diff --git a/Android.mk b/Android.mk
index 83ce839..d83e650 100644
--- a/Android.mk
+++ b/Android.mk
@@ -119,3 +119,15 @@
 LOCAL_INIT_RC := vdc.rc
 
 include $(BUILD_EXECUTABLE)
+
+include $(CLEAR_VARS)
+
+LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
+LOCAL_CLANG := true
+LOCAL_SRC_FILES:= secdiscard.cpp
+LOCAL_MODULE:= secdiscard
+LOCAL_SHARED_LIBRARIES := libcutils
+LOCAL_CFLAGS := $(vold_cflags)
+LOCAL_CONLYFLAGS := $(vold_conlyflags)
+
+include $(BUILD_EXECUTABLE)
diff --git a/CommandListener.cpp b/CommandListener.cpp
index a9a8031..03f8c73 100644
--- a/CommandListener.cpp
+++ b/CommandListener.cpp
@@ -408,7 +408,7 @@
             return 0;
         }
 
-        unsigned int numSectors = (atoi(argv[3]) * (1024 * 1024)) / 512;
+        unsigned long numSectors = (atoi(argv[3]) * (1024 * 1024)) / 512;
         const bool isExternal = (atoi(argv[7]) == 1);
         rc = vm->createAsec(argv[2], numSectors, argv[4], argv[5], atoi(argv[6]), isExternal);
     } else if (!strcmp(argv[1], "resize")) {
@@ -417,7 +417,7 @@
             cli->sendMsg(ResponseCode::CommandSyntaxError, "Usage: asec resize <container-id> <size_mb> <key>", false);
             return 0;
         }
-        unsigned int numSectors = (atoi(argv[3]) * (1024 * 1024)) / 512;
+        unsigned long numSectors = (atoi(argv[3]) * (1024 * 1024)) / 512;
         rc = vm->resizeAsec(argv[2], numSectors, argv[4]);
     } else if (!strcmp(argv[1], "finalize")) {
         dumpArgs(argc, argv, -1);
diff --git a/CryptCommandListener.cpp b/CryptCommandListener.cpp
index 2e46919..173be63 100644
--- a/CryptCommandListener.cpp
+++ b/CryptCommandListener.cpp
@@ -42,6 +42,7 @@
 #include "Process.h"
 #include "ResponseCode.h"
 #include "cryptfs.h"
+#include "Ext4Crypt.h"
 
 #define DUMP_ARGS 0
 
@@ -288,6 +289,35 @@
         dumpArgs(argc, argv, -1);
         cryptfs_clear_password();
         rc = 0;
+    } else if (!strcmp(argv[1], "setusercryptopolicies")) {
+        if (argc != 3) {
+            cli->sendMsg(ResponseCode::CommandSyntaxError,
+                "Usage: cryptfs setusercryptopolicies <path>", false);
+            return 0;
+        }
+        SLOGD("cryptfs setusercryptopolicies");
+        dumpArgs(argc, argv, -1);
+        rc = e4crypt_set_user_crypto_policies(argv[2]);
+    } else if (!strcmp(argv[1], "createnewuserdir")) {
+        if (argc != 4) {
+            cli->sendMsg(ResponseCode::CommandSyntaxError,
+                "Usage: cryptfs createnewuserdir <userHandle> <path>", false);
+            return 0;
+        }
+        // ext4enc:TODO: send a CommandSyntaxError if argv[2] not an integer
+        SLOGD("cryptfs createnewuserdir");
+        dumpArgs(argc, argv, -1);
+        rc = e4crypt_create_new_user_dir(argv[2], argv[3]);
+    } else if (!strcmp(argv[1], "deleteuserkey")) {
+        if (argc != 3) {
+            cli->sendMsg(ResponseCode::CommandSyntaxError,
+                "Usage: cryptfs deleteuserkey <userHandle>", false);
+            return 0;
+        }
+        // ext4enc:TODO: send a CommandSyntaxError if argv[2] not an integer
+        SLOGD("cryptfs deleteuserkey");
+        dumpArgs(argc, argv, -1);
+        rc = e4crypt_delete_user_key(argv[2]);
     } else {
         dumpArgs(argc, argv, -1);
         cli->sendMsg(ResponseCode::CommandSyntaxError, "Unknown cryptfs cmd", false);
diff --git a/Devmapper.cpp b/Devmapper.cpp
index 703eade..e56a4da 100644
--- a/Devmapper.cpp
+++ b/Devmapper.cpp
@@ -164,7 +164,7 @@
 }
 
