diff --git a/adb/Android.mk b/adb/Android.mk
index 32dd95a..6cd82ec 100644
--- a/adb/Android.mk
+++ b/adb/Android.mk
@@ -77,6 +77,7 @@
 LOCAL_CFLAGS += -O2 -g -DADB_HOST=1  -Wall -Wno-unused-parameter
 LOCAL_CFLAGS += -D_XOPEN_SOURCE -D_GNU_SOURCE
 LOCAL_MODULE := adb
+LOCAL_MODULE_TAGS := debug
 
 LOCAL_STATIC_LIBRARIES := libzipfile libunz libcrypto_static $(EXTRA_STATIC_LIBS)
 ifeq ($(USE_SYSDEPS_WIN32),)
diff --git a/adb/adb.c b/adb/adb.c
index 71b7a8b..cd7f16c 100644
--- a/adb/adb.c
+++ b/adb/adb.c
@@ -401,6 +401,10 @@
         return "bootloader";
     case CS_DEVICE:
         return "device";
+    case CS_RECOVERY:
+        return "recovery";
+    case CS_SIDELOAD:
+        return "sideload";
     case CS_OFFLINE:
         return "offline";
     default:
diff --git a/adb/usb_vendors.c b/adb/usb_vendors.c
index 604c461..698f8a9 100644
--- a/adb/usb_vendors.c
+++ b/adb/usb_vendors.c
@@ -141,6 +141,8 @@
 #define VENDOR_ID_XIAOMI        0x2717
 // BYD's USB Vendor ID
 #define VENDOR_ID_BYD           0x19D1
+// OUYA's USB Vendor ID
+#define VENDOR_ID_OUYA          0x2836
 
 
 /** built-in vendor list */
@@ -198,6 +200,7 @@
     VENDOR_ID_OPPO,
     VENDOR_ID_XIAOMI,
     VENDOR_ID_BYD,
+    VENDOR_ID_OUYA,
 };
 
 #define BUILT_IN_VENDOR_COUNT    (sizeof(builtInVendorIds)/sizeof(builtInVendorIds[0]))
diff --git a/debuggerd/crasher.c b/debuggerd/crasher.c
index 630d980..d88ef88 100644
--- a/debuggerd/crasher.c
+++ b/debuggerd/crasher.c
@@ -17,6 +17,8 @@
 
 #include <cutils/sockets.h>
 
+extern const char* __progname;
+
 void crash1(void);
 void crashnostack(void);
 void maybeabort(void);
@@ -47,22 +49,18 @@
     return *(int*)(&buf[0]);
 }
 
+__attribute__((noinline)) void overflow_stack(void* p) {
+    fprintf(stderr, "p = %p\n", p);
+    void* buf[1];
+    buf[0] = p;
+    overflow_stack(&buf);
+}
+
 void test_call1()
 {
     *((int*) 32) = 1;
 }
 
-void *test_thread(void *x)
-{
-    printf("crasher: thread pid=%d tid=%d\n", getpid(), gettid());
-
-    sleep(1);
-    test_call1();
-    printf("goodbye\n");
-
-    return 0;
-}
-
 void *noisy(void *x)
 {
     char c = (unsigned) x;
@@ -118,35 +116,48 @@
 
 int do_action(const char* arg)
 {
-    if(!strncmp(arg, "thread-", strlen("thread-"))) {
+    fprintf(stderr,"crasher: init pid=%d tid=%d\n", getpid(), gettid());
+
+    if (!strncmp(arg, "thread-", strlen("thread-"))) {
         return do_action_on_thread(arg + strlen("thread-"));
+    } else if (!strcmp(arg,"smash-stack")) {
+        return smash_stack(42);
+    } else if (!strcmp(arg,"stack-overflow")) {
+        overflow_stack(NULL);
+    } else if (!strcmp(arg,"nostack")) {
+        crashnostack();
+    } else if (!strcmp(arg,"ctest")) {
+        return ctest();
+    } else if (!strcmp(arg,"exit")) {
+        exit(1);
+    } else if (!strcmp(arg,"crash")) {
+        return crash(42);
+    } else if (!strcmp(arg,"abort")) {
+        maybeabort();
     }
 
-    if(!strcmp(arg,"smash-stack")) return smash_stack(42);
-    if(!strcmp(arg,"nostack")) crashnostack();
-    if(!strcmp(arg,"ctest")) return ctest();
-    if(!strcmp(arg,"exit")) exit(1);
-    if(!strcmp(arg,"crash")) return crash(42);
-    if(!strcmp(arg,"abort")) maybeabort();
-
-    pthread_t thr;
-    pthread_attr_t attr;
-    pthread_attr_init(&attr);
-    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
-    pthread_create(&thr, &attr, test_thread, 0);
-    while(1) sleep(1);
+    fprintf(stderr, "%s OP\n", __progname);
+    fprintf(stderr, "where OP is:\n");
+    fprintf(stderr, "  smash-stack     overwrite a stack-guard canary\n");
+    fprintf(stderr, "  stack-overflow  recurse until the stack overflows\n");
+    fprintf(stderr, "  nostack         crash with a NULL stack pointer\n");
+    fprintf(stderr, "  ctest           (obsoleted by thread-crash?)\n");
+    fprintf(stderr, "  exit            call exit(1)\n");
+    fprintf(stderr, "  crash           cause a SIGSEGV\n");
+    fprintf(stderr, "  abort           call abort()\n");
+    fprintf(stderr, "prefix any of the above with 'thread-' to not run\n");
+    fprintf(stderr, "on the process' main thread.\n");
+    return EXIT_SUCCESS;
 }
 
 int main(int argc, char **argv)
 {
     fprintf(stderr,"crasher: built at " __TIME__ "!@\n");
-    fprintf(stderr,"crasher: init pid=%d tid=%d\n", getpid(), gettid());
 
     if(argc > 1) {
         return do_action(argv[1]);
     } else {
         crash1();
-//        *((int*) 0) = 42;
     }
     
     return 0;
diff --git a/debuggerd/debuggerd.c b/debuggerd/debuggerd.c
index 55222c5..99e6f13 100644
--- a/debuggerd/debuggerd.c
+++ b/debuggerd/debuggerd.c
@@ -52,6 +52,7 @@
     debugger_action_t action;
     pid_t pid, tid;
     uid_t uid, gid;
+    uintptr_t abort_msg_address;
 } debugger_request_t;
 
