diff --git a/adb/Android.mk b/adb/Android.mk
index b0dcfac..543f1eb 100644
--- a/adb/Android.mk
+++ b/adb/Android.mk
@@ -118,9 +118,7 @@
 LOCAL_STATIC_LIBRARIES := libcrypto_static libbase
 
 LOCAL_C_INCLUDES_windows := development/host/windows/usb/api/
-ifneq ($(HOST_OS),windows)
-    LOCAL_MULTILIB := 64
-endif
+LOCAL_MULTILIB := first
 
 include $(BUILD_HOST_STATIC_LIBRARY)
 
@@ -136,7 +134,7 @@
 
 LOCAL_SANITIZE := $(adb_target_sanitize)
 LOCAL_STATIC_LIBRARIES := libadbd
-LOCAL_SHARED_LIBRARIES := liblog libbase libcutils
+LOCAL_SHARED_LIBRARIES := libbase libcutils
 include $(BUILD_NATIVE_TEST)
 
 # adb_test
@@ -156,7 +154,7 @@
 LOCAL_SRC_FILES_linux := $(LIBADB_TEST_linux_SRCS)
 LOCAL_SRC_FILES_darwin := $(LIBADB_TEST_darwin_SRCS)
 LOCAL_SANITIZE := $(adb_host_sanitize)
-LOCAL_SHARED_LIBRARIES := liblog libbase
+LOCAL_SHARED_LIBRARIES := libbase
 LOCAL_STATIC_LIBRARIES := \
     libadb \
     libcrypto_static \
@@ -180,7 +178,7 @@
 LOCAL_CFLAGS_linux := $(LIBADB_linux_CFLAGS)
 LOCAL_SRC_FILES := test_track_devices.cpp
 LOCAL_SANITIZE := $(adb_host_sanitize)
-LOCAL_SHARED_LIBRARIES := liblog libbase
+LOCAL_SHARED_LIBRARIES := libbase
 LOCAL_STATIC_LIBRARIES := libadb libcrypto_static libcutils
 LOCAL_LDLIBS += -lrt -ldl -lpthread
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/adb/adb.cpp b/adb/adb.cpp
index a6b539f..0bd95a3 100644
--- a/adb/adb.cpp
+++ b/adb/adb.cpp
@@ -1133,9 +1133,27 @@
     }
 
     if (!strcmp(service, "features")) {
-        SendOkay(reply_fd);
-        SendProtocolString(
-            reply_fd, android::base::Join(supported_features(), '\n'));
+        std::string error_msg;
+        atransport* t = acquire_one_transport(kCsAny, type, serial, &error_msg);
+        if (t != nullptr) {
+            SendOkay(reply_fd, android::base::Join(t->features(), '\n'));
+        } else {
+            SendFail(reply_fd, error_msg);
+        }
+        return 0;
+    }
+
+    if (!strncmp(service, "check-feature:", strlen("check-feature:"))) {
+        std::string error_msg;
+        atransport* t = acquire_one_transport(kCsAny, type, serial, &error_msg);
+        if (t && t->CanUseFeature(service + strlen("check-feature:"))) {
+            // We could potentially extend this to reply with the feature
+            // version if that becomes necessary.
+            SendOkay(reply_fd, "1");
+        } else {
+            // Empty response means unsupported feature.
+            SendOkay(reply_fd, "");
+        }
         return 0;
     }
 
diff --git a/adb/commandline.cpp b/adb/commandline.cpp
index 86f9263..8d50f46 100644
--- a/adb/commandline.cpp
+++ b/adb/commandline.cpp
@@ -931,6 +931,18 @@
     return 0;
 }
 
+// Disallow stdin, stdout, and stderr.
+static bool _is_valid_ack_reply_fd(const int ack_reply_fd) {
+#ifdef _WIN32
+    const HANDLE ack_reply_handle = cast_int_to_handle(ack_reply_fd);
+    return (GetStdHandle(STD_INPUT_HANDLE) != ack_reply_handle) &&
+           (GetStdHandle(STD_OUTPUT_HANDLE) != ack_reply_handle) &&
+           (GetStdHandle(STD_ERROR_HANDLE) != ack_reply_handle);
+#else
+    return ack_reply_fd > 2;
+#endif
+}
+
 int adb_commandline(int argc, const char **argv) {
     int no_daemon = 0;
     int is_daemon = 0;
@@ -980,14 +992,7 @@
             argc--;
             argv++;
             ack_reply_fd = strtol(reply_fd_str, nullptr, 10);
-#ifdef _WIN32
-            const HANDLE ack_reply_handle = cast_int_to_handle(ack_reply_fd);
-            if ((GetStdHandle(STD_INPUT_HANDLE) == ack_reply_handle) ||
-                (GetStdHandle(STD_OUTPUT_HANDLE) == ack_reply_handle) ||
-                (GetStdHandle(STD_ERROR_HANDLE) == ack_reply_handle)) {
-#else
-            if (ack_reply_fd <= 2) { // Disallow stdin, stdout, and stderr.
-#endif
+            if (!_is_valid_ack_reply_fd(ack_reply_fd)) {
                 fprintf(stderr, "adb: invalid reply fd \"%s\"\n", reply_fd_str);
                 return usage();
             }
@@ -1444,7 +1449,7 @@
         return 0;
     }
     else if (!strcmp(argv[0], "features")) {
-        return adb_query_command("host:features");
+        return adb_query_command(format_host_command("features", transport_type, serial));
     }
 
     usage();
diff --git a/adb/shell_service_protocol_test.cpp b/adb/shell_service_protocol_test.cpp
index 6c75215..85b2f91 100644
--- a/adb/shell_service_protocol_test.cpp
+++ b/adb/shell_service_protocol_test.cpp
@@ -72,13 +72,13 @@
         read_protocol_->buffer_end_ = read_protocol_->data() + size;
     }
 
-    static sighandler_t saved_sigpipe_handler_;
+    static sig_t saved_sigpipe_handler_;
 
     int read_fd_ = -1, write_fd_ = -1;
     ShellProtocol *read_protocol_ = nullptr, *write_protocol_ = nullptr;
 };
 
