xref: /freebsd/sys/kern/vfs_mount.c (revision 1669d8afc64812c8d2d1d147ae1fd42ff441e1b1)
1 /*-
2  * Copyright (c) 1999-2004 Poul-Henning Kamp
3  * Copyright (c) 1999 Michael Smith
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include <sys/param.h>
41 #include <sys/conf.h>
42 #include <sys/clock.h>
43 #include <sys/jail.h>
44 #include <sys/kernel.h>
45 #include <sys/libkern.h>
46 #include <sys/malloc.h>
47 #include <sys/mount.h>
48 #include <sys/mutex.h>
49 #include <sys/namei.h>
50 #include <sys/priv.h>
51 #include <sys/proc.h>
52 #include <sys/filedesc.h>
53 #include <sys/reboot.h>
54 #include <sys/syscallsubr.h>
55 #include <sys/sysproto.h>
56 #include <sys/sx.h>
57 #include <sys/sysctl.h>
58 #include <sys/sysent.h>
59 #include <sys/systm.h>
60 #include <sys/vnode.h>
61 #include <vm/uma.h>
62 
63 #include <geom/geom.h>
64 
65 #include <machine/stdarg.h>
66 
67 #include <security/audit/audit.h>
68 #include <security/mac/mac_framework.h>
69 
70 #include "opt_rootdevname.h"
71 #include "opt_ddb.h"
72 #include "opt_mac.h"
73 
74 #ifdef DDB
75 #include <ddb/ddb.h>
76 #endif
77 
78 #define	ROOTNAME		"root_device"
79 #define	VFS_MOUNTARG_SIZE_MAX	(1024 * 64)
80 
81 static int	vfs_domount(struct thread *td, const char *fstype,
82 		    char *fspath, int fsflags, void *fsdata);
83 static int	vfs_mountroot_ask(void);
84 static int	vfs_mountroot_try(const char *mountfrom);
85 static int	vfs_donmount(struct thread *td, int fsflags,
86 		    struct uio *fsoptions);
87 static void	free_mntarg(struct mntarg *ma);
88 static int	vfs_getopt_pos(struct vfsoptlist *opts, const char *name);
89 
90 static int	usermount = 0;
91 SYSCTL_INT(_vfs, OID_AUTO, usermount, CTLFLAG_RW, &usermount, 0,
92     "Unprivileged users may mount and unmount file systems");
93 
94 MALLOC_DEFINE(M_MOUNT, "mount", "vfs mount structure");
95 MALLOC_DEFINE(M_VNODE_MARKER, "vnodemarker", "vnode marker");
96 static uma_zone_t mount_zone;
97 
98 /* List of mounted filesystems. */
99 struct mntlist mountlist = TAILQ_HEAD_INITIALIZER(mountlist);
100 
101 /* For any iteration/modification of mountlist */
102 struct mtx mountlist_mtx;
103 MTX_SYSINIT(mountlist, &mountlist_mtx, "mountlist", MTX_DEF);
104 
105 TAILQ_HEAD(vfsoptlist, vfsopt);
106 struct vfsopt {
107 	TAILQ_ENTRY(vfsopt) link;
108 	char	*name;
109 	void	*value;
110 	int	len;
111 };
112 
113 /*
114  * The vnode of the system's root (/ in the filesystem, without chroot
115  * active.)
116  */
117 struct vnode	*rootvnode;
118 
119 /*
120  * The root filesystem is detailed in the kernel environment variable
121  * vfs.root.mountfrom, which is expected to be in the general format
122  *
123  * <vfsname>:[<path>]
124  * vfsname   := the name of a VFS known to the kernel and capable
125  *              of being mounted as root
126  * path      := disk device name or other data used by the filesystem
127  *              to locate its physical store
128  */
129 
130 /*
131  * Global opts, taken by all filesystems
132  */
133 static const char *global_opts[] = {
134 	"errmsg",
135 	"fstype",
136 	"fspath",
137 	"ro",
138 	"rw",
139 	"nosuid",
140 	"noexec",
141 	"update",
142 	NULL
143 };
144 
145 /*
146  * The root specifiers we will try if RB_CDROM is specified.
147  */
148 static char *cdrom_rootdevnames[] = {
149 	"cd9660:cd0",
150 	"cd9660:acd0",
151 	NULL
152 };
153 
154 /* legacy find-root code */
155 char		*rootdevnames[2] = {NULL, NULL};
156 #ifndef ROOTDEVNAME
157 #  define ROOTDEVNAME NULL
158 #endif
159 static const char	*ctrootdevname = ROOTDEVNAME;
160 
161 /*
162  * ---------------------------------------------------------------------
163  * Functions for building and sanitizing the mount options
164  */
165 
166 /* Remove one mount option. */
167 static void
168 vfs_freeopt(struct vfsoptlist *opts, struct vfsopt *opt)
169 {
170 
171 	TAILQ_REMOVE(opts, opt, link);
172 	free(opt->name, M_MOUNT);
173 	if (opt->value != NULL)
174 		free(opt->value, M_MOUNT);
175 #ifdef INVARIANTS
176 	else if (opt->len != 0)
177 		panic("%s: mount option with NULL value but length != 0",
178 		    __func__);
179 #endif
180 	free(opt, M_MOUNT);
181 }
182 
183 /* Release all resources related to the mount options. */
184 void
185 vfs_freeopts(struct vfsoptlist *opts)
186 {
187 	struct vfsopt *opt;
188 
189 	while (!TAILQ_EMPTY(opts)) {
190 		opt = TAILQ_FIRST(opts);
191 		vfs_freeopt(opts, opt);
192 	}
193 	free(opts, M_MOUNT);
194 }
195 
196 void
197 vfs_deleteopt(struct vfsoptlist *opts, const char *name)
198 {
199 	struct vfsopt *opt, *temp;
200 
201 	TAILQ_FOREACH_SAFE(opt, opts, link, temp)  {
202 		if (strcmp(opt->name, name) == 0)
203 			vfs_freeopt(opts, opt);
204 	}
205 }
206 
207 /*
208  * Check if options are equal (with or without the "no" prefix).
209  */
210 static int
211 vfs_equalopts(const char *opt1, const char *opt2)
212 {
213 
214 	/* "opt" vs. "opt" or "noopt" vs. "noopt" */
215 	if (strcmp(opt1, opt2) == 0)
216 		return (1);
217 	/* "noopt" vs. "opt" */
218 	if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
219 		return (1);
220 	/* "opt" vs. "noopt" */
221 	if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
222 		return (1);
223 	return (0);
224 }
225 
226 /*
227  * If a mount option is specified several times,
228  * (with or without the "no" prefix) only keep
229  * the last occurence of it.
230  */
231 static void
232 vfs_sanitizeopts(struct vfsoptlist *opts)
233 {
234 	struct vfsopt *opt, *opt2, *tmp;
235 
236 	TAILQ_FOREACH_REVERSE(opt, opts, vfsoptlist, link) {
237 		opt2 = TAILQ_PREV(opt, vfsoptlist, link);
238 		while (opt2 != NULL) {
239 			if (vfs_equalopts(opt->name, opt2->name)) {
240 				tmp = TAILQ_PREV(opt2, vfsoptlist, link);
241 				vfs_freeopt(opts, opt2);
242 				opt2 = tmp;
243 			} else {
244 				opt2 = TAILQ_PREV(opt2, vfsoptlist, link);
245 			}
246 		}
247 	}
248 }
249 
250 /*
251  * Build a linked list of mount options from a struct uio.
252  */
253 static int
254 vfs_buildopts(struct uio *auio, struct vfsoptlist **options)
255 {
256 	struct vfsoptlist *opts;
257 	struct vfsopt *opt;
258 	size_t memused;
259 	unsigned int i, iovcnt;
260 	int error, namelen, optlen;
261 
262 	opts = malloc(sizeof(struct vfsoptlist), M_MOUNT, M_WAITOK);
263 	TAILQ_INIT(opts);
264 	memused = 0;
265 	iovcnt = auio->uio_iovcnt;
266 	for (i = 0; i < iovcnt; i += 2) {
267 		opt = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK);
268 		namelen = auio->uio_iov[i].iov_len;
269 		optlen = auio->uio_iov[i + 1].iov_len;
270 		opt->name = malloc(namelen, M_MOUNT, M_WAITOK);
271 		opt->value = NULL;
272 		opt->len = 0;
273 
274 		/*
275 		 * Do this early, so jumps to "bad" will free the current
276 		 * option.
277 		 */
278 		TAILQ_INSERT_TAIL(opts, opt, link);
279 		memused += sizeof(struct vfsopt) + optlen + namelen;
280 
281 		/*
282 		 * Avoid consuming too much memory, and attempts to overflow
283 		 * memused.
284 		 */
285 		if (memused > VFS_MOUNTARG_SIZE_MAX ||
286 		    optlen > VFS_MOUNTARG_SIZE_MAX ||
287 		    namelen > VFS_MOUNTARG_SIZE_MAX) {
288 			error = EINVAL;
289 			goto bad;
290 		}
291 
292 		if (auio->uio_segflg == UIO_SYSSPACE) {
293 			bcopy(auio->uio_iov[i].iov_base, opt->name, namelen);
294 		} else {
295 			error = copyin(auio->uio_iov[i].iov_base, opt->name,
296 			    namelen);
297 			if (error)
298 				goto bad;
299 		}
300 		/* Ensure names are null-terminated strings. */
301 		if (opt->name[namelen - 1] != '\0') {
302 			error = EINVAL;
303 			goto bad;
304 		}
305 		if (optlen != 0) {
306 			opt->len = optlen;
307 			opt->value = malloc(optlen, M_MOUNT, M_WAITOK);
308 			if (auio->uio_segflg == UIO_SYSSPACE) {
309 				bcopy(auio->uio_iov[i + 1].iov_base, opt->value,
310 				    optlen);
311 			} else {
312 				error = copyin(auio->uio_iov[i + 1].iov_base,
313 				    opt->value, optlen);
314 				if (error)
315 					goto bad;
316 			}
317 		}
318 	}
319 	vfs_sanitizeopts(opts);
320 	*options = opts;
321 	return (0);
322 bad:
323 	vfs_freeopts(opts);
324 	return (error);
325 }
326 
327 /*
328  * Merge the old mount options with the new ones passed
329  * in the MNT_UPDATE case.
330  *
331  * XXX This function will keep a "nofoo" option in the
332  *     new options if there is no matching "foo" option
333  *     to be cancelled in the old options.  This is a bug
334  *     if the option's canonical name is "foo".  E.g., "noro"
335  *     shouldn't end up in the mount point's active options,
336  *     but it can.
337  */
338 static void
339 vfs_mergeopts(struct vfsoptlist *toopts, struct vfsoptlist *opts)
340 {
341 	struct vfsopt *opt, *opt2, *new;
342 
343 	TAILQ_FOREACH(opt, opts, link) {
344 		/*
345 		 * Check that this option hasn't been redefined
346 		 * nor cancelled with a "no" mount option.
