diff --git a/CommandListener.cpp b/CommandListener.cpp
index 8bfd0bc..1672fcc 100644
--- a/CommandListener.cpp
+++ b/CommandListener.cpp
@@ -44,7 +44,6 @@
     registerCmd(new VolumeCmd());
     registerCmd(new AsecCmd());
     registerCmd(new ObbCmd());
-    registerCmd(new ShareCmd());
     registerCmd(new StorageCmd());
     registerCmd(new XwarpCmd());
     registerCmd(new CryptfsCmd());
@@ -200,39 +199,6 @@
     return 0;
 }
 
-CommandListener::ShareCmd::ShareCmd() :
-                 VoldCommand("share") {
-}
-
-int CommandListener::ShareCmd::runCommand(SocketClient *cli,
-                                                      int argc, char **argv) {
-    dumpArgs(argc, argv, -1);
-
-    if (argc < 2) {
-        cli->sendMsg(ResponseCode::CommandSyntaxError, "Missing Argument", false);
-        return 0;
-    }
-
-    VolumeManager *vm = VolumeManager::Instance();
-    int rc = 0;
-
-    if (!strcmp(argv[1], "status")) {
-        bool avail = false;
-
-        if (vm->shareAvailable(argv[2], &avail)) {
-            cli->sendMsg(
-                    ResponseCode::OperationFailed, "Failed to determine share availability", true);
-        } else {
-            cli->sendMsg(ResponseCode::ShareStatusResult,
-                    (avail ? "Share available" : "Share unavailable"), false);
-        }
-    } else {
-        cli->sendMsg(ResponseCode::CommandSyntaxError, "Unknown share cmd", false);
-    }
-
-    return 0;
-}
-
 CommandListener::StorageCmd::StorageCmd() :
                  VoldCommand("storage") {
 }
@@ -386,6 +352,18 @@
             cli->sendMsg(ResponseCode::AsecPathResult, path, false);
             return 0;
         }
+    } else if (!strcmp(argv[1], "fspath")) {
+        dumpArgs(argc, argv, -1);
+        if (argc != 3) {
+            cli->sendMsg(ResponseCode::CommandSyntaxError, "Usage: asec fspath <container-id>", false);
+            return 0;
+        }
+        char path[255];
+
+        if (!(rc = vm->getAsecFilesystemPath(argv[2], path, sizeof(path)))) {
+            cli->sendMsg(ResponseCode::AsecPathResult, path, false);
+            return 0;
+        }
     } else {
         dumpArgs(argc, argv, -1);
         cli->sendMsg(ResponseCode::CommandSyntaxError, "Unknown asec cmd", false);
diff --git a/CommandListener.h b/CommandListener.h
index 7bae363..baf7760 100644
--- a/CommandListener.h
+++ b/CommandListener.h
@@ -42,13 +42,6 @@
         int runCommand(SocketClient *c, int argc, char ** argv);
     };
 
-    class ShareCmd : public VoldCommand {
-    public:
-        ShareCmd();
-        virtual ~ShareCmd() {}
-        int runCommand(SocketClient *c, int argc, char ** argv);
-    };
-
     class AsecCmd : public VoldCommand {
     public:
         AsecCmd();
diff --git a/DirectVolume.cpp b/DirectVolume.cpp
index 54da964..7e8ac68 100644
--- a/DirectVolume.cpp
+++ b/DirectVolume.cpp
@@ -29,6 +29,7 @@
 #include "DirectVolume.h"
 #include "VolumeManager.h"
 #include "ResponseCode.h"
+#include "cryptfs.h"
 
 // #define PARTITION_DEBUG
 
@@ -61,6 +62,10 @@
     return 0;
 }
 
+void DirectVolume::setFlags(int flags) {
+    mFlags = flags;
+}
+
 dev_t DirectVolume::getDiskDevice() {
     return MKDEV(mDiskMajor, mDiskMinor);
 }
@@ -187,8 +192,8 @@
     }
 
     if (part_num > MAX_PARTITIONS || part_num < 1) {
-        SLOGW("Invalid 'PARTN' value");
-        part_num = 1;
+        SLOGE("Invalid 'PARTN' value");
+        return;
     }
 
     if (part_num > mDiskNumParts) {
@@ -354,3 +359,61 @@
     devs[0] = MKDEV(mDiskMajor, mPartMinors[mPartIdx -1]);
     return 1;
 }
+
+/*
+ * Called from base to update device info,
+ * e.g. When setting up an dm-crypt mapping for the sd card.
+ */
+int DirectVolume::updateDeviceInfo(char *new_path, int new_major, int new_minor)
+{
+    PathCollection::iterator it;
+
+    if (mPartIdx == -1) {
+        SLOGE("Can only change device info on a partition\n");
+        return -1;
+    }
+
+    /*
+     * This is to change the sysfs path associated with a partition, in particular,
+     * for an internal SD card partition that is encrypted.  Thus, the list is
+     * expected to be only 1 entry long.  Check that and bail if not.
+     */
+    if (mPaths->size() != 1) {
+        SLOGE("Cannot change path if there are more than one for a volume\n");
+        return -1;
+    }
+
+    it = mPaths->begin();
+    free(*it); /* Free the string storage */
+    mPaths->erase(it); /* Remove it from the list */
+    addPath(new_path); /* Put the new path on the list */
+
+    mDiskMajor = new_major;
+    mDiskMinor = new_minor;
+    /* Ugh, virual block devices don't use minor 0 for whole disk and minor > 0 for
+     * partition number.  They don't have partitions, they are just virtual block
+     * devices, and minor number 0 is the first dm-crypt device.  Luckily the first
+     * dm-crypt device is for the userdata partition, which gets minor number 0, and
+     * it is not managed by vold.  So the next device is minor number one, which we
+     * will call partition one.
+     */
+    mPartIdx = new_minor;
+    mPartMinors[new_minor-1] = new_minor;
+
+    mIsDecrypted = 1;
+
+    return 0;
+}
+
+/*
+ * Called from base to give cryptfs all the info it needs to encrypt eligible volumes
+ */
+int DirectVolume::getVolInfo(struct volume_info *v)
+{
+    strcpy(v->label, mLabel);
+    strcpy(v->mnt_point, mMountpoint);
+    v->flags=mFlags;
+    /* Other fields of struct volume_info are filled in by the caller or cryptfs.c */
+
+    return 0;
+}
diff --git a/DirectVolume.h b/DirectVolume.h
index 4bf14ff..ad1b386 100644
--- a/DirectVolume.h
+++ b/DirectVolume.h
@@ -35,6 +35,8 @@
     int            mPartMinors[MAX_PARTITIONS];
     int            mDiskNumParts;
     unsigned char  mPendingPartMap;
+    int            mIsDecrypted;
+    int            mFlags;
 
 public:
     DirectVolume(VolumeManager *vm, const char *label, const char *mount_point, int partIdx);
@@ -47,9 +49,14 @@
     dev_t getShareDevice();
     void handleVolumeShared();
     void handleVolumeUnshared();
+    int getVolInfo(struct volume_info *v);
+    void setFlags(int flags);
 
 protected:
     int getDeviceNodes(dev_t *devs, int max);
+    int updateDeviceInfo(char *new_path, int new_major, int new_minor);
+    int isDecrypted() { return mIsDecrypted; }
+    int getFlags() { return mFlags; }
 
 private:
     void handleDiskAdded(const char *devpath, NetlinkEvent *evt);
diff --git a/NetlinkHandler.cpp b/NetlinkHandler.cpp
index 55b6dba..ecda2a0 100644
--- a/NetlinkHandler.cpp
+++ b/NetlinkHandler.cpp
@@ -53,11 +53,5 @@
 
     if (!strcmp(subsys, "block")) {
         vm->handleBlockEvent(evt);
-    } else if (!strcmp(subsys, "switch")) {
-        vm->handleSwitchEvent(evt);
-    } else if (!strcmp(subsys, "usb_composite")) {
-        vm->handleUsbCompositeEvent(evt);
-    } else if (!strcmp(subsys, "battery")) {
-    } else if (!strcmp(subsys, "power_supply")) {
     }
 }
diff --git a/Volume.cpp b/Volume.cpp
index ce41455..685cb35 100644
--- a/Volume.cpp
+++ b/Volume.cpp
@@ -25,6 +25,7 @@
 #include <sys/types.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
+#include <sys/param.h>
 