-sighandler_t ShellProtocolTest::saved_sigpipe_handler_ = nullptr;
+sig_t ShellProtocolTest::saved_sigpipe_handler_ = nullptr;
 
 namespace {
 
diff --git a/base/Android.mk b/base/Android.mk
index 51dd736..a09a747 100644
--- a/base/Android.mk
+++ b/base/Android.mk
@@ -26,6 +26,7 @@
 libbase_test_src_files := \
     file_test.cpp \
     logging_test.cpp \
+    parseint_test.cpp \
     stringprintf_test.cpp \
     strings_test.cpp \
     test_main.cpp \
diff --git a/base/include/base/parseint.h b/base/include/base/parseint.h
new file mode 100644
index 0000000..9ecbfbc
--- /dev/null
+++ b/base/include/base/parseint.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BASE_PARSEINT_H
+#define BASE_PARSEINT_H
+
+#include <errno.h>
+#include <stdlib.h>
+
+#include <limits>
+
+namespace android {
+namespace base {
+
+// Parses the unsigned decimal integer in the string 's' and sets 'out' to
+// that value. Optionally allows the caller to define a 'max' beyond which
+// otherwise valid values will be rejected. Returns boolean success.
+template <typename T>
+bool ParseUint(const char* s, T* out,
+               T max = std::numeric_limits<T>::max()) {
+  errno = 0;
+  char* end;
+  unsigned long long int result = strtoull(s, &end, 10);
+  if (errno != 0 || s == end || *end != '\0') {
+    return false;
+  }
+  if (max < result) {
+    return false;
+  }
+  *out = static_cast<T>(result);
+  return true;
+}
+
+// Parses the signed decimal integer in the string 's' and sets 'out' to
+// that value. Optionally allows the caller to define a 'min' and 'max
+// beyond which otherwise valid values will be rejected. Returns boolean
+// success.
+template <typename T>
+bool ParseInt(const char* s, T* out,
+              T min = std::numeric_limits<T>::min(),
+              T max = std::numeric_limits<T>::max()) {
+  errno = 0;
+  char* end;
+  long long int result = strtoll(s, &end, 10);
+  if (errno != 0 || s == end || *end != '\0') {
+    return false;
+  }
+  if (result < min || max < result) {
+    return false;
+  }
+  *out = static_cast<T>(result);
+  return true;
+}
+
+}  // namespace base
+}  // namespace android
+
+#endif  // BASE_PARSEINT_H
diff --git a/base/parseint_test.cpp b/base/parseint_test.cpp
new file mode 100644
index 0000000..6a109f4
--- /dev/null
+++ b/base/parseint_test.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "base/parseint.h"
+
+#include <gtest/gtest.h>
+
+TEST(parseint, signed_smoke) {
+  int i;
+  ASSERT_EQ(false, android::base::ParseInt("x", &i));
+  ASSERT_EQ(false, android::base::ParseInt("123x", &i));
+
+  ASSERT_EQ(true, android::base::ParseInt("123", &i));
+  ASSERT_EQ(123, i);
+  ASSERT_EQ(true, android::base::ParseInt("-123", &i));
+  ASSERT_EQ(-123, i);
+
+  short s;
+  ASSERT_EQ(true, android::base::ParseInt("1234", &s));
+  ASSERT_EQ(1234, s);
+
+  ASSERT_EQ(true, android::base::ParseInt("12", &i, 0, 15));
+  ASSERT_EQ(12, i);
+  ASSERT_EQ(false, android::base::ParseInt("-12", &i, 0, 15));
+  ASSERT_EQ(false, android::base::ParseInt("16", &i, 0, 15));
+}
+
+TEST(parseint, unsigned_smoke) {
+  unsigned int i;
+  ASSERT_EQ(false, android::base::ParseUint("x", &i));
+  ASSERT_EQ(false, android::base::ParseUint("123x", &i));
+
+  ASSERT_EQ(true, android::base::ParseUint("123", &i));
+  ASSERT_EQ(123u, i);
+  ASSERT_EQ(false, android::base::ParseUint("-123", &i));
+
+  unsigned short s;
+  ASSERT_EQ(true, android::base::ParseUint("1234", &s));
+  ASSERT_EQ(1234u, s);
+
+  ASSERT_EQ(true, android::base::ParseUint("12", &i, 15u));
+  ASSERT_EQ(12u, i);
+  ASSERT_EQ(false, android::base::ParseUint("-12", &i, 15u));
+  ASSERT_EQ(false, android::base::ParseUint("16", &i, 15u));
+}
+
+TEST(parseint, no_implicit_octal) {
+  int i;
+  ASSERT_EQ(true, android::base::ParseInt("0123", &i));
+  ASSERT_EQ(123, i);
+
+  unsigned int u;
+  ASSERT_EQ(true, android::base::ParseUint("0123", &u));
+  ASSERT_EQ(123u, u);
+}
diff --git a/crash_reporter/Android.mk b/crash_reporter/Android.mk
index 6b98af4..467432a 100644
--- a/crash_reporter/Android.mk
+++ b/crash_reporter/Android.mk
@@ -81,6 +81,7 @@
 LOCAL_MODULE := crash_sender
 LOCAL_MODULE_CLASS := EXECUTABLES
 LOCAL_MODULE_PATH := $(TARGET_OUT_EXECUTABLES)
+LOCAL_REQUIRED_MODULES := curl periodic_scheduler
 LOCAL_SRC_FILES := crash_sender
 include $(BUILD_PREBUILT)
 
@@ -113,6 +114,15 @@
 LOCAL_SRC_FILES := crash_reporter_logs.conf
 include $(BUILD_PREBUILT)
 
+# Periodic Scheduler.
+# ========================================================
+include $(CLEAR_VARS)
+LOCAL_MODULE := periodic_scheduler
+LOCAL_MODULE_CLASS := EXECUTABLES
+LOCAL_MODULE_PATH := $(TARGET_OUT_EXECUTABLES)
+LOCAL_SRC_FILES := periodic_scheduler
+include $(BUILD_PREBUILT)
+
 # Crash reporter tests.
 # ========================================================
 include $(CLEAR_VARS)
diff --git a/crash_reporter/crash_collector.cc b/crash_reporter/crash_collector.cc
index 77755f4..b81a936 100644
--- a/crash_reporter/crash_collector.cc
+++ b/crash_reporter/crash_collector.cc
@@ -42,12 +42,13 @@
 
 const char kCollectChromeFile[] =
     "/mnt/stateful_partition/etc/collect_chrome_crashes";
-const char kCrashTestInProgressPath[] = "/tmp/crash-test-in-progress";
+const char kCrashTestInProgressPath[] =
+    "/data/misc/crash_reporter/tmp/crash-test-in-progress";
 const char kDefaultLogConfig[] = "/etc/crash_reporter_logs.conf";
 const char kDefaultUserName[] = "chronos";
-const char kLeaveCoreFile[] = "/root/.leave_core";
+const char kLeaveCoreFile[] = "/data/misc/crash_reporter/.leave_core";
 const char kLsbRelease[] = "/etc/lsb-release";
-const char kShellPath[] = "/bin/sh";
+const char kShellPath[] = "/system/bin/sh";
 const char kSystemCrashPath[] = "/data/misc/crash_reporter/crash";
 const char kUploadVarPrefix[] = "upload_var_";
 const char kUploadFilePrefix[] = "upload_file_";
diff --git a/crash_reporter/crash_sender b/crash_reporter/crash_sender
index fa2f8fc..7f9062a 100755
--- a/crash_reporter/crash_sender
+++ b/crash_reporter/crash_sender
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/system/bin/sh
 
