diff --git a/g13/Makefile.am b/g13/Makefile.am
index 34d5baf4b..4244a747a 100644
--- a/g13/Makefile.am
+++ b/g13/Makefile.am
@@ -1,77 +1,78 @@
 # g13/Makefile.am
 # Copyright (C) 2009 Free Software Foundation, Inc.
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <http://www.gnu.org/licenses/>.
 
 ## Process this file with automake to produce Makefile.in
 
 EXTRA_DIST = ChangeLog-2011
 
 bin_PROGRAMS = g13
 sbin_PROGRAMS = g13-syshelp
 
 noinst_PROGRAMS = $(module_tests)
 TESTS = $(module_tests)
 
 AM_CPPFLAGS = -I$(top_srcdir)/common
 
 include $(top_srcdir)/am/cmacros.am
 
 AM_CFLAGS =  $(LIBGCRYPT_CFLAGS) $(LIBASSUAN_CFLAGS) $(NPTH_CFLAGS)
 
 g13_SOURCES = \
 	g13.c g13.h \
 	g13-common.c g13-common.h \
 	keyblob.h \
 	g13tuple.c g13tuple.h \
 	server.c server.h \
 	create.c create.h \
 	mount.c mount.h \
 	mountinfo.c mountinfo.h \
 	call-syshelp.c call-syshelp.h \
 	runner.c runner.h \
 	backend.c backend.h \
 	be-encfs.c be-encfs.h \
-	be-truecrypt.c be-truecrypt.h
+	be-truecrypt.c be-truecrypt.h \
+	be-dmcrypt.c be-dmcrypt.h
 
 g13_LDADD = $(libcommonpth) \
 	$(LIBGCRYPT_LIBS) $(LIBASSUAN_LIBS) $(NPTH_LIBS) \
 	$(GPG_ERROR_LIBS) $(LIBINTL) $(LIBICONV)
 
 
 g13_syshelp_SOURCES = \
 	g13-syshelp.c g13-syshelp.h \
 	g13-common.c g13-common.h \
 	keyblob.h \
 	g13tuple.c g13tuple.h \
 	sh-cmd.c \
 	sh-blockdev.c \
 	sh-dmcrypt.c
 
 g13_syshelp_LDADD = $(libcommon) \
 	$(LIBGCRYPT_LIBS) $(LIBASSUAN_LIBS) \
 	$(GPG_ERROR_LIBS) $(LIBINTL) $(LIBICONV)
 
 
 module_tests = t-g13tuple
 t_common_ldadd = $(libcommon) $(LIBGCRYPT_LIBS) \
 	         $(LIBASSUAN_LIBS)
 
 t_g13tuple_SOURCES = t-g13tuple.c g13tuple.c
 t_g13tuple_LDADD = $(t_common_ldadd)
 
 
 $(PROGRAMS) : $(libcommon) $(libcommonpth)
diff --git a/g13/backend.c b/g13/backend.c
index b35887be3..bb7bfcc02 100644
--- a/g13/backend.c
+++ b/g13/backend.c
@@ -1,228 +1,240 @@
 /* backend.c - Dispatcher to the various backends.
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/stat.h>
 
 #include "g13.h"
 #include "i18n.h"
 #include "keyblob.h"
 #include "backend.h"
 #include "be-encfs.h"
 #include "be-truecrypt.h"
+#include "be-dmcrypt.h"
+#include "call-syshelp.h"
 
-
+#define no_such_backend(a) _no_such_backend ((a), __func__)
 static gpg_error_t
-no_such_backend (int conttype)
+_no_such_backend (int conttype, const char *func)
 {
-  log_error ("invalid backend %d given - this is most likely a bug\n",
-             conttype);
+  log_error ("invalid backend %d given in %s - this is most likely a bug\n",
+             conttype, func);
   return gpg_error (GPG_ERR_INTERNAL);
 }
 
 
 /* Parse NAME and return the corresponding content type.  If the name
    is not known, a error message is printed and zero returned.  If
    NAME is NULL the supported backend types are listed and 0 is
    returned. */
 int
 be_parse_conttype_name (const char *name)
 {
   static struct { const char *name; int conttype; } names[] = {
     { "encfs",    CONTTYPE_ENCFS },
     { "dm-crypt", CONTTYPE_DM_CRYPT }
   };
   int i;
 
   if (!name)
     {
       log_info ("Known backend types:\n");
       for (i=0; i < DIM (names); i++)
         log_info ("    %s\n", names[i].name);
       return 0;
     }
 
   for (i=0; i < DIM (names); i++)
     {
       if (!strcmp (names[i].name, name))
         return names[i].conttype;
     }
 
   log_error ("invalid backend type '%s' given\n", name);
   return 0;
 }
 
 
 /* Return true if CONTTYPE is supported by us.  */
 int
 be_is_supported_conttype (int conttype)
 {
   switch (conttype)
     {
     case CONTTYPE_ENCFS:
+    case CONTTYPE_DM_CRYPT:
       return 1;
 
     default:
       return 0;
     }
 }
 
 
 /* Create a lock file for the container FNAME and store the lock at
  * R_LOCK and return 0.  On error return an error code and store NULL
  * at R_LOCK.  */
 gpg_error_t
 be_take_lock_for_create (ctrl_t ctrl, const char *fname, dotlock_t *r_lock)
 {
   gpg_error_t err;
   dotlock_t lock = NULL;
   struct stat sb;
 
   *r_lock = NULL;
 
   /* A DM-crypt container requires special treatment by using the
      syshelper fucntions.  */
   if (ctrl->conttype == CONTTYPE_DM_CRYPT)
     {
       /*  */
-      err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+      err = call_syshelp_set_device (ctrl, fname);
       goto leave;
     }
 
 
   /* A quick check to see that no container with that name already
      exists.  */
   if (!access (fname, F_OK))
     {
       err = gpg_error (GPG_ERR_EEXIST);
       goto leave;
     }
 
   /* Take a lock and proceed with the creation.  If there is a lock we
      immediately return an error because for creation it does not make
      sense to wait.  */
   lock = dotlock_create (fname, 0);
   if (!lock)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   if (dotlock_take (lock, 0))
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Check again that the file does not exist.  */
   err = stat (fname, &sb)? 0 : gpg_error (GPG_ERR_EEXIST);
 
  leave:
   if (!err)
     {
       *r_lock = lock;
       lock = NULL;
     }
   dotlock_destroy (lock);
   return err;
 }
 
 
 /* If the backend requires a separate file or directory for the
    container, return its name by computing it from FNAME which gives
    the g13 filename.  The new file name is allocated and stored at
    R_NAME, if this is expected to be a directory true is stored at
    R_ISDIR.  If no detached name is expected or an error occurs NULL
    is stored at R_NAME. The function returns 0 on success or an error
    code.  */
 gpg_error_t
 be_get_detached_name (int conttype, const char *fname,
                       char **r_name, int *r_isdir)
 {
   *r_name = NULL;
   *r_isdir = 0;
   switch (conttype)
     {
     case CONTTYPE_ENCFS:
       return be_encfs_get_detached_name (fname, r_name, r_isdir);
 
     case CONTTYPE_DM_CRYPT:
       return 0;
 
     default:
       return no_such_backend (conttype);
     }
 }
 
 
 gpg_error_t
 be_create_new_keys (int conttype, membuf_t *mb)
 {
   switch (conttype)
     {
     case CONTTYPE_ENCFS:
       return be_encfs_create_new_keys (mb);
 
     case CONTTYPE_TRUECRYPT:
       return be_truecrypt_create_new_keys (mb);
 
+    case CONTTYPE_DM_CRYPT:
+      return 0;
+
     default:
       return no_such_backend (conttype);
     }
 }
 
 
 /*  Dispatcher to the backend's create function.  */
 gpg_error_t
 be_create_container (ctrl_t ctrl, int conttype,
                      const char *fname, int fd, tupledesc_t tuples,
                      unsigned int *r_id)
 {
   (void)fd;  /* Not yet used.  */
 
   switch (conttype)
     {
     case CONTTYPE_ENCFS:
       return be_encfs_create_container (ctrl, fname, tuples, r_id);
 
+    case CONTTYPE_DM_CRYPT:
+      return be_dmcrypt_create_container (ctrl);
+
     default:
       return no_such_backend (conttype);
     }
 }
 
 
 /*  Dispatcher to the backend's mount function.  */
 gpg_error_t
 be_mount_container (ctrl_t ctrl, int conttype,
                     const char *fname,  const char *mountpoint,
                     tupledesc_t tuples, unsigned int *r_id)
 {
   switch (conttype)
     {
     case CONTTYPE_ENCFS:
       return be_encfs_mount_container (ctrl, fname, mountpoint, tuples, r_id);
 
+    case CONTTYPE_DM_CRYPT:
+      return be_dmcrypt_mount_container (ctrl, fname, mountpoint, tuples);
+
     default:
       return no_such_backend (conttype);
     }
 }
diff --git a/g13/be-dmcrypt.c b/g13/be-dmcrypt.c
new file mode 100644
index 000000000..325567633
--- /dev/null
+++ b/g13/be-dmcrypt.c
@@ -0,0 +1,64 @@
+/* be-dmcrypt.c - The DM-Crypt based backend
+ * Copyright (C) 2015 Werner Koch
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include "g13.h"
+#include "i18n.h"
+#include "keyblob.h"
+#include "call-syshelp.h"
+#include "be-dmcrypt.h"
+
+
+/* Create the container using the current device.
+ * information in TUPLES. */
+gpg_error_t
+be_dmcrypt_create_container (ctrl_t ctrl)
+{
+  gpg_error_t err;
+
+  err = call_syshelp_run_create (ctrl, CONTTYPE_DM_CRYPT);
+
+  return err;
+}
+
+
+/* Mount the container described by the filename FNAME and the keyblob
+ * information in TUPLES.  On success the runner id is stored at R_ID. */
+gpg_error_t
+be_dmcrypt_mount_container (ctrl_t ctrl,
+                            const char *fname, const char *mountpoint,
+                            tupledesc_t tuples)
+{
+  gpg_error_t err;
+
+  err = call_syshelp_set_device (ctrl, fname);
+  if (err)
+    goto leave;
+
+  err = call_syshelp_run_mount (ctrl, CONTTYPE_DM_CRYPT, mountpoint, tuples);
+
+ leave:
+  return err;
+}
diff --git a/g13/call-syshelp.h b/g13/be-dmcrypt.h
similarity index 61%
copy from g13/call-syshelp.h
copy to g13/be-dmcrypt.h
index c78d53b5c..152186057 100644
--- a/g13/call-syshelp.h
+++ b/g13/be-dmcrypt.h
@@ -1,26 +1,32 @@
-/* call-syshelp.h - Communication with g13-syshelp
+/* be-dmcrypt.h - Public defs for the DM-Crypt based backend
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef GNUPG_G13_CALL_SYSHELP_H
-#define GNUPG_G13_CALL_SYSHELP_H
+#ifndef G13_BE_DMCRYPT_H
+#define G13_BE_DMCRYPT_H
 
-void call_syshelp_release (ctrl_t ctrl);
+#include "backend.h"
 
+gpg_error_t be_dmcrypt_create_container (ctrl_t ctrl);
+gpg_error_t be_dmcrypt_mount_container (ctrl_t ctrl,
+                                        const char *fname,
+                                        const char *mountpoint,
+                                        tupledesc_t tuples);
 
-#endif /*GNUPG_G13_CALL_SYSHELP_H*/
+
+#endif /*G13_BE_DMCRYPT_H*/
diff --git a/g13/call-syshelp.c b/g13/call-syshelp.c
index 0e227ab16..0e69e9c11 100644
--- a/g13/call-syshelp.c
+++ b/g13/call-syshelp.c
@@ -1,133 +1,408 @@
 /* call-syshelp.c - Communication with g13-syshelp
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <time.h>
 #include <assert.h>
 #include <npth.h>
 
 #include "g13.h"
 #include <assuan.h>
 #include "i18n.h"
 #include "g13tuple.h"
 #include "keyblob.h"
 #include "membuf.h"
 #include "create.h"
 
 
 /* Local data for this module.  A pointer to this is stored in the
    CTRL object of each connection.  */
 struct call_syshelp_s
 {
   assuan_context_t assctx;  /* The Assuan context for the current
                                g13-syshep connection.  */
 };
 
 
-/* Fork off the syshelp tool if this has not already been done.  */
+/* Parameter used with the CREATE command.  */
+struct create_parm_s
+{
+  assuan_context_t ctx;
+  ctrl_t ctrl;
+  membuf_t plaintext;
+  unsigned int expect_plaintext:1;
+  unsigned int got_plaintext:1;
+};
+
+
+/* Parameter used with the MOUNT command.  */
+struct mount_parm_s
+{
+  assuan_context_t ctx;
+  ctrl_t ctrl;
+  const void *keyblob;
+  size_t keybloblen;
+};
+
+
+
+
+
+/* Fork off the syshelp tool if this has not already been done.  On
+   success stores the current Assuan context for the syshelp tool at
+   R_CTX.  */
 static gpg_error_t
-start_syshelp (ctrl_t ctrl)
+start_syshelp (ctrl_t ctrl, assuan_context_t *r_ctx)
 {
   gpg_error_t err;
   assuan_context_t ctx;
   assuan_fd_t no_close_list[3];
   int i;
 
-  if (ctrl->syshelp_local->assctx)
+  *r_ctx = NULL;
+
+  if (ctrl->syshelp_local && (*r_ctx = ctrl->syshelp_local->assctx))
     return 0; /* Already set.  */
 
   if (opt.verbose)
     log_info ("starting a new syshelp\n");
 
+  if (!ctrl->syshelp_local)
+    {
+      ctrl->syshelp_local = xtrycalloc (1, sizeof *ctrl->syshelp_local);
+      if (!ctrl->syshelp_local)
+        return gpg_error_from_syserror ();
+    }
+
   if (es_fflush (NULL))
     {
       err = gpg_error_from_syserror ();
       log_error ("error flushing pending output: %s\n", gpg_strerror (err));
       return err;
     }
 
   i = 0;
   if (log_get_fd () != -1)
     no_close_list[i++] = assuan_fd_from_posix_fd (log_get_fd ());
   no_close_list[i++] = assuan_fd_from_posix_fd (es_fileno (es_stderr));
   no_close_list[i] = ASSUAN_INVALID_FD;
 
   err = assuan_new (&ctx);
   if (err)
     {
       log_error ("can't allocate assuan context: %s\n", gpg_strerror (err));
       return err;
     }
 
-  /* Call userv to start g13-syshelp.  This userv script needs tpo be
-     installed under the name "gnupg-g13-syshelp":
-
-       if ( glob service-user root
-          )
-           reset
-           suppress-args
-           execute /home/wk/b/gnupg/g13/g13-syshelp -v
-       else
-           error Nothing to do for this service-user
-       fi
-       quit
-  */
+  /* Call userv to start g13-syshelp.  This userv script needs to be
+   * installed under the name "gnupg-g13-syshelp":
+   *
+   *   if ( glob service-user root
+   *      )
+   *       reset
+   *       suppress-args
+   *       execute /home/wk/b/gnupg/g13/g13-syshelp -v
+   *   else
+   *       error Nothing to do for this service-user
+   *   fi
+   *   quit
+   */
   {
-    const char *argv[3];
+    const char *argv[4];
 
     argv[0] = "userv";
-    argv[1] = "gnupg-g13-syshelp";
-    argv[2] = NULL;
+    argv[1] = "root";
+    argv[2] = "gnupg-g13-syshelp";
+    argv[3] = NULL;
 
     err = assuan_pipe_connect (ctx, "/usr/bin/userv", argv,
                                no_close_list, NULL, NULL, 0);
   }
   if (err)
     {
-      log_error ("can't connect to '%s' - : %s\n",
-                 "g13-syshelp", gpg_strerror (err));
+      log_error ("can't connect to '%s': %s %s\n",
+                 "g13-syshelp", gpg_strerror (err), gpg_strsource (err));
       log_info ("(is userv and its gnupg-g13-syshelp script installed?)\n");
       assuan_release (ctx);
       return err;
     }
-  ctrl->syshelp_local->assctx = ctx;
+
+  *r_ctx = ctrl->syshelp_local->assctx = ctx;
 
   if (DBG_IPC)
     log_debug ("connection to g13-syshelp established\n");
 
   return 0;
 }
 
 
 /* Release local resources associated with CTRL.  */
 void
 call_syshelp_release (ctrl_t ctrl)
 {
   if (!ctrl)
     return;
   if (ctrl->syshelp_local)
     {
       assuan_release (ctrl->syshelp_local->assctx);
       ctrl->syshelp_local->assctx = NULL;
+      xfree (ctrl->syshelp_local);
+      ctrl->syshelp_local = NULL;
+    }
+}
+
+
+/* Send the DEVICE command to the syshelper.  FNAME is the name of the
+   device.  */
+gpg_error_t
+call_syshelp_set_device (ctrl_t ctrl, const char *fname)
+{
+  gpg_error_t err;
+  assuan_context_t ctx;
+  char *line = NULL;
+
+  err = start_syshelp (ctrl, &ctx);
+  if (err)
+    goto leave;
+
+  line = xtryasprintf ("DEVICE %s", fname);
+  if (!line)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+  err = assuan_transact (ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);
+
+ leave:
+  xfree (line);
+  return err;
+}
+
+
+
+static gpg_error_t
+create_status_cb (void *opaque, const char *line)
+{
+  struct create_parm_s *parm = opaque;
+
+  if (has_leading_keyword (line, "PLAINTEXT_FOLLOWS"))
+    parm->expect_plaintext = 1;
+
+  return 0;
+}
+
+
+static gpg_error_t
+create_data_cb (void *opaque, const void *data, size_t datalen)
+{
+  struct create_parm_s *parm = opaque;
+  gpg_error_t err = 0;
+
+  if (!parm->expect_plaintext)
+    {
+      log_error ("status line for data missing\n");
+      err = gpg_error (GPG_ERR_UNEXPECTED);
+    }
+  else if (data)
+    {
+      put_membuf (&parm->plaintext, data, datalen);
+    }
+  else
+    {
+      parm->expect_plaintext = 0;
+      parm->got_plaintext = 1;
+    }
+
+  return err;
+}
+
+
+static gpg_error_t
+create_inq_cb (void *opaque, const char *line)
+{
+  struct create_parm_s *parm = opaque;
+  gpg_error_t err;
+
+  if (has_leading_keyword (line, "ENCKEYBLOB"))
+    {
+      void *plaintext;
+      size_t plaintextlen;
+
+      if (!parm->got_plaintext)
+        err = gpg_error (GPG_ERR_UNEXPECTED);
+      else if (!(plaintext = get_membuf (&parm->plaintext, &plaintextlen)))
+        err = gpg_error_from_syserror ();
+      else
+        {
+          void *ciphertext;
+          size_t ciphertextlen;
+
+          log_printhex ("plain", plaintext, plaintextlen);
+          err = g13_encrypt_keyblob (parm->ctrl,
+                                     plaintext, plaintextlen,
+                                     &ciphertext, &ciphertextlen);
+          wipememory (plaintext, plaintextlen);
+          xfree (plaintext);
+          if (err)
+            log_error ("error encrypting keyblob: %s\n", gpg_strerror (err));
+          else
+            {
+              err = assuan_send_data (parm->ctx, ciphertext, ciphertextlen);
+              xfree (ciphertext);
+              if (err)
+                log_error ("sending ciphertext to g13-syshelp failed: %s\n",
+                           gpg_strerror (err));
+            }
+        }
     }
+  else
+    err = gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
+
+  return err;
+}
+
+
+/* Run the CREATE command on the current device.  CONTTYPES gives the
+   requested content type for the new container.  */
+gpg_error_t
+call_syshelp_run_create (ctrl_t ctrl, int conttype)
+{
+  gpg_error_t err;
+  assuan_context_t ctx;
+  struct create_parm_s parm;
+
+  memset (&parm, 0, sizeof parm);
+
+  err = start_syshelp (ctrl, &ctx);
+  if (err)
+    goto leave;
+
+  /* tty_get ("waiting for debugger"); */
+  /* tty_kill_prompt (); */
+
+  parm.ctx = ctx;
+  parm.ctrl = ctrl;
+  init_membuf (&parm.plaintext, 512);
+  if (conttype == CONTTYPE_DM_CRYPT)
+    {
+      err = assuan_transact (ctx, "CREATE dm-crypt",
+                             create_data_cb, &parm,
+                             create_inq_cb, &parm,
+                             create_status_cb, &parm);
+    }
+  else
+    {
+      log_error ("invalid backend type %d given\n", conttype);
+      err = GPG_ERR_INTERNAL;
+      goto leave;
+    }
+
+ leave:
+  xfree (get_membuf (&parm.plaintext, NULL));
+  return err;
+}
+
+
+
+static gpg_error_t
+mount_status_cb (void *opaque, const char *line)
+{
+  struct mount_parm_s *parm = opaque;
+
+  /* Nothing right now.  */
+  (void)parm;
+  (void)line;
+
+  return 0;
+}
+
+
+static gpg_error_t
+mount_inq_cb (void *opaque, const char *line)
+{
+  struct mount_parm_s *parm = opaque;
+  gpg_error_t err;
+
+  if (has_leading_keyword (line, "KEYBLOB"))
+    {
+      int setconfidential = !assuan_get_flag (parm->ctx, ASSUAN_CONFIDENTIAL);
+
+      if (setconfidential)
+        assuan_begin_confidential (parm->ctx);
+      err = assuan_send_data (parm->ctx, parm->keyblob, parm->keybloblen);
+      if (setconfidential)
+        assuan_end_confidential (parm->ctx);
+      if (err)
+        log_error ("sending keyblob to g13-syshelp failed: %s\n",
+                   gpg_strerror (err));
+    }
+  else
+    err = gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
+
+  return err;
+}
+
+
+/* Run the MOUNT command on the current device.  CONTTYPES gives the
+   requested content type for the new container.  MOUNTPOINT the
+   desired mount point or NULL for default.  */
+gpg_error_t
+call_syshelp_run_mount (ctrl_t ctrl, int conttype, const char *mountpoint,
+                        tupledesc_t tuples)
+{
+  gpg_error_t err;
+  assuan_context_t ctx;
+  struct mount_parm_s parm;
+
+  memset (&parm, 0, sizeof parm);
+
+  err = start_syshelp (ctrl, &ctx);
+  if (err)
+    goto leave;
+
+  /* tty_get ("waiting for debugger"); */
+  /* tty_kill_prompt (); */
+
+  parm.ctx = ctx;
+  parm.ctrl = ctrl;
+  if (conttype == CONTTYPE_DM_CRYPT)
+    {
+      ref_tupledesc (tuples);
+      parm.keyblob = get_tupledesc_data (tuples, &parm.keybloblen);
+      err = assuan_transact (ctx, "MOUNT dm-crypt",
+                             NULL, NULL,
+                             mount_inq_cb, &parm,
+                             mount_status_cb, &parm);
+      unref_tupledesc (tuples);
+    }
+  else
+    {
+      (void)mountpoint; /* Not used.  */
+      log_error ("invalid backend type %d given\n", conttype);
+      err = GPG_ERR_INTERNAL;
+      goto leave;
+    }
+
+ leave:
+  return err;
 }
diff --git a/g13/call-syshelp.h b/g13/call-syshelp.h
index c78d53b5c..60cc776a8 100644
--- a/g13/call-syshelp.h
+++ b/g13/call-syshelp.h
@@ -1,26 +1,33 @@
 /* call-syshelp.h - Communication with g13-syshelp
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef GNUPG_G13_CALL_SYSHELP_H
 #define GNUPG_G13_CALL_SYSHELP_H
 
+#include "g13tuple.h"
+
 void call_syshelp_release (ctrl_t ctrl);
+gpg_error_t call_syshelp_set_device (ctrl_t ctrl, const char *fname);
+gpg_error_t call_syshelp_run_create (ctrl_t ctrl, int conttype);
+gpg_error_t call_syshelp_run_mount (ctrl_t ctrl, int conttype,
+                                    const char *mountpoint,
+                                    tupledesc_t tuples);
 
 
 #endif /*GNUPG_G13_CALL_SYSHELP_H*/
diff --git a/g13/create.c b/g13/create.c
index fc2761877..0126f5b47 100644
--- a/g13/create.c
+++ b/g13/create.c
@@ -1,301 +1,302 @@
 /* create.c - Create a new crypto container
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/stat.h>
 #include <assert.h>
 
 #include "g13.h"
 #include "i18n.h"
 #include "create.h"
 
 #include "keyblob.h"
 #include "backend.h"
 #include "g13tuple.h"
 #include "../common/call-gpg.h"
 
 /* Create a new blob with all the session keys and other meta
    information which are to be stored encrypted in the crypto
    container header.  On success the malloced blob is stored at R_BLOB
    and its length at R_BLOBLEN.  On error an error code is returned
    and (R_BLOB,R_BLOBLEN) are set to (NULL,0).
 
