Merge "Add doc for sentinel change in preinit_array/init_array/fini_array" into main
diff --git a/docs/status.md b/docs/status.md
index ad7e1c5..3c5d1ba 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -64,7 +64,7 @@
     multi-threaded C).
   * `mbsrtowcs_l` and `wcsrtombs_l` aliases for `mbsrtowcs` and `wcsrtombs`.
   * New system call wrappers: `__riscv_flush_icache` (`<sys/cachectl.h>`),
-    `__riscv_hwprobe` (`<sys/hwprobe.h>`).
+    `__riscv_hwprobe` (`<sys/hwprobe.h>`), `epoll_pwait2`/`epoll_pwait2_64` (`<sys/epoll.h>`).
 
 New libc behavior in V (API level 35):
   * Added `LD_SHOW_AUXV` to the dynamic linker to dump the ELF auxiliary
diff --git a/libc/SECCOMP_ALLOWLIST_COMMON.TXT b/libc/SECCOMP_ALLOWLIST_COMMON.TXT
index aba8303..1d58475 100644
--- a/libc/SECCOMP_ALLOWLIST_COMMON.TXT
+++ b/libc/SECCOMP_ALLOWLIST_COMMON.TXT
@@ -11,7 +11,7 @@
 # Syscalls used internally by bionic, but not exposed directly.
 pid_t	gettid()	all
 int	futex(int*, int, int, const timespec*, int*, int)	all
-int	clone(int (*)(void*), void*, int, void*, ...) all
+pid_t	clone(int (*)(void*), void*, int, void*, ...) all
 int	sigreturn(unsigned long)	lp32
 int	rt_sigreturn(unsigned long)	all
 int	rt_tgsigqueueinfo(pid_t, pid_t, int, siginfo_t*)	all
@@ -77,3 +77,8 @@
 int rt_sigtimedwait_time64(const sigset64_t*, siginfo_t*, const timespec64*, size_t) lp32
 int futex_time64(int*, int, int, const timespec64*, int*, int) lp32
 int sched_rr_get_interval_time64(pid_t, timespec64*) lp32
+# Since Linux 5.3, not in glibc. Not used by bionic, but increasingly
+# likely to be useful as new features are added. In particular, cgroups
+# support seems potentially useful for Android (though the struct that
+# changes size over time is obviously problematic).
+pid_t clone3(clone_args*, size_t) all
diff --git a/libc/SYSCALLS.TXT b/libc/SYSCALLS.TXT
index e8dde7c..0db5d79 100644
--- a/libc/SYSCALLS.TXT
+++ b/libc/SYSCALLS.TXT
@@ -322,6 +322,7 @@
 int __epoll_create1:epoll_create1(int)  all
 int epoll_ctl(int, int op, int, struct epoll_event*)  all
 int __epoll_pwait:epoll_pwait(int, struct epoll_event*, int, int, const sigset64_t*, size_t)  all
+int __epoll_pwait2:epoll_pwait2(int, struct epoll_event*, int, const timespec64*, const sigset64_t*, size_t)  all
 
 int __eventfd:eventfd2(unsigned int, int)  all
 
diff --git a/libc/bionic/sys_epoll.cpp b/libc/bionic/sys_epoll.cpp
index cffa173..be97818 100644
--- a/libc/bionic/sys_epoll.cpp
+++ b/libc/bionic/sys_epoll.cpp
@@ -34,6 +34,8 @@
 
 extern "C" int __epoll_create1(int flags);
 extern "C" int __epoll_pwait(int, epoll_event*, int, int, const sigset64_t*, size_t);
+extern "C" int __epoll_pwait2(int, epoll_event*, int, const __kernel_timespec*, const sigset64_t*,
+                              size_t);
 
 int epoll_create(int size) {
   if (size <= 0) {
@@ -56,6 +58,31 @@
   return __epoll_pwait(fd, events, max_events, timeout, ss, sizeof(*ss));
 }
 
