diff --git a/README.md b/README.md
index 32dda04..e731e5f 100644
--- a/README.md
+++ b/README.md
@@ -85,12 +85,29 @@
     # files written by us and files taken from BSD.
 
   kernel/
-    # The kernel uapi header files. These are scrubbed copies of the originals
-    # in external/kernel-headers/. These files must not be edited directly. The
-    # generate_uapi_headers.sh script should be used to go from a kernel tree to
-    # external/kernel-headers/ --- this takes care of the architecture-specific
-    # details. The update_all.py script should be used to regenerate bionic's
-    # scrubbed headers from external/kernel-headers/.
+    # The kernel uapi header files. The "libc" headers that developers actually
+    # use are a mixture of headers provided by the C library itself (which,
+    # for bionic, are in bionic/libc/include/) and headers provided by the
+    # kernel. This is because ISO C and POSIX will say things like "there is
+    # a constant called PROT_NONE" or "there is a type called struct stat,
+    # and it contains a field called st_size", but they won't necessarily say
+    # what _value_ that constant has, or what _order_ the fields in a type
+    # are in. Those are left to individual kernels' ABIs. In an effort to --
+    # amongst other things, see https://lwn.net/Articles/507794/ for more
+    # background -- reduce copy & paste, the Linux kernel makes all the types
+    # and constants that make up the "userspace API" (uapi) available as
+    # headers separate from their internal-use headers (which contain all kinds
+    # of extra stuff that isn't available to userspace). We import the latest
+    # released kernel's uapi headers in external/kernel-headers/, but we don't
+    # use those headers directly in bionic. The bionic/libc/kernel/ directory
+    # contains scrubbed copies of the originals from external/kernel-headers/.
+    # The generate_uapi_headers.sh script should be used to go from a kernel
+    # tree to external/kernel-headers/ --- this takes care of the
+    # architecture-specific details. The update_all.py script should then be
+    # used to regenerate bionic's copy from external/kernel-headers/.
+    # The files in bionic must not be edited directly because any local changes
+    # will be overwritten by the next update. "Updating kernel header files"
+    # below has more information on this process.
 
   private/
     # These are private header files meant for use within bionic itself.
diff --git a/benchmarks/syscall_mmap_benchmark.cpp b/benchmarks/syscall_mmap_benchmark.cpp
index 10bae1f..34ffa2e 100644
--- a/benchmarks/syscall_mmap_benchmark.cpp
+++ b/benchmarks/syscall_mmap_benchmark.cpp
@@ -24,6 +24,12 @@
 
 #include "util.h"
 
+enum BenchmarkType : uint8_t {
+  kBenchmarkMmapOnly,
+  kBenchmarkMunmapOnly,
+  kBenchmarkAll,
+};
+
 static size_t page_sz = getpagesize();
 
 struct MmapParams {
@@ -32,31 +38,49 @@
   int64_t size;
 };
 
-// mmap syscall benchmarks
-static void MmapBenchmark(benchmark::State& state, const struct MmapParams& params, int fd,
-                          void* area = nullptr) {
+template <BenchmarkType type>
+void MmapBenchmarkImpl(benchmark::State& state, const struct MmapParams& params, int fd,
+                       void* area = nullptr) {
   for (auto _ : state) {
+    if (type == kBenchmarkMunmapOnly) state.PauseTiming();
     void* addr = mmap(area, params.size, params.prot, params.flags, fd, 0);
     if (addr == MAP_FAILED) {
       state.SkipWithError(android::base::StringPrintf("mmap failed: %s", strerror(errno)).c_str());
       break;
     }
 
+    if (type == kBenchmarkMmapOnly) state.PauseTiming();
+
     if (params.prot & PROT_WRITE) {
       MakeAllocationResident(addr, params.size, page_sz);
     }
 
+    if (type == kBenchmarkMunmapOnly) state.ResumeTiming();
+
     if (munmap(addr, params.size) != 0) {
       state.SkipWithError(
           android::base::StringPrintf("munmap failed: %s", strerror(errno)).c_str());
       break;
     }
+    if (type == kBenchmarkMmapOnly) state.ResumeTiming();
   }
 }
 
