diff --git a/libc/Android.mk b/libc/Android.mk
index 5ea57be..cee700d 100644
--- a/libc/Android.mk
+++ b/libc/Android.mk
@@ -60,6 +60,8 @@
     bionic/siginterrupt.c \
     bionic/sigsetmask.c \
     bionic/system_properties_compat.c \
+    stdio/findfp.c \
+    stdio/fread.c \
     stdio/snprintf.c\
     stdio/sprintf.c \
 
@@ -390,14 +392,12 @@
     upstream-openbsd/lib/libc/stdio/fgetwc.c \
     upstream-openbsd/lib/libc/stdio/fgetws.c \
     upstream-openbsd/lib/libc/stdio/fileno.c \
-    upstream-openbsd/lib/libc/stdio/findfp.c \
     upstream-openbsd/lib/libc/stdio/fprintf.c \
     upstream-openbsd/lib/libc/stdio/fpurge.c \
     upstream-openbsd/lib/libc/stdio/fputc.c \
     upstream-openbsd/lib/libc/stdio/fputs.c \
     upstream-openbsd/lib/libc/stdio/fputwc.c \
     upstream-openbsd/lib/libc/stdio/fputws.c \
-    upstream-openbsd/lib/libc/stdio/fread.c \
     upstream-openbsd/lib/libc/stdio/freopen.c \
     upstream-openbsd/lib/libc/stdio/fscanf.c \
     upstream-openbsd/lib/libc/stdio/fseek.c \
@@ -504,7 +504,10 @@
 libc_common_cflags += -DTARGET_USES_LOGD
 endif
 
-use_clang := false
+use_clang := $(USE_CLANG_PLATFORM_BUILD)
+ifeq ($(use_clang),)
+  use_clang := false
+endif
 
 # Try to catch typical 32-bit assumptions that break with 64-bit pointers.
 libc_common_cflags += \
@@ -690,6 +693,7 @@
 LOCAL_SYSTEM_SHARED_LIBRARIES :=
 
 $(eval $(call patch-up-arch-specific-flags,LOCAL_CFLAGS,libc_common_cflags))
+$(eval $(call patch-up-arch-specific-flags,LOCAL_SRC_FILES,libc_freebsd_src_files))
 include $(BUILD_STATIC_LIBRARY)
 
 
@@ -734,6 +738,13 @@
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES := $(libc_upstream_openbsd_src_files)
+ifneq (,$(filter $(TARGET_ARCH),x86 x86_64))
+  # Clang has wrong long double size or LDBL_MANT_DIG, http://b/17163651.
+  LOCAL_CLANG := false
+else
+  LOCAL_CLANG := $(use_clang)
+endif
+
 LOCAL_CFLAGS := \
     $(libc_common_cflags) \
     -Wno-sign-compare -Wno-uninitialized -Wno-unused-parameter \
@@ -747,11 +758,11 @@
 LOCAL_CPPFLAGS := $(libc_common_cppflags)
 LOCAL_C_INCLUDES := $(libc_common_c_includes)
 LOCAL_MODULE := libc_openbsd
-LOCAL_CLANG := $(use_clang)
 LOCAL_ADDITIONAL_DEPENDENCIES := $(libc_common_additional_dependencies)
 LOCAL_SYSTEM_SHARED_LIBRARIES :=
 
 $(eval $(call patch-up-arch-specific-flags,LOCAL_CFLAGS,libc_common_cflags))
+$(eval $(call patch-up-arch-specific-flags,LOCAL_SRC_FILES,libc_openbsd_src_files))
 include $(BUILD_STATIC_LIBRARY)
 
 
@@ -766,6 +777,13 @@
 
 LOCAL_SRC_FILES_32 := $(libc_upstream_openbsd_gdtoa_src_files_32)
 LOCAL_SRC_FILES_64 := $(libc_upstream_openbsd_gdtoa_src_files_64)
+ifneq (,$(filter $(TARGET_ARCH),x86 x86_64))
+  # Clang has wrong long double size or LDBL_MANT_DIG, http://b/17163651.
+  LOCAL_CLANG := false
+else
+  LOCAL_CLANG := $(use_clang)
+endif
+
 LOCAL_CFLAGS := \
     $(libc_common_cflags) \
     -Wno-sign-compare -Wno-uninitialized \
@@ -779,7 +797,6 @@
 LOCAL_CPPFLAGS := $(libc_common_cppflags)
 LOCAL_C_INCLUDES := $(libc_common_c_includes)
 LOCAL_MODULE := libc_gdtoa
-LOCAL_CLANG := $(use_clang)
 LOCAL_ADDITIONAL_DEPENDENCIES := $(libc_common_additional_dependencies)
 LOCAL_SYSTEM_SHARED_LIBRARIES :=
 
@@ -797,6 +814,11 @@
 LOCAL_CFLAGS := $(libc_common_cflags) \
     -Wframe-larger-than=2048 \
 
+ifeq ($(TARGET_ARCH),x86_64)
+  # Clang assembler has problem with ssse3-strcmp-slm.S, http://b/17302991
+  LOCAL_CLANG_ASFLAGS += -no-integrated-as
+endif
+
 LOCAL_CONLYFLAGS := $(libc_common_conlyflags)
 LOCAL_CPPFLAGS := $(libc_common_cppflags)
 LOCAL_C_INCLUDES := $(libc_common_c_includes)
@@ -1145,6 +1167,7 @@
 include $(CLEAR_VARS)
 LOCAL_C_INCLUDES := $(libc_common_c_includes)
 LOCAL_CFLAGS := $(libc_common_cflags)
+LOCAL_CPPFLAGS := $(libc_common_cppflags)
 LOCAL_SRC_FILES := $(libstdcxx_common_src_files)
 LOCAL_MODULE:= libstdc++
 LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
@@ -1157,6 +1180,7 @@
 include $(CLEAR_VARS)
 LOCAL_C_INCLUDES := $(libc_common_c_includes)
 LOCAL_CFLAGS := $(libc_common_cflags)
+LOCAL_CPPFLAGS := $(libc_common_cppflags)
 LOCAL_SRC_FILES := $(libstdcxx_common_src_files)
 LOCAL_MODULE:= libstdc++
 LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
diff --git a/libc/arch-arm/arm.mk b/libc/arch-arm/arm.mk
index 70cc8eb..cca4ed0 100644
--- a/libc/arch-arm/arm.mk
+++ b/libc/arch-arm/arm.mk
@@ -1,22 +1,35 @@
-# arm specific configs
+# 32-bit arm.
 
-# These are used by the 32-bit targets, but not the 64-bit ones.
-libc_common_src_files_arm := \
+#
+# Various kinds of LP32 cruft.
+#
+
+libc_bionic_src_files_arm += \
+    bionic/mmap.cpp \
+
+libc_common_src_files_arm += \
     bionic/legacy_32_bit_support.cpp \
     bionic/ndk_cruft.cpp \
     bionic/time64.c \
+
+libc_netbsd_src_files_arm += \
+    upstream-netbsd/common/lib/libc/hash/sha1/sha1.c \
+
+libc_openbsd_src_files_arm += \
     upstream-openbsd/lib/libc/stdio/putw.c \
 
-# These are shared by all the 32-bit targets, but not the 64-bit ones.
-libc_bionic_src_files_arm := \
-    bionic/mmap.cpp
+#
+# Default implementations of functions that are commonly optimized.
+#
 
-libc_common_src_files_arm += \
+libc_bionic_src_files_arm += \
     bionic/memchr.c \
     bionic/memrchr.c \
     bionic/strchr.cpp \
     bionic/strnlen.c \
     bionic/strrchr.cpp \
+
+libc_freebsd_src_files_arm += \
     upstream-freebsd/lib/libc/string/wcscat.c \
     upstream-freebsd/lib/libc/string/wcschr.c \
     upstream-freebsd/lib/libc/string/wcscmp.c \
@@ -25,8 +38,9 @@
     upstream-freebsd/lib/libc/string/wcsrchr.c \
     upstream-freebsd/lib/libc/string/wmemcmp.c \
     upstream-freebsd/lib/libc/string/wmemmove.c \
+
+libc_openbsd_src_files_arm += \
     upstream-openbsd/lib/libc/string/bcopy.c \
-    upstream-openbsd/lib/libc/string/stpcpy.c \
     upstream-openbsd/lib/libc/string/stpncpy.c \
     upstream-openbsd/lib/libc/string/strlcat.c \
     upstream-openbsd/lib/libc/string/strlcpy.c \
@@ -34,20 +48,10 @@
     upstream-openbsd/lib/libc/string/strncmp.c \
     upstream-openbsd/lib/libc/string/strncpy.c \
 
-# The C++ fortify function implementations for which there is an
-# arm assembler version.
 #
-# Fortify implementations of libc functions.
-# libc_common_src_files_arm +=
-#    bionic/__memcpy_chk.cpp \
-#    bionic/__memset_chk.cpp \
-#    bionic/__strcpy_chk.cpp \
-#    bionic/__strcat_chk.cpp \
+# Inherently architecture-specific code.
+#
 
-libc_common_cflags_arm := -DSOFTFLOAT
-
-##########################################
-### CPU specific source files
 libc_bionic_src_files_arm += \
     arch-arm/bionic/abort_arm.S \
     arch-arm/bionic/atomics_arm.c \
@@ -55,6 +59,7 @@
     arch-arm/bionic/_exit_with_stack_teardown.S \
     arch-arm/bionic/libgcc_compat.c \
     arch-arm/bionic/memcmp.S \
+    arch-arm/bionic/__restore.S \
     arch-arm/bionic/_setjmp.S \
     arch-arm/bionic/setjmp.S \
     arch-arm/bionic/sigsetjmp.S \
@@ -63,9 +68,6 @@
 libc_arch_static_src_files_arm := arch-arm/bionic/exidx_static.c
 libc_arch_dynamic_src_files_arm := arch-arm/bionic/exidx_dynamic.c
 
-libc_netbsd_src_files_arm := \
-    upstream-netbsd/common/lib/libc/hash/sha1/sha1.c \
-
 ## CPU variant specific source files
 ifeq ($(strip $(TARGET_$(my_2nd_arch_prefix)CPU_VARIANT)),)
   $(warning TARGET_$(my_2nd_arch_prefix)ARCH is arm, but TARGET_$(my_2nd_arch_prefix)CPU_VARIANT is not defined)
diff --git a/libc/arch-arm/bionic/__restore.S b/libc/arch-arm/bionic/__restore.S
new file mode 100644
index 0000000..9898125
--- /dev/null
+++ b/libc/arch-arm/bionic/__restore.S
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <private/bionic_asm.h>
+
+// gdb is smart enough to unwind through signal frames with just the regular
+// CFI information but libgcc and libunwind both need extra help. We do this
+// by using .fnstart/.fnend and inserting a nop before both __restore and
+// __restore_rt (but covered by the .fnstart/.fnend) so that although they're
+// not inside the functions from objdump's point of view, an unwinder that
+// blindly looks at the previous instruction (but is then smart enough to check
+// the DWARF information to find out where it landed) gets the right answer.
+
+// We need to place .fnstart ourselves (but we may as well keep the free .fnend).
+#undef __bionic_asm_custom_entry
+#define __bionic_asm_custom_entry(f)
+
+  .fnstart
+  .save {r0-r15}
+  .pad #32
+  nop
+ENTRY_PRIVATE(__restore)
+  // This function must have exactly this instruction sequence.
+  mov r7, #__NR_sigreturn
+  swi #0
+END(__restore)
+
+  .fnstart
+  .save {r0-r15}
+  .pad #160
+  nop
+ENTRY_PRIVATE(__restore_rt)
+  // This function must have exactly this instruction sequence.
+  mov r7, #__NR_rt_sigreturn
+  swi #0
+END(__restore_rt)
diff --git a/libc/arch-arm/cortex-a15/bionic/__strcat_chk.S b/libc/arch-arm/cortex-a15/bionic/__strcat_chk.S
index 36da2d9..a2e9c22 100644
--- a/libc/arch-arm/cortex-a15/bionic/__strcat_chk.S
+++ b/libc/arch-arm/cortex-a15/bionic/__strcat_chk.S
@@ -40,12 +40,10 @@
 ENTRY(__strcat_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
     push    {r4, r5}
-    .save   {r4, r5}
     .cfi_adjust_cfa_offset 8
     .cfi_rel_offset r4, 0
     .cfi_rel_offset r5, 4
@@ -195,9 +193,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcat_chk_failed)
-    .save   {r0, lr}
-    .save   {r4, r5}
-
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/cortex-a15/bionic/__strcpy_chk.S b/libc/arch-arm/cortex-a15/bionic/__strcpy_chk.S
index c3e3e14..db76686 100644
--- a/libc/arch-arm/cortex-a15/bionic/__strcpy_chk.S
+++ b/libc/arch-arm/cortex-a15/bionic/__strcpy_chk.S
@@ -39,7 +39,6 @@
 ENTRY(__strcpy_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
@@ -161,7 +160,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcpy_chk_failed)
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/cortex-a15/bionic/memcpy.S b/libc/arch-arm/cortex-a15/bionic/memcpy.S
index da4f3dd..410b663 100644
--- a/libc/arch-arm/cortex-a15/bionic/memcpy.S
+++ b/libc/arch-arm/cortex-a15/bionic/memcpy.S
@@ -72,7 +72,6 @@
 ENTRY(memcpy)
         pld     [r1, #64]
         push    {r0, lr}
-        .save   {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -85,7 +84,6 @@
 ENTRY_PRIVATE(__memcpy_chk_fail)
         // Preserve lr for backtrace.
         push    {lr}
-        .save   {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
 
diff --git a/libc/arch-arm/cortex-a15/bionic/memcpy_base.S b/libc/arch-arm/cortex-a15/bionic/memcpy_base.S
index 6ba4931..2a73852 100644
--- a/libc/arch-arm/cortex-a15/bionic/memcpy_base.S
+++ b/libc/arch-arm/cortex-a15/bionic/memcpy_base.S
@@ -54,7 +54,6 @@
  */
 
 ENTRY_PRIVATE(MEMCPY_BASE)
-        .save   {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -172,7 +171,6 @@
 END(MEMCPY_BASE)
 
 ENTRY_PRIVATE(MEMCPY_BASE_ALIGNED)
-        .save   {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -181,17 +179,14 @@
         // i.e., not keeping the stack looking like users expect
         // (highest numbered register at highest address).
         strd    r4, r5, [sp, #-8]!
-        .save   {r4, r5}
         .cfi_adjust_cfa_offset 8
         .cfi_rel_offset r4, 0
         .cfi_rel_offset r5, 4
         strd    r6, r7, [sp, #-8]!
-        .save   {r6, r7}
         .cfi_adjust_cfa_offset 8
         .cfi_rel_offset r6, 0
         .cfi_rel_offset r7, 0
         strd    r8, r9, [sp, #-8]!
-        .save   {r8, r9}
         .cfi_adjust_cfa_offset 8
         .cfi_rel_offset r8, 0
         .cfi_rel_offset r9, 4
diff --git a/libc/arch-arm/cortex-a15/bionic/memset.S b/libc/arch-arm/cortex-a15/bionic/memset.S
index 12c68d6..e4a1ec8 100644
--- a/libc/arch-arm/cortex-a15/bionic/memset.S
+++ b/libc/arch-arm/cortex-a15/bionic/memset.S
@@ -44,7 +44,6 @@
         bls         .L_done
 
         // Preserve lr for backtrace.
-        .save       {lr}
         push        {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
@@ -68,7 +67,6 @@
 END(bzero)
 
 ENTRY(memset)
-        .save       {r0}
         stmfd       sp!, {r0}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset r0, 0
diff --git a/libc/arch-arm64/bionic/__rt_sigreturn.S b/libc/arch-arm/cortex-a15/bionic/stpcpy.S
similarity index 87%
rename from libc/arch-arm64/bionic/__rt_sigreturn.S
rename to libc/arch-arm/cortex-a15/bionic/stpcpy.S
index 8fb6f0c..740523b 100644
--- a/libc/arch-arm64/bionic/__rt_sigreturn.S
+++ b/libc/arch-arm/cortex-a15/bionic/stpcpy.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 The Android Open Source Project
+ * Copyright (C) 2014 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,9 +26,5 @@
  * SUCH DAMAGE.
  */
 
-#include <private/bionic_asm.h>
-
-ENTRY_PRIVATE(__rt_sigreturn)
-  mov     x8, __NR_rt_sigreturn
-  svc     #0
-END(__rt_sigreturn)
+#define STPCPY
+#include "string_copy.S"
diff --git a/libc/arch-arm/cortex-a15/bionic/strcmp.S b/libc/arch-arm/cortex-a15/bionic/strcmp.S
index 12da115..acedf0e 100644
--- a/libc/arch-arm/cortex-a15/bionic/strcmp.S
+++ b/libc/arch-arm/cortex-a15/bionic/strcmp.S
@@ -168,7 +168,6 @@
         bne     .L_do_align
 
         /* Fast path.  */
-        .save   {r4-r7}
         init
 
 .L_doubleword_aligned:
diff --git a/libc/arch-arm/cortex-a15/bionic/strcpy.S b/libc/arch-arm/cortex-a15/bionic/strcpy.S
index cb878c4..951face 100644
--- a/libc/arch-arm/cortex-a15/bionic/strcpy.S
+++ b/libc/arch-arm/cortex-a15/bionic/strcpy.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 The Android Open Source Project
+ * Copyright (C) 2014 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,427 +25,6 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/*
- * Copyright (c) 2013 ARM Ltd
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the company may not be used to endorse or promote
- *    products derived from this software without specific prior written
- *    permission.
- *
- * THIS SOFTWARE IS PROVIDED BY ARM LTD ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL ARM LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
 
-#include <private/bionic_asm.h>
-
-    .syntax unified
-
-    .thumb
-    .thumb_func
-
-    .macro m_push
-    push    {r0, r4, r5, lr}
-    .endm // m_push
-
-    .macro m_pop
-    pop     {r0, r4, r5, pc}
-    .endm // m_pop
-
-    .macro m_copy_byte reg, cmd, label
-    ldrb    \reg, [r1], #1
-    strb    \reg, [r0], #1
-    \cmd    \reg, \label
-    .endm // m_copy_byte
-
-ENTRY(strcpy)
-    // For short copies, hard-code checking the first 8 bytes since this
-    // new code doesn't win until after about 8 bytes.
-    m_push
-    m_copy_byte reg=r2, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r3, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r4, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r5, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r2, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r3, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r4, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r5, cmd=cbnz, label=strcpy_continue
-
-strcpy_finish:
-    m_pop
-
-strcpy_continue:
-    pld     [r1, #0]
-    ands    r3, r0, #7
-    beq     strcpy_check_src_align
-
-    // Align to a double word (64 bits).
-    rsb     r3, r3, #8
-    lsls    ip, r3, #31
-    beq     strcpy_align_to_32
-
-    ldrb    r2, [r1], #1
-    strb    r2, [r0], #1
-    cbz     r2, strcpy_complete
-
-strcpy_align_to_32:
-    bcc     strcpy_align_to_64
-
-    ldrb    r2, [r1], #1
-    strb    r2, [r0], #1
-    cbz     r2, strcpy_complete
-    ldrb    r2, [r1], #1
-    strb    r2, [r0], #1
-    cbz     r2, strcpy_complete
-
-strcpy_align_to_64:
-    tst     r3, #4
-    beq     strcpy_check_src_align
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-    str     r2, [r0], #4
-
-strcpy_check_src_align:
-    // At this point dst is aligned to a double word, check if src
-    // is also aligned to a double word.
-    ands    r3, r1, #7
-    bne     strcpy_unaligned_copy
-
-    .p2align 2
-strcpy_mainloop:
-    ldrd    r2, r3, [r1], #8
-
-    pld     [r1, #64]
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    strd    r2, r3, [r0], #8
-    b       strcpy_mainloop
-
-strcpy_complete:
-    m_pop
-
-strcpy_zero_in_first_register:
-    lsls    lr, ip, #17
-    bne     strcpy_copy1byte
-    bcs     strcpy_copy2bytes
-    lsls    ip, ip, #1
-    bne     strcpy_copy3bytes
-
-strcpy_copy4bytes:
-    // Copy 4 bytes to the destiniation.
-    str     r2, [r0]
-    m_pop
-
-strcpy_copy1byte:
-    strb    r2, [r0]
-    m_pop
-
-strcpy_copy2bytes:
-    strh    r2, [r0]
-    m_pop
-
-strcpy_copy3bytes:
-    strh    r2, [r0], #2
-    lsr     r2, #16
-    strb    r2, [r0]
-    m_pop
-
-strcpy_zero_in_second_register:
-    lsls    lr, ip, #17
-    bne     strcpy_copy5bytes
-    bcs     strcpy_copy6bytes
-    lsls    ip, ip, #1
-    bne     strcpy_copy7bytes
-
-    // Copy 8 bytes to the destination.
-    strd    r2, r3, [r0]
-    m_pop
-
-strcpy_copy5bytes:
-    str     r2, [r0], #4
-    strb    r3, [r0]
-    m_pop
-
-strcpy_copy6bytes:
-    str     r2, [r0], #4
-    strh    r3, [r0]
-    m_pop
-
-strcpy_copy7bytes:
-    str     r2, [r0], #4
-    strh    r3, [r0], #2
-    lsr     r3, #16
-    strb    r3, [r0]
-    m_pop
-
-strcpy_unaligned_copy:
-    // Dst is aligned to a double word, while src is at an unknown alignment.
-    // There are 7 different versions of the unaligned copy code
-    // to prevent overreading the src. The mainloop of every single version
-    // will store 64 bits per loop. The difference is how much of src can
-    // be read without potentially crossing a page boundary.
-    tbb     [pc, r3]
-strcpy_unaligned_branchtable:
-    .byte 0
-    .byte ((strcpy_unalign7 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign6 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign5 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign4 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign3 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign2 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign1 - strcpy_unaligned_branchtable)/2)
-
-    .p2align 2
-    // Can read 7 bytes before possibly crossing a page.
-strcpy_unalign7:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldrb    r3, [r1]
-    cbz     r3, strcpy_unalign7_copy5bytes
-    ldrb    r4, [r1, #1]
-    cbz     r4, strcpy_unalign7_copy6bytes
-    ldrb    r5, [r1, #2]
-    cbz     r5, strcpy_unalign7_copy7bytes
-
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    lsrs    ip, r3, #24
-    strd    r2, r3, [r0], #8
-    beq     strcpy_unalign_return
-    b       strcpy_unalign7
-
-strcpy_unalign7_copy5bytes:
-    str     r2, [r0], #4
-    strb    r3, [r0]
-strcpy_unalign_return:
-    m_pop
-
-strcpy_unalign7_copy6bytes:
-    str     r2, [r0], #4
-    strb    r3, [r0], #1
-    strb    r4, [r0], #1
-    m_pop
-
-strcpy_unalign7_copy7bytes:
-    str     r2, [r0], #4
-    strb    r3, [r0], #1
-    strb    r4, [r0], #1
-    strb    r5, [r0], #1
-    m_pop
-
-    .p2align 2
-    // Can read 6 bytes before possibly crossing a page.
-strcpy_unalign6:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldrb    r4, [r1]
-    cbz     r4, strcpy_unalign_copy5bytes
-    ldrb    r5, [r1, #1]
-    cbz     r5, strcpy_unalign_copy6bytes
-
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    tst     r3, #0xff0000
-    beq     strcpy_copy7bytes
-    lsrs    ip, r3, #24
-    strd    r2, r3, [r0], #8
-    beq     strcpy_unalign_return
-    b       strcpy_unalign6
-
-    .p2align 2
-    // Can read 5 bytes before possibly crossing a page.
-strcpy_unalign5:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldrb    r4, [r1]
-    cbz     r4, strcpy_unalign_copy5bytes
-
-    ldr     r3, [r1], #4
-
-    pld     [r1, #64]
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    strd    r2, r3, [r0], #8
-    b       strcpy_unalign5
-
-strcpy_unalign_copy5bytes:
-    str     r2, [r0], #4
-    strb    r4, [r0]
-    m_pop
-
-strcpy_unalign_copy6bytes:
-    str     r2, [r0], #4
-    strb    r4, [r0], #1
-    strb    r5, [r0]
-    m_pop
-
-    .p2align 2
-    // Can read 4 bytes before possibly crossing a page.
-strcpy_unalign4:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    strd    r2, r3, [r0], #8
-    b       strcpy_unalign4
-
-    .p2align 2
-    // Can read 3 bytes before possibly crossing a page.
-strcpy_unalign3:
-    ldrb    r2, [r1]
-    cbz     r2, strcpy_unalign3_copy1byte
-    ldrb    r3, [r1, #1]
-    cbz     r3, strcpy_unalign3_copy2bytes
-    ldrb    r4, [r1, #2]
-    cbz     r4, strcpy_unalign3_copy3bytes
-
-    ldr     r2, [r1], #4
-    ldr     r3, [r1], #4
-
-    pld     [r1, #64]
-
-    lsrs    lr, r2, #24
-    beq     strcpy_copy4bytes
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    strd    r2, r3, [r0], #8
-    b       strcpy_unalign3
-
-strcpy_unalign3_copy1byte:
-    strb    r2, [r0]
-    m_pop
-
-strcpy_unalign3_copy2bytes:
-    strb    r2, [r0], #1
-    strb    r3, [r0]
-    m_pop
-
-strcpy_unalign3_copy3bytes:
-    strb    r2, [r0], #1
-    strb    r3, [r0], #1
-    strb    r4, [r0]
-    m_pop
-
-    .p2align 2
-    // Can read 2 bytes before possibly crossing a page.
-strcpy_unalign2:
-    ldrb    r2, [r1]
-    cbz     r2, strcpy_unalign_copy1byte
-    ldrb    r4, [r1, #1]
-    cbz     r4, strcpy_unalign_copy2bytes
-
-    ldr     r2, [r1], #4
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    tst     r2, #0xff0000
-    beq     strcpy_copy3bytes
-    lsrs    ip, r2, #24
-    beq     strcpy_copy4bytes
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    strd    r2, r3, [r0], #8
-    b       strcpy_unalign2
-
-    .p2align 2
-    // Can read 1 byte before possibly crossing a page.
-strcpy_unalign1:
-    ldrb    r2, [r1]
-    cbz     r2, strcpy_unalign_copy1byte
-
-    ldr     r2, [r1], #4
-    ldr     r3, [r1], #4
-
-    pld     [r1, #64]
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    strd    r2, r3, [r0], #8
-    b       strcpy_unalign1
-
-strcpy_unalign_copy1byte:
-    strb    r2, [r0]
-    m_pop
-
-strcpy_unalign_copy2bytes:
-    strb    r2, [r0], #1
-    strb    r4, [r0]
-    m_pop
-END(strcpy)
+#define STRCPY
+#include "string_copy.S"
diff --git a/libc/arch-arm/cortex-a15/bionic/string_copy.S b/libc/arch-arm/cortex-a15/bionic/string_copy.S
new file mode 100644
index 0000000..20f0e91
--- /dev/null
+++ b/libc/arch-arm/cortex-a15/bionic/string_copy.S
@@ -0,0 +1,513 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * Copyright (c) 2013 ARM Ltd
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the company may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY ARM LTD ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL ARM LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if !defined(STPCPY) && !defined(STRCPY)
+#error "Either STPCPY or STRCPY must be defined."
+#endif
+
+#include <private/bionic_asm.h>
+
+    .syntax unified
+
+    .thumb
+    .thumb_func
+
+#if defined(STPCPY)
+    .macro m_push
+    push    {r4, r5, lr}
+    .cfi_def_cfa_offset 12
+    .cfi_rel_offset r4, 0
+    .cfi_rel_offset r5, 4
+    .cfi_rel_offset lr, 8
+    .endm // m_push
+#else
+    .macro m_push
+    push    {r0, r4, r5, lr}
+    .cfi_def_cfa_offset 16
+    .cfi_rel_offset r0, 0
+    .cfi_rel_offset r4, 4
+    .cfi_rel_offset r5, 8
+    .cfi_rel_offset lr, 12
+    .endm // m_push
+#endif
+
+#if defined(STPCPY)
+    .macro m_pop
+    pop     {r4, r5, pc}
+    .endm // m_pop
+#else
+    .macro m_pop
+    pop     {r0, r4, r5, pc}
+    .endm // m_pop
+#endif
+
+    .macro m_copy_byte reg, cmd, label
+    ldrb    \reg, [r1], #1
+    strb    \reg, [r0], #1
+    \cmd    \reg, \label
+    .endm // m_copy_byte
+
+#if defined(STPCPY)
+ENTRY(stpcpy)
+#else
+ENTRY(strcpy)
+#endif
+    // For short copies, hard-code checking the first 8 bytes since this
+    // new code doesn't win until after about 8 bytes.
+    m_push
+    m_copy_byte reg=r2, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r3, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r4, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r5, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r2, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r3, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r4, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r5, cmd=cbnz, label=.Lstringcopy_continue
+
+.Lstringcopy_finish:
+#if defined(STPCPY)
+    sub     r0, r0, #1
+#endif
+    m_pop
+
+.Lstringcopy_continue:
+    pld     [r1, #0]
+    ands    r3, r0, #7
+    beq     .Lstringcopy_check_src_align
+
+    // Align to a double word (64 bits).
+    rsb     r3, r3, #8
+    lsls    ip, r3, #31
+    beq     .Lstringcopy_align_to_32
+
+    ldrb    r2, [r1], #1
+    strb    r2, [r0], #1
+    cbz     r2, .Lstringcopy_complete
+
+.Lstringcopy_align_to_32:
+    bcc     .Lstringcopy_align_to_64
+
+    ldrb    r2, [r1], #1
+    strb    r2, [r0], #1
+    cbz     r2, .Lstringcopy_complete
+    ldrb    r2, [r1], #1
+    strb    r2, [r0], #1
+    cbz     r2, .Lstringcopy_complete
+
+.Lstringcopy_align_to_64:
+    tst     r3, #4
+    beq     .Lstringcopy_check_src_align
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+    str     r2, [r0], #4
+
+.Lstringcopy_check_src_align:
+    // At this point dst is aligned to a double word, check if src
+    // is also aligned to a double word.
+    ands    r3, r1, #7
+    bne     .Lstringcopy_unaligned_copy
+
+    .p2align 2
+.Lstringcopy_mainloop:
+    ldrd    r2, r3, [r1], #8
+
+    pld     [r1, #64]
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    strd    r2, r3, [r0], #8
+    b       .Lstringcopy_mainloop
+
+.Lstringcopy_complete:
+#if defined(STPCPY)
+    sub     r0, r0, #1
+#endif
+    m_pop
+
+.Lstringcopy_zero_in_first_register:
+    lsls    lr, ip, #17
+    bne     .Lstringcopy_copy1byte
+    bcs     .Lstringcopy_copy2bytes
+    lsls    ip, ip, #1
+    bne     .Lstringcopy_copy3bytes
+
+.Lstringcopy_copy4bytes:
+    // Copy 4 bytes to the destiniation.
+#if defined(STPCPY)
+    str     r2, [r0], #3
+#else
+    str     r2, [r0]
+#endif
+    m_pop
+
+.Lstringcopy_copy1byte:
+    strb    r2, [r0]
+    m_pop
+
+.Lstringcopy_copy2bytes:
+#if defined(STPCPY)
+    strh    r2, [r0], #1
+#else
+    strh    r2, [r0]
+#endif
+    m_pop
+
+.Lstringcopy_copy3bytes:
+    strh    r2, [r0], #2
+    lsr     r2, #16
+    strb    r2, [r0]
+    m_pop
+
+.Lstringcopy_zero_in_second_register:
+    lsls    lr, ip, #17
+    bne     .Lstringcopy_copy5bytes
+    bcs     .Lstringcopy_copy6bytes
+    lsls    ip, ip, #1
+    bne     .Lstringcopy_copy7bytes
+
+    // Copy 8 bytes to the destination.
+    strd    r2, r3, [r0]
+#if defined(STPCPY)
+    add     r0, r0, #7
+#endif
+    m_pop
+
+.Lstringcopy_copy5bytes:
+    str     r2, [r0], #4
+    strb    r3, [r0]
+    m_pop
+
+.Lstringcopy_copy6bytes:
+    str     r2, [r0], #4
+#if defined(STPCPY)
+    strh    r3, [r0], #1
+#else
+    strh    r3, [r0]
+#endif
+    m_pop
+
+.Lstringcopy_copy7bytes:
+    str     r2, [r0], #4
+    strh    r3, [r0], #2
+    lsr     r3, #16
+    strb    r3, [r0]
+    m_pop
+
+.Lstringcopy_unaligned_copy:
+    // Dst is aligned to a double word, while src is at an unknown alignment.
+    // There are 7 different versions of the unaligned copy code
+    // to prevent overreading the src. The mainloop of every single version
+    // will store 64 bits per loop. The difference is how much of src can
+    // be read without potentially crossing a page boundary.
+    tbb     [pc, r3]
+.Lstringcopy_unaligned_branchtable:
+    .byte 0
+    .byte ((.Lstringcopy_unalign7 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign6 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign5 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign4 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign3 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign2 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign1 - .Lstringcopy_unaligned_branchtable)/2)
+
+    .p2align 2
+    // Can read 7 bytes before possibly crossing a page.
+.Lstringcopy_unalign7:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldrb    r3, [r1]
+    cbz     r3, .Lstringcopy_unalign7_copy5bytes
+    ldrb    r4, [r1, #1]
+    cbz     r4, .Lstringcopy_unalign7_copy6bytes
+    ldrb    r5, [r1, #2]
+    cbz     r5, .Lstringcopy_unalign7_copy7bytes
+
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    lsrs    ip, r3, #24
+    strd    r2, r3, [r0], #8
+#if defined(STPCPY)
+    beq     .Lstringcopy_finish
+#else
+    beq     .Lstringcopy_unalign_return
+#endif
+    b       .Lstringcopy_unalign7
+
+.Lstringcopy_unalign7_copy5bytes:
+    str     r2, [r0], #4
+    strb    r3, [r0]
+.Lstringcopy_unalign_return:
+    m_pop
+
+.Lstringcopy_unalign7_copy6bytes:
+    str     r2, [r0], #4
+    strb    r3, [r0], #1
+    strb    r4, [r0]
+    m_pop
+
+.Lstringcopy_unalign7_copy7bytes:
+    str     r2, [r0], #4
+    strb    r3, [r0], #1
+    strb    r4, [r0], #1
+    strb    r5, [r0]
+    m_pop
+
+    .p2align 2
+    // Can read 6 bytes before possibly crossing a page.
+.Lstringcopy_unalign6:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldrb    r4, [r1]
+    cbz     r4, .Lstringcopy_unalign_copy5bytes
+    ldrb    r5, [r1, #1]
+    cbz     r5, .Lstringcopy_unalign_copy6bytes
+
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    tst     r3, #0xff0000
+    beq     .Lstringcopy_copy7bytes
+    lsrs    ip, r3, #24
+    strd    r2, r3, [r0], #8
+#if defined(STPCPY)
+    beq     .Lstringcopy_finish
+#else
+    beq     .Lstringcopy_unalign_return
+#endif
+    b       .Lstringcopy_unalign6
+
+    .p2align 2
+    // Can read 5 bytes before possibly crossing a page.
+.Lstringcopy_unalign5:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldrb    r4, [r1]
+    cbz     r4, .Lstringcopy_unalign_copy5bytes
+
+    ldr     r3, [r1], #4
+
+    pld     [r1, #64]
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    strd    r2, r3, [r0], #8
+    b       .Lstringcopy_unalign5
+
+.Lstringcopy_unalign_copy5bytes:
+    str     r2, [r0], #4
+    strb    r4, [r0]
+    m_pop
+
+.Lstringcopy_unalign_copy6bytes:
+    str     r2, [r0], #4
+    strb    r4, [r0], #1
+    strb    r5, [r0]
+    m_pop
+
+    .p2align 2
+    // Can read 4 bytes before possibly crossing a page.
+.Lstringcopy_unalign4:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    strd    r2, r3, [r0], #8
+    b       .Lstringcopy_unalign4
+
+    .p2align 2
+    // Can read 3 bytes before possibly crossing a page.
+.Lstringcopy_unalign3:
+    ldrb    r2, [r1]
+    cbz     r2, .Lstringcopy_unalign3_copy1byte
+    ldrb    r3, [r1, #1]
+    cbz     r3, .Lstringcopy_unalign3_copy2bytes
+    ldrb    r4, [r1, #2]
+    cbz     r4, .Lstringcopy_unalign3_copy3bytes
+
+    ldr     r2, [r1], #4
+    ldr     r3, [r1], #4
+
+    pld     [r1, #64]
+
+    lsrs    lr, r2, #24
+    beq     .Lstringcopy_copy4bytes
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    strd    r2, r3, [r0], #8
+    b       .Lstringcopy_unalign3
+
+.Lstringcopy_unalign3_copy1byte:
+    strb    r2, [r0]
+    m_pop
+
+.Lstringcopy_unalign3_copy2bytes:
+    strb    r2, [r0], #1
+    strb    r3, [r0]
+    m_pop
+
+.Lstringcopy_unalign3_copy3bytes:
+    strb    r2, [r0], #1
+    strb    r3, [r0], #1
+    strb    r4, [r0]
+    m_pop
+
+    .p2align 2
+    // Can read 2 bytes before possibly crossing a page.
+.Lstringcopy_unalign2:
+    ldrb    r2, [r1]
+    cbz     r2, .Lstringcopy_unalign_copy1byte
+    ldrb    r4, [r1, #1]
+    cbz     r4, .Lstringcopy_unalign_copy2bytes
+
+    ldr     r2, [r1], #4
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    tst     r2, #0xff0000
+    beq     .Lstringcopy_copy3bytes
+    lsrs    ip, r2, #24
+    beq     .Lstringcopy_copy4bytes
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    strd    r2, r3, [r0], #8
+    b       .Lstringcopy_unalign2
+
+    .p2align 2
+    // Can read 1 byte before possibly crossing a page.
+.Lstringcopy_unalign1:
+    ldrb    r2, [r1]
+    cbz     r2, .Lstringcopy_unalign_copy1byte
+
+    ldr     r2, [r1], #4
+    ldr     r3, [r1], #4
+
+    pld     [r1, #64]
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    strd    r2, r3, [r0], #8
+    b       .Lstringcopy_unalign1
+
+.Lstringcopy_unalign_copy1byte:
+    strb    r2, [r0]
+    m_pop
+
+.Lstringcopy_unalign_copy2bytes:
+    strb    r2, [r0], #1
+    strb    r4, [r0]
+    m_pop
+#if defined(STPCPY)
+END(stpcpy)
+#else
+END(strcpy)
+#endif
diff --git a/libc/arch-arm/cortex-a15/cortex-a15.mk b/libc/arch-arm/cortex-a15/cortex-a15.mk
index 552811e..f1abe32 100644
--- a/libc/arch-arm/cortex-a15/cortex-a15.mk
+++ b/libc/arch-arm/cortex-a15/cortex-a15.mk
@@ -1,10 +1,11 @@
 libc_bionic_src_files_arm += \
     arch-arm/cortex-a15/bionic/memcpy.S \
     arch-arm/cortex-a15/bionic/memset.S \
+    arch-arm/cortex-a15/bionic/stpcpy.S \
     arch-arm/cortex-a15/bionic/strcat.S \
+    arch-arm/cortex-a15/bionic/__strcat_chk.S \
     arch-arm/cortex-a15/bionic/strcmp.S \
     arch-arm/cortex-a15/bionic/strcpy.S \
-    arch-arm/cortex-a15/bionic/strlen.S \
-    arch-arm/cortex-a15/bionic/__strcat_chk.S \
     arch-arm/cortex-a15/bionic/__strcpy_chk.S \
+    arch-arm/cortex-a15/bionic/strlen.S \
     bionic/memmove.c \
diff --git a/libc/arch-arm/cortex-a9/bionic/__strcat_chk.S b/libc/arch-arm/cortex-a9/bionic/__strcat_chk.S
index 651aefc..45517f1 100644
--- a/libc/arch-arm/cortex-a9/bionic/__strcat_chk.S
+++ b/libc/arch-arm/cortex-a9/bionic/__strcat_chk.S
@@ -40,12 +40,10 @@
 ENTRY(__strcat_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
     push    {r4, r5}
-    .save   {r4, r5}
     .cfi_adjust_cfa_offset 8
     .cfi_rel_offset r4, 0
     .cfi_rel_offset r5, 4
@@ -199,8 +197,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcat_chk_fail)
-    .save   {r0, lr}
-    .save   {r4, r5}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/cortex-a9/bionic/__strcpy_chk.S b/libc/arch-arm/cortex-a9/bionic/__strcpy_chk.S
index 2447780..67eca08 100644
--- a/libc/arch-arm/cortex-a9/bionic/__strcpy_chk.S
+++ b/libc/arch-arm/cortex-a9/bionic/__strcpy_chk.S
@@ -39,7 +39,6 @@
 ENTRY(__strcpy_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
@@ -165,7 +164,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcpy_chk_fail)
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/cortex-a9/bionic/memcpy.S b/libc/arch-arm/cortex-a9/bionic/memcpy.S
index 8dcd937..db3e26f 100644
--- a/libc/arch-arm/cortex-a9/bionic/memcpy.S
+++ b/libc/arch-arm/cortex-a9/bionic/memcpy.S
@@ -50,7 +50,6 @@
 ENTRY(memcpy)
         pld     [r1, #0]
         stmfd   sp!, {r0, lr}
-        .save   {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -64,7 +63,6 @@
 ENTRY_PRIVATE(__memcpy_chk_fail)
         // Preserve lr for backtrace.
         push    {lr}
-        .save   {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
 
diff --git a/libc/arch-arm/cortex-a9/bionic/memcpy_base.S b/libc/arch-arm/cortex-a9/bionic/memcpy_base.S
index c385657..5e81305 100644
--- a/libc/arch-arm/cortex-a9/bionic/memcpy_base.S
+++ b/libc/arch-arm/cortex-a9/bionic/memcpy_base.S
@@ -33,7 +33,6 @@
  */
 
 ENTRY_PRIVATE(MEMCPY_BASE)
-        .save       {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -139,14 +138,12 @@
 END(MEMCPY_BASE)
 
 ENTRY_PRIVATE(MEMCPY_BASE_ALIGNED)
-        .save       {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
 
         /* Simple arm-only copy loop to handle aligned copy operations */
         stmfd       sp!, {r4-r8}
-        .save       {r4-r8}
         .cfi_adjust_cfa_offset 20
         .cfi_rel_offset r4, 0
         .cfi_rel_offset r5, 4
diff --git a/libc/arch-arm/cortex-a9/bionic/memset.S b/libc/arch-arm/cortex-a9/bionic/memset.S
index a5057eb..299f5a2 100644
--- a/libc/arch-arm/cortex-a9/bionic/memset.S
+++ b/libc/arch-arm/cortex-a9/bionic/memset.S
@@ -42,7 +42,6 @@
 
         // Preserve lr for backtrace.
         push        {lr}
-        .save       {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
 
@@ -72,7 +71,6 @@
         bhi         __memset_large_copy
 
         stmfd       sp!, {r0}
-        .save       {r0}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset r0, 0
 
@@ -114,7 +112,6 @@
          * offset = (4-(src&3))&3 = -src & 3
          */
         stmfd       sp!, {r0, r4-r7, lr}
-        .save       {r0, r4-r7, lr}
         .cfi_def_cfa_offset 24
         .cfi_rel_offset r0, 0
         .cfi_rel_offset r4, 4
diff --git a/libc/arch-arm64/bionic/__rt_sigreturn.S b/libc/arch-arm/cortex-a9/bionic/stpcpy.S
similarity index 87%
copy from libc/arch-arm64/bionic/__rt_sigreturn.S
copy to libc/arch-arm/cortex-a9/bionic/stpcpy.S
index 8fb6f0c..740523b 100644
--- a/libc/arch-arm64/bionic/__rt_sigreturn.S
+++ b/libc/arch-arm/cortex-a9/bionic/stpcpy.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 The Android Open Source Project
+ * Copyright (C) 2014 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,9 +26,5 @@
  * SUCH DAMAGE.
  */
 
-#include <private/bionic_asm.h>
-
-ENTRY_PRIVATE(__rt_sigreturn)
-  mov     x8, __NR_rt_sigreturn
-  svc     #0
-END(__rt_sigreturn)
+#define STPCPY
+#include "string_copy.S"
diff --git a/libc/arch-arm/cortex-a9/bionic/strcmp.S b/libc/arch-arm/cortex-a9/bionic/strcmp.S
index 2411c65..4ff26c0 100644
--- a/libc/arch-arm/cortex-a9/bionic/strcmp.S
+++ b/libc/arch-arm/cortex-a9/bionic/strcmp.S
@@ -168,7 +168,6 @@
         bne     .L_do_align
 
         /* Fast path.  */
-        .save   {r4-r7}
         init
 
 .L_doubleword_aligned:
diff --git a/libc/arch-arm/cortex-a9/bionic/strcpy.S b/libc/arch-arm/cortex-a9/bionic/strcpy.S
index 9e9610b..951face 100644
--- a/libc/arch-arm/cortex-a9/bionic/strcpy.S
+++ b/libc/arch-arm/cortex-a9/bionic/strcpy.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 The Android Open Source Project
+ * Copyright (C) 2014 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,432 +25,6 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/*
- * Copyright (c) 2013 ARM Ltd
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the company may not be used to endorse or promote
- *    products derived from this software without specific prior written
- *    permission.
- *
- * THIS SOFTWARE IS PROVIDED BY ARM LTD ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL ARM LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
 