347 		 */
348 		opt2 = TAILQ_FIRST(toopts);
349 		while (opt2 != NULL) {
350 			if (strcmp(opt2->name, opt->name) == 0)
351 				goto next;
352 			if (strncmp(opt2->name, "no", 2) == 0 &&
353 			    strcmp(opt2->name + 2, opt->name) == 0) {
354 				vfs_freeopt(toopts, opt2);
355 				goto next;
356 			}
357 			opt2 = TAILQ_NEXT(opt2, link);
358 		}
359 		/* We want this option, duplicate it. */
360 		new = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK);
361 		new->name = malloc(strlen(opt->name) + 1, M_MOUNT, M_WAITOK);
362 		strcpy(new->name, opt->name);
363 		if (opt->len != 0) {
364 			new->value = malloc(opt->len, M_MOUNT, M_WAITOK);
365 			bcopy(opt->value, new->value, opt->len);
366 		} else {
367 			new->value = NULL;
368 		}
369 		new->len = opt->len;
370 		TAILQ_INSERT_TAIL(toopts, new, link);
371 next:
372 		continue;
373 	}
374 }
375 
376 /*
377  * Mount a filesystem.
378  */
379 int
380 nmount(td, uap)
381 	struct thread *td;
382 	struct nmount_args /* {
383 		struct iovec *iovp;
384 		unsigned int iovcnt;
385 		int flags;
386 	} */ *uap;
387 {
388 	struct uio *auio;
389 	struct iovec *iov;
390 	unsigned int i;
391 	int error;
392 	u_int iovcnt;
393 
394 	AUDIT_ARG(fflags, uap->flags);
395 
396 	/*
397 	 * Filter out MNT_ROOTFS.  We do not want clients of nmount() in
398 	 * userspace to set this flag, but we must filter it out if we want
399 	 * MNT_UPDATE on the root file system to work.
400 	 * MNT_ROOTFS should only be set in the kernel in vfs_mountroot_try().
401 	 */
402 	uap->flags &= ~MNT_ROOTFS;
403 
404 	iovcnt = uap->iovcnt;
405 	/*
406 	 * Check that we have an even number of iovec's
407 	 * and that we have at least two options.
408 	 */
409 	if ((iovcnt & 1) || (iovcnt < 4))
410 		return (EINVAL);
411 
412 	error = copyinuio(uap->iovp, iovcnt, &auio);
413 	if (error)
414 		return (error);
415 	iov = auio->uio_iov;
416 	for (i = 0; i < iovcnt; i++) {
417 		if (iov->iov_len > MMAXOPTIONLEN) {
418 			free(auio, M_IOV);
419 			return (EINVAL);
420 		}
421 		iov++;
422 	}
423 	error = vfs_donmount(td, uap->flags, auio);
424 
425 	free(auio, M_IOV);
426 	return (error);
427 }
428 
429 /*
430  * ---------------------------------------------------------------------
431  * Various utility functions
432  */
433 
434 void
435 vfs_ref(struct mount *mp)
436 {
437 
438 	MNT_ILOCK(mp);
439 	MNT_REF(mp);
440 	MNT_IUNLOCK(mp);
441 }
442 
443 void
444 vfs_rel(struct mount *mp)
445 {
446 
447 	MNT_ILOCK(mp);
448 	MNT_REL(mp);
449 	MNT_IUNLOCK(mp);
450 }
451 
452 static int
453 mount_init(void *mem, int size, int flags)
454 {
455 	struct mount *mp;
456 
457 	mp = (struct mount *)mem;
458 	mtx_init(&mp->mnt_mtx, "struct mount mtx", NULL, MTX_DEF);
459 	lockinit(&mp->mnt_lock, PVFS, "vfslock", 0, 0);
460 	return (0);
461 }
462 
463 static void
464 mount_fini(void *mem, int size)
465 {
466 	struct mount *mp;
467 
468 	mp = (struct mount *)mem;
469 	lockdestroy(&mp->mnt_lock);
470 	mtx_destroy(&mp->mnt_mtx);
471 }
472 
473 /*
474  * Allocate and initialize the mount point struct.
475  */
476 struct mount *
477 vfs_mount_alloc(struct vnode *vp, struct vfsconf *vfsp,
478     const char *fspath, struct thread *td)
479 {
480 	struct mount *mp;
481 
482 	mp = uma_zalloc(mount_zone, M_WAITOK);
483 	bzero(&mp->mnt_startzero,
484 	    __rangeof(struct mount, mnt_startzero, mnt_endzero));
485 	TAILQ_INIT(&mp->mnt_nvnodelist);
486 	mp->mnt_nvnodelistsize = 0;
487 	mp->mnt_ref = 0;
488 	(void) vfs_busy(mp, LK_NOWAIT, 0, td);
489 	mp->mnt_op = vfsp->vfc_vfsops;
490 	mp->mnt_vfc = vfsp;
491 	vfsp->vfc_refcount++;	/* XXX Unlocked */
492 	mp->mnt_stat.f_type = vfsp->vfc_typenum;
493 	mp->mnt_gen++;
494 	strlcpy(mp->mnt_stat.f_fstypename, vfsp->vfc_name, MFSNAMELEN);
495 	mp->mnt_vnodecovered = vp;
496 	mp->mnt_cred = crdup(td->td_ucred);
497 	mp->mnt_stat.f_owner = td->td_ucred->cr_uid;
498 	strlcpy(mp->mnt_stat.f_mntonname, fspath, MNAMELEN);
499 	mp->mnt_iosize_max = DFLTPHYS;
500 #ifdef MAC
501 	mac_mount_init(mp);
502 	mac_mount_create(td->td_ucred, mp);
503 #endif
504 	arc4rand(&mp->mnt_hashseed, sizeof mp->mnt_hashseed, 0);
505 	return (mp);
506 }
507 
508 /*
509  * Destroy the mount struct previously allocated by vfs_mount_alloc().
510  */
511 void
512 vfs_mount_destroy(struct mount *mp)
513 {
514 	int i;
515 
516 	MNT_ILOCK(mp);
517 	for (i = 0; mp->mnt_ref && i < 3; i++)
518 		msleep(mp, MNT_MTX(mp), PVFS, "mntref", hz);
519 	/*
520 	 * This will always cause a 3 second delay in rebooting due to
521 	 * refs on the root mountpoint that never go away.  Most of these
522 	 * are held by init which never exits.
523 	 */
524 	if (i == 3 && (!rebooting || bootverbose))
525 		printf("Mount point %s had %d dangling refs\n",
526 		    mp->mnt_stat.f_mntonname, mp->mnt_ref);
527 	if (mp->mnt_holdcnt != 0) {
528 		printf("Waiting for mount point to be unheld\n");
529 		while (mp->mnt_holdcnt != 0) {
530 			mp->mnt_holdcntwaiters++;
531 			msleep(&mp->mnt_holdcnt, MNT_MTX(mp),
532 			       PZERO, "mntdestroy", 0);
533 			mp->mnt_holdcntwaiters--;
534 		}
535 		printf("mount point unheld\n");
536 	}
537 	if (mp->mnt_writeopcount > 0) {
538 		printf("Waiting for mount point write ops\n");
539 		while (mp->mnt_writeopcount > 0) {
540 			mp->mnt_kern_flag |= MNTK_SUSPEND;
541 			msleep(&mp->mnt_writeopcount,
542 			       MNT_MTX(mp),
543 			       PZERO, "mntdestroy2", 0);
544 		}
545 		printf("mount point write ops completed\n");
546 	}
547 	if (mp->mnt_secondary_writes > 0) {
548 		printf("Waiting for mount point secondary write ops\n");
549 		while (mp->mnt_secondary_writes > 0) {
550 			mp->mnt_kern_flag |= MNTK_SUSPEND;
551 			msleep(&mp->mnt_secondary_writes,
552 			       MNT_MTX(mp),
553 			       PZERO, "mntdestroy3", 0);
554 		}
555 		printf("mount point secondary write ops completed\n");
556 	}
557 	MNT_IUNLOCK(mp);
558 	mp->mnt_vfc->vfc_refcount--;
559 	if (!TAILQ_EMPTY(&mp->mnt_nvnodelist)) {
560 		struct vnode *vp;
561 
562 		TAILQ_FOREACH(vp, &mp->mnt_nvnodelist, v_nmntvnodes)
563 			vprint("", vp);
564 		panic("unmount: dangling vnode");
565 	}
566 	MNT_ILOCK(mp);
567 	if (mp->mnt_kern_flag & MNTK_MWAIT)
568 		wakeup(mp);
569 	if (mp->mnt_writeopcount != 0)
570 		panic("vfs_mount_destroy: nonzero writeopcount");
571 	if (mp->mnt_secondary_writes != 0)
572 		panic("vfs_mount_destroy: nonzero secondary_writes");
573 	if (mp->mnt_nvnodelistsize != 0)
574 		panic("vfs_mount_destroy: nonzero nvnodelistsize");
575 	mp->mnt_writeopcount = -1000;
576 	mp->mnt_nvnodelistsize = -1000;
577 	mp->mnt_secondary_writes = -1000;
578 	MNT_IUNLOCK(mp);
579 #ifdef MAC
580 	mac_mount_destroy(mp);
581 #endif
582 	if (mp->mnt_opt != NULL)
583 		vfs_freeopts(mp->mnt_opt);
584 	crfree(mp->mnt_cred);
585 	uma_zfree(mount_zone, mp);
586 }
587 
588 static int
589 vfs_donmount(struct thread *td, int fsflags, struct uio *fsoptions)
590 {
591 	struct vfsoptlist *optlist;
592 	struct vfsopt *opt, *noro_opt;
593 	char *fstype, *fspath, *errmsg;
594 	int error, fstypelen, fspathlen, errmsg_len, errmsg_pos;
595 	int has_rw, has_noro;
596 
597 	errmsg = NULL;
598 	errmsg_len = 0;
599 	errmsg_pos = -1;
600 	has_rw = 0;
601 	has_noro = 0;
602 
603 	error = vfs_buildopts(fsoptions, &optlist);
604 	if (error)
605 		return (error);
606 
607 	if (vfs_getopt(optlist, "errmsg", (void **)&errmsg, &errmsg_len) == 0)
608 		errmsg_pos = vfs_getopt_pos(optlist, "errmsg");
609 
610 	/*
611 	 * We need these two options before the others,
612 	 * and they are mandatory for any filesystem.
613 	 * Ensure they are NUL terminated as well.
614 	 */
615 	fstypelen = 0;
616 	error = vfs_getopt(optlist, "fstype", (void **)&fstype, &fstypelen);
617 	if (error || fstype[fstypelen - 1] != '\0') {
618 		error = EINVAL;
619 		if (errmsg != NULL)
620 			strncpy(errmsg, "Invalid fstype", errmsg_len);
621 		goto bail;
622 	}
623 	fspathlen = 0;
624 	error = vfs_getopt(optlist, "fspath", (void **)&fspath, &fspathlen);
625 	if (error || fspath[fspathlen - 1] != '\0') {
626 		error = EINVAL;
627 		if (errmsg != NULL)
628 			strncpy(errmsg, "Invalid fspath", errmsg_len);
629 		goto bail;
630 	}
631 
632 	/*
633 	 * We need to see if we have the "update" option
634 	 * before we call vfs_domount(), since vfs_domount() has special
635 	 * logic based on MNT_UPDATE.  This is very important
636 	 * when we want to update the root filesystem.
