system-syscalls.cc

/*
 * Copyright (c) 2008-2014, Pedigree Developers
 *
 * Please see the CONTRIB file in the root of the source tree for a full
 * list of contributors.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
 
#include "pedigree/kernel/ActivityDiagnostics.h"
#include "pedigree/kernel/Log.h"
#include "pedigree/kernel/Version.h"
#include "pedigree/kernel/compiler.h"
#include "pedigree/kernel/linker/Elf.h"
#include "pedigree/kernel/linker/KernelElf.h"
#include "pedigree/kernel/panic.h"
#include "pedigree/kernel/process/PerProcessorScheduler.h"
#include "pedigree/kernel/process/Process.h"
#include "pedigree/kernel/process/Scheduler.h"
#include "pedigree/kernel/process/TerminationDeferral.h"
#include "pedigree/kernel/process/Thread.h"
#include "pedigree/kernel/processor/PhysicalMemoryManager.h"
#include "pedigree/kernel/processor/Processor.h"
#include "pedigree/kernel/processor/StackFrame.h"
#include "pedigree/kernel/processor/SyscallManager.h"
#include "pedigree/kernel/processor/VirtualAddressSpace.h"
#include "pedigree/kernel/processor/state.h"
#include "pedigree/kernel/processor/types.h"
#include "pedigree/kernel/syscallError.h"
#include "pedigree/kernel/utilities/SecureRandom.h"
#include "pedigree/kernel/utilities/String.h"
#include "pedigree/kernel/utilities/Vector.h"
#include "pedigree/kernel/utilities/ZombieQueue.h"
#include "pedigree/kernel/utilities/lib.h"
#include "pedigree/kernel/utilities/utility.h"
 
#include "file-syscalls.h"
#include "linux-resource-abi.h"
#include "modules/system/linker/DynamicLinker.h"
#include "modules/system/vfs/File.h"
#include "modules/system/vfs/Symlink.h"
#include "modules/system/vfs/VFS.h"
#include "pipe-syscalls.h"
#include "posixSyscallNumbers.h"
#include "pthread-syscalls.h"
#include "signal-syscalls.h"
#include "system-syscalls.h"
#include "sysv-semaphore-syscalls.h"
 
#define MACHINE_FORWARD_DECL_ONLY
#include "pedigree/kernel/Subsystem.h"
#include "pedigree/kernel/machine/Machine.h"
#include "pedigree/kernel/machine/Timer.h"
 
#include <PosixProcess.h>
#include <PosixSubsystem.h>
#include <grp.h>
#include <limits.h>
#include <pwd.h>
#include <sched.h>
#include <syslog.h>
 
#include "modules/system/console/Console.h"
#include "modules/system/users/Group.h"
#include "modules/system/users/User.h"
#include "modules/system/users/UserManager.h"
#include "modules/system/vfs/MemoryMappedFile.h"
#include <sys/resource.h>
#include <sys/times.h>
#include <sys/utsname.h>
#include <sys/wait.h>
 
#if X64 && !HOSTED
static_assert(RUSAGE_SELF == 0, "musl RUSAGE_SELF selector changed");
static_assert(RUSAGE_CHILDREN == -1, "musl RUSAGE_CHILDREN selector changed");
static_assert(RUSAGE_THREAD == 1, "musl RUSAGE_THREAD selector changed");
static_assert(offsetof(struct rusage, __reserved) == sizeof(LinuxRusage64),
              "musl rusage prefix no longer matches the Linux amd64 syscall ABI");
static_assert(sizeof(struct rusage) == sizeof(LinuxRusage64) + 16 * sizeof(long),
              "musl rusage reserve changed");
#endif
 
// arch_prctl
#define ARCH_SET_GS 0x1001
#define ARCH_SET_FS 0x1002
#define ARCH_GET_FS 0x1003
#define ARCH_GET_GS 0x1004
 
// Linux prctl operations used by musl's current-thread naming helpers.
#define LINUX_PR_SET_NAME 15
#define LINUX_PR_GET_NAME 16
#define LINUX_TASK_NAME_LENGTH 16
 
// capget/capset
#define _LINUX_CAPABILITY_VERSION_1 0x19980330
 
#define LINUX_GRND_NONBLOCK 0x1
#define LINUX_GRND_RANDOM 0x2
 
namespace {
class CloneInterruptScope {
 public:
  explicit CloneInterruptScope(bool enabled = false) : m_Previous(Processor::getInterrupts()) {
    Processor::setInterrupts(enabled);
  }
 
  ~CloneInterruptScope() {
    Processor::setInterrupts(m_Previous);
  }
 
 private:
  bool m_Previous;
};
 
enum class CloneRoute { Process, Vfork, Thread, Invalid };
 
CloneRoute cloneRoute(unsigned long flags) {
  constexpr unsigned long ExitSignalMask = 0xff;
  constexpr unsigned long SpawnFlags = CLONE_VM | CLONE_VFORK | SIGCHLD;
  constexpr unsigned long ProcessModifiers =
      CLONE_NEWUTS | CLONE_PARENT_SETTID | CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | CLONE_SETTLS;
  constexpr unsigned long ThreadRequired =
      CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD;
  constexpr unsigned long ThreadAllowed = ThreadRequired | CLONE_SYSVSEM | CLONE_SETTLS |
                                          CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID |
                                          CLONE_DETACHED | CLONE_CHILD_SETTID;
 
  if (flags & CLONE_THREAD) {
    if ((flags & ExitSignalMask) || (flags & ThreadRequired) != ThreadRequired ||
        (flags & ~ThreadAllowed)) {
      return CloneRoute::Invalid;
    }
    return CloneRoute::Thread;
  }
 