 int Devmapper::create(const char *name, const char *loopFile, const char *key,
-                      unsigned int numSectors, char *ubuffer, size_t len) {
+                      unsigned long numSectors, char *ubuffer, size_t len) {
     char *buffer = (char *) malloc(DEVMAPPER_BUFFER_SIZE);
     if (!buffer) {
         SLOGE("Error allocating memory (%s)", strerror(errno));
diff --git a/Devmapper.h b/Devmapper.h
index 54f808f..5b65b53 100644
--- a/Devmapper.h
+++ b/Devmapper.h
@@ -25,7 +25,7 @@
 class Devmapper {
 public:
     static int create(const char *name, const char *loopFile, const char *key,
-                      unsigned int numSectors, char *buffer, size_t len);
+                      unsigned long numSectors, char *buffer, size_t len);
     static int destroy(const char *name);
     static int lookupActive(const char *name, char *buffer, size_t len);
     static int dumpState(SocketClient *c);
diff --git a/Ext4Crypt.cpp b/Ext4Crypt.cpp
index 7470ff9..c337dbb 100644
--- a/Ext4Crypt.cpp
+++ b/Ext4Crypt.cpp
@@ -15,6 +15,8 @@
 #include <cutils/properties.h>
 #include <openssl/sha.h>
 
+#include <private/android_filesystem_config.h>
+
 #include "unencrypted_properties.h"
 #include "key_control.h"
 #include "cryptfs.h"
@@ -285,6 +287,7 @@
     return 0;
 }
 
+// Get raw keyref - used to make keyname and to pass to ioctl
 static std::string generate_key_ref(const char* key, int length)
 {
     SHA512_CTX c;
@@ -351,9 +354,7 @@
     return 0;
 }
 
-// Install password into global keyring
-// Return raw key reference for use in policy
-static std::string e4crypt_install_key(const std::string &key)
+static ext4_encryption_key fill_key(const std::string &key)
 {
     // ext4enc:TODO Currently raw key is required to be of length
     // sizeof(ext4_key.raw) == EXT4_MAX_KEY_SIZE, so zero pad to
@@ -365,37 +366,52 @@
     static_assert(key_length / 8 <= sizeof(ext4_key.raw),
                   "Key too long!");
     memcpy(ext4_key.raw, &key[0], key.size());
+    return ext4_key;
+}
 
-    // Get raw keyref - used to make keyname and to pass to ioctl
-    auto raw_ref = generate_key_ref(ext4_key.raw, ext4_key.size);
-
-    // Generate keyname
+static std::string keyname(const std::string &raw_ref)
+{
     std::ostringstream o;
+    o << "ext4:";
     for (auto i = raw_ref.begin(); i != raw_ref.end(); ++i) {
         o << std::hex << std::setw(2) << std::setfill('0') << (int)*i;
     }
-    auto ref = std::string("ext4:") + o.str();
+    return o.str();
+}
 
-    // Find existing keyring
-    key_serial_t device_keyring = keyctl_search(KEY_SPEC_SESSION_KEYRING,
-                                                "keyring", "e4crypt", 0);
+// Get the keyring we store all keys in
+static key_serial_t e4crypt_keyring()
+{
+    return keyctl_search(KEY_SPEC_SESSION_KEYRING, "keyring", "e4crypt", 0);
+}
 
+static int e4crypt_install_key(const ext4_encryption_key &ext4_key, const std::string &ref)
+{
+    key_serial_t device_keyring = e4crypt_keyring();
     SLOGI("Found device_keyring - id is %d", device_keyring);
-
-    // Add key ...
     key_serial_t key_id = add_key("logon", ref.c_str(),
                                   (void*)&ext4_key, sizeof(ext4_key),
                                   device_keyring);
-
     if (key_id == -1) {
         SLOGE("Failed to insert key into keyring with error %s",
               strerror(errno));
-        return "";
+        return -1;
     }
-
     SLOGI("Added key %d (%s) to keyring %d in process %d",
           key_id, ref.c_str(), device_keyring, getpid());
+    return 0;
+}
 
+// Install password into global keyring
+// Return raw key reference for use in policy
+static std::string e4crypt_install_key(const std::string &key)
+{
+    auto ext4_key = fill_key(key);
+    auto raw_ref = generate_key_ref(ext4_key.raw, ext4_key.size);
+    auto ref = keyname(raw_ref);
+    if (e4crypt_install_key(ext4_key, ref) == -1) {
+        return "";
+    }
     return raw_ref;
 }
 
