diff --git a/libc/Android.bp b/libc/Android.bp
index 21ac02e..52a7aca 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -1710,6 +1710,19 @@
     cmd: "$(location :bionic-generate-version-script) x86_64 $(in) $(out)",
 }
 
+// Makes bionic_tls.h available for art to use in its implementation of Thread::Current().
+cc_library_headers {
+    name: "bionic_libc_private_headers",
+    visibility: [
+        "//art:__subpackages__",
+    ],
+    host_supported: true,
+    export_include_dirs: [
+        "private",
+    ],
+    sdk_version: "current",
+}
+
 // libc_headers for libasync_safe and libpropertyinfoparser
 cc_library_headers {
     name: "libc_headers",
diff --git a/libc/bionic/grp_pwd.cpp b/libc/bionic/grp_pwd.cpp
index d37fadd..6f8c07e 100644
--- a/libc/bionic/grp_pwd.cpp
+++ b/libc/bionic/grp_pwd.cpp
@@ -50,8 +50,21 @@
 #include "generated_android_ids.h"
 #include "grp_pwd_file.h"
 
-static PasswdFile vendor_passwd("/vendor/etc/passwd", "vendor_");
-static GroupFile vendor_group("/vendor/etc/group", "vendor_");
+static PasswdFile passwd_files[] = {
+  { "/system/etc/passwd", "system_" },
+  { "/vendor/etc/passwd", "vendor_" },
+  { "/odm/etc/passwd", "odm_" },
+  { "/product/etc/passwd", "product_" },
+  { "/system_ext/etc/passwd", "system_ext_" },
+};
+
+static GroupFile group_files[] = {
+  { "/system/etc/group", "system_" },
+  { "/vendor/etc/group", "vendor_" },
+  { "/odm/etc/group", "odm_" },
+  { "/product/etc/group", "product_" },
+  { "/system_ext/etc/group", "system_ext_" },
+};
 
 // POSIX seems to envisage an implementation where the <pwd.h> functions are
 // implemented by brute-force searching with getpwent(3), and the <grp.h>
@@ -91,7 +104,7 @@
                                        const android_id_info* iinfo) {
   snprintf(state->name_buffer_, sizeof(state->name_buffer_), "%s", iinfo->name);
   snprintf(state->dir_buffer_, sizeof(state->dir_buffer_), "/");
-  snprintf(state->sh_buffer_, sizeof(state->sh_buffer_), "/system/bin/sh");
+  snprintf(state->sh_buffer_, sizeof(state->sh_buffer_), "/bin/sh");
 
   passwd* pw = &state->passwd_;
   pw->pw_uid   = iinfo->aid;
@@ -421,17 +434,19 @@
 }
 
 static passwd* oem_id_to_passwd(uid_t uid, passwd_state_t* state) {
+  for (auto& passwd_file : passwd_files) {
+    if (passwd_file.FindById(uid, state)) {
+      return &state->passwd_;
+    }
+  }
+
   if (!is_oem_id(uid)) {
     return nullptr;
   }
 
-  if (vendor_passwd.FindById(uid, state)) {
-    return &state->passwd_;
-  }
-
   snprintf(state->name_buffer_, sizeof(state->name_buffer_), "oem_%u", uid);
   snprintf(state->dir_buffer_, sizeof(state->dir_buffer_), "/");
-  snprintf(state->sh_buffer_, sizeof(state->sh_buffer_), "/vendor/bin/sh");
+  snprintf(state->sh_buffer_, sizeof(state->sh_buffer_), "/bin/sh");
 
   passwd* pw = &state->passwd_;
   pw->pw_uid   = uid;
@@ -440,12 +455,14 @@
 }
 
 static group* oem_id_to_group(gid_t gid, group_state_t* state) {
-  if (!is_oem_id(gid)) {
-    return nullptr;
+  for (auto& group_file : group_files) {
+    if (group_file.FindById(gid, state)) {
+      return &state->group_;
+    }
   }
 
-  if (vendor_group.FindById(gid, state)) {
-    return &state->group_;
+  if (!is_oem_id(gid)) {
+    return nullptr;
   }
 
   snprintf(state->group_name_buffer_, sizeof(state->group_name_buffer_),
@@ -477,7 +494,7 @@
       snprintf(state->dir_buffer_, sizeof(state->dir_buffer_), "/data");
   }
 
-  snprintf(state->sh_buffer_, sizeof(state->sh_buffer_), "/system/bin/sh");
+  snprintf(state->sh_buffer_, sizeof(state->sh_buffer_), "/bin/sh");
 
   passwd* pw = &state->passwd_;
   pw->pw_uid   = uid;
@@ -523,8 +540,8 @@
     return android_iinfo_to_passwd(state, android_id_info);
   }
 
-  if (vendor_passwd.FindByName(login, state)) {
-    if (is_oem_id(state->passwd_.pw_uid)) {
+  for (auto& passwd_file : passwd_files) {
+    if (passwd_file.FindByName(login, state)) {
       return &state->passwd_;
     }
   }
@@ -633,6 +650,22 @@
         state->getpwent_idx++ - start + AID_OEM_RESERVED_2_START, state);
   }
 
