diff --git a/adb/adb.cpp b/adb/adb.cpp
index 0e1859c..1c1683e 100644
--- a/adb/adb.cpp
+++ b/adb/adb.cpp
@@ -395,6 +395,11 @@
                     D("Invalid A_OKAY(%d,%d), expected A_OKAY(%d,%d) on transport %s",
                       p->msg.arg0, p->msg.arg1, s->peer->id, p->msg.arg1, t->serial);
                 }
+            } else {
+                // When receiving A_OKAY from device for A_OPEN request, the host server may
+                // have closed the local socket because of client disconnection. Then we need
+                // to send A_CLSE back to device to close the service on device.
+                send_close(p->msg.arg1, p->msg.arg0, t);
             }
         }
         break;
diff --git a/adb/adb.h b/adb/adb.h
index a20b345..c284c8c 100644
--- a/adb/adb.h
+++ b/adb/adb.h
@@ -50,7 +50,7 @@
 std::string adb_version();
 
 // Increment this when we want to force users to start a new adb server.
-#define ADB_SERVER_VERSION 33
+#define ADB_SERVER_VERSION 34
 
 class atransport;
 struct usb_handle;
diff --git a/adb/commandline.cpp b/adb/commandline.cpp
index 8aad97d..d0ca67a 100644
--- a/adb/commandline.cpp
+++ b/adb/commandline.cpp
@@ -49,6 +49,7 @@
 #include "adb_io.h"
 #include "adb_utils.h"
 #include "file_sync_service.h"
+#include "services.h"
 #include "shell_service.h"
 #include "transport.h"
 
@@ -108,10 +109,11 @@
         "                                 ('-a' means copy timestamp and mode)\n"
         "  adb sync [ <directory> ]     - copy host->device only if changed\n"
         "                                 (-l means list but don't copy)\n"
-        "  adb shell                    - run remote shell interactively\n"
-        "  adb shell [-Tt] <command>    - run remote shell command\n"
+        "  adb shell [-Ttx]             - run remote shell interactively\n"
+        "  adb shell [-Ttx] <command>   - run remote shell command\n"
         "                                 (-T disables PTY allocation)\n"
         "                                 (-t forces PTY allocation)\n"
+        "                                 (-x disables remote exit codes and stdout/stderr separation)\n"
         "  adb emu <command>            - run emulator console command\n"
         "  adb logcat [ <filter-spec> ] - View device log\n"
         "  adb forward --list           - list all forward socket connections.\n"
@@ -785,12 +787,45 @@
     return adb_command(cmd);
 }
 
+// Returns a shell service string with the indicated arguments and command.
+static std::string ShellServiceString(bool use_shell_protocol,
+                                      const std::string& type_arg,
+                                      const std::string& command) {
+    std::vector<std::string> args;
+    if (use_shell_protocol) {
+        args.push_back(kShellServiceArgShellProtocol);
+    }
+    if (!type_arg.empty()) {
+        args.push_back(type_arg);
+    }
+
+    // Shell service string can look like: shell[,arg1,arg2,...]:[command].
+    return android::base::StringPrintf("shell%s%s:%s",
+                                       args.empty() ? "" : ",",
+                                       android::base::Join(args, ',').c_str(),
+                                       command.c_str());
+}
+
+// Connects to the device "shell" service with |command| and prints the
+// resulting output.
 static int send_shell_command(TransportType transport_type, const char* serial,
-                              const std::string& command) {
+                              const std::string& command,
+                              bool disable_shell_protocol) {
+    // Only use shell protocol if it's supported and the caller doesn't want
+    // to explicitly disable it.
+    bool use_shell_protocol = false;
+    if (!disable_shell_protocol) {
+        FeatureSet features = GetFeatureSet(transport_type, serial);
+        use_shell_protocol = CanUseFeature(features, kFeatureShell2);
+    }
+
+    std::string service_string = ShellServiceString(use_shell_protocol, "",
+                                                    command);
+
     int fd;
     while (true) {
         std::string error;
-        fd = adb_connect(command, &error);
+        fd = adb_connect(service_string, &error);
         if (fd >= 0) {
             break;
         }
@@ -799,8 +834,7 @@
         wait_for_device("wait-for-device", transport_type, serial);
     }
 
-    FeatureSet features = GetFeatureSet(transport_type, serial);
-    int exit_code = read_and_dump(fd, features.count(kFeatureShell2) > 0);
+    int exit_code = read_and_dump(fd, use_shell_protocol);
 
     if (adb_close(fd) < 0) {
         PLOG(ERROR) << "failure closing FD " << fd;
@@ -813,7 +847,7 @@
     char* log_tags = getenv("ANDROID_LOG_TAGS");
     std::string quoted = escape_arg(log_tags == nullptr ? "" : log_tags);
 
-    std::string cmd = "shell:export ANDROID_LOG_TAGS=\"" + quoted + "\"; exec logcat";
+    std::string cmd = "export ANDROID_LOG_TAGS=\"" + quoted + "\"; exec logcat";
 
     if (!strcmp(argv[0], "longcat")) {
         cmd += " -v long";
@@ -825,7 +859,8 @@
         cmd += " " + escape_arg(*argv++);
     }
 
-    return send_shell_command(transport, serial, cmd);
+    // No need for shell protocol with logcat, always disable for simplicity.
+    return send_shell_command(transport, serial, cmd, true);
 }
 
 static int backup(int argc, const char** argv) {
@@ -1241,7 +1276,7 @@
 
         FeatureSet features = GetFeatureSet(transport_type, serial);
 
-        bool use_shell_protocol = (features.count(kFeatureShell2) > 0);
+        bool use_shell_protocol = CanUseFeature(features, kFeatureShell2);
         if (!use_shell_protocol) {
             D("shell protocol not supported, using raw data transfer");
         } else {
@@ -1255,19 +1290,22 @@
         std::string shell_type_arg;
         while (argc) {
             if (!strcmp(argv[0], "-T") || !strcmp(argv[0], "-t")) {
-                if (features.count(kFeatureShell2) == 0) {
+                if (!CanUseFeature(features, kFeatureShell2)) {
                     fprintf(stderr, "error: target doesn't support PTY args -Tt\n");
                     return 1;
                 }
-                shell_type_arg = argv[0];
+                shell_type_arg = (argv[0][1] == 'T') ? kShellServiceArgRaw
+                                                     : kShellServiceArgPty;
+                --argc;
+                ++argv;
+            } else if (!strcmp(argv[0], "-x")) {
+                use_shell_protocol = false;
                 --argc;
                 ++argv;
             } else {
                 break;
             }
         }
-        std::string service_string = android::base::StringPrintf(
-                "shell%s:", shell_type_arg.c_str());
 
         if (h) {
             printf("\x1b[41;33m");
@@ -1276,6 +1314,8 @@
 
         if (!argc) {
             D("starting interactive shell");
+            std::string service_string =
+                    ShellServiceString(use_shell_protocol, shell_type_arg, "");
             r = interactive_shell(service_string, use_shell_protocol);
             if (h) {
                 printf("\x1b[0m");
@@ -1285,8 +1325,10 @@
         }
 
         // We don't escape here, just like ssh(1). http://b/20564385.
-        service_string += android::base::Join(
+        std::string command = android::base::Join(
                 std::vector<const char*>(argv, argv + argc), ' ');
+        std::string service_string =
+                ShellServiceString(use_shell_protocol, shell_type_arg, command);
 
         while (true) {
             D("non-interactive shell loop. cmd=%s", service_string.c_str());
@@ -1389,7 +1431,9 @@
     }
     else if (!strcmp(argv[0], "bugreport")) {
         if (argc != 1) return usage();
-        return send_shell_command(transport_type, serial, "shell:bugreport");
+        // No need for shell protocol with bugreport, always disable for
+        // simplicity.
+        return send_shell_command(transport_type, serial, "bugreport", true);
     }
     else if (!strcmp(argv[0], "forward") || !strcmp(argv[0], "reverse")) {
         bool reverse = !strcmp(argv[0], "reverse");
@@ -1566,7 +1610,7 @@
         // Only list the features common to both the adb client and the device.
         FeatureSet features = GetFeatureSet(transport_type, serial);
         for (const std::string& name : features) {
-            if (supported_features().count(name) > 0) {
+            if (CanUseFeature(features, name)) {
                 printf("%s\n", name.c_str());
             }
         }
@@ -1578,13 +1622,15 @@
 }
 
 static int pm_command(TransportType transport, const char* serial, int argc, const char** argv) {
-    std::string cmd = "shell:pm";
+    std::string cmd = "pm";
 
     while (argc-- > 0) {
         cmd += " " + escape_arg(*argv++);
     }
 
-    return send_shell_command(transport, serial, cmd);
+    // TODO(dpursell): add command-line arguments to install/uninstall to
+    // manually disable shell protocol if needed.
+    return send_shell_command(transport, serial, cmd, false);
 }
 
 static int uninstall_app(TransportType transport, const char* serial, int argc, const char** argv) {
@@ -1605,8 +1651,8 @@
 }
 
 static int delete_file(TransportType transport, const char* serial, const std::string& filename) {
-    std::string cmd = "shell:rm -f " + escape_arg(filename);
-    return send_shell_command(transport, serial, cmd);
+    std::string cmd = "rm -f " + escape_arg(filename);
+    return send_shell_command(transport, serial, cmd, false);
 }
 
 static int install_app(TransportType transport, const char* serial, int argc, const char** argv) {
diff --git a/adb/fdevent.cpp b/adb/fdevent.cpp
index 2de9386..2ffd908 100644
--- a/adb/fdevent.cpp
+++ b/adb/fdevent.cpp
@@ -58,6 +58,12 @@
   PollNode(fdevent* fde) : fde(fde) {
       memset(&pollfd, 0, sizeof(pollfd));
       pollfd.fd = fde->fd;
+
+#if defined(__linux__)
+      // Always enable POLLRDHUP, so the host server can take action when some clients disconnect.
+      // Then we can avoid leaving many sockets in CLOSE_WAIT state. See http://b/23314034.
+      pollfd.events = POLLRDHUP;
+#endif
   }
 };
 