@@ -493,12 +509,9 @@
         .Set(fieldname, std::string(value)) ? 0 : -1;
 }
 
-// ext4enc:TODO this can't be the only place keys are read from /dev/urandom
-// we should unite those places.
-static std::string e4crypt_get_user_key(
+static std::string get_key_path(
     const char *mount_path,
-    const char *user_handle,
-    bool create_if_absent)
+    const char *user_handle)
 {
     // ext4enc:TODO get the path properly
     auto key_dir = android::base::StringPrintf("%s/misc/vold/user_keys",
@@ -507,7 +520,15 @@
         SLOGE("Unable to create %s (%s)", key_dir.c_str(), strerror(errno));
         return "";
     }
-    auto key_path = key_dir + "/" + user_handle;
+    return key_dir + "/" + user_handle;
+}
+
+// ext4enc:TODO this can't be the only place keys are read from /dev/urandom
+// we should unite those places.
+static std::string e4crypt_get_key(
+    const std::string &key_path,
+    bool create_if_absent)
+{
     std::string content;
     if (android::base::ReadFileToString(key_path, &content)) {
         if (content.size() != key_length/8) {
@@ -532,20 +553,21 @@
         SLOGE("Unable to read key from /dev/urandom (%s)", strerror(errno));
         return "";
     }
-    std::string user_key(key_bytes, sizeof(key_bytes));
-    if (!android::base::WriteStringToFile(user_key, key_path)) {
+    std::string key(key_bytes, sizeof(key_bytes));
+    if (!android::base::WriteStringToFile(key, key_path)) {
         SLOGE("Unable to write key to %s (%s)",
                 key_path.c_str(), strerror(errno));
         return "";
     }
-    return user_key;
+    return key;
 }
 
 static int e4crypt_set_user_policy(const char *mount_path, const char *user_handle,
                             const char *path, bool create_if_absent)
 {
     SLOGD("e4crypt_set_user_policy for %s", user_handle);
-    auto user_key = e4crypt_get_user_key(mount_path, user_handle,
+    auto user_key = e4crypt_get_key(
+        get_key_path(mount_path, user_handle),
         create_if_absent);
     if (user_key.empty()) {
         return -1;
@@ -565,6 +587,9 @@
     if (chmod(path, S_IRWXU | S_IRWXG | S_IXOTH) < 0) {
         return -1;
     }
+    if (chown(path, AID_SYSTEM, AID_SYSTEM) < 0) {
+        return -1;
+    }
     if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
         // ext4enc:TODO handle errors from this.
         e4crypt_set_user_policy(DATA_MNT_POINT, user_handle, path, true);
@@ -612,3 +637,35 @@
     }
     return 0;
 }
+
+int e4crypt_delete_user_key(const char *user_handle) {
+    SLOGD("e4crypt_delete_user_key(\"%s\")", user_handle);
+    auto key_path = get_key_path(DATA_MNT_POINT, user_handle);
+    auto key = e4crypt_get_key(key_path, false);
+    auto ext4_key = fill_key(key);
+    auto ref = keyname(generate_key_ref(ext4_key.raw, ext4_key.size));
+    auto key_serial = keyctl_search(e4crypt_keyring(), "logon", ref.c_str(), 0);
+    if (keyctl_revoke(key_serial) == 0) {
+        SLOGD("Revoked key with serial %ld ref %s\n", key_serial, ref.c_str());
+    } else {
+        SLOGE("Failed to revoke key with serial %ld ref %s: %s\n",
+            key_serial, ref.c_str(), strerror(errno));
+    }
+    int pid = fork();
+    if (pid < 0) {
+        SLOGE("Unable to fork: %s", strerror(errno));
+        return -1;
+    }
+    if (pid == 0) {
+        SLOGD("Forked for secdiscard");
+        execl("/system/bin/secdiscard",
+            "/system/bin/secdiscard",
+            key_path.c_str(),
+            NULL);
+        SLOGE("Unable to launch secdiscard on %s: %s\n", key_path.c_str(),
+            strerror(errno));
+        exit(-1);
+    }
+    // ext4enc:TODO reap the zombie
+    return 0;
+}
diff --git a/Ext4Crypt.h b/Ext4Crypt.h
index c502b62..f5c2871 100644
--- a/Ext4Crypt.h
+++ b/Ext4Crypt.h
@@ -20,5 +20,6 @@
                       const char* value);
 int e4crypt_set_user_crypto_policies(const char *path);
 int e4crypt_create_new_user_dir(const char *user_handle, const char *path);
+int e4crypt_delete_user_key(const char *user_handle);
 
 __END_DECLS
diff --git a/Loop.cpp b/Loop.cpp
index 059b963..a5863b3 100644
--- a/Loop.cpp
+++ b/Loop.cpp
@@ -253,7 +253,7 @@
     return -1;
 }
 