 #include <linux/kdev_t.h>
 #include <linux/fs.h>
@@ -44,6 +45,7 @@
 #include "ResponseCode.h"
 #include "Fat.h"
 #include "Process.h"
+#include "cryptfs.h"
 
 extern "C" void dos_partition_dec(void const *pp, struct dos_partition *d);
 extern "C" void dos_partition_enc(void *pp, struct dos_partition *d);
@@ -284,8 +286,19 @@
     char errmsg[255];
     const char* externalStorage = getenv("EXTERNAL_STORAGE");
     bool primaryStorage = externalStorage && !strcmp(getMountpoint(), externalStorage);
+    char decrypt_state[PROPERTY_VALUE_MAX];
+    char crypto_state[PROPERTY_VALUE_MAX];
+    char encrypt_progress[PROPERTY_VALUE_MAX];
+    int flags;
 
-    if (getState() == Volume::State_NoMedia) {
+    property_get("vold.decrypt", decrypt_state, "");
+    property_get("vold.encrypt_progress", encrypt_progress, "");
+
+    /* Don't try to mount the volumes if we have not yet entered the disk password
+     * or are in the process of encrypting.
+     */
+    if ((getState() == Volume::State_NoMedia) ||
+        ((!strcmp(decrypt_state, "1") || encrypt_progress[0]) && primaryStorage)) {
         snprintf(errmsg, sizeof(errmsg),
                  "Volume %s %s mount failed - no media",
                  getLabel(), getMountpoint());
@@ -312,6 +325,56 @@
         return -1;
     }
 
+    /* If we're running encrypted, and the volume is marked as encryptable and nonremovable,
+     * and vold is asking to mount the primaryStorage device, then we need to decrypt
+     * that partition, and update the volume object to point to it's new decrypted
+     * block device
+     */
+    property_get("ro.crypto.state", crypto_state, "");
+    flags = getFlags();
+    if (primaryStorage &&
+        ((flags & (VOL_NONREMOVABLE | VOL_ENCRYPTABLE))==(VOL_NONREMOVABLE | VOL_ENCRYPTABLE)) &&
+        !strcmp(crypto_state, "encrypted") && !isDecrypted()) {
+       char new_sys_path[MAXPATHLEN];
+       char nodepath[256];
+       int new_major, new_minor;
+
+       if (n != 1) {
+           /* We only expect one device node returned when mounting encryptable volumes */
+           SLOGE("Too many device nodes returned when mounting %d\n", getMountpoint());
+           return -1;
+       }
+
+       if (cryptfs_setup_volume(getLabel(), MAJOR(deviceNodes[0]), MINOR(deviceNodes[0]),
+                                new_sys_path, sizeof(new_sys_path),
+                                &new_major, &new_minor)) {
+           SLOGE("Cannot setup encryption mapping for %d\n", getMountpoint());
+           return -1;
+       }
+       /* We now have the new sysfs path for the decrypted block device, and the
+        * majore and minor numbers for it.  So, create the device, update the
+        * path to the new sysfs path, and continue.
+        */
+        snprintf(nodepath,
+                 sizeof(nodepath), "/dev/block/vold/%d:%d",
+                 new_major, new_minor);
+        if (createDeviceNode(nodepath, new_major, new_minor)) {
+            SLOGE("Error making device node '%s' (%s)", nodepath,
+                                                       strerror(errno));
+        }
+
+        // Todo: Either create sys filename from nodepath, or pass in bogus path so
+        //       vold ignores state changes on this internal device.
+        updateDeviceInfo(nodepath, new_major, new_minor);
+
+        /* Get the device nodes again, because they just changed */
+        n = getDeviceNodes((dev_t *) &deviceNodes, 4);
+        if (!n) {
+            SLOGE("Failed to get device nodes (%s)\n", strerror(errno));
+            return -1;
+        }
+    }
+
     for (i = 0; i < n; i++) {
         char devicePath[255];
 
@@ -526,7 +589,7 @@
     if (getState() != Volume::State_Mounted) {
         SLOGE("Volume %s unmount request when not mounted", getLabel());
         errno = EINVAL;
-        return -1;
+        return UNMOUNT_NOT_MOUNTED_ERR;
     }
 
     setState(Volume::State_Unmounting);
diff --git a/Volume.h b/Volume.h
index 64cd7cb..ad3dcd8 100644
--- a/Volume.h
+++ b/Volume.h
@@ -77,11 +77,15 @@
     virtual void handleVolumeUnshared();
 
     void setDebug(bool enable);
+    virtual int getVolInfo(struct volume_info *v) = 0;
 
 protected:
     void setState(int state);
 
     virtual int getDeviceNodes(dev_t *devs, int max) = 0;
+    virtual int updateDeviceInfo(char *new_path, int new_major, int new_minor) = 0;
+    virtual int isDecrypted(void) = 0;
+    virtual int getFlags(void) = 0;
 
     int createDeviceNode(const char *path, int major, int minor);
 
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index 906fb9e..c1406a9 100644
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -41,6 +41,9 @@
 #include "Devmapper.h"
 #include "Process.h"
 #include "Asec.h"
+#include "cryptfs.h"
+
+#define MASS_STORAGE_FILE_PATH  "/sys/class/android_usb/android0/f_mass_storage/lun/file"
 
 VolumeManager *VolumeManager::sInstance = NULL;
 
@@ -55,47 +58,10 @@
     mVolumes = new VolumeCollection();
     mActiveContainers = new AsecIdCollection();
     mBroadcaster = NULL;
-    mUsbMassStorageEnabled = false;
-    mUsbConnected = false;
     mUmsSharingCount = 0;
     mSavedDirtyRatio = -1;
     // set dirty ratio to 0 when UMS is active
     mUmsDirtyRatio = 0;
-
-    readInitialState();
-}
-
-void VolumeManager::readInitialState() {
-    FILE *fp;
-    char state[255];
-
-    /*
-     * Read the initial mass storage enabled state
-     */
-    if ((fp = fopen("/sys/devices/virtual/usb_composite/usb_mass_storage/enable", "r"))) {
-        if (fgets(state, sizeof(state), fp)) {
-            mUsbMassStorageEnabled = !strncmp(state, "1", 1);
-        } else {
-            SLOGE("Failed to read usb_mass_storage enabled state (%s)", strerror(errno));
-        }
-        fclose(fp);
-    } else {
-        SLOGD("USB mass storage support is not enabled in the kernel");
-    }
-
-    /*
-     * Read the initial USB connected state
-     */
-    if ((fp = fopen("/sys/devices/virtual/switch/usb_configuration/state", "r"))) {
-        if (fgets(state, sizeof(state), fp)) {
-            mUsbConnected = !strncmp(state, "1", 1);
-        } else {
-            SLOGE("Failed to read usb_configuration switch (%s)", strerror(errno));
-        }
-        fclose(fp);
-    } else {
-        SLOGD("usb_configuration switch is not enabled in the kernel");
-    }
 }
 
