From 4ce1cee76d0a2773ea5d05234b968893082d7b4f Mon Sep 17 00:00:00 2001
From: Jax Calder <jax.calder.wild.valles@gmail.com>
Date: Sun, 25 Oct 2026 19:39:03 +0000
Subject: [PATCH] libsystemd: load the configuration directory of a mount point
 by itself

libsystemd already hears every mount and unmount (dmfsi's _mount_changed dif), so
the loading of <mount point>/cfg/services and cfg/rules is its own business again,
not an API for a service to call: on a mount it adds the units, templates and rules
to what is loaded and starts the units (dependency order, first definition of a
name stays, %m = the mount point), on an unmount it runs the rules' `remove` units,
then stops and drops exactly what came from there. A full reload keeps them; the
units directory of libsystemd_scan() is never loaded twice.

The module search path is invalidated before the units start: the new file system
may hold their modules (/mnt/<label>/bin), and automount only gets to it after the
mount returned.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 README.md                                     |  10 +
 app/libsystemd/docs/configuration.md          |  64 +-
 app/libsystemd/src/serviceapi.c               | 801 ++++++++++++++++--
 .../fixtures/mount_a/cfg/rules/devices.rules  |   2 +
 .../fixtures/mount_a/cfg/services/mounted.ini |   7 +
 .../fixtures/mount_a/cfg/services/tool@.ini   |   4 +
 .../fixtures/mount_b/cfg/services/mounted.ini |   4 +
 .../tests/fixtures/mount_empty/.keep          |   0
 .../mount_root/cfg/services/rootunit.ini      |   3 +
 app/libsystemd/tests/libsystemd_test.c        | 123 +++
 10 files changed, 959 insertions(+), 59 deletions(-)
 create mode 100644 app/libsystemd/tests/fixtures/mount_a/cfg/rules/devices.rules
 create mode 100644 app/libsystemd/tests/fixtures/mount_a/cfg/services/mounted.ini
 create mode 100644 app/libsystemd/tests/fixtures/mount_a/cfg/services/tool@.ini
 create mode 100644 app/libsystemd/tests/fixtures/mount_b/cfg/services/mounted.ini
 create mode 100644 app/libsystemd/tests/fixtures/mount_empty/.keep
 create mode 100644 app/libsystemd/tests/fixtures/mount_root/cfg/services/rootunit.ini

diff --git a/README.md b/README.md
index 398785f..5e06201 100644
--- a/README.md
+++ b/README.md
@@ -186,6 +186,16 @@ mount and unmount that way, as a device of class `mount` - what a mount means is
 up to the rules and the services they start. See
 [`app/libsystemd/docs/configuration.md`](app/libsystemd/docs/configuration.md#mounts-as-devices-the-mount-class).
 
+### Configuration directories of mount points
+
+A mounted file system may bring its own units and rules, in
+`<mount point>/cfg/services` and `<mount point>/cfg/rules`. libsystemd loads
+them by itself when the file system is mounted (from the `_mount_changed` dif)
+and starts the units; before it is unmounted it stops and removes exactly them.
+In such a unit `%m` is the mount point (`exec=%m/bin/app.dmfc`), so it uses the
+module and the files of its own card. See
+[`app/libsystemd/docs/configuration.md`](app/libsystemd/docs/configuration.md#configuration-directories-of-mount-points).
+
 ## Building
 
 ### Using CMake
diff --git a/app/libsystemd/docs/configuration.md b/app/libsystemd/docs/configuration.md
index 2fea8bb..d7e208d 100644
--- a/app/libsystemd/docs/configuration.md
+++ b/app/libsystemd/docs/configuration.md
@@ -234,11 +234,13 @@ case-sensitive):
 | `%p` | The template prefix (e.g. `getty`) |
 | `%n` | The full instantiated unit name (e.g. `getty@tty1`) |
 | `%v` | The caller-supplied `user_value` passed to `libsystemd_start_service()`/`libsystemd_notify_device_added()`, or an empty string if none was given (see [Device rules](#device-rules)) |
+| `%m` | The mount point whose configuration directory the unit (or its template) comes from, without a trailing `/` - empty for the units directory of `libsystemd_scan()` (see [Configuration directories of mount points](#configuration-directories-of-mount-points)) |
 | `%%` | A literal `%` |
 
 An unrecognized `%<char>` sequence (or a trailing `%`) is left untouched.
-Specifier expansion only happens for instance files - plain (non-`@`) unit
-files are never scanned for `%` and can freely contain a literal `%`.
+Specifier expansion only happens for instance files - in a plain (non-`@`)
+unit file only `%m` is expanded, anything else (a literal `%`, `%%`) is
+taken as is.
 
 ```ini
 # getty@.ini - the template
@@ -388,10 +390,12 @@ have `start`, `remove` or both.
 libsystemd implements dmfsi's `_mount_changed` dif, which dmvfs calls after every
 mount and before every unmount, and reports it as a device of class `mount`:
 named after the mount point (`/mnt/SD` -> `mnt_SD`, `/ext` -> `ext`, `/` ->
-`root`), its value (`%v`) the mount point. It does nothing else - what a mount
-means is up to the rules (see the example above): the unit they start does its
-work in a process of its own, with the stack its module asks for, and the
-`remove` unit is done before the file system goes away.
+`root`), its value (`%v`) the mount point. What a mount means beyond its own
+configuration directory (see [Configuration directories of mount
+points](#configuration-directories-of-mount-points)) is up to the rules (see the
+example above): the unit they start does its work in a process of its own, with
+the stack its module asks for, and the `remove` unit is done before the file
+system goes away.
 
 ### Devices reported before rules/units exist yet
 
@@ -416,3 +420,51 @@ piece is enough to leave a device pending, and either one showing up later
 is enough to retry it. A device stops being remembered - and is never
 retried again - once `libsystemd_notify_device_removed()` is called for the
 same `(class, name)` pair, even if it was never successfully started.
+
+## Configuration directories of mount points
+
+Besides the units directory of `libsystemd_scan()` and the rules directory of
+`libsystemd_load_rules()`, every mounted file system may bring its own
+configuration, in the same layout:
+
+```
+<mount point>/cfg/services/   units (and templates)
+<mount point>/cfg/rules/      device rules
+```
+
+libsystemd loads it by itself, from the `_mount_changed` dif (see above): when a
+file system is mounted, its units, templates and rules are **added** to what is
+loaded - nothing is reloaded or restarted - and its units are started in their
+dependency order (`requires`/`after` may name units from anywhere). When it is
+about to be unmounted, libsystemd first runs the rules' `remove` units, then
+stops every unit that came from there - template instances started from its
+templates too - and removes its units, templates and rules; everything else
+stays. The unmount waits for all of it, so the units stop while their files are
+still there. A mount point without `cfg/services` and `cfg/rules` is left
+alone. A full reload (`libsystemd_scan()`, `libsystemd_load_rules()`) keeps the
+loaded configuration directories, and so does a mount reported before the first
+scan. The configuration directory of the root file system is the units
+directory of `libsystemd_scan()` itself (`/cfg/services`), so it is not loaded
+twice.
+
+The call comes in the thread that mounts, so loading a directory and starting
+its units takes that thread's stack: on dmod-boot automount's, which peaked at
+2.6 kB with one unit from a card (module loaded from the FAT file system) and a
+one-shot `devscan` - more than the 2 kB it was released with, so it needs 4 kB.
+Work that is not libsystemd's own is better left to a one-shot unit started by a
+rule (a process of its own). The module search path is invalidated before the
+units start, so a module on the new file system (`/mnt/<label>/bin`) is found.
+
+In every unit of such a directory `%m` is the mount point, so a unit can name
+the module and the files on its own file system - and stays bound to it even
+with several cards carrying the same module:
+
+```ini
+; /mnt/SD/cfg/services/carhmi.ini
+description=Car HMI demo
+exec=%m/bin/carhmi.dmfc
+args=%m/views/carhmi_view/carhmi.dmv
+```
+
+A unit or template whose name is taken already - by the firmware or by a
+mount point loaded before - is logged and ignored: the first one stays.
diff --git a/app/libsystemd/src/serviceapi.c b/app/libsystemd/src/serviceapi.c
index 50b8c52..aabf1fb 100644
--- a/app/libsystemd/src/serviceapi.c
+++ b/app/libsystemd/src/serviceapi.c
@@ -68,6 +68,7 @@ struct libsystemd_service
     Dmod_Pid_t pid;                     //!< PID of the process currently tracked for this unit, or <= 0 if never started/not running.
     Dmod_Pid_t last_pid;                //!< PID of the most recent run, retained after `pid` is released so status can tell "never started" from "exited"; <= 0 only if the unit has never run.
     dmosi_process_exit_callback_handle_t exit_callback_handle;  //!< Handle of the dmosi exit callback registered for the current run (see libsystemd_attach_exit_callback()), or NULL if none is registered (not currently running, or registration failed/unsupported).
+    char* source;                       //!< Mount point whose configuration directory the unit (or its template) comes from (see libsystemd_add_config_dir()), or NULL for the units directory of libsystemd_scan(). Owned copy.
