diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp
index 0d557f1..1b539f2 100644
--- a/libc/bionic/__libc_init_main_thread.cpp
+++ b/libc/bionic/__libc_init_main_thread.cpp
@@ -44,7 +44,7 @@
 // Declared in "private/bionic_ssp.h".
 uintptr_t __stack_chk_guard = 0;
 
-BIONIC_USED_BEFORE_LINKER_RELOCATES static pthread_internal_t main_thread;
+static pthread_internal_t main_thread;
 
 // Setup for the main thread. For dynamic executables, this is called by the
 // linker _before_ libc is mapped in memory. This means that all writes to
diff --git a/libc/bionic/bionic_call_ifunc_resolver.cpp b/libc/bionic/bionic_call_ifunc_resolver.cpp
index d5a812c..e44d998 100644
--- a/libc/bionic/bionic_call_ifunc_resolver.cpp
+++ b/libc/bionic/bionic_call_ifunc_resolver.cpp
@@ -31,7 +31,6 @@
 #include <sys/hwprobe.h>
 #include <sys/ifunc.h>
 
-#include "bionic/macros.h"
 #include "private/bionic_auxv.h"
 
 // This code is called in the linker before it has been relocated, so minimize calls into other
@@ -41,8 +40,8 @@
 ElfW(Addr) __bionic_call_ifunc_resolver(ElfW(Addr) resolver_addr) {
 #if defined(__aarch64__)
   typedef ElfW(Addr) (*ifunc_resolver_t)(uint64_t, __ifunc_arg_t*);
-  BIONIC_USED_BEFORE_LINKER_RELOCATES static __ifunc_arg_t arg;
-  BIONIC_USED_BEFORE_LINKER_RELOCATES static bool initialized = false;
+  static __ifunc_arg_t arg;
+  static bool initialized = false;
   if (!initialized) {
     initialized = true;
     arg._size = sizeof(__ifunc_arg_t);
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index ae86da1..7c46113 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -344,12 +344,19 @@
 // This function is called from the linker before the main executable is relocated.
 __attribute__((no_sanitize("hwaddress", "memtag"))) void __libc_init_mte(
     const memtag_dynamic_entries_t* memtag_dynamic_entries, const void* phdr_start, size_t phdr_ct,
-    uintptr_t load_bias) {
+    uintptr_t load_bias, void* stack_top) {
   bool memtag_stack = false;
   HeapTaggingLevel level =
       __get_tagging_level(memtag_dynamic_entries, phdr_start, phdr_ct, load_bias, &memtag_stack);
-  __libc_shared_globals()->initial_memtag_stack = memtag_stack;
-
+  // initial_memtag_stack is used by the linker (in linker.cpp) to communicate than any library
+  // linked by this executable enables memtag-stack.
+  // memtag_stack is also set for static executables if they request memtag stack via the note,
+  // in which case it will differ from initial_memtag_stack.
+  if (__libc_shared_globals()->initial_memtag_stack || memtag_stack) {
+    memtag_stack = true;
+    __libc_shared_globals()->initial_memtag_stack_abi = true;
+    __get_bionic_tcb()->tls_slot(TLS_SLOT_STACK_MTE) = __allocate_stack_mte_ringbuffer(0, nullptr);
+  }
   if (int64_t timed_upgrade = __get_memtag_upgrade_secs()) {
     if (level == M_HEAP_TAGGING_LEVEL_ASYNC) {
       async_safe_format_log(ANDROID_LOG_INFO, "libc",
@@ -373,7 +380,15 @@
     if (prctl(PR_SET_TAGGED_ADDR_CTRL, prctl_arg | PR_MTE_TCF_SYNC, 0, 0, 0) == 0 ||
         prctl(PR_SET_TAGGED_ADDR_CTRL, prctl_arg, 0, 0, 0) == 0) {
       __libc_shared_globals()->initial_heap_tagging_level = level;
+      __libc_shared_globals()->initial_memtag_stack = memtag_stack;
 
+      if (memtag_stack) {
+        void* pg_start =
+            reinterpret_cast<void*>(page_start(reinterpret_cast<uintptr_t>(stack_top)));
+        if (mprotect(pg_start, page_size(), PROT_READ | PROT_WRITE | PROT_MTE | PROT_GROWSDOWN)) {
+          async_safe_fatal("error: failed to set PROT_MTE on main thread stack: %m");
+        }
+      }
       struct sigaction action = {};
       action.sa_flags = SA_SIGINFO | SA_RESTART;
       action.sa_sigaction = __enable_mte_signal_handler;
@@ -389,36 +404,11 @@
   }
   // We did not enable MTE, so we do not need to arm the upgrade timer.
   __libc_shared_globals()->heap_tagging_upgrade_timer_sec = 0;
+  // We also didn't enable memtag_stack.
+  __libc_shared_globals()->initial_memtag_stack = false;
 }
-
-// Figure out whether we need to map the stack as PROT_MTE.
-// For dynamic executables, this has to be called after loading all
-// DT_NEEDED libraries, in case one of them needs stack MTE.
-__attribute__((no_sanitize("hwaddress", "memtag"))) void __libc_init_mte_stack(void* stack_top) {
-  if (!__libc_shared_globals()->initial_memtag_stack) {
-    return;
-  }
-
-  // Even if the device doesn't support MTE, we have to allocate stack
-  // history buffers for code compiled for stack MTE. That is because the
-  // codegen expects a buffer to be present in TLS_SLOT_STACK_MTE either
-  // way.
-  __libc_shared_globals()->initial_memtag_stack_abi = true;
-  __get_bionic_tcb()->tls_slot(TLS_SLOT_STACK_MTE) = __allocate_stack_mte_ringbuffer(0, nullptr);
-
-  if (!__libc_mte_enabled()) {
-    __libc_shared_globals()->initial_memtag_stack = false;
-    return;
-  }
-  void* pg_start = reinterpret_cast<void*>(page_start(reinterpret_cast<uintptr_t>(stack_top)));
-  if (mprotect(pg_start, page_size(), PROT_READ | PROT_WRITE | PROT_MTE | PROT_GROWSDOWN)) {
-    async_safe_fatal("error: failed to set PROT_MTE on main thread stack: %m");
-  }
-}
-
 #else   // __aarch64__
-void __libc_init_mte(const memtag_dynamic_entries_t*, const void*, size_t, uintptr_t) {}
-void __libc_init_mte_stack(void*) {}
+void __libc_init_mte(const memtag_dynamic_entries_t*, const void*, size_t, uintptr_t, void*) {}
 #endif  // __aarch64__
 
