Merge "metricsd: Collect generic stats about the system."
diff --git a/adb/Android.mk b/adb/Android.mk
index 7789035..6d68bec 100644
--- a/adb/Android.mk
+++ b/adb/Android.mk
@@ -78,6 +78,9 @@
 LIBADB_TEST_darwin_SRCS := \
     fdevent_test.cpp \
 
+LIBADB_TEST_windows_SRCS := \
+    sysdeps_win32_test.cpp \
+
 include $(CLEAR_VARS)
 LOCAL_CLANG := true
 LOCAL_MODULE := libadbd
@@ -118,9 +121,7 @@
 LOCAL_STATIC_LIBRARIES := libcrypto_static libbase
 
 LOCAL_C_INCLUDES_windows := development/host/windows/usb/api/
-ifneq ($(HOST_OS),windows)
-    LOCAL_MULTILIB := 64
-endif
+LOCAL_MULTILIB := first
 
 include $(BUILD_HOST_STATIC_LIBRARY)
 
@@ -131,10 +132,14 @@
 LOCAL_SRC_FILES := \
     $(LIBADB_TEST_SRCS) \
     $(LIBADB_TEST_linux_SRCS) \
+    shell_service.cpp \
+    shell_service_protocol.cpp \
+    shell_service_protocol_test.cpp \
+    shell_service_test.cpp \
 
 LOCAL_SANITIZE := $(adb_target_sanitize)
 LOCAL_STATIC_LIBRARIES := libadbd
-LOCAL_SHARED_LIBRARIES := liblog libbase libcutils
+LOCAL_SHARED_LIBRARIES := libbase libcutils
 include $(BUILD_NATIVE_TEST)
 
 # adb_test
@@ -142,19 +147,28 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := adb_test
+LOCAL_MODULE_HOST_OS := darwin linux windows
 LOCAL_CFLAGS := -DADB_HOST=1 $(LIBADB_CFLAGS)
 LOCAL_CFLAGS_windows := $(LIBADB_windows_CFLAGS)
 LOCAL_CFLAGS_linux := $(LIBADB_linux_CFLAGS)
-LOCAL_SRC_FILES := $(LIBADB_TEST_SRCS) services.cpp
+LOCAL_SRC_FILES := \
+    $(LIBADB_TEST_SRCS) \
+    services.cpp \
+    shell_service_protocol.cpp \
+    shell_service_protocol_test.cpp \
+
 LOCAL_SRC_FILES_linux := $(LIBADB_TEST_linux_SRCS)
 LOCAL_SRC_FILES_darwin := $(LIBADB_TEST_darwin_SRCS)
+LOCAL_SRC_FILES_windows := $(LIBADB_TEST_windows_SRCS)
 LOCAL_SANITIZE := $(adb_host_sanitize)
-LOCAL_SHARED_LIBRARIES := liblog libbase
+LOCAL_SHARED_LIBRARIES := libbase
 LOCAL_STATIC_LIBRARIES := \
     libadb \
     libcrypto_static \
     libcutils \
 
+# Set entrypoint to wmain from sysdeps_win32.cpp instead of main
+LOCAL_LDFLAGS_windows := -municode
 LOCAL_LDLIBS_linux := -lrt -ldl -lpthread
 LOCAL_LDLIBS_darwin := -framework CoreFoundation -framework IOKit
 LOCAL_LDLIBS_windows := -lws2_32 -luserenv
@@ -173,7 +187,7 @@
 LOCAL_CFLAGS_linux := $(LIBADB_linux_CFLAGS)
 LOCAL_SRC_FILES := test_track_devices.cpp
 LOCAL_SANITIZE := $(adb_host_sanitize)
-LOCAL_SHARED_LIBRARIES := liblog libbase
+LOCAL_SHARED_LIBRARIES := libbase
 LOCAL_STATIC_LIBRARIES := libadb libcrypto_static libcutils
 LOCAL_LDLIBS += -lrt -ldl -lpthread
 include $(BUILD_HOST_EXECUTABLE)
@@ -201,6 +215,7 @@
     adb_client.cpp \
     services.cpp \
     file_sync_client.cpp \
+    shell_service_protocol.cpp \
 
 LOCAL_CFLAGS += \
     $(ADB_COMMON_CFLAGS) \
@@ -249,6 +264,7 @@
     remount_service.cpp \
     set_verity_enable_state_service.cpp \
     shell_service.cpp \
+    shell_service_protocol.cpp \
 
 LOCAL_CFLAGS := \
     $(ADB_COMMON_CFLAGS) \
diff --git a/adb/adb.cpp b/adb/adb.cpp
index 0bd95a3..b260a78 100644
--- a/adb/adb.cpp
+++ b/adb/adb.cpp
@@ -501,7 +501,7 @@
         if (t->online && p->msg.arg0 != 0 && p->msg.arg1 == 0) {
             char *name = (char*) p->data;
             name[p->msg.data_length > 0 ? p->msg.data_length - 1 : 0] = 0;
-            s = create_local_service_socket(name);
+            s = create_local_service_socket(name, t);
             if(s == 0) {
                 send_close(0, p->msg.arg0, t);
             } else {
diff --git a/adb/adb.h b/adb/adb.h
index 8b3359e..4922040 100644
--- a/adb/adb.h
+++ b/adb/adb.h
@@ -221,7 +221,8 @@
 void close_all_sockets(atransport *t);
 
 asocket *create_local_socket(int fd);
-asocket *create_local_service_socket(const char *destination);
+asocket *create_local_service_socket(const char* destination,
+                                     const atransport* transport);
 
 asocket *create_remote_socket(unsigned id, atransport *t);
 void connect_to_remote(asocket *s, const char *destination);
@@ -247,7 +248,7 @@
 atransport* find_emulator_transport_by_adb_port(int adb_port);
 #endif
 
-int service_to_fd(const char *name);
+int service_to_fd(const char* name, const atransport* transport);
 #if ADB_HOST
 asocket *host_service_to_socket(const char*  name, const char *serial);
 #endif
diff --git a/adb/client/main.cpp b/adb/client/main.cpp
index 6e27c0f..47234ee 100644
--- a/adb/client/main.cpp
+++ b/adb/client/main.cpp
@@ -169,34 +169,8 @@
     return 0;
 }
 
-#ifdef _WIN32
-static bool _argv_is_utf8 = false;
-#endif
-
 int main(int argc, char** argv) {
-#ifdef _WIN32
-    if (!_argv_is_utf8) {
-        fatal("_argv_is_utf8 is not set, suggesting that wmain was not "
-              "called. Did you forget to link with -municode?");
-    }
-#endif
-
     adb_sysdeps_init();
     adb_trace_init(argv);
     return adb_commandline(argc - 1, const_cast<const char**>(argv + 1));
 }
-
-#ifdef _WIN32
-
-extern "C"
-int wmain(int argc, wchar_t **argv) {
-    // Set diagnostic flag to try to detect if the build system was not
-    // configured to call wmain.
-    _argv_is_utf8 = true;
-
-    // Convert args from UTF-16 to UTF-8 and pass that to main().
-    NarrowArgs narrow_args(argc, argv);
-    return main(argc, narrow_args.data());
-}
-
-#endif
diff --git a/adb/commandline.cpp b/adb/commandline.cpp
index 4fe0c25..c508b32 100644
--- a/adb/commandline.cpp
+++ b/adb/commandline.cpp
@@ -31,8 +31,10 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
+#include <memory>
 #include <string>
 
+#include <base/logging.h>
 #include <base/stringprintf.h>
 
 #if !defined(_WIN32)
@@ -46,6 +48,8 @@
 #include "adb_io.h"
 #include "adb_utils.h"
 #include "file_sync_service.h"
+#include "shell_service.h"
+#include "transport.h"
 
 static int install_app(TransportType t, const char* serial, int argc, const char** argv);
 static int install_multiple_app(TransportType t, const char* serial, int argc, const char** argv);
@@ -256,19 +260,60 @@
 }
 #endif
 
-static void read_and_dump(int fd) {
+// Reads from |fd| and prints received data. If |use_shell_protocol| is true
+// this expects that incoming data will use the shell protocol, in which case
+// stdout/stderr are routed independently and the remote exit code will be
+// returned.
+static int read_and_dump(int fd, bool use_shell_protocol=false) {
+    int exit_code = 0;
+    std::unique_ptr<ShellProtocol> protocol;
+    int length = 0;
+    FILE* outfile = stdout;
+
+    char raw_buffer[BUFSIZ];
+    char* buffer_ptr = raw_buffer;
+    if (use_shell_protocol) {
+        protocol.reset(new ShellProtocol(fd));
+        if (!protocol) {
+            LOG(ERROR) << "failed to allocate memory for ShellProtocol object";
+            return 1;
+        }
+        buffer_ptr = protocol->data();
+    }
+
     while (fd >= 0) {
-        D("read_and_dump(): pre adb_read(fd=%d)", fd);
-        char buf[BUFSIZ];
-        int len = adb_read(fd, buf, sizeof(buf));
-        D("read_and_dump(): post adb_read(fd=%d): len=%d", fd, len);
-        if (len <= 0) {
-            break;
+        if (use_shell_protocol) {
+            if (!protocol->Read()) {
+                break;
+            }
+            switch (protocol->id()) {
+                case ShellProtocol::kIdStdout:
+                    outfile = stdout;
+                    break;
+                case ShellProtocol::kIdStderr:
+                    outfile = stderr;
+                    break;
+                case ShellProtocol::kIdExit:
+                    exit_code = protocol->data()[0];
+                    continue;
+                default:
+                    continue;
+            }
+            length = protocol->data_length();
+        } else {
+            D("read_and_dump(): pre adb_read(fd=%d)", fd);
+            length = adb_read(fd, raw_buffer, sizeof(raw_buffer));
+            D("read_and_dump(): post adb_read(fd=%d): length=%d", fd, length);
+            if (length <= 0) {
+                break;
+            }
         }
 
-        fwrite(buf, 1, len, stdout);
-        fflush(stdout);
+        fwrite(buffer_ptr, 1, length, outfile);
+        fflush(outfile);
     }
+
+    return exit_code;
 }
 
 static void read_status_line(int fd, char* buf, size_t count)
@@ -362,28 +407,41 @@
     free(buf);
 }
 
-static void *stdin_read_thread(void *x)
-{
-    int fd, fdi;
-    unsigned char buf[1024];
-    int r, n;
-    int state = 0;
+namespace {
 
-    int *fds = (int*) x;
-    fd = fds[0];
-    fdi = fds[1];
-    free(fds);
+// Used to pass multiple values to the stdin read thread.
+struct StdinReadArgs {
+    int stdin_fd, write_fd;
+    std::unique_ptr<ShellProtocol> protocol;
+};
+
+}  // namespace
+
+// Loops to read from stdin and push the data to the given FD.
+// The argument should be a pointer to a StdinReadArgs object. This function
+// will take ownership of the object and delete it when finished.
+static void* stdin_read_thread(void* x) {
+    std::unique_ptr<StdinReadArgs> args(reinterpret_cast<StdinReadArgs*>(x));
+    int state = 0;
 
     adb_thread_setname("stdin reader");
 
+    char raw_buffer[1024];
+    char* buffer_ptr = raw_buffer;
+    size_t buffer_size = sizeof(raw_buffer);
+    if (args->protocol) {
+        buffer_ptr = args->protocol->data();
+        buffer_size = args->protocol->data_capacity();
+    }
+
     while (true) {
-        /* fdi is really the client's stdin, so use read, not adb_read here */
-        D("stdin_read_thread(): pre unix_read(fdi=%d,...)", fdi);
-        r = unix_read(fdi, buf, 1024);
-        D("stdin_read_thread(): post unix_read(fdi=%d,...)", fdi);
+        // Use unix_read() rather than adb_read() for stdin.
+        D("stdin_read_thread(): pre unix_read(fdi=%d,...)", args->stdin_fd);
+        int r = unix_read(args->stdin_fd, buffer_ptr, buffer_size);
+        D("stdin_read_thread(): post unix_read(fdi=%d,...)", args->stdin_fd);
         if (r <= 0) break;
-        for (n = 0; n < r; n++){
-            switch(buf[n]) {
+        for (int n = 0; n < r; n++){
+            switch(buffer_ptr[n]) {
             case '\n':
                 state = 1;
                 break;
@@ -396,47 +454,59 @@
             case '.':
                 if(state == 2) {
                     fprintf(stderr,"\n* disconnect *\n");
-                    stdin_raw_restore(fdi);
+                    stdin_raw_restore(args->stdin_fd);
                     exit(0);
                 }
             default:
                 state = 0;
             }
         }
-        r = adb_write(fd, buf, r);
-        if(r <= 0) {
-            break;
+        if (args->protocol) {
+            if (!args->protocol->Write(ShellProtocol::kIdStdin, r)) {
+                break;
+            }
+        } else {
+            if (!WriteFdExactly(args->write_fd, buffer_ptr, r)) {
+                break;
+            }
         }
     }
-    return 0;
+
+    return nullptr;
 }
 
-static int interactive_shell() {
-    int fdi;
-
+static int interactive_shell(bool use_shell_protocol) {
     std::string error;
     int fd = adb_connect("shell:", &error);
     if (fd < 0) {
         fprintf(stderr,"error: %s\n", error.c_str());
         return 1;
     }
-    fdi = 0; //dup(0);
 
-    int* fds = reinterpret_cast<int*>(malloc(sizeof(int) * 2));
-    if (fds == nullptr) {
-        fprintf(stderr, "couldn't allocate fds array: %s\n", strerror(errno));
+    StdinReadArgs* args = new StdinReadArgs;
+    if (!args) {
+        LOG(ERROR) << "couldn't allocate StdinReadArgs object";
         return 1;
     }
+    args->stdin_fd = 0;
+    args->write_fd = fd;
+    if (use_shell_protocol) {
+        args->protocol.reset(new ShellProtocol(args->write_fd));
+    }
 
-    fds[0] = fd;
-    fds[1] = fdi;
+    stdin_raw_init(args->stdin_fd);
 
-    stdin_raw_init(fdi);
+    int exit_code = 0;
+    if (!adb_thread_create(stdin_read_thread, args)) {
+        PLOG(ERROR) << "error starting stdin read thread";
+        exit_code = 1;
+        delete args;
+    } else {
+        exit_code = read_and_dump(fd, use_shell_protocol);
+    }
 
-    adb_thread_create(stdin_read_thread, fds);
-    read_and_dump(fd);
-    stdin_raw_restore(fdi);
-    return 0;
+    stdin_raw_restore(args->stdin_fd);
+    return exit_code;
 }
 
 
@@ -931,6 +1001,32 @@
     return 0;
 }
 
+// Disallow stdin, stdout, and stderr.
+static bool _is_valid_ack_reply_fd(const int ack_reply_fd) {
+#ifdef _WIN32
+    const HANDLE ack_reply_handle = cast_int_to_handle(ack_reply_fd);
+    return (GetStdHandle(STD_INPUT_HANDLE) != ack_reply_handle) &&
+           (GetStdHandle(STD_OUTPUT_HANDLE) != ack_reply_handle) &&
+           (GetStdHandle(STD_ERROR_HANDLE) != ack_reply_handle);
+#else
+    return ack_reply_fd > 2;
+#endif
+}
+
+// Checks whether the device indicated by |transport_type| and |serial| supports
+// |feature|. Returns the response string, which will be empty if the device
+// could not be found or the feature is not supported.
+static std::string CheckFeature(const std::string& feature,
+                                TransportType transport_type,
+                                const char* serial) {
+    std::string result, error, command("check-feature:" + feature);
+    if (!adb_query(format_host_command(command.c_str(), transport_type, serial),
+                   &result, &error)) {
+        return "";
+    }
+    return result;
+}
+
 int adb_commandline(int argc, const char **argv) {
     int no_daemon = 0;
     int is_daemon = 0;
@@ -980,14 +1076,7 @@
             argc--;
             argv++;
             ack_reply_fd = strtol(reply_fd_str, nullptr, 10);
-#ifdef _WIN32
-            const HANDLE ack_reply_handle = cast_int_to_handle(ack_reply_fd);
-            if ((GetStdHandle(STD_INPUT_HANDLE) == ack_reply_handle) ||
-                (GetStdHandle(STD_OUTPUT_HANDLE) == ack_reply_handle) ||
-                (GetStdHandle(STD_ERROR_HANDLE) == ack_reply_handle)) {
-#else
-            if (ack_reply_fd <= 2) { // Disallow stdin, stdout, and stderr.
-#endif
+            if (!_is_valid_ack_reply_fd(ack_reply_fd)) {
                 fprintf(stderr, "adb: invalid reply fd \"%s\"\n", reply_fd_str);
                 return usage();
             }
@@ -1151,9 +1240,19 @@
             fflush(stdout);
         }
 
+        bool use_shell_protocol;
+        if (CheckFeature(kFeatureShell2, transport_type, serial).empty()) {
+            D("shell protocol not supported, using raw data transfer");
+            use_shell_protocol = false;
+        } else {
+            D("using shell protocol");
+            use_shell_protocol = true;
+        }
+
+
         if (argc < 2) {
             D("starting interactive shell");
-            r = interactive_shell();
+            r = interactive_shell(use_shell_protocol);
             if (h) {
                 printf("\x1b[0m");
                 fflush(stdout);
@@ -1171,16 +1270,15 @@
         }
 
         while (true) {
-            D("interactive shell loop. cmd=%s", cmd.c_str());
+            D("non-interactive shell loop. cmd=%s", cmd.c_str());
             std::string error;
             int fd = adb_connect(cmd, &error);
             int r;
             if (fd >= 0) {
                 D("about to read_and_dump(fd=%d)", fd);
-                read_and_dump(fd);
+                r = read_and_dump(fd, use_shell_protocol);
                 D("read_and_dump() done.");
                 adb_close(fd);
-                r = 0;
             } else {
                 fprintf(stderr,"error: %s\n", error.c_str());
                 r = -1;
@@ -1190,7 +1288,7 @@
                 printf("\x1b[0m");
                 fflush(stdout);
             }
-            D("interactive shell loop. return r=%d", r);
+            D("non-interactive shell loop. return r=%d", r);
             return r;
         }
     }
diff --git a/adb/device.py b/adb/device.py
index c5b5eea..516e880 100644
--- a/adb/device.py
+++ b/adb/device.py
@@ -36,6 +36,16 @@
         super(NoUniqueDeviceError, self).__init__('No unique device')
 
 
+class ShellError(RuntimeError):
+    def __init__(self, cmd, stdout, stderr, exit_code):
+        super(ShellError, self).__init__(
+                '`{0}` exited with code {1}'.format(cmd, exit_code))
+        self.cmd = cmd
+        self.stdout = stdout
+        self.stderr = stderr
+        self.exit_code = exit_code
+
+
 def get_devices():
     with open(os.devnull, 'wb') as devnull:
         subprocess.check_call(['adb', 'start-server'], stdout=devnull,
@@ -146,6 +156,9 @@
     # adb on Windows returns \r\n even if adbd returns \n.
     _RETURN_CODE_SEARCH_LENGTH = len('{0}255\r\n'.format(_RETURN_CODE_DELIMITER))
 
+    # Shell protocol feature string.
+    SHELL_PROTOCOL_FEATURE = 'shell_2'
+
     def __init__(self, serial, product=None):
         self.serial = serial
         self.product = product
@@ -155,6 +168,7 @@
         if self.product is not None:
             self.adb_cmd.extend(['-p', product])
         self._linesep = None
+        self._features = None
 
     @property
     def linesep(self):
@@ -163,9 +177,20 @@
                                                     ['shell', 'echo'])
         return self._linesep
 
+    @property
+    def features(self):
+        if self._features is None:
+            try:
+                self._features = self._simple_call(['features']).splitlines()
+            except subprocess.CalledProcessError:
+                self._features = []
+        return self._features
+
     def _make_shell_cmd(self, user_cmd):
-        return (self.adb_cmd + ['shell'] + user_cmd +
-                ['; ' + self._RETURN_CODE_PROBE_STRING])
+        command = self.adb_cmd + ['shell'] + user_cmd
+        if self.SHELL_PROTOCOL_FEATURE not in self.features:
+            command.append('; ' + self._RETURN_CODE_PROBE_STRING)
+        return command
 
     def _parse_shell_output(self, out):
         """Finds the exit code string from shell output.
@@ -201,23 +226,43 @@
             self.adb_cmd + cmd, stderr=subprocess.STDOUT)
 
     def shell(self, cmd):
-        logging.info(' '.join(self.adb_cmd + ['shell'] + cmd))
-        cmd = self._make_shell_cmd(cmd)
-        out = _subprocess_check_output(cmd)
-        rc, out = self._parse_shell_output(out)
-        if rc != 0:
-            error = subprocess.CalledProcessError(rc, cmd)
-            error.out = out
-            raise error
-        return out
+        """Calls `adb shell`
+
+        Args:
+            cmd: string shell command to execute.
+
+        Returns:
+            A (stdout, stderr) tuple. Stderr may be combined into stdout
+            if the device doesn't support separate streams.
+
+        Raises:
+            ShellError: the exit code was non-zero.
+        """
+        exit_code, stdout, stderr = self.shell_nocheck(cmd)
+        if exit_code != 0:
+            raise ShellError(cmd, stdout, stderr, exit_code)
+        return stdout, stderr
 
     def shell_nocheck(self, cmd):
+        """Calls `adb shell`
+
+        Args:
+            cmd: string shell command to execute.
+
+        Returns:
+            An (exit_code, stdout, stderr) tuple. Stderr may be combined
+            into stdout if the device doesn't support separate streams.
+        """
         cmd = self._make_shell_cmd(cmd)
         logging.info(' '.join(cmd))
         p = subprocess.Popen(
-            cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-        out, _ = p.communicate()
-        return self._parse_shell_output(out)
+            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        stdout, stderr = p.communicate()
+        if self.SHELL_PROTOCOL_FEATURE in self.features:
+            exit_code = p.returncode
+        else:
+            exit_code, stdout = self._parse_shell_output(stdout)
+        return exit_code, stdout, stderr
 
     def install(self, filename, replace=False):
         cmd = ['install']
@@ -281,7 +326,7 @@
         return self._simple_call(['wait-for-device'])
 
     def get_prop(self, prop_name):
-        output = self.shell(['getprop', prop_name]).splitlines()
+        output = self.shell(['getprop', prop_name])[0].splitlines()
         if len(output) != 1:
             raise RuntimeError('Too many lines in getprop output:\n' +
                                '\n'.join(output))
diff --git a/adb/services.cpp b/adb/services.cpp
index 561431c..d128efc 100644
--- a/adb/services.cpp
+++ b/adb/services.cpp
@@ -225,7 +225,7 @@
     return s[0];
 }
 