 # Copyright (C) 2010 The Android Open Source Project
 #
@@ -17,20 +17,20 @@
 set -e
 
 # Default product ID in crash report (used if GOOGLE_CRASH_* is undefined).
-CHROMEOS_PRODUCT=ChromeOS
+BRILLO_PRODUCT=Brillo
+
+# Base directory that contains any crash reporter state files.
+CRASH_STATE_DIR="/data/misc/crash_reporter"
 
 # File whose existence implies crash reports may be sent, and whose
 # contents includes our machine's anonymized guid.
-CONSENT_ID="/home/chronos/Consent To Send Stats"
+CONSENT_ID="/data/misc/metrics/enabled"
 
 # Crash sender lock in case the sender is already running.
-CRASH_SENDER_LOCK="/var/lock/crash_sender"
+CRASH_SENDER_LOCK="${CRASH_STATE_DIR}/lock/crash_sender"
 
 # Path to file that indicates a crash test is currently running.
-CRASH_TEST_IN_PROGRESS_FILE="/tmp/crash-test-in-progress"
-
-# Path to find which is required for computing the crash rate.
-FIND="/usr/bin/find"
+CRASH_TEST_IN_PROGRESS_FILE="${CRASH_STATE_DIR}/tmp/crash-test-in-progress"
 
 # Set this to 1 in the environment to allow uploading crash reports
 # for unofficial versions.
@@ -40,20 +40,17 @@
 HWCLASS_PATH="/sys/devices/platform/chromeos_acpi/HWID"
 
 # Path to file that indicates this is a developer image.
-LEAVE_CORE_FILE="/root/.leave_core"
+LEAVE_CORE_FILE="${CRASH_STATE_DIR}/.leave_core"
 
 # Path to list_proxies.
-LIST_PROXIES="/usr/bin/list_proxies"
+LIST_PROXIES="list_proxies"
 
 # Maximum crashes to send per day.
 MAX_CRASH_RATE=${MAX_CRASH_RATE:-32}
 
-# Path to metrics_client.
-METRICS_CLIENT="/usr/bin/metrics_client"
-
 # File whose existence mocks crash sending.  If empty we pretend the
 # crash sending was successful, otherwise unsuccessful.
-MOCK_CRASH_SENDING="/tmp/mock-crash-sending"
+MOCK_CRASH_SENDING="${CRASH_STATE_DIR}/tmp/mock-crash-sending"
 
 # Set this to 1 in the environment to pretend to have booted in developer
 # mode.  This is used by autotests.
@@ -64,40 +61,39 @@
 
 # File whose existence causes crash sending to be delayed (for testing).
 # Must be stateful to enable testing kernel crashes.
-PAUSE_CRASH_SENDING="/var/lib/crash_sender_paused"
+PAUSE_CRASH_SENDING="${CRASH_STATE_DIR}/lock/crash_sender_paused"
 
 # URL to send official build crash reports to.
 REPORT_UPLOAD_PROD_URL="https://clients2.google.com/cr/report"
 
 # Path to a directory of restricted certificates which includes
 # a certificate for ${REPORT_UPLOAD_PROD_URL}.
-RESTRICTED_CERTIFICATES_PATH="/usr/share/chromeos-ca-certificates"
+RESTRICTED_CERTIFICATES_PATH="/system/etc/security/cacerts"
 
 # File whose existence implies we're running and not to start again.
-RUN_FILE="/var/run/crash_sender.pid"
+RUN_FILE="${CRASH_STATE_DIR}/run/crash_sender.pid"
 
 # Maximum time to sleep between sends.
 SECONDS_SEND_SPREAD=${SECONDS_SEND_SPREAD:-600}
 
 # Set this to 1 to allow uploading of device coredumps.
-DEVCOREDUMP_UPLOAD_FLAG_FILE=\
-"/var/lib/crash_reporter/device_coredump_upload_allowed"
+DEVCOREDUMP_UPLOAD_FLAG_FILE="${CRASH_STATE_DIR}/device_coredump_upload_allowed"
 
 # The syslog tag for all logging we emit.
 TAG="$(basename $0)[$$]"
 
 # Directory to store timestamp files indicating the uploads in the past 24
 # hours.
-TIMESTAMPS_DIR="/var/lib/crash_sender"
+TIMESTAMPS_DIR="${CRASH_STATE_DIR}/crash_sender"
 
 # Temp directory for this process.
 TMP_DIR=""
 
-# Chrome's crash report log file.
-CHROME_CRASH_LOG="/var/log/chrome/Crash Reports/uploads.log"
+# Crash report log file.
+CRASH_LOG="${CRASH_STATE_DIR}/log/uploads.log"
 
 lecho() {
-  logger -t "${TAG}" "$@"
+  log -t "${TAG}" "$@"
 }
 
 # Returns true if mock is enabled.
@@ -117,6 +113,9 @@
     rm -rf "${TMP_DIR}"
   fi
   rm -f "${RUN_FILE}"
+  if [ -n "${CRASH_SENDER_LOCK}" ]; then
+    rm -rf "${CRASH_SENDER_LOCK}"
+  fi
   crash_done
 }
 
@@ -130,7 +129,7 @@
 
 is_official_image() {
   [ ${FORCE_OFFICIAL} -ne 0 ] && return 0
-  grep ^CHROMEOS_RELEASE_DESCRIPTION /etc/lsb-release | grep -q Official
+  getprop ro.product.description | grep -q Official
 }
 
 # Returns 0 if the a crash test is currently running.  NOTE: Mirrors
@@ -167,7 +166,11 @@
   # If we're testing crash reporter itself, we don't want to special-case
   # for developer mode.
   is_crash_test_in_progress && return 1
-  crossystem "devsw_boot?1"  # exit status will be accurate
+  if [ "$(getprop ro.build.type)" = "eng" ]; then
+    return 0
+  else
+    return 1
+  fi
 }
 
 # Return 0 if the uploading of device coredumps is allowed.
@@ -188,7 +191,7 @@
 check_rate() {
   mkdir -p ${TIMESTAMPS_DIR}
   # Only consider minidumps written in the past 24 hours by removing all older.
-  ${FIND} "${TIMESTAMPS_DIR}" -mindepth 1 -mmin +$((24 * 60)) \
+  find "${TIMESTAMPS_DIR}" -mindepth 1 -mtime +1 \
       -exec rm -- '{}' ';'
   local sends_in_24hrs=$(echo "${TIMESTAMPS_DIR}"/* | wc -w)
   lecho "Current send rate: ${sends_in_24hrs}sends/24hrs"
@@ -198,7 +201,7 @@
           "max ${MAX_CRASH_RATE}send/24hrs"
     return 1
   fi
-  mktemp "${TIMESTAMPS_DIR}"/XXXX > /dev/null
+  mktemp "${TIMESTAMPS_DIR}"/XXXXXX > /dev/null
   return 0
 }
 
@@ -252,27 +255,18 @@
 get_keys() {
   local file="$1" regex="$2"
 
-  awk -F'[[:space:]=]' -vregex="${regex}" \
-      'match($1, regex) { print $1 }' "${file}"
-}
-
-# Return the board name.
-get_board() {
-  get_key_value "/etc/lsb-release" "CHROMEOS_RELEASE_BOARD"
+  cut -d '=' -f1 "${file}" | grep --color=never "${regex}"
 }
 
