VFS.cc

/*
 * Copyright (c) 2008-2014, Pedigree Developers
 *
 * Please see the CONTRIB file in the root of the source tree for a full
 * list of contributors.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
 
#include "VFS.h"
#include "pedigree/kernel/Atomic.h"
#include "pedigree/kernel/LockGuard.h"
#include "pedigree/kernel/Log.h"
#include "pedigree/kernel/Metrics.h"
#include "pedigree/kernel/machine/Disk.h"
#include "pedigree/kernel/syscallError.h"
#include "pedigree/kernel/utilities/Iterator.h"
#include "pedigree/kernel/utilities/StaticString.h"
#include "pedigree/kernel/utilities/StringView.h"
#include "pedigree/kernel/utilities/Vector.h"
#include "pedigree/kernel/utilities/utility.h"
 
#include "Directory.h"
#include "File.h"
#include "MemoryMappedFile.h"
#include "MountView.h"
 
#ifndef VFS_STANDALONE
#include "pedigree/kernel/process/Process.h"
#include "pedigree/kernel/process/TerminationDeferral.h"
#include "pedigree/kernel/process/Thread.h"
#include "pedigree/kernel/processor/Processor.h"
#include "pedigree/kernel/processor/ProcessorInformation.h"
 
#include "modules/Module.h"
#endif
 
class Disk;
 
struct VFS::TrackedFile {
  explicit TrackedFile(File* file) : file(file), owners(1) {}
 
  bool retain() {
    size_t count = __atomic_load_n(&owners, __ATOMIC_RELAXED);
    while (count && count != ~size_t(0)) {
      if (__atomic_compare_exchange_n(&owners, &count, count + 1, false, __ATOMIC_ACQUIRE,
                                      __ATOMIC_RELAXED)) {
        return true;
      }
    }
    return false;
  }
 
  File* const file;
  size_t owners;
  RcuPointer<TrackedFile> next;
};
 
class VfsMountState {
 public:
  VfsMountState(Filesystem* filesystem, uint32_t id) : filesystem(filesystem), id(id) {}
  ~VfsMountState() {
    storagePins.closeAndWait();
    operations.closeAndWait();
  }
 
  static uint32_t reserveId() {
    static uint32_t next = 1;
    uint32_t candidate = __atomic_load_n(&next, __ATOMIC_RELAXED);
    while (candidate <= 0x7fffffffU) {
      if (__atomic_compare_exchange_n(&next, &candidate, candidate + 1, false, __ATOMIC_RELAXED,
                                      __ATOMIC_RELAXED))
        return candidate;
    }
    return 0;
  }
 
  void retire() {
    storagePins.wait();
    operations.wait();
    filesystem = nullptr;
    retirement.beginRetirement();
    retirement.finishRetirement();
  }
 
  void finishOwnedRetirement() {
    // Both gates are already closed. Once observed drained, neither can gain
    // another owner; one releasing caller performs retirement without waiting.
    if (!ownedRetirement || !storagePins.isClosedAndDrained() || !operations.isClosedAndDrained() ||
        !retirementClaimed.compareAndSwap(false, true))
      return;
#if THREADS && !defined(VFS_STANDALONE)
    TerminationDeferral lifetime;
#endif
    Filesystem* retired = filesystem;
    filesystem = nullptr;
    retirement.beginRetirement();
    retirement.finishRetirement();
    delete retired;
  }
 
  Atomic<bool> ownedRetirement{false};
  Atomic<bool> retirementClaimed{false};
  Filesystem* filesystem;
  const uint32_t id;
  OperationBarrier operations;
  OperationBarrier storagePins;
  InodeEventSource retirement;
};
 
class VfsFilesystemPin {
 public:
  ~VfsFilesystemPin() {
#if THREADS && !defined(VFS_STANDALONE)
    TerminationDeferral lifetime;
#endif
    auto retained = pedigree_std::move(state);
    admission = OperationBarrier::Lease();
    if (retained)
      retained->finishOwnedRetirement();
  }
  // Release admission before the state that owns its barrier. Copies of the
  // outer pin may survive registry shutdown and do not need fresh admission.
  SharedPointer<VfsMountState> state;
  OperationBarrier::Lease admission;
};
 
VFS::FilesystemPin::FilesystemPin() = default;
VFS::FilesystemPin::FilesystemPin(const FilesystemPin& other) = default;
VFS::FilesystemPin::FilesystemPin(FilesystemPin&& other) noexcept = default;
VFS::FilesystemPin::~FilesystemPin() {
  reset();
}
VFS::FilesystemPin& VFS::FilesystemPin::operator=(const FilesystemPin& other) {
  if (this != &other) {
    auto replacement = other.m_Pin;
    auto retired = pedigree_std::move(m_Pin);
    m_Pin = pedigree_std::move(replacement);
  }
  return *this;
}
VFS::FilesystemPin& VFS::FilesystemPin::operator=(FilesystemPin&& other) noexcept {
  if (this != &other) {
    auto retired = pedigree_std::move(m_Pin);
    m_Pin = pedigree_std::move(other.m_Pin);
  }
  return *this;
}
 
Filesystem* VFS::FilesystemPin::filesystem() const {
  return m_Pin ? m_Pin->state->filesystem : nullptr;
}
 
VFS::MountIdentity VFS::FilesystemPin::identity() const {
  MountIdentity identity;
  if (m_Pin)
    identity.m_State = m_Pin->state;
  return identity;
}
 
VFS::FilesystemPin::operator bool() const {
  return static_cast<bool>(m_Pin);
}
 
void VFS::FilesystemPin::reset() {
  auto retired = pedigree_std::move(m_Pin);
}
 
bool VFS::MountIdentity::pin(FilesystemPin& pin) const {
  pin.reset();
  auto retained = SharedPointer<VfsFilesystemPin>::tryAllocate();
  if (!retained || !m_State || !m_State->storagePins.tryAcquire(retained->admission))
    return false;
  retained->state = m_State;
  pin.m_Pin = pedigree_std::move(retained);
  return true;
}
 
bool VFS::pinFilesystem(Filesystem* key, FilesystemPin& pin) const {
  pin.reset();
  auto retained = SharedPointer<VfsFilesystemPin>::tryAllocate();
  if (!retained)
    return false;
  {
    LockGuard<Mutex> guard(m_MountTableLock);
    MountInfo* info = m_Mounts.lookup(key);
    if (!info || !info->state->storagePins.tryAcquire(retained->admission))
      return false;
    retained->state = info->state;
  }
  pin.m_Pin = pedigree_std::move(retained);
  return true;
}
 
VFS::MountIdentity::MountIdentity() = default;
VFS::MountIdentity::MountIdentity(const MountIdentity& other) = default;
VFS::MountIdentity::MountIdentity(MountIdentity&& other) noexcept = default;
VFS::MountIdentity::~MountIdentity() = default;
VFS::MountIdentity& VFS::MountIdentity::operator=(const MountIdentity& other) = default;
VFS::MountIdentity& VFS::MountIdentity::operator=(MountIdentity&& other) noexcept = default;
 
VFS::MountInfo::MountInfo(const String& stableName, const String& path,
                          const SharedPointer<VfsMountState>& state)
    : stableName(stableName), path(path), state(state) {}
VFS::MountInfo::~MountInfo() = default;
 
uint32_t VFS::MountIdentity::id() const {
  return m_State ? m_State->id : 0;
}
 
VFS::MountIdentity::operator bool() const {
  return static_cast<bool>(m_State);
}
 
bool VFS::MountIdentity::acquire(MountOperation& operation) const {
  operation.reset();
  if (!m_State || !m_State->operations.tryAcquire(operation.m_Admission))
    return false;
  operation.m_State = m_State;
  return true;
}
 
bool VFS::MountIdentity::subscribeRetirement(const SharedPointer<FileEventObserver>& observer,
                                             FileEventSubscription& subscription) const {
  if (!m_State) {
    subscription.reset();
    return false;
  }
  return m_State->retirement.subscribeFileEvents(FileEvents::SourceRetired, observer, subscription);
}
 