 static int
@@ -207,12 +208,15 @@
     }
 
     debugger_msg_t msg;
+    memset(&msg, 0, sizeof(msg));
     status = TEMP_FAILURE_RETRY(read(fd, &msg, sizeof(msg)));
     if (status < 0) {
         LOG("read failure? %s\n", strerror(errno));
         return -1;
     }
-    if (status != sizeof(msg)) {
+    if (status == sizeof(debugger_msg_t)) {
+        XLOG("crash request of size %d abort_msg_address=%#08x\n", status, msg.abort_msg_address);
+    } else {
         LOG("invalid crash request of size %d\n", status);
         return -1;
     }
@@ -222,6 +226,7 @@
     out_request->pid = cr.pid;
     out_request->uid = cr.uid;
     out_request->gid = cr.gid;
+    out_request->abort_msg_address = msg.abort_msg_address;
 
     if (msg.action == DEBUGGER_ACTION_CRASH) {
         /* Ensure that the tid reported by the crashing process is valid. */
@@ -265,6 +270,7 @@
     XLOG("handle_request(%d)\n", fd);
 
     debugger_request_t request;
+    memset(&request, 0, sizeof(request));
     int status = read_request(fd, &request);
     if (!status) {
         XLOG("BOOM: pid=%d uid=%d gid=%d tid=%d\n",
@@ -308,7 +314,7 @@
                         if (request.action == DEBUGGER_ACTION_DUMP_TOMBSTONE) {
                             XLOG("stopped -- dumping to tombstone\n");
                             tombstone_path = engrave_tombstone(request.pid, request.tid,
-                                    signal, true, true, &detach_failed,
+                                    signal, request.abort_msg_address, true, true, &detach_failed,
                                     &total_sleep_time_usec);
                         } else if (request.action == DEBUGGER_ACTION_DUMP_BACKTRACE) {
                             XLOG("stopped -- dumping to fd\n");
@@ -345,8 +351,8 @@
                         /* don't dump sibling threads when attaching to GDB because it
                          * makes the process less reliable, apparently... */
                         tombstone_path = engrave_tombstone(request.pid, request.tid,
-                                signal, !attach_gdb, false, &detach_failed,
-                                &total_sleep_time_usec);
+                                signal, request.abort_msg_address, !attach_gdb, false,
+                                &detach_failed, &total_sleep_time_usec);
                         break;
                     }
 
diff --git a/debuggerd/tombstone.c b/debuggerd/tombstone.c
index e8b3e24..da5f03c 100644
--- a/debuggerd/tombstone.c
+++ b/debuggerd/tombstone.c
@@ -174,7 +174,7 @@
     siginfo_t si;
 
     memset(&si, 0, sizeof(si));
-    if(ptrace(PTRACE_GETSIGINFO, tid, 0, &si)){
+    if (ptrace(PTRACE_GETSIGINFO, tid, 0, &si)){
         _LOG(log, false, "cannot get siginfo: %s\n", strerror(errno));
     } else if (signal_has_address(sig)) {
         _LOG(log, false, "signal %d (%s), code %d (%s), fault addr %08x\n",
@@ -616,11 +616,46 @@
     dump_log_file(log, pid, "/dev/log/main", tailOnly);
 }
 
+static void dump_abort_message(log_t* log, pid_t tid, uintptr_t address) {
+  if (address == 0) {
+    return;
+  }
+
+  address += sizeof(size_t); // Skip the buffer length.
+
+  char msg[512];
+  memset(msg, 0, sizeof(msg));
+  char* p = &msg[0];
+  while (p < &msg[sizeof(msg)]) {
+    uint32_t data;
+    if (!try_get_word_ptrace(tid, address, &data)) {
+      break;
+    }
+    address += sizeof(uint32_t);
+
+    if ((*p++ = (data >>  0) & 0xff) == 0) {
+      break;
+    }
+    if ((*p++ = (data >>  8) & 0xff) == 0) {
+      break;
+    }
+    if ((*p++ = (data >> 16) & 0xff) == 0) {
+      break;
+    }
+    if ((*p++ = (data >> 24) & 0xff) == 0) {
+      break;
+    }
+  }
+  msg[sizeof(msg) - 1] = '\0';
+
+  _LOG(log, false, "Abort message: '%s'\n", msg);
+}
+
 /*
  * Dumps all information about the specified pid to the tombstone.
  */
-static bool dump_crash(log_t* log, pid_t pid, pid_t tid, int signal,
-        bool dump_sibling_threads, int* total_sleep_time_usec)
+static bool dump_crash(log_t* log, pid_t pid, pid_t tid, int signal, uintptr_t abort_msg_address,
+                       bool dump_sibling_threads, int* total_sleep_time_usec)
 {
     /* don't copy log messages to tombstone unless this is a dev device */
     char value[PROPERTY_VALUE_MAX];
@@ -632,9 +667,10 @@
     dump_build_info(log);
     dump_revision_info(log);
     dump_thread_info(log, pid, tid, true);
-    if(signal) {
+    if (signal) {
         dump_fault_addr(log, tid, signal);
     }
+    dump_abort_message(log, tid, abort_msg_address);
 
     ptrace_context_t* context = load_ptrace_context(tid);
     dump_thread(context, log, tid, true, total_sleep_time_usec);
@@ -712,7 +748,7 @@
     return strdup(path);
 }
 
-char* engrave_tombstone(pid_t pid, pid_t tid, int signal,
+char* engrave_tombstone(pid_t pid, pid_t tid, int signal, uintptr_t abort_msg_address,
         bool dump_sibling_threads, bool quiet, bool* detach_failed,
         int* total_sleep_time_usec) {
     mkdir(TOMBSTONE_DIR, 0755);
@@ -733,7 +769,7 @@
     log_t log;
     log.tfd = fd;
     log.quiet = quiet;
-    *detach_failed = dump_crash(&log, pid, tid, signal, dump_sibling_threads,
+    *detach_failed = dump_crash(&log, pid, tid, signal, abort_msg_address, dump_sibling_threads,
             total_sleep_time_usec);
 
     close(fd);
diff --git a/debuggerd/tombstone.h b/debuggerd/tombstone.h
index edcd7b1..d4a1a96 100644
--- a/debuggerd/tombstone.h
+++ b/debuggerd/tombstone.h
@@ -25,7 +25,7 @@
 
 /* Creates a tombstone file and writes the crash dump to it.
  * Returns the path of the tombstone, which must be freed using free(). */
-char* engrave_tombstone(pid_t pid, pid_t tid, int signal,
+char* engrave_tombstone(pid_t pid, pid_t tid, int signal, uintptr_t abort_msg_address,
         bool dump_sibling_threads, bool quiet, bool* detach_failed, int* total_sleep_time_usec);
 