@@ -234,6 +240,11 @@
             // be detected at that point.
             events |= FDE_READ | FDE_ERROR;
         }
+#if defined(__linux__)
+        if (pollfd.revents & POLLRDHUP) {
+            events |= FDE_READ | FDE_ERROR;
+        }
+#endif
         if (events != 0) {
             auto it = g_poll_node_map.find(pollfd.fd);
             CHECK(it != g_poll_node_map.end());
diff --git a/adb/services.cpp b/adb/services.cpp
index 1153c31..e832b1e 100644
--- a/adb/services.cpp
+++ b/adb/services.cpp
@@ -46,6 +46,7 @@
 #include "adb_utils.h"
 #include "file_sync_service.h"
 #include "remount_service.h"
+#include "services.h"
 #include "shell_service.h"
 #include "transport.h"
 
@@ -195,33 +196,37 @@
 }
 
 // Shell service string can look like:
-//   shell[args]:[command]
-// Currently the only supported args are -T (force raw) and -t (force PTY).
+//   shell[,arg1,arg2,...]:[command]
 static int ShellService(const std::string& args, const atransport* transport) {
     size_t delimiter_index = args.find(':');
     if (delimiter_index == std::string::npos) {
         LOG(ERROR) << "No ':' found in shell service arguments: " << args;
         return -1;
     }
+
     const std::string service_args = args.substr(0, delimiter_index);
     const std::string command = args.substr(delimiter_index + 1);
 
-    SubprocessType type;
-    if (service_args.empty()) {
-        // Default: use PTY for interactive, raw for non-interactive.
-        type = (command.empty() ? SubprocessType::kPty : SubprocessType::kRaw);
-    } else if (service_args == "-T") {
-        type = SubprocessType::kRaw;
-    } else if (service_args == "-t") {
-        type = SubprocessType::kPty;
-    } else {
-        LOG(ERROR) << "Unsupported shell service arguments: " << args;
-        return -1;
-    }
+    // Defaults:
+    //   PTY for interactive, raw for non-interactive.
+    //   No protocol.
+    SubprocessType type(command.empty() ? SubprocessType::kPty
+                                        : SubprocessType::kRaw);
+    SubprocessProtocol protocol = SubprocessProtocol::kNone;
 
-    SubprocessProtocol protocol =
-            (transport->CanUseFeature(kFeatureShell2) ? SubprocessProtocol::kShell
-                                                      : SubprocessProtocol::kNone);
+    for (const std::string& arg : android::base::Split(service_args, ",")) {
+        if (arg == kShellServiceArgRaw) {
+            type = SubprocessType::kRaw;
+        } else if (arg == kShellServiceArgPty) {
+            type = SubprocessType::kPty;
+        } else if (arg == kShellServiceArgShellProtocol) {
+            protocol = SubprocessProtocol::kShell;
+        }
+        else if (!arg.empty()) {
+            LOG(ERROR) << "Unsupported shell service arguments: " << args;
+            return -1;
+        }
+    }
 
     return StartSubprocess(command.c_str(), type, protocol);
 }
diff --git a/adb/services.h b/adb/services.h
new file mode 100644
index 0000000..0428ca4
--- /dev/null
+++ b/adb/services.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SERVICES_H_
+#define SERVICES_H_
+
+constexpr char kShellServiceArgRaw[] = "raw";
+constexpr char kShellServiceArgPty[] = "pty";
+constexpr char kShellServiceArgShellProtocol[] = "v2";
+
+#endif  // SERVICES_H_
diff --git a/adb/socket_test.cpp b/adb/socket_test.cpp
index 8f395d1..03cab64 100644
--- a/adb/socket_test.cpp
+++ b/adb/socket_test.cpp
@@ -168,7 +168,7 @@
 // The socket is closing but having some packets, so it is not closed. Then
 // some write error happens in the socket's file handler, e.g., the file
 // handler is closed.
-TEST_F(LocalSocketTest, close_with_packet) {
+TEST_F(LocalSocketTest, close_socket_with_packet) {
     int socket_fd[2];
     ASSERT_EQ(0, adb_socketpair(socket_fd));
     int cause_close_fd[2];
@@ -193,13 +193,8 @@
     ASSERT_EQ(0, pthread_join(thread, nullptr));
 }
 
-#undef shutdown
-
 // This test checks if we can read packets from a closing local socket.
-// The socket's file handler may be non readable if the other side has
-// called shutdown(SHUT_WR). But we should always write packets
-// successfully to the other side.
-TEST_F(LocalSocketTest, half_close_with_packet) {
+TEST_F(LocalSocketTest, read_from_closing_socket) {
     int socket_fd[2];
     ASSERT_EQ(0, adb_socketpair(socket_fd));
     int cause_close_fd[2];
@@ -217,7 +212,6 @@
     ASSERT_EQ(0, adb_close(cause_close_fd[0]));
     sleep(1);
     ASSERT_EQ(2u, fdevent_installed_count());
-    ASSERT_EQ(0, shutdown(socket_fd[0], SHUT_WR));
 
     // Verify if we can read successfully.
     std::vector<char> buf(arg.bytes_written);
@@ -260,41 +254,56 @@
     ASSERT_EQ(0, pthread_join(thread, nullptr));
 }
 
-struct CloseNoEventsArg {
-    int socket_fd;
+#if defined(__linux__)
+
+static void ClientThreadFunc() {
+    std::string error;
+    int fd = network_loopback_client(5038, SOCK_STREAM, &error);
+    ASSERT_GE(fd, 0) << error;
+    sleep(2);
+    ASSERT_EQ(0, adb_close(fd));
+}
+
+struct CloseRdHupSocketArg {
+  int socket_fd;
 };
 
-static void CloseNoEventsThreadFunc(CloseNoEventsArg* arg) {
-    asocket* s = create_local_socket(arg->socket_fd);
-    ASSERT_TRUE(s != nullptr);
+static void CloseRdHupSocketThreadFunc(CloseRdHupSocketArg* arg) {
+  asocket* s = create_local_socket(arg->socket_fd);
+  ASSERT_TRUE(s != nullptr);
 
-    InstallDummySocket();
-    fdevent_loop();
+  InstallDummySocket();
+  fdevent_loop();
 }
 
-// This test checks when a local socket doesn't enable FDE_READ/FDE_WRITE/FDE_ERROR, it
-// can still be closed when some error happens on its file handler.
-// This test successes on linux but fails on mac because of different implementation of
-// poll(). I think the function tested here is useful to make adb server more stable on
-// linux.
-TEST_F(LocalSocketTest, close_with_no_events_installed) {
-    int socket_fd[2];
-    ASSERT_EQ(0, adb_socketpair(socket_fd));
+// This test checks if we can close sockets in CLOSE_WAIT state.
+TEST_F(LocalSocketTest, close_socket_in_CLOSE_WAIT_state) {
+  std::string error;
+  int listen_fd = network_inaddr_any_server(5038, SOCK_STREAM, &error);
+  ASSERT_GE(listen_fd, 0);
+  pthread_t client_thread;
+  ASSERT_EQ(0, pthread_create(&client_thread, nullptr,
+                              reinterpret_cast<void* (*)(void*)>(ClientThreadFunc), nullptr));
 
-    CloseNoEventsArg arg;
-    arg.socket_fd = socket_fd[1];
-    pthread_t thread;
-    ASSERT_EQ(0, pthread_create(&thread, nullptr,
-                                reinterpret_cast<void* (*)(void*)>(CloseNoEventsThreadFunc),
-                                &arg));
-    // Wait until the fdevent_loop() starts.
-    sleep(1);
-    ASSERT_EQ(2u, fdevent_installed_count());
-    ASSERT_EQ(0, adb_close(socket_fd[0]));
-
-    // Wait until the socket is closed.
-    sleep(1);
-
-    ASSERT_EQ(0, pthread_kill(thread, SIGUSR1));
-    ASSERT_EQ(0, pthread_join(thread, nullptr));
+  struct sockaddr addr;
+  socklen_t alen;
+  alen = sizeof(addr);
+  int accept_fd = adb_socket_accept(listen_fd, &addr, &alen);
+  ASSERT_GE(accept_fd, 0);
+  CloseRdHupSocketArg arg;
+  arg.socket_fd = accept_fd;
+  pthread_t thread;
+  ASSERT_EQ(0, pthread_create(&thread, nullptr,
+                              reinterpret_cast<void* (*)(void*)>(CloseRdHupSocketThreadFunc),
+                              &arg));
+  // Wait until the fdevent_loop() starts.
+  sleep(1);
+  ASSERT_EQ(2u, fdevent_installed_count());
+  // Wait until the client closes its socket.
+  ASSERT_EQ(0, pthread_join(client_thread, nullptr));
+  sleep(2);
+  ASSERT_EQ(0, pthread_kill(thread, SIGUSR1));
+  ASSERT_EQ(0, pthread_join(thread, nullptr));
 }
+
+#endif  // defined(__linux__)
diff --git a/adb/transport.cpp b/adb/transport.cpp
index 2a2fac7..501a39a 100644
--- a/adb/transport.cpp
+++ b/adb/transport.cpp
@@ -808,6 +808,11 @@
     return FeatureSet(names.begin(), names.end());
 }
 