637 	 */
638 	TAILQ_FOREACH(opt, optlist, link) {
639 		if (strcmp(opt->name, "update") == 0)
640 			fsflags |= MNT_UPDATE;
641 		else if (strcmp(opt->name, "async") == 0)
642 			fsflags |= MNT_ASYNC;
643 		else if (strcmp(opt->name, "force") == 0)
644 			fsflags |= MNT_FORCE;
645 		else if (strcmp(opt->name, "multilabel") == 0)
646 			fsflags |= MNT_MULTILABEL;
647 		else if (strcmp(opt->name, "noasync") == 0)
648 			fsflags &= ~MNT_ASYNC;
649 		else if (strcmp(opt->name, "noatime") == 0)
650 			fsflags |= MNT_NOATIME;
651 		else if (strcmp(opt->name, "atime") == 0) {
652 			free(opt->name, M_MOUNT);
653 			opt->name = strdup("nonoatime", M_MOUNT);
654 		}
655 		else if (strcmp(opt->name, "noclusterr") == 0)
656 			fsflags |= MNT_NOCLUSTERR;
657 		else if (strcmp(opt->name, "clusterr") == 0) {
658 			free(opt->name, M_MOUNT);
659 			opt->name = strdup("nonoclusterr", M_MOUNT);
660 		}
661 		else if (strcmp(opt->name, "noclusterw") == 0)
662 			fsflags |= MNT_NOCLUSTERW;
663 		else if (strcmp(opt->name, "clusterw") == 0) {
664 			free(opt->name, M_MOUNT);
665 			opt->name = strdup("nonoclusterw", M_MOUNT);
666 		}
667 		else if (strcmp(opt->name, "noexec") == 0)
668 			fsflags |= MNT_NOEXEC;
669 		else if (strcmp(opt->name, "exec") == 0) {
670 			free(opt->name, M_MOUNT);
671 			opt->name = strdup("nonoexec", M_MOUNT);
672 		}
673 		else if (strcmp(opt->name, "nosuid") == 0)
674 			fsflags |= MNT_NOSUID;
675 		else if (strcmp(opt->name, "suid") == 0) {
676 			free(opt->name, M_MOUNT);
677 			opt->name = strdup("nonosuid", M_MOUNT);
678 		}
679 		else if (strcmp(opt->name, "nosymfollow") == 0)
680 			fsflags |= MNT_NOSYMFOLLOW;
681 		else if (strcmp(opt->name, "symfollow") == 0) {
682 			free(opt->name, M_MOUNT);
683 			opt->name = strdup("nonosymfollow", M_MOUNT);
684 		}
685 		else if (strcmp(opt->name, "noro") == 0) {
686 			fsflags &= ~MNT_RDONLY;
687 			has_noro = 1;
688 		}
689 		else if (strcmp(opt->name, "rw") == 0) {
690 			fsflags &= ~MNT_RDONLY;
691 			has_rw = 1;
692 		}
693 		else if (strcmp(opt->name, "ro") == 0)
694 			fsflags |= MNT_RDONLY;
695 		else if (strcmp(opt->name, "rdonly") == 0) {
696 			free(opt->name, M_MOUNT);
697 			opt->name = strdup("ro", M_MOUNT);
698 			fsflags |= MNT_RDONLY;
699 		}
700 		else if (strcmp(opt->name, "snapshot") == 0)
701 			fsflags |= MNT_SNAPSHOT;
702 		else if (strcmp(opt->name, "suiddir") == 0)
703 			fsflags |= MNT_SUIDDIR;
704 		else if (strcmp(opt->name, "sync") == 0)
705 			fsflags |= MNT_SYNCHRONOUS;
706 		else if (strcmp(opt->name, "union") == 0)
707 			fsflags |= MNT_UNION;
708 	}
709 
710 	/*
711 	 * If "rw" was specified as a mount option, and we
712 	 * are trying to update a mount-point from "ro" to "rw",
713 	 * we need a mount option "noro", since in vfs_mergeopts(),
714 	 * "noro" will cancel "ro", but "rw" will not do anything.
715 	 */
716 	if (has_rw && !has_noro) {
717 		noro_opt = malloc(sizeof(struct vfsopt), M_MOUNT, M_WAITOK);
718 		noro_opt->name = strdup("noro", M_MOUNT);
719 		noro_opt->value = NULL;
720 		noro_opt->len = 0;
721 		TAILQ_INSERT_TAIL(optlist, noro_opt, link);
722 	}
723 
724 	/*
725 	 * Be ultra-paranoid about making sure the type and fspath
726 	 * variables will fit in our mp buffers, including the
727 	 * terminating NUL.
728 	 */
729 	if (fstypelen >= MFSNAMELEN - 1 || fspathlen >= MNAMELEN - 1) {
730 		error = ENAMETOOLONG;
731 		goto bail;
732 	}
733 
734 	mtx_lock(&Giant);
735 	error = vfs_domount(td, fstype, fspath, fsflags, optlist);
736 	mtx_unlock(&Giant);
737 bail:
738 	/* copyout the errmsg */
739 	if (errmsg_pos != -1 && ((2 * errmsg_pos + 1) < fsoptions->uio_iovcnt)
740 	    && errmsg_len > 0 && errmsg != NULL) {
741 		if (fsoptions->uio_segflg == UIO_SYSSPACE) {
742 			bcopy(errmsg,
743 			    fsoptions->uio_iov[2 * errmsg_pos + 1].iov_base,
744 			    fsoptions->uio_iov[2 * errmsg_pos + 1].iov_len);
745 		} else {
746 			copyout(errmsg,
747 			    fsoptions->uio_iov[2 * errmsg_pos + 1].iov_base,
748 			    fsoptions->uio_iov[2 * errmsg_pos + 1].iov_len);
749 		}
750 	}
751 
752 	if (error != 0)
753 		vfs_freeopts(optlist);
754 	return (error);
755 }
756 
757 /*
758  * Old mount API.
759  */
760 #ifndef _SYS_SYSPROTO_H_
761 struct mount_args {
762 	char	*type;
763 	char	*path;
764 	int	flags;
765 	caddr_t	data;
766 };
767 #endif
768 /* ARGSUSED */
769 int
770 mount(td, uap)
771 	struct thread *td;
772 	struct mount_args /* {
773 		char *type;
774 		char *path;
775 		int flags;
776 		caddr_t data;
777 	} */ *uap;
778 {
779 	char *fstype;
780 	struct vfsconf *vfsp = NULL;
781 	struct mntarg *ma = NULL;
782 	int error;
783 
784 	AUDIT_ARG(fflags, uap->flags);
785 
786 	/*
787 	 * Filter out MNT_ROOTFS.  We do not want clients of mount() in
788 	 * userspace to set this flag, but we must filter it out if we want
789 	 * MNT_UPDATE on the root file system to work.
790 	 * MNT_ROOTFS should only be set in the kernel in vfs_mountroot_try().
791 	 */
792 	uap->flags &= ~MNT_ROOTFS;
793 
794 	fstype = malloc(MFSNAMELEN, M_TEMP, M_WAITOK);
795 	error = copyinstr(uap->type, fstype, MFSNAMELEN, NULL);
796 	if (error) {
797 		free(fstype, M_TEMP);
798 		return (error);
799 	}
800 
801 	AUDIT_ARG(text, fstype);
802 	mtx_lock(&Giant);
803 	vfsp = vfs_byname_kld(fstype, td, &error);
804 	free(fstype, M_TEMP);
805 	if (vfsp == NULL) {
806 		mtx_unlock(&Giant);
807 		return (ENOENT);
808 	}
809 	if (vfsp->vfc_vfsops->vfs_cmount == NULL) {
810 		mtx_unlock(&Giant);
811 		return (EOPNOTSUPP);
812 	}
813 
814 	ma = mount_argsu(ma, "fstype", uap->type, MNAMELEN);
815 	ma = mount_argsu(ma, "fspath", uap->path, MNAMELEN);
816 	ma = mount_argb(ma, uap->flags & MNT_RDONLY, "noro");
817 	ma = mount_argb(ma, !(uap->flags & MNT_NOSUID), "nosuid");
818 	ma = mount_argb(ma, !(uap->flags & MNT_NOEXEC), "noexec");
819 
820 	error = vfsp->vfc_vfsops->vfs_cmount(ma, uap->data, uap->flags, td);
821 	mtx_unlock(&Giant);
822 	return (error);
823 }
824 
825 
826 /*
827  * vfs_domount(): actually attempt a filesystem mount.
828  */
829 static int
830 vfs_domount(
831 	struct thread *td,	/* Calling thread. */
832 	const char *fstype,	/* Filesystem type. */
833 	char *fspath,		/* Mount path. */
834 	int fsflags,		/* Flags common to all filesystems. */
835 	void *fsdata		/* Options local to the filesystem. */
836 	)
837 {
838 	struct vnode *vp;
839 	struct mount *mp;
840 	struct vfsconf *vfsp;
841 	struct export_args export;
842 	int error, flag = 0;
843 	struct vattr va;
844 	struct nameidata nd;
845 
846 	mtx_assert(&Giant, MA_OWNED);
847 	/*
848 	 * Be ultra-paranoid about making sure the type and fspath
849 	 * variables will fit in our mp buffers, including the
850 	 * terminating NUL.
851 	 */
852 	if (strlen(fstype) >= MFSNAMELEN || strlen(fspath) >= MNAMELEN)
853 		return (ENAMETOOLONG);
854 
855 	if (jailed(td->td_ucred) || usermount == 0) {
856 		if ((error = priv_check(td, PRIV_VFS_MOUNT)) != 0)
857 			return (error);
858 	}
859 
860 	/*
861 	 * Do not allow NFS export or MNT_SUIDDIR by unprivileged users.
862 	 */
863 	if (fsflags & MNT_EXPORTED) {
864 		error = priv_check(td, PRIV_VFS_MOUNT_EXPORTED);
865 		if (error)
866 			return (error);
867 	}
868 	if (fsflags & MNT_SUIDDIR) {
869 		error = priv_check(td, PRIV_VFS_MOUNT_SUIDDIR);
870 		if (error)
871 			return (error);
872 	}
873 	/*
874 	 * Silently enforce MNT_NOSUID and MNT_USER for unprivileged users.