-int service_to_fd(const char* name) {
+int service_to_fd(const char* name, const atransport* transport) {
     int ret = -1;
 
     if(!strncmp(name, "tcp:", 4)) {
@@ -267,15 +267,15 @@
         ret = create_jdwp_connection_fd(atoi(name+5));
     } else if(!strncmp(name, "shell:", 6)) {
         const char* args = name + 6;
-        if (*args) {
-            // Non-interactive session uses a raw subprocess.
-            ret = StartSubprocess(args, SubprocessType::kRaw);
-        } else {
-            // Interactive session uses a PTY subprocess.
-            ret = StartSubprocess(args, SubprocessType::kPty);
-        }
+        // Use raw for non-interactive, PTY for interactive.
+        SubprocessType type = (*args ? SubprocessType::kRaw : SubprocessType::kPty);
+        SubprocessProtocol protocol =
+                (transport->CanUseFeature(kFeatureShell2) ? SubprocessProtocol::kShell
+                                                          : SubprocessProtocol::kNone);
+        ret = StartSubprocess(args, type, protocol);
     } else if(!strncmp(name, "exec:", 5)) {
-        ret = StartSubprocess(name + 5, SubprocessType::kRaw);
+        ret = StartSubprocess(name + 5, SubprocessType::kRaw,
+                              SubprocessProtocol::kNone);
     } else if(!strncmp(name, "sync:", 5)) {
         ret = create_service_thread(file_sync_service, NULL);
     } else if(!strncmp(name, "remount:", 8)) {
@@ -291,9 +291,10 @@
     } else if(!strncmp(name, "backup:", 7)) {
         ret = StartSubprocess(android::base::StringPrintf("/system/bin/bu backup %s",
                                                           (name + 7)).c_str(),
-                              SubprocessType::kRaw);
+                              SubprocessType::kRaw, SubprocessProtocol::kNone);
     } else if(!strncmp(name, "restore:", 8)) {
-        ret = StartSubprocess("/system/bin/bu restore", SubprocessType::kRaw);
+        ret = StartSubprocess("/system/bin/bu restore", SubprocessType::kRaw,
+                              SubprocessProtocol::kNone);
     } else if(!strncmp(name, "tcpip:", 6)) {
         int port;
         if (sscanf(name + 6, "%d", &port) != 1) {
diff --git a/adb/shell_service.cpp b/adb/shell_service.cpp
index 5f80a59..0274ae3 100644
--- a/adb/shell_service.cpp
+++ b/adb/shell_service.cpp
@@ -14,6 +14,67 @@
  * limitations under the License.
  */
 
+// Functionality for launching and managing shell subprocesses.
+//
+// There are two types of subprocesses, PTY or raw. PTY is typically used for
+// an interactive session, raw for non-interactive. There are also two methods
+// of communication with the subprocess, passing raw data or using a simple
+// protocol to wrap packets. The protocol allows separating stdout/stderr and
+// passing the exit code back, but is not backwards compatible.
+//   ----------------+--------------------------------------
+//   Type  Protocol  |   Exit code?  Separate stdout/stderr?
+//   ----------------+--------------------------------------
+//   PTY   No        |   No          No
+//   Raw   No        |   No          No
+//   PTY   Yes       |   Yes         No
+//   Raw   Yes       |   Yes         Yes
+//   ----------------+--------------------------------------
+//
+// Non-protocol subprocesses work by passing subprocess stdin/out/err through
+// a single pipe which is registered with a local socket in adbd. The local
+// socket uses the fdevent loop to pass raw data between this pipe and the
+// transport, which then passes data back to the adb client. Cleanup is done by
+// waiting in a separate thread for the subprocesses to exit and then signaling
+// a separate fdevent to close out the local socket from the main loop.
+//
+// ------------------+-------------------------+------------------------------
+//   Subprocess      |  adbd subprocess thread |   adbd main fdevent loop
+// ------------------+-------------------------+------------------------------
+//                   |                         |
+//   stdin/out/err <----------------------------->       LocalSocket
+//      |            |                         |
+//      |            |      Block on exit      |
+//      |            |           *             |
+//      v            |           *             |
+//     Exit         --->      Unblock          |
+//                   |           |             |
+//                   |           v             |
+//                   |   Notify shell exit FD --->    Close LocalSocket
+// ------------------+-------------------------+------------------------------
+//
+// The protocol requires the thread to intercept stdin/out/err in order to
+// wrap/unwrap data with shell protocol packets.
+//
+// ------------------+-------------------------+------------------------------
+//   Subprocess      |  adbd subprocess thread |   adbd main fdevent loop
+// ------------------+-------------------------+------------------------------
+//                   |                         |
+//     stdin/out   <--->      Protocol       <--->       LocalSocket
+//     stderr       --->      Protocol        --->       LocalSocket
+//       |           |                         |
+//       v           |                         |
+//      Exit        --->  Exit code protocol  --->       LocalSocket
+//                   |           |             |
+//                   |           v             |
+//                   |   Notify shell exit FD --->    Close LocalSocket
+// ------------------+-------------------------+------------------------------
+//
+// An alternate approach is to put the protocol wrapping/unwrapping in the main
+// fdevent loop, which has the advantage of being able to re-use the existing
+// select() code for handling data streams. However, implementation turned out
+// to be more complex due to partial reads and non-blocking I/O so this model
+// was chosen instead.
+
 #define TRACE_TAG TRACE_SHELL
 
 #include "shell_service.h"
@@ -22,8 +83,11 @@
 
 #include <errno.h>
 #include <pty.h>
+#include <sys/select.h>
 #include <termios.h>
 
+#include <memory>
+
 #include <base/logging.h>
 #include <base/stringprintf.h>
 #include <paths.h>
@@ -110,7 +174,8 @@
 
 class Subprocess {
   public:
-    Subprocess(const std::string& command, SubprocessType type);
+    Subprocess(const std::string& command, SubprocessType type,
+               SubprocessProtocol protocol);
     ~Subprocess();
 
     const std::string& command() const { return command_; }
@@ -129,26 +194,42 @@
     int OpenPtyChildFd(const char* pts_name, ScopedFd* error_sfd);
 
     static void* ThreadHandler(void* userdata);
+    void PassDataStreams();
     void WaitForExit();
 
+    ScopedFd* SelectLoop(fd_set* master_read_set_ptr,
+                         fd_set* master_write_set_ptr);
+
+    // Input/output stream handlers. Success returns nullptr, failure returns
+    // a pointer to the failed FD.
+    ScopedFd* PassInput();
+    ScopedFd* PassOutput(ScopedFd* sfd, ShellProtocol::Id id);
+
     const std::string command_;
     SubprocessType type_;
-
+    SubprocessProtocol protocol_;
     pid_t pid_ = -1;
     ScopedFd local_socket_sfd_;
 
+    // Shell protocol variables.
+    ScopedFd stdinout_sfd_, stderr_sfd_, protocol_sfd_;
+    std::unique_ptr<ShellProtocol> input_, output_;
+    size_t input_bytes_left_ = 0;
+
     DISALLOW_COPY_AND_ASSIGN(Subprocess);
 };
 
-Subprocess::Subprocess(const std::string& command, SubprocessType type)
-        : command_(command), type_(type) {
+Subprocess::Subprocess(const std::string& command, SubprocessType type,
+                       SubprocessProtocol protocol)
+        : command_(command), type_(type), protocol_(protocol) {
 }
 
 Subprocess::~Subprocess() {
 }
 
 bool Subprocess::ForkAndExec() {
-    ScopedFd parent_sfd, child_sfd, parent_error_sfd, child_error_sfd;
+    ScopedFd child_stdinout_sfd, child_stderr_sfd;
+    ScopedFd parent_error_sfd, child_error_sfd;
     char pts_name[PATH_MAX];
 
     // Create a socketpair for the fork() child to report any errors back to
@@ -161,9 +242,14 @@
     if (type_ == SubprocessType::kPty) {
         int fd;
         pid_ = forkpty(&fd, pts_name, nullptr, nullptr);
-        parent_sfd.Reset(fd);
+        stdinout_sfd_.Reset(fd);
     } else {
-        if (!CreateSocketpair(&parent_sfd, &child_sfd)) {
+        if (!CreateSocketpair(&stdinout_sfd_, &child_stdinout_sfd)) {
+            return false;
+        }
+        // Raw subprocess + shell protocol allows for splitting stderr.
+        if (protocol_ == SubprocessProtocol::kShell &&
+                !CreateSocketpair(&stderr_sfd_, &child_stderr_sfd)) {
             return false;
         }
         pid_ = fork();
@@ -179,16 +265,19 @@
         init_subproc_child();
 
         if (type_ == SubprocessType::kPty) {
-            child_sfd.Reset(OpenPtyChildFd(pts_name, &child_error_sfd));
+            child_stdinout_sfd.Reset(OpenPtyChildFd(pts_name, &child_error_sfd));
         }
 
-        dup2(child_sfd.fd(), STDIN_FILENO);
-        dup2(child_sfd.fd(), STDOUT_FILENO);
-        dup2(child_sfd.fd(), STDERR_FILENO);
+        dup2(child_stdinout_sfd.fd(), STDIN_FILENO);
+        dup2(child_stdinout_sfd.fd(), STDOUT_FILENO);
+        dup2(child_stderr_sfd.valid() ? child_stderr_sfd.fd() : child_stdinout_sfd.fd(),
+             STDERR_FILENO);
 
         // exec doesn't trigger destructors, close the FDs manually.
-        parent_sfd.Reset();
-        child_sfd.Reset();
+        stdinout_sfd_.Reset();
+        stderr_sfd_.Reset();
+        child_stdinout_sfd.Reset();
+        child_stderr_sfd.Reset();
         parent_error_sfd.Reset();
         close_on_exec(child_error_sfd.fd());
 
@@ -203,7 +292,8 @@
     }
 
     // Subprocess parent.
-    D("subprocess parent: subprocess FD = %d", parent_sfd.fd());
+    D("subprocess parent: stdin/stdout FD = %d, stderr FD = %d",
+      stdinout_sfd_.fd(), stderr_sfd_.fd());
 
     // Wait to make sure the subprocess exec'd without error.
     child_error_sfd.Reset();
@@ -213,7 +303,38 @@
         return false;
     }
 
-    local_socket_sfd_.Reset(parent_sfd.Release());
+    if (protocol_ == SubprocessProtocol::kNone) {
+        // No protocol: all streams pass through the stdinout FD and hook
+        // directly into the local socket for raw data transfer.
+        local_socket_sfd_.Reset(stdinout_sfd_.Release());
+    } else {
+        // Shell protocol: create another socketpair to intercept data.
+        if (!CreateSocketpair(&protocol_sfd_, &local_socket_sfd_)) {
+            return false;
+        }
+        D("protocol FD = %d", protocol_sfd_.fd());
+
+        input_.reset(new ShellProtocol(protocol_sfd_.fd()));
+        output_.reset(new ShellProtocol(protocol_sfd_.fd()));
+        if (!input_ || !output_) {
+            LOG(ERROR) << "failed to allocate shell protocol objects";
+            return false;
+        }
+
+        // Don't let reads/writes to the subprocess block our thread. This isn't
+        // likely but could happen under unusual circumstances, such as if we
+        // write a ton of data to stdin but the subprocess never reads it and
+        // the pipe fills up.
+        for (int fd : {stdinout_sfd_.fd(), stderr_sfd_.fd()}) {
+            if (fd >= 0) {
+                int flags = fcntl(fd, F_GETFL, 0);
+                if (flags < 0 || fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0) {
+                    PLOG(ERROR) << "error making FD " << fd << " non-blocking";
+                    return false;
+                }
+            }
+        }
+    }
 
     if (!adb_thread_create(ThreadHandler, this)) {
         PLOG(ERROR) << "failed to create subprocess thread";
@@ -259,6 +380,7 @@
     adb_thread_setname(android::base::StringPrintf(
             "shell srvc %d", subprocess->local_socket_fd()));
 
+    subprocess->PassDataStreams();
     subprocess->WaitForExit();
 
     D("deleting Subprocess");
@@ -267,25 +389,192 @@
     return nullptr;
 }
 
+void Subprocess::PassDataStreams() {
+    if (!protocol_sfd_.valid()) {
+        return;
+    }
+
+    // Start by trying to read from the protocol FD, stdout, and stderr.
+    fd_set master_read_set, master_write_set;
+    FD_ZERO(&master_read_set);
+    FD_ZERO(&master_write_set);
+    for (ScopedFd* sfd : {&protocol_sfd_, &stdinout_sfd_, &stderr_sfd_}) {
+        if (sfd->valid()) {
+            FD_SET(sfd->fd(), &master_read_set);
+        }
+    }
+
+    // Pass data until the protocol FD or both the subprocess pipes die, at
+    // which point we can't pass any more data.
+    while (protocol_sfd_.valid() &&
+            (stdinout_sfd_.valid() || stderr_sfd_.valid())) {
+        ScopedFd* dead_sfd = SelectLoop(&master_read_set, &master_write_set);
+        if (dead_sfd) {
+            D("closing FD %d", dead_sfd->fd());
+            FD_CLR(dead_sfd->fd(), &master_read_set);
+            FD_CLR(dead_sfd->fd(), &master_write_set);
+            dead_sfd->Reset();
+        }
+    }
+}
+
+namespace {
+
+inline bool ValidAndInSet(const ScopedFd& sfd, fd_set* set) {
+    return sfd.valid() && FD_ISSET(sfd.fd(), set);
+}
+
+}   // namespace
+
+ScopedFd* Subprocess::SelectLoop(fd_set* master_read_set_ptr,
+                                 fd_set* master_write_set_ptr) {
+    fd_set read_set, write_set;
+    int select_n = std::max(std::max(protocol_sfd_.fd(), stdinout_sfd_.fd()),
+                            stderr_sfd_.fd()) + 1;
+    ScopedFd* dead_sfd = nullptr;
+
+    // Keep calling select() and passing data until an FD closes/errors.
+    while (!dead_sfd) {
+        memcpy(&read_set, master_read_set_ptr, sizeof(read_set));
+        memcpy(&write_set, master_write_set_ptr, sizeof(write_set));
+        if (select(select_n, &read_set, &write_set, nullptr, nullptr) < 0) {
+            if (errno == EINTR) {
+                continue;
+            } else {
+                PLOG(ERROR) << "select failed, closing subprocess pipes";
+                stdinout_sfd_.Reset();
+                stderr_sfd_.Reset();
+                return nullptr;
+            }
+        }
+
+        // Read stdout, write to protocol FD.
+        if (ValidAndInSet(stdinout_sfd_, &read_set)) {
+            dead_sfd = PassOutput(&stdinout_sfd_, ShellProtocol::kIdStdout);
+        }
+
+        // Read stderr, write to protocol FD.
+        if (!dead_sfd && ValidAndInSet(stderr_sfd_, &read_set)) {
+            dead_sfd = PassOutput(&stderr_sfd_, ShellProtocol::kIdStderr);
+        }
+
+        // Read protocol FD, write to stdin.
+        if (!dead_sfd && ValidAndInSet(protocol_sfd_, &read_set)) {
+            dead_sfd = PassInput();
+            // If we didn't finish writing, block on stdin write.
+            if (input_bytes_left_) {
+                FD_CLR(protocol_sfd_.fd(), master_read_set_ptr);
+                FD_SET(stdinout_sfd_.fd(), master_write_set_ptr);
+            }
+        }
+
+        // Continue writing to stdin; only happens if a previous write blocked.
+        if (!dead_sfd && ValidAndInSet(stdinout_sfd_, &write_set)) {
+            dead_sfd = PassInput();
+            // If we finished writing, go back to blocking on protocol read.
+            if (!input_bytes_left_) {
+                FD_SET(protocol_sfd_.fd(), master_read_set_ptr);
+                FD_CLR(stdinout_sfd_.fd(), master_write_set_ptr);
+            }
+        }
+    }  // while (!dead_sfd)
+
+    return dead_sfd;
+}
+
+ScopedFd* Subprocess::PassInput() {
+    // Only read a new packet if we've finished writing the last one.
+    if (!input_bytes_left_) {
+        if (!input_->Read()) {
+            // Read() uses ReadFdExactly() which sets errno to 0 on EOF.
+            if (errno != 0) {
+                PLOG(ERROR) << "error reading protocol FD "
+                            << protocol_sfd_.fd();
+            }
+            return &protocol_sfd_;
+        }
+
+        // We only care about stdin packets.
+        if (stdinout_sfd_.valid() && input_->id() == ShellProtocol::kIdStdin) {
+            input_bytes_left_ = input_->data_length();
+        } else {
+            input_bytes_left_ = 0;
+        }
+    }
+
+    if (input_bytes_left_ > 0) {
+        int index = input_->data_length() - input_bytes_left_;
+        int bytes = adb_write(stdinout_sfd_.fd(), input_->data() + index,
+                              input_bytes_left_);
+        if (bytes == 0 || (bytes < 0 && errno != EAGAIN)) {
+            if (bytes < 0) {
+                PLOG(ERROR) << "error reading stdin FD " << stdinout_sfd_.fd();
+            }
+            // stdin is done, mark this packet as finished and we'll just start
+            // dumping any further data received from the protocol FD.
+            input_bytes_left_ = 0;
+            return &stdinout_sfd_;
+        } else if (bytes > 0) {
+            input_bytes_left_ -= bytes;
+        }
+    }
+
+    return nullptr;
+}
+
+ScopedFd* Subprocess::PassOutput(ScopedFd* sfd, ShellProtocol::Id id) {
+    int bytes = adb_read(sfd->fd(), output_->data(), output_->data_capacity());
+    if (bytes == 0 || (bytes < 0 && errno != EAGAIN)) {
+        if (bytes < 0) {
+            PLOG(ERROR) << "error reading output FD " << sfd->fd();
+        }
+        return sfd;
+    }
+
+    if (bytes > 0 && !output_->Write(id, bytes)) {
+        if (errno != 0) {
+            PLOG(ERROR) << "error reading protocol FD " << protocol_sfd_.fd();
+        }
+        return &protocol_sfd_;
+    }
+
+    return nullptr;
+}
+
 void Subprocess::WaitForExit() {
+    int exit_code = 1;
+
     D("waiting for pid %d", pid_);
     while (true) {
         int status;
         if (pid_ == waitpid(pid_, &status, 0)) {
             D("post waitpid (pid=%d) status=%04x", pid_, status);
             if (WIFSIGNALED(status)) {
+                exit_code = 0x80 | WTERMSIG(status);
                 D("subprocess killed by signal %d", WTERMSIG(status));
                 break;
             } else if (!WIFEXITED(status)) {
                 D("subprocess didn't exit");
                 break;
             } else if (WEXITSTATUS(status) >= 0) {
+                exit_code = WEXITSTATUS(status);
                 D("subprocess exit code = %d", WEXITSTATUS(status));
                 break;
             }
         }
     }
 
+    // If we have an open protocol FD send an exit packet.
+    if (protocol_sfd_.valid()) {
+        output_->data()[0] = exit_code;
+        if (output_->Write(ShellProtocol::kIdExit, 1)) {
+            D("wrote the exit code packet: %d", exit_code);
+        } else {
+            PLOG(ERROR) << "failed to write the exit code packet";
+        }
+        protocol_sfd_.Reset();
+    }
+
     // Pass the local socket FD to the shell cleanup fdevent.
     if (SHELL_EXIT_NOTIFY_FD >= 0) {
         int fd = local_socket_sfd_.fd();
@@ -305,11 +594,13 @@
 
 }  // namespace
 
-int StartSubprocess(const char *name, SubprocessType type) {
-    D("starting %s subprocess: '%s'",
-      type == SubprocessType::kRaw ? "raw" : "PTY", name);
+int StartSubprocess(const char *name, SubprocessType type,
+                    SubprocessProtocol protocol) {
+    D("starting %s subprocess (protocol=%s): '%s'",
+      type == SubprocessType::kRaw ? "raw" : "PTY",
+      protocol == SubprocessProtocol::kNone ? "none" : "shell", name);
 