 # Return the channel name (sans "-channel" suffix).
 get_channel() {
-  get_key_value "/etc/lsb-release" "CHROMEOS_RELEASE_TRACK" |
-    sed 's:-channel$::'
+  getprop ro.product.channel | sed 's:-channel$::'
 }
 
 # Return the hardware class or "undefined".
 get_hardware_class() {
   if [ -r "${HWCLASS_PATH}" ]; then
     cat "${HWCLASS_PATH}"
-  elif crossystem hwid > /dev/null 2>&1; then
-    echo "$(crossystem hwid)"
   else
     echo "undefined"
   fi
@@ -284,13 +278,12 @@
   local kind="$(get_kind "${meta_path}")"
   local exec_name="$(get_key_value "${meta_path}" "exec_name")"
   local url="${REPORT_UPLOAD_PROD_URL}"
-  local chromeos_version="$(get_key_value "${meta_path}" "ver")"
-  local board="$(get_board)"
+  local brillo_version="$(get_key_value "${meta_path}" "ver")"
   local hwclass="$(get_hardware_class)"
   local write_payload_size="$(get_key_value "${meta_path}" "payload_size")"
   local log="$(get_key_value "${meta_path}" "log")"
   local sig="$(get_key_value "${meta_path}" "sig")"
-  local send_payload_size="$(stat --printf=%s "${report_payload}" 2>/dev/null)"
+  local send_payload_size="$(stat -c "%s" "${report_payload}" 2>/dev/null)"
   local product="$(get_key_value "${meta_path}" "upload_var_prod")"
   local version="$(get_key_value "${meta_path}" "upload_var_ver")"
   local upload_prefix="$(get_key_value "${meta_path}" "upload_prefix")"
@@ -358,10 +351,10 @@
   # If ID or VERSION_ID is undefined, we use the default product name
   # and CHROMEOS_RELEASE_VERSION from /etc/lsb-release.
   if [ "${product}" = "undefined" ]; then
-    product="${CHROMEOS_PRODUCT}"
+    product="${BRILLO_PRODUCT}"
   fi
   if [ "${version}" = "undefined" ]; then
-    version="${chromeos_version}"
+    version="${brillo_version}"
   fi
 
   local image_type
@@ -376,11 +369,7 @@
   fi
 
   local boot_mode
-  if ! crossystem "cros_debug" > /dev/null 2>&1; then
-    # Sanity-check failed that makes sure crossystem exists.
-    lecho "Cannot determine boot mode due to error running crossystem command"
-    boot_mode="missing-crossystem"
-  elif is_developer_mode; then
+  if is_developer_mode; then
     boot_mode="dev"
   fi
 
@@ -392,7 +381,7 @@
   [ "${error_type}" = "undefined" ] && error_type=
 
   lecho "Sending crash:"
-  if [ "${product}" != "${CHROMEOS_PRODUCT}" ]; then
+  if [ "${product}" != "${BRILLO_PRODUCT}" ]; then
     lecho "  Sending crash report on behalf of ${product}"
   fi
   lecho "  Metadata: ${meta_path} (${kind})"
@@ -403,7 +392,6 @@
   if is_mock; then
     lecho "  Product: ${product}"
     lecho "  URL: ${url}"
-    lecho "  Board: ${board}"
     lecho "  HWClass: ${hwclass}"
     lecho "  write_payload_size: ${write_payload_size}"
     lecho "  send_payload_size: ${send_payload_size}"
@@ -451,7 +439,6 @@
     --capath "${RESTRICTED_CERTIFICATES_PATH}" --ciphers HIGH \
     -F "prod=${product}" \
     -F "ver=${version}" \
-    -F "board=${board}" \
     -F "hwclass=${hwclass}" \
     -F "exec_name=${exec_name}" \
     ${image_type:+-F "image_type=${image_type}"} \
@@ -477,15 +464,11 @@
       fi
       ;;
     *)
-      if is_official_image; then
-        product_name="ChromeOS"
-      else
-        product_name="ChromiumOS"
-      fi
+      product_name="Brillo"
       ;;
     esac
     printf '%s,%s,%s\n' \
-      "${timestamp}" "${id}" "${product_name}" >> "${CHROME_CRASH_LOG}"
+      "${timestamp}" "${id}" "${product_name}" >> "${CRASH_LOG}"
     lecho "Crash report receipt ID ${id}"
   else
     lecho "Crash sending failed with exit code ${curl_result}: " \
@@ -512,6 +495,7 @@
 # 3G connection (see crosbug.com/3304 for discussion).
 send_crashes() {
   local dir="$1"
+  lecho "Sending crashes for ${dir}"
 
   if [ ! -d "${dir}" ]; then
     return
@@ -519,8 +503,8 @@
 
   # Consider any old files which still have no corresponding meta file
   # as orphaned, and remove them.
-  for old_file in $(${FIND} "${dir}" -mindepth 1 \
-                    -mmin +$((24 * 60)) -type f); do
+  for old_file in $(find "${dir}" -mindepth 1 \
+                    -mtime +1 -type f); do
     if [ ! -e "$(get_base "${old_file}").meta" ]; then
       lecho "Removing old orphaned file: ${old_file}."
       rm -f -- "${old_file}"
@@ -548,8 +532,8 @@
 
     if ! is_complete_metadata "${meta_path}"; then
       # This report is incomplete, so if it's old, just remove it.
-      local old_meta=$(${FIND} "${dir}" -mindepth 1 -name \
-        $(basename "${meta_path}") -mmin +$((24 * 60)) -type f)
+      local old_meta=$(find "${dir}" -mindepth 1 -name \
+        $(basename "${meta_path}") -mtime +1 -type f)
       if [ -n "${old_meta}" ]; then
         lecho "Removing old incomplete metadata."
         remove_report "${meta_path}"
@@ -571,19 +555,10 @@
       continue
     fi
 
-    # Don't send crash reports from previous sessions while we're in guest mode
-    # to avoid the impression that crash reporting was enabled, which it isn't.
-    # (Don't exit right now because subsequent reports may be candidates for
-    # deletion.)
-    if ${METRICS_CLIENT} -g; then
-      lecho "Guest mode has been entered.  Delaying crash sending until exited."
-      continue
-    fi
-
     # Remove existing crashes in case user consent has not (yet) been given or
     # has been revoked.  This must come after the guest mode check because
-    # ${METRICS_CLIENT} always returns "not consented" in guest mode.
-    if ! ${METRICS_CLIENT} -c; then
+    # metrics_client always returns "not consented" in guest mode.
+    if ! metrics_client -c; then
       lecho "Crash reporting is disabled.  Removing crash."
       remove_report "${meta_path}"
       continue
@@ -602,7 +577,7 @@
     # reports is spread out randomly by up to SECONDS_SEND_SPREAD.  Thus, for
     # the sleep call the greater of the two delays is used.
     local now=$(date +%s)
-    local holdoff_time=$(($(stat --format=%Y "${meta_path}") + 30 - ${now}))
+    local holdoff_time=$(($(stat -c "%Y" "${meta_path}") + 30 - ${now}))
     local spread_time=$(generate_uniform_random "${SECONDS_SEND_SPREAD}")
     local sleep_time
     if [ ${spread_time} -gt ${holdoff_time} ]; then
@@ -673,8 +648,6 @@
 }
 
 main() {
-  trap cleanup EXIT INT TERM
-
   parseargs "$@"
 
   if [ -e "${PAUSE_CRASH_SENDING}" ] && \
@@ -693,31 +666,25 @@
   # (like with autotests) that we're still running.
   echo $$ > "${RUN_FILE}"
 