 };
 
 /**
@@ -84,6 +85,7 @@ typedef struct
 {
     char* prefix;    //!< Template prefix, e.g. "console" for "console@.ini". Owned copy.
     char* dir_path;  //!< Directory "<prefix>@.ini" was found in (may be nested under the scanned units directory). Owned copy.
+    char* source;    //!< Mount point of the configuration directory it comes from, or NULL (see libsystemd_service::source). Owned copy.
 } libsystemd_template_t;
 
 /**
@@ -139,6 +141,7 @@ typedef struct
     char* class_name;      //!< Device class this rule applies to (the part after "class=" in its `[class=...]` section name). Owned copy.
     char* start_template;  //!< Value of that section's "start" key (started when a device of the class appears), with "%name" substituted for the device name at match time, or NULL. Owned copy.
     char* remove_template; //!< Value of that section's "remove" key (started when a device of the class goes away - see libsystemd_notify_device_removed()), "%name" substituted as above, or NULL. Owned copy.
+    char* source;          //!< Mount point of the configuration directory it comes from, or NULL (see libsystemd_service::source). Owned copy.
 } libsystemd_rule_t;
 
 /**
@@ -182,13 +185,31 @@ typedef struct
  */
 static dmlist_context_t* g_devices = NULL;
 
+/**
+ * @brief Name of the configuration directory a mount point may have
+ *
+ * `<mount point>/cfg/services` holds units and `<mount point>/cfg/rules` device
+ * rules, the same layout as the firmware's own `/cfg` (see libsystemd_add_config_dir()).
+ */
+#define LIBSYSTEMD_CONFIG_DIR_NAME  "cfg"
+
+/**
+ * @brief Mount points whose configuration directory is loaded (owned `char*` each), or NULL
+ *
+ * Added by libsystemd_add_config_dir() and removed by libsystemd_remove_config_dir() -
+ * when a file system is mounted or unmounted (see the _mount_changed dif). Kept so
+ * that a full reload (libsystemd_scan(), libsystemd_load_rules()) loads their units
+ * and rules again instead of dropping them.
+ */
+static dmlist_context_t* g_config_dirs = NULL;
+
 /**
  * @brief Guards the registry lists - @ref g_services (units and templates), @ref g_rules,
- *        @ref g_devices - against concurrent threads
+ *        @ref g_devices, @ref g_config_dirs - against concurrent threads
  *
- * libsystemd is called from several threads: dmdevfs's hot-plug thread and
- * dmvfs's mount reports (device notifications), the shell (`service`),
- * systemd at boot. Two of them instantiating the same unit at
+ * libsystemd is called from several threads: dmdevfs's hot-plug thread
+ * (device notifications and configuration directories), the shell
+ * (`service`), systemd at boot. Two of them instantiating the same unit at
  * once registered it twice. Recursive, and held only while a list is read or
  * changed: never while a unit is spawned, a module enabled or disabled, or a
  * stopping unit waited for - those may need another thread that calls into
@@ -213,6 +234,14 @@ static void libsystemd_unlock(void)
     }
 }
 
+// Defined with the configuration directory API at the end of this file.
+static int libsystemd_parse_dir_from(const char* dir_path, const char* source, libsystemd_services_t* services);
+static void libsystemd_merge_config_dirs_units(void);
+static void libsystemd_merge_config_dirs_rules(void);
+static void libsystemd_destroy_config_dirs(void);
+static int libsystemd_add_config_dir(const char* mount_point);
+static int libsystemd_remove_config_dir(const char* mount_point);
+
 /**
  * @brief Closure passed to libsystemd_dependency_order_visitor() while walking one service's dependency lists
  */
@@ -333,6 +362,7 @@ static void libsystemd_destroy_service(libsystemd_service_t service)
 
     libsystemd_destroy_name_list(service->required);
     libsystemd_destroy_name_list(service->after);
+    Dmod_Free(service->source);
 
     Dmod_Free(service);
 }
@@ -385,6 +415,7 @@ static void libsystemd_destroy_services(libsystemd_services_t services)
         {
             Dmod_Free(tmpl->prefix);
             Dmod_Free(tmpl->dir_path);
+            Dmod_Free(tmpl->source);
             Dmod_Free(tmpl);
             tmpl = (libsystemd_template_t*)dmlist_pop_front(services->templates);
         }
@@ -430,6 +461,7 @@ static void libsystemd_destroy_rules(dmlist_context_t* rules)
         Dmod_Free(rule->class_name);
         Dmod_Free(rule->start_template);
         Dmod_Free(rule->remove_template);
+        Dmod_Free(rule->source);
         Dmod_Free(rule);
         rule = (libsystemd_rule_t*)dmlist_pop_front(rules);
     }
@@ -2028,37 +2060,129 @@ static char* libsystemd_build_unit_name(const char* prefix, const char* instance
     return unit_name;
 }
 
+/**
+ * @brief The text `%m` expands to for a unit from @p source
+ *
+ * The mount point the unit's configuration directory is on, without a
+ * trailing '/', so "%m/bin/app.dmfc" is a path on that file system:
+ * "/mnt/SD" for a unit from /mnt/SD/cfg/services, "" for one from the root
+ * file system or from the units directory of libsystemd_scan() (@p source NULL).
+ * Only the first libsystemd_mount_specifier_length() characters count.
+ *
+ * @param source Mount point (libsystemd_service::source), or NULL.
+ *
+ * @return The text, never NULL.
+ */
+static const char* libsystemd_mount_specifier_value(const char* source)
+{
+    return (source != NULL) ? source : "";
+}
+
+/**
+ * @brief Length of the text `%m` expands to (see libsystemd_mount_specifier_value())
+ */
+static size_t libsystemd_mount_specifier_length(const char* source)
+{
+    const char* value = libsystemd_mount_specifier_value(source);
+    size_t len = strlen(value);
+    while (len > 0 && value[len - 1] == '/')
+    {
+        len--;
+    }
+    return len;
+}
+
+/**
+ * @brief Expand only `%m` in a single string
+ *
+ * For a unit that is not a template instance, whose keys are otherwise taken
+ * verbatim (see libsystemd_parse_unit_internal()): `%m` is the only specifier
+ * that means something for it. Every other `%` sequence, `%%` included, is
+ * copied through unchanged.
+ *
+ * @param value  String to expand (must not be NULL).
+ * @param source Mount point the unit comes from, or NULL (see libsystemd_mount_specifier_value()).
+ *
+ * @return Newly heap-allocated expanded string, owned by the caller (free
+ *         with Dmod_Free()), or NULL if allocation failed.
+ */
+static char* libsystemd_substitute_mount_specifier(const char* value, const char* source)
+{
+    const char* mount_point = libsystemd_mount_specifier_value(source);
+    size_t mount_point_len = libsystemd_mount_specifier_length(source);
+
+    size_t out_len = 0;
+    for (const char* scan = value; *scan != '\0'; )
+    {
+        if (scan[0] == '%' && scan[1] == 'm')
+        {
+            out_len += mount_point_len;
+            scan += 2;
+            continue;
+        }
+        out_len += 1;
+        scan += 1;
+    }
+
+    char* result = Dmod_Malloc(out_len + 1);
+    if (result == NULL)
+    {
+        return NULL;
+    }
+
+    char* dst = result;
+    for (const char* scan = value; *scan != '\0'; )
+    {
+        if (scan[0] == '%' && scan[1] == 'm')
+        {
+            memcpy(dst, mount_point, mount_point_len);
+            dst += mount_point_len;
+            scan += 2;
+            continue;
+        }
+        *dst++ = *scan++;
+    }
+    *dst = '\0';
+
+    return result;
+}
+
 /**
  * @brief Expand systemd-style `%`-specifiers in a single string
  *
  * Recognized specifiers: `%i`/`%I` (instance name), `%p` (template prefix),
  * `%n` (full instantiated unit name, "<prefix>@<instance>"), `%v` (caller-supplied
  * user value, see @ref libsystemd_notify_device_added/@ref libsystemd_start_service),
- * `%%` (a literal `%`). An unrecognized `%<char>` sequence (or a trailing `%`
- * at the end of the string) is copied through verbatim, unexpanded.
+ * `%m` (mount point the unit's configuration directory is on, see
+ * libsystemd_mount_specifier_value()), `%%` (a literal `%`). An unrecognized
+ * `%<char>` sequence (or a trailing `%` at the end of the string) is copied
+ * through verbatim, unexpanded.
  *
  * @param value      String to expand (must not be NULL).
  * @param prefix     Template prefix, substituted for `%p` (must not be NULL).
  * @param instance   Instance name, substituted for `%i`/`%I` (must not be NULL).
  * @param unit_name  Full "<prefix>@<instance>" unit name, substituted for `%n` (must not be NULL).
  * @param user_value Caller-supplied value, substituted for `%v`, or NULL to expand `%v` to an empty string.
+ * @param source     Mount point the unit comes from (libsystemd_service::source), or NULL - see libsystemd_mount_specifier_value().
  *
  * @return Newly heap-allocated expanded string, owned by the caller (free
  *         with Dmod_Free()), or NULL if allocation failed.