+static void MmapBenchmark(benchmark::State& state, const struct MmapParams& params, int fd,
+                          void* area = nullptr) {
+  MmapBenchmarkImpl<kBenchmarkAll>(state, params, fd, area);
+}
+
 static void MmapFixedBenchmark(benchmark::State& state, const struct MmapParams& params, int fd,
                                size_t area_size, size_t offs) {
-  uint8_t* area = reinterpret_cast<uint8_t*>(mmap(0, area_size, params.prot, params.flags, fd, 0));
+  if ((params.flags & MAP_FIXED) == 0) {
+    state.SkipWithError("MmapFixedBenchmark called without MAP_FIXED set");
+    return;
+  }
+
+  // Create the mmap that will be used for the fixed mmaps.
+  uint8_t* area = reinterpret_cast<uint8_t*>(
+      mmap(nullptr, area_size, params.prot, params.flags & ~MAP_FIXED, fd, 0));
   if (area == MAP_FAILED) {
     state.SkipWithError(android::base::StringPrintf("mmap failed: %s", strerror(errno)).c_str());
     return;
@@ -136,7 +160,7 @@
       .size = state.range(0),
   };
 
-  MmapFixedBenchmark(state, params, 0, params.size, 0);
+  MmapFixedBenchmark(state, params, -1, params.size, 0);
 }
 BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_rw_fixed, "AT_All_PAGE_SIZES");
 
@@ -147,7 +171,7 @@
       .size = state.range(0),
   };
 
-  MmapFixedBenchmark(state, params, 0, params.size, 0);
+  MmapFixedBenchmark(state, params, -1, params.size, 0);
 }
 BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_none_fixed, "AT_All_PAGE_SIZES");
 
@@ -212,3 +236,74 @@
 }
 // mapping at sub-page size offset is not supported, so run only for AT_MULTI_PAGE_SIZES
 BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_file_rw_priv_fixed_end, "AT_MULTI_PAGE_SIZES");
+
+static void BM_syscall_mmap_anon_mmap_only(benchmark::State& state) {
+  struct MmapParams params = {
+      .prot = PROT_READ | PROT_WRITE,
+      .flags = MAP_PRIVATE | MAP_ANONYMOUS,
+      .size = state.range(0),
+  };
+  MmapBenchmarkImpl<kBenchmarkMmapOnly>(state, params, 0);
+}
+BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_mmap_only, "AT_MULTI_PAGE_SIZES");
+
+static void BM_syscall_mmap_anon_munmap_only(benchmark::State& state) {
+  struct MmapParams params = {
+      .prot = PROT_READ | PROT_WRITE,
+      .flags = MAP_PRIVATE | MAP_ANONYMOUS,
+      .size = state.range(0),
+  };
+  MmapBenchmarkImpl<kBenchmarkMunmapOnly>(state, params, 0);
+}
+BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_munmap_only, "AT_MULTI_PAGE_SIZES");
+
+void MadviseBenchmark(benchmark::State& state, const struct MmapParams& params, int madvise_flags) {
+  void* addr = mmap(nullptr, params.size, params.prot, params.flags, 0, 0);
+  if (addr == MAP_FAILED) {
+    state.SkipWithError(android::base::StringPrintf("mmap failed: %s", strerror(errno)).c_str());
+    return;
+  }
+  for (auto _ : state) {
+    state.PauseTiming();
+    if (params.prot & PROT_WRITE) {
+      MakeAllocationResident(addr, params.size, page_sz);
+    }
+    state.ResumeTiming();
+
+    madvise(addr, params.size, madvise_flags);
+  }
+
+  if (munmap(addr, params.size) != 0) {
+    state.SkipWithError(android::base::StringPrintf("munmap failed: %s", strerror(errno)).c_str());
+  }
+}
+
+static void BM_syscall_mmap_anon_madvise_dontneed(benchmark::State& state) {
+  struct MmapParams params = {
+      .prot = PROT_READ | PROT_WRITE,
+      .flags = MAP_PRIVATE | MAP_ANONYMOUS,
+      .size = state.range(0),
+  };
+  MadviseBenchmark(state, params, MADV_DONTNEED);
+}
+BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_madvise_dontneed, "AT_MULTI_PAGE_SIZES");
+
+static void BM_syscall_mmap_anon_madvise_pageout(benchmark::State& state) {
+  struct MmapParams params = {
+      .prot = PROT_READ | PROT_WRITE,
+      .flags = MAP_PRIVATE | MAP_ANONYMOUS,
+      .size = state.range(0),
+  };
+  MadviseBenchmark(state, params, MADV_PAGEOUT);
+}
+BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_madvise_pageout, "AT_MULTI_PAGE_SIZES");
+
+static void BM_syscall_mmap_anon_madvise_free(benchmark::State& state) {
+  struct MmapParams params = {
+      .prot = PROT_READ | PROT_WRITE,
+      .flags = MAP_PRIVATE | MAP_ANONYMOUS,
+      .size = state.range(0),
+  };
+  MadviseBenchmark(state, params, MADV_FREE);
+}
+BIONIC_BENCHMARK_WITH_ARG(BM_syscall_mmap_anon_madvise_free, "AT_MULTI_PAGE_SIZES");
diff --git a/tests/malloc_test.cpp b/tests/malloc_test.cpp
index 14a426f..2b48d85 100644
--- a/tests/malloc_test.cpp
+++ b/tests/malloc_test.cpp
@@ -935,7 +935,8 @@
   size_t expected_alignment = alignof(Type);
   if (expected_alignment != 0) {
     ASSERT_EQ(0U, (expected_alignment - 1) & reinterpret_cast<uintptr_t>(floating))
-        << "Expected alignment " << expected_alignment << " ptr value " << floating;
+        << "Expected alignment " << expected_alignment << " ptr value "
+        << static_cast<void*>(floating);
   }
 }
 