 void __libc_init_profiling_handlers() {
@@ -446,8 +436,7 @@
   __libc_init_common();
   __libc_init_mte(/*memtag_dynamic_entries=*/nullptr,
                   reinterpret_cast<ElfW(Phdr)*>(getauxval(AT_PHDR)), getauxval(AT_PHNUM),
-                  /*load_bias = */ 0);
-  __libc_init_mte_stack(/*stack_top = */ raw_args);
+                  /*load_bias = */ 0, /*stack_top = */ raw_args);
   __libc_init_scudo();
   __libc_init_profiling_handlers();
   __libc_init_fork_handler();
@@ -519,11 +508,6 @@
 // compiled with -ffreestanding to avoid implicit string.h function calls. (It shouldn't strictly
 // be necessary, though.)
 __LIBC_HIDDEN__ libc_shared_globals* __libc_shared_globals() {
-  BIONIC_USED_BEFORE_LINKER_RELOCATES static libc_shared_globals globals;
+  static libc_shared_globals globals;
   return &globals;
 }
-
-__LIBC_HIDDEN__ bool __libc_mte_enabled() {
-  HeapTaggingLevel lvl = __libc_shared_globals()->initial_heap_tagging_level;
-  return lvl == M_HEAP_TAGGING_LEVEL_SYNC || lvl == M_HEAP_TAGGING_LEVEL_ASYNC;
-}
diff --git a/libc/platform/bionic/macros.h b/libc/platform/bionic/macros.h
index 837583e..93268c1 100644
--- a/libc/platform/bionic/macros.h
+++ b/libc/platform/bionic/macros.h
@@ -97,26 +97,3 @@
 static inline T* _Nonnull untag_address(T* _Nonnull p) {
   return reinterpret_cast<T*>(untag_address(reinterpret_cast<uintptr_t>(p)));
 }
-
-// MTE globals protects internal and external global variables. One of the main
-// things that MTE globals does is force all global variable accesses to go
-// through the GOT. In the linker though, some global variables are accessed (or
-// address-taken) prior to relocations being processed. Because relocations
-// haven't run yet, the GOT entry hasn't been populated, and this leads to
-// crashes. Thus, any globals used by the linker prior to relocation should be
-// annotated with this attribute, which suppresses tagging of this global
-// variable, restoring the pc-relative address computation.
-//
-// A way to find global variables that need this attribute is to build the
-// linker/libc with `SANITIZE_TARGET=memtag_globals`, push them onto a device
-// (it doesn't have to be MTE capable), and then run an executable using
-// LD_LIBRARY_PATH and using the linker in interpreter mode (e.g.
-// `LD_LIBRARY_PATH=/data/tmp/ /data/tmp/linker64 /data/tmp/my_binary`). A
-// good heuristic is that the global variable is in a file that should be
-// compiled with `-ffreestanding` (but there are global variables there that
-// don't need thisattribute).
-#if __has_feature(memtag_globals)
-#define BIONIC_USED_BEFORE_LINKER_RELOCATES __attribute__((no_sanitize("memtag")))
-#else  // __has_feature(memtag_globals)
-#define BIONIC_USED_BEFORE_LINKER_RELOCATES
-#endif  // __has_feature(memtag_globals)
diff --git a/libc/platform/bionic/mte.h b/libc/platform/bionic/mte.h
index 423ed0f..98b3d27 100644
--- a/libc/platform/bionic/mte.h
+++ b/libc/platform/bionic/mte.h
@@ -28,7 +28,6 @@
 
 #pragma once
 
-#include <stddef.h>
 #include <sys/auxv.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
@@ -50,36 +49,6 @@
   return supported;
 }
 
