diff --git a/android-changes-for-ndk-developers.md b/android-changes-for-ndk-developers.md
index da07c79..13c8911 100644
--- a/android-changes-for-ndk-developers.md
+++ b/android-changes-for-ndk-developers.md
@@ -6,6 +6,11 @@
 See also [bionic status](docs/status.md) for general libc/libm/libdl
 behavior changes.
 
+See also the
+[unwinder documentation](https://android.googlesource.com/platform/system/unwinding/+/refs/heads/master/libunwindstack/AndroidVersions.md)
+for details about changes in stack unwinding (crash dumps) between
+different releases.
+
 Required tools: the NDK has an _arch_-linux-android-readelf binary
 (e.g. arm-linux-androideabi-readelf or i686-linux-android-readelf)
 for each architecture (under toolchains/), but you can use readelf for
diff --git a/apex/Android.bp b/apex/Android.bp
index c6c4cbf..5bf078a 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -80,9 +80,8 @@
     },
 }
 
-prebuilt_etc {
+linker_config {
     name: "bionic-linker-config",
-    src: "linker.config.txt",
-    filename: "linker.config.txt",
+    src: "linker.config.json",
     installable: false,
 }
diff --git a/apex/linker.config.json b/apex/linker.config.json
new file mode 100644
index 0000000..67c076e
--- /dev/null
+++ b/apex/linker.config.json
@@ -0,0 +1,3 @@
+{
+    "visible": true
+}
diff --git a/apex/linker.config.txt b/apex/linker.config.txt
deleted file mode 100644
index 7bac3d6..0000000
--- a/apex/linker.config.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-# Extra linker configurations for bionic APEX
-# See https://android.googlesource.com/platform/system/linkerconfig/+/master/README.md#apex_etc_linker_config_txt
-
-[properties]
-# Set bionic APEX as force visible so bionic APEX namespace is accessible via android_get_exported_namespace
-visible = true
diff --git a/benchmarks/README.md b/benchmarks/README.md
index fe447d1..1fd17a1 100644
--- a/benchmarks/README.md
+++ b/benchmarks/README.md
@@ -184,5 +184,5 @@
 Some devices have a `perf-setup.sh` script that locks CPU and GPU frequencies. Some TradeFed
 benchmarks appear to be using the script. For more information:
  * run `get_build_var BOARD_PERFSETUP_SCRIPT`
- * run `m perf-setup.sh` to install the script into `${OUT}/data/local/tmp/perf-setup.sh`
+ * run `m perf-setup` to install the script into `${OUT}/data/local/tmp/perf-setup.sh`
  * see: https://android.googlesource.com/platform/platform_testing/+/refs/heads/master/scripts/perf-setup/
diff --git a/benchmarks/get_heap_size_benchmark.cpp b/benchmarks/get_heap_size_benchmark.cpp
index c3680dc..47d5b18 100644
--- a/benchmarks/get_heap_size_benchmark.cpp
+++ b/benchmarks/get_heap_size_benchmark.cpp
@@ -30,8 +30,6 @@
 #include <benchmark/benchmark.h>
 #include "util.h"
 
-static volatile size_t sink;
-
 static constexpr int NTHREADS = 5;
 
 static std::atomic<int> thread_count;
@@ -57,7 +55,7 @@
     sched_yield();
   }
   for (auto _ : state) {
-    sink = mallinfo().uordblks;
+    benchmark::DoNotOptimize(mallinfo().uordblks);
   }
   for (int i = 0; i < 5; i++) {
     int res = pthread_join(t[i], NULL);
diff --git a/benchmarks/spawn/Android.bp b/benchmarks/spawn/Android.bp
index 2276d2e..689e7c9 100644
--- a/benchmarks/spawn/Android.bp
+++ b/benchmarks/spawn/Android.bp
@@ -68,6 +68,7 @@
 
     // Install these binaries in the same directory as the main benchmark binary.
     data: [
+        ":bench_cxa_atexit",
         ":bench_noop",
         ":bench_noop_nostl",
         ":bench_noop_static",
@@ -75,7 +76,7 @@
 }
 
 cc_defaults {
-    name: "noop_binary_defaults",
+    name: "bionic_spawn_benchmark_binary",
     defaults: ["bionic_spawn_benchmark_targets"],
 
     compile_multilib: "both",
@@ -87,16 +88,11 @@
             suffix: "64",
         },
     },
-}
-
-cc_binary {
-    defaults: ["noop_binary_defaults"],
-    name: "bench_noop",
-    srcs: ["noop.cpp"],
 
     // When this binary is installed to host/linux-x86/bin, its runpath is ${ORIGIN}/../lib64, which
     // is fine for finding host/linux-x86/lib64/libc++.so. When it's installed to
-    // host/linux-x86/benchmarktest64/bionic-spawn-benchmarks, the runpath needs an extra "..".
+    // host/linux-x86/benchmarktest64/bionic-spawn-benchmarks, the runpath needs an extra "..". This
+    // argument has no effect when a static executable is produced.
     target: {
         linux_glibc_x86_64: {
             ldflags: [
@@ -107,14 +103,26 @@
 }
 
 cc_binary {
-    defaults: ["noop_binary_defaults"],
+    defaults: ["bionic_spawn_benchmark_binary"],
+    name: "bench_cxa_atexit",
+    srcs: ["bench_cxa_atexit.cpp"],
+}
+
+cc_binary {
+    defaults: ["bionic_spawn_benchmark_binary"],
+    name: "bench_noop",
+    srcs: ["noop.cpp"],
+}
+
+cc_binary {
+    defaults: ["bionic_spawn_benchmark_binary"],
     name: "bench_noop_nostl",
     srcs: ["noop.cpp"],
     stl: "none",
 }
 
 cc_binary {
-    defaults: ["noop_binary_defaults"],
+    defaults: ["bionic_spawn_benchmark_binary"],
     name: "bench_noop_static",
     srcs: ["noop.cpp"],
     static_executable: true,
diff --git a/benchmarks/spawn/bench_cxa_atexit.cpp b/benchmarks/spawn/bench_cxa_atexit.cpp
new file mode 100644
index 0000000..95849f4
--- /dev/null
+++ b/benchmarks/spawn/bench_cxa_atexit.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <string>
+
+extern "C" int __cxa_atexit(void (*func)(void*), void* arg, void* dso);
+
+extern void* __dso_handle;
+
+static void dtor_func(void*) {}
+
+// Prevent the compiler from optimizing out the __cxa_atexit call.
+void (*volatile g_pdtor_func)(void*) = dtor_func;
+
+int main(int argc, char* argv[]) {
+  auto usage = [&argv]() {
+    fprintf(stderr, "usage: %s COUNT MODE\n", argv[0]);
+    fprintf(stderr, "MODE is one of '_Exit' or 'exit'.\n");
+    exit(1);
+  };
+
+  if (argc != 3) usage();
+
+  int count = atoi(argv[1]);
+
+  // Two modes: "_Exit" ==> exit early w/o calling dtors, "exit" ==> call dtors on exit.
+  std::string mode = argv[2];
+  if (mode != "_Exit" && mode != "exit") usage();
+
+  for (int i = 0; i < count; ++i) {
+    __cxa_atexit(g_pdtor_func, nullptr, &__dso_handle);
+  }
+
+  if (mode == "_Exit") {
+    _Exit(0);
+  } else {
+    exit(0);
+  }
+}
diff --git a/benchmarks/spawn/spawn_benchmarks.cpp b/benchmarks/spawn/spawn_benchmarks.cpp
index 931a8be..18dacf9 100644
--- a/benchmarks/spawn/spawn_benchmarks.cpp
+++ b/benchmarks/spawn/spawn_benchmarks.cpp
@@ -31,6 +31,8 @@
 SPAWN_BENCHMARK(noop, test_program("bench_noop").c_str());
 SPAWN_BENCHMARK(noop_nostl, test_program("bench_noop_nostl").c_str());
 SPAWN_BENCHMARK(noop_static, test_program("bench_noop_static").c_str());
+SPAWN_BENCHMARK(bench_cxa_atexit, test_program("bench_cxa_atexit").c_str(), "100000", "_Exit");
+SPAWN_BENCHMARK(bench_cxa_atexit_full, test_program("bench_cxa_atexit").c_str(), "100000", "exit");
 
 // Android has a /bin -> /system/bin symlink, but use /system/bin explicitly so we can more easily
 // compare Bionic-vs-glibc on a Linux desktop machine.
diff --git a/benchmarks/stdio_benchmark.cpp b/benchmarks/stdio_benchmark.cpp
index 037bbd9..03f3f29 100644
--- a/benchmarks/stdio_benchmark.cpp
+++ b/benchmarks/stdio_benchmark.cpp
@@ -155,9 +155,8 @@
   while (state.KeepRunning()) {
     FILE* fp = fopen("/dev/zero", "re");
     if (no_locking) __fsetlocking(fp, FSETLOCKING_BYCALLER);
-    volatile int c __attribute__((unused));
     for (size_t i = 0; i < nbytes; ++i) {
-      c = fgetc(fp);
+      benchmark::DoNotOptimize(fgetc(fp));
     }
     fclose(fp);
   }
diff --git a/benchmarks/stdlib_benchmark.cpp b/benchmarks/stdlib_benchmark.cpp
index 45b953f..b6ea58d 100644
--- a/benchmarks/stdlib_benchmark.cpp
+++ b/benchmarks/stdlib_benchmark.cpp
@@ -189,9 +189,8 @@
         buf[l++] = i, buf[l++] = j, buf[l++] = 0x80, buf[l++] = k;
   buf[l++] = 0;
 
-  volatile size_t c __attribute__((unused)) = 0;
   for (auto _ : state) {
-    c = mbstowcs(widebuf_aligned, buf_aligned, 500000);
+    benchmark::DoNotOptimize(mbstowcs(widebuf_aligned, buf_aligned, 500000));
   }
 
   state.SetBytesProcessed(uint64_t(state.iterations()) * uint64_t(500000));
diff --git a/benchmarks/string_benchmark.cpp b/benchmarks/string_benchmark.cpp
index d176675..9be54c7 100644
--- a/benchmarks/string_benchmark.cpp
+++ b/benchmarks/string_benchmark.cpp
@@ -31,9 +31,8 @@
   char* src_aligned = GetAlignedPtrFilled(&src, src_alignment, nbytes, 'x');
   char* dst_aligned = GetAlignedPtrFilled(&dst, dst_alignment, nbytes, 'x');
 
-  volatile int c __attribute__((unused)) = 0;
   while (state.KeepRunning()) {
-    c += memcmp(dst_aligned, src_aligned, nbytes);
+    benchmark::DoNotOptimize(memcmp(dst_aligned, src_aligned, nbytes));
   }
 
   state.SetBytesProcessed(uint64_t(state.iterations()) * uint64_t(nbytes));
@@ -129,9 +128,8 @@
   char* buf_aligned = GetAlignedPtrFilled(&buf, alignment, nbytes + 1, 'x');
   buf_aligned[nbytes - 1] = '\0';
 
-  volatile int c __attribute__((unused)) = 0;
   while (state.KeepRunning()) {
-    c += strlen(buf_aligned);
+    benchmark::DoNotOptimize(strlen(buf_aligned));
   }
 
   state.SetBytesProcessed(uint64_t(state.iterations()) * uint64_t(nbytes));
@@ -239,9 +237,8 @@
   s1_aligned[nbytes - 1] = '\0';
   s2_aligned[nbytes - 1] = '\0';
 
-  volatile int c __attribute__((unused));
   while (state.KeepRunning()) {
-    c = strcmp(s1_aligned, s2_aligned);
+    benchmark::DoNotOptimize(strcmp(s1_aligned, s2_aligned));
   }
 
   state.SetBytesProcessed(uint64_t(state.iterations()) * uint64_t(nbytes));
@@ -258,9 +255,8 @@
   char* s1_aligned = GetAlignedPtrFilled(&s1, s1_alignment, nbytes, 'x');
   char* s2_aligned = GetAlignedPtrFilled(&s2, s2_alignment, nbytes, 'x');
 
-  volatile int c __attribute__((unused));
   for (auto _ : state) {
-    c = strncmp(s1_aligned, s2_aligned, nbytes);
+    benchmark::DoNotOptimize(strncmp(s1_aligned, s2_aligned, nbytes));
   }
 
   state.SetBytesProcessed(uint64_t(state.iterations()) * uint64_t(nbytes));
diff --git a/libc/Android.bp b/libc/Android.bp
index c94be62..4d63751 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -62,6 +62,7 @@
     cppflags: [],
     include_dirs: [
         "bionic/libc/async_safe/include",
+        "bionic/libc/platform",
         // For android_filesystem_config.h.
         "system/core/libcutils/include",
     ],
@@ -83,6 +84,7 @@
         fuzzer: false,
     },
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
 
@@ -1077,6 +1079,7 @@
         "bionic/mblen.cpp",
         "bionic/mbrtoc16.cpp",
         "bionic/mbrtoc32.cpp",
+        "bionic/memory_mitigation_state.cpp",
         "bionic/mempcpy.cpp",
         "bionic/mkdir.cpp",
         "bionic/mkfifo.cpp",
@@ -1348,6 +1351,7 @@
         "libc_native_allocator_defaults",
     ],
     ramdisk_available: false,
+    vendor_ramdisk_available: false,
     srcs: libc_common_src_files + [
         "bionic/gwp_asan_wrappers.cpp",
         "bionic/heap_tagging.cpp",
@@ -1602,6 +1606,7 @@
     ],
     name: "libc",
     static_ndk_lib: true,
+    llndk_stubs: "libc.llndk",
     product_variables: {
         platform_sdk_version: {
             asflags: ["-DPLATFORM_SDK_VERSION=%d"],
@@ -1789,12 +1794,15 @@
         "//external/perfetto:__subpackages__",
         "//external/scudo:__subpackages__",
         "//system/core/debuggerd:__subpackages__",
-        "//system/core/libunwindstack:__subpackages__",
+        "//system/core/libcutils:__subpackages__",
         "//system/memory/libmemunreachable:__subpackages__",
+        "//system/unwinding/libunwindstack:__subpackages__",
         "//tools/security/sanitizer-status:__subpackages__",
     ],
     vendor_available: true,
+    product_available: true,
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
     export_include_dirs: [
@@ -1804,11 +1812,10 @@
     stl: "none",
     sdk_version: "current",
 
+    min_sdk_version: "29",
     apex_available: [
         "//apex_available:platform",
-        "com.android.runtime",
-        "com.android.art.release", // from libdexfile_external
-        "com.android.art.debug", // from libdexfile_external
+        "//apex_available:anyapex",
     ],
 }
 
@@ -1822,7 +1829,9 @@
 
     host_supported: true,
     vendor_available: true,
+    product_available: true,
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
     apex_available: [
@@ -1872,7 +1881,9 @@
     host_supported: true,
     native_bridge_supported: true,
     vendor_available: true,
+    product_available: true,
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     sdk_version: "1",
 
@@ -2000,7 +2011,9 @@
     name: "crt_defaults",
     defaults: ["linux_bionic_supported"],
     vendor_available: true,
+    product_available: true,
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
     apex_available: [
@@ -2214,7 +2227,7 @@
 }
 
 llndk_library {
-    name: "libc",
+    name: "libc.llndk",
     symbol_file: "libc.map.txt",
     export_headers_as_system: true,
     export_preprocessed_headers: ["include"],
diff --git a/libc/arch-common/bionic/crtbegin.c b/libc/arch-common/bionic/crtbegin.c
index 1f8dfd2..29b02dc 100644
--- a/libc/arch-common/bionic/crtbegin.c
+++ b/libc/arch-common/bionic/crtbegin.c
@@ -31,9 +31,9 @@
 #include <stdint.h>
 
 #define SECTION(name) __attribute__((__section__(name)))
-SECTION(".preinit_array") void (*__PREINIT_ARRAY__)(void) = (void (*)(void)) -1;
-SECTION(".init_array") void (*__INIT_ARRAY__)(void) = (void (*)(void)) -1;
-SECTION(".fini_array") void (*__FINI_ARRAY__)(void) = (void (*)(void)) -1;
+SECTION(".preinit_array") init_func_t* __PREINIT_ARRAY__ = (init_func_t*)-1;
+SECTION(".init_array.0") init_func_t* __INIT_ARRAY__ = (init_func_t*)-1;
+SECTION(".fini_array.0") fini_func_t* __FINI_ARRAY__ = (fini_func_t*)-1;
 #undef SECTION
 
 __used static void _start_main(void* raw_args) {
diff --git a/libc/async_safe/Android.bp b/libc/async_safe/Android.bp
index 98da2cc..66389b9 100644
--- a/libc/async_safe/Android.bp
+++ b/libc/async_safe/Android.bp
@@ -9,6 +9,7 @@
 
     name: "libasync_safe",
     vendor_available: true,
+    product_available: true,
     recovery_available: true,
     native_bridge_supported: true,
 
@@ -22,8 +23,8 @@
     apex_available: [
         "//apex_available:platform",
         "com.android.runtime",
+        "com.android.art",
         "com.android.art.debug",
-        "com.android.art.release",
         "com.android.media",
         "com.android.media.swcodec",
     ],
@@ -32,6 +33,7 @@
 cc_library_headers {
     name: "libasync_safe_headers",
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
     defaults: ["linux_bionic_supported"],
diff --git a/libc/bionic/__bionic_get_shell_path.cpp b/libc/bionic/__bionic_get_shell_path.cpp
index 7aeed18..c087b35 100644
--- a/libc/bionic/__bionic_get_shell_path.cpp
+++ b/libc/bionic/__bionic_get_shell_path.cpp
@@ -36,6 +36,10 @@
 #define VENDOR_PREFIX "/vendor/"
 
 static const char* init_sh_path() {
+#if !defined(__ANDROID__)
+  // For the host Bionic, use the standard /bin/sh
+  return "/bin/sh";
+#else
   /* If the device is not treble enabled, return the path to the system shell.
    * Vendor code, on non-treble enabled devices could use system() / popen()
    * with relative paths for executables on /system. Since /system will not be
@@ -51,6 +55,7 @@
   }
 #endif
   return "/system/bin/sh";
+#endif  // if !defined(__ANDROID__)
 }
 
 const char* __bionic_get_shell_path() {
diff --git a/libc/bionic/android_unsafe_frame_pointer_chase.cpp b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
index b3b1942..a1cb3c6 100644
--- a/libc/bionic/android_unsafe_frame_pointer_chase.cpp
+++ b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
@@ -29,6 +29,7 @@
 #include "platform/bionic/android_unsafe_frame_pointer_chase.h"
 
 #include "platform/bionic/mte.h"
+#include "platform/bionic/pac.h"
 #include "private/bionic_defs.h"
 #include "pthread_internal.h"
 
@@ -73,7 +74,7 @@
   while (1) {
     auto* frame = reinterpret_cast<frame_record*>(begin);
     if (num_frames < num_entries) {
-      buf[num_frames] = frame->return_addr;
+      buf[num_frames] = __bionic_clear_pac_bits(frame->return_addr);
     }
     ++num_frames;
     if (frame->next_frame < begin + sizeof(frame_record) || frame->next_frame >= end ||
diff --git a/libc/bionic/atexit.cpp b/libc/bionic/atexit.cpp
index df306af..5dbf322 100644
--- a/libc/bionic/atexit.cpp
+++ b/libc/bionic/atexit.cpp
@@ -73,50 +73,42 @@
   // restart concurrent __cxa_finalize passes.
   uint64_t total_appends_;
 
-  static size_t round_up_to_page_bytes(size_t capacity) {
-    return PAGE_END(capacity * sizeof(AtexitEntry));
-  }
-
-  static size_t next_capacity(size_t capacity) {
-    // Double the capacity each time.
-    size_t result = round_up_to_page_bytes(MAX(1, capacity * 2)) / sizeof(AtexitEntry);
-    CHECK(result > capacity);
-    return result;
-  }
+  static size_t page_start_of_index(size_t idx) { return PAGE_START(idx * sizeof(AtexitEntry)); }
+  static size_t page_end_of_index(size_t idx) { return PAGE_END(idx * sizeof(AtexitEntry)); }
 
   // Recompact the array if it will save at least one page of memory at the end.
-  bool needs_recompaction() {
-    return round_up_to_page_bytes(size_ - extracted_count_) < round_up_to_page_bytes(size_);
+  bool needs_recompaction() const {
+    return page_end_of_index(size_ - extracted_count_) < page_end_of_index(size_);
   }
 
-  void set_writable(bool writable);
+  void set_writable(bool writable, size_t start_idx, size_t num_entries);
+  static bool next_capacity(size_t capacity, size_t* result);
   bool expand_capacity();
 };
 
 }  // anonymous namespace
 
 bool AtexitArray::append_entry(const AtexitEntry& entry) {
-  bool result = false;
+  if (size_ >= capacity_ && !expand_capacity()) return false;
 
-  set_writable(true);
-  if (size_ < capacity_ || expand_capacity()) {
-    array_[size_++] = entry;
-    ++total_appends_;
-    result = true;
-  }
-  set_writable(false);
+  size_t idx = size_++;
 
-  return result;
+  set_writable(true, idx, 1);
+  array_[idx] = entry;
+  ++total_appends_;
+  set_writable(false, idx, 1);
+
+  return true;
 }
 
 // Extract an entry and return it.
 AtexitEntry AtexitArray::extract_entry(size_t idx) {
   AtexitEntry result = array_[idx];
 
-  set_writable(true);
+  set_writable(true, idx, 1);
   array_[idx] = {};
   ++extracted_count_;
-  set_writable(false);
+  set_writable(false, idx, 1);
 
   return result;
 }
@@ -124,7 +116,7 @@
 void AtexitArray::recompact() {
   if (!needs_recompaction()) return;
 
-  set_writable(true);
+  set_writable(true, 0, size_);
 
   // Optimization: quickly skip over the initial non-null entries.
   size_t src = 0, dst = 0;
@@ -143,51 +135,79 @@
   }
 
   // If the table uses fewer pages, clean the pages at the end.
-  size_t old_bytes = round_up_to_page_bytes(size_);
-  size_t new_bytes = round_up_to_page_bytes(dst);
+  size_t old_bytes = page_end_of_index(size_);
+  size_t new_bytes = page_end_of_index(dst);
   if (new_bytes < old_bytes) {
     madvise(reinterpret_cast<char*>(array_) + new_bytes, old_bytes - new_bytes, MADV_DONTNEED);
   }
 
+  set_writable(false, 0, size_);
+
   size_ = dst;
   extracted_count_ = 0;
-
-  set_writable(false);
 }
 
 // Use mprotect to make the array writable or read-only. Returns true on success. Making the array
 // read-only could protect against either unintentional or malicious corruption of the array.
-void AtexitArray::set_writable(bool writable) {
+void AtexitArray::set_writable(bool writable, size_t start_idx, size_t num_entries) {
   if (array_ == nullptr) return;
+
+  const size_t start_byte = page_start_of_index(start_idx);
+  const size_t stop_byte = page_end_of_index(start_idx + num_entries);
+  const size_t byte_len = stop_byte - start_byte;
+
   const int prot = PROT_READ | (writable ? PROT_WRITE : 0);
-  if (mprotect(array_, round_up_to_page_bytes(capacity_), prot) != 0) {
+  if (mprotect(reinterpret_cast<char*>(array_) + start_byte, byte_len, prot) != 0) {
     async_safe_fatal("mprotect failed on atexit array: %s", strerror(errno));
   }
 }
 
-bool AtexitArray::expand_capacity() {
-  const size_t new_capacity = next_capacity(capacity_);
-  const size_t new_capacity_bytes = round_up_to_page_bytes(new_capacity);
+// Approximately double the capacity. Returns true if successful (no overflow). AtexitEntry is
+// smaller than a page, but this function should still be correct even if AtexitEntry were larger
+// than one.
+bool AtexitArray::next_capacity(size_t capacity, size_t* result) {
+  if (capacity == 0) {
+    *result = PAGE_END(sizeof(AtexitEntry)) / sizeof(AtexitEntry);
+    return true;
+  }
+  size_t num_bytes;
+  if (__builtin_mul_overflow(page_end_of_index(capacity), 2, &num_bytes)) {
+    async_safe_format_log(ANDROID_LOG_WARN, "libc", "__cxa_atexit: capacity calculation overflow");
+    return false;
+  }
+  *result = num_bytes / sizeof(AtexitEntry);
+  return true;
+}
 
+bool AtexitArray::expand_capacity() {
+  size_t new_capacity;
+  if (!next_capacity(capacity_, &new_capacity)) return false;
+  const size_t new_capacity_bytes = page_end_of_index(new_capacity);
+
+  set_writable(true, 0, capacity_);
+
+  bool result = false;
   void* new_pages;
   if (array_ == nullptr) {
     new_pages = mmap(nullptr, new_capacity_bytes, PROT_READ | PROT_WRITE,
                      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
   } else {
-    new_pages =
-        mremap(array_, round_up_to_page_bytes(capacity_), new_capacity_bytes, MREMAP_MAYMOVE);
+    // mremap fails if the source buffer crosses a boundary between two VMAs. When a single array
+    // element is modified, the kernel should split then rejoin the buffer's VMA.
+    new_pages = mremap(array_, page_end_of_index(capacity_), new_capacity_bytes, MREMAP_MAYMOVE);
   }
   if (new_pages == MAP_FAILED) {
     async_safe_format_log(ANDROID_LOG_WARN, "libc",
                           "__cxa_atexit: mmap/mremap failed to allocate %zu bytes: %s",
                           new_capacity_bytes, strerror(errno));
-    return false;
+  } else {
+    result = true;
+    prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, new_pages, new_capacity_bytes, "atexit handlers");
+    array_ = static_cast<AtexitEntry*>(new_pages);
+    capacity_ = new_capacity;
   }
-
-  prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, new_pages, new_capacity_bytes, "atexit handlers");
-  array_ = static_cast<AtexitEntry*>(new_pages);
-  capacity_ = new_capacity;
-  return true;
+  set_writable(false, 0, capacity_);
+  return result;
 }
 
 static AtexitArray g_array;
diff --git a/libc/bionic/empty_android_ids.h b/libc/bionic/empty_android_ids.h
new file mode 100644
index 0000000..2145dd8
--- /dev/null
+++ b/libc/bionic/empty_android_ids.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#if defined(__ANDROID__)
+#error "This file is for host only"
+#endif
+
+struct android_id_info {
+  const char name[17];
+  unsigned aid;
+};
+
+static const struct android_id_info android_ids[] = {};
+
+#define android_id_count 0
diff --git a/libc/bionic/grp_pwd.cpp b/libc/bionic/grp_pwd.cpp
index dd8df95..600693c 100644
--- a/libc/bionic/grp_pwd.cpp
+++ b/libc/bionic/grp_pwd.cpp
@@ -46,24 +46,30 @@
 #include "private/android_filesystem_config.h"
 #include "platform/bionic/macros.h"
 
+#if defined(__ANDROID__)
 // Generated android_ids array
 #include "generated_android_ids.h"
+#else
+// Empty array for host; everything is from the database files
+#include "empty_android_ids.h"
+#endif
+
 #include "grp_pwd_file.h"
 
 static PasswdFile passwd_files[] = {
-  { "/system/etc/passwd", "system_" },
-  { "/vendor/etc/passwd", "vendor_" },
-  { "/odm/etc/passwd", "odm_" },
-  { "/product/etc/passwd", "product_" },
-  { "/system_ext/etc/passwd", "system_ext_" },
+    {"/etc/passwd", "system_"},  // symlinks to /system/etc/passwd in Android
+    {"/vendor/etc/passwd", "vendor_"},
+    {"/odm/etc/passwd", "odm_"},
+    {"/product/etc/passwd", "product_"},
+    {"/system_ext/etc/passwd", "system_ext_"},
 };
 
 static GroupFile group_files[] = {
-  { "/system/etc/group", "system_" },
-  { "/vendor/etc/group", "vendor_" },
-  { "/odm/etc/group", "odm_" },
-  { "/product/etc/group", "product_" },
-  { "/system_ext/etc/group", "system_ext_" },
+    {"/etc/group", "system_"},  // symlinks to /system/etc/group in Android
+    {"/vendor/etc/group", "vendor_"},
+    {"/odm/etc/group", "odm_"},
+    {"/product/etc/group", "product_"},
+    {"/system_ext/etc/group", "system_ext_"},
 };
 
 // POSIX seems to envisage an implementation where the <pwd.h> functions are
@@ -194,6 +200,7 @@
   return false;
 }
 
+#if defined(__ANDROID__)
 static bool is_valid_app_id(id_t id, bool is_group) {
   id_t appid = id % AID_USER_OFFSET;
 
@@ -226,6 +233,12 @@
 
   return false;
 }
+#else
+static bool is_valid_app_id(id_t, bool) {
+  // Host doesn't have the concept of app_id
+  return false;
+}
+#endif  // if defined(__ANDROID__)
 
 // This provides an iterater for app_ids within the first user's app id's.
 static id_t get_next_app_id(id_t current_id, bool is_group) {
@@ -386,6 +399,7 @@
   }
 }
 
+#if defined(__ANDROID__)
 static bool device_launched_before_api_29() {
   // Check if ro.product.first_api_level is set to a value > 0 and < 29, if so, this device was
   // launched before API 29 (Q). Any other value is considered to be either in development or
@@ -420,6 +434,12 @@
   return (id >= AID_OEM_RESERVED_START && id <= AID_OEM_RESERVED_END) ||
          (id >= AID_OEM_RESERVED_2_START && id <= AID_OEM_RESERVED_2_END);
 }
+#else
+static bool is_oem_id(id_t) {
+  // no OEM ids in host
+  return false;
+}
+#endif  // if defined(__ANDROID__)
 
 // Translate an OEM name to the corresponding user/group id.
 static id_t oem_id_from_name(const char* name) {
@@ -522,7 +542,7 @@
     return android_iinfo_to_passwd(state, android_id_info);
   }
 
-  // Handle OEM range.
+  // Find an entry from the database file
   passwd* pw = oem_id_to_passwd(uid, state);
   if (pw != nullptr) {
     return pw;
@@ -540,6 +560,7 @@
     return android_iinfo_to_passwd(state, android_id_info);
   }
 
+  // Find an entry from the database file
   for (auto& passwd_file : passwd_files) {
     if (passwd_file.FindByName(login, state)) {
       return &state->passwd_;
@@ -681,7 +702,7 @@
     return android_iinfo_to_group(state, android_id_info);
   }
 
-  // Handle OEM range.
+  // Find an entry from the database file
   group* grp = oem_id_to_group(gid, state);
   if (grp != nullptr) {
     return grp;
@@ -699,6 +720,7 @@
     return android_iinfo_to_group(state, android_id_info);
   }
 
