diff --git a/libc/Android.mk b/libc/Android.mk
index 0dbc0be..06d36fe 100644
--- a/libc/Android.mk
+++ b/libc/Android.mk
@@ -140,6 +140,10 @@
 	stdio/vsscanf.c \
 	stdio/wbuf.c \
 	stdio/wsetup.c \
+	stdio/__snprintf_chk.c \
+	stdio/__sprintf_chk.c \
+	stdio/__vsnprintf_chk.c \
+	stdio/__vsprintf_chk.c \
 	stdlib/_rand48.c \
 	stdlib/assert.c \
 	stdlib/atexit.c \
@@ -205,6 +209,15 @@
 	string/strtok.c \
 	string/strtotimeval.c \
 	string/strxfrm.c \
+	string/__memcpy_chk.c \
+	string/__memmove_chk.c \
+	string/__memset_chk.c \
+	string/__strcat_chk.c \
+	string/__strcpy_chk.c \
+	string/__strlcat_chk.c \
+	string/__strlcpy_chk.c \
+	string/__strncat_chk.c \
+	string/__strncpy_chk.c \
 	wchar/wcpcpy.c \
 	wchar/wcpncpy.c \
 	wchar/wcscasecmp.c \
@@ -440,18 +453,19 @@
 # Define some common cflags
 # ========================================================
 libc_common_cflags := \
-		-DWITH_ERRLIST			\
-		-DANDROID_CHANGES		\
-		-DUSE_LOCKS 			\
-		-DREALLOC_ZERO_BYTES_FREES 	\
-		-D_LIBC=1 			\
-		-DSOFTFLOAT                     \
-		-DFLOATING_POINT		\
-		-DINET6 \
-		-I$(LOCAL_PATH)/private \
-		-DUSE_DL_PREFIX \
-		-DPOSIX_MISTAKE \
-                -DLOG_ON_HEAP_ERROR \
+    -DWITH_ERRLIST \
+    -DANDROID_CHANGES \
+    -DUSE_LOCKS \
+    -DREALLOC_ZERO_BYTES_FREES \
+    -D_LIBC=1 \
+    -DSOFTFLOAT \
+    -DFLOATING_POINT \
+    -DINET6 \
+    -I$(LOCAL_PATH)/private \
+    -DUSE_DL_PREFIX \
+    -DPOSIX_MISTAKE \
+    -DLOG_ON_HEAP_ERROR \
+    -std=gnu99
 
 # these macro definitions are required to implement the
 # 'timezone' and 'daylight' global variables, as well as
@@ -515,8 +529,8 @@
     libc_common_cflags += -DANDROID_SMP=0
 endif
 
-# Needed to access private/__dso_handle.S from
-# crtbegin_xxx.S and crtend_xxx.S
+# Needed to access private/__dso_handle.h from
+# crtbegin_xxx.c and crtend_xxx.c
 #
 libc_crt_target_cflags += -I$(LOCAL_PATH)/private
 
@@ -529,11 +543,11 @@
 libc_common_c_includes := \
 		$(LOCAL_PATH)/stdlib  \
 		$(LOCAL_PATH)/string  \
-		$(LOCAL_PATH)/stdio
+		$(LOCAL_PATH)/stdio   \
+		external/safe-iop/include
 
-# Needed to access private/__dso_handle.S from
+# Needed to access private/__dso_handle.h from
 # crtbegin_xxx.S and crtend_xxx.S
-# and machine/asm.h
 #
 libc_crt_target_cflags += -I$(LOCAL_PATH)/private -I$(LOCAL_PATH)/arch-$(TARGET_ARCH)/include
 
@@ -555,12 +569,16 @@
 #
 
 libc_crt_target_so_cflags := $(libc_crt_target_cflags)
+libc_crt_target_crtstart_file := $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin.c
+libc_crt_target_crtstart_so_file := $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin_so.c
 ifeq ($(TARGET_ARCH),x86)
     # This flag must be added for x86 targets, but not for ARM
     libc_crt_target_so_cflags += -fPIC
+    libc_crt_target_crtstart_file := $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin.S
+    libc_crt_target_crtstart_so_file := $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin_so.S
 endif
 GEN := $(TARGET_OUT_INTERMEDIATE_LIBRARIES)/crtbegin_so.o
-$(GEN): $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin_so.S
+$(GEN): $(libc_crt_target_crtstart_so_file)
 	@mkdir -p $(dir $@)
 	$(TARGET_CC) $(libc_crt_target_so_cflags) -o $@ -c $<
 ALL_GENERATED_SOURCES += $(GEN)
@@ -574,13 +592,13 @@
 
 
 GEN := $(TARGET_OUT_INTERMEDIATE_LIBRARIES)/crtbegin_static.o
-$(GEN): $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin_static.S
+$(GEN): $(libc_crt_target_crtstart_file)
 	@mkdir -p $(dir $@)
 	$(TARGET_CC) $(libc_crt_target_cflags) -o $@ -c $<
 ALL_GENERATED_SOURCES += $(GEN)
 
 GEN := $(TARGET_OUT_INTERMEDIATE_LIBRARIES)/crtbegin_dynamic.o
-$(GEN): $(LOCAL_PATH)/arch-$(TARGET_ARCH)/bionic/crtbegin_dynamic.S
+$(GEN): $(libc_crt_target_crtstart_file)
 	@mkdir -p $(dir $@)
 	$(TARGET_CC) $(libc_crt_target_cflags) -o $@ -c $<
 ALL_GENERATED_SOURCES += $(GEN)
@@ -725,7 +743,10 @@
 LOCAL_C_INCLUDES := $(libc_common_c_includes)
 
 LOCAL_SRC_FILES := \
-	bionic/malloc_debug_leak.c
+	bionic/malloc_debug_leak.c \
+	bionic/malloc_debug_check.c \
+	bionic/malloc_debug_check_mapinfo.c \
+	bionic/malloc_debug_stacktrace.c
 
 LOCAL_MODULE:= libc_malloc_debug_leak
 
diff --git a/libc/Jamfile b/libc/Jamfile
deleted file mode 100644
index a65be5d..0000000
--- a/libc/Jamfile
+++ /dev/null
@@ -1,441 +0,0 @@
-# This file is used to build the Bionic library with the Jam build
-# tool. For info, see www.perforce.com/jam/jam.html
-#
-
-BIONIC_TOP ?= $(DOT) ;
-
-DEBUG = 1 ;
-
-# pattern used for automatic heade inclusion detection
-HDRPATTERN = "^[ 	]*#[ 	]*include[ 	]*[<\"]([^\">]*)[\">].*$" ;
-
-
-# debugging support, simply define the DEBUG variable to activate verbose output
-rule Debug
-{
-    if $(DEBUG) {
-        Echo $(1) ;
-    }
-}
-
-# return all elements from $(1) that are not in $(2)
-rule Filter  list : filter
-{
-    local result = ;
-    local item ;
-    for item in $(list) {
-        if ! $(item) in $(filter) {
-            result += $(item) ;
-        }
-    }
-    return $(result) ;
-}
-
-
-# reverse a list of elements
-rule Reverse  list
-{
-    local  result = ;
-    local  item ;
-
-    for item in $(list) {
-        result = $(item) $(result) ;
-    }
-    return $(result) ;
-}
-
-
-# decompose a path into a list of elements
-rule PathDecompose  dir
-{
-    local  result ;
-
-    while $(dir:D)
-    {
-        if ! $(dir:BS) {  # for rooted paths like "/foo"
-            break ;
-        }
-        result = $(dir:BS) $(result) ;
-        dir    = $(dir:D) ;
-    }
-    result = $(dir) $(result) ;
-    return $(result) ;
-}
-
-
-# simply a file path, i.e. get rid of . or .. when possible
-rule _PathSimplify  dir
-{
-    local  result = ;
-    local  dir2 d ;
-
-    dir  = [ PathDecompose $(dir) ] ;
-
-    # get rid of any single dot
-    dir2 = ;
-    for d in $(dir) {
-        if $(d) = "." {
-            continue ;
-        }
-        dir2 += $(d) ;
-    }
-
-    # get rid of .. when possible
-    for d in $(dir2) {
-        if $(d) = ".." && $(result) {
-            result = $(result[2-]) ;
-        }
-        else
-            result = $(d) $(result) ;
-    }
-
-    # now invert the result
-    result = [ Reverse $(result) ] ;
-    if ! $(result) {
-        result = "." ;
-    }
-    return $(result:J="/") ;
-}
-
-
-rule PathSimplify  dirs
-{
-    local result ;
-    local d ;
-    for d in $(dirs) {
-        result += [ _PathSimplify $(d) ] ;
-    }
-    return $(result) ;
-}
-
-
-# retrieve list of subdirectories
-rule ListSubDirs  paths
-{
-    local  result  = ;
-    local  entry ;
-    for entry in [ Glob $(paths) : * ] {
-        if ! $(entry:S) {
-            result += $(entry) ;
-        }
-    }
-    return [ PathSimplify $(result) ] ;
-}
-
-
-# retrieve list of sources in a given directory
-rule ListSources  path
-{
-    return [ Glob $(path) : *.S *.c ] ;
-}
-
-
-# find the prebuilt directory
-#
-if ! $(TOP) {
-    Echo "Please define TOP as the root of your device build tree" ;
-    Exit ;
-}
-
-Debug "OS is" $(OS) ;
-Debug "CPU is" $(CPU) ;
-
-if $(OS) = LINUX
-{
-    PREBUILT = $(TOP)/prebuilt/Linux ;
-}
-else if $(OS) = MACOSX
-{
-    switch $(CPU) {
-        case i386 : PREBUILT = $(TOP)/prebuilt/darwin-x86 ; break ;
-        case ppc  : PREBUILT = $(TOP)/prebuilt/darwin-ppc ; break ;
-        case *    : Echo "unsupported CPU" "$(CPU) !!" ;
-                    Echo "Please contact digit@google.com for help" ;
-                    Exit ;
-    }
-}
-else
-{
-    Echo "Unsupported operating system" $(OS) ;
-    Echo "Please contact digit@google.com for help" ;
-    Exit ;
-}
-
-Debug "TOP is" $(TOP) ;
-Debug "PREBUILT is" $(PREBUILT) ;
-
-
-# check architectures and setup toolchain variables
-#
-SUPPORTED_ARCHS = x86 arm ;
-
-ARCH ?= $(SUPPORTED_ARCHS) ;
-
-if ! $(ARCH) in $(SUPPORTED_ARCHS) {
-    Echo "The variable ARCH contains an unsupported value, use one or more of these instead" ;
-    Echo "separated by spaces:" $(SUPPORTED_ARCHS) ;
-    Exit ;
-}
-
-x86_TOOLSET_PREFIX ?= "" ;
-arm_TOOLSET_PREFIX ?= $(TOP)/prebuilt/Linux/toolchain-4.1.1/bin/arm-elf- ;
-
-for arch in $(ARCH) {
-    CC_$(arch)  = $($(arch)_TOOLSET_PREFIX)gcc ;
-    C++_$(arch) = $($(arch)_TOOLSET_PREFIX)g++ ;
-    AR_$(arch)  = $($(arch)_TOOLSET_PREFIX)ar ;
-}
-
-
-# the list of arch-independent source subdirectories
-BIONIC_SRC_SUBDIRS = string ;
-BIONIC_x86_SUBDIRS = ;
-BIONIC_arm_SUBDIRS = ;
-
-CFLAGS   = -O0 -g -W ;
-
-
-
-# find sources in a given list of subdirectories
-rule FindSources  dirs
-{
-    local dir ;
-
-    for dir in $(dirs)
-    {
-        local LOCAL_SRC NO_LOCAL_SRC ;
-
-        if [ Glob $(dir) : rules.jam ] {
-            include $(dir)/rules.jam ;
-            if $(LOCAL_SRC) {
-                _sources = $(LOCAL_SRC) ;
-            }
-            else {
-                _sources = [ Glob $(dir) : *.S *.c ] ;
-                _sources = $(_sources:BS) ;
-            }
-            if $(NO_LOCAL_SRC) {
-                _sources = [ Filter $(_sources) : $(NO_LOCAL_SRC) ] ;
-            }
-            sources += $(dir)/$(_sources) ;
-        }
-        else
-            sources += [ ListSources $(dir) ] ;
-    }
-}
-
-# Compile a given object file from a source
-rule Compile  object : source
-{
-    Depends $(object) : $(source) ;
-    Depends bionic : $(object) ;
-    Clean clean : $(object) ;
-
-    MakeLocate $(object) : $(OUT) ;
-
-
-    CC on $(object)       = $(CC_$(arch)) ;
-    CFLAGS on $(object)   = $(CFLAGS) ;
-    INCLUDES on $(object) = $(INCLUDES) ;
-    DEFINES on $(object)  = $(DEFINES) ;
-
-    HDRRULE on $(>) = HdrRule ;
-    HDRSCAN on $(>) = $(HDRPATTERN) ;
-    HDRSEARCH on $(>) = $(INCLUDES) ;
-    HDRGRIST on $(>) = $(HDRGRIST) ;
-}
-
-
-actions Compile
-{
-    $(CC) -c -o $(1) $(CFLAGS) -I$(INCLUDES) -D$(DEFINES) $(2)
-}
-
-
-rule RmTemps
-{
-    Temporary $(2) ;
-}
-
-actions quietly updated piecemeal together RmTemps
-{
-    rm -f $(2)
-}
-
-actions Archive
-{
-    $(AR) ru $(1) $(2)
-}
-
-rule Library  library : objects
-{
-    local  obj ;
-
-    if ! $(library:S) {
-        library = $(library:S=.a) ;
-    }
-    library = $(library:G=<$(arch)>) ;
-
-    Depends all : $(library) ;
-
-    if ! $(library:D) {
-        MakeLocate $(library) $(library)($(objects:BS)) : $(OUT) ;
-    }
-
-    Depends $(library) : $(library)($(objects:BS)) ;
-    for obj in $(objects) {
-        Depends $(library)($(obj:BS)) : $(obj) ;
-    }
-
-    Clean clean : $(library) ;
-
-    AR on $(library) = $(AR_$(arch)) ;
-    Archive $(library) : $(objects) ;
-
-    RmTemps $(library) : $(objects) ;
-}
-
-
-rule  ProcessDir
-{
-    local CFLAGS   = $(CFLAGS) ;
-    local DEFINES  = $(DEFINES) ;
-    local INCLUDES = $(INCLUDES) ;
-    local local_rules = [ Glob $(1) : rules.jam ] ;
-    local source sources ;
-
-    if $(local_rules) {
-        local LOCAL_CFLAGS LOCAL_DEFINES LOCAL_INCLUDES LOCAL_SRC NO_LOCAL_SRC ;
-
-        include $(local_rules) ;
-        CFLAGS   += $(LOCAL_CFLAGS) ;
-        DEFINES  += $(LOCAL_DEFINES) ;
-        INCLUDES += $(LOCAL_INCLUDES) ;
-
-        if $(LOCAL_SRC) {
-            sources = $(LOCAL_SRC) ;
-        }
-        else {
-            sources = [ Glob $(1) : *.S *.c ] ;
-            sources = $(sources:BS) ;
-        }
-
-        if $(NO_LOCAL_SRC) {
-            sources = [ Filter $(sources) : $(NO_LOCAL_SRC) ] ;
-        }
-
-        sources = $(1)/$(sources) ;
-    }
-    else
-        sources = [ Glob $(1) : *.S *.c ] ;
-
-    for source in $(sources) {
-        local name = $(source:B) ;
-
-        if $(source:S) = ".S" {
-            # record the list of assembler sources
-            ASSEMBLER_SOURCES += $(name) ;
-        }
-        else if $(source:S) = ".c" && $(name) in $(ASSEMBLER_SOURCES) {
-            # skip C source file if corresponding assembler exists
-            continue ;
-        }
-
-        objname = <$(arch)>$(name).o  ;
-
-        Compile $(objname) : $(source) ;
-        ALL_OBJECTS += $(objname) ;
-    }
-}
-
-rule ProcessDirs
-{
-    local  dir ;
-    for dir in $(1) {
-        ProcessDir $(dir) ;
-    }
-}
-
-INCLUDES_x86 = /usr/src/linux/include ;
-
-INCLUDES_arm = ../kernel_headers
-               include/arch/arm
-               include/bits32
-               ;
-
-INCLUDES = include stdio string stdlib .
-           ../msun/include
-           ;
-
-DEFINES  = ANDROID_CHANGES
-           USE_LOCKS
-           REALLOC_ZERO_BYTES_FREES
-           _LIBC=1
-           SOFTFLOAT
-           FLOATING_POINT
-           NEED_PSELECT=1
-           ANDROID
-           ;
-
-CFLAGS_x86 = ;
-
-
-for arch in $(ARCH)
-{
-    local ARCH_DIR = $(BIONIC_TOP)/arch-$(arch) ;
-    local INCLUDES = $(INCLUDES_$(arch)) $(ARCH_DIR)/include $(INCLUDES) ;
-    local DEFINES  = $(DEFINES_$(arch)) $(DEFINES) ARCH=$(arch)  ;
-    local CFLAGS   = $(CFLAGS) $(CFLAGS_$(arch)) ;
-    local OUT      = out/$(arch) ;
-    local ASSEMBLER_SOURCES ALL_OBJECTS ;
-
-    ProcessDirs [ ListSubDirs $(ARCH_DIR) ] ;
-    ProcessDirs stdlib stdio unistd string tzcode inet ;
-    ProcessDirs [ ListSubDirs netbsd ] ;
-    ProcessDirs bionic ;
-
-    Library bionic : $(ALL_OBJECTS) ;
-}
-
-BIONIC_SEARCH = $(BIONIC_TOP)/include ;
-
-
-
-# /HdrRule source : headers ;
-#
-# Arranges the proper dependencies when the file _source_ includes the files
-# _headers_ through the #include C preprocessor directive
-#
-# this rule is not intendend to be called explicitely. It is called
-# automatically during header scanning on sources handled by the @Object
-# rule (e.g. sources in @Main or @Library rules)
-#
-rule HdrRule
-{
-    # HdrRule source : headers ;
-
-    # N.B.  This rule is called during binding, potentially after
-    # the fate of many targets has been determined, and must be
-    # used with caution: don't add dependencies to unrelated
-    # targets, and don't set variables on $(<).
-
-    # Tell Jam that anything depending on $(<) also depends on $(>),
-    # set SEARCH so Jam can find the headers, but then say we don't
-    # care if we can't actually find the headers (they may have been
-    # within ifdefs),
-
-    local s = $(>:G=$(HDRGRIST:E)) ;
-
-    Includes $(<) : $(s) ;
-    SEARCH on $(s) = $(HDRSEARCH) ;
-    NoCare $(s) ;
-
-    # Propagate on $(<) to $(>)
-
-    HDRSEARCH on $(s) = $(HDRSEARCH) ;
-    HDRSCAN on $(s) = $(HDRSCAN) ;
-    HDRRULE on $(s) = $(HDRRULE) ;
-    HDRGRIST on $(s) = $(HDRGRIST) ;
-}
-
-
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/arch-arm/bionic/atexit.h
similarity index 61%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/arch-arm/bionic/atexit.h
index beea685..d567bfc 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/arch-arm/bionic/atexit.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,28 @@
  * SUCH DAMAGE.
  */
 
+/* CRT_LEGACY_WORKAROUND should only be defined when building
+ * this file as part of the platform's C library.
+ *
+ * The C library already defines a function named 'atexit()'
+ * for backwards compatibility with older NDK-generated binaries.
+ *
+ * For newer ones, 'atexit' is actually embedded in the C
+ * runtime objects that are linked into the final ELF
+ * binary (shared library or executable), and will call
+ * __cxa_atexit() in order to un-register any atexit()
+ * handler when a library is unloaded.
+ *
+ * This function must be global *and* hidden. Only the
+ * code inside the same ELF binary should be able to access it.
+ */
+
 #ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
+extern void *__dso_handle;
+
+__attribute__ ((visibility ("hidden")))
+int atexit(void (*func)(void))
+{
+  return (__cxa_atexit((void (*)(void *))func, (void *)0, &__dso_handle));
+}
 #endif
diff --git a/libc/arch-arm/bionic/crtbegin.c b/libc/arch-arm/bionic/crtbegin.c
new file mode 100644
index 0000000..9dcd254
--- /dev/null
+++ b/libc/arch-arm/bionic/crtbegin.c
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+typedef struct
+{
+    void (**preinit_array)(void);
+    void (**init_array)(void);
+    void (**fini_array)(void);
+    void (**ctors_array)(void);
+} structors_array_t;
+
+extern int main(int argc, char **argv, char **env);
+
+extern void __libc_init(
+  unsigned int *elfdata,
+  void (*onexit)(void),
+  int (*slingshot)(int, char**, char**),
+  structors_array_t const * const structors
+);
+
+__attribute__ ((section (".preinit_array")))
+void (*__PREINIT_ARRAY__)(void) = (void (*)(void)) -1;
+
+__attribute__ ((section (".init_array")))
+void (*__INIT_ARRAY__)(void) = (void (*)(void)) -1;
+
+__attribute__ ((section (".fini_array")))
+void (*__FINI_ARRAY__)(void) = (void (*)(void)) -1;
+
+__attribute__ ((section (".ctors")))
+void (*__CTOR_LIST__)(void) = (void (*)(void)) -1;
+
+__attribute__((visbility("hidden")))
+void _start() {
+  structors_array_t array;
+  void *elfdata;
+
+  array.preinit_array = &__PREINIT_ARRAY__;
+  array.init_array =    &__INIT_ARRAY__;
+  array.fini_array =    &__FINI_ARRAY__;
+  array.ctors_array =   &__CTOR_LIST__;
+
+  elfdata = __builtin_frame_address(0) + sizeof(void *);
+  __libc_init(elfdata, (void *) 0, &main, &array);
+}
+
+#include "__dso_handle.h"
+#include "atexit.h"
diff --git a/libc/arch-arm/bionic/crtbegin_dynamic.S b/libc/arch-arm/bionic/crtbegin_dynamic.S
deleted file mode 100644
index ec6d482..0000000
--- a/libc/arch-arm/bionic/crtbegin_dynamic.S
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-	.text
-	.align 4
-	.type _start,#function
-	.globl _start
-
-# this is the small startup code that is first run when
-# any executable that is dynamically-linked with Bionic
-# runs.
-#
-# it's purpose is to call __libc_init with appropriate
-# arguments, which are:
-#
-#    - the address of the raw data block setup by the Linux
-#      kernel ELF loader
-#
-#    - address of an "onexit" function, not used on any
-#      platform supported by Bionic
-#
-#    - address of the "main" function of the program.
-#
-#    - address of the constructor list
-#
-_start:	
-	mov	r0, sp
-	mov	r1, #0
-	ldr	r2, =main
-	adr	r3, 1f
-	ldr	r4, =__libc_init
-	blx	r4
-	mov	r0, #0
-	bx	r0
-
-1:  .long   __PREINIT_ARRAY__
-    .long   __INIT_ARRAY__
-    .long   __FINI_ARRAY__
-    .long   __CTOR_LIST__
-
-	.section .preinit_array, "aw"
-	.globl __PREINIT_ARRAY__
-__PREINIT_ARRAY__:
-	.long -1
-
-	.section .init_array, "aw"
-	.globl __INIT_ARRAY__
-__INIT_ARRAY__:
-	.long -1
-
-	.section .fini_array, "aw"
-	.globl __FINI_ARRAY__
-__FINI_ARRAY__:
-	.long -1
-
-	.section .ctors, "aw"
-	.globl __CTOR_LIST__
-__CTOR_LIST__:
-	.long -1
-
-#include "__dso_handle.S"
-#include "atexit.S"
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/arch-arm/bionic/crtbegin_so.c
similarity index 69%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/arch-arm/bionic/crtbegin_so.c
index beea685..57d19bf 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/arch-arm/bionic/crtbegin_so.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,18 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
+extern void __cxa_finalize(void *);
+extern void *__dso_handle;
+
+__attribute__((visbility("hidden")))
+void __on_dlclose() {
+  __cxa_finalize(&__dso_handle);
+}
+
+#ifdef CRT_LEGACY_WORKAROUND
+#include "__dso_handle.h"
+#else
+#include "__dso_handle_so.h"
 #endif
+
+#include "atexit.h"
diff --git a/libc/arch-arm/bionic/crtbegin_static.S b/libc/arch-arm/bionic/crtbegin_static.S
deleted file mode 100644
index 087ce36..0000000
--- a/libc/arch-arm/bionic/crtbegin_static.S
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-	.text
-	.align 4
-	.type _start,#function
-	.globl _start
-
-# this is the small startup code that is first run when
-# any executable that is statically-linked with Bionic
-# runs.
-#
-# it's purpose is to call __libc_init with appropriate
-# arguments, which are:
-#
-#    - the address of the raw data block setup by the Linux
-#      kernel ELF loader
-#
-#    - address of an "onexit" function, not used on any
-#      platform supported by Bionic
-#
-#    - address of the "main" function of the program.
-#
-#    - address of the constructor list
-#
-_start:	
-	mov	r0, sp
-	mov	r1, #0
-	ldr	r2, =main
-	adr	r3, 1f
-	ldr	r4, =__libc_init
-	blx	r4
-	mov	r0, #0
-	bx	r0
-
-1:  .long   __PREINIT_ARRAY__
-    .long   __INIT_ARRAY__
-    .long   __FINI_ARRAY__
-    .long   __CTOR_LIST__
-
-	.section .preinit_array, "aw"
-	.globl __PREINIT_ARRAY__
-__PREINIT_ARRAY__:
-	.long -1
-
-	.section .init_array, "aw"
-	.globl __INIT_ARRAY__
-__INIT_ARRAY__:
-	.long -1
-
-	.section .fini_array, "aw"
-	.globl __FINI_ARRAY__
-__FINI_ARRAY__:
-	.long -1
-
-	.section .ctors, "aw"
-	.globl __CTOR_LIST__
-__CTOR_LIST__:
-	.long -1
-
-
-#include "__dso_handle.S"
-#include "atexit.S"
diff --git a/libc/private/__dso_handle.S b/libc/arch-x86/bionic/__dso_handle.S
similarity index 100%
rename from libc/private/__dso_handle.S
rename to libc/arch-x86/bionic/__dso_handle.S
diff --git a/libc/private/__dso_handle_so.S b/libc/arch-x86/bionic/__dso_handle_so.S
similarity index 100%
rename from libc/private/__dso_handle_so.S
rename to libc/arch-x86/bionic/__dso_handle_so.S
diff --git a/libc/arch-x86/bionic/crtbegin_dynamic.S b/libc/arch-x86/bionic/crtbegin.S
similarity index 97%
rename from libc/arch-x86/bionic/crtbegin_dynamic.S
rename to libc/arch-x86/bionic/crtbegin.S
index 177244b..39b6af0 100644
--- a/libc/arch-x86/bionic/crtbegin_dynamic.S
+++ b/libc/arch-x86/bionic/crtbegin.S
@@ -30,8 +30,7 @@
 	.globl _start
 
 # this is the small startup code that is first run when
-# any executable that is dynamically-linked with Bionic
-# runs.
+# any executable that is linked with Bionic runs.
 #
 # it's purpose is to call __libc_init with appropriate
 # arguments, which are:
diff --git a/libc/arch-x86/bionic/crtbegin_static.S b/libc/arch-x86/bionic/crtbegin_static.S
deleted file mode 100644
index 4fffecd..0000000
--- a/libc/arch-x86/bionic/crtbegin_static.S
+++ /dev/null
@@ -1,138 +0,0 @@
-# bionic/arch-x86/bionic/crtbegin_static.S
-#
-# Copyright 2006, The Android Open Source Project
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are met:
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above copyright
-#       notice, this list of conditions and the following disclaimer in the
-#       documentation and/or other materials provided with the distribution.
-#     * Neither the name of Google Inc. nor the names of its contributors may
-#       be used to endorse or promote products derived from this software
-#       without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR 
-# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO 
-# EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 
-# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
-# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
-# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
-# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-	.text
-	.align 4
-	.type _start, @function
-	.globl _start
-
-# this is the small startup code that is first run when
-# any executable that is statically-linked with Bionic
-# runs.
-#
-# it's purpose is to call __libc_init with appropriate
-# arguments, which are:
-#
-#    - the address of the raw data block setup by the Linux
-#      kernel ELF loader
-#
-#    - address of an "onexit" function, not used on any
-#      platform supported by Bionic
-#
-#    - address of the "main" function of the program. We
-#      can't hard-code it in the adr pseudo instruction
-#      so we use a tiny trampoline that will get relocated
-#      by the dynamic linker before this code runs
-#
-#    - address of the constructor list
-#
-_start:	
-        mov     %esp, %eax
-        # before push arguments, align the stack to a 16 byte boundary
-        andl    $~15, %esp
-        mov     $1f, %edx
-        pushl   %edx
-        mov     $0f, %edx
-        pushl   %edx
-        mov     $0, %edx
-        pushl   %edx
-        pushl   %eax
-        call    __libc_init
-
-0:  jmp   main
-
-1:  .long   __PREINIT_ARRAY__
-    .long   __INIT_ARRAY__
-    .long   __FINI_ARRAY__
-
-	.section .preinit_array, "aw"
-	.globl __PREINIT_ARRAY__
-__PREINIT_ARRAY__:
-	.long -1
-
-	.section .init_array, "aw"
-	.globl __INIT_ARRAY__
-__INIT_ARRAY__:
-	.long -1
-	.long	frame_dummy
-
-	.section .fini_array, "aw"
-	.globl __FINI_ARRAY__
-__FINI_ARRAY__:
-	.long -1
-	.long	__do_global_dtors_aux
-
-	.section	.eh_frame,"a",@progbits
-	.align 4
-	.type	__EH_FRAME_BEGIN__, @object
-__EH_FRAME_BEGIN__:
-	.text
-	.p2align 4,,15
-	.type	__do_global_dtors_aux, @function
-__do_global_dtors_aux:
-	pushl	%ebp
-	movl	%esp, %ebp
-	subl	$24, %esp
-	cmpb	$0, completed.4454
-	jne	.L4
-	movl	$__deregister_frame_info_bases, %eax
-	testl	%eax, %eax
-	je	.L3
-	movl	$__EH_FRAME_BEGIN__, (%esp)
-	call	__deregister_frame_info_bases
-.L3:
-	movb	$1, completed.4454
-.L4:
-	leave
-	ret
-	.text
-	.p2align 4,,15
-	.type	frame_dummy, @function
-frame_dummy:
-	pushl	%ebp
-	movl	$__register_frame_info_bases, %eax
-	movl	%esp, %ebp
-	subl	$24, %esp
-	testl	%eax, %eax
-	je	.L7
-	movl	%ebx, 12(%esp)
-	movl	$0, 8(%esp)
-	movl	$object.4466, 4(%esp)
-	movl	$__EH_FRAME_BEGIN__, (%esp)
-	call	__register_frame_info_bases
-.L7:
-	leave
-	ret
-	.local	completed.4454
-	.comm	completed.4454,1,1
-	.local	object.4466
-	.comm	object.4466,24,4
-	.weak	__register_frame_info_bases
-	.weak	__deregister_frame_info_bases
-
-#include "__dso_handle.S"
-#include "atexit.S"
-#include "__stack_chk_fail_local.S"
diff --git a/libc/bionic/dlmalloc.c b/libc/bionic/dlmalloc.c
index 98ea9e9..f88a813 100644
--- a/libc/bionic/dlmalloc.c
+++ b/libc/bionic/dlmalloc.c
@@ -2290,7 +2290,22 @@
 
