diff --git a/FsCrypt.cpp b/FsCrypt.cpp
index 4f42dd8..563dd4f 100644
--- a/FsCrypt.cpp
+++ b/FsCrypt.cpp
@@ -810,15 +810,14 @@
         // kEmptyAuthentication are encrypted by the user's synthetic password.
         LOG(DEBUG) << "CE key already exists on-disk; re-protecting it with the given secret";
         if (!read_and_fixate_user_ce_key(user_id, kEmptyAuthentication, &ce_key)) {
-            LOG(ERROR) << "Failed to retrieve CE key for user " << user_id << " using empty auth";
             // Before failing, also check whether the key is already protected
-            // with the given secret.  This isn't expected, but in theory it
-            // could happen if an upgrade is requested for a user more than once
-            // due to a power-off or other interruption.
+            // with the given secret.
             if (read_and_fixate_user_ce_key(user_id, auth, &ce_key)) {
-                LOG(WARNING) << "CE key is already protected by given secret";
+                LOG(INFO) << "CE key is already protected by given secret.  Nothing to do.";
+                LOG(INFO) << "Errors above are for the attempt with empty auth and can be ignored.";
                 return true;
             }
+            LOG(ERROR) << "Failed to retrieve CE key for user " << user_id;
             // The key isn't protected by either kEmptyAuthentication or by
             // |auth|.  This should never happen, and there's nothing we can do
             // besides return an error.
diff --git a/MetadataCrypt.cpp b/MetadataCrypt.cpp
index 8d83541..2fa0cff 100644
--- a/MetadataCrypt.cpp
+++ b/MetadataCrypt.cpp
@@ -291,7 +291,7 @@
                                       bool needs_encrypt, bool should_format,
                                       const std::string& fs_type, bool is_zoned,
                                       const std::vector<std::string>& user_devices,
-                                      int64_t length) {
+                                      const std::vector<bool>& device_aliased, int64_t length) {
     LOG(DEBUG) << "fscrypt_mount_metadata_encrypted: " << mount_point
                << " encrypt: " << needs_encrypt << " format: " << should_format << " with "
                << fs_type << " block device: " << blk_device << " with zoned " << is_zoned
@@ -385,7 +385,8 @@
             if (fs_type == "ext4") {
                 error = ext4::Format(crypto_blkdev, 0, mount_point);
             } else if (fs_type == "f2fs") {
-                error = f2fs::Format(crypto_blkdev, is_zoned, crypto_user_blkdev, length);
+                error = f2fs::Format(crypto_blkdev, is_zoned, crypto_user_blkdev, device_aliased,
+                                     length);
             } else {
                 LOG(ERROR) << "Unknown filesystem type: " << fs_type;
                 return false;
diff --git a/MetadataCrypt.h b/MetadataCrypt.h
index a091443..6c46237 100644
--- a/MetadataCrypt.h
+++ b/MetadataCrypt.h
@@ -29,7 +29,8 @@
 bool fscrypt_mount_metadata_encrypted(const std::string& block_device,
                                       const std::string& mount_point, bool needs_encrypt,
                                       bool should_format, const std::string& fs_type, bool is_zoned,
-                                      const std::vector<std::string>& user_devices, int64_t length);
+                                      const std::vector<std::string>& user_devices,
+                                      const std::vector<bool>& device_aliased, int64_t length);
 
 bool defaultkey_volume_keygen(KeyGeneration* gen);
 
diff --git a/VoldNativeService.cpp b/VoldNativeService.cpp
index 98dec66..3784487 100644
--- a/VoldNativeService.cpp
+++ b/VoldNativeService.cpp
@@ -594,19 +594,21 @@
     ACQUIRE_LOCK;
 
     return translateBool(fscrypt_mount_metadata_encrypted(blkDevice, mountPoint, false, false,
-                                                          "null", isZoned, userDevices, 0));
+                                                          "null", isZoned, userDevices, {}, 0));
 }
 