-int Loop::createImageFile(const char *file, unsigned int numSectors) {
+int Loop::createImageFile(const char *file, unsigned long numSectors) {
     int fd;
 
     if ((fd = creat(file, 0600)) < 0) {
@@ -270,7 +270,7 @@
     return 0;
 }
 
-int Loop::resizeImageFile(const char *file, unsigned int numSectors) {
+int Loop::resizeImageFile(const char *file, unsigned long numSectors) {
     int fd;
 
     if ((fd = open(file, O_RDWR | O_CLOEXEC)) < 0) {
@@ -278,7 +278,7 @@
         return -1;
     }
 
-    SLOGD("Attempting to increase size of %s to %d sectors.", file, numSectors);
+    SLOGD("Attempting to increase size of %s to %lu sectors.", file, numSectors);
 
     if (fallocate(fd, 0, 0, numSectors * 512)) {
         if (errno == ENOSYS || errno == ENOTSUP) {
diff --git a/Loop.h b/Loop.h
index f7c0392..72130b0 100644
--- a/Loop.h
+++ b/Loop.h
@@ -31,8 +31,8 @@
     static int create(const char *id, const char *loopFile, char *loopDeviceBuffer, size_t len);
     static int destroyByDevice(const char *loopDevice);
     static int destroyByFile(const char *loopFile);
-    static int createImageFile(const char *file, unsigned int numSectors);
-    static int resizeImageFile(const char *file, unsigned int numSectors);
+    static int createImageFile(const char *file, unsigned long numSectors);
+    static int resizeImageFile(const char *file, unsigned long numSectors);
 
     static int dumpState(SocketClient *c);
 };
diff --git a/TrimTask.cpp b/TrimTask.cpp
index 1c6eb1f..94bd097 100644
--- a/TrimTask.cpp
+++ b/TrimTask.cpp
@@ -37,7 +37,7 @@
 /* From a would-be kernel header */
 #define FIDTRIM         _IOWR('f', 128, struct fstrim_range)    /* Deep discard trim */
 
-#define BENCHMARK_ENABLED 0
+#define BENCHMARK_ENABLED 1
 
 using android::base::StringPrintf;
 
diff --git a/Utils.cpp b/Utils.cpp
index e19c9df..2dd9ae8 100644
--- a/Utils.cpp
+++ b/Utils.cpp
@@ -410,7 +410,7 @@
 uint64_t GetFreeBytes(const std::string& path) {
     struct statvfs sb;
     if (statvfs(path.c_str(), &sb) == 0) {
-        return sb.f_bfree * sb.f_bsize;
+        return (uint64_t)sb.f_bfree * sb.f_bsize;
     } else {
         return -1;
     }
@@ -504,7 +504,7 @@
         goto done;
     }
 
-    if ((ioctl(fd, BLKGETSIZE, nr_sec)) == -1) {
+    if ((ioctl(fd, BLKGETSIZE, &nr_sec)) == -1) {
         PLOG(ERROR) << "Failed to determine size of " << path;
         goto done;
     }
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index c2c1a16..ea5574b 100755
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -115,21 +115,21 @@
     return 0;
 }
 
-static int adjustSectorNumExt4(unsigned numSectors) {
+static unsigned long adjustSectorNumExt4(unsigned long numSectors) {
     // Ext4 started to reserve 2% or 4096 clusters, whichever is smaller for
     // preventing costly operations or unexpected ENOSPC error.
     // Ext4::format() uses default block size without clustering.
-    unsigned clusterSectors = 4096 / 512;
-    unsigned reservedSectors = (numSectors * 2)/100 + (numSectors % 50 > 0);
+    unsigned long clusterSectors = 4096 / 512;
+    unsigned long reservedSectors = (numSectors * 2)/100 + (numSectors % 50 > 0);
     numSectors += reservedSectors > (4096 * clusterSectors) ? (4096 * clusterSectors) : reservedSectors;
     return ROUND_UP_POWER_OF_2(numSectors, 3);
 }
 
-static int adjustSectorNumFAT(unsigned numSectors) {
+static unsigned long adjustSectorNumFAT(unsigned long numSectors) {
     /*
     * Add some headroom
     */
-    unsigned fatSize = (((numSectors * 4) / 512) + 1) * 2;
+    unsigned long fatSize = (((numSectors * 4) / 512) + 1) * 2;
     numSectors += fatSize + 2;
     /*
     * FAT is aligned to 32 kb with 512b sectors.
@@ -154,7 +154,7 @@
     return 0;
 }
 