-    Subprocess* subprocess = new Subprocess(name, type);
+    Subprocess* subprocess = new Subprocess(name, type, protocol);
     if (!subprocess) {
         LOG(ERROR) << "failed to allocate new subprocess";
         return -1;
diff --git a/adb/shell_service.h b/adb/shell_service.h
index c2a048c..8868f10 100644
--- a/adb/shell_service.h
+++ b/adb/shell_service.h
@@ -14,9 +14,109 @@
  * limitations under the License.
  */
 
+// This file contains classes and functionality to launch shell subprocesses
+// in adbd and communicate between those subprocesses and the adb client.
+//
+// The main features exposed here are:
+//   1. A ShellPacket class to wrap data in a simple protocol. Both adbd and
+//      the adb client use this class to transmit data between them.
+//   2. Functions to launch a subprocess on the adbd side.
+
 #ifndef SHELL_SERVICE_H_
 #define SHELL_SERVICE_H_
 
+#include <stdint.h>
+
+#include <base/macros.h>
+
+#include "adb.h"
+
+// Class to send and receive shell protocol packets.
+//
+// To keep things simple and predictable, reads and writes block until an entire
+// packet is complete.
+//
+// Example: read raw data from |fd| and send it in a packet.
+//   ShellProtocol* p = new ShellProtocol(protocol_fd);
+//   int len = adb_read(stdout_fd, p->data(), p->data_capacity());
+//   packet->WritePacket(ShellProtocol::kIdStdout, len);
+//
+// Example: read a packet and print it to |stdout|.
+//   ShellProtocol* p = new ShellProtocol(protocol_fd);
+//   if (p->ReadPacket() && p->id() == kIdStdout) {
+//       fwrite(p->data(), 1, p->data_length(), stdout);
+//   }
+class ShellProtocol {
+  public:
+    // This is an unscoped enum to make it easier to compare against raw bytes.
+    enum Id : uint8_t {
+        kIdStdin  = 0,
+        kIdStdout = 1,
+        kIdStderr = 2,
+        kIdExit   = 3,
+        kIdInvalid  = 255,  // Indicates an invalid or unknown packet.
+    };
+
+    // ShellPackets will probably be too large to allocate on the stack so they
+    // should be dynamically allocated on the heap instead.
+    //
+    // |fd| is an open file descriptor to be used to send or receive packets.
+    explicit ShellProtocol(int fd);
+    virtual ~ShellProtocol();
+
+    // Returns a pointer to the data buffer.
+    const char* data() const { return buffer_ + kHeaderSize; }
+    char* data() { return buffer_ + kHeaderSize; }
+
+    // Returns the total capacity of the data buffer.
+    size_t data_capacity() const { return buffer_end_ - data(); }
+
+    // Reads a packet from the FD.
+    //
+    // If a packet is too big to fit in the buffer then Read() will split the
+    // packet across multiple calls. For example, reading a 50-byte packet into
+    // a 20-byte buffer would read 20 bytes, 20 bytes, then 10 bytes.
+    //
+    // Returns false if the FD closed or errored.
+    bool Read();
+
+    // Returns the ID of the packet in the buffer.
+    int id() const { return buffer_[0]; }
+
+    // Returns the number of bytes that have been read into the data buffer.
+    size_t data_length() const { return data_length_; }
+
+    // Writes the packet currently in the buffer to the FD.
+    //
+    // Returns false if the FD closed or errored.
+    bool Write(Id id, size_t length);
+
+  private:
+    // Packets support 4-byte lengths.
+    typedef uint32_t length_t;
+
+    enum {
+        // It's OK if MAX_PAYLOAD doesn't match on the sending and receiving
+        // end, reading will split larger packets into multiple smaller ones.
+        kBufferSize = MAX_PAYLOAD,
+
+        // Header is 1 byte ID + 4 bytes length.
+        kHeaderSize = sizeof(Id) + sizeof(length_t)
+    };
+
+    int fd_;
+    char buffer_[kBufferSize];
+    size_t data_length_ = 0, bytes_left_ = 0;
+
+    // We need to be able to modify this value for testing purposes, but it
+    // will stay constant during actual program use.
+    char* buffer_end_ = buffer_ + sizeof(buffer_);
+
+    friend class ShellProtocolTest;
+
+    DISALLOW_COPY_AND_ASSIGN(ShellProtocol);
+};
+
 #if !ADB_HOST
 
 enum class SubprocessType {
@@ -24,11 +124,17 @@
     kRaw,
 };
 
+enum class SubprocessProtocol {
+    kNone,
+    kShell,
+};
+
 // Forks and starts a new shell subprocess. If |name| is empty an interactive
 // shell is started, otherwise |name| is executed non-interactively.
 //
 // Returns an open FD connected to the subprocess or -1 on failure.
-int StartSubprocess(const char* name, SubprocessType type);
+int StartSubprocess(const char* name, SubprocessType type,
+                    SubprocessProtocol protocol);
 
 #endif  // !ADB_HOST
 
diff --git a/adb/shell_service_protocol.cpp b/adb/shell_service_protocol.cpp
new file mode 100644
index 0000000..623629c
--- /dev/null
+++ b/adb/shell_service_protocol.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "shell_service.h"
+
+#include <string.h>
+
+#include <algorithm>
+
+#include "adb_io.h"
+
+ShellProtocol::ShellProtocol(int fd) : fd_(fd) {
+    buffer_[0] = kIdInvalid;
+}
+
+ShellProtocol::~ShellProtocol() {
+}
+
+bool ShellProtocol::Read() {
+    // Only read a new header if we've finished the last packet.
+    if (!bytes_left_) {
+        if (!ReadFdExactly(fd_, buffer_, kHeaderSize)) {
+            return false;
+        }
+
+        length_t packet_length;
+        memcpy(&packet_length, &buffer_[1], sizeof(packet_length));
+        bytes_left_ = packet_length;
+        data_length_ = 0;
+    }
+
+    size_t read_length = std::min(bytes_left_, data_capacity());
+    if (read_length && !ReadFdExactly(fd_, data(), read_length)) {
+        return false;
+    }
+
+    bytes_left_ -= read_length;
+    data_length_ = read_length;
+
+    return true;
+}
+
+bool ShellProtocol::Write(Id id, size_t length) {
+    buffer_[0] = id;
+    length_t typed_length = length;
+    memcpy(&buffer_[1], &typed_length, sizeof(typed_length));
+
+    return WriteFdExactly(fd_, buffer_, kHeaderSize + length);
+}
diff --git a/adb/shell_service_protocol_test.cpp b/adb/shell_service_protocol_test.cpp
new file mode 100644
index 0000000..a826035
--- /dev/null
+++ b/adb/shell_service_protocol_test.cpp
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "shell_service.h"
+
+#include <gtest/gtest.h>
+
+#include <signal.h>
+#include <string.h>
+
+#include "sysdeps.h"
+
+class ShellProtocolTest : public ::testing::Test {
+  public:
+    static void SetUpTestCase() {
+#if !defined(_WIN32)
+        // This is normally done in main.cpp.
+        saved_sigpipe_handler_ = signal(SIGPIPE, SIG_IGN);
+#endif
+    }
+
+    static void TearDownTestCase() {
+#if !defined(_WIN32)
+        signal(SIGPIPE, saved_sigpipe_handler_);
+#endif
+    }
+
+    // Initializes the socketpair and ShellProtocols needed for testing.
+    void SetUp() {
+        int fds[2];
+        ASSERT_EQ(0, adb_socketpair(fds));
+        read_fd_ = fds[0];
+        write_fd_ = fds[1];
+
+        write_protocol_ = new ShellProtocol(write_fd_);
+        ASSERT_TRUE(write_protocol_ != nullptr);
+
+        read_protocol_ = new ShellProtocol(read_fd_);
+        ASSERT_TRUE(read_protocol_ != nullptr);
+    }
+
+    // Cleans up FDs and ShellProtocols. If an FD is closed manually during a
+    // test, set it to -1 to prevent TearDown() trying to close it again.
+    void TearDown() {
+        for (int fd : {read_fd_, write_fd_}) {
+            if (fd >= 0) {
+                adb_close(fd);
+            }
+        }
+        for (ShellProtocol* protocol : {read_protocol_, write_protocol_}) {
+            if (protocol) {
+                delete protocol;
+            }
+        }
+    }
+
+    // Fakes the buffer size so we can test filling buffers.
+    void SetReadDataCapacity(size_t size) {
+        read_protocol_->buffer_end_ = read_protocol_->data() + size;
+    }
+
+#if !defined(_WIN32)
+    static sig_t saved_sigpipe_handler_;
+#endif
+
+    int read_fd_ = -1, write_fd_ = -1;
+    ShellProtocol *read_protocol_ = nullptr, *write_protocol_ = nullptr;
+};
+
+#if !defined(_WIN32)
+sig_t ShellProtocolTest::saved_sigpipe_handler_ = nullptr;
+#endif
+
+namespace {
+
+// Returns true if the packet contains the given values.
+bool PacketEquals(const ShellProtocol* protocol, ShellProtocol::Id id,
+                    const void* data, size_t data_length) {
+    return (protocol->id() == id &&
+            protocol->data_length() == data_length &&
+            !memcmp(data, protocol->data(), data_length));
+}
+
+}  // namespace
+
+// Tests data that can fit in a single packet.
+TEST_F(ShellProtocolTest, FullPacket) {
+    ShellProtocol::Id id = ShellProtocol::kIdStdout;
+    char data[] = "abc 123 \0\r\n";
+
+    memcpy(write_protocol_->data(), data, sizeof(data));
+    ASSERT_TRUE(write_protocol_->Write(id, sizeof(data)));
+
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_TRUE(PacketEquals(read_protocol_, id, data, sizeof(data)));
+}
+
+// Tests data that has to be read multiple times due to smaller read buffer.
+TEST_F(ShellProtocolTest, ReadBufferOverflow) {
+    ShellProtocol::Id id = ShellProtocol::kIdStdin;
+
+    memcpy(write_protocol_->data(), "1234567890", 10);
+    ASSERT_TRUE(write_protocol_->Write(id, 10));
+
+    SetReadDataCapacity(4);
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_TRUE(PacketEquals(read_protocol_, id, "1234", 4));
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_TRUE(PacketEquals(read_protocol_, id, "5678", 4));
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_TRUE(PacketEquals(read_protocol_, id, "90", 2));
+}
+
+// Tests a zero length packet.
+TEST_F(ShellProtocolTest, ZeroLengthPacket) {
+    ShellProtocol::Id id = ShellProtocol::kIdStderr;
+
+    ASSERT_TRUE(write_protocol_->Write(id, 0));
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_TRUE(PacketEquals(read_protocol_, id, nullptr, 0));
+}
+
+// Tests exit code packets.
+TEST_F(ShellProtocolTest, ExitCodePacket) {
+    write_protocol_->data()[0] = 20;
+    ASSERT_TRUE(write_protocol_->Write(ShellProtocol::kIdExit, 1));
+
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_EQ(ShellProtocol::kIdExit, read_protocol_->id());
+    ASSERT_EQ(20, read_protocol_->data()[0]);
+}
+
+// Tests writing to a closed pipe.
+TEST_F(ShellProtocolTest, WriteToClosedPipeFail) {
+    adb_close(read_fd_);
+    read_fd_ = -1;
+
+    ASSERT_FALSE(write_protocol_->Write(ShellProtocol::kIdStdout, 0));
+}
+
+// Tests writing to a closed FD.
+TEST_F(ShellProtocolTest, WriteToClosedFdFail) {
+    adb_close(write_fd_);
+    write_fd_ = -1;
+
+    ASSERT_FALSE(write_protocol_->Write(ShellProtocol::kIdStdout, 0));
+}
+
+// Tests reading from a closed pipe.
+TEST_F(ShellProtocolTest, ReadFromClosedPipeFail) {
+    adb_close(write_fd_);
+    write_fd_ = -1;
+
+    ASSERT_FALSE(read_protocol_->Read());
+}
+
+// Tests reading from a closed FD.
+TEST_F(ShellProtocolTest, ReadFromClosedFdFail) {
+    adb_close(read_fd_);
+    read_fd_ = -1;
+
+    ASSERT_FALSE(read_protocol_->Read());
+}
+
+// Tests reading from a closed pipe that has a packet waiting. This checks that
+// even if the pipe closes before we can fully read its contents we will still
+// be able to access the last packets.
+TEST_F(ShellProtocolTest, ReadPacketFromClosedPipe) {
+    ShellProtocol::Id id = ShellProtocol::kIdStdout;
+    char data[] = "foo bar";
+
+    memcpy(write_protocol_->data(), data, sizeof(data));
+    ASSERT_TRUE(write_protocol_->Write(id, sizeof(data)));
+    adb_close(write_fd_);
+    write_fd_ = -1;
+
+    // First read should grab the packet.
+    ASSERT_TRUE(read_protocol_->Read());
+    ASSERT_TRUE(PacketEquals(read_protocol_, id, data, sizeof(data)));
+
+    // Second read should fail.
+    ASSERT_FALSE(read_protocol_->Read());
+}
diff --git a/adb/shell_service_test.cpp b/adb/shell_service_test.cpp
new file mode 100644
index 0000000..20efd84
--- /dev/null
+++ b/adb/shell_service_test.cpp
@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "shell_service.h"
+
+#include <gtest/gtest.h>
+
+#include <signal.h>
+
+#include <string>
+#include <vector>
+
+#include <base/strings.h>
+
+#include "adb.h"
+#include "adb_io.h"
+#include "sysdeps.h"
+
+class ShellServiceTest : public ::testing::Test {
+  public:
+    static void SetUpTestCase() {
+        // This is normally done in main.cpp.
+        saved_sigpipe_handler_ = signal(SIGPIPE, SIG_IGN);
+
+    }
+
+    static void TearDownTestCase() {
+        signal(SIGPIPE, saved_sigpipe_handler_);
+    }
+
+    // Helpers to start and cleanup a subprocess. Cleanup normally does not
+    // need to be called manually unless multiple subprocesses are run from
+    // a single test.
+    void StartTestSubprocess(const char* command, SubprocessType type,
+                             SubprocessProtocol protocol);
+    void CleanupTestSubprocess();
+
+    virtual void TearDown() override {
+        void CleanupTestSubprocess();
+    }
+
+    static sighandler_t saved_sigpipe_handler_;
+
+    int subprocess_fd_ = -1;
+    int shell_exit_receiver_fd_ = -1, saved_shell_exit_fd_;
+};
+
+sighandler_t ShellServiceTest::saved_sigpipe_handler_ = nullptr;
+
+void ShellServiceTest::StartTestSubprocess(
+        const char* command, SubprocessType type, SubprocessProtocol protocol) {
+    // We want to intercept the shell exit message to make sure it's sent.
+    saved_shell_exit_fd_ = SHELL_EXIT_NOTIFY_FD;
+    int fd[2];
+    ASSERT_TRUE(adb_socketpair(fd) >= 0);
+    SHELL_EXIT_NOTIFY_FD = fd[0];
+    shell_exit_receiver_fd_ = fd[1];
+
+    subprocess_fd_ = StartSubprocess(command, type, protocol);
+    ASSERT_TRUE(subprocess_fd_ >= 0);
+}
+
+void ShellServiceTest::CleanupTestSubprocess() {
+    if (subprocess_fd_ >= 0) {
+        // Subprocess should send its FD to SHELL_EXIT_NOTIFY_FD for cleanup.
+        int notified_fd = -1;
+        ASSERT_TRUE(ReadFdExactly(shell_exit_receiver_fd_, &notified_fd,
+                                  sizeof(notified_fd)));
+        ASSERT_EQ(notified_fd, subprocess_fd_);
+
+        adb_close(subprocess_fd_);
+        subprocess_fd_ = -1;
+
+        // Restore SHELL_EXIT_NOTIFY_FD.
+        adb_close(SHELL_EXIT_NOTIFY_FD);
+        adb_close(shell_exit_receiver_fd_);
+        shell_exit_receiver_fd_ = -1;
+        SHELL_EXIT_NOTIFY_FD = saved_shell_exit_fd_;
+    }
+}
+
+namespace {
+
+// Reads raw data from |fd| until it closes or errors.
+std::string ReadRaw(int fd) {
+    char buffer[1024];
+    char *cur_ptr = buffer, *end_ptr = buffer + sizeof(buffer);
+
+    while (1) {
+        int bytes = adb_read(fd, cur_ptr, end_ptr - cur_ptr);
+        if (bytes <= 0) {
+            return std::string(buffer, cur_ptr);
+        }
+        cur_ptr += bytes;
+    }
+}
+
+// Reads shell protocol data from |fd| until it closes or errors. Fills
+// |stdout| and |stderr| with their respective data, and returns the exit code
+// read from the protocol or -1 if an exit code packet was not received.
+int ReadShellProtocol(int fd, std::string* stdout, std::string* stderr) {
+    int exit_code = -1;
+    stdout->clear();
+    stderr->clear();
+
+    ShellProtocol* protocol = new ShellProtocol(fd);
+    while (protocol->Read()) {
+        switch (protocol->id()) {
+            case ShellProtocol::kIdStdout:
+                stdout->append(protocol->data(), protocol->data_length());
+                break;
+            case ShellProtocol::kIdStderr:
+                stderr->append(protocol->data(), protocol->data_length());
+                break;
+            case ShellProtocol::kIdExit:
+                EXPECT_EQ(-1, exit_code) << "Multiple exit packets received";
+                EXPECT_EQ(1u, protocol->data_length());
+                exit_code = protocol->data()[0];
+                break;
+            default:
+                ADD_FAILURE() << "Unidentified packet ID: " << protocol->id();
+        }
+    }
+    delete protocol;
+
+    return exit_code;
+}
+
+// Checks if each line in |lines| exists in the same order in |output|. Blank
+// lines in |output| are ignored for simplicity.
+bool ExpectLinesEqual(const std::string& output,
+                      const std::vector<std::string>& lines) {
+    auto output_lines = android::base::Split(output, "\r\n");
+    size_t i = 0;
+
+    for (const std::string& line : lines) {
+        // Skip empty lines in output.
+        while (i < output_lines.size() && output_lines[i].empty()) {
+            ++i;
+        }
+        if (i >= output_lines.size()) {
+            ADD_FAILURE() << "Ran out of output lines";
+            return false;
+        }
+        EXPECT_EQ(line, output_lines[i]);
+        ++i;
+    }
+
+    while (i < output_lines.size() && output_lines[i].empty()) {
+        ++i;
+    }
+    EXPECT_EQ(i, output_lines.size()) << "Found unmatched output lines";
+    return true;
+}
+
+}  // namespace
+
+// Tests a raw subprocess with no protocol.
+TEST_F(ShellServiceTest, RawNoProtocolSubprocess) {
+    // [ -t 0 ] checks if stdin is connected to a terminal.
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "echo foo; echo bar >&2; [ -t 0 ]; echo $?",
+            SubprocessType::kRaw, SubprocessProtocol::kNone));
+
+    // [ -t 0 ] == 1 means no terminal (raw).
+    ExpectLinesEqual(ReadRaw(subprocess_fd_), {"foo", "bar", "1"});
+}
+
+// Tests a PTY subprocess with no protocol.
+TEST_F(ShellServiceTest, PtyNoProtocolSubprocess) {
+    // [ -t 0 ] checks if stdin is connected to a terminal.
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "echo foo; echo bar >&2; [ -t 0 ]; echo $?",
+            SubprocessType::kPty, SubprocessProtocol::kNone));
+
+    // [ -t 0 ] == 0 means we have a terminal (PTY).
+    ExpectLinesEqual(ReadRaw(subprocess_fd_), {"foo", "bar", "0"});
+}
+
+// Tests a raw subprocess with the shell protocol.
+TEST_F(ShellServiceTest, RawShellProtocolSubprocess) {
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "echo foo; echo bar >&2; echo baz; exit 24",
+            SubprocessType::kRaw, SubprocessProtocol::kShell));
+
+    std::string stdout, stderr;
+    EXPECT_EQ(24, ReadShellProtocol(subprocess_fd_, &stdout, &stderr));
+    ExpectLinesEqual(stdout, {"foo", "baz"});
+    ExpectLinesEqual(stderr, {"bar"});
+}
+
+// Tests a PTY subprocess with the shell protocol.
+TEST_F(ShellServiceTest, PtyShellProtocolSubprocess) {
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "echo foo; echo bar >&2; echo baz; exit 50",
+            SubprocessType::kPty, SubprocessProtocol::kShell));
+
+    // PTY always combines stdout and stderr but the shell protocol should
+    // still give us an exit code.
+    std::string stdout, stderr;
+    EXPECT_EQ(50, ReadShellProtocol(subprocess_fd_, &stdout, &stderr));
+    ExpectLinesEqual(stdout, {"foo", "bar", "baz"});
+    ExpectLinesEqual(stderr, {});
+}
+
+// Tests an interactive PTY session.
+TEST_F(ShellServiceTest, InteractivePtySubprocess) {
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "", SubprocessType::kPty, SubprocessProtocol::kShell));
+
+    // Use variable substitution so echoed input is different from output.
+    const char* commands[] = {"TEST_STR=abc123",
+                              "echo --${TEST_STR}--",
+                              "exit"};
+
+    ShellProtocol* protocol = new ShellProtocol(subprocess_fd_);
+    for (std::string command : commands) {
+        // Interactive shell requires a newline to complete each command.
+        command.push_back('\n');
+        memcpy(protocol->data(), command.data(), command.length());
+        ASSERT_TRUE(protocol->Write(ShellProtocol::kIdStdin, command.length()));
+    }
+    delete protocol;
+
+    std::string stdout, stderr;
+    EXPECT_EQ(0, ReadShellProtocol(subprocess_fd_, &stdout, &stderr));
+    // An unpredictable command prompt makes parsing exact output difficult but
+    // it should at least contain echoed input and the expected output.
+    for (const char* command : commands) {
+        EXPECT_FALSE(stdout.find(command) == std::string::npos);
+    }
+    EXPECT_FALSE(stdout.find("--abc123--") == std::string::npos);
+}
+
+// Tests that nothing breaks when the stdin/stdout pipe closes.
+TEST_F(ShellServiceTest, CloseStdinStdoutSubprocess) {
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "exec 0<&-; exec 1>&-; echo bar >&2",
+            SubprocessType::kRaw, SubprocessProtocol::kShell));
+
+    std::string stdout, stderr;
+    EXPECT_EQ(0, ReadShellProtocol(subprocess_fd_, &stdout, &stderr));
+    ExpectLinesEqual(stdout, {});
+    ExpectLinesEqual(stderr, {"bar"});
+}
+
+// Tests that nothing breaks when the stderr pipe closes.
+TEST_F(ShellServiceTest, CloseStderrSubprocess) {
+    ASSERT_NO_FATAL_FAILURE(StartTestSubprocess(
+            "exec 2>&-; echo foo",
+            SubprocessType::kRaw, SubprocessProtocol::kShell));
+
+    std::string stdout, stderr;
+    EXPECT_EQ(0, ReadShellProtocol(subprocess_fd_, &stdout, &stderr));
+    ExpectLinesEqual(stdout, {"foo"});
+    ExpectLinesEqual(stderr, {});
+}
diff --git a/adb/sockets.cpp b/adb/sockets.cpp
index f8c22cc..104ad6b 100644
--- a/adb/sockets.cpp
+++ b/adb/sockets.cpp
@@ -422,7 +422,8 @@
     return s;
 }
 