  // Process sharing is limited to vfork's bounded borrow. Other sharing and
  // namespace combinations must not silently receive fork semantics.
  const unsigned long processFlags = flags & ~ProcessModifiers;
  if (processFlags == SpawnFlags)
    return CloneRoute::Vfork;
  if (processFlags == 0 || processFlags == SIGCHLD) {
    return CloneRoute::Process;
  }
  return CloneRoute::Invalid;
}
}  // namespace
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
namespace {
using CloneBeforeStartHook = void (*)(Thread*, size_t, void*);
 
CloneBeforeStartHook g_CloneBeforeStartHook = nullptr;
void* g_CloneBeforeStartHookContext = nullptr;
}  // namespace
 
extern "C" EXPORTED_PUBLIC void posixSetCloneBeforeStartHookForTest(CloneBeforeStartHook hook,
                                                                    void* context) {
  if (hook) {
    __atomic_store_n(&g_CloneBeforeStartHookContext, context, __ATOMIC_RELEASE);
    __atomic_store_n(&g_CloneBeforeStartHook, hook, __ATOMIC_RELEASE);
  } else {
    __atomic_store_n(&g_CloneBeforeStartHook, static_cast<CloneBeforeStartHook>(nullptr),
                     __ATOMIC_RELEASE);
    __atomic_store_n(&g_CloneBeforeStartHookContext, static_cast<void*>(nullptr), __ATOMIC_RELEASE);
  }
}
 
extern "C" EXPORTED_PUBLIC int posixCloneRouteForTest(unsigned long flags) {
  switch (cloneRoute(flags)) {
    case CloneRoute::Process:
      return 0;
    case CloneRoute::Thread:
      return 1;
    case CloneRoute::Vfork:
      return 2;
    case CloneRoute::Invalid:
      return -1;
  }
 
  return -1;
}
#endif
 
struct cap_header {
  uint32_t version;
  int pid;
};
 
struct cap_data {
  uint32_t effective;
  uint32_t permitted;
  uint32_t inheritable;
};
 
//
// Syscalls pertaining to system operations.
//
 
static PosixProcess* getPosixProcess() {
  // Not a POSIX process
  Process* pStockProcess = Processor::information().getCurrentThread()->getParent();
  if (pStockProcess->getType() != Process::Posix) {
    return nullptr;
  }
 
  return static_cast<PosixProcess*>(pStockProcess);
}
 
static bool copyUserString(const char* userString, String& copy) {
  PosixSubsystem::UserStringResult result =
      PosixSubsystem::copyUserString(userString, copy, PATH_MAX);
  if (result == PosixSubsystem::UserStringBadAddress) {
    SYSCALL_ERROR(BadAddress);
    return false;
  }
  if (result == PosixSubsystem::UserStringTooLong) {
    SYSCALL_ERROR(NameTooLong);
    return false;
  }
  return true;
}
 
ssize_t posix_getrandom(void* buffer, size_t length, unsigned int flags) {
  if (flags & ~(LINUX_GRND_NONBLOCK | LINUX_GRND_RANDOM)) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  uint8_t snapshot[256];
  const size_t requested = length < sizeof(snapshot) ? length : sizeof(snapshot);
  const size_t produced = secure_random_bytes(snapshot, requested);
  if (requested && !produced) {
    SYSCALL_ERROR(NoMoreProcesses);
    return -1;
  }
  const bool copied = PosixSubsystem::copyToUser(buffer, snapshot, produced);
  pedigree_random::erase(snapshot, sizeof(snapshot));
  if (!copied) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  return static_cast<ssize_t>(produced);
}
 
static size_t save_string_array(const char** array, Vector<SharedPointer<String>>& rArray) {
  size_t result = 0;
  while (*array) {
    String* pStr = new String(*array);
    rArray.pushBack(SharedPointer<String>(pStr));
    array++;
 
    result += pStr->length() + 1;
  }
 
  return result;
}
 
static char** load_string_array(Vector<SharedPointer<String>>& rArray, uintptr_t arrayLoc,
                                uintptr_t& arrayEndLoc) {
  char** pMasterArray = reinterpret_cast<char**>(arrayLoc);
 
  char* pPtr = reinterpret_cast<char*>(arrayLoc + sizeof(char*) * (rArray.count() + 1));
  int i = 0;
  for (auto it = rArray.begin(); it != rArray.end(); it++) {
    const String* pStr = it->get();
 
    StringCopy(pPtr, pStr->cstr());
    pPtr[pStr->length()] = '\0';  // Ensure NULL-termination.
 
    pMasterArray[i] = pPtr;
 
    pPtr += pStr->length() + 1;
    i++;
  }
 
  pMasterArray[i] = 0;  // Null terminate.
  arrayEndLoc = reinterpret_cast<uintptr_t>(pPtr);
 
  return pMasterArray;
}
 
long posix_sbrk(int delta) {
  SC_NOTICE("sbrk(" << delta << ")");
 
  long ret = reinterpret_cast<long>(Processor::information().getVirtualAddressSpace().expandHeap(
      delta, VirtualAddressSpace::Write));
  SC_NOTICE("    -> " << ret);
  if (ret == 0) {
    SYSCALL_ERROR(OutOfMemory);
    return -1;
  } else
    return ret;
}
 
uintptr_t posix_brk(uintptr_t theBreak) {
  SC_NOTICE("brk(" << theBreak << ")");
  MemoryMapManager::OperationGuard operation(MemoryMapManager::instance());
  auto& space = Processor::information().getVirtualAddressSpace();
  const uintptr_t current = reinterpret_cast<uintptr_t>(space.getEndOfHeap());
  // The Linux syscall returns the unchanged break on failed growth. Musl's
  // allocator compares this value with the requested address.
  Processor::information().getCurrentThread()->setErrno(0);
  if (theBreak <= current || theBreak - current > static_cast<uintptr_t>(INTPTR_MAX))
    return current;
  if (!space.expandHeap(static_cast<intptr_t>(theBreak - current), VirtualAddressSpace::Write)) {
    Processor::information().getCurrentThread()->setErrno(0);
    return current;
  }
  return reinterpret_cast<uintptr_t>(space.getEndOfHeap());
}
 