 VolumeManager::~VolumeManager() {
@@ -156,56 +122,6 @@
     return 0;
 }
 
-void VolumeManager::notifyUmsAvailable(bool available) {
-    char msg[255];
-
-    snprintf(msg, sizeof(msg), "Share method ums now %s",
-             (available ? "available" : "unavailable"));
-    SLOGD(msg);
-    getBroadcaster()->sendBroadcast(ResponseCode::ShareAvailabilityChange,
-                                    msg, false);
-}
-
-void VolumeManager::handleSwitchEvent(NetlinkEvent *evt) {
-    const char *devpath = evt->findParam("DEVPATH");
-    const char *name = evt->findParam("SWITCH_NAME");
-    const char *state = evt->findParam("SWITCH_STATE");
-
-    if (!name || !state) {
-        SLOGW("Switch %s event missing name/state info", devpath);
-        return;
-    }
-
-    bool oldAvailable = massStorageAvailable();
-    if (!strcmp(name, "usb_configuration")) {
-        mUsbConnected = !strcmp(state, "1");
-        SLOGD("USB %s", mUsbConnected ? "connected" : "disconnected");
-        bool newAvailable = massStorageAvailable();
-        if (newAvailable != oldAvailable) {
-            notifyUmsAvailable(newAvailable);
-        }
-    }
-}
-void VolumeManager::handleUsbCompositeEvent(NetlinkEvent *evt) {
-    const char *function = evt->findParam("FUNCTION");
-    const char *enabled = evt->findParam("ENABLED");
-
-    if (!function || !enabled) {
-        SLOGW("usb_composite event missing function/enabled info");
-        return;
-    }
-
-    if (!strcmp(function, "usb_mass_storage")) {
-        bool oldAvailable = massStorageAvailable();
-        mUsbMassStorageEnabled = !strcmp(enabled, "1");
-        SLOGD("usb_mass_storage function %s", mUsbMassStorageEnabled ? "enabled" : "disabled");
-        bool newAvailable = massStorageAvailable();
-        if (newAvailable != oldAvailable) {
-            notifyUmsAvailable(newAvailable);
-        }
-    }
-}
-
 void VolumeManager::handleBlockEvent(NetlinkEvent *evt) {
     const char *devpath = evt->findParam("DEVPATH");
 
@@ -287,6 +203,20 @@
     return 0;
 }
 
+int VolumeManager::getAsecFilesystemPath(const char *id, char *buffer, int maxlen) {
+    char asecFileName[255];
+    snprintf(asecFileName, sizeof(asecFileName), "%s/%s.asec", Volume::SEC_ASECDIR, id);
+
+    memset(buffer, 0, maxlen);
+    if (access(asecFileName, F_OK)) {
+        errno = ENOENT;
+        return -1;
+    }
+
+    snprintf(buffer, maxlen, "%s", asecFileName);
+    return 0;
+}
+
 int VolumeManager::createAsec(const char *id, unsigned int numSectors,
                               const char *fstype, const char *key, int ownerUid) {
     struct asec_superblock sb;
@@ -960,17 +890,6 @@
     return 0;
 }
 
-int VolumeManager::shareAvailable(const char *method, bool *avail) {
-
-    if (strcmp(method, "ums")) {
-        errno = ENOSYS;
-        return -1;
-    }
-
-    *avail = massStorageAvailable();
-    return 0;
-}
-
 int VolumeManager::shareEnabled(const char *label, const char *method, bool *enabled) {
     Volume *v = lookupVolume(label);
 
@@ -992,24 +911,6 @@
     return 0;
 }
 
-int VolumeManager::simulate(const char *cmd, const char *arg) {
-
-    if (!strcmp(cmd, "ums")) {
-        if (!strcmp(arg, "connect")) {
-            notifyUmsAvailable(true);
-        } else if (!strcmp(arg, "disconnect")) {
-            notifyUmsAvailable(false);
-        } else {
-            errno = EINVAL;
-            return -1;
-        }
-    } else {
-        errno = EINVAL;
-        return -1;
-    }
-    return 0;
-}
-
 int VolumeManager::shareVolume(const char *label, const char *method) {
     Volume *v = lookupVolume(label);
 
@@ -1052,8 +953,7 @@
              sizeof(nodepath), "/dev/block/vold/%d:%d",
              MAJOR(d), MINOR(d));
 
-    if ((fd = open("/sys/devices/platform/usb_mass_storage/lun0/file",
-                   O_WRONLY)) < 0) {
+    if ((fd = open(MASS_STORAGE_FILE_PATH, O_WRONLY)) < 0) {
         SLOGE("Unable to open ums lunfile (%s)", strerror(errno));
         return -1;
     }
@@ -1103,7 +1003,7 @@
     }
 
     int fd;
-    if ((fd = open("/sys/devices/platform/usb_mass_storage/lun0/file", O_WRONLY)) < 0) {
+    if ((fd = open(MASS_STORAGE_FILE_PATH, O_WRONLY)) < 0) {
         SLOGE("Unable to open ums lunfile (%s)", strerror(errno));
         return -1;
     }
@@ -1130,6 +1030,50 @@
     return 0;
 }
 
+extern "C" int vold_unmountVol(const char *label) {
+    VolumeManager *vm = VolumeManager::Instance();
+    return vm->unmountVolume(label, true);
+}
+
+extern "C" int vold_getNumDirectVolumes(void) {
+    VolumeManager *vm = VolumeManager::Instance();
+    return vm->getNumDirectVolumes();
+}
+
+int VolumeManager::getNumDirectVolumes(void) {
+    VolumeCollection::iterator i;
+    int n=0;
+
+    for (i = mVolumes->begin(); i != mVolumes->end(); ++i) {
+        if ((*i)->getShareDevice() != (dev_t)0) {
+            n++;
+        }
+    }
+    return n;
+}
+
+extern "C" int vold_getDirectVolumeList(struct volume_info *vol_list) {
+    VolumeManager *vm = VolumeManager::Instance();
+    return vm->getDirectVolumeList(vol_list);
+}
+
+int VolumeManager::getDirectVolumeList(struct volume_info *vol_list) {
+    VolumeCollection::iterator i;
+    int n=0;
+    dev_t d;
+
+    for (i = mVolumes->begin(); i != mVolumes->end(); ++i) {
+        if ((d=(*i)->getShareDevice()) != (dev_t)0) {
+            (*i)->getVolInfo(&vol_list[n]);
+            snprintf(vol_list[n].blk_dev, sizeof(vol_list[n].blk_dev),
+                     "/dev/block/vold/%d:%d",MAJOR(d), MINOR(d));
+            n++;
+        }
+    }
+
+    return 0;
+}
+
 int VolumeManager::unmountVolume(const char *label, bool force) {
     Volume *v = lookupVolume(label);
 
@@ -1147,7 +1091,7 @@
         SLOGW("Attempt to unmount volume which isn't mounted (%d)\n",
              v->getState());
         errno = EBUSY;
-        return -1;
+        return UNMOUNT_NOT_MOUNTED_ERR;
     }
 
     cleanupAsec(v, force);
diff --git a/VolumeManager.h b/VolumeManager.h
index 11b5ed3..f526990 100644
--- a/VolumeManager.h
+++ b/VolumeManager.h
@@ -19,6 +19,7 @@
 