-inline void* get_tagged_address(const void* ptr) {
-#if defined(__aarch64__)
-  if (mte_supported()) {
-    __asm__ __volatile__(".arch_extension mte; ldg %0, [%0]" : "+r"(ptr));
-  }
-#endif  // aarch64
-  return const_cast<void*>(ptr);
-}
-
-// Inserts a random tag tag to `ptr`, using any of the set lower 16 bits in
-// `mask` to exclude the corresponding tag from being generated. Note: This does
-// not tag memory. This generates a pointer to be used with set_memory_tag.
-inline void* insert_random_tag(const void* ptr, __attribute__((unused)) uint64_t mask = 0) {
-#if defined(__aarch64__)
-  if (mte_supported() && ptr) {
-    __asm__ __volatile__(".arch_extension mte; irg %0, %0, %1" : "+r"(ptr) : "r"(mask));
-  }
-#endif  // aarch64
-  return const_cast<void*>(ptr);
-}
-
-// Stores the address tag in `ptr` to memory, at `ptr`.
-inline void set_memory_tag(__attribute__((unused)) void* ptr) {
-#if defined(__aarch64__)
-  if (mte_supported()) {
-    __asm__ __volatile__(".arch_extension mte; stg %0, [%0]" : "+r"(ptr));
-  }
-#endif  // aarch64
-}
-
 #ifdef __aarch64__
 class ScopedDisableMTE {
   size_t prev_tco_;
diff --git a/libc/private/bionic_globals.h b/libc/private/bionic_globals.h
index 02713fc..a1bebda 100644
--- a/libc/private/bionic_globals.h
+++ b/libc/private/bionic_globals.h
@@ -157,7 +157,6 @@
 };
 
 __LIBC_HIDDEN__ libc_shared_globals* __libc_shared_globals();
-__LIBC_HIDDEN__ bool __libc_mte_enabled();
 __LIBC_HIDDEN__ void __libc_init_fdsan();
 __LIBC_HIDDEN__ void __libc_init_fdtrack();
 __LIBC_HIDDEN__ void __libc_init_profiling_handlers();
diff --git a/linker/Android.bp b/linker/Android.bp
index 847a9b2..a06ca29 100644
--- a/linker/Android.bp
+++ b/linker/Android.bp
@@ -108,12 +108,6 @@
 
     // We need to access Bionic private headers in the linker.
     include_dirs: ["bionic/libc"],
-
-    sanitize: {
-        // Supporting memtag_globals in the linker would be tricky,
-        // because it relocates itself very early.
-        memtag_globals: false,
-    },
 }
 
 // ========================================================
diff --git a/linker/dlfcn.cpp b/linker/dlfcn.cpp
index 82f2728..fee19f4 100644
--- a/linker/dlfcn.cpp
+++ b/linker/dlfcn.cpp
@@ -331,7 +331,6 @@
     __libdl_info->gnu_bloom_filter_ = linker_si.gnu_bloom_filter_;
     __libdl_info->gnu_bucket_ = linker_si.gnu_bucket_;
     __libdl_info->gnu_chain_ = linker_si.gnu_chain_;
-    __libdl_info->memtag_dynamic_entries_ = linker_si.memtag_dynamic_entries_;
 
     __libdl_info->ref_count_ = 1;
     __libdl_info->strtab_size_ = linker_si.strtab_size_;
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 517950c..88d02dc 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -51,7 +51,6 @@
 #include <android-base/scopeguard.h>
 #include <async_safe/log.h>
 #include <bionic/pthread_internal.h>
-#include <platform/bionic/mte.h>
 
 // Private C library headers.
 
@@ -2362,7 +2361,7 @@
         void* tls_block = get_tls_block_for_this_thread(tls_module, /*should_alloc=*/true);
         *symbol = static_cast<char*>(tls_block) + sym->st_value;
       } else {
-        *symbol = get_tagged_address(reinterpret_cast<void*>(found->resolve_symbol_address(sym)));
+        *symbol = reinterpret_cast<void*>(found->resolve_symbol_address(sym));
       }
       failure_guard.Disable();
       LD_LOG(kLogDlsym,
@@ -2792,25 +2791,15 @@
   return true;
 }
 
-static void apply_relr_reloc(ElfW(Addr) offset, ElfW(Addr) load_bias, bool has_memtag_globals) {
-  ElfW(Addr) destination = offset + load_bias;
-  if (!has_memtag_globals) {
-    *reinterpret_cast<ElfW(Addr)*>(destination) += load_bias;
-    return;
-  }
-
-  ElfW(Addr)* tagged_destination =
-      reinterpret_cast<ElfW(Addr)*>(get_tagged_address(reinterpret_cast<void*>(destination)));
-  ElfW(Addr) tagged_value = reinterpret_cast<ElfW(Addr)>(
-      get_tagged_address(reinterpret_cast<void*>(*tagged_destination + load_bias)));
-  *tagged_destination = tagged_value;
+static void apply_relr_reloc(ElfW(Addr) offset, ElfW(Addr) load_bias) {
+  ElfW(Addr) address = offset + load_bias;
+  *reinterpret_cast<ElfW(Addr)*>(address) += load_bias;
 }
 
 // Process relocations in SHT_RELR section (experimental).
 // Details of the encoding are described in this post:
 //   https://groups.google.com/d/msg/generic-abi/bX460iggiKg/Pi9aSwwABgAJ
-bool relocate_relr(const ElfW(Relr) * begin, const ElfW(Relr) * end, ElfW(Addr) load_bias,
-                   bool has_memtag_globals) {
+bool relocate_relr(const ElfW(Relr)* begin, const ElfW(Relr)* end, ElfW(Addr) load_bias) {
   constexpr size_t wordsize = sizeof(ElfW(Addr));
 