  *
  * @par Example
  * @code
- * char* expanded = libsystemd_substitute_specifiers("--tty %i", "getty", "tty1", "getty@tty1", NULL);
+ * char* expanded = libsystemd_substitute_specifiers("--tty %i", "getty", "tty1", "getty@tty1", NULL, NULL);
  * // expanded == "--tty tty1"
  * @endcode
  */
-static char* libsystemd_substitute_specifiers(const char* value, const char* prefix, const char* instance, const char* unit_name, const char* user_value)
+static char* libsystemd_substitute_specifiers(const char* value, const char* prefix, const char* instance, const char* unit_name, const char* user_value, const char* source)
 {
     if (user_value == NULL)
     {
         user_value = "";
     }
 
+    const char* mount_point = libsystemd_mount_specifier_value(source);
+    size_t mount_point_len = libsystemd_mount_specifier_length(source);
     size_t prefix_len = strlen(prefix);
     size_t instance_len = strlen(instance);
     size_t unit_name_len = strlen(unit_name);
@@ -2071,11 +2195,12 @@ static char* libsystemd_substitute_specifiers(const char* value, const char* pre
         {
             switch (scan[1])
             {
-                case 'i': case 'I': out_len += instance_len;   scan += 2; continue;
-                case 'p':           out_len += prefix_len;     scan += 2; continue;
-                case 'n':           out_len += unit_name_len;  scan += 2; continue;
-                case 'v':           out_len += user_value_len; scan += 2; continue;
-                case '%':           out_len += 1;              scan += 2; continue;
+                case 'i': case 'I': out_len += instance_len;    scan += 2; continue;
+                case 'p':           out_len += prefix_len;      scan += 2; continue;
+                case 'n':           out_len += unit_name_len;   scan += 2; continue;
+                case 'v':           out_len += user_value_len;  scan += 2; continue;
+                case 'm':           out_len += mount_point_len; scan += 2; continue;
+                case '%':           out_len += 1;               scan += 2; continue;
                 default: break; /* unknown specifier: copied through as-is below */
             }
         }
@@ -2098,11 +2223,12 @@ static char* libsystemd_substitute_specifiers(const char* value, const char* pre
             size_t replacement_len = 0;
             switch (scan[1])
             {
-                case 'i': case 'I': replacement = instance;    replacement_len = instance_len;   break;
-                case 'p':           replacement = prefix;      replacement_len = prefix_len;     break;
-                case 'n':           replacement = unit_name;   replacement_len = unit_name_len;  break;
-                case 'v':           replacement = user_value;  replacement_len = user_value_len; break;
-                case '%':           replacement = "%";         replacement_len = 1;              break;
+                case 'i': case 'I': replacement = instance;    replacement_len = instance_len;    break;
+                case 'p':           replacement = prefix;      replacement_len = prefix_len;      break;
+                case 'n':           replacement = unit_name;   replacement_len = unit_name_len;   break;
+                case 'v':           replacement = user_value;  replacement_len = user_value_len;  break;
+                case 'm':           replacement = mount_point; replacement_len = mount_point_len; break;
+                case '%':           replacement = "%";         replacement_len = 1;               break;
                 default: break;
             }
 
@@ -2136,12 +2262,13 @@ static char* libsystemd_substitute_specifiers(const char* value, const char* pre
  * @param instance   Instance name, forwarded to libsystemd_substitute_specifiers().
  * @param unit_name  Full unit name, forwarded to libsystemd_substitute_specifiers().
  * @param user_value Caller-supplied value, forwarded to libsystemd_substitute_specifiers() (may be NULL).
+ * @param source     Mount point the unit comes from, forwarded to libsystemd_substitute_specifiers() (may be NULL).
  *
  * @retval true  Every key was expanded successfully.
  * @retval false Allocation failed part-way through; @p ctx is left with
  *                whatever subset of keys had already been expanded.
  */
-static bool libsystemd_apply_specifiers(dmini_context_t ctx, const char* prefix, const char* instance, const char* unit_name, const char* user_value)
+static bool libsystemd_apply_specifiers(dmini_context_t ctx, const char* prefix, const char* instance, const char* unit_name, const char* user_value, const char* source)
 {
     int count = dmini_key_count(ctx, NULL);
 
@@ -2159,7 +2286,45 @@ static bool libsystemd_apply_specifiers(dmini_context_t ctx, const char* prefix,
             continue;
         }
 
-        char* expanded = libsystemd_substitute_specifiers(value, prefix, instance, unit_name, user_value);
+        char* expanded = libsystemd_substitute_specifiers(value, prefix, instance, unit_name, user_value, source);
+        if (expanded == NULL)
+        {
+            return false;
+        }
+
+        dmini_set_string(ctx, NULL, key, expanded);
+        Dmod_Free(expanded);
+    }
+
+    return true;
+}
+
+/**
+ * @brief Expand only `%m` in every key of an ini context's global section, in place
+ *
+ * The libsystemd_apply_specifiers() counterpart for a unit that is not a
+ * template instance - see libsystemd_substitute_mount_specifier().
+ *
+ * @param ctx    Ini context to expand in place (must not be NULL).
+ * @param source Mount point the unit comes from, or NULL.
+ *
+ * @retval true  Every key was expanded successfully.
+ * @retval false Allocation failed part-way through.
+ */
+static bool libsystemd_apply_mount_specifier(dmini_context_t ctx, const char* source)
+{
+    int count = dmini_key_count(ctx, NULL);
+
+    for (int i = 0; i < count; i++)
+    {
+        const char* key = dmini_key_name(ctx, NULL, i);
+        const char* value = (key != NULL) ? dmini_get_string(ctx, NULL, key, NULL) : NULL;
+        if (value == NULL || strchr(value, '%') == NULL)
+        {
+            continue;
+        }
+
+        char* expanded = libsystemd_substitute_mount_specifier(value, source);
         if (expanded == NULL)
         {
             return false;
@@ -2384,6 +2549,7 @@ static int libsystemd_build_service_from_ctx(dmini_context_t ctx, libsystemd_ser
     new_service->pid = -1;
     new_service->last_pid = -1;
     new_service->exit_callback_handle = NULL;
+    new_service->source = NULL;
 
     const char* args = dmini_get_string(ctx, NULL, "args", NULL);
     const char* description = dmini_get_string(ctx, NULL, "description", NULL);
@@ -2493,6 +2659,8 @@ static bool libsystemd_split_instance_name(const char* unit_name, char** out_pre
  * @param prefix     Template prefix, e.g. "getty" (must not be NULL).
  * @param instance   Instance name, e.g. "tty1" (must not be NULL).
  * @param user_value Caller-supplied value substituted for `%v`, or NULL to expand `%v` to an empty string.
+ * @param source     Mount point the template comes from (libsystemd_template_t::source), substituted
+ *                     for `%m` and kept as the instance's own source, or NULL.
  * @param service    Receives the newly allocated service on success, with
  *                     `unit_name` already set to "<prefix>@<instance>" (must not be NULL).
  *
@@ -2503,7 +2671,7 @@ static bool libsystemd_split_instance_name(const char* unit_name, char** out_pre
  *                   from `dmini_parse_file` on the template (e.g.
  *                   `DMINI_ERR_FILE` if "<prefix>@.ini" does not exist).
  */
-static int libsystemd_instantiate_from_template(const char* units_dir, const char* prefix, const char* instance, const char* user_value, libsystemd_service_t* service)
+static int libsystemd_instantiate_from_template(const char* units_dir, const char* prefix, const char* instance, const char* user_value, const char* source, libsystemd_service_t* service)
 {
     char* template_path = libsystemd_build_template_path(units_dir, prefix);
     if (template_path == NULL)
@@ -2533,7 +2701,7 @@ static int libsystemd_instantiate_from_template(const char* units_dir, const cha
         return -ENOMEM;
     }
 
-    if (!libsystemd_apply_specifiers(ctx, prefix, instance, unit_name, user_value))
+    if (!libsystemd_apply_specifiers(ctx, prefix, instance, unit_name, user_value, source))
     {
         dmini_destroy(ctx);
         Dmod_Free(unit_name);
@@ -2552,6 +2720,11 @@ static int libsystemd_instantiate_from_template(const char* units_dir, const cha
 
     new_service->unit_name = unit_name;
     new_service->from_template = true;
+    if (source != NULL && (new_service->source = Dmod_StrDup(source)) == NULL)
+    {
+        libsystemd_destroy_service(new_service);
+        return -ENOMEM;
+    }
     *service = new_service;
 
     return 0;
@@ -2603,7 +2776,7 @@ static libsystemd_service_t libsystemd_instantiate_service_on_demand(const char*
     }
 
     libsystemd_service_t service = NULL;
-    int result = libsystemd_instantiate_from_template(tmpl->dir_path, prefix, instance, user_value, &service);
+    int result = libsystemd_instantiate_from_template(tmpl->dir_path, prefix, instance, user_value, tmpl->source, &service);
 
     Dmod_Free(prefix);
     Dmod_Free(instance);
@@ -2637,7 +2810,7 @@ static int libsystemd_refresh_library_instance(libsystemd_service_t service, con
     if (!libsystemd_split_instance_name(service->unit_name, &prefix, &instance)) return -ENOMEM;
     libsystemd_template_t* tmpl = dmlist_find(g_services->templates, prefix, libsystemd_compare_template_by_prefix);
     libsystemd_service_t fresh = NULL;
-    int rc = tmpl == NULL ? -ENOENT : libsystemd_instantiate_from_template(tmpl->dir_path, prefix, instance, user_value, &fresh);
+    int rc = tmpl == NULL ? -ENOENT : libsystemd_instantiate_from_template(tmpl->dir_path, prefix, instance, user_value, tmpl->source, &fresh);
     Dmod_Free(prefix); Dmod_Free(instance);
     if (rc != 0) return rc;
     struct libsystemd_service old = *service;
@@ -2665,7 +2838,7 @@ static int libsystemd_refresh_library_instance(libsystemd_service_t service, con
  *         are non-fatal to the overall libsystemd_load_rules() pass, exactly
  *         like a single bad unit file doesn't abort libsystemd_parse_dir().
