Merge "liblog: logcat: Add year and zone to date on each line"
diff --git a/adb/adb.cpp b/adb/adb.cpp
index e973603..0e1859c 100644
--- a/adb/adb.cpp
+++ b/adb/adb.cpp
@@ -239,6 +239,10 @@
     // "device::ro.product.name=x;ro.product.model=y;ro.product.device=z;".
     std::vector<std::string> pieces = android::base::Split(banner, ":");
 
+    // Reset the features list or else if the server sends no features we may
+    // keep the existing feature set (http://b/24405971).
+    t->SetFeatures("");
+
     if (pieces.size() > 2) {
         const std::string& props = pieces[2];
         for (auto& prop : android::base::Split(props, ";")) {
diff --git a/adb/adb.h b/adb/adb.h
index 037c010..a20b345 100644
--- a/adb/adb.h
+++ b/adb/adb.h
@@ -50,7 +50,7 @@
 std::string adb_version();
 
 // Increment this when we want to force users to start a new adb server.
-#define ADB_SERVER_VERSION 32
+#define ADB_SERVER_VERSION 33
 
 class atransport;
 struct usb_handle;
diff --git a/adb/transport.cpp b/adb/transport.cpp
index ffbb107..2a2fac7 100644
--- a/adb/transport.cpp
+++ b/adb/transport.cpp
@@ -786,6 +786,9 @@
     // Local static allocation to avoid global non-POD variables.
     static const FeatureSet* features = new FeatureSet{
         kFeatureShell2
+        // Increment ADB_SERVER_VERSION whenever the feature list changes to
+        // make sure that the adb client and server features stay in sync
+        // (http://b/24370690).
     };
 
     return *features;
@@ -796,6 +799,10 @@
 }
 
 FeatureSet StringToFeatureSet(const std::string& features_string) {
+    if (features_string.empty()) {
+        return FeatureSet();
+    }
+
     auto names = android::base::Split(features_string,
                                       {kFeatureStringDelimiter});
     return FeatureSet(names.begin(), names.end());
diff --git a/adb/transport_test.cpp b/adb/transport_test.cpp
index 7d69c3e..97fc069 100644
--- a/adb/transport_test.cpp
+++ b/adb/transport_test.cpp
@@ -167,6 +167,9 @@
     ASSERT_FALSE(t.has_feature("foo"));
     ASSERT_TRUE(t.has_feature("bar"));
     ASSERT_TRUE(t.has_feature("baz"));
+
+    t.SetFeatures("");
+    ASSERT_EQ(0U, t.features().size());
 }
 
 TEST(transport, parse_banner_no_features) {
diff --git a/crash_reporter/Android.mk b/crash_reporter/Android.mk
index 6cd34ab..e797022 100644
--- a/crash_reporter/Android.mk
+++ b/crash_reporter/Android.mk
@@ -14,8 +14,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-ifeq ($(HOST_OS),linux)
-
 crash_reporter_cpp_extension := .cc
 
 crash_reporter_src := crash_collector.cc \
@@ -62,8 +60,8 @@
 LOCAL_REQUIRED_MODULES := core2md \
     crash_reporter_logs.conf \
     crash_sender \
-    dbus-send \
-    init.crash_reporter.rc
+    dbus-send
+LOCAL_INIT_RC := crash_reporter.rc
 LOCAL_RTTI_FLAG := -frtti
 LOCAL_SHARED_LIBRARIES := libchrome \
     libchromeos \
@@ -94,17 +92,6 @@
 LOCAL_SRC_FILES := $(warn_collector_src)
 include $(BUILD_EXECUTABLE)
 
-# Crash reporter init script.
-# ========================================================
-ifdef TARGET_COPY_OUT_INITRCD
-include $(CLEAR_VARS)
-LOCAL_MODULE := init.crash_reporter.rc
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_INITRCD)
-LOCAL_SRC_FILES := init.crash_reporter.rc
-include $(BUILD_PREBUILT)
-endif
-
 # Crash reporter logs conf file.
 # ========================================================
 include $(CLEAR_VARS)
@@ -135,5 +122,3 @@
 LOCAL_SRC_FILES := $(crash_reporter_test_src)
 LOCAL_STATIC_LIBRARIES := libcrash libgmock
 include $(BUILD_NATIVE_TEST)
-
-endif # HOST_OS == linux
diff --git a/crash_reporter/init.crash_reporter.rc b/crash_reporter/crash_reporter.rc
similarity index 100%
rename from crash_reporter/init.crash_reporter.rc
rename to crash_reporter/crash_reporter.rc
diff --git a/crash_reporter/crash_sender b/crash_reporter/crash_sender
index 29a1229..8a422dd 100755
--- a/crash_reporter/crash_sender
+++ b/crash_reporter/crash_sender
@@ -128,7 +128,11 @@
 
 is_official_image() {
   [ ${FORCE_OFFICIAL} -ne 0 ] && return 0
-  getprop ro.product.description | grep -q Official
+  if [ "$(getprop ro.secure)" = "1" ]; then
+    return 0
+  else
+    return 1
+  fi
 }
 
 # Returns 0 if the a crash test is currently running.  NOTE: Mirrors
@@ -165,7 +169,7 @@
   # If we're testing crash reporter itself, we don't want to special-case
   # for developer mode.
   is_crash_test_in_progress && return 1
-  if [ "$(getprop ro.build.type)" = "eng" ]; then
+  if [ "$(getprop ro.debuggable)" = "1" ]; then
     return 0
   else
     return 1
diff --git a/fs_mgr/fs_mgr_verity.c b/fs_mgr/fs_mgr_verity.c
index a4a99c3..eddc3e4 100644
--- a/fs_mgr/fs_mgr_verity.c
+++ b/fs_mgr/fs_mgr_verity.c
@@ -47,6 +47,8 @@
 
 #define VERITY_METADATA_SIZE 32768
 #define VERITY_TABLE_RSA_KEY "/verity_key"
+#define VERITY_TABLE_HASH_IDX 8
+#define VERITY_TABLE_SALT_IDX 9
 
 #define METADATA_MAGIC 0x01564c54
 #define METADATA_TAG_MAX_LENGTH 63
@@ -141,6 +143,33 @@
     return retval;
 }
 
+static int invalidate_table(char *table, int table_length)
+{
+    int n = 0;
+    int idx = 0;
+    int cleared = 0;
+
+    while (n < table_length) {
+        if (table[n++] == ' ') {
+            ++idx;
+        }
+
+        if (idx != VERITY_TABLE_HASH_IDX && idx != VERITY_TABLE_SALT_IDX) {
+            continue;
+        }
+
+        while (n < table_length && table[n] != ' ') {
+            table[n++] = '0';
+        }
+
+        if (++cleared == 2) {
+            return 0;
+        }
+    }
+
+    return -1;
+}
+
 static int squashfs_get_target_device_size(char *blk_device, uint64_t *device_size)
 {
     struct squashfs_info sq_info;
@@ -957,6 +986,7 @@
     char *verity_blk_name = 0;
     char *verity_table = 0;
     char *verity_table_signature = 0;
+    int verity_table_length = 0;
     uint64_t device_size = 0;
 
     _Alignas(struct dm_ioctl) char buffer[DM_BUF_SIZE];
@@ -979,6 +1009,7 @@
     }
 
     retval = FS_MGR_SETUP_VERITY_FAIL;
+    verity_table_length = strlen(verity_table);
 
     // get the device mapper fd
     if ((fd = open("/dev/device-mapper", O_RDWR)) < 0) {
@@ -998,13 +1029,6 @@
         goto out;
     }
 
-    // verify the signature on the table
-    if (verify_table(verity_table_signature,
-                            verity_table,
-                            strlen(verity_table)) < 0) {
-        goto out;
-    }
-
     if (load_verity_state(fstab, &mode) < 0) {
         /* if accessing or updating the state failed, switch to the default
          * safe mode. This makes sure the device won't end up in an endless
@@ -1013,6 +1037,22 @@
         mode = VERITY_MODE_EIO;
     }
 
+    // verify the signature on the table
+    if (verify_table(verity_table_signature,
+                            verity_table,
+                            verity_table_length) < 0) {
+        if (mode == VERITY_MODE_LOGGING) {
+            // the user has been warned, allow mounting without dm-verity
+            retval = FS_MGR_SETUP_VERITY_SUCCESS;
+            goto out;
+        }
+
+        // invalidate root hash and salt to trigger device-specific recovery
+        if (invalidate_table(verity_table, verity_table_length) < 0) {
+            goto out;
+        }
+    }
+
     INFO("Enabling dm-verity for %s (mode %d)\n",  mount_point, mode);
 