+bool CanUseFeature(const FeatureSet& feature_set, const std::string& feature) {
+    return feature_set.count(feature) > 0 &&
+            supported_features().count(feature) > 0;
+}
+
 bool atransport::has_feature(const std::string& feature) const {
     return features_.count(feature) > 0;
 }
@@ -816,10 +821,6 @@
     features_ = StringToFeatureSet(features_string);
 }
 
-bool atransport::CanUseFeature(const std::string& feature) const {
-    return has_feature(feature) && supported_features().count(feature) > 0;
-}
-
 void atransport::AddDisconnect(adisconnect* disconnect) {
     disconnects_.push_back(disconnect);
 }
diff --git a/adb/transport.h b/adb/transport.h
index 0ec8ceb..dfe8875 100644
--- a/adb/transport.h
+++ b/adb/transport.h
@@ -33,9 +33,12 @@
 std::string FeatureSetToString(const FeatureSet& features);
 FeatureSet StringToFeatureSet(const std::string& features_string);
 
+// Returns true if both local features and |feature_set| support |feature|.
+bool CanUseFeature(const FeatureSet& feature_set, const std::string& feature);
+
 // Do not use any of [:;=,] in feature strings, they have special meaning
 // in the connection banner.
-constexpr char kFeatureShell2[] = "shell_2";
+constexpr char kFeatureShell2[] = "shell_v2";
 
 class atransport {
 public:
@@ -100,10 +103,6 @@
     // Loads the transport's feature set from the given string.
     void SetFeatures(const std::string& features_string);
 
-    // Returns true if both we and the other end of the transport support the
-    // feature.
-    bool CanUseFeature(const std::string& feature) const;
-
     void AddDisconnect(adisconnect* disconnect);
     void RemoveDisconnect(adisconnect* disconnect);
     void RunDisconnects();
diff --git a/fs_mgr/fs_mgr_verity.c b/fs_mgr/fs_mgr_verity.c
index a4a99c3..eddc3e4 100644
--- a/fs_mgr/fs_mgr_verity.c
+++ b/fs_mgr/fs_mgr_verity.c
@@ -47,6 +47,8 @@
 
 #define VERITY_METADATA_SIZE 32768
 #define VERITY_TABLE_RSA_KEY "/verity_key"
+#define VERITY_TABLE_HASH_IDX 8
+#define VERITY_TABLE_SALT_IDX 9
 
 #define METADATA_MAGIC 0x01564c54
 #define METADATA_TAG_MAX_LENGTH 63
@@ -141,6 +143,33 @@
     return retval;
 }
 
+static int invalidate_table(char *table, int table_length)
+{
+    int n = 0;
+    int idx = 0;
+    int cleared = 0;
+
+    while (n < table_length) {
+        if (table[n++] == ' ') {
+            ++idx;
+        }
+
+        if (idx != VERITY_TABLE_HASH_IDX && idx != VERITY_TABLE_SALT_IDX) {
+            continue;
+        }
+
+        while (n < table_length && table[n] != ' ') {
+            table[n++] = '0';
+        }
+
+        if (++cleared == 2) {
+            return 0;
+        }
+    }
+
+    return -1;
+}
+
 static int squashfs_get_target_device_size(char *blk_device, uint64_t *device_size)
 {
     struct squashfs_info sq_info;
@@ -957,6 +986,7 @@
     char *verity_blk_name = 0;
     char *verity_table = 0;
     char *verity_table_signature = 0;
+    int verity_table_length = 0;
     uint64_t device_size = 0;
 
     _Alignas(struct dm_ioctl) char buffer[DM_BUF_SIZE];
@@ -979,6 +1009,7 @@
     }
 
     retval = FS_MGR_SETUP_VERITY_FAIL;
+    verity_table_length = strlen(verity_table);
 
     // get the device mapper fd
     if ((fd = open("/dev/device-mapper", O_RDWR)) < 0) {
@@ -998,13 +1029,6 @@
         goto out;
     }
 
-    // verify the signature on the table
-    if (verify_table(verity_table_signature,
-                            verity_table,
-                            strlen(verity_table)) < 0) {
-        goto out;
-    }
-
     if (load_verity_state(fstab, &mode) < 0) {
         /* if accessing or updating the state failed, switch to the default
          * safe mode. This makes sure the device won't end up in an endless
@@ -1013,6 +1037,22 @@
         mode = VERITY_MODE_EIO;
     }
 
+    // verify the signature on the table
+    if (verify_table(verity_table_signature,
+                            verity_table,
+                            verity_table_length) < 0) {
+        if (mode == VERITY_MODE_LOGGING) {
+            // the user has been warned, allow mounting without dm-verity
+            retval = FS_MGR_SETUP_VERITY_SUCCESS;
+            goto out;
+        }
+
+        // invalidate root hash and salt to trigger device-specific recovery
+        if (invalidate_table(verity_table, verity_table_length) < 0) {
+            goto out;
+        }
+    }
+
     INFO("Enabling dm-verity for %s (mode %d)\n",  mount_point, mode);
 
     // load the verity mapping table
diff --git a/include/log/logprint.h b/include/log/logprint.h
index 4b812cc..26b1ee5 100644
--- a/include/log/logprint.h
+++ b/include/log/logprint.h
@@ -36,10 +36,12 @@
     FORMAT_TIME,
     FORMAT_THREADTIME,
     FORMAT_LONG,
-    /* The following three are modifiers to above formats */
+    /* The following are modifiers to above formats */
     FORMAT_MODIFIER_COLOR,     /* converts priority to color */
     FORMAT_MODIFIER_TIME_USEC, /* switches from msec to usec time precision */
     FORMAT_MODIFIER_PRINTABLE, /* converts non-printable to printable escapes */
+    FORMAT_MODIFIER_YEAR,      /* Adds year to date */
+    FORMAT_MODIFIER_ZONE,      /* Adds zone to date */
 } AndroidLogPrintFormat;
 
 typedef struct AndroidLogFormat_t AndroidLogFormat;
diff --git a/include/utils/LruCache.h b/include/utils/LruCache.h
index cd9d7f9..7818b4e 100644
--- a/include/utils/LruCache.h
+++ b/include/utils/LruCache.h
@@ -17,8 +17,11 @@
 #ifndef ANDROID_UTILS_LRU_CACHE_H
 #define ANDROID_UTILS_LRU_CACHE_H
 
+#include <unordered_set>
+
 #include <UniquePtr.h>
-#include <utils/BasicHashtable.h>
+
+#include "utils/TypeHelpers.h"  // hash_t
 
 namespace android {
 
@@ -36,6 +39,7 @@
 class LruCache {
 public:
     explicit LruCache(uint32_t maxCapacity);
+    virtual ~LruCache();
 
     enum Capacity {
         kUnlimitedCapacity,
@@ -50,32 +54,6 @@
     void clear();
     const TValue& peekOldestValue();
 
-    class Iterator {
-    public:
-        Iterator(const LruCache<TKey, TValue>& cache): mCache(cache), mIndex(-1) {
-        }
-
-        bool next() {
-            mIndex = mCache.mTable->next(mIndex);
-            return (ssize_t)mIndex != -1;
-        }
-
-        size_t index() const {
-            return mIndex;
-        }
-
-        const TValue& value() const {
-            return mCache.mTable->entryAt(mIndex).value;
-        }
-
-        const TKey& key() const {
-            return mCache.mTable->entryAt(mIndex).key;
-        }
-    private:
-        const LruCache<TKey, TValue>& mCache;
-        size_t mIndex;
-    };
-
 private:
     LruCache(const LruCache& that);  // disallow copy constructor
 
@@ -90,27 +68,79 @@
         const TKey& getKey() const { return key; }
     };
 
+    struct HashForEntry : public std::unary_function<Entry*, hash_t> {
+        size_t operator() (const Entry* entry) const {
+            return hash_type(entry->key);
+        };
+    };
+
+    struct EqualityForHashedEntries : public std::unary_function<Entry*, hash_t> {
+        bool operator() (const Entry* lhs, const Entry* rhs) const {
+            return lhs->key == rhs->key;
+        };
+    };
+
+    typedef std::unordered_set<Entry*, HashForEntry, EqualityForHashedEntries> LruCacheSet;
+
     void attachToCache(Entry& entry);
     void detachFromCache(Entry& entry);
-    void rehash(size_t newCapacity);
 