 #  include <private/logd.h>
 
-static void __bionic_heap_error(const char* msg, const char* function)
+/* Convert a pointer into hex string */
+static void __bionic_itox(char* hex, void* ptr)
+{
+    intptr_t val = (intptr_t) ptr;
+    /* Terminate with NULL */
+    hex[8] = 0;
+    int i;
+
+    for (i = 7; i >= 0; i--) {
+        int digit = val & 15;
+        hex[i] = (digit <= 9) ? digit + '0' : digit - 10 + 'a';
+        val >>= 4;
+    }
+}
+
+static void __bionic_heap_error(const char* msg, const char* function, void* p)
 {
     /* We format the buffer explicitely, i.e. without using snprintf()
      * which may use malloc() internally. Not something we can trust
@@ -2303,23 +2318,33 @@
         strlcat(buffer, " IN ", sizeof(buffer));
         strlcat(buffer, function, sizeof(buffer));
     }
+
+    if (p != NULL) {
+        char hexbuffer[9];
+        __bionic_itox(hexbuffer, p);
+        strlcat(buffer, " addr=0x", sizeof(buffer));
+        strlcat(buffer, hexbuffer, sizeof(buffer));
+    }
+
     __libc_android_log_write(ANDROID_LOG_FATAL,"libc",buffer);
-    abort();
+
+    /* So that we can get a memory dump around p */
+    *((int **) 0xdeadbaad) = (int *) p;
 }
 
 #  ifndef CORRUPTION_ERROR_ACTION
-#    define CORRUPTION_ERROR_ACTION(m)  \
-    __bionic_heap_error("HEAP MEMORY CORRUPTION", __FUNCTION__)
+#    define CORRUPTION_ERROR_ACTION(m,p)  \
+    __bionic_heap_error("HEAP MEMORY CORRUPTION", __FUNCTION__, p)
 #  endif
 #  ifndef USAGE_ERROR_ACTION
 #    define USAGE_ERROR_ACTION(m,p)   \
-    __bionic_heap_error("INVALID HEAP ADDRESS", __FUNCTION__)
+    __bionic_heap_error("INVALID HEAP ADDRESS", __FUNCTION__, p)
 #  endif
 
 #else /* !LOG_ON_HEAP_ERROR */
 
 #  ifndef CORRUPTION_ERROR_ACTION
-#    define CORRUPTION_ERROR_ACTION(m) ABORT
+#    define CORRUPTION_ERROR_ACTION(m,p) ABORT
 #  endif /* CORRUPTION_ERROR_ACTION */
 
 #  ifndef USAGE_ERROR_ACTION
@@ -3056,7 +3081,7 @@
   else if (RTCHECK(ok_address(M, B->fd)))\
     F = B->fd;\
   else {\
-    CORRUPTION_ERROR_ACTION(M);\
+    CORRUPTION_ERROR_ACTION(M, B);\
   }\
   B->fd = P;\
   F->bk = P;\
@@ -3073,7 +3098,7 @@
   mchunkptr B = P->bk;\
   bindex_t I = small_index(S);\
   if (__builtin_expect (F->bk != P || B->fd != P, 0))\
-    CORRUPTION_ERROR_ACTION(M);\
+    CORRUPTION_ERROR_ACTION(M, P);\
   assert(P != B);\
   assert(P != F);\
   assert(chunksize(P) == small_index2size(I));\
@@ -3085,7 +3110,7 @@
     B->fd = F;\
   }\
   else {\
-    CORRUPTION_ERROR_ACTION(M);\
+    CORRUPTION_ERROR_ACTION(M, P);\
   }\
 }
 
@@ -3096,7 +3121,7 @@
 #define unlink_first_small_chunk(M, B, P, I) {\
   mchunkptr F = P->fd;\
   if (__builtin_expect (F->bk != P || B->fd != P, 0))\
-    CORRUPTION_ERROR_ACTION(M);\
+    CORRUPTION_ERROR_ACTION(M, P);\
   assert(P != B);\
   assert(P != F);\
   assert(chunksize(P) == small_index2size(I));\
@@ -3107,7 +3132,7 @@
     F->bk = B;\
   }\
   else {\
-    CORRUPTION_ERROR_ACTION(M);\
+    CORRUPTION_ERROR_ACTION(M, P);\
   }\
 }
 
@@ -3156,7 +3181,7 @@
           break;\
         }\
         else {\
-          CORRUPTION_ERROR_ACTION(M);\
+          CORRUPTION_ERROR_ACTION(M, C);\
           break;\
         }\
       }\
@@ -3170,7 +3195,7 @@
           break;\
         }\
         else {\
-          CORRUPTION_ERROR_ACTION(M);\
+          CORRUPTION_ERROR_ACTION(M, F);\
           break;\
         }\
       }\
@@ -3205,13 +3230,13 @@
     tchunkptr F = X->fd;\
     R = X->bk;\
     if (__builtin_expect (F->bk != X || R->fd != X, 0))\
-      CORRUPTION_ERROR_ACTION(M);\
+      CORRUPTION_ERROR_ACTION(M, X);\
     if (RTCHECK(ok_address(M, F))) {\
       F->bk = R;\
       R->fd = F;\
     }\
     else {\
-      CORRUPTION_ERROR_ACTION(M);\
+      CORRUPTION_ERROR_ACTION(M, F);\
     }\
   }\
   else {\
@@ -3226,7 +3251,7 @@
       if (RTCHECK(ok_address(M, RP)))\
         *RP = 0;\
       else {\
-        CORRUPTION_ERROR_ACTION(M);\
+        CORRUPTION_ERROR_ACTION(M, RP);\
       }\
     }\
   }\
@@ -3243,7 +3268,7 @@
         XP->child[1] = R;\
     }\
     else\
-      CORRUPTION_ERROR_ACTION(M);\
+      CORRUPTION_ERROR_ACTION(M, XP);\
     if (R != 0) {\
       if (RTCHECK(ok_address(M, R))) {\
         tchunkptr C0, C1;\
@@ -3254,7 +3279,7 @@
             C0->parent = R;\
           }\
           else\
-            CORRUPTION_ERROR_ACTION(M);\
+            CORRUPTION_ERROR_ACTION(M, C0);\
         }\
         if ((C1 = X->child[1]) != 0) {\
           if (RTCHECK(ok_address(M, C1))) {\
@@ -3262,11 +3287,11 @@
             C1->parent = R;\
           }\
           else\
-            CORRUPTION_ERROR_ACTION(M);\
+            CORRUPTION_ERROR_ACTION(M, C1);\
         }\
       }\
       else\
-        CORRUPTION_ERROR_ACTION(M);\
+        CORRUPTION_ERROR_ACTION(M, R);\
     }\
   }\
 }
@@ -3917,7 +3942,7 @@
         return chunk2mem(v);
       }
     }
-    CORRUPTION_ERROR_ACTION(m);
+    CORRUPTION_ERROR_ACTION(m, v);
   }
   return 0;
 }
@@ -3957,7 +3982,7 @@
     }
   }
 
-  CORRUPTION_ERROR_ACTION(m);
+  CORRUPTION_ERROR_ACTION(m, v);
   return 0;
 }
 
diff --git a/libc/bionic/libc_init_common.c b/libc/bionic/libc_init_common.c
index 7fb1246..4ce4db6 100644
--- a/libc/bionic/libc_init_common.c
+++ b/libc/bionic/libc_init_common.c
@@ -138,4 +138,12 @@
 
         func();
     }
+
+#ifndef LIBC_STATIC
+    {
+        extern void __libc_postfini(void) __attribute__((weak));
+        if (__libc_postfini)
+            __libc_postfini();
+    }
+#endif
 }
diff --git a/libc/bionic/libc_init_dynamic.c b/libc/bionic/libc_init_dynamic.c
index 1c8480c..3a7e8e2 100644
--- a/libc/bionic/libc_init_dynamic.c
+++ b/libc/bionic/libc_init_dynamic.c
@@ -89,6 +89,12 @@
     malloc_debug_init();
 }
 
+void __libc_postfini(void)
+{
+    extern void malloc_debug_fini(void);
+    malloc_debug_fini();
+}
+
 /* This function is called from the executable's _start entry point
  * (see arch-$ARCH/bionic/crtbegin_dynamic.S), which is itself
  * called by the dynamic linker after it has loaded all shared
diff --git a/libc/bionic/logd_write.c b/libc/bionic/logd_write.c
index 2bc39fa..ac71689 100644
--- a/libc/bionic/logd_write.c
+++ b/libc/bionic/logd_write.c
@@ -64,6 +64,7 @@
     LOG_ID_NONE = 0,
     LOG_ID_MAIN,
     LOG_ID_RADIO,
+    LOG_ID_EVENTS,
     LOG_ID_MAX
 } log_id_t;
 
@@ -84,7 +85,8 @@
 static log_channel_t log_channels[LOG_ID_MAX] = {
     { __write_to_log_null, -1, NULL },
     { __write_to_log_init, -1, "/dev/"LOGGER_LOG_MAIN },
-    { __write_to_log_init, -1, "/dev/"LOGGER_LOG_RADIO }
+    { __write_to_log_init, -1, "/dev/"LOGGER_LOG_RADIO },
+    { __write_to_log_init, -1, "/dev/"LOGGER_LOG_EVENTS }
 };
 
 /* Important: see technical note at start of source file */
@@ -207,3 +209,41 @@
 
     return -1;
 }
+
+/*
+ * Event logging.
+ */
+
+// must be kept in sync with frameworks/base/core/java/android/util/EventLog.java
+typedef enum {
+    EVENT_TYPE_INT      = 0,
+    EVENT_TYPE_LONG     = 1,
+    EVENT_TYPE_STRING   = 2,
+    EVENT_TYPE_LIST     = 3,
+} AndroidEventLogType;
+
+static int __libc_android_log_btwrite(int32_t tag, char type, const void *payload, size_t len)
+{
+    struct iovec vec[3];
+
+    vec[0].iov_base = &tag;
+    vec[0].iov_len = sizeof(tag);
+    vec[1].iov_base = &type;
+    vec[1].iov_len = sizeof(type);
+    vec[2].iov_base = (void*)payload;
+    vec[2].iov_len = len;
+
+    return log_channels[LOG_ID_EVENTS].logger(LOG_ID_EVENTS, vec);
+}
+
+__LIBC_HIDDEN__
+void __libc_android_log_event_int(int32_t tag, int value)
+{
+    __libc_android_log_btwrite(tag, EVENT_TYPE_INT, &value, sizeof(value));
+}
+
+__LIBC_HIDDEN__
+void __libc_android_log_event_uid(int32_t tag)
+{
+    __libc_android_log_event_int(tag, getuid());
+}
diff --git a/libc/bionic/malloc_debug_check.c b/libc/bionic/malloc_debug_check.c
new file mode 100644
index 0000000..4ae21fe
--- /dev/null
+++ b/libc/bionic/malloc_debug_check.c
@@ -0,0 +1,574 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <errno.h>
+#include <pthread.h>
+#include <time.h>
+#include <stdio.h>
+#include <arpa/inet.h>
+#include <sys/socket.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <unwind.h>
+#include <dlfcn.h>
+#include <stdbool.h>
+
+#include <sys/types.h>
+#include <sys/system_properties.h>
+
+#include "dlmalloc.h"
+#include "logd.h"
+
+#include "malloc_debug_common.h"
+#include "malloc_debug_check_mapinfo.h"
+
+static mapinfo *milist;
+
+/* libc.debug.malloc.backlog */
+extern unsigned int malloc_double_free_backlog;
+
+#define MAX_BACKTRACE_DEPTH 15
+#define ALLOCATION_TAG      0x1ee7d00d
+#define BACKLOG_TAG         0xbabecafe
+#define FREE_POISON         0xa5
+#define BACKLOG_DEFAULT_LEN 100
+#define FRONT_GUARD         0xaa
+#define FRONT_GUARD_LEN     (1<<5)
+#define REAR_GUARD          0xbb
+#define REAR_GUARD_LEN      (1<<5)
+
+static void print_backtrace(const intptr_t *bt, unsigned int depth);
+
+static void log_message(const char* format, ...)
+{
+    extern pthread_mutex_t gAllocationsMutex;
+    extern const MallocDebug __libc_malloc_default_dispatch;
+    extern const MallocDebug* __libc_malloc_dispatch;
+
+    va_list  args;
+
+    pthread_mutex_lock(&gAllocationsMutex);
+    {
+        const MallocDebug* current_dispatch = __libc_malloc_dispatch;
+        __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
+        va_start(args, format);
+        __libc_android_log_vprint(ANDROID_LOG_ERROR, "libc",
+                                format, args);
+        va_end(args);
+        __libc_malloc_dispatch = current_dispatch;
+    }
+    pthread_mutex_unlock(&gAllocationsMutex);
+}
+
+struct hdr {
+    uint32_t tag;
+    struct hdr *prev;
+    struct hdr *next;
+    intptr_t bt[MAX_BACKTRACE_DEPTH];
+    int bt_depth;
+    intptr_t freed_bt[MAX_BACKTRACE_DEPTH];
+    int freed_bt_depth;
+    size_t size;
+    char front_guard[FRONT_GUARD_LEN];
+} __attribute__((packed));
+
+struct ftr {
+    char rear_guard[REAR_GUARD_LEN];
+} __attribute__((packed));
+
+static inline struct ftr * to_ftr(struct hdr *hdr)
+{
+    return (struct ftr *)(((char *)(hdr + 1)) + hdr->size);
+}
+
+static inline void *user(struct hdr *hdr)
+{
+    return hdr + 1;
+}
+
+static inline struct hdr *meta(void *user)
+{
+    return ((struct hdr *)user) - 1;
+}
+
+/* Call this on exit() to get leaked memory */
+void free_leaked_memory(void);
+
+static unsigned num;
+static struct hdr *tail;
+static struct hdr *head;
+static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
+
+static unsigned backlog_num;
+static struct hdr *backlog_tail;
+static struct hdr *backlog_head;
+static pthread_mutex_t backlog_lock = PTHREAD_MUTEX_INITIALIZER;
+
+extern __LIBC_HIDDEN__
+int get_backtrace(intptr_t* addrs, size_t max_entries);
+
+static void print_backtrace(const intptr_t *bt, unsigned int depth)
+{
+    const mapinfo *mi;
+    unsigned int cnt;
+    unsigned int rel_pc;
+    intptr_t self_bt[MAX_BACKTRACE_DEPTH];
+
+    if (!bt) {
+        depth = get_backtrace(self_bt, MAX_BACKTRACE_DEPTH);
+        bt = self_bt;
+    }
+
+    log_message("*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n");
+    for (cnt = 0; cnt < depth && cnt < MAX_BACKTRACE_DEPTH; cnt++) {
+        mi = pc_to_mapinfo(milist, bt[cnt], &rel_pc);
+        log_message("\t#%02d  pc %08x  %s\n", cnt,
+                   mi ? (intptr_t)rel_pc : bt[cnt],
+                   mi ? mi->name : "(unknown)");
+    }
+}
+
+static inline void init_front_guard(struct hdr *hdr)
+{
+    memset(hdr->front_guard, FRONT_GUARD, FRONT_GUARD_LEN);
+}
+
+static inline bool is_front_guard_valid(struct hdr *hdr)
+{
+    unsigned i;
+    for (i = 0; i < FRONT_GUARD_LEN; i++)
+        if (hdr->front_guard[i] != FRONT_GUARD)
+            return 0;
+    return 1;
+}
+
+static inline void init_rear_guard(struct hdr *hdr)
+{
+    struct ftr *ftr = to_ftr(hdr);
+    memset(ftr->rear_guard, REAR_GUARD, REAR_GUARD_LEN);
+}
+
+static inline bool is_rear_guard_valid(struct hdr *hdr)
+{
+    unsigned i;
+    int valid = 1;
+    int first_mismatch = -1;
+    struct ftr *ftr = to_ftr(hdr);
+    for (i = 0; i < REAR_GUARD_LEN; i++) {
+        if (ftr->rear_guard[i] != REAR_GUARD) {
+            if (first_mismatch < 0)
+                first_mismatch = i;
+            valid = 0;
+        }
+        else if (first_mismatch >= 0) {
+            log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
+            first_mismatch = -1;
+        }
+    }
+
+    if (first_mismatch >= 0)
+        log_message("+++ REAR GUARD MISMATCH [%d, %d)\n", first_mismatch, i);
+    return valid;
+}
+
+static inline void add_locked(struct hdr *hdr, struct hdr **tail, struct hdr **head)
+{
+    hdr->prev = NULL;
+    hdr->next = *head;
+    if (*head)
+        (*head)->prev = hdr;
+    else
+        *tail = hdr;
+    *head = hdr;
+}
+
+static inline int del_locked(struct hdr *hdr, struct hdr **tail, struct hdr **head)
+{
+    if (hdr->prev)
+        hdr->prev->next = hdr->next;
+    else
+        *head = hdr->next;
+    if (hdr->next)
+        hdr->next->prev = hdr->prev;
+    else
+        *tail = hdr->prev;
+    return 0;
+}
+
+static inline void add(struct hdr *hdr, size_t size)
+{
+    pthread_mutex_lock(&lock);
+    hdr->tag = ALLOCATION_TAG;
+    hdr->size = size;
+    init_front_guard(hdr);
+    init_rear_guard(hdr);
+    num++;
+    add_locked(hdr, &tail, &head);
+    pthread_mutex_unlock(&lock);
+}
+
+static inline int del(struct hdr *hdr)
+{
+    if (hdr->tag != ALLOCATION_TAG)
+        return -1;
+
+    pthread_mutex_lock(&lock);
+    del_locked(hdr, &tail, &head);
+    num--;
+    pthread_mutex_unlock(&lock);
+    return 0;
+}
+
+static inline void poison(struct hdr *hdr)
+{
+    memset(user(hdr), FREE_POISON, hdr->size);
+}
+
+static int was_used_after_free(struct hdr *hdr)
+{
+    unsigned i;
+    const char *data = (const char *)user(hdr);
+    for (i = 0; i < hdr->size; i++)
+        if (data[i] != FREE_POISON)
+            return 1;
+    return 0;
+}
+
+/* returns 1 if valid, *safe == 1 if safe to dump stack */
+static inline int check_guards(struct hdr *hdr, int *safe)
+{
+    *safe = 1;
+    if (!is_front_guard_valid(hdr)) {
+        if (hdr->front_guard[0] == FRONT_GUARD) {
+            log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED FRONT GUARD\n",
+                       user(hdr), hdr->size);
+        } else {
+            log_message("+++ ALLOCATION %p HAS A CORRUPTED FRONT GUARD "\
+                      "(NOT DUMPING STACKTRACE)\n", user(hdr));
+            /* Allocation header is probably corrupt, do not print stack trace */
+            *safe = 0;
+        }
+        return 0;
+    }
+
+    if (!is_rear_guard_valid(hdr)) {
+        log_message("+++ ALLOCATION %p SIZE %d HAS A CORRUPTED REAR GUARD\n",
+                   user(hdr), hdr->size);
+        return 0;
+    }
+
+    return 1;
+}
+
+/* returns 1 if valid, *safe == 1 if safe to dump stack */
+static inline int check_allocation_locked(struct hdr *hdr, int *safe)
+{
+    int valid = 1;
+    *safe = 1;
+
+    if (hdr->tag != ALLOCATION_TAG && hdr->tag != BACKLOG_TAG) {
+        log_message("+++ ALLOCATION %p HAS INVALID TAG %08x (NOT DUMPING STACKTRACE)\n",
+                   user(hdr), hdr->tag);
+	/* Allocation header is probably corrupt, do not dequeue or dump stack
+         * trace.
+         */
+        *safe = 0;
+        return 0;
+    }
+
+    if (hdr->tag == BACKLOG_TAG && was_used_after_free(hdr)) {
+        log_message("+++ ALLOCATION %p SIZE %d WAS USED AFTER BEING FREED\n",
+                   user(hdr), hdr->size);
+        valid = 0;
+	/* check the guards to see if it's safe to dump a stack trace */
+        (void)check_guards(hdr, safe);
+    }
+    else
+        valid = check_guards(hdr, safe);
+
+    if (!valid && *safe) {
+        log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+                        user(hdr), hdr->size);
+        print_backtrace(hdr->bt, hdr->bt_depth);
+        if (hdr->tag == BACKLOG_TAG) {
+            log_message("+++ ALLOCATION %p SIZE %d FREED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
+        }
+    }
+
+    return valid;
+}
+
+static inline int del_and_check_locked(struct hdr *hdr,
+                                   struct hdr **tail, struct hdr **head, unsigned *cnt,
+                                   int *safe)
+{
+    int valid;
+    valid = check_allocation_locked(hdr, safe);
+    if (safe) {
+        (*cnt)--;
+        del_locked(hdr, tail, head);
+    }
+    return valid;
+}
+
+static inline void del_from_backlog_locked(struct hdr *hdr)
+{
+        int safe;
+        (void)del_and_check_locked(hdr,
+                              &backlog_tail, &backlog_head, &backlog_num,
+                              &safe);
+        hdr->tag = 0; /* clear the tag */
+}
+
+static inline void del_from_backlog(struct hdr *hdr)
+{
+    pthread_mutex_lock(&backlog_lock);
+    del_from_backlog_locked(hdr);
+    pthread_mutex_unlock(&backlog_lock);
+}
+
+static inline int del_leak(struct hdr *hdr, int *safe)
+{
+    int valid;
+    pthread_mutex_lock(&lock);
+    valid = del_and_check_locked(hdr,
+                            &tail, &head, &num,
+                            safe);
+    pthread_mutex_unlock(&lock);
+    return valid;
+}
+
+static inline void add_to_backlog(struct hdr *hdr)
+{
+    pthread_mutex_lock(&backlog_lock);
+    hdr->tag = BACKLOG_TAG;
+    backlog_num++;
+    add_locked(hdr, &backlog_tail, &backlog_head);
+    poison(hdr);
+    /* If we've exceeded the maximum backlog, clear it up */
+    while (backlog_num > malloc_double_free_backlog) {
+        struct hdr *gone = backlog_tail;
+        del_from_backlog_locked(gone);
+        dlfree(gone);
+    }
+    pthread_mutex_unlock(&backlog_lock);
+}
+
+void* chk_malloc(size_t size)
+{
+    struct hdr *hdr;
+
+//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
+
+    hdr = dlmalloc(sizeof(struct hdr) + size + sizeof(struct ftr));
+    if (hdr) {
+        hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
+        add(hdr, size);
+        return user(hdr);
+    }
+    return NULL;
+}
+
+void* chk_memalign(size_t alignment, size_t bytes)
+{
+//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
+    // XXX: it's better to use malloc, than being wrong
+    return chk_malloc(bytes);
+}
+
+void chk_free(void *ptr)
+{
+    struct hdr *hdr;
+
+//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
+
+    if (!ptr) /* ignore free(NULL) */
+        return;
+
+    hdr = meta(ptr);
+
+    if (del(hdr) < 0) {
+        intptr_t bt[MAX_BACKTRACE_DEPTH];
+        int depth;
+        depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
+        if (hdr->tag == BACKLOG_TAG) {
+            log_message("+++ ALLOCATION %p SIZE %d BYTES MULTIPLY FREED!\n",
+                       user(hdr), hdr->size);
+            log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(hdr->bt, hdr->bt_depth);
+            /* hdr->freed_bt_depth should be nonzero here */
+            log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
+            log_message("+++ ALLOCATION %p SIZE %d NOW BEING FREED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(bt, depth);
+        }
+        else {
+            log_message("+++ ALLOCATION %p IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
+                       user(hdr));
+            print_backtrace(bt, depth);
+            /* Leak here so that we do not crash */
+            //dlfree(user(hdr));
+        }
+    }
+    else {
+        hdr->freed_bt_depth = get_backtrace(hdr->freed_bt,
+                                      MAX_BACKTRACE_DEPTH);
+        add_to_backlog(hdr);
+    }
+}
+
+void *chk_realloc(void *ptr, size_t size)
+{
+    struct hdr *hdr;
+
+//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
+
+    if (!size) {
+        chk_free(ptr);
+        return NULL;
+    }
+
+    if (!ptr)
+        return chk_malloc(size);
+
+    hdr = meta(ptr);
+
+    if (del(hdr) < 0) {
+        intptr_t bt[MAX_BACKTRACE_DEPTH];
+        int depth;
+        depth = get_backtrace(bt, MAX_BACKTRACE_DEPTH);
+        if (hdr->tag == BACKLOG_TAG) {
+            log_message("+++ REALLOCATION %p SIZE %d OF FREED MEMORY!\n",
+                       user(hdr), size, hdr->size);
+            log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(hdr->bt, hdr->bt_depth);
+            /* hdr->freed_bt_depth should be nonzero here */
+            log_message("+++ ALLOCATION %p SIZE %d FIRST FREED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(hdr->freed_bt, hdr->freed_bt_depth);
+            log_message("+++ ALLOCATION %p SIZE %d NOW BEING REALLOCATED HERE:\n",
+                       user(hdr), hdr->size);
+            print_backtrace(bt, depth);
+
+             /* We take the memory out of the backlog and fall through so the
+             * reallocation below succeeds.  Since we didn't really free it, we
+             * can default to this behavior.
+             */
+            del_from_backlog(hdr);
+        }
+        else {
+            log_message("+++ REALLOCATION %p SIZE %d IS CORRUPTED OR NOT ALLOCATED VIA TRACKER!\n",
+                       user(hdr), size);
+            print_backtrace(bt, depth);
+            // just get a whole new allocation and leak the old one
+            return dlrealloc(0, size);
+            // return dlrealloc(user(hdr), size); // assuming it was allocated externally
+        }
+    }
+
+    hdr = dlrealloc(hdr, sizeof(struct hdr) + size + sizeof(struct ftr));
+    if (hdr) {
+        hdr->bt_depth = get_backtrace(hdr->bt, MAX_BACKTRACE_DEPTH);
+        add(hdr, size);
+        return user(hdr);
+    }
+
+    return NULL;
+}
+
+void *chk_calloc(int nmemb, size_t size)
+{
+//  log_message("%s: %s\n", __FILE__, __FUNCTION__);
+    struct hdr *hdr;
+    size_t total_size = nmemb * size;
+    hdr = dlcalloc(1, sizeof(struct hdr) + total_size + sizeof(struct ftr));
+    if (hdr) {
+        hdr->bt_depth = get_backtrace(
+                            hdr->bt, MAX_BACKTRACE_DEPTH);
+        add(hdr, total_size);
+        return user(hdr);
+    }
+    return NULL;
+}
+
+static void heaptracker_free_leaked_memory(void)
+{
+    struct hdr *del; int cnt;
+
+    if (num)
+        log_message("+++ THERE ARE %d LEAKED ALLOCATIONS\n", num);
+
+    while (head) {
+        int safe;
+        del = head;
+        log_message("+++ DELETING %d BYTES OF LEAKED MEMORY AT %p (%d REMAINING)\n",
+                del->size, user(del), num);
+        if (del_leak(del, &safe)) {
+            /* safe == 1, because the allocation is valid */
+            log_message("+++ ALLOCATION %p SIZE %d ALLOCATED HERE:\n",
+                        user(del), del->size);
+            print_backtrace(del->bt, del->bt_depth);
+        }
+        dlfree(del);
+    }
+
+//  log_message("+++ DELETING %d BACKLOGGED ALLOCATIONS\n", backlog_num);
+    while (backlog_head) {
+	del = backlog_tail;
+        del_from_backlog(del);
+        dlfree(del);
+    }
+}
+
+/* Initializes malloc debugging framework.
+ * See comments on MallocDebugInit in malloc_debug_common.h
+ */
+int malloc_debug_initialize(void)
+{
+    if (!malloc_double_free_backlog)
+        malloc_double_free_backlog = BACKLOG_DEFAULT_LEN;
+    milist = init_mapinfo(getpid());
+    return 0;
+}
+
+void malloc_debug_finalize(void)
+{
+    heaptracker_free_leaked_memory();
+    deinit_mapinfo(milist);
+}
diff --git a/libc/bionic/malloc_debug_check_mapinfo.c b/libc/bionic/malloc_debug_check_mapinfo.c
new file mode 100644
index 0000000..044fc65
--- /dev/null
+++ b/libc/bionic/malloc_debug_check_mapinfo.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "dlmalloc.h"
+#include "malloc_debug_check_mapinfo.h"
+
+// 6f000000-6f01e000 rwxp 00000000 00:0c 16389419   /system/lib/libcomposer.so
+// 012345678901234567890123456789012345678901234567890123456789
+// 0         1         2         3         4         5
+
+static mapinfo *parse_maps_line(char *line)
+{
+    mapinfo *mi;
+    int len = strlen(line);
+
+    if(len < 1) return 0;
+    line[--len] = 0;
+
+    if(len < 50) return 0;
+    if(line[20] != 'x') return 0;
+
+    mi = dlmalloc(sizeof(mapinfo) + (len - 47));
+    if(mi == 0) return 0;
+
+    mi->start = strtoul(line, 0, 16);
+    mi->end = strtoul(line + 9, 0, 16);
+    /* To be filled in parse_elf_info if the mapped section starts with
+     * elf_header
+     */
+    mi->next = 0;
+    strcpy(mi->name, line + 49);
+
+    return mi;
+}
+
+__LIBC_HIDDEN__
+mapinfo *init_mapinfo(int pid)
+{
+    struct mapinfo *milist = NULL;
+    char data[1024];
+    sprintf(data, "/proc/%d/maps", pid);
+    FILE *fp = fopen(data, "r");
+    if(fp) {
+        while(fgets(data, sizeof(data), fp)) {
+            mapinfo *mi = parse_maps_line(data);
+            if(mi) {
+                mi->next = milist;
+                milist = mi;
+            }
+        }
+        fclose(fp);
+    }
+
+    return milist;
+}
+
+__LIBC_HIDDEN__
+void deinit_mapinfo(mapinfo *mi)
+{
+   mapinfo *del;
+   while(mi) {
+       del = mi;
+       mi = mi->next;
+       dlfree(del);
+   }
+}
+
+/* Map a pc address to the name of the containing ELF file */
+__LIBC_HIDDEN__
+const char *map_to_name(mapinfo *mi, unsigned pc, const char* def)
+{
+    while(mi) {
+        if((pc >= mi->start) && (pc < mi->end)){
+            return mi->name;
+        }
+        mi = mi->next;
+    }
+    return def;
+}
+
+/* Find the containing map info for the pc */
+__LIBC_HIDDEN__
+const mapinfo *pc_to_mapinfo(mapinfo *mi, unsigned pc, unsigned *rel_pc)
+{
+    *rel_pc = pc;
+    while(mi) {
+        if((pc >= mi->start) && (pc < mi->end)){
+            // Only calculate the relative offset for shared libraries
+            if (strstr(mi->name, ".so")) {
+                *rel_pc -= mi->start;
+            }
+            return mi;
+        }
+        mi = mi->next;
+    }
+    return NULL;
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/bionic/malloc_debug_check_mapinfo.h
similarity index 68%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/bionic/malloc_debug_check_mapinfo.h
index beea685..8a01cd3 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/bionic/malloc_debug_check_mapinfo.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,21 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#ifndef MALLOC_DEBUG_CHECK_MAPINFO_H
+#define MALLOC_DEBUG_CHECK_MAPINFO_H
+
+#include <sys/cdefs.h>
+
+typedef struct mapinfo {
+    struct mapinfo *next;
+    unsigned start;
+    unsigned end;
+    char name[];
+} mapinfo;
+
+__LIBC_HIDDEN__ mapinfo *init_mapinfo(int pid);
+__LIBC_HIDDEN__ void deinit_mapinfo(mapinfo *mi);
+__LIBC_HIDDEN__ const char *map_to_name(mapinfo *mi, unsigned pc, const char* def);
+__LIBC_HIDDEN__ const mapinfo *pc_to_mapinfo(mapinfo *mi, unsigned pc, unsigned *rel_pc);
+
+#endif/*MALLOC_DEBUG_CHECK_MAPINFO_H*/
diff --git a/libc/bionic/malloc_debug_common.c b/libc/bionic/malloc_debug_common.c
index b9fcbc4..4105ab8 100644
--- a/libc/bionic/malloc_debug_common.c
+++ b/libc/bionic/malloc_debug_common.c
@@ -240,17 +240,6 @@
 #include <dlfcn.h>
 #include "logd.h"
 