     // load the verity mapping table
diff --git a/include/utils/Compat.h b/include/utils/Compat.h
index c5f9d6a..b2ba55e 100644
--- a/include/utils/Compat.h
+++ b/include/utils/Compat.h
@@ -33,6 +33,10 @@
     return pread(fd, buf, nbytes, offset);
 }
 
+static inline ssize_t pwrite64(int fd, const void* buf, size_t nbytes, off64_t offset) {
+    return pwrite(fd, buf, nbytes, offset);
+}
+
 #endif /* __APPLE__ */
 
 #if defined(_WIN32)
diff --git a/include/utils/LruCache.h b/include/utils/LruCache.h
index cd9d7f9..7818b4e 100644
--- a/include/utils/LruCache.h
+++ b/include/utils/LruCache.h
@@ -17,8 +17,11 @@
 #ifndef ANDROID_UTILS_LRU_CACHE_H
 #define ANDROID_UTILS_LRU_CACHE_H
 
+#include <unordered_set>
+
 #include <UniquePtr.h>
-#include <utils/BasicHashtable.h>
+
+#include "utils/TypeHelpers.h"  // hash_t
 
 namespace android {
 
@@ -36,6 +39,7 @@
 class LruCache {
 public:
     explicit LruCache(uint32_t maxCapacity);
+    virtual ~LruCache();
 
     enum Capacity {
         kUnlimitedCapacity,
@@ -50,32 +54,6 @@
     void clear();
     const TValue& peekOldestValue();
 
-    class Iterator {
-    public:
-        Iterator(const LruCache<TKey, TValue>& cache): mCache(cache), mIndex(-1) {
-        }
-
-        bool next() {
-            mIndex = mCache.mTable->next(mIndex);
-            return (ssize_t)mIndex != -1;
-        }
-
-        size_t index() const {
-            return mIndex;
-        }
-
-        const TValue& value() const {
-            return mCache.mTable->entryAt(mIndex).value;
-        }
-
-        const TKey& key() const {
-            return mCache.mTable->entryAt(mIndex).key;
-        }
-    private:
-        const LruCache<TKey, TValue>& mCache;
-        size_t mIndex;
-    };
-
 private:
     LruCache(const LruCache& that);  // disallow copy constructor
 
@@ -90,27 +68,79 @@
         const TKey& getKey() const { return key; }
     };
 
+    struct HashForEntry : public std::unary_function<Entry*, hash_t> {
+        size_t operator() (const Entry* entry) const {
+            return hash_type(entry->key);
+        };
+    };
+
+    struct EqualityForHashedEntries : public std::unary_function<Entry*, hash_t> {
+        bool operator() (const Entry* lhs, const Entry* rhs) const {
+            return lhs->key == rhs->key;
+        };
+    };
+
+    typedef std::unordered_set<Entry*, HashForEntry, EqualityForHashedEntries> LruCacheSet;
+
     void attachToCache(Entry& entry);
     void detachFromCache(Entry& entry);
-    void rehash(size_t newCapacity);
 
-    UniquePtr<BasicHashtable<TKey, Entry> > mTable;
+    typename LruCacheSet::iterator findByKey(const TKey& key) {
+        Entry entryForSearch(key, mNullValue);
+        typename LruCacheSet::iterator result = mSet->find(&entryForSearch);
+        return result;
+    }
+
+    UniquePtr<LruCacheSet> mSet;
     OnEntryRemoved<TKey, TValue>* mListener;
     Entry* mOldest;
     Entry* mYoungest;
     uint32_t mMaxCapacity;
     TValue mNullValue;
+
+public:
+    class Iterator {
+    public:
+        Iterator(const LruCache<TKey, TValue>& cache): mCache(cache), mIterator(mCache.mSet->begin()) {
+        }
+
+        bool next() {
+            if (mIterator == mCache.mSet->end()) {
+                return false;
+            }
+            std::advance(mIterator, 1);
+            return mIterator != mCache.mSet->end();
+        }
+
+        const TValue& value() const {
+            return (*mIterator)->value;
+        }
+
+        const TKey& key() const {
+            return (*mIterator)->key;
+        }
+    private:
+        const LruCache<TKey, TValue>& mCache;
+        typename LruCacheSet::iterator mIterator;
+    };
 };
 
 // Implementation is here, because it's fully templated
 template <typename TKey, typename TValue>
 LruCache<TKey, TValue>::LruCache(uint32_t maxCapacity)
-    : mTable(new BasicHashtable<TKey, Entry>)
+    : mSet(new LruCacheSet())
     , mListener(NULL)
     , mOldest(NULL)
     , mYoungest(NULL)
     , mMaxCapacity(maxCapacity)
     , mNullValue(NULL) {
+    mSet->max_load_factor(1.0);
+};
+
+template <typename TKey, typename TValue>
+LruCache<TKey, TValue>::~LruCache() {
+    // Need to delete created entries.
+    clear();
 };
 
 template<typename K, typename V>
@@ -120,20 +150,19 @@
 
 template <typename TKey, typename TValue>
 size_t LruCache<TKey, TValue>::size() const {
-    return mTable->size();
+    return mSet->size();
 }
 
 template <typename TKey, typename TValue>
 const TValue& LruCache<TKey, TValue>::get(const TKey& key) {
-    hash_t hash = hash_type(key);
-    ssize_t index = mTable->find(-1, hash, key);
-    if (index == -1) {
+    typename LruCacheSet::const_iterator find_result = findByKey(key);
+    if (find_result == mSet->end()) {
         return mNullValue;
     }
-    Entry& entry = mTable->editEntryAt(index);
-    detachFromCache(entry);
-    attachToCache(entry);
-    return entry.value;
+    Entry *entry = *find_result;
+    detachFromCache(*entry);
+    attachToCache(*entry);
+    return entry->value;
 }
 
 template <typename TKey, typename TValue>
@@ -142,36 +171,29 @@
         removeOldest();
     }
 
-    hash_t hash = hash_type(key);
-    ssize_t index = mTable->find(-1, hash, key);
-    if (index >= 0) {
+    if (findByKey(key) != mSet->end()) {
         return false;
     }
-    if (!mTable->hasMoreRoom()) {
-        rehash(mTable->capacity() * 2);
-    }
 
-    // Would it be better to initialize a blank entry and assign key, value?
-    Entry initEntry(key, value);
-    index = mTable->add(hash, initEntry);
-    Entry& entry = mTable->editEntryAt(index);
-    attachToCache(entry);
+    Entry* newEntry = new Entry(key, value);
+    mSet->insert(newEntry);
+    attachToCache(*newEntry);
     return true;
 }
 
 template <typename TKey, typename TValue>
 bool LruCache<TKey, TValue>::remove(const TKey& key) {
-    hash_t hash = hash_type(key);
-    ssize_t index = mTable->find(-1, hash, key);
-    if (index < 0) {
+    typename LruCacheSet::const_iterator find_result = findByKey(key);
+    if (find_result == mSet->end()) {
         return false;
     }
-    Entry& entry = mTable->editEntryAt(index);
+    Entry* entry = *find_result;
     if (mListener) {
-        (*mListener)(entry.key, entry.value);
+        (*mListener)(entry->key, entry->value);
     }
-    detachFromCache(entry);
-    mTable->removeAt(index);
+    detachFromCache(*entry);
+    mSet->erase(entry);
+    delete entry;
     return true;
 }
 
@@ -201,7 +223,10 @@
     }
     mYoungest = NULL;
     mOldest = NULL;
-    mTable->clear();
+    for (auto entry : *mSet.get()) {
+        delete entry;
+    }
+    mSet->clear();
 }
 
 template <typename TKey, typename TValue>
@@ -232,19 +257,5 @@
     entry.child = NULL;
 }
 
-template <typename TKey, typename TValue>
-void LruCache<TKey, TValue>::rehash(size_t newCapacity) {
-    UniquePtr<BasicHashtable<TKey, Entry> > oldTable(mTable.release());
-    Entry* oldest = mOldest;
-
-    mOldest = NULL;
-    mYoungest = NULL;
-    mTable.reset(new BasicHashtable<TKey, Entry>(newCapacity));
-    for (Entry* p = oldest; p != NULL; p = p->child) {
-        put(p->key, p->value);
-    }
 }
-
-}
-
 #endif // ANDROID_UTILS_LRU_CACHE_H
diff --git a/include/utils/String16.h b/include/utils/String16.h
index b2ab5dc..9a67c7a 100644
--- a/include/utils/String16.h
+++ b/include/utils/String16.h
@@ -65,8 +65,6 @@
     
     inline  const char16_t*     string() const;
     
-            const SharedBuffer* sharedBuffer() const;
-    
             size_t              size() const;
             void                setTo(const String16& other);
             status_t            setTo(const char16_t* other);
diff --git a/include/utils/String8.h b/include/utils/String8.h
index a8a37db..2a75b98 100644
--- a/include/utils/String8.h
+++ b/include/utils/String8.h
@@ -28,7 +28,6 @@
 
 namespace android {
 
-class SharedBuffer;
 class String16;
 class TextOutput;
 
