diff --git a/libc/Android.bp b/libc/Android.bp
index d8467a8..943d41f 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -879,7 +879,6 @@
         "bionic/mkfifo.cpp",
         "bionic/mknod.cpp",
         "bionic/mntent.cpp",
-        "bionic/mremap.cpp",
         "bionic/netdb.cpp",
         "bionic/net_if.cpp",
         "bionic/netinet_ether.cpp",
diff --git a/libc/SYSCALLS.TXT b/libc/SYSCALLS.TXT
index ce14e49..a8c70e5 100644
--- a/libc/SYSCALLS.TXT
+++ b/libc/SYSCALLS.TXT
@@ -118,7 +118,6 @@
 pid_t       __getpid:getpid()  all
 int memfd_create(const char*, unsigned) all
 int         munmap(void*, size_t)  all
-void*       __mremap:mremap(void*, size_t, size_t, int, void*)  all
 int         msync(const void*, size_t, int)    all
 int         mprotect(const void*, size_t, int)  all
 int         madvise(void*, size_t, int)  all
@@ -190,6 +189,10 @@
 void* __mmap2:mmap2(void*, size_t, int, int, int, long) lp32
 void* mmap|mmap64(void*, size_t, int, int, int, off_t) lp64
 
+# mremap is in C++ for 32-bit so we can add the PTRDIFF_MAX check.
+void* __mremap:mremap(void*, size_t, size_t, int, void*) lp32
+void* mremap(void*, size_t, size_t, int, void*) lp64
+
 # posix_fadvise64 is awkward: arm has shuffled arguments,
 # the POSIX functions don't set errno, and no architecture has posix_fadvise.
 int __arm_fadvise64_64:arm_fadvise64_64(int, int, off64_t, off64_t) arm
diff --git a/libc/bionic/legacy_32_bit_support.cpp b/libc/bionic/legacy_32_bit_support.cpp
index 314fe9b..4e19ebf 100644
--- a/libc/bionic/legacy_32_bit_support.cpp
+++ b/libc/bionic/legacy_32_bit_support.cpp
@@ -30,6 +30,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <stdarg.h>
 #include <stdint.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
@@ -135,3 +136,28 @@
 void* mmap(void* addr, size_t size, int prot, int flags, int fd, off_t offset) {
   return mmap64(addr, size, prot, flags, fd, static_cast<off64_t>(offset));
 }
+
+// The only difference here is that the libc API uses varargs for the
+// optional `new_address` argument that's only used by MREMAP_FIXED.
+extern "C" void* __mremap(void*, size_t, size_t, int, void*);
+
+void* mremap(void* old_address, size_t old_size, size_t new_size, int flags, ...) {
+  // Prevent allocations large enough for `end - start` to overflow,
+  // to avoid security bugs.
+  size_t rounded = __BIONIC_ALIGN(new_size, page_size());
+  if (rounded < new_size || rounded > PTRDIFF_MAX) {
+    errno = ENOMEM;
+    return MAP_FAILED;
+  }
+
+  // The optional argument is only valid if the MREMAP_FIXED flag is set,
+  // so we assume it's not present otherwise.
+  void* new_address = nullptr;
+  if ((flags & MREMAP_FIXED) != 0) {
+    va_list ap;
+    va_start(ap, flags);
+    new_address = va_arg(ap, void*);
+    va_end(ap);
+  }
+  return __mremap(old_address, old_size, new_size, flags, new_address);
+}
diff --git a/libc/bionic/mremap.cpp b/libc/bionic/mremap.cpp
deleted file mode 100644
index 88ec829..0000000
--- a/libc/bionic/mremap.cpp
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright (C) 2015 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <errno.h>
-#include <sys/mman.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <unistd.h>
-
-#include "platform/bionic/macros.h"
-#include "platform/bionic/page.h"
-
-extern "C" void* __mremap(void*, size_t, size_t, int, void*);
-
-void* mremap(void* old_address, size_t old_size, size_t new_size, int flags, ...) {
-  // prevent allocations large enough for `end - start` to overflow
-  size_t rounded = __BIONIC_ALIGN(new_size, page_size());
-  if (rounded < new_size || rounded > PTRDIFF_MAX) {
-    errno = ENOMEM;
-    return MAP_FAILED;
-  }
-
-  void* new_address = nullptr;
-  // The optional argument is only valid if the MREMAP_FIXED flag is set,
-  // so we assume it's not present otherwise.
-  if ((flags & MREMAP_FIXED) != 0) {
-    va_list ap;
-    va_start(ap, flags);
-    new_address = va_arg(ap, void*);
-    va_end(ap);
-  }
-  return __mremap(old_address, old_size, new_size, flags, new_address);
-}
diff --git a/libc/include/sys/io.h b/libc/include/sys/io.h
new file mode 100644
index 0000000..d187b78
--- /dev/null
+++ b/libc/include/sys/io.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+/**
+ * @file sys/io.h
+ * @brief The x86/x86-64 I/O port functions iopl() and ioperm().
+ */
+
+#include <sys/cdefs.h>
+
+#include <errno.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+__BEGIN_DECLS
+
+/**
+ * [iopl(2)](http://man7.org/linux/man-pages/man2/iopl.2.html) changes the I/O
+ * privilege level for all x86/x8-64 I/O ports, for the calling thread.
+ *
+ * New callers should use ioperm() instead.
+ *
+ * Returns 0 on success, and returns -1 and sets `errno` on failure.
+ *
+ * Only available for x86/x86-64.
+ */
+#if defined(__NR_iopl)
+__attribute__((__deprecated__("use ioperm() instead"))) static __inline int iopl(int __level) {
+  return syscall(__NR_iopl, __level);
+}
+#endif
+
+/**
+ * [ioperm(2)](http://man7.org/linux/man-pages/man2/ioperm.2.html) sets the I/O
+ * permissions for the given number of x86/x86-64 I/O ports, starting at the
+ * given port.
+ *
+ * Returns 0 on success, and returns -1 and sets `errno` on failure.
+ *
+ * Only available for x86/x86-64.
+ */
+#if defined(__NR_iopl)
+static __inline int ioperm(unsigned long __from, unsigned long __n, int __enabled) {
+  return syscall(__NR_ioperm, __from, __n, __enabled);
+}
+#endif
+
+__END_DECLS
diff --git a/libc/system_properties/Android.bp b/libc/system_properties/Android.bp
index d45a2e3..16ea73f 100644
--- a/libc/system_properties/Android.bp
+++ b/libc/system_properties/Android.bp
@@ -11,7 +11,10 @@
 