875 	 */
876 	if ((fsflags & (MNT_NOSUID | MNT_USER)) != (MNT_NOSUID | MNT_USER)) {
877 		if (priv_check(td, PRIV_VFS_MOUNT_NONUSER) != 0)
878 			fsflags |= MNT_NOSUID | MNT_USER;
879 	}
880 
881 	/* Load KLDs before we lock the covered vnode to avoid reversals. */
882 	vfsp = NULL;
883 	if ((fsflags & MNT_UPDATE) == 0) {
884 		/* Don't try to load KLDs if we're mounting the root. */
885 		if (fsflags & MNT_ROOTFS)
886 			vfsp = vfs_byname(fstype);
887 		else
888 			vfsp = vfs_byname_kld(fstype, td, &error);
889 		if (vfsp == NULL)
890 			return (ENODEV);
891 		if (jailed(td->td_ucred) && !(vfsp->vfc_flags & VFCF_JAIL))
892 			return (EPERM);
893 	}
894 	/*
895 	 * Get vnode to be covered
896 	 */
897 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, UIO_SYSSPACE,
898 	    fspath, td);
899 	if ((error = namei(&nd)) != 0)
900 		return (error);
901 	NDFREE(&nd, NDF_ONLY_PNBUF);
902 	vp = nd.ni_vp;
903 	if (fsflags & MNT_UPDATE) {
904 		if ((vp->v_vflag & VV_ROOT) == 0) {
905 			vput(vp);
906 			return (EINVAL);
907 		}
908 		mp = vp->v_mount;
909 		MNT_ILOCK(mp);
910 		flag = mp->mnt_flag;
911 		/*
912 		 * We only allow the filesystem to be reloaded if it
913 		 * is currently mounted read-only.
914 		 */
915 		if ((fsflags & MNT_RELOAD) &&
916 		    ((mp->mnt_flag & MNT_RDONLY) == 0)) {
917 			MNT_IUNLOCK(mp);
918 			vput(vp);
919 			return (EOPNOTSUPP);	/* Needs translation */
920 		}
921 		MNT_IUNLOCK(mp);
922 		/*
923 		 * Only privileged root, or (if MNT_USER is set) the user that
924 		 * did the original mount is permitted to update it.
925 		 */
926 		error = vfs_suser(mp, td);
927 		if (error) {
928 			vput(vp);
929 			return (error);
930 		}
931 		if (vfs_busy(mp, LK_NOWAIT, 0, td)) {
932 			vput(vp);
933 			return (EBUSY);
934 		}
935 		VI_LOCK(vp);
936 		if ((vp->v_iflag & VI_MOUNT) != 0 ||
937 		    vp->v_mountedhere != NULL) {
938 			VI_UNLOCK(vp);
939 			vfs_unbusy(mp, td);
940 			vput(vp);
941 			return (EBUSY);
942 		}
943 		vp->v_iflag |= VI_MOUNT;
944 		VI_UNLOCK(vp);
945 		MNT_ILOCK(mp);
946 		mp->mnt_flag |= fsflags &
947 		    (MNT_RELOAD | MNT_FORCE | MNT_UPDATE | MNT_SNAPSHOT | MNT_ROOTFS);
948 		MNT_IUNLOCK(mp);
949 		VOP_UNLOCK(vp, 0);
950 		mp->mnt_optnew = fsdata;
951 		vfs_mergeopts(mp->mnt_optnew, mp->mnt_opt);
952 	} else {
953 		/*
954 		 * If the user is not root, ensure that they own the directory
955 		 * onto which we are attempting to mount.
956 		 */
957 		error = VOP_GETATTR(vp, &va, td->td_ucred, td);
958 		if (error) {
959 			vput(vp);
960 			return (error);
961 		}
962 		if (va.va_uid != td->td_ucred->cr_uid) {
963 			error = priv_check_cred(td->td_ucred, PRIV_VFS_ADMIN,
964 			    0);
965 			if (error) {
966 				vput(vp);
967 				return (error);
968 			}
969 		}
970 		error = vinvalbuf(vp, V_SAVE, td, 0, 0);
971 		if (error != 0) {
972 			vput(vp);
973 			return (error);
974 		}
975 		if (vp->v_type != VDIR) {
976 			vput(vp);
977 			return (ENOTDIR);
978 		}
979 		VI_LOCK(vp);
980 		if ((vp->v_iflag & VI_MOUNT) != 0 ||
981 		    vp->v_mountedhere != NULL) {
982 			VI_UNLOCK(vp);
983 			vput(vp);
984 			return (EBUSY);
985 		}
986 		vp->v_iflag |= VI_MOUNT;
987 		VI_UNLOCK(vp);
988 
989 		/*
990 		 * Allocate and initialize the filesystem.
991 		 */
992 		mp = vfs_mount_alloc(vp, vfsp, fspath, td);
993 		VOP_UNLOCK(vp, 0);
994 
995 		/* XXXMAC: pass to vfs_mount_alloc? */
996 		mp->mnt_optnew = fsdata;
997 	}
998 
999 	/*
1000 	 * Set the mount level flags.
1001 	 */
1002 	MNT_ILOCK(mp);
1003 	mp->mnt_flag = (mp->mnt_flag & ~MNT_UPDATEMASK) |
1004 		(fsflags & (MNT_UPDATEMASK | MNT_FORCE | MNT_ROOTFS |
1005 			    MNT_RDONLY));
1006 	if ((mp->mnt_flag & MNT_ASYNC) == 0)
1007 		mp->mnt_kern_flag &= ~MNTK_ASYNC;
1008 	MNT_IUNLOCK(mp);
1009 	/*
1010 	 * Mount the filesystem.
1011 	 * XXX The final recipients of VFS_MOUNT just overwrite the ndp they
1012 	 * get.  No freeing of cn_pnbuf.
1013 	 */
1014         error = VFS_MOUNT(mp, td);
1015 
1016 	/*
1017 	 * Process the export option only if we are
1018 	 * updating mount options.
1019 	 */
1020 	if (!error && (fsflags & MNT_UPDATE)) {
1021 		if (vfs_copyopt(mp->mnt_optnew, "export", &export,
1022 		    sizeof(export)) == 0)
1023 			error = vfs_export(mp, &export);
1024 	}
1025 
1026 	if (!error) {
1027 		if (mp->mnt_opt != NULL)
1028 			vfs_freeopts(mp->mnt_opt);
1029 		mp->mnt_opt = mp->mnt_optnew;
1030 		(void)VFS_STATFS(mp, &mp->mnt_stat, td);
1031 	}
1032 	/*
1033 	 * Prevent external consumers of mount options from reading
1034 	 * mnt_optnew.
1035 	*/
1036 	mp->mnt_optnew = NULL;
1037 	if (mp->mnt_flag & MNT_UPDATE) {
1038 		MNT_ILOCK(mp);
1039 		if (error)
1040 			mp->mnt_flag = (mp->mnt_flag & MNT_QUOTA) |
1041 				(flag & ~MNT_QUOTA);
1042 		else
1043 			mp->mnt_flag &=	~(MNT_UPDATE | MNT_RELOAD |
1044 					  MNT_FORCE | MNT_SNAPSHOT);
1045 		if ((mp->mnt_flag & MNT_ASYNC) != 0 && mp->mnt_noasync == 0)
1046 			mp->mnt_kern_flag |= MNTK_ASYNC;
1047 		else
1048 			mp->mnt_kern_flag &= ~MNTK_ASYNC;
1049 		MNT_IUNLOCK(mp);
1050 		if ((mp->mnt_flag & MNT_RDONLY) == 0) {
1051 			if (mp->mnt_syncer == NULL)
1052 				error = vfs_allocate_syncvnode(mp);
1053 		} else {
1054 			if (mp->mnt_syncer != NULL)
1055 				vrele(mp->mnt_syncer);
1056 			mp->mnt_syncer = NULL;
1057 		}
1058 		vfs_unbusy(mp, td);
1059 		VI_LOCK(vp);
1060 		vp->v_iflag &= ~VI_MOUNT;
1061 		VI_UNLOCK(vp);
1062 		vrele(vp);
1063 		return (error);
1064 	}
1065 	MNT_ILOCK(mp);
1066 	if ((mp->mnt_flag & MNT_ASYNC) != 0 && mp->mnt_noasync == 0)
1067 		mp->mnt_kern_flag |= MNTK_ASYNC;
1068 	else
1069 		mp->mnt_kern_flag &= ~MNTK_ASYNC;
1070 	MNT_IUNLOCK(mp);
1071 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1072 	/*
1073 	 * Put the new filesystem on the mount list after root.
1074 	 */
1075 	cache_purge(vp);
1076 	if (!error) {
1077 		struct vnode *newdp;
1078 
1079 		VI_LOCK(vp);
1080 		vp->v_iflag &= ~VI_MOUNT;
1081 		VI_UNLOCK(vp);
1082 		vp->v_mountedhere = mp;
1083 		mtx_lock(&mountlist_mtx);
1084 		TAILQ_INSERT_TAIL(&mountlist, mp, mnt_list);
1085 		mtx_unlock(&mountlist_mtx);
1086 		vfs_event_signal(NULL, VQ_MOUNT, 0);
1087 		if (VFS_ROOT(mp, LK_EXCLUSIVE, &newdp, td))
1088 			panic("mount: lost mount");
1089 		mountcheckdirs(vp, newdp);
1090 		vput(newdp);
1091 		VOP_UNLOCK(vp, 0);
1092 		if ((mp->mnt_flag & MNT_RDONLY) == 0)
1093 			error = vfs_allocate_syncvnode(mp);
1094 		vfs_unbusy(mp, td);
1095 		if (error)
1096 			vrele(vp);
1097 	} else {
1098 		VI_LOCK(vp);
1099 		vp->v_iflag &= ~VI_MOUNT;
1100 		VI_UNLOCK(vp);
1101 		vfs_unbusy(mp, td);
1102 		vfs_mount_destroy(mp);
1103 		vput(vp);
1104 	}
1105 	return (error);
1106 }
1107 
1108 /*
1109  * Unmount a filesystem.
1110  *
1111  * Note: unmount takes a path to the vnode mounted on as argument, not
1112  * special file (as before).
1113  */
1114 #ifndef _SYS_SYSPROTO_H_
1115 struct unmount_args {
1116 	char	*path;
1117 	int	flags;
1118 };
1119 #endif
1120 /* ARGSUSED */
1121 int
1122 unmount(td, uap)
1123 	struct thread *td;
1124 	register struct unmount_args /* {
1125 		char *path;
1126 		int flags;
1127 	} */ *uap;
1128 {
1129 	struct mount *mp;
1130 	char *pathbuf;
1131 	int error, id0, id1;
1132 
1133 	if (jailed(td->td_ucred) || usermount == 0) {
1134 		error = priv_check(td, PRIV_VFS_UNMOUNT);
1135 		if (error)
1136 			return (error);
1137 	}
1138 
1139 	pathbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK);
1140 	error = copyinstr(uap->path, pathbuf, MNAMELEN, NULL);
1141 	if (error) {
1142 		free(pathbuf, M_TEMP);
1143 		return (error);
1144 	}
1145 	AUDIT_ARG(upath, td, pathbuf, ARG_UPATH1);
1146 	mtx_lock(&Giant);
1147 	if (uap->flags & MNT_BYFSID) {
1148 		/* Decode the filesystem ID. */
1149 		if (sscanf(pathbuf, "FSID:%d:%d", &id0, &id1) != 2) {
1150 			mtx_unlock(&Giant);
1151 			free(pathbuf, M_TEMP);
1152 			return (EINVAL);
1153 		}
1154 
1155 		mtx_lock(&mountlist_mtx);
1156 		TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) {
1157 			if (mp->mnt_stat.f_fsid.val[0] == id0 &&
1158 			    mp->mnt_stat.f_fsid.val[1] == id1)
1159 				break;
1160 		}
1161 		mtx_unlock(&mountlist_mtx);
1162 	} else {
1163 		mtx_lock(&mountlist_mtx);
1164 		TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) {
1165 			if (strcmp(mp->mnt_stat.f_mntonname, pathbuf) == 0)
1166 				break;
1167 		}
1168 		mtx_unlock(&mountlist_mtx);
1169 	}
1170 	free(pathbuf, M_TEMP);
1171 	if (mp == NULL) {
1172 		/*
1173 		 * Previously we returned ENOENT for a nonexistent path and
1174 		 * EINVAL for a non-mountpoint.  We cannot tell these apart
1175 		 * now, so in the !MNT_BYFSID case return the more likely
1176 		 * EINVAL for compatibility.