@@ -69,7 +68,6 @@
     inline  bool                isEmpty() const;
     
             size_t              length() const;
-            const SharedBuffer* sharedBuffer() const;
     
             void                clear();
 
diff --git a/libbacktrace/Android.build.mk b/libbacktrace/Android.build.mk
index 84d07f2..2467f3e 100644
--- a/libbacktrace/Android.build.mk
+++ b/libbacktrace/Android.build.mk
@@ -26,11 +26,17 @@
 endif
 endif
 
-LOCAL_ADDITIONAL_DEPENDENCIES := \
+ifeq ($(build_type),target)
+  include $(LLVM_DEVICE_BUILD_MK)
+else
+  include $(LLVM_HOST_BUILD_MK)
+endif
+
+LOCAL_ADDITIONAL_DEPENDENCIES += \
     $(LOCAL_PATH)/Android.mk \
     $(LOCAL_PATH)/Android.build.mk \
 
-LOCAL_CFLAGS := \
+LOCAL_CFLAGS += \
     $(libbacktrace_common_cflags) \
     $($(module)_cflags) \
     $($(module)_cflags_$(build_type)) \
@@ -48,7 +54,7 @@
     $($(module)_cppflags) \
     $($(module)_cppflags_$(build_type)) \
 
-LOCAL_C_INCLUDES := \
+LOCAL_C_INCLUDES += \
     $(libbacktrace_common_c_includes) \
     $($(module)_c_includes) \
     $($(module)_c_includes_$(build_type)) \
@@ -57,29 +63,27 @@
     $($(module)_src_files) \
     $($(module)_src_files_$(build_type)) \
 
-LOCAL_STATIC_LIBRARIES := \
+LOCAL_STATIC_LIBRARIES += \
     $($(module)_static_libraries) \
     $($(module)_static_libraries_$(build_type)) \
 
-LOCAL_SHARED_LIBRARIES := \
+LOCAL_SHARED_LIBRARIES += \
     $($(module)_shared_libraries) \
     $($(module)_shared_libraries_$(build_type)) \
 
-LOCAL_LDLIBS := \
+LOCAL_LDLIBS += \
     $($(module)_ldlibs) \
     $($(module)_ldlibs_$(build_type)) \
 
 LOCAL_STRIP_MODULE := $($(module)_strip_module)
 
 ifeq ($(build_type),target)
-  include $(LLVM_DEVICE_BUILD_MK)
   include $(BUILD_$(build_target))
 endif
 
 ifeq ($(build_type),host)
   # Only build if host builds are supported.
   ifeq ($(build_host),true)
-    include $(LLVM_HOST_BUILD_MK)
     # -fno-omit-frame-pointer should be set for host build. Because currently
     # libunwind can't recognize .debug_frame using dwarf version 4, and it relies
     # on stack frame pointer to do unwinding on x86.
diff --git a/liblog/Android.bp b/liblog/Android.bp
index ee394fd..34e7f92 100644
--- a/liblog/Android.bp
+++ b/liblog/Android.bp
@@ -47,7 +47,7 @@
             sanitize: ["never"],
         },
         android_arm: {
-            // TODO: This is to work around b/19059885. Remove after root cause is fixed
+            // TODO: This is to work around b/24465209. Remove after root cause is fixed
             ldflags: ["-Wl,--hash-style=both"],
         },
         windows: {
diff --git a/liblog/Android.mk b/liblog/Android.mk
index 271c6f9..a183db8 100644
--- a/liblog/Android.mk
+++ b/liblog/Android.mk
@@ -69,7 +69,7 @@
 LOCAL_WHOLE_STATIC_LIBRARIES := liblog
 LOCAL_CFLAGS := -Werror $(liblog_cflags)
 
-# TODO: This is to work around b/19059885. Remove after root cause is fixed
+# TODO: This is to work around b/24465209. Remove after root cause is fixed
 LOCAL_LDFLAGS_arm := -Wl,--hash-style=both
 
 LOCAL_SANITIZE := never
diff --git a/liblog/logprint.c b/liblog/logprint.c
index 97e28fd..b6dba2e 100644
--- a/liblog/logprint.c
+++ b/liblog/logprint.c
@@ -819,7 +819,7 @@
     uint32_t utf32;
 
     if ((first_char & 0x80) == 0) { /* ASCII */
-        return 1;
+        return first_char ? 1 : -1;
     }
 
     /*
diff --git a/libutils/String16.cpp b/libutils/String16.cpp
index 67be9d8..6a5273f 100644
--- a/libutils/String16.cpp
+++ b/libutils/String16.cpp
@@ -171,11 +171,6 @@
     return SharedBuffer::sizeFromData(mString)/sizeof(char16_t)-1;
 }
 
-const SharedBuffer* String16::sharedBuffer() const
-{
-    return SharedBuffer::bufferFromData(mString);
-}
-
 void String16::setTo(const String16& other)
 {
     SharedBuffer::bufferFromData(other.mString)->acquire();
diff --git a/libutils/String8.cpp b/libutils/String8.cpp
index 5e85520..81bfccf 100644
--- a/libutils/String8.cpp
+++ b/libutils/String8.cpp
@@ -217,11 +217,6 @@
     return SharedBuffer::sizeFromData(mString)-1;
 }
 
-const SharedBuffer* String8::sharedBuffer() const
-{
-    return SharedBuffer::bufferFromData(mString);
-}
-
 String8 String8::format(const char* fmt, ...)
 {
     va_list args;
diff --git a/libutils/tests/LruCache_test.cpp b/libutils/tests/LruCache_test.cpp
index 6155def..2ed84d7 100644
--- a/libutils/tests/LruCache_test.cpp
+++ b/libutils/tests/LruCache_test.cpp
@@ -221,7 +221,7 @@
     cache.put(ComplexKey(0), ComplexValue(0));
     cache.put(ComplexKey(1), ComplexValue(1));
     EXPECT_EQ(2U, cache.size());
-    assertInstanceCount(2, 3);  // the null value counts as an instance
+    assertInstanceCount(2, 3);  // the member mNullValue counts as an instance
 }
 
 TEST_F(LruCacheTest, Clear) {
diff --git a/logd/LogAudit.cpp b/logd/LogAudit.cpp
index 4b3547c..7db17d1 100644
--- a/logd/LogAudit.cpp
+++ b/logd/LogAudit.cpp
@@ -239,9 +239,9 @@
     return rc;
 }
 
-int LogAudit::log(char *buf) {
+int LogAudit::log(char *buf, size_t len) {
     char *audit = strstr(buf, " audit(");
-    if (!audit) {
+    if (!audit || (audit >= &buf[len])) {
         return 0;
     }
 
@@ -249,7 +249,7 @@
 
     int rc;
     char *type = strstr(buf, "type=");
-    if (type) {
+    if (type && (type < &buf[len])) {
         rc = logPrint("%s %s", type, audit + 1);
     } else {
         rc = logPrint("%s", audit + 1);
diff --git a/logd/LogAudit.h b/logd/LogAudit.h
index f977be9..2342822 100644
--- a/logd/LogAudit.h
+++ b/logd/LogAudit.h
@@ -28,7 +28,7 @@
 
 public:
     LogAudit(LogBuffer *buf, LogReader *reader, int fdDmesg);
-    int log(char *buf);
+    int log(char *buf, size_t len);
 
 protected:
     virtual bool onDataAvailable(SocketClient *cli);
diff --git a/logd/LogKlog.cpp b/logd/LogKlog.cpp
index febf775..242d7a0 100644
--- a/logd/LogKlog.cpp
+++ b/logd/LogKlog.cpp
@@ -39,14 +39,15 @@
 // Parsing is hard
 
 // called if we see a '<', s is the next character, returns pointer after '>'
-static char *is_prio(char *s) {
-    if (!isdigit(*s++)) {
+static char *is_prio(char *s, size_t len) {
+    if (!len || !isdigit(*s++)) {
         return NULL;
     }
-    static const size_t max_prio_len = 4;
-    size_t len = 0;
+    --len;
+    static const size_t max_prio_len = (len < 4) ? len : 4;
+    size_t priolen = 0;
     char c;
-    while (((c = *s++)) && (++len <= max_prio_len)) {
+    while (((c = *s++)) && (++priolen <= max_prio_len)) {
         if (!isdigit(c)) {
             return ((c == '>') && (*s == '[')) ? s : NULL;
         }
@@ -55,16 +56,19 @@
 }
 
 // called if we see a '[', s is the next character, returns pointer after ']'
-static char *is_timestamp(char *s) {
-    while (*s == ' ') {
+static char *is_timestamp(char *s, size_t len) {
+    while (len && (*s == ' ')) {
         ++s;
+        --len;
     }
-    if (!isdigit(*s++)) {
+    if (!len || !isdigit(*s++)) {
         return NULL;
     }
+    --len;
     bool first_period = true;
     char c;
-    while ((c = *s++)) {
+    while (len && ((c = *s++))) {
+        --len;
         if ((c == '.') && first_period) {
             first_period = false;
         } else if (!isdigit(c)) {
@@ -77,6 +81,8 @@
 // Like strtok_r with "\r\n" except that we look for log signatures (regex)
 //  \(\(<[0-9]\{1,4\}>\)\([[] *[0-9]+[.][0-9]+[]] \)\{0,1\}\|[[] *[0-9]+[.][0-9]+[]] \)
 // and split if we see a second one without a newline.
+// We allow nuls in content, monitoring the overall length and sub-length of
+// the discovered tokens.
 