-asocket *create_local_service_socket(const char *name)
+asocket *create_local_service_socket(const char *name,
+                                     const atransport* transport)
 {
 #if !ADB_HOST
     if (!strcmp(name,"jdwp")) {
@@ -432,7 +433,7 @@
         return create_jdwp_tracker_service_socket();
     }
 #endif
-    int fd = service_to_fd(name);
+    int fd = service_to_fd(name, transport);
     if(fd < 0) return 0;
 
     asocket* s = create_local_socket(fd);
diff --git a/adb/sysdeps_win32.cpp b/adb/sysdeps_win32.cpp
index b53cd77..5b23c79 100644
--- a/adb/sysdeps_win32.cpp
+++ b/adb/sysdeps_win32.cpp
@@ -25,6 +25,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <algorithm>
 #include <memory>
 #include <string>
 #include <unordered_map>
@@ -1120,6 +1121,11 @@
     BIPD(( "bip_buffer_write: enter %d->%d len %d", bip->fdin, bip->fdout, len ));
     BIPDUMP( src, len );
 
+    if (bip->closed) {
+        errno = EPIPE;
+        return -1;
+    }
+
     EnterCriticalSection( &bip->lock );
 
     while (!bip->can_write) {
@@ -3776,6 +3782,29 @@
     return _wfopen(widen(f).c_str(), widen(m).c_str());
 }
 
+// Return a lowercase version of the argument. Uses C Runtime tolower() on
+// each byte which is not UTF-8 aware, and theoretically uses the current C
+// Runtime locale (which in practice is not changed, so this becomes a ASCII
+// conversion).
+static std::string ToLower(const std::string& anycase) {
+    // copy string
+    std::string str(anycase);
+    // transform the copy
+    std::transform(str.begin(), str.end(), str.begin(), tolower);
+    return str;
+}
+
+extern "C" int main(int argc, char** argv);
+
+// Link with -municode to cause this wmain() to be used as the program
+// entrypoint. It will convert the args from UTF-16 to UTF-8 and call the
+// regular main() with UTF-8 args.
+extern "C" int wmain(int argc, wchar_t **argv) {
+    // Convert args from UTF-16 to UTF-8 and pass that to main().
+    NarrowArgs narrow_args(argc, argv);
+    return main(argc, narrow_args.data());
+}
+
 // Shadow UTF-8 environment variable name/value pairs that are created from
 // _wenviron the first time that adb_getenv() is called. Note that this is not
 // currently updated if putenv, setenv, unsetenv are called. Note that no
@@ -3790,6 +3819,13 @@
         return;
     }
 
+    if (_wenviron == nullptr) {
+        // If _wenviron is null, then -municode probably wasn't used. That
+        // linker flag will cause the entry point to setup _wenviron. It will
+        // also require an implementation of wmain() (which we provide above).
+        fatal("_wenviron is not set, did you link with -municode?");
+    }
+
     // Read name/value pairs from UTF-16 _wenviron and write new name/value
     // pairs to UTF-8 g_environ_utf8. Note that it probably does not make sense
     // to use the D() macro here because that tracing only works if the
@@ -3803,21 +3839,26 @@
             continue;
         }
 
-        const std::string name_utf8(narrow(std::wstring(*env, equal - *env)));
+        // Store lowercase name so that we can do case-insensitive searches.
+        const std::string name_utf8(ToLower(narrow(
+                std::wstring(*env, equal - *env))));
         char* const value_utf8 = strdup(narrow(equal + 1).c_str());
 
-        // Overwrite any duplicate name, but there shouldn't be a dup in the
-        // first place.
-        g_environ_utf8[name_utf8] = value_utf8;
+        // Don't overwrite a previus env var with the same name. In reality,
+        // the system probably won't let two env vars with the same name exist
+        // in _wenviron.
+        g_environ_utf8.insert({name_utf8, value_utf8});
     }
 }
 
 // Version of getenv() that takes a UTF-8 environment variable name and
-// retrieves a UTF-8 value.
+// retrieves a UTF-8 value. Case-insensitive to match getenv() on Windows.
 char* adb_getenv(const char* name) {
     _ensure_env_setup();
 
-    const auto it = g_environ_utf8.find(std::string(name));
+    // Case-insensitive search by searching for lowercase name in a map of
+    // lowercase names.
+    const auto it = g_environ_utf8.find(ToLower(std::string(name)));
     if (it == g_environ_utf8.end()) {
         return nullptr;
     }
diff --git a/adb/sysdeps_win32_test.cpp b/adb/sysdeps_win32_test.cpp
new file mode 100755
index 0000000..cc3ac5c
--- /dev/null
+++ b/adb/sysdeps_win32_test.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "sysdeps.h"
+
+TEST(sysdeps_win32, adb_getenv) {
+    // Insert all test env vars before first call to adb_getenv() which will
+    // read the env var block only once.
+    ASSERT_EQ(0, _putenv("SYSDEPS_WIN32_TEST_UPPERCASE=1"));
+    ASSERT_EQ(0, _putenv("sysdeps_win32_test_lowercase=2"));
+    ASSERT_EQ(0, _putenv("Sysdeps_Win32_Test_MixedCase=3"));
+
+    // UTF-16 value
+    ASSERT_EQ(0, _wputenv(L"SYSDEPS_WIN32_TEST_UNICODE=\u00a1\u0048\u006f\u006c"
+                          L"\u0061\u0021\u03b1\u03b2\u03b3\u0061\u006d\u0062"
+                          L"\u0075\u006c\u014d\u043f\u0440\u0438\u0432\u0435"
+                          L"\u0442"));
+
+    // Search for non-existant env vars.
+    EXPECT_STREQ(nullptr, adb_getenv("SYSDEPS_WIN32_TEST_NONEXISTANT"));
+
+    // Search for existing env vars.
+
+    // There is no test for an env var with a value of a zero-length string
+    // because _putenv() does not support inserting such an env var.
+
+    // Search for env var that is uppercase.
+    EXPECT_STREQ("1", adb_getenv("SYSDEPS_WIN32_TEST_UPPERCASE"));
+    EXPECT_STREQ("1", adb_getenv("sysdeps_win32_test_uppercase"));
+    EXPECT_STREQ("1", adb_getenv("Sysdeps_Win32_Test_Uppercase"));
+
+    // Search for env var that is lowercase.
+    EXPECT_STREQ("2", adb_getenv("SYSDEPS_WIN32_TEST_LOWERCASE"));
+    EXPECT_STREQ("2", adb_getenv("sysdeps_win32_test_lowercase"));
+    EXPECT_STREQ("2", adb_getenv("Sysdeps_Win32_Test_Lowercase"));
+
+    // Search for env var that is mixed-case.
+    EXPECT_STREQ("3", adb_getenv("SYSDEPS_WIN32_TEST_MIXEDCASE"));
+    EXPECT_STREQ("3", adb_getenv("sysdeps_win32_test_mixedcase"));
+    EXPECT_STREQ("3", adb_getenv("Sysdeps_Win32_Test_MixedCase"));
+
+    // Check that UTF-16 was converted to UTF-8.
+    EXPECT_STREQ("\xc2\xa1\x48\x6f\x6c\x61\x21\xce\xb1\xce\xb2\xce\xb3\x61\x6d"
+                 "\x62\x75\x6c\xc5\x8d\xd0\xbf\xd1\x80\xd0\xb8\xd0\xb2\xd0\xb5"
+                 "\xd1\x82",
+                 adb_getenv("SYSDEPS_WIN32_TEST_UNICODE"));
+
+    // Check an env var that should always be set.
+    const char* path_val = adb_getenv("PATH");
+    EXPECT_NE(nullptr, path_val);
+    if (path_val != nullptr) {
+        EXPECT_GT(strlen(path_val), 0);
+    }
+}
diff --git a/adb/test_device.py b/adb/test_device.py
index 2006937..fedd2d7 100644
--- a/adb/test_device.py
+++ b/adb/test_device.py
@@ -37,7 +37,7 @@
         if self.device.get_prop('ro.debuggable') != '1':
             raise unittest.SkipTest('requires rootable build')
 
-        was_root = self.device.shell(['id', '-un']).strip() == 'root'
+        was_root = self.device.shell(['id', '-un'])[0].strip() == 'root'
         if not was_root:
             self.device.root()
             self.device.wait()
@@ -113,7 +113,7 @@
 class ShellTest(DeviceTest):
     def test_cat(self):
         """Check that we can at least cat a file."""
-        out = self.device.shell(['cat', '/proc/uptime']).strip()
+        out = self.device.shell(['cat', '/proc/uptime'])[0].strip()
         elements = out.split()
         self.assertEqual(len(elements), 2)
 
@@ -122,20 +122,19 @@
         self.assertGreater(float(idle), 0.0)
 
     def test_throws_on_failure(self):
-        self.assertRaises(subprocess.CalledProcessError,
-                          self.device.shell, ['false'])
+        self.assertRaises(adb.ShellError, self.device.shell, ['false'])
 
     def test_output_not_stripped(self):
-        out = self.device.shell(['echo', 'foo'])
+        out = self.device.shell(['echo', 'foo'])[0]
         self.assertEqual(out, 'foo' + self.device.linesep)
 
     def test_shell_nocheck_failure(self):
-        rc, out = self.device.shell_nocheck(['false'])
+        rc, out, _ = self.device.shell_nocheck(['false'])
         self.assertNotEqual(rc, 0)
         self.assertEqual(out, '')
 
     def test_shell_nocheck_output_not_stripped(self):
-        rc, out = self.device.shell_nocheck(['echo', 'foo'])
+        rc, out, _ = self.device.shell_nocheck(['echo', 'foo'])
         self.assertEqual(rc, 0)
         self.assertEqual(out, 'foo' + self.device.linesep)
 
@@ -143,7 +142,7 @@
         # If result checking on ADB shell is naively implemented as
         # `adb shell <cmd>; echo $?`, we would be unable to distinguish the
         # output from the result for a cmd of `echo -n 1`.
-        rc, out = self.device.shell_nocheck(['echo', '-n', '1'])
+        rc, out, _ = self.device.shell_nocheck(['echo', '-n', '1'])
         self.assertEqual(rc, 0)
         self.assertEqual(out, '1')
 
@@ -152,7 +151,7 @@
 
         Bug: http://b/19735063
         """
-        output = self.device.shell(['uname'])
+        output = self.device.shell(['uname'])[0]
         self.assertEqual(output, 'Linux' + self.device.linesep)
 
     def test_pty_logic(self):
@@ -180,6 +179,23 @@
         exit_code = self.device.shell_nocheck(['[ -t 0 ]'])[0]
         self.assertEqual(exit_code, 1)
 
+    def test_shell_protocol(self):
+        """Tests the shell protocol on the device.
+
+        If the device supports shell protocol, this gives us the ability
+        to separate stdout/stderr and return the exit code directly.
+
+        Bug: http://b/19734861
+        """
+        if self.device.SHELL_PROTOCOL_FEATURE not in self.device.features:
+            raise unittest.SkipTest('shell protocol unsupported on this device')
+        result = self.device.shell_nocheck(
+                shlex.split('echo foo; echo bar >&2; exit 17'))
+
+        self.assertEqual(17, result[0])
+        self.assertEqual('foo' + self.device.linesep, result[1])
+        self.assertEqual('bar' + self.device.linesep, result[2])
+
 
 class ArgumentEscapingTest(DeviceTest):
     def test_shell_escaping(self):
@@ -191,25 +207,26 @@
         # as `sh -c echo` (with an argument to that shell of "hello"),
         # and then `echo world` back in the first shell.
         result = self.device.shell(
-            shlex.split("sh -c 'echo hello; echo world'"))
+            shlex.split("sh -c 'echo hello; echo world'"))[0]
         result = result.splitlines()
         self.assertEqual(['', 'world'], result)
         # If you really wanted "hello" and "world", here's what you'd do:
         result = self.device.shell(
-            shlex.split(r'echo hello\;echo world')).splitlines()
+            shlex.split(r'echo hello\;echo world'))[0].splitlines()
         self.assertEqual(['hello', 'world'], result)
 
         # http://b/15479704
-        result = self.device.shell(shlex.split("'true && echo t'")).strip()
+        result = self.device.shell(shlex.split("'true && echo t'"))[0].strip()
         self.assertEqual('t', result)
         result = self.device.shell(
-            shlex.split("sh -c 'true && echo t'")).strip()
+            shlex.split("sh -c 'true && echo t'"))[0].strip()
         self.assertEqual('t', result)
 
         # http://b/20564385
-        result = self.device.shell(shlex.split('FOO=a BAR=b echo t')).strip()
+        result = self.device.shell(shlex.split('FOO=a BAR=b echo t'))[0].strip()
         self.assertEqual('t', result)
-        result = self.device.shell(shlex.split(r'echo -n 123\;uname')).strip()
+        result = self.device.shell(
+            shlex.split(r'echo -n 123\;uname'))[0].strip()
         self.assertEqual('123Linux', result)
 
     def test_install_argument_escaping(self):
@@ -235,19 +252,19 @@
         if 'adbd cannot run as root in production builds' in message:
             return
         self.device.wait()
-        self.assertEqual('root', self.device.shell(['id', '-un']).strip())
+        self.assertEqual('root', self.device.shell(['id', '-un'])[0].strip())
 
     def _test_unroot(self):
         self.device.unroot()
         self.device.wait()
-        self.assertEqual('shell', self.device.shell(['id', '-un']).strip())
+        self.assertEqual('shell', self.device.shell(['id', '-un'])[0].strip())
 
     def test_root_unroot(self):
         """Make sure that adb root and adb unroot work, using id(1)."""
         if self.device.get_prop('ro.debuggable') != '1':
             raise unittest.SkipTest('requires rootable build')
 
-        original_user = self.device.shell(['id', '-un']).strip()
+        original_user = self.device.shell(['id', '-un'])[0].strip()
         try:
             if original_user == 'root':
                 self._test_unroot()
@@ -286,7 +303,7 @@
 
         self.device.set_prop(prop_name, 'qux')
         self.assertEqual(
-            self.device.shell(['getprop', prop_name]).strip(), 'qux')
+            self.device.shell(['getprop', prop_name])[0].strip(), 'qux')
 
 
 def compute_md5(string):
@@ -351,7 +368,7 @@
 
         device.shell(['dd', 'if=/dev/urandom', 'of={}'.format(full_path),
                       'bs={}'.format(size), 'count=1'])
-        dev_md5, _ = device.shell([get_md5_prog(device), full_path]).split()
+        dev_md5, _ = device.shell([get_md5_prog(device), full_path])[0].split()
 
         files.append(DeviceFile(dev_md5, full_path))
     return files
@@ -366,7 +383,7 @@
         self.device.shell(['rm', '-rf', self.DEVICE_TEMP_FILE])
         self.device.push(local=local_file, remote=self.DEVICE_TEMP_FILE)
         dev_md5, _ = self.device.shell([get_md5_prog(self.device),
-                                       self.DEVICE_TEMP_FILE]).split()
+                                       self.DEVICE_TEMP_FILE])[0].split()
         self.assertEqual(checksum, dev_md5)
         self.device.shell(['rm', '-f', self.DEVICE_TEMP_FILE])
 
@@ -401,7 +418,7 @@
                'count={}'.format(kbytes)]
         self.device.shell(cmd)
         dev_md5, _ = self.device.shell(
-            [get_md5_prog(self.device), self.DEVICE_TEMP_FILE]).split()
+            [get_md5_prog(self.device), self.DEVICE_TEMP_FILE])[0].split()
         self._test_pull(self.DEVICE_TEMP_FILE, dev_md5)
         self.device.shell_nocheck(['rm', self.DEVICE_TEMP_FILE])
 
@@ -449,7 +466,7 @@
             device_full_path = posixpath.join(self.DEVICE_TEMP_DIR,
                                               temp_file.base_name)
             dev_md5, _ = device.shell(
-                [get_md5_prog(self.device), device_full_path]).split()
+                [get_md5_prog(self.device), device_full_path])[0].split()
             self.assertEqual(temp_file.checksum, dev_md5)
 
         self.device.shell(['rm', '-rf', self.DEVICE_TEMP_DIR])
diff --git a/adb/transport.cpp b/adb/transport.cpp
index e97c479..db9236e 100644
--- a/adb/transport.cpp
+++ b/adb/transport.cpp
@@ -779,10 +779,15 @@
     return max_payload;
 }
 
+// Do not use any of [:;=,] in feature strings, they have special meaning
+// in the connection banner.
+// TODO(dpursell): add this in once we can pass features through to the client.
+const char kFeatureShell2[] = "shell_2";
+
 // The list of features supported by the current system. Will be sent to the
 // other side of the connection in the banner.
 static const FeatureSet gSupportedFeatures = {
-    // None yet.
+        kFeatureShell2,
 };
 
 const FeatureSet& supported_features() {
diff --git a/adb/transport.h b/adb/transport.h
index 3b56c55..999922a 100644
--- a/adb/transport.h
+++ b/adb/transport.h
@@ -29,6 +29,8 @@
 
 const FeatureSet& supported_features();
 
+const extern char kFeatureShell2[];
+
 class atransport {
 public:
     // TODO(danalbert): We expose waaaaaaay too much stuff because this was
diff --git a/base/Android.mk b/base/Android.mk
index 51dd736..613636b 100644
--- a/base/Android.mk
+++ b/base/Android.mk
@@ -26,6 +26,7 @@
 libbase_test_src_files := \
     file_test.cpp \
     logging_test.cpp \
+    parseint_test.cpp \
     stringprintf_test.cpp \
     strings_test.cpp \
     test_main.cpp \
@@ -78,6 +79,7 @@
 LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
 LOCAL_STATIC_LIBRARIES := libcutils
 LOCAL_MULTILIB := both
+LOCAL_MODULE_HOST_OS := darwin linux windows
 include $(BUILD_HOST_SHARED_LIBRARY)
 