-// =============================================================================
-// log functions
-// =============================================================================
-
-#define debug_log(format, ...)  \
-   __libc_android_log_print(ANDROID_LOG_DEBUG, "libc", (format), ##__VA_ARGS__ )
-#define error_log(format, ...)  \
-   __libc_android_log_print(ANDROID_LOG_ERROR, "libc", (format), ##__VA_ARGS__ )
-#define info_log(format, ...)  \
-   __libc_android_log_print(ANDROID_LOG_INFO, "libc", (format), ##__VA_ARGS__ )
-
 /* Table for dispatching malloc calls, depending on environment. */
 static MallocDebug gMallocUse __attribute__((aligned(32))) = {
     dlmalloc, dlfree, dlcalloc, dlrealloc, dlmemalign
@@ -288,6 +277,14 @@
 #define MALLOC_ALIGNMENT ((size_t)8U)
 #endif  /* MALLOC_ALIGNMENT */
 
+/* This variable is set to the value of property libc.debug.malloc.backlog,
+ * when the value of libc.debug.malloc = 10.  It determines the size of the
+ * backlog we use to detect multiple frees.  If the property is not set, the
+ * backlog length defaults to an internal constant defined in
+ * malloc_debug_check.c
+ */
+unsigned int malloc_double_free_backlog;
+
 /* Initializes memory allocation framework once per process. */
 static void malloc_init_impl(void)
 {
@@ -298,6 +295,7 @@
     unsigned int memcheck_enabled = 0;
     char env[PROP_VALUE_MAX];
     char memcheck_tracing[PROP_VALUE_MAX];
+    char debug_program[PROP_VALUE_MAX];
 
     /* Get custom malloc debug level. Note that emulator started with
      * memory checking option will have priority over debug level set in
@@ -325,13 +323,30 @@
         return;
     }
 
+    /* If libc.debug.malloc.program is set and is not a substring of progname,
+     * then exit.
+     */
+    if (__system_property_get("libc.debug.malloc.program", debug_program)) {
+        if (!strstr(__progname, debug_program)) {
+            return;
+        }
+    }
+
     // Lets see which .so must be loaded for the requested debug level
     switch (debug_level) {
         case 1:
         case 5:
-        case 10:
+        case 10: {
+            char debug_backlog[PROP_VALUE_MAX];
+            if (__system_property_get("libc.debug.malloc.backlog", debug_backlog)) {
+                malloc_double_free_backlog = atoi(debug_backlog);
+                info_log("%s: setting backlog length to %d\n",
+                         __progname, malloc_double_free_backlog);
+            }
+
             so_name = "/system/lib/libc_malloc_debug_leak.so";
             break;
+        }
         case 20:
             // Quick check: debug level 20 can only be handled in emulator.
             if (!qemu_running) {
@@ -475,7 +490,19 @@
     }
 }
 
+static void malloc_fini_impl(void)
+{
+    if (libc_malloc_impl_handle) {
+        MallocDebugFini malloc_debug_finalize = NULL;
+        malloc_debug_finalize =
+                dlsym(libc_malloc_impl_handle, "malloc_debug_finalize");
+        if (malloc_debug_finalize)
+            malloc_debug_finalize();
+    }
+}
+
 static pthread_once_t  malloc_init_once_ctl = PTHREAD_ONCE_INIT;
+static pthread_once_t  malloc_fini_once_ctl = PTHREAD_ONCE_INIT;
 
 #endif  // !LIBC_STATIC
 #endif  // USE_DL_PREFIX
@@ -494,3 +521,14 @@
     }
 #endif  // USE_DL_PREFIX && !LIBC_STATIC
 }
+
+void malloc_debug_fini(void)
+{
+    /* We need to finalize malloc iff we implement here custom
+     * malloc routines (i.e. USE_DL_PREFIX is defined) for libc.so */
+#if defined(USE_DL_PREFIX) && !defined(LIBC_STATIC)
+    if (pthread_once(&malloc_fini_once_ctl, malloc_fini_impl)) {
+        error_log("Unable to finalize malloc_debug component.");
+    }
+#endif  // USE_DL_PREFIX && !LIBC_STATIC
+}
diff --git a/libc/bionic/malloc_debug_common.h b/libc/bionic/malloc_debug_common.h
index 87600d6..c78846b 100644
--- a/libc/bionic/malloc_debug_common.h
+++ b/libc/bionic/malloc_debug_common.h
@@ -82,15 +82,31 @@
     void* (*memalign)(size_t alignment, size_t bytes);
 };
 
-/* Malloc debugging initialization routine.
- * This routine must be implemented in .so modules that implement malloc
- * debugging. This routine is called once per process from malloc_init_impl
- * routine implemented in bionic/libc/bionic/malloc_debug_common.c when malloc
+/* Malloc debugging initialization and finalization routines.
+ *
+ * These routines must be implemented in .so modules that implement malloc
+ * debugging. The are is called once per process from malloc_init_impl and
+ * malloc_fini_impl respectively.
+ *
+ * They are implemented in bionic/libc/bionic/malloc_debug_common.c when malloc
  * debugging gets initialized for the process.
- * Return:
- *  0 on success, -1 on failure.
+ *
+ * MallocDebugInit returns:
+ *    0 on success, -1 on failure.
  */
 typedef int (*MallocDebugInit)(void);
+typedef void (*MallocDebugFini)(void);
+
+// =============================================================================
+// log functions
+// =============================================================================
+
+#define debug_log(format, ...)  \
+    __libc_android_log_print(ANDROID_LOG_DEBUG, "malloc_leak_check", (format), ##__VA_ARGS__ )
+#define error_log(format, ...)  \
+    __libc_android_log_print(ANDROID_LOG_ERROR, "malloc_leak_check", (format), ##__VA_ARGS__ )
+#define info_log(format, ...)  \
+    __libc_android_log_print(ANDROID_LOG_INFO, "malloc_leak_check", (format), ##__VA_ARGS__ )
 
 #ifdef __cplusplus
 };  /* end of extern "C" */
diff --git a/libc/bionic/malloc_debug_leak.c b/libc/bionic/malloc_debug_leak.c
index e584502..316d5fe 100644
--- a/libc/bionic/malloc_debug_leak.c
+++ b/libc/bionic/malloc_debug_leak.c
@@ -61,22 +61,11 @@
 extern int gMallocLeakZygoteChild;
 extern pthread_mutex_t gAllocationsMutex;
 extern HashTable gHashTable;
-extern const MallocDebug __libc_malloc_default_dispatch;
-extern const MallocDebug* __libc_malloc_dispatch;
 
 // =============================================================================
-// log functions
+// stack trace functions
 // =============================================================================
 
-#define debug_log(format, ...)  \
-    __libc_android_log_print(ANDROID_LOG_DEBUG, "malloc_leak_check", (format), ##__VA_ARGS__ )
-#define error_log(format, ...)  \
-    __libc_android_log_print(ANDROID_LOG_ERROR, "malloc_leak_check", (format), ##__VA_ARGS__ )
-#define info_log(format, ...)  \
-    __libc_android_log_print(ANDROID_LOG_INFO, "malloc_leak_check", (format), ##__VA_ARGS__ )
-
-static int gTrapOnError = 1;
-
 #define MALLOC_ALIGNMENT    8
 #define GUARD               0x48151642
 #define DEBUG               0
@@ -210,250 +199,12 @@
     gHashTable.count--;
 }
 
-
 // =============================================================================
-// stack trace functions
-// =============================================================================
-
-typedef struct
-{
-    size_t count;
-    intptr_t* addrs;
-} stack_crawl_state_t;
-
-
-/* depends how the system includes define this */
-#ifdef HAVE_UNWIND_CONTEXT_STRUCT
-typedef struct _Unwind_Context __unwind_context;
-#else
-typedef _Unwind_Context __unwind_context;
-#endif
-
-static _Unwind_Reason_Code trace_function(__unwind_context *context, void *arg)
-{
-    stack_crawl_state_t* state = (stack_crawl_state_t*)arg;
-    if (state->count) {
-        intptr_t ip = (intptr_t)_Unwind_GetIP(context);
-        if (ip) {
-            state->addrs[0] = ip;
-            state->addrs++;
-            state->count--;
-            return _URC_NO_REASON;
-        }
-    }
-    /*
-     * If we run out of space to record the address or 0 has been seen, stop
-     * unwinding the stack.
-     */
-    return _URC_END_OF_STACK;
-}
-
-static inline
-int get_backtrace(intptr_t* addrs, size_t max_entries)
-{
-    stack_crawl_state_t state;
-    state.count = max_entries;
-    state.addrs = (intptr_t*)addrs;
-    _Unwind_Backtrace(trace_function, (void*)&state);
-    return max_entries - state.count;
-}
-
-// =============================================================================
-// malloc check functions
+// malloc fill functions
 // =============================================================================
 
 #define CHK_FILL_FREE           0xef
 #define CHK_SENTINEL_VALUE      (char)0xeb
-#define CHK_SENTINEL_HEAD_SIZE  16
-#define CHK_SENTINEL_TAIL_SIZE  16
-#define CHK_OVERHEAD_SIZE       (   CHK_SENTINEL_HEAD_SIZE +    \
-                                    CHK_SENTINEL_TAIL_SIZE +    \
-                                    sizeof(size_t) )
-
-static void dump_stack_trace()
-{
-    intptr_t addrs[20];
-    int c = get_backtrace(addrs, 20);
-    char buf[16];
-    char tmp[16*20];
-    int i;
-
-    tmp[0] = 0; // Need to initialize tmp[0] for the first strcat
-    for (i=0 ; i<c; i++) {
-        snprintf(buf, sizeof buf, "%2d: %08x\n", i, addrs[i]);
-        strlcat(tmp, buf, sizeof tmp);
-    }
-    __libc_android_log_print(ANDROID_LOG_ERROR, "libc", "call stack:\n%s", tmp);
-}
-
-static int is_valid_malloc_pointer(void* addr)
-{
-    return 1;
-}
-
-static void assert_log_message(const char* format, ...)
-{
-    va_list  args;
-
-    pthread_mutex_lock(&gAllocationsMutex);
-    {
-        const MallocDebug* current_dispatch = __libc_malloc_dispatch;
-        __libc_malloc_dispatch = &__libc_malloc_default_dispatch;
-        va_start(args, format);
-        __libc_android_log_vprint(ANDROID_LOG_ERROR, "libc",
-                                format, args);
-        va_end(args);
-        dump_stack_trace();
-        if (gTrapOnError) {
-            __builtin_trap();
-        }
-        __libc_malloc_dispatch = current_dispatch;
-    }
-    pthread_mutex_unlock(&gAllocationsMutex);
-}
-
-static void assert_valid_malloc_pointer(void* mem)
-{
-    if (mem && !is_valid_malloc_pointer(mem)) {
-        assert_log_message(
-            "*** MALLOC CHECK: buffer %p, is not a valid "
-            "malloc pointer (are you mixing up new/delete "
-            "and malloc/free?)", mem);
-    }
-}
-
-/* Check that a given address corresponds to a guarded block,
- * and returns its original allocation size in '*allocated'.
- * 'func' is the capitalized name of the caller function.
- * Returns 0 on success, or -1 on failure.
- * NOTE: Does not return if gTrapOnError is set.
- */
-static int chk_mem_check(void*       mem,
-                         size_t*     allocated,
-                         const char* func)
-{
-    char*  buffer;
-    size_t offset, bytes;
-    int    i;
-    char*  buf;
-
-    /* first check the bytes in the sentinel header */
-    buf = (char*)mem - CHK_SENTINEL_HEAD_SIZE;
-    for (i=0 ; i<CHK_SENTINEL_HEAD_SIZE ; i++) {
-        if (buf[i] != CHK_SENTINEL_VALUE) {
-            assert_log_message(
-                "*** %s CHECK: buffer %p "
-                "corrupted %d bytes before allocation",
-                func, mem, CHK_SENTINEL_HEAD_SIZE-i);
-            return -1;
-        }
-    }
-
-    /* then the ones in the sentinel trailer */
-    buffer = (char*)mem - CHK_SENTINEL_HEAD_SIZE;
-    offset = dlmalloc_usable_size(buffer) - sizeof(size_t);
-    bytes  = *(size_t *)(buffer + offset);
-
-    buf = (char*)mem + bytes;
-    for (i=CHK_SENTINEL_TAIL_SIZE-1 ; i>=0 ; i--) {
-        if (buf[i] != CHK_SENTINEL_VALUE) {
-            assert_log_message(
-                "*** %s CHECK: buffer %p, size=%lu, "
-                "corrupted %d bytes after allocation",
-                func, buffer, bytes, i+1);
-            return -1;
-        }
-    }
-
-    *allocated = bytes;
-    return 0;
-}
-
-
-void* chk_malloc(size_t bytes)
-{
-    size_t size = bytes + CHK_OVERHEAD_SIZE;
-    if (size < bytes) { // Overflow.
-        return NULL;
-    }
-    uint8_t* buffer = (uint8_t*) dlmalloc(size);
-    if (buffer) {
-        memset(buffer, CHK_SENTINEL_VALUE, bytes + CHK_OVERHEAD_SIZE);
-        size_t offset = dlmalloc_usable_size(buffer) - sizeof(size_t);
-        *(size_t *)(buffer + offset) = bytes;
-        buffer += CHK_SENTINEL_HEAD_SIZE;
-    }
-    return buffer;
-}
-
-void  chk_free(void* mem)
-{
-    assert_valid_malloc_pointer(mem);
-    if (mem) {
-        size_t  size;
-        char*   buffer;
-
-        if (chk_mem_check(mem, &size, "FREE") == 0) {
-            buffer = (char*)mem - CHK_SENTINEL_HEAD_SIZE;
-            memset(buffer, CHK_FILL_FREE, size + CHK_OVERHEAD_SIZE);
-            dlfree(buffer);
-        }
-    }
-}
-
-void* chk_calloc(size_t n_elements, size_t elem_size)
-{
-    size_t  size;
-    void*   ptr;
-
-    /* Fail on overflow - just to be safe even though this code runs only
-     * within the debugging C library, not the production one */
-    if (n_elements && MAX_SIZE_T / n_elements < elem_size) {
-        return NULL;
-    }
-    size = n_elements * elem_size;
-    ptr  = chk_malloc(size);
-    if (ptr != NULL) {
-        memset(ptr, 0, size);
-    }
-    return ptr;
-}
-
-void* chk_realloc(void* mem, size_t bytes)
-{
-    char*   buffer;
-    int     ret;
-    size_t  old_bytes = 0;
-
-    assert_valid_malloc_pointer(mem);
-
-    if (mem != NULL && chk_mem_check(mem, &old_bytes, "REALLOC") < 0)
-        return NULL;
-
-    char* new_buffer = chk_malloc(bytes);
-    if (mem == NULL) {
-        return new_buffer;
-    }
-
-    if (new_buffer) {
-        if (bytes > old_bytes)
-            bytes = old_bytes;
-        memcpy(new_buffer, mem, bytes);
-        chk_free(mem);
-    }
-
-    return new_buffer;
-}
-
-void* chk_memalign(size_t alignment, size_t bytes)
-{
-    // XXX: it's better to use malloc, than being wrong
-    return chk_malloc(bytes);
-}
-
-// =============================================================================
-// malloc fill functions
-// =============================================================================
 
 void* fill_malloc(size_t bytes)
 {
@@ -501,6 +252,9 @@
 
 #define MEMALIGN_GUARD  ((void*)0xA1A41520)
 
+extern __LIBC_HIDDEN__
+int get_backtrace(intptr_t* addrs, size_t max_entries);
+
 void* leak_malloc(size_t bytes)
 {
     // allocate enough space infront of the allocation to store the pointer for
@@ -645,12 +399,3 @@
     }
     return base;
 }
-
-/* Initializes malloc debugging framework.
- * See comments on MallocDebugInit in malloc_debug_common.h
- */
-int malloc_debug_initialize(void)
-{
-    // We don't really have anything that requires initialization here.
-    return 0;
-}
diff --git a/libc/bionic/malloc_debug_qemu.c b/libc/bionic/malloc_debug_qemu.c
index 4b694e9..bcbf1e6 100644
--- a/libc/bionic/malloc_debug_qemu.c
+++ b/libc/bionic/malloc_debug_qemu.c
@@ -287,7 +287,7 @@
 /*
  * Logging helper macros.
  */
-#define debug_log(format, ...)                                              \
+#define qemu_debug_log(format, ...)                                         \
     do {                                                                    \
         __libc_android_log_print(ANDROID_LOG_DEBUG, "memcheck",             \
                                  (format), ##__VA_ARGS__ );                 \
@@ -296,7 +296,7 @@
         }                                                                   \
     } while (0)
 
-#define error_log(format, ...)                                              \
+#define qemu_error_log(format, ...)                                         \
     do {                                                                    \
         __libc_android_log_print(ANDROID_LOG_ERROR, "memcheck",             \
                                  (format), ##__VA_ARGS__ );                 \
@@ -305,7 +305,7 @@
         }                                                                   \
     } while (0)
 
-#define info_log(format, ...)                                               \
+#define qemu_info_log(format, ...)                                          \
     do {                                                                    \
         __libc_android_log_print(ANDROID_LOG_INFO, "memcheck",              \
                                  (format), ##__VA_ARGS__ );                 \
@@ -692,7 +692,7 @@
 
     notify_qemu_libc_initialized(malloc_pid);
 
-    debug_log("Instrumented for pid=%03u: malloc=%p, free=%p, calloc=%p, realloc=%p, memalign=%p",
+    qemu_debug_log("Instrumented for pid=%03u: malloc=%p, free=%p, calloc=%p, realloc=%p, memalign=%p",
               malloc_pid, qemu_instrumented_malloc, qemu_instrumented_free,
               qemu_instrumented_calloc, qemu_instrumented_realloc,
               qemu_instrumented_memalign);
@@ -717,7 +717,7 @@
     desc.suffix_size = DEFAULT_SUFFIX_SIZE;
     desc.ptr = dlmalloc(mallocdesc_alloc_size(&desc));
     if (desc.ptr == NULL) {
-        error_log("<libc_pid=%03u, pid=%03u> malloc(%u): dlmalloc(%u) failed.",
+        qemu_error_log("<libc_pid=%03u, pid=%03u> malloc(%u): dlmalloc(%u) failed.",
                   malloc_pid, getpid(), bytes, mallocdesc_alloc_size(&desc));
         return NULL;
     }
@@ -797,7 +797,7 @@
 
     if (n_elements == 0 || elem_size == 0) {
         // Just let go zero bytes allocation.
-        info_log("::: <libc_pid=%03u, pid=%03u>: Zero calloc redir to malloc",
+        qemu_info_log("::: <libc_pid=%03u, pid=%03u>: Zero calloc redir to malloc",
                  malloc_pid, getpid());
         return qemu_instrumented_malloc(0);
     }
@@ -874,14 +874,14 @@
 
     if (mem == NULL) {
         // Nothing to realloc. just do regular malloc.
-        info_log("::: <libc_pid=%03u, pid=%03u>: realloc(%p, %u) redir to malloc",
+        qemu_info_log("::: <libc_pid=%03u, pid=%03u>: realloc(%p, %u) redir to malloc",
                  malloc_pid, getpid(), mem, bytes);
         return qemu_instrumented_malloc(bytes);
     }
 
     if (bytes == 0) {
         // This is a "free" condition.
-        info_log("::: <libc_pid=%03u, pid=%03u>: realloc(%p, %u) redir to free and malloc",
+        qemu_info_log("::: <libc_pid=%03u, pid=%03u>: realloc(%p, %u) redir to free and malloc",
                  malloc_pid, getpid(), mem, bytes);
         qemu_instrumented_free(mem);
 
@@ -977,7 +977,7 @@
 
     if (bytes == 0) {
         // Just let go zero bytes allocation.
-        info_log("::: <libc_pid=%03u, pid=%03u>: memalign(%X, %u) redir to malloc",
+        qemu_info_log("::: <libc_pid=%03u, pid=%03u>: memalign(%X, %u) redir to malloc",
                  malloc_pid, getpid(), alignment, bytes);
         return qemu_instrumented_malloc(0);
     }
diff --git a/libc/bionic/malloc_debug_stacktrace.c b/libc/bionic/malloc_debug_stacktrace.c
new file mode 100644
index 0000000..c71b1c5
--- /dev/null
+++ b/libc/bionic/malloc_debug_stacktrace.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <unwind.h>
+#include <sys/types.h>
+
+// =============================================================================
+// stack trace functions
+// =============================================================================
+
+typedef struct
+{
+    size_t count;
+    intptr_t* addrs;
+} stack_crawl_state_t;
+
+
+/* depends how the system includes define this */
+#ifdef HAVE_UNWIND_CONTEXT_STRUCT
+typedef struct _Unwind_Context __unwind_context;
+#else
+typedef _Unwind_Context __unwind_context;
+#endif
+
+static _Unwind_Reason_Code trace_function(__unwind_context *context, void *arg)
+{
+    stack_crawl_state_t* state = (stack_crawl_state_t*)arg;
+    if (state->count) {
+        intptr_t ip = (intptr_t)_Unwind_GetIP(context);
+        if (ip) {
+            state->addrs[0] = ip;
+            state->addrs++;
+            state->count--;
+            return _URC_NO_REASON;
+        }
+    }
+    /*
+     * If we run out of space to record the address or 0 has been seen, stop
+     * unwinding the stack.
+     */
+    return _URC_END_OF_STACK;
+}
+
+__LIBC_HIDDEN__
+int get_backtrace(intptr_t* addrs, size_t max_entries)
+{
+    stack_crawl_state_t state;
+    state.count = max_entries;
+    state.addrs = (intptr_t*)addrs;
+    _Unwind_Backtrace(trace_function, (void*)&state);
+    return max_entries - state.count;
+}
diff --git a/libc/bionic/pthread-timers.c b/libc/bionic/pthread-timers.c
index ae04029..23d31df 100644
--- a/libc/bionic/pthread-timers.c
+++ b/libc/bionic/pthread-timers.c
@@ -9,7 +9,7 @@
  *    notice, this list of conditions and the following disclaimer.
  *  * Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the 
+ *    the documentation and/or other materials provided with the
  *    distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
@@ -19,55 +19,56 @@
  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
+
 #include "pthread_internal.h"
-#include <linux/time.h>
-#include <string.h>
+
 #include <errno.h>
+#include <linux/time.h>
+#include <stdio.h>
+#include <string.h>
 
-/* This file implements the support required to implement SIGEV_THREAD posix 
- * timers. See the following pages for additionnal details:
- *
- * www.opengroup.org/onlinepubs/000095399/functions/timer_create.html
- * www.opengroup.org/onlinepubs/000095399/functions/timer_settime.html
- * www.opengroup.org/onlinepubs/000095399/functions/xsh_chap02_04.html#tag_02_04_01
- *
- * The Linux kernel doesn't support these, so we need to implement them in the
- * C library. We use a very basic scheme where each timer is associated to a
- * thread that will loop, waiting for timeouts or messages from the program
- * corresponding to calls to timer_settime() and timer_delete().
- *
- * Note also an important thing: Posix mandates that in the case of fork(),
- * the timers of the child process should be disarmed, but not deleted.
- * this is implemented by providing a fork() wrapper (see bionic/fork.c) which
- * stops all timers before the fork, and only re-start them in case of error
- * or in the parent process.
- *
- * the stop/start is implemented by the __timer_table_start_stop() function
- * below.
- */
-
-/* normal (i.e. non-SIGEV_THREAD) timer ids are created directly by the kernel
- * and are passed as is to/from the caller.
- *
- * on the other hand, a SIGEV_THREAD timer ID will have its TIMER_ID_WRAP_BIT
- * always set to 1. In this implementation, this is always bit 31, which is
- * guaranteed to never be used by kernel-provided timer ids
- *
- * (see code in <kernel>/lib/idr.c, used to manage IDs, to see why)
- */
+// Normal (i.e. non-SIGEV_THREAD) timers are created directly by the kernel
+// and are passed as is to/from the caller.
+//
+// This file also implements the support required for SIGEV_THREAD ("POSIX interval")
+// timers. See the following pages for additional details:
+//
+// www.opengroup.org/onlinepubs/000095399/functions/timer_create.html
+// www.opengroup.org/onlinepubs/000095399/functions/timer_settime.html
+// www.opengroup.org/onlinepubs/000095399/functions/xsh_chap02_04.html#tag_02_04_01
+//
+// The Linux kernel doesn't support these, so we need to implement them in the
+// C library. We use a very basic scheme where each timer is associated to a
+// thread that will loop, waiting for timeouts or messages from the program
+// corresponding to calls to timer_settime() and timer_delete().
+//
+// Note also an important thing: Posix mandates that in the case of fork(),
+// the timers of the child process should be disarmed, but not deleted.
+// this is implemented by providing a fork() wrapper (see bionic/fork.c) which
+// stops all timers before the fork, and only re-start them in case of error
+// or in the parent process.
+//
+// This stop/start is implemented by the __timer_table_start_stop() function
+// below.
+//
+// A SIGEV_THREAD timer ID will always have its TIMER_ID_WRAP_BIT
+// set to 1. In this implementation, this is always bit 31, which is
+// guaranteed to never be used by kernel-provided timer ids
+//
+// (See code in <kernel>/lib/idr.c, used to manage IDs, to see why.)
 
 #define  TIMER_ID_WRAP_BIT        0x80000000
 #define  TIMER_ID_WRAP(id)        ((timer_t)((id) |  TIMER_ID_WRAP_BIT))
 #define  TIMER_ID_UNWRAP(id)      ((timer_t)((id) & ~TIMER_ID_WRAP_BIT))
 #define  TIMER_ID_IS_WRAPPED(id)  (((id) & TIMER_ID_WRAP_BIT) != 0)
 
-/* this value is used internally to indicate a 'free' or 'zombie' 
+/* this value is used internally to indicate a 'free' or 'zombie'
  * thr_timer structure. Here, 'zombie' means that timer_delete()
  * has been called, but that the corresponding thread hasn't
  * exited yet.
@@ -171,25 +172,23 @@
 }
 
 
-static void
-thr_timer_table_start_stop( thr_timer_table_t*  t, int  stop )
-{
-    int  nn;
+static void thr_timer_table_start_stop(thr_timer_table_t* t, int stop) {
+  if (t == NULL) {
+    return;
+  }
 
-    pthread_mutex_lock(&t->lock);
-
-    for (nn = 0; nn < MAX_THREAD_TIMERS; nn++) {
-        thr_timer_t*  timer  = &t->timers[nn];
-
-        if (TIMER_ID_IS_VALID(timer->id)) {
-            /* tell the thread to start/stop */
-            pthread_mutex_lock(&timer->mutex);
-            timer->stopped = stop;
-            pthread_cond_signal( &timer->cond );
-            pthread_mutex_unlock(&timer->mutex);
-        }
+  pthread_mutex_lock(&t->lock);
+  for (int nn = 0; nn < MAX_THREAD_TIMERS; ++nn) {
+    thr_timer_t*  timer  = &t->timers[nn];
+    if (TIMER_ID_IS_VALID(timer->id)) {
+      // Tell the thread to start/stop.
+      pthread_mutex_lock(&timer->mutex);
+      timer->stopped = stop;
+      pthread_cond_signal( &timer->cond );
+      pthread_mutex_unlock(&timer->mutex);
     }
-    pthread_mutex_unlock(&t->lock);
+  }
+  pthread_mutex_unlock(&t->lock);
 }
 
 
@@ -234,23 +233,19 @@
  * pretty infrequent
  */
 
-static pthread_once_t      __timer_table_once = PTHREAD_ONCE_INIT;
-static thr_timer_table_t*  __timer_table;
+static pthread_once_t __timer_table_once = PTHREAD_ONCE_INIT;
+static thr_timer_table_t* __timer_table;
 
-static void
-__timer_table_init( void )
-{
-    __timer_table = calloc(1,sizeof(*__timer_table));
-
-    if (__timer_table != NULL)
-        thr_timer_table_init( __timer_table );
+static void __timer_table_init(void) {
+  __timer_table = calloc(1, sizeof(*__timer_table));
+  if (__timer_table != NULL) {
+    thr_timer_table_init(__timer_table);
+  }
 }
 
-static thr_timer_table_t*
-__timer_table_get(void)
-{
-    pthread_once( &__timer_table_once, __timer_table_init );
-    return __timer_table;
+static thr_timer_table_t* __timer_table_get(void) {
+  pthread_once(&__timer_table_once, __timer_table_init);
+  return __timer_table;
 }
 
 /** POSIX THREAD TIMERS CLEANUP ON FORK
@@ -260,13 +255,9 @@
  ** requirements: the timers of fork child processes must be
  ** disarmed but not deleted.
  **/
-__LIBC_HIDDEN__ void
-__timer_table_start_stop( int  stop )
-{
-    if (__timer_table != NULL) {
-        thr_timer_table_t*  table = __timer_table_get();
-        thr_timer_table_start_stop(table, stop);
-    }
+__LIBC_HIDDEN__ void __timer_table_start_stop(int stop) {
+  // We access __timer_table directly so we don't create it if it doesn't yet exist.
+  thr_timer_table_start_stop(__timer_table, stop);
 }
 
 static thr_timer_t*
@@ -293,85 +284,76 @@
 
 /** POSIX TIMERS APIs */
 
-/* first, declare the syscall stubs */
-extern int __timer_create( clockid_t, struct sigevent*, timer_t* );
-extern int __timer_delete( timer_t );
-extern int __timer_gettime( timer_t, struct itimerspec* );
-extern int __timer_settime( timer_t, int, const struct itimerspec*, struct itimerspec* );
+extern int __timer_create(clockid_t, struct sigevent*, timer_t*);
+extern int __timer_delete(timer_t);
+extern int __timer_gettime(timer_t, struct itimerspec*);
+extern int __timer_settime(timer_t, int, const struct itimerspec*, struct itimerspec*);
 extern int __timer_getoverrun(timer_t);
 
-static void*  timer_thread_start( void* );
+static void* timer_thread_start(void*);
 
-/* then the wrappers themselves */
-int
-timer_create( clockid_t  clockid, struct sigevent*  evp, timer_t  *ptimerid)
-{
-    /* if not a SIGEV_THREAD timer, direct creation by the kernel */
-    if (__likely(evp == NULL || evp->sigev_notify != SIGEV_THREAD))
-        return __timer_create( clockid, evp, ptimerid );
+int timer_create(clockid_t clock_id, struct sigevent* evp, timer_t* timer_id) {
+  // If not a SIGEV_THREAD timer, the kernel can handle it without our help.
+  if (__likely(evp == NULL || evp->sigev_notify != SIGEV_THREAD)) {
+    return __timer_create(clock_id, evp, timer_id);
+  }
 
-    // check arguments
-    if (evp->sigev_notify_function == NULL) {
-        errno = EINVAL;
-        return -1;
-    }
+  // Check arguments.
+  if (evp->sigev_notify_function == NULL) {
+    errno = EINVAL;
+    return -1;
+  }
 
-    {
-        struct timespec  dummy;
+  // Check that the clock id is supported by the kernel.
+  struct timespec dummy;
+  if (clock_gettime(clock_id, &dummy) < 0 && errno == EINVAL) {
+    return -1;
+  }
 
-        /* check that the clock id is supported by the kernel */
-        if (clock_gettime( clockid, &dummy ) < 0 && errno == EINVAL )
-            return -1;
-    }
+  // Create a new timer and its thread.
+  // TODO: use a single global thread for all timers.
+  thr_timer_table_t* table = __timer_table_get();
+  thr_timer_t* timer = thr_timer_table_alloc(table);
+  if (timer == NULL) {
+    errno = ENOMEM;
+    return -1;
+  }
 
-    /* create a new timer and its thread */
-    {
-        thr_timer_table_t*  table = __timer_table_get();
-        thr_timer_t*        timer = thr_timer_table_alloc( table );
-        struct sigevent     evp0;
+  // Copy the thread attributes.
+  if (evp->sigev_notify_attributes == NULL) {
+    pthread_attr_init(&timer->attributes);
+  } else {
+    timer->attributes = ((pthread_attr_t*) evp->sigev_notify_attributes)[0];
+  }
 
-        if (timer == NULL) {
-            errno = ENOMEM;
-            return -1;
-        }
+  // Posix says that the default is PTHREAD_CREATE_DETACHED and
+  // that PTHREAD_CREATE_JOINABLE has undefined behavior.
+  // So simply always use DETACHED :-)
+  pthread_attr_setdetachstate(&timer->attributes, PTHREAD_CREATE_DETACHED);
 
