diff --git a/adb/adb.c b/adb/adb.c
index 0e41b34..018dd3c 100644
--- a/adb/adb.c
+++ b/adb/adb.c
@@ -1347,12 +1347,11 @@
         ** AID_NET_BT and AID_NET_BT_ADMIN to diagnose bluetooth (hcidump)
         ** AID_SDCARD_R to allow reading from the SD card
         ** AID_SDCARD_RW to allow writing to the SD card
-        ** AID_MOUNT to allow unmounting the SD card before rebooting
         ** AID_NET_BW_STATS to read out qtaguid statistics
         */
         gid_t groups[] = { AID_ADB, AID_LOG, AID_INPUT, AID_INET, AID_GRAPHICS,
                            AID_NET_BT, AID_NET_BT_ADMIN, AID_SDCARD_R, AID_SDCARD_RW,
-                           AID_MOUNT, AID_NET_BW_STATS };
+                           AID_NET_BW_STATS };
         if (setgroups(sizeof(groups)/sizeof(groups[0]), groups) != 0) {
             exit(1);
         }
diff --git a/adb/commandline.c b/adb/commandline.c
index 83b568d..e0345a8 100644
--- a/adb/commandline.c
+++ b/adb/commandline.c
@@ -137,10 +137,11 @@
         "  adb forward --remove <local> - remove a specific forward socket connection\n"
         "  adb forward --remove-all     - remove all forward socket connections\n"
         "  adb jdwp                     - list PIDs of processes hosting a JDWP transport\n"
-        "  adb install [-l] [-r] [-s] [--algo <algorithm name> --key <hex-encoded key> --iv <hex-encoded iv>] <file>\n"
+        "  adb install [-l] [-r] [-d] [-s] [--algo <algorithm name> --key <hex-encoded key> --iv <hex-encoded iv>] <file>\n"
         "                               - push this package file to the device and install it\n"
         "                                 ('-l' means forward-lock the app)\n"
         "                                 ('-r' means reinstall the app, keeping its data)\n"
+        "                                 ('-d' means allow version code downgrade)\n"
         "                                 ('-s' means install on SD card instead of internal storage)\n"
         "                                 ('--algo', '--key', and '--iv' mean the file is encrypted already)\n"
         "  adb uninstall [-k] <package> - remove this app package from the device\n"
diff --git a/adb/services.c b/adb/services.c
index 5b63a43..dcaf276 100644
--- a/adb/services.c
+++ b/adb/services.c
@@ -116,23 +116,10 @@
 {
     char buf[100];
     char property_val[PROPERTY_VALUE_MAX];
-    int pid, ret;
+    int ret;
 
     sync();
 
-    /* Attempt to unmount the SD card first.
-     * No need to bother checking for errors.
-     */
-    pid = fork();
-    if (pid == 0) {
-        /* ask vdc to unmount it */
-        execl("/system/bin/vdc", "/system/bin/vdc", "volume", "unmount",
-                getenv("EXTERNAL_STORAGE"), "force", NULL);
-    } else if (pid > 0) {
-        /* wait until vdc succeeds or fails */
-        waitpid(pid, &ret, 0);
-    }
-
     ret = snprintf(property_val, sizeof(property_val), "reboot,%s", (char *) arg);
     if (ret >= (int) sizeof(property_val)) {
         snprintf(buf, sizeof(buf), "reboot string too long. length=%d\n", ret);
diff --git a/fastboot/Android.mk b/fastboot/Android.mk
index b9b3c92..05ddf2a 100644
--- a/fastboot/Android.mk
+++ b/fastboot/Android.mk
@@ -18,7 +18,7 @@
 
 LOCAL_C_INCLUDES := $(LOCAL_PATH)/../mkbootimg \
   $(LOCAL_PATH)/../../extras/ext4_utils
-LOCAL_SRC_FILES := protocol.c engine.c bootimg.c fastboot.c util.c
+LOCAL_SRC_FILES := protocol.c engine.c bootimg.c fastboot.c util.c fs.c
 LOCAL_MODULE := fastboot
 LOCAL_MODULE_TAGS := debug
 LOCAL_CFLAGS += -std=gnu99
diff --git a/fastboot/engine.c b/fastboot/engine.c
index 972c4ed..0fab703 100644
--- a/fastboot/engine.c
+++ b/fastboot/engine.c
@@ -27,7 +27,7 @@
  */
 
 #include "fastboot.h"
-#include "make_ext4fs.h"
+#include "fs.h"
 
 #include <errno.h>
 #include <stdio.h>
@@ -51,9 +51,8 @@
 #define OP_COMMAND    2
 #define OP_QUERY      3
 #define OP_NOTICE     4
-#define OP_FORMAT     5
-#define OP_DOWNLOAD_SPARSE 6
-#define OP_WAIT_FOR_DISCONNECT 7
+#define OP_DOWNLOAD_SPARSE 5
+#define OP_WAIT_FOR_DISCONNECT 6
 
 typedef struct Action Action;
 
@@ -79,14 +78,7 @@
 static Action *action_last = 0;
 
 
-struct image_data {
-    long long partition_size;
-    long long image_size; // real size of image file
-    void *buffer;
-};
 
-void generate_ext4_image(struct image_data *image);
-void cleanup_image(struct image_data *image);
 
 int fb_getvar(struct usb_handle *usb, char *response, const char *fmt, ...)
 {
@@ -102,24 +94,6 @@
     return fb_command_response(usb, cmd, response);
 }
 
-struct generator {
-    char *fs_type;
-
-    /* generate image and return it as image->buffer.
-     * size of the buffer returned as image->image_size.
-     *
-     * image->partition_size specifies what is the size of the
-     * file partition we generate image for.
-     */
-    void (*generate)(struct image_data *image);
-
-    /* it cleans the buffer allocated during image creation.
-     * this function probably does free() or munmap().
-     */
-    void (*cleanup)(struct image_data *image);
-} generators[] = {
-    { "ext4", generate_ext4_image, cleanup_image }
-};
 
 /* Return true if this partition is supported by the fastboot format command.
  * It is also used to determine if we should first erase a partition before
@@ -130,8 +104,7 @@
  */
 int fb_format_supported(usb_handle *usb, const char *partition)
 {
-    char response[FB_RESPONSE_SZ+1];
-    struct generator *generator = NULL;
+    char response[FB_RESPONSE_SZ + 1] = {0,};
     int status;
     unsigned int i;
 
@@ -140,18 +113,7 @@
         return 0;
     }
 
-    for (i = 0; i < ARRAY_SIZE(generators); i++) {
-        if (!strncmp(generators[i].fs_type, response, FB_RESPONSE_SZ)) {
-            generator = &generators[i];
-            break;
-        }
-    }
-
-    if (generator) {
-        return 1;
-    }
-
-    return 0;
+    return !!fs_get_generator(response);
 }
 
 static int cb_default(Action *a, int status, char *resp)
@@ -205,163 +167,6 @@
     a->msg = mkmsg("erasing '%s'", ptn);
 }
 