+  start = end;
+  end += AID_SYSTEM_EXT_RESERVED_END - AID_SYSTEM_RESERVED_START + 1;
+
+  if (state->getpwent_idx < end) {
+    // No one calls this enough to worry about how inefficient the below is.
+    auto* oem_passwd =
+        oem_id_to_passwd(state->getpwent_idx++ - start + AID_SYSTEM_RESERVED_START, state);
+    while (oem_passwd == nullptr && state->getpwent_idx < end) {
+      oem_passwd =
+          oem_id_to_passwd(state->getpwent_idx++ - start + AID_SYSTEM_RESERVED_START, state);
+    }
+    if (oem_passwd != nullptr) {
+      return oem_passwd;
+    }
+  }
+
   state->getpwent_idx = get_next_app_id(state->getpwent_idx, false);
 
   if (state->getpwent_idx != -1) {
@@ -666,8 +699,8 @@
     return android_iinfo_to_group(state, android_id_info);
   }
 
-  if (vendor_group.FindByName(name, state)) {
-    if (is_oem_id(state->group_.gr_gid)) {
+  for (auto& group_file : group_files) {
+    if (group_file.FindByName(name, state)) {
       return &state->group_;
     }
   }
@@ -754,6 +787,22 @@
   }
 
   start = end;
+  end += AID_SYSTEM_EXT_RESERVED_END - AID_SYSTEM_RESERVED_START + 1;
+
+  if (state->getgrent_idx < end) {
+    // No one calls this enough to worry about how inefficient the below is.
+    init_group_state(state);
+    auto* oem_group =
+        oem_id_to_group(state->getgrent_idx++ - start + AID_SYSTEM_RESERVED_START, state);
+    while (oem_group == nullptr && state->getgrent_idx < end) {
+      oem_group = oem_id_to_group(state->getgrent_idx++ - start + AID_SYSTEM_RESERVED_START, state);
+    }
+    if (oem_group != nullptr) {
+      return oem_group;
+    }
+  }
+
+  start = end;
   end += AID_USER_OFFSET - AID_APP_START; // Do not expose higher groups
 
   state->getgrent_idx = get_next_app_id(state->getgrent_idx, true);
diff --git a/libc/bionic/grp_pwd_file.cpp b/libc/bionic/grp_pwd_file.cpp
index 201c9d0..e13604e 100644
--- a/libc/bionic/grp_pwd_file.cpp
+++ b/libc/bionic/grp_pwd_file.cpp
@@ -270,8 +270,8 @@
 
   while (line_beginning < end) {
     line_beginning = ParseLine(line_beginning, end, line->fields, line->kNumFields);
-    // To comply with Treble, users/groups from the vendor partition need to be prefixed with
-    // vendor_.
+    // To comply with Treble, users/groups from each partition need to be prefixed with
+    // the partition name.
     if (required_prefix_ != nullptr) {
       if (strncmp(line->fields[0], required_prefix_, strlen(required_prefix_)) != 0) {
         char name[kGrpPwdBufferSize];
diff --git a/libc/bionic/jemalloc.h b/libc/bionic/jemalloc.h
index b9a4e99..ef77c9c 100644
--- a/libc/bionic/jemalloc.h
+++ b/libc/bionic/jemalloc.h
@@ -30,7 +30,7 @@
 
 void* je_aligned_alloc_wrapper(size_t, size_t);
 int je_iterate(uintptr_t, size_t, void (*)(uintptr_t, size_t, void*), void*);
-int je_mallctl(const char *name, void *oldp, size_t *oldlenp, void *newp, size_t newlen);
+int je_mallctl(const char *name, void *oldp, size_t *oldlenp, void *newp, size_t newlen) __attribute__((nothrow));
 struct mallinfo je_mallinfo();
 void je_malloc_disable();
 void je_malloc_enable();
diff --git a/libc/include/android/legacy_signal_inlines.h b/libc/include/android/legacy_signal_inlines.h
index 5ca9813..d2c7677 100644
--- a/libc/include/android/legacy_signal_inlines.h
+++ b/libc/include/android/legacy_signal_inlines.h
@@ -52,7 +52,7 @@
 
 static __inline int __ndk_legacy___libc_current_sigrtmin() {
   if (__libc_current_sigrtmin) return __libc_current_sigrtmin();
-  return __SIGRTMIN + 6; /* Should match __libc_current_sigrtmin. */
+  return __SIGRTMIN + 7; /* Should match __libc_current_sigrtmin. */
 }
 