 #define SIGNATURE_MASK     0xF0
 // <digit> following ('0' to '9' masked with ~SIGNATURE_MASK) added to signature
@@ -85,7 +91,11 @@
 // space is one more than <digit> of 9
 #define OPEN_BRACKET_SPACE ((char)(OPEN_BRACKET_SIG | 10))
 
-char *log_strtok_r(char *s, char **last) {
+char *log_strntok_r(char *s, size_t *len, char **last, size_t *sublen) {
+    *sublen = 0;
+    if (!*len) {
+        return NULL;
+    }
     if (!s) {
         if (!(s = *last)) {
             return NULL;
@@ -95,6 +105,7 @@
         if ((*s & SIGNATURE_MASK) == LESS_THAN_SIG) {
             *s = (*s & ~SIGNATURE_MASK) + '0';
             *--s = '<';
+            ++*len;
         }
         // fixup for log signature split [,
         // OPEN_BRACKET_SPACE is space, OPEN_BRACKET_SIG + <digit>
@@ -105,24 +116,30 @@
                 *s = (*s & ~SIGNATURE_MASK) + '0';
             }
             *--s = '[';
+            ++*len;
         }
     }
 
-    s += strspn(s, "\r\n");
+    while (*len && ((*s == '\r') || (*s == '\n'))) {
+        ++s;
+        --*len;
+    }
 
-    if (!*s) { // no non-delimiter characters
+    if (!*len) {
         *last = NULL;
         return NULL;
     }
     char *peek, *tok = s;
 
     for (;;) {
-        char c = *s++;
-        switch (c) {
-        case '\0':
+        if (*len == 0) {
             *last = NULL;
             return tok;
-
+        }
+        char c = *s++;
+        --*len;
+        size_t adjust;
+        switch (c) {
         case '\r':
         case '\n':
             s[-1] = '\0';
@@ -130,7 +147,7 @@
             return tok;
 
         case '<':
-            peek = is_prio(s);
+            peek = is_prio(s, *len);
             if (!peek) {
                 break;
             }
@@ -141,14 +158,26 @@
                 *last = s;
                 return tok;
             }
+            adjust = peek - s;
+            if (adjust > *len) {
+                adjust = *len;
+            }
+            *sublen += adjust;
+            *len -= adjust;
             s = peek;
-            if ((*s == '[') && ((peek = is_timestamp(s + 1)))) {
+            if ((*s == '[') && ((peek = is_timestamp(s + 1, *len - 1)))) {
+                adjust = peek - s;
+                if (adjust > *len) {
+                    adjust = *len;
+                }
+                *sublen += adjust;
+                *len -= adjust;
                 s = peek;
             }
             break;
 
         case '[':
-            peek = is_timestamp(s);
+            peek = is_timestamp(s, *len);
             if (!peek) {
                 break;
             }
@@ -163,9 +192,16 @@
                 *last = s;
                 return tok;
             }
+            adjust = peek - s;
+            if (adjust > *len) {
+                adjust = *len;
+            }
+            *sublen += adjust;
+            *len -= adjust;
             s = peek;
             break;
         }
+        ++*sublen;
     }
     // NOTREACHED
 }
@@ -212,17 +248,17 @@
         bool full = len == (sizeof(buffer) - 1);
         char *ep = buffer + len;
         *ep = '\0';
-        len = 0;
+        size_t sublen;
         for(char *ptr = NULL, *tok = buffer;
-                ((tok = log_strtok_r(tok, &ptr)));
+                ((tok = log_strntok_r(tok, &len, &ptr, &sublen)));
                 tok = NULL) {
-            if (((tok + strlen(tok)) == ep) && (retval != 0) && full) {
-                len = strlen(tok);
-                memmove(buffer, tok, len);
+            if (((tok + sublen) >= ep) && (retval != 0) && full) {
+                memmove(buffer, tok, sublen);
+                len = sublen;
                 break;
             }
             if (*tok) {
-                log(tok);
+                log(tok, sublen);
             }
         }
     }
@@ -232,9 +268,11 @@
 
 
 void LogKlog::calculateCorrection(const log_time &monotonic,
-                                  const char *real_string) {
+                                  const char *real_string,
+                                  size_t len) {
     log_time real;
-    if (!real.strptime(real_string, "%Y-%m-%d %H:%M:%S.%09q UTC")) {
+    const char *ep = real.strptime(real_string, "%Y-%m-%d %H:%M:%S.%09q UTC");
+    if (!ep || (ep > &real_string[len])) {
         return;
     }
     // kernel report UTC, log_time::strptime is localtime from calendar.
@@ -249,36 +287,85 @@
     correction = real - monotonic;
 }
 
-void LogKlog::sniffTime(log_time &now, const char **buf, bool reverse) {
-    const char *cp;
-    if ((cp = now.strptime(*buf, "[ %s.%q]"))) {
-        static const char suspend[] = "PM: suspend entry ";
-        static const char resume[] = "PM: suspend exit ";
-        static const char healthd[] = "healthd: battery ";
-        static const char suspended[] = "Suspended for ";
+static const char suspendStr[] = "PM: suspend entry ";
+static const char resumeStr[] = "PM: suspend exit ";
+static const char suspendedStr[] = "Suspended for ";
 
-        if (isspace(*cp)) {
+static const char *strnstr(const char *s, size_t len, const char *needle) {
+    char c;
+
+    if (!len) {
+        return NULL;
+    }
+    if ((c = *needle++) != 0) {
+        size_t needleLen = strlen(needle);
+        do {
+            do {
+                if (len <= needleLen) {
+                    return NULL;
+                }
+                --len;
+            } while (*s++ != c);
+        } while (memcmp(s, needle, needleLen) != 0);
+        s--;
+    }
+    return s;
+}
+
+void LogKlog::sniffTime(log_time &now,
+                        const char **buf, size_t len,
+                        bool reverse) {
+    const char *cp = now.strptime(*buf, "[ %s.%q]");
+    if (cp && (cp >= &(*buf)[len])) {
+        cp = NULL;
+    }
+    len -= cp - *buf;
+    if (cp) {
+        static const char healthd[] = "healthd";
+        static const char battery[] = ": battery ";
+
+        if (len && isspace(*cp)) {
             ++cp;
+            --len;
         }
-        if (!strncmp(cp, suspend, sizeof(suspend) - 1)) {
-            calculateCorrection(now, cp + sizeof(suspend) - 1);
-        } else if (!strncmp(cp, resume, sizeof(resume) - 1)) {
-            calculateCorrection(now, cp + sizeof(resume) - 1);
-        } else if (!strncmp(cp, healthd, sizeof(healthd) - 1)) {
+        *buf = cp;
+
+        const char *b;
+        if (((b = strnstr(cp, len, suspendStr)))
+                && ((size_t)((b += sizeof(suspendStr) - 1) - cp) < len)) {
+            len -= b - cp;
+            calculateCorrection(now, b, len);
+        } else if (((b = strnstr(cp, len, resumeStr)))
+                && ((size_t)((b += sizeof(resumeStr) - 1) - cp) < len)) {
+            len -= b - cp;
+            calculateCorrection(now, b, len);
+        } else if (((b = strnstr(cp, len, healthd)))
+                && ((size_t)((b += sizeof(healthd) - 1) - cp) < len)
+                && ((b = strnstr(b, len -= b - cp, battery)))
+                && ((size_t)((b += sizeof(battery) - 1) - cp) < len)) {
+            len -= b - cp;
+            // NB: healthd is roughly 150us late, worth the price to deal with
+            //     ntp-induced or hardware clock drift.
             // look for " 2???-??-?? ??:??:??.????????? ???"
-            const char *tp;
-            for (tp = cp + sizeof(healthd) - 1; *tp && (*tp != '\n'); ++tp) {
-                if ((tp[0] == ' ') && (tp[1] == '2') && (tp[5] == '-')) {
-                    calculateCorrection(now, tp + 1);
+            for (; len && *b && (*b != '\n'); ++b, --len) {
+                if ((b[0] == ' ') && (b[1] == '2') && (b[5] == '-')) {
+                    calculateCorrection(now, b + 1, len - 1);
                     break;
                 }
             }
-        } else if (!strncmp(cp, suspended, sizeof(suspended) - 1)) {
+        } else if (((b = strnstr(cp, len, suspendedStr)))
+                && ((size_t)((b += sizeof(suspendStr) - 1) - cp) < len)) {
+            len -= b - cp;
             log_time real;
             char *endp;
-            real.tv_sec = strtol(cp + sizeof(suspended) - 1, &endp, 10);
-            if (*endp == '.') {
-                real.tv_nsec = strtol(endp + 1, &endp, 10) * 1000000L;
+            real.tv_sec = strtol(b, &endp, 10);
+            if ((*endp == '.') && ((size_t)(endp - b) < len)) {
+                unsigned long multiplier = NS_PER_SEC;
+                real.tv_nsec = 0;
+                len -= endp - b;
+                while (--len && isdigit(*++endp) && (multiplier /= 10)) {
+                    real.tv_nsec += (*endp - '0') * multiplier;
+                }
                 if (reverse) {
                     correction -= real;
                 } else {
@@ -288,14 +375,13 @@
         }
 