-    UniquePtr<BasicHashtable<TKey, Entry> > mTable;
+    typename LruCacheSet::iterator findByKey(const TKey& key) {
+        Entry entryForSearch(key, mNullValue);
+        typename LruCacheSet::iterator result = mSet->find(&entryForSearch);
+        return result;
+    }
+
+    UniquePtr<LruCacheSet> mSet;
     OnEntryRemoved<TKey, TValue>* mListener;
     Entry* mOldest;
     Entry* mYoungest;
     uint32_t mMaxCapacity;
     TValue mNullValue;
+
+public:
+    class Iterator {
+    public:
+        Iterator(const LruCache<TKey, TValue>& cache): mCache(cache), mIterator(mCache.mSet->begin()) {
+        }
+
+        bool next() {
+            if (mIterator == mCache.mSet->end()) {
+                return false;
+            }
+            std::advance(mIterator, 1);
+            return mIterator != mCache.mSet->end();
+        }
+
+        const TValue& value() const {
+            return (*mIterator)->value;
+        }
+
+        const TKey& key() const {
+            return (*mIterator)->key;
+        }
+    private:
+        const LruCache<TKey, TValue>& mCache;
+        typename LruCacheSet::iterator mIterator;
+    };
 };
 
 // Implementation is here, because it's fully templated
 template <typename TKey, typename TValue>
 LruCache<TKey, TValue>::LruCache(uint32_t maxCapacity)
-    : mTable(new BasicHashtable<TKey, Entry>)
+    : mSet(new LruCacheSet())
     , mListener(NULL)
     , mOldest(NULL)
     , mYoungest(NULL)
     , mMaxCapacity(maxCapacity)
     , mNullValue(NULL) {
+    mSet->max_load_factor(1.0);
+};
+
+template <typename TKey, typename TValue>
+LruCache<TKey, TValue>::~LruCache() {
+    // Need to delete created entries.
+    clear();
 };
 
 template<typename K, typename V>
@@ -120,20 +150,19 @@
 
 template <typename TKey, typename TValue>
 size_t LruCache<TKey, TValue>::size() const {
-    return mTable->size();
+    return mSet->size();
 }
 
 template <typename TKey, typename TValue>
 const TValue& LruCache<TKey, TValue>::get(const TKey& key) {
-    hash_t hash = hash_type(key);
-    ssize_t index = mTable->find(-1, hash, key);
-    if (index == -1) {
+    typename LruCacheSet::const_iterator find_result = findByKey(key);
+    if (find_result == mSet->end()) {
         return mNullValue;
     }
-    Entry& entry = mTable->editEntryAt(index);
-    detachFromCache(entry);
-    attachToCache(entry);
-    return entry.value;
+    Entry *entry = *find_result;
+    detachFromCache(*entry);
+    attachToCache(*entry);
+    return entry->value;
 }
 
 template <typename TKey, typename TValue>
@@ -142,36 +171,29 @@
         removeOldest();
     }
 
-    hash_t hash = hash_type(key);
-    ssize_t index = mTable->find(-1, hash, key);
-    if (index >= 0) {
+    if (findByKey(key) != mSet->end()) {
         return false;
     }
-    if (!mTable->hasMoreRoom()) {
-        rehash(mTable->capacity() * 2);
-    }
 
-    // Would it be better to initialize a blank entry and assign key, value?
-    Entry initEntry(key, value);
-    index = mTable->add(hash, initEntry);
-    Entry& entry = mTable->editEntryAt(index);
-    attachToCache(entry);
+    Entry* newEntry = new Entry(key, value);
+    mSet->insert(newEntry);
+    attachToCache(*newEntry);
     return true;
 }
 
 template <typename TKey, typename TValue>
 bool LruCache<TKey, TValue>::remove(const TKey& key) {
-    hash_t hash = hash_type(key);
-    ssize_t index = mTable->find(-1, hash, key);
-    if (index < 0) {
+    typename LruCacheSet::const_iterator find_result = findByKey(key);
+    if (find_result == mSet->end()) {
         return false;
     }
-    Entry& entry = mTable->editEntryAt(index);
+    Entry* entry = *find_result;
     if (mListener) {
-        (*mListener)(entry.key, entry.value);
+        (*mListener)(entry->key, entry->value);
     }
-    detachFromCache(entry);
-    mTable->removeAt(index);
+    detachFromCache(*entry);
+    mSet->erase(entry);
+    delete entry;
     return true;
 }
 
@@ -201,7 +223,10 @@
     }
     mYoungest = NULL;
     mOldest = NULL;
-    mTable->clear();
+    for (auto entry : *mSet.get()) {
+        delete entry;
+    }
+    mSet->clear();
 }
 
 template <typename TKey, typename TValue>
@@ -232,19 +257,5 @@
     entry.child = NULL;
 }
 
-template <typename TKey, typename TValue>
-void LruCache<TKey, TValue>::rehash(size_t newCapacity) {
-    UniquePtr<BasicHashtable<TKey, Entry> > oldTable(mTable.release());
-    Entry* oldest = mOldest;
-
-    mOldest = NULL;
-    mYoungest = NULL;
-    mTable.reset(new BasicHashtable<TKey, Entry>(newCapacity));
-    for (Entry* p = oldest; p != NULL; p = p->child) {
-        put(p->key, p->value);
-    }
 }
-
-}
-
 #endif // ANDROID_UTILS_LRU_CACHE_H
diff --git a/include/utils/String16.h b/include/utils/String16.h
index b2ab5dc..9a67c7a 100644
--- a/include/utils/String16.h
+++ b/include/utils/String16.h
@@ -65,8 +65,6 @@
     
     inline  const char16_t*     string() const;
     
-            const SharedBuffer* sharedBuffer() const;
-    
             size_t              size() const;
             void                setTo(const String16& other);
             status_t            setTo(const char16_t* other);
diff --git a/include/utils/String8.h b/include/utils/String8.h
index a8a37db..2a75b98 100644
--- a/include/utils/String8.h
+++ b/include/utils/String8.h
@@ -28,7 +28,6 @@
 
 namespace android {
 
-class SharedBuffer;
 class String16;
 class TextOutput;
 
@@ -69,7 +68,6 @@
     inline  bool                isEmpty() const;
     
             size_t              length() const;
-            const SharedBuffer* sharedBuffer() const;
     
             void                clear();
 
diff --git a/liblog/logprint.c b/liblog/logprint.c
index c2f1545..b6dba2e 100644
--- a/liblog/logprint.c
+++ b/liblog/logprint.c
@@ -48,6 +48,8 @@
     bool colored_output;
     bool usec_time_output;
     bool printable_output;
+    bool year_output;
+    bool zone_output;
 };
 
 /*
@@ -192,6 +194,8 @@
     p_ret->colored_output = false;
     p_ret->usec_time_output = false;
     p_ret->printable_output = false;
+    p_ret->year_output = false;
+    p_ret->zone_output = false;
 
     return p_ret;
 }
@@ -227,6 +231,12 @@
     case FORMAT_MODIFIER_PRINTABLE:
         p_format->printable_output = true;
         return 0;
+    case FORMAT_MODIFIER_YEAR:
+        p_format->year_output = true;
+        return 0;
+    case FORMAT_MODIFIER_ZONE:
+        p_format->zone_output = !p_format->zone_output;
+        return 0;
     default:
         break;
     }
@@ -234,6 +244,9 @@
     return 1;
 }
 
+static const char tz[] = "TZ";
+static const char utc[] = "UTC";
+
 /**
  * Returns FORMAT_OFF on invalid string
  */
@@ -252,7 +265,39 @@
     else if (strcmp(formatString, "color") == 0) format = FORMAT_MODIFIER_COLOR;
     else if (strcmp(formatString, "usec") == 0) format = FORMAT_MODIFIER_TIME_USEC;
     else if (strcmp(formatString, "printable") == 0) format = FORMAT_MODIFIER_PRINTABLE;
-    else format = FORMAT_OFF;
+    else if (strcmp(formatString, "year") == 0) format = FORMAT_MODIFIER_YEAR;
+    else if (strcmp(formatString, "zone") == 0) format = FORMAT_MODIFIER_ZONE;
+    else {
+        extern char *tzname[2];
+        static const char gmt[] = "GMT";
+        char *cp = getenv(tz);
+        if (cp) {
+            cp = strdup(cp);
+        }
+        setenv(tz, formatString, 1);
+        /*
+         * Run tzset here to determine if the timezone is legitimate. If the
+         * zone is GMT, check if that is what was asked for, if not then
+         * did not match any on the system; report an error to caller.
+         */
+        tzset();
+        if (!tzname[0]
+                || ((!strcmp(tzname[0], utc)
+                        || !strcmp(tzname[0], gmt)) /* error? */
+                    && strcasecmp(formatString, utc)
+                    && strcasecmp(formatString, gmt))) { /* ok */
+            if (cp) {
+                setenv(tz, cp, 1);
+            } else {
+                unsetenv(tz);
+            }
+            tzset();
+            format = FORMAT_OFF;
+        } else {
+            format = FORMAT_MODIFIER_ZONE;
+        }
+        free(cp);
+    }
 
     return format;
 }
@@ -774,7 +819,7 @@
     uint32_t utf32;
 
     if ((first_char & 0x80) == 0) { /* ASCII */
-        return 1;
+        return first_char ? 1 : -1;
     }
 