  */
-static void libsystemd_parse_rules_file(const char* file_path, dmlist_context_t* rules)
+static void libsystemd_parse_rules_file(const char* file_path, const char* source, dmlist_context_t* rules)
 {
     DMOD_LOG_INFO("Analyzing rules file '%s'\n", file_path);
 
@@ -2717,13 +2890,15 @@ static void libsystemd_parse_rules_file(const char* file_path, dmlist_context_t*
         rule->class_name = Dmod_StrDup(class_name);
         rule->start_template = (start_template != NULL) ? Dmod_StrDup(start_template) : NULL;
         rule->remove_template = (remove_template != NULL) ? Dmod_StrDup(remove_template) : NULL;
+        rule->source = (source != NULL) ? Dmod_StrDup(source) : NULL;
         if (rule->class_name == NULL || (start_template != NULL && rule->start_template == NULL) ||
-            (remove_template != NULL && rule->remove_template == NULL) ||
+            (remove_template != NULL && rule->remove_template == NULL) || (source != NULL && rule->source == NULL) ||
             !dmlist_push_back(rules, rule))
         {
             Dmod_Free(rule->class_name);
             Dmod_Free(rule->start_template);
         Dmod_Free(rule->remove_template);
+            Dmod_Free(rule->source);
             Dmod_Free(rule);
         }
     }
@@ -2749,7 +2924,7 @@ static void libsystemd_parse_rules_file(const char* file_path, dmlist_context_t*
  * @note A subdirectory that fails to open is logged via DMOD_LOG_WARN() and
  *       skipped - one bad subdirectory must not abort the whole scan.
  */
-static int libsystemd_parse_rules_dir_walk(const char* rules_dir, dmlist_context_t* rules)
+static int libsystemd_parse_rules_dir_walk(const char* rules_dir, const char* source, dmlist_context_t* rules)
 {
     void* dir = Dmod_OpenDir(rules_dir);
     if (dir == NULL)
@@ -2771,7 +2946,7 @@ static int libsystemd_parse_rules_dir_walk(const char* rules_dir, dmlist_context
             char* sub_dir_path = libsystemd_join_path(rules_dir, entry->name);
             if (sub_dir_path != NULL)
             {
-                int result = libsystemd_parse_rules_dir_walk(sub_dir_path, rules);
+                int result = libsystemd_parse_rules_dir_walk(sub_dir_path, source, rules);
                 if (result != 0)
                 {
                     DMOD_LOG_WARN("Failed to scan rules subdirectory '%s' (%d)\n", sub_dir_path, result);
@@ -2789,7 +2964,7 @@ static int libsystemd_parse_rules_dir_walk(const char* rules_dir, dmlist_context
             if (file_path != NULL)
             {
                 DMOD_LOG_INFO("Detected rules file '%s'\n", file_path);
-                libsystemd_parse_rules_file(file_path, rules);
+                libsystemd_parse_rules_file(file_path, source, rules);
                 Dmod_Free(file_path);
             }
         }
@@ -2819,7 +2994,7 @@ static int libsystemd_parse_rules_dir_walk(const char* rules_dir, dmlist_context
  * @retval -ENOENT @p rules_dir does not exist / cannot be opened.
  * @retval -ENOMEM Allocation of the registry or its underlying dmlist failed.
  */
-static int libsystemd_parse_rules_dir(const char* rules_dir, dmlist_context_t** out_rules)
+static int libsystemd_parse_rules_dir(const char* rules_dir, const char* source, dmlist_context_t** out_rules)
 {
     dmlist_context_t* rules = dmlist_create();
     if (rules == NULL)
@@ -2827,7 +3002,7 @@ static int libsystemd_parse_rules_dir(const char* rules_dir, dmlist_context_t**
         return -ENOMEM;
     }
 
-    int result = libsystemd_parse_rules_dir_walk(rules_dir, rules);
+    int result = libsystemd_parse_rules_dir_walk(rules_dir, source, rules);
     if (result != 0)
     {
         libsystemd_destroy_rules(rules);
@@ -3174,6 +3349,8 @@ static int libsystemd_serviceapi_init(void)
  */
 static void libsystemd_serviceapi_deinit(void)
 {
+    libsystemd_destroy_config_dirs();
+
     libsystemd_stop_all_services(g_services);
     libsystemd_destroy_services(g_services);
     g_services = NULL;
@@ -3581,7 +3758,9 @@ dmod_libsystemd_api_declaration(1.0, int, _list, (libsystemd_visitor_t visitor,
  *
  * @note Calling this again later is a full reload: unit files that disappeared
  *       since the last scan are dropped, and every service - even ones whose
- *       ini file did not change - is stopped and restarted.
+ *       ini file did not change - is stopped and restarted. The units of the
+ *       loaded configuration directories of mount points (libsystemd_add_config_dir())
+ *       are loaded again with them.
  *
  * @par Example
  * @code
@@ -3627,6 +3806,9 @@ dmod_libsystemd_api_declaration(1.0, int, _scan, (const char* path))
         g_units_dir = units_dir;
     }
 
+    // A full reload, but of this directory only: the mount points' units stay.
+    libsystemd_merge_config_dirs_units();
+
     libsystemd_resolve_starting_order(g_services->services);
     dmlist_sort(g_services->services, libsystemd_compare_by_starting_order);
     size_t count = dmlist_size(g_services->services);
@@ -3635,8 +3817,8 @@ dmod_libsystemd_api_declaration(1.0, int, _scan, (const char* path))
     libsystemd_stop_all_services(previous);
     libsystemd_destroy_services(previous);
 
-    // By index, over the services there are now: a unit started here may start another one
-    // (a device rule), which registers an instance of a template - appending to the list.
+    // By index, over the services there are now: a unit started here may load a
+    // configuration directory, which appends its own units and starts them itself.
     for (size_t i = 0; i < count; i++)
     {
         libsystemd_lock();
@@ -3681,8 +3863,9 @@ dmod_libsystemd_api_declaration(1.0, int, _scan, (const char* path))
  *
  * @param rules_dir Directory to scan, recursively, for rule ".ini"/".rules" files (e.g. "/etc/dmsystem/rules").
  *
- * @retval 0       Rules were (re-)loaded; @ref g_rules now reflects @p rules_dir only
- *                   (any previously loaded rules, from a different directory or the
+ * @retval 0       Rules were (re-)loaded; @ref g_rules now reflects @p rules_dir and
+ *                   the loaded configuration directories of mount points (any
+ *                   previously loaded rules, from a different directory or the
  *                   same one, are discarded first).
  * @retval -EINVAL @p rules_dir was NULL.
  * @retval -ENOENT @p rules_dir does not exist / cannot be opened.
@@ -3704,7 +3887,7 @@ dmod_libsystemd_api_declaration(1.0, int, _load_rules, (const char* rules_dir))
     DMOD_LOG_INFO("Starting scan of rules directory '%s'\n", rules_dir);
 
     dmlist_context_t* parsed = NULL;
-    int result = libsystemd_parse_rules_dir(rules_dir, &parsed);
+    int result = libsystemd_parse_rules_dir(rules_dir, NULL, &parsed);
     if (result != 0)
     {
         return result;
@@ -3713,6 +3896,9 @@ dmod_libsystemd_api_declaration(1.0, int, _load_rules, (const char* rules_dir))
     libsystemd_lock();
     dmlist_context_t* previous = g_rules;
     g_rules = parsed;
+
+    // The rules of the mount points' configuration directories stay.
+    libsystemd_merge_config_dirs_rules();
     libsystemd_unlock();
     libsystemd_destroy_rules(previous);
 
@@ -3971,16 +4157,23 @@ static char* libsystemd_mount_device_name(const char* mount_point)
 /**
  * @brief dmfsi's _mount_changed dif (called by dmvfs): a file system was mounted or is about to be unmounted
  *
- * libsystemd only reports it, as a device of class "mount" - named after the mount point ("/mnt/SD" -> "mnt_SD"),
- * with the mount point as its value (%v) - and the rules decide what that means:
+ * Two things happen:
  *
- *     [class=mount]
- *     start=mounted@%name             # when it is mounted
- *     remove=unmounted@%name          # when it is about to be unmounted
+ *  - the configuration directory of the mount point - `<mount point>/cfg/services` and `<mount point>/cfg/rules`,
+ *    the layout of the firmware's own `/cfg` - is loaded when it is mounted, and unloaded when it is about to be
+ *    unmounted (libsystemd_add_config_dir(), libsystemd_remove_config_dir());
+ *  - the mount is reported as a device of class "mount" - named after the mount point ("/mnt/SD" -> "mnt_SD"),
+ *    with the mount point as its value (%v) - and the rules, the firmware's and the ones of the mount point,
+ *    decide what that means:
  *
- * The call comes in the thread that mounts or unmounts, and whatever the rules start for a mount point does its
- * work in a process of its own, with the stack its module asks for. An unmount does not go on until the "remove"
- * units are done (libsystemd_notify_device_removed()).
