diff --git a/FsCrypt.cpp b/FsCrypt.cpp
index b7d3928..c3c9fef 100644
--- a/FsCrypt.cpp
+++ b/FsCrypt.cpp
@@ -411,11 +411,18 @@
     return true;
 }
 
+// "Lock" all encrypted directories whose key has been removed.  This is needed
+// because merely removing the keyring key doesn't affect inodes in the kernel's
+// inode cache whose per-file key was already set up.  So to remove the per-file
+// keys and make the files "appear encrypted", these inodes must be evicted.
+//
+// To do this, sync() to clean all dirty inodes, then drop all reclaimable slab
+// objects systemwide.  This is overkill, but it's the best available method
+// currently.  Don't use drop_caches mode "3" because that also evicts pagecache
+// for in-use files; all files relevant here are already closed and sync'ed.
 static void drop_caches() {
-    // Clean any dirty pages (otherwise they won't be dropped).
     sync();
-    // Drop inode and page caches.
-    if (!writeStringToFile("3", "/proc/sys/vm/drop_caches")) {
+    if (!writeStringToFile("2", "/proc/sys/vm/drop_caches")) {
         PLOG(ERROR) << "Failed to drop caches during key eviction";
     }
 }
diff --git a/Utils.cpp b/Utils.cpp
index df50658..1616d80 100644
--- a/Utils.cpp
+++ b/Utils.cpp
@@ -43,6 +43,7 @@
 #include <sys/sysmacros.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <unistd.h>
 
 #include <list>
 #include <mutex>
diff --git a/main.cpp b/main.cpp
index 27a701b..7555276 100644
--- a/main.cpp
+++ b/main.cpp
@@ -152,6 +152,7 @@
         {"blkid_untrusted_context", required_argument, 0, 'B'},
         {"fsck_context", required_argument, 0, 'f'},
         {"fsck_untrusted_context", required_argument, 0, 'F'},
+        {nullptr, 0, nullptr, 0},
     };
 
     int c;
diff --git a/vdc.cpp b/vdc.cpp
index 76eca3e..6136413 100644
--- a/vdc.cpp
+++ b/vdc.cpp
@@ -32,6 +32,7 @@
 
 #include <android-base/logging.h>
 #include <android-base/parseint.h>
+#include <android-base/strings.h>
 #include <android-base/stringprintf.h>
 #include <binder/IServiceManager.h>
 #include <binder/Status.h>
@@ -55,9 +56,10 @@
     return res;
 }
 
-static void checkStatus(android::binder::Status status) {
+static void checkStatus(std::vector<std::string>& cmd, android::binder::Status status) {
     if (status.isOk()) return;
-    LOG(ERROR) << "Failed: " << status.toString8().string();
+    std::string command = ::android::base::Join(cmd, " ");
+    LOG(ERROR) << "Command: " << command << " Failed: " << status.toString8().string();
     exit(ENOTTY);
 }
 
@@ -88,63 +90,63 @@
     auto vold = android::interface_cast<android::os::IVold>(binder);
 