SyscallState posix_copy_clone_state(const SyscallState& state) {
#if X64 && !HOSTED
  // The child's frame must own its metadata before it leaves this CPU.
  state.getUserEntryMetadata();
#endif
  SyscallState clonedState = state;
#if HOSTED
  // The hosted bridge's errno destination is stack-local to the parent's
  // translator frame and cannot survive in the child return state.
  clonedState.error_ptr = 0;
#endif
  return clonedState;
}
 
long posix_clone(SyscallState& state, unsigned long flags, void* child_stack, int* ptid, int* ctid,
                 unsigned long newtls, bool linuxAbi, bool clearSignalHandlers) {
  SC_NOTICE("clone(" << Hex << flags << ", " << child_stack << ", " << ptid << ", " << ctid << ", "
                     << newtls << ")");
 
  Process* pParentProcess = Processor::information().getCurrentThread()->getParent();
  Process::ThreadCreationScope creation(*pParentProcess);
  if (!creation) {
    SYSCALL_ERROR(NoMoreProcesses);
    return -1;
  }
 
  // Allocation and the mapping policy may wait. Low-level page-table changes
  // provide their own short critical sections; restore the caller's IRQ state.
  CloneInterruptScope interrupts(true);
 
  // Must clone state as we make modifications for the new thread here.
  SyscallState clonedState = posix_copy_clone_state(state);
 
  // Basic warnings to start with.
  if (flags & CLONE_PARENT) {
    SC_NOTICE(" -> CLONE_PARENT is not yet supported!");
  }
 
  const CloneRoute route = cloneRoute(flags);
  if (route == CloneRoute::Invalid || (clearSignalHandlers && route == CloneRoute::Thread)) {
    SYSCALL_ERROR(InvalidArgument);
    SC_NOTICE(" -> EINVAL (unsupported or inconsistent clone flags)");
    return -1;
  }
  if (route == CloneRoute::Thread && pParentProcess->isVforkChild()) {
    // Detach is owned by the sole child thread; it cannot strand peers in
    // the borrowed image when exec or exit wakes the creator.
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  if (route != CloneRoute::Thread &&
      (flags & (CLONE_PARENT_SETTID | CLONE_CHILD_SETTID | CLONE_SETTLS))) {
    MemoryMapManager& mappings = MemoryMapManager::instance();
    MemoryMapManager::OperationGuard mappingGuard(mappings);
    auto writableId = [&](int* address) {
      const uintptr_t target = reinterpret_cast<uintptr_t>(address);
      return PosixSubsystem::checkAddress(target, sizeof(int), PosixSubsystem::SafeWrite) &&
             mappings.faultIn(target, true) && mappings.faultIn(target + sizeof(int) - 1, true);
    };
    if (((flags & CLONE_PARENT_SETTID) && !writableId(ptid)) ||
        ((flags & CLONE_CHILD_SETTID) && !writableId(ctid))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
    if ((flags & CLONE_SETTLS) && (newtls >= pParentProcess->getAddressSpace()->getKernelStart()
#if X64
                                   || newtls >= 0x0000800000000000ULL
#endif
                                   )) {
      SYSCALL_ERROR(NotEnoughPermissions);
      return -1;
    }
  }
 
  PosixSubsystem* creatorSubsystem = getSubsystem();
  TraceCloneAdmission traceCreation;
  TraceTaskRef creatorTask;
  UniquePointer<PreparedTraceTask> preparedTrace;
  if (!creatorSubsystem || !creatorSubsystem->traceContext().taskToken(
                               *Processor::information().getCurrentThread(), creatorTask)) {
    SYSCALL_ERROR(NoSuchProcess);
    return -1;
  }
  if (route == CloneRoute::Thread) {
    if (creatorSubsystem->traceContext().reserveThreadCreation(traceCreation) !=
        TraceStatus::Success) {
      SYSCALL_ERROR(OperationNotSupported);
      return -1;
    }
    if (creatorSubsystem->traceContext().prepareTask(preparedTrace) != TraceStatus::Success) {
      SYSCALL_ERROR(OutOfMemory);
      return -1;
    }
  }
  auto creatorNamespaces = creatorSubsystem ? creatorSubsystem->namespaceContext()
                                            : SharedPointer<PosixNamespaceContext>();
  UtsRef creatorUts;
  UniquePointer<PreparedUtsThread> preparedUts;
  if (!creatorNamespaces ||
      !creatorNamespaces->acquireThread(*Processor::information().getCurrentThread(), creatorUts))
    return posix_uts_error(UtsStatus::Missing);
  UtsStatus utsPrepared;
  {
    MemoryMapManager::OperationGuard mappingGuard(MemoryMapManager::instance());
    if ((flags & CLONE_NEWUTS) && getPosixProcess()->snapshotCredentials().euid != 0) {
      SYSCALL_ERROR(NotEnoughPermissions);
      return -1;
    }
    utsPrepared = posix_uts_prepare_thread(creatorUts, flags & CLONE_NEWUTS, preparedUts);
  }
  if (utsPrepared != UtsStatus::Success)
    return posix_uts_error(utsPrepared);
 
  const ThreadPlacement placement =
      ThreadPlacement::inherit(*Processor::information().getCurrentThread());
 
  if (route == CloneRoute::Thread) {
    // clone vm doesn't actually copy the address space, it shares it
 
    // New child's stack. Must be valid as we're sharing the address space.
    if (!child_stack) {
      SYSCALL_ERROR(InvalidArgument);
      return -1;
    }
 
    // Set up stack for new thread.
    clonedState.setStackPointer(reinterpret_cast<uintptr_t>(child_stack));
 
    // Child returns 0 -- parent returns the new thread ID.
    clonedState.setSyscallReturnValue(0);
 