+int epoll_pwait2(int fd, epoll_event* events, int max_events, const timespec* timeout,
+                 const sigset_t* ss) {
+  SigSetConverter set{ss};
+  return epoll_pwait2_64(fd, events, max_events, timeout, set.ptr);
+}
+
+int epoll_pwait2_64(int fd, epoll_event* events, int max_events, const timespec* timeout,
+                    const sigset64_t* ss) {
+  // epoll_pwait2() is our first syscall that assumes a 64-bit time_t even for
+  // 32-bit processes, so for ILP32 we need to convert.
+  // TODO: factor this out into a TimeSpecConverter as/when we get more syscalls like this.
+#if __LP64__
+  const __kernel_timespec* kts_ptr = reinterpret_cast<const __kernel_timespec*>(timeout);
+#else
+  __kernel_timespec kts;
+  const __kernel_timespec* kts_ptr = nullptr;
+  if (timeout) {
+    kts.tv_sec = timeout->tv_sec;
+    kts.tv_nsec = timeout->tv_nsec;
+    kts_ptr = &kts;
+  }
+#endif
+  return __epoll_pwait2(fd, events, max_events, kts_ptr, ss, sizeof(*ss));
+}
+
 int epoll_wait(int fd, struct epoll_event* events, int max_events, int timeout) {
   return epoll_pwait64(fd, events, max_events, timeout, nullptr);
 }
diff --git a/libc/include/sys/epoll.h b/libc/include/sys/epoll.h
index 2091b90..2bad655 100644
--- a/libc/include/sys/epoll.h
+++ b/libc/include/sys/epoll.h
@@ -26,8 +26,12 @@
  * SUCH DAMAGE.
  */
 
-#ifndef _SYS_EPOLL_H_
-#define _SYS_EPOLL_H_
+#pragma once
+
+/**
+ * @file sys/epoll.h
+ * @brief I/O event file descriptors.
+ */
 
 #include <sys/cdefs.h>
 #include <sys/types.h>
@@ -37,14 +41,67 @@
 
 __BEGIN_DECLS
 
+/**
+ * [epoll_create(2)](http://man7.org/linux/man-pages/man2/epoll_create.2.html)
+ * creates a new [epoll](http://man7.org/linux/man-pages/man7/epoll.7.html)
+ * file descriptor.
+ *
+ * Returns a new file descriptor on success and returns -1 and sets `errno` on
+ * failure.
+ */
 int epoll_create(int __size);
+
+/**
+ * [epoll_create1(2)](http://man7.org/linux/man-pages/man2/epoll_create1.2.html)
+ * creates a new [epoll](http://man7.org/linux/man-pages/man7/epoll.7.html)
+ * file descriptor with the given flags.
+ *
+ * Returns a new file descriptor on success and returns -1 and sets `errno` on
+ * failure.
+ */
 int epoll_create1(int __flags);
 
+/**
+ * [epoll_ctl(2)](http://man7.org/linux/man-pages/man2/epoll_ctl.2.html)
+ * adds/modifies/removes file descriptors from the given epoll file descriptor.
+ *
+ * Returns 0 on success and returns -1 and sets `errno` on failure.
+ */
 int epoll_ctl(int __epoll_fd, int __op, int __fd, struct epoll_event* __BIONIC_COMPLICATED_NULLNESS __event);
+
+/**
+ * [epoll_wait(2)](http://man7.org/linux/man-pages/man2/epoll_wait.2.html)
+ * waits for an event on the given epoll file descriptor.
+ *
+ * Returns the number of ready file descriptors on success, 0 on timeout,
+ * or -1 and sets `errno` on failure.
+ */
 int epoll_wait(int __epoll_fd, struct epoll_event* _Nonnull __events, int __event_count, int __timeout_ms);
+
+/**
+ * Like epoll_wait() but atomically applying the given signal mask.
+ */
 int epoll_pwait(int __epoll_fd, struct epoll_event* _Nonnull __events, int __event_count, int __timeout_ms, const sigset_t* _Nullable __mask);
+
+/**
+ * Like epoll_pwait() but using a 64-bit signal mask even on 32-bit systems.
+ *
+ * Available since API level 28.
+ */
 int epoll_pwait64(int __epoll_fd, struct epoll_event* _Nonnull __events, int __event_count, int __timeout_ms, const sigset64_t* _Nullable __mask) __INTRODUCED_IN(28);
 