 binder::Status VoldNativeService::encryptFstab(const std::string& blkDevice,
                                                const std::string& mountPoint, bool shouldFormat,
                                                const std::string& fsType, bool isZoned,
                                                const std::vector<std::string>& userDevices,
+                                               const std::vector<bool>& deviceAliased,
                                                int64_t length) {
     ENFORCE_SYSTEM_OR_ROOT;
     ACQUIRE_LOCK;
 
     return translateBool(fscrypt_mount_metadata_encrypted(blkDevice, mountPoint, true, shouldFormat,
-                                                          fsType, isZoned, userDevices, length));
+                                                          fsType, isZoned, userDevices,
+                                                          deviceAliased, length));
 }
 
 binder::Status VoldNativeService::setStorageBindingSeed(const std::vector<uint8_t>& seed) {
diff --git a/VoldNativeService.h b/VoldNativeService.h
index bd37ac7..a5253c0 100644
--- a/VoldNativeService.h
+++ b/VoldNativeService.h
@@ -110,7 +110,8 @@
 
     binder::Status encryptFstab(const std::string& blkDevice, const std::string& mountPoint,
                                 bool shouldFormat, const std::string& fsType, bool isZoned,
-                                const std::vector<std::string>& userDevices, int64_t length);
+                                const std::vector<std::string>& userDevices,
+                                const std::vector<bool>& deviceAliased, int64_t length);
 
     binder::Status setStorageBindingSeed(const std::vector<uint8_t>& seed);
 
diff --git a/binder/android/os/IVold.aidl b/binder/android/os/IVold.aidl
index a8cce94..810fdad 100644
--- a/binder/android/os/IVold.aidl
+++ b/binder/android/os/IVold.aidl
@@ -84,7 +84,7 @@
 
     void initUser0();
     void mountFstab(@utf8InCpp String blkDevice, @utf8InCpp String mountPoint, boolean isZoned, in @utf8InCpp String[] userDevices);
-    void encryptFstab(@utf8InCpp String blkDevice, @utf8InCpp String mountPoint, boolean shouldFormat, @utf8InCpp String fsType, boolean isZoned, in @utf8InCpp String[] userDevices, long length);
+    void encryptFstab(@utf8InCpp String blkDevice, @utf8InCpp String mountPoint, boolean shouldFormat, @utf8InCpp String fsType, boolean isZoned, in @utf8InCpp String[] userDevices, in boolean[] deviceAliased, long length);
 
     void setStorageBindingSeed(in byte[] seed);
 
diff --git a/fs/F2fs.cpp b/fs/F2fs.cpp
index 3cdf574..c52e80e 100644
--- a/fs/F2fs.cpp
+++ b/fs/F2fs.cpp
@@ -27,6 +27,7 @@
 #include <vector>
 
 #include <sys/mount.h>
+#include <filesystem>
 
 using android::base::StringPrintf;
 
@@ -72,8 +73,9 @@
 }
 
 status_t Format(const std::string& source, bool is_zoned,
-                const std::vector<std::string>& user_devices, int64_t length) {
-    std::vector<char const*> cmd;
+                const std::vector<std::string>& user_devices,
+                const std::vector<bool>& device_aliased, int64_t length) {
+    std::vector<std::string> cmd;
     /* '-g android' parameter passed here which defaults the sector size to 4096 */
     static constexpr int kSectorSize = 4096;
     cmd.emplace_back(kMkfsPath);
@@ -102,21 +104,31 @@
     if (is_zoned) {
         cmd.emplace_back("-m");
     }
-    for (auto& device : user_devices) {
+    for (size_t i = 0; i < user_devices.size(); i++) {
+        std::string device_name = user_devices[i];
+
         cmd.emplace_back("-c");
-        cmd.emplace_back(device.c_str());
+        if (device_aliased[i]) {
+            std::filesystem::path path = device_name;
+            device_name += "@" + path.filename().string();
+        }
+        cmd.emplace_back(device_name);
     }
-    std::string block_size = std::to_string(getpagesize());
     cmd.emplace_back("-b");
-    cmd.emplace_back(block_size.c_str());
+    cmd.emplace_back(std::to_string(getpagesize()));
 