    The format of this blob is a sequence of tag-length-value tuples.
    All tuples have this format:
 
      2 byte TAG           Big endian unsigned integer (0..65535)
                           described by the KEYBLOB_TAG_ constants.
      2 byte LENGTH        Big endian unsigned integer (0..65535)
                           giving the length of the value.
      length bytes VALUE   The value described by the tag.
 
    The first tag in a keyblob must be a BLOBVERSION.  The other tags
    depend on the type of the container as described by the CONTTYPE
    tag.  See keyblob.h for details.  */
 static gpg_error_t
 create_new_keyblob (ctrl_t ctrl, int is_detached,
                     void **r_blob, size_t *r_bloblen)
 {
   gpg_error_t err;
   unsigned char twobyte[2];
   membuf_t mb;
 
   *r_blob = NULL;
   *r_bloblen = 0;
 
   init_membuf_secure (&mb, 512);
 
   append_tuple (&mb, KEYBLOB_TAG_BLOBVERSION, "\x01", 1);
 
   twobyte[0] = (ctrl->conttype >> 8);
   twobyte[1] = (ctrl->conttype);
   append_tuple (&mb, KEYBLOB_TAG_CONTTYPE, twobyte, 2);
   if (is_detached)
     append_tuple (&mb, KEYBLOB_TAG_DETACHED, NULL, 0);
 
   err = be_create_new_keys (ctrl->conttype, &mb);
   if (err)
     goto leave;
 
   /* Just for testing.  */
   append_tuple (&mb, KEYBLOB_TAG_FILLER, "filler", 6);
 
   *r_blob = get_membuf (&mb, r_bloblen);
   if (!*r_blob)
     {
       err = gpg_error_from_syserror ();
       *r_bloblen = 0;
     }
   else
     log_debug ("used keyblob size is %zu\n", *r_bloblen);
 
  leave:
   xfree (get_membuf (&mb, NULL));
   return err;
 }
 
 
 
 /* Encrypt the keyblob (KEYBLOB,KEYBLOBLEN) and store the result at
    (R_ENCBLOB, R_ENCBLOBLEN).  Returns 0 on success or an error code.
    On error R_EKYBLOB is set to NULL.  Depending on the keys set in
    CTRL the result is a single OpenPGP binary message, a single
    special OpenPGP packet encapsulating a CMS message or a
    concatenation of both with the CMS packet being the last.  */
-static gpg_error_t
-encrypt_keyblob (ctrl_t ctrl, void *keyblob, size_t keybloblen,
-                 strlist_t keys,
-                 void **r_encblob, size_t *r_encbloblen)
+gpg_error_t
+g13_encrypt_keyblob (ctrl_t ctrl, void *keyblob, size_t keybloblen,
+                     void **r_encblob, size_t *r_encbloblen)
 {
   gpg_error_t err;
 
   /* FIXME:  For now we only implement OpenPGP.  */
   err = gpg_encrypt_blob (ctrl, opt.gpg_program, opt.gpg_arguments,
                           keyblob, keybloblen,
-                          keys,
+                          ctrl->recipients,
                           r_encblob, r_encbloblen);
 
   return err;
 }
 
 
 /* Write a new file under the name FILENAME with the keyblob and an
    appropriate header.  This function is called with a lock file in
    place and after checking that the filename does not exists.  */
 static gpg_error_t
 write_keyblob (const char *filename,
                const void *keyblob, size_t keybloblen)
 {
   gpg_error_t err;
   estream_t fp;
   unsigned char packet[32];
   size_t headerlen, paddinglen;
 
   fp = es_fopen (filename, "wbx");
   if (!fp)
     {
       err = gpg_error_from_syserror ();
       log_error ("error creating new container '%s': %s\n",
                  filename, gpg_strerror (err));
       return err;
     }
 
   /* Allow for an least 8 times larger keyblob to accommodate for
      future key changes.  Round it up to 4096 byte. */
   headerlen = ((32 + 8 * keybloblen + 16) + 4095) / 4096 * 4096;
   paddinglen = headerlen - 32 - keybloblen;
   assert (paddinglen >= 16);
 
   packet[0] = (0xc0|61); /* CTB for the private packet type 0x61.  */
   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
   packet[2] = 0;
   packet[3] = 0;
   packet[4] = 0;
   packet[5] = 26;
   memcpy (packet+6, "GnuPG/G13", 10); /* Packet subtype.  */
   packet[16] = 1;   /* G13 packet format version.  */
   packet[17] = 0;   /* Reserved.  */
   packet[18] = 0;   /* Reserved.  */
   packet[19] = 0;   /* OS Flag.  */
   packet[20] = (headerlen >> 24);  /* Total length of header.  */
   packet[21] = (headerlen >> 16);
   packet[22] = (headerlen >> 8);
   packet[23] = (headerlen);
   packet[24] = 1;   /* Number of header copies.  */
   packet[25] = 0;   /* Number of header copies at the end.  */
   packet[26] = 0;   /* Reserved.  */
   packet[27] = 0;   /* Reserved.  */
   packet[28] = 0;   /* Reserved.  */
   packet[29] = 0;   /* Reserved.  */
   packet[30] = 0;   /* Reserved.  */
   packet[31] = 0;   /* Reserved.  */
 
   if (es_fwrite (packet, 32, 1, fp) != 1)
     goto writeerr;
 
   if (es_fwrite (keyblob, keybloblen, 1, fp) != 1)
     goto writeerr;
 
   /* Write the padding.  */
   packet[0] = (0xc0|61); /* CTB for Private packet type 0x61.  */
   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
   packet[2] = (paddinglen-6) >> 24;
   packet[3] = (paddinglen-6) >> 16;
   packet[4] = (paddinglen-6) >> 8;
   packet[5] = (paddinglen-6);
   memcpy (packet+6, "GnuPG/PAD", 10); /* Packet subtype.  */
   if (es_fwrite (packet, 16, 1, fp) != 1)
     goto writeerr;
   memset (packet, 0, 32);
   for (paddinglen-=16; paddinglen >= 32; paddinglen -= 32)
     if (es_fwrite (packet, 32, 1, fp) != 1)
       goto writeerr;
   if (paddinglen)
     if (es_fwrite (packet, paddinglen, 1, fp) != 1)
       goto writeerr;
 
   if (es_fclose (fp))
     {
       err = gpg_error_from_syserror ();
       log_error ("error closing '%s': %s\n",
                  filename, gpg_strerror (err));
       remove (filename);
       return err;
     }
 
   return 0;
 
 
  writeerr:
   err = gpg_error_from_syserror ();
   log_error ("error writing header to '%s': %s\n",
              filename, gpg_strerror (err));
   es_fclose (fp);
   remove (filename);
   return err;
 }
 
 
 
 /* Create a new container under the name FILENAME and intialize it
-   using the current settings.  KEYS is a list of public keys to which
-   the container will be encrypted.  If the file already exists an
-   error is returned.  */
+   using the current settings.  If the file already exists an error is
+   returned.  */
 gpg_error_t
-g13_create_container (ctrl_t ctrl, const char *filename, strlist_t keys)
+g13_create_container (ctrl_t ctrl, const char *filename)
 {
   gpg_error_t err;
   dotlock_t lock;
   void *keyblob = NULL;
   size_t keybloblen;
   void *enckeyblob = NULL;
   size_t enckeybloblen;
   char *detachedname = NULL;
   int detachedisdir;
   tupledesc_t tuples = NULL;
   unsigned int dummy_rid;
 
-  if (!keys)
+  if (!ctrl->recipients)
     return gpg_error (GPG_ERR_NO_PUBKEY);
 
   err = be_take_lock_for_create (ctrl, filename, &lock);
   if (err)
     goto leave;
 
   /* And a possible detached file or directory may not exist either.  */
   err = be_get_detached_name (ctrl->conttype, filename,
                               &detachedname, &detachedisdir);
   if (err)
     goto leave;
   if (detachedname)
     {
       struct stat sb;
 
       if (!stat (detachedname, &sb))
         {
           err = gpg_error (GPG_ERR_EEXIST);
           goto leave;
         }
     }
 
-  /* Create a new keyblob.  */
-  err = create_new_keyblob (ctrl, !!detachedname, &keyblob, &keybloblen);
-  if (err)
-    goto leave;
-
-  /* Encrypt that keyblob.  */
-  err = encrypt_keyblob (ctrl, keyblob, keybloblen, keys,
-                         &enckeyblob, &enckeybloblen);
-  if (err)
-    goto leave;
-
-  /* Put a copy of the keyblob into a tuple structure.  */
-  err = create_tupledesc (&tuples, keyblob, keybloblen);
-  if (err)
-    goto leave;
-  keyblob = NULL;
-  /* if (opt.verbose) */
-  /*   dump_keyblob (tuples); */
-
-  /* Write out the header, the encrypted keyblob and some padding. */
-  err = write_keyblob (filename, enckeyblob, enckeybloblen);
-  if (err)
-    goto leave;
+  if (ctrl->conttype != CONTTYPE_DM_CRYPT)
+    {
+      /* Create a new keyblob.  */
+      err = create_new_keyblob (ctrl, !!detachedname, &keyblob, &keybloblen);
+      if (err)
+        goto leave;
+
+      /* Encrypt that keyblob.  */
+      err = g13_encrypt_keyblob (ctrl, keyblob, keybloblen,
+                                 &enckeyblob, &enckeybloblen);
+      if (err)
+        goto leave;
+
+      /* Put a copy of the keyblob into a tuple structure.  */
+      err = create_tupledesc (&tuples, keyblob, keybloblen);
+      if (err)
+        goto leave;
+      keyblob = NULL;
+      /* if (opt.verbose) */
+      /*   dump_keyblob (tuples); */
+
+      /* Write out the header, the encrypted keyblob and some padding. */
+      err = write_keyblob (filename, enckeyblob, enckeybloblen);
+      if (err)
+        goto leave;
+    }
 
   /* Create and append the container.  FIXME: We should pass the
      estream object in addition to the filename, so that the backend
      can append the container to the g13 file.  */
   err = be_create_container (ctrl, ctrl->conttype, filename, -1, tuples,
                              &dummy_rid);
 
 
  leave:
   destroy_tupledesc (tuples);
   xfree (detachedname);
   xfree (enckeyblob);
   xfree (keyblob);
   dotlock_destroy (lock);
 
   return err;
 }
diff --git a/g13/create.h b/g13/create.h
index cc4ddfd08..ec4224c40 100644
--- a/g13/create.h
+++ b/g13/create.h
@@ -1,27 +1,29 @@
 /* create.h - Defs to create a new crypto container
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef G13_CREATE_H
 #define G13_CREATE_H
 
-gpg_error_t g13_create_container (ctrl_t ctrl, const char *filename,
-                                  strlist_t keys);
+gpg_error_t g13_encrypt_keyblob (ctrl_t ctrl,
+                                 void *keyblob, size_t keybloblen,
+                                 void **r_encblob, size_t *r_encbloblen);
+gpg_error_t g13_create_container (ctrl_t ctrl, const char *filename);
 
 
 #endif /*G13_CREATE_H*/
diff --git a/g13/g13-syshelp.c b/g13/g13-syshelp.c
index c09a5e917..cbb5f8dbf 100644
--- a/g13/g13-syshelp.c
+++ b/g13/g13-syshelp.c
@@ -1,720 +1,724 @@
 /* g13-syshelp.c - Helper for disk key management with GnuPG
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <ctype.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <limits.h>
 #ifdef HAVE_PWD_H
 # include <pwd.h>
 #endif
 #include <unistd.h>
 
 #include "g13-syshelp.h"
 
 #include <gcrypt.h>
 #include <assuan.h>
 
 #include "i18n.h"
 #include "sysutils.h"
 #include "asshelp.h"
 #include "../common/init.h"
 #include "keyblob.h"
 
 
 enum cmd_and_opt_values {
   aNull = 0,
   oQuiet	= 'q',
   oVerbose	= 'v',
   oRecipient	= 'r',
 
   aGPGConfList  = 500,
 
   oDebug,
   oDebugLevel,
   oDebugAll,
   oDebugNone,
   oDebugWait,
   oDebugAllowCoreDump,
   oLogFile,
   oNoLogFile,
   oAuditLog,
 
   oOutput,
 
   oAgentProgram,
   oGpgProgram,
   oType,
 
   oDisplay,
   oTTYname,
   oTTYtype,
   oLCctype,
   oLCmessages,
   oXauthority,
 
   oStatusFD,
   oLoggerFD,
 
   oNoVerbose,
   oNoSecmemWarn,
   oHomedir,
   oDryRun,
   oNoDetach,
 
   oNoRandomSeedFile,
   oFakedSystemTime
  };
 
 
 static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_s_n (oDryRun, "dry-run", N_("do not make any changes")),
 
   ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
   ARGPARSE_s_n (oQuiet,	"quiet",  N_("be somewhat more quiet")),
 
   ARGPARSE_s_s (oDebug, "debug", "@"),
   ARGPARSE_s_s (oDebugLevel, "debug-level",
                 N_("|LEVEL|set the debugging level to LEVEL")),
   ARGPARSE_s_n (oDebugAll, "debug-all", "@"),
   ARGPARSE_s_n (oDebugNone, "debug-none", "@"),
   ARGPARSE_s_i (oDebugWait, "debug-wait", "@"),
   ARGPARSE_s_n (oDebugAllowCoreDump, "debug-allow-core-dump", "@"),
 
   ARGPARSE_end ()
 };
 
 
 /* The list of supported debug flags.  */
 static struct debug_flags_s debug_flags [] =
   {
     { DBG_MOUNT_VALUE  , "mount"  },
     { DBG_CRYPTO_VALUE , "crypto"  },
     { DBG_MEMORY_VALUE , "memory"  },
     { DBG_MEMSTAT_VALUE, "memstat" },
     { DBG_IPC_VALUE    , "ipc"     },
     { 0, NULL }
   };
 
 
 /* The timer tick interval used by the idle task.  */
 #define TIMERTICK_INTERVAL_SEC     (1)
 
 /* It is possible that we are currently running under setuid permissions.  */
 static int maybe_setuid = 1;
 
 /* Helper to implement --debug-level and --debug.  */
 static const char *debug_level;
 static unsigned int debug_value;
 
 
 /* Local prototypes.  */
 static void g13_syshelp_deinit_default_ctrl (ctrl_t ctrl);
 static void release_tab_items (tab_item_t tab);
 static tab_item_t parse_g13tab (const char *username);
 
 
 
 static const char *
 my_strusage( int level )
 {
   const char *p;
 
   switch (level)
     {
     case 11: p = "@G13@-syshelp (@GNUPG@)";
       break;
     case 13: p = VERSION; break;
     case 17: p = PRINTABLE_OS_NAME; break;
     case 19: p = _("Please report bugs to <" PACKAGE_BUGREPORT ">.\n");
       break;
     case 1:
     case 40: p = _("Usage: @G13@-syshelp [options] [files] (-h for help)");
       break;
     case 41:
       p = _("Syntax: @G13@-syshelp [options] [files]\n"
             "Helper to perform root-only tasks for g13\n");
       break;
 
     case 31: p = "\nHome: "; break;
     case 32: p = opt.homedir; break;
 
     default: p = NULL; break;
     }
   return p;
 }
 
 
 /* Setup the debugging.  With a DEBUG_LEVEL of NULL only the active
    debug flags are propagated to the subsystems.  With DEBUG_LEVEL
    set, a specific set of debug flags is set; and individual debugging
    flags will be added on top.  */
 static void
 set_debug (void)
 {
   int numok = (debug_level && digitp (debug_level));
   int numlvl = numok? atoi (debug_level) : 0;
 
   if (!debug_level)
     ;
   else if (!strcmp (debug_level, "none") || (numok && numlvl < 1))
     opt.debug = 0;
   else if (!strcmp (debug_level, "basic") || (numok && numlvl <= 2))
     opt.debug = DBG_IPC_VALUE|DBG_MOUNT_VALUE;
   else if (!strcmp (debug_level, "advanced") || (numok && numlvl <= 5))
     opt.debug = DBG_IPC_VALUE|DBG_MOUNT_VALUE;
   else if (!strcmp (debug_level, "expert") || (numok && numlvl <= 8))
     opt.debug = (DBG_IPC_VALUE|DBG_MOUNT_VALUE|DBG_CRYPTO_VALUE);
   else if (!strcmp (debug_level, "guru") || numok)
     {
       opt.debug = ~0;
       /* if (numok) */
       /*   opt.debug &= ~(DBG_HASHING_VALUE); */
     }
   else
     {
       log_error (_("invalid debug-level '%s' given\n"), debug_level);
       g13_exit(2);
     }
 
   opt.debug |= debug_value;
 
   if (opt.debug && !opt.verbose)
     opt.verbose = 1;
   if (opt.debug)
     opt.quiet = 0;
 
   if (opt.debug & DBG_CRYPTO_VALUE )
     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1);
   gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
 
   if (opt.debug)
     parse_debug_flag (NULL, &opt.debug, debug_flags);
 }
 
 
 int
 main ( int argc, char **argv)
 {
   ARGPARSE_ARGS pargs;
   int orig_argc;
   char **orig_argv;
   gpg_error_t err = 0;
   /* const char *fname; */
   int may_coredump;
   FILE *configfp = NULL;
   char *configname = NULL;
   unsigned configlineno;
   int parse_debug = 0;
   int no_more_options = 0;
   int default_config =1;
   char *logfile = NULL;
   /* int debug_wait = 0; */
   int use_random_seed = 1;
   /* int nodetach = 0; */
   /* int nokeysetup = 0; */
   struct server_control_s ctrl;
 
   /*mtrace();*/
 
   early_system_init ();
   gnupg_reopen_std (G13_NAME "-syshelp");
   set_strusage (my_strusage);
   gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
 
   log_set_prefix (G13_NAME "-syshelp", 1);
 
   /* Make sure that our subsystems are ready.  */
   i18n_init ();
   init_common_subsystems (&argc, &argv);
 
   /* Check that the Libgcrypt is suitable.  */
   if (!gcry_check_version (NEED_LIBGCRYPT_VERSION) )
     log_fatal (_("%s is too old (need %s, have %s)\n"), "libgcrypt",
                NEED_LIBGCRYPT_VERSION, gcry_check_version (NULL) );
 
   /* Take extra care of the random pool.  */
   gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
 
   may_coredump = disable_core_dumps ();
 
   g13_init_signals ();
 
   dotlock_create (NULL, 0); /* Register locking cleanup.  */
 
   opt.session_env = session_env_new ();
   if (!opt.session_env)
     log_fatal ("error allocating session environment block: %s\n",
                strerror (errno));
 
   opt.homedir = default_homedir ();
+  /* Fixme: We enable verbose mode here because there is currently no
+     way to do this when starting g13-syshelp.  To fix that we should
+     add a g13-syshelp.conf file in /etc/gnupg.  */
+  opt.verbose = 1;
 
