_MODE_ALLOW_8X8 1
+#define V4L2_VP9_TX_MODE_ALLOW_16X16 2
+#define V4L2_VP9_TX_MODE_ALLOW_32X32 3
+#define V4L2_VP9_TX_MODE_SELECT 4
+struct v4l2_ctrl_vp9_compressed_hdr {
+  __u8 tx_mode;
+  __u8 tx8[2][1];
+  __u8 tx16[2][2];
+  __u8 tx32[2][3];
+  __u8 coef[4][2][2][6][6][3];
+  __u8 skip[3];
+  __u8 inter_mode[7][3];
+  __u8 interp_filter[4][2];
+  __u8 is_inter[4];
+  __u8 comp_mode[5];
+  __u8 single_ref[5][2];
+  __u8 comp_ref[5];
+  __u8 y_mode[4][9];
+  __u8 uv_mode[10][9];
+  __u8 partition[16][3];
+  struct v4l2_vp9_mv_probs mv;
+};
 #define V4L2_CTRL_CLASS_MPEG V4L2_CTRL_CLASS_CODEC
 #define V4L2_CID_MPEG_CLASS V4L2_CID_CODEC_CLASS
 #define V4L2_CID_MPEG_BASE V4L2_CID_CODEC_BASE
diff --git a/libc/kernel/uapi/linux/vdpa.h b/libc/kernel/uapi/linux/vdpa.h
index 767ce12ec..b3e5d3969 100644
--- a/libc/kernel/uapi/linux/vdpa.h
+++ b/libc/kernel/uapi/linux/vdpa.h
@@ -31,6 +31,7 @@ enum vdpa_command {
 };
 enum vdpa_attr {
   VDPA_ATTR_UNSPEC,
+  VDPA_ATTR_PAD = VDPA_ATTR_UNSPEC,
   VDPA_ATTR_MGMTDEV_BUS_NAME,
   VDPA_ATTR_MGMTDEV_DEV_NAME,
   VDPA_ATTR_MGMTDEV_SUPPORTED_CLASSES,
@@ -44,6 +45,9 @@ enum vdpa_attr {
   VDPA_ATTR_DEV_NET_STATUS,
   VDPA_ATTR_DEV_NET_CFG_MAX_VQP,
   VDPA_ATTR_DEV_NET_CFG_MTU,
+  VDPA_ATTR_DEV_NEGOTIATED_FEATURES,
+  VDPA_ATTR_DEV_MGMTDEV_MAX_VQS,
+  VDPA_ATTR_DEV_SUPPORTED_FEATURES,
   VDPA_ATTR_MAX,
 };
 #endif
diff --git a/libc/kernel/uapi/linux/version.h b/libc/kernel/uapi/linux/version.h
index bd323a8f4..2dfd69657 100644
--- a/libc/kernel/uapi/linux/version.h
+++ b/libc/kernel/uapi/linux/version.h
@@ -16,8 +16,8 @@
  ***
  ****************************************************************************
  ****************************************************************************/
-#define LINUX_VERSION_CODE 331776
+#define LINUX_VERSION_CODE 332032
 #define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + ((c) > 255 ? 255 : (c)))
 #define LINUX_VERSION_MAJOR 5
-#define LINUX_VERSION_PATCHLEVEL 16
+#define LINUX_VERSION_PATCHLEVEL 17
 #define LINUX_VERSION_SUBLEVEL 0
diff --git a/libc/kernel/uapi/linux/videodev2.h b/libc/kernel/uapi/linux/videodev2.h
index 5ca1d91d6..74bd32891 100644
--- a/libc/kernel/uapi/linux/videodev2.h
+++ b/libc/kernel/uapi/linux/videodev2.h
@@ -24,7 +24,12 @@
 #include <linux/types.h>
 #include <linux/v4l2-common.h>
 #include <linux/v4l2-controls.h>
-#define VIDEO_MAX_FRAME 32
+/* ---------------------------------------------------
+ * This value manually changed due to b/228783882.
+ * Next kernel update should keep this value as is.
+ */
+#define VIDEO_MAX_FRAME 64
+/* --------------------------------------------------- */
 #define VIDEO_MAX_PLANES 8
 #define v4l2_fourcc(a,b,c,d) ((__u32) (a) | ((__u32) (b) << 8) | ((__u32) (c) << 16) | ((__u32) (d) << 24))
 #define v4l2_fourcc_be(a,b,c,d) (v4l2_fourcc(a, b, c, d) | (1U << 31))
@@ -360,6 +365,7 @@ struct v4l2_pix_format {
 #define V4L2_PIX_FMT_VP8 v4l2_fourcc('V', 'P', '8', '0')
 #define V4L2_PIX_FMT_VP8_FRAME v4l2_fourcc('V', 'P', '8', 'F')
 #define V4L2_PIX_FMT_VP9 v4l2_fourcc('V', 'P', '9', '0')
+#define V4L2_PIX_FMT_VP9_FRAME v4l2_fourcc('V', 'P', '9', 'F')
 #define V4L2_PIX_FMT_HEVC v4l2_fourcc('H', 'E', 'V', 'C')
 #define V4L2_PIX_FMT_FWHT v4l2_fourcc('F', 'W', 'H', 'T')
 #define V4L2_PIX_FMT_FWHT_STATELESS v4l2_fourcc('S', 'F', 'W', 'H')
@@ -898,6 +904,8 @@ struct v4l2_ext_control {
     struct v4l2_ctrl_mpeg2_sequence __user * p_mpeg2_sequence;
     struct v4l2_ctrl_mpeg2_picture __user * p_mpeg2_picture;
     struct v4l2_ctrl_mpeg2_quantisation __user * p_mpeg2_quantisation;
+    struct v4l2_ctrl_vp9_compressed_hdr __user * p_vp9_compressed_hdr_probs;
+    struct v4l2_ctrl_vp9_frame __user * p_vp9_frame;
     void __user * ptr;
   };
 } __attribute__((packed));
@@ -948,6 +956,8 @@ enum v4l2_ctrl_type {
   V4L2_CTRL_TYPE_MPEG2_QUANTISATION = 0x0250,
   V4L2_CTRL_TYPE_MPEG2_SEQUENCE = 0x0251,
   V4L2_CTRL_TYPE_MPEG2_PICTURE = 0x0252,
+  V4L2_CTRL_TYPE_VP9_COMPRESSED_HDR = 0x0260,
+  V4L2_CTRL_TYPE_VP9_FRAME = 0x0261,
 };
 struct v4l2_queryctrl {
   __u32 id;
diff --git a/libc/kernel/uapi/linux/virtio_iommu.h b/libc/kernel/uapi/linux/virtio_iommu.h
index b08de574f..ec8def873 100644
--- a/libc/kernel/uapi/linux/virtio_iommu.h
+++ b/libc/kernel/uapi/linux/virtio_iommu.h
@@ -25,6 +25,7 @@
 #define VIRTIO_IOMMU_F_BYPASS 3
 #define VIRTIO_IOMMU_F_PROBE 4
 #define VIRTIO_IOMMU_F_MMIO 5
+#define VIRTIO_IOMMU_F_BYPASS_CONFIG 6
 struct virtio_iommu_range_64 {
   __le64 start;
   __le64 end;
@@ -38,6 +39,8 @@ struct virtio_iommu_config {
   struct virtio_iommu_range_64 input_range;
   struct virtio_iommu_range_32 domain_range;
   __le32 probe_size;
+  __u8 bypass;
+  __u8 reserved[3];
 };
 #define VIRTIO_IOMMU_T_ATTACH 0x01
 #define VIRTIO_IOMMU_T_DETACH 0x02
@@ -61,11 +64,13 @@ struct virtio_iommu_req_tail {
   __u8 status;
   __u8 reserved[3];
 };
+#define VIRTIO_IOMMU_ATTACH_F_BYPASS (1 << 0)
 struct virtio_iommu_req_attach {
   struct virtio_iommu_req_head head;
   __le32 domain;
   __le32 endpoint;
-  __u8 reserved[8];
+  __le32 flags;
+  __u8 reserved[4];
   struct virtio_iommu_req_tail tail;
 };
 struct virtio_iommu_req_detach {
diff --git a/libc/kernel/uapi/linux/xfrm.h b/libc/kernel/uapi/linux/xfrm.h
index e40b7e338..f4df95f77 100644
--- a/libc/kernel/uapi/linux/xfrm.h
+++ b/libc/kernel/uapi/linux/xfrm.h
@@ -265,6 +265,7 @@ enum xfrm_attr_type_t {
   XFRMA_SET_MARK,
   XFRMA_SET_MARK_MASK,
   XFRMA_IF_ID,
+  XFRMA_MTIMER_THRESH,
   __XFRMA_MAX
 #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK
 #define XFRMA_MAX (__XFRMA_MAX - 1)
diff --git a/libc/kernel/uapi/misc/habanalabs.h b/libc/kernel/uapi/misc/habanalabs.h
index ed2ba7c6d..6e3439ab7 100644
--- a/libc/kernel/uapi/misc/habanalabs.h
+++ b/libc/kernel/uapi/misc/habanalabs.h
@@ -264,6 +264,11 @@ enum hl_server_type {
 #define HL_INFO_PLL_FREQUENCY 16
 #define HL_INFO_POWER 17
 #define HL_INFO_OPEN_STATS 18
+#define HL_INFO_DRAM_REPLACED_ROWS 21
+#define HL_INFO_DRAM_PENDING_ROWS 22
+#define HL_INFO_LAST_ERR_OPEN_DEV_TIME 23
+#define HL_INFO_CS_TIMEOUT_EVENT 24
+#define HL_INFO_RAZWI_EVENT 25
 #define HL_INFO_VERSION_MAX_LEN 128
 #define HL_INFO_CARD_NAME_MAX_LEN 16
 struct hl_info_hw_ip_info {
@@ -325,10 +330,18 @@ struct hl_info_pci_counters {
   __u64 tx_throughput;
   __u64 replay_cnt;
 };
-#define HL_CLK_THROTTLE_POWER 0x1
-#define HL_CLK_THROTTLE_THERMAL 0x2
+enum hl_clk_throttling_type {
+  HL_CLK_THROTTLE_TYPE_POWER,
+  HL_CLK_THROTTLE_TYPE_THERMAL,
+  HL_CLK_THROTTLE_TYPE_MAX
+};
+#define HL_CLK_THROTTLE_POWER (1 << HL_CLK_THROTTLE_TYPE_POWER)
+#define HL_CLK_THROTTLE_THERMAL (1 << HL_CLK_THROTTLE_TYPE_THERMAL)
 struct hl_info_clk_throttle {
   __u32 clk_throttling_reason;
+  __u32 pad;
+  __u64 clk_throttling_timestamp_us[HL_CLK_THROTTLE_TYPE_MAX];
+  __u64 clk_throttling_duration_ns[HL_CLK_THROTTLE_TYPE_MAX];
 };
 struct hl_info_energy {
   __u64 total_energy_consumption;
@@ -364,6 +377,24 @@ struct hl_info_cs_counters {
   __u64 total_validation_drop_cnt;
   __u64 ctx_validation_drop_cnt;
 };
+struct hl_info_last_err_open_dev_time {
+  __s64 timestamp;
+};
+struct hl_info_cs_timeout_event {
+  __s64 timestamp;
+  __u64 seq;
+};
+#define HL_RAZWI_PAGE_FAULT 0
+#define HL_RAZWI_MMU_ACCESS_ERROR 1
+struct hl_info_razwi_event {
+  __s64 timestamp;
+  __u64 addr;
+  __u16 engine_id_1;
+  __u16 engine_id_2;
+  __u8 no_engine_id;
+  __u8 error_type;
+  __u8 pad[2];
+};
 enum gaudi_dcores {
   HL_GAUDI_WS_DCORE,
   HL_GAUDI_WN_DCORE,
@@ -387,6 +418,7 @@ struct hl_info_args {
 #define HL_CB_OP_INFO 2
 #define HL_MAX_CB_SIZE (0x200000 - 32)
 #define HL_CB_FLAGS_MAP 0x1
+#define HL_CB_FLAGS_GET_DEVICE_VA 0x2
 struct hl_cb_in {
   __u64 cb_handle;
   __u32 op;
@@ -397,9 +429,12 @@ struct hl_cb_in {
 struct hl_cb_out {
   union {
     __u64 cb_handle;
-    struct {
-      __u32 usage_cnt;
-      __u32 pad;
+    union {
+      struct {
+        __u32 usage_cnt;
+        __u32 pad;
+      };
+      __u64 device_va;
     };
   };
 };
@@ -466,6 +501,8 @@ struct hl_cs_out {
   };
   __u32 status;
   __u32 sob_base_addr_offset;
+  __u16 sob_count_before_submission;
+  __u16 pad[3];
 };
 union hl_cs_args {
   struct hl_cs_in in;
@@ -474,6 +511,7 @@ union hl_cs_args {
 #define HL_WAIT_CS_FLAGS_INTERRUPT 0x2
 #define HL_WAIT_CS_FLAGS_INTERRUPT_MASK 0xFFF00000
 #define HL_WAIT_CS_FLAGS_MULTI_CS 0x4
+#define HL_WAIT_CS_FLAGS_INTERRUPT_KERNEL_CQ 0x10
 #define HL_WAIT_MULTI_CS_LIST_MAX_LEN 32
 struct hl_wait_cs_in {
   union {
@@ -482,15 +520,23 @@ struct hl_wait_cs_in {
       __u64 timeout_us;
     };
     struct {
-      __u64 addr;
+      union {
+        __u64 addr;
+        __u64 cq_counters_handle;
+      };
       __u64 target;
     };
   };
   __u32 ctx_id;
   __u32 flags;
-  __u8 seq_arr_len;
-  __u8 pad[3];
-  __u32 interrupt_timeout_us;
+  union {
+    struct {
+      __u8 seq_arr_len;
+      __u8 pad[7];
+    };
+    __u64 interrupt_timeout_us;
+  };
+  __u64 cq_counters_offset;
 };
 #define HL_WAIT_CS_STATUS_COMPLETED 0
 #define HL_WAIT_CS_STATUS_BUSY 1
diff --git a/libc/kernel/uapi/rdma/hns-abi.h b/libc/kernel/uapi/rdma/hns-abi.h
index 40ec2ec81..9c8d028bd 100644
--- a/libc/kernel/uapi/rdma/hns-abi.h
+++ b/libc/kernel/uapi/rdma/hns-abi.h
@@ -54,9 +54,11 @@ enum hns_roce_qp_cap_flags {
   HNS_ROCE_QP_CAP_RQ_RECORD_DB = 1 << 0,
   HNS_ROCE_QP_CAP_SQ_RECORD_DB = 1 << 1,
   HNS_ROCE_QP_CAP_OWNER_DB = 1 << 2,
+  HNS_ROCE_QP_CAP_DIRECT_WQE = 1 << 5,
 };
 struct hns_roce_ib_create_qp_resp {
   __aligned_u64 cap_flags;
+  __aligned_u64 dwqe_mmap_key;
 };
 struct hns_roce_ib_alloc_ucontext_resp {
   __u32 qp_tab_size;
diff --git a/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h b/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h
index dad5c171c..862abcb43 100644
--- a/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h
+++ b/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h
@@ -198,7 +198,7 @@ enum mlx5_ib_flow_matcher_methods {
 enum mlx5_ib_device_query_context_attrs {
   MLX5_IB_ATTR_QUERY_CONTEXT_RESP_UCTX = (1U << UVERBS_ID_NS_SHIFT),
 };
-#define MLX5_IB_DW_MATCH_PARAM 0x90
+#define MLX5_IB_DW_MATCH_PARAM 0xA0
 struct mlx5_ib_match_params {
   __u32 match_params[MLX5_IB_DW_MATCH_PARAM];
 };
diff --git a/libc/kernel/uapi/sound/asound.h b/libc/kernel/uapi/sound/asound.h
index 441f1d431..b0e47c163 100644
--- a/libc/kernel/uapi/sound/asound.h
+++ b/libc/kernel/uapi/sound/asound.h
@@ -32,8 +32,9 @@
 #define SNDRV_PROTOCOL_MINOR(version) (((version) >> 8) & 0xff)
 #define SNDRV_PROTOCOL_MICRO(version) ((version) & 0xff)
 #define SNDRV_PROTOCOL_INCOMPATIBLE(kversion,uversion) (SNDRV_PROTOCOL_MAJOR(kversion) != SNDRV_PROTOCOL_MAJOR(uversion) || (SNDRV_PROTOCOL_MAJOR(kversion) == SNDRV_PROTOCOL_MAJOR(uversion) && SNDRV_PROTOCOL_MINOR(kversion) != SNDRV_PROTOCOL_MINOR(uversion)))
+#define AES_IEC958_STATUS_SIZE 24
 struct snd_aes_iec958 {
-  unsigned char status[24];
+  unsigned char status[AES_IEC958_STATUS_SIZE];
   unsigned char subcode[147];
   unsigned char pad;
   unsigned char dig_subframe[4];
@@ -235,6 +236,7 @@ typedef int __bitwise snd_pcm_subformat_t;
 #define SNDRV_PCM_INFO_HAS_LINK_ESTIMATED_ATIME 0x04000000
 #define SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME 0x08000000
 #define SNDRV_PCM_INFO_EXPLICIT_SYNC 0x10000000
+#define SNDRV_PCM_INFO_NO_REWINDS 0x20000000
 #define SNDRV_PCM_INFO_DRAIN_TRIGGER 0x40000000
 #define SNDRV_PCM_INFO_FIFO_IN_FRAMES 0x80000000
 #if __BITS_PER_LONG == 32 && defined(__USE_TIME_BITS64)
diff --git a/libc/kernel/uapi/sound/sof/tokens.h b/libc/kernel/uapi/sound/sof/tokens.h
index 4499cd30a..856281af8 100644
--- a/libc/kernel/uapi/sound/sof/tokens.h
+++ b/libc/kernel/uapi/sound/sof/tokens.h
@@ -87,4 +87,7 @@
 #define SOF_TKN_INTEL_ALH_CH 1401
 #define SOF_TKN_INTEL_HDA_RATE 1500
 #define SOF_TKN_INTEL_HDA_CH 1501
+#define SOF_TKN_MEDIATEK_AFE_RATE 1600
+#define SOF_TKN_MEDIATEK_AFE_CH 1601
+#define SOF_TKN_MEDIATEK_AFE_FORMAT 1602
 #endif
diff --git a/libc/malloc_debug/Android.bp b/libc/malloc_debug/Android.bp
index f779b73a1..7ff3db204 100644
--- a/libc/malloc_debug/Android.bp
+++ b/libc/malloc_debug/Android.bp
@@ -166,6 +166,7 @@ cc_test {
 