 cc_library_static {
     name: "libsystemproperties",
-    defaults: ["libc_defaults"],
+    defaults: [
+        "libc_defaults",
+        "large_system_property_node_defaults",
+    ],
     native_bridge_supported: true,
     srcs: [
         "context_node.cpp",
@@ -54,3 +57,28 @@
         "libasync_safe",
     ],
 }
+
+soong_config_module_type {
+    name: "large_system_property_node_cc_defaults",
+    module_type: "cc_defaults",
+    config_namespace: "bionic",
+    bool_variables: [
+        "large_system_property_node",
+    ],
+    properties: [
+        "cflags",
+    ],
+}
+
+soong_config_bool_variable {
+    name: "large_system_property_node",
+}
+
+large_system_property_node_cc_defaults {
+    name: "large_system_property_node_defaults",
+    soong_config_variables: {
+        large_system_property_node: {
+            cflags: ["-DLARGE_SYSTEM_PROPERTY_NODE=1"]
+        }
+    }
+}
diff --git a/libc/system_properties/prop_area.cpp b/libc/system_properties/prop_area.cpp
index 4668eed..a816a38 100644
--- a/libc/system_properties/prop_area.cpp
+++ b/libc/system_properties/prop_area.cpp
@@ -41,7 +41,11 @@
 
 #include <async_safe/log.h>
 
+#ifdef LARGE_SYSTEM_PROPERTY_NODE
+constexpr size_t PA_SIZE = 1024 * 1024;
+#else
 constexpr size_t PA_SIZE = 128 * 1024;
+#endif
 constexpr uint32_t PROP_AREA_MAGIC = 0x504f5250;
 constexpr uint32_t PROP_AREA_VERSION = 0xfc6ed0ab;
 
diff --git a/tests/Android.bp b/tests/Android.bp
index 7769110..9f64393 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -369,7 +369,10 @@
 