 #undef SIGRTMAX
diff --git a/libc/include/bits/stdatomic.h b/libc/include/bits/stdatomic.h
new file mode 100644
index 0000000..633cb86
--- /dev/null
+++ b/libc/include/bits/stdatomic.h
@@ -0,0 +1,286 @@
+/*-
+ * Copyright (c) 2011 Ed Schouten <ed@FreeBSD.org>
+ *                    David Chisnall <theraven@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#pragma once
+
+#include <sys/cdefs.h>
+#include <sys/types.h>
+#include <stdbool.h>
+
+/*
+ * C: Do it ourselves.
+ * Note that the runtime representation defined here should be compatible
+ * with the C++ one, i.e. an _Atomic(T) needs to contain the same
+ * bits as a T.
+ */
+
+#include <stddef.h>  /* For ptrdiff_t. */
+#include <stdint.h>  /* TODO: don't drag in all the macros, just the types. */
+// Include uchar.h only when available.  Bionic's stdatomic.h is also used for
+// the host (via a copy in prebuilts/clang) and uchar.h is not available in the
+// glibc used for the host.
+#if defined(__BIONIC__)
+# include <uchar.h>  /* For char16_t and char32_t.              */
+#endif
+
+/*
+ * 7.17.1 Atomic lock-free macros.
+ */
+
+#ifdef __GCC_ATOMIC_BOOL_LOCK_FREE
+#define	ATOMIC_BOOL_LOCK_FREE		__GCC_ATOMIC_BOOL_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_CHAR_LOCK_FREE
+#define	ATOMIC_CHAR_LOCK_FREE		__GCC_ATOMIC_CHAR_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_CHAR16_T_LOCK_FREE
+#define	ATOMIC_CHAR16_T_LOCK_FREE	__GCC_ATOMIC_CHAR16_T_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_CHAR32_T_LOCK_FREE
+#define	ATOMIC_CHAR32_T_LOCK_FREE	__GCC_ATOMIC_CHAR32_T_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_WCHAR_T_LOCK_FREE
+#define	ATOMIC_WCHAR_T_LOCK_FREE	__GCC_ATOMIC_WCHAR_T_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_SHORT_LOCK_FREE
+#define	ATOMIC_SHORT_LOCK_FREE		__GCC_ATOMIC_SHORT_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_INT_LOCK_FREE
+#define	ATOMIC_INT_LOCK_FREE		__GCC_ATOMIC_INT_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_LONG_LOCK_FREE
+#define	ATOMIC_LONG_LOCK_FREE		__GCC_ATOMIC_LONG_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_LLONG_LOCK_FREE
+#define	ATOMIC_LLONG_LOCK_FREE		__GCC_ATOMIC_LLONG_LOCK_FREE
+#endif
+#ifdef __GCC_ATOMIC_POINTER_LOCK_FREE
+#define	ATOMIC_POINTER_LOCK_FREE	__GCC_ATOMIC_POINTER_LOCK_FREE
+#endif
+
+/*
+ * 7.17.2 Initialization.
+ */
+
+#define	ATOMIC_VAR_INIT(value)		(value)
+#define	atomic_init(obj, value)		__c11_atomic_init(obj, value)
+
+/*
+ * Clang and recent GCC both provide predefined macros for the memory
+ * orderings.  If we are using a compiler that doesn't define them, use the
+ * clang values - these will be ignored in the fallback path.
+ */
+
+#ifndef __ATOMIC_RELAXED
+#define __ATOMIC_RELAXED		0
+#endif
+#ifndef __ATOMIC_CONSUME
+#define __ATOMIC_CONSUME		1
+#endif
+#ifndef __ATOMIC_ACQUIRE
+#define __ATOMIC_ACQUIRE		2
+#endif
+#ifndef __ATOMIC_RELEASE
+#define __ATOMIC_RELEASE		3
+#endif
+#ifndef __ATOMIC_ACQ_REL
+#define __ATOMIC_ACQ_REL		4
+#endif
+#ifndef __ATOMIC_SEQ_CST
+#define __ATOMIC_SEQ_CST		5
+#endif
+
+/*
+ * 7.17.3 Order and consistency.
+ *
+ * The memory_order_* constants that denote the barrier behaviour of the
+ * atomic operations.
+ * The enum values must be identical to those used by the
+ * C++ <atomic> header.
+ */
+
+typedef enum {
+	memory_order_relaxed = __ATOMIC_RELAXED,
+	memory_order_consume = __ATOMIC_CONSUME,
+	memory_order_acquire = __ATOMIC_ACQUIRE,
+	memory_order_release = __ATOMIC_RELEASE,
+	memory_order_acq_rel = __ATOMIC_ACQ_REL,
+	memory_order_seq_cst = __ATOMIC_SEQ_CST
+} memory_order;
+
+/*
+ * 7.17.4 Fences.
+ */
+
+static __inline void atomic_thread_fence(memory_order __order __attribute__((unused))) {
+	__c11_atomic_thread_fence(__order);
+}
+
+static __inline void atomic_signal_fence(memory_order __order __attribute__((unused))) {
+	__c11_atomic_signal_fence(__order);
+}
+
+/*
+ * 7.17.5 Lock-free property.
+ */
+
+#define	atomic_is_lock_free(obj) __c11_atomic_is_lock_free(sizeof(*(obj)))
+
+/*
+ * 7.17.6 Atomic integer types.
+ */
+
+typedef _Atomic(bool)			atomic_bool;
+typedef _Atomic(char)			atomic_char;
+typedef _Atomic(signed char)		atomic_schar;
+typedef _Atomic(unsigned char)		atomic_uchar;
+typedef _Atomic(short)			atomic_short;
+typedef _Atomic(unsigned short)		atomic_ushort;
+typedef _Atomic(int)			atomic_int;
+typedef _Atomic(unsigned int)		atomic_uint;
+typedef _Atomic(long)			atomic_long;
+typedef _Atomic(unsigned long)		atomic_ulong;
+typedef _Atomic(long long)		atomic_llong;
+typedef _Atomic(unsigned long long)	atomic_ullong;
+#if defined(__BIONIC__) || (defined(__cplusplus) && __cplusplus >= 201103L)
+  typedef _Atomic(char16_t)		atomic_char16_t;
+  typedef _Atomic(char32_t)		atomic_char32_t;
+#endif
+typedef _Atomic(wchar_t)		atomic_wchar_t;
+typedef _Atomic(int_least8_t)		atomic_int_least8_t;