         convertMonotonicToReal(now);
-        *buf = cp;
     } else {
         now = log_time(CLOCK_REALTIME);
     }
 }
 
-pid_t LogKlog::sniffPid(const char *cp) {
-    while (*cp) {
+pid_t LogKlog::sniffPid(const char *cp, size_t len) {
+    while (len) {
         // Mediatek kernels with modified printk
         if (*cp == '[') {
             int pid = 0;
@@ -306,48 +392,21 @@
             break; // Only the first one
         }
         ++cp;
+        --len;
     }
     return 0;
 }
 
-// Passed the entire SYSLOG_ACTION_READ_ALL buffer and interpret a
-// compensated start time.
-void LogKlog::synchronize(const char *buf) {
-    const char *cp = strstr(buf, "] PM: suspend e");
-    if (!cp) {
-        return;
-    }
-
-    do {
-        --cp;
-    } while ((cp > buf) && (isdigit(*cp) || isspace(*cp) || (*cp == '.')));
-
-    log_time now;
-    sniffTime(now, &cp, true);
-
-    char *suspended = strstr(buf, "] Suspended for ");
-    if (!suspended || (suspended > cp)) {
-        return;
-    }
-    cp = suspended;
-
-    do {
-        --cp;
-    } while ((cp > buf) && (isdigit(*cp) || isspace(*cp) || (*cp == '.')));
-
-    sniffTime(now, &cp, true);
-}
-
 // kernel log prefix, convert to a kernel log priority number
-static int parseKernelPrio(const char **buf) {
+static int parseKernelPrio(const char **buf, size_t len) {
     int pri = LOG_USER | LOG_INFO;
     const char *cp = *buf;
-    if (*cp == '<') {
+    if (len && (*cp == '<')) {
         pri = 0;
-        while(isdigit(*++cp)) {
+        while(--len && isdigit(*++cp)) {
             pri = (pri * 10) + *cp - '0';
         }
-        if (*cp == '>') {
+        if (len && (*cp == '>')) {
             ++cp;
         } else {
             cp = *buf;
@@ -358,6 +417,50 @@
     return pri;
 }
 
+// Passed the entire SYSLOG_ACTION_READ_ALL buffer and interpret a
+// compensated start time.
+void LogKlog::synchronize(const char *buf, size_t len) {
+    const char *cp = strnstr(buf, len, suspendStr);
+    if (!cp) {
+        cp = strnstr(buf, len, resumeStr);
+        if (!cp) {
+            return;
+        }
+    } else {
+        const char *rp = strnstr(buf, len, resumeStr);
+        if (rp && (rp < cp)) {
+            cp = rp;
+        }
+    }
+
+    do {
+        --cp;
+    } while ((cp > buf) && (*cp != '\n'));
+    if (*cp == '\n') {
+        ++cp;
+    }
+    parseKernelPrio(&cp, len - (cp - buf));
+
+    log_time now;
+    sniffTime(now, &cp, len - (cp - buf), true);
+
+    const char *suspended = strnstr(buf, len, suspendedStr);
+    if (!suspended || (suspended > cp)) {
+        return;
+    }
+    cp = suspended;
+
+    do {
+        --cp;
+    } while ((cp > buf) && (*cp != '\n'));
+    if (*cp == '\n') {
+        ++cp;
+    }
+    parseKernelPrio(&cp, len - (cp - buf));
+
+    sniffTime(now, &cp, len - (cp - buf), true);
+}
+
 // Convert kernel log priority number into an Android Logger priority number
 static int convertKernelPrioToAndroidPrio(int pri) {
     switch(pri & LOG_PRIMASK) {
@@ -388,6 +491,16 @@
     return ANDROID_LOG_INFO;
 }
 
+static const char *strnrchr(const char *s, size_t len, char c) {
+  const char *save = NULL;
+  for (;len; ++s, len--) {
+    if (*s == c) {
+      save = s;
+    }
+  }
+  return save;
+}
+
 //
 // log a message into the kernel log buffer
 //
@@ -421,19 +534,20 @@
 //  logd.klogd:
 // return -1 if message logd.klogd: <signature>
 //
-int LogKlog::log(const char *buf) {
-    if (auditd && strstr(buf, " audit(")) {
+int LogKlog::log(const char *buf, size_t len) {
+    if (auditd && strnstr(buf, len, " audit(")) {
         return 0;
     }
 
-    int pri = parseKernelPrio(&buf);
+    const char *p = buf;
+    int pri = parseKernelPrio(&p, len);
 
     log_time now;
-    sniffTime(now, &buf, false);
+    sniffTime(now, &p, len - (p - buf), false);
 
     // sniff for start marker
     const char klogd_message[] = "logd.klogd: ";
-    const char *start = strstr(buf, klogd_message);
+    const char *start = strnstr(p, len - (p - buf), klogd_message);
     if (start) {
         uint64_t sig = strtoll(start + sizeof(klogd_message) - 1, NULL, 10);
         if (sig == signature.nsec()) {
@@ -452,7 +566,7 @@
     }
 
     // Parse pid, tid and uid
-    const pid_t pid = sniffPid(buf);
+    const pid_t pid = sniffPid(p, len - (p - buf));
     const pid_t tid = pid;
     const uid_t uid = pid ? logbuf->pidToUid(pid) : 0;
 
@@ -460,40 +574,43 @@
     // Some may view the following as an ugly heuristic, the desire is to
     // beautify the kernel logs into an Android Logging format; the goal is
     // admirable but costly.
-    while (isspace(*buf)) {
-        ++buf;
+    while ((isspace(*p) || !*p) && (p < &buf[len])) {
+        ++p;
     }
-    if (!*buf) {
+    if (p >= &buf[len]) { // timestamp, no content
         return 0;
     }
-    start = buf;
+    start = p;
     const char *tag = "";
     const char *etag = tag;
-    if (!isspace(*buf)) {
+    size_t taglen = len - (p - buf);
+    if (!isspace(*p) && *p) {
         const char *bt, *et, *cp;
 
-        bt = buf;
-        if (!strncmp(buf, "[INFO]", 6)) {
+        bt = p;
+        if (!strncmp(p, "[INFO]", 6)) {
             // <PRI>[<TIME>] "[INFO]"<tag> ":" message
-            bt = buf + 6;
+            bt = p + 6;
+            taglen -= 6;
         }
-        for(et = bt; *et && (*et != ':') && !isspace(*et); ++et) {
+        for(et = bt; taglen && *et && (*et != ':') && !isspace(*et); ++et, --taglen) {
            // skip ':' within [ ... ]
            if (*et == '[') {
-               while (*et && *et != ']') {
+               while (taglen && *et && *et != ']') {
                    ++et;
+                   --taglen;
                }
             }
         }
-        for(cp = et; isspace(*cp); ++cp);
+        for(cp = et; taglen && isspace(*cp); ++cp, --taglen);
         size_t size;
 