 #endif // _DEBUGGERD_TOMBSTONE_H
diff --git a/fastboot/Android.mk b/fastboot/Android.mk
index 5025dae..1189e1f 100644
--- a/fastboot/Android.mk
+++ b/fastboot/Android.mk
@@ -20,6 +20,7 @@
   $(LOCAL_PATH)/../../extras/ext4_utils
 LOCAL_SRC_FILES := protocol.c engine.c bootimg.c fastboot.c
 LOCAL_MODULE := fastboot
+LOCAL_MODULE_TAGS := debug
 
 ifeq ($(HOST_OS),linux)
   LOCAL_SRC_FILES += usb_linux.c util_linux.c
diff --git a/include/corkscrew/map_info.h b/include/corkscrew/map_info.h
index c9b241d..14bfad6 100644
--- a/include/corkscrew/map_info.h
+++ b/include/corkscrew/map_info.h
@@ -63,6 +63,10 @@
  * previous acquired using acquire_my_map_info_list(). */
 void release_my_map_info_list(map_info_t* milist);
 
+/* Flushes the cached memory map so the next call to
+ * acquire_my_map_info_list() gets fresh data. */
+void flush_my_map_info_list();
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/cutils/debugger.h b/include/cutils/debugger.h
index 5a8e796..4eda523 100644
--- a/include/cutils/debugger.h
+++ b/include/cutils/debugger.h
@@ -34,10 +34,10 @@
     DEBUGGER_ACTION_DUMP_BACKTRACE,
 } debugger_action_t;
 
-/* message sent over the socket */
 typedef struct {
     debugger_action_t action;
     pid_t tid;
+    uintptr_t abort_msg_address;
 } debugger_msg_t;
 
 /* Dumps a process backtrace, registers, and stack to a tombstone file (requires root).
diff --git a/init/devices.c b/init/devices.c
index e25034c..69f5fc8 100644
--- a/init/devices.c
+++ b/init/devices.c
@@ -127,6 +127,7 @@
     char buf[512];
     struct listnode *node;
     struct perms_ *dp;
+    char *secontext;
 
         /* upaths omit the "/sys" that paths in this list
          * contain, so we add 4 when comparing...
@@ -148,6 +149,14 @@
         INFO("fixup %s %d %d 0%o\n", buf, dp->uid, dp->gid, dp->perm);
         chown(buf, dp->uid, dp->gid);
         chmod(buf, dp->perm);
+        if (sehandle) {
+            secontext = NULL;
+            selabel_lookup(sehandle, &secontext, buf, 0);
+            if (secontext) {
+                setfilecon(buf, secontext);
+                freecon(secontext);
+           }
+        }
     }
 }
 
diff --git a/init/init.c b/init/init.c
index b28b0ab..39df0ff 100755
--- a/init/init.c
+++ b/init/init.c
@@ -90,7 +90,7 @@
 }
 
 static int have_console;
-static char *console_name = "/dev/console";
+static char console_name[PROP_VALUE_MAX] = "/dev/console";
 static time_t process_needs_restart;
 
 static const char *ENV[32];
@@ -430,7 +430,7 @@
 
 static void msg_start(const char *name)
 {
-    struct service *svc;
+    struct service *svc = NULL;
     char *tmp = NULL;
     char *args = NULL;
 
@@ -438,11 +438,13 @@
         svc = service_find_by_name(name);
     else {
         tmp = strdup(name);
-        args = strchr(tmp, ':');
-        *args = '\0';
-        args++;
+        if (tmp) {
+            args = strchr(tmp, ':');
+            *args = '\0';
+            args++;
 
-        svc = service_find_by_name(tmp);
+            svc = service_find_by_name(tmp);
+        }
     }
 
     if (svc) {
@@ -547,11 +549,9 @@
 static int console_init_action(int nargs, char **args)
 {
     int fd;
-    char tmp[PROP_VALUE_MAX];
 
     if (console[0]) {
-        snprintf(tmp, sizeof(tmp), "/dev/%s", console);
-        console_name = strdup(tmp);
+        snprintf(console_name, sizeof(console_name), "/dev/%s", console);
     }
 
     fd = open(console_name, O_RDWR);
diff --git a/init/property_service.c b/init/property_service.c
index 61dd86f..48488be 100755
--- a/init/property_service.c
+++ b/init/property_service.c
@@ -353,7 +353,11 @@
         __futex_wake(&pa->serial, INT32_MAX);
     } else {
         pa = __system_property_area__;
-        if(pa->count == PA_COUNT_MAX) return -1;
+        if(pa->count == PA_COUNT_MAX) {
+            ERROR("Failed to set '%s'='%s',  property pool is exhausted at %d entries",
+                    name, value, PA_COUNT_MAX);
+            return -1;
+        }
 
         pi = pa_info_array + pa->count;
         pi->serial = (valuelen << 24);
diff --git a/libcorkscrew/Android.mk b/libcorkscrew/Android.mk
index 2786d8f..25512e2 100644
--- a/libcorkscrew/Android.mk
+++ b/libcorkscrew/Android.mk
@@ -59,23 +59,28 @@
 
 # Build test.
 include $(CLEAR_VARS)
-LOCAL_SRC_FILES := test.c
-LOCAL_CFLAGS += -std=gnu99 -Werror -fno-inline-small-functions
+LOCAL_SRC_FILES := test.cpp
+LOCAL_CFLAGS += -Werror -fno-inline-small-functions
 LOCAL_SHARED_LIBRARIES := libcorkscrew
 LOCAL_MODULE := libcorkscrew_test
 LOCAL_MODULE_TAGS := optional
 include $(BUILD_EXECUTABLE)
 
 
+# TODO: reenable darwin-x86
+# ifeq ($(HOST_ARCH),x86)
 ifeq ($(HOST_OS)-$(HOST_ARCH),linux-x86)
 
 # Build libcorkscrew.
 include $(CLEAR_VARS)
 LOCAL_SRC_FILES += $(generic_src_files) $(x86_src_files)
 LOCAL_CFLAGS += -DCORKSCREW_HAVE_ARCH
-LOCAL_SHARED_LIBRARIES += libgccdemangle
 LOCAL_STATIC_LIBRARIES += libcutils
-LOCAL_LDLIBS += -ldl -lrt
+LOCAL_LDLIBS += -ldl
+ifeq ($(HOST_OS),linux)
+  LOCAL_SHARED_LIBRARIES += libgccdemangle # TODO: is this even needed on Linux?
+  LOCAL_LDLIBS += -lrt
+endif
 LOCAL_CFLAGS += -std=gnu99 -Werror
 LOCAL_MODULE := libcorkscrew
 LOCAL_MODULE_TAGS := optional
@@ -83,11 +88,11 @@
 