     include_dirs: [
         "bionic/libc",
+        "bionic", // For SKIP_WITH_HWASAN.
     ],
 
     header_libs: [
diff --git a/libc/malloc_debug/PointerData.cpp b/libc/malloc_debug/PointerData.cpp
index 90c913638..b982c0ae8 100644
--- a/libc/malloc_debug/PointerData.cpp
+++ b/libc/malloc_debug/PointerData.cpp
@@ -66,7 +66,8 @@ std::mutex PointerData::frame_mutex_;
 std::unordered_map<FrameKeyType, size_t> PointerData::key_to_index_ GUARDED_BY(
     PointerData::frame_mutex_);
 std::unordered_map<size_t, FrameInfoType> PointerData::frames_ GUARDED_BY(PointerData::frame_mutex_);
-std::unordered_map<size_t, std::vector<unwindstack::LocalFrameData>> PointerData::backtraces_info_ GUARDED_BY(PointerData::frame_mutex_);
+std::unordered_map<size_t, std::vector<unwindstack::FrameData>> PointerData::backtraces_info_
+    GUARDED_BY(PointerData::frame_mutex_);
 constexpr size_t kBacktraceEmptyIndex = 1;
 size_t PointerData::cur_hash_index_ GUARDED_BY(PointerData::frame_mutex_);
 
@@ -136,7 +137,7 @@ bool PointerData::Initialize(const Config& config) NO_THREAD_SAFETY_ANALYSIS {
 
 size_t PointerData::AddBacktrace(size_t num_frames) {
   std::vector<uintptr_t> frames;
-  std::vector<unwindstack::LocalFrameData> frames_info;
+  std::vector<unwindstack::FrameData> frames_info;
   if (g_debug->config().options() & BACKTRACE_FULL) {
     if (!Unwind(&frames, &frames_info, num_frames)) {
       return kBacktraceEmptyIndex;
@@ -386,7 +387,7 @@ void PointerData::GetList(std::vector<ListInfoType>* list, bool only_with_backtr
     REQUIRES(pointer_mutex_, frame_mutex_) {
   for (const auto& entry : pointers_) {
     FrameInfoType* frame_info = nullptr;
-    std::vector<unwindstack::LocalFrameData>* backtrace_info = nullptr;
+    std::vector<unwindstack::FrameData>* backtrace_info = nullptr;
     size_t hash_index = entry.second.hash_index;
     if (hash_index > kBacktraceEmptyIndex) {
       auto frame_entry = frames_.find(hash_index);
diff --git a/libc/malloc_debug/PointerData.h b/libc/malloc_debug/PointerData.h
index 37d87db1a..92d2653d6 100644
--- a/libc/malloc_debug/PointerData.h
+++ b/libc/malloc_debug/PointerData.h
@@ -39,7 +39,7 @@
 #include <vector>
 
 #include <platform/bionic/macros.h>
-#include <unwindstack/LocalUnwinder.h>
+#include <unwindstack/Unwinder.h>
 
 #include "OptionData.h"
 #include "UnwindBacktrace.h"
@@ -109,7 +109,7 @@ struct ListInfoType {
   size_t size;
   bool zygote_child_alloc;
   FrameInfoType* frame_info;
-  std::vector<unwindstack::LocalFrameData>* backtrace_info;
+  std::vector<unwindstack::FrameData>* backtrace_info;
 };
 
 class PointerData : public OptionData {
@@ -181,7 +181,7 @@ class PointerData : public OptionData {
   static std::mutex frame_mutex_;
   static std::unordered_map<FrameKeyType, size_t> key_to_index_;
   static std::unordered_map<size_t, FrameInfoType> frames_;
-  static std::unordered_map<size_t, std::vector<unwindstack::LocalFrameData>> backtraces_info_;
+  static std::unordered_map<size_t, std::vector<unwindstack::FrameData>> backtraces_info_;
   static size_t cur_hash_index_;
 
   static std::mutex free_pointer_mutex_;
diff --git a/libc/malloc_debug/README.md b/libc/malloc_debug/README.md
index da26d158b..662f5f897 100644
--- a/libc/malloc_debug/README.md
+++ b/libc/malloc_debug/README.md
@@ -641,6 +641,13 @@ App developers should check the NDK documentation about
 for the best way to use malloc debug in Android O or later on non-rooted
 devices.
 