 #include <pthread.h>
 
+#ifdef __cplusplus
 #include <utils/List.h>
 #include <sysutils/SocketListener.h>
 
@@ -58,8 +59,6 @@
 
     VolumeCollection      *mVolumes;
     AsecIdCollection      *mActiveContainers;
-    bool                   mUsbMassStorageEnabled;
-    bool                   mUsbConnected;
     bool                   mDebug;
 
     // for adjusting /proc/sys/vm/dirty_ratio when UMS is active
@@ -74,8 +73,6 @@
     int stop();
 
     void handleBlockEvent(NetlinkEvent *evt);
-    void handleSwitchEvent(NetlinkEvent *evt);
-    void handleUsbCompositeEvent(NetlinkEvent *evt);
 
     int addVolume(Volume *v);
 
@@ -84,9 +81,7 @@
     int unmountVolume(const char *label, bool force);
     int shareVolume(const char *label, const char *method);
     int unshareVolume(const char *label, const char *method);
-    int shareAvailable(const char *method, bool *avail);
     int shareEnabled(const char *path, const char *method, bool *enabled);
-    int simulate(const char *cmd, const char *arg);
     int formatVolume(const char *label);
 
     /* ASEC */
@@ -98,6 +93,7 @@
     int unmountAsec(const char *id, bool force);
     int renameAsec(const char *id1, const char *id2);
     int getAsecMountPath(const char *id, char *buffer, int maxlen);
+    int getAsecFilesystemPath(const char *id, char *buffer, int maxlen);
 
     /* Loopback images */
     int listMountedObbs(SocketClient* cli);
@@ -121,13 +117,24 @@
 
     static char *asecHash(const char *id, char *buffer, size_t len);
 
+    Volume *lookupVolume(const char *label);
+    int getNumDirectVolumes(void);
+    int getDirectVolumeList(struct volume_info *vol_list);
+
 private:
     VolumeManager();
     void readInitialState();
-    Volume *lookupVolume(const char *label);
     bool isMountpointMounted(const char *mp);
-
-    inline bool massStorageAvailable() const { return mUsbMassStorageEnabled && mUsbConnected; }
-    void notifyUmsAvailable(bool available);
 };
+
+extern "C" {
+#endif /* __cplusplus */
+#define UNMOUNT_NOT_MOUNTED_ERR -2
+    int vold_unmountVol(const char *label);
+    int vold_getNumDirectVolumes(void);
+    int vold_getDirectVolumeList(struct volume_info *v);
+#ifdef __cplusplus
+}
+#endif
+
 #endif
diff --git a/cryptfs.c b/cryptfs.c
index 68d2787..0d3c681 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -37,11 +37,13 @@
 #include <errno.h>
 #include <cutils/android_reboot.h>
 #include <ext4.h>
+#include <linux/kdev_t.h>
 #include "cryptfs.h"
 #define LOG_TAG "Cryptfs"
 #include "cutils/log.h"
 #include "cutils/properties.h"
 #include "hardware_legacy/power.h"
+#include "VolumeManager.h"
 
 #define DM_CRYPT_BUF_SIZE 4096
 #define DATA_MNT_POINT "/data"
@@ -50,9 +52,16 @@
 #define KEY_LEN_BYTES 16
 #define IV_LEN_BYTES 16
 
+#define KEY_LOC_PROP   "ro.crypto.keyfile.userdata"
+#define KEY_IN_FOOTER  "footer"
+
+#define EXT4_FS 1
+#define FAT_FS 2
+
 char *me = "cryptfs";
 
 static unsigned char saved_master_key[KEY_LEN_BYTES];
+static char *saved_data_blkdev;
 static int  master_key_saved = 0;
 
 static void ioctl_init(struct dm_ioctl *io, size_t dataSize, const char *name, unsigned flags)
@@ -121,26 +130,42 @@
   unsigned int nr_sec, cnt;
   off64_t off;
   int rc = -1;
+  char *fname;
+  char key_loc[PROPERTY_VALUE_MAX];
 
-  if ( (fd = open(real_blk_name, O_RDWR)) < 0) {
-    SLOGE("Cannot open real block device %s\n", real_blk_name);
-    return -1;
-  }
+  property_get(KEY_LOC_PROP, key_loc, KEY_IN_FOOTER);
 
-  if ( (nr_sec = get_blkdev_size(fd)) == 0) {
-    SLOGE("Cannot get size of block device %s\n", real_blk_name);
-    goto errout;
-  }
+  if (!strcmp(key_loc, KEY_IN_FOOTER)) {
+    fname = real_blk_name;
+    if ( (fd = open(fname, O_RDWR)) < 0) {
+      SLOGE("Cannot open real block device %s\n", fname);
+      return -1;
+    }
 
-  /* If it's an encrypted Android partition, the last 16 Kbytes contain the
-   * encryption info footer and key, and plenty of bytes to spare for future
-   * growth.
-   */
-  off = ((off64_t)nr_sec * 512) - CRYPT_FOOTER_OFFSET;
+    if ( (nr_sec = get_blkdev_size(fd)) == 0) {
+      SLOGE("Cannot get size of block device %s\n", fname);
+      goto errout;
+    }
 
-  if (lseek64(fd, off, SEEK_SET) == -1) {
-    SLOGE("Cannot seek to real block device footer\n");
-    goto errout;
+    /* If it's an encrypted Android partition, the last 16 Kbytes contain the
+     * encryption info footer and key, and plenty of bytes to spare for future
+     * growth.
+     */
+    off = ((off64_t)nr_sec * 512) - CRYPT_FOOTER_OFFSET;
+
+    if (lseek64(fd, off, SEEK_SET) == -1) {
+      SLOGE("Cannot seek to real block device footer\n");
+      goto errout;
+    }
+  } else if (key_loc[0] == '/') {
+    fname = key_loc;
+    if ( (fd = open(fname, O_RDWR | O_CREAT, 0600)) < 0) {
+      SLOGE("Cannot open footer file %s\n", fname);
+      return -1;
+    }
+  } else {
+    SLOGE("Unexpected value for" KEY_LOC_PROP "\n");
+    return -1;;
   }
 
   if ((cnt = write(fd, crypt_ftr, sizeof(struct crypt_mnt_ftr))) != sizeof(struct crypt_mnt_ftr)) {
@@ -151,29 +176,36 @@
   if (key) {
     if (crypt_ftr->keysize != KEY_LEN_BYTES) {
       SLOGE("Keysize of %d bits not supported for real block device %s\n",
-            crypt_ftr->keysize * 8, real_blk_name);
+            crypt_ftr->keysize*8, fname);
       goto errout; 
     }
 
     if ( (cnt = write(fd, key, crypt_ftr->keysize)) != crypt_ftr->keysize) {
-      SLOGE("Cannot write key for real block device %s\n", real_blk_name);
+      SLOGE("Cannot write key for real block device %s\n", fname);
       goto errout;
     }
   }
 
   if (salt) {
-    /* Compute the offset for start of the crypt footer */
-    off = ((off64_t)nr_sec * 512) - CRYPT_FOOTER_OFFSET;
-    /* Add in the length of the footer, key and padding */
-    off += sizeof(struct crypt_mnt_ftr) + crypt_ftr->keysize + KEY_TO_SALT_PADDING;
+    /* Compute the offset from the last write to the salt */
+    off = KEY_TO_SALT_PADDING;
+    if (! key)
+      off += crypt_ftr->keysize;
 
