diff --git a/debuggerd/Android.bp b/debuggerd/Android.bp
index 2d6c7f5..024bc3d 100644
--- a/debuggerd/Android.bp
+++ b/debuggerd/Android.bp
@@ -161,6 +161,7 @@
     target: {
         android: {
             srcs: [
+                "client/debuggerd_client_test.cpp",
                 "debuggerd_test.cpp",
                 "util.cpp"
             ],
@@ -171,6 +172,7 @@
         "libbacktrace",
         "libbase",
         "libcutils",
+        "libdebuggerd_client",
     ],
 
     static_libs: [
diff --git a/debuggerd/client/debuggerd_client.cpp b/debuggerd/client/debuggerd_client.cpp
index f2975d1..b9fb512 100644
--- a/debuggerd/client/debuggerd_client.cpp
+++ b/debuggerd/client/debuggerd_client.cpp
@@ -19,12 +19,14 @@
 #include <fcntl.h>
 #include <signal.h>
 #include <stdlib.h>
+#include <sys/poll.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <chrono>
 
+#include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/stringprintf.h>
 #include <android-base/unique_fd.h>
@@ -33,6 +35,8 @@
 #include <debuggerd/protocol.h>
 #include <debuggerd/util.h>
 
+using namespace std::chrono_literals;
+
 using android::base::unique_fd;
 
 static bool send_signal(pid_t pid, bool backtrace) {
@@ -45,28 +49,31 @@
   return true;
 }
 
+template <typename Duration>
+static void populate_timeval(struct timeval* tv, const Duration& duration) {
+  auto seconds = std::chrono::duration_cast<std::chrono::seconds>(duration);
+  auto microseconds = std::chrono::duration_cast<std::chrono::microseconds>(duration - seconds);
+  tv->tv_sec = static_cast<long>(seconds.count());
+  tv->tv_usec = static_cast<long>(microseconds.count());
+}
+
 bool debuggerd_trigger_dump(pid_t pid, unique_fd output_fd, DebuggerdDumpType dump_type,
                             int timeout_ms) {
   LOG(INFO) << "libdebuggerd_client: started dumping process " << pid;
   unique_fd sockfd;
   const auto end = std::chrono::steady_clock::now() + std::chrono::milliseconds(timeout_ms);
-  auto set_timeout = [timeout_ms, &sockfd, &end]() {
+  auto time_left = [timeout_ms, &end]() { return end - std::chrono::steady_clock::now(); };
+  auto set_timeout = [timeout_ms, &time_left](int sockfd) {
     if (timeout_ms <= 0) {
       return true;
     }
 
-    auto now = std::chrono::steady_clock::now();
-    if (now > end) {
+    auto remaining = time_left();
+    if (remaining < decltype(remaining)::zero()) {
       return false;
     }
-
-    auto time_left = std::chrono::duration_cast<std::chrono::microseconds>(end - now);
-    auto seconds = std::chrono::duration_cast<std::chrono::seconds>(time_left);
-    auto microseconds = std::chrono::duration_cast<std::chrono::microseconds>(time_left - seconds);
-    struct timeval timeout = {
-      .tv_sec = static_cast<long>(seconds.count()),
-      .tv_usec = static_cast<long>(microseconds.count()),
-    };
+    struct timeval timeout;
+    populate_timeval(&timeout, remaining);
 
     if (setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) != 0) {
       return false;
@@ -84,7 +91,7 @@
     return false;
   }
 
-  if (!set_timeout()) {
+  if (!set_timeout(sockfd)) {
     PLOG(ERROR) << "libdebugger_client: failed to set timeout";
     return false;
   }
@@ -96,11 +103,19 @@
   }
 
   InterceptRequest req = {.pid = pid };
-  if (!set_timeout()) {
+  if (!set_timeout(sockfd)) {
     PLOG(ERROR) << "libdebugger_client: failed to set timeout";
+    return false;
   }
 
-  if (send_fd(sockfd.get(), &req, sizeof(req), std::move(output_fd)) != sizeof(req)) {
+  // Create an intermediate pipe to pass to the other end.
+  unique_fd pipe_read, pipe_write;
+  if (!Pipe(&pipe_read, &pipe_write)) {
+    PLOG(ERROR) << "libdebuggerd_client: failed to create pipe";
+    return false;
+  }
+
+  if (send_fd(sockfd.get(), &req, sizeof(req), std::move(pipe_write)) != sizeof(req)) {
     PLOG(ERROR) << "libdebuggerd_client: failed to send output fd to tombstoned";
     return false;
   }
@@ -108,8 +123,9 @@
   bool backtrace = dump_type == kDebuggerdBacktrace;
   send_signal(pid, backtrace);
 
-  if (!set_timeout()) {
-    PLOG(ERROR) << "libdebugger_client: failed to set timeout";
+  if (!set_timeout(sockfd)) {
+    PLOG(ERROR) << "libdebuggerd_client: failed to set timeout";
+    return false;
   }
 
   InterceptResponse response;
@@ -127,6 +143,48 @@
   if (response.success != 1) {
     response.error_message[sizeof(response.error_message) - 1] = '\0';
     LOG(ERROR) << "libdebuggerd_client: tombstoned reported failure: " << response.error_message;
+    return false;
+  }
+
+  // Forward output from the pipe to the output fd.
+  while (true) {
+    auto remaining_ms = std::chrono::duration_cast<std::chrono::milliseconds>(time_left());
+    if (remaining_ms <= 1ms) {
+      LOG(ERROR) << "libdebuggerd_client: timeout expired";
+      return false;
+    }
+
+    struct pollfd pfd = {
+        .fd = pipe_read.get(), .events = POLLIN, .revents = 0,
+    };
+
+    rc = poll(&pfd, 1, remaining_ms.count());
+    if (rc == -1) {
+      if (errno == EINTR) {
+        continue;
+      } else {
+        PLOG(ERROR) << "libdebuggerd_client: error while polling";
+        return false;
+      }
+    } else if (rc == 0) {
+      LOG(ERROR) << "libdebuggerd_client: timeout expired";
+      return false;
+    }
+
+    char buf[1024];
+    rc = TEMP_FAILURE_RETRY(read(pipe_read.get(), buf, sizeof(buf)));
+    if (rc == 0) {
+      // Done.
+      break;
+    } else if (rc == -1) {
+      PLOG(ERROR) << "libdebuggerd_client: error while reading";
+      return false;
+    }
+
+    if (!android::base::WriteFully(output_fd.get(), buf, rc)) {
+      PLOG(ERROR) << "libdebuggerd_client: error while writing";
+      return false;
+    }
   }
 
   LOG(INFO) << "libdebuggerd_client: done dumping process " << pid;
diff --git a/debuggerd/client/debuggerd_client_test.cpp b/debuggerd/client/debuggerd_client_test.cpp
new file mode 100644
index 0000000..86d0314
--- /dev/null
+++ b/debuggerd/client/debuggerd_client_test.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2017, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <debuggerd/client.h>
+
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <chrono>
+#include <thread>
+#include <vector>
+
+#include <gtest/gtest.h>
+
+#include <android-base/file.h>
+#include <android-base/stringprintf.h>
+#include <android-base/strings.h>
+#include <android-base/unique_fd.h>
+
+#include <debuggerd/util.h>
+
+using namespace std::chrono_literals;
+using android::base::unique_fd;
+
+TEST(debuggerd_client, race) {
+  static constexpr int THREAD_COUNT = 1024;
+  pid_t forkpid = fork();
+
+  ASSERT_NE(-1, forkpid);
+
+  if (forkpid == 0) {
+    // Spawn a bunch of threads, to make crash_dump take longer.
+    std::vector<std::thread> threads;
+    for (int i = 0; i < THREAD_COUNT; ++i) {
+      threads.emplace_back([]() {
+        while (true) {
+          std::this_thread::sleep_for(60s);
+        }
+      });
+    }
+
+    std::this_thread::sleep_for(60s);
+    exit(0);
+  }
+
+  unique_fd pipe_read, pipe_write;
+  ASSERT_TRUE(Pipe(&pipe_read, &pipe_write));
+
+  // 64 kB should be enough for everyone.
+  constexpr int PIPE_SIZE = 64 * 1024 * 1024;
+  ASSERT_EQ(PIPE_SIZE, fcntl(pipe_read.get(), F_SETPIPE_SZ, PIPE_SIZE));
+
+  // Wait for a bit to let the child spawn all of its threads.
+  std::this_thread::sleep_for(250ms);
+
+  ASSERT_TRUE(debuggerd_trigger_dump(forkpid, std::move(pipe_write), kDebuggerdBacktrace, 10000));
+  // Immediately kill the forked child, to make sure that the dump didn't return early.
+  ASSERT_EQ(0, kill(forkpid, SIGKILL)) << strerror(errno);
+
+  // Check the output.
+  std::string result;
+  ASSERT_TRUE(android::base::ReadFdToString(pipe_read.get(), &result));
+
+  // Look for "----- end <PID> -----"
+  int found_end = 0;
+
+  std::string expected_end = android::base::StringPrintf("----- end %d -----", forkpid);
+
+  std::vector<std::string> lines = android::base::Split(result, "\n");
+  for (const std::string& line : lines) {
+    if (line == expected_end) {
+      ++found_end;
+    }
+  }
+
+  EXPECT_EQ(1, found_end) << "\nOutput: \n" << result;
+}
diff --git a/fs_mgr/fs_mgr_avb_ops.cpp b/fs_mgr/fs_mgr_avb_ops.cpp
index dd8c7e7..2c14c9b 100644
--- a/fs_mgr/fs_mgr_avb_ops.cpp
+++ b/fs_mgr/fs_mgr_avb_ops.cpp
@@ -78,7 +78,7 @@
     // access. fs_mgr_test_access() will test a few iterations if the
     // path doesn't exist yet.
     if (fs_mgr_test_access(path.c_str()) < 0) {
-        return AVB_IO_RESULT_ERROR_IO;
+        return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
     }
 
     android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(path.c_str(), O_RDONLY | O_CLOEXEC)));
diff --git a/fs_mgr/fs_mgr_fstab.cpp b/fs_mgr/fs_mgr_fstab.cpp
index a4f88ba..720ec03 100644
--- a/fs_mgr/fs_mgr_fstab.cpp
+++ b/fs_mgr/fs_mgr_fstab.cpp
@@ -646,7 +646,10 @@
     std::string hw;
     std::string default_fstab;
 