-#include <private/bionic_asm.h>
-
-    .syntax unified
-
-    .thumb
-    .thumb_func
-
-    .macro m_push
-    push    {r0, r4, r5, lr}
-    .endm // m_push
-
-    .macro m_ret inst
-    \inst   {r0, r4, r5, pc}
-    .endm // m_ret
-
-    .macro m_copy_byte reg, cmd, label
-    ldrb    \reg, [r1], #1
-    strb    \reg, [r0], #1
-    \cmd    \reg, \label
-    .endm // m_copy_byte
-
-ENTRY(strcpy)
-    // Unroll the first 8 bytes that will be copied.
-    m_push
-    m_copy_byte reg=r2, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r3, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r4, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r5, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r2, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r3, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r4, cmd=cbz, label=strcpy_finish
-    m_copy_byte reg=r5, cmd=cbnz, label=strcpy_continue
-
-strcpy_finish:
-    m_ret   inst=pop
-
-strcpy_continue:
-    pld     [r1, #0]
-    ands    r3, r0, #7
-    bne     strcpy_align_dst
-
-strcpy_check_src_align:
-    // At this point dst is aligned to a double word, check if src
-    // is also aligned to a double word.
-    ands    r3, r1, #7
-    bne     strcpy_unaligned_copy
-
-    .p2align 2
-strcpy_mainloop:
-    ldmia   r1!, {r2, r3}
-
-    pld     [r1, #64]
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    stmia   r0!, {r2, r3}
-    b       strcpy_mainloop
-
-strcpy_zero_in_first_register:
-    lsls    lr, ip, #17
-    itt     ne
-    strbne  r2, [r0]
-    m_ret   inst=popne
-    itt     cs
-    strhcs  r2, [r0]
-    m_ret   inst=popcs
-    lsls    ip, ip, #1
-    itt     eq
-    streq   r2, [r0]
-    m_ret   inst=popeq
-    strh    r2, [r0], #2
-    lsr     r3, r2, #16
-    strb    r3, [r0]
-    m_ret   inst=pop
-
-strcpy_zero_in_second_register:
-    lsls    lr, ip, #17
-    ittt    ne
-    stmiane r0!, {r2}
-    strbne  r3, [r0]
-    m_ret   inst=popne
-    ittt    cs
-    strcs   r2, [r0], #4
-    strhcs  r3, [r0]
-    m_ret   inst=popcs
-    lsls    ip, ip, #1
-    itt     eq
-    stmiaeq r0, {r2, r3}
-    m_ret   inst=popeq
-    stmia   r0!, {r2}
-    strh    r3, [r0], #2
-    lsr     r4, r3, #16
-    strb    r4, [r0]
-    m_ret   inst=pop
-
-strcpy_align_dst:
-    // Align to a double word (64 bits).
-    rsb     r3, r3, #8
-    lsls    ip, r3, #31
-    beq     strcpy_align_to_32
-
-    ldrb    r2, [r1], #1
-    strb    r2, [r0], #1
-    cbz     r2, strcpy_complete
-
-strcpy_align_to_32:
-    bcc     strcpy_align_to_64
-
-    ldrb    r4, [r1], #1
-    strb    r4, [r0], #1
-    cmp     r4, #0
-    it      eq
-    m_ret   inst=popeq
-    ldrb    r5, [r1], #1
-    strb    r5, [r0], #1
-    cmp     r5, #0
-    it      eq
-    m_ret   inst=popeq
-
-strcpy_align_to_64:
-    tst     r3, #4
-    beq     strcpy_check_src_align
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-    stmia   r0!, {r2}
-    b       strcpy_check_src_align
-
-strcpy_complete:
-    m_ret   inst=pop
-
-strcpy_unaligned_copy:
-    // Dst is aligned to a double word, while src is at an unknown alignment.
-    // There are 7 different versions of the unaligned copy code
-    // to prevent overreading the src. The mainloop of every single version
-    // will store 64 bits per loop. The difference is how much of src can
-    // be read without potentially crossing a page boundary.
-    tbb     [pc, r3]
-strcpy_unaligned_branchtable:
-    .byte 0
-    .byte ((strcpy_unalign7 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign6 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign5 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign4 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign3 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign2 - strcpy_unaligned_branchtable)/2)
-    .byte ((strcpy_unalign1 - strcpy_unaligned_branchtable)/2)
-
-    .p2align 2
-    // Can read 7 bytes before possibly crossing a page.
-strcpy_unalign7:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldrb    r3, [r1]
-    cbz     r3, strcpy_unalign7_copy5bytes
-    ldrb    r4, [r1, #1]
-    cbz     r4, strcpy_unalign7_copy6bytes
-    ldrb    r5, [r1, #2]
-    cbz     r5, strcpy_unalign7_copy7bytes
-
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    lsrs    ip, r3, #24
-    stmia   r0!, {r2, r3}
-    beq     strcpy_unalign_return
-    b       strcpy_unalign7
-
-strcpy_unalign7_copy5bytes:
-    stmia   r0!, {r2}
-    strb    r3, [r0]
-strcpy_unalign_return:
-    m_ret   inst=pop
-
-strcpy_unalign7_copy6bytes:
-    stmia   r0!, {r2}
-    strb    r3, [r0], #1
-    strb    r4, [r0], #1
-    m_ret   inst=pop
-
-strcpy_unalign7_copy7bytes:
-    stmia   r0!, {r2}
-    strb    r3, [r0], #1
-    strb    r4, [r0], #1
-    strb    r5, [r0], #1
-    m_ret   inst=pop
-
-    .p2align 2
-    // Can read 6 bytes before possibly crossing a page.
-strcpy_unalign6:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldrb    r4, [r1]
-    cbz     r4, strcpy_unalign_copy5bytes
-    ldrb    r5, [r1, #1]
-    cbz     r5, strcpy_unalign_copy6bytes
-
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    tst     r3, #0xff0000
-    beq     strcpy_unalign6_copy7bytes
-    lsrs    ip, r3, #24
-    stmia   r0!, {r2, r3}
-    beq     strcpy_unalign_return
-    b       strcpy_unalign6
-
-strcpy_unalign6_copy7bytes:
-    stmia   r0!, {r2}
-    strh    r3, [r0], #2
-    lsr     r3, #16
-    strb    r3, [r0]
-    m_ret   inst=pop
-
-    .p2align 2
-    // Can read 5 bytes before possibly crossing a page.
-strcpy_unalign5:
-    ldr     r2, [r1], #4
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldrb    r4, [r1]
-    cbz     r4, strcpy_unalign_copy5bytes
-
-    ldr     r3, [r1], #4
-
-    pld     [r1, #64]
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    stmia   r0!, {r2, r3}
-    b       strcpy_unalign5
-
-strcpy_unalign_copy5bytes:
-    stmia   r0!, {r2}
-    strb    r4, [r0]
-    m_ret   inst=pop
-
-strcpy_unalign_copy6bytes:
-    stmia   r0!, {r2}
-    strb    r4, [r0], #1
-    strb    r5, [r0]
-    m_ret   inst=pop
-
-    .p2align 2
-    // Can read 4 bytes before possibly crossing a page.
-strcpy_unalign4:
-    ldmia   r1!, {r2}
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    ldmia   r1!, {r3}
-    pld     [r1, #64]
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    stmia   r0!, {r2, r3}
-    b       strcpy_unalign4
-
-    .p2align 2
-    // Can read 3 bytes before possibly crossing a page.
-strcpy_unalign3:
-    ldrb    r2, [r1]
-    cbz     r2, strcpy_unalign3_copy1byte
-    ldrb    r3, [r1, #1]
-    cbz     r3, strcpy_unalign3_copy2bytes
-    ldrb    r4, [r1, #2]
-    cbz     r4, strcpy_unalign3_copy3bytes
-
-    ldr     r2, [r1], #4
-    ldr     r3, [r1], #4
-
-    pld     [r1, #64]
-
-    lsrs    lr, r2, #24
-    beq     strcpy_unalign_copy4bytes
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    stmia   r0!, {r2, r3}
-    b       strcpy_unalign3
-
-strcpy_unalign3_copy1byte:
-    strb    r2, [r0]
-    m_ret   inst=pop
-
-strcpy_unalign3_copy2bytes:
-    strb    r2, [r0], #1
-    strb    r3, [r0]
-    m_ret   inst=pop
-
-strcpy_unalign3_copy3bytes:
-    strb    r2, [r0], #1
-    strb    r3, [r0], #1
-    strb    r4, [r0]
-    m_ret   inst=pop
-
-    .p2align 2
-    // Can read 2 bytes before possibly crossing a page.
-strcpy_unalign2:
-    ldrb    r2, [r1]
-    cbz     r2, strcpy_unalign_copy1byte
-    ldrb    r3, [r1, #1]
-    cbz     r3, strcpy_unalign_copy2bytes
-
-    ldr     r2, [r1], #4
-    ldr     r3, [r1], #4
-    pld     [r1, #64]
-
-    tst     r2, #0xff0000
-    beq     strcpy_unalign_copy3bytes
-    lsrs    ip, r2, #24
-    beq     strcpy_unalign_copy4bytes
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    stmia   r0!, {r2, r3}
-    b       strcpy_unalign2
-
-    .p2align 2
-    // Can read 1 byte before possibly crossing a page.
-strcpy_unalign1:
-    ldrb    r2, [r1]
-    cbz     r2, strcpy_unalign_copy1byte
-
-    ldr     r2, [r1], #4
-    ldr     r3, [r1], #4
-
-    pld     [r1, #64]
-
-    sub     ip, r2, #0x01010101
-    bic     ip, ip, r2
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_first_register
-
-    sub     ip, r3, #0x01010101
-    bic     ip, ip, r3
-    ands    ip, ip, #0x80808080
-    bne     strcpy_zero_in_second_register
-
-    stmia   r0!, {r2, r3}
-    b       strcpy_unalign1
-
-strcpy_unalign_copy1byte:
-    strb    r2, [r0]
-    m_ret   inst=pop
-
-strcpy_unalign_copy2bytes:
-    strb    r2, [r0], #1
-    strb    r3, [r0]
-    m_ret   inst=pop
-
-strcpy_unalign_copy3bytes:
-    strh    r2, [r0], #2
-    lsr     r2, #16
-    strb    r2, [r0]
-    m_ret   inst=pop
-
-strcpy_unalign_copy4bytes:
-    stmia   r0, {r2}
-    m_ret   inst=pop
-END(strcpy)
+#define STRCPY
+#include "string_copy.S"
diff --git a/libc/arch-arm/cortex-a9/bionic/string_copy.S b/libc/arch-arm/cortex-a9/bionic/string_copy.S
new file mode 100644
index 0000000..caf5a11
--- /dev/null
+++ b/libc/arch-arm/cortex-a9/bionic/string_copy.S
@@ -0,0 +1,535 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * Copyright (c) 2013 ARM Ltd
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the company may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY ARM LTD ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL ARM LTD BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#if !defined(STPCPY) && !defined(STRCPY)
+#error "Either STPCPY or STRCPY must be defined."
+#endif
+
+#include <private/bionic_asm.h>
+
+    .syntax unified
+
+    .thumb
+    .thumb_func
+
+#if defined(STPCPY)
+    .macro m_push
+    push    {r4, r5, lr}
+    .cfi_def_cfa_offset 12
+    .cfi_rel_offset r4, 0
+    .cfi_rel_offset r5, 4
+    .cfi_rel_offset lr, 8
+    .endm // m_push
+#else
+    .macro m_push
+    push    {r0, r4, r5, lr}
+    .cfi_def_cfa_offset 16
+    .cfi_rel_offset r0, 0
+    .cfi_rel_offset r4, 4
+    .cfi_rel_offset r5, 8
+    .cfi_rel_offset lr, 12
+    .endm // m_push
+#endif
+
+#if defined(STPCPY)
+    .macro m_ret inst
+    \inst   {r4, r5, pc}
+    .endm // m_ret
+#else
+    .macro m_ret inst
+    \inst   {r0, r4, r5, pc}
+    .endm // m_ret
+#endif
+
+    .macro m_copy_byte reg, cmd, label
+    ldrb    \reg, [r1], #1
+    strb    \reg, [r0], #1
+    \cmd    \reg, \label
+    .endm // m_copy_byte
+
+#if defined(STPCPY)
+ENTRY(stpcpy)
+#else
+ENTRY(strcpy)
+#endif
+    // Unroll the first 8 bytes that will be copied.
+    m_push
+    m_copy_byte reg=r2, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r3, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r4, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r5, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r2, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r3, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r4, cmd=cbz, label=.Lstringcopy_finish
+    m_copy_byte reg=r5, cmd=cbnz, label=.Lstringcopy_continue
+
+.Lstringcopy_finish:
+#if defined(STPCPY)
+    sub     r0, r0, #1
+#endif
+    m_ret   inst=pop
+
+.Lstringcopy_continue:
+    pld     [r1, #0]
+    ands    r3, r0, #7
+    bne     .Lstringcopy_align_dst
+
+.Lstringcopy_check_src_align:
+    // At this point dst is aligned to a double word, check if src
+    // is also aligned to a double word.
+    ands    r3, r1, #7
+    bne     .Lstringcopy_unaligned_copy
+
+    .p2align 2
+.Lstringcopy_mainloop:
+    ldmia   r1!, {r2, r3}
+
+    pld     [r1, #64]
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    stmia   r0!, {r2, r3}
+    b       .Lstringcopy_mainloop
+
+.Lstringcopy_zero_in_first_register:
+    lsls    lr, ip, #17
+    itt     ne
+    strbne  r2, [r0]
+    m_ret   inst=popne
+    itt     cs
+#if defined(STPCPY)
+    strhcs  r2, [r0], #1
+#else
+    strhcs  r2, [r0]
+#endif
+    m_ret   inst=popcs
+    lsls    ip, ip, #1
+    itt     eq
+#if defined(STPCPY)
+    streq   r2, [r0], #3
+#else
+    streq   r2, [r0]
+#endif
+    m_ret   inst=popeq
+    strh    r2, [r0], #2
+    lsr     r3, r2, #16
+    strb    r3, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_zero_in_second_register:
+    lsls    lr, ip, #17
+    ittt    ne
+    stmiane r0!, {r2}
+    strbne  r3, [r0]
+    m_ret   inst=popne
+    ittt    cs
+    strcs   r2, [r0], #4
+#if defined(STPCPY)
+    strhcs  r3, [r0], #1
+#else
+    strhcs  r3, [r0]
+#endif
+    m_ret   inst=popcs
+    lsls    ip, ip, #1
+#if defined(STPCPY)
+    ittt    eq
+#else
+    itt     eq
+#endif
+    stmiaeq r0, {r2, r3}
+#if defined(STPCPY)
+    addeq   r0, r0, #7
+#endif
+    m_ret   inst=popeq
+    stmia   r0!, {r2}
+    strh    r3, [r0], #2
+    lsr     r4, r3, #16
+    strb    r4, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_align_dst:
+    // Align to a double word (64 bits).
+    rsb     r3, r3, #8
+    lsls    ip, r3, #31
+    beq     .Lstringcopy_align_to_32
+
+    ldrb    r2, [r1], #1
+    strb    r2, [r0], #1
+    cbz     r2, .Lstringcopy_complete
+
+.Lstringcopy_align_to_32:
+    bcc     .Lstringcopy_align_to_64
+
+    ldrb    r4, [r1], #1
+    strb    r4, [r0], #1
+    cmp     r4, #0
+#if defined(STPCPY)
+    itt     eq
+    subeq   r0, r0, #1
+#else
+    it      eq
+#endif
+    m_ret   inst=popeq
+    ldrb    r5, [r1], #1
+    strb    r5, [r0], #1
+    cmp     r5, #0
+#if defined(STPCPY)
+    itt     eq
+    subeq   r0, r0, #1
+#else
+    it      eq
+#endif
+    m_ret   inst=popeq
+
+.Lstringcopy_align_to_64:
+    tst     r3, #4
+    beq     .Lstringcopy_check_src_align
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+    stmia   r0!, {r2}
+    b       .Lstringcopy_check_src_align
+
+.Lstringcopy_complete:
+#if defined(STPCPY)
+    sub     r0, r0, #1
+#endif
+    m_ret   inst=pop
+
+.Lstringcopy_unaligned_copy:
+    // Dst is aligned to a double word, while src is at an unknown alignment.
+    // There are 7 different versions of the unaligned copy code
+    // to prevent overreading the src. The mainloop of every single version
+    // will store 64 bits per loop. The difference is how much of src can
+    // be read without potentially crossing a page boundary.
+    tbb     [pc, r3]
+.Lstringcopy_unaligned_branchtable:
+    .byte 0
+    .byte ((.Lstringcopy_unalign7 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign6 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign5 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign4 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign3 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign2 - .Lstringcopy_unaligned_branchtable)/2)
+    .byte ((.Lstringcopy_unalign1 - .Lstringcopy_unaligned_branchtable)/2)
+
+    .p2align 2
+    // Can read 7 bytes before possibly crossing a page.
+.Lstringcopy_unalign7:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldrb    r3, [r1]
+    cbz     r3, .Lstringcopy_unalign7_copy5bytes
+    ldrb    r4, [r1, #1]
+    cbz     r4, .Lstringcopy_unalign7_copy6bytes
+    ldrb    r5, [r1, #2]
+    cbz     r5, .Lstringcopy_unalign7_copy7bytes
+
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    lsrs    ip, r3, #24
+    stmia   r0!, {r2, r3}
+#if defined(STPCPY)
+    beq     .Lstringcopy_finish
+#else
+    beq     .Lstringcopy_unalign_return
+#endif
+    b       .Lstringcopy_unalign7
+
+.Lstringcopy_unalign7_copy5bytes:
+    stmia   r0!, {r2}
+    strb    r3, [r0]
+.Lstringcopy_unalign_return:
+    m_ret   inst=pop
+
+.Lstringcopy_unalign7_copy6bytes:
+    stmia   r0!, {r2}
+    strb    r3, [r0], #1
+    strb    r4, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign7_copy7bytes:
+    stmia   r0!, {r2}
+    strb    r3, [r0], #1
+    strb    r4, [r0], #1
+    strb    r5, [r0]
+    m_ret   inst=pop
+
+    .p2align 2
+    // Can read 6 bytes before possibly crossing a page.
+.Lstringcopy_unalign6:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldrb    r4, [r1]
+    cbz     r4, .Lstringcopy_unalign_copy5bytes
+    ldrb    r5, [r1, #1]
+    cbz     r5, .Lstringcopy_unalign_copy6bytes
+
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    tst     r3, #0xff0000
+    beq     .Lstringcopy_unalign6_copy7bytes
+    lsrs    ip, r3, #24
+    stmia   r0!, {r2, r3}
+#if defined(STPCPY)
+    beq     .Lstringcopy_finish
+#else
+    beq     .Lstringcopy_unalign_return
+#endif
+    b       .Lstringcopy_unalign6
+
+.Lstringcopy_unalign6_copy7bytes:
+    stmia   r0!, {r2}
+    strh    r3, [r0], #2
+    lsr     r3, #16
+    strb    r3, [r0]
+    m_ret   inst=pop
+
+    .p2align 2
+    // Can read 5 bytes before possibly crossing a page.
+.Lstringcopy_unalign5:
+    ldr     r2, [r1], #4
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldrb    r4, [r1]
+    cbz     r4, .Lstringcopy_unalign_copy5bytes
+
+    ldr     r3, [r1], #4
+
+    pld     [r1, #64]
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    stmia   r0!, {r2, r3}
+    b       .Lstringcopy_unalign5
+
+.Lstringcopy_unalign_copy5bytes:
+    stmia   r0!, {r2}
+    strb    r4, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign_copy6bytes:
+    stmia   r0!, {r2}
+    strb    r4, [r0], #1
+    strb    r5, [r0]
+    m_ret   inst=pop
+
+    .p2align 2
+    // Can read 4 bytes before possibly crossing a page.
+.Lstringcopy_unalign4:
+    ldmia   r1!, {r2}
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    ldmia   r1!, {r3}
+    pld     [r1, #64]
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    stmia   r0!, {r2, r3}
+    b       .Lstringcopy_unalign4
+
+    .p2align 2
+    // Can read 3 bytes before possibly crossing a page.
+.Lstringcopy_unalign3:
+    ldrb    r2, [r1]
+    cbz     r2, .Lstringcopy_unalign3_copy1byte
+    ldrb    r3, [r1, #1]
+    cbz     r3, .Lstringcopy_unalign3_copy2bytes
+    ldrb    r4, [r1, #2]
+    cbz     r4, .Lstringcopy_unalign3_copy3bytes
+
+    ldr     r2, [r1], #4
+    ldr     r3, [r1], #4
+
+    pld     [r1, #64]
+
+    lsrs    lr, r2, #24
+    beq     .Lstringcopy_unalign_copy4bytes
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    stmia   r0!, {r2, r3}
+    b       .Lstringcopy_unalign3
+
+.Lstringcopy_unalign3_copy1byte:
+    strb    r2, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign3_copy2bytes:
+    strb    r2, [r0], #1
+    strb    r3, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign3_copy3bytes:
+    strb    r2, [r0], #1
+    strb    r3, [r0], #1
+    strb    r4, [r0]
+    m_ret   inst=pop
+
+    .p2align 2
+    // Can read 2 bytes before possibly crossing a page.
+.Lstringcopy_unalign2:
+    ldrb    r2, [r1]
+    cbz     r2, .Lstringcopy_unalign_copy1byte
+    ldrb    r3, [r1, #1]
+    cbz     r3, .Lstringcopy_unalign_copy2bytes
+
+    ldr     r2, [r1], #4
+    ldr     r3, [r1], #4
+    pld     [r1, #64]
+
+    tst     r2, #0xff0000
+    beq     .Lstringcopy_unalign_copy3bytes
+    lsrs    ip, r2, #24
+    beq     .Lstringcopy_unalign_copy4bytes
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    stmia   r0!, {r2, r3}
+    b       .Lstringcopy_unalign2
+
+    .p2align 2
+    // Can read 1 byte before possibly crossing a page.
+.Lstringcopy_unalign1:
+    ldrb    r2, [r1]
+    cbz     r2, .Lstringcopy_unalign_copy1byte
+
+    ldr     r2, [r1], #4
+    ldr     r3, [r1], #4
+
+    pld     [r1, #64]
+
+    sub     ip, r2, #0x01010101
+    bic     ip, ip, r2
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_first_register
+
+    sub     ip, r3, #0x01010101
+    bic     ip, ip, r3
+    ands    ip, ip, #0x80808080
+    bne     .Lstringcopy_zero_in_second_register
+
+    stmia   r0!, {r2, r3}
+    b       .Lstringcopy_unalign1
+
+.Lstringcopy_unalign_copy1byte:
+    strb    r2, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign_copy2bytes:
+    strb    r2, [r0], #1
+    strb    r3, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign_copy3bytes:
+    strh    r2, [r0], #2
+    lsr     r2, #16
+    strb    r2, [r0]
+    m_ret   inst=pop
+
+.Lstringcopy_unalign_copy4bytes:
+    stmia   r0, {r2}
+#if defined(STPCPY)
+    add     r0, r0, #3
+#endif
+    m_ret   inst=pop
+#if defined(STPCPY)
+END(stpcpy)
+#else
+END(strcpy)
+#endif
diff --git a/libc/arch-arm/cortex-a9/cortex-a9.mk b/libc/arch-arm/cortex-a9/cortex-a9.mk
index 9b99387..c82db3b 100644
--- a/libc/arch-arm/cortex-a9/cortex-a9.mk
+++ b/libc/arch-arm/cortex-a9/cortex-a9.mk
@@ -1,10 +1,11 @@
 libc_bionic_src_files_arm += \
     arch-arm/cortex-a9/bionic/memcpy.S \
     arch-arm/cortex-a9/bionic/memset.S \
+    arch-arm/cortex-a9/bionic/stpcpy.S \
     arch-arm/cortex-a9/bionic/strcat.S \
+    arch-arm/cortex-a9/bionic/__strcat_chk.S \
     arch-arm/cortex-a9/bionic/strcmp.S \
     arch-arm/cortex-a9/bionic/strcpy.S \
-    arch-arm/cortex-a9/bionic/strlen.S \
-    arch-arm/cortex-a9/bionic/__strcat_chk.S \
     arch-arm/cortex-a9/bionic/__strcpy_chk.S \
+    arch-arm/cortex-a9/bionic/strlen.S \
     bionic/memmove.c \
diff --git a/libc/arch-arm/denver/bionic/__strcat_chk.S b/libc/arch-arm/denver/bionic/__strcat_chk.S
index 36da2d9..a2e9c22 100644
--- a/libc/arch-arm/denver/bionic/__strcat_chk.S
+++ b/libc/arch-arm/denver/bionic/__strcat_chk.S
@@ -40,12 +40,10 @@
 ENTRY(__strcat_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
     push    {r4, r5}
-    .save   {r4, r5}
     .cfi_adjust_cfa_offset 8
     .cfi_rel_offset r4, 0
     .cfi_rel_offset r5, 4
@@ -195,9 +193,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcat_chk_failed)
-    .save   {r0, lr}
-    .save   {r4, r5}
-
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/denver/bionic/__strcpy_chk.S b/libc/arch-arm/denver/bionic/__strcpy_chk.S
index c3e3e14..db76686 100644
--- a/libc/arch-arm/denver/bionic/__strcpy_chk.S
+++ b/libc/arch-arm/denver/bionic/__strcpy_chk.S
@@ -39,7 +39,6 @@
 ENTRY(__strcpy_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
@@ -161,7 +160,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcpy_chk_failed)
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/denver/bionic/memcpy.S b/libc/arch-arm/denver/bionic/memcpy.S
index da4f3dd..410b663 100644
--- a/libc/arch-arm/denver/bionic/memcpy.S
+++ b/libc/arch-arm/denver/bionic/memcpy.S
@@ -72,7 +72,6 @@
 ENTRY(memcpy)
         pld     [r1, #64]
         push    {r0, lr}
-        .save   {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -85,7 +84,6 @@
 ENTRY_PRIVATE(__memcpy_chk_fail)
         // Preserve lr for backtrace.
         push    {lr}
-        .save   {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
 
diff --git a/libc/arch-arm/denver/denver.mk b/libc/arch-arm/denver/denver.mk
index 6989187..0bc52a2 100644
--- a/libc/arch-arm/denver/denver.mk
+++ b/libc/arch-arm/denver/denver.mk
@@ -7,7 +7,8 @@
 
 # Use cortex-a15 versions of strcat/strcpy/strlen.
 libc_bionic_src_files_arm += \
+    arch-arm/cortex-a15/bionic/stpcpy.S \
     arch-arm/cortex-a15/bionic/strcat.S \
+    arch-arm/cortex-a15/bionic/strcmp.S \
     arch-arm/cortex-a15/bionic/strcpy.S \
     arch-arm/cortex-a15/bionic/strlen.S \
-    arch-arm/cortex-a15/bionic/strcmp.S \
diff --git a/libc/arch-arm/generic/bionic/memcpy.S b/libc/arch-arm/generic/bionic/memcpy.S
index cd4a13d..b0c79ab 100644
--- a/libc/arch-arm/generic/bionic/memcpy.S
+++ b/libc/arch-arm/generic/bionic/memcpy.S
@@ -39,7 +39,7 @@
 
 ENTRY(__memcpy_chk)
         cmp         r2, r3
-        bgt         fortify_check_failed
+        bhi         __memcpy_chk_fail
 
         // Fall through to memcpy...
 END(__memcpy_chk)
@@ -49,11 +49,14 @@
          * ARM ABI. Since we have to save R0, we might as well save R4
          * which we can use for better pipelining of the reads below
          */
-        .save       {r0, r4, lr}
         stmfd       sp!, {r0, r4, lr}
+        .cfi_def_cfa_offset 12
+        .cfi_rel_offset r0, 0
+        .cfi_rel_offset r4, 4
+        .cfi_rel_offset lr, 8
         /* Making room for r5-r11 which will be spilled later */
-        .pad        #28
         sub         sp, sp, #28
+        .cfi_adjust_cfa_offset 28
 
         // preload the destination because we'll align it to a cache line
         // with small writes. Also start the source "pump".
@@ -63,14 +66,14 @@
 
         /* it simplifies things to take care of len<4 early */
         cmp         r2, #4
-        blo         copy_last_3_and_return
+        blo         .Lcopy_last_3_and_return
 
         /* compute the offset to align the source
          * offset = (4-(src&3))&3 = -src & 3
          */
         rsb         r3, r1, #0
         ands        r3, r3, #3
-        beq         src_aligned
+        beq         .Lsrc_aligned
 
         /* align source to 32 bits. We need to insert 2 instructions between
          * a ldr[b|h] and str[b|h] because byte and half-word instructions
@@ -85,12 +88,12 @@
         strcsb      r4, [r0], #1
         strcsb      r12,[r0], #1
 
-src_aligned:
+.Lsrc_aligned:
 
         /* see if src and dst are aligned together (congruent) */
         eor         r12, r0, r1
         tst         r12, #3
-        bne         non_congruent
+        bne         .Lnon_congruent
 
         /* Use post-incriment mode for stm to spill r5-r11 to reserved stack
          * frame. Don't update sp.
@@ -100,7 +103,7 @@
         /* align the destination to a cache-line */
         rsb         r3, r0, #0
         ands        r3, r3, #0x1C
-        beq         congruent_aligned32
+        beq         .Lcongruent_aligned32
         cmp         r3, r2
         andhi       r3, r2, #0x1C
 
@@ -115,14 +118,14 @@
         strne       r10,[r0], #4
         sub         r2, r2, r3
 
-congruent_aligned32:
+.Lcongruent_aligned32:
         /*
          * here source is aligned to 32 bytes.
          */
 
-cached_aligned32:
+.Lcached_aligned32:
         subs        r2, r2, #32
-        blo         less_than_32_left
+        blo         .Lless_than_32_left
 
         /*
          * We preload a cache-line up to 64 bytes ahead. On the 926, this will
@@ -160,10 +163,7 @@
 
         add         r2, r2, #32
 
-
-
-
-less_than_32_left:
+.Lless_than_32_left:
         /*
          * less than 32 bytes left at this point (length in r2)
          */
@@ -197,7 +197,7 @@
 
         /********************************************************************/
 
-non_congruent:
+.Lnon_congruent:
         /*
          * here source is aligned to 4 bytes
          * but destination is not.
@@ -207,9 +207,9 @@
          * partial words in the shift queue)
          */
         cmp         r2, #4
-        blo         copy_last_3_and_return
+        blo         .Lcopy_last_3_and_return
 
-        /* Use post-incriment mode for stm to spill r5-r11 to reserved stack
+        /* Use post-increment mode for stm to spill r5-r11 to reserved stack
          * frame. Don't update sp.
          */
         stmea       sp, {r5-r11}
@@ -236,7 +236,7 @@
         movcs       r3, r3, lsr #8
 
         cmp         r2, #4
-        blo         partial_word_tail
+        blo         .Lpartial_word_tail
 
         /* Align destination to 32 bytes (cache line boundary) */
 1:      tst         r0, #0x1c
@@ -248,11 +248,11 @@
         str         r4, [r0], #4
         cmp         r2, #4
         bhs         1b
-        blo         partial_word_tail
+        blo         .Lpartial_word_tail
 
         /* copy 32 bytes at a time */
 2:      subs        r2, r2, #32
-        blo         less_than_thirtytwo
+        blo         .Lless_than_thirtytwo
 
         /* Use immediate mode for the shifts, because there is an extra cycle
          * for register shifts, which could account for up to 50% of
@@ -260,11 +260,11 @@
          */
 
         cmp         r12, #24
-        beq         loop24
+        beq         .Lloop24
         cmp         r12, #8
-        beq         loop8
+        beq         .Lloop8
 
-loop16:
+.Lloop16:
         ldr         r12, [r1], #4
 1:      mov         r4, r12
         ldmia       r1!, {   r5,r6,r7,  r8,r9,r10,r11}
@@ -289,9 +289,9 @@
         stmia       r0!, {r3,r4,r5,r6, r7,r8,r9,r10}
         mov         r3, r11,        lsr #16
         bhs         1b
-        b           less_than_thirtytwo
+        b           .Lless_than_thirtytwo
 
-loop8:
+.Lloop8:
         ldr         r12, [r1], #4
 1:      mov         r4, r12
         ldmia       r1!, {   r5,r6,r7,  r8,r9,r10,r11}
@@ -316,9 +316,9 @@
         stmia       r0!, {r3,r4,r5,r6, r7,r8,r9,r10}
         mov         r3, r11,        lsr #8
         bhs         1b
-        b           less_than_thirtytwo
+        b           .Lless_than_thirtytwo
 
-loop24:
+.Lloop24:
         ldr         r12, [r1], #4
 1:      mov         r4, r12
         ldmia       r1!, {   r5,r6,r7,  r8,r9,r10,r11}
@@ -345,12 +345,12 @@
         bhs         1b
 
 
-less_than_thirtytwo:
+.Lless_than_thirtytwo:
         /* copy the last 0 to 31 bytes of the source */
         rsb         r12, lr, #32        /* we corrupted r12, recompute it  */
         add         r2, r2, #32
         cmp         r2, #4
-        blo         partial_word_tail
+        blo         .Lpartial_word_tail
 
 1:      ldr         r5, [r1], #4
         sub         r2, r2, #4
@@ -360,7 +360,7 @@
         cmp         r2, #4
         bhs         1b
 
-partial_word_tail:
+.Lpartial_word_tail:
         /* we have a partial word in the input buffer */
         movs        r5, lr, lsl #(31-3)
         strmib      r3, [r0], #1
@@ -372,7 +372,7 @@
         /* Refill spilled registers from the stack. Don't update sp. */
         ldmfd       sp, {r5-r11}
 
-copy_last_3_and_return:
+.Lcopy_last_3_and_return:
         movs        r2, r2, lsl #31 /* copy remaining 0, 1, 2 or 3 bytes */
         ldrmib      r2, [r1], #1
         ldrcsb      r3, [r1], #1
@@ -385,9 +385,15 @@
         add         sp,  sp, #28
         ldmfd       sp!, {r0, r4, lr}
         bx          lr
+END(memcpy)
 
         // Only reached when the __memcpy_chk check fails.
-fortify_check_failed:
+ENTRY_PRIVATE(__memcpy_chk_fail)
+        // Preserve lr for backtrace.
+        push    {lr}
+        .cfi_def_cfa_offset 4
+        .cfi_rel_offset lr, 0
+
         ldr     r0, error_message
         ldr     r1, error_code
 1:
@@ -397,7 +403,7 @@
         .word   BIONIC_EVENT_MEMCPY_BUFFER_OVERFLOW
 error_message:
         .word   error_string-(1b+8)
-END(memcpy)
+END(__memcpy_chk_fail)
 
         .data
 error_string:
diff --git a/libc/arch-arm/generic/generic.mk b/libc/arch-arm/generic/generic.mk
index 2456e6e..95be867 100644
--- a/libc/arch-arm/generic/generic.mk
+++ b/libc/arch-arm/generic/generic.mk
@@ -7,4 +7,5 @@
     bionic/memmove.c \
     bionic/__strcat_chk.cpp \
     bionic/__strcpy_chk.cpp \
+    upstream-openbsd/lib/libc/string/stpcpy.c \
     upstream-openbsd/lib/libc/string/strcat.c \
diff --git a/libc/arch-arm/krait/bionic/__strcat_chk.S b/libc/arch-arm/krait/bionic/__strcat_chk.S
index 34becdb..246f159 100644
--- a/libc/arch-arm/krait/bionic/__strcat_chk.S
+++ b/libc/arch-arm/krait/bionic/__strcat_chk.S
@@ -40,12 +40,10 @@
 ENTRY(__strcat_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
     push    {r4, r5}
-    .save   {r4, r5}
     .cfi_adjust_cfa_offset 8
     .cfi_rel_offset r4, 0
     .cfi_rel_offset r5, 4
@@ -194,8 +192,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcat_chk_failed)
-    .save   {r0, lr}
-    .save   {r4, r5}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/krait/bionic/__strcpy_chk.S b/libc/arch-arm/krait/bionic/__strcpy_chk.S
index c3e3e14..db76686 100644
--- a/libc/arch-arm/krait/bionic/__strcpy_chk.S
+++ b/libc/arch-arm/krait/bionic/__strcpy_chk.S
@@ -39,7 +39,6 @@
 ENTRY(__strcpy_chk)
     pld     [r0, #0]
     push    {r0, lr}
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
@@ -161,7 +160,6 @@
 #include "memcpy_base.S"
 
 ENTRY_PRIVATE(__strcpy_chk_failed)
-    .save   {r0, lr}
     .cfi_def_cfa_offset 8
     .cfi_rel_offset r0, 0
     .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/krait/bionic/memcpy.S b/libc/arch-arm/krait/bionic/memcpy.S
index 0b7b276..9ff46a8 100644
--- a/libc/arch-arm/krait/bionic/memcpy.S
+++ b/libc/arch-arm/krait/bionic/memcpy.S
@@ -53,7 +53,6 @@
 ENTRY(memcpy)
         pld     [r1, #64]
         stmfd   sp!, {r0, lr}
-        .save   {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
@@ -66,7 +65,6 @@
 ENTRY_PRIVATE(__memcpy_chk_fail)
         // Preserve lr for backtrace.
         push    {lr}
-        .save   {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
 
diff --git a/libc/arch-arm/krait/bionic/memcpy_base.S b/libc/arch-arm/krait/bionic/memcpy_base.S
index 99fc255..035dcf1 100644
--- a/libc/arch-arm/krait/bionic/memcpy_base.S
+++ b/libc/arch-arm/krait/bionic/memcpy_base.S
@@ -36,7 +36,6 @@
 // Assumes neon instructions and a cache line size of 32 bytes.
 
 ENTRY_PRIVATE(MEMCPY_BASE)
-        .save {r0, lr}
         .cfi_def_cfa_offset 8
         .cfi_rel_offset r0, 0
         .cfi_rel_offset lr, 4
diff --git a/libc/arch-arm/krait/bionic/memset.S b/libc/arch-arm/krait/bionic/memset.S
index 5d1943b..e9f6431 100644
--- a/libc/arch-arm/krait/bionic/memset.S
+++ b/libc/arch-arm/krait/bionic/memset.S
@@ -43,7 +43,6 @@
         bls         .L_done
 
         // Preserve lr for backtrace.
-        .save       {lr}
         push        {lr}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset lr, 0
@@ -69,7 +68,6 @@
 
 /* memset() returns its first argument.  */
 ENTRY(memset)
-        .save       {r0}
         stmfd       sp!, {r0}
         .cfi_def_cfa_offset 4
         .cfi_rel_offset r0, 0
diff --git a/libc/arch-arm/krait/bionic/strcmp.S b/libc/arch-arm/krait/bionic/strcmp.S
index eacb82a..9121c01 100644
--- a/libc/arch-arm/krait/bionic/strcmp.S
+++ b/libc/arch-arm/krait/bionic/strcmp.S
@@ -168,7 +168,6 @@
         bne     .L_do_align
 
         /* Fast path.  */
-        .save   {r4-r7}
         init
 
 .L_doubleword_aligned:
diff --git a/libc/arch-arm/krait/krait.mk b/libc/arch-arm/krait/krait.mk
index 631ab68..1bb7b0a 100644
--- a/libc/arch-arm/krait/krait.mk
+++ b/libc/arch-arm/krait/krait.mk
@@ -7,6 +7,7 @@
 
 # Use cortex-a15 versions of strcat/strcpy/strlen and standard memmove
 libc_bionic_src_files_arm += \
+    arch-arm/cortex-a15/bionic/stpcpy.S \
     arch-arm/cortex-a15/bionic/strcat.S \
     arch-arm/cortex-a15/bionic/strcpy.S \
     arch-arm/cortex-a15/bionic/strlen.S \
diff --git a/libc/arch-arm64/arm64.mk b/libc/arch-arm64/arm64.mk
index 6c4f6a6..bb6ca63 100644
--- a/libc/arch-arm64/arm64.mk
+++ b/libc/arch-arm64/arm64.mk
@@ -1,8 +1,17 @@
-# arm64 specific configs
+# 64-bit arm.
 
-libc_common_src_files_arm64 := \
+#
+# Default implementations of functions that are commonly optimized.
+#
+
+libc_bionic_src_files_arm64 += \
+    bionic/__memset_chk.cpp \
+    bionic/__strcpy_chk.cpp \
+    bionic/__strcat_chk.cpp \
     bionic/memrchr.c \
     bionic/strrchr.cpp \
+
+libc_freebsd_src_files_arm64 += \
     upstream-freebsd/lib/libc/string/wcscat.c \
     upstream-freebsd/lib/libc/string/wcschr.c \
     upstream-freebsd/lib/libc/string/wcscmp.c \
@@ -10,6 +19,8 @@
     upstream-freebsd/lib/libc/string/wcslen.c \
     upstream-freebsd/lib/libc/string/wcsrchr.c \
     upstream-freebsd/lib/libc/string/wmemcmp.c \
+
+libc_openbsd_src_files_arm64 += \
     upstream-openbsd/lib/libc/string/stpncpy.c \
     upstream-openbsd/lib/libc/string/strcat.c \
     upstream-openbsd/lib/libc/string/strlcat.c \
@@ -17,19 +28,13 @@
     upstream-openbsd/lib/libc/string/strncat.c \
     upstream-openbsd/lib/libc/string/strncpy.c \
 
-# Fortify implementations of libc functions.
-libc_common_src_files_arm64 += \
-    bionic/__memcpy_chk.cpp \
-    bionic/__memset_chk.cpp \
-    bionic/__strcpy_chk.cpp \
-    bionic/__strcat_chk.cpp \
+#
+# Inherently architecture-specific code.
+#
 
-##########################################
-### CPU specific source files
-libc_bionic_src_files_arm64 := \
+libc_bionic_src_files_arm64 += \
     arch-arm64/bionic/__bionic_clone.S \
     arch-arm64/bionic/_exit_with_stack_teardown.S \
-    arch-arm64/bionic/__rt_sigreturn.S \
     arch-arm64/bionic/_setjmp.S \
     arch-arm64/bionic/setjmp.S \
     arch-arm64/bionic/__set_tls.c \
@@ -53,7 +58,7 @@
 endif
 cpu_variant_mk := $(LOCAL_PATH)/arch-arm64/$(TARGET_CPU_VARIANT)/$(TARGET_CPU_VARIANT).mk
 ifeq ($(wildcard $(cpu_variant_mk)),)
-$(error "TARGET_CPU_VARIANT not set or set to an unknown value. Possible values are generic, generic-neon, denver64. Use generic for devices that do not have a CPU similar to any of the supported cpu variants.")
+$(error "TARGET_CPU_VARIANT not set or set to an unknown value. Possible values are generic, denver64. Use generic for devices that do not have a CPU similar to any of the supported cpu variants.")
 endif
 include $(cpu_variant_mk)
 libc_common_additional_dependencies += $(cpu_variank_mk)
diff --git a/libc/arch-arm64/denver64/bionic/memcpy.S b/libc/arch-arm64/denver64/bionic/memcpy.S
index 700f0d0..85129fe 100644
--- a/libc/arch-arm64/denver64/bionic/memcpy.S
+++ b/libc/arch-arm64/denver64/bionic/memcpy.S
@@ -1,205 +1,63 @@
-/* Copyright (c) 2012, Linaro Limited
-   All rights reserved.
-   Copyright (c) 2014, NVIDIA Corporation.  All rights reserved.
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions are met:
-       * Redistributions of source code must retain the above copyright
-         notice, this list of conditions and the following disclaimer.
-       * Redistributions in binary form must reproduce the above copyright
-         notice, this list of conditions and the following disclaimer in the
-         documentation and/or other materials provided with the distribution.
-       * Neither the name of the Linaro nor the
-         names of its contributors may be used to endorse or promote products
-         derived from this software without specific prior written permission.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-   HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-/* Assumptions:
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ * All rights reserved.
  *
- * denver, ARMv8-a, AArch64
- * Unaligned accesses
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
  *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
+// Prototype: void *memcpy (void *dst, const void *src, size_t count).
+
 #include <private/bionic_asm.h>
+#include <private/libc_events.h>
 
-#define dstin	x0
-#define src	x1
-#define count	x2
-#define tmp1	x3
-#define tmp1w	w3
-#define tmp2	x4
-#define tmp2w	w4
-#define tmp3	x5
-#define tmp3w	w5
-#define dst	x6
+ENTRY(__memcpy_chk)
+  cmp   x2, x3
+  b.hi  __memcpy_chk_fail
 
-#define A_l	x7
-#define A_h	x8
-#define B_l	x9
-#define B_h	x10
-#define C_l	x11
-#define C_h	x12
-#define D_l	x13
-#define D_h	x14
-
-#define QA_l	q0
-#define QA_h	q1
-#define QB_l	q2
-#define QB_h	q3
+  // Fall through to memcpy...
+END(__memcpy_chk)
 
 ENTRY(memcpy)
-
-	mov	dst, dstin
-	cmp	count, #64
-	b.ge	.Lcpy_not_short
-	cmp	count, #15
-	b.le	.Ltail15tiny
-
-	/* Deal with small copies quickly by dropping straight into the
-	 * exit block.  */
-.Ltail63:
-	/* Copy up to 48 bytes of data.  At this point we only need the
-	 * bottom 6 bits of count to be accurate.  */
-	ands	tmp1, count, #0x30
-	b.eq	.Ltail15
-	add	dst, dst, tmp1
-	add	src, src, tmp1
-	cmp	tmp1w, #0x20
-	b.eq	1f
-	b.lt	2f
-	ldp	A_l, A_h, [src, #-48]
-	stp	A_l, A_h, [dst, #-48]
-1:
-	ldp	A_l, A_h, [src, #-32]
-	stp	A_l, A_h, [dst, #-32]
-2:
-	ldp	A_l, A_h, [src, #-16]
-	stp	A_l, A_h, [dst, #-16]
-
-.Ltail15:
-	ands	count, count, #15
-	beq	1f
-	add	src, src, count
-	ldp	A_l, A_h, [src, #-16]
-	add	dst, dst, count
-	stp	A_l, A_h, [dst, #-16]
-1:
-	ret
-
-.Ltail15tiny:
-	/* Copy up to 15 bytes of data.  Does not assume additional data
-	   being copied.  */
-	tbz	count, #3, 1f
-	ldr	tmp1, [src], #8
-	str	tmp1, [dst], #8
-1:
-	tbz	count, #2, 1f
-	ldr	tmp1w, [src], #4
-	str	tmp1w, [dst], #4
-1:
-	tbz	count, #1, 1f
-	ldrh	tmp1w, [src], #2
-	strh	tmp1w, [dst], #2
-1:
-	tbz	count, #0, 1f
-	ldrb	tmp1w, [src]
-	strb	tmp1w, [dst]
-1:
-	ret
-
-.Lcpy_not_short:
-	/* We don't much care about the alignment of DST, but we want SRC
-	 * to be 128-bit (16 byte) aligned so that we don't cross cache line
-	 * boundaries on both loads and stores.  */
-	neg	tmp2, src
-	ands	tmp2, tmp2, #15		/* Bytes to reach alignment.  */
-	b.eq	2f
-	sub	count, count, tmp2
-	/* Copy more data than needed; it's faster than jumping
-	 * around copying sub-Quadword quantities.  We know that
-	 * it can't overrun.  */
-	ldp	A_l, A_h, [src]
-	add	src, src, tmp2
-	stp	A_l, A_h, [dst]
-	add	dst, dst, tmp2
-	/* There may be less than 63 bytes to go now.  */
-	cmp	count, #63
-	b.le	.Ltail63
-2:
-	subs	count, count, #128
-	b.ge	.Lcpy_body_large
-	/* Less than 128 bytes to copy, so handle 64 here and then jump
-	 * to the tail.  */
-	ldp	QA_l, QA_h, [src]
-	ldp	QB_l, QB_h, [src, #32]
-	stp	QA_l, QA_h, [dst]
-	stp	QB_l, QB_h, [dst, #32]
-	tst	count, #0x3f
-	add	src, src, #64
-	add	dst, dst, #64
-	b.ne	.Ltail63
-	ret
-
-	/* Critical loop.  Start at a new cache line boundary.  Assuming
-	 * 64 bytes per line this ensures the entire loop is in one line.  */
-	.p2align 6
-.Lcpy_body_large:
-	cmp	count, 65536
-	bhi	.Lcpy_body_huge
-	/* There are at least 128 bytes to copy.  */
-	ldp	QA_l, QA_h, [src, #0]
-	sub	dst, dst, #32		/* Pre-bias.  */
-	ldp	QB_l, QB_h, [src, #32]!	/* src += 64 - Pre-bias.  */
-1:
-	stp	QA_l, QA_h, [dst, #32]
-	ldp	QA_l, QA_h, [src, #32]
-	stp	QB_l, QB_h, [dst, #64]!
-	ldp	QB_l, QB_h, [src, #64]!
-
-	subs	count, count, #64
-	b.ge	1b
-
-	stp	QA_l, QA_h, [dst, #32]
-	stp	QB_l, QB_h, [dst, #64]
-	add	src, src, #32
-	add	dst, dst, #64 + 32
-	tst	count, #0x3f
-	b.ne	.Ltail63
-	ret
-.Lcpy_body_huge:
-	/* There are at least 128 bytes to copy.  */
-	ldp	QA_l, QA_h, [src, #0]
-	sub	dst, dst, #32		/* Pre-bias.  */
-	ldp	QB_l, QB_h, [src, #32]!
-1:
-	stnp	QA_l, QA_h, [dst, #32]
-	stnp	QB_l, QB_h, [dst, #64]
-	ldp	QA_l, QA_h, [src, #32]
-	ldp	QB_l, QB_h, [src, #64]!
-	add	dst, dst, #64
-
-	subs	count, count, #64
-	b.ge	1b
-
-	stnp	QA_l, QA_h, [dst, #32]
-	stnp	QB_l, QB_h, [dst, #64]
-	add	src, src, #32
-	add	dst, dst, #64 + 32
-	tst	count, #0x3f
-	b.ne	.Ltail63
-	ret
-
+  #include "memcpy_base.S"
 END(memcpy)
+
+ENTRY_PRIVATE(__memcpy_chk_fail)
+  // Preserve for accurate backtrace.
+  stp  x29, x30, [sp, -16]!
+  .cfi_def_cfa_offset 16
+  .cfi_rel_offset x29, 0
+  .cfi_rel_offset x30, 8
+
+  adrp  x0, error_string
+  add   x0, x0, :lo12:error_string
+  ldr   x1, error_code
+  bl    __fortify_chk_fail
+error_code:
+  .word   BIONIC_EVENT_MEMCPY_BUFFER_OVERFLOW
+END(__memcpy_chk_fail)
+
+  .data
+  .align 2
+error_string:
+  .string "memcpy: prevented write past end of buffer"
diff --git a/libc/arch-arm64/generic-neon/bionic/memcpy.S b/libc/arch-arm64/denver64/bionic/memcpy_base.S
similarity index 79%
copy from libc/arch-arm64/generic-neon/bionic/memcpy.S
copy to libc/arch-arm64/denver64/bionic/memcpy_base.S
index 320f748..3d7e9dd 100644
--- a/libc/arch-arm64/generic-neon/bionic/memcpy.S
+++ b/libc/arch-arm64/denver64/bionic/memcpy_base.S
@@ -1,5 +1,6 @@
 /* Copyright (c) 2012, Linaro Limited
    All rights reserved.
+   Copyright (c) 2014, NVIDIA Corporation.  All rights reserved.
 
    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:
@@ -27,13 +28,11 @@
 
 /* Assumptions:
  *
- * ARMv8-a, AArch64
+ * denver, ARMv8-a, AArch64
  * Unaligned accesses
  *
  */
 
-#include <private/bionic_asm.h>
-
 #define dstin	x0
 #define src	x1
 #define count	x2
@@ -54,12 +53,10 @@
 #define D_l	x13
 #define D_h	x14
 
-#define QA_l q0
-#define QA_h q1
-#define QB_l q2
-#define QB_h q3
-
-ENTRY(memcpy)
+#define QA_l	q0
+#define QA_h	q1
+#define QB_l	q2
+#define QB_h	q3
 
 	mov	dst, dstin
 	cmp	count, #64
@@ -142,10 +139,10 @@
 	b.ge	.Lcpy_body_large
 	/* Less than 128 bytes to copy, so handle 64 here and then jump
 	 * to the tail.  */
-	ldp QA_l, QA_h, [src]
-	ldp QB_l, QB_h, [src, #32]
-	stp QA_l, QA_h, [dst]
-	stp QB_l, QB_h, [dst, #32]
+	ldp	QA_l, QA_h, [src]
+	ldp	QB_l, QB_h, [src, #32]
+	stp	QA_l, QA_h, [dst]
+	stp	QB_l, QB_h, [dst, #32]
 	tst	count, #0x3f
 	add	src, src, #64
 	add	dst, dst, #64
@@ -156,24 +153,47 @@
 	 * 64 bytes per line this ensures the entire loop is in one line.  */
 	.p2align 6
 .Lcpy_body_large:
+	cmp	count, 65536
+	bhi	.Lcpy_body_huge
 	/* There are at least 128 bytes to copy.  */
-	ldp QA_l, QA_h, [src, #0]
+	ldp	QA_l, QA_h, [src, #0]
 	sub	dst, dst, #32		/* Pre-bias.  */
-	ldp QB_l, QB_h, [src, #32]!	/* src += 64 - Pre-bias.  */
+	ldp	QB_l, QB_h, [src, #32]!	/* src += 64 - Pre-bias.  */
 1:
-	stp QA_l, QA_h, [dst, #32]
-	ldp QA_l, QA_h, [src, #32]
-	stp QB_l, QB_h, [dst, #64]!
-	ldp QB_l, QB_h, [src, #64]!
+	stp	QA_l, QA_h, [dst, #32]
+	ldp	QA_l, QA_h, [src, #32]
+	stp	QB_l, QB_h, [dst, #64]!
+	ldp	QB_l, QB_h, [src, #64]!
 
 	subs	count, count, #64
 	b.ge	1b
 
-	stp QA_l, QA_h, [dst, #32]
-	stp QB_l, QB_h, [dst, #64]
+	stp	QA_l, QA_h, [dst, #32]
+	stp	QB_l, QB_h, [dst, #64]
 	add	src, src, #32
 	add	dst, dst, #64 + 32
 	tst	count, #0x3f
 	b.ne	.Ltail63
 	ret
-END(memcpy)
+.Lcpy_body_huge:
+	/* There are at least 128 bytes to copy.  */
+	ldp	QA_l, QA_h, [src, #0]
+	sub	dst, dst, #32		/* Pre-bias.  */
+	ldp	QB_l, QB_h, [src, #32]!
+1:
+	stnp	QA_l, QA_h, [dst, #32]
+	stnp	QB_l, QB_h, [dst, #64]
+	ldp	QA_l, QA_h, [src, #32]
+	ldp	QB_l, QB_h, [src, #64]!
+	add	dst, dst, #64
+
+	subs	count, count, #64
+	b.ge	1b
+
+	stnp	QA_l, QA_h, [dst, #32]
+	stnp	QB_l, QB_h, [dst, #64]
+	add	src, src, #32
+	add	dst, dst, #64 + 32
+	tst	count, #0x3f
+	b.ne	.Ltail63
+	ret
diff --git a/libc/arch-arm64/generic-neon/generic-neon.mk b/libc/arch-arm64/generic-neon/generic-neon.mk
deleted file mode 100644
index 77e3861..0000000
--- a/libc/arch-arm64/generic-neon/generic-neon.mk
+++ /dev/null
@@ -1,13 +0,0 @@
-libc_bionic_src_files_arm64 += \
-    arch-arm64/generic/bionic/memchr.S \
-    arch-arm64/generic/bionic/memcmp.S \
-    arch-arm64/generic/bionic/memmove.S \
-    arch-arm64/generic/bionic/memset.S \
-    arch-arm64/generic/bionic/stpcpy.S \
-    arch-arm64/generic/bionic/strchr.S \
-    arch-arm64/generic/bionic/strcmp.S \
-    arch-arm64/generic/bionic/strcpy.S \
-    arch-arm64/generic/bionic/strlen.S \
-    arch-arm64/generic/bionic/strncmp.S \
-    arch-arm64/generic/bionic/strnlen.S \
-    arch-arm64/generic-neon/bionic/memcpy.S \
diff --git a/libc/arch-arm64/generic/bionic/memcpy.S b/libc/arch-arm64/generic/bionic/memcpy.S
index e1b1a72..85129fe 100644
--- a/libc/arch-arm64/generic/bionic/memcpy.S
+++ b/libc/arch-arm64/generic/bionic/memcpy.S
@@ -1,184 +1,63 @@
-/* Copyright (c) 2012, Linaro Limited
-   All rights reserved.
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions are met:
-       * Redistributions of source code must retain the above copyright
-         notice, this list of conditions and the following disclaimer.
-       * Redistributions in binary form must reproduce the above copyright
-         notice, this list of conditions and the following disclaimer in the
-         documentation and/or other materials provided with the distribution.
-       * Neither the name of the Linaro nor the
-         names of its contributors may be used to endorse or promote products
-         derived from this software without specific prior written permission.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-   HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-/* Assumptions:
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ * All rights reserved.
  *
- * ARMv8-a, AArch64
- * Unaligned accesses
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
  *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
+// Prototype: void *memcpy (void *dst, const void *src, size_t count).
+
 #include <private/bionic_asm.h>
+#include <private/libc_events.h>
 
-#define dstin	x0
-#define src	x1
-#define count	x2
-#define tmp1	x3
-#define tmp1w	w3
-#define tmp2	x4
-#define tmp2w	w4
-#define tmp3	x5
-#define tmp3w	w5
-#define dst	x6
+ENTRY(__memcpy_chk)
+  cmp   x2, x3
+  b.hi  __memcpy_chk_fail
 
-#define A_l	x7
-#define A_h	x8
-#define B_l	x9
-#define B_h	x10
-#define C_l	x11
-#define C_h	x12
-#define D_l	x13
-#define D_h	x14
+  // Fall through to memcpy...
+END(__memcpy_chk)
 
 ENTRY(memcpy)
-
-	mov	dst, dstin
-	cmp	count, #64
-	b.ge	.Lcpy_not_short
-	cmp	count, #15
-	b.le	.Ltail15tiny
-
-	/* Deal with small copies quickly by dropping straight into the
-	 * exit block.  */
-.Ltail63:
-	/* Copy up to 48 bytes of data.  At this point we only need the
-	 * bottom 6 bits of count to be accurate.  */
-	ands	tmp1, count, #0x30
-	b.eq	.Ltail15
-	add	dst, dst, tmp1
-	add	src, src, tmp1
-	cmp	tmp1w, #0x20
-	b.eq	1f
-	b.lt	2f
-	ldp	A_l, A_h, [src, #-48]
-	stp	A_l, A_h, [dst, #-48]
-1:
-	ldp	A_l, A_h, [src, #-32]
-	stp	A_l, A_h, [dst, #-32]
-2:
-	ldp	A_l, A_h, [src, #-16]
-	stp	A_l, A_h, [dst, #-16]
-
-.Ltail15:
-	ands	count, count, #15
-	beq	1f
-	add	src, src, count
-	ldp	A_l, A_h, [src, #-16]
-	add	dst, dst, count
-	stp	A_l, A_h, [dst, #-16]
-1:
-	ret
-
-.Ltail15tiny:
-	/* Copy up to 15 bytes of data.  Does not assume additional data
-	   being copied.  */
-	tbz	count, #3, 1f
-	ldr	tmp1, [src], #8
-	str	tmp1, [dst], #8
-1:
-	tbz	count, #2, 1f
-	ldr	tmp1w, [src], #4
-	str	tmp1w, [dst], #4
-1:
-	tbz	count, #1, 1f
-	ldrh	tmp1w, [src], #2
-	strh	tmp1w, [dst], #2
-1:
-	tbz	count, #0, 1f
-	ldrb	tmp1w, [src]
-	strb	tmp1w, [dst]
-1:
-	ret
-
-.Lcpy_not_short:
-	/* We don't much care about the alignment of DST, but we want SRC
-	 * to be 128-bit (16 byte) aligned so that we don't cross cache line
-	 * boundaries on both loads and stores.  */
-	neg	tmp2, src
-	ands	tmp2, tmp2, #15		/* Bytes to reach alignment.  */
-	b.eq	2f
-	sub	count, count, tmp2
-	/* Copy more data than needed; it's faster than jumping
-	 * around copying sub-Quadword quantities.  We know that
-	 * it can't overrun.  */
-	ldp	A_l, A_h, [src]
-	add	src, src, tmp2
-	stp	A_l, A_h, [dst]
-	add	dst, dst, tmp2
-	/* There may be less than 63 bytes to go now.  */
-	cmp	count, #63
-	b.le	.Ltail63
-2:
-	subs	count, count, #128
-	b.ge	.Lcpy_body_large
-	/* Less than 128 bytes to copy, so handle 64 here and then jump
-	 * to the tail.  */
-	ldp	A_l, A_h, [src]
-	ldp	B_l, B_h, [src, #16]
-	ldp	C_l, C_h, [src, #32]
-	ldp	D_l, D_h, [src, #48]
-	stp	A_l, A_h, [dst]
-	stp	B_l, B_h, [dst, #16]
-	stp	C_l, C_h, [dst, #32]
-	stp	D_l, D_h, [dst, #48]
-	tst	count, #0x3f
-	add	src, src, #64
-	add	dst, dst, #64
-	b.ne	.Ltail63
-	ret
-
-	/* Critical loop.  Start at a new cache line boundary.  Assuming
-	 * 64 bytes per line this ensures the entire loop is in one line.  */
-	.p2align 6
-.Lcpy_body_large:
-	/* There are at least 128 bytes to copy.  */
-	ldp	A_l, A_h, [src, #0]
-	sub	dst, dst, #16		/* Pre-bias.  */
-	ldp	B_l, B_h, [src, #16]
-	ldp	C_l, C_h, [src, #32]
-	ldp	D_l, D_h, [src, #48]!	/* src += 64 - Pre-bias.  */
-1:
-	stp	A_l, A_h, [dst, #16]
-	ldp	A_l, A_h, [src, #16]
-	stp	B_l, B_h, [dst, #32]
-	ldp	B_l, B_h, [src, #32]
-	stp	C_l, C_h, [dst, #48]
-	ldp	C_l, C_h, [src, #48]
-	stp	D_l, D_h, [dst, #64]!
-	ldp	D_l, D_h, [src, #64]!
-	subs	count, count, #64
-	b.ge	1b
-	stp	A_l, A_h, [dst, #16]
-	stp	B_l, B_h, [dst, #32]
-	stp	C_l, C_h, [dst, #48]
-	stp	D_l, D_h, [dst, #64]
-	add	src, src, #16
-	add	dst, dst, #64 + 16
-	tst	count, #0x3f
-	b.ne	.Ltail63
-	ret
+  #include "memcpy_base.S"
 END(memcpy)
+
+ENTRY_PRIVATE(__memcpy_chk_fail)
+  // Preserve for accurate backtrace.
+  stp  x29, x30, [sp, -16]!
+  .cfi_def_cfa_offset 16
+  .cfi_rel_offset x29, 0
+  .cfi_rel_offset x30, 8
+
+  adrp  x0, error_string
+  add   x0, x0, :lo12:error_string
+  ldr   x1, error_code
+  bl    __fortify_chk_fail
+error_code:
+  .word   BIONIC_EVENT_MEMCPY_BUFFER_OVERFLOW
+END(__memcpy_chk_fail)
+
+  .data
+  .align 2
+error_string:
+  .string "memcpy: prevented write past end of buffer"
diff --git a/libc/arch-arm64/generic-neon/bionic/memcpy.S b/libc/arch-arm64/generic/bionic/memcpy_base.S
similarity index 84%
rename from libc/arch-arm64/generic-neon/bionic/memcpy.S
rename to libc/arch-arm64/generic/bionic/memcpy_base.S
index 320f748..c5d42ce 100644
--- a/libc/arch-arm64/generic-neon/bionic/memcpy.S
+++ b/libc/arch-arm64/generic/bionic/memcpy_base.S
@@ -32,8 +32,6 @@
  *
  */
 
-#include <private/bionic_asm.h>
-
 #define dstin	x0
 #define src	x1
 #define count	x2
@@ -54,13 +52,6 @@
 #define D_l	x13
 #define D_h	x14
 
-#define QA_l q0
-#define QA_h q1
-#define QB_l q2
-#define QB_h q3
-
-ENTRY(memcpy)
-
 	mov	dst, dstin
 	cmp	count, #64
 	b.ge	.Lcpy_not_short
@@ -142,10 +133,14 @@
 	b.ge	.Lcpy_body_large
 	/* Less than 128 bytes to copy, so handle 64 here and then jump
 	 * to the tail.  */
-	ldp QA_l, QA_h, [src]
-	ldp QB_l, QB_h, [src, #32]
-	stp QA_l, QA_h, [dst]
-	stp QB_l, QB_h, [dst, #32]
+	ldp	A_l, A_h, [src]
+	ldp	B_l, B_h, [src, #16]
+	ldp	C_l, C_h, [src, #32]
+	ldp	D_l, D_h, [src, #48]
+	stp	A_l, A_h, [dst]
+	stp	B_l, B_h, [dst, #16]
+	stp	C_l, C_h, [dst, #32]
+	stp	D_l, D_h, [dst, #48]
 	tst	count, #0x3f
 	add	src, src, #64
 	add	dst, dst, #64
@@ -157,23 +152,28 @@
 	.p2align 6
 .Lcpy_body_large:
 	/* There are at least 128 bytes to copy.  */
-	ldp QA_l, QA_h, [src, #0]
-	sub	dst, dst, #32		/* Pre-bias.  */
-	ldp QB_l, QB_h, [src, #32]!	/* src += 64 - Pre-bias.  */
+	ldp	A_l, A_h, [src, #0]
+	sub	dst, dst, #16		/* Pre-bias.  */
+	ldp	B_l, B_h, [src, #16]
+	ldp	C_l, C_h, [src, #32]
+	ldp	D_l, D_h, [src, #48]!	/* src += 64 - Pre-bias.  */
 1:
-	stp QA_l, QA_h, [dst, #32]
-	ldp QA_l, QA_h, [src, #32]
-	stp QB_l, QB_h, [dst, #64]!
-	ldp QB_l, QB_h, [src, #64]!
-
+	stp	A_l, A_h, [dst, #16]
+	ldp	A_l, A_h, [src, #16]
+	stp	B_l, B_h, [dst, #32]
+	ldp	B_l, B_h, [src, #32]
+	stp	C_l, C_h, [dst, #48]
+	ldp	C_l, C_h, [src, #48]
+	stp	D_l, D_h, [dst, #64]!
+	ldp	D_l, D_h, [src, #64]!
 	subs	count, count, #64
 	b.ge	1b
-
-	stp QA_l, QA_h, [dst, #32]
-	stp QB_l, QB_h, [dst, #64]
-	add	src, src, #32
-	add	dst, dst, #64 + 32
+	stp	A_l, A_h, [dst, #16]
+	stp	B_l, B_h, [dst, #32]
+	stp	C_l, C_h, [dst, #48]
+	stp	D_l, D_h, [dst, #64]
+	add	src, src, #16
+	add	dst, dst, #64 + 16
 	tst	count, #0x3f
 	b.ne	.Ltail63
 	ret
-END(memcpy)
diff --git a/libc/arch-arm64/include/machine/elf_machdep.h b/libc/arch-arm64/include/machine/elf_machdep.h
index 2bf8189..6eab313 100644
--- a/libc/arch-arm64/include/machine/elf_machdep.h
+++ b/libc/arch-arm64/include/machine/elf_machdep.h
@@ -99,6 +99,7 @@
 #define R_AARCH64_RELATIVE              1027    /* Adjust by program base.  */
 #define R_AARCH64_TLS_TPREL64           1030
 #define R_AARCH64_TLS_DTPREL32          1031
+#define R_AARCH64_IRELATIVE             1032
 
 #define R_TYPE(name)        __CONCAT(R_AARCH64_,name)
 
diff --git a/libc/arch-mips/mips.mk b/libc/arch-mips/mips.mk
index 31a1f32..ac75a4b 100644
--- a/libc/arch-mips/mips.mk
+++ b/libc/arch-mips/mips.mk
@@ -1,17 +1,32 @@
-# mips specific configs
+# 32-bit mips.
 