     /*
@@ -887,7 +932,7 @@
     struct tm tmBuf;
 #endif
     struct tm* ptm;
-    char timeBuf[32]; /* good margin, 23+nul for msec, 26+nul for usec */
+    char timeBuf[64]; /* good margin, 23+nul for msec, 26+nul for usec */
     char prefixBuf[128], suffixBuf[128];
     char priChar;
     int prefixSuffixIsHeaderFooter = 0;
@@ -905,21 +950,28 @@
      * For this reason it's very annoying to have regexp meta characters
      * in the time stamp.  Don't use forward slashes, parenthesis,
      * brackets, asterisks, or other special chars here.
+     *
+     * The caller may have affected the timezone environment, this is
+     * expected to be sensitive to that.
      */
 #if !defined(_WIN32)
     ptm = localtime_r(&(entry->tv_sec), &tmBuf);
 #else
     ptm = localtime(&(entry->tv_sec));
 #endif
-    /* strftime(timeBuf, sizeof(timeBuf), "%Y-%m-%d %H:%M:%S", ptm); */
-    strftime(timeBuf, sizeof(timeBuf), "%m-%d %H:%M:%S", ptm);
+    strftime(timeBuf, sizeof(timeBuf),
+             &"%Y-%m-%d %H:%M:%S"[p_format->year_output ? 0 : 3],
+             ptm);
     len = strlen(timeBuf);
     if (p_format->usec_time_output) {
-        snprintf(timeBuf + len, sizeof(timeBuf) - len,
-                 ".%06ld", entry->tv_nsec / 1000);
+        len += snprintf(timeBuf + len, sizeof(timeBuf) - len,
+                        ".%06ld", entry->tv_nsec / 1000);
     } else {
-        snprintf(timeBuf + len, sizeof(timeBuf) - len,
-                 ".%03ld", entry->tv_nsec / 1000000);
+        len += snprintf(timeBuf + len, sizeof(timeBuf) - len,
+                        ".%03ld", entry->tv_nsec / 1000000);
+    }
+    if (p_format->zone_output) {
+        strftime(timeBuf + len, sizeof(timeBuf) - len, " %z", ptm);
     }
 
     /*
diff --git a/libutils/String16.cpp b/libutils/String16.cpp
index 67be9d8..6a5273f 100644
--- a/libutils/String16.cpp
+++ b/libutils/String16.cpp
@@ -171,11 +171,6 @@
     return SharedBuffer::sizeFromData(mString)/sizeof(char16_t)-1;
 }
 
-const SharedBuffer* String16::sharedBuffer() const
-{
-    return SharedBuffer::bufferFromData(mString);
-}
-
 void String16::setTo(const String16& other)
 {
     SharedBuffer::bufferFromData(other.mString)->acquire();
diff --git a/libutils/String8.cpp b/libutils/String8.cpp
index 5e85520..81bfccf 100644
--- a/libutils/String8.cpp
+++ b/libutils/String8.cpp
@@ -217,11 +217,6 @@
     return SharedBuffer::sizeFromData(mString)-1;
 }
 
-const SharedBuffer* String8::sharedBuffer() const
-{
-    return SharedBuffer::bufferFromData(mString);
-}
-
 String8 String8::format(const char* fmt, ...)
 {
     va_list args;
diff --git a/libutils/tests/LruCache_test.cpp b/libutils/tests/LruCache_test.cpp
index 6155def..2ed84d7 100644
--- a/libutils/tests/LruCache_test.cpp
+++ b/libutils/tests/LruCache_test.cpp
@@ -221,7 +221,7 @@
     cache.put(ComplexKey(0), ComplexValue(0));
     cache.put(ComplexKey(1), ComplexValue(1));
     EXPECT_EQ(2U, cache.size());
-    assertInstanceCount(2, 3);  // the null value counts as an instance
+    assertInstanceCount(2, 3);  // the member mNullValue counts as an instance
 }
 
 TEST_F(LruCacheTest, Clear) {
diff --git a/logcat/logcat.cpp b/logcat/logcat.cpp
index e598bb8..9440b68 100644
--- a/logcat/logcat.cpp
+++ b/logcat/logcat.cpp
@@ -260,7 +260,7 @@
                     "  -n <count>      Sets max number of rotated logs to <count>, default 4\n"
                     "  -v <format>     Sets the log print format, where <format> is:\n\n"
                     "                      brief color long printable process raw tag thread\n"
-                    "                      threadtime time usec\n\n"
+                    "                      threadtime time usec UTC year zone\n\n"
                     "  -D              print dividers between each log buffer\n"
                     "  -c              clear (flush) the entire log and exit\n"
                     "  -d              dump the log and then exit (don't block)\n"
@@ -268,7 +268,8 @@
                     "  -t '<time>'     print most recent lines since specified time (implies -d)\n"
                     "  -T <count>      print only the most recent <count> lines (does not imply -d)\n"
                     "  -T '<time>'     print most recent lines since specified time (not imply -d)\n"
-                    "                  count is pure numerical, time is 'MM-DD hh:mm:ss.mmm'\n"
+                    "                  count is pure numerical, time is 'MM-DD hh:mm:ss.mmm...'\n"
+                    "                  or 'YYYY-MM-DD hh:mm:ss.mmm...' format\n"
                     "  -g              get the size of the log's ring buffer and exit\n"
                     "  -L              dump logs from prior to last reboot\n"
                     "  -b <buffer>     Request alternate ring buffer, 'main', 'system', 'radio',\n"
@@ -377,7 +378,14 @@
     exit(EXIT_FAILURE);
 }
 
-static const char g_defaultTimeFormat[] = "%m-%d %H:%M:%S.%q";
+static char *parseTime(log_time &t, const char *cp) {
+
+    char *ep = t.strptime(cp, "%m-%d %H:%M:%S.%q");
+    if (ep) {
+        return ep;
+    }
+    return t.strptime(cp, "%Y-%m-%d %H:%M:%S.%q");
+}
 
 // Find last logged line in gestalt of all matching existing output files
 static log_time lastLogTime(char *outputFileName) {
@@ -423,7 +431,7 @@
         bool found = false;
         for (const auto& line : android::base::Split(file, "\n")) {
             log_time t(log_time::EPOCH);
-            char *ep = t.strptime(line.c_str(), g_defaultTimeFormat);
+            char *ep = parseTime(t, line.c_str());
             if (!ep || (*ep != ' ')) {
                 continue;
             }
@@ -522,11 +530,10 @@
                 /* FALLTHRU */
             case 'T':
                 if (strspn(optarg, "0123456789") != strlen(optarg)) {
-                    char *cp = tail_time.strptime(optarg, g_defaultTimeFormat);
+                    char *cp = parseTime(tail_time, optarg);
                     if (!cp) {
-                        logcat_panic(false,
-                                    "-%c \"%s\" not in \"%s\" time format\n",
-                                    ret, optarg, g_defaultTimeFormat);
+                        logcat_panic(false, "-%c \"%s\" not in time format\n",
+                                     ret, optarg);
                     }
                     if (*cp) {
                         char c = *cp;
diff --git a/logcat/tests/logcat_test.cpp b/logcat/tests/logcat_test.cpp
index de2db67..bcf8d82 100644
--- a/logcat/tests/logcat_test.cpp
+++ b/logcat/tests/logcat_test.cpp
@@ -72,6 +72,90 @@
     EXPECT_EQ(4, count);
 }
 
+TEST(logcat, year) {
+    FILE *fp;
+
+    char needle[32];
+    time_t now;
+    time(&now);
+    struct tm *ptm;
+#if !defined(_WIN32)
+    struct tm tmBuf;
+    ptm = localtime_r(&now, &tmBuf);
+#else
+    ptm = localtime(&&now);
+#endif
+    strftime(needle, sizeof(needle), "[ %Y-", ptm);
+
+    ASSERT_TRUE(NULL != (fp = popen(
+      "logcat -v long -v year -b all -t 3 2>/dev/null",
+      "r")));
+
+    char buffer[5120];
+
+    int count = 0;
+
+    while (fgets(buffer, sizeof(buffer), fp)) {
+        if (!strncmp(buffer, needle, strlen(needle))) {
+            ++count;
+        }
+    }
+
+    pclose(fp);
+
+    ASSERT_EQ(3, count);
+}
+
+TEST(logcat, tz) {
+    FILE *fp;
+
+    ASSERT_TRUE(NULL != (fp = popen(
+      "logcat -v long -v America/Los_Angeles -b all -t 3 2>/dev/null",
+      "r")));
+
+    char buffer[5120];
+
+    int count = 0;
+
+    while (fgets(buffer, sizeof(buffer), fp)) {
+        if ((buffer[0] == '[') && (buffer[1] == ' ')
+         && isdigit(buffer[2]) && isdigit(buffer[3])
+         && (buffer[4] == '-')
+         && (strstr(buffer, " -0700 ") || strstr(buffer, " -0800 "))) {
+            ++count;
+        }
+    }
+
+    pclose(fp);
+
+    ASSERT_EQ(3, count);
+}
+
+TEST(logcat, ntz) {
+    FILE *fp;
+
+    ASSERT_TRUE(NULL != (fp = popen(
+      "logcat -v long -v America/Los_Angeles -v zone -b all -t 3 2>/dev/null",
+      "r")));
+
+    char buffer[5120];
+
+    int count = 0;
+
+    while (fgets(buffer, sizeof(buffer), fp)) {
+        if ((buffer[0] == '[') && (buffer[1] == ' ')
+         && isdigit(buffer[2]) && isdigit(buffer[3])
+         && (buffer[4] == '-')
+         && (strstr(buffer, " -0700 ") || strstr(buffer, " -0800 "))) {
+            ++count;
+        }
+    }
+
+    pclose(fp);
+
+    ASSERT_EQ(0, count);
+}
+
 TEST(logcat, tail_3) {
     FILE *fp;
 
diff --git a/logd/LogAudit.cpp b/logd/LogAudit.cpp
index 4b3547c..7db17d1 100644
--- a/logd/LogAudit.cpp
+++ b/logd/LogAudit.cpp
@@ -239,9 +239,9 @@
     return rc;
 }
 