-        /* copy the thread attributes */
-        if (evp->sigev_notify_attributes == NULL) {
-            pthread_attr_init(&timer->attributes);
-        }
-        else {
-            timer->attributes = ((pthread_attr_t*)evp->sigev_notify_attributes)[0];
-        }
+  timer->callback = evp->sigev_notify_function;
+  timer->value = evp->sigev_value;
+  timer->clock = clock_id;
 
-        /* Posix says that the default is PTHREAD_CREATE_DETACHED and
-         * that PTHREAD_CREATE_JOINABLE has undefined behaviour.
-         * So simply always use DETACHED :-)
-         */
-        pthread_attr_setdetachstate(&timer->attributes, PTHREAD_CREATE_DETACHED);
+  pthread_mutex_init(&timer->mutex, NULL);
+  pthread_cond_init(&timer->cond, NULL);
 
-        timer->callback = evp->sigev_notify_function;
-        timer->value    = evp->sigev_value;
-        timer->clock    = clockid;
+  timer->done = 0;
+  timer->stopped = 0;
+  timer->expires.tv_sec = timer->expires.tv_nsec = 0;
+  timer->period.tv_sec = timer->period.tv_nsec  = 0;
+  timer->overruns = 0;
 
-        pthread_mutex_init( &timer->mutex, NULL );
-        pthread_cond_init( &timer->cond, NULL );
+  // Create the thread.
+  int rc = pthread_create(&timer->thread, &timer->attributes, timer_thread_start, timer);
+  if (rc != 0) {
+    thr_timer_table_free(table, timer);
+    errno = rc;
+    return -1;
+  }
 
-        timer->done           = 0;
-        timer->stopped        = 0;
-        timer->expires.tv_sec = timer->expires.tv_nsec = 0;
-        timer->period.tv_sec  = timer->period.tv_nsec  = 0;
-        timer->overruns       = 0;
-
-        /* create the thread */
-        if (pthread_create( &timer->thread, &timer->attributes, timer_thread_start, timer ) < 0) {
-            thr_timer_table_free( __timer_table, timer );
-            errno = ENOMEM;
-            return -1;
-        }
-
-        *ptimerid = timer->id;
-        return 0;
-    }
+  *timer_id = timer->id;
+  return 0;
 }
 
 
@@ -414,7 +396,7 @@
     struct timespec  diff;
 
     diff = timer->expires;
-    if (!timespec_is_zero(&diff)) 
+    if (!timespec_is_zero(&diff))
     {
         struct timespec  now;
 
@@ -532,108 +514,93 @@
 }
 
 
-static void*
-timer_thread_start( void*  _arg )
-{
-    thr_timer_t*  timer = _arg;
+static void* timer_thread_start(void* arg) {
+  thr_timer_t* timer = arg;
 
-    thr_timer_lock( timer );
+  thr_timer_lock(timer);
 
-    /* we loop until timer->done is set in timer_delete() */
-    while (!timer->done) 
-    {
-        struct timespec   expires = timer->expires;
-        struct timespec   period  = timer->period;
-        struct timespec   now;
+  // Give this thread a meaningful name.
+  char name[32];
+  snprintf(name, sizeof(name), "POSIX interval timer 0x%08x", timer->id);
+  pthread_setname_np(pthread_self(), name);
 
-        /* if the timer is stopped or disarmed, wait indefinitely
-         * for a state change from timer_settime/_delete/_start_stop
-         */
-        if ( timer->stopped || timespec_is_zero(&expires) )
-        {
-            pthread_cond_wait( &timer->cond, &timer->mutex );
-            continue;
-        }
+  // We loop until timer->done is set in timer_delete().
+  while (!timer->done) {
+    struct timespec expires = timer->expires;
+    struct timespec period = timer->period;
 
-        /* otherwise, we need to do a timed wait until either a
-        * state change of the timer expiration time.
-        */
-        clock_gettime(timer->clock, &now);
-
-        if (timespec_cmp( &expires, &now ) > 0)
-        {
-            /* cool, there was no overrun, so compute the
-             * relative timeout as 'expires - now', then wait
-             */
-            int              ret;
-            struct timespec  diff = expires;
-            timespec_sub( &diff, &now );
-
-            ret = __pthread_cond_timedwait_relative(
-                        &timer->cond, &timer->mutex, &diff);
-
-            /* if we didn't timeout, it means that a state change
-                * occured, so reloop to take care of it.
-                */
-            if (ret != ETIMEDOUT)
-                continue;
-        }
-        else
-        {
-            /* overrun was detected before we could wait ! */
-            if (!timespec_is_zero( &period ) )
-            {
-                /* for periodic timers, compute total overrun count */
-                do {
-                    timespec_add( &expires, &period );
-                    if (timer->overruns < DELAYTIMER_MAX)
-                        timer->overruns += 1;
-                } while ( timespec_cmp( &expires, &now ) < 0 );
-
-                /* backtrack the last one, because we're going to
-                 * add the same value just a bit later */
-                timespec_sub( &expires, &period );
-            }
-            else
-            {
-                /* for non-periodic timer, things are simple */
-                timer->overruns = 1;
-            }
-        }
-
-        /* if we get there, a timeout was detected.
-         * first reload/disarm the timer has needed
-         */
-        if ( !timespec_is_zero(&period) ) {
-            timespec_add( &expires, &period );
-        } else {
-            timespec_zero( &expires );
-        }
-        timer->expires = expires;
-
-        /* now call the timer callback function. release the
-         * lock to allow the function to modify the timer setting
-         * or call timer_getoverrun().
-         *
-         * NOTE: at this point we trust the callback not to be a
-         *       total moron and pthread_kill() the timer thread
-         */
-        thr_timer_unlock(timer);
-        timer->callback( timer->value );
-        thr_timer_lock(timer);
-
-        /* now clear the overruns counter. it only makes sense
-         * within the callback */
-        timer->overruns = 0;
+    // If the timer is stopped or disarmed, wait indefinitely
+    // for a state change from timer_settime/_delete/_start_stop.
+    if (timer->stopped || timespec_is_zero(&expires)) {
+      pthread_cond_wait(&timer->cond, &timer->mutex);
+      continue;
     }
 
-    thr_timer_unlock( timer );
+    // Otherwise, we need to do a timed wait until either a
+    // state change of the timer expiration time.
+    struct timespec now;
+    clock_gettime(timer->clock, &now);
 
-    /* free the timer object now. there is no need to call
-     * __timer_table_get() since we're guaranteed that __timer_table
-     * is initialized in this thread
-     */
-    thr_timer_table_free(__timer_table, timer);
+    if (timespec_cmp(&expires, &now) > 0) {
+      // Cool, there was no overrun, so compute the
+      // relative timeout as 'expires - now', then wait.
+      struct timespec diff = expires;
+      timespec_sub(&diff, &now);
 
-    return NULL;
+      int ret = __pthread_cond_timedwait_relative(&timer->cond, &timer->mutex, &diff);
+
+      // If we didn't time out, it means that a state change
+      // occurred, so loop to take care of it.
+      if (ret != ETIMEDOUT) {
+        continue;
+      }
+    } else {
+      // Overrun was detected before we could wait!
+      if (!timespec_is_zero(&period)) {
+        // For periodic timers, compute total overrun count.
+        do {
+          timespec_add(&expires, &period);
+          if (timer->overruns < DELAYTIMER_MAX) {
+            timer->overruns += 1;
+          }
+        } while (timespec_cmp(&expires, &now) < 0);
+
+        // Backtrack the last one, because we're going to
+        // add the same value just a bit later.
+        timespec_sub(&expires, &period);
+      } else {
+        // For non-periodic timers, things are simple.
+        timer->overruns = 1;
+      }
+    }
+
+    // If we get here, a timeout was detected.
+    // First reload/disarm the timer as needed.
+    if (!timespec_is_zero(&period)) {
+      timespec_add(&expires, &period);
+    } else {
+      timespec_zero(&expires);
+    }
+    timer->expires = expires;
+
+    // Now call the timer callback function. Release the
+    // lock to allow the function to modify the timer setting
+    // or call timer_getoverrun().
+    // NOTE: at this point we trust the callback not to be a
+    //      total moron and pthread_kill() the timer thread
+    thr_timer_unlock(timer);
+    timer->callback(timer->value);
+    thr_timer_lock(timer);
+
+    // Now clear the overruns counter. it only makes sense
+    // within the callback.
+    timer->overruns = 0;
+  }
+
+  thr_timer_unlock(timer);
+
+  // Free the timer object.
+  thr_timer_table_free(__timer_table_get(), timer);
+
+  return NULL;
 }
diff --git a/libc/include/fcntl.h b/libc/include/fcntl.h
index 7219dd7..47151f4 100644
--- a/libc/include/fcntl.h
+++ b/libc/include/fcntl.h
@@ -49,6 +49,46 @@
 extern int  fcntl(int   fd, int   command, ...);
 extern int  creat(const char*  path, mode_t  mode);
 
+#if defined(__BIONIC_FORTIFY_INLINE)
+
+# if !defined(__clang__)
+/*
+ * Clang doesn't have support for __builtin_va_arg_pack()
+ * and __builtin_va_arg_pack_len()
+ *
+ * http://clang.llvm.org/docs/UsersManual.html#c_unimpl_gcc
+ */
+
+extern void __open_creat_error()
+    __attribute__((__error__ ("open called with O_CREAT, but missing mode")));
+extern void __open_toomanyargs_error()
+    __attribute__((__error__ ("open called with too many arguments")));
+extern int __open_real(const char *pathname, int flags, ...)
+    __asm__(__USER_LABEL_PREFIX__ "open");
+extern int __open_2(const char *, int);
+
+__BIONIC_FORTIFY_INLINE
+int open(const char *pathname, int flags, ...) {
+    if (__builtin_constant_p(flags)) {
+        if ((flags & O_CREAT) && __builtin_va_arg_pack_len() == 0) {
+            __open_creat_error();  // compile time error
+        }
+    }
+
+    if (__builtin_va_arg_pack_len() > 1) {
+        __open_toomanyargs_error();  // compile time error
+    }
+
+    if (__builtin_va_arg_pack_len() == 0) {
+        return __open_2(pathname, flags);
+    }
+
+    return __open_real(pathname, flags, __builtin_va_arg_pack());
+}
+
+#endif /* !defined(__clang__) */
+#endif /* defined(__BIONIC_FORTIFY_INLINE) */
+
 __END_DECLS
 
 #endif /* _FCNTL_H */
diff --git a/libc/include/malloc.h b/libc/include/malloc.h
index a864286..bcea672 100644
--- a/libc/include/malloc.h
+++ b/libc/include/malloc.h
@@ -35,7 +35,7 @@
 
 extern __mallocfunc void*  malloc(size_t);
 extern __mallocfunc void*  calloc(size_t, size_t);
-extern __mallocfunc void*  realloc(void *, size_t);
+extern void*  realloc(void *, size_t);
 extern                void   free(void *);
 
 extern void*   memalign(size_t  alignment, size_t  bytesize);
diff --git a/libc/include/net/if_dl.h b/libc/include/net/if_dl.h
deleted file mode 100644
index 1f0c080..0000000
--- a/libc/include/net/if_dl.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*	$NetBSD: if_dl.h,v 1.18 2005/12/11 23:05:24 thorpej Exp $	*/
-
-/*
- * Copyright (c) 1990, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	@(#)if_dl.h	8.1 (Berkeley) 6/10/93
- */
-
-/*
- * A Link-Level Sockaddr may specify the interface in one of two
- * ways: either by means of a system-provided index number (computed
- * anew and possibly differently on every reboot), or by a human-readable
- * string such as "il0" (for managerial convenience).
- *
- * Census taking actions, such as something akin to SIOCGCONF would return
- * both the index and the human name.
- *
- * High volume transactions (such as giving a link-level ``from'' address
- * in a recvfrom or recvmsg call) may be likely only to provide the indexed
- * form, (which requires fewer copy operations and less space).
- *
- * The form and interpretation  of the link-level address is purely a matter
- * of convention between the device driver and its consumers; however, it is
- * expected that all drivers for an interface of a given if_type will agree.
- */
-
-#ifndef _NET_IF_DL_H_
-#define _NET_IF_DL_H_
-
-#include <sys/socket.h>
-
-/*
- * Structure of a Link-Level sockaddr:
- */
-struct sockaddr_dl {
-	u_char	    sdl_len;	/* Total length of sockaddr */
-	sa_family_t sdl_family;	/* AF_LINK */
-	u_int16_t   sdl_index;	/* if != 0, system given index for interface */
-	u_char	    sdl_type;	/* interface type */
-	u_char	    sdl_nlen;	/* interface name length, no trailing 0 reqd. */
-	u_char	    sdl_alen;	/* link level address length */
-	u_char	    sdl_slen;	/* link layer selector length */
-	char	    sdl_data[12]; /* minimum work area, can be larger;
-				     contains both if name and ll address */
-};
-
-/* We do arithmetic directly with these, so keep them char instead of void */
-#define LLADDR(s) ((char *)((s)->sdl_data + (s)->sdl_nlen))
-#define CLLADDR(s) ((const char *)((s)->sdl_data + (s)->sdl_nlen))
-
-#ifndef _KERNEL
-
-#include <sys/cdefs.h>
-
-__BEGIN_DECLS
-void	link_addr(const char *, struct sockaddr_dl *);
-char	*link_ntoa(const struct sockaddr_dl *);
-__END_DECLS
-
-#endif /* !_KERNEL */
-
-#endif /* !_NET_IF_DL_H_ */
diff --git a/libc/include/stdio.h b/libc/include/stdio.h
index 8d3d5d7..18b19bf 100644
--- a/libc/include/stdio.h
+++ b/libc/include/stdio.h
@@ -231,12 +231,16 @@
 int	 fgetpos(FILE *, fpos_t *);
 char	*fgets(char *, int, FILE *);
 FILE	*fopen(const char *, const char *);
-int	 fprintf(FILE *, const char *, ...);
+int	 fprintf(FILE *, const char *, ...)
+		__attribute__((__format__ (printf, 2, 3)))
+		__attribute__((__nonnull__ (2)));
 int	 fputc(int, FILE *);
 int	 fputs(const char *, FILE *);
 size_t	 fread(void *, size_t, size_t, FILE *);
 FILE	*freopen(const char *, const char *, FILE *);
-int	 fscanf(FILE *, const char *, ...);
+int	 fscanf(FILE *, const char *, ...)
+		__attribute__ ((__format__ (scanf, 2, 3)))
+		__attribute__ ((__nonnull__ (2)));
 int	 fseek(FILE *, long, int);
 int	 fseeko(FILE *, off_t, int);
 int	 fsetpos(FILE *, const fpos_t *);
@@ -253,24 +257,38 @@
 extern char *sys_errlist[];
 #endif
 void	 perror(const char *);
-int	 printf(const char *, ...);
+int	 printf(const char *, ...)
+		__attribute__((__format__ (printf, 1, 2)))
+		__attribute__((__nonnull__ (1)));
 int	 putc(int, FILE *);
 int	 putchar(int);
 int	 puts(const char *);
 int	 remove(const char *);
 int	 rename(const char *, const char *);
 void	 rewind(FILE *);
-int	 scanf(const char *, ...);
+int	 scanf(const char *, ...)
+		__attribute__ ((__format__ (scanf, 1, 2)))
+		__attribute__ ((__nonnull__ (1)));
 void	 setbuf(FILE *, char *);
 int	 setvbuf(FILE *, char *, int, size_t);
-int	 sprintf(char *, const char *, ...);
-int	 sscanf(const char *, const char *, ...);
+int	 sprintf(char *, const char *, ...)
+		__attribute__((__format__ (printf, 2, 3)))
+		__attribute__((__nonnull__ (2)));
+int	 sscanf(const char *, const char *, ...)
+		__attribute__ ((__format__ (scanf, 2, 3)))
+		__attribute__ ((__nonnull__ (2)));
 FILE	*tmpfile(void);
 char	*tmpnam(char *);
 int	 ungetc(int, FILE *);
-int	 vfprintf(FILE *, const char *, __va_list);
-int	 vprintf(const char *, __va_list);
-int	 vsprintf(char *, const char *, __va_list);
+int	 vfprintf(FILE *, const char *, __va_list)
+		__attribute__((__format__ (printf, 2, 0)))
+		__attribute__((__nonnull__ (2)));
+int	 vprintf(const char *, __va_list)
+		__attribute__((__format__ (printf, 1, 0)))
+		__attribute__((__nonnull__ (1)));
+int	 vsprintf(char *, const char *, __va_list)
+		__attribute__((__format__ (printf, 2, 0)))
+		__attribute__((__nonnull__ (2)));
 
 #if __ISO_C_VISIBLE >= 1999 || __BSD_VISIBLE
 int	 snprintf(char *, size_t, const char *, ...)
@@ -453,9 +471,62 @@
  * #define fdprintf dprintf for compatibility
  */
 __BEGIN_DECLS
-int fdprintf(int, const char*, ...);
-int vfdprintf(int, const char*, __va_list);
+int fdprintf(int, const char*, ...)
+		__attribute__((__format__ (printf, 2, 3)))
+		__attribute__((__nonnull__ (2)));
+int vfdprintf(int, const char*, __va_list)
+		__attribute__((__format__ (printf, 2, 0)))
+		__attribute__((__nonnull__ (2)));
 __END_DECLS
 #endif /* _GNU_SOURCE */
 
+#if defined(__BIONIC_FORTIFY_INLINE)
+
+__BIONIC_FORTIFY_INLINE
+__attribute__((__format__ (printf, 3, 0)))
+__attribute__((__nonnull__ (3)))
+int vsnprintf(char *dest, size_t size, const char *format, __va_list ap)
+{
+    return __builtin___vsnprintf_chk(dest, size, 0,
+        __builtin_object_size(dest, 0), format, ap);
+}
+
+__BIONIC_FORTIFY_INLINE
+__attribute__((__format__ (printf, 2, 0)))
+__attribute__((__nonnull__ (2)))
+int vsprintf(char *dest, const char *format, __va_list ap)
+{
+    return __builtin___vsprintf_chk(dest, 0,
+        __builtin_object_size(dest, 0), format, ap);
+}
+
+
+# if !defined(__clang__)
+/*
+ * Clang doesn't have support for __builtin_va_arg_pack()
+ * http://clang.llvm.org/docs/UsersManual.html#c_unimpl_gcc
+ */
+
+__BIONIC_FORTIFY_INLINE
+__attribute__((__format__ (printf, 3, 4)))
+__attribute__((__nonnull__ (3)))
+int snprintf(char *str, size_t size, const char *format, ...)
+{
+    return __builtin___snprintf_chk(str, size, 0,
+        __builtin_object_size(str, 0), format, __builtin_va_arg_pack());
+}
+
+__BIONIC_FORTIFY_INLINE
+__attribute__((__format__ (printf, 2, 3)))
+__attribute__((__nonnull__ (2)))
+int sprintf(char *dest, const char *format, ...)
+{
+    return __builtin___sprintf_chk(dest, 0,
+        __builtin_object_size(dest, 0), format, __builtin_va_arg_pack());
+}
+
+# endif /* !defined(__clang__) */
+
+#endif /* defined(__BIONIC_FORTIFY_INLINE) */
+
 #endif /* _STDIO_H_ */
diff --git a/libc/include/stdlib.h b/libc/include/stdlib.h
index e5caadd..9c0e556 100644
--- a/libc/include/stdlib.h
+++ b/libc/include/stdlib.h
@@ -74,9 +74,9 @@
     return (float)strtod(nptr, endptr);
 }
 
-extern int atoi(const char *);
-extern long atol(const char *);
-extern long long atoll(const char *);
+extern int atoi(const char *) __purefunc;
+extern long atol(const char *) __purefunc;
+extern long long atoll(const char *) __purefunc;
 
 static __inline__ double atof(const char *nptr)
 {
diff --git a/libc/include/string.h b/libc/include/string.h
index 6e6c8e6..32fd25f 100644
--- a/libc/include/string.h
+++ b/libc/include/string.h
@@ -85,6 +85,107 @@
 extern int    strcoll(const char *, const char *) __purefunc;
 extern size_t strxfrm(char *, const char *, size_t);
 
+#if defined(__BIONIC_FORTIFY_INLINE)
+
+__BIONIC_FORTIFY_INLINE
+void *memcpy (void *dest, const void *src, size_t len) {
+    return __builtin___memcpy_chk(dest, src, len, __builtin_object_size (dest, 0));
+}
+
+__BIONIC_FORTIFY_INLINE
+void *memmove (void *dest, const void *src, size_t len) {
+    return __builtin___memmove_chk(dest, src, len, __builtin_object_size (dest, 0));
+}
+
+__BIONIC_FORTIFY_INLINE
+char *strcpy(char *dest, const char *src) {
+    return __builtin___strcpy_chk(dest, src, __builtin_object_size (dest, 0));
+}
+
+__BIONIC_FORTIFY_INLINE
+char *strncpy(char *dest, const char *src, size_t n) {
+    return __builtin___strncpy_chk(dest, src, n, __builtin_object_size (dest, 0));
+}
+
+__BIONIC_FORTIFY_INLINE
+char *strcat(char *dest, const char *src) {
+    return __builtin___strcat_chk(dest, src, __builtin_object_size (dest, 0));
+}
+
+__BIONIC_FORTIFY_INLINE
+char *strncat(char *dest, const char *src, size_t n) {
+    return __builtin___strncat_chk(dest, src, n, __builtin_object_size (dest, 0));
+}
+
+__BIONIC_FORTIFY_INLINE
+void *memset (void *s, int c, size_t n) {
+    return __builtin___memset_chk(s, c, n, __builtin_object_size (s, 0));
+}
+
+extern size_t __strlcpy_real(char *, const char *, size_t)
+    __asm__(__USER_LABEL_PREFIX__ "strlcpy");
+extern void __strlcpy_error()
+    __attribute__((__error__("strlcpy called with size bigger than buffer")));
+extern size_t __strlcpy_chk(char *, const char *, size_t, size_t);
+
+__BIONIC_FORTIFY_INLINE
+size_t strlcpy(char *dest, const char *src, size_t size) {
+    size_t bos = __builtin_object_size(dest, 0);
+
+    // Compiler doesn't know destination size. Don't call __strlcpy_chk
+    if (bos == (size_t) -1) {
+        return __strlcpy_real(dest, src, size);
+    }
+
+    // Compiler can prove, at compile time, that the passed in size
+    // is always <= the actual object size. Don't call __strlcpy_chk
+    if (__builtin_constant_p(size) && (size <= bos)) {
+        return __strlcpy_real(dest, src, size);
+    }
+
+    // Compiler can prove, at compile time, that the passed in size
+    // is always > the actual object size. Force a compiler error.
+    if (__builtin_constant_p(size) && (size > bos)) {
+        __strlcpy_error();
+    }
+
+    return __strlcpy_chk(dest, src, size, bos);
+}
+
+extern size_t __strlcat_real(char *, const char *, size_t)
+    __asm__(__USER_LABEL_PREFIX__ "strlcat");
+extern void __strlcat_error()
+    __attribute__((__error__("strlcat called with size bigger than buffer")));
+extern size_t __strlcat_chk(char *, const char *, size_t, size_t);
+
+
+__BIONIC_FORTIFY_INLINE
+size_t strlcat(char *dest, const char *src, size_t size) {
+    size_t bos = __builtin_object_size(dest, 0);
+
+    // Compiler doesn't know destination size. Don't call __strlcat_chk
+    if (bos == (size_t) -1) {
+        return __strlcat_real(dest, src, size);
+    }
+
+    // Compiler can prove, at compile time, that the passed in size
+    // is always <= the actual object size. Don't call __strlcat_chk
+    if (__builtin_constant_p(size) && (size <= bos)) {
+        return __strlcat_real(dest, src, size);
+    }
+
+    // Compiler can prove, at compile time, that the passed in size
+    // is always > the actual object size. Force a compiler error.
+    if (__builtin_constant_p(size) && (size > bos)) {
+        __strlcat_error();
+    }
+
+    return __strlcat_chk(dest, src, size, bos);
+}
+
+
+#endif /* defined(__BIONIC_FORTIFY_INLINE) */
+
 __END_DECLS
 
 #endif /* _STRING_H_ */
diff --git a/libc/include/strings.h b/libc/include/strings.h
index fee7dc4..db2aa3a 100644
--- a/libc/include/strings.h
+++ b/libc/include/strings.h
@@ -51,6 +51,14 @@
 char	*rindex(const char *, int);
 int	 strcasecmp(const char *, const char *);
 int	 strncasecmp(const char *, const char *, size_t);
+
+#if defined(__BIONIC_FORTIFY_INLINE)
+__BIONIC_FORTIFY_INLINE
+void bzero (void *s, size_t n) {
+    __builtin___memset_chk(s, '\0', n, __builtin_object_size (s, 0));
+}
+#endif /* defined(__BIONIC_FORTIFY_INLINE) */
+
 __END_DECLS
 
 #endif /* !defined(_STRINGS_H_) */
diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
index 71b419c..1ba9100 100644
--- a/libc/include/sys/cdefs.h
+++ b/libc/include/sys/cdefs.h
@@ -501,4 +501,12 @@
 #define  __BIONIC__   1
 #include <android/api-level.h>
 
+#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
+#define __BIONIC_FORTIFY_INLINE \
+    extern inline \
+    __attribute__ ((always_inline)) \
+    __attribute__ ((gnu_inline)) \
+    __attribute__ ((artificial))
+#endif
+
 #endif /* !_SYS_CDEFS_H_ */
diff --git a/libc/inet/inet_ntop.c b/libc/inet/inet_ntop.c
index 5748da3..c3448f1 100644
--- a/libc/inet/inet_ntop.c
+++ b/libc/inet/inet_ntop.c
@@ -75,8 +75,13 @@
 	char tmp[sizeof "255.255.255.255"];
 	int l;
 
+#if defined(ANDROID_CHANGES)
+	l = snprintf(tmp, sizeof(tmp), fmt, src[0], src[1], src[2], src[3]);
+	if (l <= 0 || (size_t)l >= size || (size_t)l >= sizeof(tmp)) {
+#else
 	l = snprintf(tmp, size, fmt, src[0], src[1], src[2], src[3]);
 	if (l <= 0 || (size_t)l >= size) {
+#endif
 		errno = ENOSPC;
 		return (NULL);
 	}
diff --git a/libc/kernel/common/linux/filter.h b/libc/kernel/common/linux/filter.h
index 613ee67..e5b2e95 100644
--- a/libc/kernel/common/linux/filter.h
+++ b/libc/kernel/common/linux/filter.h
@@ -23,94 +23,102 @@
 /* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_MAJOR_VERSION 1
 #define BPF_MINOR_VERSION 1
-struct sock_filter
-{
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+struct sock_filter {
  __u16 code;
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
  __u8 jt;
  __u8 jf;
  __u32 k;
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 };
-struct sock_fprog
-{
- unsigned short len;
 /* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+struct sock_fprog {
+ unsigned short len;
  struct sock_filter __user *filter;
 };
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_CLASS(code) ((code) & 0x07)
 #define BPF_LD 0x00
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_LDX 0x01
 #define BPF_ST 0x02
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_STX 0x03
 #define BPF_ALU 0x04
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_JMP 0x05
 #define BPF_RET 0x06
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_MISC 0x07
 #define BPF_SIZE(code) ((code) & 0x18)
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_W 0x00
 #define BPF_H 0x08
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_B 0x10
 #define BPF_MODE(code) ((code) & 0xe0)
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_IMM 0x00
 #define BPF_ABS 0x20
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_IND 0x40
 #define BPF_MEM 0x60
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_LEN 0x80
 #define BPF_MSH 0xa0
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_OP(code) ((code) & 0xf0)
 #define BPF_ADD 0x00
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_SUB 0x10
 #define BPF_MUL 0x20
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_DIV 0x30
 #define BPF_OR 0x40
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_AND 0x50
 #define BPF_LSH 0x60
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_RSH 0x70
 #define BPF_NEG 0x80
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_JA 0x00
 #define BPF_JEQ 0x10
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_JGT 0x20
 #define BPF_JGE 0x30
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_JSET 0x40
 #define BPF_SRC(code) ((code) & 0x08)
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_K 0x00
 #define BPF_X 0x08
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_RVAL(code) ((code) & 0x18)
 #define BPF_A 0x10
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_MISCOP(code) ((code) & 0xf8)
 #define BPF_TAX 0x00
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_TXA 0x80
 #ifndef BPF_MAXINSNS
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_MAXINSNS 4096
 #endif
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #ifndef BPF_STMT
 #define BPF_STMT(code, k) { (unsigned short)(code), 0, 0, k }
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #endif
 #ifndef BPF_JUMP
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_JUMP(code, k, jt, jf) { (unsigned short)(code), jt, jf, k }
 #endif
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define BPF_MEMWORDS 16
 #define SKF_AD_OFF (-0x1000)
-/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #define SKF_AD_PROTOCOL 0
 #define SKF_AD_PKTTYPE 4
-#define SKF_AD_IFINDEX 8
-#define SKF_AD_MAX 12
 /* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define SKF_AD_IFINDEX 8
+#define SKF_AD_NLATTR 12
+#define SKF_AD_NLATTR_NEST 16
+#define SKF_AD_MARK 20
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define SKF_AD_QUEUE 24
+#define SKF_AD_HATYPE 28
+#define SKF_AD_RXHASH 32
+#define SKF_AD_CPU 36
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define SKF_AD_ALU_XOR_X 40
+#define SKF_AD_MAX 44
 #define SKF_NET_OFF (-0x100000)
 #define SKF_LL_OFF (-0x200000)
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
 #endif
diff --git a/libc/kernel/common/linux/prctl.h b/libc/kernel/common/linux/prctl.h
index 8906639..5e79143 100644
--- a/libc/kernel/common/linux/prctl.h
+++ b/libc/kernel/common/linux/prctl.h
@@ -64,5 +64,57 @@
 #define PR_ENDIAN_BIG 0
 #define PR_ENDIAN_LITTLE 1  
 #define PR_ENDIAN_PPC_LITTLE 2  
-#endif
+#define PR_GET_SECCOMP 21
 /* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_SECCOMP 22
+#define PR_CAPBSET_READ 23
+#define PR_CAPBSET_DROP 24
+#define PR_GET_TSC 25
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_TSC 26
+#define PR_TSC_ENABLE 1  
+#define PR_TSC_SIGSEGV 2  
+#define PR_GET_SECUREBITS 27
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_SECUREBITS 28
+#define PR_SET_TIMERSLACK 29
+#define PR_GET_TIMERSLACK 30
+#define PR_TASK_PERF_EVENTS_DISABLE 31
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_TASK_PERF_EVENTS_ENABLE 32
+#define PR_MCE_KILL 33
+#define PR_MCE_KILL_CLEAR 0
+#define PR_MCE_KILL_SET 1
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_MCE_KILL_LATE 0
+#define PR_MCE_KILL_EARLY 1
+#define PR_MCE_KILL_DEFAULT 2
+#define PR_MCE_KILL_GET 34
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_MM 35
+#define PR_SET_MM_START_CODE 1
+#define PR_SET_MM_END_CODE 2
+#define PR_SET_MM_START_DATA 3
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_MM_END_DATA 4
+#define PR_SET_MM_START_STACK 5
+#define PR_SET_MM_START_BRK 6
+#define PR_SET_MM_BRK 7
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_MM_ARG_START 8
+#define PR_SET_MM_ARG_END 9
+#define PR_SET_MM_ENV_START 10
+#define PR_SET_MM_ENV_END 11
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_MM_AUXV 12
+#define PR_SET_MM_EXE_FILE 13
+#define PR_SET_PTRACER 0x59616d61
+#define PR_SET_PTRACER_ANY ((unsigned long)-1)
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_SET_CHILD_SUBREAPER 36
+#define PR_GET_CHILD_SUBREAPER 37
+#define PR_SET_NO_NEW_PRIVS 38
+#define PR_GET_NO_NEW_PRIVS 39
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define PR_GET_TID_ADDRESS 40
+#endif
diff --git a/libc/kernel/common/linux/seccomp.h b/libc/kernel/common/linux/seccomp.h
new file mode 100644
index 0000000..82a6985
--- /dev/null
+++ b/libc/kernel/common/linux/seccomp.h
@@ -0,0 +1,44 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef _LINUX_SECCOMP_H
+#define _LINUX_SECCOMP_H
+#include <linux/compiler.h>
+#include <linux/types.h>
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define SECCOMP_MODE_DISABLED 0  
+#define SECCOMP_MODE_STRICT 1  
+#define SECCOMP_MODE_FILTER 2  
+#define SECCOMP_RET_KILL 0x00000000U  
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define SECCOMP_RET_TRAP 0x00030000U  
+#define SECCOMP_RET_ERRNO 0x00050000U  
+#define SECCOMP_RET_TRACE 0x7ff00000U  
+#define SECCOMP_RET_ALLOW 0x7fff0000U  
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define SECCOMP_RET_ACTION 0x7fff0000U
+#define SECCOMP_RET_DATA 0x0000ffffU
+struct seccomp_data {
+ int nr;
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+ __u32 arch;
+ __u64 instruction_pointer;
+ __u64 args[6];
+};
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#endif
diff --git a/libc/kernel/common/linux/watchdog.h b/libc/kernel/common/linux/watchdog.h
new file mode 100644
index 0000000..4cbff4b
--- /dev/null
+++ b/libc/kernel/common/linux/watchdog.h
@@ -0,0 +1,65 @@
+/****************************************************************************
+ ****************************************************************************
+ ***
+ ***   This header was automatically generated from a Linux kernel header
+ ***   of the same name, to make information necessary for userspace to
+ ***   call into the kernel available to libc.  It contains only constants,
+ ***   structures, and macros generated from the original header, and thus,
+ ***   contains no copyrightable information.
+ ***
+ ***   To edit the content of this header, modify the corresponding
+ ***   source file (e.g. under external/kernel-headers/original/) then
+ ***   run bionic/libc/kernel/tools/update_all.py
+ ***
+ ***   Any manual change here will be lost the next time this script will
+ ***   be run. You've been warned!
+ ***
+ ****************************************************************************
+ ****************************************************************************/
+#ifndef _LINUX_WATCHDOG_H
+#define _LINUX_WATCHDOG_H
+#include <linux/ioctl.h>
+#include <linux/types.h>
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WATCHDOG_IOCTL_BASE 'W'
+struct watchdog_info {
+ __u32 options;
+ __u32 firmware_version;
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+ __u8 identity[32];
+};
+#define WDIOC_GETSUPPORT _IOR(WATCHDOG_IOCTL_BASE, 0, struct watchdog_info)
+#define WDIOC_GETSTATUS _IOR(WATCHDOG_IOCTL_BASE, 1, int)
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOC_GETBOOTSTATUS _IOR(WATCHDOG_IOCTL_BASE, 2, int)
+#define WDIOC_GETTEMP _IOR(WATCHDOG_IOCTL_BASE, 3, int)
+#define WDIOC_SETOPTIONS _IOR(WATCHDOG_IOCTL_BASE, 4, int)
+#define WDIOC_KEEPALIVE _IOR(WATCHDOG_IOCTL_BASE, 5, int)
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOC_SETTIMEOUT _IOWR(WATCHDOG_IOCTL_BASE, 6, int)
+#define WDIOC_GETTIMEOUT _IOR(WATCHDOG_IOCTL_BASE, 7, int)
+#define WDIOC_SETPRETIMEOUT _IOWR(WATCHDOG_IOCTL_BASE, 8, int)
+#define WDIOC_GETPRETIMEOUT _IOR(WATCHDOG_IOCTL_BASE, 9, int)
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOC_GETTIMELEFT _IOR(WATCHDOG_IOCTL_BASE, 10, int)
+#define WDIOF_UNKNOWN -1  
+#define WDIOS_UNKNOWN -1  
+#define WDIOF_OVERHEAT 0x0001  
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOF_FANFAULT 0x0002  
+#define WDIOF_EXTERN1 0x0004  
+#define WDIOF_EXTERN2 0x0008  
+#define WDIOF_POWERUNDER 0x0010  
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOF_CARDRESET 0x0020  
+#define WDIOF_POWEROVER 0x0040  
+#define WDIOF_SETTIMEOUT 0x0080  
+#define WDIOF_MAGICCLOSE 0x0100  
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOF_PRETIMEOUT 0x0200  
+#define WDIOF_KEEPALIVEPING 0x8000  
+#define WDIOS_DISABLECARD 0x0001  
+#define WDIOS_ENABLECARD 0x0002  
+/* WARNING: DO NOT EDIT, AUTO-GENERATED CODE - SEE TOP FOR INSTRUCTIONS */
+#define WDIOS_TEMPPANIC 0x0004  
+#endif
diff --git a/libc/netbsd/net/getnameinfo.c b/libc/netbsd/net/getnameinfo.c
index 8a1e95e..d8ac037 100644
--- a/libc/netbsd/net/getnameinfo.c
+++ b/libc/netbsd/net/getnameinfo.c
@@ -53,7 +53,9 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if.h>
+#if defined(ANDROID_CHANGES) && defined(AF_LINK)
 #include <net/if_dl.h>
+#endif
 #include <net/if_ieee1394.h>
 #include <net/if_types.h>
 #include <netinet/in.h>
@@ -104,8 +106,10 @@
 static int ip6_sa2str __P((const struct sockaddr_in6 *, char *, size_t,
 				 int));
 #endif
+#if defined(ANDROID_CHANGES) && defined(AF_LINK)
 static int getnameinfo_link __P((const struct sockaddr *, socklen_t, char *,
     socklen_t, char *, socklen_t, int));
+#endif
 static int hexname __P((const u_int8_t *, size_t, char *, socklen_t));
 