    Thread* pThread = nullptr;
    size_t threadId = 0;
    bool copiedIds = false;
    {
      MemoryMapManager& mappings = MemoryMapManager::instance();
      MemoryMapManager::OperationGuard mappingGuard(mappings);
      auto writableId = [&](int* address) {
        const uintptr_t target = reinterpret_cast<uintptr_t>(address);
        return PosixSubsystem::checkAddress(target, sizeof(int), PosixSubsystem::SafeWrite) &&
               mappings.faultIn(target, true) && mappings.faultIn(target + sizeof(int) - 1, true);
      };
      if (((flags & CLONE_CHILD_SETTID) && !writableId(ctid)) ||
          ((flags & CLONE_PARENT_SETTID) && !writableId(ptid))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
      const bool setTls = !linuxAbi || (flags & CLONE_SETTLS);
      if (setTls && (newtls >= pParentProcess->getAddressSpace()->getKernelStart()
#if X64
                     || newtls >= 0x0000800000000000ULL
#endif
                     )) {
        SYSCALL_ERROR(NotEnoughPermissions);
        return -1;
      }
      // The native ABI initializes its TLS self pointer. Linux supplies an
      // opaque FS base and owns initialization of any memory it points to.
      if (!linuxAbi &&
          !PosixSubsystem::copyToUser(reinterpret_cast<void*>(newtls), &newtls, sizeof(newtls))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
 
      pThread = new Thread(pParentProcess, clonedState, true, &placement);
      if (!pThread) {
        SYSCALL_ERROR(OutOfMemory);
        return -1;
      }
      pThread->executionPersonality().inherit(
          Processor::information().getCurrentThread()->executionPersonality());
      creatorNamespaces->publishThread(preparedUts, *pThread, false);
      if (creatorSubsystem->traceContext().publishTask(preparedTrace, *pThread) !=
              TraceStatus::Success &&
          pThread->getUnwindState() != Thread::TerminateThread)
        FATAL("clone trace task publication failed");
      pThread->setName("posix clone() thread");
      if (setTls) {
        pThread->setTlsBase(newtls);
      }
      threadId = linuxAbi ? pThread->getTaskId() : pThread->getId();
    }
    {
      CloneInterruptScope enabled(true);
      if (!posix_sem_clone(Processor::information().getCurrentThread(), pThread,
                           flags & CLONE_SYSVSEM)) {
        pThread->setUnwindState(Thread::TerminateThread);
        pThread->startDetached();
        SYSCALL_ERROR(OutOfMemory);
        return -1;
      }
    }
    const int id = static_cast<int>(threadId);
    copiedIds =
        (!(flags & CLONE_CHILD_SETTID) || PosixSubsystem::copyToUser(ctid, &id, sizeof(id))) &&
        (!(flags & CLONE_PARENT_SETTID) || PosixSubsystem::copyToUser(ptid, &id, sizeof(id)));
    if (copiedIds && (flags & CLONE_CHILD_CLEARTID)) {
      pThread->setClearChildTid(reinterpret_cast<uintptr_t>(ctid));
    }
    if (!copiedIds) {
      // The existing delayed-start cancellation path owns retirement. A
      // published Thread cannot be deleted directly on this error path.
      pThread->setUnwindState(Thread::TerminateThread);
      pThread->startDetached();
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
 
#if HOSTED && PEDIGREE_HOSTED_SMOKE_TESTS
    void* hookContext = __atomic_load_n(&g_CloneBeforeStartHookContext, __ATOMIC_ACQUIRE);
    CloneBeforeStartHook hook = __atomic_load_n(&g_CloneBeforeStartHook, __ATOMIC_ACQUIRE);
    if (hook) {
      hook(pThread, threadId, hookContext);
    }
#endif
 
    if (!pThread->startDetached()) {
      FATAL("clone(): delayed thread could not be started.");
    }
 
    // Parent gets the new thread ID.
    SC_NOTICE(" -> " << threadId << " [new thread]");
    return threadId;
  }
 
  SharedPointer<Process::VforkCompletion> vforkCompletion;
  const bool borrowAddressSpace = route == CloneRoute::Vfork;
  if (borrowAddressSpace) {
    vforkCompletion =
        SharedPointer<Process::VforkCompletion>::tryAdopt(new Process::VforkCompletion);
    if (!vforkCompletion) {
      SYSCALL_ERROR(OutOfMemory);
      return -1;
    }
  }
 
  // A vfork caller may borrow its current stack; clone wrappers supply one.
  if (child_stack) {
    clonedState.setStackPointer(reinterpret_cast<uintptr_t>(child_stack));
  }
 
  PosixSubsystem* pParentSubsystem = static_cast<PosixSubsystem*>(pParentProcess->getSubsystem());
  if (!pParentSubsystem) {
    ERROR("No subsystem for the parent process!");
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  // Enrollment precedes MM admission. Pivot updates this unpublished context
  // too; any rollback retires its owner after the mapping guard has unwound.
  FilesystemContextOwner childFilesystem;
  auto parentFilesystem = pParentProcess->acquireFilesystemContext();
  if (!parentFilesystem || !parentFilesystem->forkForProcess(childFilesystem)) {
    SYSCALL_ERROR(OutOfMemory);
    return -1;
  }
 
  // Inhibit signals to the parent
  for (size_t sig = 0; sig < PosixSubsystem::SignalDispositionCount; sig++)
    Processor::information().getCurrentThread()->inhibitEvent(sig, true);
 