-    if (lseek64(fd, off, SEEK_SET) == -1) {
+    if (lseek64(fd, off, SEEK_CUR) == -1) {
       SLOGE("Cannot seek to real block device salt \n");
       goto errout;
     }
 
     if ( (cnt = write(fd, salt, SALT_LEN)) != SALT_LEN) {
-      SLOGE("Cannot write salt for real block device %s\n", real_blk_name);
+      SLOGE("Cannot write salt for real block device %s\n", fname);
+      goto errout;
+    }
+  }
+
+  if (key_loc[0] == '/') {
+    if (ftruncate(fd, 0x4000)) {
+      SLOGE("Cannot set footer file sizen", fname);
       goto errout;
     }
   }
@@ -194,26 +226,50 @@
   unsigned int nr_sec, cnt;
   off64_t off;
   int rc = -1;
+  char key_loc[PROPERTY_VALUE_MAX];
+  char *fname;
+  struct stat statbuf;
 
-  if ( (fd = open(real_blk_name, O_RDWR)) < 0) {
-    SLOGE("Cannot open real block device %s\n", real_blk_name);
-    return -1;
-  }
+  property_get(KEY_LOC_PROP, key_loc, KEY_IN_FOOTER);
 
-  if ( (nr_sec = get_blkdev_size(fd)) == 0) {
-    SLOGE("Cannot get size of block device %s\n", real_blk_name);
-    goto errout;
-  }
+  if (!strcmp(key_loc, KEY_IN_FOOTER)) {
+    fname = real_blk_name;
+    if ( (fd = open(fname, O_RDONLY)) < 0) {
+      SLOGE("Cannot open real block device %s\n", fname);
+      return -1;
+    }
 
-  /* If it's an encrypted Android partition, the last 16 Kbytes contain the
-   * encryption info footer and key, and plenty of bytes to spare for future
-   * growth.
-   */
-  off = ((off64_t)nr_sec * 512) - CRYPT_FOOTER_OFFSET;
+    if ( (nr_sec = get_blkdev_size(fd)) == 0) {
+      SLOGE("Cannot get size of block device %s\n", fname);
+      goto errout;
+    }
 
-  if (lseek64(fd, off, SEEK_SET) == -1) {
-    SLOGE("Cannot seek to real block device footer\n");
-    goto errout;
+    /* If it's an encrypted Android partition, the last 16 Kbytes contain the
+     * encryption info footer and key, and plenty of bytes to spare for future
+     * growth.
+     */
+    off = ((off64_t)nr_sec * 512) - CRYPT_FOOTER_OFFSET;
+
+    if (lseek64(fd, off, SEEK_SET) == -1) {
+      SLOGE("Cannot seek to real block device footer\n");
+      goto errout;
+    }
+  } else if (key_loc[0] == '/') {
+    fname = key_loc;
+    if ( (fd = open(fname, O_RDONLY)) < 0) {
+      SLOGE("Cannot open footer file %s\n", fname);
+      return -1;
+    }
+
+    /* Make sure it's 16 Kbytes in length */
+    fstat(fd, &statbuf);
+    if (statbuf.st_size != 0x4000) {
+      SLOGE("footer file %s is not the expected size!\n", fname);
+      goto errout;
+    }
+  } else {
+    SLOGE("Unexpected value for" KEY_LOC_PROP "\n");
+    return -1;;
   }
 
   if ( (cnt = read(fd, crypt_ftr, sizeof(struct crypt_mnt_ftr))) != sizeof(struct crypt_mnt_ftr)) {
@@ -222,7 +278,7 @@
   }
 
   if (crypt_ftr->magic != CRYPT_MNT_MAGIC) {
-    SLOGE("Bad magic for real block device %s\n", real_blk_name);
+    SLOGE("Bad magic for real block device %s\n", fname);
     goto errout;
   }
 
@@ -249,12 +305,12 @@
 
   if (crypt_ftr->keysize != KEY_LEN_BYTES) {
     SLOGE("Keysize of %d bits not supported for real block device %s\n",
-          crypt_ftr->keysize * 8, real_blk_name);
+          crypt_ftr->keysize * 8, fname);
     goto errout;
   }
 
   if ( (cnt = read(fd, key, crypt_ftr->keysize)) != crypt_ftr->keysize) {
-    SLOGE("Cannot read key for real block device %s\n", real_blk_name);
+    SLOGE("Cannot read key for real block device %s\n", fname);
     goto errout;
   }
 
@@ -264,7 +320,7 @@
   }
 
   if ( (cnt = read(fd, salt, SALT_LEN)) != SALT_LEN) {
-    SLOGE("Cannot read salt for real block device %s\n", real_blk_name);
+    SLOGE("Cannot read salt for real block device %s\n", fname);
     goto errout;
   }
 
@@ -300,7 +356,7 @@
 }
 
 static int create_crypto_blk_dev(struct crypt_mnt_ftr *crypt_ftr, unsigned char *master_key,
-                                    char *real_blk_name, char *crypto_blk_name)
+                                    char *real_blk_name, char *crypto_blk_name, const char *name)
 {
   char buffer[DM_CRYPT_BUF_SIZE];
   char master_key_ascii[129]; /* Large enough to hold 512 bit key and null */
@@ -310,7 +366,6 @@
   unsigned int minor;
   int fd;
   int retval = -1;
-  char *name ="datadev"; /* FIX ME: Make me a parameter */
 
   if ((fd = open("/dev/device-mapper", O_RDWR)) < 0 ) {
     SLOGE("Cannot open device-mapper\n");
@@ -374,12 +429,11 @@
   return retval;
 }
 
-static int delete_crypto_blk_dev(char *crypto_blkdev)
+static int delete_crypto_blk_dev(char *name)
 {
   int fd;
   char buffer[DM_CRYPT_BUF_SIZE];
   struct dm_ioctl *io;
-  char *name ="datadev"; /* FIX ME: Make me a paraameter */
   int retval = -1;
 
   if ((fd = open("/dev/device-mapper", O_RDWR)) < 0 ) {
@@ -501,8 +555,8 @@
 static int get_orig_mount_parms(char *mount_point, char *fs_type, char *real_blkdev,
                                 unsigned long *mnt_flags, char *fs_options)
 {
-  char mount_point2[32];
-  char fs_flags[32];
+  char mount_point2[PROPERTY_VALUE_MAX];
+  char fs_flags[PROPERTY_VALUE_MAX];
 
   property_get("ro.crypto.fs_type", fs_type, "");
   property_get("ro.crypto.fs_real_blkdev", real_blkdev, "");
@@ -527,6 +581,12 @@
     /*  Now umount the tmpfs filesystem */
     for (i=0; i<WAIT_UNMOUNT_COUNT; i++) {
         if (umount(mountpoint)) {
+            if (errno == EINVAL) {
+                /* EINVAL is returned if the directory is not a mountpoint,
+                 * i.e. there is no filesystem mounted there.  So just get out.
+                 */
+                break;
+            }
             sleep(1);
             i++;
         } else {
@@ -557,7 +617,7 @@
 