-    if (fs_mgr_get_boot_config("hardware", &hw)) {
+    // Use different fstab paths for normal boot and recovery boot, respectively
+    if (access("/sbin/recovery", F_OK) == 0) {
+        default_fstab = "/etc/recovery.fstab";
+    } else if (fs_mgr_get_boot_config("hardware", &hw)) {  // normal boot
         for (const char *prefix : {"/odm/etc/fstab.","/vendor/etc/fstab.", "/fstab."}) {
             default_fstab = prefix + hw;
             if (access(default_fstab.c_str(), F_OK) == 0) break;
diff --git a/init/Android.mk b/init/Android.mk
index c82a19e..b52c949 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -115,34 +115,6 @@
     libnl \
     libavb
 
-# Include SELinux policy. We do this here because different modules
-# need to be included based on the value of PRODUCT_FULL_TREBLE. This
-# type of conditional inclusion cannot be done in top-level files such
-# as build/target/product/embedded.mk.
-# This conditional inclusion closely mimics the conditional logic
-# inside init/init.cpp for loading SELinux policy from files.
-ifeq ($(PRODUCT_FULL_TREBLE),true)
-# Use split SELinux policy
-LOCAL_REQUIRED_MODULES += \
-    mapping_sepolicy.cil \
-    nonplat_sepolicy.cil \
-    plat_sepolicy.cil \
-    plat_sepolicy.cil.sha256 \
-    secilc \
-    nonplat_file_contexts \
-    plat_file_contexts
-
-# Include precompiled policy, unless told otherwise
-ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
-LOCAL_REQUIRED_MODULES += precompiled_sepolicy precompiled_sepolicy.plat.sha256
-endif
-
-else
-# Use monolithic SELinux policy
-LOCAL_REQUIRED_MODULES += sepolicy \
-    file_contexts.bin
-endif
-
 # Create symlinks.
 LOCAL_POST_INSTALL_CMD := $(hide) mkdir -p $(TARGET_ROOT_OUT)/sbin; \
     ln -sf ../init $(TARGET_ROOT_OUT)/sbin/ueventd; \
diff --git a/init/README.md b/init/README.md
index 9d352f8..024d559 100644
--- a/init/README.md
+++ b/init/README.md
@@ -192,16 +192,17 @@
 `oneshot`
 > Do not restart the service when it exits.
 
-`class <name>`
-> Specify a class name for the service.  All services in a
+`class <name> [ <name>\* ]`
+> Specify class names for the service.  All services in a
   named class may be started or stopped together.  A service
   is in the class "default" if one is not specified via the
-  class option.
+  class option. Additional classnames beyond the (required) first
+  one are used to group services.
 
 `onrestart`
 > Execute a Command (see below) when service restarts.
 
-`writepid <file...>`
+`writepid <file> [ <file>\* ]`
 > Write the child's pid to the given files when it forks. Meant for
   cgroup/cpuset usage. If no files under /dev/cpuset/ are specified, but the
   system property 'ro.cpuset.default' is set to a non-empty cpuset name (e.g.
diff --git a/init/init.h b/init/init.h
index 3768c02..b4d25fb 100644
--- a/init/init.h
+++ b/init/init.h
@@ -19,9 +19,6 @@
 
 #include <string>
 
-class Action;
-class Service;
-
 extern const char *ENV[32];
 extern std::string default_console;
 extern struct selabel_handle *sehandle;
diff --git a/init/reboot.cpp b/init/reboot.cpp
index 1559b6f..261a437 100644
--- a/init/reboot.cpp
+++ b/init/reboot.cpp
@@ -263,6 +263,8 @@
     return umountDone;
 }
 
+static void KillAllProcesses() { android::base::WriteStringToFile("i", "/proc/sysrq-trigger"); }
+
 /* Try umounting all emulated file systems R/W block device cfile systems.
  * This will just try umount and give it up if it fails.
  * For fs like ext4, this is ok as file system will be marked as unclean shutdown
@@ -272,7 +274,8 @@
  *
  * return true when umount was successful. false when timed out.
  */
-static UmountStat TryUmountAndFsck(bool runFsck) {
+static UmountStat TryUmountAndFsck(bool runFsck, int timeoutMs) {
+    Timer t;
     std::vector<MountEntry> emulatedPartitions;
     std::vector<MountEntry> blockDevRwPartitions;
 
@@ -297,12 +300,20 @@
      * still happen while waiting for /data. If the current waiting is not good enough, give
      * up and leave it to e2fsck after reboot to fix it.
      */
-    /* TODO update max waiting time based on usage data */
-    if (!UmountPartitions(&blockDevRwPartitions, 100, 0)) {
-        /* Last resort, detach and hope it finish before shutdown. */
-        UmountPartitions(&blockDevRwPartitions, 1, MNT_DETACH);
-        stat = UMOUNT_STAT_TIMEOUT;
+    int remainingTimeMs = timeoutMs - t.duration_ms();
+    // each retry takes 100ms, and run at least once.
+    int retry = std::max(remainingTimeMs / 100, 1);
+    if (!UmountPartitions(&blockDevRwPartitions, retry, 0)) {
+        /* Last resort, kill all and try again */
+        LOG(WARNING) << "umount still failing, trying kill all";
+        KillAllProcesses();
+        DoSync();
+        if (!UmountPartitions(&blockDevRwPartitions, 1, 0)) {
+            stat = UMOUNT_STAT_TIMEOUT;
+        }
     }
+    // fsck part is excluded from timeout check. It only runs for user initiated shutdown
+    // and should not affect reboot time.
     if (stat == UMOUNT_STAT_SUCCESS && runFsck) {
         for (auto& entry : blockDevRwPartitions) {
             DoFsck(entry);
@@ -312,8 +323,6 @@
     return stat;
 }
 
-static void KillAllProcesses() { android::base::WriteStringToFile("i", "/proc/sysrq-trigger"); }
-
 static void __attribute__((noreturn)) DoThermalOff() {
     LOG(WARNING) << "Thermal system shutdown";
     DoSync();
@@ -334,11 +343,10 @@
     }
 
     std::string timeout = property_get("ro.build.shutdown_timeout");
-    unsigned int delay = 0;
-    if (!android::base::ParseUint(timeout, &delay)) {
-        delay = 3;  // force service termination by default
-    } else {
-        LOG(INFO) << "ro.build.shutdown_timeout set:" << delay;
+    /* TODO update default waiting time based on usage data */
+    unsigned int shutdownTimeout = 10;  // default value
+    if (android::base::ParseUint(timeout, &shutdownTimeout)) {
+        LOG(INFO) << "ro.build.shutdown_timeout set:" << shutdownTimeout;
     }
 
     static const constexpr char* shutdown_critical_services[] = {"vold", "watchdogd"};
@@ -353,7 +361,7 @@
     }
     // optional shutdown step
     // 1. terminate all services except shutdown critical ones. wait for delay to finish
-    if (delay > 0) {
+    if (shutdownTimeout > 0) {
         LOG(INFO) << "terminating init services";
         // tombstoned can write to data when other services are killed. so finish it first.
         static const constexpr char* first_to_kill[] = {"tombstoned"};
@@ -368,7 +376,9 @@
         });
 
         int service_count = 0;
-        while (t.duration_s() < delay) {
+        // Up to half as long as shutdownTimeout or 3 seconds, whichever is lower.
+        unsigned int terminationWaitTimeout = std::min<unsigned int>((shutdownTimeout + 1) / 2, 3);
+        while (t.duration_s() < terminationWaitTimeout) {
             ServiceManager::GetInstance().ReapAnyOutstandingChildren();
 
             service_count = 0;
@@ -409,12 +419,9 @@
     } else {
         LOG(INFO) << "vold not running, skipping vold shutdown";
     }
-    if (delay == 0) {  // no processes terminated. kill all instead.
-        KillAllProcesses();
-    }
     // 4. sync, try umount, and optionally run fsck for user shutdown
     DoSync();
-    UmountStat stat = TryUmountAndFsck(runFsck);
+    UmountStat stat = TryUmountAndFsck(runFsck, shutdownTimeout * 1000 - t.duration_ms());
     LogShutdownTime(stat, &t);
     // Reboot regardless of umount status. If umount fails, fsck after reboot will fix it.
     RebootSystem(cmd, rebootTarget);
diff --git a/init/service.cpp b/init/service.cpp
index c8d1cb1..c6ef838 100644
--- a/init/service.cpp
+++ b/init/service.cpp
@@ -149,27 +149,44 @@
     : name(name), value(value) {
 }
 