1177 		 */
1178 		mtx_unlock(&Giant);
1179 		return ((uap->flags & MNT_BYFSID) ? ENOENT : EINVAL);
1180 	}
1181 
1182 	/*
1183 	 * Don't allow unmounting the root filesystem.
1184 	 */
1185 	if (mp->mnt_flag & MNT_ROOTFS) {
1186 		mtx_unlock(&Giant);
1187 		return (EINVAL);
1188 	}
1189 	error = dounmount(mp, uap->flags, td);
1190 	mtx_unlock(&Giant);
1191 	return (error);
1192 }
1193 
1194 /*
1195  * Do the actual filesystem unmount.
1196  */
1197 int
1198 dounmount(mp, flags, td)
1199 	struct mount *mp;
1200 	int flags;
1201 	struct thread *td;
1202 {
1203 	struct vnode *coveredvp, *fsrootvp;
1204 	int error;
1205 	int async_flag;
1206 	int mnt_gen_r;
1207 
1208 	mtx_assert(&Giant, MA_OWNED);
1209 
1210 	if ((coveredvp = mp->mnt_vnodecovered) != NULL) {
1211 		mnt_gen_r = mp->mnt_gen;
1212 		VI_LOCK(coveredvp);
1213 		vholdl(coveredvp);
1214 		vn_lock(coveredvp, LK_EXCLUSIVE | LK_INTERLOCK | LK_RETRY);
1215 		vdrop(coveredvp);
1216 		/*
1217 		 * Check for mp being unmounted while waiting for the
1218 		 * covered vnode lock.
1219 		 */
1220 		if (coveredvp->v_mountedhere != mp ||
1221 		    coveredvp->v_mountedhere->mnt_gen != mnt_gen_r) {
1222 			VOP_UNLOCK(coveredvp, 0);
1223 			return (EBUSY);
1224 		}
1225 	}
1226 	/*
1227 	 * Only privileged root, or (if MNT_USER is set) the user that did the
1228 	 * original mount is permitted to unmount this filesystem.
1229 	 */
1230 	error = vfs_suser(mp, td);
1231 	if (error) {
1232 		if (coveredvp)
1233 			VOP_UNLOCK(coveredvp, 0);
1234 		return (error);
1235 	}
1236 
1237 	MNT_ILOCK(mp);
1238 	if (mp->mnt_kern_flag & MNTK_UNMOUNT) {
1239 		MNT_IUNLOCK(mp);
1240 		if (coveredvp)
1241 			VOP_UNLOCK(coveredvp, 0);
1242 		return (EBUSY);
1243 	}
1244 	mp->mnt_kern_flag |= MNTK_UNMOUNT | MNTK_NOINSMNTQ;
1245 	/* Allow filesystems to detect that a forced unmount is in progress. */
1246 	if (flags & MNT_FORCE)
1247 		mp->mnt_kern_flag |= MNTK_UNMOUNTF;
1248 	error = lockmgr(&mp->mnt_lock, LK_DRAIN | LK_INTERLOCK |
1249 	    ((flags & MNT_FORCE) ? 0 : LK_NOWAIT), MNT_MTX(mp));
1250 	if (error) {
1251 		MNT_ILOCK(mp);
1252 		mp->mnt_kern_flag &= ~(MNTK_UNMOUNT | MNTK_NOINSMNTQ |
1253 		    MNTK_UNMOUNTF);
1254 		if (mp->mnt_kern_flag & MNTK_MWAIT)
1255 			wakeup(mp);
1256 		MNT_IUNLOCK(mp);
1257 		if (coveredvp)
1258 			VOP_UNLOCK(coveredvp, 0);
1259 		return (error);
1260 	}
1261 	vn_start_write(NULL, &mp, V_WAIT);
1262 
1263 	if (mp->mnt_flag & MNT_EXPUBLIC)
1264 		vfs_setpublicfs(NULL, NULL, NULL);
1265 
1266 	vfs_msync(mp, MNT_WAIT);
1267 	MNT_ILOCK(mp);
1268 	async_flag = mp->mnt_flag & MNT_ASYNC;
1269 	mp->mnt_flag &= ~MNT_ASYNC;
1270 	mp->mnt_kern_flag &= ~MNTK_ASYNC;
1271 	MNT_IUNLOCK(mp);
1272 	cache_purgevfs(mp);	/* remove cache entries for this file sys */
1273 	if (mp->mnt_syncer != NULL)
1274 		vrele(mp->mnt_syncer);
1275 	/*
1276 	 * For forced unmounts, move process cdir/rdir refs on the fs root
1277 	 * vnode to the covered vnode.  For non-forced unmounts we want
1278 	 * such references to cause an EBUSY error.
1279 	 */
1280 	if ((flags & MNT_FORCE) &&
1281 	    VFS_ROOT(mp, LK_EXCLUSIVE, &fsrootvp, td) == 0) {
1282 		if (mp->mnt_vnodecovered != NULL)
1283 			mountcheckdirs(fsrootvp, mp->mnt_vnodecovered);
1284 		if (fsrootvp == rootvnode) {
1285 			vrele(rootvnode);
1286 			rootvnode = NULL;
1287 		}
1288 		vput(fsrootvp);
1289 	}
1290 	if (((mp->mnt_flag & MNT_RDONLY) ||
1291 	     (error = VFS_SYNC(mp, MNT_WAIT, td)) == 0) ||
1292 	    (flags & MNT_FORCE)) {
1293 		error = VFS_UNMOUNT(mp, flags, td);
1294 	}
1295 	vn_finished_write(mp);
1296 	/*
1297 	 * If we failed to flush the dirty blocks for this mount point,
1298 	 * undo all the cdir/rdir and rootvnode changes we made above.
1299 	 * Unless we failed to do so because the device is reporting that
1300 	 * it doesn't exist anymore.
1301 	 */
1302 	if (error && error != ENXIO) {
1303 		if ((flags & MNT_FORCE) &&
1304 		    VFS_ROOT(mp, LK_EXCLUSIVE, &fsrootvp, td) == 0) {
1305 			if (mp->mnt_vnodecovered != NULL)
1306 				mountcheckdirs(mp->mnt_vnodecovered, fsrootvp);
1307 			if (rootvnode == NULL) {
1308 				rootvnode = fsrootvp;
1309 				vref(rootvnode);
1310 			}
1311 			vput(fsrootvp);
1312 		}
1313 		MNT_ILOCK(mp);
1314 		mp->mnt_kern_flag &= ~MNTK_NOINSMNTQ;
1315 		if ((mp->mnt_flag & MNT_RDONLY) == 0 && mp->mnt_syncer == NULL) {
1316 			MNT_IUNLOCK(mp);
1317 			(void) vfs_allocate_syncvnode(mp);
1318 			MNT_ILOCK(mp);
1319 		}
1320 		mp->mnt_kern_flag &= ~(MNTK_UNMOUNT | MNTK_UNMOUNTF);
1321 		mp->mnt_flag |= async_flag;
1322 		if ((mp->mnt_flag & MNT_ASYNC) != 0 && mp->mnt_noasync == 0)
1323 			mp->mnt_kern_flag |= MNTK_ASYNC;
1324 		lockmgr(&mp->mnt_lock, LK_RELEASE, NULL);
1325 		if (mp->mnt_kern_flag & MNTK_MWAIT)
1326 			wakeup(mp);
1327 		MNT_IUNLOCK(mp);
1328 		if (coveredvp)
1329 			VOP_UNLOCK(coveredvp, 0);
1330 		return (error);
1331 	}
1332 	mtx_lock(&mountlist_mtx);
1333 	TAILQ_REMOVE(&mountlist, mp, mnt_list);
1334 	mtx_unlock(&mountlist_mtx);
1335 	if (coveredvp != NULL) {
1336 		coveredvp->v_mountedhere = NULL;
1337 		vput(coveredvp);
1338 	}
1339 	vfs_event_signal(NULL, VQ_UNMOUNT, 0);
1340 	lockmgr(&mp->mnt_lock, LK_RELEASE, NULL);
1341 	vfs_mount_destroy(mp);
1342 	return (0);
1343 }
1344 
1345 /*
1346  * ---------------------------------------------------------------------
1347  * Mounting of root filesystem
1348  *
1349  */
1350 
1351 struct root_hold_token {
1352 	const char			*who;
1353 	LIST_ENTRY(root_hold_token)	list;
1354 };
1355 
1356 static LIST_HEAD(, root_hold_token)	root_holds =
1357     LIST_HEAD_INITIALIZER(&root_holds);
1358 
1359 static int root_mount_complete;
1360 
1361 /*
1362  * Hold root mount.
1363  */
1364 struct root_hold_token *
1365 root_mount_hold(const char *identifier)
1366 {
1367 	struct root_hold_token *h;
1368 
1369 	h = malloc(sizeof *h, M_DEVBUF, M_ZERO | M_WAITOK);
1370 	h->who = identifier;
1371 	mtx_lock(&mountlist_mtx);
1372 	LIST_INSERT_HEAD(&root_holds, h, list);
1373 	mtx_unlock(&mountlist_mtx);
1374 	return (h);
1375 }
1376 
1377 /*
1378  * Release root mount.
1379  */
1380 void
1381 root_mount_rel(struct root_hold_token *h)
1382 {
1383 
1384 	mtx_lock(&mountlist_mtx);
1385 	LIST_REMOVE(h, list);
1386 	wakeup(&root_holds);
1387 	mtx_unlock(&mountlist_mtx);
1388 	free(h, M_DEVBUF);
1389 }
1390 
1391 /*
1392  * Wait for all subsystems to release root mount.