         if (*cp == ':') {
             // One Word
             tag = bt;
             etag = et;
-            buf = cp + 1;
-        } else {
+            p = cp + 1;
+        } else if (taglen) {
             size = et - bt;
             if (strncmp(bt, cp, size)) {
                 // <PRI>[<TIME>] <tag>_host '<tag>.<num>' : message
@@ -501,67 +618,72 @@
                         && !strncmp(bt, cp, size - 5)) {
                     const char *b = cp;
                     cp += size - 5;
+                    taglen -= size - 5;
                     if (*cp == '.') {
-                        while (!isspace(*++cp) && (*cp != ':'));
+                        while (--taglen && !isspace(*++cp) && (*cp != ':'));
                         const char *e;
-                        for(e = cp; isspace(*cp); ++cp);
+                        for(e = cp; taglen && isspace(*cp); ++cp, --taglen);
                         if (*cp == ':') {
                             tag = b;
                             etag = e;
-                            buf = cp + 1;
+                            p = cp + 1;
                         }
                     }
                 } else {
-                    while (!isspace(*++cp) && (*cp != ':'));
+                    while (--taglen && !isspace(*++cp) && (*cp != ':'));
                     const char *e;
-                    for(e = cp; isspace(*cp); ++cp);
+                    for(e = cp; taglen && isspace(*cp); ++cp, --taglen);
                     // Two words
                     if (*cp == ':') {
                         tag = bt;
                         etag = e;
-                        buf = cp + 1;
+                        p = cp + 1;
                     }
                 }
             } else if (isspace(cp[size])) {
                 cp += size;
-                while (isspace(*++cp));
+                taglen -= size;
+                while (--taglen && isspace(*++cp));
                 // <PRI>[<TIME>] <tag> <tag> : message
                 if (*cp == ':') {
                     tag = bt;
                     etag = et;
-                    buf = cp + 1;
+                    p = cp + 1;
                 }
             } else if (cp[size] == ':') {
                 // <PRI>[<TIME>] <tag> <tag> : message
                 tag = bt;
                 etag = et;
-                buf = cp + size + 1;
+                p = cp + size + 1;
             } else if ((cp[size] == '.') || isdigit(cp[size])) {
                 // <PRI>[<TIME>] <tag> '<tag>.<num>' : message
                 // <PRI>[<TIME>] <tag> '<tag><num>' : message
                 const char *b = cp;
                 cp += size;
-                while (!isspace(*++cp) && (*cp != ':'));
+                taglen -= size;
+                while (--taglen && !isspace(*++cp) && (*cp != ':'));
                 const char *e = cp;
-                while (isspace(*cp)) {
+                while (taglen && isspace(*cp)) {
                     ++cp;
+                    --taglen;
                 }
                 if (*cp == ':') {
                     tag = b;
                     etag = e;
-                    buf = cp + 1;
+                    p = cp + 1;
                 }
             } else {
-                while (!isspace(*++cp) && (*cp != ':'));
+                while (--taglen && !isspace(*++cp) && (*cp != ':'));
                 const char *e = cp;
-                while (isspace(*cp)) {
+                while (taglen && isspace(*cp)) {
                     ++cp;
+                    --taglen;
                 }
                 // Two words
                 if (*cp == ':') {
                     tag = bt;
                     etag = e;
-                    buf = cp + 1;
+                    p = cp + 1;
                 }
             }
         }
@@ -573,61 +695,65 @@
                 || ((size == 3) && (isdigit(tag[1]) && isdigit(tag[2])))
             // blacklist
                 || ((size == 3) && !strncmp(tag, "CPU", 3))
-                || ((size == 7) && !strncmp(tag, "WARNING", 7))
-                || ((size == 5) && !strncmp(tag, "ERROR", 5))
-                || ((size == 4) && !strncmp(tag, "INFO", 4))) {
-            buf = start;
+                || ((size == 7) && !strncasecmp(tag, "WARNING", 7))
+                || ((size == 5) && !strncasecmp(tag, "ERROR", 5))
+                || ((size == 4) && !strncasecmp(tag, "INFO", 4))) {
+            p = start;
             etag = tag = "";
         }
     }
     // Suppress additional stutter in tag:
     //   eg: [143:healthd]healthd -> [143:healthd]
-    size_t taglen = etag - tag;
+    taglen = etag - tag;
     // Mediatek-special printk induced stutter
-    char *np = strrchr(tag, ']');
-    if (np && (++np < etag)) {
-        size_t s = etag - np;
-        if (((s + s) < taglen) && !strncmp(np, np - 1 - s, s)) {
-            taglen = np - tag;
+    const char *mp = strnrchr(tag, ']', taglen);
+    if (mp && (++mp < etag)) {
+        size_t s = etag - mp;
+        if (((s + s) < taglen) && !memcmp(mp, mp - 1 - s, s)) {
+            taglen = mp - tag;
         }
     }
     // skip leading space
-    while (isspace(*buf)) {
-        ++buf;
+    while ((isspace(*p) || !*p) && (p < &buf[len])) {
+        ++p;
     }
-    // truncate trailing space
-    size_t b = strlen(buf);
-    while (b && isspace(buf[b-1])) {
+    // truncate trailing space or nuls
+    size_t b = len - (p - buf);
+    while (b && (isspace(p[b-1]) || !p[b-1])) {
         --b;
     }
     // trick ... allow tag with empty content to be logged. log() drops empty
     if (!b && taglen) {
-        buf = " ";
+        p = " ";
         b = 1;
     }
     size_t n = 1 + taglen + 1 + b + 1;
+    int rc = n;
+    if ((taglen > n) || (b > n)) { // Can not happen ...
+        rc = -EINVAL;
+        return rc;
+    }
 
     // Allocate a buffer to hold the interpreted log message
-    int rc = n;
     char *newstr = reinterpret_cast<char *>(malloc(n));
     if (!newstr) {
         rc = -ENOMEM;
         return rc;
     }
-    np = newstr;
+    char *np = newstr;
 
     // Convert priority into single-byte Android logger priority
     *np = convertKernelPrioToAndroidPrio(pri);
     ++np;
 
     // Copy parsed tag following priority
-    strncpy(np, tag, taglen);
+    memcpy(np, tag, taglen);
     np += taglen;
     *np = '\0';
     ++np;
 
     // Copy main message to the remainder
-    strncpy(np, buf, b);
+    memcpy(np, p, b);
     np[b] = '\0';
 
     // Log message
diff --git a/logd/LogKlog.h b/logd/LogKlog.h
index 7e4fde0..469affd 100644
--- a/logd/LogKlog.h
+++ b/logd/LogKlog.h
@@ -21,7 +21,7 @@
 #include <log/log_read.h>
 #include "LogReader.h"
 
-char *log_strtok_r(char *str, char **saveptr);
+char *log_strntok_r(char *s, size_t *len, char **saveptr, size_t *sublen);
 
 class LogKlog : public SocketListener {
     LogBuffer *logbuf;
@@ -40,15 +40,16 @@
 
 public:
     LogKlog(LogBuffer *buf, LogReader *reader, int fdWrite, int fdRead, bool auditd);
-    int log(const char *buf);
-    void synchronize(const char *buf);
+    int log(const char *buf, size_t len);
+    void synchronize(const char *buf, size_t len);
 
     static void convertMonotonicToReal(log_time &real) { real += correction; }
 
 protected:
-    void sniffTime(log_time &now, const char **buf, bool reverse);
-    pid_t sniffPid(const char *buf);
-    void calculateCorrection(const log_time &monotonic, const char *real_string);
+    void sniffTime(log_time &now, const char **buf, size_t len, bool reverse);
+    pid_t sniffPid(const char *buf, size_t len);
+    void calculateCorrection(const log_time &monotonic,
+                             const char *real_string, size_t len);
     virtual bool onDataAvailable(SocketClient *cli);
 
 };
diff --git a/logd/main.cpp b/logd/main.cpp
index 9b88983..cbdf0b6 100644
--- a/logd/main.cpp
+++ b/logd/main.cpp
@@ -282,36 +282,37 @@
         return;
     }
 
-    int len = klogctl(KLOG_SIZE_BUFFER, NULL, 0);
-    if (len <= 0) {
-        return;
-    }
-
-    len += 1024; // Margin for additional input race or trailing nul
-    std::unique_ptr<char []> buf(new char[len]);
-
-    int rc = klogctl(KLOG_READ_ALL, buf.get(), len);
+    int rc = klogctl(KLOG_SIZE_BUFFER, NULL, 0);
     if (rc <= 0) {
         return;
     }
 
-    if (rc < len) {
+    size_t len = rc + 1024; // Margin for additional input race or trailing nul
+    std::unique_ptr<char []> buf(new char[len]);
+
+    rc = klogctl(KLOG_READ_ALL, buf.get(), len);
+    if (rc <= 0) {
+        return;
+    }
+
+    if ((size_t)rc < len) {
         len = rc + 1;
     }
-    buf[len - 1] = '\0';
+    buf[--len] = '\0';
 
     if (kl) {
-        kl->synchronize(buf.get());
+        kl->synchronize(buf.get(), len);
     }
 
+    size_t sublen;
     for (char *ptr = NULL, *tok = buf.get();
-         (rc >= 0) && ((tok = log_strtok_r(tok, &ptr)));
+         (rc >= 0) && ((tok = log_strntok_r(tok, &len, &ptr, &sublen)));
          tok = NULL) {
         if (al) {
-            rc = al->log(tok);
+            rc = al->log(tok, sublen);
         }
         if (kl) {
-            rc = kl->log(tok);
+            rc = kl->log(tok, sublen);
         }
     }
 }
@@ -422,7 +423,7 @@
 