   ElfW(Addr) base = 0;
@@ -2821,7 +2810,7 @@
     if ((entry&1) == 0) {
       // Even entry: encodes the offset for next relocation.
       offset = static_cast<ElfW(Addr)>(entry);
-      apply_relr_reloc(offset, load_bias, has_memtag_globals);
+      apply_relr_reloc(offset, load_bias);
       // Set base offset for subsequent bitmap entries.
       base = offset + wordsize;
       continue;
@@ -2832,7 +2821,7 @@
     while (entry != 0) {
       entry >>= 1;
       if ((entry&1) != 0) {
-        apply_relr_reloc(offset, load_bias, has_memtag_globals);
+        apply_relr_reloc(offset, load_bias);
       }
       offset += wordsize;
     }
@@ -3336,18 +3325,6 @@
   // it each time we look up a symbol with a version.
   if (!validate_verdef_section(this)) return false;
 
-  // MTE globals requires remapping data segments with PROT_MTE as anonymous mappings, because file
-  // based mappings may not be backed by tag-capable memory (see "MAP_ANONYMOUS" on
-  // https://www.kernel.org/doc/html/latest/arch/arm64/memory-tagging-extension.html). This is only
-  // done if the binary has MTE globals (evidenced by the dynamic table entries), as it destroys
-  // page sharing. It's also only done on devices that support MTE, because the act of remapping
-  // pages is unnecessary on non-MTE devices (where we might still run MTE-globals enabled code).
-  if (should_tag_memtag_globals() &&
-      remap_memtag_globals_segments(phdr, phnum, base) == 0) {
-    tag_globals();
-    protect_memtag_globals_ro_segments(phdr, phnum, base);
-  }
-
   flags_ |= FLAG_PRELINKED;
   return true;
 }
@@ -3420,10 +3397,6 @@
     return false;
   }
 
-  if (should_tag_memtag_globals()) {
-    name_memtag_globals_segments(phdr, phnum, base, get_realpath(), vma_names_);
-  }
-
   /* Handle serializing/sharing the RELRO segment */
   if (extinfo && (extinfo->flags & ANDROID_DLEXT_WRITE_RELRO)) {
     if (phdr_table_serialize_gnu_relro(phdr, phnum, load_bias,
@@ -3462,48 +3435,6 @@
   return true;
 }
 
-// https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#global-variable-tagging
-void soinfo::tag_globals() {
-  if (is_linked()) return;
-  if (flags_ & FLAG_GLOBALS_TAGGED) return;
-  flags_ |= FLAG_GLOBALS_TAGGED;
-
-  constexpr size_t kTagGranuleSize = 16;
-  const uint8_t* descriptor_stream = reinterpret_cast<const uint8_t*>(memtag_globals());
-
-  if (memtag_globalssz() == 0) {
-    DL_ERR("Invalid memtag descriptor pool size: %zu", memtag_globalssz());
-  }
-
-  uint64_t addr = load_bias;
-  uleb128_decoder decoder(descriptor_stream, memtag_globalssz());
-  // Don't ever generate tag zero, to easily distinguish between tagged and
-  // untagged globals in register/tag dumps.
-  uint64_t last_tag_mask = 1;
-  constexpr uint64_t kDistanceReservedBits = 3;
-
-  while (decoder.has_bytes()) {
-    uint64_t value = decoder.pop_front();
-    uint64_t distance = (value >> kDistanceReservedBits) * kTagGranuleSize;
-    uint64_t ngranules = value & ((1 << kDistanceReservedBits) - 1);
-    if (ngranules == 0) {
-      ngranules = decoder.pop_front() + 1;
-    }
-
-    addr += distance;
-    void* tagged_addr;
-    tagged_addr = insert_random_tag(reinterpret_cast<void*>(addr), last_tag_mask);
-    uint64_t tag = (reinterpret_cast<uint64_t>(tagged_addr) >> 56) & 0x0f;
-    last_tag_mask = 1 | (1 << tag);
-
-    for (size_t k = 0; k < ngranules; k++) {
-      auto* granule = static_cast<uint8_t*>(tagged_addr) + k * kTagGranuleSize;
-      set_memory_tag(static_cast<void*>(granule));
-    }
-    addr += ngranules * kTagGranuleSize;
-  }
-}
-
 static std::vector<android_namespace_t*> init_default_namespace_no_config(bool is_asan, bool is_hwasan) {
   g_default_namespace.set_isolated(false);
   auto default_ld_paths = is_asan ? kAsanDefaultLdPaths : (
diff --git a/linker/linker.h b/linker/linker.h
index b696fd9..ac2222d 100644
--- a/linker/linker.h
+++ b/linker/linker.h
@@ -179,8 +179,7 @@
 int get_application_target_sdk_version();
 ElfW(Versym) find_verdef_version_index(const soinfo* si, const version_info* vi);
 bool validate_verdef_section(const soinfo* si);
-bool relocate_relr(const ElfW(Relr) * begin, const ElfW(Relr) * end, ElfW(Addr) load_bias,
-                   bool has_memtag_globals);
+bool relocate_relr(const ElfW(Relr)* begin, const ElfW(Relr)* end, ElfW(Addr) load_bias);
 
 struct platform_properties {
 #if defined(__aarch64__)
diff --git a/linker/linker_main.cpp b/linker/linker_main.cpp
index f65f82d..48ed723 100644
--- a/linker/linker_main.cpp
+++ b/linker/linker_main.cpp
@@ -46,7 +46,6 @@
 #include "linker_tls.h"
 #include "linker_utils.h"
 