+typedef _Atomic(uint_least8_t)	atomic_uint_least8_t;
+typedef _Atomic(int_least16_t)	atomic_int_least16_t;
+typedef _Atomic(uint_least16_t)	atomic_uint_least16_t;
+typedef _Atomic(int_least32_t)	atomic_int_least32_t;
+typedef _Atomic(uint_least32_t)	atomic_uint_least32_t;
+typedef _Atomic(int_least64_t)	atomic_int_least64_t;
+typedef _Atomic(uint_least64_t)	atomic_uint_least64_t;
+typedef _Atomic(int_fast8_t)		atomic_int_fast8_t;
+typedef _Atomic(uint_fast8_t)		atomic_uint_fast8_t;
+typedef _Atomic(int_fast16_t)		atomic_int_fast16_t;
+typedef _Atomic(uint_fast16_t)	atomic_uint_fast16_t;
+typedef _Atomic(int_fast32_t)		atomic_int_fast32_t;
+typedef _Atomic(uint_fast32_t)	atomic_uint_fast32_t;
+typedef _Atomic(int_fast64_t)		atomic_int_fast64_t;
+typedef _Atomic(uint_fast64_t)	atomic_uint_fast64_t;
+typedef _Atomic(intptr_t)		atomic_intptr_t;
+typedef _Atomic(uintptr_t)		atomic_uintptr_t;
+typedef _Atomic(size_t)		atomic_size_t;
+typedef _Atomic(ptrdiff_t)		atomic_ptrdiff_t;
+typedef _Atomic(intmax_t)		atomic_intmax_t;
+typedef _Atomic(uintmax_t)		atomic_uintmax_t;
+
+/*
+ * 7.17.7 Operations on atomic types.
+ */
+
+/*
+ * Compiler-specific operations.
+ */
+
+#define	atomic_compare_exchange_strong_explicit(object, expected,	\
+    desired, success, failure)						\
+	__c11_atomic_compare_exchange_strong(object, expected, desired,	\
+	    success, failure)
+#define	atomic_compare_exchange_weak_explicit(object, expected,		\
+    desired, success, failure)						\
+	__c11_atomic_compare_exchange_weak(object, expected, desired,	\
+	    success, failure)
+#define	atomic_exchange_explicit(object, desired, order)		\
+	__c11_atomic_exchange(object, desired, order)
+#define	atomic_fetch_add_explicit(object, operand, order)		\
+	__c11_atomic_fetch_add(object, operand, order)
+#define	atomic_fetch_and_explicit(object, operand, order)		\
+	__c11_atomic_fetch_and(object, operand, order)
+#define	atomic_fetch_or_explicit(object, operand, order)		\
+	__c11_atomic_fetch_or(object, operand, order)
+#define	atomic_fetch_sub_explicit(object, operand, order)		\
+	__c11_atomic_fetch_sub(object, operand, order)
+#define	atomic_fetch_xor_explicit(object, operand, order)		\
+	__c11_atomic_fetch_xor(object, operand, order)
+#define	atomic_load_explicit(object, order)				\
+	__c11_atomic_load(object, order)
+#define	atomic_store_explicit(object, desired, order)			\
+	__c11_atomic_store(object, desired, order)
+
+/*
+ * Convenience functions.
+ */
+
+#define	atomic_compare_exchange_strong(object, expected, desired)	\
+	atomic_compare_exchange_strong_explicit(object, expected,	\
+	    desired, memory_order_seq_cst, memory_order_seq_cst)
+#define	atomic_compare_exchange_weak(object, expected, desired)		\
+	atomic_compare_exchange_weak_explicit(object, expected,		\
+	    desired, memory_order_seq_cst, memory_order_seq_cst)
+#define	atomic_exchange(object, desired)				\
+	atomic_exchange_explicit(object, desired, memory_order_seq_cst)
+#define	atomic_fetch_add(object, operand)				\
+	atomic_fetch_add_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_and(object, operand)				\
+	atomic_fetch_and_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_or(object, operand)				\
+	atomic_fetch_or_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_sub(object, operand)				\
+	atomic_fetch_sub_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_fetch_xor(object, operand)				\
+	atomic_fetch_xor_explicit(object, operand, memory_order_seq_cst)
+#define	atomic_load(object)						\
+	atomic_load_explicit(object, memory_order_seq_cst)
+#define	atomic_store(object, desired)					\
+	atomic_store_explicit(object, desired, memory_order_seq_cst)
+
+/*
+ * 7.17.8 Atomic flag type and operations.
+ *
+ * XXX: Assume atomic_bool can be used as an atomic_flag. Is there some
+ * kind of compiler built-in type we could use?
+ */
+
+typedef struct {
+	atomic_bool	__flag;
+} atomic_flag;
+
+#define	ATOMIC_FLAG_INIT		{ ATOMIC_VAR_INIT(false) }
+
+static __inline bool atomic_flag_test_and_set_explicit(volatile atomic_flag *__object, memory_order __order) {
+	return (atomic_exchange_explicit(&__object->__flag, 1, __order));
+}
+
+static __inline void atomic_flag_clear_explicit(volatile atomic_flag *__object, memory_order __order) {
+	atomic_store_explicit(&__object->__flag, 0, __order);
+}
+
+static __inline bool atomic_flag_test_and_set(volatile atomic_flag *__object) {
+	return (atomic_flag_test_and_set_explicit(__object, memory_order_seq_cst));
+}
+
+static __inline void atomic_flag_clear(volatile atomic_flag *__object) {
+	atomic_flag_clear_explicit(__object, memory_order_seq_cst);
+}
diff --git a/libc/include/stdatomic.h b/libc/include/stdatomic.h
index 3c61334..b7dac4a 100644
--- a/libc/include/stdatomic.h
+++ b/libc/include/stdatomic.h
@@ -32,7 +32,7 @@
 