+**NOTE**: Android 12 introduced a bug that can cause the wrap.\<APP\> property to
+no longer work. Use the commands below so that the wrap.\<APP\> instructions will work:
+
+    adb shell setprop dalvik.vm.force-java-zygote-fork-loop true
+    adb shell stop
+    adb shell start
+
 If you do have a rooted device, you can enable malloc debug for a specific
 program/application (Android O or later):
 
diff --git a/libc/malloc_debug/UnwindBacktrace.cpp b/libc/malloc_debug/UnwindBacktrace.cpp
index a7036d935..f6c3e69e0 100644
--- a/libc/malloc_debug/UnwindBacktrace.cpp
+++ b/libc/malloc_debug/UnwindBacktrace.cpp
@@ -36,8 +36,12 @@
 #include <vector>
 
 #include <android-base/stringprintf.h>
-#include <unwindstack/LocalUnwinder.h>
 #include <unwindstack/MapInfo.h>
+#include <unwindstack/Maps.h>
+#include <unwindstack/Memory.h>
+#include <unwindstack/Regs.h>
+#include <unwindstack/RegsGetLocal.h>
+#include <unwindstack/Unwinder.h>
 
 #include "UnwindBacktrace.h"
 #include "debug_log.h"
@@ -52,42 +56,56 @@ extern "C" char* __cxa_demangle(const char*, char*, size_t*, int*);
 
 static pthread_once_t g_setup_once = PTHREAD_ONCE_INIT;
 
-static unwindstack::LocalUnwinder* g_unwinder;
-
-static void Setup() {
+static unwindstack::LocalUpdatableMaps* g_maps;
+static std::shared_ptr<unwindstack::Memory> g_process_memory;
 #if defined(__LP64__)
-  std::vector<std::string> skip_libraries{"/system/lib64/libunwindstack.so", "/system/lib64/libc_malloc_debug.so"};
+static std::vector<std::string> g_skip_libraries{"/system/lib64/libunwindstack.so",
+                                                 "/system/lib64/libc_malloc_debug.so"};
 #else
-  std::vector<std::string> skip_libraries{"/system/lib/libunwindstack.so", "/system/lib/libc_malloc_debug.so"};
+static std::vector<std::string> g_skip_libraries{"/system/lib/libunwindstack.so",
+                                                 "/system/lib/libc_malloc_debug.so"};
 #endif
 
-  g_unwinder = new unwindstack::LocalUnwinder(skip_libraries);
-  g_unwinder->Init();
+static void Setup() {
+  g_maps = new unwindstack::LocalUpdatableMaps;
+  if (!g_maps->Parse()) {
+    delete g_maps;
+    g_maps = nullptr;
+  }
+
+  g_process_memory = unwindstack::Memory::CreateProcessMemoryThreadCached(getpid());
 }
 
-bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::LocalFrameData>* frame_info, size_t max_frames) {
+bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::FrameData>* frame_info,
+            size_t max_frames) {
   pthread_once(&g_setup_once, Setup);
 
-  if (g_unwinder == nullptr) {
+  if (g_maps == nullptr) {
     return false;
   }
 
-  if (!g_unwinder->Unwind(frame_info, max_frames)) {
+  std::unique_ptr<unwindstack::Regs> regs(unwindstack::Regs::CreateFromLocal());
+  unwindstack::RegsGetLocal(regs.get());
+  unwindstack::Unwinder unwinder(max_frames, g_maps, regs.get(), g_process_memory);
+  unwinder.Unwind(&g_skip_libraries);
+  if (unwinder.NumFrames() == 0) {
     frames->clear();
     frame_info->clear();
     return false;
   }
+  *frame_info = unwinder.ConsumeFrames();
 
-  for (const auto& frame : *frame_info) {
-    frames->push_back(frame.pc);
+  frames->resize(frame_info->size());
+  for (size_t i = 0; i < frame_info->size(); i++) {
+    frames->at(i) = frame_info->at(i).pc;
   }
   return true;
 }
 
-void UnwindLog(const std::vector<unwindstack::LocalFrameData>& frame_info) {
+void UnwindLog(const std::vector<unwindstack::FrameData>& frame_info) {
   for (size_t i = 0; i < frame_info.size(); i++) {
-    const unwindstack::LocalFrameData* info = &frame_info[i];
-    std::shared_ptr<unwindstack::MapInfo> map_info = info->map_info;
+    const unwindstack::FrameData* info = &frame_info[i];
+    auto map_info = info->map_info;
 
     std::string line = android::base::StringPrintf("          #%0zd  pc %" PAD_PTR "  ", i, info->rel_pc);
     if (map_info != nullptr && map_info->offset() != 0) {
diff --git a/libc/malloc_debug/UnwindBacktrace.h b/libc/malloc_debug/UnwindBacktrace.h
index 4c6c8d4a5..7f8990716 100644
--- a/libc/malloc_debug/UnwindBacktrace.h
+++ b/libc/malloc_debug/UnwindBacktrace.h
@@ -33,9 +33,10 @@
 #include <string>
 #include <vector>
 
-#include <unwindstack/LocalUnwinder.h>
 #include <unwindstack/MapInfo.h>
+#include <unwindstack/Unwinder.h>
 
-bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::LocalFrameData>* info, size_t max_frames);
+bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::FrameData>* info,
+            size_t max_frames);
 
-void UnwindLog(const std::vector<unwindstack::LocalFrameData>& frame_info);
+void UnwindLog(const std::vector<unwindstack::FrameData>& frame_info);
diff --git a/libc/malloc_debug/malloc_debug.cpp b/libc/malloc_debug/malloc_debug.cpp
index d23ab15c3..9f38946af 100644
--- a/libc/malloc_debug/malloc_debug.cpp
+++ b/libc/malloc_debug/malloc_debug.cpp
@@ -49,6 +49,7 @@
 #include <platform/bionic/reserved_signals.h>
 #include <private/MallocXmlElem.h>
 #include <private/bionic_malloc_dispatch.h>
+#include <unwindstack/Unwinder.h>
 
 #include "Config.h"
 #include "DebugData.h"
@@ -193,7 +194,7 @@ static void InitAtfork() {
 void BacktraceAndLog() {
   if (g_debug->config().options() & BACKTRACE_FULL) {
     std::vector<uintptr_t> frames;
-    std::vector<unwindstack::LocalFrameData> frames_info;
+    std::vector<unwindstack::FrameData> frames_info;
     if (!Unwind(&frames, &frames_info, 256)) {
       error_log("  Backtrace failed to get any frames.");
     } else {
diff --git a/libc/malloc_debug/tests/backtrace_fake.cpp b/libc/malloc_debug/tests/backtrace_fake.cpp
index ad16c0211..f54bae86b 100644
--- a/libc/malloc_debug/tests/backtrace_fake.cpp
+++ b/libc/malloc_debug/tests/backtrace_fake.cpp
@@ -20,7 +20,7 @@
 #include <vector>
 #include <utility>
 
-#include <unwindstack/LocalUnwinder.h>
+#include <unwindstack/Unwinder.h>
 
 #include "backtrace.h"
 #include "backtrace_fake.h"
@@ -60,17 +60,17 @@ void backtrace_log(const uintptr_t* frames, size_t frame_count) {
   }
 }
 
-static std::deque<std::vector<unwindstack::LocalFrameData>> g_fake_local_frame_data;
+static std::deque<std::vector<unwindstack::FrameData>> g_fake_local_frame_data;
 
 void BacktraceUnwindFakeClearAll() {
   g_fake_local_frame_data.clear();
 }
 
-void BacktraceUnwindFake(const std::vector<unwindstack::LocalFrameData>& frames) {
+void BacktraceUnwindFake(const std::vector<unwindstack::FrameData>& frames) {
   g_fake_local_frame_data.push_back(frames);
 }
 
-bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::LocalFrameData>* info, size_t) {
+bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::FrameData>* info, size_t) {
   if (g_fake_local_frame_data.empty()) {
     return false;
   }
@@ -85,5 +85,4 @@ bool Unwind(std::vector<uintptr_t>* frames, std::vector<unwindstack::LocalFrameD
   return true;
 }
 
-void UnwindLog(const std::vector<unwindstack::LocalFrameData>& /*frame_info*/) {
-}
+void UnwindLog(const std::vector<unwindstack::FrameData>& /*frame_info*/) {}
diff --git a/libc/malloc_debug/tests/backtrace_fake.h b/libc/malloc_debug/tests/backtrace_fake.h
index a9ee97dc7..246fc614b 100644
--- a/libc/malloc_debug/tests/backtrace_fake.h
+++ b/libc/malloc_debug/tests/backtrace_fake.h
@@ -21,12 +21,12 @@
 
 #include <vector>
 
-#include <unwindstack/LocalUnwinder.h>
+#include <unwindstack/Unwinder.h>
 
 void backtrace_fake_clear_all();
 void backtrace_fake_add(const std::vector<uintptr_t>& ips);
 
 void BacktraceUnwindFakeClearAll();
-void BacktraceUnwindFake(const std::vector<unwindstack::LocalFrameData>& frames);
+void BacktraceUnwindFake(const std::vector<unwindstack::FrameData>& frames);
 
 #endif // MALLOC_DEBUG_TESTS_BACKTRACE_FAKE_H
diff --git a/libc/malloc_debug/tests/malloc_debug_system_tests.cpp b/libc/malloc_debug/tests/malloc_debug_system_tests.cpp
index eaf86c5a6..92679e48b 100644
--- a/libc/malloc_debug/tests/malloc_debug_system_tests.cpp
+++ b/libc/malloc_debug/tests/malloc_debug_system_tests.cpp
@@ -41,6 +41,7 @@
 
 #include <android-base/file.h>
 #include <android-base/stringprintf.h>
+#include <android-base/test_utils.h>
 #include <gtest/gtest.h>
 #include <log/log_read.h>
 