-Service::Service(const std::string& name, const std::string& classname,
-                 const std::vector<std::string>& args)
-    : name_(name), classname_(classname), flags_(0), pid_(0),
-      crash_count_(0), uid_(0), gid_(0), namespace_flags_(0),
-      seclabel_(""), ioprio_class_(IoSchedClass_NONE), ioprio_pri_(0),
-      priority_(0), oom_score_adjust_(-1000), args_(args) {
+Service::Service(const std::string& name, const std::vector<std::string>& args)
+    : name_(name),
+      classnames_({"default"}),
+      flags_(0),
+      pid_(0),
+      crash_count_(0),
+      uid_(0),
+      gid_(0),
+      namespace_flags_(0),
+      seclabel_(""),
+      ioprio_class_(IoSchedClass_NONE),
+      ioprio_pri_(0),
+      priority_(0),
+      oom_score_adjust_(-1000),
+      args_(args) {
     onrestart_.InitSingleTrigger("onrestart");
 }
 
-Service::Service(const std::string& name, const std::string& classname,
-                 unsigned flags, uid_t uid, gid_t gid,
-                 const std::vector<gid_t>& supp_gids,
-                 const CapSet& capabilities, unsigned namespace_flags,
-                 const std::string& seclabel,
+Service::Service(const std::string& name, unsigned flags, uid_t uid, gid_t gid,
+                 const std::vector<gid_t>& supp_gids, const CapSet& capabilities,
+                 unsigned namespace_flags, const std::string& seclabel,
                  const std::vector<std::string>& args)
-    : name_(name), classname_(classname), flags_(flags), pid_(0),
-      crash_count_(0), uid_(uid), gid_(gid),
-      supp_gids_(supp_gids), capabilities_(capabilities),
-      namespace_flags_(namespace_flags), seclabel_(seclabel),
-      ioprio_class_(IoSchedClass_NONE), ioprio_pri_(0), priority_(0),
-      oom_score_adjust_(-1000), args_(args) {
+    : name_(name),
+      classnames_({"default"}),
+      flags_(flags),
+      pid_(0),
+      crash_count_(0),
+      uid_(uid),
+      gid_(gid),
+      supp_gids_(supp_gids),
+      capabilities_(capabilities),
+      namespace_flags_(namespace_flags),
+      seclabel_(seclabel),
+      ioprio_class_(IoSchedClass_NONE),
+      ioprio_pri_(0),
+      priority_(0),
+      oom_score_adjust_(-1000),
+      args_(args) {
     onrestart_.InitSingleTrigger("onrestart");
 }
 
@@ -297,7 +314,7 @@
 
 void Service::DumpState() const {
     LOG(INFO) << "service " << name_;
-    LOG(INFO) << "  class '" << classname_ << "'";
+    LOG(INFO) << "  class '" << android::base::Join(classnames_, " ") << "'";
     LOG(INFO) << "  exec "<< android::base::Join(args_, " ");
     std::for_each(descriptors_.begin(), descriptors_.end(),
                   [] (const auto& info) { LOG(INFO) << *info; });
@@ -334,7 +351,7 @@
 }
 
 bool Service::ParseClass(const std::vector<std::string>& args, std::string* err) {
-    classname_ = args[1];
+    classnames_ = std::set<std::string>(args.begin() + 1, args.end());
     return true;
 }
 
@@ -516,10 +533,11 @@
 
 Service::OptionParserMap::Map& Service::OptionParserMap::map() const {
     constexpr std::size_t kMax = std::numeric_limits<std::size_t>::max();
+    // clang-format off
     static const Map option_parsers = {
         {"capabilities",
                         {1,     kMax, &Service::ParseCapabilities}},
-        {"class",       {1,     1,    &Service::ParseClass}},
+        {"class",       {1,     kMax, &Service::ParseClass}},
         {"console",     {0,     1,    &Service::ParseConsole}},
         {"critical",    {0,     0,    &Service::ParseCritical}},
         {"disabled",    {0,     0,    &Service::ParseDisabled}},
@@ -539,6 +557,7 @@
         {"user",        {1,     1,    &Service::ParseUser}},
         {"writepid",    {1,     kMax, &Service::ParseWritepid}},
     };
+    // clang-format on
     return option_parsers;
 }
 
@@ -889,8 +908,8 @@
         }
     }
 
-    auto svc_p = std::make_unique<Service>(name, "default", flags, uid, gid, supp_gids,
-                                           no_capabilities, namespace_flags, seclabel, str_args);
+    auto svc_p = std::make_unique<Service>(name, flags, uid, gid, supp_gids, no_capabilities,
+                                           namespace_flags, seclabel, str_args);
     Service* svc = svc_p.get();
     services_.emplace_back(std::move(svc_p));
 
@@ -940,7 +959,7 @@
 void ServiceManager::ForEachServiceInClass(const std::string& classname,
                                            void (*func)(Service* svc)) const {
     for (const auto& s : services_) {
-        if (classname == s->classname()) {
+        if (s->classnames().find(classname) != s->classnames().end()) {
             func(s.get());
         }
     }
@@ -1034,7 +1053,7 @@
     }
 
     std::vector<std::string> str_args(args.begin() + 2, args.end());
-    service_ = std::make_unique<Service>(name, "default", str_args);
+    service_ = std::make_unique<Service>(name, str_args);
     return true;
 }
 
diff --git a/init/service.h b/init/service.h
index 08388e2..9a9046b 100644
--- a/init/service.h
+++ b/init/service.h
@@ -22,6 +22,7 @@
 #include <cutils/iosched_policy.h>
 
 #include <memory>
+#include <set>
 #include <string>
 #include <vector>
 
@@ -61,12 +62,10 @@
 };
 
 class Service {
-public:
-    Service(const std::string& name, const std::string& classname,
-            const std::vector<std::string>& args);
+  public:
+    Service(const std::string& name, const std::vector<std::string>& args);
 
-    Service(const std::string& name, const std::string& classname,
-            unsigned flags, uid_t uid, gid_t gid,
+    Service(const std::string& name, unsigned flags, uid_t uid, gid_t gid,
             const std::vector<gid_t>& supp_gids, const CapSet& capabilities,
             unsigned namespace_flags, const std::string& seclabel,
             const std::vector<std::string>& args);
@@ -84,10 +83,10 @@
     bool Reap();
     void DumpState() const;
     void SetShutdownCritical() { flags_ |= SVC_SHUTDOWN_CRITICAL; }
-    bool IsShutdownCritical() { return (flags_ & SVC_SHUTDOWN_CRITICAL) != 0; }
+    bool IsShutdownCritical() const { return (flags_ & SVC_SHUTDOWN_CRITICAL) != 0; }
 
     const std::string& name() const { return name_; }
-    const std::string& classname() const { return classname_; }
+    const std::set<std::string>& classnames() const { return classnames_; }
     unsigned flags() const { return flags_; }
     pid_t pid() const { return pid_; }
     uid_t uid() const { return uid_; }
@@ -100,7 +99,7 @@
     void set_keychord_id(int keychord_id) { keychord_id_ = keychord_id; }
     const std::vector<std::string>& args() const { return args_; }
 
-private:
+  private:
     using OptionParser = bool (Service::*) (const std::vector<std::string>& args,
                                             std::string* err);
     class OptionParserMap;
@@ -136,7 +135,7 @@
     bool AddDescriptor(const std::vector<std::string>& args, std::string* err);
 
     std::string name_;
-    std::string classname_;
+    std::set<std::string> classnames_;
     std::string console_;
 
     unsigned flags_;
diff --git a/libcutils/sched_policy.cpp b/libcutils/sched_policy.cpp
index 40144cf..0d459cc 100644
--- a/libcutils/sched_policy.cpp
+++ b/libcutils/sched_policy.cpp
@@ -51,13 +51,8 @@
 
 static pthread_once_t the_once = PTHREAD_ONCE_INIT;
 
-static int __sys_supports_schedgroups = -1;
 static int __sys_supports_timerslack = -1;
 