 #include <sys/cdefs.h>
 
-#if defined(__cplusplus) && __cplusplus >= 201103L && defined(_USING_LIBCXX)
+#if defined(__cplusplus) && __cplusplus >= 201103L && __has_include(<atomic>)
 # if __has_feature(cxx_atomic)
 #  define _STDATOMIC_HAVE_ATOMIC
 # endif
@@ -127,260 +127,8 @@
 
 #else /* <atomic> unavailable, possibly because this is C, not C++ */
 
-#include <sys/types.h>
-#include <stdbool.h>
-
-/*
- * C: Do it ourselves.
- * Note that the runtime representation defined here should be compatible
- * with the C++ one, i.e. an _Atomic(T) needs to contain the same
- * bits as a T.
- */
-
-#include <stddef.h>  /* For ptrdiff_t. */
-#include <stdint.h>  /* TODO: don't drag in all the macros, just the types. */
-// Include uchar.h only when available.  Bionic's stdatomic.h is also used for
-// the host (via a copy in prebuilts/clang) and uchar.h is not available in the
-// glibc used for the host.
-#if defined(__BIONIC__)
-# include <uchar.h>  /* For char16_t and char32_t.              */
-#endif
-
-/*
- * 7.17.1 Atomic lock-free macros.
- */
-
-#ifdef __GCC_ATOMIC_BOOL_LOCK_FREE
-#define	ATOMIC_BOOL_LOCK_FREE		__GCC_ATOMIC_BOOL_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_CHAR_LOCK_FREE
-#define	ATOMIC_CHAR_LOCK_FREE		__GCC_ATOMIC_CHAR_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_CHAR16_T_LOCK_FREE
-#define	ATOMIC_CHAR16_T_LOCK_FREE	__GCC_ATOMIC_CHAR16_T_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_CHAR32_T_LOCK_FREE
-#define	ATOMIC_CHAR32_T_LOCK_FREE	__GCC_ATOMIC_CHAR32_T_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_WCHAR_T_LOCK_FREE
-#define	ATOMIC_WCHAR_T_LOCK_FREE	__GCC_ATOMIC_WCHAR_T_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_SHORT_LOCK_FREE
-#define	ATOMIC_SHORT_LOCK_FREE		__GCC_ATOMIC_SHORT_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_INT_LOCK_FREE
-#define	ATOMIC_INT_LOCK_FREE		__GCC_ATOMIC_INT_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_LONG_LOCK_FREE
-#define	ATOMIC_LONG_LOCK_FREE		__GCC_ATOMIC_LONG_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_LLONG_LOCK_FREE
-#define	ATOMIC_LLONG_LOCK_FREE		__GCC_ATOMIC_LLONG_LOCK_FREE
-#endif
-#ifdef __GCC_ATOMIC_POINTER_LOCK_FREE
-#define	ATOMIC_POINTER_LOCK_FREE	__GCC_ATOMIC_POINTER_LOCK_FREE
-#endif
-
-/*
- * 7.17.2 Initialization.
- */
-
-#define	ATOMIC_VAR_INIT(value)		(value)
-#define	atomic_init(obj, value)		__c11_atomic_init(obj, value)
-
-/*
- * Clang and recent GCC both provide predefined macros for the memory
- * orderings.  If we are using a compiler that doesn't define them, use the
- * clang values - these will be ignored in the fallback path.
- */
-
-#ifndef __ATOMIC_RELAXED
-#define __ATOMIC_RELAXED		0
-#endif
-#ifndef __ATOMIC_CONSUME
-#define __ATOMIC_CONSUME		1
-#endif
-#ifndef __ATOMIC_ACQUIRE
-#define __ATOMIC_ACQUIRE		2
-#endif
-#ifndef __ATOMIC_RELEASE
-#define __ATOMIC_RELEASE		3
-#endif
-#ifndef __ATOMIC_ACQ_REL
-#define __ATOMIC_ACQ_REL		4
-#endif
-#ifndef __ATOMIC_SEQ_CST
-#define __ATOMIC_SEQ_CST		5
-#endif
-
-/*
- * 7.17.3 Order and consistency.
- *
- * The memory_order_* constants that denote the barrier behaviour of the
- * atomic operations.
- * The enum values must be identical to those used by the
- * C++ <atomic> header.
- */
-
-typedef enum {
-	memory_order_relaxed = __ATOMIC_RELAXED,
-	memory_order_consume = __ATOMIC_CONSUME,
-	memory_order_acquire = __ATOMIC_ACQUIRE,
-	memory_order_release = __ATOMIC_RELEASE,
-	memory_order_acq_rel = __ATOMIC_ACQ_REL,
-	memory_order_seq_cst = __ATOMIC_SEQ_CST
-} memory_order;
-
-/*
- * 7.17.4 Fences.
- */
-
-static __inline void atomic_thread_fence(memory_order __order __attribute__((unused))) {
-	__c11_atomic_thread_fence(__order);
-}
-
-static __inline void atomic_signal_fence(memory_order __order __attribute__((unused))) {
-	__c11_atomic_signal_fence(__order);
-}
-
-/*
- * 7.17.5 Lock-free property.
- */
-
-#define	atomic_is_lock_free(obj) __c11_atomic_is_lock_free(sizeof(*(obj)))
-
-/*
- * 7.17.6 Atomic integer types.
- */
-
-typedef _Atomic(bool)			atomic_bool;
-typedef _Atomic(char)			atomic_char;
-typedef _Atomic(signed char)		atomic_schar;
-typedef _Atomic(unsigned char)		atomic_uchar;
-typedef _Atomic(short)			atomic_short;
-typedef _Atomic(unsigned short)		atomic_ushort;
-typedef _Atomic(int)			atomic_int;
-typedef _Atomic(unsigned int)		atomic_uint;
-typedef _Atomic(long)			atomic_long;
-typedef _Atomic(unsigned long)		atomic_ulong;
-typedef _Atomic(long long)		atomic_llong;
-typedef _Atomic(unsigned long long)	atomic_ullong;
-#if defined(__BIONIC__) || (defined(__cplusplus) && __cplusplus >= 201103L)
-  typedef _Atomic(char16_t)		atomic_char16_t;
-  typedef _Atomic(char32_t)		atomic_char32_t;
-#endif
-typedef _Atomic(wchar_t)		atomic_wchar_t;
-typedef _Atomic(int_least8_t)		atomic_int_least8_t;