VFS::MountOperation::MountOperation() = default;
 
VFS::MountOperation::MountOperation(MountOperation&& other) noexcept
    : m_State(pedigree_std::move(other.m_State)),
      m_Admission(pedigree_std::move(other.m_Admission)) {}
 
VFS::MountOperation::~MountOperation() {
  reset();
}
 
VFS::MountOperation& VFS::MountOperation::operator=(MountOperation&& other) noexcept {
  if (this != &other) {
    auto retired = pedigree_std::move(m_State);
    auto admission = pedigree_std::move(m_Admission);
    m_State = pedigree_std::move(other.m_State);
    m_Admission = pedigree_std::move(other.m_Admission);
    admission = OperationBarrier::Lease();
    if (retired)
      retired->finishOwnedRetirement();
  }
  return *this;
}
 
Filesystem* VFS::MountOperation::filesystem() const {
  return m_State ? m_State->filesystem : nullptr;
}
 
uint32_t VFS::MountOperation::id() const {
  return m_State ? m_State->id : 0;
}
 
VFS::MountIdentity VFS::MountOperation::identity() const {
  MountIdentity identity;
  identity.m_State = m_State;
  return identity;
}
 
VFS::MountOperation::operator bool() const {
  return static_cast<bool>(m_Admission);
}
 
void VFS::MountOperation::reset() {
  auto state = pedigree_std::move(m_State);
  m_Admission = OperationBarrier::Lease();
  if (state)
    state->finishOwnedRetirement();
}
 
bool VFS::acquireMount(Filesystem* key, MountOperation& operation) const {
  operation.reset();
  LockGuard<Mutex> guard(m_MountTableLock);
  MountInfo* info = m_Mounts.lookup(key);
  if (!info || !info->state->operations.tryAcquire(operation.m_Admission))
    return false;
  operation.m_State = info->state;
  return true;
}
 
 
VFS VFS::m_Instance;
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
VFS::RetainTrackedFileHook VFS::m_RetainTrackedFileHook = nullptr;
#endif
 
VFS& VFS::instance() {
  return m_Instance;
}
 
VFS::VFS()
    : m_PathMutationLock(),
      m_PathGeneration(0),
      m_MountView(nullptr),
      m_MountMutationLock(),
      m_MountTableLock(),
      m_pRootFilesystem(nullptr),
      m_Mounts(),
      m_ProbeCallbacks(),
      m_MountCallbacks()
#if THREADS
      ,
      m_CallbackLock(),
      m_NextCallbackSequence(1),
      m_pActiveCallbacks(nullptr),
      m_CallbacksClosing(false)
#endif
{
}
 
VFS::~VFS() {
#if THREADS
  TerminationDeferral teardownDeferral;
#endif
#if THREADS
  m_CallbackLock.acquire();
  m_CallbacksClosing = true;
  if (m_pActiveCallbacks) {
    m_CallbackLock.release();
    FATAL("VFS destroyed with an active callback invocation");
  }
  for (auto item : m_ProbeCallbacks) {
    if (item->state.inFlight || item->state.removers) {
      m_CallbackLock.release();
      FATAL("VFS destroyed before probe callback retirement completed");
    }
  }
  for (auto item : m_MountCallbacks) {
    if (item->state.inFlight || item->state.removers) {
      m_CallbackLock.release();
      FATAL("VFS destroyed before mount callback retirement completed");
    }
  }
  m_CallbackLock.release();
#endif
 
  // Wipe out probe callbacks we know about.
  for (auto it = m_ProbeCallbacks.begin(); it != m_ProbeCallbacks.end(); ++it) {
    delete *it;
  }
  for (auto it = m_MountCallbacks.begin(); it != m_MountCallbacks.end(); ++it) {
    delete *it;
  }
 
  // The view's inert paths must drain before backend storage-pin retirement.
  delete m_MountView;
  m_MountView = nullptr;
 
  Vector<MountInfo*> mountInfo;
  Vector<Filesystem*> filesystems;
  {
    LockGuard<Mutex> mutationGuard(m_MountMutationLock);
    LockGuard<Mutex> tableGuard(m_MountTableLock);
    for (auto it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
      it.value()->state->storagePins.close();
      it.value()->state->operations.close();
      mountInfo.pushBack(it.value());
      filesystems.pushBack(it.key());
    }
    m_Mounts.clear();
    m_pRootFilesystem = nullptr;
  }
 
  // Filesystem destructors can re-enter VFS, so publication locks must no
  // longer be held when ownership is released.
  for (auto info : mountInfo) {
    info->state->retire();
    delete info;
  }
  for (auto filesystem : filesystems) {
    delete filesystem;
  }
 
  TrackedFile* remaining[TrackedFileBuckets] = {};
  bool reclaim = false;
  {
    LockGuard<Mutex> guard(m_TrackedFilesLock);
    for (size_t bucket = 0; bucket < TrackedFileBuckets; ++bucket) {
      remaining[bucket] = m_TrackedFiles[bucket].exchange(nullptr);
      reclaim |= remaining[bucket] != nullptr;
    }
  }
  if (reclaim) {
    Rcu::synchronize();
    for (auto* entry : remaining) {
      while (entry) {
        TrackedFile* next = entry->next.loadForUpdate();
        delete entry;
        entry = next;
      }
    }
  }
}
 
bool VFS::mount(Disk* pDisk, String& stableName, Filesystem** pMountedFs) {
#if THREADS
  TerminationDeferral dispatchDeferral;
#endif
  DiskUse diskUse;
  if (pDisk && !pDisk->acquireUse(diskUse))
    return false;
#if THREADS
  Thread* current = Processor::information().getCurrentThread();
  void* owner =
      current ? static_cast<void*>(current) : static_cast<void*>(&Processor::information());
  size_t boundary = 0;
  m_CallbackLock.acquire();
  boundary = m_NextCallbackSequence;
  m_CallbackLock.release();
 
  size_t afterSequence = 0;
  while (true) {
    ActiveInvocation invocation = {nullptr, owner, nullptr};
    ProbeCallbackItem* item = acquireProbeCallback(afterSequence, boundary, invocation);
    if (!item) {
      break;
    }
 
    Filesystem* pFs = item->callback(pDisk);
    if (pFs) {
      m_CallbackLock.acquire();
      // This is the publication commit point. Retirement which closes the
      // entry first rejects the result while the provider remains pinned;
      // commit which wins keeps the pin through every use below.
      const bool committed = item->state.enabled && !m_CallbacksClosing;
      m_CallbackLock.release();
      if (!committed) {
        // The provider must still be pinned while its rejected result is
        // destroyed; removal can only return after finishCallback below.
        delete pFs;
        finishCallback(&item->state, invocation);
        continue;
      }
 
      pFs->m_DiskUse = pedigree_std::move(diskUse);
 
      if (stableName.length() == 0) {
        stableName = pFs->getVolumeLabel();
      }
      stableName = registerFilesystem(pFs, stableName);
      if (!stableName.length()) {
        delete pFs;
        finishCallback(&item->state, invocation);
        return false;
      }
      if (bootMountView()) {
        String path;
        if (!getMountPath(pFs, path) || !attachFilesystem(getRootFilesystem(), pFs, path)) {
          unregisterFilesystem(pFs);
          finishCallback(&item->state, invocation);
          return false;
        }
      }
      dispatchMountCallbacks(owner);
 