-// File descriptors open to /dev/cpuctl/../tasks, setup by initialize, or -1 on error.
-static int bg_cgroup_fd = -1;
-static int fg_cgroup_fd = -1;
-
 // File descriptors open to /dev/cpuset/../tasks, setup by initialize, or -1 on error
 static int system_bg_cpuset_fd = -1;
 static int bg_cpuset_fd = -1;
@@ -151,23 +146,6 @@
 
 static void __initialize() {
     const char* filename;
-    if (!access("/dev/cpuctl/tasks", W_OK)) {
-        __sys_supports_schedgroups = 1;
-
-        filename = "/dev/cpuctl/tasks";
-        fg_cgroup_fd = open(filename, O_WRONLY | O_CLOEXEC);
-        if (fg_cgroup_fd < 0) {
-            SLOGE("open of %s failed: %s\n", filename, strerror(errno));
-        }
-
-        filename = "/dev/cpuctl/bg_non_interactive/tasks";
-        bg_cgroup_fd = open(filename, O_WRONLY | O_CLOEXEC);
-        if (bg_cgroup_fd < 0) {
-            SLOGE("open of %s failed: %s\n", filename, strerror(errno));
-        }
-    } else {
-        __sys_supports_schedgroups = 0;
-    }
 
     if (cpusets_enabled()) {
         if (!access("/dev/cpuset/tasks", W_OK)) {
@@ -276,35 +254,21 @@
     }
     pthread_once(&the_once, __initialize);
 
-    if (__sys_supports_schedgroups) {
-        char grpBuf[32];
+    char grpBuf[32];
 
-        if (cpusets_enabled()) {
-            if (getCGroupSubsys(tid, "cpuset", grpBuf, sizeof(grpBuf)) < 0)
-                return -1;
-            if (grpBuf[0] == '\0') {
-                *policy = SP_FOREGROUND;
-            } else if (!strcmp(grpBuf, "foreground")) {
-                *policy = SP_FOREGROUND;
-            } else if (!strcmp(grpBuf, "background")) {
-                *policy = SP_BACKGROUND;
-            } else if (!strcmp(grpBuf, "top-app")) {
-                *policy = SP_TOP_APP;
-            } else {
-                errno = ERANGE;
-                return -1;
-            }
+    if (cpusets_enabled()) {
+        if (getCGroupSubsys(tid, "cpuset", grpBuf, sizeof(grpBuf)) < 0) return -1;
+        if (grpBuf[0] == '\0') {
+            *policy = SP_FOREGROUND;
+        } else if (!strcmp(grpBuf, "foreground")) {
+            *policy = SP_FOREGROUND;
+        } else if (!strcmp(grpBuf, "background")) {
+            *policy = SP_BACKGROUND;
+        } else if (!strcmp(grpBuf, "top-app")) {
+            *policy = SP_TOP_APP;
         } else {
-            if (getCGroupSubsys(tid, "cpu", grpBuf, sizeof(grpBuf)) < 0)
-                return -1;
-            if (grpBuf[0] == '\0') {
-                *policy = SP_FOREGROUND;
-            } else if (!strcmp(grpBuf, "bg_non_interactive")) {
-                *policy = SP_BACKGROUND;
-            } else {
-                errno = ERANGE;
-                return -1;
-            }
+            errno = ERANGE;
+            return -1;
         }
     } else {
         int rc = sched_getscheduler(tid);
@@ -440,41 +404,30 @@
     }
 #endif
 
-    if (__sys_supports_schedgroups) {
-        int fd = -1;
+    if (schedboost_enabled()) {
         int boost_fd = -1;
         switch (policy) {
         case SP_BACKGROUND:
-            fd = bg_cgroup_fd;
             boost_fd = bg_schedboost_fd;
             break;
         case SP_FOREGROUND:
         case SP_AUDIO_APP:
         case SP_AUDIO_SYS:
-            fd = fg_cgroup_fd;
             boost_fd = fg_schedboost_fd;
             break;
         case SP_TOP_APP:
-            fd = fg_cgroup_fd;
             boost_fd = ta_schedboost_fd;
             break;
         default:
-            fd = -1;
             boost_fd = -1;
             break;
         }
 
-        if (fd > 0 && add_tid_to_cgroup(tid, fd) != 0) {
+        if (boost_fd > 0 && add_tid_to_cgroup(tid, boost_fd) != 0) {
             if (errno != ESRCH && errno != ENOENT)
                 return -errno;
         }
 
-        if (schedboost_enabled()) {
-            if (boost_fd > 0 && add_tid_to_cgroup(tid, boost_fd) != 0) {
-                if (errno != ESRCH && errno != ENOENT)
-                    return -errno;
-            }
-        }
     } else {
         struct sched_param param;
 
diff --git a/libutils/include/utils/FastStrcmp.h b/libutils/include/utils/FastStrcmp.h
index 3844e7d..5cadc94 100644
--- a/libutils/include/utils/FastStrcmp.h
+++ b/libutils/include/utils/FastStrcmp.h
@@ -17,6 +17,13 @@
 #ifndef _ANDROID_UTILS_FASTSTRCMP_H__
 #define _ANDROID_UTILS_FASTSTRCMP_H__
 
+#include <ctype.h>
+#include <string.h>
+
+#ifndef __predict_true
+#define __predict_true(exp) __builtin_expect((exp) != 0, 1)
+#endif
+
 #ifdef __cplusplus
 
 // Optimized for instruction cache locality
@@ -28,25 +35,41 @@
 //
 //  fastcmp<strncmp>(str1, str2, len)
 //
-// NB: Does not work for the case insensitive str*cmp functions.
+// NB: use fasticmp for the case insensitive str*cmp functions.
 // NB: Returns boolean, do not use if expecting to check negative value.
 //     Thus not semantically identical to the expected function behavior.
 
-template <int (*cmp)(const char *l, const char *r, const size_t s)>
-static inline int fastcmp(const char *l, const char *r, const size_t s) {
-    return (*l != *r) || cmp(l + 1, r + 1, s - 1);
+template <int (*cmp)(const char* l, const char* r, const size_t s)>
+static inline int fastcmp(const char* l, const char* r, const size_t s) {
+    const ssize_t n = s;  // To help reject negative sizes, treat like zero
+    return __predict_true(n > 0) &&
+           ((*l != *r) || (__predict_true(n > 1) && cmp(l + 1, r + 1, n - 1)));
 }
 
-template <int (*cmp)(const void *l, const void *r, const size_t s)>
-static inline int fastcmp(const void *lv, const void *rv, const size_t s) {
-    const char *l = static_cast<const char *>(lv);
-    const char *r = static_cast<const char *>(rv);
-    return (*l != *r) || cmp(l + 1, r + 1, s - 1);
+template <int (*cmp)(const char* l, const char* r, const size_t s)>
+static inline int fasticmp(const char* l, const char* r, const size_t s) {
+    const ssize_t n = s;  // To help reject negative sizes, treat like zero
+    return __predict_true(n > 0) &&
+           ((tolower(*l) != tolower(*r)) || (__predict_true(n > 1) && cmp(l + 1, r + 1, n - 1)));
 }
 
-template <int (*cmp)(const char *l, const char *r)>
-static inline int fastcmp(const char *l, const char *r) {
-    return (*l != *r) || cmp(l + 1, r + 1);
+template <int (*cmp)(const void* l, const void* r, const size_t s)>
+static inline int fastcmp(const void* lv, const void* rv, const size_t s) {
+    const char* l = static_cast<const char*>(lv);
+    const char* r = static_cast<const char*>(rv);
+    const ssize_t n = s;  // To help reject negative sizes, treat like zero
+    return __predict_true(n > 0) &&
+           ((*l != *r) || (__predict_true(n > 1) && cmp(l + 1, r + 1, n - 1)));
+}
+
+template <int (*cmp)(const char* l, const char* r)>
+static inline int fastcmp(const char* l, const char* r) {
+    return (*l != *r) || (__predict_true(*l) && cmp(l + 1, r + 1));
+}
+
+template <int (*cmp)(const char* l, const char* r)>
+static inline int fasticmp(const char* l, const char* r) {
+    return (tolower(*l) != tolower(*r)) || (__predict_true(*l) && cmp(l + 1, r + 1));
 }
 
 #endif
diff --git a/logcat/tests/logcat_test.cpp b/logcat/tests/logcat_test.cpp
index 0895834..a3a0176 100644
--- a/logcat/tests/logcat_test.cpp
+++ b/logcat/tests/logcat_test.cpp
@@ -479,6 +479,56 @@
     ASSERT_EQ(1, count);
 }
 