-/* Loads file content into buffer. Returns NULL on error. */
-static void *load_buffer(int fd, off_t size)
-{
-    void *buffer;
-
-#ifdef USE_MINGW
-    ssize_t count = 0;
-
-    // mmap is more efficient but mingw does not support it.
-    // In this case we read whole image into memory buffer.
-    buffer = malloc(size);
-    if (!buffer) {
-        perror("malloc");
-        return NULL;
-    }
-
-    lseek(fd, 0, SEEK_SET);
-    while(count < size) {
-        ssize_t actually_read = read(fd, (char*)buffer+count, size-count);
-
-        if (actually_read == 0) {
-            break;
-        }
-        if (actually_read < 0) {
-            if (errno == EINTR) {
-                continue;
-            }
-            perror("read");
-            free(buffer);
-            return NULL;
-        }
-
-        count += actually_read;
-    }
-#else
-    buffer = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
-    if (buffer == MAP_FAILED) {
-        perror("mmap");
-        return NULL;
-    }
-#endif
-
-    return buffer;
-}
-
-void cleanup_image(struct image_data *image)
-{
-#ifdef USE_MINGW
-    free(image->buffer);
-#else
-    munmap(image->buffer, image->image_size);
-#endif
-}
-
-void generate_ext4_image(struct image_data *image)
-{
-    int fd;
-    struct stat st;
-
-    fd = fileno(tmpfile());
-    make_ext4fs_sparse_fd(fd, image->partition_size, NULL, NULL);
-
-    fstat(fd, &st);
-    image->image_size = st.st_size;
-    image->buffer = load_buffer(fd, st.st_size);
-
-    close(fd);
-}
-
-int fb_format(Action *a, usb_handle *usb, int skip_if_not_supported)
-{
-    const char *partition = a->cmd;
-    char response[FB_RESPONSE_SZ+1];
-    int status = 0;
-    struct image_data image;
-    struct generator *generator = NULL;
-    int fd;
-    unsigned i;
-    char cmd[CMD_SIZE];
-
-    status = fb_getvar(usb, response, "partition-type:%s", partition);
-    if (status) {
-        if (skip_if_not_supported) {
-            fprintf(stderr,
-                    "Erase successful, but not automatically formatting.\n");
-            fprintf(stderr,
-                    "Can't determine partition type.\n");
-            return 0;
-        }
-        fprintf(stderr,"FAILED (%s)\n", fb_get_error());
-        return status;
-    }
-
-    for (i = 0; i < ARRAY_SIZE(generators); i++) {
-        if (!strncmp(generators[i].fs_type, response, FB_RESPONSE_SZ)) {
-            generator = &generators[i];
-            break;
-        }
-    }
-    if (!generator) {
-        if (skip_if_not_supported) {
-            fprintf(stderr,
-                    "Erase successful, but not automatically formatting.\n");
-            fprintf(stderr,
-                    "File system type %s not supported.\n", response);
-            return 0;
-        }
-        fprintf(stderr,"Formatting is not supported for filesystem with type '%s'.\n",
-                response);
-        return -1;
-    }
-
-    status = fb_getvar(usb, response, "partition-size:%s", partition);
-    if (status) {
-        if (skip_if_not_supported) {
-            fprintf(stderr,
-                    "Erase successful, but not automatically formatting.\n");
-            fprintf(stderr, "Unable to get partition size\n.");
-            return 0;
-        }
-        fprintf(stderr,"FAILED (%s)\n", fb_get_error());
-        return status;
-    }
-    image.partition_size = strtoll(response, (char **)NULL, 16);
-
-    generator->generate(&image);
-    if (!image.buffer) {
-        fprintf(stderr,"Cannot generate image.\n");
-        return -1;
-    }
-
-    // Following piece of code is similar to fb_queue_flash() but executes
-    // actions directly without queuing
-    fprintf(stderr, "sending '%s' (%lli KB)...\n", partition, image.image_size/1024);
-    status = fb_download_data(usb, image.buffer, image.image_size);
-    if (status) goto cleanup;
-
-    fprintf(stderr, "writing '%s'...\n", partition);
-    snprintf(cmd, sizeof(cmd), "flash:%s", partition);
-    status = fb_command(usb, cmd);
-    if (status) goto cleanup;
-
-cleanup:
-    generator->cleanup(&image);
-
-    return status;
-}
-
-void fb_queue_format(const char *partition, int skip_if_not_supported)
-{
-    Action *a;
-
-    a = queue_action(OP_FORMAT, partition);
-    a->data = (void*)skip_if_not_supported;
-    a->msg = mkmsg("formatting '%s' partition", partition);
-}
-
 void fb_queue_flash(const char *ptn, void *data, unsigned sz)
 {
     Action *a;
@@ -589,10 +394,6 @@
             if (status) break;
         } else if (a->op == OP_NOTICE) {
             fprintf(stderr,"%s\n",(char*)a->data);
-        } else if (a->op == OP_FORMAT) {
-            status = fb_format(a, usb, (int)a->data);
-            status = a->func(a, status, status ? fb_get_error() : "");
-            if (status) break;
         } else if (a->op == OP_DOWNLOAD_SPARSE) {
             status = fb_download_data_sparse(usb, a->data);
             status = a->func(a, status, status ? fb_get_error() : "");
diff --git a/fastboot/fastboot.c b/fastboot/fastboot.c
index 73a6e56..4fd1a8e 100644
--- a/fastboot/fastboot.c
+++ b/fastboot/fastboot.c
@@ -49,6 +49,7 @@
 #include <zipfile/zipfile.h>
 
 #include "fastboot.h"
+#include "fs.h"
 
 #ifndef O_BINARY
 #define O_BINARY 0
@@ -622,10 +623,13 @@
     void *data;
     int64_t limit;
 
+
     sz64 = file_size(fd);
     if (sz64 < 0) {
         return -1;
     }
+
+    lseek(fd, 0, SEEK_SET);
     limit = get_sparse_limit(usb, sz64);
     if (limit) {
         struct sparse_file **s = load_sparse_files(fd, limit);
@@ -872,6 +876,73 @@
     return num;
 }
 
+void fb_perform_format(const char *partition, int skip_if_not_supported)
+{
+    char pType[FB_RESPONSE_SZ + 1], pSize[FB_RESPONSE_SZ + 1];
+    unsigned int limit = INT_MAX;
+    struct fastboot_buffer buf;
+    const char *errMsg = NULL;
+    const struct fs_generator *gen;
+    uint64_t pSz;
+    int status;
+    int fd;
+
+    if (target_sparse_limit > 0 && target_sparse_limit < limit)
+        limit = target_sparse_limit;
+    if (sparse_limit > 0 && sparse_limit < limit)
+        limit = sparse_limit;
+
+    status = fb_getvar(usb, pType, "partition-type:%s", partition);
+    if (status) {
+        errMsg = "Can't determine partition type.\n";
+        goto failed;
+    }
+
+    status = fb_getvar(usb, pSize, "partition-size:%s", partition);
+    if (status) {
+        errMsg = "Unable to get partition size\n";
+        goto failed;
+    }
+
+    gen = fs_get_generator(pType);
+    if (!gen) {
+        if (skip_if_not_supported) {
+            fprintf(stderr, "Erase successful, but not automatically formatting.\n");
+            fprintf(stderr, "File system type %s not supported.\n", pType);
+            return;
+        }
+        fprintf(stderr, "Formatting is not supported for filesystem with type '%s'.\n", pType);
+        return;
+    }
+
+    pSz = strtoll(pSize, (char **)NULL, 16);
+
+    fd = fileno(tmpfile());
+    if (fs_generator_generate(gen, fd, pSz)) {
+        close(fd);
+        fprintf(stderr, "Cannot generate image.\n");
+        return;
+    }
+
+    if (load_buf_fd(usb, fd, &buf)) {
+        fprintf(stderr, "Cannot read image.\n");
+        close(fd);
+        return;
+    }
+    flash_buf(partition, &buf);
+
+    return;
+
+
+failed:
+    if (skip_if_not_supported) {
+        fprintf(stderr, "Erase successful, but not automatically formatting.\n");
+        if (errMsg)
+            fprintf(stderr, "%s", errMsg);
+    }
+    fprintf(stderr,"FAILED (%s)\n", fb_get_error());
+}
+
 int main(int argc, char **argv)
 {
     int wants_wipe = 0;
@@ -1000,7 +1071,7 @@
             if (erase_first && needs_erase(argv[1])) {
                 fb_queue_erase(argv[1]);
             }
-            fb_queue_format(argv[1], 0);
+            fb_perform_format(argv[1], 0);
             skip(2);
         } else if(!strcmp(*argv, "signature")) {
             require(2);
@@ -1088,9 +1159,9 @@
 