@@ -55,6 +56,7 @@
 #include <backtrace/BacktraceMap.h>
 
 #include <bionic/malloc.h>
+#include <tests/utils.h>
 
 // All DISABLED_ tests are designed to be executed after malloc debug
 // is enabled. These tests don't run be default, and are executed
@@ -610,6 +612,7 @@ TEST_F(MallocDebugSystemTest, verify_leak) {
 }
 
 TEST_F(MallocDebugSystemTest, verify_leak_allocation_limit) {
+  SKIP_WITH_HWASAN;
   VerifyLeak("leak_memory_limit_");
 }
 
diff --git a/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp b/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
index 7b58f31c4..ea2dc7880 100644
--- a/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
+++ b/libc/malloc_debug/tests/malloc_debug_unit_tests.cpp
@@ -40,10 +40,13 @@
 #include <android-base/file.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
+#include <android-base/test_utils.h>
 
 #include <platform/bionic/macros.h>
 #include <private/bionic_malloc_dispatch.h>
 
+#include <unwindstack/Unwinder.h>
+
 #include "Config.h"
 #include "malloc_debug.h"
 
@@ -1530,16 +1533,18 @@ TEST_F(MallocDebugTest, backtrace_full_dump_on_exit) {
   if ((pid = fork()) == 0) {
     std::shared_ptr<unwindstack::MapInfo> empty_map;
     Init("backtrace=4 backtrace_full backtrace_dump_on_exit");
-    BacktraceUnwindFake(std::vector<unwindstack::LocalFrameData>{
-        {empty_map, 0x1100, 0x100, "fake1", 10}, {empty_map, 0x1200, 0x200, "fake2", 20}});
+    BacktraceUnwindFake(
+        std::vector<unwindstack::FrameData>{{0, 0x100, 0x1100, 0, "fake1", 10, empty_map},
+                                            {1, 0x200, 0x1200, 0, "fake2", 20, empty_map}});
     std::shared_ptr<unwindstack::MapInfo> map_info =
         unwindstack::MapInfo::Create(0x10000, 0x20000, 0, PROT_READ | PROT_EXEC, "/data/fake.so");
-    BacktraceUnwindFake(std::vector<unwindstack::LocalFrameData>{
-        {map_info, 0x1a000, 0xa000, "level1", 0}, {map_info, 0x1b000, 0xb000, "level2", 10}});
     BacktraceUnwindFake(
-        std::vector<unwindstack::LocalFrameData>{{empty_map, 0x1a000, 0xa000, "func1", 0},
-                                                 {empty_map, 0x1b000, 0xb000, "func2", 10},
-                                                 {empty_map, 0x1c000, 0xc000, "", 30}});
+        std::vector<unwindstack::FrameData>{{0, 0xa000, 0x1a000, 0, "level1", 0, map_info},
+                                            {1, 0xb000, 0x1b000, 0, "level2", 10, map_info}});
+    BacktraceUnwindFake(
+        std::vector<unwindstack::FrameData>{{0, 0xa000, 0x1a000, 0, "func1", 0, empty_map},
+                                            {1, 0xb000, 0x1b000, 0, "func2", 10, empty_map},
+                                            {2, 0xc000, 0x1c000, 0, "", 30, empty_map}});
 
     std::vector<void*> pointers;
     pointers.push_back(debug_malloc(300));
@@ -2059,6 +2064,7 @@ TEST_F(MallocDebugTest, max_size) {
 }
 
 TEST_F(MallocDebugTest, debug_mallinfo) {
+  SKIP_WITH_HWASAN;
   Init("guard");
 
   void* pointer = debug_malloc(150);
@@ -2471,6 +2477,7 @@ TEST_F(MallocDebugTest, abort_on_error_header_tag_corrupted) {
 }
 
 TEST_F(MallocDebugTest, malloc_info_no_pointer_tracking) {
+  SKIP_WITH_HWASAN;
   Init("fill");
 
   TemporaryFile tf;
diff --git a/libc/malloc_hooks/tests/malloc_hooks_tests.cpp b/libc/malloc_hooks/tests/malloc_hooks_tests.cpp
index ca064c2fe..3ff2537c3 100644
--- a/libc/malloc_hooks/tests/malloc_hooks_tests.cpp
+++ b/libc/malloc_hooks/tests/malloc_hooks_tests.cpp
@@ -38,6 +38,7 @@
 
 #include <gtest/gtest.h>
 
+#include <android-base/test_utils.h>
 #include <bionic/malloc.h>
 #include <private/bionic_malloc_dispatch.h>
 #include <tests/utils.h>
@@ -178,6 +179,7 @@ void MallocHooksTest::test_free_hook(void* ptr, const void* arg) {
 }
 
 TEST_F(MallocHooksTest, other_malloc_functions) {
+  SKIP_WITH_HWASAN; // HWASan does not implement mallinfo.
   RunTest("*.DISABLED_other_malloc_functions");
 }
 
diff --git a/libc/platform/bionic/malloc.h b/libc/platform/bionic/malloc.h
index b56ca746a..f0f13d012 100644
--- a/libc/platform/bionic/malloc.h
+++ b/libc/platform/bionic/malloc.h
@@ -96,12 +96,42 @@ enum {
   // otherwise this mallopt() will internally decide whether to sample the
   // process. The program must be single threaded at the point when the
   // android_mallopt function is called.
-  //   arg = bool*
-  //   arg_size = sizeof(bool)
+  //   arg = android_mallopt_gwp_asan_options_t*
+  //   arg_size = sizeof(android_mallopt_gwp_asan_options_t)
   M_INITIALIZE_GWP_ASAN = 10,
 #define M_INITIALIZE_GWP_ASAN M_INITIALIZE_GWP_ASAN
 };
 
+typedef struct {
+  // The null-terminated name that the zygote is spawning. Because native
+  // SpecializeCommon (where the GWP-ASan mallopt() is called from) happens
+  // before argv[0] is set, we need the zygote to tell us the new app name.
+  const char* program_name = nullptr;
+
+  // An android_mallopt(M_INITIALIZE_GWP_ASAN) is always issued on process
+  // startup and app startup, regardless of whether GWP-ASan is desired or not.
+  // This allows the process/app's desire to be overwritten by the
+  // "libc.debug.gwp_asan.*.app_default" or "libc.debug.gwp_asan.*.<name>"
+  // system properties, as well as the "GWP_ASAN_*" environment variables.
+  //
+  // Worth noting, the "libc.debug.gwp_asan.*.app_default" sysprops *do not*
+  // apply to system apps. They use the "libc.debug.gwp_asan.*.system_default"
+  // sysprops.
+  enum Action {
+    // The app has opted-in to GWP-ASan, and should always have it enabled. This
+    // should only be used by apps.
+    TURN_ON_FOR_APP,
+    // System processes apps have GWP-ASan enabled by default, but use the
+    // process sampling method.
+    TURN_ON_WITH_SAMPLING,
+    // Non-system apps don't have GWP-ASan by default.
+    DONT_TURN_ON_UNLESS_OVERRIDDEN,
+    // Note: GWP-ASan cannot be disabled once it's been enabled.
+  };
+
+  Action desire = DONT_TURN_ON_UNLESS_OVERRIDDEN;
+} android_mallopt_gwp_asan_options_t;
+
 // Manipulates bionic-specific handling of memory allocation APIs such as
 // malloc. Only for use by the Android platform itself.
 //
diff --git a/libc/platform/bionic/pac.h b/libc/platform/bionic/pac.h
index c3116512d..34efc48ae 100644
--- a/libc/platform/bionic/pac.h
+++ b/libc/platform/bionic/pac.h
@@ -29,7 +29,6 @@
 #pragma once
 
 #include <stddef.h>
-#include <sys/prctl.h>
 
 inline uintptr_t __bionic_clear_pac_bits(uintptr_t ptr) {
 #if defined(__aarch64__)
@@ -41,39 +40,3 @@ inline uintptr_t __bionic_clear_pac_bits(uintptr_t ptr) {
   return ptr;
 #endif
 }
-
-#ifdef __aarch64__
-// The default setting for branch-protection enables both PAC and BTI, so by
-// overriding it to only enable BTI we disable PAC.
-#define __BIONIC_DISABLE_PAUTH __attribute__((target("branch-protection=bti")))
-#else
-#define __BIONIC_DISABLE_PAUTH
-#endif
-
-#ifdef __aarch64__
-// Disable PAC (i.e. make the signing and authentication instructions into no-ops) for the lifetime
-// of this object.
-class ScopedDisablePAC {
-  int prev_enabled_keys_;
-
- public:
-  // Disabling IA will invalidate the return address in this function if it is signed, so we need to
-  // make sure that this function does not sign its return address. Likewise for the destructor.
-  __BIONIC_DISABLE_PAUTH
-  ScopedDisablePAC() {
-    // These prctls will fail (resulting in a no-op, the intended behavior) if PAC is not supported.
-    prev_enabled_keys_ = prctl(PR_PAC_GET_ENABLED_KEYS, 0, 0, 0, 0);
-    prctl(PR_PAC_SET_ENABLED_KEYS, prev_enabled_keys_, 0, 0, 0);
-  }
-
-  __BIONIC_DISABLE_PAUTH
-  ~ScopedDisablePAC() {
-    prctl(PR_PAC_SET_ENABLED_KEYS, prev_enabled_keys_, prev_enabled_keys_, 0, 0);
-  }
-};
-#else
-struct ScopedDisablePAC {
-  // Silence unused variable warnings in non-aarch64 builds.
-  ScopedDisablePAC() {}
-};
-#endif
diff --git a/libfdtrack/Android.bp b/libfdtrack/Android.bp
index fb28623ef..83ea7cb4b 100644
--- a/libfdtrack/Android.bp
+++ b/libfdtrack/Android.bp
@@ -38,4 +38,5 @@ cc_test {
     whole_static_libs: ["libBionicCtsGtestMain"],
     static_libs: ["liblog"],
     test_suites: ["device-tests"],
+    runtime_libs: ["libfdtrack"],
 }
diff --git a/libfdtrack/fdtrack.cpp b/libfdtrack/fdtrack.cpp
index 2e9cfbcd0..2d114f23e 100644
--- a/libfdtrack/fdtrack.cpp
+++ b/libfdtrack/fdtrack.cpp
@@ -31,6 +31,8 @@
 
 #include <array>
 #include <mutex>
+#include <string>
+#include <string_view>
 #include <thread>
 #include <utility>
 #include <vector>
@@ -43,11 +45,14 @@
 #include <android-base/thread_annotations.h>
 #include <async_safe/log.h>
 #include <bionic/reserved_signals.h>
-#include <unwindstack/LocalUnwinder.h>
+#include <unwindstack/Maps.h>
+#include <unwindstack/Regs.h>
+#include <unwindstack/RegsGetLocal.h>
+#include <unwindstack/Unwinder.h>
 
 struct FdEntry {
   std::mutex mutex;
-  std::vector<unwindstack::LocalFrameData> backtrace GUARDED_BY(mutex);
+  std::vector<unwindstack::FrameData> backtrace GUARDED_BY(mutex);
 };
 
 extern "C" void fdtrack_dump();
@@ -62,15 +67,21 @@ static void fd_hook(android_fdtrack_event* event);
 // Backtraces for the first 4k file descriptors ought to be enough to diagnose an fd leak.
 static constexpr size_t kFdTableSize = 4096;
 