-  for dependency in "${FIND}" "${METRICS_CLIENT}" \
-                    "${RESTRICTED_CERTIFICATES_PATH}"; do
+  for dependency in "${RESTRICTED_CERTIFICATES_PATH}"; do
     if [ ! -x "${dependency}" ]; then
       lecho "Fatal: Crash sending disabled: ${dependency} not found."
       exit 1
     fi
   done
 
-  TMP_DIR="$(mktemp -d /tmp/crash_sender.XXXXXX)"
+  TMP_DIR="$(mktemp -d "${CRASH_STATE_DIR}/tmp/crash_sender.XXXXXX")"
 
   # Send system-wide crashes
-  send_crashes "/var/spool/crash"
-
-  # Send user-specific crashes
-  local d
-  for d in /home/chronos/crash /home/chronos/u-*/crash; do
-    send_crashes "${d}"
-  done
+  send_crashes "${CRASH_STATE_DIR}/crash"
 }
 
-(
-if ! flock -n 9; then
+trap cleanup EXIT INT TERM
+
+#TODO(http://b/23937249): Change the locking logic back to using flock.
+if ! mkdir "${CRASH_SENDER_LOCK}" 2>/dev/null; then
   lecho "Already running; quitting."
   crash_done
   exit 1
 fi
 main "$@"
-) 9>"${CRASH_SENDER_LOCK}"
diff --git a/crash_reporter/init.crash_reporter.rc b/crash_reporter/init.crash_reporter.rc
index 6882b77..db9bb6f 100644
--- a/crash_reporter/init.crash_reporter.rc
+++ b/crash_reporter/init.crash_reporter.rc
@@ -10,9 +10,20 @@
     # number to prevent infinitely recursing on crash handling.
     write /proc/sys/kernel/core_pipe_limit 4
 
+    # Remove any previous orphaned locks.
+    rmdir /data/misc/crash_reporter/lock/crash_sender
+
     # Create crash directories.
     mkdir /data/misc/crash_reporter 0700 root root
+    mkdir /data/misc/crash_reporter/lock 0700 root root
+    mkdir /data/misc/crash_reporter/log 0700 root root
+    mkdir /data/misc/crash_reporter/run 0700 root root
+    mkdir /data/misc/crash_reporter/tmp 0700 root root
 
 service crash_reporter /system/bin/crash_reporter --init
     class late_start
     oneshot
+
+service crash_sender /system/bin/periodic_scheduler 3600 14400 crash_sender \
+    /system/bin/crash_sender
+    class late_start
diff --git a/crash_reporter/periodic_scheduler b/crash_reporter/periodic_scheduler
new file mode 100755
index 0000000..7fdb5c9
--- /dev/null
+++ b/crash_reporter/periodic_scheduler
@@ -0,0 +1,81 @@
+#!/system/bin/sh
+
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Run tasks periodically.
+# Usage: $0 <delay_seconds> <timeout_seconds> <task_name> <task_binary>
+#
+# Executes task <task_name> by running <task_binary> every <delay_seconds>.
+
+set -e -u
+
+SCRIPT_NAME="$(basename "$0")"
+#CHECK_DELAY=300  # Check every 5 minutes.
+CHECK_DELAY=15  # Check every 5 minutes.
+KILL_DELAY=10    # How long to let the job clean up after a timeout.
+# Let the unittests override.
+: ${SPOOL_DIR:=/data/misc/crash_reporter/spool/cron-lite}
+
+loginfo() {
+  log -p i -t "${SCRIPT_NAME}" "$@"
+}
+
+trap "loginfo 'exiting'" EXIT
+
+check_and_fix_spool_paths() {
+  # Avoid weird spool paths if possible.
+  rm -f "$(dirname "${SPOOL_DIR}")" "${SPOOL_DIR}" 2>/dev/null || :
+  mkdir -p "${SPOOL_DIR}"
+  if [ ! -O "${SPOOL_DIR}" -o ! -d "${SPOOL_DIR}" ]; then
+    loginfo "Spool directory is damaged. Aborting!"
+    exit 1
+  fi
+}
+
+main() {
+  local delay="$1"
+  local timeout="$2"
+  local name="$3"
+  local spool_file="${SPOOL_DIR}/${name}"
+  shift 3
+
+  [ -z "${delay}" ] && exit 1
+  [ -z "${timeout}" ] && exit 1
+  [ -z "${name}" ] && exit 1
+  [ $# -eq 0 ] && exit 1
+  check_and_fix_spool_paths
+
+  while true; do
+    # Allow the sleep to be killed manually without terminating the handler.
+    # Send stderr to /dev/null to suppress the shell's "Terminated" message.
+    sleep $(( CHECK_DELAY + KILL_DELAY )) 2>/dev/null || true
+
+    [ ! -e "${spool_file}" ] && touch "${spool_file}"
+
+    local last_rotation="$(stat -c "%Y" "${spool_file}" 2>/dev/null || echo 0)"
+    local now="$(date +%s)"
+    local time_diff=$((now - last_rotation))
+
+    if [ ${time_diff} -gt ${delay} ]; then
+      rm "${spool_file}" || true
+      touch "${spool_file}"
+      loginfo "${name}: running $*"
+      timeout -k ${KILL_DELAY} ${timeout} "$@" || true
+      loginfo "${name}: job completed"
+    fi
+  done
+}
+
+main "$@"
diff --git a/fs_mgr/Android.mk b/fs_mgr/Android.mk
index 08d0671..cf2965e 100644
--- a/fs_mgr/Android.mk
+++ b/fs_mgr/Android.mk
@@ -3,13 +3,14 @@
 LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)
 
-LOCAL_SRC_FILES:= fs_mgr.c fs_mgr_verity.c fs_mgr_fstab.c
+LOCAL_SRC_FILES:= fs_mgr.c fs_mgr_verity.c fs_mgr_fstab.c fs_mgr_slotselect.c
 