 # Build test.
 include $(CLEAR_VARS)
-LOCAL_SRC_FILES := test.c
-LOCAL_CFLAGS += -std=gnu99 -Werror -fno-inline-small-functions
+LOCAL_SRC_FILES := test.cpp
+LOCAL_CFLAGS += -Werror
 LOCAL_SHARED_LIBRARIES := libcorkscrew
 LOCAL_MODULE := libcorkscrew_test
 LOCAL_MODULE_TAGS := optional
 include $(BUILD_HOST_EXECUTABLE)
 
-endif # linux-x86
+endif # HOST_ARCH == x86
diff --git a/libcorkscrew/arch-x86/backtrace-x86.c b/libcorkscrew/arch-x86/backtrace-x86.c
index 29159ed..e133ab6 100755
--- a/libcorkscrew/arch-x86/backtrace-x86.c
+++ b/libcorkscrew/arch-x86/backtrace-x86.c
@@ -75,13 +75,18 @@
 
 #endif /* __BIONIC_HAVE_UCONTEXT_T */
 
-#else /* __BIONIC__ */
+#elif defined(__APPLE__)
+
+#define _XOPEN_SOURCE
+#include <ucontext.h>
+
+#else
 
 // glibc has its own renaming of the Linux kernel's structures.
 #define __USE_GNU // For REG_EBP, REG_ESP, and REG_EIP.
 #include <ucontext.h>
 
-#endif /* __ BIONIC__ */
+#endif
 
 /* Unwind state. */
 typedef struct {
@@ -819,9 +824,15 @@
     const ucontext_t* uc = (const ucontext_t*)sigcontext;
 
     unwind_state_t state;
+#if defined(__APPLE__)
+    state.reg[DWARF_EBP] = uc->uc_mcontext->__ss.__ebp;
+    state.reg[DWARF_ESP] = uc->uc_mcontext->__ss.__esp;
+    state.reg[DWARF_EIP] = uc->uc_mcontext->__ss.__eip;
+#else
     state.reg[DWARF_EBP] = uc->uc_mcontext.gregs[REG_EBP];
     state.reg[DWARF_ESP] = uc->uc_mcontext.gregs[REG_ESP];
     state.reg[DWARF_EIP] = uc->uc_mcontext.gregs[REG_EIP];
+#endif
 
     memory_t memory;
     init_memory(&memory, map_info_list);
@@ -831,6 +842,9 @@
 
 ssize_t unwind_backtrace_ptrace_arch(pid_t tid, const ptrace_context_t* context,
         backtrace_frame_t* backtrace, size_t ignore_depth, size_t max_depth) {
+#if defined(__APPLE__)
+    return -1;
+#else
     pt_regs_x86_t regs;
     if (ptrace(PTRACE_GETREGS, tid, 0, &regs)) {
         return -1;
@@ -845,4 +859,5 @@
     init_memory_ptrace(&memory, tid);
     return unwind_backtrace_common(&memory, context->map_info_list,
             &state, backtrace, ignore_depth, max_depth);
+#endif
 }
diff --git a/libcorkscrew/backtrace.c b/libcorkscrew/backtrace.c
index 03dbd53..b365e5b 100644
--- a/libcorkscrew/backtrace.c
+++ b/libcorkscrew/backtrace.c
@@ -33,7 +33,6 @@
 #include <unwind.h>
 #include <cutils/log.h>
 #include <cutils/atomic.h>
-#include <elf.h>
 
 #define __USE_GNU // For dladdr(3) in glibc.
 #include <dlfcn.h>
@@ -43,6 +42,15 @@
 // Bionic implements and exports gettid but only implements tgkill.
 extern int tgkill(int tgid, int tid, int sig);
 
+#elif defined(__APPLE__)
+
+#include <sys/syscall.h>
+
+// Mac OS >= 10.6 has a system call equivalent to Linux's gettid().
+static pid_t gettid() {
+  return syscall(SYS_thread_selfid);
+}
+
 #else
 
 // glibc doesn't implement or export either gettid or tgkill.
@@ -97,7 +105,7 @@
     state.returned_frames = 0;
     init_memory(&state.memory, milist);
 
-    _Unwind_Reason_Code rc =_Unwind_Backtrace(unwind_backtrace_callback, &state);
+    _Unwind_Reason_Code rc = _Unwind_Backtrace(unwind_backtrace_callback, &state);
 
     release_my_map_info_list(milist);
 
@@ -146,7 +154,9 @@
 
     ALOGV("Unwinding thread %d from thread %d.", tid, gettid());
 
-#ifdef CORKSCREW_HAVE_ARCH
+    // TODO: there's no tgkill(2) on Mac OS, so we'd either need the
+    // mach_port_t or the pthread_t rather than the tid.
+#if defined(CORKSCREW_HAVE_ARCH) && !defined(__APPLE__)
     struct sigaction act;
     struct sigaction oact;
     memset(&act, 0, sizeof(act));
@@ -305,20 +315,20 @@
         const backtrace_symbol_t* symbol, char* buffer, size_t bufferSize) {
     const char* mapName = symbol->map_name ? symbol->map_name : "<unknown>";
     const char* symbolName = symbol->demangled_name ? symbol->demangled_name : symbol->symbol_name;
-    size_t fieldWidth = (bufferSize - 80) / 2;
+    int fieldWidth = (bufferSize - 80) / 2;
     if (symbolName) {
         uint32_t pc_offset = symbol->relative_pc - symbol->relative_symbol_addr;
         if (pc_offset) {
-            snprintf(buffer, bufferSize, "#%02d  pc %08x  %.*s (%.*s+%u)",
-                    frameNumber, symbol->relative_pc, fieldWidth, mapName,
+            snprintf(buffer, bufferSize, "#%02u  pc %p  %.*s (%.*s+%u)",
+                    frameNumber, (void*) symbol->relative_pc, fieldWidth, mapName,
                     fieldWidth, symbolName, pc_offset);
         } else {
-            snprintf(buffer, bufferSize, "#%02d  pc %08x  %.*s (%.*s)",
-                    frameNumber, symbol->relative_pc, fieldWidth, mapName,
+            snprintf(buffer, bufferSize, "#%02u  pc %p  %.*s (%.*s)",
+                    frameNumber, (void*) symbol->relative_pc, fieldWidth, mapName,
                     fieldWidth, symbolName);
         }
     } else {
-        snprintf(buffer, bufferSize, "#%02d  pc %08x  %.*s",
-                frameNumber, symbol->relative_pc, fieldWidth, mapName);
+        snprintf(buffer, bufferSize, "#%02u  pc %p  %.*s",
+                frameNumber, (void*) symbol->relative_pc, fieldWidth, mapName);
     }
 }
diff --git a/libcorkscrew/demangle.c b/libcorkscrew/demangle.c
index 54247cb..30ab1b0 100644
--- a/libcorkscrew/demangle.c
+++ b/libcorkscrew/demangle.c
@@ -25,6 +25,12 @@
                              int *status);
 