     cmd.emplace_back(source.c_str());
 
     if (length) {
-        cmd.emplace_back(std::to_string(length / kSectorSize).c_str());
+        cmd.emplace_back(std::to_string(length / kSectorSize));
     }
-    return logwrap_fork_execvp(cmd.size(), cmd.data(), nullptr, false, LOG_KLOG,
-                             false, nullptr);
+
+    std::vector<char const*> cmd_cstrs;
+    for (auto& arg : cmd) {
+        cmd_cstrs.emplace_back(arg.c_str());
+    }
+    return logwrap_fork_execvp(cmd_cstrs.size(), cmd_cstrs.data(), nullptr, false, LOG_KLOG, false,
+                               nullptr);
 }
 
 }  // namespace f2fs
diff --git a/fs/F2fs.h b/fs/F2fs.h
index 7391310..4193c87 100644
--- a/fs/F2fs.h
+++ b/fs/F2fs.h
@@ -31,7 +31,8 @@
 status_t Check(const std::string& source);
 status_t Mount(const std::string& source, const std::string& target);
 status_t Format(const std::string& source, const bool is_zoned,
-                const std::vector<std::string>& user_devices, int64_t length = 0);
+                const std::vector<std::string>& user_devices,
+                const std::vector<bool>& device_aliased, int64_t length = 0);
 
 }  // namespace f2fs
 }  // namespace vold
diff --git a/model/PrivateVolume.cpp b/model/PrivateVolume.cpp
index bb52647..b2128a8 100644
--- a/model/PrivateVolume.cpp
+++ b/model/PrivateVolume.cpp
@@ -234,7 +234,7 @@
             return -EIO;
         }
     } else if (resolvedFsType == "f2fs") {
-        if (f2fs::Format(mDmDevPath, false, {})) {
+        if (f2fs::Format(mDmDevPath, false, {}, {})) {
             PLOG(ERROR) << getId() << " failed to format";
             return -EIO;
         }
diff --git a/vdc.cpp b/vdc.cpp
index 9764b1a..400bc5d 100644
--- a/vdc.cpp
+++ b/vdc.cpp
@@ -114,10 +114,22 @@
     if (args[8] != "") {
         userDevices = android::base::Split(args[8], " ");
     }
+    std::vector<std::string> deviceAliasedStr = {};
+    std::vector<bool> deviceAliased = {};
+    if (args[9] != "") {
+        deviceAliasedStr = android::base::Split(args[9], " ");
+        for (auto aliased : deviceAliasedStr) {
+            if (aliased == "0") {
+                deviceAliased.push_back(false);
+            } else {
+                deviceAliased.push_back(true);
+            }
+        }
+    }
     checkStatus(args, vold->encryptFstab(args[2], args[3],
                                          shouldFormat == android::base::ParseBoolResult::kTrue,
                                          args[5], isZoned == android::base::ParseBoolResult::kTrue,
-                                         userDevices, length));
+                                         userDevices, deviceAliased, length));
 }
 
 int main(int argc, char** argv) {
@@ -164,7 +176,7 @@
         bindkeys(args, vold);
     } else if (args[0] == "cryptfs" && args[1] == "mountFstab" && args.size() == 6) {
         mountFstab(args, vold);
-    } else if (args[0] == "cryptfs" && args[1] == "encryptFstab" && args.size() == 9) {
+    } else if (args[0] == "cryptfs" && args[1] == "encryptFstab" && args.size() == 10) {
         encryptFstab(args, vold);
     } else if (args[0] == "checkpoint" && args[1] == "supportsCheckpoint" && args.size() == 2) {
         bool supported = false;