 cc_test_library {
     name: "libBionicStandardTests",
-    defaults: ["bionic_tests_defaults"],
+    defaults: [
+        "bionic_tests_defaults",
+        "large_system_property_node_defaults",
+    ],
     tidy_disabled_srcs: [
         "malloc_test.cpp", // timed out with clang-tidy, and too many warnings
     ],
@@ -475,6 +478,7 @@
         "sys_cachectl_test.cpp",
         "sys_epoll_test.cpp",
         "sys_hwprobe_test.cpp",
+        "sys_io_test.cpp",
         "sys_mman_test.cpp",
         "sys_msg_test.cpp",
         "sys_param_test.cpp",
diff --git a/tests/sys_io_test.cpp b/tests/sys_io_test.cpp
new file mode 100644
index 0000000..293ceb2
--- /dev/null
+++ b/tests/sys_io_test.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <gtest/gtest.h>
+
+#include <sys/io.h>
+
+#include "utils.h"
+
+TEST(sys_io, iopl) {
+#if defined(__i386__) || defined(__x86_64__)
+  errno = 0;
+  ASSERT_EQ(-1, iopl(4));
+  ASSERT_ERRNO(EINVAL);
+#else
+  GTEST_SKIP() << "iopl requires x86/x86-64";
+#endif
+}
+
+TEST(sys_io, ioperm) {
+#if defined(__i386__) || defined(__x86_64__)
+  errno = 0;
+  ASSERT_EQ(-1, ioperm(65535, 4, 0));
+  ASSERT_ERRNO(EINVAL);
+#else
+  GTEST_SKIP() << "ioperm requires x86/x86-64";
+#endif
+}
diff --git a/tests/sys_mman_test.cpp b/tests/sys_mman_test.cpp
index df13e07..40c85f2 100644
--- a/tests/sys_mman_test.cpp
+++ b/tests/sys_mman_test.cpp
@@ -243,6 +243,20 @@
   ASSERT_EQ(0, munmap(map, kPageSize));
 }
 
+TEST(sys_mman, mremap_MREMAP_FIXED) {
+  // We're not trying to test the kernel here; that's external/ltp's job.
+  // We just want to check that optional argument (mremap() is varargs)
+  // gets passed through in an MREMAP_FIXED call.
+  void* vma1 = mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  ASSERT_NE(MAP_FAILED, vma1);
+
+  void* vma2 = mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+  ASSERT_NE(MAP_FAILED, vma2);
+
+  void* vma3 = mremap(vma1, getpagesize(), getpagesize(), MREMAP_FIXED | MREMAP_MAYMOVE, vma2);
+  ASSERT_EQ(vma2, vma3);
+}
+
 TEST(sys_mman, mmap_bug_27265969) {
   char* base = reinterpret_cast<char*>(
       mmap(nullptr, kPageSize * 2, PROT_EXEC | PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0));
diff --git a/tests/system_properties_test.cpp b/tests/system_properties_test.cpp
index 0b7f5ae..f11f509 100644
--- a/tests/system_properties_test.cpp
+++ b/tests/system_properties_test.cpp
@@ -593,7 +593,13 @@
   ASSERT_TRUE(system_properties.valid());
 
   auto name = "ro.super_long_property"s;
+
+#ifdef LARGE_SYSTEM_PROPERTY_NODE
+  auto value = std::string(1024 * 1024 + 1, 'x');
+#else
   auto value = std::string(128 * 1024 + 1, 'x');
+#endif
+
   ASSERT_NE(0, system_properties.Add(name.c_str(), name.size(), value.c_str(), value.size()));
 
 #else   // __BIONIC__
diff --git a/tests/termios_test.cpp b/tests/termios_test.cpp
index 480f3af..19e9bfe 100644
--- a/tests/termios_test.cpp
+++ b/tests/termios_test.cpp
@@ -96,7 +96,7 @@
   EXPECT_EQ(0U, (t.c_oflag & OPOST));
   EXPECT_EQ(0U, (t.c_lflag & (ECHO|ECHONL|ICANON|ISIG|IEXTEN)));
   EXPECT_EQ(0U, (t.c_cflag & PARENB));
-  EXPECT_EQ(CS8, static_cast<int>(t.c_cflag & CSIZE));
+  EXPECT_EQ(static_cast<unsigned>(CS8), (t.c_cflag & CSIZE));
   EXPECT_EQ(1, t.c_cc[VMIN]);
   EXPECT_EQ(0, t.c_cc[VTIME]);
 }