+  // Find an entry from the database file
   for (auto& group_file : group_files) {
     if (group_file.FindByName(name, state)) {
       return &state->group_;
diff --git a/libc/bionic/grp_pwd_file.cpp b/libc/bionic/grp_pwd_file.cpp
index 81cf893..1f45e80 100644
--- a/libc/bionic/grp_pwd_file.cpp
+++ b/libc/bionic/grp_pwd_file.cpp
@@ -268,6 +268,7 @@
 
   while (line_beginning < end) {
     line_beginning = ParseLine(line_beginning, end, line->fields, line->kNumFields);
+#if defined(__ANDROID__)
     // To comply with Treble, users/groups from each partition need to be prefixed with
     // the partition name.
     if (required_prefix_ != nullptr) {
@@ -280,6 +281,7 @@
         continue;
       }
     }
+#endif
     if (predicate(line)) return true;
   }
 
diff --git a/libc/bionic/grp_pwd_file.h b/libc/bionic/grp_pwd_file.h
index 69c771b..5fd3d2f 100644
--- a/libc/bionic/grp_pwd_file.h
+++ b/libc/bionic/grp_pwd_file.h
@@ -65,7 +65,10 @@
   const char* filename_ = nullptr;
   const char* start_ = nullptr;
   const char* end_ = nullptr;
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wunused-private-field"
   const char* required_prefix_;
+#pragma clang diagnostic pop
 };
 
 class PasswdFile {
diff --git a/libc/bionic/gwp_asan_wrappers.cpp b/libc/bionic/gwp_asan_wrappers.cpp
index d3e6a14..6eb1749 100644
--- a/libc/bionic/gwp_asan_wrappers.cpp
+++ b/libc/bionic/gwp_asan_wrappers.cpp
@@ -40,7 +40,6 @@
 #include "bionic/gwp_asan_wrappers.h"
 #include "gwp_asan/guarded_pool_allocator.h"
 #include "gwp_asan/options.h"
-#include "gwp_asan/random.h"
 #include "malloc_common.h"
 
 #ifndef LIBC_STATIC
diff --git a/libc/bionic/heap_tagging.cpp b/libc/bionic/heap_tagging.cpp
index 540372b..7601ddd 100644
--- a/libc/bionic/heap_tagging.cpp
+++ b/libc/bionic/heap_tagging.cpp
@@ -33,6 +33,10 @@
 #include <platform/bionic/malloc.h>
 #include <platform/bionic/mte_kernel.h>
 
+#include <bionic/pthread_internal.h>
+
+#include "private/ScopedPthreadMutexLocker.h"
+
 extern "C" void scudo_malloc_disable_memory_tagging();
 extern "C" void scudo_malloc_set_track_allocation_stacks(int);
 
@@ -68,7 +72,32 @@
 #endif  // aarch64
 }
 
+#ifdef ANDROID_EXPERIMENTAL_MTE
+static bool set_tcf_on_all_threads(int tcf) {
+  static int g_tcf;
+  g_tcf = tcf;
+
+  return android_run_on_all_threads(
+      [](void*) {
+        int tagged_addr_ctrl = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);
+        if (tagged_addr_ctrl < 0) {
+          return false;
+        }
+
+        tagged_addr_ctrl = (tagged_addr_ctrl & ~PR_MTE_TCF_MASK) | g_tcf;
+        if (prctl(PR_SET_TAGGED_ADDR_CTRL, tagged_addr_ctrl, 0, 0, 0) < 0) {
+          return false;
+        }
+        return true;
+      },
+      nullptr);
+}
+#endif
+
 bool SetHeapTaggingLevel(void* arg, size_t arg_size) {
+  static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
+  ScopedPthreadMutexLocker locker(&mutex);
+
   if (arg_size != sizeof(HeapTaggingLevel)) {
     return false;
   }
@@ -80,9 +109,6 @@
 
   switch (tag_level) {
     case M_HEAP_TAGGING_LEVEL_NONE:
-#if defined(USE_SCUDO)
-      scudo_malloc_disable_memory_tagging();
-#endif
       if (heap_tagging_level == M_HEAP_TAGGING_LEVEL_TBI) {
         __libc_globals.mutate([](libc_globals* globals) {
           // Preserve the untag mask (we still want to untag pointers when passing them to the
@@ -90,7 +116,17 @@
           // tagged and checks no longer happen.
           globals->heap_pointer_tag = static_cast<uintptr_t>(0xffull << UNTAG_SHIFT);
         });
+      } else {
+#if defined(ANDROID_EXPERIMENTAL_MTE)
+        if (!set_tcf_on_all_threads(PR_MTE_TCF_NONE)) {
+          error_log("SetHeapTaggingLevel: set_tcf_on_all_threads failed");
+          return false;
+        }
+#endif
       }
+#if defined(USE_SCUDO)
+      scudo_malloc_disable_memory_tagging();
+#endif
       break;
     case M_HEAP_TAGGING_LEVEL_TBI:
     case M_HEAP_TAGGING_LEVEL_ASYNC:
@@ -106,10 +142,16 @@
       }
 
       if (tag_level == M_HEAP_TAGGING_LEVEL_ASYNC) {
+#if defined(ANDROID_EXPERIMENTAL_MTE)
+        set_tcf_on_all_threads(PR_MTE_TCF_ASYNC);
+#endif
 #if defined(USE_SCUDO)
         scudo_malloc_set_track_allocation_stacks(0);
 #endif
       } else if (tag_level == M_HEAP_TAGGING_LEVEL_SYNC) {
+#if defined(ANDROID_EXPERIMENTAL_MTE)
+        set_tcf_on_all_threads(PR_MTE_TCF_SYNC);
+#endif
 #if defined(USE_SCUDO)
         scudo_malloc_set_track_allocation_stacks(1);
 #endif
diff --git a/libc/bionic/icu.cpp b/libc/bionic/icu.cpp
index 72dac9b..c11b9d6 100644
--- a/libc/bionic/icu.cpp
+++ b/libc/bionic/icu.cpp
@@ -36,12 +36,12 @@
 
 #include <async_safe/log.h>
 
-static void* g_libicuuc_handle = nullptr;
+static void* g_libicu_handle = nullptr;
 
 static bool __find_icu() {
-  g_libicuuc_handle = dlopen("libandroidicu.so", RTLD_LOCAL);
-  if (g_libicuuc_handle == nullptr) {
-    async_safe_format_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't open libandroidicu.so: %s",
+  g_libicu_handle = dlopen("libicu.so", RTLD_LOCAL);
+  if (g_libicu_handle == nullptr) {
+    async_safe_format_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't open libicu.so: %s",
                           dlerror());
     return false;
   }
@@ -53,14 +53,9 @@
   static bool found_icu = __find_icu();
   if (!found_icu) return nullptr;
 
-  char versioned_symbol_name[strlen(symbol_name) + strlen("_android") + 1];
-  snprintf(versioned_symbol_name, sizeof(versioned_symbol_name), "%s_android",
-           symbol_name);
-
-  void* symbol = dlsym(g_libicuuc_handle, versioned_symbol_name);
+  void* symbol = dlsym(g_libicu_handle, symbol_name);
   if (symbol == nullptr) {
-    async_safe_format_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't find %s",
-                          versioned_symbol_name);
+    async_safe_format_log(ANDROID_LOG_ERROR, "bionic-icu", "couldn't find %s", symbol_name);
   }
   return symbol;
 }
diff --git a/libc/bionic/libc_init_common.h b/libc/bionic/libc_init_common.h
index 0c2e78a..be7526f 100644
--- a/libc/bionic/libc_init_common.h
+++ b/libc/bionic/libc_init_common.h
@@ -30,10 +30,13 @@
 
 #include <sys/cdefs.h>
 
+typedef void init_func_t(int, char*[], char*[]);
+typedef void fini_func_t(void);
+
 typedef struct {
-  void (**preinit_array)(void);
-  void (**init_array)(void);
-  void (**fini_array)(void);
+  init_func_t** preinit_array;
+  init_func_t** init_array;
+  fini_func_t** fini_array;
 } structors_array_t;
 
 __BEGIN_DECLS
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index e3a447d..4a73918 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -60,10 +60,10 @@
 
 extern "C" int __cxa_atexit(void (*)(void *), void *, void *);
 
-static void call_array(void(**list)()) {
+static void call_array(init_func_t** list, int argc, char* argv[], char* envp[]) {
   // First element is -1, list is null-terminated
   while (*++list) {
-    (*list)();
+    (*list)(argc, argv, envp);
   }
 }
 
@@ -183,8 +183,8 @@
   // Several Linux ABIs don't pass the onexit pointer, and the ones that
   // do never use it.  Therefore, we ignore it.
 
-  call_array(structors->preinit_array);
-  call_array(structors->init_array);
+  call_array(structors->preinit_array, args.argc, args.argv, args.envp);
+  call_array(structors->init_array, args.argc, args.argv, args.envp);
 
   // The executable may have its own destructors listed in its .fini_array
   // so we need to ensure that these are called when the program exits
diff --git a/libc/bionic/malloc_common.cpp b/libc/bionic/malloc_common.cpp
index ed5537f..6b7006d 100644
--- a/libc/bionic/malloc_common.cpp
+++ b/libc/bionic/malloc_common.cpp
@@ -46,6 +46,7 @@
 #include "malloc_common.h"
 #include "malloc_limit.h"
 #include "malloc_tagged_pointers.h"
+#include "memory_mitigation_state.h"
 
 // =============================================================================
 // Global variables instantations.
@@ -326,6 +327,9 @@
       return MaybeInitGwpAsan(globals, *reinterpret_cast<bool*>(arg));
     });
   }
+  if (opcode == M_DISABLE_MEMORY_MITIGATIONS) {
+    return DisableMemoryMitigations(arg, arg_size);
+  }
   errno = ENOTSUP;
   return false;
 }
diff --git a/libc/bionic/malloc_common_dynamic.cpp b/libc/bionic/malloc_common_dynamic.cpp
index 6a82ae3..eeeaff9 100644
--- a/libc/bionic/malloc_common_dynamic.cpp
+++ b/libc/bionic/malloc_common_dynamic.cpp
@@ -70,6 +70,7 @@
 #include "malloc_common_dynamic.h"
 #include "malloc_heapprofd.h"
 #include "malloc_limit.h"
+#include "memory_mitigation_state.h"
 
 // =============================================================================
 // Global variables instantations.
@@ -533,6 +534,9 @@
       return MaybeInitGwpAsan(globals, *reinterpret_cast<bool*>(arg));
     });
   }
+  if (opcode == M_DISABLE_MEMORY_MITIGATIONS) {
+    return DisableMemoryMitigations(arg, arg_size);
+  }
   // Try heapprofd's mallopt, as it handles options not covered here.
   return HeapprofdMallopt(opcode, arg, arg_size);
 }
diff --git a/libc/bionic/memory_mitigation_state.cpp b/libc/bionic/memory_mitigation_state.cpp
new file mode 100644
index 0000000..abb1e8d
--- /dev/null
+++ b/libc/bionic/memory_mitigation_state.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "memory_mitigation_state.h"
+
+#include <dirent.h>
+#include <pthread.h>
+#include <semaphore.h>
+#include <stdatomic.h>
+#include <stdlib.h>
+#include <sys/prctl.h>
+#include <sys/types.h>
+
+#include <bionic/malloc.h>
+#include <bionic/mte.h>
+
+#include "heap_tagging.h"
+#include "private/ScopedRWLock.h"
+#include "pthread_internal.h"
+
+extern "C" void scudo_malloc_set_zero_contents(int zero_contents);
+
+bool DisableMemoryMitigations(void* arg, size_t arg_size) {
+  if (arg || arg_size) {
+    return false;
+  }
+
+#ifdef USE_SCUDO
+  scudo_malloc_set_zero_contents(0);
+#endif
+
+  HeapTaggingLevel level = M_HEAP_TAGGING_LEVEL_NONE;
+  SetHeapTaggingLevel(reinterpret_cast<void*>(&level), sizeof(level));
+
+  return true;
+}
diff --git a/libc/bionic/memory_mitigation_state.h b/libc/bionic/memory_mitigation_state.h
new file mode 100644
index 0000000..ffa1912
--- /dev/null
+++ b/libc/bionic/memory_mitigation_state.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stddef.h>
+
+bool DisableMemoryMitigations(void* arg, size_t arg_size);
diff --git a/libc/bionic/pthread_cond.cpp b/libc/bionic/pthread_cond.cpp
index e857069..793dcd9 100644
--- a/libc/bionic/pthread_cond.cpp
+++ b/libc/bionic/pthread_cond.cpp
@@ -116,7 +116,8 @@
   }
 
 #if defined(__LP64__)
-  char __reserved[44];
+  atomic_uint waiters;
+  char __reserved[40];
 #endif
 };
 
@@ -141,6 +142,10 @@
   }
   atomic_init(&cond->state, init_state);
 
+#if defined(__LP64__)
+  atomic_init(&cond->waiters, 0);
+#endif
+
   return 0;
 }
 
@@ -163,6 +168,12 @@
   // not be called. That's why pthread_wait/signal pair can't be used as a method for memory
   // synchronization. And it doesn't help even if we use any fence here.
 
+#if defined(__LP64__)
+  if (atomic_load_explicit(&cond->waiters, memory_order_relaxed) == 0) {
+    return 0;
+  }
+#endif
+
   // The increase of value should leave flags alone, even if the value can overflows.
   atomic_fetch_add_explicit(&cond->state, COND_COUNTER_STEP, memory_order_relaxed);
 
@@ -178,9 +189,19 @@
   }
 
   unsigned int old_state = atomic_load_explicit(&cond->state, memory_order_relaxed);
+
+#if defined(__LP64__)
+  atomic_fetch_add_explicit(&cond->waiters, 1, memory_order_relaxed);
+#endif
+
   pthread_mutex_unlock(mutex);
   int status = __futex_wait_ex(&cond->state, cond->process_shared(), old_state,
                                use_realtime_clock, abs_timeout_or_null);
+
+#if defined(__LP64__)
+  atomic_fetch_sub_explicit(&cond->waiters, 1, memory_order_relaxed);
+#endif
+
   pthread_mutex_lock(mutex);
 
   if (status == -ETIMEDOUT) {
diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
index c528105..206d5fd 100644
--- a/libc/bionic/pthread_create.cpp
+++ b/libc/bionic/pthread_create.cpp
@@ -39,6 +39,7 @@
 
 #include <async_safe/log.h>
 
+#include "private/ScopedRWLock.h"
 #include "private/bionic_constants.h"
 #include "private/bionic_defs.h"
 #include "private/bionic_globals.h"
@@ -357,6 +358,7 @@
   return nullptr;
 }
 
+pthread_rwlock_t g_thread_creation_lock = PTHREAD_RWLOCK_INITIALIZER;
 
 __BIONIC_WEAK_FOR_NATIVE_BRIDGE
 int pthread_create(pthread_t* thread_out, pthread_attr_t const* attr,
@@ -406,6 +408,8 @@
   tls = &tls_descriptor;
 #endif
 
+  ScopedReadLock locker(&g_thread_creation_lock);
+
   sigset64_t block_all_mask;
   sigfillset64(&block_all_mask);
   __rt_sigprocmask(SIG_SETMASK, &block_all_mask, &thread->start_mask, sizeof(thread->start_mask));
diff --git a/libc/bionic/pthread_exit.cpp b/libc/bionic/pthread_exit.cpp
index 81dab57..bde95ec 100644
--- a/libc/bionic/pthread_exit.cpp
+++ b/libc/bionic/pthread_exit.cpp
@@ -35,6 +35,7 @@
 
 #include "private/bionic_constants.h"
 #include "private/bionic_defs.h"
+#include "private/ScopedRWLock.h"
 #include "private/ScopedSignalBlocker.h"
 #include "pthread_internal.h"
 
@@ -103,9 +104,18 @@
          !atomic_compare_exchange_weak(&thread->join_state, &old_state, THREAD_EXITED_NOT_JOINED)) {
   }
 
-  // We don't want to take a signal after unmapping the stack, the shadow call
-  // stack, or dynamic TLS memory.
-  ScopedSignalBlocker ssb;
+  // android_run_on_all_threads() needs to see signals blocked atomically with setting the
+  // terminating flag, so take the creation lock while doing these operations.
+  {
+    ScopedReadLock locker(&g_thread_creation_lock);
+    atomic_store(&thread->terminating, true);
+
+    // We don't want to take a signal after unmapping the stack, the shadow call stack, or dynamic
+    // TLS memory.
+    sigset64_t set;
+    sigfillset64(&set);
+    __rt_sigprocmask(SIG_BLOCK, &set, nullptr, sizeof(sigset64_t));
+  }
 
 #ifdef __aarch64__
   // Free the shadow call stack and guard pages.
diff --git a/libc/bionic/pthread_internal.cpp b/libc/bionic/pthread_internal.cpp
index e091158..6a7ee2f 100644
--- a/libc/bionic/pthread_internal.cpp
+++ b/libc/bionic/pthread_internal.cpp
@@ -29,12 +29,15 @@
 #include "pthread_internal.h"
 
 #include <errno.h>
+#include <semaphore.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
 
 #include <async_safe/log.h>
+#include <bionic/reserved_signals.h>
 
+#include "private/ErrnoRestorer.h"
 #include "private/ScopedRWLock.h"
 #include "private/bionic_futex.h"
 #include "private/bionic_tls.h"
@@ -115,3 +118,76 @@
   }
   return nullptr;
 }
+
+bool android_run_on_all_threads(bool (*func)(void*), void* arg) {
+  // Take the locks in this order to avoid inversion (pthread_create ->
+  // __pthread_internal_add).
+  ScopedWriteLock creation_locker(&g_thread_creation_lock);
+  ScopedReadLock list_locker(&g_thread_list_lock);
+
+  // Call the function directly for the current thread so that we don't need to worry about
+  // the consequences of synchronizing with ourselves.
+  if (!func(arg)) {
+    return false;
+  }
+
+  static sem_t g_sem;
+  if (sem_init(&g_sem, 0, 0) != 0) {
+    return false;
+  }
+
+  static bool (*g_func)(void*);
+  static void *g_arg;
+  g_func = func;
+  g_arg = arg;
+
+  static _Atomic(bool) g_retval;
+  atomic_init(&g_retval, true);
+
+  auto handler = [](int, siginfo_t*, void*) {
+    ErrnoRestorer restorer;
+    if (!g_func(g_arg)) {
+      atomic_store(&g_retval, false);
+    }
+    sem_post(&g_sem);
+  };
+
+  struct sigaction act = {}, oldact;
+  act.sa_flags = SA_SIGINFO;
+  act.sa_sigaction = handler;
+  sigfillset(&act.sa_mask);
+  if (sigaction(BIONIC_SIGNAL_RUN_ON_ALL_THREADS, &act, &oldact) != 0) {
+    sem_destroy(&g_sem);
+    return false;
+  }
+
+  pid_t my_pid = getpid();
+  size_t num_tids = 0;
+  for (pthread_internal_t* t = g_thread_list; t != nullptr; t = t->next) {
+    // The function is called directly for the current thread above, so no need to send a signal to
+    // ourselves to call it here.
+    if (t == __get_thread()) continue;
+
+    // If a thread is terminating (has blocked signals) or has already terminated, our signal will
+    // never be received, so we need to check for that condition and skip the thread if it is the
+    // case.
+    if (atomic_load(&t->terminating)) continue;
+
+    if (tgkill(my_pid, t->tid, BIONIC_SIGNAL_RUN_ON_ALL_THREADS) == 0) {
+      ++num_tids;
+    } else {
+      atomic_store(&g_retval, false);
+    }
+  }
+
+  for (size_t i = 0; i != num_tids; ++i) {
+    if (TEMP_FAILURE_RETRY(sem_wait(&g_sem)) != 0) {
+      atomic_store(&g_retval, false);
+      break;
+    }
+  }
+
+  sigaction(BIONIC_SIGNAL_RUN_ON_ALL_THREADS, &oldact, 0);
+  sem_destroy(&g_sem);
+  return atomic_load(&g_retval);
+}
diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h
index 1f055f5..071a5bc 100644
--- a/libc/bionic/pthread_internal.h
+++ b/libc/bionic/pthread_internal.h
@@ -132,6 +132,11 @@
   // top of the stack quickly, which would otherwise require special logic for the main thread.
   uintptr_t stack_top;
 
+  // Whether the thread is in the process of terminating (has blocked signals), or has already
+  // terminated. This is used by android_run_on_all_threads() to avoid sending a signal to a thread
+  // that will never receive it.
+  _Atomic(bool) terminating;
+
   Lock startup_handshake_lock;
 
   void* mmap_base;
@@ -242,3 +247,7 @@
 __LIBC_HIDDEN__ extern void __bionic_atfork_run_prepare();
 __LIBC_HIDDEN__ extern void __bionic_atfork_run_child();
 __LIBC_HIDDEN__ extern void __bionic_atfork_run_parent();
+
+extern "C" bool android_run_on_all_threads(bool (*func)(void*), void* arg);
+
+extern pthread_rwlock_t g_thread_creation_lock;
diff --git a/libc/bionic/sys_thread_properties.cpp b/libc/bionic/sys_thread_properties.cpp
index 24d7551..d1a73b7 100644
--- a/libc/bionic/sys_thread_properties.cpp
+++ b/libc/bionic/sys_thread_properties.cpp
@@ -39,6 +39,11 @@
 #include <sys/uio.h>
 #include <sys/user.h>
 
+#if defined(__i386__)
+#include <asm/ldt.h>
+#endif
+
+#include "private/ErrnoRestorer.h"
 #include "private/bionic_elf_tls.h"
 #include "private/bionic_globals.h"
 #include "private/bionic_tls.h"
@@ -72,21 +77,30 @@
 
   // Find the thread-pointer register for the given thread.
   void** tp_reg = nullptr;
-
-#if defined(__x86_64__) || defined(__i386__)
+#if defined(__x86_64__)
+  {
+    ErrnoRestorer errno_restorer;
+    errno = 0;
+    uintptr_t fs_base = ptrace(PTRACE_PEEKUSER, tid, offsetof(user_regs_struct, fs_base), nullptr);
+    if (errno == 0) {
+      tp_reg = reinterpret_cast<void**>(fs_base);
+    }
+  }
+#elif defined(__i386__)
   struct user_regs_struct regs;
   struct iovec pt_iov = {
       .iov_base = &regs,
       .iov_len = sizeof(regs),
   };
+
   if (ptrace(PTRACE_GETREGSET, tid, NT_PRSTATUS, &pt_iov) == 0) {
-#if defined(__x86_64__)
-    tp_reg = reinterpret_cast<void**>(regs.fs);
-#elif defined(__i386__)
-    tp_reg = reinterpret_cast<void**>(regs.xgs);
-#endif
+    struct user_desc u_info;
+    u_info.entry_number = regs.xgs >> 3;
+    if (ptrace(PTRACE_GET_THREAD_AREA, tid, u_info.entry_number, &u_info) == 0) {
+      tp_reg = reinterpret_cast<void**>(u_info.base_addr);
+    }
   }
-#elif defined(__aarch64__) || defined(__arm__)
+#elif defined(__aarch64__)
   uint64_t reg;
   struct iovec pt_iov {
     .iov_base = &reg, .iov_len = sizeof(reg),
@@ -95,6 +109,11 @@
   if (ptrace(PTRACE_GETREGSET, tid, NT_ARM_TLS, &pt_iov) == 0) {
     tp_reg = reinterpret_cast<void**>(reg);
   }
+#elif defined(__arm__)
+  if (ptrace(PTRACE_GET_THREAD_AREA, tid, nullptr, &tp_reg) != 0) {
+    // Reset the tp_reg if ptrace was unsuccessful.
+    tp_reg = nullptr;
+  }
 #endif
 
   if (tp_reg == nullptr) {
diff --git a/libc/dns/net/gethnamaddr.c b/libc/dns/net/gethnamaddr.c
index 7e18840..84942f8 100644
--- a/libc/dns/net/gethnamaddr.c
+++ b/libc/dns/net/gethnamaddr.c
@@ -90,6 +90,8 @@
 
 #include "hostent.h"
 
+#include "private/bionic_defs.h"
+
 #define maybe_ok(res, nm, ok) (((res)->options & RES_NOCHECKNAME) != 0U || \
                                (ok)(nm) != 0)
 #define maybe_hnok(res, hn) maybe_ok((res), (hn), res_hnok)
@@ -1533,6 +1535,7 @@
  * Non-reentrant versions.
  */
 
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
 struct hostent *
 gethostbyname(const char *name)
 {
@@ -1590,6 +1593,7 @@
 	return hp;
 }
 
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
 struct hostent *
 gethostbyaddr(const void *addr, socklen_t len, int af)
 {
diff --git a/libc/dns/net/getnameinfo.c b/libc/dns/net/getnameinfo.c
index 31d07c5..413b37e 100644
--- a/libc/dns/net/getnameinfo.c
+++ b/libc/dns/net/getnameinfo.c
@@ -68,6 +68,8 @@
 #include <stddef.h>
 #include <string.h>
 