-int LogAudit::log(char *buf) {
+int LogAudit::log(char *buf, size_t len) {
     char *audit = strstr(buf, " audit(");
-    if (!audit) {
+    if (!audit || (audit >= &buf[len])) {
         return 0;
     }
 
@@ -249,7 +249,7 @@
 
     int rc;
     char *type = strstr(buf, "type=");
-    if (type) {
+    if (type && (type < &buf[len])) {
         rc = logPrint("%s %s", type, audit + 1);
     } else {
         rc = logPrint("%s", audit + 1);
diff --git a/logd/LogAudit.h b/logd/LogAudit.h
index f977be9..2342822 100644
--- a/logd/LogAudit.h
+++ b/logd/LogAudit.h
@@ -28,7 +28,7 @@
 
 public:
     LogAudit(LogBuffer *buf, LogReader *reader, int fdDmesg);
-    int log(char *buf);
+    int log(char *buf, size_t len);
 
 protected:
     virtual bool onDataAvailable(SocketClient *cli);
diff --git a/logd/LogKlog.cpp b/logd/LogKlog.cpp
index c6109f5..242d7a0 100644
--- a/logd/LogKlog.cpp
+++ b/logd/LogKlog.cpp
@@ -39,14 +39,15 @@
 // Parsing is hard
 
 // called if we see a '<', s is the next character, returns pointer after '>'
-static char *is_prio(char *s) {
-    if (!isdigit(*s++)) {
+static char *is_prio(char *s, size_t len) {
+    if (!len || !isdigit(*s++)) {
         return NULL;
     }
-    static const size_t max_prio_len = 4;
-    size_t len = 0;
+    --len;
+    static const size_t max_prio_len = (len < 4) ? len : 4;
+    size_t priolen = 0;
     char c;
-    while (((c = *s++)) && (++len <= max_prio_len)) {
+    while (((c = *s++)) && (++priolen <= max_prio_len)) {
         if (!isdigit(c)) {
             return ((c == '>') && (*s == '[')) ? s : NULL;
         }
@@ -55,16 +56,19 @@
 }
 
 // called if we see a '[', s is the next character, returns pointer after ']'
-static char *is_timestamp(char *s) {
-    while (*s == ' ') {
+static char *is_timestamp(char *s, size_t len) {
+    while (len && (*s == ' ')) {
         ++s;
+        --len;
     }
-    if (!isdigit(*s++)) {
+    if (!len || !isdigit(*s++)) {
         return NULL;
     }
+    --len;
     bool first_period = true;
     char c;
-    while ((c = *s++)) {
+    while (len && ((c = *s++))) {
+        --len;
         if ((c == '.') && first_period) {
             first_period = false;
         } else if (!isdigit(c)) {
@@ -77,6 +81,8 @@
 // Like strtok_r with "\r\n" except that we look for log signatures (regex)
 //  \(\(<[0-9]\{1,4\}>\)\([[] *[0-9]+[.][0-9]+[]] \)\{0,1\}\|[[] *[0-9]+[.][0-9]+[]] \)
 // and split if we see a second one without a newline.
+// We allow nuls in content, monitoring the overall length and sub-length of
+// the discovered tokens.
 
 #define SIGNATURE_MASK     0xF0
 // <digit> following ('0' to '9' masked with ~SIGNATURE_MASK) added to signature
@@ -85,7 +91,11 @@
 // space is one more than <digit> of 9
 #define OPEN_BRACKET_SPACE ((char)(OPEN_BRACKET_SIG | 10))
 
-char *log_strtok_r(char *s, char **last) {
+char *log_strntok_r(char *s, size_t *len, char **last, size_t *sublen) {
+    *sublen = 0;
+    if (!*len) {
+        return NULL;
+    }
     if (!s) {
         if (!(s = *last)) {
             return NULL;
@@ -95,6 +105,7 @@
         if ((*s & SIGNATURE_MASK) == LESS_THAN_SIG) {
             *s = (*s & ~SIGNATURE_MASK) + '0';
             *--s = '<';
+            ++*len;
         }
         // fixup for log signature split [,
         // OPEN_BRACKET_SPACE is space, OPEN_BRACKET_SIG + <digit>
@@ -105,24 +116,30 @@
                 *s = (*s & ~SIGNATURE_MASK) + '0';
             }
             *--s = '[';
+            ++*len;
         }
     }
 
-    s += strspn(s, "\r\n");
+    while (*len && ((*s == '\r') || (*s == '\n'))) {
+        ++s;
+        --*len;
+    }
 
-    if (!*s) { // no non-delimiter characters
+    if (!*len) {
         *last = NULL;
         return NULL;
     }
     char *peek, *tok = s;
 
     for (;;) {
-        char c = *s++;
-        switch (c) {
-        case '\0':
+        if (*len == 0) {
             *last = NULL;
             return tok;
-
+        }
+        char c = *s++;
+        --*len;
+        size_t adjust;
+        switch (c) {
         case '\r':
         case '\n':
             s[-1] = '\0';
@@ -130,7 +147,7 @@
             return tok;
 
         case '<':
-            peek = is_prio(s);
+            peek = is_prio(s, *len);
             if (!peek) {
                 break;
             }
@@ -141,14 +158,26 @@
                 *last = s;
                 return tok;
             }
+            adjust = peek - s;
+            if (adjust > *len) {
+                adjust = *len;
+            }
+            *sublen += adjust;
+            *len -= adjust;
             s = peek;
-            if ((*s == '[') && ((peek = is_timestamp(s + 1)))) {
+            if ((*s == '[') && ((peek = is_timestamp(s + 1, *len - 1)))) {
+                adjust = peek - s;
+                if (adjust > *len) {
+                    adjust = *len;
+                }
+                *sublen += adjust;
+                *len -= adjust;
                 s = peek;
             }
             break;
 
         case '[':
-            peek = is_timestamp(s);
+            peek = is_timestamp(s, *len);
             if (!peek) {
                 break;
             }
@@ -163,9 +192,16 @@
                 *last = s;
                 return tok;
             }
+            adjust = peek - s;
+            if (adjust > *len) {
+                adjust = *len;
+            }
+            *sublen += adjust;
+            *len -= adjust;
             s = peek;
             break;
         }
+        ++*sublen;
     }
     // NOTREACHED
 }
@@ -212,17 +248,17 @@
         bool full = len == (sizeof(buffer) - 1);
         char *ep = buffer + len;
         *ep = '\0';
-        len = 0;
+        size_t sublen;
         for(char *ptr = NULL, *tok = buffer;
-                ((tok = log_strtok_r(tok, &ptr)));
+                ((tok = log_strntok_r(tok, &len, &ptr, &sublen)));
                 tok = NULL) {
-            if (((tok + strlen(tok)) == ep) && (retval != 0) && full) {
-                len = strlen(tok);
-                memmove(buffer, tok, len);
+            if (((tok + sublen) >= ep) && (retval != 0) && full) {
+                memmove(buffer, tok, sublen);
+                len = sublen;
                 break;
             }
             if (*tok) {
-                log(tok);
+                log(tok, sublen);
             }
         }
     }
@@ -232,9 +268,11 @@
 
 
 void LogKlog::calculateCorrection(const log_time &monotonic,
-                                  const char *real_string) {
+                                  const char *real_string,
+                                  size_t len) {
     log_time real;
-    if (!real.strptime(real_string, "%Y-%m-%d %H:%M:%S.%09q UTC")) {
+    const char *ep = real.strptime(real_string, "%Y-%m-%d %H:%M:%S.%09q UTC");
+    if (!ep || (ep > &real_string[len])) {
         return;
     }
     // kernel report UTC, log_time::strptime is localtime from calendar.
@@ -249,36 +287,85 @@
     correction = real - monotonic;
 }
 
-void LogKlog::sniffTime(log_time &now, const char **buf, bool reverse) {
-    const char *cp;
-    if ((cp = now.strptime(*buf, "[ %s.%q]"))) {
-        static const char suspend[] = "PM: suspend entry ";
-        static const char resume[] = "PM: suspend exit ";
-        static const char healthd[] = "healthd: battery ";
-        static const char suspended[] = "Suspended for ";
+static const char suspendStr[] = "PM: suspend entry ";
+static const char resumeStr[] = "PM: suspend exit ";
+static const char suspendedStr[] = "Suspended for ";
 