     if (wants_wipe) {
         fb_queue_erase("userdata");
-        fb_queue_format("userdata", 1);
+        fb_perform_format("userdata", 1);
         fb_queue_erase("cache");
-        fb_queue_format("cache", 1);
+        fb_perform_format("cache", 1);
     }
     if (wants_reboot) {
         fb_queue_reboot();
diff --git a/fastboot/fastboot.h b/fastboot/fastboot.h
index 976c397..c510a36 100644
--- a/fastboot/fastboot.h
+++ b/fastboot/fastboot.h
@@ -49,7 +49,7 @@
 void fb_queue_flash(const char *ptn, void *data, unsigned sz);
 void fb_queue_flash_sparse(const char *ptn, struct sparse_file *s, unsigned sz);
 void fb_queue_erase(const char *ptn);
-void fb_queue_format(const char *ptn, int skip_if_not_supported);
+void fb_queue_format(const char *ptn, int skip_if_not_supported, unsigned int max_chunk_sz);
 void fb_queue_require(const char *prod, const char *var, int invert,
         unsigned nvalues, const char **value);
 void fb_queue_display(const char *var, const char *prettyname);
diff --git a/fastboot/fs.c b/fastboot/fs.c
new file mode 100644
index 0000000..6a1f9e6
--- /dev/null
+++ b/fastboot/fs.c
@@ -0,0 +1,56 @@
+#include "fastboot.h"
+#include "make_ext4fs.h"
+#include "fs.h"
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sparse/sparse.h>
+#include <unistd.h>
+
+#ifdef USE_MINGW
+#include <fcntl.h>
+#else
+#include <sys/mman.h>
+#endif
+
+
+
+static int generate_ext4_image(int fd, long long partSize)
+{
+    make_ext4fs_sparse_fd(fd, partSize, NULL, NULL);
+
+    return 0;
+}
+
+static const struct fs_generator {
+
+    char *fs_type;  //must match what fastboot reports for partition type
+    int (*generate)(int fd, long long partSize); //returns 0 or error value
+
+} generators[] = {
+
+    { "ext4", generate_ext4_image}
+
+};
+
+const struct fs_generator* fs_get_generator(const char* name)
+{
+    unsigned i;
+
+    for (i = 0; i < sizeof(generators) / sizeof(*generators); i++)
+        if (!strcmp(generators[i].fs_type, name))
+            return generators + i;
+
+    return NULL;
+}
+
+int fs_generator_generate(const struct fs_generator* gen, int tmpFileNo, long long partSize)
+{
+    return gen->generate(tmpFileNo, partSize);
+}
diff --git a/fastboot/fs.h b/fastboot/fs.h
new file mode 100644
index 0000000..65b9555
--- /dev/null
+++ b/fastboot/fs.h
@@ -0,0 +1,12 @@
+#ifndef _FS_H_
+#define _FH_H_
+
+#include <stdint.h>
+
+struct fs_generator;
+
+const struct fs_generator* fs_get_generator(const char* name);
+int fs_generator_generate(const struct fs_generator* gen, int tmpFileNo, long long partSize);
+
+#endif
+
diff --git a/include/utils/BitSet.h b/include/utils/BitSet.h
index 19c03d1..f1d68a0 100644
--- a/include/utils/BitSet.h
+++ b/include/utils/BitSet.h
@@ -30,73 +30,103 @@
 struct BitSet32 {
     uint32_t value;
 
-    inline BitSet32() : value(0) { }
+    inline BitSet32() : value(0UL) { }
     explicit inline BitSet32(uint32_t value) : value(value) { }
 
     // Gets the value associated with a particular bit index.
-    static inline uint32_t valueForBit(uint32_t n) { return 0x80000000 >> n; }
+    static inline uint32_t valueForBit(uint32_t n) { return 0x80000000UL >> n; }
 
     // Clears the bit set.
-    inline void clear() { value = 0; }
+    inline void clear() { clear(value); }
+
+    static inline void clear(uint32_t& value) { value = 0UL; }
 
     // Returns the number of marked bits in the set.
-    inline uint32_t count() const { return __builtin_popcount(value); }
+    inline uint32_t count() const { return count(value); }
+
+    static inline uint32_t count(uint32_t value) { return __builtin_popcountl(value); }
 
     // Returns true if the bit set does not contain any marked bits.
-    inline bool isEmpty() const { return ! value; }
+    inline bool isEmpty() const { return isEmpty(value); }
+
+    static inline bool isEmpty(uint32_t value) { return ! value; }
 
     // Returns true if the bit set does not contain any unmarked bits.
-    inline bool isFull() const { return value == 0xffffffff; }
+    inline bool isFull() const { return isFull(value); }
+
+    static inline bool isFull(uint32_t value) { return value == 0xffffffffUL; }
 
     // Returns true if the specified bit is marked.
-    inline bool hasBit(uint32_t n) const { return value & valueForBit(n); }
+    inline bool hasBit(uint32_t n) const { return hasBit(value, n); }
+
+    static inline bool hasBit(uint32_t value, uint32_t n) { return value & valueForBit(n); }
 
     // Marks the specified bit.
-    inline void markBit(uint32_t n) { value |= valueForBit(n); }
+    inline void markBit(uint32_t n) { markBit(value, n); }
+
+    static inline void markBit (uint32_t& value, uint32_t n) { value |= valueForBit(n); }
 
     // Clears the specified bit.
-    inline void clearBit(uint32_t n) { value &= ~ valueForBit(n); }
+    inline void clearBit(uint32_t n) { clearBit(value, n); }
+
+    static inline void clearBit(uint32_t& value, uint32_t n) { value &= ~ valueForBit(n); }
 
     // Finds the first marked bit in the set.
     // Result is undefined if all bits are unmarked.
-    inline uint32_t firstMarkedBit() const { return __builtin_clz(value); }
+    inline uint32_t firstMarkedBit() const { return firstMarkedBit(value); }
+
+    static uint32_t firstMarkedBit(uint32_t value) { return __builtin_clzl(value); }
 
     // Finds the first unmarked bit in the set.
     // Result is undefined if all bits are marked.
-    inline uint32_t firstUnmarkedBit() const { return __builtin_clz(~ value); }
+    inline uint32_t firstUnmarkedBit() const { return firstUnmarkedBit(value); }
+
+    static inline uint32_t firstUnmarkedBit(uint32_t value) { return __builtin_clzl(~ value); }
 
     // Finds the last marked bit in the set.
     // Result is undefined if all bits are unmarked.
-    inline uint32_t lastMarkedBit() const { return 31 - __builtin_ctz(value); }
+    inline uint32_t lastMarkedBit() const { return lastMarkedBit(value); }
+
+    static inline uint32_t lastMarkedBit(uint32_t value) { return 31 - __builtin_ctzl(value); }
 
     // Finds the first marked bit in the set and clears it.  Returns the bit index.
     // Result is undefined if all bits are unmarked.
-    inline uint32_t clearFirstMarkedBit() {
-        uint32_t n = firstMarkedBit();
-        clearBit(n);
+    inline uint32_t clearFirstMarkedBit() { return clearFirstMarkedBit(value); }
+
+    static inline uint32_t clearFirstMarkedBit(uint32_t& value) {
+        uint32_t n = firstMarkedBit(value);
+        clearBit(value, n);
         return n;
     }
 
     // Finds the first unmarked bit in the set and marks it.  Returns the bit index.
     // Result is undefined if all bits are marked.
-    inline uint32_t markFirstUnmarkedBit() {
-        uint32_t n = firstUnmarkedBit();
-        markBit(n);
+    inline uint32_t markFirstUnmarkedBit() { return markFirstUnmarkedBit(value); }
+
+    static inline uint32_t markFirstUnmarkedBit(uint32_t& value) {
+        uint32_t n = firstUnmarkedBit(value);
+        markBit(value, n);
         return n;
     }
 