+TEST(logcat, End_to_End_multitude) {
+    pid_t pid = getpid();
+
+    log_time ts(CLOCK_MONOTONIC);
+
+    ASSERT_LT(0, __android_log_btwrite(0, EVENT_TYPE_LONG, &ts, sizeof(ts)));
+
+    FILE* fp[256];  // does this count as a multitude!
+    memset(fp, 0, sizeof(fp));
+    logcat_define(ctx[sizeof(fp) / sizeof(fp[0])]);
+    size_t num = 0;
+    do {
+        EXPECT_TRUE(NULL !=
+                    (fp[num] = logcat_popen(
+                         ctx[num], "logcat -v brief -b events -t 100")));
+        if (!fp[num]) {
+            fprintf(stderr,
+                    "WARNING: limiting to %zu simultaneous logcat operations\n",
+                    num);
+            break;
+        }
+    } while (++num < sizeof(fp) / sizeof(fp[0]));
+
+    char buffer[BIG_BUFFER];
+
+    size_t count = 0;
+
+    for (size_t idx = 0; idx < sizeof(fp) / sizeof(fp[0]); ++idx) {
+        if (!fp[idx]) break;
+        while (fgets(buffer, sizeof(buffer), fp[idx])) {
+            int p;
+            unsigned long long t;
+
+            if ((2 != sscanf(buffer, "I/[0]     ( %d): %llu", &p, &t)) ||
+                (p != pid)) {
+                continue;
+            }
+
+            log_time tx((const char*)&t);
+            if (ts == tx) {
+                ++count;
+            }
+        }
+
+        logcat_pclose(ctx[idx], fp[idx]);
+    }
+
+    ASSERT_EQ(num, count);
+}
+
 static int get_groups(const char* cmd) {
     FILE* fp;
     logcat_define(ctx);
diff --git a/logd/LogBuffer.cpp b/logd/LogBuffer.cpp
index 352fc18..86ea6b4 100644
--- a/logd/LogBuffer.cpp
+++ b/logd/LogBuffer.cpp
@@ -132,11 +132,11 @@
                                  LogBufferElement* last) {
     // is it mostly identical?
     //  if (!elem) return DIFFERENT;
-    unsigned short lenl = elem->getMsgLen();
-    if (!lenl) return DIFFERENT;
+    ssize_t lenl = elem->getMsgLen();
+    if (lenl <= 0) return DIFFERENT;  // value if this represents a chatty elem
     //  if (!last) return DIFFERENT;
-    unsigned short lenr = last->getMsgLen();
-    if (!lenr) return DIFFERENT;
+    ssize_t lenr = last->getMsgLen();
+    if (lenr <= 0) return DIFFERENT;  // value if this represents a chatty elem
     //  if (elem->getLogId() != last->getLogId()) return DIFFERENT;
     if (elem->getUid() != last->getUid()) return DIFFERENT;
     if (elem->getPid() != last->getPid()) return DIFFERENT;
@@ -162,8 +162,6 @@
     }
 
     // audit message (except sequence number) identical?
-    static const char avc[] = "): avc: ";
-
     if (last->isBinary()) {
         if (fastcmp<memcmp>(msgl, msgr, sizeof(android_log_event_string_t) -
                                             sizeof(int32_t)))
@@ -173,6 +171,7 @@
         msgr += sizeof(android_log_event_string_t);
         lenr -= sizeof(android_log_event_string_t);
     }
+    static const char avc[] = "): avc: ";
     const char* avcl = android::strnstr(msgl, lenl, avc);
     if (!avcl) return DIFFERENT;
     lenl -= avcl - msgl;
@@ -180,10 +179,7 @@
     if (!avcr) return DIFFERENT;
     lenr -= avcr - msgr;
     if (lenl != lenr) return DIFFERENT;
-    // TODO: After b/35468874 is addressed, revisit "lenl > strlen(avc)"
-    // condition, it might become superfluous.
-    if (lenl > strlen(avc) &&
-        fastcmp<memcmp>(avcl + strlen(avc), avcr + strlen(avc),
+    if (fastcmp<memcmp>(avcl + strlen(avc), avcr + strlen(avc),
                         lenl - strlen(avc))) {
         return DIFFERENT;
     }
@@ -1092,12 +1088,12 @@
         // client wants to start from the beginning
         it = mLogElements.begin();
     } else {
-        LogBufferElementCollection::iterator last = mLogElements.begin();
+        LogBufferElementCollection::iterator last;
         // 30 second limit to continue search for out-of-order entries.
         log_time min = start - log_time(30, 0);
         // Client wants to start from some specified time. Chances are
         // we are better off starting from the end of the time sorted list.
-        for (it = mLogElements.end(); it != mLogElements.begin();
+        for (last = it = mLogElements.end(); it != mLogElements.begin();
              /* do nothing */) {
             --it;
             LogBufferElement* element = *it;
diff --git a/logd/LogKlog.cpp b/logd/LogKlog.cpp
index 9dfa14e..d23254d 100644
--- a/logd/LogKlog.cpp
+++ b/logd/LogKlog.cpp
@@ -37,46 +37,49 @@
 
 static const char priority_message[] = { KMSG_PRIORITY(LOG_INFO), '\0' };
 
+// List of the _only_ needles we supply here to android::strnstr
+static const char suspendStr[] = "PM: suspend entry ";
+static const char resumeStr[] = "PM: suspend exit ";
+static const char suspendedStr[] = "Suspended for ";
+static const char healthdStr[] = "healthd";
+static const char batteryStr[] = ": battery ";
+static const char auditStr[] = " audit(";
+static const char klogdStr[] = "logd.klogd: ";
+
 // Parsing is hard
 
 // called if we see a '<', s is the next character, returns pointer after '>'
-static char* is_prio(char* s, size_t len) {
-    if (!len || !isdigit(*s++)) {
-        return NULL;
-    }
+static char* is_prio(char* s, ssize_t len) {
+    if ((len <= 0) || !isdigit(*s++)) return nullptr;
     --len;
     static const size_t max_prio_len = (len < 4) ? len : 4;
     size_t priolen = 0;
     char c;
     while (((c = *s++)) && (++priolen <= max_prio_len)) {
-        if (!isdigit(c)) {
-            return ((c == '>') && (*s == '[')) ? s : NULL;
-        }
+        if (!isdigit(c)) return ((c == '>') && (*s == '[')) ? s : nullptr;
     }
-    return NULL;
+    return nullptr;
 }
 
 // called if we see a '[', s is the next character, returns pointer after ']'
-static char* is_timestamp(char* s, size_t len) {
-    while (len && (*s == ' ')) {
+static char* is_timestamp(char* s, ssize_t len) {
+    while ((len > 0) && (*s == ' ')) {
         ++s;
         --len;
     }
-    if (!len || !isdigit(*s++)) {
-        return NULL;
-    }
+    if ((len <= 0) || !isdigit(*s++)) return nullptr;
     --len;
     bool first_period = true;
     char c;
-    while (len && ((c = *s++))) {
+    while ((len > 0) && ((c = *s++))) {
         --len;
         if ((c == '.') && first_period) {
             first_period = false;
         } else if (!isdigit(c)) {
-            return ((c == ']') && !first_period && (*s == ' ')) ? s : NULL;
+            return ((c == ']') && !first_period && (*s == ' ')) ? s : nullptr;
         }
     }
-    return NULL;
+    return nullptr;
 }
 
 // Like strtok_r with "\r\n" except that we look for log signatures (regex)
@@ -93,96 +96,82 @@
 // space is one more than <digit> of 9
 #define OPEN_BRACKET_SPACE ((char)(OPEN_BRACKET_SIG | 10))
 
-char* log_strntok_r(char* s, size_t* len, char** last, size_t* sublen) {
-    *sublen = 0;
-    if (!*len) {
-        return NULL;
-    }
+char* android::log_strntok_r(char* s, ssize_t& len, char*& last,
+                             ssize_t& sublen) {
+    sublen = 0;
+    if (len <= 0) return nullptr;
     if (!s) {
-        if (!(s = *last)) {
-            return NULL;
-        }
+        if (!(s = last)) return nullptr;
         // fixup for log signature split <,
         // LESS_THAN_SIG + <digit>
         if ((*s & SIGNATURE_MASK) == LESS_THAN_SIG) {
             *s = (*s & ~SIGNATURE_MASK) + '0';
             *--s = '<';
-            ++*len;
+            ++len;
         }
         // fixup for log signature split [,
         // OPEN_BRACKET_SPACE is space, OPEN_BRACKET_SIG + <digit>
         if ((*s & SIGNATURE_MASK) == OPEN_BRACKET_SIG) {
-            if (*s == OPEN_BRACKET_SPACE) {
-                *s = ' ';
-            } else {
-                *s = (*s & ~SIGNATURE_MASK) + '0';
-            }
+            *s = (*s == OPEN_BRACKET_SPACE) ? ' ' : (*s & ~SIGNATURE_MASK) + '0';
             *--s = '[';
-            ++*len;
+            ++len;
         }
     }
 
-    while (*len && ((*s == '\r') || (*s == '\n'))) {
+    while ((len > 0) && ((*s == '\r') || (*s == '\n'))) {
         ++s;
-        --*len;
+        --len;
     }
 