      if (pMountedFs) {
        *pMountedFs = pFs;
      }
 
      NOTICE("mounted filesystem '" << stableName << "'");
 
      finishCallback(&item->state, invocation);
      return true;
    }
 
    finishCallback(&item->state, invocation);
  }
#else
  for (List<ProbeCallbackItem*>::Iterator it = m_ProbeCallbacks.begin();
       it != m_ProbeCallbacks.end(); it++) {
    Filesystem* pFs = (*it)->callback(pDisk);
    if (pFs) {
      pFs->m_DiskUse = pedigree_std::move(diskUse);
 
      if (stableName.length() == 0) {
        stableName = pFs->getVolumeLabel();
      }
      stableName = registerFilesystem(pFs, stableName);
 
      if (!stableName.length()) {
        delete pFs;
        return false;
      }
      if (bootMountView()) {
        String path;
        if (!getMountPath(pFs, path) || !attachFilesystem(getRootFilesystem(), pFs, path)) {
          unregisterFilesystem(pFs);
          return false;
        }
      }
 
      for (List<MountCallbackItem*>::Iterator it2 = m_MountCallbacks.begin();
           it2 != m_MountCallbacks.end(); it2++) {
        (*it2)->callback();
      }
 
      if (pMountedFs) {
        *pMountedFs = pFs;
      }
 
      NOTICE("mounted filesystem '" << stableName << "'");
 
      return true;
    }
  }
#endif
  return false;
}
 
String VFS::registerFilesystem(Filesystem* pFs, const String& preferredStableName) {
  LockGuard<Mutex> mutationGuard(m_MountMutationLock);
  return registerFilesystemLocked(pFs, preferredStableName);
}
 
String VFS::registerFilesystemLocked(Filesystem* pFs, const String& preferredStableName) {
  if (!pFs) {
    return String();
  }
  if (pFs->m_pDisk && !pFs->m_DiskUse && !pFs->m_pDisk->acquireUse(pFs->m_DiskUse))
    return String();
 
  MountInfo* info = nullptr;
  Filesystem* root = nullptr;
  {
    LockGuard<Mutex> tableGuard(m_MountTableLock);
    MountInfo* existing = m_Mounts.lookup(pFs);
    if (existing) {
      return existing->stableName;
    }
 
    String stableName = getUniqueStableNameLocked(preferredStableName);
    NormalStaticString path;
    path += "/media/";
    path += stableName;
    const uint32_t id = VfsMountState::reserveId();
    if (!id)
      return String();
    SharedPointer<VfsMountState> state(new VfsMountState(pFs, id));
    if (!state)
      return String();
    info = new MountInfo(stableName, String(path), state);
    if (!info || !m_Mounts.tryInsert(pFs, info)) {
      delete info;
      return String();
    }
    root = m_pRootFilesystem;
  }
 
  if (root && !bootMountView()) {
    attachFilesystem(root, pFs, info->path);
  }
 
  return info->stableName;
}
 
bool VFS::unregisterFilesystem(Filesystem* pFs, bool canDelete, bool terminal) {
#if THREADS
  TerminationDeferral teardownDeferral;
#endif
  if (!pFs) {
    return false;
  }
 
  MountInfo* info = nullptr;
  bool detach = false;
  {
    LockGuard<Mutex> mutationGuard(m_MountMutationLock);
    {
      LockGuard<Mutex> tableGuard(m_MountTableLock);
      info = m_Mounts.lookup(pFs);
      if (!info || !info->state->storagePins.tryCloseIfIdle()) {
        return false;
      }
      m_Mounts.take(pFs, info);
      info->state->operations.close();
 
      if (pFs == m_pRootFilesystem) {
        m_pRootFilesystem = nullptr;
      } else {
        detach = m_pRootFilesystem != nullptr;
      }
    }
 
    if (detach && !bootMountView()) {
      Directory::ChildLease pointLease;
      File* point = findRetained(info->path, pointLease);
      if (point && point->isDirectory()) {
        Directory::fromFile(point)->setReparsePoint(nullptr);
      }
    }
  }
 
  info->state->retire();
  delete info;
  if (terminal && pFs->shutdown() != Filesystem::SyncStatus::Success) {
    ERROR("Filesystem shutdown failed: " << pFs->getVolumeLabel());
    return false;
  }
  if (canDelete) {
    delete pFs;
  }
  return true;
}
 
bool VFS::retireOwnedFilesystem(Filesystem* filesystem) {
#if THREADS && !defined(VFS_STANDALONE)
  TerminationDeferral lifetime;
#endif
  if (!filesystem)
    return false;
  MountInfo* removed = nullptr;
  {
    LockGuard<Mutex> mutation(m_MountMutationLock);
    LockGuard<Mutex> table(m_MountTableLock);
    removed = m_Mounts.lookup(filesystem);
    if (!removed || filesystem == m_pRootFilesystem)
      return false;
    m_Mounts.take(filesystem, removed);
    removed->state->storagePins.close();
    removed->state->operations.close();
  }
  // Existing sync/handle operations retain the state until their admission
  // drains. Inert identities survive retirement without retaining the backend.
  auto state = removed->state;
  delete removed;
  VfsMountState* retained = state.get();
  if (!retained) {
    FATAL("Owned filesystem retirement lost its mount state.");
    return false;
  }
  retained->ownedRetirement = true;
  retained->finishOwnedRetirement();
  return true;
}
 
bool VFS::removeDiskFilesystem(Filesystem* filesystem, bool deviceAvailable) {
#if THREADS && !defined(VFS_STANDALONE)
  TerminationDeferral lifetime;
#endif
  FilesystemPin pin;
  if (!filesystem || !pinFilesystem(filesystem, pin)) {
    return false;
  }
  if (filesystem == getRootFilesystem()) {
    WARNING("VFS: root filesystem device removed");
    return filesystem->deviceRemoved(deviceAvailable);
  }
  MountInfo* removed;
  {
    LockGuard<Mutex> mutation(m_MountMutationLock);
    LockGuard<Mutex> table(m_MountTableLock);
    removed = m_Mounts.lookup(filesystem);
    if (!removed) {
      return false;
    }
    m_Mounts.take(filesystem, removed);
    removed->state->storagePins.close();
    removed->state->operations.close();
  }
  auto state = removed->state;
  VfsMountState* retained = state.get();
  if (!retained) {
    FATAL("Removed filesystem lost its mount state");
    return false;
  }
  // Stop handle/sync users before detaching, including an attachment that
  // acquired its mount admission just before the disk was withdrawn.
  retained->operations.wait();
  if (auto* view = bootMountView()) {
    if (!view->detachBackingForRemoval(filesystem)) {
      return false;
    }
  } else {
    Directory::ChildLease pointLease;
    File* point = findRetained(removed->path, pointLease);
    if (point && point->isDirectory()) {
      Directory::fromFile(point)->setReparsePoint(nullptr);
    }
  }
  delete removed;
  if (!filesystem->deviceRemoved(deviceAvailable)) {
    return false;
  }
  retained->retirement.beginRetirement();
  retained->retirement.finishRetirement();
  retained->ownedRetirement = true;
  pin.reset();
  retained->finishOwnedRetirement();
  return true;
}
 
bool VFS::setRootFilesystem(Filesystem* pFs) {
  if (bootMountView()) {
    SYSCALL_ERROR(DeviceBusy);
    return false;
  }
  LockGuard<Mutex> mutationGuard(m_MountMutationLock);
  if (pFs) {
    bool registered = false;
    {
      LockGuard<Mutex> tableGuard(m_MountTableLock);
      registered = m_Mounts.lookup(pFs) != nullptr;
    }
    if (!registered) {
      if (!registerFilesystemLocked(pFs, pFs->getVolumeLabel()).length())
        return false;
    }
  }
 