+#include "private/bionic_defs.h"
+
 /* This macro is modelled after the ones in <netinet/in6.h>. */
 /* RFC 6052, section 2.1 */
 #define IN6_IS_ADDR_WKP(a) \
@@ -110,6 +112,7 @@
  * Top-level getnameinfo() code.  Look at the address family, and pick an
  * appropriate function to call.
  */
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
 int getnameinfo(const struct sockaddr* sa, socklen_t salen, char* host, size_t hostlen,
 		char* serv, size_t servlen, int flags)
 {
diff --git a/libc/include/bits/glibc-syscalls.h b/libc/include/bits/glibc-syscalls.h
index 71e67a3..1decafd 100644
--- a/libc/include/bits/glibc-syscalls.h
+++ b/libc/include/bits/glibc-syscalls.h
@@ -120,6 +120,9 @@
 #if defined(__NR_close)
   #define SYS_close __NR_close
 #endif
+#if defined(__NR_close_range)
+  #define SYS_close_range __NR_close_range
+#endif
 #if defined(__NR_connect)
   #define SYS_connect __NR_connect
 #endif
diff --git a/libc/kernel/uapi/asm-arm/asm/unistd-common.h b/libc/kernel/uapi/asm-arm/asm/unistd-common.h
index 5784399..6e7faec 100644
--- a/libc/kernel/uapi/asm-arm/asm/unistd-common.h
+++ b/libc/kernel/uapi/asm-arm/asm/unistd-common.h
@@ -407,6 +407,7 @@
 #define __NR_fspick (__NR_SYSCALL_BASE + 433)
 #define __NR_pidfd_open (__NR_SYSCALL_BASE + 434)
 #define __NR_clone3 (__NR_SYSCALL_BASE + 435)
+#define __NR_close_range (__NR_SYSCALL_BASE + 436)
 #define __NR_openat2 (__NR_SYSCALL_BASE + 437)
 #define __NR_pidfd_getfd (__NR_SYSCALL_BASE + 438)
 #define __NR_faccessat2 (__NR_SYSCALL_BASE + 439)
diff --git a/libc/kernel/uapi/asm-generic/unistd.h b/libc/kernel/uapi/asm-generic/unistd.h
index efb5218..07fe6e7 100644
--- a/libc/kernel/uapi/asm-generic/unistd.h
+++ b/libc/kernel/uapi/asm-generic/unistd.h
@@ -396,6 +396,7 @@
 #ifdef __ARCH_WANT_SYS_CLONE3
 #define __NR_clone3 435
 #endif
+#define __NR_close_range 436
 #define __NR_openat2 437
 #define __NR_pidfd_getfd 438
 #define __NR_faccessat2 439
diff --git a/libc/kernel/uapi/asm-x86/asm/hwcap2.h b/libc/kernel/uapi/asm-x86/asm/hwcap2.h
index 9015dee..a6dbfb9 100644
--- a/libc/kernel/uapi/asm-x86/asm/hwcap2.h
+++ b/libc/kernel/uapi/asm-x86/asm/hwcap2.h
@@ -19,4 +19,5 @@
 #ifndef _ASM_X86_HWCAP2_H
 #define _ASM_X86_HWCAP2_H
 #define HWCAP2_RING3MWAIT (1 << 0)
+#define HWCAP2_FSGSBASE BIT(1)
 #endif
diff --git a/libc/kernel/uapi/asm-x86/asm/unistd_32.h b/libc/kernel/uapi/asm-x86/asm/unistd_32.h
index a3256c0..ff83a82 100644
--- a/libc/kernel/uapi/asm-x86/asm/unistd_32.h
+++ b/libc/kernel/uapi/asm-x86/asm/unistd_32.h
@@ -443,6 +443,7 @@
 #define __NR_fspick 433
 #define __NR_pidfd_open 434
 #define __NR_clone3 435
+#define __NR_close_range 436
 #define __NR_openat2 437
 #define __NR_pidfd_getfd 438
 #define __NR_faccessat2 439
diff --git a/libc/kernel/uapi/asm-x86/asm/unistd_64.h b/libc/kernel/uapi/asm-x86/asm/unistd_64.h
index 9c12a3d..40986b8 100644
--- a/libc/kernel/uapi/asm-x86/asm/unistd_64.h
+++ b/libc/kernel/uapi/asm-x86/asm/unistd_64.h
@@ -365,6 +365,7 @@
 #define __NR_fspick 433
 #define __NR_pidfd_open 434
 #define __NR_clone3 435
+#define __NR_close_range 436
 #define __NR_openat2 437
 #define __NR_pidfd_getfd 438
 #define __NR_faccessat2 439
diff --git a/libc/kernel/uapi/asm-x86/asm/unistd_x32.h b/libc/kernel/uapi/asm-x86/asm/unistd_x32.h
index 5f92cfd..283828b 100644
--- a/libc/kernel/uapi/asm-x86/asm/unistd_x32.h
+++ b/libc/kernel/uapi/asm-x86/asm/unistd_x32.h
@@ -318,6 +318,7 @@
 #define __NR_fspick (__X32_SYSCALL_BIT + 433)
 #define __NR_pidfd_open (__X32_SYSCALL_BIT + 434)
 #define __NR_clone3 (__X32_SYSCALL_BIT + 435)
+#define __NR_close_range (__X32_SYSCALL_BIT + 436)
 #define __NR_openat2 (__X32_SYSCALL_BIT + 437)
 #define __NR_pidfd_getfd (__X32_SYSCALL_BIT + 438)
 #define __NR_faccessat2 (__X32_SYSCALL_BIT + 439)
diff --git a/libc/kernel/uapi/drm/drm_fourcc.h b/libc/kernel/uapi/drm/drm_fourcc.h
index 0ea5c83..794a9e9 100644
--- a/libc/kernel/uapi/drm/drm_fourcc.h
+++ b/libc/kernel/uapi/drm/drm_fourcc.h
@@ -111,10 +111,13 @@
 #define DRM_FORMAT_NV61 fourcc_code('N', 'V', '6', '1')
 #define DRM_FORMAT_NV24 fourcc_code('N', 'V', '2', '4')
 #define DRM_FORMAT_NV42 fourcc_code('N', 'V', '4', '2')
+#define DRM_FORMAT_NV15 fourcc_code('N', 'V', '1', '5')
 #define DRM_FORMAT_P210 fourcc_code('P', '2', '1', '0')
 #define DRM_FORMAT_P010 fourcc_code('P', '0', '1', '0')
 #define DRM_FORMAT_P012 fourcc_code('P', '0', '1', '2')
 #define DRM_FORMAT_P016 fourcc_code('P', '0', '1', '6')
+#define DRM_FORMAT_Q410 fourcc_code('Q', '4', '1', '0')
+#define DRM_FORMAT_Q401 fourcc_code('Q', '4', '0', '1')
 #define DRM_FORMAT_YUV410 fourcc_code('Y', 'U', 'V', '9')
 #define DRM_FORMAT_YVU410 fourcc_code('Y', 'V', 'U', '9')
 #define DRM_FORMAT_YUV411 fourcc_code('Y', 'U', '1', '1')
@@ -136,8 +139,10 @@
 #define DRM_FORMAT_MOD_VENDOR_BROADCOM 0x07
 #define DRM_FORMAT_MOD_VENDOR_ARM 0x08
 #define DRM_FORMAT_MOD_VENDOR_ALLWINNER 0x09
+#define DRM_FORMAT_MOD_VENDOR_AMLOGIC 0x0a
 #define DRM_FORMAT_RESERVED ((1ULL << 56) - 1)
 #define fourcc_mod_code(vendor,val) ((((__u64) DRM_FORMAT_MOD_VENDOR_ ##vendor) << 56) | ((val) & 0x00ffffffffffffffULL))
+#define DRM_FORMAT_MOD_GENERIC_16_16_TILE DRM_FORMAT_MOD_SAMSUNG_16_16_TILE
 #define DRM_FORMAT_MOD_INVALID fourcc_mod_code(NONE, DRM_FORMAT_RESERVED)
 #define DRM_FORMAT_MOD_LINEAR fourcc_mod_code(NONE, 0)
 #define I915_FORMAT_MOD_X_TILED fourcc_mod_code(INTEL, 1)
@@ -150,9 +155,6 @@
 #define DRM_FORMAT_MOD_SAMSUNG_64_32_TILE fourcc_mod_code(SAMSUNG, 1)
 #define DRM_FORMAT_MOD_SAMSUNG_16_16_TILE fourcc_mod_code(SAMSUNG, 2)
 #define DRM_FORMAT_MOD_QCOM_COMPRESSED fourcc_mod_code(QCOM, 1)
-#define DRM_FORMAT_MOD_QCOM_DX fourcc_mod_code(QCOM, 0x2)
-#define DRM_FORMAT_MOD_QCOM_TIGHT fourcc_mod_code(QCOM, 0x4)
-#define DRM_FORMAT_MOD_QCOM_TILE fourcc_mod_code(QCOM, 0x8)
 #define DRM_FORMAT_MOD_VIVANTE_TILED fourcc_mod_code(VIVANTE, 1)
 #define DRM_FORMAT_MOD_VIVANTE_SUPER_TILED fourcc_mod_code(VIVANTE, 2)
 #define DRM_FORMAT_MOD_VIVANTE_SPLIT_TILED fourcc_mod_code(VIVANTE, 3)
@@ -198,8 +200,16 @@
 #define AFBC_FORMAT_MOD_SC (1ULL << 9)
 #define AFBC_FORMAT_MOD_DB (1ULL << 10)
 #define AFBC_FORMAT_MOD_BCH (1ULL << 11)
+#define AFBC_FORMAT_MOD_USM (1ULL << 12)
 #define DRM_FORMAT_MOD_ARM_16X16_BLOCK_U_INTERLEAVED DRM_FORMAT_MOD_ARM_CODE(DRM_FORMAT_MOD_ARM_TYPE_MISC, 1ULL)
 #define DRM_FORMAT_MOD_ALLWINNER_TILED fourcc_mod_code(ALLWINNER, 1)
+#define __fourcc_mod_amlogic_layout_mask 0xf
+#define __fourcc_mod_amlogic_options_shift 8
+#define __fourcc_mod_amlogic_options_mask 0xf
+#define DRM_FORMAT_MOD_AMLOGIC_FBC(__layout,__options) fourcc_mod_code(AMLOGIC, ((__layout) & __fourcc_mod_amlogic_layout_mask) | (((__options) & __fourcc_mod_amlogic_options_mask) << __fourcc_mod_amlogic_options_shift))
+#define AMLOGIC_FBC_LAYOUT_BASIC (1ULL)
+#define AMLOGIC_FBC_LAYOUT_SCATTER (2ULL)
+#define AMLOGIC_FBC_OPTION_MEM_SAVING (1ULL << 0)
 #ifdef __cplusplus
 }
 #endif
diff --git a/libc/kernel/uapi/linux/audit.h b/libc/kernel/uapi/linux/audit.h
index d7f1e04..2c18e07 100644
--- a/libc/kernel/uapi/linux/audit.h
+++ b/libc/kernel/uapi/linux/audit.h
@@ -248,6 +248,7 @@
 #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010
 #define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020
 #define AUDIT_STATUS_LOST 0x0040
+#define AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL 0x0080
 #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001
 #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002
 #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH 0x00000004
@@ -342,6 +343,7 @@
     __u32 feature_bitmap;
   };
   __u32 backlog_wait_time;
+  __u32 backlog_wait_time_actual;
 };
 struct audit_features {
 #define AUDIT_FEATURE_VERSION 1
diff --git a/libc/kernel/uapi/linux/bcache.h b/libc/kernel/uapi/linux/bcache.h
index 5e5377e..09335c8 100644
--- a/libc/kernel/uapi/linux/bcache.h
+++ b/libc/kernel/uapi/linux/bcache.h
@@ -54,7 +54,9 @@
 #define BCACHE_SB_VERSION_BDEV 1
 #define BCACHE_SB_VERSION_CDEV_WITH_UUID 3
 #define BCACHE_SB_VERSION_BDEV_WITH_OFFSET 4
-#define BCACHE_SB_MAX_VERSION 4
+#define BCACHE_SB_VERSION_CDEV_WITH_FEATURES 5
+#define BCACHE_SB_VERSION_BDEV_WITH_FEATURES 6
+#define BCACHE_SB_MAX_VERSION 6
 #define SB_SECTOR 8
 #define SB_OFFSET (SB_SECTOR << SECTOR_SHIFT)
 #define SB_SIZE 4096
@@ -75,7 +77,10 @@
   __u8 label[SB_LABEL_SIZE];
   __le64 flags;
   __le64 seq;
-  __le64 pad[8];
+  __le64 feature_compat;
+  __le64 feature_incompat;
+  __le64 feature_ro_compat;
+  __le64 pad[5];
   union {
     struct {
       __le64 nbuckets;
@@ -95,9 +100,9 @@
     __le16 keys;
   };
   __le64 d[SB_JOURNAL_BUCKETS];
+  __le16 bucket_size_hi;
 };
 struct cache_sb {
-  __u64 csum;
   __u64 offset;
   __u64 version;
   __u8 magic[16];
@@ -109,14 +114,16 @@
   __u8 label[SB_LABEL_SIZE];
   __u64 flags;
   __u64 seq;
-  __u64 pad[8];
+  __u64 feature_compat;
+  __u64 feature_incompat;
+  __u64 feature_ro_compat;
   union {
     struct {
       __u64 nbuckets;
       __u16 block_size;
-      __u16 bucket_size;
       __u16 nr_in_set;
       __u16 nr_this_dev;
+      __u32 bucket_size;
     };
     struct {
       __u64 data_offset;
diff --git a/libc/kernel/uapi/linux/blkzoned.h b/libc/kernel/uapi/linux/blkzoned.h
index 0b8ddd6..b551e8b 100644
--- a/libc/kernel/uapi/linux/blkzoned.h
+++ b/libc/kernel/uapi/linux/blkzoned.h
@@ -35,6 +35,9 @@
   BLK_ZONE_COND_FULL = 0xE,
   BLK_ZONE_COND_OFFLINE = 0xF,
 };
+enum blk_zone_report_flags {
+  BLK_ZONE_REP_CAPACITY = (1 << 0),
+};
 struct blk_zone {
   __u64 start;
   __u64 len;
@@ -43,12 +46,14 @@
   __u8 cond;
   __u8 non_seq;
   __u8 reset;
-  __u8 reserved[36];
+  __u8 resv[4];
+  __u64 capacity;
+  __u8 reserved[24];
 };
 struct blk_zone_report {
   __u64 sector;
   __u32 nr_zones;
-  __u8 reserved[4];
+  __u32 flags;
   struct blk_zone zones[0];
 };
 struct blk_zone_range {
diff --git a/libc/kernel/uapi/linux/bpf.h b/libc/kernel/uapi/linux/bpf.h
index 54b7849..816871a 100644
--- a/libc/kernel/uapi/linux/bpf.h
+++ b/libc/kernel/uapi/linux/bpf.h
@@ -70,6 +70,11 @@
   __u64 cgroup_inode_id;
   __u32 attach_type;
 };
+union bpf_iter_link_info {
+  struct {
+    __u32 map_fd;
+  } map;
+};
 enum bpf_cmd {
   BPF_MAP_CREATE,
   BPF_MAP_LOOKUP_ELEM,
@@ -105,6 +110,7 @@
   BPF_LINK_GET_NEXT_ID,
   BPF_ENABLE_STATS,
   BPF_ITER_CREATE,
+  BPF_LINK_DETACH,
 };
 enum bpf_map_type {
   BPF_MAP_TYPE_UNSPEC,
@@ -167,6 +173,7 @@
   BPF_PROG_TYPE_STRUCT_OPS,
   BPF_PROG_TYPE_EXT,
   BPF_PROG_TYPE_LSM,
+  BPF_PROG_TYPE_SK_LOOKUP,
 };
 enum bpf_attach_type {
   BPF_CGROUP_INET_INGRESS,
@@ -203,6 +210,10 @@
   BPF_CGROUP_INET4_GETSOCKNAME,
   BPF_CGROUP_INET6_GETSOCKNAME,
   BPF_XDP_DEVMAP,
+  BPF_CGROUP_INET_SOCK_RELEASE,
+  BPF_XDP_CPUMAP,
+  BPF_SK_LOOKUP,
+  BPF_XDP,
   __MAX_BPF_ATTACH_TYPE
 };
 #define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE
@@ -213,6 +224,7 @@
   BPF_LINK_TYPE_CGROUP = 3,
   BPF_LINK_TYPE_ITER = 4,
   BPF_LINK_TYPE_NETNS = 5,
+  BPF_LINK_TYPE_XDP = 6,
   MAX_BPF_LINK_TYPE,
 };
 #define BPF_F_ALLOW_OVERRIDE (1U << 0)
@@ -395,9 +407,14 @@
   } task_fd_query;
   struct {
     __u32 prog_fd;
-    __u32 target_fd;
+    union {
+      __u32 target_fd;
+      __u32 target_ifindex;
+    };
     __u32 attach_type;
     __u32 flags;
+    __aligned_u64 iter_info;
+    __u32 iter_info_len;
   } link_create;
   struct {
     __u32 link_fd;
@@ -406,6 +423,9 @@
     __u32 old_prog_fd;
   } link_update;
   struct {
+    __u32 link_fd;
+  } link_detach;
+  struct {
     __u32 type;
   } enable_stats;
   struct {
@@ -413,7 +433,7 @@
     __u32 flags;
   } iter_create;
 } __attribute__((aligned(8)));
-#define __BPF_FUNC_MAPPER(FN) FN(unspec), FN(map_lookup_elem), FN(map_update_elem), FN(map_delete_elem), FN(probe_read), FN(ktime_get_ns), FN(trace_printk), FN(get_prandom_u32), FN(get_smp_processor_id), FN(skb_store_bytes), FN(l3_csum_replace), FN(l4_csum_replace), FN(tail_call), FN(clone_redirect), FN(get_current_pid_tgid), FN(get_current_uid_gid), FN(get_current_comm), FN(get_cgroup_classid), FN(skb_vlan_push), FN(skb_vlan_pop), FN(skb_get_tunnel_key), FN(skb_set_tunnel_key), FN(perf_event_read), FN(redirect), FN(get_route_realm), FN(perf_event_output), FN(skb_load_bytes), FN(get_stackid), FN(csum_diff), FN(skb_get_tunnel_opt), FN(skb_set_tunnel_opt), FN(skb_change_proto), FN(skb_change_type), FN(skb_under_cgroup), FN(get_hash_recalc), FN(get_current_task), FN(probe_write_user), FN(current_task_under_cgroup), FN(skb_change_tail), FN(skb_pull_data), FN(csum_update), FN(set_hash_invalid), FN(get_numa_node_id), FN(skb_change_head), FN(xdp_adjust_head), FN(probe_read_str), FN(get_socket_cookie), FN(get_socket_uid), FN(set_hash), FN(setsockopt), FN(skb_adjust_room), FN(redirect_map), FN(sk_redirect_map), FN(sock_map_update), FN(xdp_adjust_meta), FN(perf_event_read_value), FN(perf_prog_read_value), FN(getsockopt), FN(override_return), FN(sock_ops_cb_flags_set), FN(msg_redirect_map), FN(msg_apply_bytes), FN(msg_cork_bytes), FN(msg_pull_data), FN(bind), FN(xdp_adjust_tail), FN(skb_get_xfrm_state), FN(get_stack), FN(skb_load_bytes_relative), FN(fib_lookup), FN(sock_hash_update), FN(msg_redirect_hash), FN(sk_redirect_hash), FN(lwt_push_encap), FN(lwt_seg6_store_bytes), FN(lwt_seg6_adjust_srh), FN(lwt_seg6_action), FN(rc_repeat), FN(rc_keydown), FN(skb_cgroup_id), FN(get_current_cgroup_id), FN(get_local_storage), FN(sk_select_reuseport), FN(skb_ancestor_cgroup_id), FN(sk_lookup_tcp), FN(sk_lookup_udp), FN(sk_release), FN(map_push_elem), FN(map_pop_elem), FN(map_peek_elem), FN(msg_push_data), FN(msg_pop_data), FN(rc_pointer_rel), FN(spin_lock), FN(spin_unlock), FN(sk_fullsock), FN(tcp_sock), FN(skb_ecn_set_ce), FN(get_listener_sock), FN(skc_lookup_tcp), FN(tcp_check_syncookie), FN(sysctl_get_name), FN(sysctl_get_current_value), FN(sysctl_get_new_value), FN(sysctl_set_new_value), FN(strtol), FN(strtoul), FN(sk_storage_get), FN(sk_storage_delete), FN(send_signal), FN(tcp_gen_syncookie), FN(skb_output), FN(probe_read_user), FN(probe_read_kernel), FN(probe_read_user_str), FN(probe_read_kernel_str), FN(tcp_send_ack), FN(send_signal_thread), FN(jiffies64), FN(read_branch_records), FN(get_ns_current_pid_tgid), FN(xdp_output), FN(get_netns_cookie), FN(get_current_ancestor_cgroup_id), FN(sk_assign), FN(ktime_get_boot_ns), FN(seq_printf), FN(seq_write), FN(sk_cgroup_id), FN(sk_ancestor_cgroup_id), FN(ringbuf_output), FN(ringbuf_reserve), FN(ringbuf_submit), FN(ringbuf_discard), FN(ringbuf_query), FN(csum_level),
+#define __BPF_FUNC_MAPPER(FN) FN(unspec), FN(map_lookup_elem), FN(map_update_elem), FN(map_delete_elem), FN(probe_read), FN(ktime_get_ns), FN(trace_printk), FN(get_prandom_u32), FN(get_smp_processor_id), FN(skb_store_bytes), FN(l3_csum_replace), FN(l4_csum_replace), FN(tail_call), FN(clone_redirect), FN(get_current_pid_tgid), FN(get_current_uid_gid), FN(get_current_comm), FN(get_cgroup_classid), FN(skb_vlan_push), FN(skb_vlan_pop), FN(skb_get_tunnel_key), FN(skb_set_tunnel_key), FN(perf_event_read), FN(redirect), FN(get_route_realm), FN(perf_event_output), FN(skb_load_bytes), FN(get_stackid), FN(csum_diff), FN(skb_get_tunnel_opt), FN(skb_set_tunnel_opt), FN(skb_change_proto), FN(skb_change_type), FN(skb_under_cgroup), FN(get_hash_recalc), FN(get_current_task), FN(probe_write_user), FN(current_task_under_cgroup), FN(skb_change_tail), FN(skb_pull_data), FN(csum_update), FN(set_hash_invalid), FN(get_numa_node_id), FN(skb_change_head), FN(xdp_adjust_head), FN(probe_read_str), FN(get_socket_cookie), FN(get_socket_uid), FN(set_hash), FN(setsockopt), FN(skb_adjust_room), FN(redirect_map), FN(sk_redirect_map), FN(sock_map_update), FN(xdp_adjust_meta), FN(perf_event_read_value), FN(perf_prog_read_value), FN(getsockopt), FN(override_return), FN(sock_ops_cb_flags_set), FN(msg_redirect_map), FN(msg_apply_bytes), FN(msg_cork_bytes), FN(msg_pull_data), FN(bind), FN(xdp_adjust_tail), FN(skb_get_xfrm_state), FN(get_stack), FN(skb_load_bytes_relative), FN(fib_lookup), FN(sock_hash_update), FN(msg_redirect_hash), FN(sk_redirect_hash), FN(lwt_push_encap), FN(lwt_seg6_store_bytes), FN(lwt_seg6_adjust_srh), FN(lwt_seg6_action), FN(rc_repeat), FN(rc_keydown), FN(skb_cgroup_id), FN(get_current_cgroup_id), FN(get_local_storage), FN(sk_select_reuseport), FN(skb_ancestor_cgroup_id), FN(sk_lookup_tcp), FN(sk_lookup_udp), FN(sk_release), FN(map_push_elem), FN(map_pop_elem), FN(map_peek_elem), FN(msg_push_data), FN(msg_pop_data), FN(rc_pointer_rel), FN(spin_lock), FN(spin_unlock), FN(sk_fullsock), FN(tcp_sock), FN(skb_ecn_set_ce), FN(get_listener_sock), FN(skc_lookup_tcp), FN(tcp_check_syncookie), FN(sysctl_get_name), FN(sysctl_get_current_value), FN(sysctl_get_new_value), FN(sysctl_set_new_value), FN(strtol), FN(strtoul), FN(sk_storage_get), FN(sk_storage_delete), FN(send_signal), FN(tcp_gen_syncookie), FN(skb_output), FN(probe_read_user), FN(probe_read_kernel), FN(probe_read_user_str), FN(probe_read_kernel_str), FN(tcp_send_ack), FN(send_signal_thread), FN(jiffies64), FN(read_branch_records), FN(get_ns_current_pid_tgid), FN(xdp_output), FN(get_netns_cookie), FN(get_current_ancestor_cgroup_id), FN(sk_assign), FN(ktime_get_boot_ns), FN(seq_printf), FN(seq_write), FN(sk_cgroup_id), FN(sk_ancestor_cgroup_id), FN(ringbuf_output), FN(ringbuf_reserve), FN(ringbuf_submit), FN(ringbuf_discard), FN(ringbuf_query), FN(csum_level), FN(skc_to_tcp6_sock), FN(skc_to_tcp_sock), FN(skc_to_tcp_timewait_sock), FN(skc_to_tcp_request_sock), FN(skc_to_udp6_sock), FN(get_task_stack),
 #define __BPF_ENUM_FN(x) BPF_FUNC_ ##x
 enum bpf_func_id {
   __BPF_FUNC_MAPPER(__BPF_ENUM_FN) __BPF_FUNC_MAX_ID,
@@ -500,6 +520,10 @@
   BPF_RINGBUF_DISCARD_BIT = (1U << 30),
   BPF_RINGBUF_HDR_SZ = 8,
 };
+enum {
+  BPF_SK_LOOKUP_F_REPLACE = (1ULL << 0),
+  BPF_SK_LOOKUP_F_NO_REUSEPORT = (1ULL << 1),
+};
 enum bpf_adj_room_mode {
   BPF_ADJ_ROOM_NET,
   BPF_ADJ_ROOM_MAC,
@@ -662,6 +686,13 @@
     __u32 id;
   } bpf_prog;
 };
+struct bpf_cpumap_val {
+  __u32 qsize;
+  union {
+    int fd;
+    __u32 id;
+  } bpf_prog;
+};
 enum sk_action {
   SK_DROP = 0,
   SK_PASS,
@@ -767,6 +798,9 @@
       __u32 netns_ino;
       __u32 attach_type;
     } netns;
+    struct {
+      __u32 ifindex;
+    } xdp;
   };
 } __attribute__((aligned(8)));
 struct bpf_sock_addr {
@@ -995,4 +1029,15 @@
   __u32 pid;
   __u32 tgid;
 };
+struct bpf_sk_lookup {
+  __bpf_md_ptr(struct bpf_sock *, sk);
+  __u32 family;
+  __u32 protocol;
+  __u32 remote_ip4;
+  __u32 remote_ip6[4];
+  __u32 remote_port;
+  __u32 local_ip4;
+  __u32 local_ip6[4];
+  __u32 local_port;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/btrfs.h b/libc/kernel/uapi/linux/btrfs.h
index 45e5572..cfeef2a 100644
--- a/libc/kernel/uapi/linux/btrfs.h
+++ b/libc/kernel/uapi/linux/btrfs.h
@@ -156,6 +156,9 @@
   __u64 unused[379];
   __u8 path[BTRFS_DEVICE_PATH_NAME_MAX];
 };
+#define BTRFS_FS_INFO_FLAG_CSUM_INFO (1 << 0)
+#define BTRFS_FS_INFO_FLAG_GENERATION (1 << 1)
+#define BTRFS_FS_INFO_FLAG_METADATA_UUID (1 << 2)
 struct btrfs_ioctl_fs_info_args {
   __u64 max_id;
   __u64 num_devices;
@@ -163,8 +166,12 @@
   __u32 nodesize;
   __u32 sectorsize;
   __u32 clone_alignment;
-  __u32 reserved32;
-  __u64 reserved[122];
+  __u16 csum_type;
+  __u16 csum_size;
+  __u64 flags;
+  __u64 generation;
+  __u8 metadata_uuid[BTRFS_FSID_SIZE];
+  __u8 reserved[944];
 };
 #define BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE (1ULL << 0)
 #define BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE_VALID (1ULL << 1)
diff --git a/libc/kernel/uapi/linux/capability.h b/libc/kernel/uapi/linux/capability.h
index b830fd6..958e6ab 100644
--- a/libc/kernel/uapi/linux/capability.h
+++ b/libc/kernel/uapi/linux/capability.h
@@ -107,7 +107,8 @@
 #define CAP_AUDIT_READ 37
 #define CAP_PERFMON 38
 #define CAP_BPF 39
-#define CAP_LAST_CAP CAP_BPF
+#define CAP_CHECKPOINT_RESTORE 40
+#define CAP_LAST_CAP CAP_CHECKPOINT_RESTORE
 #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
 #define CAP_TO_INDEX(x) ((x) >> 5)
 #define CAP_TO_MASK(x) (1 << ((x) & 31))
diff --git a/libc/kernel/uapi/linux/close_range.h b/libc/kernel/uapi/linux/close_range.h
new file mode 100644
index 0000000..de4135e
--- /dev/null
+++ b/libc/kernel/uapi/linux/close_range.h
@@ -0,0 +1,22 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef _UAPI_LINUX_CLOSE_RANGE_H
+#define _UAPI_LINUX_CLOSE_RANGE_H
+#define CLOSE_RANGE_UNSHARE (1U << 1)
+#endif
diff --git a/libc/kernel/uapi/linux/coresight-stm.h b/libc/kernel/uapi/linux/coresight-stm.h
index 9d89dd6..86d80ca 100644
--- a/libc/kernel/uapi/linux/coresight-stm.h
+++ b/libc/kernel/uapi/linux/coresight-stm.h
@@ -20,6 +20,7 @@
 #define __UAPI_CORESIGHT_STM_H_
 #include <linux/const.h>
 #define STM_FLAG_TIMESTAMPED _BITUL(3)
+#define STM_FLAG_MARKED _BITUL(4)
 #define STM_FLAG_GUARANTEED _BITUL(7)
 enum {
   STM_OPTION_GUARANTEED = 0,
diff --git a/libc/kernel/uapi/linux/devlink.h b/libc/kernel/uapi/linux/devlink.h
index 7730a45..9b4d104 100644
--- a/libc/kernel/uapi/linux/devlink.h
+++ b/libc/kernel/uapi/linux/devlink.h
@@ -323,6 +323,10 @@
   DEVLINK_ATTR_TRAP_POLICER_ID,
   DEVLINK_ATTR_TRAP_POLICER_RATE,
   DEVLINK_ATTR_TRAP_POLICER_BURST,
+  DEVLINK_ATTR_PORT_FUNCTION,
+  DEVLINK_ATTR_INFO_BOARD_SERIAL_NUMBER,
+  DEVLINK_ATTR_PORT_LANES,
+  DEVLINK_ATTR_PORT_SPLITTABLE,
   __DEVLINK_ATTR_MAX,
   DEVLINK_ATTR_MAX = __DEVLINK_ATTR_MAX - 1
 };
@@ -353,4 +357,10 @@
 enum devlink_resource_unit {
   DEVLINK_RESOURCE_UNIT_ENTRY,
 };
+enum devlink_port_function_attr {
+  DEVLINK_PORT_FUNCTION_ATTR_UNSPEC,
+  DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR,
+  __DEVLINK_PORT_FUNCTION_ATTR_MAX,
+  DEVLINK_PORT_FUNCTION_ATTR_MAX = __DEVLINK_PORT_FUNCTION_ATTR_MAX - 1
+};
 #endif
diff --git a/libc/kernel/uapi/linux/elfcore.h b/libc/kernel/uapi/linux/elfcore.h
deleted file mode 100644
index a1df1ff..0000000
--- a/libc/kernel/uapi/linux/elfcore.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/****************************************************************************
- ****************************************************************************
- ***
- ***   This header was automatically generated from a Linux kernel header
- ***   of the same name, to make information necessary for userspace to
- ***   call into the kernel available to libc.  It contains only constants,
- ***   structures, and macros generated from the original header, and thus,
- ***   contains no copyrightable information.
- ***
- ***   To edit the content of this header, modify the corresponding
- ***   source file (e.g. under external/kernel-headers/original/) then
- ***   run bionic/libc/kernel/tools/update_all.py
- ***
- ***   Any manual change here will be lost the next time this script will
- ***   be run. You've been warned!
- ***
- ****************************************************************************
- ****************************************************************************/
-#ifndef _UAPI_LINUX_ELFCORE_H
-#define _UAPI_LINUX_ELFCORE_H
-#include <linux/types.h>
-#include <linux/signal.h>
-#include <linux/time.h>
-#include <linux/ptrace.h>
-#include <linux/elf.h>
-#include <linux/fs.h>
-struct elf_siginfo {
-  int si_signo;
-  int si_code;
-  int si_errno;
-};
-typedef elf_greg_t greg_t;
-typedef elf_gregset_t gregset_t;
-typedef elf_fpregset_t fpregset_t;
-typedef elf_fpxregset_t fpxregset_t;
-#define NGREG ELF_NGREG
-struct elf_prstatus {
-  struct elf_siginfo pr_info;
-  short pr_cursig;
-  unsigned long pr_sigpend;
-  unsigned long pr_sighold;
-  pid_t pr_pid;
-  pid_t pr_ppid;
-  pid_t pr_pgrp;
-  pid_t pr_sid;
-  struct timeval pr_utime;
-  struct timeval pr_stime;
-  struct timeval pr_cutime;
-  struct timeval pr_cstime;
-  elf_gregset_t pr_reg;
-  int pr_fpvalid;
-};
-#define ELF_PRARGSZ (80)
-struct elf_prpsinfo {
-  char pr_state;
-  char pr_sname;
-  char pr_zomb;
-  char pr_nice;
-  unsigned long pr_flag;
-  __kernel_uid_t pr_uid;
-  __kernel_gid_t pr_gid;
-  pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
-  char pr_fname[16];
-  char pr_psargs[ELF_PRARGSZ];
-};
-typedef struct elf_prstatus prstatus_t;
-typedef struct elf_prpsinfo prpsinfo_t;
-#define PRARGSZ ELF_PRARGSZ
-#endif
diff --git a/libc/kernel/uapi/linux/errqueue.h b/libc/kernel/uapi/linux/errqueue.h
index 7959d2b..e93bad2 100644
--- a/libc/kernel/uapi/linux/errqueue.h
+++ b/libc/kernel/uapi/linux/errqueue.h
@@ -20,6 +20,11 @@
 #define _UAPI_LINUX_ERRQUEUE_H
 #include <linux/types.h>
 #include <linux/time_types.h>
+struct sock_ee_data_rfc4884 {
+  __u16 len;
+  __u8 flags;
+  __u8 reserved;
+};
 struct sock_extended_err {
   __u32 ee_errno;
   __u8 ee_origin;
@@ -27,7 +32,10 @@
   __u8 ee_code;
   __u8 ee_pad;
   __u32 ee_info;
-  __u32 ee_data;
+  union {
+    __u32 ee_data;
+    struct sock_ee_data_rfc4884 ee_rfc4884;
+  };
 };
 #define SO_EE_ORIGIN_NONE 0
 #define SO_EE_ORIGIN_LOCAL 1
@@ -41,6 +49,7 @@
 #define SO_EE_CODE_ZEROCOPY_COPIED 1
 #define SO_EE_CODE_TXTIME_INVALID_PARAM 1
 #define SO_EE_CODE_TXTIME_MISSED 2
+#define SO_EE_RFC4884_FLAG_INVALID 1
 struct scm_timestamping {
   struct timespec ts[3];
 };
diff --git a/libc/kernel/uapi/linux/ethtool.h b/libc/kernel/uapi/linux/ethtool.h
index 9f8678a..3a2737a 100644
--- a/libc/kernel/uapi/linux/ethtool.h
+++ b/libc/kernel/uapi/linux/ethtool.h
@@ -196,6 +196,47 @@
   __u32 rx_pause;
   __u32 tx_pause;
 };
+enum ethtool_link_ext_state {
+  ETHTOOL_LINK_EXT_STATE_AUTONEG,
+  ETHTOOL_LINK_EXT_STATE_LINK_TRAINING_FAILURE,
+  ETHTOOL_LINK_EXT_STATE_LINK_LOGICAL_MISMATCH,
+  ETHTOOL_LINK_EXT_STATE_BAD_SIGNAL_INTEGRITY,
+  ETHTOOL_LINK_EXT_STATE_NO_CABLE,
+  ETHTOOL_LINK_EXT_STATE_CABLE_ISSUE,
+  ETHTOOL_LINK_EXT_STATE_EEPROM_ISSUE,
+  ETHTOOL_LINK_EXT_STATE_CALIBRATION_FAILURE,
+  ETHTOOL_LINK_EXT_STATE_POWER_BUDGET_EXCEEDED,
+  ETHTOOL_LINK_EXT_STATE_OVERHEAT,
+};
+enum ethtool_link_ext_substate_autoneg {
+  ETHTOOL_LINK_EXT_SUBSTATE_AN_NO_PARTNER_DETECTED = 1,
+  ETHTOOL_LINK_EXT_SUBSTATE_AN_ACK_NOT_RECEIVED,
+  ETHTOOL_LINK_EXT_SUBSTATE_AN_NEXT_PAGE_EXCHANGE_FAILED,
+  ETHTOOL_LINK_EXT_SUBSTATE_AN_NO_PARTNER_DETECTED_FORCE_MODE,
+  ETHTOOL_LINK_EXT_SUBSTATE_AN_FEC_MISMATCH_DURING_OVERRIDE,
+  ETHTOOL_LINK_EXT_SUBSTATE_AN_NO_HCD,
+};
+enum ethtool_link_ext_substate_link_training {
+  ETHTOOL_LINK_EXT_SUBSTATE_LT_KR_FRAME_LOCK_NOT_ACQUIRED = 1,
+  ETHTOOL_LINK_EXT_SUBSTATE_LT_KR_LINK_INHIBIT_TIMEOUT,
+  ETHTOOL_LINK_EXT_SUBSTATE_LT_KR_LINK_PARTNER_DID_NOT_SET_RECEIVER_READY,
+  ETHTOOL_LINK_EXT_SUBSTATE_LT_REMOTE_FAULT,
+};
+enum ethtool_link_ext_substate_link_logical_mismatch {
+  ETHTOOL_LINK_EXT_SUBSTATE_LLM_PCS_DID_NOT_ACQUIRE_BLOCK_LOCK = 1,
+  ETHTOOL_LINK_EXT_SUBSTATE_LLM_PCS_DID_NOT_ACQUIRE_AM_LOCK,
+  ETHTOOL_LINK_EXT_SUBSTATE_LLM_PCS_DID_NOT_GET_ALIGN_STATUS,
+  ETHTOOL_LINK_EXT_SUBSTATE_LLM_FC_FEC_IS_NOT_LOCKED,
+  ETHTOOL_LINK_EXT_SUBSTATE_LLM_RS_FEC_IS_NOT_LOCKED,
+};
+enum ethtool_link_ext_substate_bad_signal_integrity {
+  ETHTOOL_LINK_EXT_SUBSTATE_BSI_LARGE_NUMBER_OF_PHYSICAL_ERRORS = 1,
+  ETHTOOL_LINK_EXT_SUBSTATE_BSI_UNSUPPORTED_RATE,
+};
+enum ethtool_link_ext_substate_cable_issue {
+  ETHTOOL_LINK_EXT_SUBSTATE_CI_UNSUPPORTED_CABLE = 1,
+  ETHTOOL_LINK_EXT_SUBSTATE_CI_CABLE_TEST_FAILURE,
+};
 #define ETH_GSTRING_LEN 32
 enum ethtool_stringset {
   ETH_SS_TEST = 0,
@@ -213,6 +254,7 @@
   ETH_SS_SOF_TIMESTAMPING,
   ETH_SS_TS_TX_TYPES,
   ETH_SS_TS_RX_FILTERS,
+  ETH_SS_UDP_TUNNEL_TYPES,
   ETH_SS_COUNT
 };
 struct ethtool_gstrings {
@@ -625,6 +667,21 @@
   ETHTOOL_LINK_MODE_400000baseDR8_Full_BIT = 72,
   ETHTOOL_LINK_MODE_400000baseCR8_Full_BIT = 73,
   ETHTOOL_LINK_MODE_FEC_LLRS_BIT = 74,
+  ETHTOOL_LINK_MODE_100000baseKR_Full_BIT = 75,
+  ETHTOOL_LINK_MODE_100000baseSR_Full_BIT = 76,
+  ETHTOOL_LINK_MODE_100000baseLR_ER_FR_Full_BIT = 77,
+  ETHTOOL_LINK_MODE_100000baseCR_Full_BIT = 78,
+  ETHTOOL_LINK_MODE_100000baseDR_Full_BIT = 79,
+  ETHTOOL_LINK_MODE_200000baseKR2_Full_BIT = 80,
+  ETHTOOL_LINK_MODE_200000baseSR2_Full_BIT = 81,
+  ETHTOOL_LINK_MODE_200000baseLR2_ER2_FR2_Full_BIT = 82,
+  ETHTOOL_LINK_MODE_200000baseDR2_Full_BIT = 83,
+  ETHTOOL_LINK_MODE_200000baseCR2_Full_BIT = 84,
+  ETHTOOL_LINK_MODE_400000baseKR4_Full_BIT = 85,
+  ETHTOOL_LINK_MODE_400000baseSR4_Full_BIT = 86,
+  ETHTOOL_LINK_MODE_400000baseLR4_ER4_FR4_Full_BIT = 87,
+  ETHTOOL_LINK_MODE_400000baseDR4_Full_BIT = 88,
+  ETHTOOL_LINK_MODE_400000baseCR4_Full_BIT = 89,
   __ETHTOOL_LINK_MODE_MASK_NBITS
 };
 #define __ETHTOOL_LINK_MODE_LEGACY_MASK(base_name) (1UL << (ETHTOOL_LINK_MODE_ ##base_name ##_BIT))
diff --git a/libc/kernel/uapi/linux/ethtool_netlink.h b/libc/kernel/uapi/linux/ethtool_netlink.h
index 868d3c6..da4fb46 100644
--- a/libc/kernel/uapi/linux/ethtool_netlink.h
+++ b/libc/kernel/uapi/linux/ethtool_netlink.h
@@ -48,6 +48,7 @@
   ETHTOOL_MSG_TSINFO_GET,
   ETHTOOL_MSG_CABLE_TEST_ACT,
   ETHTOOL_MSG_CABLE_TEST_TDR_ACT,
+  ETHTOOL_MSG_TUNNEL_INFO_GET,
   __ETHTOOL_MSG_USER_CNT,
   ETHTOOL_MSG_USER_MAX = __ETHTOOL_MSG_USER_CNT - 1
 };
@@ -81,6 +82,7 @@
   ETHTOOL_MSG_TSINFO_GET_REPLY,
   ETHTOOL_MSG_CABLE_TEST_NTF,
   ETHTOOL_MSG_CABLE_TEST_TDR_NTF,
+  ETHTOOL_MSG_TUNNEL_INFO_GET_REPLY,
   __ETHTOOL_MSG_KERNEL_CNT,
   ETHTOOL_MSG_KERNEL_MAX = __ETHTOOL_MSG_KERNEL_CNT - 1
 };
@@ -184,6 +186,8 @@
   ETHTOOL_A_LINKSTATE_LINK,
   ETHTOOL_A_LINKSTATE_SQI,
   ETHTOOL_A_LINKSTATE_SQI_MAX,
+  ETHTOOL_A_LINKSTATE_EXT_STATE,
+  ETHTOOL_A_LINKSTATE_EXT_SUBSTATE,
   __ETHTOOL_A_LINKSTATE_CNT,
   ETHTOOL_A_LINKSTATE_MAX = __ETHTOOL_A_LINKSTATE_CNT - 1
 };
@@ -412,6 +416,40 @@
   __ETHTOOL_A_CABLE_TEST_TDR_NTF_CNT,
   ETHTOOL_A_CABLE_TEST_TDR_NTF_MAX = __ETHTOOL_A_CABLE_TEST_TDR_NTF_CNT - 1
 };
+enum {
+  ETHTOOL_UDP_TUNNEL_TYPE_VXLAN,
+  ETHTOOL_UDP_TUNNEL_TYPE_GENEVE,
+  ETHTOOL_UDP_TUNNEL_TYPE_VXLAN_GPE,
+  __ETHTOOL_UDP_TUNNEL_TYPE_CNT
+};
+enum {
+  ETHTOOL_A_TUNNEL_UDP_ENTRY_UNSPEC,
+  ETHTOOL_A_TUNNEL_UDP_ENTRY_PORT,
+  ETHTOOL_A_TUNNEL_UDP_ENTRY_TYPE,
+  __ETHTOOL_A_TUNNEL_UDP_ENTRY_CNT,
+  ETHTOOL_A_TUNNEL_UDP_ENTRY_MAX = (__ETHTOOL_A_TUNNEL_UDP_ENTRY_CNT - 1)
+};
+enum {
+  ETHTOOL_A_TUNNEL_UDP_TABLE_UNSPEC,
+  ETHTOOL_A_TUNNEL_UDP_TABLE_SIZE,
+  ETHTOOL_A_TUNNEL_UDP_TABLE_TYPES,
+  ETHTOOL_A_TUNNEL_UDP_TABLE_ENTRY,
+  __ETHTOOL_A_TUNNEL_UDP_TABLE_CNT,
+  ETHTOOL_A_TUNNEL_UDP_TABLE_MAX = (__ETHTOOL_A_TUNNEL_UDP_TABLE_CNT - 1)
+};
+enum {
+  ETHTOOL_A_TUNNEL_UDP_UNSPEC,
+  ETHTOOL_A_TUNNEL_UDP_TABLE,
+  __ETHTOOL_A_TUNNEL_UDP_CNT,
+  ETHTOOL_A_TUNNEL_UDP_MAX = (__ETHTOOL_A_TUNNEL_UDP_CNT - 1)
+};
+enum {
+  ETHTOOL_A_TUNNEL_INFO_UNSPEC,
+  ETHTOOL_A_TUNNEL_INFO_HEADER,
+  ETHTOOL_A_TUNNEL_INFO_UDP_PORTS,
+  __ETHTOOL_A_TUNNEL_INFO_CNT,
+  ETHTOOL_A_TUNNEL_INFO_MAX = (__ETHTOOL_A_TUNNEL_INFO_CNT - 1)
+};
 #define ETHTOOL_GENL_NAME "ethtool"
 #define ETHTOOL_GENL_VERSION 1
 #define ETHTOOL_MCGRP_MONITOR_NAME "monitor"
diff --git a/libc/kernel/uapi/linux/fanotify.h b/libc/kernel/uapi/linux/fanotify.h
index 8f9bea6..c63d058 100644
--- a/libc/kernel/uapi/linux/fanotify.h
+++ b/libc/kernel/uapi/linux/fanotify.h
@@ -36,7 +36,6 @@
 #define FAN_OPEN_PERM 0x00010000
 #define FAN_ACCESS_PERM 0x00020000
 #define FAN_OPEN_EXEC_PERM 0x00040000
-#define FAN_DIR_MODIFY 0x00080000
 #define FAN_EVENT_ON_CHILD 0x08000000
 #define FAN_ONDIR 0x40000000
 #define FAN_CLOSE (FAN_CLOSE_WRITE | FAN_CLOSE_NOWRITE)
@@ -52,6 +51,9 @@
 #define FAN_ENABLE_AUDIT 0x00000040
 #define FAN_REPORT_TID 0x00000100
 #define FAN_REPORT_FID 0x00000200
+#define FAN_REPORT_DIR_FID 0x00000400
+#define FAN_REPORT_NAME 0x00000800
+#define FAN_REPORT_DFID_NAME (FAN_REPORT_DIR_FID | FAN_REPORT_NAME)
 #define FAN_ALL_INIT_FLAGS (FAN_CLOEXEC | FAN_NONBLOCK | FAN_ALL_CLASS_BITS | FAN_UNLIMITED_QUEUE | FAN_UNLIMITED_MARKS)
 #define FAN_MARK_ADD 0x00000001
 #define FAN_MARK_REMOVE 0x00000002
@@ -79,6 +81,7 @@
 };
 #define FAN_EVENT_INFO_TYPE_FID 1
 #define FAN_EVENT_INFO_TYPE_DFID_NAME 2
+#define FAN_EVENT_INFO_TYPE_DFID 3
 struct fanotify_event_info_header {
   __u8 info_type;
   __u8 pad;
diff --git a/libc/kernel/uapi/linux/fpga-dfl.h b/libc/kernel/uapi/linux/fpga-dfl.h
index 8712e4c..54b93d0 100644
--- a/libc/kernel/uapi/linux/fpga-dfl.h
+++ b/libc/kernel/uapi/linux/fpga-dfl.h
@@ -63,6 +63,15 @@
   __u64 iova;
 };
 #define DFL_FPGA_PORT_DMA_UNMAP _IO(DFL_FPGA_MAGIC, DFL_PORT_BASE + 4)
+struct dfl_fpga_irq_set {
+  __u32 start;
+  __u32 count;
+  __s32 evtfds[];
+};
+#define DFL_FPGA_PORT_ERR_GET_IRQ_NUM _IOR(DFL_FPGA_MAGIC, DFL_PORT_BASE + 5, __u32)
+#define DFL_FPGA_PORT_ERR_SET_IRQ _IOW(DFL_FPGA_MAGIC, DFL_PORT_BASE + 6, struct dfl_fpga_irq_set)
+#define DFL_FPGA_PORT_UINT_GET_IRQ_NUM _IOR(DFL_FPGA_MAGIC, DFL_PORT_BASE + 7, __u32)
+#define DFL_FPGA_PORT_UINT_SET_IRQ _IOW(DFL_FPGA_MAGIC, DFL_PORT_BASE + 8, struct dfl_fpga_irq_set)
 struct dfl_fpga_fme_port_pr {
   __u32 argsz;
   __u32 flags;
@@ -73,4 +82,6 @@
 #define DFL_FPGA_FME_PORT_PR _IO(DFL_FPGA_MAGIC, DFL_FME_BASE + 0)
 #define DFL_FPGA_FME_PORT_RELEASE _IOW(DFL_FPGA_MAGIC, DFL_FME_BASE + 1, int)
 #define DFL_FPGA_FME_PORT_ASSIGN _IOW(DFL_FPGA_MAGIC, DFL_FME_BASE + 2, int)