     // Finds the last marked bit in the set and clears it.  Returns the bit index.
     // Result is undefined if all bits are unmarked.
-    inline uint32_t clearLastMarkedBit() {
-        uint32_t n = lastMarkedBit();
-        clearBit(n);
+    inline uint32_t clearLastMarkedBit() { return clearLastMarkedBit(value); }
+
+    static inline uint32_t clearLastMarkedBit(uint32_t& value) {
+        uint32_t n = lastMarkedBit(value);
+        clearBit(value, n);
         return n;
     }
 
     // Gets the index of the specified bit in the set, which is the number of
     // marked bits that appear before the specified bit.
     inline uint32_t getIndexOfBit(uint32_t n) const {
-        return __builtin_popcount(value & ~(0xffffffffUL >> n));
+        return getIndexOfBit(value, n);
+    }
+
+    static inline uint32_t getIndexOfBit(uint32_t value, uint32_t n) {
+        return __builtin_popcountl(value & ~(0xffffffffUL >> n));
     }
 
     inline bool operator== (const BitSet32& other) const { return value == other.value; }
@@ -119,6 +149,127 @@
 
 ANDROID_BASIC_TYPES_TRAITS(BitSet32)
 
+// A simple set of 64 bits that can be individually marked or cleared.
+struct BitSet64 {
+    uint64_t value;
+
+    inline BitSet64() : value(0ULL) { }
+    explicit inline BitSet64(uint64_t value) : value(value) { }
+
+    // Gets the value associated with a particular bit index.
+    static inline uint64_t valueForBit(uint32_t n) { return 0x8000000000000000ULL >> n; }
+
+    // Clears the bit set.
+    inline void clear() { clear(value); }
+
+    static inline void clear(uint64_t& value) { value = 0ULL; }
+
+    // Returns the number of marked bits in the set.
+    inline uint32_t count() const { return count(value); }
+
+    static inline uint32_t count(uint64_t value) { return __builtin_popcountll(value); }
+
+    // Returns true if the bit set does not contain any marked bits.
+    inline bool isEmpty() const { return isEmpty(value); }
+
+    static inline bool isEmpty(uint64_t value) { return ! value; }
+
+    // Returns true if the bit set does not contain any unmarked bits.
+    inline bool isFull() const { return isFull(value); }
+
+    static inline bool isFull(uint64_t value) { return value == 0xffffffffffffffffULL; }
+
+    // Returns true if the specified bit is marked.
+    inline bool hasBit(uint32_t n) const { return hasBit(value, n); }
+
+    static inline bool hasBit(uint64_t value, uint32_t n) { return value & valueForBit(n); }
+
+    // Marks the specified bit.
+    inline void markBit(uint32_t n) { markBit(value, n); }
+
+    static inline void markBit(uint64_t& value, uint32_t n) { value |= valueForBit(n); }
+
+    // Clears the specified bit.
+    inline void clearBit(uint32_t n) { clearBit(value, n); }
+
+    static inline void clearBit(uint64_t& value, uint32_t n) { value &= ~ valueForBit(n); }
+
+    // Finds the first marked bit in the set.
+    // Result is undefined if all bits are unmarked.
+    inline uint32_t firstMarkedBit() const { return firstMarkedBit(value); }
+
+    static inline uint32_t firstMarkedBit(uint64_t value) { return __builtin_clzll(value); }
+
+    // Finds the first unmarked bit in the set.
+    // Result is undefined if all bits are marked.
+    inline uint32_t firstUnmarkedBit() const { return firstUnmarkedBit(value); }
+
+    static inline uint32_t firstUnmarkedBit(uint64_t value) { return __builtin_clzll(~ value); }
+
+    // Finds the last marked bit in the set.
+    // Result is undefined if all bits are unmarked.
+    inline uint32_t lastMarkedBit() const { return lastMarkedBit(value); }
+
+    static inline uint32_t lastMarkedBit(uint64_t value) { return 63 - __builtin_ctzll(value); }
+
+    // Finds the first marked bit in the set and clears it.  Returns the bit index.
+    // Result is undefined if all bits are unmarked.
+    inline uint32_t clearFirstMarkedBit() { return clearFirstMarkedBit(value); }
+
+    static inline uint32_t clearFirstMarkedBit(uint64_t& value) {
+        uint64_t n = firstMarkedBit(value);
+        clearBit(value, n);
+        return n;
+    }
+
+    // Finds the first unmarked bit in the set and marks it.  Returns the bit index.
+    // Result is undefined if all bits are marked.
+    inline uint32_t markFirstUnmarkedBit() { return markFirstUnmarkedBit(value); }
+
+    static inline uint32_t markFirstUnmarkedBit(uint64_t& value) {
+        uint64_t n = firstUnmarkedBit(value);
+        markBit(value, n);
+        return n;
+    }
+
+    // Finds the last marked bit in the set and clears it.  Returns the bit index.
+    // Result is undefined if all bits are unmarked.
+    inline uint32_t clearLastMarkedBit() { return clearLastMarkedBit(value); }
+
+    static inline uint32_t clearLastMarkedBit(uint64_t& value) {
+        uint64_t n = lastMarkedBit(value);
+        clearBit(value, n);
+        return n;
+    }
+
+    // Gets the index of the specified bit in the set, which is the number of
+    // marked bits that appear before the specified bit.
+    inline uint32_t getIndexOfBit(uint32_t n) const { return getIndexOfBit(value, n); }
+
+    static inline uint32_t getIndexOfBit(uint64_t value, uint32_t n) {
+        return __builtin_popcountll(value & ~(0xffffffffffffffffULL >> n));
+    }
+
+    inline bool operator== (const BitSet64& other) const { return value == other.value; }
+    inline bool operator!= (const BitSet64& other) const { return value != other.value; }
+    inline BitSet64 operator& (const BitSet64& other) const {
+        return BitSet64(value & other.value);
+    }
+    inline BitSet64& operator&= (const BitSet64& other) {
+        value &= other.value;
+        return *this;
+    }
+    inline BitSet64 operator| (const BitSet64& other) const {
+        return BitSet64(value | other.value);
+    }
+    inline BitSet64& operator|= (const BitSet64& other) {
+        value |= other.value;
+        return *this;
+    }
+};
+
+ANDROID_BASIC_TYPES_TRAITS(BitSet64)
+
 } // namespace android
 
 #endif // UTILS_BITSET_H
diff --git a/libutils/tests/BitSet_test.cpp b/libutils/tests/BitSet_test.cpp
index 752e56d..38b668a 100644
--- a/libutils/tests/BitSet_test.cpp
+++ b/libutils/tests/BitSet_test.cpp
@@ -23,7 +23,7 @@
 
 namespace android {
 
-class BitSetTest : public testing::Test {
+class BitSet32Test : public testing::Test {
 protected:
     BitSet32 b1;
     BitSet32 b2;
@@ -34,7 +34,7 @@
 };
 
 
-TEST_F(BitSetTest, BitWiseOr) {
+TEST_F(BitSet32Test, BitWiseOr) {
     b1.markBit(2);
     b2.markBit(4);
 
@@ -49,7 +49,7 @@
     EXPECT_TRUE(b1.hasBit(2) && b1.hasBit(4));
     EXPECT_TRUE(b2.hasBit(4) && b2.count() == 1u);
 }
-TEST_F(BitSetTest, BitWiseAnd_Disjoint) {
+TEST_F(BitSet32Test, BitWiseAnd_Disjoint) {
     b1.markBit(2);
     b1.markBit(4);
     b1.markBit(6);
@@ -65,7 +65,7 @@
     EXPECT_TRUE(b1.hasBit(2) && b1.hasBit(4) && b1.hasBit(6));
 }
 