 char* demangle_symbol_name(const char* name) {
+#if defined(__APPLE__)
+    // Mac OS' __cxa_demangle demangles "f" as "float"; last tested on 10.7.
+    if (name != NULL && name[0] != '_') {
+        return NULL;
+    }
+#endif
     // __cxa_demangle handles NULL by returning NULL
     return __cxa_demangle(name, 0, 0, 0);
 }
diff --git a/libcorkscrew/map_info.c b/libcorkscrew/map_info.c
index 6a27664..93dffbf 100644
--- a/libcorkscrew/map_info.c
+++ b/libcorkscrew/map_info.c
@@ -29,6 +29,67 @@
 #include <cutils/log.h>
 #include <sys/time.h>
 
+#if defined(__APPLE__)
+
+// Mac OS vmmap(1) output:
+// __TEXT                 0009f000-000a1000 [    8K     8K] r-x/rwx SM=COW  /Volumes/android/dalvik-dev/out/host/darwin-x86/bin/libcorkscrew_test\n
+// 012345678901234567890123456789012345678901234567890123456789
+// 0         1         2         3         4         5
+static map_info_t* parse_vmmap_line(const char* line) {
+    unsigned long int start;
+    unsigned long int end;
+    char permissions[4];
+    int name_pos;
+    if (sscanf(line, "%*21c %lx-%lx [%*13c] %3c/%*3c SM=%*3c  %n",
+               &start, &end, permissions, &name_pos) != 3) {
+        return NULL;
+    }
+
+    const char* name = line + name_pos;
+    size_t name_len = strlen(name);
+
+    map_info_t* mi = calloc(1, sizeof(map_info_t) + name_len);
+    if (mi != NULL) {
+        mi->start = start;
+        mi->end = end;
+        mi->is_readable = permissions[0] == 'r';
+        mi->is_writable = permissions[1] == 'w';
+        mi->is_executable = permissions[2] == 'x';
+        mi->data = NULL;
+        memcpy(mi->name, name, name_len);
+        mi->name[name_len - 1] = '\0';
+        ALOGV("Parsed map: start=0x%08x, end=0x%08x, "
+              "is_readable=%d, is_writable=%d is_executable=%d, name=%s",
+              mi->start, mi->end,
+              mi->is_readable, mi->is_writable, mi->is_executable, mi->name);
+    }
+    return mi;
+}
+
+map_info_t* load_map_info_list(pid_t pid) {
+    char cmd[1024];
+    snprintf(cmd, sizeof(cmd), "vmmap -w -resident -submap -allSplitLibs -interleaved %d", pid);
+    FILE* fp = popen(cmd, "r");
+    if (fp == NULL) {
+        return NULL;
+    }
+
+    char line[1024];
+    map_info_t* milist = NULL;
+    while (fgets(line, sizeof(line), fp) != NULL) {
+        map_info_t* mi = parse_vmmap_line(line);
+        if (mi != NULL) {
+            mi->next = milist;
+            milist = mi;
+        }
+    }
+    pclose(fp);
+    return milist;
+}
+
+#else
+
+// Linux /proc/<pid>/maps lines:
 // 6f000000-6f01e000 rwxp 00000000 00:0c 16389419   /system/lib/libcomposer.so\n
 // 012345678901234567890123456789012345678901234567890123456789
 // 0         1         2         3         4         5
@@ -63,9 +124,9 @@
         memcpy(mi->name, name, name_len);
         mi->name[name_len] = '\0';
         ALOGV("Parsed map: start=0x%08x, end=0x%08x, "
-                "is_readable=%d, is_writable=%d, is_executable=%d, name=%s",
-                mi->start, mi->end,
-                mi->is_readable, mi->is_writable, mi->is_executable, mi->name);
+              "is_readable=%d, is_writable=%d, is_executable=%d, name=%s",
+              mi->start, mi->end,
+              mi->is_readable, mi->is_writable, mi->is_executable, mi->name);
     }
     return mi;
 }
@@ -91,6 +152,8 @@
     return milist;
 }
 
+#endif
+
 void free_map_info_list(map_info_t* milist) {
     while (milist) {
         map_info_t* next = milist->next;
@@ -132,11 +195,17 @@
     int64_t timestamp;
 } my_map_info_data_t;
 
-static int64_t now() {
+static int64_t now_ns() {
+#if defined(HAVE_POSIX_CLOCKS)
     struct timespec t;
     t.tv_sec = t.tv_nsec = 0;
     clock_gettime(CLOCK_MONOTONIC, &t);
     return t.tv_sec * 1000000000LL + t.tv_nsec;
+#else
+    struct timeval t;
+    gettimeofday(&t, NULL);
+    return t.tv_sec * 1000000000LL + t.tv_usec * 1000LL;
+#endif
 }
 
 static void dec_ref(map_info_t* milist, my_map_info_data_t* data) {
@@ -150,8 +219,8 @@
 map_info_t* acquire_my_map_info_list() {
     pthread_mutex_lock(&g_my_map_info_list_mutex);
 
-    int64_t time = now();
-    if (g_my_map_info_list) {
+    int64_t time = now_ns();
+    if (g_my_map_info_list != NULL) {
         my_map_info_data_t* data = (my_map_info_data_t*)g_my_map_info_list->data;
         int64_t age = time - data->timestamp;
         if (age >= MAX_CACHE_AGE) {
@@ -163,10 +232,10 @@
         }
     }
 