-static int setupDevMapperDevice(char* buffer, size_t len, const char* loopDevice, const char* asecFileName, const char* key, const char* idHash , int numImgSectors, bool* createdDMDevice, bool debug) {
+static int setupDevMapperDevice(char* buffer, size_t len, const char* loopDevice, const char* asecFileName, const char* key, const char* idHash , unsigned long numImgSectors, bool* createdDMDevice, bool debug) {
     if (strcmp(key, "none")) {
         if (Devmapper::lookupActive(idHash, buffer, len)) {
             if (Devmapper::create(idHash, loopDevice, key, numImgSectors,
@@ -767,7 +767,7 @@
     return 0;
 }
 
-int VolumeManager::createAsec(const char *id, unsigned int numSectors, const char *fstype,
+int VolumeManager::createAsec(const char *id, unsigned long numSectors, const char *fstype,
         const char *key, const int ownerUid, bool isExternal) {
     struct asec_superblock sb;
     memset(&sb, 0, sizeof(sb));
@@ -795,7 +795,7 @@
     sb.ver = ASEC_SB_VER;
 
     if (numSectors < ((1024*1024)/512)) {
-        SLOGE("Invalid container size specified (%d sectors)", numSectors);
+        SLOGE("Invalid container size specified (%lu sectors)", numSectors);
         errno = EINVAL;
         return -1;
     }
@@ -824,7 +824,7 @@
         return -1;
     }
 
-    unsigned numImgSectors;
+    unsigned long numImgSectors;
     if (usingExt4)
         numImgSectors = adjustSectorNumExt4(numSectors);
     else
@@ -961,7 +961,7 @@
     return 0;
 }
 
-int VolumeManager::resizeAsec(const char *id, unsigned numSectors, const char *key) {
+int VolumeManager::resizeAsec(const char *id, unsigned long numSectors, const char *key) {
     char asecFileName[255];
     char mountPoint[255];
     bool cleanupDm = false;
@@ -991,7 +991,7 @@
 
     struct asec_superblock sb;
     int fd;
-    unsigned int oldNumSec = 0;
+    unsigned long oldNumSec = 0;
 
     if ((fd = open(asecFileName, O_RDONLY | O_CLOEXEC)) < 0) {
         SLOGE("Failed to open ASEC file (%s)", strerror(errno));
@@ -1007,7 +1007,7 @@
 
     oldNumSec = info.st_size / 512;
 
-    unsigned numImgSectors;
+    unsigned long numImgSectors;
     if (sb.c_opts & ASEC_SB_C_OPTS_EXT4)
         numImgSectors = adjustSectorNumExt4(numSectors);
     else
@@ -1015,7 +1015,7 @@
     /*
      *  add one block for the superblock
      */
-    SLOGD("Resizing from %d sectors to %d sectors", oldNumSec, numImgSectors + 1);
+    SLOGD("Resizing from %lu sectors to %lu sectors", oldNumSec, numImgSectors + 1);
     if (oldNumSec == numImgSectors + 1) {
         SLOGW("Size unchanged; ignoring resize request");
         return 0;
diff --git a/VolumeManager.h b/VolumeManager.h
index fa2237f..39fc8f9 100644
--- a/VolumeManager.h
+++ b/VolumeManager.h
@@ -143,9 +143,9 @@
     /* ASEC */
     int findAsec(const char *id, char *asecPath = NULL, size_t asecPathLen = 0,
             const char **directory = NULL) const;
-    int createAsec(const char *id, unsigned numSectors, const char *fstype,
+    int createAsec(const char *id, unsigned long numSectors, const char *fstype,
                    const char *key, const int ownerUid, bool isExternal);
-    int resizeAsec(const char *id, unsigned numSectors, const char *key);
+    int resizeAsec(const char *id, unsigned long numSectors, const char *key);
     int finalizeAsec(const char *id);
 
     /**
diff --git a/cryptfs.c b/cryptfs.c
index a905ff6..694c836 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -1253,11 +1253,9 @@
     SLOGI("Using pbkdf2 for cryptfs KDF");
 
     /* Turn the password into a key and IV that can decrypt the master key */
-    PKCS5_PBKDF2_HMAC_SHA1(passwd, strlen(passwd),
-                           salt, SALT_LEN,
-                           HASH_COUNT, KEY_LEN_BYTES+IV_LEN_BYTES, ikey);
-
-    return 0;
+    return PKCS5_PBKDF2_HMAC_SHA1(passwd, strlen(passwd), salt, SALT_LEN,
+                                  HASH_COUNT, KEY_LEN_BYTES + IV_LEN_BYTES,
+                                  ikey) != 1;
 }
 
 static int scrypt(const char *passwd, const unsigned char *salt,
@@ -2445,11 +2443,19 @@
         goto errout;
     }
 