-#include "platform/bionic/macros.h"
 #include "private/KernelArgumentBlock.h"
 #include "private/bionic_call_ifunc_resolver.h"
 #include "private/bionic_globals.h"
@@ -72,9 +71,7 @@
 static void set_bss_vma_name(soinfo* si);
 
 void __libc_init_mte(const memtag_dynamic_entries_t* memtag_dynamic_entries, const void* phdr_start,
-                     size_t phdr_count, uintptr_t load_bias);
-
-void __libc_init_mte_stack(void* stack_top);
+                     size_t phdr_count, uintptr_t load_bias, void* stack_top);
 
 static void __linker_cannot_link(const char* argv0) {
   __linker_error("CANNOT LINK EXECUTABLE \"%s\": %s", argv0, linker_get_error_buffer());
@@ -368,8 +365,6 @@
   init_link_map_head(*solinker);
 
 #if defined(__aarch64__)
-  __libc_init_mte(somain->memtag_dynamic_entries(), somain->phdr, somain->phnum, somain->load_bias);
-
   if (exe_to_load == nullptr) {
     // Kernel does not add PROT_BTI to executable pages of the loaded ELF.
     // Apply appropriate protections here if it is needed.
@@ -470,7 +465,8 @@
 #if defined(__aarch64__)
   // This has to happen after the find_libraries, which will have collected any possible
   // libraries that request memtag_stack in the dynamic section.
-  __libc_init_mte_stack(args.argv);
+  __libc_init_mte(somain->memtag_dynamic_entries(), somain->phdr, somain->phnum, somain->load_bias,
+                  args.argv);
 #endif
 
   linker_finalize_static_tls();
@@ -629,13 +625,8 @@
     // Apply RELR relocations first so that the GOT is initialized for ifunc
     // resolvers.
     if (relr && relrsz) {
-      // Nothing has tagged the memtag globals here, so it is pointless either
-      // way to handle them, the tags will be zero anyway.
-      // That is moot though, because the linker does not use memtag_globals
-      // in the first place.
       relocate_relr(reinterpret_cast<ElfW(Relr*)>(ehdr + relr),
-                    reinterpret_cast<ElfW(Relr*)>(ehdr + relr + relrsz), ehdr,
-                    /*has_memtag_globals=*/ false);
+                    reinterpret_cast<ElfW(Relr*)>(ehdr + relr + relrsz), ehdr);
     }
     if (pltrel && pltrelsz) {
       call_ifunc_resolvers_for_section(reinterpret_cast<RelType*>(ehdr + pltrel),
@@ -655,16 +646,6 @@
   }
 }
 
-// Remapping MTE globals segments happens before the linker relocates itself, and so can't use
-// memcpy() from string.h. This function is compiled with -ffreestanding.
-void linker_memcpy(void* dst, const void* src, size_t n) {
-  char* dst_bytes = reinterpret_cast<char*>(dst);
-  const char* src_bytes = reinterpret_cast<const char*>(src);
-  for (size_t i = 0; i < n; ++i) {
-    dst_bytes[i] = src_bytes[i];
-  }
-}
-
 // Detect an attempt to run the linker on itself. e.g.:
 //   /system/bin/linker64 /system/bin/linker64
 // Use priority-1 to run this constructor before other constructors.
diff --git a/linker/linker_main.h b/linker/linker_main.h
index ffbcf0f..724f43c 100644
--- a/linker/linker_main.h
+++ b/linker/linker_main.h
@@ -70,5 +70,3 @@
 soinfo* solist_get_head();
 soinfo* solist_get_somain();
 soinfo* solist_get_vdso();
-
-void linker_memcpy(void* dst, const void* src, size_t n);
diff --git a/linker/linker_phdr.cpp b/linker/linker_phdr.cpp
index 2bdd7f8..7691031 100644
--- a/linker/linker_phdr.cpp
+++ b/linker/linker_phdr.cpp
@@ -37,12 +37,9 @@
 #include <unistd.h>
 
 #include "linker.h"
-#include "linker_debug.h"
 #include "linker_dlwarning.h"
 #include "linker_globals.h"
-#include "linker_logger.h"
-#include "linker_main.h"
-#include "linker_soinfo.h"
+#include "linker_debug.h"
 #include "linker_utils.h"
 
 #include "private/bionic_asm_note.h"
@@ -1175,125 +1172,6 @@
                                    should_use_16kib_app_compat);
 }
 