-__END_DECLS
+/**
+ * Like epoll_pwait() but with a `struct timespec` timeout, for nanosecond resolution.
+ *
+ * Available since API level 35.
+ */
+int epoll_pwait2(int __epoll_fd, struct epoll_event* _Nonnull __events, int __event_count, const struct timespec* _Nullable __timeout, const sigset_t* _Nullable __mask) __INTRODUCED_IN(35);
 
-#endif
+/**
+ * Like epoll_pwait2() but using a 64-bit signal mask even on 32-bit systems.
+ *
+ * Available since API level 35.
+ */
+int epoll_pwait2_64(int __epoll_fd, struct epoll_event* _Nonnull __events, int __event_count, const struct timespec* _Nullable __timeout, const sigset64_t* _Nullable __mask) __INTRODUCED_IN(35);
+
+__END_DECLS
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index b3ef185..e6ea3c2 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1586,6 +1586,8 @@
 
 LIBC_V { # introduced=VanillaIceCream
   global:
+    epoll_pwait2;
+    epoll_pwait2_64;
     localtime_rz;
     mbsrtowcs_l;
     mktime_z;
diff --git a/libc/system_properties/context_node.cpp b/libc/system_properties/context_node.cpp
index d392c0a..572bf97 100644
--- a/libc/system_properties/context_node.cpp
+++ b/libc/system_properties/context_node.cpp
@@ -49,17 +49,11 @@
     return true;
   }
 
-  char filename[PROP_FILENAME_MAX];
-  int len = async_safe_format_buffer(filename, sizeof(filename), "%s/%s", filename_, context_);
-  if (len < 0 || len >= PROP_FILENAME_MAX) {
-    lock_.unlock();
-    return false;
-  }
-
+  PropertiesFilename filename(filename_, context_);
   if (access_rw) {
-    pa_ = prop_area::map_prop_area_rw(filename, context_, fsetxattr_failed);
+    pa_ = prop_area::map_prop_area_rw(filename.c_str(), context_, fsetxattr_failed);
   } else {
-    pa_ = prop_area::map_prop_area(filename);
+    pa_ = prop_area::map_prop_area(filename.c_str());
   }
   lock_.unlock();
   return pa_;
@@ -84,13 +78,8 @@
 }
 
 bool ContextNode::CheckAccess() {
-  char filename[PROP_FILENAME_MAX];
-  int len = async_safe_format_buffer(filename, sizeof(filename), "%s/%s", filename_, context_);
-  if (len < 0 || len >= PROP_FILENAME_MAX) {
-    return false;
-  }
-
-  return access(filename, R_OK) == 0;
+  PropertiesFilename filename(filename_, context_);
+  return access(filename.c_str(), R_OK) == 0;
 }
 
 void ContextNode::Unmap() {
diff --git a/libc/system_properties/contexts_serialized.cpp b/libc/system_properties/contexts_serialized.cpp
index 6ccd46c..f05aaa0 100644
--- a/libc/system_properties/contexts_serialized.cpp
+++ b/libc/system_properties/contexts_serialized.cpp
@@ -66,18 +66,12 @@
 }
 
 bool ContextsSerialized::MapSerialPropertyArea(bool access_rw, bool* fsetxattr_failed) {
-  char filename[PROP_FILENAME_MAX];
-  int len = async_safe_format_buffer(filename, sizeof(filename), "%s/properties_serial", filename_);
-  if (len < 0 || len >= PROP_FILENAME_MAX) {
-    serial_prop_area_ = nullptr;
-    return false;
-  }
-
+  PropertiesFilename filename(filename_, "properties_serial");
   if (access_rw) {
-    serial_prop_area_ =
-        prop_area::map_prop_area_rw(filename, "u:object_r:properties_serial:s0", fsetxattr_failed);
+    serial_prop_area_ = prop_area::map_prop_area_rw(
+        filename.c_str(), "u:object_r:properties_serial:s0", fsetxattr_failed);
   } else {
-    serial_prop_area_ = prop_area::map_prop_area(filename);
+    serial_prop_area_ = prop_area::map_prop_area(filename.c_str());
   }
   return serial_prop_area_;
 }
diff --git a/libc/system_properties/contexts_split.cpp b/libc/system_properties/contexts_split.cpp
index 7ba835a..3579f55 100644
--- a/libc/system_properties/contexts_split.cpp
+++ b/libc/system_properties/contexts_split.cpp
@@ -192,18 +192,12 @@
 }
 