-# These are shared by all the 32-bit targets, but not the 64-bit ones.
-libc_common_src_files_mips := \
+#
+# Various kinds of LP32 cruft.
+#
+
+libc_bionic_src_files_mips += \
+    bionic/mmap.cpp \
+
+libc_common_src_files_mips += \
     bionic/legacy_32_bit_support.cpp \
     bionic/ndk_cruft.cpp \
     bionic/time64.c \
+
+libc_netbsd_src_files_mips += \
+    upstream-netbsd/common/lib/libc/hash/sha1/sha1.c \
+
+libc_openbsd_src_files_mips += \
     upstream-openbsd/lib/libc/stdio/putw.c \
 
-# These are shared by all the 32-bit targets, but not the 64-bit ones.
-libc_bionic_src_files_mips += \
-     bionic/mmap.cpp
+#
+# Default implementations of functions that are commonly optimized.
+#
 
-libc_common_src_files_mips += \
+libc_bionic_src_files_mips += \
+    bionic/__memcpy_chk.cpp \
+    bionic/__memset_chk.cpp \
+    bionic/__strcpy_chk.cpp \
+    bionic/__strcat_chk.cpp \
     bionic/memchr.c \
     bionic/memcmp.c \
     bionic/memmove.c \
@@ -19,6 +34,8 @@
     bionic/strchr.cpp \
     bionic/strnlen.c \
     bionic/strrchr.cpp \
+
+libc_freebsd_src_files_mips += \
     upstream-freebsd/lib/libc/string/wcscat.c \
     upstream-freebsd/lib/libc/string/wcschr.c \
     upstream-freebsd/lib/libc/string/wcscmp.c \
@@ -27,6 +44,8 @@
     upstream-freebsd/lib/libc/string/wcsrchr.c \
     upstream-freebsd/lib/libc/string/wmemcmp.c \
     upstream-freebsd/lib/libc/string/wmemmove.c \
+
+libc_openbsd_src_files_mips += \
     upstream-openbsd/lib/libc/string/bcopy.c \
     upstream-openbsd/lib/libc/string/stpcpy.c \
     upstream-openbsd/lib/libc/string/stpncpy.c \
@@ -39,16 +58,10 @@
     upstream-openbsd/lib/libc/string/strncmp.c \
     upstream-openbsd/lib/libc/string/strncpy.c \
 
-# Fortify implementations of libc functions.
-libc_common_src_files_mips += \
-    bionic/__memcpy_chk.cpp \
-    bionic/__memset_chk.cpp \
-    bionic/__strcpy_chk.cpp \
-    bionic/__strcat_chk.cpp \
+#
+# Inherently architecture-specific code.
+#
 
-
-##########################################
-### CPU specific source files
 libc_bionic_src_files_mips += \
     arch-mips/bionic/__bionic_clone.S \
     arch-mips/bionic/bzero.S \
@@ -69,13 +82,12 @@
 else
 libc_bionic_src_files_mips += \
     bionic/memcpy.cpp \
-    bionic/memset.c
-libc_common_src_files_mips += \
-    upstream-openbsd/lib/libc/string/strlen.c
-endif
+    bionic/memset.c \
 
-libc_netbsd_src_files_mips := \
-    upstream-netbsd/common/lib/libc/hash/sha1/sha1.c \
+libc_openbsd_src_files_mips += \
+    upstream-openbsd/lib/libc/string/strlen.c \
+
+endif
 
 libc_crt_target_cflags_mips := \
     $($(my_2nd_arch_prefix)TARGET_GLOBAL_CFLAGS) \
diff --git a/libc/arch-mips64/mips64.mk b/libc/arch-mips64/mips64.mk
index 230cb26..0d4b727 100644
--- a/libc/arch-mips64/mips64.mk
+++ b/libc/arch-mips64/mips64.mk
@@ -1,13 +1,25 @@
-# mips64 specific configs
+# 64-bit mips.
 
-libc_common_src_files_mips64 := \
+#
+# Default implementations of functions that are commonly optimized.
+#
+
+libc_bionic_src_files_mips64 += \
+    bionic/__memcpy_chk.cpp \
+    bionic/__memset_chk.cpp \
+    bionic/__strcpy_chk.cpp \
+    bionic/__strcat_chk.cpp \
     bionic/memchr.c \
     bionic/memcmp.c \
+    bionic/memcpy.cpp \
     bionic/memmove.c \
     bionic/memrchr.c \
+    bionic/memset.c \
     bionic/strchr.cpp \
     bionic/strnlen.c \
     bionic/strrchr.cpp \
+
+libc_freebsd_src_files_mips64 += \
     upstream-freebsd/lib/libc/string/wcscat.c \
     upstream-freebsd/lib/libc/string/wcschr.c \
     upstream-freebsd/lib/libc/string/wcscmp.c \
@@ -16,6 +28,8 @@
     upstream-freebsd/lib/libc/string/wcsrchr.c \
     upstream-freebsd/lib/libc/string/wmemcmp.c \
     upstream-freebsd/lib/libc/string/wmemmove.c \
+
+libc_openbsd_src_files_mips64 += \
     upstream-openbsd/lib/libc/string/stpcpy.c \
     upstream-openbsd/lib/libc/string/stpncpy.c \
     upstream-openbsd/lib/libc/string/strcat.c \
@@ -28,17 +42,11 @@
     upstream-openbsd/lib/libc/string/strncmp.c \
     upstream-openbsd/lib/libc/string/strncpy.c \
 
-# Fortify implementations of libc functions.
-libc_common_src_files_mips64 += \
-    bionic/__memcpy_chk.cpp \
-    bionic/__memset_chk.cpp \
-    bionic/__strcpy_chk.cpp \
-    bionic/__strcat_chk.cpp \
+#
+# Inherently architecture-specific code.
+#
 
-
-##########################################
-### CPU specific source files
-libc_bionic_src_files_mips64 := \
+libc_bionic_src_files_mips64 += \
     arch-mips64/bionic/__bionic_clone.S \
     arch-mips64/bionic/_exit_with_stack_teardown.S \
     arch-mips64/bionic/__get_sp.S \
@@ -48,25 +56,18 @@
     arch-mips64/bionic/syscall.S \
     arch-mips64/bionic/vfork.S \
 
-# FIXME TODO
-## libc_bionic_src_files_mips64 += arch-mips64/string/memcpy.S
-## libc_bionic_src_files_mips64 += arch-mips64/string/memset.S
-libc_bionic_src_files_mips64 += bionic/memcpy.cpp
-libc_bionic_src_files_mips64 += bionic/memset.c
-
-
 libc_crt_target_cflags_mips64 := \
     $($(my_2nd_arch_prefix)TARGET_GLOBAL_CFLAGS) \
-    -I$(LOCAL_PATH)/arch-mips64/include
+    -I$(LOCAL_PATH)/arch-mips64/include \
 
 libc_crt_target_crtbegin_file_mips64 := \
-    $(LOCAL_PATH)/arch-mips64/bionic/crtbegin.c
+    $(LOCAL_PATH)/arch-mips64/bionic/crtbegin.c \
 
 libc_crt_target_crtbegin_so_file_mips64 := \
-    $(LOCAL_PATH)/arch-common/bionic/crtbegin_so.c
+    $(LOCAL_PATH)/arch-common/bionic/crtbegin_so.c \
 
 libc_crt_target_so_cflags_mips64 := \
-    -fPIC
+    -fPIC \
 
 libc_crt_target_ldflags_mips64 := \
-    -melf64ltsmip
+    -melf64ltsmip \
diff --git a/libc/arch-x86/bionic/__restore.S b/libc/arch-x86/bionic/__restore.S
new file mode 100644
index 0000000..cb18fd0
--- /dev/null
+++ b/libc/arch-x86/bionic/__restore.S
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <private/bionic_asm.h>
+
+// DWARF constants.
+#define DW_CFA_def_cfa_expression 0x0f
+#define DW_CFA_expression 0x10
+#define DW_EH_PE_pcrel 0x10
+#define DW_EH_PE_sdata4 0x0b
+#define DW_OP_breg4 0x74
+#define DW_OP_deref 0x06
+
+// Offsets into struct sigcontext.
+#define OFFSET_EDI 16
+#define OFFSET_ESI 20
+#define OFFSET_EBP 24
+#define OFFSET_ESP 28
+#define OFFSET_EBX 32
+#define OFFSET_EDX 36
+#define OFFSET_ECX 40
+#define OFFSET_EAX 44
+#define OFFSET_EIP 56
+
+// Non-standard DWARF constants for the x86 registers.
+#define DW_x86_REG_EAX 0
+#define DW_x86_REG_ECX 1
+#define DW_x86_REG_EDX 2
+#define DW_x86_REG_EBX 3
+#define DW_x86_REG_EBP 5
+#define DW_x86_REG_ESI 6
+#define DW_x86_REG_EDI 7
+#define DW_x86_REG_EIP 8
+
+#define cfi_signal_frame_start(f) \
+.section .eh_frame,"a",@progbits; \
+.L ## f ## _START_EH_FRAME: \
+  .long 2f - 1f; /* CIE length. */ \
+1:.long 0;       /* CIE ID. */ \
+  .byte 1;       /* Version. */ \
+  .string "zRS"; /* Augmentation string. */ \
+  .uleb128 1;    /* Code alignment factor. */ \
+  .sleb128 -4;   /* Data alignment factor. */ \
+  .uleb128 DW_x86_REG_EIP;    /* Return address register. */ \
+  .uleb128 1;    /* 1 byte of augmentation data. */ \
+  .byte (DW_EH_PE_pcrel|DW_EH_PE_sdata4); /* FDE encoding. */ \
+  .align 8; \
+2: \
+  .long .L ## f ## _END_FDE - .L ## f ## _START_FDE;   /* FDE length. */ \
+.L ## f ## _START_FDE: \
+  .long .L ## f ## _START_FDE - .L ## f ## _START_EH_FRAME; /* CIE location. */ \
+  .long (.L ## f ## _START - 1) - .;                   /* pcrel start address (see FDE encoding above). */ \
+  .long .L ## f ## _END - (.L ## f ## _START - 1);     /* Function this FDE applies to. */ \
+  .uleb128 0;                                          /* FDE augmentation length. */ \
+
+#define cfi_signal_frame_end(f) \
+.L ## f ## _END_FDE: \
+
+#define cfi_def_cfa(offset) \
+  .byte DW_CFA_def_cfa_expression; \
+  .uleb128 2f-1f; \
+1:.byte DW_OP_breg4; \
+  .sleb128 offset; \
+  .byte DW_OP_deref; \
+2: \
+
+#define cfi_offset(reg_number,offset) \
+  .byte DW_CFA_expression; \
+  .uleb128 reg_number; \
+  .uleb128 2f-1f; \
+1:.byte DW_OP_breg4; \
+  .sleb128 offset; \
+2: \
+
+ENTRY_PRIVATE(__restore)
+.L__restore_START:
+  popl %eax
+  movl $__NR_sigreturn, %eax
+  int $0x80
+.L__restore_END:
+END(__restore)
+cfi_signal_frame_start(__restore)
+  cfi_def_cfa(OFFSET_ESP + 4)
+  cfi_offset(DW_x86_REG_EDI, OFFSET_EDI + 4)
+  cfi_offset(DW_x86_REG_ESI, OFFSET_ESI + 4)
+  cfi_offset(DW_x86_REG_EBP, OFFSET_EBP + 4)
+  cfi_offset(DW_x86_REG_EBX, OFFSET_EBX + 4)
+  cfi_offset(DW_x86_REG_EDX, OFFSET_EDX + 4)
+  cfi_offset(DW_x86_REG_ECX, OFFSET_ECX + 4)
+  cfi_offset(DW_x86_REG_EAX, OFFSET_EAX + 4)
+  cfi_offset(DW_x86_REG_EIP, OFFSET_EIP + 4)
+cfi_signal_frame_end(__restore)
+
+ENTRY_PRIVATE(__restore_rt)
+.L__restore_rt_START:
+  movl $__NR_rt_sigreturn, %eax
+  int $0x80
+.L__restore_rt_END:
+END(__restore_rt)
+cfi_signal_frame_start(__restore_rt)
+  cfi_def_cfa(OFFSET_ESP + 160)
+  cfi_offset(DW_x86_REG_EDI, OFFSET_EDI + 160)
+  cfi_offset(DW_x86_REG_ESI, OFFSET_ESI + 160)
+  cfi_offset(DW_x86_REG_EBP, OFFSET_EBP + 160)
+  cfi_offset(DW_x86_REG_EBX, OFFSET_EBX + 160)
+  cfi_offset(DW_x86_REG_EDX, OFFSET_EDX + 160)
+  cfi_offset(DW_x86_REG_ECX, OFFSET_ECX + 160)
+  cfi_offset(DW_x86_REG_EAX, OFFSET_EAX + 160)
+  cfi_offset(DW_x86_REG_EIP, OFFSET_EIP + 160)
+cfi_signal_frame_end(__restore_rt)
diff --git a/libc/arch-x86/include/machine/elf_machdep.h b/libc/arch-x86/include/machine/elf_machdep.h
index 442c561..4bce933 100644
--- a/libc/arch-x86/include/machine/elf_machdep.h
+++ b/libc/arch-x86/include/machine/elf_machdep.h
@@ -59,5 +59,6 @@
 #define	R_386_TLS_GOTDESC	39
 #define	R_386_TLS_DESC_CALL	40
 #define	R_386_TLS_DESC		41
+#define	R_386_IRELATIVE		42
 
 #define	R_TYPE(name)	__CONCAT(R_386_,name)
diff --git a/libc/arch-x86/x86.mk b/libc/arch-x86/x86.mk
index 2a0609d..2c90317 100644
--- a/libc/arch-x86/x86.mk
+++ b/libc/arch-x86/x86.mk
@@ -1,31 +1,45 @@
-# x86 specific configs
+# 32-bit x86.
 
-# These are shared by all the 32-bit targets, but not the 64-bit ones.
-libc_common_src_files_x86 := \
+#
+# Various kinds of LP32 cruft.
+#
+
+libc_bionic_src_files_x86 += \
+    bionic/mmap.cpp \
+
+libc_common_src_files_x86 += \
     bionic/legacy_32_bit_support.cpp \
     bionic/ndk_cruft.cpp \
     bionic/time64.c \
+
+libc_netbsd_src_files_x86 += \
+    upstream-netbsd/common/lib/libc/hash/sha1/sha1.c \
+
+libc_openbsd_src_files_x86 += \
     upstream-openbsd/lib/libc/stdio/putw.c \
 
-# Fortify implementations of libc functions.
+#
+# Default implementations of functions that are commonly optimized.
+#
+
 libc_common_src_files_x86 += \
     bionic/__memcpy_chk.cpp \
     bionic/__memset_chk.cpp \
     bionic/__strcpy_chk.cpp \
     bionic/__strcat_chk.cpp \
+
+libc_freebsd_src_files_x86 += \
     upstream-freebsd/lib/libc/string/wmemmove.c \
 
+#
+# Inherently architecture-specific functions.
+#
 
-# These are shared by all the 32-bit targets, but not the 64-bit ones.
-libc_bionic_src_files_x86 := \
-    bionic/mmap.cpp
-
-##########################################
-### CPU specific source files
 libc_bionic_src_files_x86 += \
     arch-x86/bionic/__bionic_clone.S \
     arch-x86/bionic/_exit_with_stack_teardown.S \
     arch-x86/bionic/libgcc_compat.c \
+    arch-x86/bionic/__restore.S \
     arch-x86/bionic/_setjmp.S \
     arch-x86/bionic/setjmp.S \
     arch-x86/bionic/__set_tls.c \
@@ -41,9 +55,6 @@
 include $(arch_variant_mk)
 libc_common_additional_dependencies += $(arch_variant_mk)
 
-libc_netbsd_src_files_x86 := \
-    upstream-netbsd/common/lib/libc/hash/sha1/sha1.c \
-
 arch_variant_mk :=
 
 libc_crt_target_cflags_x86 := \
diff --git a/libc/arch-x86_64/bionic/__restore_rt.S b/libc/arch-x86_64/bionic/__restore_rt.S
new file mode 100644
index 0000000..785b3b3
--- /dev/null
+++ b/libc/arch-x86_64/bionic/__restore_rt.S
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <private/bionic_asm.h>
+
+// DWARF constants.
+#define DW_CFA_def_cfa_expression 0x0f
+#define DW_CFA_expression 0x10
+#define DW_EH_PE_pcrel 0x10
+#define DW_EH_PE_sdata4 0x0b
+#define DW_OP_breg4 0x74
+#define DW_OP_breg7 0x77
+#define DW_OP_deref 0x06
+
+// Offsets into struct ucontext_t of uc_mcontext.gregs[x].
+#define OFFSET_R8 40
+#define OFFSET_R9 48
+#define OFFSET_R10 56
+#define OFFSET_R11 64
+#define OFFSET_R12 72
+#define OFFSET_R13 80
+#define OFFSET_R14 88
+#define OFFSET_R15 96
+#define OFFSET_RDI 104
+#define OFFSET_RSI 112
+#define OFFSET_RBP 120
+#define OFFSET_RSP 160
+#define OFFSET_RBX 128
+#define OFFSET_RDX 136
+#define OFFSET_RAX 144
+#define OFFSET_RCX 152
+#define OFFSET_RIP 168
+
+// Non-standard DWARF constants for the x86-64 registers.
+#define DW_x86_64_RAX 0
+#define DW_x86_64_RDX 1
+#define DW_x86_64_RCX 2
+#define DW_x86_64_RBX 3
+#define DW_x86_64_RSI 4
+#define DW_x86_64_RDI 5
+#define DW_x86_64_RBP 6
+#define DW_x86_64_RSP 7
+#define DW_x86_64_R8 8
+#define DW_x86_64_R9 9
+#define DW_x86_64_R10 10
+#define DW_x86_64_R11 11
+#define DW_x86_64_R12 12
+#define DW_x86_64_R13 13
+#define DW_x86_64_R14 14
+#define DW_x86_64_R15 15
+#define DW_x86_64_RIP 16
+
+#define cfi_signal_frame_start(f) \
+.section .eh_frame,"a",@progbits; \
+.L ## f ## _START_EH_FRAME: \
+  .long 2f - 1f; /* CIE length. */ \
+1:.long 0;       /* CIE ID. */ \
+  .byte 1;       /* Version. */ \
+  .string "zRS"; /* Augmentation string. */ \
+  .uleb128 1;    /* Code alignment factor. */ \
+  .sleb128 -8;   /* Data alignment factor. */ \
+  .uleb128 DW_x86_64_RIP;   /* Return address register. */ \
+  .uleb128 1;    /* 1 byte of augmentation data. */ \
+  .byte (DW_EH_PE_pcrel | DW_EH_PE_sdata4); /* FDE encoding. */ \
+  .align 8; \
+2: \
+  .long .L ## f ## _END_FDE - .L ## f ## _START_FDE;   /* FDE length. */ \
+.L ## f ## _START_FDE: \
+  .long .L ## f ## _START_FDE - .L ## f ## _START_EH_FRAME; /* CIE location. */ \
+  .long (.L ## f ## _START - 1) - .;                   /* pcrel start address (see FDE encoding above). */ \
+  .long .L ## f ## _END - (.L ## f ## _START - 1);     /* Function this FDE applies to. */ \
+  .uleb128 0;                                          /* FDE augmentation length. */ \
+
+#define cfi_signal_frame_end(f) \
+.L ## f ## _END_FDE: \
+
+#define cfi_def_cfa(offset) \
+  .byte DW_CFA_def_cfa_expression; \
+  .uleb128 2f-1f; \
+1:.byte DW_OP_breg7; \
+  .sleb128 offset; \
+  .byte DW_OP_deref; \
+2: \
+
+#define cfi_offset(reg_number,offset) \
+  .byte DW_CFA_expression; \
+  .uleb128 reg_number; \
+  .uleb128 2f-1f; \
+1:.byte DW_OP_breg7; \
+  .sleb128 offset; \
+2: \
+
+ENTRY_PRIVATE(__restore_rt)
+.L__restore_rt_START:
+  mov $__NR_rt_sigreturn, %rax
+  syscall
+.L__restore_rt_END:
+END(__restore_rt)
+cfi_signal_frame_start(__restore_rt)
+  cfi_def_cfa(OFFSET_RSP)
+  cfi_offset(DW_x86_64_R8, OFFSET_R8)
+  cfi_offset(DW_x86_64_R9, OFFSET_R9)
+  cfi_offset(DW_x86_64_R10, OFFSET_R10)
+  cfi_offset(DW_x86_64_R11, OFFSET_R11)
+  cfi_offset(DW_x86_64_R12, OFFSET_R12)
+  cfi_offset(DW_x86_64_R13, OFFSET_R13)
+  cfi_offset(DW_x86_64_R14, OFFSET_R14)
+  cfi_offset(DW_x86_64_R15, OFFSET_R15)
+  cfi_offset(DW_x86_64_RDI, OFFSET_RDI)
+  cfi_offset(DW_x86_64_RSI, OFFSET_RSI)
+  cfi_offset(DW_x86_64_RBP, OFFSET_RBP)
+  cfi_offset(DW_x86_64_RSP, OFFSET_RSP)
+  cfi_offset(DW_x86_64_RBX, OFFSET_RBX)
+  cfi_offset(DW_x86_64_RDX, OFFSET_RDX)
+  cfi_offset(DW_x86_64_RAX, OFFSET_RAX)
+  cfi_offset(DW_x86_64_RCX, OFFSET_RCX)
+  cfi_offset(DW_x86_64_RIP, OFFSET_RIP)
+cfi_signal_frame_end(__restore_rt)
diff --git a/libc/arch-x86_64/bionic/__rt_sigreturn.S b/libc/arch-x86_64/bionic/__rt_sigreturn.S
deleted file mode 100644
index eddceb1..0000000
--- a/libc/arch-x86_64/bionic/__rt_sigreturn.S
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) 2013 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <private/bionic_asm.h>
-
-ENTRY_PRIVATE(__rt_sigreturn)
-  movl $__NR_rt_sigreturn, %eax
-  syscall
-END(__rt_sigreturn)
diff --git a/libc/arch-x86_64/include/machine/elf_machdep.h b/libc/arch-x86_64/include/machine/elf_machdep.h
index 20f8c6d..bf1f273 100644
--- a/libc/arch-x86_64/include/machine/elf_machdep.h
+++ b/libc/arch-x86_64/include/machine/elf_machdep.h
@@ -46,6 +46,8 @@
 #define R_X86_64_GOTTPOFF	22
 #define R_X86_64_TPOFF32	23
 
+#define R_X86_64_IRELATIVE	37
+
 #define	R_TYPE(name)	__CONCAT(R_X86_64_,name)
 
 #else	/*	!__i386__	*/
diff --git a/libc/arch-x86_64/x86_64.mk b/libc/arch-x86_64/x86_64.mk
index b001b5e..8675ef4 100644
--- a/libc/arch-x86_64/x86_64.mk
+++ b/libc/arch-x86_64/x86_64.mk
@@ -1,11 +1,21 @@
-# x86_64 specific configs
+# 64-bit x86.
 
-libc_common_src_files_x86_64 := \
+#
+# Default implementations of functions that are commonly optimized.
+#
+
+libc_bionic_src_files_x86_64 += \
+    bionic/__memcpy_chk.cpp \
+    bionic/__memset_chk.cpp \
+    bionic/__strcpy_chk.cpp \
+    bionic/__strcat_chk.cpp \
     bionic/memchr.c \
     bionic/memrchr.c \
     bionic/strchr.cpp \
     bionic/strnlen.c \
     bionic/strrchr.cpp \
+
+libc_freebsd_src_files_x86_64 += \
     upstream-freebsd/lib/libc/string/wcscat.c \
     upstream-freebsd/lib/libc/string/wcschr.c \
     upstream-freebsd/lib/libc/string/wcscmp.c \
@@ -14,23 +24,19 @@
     upstream-freebsd/lib/libc/string/wcsrchr.c \
     upstream-freebsd/lib/libc/string/wmemcmp.c \
     upstream-freebsd/lib/libc/string/wmemmove.c \
+
+libc_openbsd_src_files_x86_64 += \
     upstream-openbsd/lib/libc/string/strlcat.c \
     upstream-openbsd/lib/libc/string/strlcpy.c \
 
-# Fortify implementations of libc functions.
-libc_common_src_files_x86_64 += \
-    bionic/__memcpy_chk.cpp \
-    bionic/__memset_chk.cpp \
-    bionic/__strcpy_chk.cpp \
-    bionic/__strcat_chk.cpp \
+#
+# Inherently architecture-specific code.
+#
 
-
-##########################################
-### CPU specific source files
-libc_bionic_src_files_x86_64 := \
+libc_bionic_src_files_x86_64 += \
     arch-x86_64/bionic/__bionic_clone.S \
     arch-x86_64/bionic/_exit_with_stack_teardown.S \
-    arch-x86_64/bionic/__rt_sigreturn.S \
+    arch-x86_64/bionic/__restore_rt.S \
     arch-x86_64/bionic/_setjmp.S \
     arch-x86_64/bionic/setjmp.S \
     arch-x86_64/bionic/__set_tls.c \
@@ -38,6 +44,10 @@
     arch-x86_64/bionic/syscall.S \
     arch-x86_64/bionic/vfork.S \
 
+#
+# Optimized memory/string functions.
+#
+
 libc_bionic_src_files_x86_64 += \
     arch-x86_64/string/sse2-memcpy-slm.S \
     arch-x86_64/string/sse2-memmove-slm.S \
@@ -55,15 +65,15 @@
 
 libc_crt_target_cflags_x86_64 += \
     -m64 \
-    -I$(LOCAL_PATH)/arch-x86_64/include
+    -I$(LOCAL_PATH)/arch-x86_64/include \
 
-libc_crt_target_ldflags_x86_64 := -melf_x86_64
+libc_crt_target_ldflags_x86_64 := -melf_x86_64 \
 
 libc_crt_target_crtbegin_file_x86_64 := \
-    $(LOCAL_PATH)/arch-common/bionic/crtbegin.c
+    $(LOCAL_PATH)/arch-common/bionic/crtbegin.c \
 
 libc_crt_target_crtbegin_so_file_x86_64 := \
-    $(LOCAL_PATH)/arch-common/bionic/crtbegin_so.c
+    $(LOCAL_PATH)/arch-common/bionic/crtbegin_so.c \
 
 libc_crt_target_so_cflags_x86_64 := \
-    -fPIC
+    -fPIC \
diff --git a/libc/bionic/__fgets_chk.cpp b/libc/bionic/__fgets_chk.cpp
index c09f6c5..75e4ca0 100644
--- a/libc/bionic/__fgets_chk.cpp
+++ b/libc/bionic/__fgets_chk.cpp
@@ -43,8 +43,8 @@
  * This fgets check is called if _FORTIFY_SOURCE is defined and
  * greater than 0.
  */
-extern "C" char* __fgets_chk(char* dest, int supplied_size,
-                             FILE* stream, size_t dest_len_from_compiler) {
+char* __fgets_chk(char* dest, int supplied_size, FILE* stream,
+                  size_t dest_len_from_compiler) {
   if (supplied_size < 0) {
     __fortify_chk_fail("fgets: buffer size < 0", 0);
   }
diff --git a/libc/bionic/__recvfrom_chk.cpp b/libc/bionic/__recvfrom_chk.cpp
index 48baa8e..9c894b0 100644
--- a/libc/bionic/__recvfrom_chk.cpp
+++ b/libc/bionic/__recvfrom_chk.cpp
@@ -32,9 +32,9 @@
 #include <sys/socket.h>
 #include "private/libc_logging.h"
 
-extern "C"
-ssize_t __recvfrom_chk(int socket, void* buf, size_t len, size_t buflen, unsigned int flags,
-                       const struct sockaddr* src_addr, socklen_t* addrlen) {
+ssize_t __recvfrom_chk(int socket, void* buf, size_t len, size_t buflen,
+                       int flags, const struct sockaddr* src_addr,
+                       socklen_t* addrlen) {
   if (__predict_false(len > buflen)) {
     __fortify_chk_fail("recvfrom: prevented write past end of buffer", 0);
   }
diff --git a/libc/bionic/dl_iterate_phdr_static.cpp b/libc/bionic/dl_iterate_phdr_static.cpp
index 155a7a0..2196ac8 100644
--- a/libc/bionic/dl_iterate_phdr_static.cpp
+++ b/libc/bionic/dl_iterate_phdr_static.cpp
@@ -62,6 +62,11 @@
 
   // Try the VDSO if that didn't work.
   ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(getauxval(AT_SYSINFO_EHDR));
+  if (ehdr_vdso == nullptr) {
+    // There is no VDSO, so there's nowhere left to look.
+    return rc;
+  }
+
   struct dl_phdr_info vdso_info;
   vdso_info.dlpi_addr = 0;
   vdso_info.dlpi_name = NULL;
diff --git a/libc/bionic/flockfile.cpp b/libc/bionic/flockfile.cpp
index 3381e8e..b73907cb 100644
--- a/libc/bionic/flockfile.cpp
+++ b/libc/bionic/flockfile.cpp
@@ -36,12 +36,20 @@
 // struct __sfileext (see fileext.h).
 
 void flockfile(FILE* fp) {
+  if (!__sdidinit) {
+    __sinit();
+  }
+
   if (fp != NULL) {
     pthread_mutex_lock(&_FLOCK(fp));
   }
 }
 
 int ftrylockfile(FILE* fp) {
+  if (!__sdidinit) {
+    __sinit();
+  }
+
   // The specification for ftrylockfile() says it returns 0 on success,
   // or non-zero on error. So return an errno code directly on error.
   if (fp == NULL) {
@@ -52,6 +60,10 @@
 }
 
 void funlockfile(FILE* fp) {
+  if (!__sdidinit) {
+    __sinit();
+  }
+
   if (fp != NULL) {
     pthread_mutex_unlock(&_FLOCK(fp));
   }
diff --git a/libc/bionic/posix_timers.cpp b/libc/bionic/posix_timers.cpp
index 7ad0ef1..3c664d9 100644
--- a/libc/bionic/posix_timers.cpp
+++ b/libc/bionic/posix_timers.cpp
@@ -62,6 +62,7 @@
   pthread_t callback_thread;
   void (*callback)(sigval_t);
   sigval_t callback_argument;
+  volatile bool armed;
 };
 
 static __kernel_timer_t to_kernel_timer_id(timer_t timer) {
@@ -83,7 +84,7 @@
       continue;
     }
 
-    if (si.si_code == SI_TIMER) {
+    if (si.si_code == SI_TIMER && timer->armed) {
       // This signal was sent because a timer fired, so call the callback.
       timer->callback(timer->callback_argument);
     } else if (si.si_code == SI_TKILL) {
@@ -95,6 +96,9 @@
 }
 
 static void __timer_thread_stop(PosixTimer* timer) {
+  // Immediately mark the timer as disarmed so even if some events
+  // continue to happen, the callback won't be called.
+  timer->armed = false;
   pthread_kill(timer->callback_thread, TIMER_SIGNAL);
 }
 
@@ -121,6 +125,7 @@
   // Otherwise, this must be SIGEV_THREAD timer...
   timer->callback = evp->sigev_notify_function;
   timer->callback_argument = evp->sigev_value;
+  timer->armed = false;
 
   // Check arguments that the kernel doesn't care about but we do.
   if (timer->callback == NULL) {
@@ -200,7 +205,18 @@
 
 // http://pubs.opengroup.org/onlinepubs/9699919799/functions/timer_getoverrun.html
 int timer_settime(timer_t id, int flags, const itimerspec* ts, itimerspec* ots) {
-  return __timer_settime(to_kernel_timer_id(id), flags, ts, ots);
+  PosixTimer* timer= reinterpret_cast<PosixTimer*>(id);
+  int rc = __timer_settime(timer->kernel_timer_id, flags, ts, ots);
+  if (rc == 0) {
+    // Mark the timer as either being armed or disarmed. This avoids the
+    // callback being called after the disarm for SIGEV_THREAD timers only.
+    if (ts->it_value.tv_sec != 0 || ts->it_value.tv_nsec != 0) {
+      timer->armed = true;
+    } else {
+      timer->armed = false;
+    }
+  }
+  return rc;
 }
 
 // http://pubs.opengroup.org/onlinepubs/9699919799/functions/timer_getoverrun.html
diff --git a/libc/bionic/pthread_attr.cpp b/libc/bionic/pthread_attr.cpp
index c93970a..c65ccc1 100644
--- a/libc/bionic/pthread_attr.cpp
+++ b/libc/bionic/pthread_attr.cpp
@@ -31,6 +31,7 @@
 #include <inttypes.h>
 #include <stdio.h>
 #include <sys/resource.h>
+#include <unistd.h>
 
 #include "private/bionic_string_utils.h"
 #include "private/ErrnoRestorer.h"
@@ -126,8 +127,12 @@
     stack_limit.rlim_cur = 8 * 1024 * 1024;
   }
 
-  // It doesn't matter which thread we are; we're just looking for "[stack]".
-  FILE* fp = fopen("/proc/self/maps", "re");
+  // It shouldn't matter which thread we are because we're just looking for "[stack]", but
+  // valgrind seems to mess with the stack enough that the kernel will report "[stack:pid]"
+  // instead if you look in /proc/self/maps, so we need to look in /proc/pid/task/pid/maps.
+  char path[64];
+  snprintf(path, sizeof(path), "/proc/self/task/%d/maps", getpid());
+  FILE* fp = fopen(path, "re");
   if (fp == NULL) {
     return errno;
   }
@@ -143,7 +148,7 @@
       }
     }
   }
-  __libc_fatal("No [stack] line found in /proc/self/maps!");
+  __libc_fatal("No [stack] line found in \"%s\"!", path);
 }
 
 int pthread_attr_getstack(const pthread_attr_t* attr, void** stack_base, size_t* stack_size) {
diff --git a/libc/bionic/sigaction.cpp b/libc/bionic/sigaction.cpp
index 225a823..0633748 100644
--- a/libc/bionic/sigaction.cpp
+++ b/libc/bionic/sigaction.cpp
@@ -28,28 +28,33 @@
 
 #include <signal.h>
 
-#if __LP64__
-extern "C" void __rt_sigreturn(void);
+extern "C" void __restore_rt(void);
+extern "C" void __restore(void);
+
+#if defined(__LP64__)
+
 extern "C" int __rt_sigaction(int, const struct __kernel_sigaction*, struct __kernel_sigaction*, size_t);
-#else
-extern "C" int __sigaction(int, const struct sigaction*, struct sigaction*);
-#endif
 
 int sigaction(int signal, const struct sigaction* bionic_new_action, struct sigaction* bionic_old_action) {
-#if __LP64__
   __kernel_sigaction kernel_new_action;
   if (bionic_new_action != NULL) {
     kernel_new_action.sa_flags = bionic_new_action->sa_flags;
     kernel_new_action.sa_handler = bionic_new_action->sa_handler;
     kernel_new_action.sa_mask = bionic_new_action->sa_mask;
-#ifdef SA_RESTORER
+#if defined(SA_RESTORER)
     kernel_new_action.sa_restorer = bionic_new_action->sa_restorer;
-
+#if defined(__aarch64__)
+    // arm64 has sa_restorer, but unwinding works best if you just let the
+    // kernel supply the default restorer from [vdso]. gdb doesn't care, but
+    // libgcc needs the nop that the kernel includes before the actual code.
+    // (We could add that ourselves, but why bother?)
+#else
     if (!(kernel_new_action.sa_flags & SA_RESTORER)) {
       kernel_new_action.sa_flags |= SA_RESTORER;
-      kernel_new_action.sa_restorer = &__rt_sigreturn;
+      kernel_new_action.sa_restorer = &__restore_rt;
     }
 #endif
+#endif
   }
 
   __kernel_sigaction kernel_old_action;
@@ -62,19 +67,36 @@
     bionic_old_action->sa_flags = kernel_old_action.sa_flags;
     bionic_old_action->sa_handler = kernel_old_action.sa_handler;
     bionic_old_action->sa_mask = kernel_old_action.sa_mask;
-#ifdef SA_RESTORER
+#if defined(SA_RESTORER)
     bionic_old_action->sa_restorer = kernel_old_action.sa_restorer;
-
-    if (bionic_old_action->sa_restorer == &__rt_sigreturn) {
-      bionic_old_action->sa_flags &= ~SA_RESTORER;
-    }
 #endif
   }
 
   return result;
-#else
-  // The 32-bit ABI is broken. struct sigaction includes a too-small sigset_t.
-  // TODO: if we also had correct struct sigaction definitions available, we could copy in and out.
-  return __sigaction(signal, bionic_new_action, bionic_old_action);
-#endif
 }
+
+#else
+
+extern "C" int __sigaction(int, const struct sigaction*, struct sigaction*);
+
+int sigaction(int signal, const struct sigaction* bionic_new_action, struct sigaction* bionic_old_action) {
+  // The 32-bit ABI is broken. struct sigaction includes a too-small sigset_t,
+  // so we have to use sigaction(2) rather than rt_sigaction(2).
+  struct sigaction kernel_new_action;
+  if (bionic_new_action != NULL) {
+    kernel_new_action.sa_flags = bionic_new_action->sa_flags;
+    kernel_new_action.sa_handler = bionic_new_action->sa_handler;
+    kernel_new_action.sa_mask = bionic_new_action->sa_mask;
+#if defined(SA_RESTORER)
+    kernel_new_action.sa_restorer = bionic_new_action->sa_restorer;
+
+    if (!(kernel_new_action.sa_flags & SA_RESTORER)) {
+      kernel_new_action.sa_flags |= SA_RESTORER;
+      kernel_new_action.sa_restorer = (kernel_new_action.sa_flags & SA_SIGINFO) ? &__restore_rt : &__restore;
+    }
+#endif
+  }
+  return __sigaction(signal, (bionic_new_action != NULL) ? &kernel_new_action : NULL, bionic_old_action);
+}
+
+#endif
diff --git a/libc/bionic/sysconf.cpp b/libc/bionic/sysconf.cpp
index 8309f08..7734e40 100644
--- a/libc/bionic/sysconf.cpp
+++ b/libc/bionic/sysconf.cpp
@@ -150,7 +150,7 @@
   return (rc == -1) ? -1 : _POSIX_VERSION;
 }
 
-int sysconf(int name) {
+long sysconf(int name) {
     switch (name) {
 #ifdef _POSIX_ARG_MAX
     case _SC_ARG_MAX:           return _POSIX_ARG_MAX;
diff --git a/libc/bionic/system_properties.cpp b/libc/bionic/system_properties.cpp
index a564c39..0e16bf3 100644
--- a/libc/bionic/system_properties.cpp
+++ b/libc/bionic/system_properties.cpp
@@ -475,8 +475,8 @@
 
 static int send_prop_msg(const prop_msg *msg)
 {
-    const int fd = socket(AF_LOCAL, SOCK_STREAM, 0);
-    if (fd < 0) {
+    const int fd = socket(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0);
+    if (fd == -1) {
         return -1;
     }
 
diff --git a/libc/dns/resolv/__dn_comp.c b/libc/dns/resolv/__dn_comp.c
deleted file mode 100644
index 93d3f19..0000000
--- a/libc/dns/resolv/__dn_comp.c
+++ /dev/null
@@ -1,38 +0,0 @@
-/*	$NetBSD: __dn_comp.c,v 1.4 2005/09/13 01:44:10 christos Exp $	*/
-
-/*
- * written by matthew green, 22/04/97.
- * public domain.
- */
-
-#include <sys/cdefs.h>
-#if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: __dn_comp.c,v 1.4 2005/09/13 01:44:10 christos Exp $");
-#endif /* LIBC_SCCS and not lint */
-
-#if defined(__indr_reference)
-__indr_reference(__dn_comp,dn_comp)
-#else
-
-#include <sys/types.h>
-#include <netinet/in.h>
-#ifdef ANDROID_CHANGES
-#include "resolv_private.h"
-#else
-#include <resolv.h>
-#endif
-
-/* XXX THIS IS A MESS!  SEE <resolv.h> XXX */
-
-#undef dn_comp
-int	dn_comp(const char *, u_char *, int, u_char **, u_char **);
-
-int
-dn_comp(const char *exp_dn, u_char *comp_dn, u_char **dnptrs,
-    u_char **lastdnptr, int length)
-{
-
-	return __dn_comp(exp_dn, comp_dn, length, dnptrs, lastdnptr);
-}
-
-#endif
diff --git a/libc/dns/resolv/__res_close.c b/libc/dns/resolv/__res_close.c
deleted file mode 100644
index 3af50b0..0000000
--- a/libc/dns/resolv/__res_close.c
+++ /dev/null
@@ -1,33 +0,0 @@
-/*	$NetBSD: __res_close.c,v 1.4 2005/09/13 01:44:10 christos Exp $	*/
-
-/*
- * written by matthew green, 22/04/97.
- * public domain.
- */
-
-#include <sys/cdefs.h>
-#if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: __res_close.c,v 1.4 2005/09/13 01:44:10 christos Exp $");
-#endif /* LIBC_SCCS and not lint */
-
-#if defined(__indr_reference)
-__indr_reference(__res_close, res_close)
-#else
-
-#include <sys/types.h>
-#include <netinet/in.h>
-#include "resolv_private.h"
-
-/* XXX THIS IS A MESS!  SEE <resolv.h> XXX */
-
-#undef res_close
-void	res_close(void);
-
-void
-res_close(void)
-{
-
-	__res_close();
-}
-
-#endif
diff --git a/libc/dns/resolv/__res_send.c b/libc/dns/resolv/__res_send.c
deleted file mode 100644
index 198b05c..0000000
--- a/libc/dns/resolv/__res_send.c
+++ /dev/null
@@ -1,37 +0,0 @@
-/*	$NetBSD: __res_send.c,v 1.4 2005/09/13 01:44:10 christos Exp $	*/
-
-/*
- * written by matthew green, 22/04/97.
- * public domain.
- */
-
-#include <sys/cdefs.h>
-#if defined(LIBC_SCCS) && !defined(lint)
-__RCSID("$NetBSD: __res_send.c,v 1.4 2005/09/13 01:44:10 christos Exp $");
-#endif
-
-#if defined(__indr_reference)
-__indr_reference(__res_send, res_send)
-#else
-
-#include <sys/types.h>
-#include <netinet/in.h>
-#ifdef ANDROID_CHANGES
-#include "resolv_private.h"
-#else
-#include <resolv.h>
-#endif
-
-/* XXX THIS IS A MESS!  SEE <resolv.h> XXX */
-
-#undef res_send
-int	res_send(const u_char *, int, u_char *, int);
-
-int
-res_send(const u_char *buf, int buflen, u_char *ans, int anssiz)
-{
-
-	return __res_send(buf, buflen, ans, anssiz);
-}
-
-#endif
diff --git a/libc/dns/resolv/res_send.c b/libc/dns/resolv/res_send.c
index 6439e31..a8da3ac 100644
--- a/libc/dns/resolv/res_send.c
+++ b/libc/dns/resolv/res_send.c
@@ -402,6 +402,10 @@
 	}
 
 	if (statp->nscount == 0) {
+		// We have no nameservers configured, so there's no point trying.
+		// Tell the cache the query failed, or any retries and anyone else asking the same
+		// question will block for PENDING_REQUEST_TIMEOUT seconds instead of failing fast.
+		_resolv_cache_query_failed(statp->netid, buf, buflen);
 		errno = ESRCH;
 		return (-1);
 	}
diff --git a/libc/include/android/dlext.h b/libc/include/android/dlext.h
index 5c3a206..f27e4e5 100644
--- a/libc/include/android/dlext.h
+++ b/libc/include/android/dlext.h
@@ -54,12 +54,19 @@
    */
   ANDROID_DLEXT_USE_LIBRARY_FD        = 0x10,
 
+  /* If opening a library using library_fd read it starting at library_fd_offset.
+   * This flag is only valid when ANDROID_DLEXT_USE_LIBRARY_FD is set.
+   */
+
+  ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET    = 0x20,
+
   /* Mask of valid bits */
   ANDROID_DLEXT_VALID_FLAG_BITS       = ANDROID_DLEXT_RESERVED_ADDRESS |
                                         ANDROID_DLEXT_RESERVED_ADDRESS_HINT |
                                         ANDROID_DLEXT_WRITE_RELRO |
                                         ANDROID_DLEXT_USE_RELRO |
-                                        ANDROID_DLEXT_USE_LIBRARY_FD,
+                                        ANDROID_DLEXT_USE_LIBRARY_FD |
+                                        ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET,
 };
 
 typedef struct {
@@ -68,6 +75,7 @@
   size_t  reserved_size;
   int     relro_fd;
   int     library_fd;
+  off64_t library_fd_offset;
 } android_dlextinfo;
 
 extern void* android_dlopen_ext(const char* filename, int flag, const android_dlextinfo* extinfo);
diff --git a/libc/include/arpa/inet.h b/libc/include/arpa/inet.h
index 067be1f..86265bf 100644
--- a/libc/include/arpa/inet.h
+++ b/libc/include/arpa/inet.h
@@ -25,6 +25,7 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+
 #ifndef _ARPA_INET_H_
 #define _ARPA_INET_H_
 
@@ -34,8 +35,6 @@
 
 __BEGIN_DECLS
 
-typedef uint32_t in_addr_t;
-
 in_addr_t inet_addr(const char*);
 int inet_aton(const char*, struct in_addr*);
 in_addr_t inet_lnaof(struct in_addr);
diff --git a/libc/include/arpa/nameser.h b/libc/include/arpa/nameser.h
index a87ac91..91561ce 100644
--- a/libc/include/arpa/nameser.h
+++ b/libc/include/arpa/nameser.h
@@ -518,9 +518,8 @@
 	(cp) += NS_INT32SZ; \
 } while (/*CONSTCOND*/0)
 
-/*
- * ANSI C identifier hiding for bind's lib/nameser.
- */
+#if !defined(__LP64__)
+/* Annoyingly, LP32 shipped with __ names. */
 #define	ns_msg_getflag		__ns_msg_getflag
 #define ns_get16		__ns_get16
 #define ns_get32		__ns_get32
@@ -564,101 +563,73 @@
 #define	ns_subdomain		__ns_subdomain
 #define	ns_makecanon		__ns_makecanon
 #define	ns_samename		__ns_samename
-#define	ns_newmsg_init		__ns_newmsg_init
-#define	ns_newmsg_copy		__ns_newmsg_copy
-#define	ns_newmsg_id		__ns_newmsg_id
-#define	ns_newmsg_flag		__ns_newmsg_flag
-#define	ns_newmsg_q		__ns_newmsg_q
-#define	ns_newmsg_rr		__ns_newmsg_rr
-#define	ns_newmsg_done		__ns_newmsg_done
-#define	ns_rdata_unpack		__ns_rdata_unpack
-#define	ns_rdata_equal		__ns_rdata_equal
-#define	ns_rdata_refers		__ns_rdata_refers
+#endif
 
 __BEGIN_DECLS
-int		ns_msg_getflag(ns_msg, int);
-uint16_t	ns_get16(const u_char *);
-uint32_t	ns_get32(const u_char *);
-void		ns_put16(uint16_t, u_char *);
-void		ns_put32(uint32_t, u_char *);
-int		ns_initparse(const u_char *, int, ns_msg *);
-int		ns_skiprr(const u_char *, const u_char *, ns_sect, int);
-int		ns_parserr(ns_msg *, ns_sect, int, ns_rr *);
-int		ns_parserr2(ns_msg *, ns_sect, int, ns_rr2 *);
+int		ns_msg_getflag(ns_msg, int) __LIBC_ABI_PUBLIC__;
+uint16_t	ns_get16(const u_char *) __LIBC_ABI_PUBLIC__;
+uint32_t	ns_get32(const u_char *) __LIBC_ABI_PUBLIC__;
+void		ns_put16(uint16_t, u_char *) __LIBC_ABI_PUBLIC__;
+void		ns_put32(uint32_t, u_char *) __LIBC_ABI_PUBLIC__;
+int		ns_initparse(const u_char *, int, ns_msg *) __LIBC_ABI_PUBLIC__;
+int		ns_skiprr(const u_char *, const u_char *, ns_sect, int) __LIBC_ABI_PUBLIC__;
+int		ns_parserr(ns_msg *, ns_sect, int, ns_rr *) __LIBC_ABI_PUBLIC__;
+int		ns_parserr2(ns_msg *, ns_sect, int, ns_rr2 *) __LIBC_HIDDEN__;
 int		ns_sprintrr(const ns_msg *, const ns_rr *,
-				 const char *, const char *, char *, size_t);
+				 const char *, const char *, char *, size_t) __LIBC_ABI_PUBLIC__;
 int		ns_sprintrrf(const u_char *, size_t, const char *,
 				  ns_class, ns_type, u_long, const u_char *,
 				  size_t, const char *, const char *,
-				  char *, size_t);
-int		ns_format_ttl(u_long, char *, size_t);
-int		ns_parse_ttl(const char *, u_long *);
-uint32_t	ns_datetosecs(const char *cp, int *errp);
-int		ns_name_ntol(const u_char *, u_char *, size_t);
-int		ns_name_ntop(const u_char *, char *, size_t);
-int		ns_name_pton(const char *, u_char *, size_t);
-int		ns_name_pton2(const char *, u_char *, size_t, size_t *);
+				  char *, size_t) __LIBC_ABI_PUBLIC__;
+int		ns_format_ttl(u_long, char *, size_t) __LIBC_ABI_PUBLIC__;
+int		ns_parse_ttl(const char *, u_long *) __LIBC_ABI_PUBLIC__;
+uint32_t	ns_datetosecs(const char *cp, int *errp) __LIBC_ABI_PUBLIC__;
+int		ns_name_ntol(const u_char *, u_char *, size_t) __LIBC_ABI_PUBLIC__;
+int		ns_name_ntop(const u_char *, char *, size_t) __LIBC_ABI_PUBLIC__;
+int		ns_name_pton(const char *, u_char *, size_t) __LIBC_ABI_PUBLIC__;
+int		ns_name_pton2(const char *, u_char *, size_t, size_t *) __LIBC_HIDDEN__;
 int		ns_name_unpack(const u_char *, const u_char *,
-				    const u_char *, u_char *, size_t);
+				    const u_char *, u_char *, size_t) __LIBC_ABI_PUBLIC__;
 int		ns_name_unpack2(const u_char *, const u_char *,
 				     const u_char *, u_char *, size_t,
-				     size_t *);
+				     size_t *) __LIBC_HIDDEN__;
 int		ns_name_pack(const u_char *, u_char *, int,
-				  const u_char **, const u_char **);
+				  const u_char **, const u_char **) __LIBC_ABI_PUBLIC__;
 int		ns_name_uncompress(const u_char *, const u_char *,
-					const u_char *, char *, size_t);
+					const u_char *, char *, size_t) __LIBC_ABI_PUBLIC__;
 int		ns_name_compress(const char *, u_char *, size_t,
-				      const u_char **, const u_char **);
-int		ns_name_skip(const u_char **, const u_char *);
+				      const u_char **, const u_char **) __LIBC_ABI_PUBLIC__;
+int		ns_name_skip(const u_char **, const u_char *) __LIBC_ABI_PUBLIC__;
 void		ns_name_rollback(const u_char *, const u_char **,
-				      const u_char **);
+				      const u_char **) __LIBC_ABI_PUBLIC__;
 int		ns_sign(u_char *, int *, int, int, void *,
-			     const u_char *, int, u_char *, int *, time_t);
+			     const u_char *, int, u_char *, int *, time_t) __LIBC_ABI_PUBLIC__;
 int		ns_sign2(u_char *, int *, int, int, void *,
 			      const u_char *, int, u_char *, int *, time_t,
-			      u_char **, u_char **);
-ssize_t		ns_name_length(ns_nname_ct, size_t);
-int		ns_name_eq(ns_nname_ct, size_t, ns_nname_ct, size_t);
-int		ns_name_owned(ns_namemap_ct, int, ns_namemap_ct, int);
-int		ns_name_map(ns_nname_ct, size_t, ns_namemap_t, int);
-int		ns_name_labels(ns_nname_ct, size_t);
+			      u_char **, u_char **) __LIBC_ABI_PUBLIC__;
+ssize_t		ns_name_length(ns_nname_ct, size_t) __LIBC_HIDDEN__;
+int		ns_name_eq(ns_nname_ct, size_t, ns_nname_ct, size_t) __LIBC_HIDDEN__;
+int		ns_name_owned(ns_namemap_ct, int, ns_namemap_ct, int) __LIBC_HIDDEN__;
+int		ns_name_map(ns_nname_ct, size_t, ns_namemap_t, int) __LIBC_HIDDEN__;
+int		ns_name_labels(ns_nname_ct, size_t) __LIBC_HIDDEN__;
 int		ns_sign_tcp(u_char *, int *, int, int,
-				 ns_tcp_tsig_state *, int);
+				 ns_tcp_tsig_state *, int) __LIBC_ABI_PUBLIC__;
 int		ns_sign_tcp2(u_char *, int *, int, int,
 				  ns_tcp_tsig_state *, int,
-				  u_char **, u_char **);
+				  u_char **, u_char **) __LIBC_ABI_PUBLIC__;
 int		ns_sign_tcp_init(void *, const u_char *, int,
-					ns_tcp_tsig_state *);
-u_char		*ns_find_tsig(u_char *, u_char *);
+					ns_tcp_tsig_state *) __LIBC_ABI_PUBLIC__;
+u_char		*ns_find_tsig(u_char *, u_char *) __LIBC_ABI_PUBLIC__;
 int		ns_verify(u_char *, int *, void *,
 			       const u_char *, int, u_char *, int *,
-			       time_t *, int);
+			       time_t *, int) __LIBC_ABI_PUBLIC__;
 int		ns_verify_tcp(u_char *, int *, ns_tcp_tsig_state *, int);
 int		ns_verify_tcp_init(void *, const u_char *, int,
-					ns_tcp_tsig_state *);
-int		ns_samedomain(const char *, const char *);
-int		ns_subdomain(const char *, const char *);
-int		ns_makecanon(const char *, char *, size_t);
-int		ns_samename(const char *, const char *);
-int		ns_newmsg_init(u_char *buffer, size_t bufsiz, ns_newmsg *);
-int		ns_newmsg_copy(ns_newmsg *, ns_msg *);
-void		ns_newmsg_id(ns_newmsg *handle, uint16_t id);
-void		ns_newmsg_flag(ns_newmsg *handle, ns_flag flag, u_int value);
-int		ns_newmsg_q(ns_newmsg *handle, ns_nname_ct qname,
-			    ns_type qtype, ns_class qclass);
-int		ns_newmsg_rr(ns_newmsg *handle, ns_sect sect,
-			     ns_nname_ct name, ns_type type,
-			     ns_class rr_class, uint32_t ttl,
-			     uint16_t rdlen, const u_char *rdata);
-size_t		ns_newmsg_done(ns_newmsg *handle);
-ssize_t		ns_rdata_unpack(const u_char *, const u_char *, ns_type,
-				const u_char *, size_t, u_char *, size_t);
-int		ns_rdata_equal(ns_type,
-			       const u_char *, size_t,
-			       const u_char *, size_t);
-int		ns_rdata_refers(ns_type,
-				const u_char *, size_t,
-				const u_char *);
+					ns_tcp_tsig_state *) __LIBC_ABI_PUBLIC__;
+int		ns_samedomain(const char *, const char *) __LIBC_ABI_PUBLIC__;
+int		ns_subdomain(const char *, const char *) __LIBC_ABI_PUBLIC__;
+int		ns_makecanon(const char *, char *, size_t) __LIBC_ABI_PUBLIC__;
+int		ns_samename(const char *, const char *) __LIBC_ABI_PUBLIC__;
 __END_DECLS
 
 #ifdef BIND_4_COMPAT
diff --git a/libc/include/elf.h b/libc/include/elf.h
index 0975b7a..7de464e 100644
--- a/libc/include/elf.h
+++ b/libc/include/elf.h
@@ -54,6 +54,35 @@
 #define DF_BIND_NOW   0x00000008
 #define DF_STATIC_TLS 0x00000010
 
+#define DF_1_NOW        0x00000001 // Perform complete relocation processing.
+#define DF_1_GLOBAL     0x00000002 // implies RTLD_GLOBAL
+#define DF_1_GROUP      0x00000004
+#define DF_1_NODELETE   0x00000008 // implies RTLD_NODELETE
+#define DF_1_LOADFLTR   0x00000010
+#define DF_1_INITFIRST  0x00000020
+#define DF_1_NOOPEN     0x00000040 // Object can not be used with dlopen(3)
+#define DF_1_ORIGIN     0x00000080
+#define DF_1_DIRECT     0x00000100
+#define DF_1_TRANS      0x00000200
+#define DF_1_INTERPOSE  0x00000400
+#define DF_1_NODEFLIB   0x00000800
+#define DF_1_NODUMP     0x00001000 // Object cannot be dumped with dldump(3)
+#define DF_1_CONFALT    0x00002000
+#define DF_1_ENDFILTEE  0x00004000
+#define DF_1_DISPRELDNE 0x00008000
+#define DF_1_DISPRELPND 0x00010000
+#define DF_1_NODIRECT   0x00020000
+#define DF_1_IGNMULDEF  0x00040000 // Internal use
+#define DF_1_NOKSYMS    0x00080000 // Internal use
+#define DF_1_NOHDR      0x00100000 // Internal use
+#define DF_1_EDITED     0x00200000
+#define DF_1_NORELOC    0x00400000 // Internal use
+#define DF_1_SYMINTPOSE 0x00800000
+#define DF_1_GLOBAUDIT  0x01000000
+#define DF_1_SINGLETON  0x02000000
+#define DF_1_STUB       0x04000000
+#define DF_1_PIE        0x08000000
+
 #define DT_BIND_NOW 24
 #define DT_INIT_ARRAY 25
 #define DT_FINI_ARRAY 26
@@ -69,14 +98,15 @@
 
 #define PT_GNU_RELRO 0x6474e552
 
-#define STB_LOOS   10
-#define STB_HIOS   12
-#define STB_LOPROC 13
-#define STB_HIPROC 15
+#define STB_LOOS      10
+#define STB_HIOS      12
+#define STB_LOPROC    13
+#define STB_HIPROC    15
 
-#define STT_LOOS   10
-#define STT_HIOS   12
-#define STT_LOPROC 13
-#define STT_HIPROC 15
+#define STT_GNU_IFUNC 10
+#define STT_LOOS      10
+#define STT_HIOS      12
+#define STT_LOPROC    13
+#define STT_HIPROC    15
 
 #endif /* _ELF_H */
diff --git a/libc/include/fcntl.h b/libc/include/fcntl.h
index 8f89afb..794e62c 100644
--- a/libc/include/fcntl.h
+++ b/libc/include/fcntl.h
@@ -81,15 +81,15 @@
 extern int unlinkat(int, const char*, int);
 extern ssize_t vmsplice(int, const struct iovec*, size_t, unsigned int);
 
-#if defined(__BIONIC_FORTIFY)
-
 extern int __open_2(const char*, int);
-extern int __open_real(const char*, int, ...) __asm__(__USER_LABEL_PREFIX__ "open");
+extern int __open_real(const char*, int, ...) __RENAME(open);
 extern int __openat_2(int, const char*, int);
-extern int __openat_real(int, const char*, int, ...) __asm__(__USER_LABEL_PREFIX__ "openat");
+extern int __openat_real(int, const char*, int, ...) __RENAME(openat);
 __errordecl(__creat_missing_mode, "called with O_CREAT, but missing mode");
 __errordecl(__creat_too_many_args, "too many arguments");
 
+#if defined(__BIONIC_FORTIFY)
+
 #if !defined(__clang__)
 
