diff --git a/FsCrypt.cpp b/FsCrypt.cpp
index 017ffec..be68222 100644
--- a/FsCrypt.cpp
+++ b/FsCrypt.cpp
@@ -208,7 +208,7 @@
     return false;
 }
 
-static bool IsEmmcStorage(const std::string& blk_device) {
+static bool MightBeEmmcStorage(const std::string& blk_device) {
     // Handle symlinks.
     std::string real_path;
     if (!Realpath(blk_device, &real_path)) {
@@ -224,8 +224,15 @@
     }
 
     // Now we should have the "real" block device.
-    LOG(DEBUG) << "IsEmmcStorage(): blk_device = " << blk_device << ", real_path=" << real_path;
-    return StartsWith(Basename(real_path), "mmcblk");
+    LOG(DEBUG) << "MightBeEmmcStorage(): blk_device = " << blk_device
+               << ", real_path=" << real_path;
+    std::string name = Basename(real_path);
+    return StartsWith(name, "mmcblk") ||
+           // virtio devices may provide inline encryption support that is
+           // backed by eMMC inline encryption on the host, thus inheriting the
+           // DUN size limitation.  So virtio devices must be allowed here too.
+           // TODO(b/207390665): check the maximum DUN size directly instead.
+           StartsWith(name, "vd");
 }
 
 // Retrieve the options to use for encryption policies on the /data filesystem.
@@ -241,7 +248,7 @@
         return false;
     }
     if ((options->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) &&
-        !IsEmmcStorage(entry->blk_device)) {
+        !MightBeEmmcStorage(entry->blk_device)) {
         LOG(ERROR) << "The emmc_optimized encryption flag is only allowed on eMMC storage.  Remove "
                       "this flag from the device's fstab";
         return false;
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index d299593..02025b7 100644
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -1002,8 +1002,8 @@
             // The volume must be mounted
             return false;
         }
-        if ((vol.getMountFlags() & VolumeBase::MountFlags::kVisible) == 0) {
-            // and visible
+        if (!vol.isVisibleForWrite()) {
+            // App dirs should only be created for writable volumes.
             return false;
         }
         if (vol.getInternalPath().empty()) {
@@ -1077,8 +1077,8 @@
                 // The volume must be mounted
                 return false;
             }
-            if ((vol.getMountFlags() & VolumeBase::MountFlags::kVisible) == 0) {
-                // and visible
+            if (!vol.isVisibleForWrite()) {
+                // Obb volume should only be created for writable volumes.
                 return false;
             }
             if (vol.getInternalPath().empty()) {
diff --git a/binder/android/os/IVold.aidl b/binder/android/os/IVold.aidl
index 606f473..8dd7860 100644
--- a/binder/android/os/IVold.aidl
+++ b/binder/android/os/IVold.aidl
@@ -159,7 +159,8 @@
     const int FSTRIM_FLAG_DEEP_TRIM = 1;
 
     const int MOUNT_FLAG_PRIMARY = 1;
-    const int MOUNT_FLAG_VISIBLE = 2;
+    const int MOUNT_FLAG_VISIBLE_FOR_READ = 2;
+    const int MOUNT_FLAG_VISIBLE_FOR_WRITE = 4;
 
     const int PARTITION_TYPE_PUBLIC = 0;
     const int PARTITION_TYPE_PRIVATE = 1;
diff --git a/model/EmulatedVolume.cpp b/model/EmulatedVolume.cpp
index 6f21ff8..b686437 100644
--- a/model/EmulatedVolume.cpp
+++ b/model/EmulatedVolume.cpp
@@ -246,7 +246,7 @@
 
 status_t EmulatedVolume::doMount() {
     std::string label = getLabel();
-    bool isVisible = getMountFlags() & MountFlags::kVisible;
+    bool isVisible = isVisibleForWrite();
 
     mSdcardFsDefault = StringPrintf("/mnt/runtime/default/%s", label.c_str());
     mSdcardFsRead = StringPrintf("/mnt/runtime/read/%s", label.c_str());
diff --git a/model/PublicVolume.cpp b/model/PublicVolume.cpp
index 12e31ff..bf54c95 100644
--- a/model/PublicVolume.cpp
+++ b/model/PublicVolume.cpp
@@ -97,7 +97,7 @@
 }
 
 status_t PublicVolume::doMount() {
-    bool isVisible = getMountFlags() & MountFlags::kVisible;
+    bool isVisible = isVisibleForWrite();
     readMetadata();
 
     if (mFsType == "vfat" && vfat::IsSupported()) {
diff --git a/model/VolumeBase.h b/model/VolumeBase.h
index 689750d..f29df65 100644
--- a/model/VolumeBase.h
+++ b/model/VolumeBase.h
@@ -63,8 +63,14 @@
     enum MountFlags {
         /* Flag that volume is primary external storage */
         kPrimary = 1 << 0,
-        /* Flag that volume is visible to normal apps */
-        kVisible = 1 << 1,
+        /*
+         * Flags indicating that volume is visible to normal apps.
+         * kVisibleForRead and kVisibleForWrite correspond to
+         * VolumeInfo.MOUNT_FLAG_VISIBLE_FOR_READ and
+         * VolumeInfo.MOUNT_FLAG_VISIBLE_FOR_WRITE, respectively.
+         */
+        kVisibleForRead = 1 << 1,
+        kVisibleForWrite = 1 << 2,
     };
 
     enum class State {
@@ -103,6 +109,9 @@
     std::shared_ptr<VolumeBase> findVolume(const std::string& id);
 
     bool isEmulated() { return mType == Type::kEmulated; }
+    bool isVisibleForRead() const { return (mMountFlags & MountFlags::kVisibleForRead) != 0; }
+    bool isVisibleForWrite() const { return (mMountFlags & MountFlags::kVisibleForWrite) != 0; }
+    bool isVisible() const { return isVisibleForRead() || isVisibleForWrite(); }
 
     status_t create();
     status_t destroy();