diff --git a/CommandListener.cpp b/CommandListener.cpp
index dff4625..461103e 100644
--- a/CommandListener.cpp
+++ b/CommandListener.cpp
@@ -447,7 +447,7 @@
             dumpArgs(argc, argv, 3);
             if (argc != 5) {
                 cli->sendMsg(ResponseCode::CommandSyntaxError,
-                        "Usage: obb mount <filename> <key> <ownerUid>", false);
+                        "Usage: obb mount <filename> <key> <ownerGid>", false);
                 return 0;
             }
             rc = vm->mountObb(argv[2], argv[3], atoi(argv[4]));
diff --git a/Volume.cpp b/Volume.cpp
index a71000e..0be2e81 100644
--- a/Volume.cpp
+++ b/Volume.cpp
@@ -608,41 +608,29 @@
     usleep(1000 * 1000); // Give the framework some time to react
 
     /*
-     * First move the mountpoint back to our internal staging point
-     * so nobody else can muck with it while we work.
-     */
-    if (doMoveMount(getMountpoint(), SEC_STGDIR, force)) {
-        SLOGE("Failed to move mount %s => %s (%s)", getMountpoint(), SEC_STGDIR, strerror(errno));
-        setState(Volume::State_Mounted);
-        return -1;
-    }
-
-    protectFromAutorunStupidity();
-
-    /*
-     * Unmount the tmpfs which was obscuring the asec image directory
-     * from non root users
-     */
-
-    if (doUnmount(Volume::SEC_STG_SECIMGDIR, force)) {
-        SLOGE("Failed to unmount tmpfs on %s (%s)", SEC_STG_SECIMGDIR, strerror(errno));
-        goto fail_republish;
-    }
-
-    /*
      * Remove the bindmount we were using to keep a reference to
      * the previously obscured directory.
      */
-
     if (doUnmount(Volume::SEC_ASECDIR_EXT, force)) {
         SLOGE("Failed to remove bindmount on %s (%s)", SEC_ASECDIR_EXT, strerror(errno));
         goto fail_remount_tmpfs;
     }
 
     /*
+     * Unmount the tmpfs which was obscuring the asec image directory
+     * from non root users
+     */
+    char secure_dir[PATH_MAX];
+    snprintf(secure_dir, PATH_MAX, "%s/.android_secure", getMountpoint());
+    if (doUnmount(secure_dir, force)) {
+        SLOGE("Failed to unmount tmpfs on %s (%s)", secure_dir, strerror(errno));
+        goto fail_republish;
+    }
+
+    /*
      * Finally, unmount the actual block device from the staging dir
      */
-    if (doUnmount(Volume::SEC_STGDIR, force)) {
+    if (doUnmount(getMountpoint(), force)) {
         SLOGE("Failed to unmount %s (%s)", SEC_STGDIR, strerror(errno));
         goto fail_recreate_bindmount;
     }
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index ac1e1b9..5a4ccd5 100644
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -1099,7 +1099,7 @@
 /**
  * Mounts an image file <code>img</code>.
  */
-int VolumeManager::mountObb(const char *img, const char *key, int ownerUid) {
+int VolumeManager::mountObb(const char *img, const char *key, int ownerGid) {
     char mountPoint[255];
 
     char idHash[33];
@@ -1183,7 +1183,7 @@
         }
     }
 
-    if (Fat::doMount(dmDevice, mountPoint, true, false, true, ownerUid, 0,
+    if (Fat::doMount(dmDevice, mountPoint, true, false, true, 0, ownerGid,
                      0227, false)) {
         SLOGE("Image mount failed (%s)", strerror(errno));
         if (cleanupDm) {
diff --git a/cryptfs.c b/cryptfs.c
index e1c177d..bcacc39 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -59,6 +59,8 @@
 #define EXT4_FS 1
 #define FAT_FS 2
 