 __BIONIC_FORTIFY_INLINE
diff --git a/libc/include/netinet/in.h b/libc/include/netinet/in.h
index bf3b498..44c7fc1 100644
--- a/libc/include/netinet/in.h
+++ b/libc/include/netinet/in.h
@@ -25,6 +25,7 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+
 #ifndef _NETINET_IN_H_
 #define _NETINET_IN_H_
 
@@ -43,6 +44,9 @@
 
 #define INET_ADDRSTRLEN 16
 
+typedef uint16_t in_port_t;
+typedef uint32_t in_addr_t;
+
 extern int bindresvport (int sd, struct sockaddr_in *sin);
 
 static const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
diff --git a/libc/include/signal.h b/libc/include/signal.h
index f1849c5..e23e65b 100644
--- a/libc/include/signal.h
+++ b/libc/include/signal.h
@@ -48,6 +48,9 @@
 #  include <linux/signal.h>
 #endif
 
+#include <sys/ucontext.h>
+#define __BIONIC_HAVE_UCONTEXT_T
+
 __BEGIN_DECLS
 
 typedef int sig_atomic_t;
diff --git a/libc/include/stdatomic.h b/libc/include/stdatomic.h
index 3db25a7..58cb1bc 100644
--- a/libc/include/stdatomic.h
+++ b/libc/include/stdatomic.h
@@ -33,7 +33,7 @@
 #include <sys/cdefs.h>
 
 
-#if defined(__cplusplus) && defined(_USING_LIBCXX)
+#if defined(__cplusplus) && __cplusplus >= 201103L && defined(_USING_LIBCXX)
 # ifdef __clang__
 #  if __has_feature(cxx_atomic)
 #   define _STDATOMIC_HAVE_ATOMIC
@@ -89,6 +89,7 @@
 using std::memory_order;
 using std::memory_order_relaxed;
 using std::memory_order_consume;
+using std::memory_order_acquire;
 using std::memory_order_release;
 using std::memory_order_acq_rel;
 using std::memory_order_seq_cst;
diff --git a/libc/include/stdio.h b/libc/include/stdio.h
index 43b0fbf..a0161de 100644
--- a/libc/include/stdio.h
+++ b/libc/include/stdio.h
@@ -47,6 +47,8 @@
 #define __need_NULL
 #include <stddef.h>
 
+__BEGIN_DECLS
+
 #define	_FSTDIO			/* Define for new stdio with functions. */
 
 typedef off_t fpos_t;		/* stdio file position type */
@@ -136,9 +138,7 @@
 	fpos_t	_offset;	/* current lseek offset */
 } FILE;
 
-__BEGIN_DECLS
 extern FILE __sF[];
-__END_DECLS
 
 #define	__SLBF	0x0001		/* line buffered */
 #define	__SNBF	0x0002		/* unbuffered */
@@ -208,7 +208,6 @@
 /*
  * Functions defined in ANSI C standard.
  */
-__BEGIN_DECLS
 void	 clearerr(FILE *);
 int	 fclose(FILE *);
 int	 feof(FILE *);
@@ -296,16 +295,12 @@
 		__scanflike(2, 0);
 #endif /* __ISO_C_VISIBLE >= 1999 || __BSD_VISIBLE */
 
-__END_DECLS
-
-
 /*
  * Functions defined in POSIX 1003.1.
  */
 #if __BSD_VISIBLE || __POSIX_VISIBLE || __XPG_VISIBLE
 #define	L_ctermid	1024	/* size for ctermid(); PATH_MAX */
 
-__BEGIN_DECLS
 FILE	*fdopen(int, const char *);
 int	 fileno(FILE *);
 
@@ -329,15 +324,12 @@
 int	 putchar_unlocked(int);
 #endif /* __POSIX_VISIBLE >= 199506 */
 
-__END_DECLS
-
 #endif /* __BSD_VISIBLE || __POSIX_VISIBLE || __XPG_VISIBLE */
 
 /*
  * Routines that are purely local.
  */
 #if __BSD_VISIBLE
-__BEGIN_DECLS
 int	 asprintf(char ** __restrict, const char * __restrict, ...)
 		__printflike(2, 3);
 char	*fgetln(FILE * __restrict, size_t * __restrict);
@@ -347,25 +339,26 @@
 int	 vasprintf(char ** __restrict, const char * __restrict,
     __va_list)
 		__printflike(2, 0);
-__END_DECLS
 
 /*
  * Stdio function-access interface.
  */
-__BEGIN_DECLS
 FILE	*funopen(const void *,
 		int (*)(void *, char *, int),
 		int (*)(void *, const char *, int),
 		fpos_t (*)(void *, fpos_t, int),
 		int (*)(void *));
-__END_DECLS
+
 #define	fropen(cookie, fn) funopen(cookie, fn, 0, 0, 0)
 #define	fwopen(cookie, fn) funopen(cookie, 0, fn, 0, 0)
 #endif /* __BSD_VISIBLE */
 
-#if defined(__BIONIC_FORTIFY)
+extern char* __fgets_chk(char*, int, FILE*, size_t);
+extern char* __fgets_real(char*, int, FILE*) __RENAME(fgets);
+__errordecl(__fgets_too_big_error, "fgets called with size bigger than buffer");
+__errordecl(__fgets_too_small_error, "fgets called with size less than zero");
 
-__BEGIN_DECLS
+#if defined(__BIONIC_FORTIFY)
 
 __BIONIC_FORTIFY_INLINE
 __printflike(3, 0)
@@ -411,11 +404,6 @@
 }
 #endif
 
-extern char* __fgets_chk(char*, int, FILE*, size_t);
-extern char* __fgets_real(char*, int, FILE*) __asm__(__USER_LABEL_PREFIX__ "fgets");
-__errordecl(__fgets_too_big_error, "fgets called with size bigger than buffer");
-__errordecl(__fgets_too_small_error, "fgets called with size less than zero");
-
 #if !defined(__clang__)
 
 __BIONIC_FORTIFY_INLINE
@@ -450,8 +438,8 @@
 
 #endif /* !defined(__clang__) */
 
-__END_DECLS
-
 #endif /* defined(__BIONIC_FORTIFY) */
 
+__END_DECLS
+
 #endif /* _STDIO_H_ */
diff --git a/libc/include/string.h b/libc/include/string.h
index 8df68e3..f2f6dd2 100644
--- a/libc/include/string.h
+++ b/libc/include/string.h
@@ -92,16 +92,18 @@
 extern int    strcoll_l(const char *, const char *, locale_t) __purefunc;
 extern size_t strxfrm_l(char* __restrict, const char* __restrict, size_t, locale_t);
 
+extern char* __stpncpy_chk2(char* __restrict, const char* __restrict, size_t, size_t, size_t);
+extern char* __strncpy_chk2(char* __restrict, const char* __restrict, size_t, size_t, size_t);
+extern size_t __strlcpy_real(char* __restrict, const char* __restrict, size_t) __RENAME(strlcpy);
+extern size_t __strlcpy_chk(char *, const char *, size_t, size_t);
+extern size_t __strlcat_real(char* __restrict, const char* __restrict, size_t) __RENAME(strlcat);
+extern size_t __strlcat_chk(char* __restrict, const char* __restrict, size_t, size_t);
+
 #if defined(__BIONIC_FORTIFY)
 
 __BIONIC_FORTIFY_INLINE
 void* memcpy(void* __restrict dest, const void* __restrict src, size_t copy_amount) {
-    char *d = (char *) dest;
-    const char *s = (const char *) src;
-    size_t s_len = __bos0(s);
-    size_t d_len = __bos0(d);
-
-    return __builtin___memcpy_chk(dest, src, copy_amount, d_len);
+    return __builtin___memcpy_chk(dest, src, copy_amount, __bos0(dest));
 }
 
 __BIONIC_FORTIFY_INLINE
@@ -119,8 +121,6 @@
     return __builtin___strcpy_chk(dest, src, __bos(dest));
 }
 
-extern char* __stpncpy_chk2(char* __restrict, const char* __restrict, size_t, size_t, size_t);
-
 __BIONIC_FORTIFY_INLINE
 char* stpncpy(char* __restrict dest, const char* __restrict src, size_t n) {
     size_t bos_dest = __bos(dest);
@@ -142,8 +142,6 @@
     return __stpncpy_chk2(dest, src, n, bos_dest, bos_src);
 }
 
-extern char* __strncpy_chk2(char* __restrict, const char* __restrict, size_t, size_t, size_t);
-
 __BIONIC_FORTIFY_INLINE
 char* strncpy(char* __restrict dest, const char* __restrict src, size_t n) {
     size_t bos_dest = __bos(dest);
@@ -180,10 +178,6 @@
     return __builtin___memset_chk(s, c, n, __bos0(s));
 }
 
-extern size_t __strlcpy_real(char* __restrict, const char* __restrict, size_t)
-    __asm__(__USER_LABEL_PREFIX__ "strlcpy");
-extern size_t __strlcpy_chk(char *, const char *, size_t, size_t);
-
 __BIONIC_FORTIFY_INLINE
 size_t strlcpy(char* __restrict dest, const char* __restrict src, size_t size) {
     size_t bos = __bos(dest);
@@ -204,10 +198,6 @@
     return __strlcpy_chk(dest, src, size, bos);
 }
 
-extern size_t __strlcat_real(char* __restrict, const char* __restrict, size_t)
-    __asm__(__USER_LABEL_PREFIX__ "strlcat");
-extern size_t __strlcat_chk(char* __restrict, const char* __restrict, size_t, size_t);
-
 
 __BIONIC_FORTIFY_INLINE
 size_t strlcat(char* __restrict dest, const char* __restrict src, size_t size) {
diff --git a/libc/include/sys/_system_properties.h b/libc/include/sys/_system_properties.h
index 5a681df..0349e4c 100644
--- a/libc/include/sys/_system_properties.h
+++ b/libc/include/sys/_system_properties.h
@@ -81,6 +81,7 @@
 #define PROP_PATH_RAMDISK_DEFAULT  "/default.prop"
 #define PROP_PATH_SYSTEM_BUILD     "/system/build.prop"
 #define PROP_PATH_SYSTEM_DEFAULT   "/system/default.prop"
+#define PROP_PATH_VENDOR_BUILD     "/vendor/build.prop"
 #define PROP_PATH_LOCAL_OVERRIDE   "/data/local.prop"
 #define PROP_PATH_FACTORY          "/factory/factory.prop"
 
diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
index 9a8dfdd..504e439 100644
--- a/libc/include/sys/cdefs.h
+++ b/libc/include/sys/cdefs.h
@@ -53,6 +53,9 @@
 #ifndef __has_builtin
 #define __has_builtin(x)        0
 #endif
+#ifndef __has_attribute
+#define __has_attribute(x)      0
+#endif
 
 
 /*
@@ -267,20 +270,6 @@
 #endif /* NO_KERNEL_RCSIDS */
 #endif /* _KERNEL */
 
-#if !defined(_STANDALONE) && !defined(_KERNEL)
-#ifdef __GNUC__
-#define	__RENAME(x)	___RENAME(x)
-#else
-#ifdef __lint__
-#define	__RENAME(x)	__symbolrename(x)
-#else
-#error "No function renaming possible"
-#endif /* __lint__ */
-#endif /* __GNUC__ */
-#else /* _STANDALONE || _KERNEL */
-#define	__RENAME(x)	no renaming in kernel or standalone environment
-#endif
-
 /*
  * A barrier to stop the optimizer from moving code or assume live
  * register values. This is gcc specific, the version is more or less
@@ -359,60 +348,15 @@
 #endif
 
 /*
- * Macros for manipulating "link sets".  Link sets are arrays of pointers
- * to objects, which are gathered up by the linker.
- *
- * Object format-specific code has provided us with the following macros:
- *
- *	__link_set_add_text(set, sym)
- *		Add a reference to the .text symbol `sym' to `set'.
- *
- *	__link_set_add_rodata(set, sym)
- *		Add a reference to the .rodata symbol `sym' to `set'.
- *
- *	__link_set_add_data(set, sym)
- *		Add a reference to the .data symbol `sym' to `set'.
- *
- *	__link_set_add_bss(set, sym)
- *		Add a reference to the .bss symbol `sym' to `set'.
- *
- *	__link_set_decl(set, ptype)
- *		Provide an extern declaration of the set `set', which
- *		contains an array of the pointer type `ptype'.  This
- *		macro must be used by any code which wishes to reference
- *		the elements of a link set.
- *
- *	__link_set_start(set)
- *		This points to the first slot in the link set.
- *
- *	__link_set_end(set)
- *		This points to the (non-existent) slot after the last
- *		entry in the link set.
- *
- *	__link_set_count(set)
- *		Count the number of entries in link set `set'.
- *
- * In addition, we provide the following macros for accessing link sets:
- *
- *	__link_set_foreach(pvar, set)
- *		Iterate over the link set `set'.  Because a link set is
- *		an array of pointers, pvar must be declared as "type **pvar",
- *		and the actual entry accessed as "*pvar".
- *
- *	__link_set_entry(set, idx)
- *		Access the link set entry at index `idx' from set `set'.
+ * Some BSD source needs these macros.
+ * Originally they embedded the rcs versions of each source file
+ * in the generated binary. We strip strings during build anyway,.
  */
-#define	__link_set_foreach(pvar, set)					\
-	for (pvar = __link_set_start(set); pvar < __link_set_end(set); pvar++)
-
-#define	__link_set_entry(set, idx)	(__link_set_begin(set)[idx])
-
-/*
- * Some of the FreeBSD sources used in Bionic need this.
- * Originally, this is used to embed the rcs versions of each source file
- * in the generated binary. We certainly don't want this in Bionic.
- */
-#define __FBSDID(s) /* nothing */
+#define __IDSTRING(_prefix,_s) /* nothing */
+#define __COPYRIGHT(_s) /* nothing */
+#define __FBSDID(_s) /* nothing */
+#define __RCSID(_s) /* nothing */
+#define __SCCSID(_s) /* nothing */
 
 /*-
  * The following definitions are an extension of the behavior originally
@@ -570,11 +514,28 @@
 #endif
 #define __bos0(s) __builtin_object_size((s), 0)
 
-#define __BIONIC_FORTIFY_INLINE \
-    extern __inline__ \
-    __attribute__ ((always_inline)) \
-    __attribute__ ((gnu_inline))
+#if __GNUC_PREREQ(4,3) || __has_attribute(__artificial__)
+#define __BIONIC_FORTIFY_INLINE extern __inline__ __always_inline __attribute__((gnu_inline)) __attribute__((__artificial__))
+#else
+#define __BIONIC_FORTIFY_INLINE extern __inline__ __always_inline __attribute__((gnu_inline))
+#endif
 #endif
 #define __BIONIC_FORTIFY_UNKNOWN_SIZE ((size_t) -1)
 
+/* Used to tag non-static symbols that are private and never exposed by the shared library. */
+#define __LIBC_HIDDEN__ __attribute__((visibility("hidden")))
+
+/* Like __LIBC_HIDDEN__, but preserves binary compatibility for LP32. */
+#ifdef __LP64__
+#define __LIBC64_HIDDEN__ __LIBC_HIDDEN__
+#else
+#define __LIBC64_HIDDEN__ __LIBC_ABI_PUBLIC__
+#endif
+
+/* Used to tag non-static symbols that are public and exposed by the shared library. */
+#define __LIBC_ABI_PUBLIC__ __attribute__((visibility ("default")))
+
+/* Used to rename functions so that the compiler emits a call to 'x' rather than the function this was applied to. */
+#define __RENAME(x) __asm__(#x)
+
 #endif /* !_SYS_CDEFS_H_ */
diff --git a/libc/include/sys/cdefs_elf.h b/libc/include/sys/cdefs_elf.h
index 4dd7dc3..6bb0a57 100644
--- a/libc/include/sys/cdefs_elf.h
+++ b/libc/include/sys/cdefs_elf.h
@@ -30,27 +30,13 @@
 #ifndef _SYS_CDEFS_ELF_H_
 #define	_SYS_CDEFS_ELF_H_
 
-#ifdef __LEADING_UNDERSCORE
-#define	_C_LABEL(x)	__CONCAT(_,x)
-#define _C_LABEL_STRING(x)	"_"x
-#else
-#define	_C_LABEL(x)	x
-#define _C_LABEL_STRING(x)	x
-#endif
+#define __strong_alias(alias, sym) \
+    __asm__(".global " #alias "\n" \
+            #alias " = " #sym);
 
-#define	___RENAME(x)	__asm__(___STRING(_C_LABEL(x)))
-
-#define	__indr_reference(sym,alias)	/* nada, since we do weak refs */
-
-#define	__strong_alias(alias,sym)	       				\
-    __asm__(".global " _C_LABEL_STRING(#alias) "\n"			\
-	    _C_LABEL_STRING(#alias) " = " _C_LABEL_STRING(#sym));
-
-#define	__weak_alias(alias,sym)						\
-    __asm__(".weak " _C_LABEL_STRING(#alias) "\n"			\
-	    _C_LABEL_STRING(#alias) " = " _C_LABEL_STRING(#sym));
-#define	__weak_extern(sym)						\
-    __asm__(".weak " _C_LABEL_STRING(#sym));
+#define __weak_alias(alias,sym) \
+    __asm__(".weak " #alias "\n" \
+            #alias " = " #sym);
 
 /* We use __warnattr instead of __warn_references.
  * TODO: remove this and put an empty definition in one of the upstream-* compatibility headers.
@@ -58,74 +44,4 @@
 #define	__warn_references(sym,msg)					\
     /*__asm__(".section .gnu.warning." #sym "\n\t.ascii \"" msg "\"\n\t.text");*/
 
-#define	__SECTIONSTRING(_sec, _str)					\
-	__asm__(".section " #_sec "\n\t.asciz \"" _str "\"\n\t.previous")
-
-/* Used to tag non-static symbols that are private and never exposed by the shared library. */
-#define __LIBC_HIDDEN__ __attribute__((visibility ("hidden")))
-
-/* Like __LIBC_HIDDEN__, but preserves binary compatibility for LP32. */
-#ifdef __LP64__
-#define __LIBC64_HIDDEN__ __LIBC_HIDDEN__
-#else
-#define __LIBC64_HIDDEN__ __LIBC_ABI_PUBLIC__
-#endif
-
-/* Used to tag non-static symbols that are public and exposed by the shared library. */
-#define __LIBC_ABI_PUBLIC__ __attribute__((visibility ("default")))
-
-#define	__IDSTRING(_n,_s)		__SECTIONSTRING(.ident,_s)
-
-#define	__RCSID(_s)			__IDSTRING(rcsid,_s)
-#define	__SCCSID(_s)
-#define __SCCSID2(_s)
-#if 0	/* XXX userland __COPYRIGHTs have \ns in them */
-#define	__COPYRIGHT(_s)			__SECTIONSTRING(.copyright,_s)
-#else
-#define	__COPYRIGHT(_s)							\
-	static const char copyright[]					\
-	    __attribute__((__unused__,__section__(".copyright"))) = _s
-#endif
-
-#define	__KERNEL_RCSID(_n, _s)		__RCSID(_s)
-#define	__KERNEL_SCCSID(_n, _s)
-#if 0	/* XXX see above */
-#define	__KERNEL_COPYRIGHT(_n, _s)	__COPYRIGHT(_s)
-#else
-#define	__KERNEL_COPYRIGHT(_n, _s)	__SECTIONSTRING(.copyright, _s)
-#endif
-
-#ifndef __lint__
-#define	__link_set_make_entry(set, sym)					\
-	static void const * const __link_set_##set##_sym_##sym		\
-	    __section("link_set_" #set) __used = &sym
-#define	__link_set_make_entry2(set, sym, n)				\
-	static void const * const __link_set_##set##_sym_##sym##_##n	\
-	    __section("link_set_" #set) __used = &sym[n]
-#else
-#define	__link_set_make_entry(set, sym)					\
-	extern void const * const __link_set_##set##_sym_##sym
-#define	__link_set_make_entry2(set, sym, n)				\
-	extern void const * const __link_set_##set##_sym_##sym##_##n
-#endif /* __lint__ */
-
-#define	__link_set_add_text(set, sym)	__link_set_make_entry(set, sym)
-#define	__link_set_add_rodata(set, sym)	__link_set_make_entry(set, sym)
-#define	__link_set_add_data(set, sym)	__link_set_make_entry(set, sym)
-#define	__link_set_add_bss(set, sym)	__link_set_make_entry(set, sym)
-#define	__link_set_add_text2(set, sym, n)   __link_set_make_entry2(set, sym, n)
-#define	__link_set_add_rodata2(set, sym, n) __link_set_make_entry2(set, sym, n)
-#define	__link_set_add_data2(set, sym, n)   __link_set_make_entry2(set, sym, n)
-#define	__link_set_add_bss2(set, sym, n)    __link_set_make_entry2(set, sym, n)
-
-#define	__link_set_decl(set, ptype)					\
-	extern ptype * const __start_link_set_##set[];			\
-	extern ptype * const __stop_link_set_##set[]			\
-
-#define	__link_set_start(set)	(__start_link_set_##set)
-#define	__link_set_end(set)	(__stop_link_set_##set)
-
-#define	__link_set_count(set)						\
-	(__link_set_end(set) - __link_set_start(set))
-
 #endif /* !_SYS_CDEFS_ELF_H_ */
diff --git a/libc/include/sys/select.h b/libc/include/sys/select.h
index 4ddcb6a..32c1206 100644
--- a/libc/include/sys/select.h
+++ b/libc/include/sys/select.h
@@ -51,10 +51,11 @@
 
 #define FD_ZERO(set) (memset(set, 0, sizeof(*(fd_set*)(set))))
 
-#if defined(__BIONIC_FORTIFY)
 extern void __FD_CLR_chk(int, fd_set*, size_t);
 extern void __FD_SET_chk(int, fd_set*, size_t);
 extern int  __FD_ISSET_chk(int, fd_set*, size_t);
+
+#if defined(__BIONIC_FORTIFY)
 #define FD_CLR(fd, set) __FD_CLR_chk(fd, set, __bos(set))
 #define FD_SET(fd, set) __FD_SET_chk(fd, set, __bos(set))
 #define FD_ISSET(fd, set) __FD_ISSET_chk(fd, set, __bos(set))
diff --git a/libc/include/sys/socket.h b/libc/include/sys/socket.h
index ae2f238..43d1586 100644
--- a/libc/include/sys/socket.h
+++ b/libc/include/sys/socket.h
@@ -291,11 +291,11 @@
 __socketcall ssize_t sendto(int, const void*, size_t, int, const struct sockaddr*, socklen_t);
 __socketcall ssize_t recvfrom(int, void*, size_t, int, const struct sockaddr*, socklen_t*);
 
-#if defined(__BIONIC_FORTIFY)
 __errordecl(__recvfrom_error, "recvfrom called with size bigger than buffer");
 extern ssize_t __recvfrom_chk(int, void*, size_t, size_t, int, const struct sockaddr*, socklen_t*);
-extern ssize_t __recvfrom_real(int, void*, size_t, int, const struct sockaddr*, socklen_t*)
-    __asm__(__USER_LABEL_PREFIX__ "recvfrom");
+extern ssize_t __recvfrom_real(int, void*, size_t, int, const struct sockaddr*, socklen_t*) __RENAME(recvfrom);
+
+#if defined(__BIONIC_FORTIFY)
 
 __BIONIC_FORTIFY_INLINE
 ssize_t recvfrom(int fd, void* buf, size_t len, int flags, const struct sockaddr* src_addr, socklen_t* addr_len) {
diff --git a/libc/include/sys/stat.h b/libc/include/sys/stat.h
index c0c168b..9c7373a 100644
--- a/libc/include/sys/stat.h
+++ b/libc/include/sys/stat.h
@@ -159,12 +159,12 @@
 extern int mknod(const char*, mode_t, dev_t);
 extern mode_t umask(mode_t);
 
-#if defined(__BIONIC_FORTIFY)
-
 extern mode_t __umask_chk(mode_t);
-extern mode_t __umask_real(mode_t) __asm__(__USER_LABEL_PREFIX__ "umask");
+extern mode_t __umask_real(mode_t) __RENAME(umask);
 __errordecl(__umask_invalid_mode, "umask called with invalid mode");
 
+#if defined(__BIONIC_FORTIFY)
+
 __BIONIC_FORTIFY_INLINE
 mode_t umask(mode_t mode) {
 #if !defined(__clang__)
diff --git a/libc/include/sys/sysconf.h b/libc/include/sys/sysconf.h
index 0a46e7a..3d058d7 100644
--- a/libc/include/sys/sysconf.h
+++ b/libc/include/sys/sysconf.h
@@ -129,7 +129,7 @@
 #define _SC_AVPHYS_PAGES                0x0063
 #define _SC_MONOTONIC_CLOCK             0x0064
 
-extern int sysconf(int name);
+long sysconf(int);
 
 __END_DECLS
 
diff --git a/libc/include/sys/ucontext.h b/libc/include/sys/ucontext.h
index f62380d..dd2a0bb 100644
--- a/libc/include/sys/ucontext.h
+++ b/libc/include/sys/ucontext.h
@@ -68,11 +68,9 @@
   struct ucontext* uc_link;
   stack_t uc_stack;
   mcontext_t uc_mcontext;
+  sigset_t uc_sigmask;
   // Android has a wrong (smaller) sigset_t on ARM.
-  union {
-    sigset_t bionic;
-    uint32_t kernel[2];
-  } uc_sigmask;
+  uint32_t __padding_rt_sigset;
   // The kernel adds extra padding after uc_sigmask to match glibc sigset_t on ARM.
   char __padding[120];
   unsigned long uc_regspace[128] __attribute__((__aligned__(8)));
@@ -80,6 +78,10 @@
 
 #elif defined(__aarch64__)
 
+#define NGREG 34 /* x0..x30 + sp + pc + pstate */
+typedef unsigned long greg_t;
+typedef greg_t gregset_t[NGREG];
+
 #include <asm/sigcontext.h>
 typedef struct sigcontext mcontext_t;
 
@@ -152,11 +154,9 @@
   struct ucontext* uc_link;
   stack_t uc_stack;
   mcontext_t uc_mcontext;
+  sigset_t uc_sigmask;
   // Android has a wrong (smaller) sigset_t on x86.
-  union {
-    sigset_t bionic;
-    uint32_t kernel[2];
-  } uc_sigmask;
+  uint32_t __padding_rt_sigset;
   struct _libc_fpstate __fpregs_mem;
 } ucontext_t;
 
diff --git a/libc/include/sys/user.h b/libc/include/sys/user.h
index 18684f1..0e36825 100644
--- a/libc/include/sys/user.h
+++ b/libc/include/sys/user.h
@@ -91,7 +91,7 @@
   unsigned long start_stack;
   long int signal;
   int reserved;
-  unsigned long u_ar0;
+  struct user_regs_struct* u_ar0;
   struct user_fpregs_struct* u_fpstate;
   unsigned long magic;
   char u_comm[32];
@@ -108,7 +108,7 @@
   __u64 rip;
   __u64 rdp;
   __u32 mxcsr;
-  __u32 mxcsr_mask;
+  __u32 mxcr_mask;
   __u32 st_space[32];
   __u32 xmm_space[64];
   __u32 padding[24];
@@ -155,7 +155,7 @@
   long int signal;
   int reserved;
   int pad1;
-  unsigned long u_ar0;
+  struct user_regs_struct* u_ar0;
   struct user_fpregs_struct* u_fpstate;
   unsigned long magic;
   char u_comm[32];
@@ -175,7 +175,7 @@
   unsigned long start_data;
   unsigned long start_stack;
   long int signal;
-  unsigned long u_ar0;
+  void* u_ar0;
   unsigned long magic;
   char u_comm[32];
 };
diff --git a/libc/include/unistd.h b/libc/include/unistd.h
index 7fbafdf..1bfdb0e 100644
--- a/libc/include/unistd.h
+++ b/libc/include/unistd.h
@@ -177,7 +177,7 @@
 
 int getpagesize(void);
 
-extern int sysconf(int  name);
+long sysconf(int);
 
 extern int daemon(int, int);
 
@@ -197,12 +197,12 @@
     } while (_rc == -1 && errno == EINTR); \
     _rc; })
 
-#if defined(__BIONIC_FORTIFY)
 extern ssize_t __read_chk(int, void*, size_t, size_t);
 __errordecl(__read_dest_size_error, "read called with size bigger than destination");
 __errordecl(__read_count_toobig_error, "read called with count > SSIZE_MAX");
-extern ssize_t __read_real(int, void*, size_t)
-    __asm__(__USER_LABEL_PREFIX__ "read");
+extern ssize_t __read_real(int, void*, size_t) __RENAME(read);
+
+#if defined(__BIONIC_FORTIFY)
 
 __BIONIC_FORTIFY_INLINE
 ssize_t read(int fd, void* buf, size_t count) {
diff --git a/libc/private/ScopeGuard.h b/libc/private/ScopeGuard.h
index 183e322..d5a9235 100644
--- a/libc/private/ScopeGuard.h
+++ b/libc/private/ScopeGuard.h
@@ -14,8 +14,10 @@
  * limitations under the License.
  */
 
-#ifndef SCOPE_GUARD_H
-#define SCOPE_GUARD_H
+#ifndef _SCOPE_GUARD_H
+#define _SCOPE_GUARD_H
+
+#include "private/bionic_macros.h"
 
 // TODO: include explicit std::move when it becomes available
 template<typename F>
@@ -40,14 +42,12 @@
   F f_;
   bool active_;
 
-  ScopeGuard() = delete;
-  ScopeGuard(const ScopeGuard&) = delete;
-  ScopeGuard& operator=(const ScopeGuard&) = delete;
+  DISALLOW_IMPLICIT_CONSTRUCTORS(ScopeGuard);
 };
 
 template<typename T>
-ScopeGuard<T> create_scope_guard(T f) {
+ScopeGuard<T> make_scope_guard(T f) {
   return ScopeGuard<T>(f);
 }
 
-#endif  // SCOPE_GUARD_H
+#endif  // _SCOPE_GUARD_H
diff --git a/libc/private/UniquePtr.h b/libc/private/UniquePtr.h
new file mode 100644
index 0000000..5ac7599
--- /dev/null
+++ b/libc/private/UniquePtr.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UNIQUE_PTR_H_included
+#define UNIQUE_PTR_H_included
+
+// Default deleter for pointer types.
+template <typename T>
+struct DefaultDelete {
+    enum { type_must_be_complete = sizeof(T) };
+    DefaultDelete() {}
+    void operator()(T* p) const {
+        delete p;
+    }
+};
+
+// Default deleter for array types.
+template <typename T>
+struct DefaultDelete<T[]> {
+    enum { type_must_be_complete = sizeof(T) };
+    void operator()(T* p) const {
+        delete[] p;
+    }
+};
+
+// A smart pointer that deletes the given pointer on destruction.
+// Equivalent to C++0x's std::unique_ptr (a combination of boost::scoped_ptr
+// and boost::scoped_array).
+// Named to be in keeping with Android style but also to avoid
+// collision with any other implementation, until we can switch over
+// to unique_ptr.
+// Use thus:
+//   UniquePtr<C> c(new C);
+template <typename T, typename D = DefaultDelete<T> >
+class UniquePtr {
+public:
+    // Construct a new UniquePtr, taking ownership of the given raw pointer.
+    explicit UniquePtr(T* ptr = nullptr) : mPtr(ptr) { }
+
+    UniquePtr(UniquePtr<T, D>&& that) {
+      mPtr = that.mPtr;
+      that.mPtr = nullptr;
+    }
+
+    ~UniquePtr() {
+        reset();
+    }
+
+    // Accessors.
+    T& operator*() const { return *mPtr; }
+    T* operator->() const { return mPtr; }
+    T* get() const { return mPtr; }
+
+    // Returns the raw pointer and hands over ownership to the caller.
+    // The pointer will not be deleted by UniquePtr.
+    T* release() __attribute__((warn_unused_result)) {
+        T* result = mPtr;
+        mPtr = nullptr;
+        return result;
+    }
+
+    // Takes ownership of the given raw pointer.
+    // If this smart pointer previously owned a different raw pointer, that
+    // raw pointer will be freed.
+    void reset(T* ptr = nullptr) {
+        if (ptr != mPtr) {
+            D()(mPtr);
+            mPtr = ptr;
+        }
+    }
+
+private:
+    // The raw pointer.
+    T* mPtr;
+
+    // Comparing unique pointers is probably a mistake, since they're unique.
+    template <typename T2> bool operator==(const UniquePtr<T2>& p) const = delete;
+    template <typename T2> bool operator!=(const UniquePtr<T2>& p) const = delete;
+
+    // Disallow copy and assignment.
+    UniquePtr(const UniquePtr&) = delete;
+    void operator=(const UniquePtr&) = delete;
+};
+
+// Partial specialization for array types. Like std::unique_ptr, this removes
+// operator* and operator-> but adds operator[].
+template <typename T, typename D>
+class UniquePtr<T[], D> {
+public:
+    explicit UniquePtr(T* ptr = NULL) : mPtr(ptr) {
+    }
+    UniquePtr(UniquePtr<T, D>&& that) {
+      mPtr = that.mPtr;
+      that.mPtr = nullptr;
+    }
+
+    ~UniquePtr() {
+        reset();
+    }
+
+    T& operator[](size_t i) const {
+        return mPtr[i];
+    }
+    T* get() const { return mPtr; }
+
+    T* release() __attribute__((warn_unused_result)) {
+        T* result = mPtr;
+        mPtr = NULL;
+        return result;
+    }
+
+    void reset(T* ptr = NULL) {
+        if (ptr != mPtr) {
+            D()(mPtr);
+            mPtr = ptr;
+        }
+    }
+
+private:
+    T* mPtr;
+
+    // Disallow copy and assignment.
+    UniquePtr(const UniquePtr&) = delete;
+    void operator=(const UniquePtr&) = delete;
+};
+
+#endif  // UNIQUE_PTR_H_included
diff --git a/libc/private/bionic_macros.h b/libc/private/bionic_macros.h
index 61794bd..491b3ac 100644
--- a/libc/private/bionic_macros.h
+++ b/libc/private/bionic_macros.h
@@ -20,8 +20,8 @@
 // DISALLOW_COPY_AND_ASSIGN disallows the copy and operator= functions.
 // It goes in the private: declarations in a class.
 #define DISALLOW_COPY_AND_ASSIGN(TypeName) \
-  TypeName(const TypeName&);               \
-  void operator=(const TypeName&)
+  TypeName(const TypeName&) = delete;      \
+  void operator=(const TypeName&) = delete
 
 // A macro to disallow all the implicit constructors, namely the
 // default constructor, copy constructor and operator= functions.
@@ -30,7 +30,7 @@
 // that wants to prevent anyone from instantiating it. This is
 // especially useful for classes containing only static methods.
 #define DISALLOW_IMPLICIT_CONSTRUCTORS(TypeName) \
-  TypeName();                                    \
+  TypeName() = delete;                           \
   DISALLOW_COPY_AND_ASSIGN(TypeName)
 
 #define BIONIC_ALIGN(value, alignment) \
diff --git a/libc/stdio/fileext.h b/libc/stdio/fileext.h
index 1f2a3a3..c074b4b 100644
--- a/libc/stdio/fileext.h
+++ b/libc/stdio/fileext.h
@@ -34,6 +34,8 @@
 
 #include <pthread.h>
 
+__BEGIN_DECLS
+
 /*
  * file extension
  */
@@ -63,4 +65,6 @@
 	_FILEEXT_INIT(f); \
 } while (0)
 
+__END_DECLS
+
 #endif /* _FILEEXT_H_ */
diff --git a/libc/upstream-openbsd/lib/libc/stdio/findfp.c b/libc/stdio/findfp.c
similarity index 88%
rename from libc/upstream-openbsd/lib/libc/stdio/findfp.c
rename to libc/stdio/findfp.c
index b8c7dc1..cfbb66b 100644
--- a/libc/upstream-openbsd/lib/libc/stdio/findfp.c
+++ b/libc/stdio/findfp.c
@@ -44,15 +44,17 @@
 #define ALIGNBYTES (sizeof(uintptr_t) - 1)
 #define ALIGN(p) (((uintptr_t)(p) + ALIGNBYTES) &~ ALIGNBYTES)
 
+#undef stdin
+#undef stdout
+#undef stderr
+
 int	__sdidinit;
 
 #define	NDYNAMIC 10		/* add ten more whenever necessary */
 
 #define	std(flags, file) \
-	{0,0,0,flags,file,{0,0},0,__sF+file,__sclose,__sread,__sseek,__swrite, \
-	 {(unsigned char *)(__sFext+file), 0},NULL,0,{0,0,0},{0},{0,0},0,0}
-/*	 p r w flags file _bf z  cookie      close    read    seek    write
-	 ext */
+	{0,0,0,flags,file,{0},0,__sF+file,__sclose,__sread,__sseek,__swrite, \
+	    {(unsigned char *)(__sFext+file), 0},NULL,0,{0},{0},{0},0,0}
 
 				/* the usual - (stdin + stdout + stderr) */
 static FILE usual[FOPEN_MAX - 3];
@@ -67,6 +69,9 @@
 	std(__SWR, STDOUT_FILENO),		/* stdout */
 	std(__SWR|__SNBF, STDERR_FILENO)	/* stderr */
 };
+FILE* stdin = &__sF[0];
+FILE* stdout = &__sF[1];
+FILE* stderr = &__sF[2];
 struct glue __sglue = { &uglue, 3, __sF };
 
 static struct glue *
@@ -165,17 +170,26 @@
 __sinit(void)
 {
 	_THREAD_PRIVATE_MUTEX(__sinit_mutex);
-	int i;
 
 	_THREAD_PRIVATE_MUTEX_LOCK(__sinit_mutex);
-	if (__sdidinit)
-		goto out;	/* bail out if caller lost the race */
-	for (i = 0; i < FOPEN_MAX - 3; i++) {
+	if (__sdidinit) {
+		/* bail out if caller lost the race */
+		_THREAD_PRIVATE_MUTEX_UNLOCK(__sinit_mutex);
+		return;
+	}
+
+	/* Initialize stdin/stdout/stderr (for the recursive mutex). http://b/18208568. */
+	for (size_t i = 0; i < 3; ++i) {
+		_FILEEXT_SETUP(__sF+i, __sFext+i);
+	}
+	/* Initialize the pre-allocated (but initially unused) streams. */
+	for (size_t i = 0; i < FOPEN_MAX - 3; ++i) {
 		_FILEEXT_SETUP(usual+i, usualext+i);
 	}
+
 	/* make sure we clean up on exit */
 	__atexit_register_cleanup(_cleanup); /* conservative */
 	__sdidinit = 1;
-out:
+
 	_THREAD_PRIVATE_MUTEX_UNLOCK(__sinit_mutex);
 }
diff --git a/libc/upstream-openbsd/lib/libc/stdio/fread.c b/libc/stdio/fread.c
similarity index 84%
rename from libc/upstream-openbsd/lib/libc/stdio/fread.c
rename to libc/stdio/fread.c
index 8a592f6..e052128 100644
--- a/libc/upstream-openbsd/lib/libc/stdio/fread.c
+++ b/libc/stdio/fread.c
@@ -68,7 +68,23 @@
 		fp->_r = 0;
 	total = resid;
 	p = buf;
-	while (resid > (r = fp->_r)) {
+
+	// BEGIN android-added
+	// Avoid pathological behavior on unbuffered files. OpenBSD
+	// will loop reading one byte then memcpying one byte!
+	if ((fp->_flags & __SNBF) != 0) {
+		// We know if we're unbuffered that our buffer is empty, so
+		// we can just read directly.
+		while (resid > 0 && (r = (*fp->_read)(fp->_cookie, p, resid)) > 0) {
+			p += r;
+			resid -= r;
+		}
+		FUNLOCKFILE(fp);
+		return ((total - resid) / size);
+	}
+	// END android-added
+
+	while (resid > (size_t)(r = fp->_r)) {
 		(void)memcpy((void *)p, (void *)fp->_p, (size_t)r);
 		fp->_p += r;
 		/* fp->_r = 0 ... done in __srefill */
diff --git a/libc/stdio/glue.h b/libc/stdio/glue.h
index 4ead20a..a9e5d10 100644
--- a/libc/stdio/glue.h
+++ b/libc/stdio/glue.h
@@ -32,6 +32,10 @@
  * SUCH DAMAGE.
  */
 
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
 /*
  * The first few FILEs are statically allocated; others are dynamically
  * allocated and linked in via this glue structure.
@@ -44,3 +48,5 @@
 
 /* This was referenced by a couple of different pieces of middleware and the Crystax NDK. */
 __LIBC64_HIDDEN__ extern struct glue __sglue;
+
+__END_DECLS
diff --git a/libc/stdio/local.h b/libc/stdio/local.h
index 13188ee..46b11f1 100644
--- a/libc/stdio/local.h
+++ b/libc/stdio/local.h
@@ -41,6 +41,8 @@
 #include "wcio.h"
 #include "fileext.h"
 
+__BEGIN_DECLS
+
 /*
  * Android <= KitKat had getc/putc macros in <stdio.h> that referred
  * to __srget/__swbuf, so those symbols need to be public for LP32
@@ -137,3 +139,5 @@
 wint_t __fputwc_unlock(wchar_t wc, FILE *fp);
 
 #pragma GCC visibility pop
+
+__END_DECLS
diff --git a/libc/stdio/wcio.h b/libc/stdio/wcio.h
index 584a3f2..2c1fa3c 100644
--- a/libc/stdio/wcio.h
+++ b/libc/stdio/wcio.h
@@ -32,6 +32,10 @@
 #ifndef _WCIO_H_
 #define _WCIO_H_
 
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
 /* minimal requirement of SUSv2 */
 #define WCIO_UNGETWC_BUFSIZE 1
 
@@ -78,4 +82,6 @@
 #define WCIO_INIT(fp) \
 	memset(&(_EXT(fp)->_wcio), 0, sizeof(struct wchar_io_data))
 
+__END_DECLS
+
 #endif /*_WCIO_H_*/
diff --git a/libc/tools/zoneinfo/ZoneCompactor.java b/libc/tools/zoneinfo/ZoneCompactor.java
index bf3153e..2d598fe 100644
--- a/libc/tools/zoneinfo/ZoneCompactor.java
+++ b/libc/tools/zoneinfo/ZoneCompactor.java
@@ -132,9 +132,15 @@
         throw new RuntimeException("zone filename too long: " + zoneName.length());
       }
 
+      // Follow the chain of links to work out where the real data for this zone lives.
+      String actualZoneName = zoneName;
+      while (links.get(actualZoneName) != null) {
+        actualZoneName = links.get(actualZoneName);
+      }
+
       f.write(toAscii(new byte[MAXNAME], zoneName));
-      f.writeInt(offsets.get(zoneName));
-      f.writeInt(lengths.get(zoneName));
+      f.writeInt(offsets.get(actualZoneName));
+      f.writeInt(lengths.get(actualZoneName));
       f.writeInt(0); // Used to be raw GMT offset. No longer used.
     }
 
diff --git a/libc/tools/zoneinfo/update-tzdata.py b/libc/tools/zoneinfo/update-tzdata.py
index e800e8f..4847356 100755
--- a/libc/tools/zoneinfo/update-tzdata.py
+++ b/libc/tools/zoneinfo/update-tzdata.py
@@ -13,8 +13,11 @@
 import tarfile
 import tempfile
 
-regions = ['africa', 'antarctica', 'asia', 'australasia', 'backward',
-           'etcetera', 'europe', 'northamerica', 'southamerica']
+regions = ['africa', 'antarctica', 'asia', 'australasia',
+           'etcetera', 'europe', 'northamerica', 'southamerica',
+           # These two deliberately come last so they override what came
+           # before (and each other).
+           'backward', 'backzone' ]
 
 def CheckDirExists(dir, dirname):
   if not os.path.isdir(dir):
@@ -49,16 +52,16 @@
       fields = line.split()
       if fields:
         if fields[0] == 'Link':
-          links.append('%s %s %s\n' % (fields[0], fields[1], fields[2]))
+          links.append('%s %s %s' % (fields[0], fields[1], fields[2]))
           zones.append(fields[2])
         elif fields[0] == 'Zone':
           zones.append(fields[1])
   zones.sort()
 
   setup = open('setup', 'w')
-  for link in links:
-    setup.write(link)
-  for zone in zones:
+  for link in sorted(set(links)):
+    setup.write('%s\n' % link)
+  for zone in sorted(set(zones)):
     setup.write('%s\n' % zone)
   setup.close()
 
@@ -114,27 +117,37 @@
   # Build the ICU tools.
   print 'Configuring ICU tools...'
   subprocess.check_call(['%s/runConfigureICU' % icu_dir, 'Linux'])
-  print 'Making ICU tools...'
-  subprocess.check_call(['make', '-j32'])
 
   # Run the ICU tools.
   os.chdir('tools/tzcode')
+
+  # The tz2icu tool only picks up icuregions and icuzones in they are in the CWD
+  for icu_data_file in [ 'icuregions', 'icuzones']:
+    icu_data_file_source = '%s/tools/tzcode/%s' % (icu_dir, icu_data_file)
+    icu_data_file_symlink = './%s' % icu_data_file
+    os.symlink(icu_data_file_source, icu_data_file_symlink)
+
   shutil.copyfile('%s/%s' % (original_working_dir, data_filename), data_filename)
   print 'Making ICU data...'
+  # The Makefile assumes the existence of the bin directory.
+  os.mkdir('%s/bin' % icu_working_dir)
   subprocess.check_call(['make'])
 
-  # Copy the output files to their ultimate destination.
+  # Copy the source file to its ultimate destination.
   icu_txt_data_dir = '%s/data/misc' % icu_dir
   print 'Copying zoneinfo64.txt to %s ...' % icu_txt_data_dir
   shutil.copy('zoneinfo64.txt', icu_txt_data_dir)
 
+  # Regenerate the .dat file.
   os.chdir(icu_working_dir)
+  subprocess.check_call(['make', '-j32'])
+
+  # Copy the .dat file to its ultimate destination.
   icu_dat_data_dir = '%s/stubdata' % icu_dir
   datfiles = glob.glob('data/out/tmp/icudt??l.dat')
   if len(datfiles) != 1:
     print 'ERROR: Unexpectedly found %d .dat files (%s). Halting.' % (len(datfiles), datfiles)
     sys.exit(1)
-
   datfile = datfiles[0]
   print 'Copying %s to %s ...' % (datfile, icu_dat_data_dir)
   shutil.copy(datfile, icu_dat_data_dir)
@@ -162,9 +175,10 @@
 
   print 'Calling zic(1)...'
   os.mkdir('data')
-  for region in regions:
-    if region != 'backward':
-      subprocess.check_call(['zic', '-d', 'data', 'extracted/%s' % region])
+  zic_inputs = [ 'extracted/%s' % x for x in regions ]
+  zic_cmd = ['zic', '-d', 'data' ]
+  zic_cmd.extend(zic_inputs)
+  subprocess.check_call(zic_cmd)
 
   WriteSetupFile()
 
diff --git a/libc/tzcode/localtime.c b/libc/tzcode/localtime.c
index 3bbed90..28d13f4 100644
--- a/libc/tzcode/localtime.c
+++ b/libc/tzcode/localtime.c
@@ -2252,14 +2252,11 @@
 }
 
 static int __bionic_open_tzdata(const char* olson_id, int* data_size) {
-  int fd = __bionic_open_tzdata_path("ANDROID_DATA", "/misc/zoneinfo/tzdata", olson_id, data_size);
-  if (fd < 0) {
-    fd = __bionic_open_tzdata_path("ANDROID_ROOT", "/usr/share/zoneinfo/tzdata", olson_id, data_size);
-    if (fd == -2) {
-      // The first thing that 'recovery' does is try to format the current time. It doesn't have
-      // any tzdata available, so we must not abort here --- doing so breaks the recovery image!
-      fprintf(stderr, "%s: couldn't find any tzdata when looking for %s!\n", __FUNCTION__, olson_id);
-    }
+  int fd = __bionic_open_tzdata_path("ANDROID_ROOT", "/usr/share/zoneinfo/tzdata", olson_id, data_size);
+  if (fd == -2) {
+    // The first thing that 'recovery' does is try to format the current time. It doesn't have
+    // any tzdata available, so we must not abort here --- doing so breaks the recovery image!
+    fprintf(stderr, "%s: couldn't find any tzdata when looking for %s!\n", __FUNCTION__, olson_id);
   }
   return fd;
 }
diff --git a/libc/upstream-dlmalloc/malloc.c b/libc/upstream-dlmalloc/malloc.c
index 4362f49..3c9d36b 100644
--- a/libc/upstream-dlmalloc/malloc.c
+++ b/libc/upstream-dlmalloc/malloc.c
@@ -3526,7 +3526,9 @@
       nm.arena    = sum;
       nm.ordblks  = nfree;
       nm.hblkhd   = m->footprint - sum;
-      nm.usmblks  = m->max_footprint;
+      /* BEGIN android-changed: usmblks set to footprint from max_footprint */
+      nm.usmblks  = m->footprint;
+      /* END android-changed */
       nm.uordblks = m->footprint - mfree;
       nm.fordblks = mfree;
       nm.keepcost = m->topsize;
diff --git a/libc/zoneinfo/tzdata b/libc/zoneinfo/tzdata
index 8d574f5..b9a6621 100644
--- a/libc/zoneinfo/tzdata
+++ b/libc/zoneinfo/tzdata
Binary files differ
diff --git a/linker/Android.mk b/linker/Android.mk
index 5853c90..4298032 100644
--- a/linker/Android.mk
+++ b/linker/Android.mk
@@ -8,6 +8,7 @@
     linker.cpp \
     linker_allocator.cpp \
     linker_environ.cpp \
+    linker_libc_support.c \
     linker_phdr.cpp \
     rt.cpp \
 
diff --git a/linker/debugger.cpp b/linker/debugger.cpp
index c316151..ac466a5 100644
--- a/linker/debugger.cpp
+++ b/linker/debugger.cpp
@@ -162,12 +162,12 @@
     thread_name[MAX_TASK_NAME_LEN] = 0;
   }
 
-  // "info" will be NULL if the siginfo_t information was not available.
+  // "info" will be null if the siginfo_t information was not available.
   // Many signals don't have an address or a code.
   char code_desc[32]; // ", code -6"
   char addr_desc[32]; // ", fault addr 0x1234"
   addr_desc[0] = code_desc[0] = 0;
-  if (info != NULL) {
+  if (info != nullptr) {
     // For a rethrown signal, this si_code will be right and the one debuggerd shows will
     // always be SI_TKILL.
     __libc_format_buffer(code_desc, sizeof(code_desc), ", code %d", info->si_code);
@@ -198,7 +198,7 @@
   }
   bool result = (old_action.sa_flags & SA_SIGINFO) != 0;
 
-  if (sigaction(signum, &old_action, NULL) == -1) {
+  if (sigaction(signum, &old_action, nullptr) == -1) {
     __libc_format_log(ANDROID_LOG_WARN, "libc", "Restore failed in test for SA_SIGINFO: %s",
                       strerror(errno));
   }
@@ -215,7 +215,7 @@
     return;
   }
 
-  int s = socket_abstract_client(DEBUGGER_SOCKET_NAME, SOCK_STREAM);
+  int s = socket_abstract_client(DEBUGGER_SOCKET_NAME, SOCK_STREAM | SOCK_CLOEXEC);
   if (s == -1) {
     __libc_format_log(ANDROID_LOG_FATAL, "libc", "Unable to open connection to debuggerd: %s",
                       strerror(errno));
@@ -230,7 +230,7 @@
   msg.action = DEBUGGER_ACTION_CRASH;
   msg.tid = gettid();
   msg.abort_msg_address = reinterpret_cast<uintptr_t>(g_abort_message);
-  msg.original_si_code = (info != NULL) ? info->si_code : 0;
+  msg.original_si_code = (info != nullptr) ? info->si_code : 0;
   int ret = TEMP_FAILURE_RETRY(write(s, &msg, sizeof(msg)));
   if (ret == sizeof(msg)) {
     char debuggerd_ack;
@@ -255,7 +255,7 @@
   // It's possible somebody cleared the SA_SIGINFO flag, which would mean
   // our "info" arg holds an undefined value.
   if (!have_siginfo(signal_number)) {
-    info = NULL;
+    info = nullptr;
   }
 
   log_signal_summary(signal_number, info);
@@ -296,14 +296,14 @@
   // Use the alternate signal stack if available so we can catch stack overflows.
   action.sa_flags |= SA_ONSTACK;
 
-  sigaction(SIGABRT, &action, NULL);
-  sigaction(SIGBUS, &action, NULL);
-  sigaction(SIGFPE, &action, NULL);
-  sigaction(SIGILL, &action, NULL);
-  sigaction(SIGPIPE, &action, NULL);
-  sigaction(SIGSEGV, &action, NULL);
+  sigaction(SIGABRT, &action, nullptr);
+  sigaction(SIGBUS, &action, nullptr);
+  sigaction(SIGFPE, &action, nullptr);
+  sigaction(SIGILL, &action, nullptr);
+  sigaction(SIGPIPE, &action, nullptr);
+  sigaction(SIGSEGV, &action, nullptr);
 #if defined(SIGSTKFLT)
-  sigaction(SIGSTKFLT, &action, NULL);
+  sigaction(SIGSTKFLT, &action, nullptr);
 #endif
-  sigaction(SIGTRAP, &action, NULL);
+  sigaction(SIGTRAP, &action, nullptr);
 }
diff --git a/linker/dlfcn.cpp b/linker/dlfcn.cpp
index 5d6db8e..3eb5bea 100644
--- a/linker/dlfcn.cpp
+++ b/linker/dlfcn.cpp
@@ -42,7 +42,7 @@
 static void __bionic_format_dlerror(const char* msg, const char* detail) {
   char* buffer = __get_thread()->dlerror_buffer;
   strlcpy(buffer, msg, __BIONIC_DLERROR_BUFFER_SIZE);
-  if (detail != NULL) {
+  if (detail != nullptr) {
     strlcat(buffer, ": ", __BIONIC_DLERROR_BUFFER_SIZE);
     strlcat(buffer, detail, __BIONIC_DLERROR_BUFFER_SIZE);
   }
@@ -51,7 +51,7 @@
 }
 
 const char* dlerror() {
-  const char* old_value = __bionic_set_dlerror(NULL);
+  const char* old_value = __bionic_set_dlerror(nullptr);
   return old_value;
 }
 
@@ -68,9 +68,9 @@
 static void* dlopen_ext(const char* filename, int flags, const android_dlextinfo* extinfo) {
   ScopedPthreadMutexLocker locker(&g_dl_mutex);
   soinfo* result = do_dlopen(filename, flags, extinfo);
-  if (result == NULL) {
+  if (result == nullptr) {
     __bionic_format_dlerror("dlopen failed", linker_get_error_buffer());
-    return NULL;
+    return nullptr;
   }
   return result;
 }
@@ -80,33 +80,33 @@
 }
 
 void* dlopen(const char* filename, int flags) {
-  return dlopen_ext(filename, flags, NULL);
+  return dlopen_ext(filename, flags, nullptr);
 }
 
 void* dlsym(void* handle, const char* symbol) {
   ScopedPthreadMutexLocker locker(&g_dl_mutex);
 
 #if !defined(__LP64__)
-  if (handle == NULL) {
-    __bionic_format_dlerror("dlsym library handle is null", NULL);
-    return NULL;
+  if (handle == nullptr) {
+    __bionic_format_dlerror("dlsym library handle is null", nullptr);
+    return nullptr;
   }
 #endif
 
-  if (symbol == NULL) {
-    __bionic_format_dlerror("dlsym symbol name is null", NULL);
-    return NULL;
+  if (symbol == nullptr) {
+    __bionic_format_dlerror("dlsym symbol name is null", nullptr);
+    return nullptr;
   }
 
-  soinfo* found = NULL;
-  ElfW(Sym)* sym = NULL;
+  soinfo* found = nullptr;
+  ElfW(Sym)* sym = nullptr;
   if (handle == RTLD_DEFAULT) {
-    sym = dlsym_linear_lookup(symbol, &found, NULL);
+    sym = dlsym_linear_lookup(symbol, &found, nullptr);
   } else if (handle == RTLD_NEXT) {
     void* caller_addr = __builtin_return_address(0);
     soinfo* si = find_containing_library(caller_addr);
 
-    sym = NULL;
+    sym = nullptr;
     if (si && si->next) {
       sym = dlsym_linear_lookup(symbol, &found, si->next);
     }
@@ -114,18 +114,18 @@
     sym = dlsym_handle_lookup(reinterpret_cast<soinfo*>(handle), &found, symbol);
   }
 
-  if (sym != NULL) {
+  if (sym != nullptr) {
     unsigned bind = ELF_ST_BIND(sym->st_info);
 
     if ((bind == STB_GLOBAL || bind == STB_WEAK) && sym->st_shndx != 0) {
-      return reinterpret_cast<void*>(sym->st_value + found->load_bias);
+      return reinterpret_cast<void*>(found->resolve_symbol_address(sym));
     }
 
     __bionic_format_dlerror("symbol found but not global", symbol);
-    return NULL;
+    return nullptr;
   } else {
     __bionic_format_dlerror("undefined symbol", symbol);
-    return NULL;
+    return nullptr;
   }
 }
 
@@ -134,7 +134,7 @@
 
   // Determine if this address can be found in any library currently mapped.
   soinfo* si = find_containing_library(addr);
-  if (si == NULL) {
+  if (si == nullptr) {
     return 0;
   }
 