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
 
 LOCAL_MODULE:= libfs_mgr
 LOCAL_STATIC_LIBRARIES := liblogwrap libmincrypt libext4_utils_static libsquashfs_utils
-LOCAL_C_INCLUDES += system/extras/ext4_utils system/extras/squashfs_utils
+LOCAL_C_INCLUDES += system/extras/ext4_utils system/extras/squashfs_utils \
+	bootable/recovery
 LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
 LOCAL_CFLAGS := -Werror
 
diff --git a/fs_mgr/fs_mgr_fstab.c b/fs_mgr/fs_mgr_fstab.c
index d77d41f..4f18339 100644
--- a/fs_mgr/fs_mgr_fstab.c
+++ b/fs_mgr/fs_mgr_fstab.c
@@ -20,8 +20,6 @@
 #include <string.h>
 #include <sys/mount.h>
 
-#include <cutils/properties.h>
-
 #include "fs_mgr_priv.h"
 
 struct fs_mgr_flag_values {
@@ -310,25 +308,13 @@
         fstab->recs[cnt].partnum = flag_vals.partnum;
         fstab->recs[cnt].swap_prio = flag_vals.swap_prio;
         fstab->recs[cnt].zram_size = flag_vals.zram_size;
-
-        /* If an A/B partition, modify block device to be the real block device */
-        if (fstab->recs[cnt].fs_mgr_flags & MF_SLOTSELECT) {
-            char propbuf[PROPERTY_VALUE_MAX];
-            char *tmp;
-
-            /* use the kernel parameter if set */
-            property_get("ro.boot.slot_suffix", propbuf, "");
-
-            if (asprintf(&tmp, "%s%s", fstab->recs[cnt].blk_device, propbuf) > 0) {
-                free(fstab->recs[cnt].blk_device);
-                fstab->recs[cnt].blk_device = tmp;
-            } else {
-                ERROR("Error updating block device name\n");
-                goto err;
-            }
-        }
         cnt++;
     }
+    /* If an A/B partition, modify block device to be the real block device */
+    if (fs_mgr_update_for_slotselect(fstab) != 0) {
+        ERROR("Error updating for slotselect\n");
+        goto err;
+    }
     fclose(fstab_file);
     free(line);
     return fstab;
diff --git a/fs_mgr/fs_mgr_priv.h b/fs_mgr/fs_mgr_priv.h
index cc02bac..992b544 100644
--- a/fs_mgr/fs_mgr_priv.h
+++ b/fs_mgr/fs_mgr_priv.h
@@ -82,6 +82,7 @@
 #define DM_BUF_SIZE 4096
 
 int fs_mgr_set_blk_ro(const char *blockdev);
+int fs_mgr_update_for_slotselect(struct fstab *fstab);
 
 #endif /* __CORE_FS_MGR_PRIV_H */
 
diff --git a/fs_mgr/fs_mgr_slotselect.c b/fs_mgr/fs_mgr_slotselect.c
new file mode 100644
index 0000000..99dcd0e
--- /dev/null
+++ b/fs_mgr/fs_mgr_slotselect.c
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <cutils/properties.h>
+
+#include "fs_mgr.h"
+#include "fs_mgr_priv.h"
+
+#include "bootloader.h"
+
+// Copies slot_suffix from misc into |out_suffix|. Returns 0 on
+// success, -1 on error or if there is no non-empty slot_suffix.
+static int get_active_slot_suffix_from_misc(struct fstab *fstab,
+                                            char *out_suffix,
+                                            size_t suffix_len)
+{
+    int n;
+    int misc_fd;
+    ssize_t num_read;
+    struct bootloader_message msg;
+
+    misc_fd = -1;
+    for (n = 0; n < fstab->num_entries; n++) {
+        if (strcmp(fstab->recs[n].mount_point, "/misc") == 0) {
+            misc_fd = open(fstab->recs[n].blk_device, O_RDONLY);
+            if (misc_fd == -1) {
+                ERROR("Error opening misc partition \"%s\" (%s)\n",
+                      fstab->recs[n].blk_device,
+                      strerror(errno));
+                return -1;
+            } else {
+                break;
+            }
+        }
+    }
+
+    if (misc_fd == -1) {
+        ERROR("Error finding misc partition\n");
+        return -1;
+    }
+
+    num_read = TEMP_FAILURE_RETRY(read(misc_fd, &msg, sizeof(msg)));
+    // Linux will never return partial reads when reading from block
+    // devices so no need to worry about them.
+    if (num_read != sizeof(msg)) {
+        ERROR("Error reading bootloader_message (%s)\n", strerror(errno));
+        close(misc_fd);
+        return -1;
+    }
+    close(misc_fd);
+    if (msg.slot_suffix[0] == '\0')
+        return -1;
+    strncpy(out_suffix, msg.slot_suffix, suffix_len);
+    return 0;
+}
+
+// Gets slot_suffix from either the kernel cmdline / firmware, the
+// misc partition or built-in fallback.
+static void get_active_slot_suffix(struct fstab *fstab, char *out_suffix,
+                                   size_t suffix_len)
+{
+    char propbuf[PROPERTY_VALUE_MAX];
+
+    // Get the suffix from the kernel commandline (note that we don't
+    // allow the empty suffix). On bootloaders natively supporting A/B
+    // we'll hit this path every time so don't bother logging it.
+    property_get("ro.boot.slot_suffix", propbuf, "");
+    if (propbuf[0] != '\0') {
+        strncpy(out_suffix, propbuf, suffix_len);
+        return;
+    }
+
+    // If we couldn't get the suffix from the kernel cmdline, try the
+    // the misc partition.
+    if (get_active_slot_suffix_from_misc(fstab, out_suffix, suffix_len) == 0) {
+        INFO("Using slot suffix \"%s\" from misc\n", out_suffix);
+        return;
+    }
+
+    // If that didn't work, fall back to _a. The reasoning here is
+    // that since the fstab has the slotselect option set (otherwise
+    // we wouldn't end up here) we must assume that partitions are
+    // indeed set up for A/B. This corner-case is important because we
+    // may be on this codepath on newly provisioned A/B devices where
+    // misc isn't set up properly (it's just zeroes) and the
+    // bootloader does not (yet) natively support A/B.
+    //
+    // Why '_a'? Because that's what system/extras/boot_control_copy
+    // is using and since the bootloader isn't A/B aware we assume
+    // slots are set up this way.
+    WARNING("Could not determine slot suffix, falling back to \"_a\"\n");
+    strncpy(out_suffix, "_a", suffix_len);
+    return;
+}
+
+// Updates |fstab| for slot_suffix. Returns 0 on success, -1 on error.
+int fs_mgr_update_for_slotselect(struct fstab *fstab)
+{
+    int n;
+    char suffix[PROPERTY_VALUE_MAX];
+    int got_suffix = 0;
+
+    for (n = 0; n < fstab->num_entries; n++) {
+        if (fstab->recs[n].fs_mgr_flags & MF_SLOTSELECT) {
+            char *tmp;
+
+            if (!got_suffix) {
+                memset(suffix, '\0', sizeof(suffix));
+                get_active_slot_suffix(fstab, suffix, sizeof(suffix) - 1);
+                got_suffix = 1;
+            }
+
+            if (asprintf(&tmp, "%s%s", fstab->recs[n].blk_device,
+                         suffix) > 0) {
+                free(fstab->recs[n].blk_device);
+                fstab->recs[n].blk_device = tmp;
+            } else {
+                return -1;
+            }
+        }
+    }
+    return 0;
+}
diff --git a/logd/LogBuffer.cpp b/logd/LogBuffer.cpp
index 0582a5f..c2f846e 100644
--- a/logd/LogBuffer.cpp
+++ b/logd/LogBuffer.cpp
@@ -242,8 +242,8 @@
         LogBufferElementCollection::iterator it, bool engageStats) {
     LogBufferElement *e = *it;
     log_id_t id = e->getLogId();
-    LogBufferIteratorMap::iterator f = mLastWorstUid[id].find(e->getUid());
 