-    if (!g_my_map_info_list) {
+    if (g_my_map_info_list == NULL) {
         my_map_info_data_t* data = (my_map_info_data_t*)malloc(sizeof(my_map_info_data_t));
         g_my_map_info_list = load_map_info_list(getpid());
-        if (g_my_map_info_list) {
+        if (g_my_map_info_list != NULL) {
             ALOGV("Loaded my_map_info_list %p.", g_my_map_info_list);
             g_my_map_info_list->data = data;
             data->refs = 1;
@@ -196,3 +265,15 @@
         pthread_mutex_unlock(&g_my_map_info_list_mutex);
     }
 }
+
+void flush_my_map_info_list() {
+    pthread_mutex_lock(&g_my_map_info_list_mutex);
+
+    if (g_my_map_info_list != NULL) {
+        my_map_info_data_t* data = (my_map_info_data_t*) g_my_map_info_list->data;
+        dec_ref(g_my_map_info_list, data);
+        g_my_map_info_list = NULL;
+    }
+
+    pthread_mutex_unlock(&g_my_map_info_list_mutex);
+}
diff --git a/libcorkscrew/ptrace.c b/libcorkscrew/ptrace.c
index 776ef69..be58f7f 100644
--- a/libcorkscrew/ptrace.c
+++ b/libcorkscrew/ptrace.c
@@ -46,21 +46,25 @@
 }
 
 bool try_get_word(const memory_t* memory, uintptr_t ptr, uint32_t* out_value) {
-    ALOGV("try_get_word: reading word at 0x%08x", ptr);
+    ALOGV("try_get_word: reading word at %p", (void*) ptr);
     if (ptr & 3) {
-        ALOGV("try_get_word: invalid pointer 0x%08x", ptr);
+        ALOGV("try_get_word: invalid pointer %p", (void*) ptr);
         *out_value = 0xffffffffL;
         return false;
     }
     if (memory->tid < 0) {
         if (!is_readable_map(memory->map_info_list, ptr)) {
-            ALOGV("try_get_word: pointer 0x%08x not in a readable map", ptr);
+            ALOGV("try_get_word: pointer %p not in a readable map", (void*) ptr);
             *out_value = 0xffffffffL;
             return false;
         }
         *out_value = *(uint32_t*)ptr;
         return true;
     } else {
+#if defined(__APPLE__)
+        ALOGV("no ptrace on Mac OS");
+        return false;
+#else
         // ptrace() returns -1 and sets errno when the operation fails.
         // To disambiguate -1 from a valid result, we clear errno beforehand.
         errno = 0;
@@ -71,6 +75,7 @@
             return false;
         }
         return true;
+#endif
     }
 }
 
diff --git a/libcorkscrew/symbol_table.c b/libcorkscrew/symbol_table.c
index 29e4a79..982ccc8 100644
--- a/libcorkscrew/symbol_table.c
+++ b/libcorkscrew/symbol_table.c
@@ -21,13 +21,17 @@
 
 #include <stdbool.h>
 #include <stdlib.h>
-#include <elf.h>
 #include <fcntl.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/mman.h>
 #include <cutils/log.h>
 
+#if defined(__APPLE__)
+#else
+
+#include <elf.h>
+
 static bool is_elf(Elf32_Ehdr* e) {
     return (e->e_ident[EI_MAG0] == ELFMAG0 &&
             e->e_ident[EI_MAG1] == ELFMAG1 &&
@@ -35,6 +39,8 @@
             e->e_ident[EI_MAG3] == ELFMAG3);
 }
 
+#endif
+
 // Compare function for qsort
 static int qcompar(const void *a, const void *b) {
     const symbol_t* asym = (const symbol_t*)a;
@@ -55,6 +61,7 @@
 
 symbol_table_t* load_symbol_table(const char *filename) {
     symbol_table_t* table = NULL;
+#if !defined(__APPLE__)
     ALOGV("Loading symbol table from '%s'.", filename);
 
     int fd = open(filename, O_RDONLY);
@@ -197,6 +204,7 @@
 
 out_close:
     close(fd);
+#endif
 
 out:
     return table;
diff --git a/libcorkscrew/test.c b/libcorkscrew/test.cpp
similarity index 77%
rename from libcorkscrew/test.c
rename to libcorkscrew/test.cpp
index af34c03..22dfa7d 100644
--- a/libcorkscrew/test.c
+++ b/libcorkscrew/test.cpp
@@ -3,11 +3,14 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-void do_backtrace() {
+int do_backtrace(float /* just to test demangling */) {
   const size_t MAX_DEPTH = 32;
   backtrace_frame_t* frames = (backtrace_frame_t*) malloc(sizeof(backtrace_frame_t) * MAX_DEPTH);
   ssize_t frame_count = unwind_backtrace(frames, 0, MAX_DEPTH);
   fprintf(stderr, "frame_count=%d\n", (int) frame_count);
+  if (frame_count <= 0) {
+    return frame_count;
+  }
 
   backtrace_symbol_t* backtrace_symbols = (backtrace_symbol_t*) malloc(sizeof(backtrace_symbol_t) * frame_count);
   get_backtrace_symbols(frames, frame_count, backtrace_symbols);
@@ -31,7 +34,7 @@
         symbol = find_symbol(symbols, frames[i].absolute_pc);
       }
       if (symbol != NULL) {
-        uintptr_t offset = frames[i].absolute_pc - symbol->start;
+        int offset = frames[i].absolute_pc - symbol->start;
         fprintf(stderr, "  %s (%s%+d)\n", line, symbol->name, offset);
       } else {
         fprintf(stderr, "  %s (\?\?\?)\n", line);
@@ -43,22 +46,31 @@
   free_backtrace_symbols(backtrace_symbols, frame_count);
   free(backtrace_symbols);
   free(frames);
+  return frame_count;
 }
 
-__attribute__ ((noinline)) void g() {
-  fprintf(stderr, "g()\n");
-  do_backtrace();
-}
+struct C {
+  int g(int i);
+};
 
-__attribute__ ((noinline)) int f(int i) {
-  fprintf(stderr, "f(%i)\n", i);
+__attribute__ ((noinline)) int C::g(int i) {
   if (i == 0) {
-    g();
-    return 0;
+    return do_backtrace(0.1);
   }
-  return f(i - 1);
+  return g(i - 1);
+}
+
+extern "C" __attribute__ ((noinline)) int f() {
+  C c;
+  return c.g(5);
 }
 
 int main() {
-  return f(5);
+  flush_my_map_info_list();
+  f();
+
+  flush_my_map_info_list();
+  f();
+
+  return 0;
 }
diff --git a/libsparse/output_file.c b/libsparse/output_file.c
index b5ae419..5014e4a 100644
--- a/libsparse/output_file.c
+++ b/libsparse/output_file.c
@@ -675,6 +675,9 @@
 	} else {
 		out = output_file_new_normal();
 	}
+	if (!out) {
+		return NULL;
+	}
 
 	out->ops->open(out, fd);
 
diff --git a/rootdir/etc/init.goldfish.rc b/rootdir/etc/init.goldfish.rc
index a0c1c4f..1373be8 100644
--- a/rootdir/etc/init.goldfish.rc
+++ b/rootdir/etc/init.goldfish.rc
@@ -3,6 +3,7 @@
     mkdir /mnt/sdcard 0000 system system
     # for backwards compatibility
     symlink /mnt/sdcard /sdcard
+    mount debugfs debugfs /sys/kernel/debug
 
 on boot
     setsebool in_qemu 1
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 0784c63..5206cd1 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -37,7 +37,7 @@
     export ANDROID_STORAGE /storage
     export ASEC_MOUNTPOINT /mnt/asec
     export LOOP_MOUNTPOINT /mnt/obb
-    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
+    export BOOTCLASSPATH /system/framework/core.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
 