@@ -146,9 +146,9 @@
 
   // Determine if any symbol in the library contains the specified address.
   ElfW(Sym)* sym = dladdr_find_symbol(si, addr);
-  if (sym != NULL) {
-    info->dli_sname = si->strtab + sym->st_name;
-    info->dli_saddr = reinterpret_cast<void*>(si->load_bias + sym->st_value);
+  if (sym != nullptr) {
+    info->dli_sname = si->get_string(sym->st_name);
+    info->dli_saddr = reinterpret_cast<void*>(si->resolve_symbol_address(sym));
   }
 
   return 1;
@@ -164,7 +164,7 @@
 // name_offset: starting index of the name in libdl_info.strtab
 #define ELF32_SYM_INITIALIZER(name_offset, value, shndx) \
     { name_offset, \
-      reinterpret_cast<Elf32_Addr>(reinterpret_cast<void*>(value)), \
+      reinterpret_cast<Elf32_Addr>(value), \
       /* st_size */ 0, \
       (shndx == 0) ? 0 : (STB_GLOBAL << 4), \
       /* st_other */ 0, \
@@ -176,7 +176,7 @@
       (shndx == 0) ? 0 : (STB_GLOBAL << 4), \
       /* st_other */ 0, \
       shndx, \
-      reinterpret_cast<Elf64_Addr>(reinterpret_cast<void*>(value)), \
+      reinterpret_cast<Elf64_Addr>(value), \
       /* st_size */ 0, \
     }
 
@@ -199,7 +199,7 @@
   // This is actually the STH_UNDEF entry. Technically, it's
   // supposed to have st_name == 0, but instead, it points to an index
   // in the strtab with a \0 to make iterating through the symtab easier.
-  ELFW(SYM_INITIALIZER)(sizeof(ANDROID_LIBDL_STRTAB) - 1, NULL, 0),
+  ELFW(SYM_INITIALIZER)(sizeof(ANDROID_LIBDL_STRTAB) - 1, nullptr, 0),
   ELFW(SYM_INITIALIZER)(  0, &dlopen, 1),
   ELFW(SYM_INITIALIZER)(  7, &dlclose, 1),
   ELFW(SYM_INITIALIZER)( 15, &dlsym, 1),
@@ -232,24 +232,20 @@
 static unsigned g_libdl_chains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 9, 0 };
 #endif
 
-// Defined as global because we do not yet have access
-// to synchronization functions __cxa_guard_* needed
-// to define statics inside functions.
-static soinfo __libdl_info;
+static soinfo __libdl_info("libdl.so", nullptr, 0);
 
 // This is used by the dynamic linker. Every process gets these symbols for free.
 soinfo* get_libdl_info() {
-  if (__libdl_info.name[0] == '\0') {
-    // initialize
-    strncpy(__libdl_info.name, "libdl.so", sizeof(__libdl_info.name));
-    __libdl_info.flags = FLAG_LINKED | FLAG_NEW_SOINFO;
+  if ((__libdl_info.flags & FLAG_LINKED) == 0) {
+    __libdl_info.flags |= FLAG_LINKED;
     __libdl_info.strtab = ANDROID_LIBDL_STRTAB;
     __libdl_info.symtab = g_libdl_symtab;
     __libdl_info.nbucket = sizeof(g_libdl_buckets)/sizeof(unsigned);
     __libdl_info.nchain = sizeof(g_libdl_chains)/sizeof(unsigned);
     __libdl_info.bucket = g_libdl_buckets;
     __libdl_info.chain = g_libdl_chains;
-    __libdl_info.has_DT_SYMBOLIC = true;
+    __libdl_info.ref_count = 1;
+    __libdl_info.strtab_size = sizeof(ANDROID_LIBDL_STRTAB);
   }
 
   return &__libdl_info;
diff --git a/linker/linked_list.h b/linker/linked_list.h
index 8096e62..4e62e20 100644
--- a/linker/linked_list.h
+++ b/linker/linked_list.h
@@ -32,6 +32,9 @@
 class LinkedList {
  public:
   LinkedList() : head_(nullptr), tail_(nullptr) {}
+  ~LinkedList() {
+    clear();
+  }
 
   void push_front(T* const element) {
     LinkedListEntry<T>* new_entry = Allocator::alloc();
@@ -83,26 +86,54 @@
   }
 
   template<typename F>
-  void for_each(F&& action) {
-    for (LinkedListEntry<T>* e = head_; e != nullptr; e = e->next) {
-      if (e->element != nullptr) {
-        action(e->element);
-      }
-    }
+  void for_each(F action) {
+    visit([&] (T* si) {
+      action(si);
+      return true;
+    });
   }
 
   template<typename F>
-  void remove_if(F&& predicate) {
+  bool visit(F action) {
     for (LinkedListEntry<T>* e = head_; e != nullptr; e = e->next) {
-      if (e->element != nullptr && predicate(e->element)) {
-        e->element = nullptr;
+      if (!action(e->element)) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  template<typename F>
+  void remove_if(F predicate) {
+    for (LinkedListEntry<T>* e = head_, *p = nullptr; e != nullptr;) {
+      if (predicate(e->element)) {
+        LinkedListEntry<T>* next = e->next;
+        if (p == nullptr) {
+          head_ = next;
+        } else {
+          p->next = next;
+        }
+        Allocator::free(e);
+        e = next;
+      } else {
+        p = e;
+        e = e->next;
       }
     }
   }
 
-  bool contains(const T* el) {
+  size_t copy_to_array(T* array[], size_t array_length) const {
+    size_t sz = 0;
+    for (LinkedListEntry<T>* e = head_; sz < array_length && e != nullptr; e = e->next) {
+      array[sz++] = e->element;
+    }
+
+    return sz;
+  }
+
+  bool contains(const T* el) const {
     for (LinkedListEntry<T>* e = head_; e != nullptr; e = e->next) {
-      if (e->element != nullptr && e->element == el) {
+      if (e->element == el) {
         return true;
       }
     }
diff --git a/linker/linker.cpp b/linker/linker.cpp
index cf65705..54867dc 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -35,14 +35,17 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
-#include <sys/stat.h>
 #include <unistd.h>
 
+#include <new>
+
 // Private C library headers.
 #include "private/bionic_tls.h"
 #include "private/KernelArgumentBlock.h"
 #include "private/ScopedPthreadMutexLocker.h"
 #include "private/ScopedFd.h"
+#include "private/ScopeGuard.h"
+#include "private/UniquePtr.h"
 
 #include "linker.h"
 #include "linker_debug.h"
@@ -78,7 +81,6 @@
 #define SEARCH_NAME(x) get_base_name(x)
 #endif
 
-static bool soinfo_link_image(soinfo* si, const android_dlextinfo* extinfo);
 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf);
 
 static LinkerAllocator<soinfo> g_soinfo_allocator;
@@ -86,7 +88,7 @@
 
 static soinfo* solist;
 static soinfo* sonext;
-static soinfo* somain; /* main process, always the one after libdl_info */
+static soinfo* somain; // main process, always the one after libdl_info
 
 static const char* const kDefaultLdPaths[] = {
 #if defined(__LP64__)
@@ -96,7 +98,7 @@
   "/vendor/lib",
   "/system/lib",
 #endif
-  NULL
+  nullptr
 };
 
 #define LDPATH_BUFSIZE (LDPATH_MAX*64)
@@ -115,25 +117,25 @@
 
 __LIBC_HIDDEN__ int g_ld_debug_verbosity;
 
-__LIBC_HIDDEN__ abort_msg_t* g_abort_message = NULL; // For debuggerd.
+__LIBC_HIDDEN__ abort_msg_t* g_abort_message = nullptr; // For debuggerd.
 
 enum RelocationKind {
-    kRelocAbsolute = 0,
-    kRelocRelative,
-    kRelocCopy,
-    kRelocSymbol,
-    kRelocMax
+  kRelocAbsolute = 0,
+  kRelocRelative,
+  kRelocCopy,
+  kRelocSymbol,
+  kRelocMax
 };
 
 #if STATS
 struct linker_stats_t {
-    int count[kRelocMax];
+  int count[kRelocMax];
 };
 
 static linker_stats_t linker_stats;
 
 static void count_relocation(RelocationKind kind) {
-    ++linker_stats.count[kind];
+  ++linker_stats.count[kind];
 }
 #else
 static void count_relocation(RelocationKind) {
@@ -145,13 +147,13 @@
 #if defined(__LP64__)
 #define MARK(offset) \
     do { \
-        if ((((offset) >> 12) >> 5) < 4096) \
-            bitmask[((offset) >> 12) >> 5] |= (1 << (((offset) >> 12) & 31)); \
+      if ((((offset) >> 12) >> 5) < 4096) \
+          bitmask[((offset) >> 12) >> 5] |= (1 << (((offset) >> 12) & 31)); \
     } while (0)
 #else
 #define MARK(offset) \
     do { \
-        bitmask[((offset) >> 12) >> 3] |= (1 << (((offset) >> 12) & 7)); \
+      bitmask[((offset) >> 12) >> 3] |= (1 << (((offset) >> 12) & 7)); \
     } while (0)
 #endif
 #else
@@ -163,14 +165,13 @@
 #define DISALLOW_ALLOCATION(return_type, name, ...) \
     return_type name __VA_ARGS__ \
     { \
-        __libc_fatal("ERROR: " #name " called from the dynamic linker!\n"); \
+      __libc_fatal("ERROR: " #name " called from the dynamic linker!\n"); \
     }
 DISALLOW_ALLOCATION(void*, malloc, (size_t u __unused));
 DISALLOW_ALLOCATION(void, free, (void* u __unused));
 DISALLOW_ALLOCATION(void*, realloc, (void* u1 __unused, size_t u2 __unused));
 DISALLOW_ALLOCATION(void*, calloc, (size_t u1 __unused, size_t u2 __unused));
 
-static char tmp_err_buf[768];
 static char __linker_dl_err_buf[768];
 
 char* linker_get_error_buffer() {
@@ -181,87 +182,84 @@
   return sizeof(__linker_dl_err_buf);
 }
 
-/*
- * This function is an empty stub where GDB locates a breakpoint to get notified
- * about linker activity.
- */
+// This function is an empty stub where GDB locates a breakpoint to get notified
+// about linker activity.
 extern "C" void __attribute__((noinline)) __attribute__((visibility("default"))) rtld_db_dlactivity();
 
 static pthread_mutex_t g__r_debug_mutex = PTHREAD_MUTEX_INITIALIZER;
-static r_debug _r_debug = {1, NULL, reinterpret_cast<uintptr_t>(&rtld_db_dlactivity), r_debug::RT_CONSISTENT, 0};
+static r_debug _r_debug = {1, nullptr, reinterpret_cast<uintptr_t>(&rtld_db_dlactivity), r_debug::RT_CONSISTENT, 0};
 static link_map* r_debug_tail = 0;
 
 static void insert_soinfo_into_debug_map(soinfo* info) {
-    // Copy the necessary fields into the debug structure.
-    link_map* map = &(info->link_map_head);
-    map->l_addr = info->load_bias;
-    map->l_name = reinterpret_cast<char*>(info->name);
-    map->l_ld = info->dynamic;
+  // Copy the necessary fields into the debug structure.
+  link_map* map = &(info->link_map_head);
+  map->l_addr = info->load_bias;
+  map->l_name = reinterpret_cast<char*>(info->name);
+  map->l_ld = info->dynamic;
 
-    /* Stick the new library at the end of the list.
-     * gdb tends to care more about libc than it does
-     * about leaf libraries, and ordering it this way
-     * reduces the back-and-forth over the wire.
-     */
-    if (r_debug_tail) {
-        r_debug_tail->l_next = map;
-        map->l_prev = r_debug_tail;
-        map->l_next = 0;
-    } else {
-        _r_debug.r_map = map;
-        map->l_prev = 0;
-        map->l_next = 0;
-    }
-    r_debug_tail = map;
+  // Stick the new library at the end of the list.
+  // gdb tends to care more about libc than it does
+  // about leaf libraries, and ordering it this way
+  // reduces the back-and-forth over the wire.
+  if (r_debug_tail) {
+    r_debug_tail->l_next = map;
+    map->l_prev = r_debug_tail;
+    map->l_next = 0;
+  } else {
+    _r_debug.r_map = map;
+    map->l_prev = 0;
+    map->l_next = 0;
+  }
+  r_debug_tail = map;
 }
 
 static void remove_soinfo_from_debug_map(soinfo* info) {
-    link_map* map = &(info->link_map_head);
+  link_map* map = &(info->link_map_head);
 
-    if (r_debug_tail == map) {
-        r_debug_tail = map->l_prev;
-    }
+  if (r_debug_tail == map) {
+    r_debug_tail = map->l_prev;
+  }
 
-    if (map->l_prev) {
-        map->l_prev->l_next = map->l_next;
-    }
-    if (map->l_next) {
-        map->l_next->l_prev = map->l_prev;
-    }
+  if (map->l_prev) {
+    map->l_prev->l_next = map->l_next;
+  }
+  if (map->l_next) {
+    map->l_next->l_prev = map->l_prev;
+  }
 }
 
 static void notify_gdb_of_load(soinfo* info) {
-    if (info->flags & FLAG_EXE) {
-        // GDB already knows about the main executable
-        return;
-    }
+  if (info->flags & FLAG_EXE) {
+    // GDB already knows about the main executable
+    return;
+  }
 
-    ScopedPthreadMutexLocker locker(&g__r_debug_mutex);
+  ScopedPthreadMutexLocker locker(&g__r_debug_mutex);
 
-    _r_debug.r_state = r_debug::RT_ADD;
-    rtld_db_dlactivity();
+  _r_debug.r_state = r_debug::RT_ADD;
+  rtld_db_dlactivity();
 
-    insert_soinfo_into_debug_map(info);
+  insert_soinfo_into_debug_map(info);
 
-    _r_debug.r_state = r_debug::RT_CONSISTENT;
-    rtld_db_dlactivity();
+  _r_debug.r_state = r_debug::RT_CONSISTENT;
+  rtld_db_dlactivity();
 }
 
 static void notify_gdb_of_unload(soinfo* info) {
-    if (info->flags & FLAG_EXE) {
-        // GDB already knows about the main executable
-        return;
-    }
+  if (info->flags & FLAG_EXE) {
+    // GDB already knows about the main executable
+    return;
+  }
 
-    ScopedPthreadMutexLocker locker(&g__r_debug_mutex);
+  ScopedPthreadMutexLocker locker(&g__r_debug_mutex);
 
-    _r_debug.r_state = r_debug::RT_DELETE;
-    rtld_db_dlactivity();
+  _r_debug.r_state = r_debug::RT_DELETE;
+  rtld_db_dlactivity();
 
-    remove_soinfo_from_debug_map(info);
+  remove_soinfo_from_debug_map(info);
 
-    _r_debug.r_state = r_debug::RT_CONSISTENT;
-    rtld_db_dlactivity();
+  _r_debug.r_state = r_debug::RT_CONSISTENT;
+  rtld_db_dlactivity();
 }
 
 void notify_gdb_of_libraries() {
@@ -284,23 +282,13 @@
   g_soinfo_links_allocator.protect_all(protection);
 }
 
-static soinfo* soinfo_alloc(const char* name, struct stat* file_stat) {
+static soinfo* soinfo_alloc(const char* name, struct stat* file_stat, off64_t file_offset) {
   if (strlen(name) >= SOINFO_NAME_LEN) {
     DL_ERR("library name \"%s\" too long", name);
-    return NULL;
+    return nullptr;
   }
 
-  soinfo* si = g_soinfo_allocator.alloc();
-
-  // Initialize the new element.
-  memset(si, 0, sizeof(soinfo));
-  strlcpy(si->name, name, sizeof(si->name));
-  si->flags = FLAG_NEW_SOINFO;
-
-  if (file_stat != NULL) {
-    si->set_st_dev(file_stat->st_dev);
-    si->set_st_ino(file_stat->st_ino);
-  }
+  soinfo* si = new (g_soinfo_allocator.alloc()) soinfo(name, file_stat, file_offset);
 
   sonext->next = si;
   sonext = si;
@@ -310,47 +298,47 @@
 }
 
 static void soinfo_free(soinfo* si) {
-    if (si == NULL) {
-        return;
+  if (si == nullptr) {
+    return;
+  }
+
+  if (si->base != 0 && si->size != 0) {
+    munmap(reinterpret_cast<void*>(si->base), si->size);
+  }
+
+  soinfo *prev = nullptr, *trav;
+
+  TRACE("name %s: freeing soinfo @ %p", si->name, si);
+
+  for (trav = solist; trav != nullptr; trav = trav->next) {
+    if (trav == si) {
+      break;
     }
+    prev = trav;
+  }
+  if (trav == nullptr) {
+    // si was not in solist
+    DL_ERR("name \"%s\" is not in solist!", si->name);
+    return;
+  }
 
-    if (si->base != 0 && si->size != 0) {
-      munmap(reinterpret_cast<void*>(si->base), si->size);
-    }
+  // clear links to/from si
+  si->remove_all_links();
 
-    soinfo *prev = NULL, *trav;
+  // prev will never be null, because the first entry in solist is
+  // always the static libdl_info.
+  prev->next = si->next;
+  if (si == sonext) {
+    sonext = prev;
+  }
 
-    TRACE("name %s: freeing soinfo @ %p", si->name, si);
-
-    for (trav = solist; trav != NULL; trav = trav->next) {
-        if (trav == si)
-            break;
-        prev = trav;
-    }
-    if (trav == NULL) {
-        /* si was not in solist */
-        DL_ERR("name \"%s\" is not in solist!", si->name);
-        return;
-    }
-
-    // clear links to/from si
-    si->remove_all_links();
-
-    /* prev will never be NULL, because the first entry in solist is
-       always the static libdl_info.
-    */
-    prev->next = si->next;
-    if (si == sonext) {
-        sonext = prev;
-    }
-
-    g_soinfo_allocator.free(si);
+  g_soinfo_allocator.free(si);
 }
 
 
 static void parse_path(const char* path, const char* delimiters,
                        const char** array, char* buf, size_t buf_size, size_t max_count) {
-  if (path == NULL) {
+  if (path == nullptr) {
     return;
   }
 
@@ -367,9 +355,9 @@
   // Forget the last path if we had to truncate; this occurs if the 2nd to
   // last char isn't '\0' (i.e. wasn't originally a delimiter).
   if (i > 0 && len >= buf_size && buf[buf_size - 2] != '\0') {
-    array[i - 1] = NULL;
+    array[i - 1] = nullptr;
   } else {
-    array[i] = NULL;
+    array[i] = nullptr;
   }
 }
 
@@ -386,60 +374,58 @@
 
 #if defined(__arm__)
 
-/* For a given PC, find the .so that it belongs to.
- * Returns the base address of the .ARM.exidx section
- * for that .so, and the number of 8-byte entries
- * in that section (via *pcount).
- *
- * Intended to be called by libc's __gnu_Unwind_Find_exidx().
- *
- * This function is exposed via dlfcn.cpp and libdl.so.
- */
+// For a given PC, find the .so that it belongs to.
+// Returns the base address of the .ARM.exidx section
+// for that .so, and the number of 8-byte entries
+// in that section (via *pcount).
+//
+// Intended to be called by libc's __gnu_Unwind_Find_exidx().
+//
+// This function is exposed via dlfcn.cpp and libdl.so.
 _Unwind_Ptr dl_unwind_find_exidx(_Unwind_Ptr pc, int* pcount) {
-    unsigned addr = (unsigned)pc;
+  unsigned addr = (unsigned)pc;
 
-    for (soinfo* si = solist; si != 0; si = si->next) {
-        if ((addr >= si->base) && (addr < (si->base + si->size))) {
-            *pcount = si->ARM_exidx_count;
-            return (_Unwind_Ptr)si->ARM_exidx;
-        }
+  for (soinfo* si = solist; si != 0; si = si->next) {
+    if ((addr >= si->base) && (addr < (si->base + si->size))) {
+        *pcount = si->ARM_exidx_count;
+        return (_Unwind_Ptr)si->ARM_exidx;
     }
-    *pcount = 0;
-    return NULL;
+  }
+  *pcount = 0;
+  return nullptr;
 }
 
 #endif
 
-/* Here, we only have to provide a callback to iterate across all the
- * loaded libraries. gcc_eh does the rest. */
+// Here, we only have to provide a callback to iterate across all the
+// loaded libraries. gcc_eh does the rest.
 int dl_iterate_phdr(int (*cb)(dl_phdr_info* info, size_t size, void* data), void* data) {
-    int rv = 0;
-    for (soinfo* si = solist; si != NULL; si = si->next) {
-        dl_phdr_info dl_info;
-        dl_info.dlpi_addr = si->link_map_head.l_addr;
-        dl_info.dlpi_name = si->link_map_head.l_name;
-        dl_info.dlpi_phdr = si->phdr;
-        dl_info.dlpi_phnum = si->phnum;
-        rv = cb(&dl_info, sizeof(dl_phdr_info), data);
-        if (rv != 0) {
-            break;
-        }
+  int rv = 0;
+  for (soinfo* si = solist; si != nullptr; si = si->next) {
+    dl_phdr_info dl_info;
+    dl_info.dlpi_addr = si->link_map_head.l_addr;
+    dl_info.dlpi_name = si->link_map_head.l_name;
+    dl_info.dlpi_phdr = si->phdr;
+    dl_info.dlpi_phnum = si->phnum;
+    rv = cb(&dl_info, sizeof(dl_phdr_info), data);
+    if (rv != 0) {
+      break;
     }
-    return rv;
+  }
+  return rv;
 }
 
 static ElfW(Sym)* soinfo_elf_lookup(soinfo* si, unsigned hash, const char* name) {
   ElfW(Sym)* symtab = si->symtab;
-  const char* strtab = si->strtab;
 
   TRACE_TYPE(LOOKUP, "SEARCH %s in %s@%p %x %zd",
              name, si->name, reinterpret_cast<void*>(si->base), hash, hash % si->nbucket);
 
   for (unsigned n = si->bucket[hash % si->nbucket]; n != 0; n = si->chain[n]) {
     ElfW(Sym)* s = symtab + n;
-    if (strcmp(strtab + s->st_name, name)) continue;
+    if (strcmp(si->get_string(s->st_name), name)) continue;
 
-    /* only concern ourselves with global and weak symbol definitions */
+    // only concern ourselves with global and weak symbol definitions
     switch (ELF_ST_BIND(s->st_info)) {
       case STB_GLOBAL:
       case STB_WEAK:
@@ -463,159 +449,204 @@
              name, si->name, reinterpret_cast<void*>(si->base), hash, hash % si->nbucket);
 
 
-  return NULL;
+  return nullptr;
+}
+
+soinfo::soinfo(const char* name, const struct stat* file_stat, off64_t file_offset) {
+  memset(this, 0, sizeof(*this));
+
+  strlcpy(this->name, name, sizeof(this->name));
+  flags = FLAG_NEW_SOINFO;
+  version = SOINFO_VERSION;
+
+  if (file_stat != nullptr) {
+    this->st_dev = file_stat->st_dev;
+    this->st_ino = file_stat->st_ino;
+    this->file_offset = file_offset;
+  }
 }
 
 static unsigned elfhash(const char* _name) {
-    const unsigned char* name = reinterpret_cast<const unsigned char*>(_name);
-    unsigned h = 0, g;
+  const unsigned char* name = reinterpret_cast<const unsigned char*>(_name);
+  unsigned h = 0, g;
 
-    while (*name) {
-        h = (h << 4) + *name++;
-        g = h & 0xf0000000;
-        h ^= g;
-        h ^= g >> 24;
-    }
-    return h;
+  while (*name) {
+    h = (h << 4) + *name++;
+    g = h & 0xf0000000;
+    h ^= g;
+    h ^= g >> 24;
+  }
+  return h;
 }
 
-static ElfW(Sym)* soinfo_do_lookup(soinfo* si, const char* name, soinfo** lsi, soinfo* needed[]) {
-    unsigned elf_hash = elfhash(name);
-    ElfW(Sym)* s = NULL;
+static ElfW(Sym)* soinfo_do_lookup(soinfo* si, const char* name, soinfo** lsi) {
+  unsigned elf_hash = elfhash(name);
+  ElfW(Sym)* s = nullptr;
 
-    if (si != NULL && somain != NULL) {
-        /*
-         * Local scope is executable scope. Just start looking into it right away
-         * for the shortcut.
-         */
-
-        if (si == somain) {
-            s = soinfo_elf_lookup(si, elf_hash, name);
-            if (s != NULL) {
-                *lsi = si;
-                goto done;
-            }
-
-            /* Next, look for it in the preloads list */
-            for (int i = 0; g_ld_preloads[i] != NULL; i++) {
-                s = soinfo_elf_lookup(g_ld_preloads[i], elf_hash, name);
-                if (s != NULL) {
-                    *lsi = g_ld_preloads[i];
-                    goto done;
-                }
-            }
-        } else {
-            /* Order of symbol lookup is controlled by DT_SYMBOLIC flag */
-
-            /*
-             * If this object was built with symbolic relocations disabled, the
-             * first place to look to resolve external references is the main
-             * executable.
-             */
-
-            if (!si->has_DT_SYMBOLIC) {
-                DEBUG("%s: looking up %s in executable %s",
-                      si->name, name, somain->name);
-                s = soinfo_elf_lookup(somain, elf_hash, name);
-                if (s != NULL) {
-                    *lsi = somain;
-                    goto done;
-                }
-
-                /* Next, look for it in the preloads list */
-                for (int i = 0; g_ld_preloads[i] != NULL; i++) {
-                    s = soinfo_elf_lookup(g_ld_preloads[i], elf_hash, name);
-                    if (s != NULL) {
-                        *lsi = g_ld_preloads[i];
-                        goto done;
-                    }
-                }
-            }
-
-            /* Look for symbols in the local scope (the object who is
-             * searching). This happens with C++ templates on x86 for some
-             * reason.
-             *
-             * Notes on weak symbols:
-             * The ELF specs are ambiguous about treatment of weak definitions in
-             * dynamic linking.  Some systems return the first definition found
-             * and some the first non-weak definition.   This is system dependent.
-             * Here we return the first definition found for simplicity.  */
-
-            s = soinfo_elf_lookup(si, elf_hash, name);
-            if (s != NULL) {
-                *lsi = si;
-                goto done;
-            }
-
-            /*
-             * If this object was built with -Bsymbolic and symbol is not found
-             * in the local scope, try to find the symbol in the main executable.
-             */
-
-            if (si->has_DT_SYMBOLIC) {
-                DEBUG("%s: looking up %s in executable %s after local scope",
-                      si->name, name, somain->name);
-                s = soinfo_elf_lookup(somain, elf_hash, name);
-                if (s != NULL) {
-                    *lsi = somain;
-                    goto done;
-                }
-
-                /* Next, look for it in the preloads list */
-                for (int i = 0; g_ld_preloads[i] != NULL; i++) {
-                    s = soinfo_elf_lookup(g_ld_preloads[i], elf_hash, name);
-                    if (s != NULL) {
-                        *lsi = g_ld_preloads[i];
-                        goto done;
-                    }
-                }
-            }
-        }
+  /* "This element's presence in a shared object library alters the dynamic linker's
+   * symbol resolution algorithm for references within the library. Instead of starting
+   * a symbol search with the executable file, the dynamic linker starts from the shared
+   * object itself. If the shared object fails to supply the referenced symbol, the
+   * dynamic linker then searches the executable file and other shared objects as usual."
+   *
+   * http://www.sco.com/developers/gabi/2012-12-31/ch5.dynamic.html
+   *
+   * Note that this is unlikely since static linker avoids generating
+   * relocations for -Bsymbolic linked dynamic executables.
+   */
+  if (si->has_DT_SYMBOLIC) {
+    DEBUG("%s: looking up %s in local scope (DT_SYMBOLIC)", si->name, name);
+    s = soinfo_elf_lookup(si, elf_hash, name);
+    if (s != nullptr) {
+      *lsi = si;
     }
-
-    for (int i = 0; needed[i] != NULL; i++) {
-        DEBUG("%s: looking up %s in %s",
-              si->name, name, needed[i]->name);
-        s = soinfo_elf_lookup(needed[i], elf_hash, name);
-        if (s != NULL) {
-            *lsi = needed[i];
-            goto done;
-        }
-    }
-
-done:
-    if (s != NULL) {
-        TRACE_TYPE(LOOKUP, "si %s sym %s s->st_value = %p, "
-                   "found in %s, base = %p, load bias = %p",
-                   si->name, name, reinterpret_cast<void*>(s->st_value),
-                   (*lsi)->name, reinterpret_cast<void*>((*lsi)->base),
-                   reinterpret_cast<void*>((*lsi)->load_bias));
-        return s;
-    }
-
-    return NULL;
-}
-
-// Another soinfo list allocator to use in dlsym. We don't reuse
-// SoinfoListAllocator because it is write-protected most of the time.
-static LinkerAllocator<LinkedListEntry<soinfo>> g_soinfo_list_allocator_rw;
-class SoinfoListAllocatorRW {
- public:
-  static LinkedListEntry<soinfo>* alloc() {
-    return g_soinfo_list_allocator_rw.alloc();
   }
 
-  static void free(LinkedListEntry<soinfo>* ptr) {
-    g_soinfo_list_allocator_rw.free(ptr);
+  if (s == nullptr && somain != nullptr) {
+    // 1. Look for it in the main executable unless we already did.
+    if (si != somain || !si->has_DT_SYMBOLIC) {
+      DEBUG("%s: looking up %s in executable %s",
+            si->name, name, somain->name);
+      s = soinfo_elf_lookup(somain, elf_hash, name);
+      if (s != nullptr) {
+        *lsi = somain;
+      }
+    }
+
+    // 2. Look for it in the ld_preloads
+    if (s == nullptr) {
+      for (int i = 0; g_ld_preloads[i] != NULL; i++) {
+        s = soinfo_elf_lookup(g_ld_preloads[i], elf_hash, name);
+        if (s != nullptr) {
+          *lsi = g_ld_preloads[i];
+          break;
+        }
+      }
+    }
+  }
+
+  /* Look for symbols in the local scope (the object who is
+   * searching). This happens with C++ templates on x86 for some
+   * reason.
+   *
+   * Notes on weak symbols:
+   * The ELF specs are ambiguous about treatment of weak definitions in
+   * dynamic linking.  Some systems return the first definition found
+   * and some the first non-weak definition.   This is system dependent.
+   * Here we return the first definition found for simplicity.  */
+
+  if (s == nullptr && !si->has_DT_SYMBOLIC) {
+    DEBUG("%s: looking up %s in local scope", si->name, name);
+    s = soinfo_elf_lookup(si, elf_hash, name);
+    if (s != nullptr) {
+      *lsi = si;
+    }
+  }
+
+  if (s == nullptr) {
+    si->get_children().visit([&](soinfo* child) {
+      DEBUG("%s: looking up %s in %s", si->name, name, child->name);
+      s = soinfo_elf_lookup(child, elf_hash, name);
+      if (s != nullptr) {
+        *lsi = child;
+        return false;
+      }
+      return true;
+    });
+  }
+
+  if (s != nullptr) {
+    TRACE_TYPE(LOOKUP, "si %s sym %s s->st_value = %p, "
+               "found in %s, base = %p, load bias = %p",
+               si->name, name, reinterpret_cast<void*>(s->st_value),
+               (*lsi)->name, reinterpret_cast<void*>((*lsi)->base),
+               reinterpret_cast<void*>((*lsi)->load_bias));
+  }
+
+  return s;
+}
+
+// Each size has it's own allocator.
+template<size_t size>
+class SizeBasedAllocator {
+ public:
+  static void* alloc() {
+    return allocator_.alloc();
+  }
+
+  static void free(void* ptr) {
+    allocator_.free(ptr);
+  }
+
+ private:
+  static LinkerBlockAllocator allocator_;
+};
+
+template<size_t size>
+LinkerBlockAllocator SizeBasedAllocator<size>::allocator_(size);
+
+template<typename T>
+class TypeBasedAllocator {
+ public:
+  static T* alloc() {
+    return reinterpret_cast<T*>(SizeBasedAllocator<sizeof(T)>::alloc());
+  }
+
+  static void free(T* ptr) {
+    SizeBasedAllocator<sizeof(T)>::free(ptr);
   }
 };
 
+class LoadTask {
+ public:
+  struct deleter_t {
+    void operator()(LoadTask* t) {
+      TypeBasedAllocator<LoadTask>::free(t);
+    }
+  };
+
+  typedef UniquePtr<LoadTask, deleter_t> unique_ptr;
+
+  static deleter_t deleter;
+
+  static LoadTask* create(const char* name, soinfo* needed_by) {
+    LoadTask* ptr = TypeBasedAllocator<LoadTask>::alloc();
+    return new (ptr) LoadTask(name, needed_by);
+  }
+
+  const char* get_name() const {
+    return name_;
+  }
+
+  soinfo* get_needed_by() const {
+    return needed_by_;
+  }
+ private:
+  LoadTask(const char* name, soinfo* needed_by)
+    : name_(name), needed_by_(needed_by) {}
+
+  const char* name_;
+  soinfo* needed_by_;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(LoadTask);
+};
+
+LoadTask::deleter_t LoadTask::deleter;
+
+template <typename T>
+using linked_list_t = LinkedList<T, TypeBasedAllocator<LinkedListEntry<T>>>;
+
+typedef linked_list_t<soinfo> SoinfoLinkedList;
+typedef linked_list_t<const char> StringLinkedList;
+typedef linked_list_t<LoadTask> LoadTaskList;
+
+
 // This is used by dlsym(3).  It performs symbol lookup only within the
 // specified soinfo object and its dependencies in breadth first order.
 ElfW(Sym)* dlsym_handle_lookup(soinfo* si, soinfo** found, const char* name) {
-  LinkedList<soinfo, SoinfoListAllocatorRW> visit_list;
-  LinkedList<soinfo, SoinfoListAllocatorRW> visited;
+  SoinfoLinkedList visit_list;
+  SoinfoLinkedList visited;
+
   visit_list.push_back(si);
   soinfo* current_soinfo;
   while ((current_soinfo = visit_list.pop_front()) != nullptr) {
@@ -627,8 +658,6 @@
 
     if (result != nullptr) {
       *found = current_soinfo;
-      visit_list.clear();
-      visited.clear();
       return result;
     }
     visited.push_back(current_soinfo);
@@ -638,8 +667,6 @@
     });
   }
 
-  visit_list.clear();
-  visited.clear();
   return nullptr;
 }
 
@@ -651,20 +678,20 @@
 ElfW(Sym)* dlsym_linear_lookup(const char* name, soinfo** found, soinfo* start) {
   unsigned elf_hash = elfhash(name);
 
-  if (start == NULL) {
+  if (start == nullptr) {
     start = solist;
   }
 
-  ElfW(Sym)* s = NULL;
-  for (soinfo* si = start; (s == NULL) && (si != NULL); si = si->next) {
+  ElfW(Sym)* s = nullptr;
+  for (soinfo* si = start; (s == nullptr) && (si != nullptr); si = si->next) {
     s = soinfo_elf_lookup(si, elf_hash, name);
-    if (s != NULL) {
+    if (s != nullptr) {
       *found = si;
       break;
     }
   }
 
-  if (s != NULL) {
+  if (s != nullptr) {
     TRACE_TYPE(LOOKUP, "%s s->st_value = %p, found->base = %p",
                name, reinterpret_cast<void*>(s->st_value), reinterpret_cast<void*>((*found)->base));
   }
@@ -674,12 +701,12 @@
 
 soinfo* find_containing_library(const void* p) {
   ElfW(Addr) address = reinterpret_cast<ElfW(Addr)>(p);
-  for (soinfo* si = solist; si != NULL; si = si->next) {
+  for (soinfo* si = solist; si != nullptr; si = si->next) {
     if (address >= si->base && address - si->base < si->size) {
       return si;
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 ElfW(Sym)* dladdr_find_symbol(soinfo* si, const void* addr) {
@@ -696,12 +723,12 @@
     }
   }
 
-  return NULL;
+  return nullptr;
 }
 
 static int open_library_on_path(const char* name, const char* const paths[]) {
   char buf[512];
-  for (size_t i = 0; paths[i] != NULL; ++i) {
+  for (size_t i = 0; paths[i] != nullptr; ++i) {
     int n = __libc_format_buffer(buf, sizeof(buf), "%s/%s", paths[i], name);
     if (n < 0 || n >= static_cast<int>(sizeof(buf))) {
       PRINT("Warning: ignoring very long library path: %s/%s", paths[i], name);
@@ -719,7 +746,7 @@
   TRACE("[ opening %s ]", name);
 
   // If the name contains a slash, we should attempt to open it directly and not search the paths.
-  if (strchr(name, '/') != NULL) {
+  if (strchr(name, '/') != nullptr) {
     int fd = TEMP_FAILURE_RETRY(open(name, O_RDONLY | O_CLOEXEC));
     if (fd != -1) {
       return fd;
@@ -738,112 +765,218 @@
   return fd;
 }
 
-static soinfo* load_library(const char* name, int dlflags, const android_dlextinfo* extinfo) {
-    int fd = -1;
-    ScopedFd file_guard(-1);
+template<typename F>
+static void for_each_dt_needed(const soinfo* si, F action) {
+  for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
+    if (d->d_tag == DT_NEEDED) {
+      action(si->get_string(d->d_un.d_val));
+    }
+  }
+}
 
-    if (extinfo != NULL && (extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD) != 0) {
-      fd = extinfo->library_fd;
-    } else {
-      // Open the file.
-      fd = open_library(name);
-      if (fd == -1) {
-        DL_ERR("library \"%s\" not found", name);
-        return NULL;
-      }
+static soinfo* load_library(LoadTaskList& load_tasks, const char* name, int dlflags, const android_dlextinfo* extinfo) {
+  int fd = -1;
+  off64_t file_offset = 0;
+  ScopedFd file_guard(-1);
 
-      file_guard.reset(fd);
+  if (extinfo != nullptr && (extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD) != 0) {
+    fd = extinfo->library_fd;
+    if ((extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET) != 0) {
+      file_offset = extinfo->library_fd_offset;
+    }
+  } else {
+    // Open the file.
+    fd = open_library(name);
+    if (fd == -1) {
+      DL_ERR("library \"%s\" not found", name);
+      return nullptr;
     }
 
-    ElfReader elf_reader(name, fd);
+    file_guard.reset(fd);
+  }
 
-    struct stat file_stat;
-    if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
-      DL_ERR("unable to stat file for the library %s: %s", name, strerror(errno));
-      return NULL;
+  if ((file_offset % PAGE_SIZE) != 0) {
+    DL_ERR("file offset for the library \"%s\" is not page-aligned: %" PRId64, name, file_offset);
+    return nullptr;
+  }
+
+  struct stat file_stat;
+  if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
+    DL_ERR("unable to stat file for the library \"%s\": %s", name, strerror(errno));
+    return nullptr;
+  }
+
+  // Check for symlink and other situations where
+  // file can have different names.
+  for (soinfo* si = solist; si != nullptr; si = si->next) {
+    if (si->get_st_dev() != 0 &&
+        si->get_st_ino() != 0 &&
+        si->get_st_dev() == file_stat.st_dev &&
+        si->get_st_ino() == file_stat.st_ino &&
+        si->get_file_offset() == file_offset) {
+      TRACE("library \"%s\" is already loaded under different name/path \"%s\" - will return existing soinfo", name, si->name);
+      return si;
     }
+  }
 
-    // Check for symlink and other situations where
-    // file can have different names.
-    for (soinfo* si = solist; si != NULL; si = si->next) {
-      if (si->get_st_dev() != 0 &&
-          si->get_st_ino() != 0 &&
-          si->get_st_dev() == file_stat.st_dev &&
-          si->get_st_ino() == file_stat.st_ino) {
-        TRACE("library \"%s\" is already loaded under different name/path \"%s\" - will return existing soinfo", name, si->name);
-        return si;
-      }
-    }
+  if ((dlflags & RTLD_NOLOAD) != 0) {
+    DL_ERR("library \"%s\" wasn't loaded and RTLD_NOLOAD prevented it", name);
+    return nullptr;
+  }
 
-    if ((dlflags & RTLD_NOLOAD) != 0) {
-      return NULL;
-    }
+  // Read the ELF header and load the segments.
+  ElfReader elf_reader(name, fd, file_offset);
+  if (!elf_reader.Load(extinfo)) {
+    return nullptr;
+  }
 
-    // Read the ELF header and load the segments.
-    if (!elf_reader.Load(extinfo)) {
-        return NULL;
-    }
+  soinfo* si = soinfo_alloc(SEARCH_NAME(name), &file_stat, file_offset);
+  if (si == nullptr) {
+    return nullptr;
+  }
+  si->base = elf_reader.load_start();
+  si->size = elf_reader.load_size();
+  si->load_bias = elf_reader.load_bias();
+  si->phnum = elf_reader.phdr_count();
+  si->phdr = elf_reader.loaded_phdr();
 
-    soinfo* si = soinfo_alloc(SEARCH_NAME(name), &file_stat);
-    if (si == NULL) {
-        return NULL;
-    }
-    si->base = elf_reader.load_start();
-    si->size = elf_reader.load_size();
-    si->load_bias = elf_reader.load_bias();
-    si->phnum = elf_reader.phdr_count();
-    si->phdr = elf_reader.loaded_phdr();
+  if (!si->PrelinkImage()) {
+    soinfo_free(si);
+    return nullptr;
+  }
 
-    // At this point we know that whatever is loaded @ base is a valid ELF
-    // shared library whose segments are properly mapped in.
-    TRACE("[ load_library base=%p size=%zu name='%s' ]",
-          reinterpret_cast<void*>(si->base), si->size, si->name);
+  for_each_dt_needed(si, [&] (const char* name) {
+    load_tasks.push_back(LoadTask::create(name, si));
+  });
 
-    if (!soinfo_link_image(si, extinfo)) {
-      soinfo_free(si);
-      return NULL;
-    }
-
-    return si;
+  return si;
 }
 
 static soinfo *find_loaded_library_by_name(const char* name) {
   const char* search_name = SEARCH_NAME(name);
-  for (soinfo* si = solist; si != NULL; si = si->next) {
+  for (soinfo* si = solist; si != nullptr; si = si->next) {
     if (!strcmp(search_name, si->name)) {
       return si;
     }
   }
-  return NULL;
+  return nullptr;
 }
 
-static soinfo* find_library_internal(const char* name, int dlflags, const android_dlextinfo* extinfo) {
-  if (name == NULL) {
-    return somain;
-  }
+static soinfo* find_library_internal(LoadTaskList& load_tasks, const char* name, int dlflags, const android_dlextinfo* extinfo) {
 
   soinfo* si = find_loaded_library_by_name(name);
 
   // Library might still be loaded, the accurate detection
-  // of this fact is done by load_library
-  if (si == NULL) {
+  // of this fact is done by load_library.
+  if (si == nullptr) {
     TRACE("[ '%s' has not been found by name.  Trying harder...]", name);
-    si = load_library(name, dlflags, extinfo);
-  }
-
-  if (si != NULL && (si->flags & FLAG_LINKED) == 0) {
-    DL_ERR("recursive link to \"%s\"", si->name);
-    return NULL;
+    si = load_library(load_tasks, name, dlflags, extinfo);
   }
 
   return si;
 }
 
-static soinfo* find_library(const char* name, int dlflags, const android_dlextinfo* extinfo) {
-  soinfo* si = find_library_internal(name, dlflags, extinfo);
-  if (si != NULL) {
-    si->ref_count++;
+static void soinfo_unload(soinfo* si);
+
+static bool is_recursive(soinfo* si, soinfo* parent) {
+  if (parent == nullptr) {
+    return false;
   }
+
+  if (si == parent) {
+    DL_ERR("recursive link to \"%s\"", si->name);
+    return true;
+  }
+
+  return !parent->get_parents().visit([&](soinfo* grandparent) {
+    return !is_recursive(si, grandparent);
+  });
+}
+
+static bool find_libraries(const char* const library_names[], size_t library_names_size, soinfo* soinfos[],
+    soinfo* ld_preloads[], size_t ld_preloads_size, int dlflags, const android_dlextinfo* extinfo) {
+  // Step 0: prepare.
+  LoadTaskList load_tasks;
+  for (size_t i = 0; i < library_names_size; ++i) {
+    const char* name = library_names[i];
+    load_tasks.push_back(LoadTask::create(name, nullptr));
+  }
+
+  // Libraries added to this list in reverse order so that we can
+  // start linking from bottom-up - see step 2.
+  SoinfoLinkedList found_libs;
+  size_t soinfos_size = 0;
+
+  auto failure_guard = make_scope_guard([&]() {
+    // Housekeeping
+    load_tasks.for_each([] (LoadTask* t) {
+      LoadTask::deleter(t);
+    });
+
+    for (size_t i = 0; i<soinfos_size; ++i) {
+      soinfo_unload(soinfos[i]);
+    }
+  });
+
+  // Step 1: load and pre-link all DT_NEEDED libraries in breadth first order.
+  for (LoadTask::unique_ptr task(load_tasks.pop_front()); task.get() != nullptr; task.reset(load_tasks.pop_front())) {
+    soinfo* si = find_library_internal(load_tasks, task->get_name(), dlflags, extinfo);
+    if (si == nullptr) {
+      return false;
+    }
+
+    soinfo* needed_by = task->get_needed_by();
+
+    if (is_recursive(si, needed_by)) {
+      return false;
+    }
+
+    si->ref_count++;
+    if (needed_by != nullptr) {
+      needed_by->add_child(si);
+    }
+    found_libs.push_front(si);
+
+    // When ld_preloads is not null first
+    // ld_preloads_size libs are in fact ld_preloads.
+    if (ld_preloads != nullptr && soinfos_size < ld_preloads_size) {
+      ld_preloads[soinfos_size] = si;
+    }
+
+    if (soinfos_size<library_names_size) {
+      soinfos[soinfos_size++] = si;
+    }
+  }
+
+  // Step 2: link libraries.
+  soinfo* si;
+  while ((si = found_libs.pop_front()) != nullptr) {
+    if ((si->flags & FLAG_LINKED) == 0) {
+      if (!si->LinkImage(extinfo)) {
+        return false;
+      }
+      si->flags |= FLAG_LINKED;
+    }
+  }
+
+  // All is well - found_libs and load_tasks are empty at this point
+  // and all libs are successfully linked.
+  failure_guard.disable();
+  return true;
+}
+
+static soinfo* find_library(const char* name, int dlflags, const android_dlextinfo* extinfo) {
+  if (name == nullptr) {
+    somain->ref_count++;
+    return somain;
+  }
+
+  soinfo* si;
+
+  if (!find_libraries(&name, 1, &si, nullptr, 0, dlflags, extinfo)) {
+    return nullptr;
+  }
+
   return si;
 }
 
@@ -852,26 +985,24 @@
     TRACE("unloading '%s'", si->name);
     si->CallDestructors();
 
-    if ((si->flags | FLAG_NEW_SOINFO) != 0) {
-      si->get_children().for_each([&] (soinfo* child) {
+    if (si->has_min_version(0)) {
+      soinfo* child = nullptr;
+      while ((child = si->get_children().pop_front()) != nullptr) {
         TRACE("%s needs to unload %s", si->name, child->name);
         soinfo_unload(child);
-      });
-    } else {
-      for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
-        if (d->d_tag == DT_NEEDED) {
-          const char* library_name = si->strtab + d->d_un.d_val;
-          TRACE("%s needs to unload %s", si->name, library_name);
-          soinfo* needed = find_library(library_name, RTLD_NOLOAD, NULL);
-          if (needed != NULL) {
-            soinfo_unload(needed);
-          } else {
-            // Not found: for example if symlink was deleted between dlopen and dlclose
-            // Since we cannot really handle errors at this point - print and continue.
-            PRINT("warning: couldn't find %s needed by %s on unload.", library_name, si->name);
-          }
-        }
       }
+    } else {
+      for_each_dt_needed(si, [&] (const char* library_name) {
+        TRACE("deprecated (old format of soinfo): %s needs to unload %s", si->name, library_name);
+        soinfo* needed = find_library(library_name, RTLD_NOLOAD, nullptr);
+        if (needed != nullptr) {
+          soinfo_unload(needed);
+        } else {
+          // Not found: for example if symlink was deleted between dlopen and dlclose
+          // Since we cannot really handle errors at this point - print and continue.
+          PRINT("warning: couldn't find %s needed by %s on unload.", library_name, si->name);
+        }
+      });
     }
 
     notify_gdb_of_unload(si);
@@ -910,15 +1041,22 @@
 soinfo* do_dlopen(const char* name, int flags, const android_dlextinfo* extinfo) {
   if ((flags & ~(RTLD_NOW|RTLD_LAZY|RTLD_LOCAL|RTLD_GLOBAL|RTLD_NOLOAD)) != 0) {
     DL_ERR("invalid flags to dlopen: %x", flags);
-    return NULL;
+    return nullptr;
   }
-  if (extinfo != NULL && ((extinfo->flags & ~(ANDROID_DLEXT_VALID_FLAG_BITS)) != 0)) {
-    DL_ERR("invalid extended flags to android_dlopen_ext: %" PRIx64, extinfo->flags);
-    return NULL;
+  if (extinfo != nullptr) {
+    if ((extinfo->flags & ~(ANDROID_DLEXT_VALID_FLAG_BITS)) != 0) {
+      DL_ERR("invalid extended flags to android_dlopen_ext: 0x%" PRIx64, extinfo->flags);
+      return nullptr;
+    }
+    if ((extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD) == 0 &&
+        (extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET) != 0) {
+      DL_ERR("invalid extended flag combination (ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET without ANDROID_DLEXT_USE_LIBRARY_FD): 0x%" PRIx64, extinfo->flags);
+      return nullptr;
+    }
   }
   protect_data(PROT_READ | PROT_WRITE);
   soinfo* si = find_library(name, flags, extinfo);
-  if (si != NULL) {
+  if (si != nullptr) {
     si->CallConstructors();
   }
   protect_data(PROT_READ);
@@ -931,30 +1069,40 @@
   protect_data(PROT_READ);
 }
 
-#if defined(USE_RELA)
-static int soinfo_relocate(soinfo* si, ElfW(Rela)* rela, unsigned count, soinfo* needed[]) {
-  ElfW(Sym)* s;
-  soinfo* lsi;
+static ElfW(Addr) call_ifunc_resolver(ElfW(Addr) resolver_addr) {
+  typedef ElfW(Addr) (*ifunc_resolver_t)(void);
+  ifunc_resolver_t ifunc_resolver = reinterpret_cast<ifunc_resolver_t>(resolver_addr);
+  ElfW(Addr) ifunc_addr = ifunc_resolver();
+  TRACE_TYPE(RELO, "Called ifunc_resolver@%p. The result is %p", ifunc_resolver, reinterpret_cast<void*>(ifunc_addr));
 
+  return ifunc_addr;
+}
+
+#if defined(USE_RELA)
+int soinfo::Relocate(ElfW(Rela)* rela, unsigned count) {
   for (size_t idx = 0; idx < count; ++idx, ++rela) {
     unsigned type = ELFW(R_TYPE)(rela->r_info);
     unsigned sym = ELFW(R_SYM)(rela->r_info);
-    ElfW(Addr) reloc = static_cast<ElfW(Addr)>(rela->r_offset + si->load_bias);
+    ElfW(Addr) reloc = static_cast<ElfW(Addr)>(rela->r_offset + load_bias);
     ElfW(Addr) sym_addr = 0;
-    const char* sym_name = NULL;
+    const char* sym_name = nullptr;
 
-    DEBUG("Processing '%s' relocation at index %zd", si->name, idx);
+    DEBUG("Processing '%s' relocation at index %zd", name, idx);
     if (type == 0) { // R_*_NONE
       continue;
     }
+
+    ElfW(Sym)* s = nullptr;
+    soinfo* lsi = nullptr;
+
     if (sym != 0) {
-      sym_name = reinterpret_cast<const char*>(si->strtab + si->symtab[sym].st_name);
-      s = soinfo_do_lookup(si, sym_name, &lsi, needed);
-      if (s == NULL) {
+      sym_name = get_string(symtab[sym].st_name);
+      s = soinfo_do_lookup(this, sym_name, &lsi);
+      if (s == nullptr) {
         // We only allow an undefined symbol if this is a weak reference...
-        s = &si->symtab[sym];
+        s = &symtab[sym];
         if (ELF_ST_BIND(s->st_info) != STB_WEAK) {
-          DL_ERR("cannot locate symbol \"%s\" referenced by \"%s\"...", sym_name, si->name);
+          DL_ERR("cannot locate symbol \"%s\" referenced by \"%s\"...", sym_name, name);
           return -1;
         }
 
@@ -972,151 +1120,158 @@
 
         switch (type) {
 #if defined(__aarch64__)
-        case R_AARCH64_JUMP_SLOT:
-        case R_AARCH64_GLOB_DAT:
-        case R_AARCH64_ABS64:
-        case R_AARCH64_ABS32:
-        case R_AARCH64_ABS16:
-        case R_AARCH64_RELATIVE:
-          /*
-           * The sym_addr was initialized to be zero above, or the relocation
-           * code below does not care about value of sym_addr.
-           * No need to do anything.
-           */
-          break;
+          case R_AARCH64_JUMP_SLOT:
+          case R_AARCH64_GLOB_DAT:
+          case R_AARCH64_ABS64:
+          case R_AARCH64_ABS32:
+          case R_AARCH64_ABS16:
+          case R_AARCH64_RELATIVE:
+          case R_AARCH64_IRELATIVE:
+            /*
+             * The sym_addr was initialized to be zero above, or the relocation
+             * code below does not care about value of sym_addr.
+             * No need to do anything.
+             */
+            break;
 #elif defined(__x86_64__)
-        case R_X86_64_JUMP_SLOT:
-        case R_X86_64_GLOB_DAT:
-        case R_X86_64_32:
-        case R_X86_64_64:
-        case R_X86_64_RELATIVE:
-          // No need to do anything.
-          break;
-        case R_X86_64_PC32:
-          sym_addr = reloc;
-          break;
+          case R_X86_64_JUMP_SLOT:
+          case R_X86_64_GLOB_DAT:
+          case R_X86_64_32:
+          case R_X86_64_64:
+          case R_X86_64_RELATIVE:
+          case R_X86_64_IRELATIVE:
+            // No need to do anything.
+            break;
+          case R_X86_64_PC32:
+            sym_addr = reloc;
+            break;
 #endif
-        default:
-          DL_ERR("unknown weak reloc type %d @ %p (%zu)", type, rela, idx);
-          return -1;
+          default:
+            DL_ERR("unknown weak reloc type %d @ %p (%zu)", type, rela, idx);
+            return -1;
         }
       } else {
         // We got a definition.
-        sym_addr = static_cast<ElfW(Addr)>(s->st_value + lsi->load_bias);
+        sym_addr = lsi->resolve_symbol_address(s);
       }
       count_relocation(kRelocSymbol);
-    } else {
-      s = NULL;
     }
 
     switch (type) {
 #if defined(__aarch64__)
-    case R_AARCH64_JUMP_SLOT:
+      case R_AARCH64_JUMP_SLOT:
         count_relocation(kRelocAbsolute);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO JMP_SLOT %16llx <- %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), sym_name);
         *reinterpret_cast<ElfW(Addr)*>(reloc) = (sym_addr + rela->r_addend);
         break;
-    case R_AARCH64_GLOB_DAT:
+      case R_AARCH64_GLOB_DAT:
         count_relocation(kRelocAbsolute);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO GLOB_DAT %16llx <- %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), sym_name);
         *reinterpret_cast<ElfW(Addr)*>(reloc) = (sym_addr + rela->r_addend);
         break;
-    case R_AARCH64_ABS64:
+      case R_AARCH64_ABS64:
         count_relocation(kRelocAbsolute);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO ABS64 %16llx <- %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), sym_name);
         *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr + rela->r_addend);
         break;
-    case R_AARCH64_ABS32:
+      case R_AARCH64_ABS32:
         count_relocation(kRelocAbsolute);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO ABS32 %16llx <- %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), sym_name);
         if ((static_cast<ElfW(Addr)>(INT32_MIN) <= (*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend))) &&
             ((*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend)) <= static_cast<ElfW(Addr)>(UINT32_MAX))) {
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr + rela->r_addend);
+          *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr + rela->r_addend);
         } else {
-            DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
-                   (*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend)),
-                   static_cast<ElfW(Addr)>(INT32_MIN),
-                   static_cast<ElfW(Addr)>(UINT32_MAX));
-            return -1;
+          DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
+                 (*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend)),
+                 static_cast<ElfW(Addr)>(INT32_MIN),
+                 static_cast<ElfW(Addr)>(UINT32_MAX));
+          return -1;
         }
         break;
-    case R_AARCH64_ABS16:
+      case R_AARCH64_ABS16:
         count_relocation(kRelocAbsolute);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO ABS16 %16llx <- %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), sym_name);
         if ((static_cast<ElfW(Addr)>(INT16_MIN) <= (*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend))) &&
             ((*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend)) <= static_cast<ElfW(Addr)>(UINT16_MAX))) {
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr + rela->r_addend);
+          *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr + rela->r_addend);
         } else {
-            DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
-                   (*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend)),
-                   static_cast<ElfW(Addr)>(INT16_MIN),
-                   static_cast<ElfW(Addr)>(UINT16_MAX));
-            return -1;
+          DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
+                 (*reinterpret_cast<ElfW(Addr)*>(reloc) + (sym_addr + rela->r_addend)),
+                 static_cast<ElfW(Addr)>(INT16_MIN),
+                 static_cast<ElfW(Addr)>(UINT16_MAX));
+          return -1;
         }
         break;
-    case R_AARCH64_PREL64:
+      case R_AARCH64_PREL64:
         count_relocation(kRelocRelative);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO REL64 %16llx <- %16llx - %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), rela->r_offset, sym_name);
         *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr + rela->r_addend) - rela->r_offset;
         break;
-    case R_AARCH64_PREL32:
+      case R_AARCH64_PREL32:
         count_relocation(kRelocRelative);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO REL32 %16llx <- %16llx - %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), rela->r_offset, sym_name);
         if ((static_cast<ElfW(Addr)>(INT32_MIN) <= (*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset))) &&
             ((*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset)) <= static_cast<ElfW(Addr)>(UINT32_MAX))) {
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += ((sym_addr + rela->r_addend) - rela->r_offset);
+          *reinterpret_cast<ElfW(Addr)*>(reloc) += ((sym_addr + rela->r_addend) - rela->r_offset);
         } else {
-            DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
-                   (*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset)),
-                   static_cast<ElfW(Addr)>(INT32_MIN),
-                   static_cast<ElfW(Addr)>(UINT32_MAX));
-            return -1;
+          DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
+                 (*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset)),
+                 static_cast<ElfW(Addr)>(INT32_MIN),
+                 static_cast<ElfW(Addr)>(UINT32_MAX));
+          return -1;
         }
         break;
-    case R_AARCH64_PREL16:
+      case R_AARCH64_PREL16:
         count_relocation(kRelocRelative);
         MARK(rela->r_offset);
         TRACE_TYPE(RELO, "RELO REL16 %16llx <- %16llx - %16llx %s\n",
                    reloc, (sym_addr + rela->r_addend), rela->r_offset, sym_name);
         if ((static_cast<ElfW(Addr)>(INT16_MIN) <= (*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset))) &&
             ((*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset)) <= static_cast<ElfW(Addr)>(UINT16_MAX))) {
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += ((sym_addr + rela->r_addend) - rela->r_offset);
+          *reinterpret_cast<ElfW(Addr)*>(reloc) += ((sym_addr + rela->r_addend) - rela->r_offset);
         } else {
-            DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
-                   (*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset)),
-                   static_cast<ElfW(Addr)>(INT16_MIN),
-                   static_cast<ElfW(Addr)>(UINT16_MAX));
-            return -1;
+          DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx",
+                 (*reinterpret_cast<ElfW(Addr)*>(reloc) + ((sym_addr + rela->r_addend) - rela->r_offset)),
+                 static_cast<ElfW(Addr)>(INT16_MIN),
+                 static_cast<ElfW(Addr)>(UINT16_MAX));
+          return -1;
         }
         break;
 