diff --git a/tests/sys_statvfs_test.cpp b/tests/sys_statvfs_test.cpp
index 1761e6a..73b2a96 100644
--- a/tests/sys_statvfs_test.cpp
+++ b/tests/sys_statvfs_test.cpp
@@ -28,9 +28,19 @@
   EXPECT_EQ(4096U, sb.f_bsize);
   EXPECT_EQ(0U, sb.f_bfree);
   EXPECT_EQ(0U, sb.f_ffree);
-  EXPECT_EQ(0U, sb.f_fsid);
   EXPECT_EQ(255U, sb.f_namemax);
 
+  // Linux 6.7 requires that all filesystems have a non-zero fsid.
+  if (sb.f_fsid != 0U) {
+    // fs/libfs.c reuses the filesystem's device number.
+    struct stat proc_sb;
+    ASSERT_EQ(0, stat("/proc", &proc_sb));
+    EXPECT_EQ(proc_sb.st_dev, sb.f_fsid);
+  } else {
+    // Prior to that, the fsid for /proc was just 0.
+    EXPECT_EQ(0U, sb.f_fsid);
+  }
+
   // The kernel sets a private bit to indicate that f_flags is valid.
   // This flag is not supposed to be exposed to libc clients.
   static const uint32_t ST_VALID = 0x0020;
diff --git a/tests/wctype_test.cpp b/tests/wctype_test.cpp
index 85a46aa..0f07956 100644
--- a/tests/wctype_test.cpp
+++ b/tests/wctype_test.cpp
@@ -35,20 +35,24 @@
                          const wchar_t* falses) {
   UtfLocale l;
   for (const wchar_t* p = trues; *p; ++p) {
-    if (!have_dl() && *p > 0x7f) {
-      GTEST_LOG_(INFO) << "skipping unicode test " << *p;
+    const wchar_t val_ch = *p;
+    const int val_int = static_cast<int>(val_ch);
+    if (!have_dl() && val_ch > 0x7f) {
+      GTEST_LOG_(INFO) << "skipping unicode test " << val_int;
       continue;
     }
-    EXPECT_TRUE(fn(*p)) << *p;
-    EXPECT_TRUE(fn_l(*p, l.l)) << *p;
+    EXPECT_TRUE(fn(val_ch)) << val_int;
+    EXPECT_TRUE(fn_l(val_ch, l.l)) << val_int;
   }
   for (const wchar_t* p = falses; *p; ++p) {
-    if (!have_dl() && *p > 0x7f) {
-      GTEST_LOG_(INFO) << "skipping unicode test " << *p;
+    const wchar_t val_ch = *p;
+    const int val_int = static_cast<int>(val_ch);
+    if (!have_dl() && val_ch > 0x7f) {
+      GTEST_LOG_(INFO) << "skipping unicode test " << val_int;
       continue;
     }
-    EXPECT_FALSE(fn(*p)) << *p;
-    EXPECT_FALSE(fn_l(*p, l.l)) << *p;
+    EXPECT_FALSE(fn(val_ch)) << val_int;
+    EXPECT_FALSE(fn_l(val_ch, l.l)) << val_int;
   }
 }