+#define DFL_FPGA_FME_ERR_GET_IRQ_NUM _IOR(DFL_FPGA_MAGIC, DFL_FME_BASE + 3, __u32)
+#define DFL_FPGA_FME_ERR_SET_IRQ _IOW(DFL_FPGA_MAGIC, DFL_FME_BASE + 4, struct dfl_fpga_irq_set)
 #endif
diff --git a/libc/kernel/uapi/linux/icmp.h b/libc/kernel/uapi/linux/icmp.h
index 03aa087..5892d12 100644
--- a/libc/kernel/uapi/linux/icmp.h
+++ b/libc/kernel/uapi/linux/icmp.h
@@ -19,6 +19,7 @@
 #ifndef _UAPI_LINUX_ICMP_H
 #define _UAPI_LINUX_ICMP_H
 #include <linux/types.h>
+#include <asm/byteorder.h>
 #define ICMP_ECHOREPLY 0
 #define ICMP_DEST_UNREACH 3
 #define ICMP_SOURCE_QUENCH 4
@@ -77,4 +78,20 @@
 struct icmp_filter {
   __u32 data;
 };
+struct icmp_ext_hdr {
+#ifdef __LITTLE_ENDIAN_BITFIELD
+  __u8 reserved1 : 4, version : 4;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+  __u8 version : 4, reserved1 : 4;
+#else
+#error "Please fix <asm/byteorder.h>"
+#endif
+  __u8 reserved2;
+  __sum16 checksum;
+};
+struct icmp_extobj_hdr {
+  __be16 length;
+  __u8 class_num;
+  __u8 class_type;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/icmpv6.h b/libc/kernel/uapi/linux/icmpv6.h
index 798a945..38c30cf 100644
--- a/libc/kernel/uapi/linux/icmpv6.h
+++ b/libc/kernel/uapi/linux/icmpv6.h
@@ -59,6 +59,7 @@
 #define icmp6_mtu icmp6_dataun.un_data32[0]
 #define icmp6_unused icmp6_dataun.un_data32[0]
 #define icmp6_maxdelay icmp6_dataun.un_data16[0]
+#define icmp6_datagram_len icmp6_dataun.un_data8[0]
 #define icmp6_router icmp6_dataun.u_nd_advt.router
 #define icmp6_solicited icmp6_dataun.u_nd_advt.solicited
 #define icmp6_override icmp6_dataun.u_nd_advt.override
diff --git a/libc/kernel/uapi/linux/idxd.h b/libc/kernel/uapi/linux/idxd.h
index 3c8492e..74cdabd 100644
--- a/libc/kernel/uapi/linux/idxd.h
+++ b/libc/kernel/uapi/linux/idxd.h
@@ -172,6 +172,10 @@
   uint32_t bytes_completed;
   uint64_t fault_addr;
   union {
+    struct {
+      uint32_t invalid_flags : 24;
+      uint32_t rsvd2 : 8;
+    };
     uint16_t delta_rec_size;
     uint16_t crc_val;
     struct {
diff --git a/libc/kernel/uapi/linux/if_bridge.h b/libc/kernel/uapi/linux/if_bridge.h
index 2c72ddf..aa12dea 100644
--- a/libc/kernel/uapi/linux/if_bridge.h
+++ b/libc/kernel/uapi/linux/if_bridge.h
@@ -146,6 +146,10 @@
   IFLA_BRIDGE_MRP_RING_STATE,
   IFLA_BRIDGE_MRP_RING_ROLE,
   IFLA_BRIDGE_MRP_START_TEST,
+  IFLA_BRIDGE_MRP_INFO,
+  IFLA_BRIDGE_MRP_IN_ROLE,
+  IFLA_BRIDGE_MRP_IN_STATE,
+  IFLA_BRIDGE_MRP_START_IN_TEST,
   __IFLA_BRIDGE_MRP_MAX,
 };
 #define IFLA_BRIDGE_MRP_MAX (__IFLA_BRIDGE_MRP_MAX - 1)
@@ -194,6 +198,50 @@
   __IFLA_BRIDGE_MRP_START_TEST_MAX,
 };
 #define IFLA_BRIDGE_MRP_START_TEST_MAX (__IFLA_BRIDGE_MRP_START_TEST_MAX - 1)
+enum {
+  IFLA_BRIDGE_MRP_INFO_UNSPEC,
+  IFLA_BRIDGE_MRP_INFO_RING_ID,
+  IFLA_BRIDGE_MRP_INFO_P_IFINDEX,
+  IFLA_BRIDGE_MRP_INFO_S_IFINDEX,
+  IFLA_BRIDGE_MRP_INFO_PRIO,
+  IFLA_BRIDGE_MRP_INFO_RING_STATE,
+  IFLA_BRIDGE_MRP_INFO_RING_ROLE,
+  IFLA_BRIDGE_MRP_INFO_TEST_INTERVAL,
+  IFLA_BRIDGE_MRP_INFO_TEST_MAX_MISS,
+  IFLA_BRIDGE_MRP_INFO_TEST_MONITOR,
+  IFLA_BRIDGE_MRP_INFO_I_IFINDEX,
+  IFLA_BRIDGE_MRP_INFO_IN_STATE,
+  IFLA_BRIDGE_MRP_INFO_IN_ROLE,
+  IFLA_BRIDGE_MRP_INFO_IN_TEST_INTERVAL,
+  IFLA_BRIDGE_MRP_INFO_IN_TEST_MAX_MISS,
+  __IFLA_BRIDGE_MRP_INFO_MAX,
+};
+#define IFLA_BRIDGE_MRP_INFO_MAX (__IFLA_BRIDGE_MRP_INFO_MAX - 1)
+enum {
+  IFLA_BRIDGE_MRP_IN_STATE_UNSPEC,
+  IFLA_BRIDGE_MRP_IN_STATE_IN_ID,
+  IFLA_BRIDGE_MRP_IN_STATE_STATE,
+  __IFLA_BRIDGE_MRP_IN_STATE_MAX,
+};
+#define IFLA_BRIDGE_MRP_IN_STATE_MAX (__IFLA_BRIDGE_MRP_IN_STATE_MAX - 1)
+enum {
+  IFLA_BRIDGE_MRP_IN_ROLE_UNSPEC,
+  IFLA_BRIDGE_MRP_IN_ROLE_RING_ID,
+  IFLA_BRIDGE_MRP_IN_ROLE_IN_ID,
+  IFLA_BRIDGE_MRP_IN_ROLE_ROLE,
+  IFLA_BRIDGE_MRP_IN_ROLE_I_IFINDEX,
+  __IFLA_BRIDGE_MRP_IN_ROLE_MAX,
+};
+#define IFLA_BRIDGE_MRP_IN_ROLE_MAX (__IFLA_BRIDGE_MRP_IN_ROLE_MAX - 1)
+enum {
+  IFLA_BRIDGE_MRP_START_IN_TEST_UNSPEC,
+  IFLA_BRIDGE_MRP_START_IN_TEST_IN_ID,
+  IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL,
+  IFLA_BRIDGE_MRP_START_IN_TEST_MAX_MISS,
+  IFLA_BRIDGE_MRP_START_IN_TEST_PERIOD,
+  __IFLA_BRIDGE_MRP_START_IN_TEST_MAX,
+};
+#define IFLA_BRIDGE_MRP_START_IN_TEST_MAX (__IFLA_BRIDGE_MRP_START_IN_TEST_MAX - 1)
 struct br_mrp_instance {
   __u32 ring_id;
   __u32 p_ifindex;
@@ -215,6 +263,22 @@
   __u32 period;
   __u32 monitor;
 };
+struct br_mrp_in_state {
+  __u32 in_state;
+  __u16 in_id;
+};
+struct br_mrp_in_role {
+  __u32 ring_id;
+  __u32 in_role;
+  __u32 i_ifindex;
+  __u16 in_id;
+};
+struct br_mrp_start_in_test {
+  __u32 interval;
+  __u32 max_miss;
+  __u32 period;
+  __u16 in_id;
+};
 struct bridge_stp_xstats {
   __u64 transition_blk;
   __u64 transition_fwd;
diff --git a/libc/kernel/uapi/linux/if_link.h b/libc/kernel/uapi/linux/if_link.h
index b248a6b..1b4683e 100644
--- a/libc/kernel/uapi/linux/if_link.h
+++ b/libc/kernel/uapi/linux/if_link.h
@@ -147,9 +147,17 @@
   IFLA_PROP_LIST,
   IFLA_ALT_IFNAME,
   IFLA_PERM_ADDRESS,
+  IFLA_PROTO_DOWN_REASON,
   __IFLA_MAX
 };
 #define IFLA_MAX (__IFLA_MAX - 1)
+enum {
+  IFLA_PROTO_DOWN_REASON_UNSPEC,
+  IFLA_PROTO_DOWN_REASON_MASK,
+  IFLA_PROTO_DOWN_REASON_VALUE,
+  __IFLA_PROTO_DOWN_REASON_CNT,
+  IFLA_PROTO_DOWN_REASON_MAX = __IFLA_PROTO_DOWN_REASON_CNT - 1
+};
 #define IFLA_RTA(r) ((struct rtattr *) (((char *) (r)) + NLMSG_ALIGN(sizeof(struct ifinfomsg))))
 #define IFLA_PAYLOAD(n) NLMSG_PAYLOAD(n, sizeof(struct ifinfomsg))
 enum {
@@ -273,6 +281,7 @@
   IFLA_BRPORT_ISOLATED,
   IFLA_BRPORT_BACKUP_PORT,
   IFLA_BRPORT_MRP_RING_OPEN,
+  IFLA_BRPORT_MRP_IN_OPEN,
   __IFLA_BRPORT_MAX
 };
 #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
@@ -721,6 +730,11 @@
 };
 #define IFLA_IPOIB_MAX (__IFLA_IPOIB_MAX - 1)
 enum {
+  HSR_PROTOCOL_HSR,
+  HSR_PROTOCOL_PRP,
+  HSR_PROTOCOL_MAX,
+};
+enum {
   IFLA_HSR_UNSPEC,
   IFLA_HSR_SLAVE1,
   IFLA_HSR_SLAVE2,
@@ -728,6 +742,7 @@
   IFLA_HSR_SUPERVISION_ADDR,
   IFLA_HSR_SEQ_NR,
   IFLA_HSR_VERSION,
+  IFLA_HSR_PROTOCOL,
   __IFLA_HSR_MAX,
 };
 #define IFLA_HSR_MAX (__IFLA_HSR_MAX - 1)
diff --git a/libc/kernel/uapi/linux/if_xdp.h b/libc/kernel/uapi/linux/if_xdp.h
index 3615edb..d2b6bfd 100644
--- a/libc/kernel/uapi/linux/if_xdp.h
+++ b/libc/kernel/uapi/linux/if_xdp.h
@@ -63,6 +63,9 @@
   __u64 rx_dropped;
   __u64 rx_invalid_descs;
   __u64 tx_invalid_descs;
+  __u64 rx_ring_full;
+  __u64 rx_fill_ring_empty_descs;
+  __u64 tx_ring_empty_descs;
 };
 struct xdp_options {
   __u32 flags;
diff --git a/libc/kernel/uapi/linux/in.h b/libc/kernel/uapi/linux/in.h
index 99b54cc..e5437ca 100644
--- a/libc/kernel/uapi/linux/in.h
+++ b/libc/kernel/uapi/linux/in.h
@@ -112,6 +112,7 @@
 #define IP_CHECKSUM 23
 #define IP_BIND_ADDRESS_NO_PORT 24
 #define IP_RECVFRAGSIZE 25
+#define IP_RECVERR_RFC4884 26
 #define IP_PMTUDISC_DONT 0
 #define IP_PMTUDISC_WANT 1
 #define IP_PMTUDISC_DO 2
diff --git a/libc/kernel/uapi/linux/in6.h b/libc/kernel/uapi/linux/in6.h
index 2eb64d0..8dd3238 100644
--- a/libc/kernel/uapi/linux/in6.h
+++ b/libc/kernel/uapi/linux/in6.h
@@ -134,6 +134,7 @@
 #define IPV6_LEAVE_ANYCAST 28
 #define IPV6_MULTICAST_ALL 29
 #define IPV6_ROUTER_ALERT_ISOLATE 30
+#define IPV6_RECVERR_RFC4884 31
 #define IPV6_PMTUDISC_DONT 0
 #define IPV6_PMTUDISC_WANT 1
 #define IPV6_PMTUDISC_DO 2
diff --git a/libc/kernel/uapi/linux/incrementalfs.h b/libc/kernel/uapi/linux/incrementalfs.h
index cfaee52..3dea328 100644
--- a/libc/kernel/uapi/linux/incrementalfs.h
+++ b/libc/kernel/uapi/linux/incrementalfs.h
@@ -23,13 +23,14 @@
 #include <linux/types.h>
 #include <linux/xattr.h>
 #define INCFS_NAME "incremental-fs"
-#define INCFS_MAGIC_NUMBER (0x5346434e49ul)
+#define INCFS_MAGIC_NUMBER (unsigned long) (0x5346434e49ul)
 #define INCFS_DATA_FILE_BLOCK_SIZE 4096
 #define INCFS_HEADER_VER 1
 #define INCFS_MAX_HASH_SIZE 32
 #define INCFS_MAX_FILE_ATTR_SIZE 512
 #define INCFS_PENDING_READS_FILENAME ".pending_reads"
 #define INCFS_LOG_FILENAME ".log"
+#define INCFS_BLOCKS_WRITTEN_FILENAME ".blocks_written"
 #define INCFS_XATTR_ID_NAME (XATTR_USER_PREFIX "incfs.id")
 #define INCFS_XATTR_SIZE_NAME (XATTR_USER_PREFIX "incfs.size")
 #define INCFS_XATTR_METADATA_NAME (XATTR_USER_PREFIX "incfs.metadata")
@@ -42,6 +43,12 @@
 #define INCFS_IOC_FILL_BLOCKS _IOR(INCFS_IOCTL_BASE_CODE, 32, struct incfs_fill_blocks)
 #define INCFS_IOC_PERMIT_FILL _IOW(INCFS_IOCTL_BASE_CODE, 33, struct incfs_permit_fill)
 #define INCFS_IOC_GET_FILLED_BLOCKS _IOR(INCFS_IOCTL_BASE_CODE, 34, struct incfs_get_filled_blocks_args)
+#define INCFS_IOC_CREATE_MAPPED_FILE _IOWR(INCFS_IOCTL_BASE_CODE, 35, struct incfs_create_mapped_file_args)
+#define INCFS_IOC_GET_BLOCK_COUNT _IOR(INCFS_IOCTL_BASE_CODE, 36, struct incfs_get_block_count_args)
+#define INCFS_IOC_GET_READ_TIMEOUTS _IOR(INCFS_IOCTL_BASE_CODE, 37, struct incfs_get_read_timeouts_args)
+#define INCFS_IOC_SET_READ_TIMEOUTS _IOW(INCFS_IOCTL_BASE_CODE, 38, struct incfs_set_read_timeouts_args)
+#define INCFS_FEATURE_FLAG_COREFS "corefs"
+#define INCFS_FEATURE_FLAG_REPORT_UID "report_uid"
 enum incfs_compression_alg {
   COMPRESSION_NONE = 0,
   COMPRESSION_LZ4 = 1
@@ -59,6 +66,14 @@
   __u32 block_index;
   __u32 serial_number;
 };
+struct incfs_pending_read_info2 {
+  incfs_uuid_t file_id;
+  __aligned_u64 timestamp_us;
+  __u32 block_index;
+  __u32 serial_number;
+  __u32 uid;
+  __u32 reserved;
+};
 struct incfs_fill_block {
   __u32 block_index;
   __u32 data_len;
@@ -114,4 +129,35 @@
   __u32 range_buffer_size_out;
   __u32 index_out;
 };
+struct incfs_create_mapped_file_args {
+  __aligned_u64 size;
+  __u16 mode;
+  __u16 reserved1;
+  __u32 reserved2;
+  __aligned_u64 directory_path;
+  __aligned_u64 file_name;
+  incfs_uuid_t source_file_id;
+  __aligned_u64 source_offset;
+};
+struct incfs_get_block_count_args {
+  __u32 total_data_blocks_out;
+  __u32 filled_data_blocks_out;
+  __u32 total_hash_blocks_out;
+  __u32 filled_hash_blocks_out;
+};
+struct incfs_per_uid_read_timeouts {
+  __u32 uid;
+  __u32 min_time_ms;
+  __u32 min_pending_time_ms;
+  __u32 max_pending_time_ms;
+};
+struct incfs_get_read_timeouts_args {
+  __aligned_u64 timeouts_array;
+  __u32 timeouts_array_size;
+  __u32 timeouts_array_size_out;
+};
+struct incfs_set_read_timeouts_args {
+  __aligned_u64 timeouts_array;
+  __u32 timeouts_array_size;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/inet_diag.h b/libc/kernel/uapi/linux/inet_diag.h
index 1c3c128..350781c 100644
--- a/libc/kernel/uapi/linux/inet_diag.h
+++ b/libc/kernel/uapi/linux/inet_diag.h
@@ -60,6 +60,7 @@
   INET_DIAG_REQ_NONE,
   INET_DIAG_REQ_BYTECODE,
   INET_DIAG_REQ_SK_BPF_STORAGES,
+  INET_DIAG_REQ_PROTOCOL,
   __INET_DIAG_REQ_MAX,
 };
 #define INET_DIAG_REQ_MAX (__INET_DIAG_REQ_MAX - 1)
diff --git a/libc/kernel/uapi/linux/io_uring.h b/libc/kernel/uapi/linux/io_uring.h
index 9912405..5d54090 100644
--- a/libc/kernel/uapi/linux/io_uring.h
+++ b/libc/kernel/uapi/linux/io_uring.h
@@ -38,6 +38,7 @@
     __kernel_rwf_t rw_flags;
     __u32 fsync_flags;
     __u16 poll_events;
+    __u32 poll32_events;
     __u32 sync_range_flags;
     __u32 msg_flags;
     __u32 timeout_flags;
@@ -178,6 +179,7 @@
 #define IORING_FEAT_RW_CUR_POS (1U << 3)
 #define IORING_FEAT_CUR_PERSONALITY (1U << 4)
 #define IORING_FEAT_FAST_POLL (1U << 5)
+#define IORING_FEAT_POLL_32BITS (1U << 6)
 #define IORING_REGISTER_BUFFERS 0
 #define IORING_UNREGISTER_BUFFERS 1
 #define IORING_REGISTER_FILES 2
diff --git a/libc/kernel/uapi/linux/iommu.h b/libc/kernel/uapi/linux/iommu.h
index 172be9c..a3817b1 100644
--- a/libc/kernel/uapi/linux/iommu.h
+++ b/libc/kernel/uapi/linux/iommu.h
@@ -53,6 +53,7 @@
 #define IOMMU_FAULT_PAGE_REQUEST_PASID_VALID (1 << 0)
 #define IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE (1 << 1)
 #define IOMMU_FAULT_PAGE_REQUEST_PRIV_DATA (1 << 2)
+#define IOMMU_FAULT_PAGE_RESPONSE_NEEDS_PASID (1 << 3)
   __u32 flags;
   __u32 pasid;
   __u32 grpid;
diff --git a/libc/kernel/uapi/linux/kfd_ioctl.h b/libc/kernel/uapi/linux/kfd_ioctl.h
index d9f7bfc..85e6938 100644
--- a/libc/kernel/uapi/linux/kfd_ioctl.h
+++ b/libc/kernel/uapi/linux/kfd_ioctl.h
@@ -21,7 +21,7 @@
 #include <drm/drm.h>
 #include <linux/ioctl.h>
 #define KFD_IOCTL_MAJOR_VERSION 1
-#define KFD_IOCTL_MINOR_VERSION 1
+#define KFD_IOCTL_MINOR_VERSION 3
 struct kfd_ioctl_get_version_args {
   __u32 major_version;
   __u32 minor_version;
@@ -287,6 +287,11 @@
   __u32 gpu_id;
   __u32 dmabuf_fd;
 };
+#define KFD_SMI_EVENT_VMFAULT 0x0000000000000001
+struct kfd_ioctl_smi_events_args {
+  __u32 gpuid;
+  __u32 anon_fd;
+};
 enum kfd_mmio_remap {
   KFD_MMIO_REMAP_HDP_MEM_FLUSH_CNTL = 0,
   KFD_MMIO_REMAP_HDP_REG_FLUSH_CNTL = 4,
@@ -326,6 +331,7 @@
 #define AMDKFD_IOC_GET_DMABUF_INFO AMDKFD_IOWR(0x1C, struct kfd_ioctl_get_dmabuf_info_args)
 #define AMDKFD_IOC_IMPORT_DMABUF AMDKFD_IOWR(0x1D, struct kfd_ioctl_import_dmabuf_args)
 #define AMDKFD_IOC_ALLOC_QUEUE_GWS AMDKFD_IOWR(0x1E, struct kfd_ioctl_alloc_queue_gws_args)
+#define AMDKFD_IOC_SMI_EVENTS AMDKFD_IOWR(0x1F, struct kfd_ioctl_smi_events_args)
 #define AMDKFD_COMMAND_START 0x01
-#define AMDKFD_COMMAND_END 0x1F
+#define AMDKFD_COMMAND_END 0x20
 #endif
diff --git a/libc/kernel/uapi/linux/kvm.h b/libc/kernel/uapi/linux/kvm.h
index 7e13990..21fba77 100644
--- a/libc/kernel/uapi/linux/kvm.h
+++ b/libc/kernel/uapi/linux/kvm.h
@@ -219,6 +219,7 @@
     } hw;
     struct {
       __u64 hardware_entry_failure_reason;
+      __u32 cpu;
     } fail_entry;
     struct {
       __u32 exception;
@@ -595,8 +596,9 @@
 #define KVM_VM_S390_UCONTROL 1
 #define KVM_VM_PPC_HV 1
 #define KVM_VM_PPC_PR 2
-#define KVM_VM_MIPS_TE 0
+#define KVM_VM_MIPS_AUTO 0
 #define KVM_VM_MIPS_VZ 1
+#define KVM_VM_MIPS_TE 2
 #define KVM_S390_SIE_PAGE_OFFSET 1
 #define KVM_VM_TYPE_ARM_IPA_SIZE_MASK 0xffULL
 #define KVM_VM_TYPE_ARM_IPA_SIZE(x) ((x) & KVM_VM_TYPE_ARM_IPA_SIZE_MASK)
@@ -810,6 +812,10 @@
 #define KVM_CAP_PPC_SECURE_GUEST 181
 #define KVM_CAP_HALT_POLL 182
 #define KVM_CAP_ASYNC_PF_INT 183
+#define KVM_CAP_LAST_CPU 184
+#define KVM_CAP_SMALLER_MAXPHYADDR 185
+#define KVM_CAP_S390_DIAG318 186
+#define KVM_CAP_STEAL_TIME 187
 #ifdef KVM_CAP_IRQ_ROUTING
 struct kvm_irq_routing_irqchip {
   __u32 irqchip;
diff --git a/libc/kernel/uapi/linux/mdio.h b/libc/kernel/uapi/linux/mdio.h
index 3bbe433..a38cbfc 100644
--- a/libc/kernel/uapi/linux/mdio.h
+++ b/libc/kernel/uapi/linux/mdio.h
@@ -246,4 +246,28 @@
 #define MDIO_PHY_ID_PRTAD 0x03e0
 #define MDIO_PHY_ID_DEVAD 0x001f
 #define MDIO_PHY_ID_C45_MASK (MDIO_PHY_ID_C45 | MDIO_PHY_ID_PRTAD | MDIO_PHY_ID_DEVAD)
+#define MDIO_USXGMII_EEE_CLK_STP 0x0080
+#define MDIO_USXGMII_EEE 0x0100
+#define MDIO_USXGMII_SPD_MASK 0x0e00
+#define MDIO_USXGMII_FULL_DUPLEX 0x1000
+#define MDIO_USXGMII_DPX_SPD_MASK 0x1e00
+#define MDIO_USXGMII_10 0x0000
+#define MDIO_USXGMII_10HALF 0x0000
+#define MDIO_USXGMII_10FULL 0x1000
+#define MDIO_USXGMII_100 0x0200
+#define MDIO_USXGMII_100HALF 0x0200
+#define MDIO_USXGMII_100FULL 0x1200
+#define MDIO_USXGMII_1000 0x0400
+#define MDIO_USXGMII_1000HALF 0x0400
+#define MDIO_USXGMII_1000FULL 0x1400
+#define MDIO_USXGMII_10G 0x0600
+#define MDIO_USXGMII_10GHALF 0x0600
+#define MDIO_USXGMII_10GFULL 0x1600
+#define MDIO_USXGMII_2500 0x0800
+#define MDIO_USXGMII_2500HALF 0x0800
+#define MDIO_USXGMII_2500FULL 0x1800
+#define MDIO_USXGMII_5000 0x0a00
+#define MDIO_USXGMII_5000HALF 0x0a00
+#define MDIO_USXGMII_5000FULL 0x1a00
+#define MDIO_USXGMII_LINK 0x8000
 #endif
diff --git a/libc/kernel/uapi/linux/mptcp.h b/libc/kernel/uapi/linux/mptcp.h
index 43702f3..deaa1bf 100644
--- a/libc/kernel/uapi/linux/mptcp.h
+++ b/libc/kernel/uapi/linux/mptcp.h
@@ -81,4 +81,19 @@
   MPTCP_PM_CMD_GET_LIMITS,
   __MPTCP_PM_CMD_AFTER_LAST
 };
+#define MPTCP_INFO_FLAG_FALLBACK _BITUL(0)
+#define MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED _BITUL(1)
+struct mptcp_info {
+  __u8 mptcpi_subflows;
+  __u8 mptcpi_add_addr_signal;
+  __u8 mptcpi_add_addr_accepted;
+  __u8 mptcpi_subflows_max;
+  __u8 mptcpi_add_addr_signal_max;
+  __u8 mptcpi_add_addr_accepted_max;
+  __u32 mptcpi_flags;
+  __u32 mptcpi_token;
+  __u64 mptcpi_write_seq;
+  __u64 mptcpi_snd_una;
+  __u64 mptcpi_rcv_nxt;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/mrp_bridge.h b/libc/kernel/uapi/linux/mrp_bridge.h
index cbfc322..ea4a7e3 100644
--- a/libc/kernel/uapi/linux/mrp_bridge.h
+++ b/libc/kernel/uapi/linux/mrp_bridge.h
@@ -33,10 +33,19 @@
   BR_MRP_RING_ROLE_MRM,
   BR_MRP_RING_ROLE_MRA,
 };
+enum br_mrp_in_role_type {
+  BR_MRP_IN_ROLE_DISABLED,
+  BR_MRP_IN_ROLE_MIC,
+  BR_MRP_IN_ROLE_MIM,
+};
 enum br_mrp_ring_state_type {
   BR_MRP_RING_STATE_OPEN,
   BR_MRP_RING_STATE_CLOSED,
 };
+enum br_mrp_in_state_type {
+  BR_MRP_IN_STATE_OPEN,
+  BR_MRP_IN_STATE_CLOSED,
+};
 enum br_mrp_port_state_type {
   BR_MRP_PORT_STATE_DISABLED,
   BR_MRP_PORT_STATE_BLOCKED,
@@ -46,6 +55,7 @@
 enum br_mrp_port_role_type {
   BR_MRP_PORT_ROLE_PRIMARY,
   BR_MRP_PORT_ROLE_SECONDARY,
+  BR_MRP_PORT_ROLE_INTER,
 };
 enum br_mrp_tlv_header_type {
   BR_MRP_TLV_HEADER_END = 0x0,
@@ -54,6 +64,10 @@
   BR_MRP_TLV_HEADER_RING_TOPO = 0x3,
   BR_MRP_TLV_HEADER_RING_LINK_DOWN = 0x4,
   BR_MRP_TLV_HEADER_RING_LINK_UP = 0x5,
+  BR_MRP_TLV_HEADER_IN_TEST = 0x6,
+  BR_MRP_TLV_HEADER_IN_TOPO = 0x7,
+  BR_MRP_TLV_HEADER_IN_LINK_DOWN = 0x8,
+  BR_MRP_TLV_HEADER_IN_LINK_UP = 0x9,
   BR_MRP_TLV_HEADER_OPTION = 0x7f,
 };
 enum br_mrp_sub_tlv_header_type {
@@ -114,4 +128,23 @@
 struct br_mrp_oui_hdr {
   __u8 oui[MRP_OUI_LENGTH];
 };
+struct br_mrp_in_test_hdr {
+  __be16 id;
+  __u8 sa[ETH_ALEN];
+  __be16 port_role;
+  __be16 state;
+  __be16 transitions;
+  __be32 timestamp;
+};
+struct br_mrp_in_topo_hdr {
+  __u8 sa[ETH_ALEN];
+  __be16 id;
+  __be16 interval;
+};
+struct br_mrp_in_link_hdr {
+  __u8 sa[ETH_ALEN];
+  __be16 port_role;
+  __be16 id;
+  __be16 interval;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/ndctl.h b/libc/kernel/uapi/linux/ndctl.h
index 61c8929..53f8ba4 100644
--- a/libc/kernel/uapi/linux/ndctl.h
+++ b/libc/kernel/uapi/linux/ndctl.h
@@ -159,5 +159,9 @@
 #define NVDIMM_FAMILY_MSFT 3
 #define NVDIMM_FAMILY_HYPERV 4
 #define NVDIMM_FAMILY_PAPR 5
+#define NVDIMM_FAMILY_MAX NVDIMM_FAMILY_PAPR
+#define NVDIMM_BUS_FAMILY_NFIT 0
+#define NVDIMM_BUS_FAMILY_INTEL 1
+#define NVDIMM_BUS_FAMILY_MAX NVDIMM_BUS_FAMILY_INTEL
 #define ND_IOCTL_CALL _IOWR(ND_IOCTL, ND_CMD_CALL, struct nd_cmd_pkg)
 #endif
diff --git a/libc/kernel/uapi/linux/neighbour.h b/libc/kernel/uapi/linux/neighbour.h
index eb4babd..e0e84aa 100644
--- a/libc/kernel/uapi/linux/neighbour.h
+++ b/libc/kernel/uapi/linux/neighbour.h
@@ -44,6 +44,7 @@
   NDA_SRC_VNI,
   NDA_PROTOCOL,
   NDA_NH_ID,
+  NDA_FDB_EXT_ATTRS,
   __NDA_MAX
 };
 #define NDA_MAX (__NDA_MAX - 1)
@@ -136,4 +137,15 @@
   __NDTA_MAX
 };
 #define NDTA_MAX (__NDTA_MAX - 1)
+enum {
+  FDB_NOTIFY_BIT = (1 << 0),
+  FDB_NOTIFY_INACTIVE_BIT = (1 << 1)
+};
+enum {
+  NFEA_UNSPEC,
+  NFEA_ACTIVITY_NOTIFY,
+  NFEA_DONT_REFRESH,
+  __NFEA_MAX
+};
+#define NFEA_MAX (__NFEA_MAX - 1)
 #endif
diff --git a/libc/kernel/uapi/linux/netfilter/nf_tables.h b/libc/kernel/uapi/linux/netfilter/nf_tables.h
index 6d3ec0a..abb35d2 100644
--- a/libc/kernel/uapi/linux/netfilter/nf_tables.h
+++ b/libc/kernel/uapi/linux/netfilter/nf_tables.h
@@ -89,7 +89,7 @@
   NFT_MSG_MAX,
 };
 enum nft_list_attributes {
-  NFTA_LIST_UNPEC,
+  NFTA_LIST_UNSPEC,
   NFTA_LIST_ELEM,
   __NFTA_LIST_MAX
 };
@@ -116,6 +116,12 @@
   __NFTA_TABLE_MAX
 };
 #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
+enum nft_chain_flags {
+  NFT_CHAIN_BASE = (1 << 0),
+  NFT_CHAIN_HW_OFFLOAD = (1 << 1),
+  NFT_CHAIN_BINDING = (1 << 2),
+};
+#define NFT_CHAIN_FLAGS (NFT_CHAIN_BASE | NFT_CHAIN_HW_OFFLOAD | NFT_CHAIN_BINDING)
 enum nft_chain_attributes {
   NFTA_CHAIN_UNSPEC,
   NFTA_CHAIN_TABLE,
@@ -128,6 +134,7 @@
   NFTA_CHAIN_COUNTERS,
   NFTA_CHAIN_PAD,
   NFTA_CHAIN_FLAGS,
+  NFTA_CHAIN_ID,
   __NFTA_CHAIN_MAX
 };
 #define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
@@ -143,6 +150,7 @@
   NFTA_RULE_PAD,
   NFTA_RULE_ID,
   NFTA_RULE_POSITION_ID,
+  NFTA_RULE_CHAIN_ID,
   __NFTA_RULE_MAX
 };
 #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
@@ -250,6 +258,7 @@
   NFTA_VERDICT_UNSPEC,
   NFTA_VERDICT_CODE,
   NFTA_VERDICT_CHAIN,
+  NFTA_VERDICT_CHAIN_ID,
   __NFTA_VERDICT_MAX
 };
 #define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
diff --git a/libc/kernel/uapi/linux/nfs4.h b/libc/kernel/uapi/linux/nfs4.h
index e6118a6..bc3e002 100644
--- a/libc/kernel/uapi/linux/nfs4.h
+++ b/libc/kernel/uapi/linux/nfs4.h
@@ -35,6 +35,9 @@
 #define NFS4_ACCESS_EXTEND 0x0008
 #define NFS4_ACCESS_DELETE 0x0010
 #define NFS4_ACCESS_EXECUTE 0x0020
+#define NFS4_ACCESS_XAREAD 0x0040
+#define NFS4_ACCESS_XAWRITE 0x0080
+#define NFS4_ACCESS_XALIST 0x0100
 #define NFS4_FH_PERSISTENT 0x0000
 #define NFS4_FH_NOEXPIRE_WITH_OPEN 0x0001
 #define NFS4_FH_VOLATILE_ANY 0x0002
diff --git a/libc/kernel/uapi/linux/nfs_fs.h b/libc/kernel/uapi/linux/nfs_fs.h
index 8ff9305..f8228ec 100644
--- a/libc/kernel/uapi/linux/nfs_fs.h
+++ b/libc/kernel/uapi/linux/nfs_fs.h
@@ -49,5 +49,6 @@
 #define NFSDBG_PNFS 0x1000
 #define NFSDBG_PNFS_LD 0x2000
 #define NFSDBG_STATE 0x4000
+#define NFSDBG_XATTRCACHE 0x8000
 #define NFSDBG_ALL 0xFFFF
 #endif
diff --git a/libc/kernel/uapi/linux/nl80211.h b/libc/kernel/uapi/linux/nl80211.h
index 75d51c9..e794bec 100644
--- a/libc/kernel/uapi/linux/nl80211.h
+++ b/libc/kernel/uapi/linux/nl80211.h
@@ -661,6 +661,7 @@
   NL80211_STA_INFO_AIRTIME_WEIGHT,
   NL80211_STA_INFO_AIRTIME_LINK_METRIC,
   NL80211_STA_INFO_ASSOC_AT_BOOTTIME,
+  NL80211_STA_INFO_CONNECTED_TO_AS,
   __NL80211_STA_INFO_AFTER_LAST,
   NL80211_STA_INFO_MAX = __NL80211_STA_INFO_AFTER_LAST - 1
 };
@@ -929,6 +930,8 @@
   NL80211_MESHCONF_AWAKE_WINDOW,
   NL80211_MESHCONF_PLINK_TIMEOUT,
   NL80211_MESHCONF_CONNECTED_TO_GATE,
+  NL80211_MESHCONF_NOLEARN,
+  NL80211_MESHCONF_CONNECTED_TO_AS,
   __NL80211_MESHCONF_ATTR_AFTER_LAST,
   NL80211_MESHCONF_ATTR_MAX = __NL80211_MESHCONF_ATTR_AFTER_LAST - 1
 };
@@ -987,11 +990,18 @@
   NL80211_CHAN_WIDTH_160,
   NL80211_CHAN_WIDTH_5,
   NL80211_CHAN_WIDTH_10,
+  NL80211_CHAN_WIDTH_1,
+  NL80211_CHAN_WIDTH_2,
+  NL80211_CHAN_WIDTH_4,
+  NL80211_CHAN_WIDTH_8,
+  NL80211_CHAN_WIDTH_16,
 };
 enum nl80211_bss_scan_width {
   NL80211_BSS_CHAN_WIDTH_20,
   NL80211_BSS_CHAN_WIDTH_10,
   NL80211_BSS_CHAN_WIDTH_5,
+  NL80211_BSS_CHAN_WIDTH_1,
+  NL80211_BSS_CHAN_WIDTH_2,
 };
 enum nl80211_bss {
   __NL80211_BSS_INVALID,
@@ -1097,6 +1107,7 @@
   NL80211_BAND_5GHZ,
   NL80211_BAND_60GHZ,
   NL80211_BAND_6GHZ,
+  NL80211_BAND_S1GHZ,
   NUM_NL80211_BANDS,
 };
 enum nl80211_ps_state {
@@ -1403,6 +1414,8 @@
   NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT,
   NL80211_EXT_FEATURE_SCAN_FREQ_KHZ,
   NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS,
+  NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION,
+  NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK,
   NUM_NL80211_EXT_FEATURES,
   MAX_NL80211_EXT_FEATURES = NUM_NL80211_EXT_FEATURES - 1
 };
diff --git a/libc/kernel/uapi/linux/openvswitch.h b/libc/kernel/uapi/linux/openvswitch.h
index 5dba4e6..b043dd8 100644
--- a/libc/kernel/uapi/linux/openvswitch.h
+++ b/libc/kernel/uapi/linux/openvswitch.h
@@ -42,6 +42,7 @@
   OVS_DP_ATTR_MEGAFLOW_STATS,
   OVS_DP_ATTR_USER_FEATURES,
   OVS_DP_ATTR_PAD,
+  OVS_DP_ATTR_MASKS_CACHE_SIZE,
   __OVS_DP_ATTR_MAX
 };
 #define OVS_DP_ATTR_MAX (__OVS_DP_ATTR_MAX - 1)
@@ -55,8 +56,8 @@
   __u64 n_mask_hit;
   __u32 n_masks;
   __u32 pad0;
+  __u64 n_cache_hit;
   __u64 pad1;
-  __u64 pad2;
 };
 struct ovs_vport_stats {
   __u64 rx_packets;
diff --git a/libc/kernel/uapi/linux/perf_event.h b/libc/kernel/uapi/linux/perf_event.h
index b996adb..8349f61 100644
--- a/libc/kernel/uapi/linux/perf_event.h
+++ b/libc/kernel/uapi/linux/perf_event.h
@@ -203,7 +203,7 @@
   };
   __u64 sample_type;
   __u64 read_format;
-  __u64 disabled : 1, inherit : 1, pinned : 1, exclusive : 1, exclude_user : 1, exclude_kernel : 1, exclude_hv : 1, exclude_idle : 1, mmap : 1, comm : 1, freq : 1, inherit_stat : 1, enable_on_exec : 1, task : 1, watermark : 1, precise_ip : 2, mmap_data : 1, sample_id_all : 1, exclude_host : 1, exclude_guest : 1, exclude_callchain_kernel : 1, exclude_callchain_user : 1, mmap2 : 1, comm_exec : 1, use_clockid : 1, context_switch : 1, write_backward : 1, namespaces : 1, ksymbol : 1, bpf_event : 1, aux_output : 1, cgroup : 1, __reserved_1 : 31;
+  __u64 disabled : 1, inherit : 1, pinned : 1, exclusive : 1, exclude_user : 1, exclude_kernel : 1, exclude_hv : 1, exclude_idle : 1, mmap : 1, comm : 1, freq : 1, inherit_stat : 1, enable_on_exec : 1, task : 1, watermark : 1, precise_ip : 2, mmap_data : 1, sample_id_all : 1, exclude_host : 1, exclude_guest : 1, exclude_callchain_kernel : 1, exclude_callchain_user : 1, mmap2 : 1, comm_exec : 1, use_clockid : 1, context_switch : 1, write_backward : 1, namespaces : 1, ksymbol : 1, bpf_event : 1, aux_output : 1, cgroup : 1, text_poke : 1, __reserved_1 : 30;
   union {
     __u32 wakeup_events;
     __u32 wakeup_watermark;
@@ -263,7 +263,7 @@
   union {
     __u64 capabilities;
     struct {
-      __u64 cap_bit0 : 1, cap_bit0_is_deprecated : 1, cap_user_rdpmc : 1, cap_user_time : 1, cap_user_time_zero : 1, cap_____res : 59;
+      __u64 cap_bit0 : 1, cap_bit0_is_deprecated : 1, cap_user_rdpmc : 1, cap_user_time : 1, cap_user_time_zero : 1, cap_user_time_short : 1, cap_____res : 58;
     };
   };
   __u16 pmc_width;
@@ -272,7 +272,10 @@
   __u64 time_offset;
   __u64 time_zero;
   __u32 size;
-  __u8 __reserved[118 * 8 + 4];
+  __u32 __reserved_1;
+  __u64 time_cycles;
+  __u64 time_mask;
+  __u8 __reserved[116 * 8];
   __u64 data_head;
   __u64 data_tail;
   __u64 data_offset;
@@ -336,11 +339,13 @@
   PERF_RECORD_KSYMBOL = 17,
   PERF_RECORD_BPF_EVENT = 18,
   PERF_RECORD_CGROUP = 19,
+  PERF_RECORD_TEXT_POKE = 20,
   PERF_RECORD_MAX,
 };
 enum perf_record_ksymbol_type {
   PERF_RECORD_KSYMBOL_TYPE_UNKNOWN = 0,
   PERF_RECORD_KSYMBOL_TYPE_BPF = 1,
+  PERF_RECORD_KSYMBOL_TYPE_OOL = 2,
   PERF_RECORD_KSYMBOL_TYPE_MAX
 };
 #define PERF_RECORD_KSYMBOL_FLAGS_UNREGISTER (1 << 0)
diff --git a/libc/kernel/uapi/linux/pkt_cls.h b/libc/kernel/uapi/linux/pkt_cls.h
index a5e8149..62c2274 100644
--- a/libc/kernel/uapi/linux/pkt_cls.h
+++ b/libc/kernel/uapi/linux/pkt_cls.h
@@ -452,6 +452,8 @@
   TCA_FLOWER_KEY_CT_LABELS,
   TCA_FLOWER_KEY_CT_LABELS_MASK,
   TCA_FLOWER_KEY_MPLS_OPTS,
+  TCA_FLOWER_KEY_HASH,
+  TCA_FLOWER_KEY_HASH_MASK,
   __TCA_FLOWER_MAX,
 };
 #define TCA_FLOWER_MAX (__TCA_FLOWER_MAX - 1)
diff --git a/libc/kernel/uapi/linux/pkt_sched.h b/libc/kernel/uapi/linux/pkt_sched.h
index 9579583..7c16d3c 100644
--- a/libc/kernel/uapi/linux/pkt_sched.h
+++ b/libc/kernel/uapi/linux/pkt_sched.h
@@ -168,6 +168,8 @@
   TCA_RED_STAB,
   TCA_RED_MAX_P,
   TCA_RED_FLAGS,
+  TCA_RED_EARLY_DROP_BLOCK,
+  TCA_RED_MARK_BLOCK,
   __TCA_RED_MAX,
 };
 #define TCA_RED_MAX (__TCA_RED_MAX - 1)
diff --git a/libc/kernel/uapi/linux/ptp_clock.h b/libc/kernel/uapi/linux/ptp_clock.h
index 3d0dc24..ca6f3c3 100644
--- a/libc/kernel/uapi/linux/ptp_clock.h
+++ b/libc/kernel/uapi/linux/ptp_clock.h
@@ -28,7 +28,9 @@
 #define PTP_EXTTS_VALID_FLAGS (PTP_ENABLE_FEATURE | PTP_RISING_EDGE | PTP_FALLING_EDGE | PTP_STRICT_FLAGS)
 #define PTP_EXTTS_V1_VALID_FLAGS (PTP_ENABLE_FEATURE | PTP_RISING_EDGE | PTP_FALLING_EDGE)
 #define PTP_PEROUT_ONE_SHOT (1 << 0)
-#define PTP_PEROUT_VALID_FLAGS (PTP_PEROUT_ONE_SHOT)
+#define PTP_PEROUT_DUTY_CYCLE (1 << 1)
+#define PTP_PEROUT_PHASE (1 << 2)
+#define PTP_PEROUT_VALID_FLAGS (PTP_PEROUT_ONE_SHOT | PTP_PEROUT_DUTY_CYCLE | PTP_PEROUT_PHASE)
 #define PTP_PEROUT_V1_VALID_FLAGS (0)
 struct ptp_clock_time {
   __s64 sec;
@@ -52,11 +54,17 @@
   unsigned int rsv[2];
 };
 struct ptp_perout_request {
-  struct ptp_clock_time start;
+  union {
+    struct ptp_clock_time start;
+    struct ptp_clock_time phase;
+  };
   struct ptp_clock_time period;
   unsigned int index;
   unsigned int flags;
-  unsigned int rsv[4];
+  union {
+    struct ptp_clock_time on;
+    unsigned int rsv[4];
+  };
 };
 #define PTP_MAX_SAMPLES 25
 struct ptp_sys_offset {
diff --git a/libc/kernel/uapi/linux/raw.h b/libc/kernel/uapi/linux/raw.h
index 86aea2b..bb45c3d 100644
--- a/libc/kernel/uapi/linux/raw.h
+++ b/libc/kernel/uapi/linux/raw.h
@@ -26,5 +26,4 @@
   __u64 block_major;
   __u64 block_minor;
 };
-#define MAX_RAW_MINORS CONFIG_MAX_RAW_DEVS
 #endif
diff --git a/libc/kernel/uapi/linux/remoteproc_cdev.h b/libc/kernel/uapi/linux/remoteproc_cdev.h
new file mode 100644
index 0000000..a10ff01
--- /dev/null
+++ b/libc/kernel/uapi/linux/remoteproc_cdev.h
@@ -0,0 +1,26 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef _UAPI_REMOTEPROC_CDEV_H_
+#define _UAPI_REMOTEPROC_CDEV_H_
+#include <linux/ioctl.h>
+#include <linux/types.h>
+#define RPROC_MAGIC 0xB7
+#define RPROC_SET_SHUTDOWN_ON_RELEASE _IOW(RPROC_MAGIC, 1, __s32)
+#define RPROC_GET_SHUTDOWN_ON_RELEASE _IOR(RPROC_MAGIC, 2, __s32)
+#endif
diff --git a/libc/kernel/uapi/linux/rtnetlink.h b/libc/kernel/uapi/linux/rtnetlink.h
index f7be4a5..6f50bb5 100644
--- a/libc/kernel/uapi/linux/rtnetlink.h
+++ b/libc/kernel/uapi/linux/rtnetlink.h
@@ -217,6 +217,7 @@
 #define RTPROT_NTK 15
 #define RTPROT_DHCP 16
 #define RTPROT_MROUTED 17
+#define RTPROT_KEEPALIVED 18
 #define RTPROT_BABEL 42
 #define RTPROT_BGP 186
 #define RTPROT_ISIS 187
@@ -575,4 +576,5 @@
 #define RTEXT_FILTER_BRVLAN (1 << 1)
 #define RTEXT_FILTER_BRVLAN_COMPRESSED (1 << 2)
 #define RTEXT_FILTER_SKIP_STATS (1 << 3)
+#define RTEXT_FILTER_MRP (1 << 4)
 #endif
diff --git a/libc/kernel/uapi/linux/rxrpc.h b/libc/kernel/uapi/linux/rxrpc.h
index 1690111..16207dd 100644
--- a/libc/kernel/uapi/linux/rxrpc.h
+++ b/libc/kernel/uapi/linux/rxrpc.h
@@ -46,11 +46,11 @@
   RXRPC_BUSY = 6,
   RXRPC_LOCAL_ERROR = 7,
   RXRPC_NEW_CALL = 8,
-  RXRPC_ACCEPT = 9,
   RXRPC_EXCLUSIVE_CALL = 10,
   RXRPC_UPGRADE_SERVICE = 11,
   RXRPC_TX_LENGTH = 12,
   RXRPC_SET_CALL_TIMEOUT = 13,
+  RXRPC_CHARGE_ACCEPT = 14,
   RXRPC__SUPPORTED
 };
 #define RXRPC_SECURITY_PLAIN 0
diff --git a/libc/kernel/uapi/linux/seccomp.h b/libc/kernel/uapi/linux/seccomp.h
index d535f50..0ae0e12 100644
--- a/libc/kernel/uapi/linux/seccomp.h
+++ b/libc/kernel/uapi/linux/seccomp.h
@@ -68,6 +68,14 @@
   __s32 error;
   __u32 flags;
 };
+#define SECCOMP_ADDFD_FLAG_SETFD (1UL << 0)
+struct seccomp_notif_addfd {
+  __u64 id;
+  __u32 flags;
+  __u32 srcfd;
+  __u32 newfd;
+  __u32 newfd_flags;
+};
 #define SECCOMP_IOC_MAGIC '!'
 #define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr)
 #define SECCOMP_IOR(nr,type) _IOR(SECCOMP_IOC_MAGIC, nr, type)
@@ -75,5 +83,6 @@
 #define SECCOMP_IOWR(nr,type) _IOWR(SECCOMP_IOC_MAGIC, nr, type)
 #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif)
 #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, struct seccomp_notif_resp)
-#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64)
+#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64)
+#define SECCOMP_IOCTL_NOTIF_ADDFD SECCOMP_IOW(3, struct seccomp_notif_addfd)
 #endif
diff --git a/libc/kernel/uapi/linux/serial_core.h b/libc/kernel/uapi/linux/serial_core.h
index 37dfc16..b2c3253 100644
--- a/libc/kernel/uapi/linux/serial_core.h
+++ b/libc/kernel/uapi/linux/serial_core.h
@@ -19,20 +19,6 @@
 #ifndef _UAPILINUX_SERIAL_CORE_H
 #define _UAPILINUX_SERIAL_CORE_H
 #include <linux/serial.h>
-#define PORT_UNKNOWN 0
-#define PORT_8250 1
-#define PORT_16450 2
-#define PORT_16550 3
-#define PORT_16550A 4
-#define PORT_CIRRUS 5
-#define PORT_16650 6
-#define PORT_16650V2 7
-#define PORT_16750 8
-#define PORT_STARTECH 9
-#define PORT_16C950 10
-#define PORT_16654 11
-#define PORT_16850 12
-#define PORT_RSA 13
 #define PORT_NS16550A 14
 #define PORT_XSCALE 15
 #define PORT_RM9000 16
diff --git a/libc/kernel/uapi/linux/snmp.h b/libc/kernel/uapi/linux/snmp.h
index c114544..8d63a3c 100644
--- a/libc/kernel/uapi/linux/snmp.h
+++ b/libc/kernel/uapi/linux/snmp.h
@@ -254,6 +254,8 @@
   LINUX_MIB_TCPFASTOPENPASSIVEALTKEY,
   LINUX_MIB_TCPTIMEOUTREHASH,
   LINUX_MIB_TCPDUPLICATEDATAREHASH,
+  LINUX_MIB_TCPDSACKRECVSEGS,
+  LINUX_MIB_TCPDSACKIGNOREDDUBIOUS,
   __LINUX_MIB_MAX
 };
 enum {
diff --git a/libc/kernel/uapi/linux/target_core_user.h b/libc/kernel/uapi/linux/target_core_user.h
index 7c997d1..e0b9f22 100644
--- a/libc/kernel/uapi/linux/target_core_user.h
+++ b/libc/kernel/uapi/linux/target_core_user.h
@@ -25,6 +25,7 @@
 #define ALIGN_SIZE 64
 #define TCMU_MAILBOX_FLAG_CAP_OOOC (1 << 0)
 #define TCMU_MAILBOX_FLAG_CAP_READ_LEN (1 << 1)
+#define TCMU_MAILBOX_FLAG_CAP_TMR (1 << 2)
 struct tcmu_mailbox {
   __u16 version;
   __u16 flags;
@@ -36,6 +37,7 @@
 enum tcmu_opcode {
   TCMU_OP_PAD = 0,
   TCMU_OP_CMD,
+  TCMU_OP_TMR,
 };
 struct tcmu_cmd_entry_hdr {
   __u32 len_op;
@@ -68,6 +70,25 @@
     } rsp;
   };
 } __packed;
+struct tcmu_tmr_entry {
+  struct tcmu_cmd_entry_hdr hdr;
+#define TCMU_TMR_UNKNOWN 0