-static bool segment_needs_memtag_globals_remapping(const ElfW(Phdr) * phdr) {
-  // For now, MTE globals is only supported on writeable data segments.
-  return phdr->p_type == PT_LOAD && !(phdr->p_flags & PF_X) && (phdr->p_flags & PF_W);
-}
-
-/* When MTE globals are requested by the binary, and when the hardware supports
- * it, remap the executable's PT_LOAD data pages to have PROT_MTE.
- *
- * Returns 0 on success, -1 on failure (error code in errno).
- */
-int remap_memtag_globals_segments(const ElfW(Phdr) * phdr_table __unused,
-                                  size_t phdr_count __unused, ElfW(Addr) load_bias __unused) {
-#if defined(__aarch64__)
-  for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_table + phdr_count; phdr++) {
-    if (!segment_needs_memtag_globals_remapping(phdr)) {
-      continue;
-    }
-
-    uintptr_t seg_page_start = page_start(phdr->p_vaddr) + load_bias;
-    uintptr_t seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
-    size_t seg_page_aligned_size = seg_page_end - seg_page_start;
-
-    int prot = PFLAGS_TO_PROT(phdr->p_flags);
-    // For anonymous private mappings, it may be possible to simply mprotect()
-    // the PROT_MTE flag over the top. For file-based mappings, this will fail,
-    // and we'll need to fall back. We also allow PROT_WRITE here to allow
-    // writing memory tags (in `soinfo::tag_globals()`), and set these sections
-    // back to read-only after tags are applied (similar to RELRO).
-    prot |= PROT_MTE;
-    if (mprotect(reinterpret_cast<void*>(seg_page_start), seg_page_aligned_size,
-                 prot | PROT_WRITE) == 0) {
-      continue;
-    }
-
-    void* mapping_copy = mmap(nullptr, seg_page_aligned_size, PROT_READ | PROT_WRITE,
-                              MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-    linker_memcpy(mapping_copy, reinterpret_cast<void*>(seg_page_start), seg_page_aligned_size);
-
-    void* seg_addr = mmap(reinterpret_cast<void*>(seg_page_start), seg_page_aligned_size,
-                          prot | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-    if (seg_addr == MAP_FAILED) return -1;
-
-    linker_memcpy(seg_addr, mapping_copy, seg_page_aligned_size);
-    munmap(mapping_copy, seg_page_aligned_size);
-  }
-#endif  // defined(__aarch64__)
-  return 0;
-}
-
-void protect_memtag_globals_ro_segments(const ElfW(Phdr) * phdr_table __unused,
-                                        size_t phdr_count __unused, ElfW(Addr) load_bias __unused) {
-#if defined(__aarch64__)
-  for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_table + phdr_count; phdr++) {
-    int prot = PFLAGS_TO_PROT(phdr->p_flags);
-    if (!segment_needs_memtag_globals_remapping(phdr) || (prot & PROT_WRITE)) {
-      continue;
-    }
-
-    prot |= PROT_MTE;
-
-    uintptr_t seg_page_start = page_start(phdr->p_vaddr) + load_bias;
-    uintptr_t seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
-    size_t seg_page_aligned_size = seg_page_end - seg_page_start;
-    mprotect(reinterpret_cast<void*>(seg_page_start), seg_page_aligned_size, prot);
-  }
-#endif  // defined(__aarch64__)
-}
-
-void name_memtag_globals_segments(const ElfW(Phdr) * phdr_table, size_t phdr_count,
-                                  ElfW(Addr) load_bias, const char* soname,
-                                  std::list<std::string>& vma_names) {
-  for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_table + phdr_count; phdr++) {
-    if (!segment_needs_memtag_globals_remapping(phdr)) {
-      continue;
-    }
-
-    uintptr_t seg_page_start = page_start(phdr->p_vaddr) + load_bias;
-    uintptr_t seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
-    size_t seg_page_aligned_size = seg_page_end - seg_page_start;
-
-    // For file-based mappings that we're now forcing to be anonymous mappings, set the VMA name to
-    // make debugging easier.
-    // Once we are targeting only devices that run kernel 5.10 or newer (and thus include
-    // https://android-review.git.corp.google.com/c/kernel/common/+/1934723 which causes the
-    // VMA_ANON_NAME to be copied into the kernel), we can get rid of the storage here.
-    // For now, that is not the case:
-    // https://source.android.com/docs/core/architecture/kernel/android-common#compatibility-matrix
-    constexpr int kVmaNameLimit = 80;
-    std::string& vma_name = vma_names.emplace_back('\0', kVmaNameLimit);
-    int full_vma_length =
-        async_safe_format_buffer(vma_name.data(), kVmaNameLimit, "mt:%s+%" PRIxPTR, soname,
-                                 page_start(phdr->p_vaddr)) +
-        /* include the null terminator */ 1;
-    // There's an upper limit of 80 characters, including the null terminator, in the anonymous VMA
-    // name. If we run over that limit, we end up truncating the segment offset and parts of the
-    // DSO's name, starting on the right hand side of the basename. Because the basename is the most
-    // important thing, chop off the soname from the left hand side first.
-    //
-    // Example (with '#' as the null terminator):
-    //   - "mt:/data/nativetest64/bionic-unit-tests/bionic-loader-test-libs/libdlext_test.so+e000#"
-    //     is a `full_vma_length` == 86.
-    //
-    // We need to left-truncate (86 - 80) 6 characters from the soname, plus the
-    // `vma_truncation_prefix`, so 9 characters total.
-    if (full_vma_length > kVmaNameLimit) {
-      const char vma_truncation_prefix[] = "...";
-      int soname_truncated_bytes =
-          full_vma_length - kVmaNameLimit + sizeof(vma_truncation_prefix) - 1;
-      async_safe_format_buffer(vma_name.data(), kVmaNameLimit, "mt:%s%s+%" PRIxPTR,
-                               vma_truncation_prefix, soname + soname_truncated_bytes,
-                               page_start(phdr->p_vaddr));
-    }
-    if (prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, reinterpret_cast<void*>(seg_page_start),
-              seg_page_aligned_size, vma_name.data()) != 0) {
-      DL_WARN("Failed to re-name memtag global segment.");
-    }
-  }
-}
-
 /* Change the protection of all loaded segments in memory to writable.
  * This is useful before performing relocations. Once completed, you
  * will have to call phdr_table_protect_segments to restore the original
diff --git a/linker/linker_phdr.h b/linker/linker_phdr.h
index 353970c..2f159f3 100644
--- a/linker/linker_phdr.h
+++ b/linker/linker_phdr.h
@@ -39,8 +39,6 @@
 #include "linker_mapped_file_fragment.h"
 #include "linker_note_gnu_property.h"
 