  {
    LockGuard<Mutex> tableGuard(m_MountTableLock);
    m_pRootFilesystem = pFs;
  }
  attachRegisteredFilesystemsLocked();
  return true;
}
 
Filesystem* VFS::getRootFilesystem() const {
  LockGuard<Mutex> tableGuard(m_MountTableLock);
  return m_pRootFilesystem;
}
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
VFS::HostedRootViewScope::HostedRootViewScope() : m_Vfs(VFS::instance()) {}
VFS::HostedRootViewScope::~HostedRootViewScope() {
  if (!close())
    FATAL("Hosted root view scope still has retained owners");
}
bool VFS::HostedRootViewScope::open(Filesystem* filesystem) {
  if (!filesystem || m_Filesystem)
    return false;
  auto* thread = Processor::information().getCurrentThread();
  m_PreviousContext = thread && thread->getParent()
                          ? thread->getParent()->acquireFilesystemContext()
                          : FilesystemContextRef();
  bool prepared = false;
  {
    LockGuard<Mutex> mutation(m_Vfs.m_MountMutationLock);
    {
      LockGuard<Mutex> table(m_Vfs.m_MountTableLock);
      if (m_Vfs.m_Mounts.lookup(filesystem))
        return false;
      m_PreviousRoot = m_Vfs.m_pRootFilesystem;
      m_PreviousView = m_Vfs.bootMountView();
    }
    if (m_PreviousRoot && !m_Vfs.pinFilesystem(m_PreviousRoot, m_PreviousRootPin))
      return false;
    if (!m_Vfs.registerFilesystemLocked(filesystem, String("hosted-root-fixture")).length())
      return false;
    m_Filesystem = filesystem;
    m_View = new VfsMountView(m_Vfs);
    if (m_View && m_View->initialise(filesystem)) {
      NamespaceMutation writer(m_Vfs);
      LockGuard<Mutex> table(m_Vfs.m_MountTableLock);
      m_Vfs.m_pRootFilesystem = filesystem;
      __atomic_store_n(&m_Vfs.m_MountView, m_View, __ATOMIC_RELEASE);
      m_Installed = prepared = true;
    }
  }
  if (!prepared)
    close();
  return prepared;
}
bool VFS::HostedRootViewScope::installContext(Process& process) {
  FilesystemContextOwner context;
  return m_Installed && m_View->createBootContext(context) &&
         process.installFilesystemContext(pedigree_std::move(context));
}
bool VFS::HostedRootViewScope::close() {
  {
    LockGuard<Mutex> mutation(m_Vfs.m_MountMutationLock);
    NamespaceMutation writer(m_Vfs);
    // Enrollment cannot race the final quiescence check and view restoration.
    if (m_View && !m_View->quiescentForHostedTest())
      return false;
    if (m_Installed) {
      LockGuard<Mutex> table(m_Vfs.m_MountTableLock);
      if (m_Vfs.bootMountView() != m_View || m_Vfs.m_pRootFilesystem != m_Filesystem)
        return false;
      m_Vfs.m_pRootFilesystem = m_PreviousRoot;
      __atomic_store_n(&m_Vfs.m_MountView, m_PreviousView, __ATOMIC_RELEASE);
      m_Installed = false;
    }
  }
  delete m_View;
  m_View = nullptr;
  if (m_Filesystem && !m_Vfs.unregisterFilesystem(m_Filesystem, false))
    return false;
  m_Filesystem = nullptr;
  m_PreviousContext.reset();
  m_PreviousRootPin.reset();
  m_PreviousRoot = nullptr;
  m_PreviousView = nullptr;
  return true;
}
#endif
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
Filesystem* VFS::swapRootFilesystemForHostedTest(Filesystem* pFs) {
  LockGuard<Mutex> mutationGuard(m_MountMutationLock);
  LockGuard<Mutex> tableGuard(m_MountTableLock);
  Filesystem* previous = m_pRootFilesystem;
  m_pRootFilesystem = pFs;
  return previous;
}
#endif
 
bool VFS::getMountPath(Filesystem* pFs, String& path) const {
  LockGuard<Mutex> tableGuard(m_MountTableLock);
  MountInfo* info = m_Mounts.lookup(pFs);
  if (!info) {
    return false;
  }
 
  path = info->path;
  return true;
}
 
Filesystem* VFS::getFilesystemAt(const String& path) const {
  LockGuard<Mutex> tableGuard(m_MountTableLock);
  for (MountTable::Iterator it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
    if (it.value()->path == path) {
      return it.key();
    }
  }
 
  return nullptr;
}
 
void VFS::getMounts(Vector<MountSnapshot>& mounts) const {
  LockGuard<Mutex> mutationGuard(m_MountMutationLock);
  getMountsLocked(mounts);
}
 
void VFS::getMountsLocked(Vector<MountSnapshot>& mounts) const {
  struct MountSnapshotSource {
    MountSnapshotSource() : filesystem(nullptr) {}
    MountSnapshotSource(Filesystem* filesystem, const String& stableName, const String& path)
        : filesystem(filesystem), stableName(stableName), path(path) {}
 
    Filesystem* filesystem;
    String stableName;
    String path;
  };
 
  mounts.clear();
  Vector<MountSnapshotSource> sources;
  {
    LockGuard<Mutex> tableGuard(m_MountTableLock);
    for (MountTable::Iterator it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
      sources.createBack(it.key(), it.value()->stableName, it.value()->path);
    }
  }
 
  for (const auto& source : sources) {
    bool hasDisk = false;
    String diskParentName;
    String diskName;
    Disk* disk = source.filesystem->getDisk();
    if (disk) {
      hasDisk = true;
      disk->getName(diskName);
      if (disk->getParent()) {
        disk->getParent()->getName(diskParentName);
      }
    }
    mounts.createBack(source.stableName, source.path, hasDisk, diskParentName, diskName);
  }
}
 
namespace {
Filesystem::SyncStatus syncPinnedFilesystem(Filesystem* filesystem) {
  Metrics::increment(Metrics::VfsSyncCalls);
#if !defined(VFS_STANDALONE) && THREADS
  Thread* thread = Processor::information().getCurrentThread();
  const int previousError = thread ? thread->getErrno() : 0;
  if (thread)
    thread->setErrno(0);
#endif
  const auto result = filesystem->sync();
  if (result == Filesystem::SyncStatus::Unsupported) {
    Metrics::increment(Metrics::VfsSyncUnsupported);
  } else if (result != Filesystem::SyncStatus::Success) {
    Metrics::increment(Metrics::VfsSyncFailed);
  }
#if !defined(VFS_STANDALONE) && THREADS
  if (thread)
    thread->setErrno(previousError);
#endif
  return result;
}
}  // namespace
 
Filesystem::SyncStatus VFS::syncFilesystem(Filesystem* key) {
#if !defined(VFS_STANDALONE) && THREADS
  TerminationDeferral lifetime;
#endif
  if (!key)
    return Filesystem::SyncStatus::Unsupported;
  auto pin = SharedPointer<VfsFilesystemPin>::tryAllocate();
  if (!pin)
    return Filesystem::SyncStatus::NoMemory;
  {
    LockGuard<Mutex> guard(m_MountTableLock);
    MountInfo* info = m_Mounts.lookup(key);
    if (!info)
      return Filesystem::SyncStatus::Unsupported;
    if (!info->state->storagePins.tryAcquire(pin->admission))
      return Filesystem::SyncStatus::IoError;
    pin->state = info->state;
  }
  return syncPinnedFilesystem(pin->state->filesystem);
}
 