+#define TCMU_TMR_ABORT_TASK 1
+#define TCMU_TMR_ABORT_TASK_SET 2
+#define TCMU_TMR_CLEAR_ACA 3
+#define TCMU_TMR_CLEAR_TASK_SET 4
+#define TCMU_TMR_LUN_RESET 5
+#define TCMU_TMR_TARGET_WARM_RESET 6
+#define TCMU_TMR_TARGET_COLD_RESET 7
+#define TCMU_TMR_LUN_RESET_PRO 128
+  __u8 tmr_type;
+  __u8 __pad1;
+  __u16 __pad2;
+  __u32 cmd_cnt;
+  __u64 __pad3;
+  __u64 __pad4;
+  __u16 cmd_ids[0];
+} __packed;
 #define TCMU_OP_ALIGN_SIZE sizeof(__u64)
 enum tcmu_genl_cmd {
   TCMU_CMD_UNSPEC,
diff --git a/libc/kernel/uapi/linux/tcp.h b/libc/kernel/uapi/linux/tcp.h
index e38e462..e05e3ad 100644
--- a/libc/kernel/uapi/linux/tcp.h
+++ b/libc/kernel/uapi/linux/tcp.h
@@ -219,6 +219,7 @@
   TCP_NLA_SRTT,
   TCP_NLA_TIMEOUT_REHASH,
   TCP_NLA_BYTES_NOTSENT,
+  TCP_NLA_EDT,
 };
 #define TCP_MD5SIG_MAXKEYLEN 80
 #define TCP_MD5SIG_FLAG_PREFIX 0x1
diff --git a/libc/kernel/uapi/linux/thermal.h b/libc/kernel/uapi/linux/thermal.h
index c78f17e..72ea378 100644
--- a/libc/kernel/uapi/linux/thermal.h
+++ b/libc/kernel/uapi/linux/thermal.h
@@ -19,24 +19,75 @@
 #ifndef _UAPI_LINUX_THERMAL_H
 #define _UAPI_LINUX_THERMAL_H
 #define THERMAL_NAME_LENGTH 20
-#define THERMAL_GENL_FAMILY_NAME "thermal_event"
-#define THERMAL_GENL_VERSION 0x01
-#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_grp"
-enum events {
-  THERMAL_AUX0,
-  THERMAL_AUX1,
-  THERMAL_CRITICAL,
-  THERMAL_DEV_FAULT,
+enum thermal_device_mode {
+  THERMAL_DEVICE_DISABLED = 0,
+  THERMAL_DEVICE_ENABLED,
 };
-enum {
+enum thermal_trip_type {
+  THERMAL_TRIP_ACTIVE = 0,
+  THERMAL_TRIP_PASSIVE,
+  THERMAL_TRIP_HOT,
+  THERMAL_TRIP_CRITICAL,
+};
+#define THERMAL_GENL_FAMILY_NAME "thermal"
+#define THERMAL_GENL_VERSION 0x01
+#define THERMAL_GENL_SAMPLING_GROUP_NAME "sampling"
+#define THERMAL_GENL_EVENT_GROUP_NAME "event"
+enum thermal_genl_attr {
   THERMAL_GENL_ATTR_UNSPEC,
-  THERMAL_GENL_ATTR_EVENT,
+  THERMAL_GENL_ATTR_TZ,
+  THERMAL_GENL_ATTR_TZ_ID,
+  THERMAL_GENL_ATTR_TZ_TEMP,
+  THERMAL_GENL_ATTR_TZ_TRIP,
+  THERMAL_GENL_ATTR_TZ_TRIP_ID,
+  THERMAL_GENL_ATTR_TZ_TRIP_TYPE,
+  THERMAL_GENL_ATTR_TZ_TRIP_TEMP,
+  THERMAL_GENL_ATTR_TZ_TRIP_HYST,
+  THERMAL_GENL_ATTR_TZ_MODE,
+  THERMAL_GENL_ATTR_TZ_NAME,
+  THERMAL_GENL_ATTR_TZ_CDEV_WEIGHT,
+  THERMAL_GENL_ATTR_TZ_GOV,
+  THERMAL_GENL_ATTR_TZ_GOV_NAME,
+  THERMAL_GENL_ATTR_CDEV,
+  THERMAL_GENL_ATTR_CDEV_ID,
+  THERMAL_GENL_ATTR_CDEV_CUR_STATE,
+  THERMAL_GENL_ATTR_CDEV_MAX_STATE,
+  THERMAL_GENL_ATTR_CDEV_NAME,
+  THERMAL_GENL_ATTR_GOV_NAME,
   __THERMAL_GENL_ATTR_MAX,
 };
 #define THERMAL_GENL_ATTR_MAX (__THERMAL_GENL_ATTR_MAX - 1)
-enum {
+enum thermal_genl_sampling {
+  THERMAL_GENL_SAMPLING_TEMP,
+  __THERMAL_GENL_SAMPLING_MAX,
+};
+#define THERMAL_GENL_SAMPLING_MAX (__THERMAL_GENL_SAMPLING_MAX - 1)
+enum thermal_genl_event {
+  THERMAL_GENL_EVENT_UNSPEC,
+  THERMAL_GENL_EVENT_TZ_CREATE,
+  THERMAL_GENL_EVENT_TZ_DELETE,
+  THERMAL_GENL_EVENT_TZ_DISABLE,
+  THERMAL_GENL_EVENT_TZ_ENABLE,
+  THERMAL_GENL_EVENT_TZ_TRIP_UP,
+  THERMAL_GENL_EVENT_TZ_TRIP_DOWN,
+  THERMAL_GENL_EVENT_TZ_TRIP_CHANGE,
+  THERMAL_GENL_EVENT_TZ_TRIP_ADD,
+  THERMAL_GENL_EVENT_TZ_TRIP_DELETE,
+  THERMAL_GENL_EVENT_CDEV_ADD,
+  THERMAL_GENL_EVENT_CDEV_DELETE,
+  THERMAL_GENL_EVENT_CDEV_STATE_UPDATE,
+  THERMAL_GENL_EVENT_TZ_GOV_CHANGE,
+  __THERMAL_GENL_EVENT_MAX,
+};
+#define THERMAL_GENL_EVENT_MAX (__THERMAL_GENL_EVENT_MAX - 1)
+enum thermal_genl_cmd {
   THERMAL_GENL_CMD_UNSPEC,
-  THERMAL_GENL_CMD_EVENT,
+  THERMAL_GENL_CMD_TZ_GET_ID,
+  THERMAL_GENL_CMD_TZ_GET_TRIP,
+  THERMAL_GENL_CMD_TZ_GET_TEMP,
+  THERMAL_GENL_CMD_TZ_GET_GOV,
+  THERMAL_GENL_CMD_TZ_GET_MODE,
+  THERMAL_GENL_CMD_CDEV_GET,
   __THERMAL_GENL_CMD_MAX,
 };
 #define THERMAL_GENL_CMD_MAX (__THERMAL_GENL_CMD_MAX - 1)
diff --git a/libc/kernel/uapi/linux/usb/ch9.h b/libc/kernel/uapi/linux/usb/ch9.h
index 2d69abd..43d2f4b 100644
--- a/libc/kernel/uapi/linux/usb/ch9.h
+++ b/libc/kernel/uapi/linux/usb/ch9.h
@@ -74,11 +74,11 @@
 #define USB_DEVICE_A_HNP_SUPPORT 4
 #define USB_DEVICE_A_ALT_HNP_SUPPORT 5
 #define USB_DEVICE_DEBUG_MODE 6
-#define TEST_J 1
-#define TEST_K 2
-#define TEST_SE0_NAK 3
-#define TEST_PACKET 4
-#define TEST_FORCE_EN 5
+#define USB_TEST_J 1
+#define USB_TEST_K 2
+#define USB_TEST_SE0_NAK 3
+#define USB_TEST_PACKET 4
+#define USB_TEST_FORCE_ENABLE 5
 #define USB_STATUS_TYPE_STANDARD 0
 #define USB_STATUS_TYPE_PTM 1
 #define USB_DEVICE_U1_ENABLE 48
@@ -176,6 +176,10 @@
 #define USB_CLASS_CONTENT_SEC 0x0d
 #define USB_CLASS_VIDEO 0x0e
 #define USB_CLASS_WIRELESS_CONTROLLER 0xe0
+#define USB_CLASS_PERSONAL_HEALTHCARE 0x0f
+#define USB_CLASS_AUDIO_VIDEO 0x10
+#define USB_CLASS_BILLBOARD 0x11
+#define USB_CLASS_USB_TYPE_C_BRIDGE 0x12
 #define USB_CLASS_MISC 0xef
 #define USB_CLASS_APP_SPEC 0xfe
 #define USB_CLASS_VENDOR_SPEC 0xff
@@ -195,6 +199,7 @@
 #define USB_CONFIG_ATT_SELFPOWER (1 << 6)
 #define USB_CONFIG_ATT_WAKEUP (1 << 5)
 #define USB_CONFIG_ATT_BATTERY (1 << 4)
+#define USB_MAX_STRING_LEN 126
 struct usb_string_descriptor {
   __u8 bLength;
   __u8 bDescriptorType;
diff --git a/libc/kernel/uapi/linux/v4l2-controls.h b/libc/kernel/uapi/linux/v4l2-controls.h
index d060744..7f965a3 100644
--- a/libc/kernel/uapi/linux/v4l2-controls.h
+++ b/libc/kernel/uapi/linux/v4l2-controls.h
@@ -278,6 +278,7 @@
 enum v4l2_mpeg_video_bitrate_mode {
   V4L2_MPEG_VIDEO_BITRATE_MODE_VBR = 0,
   V4L2_MPEG_VIDEO_BITRATE_MODE_CBR = 1,
+  V4L2_MPEG_VIDEO_BITRATE_MODE_CQ = 2,
 };
 #define V4L2_CID_MPEG_VIDEO_BITRATE (V4L2_CID_MPEG_BASE + 207)
 #define V4L2_CID_MPEG_VIDEO_BITRATE_PEAK (V4L2_CID_MPEG_BASE + 208)
@@ -537,6 +538,23 @@
   V4L2_MPEG_VIDEO_VP9_PROFILE_2 = 2,
   V4L2_MPEG_VIDEO_VP9_PROFILE_3 = 3,
 };
+#define V4L2_CID_MPEG_VIDEO_VP9_LEVEL (V4L2_CID_MPEG_BASE + 513)
+enum v4l2_mpeg_video_vp9_level {
+  V4L2_MPEG_VIDEO_VP9_LEVEL_1_0 = 0,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_1_1 = 1,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_2_0 = 2,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_2_1 = 3,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_3_0 = 4,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_3_1 = 5,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_4_0 = 6,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_4_1 = 7,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_5_0 = 8,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_5_1 = 9,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_5_2 = 10,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_6_0 = 11,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_6_1 = 12,
+  V4L2_MPEG_VIDEO_VP9_LEVEL_6_2 = 13,
+};
 #define V4L2_CID_MPEG_VIDEO_HEVC_MIN_QP (V4L2_CID_MPEG_BASE + 600)
 #define V4L2_CID_MPEG_VIDEO_HEVC_MAX_QP (V4L2_CID_MPEG_BASE + 601)
 #define V4L2_CID_MPEG_VIDEO_HEVC_I_FRAME_QP (V4L2_CID_MPEG_BASE + 602)
@@ -626,6 +644,13 @@
 #define V4L2_CID_MPEG_VIDEO_HEVC_HIER_CODING_L6_BR (V4L2_CID_MPEG_BASE + 642)
 #define V4L2_CID_MPEG_VIDEO_REF_NUMBER_FOR_PFRAMES (V4L2_CID_MPEG_BASE + 643)
 #define V4L2_CID_MPEG_VIDEO_PREPEND_SPSPPS_TO_IDR (V4L2_CID_MPEG_BASE + 644)
+#define V4L2_CID_MPEG_VIDEO_CONSTANT_QUALITY (V4L2_CID_MPEG_BASE + 645)
+#define V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE (V4L2_CID_MPEG_BASE + 646)
+enum v4l2_mpeg_video_frame_skip_mode {
+  V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_DISABLED = 0,
+  V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_LEVEL_LIMIT = 1,
+  V4L2_MPEG_VIDEO_FRAME_SKIP_MODE_BUF_LIMIT = 2,
+};
 #define V4L2_CID_MPEG_CX2341X_BASE (V4L2_CTRL_CLASS_MPEG | 0x1000)
 #define V4L2_CID_MPEG_CX2341X_VIDEO_SPATIAL_FILTER_MODE (V4L2_CID_MPEG_CX2341X_BASE + 0)
 enum v4l2_mpeg_cx2341x_video_spatial_filter_mode {
diff --git a/libc/kernel/uapi/linux/vbox_vmmdev_types.h b/libc/kernel/uapi/linux/vbox_vmmdev_types.h
index 3b27029..009f9a6 100644
--- a/libc/kernel/uapi/linux/vbox_vmmdev_types.h
+++ b/libc/kernel/uapi/linux/vbox_vmmdev_types.h
@@ -48,6 +48,7 @@
   VMMDEVREQ_SET_GUEST_CAPABILITIES = 56,
   VMMDEVREQ_VIDEMODE_SUPPORTED2 = 57,
   VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX = 80,
+  VMMDEVREQ_GET_DISPLAY_CHANGE_REQ_MULTI = 81,
   VMMDEVREQ_HGCM_CONNECT = 60,
   VMMDEVREQ_HGCM_DISCONNECT = 61,
   VMMDEVREQ_HGCM_CALL32 = 62,
@@ -77,6 +78,8 @@
   VMMDEVREQ_WRITE_COREDUMP = 218,
   VMMDEVREQ_GUEST_HEARTBEAT = 219,
   VMMDEVREQ_HEARTBEAT_CONFIGURE = 220,
+  VMMDEVREQ_NT_BUG_CHECK = 221,
+  VMMDEVREQ_VIDEO_UPDATE_MONITOR_POSITIONS = 222,
   VMMDEVREQ_SIZEHACK = 0x7fffffff
 };
 #if __BITS_PER_LONG == 64
diff --git a/libc/kernel/uapi/linux/vboxguest.h b/libc/kernel/uapi/linux/vboxguest.h
index d9dfa9a..342c020 100644
--- a/libc/kernel/uapi/linux/vboxguest.h
+++ b/libc/kernel/uapi/linux/vboxguest.h
@@ -124,6 +124,19 @@
   } u;
 };
 #define VBG_IOCTL_CHANGE_FILTER_MASK _IOWR('V', 12, struct vbg_ioctl_change_filter)
+struct vbg_ioctl_acquire_guest_caps {
+  struct vbg_ioctl_hdr hdr;
+  union {
+    struct {
+      __u32 flags;
+      __u32 or_mask;
+      __u32 not_mask;
+    } in;
+  } u;
+};
+#define VBGL_IOC_AGC_FLAGS_CONFIG_ACQUIRE_MODE 0x00000001
+#define VBGL_IOC_AGC_FLAGS_VALID_MASK 0x00000001
+#define VBG_IOCTL_ACQUIRE_GUEST_CAPABILITIES _IOWR('V', 13, struct vbg_ioctl_acquire_guest_caps)
 struct vbg_ioctl_set_guest_caps {
   struct vbg_ioctl_hdr hdr;
   union {
diff --git a/libc/kernel/uapi/linux/version.h b/libc/kernel/uapi/linux/version.h
index 05b1551..54d59c2 100644
--- a/libc/kernel/uapi/linux/version.h
+++ b/libc/kernel/uapi/linux/version.h
@@ -16,5 +16,5 @@
  ***
  ****************************************************************************
  ****************************************************************************/
-#define LINUX_VERSION_CODE 329728
+#define LINUX_VERSION_CODE 329984
 #define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
diff --git a/libc/kernel/uapi/linux/vhost.h b/libc/kernel/uapi/linux/vhost.h
index 0349fa7..a844ec8 100644
--- a/libc/kernel/uapi/linux/vhost.h
+++ b/libc/kernel/uapi/linux/vhost.h
@@ -44,6 +44,7 @@
 #define VHOST_SET_VRING_BUSYLOOP_TIMEOUT _IOW(VHOST_VIRTIO, 0x23, struct vhost_vring_state)
 #define VHOST_GET_VRING_BUSYLOOP_TIMEOUT _IOW(VHOST_VIRTIO, 0x24, struct vhost_vring_state)
 #define VHOST_BACKEND_F_IOTLB_MSG_V2 0x1
+#define VHOST_BACKEND_F_IOTLB_BATCH 0x2
 #define VHOST_SET_BACKEND_FEATURES _IOW(VHOST_VIRTIO, 0x25, __u64)
 #define VHOST_GET_BACKEND_FEATURES _IOR(VHOST_VIRTIO, 0x26, __u64)
 #define VHOST_NET_SET_BACKEND _IOW(VHOST_VIRTIO, 0x30, struct vhost_vring_file)
diff --git a/libc/kernel/uapi/linux/vhost_types.h b/libc/kernel/uapi/linux/vhost_types.h
index 1288cf6..8c0e487 100644
--- a/libc/kernel/uapi/linux/vhost_types.h
+++ b/libc/kernel/uapi/linux/vhost_types.h
@@ -51,6 +51,8 @@
 #define VHOST_IOTLB_UPDATE 2
 #define VHOST_IOTLB_INVALIDATE 3
 #define VHOST_IOTLB_ACCESS_FAIL 4
+#define VHOST_IOTLB_BATCH_BEGIN 5
+#define VHOST_IOTLB_BATCH_END 6
   __u8 type;
 };
 #define VHOST_IOTLB_MSG 0x1
diff --git a/libc/kernel/uapi/linux/videodev2.h b/libc/kernel/uapi/linux/videodev2.h
index d8c7549..da57468 100644
--- a/libc/kernel/uapi/linux/videodev2.h
+++ b/libc/kernel/uapi/linux/videodev2.h
@@ -65,6 +65,7 @@
 };
 #define V4L2_TYPE_IS_MULTIPLANAR(type) ((type) == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
 #define V4L2_TYPE_IS_OUTPUT(type) ((type) == V4L2_BUF_TYPE_VIDEO_OUTPUT || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE || (type) == V4L2_BUF_TYPE_VIDEO_OVERLAY || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY || (type) == V4L2_BUF_TYPE_VBI_OUTPUT || (type) == V4L2_BUF_TYPE_SLICED_VBI_OUTPUT || (type) == V4L2_BUF_TYPE_SDR_OUTPUT || (type) == V4L2_BUF_TYPE_META_OUTPUT)
+#define V4L2_TYPE_IS_CAPTURE(type) (! V4L2_TYPE_IS_OUTPUT(type))
 enum v4l2_tuner_type {
   V4L2_TUNER_RADIO = 1,
   V4L2_TUNER_ANALOG_TV = 2,
@@ -428,6 +429,7 @@
 #define V4L2_FMT_FLAG_EMULATED 0x0002
 #define V4L2_FMT_FLAG_CONTINUOUS_BYTESTREAM 0x0004
 #define V4L2_FMT_FLAG_DYN_RESOLUTION 0x0008
+#define V4L2_FMT_FLAG_ENC_CAP_FRAME_INTERVAL 0x0010
 enum v4l2_frmsizetypes {
   V4L2_FRMSIZE_TYPE_DISCRETE = 1,
   V4L2_FRMSIZE_TYPE_CONTINUOUS = 2,
@@ -523,6 +525,7 @@
 #define V4L2_BUF_CAP_SUPPORTS_REQUESTS (1 << 3)
 #define V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS (1 << 4)
 #define V4L2_BUF_CAP_SUPPORTS_M2M_HOLD_CAPTURE_BUF (1 << 5)
+#define V4L2_BUF_CAP_SUPPORTS_MMAP_CACHE_HINTS (1 << 6)
 struct v4l2_plane {
   __u32 bytesused;
   __u32 length;
diff --git a/libc/kernel/uapi/linux/virtio_9p.h b/libc/kernel/uapi/linux/virtio_9p.h
index f593353..1d9dfb1 100644
--- a/libc/kernel/uapi/linux/virtio_9p.h
+++ b/libc/kernel/uapi/linux/virtio_9p.h
@@ -18,12 +18,12 @@
  ****************************************************************************/
 #ifndef _LINUX_VIRTIO_9P_H
 #define _LINUX_VIRTIO_9P_H
-#include <linux/types.h>
+#include <linux/virtio_types.h>
 #include <linux/virtio_ids.h>
 #include <linux/virtio_config.h>
 #define VIRTIO_9P_MOUNT_TAG 0
 struct virtio_9p_config {
-  __u16 tag_len;
+  __virtio16 tag_len;
   __u8 tag[0];
 } __attribute__((packed));
 #endif
diff --git a/libc/kernel/uapi/linux/virtio_balloon.h b/libc/kernel/uapi/linux/virtio_balloon.h
index 80affd8..d145caa 100644
--- a/libc/kernel/uapi/linux/virtio_balloon.h
+++ b/libc/kernel/uapi/linux/virtio_balloon.h
@@ -32,13 +32,13 @@
 #define VIRTIO_BALLOON_CMD_ID_STOP 0
 #define VIRTIO_BALLOON_CMD_ID_DONE 1
 struct virtio_balloon_config {
-  __u32 num_pages;
-  __u32 actual;
+  __le32 num_pages;
+  __le32 actual;
   union {
-    __u32 free_page_hint_cmd_id;
-    __u32 free_page_report_cmd_id;
+    __le32 free_page_hint_cmd_id;
+    __le32 free_page_report_cmd_id;
   };
-  __u32 poison_val;
+  __le32 poison_val;
 };
 #define VIRTIO_BALLOON_S_SWAP_IN 0
 #define VIRTIO_BALLOON_S_SWAP_OUT 1
diff --git a/libc/kernel/uapi/linux/virtio_blk.h b/libc/kernel/uapi/linux/virtio_blk.h
index 5197434..f2f0381 100644
--- a/libc/kernel/uapi/linux/virtio_blk.h
+++ b/libc/kernel/uapi/linux/virtio_blk.h
@@ -40,27 +40,27 @@
 #endif
 #define VIRTIO_BLK_ID_BYTES 20
 struct virtio_blk_config {
-  __u64 capacity;
-  __u32 size_max;
-  __u32 seg_max;
+  __virtio64 capacity;
+  __virtio32 size_max;
+  __virtio32 seg_max;
   struct virtio_blk_geometry {
-    __u16 cylinders;
+    __virtio16 cylinders;
     __u8 heads;
     __u8 sectors;
   } geometry;
-  __u32 blk_size;
+  __virtio32 blk_size;
   __u8 physical_block_exp;
   __u8 alignment_offset;
-  __u16 min_io_size;
-  __u32 opt_io_size;
+  __virtio16 min_io_size;
+  __virtio32 opt_io_size;
   __u8 wce;
   __u8 unused;
-  __u16 num_queues;
-  __u32 max_discard_sectors;
-  __u32 max_discard_seg;
-  __u32 discard_sector_alignment;
-  __u32 max_write_zeroes_sectors;
-  __u32 max_write_zeroes_seg;
+  __virtio16 num_queues;
+  __virtio32 max_discard_sectors;
+  __virtio32 max_discard_seg;
+  __virtio32 discard_sector_alignment;
+  __virtio32 max_write_zeroes_sectors;
+  __virtio32 max_write_zeroes_seg;
   __u8 write_zeroes_may_unmap;
   __u8 unused1[3];
 } __attribute__((packed));
diff --git a/libc/kernel/uapi/linux/virtio_config.h b/libc/kernel/uapi/linux/virtio_config.h
index c9ec83f..6198fd1 100644
--- a/libc/kernel/uapi/linux/virtio_config.h
+++ b/libc/kernel/uapi/linux/virtio_config.h
@@ -32,7 +32,8 @@
 #define VIRTIO_F_ANY_LAYOUT 27
 #endif
 #define VIRTIO_F_VERSION_1 32
-#define VIRTIO_F_IOMMU_PLATFORM 33
+#define VIRTIO_F_ACCESS_PLATFORM 33
+#define VIRTIO_F_IOMMU_PLATFORM VIRTIO_F_ACCESS_PLATFORM
 #define VIRTIO_F_RING_PACKED 34
 #define VIRTIO_F_ORDER_PLATFORM 36
 #define VIRTIO_F_SR_IOV 37
diff --git a/libc/kernel/uapi/linux/virtio_console.h b/libc/kernel/uapi/linux/virtio_console.h
index bf9888a..6eb4d2a 100644
--- a/libc/kernel/uapi/linux/virtio_console.h
+++ b/libc/kernel/uapi/linux/virtio_console.h
@@ -27,10 +27,10 @@
 #define VIRTIO_CONSOLE_F_EMERG_WRITE 2
 #define VIRTIO_CONSOLE_BAD_ID (~(__u32) 0)
 struct virtio_console_config {
-  __u16 cols;
-  __u16 rows;
-  __u32 max_nr_ports;
-  __u32 emerg_wr;
+  __virtio16 cols;
+  __virtio16 rows;
+  __virtio32 max_nr_ports;
+  __virtio32 emerg_wr;
 } __attribute__((packed));
 struct virtio_console_control {
   __virtio32 id;
diff --git a/libc/kernel/uapi/linux/virtio_crypto.h b/libc/kernel/uapi/linux/virtio_crypto.h
index 03727dc..2ce760f 100644
--- a/libc/kernel/uapi/linux/virtio_crypto.h
+++ b/libc/kernel/uapi/linux/virtio_crypto.h
@@ -273,19 +273,19 @@
 #define VIRTIO_CRYPTO_INVSESS 4
 #define VIRTIO_CRYPTO_S_HW_READY (1 << 0)
 struct virtio_crypto_config {
-  __u32 status;
-  __u32 max_dataqueues;
-  __u32 crypto_services;
-  __u32 cipher_algo_l;
-  __u32 cipher_algo_h;
-  __u32 hash_algo;
-  __u32 mac_algo_l;
-  __u32 mac_algo_h;
-  __u32 aead_algo;
-  __u32 max_cipher_key_len;
-  __u32 max_auth_key_len;
-  __u32 reserve;
-  __u64 max_size;
+  __le32 status;
+  __le32 max_dataqueues;
+  __le32 crypto_services;
+  __le32 cipher_algo_l;
+  __le32 cipher_algo_h;
+  __le32 hash_algo;
+  __le32 mac_algo_l;
+  __le32 mac_algo_h;
+  __le32 aead_algo;
+  __le32 max_cipher_key_len;
+  __le32 max_auth_key_len;
+  __le32 reserve;
+  __le64 max_size;
 };
 struct virtio_crypto_inhdr {
   __u8 status;
diff --git a/libc/kernel/uapi/linux/virtio_fs.h b/libc/kernel/uapi/linux/virtio_fs.h
index 41946e7..b64965f 100644
--- a/libc/kernel/uapi/linux/virtio_fs.h
+++ b/libc/kernel/uapi/linux/virtio_fs.h
@@ -24,6 +24,6 @@
 #include <linux/virtio_types.h>
 struct virtio_fs_config {
   __u8 tag[36];
-  __u32 num_request_queues;
+  __le32 num_request_queues;
 } __attribute__((packed));
 #endif
diff --git a/libc/kernel/uapi/linux/virtio_gpu.h b/libc/kernel/uapi/linux/virtio_gpu.h
index 0ac7495..b320280 100644
--- a/libc/kernel/uapi/linux/virtio_gpu.h
+++ b/libc/kernel/uapi/linux/virtio_gpu.h
@@ -223,10 +223,10 @@
 };
 #define VIRTIO_GPU_EVENT_DISPLAY (1 << 0)
 struct virtio_gpu_config {
-  __u32 events_read;
-  __u32 events_clear;
-  __u32 num_scanouts;
-  __u32 num_capsets;
+  __le32 events_read;
+  __le32 events_clear;
+  __le32 num_scanouts;
+  __le32 num_capsets;
 };
 enum virtio_gpu_formats {
   VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM = 1,
diff --git a/libc/kernel/uapi/linux/virtio_input.h b/libc/kernel/uapi/linux/virtio_input.h
index e1fc3e5..188b0bb 100644
--- a/libc/kernel/uapi/linux/virtio_input.h
+++ b/libc/kernel/uapi/linux/virtio_input.h
@@ -29,17 +29,17 @@
   VIRTIO_INPUT_CFG_ABS_INFO = 0x12,
 };
 struct virtio_input_absinfo {
-  __u32 min;
-  __u32 max;
-  __u32 fuzz;
-  __u32 flat;
-  __u32 res;
+  __le32 min;
+  __le32 max;
+  __le32 fuzz;
+  __le32 flat;
+  __le32 res;
 };
 struct virtio_input_devids {
-  __u16 bustype;
-  __u16 vendor;
-  __u16 product;
-  __u16 version;
+  __le16 bustype;
+  __le16 vendor;
+  __le16 product;
+  __le16 version;
 };
 struct virtio_input_config {
   __u8 select;
diff --git a/libc/kernel/uapi/linux/virtio_iommu.h b/libc/kernel/uapi/linux/virtio_iommu.h
index b156ea3..b08de57 100644
--- a/libc/kernel/uapi/linux/virtio_iommu.h
+++ b/libc/kernel/uapi/linux/virtio_iommu.h
@@ -26,18 +26,18 @@
 #define VIRTIO_IOMMU_F_PROBE 4
 #define VIRTIO_IOMMU_F_MMIO 5
 struct virtio_iommu_range_64 {
-  __u64 start;
-  __u64 end;
+  __le64 start;
+  __le64 end;
 };
 struct virtio_iommu_range_32 {
-  __u32 start;
-  __u32 end;
+  __le32 start;
+  __le32 end;
 };
 struct virtio_iommu_config {
-  __u64 page_size_mask;
+  __le64 page_size_mask;
   struct virtio_iommu_range_64 input_range;
   struct virtio_iommu_range_32 domain_range;
-  __u32 probe_size;
+  __le32 probe_size;
 };
 #define VIRTIO_IOMMU_T_ATTACH 0x01
 #define VIRTIO_IOMMU_T_DETACH 0x02
diff --git a/libc/kernel/uapi/linux/virtio_mem.h b/libc/kernel/uapi/linux/virtio_mem.h
index 854a2fe..d6542b7 100644
--- a/libc/kernel/uapi/linux/virtio_mem.h
+++ b/libc/kernel/uapi/linux/virtio_mem.h
@@ -69,13 +69,13 @@
   } u;
 };
 struct virtio_mem_config {
-  __u64 block_size;
-  __u16 node_id;
+  __le64 block_size;
+  __le16 node_id;
   __u8 padding[6];
-  __u64 addr;
-  __u64 region_size;
-  __u64 usable_region_size;
-  __u64 plugged_size;
-  __u64 requested_size;
+  __le64 addr;
+  __le64 region_size;
+  __le64 usable_region_size;
+  __le64 plugged_size;
+  __le64 requested_size;
 };
 #endif
diff --git a/libc/kernel/uapi/linux/virtio_net.h b/libc/kernel/uapi/linux/virtio_net.h
index cd53e16..2d92904 100644
--- a/libc/kernel/uapi/linux/virtio_net.h
+++ b/libc/kernel/uapi/linux/virtio_net.h
@@ -66,10 +66,10 @@
 #define VIRTIO_NET_RSS_HASH_TYPE_UDP_EX (1 << 8)
 struct virtio_net_config {
   __u8 mac[ETH_ALEN];
-  __u16 status;
-  __u16 max_virtqueue_pairs;
-  __u16 mtu;
-  __u32 speed;
+  __virtio16 status;
+  __virtio16 max_virtqueue_pairs;
+  __virtio16 mtu;
+  __le32 speed;
   __u8 duplex;
   __u8 rss_max_key_size;
   __le16 rss_max_indirection_table_length;
diff --git a/libc/kernel/uapi/linux/virtio_pmem.h b/libc/kernel/uapi/linux/virtio_pmem.h
index 38740f3..838f9d6 100644
--- a/libc/kernel/uapi/linux/virtio_pmem.h
+++ b/libc/kernel/uapi/linux/virtio_pmem.h
@@ -22,8 +22,8 @@
 #include <linux/virtio_ids.h>
 #include <linux/virtio_config.h>
 struct virtio_pmem_config {
-  __u64 start;
-  __u64 size;
+  __le64 start;
+  __le64 size;
 };
 #define VIRTIO_PMEM_REQ_TYPE_FLUSH 0
 struct virtio_pmem_resp {
diff --git a/libc/kernel/uapi/linux/virtio_scsi.h b/libc/kernel/uapi/linux/virtio_scsi.h
index b809e08..74e6ac8 100644
--- a/libc/kernel/uapi/linux/virtio_scsi.h
+++ b/libc/kernel/uapi/linux/virtio_scsi.h
@@ -77,16 +77,16 @@
   __virtio32 reason;
 } __attribute__((packed));
 struct virtio_scsi_config {
-  __u32 num_queues;
-  __u32 seg_max;
-  __u32 max_sectors;
-  __u32 cmd_per_lun;
-  __u32 event_info_size;
-  __u32 sense_size;
-  __u32 cdb_size;
-  __u16 max_channel;
-  __u16 max_target;
-  __u32 max_lun;
+  __virtio32 num_queues;
+  __virtio32 seg_max;
+  __virtio32 max_sectors;
+  __virtio32 cmd_per_lun;
+  __virtio32 event_info_size;
+  __virtio32 sense_size;
+  __virtio32 cdb_size;
+  __virtio16 max_channel;
+  __virtio16 max_target;
+  __virtio32 max_lun;
 } __attribute__((packed));
 #define VIRTIO_SCSI_F_INOUT 0
 #define VIRTIO_SCSI_F_HOTPLUG 1
diff --git a/libc/kernel/uapi/linux/xdp_diag.h b/libc/kernel/uapi/linux/xdp_diag.h
index f7d203f..1fe9d49 100644
--- a/libc/kernel/uapi/linux/xdp_diag.h
+++ b/libc/kernel/uapi/linux/xdp_diag.h
@@ -38,6 +38,7 @@
 #define XDP_SHOW_RING_CFG (1 << 1)
 #define XDP_SHOW_UMEM (1 << 2)
 #define XDP_SHOW_MEMINFO (1 << 3)
+#define XDP_SHOW_STATS (1 << 4)
 enum {
   XDP_DIAG_NONE,
   XDP_DIAG_INFO,
@@ -48,6 +49,7 @@
   XDP_DIAG_UMEM_FILL_RING,
   XDP_DIAG_UMEM_COMPLETION_RING,
   XDP_DIAG_MEMINFO,
+  XDP_DIAG_STATS,
   __XDP_DIAG_MAX,
 };
 #define XDP_DIAG_MAX (__XDP_DIAG_MAX - 1)
@@ -70,4 +72,12 @@
   __u32 flags;
   __u32 refs;
 };
+struct xdp_diag_stats {
+  __u64 n_rx_dropped;
+  __u64 n_rx_invalid;
+  __u64 n_rx_full;
+  __u64 n_fill_ring_empty;
+  __u64 n_tx_invalid;
+  __u64 n_tx_ring_empty;
+};
 #endif
diff --git a/libc/kernel/uapi/linux/xfrm.h b/libc/kernel/uapi/linux/xfrm.h
index ea0ef5e..b0e930c 100644
--- a/libc/kernel/uapi/linux/xfrm.h
+++ b/libc/kernel/uapi/linux/xfrm.h
@@ -328,6 +328,7 @@
 #define XFRM_STATE_ESN 128
 };
 #define XFRM_SA_XFLAG_DONT_ENCAP_DSCP 1
+#define XFRM_SA_XFLAG_OSEQ_MAY_WRAP 2
 struct xfrm_usersa_id {
   xfrm_address_t daddr;
   __be32 spi;
diff --git a/libc/kernel/uapi/misc/habanalabs.h b/libc/kernel/uapi/misc/habanalabs.h
index 3ae1722..b235f51 100644
--- a/libc/kernel/uapi/misc/habanalabs.h
+++ b/libc/kernel/uapi/misc/habanalabs.h
@@ -223,6 +223,7 @@
 #define HL_INFO_CLK_RATE 8
 #define HL_INFO_RESET_COUNT 9
 #define HL_INFO_TIME_SYNC 10
+#define HL_INFO_CS_COUNTERS 11
 #define HL_INFO_VERSION_MAX_LEN 128
 #define HL_INFO_CARD_NAME_MAX_LEN 16
 struct hl_info_hw_ip_info {
@@ -273,6 +274,16 @@
   __u64 device_time;
   __u64 host_time;
 };
+struct hl_cs_counters {
+  __u64 out_of_mem_drop_cnt;
+  __u64 parsing_drop_cnt;
+  __u64 queue_full_drop_cnt;
+  __u64 device_in_reset_drop_cnt;
+};
+struct hl_info_cs_counters {
+  struct hl_cs_counters cs_counters;
+  struct hl_cs_counters ctx_cs_counters;
+};
 struct hl_info_args {
   __u64 return_pointer;
   __u32 return_size;
diff --git a/libc/kernel/uapi/rdma/efa-abi.h b/libc/kernel/uapi/rdma/efa-abi.h
index 39fd55b..86cfac6 100644
--- a/libc/kernel/uapi/rdma/efa-abi.h
+++ b/libc/kernel/uapi/rdma/efa-abi.h
@@ -20,6 +20,14 @@
 #define EFA_ABI_USER_H
 #include <linux/types.h>
 #define EFA_UVERBS_ABI_VERSION 1
+enum {
+  EFA_ALLOC_UCONTEXT_CMD_COMP_TX_BATCH = 1 << 0,
+  EFA_ALLOC_UCONTEXT_CMD_COMP_MIN_SQ_WR = 1 << 1,
+};
+struct efa_ibv_alloc_ucontext_cmd {
+  __u32 comp_mask;
+  __u8 reserved_20[4];
+};
 enum efa_ibv_user_cmds_supp_udata {
   EFA_USER_CMDS_SUPP_UDATA_QUERY_DEVICE = 1 << 0,
   EFA_USER_CMDS_SUPP_UDATA_CREATE_AH = 1 << 1,
@@ -30,6 +38,9 @@
   __u16 sub_cqs_per_cq;
   __u16 inline_buf_size;
   __u32 max_llq_size;
+  __u16 max_tx_batch;
+  __u16 min_sq_wr;
+  __u8 reserved_a0[4];
 };
 struct efa_ibv_alloc_pd_resp {
   __u32 comp_mask;
diff --git a/libc/kernel/uapi/rdma/ib_user_ioctl_cmds.h b/libc/kernel/uapi/rdma/ib_user_ioctl_cmds.h
index e38bd93..22be9fd 100644
--- a/libc/kernel/uapi/rdma/ib_user_ioctl_cmds.h
+++ b/libc/kernel/uapi/rdma/ib_user_ioctl_cmds.h
@@ -50,6 +50,7 @@
   UVERBS_METHOD_INFO_HANDLES,
   UVERBS_METHOD_QUERY_PORT,
   UVERBS_METHOD_GET_CONTEXT,
+  UVERBS_METHOD_QUERY_CONTEXT,
 };
 enum uverbs_attrs_invoke_write_cmd_attr_ids {
   UVERBS_ATTR_CORE_IN,
@@ -64,6 +65,10 @@
   UVERBS_ATTR_GET_CONTEXT_NUM_COMP_VECTORS,
   UVERBS_ATTR_GET_CONTEXT_CORE_SUPPORT,
 };
+enum uverbs_attrs_query_context_attr_ids {
+  UVERBS_ATTR_QUERY_CONTEXT_NUM_COMP_VECTORS,
+  UVERBS_ATTR_QUERY_CONTEXT_CORE_SUPPORT,
+};
 enum uverbs_attrs_create_cq_cmd_attr_ids {
   UVERBS_ATTR_CREATE_CQ_HANDLE,
   UVERBS_ATTR_CREATE_CQ_CQE,
@@ -198,6 +203,7 @@
   UVERBS_METHOD_DM_MR_REG,
   UVERBS_METHOD_MR_DESTROY,
   UVERBS_METHOD_ADVISE_MR,
+  UVERBS_METHOD_QUERY_MR,
 };
 enum uverbs_attrs_mr_destroy_ids {
   UVERBS_ATTR_DESTROY_MR_HANDLE,
@@ -208,6 +214,13 @@
   UVERBS_ATTR_ADVISE_MR_FLAGS,
   UVERBS_ATTR_ADVISE_MR_SGE_LIST,
 };
+enum uverbs_attrs_query_mr_cmd_attr_ids {
+  UVERBS_ATTR_QUERY_MR_HANDLE,
+  UVERBS_ATTR_QUERY_MR_RESP_LKEY,
+  UVERBS_ATTR_QUERY_MR_RESP_RKEY,
+  UVERBS_ATTR_QUERY_MR_RESP_LENGTH,
+  UVERBS_ATTR_QUERY_MR_RESP_IOVA,
+};
 enum uverbs_attrs_create_counters_cmd_attr_ids {
   UVERBS_ATTR_CREATE_COUNTERS_HANDLE,
 };
diff --git a/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h b/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h
index 0b7cead..d46121a 100644
--- a/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h
+++ b/libc/kernel/uapi/rdma/mlx5_user_ioctl_cmds.h
@@ -178,6 +178,9 @@
   MLX5_IB_METHOD_FLOW_MATCHER_CREATE = (1U << UVERBS_ID_NS_SHIFT),
   MLX5_IB_METHOD_FLOW_MATCHER_DESTROY,
 };
+enum mlx5_ib_device_query_context_attrs {
+  MLX5_IB_ATTR_QUERY_CONTEXT_RESP_UCTX = (1U << UVERBS_ID_NS_SHIFT),
+};
 #define MLX5_IB_DW_MATCH_PARAM 0x80
 struct mlx5_ib_match_params {
   __u32 match_params[MLX5_IB_DW_MATCH_PARAM];
@@ -204,7 +207,7 @@
   MLX5_IB_ATTR_CREATE_FLOW_ARR_COUNTERS_DEVX_OFFSET,
   MLX5_IB_ATTR_CREATE_FLOW_FLAGS,
 };
-enum mlx5_ib_destoy_flow_attrs {
+enum mlx5_ib_destroy_flow_attrs {
   MLX5_IB_ATTR_DESTROY_FLOW_HANDLE = (1U << UVERBS_ID_NS_SHIFT),
 };
 enum mlx5_ib_flow_methods {
@@ -226,4 +229,11 @@
   MLX5_IB_ATTR_CREATE_PACKET_REFORMAT_FT_TYPE,
   MLX5_IB_ATTR_CREATE_PACKET_REFORMAT_DATA_BUF,
 };
+enum mlx5_ib_query_pd_attrs {
+  MLX5_IB_ATTR_QUERY_PD_HANDLE = (1U << UVERBS_ID_NS_SHIFT),
+  MLX5_IB_ATTR_QUERY_PD_RESP_PDN,
+};
+enum mlx5_ib_pd_methods {
+  MLX5_IB_METHOD_PD_QUERY = (1U << UVERBS_ID_NS_SHIFT),
+};
 #endif
diff --git a/libc/kernel/uapi/rdma/qedr-abi.h b/libc/kernel/uapi/rdma/qedr-abi.h
index 2e666f3..bf6dc76 100644
--- a/libc/kernel/uapi/rdma/qedr-abi.h
+++ b/libc/kernel/uapi/rdma/qedr-abi.h
@@ -21,8 +21,9 @@
 #include <linux/types.h>
 #define QEDR_ABI_VERSION (8)
 enum qedr_alloc_ucontext_flags {
-  QEDR_ALLOC_UCTX_RESERVED = 1 << 0,
-  QEDR_ALLOC_UCTX_DB_REC = 1 << 1
+  QEDR_ALLOC_UCTX_EDPM_MODE = 1 << 0,
+  QEDR_ALLOC_UCTX_DB_REC = 1 << 1,
+  QEDR_SUPPORT_DPM_SIZES = 1 << 2,
 };
 struct qedr_alloc_ucontext_req {
   __u32 context_flags;
@@ -30,12 +31,13 @@
 };
 #define QEDR_LDPM_MAX_SIZE (8192)
 #define QEDR_EDPM_TRANS_SIZE (64)
+#define QEDR_EDPM_MAX_SIZE (ROCE_REQ_MAX_INLINE_DATA_SIZE)
 enum qedr_rdma_dpm_type {
   QEDR_DPM_TYPE_NONE = 0,
   QEDR_DPM_TYPE_ROCE_ENHANCED = 1 << 0,
   QEDR_DPM_TYPE_ROCE_LEGACY = 1 << 1,
   QEDR_DPM_TYPE_IWARP_LEGACY = 1 << 2,
-  QEDR_DPM_TYPE_RESERVED = 1 << 3,
+  QEDR_DPM_TYPE_ROCE_EDPM_MODE = 1 << 3,
   QEDR_DPM_SIZES_SET = 1 << 4,
 };
 struct qedr_alloc_ucontext_resp {
@@ -54,6 +56,8 @@
   __u16 ldpm_limit_size;
   __u8 edpm_trans_size;
   __u8 reserved;
+  __u16 edpm_limit_size;
+  __u8 padding[6];
 };
 struct qedr_alloc_pd_ureq {
   __aligned_u64 rsvd1;
diff --git a/libc/kernel/uapi/rdma/rdma_netlink.h b/libc/kernel/uapi/rdma/rdma_netlink.h
index ed585cf..48444da 100644
--- a/libc/kernel/uapi/rdma/rdma_netlink.h
+++ b/libc/kernel/uapi/rdma/rdma_netlink.h
@@ -204,6 +204,9 @@
   RDMA_NLDEV_CMD_STAT_SET,
   RDMA_NLDEV_CMD_STAT_GET,
   RDMA_NLDEV_CMD_STAT_DEL,
+  RDMA_NLDEV_CMD_RES_QP_GET_RAW,
+  RDMA_NLDEV_CMD_RES_CQ_GET_RAW,
+  RDMA_NLDEV_CMD_RES_MR_GET_RAW,
   RDMA_NLDEV_NUM_OPS
 };
 enum rdma_nldev_print_type {
@@ -297,6 +300,7 @@
   RDMA_NLDEV_ATTR_STAT_HWCOUNTER_ENTRY_NAME,
   RDMA_NLDEV_ATTR_STAT_HWCOUNTER_ENTRY_VALUE,
   RDMA_NLDEV_ATTR_DEV_DIM,
+  RDMA_NLDEV_ATTR_RES_RAW,
   RDMA_NLDEV_ATTR_MAX
 };
 enum rdma_nl_counter_mode {
@@ -307,5 +311,6 @@
 };
 enum rdma_nl_counter_mask {
   RDMA_COUNTER_MASK_QP_TYPE = 1,
+  RDMA_COUNTER_MASK_PID = 1 << 1,
 };
 #endif
diff --git a/libc/kernel/uapi/scsi/fc/fc_els.h b/libc/kernel/uapi/scsi/fc/fc_els.h
index 843bc4e..9822579 100644
--- a/libc/kernel/uapi/scsi/fc/fc_els.h
+++ b/libc/kernel/uapi/scsi/fc/fc_els.h
@@ -42,6 +42,7 @@
   ELS_REC = 0x13,
   ELS_SRR = 0x14,
   ELS_FPIN = 0x16,
+  ELS_RDP = 0x18,
   ELS_RDF = 0x19,
   ELS_PRLI = 0x20,
   ELS_PRLO = 0x21,
@@ -84,7 +85,7 @@
   ELS_LKA = 0x80,
   ELS_AUTH_ELS = 0x90,
 };
-#define FC_ELS_CMDS_INIT {[ELS_LS_RJT] = "LS_RJT",[ELS_LS_ACC] = "LS_ACC",[ELS_PLOGI] = "PLOGI",[ELS_FLOGI] = "FLOGI",[ELS_LOGO] = "LOGO",[ELS_ABTX] = "ABTX",[ELS_RCS] = "RCS",[ELS_RES] = "RES",[ELS_RSS] = "RSS",[ELS_RSI] = "RSI",[ELS_ESTS] = "ESTS",[ELS_ESTC] = "ESTC",[ELS_ADVC] = "ADVC",[ELS_RTV] = "RTV",[ELS_RLS] = "RLS",[ELS_ECHO] = "ECHO",[ELS_TEST] = "TEST",[ELS_RRQ] = "RRQ",[ELS_REC] = "REC",[ELS_SRR] = "SRR",[ELS_FPIN] = "FPIN",[ELS_RDF] = "RDF",[ELS_PRLI] = "PRLI",[ELS_PRLO] = "PRLO",[ELS_SCN] = "SCN",[ELS_TPLS] = "TPLS",[ELS_TPRLO] = "TPRLO",[ELS_LCLM] = "LCLM",[ELS_GAID] = "GAID",[ELS_FACT] = "FACT",[ELS_FDACDT] = "FDACDT",[ELS_NACT] = "NACT",[ELS_NDACT] = "NDACT",[ELS_QOSR] = "QOSR",[ELS_RVCS] = "RVCS",[ELS_PDISC] = "PDISC",[ELS_FDISC] = "FDISC",[ELS_ADISC] = "ADISC",[ELS_RNC] = "RNC",[ELS_FARP_REQ] = "FARP_REQ",[ELS_FARP_REPL] = "FARP_REPL",[ELS_RPS] = "RPS",[ELS_RPL] = "RPL",[ELS_RPBC] = "RPBC",[ELS_FAN] = "FAN",[ELS_RSCN] = "RSCN",[ELS_SCR] = "SCR",[ELS_RNFT] = "RNFT",[ELS_CSR] = "CSR",[ELS_CSU] = "CSU",[ELS_LINIT] = "LINIT",[ELS_LSTS] = "LSTS",[ELS_RNID] = "RNID",[ELS_RLIR] = "RLIR",[ELS_LIRR] = "LIRR",[ELS_SRL] = "SRL",[ELS_SBRP] = "SBRP",[ELS_RPSC] = "RPSC",[ELS_QSA] = "QSA",[ELS_EVFP] = "EVFP",[ELS_LKA] = "LKA",[ELS_AUTH_ELS] = "AUTH_ELS", \
+#define FC_ELS_CMDS_INIT {[ELS_LS_RJT] = "LS_RJT",[ELS_LS_ACC] = "LS_ACC",[ELS_PLOGI] = "PLOGI",[ELS_FLOGI] = "FLOGI",[ELS_LOGO] = "LOGO",[ELS_ABTX] = "ABTX",[ELS_RCS] = "RCS",[ELS_RES] = "RES",[ELS_RSS] = "RSS",[ELS_RSI] = "RSI",[ELS_ESTS] = "ESTS",[ELS_ESTC] = "ESTC",[ELS_ADVC] = "ADVC",[ELS_RTV] = "RTV",[ELS_RLS] = "RLS",[ELS_ECHO] = "ECHO",[ELS_TEST] = "TEST",[ELS_RRQ] = "RRQ",[ELS_REC] = "REC",[ELS_SRR] = "SRR",[ELS_FPIN] = "FPIN",[ELS_RDP] = "RDP",[ELS_RDF] = "RDF",[ELS_PRLI] = "PRLI",[ELS_PRLO] = "PRLO",[ELS_SCN] = "SCN",[ELS_TPLS] = "TPLS",[ELS_TPRLO] = "TPRLO",[ELS_LCLM] = "LCLM",[ELS_GAID] = "GAID",[ELS_FACT] = "FACT",[ELS_FDACDT] = "FDACDT",[ELS_NACT] = "NACT",[ELS_NDACT] = "NDACT",[ELS_QOSR] = "QOSR",[ELS_RVCS] = "RVCS",[ELS_PDISC] = "PDISC",[ELS_FDISC] = "FDISC",[ELS_ADISC] = "ADISC",[ELS_RNC] = "RNC",[ELS_FARP_REQ] = "FARP_REQ",[ELS_FARP_REPL] = "FARP_REPL",[ELS_RPS] = "RPS",[ELS_RPL] = "RPL",[ELS_RPBC] = "RPBC",[ELS_FAN] = "FAN",[ELS_RSCN] = "RSCN",[ELS_SCR] = "SCR",[ELS_RNFT] = "RNFT",[ELS_CSR] = "CSR",[ELS_CSU] = "CSU",[ELS_LINIT] = "LINIT",[ELS_LSTS] = "LSTS",[ELS_RNID] = "RNID",[ELS_RLIR] = "RLIR",[ELS_LIRR] = "LIRR",[ELS_SRL] = "SRL",[ELS_SBRP] = "SBRP",[ELS_RPSC] = "RPSC",[ELS_QSA] = "QSA",[ELS_EVFP] = "EVFP",[ELS_LKA] = "LKA",[ELS_AUTH_ELS] = "AUTH_ELS", \
 }
 struct fc_els_ls_acc {
   __u8 la_cmd;
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index a224eab..a17a33f 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1476,8 +1476,8 @@
     # Used by libandroid_net
     android_getaddrinfofornet; # apex
 