 # Tests
@@ -96,6 +98,7 @@
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := libbase_test
+LOCAL_MODULE_HOST_OS := darwin linux windows
 LOCAL_SRC_FILES := $(libbase_test_src_files)
 LOCAL_C_INCLUDES := $(LOCAL_PATH)
 LOCAL_CPPFLAGS := $(libbase_cppflags)
diff --git a/base/include/base/parseint.h b/base/include/base/parseint.h
new file mode 100644
index 0000000..9ecbfbc
--- /dev/null
+++ b/base/include/base/parseint.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BASE_PARSEINT_H
+#define BASE_PARSEINT_H
+
+#include <errno.h>
+#include <stdlib.h>
+
+#include <limits>
+
+namespace android {
+namespace base {
+
+// Parses the unsigned decimal integer in the string 's' and sets 'out' to
+// that value. Optionally allows the caller to define a 'max' beyond which
+// otherwise valid values will be rejected. Returns boolean success.
+template <typename T>
+bool ParseUint(const char* s, T* out,
+               T max = std::numeric_limits<T>::max()) {
+  errno = 0;
+  char* end;
+  unsigned long long int result = strtoull(s, &end, 10);
+  if (errno != 0 || s == end || *end != '\0') {
+    return false;
+  }
+  if (max < result) {
+    return false;
+  }
+  *out = static_cast<T>(result);
+  return true;
+}
+
+// Parses the signed decimal integer in the string 's' and sets 'out' to
+// that value. Optionally allows the caller to define a 'min' and 'max
+// beyond which otherwise valid values will be rejected. Returns boolean
+// success.
+template <typename T>
+bool ParseInt(const char* s, T* out,
+              T min = std::numeric_limits<T>::min(),
+              T max = std::numeric_limits<T>::max()) {
+  errno = 0;
+  char* end;
+  long long int result = strtoll(s, &end, 10);
+  if (errno != 0 || s == end || *end != '\0') {
+    return false;
+  }
+  if (result < min || max < result) {
+    return false;
+  }
+  *out = static_cast<T>(result);
+  return true;
+}
+
+}  // namespace base
+}  // namespace android
+
+#endif  // BASE_PARSEINT_H
diff --git a/base/parseint_test.cpp b/base/parseint_test.cpp
new file mode 100644
index 0000000..e19c6e3
--- /dev/null
+++ b/base/parseint_test.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "base/parseint.h"
+
+#include <gtest/gtest.h>
+
+TEST(parseint, signed_smoke) {
+  int i;
+  ASSERT_FALSE(android::base::ParseInt("x", &i));
+  ASSERT_FALSE(android::base::ParseInt("123x", &i));
+
+  ASSERT_TRUE(android::base::ParseInt("123", &i));
+  ASSERT_EQ(123, i);
+  ASSERT_TRUE(android::base::ParseInt("-123", &i));
+  ASSERT_EQ(-123, i);
+
+  short s;
+  ASSERT_TRUE(android::base::ParseInt("1234", &s));
+  ASSERT_EQ(1234, s);
+
+  ASSERT_TRUE(android::base::ParseInt("12", &i, 0, 15));
+  ASSERT_EQ(12, i);
+  ASSERT_FALSE(android::base::ParseInt("-12", &i, 0, 15));
+  ASSERT_FALSE(android::base::ParseInt("16", &i, 0, 15));
+}
+
+TEST(parseint, unsigned_smoke) {
+  unsigned int i;
+  ASSERT_FALSE(android::base::ParseUint("x", &i));
+  ASSERT_FALSE(android::base::ParseUint("123x", &i));
+
+  ASSERT_TRUE(android::base::ParseUint("123", &i));
+  ASSERT_EQ(123u, i);
+  ASSERT_FALSE(android::base::ParseUint("-123", &i));
+
+  unsigned short s;
+  ASSERT_TRUE(android::base::ParseUint("1234", &s));
+  ASSERT_EQ(1234u, s);
+
+  ASSERT_TRUE(android::base::ParseUint("12", &i, 15u));
+  ASSERT_EQ(12u, i);
+  ASSERT_FALSE(android::base::ParseUint("-12", &i, 15u));
+  ASSERT_FALSE(android::base::ParseUint("16", &i, 15u));
+}
+
+TEST(parseint, no_implicit_octal) {
+  int i;
+  ASSERT_TRUE(android::base::ParseInt("0123", &i));
+  ASSERT_EQ(123, i);
+
+  unsigned int u;
+  ASSERT_TRUE(android::base::ParseUint("0123", &u));
+  ASSERT_EQ(123u, u);
+}
diff --git a/crash_reporter/Android.mk b/crash_reporter/Android.mk
index 6b98af4..467432a 100644
--- a/crash_reporter/Android.mk
+++ b/crash_reporter/Android.mk
@@ -81,6 +81,7 @@
 LOCAL_MODULE := crash_sender
 LOCAL_MODULE_CLASS := EXECUTABLES
 LOCAL_MODULE_PATH := $(TARGET_OUT_EXECUTABLES)
+LOCAL_REQUIRED_MODULES := curl periodic_scheduler
 LOCAL_SRC_FILES := crash_sender
 include $(BUILD_PREBUILT)
 
@@ -113,6 +114,15 @@
 LOCAL_SRC_FILES := crash_reporter_logs.conf
 include $(BUILD_PREBUILT)
 
+# Periodic Scheduler.
+# ========================================================
+include $(CLEAR_VARS)
+LOCAL_MODULE := periodic_scheduler
+LOCAL_MODULE_CLASS := EXECUTABLES
+LOCAL_MODULE_PATH := $(TARGET_OUT_EXECUTABLES)
+LOCAL_SRC_FILES := periodic_scheduler
+include $(BUILD_PREBUILT)
+
 # Crash reporter tests.
 # ========================================================
 include $(CLEAR_VARS)
diff --git a/crash_reporter/crash_collector.cc b/crash_reporter/crash_collector.cc
index 77755f4..b81a936 100644
--- a/crash_reporter/crash_collector.cc
+++ b/crash_reporter/crash_collector.cc
@@ -42,12 +42,13 @@
 
 const char kCollectChromeFile[] =
     "/mnt/stateful_partition/etc/collect_chrome_crashes";
-const char kCrashTestInProgressPath[] = "/tmp/crash-test-in-progress";
+const char kCrashTestInProgressPath[] =
+    "/data/misc/crash_reporter/tmp/crash-test-in-progress";
 const char kDefaultLogConfig[] = "/etc/crash_reporter_logs.conf";
 const char kDefaultUserName[] = "chronos";
-const char kLeaveCoreFile[] = "/root/.leave_core";
+const char kLeaveCoreFile[] = "/data/misc/crash_reporter/.leave_core";
 const char kLsbRelease[] = "/etc/lsb-release";
-const char kShellPath[] = "/bin/sh";
+const char kShellPath[] = "/system/bin/sh";
 const char kSystemCrashPath[] = "/data/misc/crash_reporter/crash";
 const char kUploadVarPrefix[] = "upload_var_";
 const char kUploadFilePrefix[] = "upload_file_";
diff --git a/crash_reporter/crash_sender b/crash_reporter/crash_sender
index fa2f8fc..7f9062a 100755
--- a/crash_reporter/crash_sender
+++ b/crash_reporter/crash_sender
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/system/bin/sh
 
 # Copyright (C) 2010 The Android Open Source Project
 #
@@ -17,20 +17,20 @@
 set -e
 
 # Default product ID in crash report (used if GOOGLE_CRASH_* is undefined).
-CHROMEOS_PRODUCT=ChromeOS
+BRILLO_PRODUCT=Brillo
+
+# Base directory that contains any crash reporter state files.
+CRASH_STATE_DIR="/data/misc/crash_reporter"
 
 # File whose existence implies crash reports may be sent, and whose
 # contents includes our machine's anonymized guid.
-CONSENT_ID="/home/chronos/Consent To Send Stats"
+CONSENT_ID="/data/misc/metrics/enabled"
 
 # Crash sender lock in case the sender is already running.
-CRASH_SENDER_LOCK="/var/lock/crash_sender"
+CRASH_SENDER_LOCK="${CRASH_STATE_DIR}/lock/crash_sender"
 
 # Path to file that indicates a crash test is currently running.
-CRASH_TEST_IN_PROGRESS_FILE="/tmp/crash-test-in-progress"
-
-# Path to find which is required for computing the crash rate.
-FIND="/usr/bin/find"
+CRASH_TEST_IN_PROGRESS_FILE="${CRASH_STATE_DIR}/tmp/crash-test-in-progress"
 
 # Set this to 1 in the environment to allow uploading crash reports
 # for unofficial versions.
@@ -40,20 +40,17 @@
 HWCLASS_PATH="/sys/devices/platform/chromeos_acpi/HWID"
 
 # Path to file that indicates this is a developer image.
-LEAVE_CORE_FILE="/root/.leave_core"
+LEAVE_CORE_FILE="${CRASH_STATE_DIR}/.leave_core"
 
 # Path to list_proxies.
-LIST_PROXIES="/usr/bin/list_proxies"
+LIST_PROXIES="list_proxies"
 
 # Maximum crashes to send per day.
 MAX_CRASH_RATE=${MAX_CRASH_RATE:-32}
 
-# Path to metrics_client.
-METRICS_CLIENT="/usr/bin/metrics_client"
-
 # File whose existence mocks crash sending.  If empty we pretend the
 # crash sending was successful, otherwise unsuccessful.
-MOCK_CRASH_SENDING="/tmp/mock-crash-sending"
+MOCK_CRASH_SENDING="${CRASH_STATE_DIR}/tmp/mock-crash-sending"
 
 # Set this to 1 in the environment to pretend to have booted in developer
 # mode.  This is used by autotests.
@@ -64,40 +61,39 @@
 
 # File whose existence causes crash sending to be delayed (for testing).
 # Must be stateful to enable testing kernel crashes.
-PAUSE_CRASH_SENDING="/var/lib/crash_sender_paused"
+PAUSE_CRASH_SENDING="${CRASH_STATE_DIR}/lock/crash_sender_paused"
 
 # URL to send official build crash reports to.
 REPORT_UPLOAD_PROD_URL="https://clients2.google.com/cr/report"
 
 # Path to a directory of restricted certificates which includes
 # a certificate for ${REPORT_UPLOAD_PROD_URL}.
-RESTRICTED_CERTIFICATES_PATH="/usr/share/chromeos-ca-certificates"
+RESTRICTED_CERTIFICATES_PATH="/system/etc/security/cacerts"
 
 # File whose existence implies we're running and not to start again.
-RUN_FILE="/var/run/crash_sender.pid"
+RUN_FILE="${CRASH_STATE_DIR}/run/crash_sender.pid"
 
 # Maximum time to sleep between sends.
 SECONDS_SEND_SPREAD=${SECONDS_SEND_SPREAD:-600}
 
 # Set this to 1 to allow uploading of device coredumps.
-DEVCOREDUMP_UPLOAD_FLAG_FILE=\
-"/var/lib/crash_reporter/device_coredump_upload_allowed"
+DEVCOREDUMP_UPLOAD_FLAG_FILE="${CRASH_STATE_DIR}/device_coredump_upload_allowed"
 
 # The syslog tag for all logging we emit.
 TAG="$(basename $0)[$$]"
 
 # Directory to store timestamp files indicating the uploads in the past 24
 # hours.
-TIMESTAMPS_DIR="/var/lib/crash_sender"
+TIMESTAMPS_DIR="${CRASH_STATE_DIR}/crash_sender"
 
 # Temp directory for this process.
 TMP_DIR=""
 
-# Chrome's crash report log file.
-CHROME_CRASH_LOG="/var/log/chrome/Crash Reports/uploads.log"
+# Crash report log file.
+CRASH_LOG="${CRASH_STATE_DIR}/log/uploads.log"
 
 lecho() {
-  logger -t "${TAG}" "$@"
+  log -t "${TAG}" "$@"
 }
 
 # Returns true if mock is enabled.
@@ -117,6 +113,9 @@
     rm -rf "${TMP_DIR}"
   fi
   rm -f "${RUN_FILE}"
+  if [ -n "${CRASH_SENDER_LOCK}" ]; then
+    rm -rf "${CRASH_SENDER_LOCK}"
+  fi
   crash_done
 }
 
@@ -130,7 +129,7 @@
 
 is_official_image() {
   [ ${FORCE_OFFICIAL} -ne 0 ] && return 0
-  grep ^CHROMEOS_RELEASE_DESCRIPTION /etc/lsb-release | grep -q Official
+  getprop ro.product.description | grep -q Official
 }
 
 # Returns 0 if the a crash test is currently running.  NOTE: Mirrors
@@ -167,7 +166,11 @@
   # If we're testing crash reporter itself, we don't want to special-case
   # for developer mode.
   is_crash_test_in_progress && return 1
-  crossystem "devsw_boot?1"  # exit status will be accurate
+  if [ "$(getprop ro.build.type)" = "eng" ]; then
+    return 0
+  else
+    return 1
+  fi
 }
 
 # Return 0 if the uploading of device coredumps is allowed.
@@ -188,7 +191,7 @@
 check_rate() {
   mkdir -p ${TIMESTAMPS_DIR}
   # Only consider minidumps written in the past 24 hours by removing all older.
-  ${FIND} "${TIMESTAMPS_DIR}" -mindepth 1 -mmin +$((24 * 60)) \
+  find "${TIMESTAMPS_DIR}" -mindepth 1 -mtime +1 \
       -exec rm -- '{}' ';'
   local sends_in_24hrs=$(echo "${TIMESTAMPS_DIR}"/* | wc -w)
   lecho "Current send rate: ${sends_in_24hrs}sends/24hrs"
@@ -198,7 +201,7 @@
           "max ${MAX_CRASH_RATE}send/24hrs"
     return 1
   fi
-  mktemp "${TIMESTAMPS_DIR}"/XXXX > /dev/null
+  mktemp "${TIMESTAMPS_DIR}"/XXXXXX > /dev/null
   return 0
 }
 
@@ -252,27 +255,18 @@
 get_keys() {
   local file="$1" regex="$2"
 
-  awk -F'[[:space:]=]' -vregex="${regex}" \
-      'match($1, regex) { print $1 }' "${file}"
-}
-
-# Return the board name.
-get_board() {
-  get_key_value "/etc/lsb-release" "CHROMEOS_RELEASE_BOARD"
+  cut -d '=' -f1 "${file}" | grep --color=never "${regex}"
 }
 
 # Return the channel name (sans "-channel" suffix).
 get_channel() {
-  get_key_value "/etc/lsb-release" "CHROMEOS_RELEASE_TRACK" |
-    sed 's:-channel$::'
+  getprop ro.product.channel | sed 's:-channel$::'
 }
 
 # Return the hardware class or "undefined".
 get_hardware_class() {
   if [ -r "${HWCLASS_PATH}" ]; then
     cat "${HWCLASS_PATH}"
-  elif crossystem hwid > /dev/null 2>&1; then
-    echo "$(crossystem hwid)"
   else
     echo "undefined"
   fi
@@ -284,13 +278,12 @@
   local kind="$(get_kind "${meta_path}")"
   local exec_name="$(get_key_value "${meta_path}" "exec_name")"
   local url="${REPORT_UPLOAD_PROD_URL}"
-  local chromeos_version="$(get_key_value "${meta_path}" "ver")"
-  local board="$(get_board)"
+  local brillo_version="$(get_key_value "${meta_path}" "ver")"
   local hwclass="$(get_hardware_class)"
   local write_payload_size="$(get_key_value "${meta_path}" "payload_size")"
   local log="$(get_key_value "${meta_path}" "log")"
   local sig="$(get_key_value "${meta_path}" "sig")"
-  local send_payload_size="$(stat --printf=%s "${report_payload}" 2>/dev/null)"
+  local send_payload_size="$(stat -c "%s" "${report_payload}" 2>/dev/null)"
   local product="$(get_key_value "${meta_path}" "upload_var_prod")"
   local version="$(get_key_value "${meta_path}" "upload_var_ver")"
   local upload_prefix="$(get_key_value "${meta_path}" "upload_prefix")"
@@ -358,10 +351,10 @@
   # If ID or VERSION_ID is undefined, we use the default product name
   # and CHROMEOS_RELEASE_VERSION from /etc/lsb-release.
   if [ "${product}" = "undefined" ]; then
-    product="${CHROMEOS_PRODUCT}"
+    product="${BRILLO_PRODUCT}"
   fi
   if [ "${version}" = "undefined" ]; then
-    version="${chromeos_version}"
+    version="${brillo_version}"
   fi
 
   local image_type
@@ -376,11 +369,7 @@
   fi
 
   local boot_mode
-  if ! crossystem "cros_debug" > /dev/null 2>&1; then
-    # Sanity-check failed that makes sure crossystem exists.
-    lecho "Cannot determine boot mode due to error running crossystem command"
-    boot_mode="missing-crossystem"
-  elif is_developer_mode; then
+  if is_developer_mode; then
     boot_mode="dev"
   fi
 
@@ -392,7 +381,7 @@
   [ "${error_type}" = "undefined" ] && error_type=
 
   lecho "Sending crash:"
-  if [ "${product}" != "${CHROMEOS_PRODUCT}" ]; then
+  if [ "${product}" != "${BRILLO_PRODUCT}" ]; then
     lecho "  Sending crash report on behalf of ${product}"
   fi
   lecho "  Metadata: ${meta_path} (${kind})"
@@ -403,7 +392,6 @@
   if is_mock; then
     lecho "  Product: ${product}"
     lecho "  URL: ${url}"
-    lecho "  Board: ${board}"
     lecho "  HWClass: ${hwclass}"
     lecho "  write_payload_size: ${write_payload_size}"
     lecho "  send_payload_size: ${send_payload_size}"
@@ -451,7 +439,6 @@
     --capath "${RESTRICTED_CERTIFICATES_PATH}" --ciphers HIGH \
     -F "prod=${product}" \
     -F "ver=${version}" \
-    -F "board=${board}" \
     -F "hwclass=${hwclass}" \
     -F "exec_name=${exec_name}" \
     ${image_type:+-F "image_type=${image_type}"} \
@@ -477,15 +464,11 @@
       fi
       ;;
     *)
-      if is_official_image; then
-        product_name="ChromeOS"
-      else
-        product_name="ChromiumOS"
-      fi
+      product_name="Brillo"
       ;;
     esac
     printf '%s,%s,%s\n' \
-      "${timestamp}" "${id}" "${product_name}" >> "${CHROME_CRASH_LOG}"
+      "${timestamp}" "${id}" "${product_name}" >> "${CRASH_LOG}"
     lecho "Crash report receipt ID ${id}"
   else
     lecho "Crash sending failed with exit code ${curl_result}: " \
@@ -512,6 +495,7 @@
 # 3G connection (see crosbug.com/3304 for discussion).
 send_crashes() {
   local dir="$1"
+  lecho "Sending crashes for ${dir}"
 
   if [ ! -d "${dir}" ]; then
     return
@@ -519,8 +503,8 @@
 
   # Consider any old files which still have no corresponding meta file
   # as orphaned, and remove them.
-  for old_file in $(${FIND} "${dir}" -mindepth 1 \
-                    -mmin +$((24 * 60)) -type f); do
+  for old_file in $(find "${dir}" -mindepth 1 \
+                    -mtime +1 -type f); do
     if [ ! -e "$(get_base "${old_file}").meta" ]; then
       lecho "Removing old orphaned file: ${old_file}."
       rm -f -- "${old_file}"
@@ -548,8 +532,8 @@
 
     if ! is_complete_metadata "${meta_path}"; then
       # This report is incomplete, so if it's old, just remove it.
-      local old_meta=$(${FIND} "${dir}" -mindepth 1 -name \
-        $(basename "${meta_path}") -mmin +$((24 * 60)) -type f)
+      local old_meta=$(find "${dir}" -mindepth 1 -name \
+        $(basename "${meta_path}") -mtime +1 -type f)
       if [ -n "${old_meta}" ]; then
         lecho "Removing old incomplete metadata."
         remove_report "${meta_path}"
@@ -571,19 +555,10 @@
       continue
     fi
 
-    # Don't send crash reports from previous sessions while we're in guest mode
-    # to avoid the impression that crash reporting was enabled, which it isn't.
-    # (Don't exit right now because subsequent reports may be candidates for
-    # deletion.)
-    if ${METRICS_CLIENT} -g; then
-      lecho "Guest mode has been entered.  Delaying crash sending until exited."
-      continue
-    fi
-
     # Remove existing crashes in case user consent has not (yet) been given or
     # has been revoked.  This must come after the guest mode check because
-    # ${METRICS_CLIENT} always returns "not consented" in guest mode.
-    if ! ${METRICS_CLIENT} -c; then
+    # metrics_client always returns "not consented" in guest mode.
+    if ! metrics_client -c; then
       lecho "Crash reporting is disabled.  Removing crash."
       remove_report "${meta_path}"
       continue
@@ -602,7 +577,7 @@
     # reports is spread out randomly by up to SECONDS_SEND_SPREAD.  Thus, for
     # the sleep call the greater of the two delays is used.
     local now=$(date +%s)
-    local holdoff_time=$(($(stat --format=%Y "${meta_path}") + 30 - ${now}))
+    local holdoff_time=$(($(stat -c "%Y" "${meta_path}") + 30 - ${now}))
     local spread_time=$(generate_uniform_random "${SECONDS_SEND_SPREAD}")
     local sleep_time
     if [ ${spread_time} -gt ${holdoff_time} ]; then
@@ -673,8 +648,6 @@
 }
 
 main() {
-  trap cleanup EXIT INT TERM
-
   parseargs "$@"
 
   if [ -e "${PAUSE_CRASH_SENDING}" ] && \
@@ -693,31 +666,25 @@
   # (like with autotests) that we're still running.
   echo $$ > "${RUN_FILE}"
 
-  for dependency in "${FIND}" "${METRICS_CLIENT}" \
-                    "${RESTRICTED_CERTIFICATES_PATH}"; do
+  for dependency in "${RESTRICTED_CERTIFICATES_PATH}"; do
     if [ ! -x "${dependency}" ]; then
       lecho "Fatal: Crash sending disabled: ${dependency} not found."
       exit 1
     fi
   done
 
-  TMP_DIR="$(mktemp -d /tmp/crash_sender.XXXXXX)"
+  TMP_DIR="$(mktemp -d "${CRASH_STATE_DIR}/tmp/crash_sender.XXXXXX")"
 
   # Send system-wide crashes
-  send_crashes "/var/spool/crash"
-
-  # Send user-specific crashes
-  local d
-  for d in /home/chronos/crash /home/chronos/u-*/crash; do
-    send_crashes "${d}"
-  done
+  send_crashes "${CRASH_STATE_DIR}/crash"
 }
 