   /* First check whether we have a debug option on the commandline.  */
   orig_argc = argc;
   orig_argv = argv;
   pargs.argc = &argc;
   pargs.argv = &argv;
   pargs.flags= (ARGPARSE_FLAG_KEEP | ARGPARSE_FLAG_NOVERSION);
   while (arg_parse( &pargs, opts))
     {
       if (pargs.r_opt == oDebug || pargs.r_opt == oDebugAll)
         parse_debug++;
     }
 
   /* Initialize the secure memory. */
   gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
   maybe_setuid = 0;
 
   /*
      Now we are now working under our real uid
   */
 
   /* Setup malloc hooks. */
   {
     struct assuan_malloc_hooks malloc_hooks;
 
     malloc_hooks.malloc = gcry_malloc;
     malloc_hooks.realloc = gcry_realloc;
     malloc_hooks.free = gcry_free;
     assuan_set_malloc_hooks (&malloc_hooks);
   }
 
   /* Prepare libassuan.  */
   assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
   /*assuan_set_system_hooks (ASSUAN_SYSTEM_NPTH);*/
   setup_libassuan_logging (&opt.debug);
 
   /* Setup a default control structure for command line mode.  */
   memset (&ctrl, 0, sizeof ctrl);
   g13_syshelp_init_default_ctrl (&ctrl);
   ctrl.no_server = 1;
   ctrl.status_fd = -1; /* No status output. */
 
   if (default_config )
     configname = make_filename (gnupg_sysconfdir (),
                                 G13_NAME"-syshelp.conf", NULL);
 
   argc        = orig_argc;
   argv        = orig_argv;
   pargs.argc  = &argc;
   pargs.argv  = &argv;
   pargs.flags =  1;  /* Do not remove the args.  */
 
  next_pass:
   if (configname)
     {
       configlineno = 0;
       configfp = fopen (configname, "r");
       if (!configfp)
         {
           if (default_config)
             {
               if (parse_debug)
                 log_info (_("NOTE: no default option file '%s'\n"), configname);
             }
           else
             {
               log_error (_("option file '%s': %s\n"),
                          configname, strerror(errno));
               g13_exit(2);
             }
           xfree (configname);
           configname = NULL;
         }
       if (parse_debug && configname)
         log_info (_("reading options from '%s'\n"), configname);
       default_config = 0;
     }
 
   while (!no_more_options
          && optfile_parse (configfp, configname, &configlineno, &pargs, opts))
     {
       switch (pargs.r_opt)
         {
         case oQuiet: opt.quiet = 1; break;
 
         case oDryRun: opt.dry_run = 1; break;
 
         case oVerbose:
           opt.verbose++;
           gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
           break;
         case oNoVerbose:
           opt.verbose = 0;
           gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
           break;
 
         case oLogFile: logfile = pargs.r.ret_str; break;
         case oNoLogFile: logfile = NULL; break;
 
         case oNoDetach: /*nodetach = 1; */break;
 
         case oDebug:
           if (parse_debug_flag (pargs.r.ret_str, &opt.debug, debug_flags))
             {
               pargs.r_opt = ARGPARSE_INVALID_ARG;
               pargs.err = ARGPARSE_PRINT_ERROR;
             }
             break;
         case oDebugAll: debug_value = ~0; break;
         case oDebugNone: debug_value = 0; break;
         case oDebugLevel: debug_level = pargs.r.ret_str; break;
         case oDebugWait: /*debug_wait = pargs.r.ret_int; */break;
         case oDebugAllowCoreDump:
           may_coredump = enable_core_dumps ();
           break;
 
         case oStatusFD: ctrl.status_fd = pargs.r.ret_int; break;
         case oLoggerFD: log_set_fd (pargs.r.ret_int ); break;
 
         case oHomedir: opt.homedir = pargs.r.ret_str; break;
 
         case oFakedSystemTime:
           {
             time_t faked_time = isotime2epoch (pargs.r.ret_str);
             if (faked_time == (time_t)(-1))
               faked_time = (time_t)strtoul (pargs.r.ret_str, NULL, 10);
             gnupg_set_time (faked_time, 0);
           }
           break;
 
         case oNoSecmemWarn: gcry_control (GCRYCTL_DISABLE_SECMEM_WARN); break;
 
         case oNoRandomSeedFile: use_random_seed = 0; break;
 
         default:
           pargs.err = configfp? ARGPARSE_PRINT_WARNING:ARGPARSE_PRINT_ERROR;
           break;
 	}
     }
 
   if (configfp)
     {
       fclose (configfp);
       configfp = NULL;
       /* Keep a copy of the config filename. */
       opt.config_filename = configname;
       configname = NULL;
       goto next_pass;
     }
   xfree (configname);
   configname = NULL;
 
   if (!opt.config_filename)
     opt.config_filename = make_filename (opt.homedir, G13_NAME".conf", NULL);
 
   if (log_get_errorcount(0))
     g13_exit(2);
 
   /* Now that we have the options parsed we need to update the default
      control structure.  */
   g13_syshelp_init_default_ctrl (&ctrl);
 
   if (may_coredump && !opt.quiet)
     log_info (_("WARNING: program may create a core file!\n"));
 
   if (logfile)
     {
       log_set_file (logfile);
       log_set_prefix (NULL, 1|2|4);
     }
 
   if (gnupg_faked_time_p ())
     {
       gnupg_isotime_t tbuf;
 
       log_info (_("WARNING: running with faked system time: "));
       gnupg_get_isotime (tbuf);
       dump_isotime (tbuf);
       log_printf ("\n");
     }
 
   /* Print any pending secure memory warnings.  */
   gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
 
   /* Setup the debug flags for all subsystems.  */
   set_debug ();
 
   /* Install a regular exit handler to make real sure that the secure
      memory gets wiped out.  */
   g13_install_emergency_cleanup ();
 
   /* Terminate if we found any error until now.  */
   if (log_get_errorcount(0))
     g13_exit (2);
 
   /* Set the standard GnuPG random seed file.  */
   if (use_random_seed)
     {
       char *p = make_filename (opt.homedir, "random_seed", NULL);
       gcry_control (GCRYCTL_SET_RANDOM_SEED_FILE, p);
       xfree(p);
     }
 
   /* Get the UID of the caller.  */
 #if defined(HAVE_PWD_H) && defined(HAVE_GETPWUID)
   {
     const char *uidstr;
     struct passwd *pwd = NULL;
 
     uidstr = getenv ("USERV_UID");
 
     /* Print a quick note if we are not started via userv.  */
     if (!uidstr)
       {
         if (getuid ())
           {
             log_info ("WARNING: Not started via userv\n");
             ctrl.fail_all_cmds = 1;
           }
         ctrl.client.uid = getuid ();
       }
     else
       {
         unsigned long myuid;
 
         errno = 0;
         myuid = strtoul (uidstr, NULL, 10);
         if (myuid == ULONG_MAX && errno)
           {
             log_info ("WARNING: Started via broken userv: %s\n",
                       strerror (errno));
             ctrl.fail_all_cmds = 1;
             ctrl.client.uid = getuid ();
           }
         else
           ctrl.client.uid = (uid_t)myuid;
       }
 
       pwd = getpwuid (ctrl.client.uid);
       if (!pwd || !*pwd->pw_name)
         {
           log_info ("WARNING: Name for UID not found: %s\n", strerror (errno));
           ctrl.fail_all_cmds = 1;
           ctrl.client.uname = xstrdup ("?");
         }
       else
         ctrl.client.uname = xstrdup (pwd->pw_name);
   }
 #else /*!HAVE_PWD_H || !HAVE_GETPWUID*/
   log_info ("WARNING: System does not support required syscalls\n");
   ctrl.fail_all_cmds = 1;
   ctrl.client.uid = getuid ();
   ctrl.client.uname = xstrdup ("?");
 #endif /*!HAVE_PWD_H || !HAVE_GETPWUID*/
 
   /* Read the table entries for this user.  */
   if (!ctrl.fail_all_cmds
       && !(ctrl.client.tab = parse_g13tab (ctrl.client.uname)))
     ctrl.fail_all_cmds = 1;
 
   /* Start the server.  */
   err = syshelp_server (&ctrl);
   if (err)
     log_error ("server exited with error: %s <%s>\n",
                gpg_strerror (err), gpg_strsource (err));
 
   /* Cleanup.  */
   g13_syshelp_deinit_default_ctrl (&ctrl);
   g13_exit (0);
   return 8; /*NOTREACHED*/
 }
 
 
 /* Store defaults into the per-connection CTRL object.  */
 void
 g13_syshelp_init_default_ctrl (ctrl_t ctrl)
 {
   ctrl->conttype = CONTTYPE_DM_CRYPT;
 }
 
 /* Release all resources allocated by default in the CTRl object.  */
 static void
 g13_syshelp_deinit_default_ctrl (ctrl_t ctrl)
 {
   xfree (ctrl->client.uname);
   release_tab_items (ctrl->client.tab);
 }
 
 
 /* Release the list of g13tab itejms at TAB.  */
 static void
 release_tab_items (tab_item_t tab)
 {
   while (tab)
     {
       tab_item_t next = tab->next;
       xfree (tab->mountpoint);
       xfree (tab);
       tab = next;
     }
 }
 
 
 /* Parse the /etc/gnupg/g13tab for user USERNAME.  Return a table for
    the user on success.  Return NULL on error and print
    diagnostics. */
 static tab_item_t
 parse_g13tab (const char *username)
 {
   gpg_error_t err;
   int c, n;
   char line[512];
   char *p;
   char *fname;
   estream_t fp;
   int lnr;
   char **words = NULL;
   tab_item_t table = NULL;
   tab_item_t *tabletail, ti;
 
   fname = make_filename (gnupg_sysconfdir (), G13_NAME"tab", NULL);
   fp = es_fopen (fname, "r");
   if (!fp)
     {
       err = gpg_error_from_syserror ();
       log_error (_("error opening '%s': %s\n"), fname, gpg_strerror (err));
       goto leave;
     }
 
   tabletail = &table;
   err = 0;
   lnr = 0;
   while (es_fgets (line, DIM(line)-1, fp))
     {
       lnr++;
       n = strlen (line);
       if (!n || line[n-1] != '\n')
         {
           /* Eat until end of line. */
           while ((c=es_getc (fp)) != EOF && c != '\n')
             ;
           err = gpg_error (*line? GPG_ERR_LINE_TOO_LONG
                            : GPG_ERR_INCOMPLETE_LINE);
           log_error (_("file '%s', line %d: %s\n"),
                      fname, lnr, gpg_strerror (err));
           continue;
         }
       line[--n] = 0; /* Chop the LF. */
       if (n && line[n-1] == '\r')
         line[--n] = 0; /* Chop an optional CR. */
 
       /* Allow for empty lines and spaces */
       for (p=line; spacep (p); p++)
         ;
       if (!*p || *p == '#')
         continue;
 
       /* Parse the line.  The format is
        * <username> <blockdev> [<label>|"-" [<mountpoint>]]
        */
       xfree (words);
       words = strtokenize (p, " \t");
       if (!words)
         {
           err = gpg_error_from_syserror ();
           break;
         }
       if (!words[0] || !words[1])
         {
           log_error (_("file '%s', line %d: %s\n"),
                      fname, lnr, gpg_strerror (GPG_ERR_SYNTAX));
           continue;
         }
       if (!(*words[1] == '/'
             || !strncmp (words[1], "PARTUUID=", 9)
             || !strncmp (words[1], "partuuid=", 9)))
         {
           log_error (_("file '%s', line %d: %s\n"),
                      fname, lnr, "Invalid block device syntax");
           continue;
         }
       if (words[2])
         {
           if (strlen (words[2]) > 16 || strchr (words[2], '/'))
             {
               log_error (_("file '%s', line %d: %s\n"),
                          fname, lnr, "Label too long or invalid syntax");
               continue;
             }
 
           if (words[3] && *words[3] != '/')
             {
               log_error (_("file '%s', line %d: %s\n"),
                          fname, lnr, "Invalid mountpoint syntax");
               continue;
             }
         }
       if (strcmp (words[0], username))
         continue; /* Skip entries for other usernames!  */
 
       ti = xtrymalloc (sizeof *ti + strlen (words[1]));
       if (!ti)
         {
           err = gpg_error_from_syserror ();
           break;
         }
       ti->next = NULL;
       ti->label = NULL;
       ti->mountpoint = NULL;
       strcpy (ti->blockdev, *words[1]=='/'? words[1] : words[1]+9);
       if (words[2])
         {
           if (strcmp (words[2], "-")
               && !(ti->label = xtrystrdup (words[2])))
             {
               err = gpg_error_from_syserror ();
               xfree (ti);
               break;
             }
           if (words[3] && !(ti->mountpoint = xtrystrdup (words[3])))
             {
               err = gpg_error_from_syserror ();
               xfree (ti->label);
               xfree (ti);
               break;
             }
         }
       *tabletail = ti;
       tabletail = &ti->next;
     }
 
   if (!err && !es_feof (fp))
     err = gpg_error_from_syserror ();
   if (err)
     log_error (_("error reading '%s', line %d: %s\n"),
                fname, lnr, gpg_strerror (err));
 
  leave:
   xfree (words);
   es_fclose (fp);
   xfree (fname);
   if (err)
     {
       release_tab_items (table);
       return NULL;
     }
   return table;
 }
diff --git a/g13/g13-syshelp.h b/g13/g13-syshelp.h
index 5a2055eb1..0503079cd 100644
--- a/g13/g13-syshelp.h
+++ b/g13/g13-syshelp.h
@@ -1,88 +1,90 @@
 /* g130syshelp.h - Global definitions for G13-SYSHELP.
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef G13_SYSHELP_H
 #define G13_SYSHELP_H
 
 #include "g13-common.h"
-
+#include "g13tuple.h"
 
 struct tab_item_s;
 typedef struct tab_item_s *tab_item_t;
 
 struct tab_item_s
 {
   tab_item_t next;
   char *label;       /* Optional malloced label for that entry.  */
   char *mountpoint;  /* NULL or a malloced mountpoint.  */
   char blockdev[1];  /* String with the name of the block device.  If
                         it starts with a slash is is a regular device
                         name, otherwise it is a PARTUUID.  */
 };
 
 
 
 /* Forward declaration for an object defined in g13-sh-cmd.c.  */
 struct server_local_s;
 
 /* Session control object.  This object is passed down to most
    functions.  The default values for it are set by
    g13_syshelp_init_default_ctrl(). */
 struct server_control_s
 {
   int no_server;      /* We are not running under server control */
   int  status_fd;     /* Only for non-server mode */
   struct server_local_s *server_local;
 
   struct {
     uid_t uid;     /* UID of the client calling use.  */
     char *uname;
     tab_item_t tab;/* Linked list with the g13tab items for this user.  */
   } client;
 
   /* Flag indicating that we should fail all commands.  */
   int fail_all_cmds;
 
   /* Type of the current container.  See the CONTTYPE_ constants.  */
   int conttype;
 
   /* A pointer into client.tab with the selected tab line or NULL. */
   tab_item_t devti;
 };
 
 
 /*-- g13-syshelp.c --*/
 void g13_syshelp_init_default_ctrl (struct server_control_s *ctrl);
 
 /*-- sh-cmd.c --*/
 gpg_error_t syshelp_server (ctrl_t ctrl);
 gpg_error_t sh_encrypt_keyblob (ctrl_t ctrl,
                                 const void *keyblob, size_t keybloblen,
                                 char **r_enckeyblob, size_t *r_enckeybloblen);
 
 /*-- sh-blockdev.c --*/
 gpg_error_t sh_blockdev_getsz (const char *name, unsigned long long *r_nblocks);
 gpg_error_t sh_is_empty_partition (const char *name);
 
 /*-- sh-dmcrypt.c --*/
 gpg_error_t sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname,
                                          estream_t devfp);
+gpg_error_t sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
+                                        tupledesc_t keyblob);
 
 
 #endif /*G13_SYSHELP_H*/
diff --git a/g13/g13.c b/g13/g13.c
index d9d40982a..b8a2dda6c 100644
--- a/g13/g13.c
+++ b/g13/g13.c
@@ -1,999 +1,1013 @@
 /* g13.c - Disk Key management with GnuPG
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <ctype.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <npth.h>
 
 #include "g13.h"
 
 #include <gcrypt.h>
 #include <assuan.h>
 
 #include "i18n.h"
 #include "sysutils.h"
 #include "gc-opt-flags.h"
 #include "asshelp.h"
 #include "../common/init.h"
 #include "keyblob.h"
 #include "server.h"
 #include "runner.h"
 #include "create.h"
 #include "mount.h"
 #include "mountinfo.h"
 #include "backend.h"
 #include "call-syshelp.h"
 
 
 enum cmd_and_opt_values {
   aNull = 0,
   oQuiet	= 'q',
   oVerbose	= 'v',
   oRecipient	= 'r',
 
   aGPGConfList  = 500,
   aGPGConfTest,
   aCreate,
   aMount,
   aUmount,
   aServer,
 
   oOptions,
   oDebug,
   oDebugLevel,
   oDebugAll,
   oDebugNone,
   oDebugWait,
   oDebugAllowCoreDump,
   oLogFile,
   oNoLogFile,
   oAuditLog,
 
   oOutput,
 
   oAgentProgram,
   oGpgProgram,
   oType,
 
   oDisplay,
   oTTYname,
   oTTYtype,
   oLCctype,
   oLCmessages,
   oXauthority,
 
   oStatusFD,
   oLoggerFD,
 
   oNoVerbose,
   oNoSecmemWarn,
   oNoGreeting,
   oNoTTY,
   oNoOptions,
   oHomedir,
   oWithColons,
   oDryRun,
   oNoDetach,
 
   oNoRandomSeedFile,
   oFakedSystemTime
  };
 
 
 static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_group (300, N_("@Commands:\n ")),
 
   ARGPARSE_c (aCreate, "create", N_("Create a new file system container")),
   ARGPARSE_c (aMount,  "mount",  N_("Mount a file system container") ),
   ARGPARSE_c (aUmount, "umount", N_("Unmount a file system container") ),
   ARGPARSE_c (aServer, "server", N_("Run in server mode")),
 
   ARGPARSE_c (aGPGConfList, "gpgconf-list", "@"),
   ARGPARSE_c (aGPGConfTest, "gpgconf-test", "@"),
 
   ARGPARSE_group (301, N_("@\nOptions:\n ")),
 
   ARGPARSE_s_s (oRecipient, "recipient", N_("|USER-ID|encrypt for USER-ID")),
   ARGPARSE_s_s (oType, "type", N_("|NAME|use container format NAME")),
 
   ARGPARSE_s_s (oOutput, "output", N_("|FILE|write output to FILE")),
   ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
   ARGPARSE_s_n (oQuiet,	"quiet",  N_("be somewhat more quiet")),
   ARGPARSE_s_n (oNoTTY, "no-tty", N_("don't use the terminal at all")),
   ARGPARSE_s_n (oNoDetach, "no-detach", N_("do not detach from the console")),
   ARGPARSE_s_s (oLogFile, "log-file",  N_("|FILE|write log output to FILE")),
   ARGPARSE_s_n (oNoLogFile, "no-log-file", "@"),
   ARGPARSE_s_i (oLoggerFD, "logger-fd", "@"),
 
   ARGPARSE_s_n (oDryRun, "dry-run", N_("do not make any changes")),
 
   ARGPARSE_s_s (oOptions, "options", N_("|FILE|read options from FILE")),
 
   ARGPARSE_s_s (oDebug, "debug", "@"),
   ARGPARSE_s_s (oDebugLevel, "debug-level",
                 N_("|LEVEL|set the debugging level to LEVEL")),
   ARGPARSE_s_n (oDebugAll, "debug-all", "@"),
   ARGPARSE_s_n (oDebugNone, "debug-none", "@"),
   ARGPARSE_s_i (oDebugWait, "debug-wait", "@"),
   ARGPARSE_s_n (oDebugAllowCoreDump, "debug-allow-core-dump", "@"),
 
   ARGPARSE_s_i (oStatusFD, "status-fd",
                 N_("|FD|write status info to this FD")),
 
   ARGPARSE_group (302, N_(
   "@\n(See the man page for a complete listing of all commands and options)\n"
   )),
 
   ARGPARSE_group (303, N_("@\nExamples:\n\n"
     " blurb\n"
                           " blurb\n")),
 
   /* Hidden options. */
   ARGPARSE_s_n (oNoVerbose, "no-verbose", "@"),
   ARGPARSE_s_n (oNoSecmemWarn, "no-secmem-warning", "@"),
   ARGPARSE_s_n (oNoGreeting, "no-greeting", "@"),
   ARGPARSE_s_n (oNoOptions, "no-options", "@"),
   ARGPARSE_s_s (oHomedir, "homedir", "@"),
   ARGPARSE_s_s (oAgentProgram, "agent-program", "@"),
   ARGPARSE_s_s (oGpgProgram, "gpg-program", "@"),
   ARGPARSE_s_s (oDisplay,    "display", "@"),
   ARGPARSE_s_s (oTTYname,    "ttyname", "@"),
   ARGPARSE_s_s (oTTYtype,    "ttytype", "@"),
   ARGPARSE_s_s (oLCctype,    "lc-ctype", "@"),
   ARGPARSE_s_s (oLCmessages, "lc-messages", "@"),
   ARGPARSE_s_s (oXauthority, "xauthority", "@"),
   ARGPARSE_s_s (oFakedSystemTime, "faked-system-time", "@"),
   ARGPARSE_s_n (oWithColons, "with-colons", "@"),
   ARGPARSE_s_n (oNoRandomSeedFile,  "no-random-seed-file", "@"),
 
   /* Command aliases.  */
 
   ARGPARSE_end ()
 };
 