-typedef _Atomic(uint_least8_t)	atomic_uint_least8_t;
-typedef _Atomic(int_least16_t)	atomic_int_least16_t;
-typedef _Atomic(uint_least16_t)	atomic_uint_least16_t;
-typedef _Atomic(int_least32_t)	atomic_int_least32_t;
-typedef _Atomic(uint_least32_t)	atomic_uint_least32_t;
-typedef _Atomic(int_least64_t)	atomic_int_least64_t;
-typedef _Atomic(uint_least64_t)	atomic_uint_least64_t;
-typedef _Atomic(int_fast8_t)		atomic_int_fast8_t;
-typedef _Atomic(uint_fast8_t)		atomic_uint_fast8_t;
-typedef _Atomic(int_fast16_t)		atomic_int_fast16_t;
-typedef _Atomic(uint_fast16_t)	atomic_uint_fast16_t;
-typedef _Atomic(int_fast32_t)		atomic_int_fast32_t;
-typedef _Atomic(uint_fast32_t)	atomic_uint_fast32_t;
-typedef _Atomic(int_fast64_t)		atomic_int_fast64_t;
-typedef _Atomic(uint_fast64_t)	atomic_uint_fast64_t;
-typedef _Atomic(intptr_t)		atomic_intptr_t;
-typedef _Atomic(uintptr_t)		atomic_uintptr_t;
-typedef _Atomic(size_t)		atomic_size_t;
-typedef _Atomic(ptrdiff_t)		atomic_ptrdiff_t;
-typedef _Atomic(intmax_t)		atomic_intmax_t;
-typedef _Atomic(uintmax_t)		atomic_uintmax_t;
-
-/*
- * 7.17.7 Operations on atomic types.
- */
-
-/*
- * Compiler-specific operations.
- */
-
-#define	atomic_compare_exchange_strong_explicit(object, expected,	\
-    desired, success, failure)						\
-	__c11_atomic_compare_exchange_strong(object, expected, desired,	\
-	    success, failure)
-#define	atomic_compare_exchange_weak_explicit(object, expected,		\
-    desired, success, failure)						\
-	__c11_atomic_compare_exchange_weak(object, expected, desired,	\
-	    success, failure)
-#define	atomic_exchange_explicit(object, desired, order)		\
-	__c11_atomic_exchange(object, desired, order)
-#define	atomic_fetch_add_explicit(object, operand, order)		\
-	__c11_atomic_fetch_add(object, operand, order)
-#define	atomic_fetch_and_explicit(object, operand, order)		\
-	__c11_atomic_fetch_and(object, operand, order)
-#define	atomic_fetch_or_explicit(object, operand, order)		\
-	__c11_atomic_fetch_or(object, operand, order)
-#define	atomic_fetch_sub_explicit(object, operand, order)		\
-	__c11_atomic_fetch_sub(object, operand, order)
-#define	atomic_fetch_xor_explicit(object, operand, order)		\
-	__c11_atomic_fetch_xor(object, operand, order)
-#define	atomic_load_explicit(object, order)				\
-	__c11_atomic_load(object, order)
-#define	atomic_store_explicit(object, desired, order)			\
-	__c11_atomic_store(object, desired, order)
-
-/*
- * Convenience functions.
- */
-
-#define	atomic_compare_exchange_strong(object, expected, desired)	\
-	atomic_compare_exchange_strong_explicit(object, expected,	\
-	    desired, memory_order_seq_cst, memory_order_seq_cst)
-#define	atomic_compare_exchange_weak(object, expected, desired)		\
-	atomic_compare_exchange_weak_explicit(object, expected,		\
-	    desired, memory_order_seq_cst, memory_order_seq_cst)
-#define	atomic_exchange(object, desired)				\
-	atomic_exchange_explicit(object, desired, memory_order_seq_cst)
-#define	atomic_fetch_add(object, operand)				\
-	atomic_fetch_add_explicit(object, operand, memory_order_seq_cst)
-#define	atomic_fetch_and(object, operand)				\
-	atomic_fetch_and_explicit(object, operand, memory_order_seq_cst)
-#define	atomic_fetch_or(object, operand)				\
-	atomic_fetch_or_explicit(object, operand, memory_order_seq_cst)
-#define	atomic_fetch_sub(object, operand)				\
-	atomic_fetch_sub_explicit(object, operand, memory_order_seq_cst)
-#define	atomic_fetch_xor(object, operand)				\
-	atomic_fetch_xor_explicit(object, operand, memory_order_seq_cst)
-#define	atomic_load(object)						\
-	atomic_load_explicit(object, memory_order_seq_cst)
-#define	atomic_store(object, desired)					\
-	atomic_store_explicit(object, desired, memory_order_seq_cst)
-
-/*
- * 7.17.8 Atomic flag type and operations.
- *
- * XXX: Assume atomic_bool can be used as an atomic_flag. Is there some
- * kind of compiler built-in type we could use?
- */
-
-typedef struct {
-	atomic_bool	__flag;
-} atomic_flag;
-
-#define	ATOMIC_FLAG_INIT		{ ATOMIC_VAR_INIT(false) }
-
-static __inline bool atomic_flag_test_and_set_explicit(volatile atomic_flag *__object, memory_order __order) {
-	return (atomic_exchange_explicit(&__object->__flag, 1, __order));
-}
-
-static __inline void atomic_flag_clear_explicit(volatile atomic_flag *__object, memory_order __order) {
-	atomic_store_explicit(&__object->__flag, 0, __order);
-}
-
-static __inline bool atomic_flag_test_and_set(volatile atomic_flag *__object) {
-	return (atomic_flag_test_and_set_explicit(__object, memory_order_seq_cst));
-}
-
-static __inline void atomic_flag_clear(volatile atomic_flag *__object) {
-	atomic_flag_clear_explicit(__object, memory_order_seq_cst);
-}
+/* Actual implementation is in bits/stdatomic.h since our test code is C++. */
+#include <bits/stdatomic.h>
 