-TEST_F(BitSetTest, BitWiseAnd_NonDisjoint) {
+TEST_F(BitSet32Test, BitWiseAnd_NonDisjoint) {
     b1.markBit(2);
     b1.markBit(4);
     b1.markBit(6);
@@ -84,4 +84,187 @@
     EXPECT_EQ(b2.count(), 3u);
     EXPECT_TRUE(b2.hasBit(3) && b2.hasBit(6) && b2.hasBit(9));
 }
+
+TEST_F(BitSet32Test, MarkFirstUnmarkedBit) {
+    b1.markBit(1);
+
+    b1.markFirstUnmarkedBit();
+    EXPECT_EQ(b1.count(), 2u);
+    EXPECT_TRUE(b1.hasBit(0) && b1.hasBit(1));
+
+    b1.markFirstUnmarkedBit();
+    EXPECT_EQ(b1.count(), 3u);
+    EXPECT_TRUE(b1.hasBit(0) && b1.hasBit(1) && b1.hasBit(2));
+}
+
+TEST_F(BitSet32Test, ClearFirstMarkedBit) {
+    b1.markBit(0);
+    b1.markBit(10);
+
+    b1.clearFirstMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(10));
+
+    b1.markBit(30);
+    b1.clearFirstMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(30));
+}
+
+TEST_F(BitSet32Test, ClearLastMarkedBit) {
+    b1.markBit(10);
+    b1.markBit(31);
+
+    b1.clearLastMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(10));
+
+    b1.markBit(5);
+    b1.clearLastMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(5));
+}
+
+TEST_F(BitSet32Test, FillAndClear) {
+    EXPECT_TRUE(b1.isEmpty());
+    for (size_t i = 0; i < 32; i++) {
+        b1.markFirstUnmarkedBit();
+    }
+    EXPECT_TRUE(b1.isFull());
+    b1.clear();
+    EXPECT_TRUE(b1.isEmpty());
+}
+
+TEST_F(BitSet32Test, GetIndexOfBit) {
+    b1.markBit(1);
+    b1.markBit(4);
+    EXPECT_EQ(b1.getIndexOfBit(1), 0);
+    EXPECT_EQ(b1.getIndexOfBit(4), 1);
+    b1.markFirstUnmarkedBit();
+    EXPECT_EQ(b1.getIndexOfBit(1), 1);
+    EXPECT_EQ(b1.getIndexOfBit(4), 2);
+}
+
+class BitSet64Test : public testing::Test {
+protected:
+    BitSet64 b1;
+    BitSet64 b2;
+    virtual void TearDown() {
+        b1.clear();
+        b2.clear();
+    }
+};
+
+
+TEST_F(BitSet64Test, BitWiseOr) {
+    b1.markBit(20);
+    b2.markBit(40);
+
+    BitSet64 tmp = b1 | b2;
+    EXPECT_EQ(tmp.count(), 2u);
+    EXPECT_TRUE(tmp.hasBit(20) && tmp.hasBit(40));
+    // Check that the operator is symmetric
+    EXPECT_TRUE((b2 | b1) == (b1 | b2));
+
+    b1 |= b2;
+    EXPECT_EQ(b1.count(), 2u);
+    EXPECT_TRUE(b1.hasBit(20) && b1.hasBit(40));
+    EXPECT_TRUE(b2.hasBit(40) && b2.count() == 1u);
+}
+TEST_F(BitSet64Test, BitWiseAnd_Disjoint) {
+    b1.markBit(20);
+    b1.markBit(40);
+    b1.markBit(60);
+
+    BitSet64 tmp = b1 & b2;
+    EXPECT_TRUE(tmp.isEmpty());
+    // Check that the operator is symmetric
+    EXPECT_TRUE((b2 & b1) == (b1 & b2));
+
+    b2 &= b1;
+    EXPECT_TRUE(b2.isEmpty());
+    EXPECT_EQ(b1.count(), 3u);
+    EXPECT_TRUE(b1.hasBit(20) && b1.hasBit(40) && b1.hasBit(60));
+}
+
+TEST_F(BitSet64Test, BitWiseAnd_NonDisjoint) {
+    b1.markBit(20);
+    b1.markBit(40);
+    b1.markBit(60);
+    b2.markBit(30);
+    b2.markBit(60);
+    b2.markBit(63);
+
+    BitSet64 tmp = b1 & b2;
+    EXPECT_EQ(tmp.count(), 1u);
+    EXPECT_TRUE(tmp.hasBit(60));
+    // Check that the operator is symmetric
+    EXPECT_TRUE((b2 & b1) == (b1 & b2));
+
+    b1 &= b2;
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_EQ(b2.count(), 3u);
+    EXPECT_TRUE(b2.hasBit(30) && b2.hasBit(60) && b2.hasBit(63));
+}
+
+TEST_F(BitSet64Test, MarkFirstUnmarkedBit) {
+    b1.markBit(1);
+
+    b1.markFirstUnmarkedBit();
+    EXPECT_EQ(b1.count(), 2u);
+    EXPECT_TRUE(b1.hasBit(0) && b1.hasBit(1));
+
+    b1.markFirstUnmarkedBit();
+    EXPECT_EQ(b1.count(), 3u);
+    EXPECT_TRUE(b1.hasBit(0) && b1.hasBit(1) && b1.hasBit(2));
+}
+
+TEST_F(BitSet64Test, ClearFirstMarkedBit) {
+    b1.markBit(0);
+    b1.markBit(10);
+
+    b1.clearFirstMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(10));
+
+    b1.markBit(50);
+    b1.clearFirstMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(50));
+}
+
+TEST_F(BitSet64Test, ClearLastMarkedBit) {
+    b1.markBit(10);
+    b1.markBit(63);
+
+    b1.clearLastMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(10));
+
+    b1.markBit(5);
+    b1.clearLastMarkedBit();
+    EXPECT_EQ(b1.count(), 1u);
+    EXPECT_TRUE(b1.hasBit(5));
+}
+
+TEST_F(BitSet64Test, FillAndClear) {
+    EXPECT_TRUE(b1.isEmpty());
+    for (size_t i = 0; i < 64; i++) {
+        b1.markFirstUnmarkedBit();
+    }
+    EXPECT_TRUE(b1.isFull());
+    b1.clear();
+    EXPECT_TRUE(b1.isEmpty());
+}
+
+TEST_F(BitSet64Test, GetIndexOfBit) {
+    b1.markBit(10);
+    b1.markBit(40);
+    EXPECT_EQ(b1.getIndexOfBit(10), 0);
+    EXPECT_EQ(b1.getIndexOfBit(40), 1);
+    b1.markFirstUnmarkedBit();
+    EXPECT_EQ(b1.getIndexOfBit(10), 1);
+    EXPECT_EQ(b1.getIndexOfBit(40), 2);
+}
+
 } // namespace android
diff --git a/lmkd/Android.mk b/lmkd/Android.mk
new file mode 100644
index 0000000..5d6d1d2
--- /dev/null
+++ b/lmkd/Android.mk
@@ -0,0 +1,10 @@
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES := lmkd.c
+LOCAL_STATIC_LIBRARIES := libcutils liblog libm libc
+LOCAL_FORCE_STATIC_EXECUTABLE := true
+
+LOCAL_MODULE := lmkd
+
+include $(BUILD_EXECUTABLE)
diff --git a/lmkd/lmkd.c b/lmkd/lmkd.c
new file mode 100644
index 0000000..376410b
--- /dev/null
+++ b/lmkd/lmkd.c
@@ -0,0 +1,735 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "lowmemorykiller"
+
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <arpa/inet.h>
+#include <sys/epoll.h>
+#include <sys/eventfd.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <cutils/log.h>
+#include <cutils/sockets.h>
+
+#define MEMCG_SYSFS_PATH "/dev/memcg/"
+#define MEMPRESSURE_WATCH_LEVEL "medium"
+#define ZONEINFO_PATH "/proc/zoneinfo"
+#define LINE_MAX 128
+
+#define INKERNEL_MINFREE_PATH "/sys/module/lowmemorykiller/parameters/minfree"
+#define INKERNEL_ADJ_PATH "/sys/module/lowmemorykiller/parameters/adj"
+
+#define ARRAY_SIZE(x)   (sizeof(x) / sizeof(*(x)))
+
+enum lmk_cmd {
+    LMK_TARGET,
+    LMK_PROCPRIO,
+    LMK_PROCREMOVE,
+};
+
+#define MAX_TARGETS 6
+/*
+ * longest is LMK_TARGET followed by MAX_TARGETS each minfree and minkillprio
+ * values
+ */
+#define CTRL_PACKET_MAX (sizeof(int) * (MAX_TARGETS * 2 + 1))
+
+/* default to old in-kernel interface if no memory pressure events */
+static int use_inkernel_interface = 1;
+
+/* memory pressure level medium event */
+static int mpevfd;
+
+/* control socket listen and data */
+static int ctrl_lfd;
+static int ctrl_dfd = -1;
+static int ctrl_dfd_reopened; /* did we reopen ctrl conn on this loop? */
+
+/* 1 memory pressure level, 1 ctrl listen socket, 1 ctrl data socket */
+#define MAX_EPOLL_EVENTS 3
+static int epollfd;
+static int maxevents;
+
+#define OOM_DISABLE (-17)
+/* inclusive */
+#define OOM_ADJUST_MIN (-16)
+#define OOM_ADJUST_MAX 15
+
+static int lowmem_adj[MAX_TARGETS];
+static int lowmem_minfree[MAX_TARGETS];
+static int lowmem_targets_size;
+
+struct sysmeminfo {
+    int nr_free_pages;
+    int nr_file_pages;
+    int nr_shmem;
+    int totalreserve_pages;
+};
+
+struct adjslot_list {
+    struct adjslot_list *next;
+    struct adjslot_list *prev;
+};
+
+struct proc {
+    struct adjslot_list asl;
+    int pid;
+    int oomadj;
+    struct proc *pidhash_next;
+};
+
+#define PIDHASH_SZ 1024
+static struct proc *pidhash[PIDHASH_SZ];
+#define pid_hashfn(x) ((((x) >> 8) ^ (x)) & (PIDHASH_SZ - 1))
+
+#define ADJTOSLOT(adj) (adj + -OOM_ADJUST_MIN)
+static struct adjslot_list procadjslot_list[ADJTOSLOT(OOM_ADJUST_MAX) + 1];
+
+/*
+ * Wait 1-2 seconds for the death report of a killed process prior to
+ * considering killing more processes.
+ */
+#define KILL_TIMEOUT 2
+/* Time of last process kill we initiated, stop me before I kill again */
+static time_t kill_lasttime;
+
+/* PAGE_SIZE / 1024 */
+static long page_k;
+
+static struct proc *pid_lookup(int pid) {
+    struct proc *procp;
+
+    for (procp = pidhash[pid_hashfn(pid)]; procp && procp->pid != pid;
+         procp = procp->pidhash_next)
+            ;
+
+    return procp;
+}
+