 # Backward compatibility
     symlink /system/etc /etc
@@ -243,7 +243,7 @@
     mkdir /data/drm 0770 drm drm
 
     # Separate location for storing security policy files on data
-    mkdir /data/security 0700 system system
+    mkdir /data/security 0711 system system
 
     # If there is no fs-post-data action in the init.<device>.rc file, you
     # must uncomment this line, otherwise encrypted filesystems
@@ -322,12 +322,6 @@
     chown system system /sys/class/leds/red/device/grpfreq
     chown system system /sys/class/leds/red/device/grppwm
     chown system system /sys/class/leds/red/device/blink
-    chown system system /sys/class/leds/red/brightness
-    chown system system /sys/class/leds/green/brightness
-    chown system system /sys/class/leds/blue/brightness
-    chown system system /sys/class/leds/red/device/grpfreq
-    chown system system /sys/class/leds/red/device/grppwm
-    chown system system /sys/class/leds/red/device/blink
     chown system system /sys/class/timed_output/vibrator/enable
     chown system system /sys/module/sco/parameters/disable_esco
     chown system system /sys/kernel/ipv4/tcp_wmem_min
diff --git a/toolbox/dd.c b/toolbox/dd.c
index 350f1d2..a8c12d2 100644
--- a/toolbox/dd.c
+++ b/toolbox/dd.c
@@ -590,8 +590,8 @@
 
 	/* If not a pipe or tape device, try to seek on it. */
 	if (!(in.flags & (ISPIPE|ISTAPE))) {
-		if (lseek(in.fd,
-		    (off_t)in.offset * (off_t)in.dbsz, SEEK_CUR) == -1) {
+		if (lseek64(in.fd,
+		    (off64_t)in.offset * (off64_t)in.dbsz, SEEK_CUR) == -1) {
 			fprintf(stderr, "%s: seek error: %s",
 				in.name, strerror(errno));
 			exit(1);
@@ -661,8 +661,8 @@
 	 * have specified the seek operand.
 	 */
 	if (!(out.flags & ISTAPE)) {
-		if (lseek(out.fd,
-		    (off_t)out.offset * (off_t)out.dbsz, SEEK_SET) == -1) {
+		if (lseek64(out.fd,
+		    (off64_t)out.offset * (off64_t)out.dbsz, SEEK_SET) == -1) {
 			fprintf(stderr, "%s: seek error: %s\n",
 				out.name, strerror(errno));
 			exit(1);
diff --git a/toolbox/dmesg.c b/toolbox/dmesg.c
index e57f607..9c73b00 100644
--- a/toolbox/dmesg.c
+++ b/toolbox/dmesg.c
@@ -5,15 +5,30 @@
 #include <sys/klog.h>
 #include <string.h>
 
-#define KLOG_BUF_SHIFT	17	/* CONFIG_LOG_BUF_SHIFT from our kernel */
-#define KLOG_BUF_LEN	(1 << KLOG_BUF_SHIFT)
+#define FALLBACK_KLOG_BUF_SHIFT	17	/* CONFIG_LOG_BUF_SHIFT from our kernel */
+#define FALLBACK_KLOG_BUF_LEN	(1 << FALLBACK_KLOG_BUF_SHIFT)
 
 int dmesg_main(int argc, char **argv)
 {
-    char buffer[KLOG_BUF_LEN + 1];
-    char *p = buffer;
+    char *buffer;
+    char *p;
     ssize_t ret;
-    int n, op;
+    int n, op, klog_buf_len;
+
+    klog_buf_len = klogctl(KLOG_SIZE_BUFFER, 0, 0);
+
+    if (klog_buf_len <= 0) {
+        klog_buf_len = FALLBACK_KLOG_BUF_LEN;
+    }
+
+    buffer = (char *)malloc(klog_buf_len + 1);
+
+    if (!buffer) {
+        perror("malloc");
+        return EXIT_FAILURE;
+    }
+
+    p = buffer;
 
     if((argc == 2) && (!strcmp(argv[1],"-c"))) {
         op = KLOG_READ_CLEAR;
@@ -21,7 +36,7 @@
         op = KLOG_READ_ALL;
     }
 
-    n = klogctl(op, buffer, KLOG_BUF_LEN);
+    n = klogctl(op, buffer, klog_buf_len);
     if (n < 0) {
         perror("klogctl");
         return EXIT_FAILURE;
diff --git a/toolbox/ls.c b/toolbox/ls.c
index e530521..5324511 100644
--- a/toolbox/ls.c
+++ b/toolbox/ls.c
@@ -28,6 +28,7 @@
 #define LIST_LONG_NUMERIC   (1 << 5)
 #define LIST_CLASSIFY       (1 << 6)
 #define LIST_MACLABEL       (1 << 7)
+#define LIST_INODE          (1 << 8)
 
 // fwd
 static int listpath(const char *name, int flags);
@@ -127,22 +128,20 @@
     return 0;
 }
 
-static int listfile_size(const char *path, const char *filename, int flags)
+static int listfile_size(const char *path, const char *filename, struct stat *s,
+                         int flags)
 {
-    struct stat s;
-
-    if (lstat(path, &s) < 0) {
-        fprintf(stderr, "lstat '%s' failed: %s\n", path, strerror(errno));
+    if(!s || !path) {
         return -1;
     }
 
     /* blocks are 512 bytes, we want output to be KB */
     if ((flags & LIST_SIZE) != 0) {
-        printf("%lld ", s.st_blocks / 2);
+        printf("%lld ", s->st_blocks / 2);
     }
 
     if ((flags & LIST_CLASSIFY) != 0) {
-        char filetype = mode2kind(s.st_mode);
+        char filetype = mode2kind(s->st_mode);
         if (filetype != 'l') {
             printf("%c ", filetype);
         } else {
@@ -161,15 +160,18 @@
     return 0;
 }
 