     LogListener *swl = new LogListener(logBuf, reader);
     // Backlog and /proc/sys/net/unix/max_dgram_qlen set to large value
-    if (swl->startListener(300)) {
+    if (swl->startListener(600)) {
         exit(1);
     }
 
diff --git a/metricsd/Android.mk b/metricsd/Android.mk
index 63bc7b2..03b5739 100644
--- a/metricsd/Android.mk
+++ b/metricsd/Android.mk
@@ -14,10 +14,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-ifeq ($(HOST_OS),linux)
-
-LOCAL_INIT_SERVICE := metrics_daemon
-
 metrics_cpp_extension := .cc
 libmetrics_sources := \
   c_metrics_library.cc \
@@ -30,6 +26,7 @@
   metrics_client.cc
 
 metrics_daemon_sources := \
+  collectors/disk_usage_collector.cc \
   metrics_daemon.cc \
   metrics_daemon_main.cc \
   persistent_integer.cc \
@@ -43,6 +40,7 @@
   serialization/serialization_utils.cc
 
 metrics_tests_sources := \
+  collectors/disk_usage_collector.cc \
   metrics_daemon.cc \
   metrics_daemon_test.cc \
   metrics_library_test.cc \
@@ -122,13 +120,13 @@
 # metrics daemon.
 # ========================================================
 include $(CLEAR_VARS)
-LOCAL_MODULE := $(LOCAL_INIT_SERVICE)
+LOCAL_MODULE := metrics_daemon
 LOCAL_C_INCLUDES := $(metrics_includes) \
   external/libchromeos
 LOCAL_CFLAGS := $(metrics_CFLAGS)
 LOCAL_CPP_EXTENSION := $(metrics_cpp_extension)
 LOCAL_CPPFLAGS := $(metrics_CPPFLAGS)
-LOCAL_REQUIRED_MODULES := init.$(LOCAL_INIT_SERVICE).rc
+LOCAL_INIT_RC := metrics_daemon.rc
 LOCAL_RTTI_FLAG := -frtti
 LOCAL_SHARED_LIBRARIES := $(metrics_shared_libraries) \
   libmetrics \
@@ -144,15 +142,6 @@
 LOCAL_STATIC_LIBRARIES := metrics_daemon_protos
 include $(BUILD_EXECUTABLE)
 
-ifdef INITRC_TEMPLATE
-include $(CLEAR_VARS)
-LOCAL_MODULE := init.$(LOCAL_INIT_SERVICE).rc
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_PATH := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_INITRCD)
-LOCAL_SRC_FILES := init.$(LOCAL_INIT_SERVICE).rc
-include $(BUILD_PREBUILT)
-endif # INITRC_TEMPLATE
-
 # Unit tests for metrics.
 # ========================================================
 include $(CLEAR_VARS)
@@ -173,5 +162,3 @@
 LOCAL_STATIC_LIBRARIES := libBionicGtestMain libgmock metrics_daemon_protos
 
 include $(BUILD_NATIVE_TEST)
-
-endif # HOST_OS == linux
diff --git a/metricsd/collectors/disk_usage_collector.cc b/metricsd/collectors/disk_usage_collector.cc
new file mode 100644
index 0000000..5ab51fb
--- /dev/null
+++ b/metricsd/collectors/disk_usage_collector.cc
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "collectors/disk_usage_collector.h"
+
+#include <base/bind.h>
+#include <base/bind_helpers.h>
+#include <base/message_loop/message_loop.h>
+#include <sys/statvfs.h>
+
+#include "metrics/metrics_library.h"
+
+namespace {
+
+const char kDiskUsageMB[] = "Platform.DataPartitionUsed.MB";
+const char kDiskUsagePercent[] = "Platform.DataPartitionUsed.Percent";
+const char kDataPartitionPath[] = "/data";
+
+// Collect every 15 minutes.
+const int kDiskUsageCollectorIntervalSeconds = 900;
+
+}  // namespace
+
+DiskUsageCollector::DiskUsageCollector(
+    MetricsLibraryInterface* metrics_library) {
+  collect_interval_ = base::TimeDelta::FromSeconds(
+      kDiskUsageCollectorIntervalSeconds);
+  CHECK(metrics_library);
+  metrics_lib_ = metrics_library;
+}
+
+void DiskUsageCollector::Collect() {
+  struct statvfs buf;
+  int result = statvfs(kDataPartitionPath, &buf);
+  if (result != 0) {
+    PLOG(ERROR) << "Failed to check the available space in "
+                << kDataPartitionPath;
+    return;
+  }
+
+  unsigned long total_space = buf.f_blocks * buf.f_bsize;
+  unsigned long used_space = (buf.f_blocks - buf.f_bfree) * buf.f_bsize;
+  int percent_used = (used_space * 100) / total_space;
+
+  metrics_lib_->SendToUMA(kDiskUsageMB,
+                          used_space / (1024 * 1024),
+                          0,
+                          1024, // up to 1 GB.
+                          100);
+  metrics_lib_->SendEnumToUMA(kDiskUsagePercent, percent_used, 101);
+}
+
+void DiskUsageCollector::CollectCallback() {
+  Collect();
+  Schedule();
+}
+
+void DiskUsageCollector::Schedule() {
+  base::MessageLoop::current()->PostDelayedTask(FROM_HERE,
+      base::Bind(&DiskUsageCollector::CollectCallback, base::Unretained(this)),
+      collect_interval_);
+}
diff --git a/metricsd/collectors/disk_usage_collector.h b/metricsd/collectors/disk_usage_collector.h
new file mode 100644
index 0000000..c1d4546
--- /dev/null
+++ b/metricsd/collectors/disk_usage_collector.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef METRICSD_COLLECTORS_DISK_USAGE_COLLECTOR_H_
+#define METRICSD_COLLECTORS_DISK_USAGE_COLLECTOR_H_
+
+#include <base/time/time.h>
+
+#include "metrics/metrics_library.h"
+
+class DiskUsageCollector {
+ public:
+  DiskUsageCollector(MetricsLibraryInterface* metrics_library);
+
+  // Schedule the next collection.
+  void Schedule();
+
+  // Callback used by the main loop.
+  void CollectCallback();
+
+  // Collect the disk usage statistics and report them.
+  void Collect();
+
+ private:
+  base::TimeDelta collect_interval_;
+  MetricsLibraryInterface* metrics_lib_;
+};
+
+#endif  // METRICSD_COLLECTORS_DISK_USAGE_COLLECTOR_H_
diff --git a/metricsd/constants.h b/metricsd/constants.h
index 717e5d2..8a00fc4 100644
--- a/metricsd/constants.h
+++ b/metricsd/constants.h
@@ -28,7 +28,7 @@
 static const char kDefaultVersion[] = "0.0.0.0";
 
 // System properties used.
-static const char kBuildTargetIdProperty[] = "ro.product.build_target_id";
+static const char kProductIdProperty[] = "ro.product.product_id";
 static const char kChannelProperty[] = "ro.product.channel";
 static const char kProductVersionProperty[] = "ro.product.version";
 }  // namespace metrics
diff --git a/metricsd/include/metrics/metrics_library.h b/metricsd/include/metrics/metrics_library.h
index 26df2f4..5556e57 100644
--- a/metricsd/include/metrics/metrics_library.h
+++ b/metricsd/include/metrics/metrics_library.h
@@ -142,10 +142,10 @@
                        bool* result);
 
   // Time at which we last checked if metrics were enabled.
-  static time_t cached_enabled_time_;
+  time_t cached_enabled_time_;
 