+static void adjslot_insert(struct adjslot_list *head, struct adjslot_list *new)
+{
+    struct adjslot_list *next = head->next;
+    new->prev = head;
+    new->next = next;
+    next->prev = new;
+    head->next = new;
+}
+
+static void adjslot_remove(struct adjslot_list *old)
+{
+    struct adjslot_list *prev = old->prev;
+    struct adjslot_list *next = old->next;
+    next->prev = prev;
+    prev->next = next;
+}
+
+static struct adjslot_list *adjslot_tail(struct adjslot_list *head) {
+    struct adjslot_list *asl = head->prev;
+
+    return asl == head ? NULL : asl;
+}
+
+static void proc_slot(struct proc *procp) {
+    int adjslot = ADJTOSLOT(procp->oomadj);
+
+    adjslot_insert(&procadjslot_list[adjslot], &procp->asl);
+}
+
+static void proc_unslot(struct proc *procp) {
+    adjslot_remove(&procp->asl);
+}
+
+static void proc_insert(struct proc *procp) {
+    int hval = pid_hashfn(procp->pid);
+
+    procp->pidhash_next = pidhash[hval];
+    pidhash[hval] = procp;
+    proc_slot(procp);
+}
+
+static int pid_remove(int pid) {
+    int hval = pid_hashfn(pid);
+    struct proc *procp;
+    struct proc *prevp;
+
+    for (procp = pidhash[hval], prevp = NULL; procp && procp->pid != pid;
+         procp = procp->pidhash_next)
+            prevp = procp;
+
+    if (!procp)
+        return -1;
+
+    if (!prevp)
+        pidhash[hval] = procp->pidhash_next;
+    else
+        prevp->pidhash_next = procp->pidhash_next;
+
+    proc_unslot(procp);
+    free(procp);
+    return 0;
+}
+
+static void writefilestring(char *path, char *s) {
+    int fd = open(path, O_WRONLY);
+    int len = strlen(s);
+    int ret;
+
+    if (fd < 0) {
+        ALOGE("Error opening %s; errno=%d", path, errno);
+        return;
+    }
+
+    ret = write(fd, s, len);
+    if (ret < 0) {
+        ALOGE("Error writing %s; errno=%d", path, errno);
+    } else if (ret < len) {
+        ALOGE("Short write on %s; length=%d", path, ret);
+    }
+
+    close(fd);
+}
+
+static void cmd_procprio(int pid, int oomadj) {
+    struct proc *procp;
+    char path[80];
+    char val[20];
+
+    if (oomadj < OOM_DISABLE || oomadj > OOM_ADJUST_MAX) {
+        ALOGE("Invalid PROCPRIO oomadj argument %d", oomadj);
+        return;
+    }
+
+    snprintf(path, sizeof(path), "/proc/%d/oom_adj", pid);
+    snprintf(val, sizeof(val), "%d", oomadj);
+    writefilestring(path, val);
+
+    if (use_inkernel_interface)
+        return;
+
+    procp = pid_lookup(pid);
+    if (!procp) {
+            procp = malloc(sizeof(struct proc));
+            if (!procp) {
+                // Oh, the irony.  May need to rebuild our state.
+                return;
+            }
+
+            procp->pid = pid;
+            procp->oomadj = oomadj;
+            proc_insert(procp);
+    } else {
+        proc_unslot(procp);
+        procp->oomadj = oomadj;
+        proc_slot(procp);
+    }
+}
+
+static void cmd_procremove(int pid) {
+    struct proc *procp;
+
+    if (use_inkernel_interface)
+        return;
+
+    pid_remove(pid);
+    kill_lasttime = 0;
+}
+
+static void cmd_target(int ntargets, int *params) {
+    int i;
+
+    if (ntargets > (int)ARRAY_SIZE(lowmem_adj))
+        return;
+
+    for (i = 0; i < ntargets; i++) {
+        lowmem_minfree[i] = ntohl(*params++);
+        lowmem_adj[i] = ntohl(*params++);
+    }
+
+    lowmem_targets_size = ntargets;
+
+    if (use_inkernel_interface) {
+        char minfreestr[128];
+        char killpriostr[128];
+
+        minfreestr[0] = '\0';
+        killpriostr[0] = '\0';
+
+        for (i = 0; i < lowmem_targets_size; i++) {
+            char val[40];
+
+            if (i) {
+                strlcat(minfreestr, ",", sizeof(minfreestr));
+                strlcat(killpriostr, ",", sizeof(killpriostr));
+            }
+
+            snprintf(val, sizeof(val), "%d", lowmem_minfree[i]);
+            strlcat(minfreestr, val, sizeof(minfreestr));
+            snprintf(val, sizeof(val), "%d", lowmem_adj[i]);
+            strlcat(killpriostr, val, sizeof(killpriostr));
+        }
+
+        writefilestring(INKERNEL_MINFREE_PATH, minfreestr);
+        writefilestring(INKERNEL_ADJ_PATH, killpriostr);
+    }
+}
+
+static void ctrl_data_close(void) {
+    ALOGI("Closing Activity Manager data connection");
+    close(ctrl_dfd);
+    ctrl_dfd = -1;
+    maxevents--;
+}
+
+static int ctrl_data_read(char *buf, size_t bufsz) {
+    int ret = 0;
+
+    ret = read(ctrl_dfd, buf, bufsz);
+
+    if (ret == -1) {
+        ALOGE("control data socket read failed; errno=%d", errno);
+    } else if (ret == 0) {
+        ALOGE("Got EOF on control data socket");
+        ret = -1;
+    }
+
+    return ret;
+}
+
+static void ctrl_command_handler(void) {
+    int ibuf[CTRL_PACKET_MAX / sizeof(int)];
+    int len;
+    int cmd = -1;
+    int nargs;
+    int targets;
+
+    len = ctrl_data_read((char *)ibuf, CTRL_PACKET_MAX);
+    if (len <= 0)
+        return;
+
+    nargs = len / sizeof(int) - 1;
+    if (nargs < 0)
+        goto wronglen;
+
+    cmd = ntohl(ibuf[0]);
+
+    switch(cmd) {
+    case LMK_TARGET:
+        targets = nargs / 2;
+        if (nargs & 0x1 || targets > (int)ARRAY_SIZE(lowmem_adj))
+            goto wronglen;
+        cmd_target(targets, &ibuf[1]);
+        break;
+    case LMK_PROCPRIO:
+        if (nargs != 2)
+            goto wronglen;
+        cmd_procprio(ntohl(ibuf[1]), ntohl(ibuf[2]));
+        break;
+    case LMK_PROCREMOVE:
+        if (nargs != 1)
+            goto wronglen;
+        cmd_procremove(ntohl(ibuf[1]));
+        break;
+    default:
+        ALOGE("Received unknown command code %d", cmd);
+        return;
+    }
+
+    return;
+
+wronglen:
+    ALOGE("Wrong control socket read length cmd=%d len=%d", cmd, len);
+}
+
+static void ctrl_data_handler(uint32_t events) {
+    if (events & EPOLLHUP) {
+        ALOGI("ActivityManager disconnected");
+        if (!ctrl_dfd_reopened)
+            ctrl_data_close();
+    } else if (events & EPOLLIN) {
+        ctrl_command_handler();
+    }
+}
+
+static void ctrl_connect_handler(uint32_t events) {
+    struct sockaddr addr;
+    socklen_t alen;
+    struct epoll_event epev;
+
+    if (ctrl_dfd >= 0) {
+        ctrl_data_close();
+        ctrl_dfd_reopened = 1;
+    }
+
+    alen = sizeof(addr);
+    ctrl_dfd = accept(ctrl_lfd, &addr, &alen);
+
+    if (ctrl_dfd < 0) {
+        ALOGE("lmkd control socket accept failed; errno=%d", errno);
+        return;
+    }
+
+    ALOGI("ActivityManager connected");
+    maxevents++;
+    epev.events = EPOLLIN;
+    epev.data.ptr = (void *)ctrl_data_handler;
+    if (epoll_ctl(epollfd, EPOLL_CTL_ADD, ctrl_dfd, &epev) == -1) {
+        ALOGE("epoll_ctl for data connection socket failed; errno=%d", errno);
+        ctrl_data_close();
+        return;
+    }
+}
+
+static int zoneinfo_parse_protection(char *cp) {
+    int max = 0;
+    int zoneval;
+
+    if (*cp++ != '(')
+        return 0;
+
+    do {
+        zoneval = strtol(cp, &cp, 0);
+        if ((*cp != ',') && (*cp != ')'))
+            return 0;
+        if (zoneval > max)
+            max = zoneval;
+    } while (cp = strtok(NULL, " "));
+
+    return max;
+}
+
+static void zoneinfo_parse_line(char *line, struct sysmeminfo *mip) {
+    char *cp = line;
+    char *ap;
+
+    cp = strtok(line, " ");
+    if (!cp)
+        return;
+
+    ap = strtok(NULL, " ");
+    if (!ap)
+        return;
+
+    if (!strcmp(cp, "nr_free_pages"))
+        mip->nr_free_pages += strtol(ap, NULL, 0);
+    else if (!strcmp(cp, "nr_file_pages"))
+        mip->nr_file_pages += strtol(ap, NULL, 0);
+    else if (!strcmp(cp, "nr_shmem"))
+        mip->nr_shmem += strtol(ap, NULL, 0);
+    else if (!strcmp(cp, "high"))
+        mip->totalreserve_pages += strtol(ap, NULL, 0);
+    else if (!strcmp(cp, "protection:"))
+        mip->totalreserve_pages += zoneinfo_parse_protection(ap);