-static int listfile_long(const char *path, int flags)
+static int listfile_long(const char *path, struct stat *s, int flags)
 {
-    struct stat s;
     char date[32];
     char mode[16];
     char user[16];
     char group[16];
     const char *name;
 
+    if(!s || !path) {
+        return -1;
+    }
+
     /* name is anything after the final '/', or the whole path if none*/
     name = strrchr(path, '/');
     if(name == 0) {
@@ -178,36 +180,32 @@
         name++;
     }
 
-    if(lstat(path, &s) < 0) {
-        return -1;
-    }
-
-    mode2str(s.st_mode, mode);
+    mode2str(s->st_mode, mode);
     if (flags & LIST_LONG_NUMERIC) {
-        sprintf(user, "%ld", s.st_uid);
-        sprintf(group, "%ld", s.st_gid);
+        sprintf(user, "%ld", s->st_uid);
+        sprintf(group, "%ld", s->st_gid);
     } else {
-        user2str(s.st_uid, user);
-        group2str(s.st_gid, group);
+        user2str(s->st_uid, user);
+        group2str(s->st_gid, group);
     }
 
-    strftime(date, 32, "%Y-%m-%d %H:%M", localtime((const time_t*)&s.st_mtime));
+    strftime(date, 32, "%Y-%m-%d %H:%M", localtime((const time_t*)&s->st_mtime));
     date[31] = 0;
 
 // 12345678901234567890123456789012345678901234567890123456789012345678901234567890
 // MMMMMMMM UUUUUUUU GGGGGGGGG XXXXXXXX YYYY-MM-DD HH:MM NAME (->LINK)
 
-    switch(s.st_mode & S_IFMT) {
+    switch(s->st_mode & S_IFMT) {
     case S_IFBLK:
     case S_IFCHR:
         printf("%s %-8s %-8s %3d, %3d %s %s\n",
                mode, user, group,
-               (int) MAJOR(s.st_rdev), (int) MINOR(s.st_rdev),
+               (int) MAJOR(s->st_rdev), (int) MINOR(s->st_rdev),
                date, name);
         break;
     case S_IFREG:
         printf("%s %-8s %-8s %8lld %s %s\n",
-               mode, user, group, s.st_size, date, name);
+               mode, user, group, s->st_size, date, name);
         break;
     case S_IFLNK: {
         char linkto[256];
@@ -237,15 +235,18 @@
     return 0;
 }
 
-static int listfile_maclabel(const char *path, int flags)
+static int listfile_maclabel(const char *path, struct stat *s, int flags)
 {
-    struct stat s;
     char mode[16];
     char user[16];
     char group[16];
     char *maclabel = NULL;
     const char *name;
 
+    if(!s || !path) {
+        return -1;
+    }
+
     /* name is anything after the final '/', or the whole path if none*/
     name = strrchr(path, '/');
     if(name == 0) {
@@ -254,20 +255,16 @@
         name++;
     }
 
-    if(lstat(path, &s) < 0) {
-        return -1;
-    }
-
     lgetfilecon(path, &maclabel);
     if (!maclabel) {
         return -1;
     }
 
-    mode2str(s.st_mode, mode);
-    user2str(s.st_uid, user);
-    group2str(s.st_gid, group);
+    mode2str(s->st_mode, mode);
+    user2str(s->st_uid, user);
+    group2str(s->st_gid, group);
 
-    switch(s.st_mode & S_IFMT) {
+    switch(s->st_mode & S_IFMT) {
     case S_IFLNK: {
         char linkto[256];
         ssize_t len;
@@ -301,7 +298,9 @@
 
 static int listfile(const char *dirname, const char *filename, int flags)
 {
-    if ((flags & (LIST_LONG | LIST_SIZE | LIST_CLASSIFY | LIST_MACLABEL)) == 0) {
+    struct stat s;
+
+    if ((flags & (LIST_LONG | LIST_SIZE | LIST_CLASSIFY | LIST_MACLABEL | LIST_INODE)) == 0) {
         printf("%s\n", filename);
         return 0;
     }
@@ -316,12 +315,20 @@
         pathname = filename;
     }
 
+    if(lstat(pathname, &s) < 0) {
+        return -1;
+    }
+
+    if(flags & LIST_INODE) {
+        printf("%8llu ", s.st_ino);
+    }
+
     if ((flags & LIST_MACLABEL) != 0) {
-        return listfile_maclabel(pathname, flags);
+        return listfile_maclabel(pathname, &s, flags);
     } else if ((flags & LIST_LONG) != 0) {
-        return listfile_long(pathname, flags);
+        return listfile_long(pathname, &s, flags);
     } else /*((flags & LIST_SIZE) != 0)*/ {
-        return listfile_size(pathname, filename, flags);
+        return listfile_size(pathname, filename, &s, flags);
     }
 }
 
@@ -456,6 +463,7 @@
                     case 'Z': flags |= LIST_MACLABEL; break;
                     case 'a': flags |= LIST_ALL; break;
                     case 'F': flags |= LIST_CLASSIFY; break;
+                    case 'i': flags |= LIST_INODE; break;
                     default:
                         fprintf(stderr, "%s: Unknown option '-%c'. Aborting.\n", "ls", arg[0]);
                         exit(1);
diff --git a/toolbox/mount.c b/toolbox/mount.c
index b7adce2..bcda2a2 100644
--- a/toolbox/mount.c
+++ b/toolbox/mount.c
@@ -19,7 +19,7 @@
 #define LOOPDEV_MAXLEN 64
 
 struct mount_opts {
-	const char str[8];
+	const char str[16];
 	unsigned long rwmask;
 	unsigned long rwset;
 	unsigned long rwnoset;
@@ -65,10 +65,11 @@
 static void add_extra_option(struct extra_opts *extra, char *s)
 {
 	int len = strlen(s);
-	int newlen = extra->used_size + len;
+	int newlen;
 
 	if (extra->str)
 	       len++;			/* +1 for ',' */
+	newlen = extra->used_size + len;
 
 	if (newlen >= extra->alloc_size) {
 		char *new;
@@ -79,7 +80,7 @@
 
 		extra->str = new;
 		extra->end = extra->str + extra->used_size;
-		extra->alloc_size = newlen;
+		extra->alloc_size = newlen + 1;
 	}
 
 	if (extra->used_size) {