-(
-if ! flock -n 9; then
+trap cleanup EXIT INT TERM
+
+#TODO(http://b/23937249): Change the locking logic back to using flock.
+if ! mkdir "${CRASH_SENDER_LOCK}" 2>/dev/null; then
   lecho "Already running; quitting."
   crash_done
   exit 1
 fi
 main "$@"
-) 9>"${CRASH_SENDER_LOCK}"
diff --git a/crash_reporter/init.crash_reporter.rc b/crash_reporter/init.crash_reporter.rc
index 6882b77..db9bb6f 100644
--- a/crash_reporter/init.crash_reporter.rc
+++ b/crash_reporter/init.crash_reporter.rc
@@ -10,9 +10,20 @@
     # number to prevent infinitely recursing on crash handling.
     write /proc/sys/kernel/core_pipe_limit 4
 
+    # Remove any previous orphaned locks.
+    rmdir /data/misc/crash_reporter/lock/crash_sender
+
     # Create crash directories.
     mkdir /data/misc/crash_reporter 0700 root root
+    mkdir /data/misc/crash_reporter/lock 0700 root root
+    mkdir /data/misc/crash_reporter/log 0700 root root
+    mkdir /data/misc/crash_reporter/run 0700 root root
+    mkdir /data/misc/crash_reporter/tmp 0700 root root
 
 service crash_reporter /system/bin/crash_reporter --init
     class late_start
     oneshot
+
+service crash_sender /system/bin/periodic_scheduler 3600 14400 crash_sender \
+    /system/bin/crash_sender
+    class late_start
diff --git a/crash_reporter/periodic_scheduler b/crash_reporter/periodic_scheduler
new file mode 100755
index 0000000..7fdb5c9
--- /dev/null
+++ b/crash_reporter/periodic_scheduler
@@ -0,0 +1,81 @@
+#!/system/bin/sh
+
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Run tasks periodically.
+# Usage: $0 <delay_seconds> <timeout_seconds> <task_name> <task_binary>
+#
+# Executes task <task_name> by running <task_binary> every <delay_seconds>.
+
+set -e -u
+
+SCRIPT_NAME="$(basename "$0")"
+#CHECK_DELAY=300  # Check every 5 minutes.
+CHECK_DELAY=15  # Check every 5 minutes.
+KILL_DELAY=10    # How long to let the job clean up after a timeout.
+# Let the unittests override.
+: ${SPOOL_DIR:=/data/misc/crash_reporter/spool/cron-lite}
+
+loginfo() {
+  log -p i -t "${SCRIPT_NAME}" "$@"
+}
+
+trap "loginfo 'exiting'" EXIT
+
+check_and_fix_spool_paths() {
+  # Avoid weird spool paths if possible.
+  rm -f "$(dirname "${SPOOL_DIR}")" "${SPOOL_DIR}" 2>/dev/null || :
+  mkdir -p "${SPOOL_DIR}"
+  if [ ! -O "${SPOOL_DIR}" -o ! -d "${SPOOL_DIR}" ]; then
+    loginfo "Spool directory is damaged. Aborting!"
+    exit 1
+  fi
+}
+
+main() {
+  local delay="$1"
+  local timeout="$2"
+  local name="$3"
+  local spool_file="${SPOOL_DIR}/${name}"
+  shift 3
+
+  [ -z "${delay}" ] && exit 1
+  [ -z "${timeout}" ] && exit 1
+  [ -z "${name}" ] && exit 1
+  [ $# -eq 0 ] && exit 1
+  check_and_fix_spool_paths
+
+  while true; do
+    # Allow the sleep to be killed manually without terminating the handler.
+    # Send stderr to /dev/null to suppress the shell's "Terminated" message.
+    sleep $(( CHECK_DELAY + KILL_DELAY )) 2>/dev/null || true
+
+    [ ! -e "${spool_file}" ] && touch "${spool_file}"
+
+    local last_rotation="$(stat -c "%Y" "${spool_file}" 2>/dev/null || echo 0)"
+    local now="$(date +%s)"
+    local time_diff=$((now - last_rotation))
+
+    if [ ${time_diff} -gt ${delay} ]; then
+      rm "${spool_file}" || true
+      touch "${spool_file}"
+      loginfo "${name}: running $*"
+      timeout -k ${KILL_DELAY} ${timeout} "$@" || true
+      loginfo "${name}: job completed"
+    fi
+  done
+}
+
+main "$@"
diff --git a/fs_mgr/Android.mk b/fs_mgr/Android.mk
index 08d0671..cf2965e 100644
--- a/fs_mgr/Android.mk
+++ b/fs_mgr/Android.mk
@@ -3,13 +3,14 @@
 LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)
 
-LOCAL_SRC_FILES:= fs_mgr.c fs_mgr_verity.c fs_mgr_fstab.c
+LOCAL_SRC_FILES:= fs_mgr.c fs_mgr_verity.c fs_mgr_fstab.c fs_mgr_slotselect.c
 
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/include
 
 LOCAL_MODULE:= libfs_mgr
 LOCAL_STATIC_LIBRARIES := liblogwrap libmincrypt libext4_utils_static libsquashfs_utils
-LOCAL_C_INCLUDES += system/extras/ext4_utils system/extras/squashfs_utils
+LOCAL_C_INCLUDES += system/extras/ext4_utils system/extras/squashfs_utils \
+	bootable/recovery
 LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/include
 LOCAL_CFLAGS := -Werror
 
diff --git a/fs_mgr/fs_mgr_fstab.c b/fs_mgr/fs_mgr_fstab.c
index d77d41f..4f18339 100644
--- a/fs_mgr/fs_mgr_fstab.c
+++ b/fs_mgr/fs_mgr_fstab.c
@@ -20,8 +20,6 @@
 #include <string.h>
 #include <sys/mount.h>
 
-#include <cutils/properties.h>
-
 #include "fs_mgr_priv.h"
 
 struct fs_mgr_flag_values {
@@ -310,25 +308,13 @@
         fstab->recs[cnt].partnum = flag_vals.partnum;
         fstab->recs[cnt].swap_prio = flag_vals.swap_prio;
         fstab->recs[cnt].zram_size = flag_vals.zram_size;
-
-        /* If an A/B partition, modify block device to be the real block device */
-        if (fstab->recs[cnt].fs_mgr_flags & MF_SLOTSELECT) {
-            char propbuf[PROPERTY_VALUE_MAX];
-            char *tmp;
-
-            /* use the kernel parameter if set */
-            property_get("ro.boot.slot_suffix", propbuf, "");
-
-            if (asprintf(&tmp, "%s%s", fstab->recs[cnt].blk_device, propbuf) > 0) {
-                free(fstab->recs[cnt].blk_device);
-                fstab->recs[cnt].blk_device = tmp;
-            } else {
-                ERROR("Error updating block device name\n");
-                goto err;
-            }
-        }
         cnt++;
     }
+    /* If an A/B partition, modify block device to be the real block device */
+    if (fs_mgr_update_for_slotselect(fstab) != 0) {
+        ERROR("Error updating for slotselect\n");
+        goto err;
+    }
     fclose(fstab_file);
     free(line);
     return fstab;
diff --git a/fs_mgr/fs_mgr_priv.h b/fs_mgr/fs_mgr_priv.h
index cc02bac..992b544 100644
--- a/fs_mgr/fs_mgr_priv.h
+++ b/fs_mgr/fs_mgr_priv.h
@@ -82,6 +82,7 @@
 #define DM_BUF_SIZE 4096
 
 int fs_mgr_set_blk_ro(const char *blockdev);
+int fs_mgr_update_for_slotselect(struct fstab *fstab);
 
 #endif /* __CORE_FS_MGR_PRIV_H */
 
diff --git a/fs_mgr/fs_mgr_slotselect.c b/fs_mgr/fs_mgr_slotselect.c
new file mode 100644
index 0000000..ca07b18
--- /dev/null
+++ b/fs_mgr/fs_mgr_slotselect.c
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <cutils/properties.h>
+
+#include "fs_mgr.h"
+#include "fs_mgr_priv.h"
+
+#include "bootloader.h"
+
+// Copies slot_suffix from misc into |out_suffix|. Returns 0 on
+// success, -1 on error or if there is no non-empty slot_suffix.
+static int get_active_slot_suffix_from_misc(struct fstab *fstab,
+                                            char *out_suffix,
+                                            size_t suffix_len)
+{
+    int n;
+    int misc_fd;
+    ssize_t num_read;
+    struct bootloader_message msg;
+
+    misc_fd = -1;
+    for (n = 0; n < fstab->num_entries; n++) {
+        if (strcmp(fstab->recs[n].mount_point, "/misc") == 0) {
+            misc_fd = open(fstab->recs[n].blk_device, O_RDONLY);
+            if (misc_fd == -1) {
+                ERROR("Error opening misc partition \"%s\" (%s)\n",
+                      fstab->recs[n].blk_device,
+                      strerror(errno));
+                return -1;
+            } else {
+                break;
+            }
+        }
+    }
+
+    if (misc_fd == -1) {
+        ERROR("Error finding misc partition\n");
+        return -1;
+    }
+
+    num_read = TEMP_FAILURE_RETRY(read(misc_fd, &msg, sizeof(msg)));
+    // Linux will never return partial reads when reading from block
+    // devices so no need to worry about them.
+    if (num_read != sizeof(msg)) {
+        ERROR("Error reading bootloader_message (%s)\n", strerror(errno));
+        close(misc_fd);
+        return -1;
+    }
+    close(misc_fd);
+    if (msg.slot_suffix[0] == '\0')
+        return -1;
+    strncpy(out_suffix, msg.slot_suffix, suffix_len);
+    return 0;
+}
+
+// Gets slot_suffix from either the kernel cmdline / firmware or the
+// misc partition. Sets |out_suffix| on success and returns 0. Returns
+// -1 if slot_suffix could not be determined.
+static int get_active_slot_suffix(struct fstab *fstab, char *out_suffix,
+                                  size_t suffix_len)
+{
+    char propbuf[PROPERTY_VALUE_MAX];
+
+    // Get the suffix from the kernel commandline (note that we don't
+    // allow the empty suffix). On bootloaders natively supporting A/B
+    // we'll hit this path every time so don't bother logging it.
+    property_get("ro.boot.slot_suffix", propbuf, "");
+    if (propbuf[0] != '\0') {
+        strncpy(out_suffix, propbuf, suffix_len);
+        return 0;
+    }
+
+    // If we couldn't get the suffix from the kernel cmdline, try the
+    // the misc partition.
+    if (get_active_slot_suffix_from_misc(fstab, out_suffix, suffix_len) == 0) {
+        INFO("Using slot suffix \"%s\" from misc\n", out_suffix);
+        return 0;
+    }
+
+    ERROR("Error determining slot_suffix\n");
+
+    return -1;
+}
+
+// Updates |fstab| for slot_suffix. Returns 0 on success, -1 on error.
+int fs_mgr_update_for_slotselect(struct fstab *fstab)
+{
+    int n;
+    char suffix[PROPERTY_VALUE_MAX];
+    int got_suffix = 0;
+
+    for (n = 0; n < fstab->num_entries; n++) {
+        if (fstab->recs[n].fs_mgr_flags & MF_SLOTSELECT) {
+            char *tmp;
+
+            if (!got_suffix) {
+                memset(suffix, '\0', sizeof(suffix));
+                if (get_active_slot_suffix(fstab, suffix,
+                                           sizeof(suffix) - 1) != 0) {
+                  return -1;
+                }
+                got_suffix = 1;
+            }
+
+            if (asprintf(&tmp, "%s%s", fstab->recs[n].blk_device,
+                         suffix) > 0) {
+                free(fstab->recs[n].blk_device);
+                fstab->recs[n].blk_device = tmp;
+            } else {
+                return -1;
+            }
+        }
+    }
+    return 0;
+}
diff --git a/include/binderwrapper/binder_test_base.h b/include/binderwrapper/binder_test_base.h
new file mode 100644
index 0000000..06543de
--- /dev/null
+++ b/include/binderwrapper/binder_test_base.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SYSTEM_CORE_INCLUDE_BINDERWRAPPER_BINDER_TEST_BASE_H_
+#define SYSTEM_CORE_INCLUDE_BINDERWRAPPER_BINDER_TEST_BASE_H_
+
+#include <base/macros.h>
+#include <gtest/gtest.h>
+
+namespace android {
+
+class StubBinderWrapper;
+
+// Class that can be inherited from (or aliased via typedef/using) when writing
+// tests that use StubBinderManager.
+class BinderTestBase : public ::testing::Test {
+ public:
+  BinderTestBase();
+  ~BinderTestBase() override;
+
+  StubBinderWrapper* binder_wrapper() { return binder_wrapper_; }
+
+ protected:
+  StubBinderWrapper* binder_wrapper_;  // Not owned.
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(BinderTestBase);
+};
+
+}  // namespace android
+
+#endif  // SYSTEM_CORE_INCLUDE_BINDERWRAPPER_BINDER_TEST_BASE_H_
diff --git a/include/binderwrapper/binder_wrapper.h b/include/binderwrapper/binder_wrapper.h
new file mode 100644
index 0000000..e57cf83
--- /dev/null
+++ b/include/binderwrapper/binder_wrapper.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SYSTEM_CORE_INCLUDE_BINDERWRAPPER_BINDER_WRAPPER_H_
+#define SYSTEM_CORE_INCLUDE_BINDERWRAPPER_BINDER_WRAPPER_H_
+
+#include <string>
+
+#include <base/callback.h>
+#include <utils/StrongPointer.h>
+
+namespace android {
+
+class BBinder;
+class IBinder;
+
+// Wraps libbinder to make it testable.
+class BinderWrapper {
+ public:
+  virtual ~BinderWrapper() {}
+
+  // Creates and initializes the singleton (using a wrapper that communicates
+  // with the real binder system).
+  static void Create();
+
+  // Initializes |wrapper| as the singleton, taking ownership of it. Tests that
+  // want to inject their own wrappers should call this instead of Create().
+  static void InitForTesting(BinderWrapper* wrapper);
+
+  // Destroys the singleton. Must be called before calling Create() or
+  // InitForTesting() a second time.
+  static void Destroy();
+
+  // Returns the singleton instance previously created by Create() or set by
+  // InitForTesting().
+  static BinderWrapper* Get();
+
+  // Gets the binder for communicating with the service identified by
+  // |service_name|, returning null immediately if it doesn't exist.
+  virtual sp<IBinder> GetService(const std::string& service_name) = 0;
+
+  // Registers |binder| as |service_name| with the service manager.
+  virtual bool RegisterService(const std::string& service_name,
+                               const sp<IBinder>& binder) = 0;
+
+  // Creates a local binder object.
+  virtual sp<BBinder> CreateLocalBinder() = 0;
+
+  // Registers |callback| to be invoked when |binder| dies. If another callback
+  // is currently registered for |binder|, it will be replaced.
+  virtual bool RegisterForDeathNotifications(
+      const sp<IBinder>& binder,
+      const base::Closure& callback) = 0;
+
+  // Unregisters the callback, if any, for |binder|.
+  virtual bool UnregisterForDeathNotifications(const sp<IBinder>& binder) = 0;
+
+ private:
+  static BinderWrapper* instance_;
+};
+
+}  // namespace android
+
+#endif  // SYSTEM_CORE_INCLUDE_BINDERWRAPPER_BINDER_WRAPPER_H_
diff --git a/include/binderwrapper/stub_binder_wrapper.h b/include/binderwrapper/stub_binder_wrapper.h
new file mode 100644
index 0000000..6e198ae
--- /dev/null
+++ b/include/binderwrapper/stub_binder_wrapper.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SYSTEM_CORE_INCLUDE_BINDERWRAPPER_STUB_BINDER_WRAPPER_H_
+#define SYSTEM_CORE_INCLUDE_BINDERWRAPPER_STUB_BINDER_WRAPPER_H_
+
+#include <map>
+#include <string>
+#include <vector>
+
+#include <base/macros.h>
+#include <binder/Binder.h>
+#include <binder/IBinder.h>
+#include <binderwrapper/binder_wrapper.h>
+
+namespace android {
+
+// Stub implementation of BinderWrapper for testing.
+//
+// Example usage:
+//
+// First, assuming a base IFoo binder interface, create a stub class that
+// derives from BnFoo to implement the receiver side of the communication:
+//
+//   class StubFoo : public BnFoo {
+//    public:
+//     ...
+//     status_t doSomething(int arg) override {
+//       // e.g. save passed-in value for later inspection by tests.
+//       return OK;
+//     }
+//   };
+//
+// Next, from your test code, inject a StubBinderManager either directly or by
+// inheriting from the BinderTestBase class:
+//
+//   StubBinderWrapper* wrapper = new StubBinderWrapper();
+//   BinderWrapper::InitForTesting(wrapper);  // Takes ownership.
+//
+// Also from your test, create a StubFoo and register it with the wrapper:
+//
+//   StubFoo* foo = new StubFoo();
+//   sp<IBinder> binder(foo);
+//   wrapper->SetBinderForService("foo", binder);
+//
+// The code being tested can now use the wrapper to get the stub and call it:
+//
+//   sp<IBinder> binder = BinderWrapper::Get()->GetService("foo");
+//   CHECK(binder.get());
+//   sp<IFoo> foo = interface_cast<IFoo>(binder);
+//   CHECK_EQ(foo->doSomething(3), OK);
+//
+// To create a local BBinder object, production code can call
+// CreateLocalBinder(). Then, a test can get the BBinder's address via
+// local_binders() to check that they're passed as expected in binder calls.
+//
+class StubBinderWrapper : public BinderWrapper {
+ public:
+  StubBinderWrapper();
+  ~StubBinderWrapper() override;
+
+  const std::vector<sp<BBinder>>& local_binders() const {
+    return local_binders_;
+  }
+  void clear_local_binders() { local_binders_.clear(); }
+
+  // Sets the binder to return when |service_name| is passed to GetService() or
+  // WaitForService().
+  void SetBinderForService(const std::string& service_name,
+                           const sp<IBinder>& binder);
+
+  // Returns the binder previously registered for |service_name| via
+  // RegisterService(), or null if the service hasn't been registered.
+  sp<IBinder> GetRegisteredService(const std::string& service_name) const;
+
+  // Run the calback in |death_callbacks_| corresponding to |binder|.
+  void NotifyAboutBinderDeath(const sp<IBinder>& binder);
+
+  // BinderWrapper:
+  sp<IBinder> GetService(const std::string& service_name) override;
+  bool RegisterService(const std::string& service_name,
+                       const sp<IBinder>& binder) override;
+  sp<BBinder> CreateLocalBinder() override;
+  bool RegisterForDeathNotifications(const sp<IBinder>& binder,
+                                     const base::Closure& callback) override;
+  bool UnregisterForDeathNotifications(const sp<IBinder>& binder) override;
+
+ private:
+  using ServiceMap = std::map<std::string, sp<IBinder>>;
+
+  // Map from service name to associated binder handle. Used by GetService() and
+  // WaitForService().
+  ServiceMap services_to_return_;
+
+  // Map from service name to associated binder handle. Updated by
+  // RegisterService().
+  ServiceMap registered_services_;
+
+  // Local binders returned by CreateLocalBinder().
+  std::vector<sp<BBinder>> local_binders_;
+
+  // Map from binder handle to the callback that should be invoked on binder
+  // death.
+  std::map<sp<IBinder>, base::Closure> death_callbacks_;
+
+  DISALLOW_COPY_AND_ASSIGN(StubBinderWrapper);
+};
+
+}  // namespace android
+
+#endif  // SYSTEM_CORE_INCLUDE_BINDERWRAPPER_STUB_BINDER_WRAPPER_H_
diff --git a/libbinderwrapper/Android.mk b/libbinderwrapper/Android.mk
new file mode 100644
index 0000000..23c2246
--- /dev/null
+++ b/libbinderwrapper/Android.mk
@@ -0,0 +1,62 @@
+#
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+binderwrapperCommonCFlags := -Wall -Werror -Wno-unused-parameter
+binderwrapperCommonCFlags += -Wno-sign-promo  # for libchrome
+binderwrapperCommonExportCIncludeDirs := $(LOCAL_PATH)/../include
+binderwrapperCommonCIncludes := $(LOCAL_PATH)/../include
+binderwrapperCommonSharedLibraries := \
+  libbinder \
+  libchrome \
+  libutils \
+
+# libbinderwrapper shared library
+# ========================================================
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := libbinderwrapper
+LOCAL_CPP_EXTENSION := .cc
+LOCAL_CFLAGS := $(binderwrapperCommonCFlags)
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(binderwrapperCommonExportCIncludeDirs)
+LOCAL_C_INCLUDES := $(binderwrapperCommonCIncludes)
+LOCAL_SHARED_LIBRARIES := $(binderwrapperCommonSharedLibraries)
+LOCAL_SRC_FILES := \
+  binder_wrapper.cc \
+  real_binder_wrapper.cc \
+
+include $(BUILD_SHARED_LIBRARY)
+
+# libbinderwrapper_test_support shared library
+# ========================================================
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := libbinderwrapper_test_support
+LOCAL_CPP_EXTENSION := .cc
+LOCAL_CFLAGS := $(binderwrapperCommonCFlags)
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(binderwrapperCommonExportCIncludeDirs)
+LOCAL_C_INCLUDES := $(binderwrapperCommonCIncludes)
+LOCAL_STATIC_LIBRARIES := libgtest
+LOCAL_SHARED_LIBRARIES := \
+  $(binderwrapperCommonSharedLibraries) \
+  libbinderwrapper \
+
+LOCAL_SRC_FILES := \
+  binder_test_base.cc \
+  stub_binder_wrapper.cc \
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/libbinderwrapper/binder_test_base.cc b/libbinderwrapper/binder_test_base.cc
new file mode 100644
index 0000000..af93a04
--- /dev/null
+++ b/libbinderwrapper/binder_test_base.cc
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <binderwrapper/binder_test_base.h>
+
+#include <binderwrapper/binder_wrapper.h>
+#include <binderwrapper/stub_binder_wrapper.h>
+
+namespace android {
+
+BinderTestBase::BinderTestBase() : binder_wrapper_(new StubBinderWrapper()) {
+  // Pass ownership.
+  BinderWrapper::InitForTesting(binder_wrapper_);
+}
+
+BinderTestBase::~BinderTestBase() {
+  BinderWrapper::Destroy();
+}
+
+}  // namespace android
diff --git a/libbinderwrapper/binder_wrapper.cc b/libbinderwrapper/binder_wrapper.cc
new file mode 100644
index 0000000..0b5ff96
--- /dev/null
+++ b/libbinderwrapper/binder_wrapper.cc
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <binderwrapper/binder_wrapper.h>
+
+#include <base/logging.h>
+
+#include "real_binder_wrapper.h"
+
+namespace android {
+
+// Singleton instance.
+BinderWrapper* BinderWrapper::instance_ = nullptr;
+
+// static
+void BinderWrapper::Create() {
+  CHECK(!instance_) << "Already initialized; missing call to Destroy()?";
+  instance_ = new RealBinderWrapper();
+}
+
+// static
+void BinderWrapper::InitForTesting(BinderWrapper* wrapper) {
+  CHECK(!instance_) << "Already initialized; missing call to Destroy()?";
+  instance_ = wrapper;
+}
+
+// static
+void BinderWrapper::Destroy() {
+  CHECK(instance_) << "Not initialized; missing call to Create()?";
+  delete instance_;
+  instance_ = nullptr;
+}
+
+// static
+BinderWrapper* BinderWrapper::Get() {
+  CHECK(instance_) << "Not initialized; missing call to Create()?";
+  return instance_;
+}
+
+}  // namespace android
diff --git a/libbinderwrapper/real_binder_wrapper.cc b/libbinderwrapper/real_binder_wrapper.cc
new file mode 100644
index 0000000..adff19b
--- /dev/null
+++ b/libbinderwrapper/real_binder_wrapper.cc
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "real_binder_wrapper.h"
+
+#include <base/logging.h>
+#include <binder/Binder.h>
+#include <binder/IBinder.h>
+#include <binder/IServiceManager.h>
+
+namespace android {
+
+// Class that handles binder death notifications. libbinder wants the recipient
+// to be wrapped in sp<>, so registering RealBinderWrapper as a recipient would
+// be awkward.
+class RealBinderWrapper::DeathRecipient : public IBinder::DeathRecipient {
+ public:
+  explicit DeathRecipient(const base::Closure& callback)
+      : callback_(callback) {}
+  ~DeathRecipient() = default;
+
+  // IBinder::DeathRecipient:
+  void binderDied(const wp<IBinder>& who) override {
+    callback_.Run();
+  }
+
+ private:
+  // Callback to run in response to binder death.
+  base::Closure callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeathRecipient);
+};
+
+RealBinderWrapper::RealBinderWrapper() = default;
+
+RealBinderWrapper::~RealBinderWrapper() = default;
+
+sp<IBinder> RealBinderWrapper::GetService(const std::string& service_name) {
+  sp<IServiceManager> service_manager = defaultServiceManager();
+  if (!service_manager.get()) {
+    LOG(ERROR) << "Unable to get service manager";
+    return sp<IBinder>();
+  }
+  sp<IBinder> binder =
+      service_manager->checkService(String16(service_name.c_str()));
+  if (!binder.get())
+    LOG(ERROR) << "Unable to get \"" << service_name << "\" service";
+  return binder;
+}
+
+bool RealBinderWrapper::RegisterService(const std::string& service_name,
+                                        const sp<IBinder>& binder) {
+  sp<IServiceManager> service_manager = defaultServiceManager();
+  if (!service_manager.get()) {
+    LOG(ERROR) << "Unable to get service manager";
+    return false;
+  }
+  status_t status = defaultServiceManager()->addService(
+      String16(service_name.c_str()), binder);
+  if (status != OK) {
+    LOG(ERROR) << "Failed to register \"" << service_name << "\" with service "
+               << "manager";
+    return false;
+  }
+  return true;
+}
+
+sp<BBinder> RealBinderWrapper::CreateLocalBinder() {
+  return sp<BBinder>(new BBinder());
+}
+
+bool RealBinderWrapper::RegisterForDeathNotifications(
+    const sp<IBinder>& binder,
+    const base::Closure& callback) {
+  sp<DeathRecipient> recipient(new DeathRecipient(callback));
+  if (binder->linkToDeath(recipient) != OK) {
+    LOG(ERROR) << "Failed to register for death notifications on "
+               << binder.get();
+    return false;
+  }
+  death_recipients_[binder] = recipient;
+  return true;
+}
+
+bool RealBinderWrapper::UnregisterForDeathNotifications(
+    const sp<IBinder>& binder) {
+  auto it = death_recipients_.find(binder);
+  if (it == death_recipients_.end()) {
+    LOG(ERROR) << "Not registered for death notifications on " << binder.get();
+    return false;
+  }
+  if (binder->unlinkToDeath(it->second) != OK) {
+    LOG(ERROR) << "Failed to unregister for death notifications on "
+               << binder.get();
+    return false;
+  }
+  death_recipients_.erase(it);
+  return true;
+}
+
+}  // namespace android
diff --git a/libbinderwrapper/real_binder_wrapper.h b/libbinderwrapper/real_binder_wrapper.h
new file mode 100644
index 0000000..8e281f2
--- /dev/null
+++ b/libbinderwrapper/real_binder_wrapper.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SYSTEM_CORE_LIBBINDERWRAPPER_REAL_BINDER_WRAPPER_H_
+#define SYSTEM_CORE_LIBBINDERWRAPPER_REAL_BINDER_WRAPPER_H_
+
+#include <base/macros.h>
+#include <binderwrapper/binder_wrapper.h>
+
+namespace android {
+
+class IBinder;
+
+// Real implementation of BinderWrapper.
+class RealBinderWrapper : public BinderWrapper {
+ public:
+  RealBinderWrapper();
+  ~RealBinderWrapper() override;
+
+  // BinderWrapper:
+  sp<IBinder> GetService(const std::string& service_name) override;
+  bool RegisterService(const std::string& service_name,
+                       const sp<IBinder>& binder) override;
+  sp<BBinder> CreateLocalBinder() override;
+  bool RegisterForDeathNotifications(const sp<IBinder>& binder,
+                                     const base::Closure& callback) override;
+  bool UnregisterForDeathNotifications(const sp<IBinder>& binder) override;
+
+ private:
+  class DeathRecipient;
+
+  // Map from binder handle to object that should be notified of the binder's
+  // death.
+  std::map<sp<IBinder>, sp<DeathRecipient>> death_recipients_;
+
+  DISALLOW_COPY_AND_ASSIGN(RealBinderWrapper);
+};
+
+}  // namespace android
+
+#endif  // SYSTEM_CORE_LIBBINDER_WRAPPER_REAL_BINDER_WRAPPER_H_
diff --git a/libbinderwrapper/stub_binder_wrapper.cc b/libbinderwrapper/stub_binder_wrapper.cc
new file mode 100644
index 0000000..1d24681
--- /dev/null
+++ b/libbinderwrapper/stub_binder_wrapper.cc
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <binderwrapper/stub_binder_wrapper.h>
+
+#include <base/logging.h>
+#include <binder/Binder.h>
+#include <binder/IBinder.h>
+
+namespace android {
+
+StubBinderWrapper::StubBinderWrapper() = default;
+
+StubBinderWrapper::~StubBinderWrapper() = default;
+
+void StubBinderWrapper::SetBinderForService(const std::string& service_name,
+                                            const sp<IBinder>& binder) {
+  services_to_return_[service_name] = binder;
+}
+
+sp<IBinder> StubBinderWrapper::GetRegisteredService(
+    const std::string& service_name) const {
+  const auto it = registered_services_.find(service_name);
+  return it != registered_services_.end() ? it->second : sp<IBinder>();
+}
+
+void StubBinderWrapper::NotifyAboutBinderDeath(const sp<IBinder>& binder) {
+  const auto it = death_callbacks_.find(binder);
+  if (it != death_callbacks_.end())
+    it->second.Run();
+}
+
+sp<IBinder> StubBinderWrapper::GetService(const std::string& service_name) {
+  const auto it = services_to_return_.find(service_name);
+  return it != services_to_return_.end() ? it->second : sp<IBinder>();
+}
+
+bool StubBinderWrapper::RegisterService(const std::string& service_name,
+                                        const sp<IBinder>& binder) {
+  registered_services_[service_name] = binder;
+  return true;
+}
+
+sp<BBinder> StubBinderWrapper::CreateLocalBinder() {
+  sp<BBinder> binder(new BBinder());
+  local_binders_.push_back(binder);
+  return binder;
+}
+
+bool StubBinderWrapper::RegisterForDeathNotifications(
+    const sp<IBinder>& binder,
+    const base::Closure& callback) {
+  death_callbacks_[binder] = callback;
+  return true;
+}
+
+bool StubBinderWrapper::UnregisterForDeathNotifications(
+    const sp<IBinder>& binder) {
+  death_callbacks_.erase(binder);
+  return true;
+}
+
+}  // namespace android
diff --git a/liblog/Android.mk b/liblog/Android.mk
index 3a1a9db..271c6f9 100644
--- a/liblog/Android.mk
+++ b/liblog/Android.mk
@@ -50,6 +50,7 @@
 LOCAL_LDLIBS_linux := -lrt
 LOCAL_MULTILIB := both
 LOCAL_CXX_STL := none
+LOCAL_MODULE_HOST_OS := darwin linux windows
 include $(BUILD_HOST_SHARED_LIBRARY)
 