+    LogBufferIteratorMap::iterator f = mLastWorstUid[id].find(e->getUid());
     if ((f != mLastWorstUid[id].end()) && (it == f->second)) {
         mLastWorstUid[id].erase(f);
     }
@@ -329,7 +329,51 @@
 
 // prune "pruneRows" of type "id" from the buffer.
 //
+// This garbage collection task is used to expire log entries. It is called to
+// remove all logs (clear), all UID logs (unprivileged clear), or every
+// 256 or 10% of the total logs (whichever is less) to prune the logs.
+//
+// First there is a prep phase where we discover the reader region lock that
+// acts as a backstop to any pruning activity to stop there and go no further.
+//
+// There are three major pruning loops that follow. All expire from the oldest
+// entries. Since there are multiple log buffers, the Android logging facility
+// will appear to drop entries 'in the middle' when looking at multiple log
+// sources and buffers. This effect is slightly more prominent when we prune
+// the worst offender by logging source. Thus the logs slowly loose content
+// and value as you move back in time. This is preferred since chatty sources
+// invariably move the logs value down faster as less chatty sources would be
+// expired in the noise.
+//
+// The first loop performs blacklisting and worst offender pruning. Falling
+// through when there are no notable worst offenders and have not hit the
+// region lock preventing further worst offender pruning. This loop also looks
+// after managing the chatty log entries and merging to help provide
+// statistical basis for blame. The chatty entries are not a notification of
+// how much logs you may have, but instead represent how much logs you would
+// have had in a virtual log buffer that is extended to cover all the in-memory
+// logs without loss. They last much longer than the represented pruned logs
+// since they get multiplied by the gains in the non-chatty log sources.
+//
+// The second loop get complicated because an algorithm of watermarks and
+// history is maintained to reduce the order and keep processing time
+// down to a minimum at scale. These algorithms can be costly in the face
+// of larger log buffers, or severly limited processing time granted to a
+// background task at lowest priority.
+//
+// This second loop does straight-up expiration from the end of the logs
+// (again, remember for the specified log buffer id) but does some whitelist
+// preservation. Thus whitelist is a Hail Mary low priority, blacklists and
+// spam filtration all take priority. This second loop also checks if a region
+// lock is causing us to buffer too much in the logs to help the reader(s),
+// and will tell the slowest reader thread to skip log entries, and if
+// persistent and hits a further threshold, kill the reader thread.
+//
+// The third thread is optional, and only gets hit if there was a whitelist
+// and more needs to be pruned against the backstop of the region lock.
+//
 // mLogElementsLock must be held when this function is called.
+//
 void LogBuffer::prune(log_id_t id, unsigned long pruneRows, uid_t caller_uid) {
     LogTimeEntry *oldest = NULL;
 
@@ -410,7 +454,12 @@
         bool kick = false;
         bool leading = true;
         it = mLogElements.begin();
-        if (worst != (uid_t) -1) {
+        // Perform at least one mandatory garbage collection cycle in following
+        // - clear leading chatty tags
+        // - merge chatty tags
+        // - check age-out of preserved logs
+        bool gc = pruneRows <= 1;
+        if (!gc && (worst != (uid_t) -1)) {
             LogBufferIteratorMap::iterator f = mLastWorstUid[id].find(worst);
             if ((f != mLastWorstUid[id].end())
                     && (f->second != mLogElements.end())) {
@@ -481,7 +530,7 @@
             // unmerged drop message
             if (dropped) {
                 last.add(e);
-                if ((e->getUid() == worst)
+                if ((!gc && (e->getUid() == worst))
                         || (mLastWorstUid[id].find(e->getUid())
                             == mLastWorstUid[id].end())) {
                     mLastWorstUid[id][e->getUid()] = it;
@@ -516,7 +565,10 @@
                     it = erase(it, false);
                 } else {
                     last.add(e);
-                    mLastWorstUid[id][e->getUid()] = it;
+                    if (!gc || (mLastWorstUid[id].find(worst)
+                                == mLastWorstUid[id].end())) {
+                        mLastWorstUid[id][worst] = it;
+                    }
                     ++it;
                 }
             }
diff --git a/metricsd/Android.mk b/metricsd/Android.mk
index 12dfa18..c5d5281 100644
--- a/metricsd/Android.mk
+++ b/metricsd/Android.mk
@@ -113,7 +113,6 @@
 LOCAL_EXPORT_C_INCLUDE_DIRS += \
     $(generated_sources_dir)/proto/system/core/metricsd
 LOCAL_SRC_FILES :=  $(call all-proto-files-under,uploader/proto)
-LOCAL_STATIC_LIBRARIES := libprotobuf-cpp-lite
 include $(BUILD_STATIC_LIBRARY)
 
 # metrics daemon.
diff --git a/metricsd/metrics_client.cc b/metricsd/metrics_client.cc
index 57e96c2..f658b22 100644
--- a/metricsd/metrics_client.cc
+++ b/metricsd/metrics_client.cc
@@ -17,9 +17,15 @@
 #include <cstdio>
 #include <cstdlib>
 
+#include <base/memory/scoped_vector.h>
+
+#include "constants.h"
 #include "metrics/metrics_library.h"
+#include "serialization/metric_sample.h"
+#include "serialization/serialization_utils.h"
 
 enum Mode {
+    kModeDumpLogs,
     kModeSendSample,
     kModeSendEnumSample,
     kModeSendSparseSample,
@@ -36,12 +42,13 @@
           "        metrics_client -s   name sample\n"
           "        metrics_client -v   event\n"
           "        metrics_client -u action\n"
-          "        metrics_client [-cg]\n"
+          "        metrics_client [-cdg]\n"
           "\n"
           "  default: send metric with integer values \n"
           "           |min| > 0, |min| <= sample < |max|\n"
           "  -c: return exit status 0 if user consents to stats, 1 otherwise,\n"
           "      in guest mode always return 1\n"
+          "  -d: dump cached logs to the console\n"
           "  -e: send linear/enumeration histogram data\n"
           "  -g: return exit status 0 if machine in guest mode, 1 otherwise\n"
           "  -s: send a sparse histogram sample\n"
@@ -132,17 +139,57 @@
   return metrics_lib.IsGuestMode() ? 0 : 1;
 }
 