-// 32 frames, plus two to skip from fdtrack itself.
-static constexpr size_t kStackDepth = 34;
-static constexpr size_t kStackFrameSkip = 2;
+// Only unwind up to 32 frames outside of libfdtrack.so.
+static constexpr size_t kStackDepth = 32;
+
+// Skip any initial frames from libfdtrack.so.
+static std::vector<std::string> kSkipFdtrackLib [[clang::no_destroy]] = {"libfdtrack.so"};
 
 static bool installed = false;
 static std::array<FdEntry, kFdTableSize> stack_traces [[clang::no_destroy]];
-static unwindstack::LocalUnwinder& Unwinder() {
-  static android::base::NoDestructor<unwindstack::LocalUnwinder> unwinder;
-  return *unwinder.get();
+static unwindstack::LocalUpdatableMaps& Maps() {
+  static android::base::NoDestructor<unwindstack::LocalUpdatableMaps> maps;
+  return *maps.get();
+}
+static std::shared_ptr<unwindstack::Memory>& ProcessMemory() {
+  static android::base::NoDestructor<std::shared_ptr<unwindstack::Memory>> process_memory;
+  return *process_memory.get();
 }
 
 __attribute__((constructor)) static void ctor() {
@@ -89,7 +100,8 @@ __attribute__((constructor)) static void ctor() {
   sa.sa_flags = SA_SIGINFO | SA_ONSTACK;
   sigaction(BIONIC_SIGNAL_FDTRACK, &sa, nullptr);
 
-  if (Unwinder().Init()) {
+  if (Maps().Parse()) {
+    ProcessMemory() = unwindstack::Memory::CreateProcessMemoryThreadCached(getpid());
     android_fdtrack_hook_t expected = nullptr;
     installed = android_fdtrack_compare_exchange_hook(&expected, &fd_hook);
   }
@@ -116,7 +128,12 @@ static void fd_hook(android_fdtrack_event* event) {
     if (FdEntry* entry = GetFdEntry(event->fd); entry) {
       std::lock_guard<std::mutex> lock(entry->mutex);
       entry->backtrace.clear();
-      Unwinder().Unwind(&entry->backtrace, kStackDepth);
+
+      std::unique_ptr<unwindstack::Regs> regs(unwindstack::Regs::CreateFromLocal());
+      unwindstack::RegsGetLocal(regs.get());
+      unwindstack::Unwinder unwinder(kStackDepth, &Maps(), regs.get(), ProcessMemory());
+      unwinder.Unwind(&kSkipFdtrackLib);
+      entry->backtrace = unwinder.ConsumeFrames();
     }
   } else if (event->type == ANDROID_FDTRACK_EVENT_TYPE_CLOSE) {
     if (FdEntry* entry = GetFdEntry(event->fd); entry) {
@@ -153,14 +170,13 @@ void fdtrack_iterate(fdtrack_callback_t callback, void* arg) {
       continue;
     }
 
-    for (size_t i = kStackFrameSkip; i < entry->backtrace.size(); ++i) {
-      size_t j = i - kStackFrameSkip;
-      function_names[j] = entry->backtrace[i].function_name.c_str();
-      function_offsets[j] = entry->backtrace[i].function_offset;
+    for (size_t i = 0; i < entry->backtrace.size(); ++i) {
+      function_names[i] = entry->backtrace[i].function_name.c_str();
+      function_offsets[i] = entry->backtrace[i].function_offset;
     }
 
-    bool should_continue = callback(fd, function_names, function_offsets,
-                                    entry->backtrace.size() - kStackFrameSkip, arg);
+    bool should_continue =
+        callback(fd, function_names, function_offsets, entry->backtrace.size(), arg);
 
     entry->mutex.unlock();
 
@@ -200,8 +216,8 @@ static void fdtrack_dump_impl(bool fatal) {
     size_t count = 0;
 
     size_t stack_depth = 0;
-    const char* function_names[kStackDepth - kStackFrameSkip];
-    uint64_t function_offsets[kStackDepth - kStackFrameSkip];
+    const char* function_names[kStackDepth];
+    uint64_t function_offsets[kStackDepth];
   };
   struct StackList {
     size_t count = 0;
diff --git a/libm/Android.bp b/libm/Android.bp
index 43d82d5a0..7469cde0a 100644
--- a/libm/Android.bp
+++ b/libm/Android.bp
@@ -307,7 +307,7 @@ cc_library {
             no_libcrt: true,
             shared: {
                 // For backwards-compatibility, some arm32 builtins are exported from libm.so.
-                static_libs: ["libclang_rt.builtins-arm-android-exported"],
+                static_libs: ["libclang_rt.builtins-exported"],
             },
         },
 
@@ -552,6 +552,8 @@ ndk_library {
     name: "libm",
     symbol_file: "libm.map.txt",
     first_version: "9",
+    // APIs implemented in asm don't have debug info: http://b/190554910.
+    allow_untyped_symbols: true,
 }
 
 genrule {
diff --git a/linker/Android.bp b/linker/Android.bp
index dbefcf616..d5e7367f4 100644
--- a/linker/Android.bp
+++ b/linker/Android.bp
@@ -28,16 +28,11 @@ cc_object {
     name: "linker_wrapper",
     host_supported: true,
     device_supported: false,
+    enabled: false,
     target: {
         linux_bionic: {
             enabled: true,
         },
-        linux_glibc: {
-            enabled: false,
-        },
-        darwin: {
-            enabled: false,
-        },
     },
 
     cflags: [
diff --git a/linker/arch/arm_neon/linker_gnu_hash_neon.cpp b/linker/arch/arm_neon/linker_gnu_hash_neon.cpp
index 11cf5a3d0..159c66e9d 100644
--- a/linker/arch/arm_neon/linker_gnu_hash_neon.cpp
+++ b/linker/arch/arm_neon/linker_gnu_hash_neon.cpp
@@ -81,6 +81,8 @@ constexpr uint32_t kStepN7 = kStepN6 * 0x3e0f83e1;
 //      return h;
 //    }
 //
+// This does an within-alignment out-of-bounds read for performance reasons.
+__attribute__((no_sanitize("hwaddress")))
 std::pair<uint32_t, uint32_t> calculate_gnu_hash_neon(const char* name) {
 
   // The input string may be misaligned by 0-7 bytes (K). This function loads the first aligned
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 3488f5cc7..c6588d2cd 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -3351,18 +3351,15 @@ static std::vector<android_namespace_t*> init_default_namespace_no_config(bool i
 }
 
 // Given an `executable_path` starting with "/apex/<name>/bin/, return
-// "/linkerconfig/<name>/ld.config.txt" (or "/apex/<name>/etc/ld.config.txt", if
-// the former does not exist).
+// "/linkerconfig/<name>/ld.config.txt", which is the auto-generated config file for the APEX by the
+// linkerconfig tool.
 static std::string get_ld_config_file_apex_path(const char* executable_path) {
   std::vector<std::string> paths = android::base::Split(executable_path, "/");
   if (paths.size() >= 5 && paths[1] == "apex" && paths[3] == "bin") {
-    // Check auto-generated ld.config.txt first
     std::string generated_apex_config = "/linkerconfig/" + paths[2] + "/ld.config.txt";
     if (file_exists(generated_apex_config.c_str())) {
       return generated_apex_config;
     }
-
-    return std::string("/apex/") + paths[2] + "/etc/ld.config.txt";
   }
   return "";
 }
diff --git a/linker/linker.h b/linker/linker.h
index 74bdcc7fa..a80342479 100644
--- a/linker/linker.h
+++ b/linker/linker.h
@@ -51,7 +51,7 @@
 #define ELFW(what) ELF32_ ## what
 #endif
 
-#define SUPPORTED_DT_FLAGS_1 (DF_1_NOW | DF_1_GLOBAL | DF_1_NODELETE | DF_1_PIE)
+#define SUPPORTED_DT_FLAGS_1 (DF_1_NOW | DF_1_GLOBAL | DF_1_NODELETE | DF_1_PIE | DF_1_ORIGIN)
 
 // Class used construct version dependency graph.
 class VersionTracker {
diff --git a/linker/linker_relocate.cpp b/linker/linker_relocate.cpp
index 72be5f74c..c7c7bfbb3 100644
--- a/linker/linker_relocate.cpp
+++ b/linker/linker_relocate.cpp
@@ -229,6 +229,12 @@ static bool process_relocation_impl(Relocator& relocator, const rel_t& reloc) {
   auto get_addend_norel = [&]() -> ElfW(Addr) { return 0; };
 #endif
 
+  if (!IsGeneral && __predict_false(is_tls_reloc(r_type))) {
+    // Always process TLS relocations using the slow code path, so that STB_LOCAL symbols are
+    // diagnosed, and ifunc processing is skipped.
+    return process_relocation_general(relocator, reloc);
+  }
+
   if (IsGeneral && is_tls_reloc(r_type)) {
     if (r_sym == 0) {
       // By convention in ld.bfd and lld, an omitted symbol on a TLS relocation
@@ -242,8 +248,15 @@ static bool process_relocation_impl(Relocator& relocator, const rel_t& reloc) {
       //  - https://groups.google.com/d/topic/generic-abi/dJ4_Y78aQ2M/discussion
       //  - https://sourceware.org/bugzilla/show_bug.cgi?id=17699
       sym = &relocator.si_symtab[r_sym];
-      DL_ERR("unexpected TLS reference to local symbol \"%s\" in \"%s\": sym type %d, rel type %u",
-             sym_name, relocator.si->get_realpath(), ELF_ST_TYPE(sym->st_info), r_type);
+      auto sym_type = ELF_ST_TYPE(sym->st_info);
+      if (sym_type == STT_SECTION) {
+        DL_ERR("unexpected TLS reference to local section in \"%s\": sym type %d, rel type %u",
+               relocator.si->get_realpath(), sym_type, r_type);
+      } else {
+        DL_ERR(
+            "unexpected TLS reference to local symbol \"%s\" in \"%s\": sym type %d, rel type %u",
+            sym_name, relocator.si->get_realpath(), sym_type, r_type);
+      }
       return false;
     } else if (!lookup_symbol<IsGeneral>(relocator, r_sym, sym_name, &found_in, &sym)) {
       return false;
diff --git a/tests/Android.bp b/tests/Android.bp
index b30eac97f..a54ffb835 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -62,7 +62,10 @@ cc_defaults {
         // For glibc.
         "-D__STDC_LIMIT_MACROS",
     ],
-    header_libs: ["libcutils_headers"],
+    header_libs: [
+        "libcutils_headers",
+        "gwp_asan_headers"
+    ],
     // Ensure that the tests exercise shadow call stack support and
     // the hint space PAC/BTI instructions.
     arch: {
@@ -295,6 +298,29 @@ cc_prebuilt_test_library_shared {
     },
 }
 