+ *        [class=mount]
+ *        start=devscan@%name             # when it is mounted
+ *        remove=devscan-remove@%name     # when it is about to be unmounted
+ *
+ * The call comes in the thread that mounts or unmounts. On a mount the configuration comes first, so the device
+ * is matched against the rules that came with it. On an unmount the "remove" units are done first (they, and the
+ * units a rule started, may still need files of the file system - an unmount does not go on until they are done,
+ * see libsystemd_notify_device_removed()), and the units of the configuration directory stop last.
  */
 dmod_dmfsi_dif_api_declaration( 1.0, libsystemd, void, _mount_changed, (const char* mount_point, bool mounted) )
 {
@@ -3997,11 +4190,20 @@ dmod_dmfsi_dif_api_declaration( 1.0, libsystemd, void, _mount_changed, (const ch
 
     if (mounted)
     {
+        // The new file system may hold modules (/mnt/<label>/bin is on the module search path, which is cached):
+        // the units of its cfg/services start right now, before the one that mounted it (automount) gets to it.
+        Dmod_InvalidateModuleSearchPaths();
+        int result = libsystemd_add_config_dir(mount_point);
+        if (result != 0 && result != -ENOENT && result != -EALREADY)      // -ENOENT: there is no cfg/ there
+        {
+            DMOD_LOG_WARN("Cannot load the configuration directory of '%s' (%d)\n", mount_point, result);
+        }
         libsystemd_notify_device_added(LIBSYSTEMD_MOUNT_CLASS, name, mount_point);
     }
     else
     {
         libsystemd_notify_device_removed(LIBSYSTEMD_MOUNT_CLASS, name);
+        libsystemd_remove_config_dir(mount_point);
     }
     Dmod_Free(name);
 }
@@ -4037,6 +4239,9 @@ dmod_dmfsi_dif_api_declaration( 1.0, libsystemd, void, _mount_changed, (const ch
  *                        for a non-templated parse.
  * @param prefix        Template prefix (e.g. "getty"), or NULL.
  * @param instance      Instance name (e.g. "tty1"), or NULL.
+ * @param source        Mount point the unit comes from (libsystemd_service::source) - substituted for
+ *                        `%m` (in a plain unit `%m` is the only specifier expanded) and kept by the
+ *                        service - or NULL.
  * @param service       Receives the newly allocated service on success (must not be NULL).
  *
  * @retval 0       `*service` now points to a fully populated service (unit_name is NULL,
@@ -4049,7 +4254,7 @@ dmod_dmfsi_dif_api_declaration( 1.0, libsystemd, void, _mount_changed, (const ch
  *                   `DMINI_ERR_FILE` if the file could not be opened) - a
  *                   failure to parse @p template_path is never propagated.
  */
-static int libsystemd_parse_unit_internal(const char* file_path, const char* template_path, const char* prefix, const char* instance, libsystemd_service_t* service)
+static int libsystemd_parse_unit_internal(const char* file_path, const char* template_path, const char* prefix, const char* instance, const char* source, libsystemd_service_t* service)
 {
     if (file_path == NULL || service == NULL)
     {
@@ -4077,7 +4282,7 @@ static int libsystemd_parse_unit_internal(const char* file_path, const char* tem
     if (prefix != NULL && instance != NULL)
     {
         char* unit_name = libsystemd_build_unit_name(prefix, instance);
-        if (unit_name == NULL || !libsystemd_apply_specifiers(ctx, prefix, instance, unit_name, NULL))
+        if (unit_name == NULL || !libsystemd_apply_specifiers(ctx, prefix, instance, unit_name, NULL, source))
         {
             Dmod_Free(unit_name);
             dmini_destroy(ctx);
@@ -4085,10 +4290,22 @@ static int libsystemd_parse_unit_internal(const char* file_path, const char* tem
         }
         Dmod_Free(unit_name);
     }
+    else if (!libsystemd_apply_mount_specifier(ctx, source))
+    {
+        dmini_destroy(ctx);
+        return -ENOMEM;
+    }
 
     result = libsystemd_build_service_from_ctx(ctx, service);
     dmini_destroy(ctx);
 
+    if (result == 0 && source != NULL && ((*service)->source = Dmod_StrDup(source)) == NULL)
+    {
+        libsystemd_destroy_service(*service);
+        *service = NULL;
+        return -ENOMEM;
+    }
+
     return result;
 }
 
@@ -4125,7 +4342,7 @@ static int libsystemd_parse_unit_internal(const char* file_path, const char* tem
  */
 dmod_libsystemd_api_declaration(1.0, int, _parse_file, ( const char* file_path, libsystemd_service_t* service ))
 {
-    return libsystemd_parse_unit_internal(file_path, NULL, NULL, NULL, service);
+    return libsystemd_parse_unit_internal(file_path, NULL, NULL, NULL, NULL, service);
 }
 
 /**
@@ -4137,6 +4354,7 @@ dmod_libsystemd_api_declaration(1.0, int, _parse_file, ( const char* file_path,
  * - a ".ini" file is parsed exactly as documented on libsystemd_parse_dir().
  *
  * @param dir_path Directory to scan (recursively).
+ * @param source   Mount point the units come from (libsystemd_service::source), or NULL.
  * @param services Registry to append parsed units to (must already be allocated).
  *
  * @retval 0       @p dir_path was scanned (possibly zero units were found/parsed).
@@ -4146,7 +4364,7 @@ dmod_libsystemd_api_declaration(1.0, int, _parse_file, ( const char* file_path,
  *       skipped, exactly like a unit file that fails to parse - one bad
  *       subdirectory must not abort the whole scan.
  */
-static int libsystemd_parse_dir_walk(const char* dir_path, libsystemd_services_t services)
+static int libsystemd_parse_dir_walk(const char* dir_path, const char* source, libsystemd_services_t services)
 {
     void* dir = Dmod_OpenDir(dir_path);
     if (dir == NULL)
@@ -4168,7 +4386,7 @@ static int libsystemd_parse_dir_walk(const char* dir_path, libsystemd_services_t
             char* sub_dir_path = libsystemd_join_path(dir_path, entry->name);
             if (sub_dir_path != NULL)
             {
-                int result = libsystemd_parse_dir_walk(sub_dir_path, services);
+                int result = libsystemd_parse_dir_walk(sub_dir_path, source, services);
                 if (result != 0)
                 {
                     DMOD_LOG_WARN("Failed to scan units subdirectory '%s' (%d)\n", sub_dir_path, result);
@@ -4195,9 +4413,12 @@ static int libsystemd_parse_dir_walk(const char* dir_path, libsystemd_services_t
                 {
                     tmpl->prefix = prefix;
                     tmpl->dir_path = Dmod_StrDup(dir_path);
-                    if (tmpl->dir_path == NULL || !dmlist_push_back(services->templates, tmpl))
+                    tmpl->source = (source != NULL) ? Dmod_StrDup(source) : NULL;
+                    if (tmpl->dir_path == NULL || (source != NULL && tmpl->source == NULL) ||
+                        !dmlist_push_back(services->templates, tmpl))
                     {
                         Dmod_Free(tmpl->dir_path);
+                        Dmod_Free(tmpl->source);
                         Dmod_Free(tmpl);
                     }
                     else
@@ -4214,7 +4435,7 @@ static int libsystemd_parse_dir_walk(const char* dir_path, libsystemd_services_t
                     char* template_path = (kind == LIBSYSTEMD_UNIT_INSTANCE) ? libsystemd_build_template_path(dir_path, prefix) : NULL;
 
                     libsystemd_service_t service = NULL;
-                    int result = libsystemd_parse_unit_internal(file_path, template_path, prefix, instance, &service);
+                    int result = libsystemd_parse_unit_internal(file_path, template_path, prefix, instance, source, &service);
                     if (result == 0)
                     {
                         service->unit_name = libsystemd_make_unit_name(entry->name);
@@ -4295,6 +4516,23 @@ static int libsystemd_parse_dir_walk(const char* dir_path, libsystemd_services_t
  * @endcode
  */
 dmod_libsystemd_api_declaration(1.0, int, _parse_dir, ( const char* dir_path, libsystemd_services_t* services ))
+{
+    return libsystemd_parse_dir_from(dir_path, NULL, services);
+}
+
+/**
+ * @brief libsystemd_parse_dir() for the units of a mount point's configuration directory
+ *
+ * Every unit and template parsed gets @p source (see libsystemd_service::source),
+ * which `%m` expands to.
+ *
+ * @param dir_path Directory to scan, recursively.
+ * @param source   Mount point the units come from, or NULL.
+ * @param services Receives the newly allocated registry on success (must not be NULL).
+ *
+ * @return As libsystemd_parse_dir().