Filesystem::SyncStatus VFS::syncAll() {
#if !defined(VFS_STANDALONE) && THREADS
  TerminationDeferral lifetime;
#endif
  struct Snapshot {
    ~Snapshot() {
      delete[] pins;
    }
    VfsFilesystemPin* pins = nullptr;
    size_t count = 0;
  } snapshot;
  for (;;) {
    size_t capacity;
    {
      LockGuard<Mutex> guard(m_MountTableLock);
      capacity = m_Mounts.count();
    }
    if (capacity > ~size_t(0) / sizeof(VfsFilesystemPin)) {
      ERROR("VFS::syncAll: filesystem snapshot is too large");
      return Filesystem::SyncStatus::NoMemory;
    }
    delete[] snapshot.pins;
    snapshot.pins = capacity ? new VfsFilesystemPin[capacity] : nullptr;
    if (capacity && !snapshot.pins) {
      ERROR("VFS::syncAll: cannot allocate filesystem snapshot");
      return Filesystem::SyncStatus::NoMemory;
    }
    {
      LockGuard<Mutex> guard(m_MountTableLock);
      // Registration may have grown the table while allocation was unlocked.
      if (m_Mounts.count() > capacity)
        continue;
      for (auto it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
        auto& pin = snapshot.pins[snapshot.count++];
        pin.state = it.value()->state;
        const bool admitted = pin.state->storagePins.tryAcquire(pin.admission);
        (void)admitted;
      }
    }
    break;
  }
 
  auto firstError = Filesystem::SyncStatus::Success;
  for (size_t n = 0; n < snapshot.count; ++n) {
    auto& pin = snapshot.pins[n];
    const auto status = pin.admission ? syncPinnedFilesystem(pin.state->filesystem)
                                      : Filesystem::SyncStatus::IoError;
    if (status != Filesystem::SyncStatus::Success) {
      const char* reason = status == Filesystem::SyncStatus::Unsupported ? "unsupported"
                           : status == Filesystem::SyncStatus::NoMemory  ? "out of memory"
                                                                         : "I/O error";
      ERROR("VFS::syncAll: filesystem " << Dec << pin.state->id << " sync failed: " << reason);
      if (firstError == Filesystem::SyncStatus::Success ||
          (firstError == Filesystem::SyncStatus::Unsupported &&
           status != Filesystem::SyncStatus::Unsupported))
        firstError = status;
    }
  }
  return firstError;
}
 
bool VFS::removeEphemeralFiles() {
  Vector<MountIdentity> mounts;
  {
    LockGuard<Mutex> guard(m_MountTableLock);
    for (auto it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
      MountIdentity identity;
      identity.m_State = it.value()->state;
      mounts.pushBack(identity);
    }
  }
  for (const auto& mount : mounts) {
    FilesystemPin pin;
    if (!mount.pin(pin)) {
      return false;
    }
    File* root = pin.filesystem()->getRoot();
    if (root && root->isDirectory()) {
      Directory::fromFile(root)->removeEphemeralFiles();
    }
  }
  return true;
}
 
File* VFS::find(const String& path, File* pStartNode) {
  Metrics::increment(Metrics::VfsFindCalls);
  // NOTICE("find: " << path);
 
  File* pResult = 0;
 
  pStartNode = resolveStartNode(path, pStartNode);
  if (pStartNode) {
    pResult = pStartNode->getFilesystem()->find(path.view(), pStartNode);
  }
 
  if (!pResult) {
    Metrics::increment(Metrics::VfsFindMisses);
  }
 
  // NOTICE("find: " << path << " -> " << pResult);
  return pResult;
}
 
File* VFS::findRetained(const String& path, Directory::ChildLease& result, File* pStartNode) {
  pStartNode = resolveStartNode(path, pStartNode);
  if (!pStartNode) {
    return nullptr;
  }
  return pStartNode->getFilesystem()->findRetained(path.view(), result, pStartNode);
}
 
void VFS::addProbeCallback(Filesystem::ProbeCallback callback) {
  if (!callback) {
    FATAL("VFS cannot register a null probe callback");
  }
 
  ProbeCallbackItem* item = new ProbeCallbackItem(callback);
#if THREADS
  m_CallbackLock.acquire();
  if (m_CallbacksClosing) {
    m_CallbackLock.release();
    delete item;
    FATAL("VFS probe callback registered during teardown");
  }
  for (auto registered : m_ProbeCallbacks) {
    if (registered->callback == callback) {
      if (!registered->state.draining) {
        registered->state.enabled = true;
      }
      m_CallbackLock.release();
      delete item;
      return;
    }
  }
  if (m_NextCallbackSequence == static_cast<size_t>(-1)) {
    m_CallbackLock.release();
    delete item;
    FATAL("VFS callback sequence exhausted");
  }
  item->state.sequence = m_NextCallbackSequence++;
  item->state.debugAddress = reinterpret_cast<uintptr_t>(callback);
  m_ProbeCallbacks.pushBack(item);
  m_CallbackLock.release();
#else
  for (auto registered : m_ProbeCallbacks) {
    if (registered->callback == callback) {
      delete item;
      return;
    }
  }
  m_ProbeCallbacks.pushBack(item);
#endif
}
 
bool VFS::removeProbeCallback(Filesystem::ProbeCallback callback) {
#if THREADS
  if (!callback) {
    return false;
  }
 
  TerminationDeferral removalDeferral;
  Thread* current = Processor::information().getCurrentThread();
  const bool canYield =
      current && Processor::executionContext() == ExecutionContext::WaitableThread;
  void* owner =
      current ? static_cast<void*>(current) : static_cast<void*>(&Processor::information());
  ProbeCallbackItem* item = nullptr;
  bool callbackContext = false;
 
  m_CallbackLock.acquire();
  if (m_CallbacksClosing) {
    m_CallbackLock.release();
    return false;
  }
  for (auto it = m_ProbeCallbacks.begin(); it != m_ProbeCallbacks.end(); ++it) {
    if ((*it)->callback != callback) {
      continue;
    }
 
    item = *it;
    item->state.enabled = false;
    callbackContext = isCallbackInvocation(owner);
    if (!callbackContext && canYield) {
      item->state.draining = true;
      ++item->state.removers;
    }
    break;
  }
  m_CallbackLock.release();
 
  if (!item) {
    return false;
  }
  if (callbackContext || !canYield) {
    return false;
  }
 
  drainProbeCallback(item);
  return true;
#else
  for (auto it = m_ProbeCallbacks.begin(); it != m_ProbeCallbacks.end(); ++it) {
    ProbeCallbackItem* item = *it;
    if (item->callback == callback) {
      m_ProbeCallbacks.erase(it);
      delete item;
      return true;
    }
  }
  return false;
#endif
}
 
void VFS::addMountCallback(MountCallback callback) {
  if (!callback) {
    FATAL("VFS cannot register a null mount callback");
  }
 
  MountCallbackItem* item = new MountCallbackItem(callback);
#if THREADS
  m_CallbackLock.acquire();
  if (m_CallbacksClosing) {
    m_CallbackLock.release();
    delete item;
    FATAL("VFS mount callback registered during teardown");
  }
  for (auto registered : m_MountCallbacks) {
    if (registered->callback == callback) {
      if (!registered->state.draining) {
        registered->state.enabled = true;
      }
      m_CallbackLock.release();
      delete item;
      return;
    }
  }
  if (m_NextCallbackSequence == static_cast<size_t>(-1)) {
    m_CallbackLock.release();
    delete item;
    FATAL("VFS callback sequence exhausted");
  }
  item->state.sequence = m_NextCallbackSequence++;
  item->state.debugAddress = reinterpret_cast<uintptr_t>(callback);
  m_MountCallbacks.pushBack(item);
  m_CallbackLock.release();
#else
  for (auto registered : m_MountCallbacks) {
    if (registered->callback == callback) {
      delete item;
      return;
    }
  }
  m_MountCallbacks.pushBack(item);
#endif
}
 
bool VFS::removeMountCallback(MountCallback callback) {
#if THREADS
  if (!callback) {
    return false;
  }
 