-    case R_AARCH64_RELATIVE:
+      case R_AARCH64_RELATIVE:
         count_relocation(kRelocRelative);
         MARK(rela->r_offset);
         if (sym) {
-            DL_ERR("odd RELATIVE form...");
-            return -1;
+          DL_ERR("odd RELATIVE form...");
+          return -1;
         }
         TRACE_TYPE(RELO, "RELO RELATIVE %16llx <- %16llx\n",
-                   reloc, (si->base + rela->r_addend));
-        *reinterpret_cast<ElfW(Addr)*>(reloc) = (si->base + rela->r_addend);
+                   reloc, (base + rela->r_addend));
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = (base + rela->r_addend);
         break;
 
-    case R_AARCH64_COPY:
+      case R_AARCH64_IRELATIVE:
+        count_relocation(kRelocRelative);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO IRELATIVE %16llx <- %16llx\n", reloc, (base + rela->r_addend));
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = call_ifunc_resolver(base + rela->r_addend);
+        break;
+
+      case R_AARCH64_COPY:
         /*
          * ET_EXEC is not supported so this should not happen.
          *
@@ -1126,328 +1281,341 @@
          * R_AARCH64_COPY may only appear in executable objects where e_type is
          * set to ET_EXEC.
          */
-        DL_ERR("%s R_AARCH64_COPY relocations are not supported", si->name);
+        DL_ERR("%s R_AARCH64_COPY relocations are not supported", name);
         return -1;
-    case R_AARCH64_TLS_TPREL64:
+      case R_AARCH64_TLS_TPREL64:
         TRACE_TYPE(RELO, "RELO TLS_TPREL64 *** %16llx <- %16llx - %16llx\n",
                    reloc, (sym_addr + rela->r_addend), rela->r_offset);
         break;
-    case R_AARCH64_TLS_DTPREL32:
+      case R_AARCH64_TLS_DTPREL32:
         TRACE_TYPE(RELO, "RELO TLS_DTPREL32 *** %16llx <- %16llx - %16llx\n",
                    reloc, (sym_addr + rela->r_addend), rela->r_offset);
         break;
 #elif defined(__x86_64__)
-    case R_X86_64_JUMP_SLOT:
-      count_relocation(kRelocAbsolute);
-      MARK(rela->r_offset);
-      TRACE_TYPE(RELO, "RELO JMP_SLOT %08zx <- %08zx %s", static_cast<size_t>(reloc),
-                 static_cast<size_t>(sym_addr + rela->r_addend), sym_name);
-      *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
-      break;
-    case R_X86_64_GLOB_DAT:
-      count_relocation(kRelocAbsolute);
-      MARK(rela->r_offset);
-      TRACE_TYPE(RELO, "RELO GLOB_DAT %08zx <- %08zx %s", static_cast<size_t>(reloc),
-                 static_cast<size_t>(sym_addr + rela->r_addend), sym_name);
-      *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
-      break;
-    case R_X86_64_RELATIVE:
-      count_relocation(kRelocRelative);
-      MARK(rela->r_offset);
-      if (sym) {
-        DL_ERR("odd RELATIVE form...");
-        return -1;
-      }
-      TRACE_TYPE(RELO, "RELO RELATIVE %08zx <- +%08zx", static_cast<size_t>(reloc),
-                 static_cast<size_t>(si->base));
-      *reinterpret_cast<ElfW(Addr)*>(reloc) = si->base + rela->r_addend;
-      break;
-    case R_X86_64_32:
-      count_relocation(kRelocRelative);
-      MARK(rela->r_offset);
-      TRACE_TYPE(RELO, "RELO R_X86_64_32 %08zx <- +%08zx %s", static_cast<size_t>(reloc),
-                 static_cast<size_t>(sym_addr), sym_name);
-      *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
-      break;
-    case R_X86_64_64:
-      count_relocation(kRelocRelative);
-      MARK(rela->r_offset);
-      TRACE_TYPE(RELO, "RELO R_X86_64_64 %08zx <- +%08zx %s", static_cast<size_t>(reloc),
-                 static_cast<size_t>(sym_addr), sym_name);
-      *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
-      break;
-    case R_X86_64_PC32:
-      count_relocation(kRelocRelative);
-      MARK(rela->r_offset);
-      TRACE_TYPE(RELO, "RELO R_X86_64_PC32 %08zx <- +%08zx (%08zx - %08zx) %s",
-                 static_cast<size_t>(reloc), static_cast<size_t>(sym_addr - reloc),
-                 static_cast<size_t>(sym_addr), static_cast<size_t>(reloc), sym_name);
-      *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend - reloc;
-      break;
+      case R_X86_64_JUMP_SLOT:
+        count_relocation(kRelocAbsolute);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO JMP_SLOT %08zx <- %08zx %s", static_cast<size_t>(reloc),
+                   static_cast<size_t>(sym_addr + rela->r_addend), sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+        break;
+      case R_X86_64_GLOB_DAT:
+        count_relocation(kRelocAbsolute);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO GLOB_DAT %08zx <- %08zx %s", static_cast<size_t>(reloc),
+                   static_cast<size_t>(sym_addr + rela->r_addend), sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+        break;
+      case R_X86_64_RELATIVE:
+        count_relocation(kRelocRelative);
+        MARK(rela->r_offset);
+        if (sym) {
+          DL_ERR("odd RELATIVE form...");
+          return -1;
+        }
+        TRACE_TYPE(RELO, "RELO RELATIVE %08zx <- +%08zx", static_cast<size_t>(reloc),
+                   static_cast<size_t>(base));
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = base + rela->r_addend;
+        break;
+      case R_X86_64_IRELATIVE:
+        count_relocation(kRelocRelative);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO IRELATIVE %16llx <- %16llx\n", reloc, (base + rela->r_addend));
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = call_ifunc_resolver(base + rela->r_addend);
+        break;
+      case R_X86_64_32:
+        count_relocation(kRelocRelative);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO R_X86_64_32 %08zx <- +%08zx %s", static_cast<size_t>(reloc),
+                   static_cast<size_t>(sym_addr), sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+        break;
+      case R_X86_64_64:
+        count_relocation(kRelocRelative);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO R_X86_64_64 %08zx <- +%08zx %s", static_cast<size_t>(reloc),
+                   static_cast<size_t>(sym_addr), sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend;
+        break;
+      case R_X86_64_PC32:
+        count_relocation(kRelocRelative);
+        MARK(rela->r_offset);
+        TRACE_TYPE(RELO, "RELO R_X86_64_PC32 %08zx <- +%08zx (%08zx - %08zx) %s",
+                   static_cast<size_t>(reloc), static_cast<size_t>(sym_addr - reloc),
+                   static_cast<size_t>(sym_addr), static_cast<size_t>(reloc), sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + rela->r_addend - reloc;
+        break;
 #endif
 
-    default:
-      DL_ERR("unknown reloc type %d @ %p (%zu)", type, rela, idx);
-      return -1;
+      default:
+        DL_ERR("unknown reloc type %d @ %p (%zu)", type, rela, idx);
+        return -1;
     }
   }
   return 0;
 }
 
 #else // REL, not RELA.
+int soinfo::Relocate(ElfW(Rel)* rel, unsigned count) {
+  for (size_t idx = 0; idx < count; ++idx, ++rel) {
+    unsigned type = ELFW(R_TYPE)(rel->r_info);
+    // TODO: don't use unsigned for 'sym'. Use uint32_t or ElfW(Addr) instead.
+    unsigned sym = ELFW(R_SYM)(rel->r_info);
+    ElfW(Addr) reloc = static_cast<ElfW(Addr)>(rel->r_offset + load_bias);
+    ElfW(Addr) sym_addr = 0;
+    const char* sym_name = nullptr;
 
-static int soinfo_relocate(soinfo* si, ElfW(Rel)* rel, unsigned count, soinfo* needed[]) {
-    ElfW(Sym)* s;
-    soinfo* lsi;
+    DEBUG("Processing '%s' relocation at index %zd", name, idx);
+    if (type == 0) { // R_*_NONE
+      continue;
+    }
 
-    for (size_t idx = 0; idx < count; ++idx, ++rel) {
-        unsigned type = ELFW(R_TYPE)(rel->r_info);
-        // TODO: don't use unsigned for 'sym'. Use uint32_t or ElfW(Addr) instead.
-        unsigned sym = ELFW(R_SYM)(rel->r_info);
-        ElfW(Addr) reloc = static_cast<ElfW(Addr)>(rel->r_offset + si->load_bias);
-        ElfW(Addr) sym_addr = 0;
-        const char* sym_name = NULL;
+    ElfW(Sym)* s = nullptr;
+    soinfo* lsi = nullptr;
 
-        DEBUG("Processing '%s' relocation at index %zd", si->name, idx);
-        if (type == 0) { // R_*_NONE
-            continue;
+    if (sym != 0) {
+      sym_name = get_string(symtab[sym].st_name);
+      s = soinfo_do_lookup(this, sym_name, &lsi);
+      if (s == nullptr) {
+        // We only allow an undefined symbol if this is a weak reference...
+        s = &symtab[sym];
+        if (ELF_ST_BIND(s->st_info) != STB_WEAK) {
+          DL_ERR("cannot locate symbol \"%s\" referenced by \"%s\"...", sym_name, name);
+          return -1;
         }
-        if (sym != 0) {
-            sym_name = reinterpret_cast<const char*>(si->strtab + si->symtab[sym].st_name);
-            s = soinfo_do_lookup(si, sym_name, &lsi, needed);
-            if (s == NULL) {
-                // We only allow an undefined symbol if this is a weak reference...
-                s = &si->symtab[sym];
-                if (ELF_ST_BIND(s->st_info) != STB_WEAK) {
-                    DL_ERR("cannot locate symbol \"%s\" referenced by \"%s\"...", sym_name, si->name);
-                    return -1;
-                }
 
-                /* IHI0044C AAELF 4.5.1.1:
+        /* IHI0044C AAELF 4.5.1.1:
 
-                   Libraries are not searched to resolve weak references.
-                   It is not an error for a weak reference to remain
-                   unsatisfied.
+           Libraries are not searched to resolve weak references.
+           It is not an error for a weak reference to remain
+           unsatisfied.
 
-                   During linking, the value of an undefined weak reference is:
-                   - Zero if the relocation type is absolute
-                   - The address of the place if the relocation is pc-relative
-                   - The address of nominal base address if the relocation
-                     type is base-relative.
-                  */
-
-                switch (type) {
-#if defined(__arm__)
-                case R_ARM_JUMP_SLOT:
-                case R_ARM_GLOB_DAT:
-                case R_ARM_ABS32:
-                case R_ARM_RELATIVE:    /* Don't care. */
-                    // sym_addr was initialized to be zero above or relocation
-                    // code below does not care about value of sym_addr.
-                    // No need to do anything.
-                    break;
-#elif defined(__i386__)
-                case R_386_JMP_SLOT:
-                case R_386_GLOB_DAT:
-                case R_386_32:
-                case R_386_RELATIVE:    /* Don't care. */
-                    // sym_addr was initialized to be zero above or relocation
-                    // code below does not care about value of sym_addr.
-                    // No need to do anything.
-                    break;
-                case R_386_PC32:
-                    sym_addr = reloc;
-                    break;
-#endif
-
-#if defined(__arm__)
-                case R_ARM_COPY:
-                    // Fall through. Can't really copy if weak symbol is not found at run-time.
-#endif
-                default:
-                    DL_ERR("unknown weak reloc type %d @ %p (%zu)", type, rel, idx);
-                    return -1;
-                }
-            } else {
-                // We got a definition.
-                sym_addr = static_cast<ElfW(Addr)>(s->st_value + lsi->load_bias);
-            }
-            count_relocation(kRelocSymbol);
-        } else {
-            s = NULL;
-        }
+           During linking, the value of an undefined weak reference is:
+           - Zero if the relocation type is absolute
+           - The address of the place if the relocation is pc-relative
+           - The address of nominal base address if the relocation
+             type is base-relative.
+        */
 
         switch (type) {
 #if defined(__arm__)
-        case R_ARM_JUMP_SLOT:
-            count_relocation(kRelocAbsolute);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO JMP_SLOT %08x <- %08x %s", reloc, sym_addr, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
+          case R_ARM_JUMP_SLOT:
+          case R_ARM_GLOB_DAT:
+          case R_ARM_ABS32:
+          case R_ARM_RELATIVE:    /* Don't care. */
+            // sym_addr was initialized to be zero above or relocation
+            // code below does not care about value of sym_addr.
+            // No need to do anything.
             break;
-        case R_ARM_GLOB_DAT:
-            count_relocation(kRelocAbsolute);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO GLOB_DAT %08x <- %08x %s", reloc, sym_addr, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
-            break;
-        case R_ARM_ABS32:
-            count_relocation(kRelocAbsolute);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO ABS %08x <- %08x %s", reloc, sym_addr, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr;
-            break;
-        case R_ARM_REL32:
-            count_relocation(kRelocRelative);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO REL32 %08x <- %08x - %08x %s",
-                       reloc, sym_addr, rel->r_offset, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr - rel->r_offset;
-            break;
-        case R_ARM_COPY:
-            /*
-             * ET_EXEC is not supported so this should not happen.
-             *
-             * http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044d/IHI0044D_aaelf.pdf
-             *
-             * Section 4.7.1.10 "Dynamic relocations"
-             * R_ARM_COPY may only appear in executable objects where e_type is
-             * set to ET_EXEC.
-             */
-            DL_ERR("%s R_ARM_COPY relocations are not supported", si->name);
-            return -1;
 #elif defined(__i386__)
-        case R_386_JMP_SLOT:
-            count_relocation(kRelocAbsolute);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO JMP_SLOT %08x <- %08x %s", reloc, sym_addr, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
+          case R_386_JMP_SLOT:
+          case R_386_GLOB_DAT:
+          case R_386_32:
+          case R_386_RELATIVE:    /* Don't care. */
+          case R_386_IRELATIVE:
+            // sym_addr was initialized to be zero above or relocation
+            // code below does not care about value of sym_addr.
+            // No need to do anything.
             break;
-        case R_386_GLOB_DAT:
-            count_relocation(kRelocAbsolute);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO GLOB_DAT %08x <- %08x %s", reloc, sym_addr, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
-            break;
-        case R_386_32:
-            count_relocation(kRelocRelative);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO R_386_32 %08x <- +%08x %s", reloc, sym_addr, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr;
-            break;
-        case R_386_PC32:
-            count_relocation(kRelocRelative);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO R_386_PC32 %08x <- +%08x (%08x - %08x) %s",
-                       reloc, (sym_addr - reloc), sym_addr, reloc, sym_name);
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr - reloc);
-            break;
-#elif defined(__mips__)
-        case R_MIPS_REL32:
-#if defined(__LP64__)
-            // MIPS Elf64_Rel entries contain compound relocations
-            // We only handle the R_MIPS_NONE|R_MIPS_64|R_MIPS_REL32 case
-            if (ELF64_R_TYPE2(rel->r_info) != R_MIPS_64 ||
-                ELF64_R_TYPE3(rel->r_info) != R_MIPS_NONE) {
-                DL_ERR("Unexpected compound relocation type:%d type2:%d type3:%d @ %p (%zu)",
-                       type, (unsigned)ELF64_R_TYPE2(rel->r_info),
-                       (unsigned)ELF64_R_TYPE3(rel->r_info), rel, idx);
-                return -1;
-            }
-#endif
-            count_relocation(kRelocAbsolute);
-            MARK(rel->r_offset);
-            TRACE_TYPE(RELO, "RELO REL32 %08zx <- %08zx %s", static_cast<size_t>(reloc),
-                       static_cast<size_t>(sym_addr), sym_name ? sym_name : "*SECTIONHDR*");
-            if (s) {
-                *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr;
-            } else {
-                *reinterpret_cast<ElfW(Addr)*>(reloc) += si->base;
-            }
+          case R_386_PC32:
+            sym_addr = reloc;
             break;
 #endif
 
 #if defined(__arm__)
-        case R_ARM_RELATIVE:
-#elif defined(__i386__)
-        case R_386_RELATIVE:
+          case R_ARM_COPY:
+            // Fall through. Can't really copy if weak symbol is not found at run-time.
 #endif
-            count_relocation(kRelocRelative);
-            MARK(rel->r_offset);
-            if (sym) {
-                DL_ERR("odd RELATIVE form...");
-                return -1;
-            }
-            TRACE_TYPE(RELO, "RELO RELATIVE %p <- +%p",
-                       reinterpret_cast<void*>(reloc), reinterpret_cast<void*>(si->base));
-            *reinterpret_cast<ElfW(Addr)*>(reloc) += si->base;
-            break;
-
-        default:
-            DL_ERR("unknown reloc type %d @ %p (%zu)", type, rel, idx);
+          default:
+            DL_ERR("unknown weak reloc type %d @ %p (%zu)", type, rel, idx);
             return -1;
         }
+      } else {
+        // We got a definition.
+        sym_addr = lsi->resolve_symbol_address(s);
+      }
+      count_relocation(kRelocSymbol);
     }
-    return 0;
+
+    switch (type) {
+#if defined(__arm__)
+      case R_ARM_JUMP_SLOT:
+        count_relocation(kRelocAbsolute);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO JMP_SLOT %08x <- %08x %s", reloc, sym_addr, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
+        break;
+      case R_ARM_GLOB_DAT:
+        count_relocation(kRelocAbsolute);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO GLOB_DAT %08x <- %08x %s", reloc, sym_addr, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
+        break;
+      case R_ARM_ABS32:
+        count_relocation(kRelocAbsolute);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO ABS %08x <- %08x %s", reloc, sym_addr, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr;
+        break;
+      case R_ARM_REL32:
+        count_relocation(kRelocRelative);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO REL32 %08x <- %08x - %08x %s",
+                   reloc, sym_addr, rel->r_offset, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr - rel->r_offset;
+        break;
+      case R_ARM_COPY:
+        /*
+         * ET_EXEC is not supported so this should not happen.
+         *
+         * http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044d/IHI0044D_aaelf.pdf
+         *
+         * Section 4.7.1.10 "Dynamic relocations"
+         * R_ARM_COPY may only appear in executable objects where e_type is
+         * set to ET_EXEC.
+         */
+        DL_ERR("%s R_ARM_COPY relocations are not supported", name);
+        return -1;
+#elif defined(__i386__)
+      case R_386_JMP_SLOT:
+        count_relocation(kRelocAbsolute);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO JMP_SLOT %08x <- %08x %s", reloc, sym_addr, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
+        break;
+      case R_386_GLOB_DAT:
+        count_relocation(kRelocAbsolute);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO GLOB_DAT %08x <- %08x %s", reloc, sym_addr, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr;
+        break;
+      case R_386_32:
+        count_relocation(kRelocRelative);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO R_386_32 %08x <- +%08x %s", reloc, sym_addr, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr;
+        break;
+      case R_386_PC32:
+        count_relocation(kRelocRelative);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO R_386_PC32 %08x <- +%08x (%08x - %08x) %s",
+                   reloc, (sym_addr - reloc), sym_addr, reloc, sym_name);
+        *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr - reloc);
+        break;
+#elif defined(__mips__)
+      case R_MIPS_REL32:
+#if defined(__LP64__)
+        // MIPS Elf64_Rel entries contain compound relocations
+        // We only handle the R_MIPS_NONE|R_MIPS_64|R_MIPS_REL32 case
+        if (ELF64_R_TYPE2(rel->r_info) != R_MIPS_64 ||
+            ELF64_R_TYPE3(rel->r_info) != R_MIPS_NONE) {
+          DL_ERR("Unexpected compound relocation type:%d type2:%d type3:%d @ %p (%zu)",
+                 type, (unsigned)ELF64_R_TYPE2(rel->r_info),
+                 (unsigned)ELF64_R_TYPE3(rel->r_info), rel, idx);
+          return -1;
+        }
+#endif
+        count_relocation(kRelocAbsolute);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO REL32 %08zx <- %08zx %s", static_cast<size_t>(reloc),
+                   static_cast<size_t>(sym_addr), sym_name ? sym_name : "*SECTIONHDR*");
+        if (s) {
+          *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr;
+        } else {
+          *reinterpret_cast<ElfW(Addr)*>(reloc) += base;
+        }
+        break;
+#endif
+
+#if defined(__arm__)
+      case R_ARM_RELATIVE:
+#elif defined(__i386__)
+      case R_386_RELATIVE:
+#endif
+        count_relocation(kRelocRelative);
+        MARK(rel->r_offset);
+        if (sym) {
+          DL_ERR("odd RELATIVE form...");
+          return -1;
+        }
+        TRACE_TYPE(RELO, "RELO RELATIVE %p <- +%p",
+                   reinterpret_cast<void*>(reloc), reinterpret_cast<void*>(base));
+        *reinterpret_cast<ElfW(Addr)*>(reloc) += base;
+        break;
+#if defined(__i386__)
+      case R_386_IRELATIVE:
+        count_relocation(kRelocRelative);
+        MARK(rel->r_offset);
+        TRACE_TYPE(RELO, "RELO IRELATIVE %p <- %p", reinterpret_cast<void*>(reloc), reinterpret_cast<void*>(base));
+        *reinterpret_cast<ElfW(Addr)*>(reloc) = call_ifunc_resolver(base + *reinterpret_cast<ElfW(Addr)*>(reloc));
+        break;
+#endif
+
+      default:
+        DL_ERR("unknown reloc type %d @ %p (%zu)", type, rel, idx);
+        return -1;
+    }
+  }
+  return 0;
 }
 #endif
 
 #if defined(__mips__)
-static bool mips_relocate_got(soinfo* si, soinfo* needed[]) {
-    ElfW(Addr)** got = si->plt_got;
-    if (got == NULL) {
-        return true;
-    }
-    unsigned local_gotno = si->mips_local_gotno;
-    unsigned gotsym = si->mips_gotsym;
-    unsigned symtabno = si->mips_symtabno;
-    ElfW(Sym)* symtab = si->symtab;
-
-    // got[0] is the address of the lazy resolver function.
-    // got[1] may be used for a GNU extension.
-    // Set it to a recognizable address in case someone calls it (should be _rtld_bind_start).
-    // FIXME: maybe this should be in a separate routine?
-    if ((si->flags & FLAG_LINKER) == 0) {
-        size_t g = 0;
-        got[g++] = reinterpret_cast<ElfW(Addr)*>(0xdeadbeef);
-        if (reinterpret_cast<intptr_t>(got[g]) < 0) {
-            got[g++] = reinterpret_cast<ElfW(Addr)*>(0xdeadfeed);
-        }
-        // Relocate the local GOT entries.
-        for (; g < local_gotno; g++) {
-            got[g] = reinterpret_cast<ElfW(Addr)*>(reinterpret_cast<uintptr_t>(got[g]) + si->load_bias);
-        }
-    }
-
-    // Now for the global GOT entries...
-    ElfW(Sym)* sym = symtab + gotsym;
-    got = si->plt_got + local_gotno;
-    for (size_t g = gotsym; g < symtabno; g++, sym++, got++) {
-        // This is an undefined reference... try to locate it.
-        const char* sym_name = si->strtab + sym->st_name;
-        soinfo* lsi;
-        ElfW(Sym)* s = soinfo_do_lookup(si, sym_name, &lsi, needed);
-        if (s == NULL) {
-            // We only allow an undefined symbol if this is a weak reference.
-            s = &symtab[g];
-            if (ELF_ST_BIND(s->st_info) != STB_WEAK) {
-                DL_ERR("cannot locate \"%s\"...", sym_name);
-                return false;
-            }
-            *got = 0;
-        } else {
-            // FIXME: is this sufficient?
-            // For reference see NetBSD link loader
-            // http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ld.elf_so/arch/mips/mips_reloc.c?rev=1.53&content-type=text/x-cvsweb-markup
-            *got = reinterpret_cast<ElfW(Addr)*>(lsi->load_bias + s->st_value);
-        }
-    }
+static bool mips_relocate_got(soinfo* si) {
+  ElfW(Addr)** got = si->plt_got;
+  if (got == nullptr) {
     return true;
+  }
+  unsigned local_gotno = si->mips_local_gotno;
+  unsigned gotsym = si->mips_gotsym;
+  unsigned symtabno = si->mips_symtabno;
+  ElfW(Sym)* symtab = si->symtab;
+
+  // got[0] is the address of the lazy resolver function.
+  // got[1] may be used for a GNU extension.
+  // Set it to a recognizable address in case someone calls it (should be _rtld_bind_start).
+  // FIXME: maybe this should be in a separate routine?
+  if ((si->flags & FLAG_LINKER) == 0) {
+    size_t g = 0;
+    got[g++] = reinterpret_cast<ElfW(Addr)*>(0xdeadbeef);
+    if (reinterpret_cast<intptr_t>(got[g]) < 0) {
+      got[g++] = reinterpret_cast<ElfW(Addr)*>(0xdeadfeed);
+    }
+    // Relocate the local GOT entries.
+    for (; g < local_gotno; g++) {
+      got[g] = reinterpret_cast<ElfW(Addr)*>(reinterpret_cast<uintptr_t>(got[g]) + si->load_bias);
+    }
+  }
+
+  // Now for the global GOT entries...
+  ElfW(Sym)* sym = symtab + gotsym;
+  got = si->plt_got + local_gotno;
+  for (size_t g = gotsym; g < symtabno; g++, sym++, got++) {
+    // This is an undefined reference... try to locate it.
+    const char* sym_name = si->get_string(sym->st_name);
+    soinfo* lsi = nullptr;
+    ElfW(Sym)* s = soinfo_do_lookup(si, sym_name, &lsi);
+    if (s == nullptr) {
+      // We only allow an undefined symbol if this is a weak reference.
+      s = &symtab[g];
+      if (ELF_ST_BIND(s->st_info) != STB_WEAK) {
+        DL_ERR("cannot locate \"%s\"...", sym_name);
+        return false;
+      }
+      *got = 0;
+    } else {
+      // FIXME: is this sufficient?
+      // For reference see NetBSD link loader
+      // http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ld.elf_so/arch/mips/mips_reloc.c?rev=1.53&content-type=text/x-cvsweb-markup
+      *got = reinterpret_cast<ElfW(Addr)*>(lsi->resolve_symbol_address(s));
+    }
+  }
+  return true;
 }
 #endif
 
 void soinfo::CallArray(const char* array_name __unused, linker_function_t* functions, size_t count, bool reverse) {
-  if (functions == NULL) {
+  if (functions == nullptr) {
     return;
   }
 
@@ -1466,7 +1634,7 @@
 }
 
 void soinfo::CallFunction(const char* function_name __unused, linker_function_t function) {
-  if (function == NULL || reinterpret_cast<uintptr_t>(function) == static_cast<uintptr_t>(-1)) {
+  if (function == nullptr || reinterpret_cast<uintptr_t>(function) == static_cast<uintptr_t>(-1)) {
     return;
   }
 
@@ -1502,7 +1670,7 @@
   //    out above, the libc constructor will be called again (recursively!).
   constructors_called = true;
 
-  if ((flags & FLAG_EXE) == 0 && preinit_array != NULL) {
+  if ((flags & FLAG_EXE) == 0 && preinit_array != nullptr) {
     // The GNU dynamic linker silently ignores these, but we warn the developer.
     PRINT("\"%s\": ignoring %zd-entry DT_PREINIT_ARRAY in shared library!",
           name, preinit_array_count);
@@ -1520,6 +1688,9 @@
 }
 
 void soinfo::CallDestructors() {
+  if (!constructors_called) {
+    return;
+  }
   TRACE("\"%s\": calling destructors", name);
 
   // DT_FINI_ARRAY must be parsed in reverse order.
@@ -1534,16 +1705,14 @@
 }
 
 void soinfo::add_child(soinfo* child) {
-  if ((this->flags & FLAG_NEW_SOINFO) == 0) {
-    return;
+  if (has_min_version(0)) {
+    child->parents.push_back(this);
+    this->children.push_back(child);
   }
-
-  this->children.push_front(child);
-  child->parents.push_front(this);
 }
 
 void soinfo::remove_all_links() {
-  if ((this->flags & FLAG_NEW_SOINFO) == 0) {
+  if (!has_min_version(0)) {
     return;
   }
 
@@ -1555,7 +1724,7 @@
   });
 
   parents.for_each([&] (soinfo* parent) {
-    parent->children.for_each([&] (const soinfo* child) {
+    parent->children.remove_if([&] (const soinfo* child) {
       return child == this;
     });
   });
@@ -1565,468 +1734,533 @@
   children.clear();
 }
 
-void soinfo::set_st_dev(dev_t dev) {
-  if ((this->flags & FLAG_NEW_SOINFO) == 0) {
-    return;
-  }
-
-  st_dev = dev;
-}
-
-void soinfo::set_st_ino(ino_t ino) {
-  if ((this->flags & FLAG_NEW_SOINFO) == 0) {
-    return;
-  }
-
-  st_ino = ino;
-}
-
 dev_t soinfo::get_st_dev() {
-  if ((this->flags & FLAG_NEW_SOINFO) == 0) {
-    return 0;
+  if (has_min_version(0)) {
+    return st_dev;
   }
 
-  return st_dev;
+  return 0;
 };
 
 ino_t soinfo::get_st_ino() {
-  if ((this->flags & FLAG_NEW_SOINFO) == 0) {
-    return 0;
+  if (has_min_version(0)) {
+    return st_ino;
   }
 
-  return st_ino;
+  return 0;
 }
 
-// This is a return on get_children() in case
+off64_t soinfo::get_file_offset() {
+  if (has_min_version(1)) {
+    return file_offset;
+  }
+
+  return 0;
+}
+
+// This is a return on get_children()/get_parents() if
 // 'this->flags' does not have FLAG_NEW_SOINFO set.
 static soinfo::soinfo_list_t g_empty_list;
 
 soinfo::soinfo_list_t& soinfo::get_children() {
+  if (has_min_version(0)) {
+    return this->children;
+  }
+
+  return g_empty_list;
+}
+
+soinfo::soinfo_list_t& soinfo::get_parents() {
   if ((this->flags & FLAG_NEW_SOINFO) == 0) {
     return g_empty_list;
   }
 
-  return this->children;
+  return this->parents;
+}
+
+ElfW(Addr) soinfo::resolve_symbol_address(ElfW(Sym)* s) {
+  if (ELF_ST_TYPE(s->st_info) == STT_GNU_IFUNC) {
+    return call_ifunc_resolver(s->st_value + load_bias);
+  }
+
+  return static_cast<ElfW(Addr)>(s->st_value + load_bias);
+}
+
+const char* soinfo::get_string(ElfW(Word) index) const {
+  if (has_min_version(1) && (index >= strtab_size)) {
+    __libc_fatal("%s: strtab out of bounds error; STRSZ=%zd, name=%d", name, strtab_size, index);
+  }
+
+  return strtab + index;
 }
 
 /* Force any of the closed stdin, stdout and stderr to be associated with
    /dev/null. */
 static int nullify_closed_stdio() {
-    int dev_null, i, status;
-    int return_value = 0;
+  int dev_null, i, status;
+  int return_value = 0;
 
-    dev_null = TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR));
-    if (dev_null < 0) {
-        DL_ERR("cannot open /dev/null: %s", strerror(errno));
-        return -1;
-    }
-    TRACE("[ Opened /dev/null file-descriptor=%d]", dev_null);
+  dev_null = TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR));
+  if (dev_null < 0) {
+    DL_ERR("cannot open /dev/null: %s", strerror(errno));
+    return -1;
+  }
+  TRACE("[ Opened /dev/null file-descriptor=%d]", dev_null);
 
-    /* If any of the stdio file descriptors is valid and not associated
-       with /dev/null, dup /dev/null to it.  */
-    for (i = 0; i < 3; i++) {
-        /* If it is /dev/null already, we are done. */
-        if (i == dev_null) {
-            continue;
-        }
-
-        TRACE("[ Nullifying stdio file descriptor %d]", i);
-        status = TEMP_FAILURE_RETRY(fcntl(i, F_GETFL));
-
-        /* If file is opened, we are good. */
-        if (status != -1) {
-            continue;
-        }
-
-        /* The only error we allow is that the file descriptor does not
-           exist, in which case we dup /dev/null to it. */
-        if (errno != EBADF) {
-            DL_ERR("fcntl failed: %s", strerror(errno));
-            return_value = -1;
-            continue;
-        }
-
-        /* Try dupping /dev/null to this stdio file descriptor and
-           repeat if there is a signal.  Note that any errors in closing
-           the stdio descriptor are lost.  */
-        status = TEMP_FAILURE_RETRY(dup2(dev_null, i));
-        if (status < 0) {
-            DL_ERR("dup2 failed: %s", strerror(errno));
-            return_value = -1;
-            continue;
-        }
+  /* If any of the stdio file descriptors is valid and not associated
+     with /dev/null, dup /dev/null to it.  */
+  for (i = 0; i < 3; i++) {
+    /* If it is /dev/null already, we are done. */
+    if (i == dev_null) {
+      continue;
     }
 
-    /* If /dev/null is not one of the stdio file descriptors, close it. */
-    if (dev_null > 2) {
-        TRACE("[ Closing /dev/null file-descriptor=%d]", dev_null);
-        status = TEMP_FAILURE_RETRY(close(dev_null));
-        if (status == -1) {
-            DL_ERR("close failed: %s", strerror(errno));
-            return_value = -1;
-        }
+    TRACE("[ Nullifying stdio file descriptor %d]", i);
+    status = TEMP_FAILURE_RETRY(fcntl(i, F_GETFL));
+
+    /* If file is opened, we are good. */
+    if (status != -1) {
+      continue;
     }
 
-    return return_value;
+    /* The only error we allow is that the file descriptor does not
+       exist, in which case we dup /dev/null to it. */
+    if (errno != EBADF) {
+      DL_ERR("fcntl failed: %s", strerror(errno));
+      return_value = -1;
+      continue;
+    }
+
+    /* Try dupping /dev/null to this stdio file descriptor and
+       repeat if there is a signal.  Note that any errors in closing
+       the stdio descriptor are lost.  */
+    status = TEMP_FAILURE_RETRY(dup2(dev_null, i));
+    if (status < 0) {
+      DL_ERR("dup2 failed: %s", strerror(errno));
+      return_value = -1;
+      continue;
+    }
+  }
+
+  /* If /dev/null is not one of the stdio file descriptors, close it. */
+  if (dev_null > 2) {
+    TRACE("[ Closing /dev/null file-descriptor=%d]", dev_null);
+    status = TEMP_FAILURE_RETRY(close(dev_null));
+    if (status == -1) {
+      DL_ERR("close failed: %s", strerror(errno));
+      return_value = -1;
+    }
+  }
+
+  return return_value;
 }
 
-static bool soinfo_link_image(soinfo* si, const android_dlextinfo* extinfo) {
-    /* "base" might wrap around UINT32_MAX. */
-    ElfW(Addr) base = si->load_bias;
-    const ElfW(Phdr)* phdr = si->phdr;
-    int phnum = si->phnum;
-    bool relocating_linker = (si->flags & FLAG_LINKER) != 0;
+bool soinfo::PrelinkImage() {
+  /* Extract dynamic section */
+  ElfW(Word) dynamic_flags = 0;
+  phdr_table_get_dynamic_section(phdr, phnum, load_bias, &dynamic, &dynamic_flags);
 
-    /* We can't debug anything until the linker is relocated */
+  /* We can't log anything until the linker is relocated */
+  bool relocating_linker = (flags & FLAG_LINKER) != 0;
+  if (!relocating_linker) {
+    INFO("[ linking %s ]", name);
+    DEBUG("si->base = %p si->flags = 0x%08x", reinterpret_cast<void*>(base), flags);
+  }
+
+  if (dynamic == nullptr) {
     if (!relocating_linker) {
-        INFO("[ linking %s ]", si->name);
-        DEBUG("si->base = %p si->flags = 0x%08x", reinterpret_cast<void*>(si->base), si->flags);
+      DL_ERR("missing PT_DYNAMIC in \"%s\"", name);
     }
-
-    /* Extract dynamic section */
-    size_t dynamic_count;
-    ElfW(Word) dynamic_flags;
-    phdr_table_get_dynamic_section(phdr, phnum, base, &si->dynamic,
-                                   &dynamic_count, &dynamic_flags);
-    if (si->dynamic == NULL) {
-        if (!relocating_linker) {
-            DL_ERR("missing PT_DYNAMIC in \"%s\"", si->name);
-        }
-        return false;
-    } else {
-        if (!relocating_linker) {
-            DEBUG("dynamic = %p", si->dynamic);
-        }
+    return false;
+  } else {
+    if (!relocating_linker) {
+      DEBUG("dynamic = %p", dynamic);
     }
+  }
 
 #if defined(__arm__)
-    (void) phdr_table_get_arm_exidx(phdr, phnum, base,
-                                    &si->ARM_exidx, &si->ARM_exidx_count);
+  (void) phdr_table_get_arm_exidx(phdr, phnum, load_bias,
+                                  &ARM_exidx, &ARM_exidx_count);
 #endif
 
-    // Extract useful information from dynamic section.
-    uint32_t needed_count = 0;
-    for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
-        DEBUG("d = %p, d[0](tag) = %p d[1](val) = %p",
-              d, reinterpret_cast<void*>(d->d_tag), reinterpret_cast<void*>(d->d_un.d_val));
-        switch (d->d_tag) {
-        case DT_HASH:
-            si->nbucket = reinterpret_cast<uint32_t*>(base + d->d_un.d_ptr)[0];
-            si->nchain = reinterpret_cast<uint32_t*>(base + d->d_un.d_ptr)[1];
-            si->bucket = reinterpret_cast<uint32_t*>(base + d->d_un.d_ptr + 8);
-            si->chain = reinterpret_cast<uint32_t*>(base + d->d_un.d_ptr + 8 + si->nbucket * 4);
-            break;
-        case DT_STRTAB:
-            si->strtab = reinterpret_cast<const char*>(base + d->d_un.d_ptr);
-            break;
-        case DT_SYMTAB:
-            si->symtab = reinterpret_cast<ElfW(Sym)*>(base + d->d_un.d_ptr);
-            break;
-#if !defined(__LP64__)
-        case DT_PLTREL:
-            if (d->d_un.d_val != DT_REL) {
-                DL_ERR("unsupported DT_RELA in \"%s\"", si->name);
-                return false;
-            }
-            break;
-#endif
-        case DT_JMPREL:
+  // Extract useful information from dynamic section.
+  uint32_t needed_count = 0;
+  for (ElfW(Dyn)* d = dynamic; d->d_tag != DT_NULL; ++d) {
+    DEBUG("d = %p, d[0](tag) = %p d[1](val) = %p",
+          d, reinterpret_cast<void*>(d->d_tag), reinterpret_cast<void*>(d->d_un.d_val));
+    switch (d->d_tag) {
+      case DT_SONAME:
+        // TODO: glibc dynamic linker uses this name for
+        // initial library lookup; consider doing the same here.
+        break;
+
+      case DT_HASH:
+        nbucket = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[0];
+        nchain = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[1];
+        bucket = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr + 8);
+        chain = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr + 8 + nbucket * 4);
+        break;
+
+      case DT_STRTAB:
+        strtab = reinterpret_cast<const char*>(load_bias + d->d_un.d_ptr);
+        break;
+
+      case DT_STRSZ:
+        strtab_size = d->d_un.d_val;
+        break;
+
+      case DT_SYMTAB:
+        symtab = reinterpret_cast<ElfW(Sym)*>(load_bias + d->d_un.d_ptr);
+        break;
+
+      case DT_SYMENT:
+        if (d->d_un.d_val != sizeof(ElfW(Sym))) {
+          DL_ERR("invalid DT_SYMENT: %zd", static_cast<size_t>(d->d_un.d_val));
+          return false;
+        }
+        break;
+
+      case DT_PLTREL:
 #if defined(USE_RELA)
-            si->plt_rela = reinterpret_cast<ElfW(Rela)*>(base + d->d_un.d_ptr);
+        if (d->d_un.d_val != DT_RELA) {
+          DL_ERR("unsupported DT_PLTREL in \"%s\"; expected DT_RELA", name);
+          return false;
+        }
 #else
-            si->plt_rel = reinterpret_cast<ElfW(Rel)*>(base + d->d_un.d_ptr);
+        if (d->d_un.d_val != DT_REL) {
+          DL_ERR("unsupported DT_PLTREL in \"%s\"; expected DT_REL", name);
+          return false;
+        }
 #endif
-            break;
-        case DT_PLTRELSZ:
+        break;
+
+      case DT_JMPREL:
 #if defined(USE_RELA)
-            si->plt_rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
+        plt_rela = reinterpret_cast<ElfW(Rela)*>(load_bias + d->d_un.d_ptr);
 #else
-            si->plt_rel_count = d->d_un.d_val / sizeof(ElfW(Rel));
+        plt_rel = reinterpret_cast<ElfW(Rel)*>(load_bias + d->d_un.d_ptr);
 #endif
-            break;
+        break;
+
+      case DT_PLTRELSZ:
+#if defined(USE_RELA)
+        plt_rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
+#else
+        plt_rel_count = d->d_un.d_val / sizeof(ElfW(Rel));
+#endif
+        break;
+
+      case DT_PLTGOT:
 #if defined(__mips__)
-        case DT_PLTGOT:
-            // Used by mips and mips64.
-            si->plt_got = reinterpret_cast<ElfW(Addr)**>(base + d->d_un.d_ptr);
-            break;
+        // Used by mips and mips64.
+        plt_got = reinterpret_cast<ElfW(Addr)**>(load_bias + d->d_un.d_ptr);
 #endif
-        case DT_DEBUG:
-            // Set the DT_DEBUG entry to the address of _r_debug for GDB
-            // if the dynamic table is writable
+        // Ignore for other platforms... (because RTLD_LAZY is not supported)
+        break;
+
+      case DT_DEBUG:
+        // Set the DT_DEBUG entry to the address of _r_debug for GDB
+        // if the dynamic table is writable
 // FIXME: not working currently for N64
 // The flags for the LOAD and DYNAMIC program headers do not agree.
-// The LOAD section containng the dynamic table has been mapped as
+// The LOAD section containing the dynamic table has been mapped as
 // read-only, but the DYNAMIC header claims it is writable.
 #if !(defined(__mips__) && defined(__LP64__))
-            if ((dynamic_flags & PF_W) != 0) {
-                d->d_un.d_val = reinterpret_cast<uintptr_t>(&_r_debug);
-            }
-            break;
+        if ((dynamic_flags & PF_W) != 0) {
+          d->d_un.d_val = reinterpret_cast<uintptr_t>(&_r_debug);
+        }
+        break;
 #endif
 #if defined(USE_RELA)
-         case DT_RELA:
-            si->rela = reinterpret_cast<ElfW(Rela)*>(base + d->d_un.d_ptr);
-            break;
-         case DT_RELASZ:
-            si->rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
-            break;
-        case DT_REL:
-            DL_ERR("unsupported DT_REL in \"%s\"", si->name);
-            return false;
-        case DT_RELSZ:
-            DL_ERR("unsupported DT_RELSZ in \"%s\"", si->name);
-            return false;
+      case DT_RELA:
+        rela = reinterpret_cast<ElfW(Rela)*>(load_bias + d->d_un.d_ptr);
+        break;
+
+      case DT_RELASZ:
+        rela_count = d->d_un.d_val / sizeof(ElfW(Rela));
+        break;
+
+      case DT_RELAENT:
+        if (d->d_un.d_val != sizeof(ElfW(Rela))) {
+          DL_ERR("invalid DT_RELAENT: %zd", static_cast<size_t>(d->d_un.d_val));
+          return false;
+        }
+        break;
+
+      // ignored (see DT_RELCOUNT comments for details)
+      case DT_RELACOUNT:
+        break;
+
+      case DT_REL:
+        DL_ERR("unsupported DT_REL in \"%s\"", name);
+        return false;
+
+      case DT_RELSZ:
+        DL_ERR("unsupported DT_RELSZ in \"%s\"", name);
+        return false;
 #else
-        case DT_REL:
-            si->rel = reinterpret_cast<ElfW(Rel)*>(base + d->d_un.d_ptr);
-            break;
-        case DT_RELSZ:
-            si->rel_count = d->d_un.d_val / sizeof(ElfW(Rel));
-            break;
-         case DT_RELA:
-            DL_ERR("unsupported DT_RELA in \"%s\"", si->name);
-            return false;
+      case DT_REL:
+        rel = reinterpret_cast<ElfW(Rel)*>(load_bias + d->d_un.d_ptr);
+        break;
+
+      case DT_RELSZ:
+        rel_count = d->d_un.d_val / sizeof(ElfW(Rel));
+        break;
+
+      case DT_RELENT:
+        if (d->d_un.d_val != sizeof(ElfW(Rel))) {
+          DL_ERR("invalid DT_RELENT: %zd", static_cast<size_t>(d->d_un.d_val));
+          return false;
+        }
+        break;
+
+      // "Indicates that all RELATIVE relocations have been concatenated together,
+      // and specifies the RELATIVE relocation count."
+      //
+      // TODO: Spec also mentions that this can be used to optimize relocation process;
+      // Not currently used by bionic linker - ignored.
+      case DT_RELCOUNT:
+        break;
+      case DT_RELA:
+        DL_ERR("unsupported DT_RELA in \"%s\"", name);
+        return false;
 #endif
-        case DT_INIT:
-            si->init_func = reinterpret_cast<linker_function_t>(base + d->d_un.d_ptr);
-            DEBUG("%s constructors (DT_INIT) found at %p", si->name, si->init_func);
-            break;
-        case DT_FINI:
-            si->fini_func = reinterpret_cast<linker_function_t>(base + d->d_un.d_ptr);
-            DEBUG("%s destructors (DT_FINI) found at %p", si->name, si->fini_func);
-            break;
-        case DT_INIT_ARRAY:
-            si->init_array = reinterpret_cast<linker_function_t*>(base + d->d_un.d_ptr);
-            DEBUG("%s constructors (DT_INIT_ARRAY) found at %p", si->name, si->init_array);
-            break;
-        case DT_INIT_ARRAYSZ:
-            si->init_array_count = ((unsigned)d->d_un.d_val) / sizeof(ElfW(Addr));
-            break;
-        case DT_FINI_ARRAY:
-            si->fini_array = reinterpret_cast<linker_function_t*>(base + d->d_un.d_ptr);
-            DEBUG("%s destructors (DT_FINI_ARRAY) found at %p", si->name, si->fini_array);
-            break;
-        case DT_FINI_ARRAYSZ:
-            si->fini_array_count = ((unsigned)d->d_un.d_val) / sizeof(ElfW(Addr));
-            break;
-        case DT_PREINIT_ARRAY:
-            si->preinit_array = reinterpret_cast<linker_function_t*>(base + d->d_un.d_ptr);
-            DEBUG("%s constructors (DT_PREINIT_ARRAY) found at %p", si->name, si->preinit_array);
-            break;
-        case DT_PREINIT_ARRAYSZ:
-            si->preinit_array_count = ((unsigned)d->d_un.d_val) / sizeof(ElfW(Addr));
-            break;
-        case DT_TEXTREL:
+      case DT_INIT:
+        init_func = reinterpret_cast<linker_function_t>(load_bias + d->d_un.d_ptr);
+        DEBUG("%s constructors (DT_INIT) found at %p", name, init_func);
+        break;
+
+      case DT_FINI:
+        fini_func = reinterpret_cast<linker_function_t>(load_bias + d->d_un.d_ptr);
+        DEBUG("%s destructors (DT_FINI) found at %p", name, fini_func);
+        break;
+
+      case DT_INIT_ARRAY:
+        init_array = reinterpret_cast<linker_function_t*>(load_bias + d->d_un.d_ptr);
+        DEBUG("%s constructors (DT_INIT_ARRAY) found at %p", name, init_array);
+        break;
+
+      case DT_INIT_ARRAYSZ:
+        init_array_count = ((unsigned)d->d_un.d_val) / sizeof(ElfW(Addr));
+        break;
+
+      case DT_FINI_ARRAY:
+        fini_array = reinterpret_cast<linker_function_t*>(load_bias + d->d_un.d_ptr);
+        DEBUG("%s destructors (DT_FINI_ARRAY) found at %p", name, fini_array);
+        break;
+
+      case DT_FINI_ARRAYSZ:
+        fini_array_count = ((unsigned)d->d_un.d_val) / sizeof(ElfW(Addr));
+        break;
+
+      case DT_PREINIT_ARRAY:
+        preinit_array = reinterpret_cast<linker_function_t*>(load_bias + d->d_un.d_ptr);
+        DEBUG("%s constructors (DT_PREINIT_ARRAY) found at %p", name, preinit_array);
+        break;
+
+      case DT_PREINIT_ARRAYSZ:
+        preinit_array_count = ((unsigned)d->d_un.d_val) / sizeof(ElfW(Addr));
+        break;
+
+      case DT_TEXTREL:
 #if defined(__LP64__)
-            DL_ERR("text relocations (DT_TEXTREL) found in 64-bit ELF file \"%s\"", si->name);
-            return false;
+        DL_ERR("text relocations (DT_TEXTREL) found in 64-bit ELF file \"%s\"", name);
+        return false;
 #else
-            si->has_text_relocations = true;
-            break;
+        has_text_relocations = true;
+        break;
 #endif
-        case DT_SYMBOLIC:
-            si->has_DT_SYMBOLIC = true;
-            break;
-        case DT_NEEDED:
-            ++needed_count;
-            break;
-        case DT_FLAGS:
-            if (d->d_un.d_val & DF_TEXTREL) {
+
+      case DT_SYMBOLIC:
+        has_DT_SYMBOLIC = true;
+        break;
+
+      case DT_NEEDED:
+        ++needed_count;
+        break;
+
+      case DT_FLAGS:
+        if (d->d_un.d_val & DF_TEXTREL) {
 #if defined(__LP64__)
-                DL_ERR("text relocations (DF_TEXTREL) found in 64-bit ELF file \"%s\"", si->name);
-                return false;
+          DL_ERR("text relocations (DF_TEXTREL) found in 64-bit ELF file \"%s\"", name);
+          return false;
 #else
-                si->has_text_relocations = true;
+          has_text_relocations = true;
 #endif
-            }
-            if (d->d_un.d_val & DF_SYMBOLIC) {
-                si->has_DT_SYMBOLIC = true;
-            }
-            break;
+        }
+        if (d->d_un.d_val & DF_SYMBOLIC) {
+          has_DT_SYMBOLIC = true;
+        }
+        break;
+
+      case DT_FLAGS_1:
+        if ((d->d_un.d_val & DF_1_GLOBAL) != 0) {
+          rtld_flags |= RTLD_GLOBAL;
+        }
+        // TODO: Implement other flags
+
+        if ((d->d_un.d_val & ~(DF_1_NOW | DF_1_GLOBAL)) != 0) {
+          DL_WARN("Unsupported flags DT_FLAGS_1=%p", reinterpret_cast<void*>(d->d_un.d_val));
+        }
+        break;
 #if defined(__mips__)
-        case DT_STRSZ:
-        case DT_SYMENT:
-        case DT_RELENT:
-             break;
-        case DT_MIPS_RLD_MAP:
-            // Set the DT_MIPS_RLD_MAP entry to the address of _r_debug for GDB.
-            {
-              r_debug** dp = reinterpret_cast<r_debug**>(base + d->d_un.d_ptr);
-              *dp = &_r_debug;
-            }
-            break;
-        case DT_MIPS_RLD_VERSION:
-        case DT_MIPS_FLAGS:
-        case DT_MIPS_BASE_ADDRESS:
-        case DT_MIPS_UNREFEXTNO:
-            break;
+      case DT_MIPS_RLD_MAP:
+        // Set the DT_MIPS_RLD_MAP entry to the address of _r_debug for GDB.
+        {
+          r_debug** dp = reinterpret_cast<r_debug**>(load_bias + d->d_un.d_ptr);
+          *dp = &_r_debug;
+        }
+        break;
 
-        case DT_MIPS_SYMTABNO:
-            si->mips_symtabno = d->d_un.d_val;
-            break;
+      case DT_MIPS_RLD_VERSION:
+      case DT_MIPS_FLAGS:
+      case DT_MIPS_BASE_ADDRESS:
+      case DT_MIPS_UNREFEXTNO:
+        break;
 
-        case DT_MIPS_LOCAL_GOTNO:
-            si->mips_local_gotno = d->d_un.d_val;
-            break;
+      case DT_MIPS_SYMTABNO:
+        mips_symtabno = d->d_un.d_val;
+        break;
 
-        case DT_MIPS_GOTSYM:
-            si->mips_gotsym = d->d_un.d_val;
-            break;
+      case DT_MIPS_LOCAL_GOTNO:
+        mips_local_gotno = d->d_un.d_val;
+        break;
+
+      case DT_MIPS_GOTSYM:
+        mips_gotsym = d->d_un.d_val;
+        break;
 #endif
+      // Ignored: "Its use has been superseded by the DF_BIND_NOW flag"
+      case DT_BIND_NOW:
+        break;
 
-        default:
-            DEBUG("Unused DT entry: type %p arg %p",
-                  reinterpret_cast<void*>(d->d_tag), reinterpret_cast<void*>(d->d_un.d_val));
-            break;
+      // Ignore: bionic does not support symbol versioning...
+      case DT_VERSYM:
+      case DT_VERDEF:
+      case DT_VERDEFNUM:
+        break;
+
+      default:
+        if (!relocating_linker) {
+          DL_WARN("%s: unused DT entry: type %p arg %p", name,
+              reinterpret_cast<void*>(d->d_tag), reinterpret_cast<void*>(d->d_un.d_val));
         }
+        break;
     }
+  }
 
-    DEBUG("si->base = %p, si->strtab = %p, si->symtab = %p",
-          reinterpret_cast<void*>(si->base), si->strtab, si->symtab);
+  DEBUG("si->base = %p, si->strtab = %p, si->symtab = %p",
+        reinterpret_cast<void*>(base), strtab, symtab);
 
-    // Sanity checks.
-    if (relocating_linker && needed_count != 0) {
-        DL_ERR("linker cannot have DT_NEEDED dependencies on other libraries");
-        return false;
-    }
-    if (si->nbucket == 0) {
-        DL_ERR("empty/missing DT_HASH in \"%s\" (built with --hash-style=gnu?)", si->name);
-        return false;
-    }
-    if (si->strtab == 0) {
-        DL_ERR("empty/missing DT_STRTAB in \"%s\"", si->name);
-        return false;
-    }
-    if (si->symtab == 0) {
-        DL_ERR("empty/missing DT_SYMTAB in \"%s\"", si->name);
-        return false;
-    }
+  // Sanity checks.
+  if (relocating_linker && needed_count != 0) {
+    DL_ERR("linker cannot have DT_NEEDED dependencies on other libraries");
+    return false;
+  }
+  if (nbucket == 0) {
+    DL_ERR("empty/missing DT_HASH in \"%s\" (built with --hash-style=gnu?)", name);
+    return false;
+  }
+  if (strtab == 0) {
+    DL_ERR("empty/missing DT_STRTAB in \"%s\"", name);
+    return false;
+  }
+  if (symtab == 0) {
+    DL_ERR("empty/missing DT_SYMTAB in \"%s\"", name);
+    return false;
+  }
+  return true;
+}
 
-    // If this is the main executable, then load all of the libraries from LD_PRELOAD now.
-    if (si->flags & FLAG_EXE) {
-        memset(g_ld_preloads, 0, sizeof(g_ld_preloads));
-        size_t preload_count = 0;
-        for (size_t i = 0; g_ld_preload_names[i] != NULL; i++) {
-            soinfo* lsi = find_library(g_ld_preload_names[i], 0, NULL);
-            if (lsi != NULL) {
-                g_ld_preloads[preload_count++] = lsi;
-            } else {
-                // As with glibc, failure to load an LD_PRELOAD library is just a warning.
-                DL_WARN("could not load library \"%s\" from LD_PRELOAD for \"%s\"; caused by %s",
-                        g_ld_preload_names[i], si->name, linker_get_error_buffer());
-            }
-        }
-    }
-
-    soinfo** needed = reinterpret_cast<soinfo**>(alloca((1 + needed_count) * sizeof(soinfo*)));
-    soinfo** pneeded = needed;
-
-    for (ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL; ++d) {
-        if (d->d_tag == DT_NEEDED) {
-            const char* library_name = si->strtab + d->d_un.d_val;
-            DEBUG("%s needs %s", si->name, library_name);
-            soinfo* lsi = find_library(library_name, 0, NULL);
-            if (lsi == NULL) {
-                strlcpy(tmp_err_buf, linker_get_error_buffer(), sizeof(tmp_err_buf));
-                DL_ERR("could not load library \"%s\" needed by \"%s\"; caused by %s",
-                       library_name, si->name, tmp_err_buf);
-                return false;
-            }
-
-            si->add_child(lsi);
-            *pneeded++ = lsi;
-        }
-    }
-    *pneeded = NULL;
+bool soinfo::LinkImage(const android_dlextinfo* extinfo) {
 