-    if (!*len) {
-        *last = NULL;
-        return NULL;
-    }
+    if (len <= 0) return last = nullptr;
     char *peek, *tok = s;
 
     for (;;) {
-        if (*len == 0) {
-            *last = NULL;
+        if (len <= 0) {
+            last = nullptr;
             return tok;
         }
         char c = *s++;
-        --*len;
-        size_t adjust;
+        --len;
+        ssize_t adjust;
         switch (c) {
             case '\r':
             case '\n':
                 s[-1] = '\0';
-                *last = s;
+                last = s;
                 return tok;
 
             case '<':
-                peek = is_prio(s, *len);
-                if (!peek) {
-                    break;
-                }
+                peek = is_prio(s, len);
+                if (!peek) break;
                 if (s != (tok + 1)) {  // not first?
                     s[-1] = '\0';
                     *s &= ~SIGNATURE_MASK;
                     *s |= LESS_THAN_SIG;  // signature for '<'
-                    *last = s;
+                    last = s;
                     return tok;
                 }
                 adjust = peek - s;
-                if (adjust > *len) {
-                    adjust = *len;
+                if (adjust > len) {
+                    adjust = len;
                 }
-                *sublen += adjust;
-                *len -= adjust;
+                sublen += adjust;
+                len -= adjust;
                 s = peek;
-                if ((*s == '[') && ((peek = is_timestamp(s + 1, *len - 1)))) {
+                if ((*s == '[') && ((peek = is_timestamp(s + 1, len - 1)))) {
                     adjust = peek - s;
-                    if (adjust > *len) {
-                        adjust = *len;
+                    if (adjust > len) {
+                        adjust = len;
                     }
-                    *sublen += adjust;
-                    *len -= adjust;
+                    sublen += adjust;
+                    len -= adjust;
                     s = peek;
                 }
                 break;
 
             case '[':
-                peek = is_timestamp(s, *len);
-                if (!peek) {
-                    break;
-                }
+                peek = is_timestamp(s, len);
+                if (!peek) break;
                 if (s != (tok + 1)) {  // not first?
                     s[-1] = '\0';
                     if (*s == ' ') {
@@ -191,19 +180,19 @@
                         *s &= ~SIGNATURE_MASK;
                         *s |= OPEN_BRACKET_SIG;  // signature for '['
                     }
-                    *last = s;
+                    last = s;
                     return tok;
                 }
                 adjust = peek - s;
-                if (adjust > *len) {
-                    adjust = *len;
+                if (adjust > len) {
+                    adjust = len;
                 }
-                *sublen += adjust;
-                *len -= adjust;
+                sublen += adjust;
+                len -= adjust;
                 s = peek;
                 break;
         }
-        ++*sublen;
+        ++sublen;
     }
     // NOTREACHED
 }
@@ -222,9 +211,10 @@
       initialized(false),
       enableLogging(true),
       auditd(auditd) {
-    static const char klogd_message[] = "%slogd.klogd: %" PRIu64 "\n";
-    char buffer[sizeof(priority_message) + sizeof(klogd_message) + 20 - 4];
-    snprintf(buffer, sizeof(buffer), klogd_message, priority_message,
+    static const char klogd_message[] = "%s%s%" PRIu64 "\n";
+    char buffer[strlen(priority_message) + strlen(klogdStr) +
+                strlen(klogd_message) + 20];
+    snprintf(buffer, sizeof(buffer), klogd_message, priority_message, klogdStr,
              signature.nsec());
     write(fdWrite, buffer, strlen(buffer));
 }
@@ -237,15 +227,15 @@
     }
 
     char buffer[LOGGER_ENTRY_MAX_PAYLOAD];
-    size_t len = 0;
+    ssize_t len = 0;
 
     for (;;) {
         ssize_t retval = 0;
-        if ((sizeof(buffer) - 1 - len) > 0) {
+        if (len < (ssize_t)(sizeof(buffer) - 1)) {
             retval =
                 read(cli->getSocket(), buffer + len, sizeof(buffer) - 1 - len);
         }
-        if ((retval == 0) && (len == 0)) {
+        if ((retval == 0) && (len <= 0)) {
             break;
         }
         if (retval < 0) {
@@ -255,15 +245,16 @@
         bool full = len == (sizeof(buffer) - 1);
         char* ep = buffer + len;
         *ep = '\0';
-        size_t sublen;
-        for (char *ptr = NULL, *tok = buffer;
-             ((tok = log_strntok_r(tok, &len, &ptr, &sublen))); tok = NULL) {
+        ssize_t sublen;
+        for (char *ptr = nullptr, *tok = buffer;
+             !!(tok = android::log_strntok_r(tok, len, ptr, sublen));
+             tok = nullptr) {
             if (((tok + sublen) >= ep) && (retval != 0) && full) {
-                memmove(buffer, tok, sublen);
+                if (sublen > 0) memmove(buffer, tok, sublen);
                 len = sublen;
                 break;
             }
-            if (*tok) {
+            if ((sublen > 0) && *tok) {
                 log(tok, sublen);
             }
         }
@@ -273,9 +264,12 @@
 }
 
 void LogKlog::calculateCorrection(const log_time& monotonic,
-                                  const char* real_string, size_t len) {
+                                  const char* real_string, ssize_t len) {
+    static const char real_format[] = "%Y-%m-%d %H:%M:%S.%09q UTC";
+    if (len < (ssize_t)(strlen(real_format) + 5)) return;
+
     log_time real;
-    const char* ep = real.strptime(real_string, "%Y-%m-%d %H:%M:%S.%09q UTC");
+    const char* ep = real.strptime(real_string, real_format);
     if (!ep || (ep > &real_string[len]) || (real > log_time(CLOCK_REALTIME))) {
         return;
     }
@@ -299,73 +293,50 @@
     }
 }
 
-static const char suspendStr[] = "PM: suspend entry ";
-static const char resumeStr[] = "PM: suspend exit ";
-static const char suspendedStr[] = "Suspended for ";
-
-const char* android::strnstr(const char* s, size_t len, const char* needle) {
-    char c;
-
-    if (!len) return NULL;
-    if ((c = *needle++) != 0) {
-        size_t needleLen = strlen(needle);
-        do {
-            do {
-                if (len <= needleLen) return NULL;
-                --len;
-            } while (*s++ != c);
-        } while (fastcmp<memcmp>(s, needle, needleLen));
-        s--;
-    }
-    return s;
-}
-
-void LogKlog::sniffTime(log_time& now, const char** buf, size_t len,
+void LogKlog::sniffTime(log_time& now, const char*& buf, ssize_t len,
                         bool reverse) {
-    const char* cp = now.strptime(*buf, "[ %s.%q]");
-    if (cp && (cp >= &(*buf)[len])) {
-        cp = NULL;
+    if (len <= 0) return;
+
+    const char* cp = nullptr;
+    if ((len > 10) && (*buf == '[')) {
+        cp = now.strptime(buf, "[ %s.%q]");  // can index beyond buffer bounds
+        if (cp && (cp > &buf[len - 1])) cp = nullptr;
     }
     if (cp) {
-        static const char healthd[] = "healthd";
-        static const char battery[] = ": battery ";
-
-        len -= cp - *buf;
-        if (len && isspace(*cp)) {
+        len -= cp - buf;
+        if ((len > 0) && isspace(*cp)) {
             ++cp;
             --len;
         }
-        *buf = cp;
+        buf = cp;
 
-        if (isMonotonic()) {
-            return;
-        }
+        if (isMonotonic()) return;
 
         const char* b;
         if (((b = android::strnstr(cp, len, suspendStr))) &&
-            ((size_t)((b += sizeof(suspendStr) - 1) - cp) < len)) {
+            (((b += strlen(suspendStr)) - cp) < len)) {
             len -= b - cp;
             calculateCorrection(now, b, len);
         } else if (((b = android::strnstr(cp, len, resumeStr))) &&
-                   ((size_t)((b += sizeof(resumeStr) - 1) - cp) < len)) {
+                   (((b += strlen(resumeStr)) - cp) < len)) {
             len -= b - cp;
             calculateCorrection(now, b, len);
-        } else if (((b = android::strnstr(cp, len, healthd))) &&
-                   ((size_t)((b += sizeof(healthd) - 1) - cp) < len) &&
-                   ((b = android::strnstr(b, len -= b - cp, battery))) &&
-                   ((size_t)((b += sizeof(battery) - 1) - cp) < len)) {
+        } else if (((b = android::strnstr(cp, len, healthdStr))) &&
+                   (((b += strlen(healthdStr)) - cp) < len) &&
+                   ((b = android::strnstr(b, len -= b - cp, batteryStr))) &&
+                   (((b += strlen(batteryStr)) - cp) < len)) {
             // NB: healthd is roughly 150us late, so we use it instead to
             //     trigger a check for ntp-induced or hardware clock drift.
             log_time real(CLOCK_REALTIME);
             log_time mono(CLOCK_MONOTONIC);
             correction = (real < mono) ? log_time::EPOCH : (real - mono);
         } else if (((b = android::strnstr(cp, len, suspendedStr))) &&
-                   ((size_t)((b += sizeof(suspendStr) - 1) - cp) < len)) {
+                   (((b += strlen(suspendStr)) - cp) < len)) {
             len -= b - cp;
             log_time real;
             char* endp;
             real.tv_sec = strtol(b, &endp, 10);
-            if ((*endp == '.') && ((size_t)(endp - b) < len)) {
+            if ((*endp == '.') && ((endp - b) < len)) {
                 unsigned long multiplier = NS_PER_SEC;
                 real.tv_nsec = 0;
                 len -= endp - b;
@@ -394,8 +365,15 @@
     }
 }
 