+ */
+static int libsystemd_parse_dir_from(const char* dir_path, const char* source, libsystemd_services_t* services)
 {
     if (dir_path == NULL || services == NULL)
     {
@@ -4315,7 +4553,7 @@ dmod_libsystemd_api_declaration(1.0, int, _parse_dir, ( const char* dir_path, li
         return -ENOMEM;
     }
 
-    int result = libsystemd_parse_dir_walk(dir_path, new_services);
+    int result = libsystemd_parse_dir_walk(dir_path, source, new_services);
     if (result != 0)
     {
         libsystemd_destroy_services(new_services);
@@ -4327,3 +4565,460 @@ dmod_libsystemd_api_declaration(1.0, int, _parse_dir, ( const char* dir_path, li
     return 0;
 }
 
+// ============================================================================
+//                Configuration directories of mount points
+// ============================================================================
+
+/**
+ * @brief Build "<mount point>/cfg/<sub_dir>" (see LIBSYSTEMD_CONFIG_DIR_NAME)
+ *
+ * @return Newly heap-allocated path, owned by the caller, or NULL if allocation failed.
+ */
+static char* libsystemd_config_dir_path(const char* mount_point, const char* sub_dir)
+{
+    char* config_dir = libsystemd_join_path(mount_point, LIBSYSTEMD_CONFIG_DIR_NAME);
+    if (config_dir == NULL)
+    {
+        return NULL;
+    }
+
+    char* path = libsystemd_join_path(config_dir, sub_dir);
+    Dmod_Free(config_dir);
+
+    return path;
+}
+
+/**
+ * @brief Whether two paths name the same directory, trailing '/' aside
+ */
+static bool libsystemd_same_path(const char* path1, const char* path2)
+{
+    size_t len1 = strlen(path1);
+    size_t len2 = strlen(path2);
+    while (len1 > 1 && path1[len1 - 1] == '/')
+    {
+        len1--;
+    }
+    while (len2 > 1 && path2[len2 - 1] == '/')
+    {
+        len2--;
+    }
+
+    return len1 == len2 && strncmp(path1, path2, len1) == 0;
+}
+
+/**
+ * @brief dmlist_find() comparator matching a `char*` entry by its text
+ */
+static int libsystemd_compare_string(const void* data1, const void* data2)
+{
+    return strcmp((const char*)data1, (const char*)data2);
+}
+
+/**
+ * @brief dmlist_remove() comparator matching an entry by its address
+ */
+static int libsystemd_compare_pointer(const void* data1, const void* data2)
+{
+    return (data1 == data2) ? 0 : 1;
+}
+
+/**
+ * @brief Whether something comes from the configuration directory of @p mount_point
+ *
+ * @param source A libsystemd_service::source / libsystemd_template_t::source / libsystemd_rule_t::source.
+ */
+static bool libsystemd_is_from(const char* source, const char* mount_point)
+{
+    return source != NULL && strcmp(source, mount_point) == 0;
+}
+
+/**
+ * @brief Add the units and templates of `<mount_point>/cfg/services` to @ref g_services, without starting them
+ *
+ * A unit or template whose name is taken already - by the units directory of
+ * libsystemd_scan() or by a mount point loaded before - is logged and ignored:
+ * the first one stays.
+ *
+ * @retval 0       The directory was read (possibly with no units in it).
+ * @retval -ENOENT There is no such directory.
+ * @retval -ENOMEM Allocation failed (some units may have been added).
+ */
+static int libsystemd_merge_config_dir_units(const char* mount_point)
+{
+    char* units_dir = libsystemd_config_dir_path(mount_point, "services");
+    if (units_dir == NULL)
+    {
+        return -ENOMEM;
+    }
+
+    libsystemd_services_t parsed = NULL;
+    int result = libsystemd_parse_dir_from(units_dir, mount_point, &parsed);
+    Dmod_Free(units_dir);
+    if (result != 0)
+    {
+        return result;
+    }
+
+    libsystemd_service_t service = (libsystemd_service_t)dmlist_pop_front(parsed->services);
+    while (service != NULL)
+    {
+        if (libsystemd_find_service(g_services, service->unit_name) != NULL)
+        {
+            DMOD_LOG_WARN("Unit '%s' of '%s' is defined already - ignored\n", service->unit_name, mount_point);
+            libsystemd_destroy_service(service);
+        }
+        else if (!dmlist_push_back(g_services->services, service))
+        {
+            libsystemd_destroy_service(service);
+            result = -ENOMEM;
+        }
+        service = (libsystemd_service_t)dmlist_pop_front(parsed->services);
+    }
+
+    libsystemd_template_t* tmpl = (libsystemd_template_t*)dmlist_pop_front(parsed->templates);
+    while (tmpl != NULL)
+    {
+        bool taken = dmlist_find(g_services->templates, tmpl->prefix, libsystemd_compare_template_by_prefix) != NULL;
+        if (taken)
+        {
+            DMOD_LOG_WARN("Template '%s@' of '%s' is defined already - ignored\n", tmpl->prefix, mount_point);
+        }
+        if (taken || !dmlist_push_back(g_services->templates, tmpl))
+        {
+            result = taken ? result : -ENOMEM;
+            Dmod_Free(tmpl->prefix);
+            Dmod_Free(tmpl->dir_path);
+            Dmod_Free(tmpl->source);
+            Dmod_Free(tmpl);
+        }
+        tmpl = (libsystemd_template_t*)dmlist_pop_front(parsed->templates);
+    }
+
+    libsystemd_destroy_services(parsed);
+
+    return result;
+}
+
+/**
+ * @brief Add the rules of `<mount_point>/cfg/rules` to @ref g_rules
+ *
+ * @retval 0       The directory was read (possibly with no rules in it).
+ * @retval -ENOENT There is no such directory.
+ * @retval -ENOMEM Allocation failed (some rules may have been added).
+ */
+static int libsystemd_merge_config_dir_rules(const char* mount_point)
+{
+    char* rules_dir = libsystemd_config_dir_path(mount_point, "rules");
+    if (rules_dir == NULL)
+    {
+        return -ENOMEM;
+    }
+
+    dmlist_context_t* parsed = NULL;
+    int result = libsystemd_parse_rules_dir(rules_dir, mount_point, &parsed);
+    Dmod_Free(rules_dir);
+    if (result != 0)
+    {
+        return result;
+    }
+
+    if (g_rules == NULL)
+    {
+        g_rules = parsed;
+        return 0;
+    }
+
+    libsystemd_rule_t* rule = (libsystemd_rule_t*)dmlist_pop_front(parsed);
+    while (rule != NULL)
+    {
+        if (!dmlist_push_back(g_rules, rule))
+        {
+            Dmod_Free(rule->class_name);
+            Dmod_Free(rule->start_template);
+        Dmod_Free(rule->remove_template);
+            Dmod_Free(rule->source);
+            Dmod_Free(rule);
+            result = -ENOMEM;
+        }
+        rule = (libsystemd_rule_t*)dmlist_pop_front(parsed);
+    }
+    dmlist_destroy(parsed);
+
+    return result;
+}
+
+/**
+ * @brief Add the units of every loaded configuration directory again - after libsystemd_scan() replaced @ref g_services
+ */
+static void libsystemd_merge_config_dirs_units(void)
+{
+    size_t count = (g_config_dirs != NULL) ? dmlist_size(g_config_dirs) : 0;
+    for (size_t i = 0; i < count; i++)
+    {
+        libsystemd_merge_config_dir_units((const char*)dmlist_get(g_config_dirs, i));
+    }
+}
+
+/**
+ * @brief Add the rules of every loaded configuration directory again - after libsystemd_load_rules() replaced @ref g_rules
+ */
+static void libsystemd_merge_config_dirs_rules(void)
+{
+    size_t count = (g_config_dirs != NULL) ? dmlist_size(g_config_dirs) : 0;
+    for (size_t i = 0; i < count; i++)
+    {
+        libsystemd_merge_config_dir_rules((const char*)dmlist_get(g_config_dirs, i));
+    }
+}
+
+/**
+ * @brief Start the units of one configuration directory, in their dependency order
+ *
+ * Their starting_order is resolved against the whole registry (a unit may come
+ * after one of the firmware's), but the registry itself is not reordered - this
+ * may run while libsystemd_scan() is walking it (see libsystemd_add_config_dir()).
+ *
+ * @param mount_point Mount point whose units are started.