-        if (isspace(*cp)) {
+static const char *strnstr(const char *s, size_t len, const char *needle) {
+    char c;
+
+    if (!len) {
+        return NULL;
+    }
+    if ((c = *needle++) != 0) {
+        size_t needleLen = strlen(needle);
+        do {
+            do {
+                if (len <= needleLen) {
+                    return NULL;
+                }
+                --len;
+            } while (*s++ != c);
+        } while (memcmp(s, needle, needleLen) != 0);
+        s--;
+    }
+    return s;
+}
+
+void LogKlog::sniffTime(log_time &now,
+                        const char **buf, size_t len,
+                        bool reverse) {
+    const char *cp = now.strptime(*buf, "[ %s.%q]");
+    if (cp && (cp >= &(*buf)[len])) {
+        cp = NULL;
+    }
+    len -= cp - *buf;
+    if (cp) {
+        static const char healthd[] = "healthd";
+        static const char battery[] = ": battery ";
+
+        if (len && isspace(*cp)) {
             ++cp;
+            --len;
         }
-        if (!strncmp(cp, suspend, sizeof(suspend) - 1)) {
-            calculateCorrection(now, cp + sizeof(suspend) - 1);
-        } else if (!strncmp(cp, resume, sizeof(resume) - 1)) {
-            calculateCorrection(now, cp + sizeof(resume) - 1);
-        } else if (!strncmp(cp, healthd, sizeof(healthd) - 1)) {
+        *buf = cp;
+
+        const char *b;
+        if (((b = strnstr(cp, len, suspendStr)))
+                && ((size_t)((b += sizeof(suspendStr) - 1) - cp) < len)) {
+            len -= b - cp;
+            calculateCorrection(now, b, len);
+        } else if (((b = strnstr(cp, len, resumeStr)))
+                && ((size_t)((b += sizeof(resumeStr) - 1) - cp) < len)) {
+            len -= b - cp;
+            calculateCorrection(now, b, len);
+        } else if (((b = strnstr(cp, len, healthd)))
+                && ((size_t)((b += sizeof(healthd) - 1) - cp) < len)
+                && ((b = strnstr(b, len -= b - cp, battery)))
+                && ((size_t)((b += sizeof(battery) - 1) - cp) < len)) {
+            len -= b - cp;
+            // NB: healthd is roughly 150us late, worth the price to deal with
+            //     ntp-induced or hardware clock drift.
             // look for " 2???-??-?? ??:??:??.????????? ???"
-            const char *tp;
-            for (tp = cp + sizeof(healthd) - 1; *tp && (*tp != '\n'); ++tp) {
-                if ((tp[0] == ' ') && (tp[1] == '2') && (tp[5] == '-')) {
-                    calculateCorrection(now, tp + 1);
+            for (; len && *b && (*b != '\n'); ++b, --len) {
+                if ((b[0] == ' ') && (b[1] == '2') && (b[5] == '-')) {
+                    calculateCorrection(now, b + 1, len - 1);
                     break;
                 }
             }
-        } else if (!strncmp(cp, suspended, sizeof(suspended) - 1)) {
+        } else if (((b = strnstr(cp, len, suspendedStr)))
+                && ((size_t)((b += sizeof(suspendStr) - 1) - cp) < len)) {
+            len -= b - cp;
             log_time real;
             char *endp;
-            real.tv_sec = strtol(cp + sizeof(suspended) - 1, &endp, 10);
-            if (*endp == '.') {
-                real.tv_nsec = strtol(endp + 1, &endp, 10) * 1000000L;
+            real.tv_sec = strtol(b, &endp, 10);
+            if ((*endp == '.') && ((size_t)(endp - b) < len)) {
+                unsigned long multiplier = NS_PER_SEC;
+                real.tv_nsec = 0;
+                len -= endp - b;
+                while (--len && isdigit(*++endp) && (multiplier /= 10)) {
+                    real.tv_nsec += (*endp - '0') * multiplier;
+                }
                 if (reverse) {
                     correction -= real;
                 } else {
@@ -288,14 +375,13 @@
         }
 
         convertMonotonicToReal(now);
-        *buf = cp;
     } else {
         now = log_time(CLOCK_REALTIME);
     }
 }
 
-pid_t LogKlog::sniffPid(const char *cp) {
-    while (*cp) {
+pid_t LogKlog::sniffPid(const char *cp, size_t len) {
+    while (len) {
         // Mediatek kernels with modified printk
         if (*cp == '[') {
             int pid = 0;
@@ -306,48 +392,21 @@
             break; // Only the first one
         }
         ++cp;
+        --len;
     }
     return 0;
 }
 
-// Passed the entire SYSLOG_ACTION_READ_ALL buffer and interpret a
-// compensated start time.
-void LogKlog::synchronize(const char *buf) {
-    const char *cp = strstr(buf, "] PM: suspend e");
-    if (!cp) {
-        return;
-    }
-
-    do {
-        --cp;
-    } while ((cp > buf) && (isdigit(*cp) || isspace(*cp) || (*cp == '.')));
-
-    log_time now;
-    sniffTime(now, &cp, true);
-
-    char *suspended = strstr(buf, "] Suspended for ");
-    if (!suspended || (suspended > cp)) {
-        return;
-    }
-    cp = suspended;
-
-    do {
-        --cp;
-    } while ((cp > buf) && (isdigit(*cp) || isspace(*cp) || (*cp == '.')));
-
-    sniffTime(now, &cp, true);
-}
-
 // kernel log prefix, convert to a kernel log priority number
-static int parseKernelPrio(const char **buf) {
+static int parseKernelPrio(const char **buf, size_t len) {
     int pri = LOG_USER | LOG_INFO;
     const char *cp = *buf;
-    if (*cp == '<') {
+    if (len && (*cp == '<')) {
         pri = 0;
-        while(isdigit(*++cp)) {
+        while(--len && isdigit(*++cp)) {
             pri = (pri * 10) + *cp - '0';
         }
-        if (*cp == '>') {
+        if (len && (*cp == '>')) {
             ++cp;
         } else {
             cp = *buf;
@@ -358,6 +417,50 @@
     return pri;
 }
 
+// Passed the entire SYSLOG_ACTION_READ_ALL buffer and interpret a
+// compensated start time.
+void LogKlog::synchronize(const char *buf, size_t len) {
+    const char *cp = strnstr(buf, len, suspendStr);
+    if (!cp) {
+        cp = strnstr(buf, len, resumeStr);
+        if (!cp) {
+            return;
+        }
+    } else {
+        const char *rp = strnstr(buf, len, resumeStr);
+        if (rp && (rp < cp)) {
+            cp = rp;
+        }
+    }
+
+    do {
+        --cp;
+    } while ((cp > buf) && (*cp != '\n'));
+    if (*cp == '\n') {
+        ++cp;
+    }
+    parseKernelPrio(&cp, len - (cp - buf));
+
+    log_time now;
+    sniffTime(now, &cp, len - (cp - buf), true);
+
+    const char *suspended = strnstr(buf, len, suspendedStr);
+    if (!suspended || (suspended > cp)) {
+        return;
+    }
+    cp = suspended;
+
+    do {
+        --cp;
+    } while ((cp > buf) && (*cp != '\n'));
+    if (*cp == '\n') {
+        ++cp;
+    }
+    parseKernelPrio(&cp, len - (cp - buf));
+
+    sniffTime(now, &cp, len - (cp - buf), true);
+}
+
 // Convert kernel log priority number into an Android Logger priority number
 static int convertKernelPrioToAndroidPrio(int pri) {
     switch(pri & LOG_PRIMASK) {
@@ -431,19 +534,20 @@
 //  logd.klogd:
 // return -1 if message logd.klogd: <signature>
 //
-int LogKlog::log(const char *buf) {
-    if (auditd && strstr(buf, " audit(")) {
+int LogKlog::log(const char *buf, size_t len) {
+    if (auditd && strnstr(buf, len, " audit(")) {
         return 0;
     }
 
-    int pri = parseKernelPrio(&buf);
+    const char *p = buf;
+    int pri = parseKernelPrio(&p, len);
 
     log_time now;
-    sniffTime(now, &buf, false);
+    sniffTime(now, &p, len - (p - buf), false);
 
     // sniff for start marker
     const char klogd_message[] = "logd.klogd: ";
-    const char *start = strstr(buf, klogd_message);
+    const char *start = strnstr(p, len - (p - buf), klogd_message);
     if (start) {
         uint64_t sig = strtoll(start + sizeof(klogd_message) - 1, NULL, 10);
         if (sig == signature.nsec()) {
@@ -462,7 +566,7 @@
     }
 
     // Parse pid, tid and uid
-    const pid_t pid = sniffPid(buf);
+    const pid_t pid = sniffPid(p, len - (p - buf));
     const pid_t tid = pid;
     const uid_t uid = pid ? logbuf->pidToUid(pid) : 0;
 
@@ -470,40 +574,43 @@
     // Some may view the following as an ugly heuristic, the desire is to
     // beautify the kernel logs into an Android Logging format; the goal is
     // admirable but costly.
-    while (isspace(*buf)) {
-        ++buf;
+    while ((isspace(*p) || !*p) && (p < &buf[len])) {
+        ++p;
     }
-    if (!*buf) {
+    if (p >= &buf[len]) { // timestamp, no content
         return 0;
     }
-    start = buf;
+    start = p;
     const char *tag = "";
     const char *etag = tag;
-    if (!isspace(*buf)) {
+    size_t taglen = len - (p - buf);
+    if (!isspace(*p) && *p) {
         const char *bt, *et, *cp;
 