 
 /* The list of supported debug flags.  */
 static struct debug_flags_s debug_flags [] =
   {
     { DBG_MOUNT_VALUE  , "mount"  },
     { DBG_CRYPTO_VALUE , "crypto"  },
     { DBG_MEMORY_VALUE , "memory"  },
     { DBG_MEMSTAT_VALUE, "memstat" },
     { DBG_IPC_VALUE    , "ipc"     },
     { 0, NULL }
   };
 
 
 /* The timer tick interval used by the idle task.  */
 #define TIMERTICK_INTERVAL_SEC     (1)
 
 /* It is possible that we are currently running under setuid permissions.  */
 static int maybe_setuid = 1;
 
 /* Helper to implement --debug-level and --debug.  */
 static const char *debug_level;
 static unsigned int debug_value;
 
 /* Flag to indicate that a shutdown was requested.  */
 static int shutdown_pending;
 
 /* The thread id of the idle task.  */
 static npth_t idle_task_thread;
 
 
 /* The container type as specified on the command line.  */
 static int cmdline_conttype;
 
 
 
 static void set_cmd (enum cmd_and_opt_values *ret_cmd,
                      enum cmd_and_opt_values new_cmd );
 
 static void start_idle_task (void);
 static void join_idle_task (void);
 
 
 /* Begin NPth wrapper functions. */
 ASSUAN_SYSTEM_NPTH_IMPL;
 
 
 static const char *
 my_strusage( int level )
 {
   const char *p;
 
   switch (level)
     {
     case 11: p = "@G13@ (@GNUPG@)";
       break;
     case 13: p = VERSION; break;
     case 17: p = PRINTABLE_OS_NAME; break;
     case 19: p = _("Please report bugs to <" PACKAGE_BUGREPORT ">.\n");
       break;
     case 1:
     case 40: p = _("Usage: @G13@ [options] [files] (-h for help)");
       break;
     case 41:
       p = _("Syntax: @G13@ [options] [files]\n"
             "Create, mount or unmount an encrypted file system container\n");
       break;
 
     case 31: p = "\nHome: "; break;
     case 32: p = opt.homedir; break;
 
     default: p = NULL; break;
     }
   return p;
 }
 
 
 static void
 wrong_args (const char *text)
 {
   fprintf (stderr, _("usage: %s [options] "), G13_NAME);
   fputs (text, stderr);
   putc ('\n', stderr);
   g13_exit (2);
 }
 
 
 /* Setup the debugging.  With a DEBUG_LEVEL of NULL only the active
    debug flags are propagated to the subsystems.  With DEBUG_LEVEL
    set, a specific set of debug flags is set; and individual debugging
    flags will be added on top.  */
 static void
 set_debug (void)
 {
   int numok = (debug_level && digitp (debug_level));
   int numlvl = numok? atoi (debug_level) : 0;
 
   if (!debug_level)
     ;
   else if (!strcmp (debug_level, "none") || (numok && numlvl < 1))
     opt.debug = 0;
   else if (!strcmp (debug_level, "basic") || (numok && numlvl <= 2))
     opt.debug = DBG_IPC_VALUE|DBG_MOUNT_VALUE;
   else if (!strcmp (debug_level, "advanced") || (numok && numlvl <= 5))
     opt.debug = DBG_IPC_VALUE|DBG_MOUNT_VALUE;
   else if (!strcmp (debug_level, "expert") || (numok && numlvl <= 8))
     opt.debug = (DBG_IPC_VALUE|DBG_MOUNT_VALUE|DBG_CRYPTO_VALUE);
   else if (!strcmp (debug_level, "guru") || numok)
     {
       opt.debug = ~0;
       /* if (numok) */
       /*   opt.debug &= ~(DBG_HASHING_VALUE); */
     }
   else
     {
       log_error (_("invalid debug-level '%s' given\n"), debug_level);
       g13_exit(2);
     }
 
   opt.debug |= debug_value;
 
   if (opt.debug && !opt.verbose)
     opt.verbose = 1;
   if (opt.debug)
     opt.quiet = 0;
 
   if (opt.debug & DBG_CRYPTO_VALUE )
     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1);
   gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
 
   if (opt.debug)
     parse_debug_flag (NULL, &opt.debug, debug_flags);
 }
 
 
 
 static void
 set_cmd (enum cmd_and_opt_values *ret_cmd, enum cmd_and_opt_values new_cmd)
 {
   enum cmd_and_opt_values cmd = *ret_cmd;
 
   if (!cmd || cmd == new_cmd)
     cmd = new_cmd;
   else
     {
       log_error (_("conflicting commands\n"));
       g13_exit (2);
     }
 
   *ret_cmd = cmd;
 }
 
 
 int
 main ( int argc, char **argv)
 {
   ARGPARSE_ARGS pargs;
   int orig_argc;
   char **orig_argv;
   gpg_error_t err = 0;
   /* const char *fname; */
   int may_coredump;
   FILE *configfp = NULL;
   char *configname = NULL;
   unsigned configlineno;
   int parse_debug = 0;
   int no_more_options = 0;
   int default_config =1;
   char *logfile = NULL;
   int greeting = 0;
   int nogreeting = 0;
   /* int debug_wait = 0; */
   int use_random_seed = 1;
   /* int nodetach = 0; */
   /* int nokeysetup = 0; */
   enum cmd_and_opt_values cmd = 0;
   struct server_control_s ctrl;
   strlist_t recipients = NULL;
 
   /*mtrace();*/
 
   early_system_init ();
   gnupg_reopen_std (G13_NAME);
   set_strusage (my_strusage);
   gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
 
   log_set_prefix (G13_NAME, 1);
 
   /* Make sure that our subsystems are ready.  */
   i18n_init ();
   init_common_subsystems (&argc, &argv);
 
   npth_init ();
 
   /* Check that the Libgcrypt is suitable.  */
   if (!gcry_check_version (NEED_LIBGCRYPT_VERSION) )
     log_fatal (_("%s is too old (need %s, have %s)\n"), "libgcrypt",
                NEED_LIBGCRYPT_VERSION, gcry_check_version (NULL) );
 
   /* Take extra care of the random pool.  */
   gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
 
   may_coredump = disable_core_dumps ();
 
   g13_init_signals ();
 
   dotlock_create (NULL, 0); /* Register locking cleanup.  */
 
   opt.session_env = session_env_new ();
   if (!opt.session_env)
     log_fatal ("error allocating session environment block: %s\n",
                strerror (errno));
 
   opt.homedir = default_homedir ();
 
   /* First check whether we have a config file on the commandline.  */
   orig_argc = argc;
   orig_argv = argv;
   pargs.argc = &argc;
   pargs.argv = &argv;
   pargs.flags= 1|(1<<6);  /* Do not remove the args, ignore version.  */
   while (arg_parse( &pargs, opts))
     {
       if (pargs.r_opt == oDebug || pargs.r_opt == oDebugAll)
         parse_debug++;
       else if (pargs.r_opt == oOptions)
         { /* Yes, there is one, so we do not try the default one but
              read the config file when it is encountered at the
              commandline.  */
           default_config = 0;
 	}
       else if (pargs.r_opt == oNoOptions)
         default_config = 0; /* --no-options */
       else if (pargs.r_opt == oHomedir)
         opt.homedir = pargs.r.ret_str;
     }
 
   /* Initialize the secure memory. */
   gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
   maybe_setuid = 0;
 
   /*
      Now we are now working under our real uid
   */
 
   /* Setup malloc hooks. */
   {
     struct assuan_malloc_hooks malloc_hooks;
 
     malloc_hooks.malloc = gcry_malloc;
     malloc_hooks.realloc = gcry_realloc;
     malloc_hooks.free = gcry_free;
     assuan_set_malloc_hooks (&malloc_hooks);
   }
 
   /* Prepare libassuan.  */
   assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
   assuan_set_system_hooks (ASSUAN_SYSTEM_NPTH);
   setup_libassuan_logging (&opt.debug);
 
   /* Setup a default control structure for command line mode.  */
   memset (&ctrl, 0, sizeof ctrl);
   g13_init_default_ctrl (&ctrl);
   ctrl.no_server = 1;
   ctrl.status_fd = -1; /* No status output. */
 
   /* Set the default option file */
   if (default_config )
     configname = make_filename (opt.homedir, G13_NAME".conf", NULL);
 
   argc        = orig_argc;
   argv        = orig_argv;
   pargs.argc  = &argc;
   pargs.argv  = &argv;
   pargs.flags =  1;  /* Do not remove the args.  */
 
  next_pass:
   if (configname)
     {
       configlineno = 0;
       configfp = fopen (configname, "r");
       if (!configfp)
         {
           if (default_config)
             {
               if (parse_debug)
-                log_info (_("NOTE: no default option file '%s'\n"), configname);
+                log_info (_("Note: no default option file '%s'\n"), configname);
             }
           else
             {
               log_error (_("option file '%s': %s\n"),
                          configname, strerror(errno));
               g13_exit(2);
             }
           xfree (configname);
           configname = NULL;
         }
       if (parse_debug && configname)
         log_info (_("reading options from '%s'\n"), configname);
       default_config = 0;
     }
 
   while (!no_more_options
          && optfile_parse (configfp, configname, &configlineno, &pargs, opts))
     {
       switch (pargs.r_opt)
         {
 	case aGPGConfList:
 	case aGPGConfTest:
           set_cmd (&cmd, pargs.r_opt);
           nogreeting = 1;
           /* nokeysetup = 1; */
           break;
 
         case aServer:
         case aMount:
         case aUmount:
           /* nokeysetup = 1; */
         case aCreate:
           set_cmd (&cmd, pargs.r_opt);
           break;
 
         case oOutput: opt.outfile = pargs.r.ret_str; break;
 
         case oQuiet: opt.quiet = 1; break;
         case oNoGreeting: nogreeting = 1; break;
         case oNoTTY:  break;
 
         case oDryRun: opt.dry_run = 1; break;
 
         case oVerbose:
           opt.verbose++;
           gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
           break;
         case oNoVerbose:
           opt.verbose = 0;
           gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
           break;
 
         case oLogFile: logfile = pargs.r.ret_str; break;
         case oNoLogFile: logfile = NULL; break;
 
         case oNoDetach: /*nodetach = 1; */break;
 
         case oDebug:
           if (parse_debug_flag (pargs.r.ret_str, &opt.debug, debug_flags))
             {
               pargs.r_opt = ARGPARSE_INVALID_ARG;
               pargs.err = ARGPARSE_PRINT_ERROR;
             }
             break;
         case oDebugAll: debug_value = ~0; break;
         case oDebugNone: debug_value = 0; break;
         case oDebugLevel: debug_level = pargs.r.ret_str; break;
         case oDebugWait: /*debug_wait = pargs.r.ret_int; */break;
         case oDebugAllowCoreDump:
           may_coredump = enable_core_dumps ();
           break;
 
         case oStatusFD: ctrl.status_fd = pargs.r.ret_int; break;
         case oLoggerFD: log_set_fd (pargs.r.ret_int ); break;
 
         case oNoOptions: break; /* no-options */
         case oOptions:
           /* Config files may not be nested (silently ignore them).  */
           if (!configfp)
             {
               xfree(configname);
               configname = xstrdup (pargs.r.ret_str);
               goto next_pass;
 	    }
           break;
 
         case oHomedir: opt.homedir = pargs.r.ret_str; break;
 
         case oAgentProgram: opt.agent_program = pargs.r.ret_str;  break;
         case oGpgProgram: opt.gpg_program = pargs.r.ret_str;  break;
         case oDisplay: opt.display = xstrdup (pargs.r.ret_str); break;
         case oTTYname: opt.ttyname = xstrdup (pargs.r.ret_str); break;
         case oTTYtype: opt.ttytype = xstrdup (pargs.r.ret_str); break;
         case oLCctype: opt.lc_ctype = xstrdup (pargs.r.ret_str); break;
         case oLCmessages: opt.lc_messages = xstrdup (pargs.r.ret_str); break;
         case oXauthority: opt.xauthority = xstrdup (pargs.r.ret_str); break;
 
         case oFakedSystemTime:
           {
             time_t faked_time = isotime2epoch (pargs.r.ret_str);
             if (faked_time == (time_t)(-1))
               faked_time = (time_t)strtoul (pargs.r.ret_str, NULL, 10);
             gnupg_set_time (faked_time, 0);
           }
           break;
 
         case oNoSecmemWarn: gcry_control (GCRYCTL_DISABLE_SECMEM_WARN); break;
 
         case oNoRandomSeedFile: use_random_seed = 0; break;
 
         case oRecipient: /* Store the encryption key.  */
           add_to_strlist (&recipients, pargs.r.ret_str);
           break;
 
         case oType:
           if (!strcmp (pargs.r.ret_str, "help"))
             {
               be_parse_conttype_name (NULL);
               g13_exit (0);
             }
           cmdline_conttype = be_parse_conttype_name (pargs.r.ret_str);
           if (!cmdline_conttype)
             {
               pargs.r_opt = ARGPARSE_INVALID_ARG;
               pargs.err = ARGPARSE_PRINT_ERROR;
             }
           break;
 
         default:
           pargs.err = configfp? ARGPARSE_PRINT_WARNING:ARGPARSE_PRINT_ERROR;
           break;
 	}
     }
 
   /* XXX Construct GPG arguments.  */
   {
     strlist_t last;
     last = append_to_strlist (&opt.gpg_arguments, "-z");
     last = append_to_strlist (&last, "0");
     last = append_to_strlist (&last, "--trust-model");
     last = append_to_strlist (&last, "always");
     (void) last;
   }
 
   if (configfp)
     {
       fclose (configfp);
       configfp = NULL;
       /* Keep a copy of the config filename. */
       opt.config_filename = configname;
       configname = NULL;
       goto next_pass;
     }
   xfree (configname);
   configname = NULL;
 
   if (!opt.config_filename)
     opt.config_filename = make_filename (opt.homedir, G13_NAME".conf", NULL);
 
   if (log_get_errorcount(0))
     g13_exit(2);
 
   /* Now that we have the options parsed we need to update the default
      control structure.  */
   g13_init_default_ctrl (&ctrl);
+  ctrl.recipients = recipients;
+  recipients = NULL;
 
   if (nogreeting)
     greeting = 0;
 
   if (greeting)
     {
       fprintf (stderr, "%s %s; %s\n",
                strusage(11), strusage(13), strusage(14) );
       fprintf (stderr, "%s\n", strusage(15) );
     }
 
   if (may_coredump && !opt.quiet)
     log_info (_("WARNING: program may create a core file!\n"));
 
   /* Print a warning if an argument looks like an option.  */
   if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
     {
       int i;
 
       for (i=0; i < argc; i++)
         if (argv[i][0] == '-' && argv[i][1] == '-')
-          log_info (_("NOTE: '%s' is not considered an option\n"), argv[i]);
+          log_info (_("Note: '%s' is not considered an option\n"), argv[i]);
     }
 
 
   if (logfile)
     {
       log_set_file (logfile);
       log_set_prefix (NULL, 1|2|4);
     }
 
   if (gnupg_faked_time_p ())
     {
       gnupg_isotime_t tbuf;
 
       log_info (_("WARNING: running with faked system time: "));
       gnupg_get_isotime (tbuf);
       dump_isotime (tbuf);
       log_printf ("\n");
     }
 
   /* Print any pending secure memory warnings.  */
   gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
 
   /* Setup the debug flags for all subsystems.  */
   set_debug ();
 
   /* Install emergency cleanup handler.  */
   g13_install_emergency_cleanup ();
 
   /* Terminate if we found any error until now.  */
   if (log_get_errorcount(0))
     g13_exit (2);
 
   /* Set the standard GnuPG random seed file.  */
   if (use_random_seed)
     {
       char *p = make_filename (opt.homedir, "random_seed", NULL);
       gcry_control (GCRYCTL_SET_RANDOM_SEED_FILE, p);
       xfree(p);
     }
 
   /* Store given filename into FNAME. */
   /* fname = argc? *argv : NULL; */
 
   /* Parse all given encryption keys.  This does a lookup of the keys
      and stops if any of the given keys was not found. */
 #if 0 /* Currently not implemented.  */
   if (!nokeysetup)
     {
       strlist_t sl;
       int failed = 0;
 
-      for (sl = recipients; sl; sl = sl->next)
+      for (sl = ctrl->recipients; sl; sl = sl->next)
         if (check_encryption_key ())
           failed = 1;
       if (failed)
         g13_exit (1);
     }
 #endif /*0*/
 
   /* Dispatch command.  */
   err = 0;
   switch (cmd)
     {
     case aGPGConfList:
       { /* List options and default values in the GPG Conf format.  */
 	char *config_filename_esc = percent_escape (opt.config_filename, NULL);
 
         printf ("gpgconf-g13.conf:%lu:\"%s\n",
                 GC_OPT_FLAG_DEFAULT, config_filename_esc);
         xfree (config_filename_esc);
 
         printf ("verbose:%lu:\n", GC_OPT_FLAG_NONE);
 	printf ("quiet:%lu:\n", GC_OPT_FLAG_NONE);
 	printf ("debug-level:%lu:\"none:\n", GC_OPT_FLAG_DEFAULT);
 	printf ("log-file:%lu:\n", GC_OPT_FLAG_NONE);
       }
       break;
     case aGPGConfTest:
       /* This is merely a dummy command to test whether the
          configuration file is valid.  */
       break;
 
     case aServer:
       {
         start_idle_task ();
         ctrl.no_server = 0;
         err = g13_server (&ctrl);
         if (err)
           log_error ("server exited with error: %s <%s>\n",
                      gpg_strerror (err), gpg_strsource (err));
         else
-          shutdown_pending++;
+          g13_request_shutdown ();
       }
       break;
 
     case aCreate: /* Create a new container. */
       {
         if (argc != 1)
           wrong_args ("--create filename");
         start_idle_task ();
-        err = g13_create_container (&ctrl, argv[0], recipients);
+        err = g13_create_container (&ctrl, argv[0]);
         if (err)
           log_error ("error creating a new container: %s <%s>\n",
                      gpg_strerror (err), gpg_strsource (err));
         else
-          shutdown_pending++;
+          g13_request_shutdown ();
       }
       break;
 
     case aMount: /* Mount a container. */
       {
         if (argc != 1 && argc != 2 )
           wrong_args ("--mount filename [mountpoint]");
         start_idle_task ();
         err = g13_mount_container (&ctrl, argv[0], argc == 2?argv[1]:NULL);
         if (err)
           log_error ("error mounting container '%s': %s <%s>\n",
                      *argv, gpg_strerror (err), gpg_strsource (err));
       }
       break;
 
     default:
       log_error (_("invalid command (there is no implicit command)\n"));
       break;
     }
 
   g13_deinit_default_ctrl (&ctrl);
 
   if (!err)
     join_idle_task ();
 
   /* Cleanup.  */
   g13_exit (0);
   return 8; /*NOTREACHED*/
 }
 
 
 /* Store defaults into the per-connection CTRL object.  */
 void
 g13_init_default_ctrl (ctrl_t ctrl)
 {
   ctrl->conttype = cmdline_conttype? cmdline_conttype : CONTTYPE_ENCFS;
 }
 
 
 /* Release remaining resources allocated in the CTRL object.  */
 void
 g13_deinit_default_ctrl (ctrl_t ctrl)
 {
   call_syshelp_release (ctrl);
+  FREE_STRLIST (ctrl->recipients);
+}
+
+
+/* Request a shutdown.  This can be used when the process should
+ * finish instead of running the idle task.  */
+void
+g13_request_shutdown (void)
+{
+  shutdown_pending++;
 }
 
 
 /* This function is called for each signal we catch.  It is run in the
    main context or the one of a NPth thread and thus it is not
    restricted in what it may do.  */
 static void
 handle_signal (int signo)
 {
   switch (signo)
     {
 #ifndef HAVE_W32_SYSTEM
     case SIGHUP:
       log_info ("SIGHUP received - re-reading configuration\n");
       /* Fixme:  Not yet implemented.  */
       break;
 
     case SIGUSR1:
       log_info ("SIGUSR1 received - printing internal information:\n");
       /* Fixme: We need to see how to integrate pth dumping into our
          logging system.  */
       /* pth_ctrl (PTH_CTRL_DUMPSTATE, log_get_stream ()); */
       mountinfo_dump_all ();
       break;
 
     case SIGUSR2:
       log_info ("SIGUSR2 received - no action defined\n");
       break;
 
     case SIGTERM:
       if (!shutdown_pending)
         log_info ("SIGTERM received - shutting down ...\n");
       else
         log_info ("SIGTERM received - still %u runners active\n",
                   runner_get_threads ());
       shutdown_pending++;
       if (shutdown_pending > 2)
         {
           log_info ("shutdown forced\n");
           log_info ("%s %s stopped\n", strusage(11), strusage(13) );
           g13_exit (0);
 	}
       break;
 
     case SIGINT:
       log_info ("SIGINT received - immediate shutdown\n");
       log_info( "%s %s stopped\n", strusage(11), strusage(13));
       g13_exit (0);
       break;
 #endif /*!HAVE_W32_SYSTEM*/
 
     default:
       log_info ("signal %d received - no action defined\n", signo);
     }
 }
 
 
 /* This ticker function is called about every TIMERTICK_INTERVAL_SEC
    seconds. */
 static void
 handle_tick (void)
 {
   /* log_debug ("TICK\n"); */
 }
 
 
 /* The idle task.  We use a separate thread to do idle stuff and to
    catch signals.  */
 static void *
 idle_task (void *dummy_arg)
 {
   int signo;           /* The number of a raised signal is stored here.  */
   int saved_errno;
   struct timespec abstime;
   struct timespec curtime;
   struct timespec timeout;
   int ret;
 
   (void)dummy_arg;
 