 // This should be synchronized to ResponseCode.h
@@ -123,7 +127,7 @@
 	case AF_INET6:
 		return getnameinfo_inet(sa, salen, host, hostlen,
 		    serv, servlen, flags);
-#if 0
+#if defined(ANDROID_CHANGES) && defined(AF_LINK)
 	case AF_LINK:
 		return getnameinfo_link(sa, salen, host, hostlen,
 		    serv, servlen, flags);
@@ -408,7 +412,7 @@
 #endif
 
 		if (hp) {
-#if 0
+#if defined(ANDROID_CHANGES) && defined(AF_LINK)
 			/*
 			 * commented out, since "for local host" is not
 			 * implemented here - see RFC2553 p30
@@ -546,6 +550,7 @@
 #endif /* INET6 */
 
 
+#if defined(ANDROID_CHANGES) && defined(AF_LINK)
 /*
  * getnameinfo_link():
  * Format a link-layer address into a printable format, paying attention to
@@ -623,6 +628,7 @@
 		    (size_t)sdl->sdl_alen, host, hostlen);
 	}
 }
+#endif
 
 static int
 hexname(cp, len, host, hostlen)
diff --git a/libc/netbsd/resolv/res_cache.c b/libc/netbsd/resolv/res_cache.c
index 0bb2f23..838e084 100644
--- a/libc/netbsd/resolv/res_cache.c
+++ b/libc/netbsd/resolv/res_cache.c
@@ -1170,6 +1170,15 @@
  * inlined in the Entry structure.
  */
 
+/* Maximum time for a thread to wait for an pending request */
+#define PENDING_REQUEST_TIMEOUT 20;
+
+typedef struct pending_req_info {
+    unsigned int                hash;
+    pthread_cond_t              cond;
+    struct pending_req_info*    next;
+} PendingReqInfo;
+
 typedef struct resolv_cache {
     int              max_entries;
     int              num_entries;
@@ -1178,6 +1187,7 @@
     unsigned         generation;
     int              last_id;
     Entry*           entries;
+    PendingReqInfo   pending_requests;
 } Cache;
 
 typedef struct resolv_cache_info {
@@ -1192,6 +1202,107 @@
 #define  HTABLE_VALID(x)  ((x) != NULL && (x) != HTABLE_DELETED)
 
 static void
+_cache_flush_pending_requests_locked( struct resolv_cache* cache )
+{
+    struct pending_req_info *ri, *tmp;
+    if (cache) {
+        ri = cache->pending_requests.next;
+
+        while (ri) {
+            tmp = ri;
+            ri = ri->next;
+            pthread_cond_broadcast(&tmp->cond);
+
+            pthread_cond_destroy(&tmp->cond);
+            free(tmp);
+        }
+
+        cache->pending_requests.next = NULL;
+    }
+}
+
+/* return 0 if no pending request is found matching the key
+ * if a matching request is found the calling thread will wait
+ * and return 1 when released */
+static int
+_cache_check_pending_request_locked( struct resolv_cache* cache, Entry* key )
+{
+    struct pending_req_info *ri, *prev;
+    int exist = 0;
+
+    if (cache && key) {
+        ri = cache->pending_requests.next;
+        prev = &cache->pending_requests;
+        while (ri) {
+            if (ri->hash == key->hash) {
+                exist = 1;
+                break;
+            }
+            prev = ri;
+            ri = ri->next;
+        }
+
+        if (!exist) {
+            ri = calloc(1, sizeof(struct pending_req_info));
+            if (ri) {
+                ri->hash = key->hash;
+                pthread_cond_init(&ri->cond, NULL);
+                prev->next = ri;
+            }
+        } else {
+            struct timespec ts = {0,0};
+            ts.tv_sec = _time_now() + PENDING_REQUEST_TIMEOUT;
+            int rv = pthread_cond_timedwait(&ri->cond, &cache->lock, &ts);
+        }
+    }
+
+    return exist;
+}
+
+/* notify any waiting thread that waiting on a request
+ * matching the key has been added to the cache */
+static void
+_cache_notify_waiting_tid_locked( struct resolv_cache* cache, Entry* key )
+{
+    struct pending_req_info *ri, *prev;
+
+    if (cache && key) {
+        ri = cache->pending_requests.next;
+        prev = &cache->pending_requests;
+        while (ri) {
+            if (ri->hash == key->hash) {
+                pthread_cond_broadcast(&ri->cond);
+                break;
+            }
+            prev = ri;
+            ri = ri->next;
+        }
+
+        // remove item from list and destroy
+        if (ri) {
+            prev->next = ri->next;
+            pthread_cond_destroy(&ri->cond);
+            free(ri);
+        }
+    }
+}
+
+/* notify the cache that the query failed */
+void
+_resolv_cache_query_failed( struct resolv_cache* cache,
+                   const void* query,
+                   int         querylen)
+{
+    Entry    key[1];
+
+    if (cache && entry_init_key(key, query, querylen)) {
+        pthread_mutex_lock(&cache->lock);
+        _cache_notify_waiting_tid_locked(cache, key);
+        pthread_mutex_unlock(&cache->lock);
+    }
+}
+
+static void
 _cache_flush_locked( Cache*  cache )
 {
     int     nn;
@@ -1208,6 +1319,9 @@
         }
     }
 
+    // flush pending request
+    _cache_flush_pending_requests_locked(cache);
+
     cache->mru_list.mru_next = cache->mru_list.mru_prev = &cache->mru_list;
     cache->num_entries       = 0;
     cache->last_id           = 0;
@@ -1491,7 +1605,17 @@
 
     if (e == NULL) {
         XLOG( "NOT IN CACHE");
-        goto Exit;
+        // calling thread will wait if an outstanding request is found
+        // that matching this query
+        if (!_cache_check_pending_request_locked(cache, key)) {
+            goto Exit;
+        } else {
+            lookup = _cache_lookup_p(cache, key);
+            e = *lookup;
+            if (e == NULL) {
+                goto Exit;
+            }
+        }
     }
 
     now = _time_now();
@@ -1594,6 +1718,7 @@
     _cache_dump_mru(cache);
 #endif
 Exit:
+    _cache_notify_waiting_tid_locked(cache, key);
     pthread_mutex_unlock( &cache->lock );
 }
 
diff --git a/libc/netbsd/resolv/res_init.c b/libc/netbsd/resolv/res_init.c
index ffd4054..56a25af 100644
--- a/libc/netbsd/resolv/res_init.c
+++ b/libc/netbsd/resolv/res_init.c
@@ -99,6 +99,8 @@
 #include <netdb.h>
 
 #ifdef ANDROID_CHANGES
+#include <errno.h>
+#include <fcntl.h>
 #include <sys/system_properties.h>
 #endif /* ANDROID_CHANGES */
 
@@ -716,10 +718,44 @@
 	return (htonl(IN_CLASSC_NET));
 }
 
+#ifdef ANDROID_CHANGES
+static int
+real_randomid(u_int *random_value) {
+	/* open the nonblocking random device, returning -1 on failure */
+	int random_device = open("/dev/urandom", O_RDONLY);
+	if (random_device < 0) {
+		return -1;
+	}
+
+	/* read from the random device, returning -1 on failure (or too many retries)*/
+	u_int retry = 5;
+	for (retry; retry > 0; retry--) {
+		int retval = read(random_device, random_value, sizeof(u_int));
+		if (retval == sizeof(u_int)) {
+			*random_value &= 0xffff;
+			close(random_device);
+			return 0;
+		} else if ((retval < 0) && (errno != EINTR)) {
+			break;
+		}
+	}
+
+	close(random_device);
+	return -1;
+}
+#endif /* ANDROID_CHANGES */
+
 u_int
 res_randomid(void) {
+#ifdef ANDROID_CHANGES
+	int status = 0;
+	u_int output = 0;
+	status = real_randomid(&output);
+	if (status != -1) {
+		return output;
+	}
+#endif /* ANDROID_CHANGES */
 	struct timeval now;
-
 	gettimeofday(&now, NULL);
 	return (0xffff & (now.tv_sec ^ now.tv_usec ^ getpid()));
 }
diff --git a/libc/netbsd/resolv/res_send.c b/libc/netbsd/resolv/res_send.c
index dbad6dd..72a7ada 100644
--- a/libc/netbsd/resolv/res_send.c
+++ b/libc/netbsd/resolv/res_send.c
@@ -646,6 +646,9 @@
 		errno = terrno;
 	return (-1);
  fail:
+#if USE_RESOLV_CACHE
+	_resolv_cache_query_failed(cache, buf, buflen);
+#endif
 	res_nclose(statp);
 	return (-1);
 }
@@ -1144,6 +1147,9 @@
 		 * XXX - potential security hazard could
 		 *	 be detected here.
 		 */
+#ifdef ANDROID_CHANGES
+		__libc_android_log_event_uid(BIONIC_EVENT_RESOLVER_OLD_RESPONSE);
+#endif
 		DprintQ((statp->options & RES_DEBUG) ||
 			(statp->pfcode & RES_PRF_REPLY),
 			(stdout, ";; old answer:\n"),
@@ -1157,6 +1163,9 @@
 		 * XXX - potential security hazard could
 		 *	 be detected here.
 		 */
+#ifdef ANDROID_CHANGES
+		__libc_android_log_event_uid(BIONIC_EVENT_RESOLVER_WRONG_SERVER);
+#endif
 		DprintQ((statp->options & RES_DEBUG) ||
 			(statp->pfcode & RES_PRF_REPLY),
 			(stdout, ";; not our server:\n"),
@@ -1187,6 +1196,9 @@
 		 * XXX - potential security hazard could
 		 *	 be detected here.
 		 */
+#ifdef ANDROID_CHANGES
+		__libc_android_log_event_uid(BIONIC_EVENT_RESOLVER_WRONG_QUERY);
+#endif
 		DprintQ((statp->options & RES_DEBUG) ||
 			(statp->pfcode & RES_PRF_REPLY),
 			(stdout, ";; wrong query name:\n"),
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/private/__dso_handle.h
similarity index 70%
rename from libc/arch-arm/bionic/atexit.S
rename to libc/private/__dso_handle.h
index beea685..e67ce7c 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/private/__dso_handle.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,9 @@
  * SUCH DAMAGE.
  */
 
+
 #ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
+__attribute__ ((visibility ("hidden")))
 #endif
+__attribute__ ((section (".bss")))
+void *__dso_handle = (void *) 0;
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/private/__dso_handle_so.c
similarity index 68%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/private/__dso_handle_so.c
index beea685..198e64b 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/private/__dso_handle_so.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,7 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+
+__attribute__ ((visibility ("hidden")))
+__attribute__ ((section (".data")))
+void *__dso_handle;
diff --git a/libc/private/logd.h b/libc/private/logd.h
index 4a9b62e..8970daf 100644
--- a/libc/private/logd.h
+++ b/libc/private/logd.h
@@ -30,6 +30,21 @@
 
 #include <stdarg.h>
 
+#define BIONIC_EVENT_MEMCPY_BUFFER_OVERFLOW 80100
+#define BIONIC_EVENT_STRCAT_BUFFER_OVERFLOW 80105
+#define BIONIC_EVENT_MEMMOVE_BUFFER_OVERFLOW 80110
+#define BIONIC_EVENT_STRNCAT_BUFFER_OVERFLOW 80115
+#define BIONIC_EVENT_STRNCPY_BUFFER_OVERFLOW 80120
+#define BIONIC_EVENT_MEMSET_BUFFER_OVERFLOW 80125
+#define BIONIC_EVENT_STRCPY_BUFFER_OVERFLOW 80130
+
+#define BIONIC_EVENT_STRCAT_INTEGER_OVERFLOW 80200
+#define BIONIC_EVENT_STRNCAT_INTEGER_OVERFLOW 80205
+
+#define BIONIC_EVENT_RESOLVER_OLD_RESPONSE 80300
+#define BIONIC_EVENT_RESOLVER_WRONG_SERVER 80305
+#define BIONIC_EVENT_RESOLVER_WRONG_QUERY 80310
+
 enum  {
     ANDROID_LOG_UNKNOWN = 0,
     ANDROID_LOG_DEFAULT,    /* only for SetMinPriority() */
@@ -48,4 +63,7 @@
 int __libc_android_log_print(int prio, const char *tag, const char *fmt, ...);
 int __libc_android_log_vprint(int prio, const char *tag, const char *fmt, va_list ap);
 
+void __libc_android_log_event_int(int32_t tag, int value);
+void __libc_android_log_event_uid(int32_t tag);
+
 #endif /* _ANDROID_BIONIC_LOGD_H */
diff --git a/libc/private/resolv_cache.h b/libc/private/resolv_cache.h
index 2a54453..1dcc53f 100644
--- a/libc/private/resolv_cache.h
+++ b/libc/private/resolv_cache.h
@@ -95,4 +95,10 @@
                    const void*           answer,
                    int                   answerlen );
 
+/* Notify the cache a request failed */
+extern void
+_resolv_cache_query_failed( struct resolv_cache* cache,
+                   const void* query,
+                   int         querylen);
+
 #endif /* _RESOLV_CACHE_H_ */
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/stdio/__snprintf_chk.c
similarity index 62%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/stdio/__snprintf_chk.c
index beea685..dbda3db 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/stdio/__snprintf_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,34 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <stdio.h>
+#include <stdarg.h>
+
+/*
+ * Runtime implementation of __builtin____snprintf_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This snprintf check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+int __snprintf_chk(
+        char *dest,
+        size_t supplied_size,
+        int flags,
+        size_t dest_len_from_compiler,
+        const char *format, ...)
+{
+    va_list va;
+    int retval;
+
+    va_start(va, format);
+    retval = __vsnprintf_chk(dest, supplied_size, flags,
+                             dest_len_from_compiler, format, va);
+    va_end(va);
+
+    return retval;
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/stdio/__sprintf_chk.c
similarity index 64%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/stdio/__sprintf_chk.c
index beea685..67acbe1 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/stdio/__sprintf_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,33 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <stdio.h>
+#include <stdarg.h>
+
+/*
+ * Runtime implementation of __builtin____sprintf_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This sprintf check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+int __sprintf_chk(
+        char *dest,
+        int flags,
+        size_t dest_len_from_compiler,
+        const char *format, ...)
+{
+    va_list va;
+    int retval;
+
+    va_start(va, format);
+    retval = __vsprintf_chk(dest, flags,
+                             dest_len_from_compiler, format, va);
+    va_end(va);
+
+    return retval;
+}
diff --git a/libc/arch-arm/bionic/crtbegin_so.S b/libc/stdio/__vsnprintf_chk.c
similarity index 60%
rename from libc/arch-arm/bionic/crtbegin_so.S
rename to libc/stdio/__vsnprintf_chk.c
index 104d214..a1a1039 100644
--- a/libc/arch-arm/bionic/crtbegin_so.S
+++ b/libc/stdio/__vsnprintf_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,39 +26,35 @@
  * SUCH DAMAGE.
  */
 
-#include <machine/asm.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <private/logd.h>
 
-# Implement static C++ destructors when the shared
-# library is unloaded through dlclose().
-#
-# A call to this function must be the first entry
-# in the .fini_array. See 3.3.5.3.C of C++ ABI
-# standard.
-#
-ENTRY(__on_dlclose)
-        adr     r0, 0f
-        ldr     r0, [r0]
-        b       __cxa_finalize
-END(__on_dlclose)
+/*
+ * Runtime implementation of __builtin____vsnprintf_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This vsnprintf check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+int __vsnprintf_chk(
+        char *dest,
+        size_t supplied_size,
+        int flags,
+        size_t dest_len_from_compiler,
+        const char *format,
+        va_list va)
+{
+    if (supplied_size > dest_len_from_compiler) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** vsnprintf buffer overflow detected ***\n");
+        abort();
+    }
 
-0:
-        .long   __dso_handle
-
-	.section .init_array, "aw"
-	.globl __INIT_ARRAY__
-__INIT_ARRAY__:
-	.long -1
-
-        .section .fini_array, "aw"
-        .globl __FINI_ARRAY__
-__FINI_ARRAY__:
-        .long -1
-        .long __on_dlclose
-
-#ifdef CRT_LEGACY_WORKAROUND
-#include "__dso_handle.S"
-#else
-#include "__dso_handle_so.S"
-#endif
-
-#include "atexit.S"
+    return vsnprintf(dest, supplied_size, format, va);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/stdio/__vsprintf_chk.c
similarity index 60%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/stdio/__vsprintf_chk.c
index beea685..8a809fc 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/stdio/__vsprintf_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,36 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <private/logd.h>
+
+/*
+ * Runtime implementation of __builtin____vsprintf_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This vsprintf check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+int __vsprintf_chk(
+        char *dest,
+        int flags,
+        size_t dest_len_from_compiler,
+        const char *format,
+        va_list va)
+{
+    int ret = vsnprintf(dest, dest_len_from_compiler, format, va);
+
+    if ((size_t) ret >= dest_len_from_compiler) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** vsprintf buffer overflow detected ***\n");
+        abort();
+    }
+
+    return ret;
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__memcpy_chk.c
similarity index 62%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__memcpy_chk.c
index beea685..e79f6ac 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__memcpy_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,30 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * Runtime implementation of __builtin____memcpy_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This memcpy check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+void *__memcpy_chk (void *dest, const void *src,
+              size_t len, size_t dest_len)
+{
+    if (len > dest_len) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** memcpy buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_MEMCPY_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return memcpy(dest, src, len);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__memmove_chk.c
similarity index 62%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__memmove_chk.c
index beea685..529eb8f 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__memmove_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,30 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * Runtime implementation of __builtin____memmove_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This memmove check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+void *__memmove_chk (void *dest, const void *src,
+              size_t len, size_t dest_len)
+{
+    if (len > dest_len) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** memmove buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_MEMMOVE_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return memmove(dest, src, len);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__memset_chk.c
similarity index 63%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__memset_chk.c
index beea685..0904c03 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__memset_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,29 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * Runtime implementation of __builtin____memset_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This memset check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+void *__memset_chk (void *dest, int c, size_t n, size_t dest_len)
+{
+    if (n > dest_len) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** memset buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_MEMSET_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return memset(dest, c, n);
+}
diff --git a/libc/string/__strcat_chk.c b/libc/string/__strcat_chk.c
new file mode 100644
index 0000000..4665d66
--- /dev/null
+++ b/libc/string/__strcat_chk.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+#include <safe_iop.h>
+
+/*
+ * Runtime implementation of __builtin____strcat_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This strcat check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+char *__strcat_chk (char *dest, const char *src, size_t dest_buf_size)
+{
+    // TODO: optimize so we don't scan src/dest twice.
+    size_t src_len  = strlen(src);
+    size_t dest_len = strlen(dest);
+    size_t sum;
+
+    // sum = src_len + dest_len + 1 (with overflow protection)
+    if (!safe_add3(&sum, src_len, dest_len, 1U)) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strcat integer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_STRCAT_INTEGER_OVERFLOW);
+        abort();
+    }
+
+    if (sum > dest_buf_size) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strcat buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_STRNCAT_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return strcat(dest, src);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__strcpy_chk.c
similarity index 60%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__strcpy_chk.c
index beea685..79486b4 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__strcpy_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,31 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * Runtime implementation of __builtin____strcpy_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This strcpy check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+char *__strcpy_chk (char *dest, const char *src, size_t dest_len)
+{
+    // TODO: optimize so we don't scan src twice.
+    size_t src_len = strlen(src) + 1;
+    if (src_len > dest_len) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strcpy buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_STRCPY_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return strcpy(dest, src);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__strlcat_chk.c
similarity index 61%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__strlcat_chk.c
index beea685..b895fb8 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__strlcat_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,30 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * __strlcat_chk. Called in place of strlcat() when we know the
+ * size of the buffer we're writing into.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This strlcat check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+size_t __strlcat_chk(char *dest, const char *src,
+              size_t supplied_size, size_t dest_len_from_compiler)
+{
+    if (supplied_size > dest_len_from_compiler) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strlcat buffer overflow detected ***\n");
+        abort();
+    }
+
+    return strlcat(dest, src, supplied_size);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__strlcpy_chk.c
similarity index 61%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__strlcpy_chk.c
index beea685..752c86c 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__strlcpy_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,30 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * __strlcpy_chk. Called in place of strlcpy() when we know the
+ * size of the buffer we're writing into.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This strlcpy check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+size_t __strlcpy_chk(char *dest, const char *src,
+              size_t supplied_size, size_t dest_len_from_compiler)
+{
+    if (supplied_size > dest_len_from_compiler) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strlcpy buffer overflow detected ***\n");
+        abort();
+    }
+
+    return strlcpy(dest, src, supplied_size);
+}
diff --git a/libc/string/__strncat_chk.c b/libc/string/__strncat_chk.c
new file mode 100644
index 0000000..2036c9f
--- /dev/null
+++ b/libc/string/__strncat_chk.c
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+#include <safe_iop.h>
+
+/*
+ * Runtime implementation of __builtin____strncat_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This strncat check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+char *__strncat_chk (char *dest, const char *src,
+              size_t len, size_t dest_buf_size)
+{
+    // TODO: optimize so we don't scan src/dest twice.
+    size_t dest_len = strlen(dest);
+    size_t src_len = strlen(src);
+    if (src_len > len) {
+        src_len = len;
+    }
+
+    size_t sum;
+    // sum = src_len + dest_len + 1 (with overflow protection)
+    if (!safe_add3(&sum, src_len, dest_len, 1U)) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strncat integer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_STRNCAT_INTEGER_OVERFLOW);
+        abort();
+    }
+
+    if (sum > dest_buf_size) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strncat buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_STRNCAT_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return strncat(dest, src, len);
+}
diff --git a/libc/arch-arm/bionic/atexit.S b/libc/string/__strncpy_chk.c
similarity index 62%
copy from libc/arch-arm/bionic/atexit.S
copy to libc/string/__strncpy_chk.c
index beea685..3f9e9fb 100644
--- a/libc/arch-arm/bionic/atexit.S
+++ b/libc/string/__strncpy_chk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 The Android Open Source Project
+ * Copyright (C) 2012 The Android Open Source Project
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,37 +26,30 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CRT_LEGACY_WORKAROUND
-	.arch armv5te
-	.fpu softvfp
-	.eabi_attribute 20, 1
-	.eabi_attribute 21, 1
-	.eabi_attribute 23, 3
-	.eabi_attribute 24, 1
-	.eabi_attribute 25, 1
-	.eabi_attribute 26, 2
-	.eabi_attribute 30, 4
-	.eabi_attribute 18, 4
-	.hidden	atexit
-	.code	16
-	.thumb_func
-ENTRY(atexit)
-.LFB0:
-	.save	{r4, lr}
-	push	{r4, lr}
-.LCFI0:
-	ldr	r3, .L3
-	mov	r1, #0
-	@ sp needed for prologue
-.LPIC0:
-	add	r3, pc
-	ldr	r2, [r3]
-	bl	__cxa_atexit
-	pop	{r4, pc}
-.L4:
-	.align	2
-.L3:
-	.word	__dso_handle-(.LPIC0+4)
-.LFE0:
-END(atexit)
-#endif
+#include <string.h>
+#include <stdlib.h>
+#include <private/logd.h>
+
+/*
+ * Runtime implementation of __builtin____strncpy_chk.
+ *
+ * See
+ *   http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
+ *   http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
+ * for details.
+ *
+ * This strncpy check is called if _FORTIFY_SOURCE is defined and
+ * greater than 0.
+ */
+char *__strncpy_chk (char *dest, const char *src,
+              size_t len, size_t dest_len)
+{
+    if (len > dest_len) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** strncpy buffer overflow detected ***\n");
+        __libc_android_log_event_uid(BIONIC_EVENT_STRNCPY_BUFFER_OVERFLOW);
+        abort();
+    }
+
+    return strncpy(dest, src, len);
+}
diff --git a/libc/unistd/open.c b/libc/unistd/open.c
index 03cba45..56602db 100644
--- a/libc/unistd/open.c
+++ b/libc/unistd/open.c
@@ -28,6 +28,8 @@
 #include <unistd.h>
 #include <fcntl.h>
 #include <stdarg.h>
+#include <stdlib.h>
+#include <private/logd.h>
 
 extern int  __open(const char*, int, int);
 
@@ -49,3 +51,15 @@
     return __open(pathname, flags, mode);
 }
 
+int __open_2(const char *pathname, int flags) {
+    if (flags & O_CREAT) {
+        __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
+            "*** open(O_CREAT) called without specifying a mode ***\n");
+        abort();
+    }
+
+    flags |= O_LARGEFILE;
+
+    return __open(pathname, flags, 0);
+}
+
diff --git a/libc/unistd/sysconf.c b/libc/unistd/sysconf.c
index 9377802..7caa4e9 100644
--- a/libc/unistd/sysconf.c
+++ b/libc/unistd/sysconf.c
@@ -25,16 +25,19 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-#include <unistd.h>
-#include <sys/sysconf.h>
-#include <limits.h>
-#include <bionic_tls.h>
+
 #include <asm/page.h>
-#include <stdio.h>  /* for FOPEN_MAX */
+#include <bionic_tls.h>
+#include <ctype.h>
+#include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <limits.h>
+#include <stdbool.h>
+#include <stdio.h>  // For FOPEN_MAX.
 #include <string.h>
-#include <ctype.h>
+#include <sys/sysconf.h>
+#include <unistd.h>
 
 /* seems to be the default on Linux, per the GLibc sources and my own digging */
 
@@ -62,18 +65,88 @@
 #define  SYSTEM_2_FORT_DEV   -1       /* Fortran development unsupported */
 #define  SYSTEM_2_FORT_RUN   -1       /* Fortran runtime unsupported */
 #define  SYSTEM_2_SW_DEV     -1       /* posix software dev utilities unsupported */
-#define  SYSTEM_2_LOCALEDEF  -1       /* localdef() unimplemented */
+#define  SYSTEM_2_LOCALEDEF  -1       /* localedef() unimplemented */
 #define  SYSTEM_2_UPE        -1       /* No UPE for you ! (User Portability Utilities) */
 #define  SYSTEM_2_VERSION    -1       /* No posix command-line tools */
 
-static int  __get_nproc_conf(void);
-static int  __get_nproc_onln(void);
-static int  __get_phys_pages(void);
-static int  __get_avphys_pages(void);
+static bool __matches_cpuN(const char* s) {
+  // The %c trick is to ensure that we have the anchored match "^cpu[0-9]+$".
+  unsigned cpu;
+  char dummy;
+  return (sscanf(s, "cpu%u%c", &cpu, &dummy) == 1);
+}
 