 bool ContextsSplit::MapSerialPropertyArea(bool access_rw, bool* fsetxattr_failed) {
-  char filename[PROP_FILENAME_MAX];
-  int len = async_safe_format_buffer(filename, sizeof(filename), "%s/properties_serial", filename_);
-  if (len < 0 || len >= PROP_FILENAME_MAX) {
-    serial_prop_area_ = nullptr;
-    return false;
-  }
-
+  PropertiesFilename filename(filename_, "properties_serial");
   if (access_rw) {
-    serial_prop_area_ =
-        prop_area::map_prop_area_rw(filename, "u:object_r:properties_serial:s0", fsetxattr_failed);
+    serial_prop_area_ = prop_area::map_prop_area_rw(
+        filename.c_str(), "u:object_r:properties_serial:s0", fsetxattr_failed);
   } else {
-    serial_prop_area_ = prop_area::map_prop_area(filename);
+    serial_prop_area_ = prop_area::map_prop_area(filename.c_str());
   }
   return serial_prop_area_;
 }
diff --git a/libc/system_properties/include/system_properties/system_properties.h b/libc/system_properties/include/system_properties/system_properties.h
index 0666e28..4d84b39 100644
--- a/libc/system_properties/include/system_properties/system_properties.h
+++ b/libc/system_properties/include/system_properties/system_properties.h
@@ -37,7 +37,25 @@
 #include "contexts_serialized.h"
 #include "contexts_split.h"
 
-constexpr int PROP_FILENAME_MAX = 1024;
+class PropertiesFilename {
+ public:
+  PropertiesFilename() = default;
+  PropertiesFilename(const char* dir, const char* file) {
+    if (snprintf(filename_, sizeof(filename_), "%s/%s", dir, file) >=
+        static_cast<int>(sizeof(filename_))) {
+      abort();
+    }
+  }
+  void operator=(const char* value) {
+    if (strlen(value) >= sizeof(filename_)) abort();
+    strcpy(filename_, value);
+  }
+  const char* c_str() { return filename_; }
+
+ private:
+  // Typically something like "/dev/__properties__/properties_serial".
+  char filename_[128];
+};
 
 class SystemProperties {
  public:
@@ -86,5 +104,5 @@
   Contexts* contexts_;
 
   bool initialized_;
-  char property_filename_[PROP_FILENAME_MAX];
+  PropertiesFilename properties_filename_;
 };
diff --git a/libc/system_properties/system_properties.cpp b/libc/system_properties/system_properties.cpp
index 1cb15c3..049236f 100644
--- a/libc/system_properties/system_properties.cpp
+++ b/libc/system_properties/system_properties.cpp
@@ -67,26 +67,23 @@
     return true;
   }
 
-  if (strlen(filename) >= PROP_FILENAME_MAX) {
-    return false;
-  }
-  strcpy(property_filename_, filename);
+  properties_filename_ = filename;
 