-    # Used by libandroid_runtime, libmedia and libmediautils
-    android_mallopt; # apex
+    # Used by libandroid_runtime, libcutils, libmedia, and libmediautils
+    android_mallopt; # apex llndk
 } LIBC_P;
 
 LIBC_R { # introduced=R
@@ -1718,6 +1718,7 @@
     android_gethostbyaddrfornetcontext;
     android_gethostbynamefornet;
     android_gethostbynamefornetcontext;
+    android_run_on_all_threads;
     android_unsafe_frame_pointer_chase;
     arc4random_addrandom; # arm x86
     arc4random_stir; # arm x86
diff --git a/libc/platform/bionic/malloc.h b/libc/platform/bionic/malloc.h
index f9eb03f..56badf0 100644
--- a/libc/platform/bionic/malloc.h
+++ b/libc/platform/bionic/malloc.h
@@ -85,8 +85,8 @@
   //   arg_size = sizeof(android_mallopt_leak_info_t)
   M_FREE_MALLOC_LEAK_INFO = 7,
 #define M_FREE_MALLOC_LEAK_INFO M_FREE_MALLOC_LEAK_INFO
-  // Change the heap tagging state. The program must be single threaded at the point when the
-  // android_mallopt function is called.
+  // Change the heap tagging state. May be called at any time including when
+  // multiple threads are running.
   //   arg = HeapTaggingLevel*
   //   arg_size = sizeof(HeapTaggingLevel)
   M_SET_HEAP_TAGGING_LEVEL = 8,
@@ -105,18 +105,27 @@
   //   arg_size = sizeof(bool)
   M_INITIALIZE_GWP_ASAN = 10,
 #define M_INITIALIZE_GWP_ASAN M_INITIALIZE_GWP_ASAN
+  // Disable heap initialization across the whole process. If the hardware supports memory
+  // tagging, it also disables memory tagging. May be called at any time including
+  // when multiple threads are running. arg and arg_size are unused and must be set to 0.
+  // Note that the memory mitigations are only implemented in scudo and therefore this API call will
+  // have no effect when using another allocator.
+  M_DISABLE_MEMORY_MITIGATIONS = 11,
+#define M_DISABLE_MEMORY_MITIGATIONS M_DISABLE_MEMORY_MITIGATIONS
 };
 