-int
-sysconf( int  name )
-{
+static int __get_nproc_conf(void) {
+  // On x86 kernels you can use /proc/cpuinfo for this, but on ARM kernels offline CPUs disappear
+  // from there. This method works on both.
+  DIR* d = opendir("/sys/devices/system/cpu");
+  if (!d) {
+    return 1;
+  }
+
+  int result = 0;
+  struct dirent de;
+  struct dirent* e;
+  while (!readdir_r(d, &de, &e) && e != NULL) {
+    if (e->d_type == DT_DIR && __matches_cpuN(e->d_name)) {
+      ++result;
+    }
+  }
+  closedir(d);
+  return result;
+}
+
+static int __get_nproc_onln(void) {
+  FILE* fp = fopen("/proc/stat", "r");
+  if (fp == NULL) {
+    return 1;
+  }
+
+  int result = 0;
+  char buf[256];
+  while (fgets(buf, sizeof(buf), fp) != NULL) {
+    // Extract just the first word from the line.
+    // 'cpu0 7976751 1364388 3116842 469770388 8629405 0 49047 0 0 0'
+    char* p = strchr(buf, ' ');
+    if (p != NULL) {
+      *p = 0;
+    }
+    if (__matches_cpuN(buf)) {
+      ++result;
+    }
+  }
+  fclose(fp);
+  return result;
+}
+
+static int __get_meminfo(const char* pattern) {
+  FILE* fp = fopen("/proc/meminfo", "r");
+  if (fp == NULL) {
+    return -1;
+  }
+
+  int result = -1;
+  char buf[256];
+  while (fgets(buf, sizeof(buf), fp) != NULL) {
+    long total;
+    if (sscanf(buf, pattern, &total) == 1) {
+      result = (int) (total / (PAGE_SIZE/1024));
+      break;
+    }
+  }
+  fclose(fp);
+  return result;
+}
+
+static int __get_phys_pages(void) {
+  return __get_meminfo("MemTotal: %ld kB");
+}
+
+static int __get_avphys_pages(void) {
+  return __get_meminfo("MemFree: %ld kB");
+}
+
+int sysconf(int name) {
     switch (name) {
 #ifdef _POSIX_ARG_MAX
     case _SC_ARG_MAX:           return _POSIX_ARG_MAX;
@@ -266,169 +339,3 @@
         return -1;
     }
 }
-
-
-typedef struct {
-    int   rpos;
-    int   len;
-    int   overflow;
-    int   fd;
-    int   in_len;
-    int   in_pos;
-    char  buff[128];
-    char  input[128];
-} LineParser;
-
-static int
-line_parser_init( LineParser*  p, const char*  path )
-{
-    p->rpos     = 0;
-    p->len      = (int)sizeof(p->buff);
-    p->overflow = 0;
-
-    p->in_len   = 0;
-    p->in_pos   = 0;
-    p->fd       = open( path, O_RDONLY );
-
-    return p->fd;
-}
-
-
-static int
-line_parser_addc( LineParser*  p, int  c )
-{
-    if (p->overflow) {
-        p->overflow = (c == '\n');
-        return 0;
-    }
-    if (p->rpos >= p->len) {
-        p->overflow = 1;
-        return 0;
-    }
-    if (c == '\n') {
-        p->buff[p->rpos] = 0;
-        p->rpos = 0;
-        return 1;
-    }
-    p->buff[p->rpos++] = (char) c;
-    return 0;
-}
-
-static int
-line_parser_getc( LineParser*  p )
-{
-    if (p->in_pos >= p->in_len) {
-        int  ret;
-
-        p->in_len = p->in_pos = 0;
-        do {
-            ret = read(p->fd, p->input, sizeof(p->input));
-        } while (ret < 0 && errno == EINTR);
-
-        if (ret <= 0)
-            return -1;
-
-        p->in_len = ret;
-    }
-    return p->input[ p->in_pos++ ];
-}
-
-static const char*
-line_parser_gets( LineParser*  p )
-{
-    for (;;) {
-        for (;;) {
-            int  c = line_parser_getc(p);
-
-            if (c < 0) {
-                close(p->fd);
-                p->fd = -1;
-                return NULL;
-             }
-             if (line_parser_addc(p, c))
-                return p->buff;
-        }
-    }
-}
-
-static void
-line_parser_done( LineParser* p )
-{
-    if (p->fd >= 0) {
-        close(p->fd);
-        p->fd = -1;
-    }
-}
-
-static int
-__get_nproc_conf(void)
-{
-    LineParser   parser[1];
-    const char*  p;
-    int          count = 0;
-
-    if (line_parser_init(parser, "/proc/cpuinfo") < 0)
-        return 1;
-
-    while ((p = line_parser_gets(parser))) {
-        if ( !memcmp(p, "processor", 9) )
-            count += 1;
-    }
-    return (count < 1) ? 1 : count;
-}
-
-
-static int
-__get_nproc_onln(void)
-{
-    LineParser   parser[1];
-    const char*  p;
-    int          count = 0;
-
-    if (line_parser_init(parser, "/proc/stat") < 0)
-        return 1;
-
-    while ((p = line_parser_gets(parser))) {
-        if ( !memcmp(p, "cpu", 3) && isdigit(p[3]) )
-            count += 1;
-    }
-    return (count < 1) ? 1 : count;
-}
-
-static int
-__get_phys_pages(void)
-{
-    LineParser   parser[1];
-    const char*  p;
-
-    if (line_parser_init(parser, "/proc/meminfo") < 0)
-        return -2;  /* what ? */
-
-    while ((p = line_parser_gets(parser))) {
-        long  total;
-        if ( sscanf(p, "MemTotal: %ld kB", &total) == 1 ) {
-            line_parser_done(parser);
-            return (int) (total / (PAGE_SIZE/1024));
-        }
-    }
-    return -3;
-}
-
-static int
-__get_avphys_pages(void)
-{
-    LineParser   parser[1];
-    const char*  p;
-
-    if (line_parser_init(parser, "/proc/meminfo") < 0)
-        return -1;  /* what ? */
-
-    while ((p = line_parser_gets(parser))) {
-        long  total;
-        if ( sscanf(p, "MemFree: %ld kB", &total) == 1 ) {
-            line_parser_done(parser);
-            return (int) (total / (PAGE_SIZE/1024));
-        }
-    }
-    return -1;
-}
diff --git a/libm/Android.mk b/libm/Android.mk
index 07cb7db..756c9ab 100644
--- a/libm/Android.mk
+++ b/libm/Android.mk
@@ -54,7 +54,6 @@
 	src/e_sinh.c \
 	src/e_sinhf.c \
 	src/e_sqrt.c \
-	src/e_sqrtf.c \
 	src/k_cos.c \
 	src/k_cosf.c \
 	src/k_rem_pio2.c \
@@ -160,7 +159,8 @@
 	src/e_ldexpf.c \
 	src/s_scalbln.c \
 	src/s_scalbn.c \
-	src/s_scalbnf.c
+	src/s_scalbnf.c \
+	src/e_sqrtf.c
 
   libm_common_includes = $(LOCAL_PATH)/arm
 endif
@@ -170,7 +170,8 @@
 	i387/fenv.c \
 	i387/s_scalbnl.S \
 	i387/s_scalbn.S \
-	i387/s_scalbnf.S
+	i387/s_scalbnf.S \
+	i387/e_sqrtf.S
 
   libm_common_includes = $(LOCAL_PATH)/i386 $(LOCAL_PATH)/i387
 endif
@@ -180,7 +181,8 @@
 	src/e_ldexpf.c \
 	src/s_scalbln.c \
 	src/s_scalbn.c \
-	src/s_scalbnf.c
+	src/s_scalbnf.c \
+	src/e_sqrtf.c
 
   libm_common_includes = $(LOCAL_PATH)/mips
   # Need to build *rint* functions
diff --git a/linker/Android.mk b/linker/Android.mk
index 4a81681..a739b4f 100644
--- a/linker/Android.mk
+++ b/linker/Android.mk
@@ -6,6 +6,7 @@
 	linker.c \
 	linker_environ.c \
 	linker_format.c \
+	linker_phdr.c \
 	rt.c \
 	dlfcn.c \
 	debugger.c
@@ -26,7 +27,9 @@
 ifeq ($(TARGET_ARCH)-$(ARCH_ARM_HAVE_TLS_REGISTER),arm-true)
     LOCAL_CFLAGS += -DHAVE_ARM_TLS_REGISTER
 endif
-LOCAL_CFLAGS += -I$(LOCAL_PATH)/../libc/private
+LOCAL_CFLAGS += \
+    -I$(LOCAL_PATH)/../libc/private \
+    -I$(LOCAL_PATH)/../libc/arch-$(TARGET_ARCH)/bionic
 
 ifeq ($(TARGET_ARCH),arm)
 LOCAL_CFLAGS += -DANDROID_ARM_LINKER
diff --git a/linker/arch/x86/begin.S b/linker/arch/x86/begin.S
index b4427e0..0c0fc3d 100644
--- a/linker/arch/x86/begin.S
+++ b/linker/arch/x86/begin.S
@@ -44,3 +44,4 @@
         popl   %esp
         jmp    *%eax
 
+#include "__stack_chk_fail_local.S"
diff --git a/linker/debugger.c b/linker/debugger.c
index 899a5b2..756b5cf 100644
--- a/linker/debugger.c
+++ b/linker/debugger.c
@@ -44,6 +44,23 @@
 
 void notify_gdb_of_libraries();
 
+#define DEBUGGER_SOCKET_NAME "android:debuggerd"
+
+typedef enum {
+    // dump a crash
+    DEBUGGER_ACTION_CRASH,
+    // dump a tombstone file
+    DEBUGGER_ACTION_DUMP_TOMBSTONE,
+    // dump a backtrace only back to the socket
+    DEBUGGER_ACTION_DUMP_BACKTRACE,
+} debugger_action_t;
+
+/* message sent over the socket */
+typedef struct {
+    debugger_action_t action;
+    pid_t tid;
+} debugger_msg_t;
+
 #define  RETRY_ON_EINTR(ret,cond) \
     do { \
         ret = (cond); \
@@ -146,7 +163,7 @@
     logSignalSummary(n, info);
 
     tid = gettid();
-    s = socket_abstract_client("android:debuggerd", SOCK_STREAM);
+    s = socket_abstract_client(DEBUGGER_SOCKET_NAME, SOCK_STREAM);
 
     if (s >= 0) {
         /* debugger knows our pid from the credentials on the
@@ -155,9 +172,11 @@
          * that's actually in our process
          */
         int  ret;
-
-        RETRY_ON_EINTR(ret, write(s, &tid, sizeof(unsigned)));
-        if (ret == sizeof(unsigned)) {
+        debugger_msg_t msg;
+        msg.action = DEBUGGER_ACTION_CRASH;
+        msg.tid = tid;
+        RETRY_ON_EINTR(ret, write(s, &msg, sizeof(msg)));
+        if (ret == sizeof(msg)) {
             /* if the write failed, there is no point to read on
              * the file descriptor. */
             RETRY_ON_EINTR(ret, read(s, &tid, 1));
diff --git a/linker/dlfcn.c b/linker/dlfcn.c
index ac7e5d3..3d0384f 100644
--- a/linker/dlfcn.c
+++ b/linker/dlfcn.c
@@ -60,7 +60,7 @@
     if (unlikely(ret == NULL)) {
         set_dlerror(DL_ERR_CANNOT_LOAD_LIBRARY);
     } else {
-        call_constructors_recursive(ret);
+        soinfo_call_constructors(ret);
         ret->refcount++;
     }
     pthread_mutex_unlock(&dl_lock);
@@ -103,7 +103,7 @@
         }
     } else {
         found = (soinfo*)handle;
-        sym = lookup_in_library(found, symbol);
+        sym = soinfo_lookup(found, symbol);
     }
 
     if(likely(sym != 0)) {
@@ -141,7 +141,7 @@
         info->dli_fbase = (void*)si->base;
 
         /* Determine if any symbol in the library contains the specified address */
-        Elf32_Sym *sym = find_containing_symbol(addr, si);
+        Elf32_Sym *sym = soinfo_find_symbol(si, addr);
 
         if(sym != NULL) {
             info->dli_sname = si->strtab + sym->st_name;
@@ -159,7 +159,7 @@
 int dlclose(void *handle)
 {
     pthread_mutex_lock(&dl_lock);
-    (void)unload_library((soinfo*)handle);
+    (void)soinfo_unload((soinfo*)handle);
     pthread_mutex_unlock(&dl_lock);
     return 0;
 }
diff --git a/linker/linker.c b/linker/linker.c
index eb9cc3e..e90ac0a 100644
--- a/linker/linker.c
+++ b/linker/linker.c
@@ -50,6 +50,7 @@
 #include "linker_debug.h"
 #include "linker_environ.h"
 #include "linker_format.h"
+#include "linker_phdr.h"
 
 #define ALLOW_SYMBOLS_FROM_MAIN 1
 #define SO_MAX 128
@@ -82,7 +83,7 @@
 */
 
 
-static int link_image(soinfo *si, unsigned wr_offset);
+static int soinfo_link_image(soinfo *si, unsigned wr_offset);
 
 static int socount = 0;
 static soinfo sopool[SO_MAX];
@@ -125,10 +126,6 @@
 unsigned bitmask[4096];
 #endif
 
-#ifndef PT_ARM_EXIDX
-#define PT_ARM_EXIDX    0x70000001      /* .ARM.exidx segment */
-#endif
-
 #define HOODLUM(name, ret, ...)                                               \
     ret name __VA_ARGS__                                                      \
     {                                                                         \
@@ -254,7 +251,7 @@
     rtld_db_dlactivity();
 }
 
-static soinfo *alloc_info(const char *name)
+static soinfo *soinfo_alloc(const char *name)
 {
     soinfo *si;
 
@@ -263,7 +260,7 @@
         return NULL;
     }
 
-    /* The freelist is populated when we call free_info(), which in turn is
+    /* The freelist is populated when we call soinfo_free(), which in turn is
        done only by dlclose(), which is not likely to be used.
     */
     if (!freelist) {
@@ -290,7 +287,7 @@
     return si;
 }
 
-static void free_info(soinfo *si)
+static void soinfo_free(soinfo *si)
 {
     soinfo *prev = NULL, *trav;
 
@@ -347,7 +344,7 @@
     for (si = solist; si != 0; si = si->next){
         if ((addr >= si->base) && (addr < (si->base + si->size))) {
             *pcount = si->ARM_exidx_count;
-            return (_Unwind_Ptr)(si->base + (unsigned long)si->ARM_exidx);
+            return (_Unwind_Ptr)si->ARM_exidx;
         }
     }
    *pcount = 0;
@@ -377,7 +374,7 @@
 }
 #endif
 
-static Elf32_Sym *_elf_lookup(soinfo *si, unsigned hash, const char *name)
+static Elf32_Sym *soinfo_elf_lookup(soinfo *si, unsigned hash, const char *name)
 {
     Elf32_Sym *s;
     Elf32_Sym *symtab = si->symtab;
@@ -423,7 +420,7 @@
 }
 
 static Elf32_Sym *
-_do_lookup(soinfo *si, const char *name, unsigned *base)
+soinfo_do_lookup(soinfo *si, const char *name, Elf32_Addr *offset)
 {
     unsigned elf_hash = elfhash(name);
     Elf32_Sym *s;
@@ -441,14 +438,14 @@
      * and some the first non-weak definition.   This is system dependent.
      * Here we return the first definition found for simplicity.  */
 
-    s = _elf_lookup(si, elf_hash, name);
+    s = soinfo_elf_lookup(si, elf_hash, name);
     if(s != NULL)
         goto done;
 
     /* Next, look for it in the preloads list */
     for(i = 0; preloads[i] != NULL; i++) {
         lsi = preloads[i];
-        s = _elf_lookup(lsi, elf_hash, name);
+        s = soinfo_elf_lookup(lsi, elf_hash, name);
         if(s != NULL)
             goto done;
     }
@@ -464,7 +461,7 @@
 
             DEBUG("%5d %s: looking up %s in %s\n",
                   pid, si->name, name, lsi->name);
-            s = _elf_lookup(lsi, elf_hash, name);
+            s = soinfo_elf_lookup(lsi, elf_hash, name);
             if ((s != NULL) && (s->st_shndx != SHN_UNDEF))
                 goto done;
         }
@@ -479,16 +476,17 @@
         lsi = somain;
         DEBUG("%5d %s: looking up %s in executable %s\n",
               pid, si->name, name, lsi->name);
-        s = _elf_lookup(lsi, elf_hash, name);
+        s = soinfo_elf_lookup(lsi, elf_hash, name);
     }
 #endif
 
 done:
     if(s != NULL) {
         TRACE_TYPE(LOOKUP, "%5d si %s sym %s s->st_value = 0x%08x, "
-                   "found in %s, base = 0x%08x\n",
-                   pid, si->name, name, s->st_value, lsi->name, lsi->base);
-        *base = lsi->base;
+                   "found in %s, base = 0x%08x, load bias = 0x%08x\n",
+                   pid, si->name, name, s->st_value,
+                   lsi->name, lsi->base, lsi->load_bias);
+        *offset = lsi->load_bias;
         return s;
     }
 
@@ -498,9 +496,9 @@
 /* This is used by dl_sym().  It performs symbol lookup only within the
    specified soinfo object and not in any of its dependencies.
  */
-Elf32_Sym *lookup_in_library(soinfo *si, const char *name)
+Elf32_Sym *soinfo_lookup(soinfo *si, const char *name)
 {
-    return _elf_lookup(si, elfhash(name), name);
+    return soinfo_elf_lookup(si, elfhash(name), name);
 }
 
 /* This is used by dl_sym().  It performs a global symbol lookup.
@@ -519,7 +517,7 @@
     {
         if(si->flags & FLAG_ERROR)
             continue;
-        s = _elf_lookup(si, elf_hash, name);
+        s = soinfo_elf_lookup(si, elf_hash, name);
         if (s != NULL) {
             *found = si;
             break;
@@ -549,7 +547,7 @@
     return NULL;
 }
 
-Elf32_Sym *find_containing_symbol(const void *addr, soinfo *si)
+Elf32_Sym *soinfo_find_symbol(soinfo* si, const void *addr)
 {
     unsigned int i;
     unsigned soaddr = (unsigned)addr - si->base;
@@ -584,7 +582,7 @@
 }
 #endif
 
-static const char *sopaths[] = {
+static const char * const sopaths[] = {
     "/vendor/lib",
     "/system/lib",
     0
@@ -596,7 +594,7 @@
     struct stat filestat;
 
     if ((stat(name, &filestat) >= 0) && S_ISREG(filestat.st_mode)) {
-        if ((fd = open(name, O_RDONLY)) >= 0)
+        if ((fd = TEMP_FAILURE_RETRY(open(name, O_RDONLY))) >= 0)
             return fd;
     }
 
@@ -607,7 +605,7 @@
 {
     int fd;
     char buf[512];
-    const char **path;
+    const char * const*path;
     int n;
 
     TRACE("[ %5d opening %s ]\n", pid, name);
@@ -640,10 +638,6 @@
     return -1;
 }
 
-/* temporary space for holding the first page of the shared lib
- * which contains the elf header (with the pht). */
-static unsigned char __header[PAGE_SIZE];
-
 typedef struct {
     long mmap_addr;
     char tag[4]; /* 'P', 'R', 'E', ' ' */
@@ -663,12 +657,12 @@
         return 0;
     }
 
-    if (read(fd, &info, sizeof(info)) != sizeof(info)) {
+    if (TEMP_FAILURE_RETRY(read(fd, &info, sizeof(info)) != sizeof(info))) {
         WARN("Could not read prelink_info_t structure for `%s`\n", name);
         return 0;
     }
 
-    if (strncmp(info.tag, "PRE ", 4)) {
+    if (memcmp(info.tag, "PRE ", 4)) {
         WARN("`%s` is not a prelinked library\n", name);
         return 0;
     }
@@ -676,8 +670,8 @@
     return (unsigned long)info.mmap_addr;
 }
 
-/* verify_elf_object
- *      Verifies if the object @ base is a valid ELF object
+/* verify_elf_header
+ *      Verifies the content of an ELF header.
  *
  * Args:
  *
@@ -686,10 +680,8 @@
  *      -1 if no valid ELF object is found @ base.
  */
 static int
-verify_elf_object(void *base, const char *name)
+verify_elf_header(const Elf32_Ehdr* hdr)
 {
-    Elf32_Ehdr *hdr = (Elf32_Ehdr *) base;
-
     if (hdr->e_ident[EI_MAG0] != ELFMAG0) return -1;
     if (hdr->e_ident[EI_MAG1] != ELFMAG1) return -1;
     if (hdr->e_ident[EI_MAG2] != ELFMAG2) return -1;
@@ -705,412 +697,76 @@
 }
 
 
-/* get_lib_extents
- *      Retrieves the base (*base) address where the ELF object should be
- *      mapped and its overall memory size (*total_sz).
- *
- * Args:
- *      fd: Opened file descriptor for the library
- *      name: The name of the library
- *      _hdr: Pointer to the header page of the library
- *      total_sz: Total size of the memory that should be allocated for
- *                this library
- *
- * Returns:
- *      -1 if there was an error while trying to get the lib extents.
- *         The possible reasons are:
- *             - Could not determine if the library was prelinked.
- *             - The library provided is not a valid ELF object
- *       0 if the library did not request a specific base offset (normal
- *         for non-prelinked libs)
- *     > 0 if the library requests a specific address to be mapped to.
- *         This indicates a pre-linked library.
- */
-static unsigned
-get_lib_extents(int fd, const char *name, void *__hdr, unsigned *total_sz)
+static soinfo *
+load_library(const char *name)
 {
+    int fd = open_library(name);
+    int ret, cnt;
+    unsigned ext_sz;
     unsigned req_base;
-    unsigned min_vaddr = 0xffffffff;
-    unsigned max_vaddr = 0;
-    unsigned char *_hdr = (unsigned char *)__hdr;
-    Elf32_Ehdr *ehdr = (Elf32_Ehdr *)_hdr;
-    Elf32_Phdr *phdr;
-    int cnt;
+    const char *bname;
+    struct stat sb;
+    soinfo *si = NULL;
+    Elf32_Ehdr  header[1];
+    int         phdr_count;
+    void*       phdr_mmap = NULL;
+    Elf32_Addr  phdr_size;
+    const Elf32_Phdr* phdr_table;
 
-    TRACE("[ %5d Computing extents for '%s'. ]\n", pid, name);
-    if (verify_elf_object(_hdr, name) < 0) {
-        DL_ERR("%5d - %s is not a valid ELF object", pid, name);
-        return (unsigned)-1;
+    void*       load_start = NULL;
+    Elf32_Addr  load_size = 0;
+    Elf32_Addr  load_bias = 0;
+
+    if (fd == -1) {
+        DL_ERR("Library '%s' not found", name);
+        return NULL;
+    }
+
+    /* Read the ELF header first */
+    ret = TEMP_FAILURE_RETRY(read(fd, (void*)header, sizeof(header)));
+    if (ret < 0) {
+        DL_ERR("%5d can't read file %s: %s", pid, name, strerror(errno));
+        goto fail;
+    }
+    if (ret != (int)sizeof(header)) {
+        DL_ERR("%5d too small to be an ELF executable: %s", pid, name);
+        goto fail;
+    }
+    if (verify_elf_header(header) < 0) {
+        DL_ERR("%5d not a valid ELF executable: %s", pid, name);
+        goto fail;
+    }
+
+    /* Then read the program header table */
+    ret = phdr_table_load(fd, header->e_phoff, header->e_phnum,
+                          &phdr_mmap, &phdr_size, &phdr_table);
+    if (ret < 0) {
+        DL_ERR("%5d can't load program header table: %s: %s", pid,
+               name, strerror(errno));
+        goto fail;
+    }
+    phdr_count = header->e_phnum;
+
+    /* Get the load extents and the prelinked load address, if any */
+    ext_sz = phdr_table_get_load_size(phdr_table, phdr_count);
+    if (ext_sz == 0) {
+        DL_ERR("%5d no loadable segments in file: %s", pid, name);
+        goto fail;
     }
 
     req_base = (unsigned) is_prelinked(fd, name);
-    if (req_base == (unsigned)-1)
-        return -1;
-    else if (req_base != 0) {
+    if (req_base == (unsigned)-1) {
+        DL_ERR("%5d can't read end of library: %s: %s", pid, name,
+               strerror(errno));
+        goto fail;
+    }
+    if (req_base != 0) {
         TRACE("[ %5d - Prelinked library '%s' requesting base @ 0x%08x ]\n",
               pid, name, req_base);
     } else {
         TRACE("[ %5d - Non-prelinked library '%s' found. ]\n", pid, name);
     }
 