   // Cached state of whether or not metrics were enabled.
-  static bool cached_enabled_;
+  bool cached_enabled_;
 
   base::FilePath uma_events_file_;
   base::FilePath consent_file_;
diff --git a/metricsd/metrics_daemon.cc b/metricsd/metrics_daemon.cc
index f399c55..3b81cf8 100644
--- a/metricsd/metrics_daemon.cc
+++ b/metricsd/metrics_daemon.cc
@@ -239,7 +239,7 @@
   ticks_per_second_ = sysconf(_SC_CLK_TCK);
 
   daily_active_use_.reset(
-      new PersistentInteger("Platform.DailyUseTime"));
+      new PersistentInteger("Platform.UseTime.PerDay"));
   version_cumulative_active_use_.reset(
       new PersistentInteger("Platform.CumulativeUseTime"));
   version_cumulative_cpu_use_.reset(
@@ -253,23 +253,23 @@
       new PersistentInteger("Platform.UserCrashInterval"));
 
   any_crashes_daily_count_.reset(
-      new PersistentInteger("Platform.AnyCrashesDaily"));
+      new PersistentInteger("Platform.AnyCrashes.PerDay"));
   any_crashes_weekly_count_.reset(
-      new PersistentInteger("Platform.AnyCrashesWeekly"));
+      new PersistentInteger("Platform.AnyCrashes.PerWeek"));
   user_crashes_daily_count_.reset(
-      new PersistentInteger("Platform.UserCrashesDaily"));
+      new PersistentInteger("Platform.UserCrashes.PerDay"));
   user_crashes_weekly_count_.reset(
-      new PersistentInteger("Platform.UserCrashesWeekly"));
+      new PersistentInteger("Platform.UserCrashes.PerWeek"));
   kernel_crashes_daily_count_.reset(
-      new PersistentInteger("Platform.KernelCrashesDaily"));
+      new PersistentInteger("Platform.KernelCrashes.PerDay"));
   kernel_crashes_weekly_count_.reset(
-      new PersistentInteger("Platform.KernelCrashesWeekly"));
+      new PersistentInteger("Platform.KernelCrashes.PerWeek"));
   kernel_crashes_version_count_.reset(
       new PersistentInteger("Platform.KernelCrashesSinceUpdate"));
   unclean_shutdowns_daily_count_.reset(
-      new PersistentInteger("Platform.UncleanShutdownsDaily"));
+      new PersistentInteger("Platform.UncleanShutdown.PerDay"));
   unclean_shutdowns_weekly_count_.reset(
-      new PersistentInteger("Platform.UncleanShutdownsWeekly"));
+      new PersistentInteger("Platform.UncleanShutdowns.PerWeek"));
 
   daily_cycle_.reset(new PersistentInteger("daily.cycle"));
   weekly_cycle_.reset(new PersistentInteger("weekly.cycle"));
@@ -278,6 +278,7 @@
   diskstats_path_ = diskstats_path;
   scaling_max_freq_path_ = scaling_max_freq_path;
   cpuinfo_max_freq_path_ = cpuinfo_max_freq_path;
+  disk_usage_collector_.reset(new DiskUsageCollector(metrics_lib_));
 
   // If testing, initialize Stats Reporter without connecting DBus
   if (testing_)
@@ -492,6 +493,7 @@
 }
 
 void MetricsDaemon::StatsReporterInit() {
+  disk_usage_collector_->Schedule();
   DiskStatsReadStats(&read_sectors_, &write_sectors_);
   VmStatsReadStats(&vmstats_);
   // The first time around just run the long stat, so we don't delay boot.
diff --git a/metricsd/metrics_daemon.h b/metricsd/metrics_daemon.h
index fbb871e..eaa8219 100644
--- a/metricsd/metrics_daemon.h
+++ b/metricsd/metrics_daemon.h
@@ -29,6 +29,7 @@
 #include <chromeos/daemons/dbus_daemon.h>
 #include <gtest/gtest_prod.h>  // for FRIEND_TEST
 
+#include "collectors/disk_usage_collector.h"
 #include "metrics/metrics_library.h"
 #include "persistent_integer.h"
 #include "uploader/upload_service.h"
@@ -327,6 +328,7 @@
   scoped_ptr<PersistentInteger> kernel_crashes_version_count_;
   scoped_ptr<PersistentInteger> unclean_shutdowns_daily_count_;
   scoped_ptr<PersistentInteger> unclean_shutdowns_weekly_count_;
+  scoped_ptr<DiskUsageCollector> disk_usage_collector_;
 
   std::string diskstats_path_;
   std::string scaling_max_freq_path_;
diff --git a/metricsd/init.metrics_daemon.rc b/metricsd/metrics_daemon.rc
similarity index 100%
rename from metricsd/init.metrics_daemon.rc
rename to metricsd/metrics_daemon.rc
diff --git a/metricsd/metrics_library.cc b/metricsd/metrics_library.cc
index 6449a24..3109704 100644
--- a/metricsd/metrics_library.cc
+++ b/metricsd/metrics_library.cc
@@ -53,9 +53,6 @@
   "TPM.EarlyResetDuringCommand",  // 12
 };
 
-time_t MetricsLibrary::cached_enabled_time_ = 0;
-bool MetricsLibrary::cached_enabled_ = false;
-
 MetricsLibrary::MetricsLibrary() {}
 MetricsLibrary::~MetricsLibrary() {}
 
@@ -140,11 +137,15 @@
   base::FilePath dir = base::FilePath(metrics::kMetricsDirectory);
   uma_events_file_ = dir.Append(metrics::kMetricsEventsFileName);
   consent_file_ = dir.Append(metrics::kConsentFileName);
+  cached_enabled_ = false;
+  cached_enabled_time_ = 0;
 }
 
 void MetricsLibrary::InitForTest(const base::FilePath& metrics_directory) {
   uma_events_file_ = metrics_directory.Append(metrics::kMetricsEventsFileName);
   consent_file_ = metrics_directory.Append(metrics::kConsentFileName);
+  cached_enabled_ = false;
+  cached_enabled_time_ = 0;
 }
 
 bool MetricsLibrary::SendToUMA(const std::string& name,
diff --git a/metricsd/uploader/system_profile_cache.cc b/metricsd/uploader/system_profile_cache.cc
index e3f6339..2437b56 100644
--- a/metricsd/uploader/system_profile_cache.cc
+++ b/metricsd/uploader/system_profile_cache.cc
@@ -73,10 +73,10 @@
   CHECK(!initialized_)
       << "this should be called only once in the metrics_daemon lifetime.";
 
-  profile_.build_target_id = GetProperty(metrics::kBuildTargetIdProperty);
+  profile_.product_id = GetProperty(metrics::kProductIdProperty);
 
-  if (profile_.build_target_id.empty()) {
-    LOG(ERROR) << "System property " << metrics::kBuildTargetIdProperty
+  if (profile_.product_id.empty()) {
+    LOG(ERROR) << "System property " << metrics::kProductIdProperty
                << " is not set.";
     return false;
   }
@@ -136,7 +136,7 @@
   profile_proto->set_channel(profile_.channel);
   metrics::SystemProfileProto_BrilloDeviceData* device_data =
       profile_proto->mutable_brillo();
-  device_data->set_build_target_id(profile_.build_target_id);
+  device_data->set_build_target_id(profile_.product_id);
 
   return true;
 }
diff --git a/metricsd/uploader/system_profile_cache.h b/metricsd/uploader/system_profile_cache.h
index 1d22fa1..3410157 100644
--- a/metricsd/uploader/system_profile_cache.h
+++ b/metricsd/uploader/system_profile_cache.h
@@ -39,7 +39,7 @@
   std::string client_id;
   int session_id;
   metrics::SystemProfileProto::Channel channel;
-  std::string build_target_id;
+  std::string product_id;
 };
 
 // Retrieves general system informations needed by the protobuf for context and
diff --git a/metricsd/uploader/upload_service_test.cc b/metricsd/uploader/upload_service_test.cc
index 09748db..305fd0c 100644
--- a/metricsd/uploader/upload_service_test.cc
+++ b/metricsd/uploader/upload_service_test.cc
@@ -42,6 +42,8 @@
     chromeos_metrics::PersistentInteger::SetMetricsDirectory(
         dir_.path().value());
     metrics_lib_.InitForTest(dir_.path());
+    ASSERT_EQ(0, base::WriteFile(
+        dir_.path().Append(metrics::kConsentFileName), "", 0));
     upload_service_.reset(new UploadService(new MockSystemProfileSetter(),
                                             &metrics_lib_, "", true));
 
@@ -224,7 +226,7 @@
   upload_service_->sender_.reset(sender);
 
   SetTestingProperty(metrics::kChannelProperty, "beta");
-  SetTestingProperty(metrics::kBuildTargetIdProperty, "hello");
+  SetTestingProperty(metrics::kProductIdProperty, "hello");
   SetTestingProperty(metrics::kProductVersionProperty, "1.2.3.4");
 
   scoped_ptr<metrics::MetricSample> histogram =
@@ -267,7 +269,7 @@
 }
 
 TEST_F(UploadServiceTest, SessionIdIncrementedAtInitialization) {
-  SetTestingProperty(metrics::kBuildTargetIdProperty, "hello");
+  SetTestingProperty(metrics::kProductIdProperty, "hello");
   SystemProfileCache cache(true, dir_.path());
   cache.Initialize();
   int session_id = cache.profile_.session_id;
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 5f1169d..dc85d98 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -86,7 +86,7 @@
     write /proc/sys/kernel/kptr_restrict 2
     write /proc/sys/vm/mmap_min_addr 32768
     write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
-    write /proc/sys/net/unix/max_dgram_qlen 300
+    write /proc/sys/net/unix/max_dgram_qlen 600
     write /proc/sys/kernel/sched_rt_runtime_us 950000
     write /proc/sys/kernel/sched_rt_period_us 1000000