+}
+
+static int zoneinfo_parse(struct sysmeminfo *mip) {
+    FILE *f;
+    char *cp;
+    char line[LINE_MAX];
+
+    memset(mip, 0, sizeof(struct sysmeminfo));
+    f = fopen(ZONEINFO_PATH, "r");
+    if (!f) {
+        ALOGE("%s open: errno=%d", ZONEINFO_PATH, errno);
+        return -1;
+    }
+
+    while (fgets(line, LINE_MAX, f))
+            zoneinfo_parse_line(line, mip);
+
+    fclose(f);
+    return 0;
+}
+
+static int proc_get_size(int pid) {
+    char path[PATH_MAX];
+    char line[LINE_MAX];
+    FILE *f;
+    int rss = 0;
+    int total;
+
+    snprintf(path, PATH_MAX, "/proc/%d/statm", pid);
+    f = fopen(path, "r");
+    if (!f)
+        return -1;
+    if (!fgets(line, LINE_MAX, f)) {
+        fclose(f);
+        return -1;
+    }
+
+    sscanf(line, "%d %d ", &total, &rss);
+    fclose(f);
+    return rss;
+}
+
+static char *proc_get_name(int pid) {
+    char path[PATH_MAX];
+    static char line[LINE_MAX];
+    FILE *f;
+    char *cp;
+
+    snprintf(path, PATH_MAX, "/proc/%d/cmdline", pid);
+    f = fopen(path, "r");
+    if (!f)
+        return NULL;
+    if (!fgets(line, LINE_MAX, f)) {
+        fclose(f);
+        return NULL;
+    }
+
+    cp = strchr(line, ' ');
+    if (cp)
+        *cp = '\0';
+
+    return line;
+}
+
+static struct proc *proc_adj_lru(int oomadj) {
+    return (struct proc *)adjslot_tail(&procadjslot_list[ADJTOSLOT(oomadj)]);
+}
+
+static void mp_event(uint32_t events) {
+    int i;
+    int ret;
+    unsigned long long evcount;
+    struct sysmeminfo mi;
+    int other_free;
+    int other_file;
+    int minfree = 0;
+    int min_score_adj = OOM_ADJUST_MAX + 1;
+
+    ret = read(mpevfd, &evcount, sizeof(evcount));
+    if (ret < 0)
+        ALOGE("Error reading memory pressure event fd; errno=%d",
+              errno);
+
+    if (time(NULL) - kill_lasttime < KILL_TIMEOUT)
+        return;
+
+    if (zoneinfo_parse(&mi) < 0)
+        return;
+
+    other_free = mi.nr_free_pages - mi.totalreserve_pages;
+    other_file = mi.nr_file_pages - mi.nr_shmem;
+
+    for (i = 0; i < lowmem_targets_size; i++) {
+        minfree = lowmem_minfree[i];
+        if (other_free < minfree && other_file < minfree) {
+            min_score_adj = lowmem_adj[i];
+            break;
+        }
+    }
+
+    if (min_score_adj == OOM_ADJUST_MAX + 1)
+        return;
+
+    for (i = OOM_ADJUST_MAX; i >= min_score_adj; i--) {
+        struct proc *procp;
+
+    retry:
+        procp = proc_adj_lru(i);
+
+        if (procp) {
+            int pid = procp->pid;
+            char *taskname;
+            int tasksize;
+            int r;
+
+            taskname = proc_get_name(pid);
+            if (!taskname) {
+                pid_remove(pid);
+                goto retry;
+            }
+
+            tasksize = proc_get_size(pid);
+            if (tasksize < 0) {
+                pid_remove(pid);
+                goto retry;
+            }
+
+            ALOGI("Killing '%s' (%d), adj %d\n"
+                  "   to free %ldkB because cache %ldkB is below limit %ldkB for oom_adj %d\n"
+                  "   Free memory is %ldkB %s reserved",
+                  taskname, pid, procp->oomadj, tasksize * page_k,
+                  other_file * page_k, minfree * page_k, min_score_adj,
+                  other_free * page_k, other_free >= 0 ? "above" : "below");
+            r = kill(pid, SIGKILL);
+            pid_remove(pid);
+
+            if (r) {
+                ALOGE("kill(%d): errno=%d", procp->pid, errno);
+                goto retry;
+            } else {
+                time(&kill_lasttime);
+                break;
+            }
+        }
+    }
+}
+
+static int init_mp(char *levelstr, void *event_handler)
+{
+    int mpfd;
+    int evfd;
+    int evctlfd;
+    char buf[256];
+    struct epoll_event epev;
+    int ret;
+
+    mpfd = open(MEMCG_SYSFS_PATH "memory.pressure_level", O_RDONLY);
+    if (mpfd < 0) {
+        ALOGI("No kernel memory.pressure_level support (errno=%d)", errno);
+        goto err_open_mpfd;
+    }
+
+    evctlfd = open(MEMCG_SYSFS_PATH "cgroup.event_control", O_WRONLY);
+    if (evctlfd < 0) {
+        ALOGI("No kernel memory cgroup event control (errno=%d)", errno);
+        goto err_open_evctlfd;
+    }
+
+    evfd = eventfd(0, EFD_NONBLOCK);
+    if (evfd < 0) {
+        ALOGE("eventfd failed for level %s; errno=%d", levelstr, errno);
+        goto err_eventfd;
+    }
+
+    ret = snprintf(buf, sizeof(buf), "%d %d %s", evfd, mpfd, levelstr);
+    if (ret >= (ssize_t)sizeof(buf)) {
+        ALOGE("cgroup.event_control line overflow for level %s", levelstr);
+        goto err;
+    }
+
+    ret = write(evctlfd, buf, strlen(buf) + 1);
+    if (ret == -1) {
+        ALOGE("cgroup.event_control write failed for level %s; errno=%d",
+              levelstr, errno);
+        goto err;
+    }
+
+    epev.events = EPOLLIN;
+    epev.data.ptr = event_handler;
+    ret = epoll_ctl(epollfd, EPOLL_CTL_ADD, evfd, &epev);
+    if (ret == -1) {
+        ALOGE("epoll_ctl for level %s failed; errno=%d", levelstr, errno);
+        goto err;
+    }
+    maxevents++;
+    mpevfd = evfd;
+    return 0;
+
+err:
+    close(evfd);
+err_eventfd:
+    close(evctlfd);
+err_open_evctlfd:
+    close(mpfd);
+err_open_mpfd:
+    return -1;
+}
+
+static int init(void) {
+    struct epoll_event epev;
+    int i;
+    int ret;
+
+    page_k = sysconf(_SC_PAGESIZE);
+    if (page_k == -1)
+        page_k = PAGE_SIZE;
+    page_k /= 1024;
+
+    epollfd = epoll_create(MAX_EPOLL_EVENTS);
+    if (epollfd == -1) {
+        ALOGE("epoll_create failed (errno=%d)", errno);
+        return -1;
+    }
+
+    ctrl_lfd = android_get_control_socket("lmkd");
+    if (ctrl_lfd < 0) {
+        ALOGE("get lmkd control socket failed");
+        return -1;
+    }
+
+    ret = listen(ctrl_lfd, 1);
+    if (ret < 0) {
+        ALOGE("lmkd control socket listen failed (errno=%d)", errno);
+        return -1;
+    }
+
+    epev.events = EPOLLIN;
+    epev.data.ptr = (void *)ctrl_connect_handler;
+    if (epoll_ctl(epollfd, EPOLL_CTL_ADD, ctrl_lfd, &epev) == -1) {
+        ALOGE("epoll_ctl for lmkd control socket failed (errno=%d)", errno);
+        return -1;
+    }
+    maxevents++;
+
+    use_inkernel_interface = !access(INKERNEL_MINFREE_PATH, W_OK);
+
+    if (use_inkernel_interface) {
+        ALOGI("Using in-kernel low memory killer interface");
+    } else {
+        ret = init_mp(MEMPRESSURE_WATCH_LEVEL, (void *)&mp_event);
+        if (ret)
+            ALOGE("Kernel does not support memory pressure events or in-kernel low memory killer");
+    }
+
+    for (i = 0; i <= ADJTOSLOT(OOM_ADJUST_MAX); i++) {
+        procadjslot_list[i].next = &procadjslot_list[i];
+        procadjslot_list[i].prev = &procadjslot_list[i];
+    }
+
+    return 0;
+}
+
+static void mainloop(void) {
+    while (1) {
+        struct epoll_event events[maxevents];
+        int nevents;
+        int i;
+
+        ctrl_dfd_reopened = 0;
+        nevents = epoll_wait(epollfd, events, maxevents, -1);
+
+        if (nevents == -1) {
+            if (errno == EINTR)
+                continue;
+            ALOGE("epoll_wait failed (errno=%d)", errno);
+            continue;
+        }
+
+        for (i = 0; i < nevents; ++i) {
+            if (events[i].events & EPOLLERR)
+                ALOGD("EPOLLERR on event #%d", i);
+            if (events[i].data.ptr)
+                (*(void (*)(uint32_t))events[i].data.ptr)(events[i].events);
+        }
+    }
+}
+
+int main(int argc, char **argv) {
+    if (!init())
+        mainloop();
+
+    ALOGI("exiting");
+    return 0;
+}
diff --git a/rootdir/init.rc b/rootdir/init.rc
index dfb98f0..53b380b 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -89,6 +89,10 @@
     mkdir /mnt/obb 0700 root system
     mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
 