-    if ( (data.cryptofd = open(crypto_blkdev, O_WRONLY|O_CLOEXEC)) < 0) {
-        SLOGE("Error opening crypto_blkdev %s for ext4 inplace encrypt. err=%d(%s)\n",
-              crypto_blkdev, errno, strerror(errno));
-        rc = ENABLE_INPLACE_ERR_DEV;
-        goto errout;
+    // Wait until the block device appears.  Re-use the mount retry values since it is reasonable.
+    int retries = RETRY_MOUNT_ATTEMPTS;
+    while ((data.cryptofd = open(crypto_blkdev, O_WRONLY|O_CLOEXEC)) < 0) {
+        if (--retries) {
+            SLOGE("Error opening crypto_blkdev %s for ext4 inplace encrypt. err=%d(%s), retrying\n",
+                  crypto_blkdev, errno, strerror(errno));
+            sleep(RETRY_MOUNT_DELAY_SECONDS);
+        } else {
+            SLOGE("Error opening crypto_blkdev %s for ext4 inplace encrypt. err=%d(%s)\n",
+                  crypto_blkdev, errno, strerror(errno));
+            rc = ENABLE_INPLACE_ERR_DEV;
+            goto errout;
+        }
     }
 
     if (setjmp(setjmp_env)) {
@@ -3237,7 +3243,9 @@
 int cryptfs_changepw(int crypt_type, const char *newpw)
 {
     if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
-        return e4crypt_change_password(DATA_MNT_POINT, crypt_type, newpw);
+        return e4crypt_change_password(DATA_MNT_POINT, crypt_type,
+                    crypt_type == CRYPT_TYPE_DEFAULT ? DEFAULT_PASSWORD
+                                                     : newpw);
     }
 
     struct crypt_mnt_ftr crypt_ftr;
diff --git a/fs/Ext4.cpp b/fs/Ext4.cpp
index 3ae4159..4cb9d31 100644
--- a/fs/Ext4.cpp
+++ b/fs/Ext4.cpp
@@ -151,17 +151,17 @@
     return rc;
 }
 
-status_t Resize(const std::string& source, unsigned int numSectors) {
+status_t Resize(const std::string& source, unsigned long numSectors) {
     std::vector<std::string> cmd;
     cmd.push_back(kResizefsPath);
     cmd.push_back("-f");
     cmd.push_back(source);
-    cmd.push_back(StringPrintf("%u", numSectors));
+    cmd.push_back(StringPrintf("%lu", numSectors));
 
     return ForkExecvp(cmd);
 }
 
-status_t Format(const std::string& source, unsigned int numSectors,
+status_t Format(const std::string& source, unsigned long numSectors,
         const std::string& target) {
     std::vector<std::string> cmd;
     cmd.push_back(kMkfsPath);
@@ -172,7 +172,7 @@
 
     if (numSectors) {
         cmd.push_back("-l");
-        cmd.push_back(StringPrintf("%u", numSectors * 512));
+        cmd.push_back(StringPrintf("%lu", numSectors * 512));
     }
 
     // Always generate a real UUID
diff --git a/fs/Ext4.h b/fs/Ext4.h
index a5efa74..f78dc95 100644
--- a/fs/Ext4.h
+++ b/fs/Ext4.h
@@ -30,9 +30,9 @@
 status_t Check(const std::string& source, const std::string& target);
 status_t Mount(const std::string& source, const std::string& target, bool ro,
         bool remount, bool executable);
-status_t Format(const std::string& source, unsigned int numSectors,
+status_t Format(const std::string& source, unsigned long numSectors,
         const std::string& target);
-status_t Resize(const std::string& source, unsigned int numSectors);
+status_t Resize(const std::string& source, unsigned long numSectors);
 
 }  // namespace ext4
 }  // namespace vold
diff --git a/fs/Vfat.cpp b/fs/Vfat.cpp
index 7bd05ec..7338c1e 100644
--- a/fs/Vfat.cpp
+++ b/fs/Vfat.cpp
@@ -164,7 +164,7 @@
     return rc;
 }
 