 #endif /* <atomic> unavailable */
 
diff --git a/libc/malloc_debug/Android.bp b/libc/malloc_debug/Android.bp
index aae16f1..d6b8531 100644
--- a/libc/malloc_debug/Android.bp
+++ b/libc/malloc_debug/Android.bp
@@ -16,7 +16,6 @@
     whole_static_libs: [
         "libbase",
         "libasync_safe",
-        "libdemangle",
     ],
 
     include_dirs: ["bionic/libc"],
@@ -66,7 +65,6 @@
     static_libs: [
         "libasync_safe",
         "libbase",
-        "libdemangle",
         "libc_malloc_debug_backtrace",
     ],
 
@@ -122,7 +120,6 @@
 
     static_libs: [
         "libc_malloc_debug",
-        "libdemangle",
         "libtinyxml2",
     ],
 
diff --git a/libc/malloc_debug/PointerData.cpp b/libc/malloc_debug/PointerData.cpp
index 617d128..ec7e42d 100644
--- a/libc/malloc_debug/PointerData.cpp
+++ b/libc/malloc_debug/PointerData.cpp
@@ -43,7 +43,6 @@
 
 #include <android-base/stringprintf.h>
 #include <android-base/thread_annotations.h>
-#include <demangle.h>
 #include <private/bionic_macros.h>
 
 #include "Config.h"
@@ -54,6 +53,8 @@
 #include "malloc_debug.h"
 #include "UnwindBacktrace.h"
 
+extern "C" char* __cxa_demangle(const char*, char*, size_t*, int*);
+
 std::atomic_uint8_t PointerData::backtrace_enabled_;
 std::atomic_bool PointerData::backtrace_dump_;
 
@@ -596,7 +597,16 @@
         if (frame.function_name.empty()) {
           fprintf(fp, " \"\" 0}");
         } else {
-          fprintf(fp, " \"%s\" %" PRIx64 "}", demangle(frame.function_name.c_str()).c_str(), frame.function_offset);
+          char* demangled_name = __cxa_demangle(frame.function_name.c_str(), nullptr, nullptr,
+                                                nullptr);
+          const char* name;
+          if (demangled_name != nullptr) {
+            name = demangled_name;
+          } else {
+            name = frame.function_name.c_str();
+          }
+          fprintf(fp, " \"%s\" %" PRIx64 "}", name, frame.function_offset);
+          free(demangled_name);
         }
       }
       fprintf(fp, "\n");
diff --git a/libc/malloc_debug/UnwindBacktrace.cpp b/libc/malloc_debug/UnwindBacktrace.cpp
index ddafc73..92fb3fa 100644
--- a/libc/malloc_debug/UnwindBacktrace.cpp
+++ b/libc/malloc_debug/UnwindBacktrace.cpp
@@ -36,7 +36,6 @@
 #include <vector>
 
 #include <android-base/stringprintf.h>
-#include <demangle.h>
 #include <unwindstack/LocalUnwinder.h>
 #include <unwindstack/MapInfo.h>
 
@@ -49,6 +48,8 @@
 #define PAD_PTR "08" PRIx64
 #endif
 
+extern "C" char* __cxa_demangle(const char*, char*, size_t*, int*);
+
 static pthread_once_t g_setup_once = PTHREAD_ONCE_INIT;
 
 static unwindstack::LocalUnwinder* g_unwinder;
@@ -100,7 +101,14 @@
     }
 
     if (!info->function_name.empty()) {
-      line += " (" + demangle(info->function_name.c_str());
+      line += " (";
+      char* demangled_name = __cxa_demangle(info->function_name.c_str(), nullptr, nullptr, nullptr);
+      if (demangled_name != nullptr) {
+        line += demangled_name;
+        free(demangled_name);
+      } else {
+        line += info->function_name;
+      }
       if (info->function_offset != 0) {
         line += "+" + std::to_string(info->function_offset);
       }
diff --git a/libc/malloc_debug/backtrace.cpp b/libc/malloc_debug/backtrace.cpp
index 0e3a53f..ab5c505 100644
--- a/libc/malloc_debug/backtrace.cpp
+++ b/libc/malloc_debug/backtrace.cpp
@@ -36,8 +36,6 @@
 #include <unistd.h>
 #include <unwind.h>
 