+    # memory control cgroup
+    mkdir /dev/memcg 0700 root system
+    mount cgroup none /dev/memcg memory
+
     write /proc/sys/kernel/panic_on_oops 1
     write /proc/sys/kernel/hung_task_timeout_secs 0
     write /proc/cpu/alignment 4
@@ -144,6 +148,11 @@
 # checker programs.
     mkdir /dev/fscklogs 0770 root system
 
+# pstore/ramoops previous console log
+    mount pstore pstore /sys/fs/pstore
+    chown system log /sys/fs/pstore/console-ramoops
+    chmod 0440 /sys/fs/pstore/console-ramoops
+
 on post-fs
     # once everything is setup, no need to modify /
     mount rootfs rootfs / ro remount
@@ -381,6 +390,9 @@
     setprop net.tcp.buffersize.gprs     4092,8760,11680,4096,8760,11680
     setprop net.tcp.buffersize.evdo     4094,87380,262144,4096,16384,262144
 
+# Define default initial receive window size in segments.
+    setprop net.tcp.default_init_rwnd 60
+
     class_start core
     class_start main
 
@@ -413,9 +425,15 @@
 on property:sys.powerctl=*
     powerctl ${sys.powerctl}
 
-# system server cannot write to /proc/sys files, so proxy it through init
+# system server cannot write to /proc/sys files,
+# and chown/chmod does not work for /proc/sys/ entries.
+# So proxy writes through init.
 on property:sys.sysctl.extra_free_kbytes=*
     write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
+# "tcp_default_init_rwnd" Is too long!
+on property:sys.sysctl.tcp_def_init_rwnd=*
+    write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
+
 
 ## Daemon processes to be run by init.
 ##
@@ -463,6 +481,11 @@
 on property:ro.kernel.qemu=1
     start adbd
 
+service lmkd /system/bin/lmkd
+    class core
+    critical
+    socket lmkd seqpacket 0660 system system
+
 service servicemanager /system/bin/servicemanager
     class core
     user system