+cc_prebuilt_test_library_shared {
+    name: "libtest_invalid-local-tls",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+    relative_install_path: "bionic-loader-test-libs/prebuilt-elf-files",
+    arch: {
+        arm: {
+            srcs: ["prebuilt-elf-files/arm/libtest_invalid-local-tls.so"],
+        },
+        arm64: {
+            srcs: ["prebuilt-elf-files/arm64/libtest_invalid-local-tls.so"],
+        },
+        x86: {
+            srcs: ["prebuilt-elf-files/x86/libtest_invalid-local-tls.so"],
+        },
+        x86_64: {
+            srcs: ["prebuilt-elf-files/x86_64/libtest_invalid-local-tls.so"],
+        },
+    },
+}
+
 // -----------------------------------------------------------------------------
 // All standard tests.
 // -----------------------------------------------------------------------------
@@ -320,6 +346,7 @@ cc_test_library {
         "__cxa_demangle_test.cpp",
         "alloca_test.cpp",
         "android_get_device_api_level.cpp",
+        "android_set_abort_message_test.cpp",
         "arpa_inet_test.cpp",
         "async_safe_test.cpp",
         "assert_test.cpp",
@@ -493,6 +520,12 @@ cc_test_library {
     },
 
     generated_headers: ["generated_android_ids"],
+
+    // Bug: http://b/218788252 IR verifier too strict for ifunc resolver that
+    // accept parameters.
+    lto: {
+        never: true,
+    },
 }
 
 cc_test_library {
@@ -565,6 +598,18 @@ cc_test_library {
     ],
 }
 
+cc_test_library {
+    name: "libBionicGwpAsanTests",
+    defaults: ["bionic_tests_defaults"],
+    srcs: [
+        "gwp_asan_test.cpp",
+    ],
+    include_dirs: [
+        "bionic/libc",
+    ],
+    static_libs: ["libbase"],
+}
+
 // -----------------------------------------------------------------------------
 // Fortify tests.
 // -----------------------------------------------------------------------------
@@ -729,6 +774,7 @@ cc_test_library {
         "libBionicStandardTests",
         "libBionicElfTlsTests",
         "libBionicFramePointerTests",
+        "libBionicGwpAsanTests",
         "libfortify1-tests-clang",
         "libfortify1-new-tests-clang",
         "libfortify2-tests-clang",
@@ -988,6 +1034,7 @@ cc_defaults {
         "libtest_init_fini_order_root",
         "libtest_init_fini_order_root2",
         "libtest_invalid-empty_shdr_table",
+        "libtest_invalid-local-tls",
         "libtest_invalid-rw_load_segment",
         "libtest_invalid-textrels",
         "libtest_invalid-textrels2",
diff --git a/tests/NOTICE b/tests/NOTICE
index c9b65d07b..8c3483c3b 100644
--- a/tests/NOTICE
+++ b/tests/NOTICE
@@ -382,3 +382,31 @@ SUCH DAMAGE.
 
 -------------------------------------------------------------------
 
+Copyright (C) 2022 The Android Open Source Project
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+ * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
diff --git a/tests/android_set_abort_message_test.cpp b/tests/android_set_abort_message_test.cpp
new file mode 100644
index 000000000..d6553dedd
--- /dev/null
+++ b/tests/android_set_abort_message_test.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+
+#include <gtest/gtest.h>
+
+#if defined(__BIONIC__)
+extern "C" void android_set_abort_message(const char* msg);
+#endif
+
+TEST(android_set_abort_message_test, nullptr_check) {
+#if defined(__BIONIC__)
+  android_set_abort_message(nullptr);
+#else
+  GTEST_SKIP() << "This test is only supported on bionic.";
+#endif
+}
diff --git a/tests/async_safe_test.cpp b/tests/async_safe_test.cpp
index 6c4758e71..f52387e97 100644
--- a/tests/async_safe_test.cpp
+++ b/tests/async_safe_test.cpp
@@ -64,6 +64,10 @@ TEST(async_safe_log, smoke) {
   async_safe_format_buffer(buf, sizeof(buf), "a%ldb", 70000L);
   EXPECT_STREQ("a70000b", buf);
 
+  errno = EINVAL;
+  async_safe_format_buffer(buf, sizeof(buf), "a%mZ");
+  EXPECT_STREQ("aInvalid argumentZ", buf);
+
   async_safe_format_buffer(buf, sizeof(buf), "a%pb", reinterpret_cast<void*>(0xb0001234));
   EXPECT_STREQ("a0xb0001234b", buf);
 
@@ -97,6 +101,30 @@ TEST(async_safe_log, smoke) {
   async_safe_format_buffer(buf, sizeof(buf), "a%03d:%d:%02dz", 5, 5, 5);
   EXPECT_STREQ("a005:5:05z", buf);
 
+  async_safe_format_buffer(buf, sizeof(buf), "a%#xZ", 34);
+  EXPECT_STREQ("a0x22Z", buf);
+
+  async_safe_format_buffer(buf, sizeof(buf), "a%#xZ", 0);
+  EXPECT_STREQ("a0Z", buf);
+
+  async_safe_format_buffer(buf, sizeof(buf), "a%#5xZ", 20);
+  EXPECT_STREQ("a 0x14Z", buf);
+
+  snprintf(buf, sizeof(buf), "a%#08.8xZ", 1);
+  EXPECT_STREQ("a0x00000001Z", buf);
+
+  async_safe_format_buffer(buf, sizeof(buf), "a%#oZ", 777);
+  EXPECT_STREQ("a01411Z", buf);
+
+  async_safe_format_buffer(buf, sizeof(buf), "a%#oZ", 0);
+  EXPECT_STREQ("a0Z", buf);
+
+  async_safe_format_buffer(buf, sizeof(buf), "a%#6oZ", 15);
+  EXPECT_STREQ("a   017Z", buf);
+
+  snprintf(buf, sizeof(buf), "a%#08.8oZ", 11);
+  EXPECT_STREQ("a00000013Z", buf);
+
   void* p = nullptr;
   async_safe_format_buffer(buf, sizeof(buf), "a%d,%pz", 5, p);
   EXPECT_STREQ("a5,0x0z", buf);
diff --git a/tests/dl_test.cpp b/tests/dl_test.cpp
index bf32bd549..a61586b04 100644
--- a/tests/dl_test.cpp
+++ b/tests/dl_test.cpp
@@ -34,6 +34,7 @@
 
 #include "gtest_globals.h"
 #include <android-base/file.h>
+#include <android-base/test_utils.h>
 #include "utils.h"
 
 extern "C" int main_global_default_serial() {
diff --git a/tests/dlfcn_test.cpp b/tests/dlfcn_test.cpp
index 0bf877507..940e7268c 100644
--- a/tests/dlfcn_test.cpp
+++ b/tests/dlfcn_test.cpp
@@ -258,6 +258,9 @@ TEST(dlfcn, dlopen_vdso) {
   dlclose(handle);
 }
 
+// HWASan uses an ifunc to describe the location of its shadow memory,
+// so even though it's an unusual case, Android needs to support
+// "ifunc variables".
 TEST(dlfcn, ifunc_variable) {
   typedef const char* (*fn_ptr)();
 
@@ -1651,6 +1654,21 @@ TEST(dlfcn, dlopen_invalid_textrels2) {
   ASSERT_SUBSTR(expected_dlerror.c_str(), dlerror());
 }
 
+TEST(dlfcn, dlopen_invalid_local_tls) {
+  const std::string libpath = GetPrebuiltElfDir() + "/libtest_invalid-local-tls.so";
+
+  void* handle = dlopen(libpath.c_str(), RTLD_NOW);
+  ASSERT_TRUE(handle == nullptr);
+#if defined(__arm__)
+  const char* referent = "local section";
+#else
+  const char* referent = "local symbol \"tls_var_2\"";
+#endif
+  std::string expected_dlerror = std::string("dlopen failed: unexpected TLS reference to ") +
+                                 referent + " in \"" + libpath + "\"";
+  ASSERT_SUBSTR(expected_dlerror.c_str(), dlerror());
+}
+
 TEST(dlfcn, dlopen_df_1_global) {
   void* handle = dlopen("libtest_dlopen_df_1_global.so", RTLD_NOW);
   ASSERT_TRUE(handle != nullptr) << dlerror();
diff --git a/tests/getcwd_test.cpp b/tests/getcwd_test.cpp
index 97b1d4f29..4fec40bae 100644
--- a/tests/getcwd_test.cpp
+++ b/tests/getcwd_test.cpp
@@ -20,6 +20,8 @@
 #include <limits.h>
 #include <unistd.h>
 
+#include <android-base/test_utils.h>
+
 #include "utils.h"
 
 TEST(getcwd, auto_full) {
diff --git a/tests/gwp_asan_test.cpp b/tests/gwp_asan_test.cpp
new file mode 100644
index 000000000..b2c7780b1
--- /dev/null
+++ b/tests/gwp_asan_test.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <gtest/gtest.h>
+#include <stdio.h>
+#include <string>
+
+#if defined(__BIONIC__)
+
+#include "gwp_asan/options.h"
+#include "platform/bionic/malloc.h"
+#include "utils.h"
+
+void RunGwpAsanTest(const char* test_name) {
+  ExecTestHelper eh;
+  eh.SetEnv({"GWP_ASAN_SAMPLE_RATE=1", "GWP_ASAN_PROCESS_SAMPLING=1", "GWP_ASAN_MAX_ALLOCS=40000",
+             nullptr});
+  std::string filter_arg = "--gtest_filter=";
+  filter_arg += test_name;
+  std::string exec(testing::internal::GetArgvs()[0]);
+  eh.SetArgs({exec.c_str(), "--gtest_also_run_disabled_tests", filter_arg.c_str(), nullptr});
+  eh.Run([&]() { execve(exec.c_str(), eh.GetArgs(), eh.GetEnv()); },
+         /* expected_exit_status */ 0,
+         // |expected_output_regex|, ensure at least one test ran:
+         R"(\[  PASSED  \] [1-9]+0? test)");
+}
+
+// This file implements "torture testing" under GWP-ASan, where we sample every
+// single allocation. The upper limit for the number of GWP-ASan allocations in
+// the torture mode is is generally 40,000, so that svelte devices don't
+// explode, as this uses ~163MiB RAM (4KiB per live allocation).
+TEST(gwp_asan_integration, malloc_tests_under_torture) {
+  RunGwpAsanTest("malloc.*:-malloc.mallinfo*");
+}
+
+#endif  // defined(__BIONIC__)
diff --git a/tests/headers/posix/stdio_h.c b/tests/headers/posix/stdio_h.c
index cbeb0bc13..57be0a0c2 100644
--- a/tests/headers/posix/stdio_h.c
+++ b/tests/headers/posix/stdio_h.c
@@ -110,7 +110,8 @@ static void stdio_h() {
   FUNCTION(getchar_unlocked, int (*f)(void));
   FUNCTION(getdelim, ssize_t (*f)(char**, size_t*, int, FILE*));
   FUNCTION(getline, ssize_t (*f)(char**, size_t*, FILE*));
-  FUNCTION(gets, char* (*f)(char*));
+  // gets() was removed in C11.
+  // FUNCTION(gets, char* (*f)(char*));
   FUNCTION(open_memstream, FILE* (*f)(char**, size_t*));
   FUNCTION(pclose, int (*f)(FILE*));
   FUNCTION(perror, void (*f)(const char*));
diff --git a/tests/heap_tagging_level_test.cpp b/tests/heap_tagging_level_test.cpp
index cfb2490f1..96c2ffd0b 100644
--- a/tests/heap_tagging_level_test.cpp
+++ b/tests/heap_tagging_level_test.cpp
@@ -26,6 +26,7 @@
 