  PosixProcess* pProcess;
  PosixSubsystem* pSubsystem;
  {
    // PTEs, raw allocation inventory, and managed metadata describe one snapshot.
    MemoryMapManager::OperationGuard mappingGuard(MemoryMapManager::instance());
    pProcess = new PosixProcess(pParentProcess, true, Process::FilesystemContextMode::Deferred,
                                borrowAddressSpace);
    if (!pProcess || !pProcess->getAddressSpace() || !pProcess->jobControlReady()) {
      delete pProcess;
      for (size_t sig = 0; sig < PosixSubsystem::SignalDispositionCount; sig++)
        Processor::information().getCurrentThread()->inhibitEvent(sig, false);
      SYSCALL_ERROR(OutOfMemory);
      SC_NOTICE(" -> ENOMEM");
      return -1;
    }
 
    pSubsystem = new PosixSubsystem(*pParentSubsystem, clearSignalHandlers);
    if (!pSubsystem || !pSubsystem->namespaceContext() ||
        !pSubsystem->namespaceContext()->valid()) {
      if (pSubsystem)
        pProcess->setSubsystem(pSubsystem);
      ERROR("Could not create a subsystem for the child process!");
      delete pProcess;
 
      SYSCALL_ERROR(OutOfMemory);
 
      // Allow signals again, something went wrong
      for (size_t sig = 0; sig < PosixSubsystem::SignalDispositionCount; sig++)
        Processor::information().getCurrentThread()->inhibitEvent(sig, false);
      SC_NOTICE(" -> ENOMEM");
      return -1;
    }
    pProcess->setSubsystem(pSubsystem);
    pSubsystem->setProcess(pProcess);
 
    // Copy POSIX Process Group information if needed
    if (pParentProcess->getType() == Process::Posix) {
      PosixProcess* p = static_cast<PosixProcess*>(pParentProcess);
 
      // Do not adopt leadership status.
      if (p->getGroupMembership() == PosixProcess::Leader) {
        SC_NOTICE("fork parent was a group leader.");
      } else {
        SC_NOTICE("fork parent had status " << static_cast<int>(p->getGroupMembership()) << "...");
      }
      pProcess->inheritProcessGroup(p);
    }
 
    // Register with the dynamic linker.
    DynamicLinker* oldLinker = pProcess->getLinker();
    if (oldLinker) {
      DynamicLinker* newLinker = new DynamicLinker(*oldLinker);
      pProcess->setLinker(newLinker);
    }
 
    if (borrowAddressSpace) {
      pProcess->borrowVforkAddressSpace(*pParentProcess, vforkCompletion);
    } else if (!MemoryMapManager::instance().clone(pProcess)) {
      delete pProcess;
      for (size_t sig = 0; sig < PosixSubsystem::SignalDispositionCount; ++sig)
        Processor::information().getCurrentThread()->inhibitEvent(sig, false);
      SYSCALL_ERROR(OutOfMemory);
      return -1;
    }
  }
 
  if (!pProcess->installFilesystemContext(pedigree_std::move(childFilesystem)))
    FATAL("Fork could not install its prepared filesystem context");
 
  // Copy the file descriptors from the parent
  pSubsystem->copyDescriptors(pParentSubsystem);
 
  // Child returns 0.
  clonedState.setSyscallReturnValue(0);
 
  // Allow signals to the parent again
  for (size_t sig = 0; sig < PosixSubsystem::SignalDispositionCount; sig++)
    Processor::information().getCurrentThread()->inhibitEvent(sig, false);
 
  // Set ctid in the new address space if we are required to.
  if (flags & CLONE_CHILD_SETTID) {
    VirtualAddressSpace& curr = Processor::information().getVirtualAddressSpace();
    VirtualAddressSpace* va = pProcess->getAddressSpace();
    const int childId = static_cast<int>(pProcess->getUserspaceId());
    bool copied = false;
    {
      MemoryMapManager::OperationGuard mappingGuard(MemoryMapManager::instance());
      Processor::switchAddressSpace(*va);
      copied = PosixSubsystem::copyToUser(ctid, &childId, sizeof(childId));
      Processor::switchAddressSpace(curr);
    }
    if (!copied) {
      delete pProcess;
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
  }
 
  if (flags & CLONE_PARENT_SETTID) {
    const int childId = static_cast<int>(pProcess->getUserspaceId());
    if (!PosixSubsystem::copyToUser(ptid, &childId, sizeof(childId))) {
      delete pProcess;
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
  }
 
  pSubsystem->traceContext().setCreator(creatorTask);
  if (pSubsystem->traceContext().prepareTask(preparedTrace) != TraceStatus::Success) {
    delete pProcess;
    SYSCALL_ERROR(OutOfMemory);
    return -1;
  }
 
  // The process is still unpublished, so this image is not remotely reachable
  // until its remaining thread state is assembled and publish() runs below.
  if (!pSubsystem->publishUserImage(*pProcess->getAddressSpace())) {
    delete pProcess;
    SYSCALL_ERROR(OutOfMemory);
    return -1;
  }
 
  // Create a new thread for the new process.
  Thread* pThread = new Thread(pProcess, clonedState, true, &placement);
  if (!pThread) {
    delete pProcess;
    SYSCALL_ERROR(OutOfMemory);
    return -1;
  }
  pThread->executionPersonality().inherit(
      Processor::information().getCurrentThread()->executionPersonality());
  pSubsystem->namespaceContext()->publishThread(preparedUts, *pThread, true);
  if (pSubsystem->traceContext().publishTask(preparedTrace, *pThread) != TraceStatus::Success &&
      pThread->getUnwindState() != Thread::TerminateThread)
    FATAL("fork trace task publication failed");
  pThread->setName("posix clone() forked thread");
  if (flags & CLONE_SETTLS)
    pThread->setTlsBase(newtls);
  pThread->detach();
  if (flags & CLONE_CHILD_CLEARTID) {
    // The exit hook clears this before releasing a borrowed vfork image.
    pThread->setClearChildTid(reinterpret_cast<uintptr_t>(ctid));
  }
 
  // Finish publishing the child-side POSIX state before it can execute.
  pedigree_copy_posix_thread(Processor::information().getCurrentThread(), pParentSubsystem, pThread,
                             pSubsystem);
  const size_t childId = pProcess->getUserspaceId();
  Uninterruptible parentEvents;
  pProcess->publish();
  if (!pThread->start()) {
    FATAL("fork(): delayed child thread could not be started.");
  }
  if (vforkCompletion)
    vforkCompletion->wait();
 