-#include <demangle.h>
-
 #include "MapData.h"
 #include "backtrace.h"
 #include "debug_log.h"
@@ -164,10 +162,18 @@
 
     char buf[1024];
     if (symbol != nullptr) {
+      char* demangled_name = __cxa_demangle(symbol, nullptr, nullptr, nullptr);
+      const char* name;
+      if (demangled_name != nullptr) {
+        name = demangled_name;
+      } else {
+        name = symbol;
+      }
       async_safe_format_buffer(buf, sizeof(buf),
                                "          #%02zd  pc %" PAD_PTR "  %s%s (%s+%" PRIuPTR ")\n",
-                               frame_num, rel_pc, soname, offset_buf, demangle(symbol).c_str(),
+                               frame_num, rel_pc, soname, offset_buf, name,
                                frames[frame_num] - offset);
+      free(demangled_name);
     } else {
       async_safe_format_buffer(buf, sizeof(buf), "          #%02zd  pc %" PAD_PTR "  %s%s\n",
                                frame_num, rel_pc, soname, offset_buf);
diff --git a/libc/private/sigrtmin.h b/libc/private/sigrtmin.h
index d78d980..5de1a32 100644
--- a/libc/private/sigrtmin.h
+++ b/libc/private/sigrtmin.h
@@ -39,13 +39,14 @@
 //   33 (__SIGRTMIN + 1)        libbacktrace
 //   34 (__SIGRTMIN + 2)        libcore
 //   35 (__SIGRTMIN + 3)        debuggerd -b
-//   36 (__SIGRTMIN + 4)        heapprofd
+//   36 (__SIGRTMIN + 4)        heapprofd native dumps
 //   37 (__SIGRTMIN + 5)        coverage (libprofile-extras)
+//   38 (__SIGRTMIN + 6)        heapprofd ART managed heap dumps
 //
 // If you change this, also change __ndk_legacy___libc_current_sigrtmin
 // in <android/legacy_signal_inlines.h> to match.
 
-#define __SIGRT_RESERVED 6
+#define __SIGRT_RESERVED 7
 static inline __always_inline sigset64_t filter_reserved_signals(sigset64_t sigset, int how) {
   int (*block)(sigset64_t*, int);
   int (*unblock)(sigset64_t*, int);
@@ -72,5 +73,6 @@
   unblock(&sigset, __SIGRTMIN + 3);
   unblock(&sigset, __SIGRTMIN + 4);
   unblock(&sigset, __SIGRTMIN + 5);
+  unblock(&sigset, __SIGRTMIN + 6);
   return sigset;
 }
diff --git a/libc/symbol_ordering b/libc/symbol_ordering
index c04692b..679d461 100644
--- a/libc/symbol_ordering
+++ b/libc/symbol_ordering
@@ -176,8 +176,6 @@
 __sym_ntop.unname
 __sym_ntos.unname
 _ZL10gFunctions
-_ZL12vendor_group
-_ZL13vendor_passwd
 freelist
 __p_option.nbuf
 __p_time.nbuf
diff --git a/tests/grp_pwd_test.cpp b/tests/grp_pwd_test.cpp
index 5b6eed8..6b49e29 100644
--- a/tests/grp_pwd_test.cpp
+++ b/tests/grp_pwd_test.cpp
@@ -75,11 +75,7 @@
     EXPECT_STREQ("/", pwd->pw_dir);
   }
 
-  if (uid_type == TYPE_VENDOR) {
-    EXPECT_STREQ("/vendor/bin/sh", pwd->pw_shell);
-  } else {
-    EXPECT_STREQ("/system/bin/sh", pwd->pw_shell);
-  }
+  EXPECT_STREQ("/bin/sh", pwd->pw_shell);
 }
 
 static void check_getpwuid(const char* username, uid_t uid, uid_type_t uid_type,
@@ -382,7 +378,7 @@
 
 #if defined(__BIONIC__)
 template <typename T>
-static void expect_ids(const T& ids, bool is_group) {
+static void expect_ids(T ids, bool is_group) {
   std::set<typename T::key_type> expected_ids;
   // Ensure that all android_ids are iterated through.
   for (size_t n = 0; n < android_id_count; ++n) {
@@ -415,6 +411,14 @@
     return;
   }
 
+  auto allow_range = [&ids](uid_t start, uid_t end) {
+    for (size_t n = start; n <= end; ++n) {
+      ids.erase(n);
+    }
+  };
+
+  allow_range(AID_SYSTEM_RESERVED_START, AID_SYSTEM_EXT_RESERVED_END);
+
   // Ensure that no other ids were returned.
   auto return_differences = [&ids, &expected_ids] {
     std::vector<typename T::key_type> missing_from_ids;
diff --git a/tests/stdatomic_test.cpp b/tests/stdatomic_test.cpp
index d122d2f..a9665d1 100644
--- a/tests/stdatomic_test.cpp
+++ b/tests/stdatomic_test.cpp
@@ -15,9 +15,14 @@
  */
 
 #include <gtest/gtest.h>
-// Fool stdatomic.h into not using <atomic>.
-#undef _USING_LIBCXX
+
+#if defined(__ANDROID__)
+#include <bits/stdatomic.h>
+#else
+#undef _USING_LIBCXX  //TODO(b/137876753): Remove this
 #include <stdatomic.h>
+#endif
+
 #include <pthread.h>
 #include <stdint.h>