   /* Create the event to catch the signals. */
 #ifndef HAVE_W32_SYSTEM
   npth_sigev_init ();
   npth_sigev_add (SIGHUP);
   npth_sigev_add (SIGUSR1);
   npth_sigev_add (SIGUSR2);
   npth_sigev_add (SIGINT);
   npth_sigev_add (SIGTERM);
   npth_sigev_fini ();
 #endif
 
   npth_clock_gettime (&abstime);
   abstime.tv_sec += TIMERTICK_INTERVAL_SEC;
 
   for (;;)
     {
       /* The shutdown flag allows us to terminate the idle task.  */
       if (shutdown_pending)
         {
           runner_cancel_all ();
 
           if (!runner_get_threads ())
             break; /* ready */
 	}
 
       npth_clock_gettime (&curtime);
       if (!(npth_timercmp (&curtime, &abstime, <)))
 	{
 	  /* Timeout.  */
 	  handle_tick ();
 	  npth_clock_gettime (&abstime);
 	  abstime.tv_sec += TIMERTICK_INTERVAL_SEC;
 	}
       npth_timersub (&abstime, &curtime, &timeout);
 
 #ifndef HAVE_W32_SYSTEM
       ret = npth_pselect (0, NULL, NULL, NULL, &timeout, npth_sigev_sigmask());
       saved_errno = errno;
 
       while (npth_sigev_get_pending(&signo))
 	handle_signal (signo);
 #else
       ret = npth_eselect (0, NULL, NULL, NULL, &timeout, NULL, NULL);
       saved_errno = errno;
 #endif
 
       if (ret == -1 && saved_errno != EINTR)
 	{
           log_error (_("npth_pselect failed: %s - waiting 1s\n"),
                      strerror (saved_errno));
           npth_sleep (1);
           continue;
 	}
 
       if (ret <= 0)
-	/* Interrupt or timeout.  Will be handled when calculating the
-	   next timeout.  */
-	continue;
+        {
+          /* Interrupt or timeout.  Will be handled when calculating the
+             next timeout.  */
+          continue;
+        }
 
       /* Here one would add processing of file descriptors.  */
     }
 
   log_info (_("%s %s stopped\n"), strusage(11), strusage(13));
   return NULL;
 }
 
 
 /* Start the idle task.   */
 static void
 start_idle_task (void)
 {
   npth_attr_t tattr;
   npth_t thread;
   sigset_t sigs;       /* The set of signals we want to catch.  */
   int err;
 
 #ifndef HAVE_W32_SYSTEM
   /* These signals should always go to the idle task, so they need to
      be blocked everywhere else.  We assume start_idle_task is called
      from the main thread before any other threads are created.  */
   sigemptyset (&sigs);
   sigaddset (&sigs, SIGHUP);
   sigaddset (&sigs, SIGUSR1);
   sigaddset (&sigs, SIGUSR2);
   sigaddset (&sigs, SIGINT);
   sigaddset (&sigs, SIGTERM);
   npth_sigmask (SIG_BLOCK, &sigs, NULL);
 #endif
 
   npth_attr_init (&tattr);
   npth_attr_setdetachstate (&tattr, NPTH_CREATE_JOINABLE);
 
   err = npth_create (&thread, &tattr, idle_task, NULL);
   if (err)
     {
       log_fatal ("error starting idle task: %s\n", strerror (err));
       return; /*NOTREACHED*/
     }
   npth_setname_np (thread, "idle-task");
   idle_task_thread = thread;
   npth_attr_destroy (&tattr);
 }
 
 
 /* Wait for the idle task to finish.  */
 static void
 join_idle_task (void)
 {
   int err;
 
   /* FIXME: This assumes that a valid pthread_t is non-null.  That is
      not guaranteed.  */
   if (idle_task_thread)
     {
       err = npth_join (idle_task_thread, NULL);
       if (err)
         log_error ("waiting for idle task thread failed: %s\n",
                    strerror (err));
     }
 }
diff --git a/g13/g13.h b/g13/g13.h
index f6f88b96b..e69489069 100644
--- a/g13/g13.h
+++ b/g13/g13.h
@@ -1,57 +1,60 @@
 /* g13.h - Global definitions for G13.
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef G13_H
 #define G13_H
 
 #include "g13-common.h"
 
 
 /* Forward declaration for an object defined in server.c.  */
 struct server_local_s;
 /* Forward declaration for an object defined in call-syshelp.c.  */
 struct call_syshelp_s;
 
 
 /* Session control object.  This object is passed down to most
    functions.  The default values for it are set by
    g13_init_default_ctrl(). */
 struct server_control_s
 {
   int no_server;      /* We are not running under server control */
   int  status_fd;     /* Only for non-server mode */
   struct server_local_s *server_local;
   struct call_syshelp_s *syshelp_local;
 
   int agent_seen;     /* Flag indicating that the gpg-agent has been
                          accessed.  */
 
   int with_colons;    /* Use column delimited output format */
 
   /* Type of the current container.  See the CONTTYPE_ constants.  */
   int conttype;
 
+  strlist_t recipients; /* List of recipients.  */
+
 };
 
 
 /*-- g13.c --*/
 void g13_init_default_ctrl (ctrl_t ctrl);
 void g13_deinit_default_ctrl (ctrl_t ctrl);
+void g13_request_shutdown (void);
 
 #endif /*G13_H*/
diff --git a/g13/g13tuple.c b/g13/g13tuple.c
index b3187fbfe..fc6644cb7 100644
--- a/g13/g13tuple.c
+++ b/g13/g13tuple.c
@@ -1,328 +1,340 @@
 /* g13tuple.c - Tuple handling
  * Copyright (C) 2009 Free Software Foundation, Inc.
  * Copyright (C) 2009, 2015, 2016  Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <assert.h>
 
 #include "g13.h"
 #include "g13tuple.h"
 #include "keyblob.h"  /* Required for dump_tupledesc.  */
 
 
 /* Definition of the tuple descriptor object.  */
 struct tupledesc_s
 {
   unsigned char *data; /* The tuple data.  */
   size_t datalen;      /* The length of the data.  */
   size_t pos;          /* The current position as used by next_tuple.  */
   int refcount;        /* Number of references hold. */
 };
 
 
 
 /* Append the TAG and the VALUE to the MEMBUF.  There is no error
    checking here; this is instead done while getting the value back
    from the membuf. */
 void
 append_tuple (membuf_t *membuf, int tag, const void *value, size_t length)
 {
   unsigned char buf[2];
 
   assert (tag >= 0 && tag <= 0xffff);
   assert (length <= 0xffff);
 
   buf[0] = tag >> 8;
   buf[1] = tag;
   put_membuf (membuf, buf, 2);
   buf[0] = length >> 8;
   buf[1] = length;
   put_membuf (membuf, buf, 2);
   if (length)
     put_membuf (membuf, value, length);
 }
 
 
 /* Append the unsigned integer VALUE under TAG to MEMBUF.  We make
  * sure that the most significant bit is always cleared to explicitly
  * flag the value as unsigned.  */
 void
 append_tuple_uint (membuf_t *membuf, int tag, unsigned long long value)
 {
   unsigned char buf[16];
   unsigned char *p;
   unsigned int len;
 
   p = buf + sizeof buf;
   len = 0;
   do
     {
       if (p == buf)
         BUG () ;
       *--p = (value & 0xff);
       value >>= 8;
       len++;
     }
   while (value);
 
   /* Prepend a zero byte if the first byte has its MSB set.  */
   if ((*p & 0x80))
     {
       if (p == buf)
         BUG () ;
       *--p = 0;
       len++;
     }
 
   append_tuple (membuf, tag, p, len);
 }
 
 
 /* Create a tuple object by moving the ownership of (DATA,DATALEN) to
  * a new object.  Returns 0 on success and stores the new object at
  * R_TUPLEHD.  The return object must be released using
  * destroy_tuples().  */
 gpg_error_t
 create_tupledesc (tupledesc_t *r_desc, void *data, size_t datalen)
 {
   if (datalen < 5 || memcmp (data, "\x00\x00\x00\x01\x01", 5))
     return gpg_error (GPG_ERR_NOT_SUPPORTED);
 
   *r_desc = xtrymalloc (sizeof **r_desc);
   if (!*r_desc)
     return gpg_error_from_syserror ();
   (*r_desc)->data = data;
   (*r_desc)->datalen = datalen;
   (*r_desc)->pos = 0;
   (*r_desc)->refcount++;
   return 0;
 }
 
 /* Unref a tuple descriptor and if the refcount is down to 0 release
    its allocated storage.  */
 void
 destroy_tupledesc (tupledesc_t tupledesc)
 {
   if (!tupledesc)
     return;
 
   if (!--tupledesc->refcount)
     {
       xfree (tupledesc->data);
       xfree (tupledesc);
     }
 }
 
 
 tupledesc_t
 ref_tupledesc (tupledesc_t tupledesc)
 {
   if (tupledesc)
     tupledesc->refcount++;
   return tupledesc;
 }
 
 
+/* Return a pointer to the memory used to store the tuples.  This is
+ * the data originally provided to create_tupledesc.  It is higly
+ * recommended that the callers uses ref_tupledesc before calling this
+ * function and unref_tupledesc when the return data will not anymore
+ * be used.  */
+const void *
+get_tupledesc_data (tupledesc_t tupledesc, size_t *r_datalen)
+{
+  *r_datalen = tupledesc->datalen;
+  return tupledesc->data;
+}
+
 /* Find the first tuple with tag TAG.  On success return a pointer to
    its value and store the length of the value at R_LENGTH.  If no
    tuple was found return NULL.  For use by next_tuple, the last
    position is stored in the descriptor.  */
 const void *
 find_tuple (tupledesc_t tupledesc, unsigned int tag, size_t *r_length)
 {
   const unsigned char *s;
   const unsigned char *s_end; /* Points right behind the data. */
   unsigned int t;
   size_t n;
 
   s = tupledesc->data;
   if (!s)
     return NULL;
   s_end = s + tupledesc->datalen;
   while (s < s_end)
     {
       /* We use addresses for the overflow check to avoid undefined
          behaviour.  size_t should work with all flat memory models.  */
       if ((size_t)s+3 >= (size_t)s_end || (size_t)s + 3 < (size_t)s)
         break;
       t  = s[0] << 8;
       t |= s[1];
       n  = s[2] << 8;
       n |= s[3];
       s += 4;
       if ((size_t)s + n > (size_t)s_end || (size_t)s + n < (size_t)s)
         break;
       if (t == tag)
         {
           tupledesc->pos = (s + n) - tupledesc->data;
           *r_length = n;
           return s;
         }
       s += n;
     }
   return NULL;
 }
 
 
 /* Helper for find_tuple_uint and others.  */
 static gpg_error_t
 convert_uint (const unsigned char *s, size_t n, unsigned long long *r_value)
 {
   unsigned long long value = 0;
 
   *r_value = 0;
 
   if (!s)
     return gpg_error (GPG_ERR_NOT_FOUND);
   if (!n || (*s & 0x80)) /* No bytes or negative.  */
     return gpg_error (GPG_ERR_ERANGE);
   if (n && !*s) /* Skip a leading zero.  */
     {
       n--;
       s++;
     }
   if (n > sizeof value)
     return gpg_error (GPG_ERR_ERANGE);
   for (; n; n--, s++)
     {
       value <<= 8;
       value |= *s;
     }
   *r_value = value;
   return 0;
 }
 
 
 /* Similar to find-tuple but expects an unsigned int value and stores
  * that at R_VALUE.  If the tag was not found GPG_ERR_NOT_FOUND is
  * returned and 0 stored at R_VALUE.  If the value cannot be converted
  * to an unsigned integer GPG_ERR_ERANGE is returned.  */
 gpg_error_t
 find_tuple_uint (tupledesc_t tupledesc, unsigned int tag,
                  unsigned long long *r_value)
 {
   const unsigned char *s;
   size_t n;
 
   s = find_tuple (tupledesc, tag, &n);
   return convert_uint (s, n, r_value);
 }
 
 
 const void *
 next_tuple (tupledesc_t tupledesc, unsigned int *r_tag, size_t *r_length)
 {
   const unsigned char *s;
   const unsigned char *s_end; /* Points right behind the data.  */
   unsigned int t;
   size_t n;
 
   s = tupledesc->data;
   if (!s)
     return NULL;
   s_end = s + tupledesc->datalen;
   s += tupledesc->pos;
   if (s < s_end
       && !((size_t)s + 3 >= (size_t)s_end || (size_t)s + 3 < (size_t)s))
     {
       t  = s[0] << 8;
       t |= s[1];
       n  = s[2] << 8;
       n |= s[3];
       s += 4;
       if (!((size_t)s + n > (size_t)s_end || (size_t)s + n < (size_t)s))
         {
           tupledesc->pos = (s + n) - tupledesc->data;
           *r_tag = t;
           *r_length = n;
           return s;
         }
     }
 
   return NULL;
 }
 
 
 /* Return true if BUF has only printable characters.  */
 static int
 all_printable (const void *buf, size_t buflen)
 {
   const unsigned char *s;
 
   for (s=buf ; buflen; s++, buflen--)
     if (*s < 32 && *s > 126)
       return 0;
   return 1;
 }
 
 
 /* Print information about TUPLES to the log stream.  */
 void
 dump_tupledesc (tupledesc_t tuples)
 {
   size_t n;
   unsigned int tag;
   const void *value;
   unsigned long long uint;
 
   log_info ("keyblob dump:\n");
   tag = KEYBLOB_TAG_BLOBVERSION;
   value = find_tuple (tuples, tag, &n);
   while (value)
     {
       log_info ("   tag: %-5u len: %-2u value: ", tag, (unsigned int)n);
       if (!n)
         log_printf ("[none]\n");
       else
         {
           switch (tag)
             {
             case KEYBLOB_TAG_ENCKEY:
             case KEYBLOB_TAG_MACKEY:
               log_printf ("[confidential]\n");
               break;
 
             case KEYBLOB_TAG_ALGOSTR:
               if (n < 100 && all_printable (value, n))
                 log_printf ("%.*s\n", (int)n, (const char*)value);
               else
                 log_printhex ("", value, n);
               break;
 
             case KEYBLOB_TAG_CONT_NSEC:
             case KEYBLOB_TAG_ENC_NSEC:
             case KEYBLOB_TAG_ENC_OFF:
               if (!convert_uint (value, n, &uint))
                 log_printf ("%llu\n", uint);
               else
                 log_printhex ("", value, n);
               break;
 
             default:
               log_printhex ("", value, n);
               break;
             }
         }
       value = next_tuple (tuples, &tag, &n);
     }
 }
diff --git a/g13/g13tuple.h b/g13/g13tuple.h
index 948e3475e..c9dfb47b7 100644
--- a/g13/g13tuple.h
+++ b/g13/g13tuple.h
@@ -1,49 +1,52 @@
 /* g13tuple.h - Tuple handling
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef G13_G13TUPLE_H
 #define G13_G13TUPLE_H
 
 #include "../common/membuf.h"
 
 /* Append a new tuple to a memory buffer.  */
 void append_tuple (membuf_t *membuf,
                    int tag, const void *value, size_t length);
 void append_tuple_uint (membuf_t *membuf, int tag,
                         unsigned long long value);
 
 /* The tuple descriptor object. */
 struct tupledesc_s;
 typedef struct tupledesc_s *tupledesc_t;
 
 gpg_error_t create_tupledesc (tupledesc_t *r_tupledesc,
                               void *data, size_t datalen);
 void destroy_tupledesc (tupledesc_t tupledesc);
 tupledesc_t ref_tupledesc (tupledesc_t tupledesc);
+#define unref_tupledesc(a) destroy_tupledesc ((a))
+const void *get_tupledesc_data (tupledesc_t tupledesc, size_t *r_datalen);
+
 const void *find_tuple (tupledesc_t tupledesc,
                         unsigned int tag, size_t *r_length);
 gpg_error_t find_tuple_uint (tupledesc_t tupledesc, unsigned int tag,
                              unsigned long long *r_value);
 const void *next_tuple (tupledesc_t tupledesc,
                         unsigned int *r_tag, size_t *r_length);
 
 void dump_tupledesc (tupledesc_t tuples);
 
 
 #endif /*G13_G13TUPLE_H*/
diff --git a/g13/mount.c b/g13/mount.c
index bc54020eb..c5c8f22b4 100644
--- a/g13/mount.c
+++ b/g13/mount.c
@@ -1,391 +1,408 @@
 /* mount.c - Mount a crypto container
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/stat.h>
 #include <assert.h>
 
 #include "g13.h"
 #include "i18n.h"
 #include "mount.h"
 
 #include "keyblob.h"
 #include "backend.h"
 #include "g13tuple.h"
 #include "../common/sysutils.h"
 #include "../common/call-gpg.h"
 #include "mountinfo.h"
 #include "runner.h"
 #include "host2net.h"
 
 
 /* Parse the header prefix and return the length of the entire header.  */
 static gpg_error_t
 parse_header (const char *filename,
               const unsigned char *packet, size_t packetlen,
               size_t *r_headerlen)
 {
   unsigned int len;
 
   if (packetlen != 32)
     return gpg_error (GPG_ERR_BUG);
 
   len = buf32_to_uint (packet+2);
   if (packet[0] != (0xc0|61) || len < 26
       || memcmp (packet+6, "GnuPG/G13", 10))
     {
       log_error ("file '%s' is not valid container\n", filename);
       return gpg_error (GPG_ERR_INV_OBJ);
     }
   if (packet[16] != 1)
     {
       log_error ("unknown version %u of container '%s'\n",
                  (unsigned int)packet[16], filename);
       return gpg_error (GPG_ERR_INV_OBJ);
     }
   if (packet[17] || packet[18]
       || packet[26] || packet[27] || packet[28] || packet[29]
       || packet[30] || packet[31])
     log_info ("WARNING: unknown meta information in '%s'\n", filename);
   if (packet[19])
     log_info ("WARNING: OS flag is not supported in '%s'\n", filename);
-  if (packet[24] != 1 || packet[25] != 0)
-    {
-      log_error ("meta data copies in '%s' are not supported\n", filename);
-      return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
-    }
+  if (packet[24] > 1 )
+    log_info ("Note: meta data copies in '%s' are ignored\n", filename);
 
   len = buf32_to_uint (packet+20);
 
   /* Do a basic sanity check on the length.  */
   if (len < 32 || len > 1024*1024)
     {
       log_error ("bad length given in container '%s'\n", filename);
       return gpg_error (GPG_ERR_INV_OBJ);
     }
 
   *r_headerlen = len;
   return 0;
 }
 
 
 /* Read the prefix of the keyblob and do some basic parsing.  On
    success returns an open estream file at R_FP and the length of the
    header at R_HEADERLEN.  */
 static gpg_error_t
 read_keyblob_prefix (const char *filename, estream_t *r_fp, size_t *r_headerlen)
 {
   gpg_error_t err;
   estream_t fp;
   unsigned char packet[32];
 
   *r_fp = NULL;
 
   fp = es_fopen (filename, "rb");
   if (!fp)
     {
       err = gpg_error_from_syserror ();
       log_error ("error reading '%s': %s\n", filename, gpg_strerror (err));
       return err;
     }
 
   /* Read the header.  It is defined as 32 bytes thus we read it in one go.  */
   if (es_fread (packet, 32, 1, fp) != 1)
     {
       err = gpg_error_from_syserror ();
       log_error ("error reading the header of '%s': %s\n",
                  filename, gpg_strerror (err));
       es_fclose (fp);
       return err;
     }
 
   err = parse_header (filename, packet, 32, r_headerlen);
   if (err)
     es_fclose (fp);
   else
     *r_fp = fp;
 
   return err;
 }
 
 
 /* Read the keyblob at FILENAME.  The caller should have acquired a
    lockfile and checked that the file exists.  */
 static gpg_error_t
 read_keyblob (const char *filename,
               void **r_enckeyblob, size_t *r_enckeybloblen)
 {
   gpg_error_t err;
   estream_t fp = NULL;
   size_t headerlen = 0;
   size_t msglen;
   void *msg = NULL;
 
   *r_enckeyblob = NULL;
   *r_enckeybloblen = 0;
 
   err = read_keyblob_prefix (filename, &fp, &headerlen);
   if (err)
     goto leave;
 
   if (opt.verbose)
     log_info ("header length of '%s' is %zu\n", filename, headerlen);
 
   /* Read everything including the padding.  We should eventually do a
      regular OpenPGP parsing to detect the padding packet and pass
      only the actual used OpenPGP data to the engine.  This is in
      particular required when supporting CMS which will be
      encapsulated in an OpenPGP packet.  */
   assert (headerlen >= 32);
   msglen = headerlen - 32;
   if (!msglen)
     {
       err = gpg_error (GPG_ERR_NO_DATA);
       goto leave;
     }
   msg = xtrymalloc (msglen);
   if (!msglen)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   if (es_fread (msg, msglen, 1, fp) != 1)
     {
       err = gpg_error_from_syserror ();
       log_error ("error reading keyblob of '%s': %s\n",
                  filename, gpg_strerror (err));
       goto leave;
     }
 
   *r_enckeyblob = msg;
   msg = NULL;
   *r_enckeybloblen = msglen;
 
  leave:
   xfree (msg);
   es_fclose (fp);
 
   return err;
 }
 
 
 
 
 /* Decrypt the keyblob (ENCKEYBLOB,ENCKEYBLOBLEN) and store the result at
    (R_KEYBLOB, R_KEYBLOBLEN).  Returns 0 on success or an error code.
    On error R_KEYBLOB is set to NULL.  */
 static gpg_error_t
 decrypt_keyblob (ctrl_t ctrl, const void *enckeyblob, size_t enckeybloblen,
                  void **r_keyblob, size_t *r_keybloblen)
 {
   gpg_error_t err;
 