-    phdr = (Elf32_Phdr *)(_hdr + ehdr->e_phoff);
-
-    /* find the min/max p_vaddrs from all the PT_LOAD segments so we can
-     * get the range. */
-    for (cnt = 0; cnt < ehdr->e_phnum; ++cnt, ++phdr) {
-        if (phdr->p_type == PT_LOAD) {
-            if ((phdr->p_vaddr + phdr->p_memsz) > max_vaddr)
-                max_vaddr = phdr->p_vaddr + phdr->p_memsz;
-            if (phdr->p_vaddr < min_vaddr)
-                min_vaddr = phdr->p_vaddr;
-        }
-    }
-
-    if ((min_vaddr == 0xffffffff) && (max_vaddr == 0)) {
-        DL_ERR("%5d - No loadable segments found in %s.", pid, name);
-        return (unsigned)-1;
-    }
-
-    /* truncate min_vaddr down to page boundary */
-    min_vaddr &= ~PAGE_MASK;
-
-    /* round max_vaddr up to the next page */
-    max_vaddr = (max_vaddr + PAGE_SIZE - 1) & ~PAGE_MASK;
-
-    *total_sz = (max_vaddr - min_vaddr);
-    return (unsigned)req_base;
-}
-
-/* reserve_mem_region
- *
- *     This function reserves a chunk of memory to be used for mapping in
- *     a prelinked shared library. We reserve the entire memory region here, and
- *     then the rest of the linker will relocate the individual loadable
- *     segments into the correct locations within this memory range.
- *
- * Args:
- *     si->base: The requested base of the allocation.
- *     si->size: The size of the allocation.
- *
- * Returns:
- *     -1 on failure, and 0 on success.  On success, si->base will contain
- *     the virtual address at which the library will be mapped.
- */
-
-static int reserve_mem_region(soinfo *si)
-{
-    void *base = mmap((void *)si->base, si->size, PROT_NONE,
-                      MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-    if (base == MAP_FAILED) {
-        DL_ERR("%5d can NOT map (%sprelinked) library '%s' at 0x%08x "
-              "as requested, will try general pool: %d (%s)",
-              pid, (si->base ? "" : "non-"), si->name, si->base,
-              errno, strerror(errno));
-        return -1;
-    } else if (base != (void *)si->base) {
-        DL_ERR("OOPS: %5d %sprelinked library '%s' mapped at 0x%08x, "
-              "not at 0x%08x", pid, (si->base ? "" : "non-"),
-              si->name, (unsigned)base, si->base);
-        munmap(base, si->size);
-        return -1;
-    }
-    return 0;
-}
-
-static int alloc_mem_region(soinfo *si)
-{
-    if (si->base) {
-        /* Attempt to mmap a prelinked library. */
-        return reserve_mem_region(si);
-    }
-
-    /* This is not a prelinked library, so we use the kernel's default
-       allocator.
-    */
-
-    void *base = mmap(NULL, si->size, PROT_NONE,
-                      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-    if (base == MAP_FAILED) {
-        DL_ERR("%5d mmap of library '%s' failed: %d (%s)\n",
-              pid, si->name,
-              errno, strerror(errno));
-        goto err;
-    }
-    si->base = (unsigned) base;
-    PRINT("%5d mapped library '%s' to %08x via kernel allocator.\n",
-          pid, si->name, si->base);
-    return 0;
-
-err:
-    DL_ERR("OOPS: %5d cannot map library '%s'. no vspace available.",
-          pid, si->name);
-    return -1;
-}
-
-#define MAYBE_MAP_FLAG(x,from,to)    (((x) & (from)) ? (to) : 0)
-#define PFLAGS_TO_PROT(x)            (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
-                                      MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
-                                      MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
-/* load_segments
- *
- *     This function loads all the loadable (PT_LOAD) segments into memory
- *     at their appropriate memory offsets off the base address.
- *
- * Args:
- *     fd: Open file descriptor to the library to load.
- *     header: Pointer to a header page that contains the ELF header.
- *             This is needed since we haven't mapped in the real file yet.
- *     si: ptr to soinfo struct describing the shared object.
- *
- * Returns:
- *     0 on success, -1 on failure.
- */
-static int
-load_segments(int fd, void *header, soinfo *si)
-{
-    Elf32_Ehdr *ehdr = (Elf32_Ehdr *)header;
-    Elf32_Phdr *phdr = (Elf32_Phdr *)((unsigned char *)header + ehdr->e_phoff);
-    Elf32_Addr base = (Elf32_Addr) si->base;
-    int cnt;
-    unsigned len;
-    Elf32_Addr tmp;
-    unsigned char *pbase;
-    unsigned char *extra_base;
-    unsigned extra_len;
-    unsigned total_sz = 0;
-
-    si->wrprotect_start = 0xffffffff;
-    si->wrprotect_end = 0;
-
-    TRACE("[ %5d - Begin loading segments for '%s' @ 0x%08x ]\n",
-          pid, si->name, (unsigned)si->base);
-    /* Now go through all the PT_LOAD segments and map them into memory
-     * at the appropriate locations. */
-    for (cnt = 0; cnt < ehdr->e_phnum; ++cnt, ++phdr) {
-        if (phdr->p_type == PT_LOAD) {
-            DEBUG_DUMP_PHDR(phdr, "PT_LOAD", pid);
-            /* we want to map in the segment on a page boundary */
-            tmp = base + (phdr->p_vaddr & (~PAGE_MASK));
-            /* add the # of bytes we masked off above to the total length. */
-            len = phdr->p_filesz + (phdr->p_vaddr & PAGE_MASK);
-
-            TRACE("[ %d - Trying to load segment from '%s' @ 0x%08x "
-                  "(0x%08x). p_vaddr=0x%08x p_offset=0x%08x ]\n", pid, si->name,
-                  (unsigned)tmp, len, phdr->p_vaddr, phdr->p_offset);
-            pbase = mmap((void *)tmp, len, PFLAGS_TO_PROT(phdr->p_flags),
-                         MAP_PRIVATE | MAP_FIXED, fd,
-                         phdr->p_offset & (~PAGE_MASK));
-            if (pbase == MAP_FAILED) {
-                DL_ERR("%d failed to map segment from '%s' @ 0x%08x (0x%08x). "
-                      "p_vaddr=0x%08x p_offset=0x%08x", pid, si->name,
-                      (unsigned)tmp, len, phdr->p_vaddr, phdr->p_offset);
-                goto fail;
-            }
-
-            /* If 'len' didn't end on page boundary, and it's a writable
-             * segment, zero-fill the rest. */
-            if ((len & PAGE_MASK) && (phdr->p_flags & PF_W))
-                memset((void *)(pbase + len), 0, PAGE_SIZE - (len & PAGE_MASK));
-
-            /* Check to see if we need to extend the map for this segment to
-             * cover the diff between filesz and memsz (i.e. for bss).
-             *
-             *  base           _+---------------------+  page boundary
-             *                  .                     .
-             *                  |                     |
-             *                  .                     .
-             *  pbase          _+---------------------+  page boundary
-             *                  |                     |
-             *                  .                     .
-             *  base + p_vaddr _|                     |
-             *                  . \          \        .
-             *                  . | filesz   |        .
-             *  pbase + len    _| /          |        |
-             *     <0 pad>      .            .        .
-             *  extra_base     _+------------|--------+  page boundary
-             *               /  .            .        .
-             *               |  .            .        .
-             *               |  +------------|--------+  page boundary
-             *  extra_len->  |  |            |        |
-             *               |  .            | memsz  .
-             *               |  .            |        .
-             *               \ _|            /        |
-             *                  .                     .
-             *                  |                     |
-             *                 _+---------------------+  page boundary
-             */
-            tmp = (Elf32_Addr)(((unsigned)pbase + len + PAGE_SIZE - 1) &
-                                    (~PAGE_MASK));
-            if (tmp < (base + phdr->p_vaddr + phdr->p_memsz)) {
-                extra_len = base + phdr->p_vaddr + phdr->p_memsz - tmp;
-                TRACE("[ %5d - Need to extend segment from '%s' @ 0x%08x "
-                      "(0x%08x) ]\n", pid, si->name, (unsigned)tmp, extra_len);
-                /* map in the extra page(s) as anonymous into the range.
-                 * This is probably not necessary as we already mapped in
-                 * the entire region previously, but we just want to be
-                 * sure. This will also set the right flags on the region
-                 * (though we can probably accomplish the same thing with
-                 * mprotect).
-                 */
-                extra_base = mmap((void *)tmp, extra_len,
-                                  PFLAGS_TO_PROT(phdr->p_flags),
-                                  MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,
-                                  -1, 0);
-                if (extra_base == MAP_FAILED) {
-                    DL_ERR("[ %5d - failed to extend segment from '%s' @ 0x%08x"
-                           " (0x%08x) ]", pid, si->name, (unsigned)tmp,
-                          extra_len);
-                    goto fail;
-                }
-                /* TODO: Check if we need to memset-0 this region.
-                 * Anonymous mappings are zero-filled copy-on-writes, so we
-                 * shouldn't need to. */
-                TRACE("[ %5d - Segment from '%s' extended @ 0x%08x "
-                      "(0x%08x)\n", pid, si->name, (unsigned)extra_base,
-                      extra_len);
-            }
-            /* set the len here to show the full extent of the segment we
-             * just loaded, mostly for debugging */
-            len = (((unsigned)base + phdr->p_vaddr + phdr->p_memsz +
-                    PAGE_SIZE - 1) & (~PAGE_MASK)) - (unsigned)pbase;
-            TRACE("[ %5d - Successfully loaded segment from '%s' @ 0x%08x "
-                  "(0x%08x). p_vaddr=0x%08x p_offset=0x%08x\n", pid, si->name,
-                  (unsigned)pbase, len, phdr->p_vaddr, phdr->p_offset);
-            total_sz += len;
-            /* Make the section writable just in case we'll have to write to
-             * it during relocation (i.e. text segment). However, we will
-             * remember what range of addresses should be write protected.
-             *
-             */
-            if (!(phdr->p_flags & PF_W)) {
-                if ((unsigned)pbase < si->wrprotect_start)
-                    si->wrprotect_start = (unsigned)pbase;
-                if (((unsigned)pbase + len) > si->wrprotect_end)
-                    si->wrprotect_end = (unsigned)pbase + len;
-                mprotect(pbase, len,
-                         PFLAGS_TO_PROT(phdr->p_flags) | PROT_WRITE);
-            }
-        } else if (phdr->p_type == PT_DYNAMIC) {
-            DEBUG_DUMP_PHDR(phdr, "PT_DYNAMIC", pid);
-            /* this segment contains the dynamic linking information */
-            si->dynamic = (unsigned *)(base + phdr->p_vaddr);
-        } else if (phdr->p_type == PT_GNU_RELRO) {
-            if ((phdr->p_vaddr >= si->size)
-                    || ((phdr->p_vaddr + phdr->p_memsz) > si->size)
-                    || ((base + phdr->p_vaddr + phdr->p_memsz) < base)) {
-                DL_ERR("%d invalid GNU_RELRO in '%s' "
-                       "p_vaddr=0x%08x p_memsz=0x%08x", pid, si->name,
-                       phdr->p_vaddr, phdr->p_memsz);
-                goto fail;
-            }
-            si->gnu_relro_start = (Elf32_Addr) (base + phdr->p_vaddr);
-            si->gnu_relro_len = (unsigned) phdr->p_memsz;
-        } else {
-#ifdef ANDROID_ARM_LINKER
-            if (phdr->p_type == PT_ARM_EXIDX) {
-                DEBUG_DUMP_PHDR(phdr, "PT_ARM_EXIDX", pid);
-                /* exidx entries (used for stack unwinding) are 8 bytes each.
-                 */
-                si->ARM_exidx = (unsigned *)phdr->p_vaddr;
-                si->ARM_exidx_count = phdr->p_memsz / 8;
-            }
-#endif
-        }
-
-    }
-
-    /* Sanity check */
-    if (total_sz > si->size) {
-        DL_ERR("%5d - Total length (0x%08x) of mapped segments from '%s' is "
-              "greater than what was allocated (0x%08x). THIS IS BAD!",
-              pid, total_sz, si->name, si->size);
-        goto fail;
-    }
-
-    TRACE("[ %5d - Finish loading segments for '%s' @ 0x%08x. "
-          "Total memory footprint: 0x%08x bytes ]\n", pid, si->name,
-          (unsigned)si->base, si->size);
-    return 0;
-
-fail:
-    /* We can just blindly unmap the entire region even though some things
-     * were mapped in originally with anonymous and others could have been
-     * been mapped in from the file before we failed. The kernel will unmap
-     * all the pages in the range, irrespective of how they got there.
-     */
-    munmap((void *)si->base, si->size);
-    si->flags |= FLAG_ERROR;
-    return -1;
-}
-
-/* TODO: Implement this to take care of the fact that Android ARM
- * ELF objects shove everything into a single loadable segment that has the
- * write bit set. wr_offset is then used to set non-(data|bss) pages to be
- * non-writable.
- */
-#if 0
-static unsigned
-get_wr_offset(int fd, const char *name, Elf32_Ehdr *ehdr)
-{
-    Elf32_Shdr *shdr_start;
-    Elf32_Shdr *shdr;
-    int shdr_sz = ehdr->e_shnum * sizeof(Elf32_Shdr);
-    int cnt;
-    unsigned wr_offset = 0xffffffff;
-
-    shdr_start = mmap(0, shdr_sz, PROT_READ, MAP_PRIVATE, fd,
-                      ehdr->e_shoff & (~PAGE_MASK));
-    if (shdr_start == MAP_FAILED) {
-        WARN("%5d - Could not read section header info from '%s'. Will not "
-             "not be able to determine write-protect offset.\n", pid, name);
-        return (unsigned)-1;
-    }
-
-    for(cnt = 0, shdr = shdr_start; cnt < ehdr->e_shnum; ++cnt, ++shdr) {
-        if ((shdr->sh_type != SHT_NULL) && (shdr->sh_flags & SHF_WRITE) &&
-            (shdr->sh_addr < wr_offset)) {
-            wr_offset = shdr->sh_addr;
-        }
-    }
-
-    munmap(shdr_start, shdr_sz);
-    return wr_offset;
-}
-#endif
-
-static soinfo *
-load_library(const char *name)
-{
-    int fd = open_library(name);
-    int cnt;
-    unsigned ext_sz;
-    unsigned req_base;
-    const char *bname;
-    soinfo *si = NULL;
-    Elf32_Ehdr *hdr;
-
-    if(fd == -1) {
-        DL_ERR("Library '%s' not found", name);
-        return NULL;
-    }
-
-    /* We have to read the ELF header to figure out what to do with this image
-     */
-    if (lseek(fd, 0, SEEK_SET) < 0) {
-        DL_ERR("lseek() failed!");
-        goto fail;
-    }
-
-    if ((cnt = read(fd, &__header[0], PAGE_SIZE)) < 0) {
-        DL_ERR("read() failed!");
-        goto fail;
-    }
-
-    /* Parse the ELF header and get the size of the memory footprint for
-     * the library */
-    req_base = get_lib_extents(fd, name, &__header[0], &ext_sz);
-    if (req_base == (unsigned)-1)
-        goto fail;
     TRACE("[ %5d - '%s' (%s) wants base=0x%08x sz=0x%08x ]\n", pid, name,
           (req_base ? "prelinked" : "not pre-linked"), req_base, ext_sz);
 
@@ -1120,40 +776,76 @@
      * soinfo struct here is a lot more convenient.
      */
     bname = strrchr(name, '/');
-    si = alloc_info(bname ? bname + 1 : name);
+    si = soinfo_alloc(bname ? bname + 1 : name);
     if (si == NULL)
         goto fail;
 
-    /* Carve out a chunk of memory where we will map in the individual
-     * segments */
-    si->base = req_base;
-    si->size = ext_sz;
-    si->flags = 0;
-    si->entry = 0;
-    si->dynamic = (unsigned *)-1;
-    if (alloc_mem_region(si) < 0)
-        goto fail;
-
-    TRACE("[ %5d allocated memory for %s @ %p (0x%08x) ]\n",
-          pid, name, (void *)si->base, (unsigned) ext_sz);
-
-    /* Now actually load the library's segments into right places in memory */
-    if (load_segments(fd, &__header[0], si) < 0) {
+    /* Reserve address space for all loadable segments */
+    ret = phdr_table_reserve_memory(phdr_table,
+                                    phdr_count,
+                                    req_base,
+                                    &load_start,
+                                    &load_size,
+                                    &load_bias);
+    if (ret < 0) {
+        DL_ERR("%5d Can't reserve %d bytes from 0x%08x in address space for %s: %s",
+               pid, ext_sz, req_base, name, strerror(errno));
         goto fail;
     }
 
-    /* this might not be right. Technically, we don't even need this info
-     * once we go through 'load_segments'. */
-    hdr = (Elf32_Ehdr *)si->base;
-    si->phdr = (Elf32_Phdr *)((unsigned char *)si->base + hdr->e_phoff);
-    si->phnum = hdr->e_phnum;
-    /**/
+    TRACE("[ %5d allocated memory for %s @ %p (0x%08x) ]\n",
+          pid, name, load_start, load_size);
 
+    /* Map all the segments in our address space with default protections */
+    ret = phdr_table_load_segments(phdr_table,
+                                   phdr_count,
+                                   load_start,
+                                   load_size,
+                                   load_bias,
+                                   fd);
+    if (ret < 0) {
+        DL_ERR("%5d Can't map loadable segments for %s: %s",
+               pid, name, strerror(errno));
+        goto fail;
+    }
+
+    /* Unprotect the segments, i.e. make them writable, to allow
+     * relocations to work properly. We will later call
+     * phdr_table_protect_segments() after all of them are applied
+     * and all constructors are run.
+     */
+    ret = phdr_table_unprotect_segments(phdr_table,
+                                        phdr_count,
+                                        load_bias);
+    if (ret < 0) {
+        DL_ERR("%5d Can't unprotect loadable segments for %s: %s",
+               pid, name, strerror(errno));
+        goto fail;
+    }
+
+    si->base = (Elf32_Addr) load_start;
+    si->size = load_size;
+    si->load_bias = load_bias;
+    si->flags = 0;
+    si->entry = 0;
+    si->dynamic = (unsigned *)-1;
+    si->phnum = phdr_count;
+    si->phdr = phdr_table_get_loaded_phdr(phdr_table, phdr_count, load_bias);
+    if (si->phdr == NULL) {
+        DL_ERR("%5d Can't find loaded PHDR for %s",
+               pid, name);
+        goto fail;
+    }
+
+    phdr_table_unload(phdr_mmap, phdr_size);
     close(fd);
     return si;
 
 fail:
-    if (si) free_info(si);
+    if (si) soinfo_free(si);
+    if (phdr_mmap != NULL) {
+        phdr_table_unload(phdr_mmap, phdr_size);
+    }
     close(fd);
     return NULL;
 }
@@ -1168,7 +860,7 @@
     TRACE("[ %5d init_library base=0x%08x sz=0x%08x name='%s') ]\n",
           pid, si->base, si->size, si->name);
 
-    if(link_image(si, wr_offset)) {
+    if(soinfo_link_image(si, wr_offset)) {
             /* We failed to link.  However, we can only restore libbase
             ** if no additional libraries have moved it since we updated it.
             */
@@ -1219,7 +911,7 @@
  *   for non-prelinked libraries, find a way to decrement libbase
  */
 static void call_destructors(soinfo *si);
-unsigned unload_library(soinfo *si)
+unsigned soinfo_unload(soinfo *si)
 {
     unsigned *d;
     if (si->refcount == 1) {
@@ -1228,16 +920,13 @@
 
         /*
          * Make sure that we undo the PT_GNU_RELRO protections we added
-         * in link_image. This is needed to undo the DT_NEEDED hack below.
+         * in soinfo_link_image. This is needed to undo the DT_NEEDED hack below.
          */
-        if ((si->gnu_relro_start != 0) && (si->gnu_relro_len != 0)) {
-            Elf32_Addr start = (si->gnu_relro_start & ~PAGE_MASK);
-            unsigned len = (si->gnu_relro_start - start) + si->gnu_relro_len;
-            if (mprotect((void *) start, len, PROT_READ | PROT_WRITE) < 0)
-                DL_ERR("%5d %s: could not undo GNU_RELRO protections. "
-                       "Expect a crash soon. errno=%d (%s)",
-                       pid, si->name, errno, strerror(errno));
-
+        if (phdr_table_unprotect_gnu_relro(si->phdr, si->phnum,
+                                           si->load_bias) < 0) {
+            DL_ERR("%5d %s: could not undo GNU_RELRO protections. "
+                    "Expect a crash soon. errno=%d (%s)",
+                    pid, si->name, errno, strerror(errno));
         }
 
         for(d = si->dynamic; *d; d += 2) {
@@ -1246,13 +935,13 @@
 
                 // The next line will segfault if the we don't undo the
                 // PT_GNU_RELRO protections (see comments above and in
-                // link_image().
+                // soinfo_link_image().
                 d[1] = 0;
 
                 if (validate_soinfo(lsi)) {
                     TRACE("%5d %s needs to unload %s\n", pid,
                           si->name, lsi->name);
-                    unload_library(lsi);
+                    soinfo_unload(lsi);
                 }
                 else
                     DL_ERR("%5d %s: could not unload dependent library",
@@ -1262,7 +951,7 @@
 
         munmap((char *)si->base, si->size);
         notify_gdb_of_unload(si);
-        free_info(si);
+        soinfo_free(si);
         si->refcount = 0;
     }
     else {
@@ -1277,19 +966,20 @@
  * ideal. They should probably be either uint32_t, Elf32_Addr, or unsigned
  * long.
  */
-static int reloc_library(soinfo *si, Elf32_Rel *rel, unsigned count)
+static int soinfo_relocate(soinfo *si, Elf32_Rel *rel, unsigned count)
 {
     Elf32_Sym *symtab = si->symtab;
     const char *strtab = si->strtab;
     Elf32_Sym *s;
     unsigned base;
+    Elf32_Addr offset;
     Elf32_Rel *start = rel;
     unsigned idx;
 
     for (idx = 0; idx < count; ++idx) {
         unsigned type = ELF32_R_TYPE(rel->r_info);
         unsigned sym = ELF32_R_SYM(rel->r_info);
-        unsigned reloc = (unsigned)(rel->r_offset + si->base);
+        unsigned reloc = (unsigned)(rel->r_offset + si->load_bias);
         unsigned sym_addr = 0;
         char *sym_name = NULL;
 
@@ -1297,7 +987,7 @@
               si->name, idx);
         if(sym != 0) {
             sym_name = (char *)(strtab + symtab[sym].st_name);
-            s = _do_lookup(si, sym_name, &base);
+            s = soinfo_do_lookup(si, sym_name, &offset);
             if(s == NULL) {
                 /* We only allow an undefined symbol if this is a weak
                    reference..   */
@@ -1364,7 +1054,7 @@
                 return -1;
             }
 #endif
-                sym_addr = (unsigned)(s->st_value + base);
+                sym_addr = (unsigned)(s->st_value + offset);
 	    }
             COUNT_RELOC(RELOC_SYMBOL);
         } else {
@@ -1516,7 +1206,7 @@
     }
 }
 
-void call_constructors_recursive(soinfo *si)
+void soinfo_call_constructors(soinfo *si)
 {
     if (si->constructors_called)
         return;
@@ -1527,9 +1217,9 @@
     // libc_malloc_debug_leak.so:
     // 1. The program depends on libc, so libc's constructor is called here.
     // 2. The libc constructor calls dlopen() to load libc_malloc_debug_leak.so.
-    // 3. dlopen() calls call_constructors_recursive() with the newly created
+    // 3. dlopen() calls soinfo_call_constructors() with the newly created
     //    soinfo for libc_malloc_debug_leak.so.
-    // 4. The debug so depends on libc, so call_constructors_recursive() is
+    // 4. The debug so depends on libc, so soinfo_call_constructors() is
     //    called again with the libc soinfo. If it doesn't trigger the early-
     //    out above, the libc constructor will be called again (recursively!).
     si->constructors_called = 1;
@@ -1557,7 +1247,7 @@
                     DL_ERR("%5d bad DT_NEEDED pointer in %s",
                            pid, si->name);
                 } else {
-                    call_constructors_recursive(lsi);
+                    soinfo_call_constructors(lsi);
                 }
             }
         }
@@ -1603,7 +1293,7 @@
     int dev_null, i, status;
     int return_value = 0;
 
-    dev_null = open("/dev/null", O_RDWR);
+    dev_null = TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR));
     if (dev_null < 0) {
         DL_ERR("Cannot open /dev/null.");
         return -1;
@@ -1666,120 +1356,69 @@
     return return_value;
 }
 
-static int link_image(soinfo *si, unsigned wr_offset)
+static int soinfo_link_image(soinfo *si, unsigned wr_offset)
 {
     unsigned *d;
-    Elf32_Phdr *phdr = si->phdr;
+    /* "base" might wrap around UINT32_MAX. */
+    Elf32_Addr base = si->load_bias;
+    const Elf32_Phdr *phdr = si->phdr;
     int phnum = si->phnum;
+    int relocating_linker = (si->flags & FLAG_LINKER) != 0;
 
-    INFO("[ %5d linking %s ]\n", pid, si->name);
-    DEBUG("%5d si->base = 0x%08x si->flags = 0x%08x\n", pid,
-          si->base, si->flags);
+    /* We can't debug anything until the linker is relocated */
+    if (!relocating_linker) {
+        INFO("[ %5d linking %s ]\n", pid, si->name);
+        DEBUG("%5d si->base = 0x%08x si->flags = 0x%08x\n", pid,
+            si->base, si->flags);
+    }
 
-    if (si->flags & (FLAG_EXE | FLAG_LINKER)) {
-        /* Locate the needed program segments (DYNAMIC/ARM_EXIDX) for
-         * linkage info if this is the executable or the linker itself. 
-         * If this was a dynamic lib, that would have been done at load time.
-         *
-         * TODO: It's unfortunate that small pieces of this are
-         * repeated from the load_library routine. Refactor this just
-         * slightly to reuse these bits.
-         */
-        si->size = 0;
-        for(; phnum > 0; --phnum, ++phdr) {
-#ifdef ANDROID_ARM_LINKER
-            if(phdr->p_type == PT_ARM_EXIDX) {
-                /* exidx entries (used for stack unwinding) are 8 bytes each.
-                 */
-                si->ARM_exidx = (unsigned *)phdr->p_vaddr;
-                si->ARM_exidx_count = phdr->p_memsz / 8;
-            }
-#endif
-            if (phdr->p_type == PT_LOAD) {
-                /* For the executable, we use the si->size field only in
-                   dl_unwind_find_exidx(), so the meaning of si->size
-                   is not the size of the executable; it is the distance
-                   between the load location of the executable and the last
-                   address of the loadable part of the executable.
-                   We use the range [si->base, si->base + si->size) to
-                   determine whether a PC value falls within the executable
-                   section. Of course, if a value is between si->base and
-                   (si->base + phdr->p_vaddr), it's not in the executable
-                   section, but a) we shouldn't be asking for such a value
-                   anyway, and b) if we have to provide an EXIDX for such a
-                   value, then the executable's EXIDX is probably the better
-                   choice.
-                */
-                DEBUG_DUMP_PHDR(phdr, "PT_LOAD", pid);
-                if (phdr->p_vaddr + phdr->p_memsz > si->size)
-                    si->size = phdr->p_vaddr + phdr->p_memsz;
-                /* try to remember what range of addresses should be write
-                 * protected */
-                if (!(phdr->p_flags & PF_W)) {
-                    unsigned _end;
-
-                    if (si->base + phdr->p_vaddr < si->wrprotect_start)
-                        si->wrprotect_start = si->base + phdr->p_vaddr;
-                    _end = (((si->base + phdr->p_vaddr + phdr->p_memsz + PAGE_SIZE - 1) &
-                             (~PAGE_MASK)));
-                    if (_end > si->wrprotect_end)
-                        si->wrprotect_end = _end;
-                    /* Make the section writable just in case we'll have to
-                     * write to it during relocation (i.e. text segment).
-                     * However, we will remember what range of addresses
-                     * should be write protected.
-                     */
-                    mprotect((void *) (si->base + phdr->p_vaddr),
-                             phdr->p_memsz,
-                             PFLAGS_TO_PROT(phdr->p_flags) | PROT_WRITE);
-                }
-            } else if (phdr->p_type == PT_DYNAMIC) {
-                if (si->dynamic != (unsigned *)-1) {
-                    DL_ERR("%5d multiple PT_DYNAMIC segments found in '%s'. "
-                          "Segment at 0x%08x, previously one found at 0x%08x",
-                          pid, si->name, si->base + phdr->p_vaddr,
-                          (unsigned)si->dynamic);
-                    goto fail;
-                }
-                DEBUG_DUMP_PHDR(phdr, "PT_DYNAMIC", pid);
-                si->dynamic = (unsigned *) (si->base + phdr->p_vaddr);
-            } else if (phdr->p_type == PT_GNU_RELRO) {
-                if ((phdr->p_vaddr >= si->size)
-                        || ((phdr->p_vaddr + phdr->p_memsz) > si->size)
-                        || ((si->base + phdr->p_vaddr + phdr->p_memsz) < si->base)) {
-                    DL_ERR("%d invalid GNU_RELRO in '%s' "
-                           "p_vaddr=0x%08x p_memsz=0x%08x", pid, si->name,
-                           phdr->p_vaddr, phdr->p_memsz);
-                    goto fail;
-                }
-                si->gnu_relro_start = (Elf32_Addr) (si->base + phdr->p_vaddr);
-                si->gnu_relro_len = (unsigned) phdr->p_memsz;
-            }
+    /* Extract dynamic section */
+    si->dynamic = phdr_table_get_dynamic_section(phdr, phnum, base);
+    if (si->dynamic == NULL) {
+        if (!relocating_linker) {
+            DL_ERR("%5d missing PT_DYNAMIC?!", pid);
+        }
+        goto fail;
+    } else {
+        if (!relocating_linker) {
+            DEBUG("%5d dynamic = %p\n", pid, si->dynamic);
         }
     }
 
-    if (si->dynamic == (unsigned *)-1) {
-        DL_ERR("%5d missing PT_DYNAMIC?!", pid);
-        goto fail;
-    }
+#ifdef ANDROID_ARM_LINKER
+    (void) phdr_table_get_arm_exidx(phdr, phnum, base,
+                                    &si->ARM_exidx, &si->ARM_exidx_count);
+#endif
 
-    DEBUG("%5d dynamic = %p\n", pid, si->dynamic);
+    if (si->flags & (FLAG_EXE | FLAG_LINKER)) {
+        if (phdr_table_unprotect_segments(si->phdr,
+                                          si->phnum,
+                                          si->load_bias) < 0) {
+            /* We can't call DL_ERR if the linker's relocations haven't
+             * been performed yet */
+            if (!relocating_linker) {
+                DL_ERR("%5d Can't unprotect segments for %s: %s",
+                       pid, si->name, strerror(errno));
+            }
+            goto fail;
+        }
+    }
 
     /* extract useful information from dynamic section */
     for(d = si->dynamic; *d; d++){
         DEBUG("%5d d = %p, d[0] = 0x%08x d[1] = 0x%08x\n", pid, d, d[0], d[1]);
         switch(*d++){
         case DT_HASH:
-            si->nbucket = ((unsigned *) (si->base + *d))[0];
-            si->nchain = ((unsigned *) (si->base + *d))[1];
-            si->bucket = (unsigned *) (si->base + *d + 8);
-            si->chain = (unsigned *) (si->base + *d + 8 + si->nbucket * 4);
+            si->nbucket = ((unsigned *) (base + *d))[0];
+            si->nchain = ((unsigned *) (base + *d))[1];
+            si->bucket = (unsigned *) (base + *d + 8);
+            si->chain = (unsigned *) (base + *d + 8 + si->nbucket * 4);
             break;
         case DT_STRTAB:
-            si->strtab = (const char *) (si->base + *d);
+            si->strtab = (const char *) (base + *d);
             break;
         case DT_SYMTAB:
-            si->symtab = (Elf32_Sym *) (si->base + *d);
+            si->symtab = (Elf32_Sym *) (base + *d);
             break;
         case DT_PLTREL:
             if(*d != DT_REL) {
@@ -1788,20 +1427,20 @@
             }
             break;
         case DT_JMPREL:
-            si->plt_rel = (Elf32_Rel*) (si->base + *d);
+            si->plt_rel = (Elf32_Rel*) (base + *d);
             break;
         case DT_PLTRELSZ:
             si->plt_rel_count = *d / 8;
             break;
         case DT_REL:
-            si->rel = (Elf32_Rel*) (si->base + *d);
+            si->rel = (Elf32_Rel*) (base + *d);
             break;
         case DT_RELSZ:
             si->rel_count = *d / 8;
             break;
         case DT_PLTGOT:
             /* Save this in case we decide to do lazy binding. We don't yet. */
-            si->plt_got = (unsigned *)(si->base + *d);
+            si->plt_got = (unsigned *)(base + *d);
             break;
         case DT_DEBUG:
             // Set the DT_DEBUG entry to the addres of _r_debug for GDB
@@ -1811,17 +1450,17 @@
             DL_ERR("%5d DT_RELA not supported", pid);
             goto fail;
         case DT_INIT:
-            si->init_func = (void (*)(void))(si->base + *d);
+            si->init_func = (void (*)(void))(base + *d);
             DEBUG("%5d %s constructors (init func) found at %p\n",
                   pid, si->name, si->init_func);
             break;
         case DT_FINI:
-            si->fini_func = (void (*)(void))(si->base + *d);
+            si->fini_func = (void (*)(void))(base + *d);
             DEBUG("%5d %s destructors (fini func) found at %p\n",
                   pid, si->name, si->fini_func);
             break;
         case DT_INIT_ARRAY:
-            si->init_array = (unsigned *)(si->base + *d);
+            si->init_array = (unsigned *)(base + *d);
             DEBUG("%5d %s constructors (init_array) found at %p\n",
                   pid, si->name, si->init_array);
             break;
@@ -1829,7 +1468,7 @@
             si->init_array_count = ((unsigned)*d) / sizeof(Elf32_Addr);
             break;
         case DT_FINI_ARRAY:
-            si->fini_array = (unsigned *)(si->base + *d);
+            si->fini_array = (unsigned *)(base + *d);
             DEBUG("%5d %s destructors (fini_array) found at %p\n",
                   pid, si->name, si->fini_array);
             break;
@@ -1837,7 +1476,7 @@
             si->fini_array_count = ((unsigned)*d) / sizeof(Elf32_Addr);
             break;
         case DT_PREINIT_ARRAY:
-            si->preinit_array = (unsigned *)(si->base + *d);
+            si->preinit_array = (unsigned *)(base + *d);
             DEBUG("%5d %s constructors (preinit_array) found at %p\n",
                   pid, si->name, si->preinit_array);
             break;
@@ -1905,52 +1544,31 @@
 
     if(si->plt_rel) {
         DEBUG("[ %5d relocating %s plt ]\n", pid, si->name );
-        if(reloc_library(si, si->plt_rel, si->plt_rel_count))
+        if(soinfo_relocate(si, si->plt_rel, si->plt_rel_count))
             goto fail;
     }
     if(si->rel) {
         DEBUG("[ %5d relocating %s ]\n", pid, si->name );
-        if(reloc_library(si, si->rel, si->rel_count))
+        if(soinfo_relocate(si, si->rel, si->rel_count))
             goto fail;
     }
 
     si->flags |= FLAG_LINKED;
     DEBUG("[ %5d finished linking %s ]\n", pid, si->name);
 
-#if 0
-    /* This is the way that the old dynamic linker did protection of
-     * non-writable areas. It would scan section headers and find where
-     * .text ended (rather where .data/.bss began) and assume that this is
-     * the upper range of the non-writable area. This is too coarse,
-     * and is kept here for reference until we fully move away from single
-     * segment elf objects. See the code in get_wr_offset (also #if'd 0)
-     * that made this possible.
-     */
-    if(wr_offset < 0xffffffff){
-        mprotect((void*) si->base, wr_offset, PROT_READ | PROT_EXEC);
+    /* All relocations are done, we can protect our segments back to
+     * read-only. */
+    if (phdr_table_protect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
+        DL_ERR("%5d Can't protect segments for %s: %s",
+               pid, si->name, strerror(errno));
+        goto fail;
     }
-#else
-    /* TODO: Verify that this does the right thing in all cases, as it
-     * presently probably does not. It is possible that an ELF image will
-     * come with multiple read-only segments. What we ought to do is scan
-     * the program headers again and mprotect all the read-only segments.
-     * To prevent re-scanning the program header, we would have to build a
-     * list of loadable segments in si, and then scan that instead. */
-    if (si->wrprotect_start != 0xffffffff && si->wrprotect_end != 0) {
-        mprotect((void *)si->wrprotect_start,
-                 si->wrprotect_end - si->wrprotect_start,
-                 PROT_READ | PROT_EXEC);
-    }
-#endif
 
-    if (si->gnu_relro_start != 0 && si->gnu_relro_len != 0) {
-        Elf32_Addr start = (si->gnu_relro_start & ~PAGE_MASK);
-        unsigned len = (si->gnu_relro_start - start) + si->gnu_relro_len;
-        if (mprotect((void *) start, len, PROT_READ) < 0) {
-            DL_ERR("%5d GNU_RELRO mprotect of library '%s' failed: %d (%s)\n",
-                   pid, si->name, errno, strerror(errno));
-            goto fail;
-        }
+    /* We can also turn on GNU RELRO protection */
+    if (phdr_table_protect_gnu_relro(si->phdr, si->phnum, si->load_bias) < 0) {
+        DL_ERR("%5d Can't enable GNU RELRO protection for %s: %s",
+               pid, si->name, strerror(errno));
+        goto fail;
     }
 
     /* If this is a SET?ID program, dup /dev/null to opened stdin,
@@ -2095,7 +1713,7 @@
     INFO("[ android linker & debugger ]\n");
     DEBUG("%5d elfdata @ 0x%08x\n", pid, (unsigned)elfdata);
 
-    si = alloc_info(argv[0]);
+    si = soinfo_alloc(argv[0]);
     if(si == 0) {
         exit(-1);
     }
@@ -2115,7 +1733,7 @@
         /* gdb expects the linker to be in the debug shared object list,
          * and we need to make sure that the reported load address is zero.
          * Without this, gdb gets the wrong idea of where rtld_db_dlactivity()
-         * is.  Don't use alloc_info(), because the linker shouldn't
+         * is.  Don't use soinfo_alloc(), because the linker shouldn't
          * be on the soinfo list.
          */
     strlcpy((char*) linker_soinfo.name, "/system/bin/linker", sizeof linker_soinfo.name);
@@ -2145,18 +1763,17 @@
      */
     int nn;
     si->base = 0;
+    si->size = phdr_table_get_load_size(si->phdr, si->phnum);
+    si->load_bias = 0;
     for ( nn = 0; nn < si->phnum; nn++ ) {
         if (si->phdr[nn].p_type == PT_PHDR) {
-            si->base = (Elf32_Addr) si->phdr - si->phdr[nn].p_vaddr;
+            si->load_bias = (Elf32_Addr)si->phdr - si->phdr[nn].p_vaddr;
+            si->base = (Elf32_Addr) si->phdr - si->phdr[nn].p_offset;
             break;
         }
     }
     si->dynamic = (unsigned *)-1;
-    si->wrprotect_start = 0xffffffff;
-    si->wrprotect_end = 0;
     si->refcount = 1;
-    si->gnu_relro_start = 0;
-    si->gnu_relro_len = 0;
 