 #if !defined(__LP64__)
-    if (si->has_text_relocations) {
-        // Make segments writable to allow text relocations to work properly. We will later call
-        // phdr_table_protect_segments() after all of them are applied and all constructors are run.
-        DL_WARN("%s has text relocations. This is wasting memory and prevents "
-                "security hardening. Please fix.", si->name);
-        if (phdr_table_unprotect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
-            DL_ERR("can't unprotect loadable segments for \"%s\": %s",
-                   si->name, strerror(errno));
-            return false;
-        }
+  if (has_text_relocations) {
+    // Make segments writable to allow text relocations to work properly. We will later call
+    // phdr_table_protect_segments() after all of them are applied and all constructors are run.
+    DL_WARN("%s has text relocations. This is wasting memory and prevents "
+            "security hardening. Please fix.", name);
+    if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) {
+      DL_ERR("can't unprotect loadable segments for \"%s\": %s",
+             name, strerror(errno));
+      return false;
     }
+  }
 #endif
 
 #if defined(USE_RELA)
-    if (si->plt_rela != NULL) {
-        DEBUG("[ relocating %s plt ]\n", si->name);
-        if (soinfo_relocate(si, si->plt_rela, si->plt_rela_count, needed)) {
-            return false;
-        }
+  if (rela != nullptr) {
+    DEBUG("[ relocating %s ]", name);
+    if (Relocate(rela, rela_count)) {
+      return false;
     }
-    if (si->rela != NULL) {
-        DEBUG("[ relocating %s ]\n", si->name);
-        if (soinfo_relocate(si, si->rela, si->rela_count, needed)) {
-            return false;
-        }
+  }
+  if (plt_rela != nullptr) {
+    DEBUG("[ relocating %s plt ]", name);
+    if (Relocate(plt_rela, plt_rela_count)) {
+      return false;
     }
+  }
 #else
-    if (si->plt_rel != NULL) {
-        DEBUG("[ relocating %s plt ]", si->name);
-        if (soinfo_relocate(si, si->plt_rel, si->plt_rel_count, needed)) {
-            return false;
-        }
+  if (rel != nullptr) {
+    DEBUG("[ relocating %s ]", name);
+    if (Relocate(rel, rel_count)) {
+      return false;
     }
-    if (si->rel != NULL) {
-        DEBUG("[ relocating %s ]", si->name);
-        if (soinfo_relocate(si, si->rel, si->rel_count, needed)) {
-            return false;
-        }
+  }
+  if (plt_rel != nullptr) {
+    DEBUG("[ relocating %s plt ]", name);
+    if (Relocate(plt_rel, plt_rel_count)) {
+      return false;
     }
+  }
 #endif
 
 #if defined(__mips__)
-    if (!mips_relocate_got(si, needed)) {
-        return false;
-    }
+  if (!mips_relocate_got(this)) {
+    return false;
+  }
 #endif
 
-    si->flags |= FLAG_LINKED;
-    DEBUG("[ finished linking %s ]", si->name);
+  DEBUG("[ finished linking %s ]", name);
 
 #if !defined(__LP64__)
-    if (si->has_text_relocations) {
-        // All relocations are done, we can protect our segments back to read-only.
-        if (phdr_table_protect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
-            DL_ERR("can't protect segments for \"%s\": %s",
-                   si->name, strerror(errno));
-            return false;
-        }
+  if (has_text_relocations) {
+    // All relocations are done, we can protect our segments back to read-only.
+    if (phdr_table_protect_segments(phdr, phnum, load_bias) < 0) {
+      DL_ERR("can't protect segments for \"%s\": %s",
+             name, strerror(errno));
+      return false;
     }
+  }
 #endif
 
-    /* We can also turn on GNU RELRO protection */
-    if (phdr_table_protect_gnu_relro(si->phdr, si->phnum, si->load_bias) < 0) {
-        DL_ERR("can't enable GNU RELRO protection for \"%s\": %s",
-               si->name, strerror(errno));
-        return false;
-    }
+  /* We can also turn on GNU RELRO protection */
+  if (phdr_table_protect_gnu_relro(phdr, phnum, load_bias) < 0) {
+    DL_ERR("can't enable GNU RELRO protection for \"%s\": %s",
+           name, strerror(errno));
+    return false;
+  }
 
-    /* Handle serializing/sharing the RELRO segment */
-    if (extinfo && (extinfo->flags & ANDROID_DLEXT_WRITE_RELRO)) {
-      if (phdr_table_serialize_gnu_relro(si->phdr, si->phnum, si->load_bias,
-                                         extinfo->relro_fd) < 0) {
-        DL_ERR("failed serializing GNU RELRO section for \"%s\": %s",
-               si->name, strerror(errno));
-        return false;
-      }
-    } else if (extinfo && (extinfo->flags & ANDROID_DLEXT_USE_RELRO)) {
-      if (phdr_table_map_gnu_relro(si->phdr, si->phnum, si->load_bias,
-                                   extinfo->relro_fd) < 0) {
-        DL_ERR("failed mapping GNU RELRO section for \"%s\": %s",
-               si->name, strerror(errno));
-        return false;
-      }
+  /* Handle serializing/sharing the RELRO segment */
+  if (extinfo && (extinfo->flags & ANDROID_DLEXT_WRITE_RELRO)) {
+    if (phdr_table_serialize_gnu_relro(phdr, phnum, load_bias,
+                                       extinfo->relro_fd) < 0) {
+      DL_ERR("failed serializing GNU RELRO section for \"%s\": %s",
+             name, strerror(errno));
+      return false;
     }
+  } else if (extinfo && (extinfo->flags & ANDROID_DLEXT_USE_RELRO)) {
+    if (phdr_table_map_gnu_relro(phdr, phnum, load_bias,
+                                 extinfo->relro_fd) < 0) {
+      DL_ERR("failed mapping GNU RELRO section for \"%s\": %s",
+             name, strerror(errno));
+      return false;
+    }
+  }
 
-    notify_gdb_of_load(si);
-    return true;
+  notify_gdb_of_load(this);
+  return true;
 }
 
 /*
@@ -2037,11 +2271,11 @@
 static void add_vdso(KernelArgumentBlock& args __unused) {
 #if defined(AT_SYSINFO_EHDR)
   ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(args.getauxval(AT_SYSINFO_EHDR));
-  if (ehdr_vdso == NULL) {
+  if (ehdr_vdso == nullptr) {
     return;
   }
 
-  soinfo* si = soinfo_alloc("[vdso]", NULL);
+  soinfo* si = soinfo_alloc("[vdso]", nullptr, 0);
 
   si->phdr = reinterpret_cast<ElfW(Phdr)*>(reinterpret_cast<char*>(ehdr_vdso) + ehdr_vdso->e_phoff);
   si->phnum = ehdr_vdso->e_phnum;
@@ -2049,14 +2283,20 @@
   si->size = phdr_table_get_load_size(si->phdr, si->phnum);
   si->load_bias = get_elf_exec_load_bias(ehdr_vdso);
 
-  soinfo_link_image(si, NULL);
+  si->PrelinkImage();
+  si->LinkImage(nullptr);
 #endif
 }
 
 /*
  * This is linker soinfo for GDB. See details below.
  */
-static soinfo linker_soinfo_for_gdb;
+#if defined(__LP64__)
+#define LINKER_PATH "/system/bin/linker64"
+#else
+#define LINKER_PATH "/system/bin/linker"
+#endif
+static soinfo linker_soinfo_for_gdb(LINKER_PATH, nullptr, 0);
 
 /* gdb expects the linker to be in the debug shared object list.
  * Without this, gdb has trouble locating the linker's ".text"
@@ -2066,12 +2306,6 @@
  * be on the soinfo list.
  */
 static void init_linker_info_for_gdb(ElfW(Addr) linker_base) {
-#if defined(__LP64__)
-  strlcpy(linker_soinfo_for_gdb.name, "/system/bin/linker64", sizeof(linker_soinfo_for_gdb.name));
-#else
-  strlcpy(linker_soinfo_for_gdb.name, "/system/bin/linker", sizeof(linker_soinfo_for_gdb.name));
-#endif
-  linker_soinfo_for_gdb.flags = FLAG_NEW_SOINFO;
   linker_soinfo_for_gdb.base = linker_base;
 
   /*
@@ -2083,7 +2317,7 @@
   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_base);
   ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_base + elf_hdr->e_phoff);
   phdr_table_get_dynamic_section(phdr, elf_hdr->e_phnum, linker_base,
-                                 &linker_soinfo_for_gdb.dynamic, NULL, NULL);
+                                 &linker_soinfo_for_gdb.dynamic, nullptr);
   insert_soinfo_into_debug_map(&linker_soinfo_for_gdb);
 }
 
@@ -2093,166 +2327,186 @@
  * and other non-local data at this point.
  */
 static ElfW(Addr) __linker_init_post_relocation(KernelArgumentBlock& args, ElfW(Addr) linker_base) {
-    /* NOTE: we store the args pointer on a special location
-     *       of the temporary TLS area in order to pass it to
-     *       the C Library's runtime initializer.
-     *
-     *       The initializer must clear the slot and reset the TLS
-     *       to point to a different location to ensure that no other
-     *       shared library constructor can access it.
-     */
-  __libc_init_tls(args);
-
 #if TIMING
-    struct timeval t0, t1;
-    gettimeofday(&t0, 0);
+  struct timeval t0, t1;
+  gettimeofday(&t0, 0);
 #endif
 
-    // Initialize environment functions, and get to the ELF aux vectors table.
-    linker_env_init(args);
+  // Initialize environment functions, and get to the ELF aux vectors table.
+  linker_env_init(args);
 
-    // If this is a setuid/setgid program, close the security hole described in
-    // ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc
-    if (get_AT_SECURE()) {
-        nullify_closed_stdio();
+  // If this is a setuid/setgid program, close the security hole described in
+  // ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc
+  if (get_AT_SECURE()) {
+    nullify_closed_stdio();
+  }
+
+  debuggerd_init();
+
+  // Get a few environment variables.
+  const char* LD_DEBUG = linker_env_get("LD_DEBUG");
+  if (LD_DEBUG != nullptr) {
+    g_ld_debug_verbosity = atoi(LD_DEBUG);
+  }
+
+  // Normally, these are cleaned by linker_env_init, but the test
+  // doesn't cost us anything.
+  const char* ldpath_env = nullptr;
+  const char* ldpreload_env = nullptr;
+  if (!get_AT_SECURE()) {
+    ldpath_env = linker_env_get("LD_LIBRARY_PATH");
+    ldpreload_env = linker_env_get("LD_PRELOAD");
+  }
+
+  INFO("[ android linker & debugger ]");
+
+  soinfo* si = soinfo_alloc(args.argv[0], nullptr, 0);
+  if (si == nullptr) {
+    exit(EXIT_FAILURE);
+  }
+
+  /* bootstrap the link map, the main exe always needs to be first */
+  si->flags |= FLAG_EXE;
+  link_map* map = &(si->link_map_head);
+
+  map->l_addr = 0;
+  map->l_name = args.argv[0];
+  map->l_prev = nullptr;
+  map->l_next = nullptr;
+
+  _r_debug.r_map = map;
+  r_debug_tail = map;
+
+  init_linker_info_for_gdb(linker_base);
+
+  // Extract information passed from the kernel.
+  si->phdr = reinterpret_cast<ElfW(Phdr)*>(args.getauxval(AT_PHDR));
+  si->phnum = args.getauxval(AT_PHNUM);
+  si->entry = args.getauxval(AT_ENTRY);
+
+  /* Compute the value of si->base. We can't rely on the fact that
+   * the first entry is the PHDR because this will not be true
+   * for certain executables (e.g. some in the NDK unit test suite)
+   */
+  si->base = 0;
+  si->size = phdr_table_get_load_size(si->phdr, si->phnum);
+  si->load_bias = 0;
+  for (size_t i = 0; i < si->phnum; ++i) {
+    if (si->phdr[i].p_type == PT_PHDR) {
+      si->load_bias = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_vaddr;
+      si->base = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_offset;
+      break;
     }
+  }
+  si->dynamic = nullptr;
+  si->ref_count = 1;
 
-    debuggerd_init();
+  ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base);
+  if (elf_hdr->e_type != ET_DYN) {
+    __libc_format_fd(2, "error: only position independent executables (PIE) are supported.\n");
+    exit(EXIT_FAILURE);
+  }
 
-    // Get a few environment variables.
-    const char* LD_DEBUG = linker_env_get("LD_DEBUG");
-    if (LD_DEBUG != NULL) {
-      g_ld_debug_verbosity = atoi(LD_DEBUG);
-    }
+  // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid).
+  parse_LD_LIBRARY_PATH(ldpath_env);
+  parse_LD_PRELOAD(ldpreload_env);
 
-    // Normally, these are cleaned by linker_env_init, but the test
-    // doesn't cost us anything.
-    const char* ldpath_env = NULL;
-    const char* ldpreload_env = NULL;
-    if (!get_AT_SECURE()) {
-      ldpath_env = linker_env_get("LD_LIBRARY_PATH");
-      ldpreload_env = linker_env_get("LD_PRELOAD");
-    }
+  somain = si;
 
-    INFO("[ android linker & debugger ]");
+  if (!si->PrelinkImage()) {
+    __libc_format_fd(2, "CANNOT LINK EXECUTABLE: %s\n", linker_get_error_buffer());
+    exit(EXIT_FAILURE);
+  }
 
-    soinfo* si = soinfo_alloc(args.argv[0], NULL);
-    if (si == NULL) {
-        exit(EXIT_FAILURE);
-    }
+  // Load ld_preloads and dependencies.
+  StringLinkedList needed_library_name_list;
+  size_t needed_libraries_count = 0;
+  size_t ld_preloads_count = 0;
+  while (g_ld_preload_names[ld_preloads_count] != nullptr) {
+    needed_library_name_list.push_back(g_ld_preload_names[ld_preloads_count++]);
+    ++needed_libraries_count;
+  }
 
-    /* bootstrap the link map, the main exe always needs to be first */
-    si->flags |= FLAG_EXE;
-    link_map* map = &(si->link_map_head);
+  for_each_dt_needed(si, [&](const char* name) {
+    needed_library_name_list.push_back(name);
+    ++needed_libraries_count;
+  });
 
-    map->l_addr = 0;
-    map->l_name = args.argv[0];
-    map->l_prev = NULL;
-    map->l_next = NULL;
+  const char* needed_library_names[needed_libraries_count];
+  soinfo* needed_library_si[needed_libraries_count];
 
-    _r_debug.r_map = map;
-    r_debug_tail = map;
+  memset(needed_library_names, 0, sizeof(needed_library_names));
+  needed_library_name_list.copy_to_array(needed_library_names, needed_libraries_count);
 
-    init_linker_info_for_gdb(linker_base);
+  if (needed_libraries_count > 0 && !find_libraries(needed_library_names, needed_libraries_count, needed_library_si, g_ld_preloads, ld_preloads_count, 0, nullptr)) {
+    __libc_format_fd(2, "CANNOT LINK EXECUTABLE DEPENDENCIES: %s\n", linker_get_error_buffer());
+    exit(EXIT_FAILURE);
+  }
 
-    // Extract information passed from the kernel.
-    si->phdr = reinterpret_cast<ElfW(Phdr)*>(args.getauxval(AT_PHDR));
-    si->phnum = args.getauxval(AT_PHNUM);
-    si->entry = args.getauxval(AT_ENTRY);
+  for (size_t i = 0; i<needed_libraries_count; ++i) {
+    si->add_child(needed_library_si[i]);
+  }
 
-    /* Compute the value of si->base. We can't rely on the fact that
-     * the first entry is the PHDR because this will not be true
-     * for certain executables (e.g. some in the NDK unit test suite)
-     */
-    si->base = 0;
-    si->size = phdr_table_get_load_size(si->phdr, si->phnum);
-    si->load_bias = 0;
-    for (size_t i = 0; i < si->phnum; ++i) {
-      if (si->phdr[i].p_type == PT_PHDR) {
-        si->load_bias = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_vaddr;
-        si->base = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_offset;
-        break;
-      }
-    }
-    si->dynamic = NULL;
-    si->ref_count = 1;
+  if (!si->LinkImage(nullptr)) {
+    __libc_format_fd(2, "CANNOT LINK EXECUTABLE: %s\n", linker_get_error_buffer());
+    exit(EXIT_FAILURE);
+  }
 
-    ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base);
-    if (elf_hdr->e_type != ET_DYN) {
-        __libc_format_fd(2, "error: only position independent executables (PIE) are supported.\n");
-        exit(EXIT_FAILURE);
-    }
+  add_vdso(args);
 
-    // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid).
-    parse_LD_LIBRARY_PATH(ldpath_env);
-    parse_LD_PRELOAD(ldpreload_env);
+  si->CallPreInitConstructors();
 
-    somain = si;
-
-    if (!soinfo_link_image(si, NULL)) {
-        __libc_format_fd(2, "CANNOT LINK EXECUTABLE: %s\n", linker_get_error_buffer());
-        exit(EXIT_FAILURE);
-    }
-
-    add_vdso(args);
-
-    si->CallPreInitConstructors();
-
-    for (size_t i = 0; g_ld_preloads[i] != NULL; ++i) {
-        g_ld_preloads[i]->CallConstructors();
-    }
-
-    /* After the link_image, the si->load_bias is initialized.
-     * For so lib, the map->l_addr will be updated in notify_gdb_of_load.
-     * We need to update this value for so exe here. So Unwind_Backtrace
-     * for some arch like x86 could work correctly within so exe.
-     */
-    map->l_addr = si->load_bias;
-    si->CallConstructors();
+  /* After the PrelinkImage, the si->load_bias is initialized.
+   * For so lib, the map->l_addr will be updated in notify_gdb_of_load.
+   * We need to update this value for so exe here. So Unwind_Backtrace
+   * for some arch like x86 could work correctly within so exe.
+   */
+  map->l_addr = si->load_bias;
+  si->CallConstructors();
 
 #if TIMING
-    gettimeofday(&t1, NULL);
-    PRINT("LINKER TIME: %s: %d microseconds", args.argv[0], (int) (
-               (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) -
-               (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec)));
+  gettimeofday(&t1, nullptr);
+  PRINT("LINKER TIME: %s: %d microseconds", args.argv[0], (int) (
+           (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) -
+           (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec)));
 #endif
 #if STATS
-    PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", args.argv[0],
-           linker_stats.count[kRelocAbsolute],
-           linker_stats.count[kRelocRelative],
-           linker_stats.count[kRelocCopy],
-           linker_stats.count[kRelocSymbol]);
+  PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", args.argv[0],
+         linker_stats.count[kRelocAbsolute],
+         linker_stats.count[kRelocRelative],
+         linker_stats.count[kRelocCopy],
+         linker_stats.count[kRelocSymbol]);
 #endif
 #if COUNT_PAGES
-    {
-        unsigned n;
-        unsigned i;
-        unsigned count = 0;
-        for (n = 0; n < 4096; n++) {
-            if (bitmask[n]) {
-                unsigned x = bitmask[n];
+  {
+    unsigned n;
+    unsigned i;
+    unsigned count = 0;
+    for (n = 0; n < 4096; n++) {
+      if (bitmask[n]) {
+        unsigned x = bitmask[n];
 #if defined(__LP64__)
-                for (i = 0; i < 32; i++) {
+        for (i = 0; i < 32; i++) {
 #else
-                for (i = 0; i < 8; i++) {
+        for (i = 0; i < 8; i++) {
 #endif
-                    if (x & 1) {
-                        count++;
-                    }
-                    x >>= 1;
-                }
-            }
+          if (x & 1) {
+            count++;
+          }
+          x >>= 1;
         }
-        PRINT("PAGES MODIFIED: %s: %d (%dKB)", args.argv[0], count, count * 4);
+      }
     }
+    PRINT("PAGES MODIFIED: %s: %d (%dKB)", args.argv[0], count, count * 4);
+  }
 #endif
 
 #if TIMING || STATS || COUNT_PAGES
-    fflush(stdout);
+  fflush(stdout);
 #endif
 
-    TRACE("[ Ready to execute '%s' @ %p ]", si->name, reinterpret_cast<void*>(si->entry));
-    return si->entry;
+  TRACE("[ Ready to execute '%s' @ %p ]", si->name, reinterpret_cast<void*>(si->entry));
+  return si->entry;
 }
 
 /* Compute the load-bias of an existing executable. This shall only
@@ -2290,10 +2544,6 @@
  * function, or other GOT reference will generate a segfault.
  */
 extern "C" ElfW(Addr) __linker_init(void* raw_args) {
-  // Initialize static variables.
-  solist = get_libdl_info();
-  sonext = get_libdl_info();
-
   KernelArgumentBlock args(raw_args);
 
   ElfW(Addr) linker_addr = args.getauxval(AT_BASE);
@@ -2301,8 +2551,7 @@
   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr);
   ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff);
 
-  soinfo linker_so;
-  memset(&linker_so, 0, sizeof(soinfo));
+  soinfo linker_so("[dynamic linker]", nullptr, 0);
 
   // If the linker is not acting as PT_INTERP entry_point is equal to
   // _start. Which means that the linker is running as an executable and
@@ -2314,16 +2563,15 @@
     __libc_fatal("This is %s, the helper program for shared library executables.\n", args.argv[0]);
   }
 
-  strcpy(linker_so.name, "[dynamic linker]");
   linker_so.base = linker_addr;
   linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum);
   linker_so.load_bias = get_elf_exec_load_bias(elf_hdr);
-  linker_so.dynamic = NULL;
+  linker_so.dynamic = nullptr;
   linker_so.phdr = phdr;
   linker_so.phnum = elf_hdr->e_phnum;
   linker_so.flags |= FLAG_LINKER;
 
-  if (!soinfo_link_image(&linker_so, NULL)) {
+  if (!(linker_so.PrelinkImage() && linker_so.LinkImage(nullptr))) {
     // It would be nice to print an error message, but if the linker
     // can't link itself, there's no guarantee that we'll be able to
     // call write() (because it involves a GOT reference). We may as
@@ -2335,9 +2583,17 @@
     _exit(EXIT_FAILURE);
   }
 
+  __libc_init_tls(args);
+
   // Initialize the linker's own global variables
   linker_so.CallConstructors();
 
+  // Initialize static variables. Note that in order to
+  // get correct libdl_info we need to call constructors
+  // before get_libdl_info().
+  solist = get_libdl_info();
+  sonext = get_libdl_info();
+
   // We have successfully fixed our own relocations. It's safe to run
   // the main part of the linker now.
   args.abort_message_ptr = &g_abort_message;
diff --git a/linker/linker.h b/linker/linker.h
index 374652e..fa38c7f 100644
--- a/linker/linker.h
+++ b/linker/linker.h
@@ -30,6 +30,7 @@
 #define _LINKER_H_
 
 #include <elf.h>
+#include <inttypes.h>
 #include <link.h>
 #include <unistd.h>
 #include <android/dlext.h>
@@ -88,6 +89,8 @@
 #define FLAG_LINKER     0x00000010 // The linker itself
 #define FLAG_NEW_SOINFO 0x40000000 // new soinfo format
 
+#define SOINFO_VERSION 0
+
 #define SOINFO_NAME_LEN 128
 
 typedef void (*linker_function_t)();
@@ -133,7 +136,9 @@
   soinfo* next;
   unsigned flags;
 
+ private:
   const char* strtab;
+ public:
   ElfW(Sym)* symtab;
 
   size_t nbucket;
@@ -195,29 +200,47 @@
   bool has_text_relocations;
 #endif
   bool has_DT_SYMBOLIC;
+
+  soinfo(const char* name, const struct stat* file_stat, off64_t file_offset);
+
   void CallConstructors();
   void CallDestructors();
   void CallPreInitConstructors();
+  bool PrelinkImage();
+  bool LinkImage(const android_dlextinfo* extinfo);
 
   void add_child(soinfo* child);
   void remove_all_links();
 
-  void set_st_dev(dev_t st_dev);
-  void set_st_ino(ino_t st_ino);
   ino_t get_st_ino();
   dev_t get_st_dev();
+  off64_t get_file_offset();
 
   soinfo_list_t& get_children();
+  soinfo_list_t& get_parents();
 
+  ElfW(Addr) resolve_symbol_address(ElfW(Sym)* s);
+
+  const char* get_string(ElfW(Word) index) const;
+
+  bool inline has_min_version(uint32_t min_version) const {
+    return (flags & FLAG_NEW_SOINFO) != 0 && version >= min_version;
+  }
  private:
   void CallArray(const char* array_name, linker_function_t* functions, size_t count, bool reverse);
   void CallFunction(const char* function_name, linker_function_t function);
+#if defined(USE_RELA)
+  int Relocate(ElfW(Rela)* rela, unsigned count);
+#else
+  int Relocate(ElfW(Rel)* rel, unsigned count);
+#endif
 
  private:
   // This part of the structure is only available
   // when FLAG_NEW_SOINFO is set in this->flags.
-  unsigned int version;
+  uint32_t version;
 
+  // version >= 0
   dev_t st_dev;
   ino_t st_ino;
 
@@ -225,6 +248,12 @@
   soinfo_list_t children;
   soinfo_list_t parents;
 
+  // version >= 1
+  off64_t file_offset;
+  int rtld_flags;
+  size_t strtab_size;
+
+  friend soinfo* get_libdl_info();
 };
 
 extern soinfo* get_libdl_info();
diff --git a/linker/linker_debug.h b/linker/linker_debug.h
index 3faa38e..0c7a784 100644
--- a/linker/linker_debug.h
+++ b/linker/linker_debug.h
@@ -42,6 +42,7 @@
 #define TRACE_DEBUG          1
 #define DO_TRACE_LOOKUP      1
 #define DO_TRACE_RELO        1
+#define DO_TRACE_IFUNC       1
 #define TIMING               0
 #define STATS                0
 #define COUNT_PAGES          0
diff --git a/linker/linker_environ.cpp b/linker/linker_environ.cpp
index 846624b..daee56f 100644
--- a/linker/linker_environ.cpp
+++ b/linker/linker_environ.cpp
@@ -58,7 +58,7 @@
 
 // Check if the environment variable definition at 'envstr'
 // starts with '<name>=', and if so return the address of the
-// first character after the equal sign. Otherwise return NULL.
+// first character after the equal sign. Otherwise return null.
 static const char* env_match(const char* envstr, const char* name) {
   size_t i = 0;
 
@@ -70,7 +70,7 @@
     return envstr + i + 1;
   }
 
-  return NULL;
+  return nullptr;
 }
 
 static bool __is_valid_environment_variable(const char* name) {
@@ -78,7 +78,7 @@
   // as the maximum size for an env. variable definition.
   const int MAX_ENV_LEN = 32*4096;
 
-  if (name == NULL) {
+  if (name == nullptr) {
     return false;
   }
 
@@ -136,10 +136,10 @@
       "RES_OPTIONS",
       "TMPDIR",
       "TZDIR",
-      NULL
+      nullptr
   };
-  for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != NULL; ++i) {
-    if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != NULL) {
+  for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != nullptr; ++i) {
+    if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != nullptr) {
       return true;
     }
   }
@@ -149,7 +149,7 @@
 static void __sanitize_environment_variables() {
   char** src  = _envp;
   char** dst = _envp;
-  for (; src[0] != NULL; ++src) {
+  for (; src[0] != nullptr; ++src) {
     if (!__is_valid_environment_variable(src[0])) {
       continue;
     }
@@ -160,11 +160,11 @@
     dst[0] = src[0];
     ++dst;
   }
-  dst[0] = NULL;
+  dst[0] = nullptr;
 }
 
 void linker_env_init(KernelArgumentBlock& args) {
-  // Store environment pointer - can't be NULL.
+  // Store environment pointer - can't be null.
   _envp = args.envp;
 
   __init_AT_SECURE(args);
@@ -172,18 +172,18 @@
 }
 
 const char* linker_env_get(const char* name) {
-  if (name == NULL || name[0] == '\0') {
-    return NULL;
+  if (name == nullptr || name[0] == '\0') {
+    return nullptr;
   }
 
-  for (char** p = _envp; p[0] != NULL; ++p) {
+  for (char** p = _envp; p[0] != nullptr; ++p) {
     const char* val = env_match(p[0], name);
-    if (val != NULL) {
+    if (val != nullptr) {
       if (val[0] == '\0') {
-        return NULL; // Return NULL for empty strings.
+        return nullptr; // Return null for empty strings.
       }
       return val;
     }
   }
-  return NULL;
+  return nullptr;
 }
diff --git a/linker/linker_environ.h b/linker/linker_environ.h
index d3f54fd..0f6ac08 100644
--- a/linker/linker_environ.h
+++ b/linker/linker_environ.h
@@ -35,7 +35,7 @@
 extern void linker_env_init(KernelArgumentBlock& args);
 
 // Returns the value of environment variable 'name' if defined and not
-// empty, or NULL otherwise.
+// empty, or null otherwise.
 extern const char* linker_env_get(const char* name);
 
 // Returns the value of this program's AT_SECURE variable.
diff --git a/linker/linker_executable.mk b/linker/linker_executable.mk
index 4902a0c..a596a48 100644
--- a/linker/linker_executable.mk
+++ b/linker/linker_executable.mk
@@ -9,6 +9,8 @@
 LOCAL_MODULE_CLASS := EXECUTABLES
 LOCAL_MODULE_SUFFIX := $(TARGET_EXECUTABLE_SUFFIX)
 
+# Clang calls /usr/bin/ld: unrecognized option '--icf=safe', http://b/17403674.
+LOCAL_CLANG := false
 include $(BUILD_SYSTEM)/dynamic_binary.mk
 
 # See build/core/executable_internal.mk
diff --git a/linker/linker_libc_support.c b/linker/linker_libc_support.c
new file mode 100644
index 0000000..17db6d4
--- /dev/null
+++ b/linker/linker_libc_support.c
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "../libc/arch-common/bionic/__dso_handle.h"
diff --git a/linker/linker_phdr.cpp b/linker/linker_phdr.cpp
index 0b99d20..4b1c0ca 100644
--- a/linker/linker_phdr.cpp
+++ b/linker/linker_phdr.cpp
@@ -119,15 +119,15 @@
                                       MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
                                       MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
 
-ElfReader::ElfReader(const char* name, int fd)
-    : name_(name), fd_(fd),
-      phdr_num_(0), phdr_mmap_(NULL), phdr_table_(NULL), phdr_size_(0),
-      load_start_(NULL), load_size_(0), load_bias_(0),
-      loaded_phdr_(NULL) {
+ElfReader::ElfReader(const char* name, int fd, off64_t file_offset)
+    : name_(name), fd_(fd), file_offset_(file_offset),
+      phdr_num_(0), phdr_mmap_(nullptr), phdr_table_(nullptr), phdr_size_(0),
+      load_start_(nullptr), load_size_(0), load_bias_(0),
+      loaded_phdr_(nullptr) {
 }
 
 ElfReader::~ElfReader() {
-  if (phdr_mmap_ != NULL) {
+  if (phdr_mmap_ != nullptr) {
     munmap(phdr_mmap_, phdr_size_);
   }
 }
@@ -142,11 +142,12 @@
 }
 
 bool ElfReader::ReadElfHeader() {
-  ssize_t rc = TEMP_FAILURE_RETRY(read(fd_, &header_, sizeof(header_)));
+  ssize_t rc = TEMP_FAILURE_RETRY(pread64(fd_, &header_, sizeof(header_), file_offset_));
   if (rc < 0) {
     DL_ERR("can't read file \"%s\": %s", name_, strerror(errno));
     return false;
   }
+
   if (rc != sizeof(header_)) {
     DL_ERR("\"%s\" is too small to be an ELF executable: only found %zd bytes", name_,
            static_cast<size_t>(rc));
@@ -225,7 +226,7 @@
 
   phdr_size_ = page_max - page_min;
 
-  void* mmap_result = mmap(NULL, phdr_size_, PROT_READ, MAP_PRIVATE, fd_, page_min);
+  void* mmap_result = mmap64(nullptr, phdr_size_, PROT_READ, MAP_PRIVATE, fd_, file_offset_ + page_min);
   if (mmap_result == MAP_FAILED) {
     DL_ERR("\"%s\" phdr mmap failed: %s", name_, strerror(errno));
     return false;
@@ -242,7 +243,7 @@
  * process' address space. If there are no loadable segments, 0 is
  * returned.
  *
- * If out_min_vaddr or out_max_vaddr are non-NULL, they will be
+ * If out_min_vaddr or out_max_vaddr are not null, they will be
  * set to the minimum and maximum addresses of pages to be reserved,
  * or 0 if there is nothing to load.
  */
@@ -276,10 +277,10 @@
   min_vaddr = PAGE_START(min_vaddr);
   max_vaddr = PAGE_END(max_vaddr);
 
-  if (out_min_vaddr != NULL) {
+  if (out_min_vaddr != nullptr) {
     *out_min_vaddr = min_vaddr;
   }
-  if (out_max_vaddr != NULL) {
+  if (out_max_vaddr != nullptr) {
     *out_max_vaddr = max_vaddr;
   }
   return max_vaddr - min_vaddr;
@@ -301,7 +302,7 @@
   size_t reserved_size = 0;
   bool reserved_hint = true;
 
-  if (extinfo != NULL) {
+  if (extinfo != nullptr) {
     if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS) {
       reserved_size = extinfo->reserved_size;
       reserved_hint = false;
@@ -356,12 +357,12 @@
     ElfW(Addr) file_length = file_end - file_page_start;
 
     if (file_length != 0) {
-      void* seg_addr = mmap(reinterpret_cast<void*>(seg_page_start),
+      void* seg_addr = mmap64(reinterpret_cast<void*>(seg_page_start),
                             file_length,
                             PFLAGS_TO_PROT(phdr->p_flags),
                             MAP_FIXED|MAP_PRIVATE,
                             fd_,
-                            file_page_start);
+                            file_offset_ + file_page_start);
       if (seg_addr == MAP_FAILED) {
         DL_ERR("couldn't map \"%s\" segment %zd: %s", name_, i, strerror(errno));
         return false;
@@ -585,9 +586,9 @@
     return -1;
   }
   off_t file_size = file_stat.st_size;
-  void* temp_mapping = NULL;
+  void* temp_mapping = nullptr;
   if (file_size > 0) {
-    temp_mapping = mmap(NULL, file_size, PROT_READ, MAP_PRIVATE, fd, 0);
+    temp_mapping = mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0);
     if (temp_mapping == MAP_FAILED) {
       return -1;
     }
@@ -667,7 +668,7 @@
  *   phdr_count  -> number of entries in tables
  *   load_bias   -> load bias
  * Output:
- *   arm_exidx       -> address of table in memory (NULL on failure).
+ *   arm_exidx       -> address of table in memory (null on failure).
  *   arm_exidx_count -> number of items in table (0 on failure).
  * Return:
  *   0 on error, -1 on failure (_no_ error code in errno)
@@ -687,49 +688,37 @@
     *arm_exidx_count = (unsigned)(phdr->p_memsz / 8);
     return 0;
   }
-  *arm_exidx = NULL;
+  *arm_exidx = nullptr;
   *arm_exidx_count = 0;
   return -1;
 }
 #endif
 
 /* Return the address and size of the ELF file's .dynamic section in memory,
- * or NULL if missing.
+ * or null if missing.
  *
  * Input:
  *   phdr_table  -> program header table
  *   phdr_count  -> number of entries in tables
  *   load_bias   -> load bias
  * Output:
- *   dynamic       -> address of table in memory (NULL on failure).
- *   dynamic_count -> number of items in table (0 on failure).
+ *   dynamic       -> address of table in memory (null on failure).
  *   dynamic_flags -> protection flags for section (unset on failure)
  * Return:
  *   void
  */
 void phdr_table_get_dynamic_section(const ElfW(Phdr)* phdr_table, size_t phdr_count,
-                                    ElfW(Addr) load_bias,
-                                    ElfW(Dyn)** dynamic, size_t* dynamic_count, ElfW(Word)* dynamic_flags) {
-  const ElfW(Phdr)* phdr = phdr_table;
-  const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
-
-  for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
-    if (phdr->p_type != PT_DYNAMIC) {
-      continue;
+                                    ElfW(Addr) load_bias, ElfW(Dyn)** dynamic,
+                                    ElfW(Word)* dynamic_flags) {
+  *dynamic = nullptr;
+  for (const ElfW(Phdr)* phdr = phdr_table, *phdr_limit = phdr + phdr_count; phdr < phdr_limit; phdr++) {
+    if (phdr->p_type == PT_DYNAMIC) {
+      *dynamic = reinterpret_cast<ElfW(Dyn)*>(load_bias + phdr->p_vaddr);
+      if (dynamic_flags) {
+        *dynamic_flags = phdr->p_flags;
+      }
+      return;
     }
-
-    *dynamic = reinterpret_cast<ElfW(Dyn)*>(load_bias + phdr->p_vaddr);
-    if (dynamic_count) {
-      *dynamic_count = (unsigned)(phdr->p_memsz / 8);
-    }
-    if (dynamic_flags) {
-      *dynamic_flags = phdr->p_flags;
-    }
-    return;
-  }
-  *dynamic = NULL;
-  if (dynamic_count) {
-    *dynamic_count = 0;
   }
 }
 
diff --git a/linker/linker_phdr.h b/linker/linker_phdr.h
index 611f1a7..65d302c 100644
--- a/linker/linker_phdr.h
+++ b/linker/linker_phdr.h
@@ -39,7 +39,7 @@
 
 class ElfReader {
  public:
-  ElfReader(const char* name, int fd);
+  ElfReader(const char* name, int fd, off64_t file_offset);
   ~ElfReader();
 
   bool Load(const android_dlextinfo* extinfo);
@@ -61,6 +61,7 @@
 
   const char* name_;
   int fd_;
+  off64_t file_offset_;
 
   ElfW(Ehdr) header_;
   size_t phdr_num_;
@@ -81,7 +82,7 @@
 };
 
 size_t phdr_table_get_load_size(const ElfW(Phdr)* phdr_table, size_t phdr_count,
-                                ElfW(Addr)* min_vaddr = NULL, ElfW(Addr)* max_vaddr = NULL);
+                                ElfW(Addr)* min_vaddr = nullptr, ElfW(Addr)* max_vaddr = nullptr);
 
 int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table, size_t phdr_count, ElfW(Addr) load_bias);
 
@@ -101,7 +102,7 @@
 #endif
 
 void phdr_table_get_dynamic_section(const ElfW(Phdr)* phdr_table, size_t phdr_count,
-                                    ElfW(Addr) load_bias,
-                                    ElfW(Dyn)** dynamic, size_t* dynamic_count, ElfW(Word)* dynamic_flags);
+                                    ElfW(Addr) load_bias, ElfW(Dyn)** dynamic,
+                                    ElfW(Word)* dynamic_flags);
 
 #endif /* LINKER_PHDR_H */
diff --git a/linker/tests/linked_list_test.cpp b/linker/tests/linked_list_test.cpp
index b9816fa..09ad687 100644
--- a/linker/tests/linked_list_test.cpp
+++ b/linker/tests/linked_list_test.cpp
@@ -80,7 +80,7 @@
   });
 
   ASSERT_TRUE(!alloc_called);
-  ASSERT_TRUE(!free_called);
+  ASSERT_TRUE(free_called);
 
   ASSERT_EQ("dba", test_list_to_string(list));
   alloc_called = free_called = false;
@@ -103,15 +103,114 @@
   ASSERT_EQ("ab", test_list_to_string(list));
   list.push_back("c");
   ASSERT_EQ("abc", test_list_to_string(list));
-  ASSERT_EQ("a", list.pop_front());
+  ASSERT_STREQ("a", list.pop_front());
   ASSERT_EQ("bc", test_list_to_string(list));
-  ASSERT_EQ("b", list.pop_front());
+  ASSERT_STREQ("b", list.pop_front());
   ASSERT_EQ("c", test_list_to_string(list));
-  ASSERT_EQ("c", list.pop_front());
+  ASSERT_STREQ("c", list.pop_front());
   ASSERT_EQ("", test_list_to_string(list));
   ASSERT_TRUE(list.pop_front() == nullptr);
   list.push_back("r");
   ASSERT_EQ("r", test_list_to_string(list));
-  ASSERT_EQ("r", list.pop_front());
+  ASSERT_STREQ("r", list.pop_front());
   ASSERT_TRUE(list.pop_front() == nullptr);
 }
+
+TEST(linked_list, remove_if_then_pop) {
+  test_list_t list;
+  list.push_back("a");
+  list.push_back("b");
+  list.push_back("c");
+  list.push_back("d");
+  list.remove_if([](const char* c) {
+    return *c == 'b' || *c == 'c';
+  });
+
+  ASSERT_EQ("ad", test_list_to_string(list));
+  ASSERT_STREQ("a", list.pop_front());
+  ASSERT_EQ("d", test_list_to_string(list));
+  ASSERT_STREQ("d", list.pop_front());
+  ASSERT_TRUE(list.pop_front() == nullptr);
+}
+
+TEST(linked_list, copy_to_array) {
+  test_list_t list;
+  const size_t max_size = 128;
+  const char* buf[max_size];
+  memset(buf, 0, sizeof(buf));
+
+  ASSERT_EQ(0U, list.copy_to_array(buf, max_size));
+  ASSERT_EQ(nullptr, buf[0]);
+
+  list.push_back("a");
+  list.push_back("b");
+  list.push_back("c");
+  list.push_back("d");
+
+  memset(buf, 0, sizeof(buf));
+  ASSERT_EQ(2U, list.copy_to_array(buf, 2));
+  ASSERT_STREQ("a", buf[0]);
+  ASSERT_STREQ("b", buf[1]);
+  ASSERT_EQ(nullptr, buf[2]);
+
+  ASSERT_EQ(4U, list.copy_to_array(buf, max_size));
+  ASSERT_STREQ("a", buf[0]);
+  ASSERT_STREQ("b", buf[1]);
+  ASSERT_STREQ("c", buf[2]);
+  ASSERT_STREQ("d", buf[3]);
+  ASSERT_EQ(nullptr, buf[4]);
+
+  memset(buf, 0, sizeof(buf));
+  list.remove_if([](const char* c) {
+    return *c != 'c';
+  });
+  ASSERT_EQ(1U, list.copy_to_array(buf, max_size));
+  ASSERT_STREQ("c", buf[0]);
+  ASSERT_EQ(nullptr, buf[1]);
+
+  memset(buf, 0, sizeof(buf));
+
+  list.remove_if([](const char* c) {
+    return *c == 'c';
+  });
+
+  ASSERT_EQ(0U, list.copy_to_array(buf, max_size));
+  ASSERT_EQ(nullptr, buf[0]);
+}
+
+TEST(linked_list, test_visit) {
+  test_list_t list;
+  list.push_back("a");
+  list.push_back("b");
+  list.push_back("c");
+  list.push_back("d");
+
+  int visits = 0;
+  std::stringstream ss;
+  bool result = list.visit([&](const char* c) {
+    ++visits;
+    ss << c;
+    return true;
+  });
+
+  ASSERT_TRUE(result);
+  ASSERT_EQ(4, visits);
+  ASSERT_EQ("abcd", ss.str());
+
+  visits = 0;
+  ss.str(std::string());
+
+  result = list.visit([&](const char* c) {
+    if (++visits == 3) {
+      return false;
+    }
+
+    ss << c;
+    return true;
+  });
+
+  ASSERT_TRUE(!result);
+  ASSERT_EQ(3, visits);
+  ASSERT_EQ("ab", ss.str());
+}
+
diff --git a/tests/Android.build.mk b/tests/Android.build.mk
index d4b0396..63729da 100644
--- a/tests/Android.build.mk
+++ b/tests/Android.build.mk
@@ -15,6 +15,7 @@
 #
 
 include $(CLEAR_VARS)
+LOCAL_ADDITIONAL_DEPENDENCIES := $(common_additional_dependencies)
 
 LOCAL_MODULE := $(module)
 LOCAL_MODULE_TAGS := $(module_tag)
@@ -37,6 +38,10 @@
 
 LOCAL_FORCE_STATIC_EXECUTABLE := $($(module)_force_static_executable)
 
+ifneq ($($(module)_multilib),)
+    LOCAL_MULTILIB := $($(module)_multilib)
+endif
+
 LOCAL_CFLAGS := \
     $(common_cflags) \
     $($(module)_cflags) \
diff --git a/tests/Android.mk b/tests/Android.mk
index 8184bf7..8b0b0a0 100644
--- a/tests/Android.mk
+++ b/tests/Android.mk
@@ -28,6 +28,8 @@
 build_host := false
 endif
 
+common_additional_dependencies := $(LOCAL_PATH)/Android.mk $(LOCAL_PATH)/Android.build.mk
+
 # -----------------------------------------------------------------------------
 # All standard tests.
 # -----------------------------------------------------------------------------
@@ -112,6 +114,7 @@
     system_properties_test.cpp \
     time_test.cpp \
     uchar_test.cpp \
+    uniqueptr_test.cpp \
     unistd_test.cpp \
     wchar_test.cpp \
 
@@ -133,9 +136,6 @@
 libBionicStandardTests_ldlibs_host := \
     -lrt \
 
-libBionicStandardTests_whole_static_libraries := \
-    libBionicUnwindTest \
-
 module := libBionicStandardTests
 module_tag := optional
 build_type := target
@@ -145,36 +145,16 @@
 include $(LOCAL_PATH)/Android.build.mk
 
 # -----------------------------------------------------------------------------
-# Special stack unwinding test library compiled with special flags.
-# -----------------------------------------------------------------------------
-libBionicUnwindTest_cflags := \
-    $(test_cflags) \
-    -fexceptions \
-    -fnon-call-exceptions \
-
-libBionicUnwindTest_src_files := \
-    stack_unwinding_test_impl.c \
-
-module := libBionicUnwindTest
-module_tag := optional
-build_type := target
-build_target := STATIC_TEST_LIBRARY
-include $(LOCAL_PATH)/Android.build.mk
-build_type := host
-include $(LOCAL_PATH)/Android.build.mk
-
-# -----------------------------------------------------------------------------
 # Fortify tests.
 # -----------------------------------------------------------------------------
 $(foreach compiler,gcc clang, \
   $(foreach test,1 2, \
     $(eval fortify$(test)-tests-$(compiler)_cflags := \
       $(test_cflags) \
+      -Wno-error \
       -U_FORTIFY_SOURCE \
       -D_FORTIFY_SOURCE=$(test) \
       -DTEST_NAME=Fortify$(test)_$(compiler)); \
-    $(eval fortify$(test)-tests-$(compiler)_cflags_host := \
-      -Wno-error); \
     $(eval fortify$(test)-tests-$(compiler)_src_files := \
       fortify_test.cpp); \
     $(eval fortify_libs += fortify$(test)-tests-$(compiler)); \
@@ -249,6 +229,11 @@
     dlfcn_test.cpp \
 
 bionic-unit-tests_cflags := $(test_cflags)
+
+bionic-unit-tests_conlyflags := \
+    -fexceptions \
+    -fnon-call-exceptions \
+
 bionic-unit-tests_cppflags := $(test_cppflags)
 
 bionic-unit-tests_ldflags := \
@@ -256,6 +241,7 @@
     -Wl,-u,DlSymTestFunction \
 
 bionic-unit-tests_c_includes := \
+    bionic/libc \
     $(call include-path-for, libpagemap) \
 
 bionic-unit-tests_shared_libraries_target := \
@@ -299,6 +285,7 @@
 
 bionic-unit-tests-glibc_src_files := \
     atexit_test.cpp \
+    dlfcn_test.cpp \
 
 bionic-unit-tests-glibc_whole_static_libraries := \
     libBionicStandardTests \
@@ -306,8 +293,12 @@
 bionic-unit-tests-glibc_ldlibs := \
     -lrt -ldl \
 
+bionic-unit-tests-glibc_c_includes := \
+    bionic/libc \
+
 bionic-unit-tests-glibc_cflags := $(test_cflags)
 bionic-unit-tests-glibc_cppflags := $(test_cppflags)
+bionic-unit-tests-glibc_ldflags := -Wl,--export-dynamic
 
 module := bionic-unit-tests-glibc
 module_tag := optional
@@ -356,6 +347,22 @@
 		$(TARGET_OUT_DATA_NATIVE_TESTS)/bionic-unit-tests/bionic-unit-tests$(NATIVE_TEST_SUFFIX) $(BIONIC_TEST_FLAGS)
 endif
 
+ifeq ($(TARGET_ARCH),$(filter $(TARGET_ARCH),x86_64))
+# add target to run lp32 tests
+bionic-unit-tests-run-on-host32: bionic-unit-tests_32 $(TARGET_OUT_EXECUTABLES)/$(LINKER) $(TARGET_OUT_EXECUTABLES)/sh
+	if [ ! -d /system -o ! -d /system/bin ]; then \
+	  echo "Attempting to create /system/bin"; \
+	  sudo mkdir -p -m 0777 /system/bin; \
+	fi
+	mkdir -p $(TARGET_OUT_DATA)/local/tmp
+	cp $(TARGET_OUT_EXECUTABLES)/linker /system/bin
+	cp $(TARGET_OUT_EXECUTABLES)/sh /system/bin
+	ANDROID_DATA=$(TARGET_OUT_DATA) \
+	ANDROID_ROOT=$(TARGET_OUT) \
+	LD_LIBRARY_PATH=$(2ND_TARGET_OUT_SHARED_LIBRARIES) \
+		$(2ND_TARGET_OUT_DATA_NATIVE_TESTS)/bionic-unit-tests/bionic-unit-tests32 $(BIONIC_TEST_FLAGS)
+endif
+
 endif # linux-x86
 
 include $(call first-makefiles-under,$(LOCAL_PATH))
diff --git a/tests/ScopedSignalHandler.h b/tests/ScopedSignalHandler.h
index 89a14a6..3ec23b0 100644
--- a/tests/ScopedSignalHandler.h
+++ b/tests/ScopedSignalHandler.h
@@ -21,9 +21,10 @@
 
 class ScopedSignalHandler {
  public:
-  ScopedSignalHandler(int signal_number, void (*handler)(int)) : signal_number_(signal_number) {
+  ScopedSignalHandler(int signal_number, void (*handler)(int), int sa_flags = 0)
+      : signal_number_(signal_number) {
     sigemptyset(&action_.sa_mask);
-    action_.sa_flags = 0;
+    action_.sa_flags = sa_flags;
     action_.sa_handler = handler;
     sigaction(signal_number_, &action_, &old_action_);
   }
diff --git a/tests/dlext_test.cpp b/tests/dlext_test.cpp
index da63046..7f706c1 100644
--- a/tests/dlext_test.cpp
+++ b/tests/dlext_test.cpp
@@ -31,7 +31,7 @@
 
 
 #define ASSERT_DL_NOTNULL(ptr) \
-    ASSERT_TRUE(ptr != NULL) << "dlerror: " << dlerror()
+    ASSERT_TRUE(ptr != nullptr) << "dlerror: " << dlerror()
 
 #define ASSERT_DL_ZERO(i) \
     ASSERT_EQ(0, i) << "dlerror: " << dlerror()
@@ -46,23 +46,31 @@
 #define LIBSIZE 1024*1024 // how much address space to reserve for it
 
 #if defined(__LP64__)
-#define LIBPATH "%s/nativetest64/libdlext_test_fd/libdlext_test_fd.so"
+#define LIBPATH_PREFIX "%s/nativetest64/libdlext_test_fd/"
 #else
-#define LIBPATH "%s/nativetest/libdlext_test_fd/libdlext_test_fd.so"
+#define LIBPATH_PREFIX "%s/nativetest/libdlext_test_fd/"
 #endif
 
+#define LIBPATH LIBPATH_PREFIX "libdlext_test_fd.so"
+#define LIBZIPPATH LIBPATH_PREFIX "libdlext_test_fd_zipaligned.zip"
+
+#define LIBZIP_OFFSET 2*PAGE_SIZE
+
 class DlExtTest : public ::testing::Test {
 protected:
   virtual void SetUp() {
-    handle_ = NULL;
+    handle_ = nullptr;
     // verify that we don't have the library loaded already
-    ASSERT_EQ(NULL, dlsym(RTLD_DEFAULT, "getRandomNumber"));
+    void* h = dlopen(LIBNAME, RTLD_NOW | RTLD_NOLOAD);
+    ASSERT_TRUE(h == nullptr);
+    h = dlopen(LIBNAME_NORELRO, RTLD_NOW | RTLD_NOLOAD);
+    ASSERT_TRUE(h == nullptr);
     // call dlerror() to swallow the error, and check it was the one we wanted
-    ASSERT_STREQ("undefined symbol: getRandomNumber", dlerror());
+    ASSERT_STREQ("dlopen failed: library \"" LIBNAME_NORELRO "\" wasn't loaded and RTLD_NOLOAD prevented it", dlerror());
   }
 
   virtual void TearDown() {
-    if (handle_ != NULL) {
+    if (handle_ != nullptr) {
       ASSERT_DL_ZERO(dlclose(handle_));
     }
   }
@@ -71,7 +79,7 @@
 };
 
 TEST_F(DlExtTest, ExtInfoNull) {
-  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, NULL);
+  handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, nullptr);
   ASSERT_DL_NOTNULL(handle_);
   fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
   ASSERT_DL_NOTNULL(f);
@@ -90,7 +98,7 @@
 
 TEST_F(DlExtTest, ExtInfoUseFd) {
   const char* android_data = getenv("ANDROID_DATA");
-  ASSERT_TRUE(android_data != NULL);
+  ASSERT_TRUE(android_data != nullptr);
   char lib_path[PATH_MAX];
   snprintf(lib_path, sizeof(lib_path), LIBPATH, android_data);
 
@@ -105,8 +113,64 @@
   EXPECT_EQ(4, f());
 }
 
+TEST_F(DlExtTest, ExtInfoUseFdWithOffset) {
+  const char* android_data = getenv("ANDROID_DATA");
+  ASSERT_TRUE(android_data != nullptr);
+
+  char lib_path[PATH_MAX];
+  snprintf(lib_path, sizeof(lib_path), LIBZIPPATH, android_data);
+
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_USE_LIBRARY_FD | ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET;
+  extinfo.library_fd = TEMP_FAILURE_RETRY(open(lib_path, O_RDONLY | O_CLOEXEC));
+  extinfo.library_fd_offset = LIBZIP_OFFSET;
+
+  handle_ = android_dlopen_ext(lib_path, RTLD_NOW, &extinfo);
+  ASSERT_DL_NOTNULL(handle_);
+
+  fn f = reinterpret_cast<fn>(dlsym(handle_, "getRandomNumber"));
+  ASSERT_DL_NOTNULL(f);
+  EXPECT_EQ(4, f());
+}
+
+TEST_F(DlExtTest, ExtInfoUseFdWithInvalidOffset) {
+  const char* android_data = getenv("ANDROID_DATA");
+  ASSERT_TRUE(android_data != nullptr);
+
+  char lib_path[PATH_MAX];
+  snprintf(lib_path, sizeof(lib_path), LIBZIPPATH, android_data);
+
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_USE_LIBRARY_FD | ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET;
+  extinfo.library_fd = TEMP_FAILURE_RETRY(open(lib_path, O_RDONLY | O_CLOEXEC));
+  extinfo.library_fd_offset = 17;
+
+  handle_ = android_dlopen_ext("libname_placeholder", RTLD_NOW, &extinfo);
+  ASSERT_TRUE(handle_ == nullptr);
+  ASSERT_STREQ("dlopen failed: file offset for the library \"libname_placeholder\" is not page-aligned: 17", dlerror());
+
+  extinfo.library_fd_offset = (5LL<<58) + PAGE_SIZE;
+  handle_ = android_dlopen_ext("libname_placeholder", RTLD_NOW, &extinfo);
+
+  ASSERT_TRUE(handle_ == nullptr);
+  // TODO: Better error message when reading with offset > file_size
+  ASSERT_STREQ("dlopen failed: \"libname_placeholder\" has bad ELF magic", dlerror());
+
+  close(extinfo.library_fd);
+}
+
+TEST_F(DlExtTest, ExtInfoUseOffsetWihtoutFd) {
+  android_dlextinfo extinfo;
+  extinfo.flags = ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET;
+  extinfo.library_fd_offset = LIBZIP_OFFSET;
+
+  handle_ = android_dlopen_ext("/some/lib/that/does_not_exist", RTLD_NOW, &extinfo);
+  ASSERT_TRUE(handle_ == nullptr);
+  ASSERT_STREQ("dlopen failed: invalid extended flag combination (ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET without ANDROID_DLEXT_USE_LIBRARY_FD): 0x20", dlerror());
+}
+
 TEST_F(DlExtTest, Reserved) {
-  void* start = mmap(NULL, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+  void* start = mmap(nullptr, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
                      -1, 0);
   ASSERT_TRUE(start != MAP_FAILED);
   android_dlextinfo extinfo;
@@ -124,7 +188,7 @@
 }
 
 TEST_F(DlExtTest, ReservedTooSmall) {
-  void* start = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+  void* start = mmap(nullptr, PAGE_SIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
                      -1, 0);
   ASSERT_TRUE(start != MAP_FAILED);
   android_dlextinfo extinfo;
@@ -132,11 +196,11 @@
   extinfo.reserved_addr = start;
   extinfo.reserved_size = PAGE_SIZE;
   handle_ = android_dlopen_ext(LIBNAME, RTLD_NOW, &extinfo);
-  EXPECT_EQ(NULL, handle_);
+  EXPECT_EQ(nullptr, handle_);
 }
 