-status_t Format(const std::string& source, unsigned int numSectors) {
+status_t Format(const std::string& source, unsigned long numSectors) {
     std::vector<std::string> cmd;
     cmd.push_back(kMkfsPath);
     cmd.push_back("-F");
@@ -177,7 +177,7 @@
 
     if (numSectors) {
         cmd.push_back("-s");
-        cmd.push_back(StringPrintf("%u", numSectors));
+        cmd.push_back(StringPrintf("%lu", numSectors));
     }
 
     cmd.push_back(source);
diff --git a/fs/Vfat.h b/fs/Vfat.h
index 306c7db..40be5f6 100644
--- a/fs/Vfat.h
+++ b/fs/Vfat.h
@@ -31,7 +31,7 @@
 status_t Mount(const std::string& source, const std::string& target, bool ro,
         bool remount, bool executable, int ownerUid, int ownerGid, int permMask,
         bool createLost);
-status_t Format(const std::string& source, unsigned int numSectors);
+status_t Format(const std::string& source, unsigned long numSectors);
 
 }  // namespace vfat
 }  // namespace vold
diff --git a/secdiscard.cpp b/secdiscard.cpp
new file mode 100644
index 0000000..3f4ab2e
--- /dev/null
+++ b/secdiscard.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <linux/fs.h>
+#include <linux/fiemap.h>
+
+#define LOG_TAG "secdiscard"
+#include "cutils/log.h"
+
+// Deliberately limit ourselves to wiping small files.
+#define MAX_WIPE_LENGTH 4096
+#define INIT_BUFFER_SIZE 2048
+
+static void usage(char *progname);
+static void destroy_key(const std::string &path);
+static int file_device_range(const std::string &path, uint64_t range[2]);
+static int open_block_device_for_path(const std::string &path);
+static int read_file_as_string_atomically(const std::string &path, std::string &contents);
+static int find_block_device_for_path(
+    const std::string &mounts,
+    const std::string &path,
+    std::string &block_device);
+
+int main(int argc, char **argv) {
+    if (argc != 2 || argv[1][0] != '/') {
+        usage(argv[0]);
+        return -1;
+    }
+    SLOGD("Running: %s %s", argv[0], argv[1]);
+    std::string target(argv[1]);
+    destroy_key(target);
+    if (unlink(argv[1]) != 0 && errno != ENOENT) {
+        SLOGE("Unable to delete %s: %s",
+            argv[1], strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+static void usage(char *progname) {
+    fprintf(stderr, "Usage: %s <absolute path>\n", progname);
+}
+
+// BLKSECDISCARD all content in "path", if it's small enough.
+static void destroy_key(const std::string &path) {
+    uint64_t range[2];
+    if (file_device_range(path, range) < 0) {
+        return;
+    }
+    int fs_fd = open_block_device_for_path(path);
+    if (fs_fd < 0) {
+        return;
+    }
+    if (ioctl(fs_fd, BLKSECDISCARD, range) != 0) {
+        SLOGE("Unable to BLKSECDISCARD %s: %s", path.c_str(), strerror(errno));
+        close(fs_fd);
+        return;
+    }
+    close(fs_fd);
+    SLOGD("Discarded %s", path.c_str());
+}
+
+// Find a short range that completely covers the file.
+// If there isn't one, return -1, otherwise 0.
+static int file_device_range(const std::string &path, uint64_t range[2])
+{
+    int fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
+    if (fd < 0) {
+        if (errno == ENOENT) {
+            SLOGD("Unable to open %s: %s", path.c_str(), strerror(errno));
+        } else {
+            SLOGE("Unable to open %s: %s", path.c_str(), strerror(errno));
+        }
+        return -1;
+    }
+    alignas(struct fiemap) char fiemap_buffer[offsetof(struct fiemap, fm_extents[1])];
+    memset(fiemap_buffer, 0, sizeof(fiemap_buffer));
+    struct fiemap *fiemap = (struct fiemap *)fiemap_buffer;
+    fiemap->fm_start = 0;
+    fiemap->fm_length = UINT64_MAX;
+    fiemap->fm_flags = 0;
+    fiemap->fm_extent_count = 1;
+    fiemap->fm_mapped_extents = 0;
+    if (ioctl(fd, FS_IOC_FIEMAP, fiemap) != 0) {
+        SLOGE("Unable to FIEMAP %s: %s", path.c_str(), strerror(errno));
+        close(fd);
+        return -1;
+    }
+    close(fd);
+    if (fiemap->fm_mapped_extents != 1) {
+        SLOGE("Expecting one extent, got %d in %s", fiemap->fm_mapped_extents, path.c_str());
+        return -1;
+    }
+    struct fiemap_extent *extent = &fiemap->fm_extents[0];
+    if (!(extent->fe_flags & FIEMAP_EXTENT_LAST)) {
+        SLOGE("First extent was not the last in %s", path.c_str());
+        return -1;
+    }