         /* Use LD_LIBRARY_PATH if we aren't setuid/setgid */
     if (ldpath_env)
@@ -2166,14 +1783,14 @@
         parse_preloads(ldpreload_env, " :");
     }
 
-    if(link_image(si, 0)) {
+    if(soinfo_link_image(si, 0)) {
         char errmsg[] = "CANNOT LINK EXECUTABLE\n";
         write(2, __linker_dl_err_buf, strlen(__linker_dl_err_buf));
         write(2, errmsg, sizeof(errmsg));
         exit(-1);
     }
 
-    call_constructors_recursive(si);
+    soinfo_call_constructors(si);
 
 #if ALLOW_SYMBOLS_FROM_MAIN
     /* Set somain after we've loaded all the libraries in order to prevent
@@ -2249,6 +1866,32 @@
     return 0; // should never happen
 }
 
+/* Compute the load-bias of an existing executable. This shall only
+ * be used to compute the load bias of an executable or shared library
+ * that was loaded by the kernel itself.
+ *
+ * Input:
+ *    elf    -> address of ELF header, assumed to be at the start of the file.
+ * Return:
+ *    load bias, i.e. add the value of any p_vaddr in the file to get
+ *    the corresponding address in memory.
+ */
+static Elf32_Addr
+get_elf_exec_load_bias(const Elf32_Ehdr* elf)
+{
+    Elf32_Addr        offset     = elf->e_phoff;
+    const Elf32_Phdr* phdr_table = (const Elf32_Phdr*)((char*)elf + offset);
+    const Elf32_Phdr* phdr_end   = phdr_table + elf->e_phnum;
+    const Elf32_Phdr* phdr;
+
+    for (phdr = phdr_table; phdr < phdr_end; phdr++) {
+        if (phdr->p_type == PT_LOAD) {
+            return (Elf32_Addr)elf + phdr->p_offset - phdr->p_vaddr;
+        }
+    }
+    return 0;
+}
+
 /*
  * This is the entry point for the linker, called from begin.S. This
  * method is responsible for fixing the linker's own relocations, and
@@ -2268,16 +1911,14 @@
     memset(&linker_so, 0, sizeof(soinfo));
 
     linker_so.base = linker_addr;
+    linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum);
+    linker_so.load_bias = get_elf_exec_load_bias(elf_hdr);
     linker_so.dynamic = (unsigned *) -1;
     linker_so.phdr = phdr;
     linker_so.phnum = elf_hdr->e_phnum;
     linker_so.flags |= FLAG_LINKER;
-    linker_so.wrprotect_start = 0xffffffff;
-    linker_so.wrprotect_end = 0;
-    linker_so.gnu_relro_start = 0;
-    linker_so.gnu_relro_len = 0;
 
-    if (link_image(&linker_so, 0)) {
+    if (soinfo_link_image(&linker_so, 0)) {
         // It would be nice to print an error message, but if the linker
         // can't link itself, there's no guarantee that we'll be able to
         // call write() (because it involves a GOT reference).
diff --git a/linker/linker.h b/linker/linker.h
index 0c986cd..0956ac5 100644
--- a/linker/linker.h
+++ b/linker/linker.h
@@ -37,7 +37,23 @@
 #undef PAGE_MASK
 #undef PAGE_SIZE
 #define PAGE_SIZE 4096
-#define PAGE_MASK 4095
+#define PAGE_MASK (PAGE_SIZE-1)
+
+/* Convenience macros to make page address/offset computations more explicit */
+
+/* Returns the address of the page starting at address 'x' */
+#define PAGE_START(x)  ((x) & ~PAGE_MASK)
+
+/* Returns the offset of address 'x' in its memory page, i.e. this is the
+ * same than 'x' - PAGE_START(x) */
+#define PAGE_OFFSET(x) ((x) & PAGE_MASK)
+
+/* Returns the address of the next page after address 'x', unless 'x' is
+ * itself at the start of a page. Equivalent to:
+ *
+ *  (x == PAGE_START(x)) ? x : PAGE_START(x)+PAGE_SIZE
+ */
+#define PAGE_END(x)    PAGE_START((x) + (PAGE_SIZE-1))
 
 void debugger_init();
 const char *addr_to_name(unsigned addr);
@@ -91,7 +107,7 @@
 struct soinfo
 {
     const char name[SOINFO_NAME_LEN];
-    Elf32_Phdr *phdr;
+    const Elf32_Phdr *phdr;
     int phnum;
     unsigned entry;
     unsigned base;
@@ -101,8 +117,8 @@
 
     unsigned *dynamic;
 
-    unsigned wrprotect_start;
-    unsigned wrprotect_end;
+    unsigned unused2; // DO NOT USE, maintained for compatibility
+    unsigned unused3; // DO NOT USE, maintained for compatibility
 
     soinfo *next;
     unsigned flags;
@@ -145,9 +161,9 @@
 
     int constructors_called;
 
-    Elf32_Addr gnu_relro_start;
-    unsigned gnu_relro_len;
-
+    /* When you read a virtual address from the ELF file, add this
+     * value to get the corresponding address in the process' address space */
+    Elf32_Addr load_bias;
 };
 
 
@@ -202,13 +218,14 @@
 #endif
 
 soinfo *find_library(const char *name);
-unsigned unload_library(soinfo *si);
-Elf32_Sym *lookup_in_library(soinfo *si, const char *name);
 Elf32_Sym *lookup(const char *name, soinfo **found, soinfo *start);
 soinfo *find_containing_library(const void *addr);
-Elf32_Sym *find_containing_symbol(const void *addr, soinfo *si);
 const char *linker_get_error(void);
-void call_constructors_recursive(soinfo *si);
+
+unsigned soinfo_unload(soinfo *si);
+Elf32_Sym *soinfo_find_symbol(soinfo* si, const void *addr);
+Elf32_Sym *soinfo_lookup(soinfo *si, const char *name);
+void soinfo_call_constructors(soinfo *si);
 
 #ifdef ANDROID_ARM_LINKER 
 typedef long unsigned int *_Unwind_Ptr;
diff --git a/linker/linker_environ.c b/linker/linker_environ.c
index b71dd80..fadcb60 100644
--- a/linker/linker_environ.c
+++ b/linker/linker_environ.c
@@ -192,13 +192,11 @@
         "TZDIR",
         "LD_AOUT_LIBRARY_PATH",
         "LD_AOUT_PRELOAD",
+        NULL
     };
 
-    const char* const* cp   = unsec_vars;
-    const char* const* endp = cp + sizeof(unsec_vars)/sizeof(unsec_vars[0]);
-
-    while (cp < endp) {
-        linker_env_unset(*cp);
-        cp++;
+    int count;
+    for (count = 0; unsec_vars[count] != NULL; count++) {
+        linker_env_unset(unsec_vars[count]);
     }
 }
diff --git a/linker/linker_format.c b/linker/linker_format.c
index 0c68a0b..cded68a 100644
--- a/linker/linker_format.c
+++ b/linker/linker_format.c
@@ -172,6 +172,21 @@
     return format_buffer(buff, bufsize, format, args);
 }
 
+/* The pthread implementation uses snprintf(). If we define it here, we
+ * avoid pulling the stdio vfprintf() implementation into the linker
+ * saving about 19KB of machine code.
+ */
+int
+snprintf(char* buff, size_t bufsize, const char* format, ...)
+{
+    va_list args;
+    int ret;
+    va_start(args, format);
+    ret = vsnprintf(buff, bufsize, format, args);
+    va_end(args);
+    return ret;
+}
+
 #if LINKER_DEBUG
 
 #if !LINKER_DEBUG_TO_LOG
diff --git a/linker/linker_phdr.c b/linker/linker_phdr.c
new file mode 100644
index 0000000..c9f194b
--- /dev/null
+++ b/linker/linker_phdr.c
@@ -0,0 +1,665 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <errno.h>
+#include <sys/mman.h>
+
+#include "linker_phdr.h"
+
+/**
+  TECHNICAL NOTE ON ELF LOADING.
+
+  An ELF file's program header table contains one or more PT_LOAD
+  segments, which corresponds to portions of the file that need to
+  be mapped into the process' address space.
+
+  Each loadable segment has the following important properties:
+
+    p_offset  -> segment file offset
+    p_filesz  -> segment file size
+    p_memsz   -> segment memory size (always >= p_filesz)
+    p_vaddr   -> segment's virtual address
+    p_flags   -> segment flags (e.g. readable, writable, executable)
+
+  We will ignore the p_paddr and p_align fields of Elf32_Phdr for now.
+
+  The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz)
+  ranges of virtual addresses. A few rules apply:
+
+  - the virtual address ranges should not overlap.
+
+  - if a segment's p_filesz is smaller than its p_memsz, the extra bytes
+    between them should always be initialized to 0.
+
+  - ranges do not necessarily start or end at page boundaries. Two distinct
+    segments can have their start and end on the same page. In this case, the
+    page inherits the mapping flags of the latter segment.
+
+  Finally, the real load addrs of each segment is not p_vaddr. Instead the
+  loader decides where to load the first segment, then will load all others
+  relative to the first one to respect the initial range layout.
+
+  For example, consider the following list:
+
+    [ offset:0,      filesz:0x4000, memsz:0x4000, vaddr:0x30000 ],
+    [ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ],
+
+  This corresponds to two segments that cover these virtual address ranges:
+
+       0x30000...0x34000
+       0x40000...0x48000
+
+  If the loader decides to load the first segment at address 0xa0000000
+  then the segments' load address ranges will be:
+
+       0xa0030000...0xa0034000
+       0xa0040000...0xa0048000
+
+  In other words, all segments must be loaded at an address that has the same
+  constant offset from their p_vaddr value. This offset is computed as the
+  difference between the first segment's load address, and its p_vaddr value.
+
+  However, in practice, segments do _not_ start at page boundaries. Since we
+  can only memory-map at page boundaries, this means that the bias is
+  computed as:
+
+       load_bias = phdr0_load_address - PAGE_START(phdr0->p_vaddr)
+
+  (NOTE: The value must be used as a 32-bit unsigned integer, to deal with
+          possible wrap around UINT32_MAX for possible large p_vaddr values).
+
+  And that the phdr0_load_address must start at a page boundary, with
+  the segment's real content starting at:
+
+       phdr0_load_address + PAGE_OFFSET(phdr0->p_vaddr)
+
+  Note that ELF requires the following condition to make the mmap()-ing work:
+
+      PAGE_OFFSET(phdr0->p_vaddr) == PAGE_OFFSET(phdr0->p_offset)
+
+  The load_bias must be added to any p_vaddr value read from the ELF file to
+  determine the corresponding memory address.
+
+ **/
+
+#define MAYBE_MAP_FLAG(x,from,to)    (((x) & (from)) ? (to) : 0)
+#define PFLAGS_TO_PROT(x)            (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
+                                      MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
+                                      MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
+
+/* Load the program header table from an ELF file into a read-only private
+ * anonymous mmap-ed block.
+ *
+ * Input:
+ *   fd           -> file descriptor
+ *   phdr_offset  -> file offset of phdr table
+ *   phdr_num     -> number of entries in the table.
+ *
+ * Output:
+ *   phdr_mmap    -> address of mmap block in memory.
+ *   phdr_memsize -> size of mmap block in memory.
+ *   phdr_table   -> address of first entry in memory.
+ *
+ * Return:
+ *   -1 on error, or 0 on success.
+ */
+int phdr_table_load(int                fd,
+                    Elf32_Addr         phdr_offset,
+                    Elf32_Half         phdr_num,
+                    void**             phdr_mmap,
+                    Elf32_Addr*        phdr_size,
+                    const Elf32_Phdr** phdr_table)
+{
+    Elf32_Addr  page_min, page_max, page_offset;
+    void*       mmap_result;
+
+    /* Just like the kernel, we only accept program header tables that
+     * are smaller than 64KB. */
+    if (phdr_num < 1 || phdr_num > 65536/sizeof(Elf32_Phdr)) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    page_min = PAGE_START(phdr_offset);
+    page_max = PAGE_END(phdr_offset + phdr_num*sizeof(Elf32_Phdr));
+    page_offset = PAGE_OFFSET(phdr_offset);
+
+    mmap_result = mmap(NULL,
+                       page_max - page_min,
+                       PROT_READ,
+                       MAP_PRIVATE,
+                       fd,
+                       page_min);
+
+    if (mmap_result == MAP_FAILED) {
+        return -1;
+    }
+
+    *phdr_mmap = mmap_result;
+    *phdr_size = page_max - page_min;
+    *phdr_table = (Elf32_Phdr*)((char*)mmap_result + page_offset);
+
+    return 0;
+}
+
+void phdr_table_unload(void* phdr_mmap, Elf32_Addr phdr_memsize)
+{
+    munmap(phdr_mmap, phdr_memsize);
+}
+
+
+/* Compute the extent of all loadable segments in an ELF program header
+ * table. This corresponds to the page-aligned size in bytes that needs to be
+ * reserved in the process' address space
+ *
+ * This returns 0 if there are no loadable segments.
+ */
+Elf32_Addr phdr_table_get_load_size(const Elf32_Phdr* phdr_table,
+                                    int               phdr_count)
+{
+    int nn;
+
+    Elf32_Addr min_vaddr = 0xFFFFFFFFU;
+    Elf32_Addr max_vaddr = 0x00000000U;
+
+    for (nn = 0; nn < phdr_count; nn++) {
+        const Elf32_Phdr* phdr = &phdr_table[nn];
+
+        if (phdr->p_type != PT_LOAD)
+            continue;
+
+        if (phdr->p_vaddr < min_vaddr)
+            min_vaddr = phdr->p_vaddr;
+
+        if (phdr->p_vaddr + phdr->p_memsz > max_vaddr)
+            max_vaddr = phdr->p_vaddr + phdr->p_memsz;
+    }
+
+    if (min_vaddr > max_vaddr) {
+        return 0;
+    }
+
+    min_vaddr = PAGE_START(min_vaddr);
+    max_vaddr = PAGE_END(max_vaddr);
+
+    return max_vaddr - min_vaddr;
+}
+
+/* Reserve a virtual address range big enough to hold all loadable
+ * segments of a program header table. This is done by creating a
+ * private anonymous mmap() with PROT_NONE.
+ *
+ * Input:
+ *   phdr_table    -> program header table
+ *   phdr_count    -> number of entries in the tables
+ *   required_base -> for prelinked libraries, mandatory load address
+ *                    of the first loadable segment. 0 otherwise.
+ * Output:
+ *   load_start    -> first page of reserved address space range
+ *   load_size     -> size in bytes of reserved address space range
+ *   load_bias     -> load bias, as described in technical note above.
+ *
+ * Return:
+ *   0 on success, -1 otherwise. Error code in errno.
+ */
+int
+phdr_table_reserve_memory(const Elf32_Phdr* phdr_table,
+                          int               phdr_count,
+                          Elf32_Addr        required_base,
+                          void**            load_start,
+                          Elf32_Addr*       load_size,
+                          Elf32_Addr*       load_bias)
+{
+    Elf32_Addr size = phdr_table_get_load_size(phdr_table, phdr_count);
+    void*      start;
+    int        nn, mmap_flags;
+
+    if (size == 0) {
+        errno = EINVAL;
+        return -1;
+    }
+
+    mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS;
+    if (required_base != 0)
+        mmap_flags |= MAP_FIXED;
+
+    start = mmap((void*)required_base, size, PROT_NONE, mmap_flags, -1, 0);
+    if (start == MAP_FAILED) {
+        return -1;
+    }
+
+    *load_start = start;
+    *load_size  = size;
+    *load_bias  = 0;
+
+    for (nn = 0; nn < phdr_count; nn++) {
+        const Elf32_Phdr* phdr = &phdr_table[nn];
+        if (phdr->p_type == PT_LOAD) {
+            *load_bias = (Elf32_Addr)start - PAGE_START(phdr->p_vaddr);
+            break;
+        }
+    }
+    return 0;
+}
+
+/* Map all loadable segments in process' address space.
+ * This assumes you already called phdr_table_reserve_memory to
+ * reserve the address space range for the library.
+ *
+ * Input:
+ *   phdr_table    -> program header table
+ *   phdr_count    -> number of entries in the table
+ *   load_start    -> start address of reserved memory range.
+ *   load_size     -> size of reserved memory range.
+ *   load_bias     -> load offset.
+ *   fd            -> input file descriptor.
+ *
+ * Return:
+ *   0 on success, -1 otherwise. Error code in errno.
+ */
+int
+phdr_table_load_segments(const Elf32_Phdr* phdr_table,
+                         int               phdr_count,
+                         void*             load_start,
+                         Elf32_Addr        load_size,
+                         Elf32_Addr        load_bias,
+                         int               fd)
+{
+    int nn;
+
+    for (nn = 0; nn < phdr_count; nn++) {
+        const Elf32_Phdr* phdr = &phdr_table[nn];
+        void* seg_addr;
+
+        if (phdr->p_type != PT_LOAD)
+            continue;
+
+        /* Segment addresses in memory */
+        Elf32_Addr seg_start = phdr->p_vaddr + load_bias;
+        Elf32_Addr seg_end   = seg_start + phdr->p_memsz;
+
+        Elf32_Addr seg_page_start = PAGE_START(seg_start);
+        Elf32_Addr seg_page_end   = PAGE_END(seg_end);
+
+        Elf32_Addr seg_file_end   = seg_start + phdr->p_filesz;
+
+        /* File offsets */
+        Elf32_Addr file_start = phdr->p_offset;
+        Elf32_Addr file_end   = file_start + phdr->p_filesz;
+
+        Elf32_Addr file_page_start = PAGE_START(file_start);
+        Elf32_Addr file_page_end   = PAGE_END(file_end);
+
+        seg_addr = mmap((void*)seg_page_start,
+                        file_end - file_page_start,
+                        PFLAGS_TO_PROT(phdr->p_flags),
+                        MAP_FIXED|MAP_PRIVATE,
+                        fd,
+                        file_page_start);
+
+        if (seg_addr == MAP_FAILED) {
+            return -1;
+        }
+
+        /* if the segment is writable, and does not end on a page boundary,
+         * zero-fill it until the page limit. */
+        if ((phdr->p_flags & PF_W) != 0 && PAGE_OFFSET(seg_file_end) > 0) {
+            memset((void*)seg_file_end, 0, PAGE_SIZE - PAGE_OFFSET(seg_file_end));
+        }
+
+        seg_file_end = PAGE_END(seg_file_end);
+
+        /* seg_file_end is now the first page address after the file
+         * content. If seg_end is larger, we need to zero anything
+         * between them. This is done by using a private anonymous
+         * map for all extra pages.
+         */
+        if (seg_page_end > seg_file_end) {
+            void* zeromap = mmap((void*)seg_file_end,
+                                    seg_page_end - seg_file_end,
+                                    PFLAGS_TO_PROT(phdr->p_flags),
+                                    MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,
+                                    -1,
+                                    0);
+            if (zeromap == MAP_FAILED) {
+                return -1;
+            }
+        }
+    }
+    return 0;
+}
+
+/* Used internally. Used to set the protection bits of all loaded segmments
+ * with optional extra flags (i.e. really PROT_WRITE). Used by
+ * phdr_table_protect_segments and phdr_table_unprotect_segments.
+ */
+static int
+_phdr_table_set_load_prot(const Elf32_Phdr* phdr_table,
+                          int               phdr_count,
+                          Elf32_Addr        load_bias,
+                          int               extra_prot_flags)
+{
+    const Elf32_Phdr* phdr = phdr_table;
+    const Elf32_Phdr* phdr_limit = phdr + phdr_count;
+
+    for (; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0)
+            continue;
+
+        Elf32_Addr seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
+        Elf32_Addr seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
+
+        int ret = mprotect((void*)seg_page_start,
+                           seg_page_end - seg_page_start,
+                           PFLAGS_TO_PROT(phdr->p_flags) | extra_prot_flags);
+        if (ret < 0) {
+            return -1;
+        }
+    }
+    return 0;
+}
+
+/* Restore the original protection modes for all loadable segments.
+ * You should only call this after phdr_table_unprotect_segments and
+ * applying all relocations.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entires in tables
+ *   load_bias   -> load bias
+ * Return:
+ *   0 on error, -1 on failure (error code in errno).
+ */
+int
+phdr_table_protect_segments(const Elf32_Phdr* phdr_table,
+                            int               phdr_count,
+                            Elf32_Addr        load_bias)
+{
+    return _phdr_table_set_load_prot(phdr_table, phdr_count,
+                                      load_bias, 0);
+}
+
+/* Change the protection of all loaded segments in memory to writable.
+ * This is useful before performing relocations. Once completed, you
+ * will have to call phdr_table_protect_segments to restore the original
+ * protection flags on all segments.
+ *
+ * Note that some writable segments can also have their content turned
+ * to read-only by calling phdr_table_protect_gnu_relro. This is no
+ * performed here.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entires in tables
+ *   load_bias   -> load bias
+ * Return:
+ *   0 on error, -1 on failure (error code in errno).
+ */
+int
+phdr_table_unprotect_segments(const Elf32_Phdr* phdr_table,
+                              int               phdr_count,
+                              Elf32_Addr        load_bias)
+{
+    return _phdr_table_set_load_prot(phdr_table, phdr_count,
+                                      load_bias, PROT_WRITE);
+}
+
+/* Used internally by phdr_table_protect_gnu_relro and
+ * phdr_table_unprotect_gnu_relro.
+ */
+static int
+_phdr_table_set_gnu_relro_prot(const Elf32_Phdr* phdr_table,
+                               int               phdr_count,
+                               Elf32_Addr        load_bias,
+                               int               prot_flags)
+{
+    const Elf32_Phdr* phdr = phdr_table;
+    const Elf32_Phdr* phdr_limit = phdr + phdr_count;
+
+    for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type != PT_GNU_RELRO)
+            continue;
+
+        /* Tricky: what happens when the relro segment does not start
+         * or end at page boundaries?. We're going to be over-protective
+         * here and put every page touched by the segment as read-only.
+         *
+         * This seems to match Ian Lance Taylor's description of the
+         * feature at http://www.airs.com/blog/archives/189.
+         *
+         * Extract:
+         *    Note that the current dynamic linker code will only work
+         *    correctly if the PT_GNU_RELRO segment starts on a page
+         *    boundary. This is because the dynamic linker rounds the
+         *    p_vaddr field down to the previous page boundary. If
+         *    there is anything on the page which should not be read-only,
+         *    the program is likely to fail at runtime. So in effect the
+         *    linker must only emit a PT_GNU_RELRO segment if it ensures
+         *    that it starts on a page boundary.
+         */
+        Elf32_Addr seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
+        Elf32_Addr seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
+
+        int ret = mprotect((void*)seg_page_start,
+                           seg_page_end - seg_page_start,
+                           prot_flags);
+        if (ret < 0) {
+            return -1;
+        }
+    }
+    return 0;
+}
+
+/* Apply GNU relro protection if specified by the program header. This will
+ * turn some of the pages of a writable PT_LOAD segment to read-only, as
+ * specified by one or more PT_GNU_RELRO segments. This must be always
+ * performed after relocations.
+ *
+ * NOTE: One must call phdr_table_unprotect_gnu_relro() before calling
+ *        the library's destructors, in order to ensure that the .dynamic
+ *        section is writable (as well as the .data.relro section that
+ *        might contain the content of static constant C++ objects that
+ *        needs to be destroyed).
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entires in tables
+ *   load_bias   -> load bias
+ * Return:
+ *   0 on error, -1 on failure (error code in errno).
+ */
+int
+phdr_table_protect_gnu_relro(const Elf32_Phdr* phdr_table,
+                             int               phdr_count,
+                             Elf32_Addr        load_bias)
+{
+    return _phdr_table_set_gnu_relro_prot(phdr_table,
+                                          phdr_count,
+                                          load_bias,
+                                          PROT_READ);
+}
+
+/* Un-apply GNU relro protection if specified by the program header.
+ * See comment for phdr_table_protect_gnu_relro.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entires in tables
+ *   load_bias   -> load bias
+ * Return:
+ *   0 on error, -1 on failure (error code in errno).
+ */
+int
+phdr_table_unprotect_gnu_relro(const Elf32_Phdr* phdr_table,
+                               int               phdr_count,
+                               Elf32_Addr        load_bias)
+{
+    return _phdr_table_set_gnu_relro_prot(phdr_table,
+                                          phdr_count,
+                                          load_bias,
+                                          PROT_READ|PROT_WRITE);
+}
+
+#ifdef ANDROID_ARM_LINKER
+
+#  ifndef PT_ARM_EXIDX
+#    define PT_ARM_EXIDX    0x70000001      /* .ARM.exidx segment */
+#  endif
+
+/* Return the address and size of the .ARM.exidx section in memory,
+ * if present.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entires in tables
+ *   load_bias   -> load bias
+ * Output:
+ *   arm_exidx       -> address of table in memory (NULL on failure).
+ *   arm_exidx_count -> number of items in table (0 on failure).
+ * Return:
+ *   0 on error, -1 on failure (_no_ error code in errno)
+ */
+int
+phdr_table_get_arm_exidx(const Elf32_Phdr* phdr_table,
+                         int               phdr_count,
+                         Elf32_Addr        load_bias,
+                         Elf32_Addr**      arm_exidx,
+                         unsigned*         arm_exidx_count)
+{
+    const Elf32_Phdr* phdr = phdr_table;
+    const Elf32_Phdr* phdr_limit = phdr + phdr_count;
+
+    for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type != PT_ARM_EXIDX)
+            continue;
+
+        *arm_exidx = (Elf32_Addr*)(load_bias + phdr->p_vaddr);
+        *arm_exidx_count = (unsigned)(phdr->p_memsz / 8);
+        return 0;
+    }
+    *arm_exidx = NULL;
+    *arm_exidx_count = 0;
+    return -1;
+}
+#endif /* ANDROID_ARM_LINKER */
+
+/* Return the address of the ELF file's .dynamic section in memory,
+ * or NULL if missing.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entires in tables
+ *   load_bias   -> load bias
+ * Return:
+ *   0 on error, -1 on failure (_no_ error code in errno)
+ */
+Elf32_Addr*
+phdr_table_get_dynamic_section(const Elf32_Phdr* phdr_table,
+                               int               phdr_count,
+                               Elf32_Addr        load_bias)
+{
+    const Elf32_Phdr* phdr = phdr_table;
+    const Elf32_Phdr* phdr_limit = phdr + phdr_count;
+
+    for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type == PT_DYNAMIC) {
+            return (Elf32_Addr*)(load_bias + phdr->p_vaddr);
+        }
+    }
+    return NULL;
+}
+
+/* Return the address of the program header table as it appears in the loaded
+ * segments in memory. This is in contrast with the input 'phdr_table' which
+ * is temporary and will be released before the library is relocated.
+ *
+ * Input:
+ *   phdr_table  -> program header table
+ *   phdr_count  -> number of entries in tables
+ *   load_bias   -> load bias
+ * Return:
+ *   Address of loaded program header table on success (it has
+ *   'phdr_count' entries), or NULL on failure (no error code).
+ */
+const Elf32_Phdr*
+phdr_table_get_loaded_phdr(const Elf32_Phdr*   phdr_table,
+                           int                 phdr_count,
+                           Elf32_Addr          load_bias)
+{
+    const Elf32_Phdr* phdr = phdr_table;
+    const Elf32_Phdr* phdr_limit = phdr + phdr_count;
+    Elf32_Addr  loaded = 0;
+    Elf32_Addr  loaded_end;
+
+    /* If there is a PT_PHDR, use it directly */
+    for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type == PT_PHDR) {
+            loaded = load_bias + phdr->p_vaddr;
+            goto CHECK;
+        }
+    }
+
+    /* Otherwise, check the first loadable segment. If its file offset
+     * is 0, it starts with the ELF header, and we can trivially find the
+     * loaded program header from it. */
+    for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type == PT_LOAD) {
+            if (phdr->p_offset == 0) {
+                Elf32_Addr  elf_addr = load_bias + phdr->p_vaddr;
+                const Elf32_Ehdr* ehdr = (const Elf32_Ehdr*)(void*)elf_addr;
+                Elf32_Addr  offset = ehdr->e_phoff;
+                loaded = (Elf32_Addr)ehdr + offset;
+                goto CHECK;
+            }
+            break;
+        }
+    }
+
+    /* We didn't find it, let the client know. He may be able to
+     * keep a copy of the input phdr_table instead. */
+    return NULL;
+
+CHECK:
+    /* Ensure that our program header is actually within a loadable
+     * segment. This should help catch badly-formed ELF files that
+     * would cause the linker to crash later when trying to access it.
+     */
+    loaded_end = loaded + phdr_count*sizeof(Elf32_Phdr);
+
+    for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
+        if (phdr->p_type != PT_LOAD)
+            continue;
+        Elf32_Addr seg_start = phdr->p_vaddr + load_bias;
+        Elf32_Addr seg_end   = phdr->p_filesz + seg_start;
+
+        if (seg_start <= loaded && loaded_end <= seg_end) {
+            return (const Elf32_Phdr*)loaded;
+        }
+    }
+    return NULL;
+}
diff --git a/linker/linker_phdr.h b/linker/linker_phdr.h
new file mode 100644
index 0000000..d542e46
--- /dev/null
+++ b/linker/linker_phdr.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef LINKER_PHDR_H
+#define LINKER_PHDR_H
+
+/* Declarations related to the ELF program header table and segments.
+ *
+ * The design goal is to provide an API that is as close as possible
+ * to the ELF spec, and does not depend on linker-specific data
+ * structures (e.g. the exact layout of struct soinfo).
+ */
+
+#include "linker.h"
+
+/* See linker_phdr.c for all usage documentation */
+
+int
+phdr_table_load(int                fd,
+                Elf32_Addr         phdr_offset,
+                Elf32_Half         phdr_num,
+                void**             phdr_mmap,
+                Elf32_Addr*        phdr_size,
+                const Elf32_Phdr** phdr_table);
+
+void
+phdr_table_unload(void* phdr_mmap, Elf32_Addr phdr_memsize);
+
+Elf32_Addr
+phdr_table_get_load_size(const Elf32_Phdr* phdr_table,
+                         int               phdr_count);
+
+int
+phdr_table_reserve_memory(const Elf32_Phdr* phdr_table,
+                          int               phdr_count,
+                          Elf32_Addr        required_base,
+                          void**            load_start,
+                          Elf32_Addr*       load_size,
+                          Elf32_Addr*       load_bias);
+
+int
+phdr_table_load_segments(const Elf32_Phdr* phdr_table,
+                         int               phdr_count,
+                         void*             load_start,
+                         Elf32_Addr        load_size,
+                         Elf32_Addr        load_bias,
+                         int               fd);
+
+int
+phdr_table_protect_segments(const Elf32_Phdr* phdr_table,
+                            int               phdr_count,
+                            Elf32_Addr        load_bias);
+
+int
+phdr_table_unprotect_segments(const Elf32_Phdr* phdr_table,
+                              int               phdr_count,
+                              Elf32_Addr        load_bias);
+
+int
+phdr_table_protect_gnu_relro(const Elf32_Phdr* phdr_table,
+                             int               phdr_count,
+                             Elf32_Addr        load_bias);
+
+int
+phdr_table_unprotect_gnu_relro(const Elf32_Phdr* phdr_table,
+                               int               phdr_count,
+                               Elf32_Addr        load_bias);
+
+const Elf32_Phdr*
+phdr_table_get_loaded_phdr(const Elf32_Phdr*   phdr_table,
+                           int                 phdr_count,
+                           Elf32_Addr          load_bias);
+
+#ifdef ANDROID_ARM_LINKER
+int
+phdr_table_get_arm_exidx(const Elf32_Phdr* phdr_table,
+                         int               phdr_count,
+                         Elf32_Addr        load_bias,
+                         Elf32_Addr**      arm_exidx,
+                         unsigned*         arm_exidix_count);
+#endif
+
+Elf32_Addr*
+phdr_table_get_dynamic_section(const Elf32_Phdr* phdr_table,
+                               int               phdr_count,
+                               Elf32_Addr        load_bias);
+
+#endif /* LINKER_PHDR_H */