     /* Wait a max of 25 seconds, hopefully it takes much less */
     for (i=0; i<DATA_PREP_TIMEOUT; i++) {
-        char p[16];;
+        char p[PROPERTY_VALUE_MAX];
 
         property_get("vold.post_fs_data_done", p, "0");
         if (*p == '1') {
@@ -662,10 +722,10 @@
   unsigned char encrypted_master_key[32];
   unsigned char salt[SALT_LEN];
   char real_blkdev[MAXPATHLEN];
-  char fs_type[32];
-  char fs_options[256];
+  char fs_type[PROPERTY_VALUE_MAX];
+  char fs_options[PROPERTY_VALUE_MAX];
   unsigned long mnt_flags;
-  char encrypted_state[32];
+  char encrypted_state[PROPERTY_VALUE_MAX];
 
   property_get("ro.crypto.state", encrypted_state, "");
   if (strcmp(encrypted_state, "encrypted") ) {
@@ -693,7 +753,7 @@
   return 0;
 }
 
-static int test_mount_encrypted_fs(char *passwd, char *mount_point)
+static int test_mount_encrypted_fs(char *passwd, char *mount_point, char *label)
 {
   struct crypt_mnt_ftr crypt_ftr;
   /* Allocate enough space for a 256 bit key, but we may use less */
@@ -701,12 +761,12 @@
   unsigned char salt[SALT_LEN];
   char crypto_blkdev[MAXPATHLEN];
   char real_blkdev[MAXPATHLEN];
-  char fs_type[32];
-  char fs_options[256];
+  char fs_type[PROPERTY_VALUE_MAX];
+  char fs_options[PROPERTY_VALUE_MAX];
   char tmp_mount_point[64];
   unsigned long mnt_flags;
   unsigned int orig_failed_decrypt_count;
-  char encrypted_state[32];
+  char encrypted_state[PROPERTY_VALUE_MAX];
   int rc;
 
   property_get("ro.crypto.state", encrypted_state, "");
@@ -733,7 +793,7 @@
   }
 
   if (create_crypto_blk_dev(&crypt_ftr, decrypted_master_key,
-                               real_blkdev, crypto_blkdev)) {
+                               real_blkdev, crypto_blkdev, label)) {
     SLOGE("Error creating decrypted block device\n");
     return -1;
   }
@@ -749,7 +809,7 @@
   mkdir(tmp_mount_point, 0755);
   if ( mount(crypto_blkdev, tmp_mount_point, "ext4", MS_RDONLY, "") ) {
     SLOGE("Error temp mounting decrypted block device\n");
-    delete_crypto_blk_dev(crypto_blkdev);
+    delete_crypto_blk_dev(label);
     crypt_ftr.failed_decrypt_count++;
   } else {
     /* Success, so just umount and we'll mount it properly when we restart
@@ -777,6 +837,7 @@
      * the key when we want to change the password on it.
      */
     memcpy(saved_master_key, decrypted_master_key, KEY_LEN_BYTES);
+    saved_data_blkdev = strdup(real_blkdev);
     master_key_saved = 1;
     rc = 0;
   }
@@ -784,6 +845,49 @@
   return rc;
 }
 
+/*
+ * Called by vold when it's asked to mount an encrypted, nonremovable volume.
+ * Setup a dm-crypt mapping, use the saved master key from
+ * setting up the /data mapping, and return the new device path.
+ */
+int cryptfs_setup_volume(const char *label, int major, int minor,
+                         char *crypto_sys_path, unsigned int max_path,
+                         int *new_major, int *new_minor)
+{
+    char real_blkdev[MAXPATHLEN], crypto_blkdev[MAXPATHLEN];
+    struct crypt_mnt_ftr sd_crypt_ftr;
+    unsigned char key[32], salt[32];
+    struct stat statbuf;
+    int nr_sec, fd;
+
+    sprintf(real_blkdev, "/dev/block/vold/%d:%d", major, minor);
+
+    /* Just want the footer, but gotta get it all */
+    get_crypt_ftr_and_key(saved_data_blkdev, &sd_crypt_ftr, key, salt);
+
+    /* Update the fs_size field to be the size of the volume */
+    fd = open(real_blkdev, O_RDONLY);
+    nr_sec = get_blkdev_size(fd);
+    close(fd);
+    if (nr_sec == 0) {
+        SLOGE("Cannot get size of volume %s\n", real_blkdev);
+        return -1;
+    }
+
+    sd_crypt_ftr.fs_size = nr_sec;
+    create_crypto_blk_dev(&sd_crypt_ftr, saved_master_key, real_blkdev, 
+                          crypto_blkdev, label);
+
+    stat(crypto_blkdev, &statbuf);
+    *new_major = MAJOR(statbuf.st_rdev);
+    *new_minor = MINOR(statbuf.st_rdev);
+
+    /* Create path to sys entry for this block device */
+    snprintf(crypto_sys_path, max_path, "/devices/virtual/block/%s", strrchr(crypto_blkdev, '/')+1);
+
+    return 0;
+}
+
 int cryptfs_crypto_complete(void)
 {
   return do_crypto_complete("/data");
@@ -793,7 +897,7 @@
 {
     int rc = -1;
 
-    rc = test_mount_encrypted_fs(passwd, DATA_MNT_POINT);
+    rc = test_mount_encrypted_fs(passwd, DATA_MNT_POINT, "userdata");
 
     return rc;
 }
@@ -817,14 +921,24 @@
     ftr->crypto_type_name[0] = '\0';
 }
 
-static int cryptfs_enable_wipe(char *crypto_blkdev, off64_t size)
+static int cryptfs_enable_wipe(char *crypto_blkdev, off64_t size, int type)
 {
     char cmdline[256];
     int rc = -1;
 
-    snprintf(cmdline, sizeof(cmdline), "/system/bin/make_ext4fs -a /data -l %lld %s",
-             size * 512, crypto_blkdev);
-    SLOGI("Making empty filesystem with command %s\n", cmdline);
+    if (type == EXT4_FS) {
+        snprintf(cmdline, sizeof(cmdline), "/system/bin/make_ext4fs -a /data -l %lld %s",
+                 size * 512, crypto_blkdev);
+        SLOGI("Making empty filesystem with command %s\n", cmdline);
+    } else if (type== FAT_FS) {
+        snprintf(cmdline, sizeof(cmdline), "/system/bin/newfs_msdos -F 32 -O android -c 8 -s %lld %s",
+                 size, crypto_blkdev);
+        SLOGI("Making empty filesystem with command %s\n", cmdline);
+    } else {
+        SLOGE("cryptfs_enable_wipe(): unknown filesystem type %d\n", type);
+        return -1;
+    }
+
     if (system(cmdline)) {
       SLOGE("Error creating empty filesystem on %s\n", crypto_blkdev);
     } else {
@@ -851,13 +965,15 @@
 
 #define CRYPT_INPLACE_BUFSIZE 4096
 #define CRYPT_SECTORS_PER_BUFSIZE (CRYPT_INPLACE_BUFSIZE / 512)
-static int cryptfs_enable_inplace(char *crypto_blkdev, char *real_blkdev, off64_t size)
+static int cryptfs_enable_inplace(char *crypto_blkdev, char *real_blkdev, off64_t size,
+                                  off64_t *size_already_done, off64_t tot_size)
 {
     int realfd, cryptofd;
     char *buf[CRYPT_INPLACE_BUFSIZE];
     int rc = -1;
     off64_t numblocks, i, remainder;
     off64_t one_pct, cur_pct, new_pct;
+    off64_t blocks_already_done, tot_numblocks;
 
     if ( (realfd = open(real_blkdev, O_RDONLY)) < 0) { 
         SLOGE("Error opening real_blkdev %s for inplace encrypt\n", real_blkdev);
@@ -877,14 +993,16 @@
      */
     numblocks = size / CRYPT_SECTORS_PER_BUFSIZE;
     remainder = size % CRYPT_SECTORS_PER_BUFSIZE;
+    tot_numblocks = tot_size / CRYPT_SECTORS_PER_BUFSIZE;
+    blocks_already_done = *size_already_done / CRYPT_SECTORS_PER_BUFSIZE;
 