-pid_t LogKlog::sniffPid(const char** buf, size_t len) {
-    const char* cp = *buf;
+pid_t LogKlog::sniffPid(const char*& buf, ssize_t len) {
+    if (len <= 0) return 0;
+
+    const char* cp = buf;
+    // sscanf does a strlen, let's check if the string is not nul terminated.
+    // pseudo out-of-bounds access since we always have an extra char on buffer.
+    if (((ssize_t)strnlen(cp, len) == len) && cp[len]) {
+        return 0;
+    }
     // HTC kernels with modified printk "c0   1648 "
     if ((len > 9) && (cp[0] == 'c') && isdigit(cp[1]) &&
         (isdigit(cp[2]) || (cp[2] == ' ')) && (cp[3] == ' ')) {
@@ -412,7 +390,7 @@
             int pid = 0;
             char dummy;
             if (sscanf(cp + 4, "%d%c", &pid, &dummy) == 2) {
-                *buf = cp + 10;  // skip-it-all
+                buf = cp + 10;  // skip-it-all
                 return pid;
             }
         }
@@ -434,28 +412,28 @@
 }
 
 // kernel log prefix, convert to a kernel log priority number
-static int parseKernelPrio(const char** buf, size_t len) {
+static int parseKernelPrio(const char*& buf, ssize_t len) {
     int pri = LOG_USER | LOG_INFO;
-    const char* cp = *buf;
-    if (len && (*cp == '<')) {
+    const char* cp = buf;
+    if ((len > 0) && (*cp == '<')) {
         pri = 0;
         while (--len && isdigit(*++cp)) {
             pri = (pri * 10) + *cp - '0';
         }
-        if (len && (*cp == '>')) {
+        if ((len > 0) && (*cp == '>')) {
             ++cp;
         } else {
-            cp = *buf;
+            cp = buf;
             pri = LOG_USER | LOG_INFO;
         }
-        *buf = cp;
+        buf = cp;
     }
     return pri;
 }
 
 // Passed the entire SYSLOG_ACTION_READ_ALL buffer and interpret a
 // compensated start time.
-void LogKlog::synchronize(const char* buf, size_t len) {
+void LogKlog::synchronize(const char* buf, ssize_t len) {
     const char* cp = android::strnstr(buf, len, suspendStr);
     if (!cp) {
         cp = android::strnstr(buf, len, resumeStr);
@@ -471,10 +449,10 @@
     if (*cp == '\n') {
         ++cp;
     }
-    parseKernelPrio(&cp, len - (cp - buf));
+    parseKernelPrio(cp, len - (cp - buf));
 
     log_time now;
-    sniffTime(now, &cp, len - (cp - buf), true);
+    sniffTime(now, cp, len - (cp - buf), true);
 
     const char* suspended = android::strnstr(buf, len, suspendedStr);
     if (!suspended || (suspended > cp)) {
@@ -488,9 +466,9 @@
     if (*cp == '\n') {
         ++cp;
     }
-    parseKernelPrio(&cp, len - (cp - buf));
+    parseKernelPrio(cp, len - (cp - buf));
 
-    sniffTime(now, &cp, len - (cp - buf), true);
+    sniffTime(now, cp, len - (cp - buf), true);
 }
 
 // Convert kernel log priority number into an Android Logger priority number
@@ -523,9 +501,9 @@
     return ANDROID_LOG_INFO;
 }
 
-static const char* strnrchr(const char* s, size_t len, char c) {
-    const char* save = NULL;
-    for (; len; ++s, len--) {
+static const char* strnrchr(const char* s, ssize_t len, char c) {
+    const char* save = nullptr;
+    for (; len > 0; ++s, len--) {
         if (*s == c) {
             save = s;
         }
@@ -566,22 +544,21 @@
 //  logd.klogd:
 // return -1 if message logd.klogd: <signature>
 //
-int LogKlog::log(const char* buf, size_t len) {
-    if (auditd && android::strnstr(buf, len, " audit(")) {
+int LogKlog::log(const char* buf, ssize_t len) {
+    if (auditd && android::strnstr(buf, len, auditStr)) {
         return 0;
     }
 
     const char* p = buf;
-    int pri = parseKernelPrio(&p, len);
+    int pri = parseKernelPrio(p, len);
 
     log_time now;
-    sniffTime(now, &p, len - (p - buf), false);
+    sniffTime(now, p, len - (p - buf), false);
 
     // sniff for start marker
-    const char klogd_message[] = "logd.klogd: ";
-    const char* start = android::strnstr(p, len - (p - buf), klogd_message);
+    const char* start = android::strnstr(p, len - (p - buf), klogdStr);
     if (start) {
-        uint64_t sig = strtoll(start + sizeof(klogd_message) - 1, NULL, 10);
+        uint64_t sig = strtoll(start + strlen(klogdStr), nullptr, 10);
         if (sig == signature.nsec()) {
             if (initialized) {
                 enableLogging = true;
@@ -598,7 +575,7 @@
     }
 
     // Parse pid, tid and uid
-    const pid_t pid = sniffPid(&p, len - (p - buf));
+    const pid_t pid = sniffPid(p, len - (p - buf));
     const pid_t tid = pid;
     uid_t uid = AID_ROOT;
     if (pid) {
@@ -620,11 +597,11 @@
     start = p;
     const char* tag = "";
     const char* etag = tag;
-    size_t taglen = len - (p - buf);
+    ssize_t taglen = len - (p - buf);
     const char* bt = p;
 
     static const char infoBrace[] = "[INFO]";
-    static const size_t infoBraceLen = strlen(infoBrace);
+    static const ssize_t infoBraceLen = strlen(infoBrace);
     if ((taglen >= infoBraceLen) &&
         !fastcmp<strncmp>(p, infoBrace, infoBraceLen)) {
         // <PRI>[<TIME>] "[INFO]"<tag> ":" message
@@ -633,26 +610,26 @@
     }
 
     const char* et;
-    for (et = bt; taglen && *et && (*et != ':') && !isspace(*et);
+    for (et = bt; (taglen > 0) && *et && (*et != ':') && !isspace(*et);
          ++et, --taglen) {
         // skip ':' within [ ... ]
         if (*et == '[') {
-            while (taglen && *et && *et != ']') {
+            while ((taglen > 0) && *et && *et != ']') {
                 ++et;
                 --taglen;
             }
-            if (!taglen) {
+            if (taglen <= 0) {
                 break;
             }
         }
     }
     const char* cp;
-    for (cp = et; taglen && isspace(*cp); ++cp, --taglen) {
+    for (cp = et; (taglen > 0) && isspace(*cp); ++cp, --taglen) {
     }
 
     // Validate tag
-    size_t size = et - bt;
-    if (taglen && size) {
+    ssize_t size = et - bt;
+    if ((taglen > 0) && (size > 0)) {
         if (*cp == ':') {
             // ToDo: handle case insensitive colon separated logging stutter:
             //       <tag> : <tag>: ...
@@ -672,12 +649,12 @@
                 const char* b = cp;
                 cp += size;
                 taglen -= size;
-                while (--taglen && !isspace(*++cp) && (*cp != ':')) {
+                while ((--taglen > 0) && !isspace(*++cp) && (*cp != ':')) {
                 }
                 const char* e;
-                for (e = cp; taglen && isspace(*cp); ++cp, --taglen) {
+                for (e = cp; (taglen > 0) && isspace(*cp); ++cp, --taglen) {
                 }
-                if (taglen && (*cp == ':')) {
+                if ((taglen > 0) && (*cp == ':')) {
                     tag = b;
                     etag = e;
                     p = cp + 1;
@@ -685,7 +662,7 @@
             } else {
                 // what about <PRI>[<TIME>] <tag>_host '<tag><stuff>' : message
                 static const char host[] = "_host";
-                static const size_t hostlen = strlen(host);
+                static const ssize_t hostlen = strlen(host);
                 if ((size > hostlen) &&
                     !fastcmp<strncmp>(bt + size - hostlen, host, hostlen) &&
                     !fastcmp<strncmp>(bt + 1, cp + 1, size - hostlen - 1)) {
@@ -693,12 +670,14 @@
                     cp += size - hostlen;
                     taglen -= size - hostlen;
                     if (*cp == '.') {
-                        while (--taglen && !isspace(*++cp) && (*cp != ':')) {
+                        while ((--taglen > 0) && !isspace(*++cp) &&
+                               (*cp != ':')) {
                         }
                         const char* e;
-                        for (e = cp; taglen && isspace(*cp); ++cp, --taglen) {
+                        for (e = cp; (taglen > 0) && isspace(*cp);
+                             ++cp, --taglen) {
                         }
-                        if (taglen && (*cp == ':')) {
+                        if ((taglen > 0) && (*cp == ':')) {
                             tag = b;
                             etag = e;
                             p = cp + 1;
@@ -711,13 +690,13 @@
         } else {
         // <PRI>[<TIME>] <tag> <stuff>' : message
         twoWord:
-            while (--taglen && !isspace(*++cp) && (*cp != ':')) {
+            while ((--taglen > 0) && !isspace(*++cp) && (*cp != ':')) {
             }
             const char* e;
-            for (e = cp; taglen && isspace(*cp); ++cp, --taglen) {
+            for (e = cp; (taglen > 0) && isspace(*cp); ++cp, --taglen) {
             }
             // Two words
-            if (taglen && (*cp == ':')) {
+            if ((taglen > 0) && (*cp == ':')) {
                 tag = bt;
                 etag = e;
                 p = cp + 1;
@@ -726,13 +705,13 @@
     }  // else no tag
 