 TEST_F(DlExtTest, ReservedHint) {
-  void* start = mmap(NULL, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+  void* start = mmap(nullptr, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
                      -1, 0);
   ASSERT_TRUE(start != MAP_FAILED);
   android_dlextinfo extinfo;
@@ -154,7 +218,7 @@
 }
 
 TEST_F(DlExtTest, ReservedHintTooSmall) {
-  void* start = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+  void* start = mmap(nullptr, PAGE_SIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
                      -1, 0);
   ASSERT_TRUE(start != MAP_FAILED);
   android_dlextinfo extinfo;
@@ -174,7 +238,7 @@
 protected:
   virtual void SetUp() {
     DlExtTest::SetUp();
-    void* start = mmap(NULL, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
+    void* start = mmap(nullptr, LIBSIZE, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
                        -1, 0);
     ASSERT_TRUE(start != MAP_FAILED);
     extinfo_.flags = ANDROID_DLEXT_RESERVED_ADDRESS;
@@ -183,7 +247,7 @@
     extinfo_.relro_fd = -1;
 
     const char* android_data = getenv("ANDROID_DATA");
-    ASSERT_TRUE(android_data != NULL);
+    ASSERT_TRUE(android_data != nullptr);
     snprintf(relro_file_, sizeof(relro_file_), "%s/local/tmp/libdlext_test.relro", android_data);
   }
 
@@ -204,7 +268,7 @@
       extinfo_.flags |= ANDROID_DLEXT_WRITE_RELRO;
       extinfo_.relro_fd = relro_fd;
       void* handle = android_dlopen_ext(lib, RTLD_NOW, &extinfo_);
-      if (handle == NULL) {
+      if (handle == nullptr) {
         fprintf(stderr, "in child: %s\n", dlerror());
         exit(1);
       }
@@ -327,7 +391,7 @@
       } else {
         handle = dlopen(lib, RTLD_NOW);
       }
-      if (handle == NULL) {
+      if (handle == nullptr) {
         fprintf(stderr, "in child: %s\n", dlerror());
         exit(1);
       }
diff --git a/tests/dlfcn_test.cpp b/tests/dlfcn_test.cpp
index 457fcd5..e24af13 100644
--- a/tests/dlfcn_test.cpp
+++ b/tests/dlfcn_test.cpp
@@ -22,6 +22,8 @@
 #include <stdio.h>
 #include <stdint.h>
 
+#include "private/ScopeGuard.h"
+
 #include <string>
 
 #define ASSERT_SUBSTR(needle, haystack) \
@@ -87,6 +89,144 @@
   ASSERT_EQ(0, dlclose(handle2));
 }
 
+// ifuncs are only supported on intel and arm64 for now
+#if defined(__i386__) || defined(__x86_64__)
+TEST(dlfcn, ifunc) {
+  typedef const char* (*fn_ptr)();
+
+  // ifunc's choice depends on whether IFUNC_CHOICE has a value
+  // first check the set case
+  setenv("IFUNC_CHOICE", "set", 1);
+  void* handle = dlopen("libtest_ifunc.so", RTLD_NOW);
+  ASSERT_TRUE(handle != NULL);
+  fn_ptr foo_ptr = reinterpret_cast<fn_ptr>(dlsym(handle, "foo"));
+  fn_ptr foo_library_ptr = reinterpret_cast<fn_ptr>(dlsym(handle, "foo_library"));
+  ASSERT_TRUE(foo_ptr != NULL);
+  ASSERT_TRUE(foo_library_ptr != NULL);
+  ASSERT_EQ(strncmp("set", foo_ptr(), 3), 0);
+  ASSERT_EQ(strncmp("set", foo_library_ptr(), 3), 0);
+  dlclose(handle);
+
+  // then check the unset case
+  unsetenv("IFUNC_CHOICE");
+  handle = dlopen("libtest_ifunc.so", RTLD_NOW);
+  ASSERT_TRUE(handle != NULL);
+  foo_ptr = reinterpret_cast<fn_ptr>(dlsym(handle, "foo"));
+  foo_library_ptr = reinterpret_cast<fn_ptr>(dlsym(handle, "foo_library"));
+  ASSERT_TRUE(foo_ptr != NULL);
+  ASSERT_TRUE(foo_library_ptr != NULL);
+  ASSERT_EQ(strncmp("unset", foo_ptr(), 5), 0);
+  ASSERT_EQ(strncmp("unset", foo_library_ptr(), 3), 0);
+  dlclose(handle);
+}
+
+TEST(dlfcn, ifunc_ctor_call) {
+  typedef const char* (*fn_ptr)();
+
+  void* handle = dlopen("libtest_ifunc.so", RTLD_NOW);
+  ASSERT_TRUE(handle != nullptr) << dlerror();
+  fn_ptr is_ctor_called =  reinterpret_cast<fn_ptr>(dlsym(handle, "is_ctor_called_irelative"));
+  ASSERT_TRUE(is_ctor_called != nullptr) << dlerror();
+  ASSERT_STREQ("false", is_ctor_called());
+
+  is_ctor_called =  reinterpret_cast<fn_ptr>(dlsym(handle, "is_ctor_called_jump_slot"));
+  ASSERT_TRUE(is_ctor_called != nullptr) << dlerror();
+  ASSERT_STREQ("true", is_ctor_called());
+  dlclose(handle);
+}
+#endif
+
+TEST(dlfcn, dlopen_check_relocation_dt_needed_order) {
+  // This is the structure of the test library and
+  // its dt_needed libraries
+  // libtest_relo_check_dt_needed_order.so
+  // |
+  // +-> libtest_relo_check_dt_needed_order_1.so
+  // |
+  // +-> libtest_relo_check_dt_needed_order_2.so
+  //
+  // The root library references relo_test_get_answer_lib - which is defined
+  // in both dt_needed libraries, the correct relocation should
+  // use the function defined in libtest_relo_check_dt_needed_order_1.so
+  void* handle = nullptr;
+  auto guard = make_scope_guard([&]() {
+    dlclose(handle);
+  });
+
+  handle = dlopen("libtest_relo_check_dt_needed_order.so", RTLD_NOW);
+  ASSERT_TRUE(handle != nullptr) << dlerror();
+
+  typedef int (*fn_t) (void);
+  fn_t fn = reinterpret_cast<fn_t>(dlsym(handle, "relo_test_get_answer"));
+  ASSERT_TRUE(fn != nullptr) << dlerror();
+  ASSERT_EQ(1, fn());
+}
+
+TEST(dlfcn, dlopen_check_order) {
+  // Here is how the test library and its dt_needed
+  // libraries are arranged
+  //
+  //  libtest_check_order.so
+  //  |
+  //  +-> libtest_check_order_1_left.so
+  //  |   |
+  //  |   +-> libtest_check_order_a.so
+  //  |   |
+  //  |   +-> libtest_check_order_b.so
+  //  |
+  //  +-> libtest_check_order_2_right.so
+  //  |   |
+  //  |   +-> libtest_check_order_d.so
+  //  |       |
+  //  |       +-> libtest_check_order_b.so
+  //  |
+  //  +-> libtest_check_order_3_c.so
+  //
+  //  load order should be (1, 2, 3, a, b, d)
+  //
+  // get_answer() is defined in (2, 3, a, b, c)
+  // get_answer2() is defined in (b, d)
+  void* sym = dlsym(RTLD_DEFAULT, "dlopen_test_get_answer");
+  ASSERT_TRUE(sym == nullptr);
+  void* handle = dlopen("libtest_check_order.so", RTLD_NOW | RTLD_GLOBAL);
+  ASSERT_TRUE(handle != nullptr);
+  typedef int (*fn_t) (void);
+  fn_t fn, fn2;
+  fn = reinterpret_cast<fn_t>(dlsym(RTLD_DEFAULT, "dlopen_test_get_answer"));
+  ASSERT_TRUE(fn != NULL) << dlerror();
+  fn2 = reinterpret_cast<fn_t>(dlsym(RTLD_DEFAULT, "dlopen_test_get_answer2"));
+  ASSERT_TRUE(fn2 != NULL) << dlerror();
+
+  ASSERT_EQ(42, fn());
+  ASSERT_EQ(43, fn2());
+  dlclose(handle);
+}
+
+// libtest_with_dependency_loop.so -> libtest_with_dependency_loop_a.so ->
+// libtest_with_dependency_loop_b.so -> libtest_with_dependency_loop_c.so ->
+// libtest_with_dependency_loop_a.so
+TEST(dlfcn, dlopen_check_loop) {
+  void* handle = dlopen("libtest_with_dependency_loop.so", RTLD_NOW);
+#if defined(__BIONIC__)
+  ASSERT_TRUE(handle == nullptr);
+  ASSERT_STREQ("dlopen failed: recursive link to \"libtest_with_dependency_loop_a.so\"", dlerror());
+  // This symbol should never be exposed
+  void* f = dlsym(RTLD_DEFAULT, "dlopen_test_invalid_function");
+  ASSERT_TRUE(f == nullptr);
+  ASSERT_SUBSTR("undefined symbol: dlopen_test_invalid_function", dlerror());
+
+  // dlopen second time to make sure that the library wasn't loaded even though dlopen returned null.
+  // This may happen if during cleanup the root library or one of the depended libs were not removed
+  // from soinfo list.
+  handle = dlopen("libtest_with_dependency_loop.so", RTLD_NOW | RTLD_NOLOAD);
+  ASSERT_TRUE(handle == nullptr);
+  ASSERT_STREQ("dlopen failed: library \"libtest_with_dependency_loop.so\" wasn't loaded and RTLD_NOLOAD prevented it", dlerror());
+#else // glibc allows recursive links
+  ASSERT_TRUE(handle != nullptr);
+  dlclose(handle);
+#endif
+}
+
 TEST(dlfcn, dlopen_failure) {
   void* self = dlopen("/does/not/exist", RTLD_NOW);
   ASSERT_TRUE(self == NULL);
diff --git a/tests/libs/Android.build.dlext_testzip.mk b/tests/libs/Android.build.dlext_testzip.mk
new file mode 100644
index 0000000..d05927e
--- /dev/null
+++ b/tests/libs/Android.build.dlext_testzip.mk
@@ -0,0 +1,41 @@
+#
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# -----------------------------------------------------------------------------
+# Library used by dlext tests - zipped and aligned
+# -----------------------------------------------------------------------------
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE_CLASS := SHARED_LIBRARIES
+LOCAL_MODULE := libdlext_test_fd_zipaligned
+LOCAL_MODULE_SUFFIX := .zip
+LOCAL_MODULE_TAGS := tests
+LOCAL_MODULE_PATH := $($(bionic_2nd_arch_prefix)TARGET_OUT_DATA_NATIVE_TESTS)/libdlext_test_fd
+LOCAL_2ND_ARCH_VAR_PREFIX := $(bionic_2nd_arch_prefix)
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+my_shared_libs := \
+  $($(bionic_2nd_arch_prefix)TARGET_OUT_INTERMEDIATE_LIBRARIES)/libdlext_test_fd.so
+
+$(LOCAL_BUILT_MODULE): PRIVATE_ALIGNMENT := 4096 # PAGE_SIZE
+$(LOCAL_BUILT_MODULE) : $(my_shared_libs) | $(ZIPALIGN)
+	@echo "Zipalign $(PRIVATE_ALIGNMENT): $@"
+	$(hide) rm -rf $(dir $@) && mkdir -p $(dir $@)
+	$(hide) cp $^ $(dir $@)
+	$(hide) (cd $(dir $@) && touch empty_file.txt && zip -rD0 $(notdir $@).unaligned empty_file.txt *.so)
+	$(hide) $(ZIPALIGN) $(PRIVATE_ALIGNMENT) $@.unaligned $@
diff --git a/tests/libs/Android.build.testlib.mk b/tests/libs/Android.build.testlib.mk
new file mode 100644
index 0000000..5b688e4
--- /dev/null
+++ b/tests/libs/Android.build.testlib.mk
@@ -0,0 +1,22 @@
+#
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+build_target := SHARED_LIBRARY
+build_type := host
+include $(TEST_PATH)/Android.build.mk
+build_type := target
+include $(TEST_PATH)/Android.build.mk
+
diff --git a/tests/libs/Android.mk b/tests/libs/Android.mk
index 75df539..af3e070 100644
--- a/tests/libs/Android.mk
+++ b/tests/libs/Android.mk
@@ -17,6 +17,13 @@
 LOCAL_PATH := $(call my-dir)
 TEST_PATH := $(LOCAL_PATH)/..
 
+common_cppflags += -std=gnu++11
+common_additional_dependencies := \
+    $(LOCAL_PATH)/Android.mk \
+    $(LOCAL_PATH)/Android.build.dlext_testzip.mk \
+    $(LOCAL_PATH)/Android.build.testlib.mk \
+    $(TEST_PATH)/Android.build.mk
+
 # -----------------------------------------------------------------------------
 # Library used by dlfcn tests.
 # -----------------------------------------------------------------------------
@@ -29,9 +36,7 @@
 
 module := no-elf-hash-table-library
 module_tag := optional
-build_type := target
-build_target := SHARED_LIBRARY
-include $(TEST_PATH)/Android.build.mk
+include $(LOCAL_PATH)/Android.build.testlib.mk
 endif
 
 # -----------------------------------------------------------------------------
@@ -45,15 +50,13 @@
 
 module := libdlext_test
 module_tag := optional
-build_type := target
-build_target := SHARED_LIBRARY
-include $(TEST_PATH)/Android.build.mk
+include $(LOCAL_PATH)/Android.build.testlib.mk
 
 # -----------------------------------------------------------------------------
 # create symlink to libdlext_test.so for symlink test
 # -----------------------------------------------------------------------------
 # Use = instead of := to defer the evaluation of $@
-$(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD = \
+$(TARGET_OUT)/lib/libdlext_test.so: PRIVATE_POST_INSTALL_CMD = \
     $(hide) cd $(dir $@) && ln -sf $(notdir $@) libdlext_test_v2.so
 
 ifneq ($(TARGET_2ND_ARCH),)
@@ -62,6 +65,13 @@
     $(hide) cd $(dir $@) && ln -sf $(notdir $@) libdlext_test_v2.so
 endif
 
+# host symlinks
+$(HOST_OUT)/lib64/libdlext_test.so: PRIVATE_POST_INSTALL_CMD = \
+    $(hide) cd $(dir $@) && ln -sf $(notdir $@) libdlext_test_v2.so
+
+$(HOST_OUT)/lib/libdlext_test.so: PRIVATE_POST_INSTALL_CMD = \
+    $(hide) cd $(dir $@) && ln -sf $(notdir $@) libdlext_test_v2.so
+
 # -----------------------------------------------------------------------------
 # Library used by dlext tests - without GNU RELRO program header
 # -----------------------------------------------------------------------------
@@ -91,15 +101,175 @@
 include $(TEST_PATH)/Android.build.mk
 
 # -----------------------------------------------------------------------------
+# Library used by dlext tests - zipped and aligned
+# -----------------------------------------------------------------------------
+include $(CLEAR_VARS)
+bionic_2nd_arch_prefix :=
+include $(LOCAL_PATH)/Android.build.dlext_testzip.mk
+ifneq ($(TARGET_2ND_ARCH),)
+  bionic_2nd_arch_prefix := $(TARGET_2ND_ARCH_VAR_PREFIX)
+  include $(LOCAL_PATH)/Android.build.dlext_testzip.mk
+endif
+
+# -----------------------------------------------------------------------------
 # Library used by dlfcn tests
 # -----------------------------------------------------------------------------
 libtest_simple_src_files := \
     dlopen_testlib_simple.cpp
 
 module := libtest_simple
-build_type := target
-build_target := SHARED_LIBRARY
-include $(TEST_PATH)/Android.build.mk
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# Libraries used by dlfcn tests to verify correct load order:
+# libtest_check_order_2_right.so
+# -----------------------------------------------------------------------------
+libtest_check_order_2_right_src_files := \
+    dlopen_testlib_answer.cpp
+
+libtest_check_order_2_right_cflags := -D__ANSWER=42
+module := libtest_check_order_2_right
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_check_order_a.so
+# -----------------------------------------------------------------------------
+libtest_check_order_a_src_files := \
+    dlopen_testlib_answer.cpp
+
+libtest_check_order_a_cflags := -D__ANSWER=1
+module := libtest_check_order_a
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_check_order_b.so
+# -----------------------------------------------------------------------------
+libtest_check_order_b_src_files := \
+    dlopen_testlib_answer.cpp
+
+libtest_check_order_b_cflags := -D__ANSWER=2 -D__ANSWER2=43
+module := libtest_check_order_b
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_check_order_c.so
+# -----------------------------------------------------------------------------
+libtest_check_order_3_c_src_files := \
+    dlopen_testlib_answer.cpp
+
+libtest_check_order_3_c_cflags := -D__ANSWER=3
+module := libtest_check_order_3_c
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_check_order_d.so
+# -----------------------------------------------------------------------------
+libtest_check_order_d_src_files := \
+   dlopen_testlib_answer.cpp
+
+libtest_check_order_d_shared_libraries := libtest_check_order_b
+libtest_check_order_d_cflags := -D__ANSWER=4 -D__ANSWER2=4
+module := libtest_check_order_d
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_check_order_left.so
+# -----------------------------------------------------------------------------
+libtest_check_order_1_left_src_files := \
+    empty.cpp
+
+libtest_check_order_1_left_shared_libraries := libtest_check_order_a libtest_check_order_b
+
+module := libtest_check_order_1_left
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_check_order.so
+# -----------------------------------------------------------------------------
+libtest_check_order_src_files := \
+    empty.cpp
+
+libtest_check_order_shared_libraries := libtest_check_order_1_left \
+  libtest_check_order_2_right libtest_check_order_3_c
+
+module := libtest_check_order
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# Library with dependency loop used by dlfcn tests
+#
+# libtest_with_dependency_loop -> a -> b -> c -> a
+# -----------------------------------------------------------------------------
+libtest_with_dependency_loop_src_files := dlopen_testlib_invalid.cpp
+
+libtest_with_dependency_loop_shared_libraries := \
+    libtest_with_dependency_loop_a
+
+module := libtest_with_dependency_loop
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_with_dependency_loop_a.so
+# -----------------------------------------------------------------------------
+libtest_with_dependency_loop_a_src_files := dlopen_testlib_invalid.cpp
+
+libtest_with_dependency_loop_a_shared_libraries := \
+    libtest_with_dependency_loop_b_tmp
+
+module := libtest_with_dependency_loop_a
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_with_dependency_loop_b.so
+#
+# this is temporary placeholder - will be removed
+# -----------------------------------------------------------------------------
+libtest_with_dependency_loop_b_tmp_src_files := dlopen_testlib_invalid.cpp
+libtest_with_dependency_loop_b_tmp_ldflags := -Wl,-soname=libtest_with_dependency_loop_b.so
+
+module := libtest_with_dependency_loop_b_tmp
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_with_dependency_loop_b.so
+# -----------------------------------------------------------------------------
+libtest_with_dependency_loop_b_src_files := dlopen_testlib_invalid.cpp
+libtest_with_dependency_loop_b_shared_libraries := libtest_with_dependency_loop_c
+
+module := libtest_with_dependency_loop_b
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_with_dependency_loop_c.so
+# -----------------------------------------------------------------------------
+libtest_with_dependency_loop_c_src_files := dlopen_testlib_invalid.cpp
+
+libtest_with_dependency_loop_c_shared_libraries := \
+    libtest_with_dependency_loop_a
+
+module := libtest_with_dependency_loop_c
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# libtest_relo_check_dt_needed_order.so
+# |
+# +-> libtest_relo_check_dt_needed_order_1.so
+# |
+# +-> libtest_relo_check_dt_needed_order_2.so
+# -----------------------------------------------------------------------------
+libtest_relo_check_dt_needed_order_shared_libraries := \
+    libtest_relo_check_dt_needed_order_1 libtest_relo_check_dt_needed_order_2
+
+libtest_relo_check_dt_needed_order_src_files := dlopen_testlib_relo_check_dt_needed_order.cpp
+libtest_relo_check_dt_needed_order_1_src_files := dlopen_testlib_relo_check_dt_needed_order_1.cpp
+libtest_relo_check_dt_needed_order_2_src_files := dlopen_testlib_relo_check_dt_needed_order_2.cpp
+
+module := libtest_relo_check_dt_needed_order
+include $(LOCAL_PATH)/Android.build.testlib.mk
+module := libtest_relo_check_dt_needed_order_1
+include $(LOCAL_PATH)/Android.build.testlib.mk
+module := libtest_relo_check_dt_needed_order_2
+include $(LOCAL_PATH)/Android.build.testlib.mk
 
 # -----------------------------------------------------------------------------
 # Library with dependency used by dlfcn tests
@@ -110,10 +280,33 @@
 libtest_with_dependency_shared_libraries := libdlext_test
 
 module := libtest_with_dependency
-build_type := target
+include $(LOCAL_PATH)/Android.build.testlib.mk
+
+# -----------------------------------------------------------------------------
+# Library used by ifunc tests
+# -----------------------------------------------------------------------------
+libtest_ifunc_src_files := \
+    dlopen_testlib_ifunc.c
+
+libtest_ifunc_clang_host := false
+module := libtest_ifunc
 build_target := SHARED_LIBRARY
+
+build_type := host
 include $(TEST_PATH)/Android.build.mk
 
+ifeq ($(TARGET_ARCH),$(filter $(TARGET_ARCH),x86 x86_64))
+    ifeq ($(TARGET_ARCH),arm64)
+      libtest_ifunc_multilib := 64
+      # TODO: This is a workaround - remove it once gcc
+      # removes its Android ifunc checks
+      libtest_ifunc_cflags := -mglibc
+    endif
+
+    build_type := target
+    include $(TEST_PATH)/Android.build.mk
+endif
+
 # -----------------------------------------------------------------------------
 # Library used by atexit tests
 # -----------------------------------------------------------------------------
@@ -122,11 +315,7 @@
     atexit_testlib.cpp
 
 module := libtest_atexit
-build_target := SHARED_LIBRARY
-build_type := target
-include $(TEST_PATH)/Android.build.mk
-build_type := host
-include $(TEST_PATH)/Android.build.mk
+include $(LOCAL_PATH)/Android.build.testlib.mk
 
 # -----------------------------------------------------------------------------
 # Library with weak function
@@ -135,8 +324,4 @@
     dlsym_weak_function.cpp
 
 module := libtest_dlsym_weak_func
-build_target := SHARED_LIBRARY
-build_type := target
-include $(TEST_PATH)/Android.build.mk
-build_type := host
-include $(TEST_PATH)/Android.build.mk
+include $(LOCAL_PATH)/Android.build.testlib.mk
diff --git a/tests/libs/dlopen_testlib_answer.cpp b/tests/libs/dlopen_testlib_answer.cpp
new file mode 100644
index 0000000..a4d7504
--- /dev/null
+++ b/tests/libs/dlopen_testlib_answer.cpp
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+extern "C" int dlopen_test_get_answer() {
+  return __ANSWER;
+}
+
+#ifdef __ANSWER2
+extern "C" int dlopen_test_get_answer2() {
+  return __ANSWER2;
+}
+#endif
diff --git a/tests/libs/dlopen_testlib_ifunc.c b/tests/libs/dlopen_testlib_ifunc.c
new file mode 100644
index 0000000..b68a3dd
--- /dev/null
+++ b/tests/libs/dlopen_testlib_ifunc.c
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+static int g_flag = 0;
+
+static void __attribute__((constructor)) init_flag() {
+  g_flag = 1;
+}
+
+static const char* is_ctor_called() __attribute__ ((ifunc("is_ctor_called_ifun")));
+
+const char* foo() __attribute__ ((ifunc ("foo_ifunc")));
+
+// Static linker creates GLOBAL/IFUNC symbol and JUMP_SLOT relocation type for plt segment
+const char* is_ctor_called_jump_slot() __attribute__ ((ifunc("is_ctor_called_ifun")));
+
+const char* is_ctor_called_irelative() {
+  // Call internal ifunc-resolved function with IRELATIVE reloc
+  return is_ctor_called();
+}
+
+const char* return_true() {
+  return "true";
+}
+
+const char* return_false() {
+  return "false";
+}
+
+const char* f1() {
+  return "unset";
+}
+
+const char* f2() {
+  return "set";
+}
+
+void* is_ctor_called_ifun() {
+  return g_flag == 0 ? return_false : return_true;
+}
+
+void* foo_ifunc() {
+   char* choice = getenv("IFUNC_CHOICE");
+   return choice == NULL ? f1 : f2;
+}
+
+const char* foo_library() {
+   return foo();
+}
diff --git a/tests/libs/dlopen_testlib_invalid.cpp b/tests/libs/dlopen_testlib_invalid.cpp
new file mode 100644
index 0000000..f2039c6
--- /dev/null
+++ b/tests/libs/dlopen_testlib_invalid.cpp
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+
+// This file is used for libraries that are not supposed to
+// be successfully loaded/linked - therefore, this function should
+// not be visible via dlsym - (we are going to use this fact in tests)
+extern "C" int dlopen_test_invalid_function() {
+  abort();
+}
diff --git a/tests/libs/dlopen_testlib_relo_check_dt_needed_order.cpp b/tests/libs/dlopen_testlib_relo_check_dt_needed_order.cpp
new file mode 100644
index 0000000..d8fb543
--- /dev/null
+++ b/tests/libs/dlopen_testlib_relo_check_dt_needed_order.cpp
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+extern "C" int relo_test_get_answer_lib();
+
+extern "C" int relo_test_get_answer() {
+  return relo_test_get_answer_lib();
+}
diff --git a/tests/libs/dlopen_testlib_relo_check_dt_needed_order_1.cpp b/tests/libs/dlopen_testlib_relo_check_dt_needed_order_1.cpp
new file mode 100644
index 0000000..4c877d0
--- /dev/null
+++ b/tests/libs/dlopen_testlib_relo_check_dt_needed_order_1.cpp
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+extern "C" int relo_test_get_answer_lib() {
+  return 1;
+}
diff --git a/tests/libs/dlopen_testlib_relo_check_dt_needed_order_2.cpp b/tests/libs/dlopen_testlib_relo_check_dt_needed_order_2.cpp
new file mode 100644
index 0000000..10288a0
--- /dev/null
+++ b/tests/libs/dlopen_testlib_relo_check_dt_needed_order_2.cpp
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+extern "C" int relo_test_get_answer_lib() {
+  return 2;
+}
diff --git a/tests/libs/dlopen_testlib_simple.cpp b/tests/libs/dlopen_testlib_simple.cpp
index afe54b4..bf750b2 100644
--- a/tests/libs/dlopen_testlib_simple.cpp
+++ b/tests/libs/dlopen_testlib_simple.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <stdint.h>
 #include <stdlib.h>
 
 uint32_t dlopen_testlib_taxicab_number = 1729;
diff --git a/tests/math_test.cpp b/tests/math_test.cpp
index b4f5b14..2203db9 100644
--- a/tests/math_test.cpp
+++ b/tests/math_test.cpp
@@ -53,6 +53,8 @@
 #include <limits.h>
 #include <stdint.h>
 
+#include <private/ScopeGuard.h>
+
 float float_subnormal() {
   union {
     float f;
@@ -760,6 +762,10 @@
 }
 
 TEST(math, lrint) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
+
   fesetround(FE_UPWARD); // lrint/lrintf/lrintl obey the rounding mode.
   ASSERT_EQ(1235, lrint(1234.01));
   ASSERT_EQ(1235, lrintf(1234.01f));
@@ -780,6 +786,10 @@
 }
 
 TEST(math, rint) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
+
   fesetround(FE_UPWARD); // rint/rintf/rintl obey the rounding mode.
   feclearexcept(FE_ALL_EXCEPT); // rint/rintf/rintl do set the FE_INEXACT flag.
   ASSERT_EQ(1234.0, rint(1234.0));
@@ -806,6 +816,9 @@
 }
 
 TEST(math, nearbyint) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_UPWARD); // nearbyint/nearbyintf/nearbyintl obey the rounding mode.
   feclearexcept(FE_ALL_EXCEPT); // nearbyint/nearbyintf/nearbyintl don't set the FE_INEXACT flag.
   ASSERT_EQ(1234.0, nearbyint(1234.0));
@@ -832,6 +845,9 @@
 }
 
 TEST(math, lround) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_UPWARD); // lround ignores the rounding mode.
   ASSERT_EQ(1234, lround(1234.01));
   ASSERT_EQ(1234, lroundf(1234.01f));
@@ -839,6 +855,9 @@
 }
 
 TEST(math, llround) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_UPWARD); // llround ignores the rounding mode.
   ASSERT_EQ(1234L, llround(1234.01));
   ASSERT_EQ(1234L, llroundf(1234.01f));
@@ -933,6 +952,9 @@
 }
 
 TEST(math, round) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_TOWARDZERO); // round ignores the rounding mode and always rounds away from zero.
   ASSERT_DOUBLE_EQ(1.0, round(0.5));
   ASSERT_DOUBLE_EQ(-1.0, round(-0.5));
@@ -943,6 +965,9 @@
 }
 
 TEST(math, roundf) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_TOWARDZERO); // roundf ignores the rounding mode and always rounds away from zero.
   ASSERT_FLOAT_EQ(1.0f, roundf(0.5f));
   ASSERT_FLOAT_EQ(-1.0f, roundf(-0.5f));
@@ -953,6 +978,9 @@
 }
 
 TEST(math, roundl) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_TOWARDZERO); // roundl ignores the rounding mode and always rounds away from zero.
   ASSERT_DOUBLE_EQ(1.0L, roundl(0.5L));
   ASSERT_DOUBLE_EQ(-1.0L, roundl(-0.5L));
@@ -963,6 +991,9 @@
 }
 
 TEST(math, trunc) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_UPWARD); // trunc ignores the rounding mode and always rounds toward zero.
   ASSERT_DOUBLE_EQ(1.0, trunc(1.5));
   ASSERT_DOUBLE_EQ(-1.0, trunc(-1.5));
@@ -973,6 +1004,9 @@
 }
 
 TEST(math, truncf) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_UPWARD); // truncf ignores the rounding mode and always rounds toward zero.
   ASSERT_FLOAT_EQ(1.0f, truncf(1.5f));
   ASSERT_FLOAT_EQ(-1.0f, truncf(-1.5f));
@@ -983,6 +1017,9 @@
 }
 
 TEST(math, truncl) {
+  auto guard = make_scope_guard([]() {
+    fesetenv(FE_DFL_ENV);
+  });
   fesetround(FE_UPWARD); // truncl ignores the rounding mode and always rounds toward zero.
   ASSERT_DOUBLE_EQ(1.0L, truncl(1.5L));
   ASSERT_DOUBLE_EQ(-1.0L, truncl(-1.5L));
diff --git a/tests/pthread_test.cpp b/tests/pthread_test.cpp
index 4a7c6bd..32bb54c 100644
--- a/tests/pthread_test.cpp
+++ b/tests/pthread_test.cpp
@@ -869,7 +869,7 @@
 #endif
   EXPECT_EQ(rl.rlim_cur, stack_size);
 
-  auto guard = create_scope_guard([&rl, original_rlim_cur]() {
+  auto guard = make_scope_guard([&rl, original_rlim_cur]() {
     rl.rlim_cur = original_rlim_cur;
     ASSERT_EQ(0, setrlimit(RLIMIT_STACK, &rl));
   });
diff --git a/tests/signal_test.cpp b/tests/signal_test.cpp
index 89b8088..8fd8b72 100644
--- a/tests/signal_test.cpp
+++ b/tests/signal_test.cpp
@@ -14,10 +14,10 @@
  * limitations under the License.
  */
 
-#include <gtest/gtest.h>
+#include <signal.h>
 
 #include <errno.h>
-#include <signal.h>
+#include <gtest/gtest.h>
 
 #include "ScopedSignalHandler.h"
 
@@ -198,13 +198,19 @@
 static void EmptySignalAction(int, siginfo_t*, void*) {}
 
 TEST(signal, sigaction) {
+  // Both bionic and glibc set SA_RESTORER when talking to the kernel on arm,
+  // arm64, x86, and x86-64. The version of glibc we're using also doesn't
+  // define SA_RESTORER, but luckily it's the same value everywhere, and mips
+  // doesn't use the bit for anything.
+  static const unsigned sa_restorer = 0x4000000;
+
   // See what's currently set for SIGALRM.
   struct sigaction original_sa;
   memset(&original_sa, 0, sizeof(original_sa));
   ASSERT_EQ(0, sigaction(SIGALRM, NULL, &original_sa));
   ASSERT_TRUE(original_sa.sa_handler == NULL);
   ASSERT_TRUE(original_sa.sa_sigaction == NULL);
-  ASSERT_TRUE(original_sa.sa_flags == 0);
+  ASSERT_EQ(0U, original_sa.sa_flags & ~sa_restorer);
 
   // Set a traditional sa_handler signal handler.
   struct sigaction sa;
@@ -219,7 +225,7 @@
   ASSERT_EQ(0, sigaction(SIGALRM, NULL, &sa));
   ASSERT_TRUE(sa.sa_handler == EmptySignalHandler);
   ASSERT_TRUE((void*) sa.sa_sigaction == (void*) sa.sa_handler);
-  ASSERT_TRUE(sa.sa_flags == SA_ONSTACK);
+  ASSERT_EQ(static_cast<unsigned>(SA_ONSTACK), sa.sa_flags & ~sa_restorer);
 
   // Set a new-style sa_sigaction signal handler.
   memset(&sa, 0, sizeof(sa));
@@ -233,7 +239,7 @@
   ASSERT_EQ(0, sigaction(SIGALRM, NULL, &sa));
   ASSERT_TRUE(sa.sa_sigaction == EmptySignalAction);
   ASSERT_TRUE((void*) sa.sa_sigaction == (void*) sa.sa_handler);
-  ASSERT_TRUE(sa.sa_flags == (SA_ONSTACK | SA_SIGINFO));
+  ASSERT_EQ(static_cast<unsigned>(SA_ONSTACK | SA_SIGINFO), sa.sa_flags & ~sa_restorer);
 
   // Put everything back how it was.
   ASSERT_EQ(0, sigaction(SIGALRM, &original_sa, NULL));
diff --git a/tests/stack_unwinding_test.cpp b/tests/stack_unwinding_test.cpp
index 1024f28..3fc45c5 100644
--- a/tests/stack_unwinding_test.cpp
+++ b/tests/stack_unwinding_test.cpp
@@ -20,18 +20,86 @@
 
 #include <gtest/gtest.h>
 
-extern "C" {
-  void do_test();
+#include <dlfcn.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <unwind.h>
+
+#include "ScopedSignalHandler.h"
+
+#define noinline __attribute__((__noinline__))
+#define __unused __attribute__((__unused__))
+
+static _Unwind_Reason_Code FrameCounter(_Unwind_Context* ctx __unused, void* arg) {
+  int* count_ptr = reinterpret_cast<int*>(arg);
+
+#if SHOW_FRAME_LOCATIONS
+  void* ip = reinterpret_cast<void*>(_Unwind_GetIP(ctx));
+
+  const char* symbol = "<unknown>";
+  int offset = 0;
+
+  Dl_info info;
+  memset(&info, 0, sizeof(info));
+  if (dladdr(ip, &info) != 0) {
+    symbol = info.dli_sname;
+    if (info.dli_saddr != nullptr) {
+      offset = static_cast<int>(reinterpret_cast<char*>(ip) - reinterpret_cast<char*>(info.dli_saddr));
+    }
+  }
+
+  fprintf(stderr, " #%02d %p %s%+d (%s)\n", *count_ptr, ip, symbol, offset, info.dli_fname ? info.dli_fname : "??");
+  fflush(stderr);
+#endif
+
+  ++*count_ptr;
+  return _URC_NO_REASON;
 }
 
-// We have to say "DeathTest" here so gtest knows to run this test (which exits)
-// in its own process.
-TEST(stack_unwinding_DeathTest, unwinding_through_signal_frame) {
-// Only our x86 unwinding is good enough. Switch to libunwind?
-#if defined(__BIONIC__) && defined(__i386__)
-  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
-  ASSERT_EXIT(do_test(), ::testing::ExitedWithCode(42), "");
-#else // __i386__
-  GTEST_LOG_(INFO) << "This test does nothing.\n";
-#endif // __i386__
+static int noinline unwind_one_frame_deeper() {
+  int count = 0;
+  _Unwind_Backtrace(FrameCounter, &count);
+  return count;
+}
+
+TEST(stack_unwinding, easy) {
+  int count = 0;
+  _Unwind_Backtrace(FrameCounter, &count);
+  int deeper_count = unwind_one_frame_deeper();
+  ASSERT_EQ(count + 1, deeper_count);
+}
+
+static int killer_count = 0;
+static int handler_count = 0;
+static int handler_one_deeper_count = 0;
+
+static void noinline UnwindSignalHandler(int) {
+  _Unwind_Backtrace(FrameCounter, &handler_count);
+  ASSERT_GT(handler_count, killer_count);
+
+  handler_one_deeper_count = unwind_one_frame_deeper();
+  ASSERT_EQ(handler_count + 1, handler_one_deeper_count);
+}
+
+TEST(stack_unwinding, unwind_through_signal_frame) {
+  killer_count = handler_count = handler_one_deeper_count = 0;
+  ScopedSignalHandler ssh(SIGUSR1, UnwindSignalHandler);
+
+  _Unwind_Backtrace(FrameCounter, &killer_count);
+
+  ASSERT_EQ(0, kill(getpid(), SIGUSR1));
+}
+
+// On LP32, the SA_SIGINFO flag gets you __restore_rt instead of __restore.
+TEST(stack_unwinding, unwind_through_signal_frame_SA_SIGINFO) {
+  killer_count = handler_count = handler_one_deeper_count = 0;
+  ScopedSignalHandler ssh(SIGUSR1, UnwindSignalHandler, SA_SIGINFO);
+
+  _Unwind_Backtrace(FrameCounter, &killer_count);
+
+  ASSERT_EQ(0, kill(getpid(), SIGUSR1));
 }
diff --git a/tests/stack_unwinding_test_impl.c b/tests/stack_unwinding_test_impl.c
deleted file mode 100644
index 7518a2c..0000000
--- a/tests/stack_unwinding_test_impl.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2013 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/*
- * Contributed by: Intel Corporation
- */
-
-#include <stdio.h>
-#include <signal.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unwind.h>
-
-#define noinline __attribute__((__noinline__))
-#define unused __attribute__((__unused__))
-
-static noinline _Unwind_Reason_Code stop_fn(int a unused,
-    _Unwind_Action action,
-    _Unwind_Exception_Class b unused, struct _Unwind_Exception* c unused,
-    struct _Unwind_Context* d unused, void* e unused) {
-  if ((action & _UA_END_OF_STACK) != 0) {
-    // We reached the end of the stack without executing foo_cleanup. Test failed.
-    abort();
-  }
-  return _URC_NO_REASON;
-}
-
-static void noinline foo_cleanup(char* param unused) {
-  exit(42);
-}
-
-static void noinline do_crash() {
-  char* ptr = NULL;
-  *ptr = 0; // Deliberately cause a SIGSEGV.
-}
-
-static void noinline foo() {
-  char c1 __attribute__((cleanup(foo_cleanup))) unused;
-  do_crash();
-}
-
-// It's SEGSEGV handler. We start forced stack unwinding here.
-// If libgcc don't find dso for signal frame stack unwinding will be finished.
-// libgcc pass to stop_fn _UA_END_OF_STACK flag.
-// Test pass condition: stack unwinding through signal frame and foo1_handler execution.
-static void noinline sigsegv_handler(int param unused) {
-  struct _Unwind_Exception* exception = (struct _Unwind_Exception*) malloc(sizeof(*exception));
-  memset(&exception->exception_class, 0, sizeof(exception->exception_class));
-  exception->exception_cleanup = 0;
-  _Unwind_ForcedUnwind(exception, stop_fn, 0);
-}
-
-void do_test() {
-  signal(SIGSEGV, &sigsegv_handler);
-  foo();
-}
diff --git a/tests/stdio_test.cpp b/tests/stdio_test.cpp
index 8c8c235..bba744a 100644
--- a/tests/stdio_test.cpp
+++ b/tests/stdio_test.cpp
@@ -29,6 +29,23 @@
 
 #include "TemporaryFile.h"
 
+TEST(stdio, flockfile_18208568_stderr) {
+  // Check that we have a _recursive_ mutex for flockfile.
+  flockfile(stderr);
+  feof(stderr); // We don't care about the result, but this needs to take the lock.
+  funlockfile(stderr);
+}
+
+TEST(stdio, flockfile_18208568_regular) {
+  // We never had a bug for streams other than stdin/stdout/stderr, but test anyway.
+  FILE* fp = fopen("/dev/null", "w");
+  ASSERT_TRUE(fp != NULL);
+  flockfile(fp);
+  feof(fp);
+  funlockfile(fp);
+  fclose(fp);
+}
+
 TEST(stdio, tmpfile_fileno_fprintf_rewind_fgets) {
   FILE* fp = tmpfile();
   ASSERT_TRUE(fp != NULL);
@@ -677,3 +694,34 @@
 
   fclose(fp);
 }
+
+// https://code.google.com/p/android/issues/detail?id=81155
+// http://b/18556607
+TEST(stdio, fread_unbuffered_pathological_performance) {
+  FILE* fp = fopen("/dev/zero", "r");
+  ASSERT_TRUE(fp != NULL);
+
+  // Make this stream unbuffered.
+  setvbuf(fp, 0, _IONBF, 0);
+
+  char buf[65*1024];
+  memset(buf, 0xff, sizeof(buf));
+
+  time_t t0 = time(NULL);
+  for (size_t i = 0; i < 1024; ++i) {
+    fread(buf, 64*1024, 1, fp);
+  }
+  time_t t1 = time(NULL);
+
+  fclose(fp);
+
+  // 1024 64KiB reads should have been very quick.
+  ASSERT_LE(t1 - t0, 1);
+
+  for (size_t i = 0; i < 64*1024; ++i) {
+    ASSERT_EQ('\0', buf[i]);
+  }
+  for (size_t i = 64*1024; i < 65*1024; ++i) {
+    ASSERT_EQ('\xff', buf[i]);
+  }
+}
diff --git a/tests/string_test.cpp b/tests/string_test.cpp
index 73c94c6..f1ac9dd 100644
--- a/tests/string_test.cpp
+++ b/tests/string_test.cpp
@@ -173,7 +173,7 @@
   const size_t MAX_LEN;
   Character *ptr, *ptr1, *ptr2;
   size_t n;
-  int len[ITER + 1];
+  size_t len[ITER + 1];
 
  private:
   Character *glob_ptr, *glob_ptr1, *glob_ptr2;
@@ -186,7 +186,7 @@
     n = 0;
     len[n++] = 0;
     for (size_t i = 1; i < ITER; ++i) {
-      int l = (int) exp(log((double) MAX_LEN) * i / ITER);
+      size_t l = static_cast<size_t>(exp(log(static_cast<double>(MAX_LEN)) * i / ITER));
       if (l != len[n - 1]) {
         len[n++] = l;
       }
@@ -392,7 +392,7 @@
       }
       state.ptr1[state.len[i] - 1] = '\0';
 
-      int pos = random() % state.MAX_LEN;
+      size_t pos = random() % state.MAX_LEN;
       char* expected;
       if (pos >= state.len[i] - 1) {
         if (seek_char == 0) {
@@ -421,7 +421,7 @@
       state.ptr1[state.len[i] - 1] = '\0';
       state.ptr2[state.len[i] - 1] = '\0';
 
-      int pos = 1 + (random() % (state.MAX_LEN - 1));
+      size_t pos = 1 + (random() % (state.MAX_LEN - 1));
       int actual;
       int expected;
       if (pos >= state.len[i] - 1) {
@@ -510,7 +510,7 @@
       state.ptr2[state.MAX_LEN - 1] = '\0';
       memcpy(state.ptr, state.ptr2, state.MAX_LEN + state.len[i]);
 
-      int pos = random() % state.MAX_LEN;
+      size_t pos = random() % state.MAX_LEN;
       memset(state.ptr1, '\3', pos);
       state.ptr1[pos] = '\0';
       if (pos < state.len[i]) {
@@ -604,7 +604,7 @@
       state.ptr1[state.len[i] - 1] = '\0';
       state.ptr2[state.len[i] - 1] = '\0';
 
-      int pos = 1 + (random() % (state.MAX_LEN - 1));
+      size_t pos = 1 + (random() % (state.MAX_LEN - 1));
       int actual;
       int expected;
       if (pos >= state.len[i] - 1) {
@@ -722,7 +722,7 @@
       }
       state.ptr1[state.len[i] - 1] = '\0';
 
-      int pos = random() % state.MAX_LEN;
+      size_t pos = random() % state.MAX_LEN;
       char* expected;
       if (pos >= state.len[i] - 1) {
         if (seek_char == 0) {
@@ -749,7 +749,7 @@
 
       memset(state.ptr1, ~seek_char, state.len[i]);
 
-      int pos = random() % state.MAX_LEN;
+      size_t pos = random() % state.MAX_LEN;
       char* expected;
       if (pos >= state.len[i]) {
         expected = NULL;
@@ -780,7 +780,7 @@
 
       memset(state.ptr1, ~seek_char, state.len[i]);
 
-      int pos = random() % state.MAX_LEN;
+      size_t pos = random() % state.MAX_LEN;
       char* expected;
       if (pos >= state.len[i]) {
         expected = NULL;
diff --git a/tests/time_test.cpp b/tests/time_test.cpp
index 241c4a0..0971de2 100644
--- a/tests/time_test.cpp
+++ b/tests/time_test.cpp
@@ -21,6 +21,7 @@
 #include <gtest/gtest.h>
 #include <pthread.h>
 #include <signal.h>
+#include <stdatomic.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -139,7 +140,7 @@
   ts.it_value.tv_nsec = value_ns;
   ts.it_interval.tv_sec = interval_s;
   ts.it_interval.tv_nsec = interval_ns;
-  ASSERT_EQ(0, timer_settime(t, TIMER_ABSTIME, &ts, NULL));
+  ASSERT_EQ(0, timer_settime(t, 0, &ts, NULL));
 }
 
 static void NoOpNotifyFunction(sigval_t) {
@@ -171,7 +172,7 @@
   ASSERT_EQ(0, timer_delete(timer_id));
 }
 
-static int timer_create_SIGEV_SIGNAL_signal_handler_invocation_count = 0;
+static int timer_create_SIGEV_SIGNAL_signal_handler_invocation_count;
 static void timer_create_SIGEV_SIGNAL_signal_handler(int signal_number) {
   ++timer_create_SIGEV_SIGNAL_signal_handler_invocation_count;
   ASSERT_EQ(SIGUSR1, signal_number);
@@ -186,6 +187,7 @@
   timer_t timer_id;
   ASSERT_EQ(0, timer_create(CLOCK_MONOTONIC, &se, &timer_id));
 
+  timer_create_SIGEV_SIGNAL_signal_handler_invocation_count = 0;
   ScopedSignalHandler ssh(SIGUSR1, timer_create_SIGEV_SIGNAL_signal_handler);
 
   ASSERT_EQ(0, timer_create_SIGEV_SIGNAL_signal_handler_invocation_count);
@@ -202,68 +204,94 @@
 }
 
 struct Counter {
-  volatile int value;
+ private:
+  atomic_int value;
   timer_t timer_id;
   sigevent_t se;
+  bool timer_valid;
 
-  Counter(void (*fn)(sigval_t)) : value(0) {
+  void Create() {
+    ASSERT_FALSE(timer_valid);
+    ASSERT_EQ(0, timer_create(CLOCK_REALTIME, &se, &timer_id));
+    timer_valid = true;
+  }
+
+ public:
+  Counter(void (*fn)(sigval_t)) : value(ATOMIC_VAR_INIT(0)), timer_valid(false) {
     memset(&se, 0, sizeof(se));
     se.sigev_notify = SIGEV_THREAD;
     se.sigev_notify_function = fn;
     se.sigev_value.sival_ptr = this;
+    Create();
   }
 
-  void Create() {
-    ASSERT_EQ(0, timer_create(CLOCK_REALTIME, &se, &timer_id));
+  void DeleteTimer() {
+    ASSERT_TRUE(timer_valid);
+    ASSERT_EQ(0, timer_delete(timer_id));
+    timer_valid = false;
   }
 
   ~Counter() {
-    if (timer_delete(timer_id) != 0) {
-      abort();
+    if (timer_valid) {
+      DeleteTimer();
     }
   }
 
+  int Value() {
+    return atomic_load(&value);
+  }
+
+  void SetTime(time_t value_s, time_t value_ns, time_t interval_s, time_t interval_ns) {
+    ::SetTime(timer_id, value_s, value_ns, interval_s, interval_ns);
+  }
+
+  bool ValueUpdated() {
+    int current_value = atomic_load(&value);
+    time_t start = time(NULL);
+    while (current_value == atomic_load(&value) && (time(NULL) - start) < 5) {
+    }
+    return current_value != atomic_load(&value);
+  }
+
   static void CountNotifyFunction(sigval_t value) {
     Counter* cd = reinterpret_cast<Counter*>(value.sival_ptr);
-    ++cd->value;
+    atomic_fetch_add(&cd->value, 1);
   }
 
   static void CountAndDisarmNotifyFunction(sigval_t value) {
     Counter* cd = reinterpret_cast<Counter*>(value.sival_ptr);
-    ++cd->value;
+    atomic_fetch_add(&cd->value, 1);
 
     // Setting the initial expiration time to 0 disarms the timer.
-    SetTime(cd->timer_id, 0, 0, 1, 0);
+    cd->SetTime(0, 0, 1, 0);
   }
 };
 
 TEST(time, timer_settime_0) {
   Counter counter(Counter::CountAndDisarmNotifyFunction);
-  counter.Create();
+  ASSERT_EQ(0, counter.Value());
 
-  ASSERT_EQ(0, counter.value);
-
-  SetTime(counter.timer_id, 0, 1, 1, 0);
-  usleep(500000);
+  counter.SetTime(0, 500000000, 1, 0);
+  sleep(1);
 
   // The count should just be 1 because we disarmed the timer the first time it fired.
-  ASSERT_EQ(1, counter.value);
+  ASSERT_EQ(1, counter.Value());
 }
 
 TEST(time, timer_settime_repeats) {
   Counter counter(Counter::CountNotifyFunction);
-  counter.Create();
+  ASSERT_EQ(0, counter.Value());
 
-  ASSERT_EQ(0, counter.value);
-
-  SetTime(counter.timer_id, 0, 1, 0, 10);
+  counter.SetTime(0, 1, 0, 10);
+  ASSERT_TRUE(counter.ValueUpdated());
+  ASSERT_TRUE(counter.ValueUpdated());
+  ASSERT_TRUE(counter.ValueUpdated());
+  counter.DeleteTimer();
+  // Add a sleep as other threads may be calling the callback function when the timer is deleted.
   usleep(500000);
-
-  // The count should just be > 1 because we let the timer repeat.
-  ASSERT_GT(counter.value, 1);
 }
 
-static int timer_create_NULL_signal_handler_invocation_count = 0;
+static int timer_create_NULL_signal_handler_invocation_count;
 static void timer_create_NULL_signal_handler(int signal_number) {
   ++timer_create_NULL_signal_handler_invocation_count;
   ASSERT_EQ(SIGALRM, signal_number);
@@ -274,6 +302,7 @@
   timer_t timer_id;
   ASSERT_EQ(0, timer_create(CLOCK_MONOTONIC, NULL, &timer_id));
 
+  timer_create_NULL_signal_handler_invocation_count = 0;
   ScopedSignalHandler ssh(SIGALRM, timer_create_NULL_signal_handler);
 
   ASSERT_EQ(0, timer_create_NULL_signal_handler_invocation_count);
@@ -320,22 +349,59 @@
 
 TEST(time, timer_create_multiple) {
   Counter counter1(Counter::CountNotifyFunction);
-  counter1.Create();
   Counter counter2(Counter::CountNotifyFunction);
-  counter2.Create();
   Counter counter3(Counter::CountNotifyFunction);
-  counter3.Create();
 
-  ASSERT_EQ(0, counter1.value);
-  ASSERT_EQ(0, counter2.value);
-  ASSERT_EQ(0, counter3.value);
+  ASSERT_EQ(0, counter1.Value());
+  ASSERT_EQ(0, counter2.Value());
+  ASSERT_EQ(0, counter3.Value());
 
-  SetTime(counter2.timer_id, 0, 1, 0, 0);
+  counter2.SetTime(0, 500000000, 0, 0);
+  sleep(1);
+
+  EXPECT_EQ(0, counter1.Value());
+  EXPECT_EQ(1, counter2.Value());
+  EXPECT_EQ(0, counter3.Value());
+}
+
+// Test to verify that disarming a repeatable timer disables the callbacks.
+TEST(time, timer_disarm_terminates) {
+  Counter counter(Counter::CountNotifyFunction);
+  ASSERT_EQ(0, counter.Value());
+
+  counter.SetTime(0, 1, 0, 1);
+  ASSERT_TRUE(counter.ValueUpdated());
+  ASSERT_TRUE(counter.ValueUpdated());
+  ASSERT_TRUE(counter.ValueUpdated());
+
+  counter.SetTime(0, 0, 0, 0);
+  // Add a sleep as the kernel may have pending events when the timer is disarmed.
+  usleep(500000);
+  int value = counter.Value();
   usleep(500000);
 
-  EXPECT_EQ(0, counter1.value);
-  EXPECT_EQ(1, counter2.value);
-  EXPECT_EQ(0, counter3.value);
+  // Verify the counter has not been incremented.
+  ASSERT_EQ(value, counter.Value());
+}
+
+// Test to verify that deleting a repeatable timer disables the callbacks.
+TEST(time, timer_delete_terminates) {
+  Counter counter(Counter::CountNotifyFunction);
+  ASSERT_EQ(0, counter.Value());
+
+  counter.SetTime(0, 1, 0, 1);
+  ASSERT_TRUE(counter.ValueUpdated());
+  ASSERT_TRUE(counter.ValueUpdated());
+  ASSERT_TRUE(counter.ValueUpdated());
+
+  counter.DeleteTimer();
+  // Add a sleep as other threads may be calling the callback function when the timer is deleted.
+  usleep(500000);
+  int value = counter.Value();
+  usleep(500000);
+
+  // Verify the counter has not been incremented.
+  ASSERT_EQ(value, counter.Value());
 }
 
 struct TimerDeleteData {
@@ -365,11 +431,11 @@
   ASSERT_EQ(0, timer_create(CLOCK_REALTIME, &se, &tdd.timer_id));
 
   itimerspec ts;
-  ts.it_value.tv_sec = 0;
-  ts.it_value.tv_nsec = 100;
+  ts.it_value.tv_sec = 1;
+  ts.it_value.tv_nsec = 0;
   ts.it_interval.tv_sec = 0;
   ts.it_interval.tv_nsec = 0;
-  ASSERT_EQ(0, timer_settime(tdd.timer_id, TIMER_ABSTIME, &ts, NULL));
+  ASSERT_EQ(0, timer_settime(tdd.timer_id, 0, &ts, NULL));
 
   time_t cur_time = time(NULL);
   while (!tdd.complete && (time(NULL) - cur_time) < 5);
diff --git a/tests/uniqueptr_test.cpp b/tests/uniqueptr_test.cpp
new file mode 100644
index 0000000..4b6608a
--- /dev/null
+++ b/tests/uniqueptr_test.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include <private/UniquePtr.h>
+
+static int cCount = 0;
+struct C {
+  C() { ++cCount; }
+  ~C() { --cCount; }
+};
+
+static bool freed = false;
+struct Freer {
+  void operator() (int* p) {
+    ASSERT_EQ(123, *p);
+    free(p);
+    freed = true;
+  }
+};
+
+TEST(UniquePtr, smoke) {
+  //
+  // UniquePtr<T> tests...
+  //
+
+  // Can we free a single object?
+  {
+    UniquePtr<C> c(new C);
+    ASSERT_TRUE(cCount == 1);
+  }
+  ASSERT_TRUE(cCount == 0);
+  // Does release work?
+  C* rawC;
+  {
+      UniquePtr<C> c(new C);
+      ASSERT_TRUE(cCount == 1);
+      rawC = c.release();
+  }
+  ASSERT_TRUE(cCount == 1);
+  delete rawC;
+  // Does reset work?
+  {
+      UniquePtr<C> c(new C);
+      ASSERT_TRUE(cCount == 1);
+      c.reset(new C);
+      ASSERT_TRUE(cCount == 1);
+  }
+  ASSERT_TRUE(cCount == 0);
+
+  //
+  // UniquePtr<T[]> tests...
+  //
+
+  // Can we free an array?
+  {
+      UniquePtr<C[]> cs(new C[4]);
+      ASSERT_TRUE(cCount == 4);
+  }
+  ASSERT_TRUE(cCount == 0);
+  // Does release work?
+  {
+      UniquePtr<C[]> c(new C[4]);
+      ASSERT_TRUE(cCount == 4);
+      rawC = c.release();
+  }
+  ASSERT_TRUE(cCount == 4);
+  delete[] rawC;
+  // Does reset work?
+  {
+      UniquePtr<C[]> c(new C[4]);
+      ASSERT_TRUE(cCount == 4);
+      c.reset(new C[2]);
+      ASSERT_TRUE(cCount == 2);
+  }
+  ASSERT_TRUE(cCount == 0);
+
+  //
+  // Custom deleter tests...
+  //
+  ASSERT_TRUE(!freed);
+  {
+      UniquePtr<int, Freer> i(reinterpret_cast<int*>(malloc(sizeof(int))));
+      *i = 123;
+  }
+  ASSERT_TRUE(freed);
+}