     SLOGE("Encrypting filesystem in place...");
 
-    one_pct = numblocks / 100;
+    one_pct = tot_numblocks / 100;
     cur_pct = 0;
     /* process the majority of the filesystem in blocks */
     for (i=0; i<numblocks; i++) {
-        new_pct = i / one_pct;
+        new_pct = (i + blocks_already_done) / one_pct;
         if (new_pct > cur_pct) {
             char buf[8];
 
@@ -914,8 +1032,7 @@
         }
     }
 
-    property_set("vold.encrypt_progress", "100");
-
+    *size_already_done += size;
     rc = 0;
 
 errout:
@@ -930,19 +1047,33 @@
 
 #define FRAMEWORK_BOOT_WAIT 60
 
+static inline int should_encrypt(struct volume_info *volume)
+{
+    return (volume->flags & (VOL_ENCRYPTABLE | VOL_NONREMOVABLE)) == 
+            (VOL_ENCRYPTABLE | VOL_NONREMOVABLE);
+}
+
 int cryptfs_enable(char *howarg, char *passwd)
 {
     int how = 0;
-    char crypto_blkdev[MAXPATHLEN], real_blkdev[MAXPATHLEN];
-    char fs_type[32], fs_options[256], mount_point[32];
+    char crypto_blkdev[MAXPATHLEN], real_blkdev[MAXPATHLEN], sd_crypto_blkdev[MAXPATHLEN];
+    char fs_type[PROPERTY_VALUE_MAX], fs_options[PROPERTY_VALUE_MAX],
+         mount_point[PROPERTY_VALUE_MAX];
     unsigned long mnt_flags, nr_sec;
     unsigned char master_key[KEY_LEN_BYTES], decrypted_master_key[KEY_LEN_BYTES];
     unsigned char salt[SALT_LEN];
-    int rc=-1, fd, i;
-    struct crypt_mnt_ftr crypt_ftr;
-    char tmpfs_options[80];
-    char encrypted_state[32];
+    int rc=-1, fd, i, ret;
+    struct crypt_mnt_ftr crypt_ftr, sd_crypt_ftr;;
+    char tmpfs_options[PROPERTY_VALUE_MAX];
+    char encrypted_state[PROPERTY_VALUE_MAX];
     char lockid[32] = { 0 };
+    char key_loc[PROPERTY_VALUE_MAX];
+    char fuse_sdcard[PROPERTY_VALUE_MAX];
+    char *sd_mnt_point;
+    char sd_blk_dev[256] = { 0 };
+    int num_vols;
+    struct volume_info *vol_list = 0;
+    off64_t cur_encryption_done=0, tot_encryption_size=0;
 
     property_get("ro.crypto.state", encrypted_state, "");
     if (strcmp(encrypted_state, "unencrypted")) {
@@ -950,6 +1081,8 @@
         goto error_unencrypted;
     }
 
+    property_get(KEY_LOC_PROP, key_loc, KEY_IN_FOOTER);
+
     if (!strcmp(howarg, "wipe")) {
       how = CRYPTO_ENABLE_WIPE;
     } else if (! strcmp(howarg, "inplace")) {
@@ -970,7 +1103,7 @@
     close(fd);
 
     /* If doing inplace encryption, make sure the orig fs doesn't include the crypto footer */
-    if (how == CRYPTO_ENABLE_INPLACE) {
+    if ((how == CRYPTO_ENABLE_INPLACE) && (!strcmp(key_loc, KEY_IN_FOOTER))) {
         unsigned int fs_size_sec, max_fs_size_sec;
 
         fs_size_sec = get_fs_size(real_blkdev);
@@ -986,17 +1119,55 @@
      * device to sleep on us.  We'll grab a partial wakelock, and if the UI
      * wants to keep the screen on, it can grab a full wakelock.
      */
-    snprintf(lockid, 32, "enablecrypto%d", (int) getpid());
+    snprintf(lockid, sizeof(lockid), "enablecrypto%d", (int) getpid());
     acquire_wake_lock(PARTIAL_WAKE_LOCK, lockid);
 
+     /* Get the sdcard mount point */
+     sd_mnt_point = getenv("EXTERNAL_STORAGE");
+     if (! sd_mnt_point) {
+         sd_mnt_point = "/mnt/sdcard";
+     }
+
+    num_vols=vold_getNumDirectVolumes();
+    vol_list = malloc(sizeof(struct volume_info) * num_vols);
+    vold_getDirectVolumeList(vol_list);
+
+    for (i=0; i<num_vols; i++) {
+        if (should_encrypt(&vol_list[i])) {
+            fd = open(vol_list[i].blk_dev, O_RDONLY);
+            if ( (vol_list[i].size = get_blkdev_size(fd)) == 0) {
+                SLOGE("Cannot get size of block device %s\n", vol_list[i].blk_dev);
+                goto error_unencrypted;
+            }
+            close(fd);
+
+            ret=vold_unmountVol(vol_list[i].label);
+            if ((ret < 0) && (ret != UNMOUNT_NOT_MOUNTED_ERR)) {
+                /* -2 is returned when the device exists but is not currently mounted.
+                 * ignore the error and continue. */
+                SLOGE("Failed to unmount volume %s\n", vol_list[i].label);
+                goto error_unencrypted;
+            }
+        }
+    }
+
     /* The init files are setup to stop the class main and late start when
      * vold sets trigger_shutdown_framework.
      */
     property_set("vold.decrypt", "trigger_shutdown_framework");
     SLOGD("Just asked init to shut down class main\n");
 
-    if (wait_and_unmount("/mnt/sdcard")) {
-        goto error_shutting_down;
+    property_get("ro.crypto.fuse_sdcard", fuse_sdcard, "");
+    if (!strcmp(fuse_sdcard, "true")) {
+        /* This is a device using the fuse layer to emulate the sdcard semantics
+         * on top of the userdata partition.  vold does not manage it, it is managed
+         * by the sdcard service.  The sdcard service was killed by the property trigger
+         * above, so just unmount it now.  We must do this _AFTER_ killing the framework,
+         * unlike the case for vold managed devices above.
+         */
+        if (wait_and_unmount(sd_mnt_point)) {
+            goto error_shutting_down;
+        }
     }
 
     /* Now unmount the /data partition. */
@@ -1038,7 +1209,11 @@
     /* Start the actual work of making an encrypted filesystem */
     /* Initialize a crypt_mnt_ftr for the partition */
     cryptfs_init_crypt_mnt_ftr(&crypt_ftr);
-    crypt_ftr.fs_size = nr_sec - (CRYPT_FOOTER_OFFSET / 512);
+    if (!strcmp(key_loc, KEY_IN_FOOTER)) {
+        crypt_ftr.fs_size = nr_sec - (CRYPT_FOOTER_OFFSET / 512);
+    } else {
+        crypt_ftr.fs_size = nr_sec;
+    }
     crypt_ftr.flags |= CRYPT_ENCRYPTION_IN_PROGRESS;
     strcpy((char *)crypt_ftr.crypto_type_name, "aes-cbc-essiv:sha256");
 