+ */
+static void libsystemd_start_config_dir_services(const char* mount_point)
+{
+    dmlist_context_t* to_start = dmlist_create();
+    if (to_start == NULL)
+    {
+        return;
+    }
+
+    libsystemd_lock();
+    libsystemd_resolve_starting_order(g_services->services);
+    size_t count = dmlist_size(g_services->services);
+    for (size_t i = 0; i < count; i++)
+    {
+        libsystemd_service_t service = (libsystemd_service_t)dmlist_get(g_services->services, i);
+        if (libsystemd_is_from(service->source, mount_point) && !dmlist_push_back(to_start, service))
+        {
+            DMOD_LOG_WARN("Cannot start service '%s' - out of memory\n", service->unit_name);
+        }
+    }
+    libsystemd_unlock();
+
+    dmlist_sort(to_start, libsystemd_compare_by_starting_order);
+    dmlist_foreach(to_start, libsystemd_start_service_visitor, NULL);
+    dmlist_destroy(to_start);
+}
+
+/**
+ * @brief Free every entry of @ref g_config_dirs and the list itself
+ */
+static void libsystemd_destroy_config_dirs(void)
+{
+    if (g_config_dirs == NULL)
+    {
+        return;
+    }
+
+    char* mount_point = (char*)dmlist_pop_front(g_config_dirs);
+    while (mount_point != NULL)
+    {
+        Dmod_Free(mount_point);
+        mount_point = (char*)dmlist_pop_front(g_config_dirs);
+    }
+    dmlist_destroy(g_config_dirs);
+    g_config_dirs = NULL;
+}
+
+/**
+ * @brief Load the configuration directory of a mount point
+ *
+ * A mount point may have a configuration directory with the same layout as the
+ * firmware's own: units in `<mount_point>/cfg/services` and device rules in
+ * `<mount_point>/cfg/rules`. They are added to what libsystemd_scan() and
+ * libsystemd_load_rules() loaded - nothing is reloaded or restarted - and the
+ * new units are started, in their dependency order. A unit or template whose
+ * name is taken already is logged and ignored: the first one stays.
+ *
+ * In every unit of the directory, `%m` expands to @p mount_point (without a
+ * trailing '/'), so a unit can name the module and the files on its own file
+ * system: `exec=%m/bin/app.dmfc`, `args=%m/views/app/app.dmv`. Units and
+ * template instances started from it keep that binding, and
+ * libsystemd_remove_config_dir() stops exactly them - even with several cards
+ * carrying the same module.
+ *
+ * Called by the _mount_changed dif when a file system is mounted (libsystemd
+ * does not depend on dmvfs). The configuration directory of the root file system
+ * is the units directory of libsystemd_scan() itself, so it is not loaded twice.
+ * Safe to call from a unit libsystemd_scan() is starting: the units already
+ * there keep their place, the new ones are appended.
+ *
+ * @param mount_point Mount point of the file system (e.g. "/mnt/SD").
+ *
+ * @retval 0         Loaded.
+ * @retval -EINVAL   @p mount_point is NULL.
+ * @retval -EALREADY Loaded already, or it is the units directory of libsystemd_scan().
+ * @retval -ENOENT   Neither `cfg/services` nor `cfg/rules` is there - nothing is loaded.
+ * @retval -ENOMEM   Allocation failed.
+ *
+ * @note Like the rest of this module, not serialized against other calls into it.
+ */
+static int libsystemd_add_config_dir(const char* mount_point)
+{
+    if (mount_point == NULL)
+    {
+        return -EINVAL;
+    }
+
+    int result = libsystemd_serviceapi_init();
+    if (result != 0)
+    {
+        return result;
+    }
+
+    char* units_dir = libsystemd_config_dir_path(mount_point, "services");
+    if (units_dir == NULL)
+    {
+        return -ENOMEM;
+    }
+
+    libsystemd_lock();
+    bool is_scanned = g_units_dir != NULL && libsystemd_same_path(units_dir, g_units_dir);
+    Dmod_Free(units_dir);
+    if (is_scanned || (g_config_dirs != NULL && dmlist_find(g_config_dirs, mount_point, libsystemd_compare_string) != NULL))
+    {
+        libsystemd_unlock();
+        return -EALREADY;
+    }
+
+    if (g_config_dirs == NULL && (g_config_dirs = dmlist_create()) == NULL)
+    {
+        libsystemd_unlock();
+        return -ENOMEM;
+    }
+    char* entry = Dmod_StrDup(mount_point);
+    if (entry == NULL || !dmlist_push_back(g_config_dirs, entry))
+    {
+        libsystemd_unlock();
+        Dmod_Free(entry);
+        return -ENOMEM;
+    }
+
+    int units_result = libsystemd_merge_config_dir_units(entry);
+    int rules_result = libsystemd_merge_config_dir_rules(entry);
+    if (units_result == -ENOENT && rules_result == -ENOENT)
+    {
+        dmlist_remove(g_config_dirs, entry, libsystemd_compare_pointer);
+        libsystemd_unlock();
+        Dmod_Free(entry);
+        return -ENOENT;
+    }
+    libsystemd_unlock();
+
+    DMOD_LOG_INFO("Loaded the configuration directory of '%s'\n", entry);
+
+    libsystemd_start_config_dir_services(entry);
+
+    // Its rules may match devices reported before.
+    libsystemd_replay_pending_devices();
+
+    return (units_result == -ENOMEM || rules_result == -ENOMEM) ? -ENOMEM : 0;
+}
+
+/**
+ * @brief Unload the configuration directory of a mount point
+ *
+ * Stops (gracefully, so this may block for up to their stop_timeout_ms) and
+ * removes every unit that came from the configuration directory of
+ * @p mount_point - template instances too - and removes its templates and
+ * rules. What came from anywhere else stays as it is.
+ *
+ * Called by the _mount_changed dif before @p mount_point is unmounted: the
+ * units stop while their files are still there.
+ *
+ * @param mount_point Mount point given to libsystemd_add_config_dir().
+ *
+ * @retval 0       Unloaded.
+ * @retval -EINVAL @p mount_point is NULL.
+ * @retval -ENOENT Its configuration directory is not loaded.
+ *
+ * @note Like the rest of this module, not serialized against other calls into it.
+ */
+static int libsystemd_remove_config_dir(const char* mount_point)
+{
+    if (mount_point == NULL)
+    {
+        return -EINVAL;
+    }
+
+    dmlist_context_t* removed = dmlist_create();
+    if (removed == NULL)
+    {
+        return -ENOMEM;
+    }
+
+    libsystemd_lock();
+    char* entry = (g_config_dirs != NULL) ? (char*)dmlist_find(g_config_dirs, mount_point, libsystemd_compare_string) : NULL;
+    if (entry == NULL)
+    {
+        libsystemd_unlock();
+        dmlist_destroy(removed);
+        return -ENOENT;
+    }
+    dmlist_remove(g_config_dirs, entry, libsystemd_compare_pointer);
+
+    DMOD_LOG_INFO("Unloading the configuration directory of '%s'\n", entry);
+
+    if (g_services != NULL)
+    {
+        // Backwards: the units started last stop first. Taken out of the registry
+        // here, stopped below - outside the lock (see g_registry_lock).
+        for (size_t i = dmlist_size(g_services->services); i-- > 0; )
+        {
+            libsystemd_service_t service = (libsystemd_service_t)dmlist_get(g_services->services, i);
+            if (libsystemd_is_from(service->source, entry) && dmlist_push_back(removed, service))
+            {
+                dmlist_remove_at(g_services->services, i);
+            }
+        }
+
+        for (size_t i = dmlist_size(g_services->templates); i-- > 0; )
+        {
+            libsystemd_template_t* tmpl = (libsystemd_template_t*)dmlist_get(g_services->templates, i);
+            if (!libsystemd_is_from(tmpl->source, entry))
+            {
+                continue;
+            }
+            dmlist_remove_at(g_services->templates, i);
+            Dmod_Free(tmpl->prefix);
+            Dmod_Free(tmpl->dir_path);
+            Dmod_Free(tmpl->source);
+            Dmod_Free(tmpl);
+        }
+    }
+
+    for (size_t i = (g_rules != NULL) ? dmlist_size(g_rules) : 0; i-- > 0; )
+    {
+        libsystemd_rule_t* rule = (libsystemd_rule_t*)dmlist_get(g_rules, i);
+        if (!libsystemd_is_from(rule->source, entry))
+        {
+            continue;
+        }
+        dmlist_remove_at(g_rules, i);
+        Dmod_Free(rule->class_name);
+        Dmod_Free(rule->start_template);
+        Dmod_Free(rule->remove_template);
+        Dmod_Free(rule->source);
+        Dmod_Free(rule);
+    }
+    libsystemd_unlock();
+    Dmod_Free(entry);
+
+    libsystemd_service_t service = (libsystemd_service_t)dmlist_pop_front(removed);
+    while (service != NULL)
+    {
+        libsystemd_stop_all_services_visitor(service, NULL);
+        libsystemd_destroy_service(service);
+        service = (libsystemd_service_t)dmlist_pop_front(removed);
+    }
+    dmlist_destroy(removed);
+
+    return 0;
+}
diff --git a/app/libsystemd/tests/fixtures/mount_a/cfg/rules/devices.rules b/app/libsystemd/tests/fixtures/mount_a/cfg/rules/devices.rules
new file mode 100644
index 0000000..4adea0b
--- /dev/null
+++ b/app/libsystemd/tests/fixtures/mount_a/cfg/rules/devices.rules
@@ -0,0 +1,2 @@
+[class=mountdev]
+start=tool@%name
diff --git a/app/libsystemd/tests/fixtures/mount_a/cfg/services/mounted.ini b/app/libsystemd/tests/fixtures/mount_a/cfg/services/mounted.ini
new file mode 100644
index 0000000..114acbc
--- /dev/null
+++ b/app/libsystemd/tests/fixtures/mount_a/cfg/services/mounted.ini
@@ -0,0 +1,7 @@
+# A unit of a mount point's configuration directory (libsystemd_add_config_dir()):
+# started when it is loaded (dmtestplain is a library module, so "started" is
+# visible as the module being enabled), stopped when it is unloaded. %m is the
+# mount point it comes from.