   /* FIXME:  For now we only implement OpenPGP.  */
   err = gpg_decrypt_blob (ctrl, opt.gpg_program, opt.gpg_arguments,
                           enckeyblob, enckeybloblen,
                           r_keyblob, r_keybloblen);
 
   return err;
 }
 
 
 /* Mount the container with name FILENAME at MOUNTPOINT.  */
 gpg_error_t
 g13_mount_container (ctrl_t ctrl, const char *filename, const char *mountpoint)
 {
   gpg_error_t err;
   dotlock_t lock;
+  int needs_syshelp;
   void *enckeyblob = NULL;
   size_t enckeybloblen;
   void *keyblob = NULL;
   size_t keybloblen;
   tupledesc_t tuples = NULL;
   size_t n;
   const unsigned char *value;
   int conttype;
   unsigned int rid;
   char *mountpoint_buffer = NULL;
 
   /* A quick check to see whether the container exists.  */
   if (access (filename, R_OK))
     return gpg_error_from_syserror ();
 
+  /* Decide whether we need to use the g13-syshelp because we can't
+     use lock files for them.  This is most likely the case for device
+     files; thus we test for this.  FIXME: The correct solution would
+     be to call g13-syshelp to match the file against the g13tab.  */
+  needs_syshelp = !strncmp (filename, "/dev/", 5);
+
   if (!mountpoint)
     {
       mountpoint_buffer = xtrystrdup ("/tmp/g13-XXXXXX");
       if (!mountpoint_buffer)
         return gpg_error_from_syserror ();
       if (!gnupg_mkdtemp (mountpoint_buffer))
         {
           err = gpg_error_from_syserror ();
           log_error (_("can't create directory '%s': %s\n"),
                      "/tmp/g13-XXXXXX", gpg_strerror (err));
           xfree (mountpoint_buffer);
           return err;
         }
       mountpoint = mountpoint_buffer;
     }
 
-  /* Try to take a lock.  */
-  lock = dotlock_create (filename, 0);
-  if (!lock)
+  err = 0;
+  if (needs_syshelp)
+    lock = NULL;
+  else
     {
-      xfree (mountpoint_buffer);
-      return gpg_error_from_syserror ();
-    }
+      /* Try to take a lock.  */
+      lock = dotlock_create (filename, 0);
+      if (!lock)
+        {
+          xfree (mountpoint_buffer);
+          return gpg_error_from_syserror ();
+        }
 
-  if (dotlock_take (lock, 0))
-    {
-      err = gpg_error_from_syserror ();
-      goto leave;
+      if (dotlock_take (lock, 0))
+        {
+          err = gpg_error_from_syserror ();
+          goto leave;
+        }
     }
-  else
-    err = 0;
 
   /* Check again that the file exists.  */
   {
     struct stat sb;
 
     if (stat (filename, &sb))
       {
         err = gpg_error_from_syserror ();
         goto leave;
       }
   }
 
   /* Read the encrypted keyblob.  */
+  /* Fixme: Should we move this to syshelp for dm-crypt or do we
+     assume that the encrypted device is world readable?  */
   err = read_keyblob (filename, &enckeyblob, &enckeybloblen);
   if (err)
     goto leave;
 
   /* Decrypt that keyblob and store it in a tuple descriptor.  */
   err = decrypt_keyblob (ctrl, enckeyblob, enckeybloblen,
                          &keyblob, &keybloblen);
   if (err)
     goto leave;
   xfree (enckeyblob);
   enckeyblob = NULL;
 
   err = create_tupledesc (&tuples, keyblob, keybloblen);
   if (!err)
     keyblob = NULL;
   else
     {
       if (gpg_err_code (err) == GPG_ERR_NOT_SUPPORTED)
         log_error ("unknown keyblob version\n");
       goto leave;
     }
   if (opt.verbose)
     dump_tupledesc (tuples);
 
   value = find_tuple (tuples, KEYBLOB_TAG_CONTTYPE, &n);
   if (!value || n != 2)
     conttype = 0;
   else
     conttype = (value[0] << 8 | value[1]);
   if (!be_is_supported_conttype (conttype))
     {
       log_error ("content type %d is not supported\n", conttype);
       err = gpg_error (GPG_ERR_NOT_SUPPORTED);
       goto leave;
     }
   err = be_mount_container (ctrl, conttype, filename, mountpoint, tuples, &rid);
-  if (!err)
+  if (err)
+    ;
+  else if (conttype == CONTTYPE_DM_CRYPT)
+    g13_request_shutdown ();
+  else
     {
+      /* Unless this is a DM-CRYPT mount we put it into our mounttable
+         so that we can manage the mounts ourselves.  For dm-crypt we
+         do not keep a process to monitor he mounts (for now).  */
       err = mountinfo_add_mount (filename, mountpoint, conttype, rid,
                                  !!mountpoint_buffer);
       /* Fixme: What shall we do if this fails?  Add a provisional
          mountinfo entry first and remove it on error? */
       if (!err)
         {
           char *tmp = percent_plus_escape (mountpoint);
           if (!tmp)
             err = gpg_error_from_syserror ();
           else
             {
               g13_status (ctrl, STATUS_MOUNTPOINT, tmp, NULL);
               xfree (tmp);
             }
         }
     }
 
  leave:
   destroy_tupledesc (tuples);
   xfree (keyblob);
   xfree (enckeyblob);
   dotlock_destroy (lock);
   xfree (mountpoint_buffer);
   return err;
 }
 
 
 /* Unmount the container with name FILENAME or the one mounted at
    MOUNTPOINT.  If both are given the FILENAME takes precedence.  */
 gpg_error_t
 g13_umount_container (ctrl_t ctrl, const char *filename, const char *mountpoint)
 {
   gpg_error_t err;
   unsigned int rid;
   runner_t runner;
 
   (void)ctrl;
 
   if (!filename && !mountpoint)
     return gpg_error (GPG_ERR_ENOENT);
   err = mountinfo_find_mount (filename, mountpoint, &rid);
   if (err)
     return err;
 
   runner = runner_find_by_rid (rid);
   if (!runner)
     {
       log_error ("runner %u not found\n", rid);
       return gpg_error (GPG_ERR_NOT_FOUND);
     }
 
   runner_cancel (runner);
   runner_release (runner);
 
   return 0;
 }
 
 
 /* Test whether the container with name FILENAME is a suitable G13
    container.  This function may even be called on a mounted
    container.  */
 gpg_error_t
 g13_is_container (ctrl_t ctrl, const char *filename)
 {
   gpg_error_t err;
   estream_t fp = NULL;
   size_t dummy;
 
   (void)ctrl;
 
   /* Read just the prefix of the header.  */
   err = read_keyblob_prefix (filename, &fp, &dummy);
   if (!err)
     es_fclose (fp);
   return err;
 }
diff --git a/g13/server.c b/g13/server.c
index 07b74f8bf..2f4acf595 100644
--- a/g13/server.c
+++ b/g13/server.c
@@ -1,751 +1,749 @@
 /* server.c - The G13 Assuan server
  * Copyright (C) 2009 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <errno.h>
 #include <assert.h>
 
 #include "g13.h"
 #include <assuan.h>
 #include "i18n.h"
 #include "keyblob.h"
 #include "server.h"
 #include "mount.h"
 #include "create.h"
 
 
 /* The filepointer for status message used in non-server mode */
 static FILE *statusfp;
 
 /* Local data for this server module.  A pointer to this is stored in
    the CTRL object of each connection.  */
 struct server_local_s
 {
   /* The Assuan contect we are working on.  */
   assuan_context_t assuan_ctx;
 
   char *containername;  /* Malloced active containername.  */
-
-  strlist_t recipients; /* List of recipients.  */
 };
 
 
 
 
 /* Local prototypes.  */
 static int command_has_option (const char *cmd, const char *cmdopt);
 
 
 
 
 /*
    Helper functions.
  */
 
 /* Set an error and a description.  */
 #define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))
 
 
 /* Skip over options.  Blanks after the options are also removed.  */
 static char *
 skip_options (const char *line)
 {
   while (spacep (line))
     line++;
   while ( *line == '-' && line[1] == '-' )
     {
       while (*line && !spacep (line))
         line++;
       while (spacep (line))
         line++;
     }
   return (char*)line;
 }
 
 
 /* Check whether the option NAME appears in LINE.  */
 /* static int */
 /* has_option (const char *line, const char *name) */
 /* { */
 /*   const char *s; */
 /*   int n = strlen (name); */
 
 /*   s = strstr (line, name); */
 /*   if (s && s >= skip_options (line)) */
 /*     return 0; */
 /*   return (s && (s == line || spacep (s-1)) && (!s[n] || spacep (s+n))); */
 /* } */
 
 
 /* Helper to print a message while leaving a command.  */
 static gpg_error_t
 leave_cmd (assuan_context_t ctx, gpg_error_t err)
 {
   if (err)
     {
       const char *name = assuan_get_command_name (ctx);
       if (!name)
         name = "?";
       if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
         log_error ("command '%s' failed: %s\n", name,
                    gpg_strerror (err));
       else
         log_error ("command '%s' failed: %s <%s>\n", name,
                    gpg_strerror (err), gpg_strsource (err));
     }
   return err;
 }
 
 
 
 
 /* The handler for Assuan OPTION commands.  */
 static gpg_error_t
 option_handler (assuan_context_t ctx, const char *key, const char *value)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
 
   (void)ctrl;
 
   if (!strcmp (key, "putenv"))
     {
       /* Change the session's environment to be used for the
          Pinentry.  Valid values are:
           <NAME>            Delete envvar NAME
           <KEY>=            Set envvar NAME to the empty string
           <KEY>=<VALUE>     Set envvar NAME to VALUE
       */
       err = session_env_putenv (opt.session_env, value);
     }
   else if (!strcmp (key, "display"))
     {
       err = session_env_setenv (opt.session_env, "DISPLAY", value);
     }
   else if (!strcmp (key, "ttyname"))
     {
       err = session_env_setenv (opt.session_env, "GPG_TTY", value);
     }
   else if (!strcmp (key, "ttytype"))
     {
       err = session_env_setenv (opt.session_env, "TERM", value);
     }
   else if (!strcmp (key, "lc-ctype"))
     {
       xfree (opt.lc_ctype);
       opt.lc_ctype = xtrystrdup (value);
       if (!opt.lc_ctype)
         err = gpg_error_from_syserror ();
     }
   else if (!strcmp (key, "lc-messages"))
     {
       xfree (opt.lc_messages);
       opt.lc_messages = xtrystrdup (value);
       if (!opt.lc_messages)
         err = gpg_error_from_syserror ();
     }
   else if (!strcmp (key, "xauthority"))
     {
       err = session_env_setenv (opt.session_env, "XAUTHORITY", value);
     }
   else if (!strcmp (key, "pinentry-user-data"))
     {
       err = session_env_setenv (opt.session_env, "PINENTRY_USER_DATA", value);
     }
   else if (!strcmp (key, "allow-pinentry-notify"))
     {
       ; /* We always allow it.  */
     }
   else
     err = gpg_error (GPG_ERR_UNKNOWN_OPTION);
 
   return err;
 }
 
 
 /* The handler for an Assuan RESET command.  */
 static gpg_error_t
 reset_notify (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
 
   (void)line;
 
   xfree (ctrl->server_local->containername);
   ctrl->server_local->containername = NULL;
 
-  FREE_STRLIST (ctrl->server_local->recipients);
+  FREE_STRLIST (ctrl->recipients);
 
   assuan_close_input_fd (ctx);
   assuan_close_output_fd (ctx);
   return 0;
 }
 
 
 static const char hlp_open[] =
   "OPEN [<options>] <filename>\n"
   "\n"
   "Open the container FILENAME.  FILENAME must be percent-plus\n"
   "escaped.  A quick check to see whether this is a suitable G13\n"
   "container file is done.  However no cryptographic check or any\n"
   "other check is done.  This command is used to define the target for\n"
   "further commands.  The filename is reset with the RESET command,\n"
   "another OPEN or the CREATE command.";
 static gpg_error_t
 cmd_open (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   char *p, *pend;
   size_t len;
 
   /* In any case reset the active container.  */
   xfree (ctrl->server_local->containername);
   ctrl->server_local->containername = NULL;
 
   /* Parse the line.  */
   line = skip_options (line);
   for (p=line; *p && !spacep (p); p++)
     ;
   pend = p;
   while (spacep(p))
     p++;
   if (*p || pend == line)
     {
       err = gpg_error (GPG_ERR_ASS_SYNTAX);
       goto leave;
     }
   *pend = 0;
 
   /* Unescape the line and check for embedded Nul bytes.  */
   len = percent_plus_unescape_inplace (line, 0);
   line[len] = 0;
   if (!len || memchr (line, 0, len))
     {
       err = gpg_error (GPG_ERR_INV_NAME);
       goto leave;
     }
 
   /* Do a basic check.  */
   err = g13_is_container (ctrl, line);
   if (err)
     goto leave;
 
   /* Store the filename.  */
   ctrl->server_local->containername = xtrystrdup (line);
   if (!ctrl->server_local->containername)
     err = gpg_error_from_syserror ();
 
 
  leave:
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_mount[] =
   "MOUNT [options] [<mountpoint>]\n"
   "\n"
   "Mount the currently open file onto MOUNTPOINT.  If MOUNTPOINT is not\n"
   "given the system picks an unused mountpoint.  MOUNTPOINT must\n"
   "be percent-plus escaped to allow for arbitrary names.";
 static gpg_error_t
 cmd_mount (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   char *p, *pend;
   size_t len;
 
   line = skip_options (line);
   for (p=line; *p && !spacep (p); p++)
     ;
   pend = p;
   while (spacep(p))
     p++;
   if (*p)
     {
       err = gpg_error (GPG_ERR_ASS_SYNTAX);
       goto leave;
     }
   *pend = 0;
 
   /* Unescape the line and check for embedded Nul bytes.  */
   len = percent_plus_unescape_inplace (line, 0);
   line[len] = 0;
   if (memchr (line, 0, len))
     {
       err = gpg_error (GPG_ERR_INV_NAME);
       goto leave;
     }
 
   if (!ctrl->server_local->containername)
     {
       err = gpg_error (GPG_ERR_MISSING_ACTION);
       goto leave;
     }
 
   /* Perform the mount.  */
   err = g13_mount_container (ctrl, ctrl->server_local->containername,
                              *line? line : NULL);
 
  leave:
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_umount[] =
   "UMOUNT [options] [<mountpoint>]\n"
   "\n"
   "Unmount the currently open file or the one opened at MOUNTPOINT.\n"
   "MOUNTPOINT must be percent-plus escaped.  On success the mountpoint\n"
   "is returned via a \"MOUNTPOINT\" status line.";
 static gpg_error_t
 cmd_umount (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   char *p, *pend;
   size_t len;
 
   line = skip_options (line);
   for (p=line; *p && !spacep (p); p++)
     ;
   pend = p;
   while (spacep(p))
     p++;
   if (*p)
     {
       err = gpg_error (GPG_ERR_ASS_SYNTAX);
       goto leave;
     }
   *pend = 0;
 
   /* Unescape the line and check for embedded Nul bytes.  */
   len = percent_plus_unescape_inplace (line, 0);
   line[len] = 0;
   if (memchr (line, 0, len))
     {
       err = gpg_error (GPG_ERR_INV_NAME);
       goto leave;
     }
 
   /* Perform the unmount.  */
   err = g13_umount_container (ctrl, ctrl->server_local->containername,
                               *line? line : NULL);
 
  leave:
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_recipient[] =
   "RECIPIENT <userID>\n"
   "\n"
   "Add USERID to the list of recipients to be used for the next CREATE\n"
   "command.  All recipient commands are cumulative until a RESET or an\n"
   "successful create command.";
 static gpg_error_t
 cmd_recipient (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
 
   line = skip_options (line);
 
-  if (!add_to_strlist_try (&ctrl->server_local->recipients, line))
+  if (!add_to_strlist_try (&ctrl->recipients, line))
     err = gpg_error_from_syserror ();
 
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_signer[] =
   "SIGNER <userID>\n"
   "\n"
   "Not yet implemented.";
 static gpg_error_t
 cmd_signer (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err;
 
   (void)ctrl;
   (void)line;
 
   err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_create[] =
   "CREATE [options] <filename>\n"
   "\n"
   "Create a new container.  On success the OPEN command is \n"
   "implictly done for the new container.";
 static gpg_error_t
 cmd_create (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err;
   char *p, *pend;
   size_t len;
 
   /* First we close the active container.  */
   xfree (ctrl->server_local->containername);
   ctrl->server_local->containername = NULL;
 
   /* Parse the line.  */
   line = skip_options (line);
   for (p=line; *p && !spacep (p); p++)
     ;
   pend = p;
   while (spacep(p))
     p++;
   if (*p || pend == line)
     {
       err = gpg_error (GPG_ERR_ASS_SYNTAX);
       goto leave;
     }
   *pend = 0;
 
   /* Unescape the line and check for embedded Nul bytes.  */
   len = percent_plus_unescape_inplace (line, 0);
   line[len] = 0;
   if (!len || memchr (line, 0, len))
     {
       err = gpg_error (GPG_ERR_INV_NAME);
       goto leave;
     }
 
   /* Create container.  */
-  err = g13_create_container (ctrl, line, ctrl->server_local->recipients);
+  err = g13_create_container (ctrl, line);
 
   if (!err)
     {
-      FREE_STRLIST (ctrl->server_local->recipients);
+      FREE_STRLIST (ctrl->recipients);
 
       /* Store the filename.  */
       ctrl->server_local->containername = xtrystrdup (line);
       if (!ctrl->server_local->containername)
         err = gpg_error_from_syserror ();
 
     }
  leave:
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_getinfo[] =
   "GETINFO <what>\n"
   "\n"
   "Multipurpose function to return a variety of information.\n"
   "Supported values for WHAT are:\n"
   "\n"
   "  version     - Return the version of the program.\n"
   "  pid         - Return the process id of the server.\n"
   "  cmd_has_option CMD OPT\n"
   "              - Return OK if the command CMD implements the option OPT.";
 static gpg_error_t
 cmd_getinfo (assuan_context_t ctx, char *line)
 {
   gpg_error_t err = 0;
 
   if (!strcmp (line, "version"))
     {
       const char *s = PACKAGE_VERSION;
       err = assuan_send_data (ctx, s, strlen (s));
     }
   else if (!strcmp (line, "pid"))
     {
       char numbuf[50];
 
       snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ());
       err = assuan_send_data (ctx, numbuf, strlen (numbuf));
     }
   else if (!strncmp (line, "cmd_has_option", 14)
            && (line[14] == ' ' || line[14] == '\t' || !line[14]))
     {
       char *cmd, *cmdopt;
       line += 14;
       while (*line == ' ' || *line == '\t')
         line++;
       if (!*line)
         err = gpg_error (GPG_ERR_MISSING_VALUE);
       else
         {
           cmd = line;
           while (*line && (*line != ' ' && *line != '\t'))
             line++;
           if (!*line)
             err = gpg_error (GPG_ERR_MISSING_VALUE);
           else
             {
               *line++ = 0;
               while (*line == ' ' || *line == '\t')
                 line++;
               if (!*line)
                 err = gpg_error (GPG_ERR_MISSING_VALUE);
               else
                 {
                   cmdopt = line;
                   if (!command_has_option (cmd, cmdopt))
                     err = gpg_error (GPG_ERR_GENERAL);
                 }
             }
         }
     }
   else
     err = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
 
   return leave_cmd (ctx, err);
 }
 
 
 
 /* Return true if the command CMD implements the option CMDOPT.  */
 static int
 command_has_option (const char *cmd, const char *cmdopt)
 {
   (void)cmd;
   (void)cmdopt;
 
   return 0;
 }
 
 
 /* Tell the Assuan library about our commands.  */
 static int
 register_commands (assuan_context_t ctx)
 {
   static struct {
     const char *name;
     assuan_handler_t handler;
     const char * const help;
   } table[] =  {
     { "OPEN",          cmd_open,   hlp_open },
     { "MOUNT",         cmd_mount,  hlp_mount},
     { "UMOUNT",        cmd_umount, hlp_umount },
     { "RECIPIENT",     cmd_recipient, hlp_recipient },
     { "SIGNER",        cmd_signer, hlp_signer },
     { "CREATE",        cmd_create, hlp_create },
     { "INPUT",         NULL },
     { "OUTPUT",        NULL },
     { "GETINFO",       cmd_getinfo,hlp_getinfo },
     { NULL }
   };
   gpg_error_t err;
   int i;
 
   for (i=0; table[i].name; i++)
     {
       err = assuan_register_command (ctx, table[i].name, table[i].handler,
                                      table[i].help);
       if (err)
         return err;
     }
   return 0;
 }
 
 
 /* Startup the server. DEFAULT_RECPLIST is the list of recipients as
    set from the command line or config file.  We only require those
    marked as encrypt-to. */
 gpg_error_t
 g13_server (ctrl_t ctrl)
 {
   gpg_error_t err;
   assuan_fd_t filedes[2];
   assuan_context_t ctx = NULL;
   static const char hello[] = ("GNU Privacy Guard's G13 server "
                                PACKAGE_VERSION " ready");
 