@@ -1052,12 +1227,51 @@
     put_crypt_ftr_and_key(real_blkdev, &crypt_ftr, master_key, salt);
 
     decrypt_master_key(passwd, salt, master_key, decrypted_master_key);
-    create_crypto_blk_dev(&crypt_ftr, decrypted_master_key, real_blkdev, crypto_blkdev);
+    create_crypto_blk_dev(&crypt_ftr, decrypted_master_key, real_blkdev, crypto_blkdev,
+                          "userdata");
+
+    /* setup crypto mapping for all encryptable volumes handled by vold */
+    for (i=0; i<num_vols; i++) {
+        if (should_encrypt(&vol_list[i])) {
+            vol_list[i].crypt_ftr = crypt_ftr; /* gotta love struct assign */
+            vol_list[i].crypt_ftr.fs_size = vol_list[i].size;
+            create_crypto_blk_dev(&vol_list[i].crypt_ftr, decrypted_master_key,
+                                  vol_list[i].blk_dev, vol_list[i].crypto_blkdev,
+                                  vol_list[i].label);
+             tot_encryption_size += vol_list[i].size;
+        }
+    }
 
     if (how == CRYPTO_ENABLE_WIPE) {
-        rc = cryptfs_enable_wipe(crypto_blkdev, crypt_ftr.fs_size);
+        rc = cryptfs_enable_wipe(crypto_blkdev, crypt_ftr.fs_size, EXT4_FS);
+        /* Encrypt all encryptable volumes handled by vold */
+        if (!rc) {
+            for (i=0; i<num_vols; i++) {
+                if (should_encrypt(&vol_list[i])) {
+                    rc = cryptfs_enable_wipe(vol_list[i].crypto_blkdev,
+                                             vol_list[i].crypt_ftr.fs_size, FAT_FS);
+                }
+            }
+        }
     } else if (how == CRYPTO_ENABLE_INPLACE) {
-        rc = cryptfs_enable_inplace(crypto_blkdev, real_blkdev, crypt_ftr.fs_size);
+        rc = cryptfs_enable_inplace(crypto_blkdev, real_blkdev, crypt_ftr.fs_size,
+                                    &cur_encryption_done, tot_encryption_size);
+        /* Encrypt all encryptable volumes handled by vold */
+        if (!rc) {
+            for (i=0; i<num_vols; i++) {
+                if (should_encrypt(&vol_list[i])) {
+                    rc = cryptfs_enable_inplace(vol_list[i].crypto_blkdev,
+                                                vol_list[i].blk_dev,
+                                                vol_list[i].crypt_ftr.fs_size,
+                                                &cur_encryption_done, tot_encryption_size);
+                }
+            }
+        }
+        if (!rc) {
+            /* The inplace routine never actually sets the progress to 100%
+             * due to the round down nature of integer division, so set it here */
+            property_set("vold.encrypt_progress", "100");
+        }
     } else {
         /* Shouldn't happen */
         SLOGE("cryptfs_enable: internal error, unknown option\n");
@@ -1065,7 +1279,14 @@
     }
 
     /* Undo the dm-crypt mapping whether we succeed or not */
-    delete_crypto_blk_dev(crypto_blkdev);
+    delete_crypto_blk_dev("userdata");
+    for (i=0; i<num_vols; i++) {
+        if (should_encrypt(&vol_list[i])) {
+            delete_crypto_blk_dev(vol_list[i].label);
+        }
+    }
+
+    free(vol_list);
 
     if (! rc) {
         /* Success */
@@ -1074,7 +1295,7 @@
         crypt_ftr.flags &= ~CRYPT_ENCRYPTION_IN_PROGRESS;
         put_crypt_ftr_and_key(real_blkdev, &crypt_ftr, 0, 0);
 
-        sleep(2); /* Give the UI a change to show 100% progress */
+        sleep(2); /* Give the UI a chance to show 100% progress */
         android_reboot(ANDROID_RB_RESTART, 0, 0);
     } else {
         property_set("vold.encrypt_progress", "error_partially_encrypted");
@@ -1091,6 +1312,7 @@
     return rc;
 
 error_unencrypted:
+    free(vol_list);
     property_set("vold.encrypt_progress", "error_not_encrypted");
     if (lockid[0]) {
         release_wake_lock(lockid);
@@ -1107,6 +1329,7 @@
 
     /* shouldn't get here */
     property_set("vold.encrypt_progress", "error_shutting_down");
+    free(vol_list);
     if (lockid[0]) {
         release_wake_lock(lockid);
     }
diff --git a/cryptfs.h b/cryptfs.h
index bb461ac..8b4c37b 100644
--- a/cryptfs.h
+++ b/cryptfs.h
@@ -58,6 +58,18 @@
 							       partition, null terminated */
 };
 
+struct volume_info {
+   unsigned int size;
+   unsigned int flags;
+   struct crypt_mnt_ftr crypt_ftr;
+   char mnt_point[256];
+   char blk_dev[256];
+   char crypto_blkdev[256];
+   char label[256];
+};
+#define VOL_NONREMOVABLE 0x1
+#define VOL_ENCRYPTABLE  0x2
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -66,6 +78,9 @@
   int cryptfs_restart(void);
   int cryptfs_enable(char *flag, char *passwd);
   int cryptfs_changepw(char *newpw);
+  int cryptfs_setup_volume(const char *label, int major, int minor,
+                           char *crypto_dev_path, unsigned int max_pathlen,
+                           int *new_major, int *new_minor);
 #ifdef __cplusplus
 }
 #endif
diff --git a/main.cpp b/main.cpp
index 9c45774..5924fe4 100644
--- a/main.cpp
+++ b/main.cpp
@@ -32,6 +32,7 @@
 #include "CommandListener.h"
 #include "NetlinkManager.h"
 #include "DirectVolume.h"
+#include "cryptfs.h"
 
 static int process_config(VolumeManager *vm);
 static void coldboot(const char *path);
@@ -141,6 +142,22 @@
     }
 }
 
+static int parse_mount_flags(char *mount_flags)
+{
+    char *save_ptr;
+    int flags = 0;
+
+    if (strcasestr(mount_flags, "encryptable")) {
+        flags |= VOL_ENCRYPTABLE;
+    }
+
+    if (strcasestr(mount_flags, "nonremovable")) {
+        flags |= VOL_NONREMOVABLE;
+    }
+
+    return flags;
+}
+
 static int process_config(VolumeManager *vm) {
     FILE *fp;
     int n = 0;
@@ -153,7 +170,8 @@
     while(fgets(line, sizeof(line), fp)) {
         const char *delim = " \t";
         char *save_ptr;
-        char *type, *label, *mount_point;
+        char *type, *label, *mount_point, *mount_flags, *sysfs_path;
+        int flags;
 
         n++;
         line[strlen(line)-1] = '\0';
@@ -193,13 +211,27 @@
                 dv = new DirectVolume(vm, label, mount_point, atoi(part));
             }
 
-            while (char *sysfs_path = strtok_r(NULL, delim, &save_ptr)) {
+            while ((sysfs_path = strtok_r(NULL, delim, &save_ptr))) {
+                if (*sysfs_path != '/') {
+                    /* If the first character is not a '/', it must be flags */
+                    break;
+                }
                 if (dv->addPath(sysfs_path)) {
                     SLOGE("Failed to add devpath %s to volume %s", sysfs_path,
                          label);
                     goto out_fail;
                 }
             }
+
+            /* If sysfs_path is non-null at this point, then it contains
+             * the optional flags for this volume
+             */
+            if (sysfs_path)
+                flags = parse_mount_flags(sysfs_path);
+            else
+                flags = 0;
+            dv->setFlags(flags);
+
             vm->addVolume(dv);
         } else if (!strcmp(type, "map_mount")) {
         } else {