1393  */
1394 static void
1395 root_mount_prepare(void)
1396 {
1397 	struct root_hold_token *h;
1398 
1399 	for (;;) {
1400 		DROP_GIANT();
1401 		g_waitidle();
1402 		PICKUP_GIANT();
1403 		mtx_lock(&mountlist_mtx);
1404 		if (LIST_EMPTY(&root_holds)) {
1405 			mtx_unlock(&mountlist_mtx);
1406 			break;
1407 		}
1408 		printf("Root mount waiting for:");
1409 		LIST_FOREACH(h, &root_holds, list)
1410 			printf(" %s", h->who);
1411 		printf("\n");
1412 		msleep(&root_holds, &mountlist_mtx, PZERO | PDROP, "roothold",
1413 		    hz);
1414 	}
1415 }
1416 
1417 /*
1418  * Root was mounted, share the good news.
1419  */
1420 static void
1421 root_mount_done(void)
1422 {
1423 
1424 	/*
1425 	 * Use a mutex to prevent the wakeup being missed and waiting for
1426 	 * an extra 1 second sleep.
1427 	 */
1428 	mtx_lock(&mountlist_mtx);
1429 	root_mount_complete = 1;
1430 	wakeup(&root_mount_complete);
1431 	mtx_unlock(&mountlist_mtx);
1432 }
1433 
1434 /*
1435  * Return true if root is already mounted.
1436  */
1437 int
1438 root_mounted(void)
1439 {
1440 
1441 	/* No mutex is acquired here because int stores are atomic. */
1442 	return (root_mount_complete);
1443 }
1444 
1445 /*
1446  * Wait until root is mounted.
1447  */
1448 void
1449 root_mount_wait(void)
1450 {
1451 
1452 	/*
1453 	 * Panic on an obvious deadlock - the function can't be called from
1454 	 * a thread which is doing the whole SYSINIT stuff.
1455 	 */
1456 	KASSERT(curthread->td_proc->p_pid != 0,
1457 	    ("root_mount_wait: cannot be called from the swapper thread"));
1458 	mtx_lock(&mountlist_mtx);
1459 	while (!root_mount_complete) {
1460 		msleep(&root_mount_complete, &mountlist_mtx, PZERO, "rootwait",
1461 		    hz);
1462 	}
1463 	mtx_unlock(&mountlist_mtx);
1464 }
1465 
1466 static void
1467 set_rootvnode(struct thread *td)
1468 {
1469 	struct proc *p;
1470 
1471 	if (VFS_ROOT(TAILQ_FIRST(&mountlist), LK_EXCLUSIVE, &rootvnode, td))
1472 		panic("Cannot find root vnode");
1473 
1474 	p = td->td_proc;
1475 	FILEDESC_SLOCK(p->p_fd);
1476 
1477 	if (p->p_fd->fd_cdir != NULL)
1478 		vrele(p->p_fd->fd_cdir);
1479 	p->p_fd->fd_cdir = rootvnode;
1480 	VREF(rootvnode);
1481 
1482 	if (p->p_fd->fd_rdir != NULL)
1483 		vrele(p->p_fd->fd_rdir);
1484 	p->p_fd->fd_rdir = rootvnode;
1485 	VREF(rootvnode);
1486 
1487 	FILEDESC_SUNLOCK(p->p_fd);
1488 
1489 	VOP_UNLOCK(rootvnode, 0);
1490 }
1491 
1492 /*
1493  * Mount /devfs as our root filesystem, but do not put it on the mountlist
1494  * yet.  Create a /dev -> / symlink so that absolute pathnames will lookup.
1495  */
1496 
1497 static void
1498 devfs_first(void)
1499 {
1500 	struct thread *td = curthread;
1501 	struct vfsoptlist *opts;
1502 	struct vfsconf *vfsp;
1503 	struct mount *mp = NULL;
1504 	int error;
1505 
1506 	vfsp = vfs_byname("devfs");
1507 	KASSERT(vfsp != NULL, ("Could not find devfs by name"));
1508 	if (vfsp == NULL)
1509 		return;
1510 
1511 	mp = vfs_mount_alloc(NULLVP, vfsp, "/dev", td);
1512 
1513 	error = VFS_MOUNT(mp, td);
1514 	KASSERT(error == 0, ("VFS_MOUNT(devfs) failed %d", error));
1515 	if (error)
1516 		return;
1517 
1518 	opts = malloc(sizeof(struct vfsoptlist), M_MOUNT, M_WAITOK);
1519 	TAILQ_INIT(opts);
1520 	mp->mnt_opt = opts;
1521 
1522 	mtx_lock(&mountlist_mtx);
1523 	TAILQ_INSERT_HEAD(&mountlist, mp, mnt_list);
1524 	mtx_unlock(&mountlist_mtx);
1525 
1526 	set_rootvnode(td);
1527 
1528 	error = kern_symlink(td, "/", "dev", UIO_SYSSPACE);
1529 	if (error)
1530 		printf("kern_symlink /dev -> / returns %d\n", error);
1531 }
1532 
1533 /*
1534  * Surgically move our devfs to be mounted on /dev.
1535  */
1536 
1537 static void
1538 devfs_fixup(struct thread *td)
1539 {
1540 	struct nameidata nd;
1541 	int error;
1542 	struct vnode *vp, *dvp;
1543 	struct mount *mp;
1544 
1545 	/* Remove our devfs mount from the mountlist and purge the cache */
1546 	mtx_lock(&mountlist_mtx);
1547 	mp = TAILQ_FIRST(&mountlist);
1548 	TAILQ_REMOVE(&mountlist, mp, mnt_list);
1549 	mtx_unlock(&mountlist_mtx);
1550 	cache_purgevfs(mp);
1551 
1552 	VFS_ROOT(mp, LK_EXCLUSIVE, &dvp, td);
1553 	VI_LOCK(dvp);
1554 	dvp->v_iflag &= ~VI_MOUNT;
1555 	VI_UNLOCK(dvp);
1556 	dvp->v_mountedhere = NULL;
1557 
1558 	/* Set up the real rootvnode, and purge the cache */
1559 	TAILQ_FIRST(&mountlist)->mnt_vnodecovered = NULL;
1560 	set_rootvnode(td);
1561 	cache_purgevfs(rootvnode->v_mount);
1562 
1563 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, "/dev", td);
1564 	error = namei(&nd);
1565 	if (error) {
1566 		printf("Lookup of /dev for devfs, error: %d\n", error);
1567 		return;
1568 	}
1569 	NDFREE(&nd, NDF_ONLY_PNBUF);
1570 	vp = nd.ni_vp;
1571 	if (vp->v_type != VDIR) {
1572 		vput(vp);
1573 	}
1574 	error = vinvalbuf(vp, V_SAVE, td, 0, 0);
1575 	if (error) {
1576 		vput(vp);
1577 	}
1578 	cache_purge(vp);
1579 	mp->mnt_vnodecovered = vp;
1580 	vp->v_mountedhere = mp;
1581 	mtx_lock(&mountlist_mtx);
1582 	TAILQ_INSERT_TAIL(&mountlist, mp, mnt_list);
1583 	mtx_unlock(&mountlist_mtx);
1584 	VOP_UNLOCK(vp, 0);
1585 	vput(dvp);
1586 	vfs_unbusy(mp, td);
1587 
1588 	/* Unlink the no longer needed /dev/dev -> / symlink */
1589 	kern_unlink(td, "/dev/dev", UIO_SYSSPACE);
1590 }
1591 
1592 /*
1593  * Report errors during filesystem mounting.
1594  */
1595 void
1596 vfs_mount_error(struct mount *mp, const char *fmt, ...)
1597 {
1598 	struct vfsoptlist *moptlist = mp->mnt_optnew;
1599 	va_list ap;
1600 	int error, len;
1601 	char *errmsg;
1602 
1603 	error = vfs_getopt(moptlist, "errmsg", (void **)&errmsg, &len);
1604 	if (error || errmsg == NULL || len <= 0)
1605 		return;
1606 
1607 	va_start(ap, fmt);
1608 	vsnprintf(errmsg, (size_t)len, fmt, ap);
1609 	va_end(ap);
1610 }
1611 
1612 /*
1613  * Find and mount the root filesystem
1614  */
1615 void
1616 vfs_mountroot(void)
1617 {
1618 	char *cp;
1619 	int error, i, asked = 0;
1620 
1621 	root_mount_prepare();
1622 
1623 	mount_zone = uma_zcreate("Mountpoints", sizeof(struct mount),
1624 	    NULL, NULL, mount_init, mount_fini,
1625 	    UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
1626 	devfs_first();
1627 
1628 	/*
1629 	 * We are booted with instructions to prompt for the root filesystem.
1630 	 */
1631 	if (boothowto & RB_ASKNAME) {
1632 		if (!vfs_mountroot_ask())
1633 			goto mounted;
1634 		asked = 1;
1635 	}
1636 
1637 	/*
1638 	 * The root filesystem information is compiled in, and we are
1639 	 * booted with instructions to use it.
1640 	 */
1641 	if (ctrootdevname != NULL && (boothowto & RB_DFLTROOT)) {
1642 		if (!vfs_mountroot_try(ctrootdevname))
1643 			goto mounted;
1644 		ctrootdevname = NULL;
1645 	}
1646 
1647 	/*
1648 	 * We've been given the generic "use CDROM as root" flag.  This is
1649 	 * necessary because one media may be used in many different
1650 	 * devices, so we need to search for them.
1651 	 */
1652 	if (boothowto & RB_CDROM) {
1653 		for (i = 0; cdrom_rootdevnames[i] != NULL; i++) {
1654 			if (!vfs_mountroot_try(cdrom_rootdevnames[i]))
1655 				goto mounted;
1656 		}
1657 	}
1658 
1659 	/*
1660 	 * Try to use the value read by the loader from /etc/fstab, or
1661 	 * supplied via some other means.  This is the preferred
1662 	 * mechanism.
1663 	 */
1664 	cp = getenv("vfs.root.mountfrom");
1665 	if (cp != NULL) {
1666 		error = vfs_mountroot_try(cp);
1667 		freeenv(cp);
1668 		if (!error)
1669 			goto mounted;
1670 	}
1671 
1672 	/*
1673 	 * Try values that may have been computed by code during boot
1674 	 */
1675 	if (!vfs_mountroot_try(rootdevnames[0]))
1676 		goto mounted;
1677 	if (!vfs_mountroot_try(rootdevnames[1]))
1678 		goto mounted;
1679 
1680 	/*
1681 	 * If we (still) have a compiled-in default, try it.
1682 	 */
1683 	if (ctrootdevname != NULL)
1684 		if (!vfs_mountroot_try(ctrootdevname))
1685 			goto mounted;
1686 	/*
1687 	 * Everything so far has failed, prompt on the console if we haven't
1688 	 * already tried that.
1689 	 */
1690 	if (!asked)
1691 		if (!vfs_mountroot_ask())
1692 			goto mounted;
1693 
1694 	panic("Root mount failed, startup aborted.");
1695 
1696 mounted:
1697 	root_mount_done();
1698 }
1699 
1700 /*
1701  * Mount (mountfrom) as the root filesystem.