 
diff --git a/logd/LogBuffer.cpp b/logd/LogBuffer.cpp
index 0582a5f..c2f846e 100644
--- a/logd/LogBuffer.cpp
+++ b/logd/LogBuffer.cpp
@@ -242,8 +242,8 @@
         LogBufferElementCollection::iterator it, bool engageStats) {
     LogBufferElement *e = *it;
     log_id_t id = e->getLogId();
-    LogBufferIteratorMap::iterator f = mLastWorstUid[id].find(e->getUid());
 
+    LogBufferIteratorMap::iterator f = mLastWorstUid[id].find(e->getUid());
     if ((f != mLastWorstUid[id].end()) && (it == f->second)) {
         mLastWorstUid[id].erase(f);
     }
@@ -329,7 +329,51 @@
 
 // prune "pruneRows" of type "id" from the buffer.
 //
+// This garbage collection task is used to expire log entries. It is called to
+// remove all logs (clear), all UID logs (unprivileged clear), or every
+// 256 or 10% of the total logs (whichever is less) to prune the logs.
+//
+// First there is a prep phase where we discover the reader region lock that
+// acts as a backstop to any pruning activity to stop there and go no further.
+//
+// There are three major pruning loops that follow. All expire from the oldest
+// entries. Since there are multiple log buffers, the Android logging facility
+// will appear to drop entries 'in the middle' when looking at multiple log
+// sources and buffers. This effect is slightly more prominent when we prune
+// the worst offender by logging source. Thus the logs slowly loose content
+// and value as you move back in time. This is preferred since chatty sources
+// invariably move the logs value down faster as less chatty sources would be
+// expired in the noise.
+//
+// The first loop performs blacklisting and worst offender pruning. Falling
+// through when there are no notable worst offenders and have not hit the
+// region lock preventing further worst offender pruning. This loop also looks
+// after managing the chatty log entries and merging to help provide
+// statistical basis for blame. The chatty entries are not a notification of
+// how much logs you may have, but instead represent how much logs you would
+// have had in a virtual log buffer that is extended to cover all the in-memory
+// logs without loss. They last much longer than the represented pruned logs
+// since they get multiplied by the gains in the non-chatty log sources.
+//
+// The second loop get complicated because an algorithm of watermarks and
+// history is maintained to reduce the order and keep processing time
+// down to a minimum at scale. These algorithms can be costly in the face
+// of larger log buffers, or severly limited processing time granted to a
+// background task at lowest priority.
+//
+// This second loop does straight-up expiration from the end of the logs
+// (again, remember for the specified log buffer id) but does some whitelist
+// preservation. Thus whitelist is a Hail Mary low priority, blacklists and
+// spam filtration all take priority. This second loop also checks if a region
+// lock is causing us to buffer too much in the logs to help the reader(s),
+// and will tell the slowest reader thread to skip log entries, and if
+// persistent and hits a further threshold, kill the reader thread.
+//
+// The third thread is optional, and only gets hit if there was a whitelist
+// and more needs to be pruned against the backstop of the region lock.
+//
 // mLogElementsLock must be held when this function is called.
+//
 void LogBuffer::prune(log_id_t id, unsigned long pruneRows, uid_t caller_uid) {
     LogTimeEntry *oldest = NULL;
 
@@ -410,7 +454,12 @@
         bool kick = false;
         bool leading = true;
         it = mLogElements.begin();
-        if (worst != (uid_t) -1) {
+        // Perform at least one mandatory garbage collection cycle in following
+        // - clear leading chatty tags
+        // - merge chatty tags
+        // - check age-out of preserved logs
+        bool gc = pruneRows <= 1;
+        if (!gc && (worst != (uid_t) -1)) {
             LogBufferIteratorMap::iterator f = mLastWorstUid[id].find(worst);
             if ((f != mLastWorstUid[id].end())
                     && (f->second != mLogElements.end())) {
@@ -481,7 +530,7 @@
             // unmerged drop message
             if (dropped) {
                 last.add(e);
-                if ((e->getUid() == worst)
+                if ((!gc && (e->getUid() == worst))
                         || (mLastWorstUid[id].find(e->getUid())
                             == mLastWorstUid[id].end())) {
                     mLastWorstUid[id][e->getUid()] = it;
@@ -516,7 +565,10 @@
                     it = erase(it, false);
                 } else {
                     last.add(e);
-                    mLastWorstUid[id][e->getUid()] = it;
+                    if (!gc || (mLastWorstUid[id].find(worst)
+                                == mLastWorstUid[id].end())) {
+                        mLastWorstUid[id][worst] = it;
+                    }
                     ++it;
                 }
             }
diff --git a/metricsd/Android.mk b/metricsd/Android.mk
index 9620e16..c219ab1 100644
--- a/metricsd/Android.mk
+++ b/metricsd/Android.mk
@@ -115,7 +115,6 @@
 LOCAL_EXPORT_C_INCLUDE_DIRS += \
     $(generated_sources_dir)/proto/system/core/metricsd
 LOCAL_SRC_FILES :=  $(call all-proto-files-under,uploader/proto)
-LOCAL_STATIC_LIBRARIES := libprotobuf-cpp-lite
 include $(BUILD_STATIC_LIBRARY)
 
 # metrics daemon.
diff --git a/metricsd/metrics_client.cc b/metricsd/metrics_client.cc
index 57e96c2..f658b22 100644
--- a/metricsd/metrics_client.cc
+++ b/metricsd/metrics_client.cc
@@ -17,9 +17,15 @@
 #include <cstdio>
 #include <cstdlib>
 
+#include <base/memory/scoped_vector.h>
+
+#include "constants.h"
 #include "metrics/metrics_library.h"
+#include "serialization/metric_sample.h"
+#include "serialization/serialization_utils.h"
 
 enum Mode {
+    kModeDumpLogs,
     kModeSendSample,
     kModeSendEnumSample,
     kModeSendSparseSample,
@@ -36,12 +42,13 @@
           "        metrics_client -s   name sample\n"
           "        metrics_client -v   event\n"
           "        metrics_client -u action\n"
-          "        metrics_client [-cg]\n"
+          "        metrics_client [-cdg]\n"
           "\n"
           "  default: send metric with integer values \n"
           "           |min| > 0, |min| <= sample < |max|\n"
           "  -c: return exit status 0 if user consents to stats, 1 otherwise,\n"
           "      in guest mode always return 1\n"
+          "  -d: dump cached logs to the console\n"
           "  -e: send linear/enumeration histogram data\n"
           "  -g: return exit status 0 if machine in guest mode, 1 otherwise\n"
           "  -s: send a sparse histogram sample\n"
@@ -132,17 +139,57 @@
   return metrics_lib.IsGuestMode() ? 0 : 1;
 }
 
+static int DumpLogs() {
+  printf("Metrics from %s\n\n", metrics::kMetricsEventsFilePath);
+
+  ScopedVector<metrics::MetricSample> metrics;
+  metrics::SerializationUtils::ReadMetricsFromFile(
+      metrics::kMetricsEventsFilePath, &metrics);
+
+  for (ScopedVector<metrics::MetricSample>::const_iterator i = metrics.begin();
+       i != metrics.end(); ++i) {
+    const metrics::MetricSample* sample = *i;
+    printf("name: %s\t", sample->name().c_str());
+    printf("type: ");
+
+    switch (sample->type()) {
+      case metrics::MetricSample::CRASH:
+        printf("CRASH");
+        break;
+      case metrics::MetricSample::HISTOGRAM:
+        printf("HISTOGRAM");
+        break;
+      case metrics::MetricSample::LINEAR_HISTOGRAM:
+        printf("LINEAR_HISTOGRAM");
+        break;
+      case metrics::MetricSample::SPARSE_HISTOGRAM:
+        printf("SPARSE_HISTOGRAM");
+        break;
+      case metrics::MetricSample::USER_ACTION:
+        printf("USER_ACTION");
+        break;
+    }
+
+    printf("\n");
+  }
+
+  return 0;
+}
+
 int main(int argc, char** argv) {
   enum Mode mode = kModeSendSample;
   bool secs_to_msecs = false;
 
   // Parse arguments
   int flag;
-  while ((flag = getopt(argc, argv, "abcegstuv")) != -1) {
+  while ((flag = getopt(argc, argv, "abcdegstuv")) != -1) {
     switch (flag) {
       case 'c':
         mode = kModeHasConsent;
         break;
+      case 'd':
+        mode = kModeDumpLogs;
+        break;
       case 'e':
         mode = kModeSendEnumSample;
         break;
@@ -203,6 +250,8 @@
       return HasConsent();
     case kModeIsGuestMode:
       return IsGuestMode();
+    case kModeDumpLogs:
+      return DumpLogs();
     default:
       ShowUsage();
       return 0;
diff --git a/metricsd/serialization/serialization_utils.cc b/metricsd/serialization/serialization_utils.cc
index 6dd8258..102c940 100644
--- a/metricsd/serialization/serialization_utils.cc
+++ b/metricsd/serialization/serialization_utils.cc
@@ -96,6 +96,50 @@
   return true;
 }
 
+
+// Opens the metrics log file at |filename| in the given |mode|.
+//
+// Returns the file descriptor wrapped in a valid ScopedFD on success.
+base::ScopedFD OpenMetricsFile(const std::string& filename, mode_t mode) {
+  struct stat stat_buf;
+  int result;
+
+  result = stat(filename.c_str(), &stat_buf);
+  if (result < 0) {
+    if (errno != ENOENT)
+      DPLOG(ERROR) << filename << ": bad metrics file stat";
+
+    // Nothing to collect---try later.
+    return base::ScopedFD();
+  }
+  if (stat_buf.st_size == 0) {
+    // Also nothing to collect.
+    return base::ScopedFD();
+  }
+  base::ScopedFD fd(open(filename.c_str(), mode));
+  if (fd.get() < 0) {
+    DPLOG(ERROR) << filename << ": cannot open";
+    return base::ScopedFD();
+  }
+
+  return fd.Pass();
+}
+
+
+// Parses the contents of the metrics log file descriptor |fd| into |metrics|.
+void ReadAllMetricsFromFd(int fd, ScopedVector<MetricSample>* metrics) {
+  for (;;) {
+    std::string message;
+
+    if (!ReadMessage(fd, &message))
+      break;
+
+    scoped_ptr<MetricSample> sample = SerializationUtils::ParseSample(message);
+    if (sample)
+      metrics->push_back(sample.release());
+  }
+}
+
 }  // namespace
 
 scoped_ptr<MetricSample> SerializationUtils::ParseSample(
@@ -131,30 +175,27 @@
   return scoped_ptr<MetricSample>();
 }
 
+void SerializationUtils::ReadMetricsFromFile(
+    const std::string& filename,
+    ScopedVector<MetricSample>* metrics) {
+  base::ScopedFD fd(OpenMetricsFile(filename, O_RDONLY));
+  if (!fd.is_valid()) {
+    return;
+  }
+
+  // This processes all messages in the log.
+  ReadAllMetricsFromFd(fd.get(), metrics);
+}
+
 void SerializationUtils::ReadAndTruncateMetricsFromFile(
     const std::string& filename,
     ScopedVector<MetricSample>* metrics) {
-  struct stat stat_buf;
-  int result;
+  base::ScopedFD fd(OpenMetricsFile(filename, O_RDWR));
+  if (!fd.is_valid()) {
+    return;
+  }
 
-  result = stat(filename.c_str(), &stat_buf);
-  if (result < 0) {
-    if (errno != ENOENT)
-      DPLOG(ERROR) << filename << ": bad metrics file stat";
-
-    // Nothing to collect---try later.
-    return;
-  }
-  if (stat_buf.st_size == 0) {
-    // Also nothing to collect.
-    return;
-  }
-  base::ScopedFD fd(open(filename.c_str(), O_RDWR));
-  if (fd.get() < 0) {
-    DPLOG(ERROR) << filename << ": cannot open";
-    return;
-  }
-  result = flock(fd.get(), LOCK_EX);
+  int result = flock(fd.get(), LOCK_EX);
   if (result < 0) {
     DPLOG(ERROR) << filename << ": cannot lock";
     return;
@@ -162,16 +203,7 @@
 