  // Parent returns child ID.
  SC_NOTICE(" -> " << childId << " [new process]");
  return childId;
}
 
int posix_fork(SyscallState& state) {
  SC_NOTICE("fork");
 
  return posix_clone(state, 0, 0, 0, 0, 0);
}
 
int posix_vfork(SyscallState& state) {
  return posix_clone(state, CLONE_VM | CLONE_VFORK | SIGCHLD, nullptr, nullptr, nullptr, 0, true);
}
 
int posix_execve(const char* name, const char** argv, const char** env, SyscallState& state) {
  String nameCopy;
  if (!copyUserString(name, nameCopy)) {
    SC_NOTICE("execve -> invalid address");
    return -1;
  }
 
  SC_NOTICE("execve(\"" << nameCopy << "\")");
 
  Process* pProcess = Processor::information().getCurrentThread()->getParent();
  PosixSubsystem* pSubsystem = static_cast<PosixSubsystem*>(pProcess->getSubsystem());
  if (!pSubsystem) {
    ERROR("No subsystem for this process!");
    return -1;
  }
 
  Vector<String> listArgv, listEnv;
  {
    MemoryMapManager::OperationGuard mappingGuard(MemoryMapManager::instance());
    size_t remaining = PosixSubsystem::MaximumExecArgumentBytes - 2 * sizeof(uintptr_t);
    if (nameCopy.length() >= remaining) {
      SYSCALL_ERROR(TooBig);
      return -1;
    }
    remaining -= nameCopy.length() + 1;
    auto snapshot = [&](const char** pointers, Vector<String>& output) {
      uintptr_t cursor = reinterpret_cast<uintptr_t>(pointers);
      while (cursor) {
        const char* argument = nullptr;
        if (!PosixSubsystem::copyFromUser(&argument, reinterpret_cast<void*>(cursor),
                                          sizeof(argument))) {
          SYSCALL_ERROR(BadAddress);
          return false;
        }
        if (!argument) {
          return true;
        }
        if (remaining <= sizeof(uintptr_t)) {
          SYSCALL_ERROR(TooBig);
          return false;
        }
        remaining -= sizeof(uintptr_t);
        String value;
        const auto result = PosixSubsystem::copyUserString(argument, value, remaining);
        if (result != PosixSubsystem::UserStringSuccess) {
          syscallError(result == PosixSubsystem::UserStringBadAddress ? Error::BadAddress
                                                                      : Error::TooBig);
          return false;
        }
        remaining -= value.length() + 1;
        output.pushBack(value);
        if (cursor > ~uintptr_t(0) - sizeof(uintptr_t)) {
          SYSCALL_ERROR(BadAddress);
          return false;
        }
        cursor += sizeof(uintptr_t);
      }
      return true;
    };
    if (!snapshot(argv, listArgv) || !snapshot(env, listEnv)) {
      return -1;
    }
  }
 
  // Normalise path to ensure we have the correct path to invoke.
  String invokePath;
  normalisePath(invokePath, nameCopy.cstr());
 
  if (!pSubsystem->invoke(invokePath.cstr(), listArgv, listEnv, state)) {
    SC_NOTICE(" -> execve failed in invoke");
    return -1;
  }
 
  // Technically, we never get here.
  return 0;
}
 
int posix_getpid() {
  SC_NOTICE("getpid");
 
  Process* pProcess = Processor::information().getCurrentThread()->getParent();
  return pProcess->getUserspaceId();
}
 
int posix_getppid() {
  SC_NOTICE("getppid");
 
  Process* pProcess = Processor::information().getCurrentThread()->getParent();
  while (true) {
    Process* expectedParent = pProcess->getParent();
    if (!expectedParent) {
      return 0;
    }
 
    Scheduler::ProcessLease parent;
    if (!Scheduler::instance().acquireProcess(parent, expectedParent)) {
      if (pProcess->getParent() != expectedParent) {
        continue;
      }
      return 0;
    }
    if (pProcess->getParent() == parent.get()) {
      return parent->getUserspaceId();
    }
  }
}
 
int posix_gettimeofday(timeval* tv, struct timezone* tz) {
  SC_NOTICE("gettimeofday");
 
  const Time::Timestamp nanoseconds = Time::getTimeNanoseconds();
  if (tv) {
    struct timeval result = {};
    result.tv_sec = nanoseconds / Time::Multiplier::Second;
    result.tv_usec = (nanoseconds % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
    if (!PosixSubsystem::copyToUser(tv, &result, sizeof(result))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
  }
 
  if (tz) {
    const struct timezone result = {};
    if (!PosixSubsystem::copyToUser(tz, &result, sizeof(result))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
  }
 
  return 0;
}
 
int posix_settimeofday(const timeval* tv, const struct timezone* tz) {
  SC_NOTICE("settimeofday");
  SYSCALL_ERROR(Unimplemented);
  return -1;
}
 
time_t posix_time(time_t* tval) {
  SC_NOTICE("time");
 
  time_t result = Time::getTime();
  if (tval && !PosixSubsystem::copyToUser(tval, &result, sizeof(result))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
 
  return result;
}
 
clock_t posix_times(struct tms* tm) {
  SC_NOTICE("times");
 
  Process* pProcess = Processor::information().getCurrentThread()->getParent();
  constexpr Time::Timestamp nanosecondsPerClockTick = Time::Multiplier::Second / 100;
 
  struct tms result = {};
  result.tms_utime = pProcess->getUserTime() / nanosecondsPerClockTick;
  result.tms_stime = pProcess->getKernelTime() / nanosecondsPerClockTick;
  result.tms_cutime = pProcess->getReapedChildrenUserTime() / nanosecondsPerClockTick;
  result.tms_cstime = pProcess->getReapedChildrenKernelTime() / nanosecondsPerClockTick;
  if (tm && !PosixSubsystem::copyToUser(tm, &result, sizeof(result))) {
    SC_NOTICE("posix_times -> invalid address");
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
 