 enum HeapTaggingLevel {
-  // Disable heap tagging. The program must use prctl(PR_SET_TAGGED_ADDR_CTRL) to disable memory tag
-  // checks before disabling heap tagging. Heap tagging may not be re-enabled after being disabled.
+  // Disable heap tagging and memory tag checks if supported. Heap tagging may not be re-enabled
+  // after being disabled.
   M_HEAP_TAGGING_LEVEL_NONE = 0,
   // Address-only tagging. Heap pointers have a non-zero tag in the most significant byte which is
   // checked in free(). Memory accesses ignore the tag.
   M_HEAP_TAGGING_LEVEL_TBI = 1,
-  // Enable heap tagging if supported, at a level appropriate for asynchronous memory tag checks.
+  // Enable heap tagging and asynchronous memory tag checks if supported. Disable stack trace
+  // collection.
   M_HEAP_TAGGING_LEVEL_ASYNC = 2,
-  // Enable heap tagging if supported, at a level appropriate for synchronous memory tag checks.
+  // Enable heap tagging and synchronous memory tag checks if supported. Enable stack trace
+  // collection.
   M_HEAP_TAGGING_LEVEL_SYNC = 3,
 };
 
diff --git a/libc/platform/bionic/pac.h b/libc/platform/bionic/pac.h
new file mode 100644
index 0000000..34efc48
--- /dev/null
+++ b/libc/platform/bionic/pac.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stddef.h>
+
+inline uintptr_t __bionic_clear_pac_bits(uintptr_t ptr) {
+#if defined(__aarch64__)
+  register uintptr_t x30 __asm("x30") = ptr;
+  // This is a NOP on pre-Armv8.3-A architectures.
+  asm("xpaclri" : "+r"(x30));
+  return x30;
+#else
+  return ptr;
+#endif
+}
diff --git a/libc/platform/bionic/reserved_signals.h b/libc/platform/bionic/reserved_signals.h
index e8e517e..dab58af 100644
--- a/libc/platform/bionic/reserved_signals.h
+++ b/libc/platform/bionic/reserved_signals.h
@@ -43,9 +43,7 @@
 //   37 (__SIGRTMIN + 5)        coverage (libprofile-extras)
 //   38 (__SIGRTMIN + 6)        heapprofd ART managed heap dumps
 //   39 (__SIGRTMIN + 7)        fdtrack
-//
-// If you change this, also change __ndk_legacy___libc_current_sigrtmin
-// in <android/legacy_signal_inlines.h> to match.
+//   40 (__SIGRTMIN + 8)        android_run_on_all_threads (bionic/pthread_internal.cpp)
 