     if (args[0] == "cryptfs" && args[1] == "enablefilecrypto") {
-        checkStatus(vold->fbeEnable());
+        checkStatus(args, vold->fbeEnable());
     } else if (args[0] == "cryptfs" && args[1] == "init_user0") {
-        checkStatus(vold->initUser0());
+        checkStatus(args, vold->initUser0());
     } else if (args[0] == "cryptfs" && args[1] == "enablecrypto") {
         int passwordType = android::os::IVold::PASSWORD_TYPE_DEFAULT;
         int encryptionFlags = android::os::IVold::ENCRYPTION_FLAG_NO_UI;
-        checkStatus(vold->fdeEnable(passwordType, "", encryptionFlags));
+        checkStatus(args, vold->fdeEnable(passwordType, "", encryptionFlags));
     } else if (args[0] == "cryptfs" && args[1] == "mountdefaultencrypted") {
-        checkStatus(vold->mountDefaultEncrypted());
+        checkStatus(args, vold->mountDefaultEncrypted());
     } else if (args[0] == "volume" && args[1] == "shutdown") {
-        checkStatus(vold->shutdown());
+        checkStatus(args, vold->shutdown());
     } else if (args[0] == "cryptfs" && args[1] == "checkEncryption" && args.size() == 3) {
-        checkStatus(vold->checkEncryption(args[2]));
+        checkStatus(args, vold->checkEncryption(args[2]));
     } else if (args[0] == "cryptfs" && args[1] == "mountFstab" && args.size() == 3) {
-        checkStatus(vold->mountFstab(args[2]));
+        checkStatus(args, vold->mountFstab(args[2]));
     } else if (args[0] == "cryptfs" && args[1] == "encryptFstab" && args.size() == 3) {
-        checkStatus(vold->encryptFstab(args[2]));
+        checkStatus(args, vold->encryptFstab(args[2]));
     } else if (args[0] == "checkpoint" && args[1] == "supportsCheckpoint" && args.size() == 2) {
         bool supported = false;
-        checkStatus(vold->supportsCheckpoint(&supported));
+        checkStatus(args, vold->supportsCheckpoint(&supported));
         return supported ? 1 : 0;
     } else if (args[0] == "checkpoint" && args[1] == "supportsBlockCheckpoint" && args.size() == 2) {
         bool supported = false;
-        checkStatus(vold->supportsBlockCheckpoint(&supported));
+        checkStatus(args, vold->supportsBlockCheckpoint(&supported));
         return supported ? 1 : 0;
     } else if (args[0] == "checkpoint" && args[1] == "supportsFileCheckpoint" && args.size() == 2) {
         bool supported = false;
-        checkStatus(vold->supportsFileCheckpoint(&supported));
+        checkStatus(args, vold->supportsFileCheckpoint(&supported));
         return supported ? 1 : 0;
     } else if (args[0] == "checkpoint" && args[1] == "startCheckpoint" && args.size() == 3) {
         int retry;
         if (!android::base::ParseInt(args[2], &retry)) exit(EINVAL);
-        checkStatus(vold->startCheckpoint(retry));
+        checkStatus(args, vold->startCheckpoint(retry));
     } else if (args[0] == "checkpoint" && args[1] == "needsCheckpoint" && args.size() == 2) {
         bool enabled = false;
-        checkStatus(vold->needsCheckpoint(&enabled));
+        checkStatus(args, vold->needsCheckpoint(&enabled));
         return enabled ? 1 : 0;
     } else if (args[0] == "checkpoint" && args[1] == "needsRollback" && args.size() == 2) {
         bool enabled = false;
-        checkStatus(vold->needsRollback(&enabled));
+        checkStatus(args, vold->needsRollback(&enabled));
         return enabled ? 1 : 0;
     } else if (args[0] == "checkpoint" && args[1] == "commitChanges" && args.size() == 2) {
-        checkStatus(vold->commitChanges());
+        checkStatus(args, vold->commitChanges());
     } else if (args[0] == "checkpoint" && args[1] == "prepareCheckpoint" && args.size() == 2) {
-        checkStatus(vold->prepareCheckpoint());
+        checkStatus(args, vold->prepareCheckpoint());
     } else if (args[0] == "checkpoint" && args[1] == "restoreCheckpoint" && args.size() == 3) {
-        checkStatus(vold->restoreCheckpoint(args[2]));
+        checkStatus(args, vold->restoreCheckpoint(args[2]));
     } else if (args[0] == "checkpoint" && args[1] == "restoreCheckpointPart" && args.size() == 4) {
         int count;
         if (!android::base::ParseInt(args[3], &count)) exit(EINVAL);
-        checkStatus(vold->restoreCheckpointPart(args[2], count));
+        checkStatus(args, vold->restoreCheckpointPart(args[2], count));
     } else if (args[0] == "checkpoint" && args[1] == "markBootAttempt" && args.size() == 2) {
-        checkStatus(vold->markBootAttempt());
+        checkStatus(args, vold->markBootAttempt());
     } else if (args[0] == "checkpoint" && args[1] == "abortChanges" && args.size() == 4) {
         int retry;
         if (!android::base::ParseInt(args[2], &retry)) exit(EINVAL);
-        checkStatus(vold->abortChanges(args[2], retry != 0));
+        checkStatus(args, vold->abortChanges(args[2], retry != 0));
     } else {
         LOG(ERROR) << "Raw commands are no longer supported";
         exit(EINVAL);