  TerminationDeferral removalDeferral;
  Thread* current = Processor::information().getCurrentThread();
  const bool canYield =
      current && Processor::executionContext() == ExecutionContext::WaitableThread;
  void* owner =
      current ? static_cast<void*>(current) : static_cast<void*>(&Processor::information());
  MountCallbackItem* item = nullptr;
  bool callbackContext = false;
 
  m_CallbackLock.acquire();
  if (m_CallbacksClosing) {
    m_CallbackLock.release();
    return false;
  }
  for (auto it = m_MountCallbacks.begin(); it != m_MountCallbacks.end(); ++it) {
    if ((*it)->callback != callback) {
      continue;
    }
 
    item = *it;
    item->state.enabled = false;
    callbackContext = isCallbackInvocation(owner);
    if (!callbackContext && canYield) {
      item->state.draining = true;
      ++item->state.removers;
    }
    break;
  }
  m_CallbackLock.release();
 
  if (!item) {
    return false;
  }
  if (callbackContext || !canYield) {
    return false;
  }
 
  drainMountCallback(item);
  return true;
#else
  for (auto it = m_MountCallbacks.begin(); it != m_MountCallbacks.end(); ++it) {
    MountCallbackItem* item = *it;
    if (item->callback == callback) {
      m_MountCallbacks.erase(it);
      delete item;
      return true;
    }
  }
  return false;
#endif
}
 
#if THREADS
VFS::ProbeCallbackItem* VFS::acquireProbeCallback(size_t& afterSequence, size_t boundary,
                                                  ActiveInvocation& invocation) {
  ProbeCallbackItem* item = nullptr;
  m_CallbackLock.acquire();
  if (!m_CallbacksClosing) {
    for (auto candidate : m_ProbeCallbacks) {
      if (candidate->state.sequence <= afterSequence) {
        continue;
      }
      if (candidate->state.sequence >= boundary) {
        break;
      }
 
      afterSequence = candidate->state.sequence;
      if (!candidate->state.enabled) {
        continue;
      }
 
      item = candidate;
      invocation.state = &item->state;
      ++item->state.inFlight;
      invocation.next = m_pActiveCallbacks;
      m_pActiveCallbacks = &invocation;
      break;
    }
  }
  m_CallbackLock.release();
  return item;
}
 
VFS::MountCallbackItem* VFS::acquireMountCallback(size_t& afterSequence, size_t boundary,
                                                  ActiveInvocation& invocation) {
  MountCallbackItem* item = nullptr;
  m_CallbackLock.acquire();
  if (!m_CallbacksClosing) {
    for (auto candidate : m_MountCallbacks) {
      if (candidate->state.sequence <= afterSequence) {
        continue;
      }
      if (candidate->state.sequence >= boundary) {
        break;
      }
 
      afterSequence = candidate->state.sequence;
      if (!candidate->state.enabled) {
        continue;
      }
 
      item = candidate;
      invocation.state = &item->state;
      ++item->state.inFlight;
      invocation.next = m_pActiveCallbacks;
      m_pActiveCallbacks = &invocation;
      break;
    }
  }
  m_CallbackLock.release();
  return item;
}
 
void VFS::finishCallback(CallbackState* state, ActiveInvocation& invocation) {
  auto completionGuard = state->drainWaiters.acquire();
  bool wakeDrainers = false;
 
  m_CallbackLock.acquire();
  ActiveInvocation** link = &m_pActiveCallbacks;
  while (*link && *link != &invocation) {
    link = &((*link)->next);
  }
  if (!*link) {
    m_CallbackLock.release();
    FATAL("VFS lost an active callback invocation");
  }
  *link = invocation.next;
 
  if (!state->inFlight) {
    m_CallbackLock.release();
    FATAL("VFS callback pin underflow");
  }
  --state->inFlight;
  wakeDrainers = !state->inFlight && state->draining;
  m_CallbackLock.release();
 
  if (wakeDrainers) {
    completionGuard.wakeAll(WaitQueue::WakeReason::Signalled, WaitQueue::Channel(state));
  }
}
 
void VFS::drainProbeCallback(ProbeCallbackItem* item) {
  while (true) {
    bool complete = false;
    {
      auto waitGuard = item->state.drainWaiters.acquire();
      m_CallbackLock.acquire();
      if (!item->state.inFlight) {
        complete = true;
        m_CallbackLock.release();
      } else {
        m_CallbackLock.release();
        const WaitQueue::WakeReason reason = waitGuard.waitForCompletion(
            WaitQueue::Channel(&item->state), Thread::CallbackDrain, item->state.debugAddress);
        (void)reason;
      }
    }
    if (complete) {
      break;
    }
  }
 
  bool deleteItem = false;
  m_CallbackLock.acquire();
  if (!item->state.removers) {
    m_CallbackLock.release();
    FATAL("VFS probe callback remover underflow");
  }
  --item->state.removers;
  if (!item->state.removers) {
    for (auto it = m_ProbeCallbacks.begin(); it != m_ProbeCallbacks.end(); ++it) {
      if (*it == item) {
        m_ProbeCallbacks.erase(it);
        deleteItem = true;
        break;
      }
    }
  }
  m_CallbackLock.release();
 
  if (deleteItem) {
    delete item;
  }
}
 
void VFS::drainMountCallback(MountCallbackItem* item) {
  while (true) {
    bool complete = false;
    {
      auto waitGuard = item->state.drainWaiters.acquire();
      m_CallbackLock.acquire();
      if (!item->state.inFlight) {
        complete = true;
        m_CallbackLock.release();
      } else {
        m_CallbackLock.release();
        const WaitQueue::WakeReason reason = waitGuard.waitForCompletion(
            WaitQueue::Channel(&item->state), Thread::CallbackDrain, item->state.debugAddress);
        (void)reason;
      }
    }
    if (complete) {
      break;
    }
  }
 
  bool deleteItem = false;
  m_CallbackLock.acquire();
  if (!item->state.removers) {
    m_CallbackLock.release();
    FATAL("VFS mount callback remover underflow");
  }
  --item->state.removers;
  if (!item->state.removers) {
    for (auto it = m_MountCallbacks.begin(); it != m_MountCallbacks.end(); ++it) {
      if (*it == item) {
        m_MountCallbacks.erase(it);
        deleteItem = true;
        break;
      }
    }
  }
  m_CallbackLock.release();
 
  if (deleteItem) {
    delete item;
  }
}
 
void VFS::dispatchMountCallbacks(void* owner) {
  size_t boundary = 0;
  m_CallbackLock.acquire();
  boundary = m_NextCallbackSequence;
  m_CallbackLock.release();
 
  size_t afterSequence = 0;
  while (true) {
    ActiveInvocation invocation = {nullptr, owner, nullptr};
    MountCallbackItem* item = acquireMountCallback(afterSequence, boundary, invocation);
    if (!item) {
      break;
    }
 
    item->callback();
    finishCallback(&item->state, invocation);
  }
}
 
bool VFS::isCallbackInvocation(void* owner) const {
  for (ActiveInvocation* invocation = m_pActiveCallbacks; invocation;
       invocation = invocation->next) {
    if (invocation->owner == owner) {
      return true;
    }
  }
  return false;
}
#endif
 
bool VFS::createFile(const String& path, uint32_t mask, File* pStartNode) {
  pStartNode = resolveStartNode(path, pStartNode);
  return pStartNode && pStartNode->getFilesystem()->createFile(path, mask, pStartNode);
}
 