+description=from %m
+exec=dmtestplain
+type=library
diff --git a/app/libsystemd/tests/fixtures/mount_a/cfg/services/tool@.ini b/app/libsystemd/tests/fixtures/mount_a/cfg/services/tool@.ini
new file mode 100644
index 0000000..01514d7
--- /dev/null
+++ b/app/libsystemd/tests/fixtures/mount_a/cfg/services/tool@.ini
@@ -0,0 +1,4 @@
+# A template of a mount point: an instance started by a device rule of the same
+# directory keeps its mount point (%m) and goes away with it.
+description=%m %i
+exec=dmtool
diff --git a/app/libsystemd/tests/fixtures/mount_b/cfg/services/mounted.ini b/app/libsystemd/tests/fixtures/mount_b/cfg/services/mounted.ini
new file mode 100644
index 0000000..492aeea
--- /dev/null
+++ b/app/libsystemd/tests/fixtures/mount_b/cfg/services/mounted.ini
@@ -0,0 +1,4 @@
+# Same name as mount_a's: the unit loaded first stays, this one is ignored.
+description=from %m
+exec=dmtestplain
+type=library
diff --git a/app/libsystemd/tests/fixtures/mount_empty/.keep b/app/libsystemd/tests/fixtures/mount_empty/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/app/libsystemd/tests/fixtures/mount_root/cfg/services/rootunit.ini b/app/libsystemd/tests/fixtures/mount_root/cfg/services/rootunit.ini
new file mode 100644
index 0000000..63f1547
--- /dev/null
+++ b/app/libsystemd/tests/fixtures/mount_root/cfg/services/rootunit.ini
@@ -0,0 +1,3 @@
+# Scanned by libsystemd_scan() as the units directory: the configuration
+# directory of its mount point must not be loaded a second time.
+exec=dmroot
diff --git a/app/libsystemd/tests/libsystemd_test.c b/app/libsystemd/tests/libsystemd_test.c
index a999a8b..90371d6 100644
--- a/app/libsystemd/tests/libsystemd_test.c
+++ b/app/libsystemd/tests/libsystemd_test.c
@@ -1109,3 +1109,126 @@ DMOD_TEST_STEP(a_rule_with_only_remove_runs_on_removal_only)
     DMOD_TEST_EXPECT_NOT_NULL(description_of("gone@x"));
     DMOD_TEST_EXPECT_EQ(strcmp(description_of("gone@x"), "gone /value"), 0);
 }
+
+/*
+ * Configuration directories of mount points: a mount loads <mount point>/cfg/services and <mount point>/cfg/rules, an
+ * unmount drops them. The fixture directories tests/fixtures/mount_a, mount_b, ... stand for mounted file systems
+ * (their paths are the mount points): mount_a and mount_b have cfg/services (and mount_a cfg/rules), mount_empty
+ * has no cfg/ at all. Every step unmounts what it mounted - dmod_test_setup() rescans the examples, which keeps
+ * loaded configuration directories.
+ */
+#define LIBSYSTEMD_MOUNT_A      LIBSYSTEMD_TEST_FIXTURES_DIR "/mount_a"
+#define LIBSYSTEMD_MOUNT_B      LIBSYSTEMD_TEST_FIXTURES_DIR "/mount_b"
+#define LIBSYSTEMD_MOUNT_EMPTY  LIBSYSTEMD_TEST_FIXTURES_DIR "/mount_empty"
+#define LIBSYSTEMD_MOUNT_ROOT   LIBSYSTEMD_TEST_FIXTURES_DIR "/mount_root"
+
+static int count_units(void)
+{
+    unit_summary_t summary = { 0 };
+    libsystemd_list(count_units_visitor, &summary);
+    return summary.count;
+}
+
+DMOD_TEST_STEP(a_mount_without_cfg_changes_nothing)
+{
+    int units = count_units();
+    call_mount_changed(LIBSYSTEMD_MOUNT_EMPTY, true);
+    DMOD_TEST_EXPECT_EQ(count_units(), units);
+    call_mount_changed(LIBSYSTEMD_MOUNT_EMPTY, false);
+    DMOD_TEST_EXPECT_EQ(count_units(), units);
+}
+
+DMOD_TEST_STEP(mount_adds_starts_and_unmount_removes_the_units_of_cfg_services)
+{
+    int units = count_units();
+    DMOD_TEST_EXPECT_FALSE(Dmod_IsModuleEnabled("dmtestplain"));
+
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, true);
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, true);       // reported twice: loaded once
+
+    // Added to the units there were (the template is not a unit), and started
+    DMOD_TEST_EXPECT_EQ(count_units(), units + 1);
+    libsystemd_service_status_t status;
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("mounted", &status), 0);
+    DMOD_TEST_EXPECT_EQ(status.state, DMOSI_PROCESS_STATE_RUNNING);
+    DMOD_TEST_EXPECT_TRUE(Dmod_IsModuleEnabled("dmtestplain"));
+
+    // %m is the mount point
+    DMOD_TEST_EXPECT_NOT_NULL(description_of("mounted"));
+    DMOD_TEST_EXPECT_EQ(strcmp(description_of("mounted"), "from " LIBSYSTEMD_MOUNT_A), 0);
+
+    // Unmounted: stopped and gone, the rest untouched
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, false);
+    DMOD_TEST_EXPECT_FALSE(Dmod_IsModuleEnabled("dmtestplain"));
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("mounted", &status), -ENOENT);
+    DMOD_TEST_EXPECT_EQ(count_units(), units);
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("networking", &status), 0);
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, false);      // again: nothing to do
+    DMOD_TEST_EXPECT_EQ(count_units(), units);
+}
+
+DMOD_TEST_STEP(a_unit_of_two_mount_points_stays_the_first_one)
+{
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, true);
+    call_mount_changed(LIBSYSTEMD_MOUNT_B, true);
+
+    DMOD_TEST_EXPECT_EQ(strcmp(description_of("mounted"), "from " LIBSYSTEMD_MOUNT_A), 0);
+
+    // mount_b's copy was never loaded, so unmounting mount_b leaves mount_a's
+    call_mount_changed(LIBSYSTEMD_MOUNT_B, false);
+    libsystemd_service_status_t status;
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("mounted", &status), 0);
+    DMOD_TEST_EXPECT_EQ(status.state, DMOSI_PROCESS_STATE_RUNNING);
+
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, false);
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("mounted", &status), -ENOENT);
+}
+
+DMOD_TEST_STEP(rules_of_a_mount_point_start_instances_bound_to_it)
+{
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, true);
+
+    // mount_a's rule, mount_a's template ("dmtool" is not loadable: the
+    // instance is registered, its start fails)
+    libsystemd_notify_device_added("mountdev", "dev1", NULL);
+    libsystemd_service_status_t status;
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("tool@dev1", &status), 0);
+    DMOD_TEST_EXPECT_NOT_NULL(description_of("tool@dev1"));
+    DMOD_TEST_EXPECT_EQ(strcmp(description_of("tool@dev1"), LIBSYSTEMD_MOUNT_A " dev1"), 0);
+
+    // The instance, the template and the rule go away with the unmount
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, false);
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("tool@dev1", &status), -ENOENT);
+    DMOD_TEST_EXPECT_EQ(libsystemd_start_service("tool@dev2", NULL), -ENOENT);
+    libsystemd_notify_device_added("mountdev", "dev3", NULL);
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("tool@dev3", &status), -ENOENT);
+
+    libsystemd_notify_device_removed("mountdev", "dev1");
+    libsystemd_notify_device_removed("mountdev", "dev3");
+}
+
+DMOD_TEST_STEP(the_cfg_of_a_mount_point_survives_a_full_reload)
+{
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, true);
+
+    DMOD_TEST_EXPECT_EQ(libsystemd_scan(LIBSYSTEMD_EXAMPLES_DIR), 0);
+    DMOD_TEST_EXPECT_EQ(libsystemd_load_rules(LIBSYSTEMD_TEST_FIXTURES_DIR "/rules"), 0);
+
+    libsystemd_service_status_t status;
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("mounted", &status), 0);
+    DMOD_TEST_EXPECT_EQ(status.state, DMOSI_PROCESS_STATE_RUNNING);
+    libsystemd_notify_device_added("mountdev", "dev4", NULL);
+    DMOD_TEST_EXPECT_EQ(libsystemd_status("tool@dev4", &status), 0);
+
+    call_mount_changed(LIBSYSTEMD_MOUNT_A, false);
+    libsystemd_notify_device_removed("mountdev", "dev4");
+}
+
+DMOD_TEST_STEP(the_scanned_units_directory_is_not_loaded_twice_as_a_mount)
+{
+    DMOD_TEST_EXPECT_EQ(libsystemd_scan(LIBSYSTEMD_MOUNT_ROOT "/cfg/services/"), 0);
+    call_mount_changed(LIBSYSTEMD_MOUNT_ROOT, true);
+    DMOD_TEST_EXPECT_EQ(count_units(), 1);
+    call_mount_changed(LIBSYSTEMD_MOUNT_ROOT, false);
+    DMOD_TEST_EXPECT_EQ(count_units(), 1);
+}