+static int DumpLogs() {
+  printf("Metrics from %s\n\n", metrics::kMetricsEventsFilePath);
+
+  ScopedVector<metrics::MetricSample> metrics;
+  metrics::SerializationUtils::ReadMetricsFromFile(
+      metrics::kMetricsEventsFilePath, &metrics);
+
+  for (ScopedVector<metrics::MetricSample>::const_iterator i = metrics.begin();
+       i != metrics.end(); ++i) {
+    const metrics::MetricSample* sample = *i;
+    printf("name: %s\t", sample->name().c_str());
+    printf("type: ");
+
+    switch (sample->type()) {
+      case metrics::MetricSample::CRASH:
+        printf("CRASH");
+        break;
+      case metrics::MetricSample::HISTOGRAM:
+        printf("HISTOGRAM");
+        break;
+      case metrics::MetricSample::LINEAR_HISTOGRAM:
+        printf("LINEAR_HISTOGRAM");
+        break;
+      case metrics::MetricSample::SPARSE_HISTOGRAM:
+        printf("SPARSE_HISTOGRAM");
+        break;
+      case metrics::MetricSample::USER_ACTION:
+        printf("USER_ACTION");
+        break;
+    }
+
+    printf("\n");
+  }
+
+  return 0;
+}
+
 int main(int argc, char** argv) {
   enum Mode mode = kModeSendSample;
   bool secs_to_msecs = false;
 
   // Parse arguments
   int flag;
-  while ((flag = getopt(argc, argv, "abcegstuv")) != -1) {
+  while ((flag = getopt(argc, argv, "abcdegstuv")) != -1) {
     switch (flag) {
       case 'c':
         mode = kModeHasConsent;
         break;
+      case 'd':
+        mode = kModeDumpLogs;
+        break;
       case 'e':
         mode = kModeSendEnumSample;
         break;
@@ -203,6 +250,8 @@
       return HasConsent();
     case kModeIsGuestMode:
       return IsGuestMode();
+    case kModeDumpLogs:
+      return DumpLogs();
     default:
       ShowUsage();
       return 0;
diff --git a/metricsd/serialization/serialization_utils.cc b/metricsd/serialization/serialization_utils.cc
index 6dd8258..102c940 100644
--- a/metricsd/serialization/serialization_utils.cc
+++ b/metricsd/serialization/serialization_utils.cc
@@ -96,6 +96,50 @@
   return true;
 }
 
+
+// Opens the metrics log file at |filename| in the given |mode|.
+//
+// Returns the file descriptor wrapped in a valid ScopedFD on success.
+base::ScopedFD OpenMetricsFile(const std::string& filename, mode_t mode) {
+  struct stat stat_buf;
+  int result;
+
+  result = stat(filename.c_str(), &stat_buf);
+  if (result < 0) {
+    if (errno != ENOENT)
+      DPLOG(ERROR) << filename << ": bad metrics file stat";
+
+    // Nothing to collect---try later.
+    return base::ScopedFD();
+  }
+  if (stat_buf.st_size == 0) {
+    // Also nothing to collect.
+    return base::ScopedFD();
+  }
+  base::ScopedFD fd(open(filename.c_str(), mode));
+  if (fd.get() < 0) {
+    DPLOG(ERROR) << filename << ": cannot open";
+    return base::ScopedFD();
+  }
+
+  return fd.Pass();
+}
+
+
+// Parses the contents of the metrics log file descriptor |fd| into |metrics|.
+void ReadAllMetricsFromFd(int fd, ScopedVector<MetricSample>* metrics) {
+  for (;;) {
+    std::string message;
+
+    if (!ReadMessage(fd, &message))
+      break;
+
+    scoped_ptr<MetricSample> sample = SerializationUtils::ParseSample(message);
+    if (sample)
+      metrics->push_back(sample.release());
+  }
+}
+
 }  // namespace
 
 scoped_ptr<MetricSample> SerializationUtils::ParseSample(
@@ -131,30 +175,27 @@
   return scoped_ptr<MetricSample>();
 }
 
+void SerializationUtils::ReadMetricsFromFile(
+    const std::string& filename,
+    ScopedVector<MetricSample>* metrics) {
+  base::ScopedFD fd(OpenMetricsFile(filename, O_RDONLY));
+  if (!fd.is_valid()) {
+    return;
+  }
+
+  // This processes all messages in the log.
+  ReadAllMetricsFromFd(fd.get(), metrics);
+}
+
 void SerializationUtils::ReadAndTruncateMetricsFromFile(
     const std::string& filename,
     ScopedVector<MetricSample>* metrics) {
-  struct stat stat_buf;
-  int result;
+  base::ScopedFD fd(OpenMetricsFile(filename, O_RDWR));
+  if (!fd.is_valid()) {
+    return;
+  }
 
-  result = stat(filename.c_str(), &stat_buf);
-  if (result < 0) {
-    if (errno != ENOENT)
-      DPLOG(ERROR) << filename << ": bad metrics file stat";
-
-    // Nothing to collect---try later.
-    return;
-  }
-  if (stat_buf.st_size == 0) {
-    // Also nothing to collect.
-    return;
-  }
-  base::ScopedFD fd(open(filename.c_str(), O_RDWR));
-  if (fd.get() < 0) {
-    DPLOG(ERROR) << filename << ": cannot open";
-    return;
-  }
-  result = flock(fd.get(), LOCK_EX);
+  int result = flock(fd.get(), LOCK_EX);
   if (result < 0) {
     DPLOG(ERROR) << filename << ": cannot lock";
     return;
@@ -162,16 +203,7 @@
 
   // This processes all messages in the log. When all messages are
   // read and processed, or an error occurs, truncate the file to zero size.
-  for (;;) {
-    std::string message;
-
-    if (!ReadMessage(fd.get(), &message))
-      break;
-
-    scoped_ptr<MetricSample> sample = ParseSample(message);
-    if (sample)
-      metrics->push_back(sample.release());
-  }
+  ReadAllMetricsFromFd(fd.get(), metrics);
 
   result = ftruncate(fd.get(), 0);
   if (result < 0)
diff --git a/metricsd/serialization/serialization_utils.h b/metricsd/serialization/serialization_utils.h
index 67d4675..655652d 100644
--- a/metricsd/serialization/serialization_utils.h
+++ b/metricsd/serialization/serialization_utils.h
@@ -35,7 +35,11 @@
 // deserialization was successful) or a NULL scoped_ptr.
 scoped_ptr<MetricSample> ParseSample(const std::string& sample);
 
-// Reads all samples from a file and truncate the file when done.
+// Reads all samples from a file. The file contents remain unchanged.
+void ReadMetricsFromFile(const std::string& filename,
+                         ScopedVector<MetricSample>* metrics);
+
+// Reads all samples from a file and truncates the file when done.
 void ReadAndTruncateMetricsFromFile(const std::string& filename,
                                     ScopedVector<MetricSample>* metrics);