1702  */
1703 static int
1704 vfs_mountroot_try(const char *mountfrom)
1705 {
1706 	struct mount	*mp;
1707 	char		*vfsname, *path;
1708 	time_t		timebase;
1709 	int		error;
1710 	char		patt[32];
1711 
1712 	vfsname = NULL;
1713 	path    = NULL;
1714 	mp      = NULL;
1715 	error   = EINVAL;
1716 
1717 	if (mountfrom == NULL)
1718 		return (error);		/* don't complain */
1719 	printf("Trying to mount root from %s\n", mountfrom);
1720 
1721 	/* parse vfs name and path */
1722 	vfsname = malloc(MFSNAMELEN, M_MOUNT, M_WAITOK);
1723 	path = malloc(MNAMELEN, M_MOUNT, M_WAITOK);
1724 	vfsname[0] = path[0] = 0;
1725 	sprintf(patt, "%%%d[a-z0-9]:%%%ds", MFSNAMELEN, MNAMELEN);
1726 	if (sscanf(mountfrom, patt, vfsname, path) < 1)
1727 		goto out;
1728 
1729 	if (path[0] == '\0')
1730 		strcpy(path, ROOTNAME);
1731 
1732 	error = kernel_vmount(
1733 	    MNT_RDONLY | MNT_ROOTFS,
1734 	    "fstype", vfsname,
1735 	    "fspath", "/",
1736 	    "from", path,
1737 	    NULL);
1738 	if (error == 0) {
1739 		/*
1740 		 * We mount devfs prior to mounting the / FS, so the first
1741 		 * entry will typically be devfs.
1742 		 */
1743 		mp = TAILQ_FIRST(&mountlist);
1744 		KASSERT(mp != NULL, ("%s: mountlist is empty", __func__));
1745 
1746 		/*
1747 		 * Iterate over all currently mounted file systems and use
1748 		 * the time stamp found to check and/or initialize the RTC.
1749 		 * Typically devfs has no time stamp and the only other FS
1750 		 * is the actual / FS.
1751 		 * Call inittodr() only once and pass it the largest of the
1752 		 * timestamps we encounter.
1753 		 */
1754 		timebase = 0;
1755 		do {
1756 			if (mp->mnt_time > timebase)
1757 				timebase = mp->mnt_time;
1758 			mp = TAILQ_NEXT(mp, mnt_list);
1759 		} while (mp != NULL);
1760 		inittodr(timebase);
1761 
1762 		devfs_fixup(curthread);
1763 	}
1764 out:
1765 	free(path, M_MOUNT);
1766 	free(vfsname, M_MOUNT);
1767 	return (error);
1768 }
1769 
1770 /*
1771  * ---------------------------------------------------------------------
1772  * Interactive root filesystem selection code.
1773  */
1774 
1775 static int
1776 vfs_mountroot_ask(void)
1777 {
1778 	char name[128];
1779 
1780 	for(;;) {
1781 		printf("\nManual root filesystem specification:\n");
1782 		printf("  <fstype>:<device>  Mount <device> using filesystem <fstype>\n");
1783 #if defined(__amd64__) || defined(__i386__) || defined(__ia64__)
1784 		printf("                       eg. ufs:da0s1a\n");
1785 #else
1786 		printf("                       eg. ufs:/dev/da0a\n");
1787 #endif
1788 		printf("  ?                  List valid disk boot devices\n");
1789 		printf("  <empty line>       Abort manual input\n");
1790 		printf("\nmountroot> ");
1791 		gets(name, sizeof(name), 1);
1792 		if (name[0] == '\0')
1793 			return (1);
1794 		if (name[0] == '?') {
1795 			printf("\nList of GEOM managed disk devices:\n  ");
1796 			g_dev_print();
1797 			continue;
1798 		}
1799 		if (!vfs_mountroot_try(name))
1800 			return (0);
1801 	}
1802 }
1803 
1804 /*
1805  * ---------------------------------------------------------------------
1806  * Functions for querying mount options/arguments from filesystems.
1807  */
1808 
1809 /*
1810  * Check that no unknown options are given
1811  */
1812 int
1813 vfs_filteropt(struct vfsoptlist *opts, const char **legal)
1814 {
1815 	struct vfsopt *opt;
1816 	char errmsg[255];
1817 	const char **t, *p, *q;
1818 	int ret = 0;
1819 
1820 	TAILQ_FOREACH(opt, opts, link) {
1821 		p = opt->name;
1822 		q = NULL;
1823 		if (p[0] == 'n' && p[1] == 'o')
1824 			q = p + 2;
1825 		for(t = global_opts; *t != NULL; t++) {
1826 			if (strcmp(*t, p) == 0)
1827 				break;
1828 			if (q != NULL) {
1829 				if (strcmp(*t, q) == 0)
1830 					break;
1831 			}
1832 		}
1833 		if (*t != NULL)
1834 			continue;
1835 		for(t = legal; *t != NULL; t++) {
1836 			if (strcmp(*t, p) == 0)
1837 				break;
1838 			if (q != NULL) {
1839 				if (strcmp(*t, q) == 0)
1840 					break;
1841 			}
1842 		}
1843 		if (*t != NULL)
1844 			continue;
1845 		sprintf(errmsg, "mount option <%s> is unknown", p);
1846 		printf("%s\n", errmsg);
1847 		ret = EINVAL;
1848 	}
1849 	if (ret != 0) {
1850 		TAILQ_FOREACH(opt, opts, link) {
1851 			if (strcmp(opt->name, "errmsg") == 0) {
1852 				strncpy((char *)opt->value, errmsg, opt->len);
1853 			}
1854 		}
1855 	}
1856 	return (ret);
1857 }
1858 
1859 /*
1860  * Get a mount option by its name.
1861  *
1862  * Return 0 if the option was found, ENOENT otherwise.
1863  * If len is non-NULL it will be filled with the length
1864  * of the option. If buf is non-NULL, it will be filled
1865  * with the address of the option.
1866  */
1867 int
1868 vfs_getopt(opts, name, buf, len)
1869 	struct vfsoptlist *opts;
1870 	const char *name;
1871 	void **buf;
1872 	int *len;
1873 {
1874 	struct vfsopt *opt;
1875 
1876 	KASSERT(opts != NULL, ("vfs_getopt: caller passed 'opts' as NULL"));
1877 
1878 	TAILQ_FOREACH(opt, opts, link) {
1879 		if (strcmp(name, opt->name) == 0) {
1880 			if (len != NULL)
1881 				*len = opt->len;
1882 			if (buf != NULL)
1883 				*buf = opt->value;
1884 			return (0);
1885 		}
1886 	}
1887 	return (ENOENT);
1888 }
1889 
1890 static int
1891 vfs_getopt_pos(struct vfsoptlist *opts, const char *name)
1892 {
1893 	struct vfsopt *opt;
1894 	int i;
1895 
1896 	if (opts == NULL)
1897 		return (-1);
1898 
1899 	i = 0;
1900 	TAILQ_FOREACH(opt, opts, link) {
1901 		if (strcmp(name, opt->name) == 0)
1902 			return (i);
1903 		++i;
1904 	}
1905 	return (-1);
1906 }
1907 
1908 char *
1909 vfs_getopts(struct vfsoptlist *opts, const char *name, int *error)
1910 {
1911 	struct vfsopt *opt;
1912 
1913 	*error = 0;
1914 	TAILQ_FOREACH(opt, opts, link) {
1915 		if (strcmp(name, opt->name) != 0)
1916 			continue;
1917 		if (((char *)opt->value)[opt->len - 1] != '\0') {
1918 			*error = EINVAL;
1919 			return (NULL);
1920 		}
1921 		return (opt->value);
1922 	}
1923 	*error = ENOENT;
1924 	return (NULL);
1925 }
1926 
1927 int
1928 vfs_flagopt(struct vfsoptlist *opts, const char *name, u_int *w, u_int val)
1929 {
1930 	struct vfsopt *opt;
1931 
1932 	TAILQ_FOREACH(opt, opts, link) {
1933 		if (strcmp(name, opt->name) == 0) {
1934 			if (w != NULL)
1935 				*w |= val;
1936 			return (1);
1937 		}
1938 	}
1939 	if (w != NULL)
1940 		*w &= ~val;
1941 	return (0);
1942 }
1943 
1944 int
1945 vfs_scanopt(struct vfsoptlist *opts, const char *name, const char *fmt, ...)
1946 {
1947 	va_list ap;
1948 	struct vfsopt *opt;
1949 	int ret;
1950 
1951 	KASSERT(opts != NULL, ("vfs_getopt: caller passed 'opts' as NULL"));
1952 
1953 	TAILQ_FOREACH(opt, opts, link) {
1954 		if (strcmp(name, opt->name) != 0)
1955 			continue;
1956 		if (opt->len == 0 || opt->value == NULL)
1957 			return (0);
1958 		if (((char *)opt->value)[opt->len - 1] != '\0')
1959 			return (0);
1960 		va_start(ap, fmt);
1961 		ret = vsscanf(opt->value, fmt, ap);
1962 		va_end(ap);
1963 		return (ret);
1964 	}
1965 	return (0);
1966 }
1967 
1968 /*
1969  * Find and copy a mount option.
1970  *
1971  * The size of the buffer has to be specified
1972  * in len, if it is not the same length as the
1973  * mount option, EINVAL is returned.
1974  * Returns ENOENT if the option is not found.