+    if (extent->fe_flags &
+            (FIEMAP_EXTENT_UNKNOWN | FIEMAP_EXTENT_DELALLOC | FIEMAP_EXTENT_NOT_ALIGNED)) {
+        SLOGE("Extent has unexpected flags %ulx: %s", extent->fe_flags, path.c_str());
+        return -1;
+    }
+    if (extent->fe_length > MAX_WIPE_LENGTH) {
+        SLOGE("Extent too big, %llu bytes in %s", extent->fe_length, path.c_str());
+        return -1;
+    }
+    range[0] = extent->fe_physical;
+    range[1] = extent->fe_length;
+    return 0;
+}
+
+// Given a file path, look for the corresponding
+// block device in /proc/mounts and open it.
+static int open_block_device_for_path(const std::string &path)
+{
+    std::string mountsfile("/proc/mounts");
+    std::string mounts;
+    if (read_file_as_string_atomically(mountsfile, mounts) < 0) {
+        return -1;
+    }
+    std::string block_device;
+    if (find_block_device_for_path(mounts, path, block_device) < 0) {
+        return -1;
+    }
+    SLOGD("For path %s block device is %s", path.c_str(), block_device.c_str());
+    int res = open(block_device.c_str(), O_RDWR | O_LARGEFILE | O_CLOEXEC);
+    if (res < 0) {
+        SLOGE("Failed to open device %s: %s", block_device.c_str(), strerror(errno));
+        return -1;
+    }
+    return res;
+}
+
+// Read a file into a buffer in a single gulp, for atomicity.
+// Null-terminate the buffer.
+// Retry until the buffer is big enough.
+static int read_file_as_string_atomically(const std::string &path, std::string &contents)
+{
+    ssize_t buffer_size = INIT_BUFFER_SIZE;
+    while (true) {
+        int fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
+        if (fd < 0) {
+            SLOGE("Failed to open %s: %s", path.c_str(), strerror(errno));
+            return -1;
+        }
+        contents.resize(buffer_size);
+        ssize_t read_size = read(fd, &contents[0], buffer_size);
+        if (read_size < 0) {
+            SLOGE("Failed to read from %s: %s", path.c_str(), strerror(errno));
+            close(fd);
+            return -1;
+        }
+        close(fd);
+        if (read_size < buffer_size) {
+            contents.resize(read_size);
+            return 0;
+        }
+        SLOGD("%s too big for buffer of size %zu", path.c_str(), buffer_size);
+        buffer_size <<= 1;
+    }
+}
+
+// Search a string representing the contents of /proc/mounts
+// for the mount point of a particular file by prefix matching
+// and return the corresponding block device.
+static int find_block_device_for_path(
+    const std::string &mounts,
+    const std::string &path,
+    std::string &block_device)
+{
+    auto line_begin = mounts.begin();
+    size_t best_prefix = 0;
+    std::string::const_iterator line_end;
+    while (line_begin != mounts.end()) {
+        line_end = std::find(line_begin, mounts.end(), '\n');
+        if (line_end == mounts.end()) {
+            break;
+        }
+        auto device_end = std::find(line_begin, line_end, ' ');
+        if (device_end == line_end) {
+            break;
+        }
+        auto mountpoint_begin = device_end + 1;
+        auto mountpoint_end = std::find(mountpoint_begin, line_end, ' ');
+        if (mountpoint_end == line_end) {
+            break;
+        }
+        if (std::find(line_begin, mountpoint_end, '\\') != mountpoint_end) {
+            // We don't correctly handle escape sequences, and we don't expect
+            // to encounter any, so fail if we do.
+            break;
+        }
+        size_t mountpoint_len = mountpoint_end - mountpoint_begin;
+        if (mountpoint_len > best_prefix &&
+                mountpoint_len < path.length() &&
+                path[mountpoint_len] == '/' &&
+                std::equal(mountpoint_begin, mountpoint_end, path.begin())) {
+            block_device = std::string(line_begin, device_end);
+            best_prefix = mountpoint_len;
+        }
+        line_begin = line_end + 1;
+    }
+    // All of the "break"s above are fatal parse errors.
+    if (line_begin != mounts.end()) {
+        auto bad_line = std::string(line_begin, line_end);
+        SLOGE("Unable to parse line in %s: %s", path.c_str(), bad_line.c_str());
+        return -1;
+    }
+    if (best_prefix == 0) {
+        SLOGE("No prefix found for path: %s", path.c_str());
+        return -1;
+    }
+    return 0;
+}