  SC_NOTICE("times: u=" << pProcess->getUserTime() << ", s=" << pProcess->getKernelTime());
 
  return Time::getTicks() / nanosecondsPerClockTick;
}
 
int posix_getrusage(int who, struct rusage* r) {
  SC_NOTICE("getrusage who=" << who);
 
  if (who != RUSAGE_SELF && who != RUSAGE_CHILDREN && who != RUSAGE_THREAD) {
    SC_NOTICE("posix_getrusage -> unsupported selector");
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  Thread* currentThread = Processor::information().getCurrentThread();
  Process* pProcess = currentThread->getParent();
  const Time::Timestamp user = who == RUSAGE_THREAD     ? currentThread->getUserTime()
                               : who == RUSAGE_CHILDREN ? pProcess->getReapedChildrenUserTime()
                                                        : pProcess->getUserTime();
  const Time::Timestamp kernel = who == RUSAGE_THREAD     ? currentThread->getKernelTime()
                                 : who == RUSAGE_CHILDREN ? pProcess->getReapedChildrenKernelTime()
                                                          : pProcess->getKernelTime();
 
  struct rusage result = {};
  result.ru_utime.tv_sec = user / Time::Multiplier::Second;
  result.ru_utime.tv_usec = (user % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
  result.ru_stime.tv_sec = kernel / Time::Multiplier::Second;
  result.ru_stime.tv_usec = (kernel % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
 
  if (!PosixSubsystem::copyToUser(r, &result, sizeof(result))) {
    SC_NOTICE("posix_getrusage -> invalid address");
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
 
  return 0;
}
 
int posix_linux_getrusage(int who, LinuxRusage64* r) {
  SC_NOTICE("Linux getrusage who=" << who);
 
  if (who != RUSAGE_SELF && who != RUSAGE_CHILDREN && who != RUSAGE_THREAD) {
    SC_NOTICE("posix_linux_getrusage -> unsupported selector");
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  Thread* currentThread = Processor::information().getCurrentThread();
  Process* pProcess = currentThread->getParent();
  const Time::Timestamp user = who == RUSAGE_THREAD     ? currentThread->getUserTime()
                               : who == RUSAGE_CHILDREN ? pProcess->getReapedChildrenUserTime()
                                                        : pProcess->getUserTime();
  const Time::Timestamp kernel = who == RUSAGE_THREAD     ? currentThread->getKernelTime()
                                 : who == RUSAGE_CHILDREN ? pProcess->getReapedChildrenKernelTime()
                                                          : pProcess->getKernelTime();
 
  LinuxRusage64 result = {};
  result.userSeconds = user / Time::Multiplier::Second;
  result.userMicroseconds = (user % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
  result.systemSeconds = kernel / Time::Multiplier::Second;
  result.systemMicroseconds = (kernel % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
 
  if (!PosixSubsystem::copyToUser(r, &result, sizeof(result))) {
    SC_NOTICE("posix_linux_getrusage -> invalid address");
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
 
  return 0;
}
 
namespace {
int copyPasswd(User* user, passwd* output, char* userStrings) {
  if (!user) {
    return -1;
  }
  // The native glue supplies one 256-byte buffer for all passwd strings.
  char strings[256] = {};
  passwd result = {};
  size_t used = 0;
  const uintptr_t base = reinterpret_cast<uintptr_t>(userStrings);
  const String empty;
  const String* values[] = {&user->getUsername(), &empty, &user->getFullName(), &user->getHome(),
                            &user->getShell()};
  char** fields[] = {&result.pw_name, &result.pw_passwd, &result.pw_gecos, &result.pw_dir,
                     &result.pw_shell};
  for (size_t i = 0; i < 5; ++i) {
    const size_t length = values[i]->length();
    if (length >= sizeof(strings) - used) {
      SYSCALL_ERROR(BadRange);
      return -1;
    }
    *fields[i] = reinterpret_cast<char*>(base + used);
    MemoryCopy(strings + used, values[i]->cstr(), length + 1);
    used += length + 1;
  }
  result.pw_uid = user->getId();
  result.pw_gid = user->getDefaultGroup()->getId();
  if (!PosixSubsystem::copyToUser(userStrings, strings, used) ||
      !PosixSubsystem::copyToUser(output, &result, sizeof(result))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  return 0;
}
 
int copyGroup(Group* group, struct group* output) {
  if (!group) {
    return -1;
  }
  struct group result = {};
  if (!PosixSubsystem::copyFromUser(&result, output, sizeof(result))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  // The native getgr* glue allocates 256 bytes for the caller-owned name.
  const String& name = group->getName();
  if (name.length() >= 256) {
    SYSCALL_ERROR(BadRange);
    return -1;
  }
  result.gr_gid = group->getId();
  if (!PosixSubsystem::copyToUser(result.gr_name, name.cstr(), name.length() + 1) ||
      !PosixSubsystem::copyToUser(output, &result, sizeof(result))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  return 0;
}
}  // namespace
 
int posix_getpwent(passwd* pw, int n, char* str) {
  return copyPasswd(UserManager::instance().getUser(n), pw, str);
}
 
int posix_getpwnam(passwd* pw, const char* name, char* str) {
  String nameCopy;
  if (!copyUserString(name, nameCopy)) {
    return -1;
  }
  return copyPasswd(UserManager::instance().getUser(nameCopy), pw, str);
}
 
int posix_getgrnam(const char* name, struct group* out) {
  String nameCopy;
  if (!copyUserString(name, nameCopy)) {
    return -1;
  }
  return copyGroup(UserManager::instance().getGroup(nameCopy), out);
}
 
int posix_getgrgid(gid_t id, struct group* out) {
  return copyGroup(UserManager::instance().getGroup(id), out);
}
 