-        bt = buf;
-        if (!strncmp(buf, "[INFO]", 6)) {
+        bt = p;
+        if (!strncmp(p, "[INFO]", 6)) {
             // <PRI>[<TIME>] "[INFO]"<tag> ":" message
-            bt = buf + 6;
+            bt = p + 6;
+            taglen -= 6;
         }
-        for(et = bt; *et && (*et != ':') && !isspace(*et); ++et) {
+        for(et = bt; taglen && *et && (*et != ':') && !isspace(*et); ++et, --taglen) {
            // skip ':' within [ ... ]
            if (*et == '[') {
-               while (*et && *et != ']') {
+               while (taglen && *et && *et != ']') {
                    ++et;
+                   --taglen;
                }
             }
         }
-        for(cp = et; isspace(*cp); ++cp);
+        for(cp = et; taglen && isspace(*cp); ++cp, --taglen);
         size_t size;
 
         if (*cp == ':') {
             // One Word
             tag = bt;
             etag = et;
-            buf = cp + 1;
-        } else {
+            p = cp + 1;
+        } else if (taglen) {
             size = et - bt;
             if (strncmp(bt, cp, size)) {
                 // <PRI>[<TIME>] <tag>_host '<tag>.<num>' : message
@@ -511,67 +618,72 @@
                         && !strncmp(bt, cp, size - 5)) {
                     const char *b = cp;
                     cp += size - 5;
+                    taglen -= size - 5;
                     if (*cp == '.') {
-                        while (!isspace(*++cp) && (*cp != ':'));
+                        while (--taglen && !isspace(*++cp) && (*cp != ':'));
                         const char *e;
-                        for(e = cp; isspace(*cp); ++cp);
+                        for(e = cp; taglen && isspace(*cp); ++cp, --taglen);
                         if (*cp == ':') {
                             tag = b;
                             etag = e;
-                            buf = cp + 1;
+                            p = cp + 1;
                         }
                     }
                 } else {
-                    while (!isspace(*++cp) && (*cp != ':'));
+                    while (--taglen && !isspace(*++cp) && (*cp != ':'));
                     const char *e;
-                    for(e = cp; isspace(*cp); ++cp);
+                    for(e = cp; taglen && isspace(*cp); ++cp, --taglen);
                     // Two words
                     if (*cp == ':') {
                         tag = bt;
                         etag = e;
-                        buf = cp + 1;
+                        p = cp + 1;
                     }
                 }
             } else if (isspace(cp[size])) {
                 cp += size;
-                while (isspace(*++cp));
+                taglen -= size;
+                while (--taglen && isspace(*++cp));
                 // <PRI>[<TIME>] <tag> <tag> : message
                 if (*cp == ':') {
                     tag = bt;
                     etag = et;
-                    buf = cp + 1;
+                    p = cp + 1;
                 }
             } else if (cp[size] == ':') {
                 // <PRI>[<TIME>] <tag> <tag> : message
                 tag = bt;
                 etag = et;
-                buf = cp + size + 1;
+                p = cp + size + 1;
             } else if ((cp[size] == '.') || isdigit(cp[size])) {
                 // <PRI>[<TIME>] <tag> '<tag>.<num>' : message
                 // <PRI>[<TIME>] <tag> '<tag><num>' : message
                 const char *b = cp;
                 cp += size;
-                while (!isspace(*++cp) && (*cp != ':'));
+                taglen -= size;
+                while (--taglen && !isspace(*++cp) && (*cp != ':'));
                 const char *e = cp;
-                while (isspace(*cp)) {
+                while (taglen && isspace(*cp)) {
                     ++cp;
+                    --taglen;
                 }
                 if (*cp == ':') {
                     tag = b;
                     etag = e;
-                    buf = cp + 1;
+                    p = cp + 1;
                 }
             } else {
-                while (!isspace(*++cp) && (*cp != ':'));
+                while (--taglen && !isspace(*++cp) && (*cp != ':'));
                 const char *e = cp;
-                while (isspace(*cp)) {
+                while (taglen && isspace(*cp)) {
                     ++cp;
+                    --taglen;
                 }
                 // Two words
                 if (*cp == ':') {
                     tag = bt;
                     etag = e;
-                    buf = cp + 1;
+                    p = cp + 1;
                 }
             }
         }
@@ -583,16 +695,16 @@
                 || ((size == 3) && (isdigit(tag[1]) && isdigit(tag[2])))
             // blacklist
                 || ((size == 3) && !strncmp(tag, "CPU", 3))
-                || ((size == 7) && !strncmp(tag, "WARNING", 7))
-                || ((size == 5) && !strncmp(tag, "ERROR", 5))
-                || ((size == 4) && !strncmp(tag, "INFO", 4))) {
-            buf = start;
+                || ((size == 7) && !strncasecmp(tag, "WARNING", 7))
+                || ((size == 5) && !strncasecmp(tag, "ERROR", 5))
+                || ((size == 4) && !strncasecmp(tag, "INFO", 4))) {
+            p = start;
             etag = tag = "";
         }
     }
     // Suppress additional stutter in tag:
     //   eg: [143:healthd]healthd -> [143:healthd]
-    size_t taglen = etag - tag;
+    taglen = etag - tag;
     // Mediatek-special printk induced stutter
     const char *mp = strnrchr(tag, ']', taglen);
     if (mp && (++mp < etag)) {
@@ -602,17 +714,17 @@
         }
     }
     // skip leading space
-    while (isspace(*buf)) {
-        ++buf;
+    while ((isspace(*p) || !*p) && (p < &buf[len])) {
+        ++p;
     }
-    // truncate trailing space
-    size_t b = strlen(buf);
-    while (b && isspace(buf[b-1])) {
+    // truncate trailing space or nuls
+    size_t b = len - (p - buf);
+    while (b && (isspace(p[b-1]) || !p[b-1])) {
         --b;
     }
     // trick ... allow tag with empty content to be logged. log() drops empty
     if (!b && taglen) {
-        buf = " ";
+        p = " ";
         b = 1;
     }
     size_t n = 1 + taglen + 1 + b + 1;
@@ -635,13 +747,13 @@
     ++np;
 
     // Copy parsed tag following priority
-    strncpy(np, tag, taglen);
+    memcpy(np, tag, taglen);
     np += taglen;
     *np = '\0';
     ++np;
 
     // Copy main message to the remainder
-    strncpy(np, buf, b);
+    memcpy(np, p, b);
     np[b] = '\0';
 
     // Log message
diff --git a/logd/LogKlog.h b/logd/LogKlog.h
index 7e4fde0..469affd 100644
--- a/logd/LogKlog.h
+++ b/logd/LogKlog.h
@@ -21,7 +21,7 @@
 #include <log/log_read.h>
 #include "LogReader.h"
 
-char *log_strtok_r(char *str, char **saveptr);
+char *log_strntok_r(char *s, size_t *len, char **saveptr, size_t *sublen);
 
 class LogKlog : public SocketListener {
     LogBuffer *logbuf;
@@ -40,15 +40,16 @@
 
 public:
     LogKlog(LogBuffer *buf, LogReader *reader, int fdWrite, int fdRead, bool auditd);
-    int log(const char *buf);
-    void synchronize(const char *buf);
+    int log(const char *buf, size_t len);
+    void synchronize(const char *buf, size_t len);
 
     static void convertMonotonicToReal(log_time &real) { real += correction; }
 
 protected:
-    void sniffTime(log_time &now, const char **buf, bool reverse);
-    pid_t sniffPid(const char *buf);
-    void calculateCorrection(const log_time &monotonic, const char *real_string);
+    void sniffTime(log_time &now, const char **buf, size_t len, bool reverse);
+    pid_t sniffPid(const char *buf, size_t len);
+    void calculateCorrection(const log_time &monotonic,
+                             const char *real_string, size_t len);
     virtual bool onDataAvailable(SocketClient *cli);
 
 };
diff --git a/logd/main.cpp b/logd/main.cpp
index f90da37..cbdf0b6 100644
--- a/logd/main.cpp
+++ b/logd/main.cpp
@@ -282,36 +282,37 @@
         return;
     }
 
-    int len = klogctl(KLOG_SIZE_BUFFER, NULL, 0);
-    if (len <= 0) {
-        return;
-    }
-
-    len += 1024; // Margin for additional input race or trailing nul
-    std::unique_ptr<char []> buf(new char[len]);
-
-    int rc = klogctl(KLOG_READ_ALL, buf.get(), len);
+    int rc = klogctl(KLOG_SIZE_BUFFER, NULL, 0);
     if (rc <= 0) {
         return;
     }
 
-    if (rc < len) {
+    size_t len = rc + 1024; // Margin for additional input race or trailing nul
+    std::unique_ptr<char []> buf(new char[len]);
+
+    rc = klogctl(KLOG_READ_ALL, buf.get(), len);
+    if (rc <= 0) {
+        return;
+    }
+
+    if ((size_t)rc < len) {
         len = rc + 1;
     }
-    buf[len - 1] = '\0';
+    buf[--len] = '\0';
 
     if (kl) {
-        kl->synchronize(buf.get());
+        kl->synchronize(buf.get(), len);
     }
 
+    size_t sublen;
     for (char *ptr = NULL, *tok = buf.get();
-         (rc >= 0) && ((tok = log_strtok_r(tok, &ptr)));
+         (rc >= 0) && ((tok = log_strntok_r(tok, &len, &ptr, &sublen)));
          tok = NULL) {
         if (al) {
-            rc = al->log(tok);
+            rc = al->log(tok, sublen);
         }
         if (kl) {
-            rc = kl->log(tok);
+            rc = kl->log(tok, sublen);
         }
     }
 }