-#include <list>
-
 #define MAYBE_MAP_FLAG(x, from, to)  (((x) & (from)) ? (to) : 0)
 #define PFLAGS_TO_PROT(x)            (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
                                       MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
@@ -190,13 +188,3 @@
                                             ElfW(Addr) load_bias);
 
 bool page_size_migration_supported();
-
-int remap_memtag_globals_segments(const ElfW(Phdr) * phdr_table, size_t phdr_count,
-                                  ElfW(Addr) load_bias);
-
-void protect_memtag_globals_ro_segments(const ElfW(Phdr) * phdr_table, size_t phdr_count,
-                                        ElfW(Addr) load_bias);
-
-void name_memtag_globals_segments(const ElfW(Phdr) * phdr_table, size_t phdr_count,
-                                  ElfW(Addr) load_bias, const char* soname,
-                                  std::list<std::string>& vma_names);
diff --git a/linker/linker_relocate.cpp b/linker/linker_relocate.cpp
index bbf8359..0470f87 100644
--- a/linker/linker_relocate.cpp
+++ b/linker/linker_relocate.cpp
@@ -44,8 +44,6 @@
 #include "linker_soinfo.h"
 #include "private/bionic_globals.h"
 
-#include <platform/bionic/mte.h>
-
 static bool is_tls_reloc(ElfW(Word) type) {
   switch (type) {
     case R_GENERIC_TLS_DTPMOD:
@@ -165,8 +163,7 @@
 static bool process_relocation_impl(Relocator& relocator, const rel_t& reloc) {
   constexpr bool IsGeneral = Mode == RelocMode::General;
 
-  void* const rel_target = reinterpret_cast<void*>(
-      relocator.si->apply_memtag_if_mte_globals(reloc.r_offset + relocator.si->load_bias));
+  void* const rel_target = reinterpret_cast<void*>(reloc.r_offset + relocator.si->load_bias);
   const uint32_t r_type = ELFW(R_TYPE)(reloc.r_info);
   const uint32_t r_sym = ELFW(R_SYM)(reloc.r_info);
 
@@ -319,7 +316,6 @@
     // common in non-platform binaries.
     if (r_type == R_GENERIC_ABSOLUTE) {
       count_relocation_if<IsGeneral>(kRelocAbsolute);
-      if (found_in) sym_addr = found_in->apply_memtag_if_mte_globals(sym_addr);
       const ElfW(Addr) result = sym_addr + get_addend_rel();
       LD_DEBUG(reloc && IsGeneral, "RELO ABSOLUTE %16p <- %16p %s",
                rel_target, reinterpret_cast<void*>(result), sym_name);
@@ -330,7 +326,6 @@
       // document (IHI0044F) specifies that R_ARM_GLOB_DAT has an addend, but Bionic isn't adding
       // it.
       count_relocation_if<IsGeneral>(kRelocAbsolute);
-      if (found_in) sym_addr = found_in->apply_memtag_if_mte_globals(sym_addr);
       const ElfW(Addr) result = sym_addr + get_addend_norel();
       LD_DEBUG(reloc && IsGeneral, "RELO GLOB_DAT %16p <- %16p %s",
                rel_target, reinterpret_cast<void*>(result), sym_name);
@@ -340,18 +335,7 @@
       // In practice, r_sym is always zero, but if it weren't, the linker would still look up the
       // referenced symbol (and abort if the symbol isn't found), even though it isn't used.
       count_relocation_if<IsGeneral>(kRelocRelative);
-      ElfW(Addr) result = relocator.si->load_bias + get_addend_rel();
-      // MTE globals reuses the place bits for additional tag-derivation metadata for
-      // R_AARCH64_RELATIVE relocations, which makes it incompatible with
-      // `-Wl,--apply-dynamic-relocs`. This is enforced by lld, however there's nothing stopping
-      // Android binaries (particularly prebuilts) from building with this linker flag if they're
-      // not built with MTE globals. Thus, don't use the new relocation semantics if this DSO
-      // doesn't have MTE globals.
-      if (relocator.si->should_tag_memtag_globals()) {
-        int64_t* place = static_cast<int64_t*>(rel_target);
-        int64_t offset = *place;
-        result = relocator.si->apply_memtag_if_mte_globals(result + offset) - offset;
-      }
+      const ElfW(Addr) result = relocator.si->load_bias + get_addend_rel();
       LD_DEBUG(reloc && IsGeneral, "RELO RELATIVE %16p <- %16p",
                rel_target, reinterpret_cast<void*>(result));
       *static_cast<ElfW(Addr)*>(rel_target) = result;
@@ -616,7 +600,7 @@
     LD_DEBUG(reloc, "[ relocating %s relr ]", get_realpath());
     const ElfW(Relr)* begin = relr_;
     const ElfW(Relr)* end = relr_ + relr_count_;
-    if (!relocate_relr(begin, end, load_bias, should_tag_memtag_globals())) {
+    if (!relocate_relr(begin, end, load_bias)) {
       return false;
     }
   }
diff --git a/linker/linker_sleb128.h b/linker/linker_sleb128.h
index f48fda8..6bb3199 100644
--- a/linker/linker_sleb128.h
+++ b/linker/linker_sleb128.h
@@ -69,32 +69,3 @@
   const uint8_t* current_;
   const uint8_t* const end_;
 };
-
-class uleb128_decoder {
- public:
-  uleb128_decoder(const uint8_t* buffer, size_t count) : current_(buffer), end_(buffer + count) {}
-
-  uint64_t pop_front() {
-    uint64_t value = 0;
-
-    size_t shift = 0;
-    uint8_t byte;
-
-    do {
-      if (current_ >= end_) {
-        async_safe_fatal("uleb128_decoder ran out of bounds");
-      }
-      byte = *current_++;
-      value |= (static_cast<size_t>(byte & 127) << shift);
-      shift += 7;
-    } while (byte & 128);
-
-    return value;
-  }
-
-  bool has_bytes() { return current_ < end_; }
-
- private:
-  const uint8_t* current_;
-  const uint8_t* const end_;
-};
diff --git a/linker/linker_soinfo.cpp b/linker/linker_soinfo.cpp
index 176c133..0549d36 100644
--- a/linker/linker_soinfo.cpp
+++ b/linker/linker_soinfo.cpp
@@ -44,8 +44,6 @@
 #include "linker_logger.h"
 #include "linker_relocate.h"
 #include "linker_utils.h"
-#include "platform/bionic/mte.h"
-#include "private/bionic_globals.h"
 