   /* We use a pipe based server so that we can work from scripts.
      assuan_init_pipe_server will automagically detect when we are
      called with a socketpair and ignore FIELDES in this case. */
   filedes[0] = assuan_fdopen (0);
   filedes[1] = assuan_fdopen (1);
   err = assuan_new (&ctx);
   if (err)
     {
       log_error ("failed to allocate an Assuan context: %s\n",
                  gpg_strerror (err));
       goto leave;
     }
 
   err = assuan_init_pipe_server (ctx, filedes);
   if (err)
     {
       log_error ("failed to initialize the server: %s\n", gpg_strerror (err));
       goto leave;
     }
 
   err = register_commands (ctx);
   if (err)
     {
       log_error ("failed to the register commands with Assuan: %s\n",
                  gpg_strerror (err));
       goto leave;
     }
 
   assuan_set_pointer (ctx, ctrl);
 
   if (opt.verbose || opt.debug)
     {
       char *tmp = NULL;
 
       tmp = xtryasprintf ("Home: %s\n"
                           "Config: %s\n"
                           "%s",
                           opt.homedir,
                           opt.config_filename,
                           hello);
       if (tmp)
         {
           assuan_set_hello_line (ctx, tmp);
           xfree (tmp);
         }
     }
   else
     assuan_set_hello_line (ctx, hello);
 
   assuan_register_reset_notify (ctx, reset_notify);
   assuan_register_option_handler (ctx, option_handler);
 
   ctrl->server_local = xtrycalloc (1, sizeof *ctrl->server_local);
   if (!ctrl->server_local)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   ctrl->server_local->assuan_ctx = ctx;
 
   while ( !(err = assuan_accept (ctx)) )
     {
       err = assuan_process (ctx);
       if (err)
         log_info ("Assuan processing failed: %s\n", gpg_strerror (err));
     }
   if (err == -1)
     err = 0;
   else
     log_info ("Assuan accept problem: %s\n", gpg_strerror (err));
 
  leave:
   reset_notify (ctx, NULL);  /* Release all items hold by SERVER_LOCAL.  */
   if (ctrl->server_local)
     {
       xfree (ctrl->server_local);
       ctrl->server_local = NULL;
     }
 
   assuan_release (ctx);
   return err;
 }
 
 
 /* Send a status line with status ID NO.  The arguments are a list of
    strings terminated by a NULL argument.  */
 gpg_error_t
 g13_status (ctrl_t ctrl, int no, ...)
 {
   gpg_error_t err = 0;
   va_list arg_ptr;
   const char *text;
 
   va_start (arg_ptr, no);
 
   if (ctrl->no_server && ctrl->status_fd == -1)
     ; /* No status wanted. */
   else if (ctrl->no_server)
     {
       if (!statusfp)
         {
           if (ctrl->status_fd == 1)
             statusfp = stdout;
           else if (ctrl->status_fd == 2)
             statusfp = stderr;
           else
             statusfp = fdopen (ctrl->status_fd, "w");
 
           if (!statusfp)
             {
               log_fatal ("can't open fd %d for status output: %s\n",
                          ctrl->status_fd, strerror(errno));
             }
         }
 
       fputs ("[GNUPG:] ", statusfp);
       fputs (get_status_string (no), statusfp);
 
       while ( (text = va_arg (arg_ptr, const char*) ))
         {
           putc ( ' ', statusfp );
           for (; *text; text++)
             {
               if (*text == '\n')
                 fputs ( "\\n", statusfp );
               else if (*text == '\r')
                 fputs ( "\\r", statusfp );
               else
                 putc ( *(const byte *)text,  statusfp );
             }
         }
       putc ('\n', statusfp);
       fflush (statusfp);
     }
   else
     {
       assuan_context_t ctx = ctrl->server_local->assuan_ctx;
       char buf[950], *p;
       size_t n;
 
       p = buf;
       n = 0;
       while ( (text = va_arg (arg_ptr, const char *)) )
         {
           if (n)
             {
               *p++ = ' ';
               n++;
             }
           for ( ; *text && n < DIM (buf)-2; n++)
             *p++ = *text++;
         }
       *p = 0;
       err = assuan_write_status (ctx, get_status_string (no), buf);
     }
 
   va_end (arg_ptr);
   return err;
 }
 
 
 /* Helper to notify the client about Pinentry events.  Returns an gpg
    error code. */
 gpg_error_t
 g13_proxy_pinentry_notify (ctrl_t ctrl, const unsigned char *line)
 {
   if (!ctrl || !ctrl->server_local)
     return 0;
   return assuan_inquire (ctrl->server_local->assuan_ctx, line, NULL, NULL, 0);
 }
diff --git a/g13/sh-cmd.c b/g13/sh-cmd.c
index 8a3006cab..6ba4cd8c8 100644
--- a/g13/sh-cmd.c
+++ b/g13/sh-cmd.c
@@ -1,559 +1,663 @@
 /* sh-cmd.c - The Assuan server for g13-syshelp
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <errno.h>
 #include <assert.h>
 
 #include "g13-syshelp.h"
 #include <assuan.h>
 #include "i18n.h"
 #include "keyblob.h"
 
 
 /* Local data for this server module.  A pointer to this is stored in
    the CTRL object of each connection.  */
 struct server_local_s
 {
   /* The Assuan contect we are working on.  */
   assuan_context_t assuan_ctx;
 
   /* The malloced name of the device.  */
   char *devicename;
 
   /* A stream open for read of the device set by the DEVICE command or
      NULL if no DEVICE command has been used.  */
   estream_t devicefp;
 };
 
 
 
 
 /* Local prototypes.  */
 
 
 
 
 /*
    Helper functions.
  */
 
 /* Set an error and a description.  */
 #define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))
 #define set_error_fail_cmd() set_error (GPG_ERR_NOT_INITIALIZED, \
                                         "not called via userv or unknown user")
 
 
 /* Skip over options.  Blanks after the options are also removed.  */
 static char *
 skip_options (const char *line)
 {
   while (spacep (line))
     line++;
   while ( *line == '-' && line[1] == '-' )
     {
       while (*line && !spacep (line))
         line++;
       while (spacep (line))
         line++;
     }
   return (char*)line;
 }
 
 
 /* Check whether the option NAME appears in LINE.  */
 /* static int */
 /* has_option (const char *line, const char *name) */
 /* { */
 /*   const char *s; */
 /*   int n = strlen (name); */
 
 /*   s = strstr (line, name); */
 /*   if (s && s >= skip_options (line)) */
 /*     return 0; */
 /*   return (s && (s == line || spacep (s-1)) && (!s[n] || spacep (s+n))); */
 /* } */
 
 
 /* Helper to print a message while leaving a command.  */
 static gpg_error_t
 leave_cmd (assuan_context_t ctx, gpg_error_t err)
 {
   if (err)
     {
       const char *name = assuan_get_command_name (ctx);
       if (!name)
         name = "?";
       if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
         log_error ("command '%s' failed: %s\n", name,
                    gpg_strerror (err));
       else
         log_error ("command '%s' failed: %s <%s>\n", name,
                    gpg_strerror (err), gpg_strsource (err));
     }
   return err;
 }
 
 
 
 
 /* The handler for Assuan OPTION commands.  */
 static gpg_error_t
 option_handler (assuan_context_t ctx, const char *key, const char *value)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
 
   (void)ctrl;
   (void)key;
   (void)value;
 
   if (ctrl->fail_all_cmds)
     err = set_error_fail_cmd ();
   else
     err = gpg_error (GPG_ERR_UNKNOWN_OPTION);
 
   return err;
 }
 
 
 /* The handler for an Assuan RESET command.  */
 static gpg_error_t
 reset_notify (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
 
   (void)line;
 
   xfree (ctrl->server_local->devicename);
   ctrl->server_local->devicename = NULL;
   es_fclose (ctrl->server_local->devicefp);
   ctrl->server_local->devicefp = NULL;
   ctrl->devti = NULL;
 
   assuan_close_input_fd (ctx);
   assuan_close_output_fd (ctx);
   return 0;
 }
 
 
 static const char hlp_device[] =
   "DEVICE <name>\n"
   "\n"
   "Set the device used by further commands.\n"
   "A device name or a PARTUUID string may be used.\n"
   "Access to that device (by the g13 system) is locked\n"
   "until a new DEVICE command or end of this process\n";
 static gpg_error_t
 cmd_device (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   tab_item_t ti;
   estream_t fp = NULL;
 
-  /* strcpy (line, "/dev/sdb1"); /\* FIXME *\/ */
   line = skip_options (line);
 
+/* # warning hardwired to /dev/sdb1 ! */
+/*   if (strcmp (line, "/dev/sdb1")) */
+/*     { */
+/*       err = gpg_error (GPG_ERR_ENOENT); */
+/*       goto leave; */
+/*     } */
+
   /* Always close an open device stream of this session. */
   xfree (ctrl->server_local->devicename);
   ctrl->server_local->devicename = NULL;
   es_fclose (ctrl->server_local->devicefp);
   ctrl->server_local->devicefp = NULL;
 
   /* Are we allowed to use the given device?  */
   for (ti=ctrl->client.tab; ti; ti = ti->next)
     if (!strcmp (line, ti->blockdev))
       break;
   if (!ti)
     {
       err = set_error (GPG_ERR_EACCES, "device not configured for user");
       goto leave;
     }
 
   ctrl->server_local->devicename = xtrystrdup (line);
   if (!ctrl->server_local->devicename)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
 
   /* Check whether we have permissions to open the device and keep an
      FD open.  */
   fp = es_fopen (ctrl->server_local->devicename, "rb");
   if (!fp)
     {
       err = gpg_error_from_syserror ();
       log_error ("error opening '%s': %s\n",
                  ctrl->server_local->devicename, gpg_strerror (err));
       goto leave;
     }
 
   es_fclose (ctrl->server_local->devicefp);
   ctrl->server_local->devicefp = fp;
   fp = NULL;
   ctrl->devti = ti;
 
   /* Fixme: Take some kind of lock.  */
 
  leave:
   es_fclose (fp);
   if (err)
     {
       xfree (ctrl->server_local->devicename);
       ctrl->server_local->devicename = NULL;
       ctrl->devti = NULL;
     }
   return leave_cmd (ctx, err);
 }
 
 
 static const char hlp_create[] =
   "CREATE <type>\n"
   "\n"
   "Create a new encrypted partition on the current device.\n"
   "<type> must be \"dm-crypt\" for now.";
 static gpg_error_t
 cmd_create (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
+  estream_t fp = NULL;
 
   line = skip_options (line);
-
   if (strcmp (line, "dm-crypt"))
     {
       err = set_error (GPG_ERR_INV_ARG, "Type must be \"dm-crypt\"");
       goto leave;
     }
 
   if (!ctrl->server_local->devicename
       || !ctrl->server_local->devicefp
       || !ctrl->devti)
     {
       err = set_error (GPG_ERR_ENOENT, "No device has been set");
       goto leave;
     }
 
   err = sh_is_empty_partition (ctrl->server_local->devicename);
   if (err)
     {
+      if (gpg_err_code (err) == GPG_ERR_FALSE)
+        err = gpg_error (GPG_ERR_CONFLICT);
       err = assuan_set_error (ctx, err, "Partition is not empty");
       goto leave;
     }
 
+  /* We need a writeable stream to create the container.  */
+  fp = es_fopen (ctrl->server_local->devicename, "r+b");
+  if (!fp)
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error opening '%s': %s\n",
+                 ctrl->server_local->devicename, gpg_strerror (err));
+      goto leave;
+    }
+  if (es_setvbuf (fp, NULL, _IONBF, 0))
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error setting '%s' to _IONBF: %s\n",
+                 ctrl->server_local->devicename, gpg_strerror (err));
+      goto leave;
+    }
+
   err = sh_dmcrypt_create_container (ctrl,
                                      ctrl->server_local->devicename,
-                                     ctrl->server_local->devicefp);
+                                     fp);
+  if (es_fclose (fp))
+    {
+      gpg_error_t err2 = gpg_error_from_syserror ();
+      log_error ("error closing '%s': %s\n",
+                 ctrl->server_local->devicename, gpg_strerror (err2));
+      if (!err)
+        err = err2;
+    }
+  fp = NULL;
 
+ leave:
+  es_fclose (fp);
+  return leave_cmd (ctx, err);
+}
 
 
+static const char hlp_mount[] =
+  "MOUNT <type>\n"
+  "\n"
+  "Mount an encrypted partition on the current device.\n"
+  "<type> must be \"dm-crypt\" for now.";
+static gpg_error_t
+cmd_mount (assuan_context_t ctx, char *line)
+{
+  ctrl_t ctrl = assuan_get_pointer (ctx);
+  gpg_error_t err = 0;
+  unsigned char *keyblob = NULL;
+  size_t keybloblen;
+  tupledesc_t tuples = NULL;
+
+  line = skip_options (line);
+
+  if (strcmp (line, "dm-crypt"))
+    {
+      err = set_error (GPG_ERR_INV_ARG, "Type must be \"dm-crypt\"");
+      goto leave;
+    }
+
+  if (!ctrl->server_local->devicename
+      || !ctrl->server_local->devicefp
+      || !ctrl->devti)
+    {
+      err = set_error (GPG_ERR_ENOENT, "No device has been set");
+      goto leave;
+    }
+
+  err = sh_is_empty_partition (ctrl->server_local->devicename);
+  if (!err)
+    {
+      err = gpg_error (GPG_ERR_ENODEV);
+      assuan_set_error (ctx, err, "Partition is empty");
+      goto leave;
+    }
+  err = 0;
+
+  /* We expect that the client already decrypted the keyblob.
+   * Eventually we should move reading of the keyblob to here and ask
+   * the client to decrypt it.  */
+  assuan_begin_confidential (ctx);
+  err = assuan_inquire (ctx, "KEYBLOB",
+                        &keyblob, &keybloblen, 4 * 1024);
+  assuan_end_confidential (ctx);
+  if (err)
+    {
+      log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
+      goto leave;
+    }
+  err = create_tupledesc (&tuples, keyblob, keybloblen);
+  if (!err)
+    keyblob = NULL;
+  else
+    {
+      if (gpg_err_code (err) == GPG_ERR_NOT_SUPPORTED)
+        log_error ("unknown keyblob version received\n");
+      goto leave;
+    }
+
+  err = sh_dmcrypt_mount_container (ctrl,
+                                    ctrl->server_local->devicename,
+                                    tuples);
 
  leave:
+  xfree (tuples);
+  destroy_tupledesc (tuples);
   return leave_cmd (ctx, err);
 }
 
 
-
 static const char hlp_getinfo[] =
   "GETINFO <what>\n"
   "\n"
   "Multipurpose function to return a variety of information.\n"
   "Supported values for WHAT are:\n"
   "\n"
   "  version     - Return the version of the program.\n"
   "  pid         - Return the process id of the server.\n"
   "  showtab     - Show the table for the user.";
 static gpg_error_t
 cmd_getinfo (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   char *buf;
 
   if (!strcmp (line, "version"))
     {
       const char *s = PACKAGE_VERSION;
       err = assuan_send_data (ctx, s, strlen (s));
     }
   else if (!strcmp (line, "pid"))
     {
       char numbuf[50];
 
       snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ());
       err = assuan_send_data (ctx, numbuf, strlen (numbuf));
     }
   else if (!strncmp (line, "getsz", 5))
     {
       unsigned long long nblocks;
       err = sh_blockdev_getsz (line+6, &nblocks);
       if (!err)
         log_debug ("getsz=%llu\n", nblocks);
     }
   else if (!strcmp (line, "showtab"))
     {
       tab_item_t ti;
 
       for (ti=ctrl->client.tab; !err && ti; ti = ti->next)
         {
           buf = es_bsprintf ("%s %s%s %s %s%s\n",
                              ctrl->client.uname,
                              *ti->blockdev=='/'? "":"partuuid=",
                              ti->blockdev,
                              ti->label? ti->label : "-",
                              ti->mountpoint? " ":"",
                              ti->mountpoint? ti->mountpoint:"");
           if (!buf)
             err = gpg_error_from_syserror ();
           else
             {
               err = assuan_send_data (ctx, buf, strlen (buf));
               if (!err)
                 err = assuan_send_data (ctx, NULL, 0); /* Flush  */
             }
           xfree (buf);
         }
     }
   else
     err = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
 
   return leave_cmd (ctx, err);
 }
 
 
 /* This command handler is used for all commands if this process has
    not been started as expected.  */
 static gpg_error_t
 fail_command (assuan_context_t ctx, char *line)
 {
   gpg_error_t err;
   const char *name = assuan_get_command_name (ctx);
 
   (void)line;
 
   if (!name)
     name = "?";
 
   err = set_error_fail_cmd ();
   log_error ("command '%s' failed: %s\n", name, gpg_strerror (err));
   return err;
 }
 
 
 /* Tell the Assuan library about our commands.  */
 static int
 register_commands (assuan_context_t ctx, int fail_all)
 {
   static struct {
     const char *name;
     assuan_handler_t handler;
     const char * const help;
   } table[] =  {
     { "DEVICE",        cmd_device, hlp_device },
     { "CREATE",        cmd_create, hlp_create },
+    { "MOUNT",         cmd_mount,  hlp_mount  },
     { "INPUT",         NULL },
     { "OUTPUT",        NULL },
     { "GETINFO",       cmd_getinfo, hlp_getinfo },
     { NULL }
   };
   gpg_error_t err;
   int i;
 
   for (i=0; table[i].name; i++)
     {
       err = assuan_register_command (ctx, table[i].name,
                                      fail_all ? fail_command : table[i].handler,
                                      table[i].help);
       if (err)
         return err;
     }
   return 0;
 }
 
 
 /* Startup the server.  */
 gpg_error_t
 syshelp_server (ctrl_t ctrl)
 {
   gpg_error_t err;
   assuan_fd_t filedes[2];
   assuan_context_t ctx = NULL;
 
   /* We use a pipe based server so that we can work from scripts.
      assuan_init_pipe_server will automagically detect when we are
      called with a socketpair and ignore FILEDES in this case. */
   filedes[0] = assuan_fdopen (0);
   filedes[1] = assuan_fdopen (1);
   err = assuan_new (&ctx);
   if (err)
     {
       log_error ("failed to allocate an Assuan context: %s\n",
                  gpg_strerror (err));
       goto leave;
     }
 
   err = assuan_init_pipe_server (ctx, filedes);
   if (err)
     {
       log_error ("failed to initialize the server: %s\n", gpg_strerror (err));
       goto leave;
     }
 
   err = register_commands (ctx, 0 /*FIXME:ctrl->fail_all_cmds*/);
   if (err)
     {
       log_error ("failed to the register commands with Assuan: %s\n",
                  gpg_strerror (err));
       goto leave;
     }
 
   assuan_set_pointer (ctx, ctrl);
 
   {
     char *tmp = xtryasprintf ("G13-syshelp %s ready to serve requests "
                               "from %lu(%s)",
                               PACKAGE_VERSION,
                               (unsigned long)ctrl->client.uid,
                               ctrl->client.uname);
     if (tmp)
       {
         assuan_set_hello_line (ctx, tmp);
         xfree (tmp);
       }
   }
 
   assuan_register_reset_notify (ctx, reset_notify);
   assuan_register_option_handler (ctx, option_handler);
 
   ctrl->server_local = xtrycalloc (1, sizeof *ctrl->server_local);
   if (!ctrl->server_local)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   ctrl->server_local->assuan_ctx = ctx;
 
   while ( !(err = assuan_accept (ctx)) )
     {
       err = assuan_process (ctx);
       if (err)
         log_info ("Assuan processing failed: %s\n", gpg_strerror (err));
     }
   if (err == -1)
     err = 0;
   else
     log_info ("Assuan accept problem: %s\n", gpg_strerror (err));
 
  leave:
   reset_notify (ctx, NULL);  /* Release all items hold by SERVER_LOCAL.  */
   if (ctrl->server_local)
     {
       xfree (ctrl->server_local);
       ctrl->server_local = NULL;
     }
 
   assuan_release (ctx);
   return err;
 }
 
 
 gpg_error_t
 sh_encrypt_keyblob (ctrl_t ctrl, const void *keyblob, size_t keybloblen,
                     char **r_enckeyblob, size_t *r_enckeybloblen)
 {
   assuan_context_t ctx = ctrl->server_local->assuan_ctx;
   gpg_error_t err;
   unsigned char *enckeyblob;
   size_t enckeybloblen;
 
   *r_enckeyblob = NULL;
 
   /* Send the plaintext.  */
   err = g13_status (ctrl, STATUS_PLAINTEXT_FOLLOWS, NULL);
   if (err)
     return err;
   assuan_begin_confidential (ctx);
   err = assuan_send_data (ctx, keyblob, keybloblen);
   if (!err)
     err = assuan_send_data (ctx, NULL, 0);
   assuan_end_confidential (ctx);
   if (!err)
     err = assuan_write_line (ctx, "END");
   if (err)
     {
       log_error (_("error sending data: %s\n"), gpg_strerror (err));
       return err;
     }
 
   /* Inquire the ciphertext.  */
   err = assuan_inquire (ctx, "ENCKEYBLOB",
                         &enckeyblob, &enckeybloblen, 16 * 1024);
   if (err)
     {
       log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
       return err;
     }
 
   *r_enckeyblob = enckeyblob;
   *r_enckeybloblen = enckeybloblen;
   return 0;
 }
 
 
 /* Send a status line with status ID NO.  The arguments are a list of
    strings terminated by a NULL argument.  */
 gpg_error_t
 g13_status (ctrl_t ctrl, int no, ...)
 {
   gpg_error_t err = 0;
   va_list arg_ptr;
   const char *text;
 
   va_start (arg_ptr, no);
 
   if (1)
     {
       assuan_context_t ctx = ctrl->server_local->assuan_ctx;
       char buf[950], *p;
       size_t n;
 
       p = buf;
       n = 0;
       while ( (text = va_arg (arg_ptr, const char *)) )
         {
           if (n)
             {
               *p++ = ' ';
               n++;
             }
           for ( ; *text && n < DIM (buf)-2; n++)
             *p++ = *text++;
         }
       *p = 0;
       err = assuan_write_status (ctx, get_status_string (no), buf);
     }
 
   va_end (arg_ptr);
   return err;
 }
diff --git a/g13/sh-dmcrypt.c b/g13/sh-dmcrypt.c
index 20eea2350..f0693b1e9 100644
--- a/g13/sh-dmcrypt.c
+++ b/g13/sh-dmcrypt.c
@@ -1,407 +1,686 @@
 /* sh-dmcrypt.c - The DM-Crypt part for g13-syshelp
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <errno.h>
 #include <assert.h>
 #include <sys/types.h>
 #ifdef HAVE_STAT
 # include <sys/stat.h>
 #endif
 #include <unistd.h>
 
 #include "g13-syshelp.h"
 #include <assuan.h>
 #include "i18n.h"
 #include "g13tuple.h"
 #include "exectool.h"
 #include "keyblob.h"
 