     static const char cpu[] = "CPU";
-    static const size_t cpuLen = strlen(cpu);
+    static const ssize_t cpuLen = strlen(cpu);
     static const char warning[] = "WARNING";
-    static const size_t warningLen = strlen(warning);
+    static const ssize_t warningLen = strlen(warning);
     static const char error[] = "ERROR";
-    static const size_t errorLen = strlen(error);
+    static const ssize_t errorLen = strlen(error);
     static const char info[] = "INFO";
-    static const size_t infoLen = strlen(info);
+    static const ssize_t infoLen = strlen(info);
 
     size = etag - tag;
     if ((size <= 1) ||
@@ -756,13 +735,13 @@
     // Mediatek-special printk induced stutter
     const char* mp = strnrchr(tag, taglen, ']');
     if (mp && (++mp < etag)) {
-        size_t s = etag - mp;
+        ssize_t s = etag - mp;
         if (((s + s) < taglen) && !fastcmp<memcmp>(mp, mp - 1 - s, s)) {
             taglen = mp - tag;
         }
     }
     // Deal with sloppy and simplistic harmless p = cp + 1 etc above.
-    if (len < (size_t)(p - buf)) {
+    if (len < (p - buf)) {
         p = &buf[len];
     }
     // skip leading space
@@ -770,12 +749,12 @@
         ++p;
     }
     // truncate trailing space or nuls
-    size_t b = len - (p - buf);
-    while (b && (isspace(p[b - 1]) || !p[b - 1])) {
+    ssize_t b = len - (p - buf);
+    while ((b > 0) && (isspace(p[b - 1]) || !p[b - 1])) {
         --b;
     }
     // trick ... allow tag with empty content to be logged. log() drops empty
-    if (!b && taglen) {
+    if ((b <= 0) && (taglen > 0)) {
         p = " ";
         b = 1;
     }
@@ -787,9 +766,9 @@
         taglen = LOGGER_ENTRY_MAX_PAYLOAD;
     }
     // calculate buffer copy requirements
-    size_t n = 1 + taglen + 1 + b + 1;
+    ssize_t n = 1 + taglen + 1 + b + 1;
     // paranoid sanity check, first two just can not happen ...
-    if ((taglen > n) || (b > n) || (n > USHRT_MAX)) {
+    if ((taglen > n) || (b > n) || (n > (ssize_t)USHRT_MAX) || (n <= 0)) {
         return -EINVAL;
     }
 
diff --git a/logd/LogKlog.h b/logd/LogKlog.h
index 976afc8..bb92dd2 100644
--- a/logd/LogKlog.h
+++ b/logd/LogKlog.h
@@ -20,8 +20,6 @@
 #include <private/android_logger.h>
 #include <sysutils/SocketListener.h>
 
-char* log_strntok_r(char* s, size_t* len, char** saveptr, size_t* sublen);
-
 class LogBuffer;
 class LogReader;
 
@@ -43,8 +41,8 @@
    public:
     LogKlog(LogBuffer* buf, LogReader* reader, int fdWrite, int fdRead,
             bool auditd);
-    int log(const char* buf, size_t len);
-    void synchronize(const char* buf, size_t len);
+    int log(const char* buf, ssize_t len);
+    void synchronize(const char* buf, ssize_t len);
 
     bool isMonotonic() {
         return logbuf->isMonotonic();
@@ -57,10 +55,10 @@
     }
 
    protected:
-    void sniffTime(log_time& now, const char** buf, size_t len, bool reverse);
-    pid_t sniffPid(const char** buf, size_t len);
+    void sniffTime(log_time& now, const char*& buf, ssize_t len, bool reverse);
+    pid_t sniffPid(const char*& buf, ssize_t len);
     void calculateCorrection(const log_time& monotonic, const char* real_string,
-                             size_t len);
+                             ssize_t len);
     virtual bool onDataAvailable(SocketClient* cli);
 };
 
diff --git a/logd/LogUtils.h b/logd/LogUtils.h
index 93d2a79..fa9f398 100644
--- a/logd/LogUtils.h
+++ b/logd/LogUtils.h
@@ -43,8 +43,25 @@
 const char* tagToName(uint32_t tag);
 void ReReadEventLogTags();
 
-// Furnished by LogKlog.cpp.
-const char* strnstr(const char* s, size_t len, const char* needle);
+// Furnished by LogKlog.cpp
+char* log_strntok_r(char* s, ssize_t& len, char*& saveptr, ssize_t& sublen);
+
+// needle should reference a string longer than 1 character
+static inline const char* strnstr(const char* s, ssize_t len,
+                                  const char* needle) {
+    if (len <= 0) return nullptr;
+
+    const char c = *needle++;
+    const size_t needleLen = strlen(needle);
+    do {
+        do {
+            if (len <= (ssize_t)needleLen) return nullptr;
+            --len;
+        } while (*s++ != c);
+    } while (fastcmp<memcmp>(s, needle, needleLen));
+    s--;
+    return s;
+}
 }
 
 // Furnished in LogCommand.cpp
diff --git a/logd/main.cpp b/logd/main.cpp
index 3334506..946485b 100644
--- a/logd/main.cpp
+++ b/logd/main.cpp
@@ -221,7 +221,7 @@
 
 static sem_t reinit;
 static bool reinit_running = false;
-static LogBuffer* logBuf = NULL;
+static LogBuffer* logBuf = nullptr;
 
 static bool package_list_parser_cb(pkg_info* info, void* /* userdata */) {
     bool rc = true;
@@ -254,9 +254,9 @@
     while (reinit_running && !sem_wait(&reinit) && reinit_running) {
         // uidToName Privileged Worker
         if (uid) {
-            name = NULL;
+            name = nullptr;
 
-            packagelist_parse(package_list_parser_cb, NULL);
+            packagelist_parse(package_list_parser_cb, nullptr);
 
             uid = 0;
             sem_post(&uidName);
@@ -291,19 +291,19 @@
         // Anything that reads persist.<property>
         if (logBuf) {
             logBuf->init();
-            logBuf->initPrune(NULL);
+            logBuf->initPrune(nullptr);
         }
         android::ReReadEventLogTags();
     }
 
-    return NULL;
+    return nullptr;
 }
 
 static sem_t sem_name;
 
 char* android::uidToName(uid_t u) {
     if (!u || !reinit_running) {
-        return NULL;
+        return nullptr;
     }
 
     sem_wait(&sem_name);
@@ -311,7 +311,7 @@
     // Not multi-thread safe, we use sem_name to protect
     uid = u;
 
-    name = NULL;
+    name = nullptr;
     sem_post(&reinit);
     sem_wait(&uidName);
     char* ret = name;
@@ -332,12 +332,13 @@
         return;
     }
 
-    int rc = klogctl(KLOG_SIZE_BUFFER, NULL, 0);
+    int rc = klogctl(KLOG_SIZE_BUFFER, nullptr, 0);
     if (rc <= 0) {
         return;
     }
 
-    size_t len = rc + 1024;  // Margin for additional input race or trailing nul
+    // Margin for additional input race or trailing nul
+    ssize_t len = rc + 1024;
     std::unique_ptr<char[]> buf(new char[len]);
 
     rc = klogctl(KLOG_READ_ALL, buf.get(), len);
@@ -345,7 +346,7 @@
         return;
     }
 
-    if ((size_t)rc < len) {
+    if (rc < len) {
         len = rc + 1;
     }
     buf[--len] = '\0';
@@ -354,10 +355,11 @@
         kl->synchronize(buf.get(), len);
     }
 
-    size_t sublen;
-    for (char *ptr = NULL, *tok = buf.get();
-         (rc >= 0) && ((tok = log_strntok_r(tok, &len, &ptr, &sublen)));
-         tok = NULL) {
+    ssize_t sublen;
+    for (char *ptr = nullptr, *tok = buf.get();
+         (rc >= 0) && !!(tok = android::log_strntok_r(tok, len, ptr, sublen));
+         tok = nullptr) {
+        if ((sublen <= 0) || !*tok) continue;
         if (al) {
             rc = al->log(tok, sublen);
         }
@@ -444,7 +446,7 @@
         if (!pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED)) {
             pthread_t thread;
             reinit_running = true;
-            if (pthread_create(&thread, &attr, reinit_thread_start, NULL)) {
+            if (pthread_create(&thread, &attr, reinit_thread_start, nullptr)) {
                 reinit_running = false;
             }
         }
@@ -507,7 +509,7 @@
     // initiated log messages. New log entries are added to LogBuffer
     // and LogReader is notified to send updates to connected clients.
 
-    LogAudit* al = NULL;
+    LogAudit* al = nullptr;
     if (auditd) {
         al = new LogAudit(logBuf, reader,
                           __android_logger_property_get_bool(
@@ -516,9 +518,9 @@
                               : -1);
     }
 
-    LogKlog* kl = NULL;
+    LogKlog* kl = nullptr;
     if (klogd) {
-        kl = new LogKlog(logBuf, reader, fdDmesg, fdPmesg, al != NULL);
+        kl = new LogKlog(logBuf, reader, fdDmesg, fdPmesg, al != nullptr);
     }
 
     readDmesg(al, kl);