   // This processes all messages in the log. When all messages are
   // read and processed, or an error occurs, truncate the file to zero size.
-  for (;;) {
-    std::string message;
-
-    if (!ReadMessage(fd.get(), &message))
-      break;
-
-    scoped_ptr<MetricSample> sample = ParseSample(message);
-    if (sample)
-      metrics->push_back(sample.release());
-  }
+  ReadAllMetricsFromFd(fd.get(), metrics);
 
   result = ftruncate(fd.get(), 0);
   if (result < 0)
diff --git a/metricsd/serialization/serialization_utils.h b/metricsd/serialization/serialization_utils.h
index 67d4675..655652d 100644
--- a/metricsd/serialization/serialization_utils.h
+++ b/metricsd/serialization/serialization_utils.h
@@ -35,7 +35,11 @@
 // deserialization was successful) or a NULL scoped_ptr.
 scoped_ptr<MetricSample> ParseSample(const std::string& sample);
 
-// Reads all samples from a file and truncate the file when done.
+// Reads all samples from a file. The file contents remain unchanged.
+void ReadMetricsFromFile(const std::string& filename,
+                         ScopedVector<MetricSample>* metrics);
+
+// Reads all samples from a file and truncates the file when done.
 void ReadAndTruncateMetricsFromFile(const std::string& filename,
                                     ScopedVector<MetricSample>* metrics);
 
diff --git a/toolbox/Android.mk b/toolbox/Android.mk
index 1d3605e..579d26e 100644
--- a/toolbox/Android.mk
+++ b/toolbox/Android.mk
@@ -24,18 +24,11 @@
 LOCAL_MODULE := libtoolbox_dd
 include $(BUILD_STATIC_LIBRARY)
 
-include $(CLEAR_VARS)
-LOCAL_SRC_FILES := upstream-netbsd/usr.bin/du/du.c
-LOCAL_CFLAGS += $(common_cflags) -Dmain=du_main
-LOCAL_MODULE := libtoolbox_du
-include $(BUILD_STATIC_LIBRARY)
-
 
 include $(CLEAR_VARS)
 
 BSD_TOOLS := \
     dd \
-    du \
 
 OUR_TOOLS := \
     df \
@@ -43,7 +36,6 @@
     iftop \
     ioctl \
     log \
-    lsof \
     nandread \
     newfs_msdos \
     ps \
diff --git a/toolbox/lsof.c b/toolbox/lsof.c
deleted file mode 100644
index 198ca52..0000000
--- a/toolbox/lsof.c
+++ /dev/null
@@ -1,296 +0,0 @@
-/*
- * Copyright (c) 2010, The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name of Google, Inc. nor the names of its contributors
- *    may be used to endorse or promote products derived from this
- *    software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <ctype.h>
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <libgen.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#include <pwd.h>
-#include <sys/stat.h>
-
-#define BUF_MAX 1024
-#define CMD_DISPLAY_MAX (9 + 1)
-#define USER_DISPLAY_MAX (10 + 1)
-
-struct pid_info_t {
-    pid_t pid;
-    char user[USER_DISPLAY_MAX];
-
-    char cmdline[CMD_DISPLAY_MAX];
-
-    char path[PATH_MAX];
-    ssize_t parent_length;
-};
-
-static void print_header()
-{
-    printf("%-9s %5s %10s %4s   %9s %18s %9s %10s %s\n",
-            "COMMAND",
-            "PID",
-            "USER",
-            "FD",
-            "TYPE",
-            "DEVICE",
-            "SIZE/OFF",
-            "NODE",
-            "NAME");
-}
-
-static void print_symlink(const char* name, const char* path, struct pid_info_t* info)
-{
-    static ssize_t link_dest_size;
-    static char link_dest[PATH_MAX];
-
-    strlcat(info->path, path, sizeof(info->path));
-    if ((link_dest_size = readlink(info->path, link_dest, sizeof(link_dest)-1)) < 0) {
-        if (errno == ENOENT)
-            goto out;
-
-        snprintf(link_dest, sizeof(link_dest), "%s (readlink: %s)", info->path, strerror(errno));
-    } else {
-        link_dest[link_dest_size] = '\0';
-    }
-
-    // Things that are just the root filesystem are uninteresting (we already know)
-    if (!strcmp(link_dest, "/"))
-        goto out;
-
-    const char* fd = name;
-    char rw = ' ';
-    char locks = ' '; // TODO: read /proc/locks
-
-    const char* type = "unknown";
-    char device[32] = "?";
-    char size_off[32] = "?";
-    char node[32] = "?";
-
-    struct stat sb;
-    if (lstat(link_dest, &sb) != -1) {
-        switch ((sb.st_mode & S_IFMT)) {
-          case S_IFSOCK: type = "sock"; break; // TODO: what domain?
-          case S_IFLNK: type = "LINK"; break;
-          case S_IFREG: type = "REG"; break;
-          case S_IFBLK: type = "BLK"; break;
-          case S_IFDIR: type = "DIR"; break;
-          case S_IFCHR: type = "CHR"; break;
-          case S_IFIFO: type = "FIFO"; break;
-        }
-        snprintf(device, sizeof(device), "%d,%d", (int) sb.st_dev, (int) sb.st_rdev);
-        snprintf(node, sizeof(node), "%d", (int) sb.st_ino);
-        snprintf(size_off, sizeof(size_off), "%d", (int) sb.st_size);
-    }
-
-    if (!name) {
-        // We're looking at an fd, so read its flags.
-        fd = path;
-        char fdinfo_path[PATH_MAX];
-        snprintf(fdinfo_path, sizeof(fdinfo_path), "/proc/%d/fdinfo/%s", info->pid, path);
-        FILE* fp = fopen(fdinfo_path, "r");
-        if (fp != NULL) {
-            int pos;
-            unsigned flags;
-
-            if (fscanf(fp, "pos: %d flags: %o", &pos, &flags) == 2) {
-                flags &= O_ACCMODE;
-                if (flags == O_RDONLY) rw = 'r';
-                else if (flags == O_WRONLY) rw = 'w';
-                else rw = 'u';
-            }
-            fclose(fp);
-        }
-    }
-
-    printf("%-9s %5d %10s %4s%c%c %9s %18s %9s %10s %s\n",
-            info->cmdline, info->pid, info->user, fd, rw, locks, type, device, size_off, node, link_dest);
-
-out:
-    info->path[info->parent_length] = '\0';
-}
-
-// Prints out all file that have been memory mapped
-static void print_maps(struct pid_info_t* info)
-{
-    FILE *maps;
-    size_t offset;
-    char device[10];
-    long int inode;
-    char file[PATH_MAX];
-
-    strlcat(info->path, "maps", sizeof(info->path));
-
-    maps = fopen(info->path, "r");
-    if (!maps)
-        goto out;
-
-    while (fscanf(maps, "%*x-%*x %*s %zx %s %ld %s\n", &offset, device, &inode, file) == 4) {
-        // We don't care about non-file maps
-        if (inode == 0 || !strcmp(device, "00:00"))
-            continue;
-
-        printf("%-9s %5d %10s %4s   %9s %18s %9zd %10ld %s\n",
-                info->cmdline, info->pid, info->user, "mem",
-                "REG", device, offset, inode, file);
-    }
-
-    fclose(maps);
-
-out:
-    info->path[info->parent_length] = '\0';
-}
-
-// Prints out all open file descriptors
-static void print_fds(struct pid_info_t* info)
-{
-    static char* fd_path = "fd/";
-    strlcat(info->path, fd_path, sizeof(info->path));
-
-    int previous_length = info->parent_length;
-    info->parent_length += strlen(fd_path);
-
-    DIR *dir = opendir(info->path);
-    if (dir == NULL) {
-        char msg[BUF_MAX];
-        snprintf(msg, sizeof(msg), "%s (opendir: %s)", info->path, strerror(errno));
-        printf("%-9s %5d %10s %4s   %9s %18s %9s %10s %s\n",
-                info->cmdline, info->pid, info->user, "FDS",
-                "", "", "", "", msg);
-        goto out;
-    }
-
-    struct dirent* de;
-    while ((de = readdir(dir))) {
-        if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
-            continue;
-
-        print_symlink(NULL, de->d_name, info);
-    }
-    closedir(dir);
-
-out:
-    info->parent_length = previous_length;
-    info->path[info->parent_length] = '\0';
-}
-
-static void lsof_dumpinfo(pid_t pid)
-{
-    int fd;
-    struct pid_info_t info;
-    struct stat pidstat;
-    struct passwd *pw;
-
-    info.pid = pid;
-    snprintf(info.path, sizeof(info.path), "/proc/%d/", pid);
-    info.parent_length = strlen(info.path);
-
-    // Get the UID by calling stat on the proc/pid directory.
-    if (!stat(info.path, &pidstat)) {
-        pw = getpwuid(pidstat.st_uid);
-        if (pw) {
-            strlcpy(info.user, pw->pw_name, sizeof(info.user));
-        } else {
-            snprintf(info.user, USER_DISPLAY_MAX, "%d", (int)pidstat.st_uid);
-        }
-    } else {
-        strcpy(info.user, "???");
-    }
-
-    // Read the command line information; each argument is terminated with NULL.
-    strlcat(info.path, "cmdline", sizeof(info.path));
-    fd = open(info.path, O_RDONLY);
-    if (fd < 0) {
-        fprintf(stderr, "Couldn't read %s\n", info.path);
-        return;
-    }
-
-    char cmdline[PATH_MAX];
-    int numRead = read(fd, cmdline, sizeof(cmdline) - 1);
-    close(fd);
-
-    if (numRead < 0) {
-        fprintf(stderr, "Error reading cmdline: %s: %s\n", info.path, strerror(errno));
-        return;
-    }
-
-    cmdline[numRead] = '\0';
-
-    // We only want the basename of the cmdline
-    strlcpy(info.cmdline, basename(cmdline), sizeof(info.cmdline));
-
-    // Read each of these symlinks
-    print_symlink("cwd", "cwd", &info);
-    print_symlink("txt", "exe", &info);
-    print_symlink("rtd", "root", &info);
-    print_fds(&info);
-    print_maps(&info);
-}
-
-int lsof_main(int argc, char *argv[])
-{
-    long int pid = 0;
-    char* endptr;
-    if (argc == 2) {
-        pid = strtol(argv[1], &endptr, 10);
-    }
-
-    print_header();
-
-    if (pid) {
-        lsof_dumpinfo(pid);
-    } else {
-        DIR *dir = opendir("/proc");
-        if (dir == NULL) {
-            fprintf(stderr, "Couldn't open /proc\n");
-            return -1;
-        }
-
-        struct dirent* de;
-        while ((de = readdir(dir))) {
-            if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
-                continue;
-
-            // Only inspect directories that are PID numbers
-            pid = strtol(de->d_name, &endptr, 10);
-            if (*endptr != '\0')
-                continue;
-
-            lsof_dumpinfo(pid);
-        }
-        closedir(dir);
-    }
-
-    return 0;
-}
diff --git a/toolbox/upstream-netbsd/usr.bin/du/du.c b/toolbox/upstream-netbsd/usr.bin/du/du.c
deleted file mode 100644
index 086ac4a..0000000
--- a/toolbox/upstream-netbsd/usr.bin/du/du.c
+++ /dev/null
@@ -1,364 +0,0 @@
-/*	$NetBSD: du.c,v 1.36 2012/03/11 11:23:20 shattered Exp $	*/
-
-/*
- * Copyright (c) 1989, 1993, 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Chris Newcomb.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-#ifndef lint
-__COPYRIGHT("@(#) Copyright (c) 1989, 1993, 1994\
- The Regents of the University of California.  All rights reserved.");
-#endif /* not lint */
-
-#ifndef lint
-#if 0
-static char sccsid[] = "@(#)du.c	8.5 (Berkeley) 5/4/95";
-#else
-__RCSID("$NetBSD: du.c,v 1.36 2012/03/11 11:23:20 shattered Exp $");
-#endif
-#endif /* not lint */
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-
-#include <dirent.h>
-#include <err.h>
-#include <errno.h>
-#include <fts.h>
-#include <inttypes.h>
-#include <util.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <limits.h>
-
-/* Count inodes or file size */
-#define	COUNT	(iflag ? 1 : p->fts_statp->st_blocks)
-
-static int	linkchk(dev_t, ino_t);
-static void	prstat(const char *, int64_t);
-__dead static void	usage(void);
-
-static int hflag, iflag;
-static long blocksize;
-
-int
-main(int argc, char *argv[])
-{
-	FTS *fts;
-	FTSENT *p;
-	int64_t totalblocks;
-	int ftsoptions, listfiles;
-	int depth;
-	int Hflag, Lflag, aflag, ch, cflag, dflag, gkmflag, nflag, rval, sflag;
-	const char *noargv[2];
-
-	Hflag = Lflag = aflag = cflag = dflag = gkmflag = nflag = sflag = 0;
-	totalblocks = 0;
-	ftsoptions = FTS_PHYSICAL;
-	depth = INT_MAX;
-	while ((ch = getopt(argc, argv, "HLPacd:ghikmnrsx")) != -1)
-		switch (ch) {
-		case 'H':
-			Hflag = 1;
-			Lflag = 0;
-			break;
-		case 'L':
-			Lflag = 1;
-			Hflag = 0;
-			break;
-		case 'P':
-			Hflag = Lflag = 0;
-			break;
-		case 'a':
-			aflag = 1;
-			break;
-		case 'c':
-			cflag = 1;
-			break;
-		case 'd':
-			dflag = 1;
-			depth = atoi(optarg);
-			if (depth < 0 || depth > SHRT_MAX) {
-				warnx("invalid argument to option d: %s", 
-					optarg);
-				usage();
-			}
-			break;
-		case 'g':
-			blocksize = 1024 * 1024 * 1024;
-			gkmflag = 1;
-			break;
-		case 'h':
-			hflag = 1;
-			break;
-		case 'i':
-			iflag = 1;
-			break;
-		case 'k':
-			blocksize = 1024;
-			gkmflag = 1;
-			break;
-		case 'm':
-			blocksize = 1024 * 1024;
-			gkmflag = 1;
-			break; 
-		case 'n':
-			nflag = 1;
-			break;
-		case 'r':
-			break;
-		case 's':
-			sflag = 1;
-			break;
-		case 'x':
-			ftsoptions |= FTS_XDEV;
-			break;
-		case '?':
-		default:
-			usage();
-		}
-	argc -= optind;
-	argv += optind;
-
-	/*
-	 * XXX
-	 * Because of the way that fts(3) works, logical walks will not count
-	 * the blocks actually used by symbolic links.  We rationalize this by
-	 * noting that users computing logical sizes are likely to do logical
-	 * copies, so not counting the links is correct.  The real reason is
-	 * that we'd have to re-implement the kernel's symbolic link traversing
-	 * algorithm to get this right.  If, for example, you have relative
-	 * symbolic links referencing other relative symbolic links, it gets
-	 * very nasty, very fast.  The bottom line is that it's documented in
-	 * the man page, so it's a feature.
-	 */
-	if (Hflag)
-		ftsoptions |= FTS_COMFOLLOW;
-	if (Lflag) {
-		ftsoptions &= ~FTS_PHYSICAL;
-		ftsoptions |= FTS_LOGICAL;
-	}
-
-	listfiles = 0;
-	if (aflag) {
-		if (sflag || dflag)
-			usage();
-		listfiles = 1;
-	} else if (sflag) {
-		if (dflag)
-			usage();
-		depth = 0;
-	}
-
-	if (!*argv) {
-		noargv[0] = ".";
-		noargv[1] = NULL;
-		argv = __UNCONST(noargv);
-	}
-
-	if (!gkmflag)
-		(void)getbsize(NULL, &blocksize);
-	blocksize /= 512;
-
-	if ((fts = fts_open(argv, ftsoptions, NULL)) == NULL)
-		err(1, "fts_open `%s'", *argv);
-
-	for (rval = 0; (p = fts_read(fts)) != NULL;) {
-#ifndef __ANDROID__
-		if (nflag) {
-			switch (p->fts_info) {
-			case FTS_NS:
-			case FTS_SLNONE:
-				/* nothing */
-				break;
-			default:
-				if (p->fts_statp->st_flags & UF_NODUMP) {
-					fts_set(fts, p, FTS_SKIP);
-					continue;
-				}
-			}
-		}
-#endif
-		switch (p->fts_info) {
-		case FTS_D:			/* Ignore. */
-			break;
-		case FTS_DP:
-			p->fts_parent->fts_number += 
-			    p->fts_number += COUNT;
-			if (cflag)
-				totalblocks += COUNT;
-			/*
-			 * If listing each directory, or not listing files
-			 * or directories and this is post-order of the
-			 * root of a traversal, display the total.
-			 */
-			if (p->fts_level <= depth
-			    || (!listfiles && !p->fts_level))
-				prstat(p->fts_path, p->fts_number);
-			break;
-		case FTS_DC:			/* Ignore. */
-			break;
-		case FTS_DNR:			/* Warn, continue. */
-		case FTS_ERR:
-		case FTS_NS:
-			warnx("%s: %s", p->fts_path, strerror(p->fts_errno));
-			rval = 1;
-			break;
-		default:
-			if (p->fts_statp->st_nlink > 1 &&
-			    linkchk(p->fts_statp->st_dev, p->fts_statp->st_ino))
-				break;
-			/*
-			 * If listing each file, or a non-directory file was
-			 * the root of a traversal, display the total.
-			 */
-			if (listfiles || !p->fts_level)
-				prstat(p->fts_path, COUNT);
-			p->fts_parent->fts_number += COUNT;
-			if (cflag)
-				totalblocks += COUNT;
-		}
-	}
-	if (errno)
-		err(1, "fts_read");
-	if (cflag)
-		prstat("total", totalblocks);
-	exit(rval);
-}
-
-static void
-prstat(const char *fname, int64_t blocks)
-{
-	if (iflag) {
-		(void)printf("%" PRId64 "\t%s\n", blocks, fname);
-		return;
-	}
-
-	if (hflag) {
-		char buf[5];
-		int64_t sz = blocks * 512;
-
-		humanize_number(buf, sizeof(buf), sz, "", HN_AUTOSCALE,
-		    HN_B | HN_NOSPACE | HN_DECIMAL);
-
-		(void)printf("%s\t%s\n", buf, fname);
-	} else
-		(void)printf("%" PRId64 "\t%s\n",
-		    howmany(blocks, (int64_t)blocksize),
-		    fname);
-}
-
-static int
-linkchk(dev_t dev, ino_t ino)
-{
-	static struct entry {
-		dev_t	dev;
-		ino_t	ino;
-	} *htable;
-	static int htshift;  /* log(allocated size) */
-	static int htmask;   /* allocated size - 1 */
-	static int htused;   /* 2*number of insertions */
-	static int sawzero;  /* Whether zero is in table or not */
-	int h, h2;
-	uint64_t tmp;
-	/* this constant is (1<<64)/((1+sqrt(5))/2)
-	 * aka (word size)/(golden ratio)
-	 */
-	const uint64_t HTCONST = 11400714819323198485ULL;
-	const int HTBITS = CHAR_BIT * sizeof(tmp);
-
-	/* Never store zero in hashtable */
-	if (dev == 0 && ino == 0) {
-		h = sawzero;
-		sawzero = 1;
-		return h;
-	}
-
-	/* Extend hash table if necessary, keep load under 0.5 */
-	if (htused<<1 >= htmask) {
-		struct entry *ohtable;
-
-		if (!htable)
-			htshift = 10;   /* starting hashtable size */
-		else
-			htshift++;   /* exponential hashtable growth */
-
-		htmask  = (1 << htshift) - 1;
-		htused = 0;
-
-		ohtable = htable;
-		htable = calloc(htmask+1, sizeof(*htable));
-		if (!htable)
-			err(1, "calloc");
-
-		/* populate newly allocated hashtable */
-		if (ohtable) {
-			int i;
-			for (i = 0; i <= htmask>>1; i++)
-				if (ohtable[i].ino || ohtable[i].dev)
-					linkchk(ohtable[i].dev, ohtable[i].ino);
-			free(ohtable);
-		}
-	}
-
-	/* multiplicative hashing */
-	tmp = dev;
-	tmp <<= HTBITS>>1;
-	tmp |=  ino;
-	tmp *= HTCONST;
-	h  = tmp >> (HTBITS - htshift);
-	h2 = 1 | ( tmp >> (HTBITS - (htshift<<1) - 1)); /* must be odd */
-
-	/* open address hashtable search with double hash probing */
-	while (htable[h].ino || htable[h].dev) {
-		if ((htable[h].ino == ino) && (htable[h].dev == dev))
-			return 1;
-		h = (h + h2) & htmask;
-	}
-
-	/* Insert the current entry into hashtable */
-	htable[h].dev = dev;
-	htable[h].ino = ino;
-	htused++;
-	return 0;
-}
-
-static void
-usage(void)
-{
-
-	(void)fprintf(stderr,
-		"usage: du [-H | -L | -P] [-a | -d depth | -s] [-cghikmnrx] [file ...]\n");
-	exit(1);
-}