 #define BIONIC_SIGNAL_POSIX_TIMERS (__SIGRTMIN + 0)
 #define BIONIC_SIGNAL_BACKTRACE (__SIGRTMIN + 1)
@@ -53,8 +51,9 @@
 #define BIONIC_SIGNAL_PROFILER (__SIGRTMIN + 4)
 #define BIONIC_SIGNAL_ART_PROFILER (__SIGRTMIN + 6)
 #define BIONIC_SIGNAL_FDTRACK (__SIGRTMIN + 7)
+#define BIONIC_SIGNAL_RUN_ON_ALL_THREADS (__SIGRTMIN + 8)
 
-#define __SIGRT_RESERVED 8
+#define __SIGRT_RESERVED 9
 static inline __always_inline sigset64_t filter_reserved_signals(sigset64_t sigset, int how) {
   int (*block)(sigset64_t*, int);
   int (*unblock)(sigset64_t*, int);
@@ -83,5 +82,6 @@
   unblock(&sigset, __SIGRTMIN + 5);
   unblock(&sigset, __SIGRTMIN + 6);
   unblock(&sigset, __SIGRTMIN + 7);
+  unblock(&sigset, __SIGRTMIN + 8);
   return sigset;
 }
diff --git a/libdl/Android.bp b/libdl/Android.bp
index 1a5439f..9a31d36 100644
--- a/libdl/Android.bp
+++ b/libdl/Android.bp
@@ -5,6 +5,7 @@
     name: "libdl_static",
     defaults: ["linux_bionic_supported"],
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
 
@@ -36,9 +37,11 @@
 cc_library {
     name: "libdl",
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
     static_ndk_lib: true,
+    llndk_stubs: "libdl.llndk",
 
     defaults: ["linux_bionic_supported"],
 
@@ -135,6 +138,7 @@
 
     defaults: ["linux_bionic_supported"],
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
 
@@ -218,7 +222,7 @@
 }
 
 llndk_library {
-    name: "libdl",
+    name: "libdl.llndk",
     native_bridge_supported: true,
     symbol_file: "libdl.map.txt",
 }
diff --git a/libm/Android.bp b/libm/Android.bp
index 7f96975..6c8ad22 100644
--- a/libm/Android.bp
+++ b/libm/Android.bp
@@ -5,8 +5,10 @@
     name: "libm",
     defaults: ["linux_bionic_supported"],
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     static_ndk_lib: true,
+    llndk_stubs: "libm.llndk",
 
     whole_static_libs: ["libarm-optimized-routines-math"],
 
@@ -520,7 +522,7 @@
 }
 
 llndk_library {
-    name: "libm",
+    name: "libm.llndk",
     native_bridge_supported: true,
     symbol_file: "libm.map.txt",
 }
diff --git a/linker/Android.bp b/linker/Android.bp
index 15585a7..8a2809a 100644
--- a/linker/Android.bp
+++ b/linker/Android.bp
@@ -124,6 +124,7 @@
     name: "linker_all_targets",
     defaults: ["linux_bionic_supported"],
     recovery_available: true,
+    vendor_ramdisk_available: true,
     native_bridge_supported: true,
 }
 
@@ -336,6 +337,7 @@
     compile_multilib: "both",
 
     recovery_available: true,
+    vendor_ramdisk_available: true,
     apex_available: [
         "//apex_available:platform",
         "com.android.runtime",
@@ -413,6 +415,7 @@
     name: "ld-android",
     defaults: ["linux_bionic_supported", "linker_version_script_overlay"],
     ramdisk_available: true,
+    vendor_ramdisk_available: true,
     recovery_available: true,
     native_bridge_supported: true,
 
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 77f754c..2481be4 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -3458,23 +3458,19 @@
 
   const Config* config = nullptr;
 
-  std::string error_msg;
-
-  std::string ld_config_file_path = get_ld_config_file_path(executable_path);
-
-  INFO("[ Reading linker config \"%s\" ]", ld_config_file_path.c_str());
-  if (!Config::read_binary_config(ld_config_file_path.c_str(),
-                                  executable_path,
-                                  g_is_asan,
-                                  &config,
-                                  &error_msg)) {
-    if (!error_msg.empty()) {
-      DL_WARN("Warning: couldn't read \"%s\" for \"%s\" (using default configuration instead): %s",
-              ld_config_file_path.c_str(),
-              executable_path,
-              error_msg.c_str());
+  {
+    std::string ld_config_file_path = get_ld_config_file_path(executable_path);
+    INFO("[ Reading linker config \"%s\" ]", ld_config_file_path.c_str());
+    ScopedTrace trace(("linker config " + ld_config_file_path).c_str());
+    std::string error_msg;
+    if (!Config::read_binary_config(ld_config_file_path.c_str(), executable_path, g_is_asan,
+                                    &config, &error_msg)) {
+      if (!error_msg.empty()) {
+        DL_WARN("Warning: couldn't read '%s' for '%s' (using default configuration instead): %s",
+                ld_config_file_path.c_str(), executable_path, error_msg.c_str());
+      }
+      config = nullptr;
     }
-    config = nullptr;
   }
 
   if (config == nullptr) {
diff --git a/tests/Android.bp b/tests/Android.bp
index bf921c8..a7f6229 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -308,6 +308,7 @@
     srcs: [
         "__aeabi_read_tp_test.cpp",
         "__cxa_atexit_test.cpp",
+        "__cxa_demangle_test.cpp",
         "alloca_test.cpp",
         "android_get_device_api_level.cpp",
         "arpa_inet_test.cpp",
@@ -365,6 +366,7 @@
         "netinet_udp_test.cpp",
         "nl_types_test.cpp",
         "poll_test.cpp",
+        "prio_ctor_test.cpp",
         "pthread_test.cpp",
         "pty_test.cpp",
         "regex_test.cpp",
@@ -991,6 +993,8 @@
         "ld_config_test_helper_lib1",
         "ld_config_test_helper_lib2",
         "ld_config_test_helper_lib3",
+        "tls_properties_helper",
+        "thread_exit_cb_helper",
     ],
 }
 
diff --git a/tests/__cxa_demangle_test.cpp b/tests/__cxa_demangle_test.cpp
new file mode 100644
index 0000000..4628a61
--- /dev/null
+++ b/tests/__cxa_demangle_test.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <cxxabi.h>
+#include <gtest/gtest.h>
+
+extern "C" char* __cxa_demangle(const char*, char*, size_t*, int*);
+
+TEST(__cxa_demangle, cxa_demangle_fuzz_152588929) {
+#if defined(__aarch64__)
+  char* p = __cxa_demangle("1\006ILeeeEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE", 0, 0, 0);
+  ASSERT_STREQ("\x6<-0x1.cecececececececececececececep+11983", p);
+  free(p);
+#endif
+}
+
+TEST(__cxa_demangle, DISABLED_cxa_demangle_fuzz_167977068) {
+#if defined(__aarch64__)
+  char* p = __cxa_demangle("DTLeeeeeeeeeeeeeeeeeeeeeeeeeEEEEeeEEEE", 0, 0, 0);
+  ASSERT_EQ(nullptr, p) << p;
+  free(p);
+#endif
+}
diff --git a/tests/fenv_test.cpp b/tests/fenv_test.cpp
index e983a1c..89c7fd5 100644
--- a/tests/fenv_test.cpp
+++ b/tests/fenv_test.cpp
@@ -22,19 +22,20 @@
 #include <stdint.h>
 
 static void TestRounding(float expectation1, float expectation2) {
-  // volatile to prevent compiler optimizations.
+  // Volatile to prevent compile-time evaluation.
   volatile float f = 1.968750f;
   volatile float m = 0x1.0p23f;
-  volatile float x = f + m;
+  float x;
+  DoNotOptimize(x = f + m);
   ASSERT_FLOAT_EQ(expectation1, x);
-  x = x - m;
+  DoNotOptimize(x = x - m);
   ASSERT_EQ(expectation2, x);
 }
 
 static void DivideByZero() {
-  // volatile to prevent compiler optimizations.
+  // Volatile to prevent compile-time evaluation.
   volatile float zero = 0.0f;
-  volatile float result __attribute__((unused)) = 123.0f / zero;
+  DoNotOptimize(123.0f / zero);
 }
 
 TEST(fenv, fesetround_fegetround_FE_TONEAREST) {
diff --git a/tests/heap_tagging_level_test.cpp b/tests/heap_tagging_level_test.cpp
index 05123fd..1dbf455 100644
--- a/tests/heap_tagging_level_test.cpp
+++ b/tests/heap_tagging_level_test.cpp
@@ -77,21 +77,8 @@
 }
 
 #if defined(__BIONIC__) && defined(__aarch64__) && defined(ANDROID_EXPERIMENTAL_MTE)
-template <int SiCode> void CheckSiCode(int, siginfo_t* info, void*) {
-  if (info->si_code != SiCode) {
-    _exit(2);
-  }
-  _exit(1);
-}
-
-static bool SetTagCheckingLevel(int level) {
-  int tagged_addr_ctrl = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);
-  if (tagged_addr_ctrl < 0) {
-    return false;
-  }
-
-  tagged_addr_ctrl = (tagged_addr_ctrl & ~PR_MTE_TCF_MASK) | level;
-  return prctl(PR_SET_TAGGED_ADDR_CTRL, tagged_addr_ctrl, 0, 0, 0) == 0;
+void ExitWithSiCode(int, siginfo_t* info, void*) {
+  _exit(info->si_code);
 }
 #endif
 
@@ -108,30 +95,26 @@
   // mismatching tag before each allocation.
   EXPECT_EXIT(
       {
-        ScopedSignalHandler ssh(SIGSEGV, CheckSiCode<SEGV_MTEAERR>, SA_SIGINFO);
+        ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
         p[-1] = 42;
       },
-      testing::ExitedWithCode(1), "");
+      testing::ExitedWithCode(SEGV_MTEAERR), "");
 
-  EXPECT_TRUE(SetTagCheckingLevel(PR_MTE_TCF_SYNC));
+  EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_SYNC));
   EXPECT_EXIT(
       {
-        ScopedSignalHandler ssh(SIGSEGV, CheckSiCode<SEGV_MTESERR>, SA_SIGINFO);
+        ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
         p[-1] = 42;
       },
-      testing::ExitedWithCode(1), "");
+      testing::ExitedWithCode(SEGV_MTESERR), "");
 
-  EXPECT_TRUE(SetTagCheckingLevel(PR_MTE_TCF_NONE));
+  EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_NONE));
   volatile int oob ATTRIBUTE_UNUSED = p[-1];
 #endif
 }
 
 TEST(heap_tagging_level, none_pointers_untagged) {
 #if defined(__BIONIC__)
-#if defined(__aarch64__) && defined(ANDROID_EXPERIMENTAL_MTE)
-  EXPECT_TRUE(SetTagCheckingLevel(PR_MTE_TCF_NONE));
-#endif
-
   EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_NONE));
   std::unique_ptr<int[]> p = std::make_unique<int[]>(4);
   EXPECT_EQ(untag_address(p.get()), p.get());
@@ -146,10 +129,6 @@
     GTEST_SKIP() << "Kernel doesn't support tagged pointers.";
   }
 
-#if defined(ANDROID_EXPERIMENTAL_MTE)
-  EXPECT_TRUE(SetTagCheckingLevel(PR_MTE_TCF_NONE));
-#endif
-
   EXPECT_FALSE(SetHeapTaggingLevel(static_cast<HeapTaggingLevel>(12345)));
 
   if (mte_supported()) {
@@ -190,10 +169,6 @@
     GTEST_SKIP() << "requires MTE support";
   }
 
-#if defined(ANDROID_EXPERIMENTAL_MTE)
-  EXPECT_TRUE(SetTagCheckingLevel(PR_MTE_TCF_NONE));
-#endif
-
   EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_SYNC));
   EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_NONE));
 #else
diff --git a/tests/libs/Android.bp b/tests/libs/Android.bp
index ef4fddd..4b86faf 100644
--- a/tests/libs/Android.bp
+++ b/tests/libs/Android.bp
@@ -80,7 +80,7 @@
 }
 
 cc_test {
-   name: "thread_exit_cb_helper.cpp",
+   name: "thread_exit_cb_helper",
    defaults: ["bionic_testlib_defaults"],
    srcs: ["thread_exit_cb_helper.cpp"],
    cflags: ["-fno-emulated-tls"],
diff --git a/tests/libs/tls_properties_helper.cpp b/tests/libs/tls_properties_helper.cpp
index 3f8d118..5982de4 100644
--- a/tests/libs/tls_properties_helper.cpp
+++ b/tests/libs/tls_properties_helper.cpp
@@ -34,8 +34,19 @@
 
 #include <assert.h>
 #include <dlfcn.h>
+#include <elf.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
 #include <stdio.h>
-#include <unistd.h>  // for gettid
+#include <string.h>
+#include <sys/prctl.h>
+#include <sys/ptrace.h>
+#include <sys/uio.h>
+#include <sys/user.h>
+#include <sys/wait.h>
+#include <unistd.h>
 
 // Helper binary to use TLS-related functions in thread_properties
 
@@ -59,20 +70,54 @@
 // Tests iterate_dynamic tls chunks.
 // Export a var from the shared so.
 __thread char large_tls_var[4 * 1024 * 1024];
+// found_count  has to be Global variable so that the non-capturing lambda
+// can access it.
+int found_count = 0;
 void test_iter_tls() {
   void* lib = dlopen("libtest_elftls_dynamic.so", RTLD_LOCAL | RTLD_NOW);
-
-  int i = 0;
-  auto cb = [&](void* dtls_begin, void* dtls_end, size_t dso_id, void* arg) {
-    printf("iterate_cb i = %d\n", i++);
+  large_tls_var[1025] = 'a';
+  auto cb = +[](void* dtls_begin, void* dtls_end, size_t dso_id, void* arg) {
+    if (&large_tls_var >= dtls_begin && &large_tls_var < dtls_end) ++found_count;
   };
   __libc_iterate_dynamic_tls(gettid(), cb, nullptr);
+
+  // It should be found exactly once.
+  assert(found_count == 1);
   printf("done_iterate_dynamic_tls\n");
 }
 
+void* parent_addr = nullptr;
+void test_iterate_another_thread_tls() {
+  large_tls_var[1025] = 'b';
+  parent_addr = &large_tls_var;
+  found_count = 0;
+
+  pid_t pid = fork();
+  assert(pid != -1);
+  int status;
+  if (pid) {
+    // Parent.
+    assert(pid == wait(&status));
+    assert(0 == status);
+  } else {
+    // Child.
+    pid_t parent_pid = getppid();
+    assert(0 == ptrace(PTRACE_ATTACH, parent_pid));
+    assert(parent_pid == waitpid(parent_pid, &status, 0));
+
+    auto cb = +[](void* dtls_begin, void* dtls_end, size_t dso_id, void* arg) {
+      if (parent_addr >= dtls_begin && parent_addr < dtls_end) ++found_count;
+    };
+    __libc_iterate_dynamic_tls(parent_pid, cb, nullptr);
+    // It should be found exactly once.
+    assert(found_count == 1);
+    printf("done_iterate_another_thread_tls\n");
+  }
+}
 int main() {
   test_static_tls_bounds();
   test_iter_tls();
+  test_iterate_another_thread_tls();
   return 0;
 }
 
diff --git a/tests/malloc_test.cpp b/tests/malloc_test.cpp
index d692cf9..ddd3416 100644
--- a/tests/malloc_test.cpp
+++ b/tests/malloc_test.cpp
@@ -20,6 +20,7 @@
 #include <limits.h>
 #include <malloc.h>
 #include <pthread.h>
+#include <semaphore.h>
 #include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -45,6 +46,7 @@
 #include "SignalUtils.h"
 
 #include "platform/bionic/malloc.h"
+#include "platform/bionic/mte.h"
 #include "platform/bionic/mte_kernel.h"
 #include "platform/bionic/reserved_signals.h"
 #include "private/bionic_config.h"
@@ -923,12 +925,8 @@
     std::thread* t = new std::thread([&stop] {
       while (!stop) {
         for (size_t size = kMinAllocationSize; size <= kMaxAllocationSize; size <<= 1) {
-          void* ptr = malloc(size);
-          if (ptr == nullptr) {
-            return;
-          }
-          // Make sure this value is not optimized away.
-          asm volatile("" : : "r,m"(ptr) : "memory");
+          void* ptr;
+          DoNotOptimize(ptr = malloc(size));
           free(ptr);
         }
       }
@@ -941,10 +939,9 @@
     pid_t pid;
     if ((pid = fork()) == 0) {
       for (size_t size = kMinAllocationSize; size <= kMaxAllocationSize; size <<= 1) {
-        void* ptr = malloc(size);
+        void* ptr;
+        DoNotOptimize(ptr = malloc(size));
         ASSERT_TRUE(ptr != nullptr);
-        // Make sure this value is not optimized away.
-        asm volatile("" : : "r,m"(ptr) : "memory");
         // Make sure we can touch all of the allocation.
         memset(ptr, 0x1, size);
         ASSERT_LE(size, malloc_usable_size(ptr));
@@ -1259,3 +1256,39 @@
   GTEST_SKIP() << "bionic extension";
 #endif
 }
+
+TEST(android_mallopt, disable_memory_mitigations) {
+#if defined(__BIONIC__)
+  if (!mte_supported()) {
+    GTEST_SKIP() << "This function can only be tested with MTE";
+  }
+
+#ifdef ANDROID_EXPERIMENTAL_MTE
+  sem_t sem;
+  ASSERT_EQ(0, sem_init(&sem, 0, 0));
+
+  pthread_t thread;
+  ASSERT_EQ(0, pthread_create(
+                   &thread, nullptr,
+                   [](void* ptr) -> void* {
+                     auto* sem = reinterpret_cast<sem_t*>(ptr);
+                     sem_wait(sem);
+                     return reinterpret_cast<void*>(prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0));
+                   },
+                   &sem));
+
+  ASSERT_TRUE(android_mallopt(M_DISABLE_MEMORY_MITIGATIONS, nullptr, 0));
+  ASSERT_EQ(0, sem_post(&sem));
+
+  int my_tagged_addr_ctrl = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);
+  ASSERT_EQ(PR_MTE_TCF_NONE, my_tagged_addr_ctrl & PR_MTE_TCF_MASK);
+
+  void* retval;
+  ASSERT_EQ(0, pthread_join(thread, &retval));
+  int thread_tagged_addr_ctrl = reinterpret_cast<uintptr_t>(retval);
+  ASSERT_EQ(my_tagged_addr_ctrl, thread_tagged_addr_ctrl);
+#endif
+#else
+  GTEST_SKIP() << "bionic extension";
+#endif
+}
diff --git a/tests/prio_ctor_test.cpp b/tests/prio_ctor_test.cpp
new file mode 100644
index 0000000..0dfa66d
--- /dev/null
+++ b/tests/prio_ctor_test.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include <stdint.h>
+
+static const char* record[4] = {};
+static int idx = 0;
+
+__attribute__((constructor(1000))) static void prio1000() {
+  record[idx++] = "prio1000";
+}
+
+__attribute__((constructor(1))) static void prio1() {
+  record[idx++] = "prio1";
+}
+
+__attribute__((constructor)) static void noprio() {
+  record[idx++] = "noprio";
+}
+
+TEST(prio_ctor, order) {
+  EXPECT_EQ(idx, 3);
+  EXPECT_STREQ(record[0], "prio1");
+  EXPECT_STREQ(record[1], "prio1000");
+  EXPECT_STREQ(record[2], "noprio");
+}
diff --git a/tests/pthread_test.cpp b/tests/pthread_test.cpp
index 851b86f..d9ad3cc 100644
--- a/tests/pthread_test.cpp
+++ b/tests/pthread_test.cpp
@@ -2975,3 +2975,48 @@
   spin_helper.UnSpin();
   ASSERT_EQ(0, pthread_join(t, nullptr));
 }
+
+extern "C" bool android_run_on_all_threads(bool (*func)(void*), void* arg);
+
+TEST(pthread, run_on_all_threads) {
+#if defined(__BIONIC__)
+  pthread_t t;
+  ASSERT_EQ(
+      0, pthread_create(
+             &t, nullptr,
+             [](void*) -> void* {
+               pthread_attr_t detached;
+               if (pthread_attr_init(&detached) != 0 ||
+                   pthread_attr_setdetachstate(&detached, PTHREAD_CREATE_DETACHED) != 0) {
+                 return reinterpret_cast<void*>(errno);
+               }
+
+               for (int i = 0; i != 1000; ++i) {
+                 pthread_t t1, t2;
+                 if (pthread_create(
+                         &t1, &detached, [](void*) -> void* { return nullptr; }, nullptr) != 0 ||
+                     pthread_create(
+                         &t2, nullptr, [](void*) -> void* { return nullptr; }, nullptr) != 0 ||
+                     pthread_join(t2, nullptr) != 0) {
+                   return reinterpret_cast<void*>(errno);
+                 }
+               }
+
+               if (pthread_attr_destroy(&detached) != 0) {
+                 return reinterpret_cast<void*>(errno);
+               }
+               return nullptr;
+             },
+             nullptr));
+
+  for (int i = 0; i != 1000; ++i) {
+    ASSERT_TRUE(android_run_on_all_threads([](void* arg) { return arg == nullptr; }, nullptr));
+  }
+
+  void *retval;
+  ASSERT_EQ(0, pthread_join(t, &retval));
+  ASSERT_EQ(nullptr, retval);
+#else
+  GTEST_SKIP() << "bionic-only test";
+#endif
+}
diff --git a/tests/struct_layout_test.cpp b/tests/struct_layout_test.cpp
index 9da702c..00fd4d5 100644
--- a/tests/struct_layout_test.cpp
+++ b/tests/struct_layout_test.cpp
@@ -30,7 +30,7 @@
 #define CHECK_OFFSET(name, field, offset) \
     check_offset(#name, #field, offsetof(name, field), offset);
 #ifdef __LP64__
-  CHECK_SIZE(pthread_internal_t, 768);
+  CHECK_SIZE(pthread_internal_t, 776);
   CHECK_OFFSET(pthread_internal_t, next, 0);
   CHECK_OFFSET(pthread_internal_t, prev, 8);
   CHECK_OFFSET(pthread_internal_t, tid, 16);
@@ -44,17 +44,17 @@
   CHECK_OFFSET(pthread_internal_t, alternate_signal_stack, 128);
   CHECK_OFFSET(pthread_internal_t, shadow_call_stack_guard_region, 136);
   CHECK_OFFSET(pthread_internal_t, stack_top, 144);
-  CHECK_OFFSET(pthread_internal_t, startup_handshake_lock, 152);
-  CHECK_OFFSET(pthread_internal_t, mmap_base, 160);
-  CHECK_OFFSET(pthread_internal_t, mmap_size, 168);
-  CHECK_OFFSET(pthread_internal_t, mmap_base_unguarded, 176);
-  CHECK_OFFSET(pthread_internal_t, mmap_size_unguarded, 184);
-  CHECK_OFFSET(pthread_internal_t, vma_name_buffer, 192);
-  CHECK_OFFSET(pthread_internal_t, thread_local_dtors, 224);
-  CHECK_OFFSET(pthread_internal_t, current_dlerror, 232);
-  CHECK_OFFSET(pthread_internal_t, dlerror_buffer, 240);
-  CHECK_OFFSET(pthread_internal_t, bionic_tls, 752);
-  CHECK_OFFSET(pthread_internal_t, errno_value, 760);
+  CHECK_OFFSET(pthread_internal_t, startup_handshake_lock, 156);
+  CHECK_OFFSET(pthread_internal_t, mmap_base, 168);
+  CHECK_OFFSET(pthread_internal_t, mmap_size, 176);
+  CHECK_OFFSET(pthread_internal_t, mmap_base_unguarded, 184);
+  CHECK_OFFSET(pthread_internal_t, mmap_size_unguarded, 192);
+  CHECK_OFFSET(pthread_internal_t, vma_name_buffer, 200);
+  CHECK_OFFSET(pthread_internal_t, thread_local_dtors, 232);
+  CHECK_OFFSET(pthread_internal_t, current_dlerror, 240);
+  CHECK_OFFSET(pthread_internal_t, dlerror_buffer, 248);
+  CHECK_OFFSET(pthread_internal_t, bionic_tls, 760);
+  CHECK_OFFSET(pthread_internal_t, errno_value, 768);
   CHECK_SIZE(bionic_tls, 12200);
   CHECK_OFFSET(bionic_tls, key_data, 0);
   CHECK_OFFSET(bionic_tls, locale, 2080);
@@ -71,7 +71,7 @@
   CHECK_OFFSET(bionic_tls, fdtrack_disabled, 12192);
   CHECK_OFFSET(bionic_tls, padding, 12193);
 #else
-  CHECK_SIZE(pthread_internal_t, 664);
+  CHECK_SIZE(pthread_internal_t, 668);
   CHECK_OFFSET(pthread_internal_t, next, 0);
   CHECK_OFFSET(pthread_internal_t, prev, 4);
   CHECK_OFFSET(pthread_internal_t, tid, 8);
@@ -85,17 +85,17 @@
   CHECK_OFFSET(pthread_internal_t, alternate_signal_stack, 68);
   CHECK_OFFSET(pthread_internal_t, shadow_call_stack_guard_region, 72);
   CHECK_OFFSET(pthread_internal_t, stack_top, 76);
-  CHECK_OFFSET(pthread_internal_t, startup_handshake_lock, 80);
-  CHECK_OFFSET(pthread_internal_t, mmap_base, 88);
-  CHECK_OFFSET(pthread_internal_t, mmap_size, 92);
-  CHECK_OFFSET(pthread_internal_t, mmap_base_unguarded, 96);
-  CHECK_OFFSET(pthread_internal_t, mmap_size_unguarded, 100);
-  CHECK_OFFSET(pthread_internal_t, vma_name_buffer, 104);
-  CHECK_OFFSET(pthread_internal_t, thread_local_dtors, 136);
-  CHECK_OFFSET(pthread_internal_t, current_dlerror, 140);
-  CHECK_OFFSET(pthread_internal_t, dlerror_buffer, 144);
-  CHECK_OFFSET(pthread_internal_t, bionic_tls, 656);
-  CHECK_OFFSET(pthread_internal_t, errno_value, 660);
+  CHECK_OFFSET(pthread_internal_t, startup_handshake_lock, 84);
+  CHECK_OFFSET(pthread_internal_t, mmap_base, 92);
+  CHECK_OFFSET(pthread_internal_t, mmap_size, 96);
+  CHECK_OFFSET(pthread_internal_t, mmap_base_unguarded, 100);
+  CHECK_OFFSET(pthread_internal_t, mmap_size_unguarded, 104);
+  CHECK_OFFSET(pthread_internal_t, vma_name_buffer, 108);
+  CHECK_OFFSET(pthread_internal_t, thread_local_dtors, 140);
+  CHECK_OFFSET(pthread_internal_t, current_dlerror, 144);
+  CHECK_OFFSET(pthread_internal_t, dlerror_buffer, 148);
+  CHECK_OFFSET(pthread_internal_t, bionic_tls, 660);
+  CHECK_OFFSET(pthread_internal_t, errno_value, 664);
   CHECK_SIZE(bionic_tls, 11080);
   CHECK_OFFSET(bionic_tls, key_data, 0);
   CHECK_OFFSET(bionic_tls, locale, 1040);
diff --git a/tests/unistd_test.cpp b/tests/unistd_test.cpp
index 43d50f8..41ca8b4 100644
--- a/tests/unistd_test.cpp
+++ b/tests/unistd_test.cpp
@@ -676,14 +676,10 @@
   ASSERT_NE(static_cast<uint64_t>(parent_tid), reinterpret_cast<uint64_t>(result));
 }
 
-static void optimization_barrier(void* arg) {
-  asm volatile("" : : "r"(arg) : "memory");
-}
-
 __attribute__((noinline)) static void HwasanVforkTestChild() {
   // Allocate a tagged region on stack and leave it there.
   char x[10000];
-  optimization_barrier(x);
+  DoNotOptimize(x);
   _exit(0);
 }
 
@@ -700,7 +696,7 @@
   // Allocate a region on stack, but don't tag it (see the function attribute).
   // This depends on unallocated stack space at current function entry being untagged.
   char x[10000];
-  optimization_barrier(x);
+  DoNotOptimize(x);
   // Verify that contents of x[] are untagged.
   HwasanReadMemory(x, sizeof(x));
 }
diff --git a/tests/utils.h b/tests/utils.h
index acd8bc6..94ff050 100644
--- a/tests/utils.h
+++ b/tests/utils.h
@@ -290,3 +290,13 @@
 
   size_t start_count_ = CountOpenFds();
 };
+
+// From <benchmark/benchmark.h>.
+template <class Tp>
+static inline void DoNotOptimize(Tp const& value) {
+  asm volatile("" : : "r,m"(value) : "memory");
+}
+template <class Tp>
+static inline void DoNotOptimize(Tp& value) {
+  asm volatile("" : "+r,m"(value) : : "memory");
+}