1975  */
1976 int
1977 vfs_copyopt(opts, name, dest, len)
1978 	struct vfsoptlist *opts;
1979 	const char *name;
1980 	void *dest;
1981 	int len;
1982 {
1983 	struct vfsopt *opt;
1984 
1985 	KASSERT(opts != NULL, ("vfs_copyopt: caller passed 'opts' as NULL"));
1986 
1987 	TAILQ_FOREACH(opt, opts, link) {
1988 		if (strcmp(name, opt->name) == 0) {
1989 			if (len != opt->len)
1990 				return (EINVAL);
1991 			bcopy(opt->value, dest, opt->len);
1992 			return (0);
1993 		}
1994 	}
1995 	return (ENOENT);
1996 }
1997 
1998 /*
1999  * This is a helper function for filesystems to traverse their
2000  * vnodes.  See MNT_VNODE_FOREACH() in sys/mount.h
2001  */
2002 
2003 struct vnode *
2004 __mnt_vnode_next(struct vnode **mvp, struct mount *mp)
2005 {
2006 	struct vnode *vp;
2007 
2008 	mtx_assert(MNT_MTX(mp), MA_OWNED);
2009 
2010 	KASSERT((*mvp)->v_mount == mp, ("marker vnode mount list mismatch"));
2011 	vp = TAILQ_NEXT(*mvp, v_nmntvnodes);
2012 	while (vp != NULL && vp->v_type == VMARKER)
2013 		vp = TAILQ_NEXT(vp, v_nmntvnodes);
2014 
2015 	/* Check if we are done */
2016 	if (vp == NULL) {
2017 		__mnt_vnode_markerfree(mvp, mp);
2018 		return (NULL);
2019 	}
2020 	TAILQ_REMOVE(&mp->mnt_nvnodelist, *mvp, v_nmntvnodes);
2021 	TAILQ_INSERT_AFTER(&mp->mnt_nvnodelist, vp, *mvp, v_nmntvnodes);
2022 	return (vp);
2023 }
2024 
2025 struct vnode *
2026 __mnt_vnode_first(struct vnode **mvp, struct mount *mp)
2027 {
2028 	struct vnode *vp;
2029 
2030 	mtx_assert(MNT_MTX(mp), MA_OWNED);
2031 
2032 	vp = TAILQ_FIRST(&mp->mnt_nvnodelist);
2033 	while (vp != NULL && vp->v_type == VMARKER)
2034 		vp = TAILQ_NEXT(vp, v_nmntvnodes);
2035 
2036 	/* Check if we are done */
2037 	if (vp == NULL) {
2038 		*mvp = NULL;
2039 		return (NULL);
2040 	}
2041 	mp->mnt_holdcnt++;
2042 	MNT_IUNLOCK(mp);
2043 	*mvp = (struct vnode *) malloc(sizeof(struct vnode),
2044 				       M_VNODE_MARKER,
2045 				       M_WAITOK | M_ZERO);
2046 	MNT_ILOCK(mp);
2047 	(*mvp)->v_type = VMARKER;
2048 
2049 	vp = TAILQ_FIRST(&mp->mnt_nvnodelist);
2050 	while (vp != NULL && vp->v_type == VMARKER)
2051 		vp = TAILQ_NEXT(vp, v_nmntvnodes);
2052 
2053 	/* Check if we are done */
2054 	if (vp == NULL) {
2055 		MNT_IUNLOCK(mp);
2056 		free(*mvp, M_VNODE_MARKER);
2057 		MNT_ILOCK(mp);
2058 		*mvp = NULL;
2059 		mp->mnt_holdcnt--;
2060 		if (mp->mnt_holdcnt == 0 && mp->mnt_holdcntwaiters != 0)
2061 			wakeup(&mp->mnt_holdcnt);
2062 		return (NULL);
2063 	}
2064 	mp->mnt_markercnt++;
2065 	(*mvp)->v_mount = mp;
2066 	TAILQ_INSERT_AFTER(&mp->mnt_nvnodelist, vp, *mvp, v_nmntvnodes);
2067 	return (vp);
2068 }
2069 
2070 
2071 void
2072 __mnt_vnode_markerfree(struct vnode **mvp, struct mount *mp)
2073 {
2074 
2075 	if (*mvp == NULL)
2076 		return;
2077 
2078 	mtx_assert(MNT_MTX(mp), MA_OWNED);
2079 
2080 	KASSERT((*mvp)->v_mount == mp, ("marker vnode mount list mismatch"));
2081 	TAILQ_REMOVE(&mp->mnt_nvnodelist, *mvp, v_nmntvnodes);
2082 	MNT_IUNLOCK(mp);
2083 	free(*mvp, M_VNODE_MARKER);
2084 	MNT_ILOCK(mp);
2085 	*mvp = NULL;
2086 
2087 	mp->mnt_markercnt--;
2088 	mp->mnt_holdcnt--;
2089 	if (mp->mnt_holdcnt == 0 && mp->mnt_holdcntwaiters != 0)
2090 		wakeup(&mp->mnt_holdcnt);
2091 }
2092 
2093 
2094 int
2095 __vfs_statfs(struct mount *mp, struct statfs *sbp, struct thread *td)
2096 {
2097 	int error;
2098 
2099 	error = mp->mnt_op->vfs_statfs(mp, &mp->mnt_stat, td);
2100 	if (sbp != &mp->mnt_stat)
2101 		*sbp = mp->mnt_stat;
2102 	return (error);
2103 }
2104 
2105 void
2106 vfs_mountedfrom(struct mount *mp, const char *from)
2107 {
2108 
2109 	bzero(mp->mnt_stat.f_mntfromname, sizeof mp->mnt_stat.f_mntfromname);
2110 	strlcpy(mp->mnt_stat.f_mntfromname, from,
2111 	    sizeof mp->mnt_stat.f_mntfromname);
2112 }
2113 
2114 /*
2115  * ---------------------------------------------------------------------
2116  * This is the api for building mount args and mounting filesystems from
2117  * inside the kernel.
2118  *
2119  * The API works by accumulation of individual args.  First error is
2120  * latched.
2121  *
2122  * XXX: should be documented in new manpage kernel_mount(9)
2123  */
2124 
2125 /* A memory allocation which must be freed when we are done */
2126 struct mntaarg {
2127 	SLIST_ENTRY(mntaarg)	next;
2128 };
2129 
2130 /* The header for the mount arguments */
2131 struct mntarg {
2132 	struct iovec *v;
2133 	int len;
2134 	int error;
2135 	SLIST_HEAD(, mntaarg)	list;
2136 };
2137 
2138 /*
2139  * Add a boolean argument.
2140  *
2141  * flag is the boolean value.
2142  * name must start with "no".
2143  */
2144 struct mntarg *
2145 mount_argb(struct mntarg *ma, int flag, const char *name)
2146 {
2147 
2148 	KASSERT(name[0] == 'n' && name[1] == 'o',
2149 	    ("mount_argb(...,%s): name must start with 'no'", name));
2150 
2151 	return (mount_arg(ma, name + (flag ? 2 : 0), NULL, 0));
2152 }
2153 
2154 /*
2155  * Add an argument printf style
2156  */
2157 struct mntarg *
2158 mount_argf(struct mntarg *ma, const char *name, const char *fmt, ...)
2159 {
2160 	va_list ap;
2161 	struct mntaarg *maa;
2162 	struct sbuf *sb;
2163 	int len;
2164 
2165 	if (ma == NULL) {
2166 		ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO);
2167 		SLIST_INIT(&ma->list);
2168 	}
2169 	if (ma->error)
2170 		return (ma);
2171 
2172 	ma->v = realloc(ma->v, sizeof *ma->v * (ma->len + 2),
2173 	    M_MOUNT, M_WAITOK);
2174 	ma->v[ma->len].iov_base = (void *)(uintptr_t)name;
2175 	ma->v[ma->len].iov_len = strlen(name) + 1;
2176 	ma->len++;
2177 
2178 	sb = sbuf_new(NULL, NULL, 0, SBUF_AUTOEXTEND);
2179 	va_start(ap, fmt);
2180 	sbuf_vprintf(sb, fmt, ap);
2181 	va_end(ap);
2182 	sbuf_finish(sb);
2183 	len = sbuf_len(sb) + 1;
2184 	maa = malloc(sizeof *maa + len, M_MOUNT, M_WAITOK | M_ZERO);
2185 	SLIST_INSERT_HEAD(&ma->list, maa, next);
2186 	bcopy(sbuf_data(sb), maa + 1, len);
2187 	sbuf_delete(sb);
2188 
2189 	ma->v[ma->len].iov_base = maa + 1;
2190 	ma->v[ma->len].iov_len = len;
2191 	ma->len++;
2192 
2193 	return (ma);
2194 }
2195 
2196 /*
2197  * Add an argument which is a userland string.
2198  */
2199 struct mntarg *
2200 mount_argsu(struct mntarg *ma, const char *name, const void *val, int len)
2201 {
2202 	struct mntaarg *maa;
2203 	char *tbuf;
2204 
2205 	if (val == NULL)
2206 		return (ma);
2207 	if (ma == NULL) {
2208 		ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO);
2209 		SLIST_INIT(&ma->list);
2210 	}
2211 	if (ma->error)
2212 		return (ma);
2213 	maa = malloc(sizeof *maa + len, M_MOUNT, M_WAITOK | M_ZERO);
2214 	SLIST_INSERT_HEAD(&ma->list, maa, next);
2215 	tbuf = (void *)(maa + 1);
2216 	ma->error = copyinstr(val, tbuf, len, NULL);
2217 	return (mount_arg(ma, name, tbuf, -1));
2218 }
2219 
2220 /*
2221  * Plain argument.
2222  *
2223  * If length is -1, treat value as a C string.
2224  */
2225 struct mntarg *
2226 mount_arg(struct mntarg *ma, const char *name, const void *val, int len)
2227 {
2228 
2229 	if (ma == NULL) {
2230 		ma = malloc(sizeof *ma, M_MOUNT, M_WAITOK | M_ZERO);
2231 		SLIST_INIT(&ma->list);
2232 	}
2233 	if (ma->error)
2234 		return (ma);
2235 
2236 	ma->v = realloc(ma->v, sizeof *ma->v * (ma->len + 2),
2237 	    M_MOUNT, M_WAITOK);
2238 	ma->v[ma->len].iov_base = (void *)(uintptr_t)name;
2239 	ma->v[ma->len].iov_len = strlen(name) + 1;
2240 	ma->len++;
2241 
2242 	ma->v[ma->len].iov_base = (void *)(uintptr_t)val;
2243 	if (len < 0)
2244 		ma->v[ma->len].iov_len = strlen(val) + 1;
2245 	else
2246 		ma->v[ma->len].iov_len = len;
2247 	ma->len++;
2248 	return (ma);
2249 }
2250 
2251 /*
2252  * Free a mntarg structure
2253  */
2254 static void
2255 free_mntarg(struct mntarg *ma)
2256 {
2257 	struct mntaarg *maa;
2258 
2259 	while (!SLIST_EMPTY(&ma->list)) {
2260 		maa = SLIST_FIRST(&ma->list);
2261 		SLIST_REMOVE_HEAD(&ma->list, next);
2262 		free(maa, M_MOUNT);
2263 	}
2264 	free(ma->v, M_MOUNT);
2265 	free(ma, M_MOUNT);
2266 }
2267 
2268 /*
2269  * Mount a filesystem
2270  */
2271 int
2272 kernel_mount(struct mntarg *ma, int flags)
2273 {
2274 	struct uio auio;
2275 	int error;
2276 
2277 	KASSERT(ma != NULL, ("kernel_mount NULL ma"));
2278 	KASSERT(ma->v != NULL, ("kernel_mount NULL ma->v"));
2279 	KASSERT(!(ma->len & 1), ("kernel_mount odd ma->len (%d)", ma->len));
2280 
2281 	auio.uio_iov = ma->v;
2282 	auio.uio_iovcnt = ma->len;
2283 	auio.uio_segflg = UIO_SYSSPACE;
2284 
2285 	error = ma->error;
2286 	if (!error)
2287 		error = vfs_donmount(curthread, flags, &auio);
2288 	free_mntarg(ma);
2289 	return (error);
2290 }
2291 
2292 /*
2293  * A printflike function to mount a filesystem.
2294  */
2295 int
2296 kernel_vmount(int flags, ...)
2297 {
2298 	struct mntarg *ma = NULL;
2299 	va_list ap;
2300 	const char *cp;
2301 	const void *vp;
2302 	int error;
2303 
2304 	va_start(ap, flags);
2305 	for (;;) {
2306 		cp = va_arg(ap, const char *);
2307 		if (cp == NULL)
2308 			break;
2309 		vp = va_arg(ap, const void *);
2310 		ma = mount_arg(ma, cp, vp, (vp != NULL ? -1 : 0));
2311 	}
2312 	va_end(ap);
2313 
2314 	error = kernel_mount(ma, flags);
2315 	return (error);
2316 }
2317