-  if (is_dir(property_filename_)) {
+  if (is_dir(properties_filename_.c_str())) {
     if (access("/dev/__properties__/property_info", R_OK) == 0) {
       contexts_ = new (contexts_data_) ContextsSerialized();
-      if (!contexts_->Initialize(false, property_filename_, nullptr)) {
+      if (!contexts_->Initialize(false, properties_filename_.c_str(), nullptr)) {
         return false;
       }
     } else {
       contexts_ = new (contexts_data_) ContextsSplit();
-      if (!contexts_->Initialize(false, property_filename_, nullptr)) {
+      if (!contexts_->Initialize(false, properties_filename_.c_str(), nullptr)) {
         return false;
       }
     }
   } else {
     contexts_ = new (contexts_data_) ContextsPreSplit();
-    if (!contexts_->Initialize(false, property_filename_, nullptr)) {
+    if (!contexts_->Initialize(false, properties_filename_.c_str(), nullptr)) {
       return false;
     }
   }
@@ -95,13 +92,9 @@
 }
 
 bool SystemProperties::AreaInit(const char* filename, bool* fsetxattr_failed) {
-  if (strlen(filename) >= PROP_FILENAME_MAX) {
-    return false;
-  }
-  strcpy(property_filename_, filename);
-
+  properties_filename_ = filename;
   contexts_ = new (contexts_data_) ContextsSerialized();
-  if (!contexts_->Initialize(true, property_filename_, fsetxattr_failed)) {
+  if (!contexts_->Initialize(true, properties_filename_.c_str(), fsetxattr_failed)) {
     return false;
   }
   initialized_ = true;
diff --git a/tests/sys_epoll_test.cpp b/tests/sys_epoll_test.cpp
index fb2a48f..8dee93f 100644
--- a/tests/sys_epoll_test.cpp
+++ b/tests/sys_epoll_test.cpp
@@ -24,29 +24,101 @@
 
 #include "utils.h"
 
-TEST(sys_epoll, smoke) {
+TEST(sys_epoll, epoll_wait) {
   int epoll_fd = epoll_create(1);
-  ASSERT_NE(-1, epoll_fd) << strerror(errno);
-  epoll_event events[1];
+  ASSERT_NE(-1, epoll_fd);
 
   // Regular epoll_wait.
+  epoll_event events[1] = {};
   ASSERT_EQ(0, epoll_wait(epoll_fd, events, 1, 1));
+}
+
+TEST(sys_epoll, epoll_pwait_no_sigset) {
+  int epoll_fd = epoll_create(1);
+  ASSERT_NE(-1, epoll_fd);
 
   // epoll_pwait without a sigset (which is equivalent to epoll_wait).
+  epoll_event events[1] = {};
   ASSERT_EQ(0, epoll_pwait(epoll_fd, events, 1, 1, nullptr));
+}
 
+TEST(sys_epoll, epoll_pwait64_no_sigset) {
 #if defined(__BIONIC__)
+  int epoll_fd = epoll_create(1);
+  ASSERT_NE(-1, epoll_fd);
+
   // epoll_pwait64 without a sigset (which is equivalent to epoll_wait).
+  epoll_event events[1] = {};
   ASSERT_EQ(0, epoll_pwait64(epoll_fd, events, 1, 1, nullptr));
+#else
+  GTEST_SKIP() << "epoll_pwait64 is bionic-only";
 #endif
+}
+
+TEST(sys_epoll, epoll_pwait2_no_sigset) {
+#if defined(__BIONIC__)
+  int epoll_fd = epoll_create(1);
+  ASSERT_NE(-1, epoll_fd);
+
+  // epoll_pwait2 without a sigset (which is equivalent to epoll_wait).
+  epoll_event events[1] = {};
+  timespec ts = {.tv_nsec = 500};
+  int rc = epoll_pwait2(epoll_fd, events, 1, &ts, nullptr);
+  if (rc == -1 && errno == ENOSYS) GTEST_SKIP() << "no epoll_pwait2 in this kernel";
+  ASSERT_EQ(0, rc) << strerror(errno);
+#else
+  GTEST_SKIP() << "epoll_pwait2 is only in glibc 2.35+";
+#endif
+}
+
+TEST(sys_epoll, epoll_pwait_with_sigset) {
+  int epoll_fd = epoll_create(1);
+  ASSERT_NE(-1, epoll_fd);
 
   // epoll_pwait with a sigset.
+  epoll_event events[1] = {};
   sigset_t ss;
   sigemptyset(&ss);
   sigaddset(&ss, SIGPIPE);
   ASSERT_EQ(0, epoll_pwait(epoll_fd, events, 1, 1, &ss));
 }
 