 #include "SignalUtils.h"
 
+#include <android-base/test_utils.h>
 #include <bionic/malloc_tagged_pointers.h>
 
 static bool KernelSupportsTaggedPointers() {
@@ -81,10 +82,20 @@ TEST(heap_tagging_level, tagged_pointer_dies) {
 #endif // defined(__BIONIC__)
 }
 
+namespace {
 #if defined(__BIONIC__) && defined(__aarch64__)
 void ExitWithSiCode(int, siginfo_t* info, void*) {
   _exit(info->si_code);
 }
+
+template <typename Pred>
+class Or {
+  Pred A, B;
+
+ public:
+  Or(Pred A, Pred B) : A(A), B(B) {}
+  bool operator()(int exit_status) { return A(exit_status) || B(exit_status); }
+};
 #endif
 
 TEST(heap_tagging_level, sync_async_bad_accesses_die) {
@@ -94,6 +105,7 @@ TEST(heap_tagging_level, sync_async_bad_accesses_die) {
   }
 
   std::unique_ptr<int[]> p = std::make_unique<int[]>(4);
+  volatile int sink ATTRIBUTE_UNUSED;
 
   // We assume that scudo is used on all MTE enabled hardware; scudo inserts a header with a
   // mismatching tag before each allocation.
@@ -104,6 +116,12 @@ TEST(heap_tagging_level, sync_async_bad_accesses_die) {
         p[-1] = 42;
       },
       testing::ExitedWithCode(SEGV_MTESERR), "");
+  EXPECT_EXIT(
+      {
+        ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
+        sink = p[-1];
+      },
+      testing::ExitedWithCode(SEGV_MTESERR), "");
 
   EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_ASYNC));
   EXPECT_EXIT(
@@ -111,14 +129,21 @@ TEST(heap_tagging_level, sync_async_bad_accesses_die) {
         ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
         p[-1] = 42;
       },
-      testing::ExitedWithCode(SEGV_MTEAERR), "");
+      Or(testing::ExitedWithCode(SEGV_MTESERR), testing::ExitedWithCode(SEGV_MTEAERR)), "");
+  EXPECT_EXIT(
+      {
+        ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
+        sink = p[-1];
+      },
+      Or(testing::ExitedWithCode(SEGV_MTESERR), testing::ExitedWithCode(SEGV_MTEAERR)), "");
 
   EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_NONE));
-  volatile int oob ATTRIBUTE_UNUSED = p[-1];
+  sink = p[-1];
 #else
   GTEST_SKIP() << "bionic/arm64 only";
 #endif
 }
+}  // namespace
 
 TEST(heap_tagging_level, none_pointers_untagged) {
 #if defined(__BIONIC__)
@@ -205,7 +230,9 @@ TEST_P(MemtagNoteTest, SEGV) {
   const char* kNoteSuffix[] = {"disabled", "async", "sync"};
   const char* kExpectedOutputHWASAN[] = {".*tag-mismatch.*", ".*tag-mismatch.*",
                                          ".*tag-mismatch.*"};
-  const char* kExpectedOutputMTE[] = {"normal exit\n", "SEGV_MTEAERR\n", "SEGV_MTESERR\n"};
+  // Note that we do not check the exact si_code of the "async" variant, as it may be auto-upgraded
+  // to asymm or even sync.
+  const char* kExpectedOutputMTE[] = {"normal exit\n", "SEGV_MTE[AS]ERR\n", "SEGV_MTESERR\n"};
   const char* kExpectedOutputNonMTE[] = {"normal exit\n", "normal exit\n", "normal exit\n"};
   const char** kExpectedOutput =
       withHWASAN ? kExpectedOutputHWASAN : (withMTE ? kExpectedOutputMTE : kExpectedOutputNonMTE);
@@ -215,7 +242,6 @@ TEST_P(MemtagNoteTest, SEGV) {
   bool isStatic = std::get<1>(GetParam());
   std::string helper_base = std::string("heap_tagging_") + (isStatic ? "static_" : "") +
                             kNoteSuffix[static_cast<int>(note)] + "_helper";
-  fprintf(stderr, "=== %s\n", helper_base.c_str());
   std::string helper = GetTestlibRoot() + "/" + helper_base;
   chmod(helper.c_str(), 0755);
   ExecTestHelper eth;
diff --git a/tests/libs/dlopen_testlib_ifunc_variable_impl.cpp b/tests/libs/dlopen_testlib_ifunc_variable_impl.cpp
index 4b13ebab3..624ae7499 100644
--- a/tests/libs/dlopen_testlib_ifunc_variable_impl.cpp
+++ b/tests/libs/dlopen_testlib_ifunc_variable_impl.cpp
@@ -43,11 +43,13 @@ extern "C" const char* var_false = "false";
 extern "C" const char* v1 = "unset";
 extern "C" const char* v2 = "set";
 
-extern "C" void* is_ctor_called_ifun() {
-  return g_flag == 0 ? &var_false : &var_true;
+typedef const char* (*fn_ptr)();
+
+extern "C" fn_ptr is_ctor_called_ifun() {
+  return (fn_ptr)(g_flag == 0 ? &var_false : &var_true);
 }
 
-extern "C" void* foo_ifunc() {
-   char* choice = getenv("IFUNC_CHOICE");
-   return choice == nullptr ? &v1 : &v2;
+extern "C" fn_ptr foo_ifunc() {
+  char* choice = getenv("IFUNC_CHOICE");
+  return (fn_ptr)(choice == nullptr ? &v1 : &v2);
 }
diff --git a/tests/libs/heap_tagging_helper.cpp b/tests/libs/heap_tagging_helper.cpp
index 1a970f258..16a8c8b0d 100644
--- a/tests/libs/heap_tagging_helper.cpp
+++ b/tests/libs/heap_tagging_helper.cpp
@@ -16,7 +16,9 @@
 
 #include <signal.h>
 #include <stdio.h>
+#include <sys/auxv.h>
 #include <sys/cdefs.h>
+#include <sys/mman.h>
 #include <unistd.h>
 #include <memory>
 
@@ -37,6 +39,11 @@ void action(int signo, siginfo_t* info __unused, void*) {
   _exit(0);
 }
 
+void action2(int signo, siginfo_t* info __unused, void*) {
+  fprintf(stderr, "unexpected signal %d\n", signo);
+  _exit(0);
+}
+
 __attribute__((optnone)) int main() {
   struct sigaction sa = {};
   sa.sa_sigaction = action;
@@ -47,6 +54,37 @@ __attribute__((optnone)) int main() {
   volatile int oob = p[-1];
   (void)oob;
 
+#if defined(__BIONIC__) && defined(__aarch64__)
+  // If we get here, bad access on system heap memory did not trigger a fault.
+  // This suggests that MTE is disabled. Make sure that explicitly tagged PROT_MTE memory does not
+  // trigger a fault either.
+  if (getauxval(AT_HWCAP2) & HWCAP2_MTE) {
+    sa.sa_sigaction = action2;
+    sigaction(SIGSEGV, &sa, nullptr);
+
+    size_t page_size = static_cast<size_t>(sysconf(_SC_PAGESIZE));
+    void* p = mmap(nullptr, page_size, PROT_READ | PROT_WRITE | PROT_MTE,
+                   MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
+    if (!p) {
+      fprintf(stderr, "mmap failed\n");
+      return 1;
+    }
+
+    void* q = p;
+    __asm__ __volatile__(
+        ".arch_extension memtag\n"
+        "irg %[Ptr], %[Ptr], xzr\n"
+        "stg %[Ptr], [%[Ptr]]\n"
+        "addg %[Ptr], %[Ptr], 0, 1\n"
+        "str xzr, [%[Ptr]]\n"
+        : [Ptr] "+&r"(q)
+        :
+        : "memory");
+
+    munmap(p, page_size);
+  }
+#endif  // __aarch64__
+
   fprintf(stderr, "normal exit\n");
   return 0;
 }
diff --git a/tests/malloc_iterate_test.cpp b/tests/malloc_iterate_test.cpp
index e896c90f4..297f637c6 100644
--- a/tests/malloc_iterate_test.cpp
+++ b/tests/malloc_iterate_test.cpp
@@ -26,6 +26,7 @@
 
 #include <vector>
 
+#include <android-base/test_utils.h>
 #include <async_safe/log.h>
 #include <procinfo/process_map.h>
 
diff --git a/tests/malloc_test.cpp b/tests/malloc_test.cpp
index f157ec497..69f8506fd 100644
--- a/tests/malloc_test.cpp
+++ b/tests/malloc_test.cpp
@@ -41,6 +41,7 @@
 #include <tinyxml2.h>
 
 #include <android-base/file.h>
+#include <android-base/test_utils.h>
 
 #include "utils.h"
 
@@ -1010,18 +1011,6 @@ TEST(malloc, align_check) {
   AlignCheck();
 }
 
-// Force GWP-ASan on and verify all alignment checks still pass.
-TEST(malloc, align_check_gwp_asan) {
-#if defined(__BIONIC__)
-  bool force_init = true;
-  ASSERT_TRUE(android_mallopt(M_INITIALIZE_GWP_ASAN, &force_init, sizeof(force_init)));
-
-  AlignCheck();
-#else
-  GTEST_SKIP() << "bionic-only test";
-#endif
-}
-
 // Jemalloc doesn't pass this test right now, so leave it as disabled.
 TEST(malloc, DISABLED_alloc_after_fork) {
   // Both of these need to be a power of 2.
@@ -1371,17 +1360,24 @@ TEST(android_mallopt, set_allocation_limit_multiple_threads) {
 #endif
 }
 