bool VFS::createDirectory(const String& path, uint32_t mask, File* pStartNode) {
  pStartNode = resolveStartNode(path, pStartNode);
  if (!pStartNode) {
    NOTICE("no start node found");
    return false;
  }
 
  return pStartNode->getFilesystem()->createDirectory(path, mask, pStartNode);
}
 
bool VFS::createSymlink(const String& path, const String& value, File* pStartNode) {
  pStartNode = resolveStartNode(path, pStartNode);
  return pStartNode && pStartNode->getFilesystem()->createSymlink(path, value, pStartNode);
}
 
bool VFS::createLink(const String& path, File* target, File* pStartNode) {
  pStartNode = resolveStartNode(path, pStartNode);
  return pStartNode && pStartNode->getFilesystem()->createLink(path, target, pStartNode);
}
 
bool VFS::remove(const String& path, File* pStartNode) {
  return remove(path, pStartNode, nullptr);
}
 
bool VFS::remove(const String& path, File* pStartNode, File* expected) {
  pStartNode = resolveStartNode(path, pStartNode);
  return pStartNode && pStartNode->getFilesystem()->remove(path, pStartNode, expected);
}
 
bool VFS::rename(const String& oldPath, File* oldStart, const String& newPath, File* newStart,
                 bool noReplace) {
  oldStart = resolveStartNode(oldPath, oldStart);
  newStart = resolveStartNode(newPath, newStart);
  return oldStart && newStart &&
         oldStart->getFilesystem()->rename(oldPath.view(), oldStart, newPath.view(), newStart,
                                           noReplace);
}
 
bool VFS::checkAccess(File* pFile, bool bRead, bool bWrite, bool bExecute) {
#ifdef VFS_STANDALONE
  // We don't check permissions on standalone builds of the VFS.
  return true;
#else
  if (!pFile) {
    // The error for a null file is not EPERM or EACCESS.
    return true;
  }
 
  FilesystemCredentials credentials;
  if (!Process::currentFilesystemCredentials(credentials)) {
    SYSCALL_ERROR(PermissionDenied);
    return false;
  }
  return checkAccess(pFile, bRead, bWrite, bExecute, credentials);
#endif
}
 
bool VFS::checkAccess(File* file, bool read, bool write, bool execute, int64_t uid, int64_t gid,
                      const Vector<int64_t>& groups) {
  FilesystemCredentials credentials;
  if (uid >= 0 && static_cast<uint64_t>(uid) < UINT32_MAX && gid >= 0 &&
      static_cast<uint64_t>(gid) < UINT32_MAX && groups.count() <= credentials.MaximumGroups) {
    credentials.uid = uid;
    credentials.gid = gid;
    credentials.groupCount = groups.count();
    credentials.valid = true;
    for (size_t i = 0; i < groups.count(); ++i) {
      if (groups[i] < 0 || static_cast<uint64_t>(groups[i]) >= UINT32_MAX)
        credentials.valid = false;
      credentials.groups[i] = groups[i];
    }
  }
  return checkAccess(file, read, write, execute, credentials);
}
 
bool VFS::checkAccess(File* pFile, bool bRead, bool bWrite, bool bExecute,
                      const FilesystemCredentials& credentials) {
#ifdef VFS_STANDALONE
  return true;
#else
  if (!pFile)
    return true;
  if (!credentials.valid) {
    SYSCALL_ERROR(PermissionDenied);
    return false;
  }
  const uint32_t processUid = credentials.uid;
  const uint32_t processGid = credentials.gid;
  uint32_t check = 0;
  const auto attributes = pFile->getAttributes();
  const int64_t fuid = attributes.uid;
  const int64_t fgid = attributes.gid;
  uint32_t permissions = attributes.permissions;
  uint32_t needed = (bRead ? FILE_UR : 0) | (bWrite ? FILE_UW : 0) | (bExecute ? FILE_UX : 0);
 
  const bool dacOverride = credentials.enforceCapabilities
                               ? (credentials.capabilities & (uint64_t(1) << 1))
                               : processUid == 0;
  const bool dacReadSearch =
      credentials.enforceCapabilities && (credentials.capabilities & (uint64_t(1) << 2));
  if (dacOverride) {
    if (!bExecute || pFile->isDirectory() || (permissions & (FILE_UX | FILE_GX | FILE_OX))) {
      return true;
    }
  }
  if (dacReadSearch && !bWrite && (!bExecute || pFile->isDirectory())) {
    return true;
  }
  if (fuid == processUid) {
    check = (permissions >> FILE_UBITS) & 0x7;
  } else {
    bool inFileGroup = fgid == processGid;
 
    if (!inFileGroup) {
      for (size_t i = 0; i < credentials.groupCount; ++i) {
        if (credentials.groups[i] == fgid) {
          inFileGroup = true;
          break;
        }
      }
    }
 
    check = (permissions >> (inFileGroup ? FILE_GBITS : FILE_OBITS)) & 0x7;
  }
 
  if ((check & needed) != needed) {
    SYSCALL_ERROR(PermissionDenied);
    return false;
  }
 
  return true;
#endif
}
 
RcuPointer<VFS::TrackedFile>& VFS::trackedFileBucket(File* file) {
  uintptr_t key = reinterpret_cast<uintptr_t>(file) >> 4;
  key ^= key >> 8;
  key ^= key >> 16;
  return m_TrackedFiles[key % TrackedFileBuckets];
}
 
bool VFS::trackFileLocked(File* file) {
  auto& bucket = trackedFileBucket(file);
  TrackedFile* first = bucket.loadForUpdate();
  for (auto* entry = first; entry; entry = entry->next.loadForUpdate()) {
    if (entry->file == file) {
      return entry->retain();
    }
  }
 
  auto* entry = new TrackedFile(file);
  if (!entry) {
    return false;
  }
  if (first) {
    entry->next.exchange(first);
  }
  bucket.exchange(entry);
  return true;
}
 
void VFS::trackFile(File* pFile) {
  LockGuard<Mutex> guard(m_TrackedFilesLock);
  if (!trackFileLocked(pFile)) {
    FATAL("VFS could not track a File");
  }
}
 
bool VFS::tryTrackFile(File* file) {
  if (!file) {
    return false;
  }
  LockGuard<Mutex> guard(m_TrackedFilesLock);
  return trackFileLocked(file);
}
 
bool VFS::retainTrackedFile(File* pFile) {
  if (!pFile) {
    return false;
  }
 
  bool retained = false;
  {
    RcuReadGuard guard;
    for (auto* entry = trackedFileBucket(pFile).load(guard); entry;
         entry = entry->next.load(guard)) {
      if (entry->file == pFile) {
        retained = entry->retain();
        break;
      }
    }
  }
  if (!retained) {
    return false;
  }
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
  RetainTrackedFileHook hook = __atomic_load_n(&m_RetainTrackedFileHook, __ATOMIC_ACQUIRE);
  if (hook) {
    hook(pFile);
  }
#endif
 
  return true;
}
 
bool VFS::untrackFile(File* pFile, bool destroy) {
  {
    RcuReadGuard guard;
    TrackedFile* entry = trackedFileBucket(pFile).load(guard);
    while (entry && entry->file != pFile) {
      entry = entry->next.load(guard);
    }
    if (!entry) {
      return false;
    }
    size_t count = __atomic_load_n(&entry->owners, __ATOMIC_RELAXED);
    while (count > 1) {
      if (__atomic_compare_exchange_n(&entry->owners, &count, count - 1, false, __ATOMIC_ACQ_REL,
                                      __ATOMIC_RELAXED)) {
        return false;
      }
    }
    if (!count) {
      return false;
    }
  }
 