 SymbolLookupList::SymbolLookupList(soinfo* si)
     : sole_lib_(si->get_lookup_lib()), begin_(&sole_lib_), end_(&sole_lib_ + 1) {
@@ -306,12 +304,6 @@
   return is_gnu_hash() ? gnu_lookup(symbol_name, vi) : elf_lookup(symbol_name, vi);
 }
 
-ElfW(Addr) soinfo::apply_memtag_if_mte_globals(ElfW(Addr) sym_addr) const {
-  if (!should_tag_memtag_globals()) return sym_addr;
-  if (sym_addr == 0) return sym_addr;  // Handle undefined weak symbols.
-  return reinterpret_cast<ElfW(Addr)>(get_tagged_address(reinterpret_cast<void*>(sym_addr)));
-}
-
 const ElfW(Sym)* soinfo::gnu_lookup(SymbolName& symbol_name, const version_info* vi) const {
   const uint32_t hash = symbol_name.gnu_hash();
 
diff --git a/linker/linker_soinfo.h b/linker/linker_soinfo.h
index 6b81f5f..a776c1f 100644
--- a/linker/linker_soinfo.h
+++ b/linker/linker_soinfo.h
@@ -30,7 +30,6 @@
 
 #include <link.h>
 
-#include <list>
 #include <memory>
 #include <string>
 #include <vector>
@@ -67,10 +66,9 @@
                                          // soinfo is executed and this flag is
                                          // unset.
 #define FLAG_PRELINKED        0x00000400 // prelink_image has successfully processed this soinfo
-#define FLAG_GLOBALS_TAGGED   0x00000800 // globals have been tagged by MTE.
 #define FLAG_NEW_SOINFO       0x40000000 // new soinfo format
 
-#define SOINFO_VERSION 7
+#define SOINFO_VERSION 6
 
 ElfW(Addr) call_ifunc_resolver(ElfW(Addr) resolver_addr);
 
@@ -259,9 +257,6 @@
                   const android_dlextinfo* extinfo, size_t* relro_fd_offset);
   bool protect_relro();
 
-  void tag_globals();
-  ElfW(Addr) apply_memtag_if_mte_globals(ElfW(Addr) sym_addr) const;
-
   void add_child(soinfo* child);
   void remove_all_links();
 
@@ -373,10 +368,6 @@
    should_pad_segments_ = should_pad_segments;
   }
   bool should_pad_segments() const { return should_pad_segments_; }
-  bool should_tag_memtag_globals() const {
-    return !is_linker() && memtag_globals() && memtag_globalssz() > 0 && __libc_mte_enabled();
-  }
-  std::list<std::string>& vma_names() { return vma_names_; };
 
   void set_should_use_16kib_app_compat(bool should_use_16kib_app_compat) {
     should_use_16kib_app_compat_ = should_use_16kib_app_compat;
@@ -473,8 +464,6 @@
   // version >= 7
   memtag_dynamic_entries_t memtag_dynamic_entries_;
 
-  std::list<std::string> vma_names_;
-
   // Pad gaps between segments when memory mapping?
   bool should_pad_segments_ = false;