 /* The standard disk block size (logical).  */
 #define SECTOR_SIZE 512
 
 /* The physical block size used by modern devices.  */
 #define PHY_SECTOR_SIZE  (SECTOR_SIZE*8)  /* 4 KiB */
 
 /* The length of the crypto setup area in sectors.  16 KiB is a nice
    multiple of a modern block size and should be sufficient for all
-   kind of extra public key encryption packet.  */
+   kind of extra public key encryption packets.  */
 #define SETUP_AREA_SECTORS 32  /* 16 KiB */
 
 /* The number of header block copies stored at the begin and end of
    the device.  */
 #define HEADER_SETUP_AREA_COPIES 2
 #define FOOTER_SETUP_AREA_COPIES 2
 
 /* The length in blocks of the space we put at the start and at the
    end of the device.  This space is used to store N copies of the
    setup area for the actual encrypted container inbetween.  */
 #define HEADER_SECTORS (SETUP_AREA_SECTORS * HEADER_SETUP_AREA_COPIES)
 #define FOOTER_SECTORS (SETUP_AREA_SECTORS * FOOTER_SETUP_AREA_COPIES)
 
 /* Minimim size of the encrypted space in blocks.  This is more or
    less an arbitrary value.  */
 #define MIN_ENCRYPTED_SPACE 32
 
 /* Some consistency checks for the above constants.  */
 #if (PHY_SECTOR_SIZE % SECTOR_SIZE)
 # error the physical secotor size should be a multiple of 512
 #endif
 #if ((SETUP_AREA_SECTORS*SECTOR_SIZE) % PHY_SECTOR_SIZE)
 # error The setup area size should be a multiple of the phy. sector size.
 #endif
 
 
 /* Check whether the block device DEVNAME is used by device mapper.
    Returns: 0 if the device is good and not yet used by DM.  */
 static gpg_error_t
 check_blockdev (const char *devname)
 {
   gpg_error_t err;
   struct stat sb;
   unsigned int devmajor, devminor;
   char *result = NULL;
   char **lines = NULL;
   char **fields = NULL;
   int lno, count;
 
   if (stat (devname, &sb))
     {
       err = gpg_error_from_syserror ();
       log_error ("error stating '%s': %s\n", devname, gpg_strerror (err));
       return err;
     }
   if (!S_ISBLK (sb.st_mode))
     {
       err = gpg_error (GPG_ERR_ENOTBLK);
       log_error ("can't use '%s': %s\n", devname, gpg_strerror (err));
       return err;
     }
   devmajor = major (sb.st_rdev);
   devminor = minor (sb.st_rdev);
 
   {
     const char *argv[2];
 
     argv[0] = "deps";
     argv[1] = NULL;
     err = gnupg_exec_tool ("/sbin/dmsetup", argv, NULL, &result, NULL);
   }
   if (err)
     {
       log_error ("error running '%s' to search for '%s': %s\n",
                  "dmsetup deps", devname, gpg_strerror (err));
       goto leave;
     }
   lines = strsplit (result, '\n', 0, NULL);
   if (!lines)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   if (lines[0] && !strcmp (lines[0], "No devices found"))
     ;
   else
     {
       for (lno=0; lines[lno]; lno++)
         {
           unsigned int xmajor, xminor;
 
           if (!*lines[lno])
             continue;
           xfree (fields);
           fields = strsplit (lines[lno], ':', 0, &count);
           if (!fields)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
           if (count < 3
               || sscanf (fields[2], " (%u,%u)", &xmajor, &xminor) != 2)
             {
               log_error ("error running '%s' to search for '%s': %s\n",
                          "dmsetup deps", devname, "unexpected output");
               err = gpg_error (GPG_ERR_INV_VALUE);
               goto leave;
             }
 
           if (xmajor == devmajor && xminor == devminor)
             {
               log_error ("device '%s' (%u:%u) already used by device mapper\n",
                          devname, devmajor, devminor);
               err = gpg_error (GPG_ERR_EBUSY);
               goto leave;
             }
         }
     }
 
 
  leave:
   xfree (fields);
   xfree (lines);
   xfree (result);
   return err;
 }
 
 
 /* Return a malloced buffer with the prefix of the setup area.  This
    is the data written right before the encrypted keyblob.  Return NULL
    on error and sets ERRNO.  */
 static void *
 mk_setup_area_prefix (size_t *r_length)
 {
   unsigned char *packet;
   size_t setuparealen;
 
   packet = xtrymalloc (32);
   if (!packet)
     return NULL;
   *r_length = 32;
 
   setuparealen = SETUP_AREA_SECTORS * SECTOR_SIZE;
 
   packet[0] = (0xc0|61); /* CTB for the private packet type 0x61.  */
   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
   packet[2] = 0;
   packet[3] = 0;
   packet[4] = 0;
   packet[5] = 26;
   memcpy (packet+6, "GnuPG/G13", 10); /* Packet subtype.  */
   packet[16] = 1;   /* G13 packet format version.  */
   packet[17] = 0;   /* Reserved.  */
   packet[18] = 0;   /* Reserved.  */
   packet[19] = 1;   /* OS Flag = Linux  */
   packet[20] = (setuparealen >> 24);  /* Total length of header.  */
   packet[21] = (setuparealen >> 16);
   packet[22] = (setuparealen >> 8);
   packet[23] = (setuparealen);
   packet[24] = HEADER_SETUP_AREA_COPIES;
   packet[25] = FOOTER_SETUP_AREA_COPIES;
   packet[26] = 0;   /* Reserved.  */
   packet[27] = 0;   /* Reserved.  */
   packet[28] = 0;   /* Reserved.  */
   packet[29] = 0;   /* Reserved.  */
   packet[30] = 0;   /* Reserved.  */
   packet[31] = 0;   /* Reserved.  */
 
   return packet;
 }
 
 
+/* Create a new g13 styloe DM-Crypt container on devoce DEVNAME.  */
 gpg_error_t
 sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname, estream_t devfp)
 {
   gpg_error_t err;
   char *header_space;
+  size_t header_space_size, header_space_used;
+  size_t paddinglen;
   char *targetname = NULL;
   size_t nread;
   char *p;
   char hexkey[16*2+1];
   char *table = NULL;
   unsigned long long nblocks;
   char *result = NULL;
   unsigned char twobyte[2];
   membuf_t keyblob;
   void  *keyblob_buf = NULL;
   size_t keyblob_len;
   size_t n;
   const char *s;
+  unsigned char *packet;
+  int copy;
 
   if (!ctrl->devti)
     return gpg_error (GPG_ERR_INV_ARG);
 
-  header_space = xtrymalloc (HEADER_SECTORS * SECTOR_SIZE);
+  header_space_size = SETUP_AREA_SECTORS * SECTOR_SIZE;
+  header_space = xtrymalloc (header_space_size);
   if (!header_space)
     return gpg_error_from_syserror ();
 
   /* Start building the keyblob.  */
   init_membuf (&keyblob, 512);
   append_tuple (&keyblob, KEYBLOB_TAG_BLOBVERSION, "\x01", 1);
   n = CONTTYPE_DM_CRYPT;
   twobyte[0] = (n >> 8);
   twobyte[1] = n;
   append_tuple (&keyblob, KEYBLOB_TAG_CONTTYPE, twobyte, 2);
   {
     gnupg_isotime_t tbuf;
 
     gnupg_get_isotime (tbuf);
     append_tuple (&keyblob, KEYBLOB_TAG_CREATED, tbuf, strlen (tbuf));
   }
 
-  /* Rewind out stream.  */
+  /* Rewind device stream.  */
   if (es_fseeko (devfp, 0, SEEK_SET))
     {
       err = gpg_error_from_syserror ();
       log_error ("error seeking to begin of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   es_clearerr (devfp);
 
   /* Extra check that the device is empty.  */
-  if (es_read (devfp, header_space, HEADER_SECTORS * SECTOR_SIZE, &nread))
+  if (es_read (devfp, header_space, header_space_size, &nread))
     err = gpg_error_from_syserror ();
-  else if (nread != HEADER_SECTORS * SECTOR_SIZE)
+  else if (nread != header_space_size)
     err = gpg_error (GPG_ERR_TOO_SHORT);
   else
     err = 0;
   if (err)
     {
       log_error ("error reading header space of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   for (p=header_space; nread && !*p; nread--, p++)
     ;
   if (nread)
     {
       log_error ("header space of '%s' already used - use %s to override\n",
                  devname, "--force");
       err = gpg_error (GPG_ERR_NOT_SUPPORTED);
       goto leave;
     }
 
   /* Check that the device is not used by device mapper. */
   err = check_blockdev (devname);
   if (err)
     goto leave;
 
   /* Compute the number of blocks.  */
   err = sh_blockdev_getsz (devname, &nblocks);
   if (err)
     {
       log_error ("error getting size of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   if (nblocks <= HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS)
     {
       log_error ("device '%s' is too small (min=%d blocks)\n",
                  devname,
                  HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS);
       err = gpg_error (GPG_ERR_TOO_SHORT);
       goto leave;
     }
+  append_tuple_uint (&keyblob, KEYBLOB_TAG_CONT_NSEC, nblocks);
   nblocks -= HEADER_SECTORS + FOOTER_SECTORS;
+  append_tuple_uint (&keyblob, KEYBLOB_TAG_ENC_NSEC, nblocks);
+  append_tuple_uint (&keyblob, KEYBLOB_TAG_ENC_OFF, HEADER_SECTORS);
 
   /* Device mapper needs a name for the device: Take it from the label
      or use "0".  */
   targetname = strconcat ("g13-", ctrl->client.uname, "-",
                           ctrl->devti->label? ctrl->devti->label : "0",
                           NULL);
   if (!targetname)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Create the key.  */
   {
     char key[16];
     gcry_randomize (key, sizeof key, GCRY_STRONG_RANDOM);
     append_tuple (&keyblob, KEYBLOB_TAG_ENCKEY, key, sizeof key);
     bin2hex (key, 16, hexkey);
     wipememory (key, 16);
     /* Add a 2*(4+16) byte filler to conceal the fact that we use
        AES-128.  If we ever want to switch to 256 bit we can resize
        that filler to keep the keyblob at the same size.  */
     append_tuple (&keyblob, KEYBLOB_TAG_FILLER, key, sizeof key);
     append_tuple (&keyblob, KEYBLOB_TAG_FILLER, key, sizeof key);
   }
 
   /* Build dmcrypt table. */
   s = "aes-cbc-essiv:sha256";
   append_tuple (&keyblob, KEYBLOB_TAG_ALGOSTR, s, strlen (s));
   table = es_bsprintf ("0 %llu crypt %s %s 0 %s %d",
                        nblocks, s, hexkey, devname, HEADER_SECTORS);
   if (!table)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   wipememory (hexkey, sizeof hexkey);
 
   /* Add a copy of the setup area prefix to the keyblob.  */
   p = mk_setup_area_prefix (&n);
   if (!p)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   append_tuple (&keyblob, KEYBLOB_TAG_HDRCOPY, p, n);
+  assert (n < header_space_size);
+  memcpy (header_space, p, n);
+  header_space_used = n;
 
   /* Turn the keyblob into a buffer and callback to encrypt it.  */
   keyblob_buf = get_membuf (&keyblob, &keyblob_len);
   if (!keyblob_buf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   err = sh_encrypt_keyblob (ctrl, keyblob_buf, keyblob_len, &p, &n);
   if (err)
     {
       log_error ("encrypting the keyblob failed: %s\n", gpg_strerror (err));
       goto leave;
     }
+  log_debug ("plain setuparea=%p %zu bytes\n", keyblob_buf, keyblob_len);
   wipememory (keyblob_buf, keyblob_len);
   xfree (keyblob_buf);
   keyblob_buf = NULL;
 
+  log_debug ("encry setuparea=%p %zu bytes\n", p, n);
+  if (n >= header_space_size || (header_space_used + n) >= header_space_size)
+    {
+      err = gpg_error (GPG_ERR_TOO_LARGE);
+      log_error ("setup area would overflow: %s\n", gpg_strerror (err));
+      goto leave;
+    }
+  memcpy (header_space + header_space_used, p, n);
+  header_space_used += n;
+
+  /* Write the padding.  */
+  packet = header_space + header_space_used;
+  paddinglen = header_space_size - header_space_used;
+  if (paddinglen < 16)
+    {
+      err = gpg_error (GPG_ERR_TOO_LARGE);
+      log_error ("setup area too short for padding: %s\n", gpg_strerror (err));
+      goto leave;
+    }
+  packet[0] = (0xc0|61); /* CTB for Private packet type 0x61.  */
+  packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
+  packet[2] = (paddinglen-6) >> 24;
+  packet[3] = (paddinglen-6) >> 16;
+  packet[4] = (paddinglen-6) >> 8;
+  packet[5] = (paddinglen-6);
+  packet += 6;
+  paddinglen -= 6;
+  header_space_used += 6;
+  for ( ;paddinglen >= 10;
+        paddinglen -= 10, packet += 10, header_space_used += 10)
+    memcpy (packet, "GnuPG/PAD", 10);
+  for ( ;paddinglen; paddinglen--, packet++, header_space_used++)
+    *packet = 0;
+
+  if (header_space_used != header_space_size)
+    BUG ();
+
   /* Create the container.  */
-  /* { */
-  /*   const char *argv[3]; */
-
-  /*   argv[0] = "create"; */
-  /*   argv[1] = targetname; */
-  /*   argv[2] = NULL; */
-  /*   err = sh_exec_tool ("/sbin/dmsetup", argv, table, &result, NULL); */
-  /* } */
-  /* if (err) */
-  /*   { */
-  /*     log_error ("error running dmsetup for '%s': %s\n", */
-  /*                devname, gpg_strerror (err)); */
-  /*     goto leave; */
-  /*   } */
-  /* log_debug ("dmsetup result: %s\n", result); */
+  {
+    const char *argv[3];
+
+    argv[0] = "create";
+    argv[1] = targetname;
+    argv[2] = NULL;
+    log_debug ("now running \"dmsetup create %s\"\n", targetname);
+    log_debug ("  with table='%s'\"\n", table);
+    err = gnupg_exec_tool ("/sbin/dmsetup", argv, table, &result, NULL);
+  }
+  if (err)
+    {
+      log_error ("error running dmsetup for '%s': %s\n",
+                 devname, gpg_strerror (err));
+      goto leave;
+    }
+  if (result && *result)
+    log_debug ("dmsetup result: %s\n", result);
 
   /* Write the setup area.  */
+  if (es_fseeko (devfp, 0, SEEK_SET))
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error seeking to begin of '%s': %s\n",
+                 devname, gpg_strerror (err));
+      goto leave;
+    }
+  es_clearerr (devfp);
+
+  for (copy = 0; copy < HEADER_SETUP_AREA_COPIES; copy++)
+    {
+      size_t nwritten;
 
+      if (es_write (devfp, header_space, header_space_size, &nwritten))
+        {
+          err = gpg_error_from_syserror ();
+          break;
+        }
+      else if (nwritten != header_space_size)
+        {
+          err = gpg_error (GPG_ERR_TOO_SHORT);
+          break;
+        }
+    }
+  if (err)
+    {
+      log_error ("error writing header space copy %d of '%s': %s\n",
+                 copy, devname, gpg_strerror (err));
+      goto leave;
+    }
+
+  if (es_fseeko (devfp,
+                 (- header_space_size * FOOTER_SETUP_AREA_COPIES), SEEK_END))
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error seeking to end of '%s': %s\n",
+                 devname, gpg_strerror (err));
+      goto leave;
+    }
+  es_clearerr (devfp);
+
+  for (copy = 0; copy < FOOTER_SETUP_AREA_COPIES; copy++)
+    {
+      size_t nwritten;
+
+      if (es_write (devfp, header_space, header_space_size, &nwritten))
+        {
+          err = gpg_error_from_syserror ();
+          break;
+        }
+      else if (nwritten != header_space_size)
+        {
+          err = gpg_error (GPG_ERR_TOO_SHORT);
+          break;
+        }
+    }
+  if (!err && es_fflush (devfp))
+    err = gpg_error_from_syserror ();
+  if (err)
+    {
+      log_error ("error writing footer space copy %d of '%s': %s\n",
+                 copy, devname, gpg_strerror (err));
+      goto leave;
+    }
 
  leave:
   wipememory (hexkey, sizeof hexkey);
   if (table)
     {
       wipememory (table, strlen (table));
       xfree (table);
     }
   if (keyblob_buf)
     {
       wipememory (keyblob_buf, keyblob_len);
       xfree (keyblob_buf);
     }
   xfree (get_membuf (&keyblob, NULL));
   xfree (targetname);
   xfree (result);
   xfree (header_space);
   return err;
 }
+
+
+/* Mount a DM-Crypt congtainer on device DEVNAME taking keys and other
+ * meta data from KEYBLOB.  */
+gpg_error_t
+sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
+                            tupledesc_t keyblob)
+{
+  gpg_error_t err;
+  char *targetname = NULL;
+  char hexkey[16*2+1];
+  char *table = NULL;
+  unsigned long long nblocks, nblocks2;
+  char *result = NULL;
+  size_t n;
+  const char *s;
+  const char *algostr;
+  size_t algostrlen;
+
+  if (!ctrl->devti)
+    return gpg_error (GPG_ERR_INV_ARG);
+
+  /* Check that the device is not yet used by device mapper. */
+  err = check_blockdev (devname);
+  if (err)
+    goto leave;
+
+  /* Compute the number of blocks and compare them to the value
+     provided as meta data.  */
+  err = sh_blockdev_getsz (devname, &nblocks);
+  if (err)
+    {
+      log_error ("error getting size of '%s': %s\n",
+                 devname, gpg_strerror (err));
+      goto leave;
+    }
+  err = find_tuple_uint (keyblob, KEYBLOB_TAG_CONT_NSEC, &nblocks2);
+  if (err)
+    {
+      log_error ("error getting size from keyblob: %s\n", gpg_strerror (err));
+      goto leave;
+    }
+  if (nblocks != nblocks2)
+    {
+      log_error ("inconsistent size of container: expected==%llu got=%llu\n",
+                 nblocks2, nblocks);
+      err = gpg_error (GPG_ERR_INV_DATA);
+      goto leave;
+    }
+  if (nblocks <= HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS)
+    {
+      log_error ("device '%s' is too small (min=%d blocks)\n",
+                 devname,
+                 HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS);
+      err = gpg_error (GPG_ERR_TOO_SHORT);
+      goto leave;
+    }
+  nblocks -= HEADER_SECTORS + FOOTER_SECTORS;
+  err = find_tuple_uint (keyblob, KEYBLOB_TAG_ENC_NSEC, &nblocks2);
+  if (err)
+    {
+      log_error ("error getting enc size from keyblob: %s\n",
+                 gpg_strerror (err));
+      goto leave;
+    }
+  if (nblocks != nblocks2)
+    {
+      log_error ("inconsistent size of enc data: expected==%llu got=%llu\n",
+                 nblocks2, nblocks);
+      err = gpg_error (GPG_ERR_INV_DATA);
+      goto leave;
+    }
+  /* Check that the offset is consistent.  */
+  err = find_tuple_uint (keyblob, KEYBLOB_TAG_ENC_OFF, &nblocks2);
+  if (err)
+    {
+      log_error ("error getting enc offset from keyblob: %s\n",
+                 gpg_strerror (err));
+      goto leave;
+    }
+  if (nblocks2 != HEADER_SECTORS)
+    {
+      log_error ("inconsistent offset of enc data: expected==%llu got=%d\n",
+                 nblocks2, HEADER_SECTORS);
+      err = gpg_error (GPG_ERR_INV_DATA);
+      goto leave;
+    }
+
+  /* Device mapper needs a name for the device: Take it from the label
+     or use "0".  */
+  targetname = strconcat ("g13-", ctrl->client.uname, "-",
+                          ctrl->devti->label? ctrl->devti->label : "0",
+                          NULL);
+  if (!targetname)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  /* Get the algorithm string.  */
+  algostr = find_tuple (keyblob, KEYBLOB_TAG_ALGOSTR, &algostrlen);
+  if (!algostr || algostrlen > 100)
+    {
+      log_error ("algo string not found in keyblob or too long\n");
+      err = gpg_error (GPG_ERR_INV_DATA);
+      goto leave;
+    }
+
+  /* Get the key.  */
+  s = find_tuple (keyblob, KEYBLOB_TAG_ENCKEY, &n);
+  if (!s || n != 16)
+    {
+      if (!s)
+        log_error ("no key found in keyblob\n");
+      else
+        log_error ("unexpected size of key (%zu)\n", n);
+      err = gpg_error (GPG_ERR_INV_KEYLEN);
+      goto leave;
+    }
+  bin2hex (s, 16, hexkey);
+
+  /* Build dmcrypt table. */
+  table = es_bsprintf ("0 %llu crypt %.*s %s 0 %s %d",
+                       nblocks, (int)algostrlen, algostr,
+                       hexkey, devname, HEADER_SECTORS);
+  wipememory (hexkey, sizeof hexkey);
+  if (!table)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  /* Load the table.  */
+  {
+    const char *argv[3];
+
+    argv[0] = "create";
+    argv[1] = targetname;
+    argv[2] = NULL;
+    log_debug ("now running \"dmsetup create %s\"\n", targetname);
+    err = gnupg_exec_tool ("/sbin/dmsetup", argv, table, &result, NULL);
+  }
+  if (err)
+    {
+      log_error ("error running dmsetup for '%s': %s\n",
+                 devname, gpg_strerror (err));
+      goto leave;
+    }
+  if (result && *result)
+    log_debug ("dmsetup result: %s\n", result);
+
+
+ leave:
+  wipememory (hexkey, sizeof hexkey);
+  if (table)
+    {
+      wipememory (table, strlen (table));
+      xfree (table);
+    }
+  xfree (targetname);
+  xfree (result);
+  return err;
+}