  TrackedFile* retiring = nullptr;
  {
    LockGuard<Mutex> guard(m_TrackedFilesLock);
    auto* link = &trackedFileBucket(pFile);
    TrackedFile* entry = link->loadForUpdate();
    while (entry && entry->file != pFile) {
      link = &entry->next;
      entry = link->loadForUpdate();
    }
    if (!entry) {
      return false;
    }
 
    size_t count = __atomic_load_n(&entry->owners, __ATOMIC_RELAXED);
    while (count) {
      if (__atomic_compare_exchange_n(&entry->owners, &count, count - 1, false, __ATOMIC_ACQ_REL,
                                      __ATOMIC_RELAXED)) {
        if (count > 1) {
          return false;
        }
        link->exchange(entry->next.loadForUpdate());
        retiring = entry;
        break;
      }
    }
  }
 
  if (!retiring) {
    return false;
  }
  // Zero closes retain admission. Reclaim the record before destroying the
  // File, whose destructor may recursively release a tracked parent.
  Rcu::synchronize();
  delete retiring;
  if (destroy) {
    delete pFile;
  }
  return true;
}
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
void VFS::setRetainTrackedFileHookForHostedTest(RetainTrackedFileHook hook) {
  __atomic_store_n(&m_RetainTrackedFileHook, hook, __ATOMIC_RELEASE);
}
#endif
 
String VFS::getUniqueStableNameLocked(const String& preferredName) const {
  NormalStaticString safeName;
  for (size_t i = 0; i < preferredName.length(); ++i) {
    char c = preferredName[i];
    bool allowed = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') ||
                   c == '.' || c == '_' || c == '-';
    safeName.append(allowed ? c : '-');
  }
 
  String base(safeName, safeName.length());
  if (!base.length() || base == "." || base == "..") {
    base.assign("filesystem");
  }
 
  size_t suffix = 1;
  while (true) {
    NormalStaticString candidateBuffer;
    candidateBuffer += base;
    if (suffix > 1) {
      candidateBuffer += "-";
      candidateBuffer.append(suffix);
    }
    String candidate(candidateBuffer, candidateBuffer.length());
 
    bool exists = false;
    for (MountTable::Iterator it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
      if (it.value()->stableName == candidate) {
        exists = true;
        break;
      }
    }
 
    if (!exists) {
      return candidate;
    }
 
    ++suffix;
  }
}
 
File* VFS::resolveStartNode(const String& path, File* pStartNode) {
  if (!path.length() || path[0] != '/') {
    return pStartNode;
  }
 
  Filesystem* root = nullptr;
  {
    LockGuard<Mutex> tableGuard(m_MountTableLock);
    root = m_pRootFilesystem;
  }
  return root ? root->getRoot() : nullptr;
}
 
bool VFS::attachFilesystem(Filesystem* pRootFs, Filesystem* pFs, const String& path) {
  if (!pRootFs || !pFs || pFs == pRootFs) {
    return pFs == pRootFs;
  }
 
  File* filesystemRoot = pFs->getRoot();
  if (!filesystemRoot || !filesystemRoot->isDirectory()) {
    ERROR("VFS: filesystem at " << path << " has no valid root directory");
    return false;
  }
 
  Directory::ChildLease mediaLease;
  if (auto* view = bootMountView()) {
    FilesystemContextOwner bootstrap;
    if (!view->createBootContext(bootstrap)) {
      return false;
    }
    auto context = bootstrap.reference();
    VfsMountView::ResolveOptions options;
    options.requireDirectory = true;
    FilesystemPathRef attached;
    // Startup may import this registration before mount() resumes attaching it.
    if (view->resolve(context, FilesystemPathRef(), path, options, attached) &&
        attached->node() == filesystemRoot) {
      return true;
    }
    attached.reset();
    options.crossFinalMount = false;
    FilesystemPathRef media, point;
    if (!view->resolve(context, FilesystemPathRef(), String("/media"), options, media)) {
      FilesystemPathRef root;
      if (!view->bootRootPath(root) || !view->createDirectory(root, String("media"), 0755) ||
          !view->resolve(context, FilesystemPathRef(), String("/media"), options, media)) {
        return false;
      }
    }
    if (!view->resolve(context, FilesystemPathRef(), path, options, point)) {
      String name = path.view().substring(7, path.length()).toString();
      if (!view->createDirectory(media, name, 0755) ||
          !view->resolve(context, FilesystemPathRef(), path, options, point)) {
        return false;
      }
    }
    return view->attach(context, point, pFs);
  }
  if (!findRetained(String("/media"), mediaLease)) {
    createDirectory(String("/media"), 0755);
  }
 
  Directory::ChildLease pointLease;
  File* point = findRetained(path, pointLease);
  if (!point) {
    createDirectory(path, 0755);
    point = findRetained(path, pointLease);
  }
 
  if (!point || !point->isDirectory()) {
    ERROR("VFS: cannot attach filesystem at " << path);
    return false;
  }
 
  Directory::fromFile(point)->setReparsePoint(Directory::fromFile(filesystemRoot));
  NOTICE("VFS: attached filesystem at " << path);
  return true;
}
 
void VFS::attachRegisteredFilesystemsLocked() {
  struct AttachWork {
    AttachWork() : filesystem(nullptr) {}
    AttachWork(Filesystem* filesystem, const String& path) : filesystem(filesystem), path(path) {}
 
    Filesystem* filesystem;
    String path;
  };
 
  Filesystem* root = nullptr;
  Vector<AttachWork> work;
  {
    LockGuard<Mutex> tableGuard(m_MountTableLock);
    root = m_pRootFilesystem;
    if (!root) {
      return;
    }
 
    for (MountTable::Iterator it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
      MountInfo* info = it.value();
      if (it.key() == root) {
        info->path.assign("/");
        continue;
      }
 
      NormalStaticString path;
      path += "/media/";
      path += info->stableName;
      info->path.assign(path, path.length());
      work.createBack(it.key(), info->path);
    }
  }
 
  for (const auto& item : work) {
    attachFilesystem(root, item.filesystem, item.path);
  }
}
 
Module::UnloadAdmission VFS::unloadAdmission(bool terminal) {
  // Mapping/pressure callbacks remain registered until singleton destruction.
  // destroyVFS does not close that global service or its surviving clients.
  return terminal ? Module::UnloadAdmission::KeepMapped : Module::UnloadAdmission::Busy;
}
 
#ifndef VFS_STANDALONE
static bool initVFS() {
  SwapStore::instance().prepareAtBoot();
  AnonymousMemoryMap prepareZeroPage(0, 0, MemoryMappedObject::None);
  return KernelElf::instance().registerUnloadAdmission(&initVFS, &VFS::unloadAdmission);
}
 
static void destroyVFS() {}
 
MODULE_INFO("vfs", &initVFS, &destroyVFS);
#endif
 
bool VFS::diskMount(uint32_t id, MountIdentity& identity) const {
  identity = MountIdentity();
  if (!id || id > 0xfffff)
    return false;
  LockGuard<Mutex> guard(m_MountTableLock);
  for (auto it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
    const auto& state = it.value()->state;
    if (state->id == id && state->filesystem->getDisk() && state->operations.isOpen()) {
      identity.m_State = state;
      return true;
    }
  }
  return false;
}
bool VFS::snapshotDiskMounts(Vector<MountIdentity>& mounts) const {
  mounts.clear();
  LockGuard<Mutex> guard(m_MountTableLock);
  if (!mounts.tryReserve(m_Mounts.count()))
    return false;
  for (auto it = m_Mounts.begin(); it != m_Mounts.end(); ++it) {
    const auto& state = it.value()->state;
    if (state->id > 0xfffff || !state->filesystem->getDisk() || !state->operations.isOpen())
      continue;
    MountIdentity identity;
    identity.m_State = state;
    mounts.pushBack(identity);
  }
  return true;
}