+#define TABLE_LOAD_RETRIES 10
+
 char *me = "cryptfs";
 
 static unsigned char saved_master_key[KEY_LEN_BYTES];
@@ -385,6 +387,7 @@
   struct dm_target_spec *tgt;
   unsigned int minor;
   int fd;
+  int i;
   int retval = -1;
 
   if ((fd = open("/dev/device-mapper", O_RDWR)) < 0 ) {
@@ -427,9 +430,18 @@
   crypt_params = (char *) (((unsigned long)crypt_params + 7) & ~8); /* Align to an 8 byte boundary */
   tgt->next = crypt_params - buffer;
 
-  if (ioctl(fd, DM_TABLE_LOAD, io)) {
+  for (i = 0; i < TABLE_LOAD_RETRIES; i++) {
+    if (! ioctl(fd, DM_TABLE_LOAD, io)) {
+      break;
+    }
+    usleep(500000);
+  }
+
+  if (i == TABLE_LOAD_RETRIES) {
       SLOGE("Cannot load dm-crypt mapping table.\n");
       goto errout;
+  } else if (i) {
+      SLOGI("Took %d tries to load dmcrypt table.\n", i + 1);
   }
 
   /* Resume this device to activate it */
@@ -676,6 +688,13 @@
     property_set("vold.decrypt", "trigger_reset_main");
     SLOGD("Just asked init to shut down class main\n");
 
+    /* Ugh, shutting down the framework is not synchronous, so until it
+     * can be fixed, this horrible hack will wait a moment for it all to
+     * shut down before proceeding.  Without it, some devices cannot
+     * restart the graphics services.
+     */
+    sleep(2);
+
     /* Now that the framework is shutdown, we should be able to umount()
      * the tmpfs filesystem, and mount the real one.
      */
@@ -1179,11 +1198,14 @@
     snprintf(lockid, sizeof(lockid), "enablecrypto%d", (int) getpid());
     acquire_wake_lock(PARTIAL_WAKE_LOCK, lockid);
 
-     /* Get the sdcard mount point */
-     sd_mnt_point = getenv("EXTERNAL_STORAGE");
-     if (! sd_mnt_point) {
-         sd_mnt_point = "/mnt/sdcard";
-     }
+    /* Get the sdcard mount point */
+    sd_mnt_point = getenv("EMULATED_STORAGE_SOURCE");
+    if (!sd_mnt_point) {
+       sd_mnt_point = getenv("EXTERNAL_STORAGE");
+    }
+    if (!sd_mnt_point) {
+        sd_mnt_point = "/mnt/sdcard";
+    }
 
     num_vols=vold_getNumDirectVolumes();
     vol_list = malloc(sizeof(struct volume_info) * num_vols);
@@ -1257,6 +1279,13 @@
             goto error_shutting_down;
         }
 
+        /* Ugh, shutting down the framework is not synchronous, so until it
+         * can be fixed, this horrible hack will wait a moment for it all to
+         * shut down before proceeding.  Without it, some devices cannot
+         * restart the graphics services.
+         */
+        sleep(2);
+
         /* startup service classes main and late_start */
         property_set("vold.decrypt", "trigger_restart_min_framework");
         SLOGD("Just triggered restart_min_framework\n");
@@ -1365,12 +1394,12 @@
     } else {
         char value[PROPERTY_VALUE_MAX];
 
-        property_get("ro.vold.wipe_on_cyrypt_fail", value, "0");
+        property_get("ro.vold.wipe_on_crypt_fail", value, "0");
         if (!strcmp(value, "1")) {
             /* wipe data if encryption failed */
             SLOGE("encryption failed - rebooting into recovery to wipe data\n");
             mkdir("/cache/recovery", 0700);
-            int fd = open("/cache/recovery/command", O_RDWR|O_CREAT|O_TRUNC);
+            int fd = open("/cache/recovery/command", O_RDWR|O_CREAT|O_TRUNC, 0600);
             if (fd >= 0) {
                 write(fd, "--wipe_data", strlen("--wipe_data") + 1);
                 close(fd);