-TEST(android_mallopt, force_init_gwp_asan) {
 #if defined(__BIONIC__)
-  bool force_init = true;
-  ASSERT_TRUE(android_mallopt(M_INITIALIZE_GWP_ASAN, &force_init, sizeof(force_init)));
-
-  // Verify that trying to do the call again also passes no matter the
-  // value of force_init.
-  force_init = false;
-  ASSERT_TRUE(android_mallopt(M_INITIALIZE_GWP_ASAN, &force_init, sizeof(force_init)));
-  force_init = true;
-  ASSERT_TRUE(android_mallopt(M_INITIALIZE_GWP_ASAN, &force_init, sizeof(force_init)));
+using Action = android_mallopt_gwp_asan_options_t::Action;
+TEST(android_mallopt, DISABLED_multiple_enable_gwp_asan) {
+  android_mallopt_gwp_asan_options_t options;
+  options.program_name = "";  // Don't infer GWP-ASan options from sysprops.
+  options.desire = Action::DONT_TURN_ON_UNLESS_OVERRIDDEN;
+  // GWP-ASan should already be enabled. Trying to enable or disable it should
+  // always pass.
+  ASSERT_TRUE(android_mallopt(M_INITIALIZE_GWP_ASAN, &options, sizeof(options)));
+  options.desire = Action::TURN_ON_WITH_SAMPLING;
+  ASSERT_TRUE(android_mallopt(M_INITIALIZE_GWP_ASAN, &options, sizeof(options)));
+}
+#endif  // defined(__BIONIC__)
+
+TEST(android_mallopt, multiple_enable_gwp_asan) {
+#if defined(__BIONIC__)
+  // Always enable GWP-Asan, with default options.
+  RunGwpAsanTest("*.DISABLED_multiple_enable_gwp_asan");
 #else
   GTEST_SKIP() << "bionic extension";
 #endif
diff --git a/tests/prebuilt-elf-files/arm/libtest_invalid-local-tls.so b/tests/prebuilt-elf-files/arm/libtest_invalid-local-tls.so
new file mode 100755
index 000000000..a42848de2
--- /dev/null
+++ b/tests/prebuilt-elf-files/arm/libtest_invalid-local-tls.so
diff --git a/tests/prebuilt-elf-files/arm64/libtest_invalid-local-tls.so b/tests/prebuilt-elf-files/arm64/libtest_invalid-local-tls.so
new file mode 100755
index 000000000..20c576525
--- /dev/null
+++ b/tests/prebuilt-elf-files/arm64/libtest_invalid-local-tls.so
diff --git a/tests/prebuilt-elf-files/gen-libtest_invalid-local-tls.sh b/tests/prebuilt-elf-files/gen-libtest_invalid-local-tls.sh
new file mode 100755
index 000000000..0f3e73628
--- /dev/null
+++ b/tests/prebuilt-elf-files/gen-libtest_invalid-local-tls.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# Bionic doesn't support the references to STB_LOCAL symbols of type STT_TLS
+# and STT_SECTION that ld.gold generates. Set NDK21E to the path to a copy of
+# NDK r21e, which still has ld.gold (unlike the platform build or newer NDKs).
+
+set -e
+
+cat >test.c <<EOF
+  static __thread int tls_var_1;
+  extern __thread int tls_var_2;
+  int* getaddr1() { return &tls_var_1; }
+  int* getaddr2() { return &tls_var_2; }
+EOF
+cat >test2.c <<EOF
+  __attribute__((visibility("hidden"))) __thread int tls_var_2;
+EOF
+
+build() {
+  arch=$1
+  target=$2
+  $NDK21E/toolchains/llvm/prebuilt/linux-x86_64/bin/clang -O2 --target=$target \
+      -fpic -shared -o $arch/libtest_invalid-local-tls.so -fno-emulated-tls \
+      -fuse-ld=gold test.c test2.c
+}
+
+build arm armv7a-linux-androideabi29
+build arm64 aarch64-linux-android29
+build x86 i686-linux-android29
+build x86_64 x86_64-linux-android29
diff --git a/tests/prebuilt-elf-files/x86/libtest_invalid-local-tls.so b/tests/prebuilt-elf-files/x86/libtest_invalid-local-tls.so
new file mode 100755
index 000000000..879f6a1d4
--- /dev/null
+++ b/tests/prebuilt-elf-files/x86/libtest_invalid-local-tls.so
diff --git a/tests/prebuilt-elf-files/x86_64/libtest_invalid-local-tls.so b/tests/prebuilt-elf-files/x86_64/libtest_invalid-local-tls.so
new file mode 100755
index 000000000..5b689ba17
--- /dev/null
+++ b/tests/prebuilt-elf-files/x86_64/libtest_invalid-local-tls.so
diff --git a/tests/setjmp_test.cpp b/tests/setjmp_test.cpp
index ee126eb11..472aa205b 100644
--- a/tests/setjmp_test.cpp
+++ b/tests/setjmp_test.cpp
@@ -22,6 +22,7 @@
 #include <unistd.h>
 
 #include <android-base/silent_death_test.h>
+#include <android-base/test_utils.h>
 
 #include "SignalUtils.h"
 
@@ -273,6 +274,7 @@ TEST(setjmp, setjmp_stack) {
 }
 
 TEST(setjmp, bug_152210274) {
+  SKIP_WITH_HWASAN; // b/227390656
   // Ensure that we never have a mangled value in the stack pointer.
 #if defined(__BIONIC__)
   struct sigaction sa = {.sa_flags = SA_SIGINFO, .sa_sigaction = [](int, siginfo_t*, void*) {}};
diff --git a/tests/spawn_test.cpp b/tests/spawn_test.cpp
index f3c5b9aff..a9563b8aa 100644
--- a/tests/spawn_test.cpp
+++ b/tests/spawn_test.cpp
@@ -508,3 +508,42 @@ TEST(spawn, signal_stress) {
 
   AssertChildExited(pid, 99);
 }
+
+TEST(spawn, posix_spawn_dup2_CLOEXEC) {
+  int fds[2];
+  ASSERT_NE(-1, pipe(fds));
+
+  posix_spawn_file_actions_t fa;
+  ASSERT_EQ(0, posix_spawn_file_actions_init(&fa));
+
+  int fd = open("/proc/version", O_RDONLY | O_CLOEXEC);
+  ASSERT_NE(-1, fd);
+
+  ASSERT_EQ(0, posix_spawn_file_actions_addclose(&fa, fds[0]));
+  ASSERT_EQ(0, posix_spawn_file_actions_adddup2(&fa, fds[1], 1));
+  // dup2() is a no-op when the two fds are the same, so this won't clear
+  // O_CLOEXEC unless we're doing extra work to make that happen.
+  ASSERT_EQ(0, posix_spawn_file_actions_adddup2(&fa, fd, fd));
+
+  // Read /proc/self/fd/<fd> in the child...
+  std::string fdinfo_path = android::base::StringPrintf("/proc/self/fd/%d", fd);
+  ExecTestHelper eth;
+  eth.SetArgs({"cat", fdinfo_path.c_str(), nullptr});
+  pid_t pid;
+  ASSERT_EQ(0, posix_spawnp(&pid, eth.GetArg0(), &fa, nullptr, eth.GetArgs(), eth.GetEnv()));
+  ASSERT_EQ(0, posix_spawn_file_actions_destroy(&fa));
+  ASSERT_EQ(0, close(fds[1]));
+  std::string content;
+  ASSERT_TRUE(android::base::ReadFdToString(fds[0], &content));
+  ASSERT_EQ(0, close(fds[0]));
+
+  // ...and compare that to the parent. This is overkill really, since the very
+  // fact that the child had a valid file descriptor strongly implies that we
+  // removed O_CLOEXEC, but we may as well check that the child ended up with
+  // the *right* file descriptor :-)
+  std::string expected;
+  ASSERT_TRUE(android::base::ReadFdToString(fd, &expected));
+  ASSERT_EQ(expected, content);
+
+  AssertChildExited(pid, 0);
+}
diff --git a/tests/stdio_test.cpp b/tests/stdio_test.cpp
index e38dd6077..87031f6fc 100644
--- a/tests/stdio_test.cpp
+++ b/tests/stdio_test.cpp
@@ -364,10 +364,13 @@ TEST(STDIO_TEST, snprintf_S) { // Synonym for %ls.
 
 TEST_F(STDIO_DEATHTEST, snprintf_n) {
 #if defined(__BIONIC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat"
   // http://b/14492135 and http://b/31832608.
   char buf[32];
   int i = 1234;
   EXPECT_DEATH(snprintf(buf, sizeof(buf), "a %n b", &i), "%n not allowed on Android");
+#pragma GCC diagnostic pop
 #else
   GTEST_SKIP() << "glibc does allow %n";
 #endif
diff --git a/tests/stdlib_test.cpp b/tests/stdlib_test.cpp
index 6dbd74167..465e61a7f 100644
--- a/tests/stdlib_test.cpp
+++ b/tests/stdlib_test.cpp
@@ -33,6 +33,7 @@
 #include <android-base/file.h>
 #include <android-base/macros.h>
 #include <android-base/silent_death_test.h>
+#include <android-base/test_utils.h>
 #include <gtest/gtest.h>
 
 #include "math_data_test.h"
diff --git a/tests/unistd_test.cpp b/tests/unistd_test.cpp
index c306a0873..6d7e6878f 100644
--- a/tests/unistd_test.cpp
+++ b/tests/unistd_test.cpp
@@ -1529,11 +1529,21 @@ TEST(UNISTD_TEST, execvp_libcore_test_55017) {
 }
 
 TEST(UNISTD_TEST, exec_argv0_null) {
-  // http://b/33276926
+  // http://b/33276926 and http://b/227498625.
+  //
+  // With old kernels, bionic will see the null pointer and use "<unknown>" but
+  // with new (5.18+) kernels, the kernel will already have substituted the
+  // empty string, so we don't make any assertion here about what (if anything)
+  // comes before the first ':'.
+  //
+  // If this ever causes trouble, we could change bionic to replace _either_ the
+  // null pointer or the empty string. We could also use the actual name from
+  // readlink() on /proc/self/exe if we ever had reason to disallow programs
+  // from trying to hide like this.
   char* args[] = {nullptr};
   char* envs[] = {nullptr};
   ASSERT_EXIT(execve("/system/bin/run-as", args, envs), testing::ExitedWithCode(1),
-              "<unknown>: usage: run-as");
+              ": usage: run-as");
 }
 
 TEST(UNISTD_TEST, fexecve_failure) {
diff --git a/tests/utils.h b/tests/utils.h
index 284140a0d..72214c2b9 100644
--- a/tests/utils.h
+++ b/tests/utils.h
@@ -69,14 +69,6 @@ static inline bool have_dl() {
   return (dlopen("libc.so", 0) != nullptr);
 }
 
-extern "C" void __hwasan_init() __attribute__((weak));
-
-static inline bool running_with_hwasan() {
-  return &__hwasan_init != 0;
-}
-
-#define SKIP_WITH_HWASAN if (running_with_hwasan()) GTEST_SKIP()
-
 static inline bool running_with_native_bridge() {
 #if defined(__BIONIC__)
   static const prop_info* pi = __system_property_find("ro.dalvik.vm.isa." ABI_STRING);
@@ -270,6 +262,8 @@ class ExecTestHelper {
   std::vector<const char*> env_;
   std::string output_;
 };
+
+void RunGwpAsanTest(const char* test_name);
 #endif
 
 class FdLeakChecker {