+TEST(sys_epoll, epoll_pwait2_with_sigset) {
+  int epoll_fd = epoll_create(1);
+  ASSERT_NE(-1, epoll_fd);
+
+#if defined(__BIONIC__)
+  epoll_event events[1] = {};
+  timespec ts = {.tv_nsec = 500};
+  sigset_t ss2;
+  sigemptyset(&ss2);
+  sigaddset(&ss2, SIGPIPE);
+  int rc = epoll_pwait2(epoll_fd, events, 1, &ts, &ss2);
+  if (rc == -1 && errno == ENOSYS) GTEST_SKIP() << "no epoll_pwait2 in this kernel";
+  ASSERT_EQ(0, rc) << strerror(errno);
+#else
+  GTEST_SKIP() << "epoll_pwait2 is only in glibc 2.35+";
+#endif
+}
+
+TEST(sys_epoll, epoll_pwait2_64_with_sigset) {
+  int epoll_fd = epoll_create(1);
+  ASSERT_NE(-1, epoll_fd);
+
+#if defined(__BIONIC__)
+  epoll_event events[1] = {};
+  timespec ts = {.tv_nsec = 500};
+  sigset64_t ss2;
+  sigemptyset64(&ss2);
+  sigaddset64(&ss2, SIGPIPE);
+  int rc = epoll_pwait2_64(epoll_fd, events, 1, &ts, &ss2);
+  if (rc == -1 && errno == ENOSYS) GTEST_SKIP() << "no epoll_pwait2 in this kernel";
+  ASSERT_EQ(0, rc) << strerror(errno);
+#else
+  GTEST_SKIP() << "epoll_pwait2_64 is bionic-only";
+#endif
+}
+
 TEST(sys_epoll, epoll_create_invalid_size) {
   errno = 0;
   ASSERT_EQ(-1, epoll_create(0));
diff --git a/tests/unistd_test.cpp b/tests/unistd_test.cpp
index b639a4e..ac39f96 100644
--- a/tests/unistd_test.cpp
+++ b/tests/unistd_test.cpp
@@ -1166,7 +1166,7 @@
   VERIFY_SYSCONF_UNKNOWN(666);
 }
 
-static void show_cache(const char* name, long size, long assoc, long line_size) {
+[[maybe_unused]] static void show_cache(const char* name, long size, long assoc, long line_size) {
   printf("%s cache size: %ld bytes, line size %ld bytes, ", name, size, line_size);
   if (assoc == 0) {
     printf("fully");
@@ -1177,6 +1177,9 @@
 }
 
 TEST(UNISTD_TEST, sysconf_cache) {
+#if defined(ANDROID_HOST_MUSL)
+  GTEST_SKIP() << "musl does not have _SC_LEVEL?_?CACHE_SIZE";
+#else
   // It's not obvious we can _test_ any of these, but we can at least
   // show the output for humans to inspect.
   show_cache("L1D", sysconf(_SC_LEVEL1_DCACHE_SIZE), sysconf(_SC_LEVEL1_DCACHE_ASSOC), sysconf(_SC_LEVEL1_DCACHE_LINESIZE));
@@ -1184,6 +1187,7 @@
   show_cache("L2", sysconf(_SC_LEVEL2_CACHE_SIZE), sysconf(_SC_LEVEL2_CACHE_ASSOC), sysconf(_SC_LEVEL2_CACHE_LINESIZE));
   show_cache("L3", sysconf(_SC_LEVEL3_CACHE_SIZE), sysconf(_SC_LEVEL3_CACHE_ASSOC), sysconf(_SC_LEVEL3_CACHE_LINESIZE));
   show_cache("L4", sysconf(_SC_LEVEL4_CACHE_SIZE), sysconf(_SC_LEVEL4_CACHE_ASSOC), sysconf(_SC_LEVEL4_CACHE_LINESIZE));
+#endif
 }
 
 TEST(UNISTD_TEST, dup2_same) {