EXPORTED_PUBLIC int pedigree_login(int uid) {
  PosixProcess* process = getPosixProcess();
  if (!process) {
    SYSCALL_ERROR(NotEnoughPermissions);
    return -1;
  }
  MemoryMapManager::OperationGuard operation(MemoryMapManager::instance());
  if (process->snapshotCredentials().euid != 0) {
    SYSCALL_ERROR(NotEnoughPermissions);
    return -1;
  }
  if (process->getNumThreads() != 1) {
    SYSCALL_ERROR(NoMoreProcesses);
    return -1;
  }
  User* user = uid < 0 ? nullptr : UserManager::instance().getUser(uid);
  if (!user) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
  if (!user->login()) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
  Processor::information().getCurrentThread()->setErrno(0);
  return 0;
}
 
mode_t posix_umask(mode_t mask) {
  SC_NOTICE("umask(" << Oct << mask << ")");
 
  // Not a POSIX process
  Process* pStockProcess = Processor::information().getCurrentThread()->getParent();
  if (pStockProcess->getType() != Process::Posix) {
    SC_NOTICE("umask -> called on something not a POSIX process");
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  PosixProcess* pProcess = static_cast<PosixProcess*>(pStockProcess);
 
  uint32_t previous = pProcess->getMask();
  pProcess->setMask(mask);
 
  return previous;
}
 
int posix_linux_syslog(int type, char* buf, int len) {
  switch (type) {
    case 0:
    case 1:
      return 0;
    case 3:
      break;
    case 10:
      return static_cast<int>(Log::textCapacity());
#if PEDIGREE_SYSCALL_COUNTER
    case 11: {
      if (len != static_cast<int>(sizeof(uint64_t))) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      Process* process = Processor::information().getCurrentThread()->getParent();
      const uint64_t count = process->getReapedChildrenSyscallCount();
      if (!PosixSubsystem::copyToUser(buf, &count, sizeof(count))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
      return static_cast<int>(sizeof(count));
    }
    case 12: {
      Process* process = Processor::information().getCurrentThread()->getParent();
      Process::SyscallLatencySnapshot snapshot = {};
      process->getReapedChildrenSyscallLatencySnapshot(snapshot);
      if (len != static_cast<int>(sizeof(snapshot))) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      if (!PosixSubsystem::copyToUser(buf, &snapshot, sizeof(snapshot))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
      return static_cast<int>(sizeof(snapshot));
    }
#endif
#if PEDIGREE_ACTIVITY_DIAGNOSTICS
    case 13: {
      if (len != static_cast<int>(sizeof(ActivityDiagnostics::Snapshot))) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      ActivityDiagnostics::Snapshot snapshot = {};
      ActivityDiagnostics::snapshot(snapshot);
      if (!PosixSubsystem::copyToUser(buf, &snapshot, sizeof(snapshot))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
      return static_cast<int>(sizeof(snapshot));
    }
#endif
#if PEDIGREE_BENCHMARK_SYSCALL_TIMING
    case 15: {
      if (buf || (len != 0 && len != 1)) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      Process* process = Processor::information().getCurrentThread()->getParent();
      process->setBenchmarkSyscallTiming(len != 0);
      return 0;
    }
    case 16: {
      constexpr size_t snapshotSize =
          Process::SyscallTimingSlotCount * sizeof(Process::SyscallTimingEntry);
      if (len != static_cast<int>(snapshotSize)) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      Process* process = Processor::information().getCurrentThread()->getParent();
      for (size_t i = 0; i < Process::SyscallTimingSlotCount; ++i) {
        Process::SyscallTimingEntry entry = {};
        process->getSyscallTimingEntry(i, entry);
        if (!PosixSubsystem::copyToUser(buf + i * sizeof(entry), &entry, sizeof(entry))) {
          SYSCALL_ERROR(BadAddress);
          return -1;
        }
      }
      return static_cast<int>(snapshotSize);
    }
#endif
#if PEDIGREE_BENCHMARK_VM_DIAGNOSTICS
    case 17: {
      if (buf || (len != 0 && len != 1)) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      Process* process = Processor::information().getCurrentThread()->getParent();
      process->setBenchmarkVmDiagnostics(len != 0);
      return 0;
    }
    case 18: {
      constexpr size_t snapshotSize = Process::BenchmarkVmCounterCount * sizeof(uint64_t);
      if (len != static_cast<int>(snapshotSize)) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      Process* process = Processor::information().getCurrentThread()->getParent();
      for (size_t i = 0; i < Process::BenchmarkVmCounterCount; ++i) {
        const uint64_t value = process->getBenchmarkVmCounter(i);
        if (!PosixSubsystem::copyToUser(buf + i * sizeof(value), &value, sizeof(value))) {
          SYSCALL_ERROR(BadAddress);
          return -1;
        }
      }
      return static_cast<int>(snapshotSize);
    }
#endif
    case 20: {
#if PEDIGREE_BENCHMARK_SYSCALL_TRACE
      if (buf || (len != 0 && len != 1)) {
        SYSCALL_ERROR(InvalidArgument);
        return -1;
      }
      Process* process = Processor::information().getCurrentThread()->getParent();
      process->setBenchmarkSyscallTrace(len != 0);
      return 0;
#else
      SYSCALL_ERROR(Unimplemented);
      return -1;
#endif
    }
    case 2:
    case 4:
    case 5:
    case 6:
    case 7:
    case 8:
    case 9:
      SYSCALL_ERROR(Unimplemented);
      return -1;
    default:
      SYSCALL_ERROR(InvalidArgument);
      return -1;
  }
 
  if (len < 0) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
  if (!len)
    return 0;
  const size_t capacity = static_cast<size_t>(len) < Log::textCapacity() ? static_cast<size_t>(len)
                                                                         : Log::textCapacity();
  if (!PosixSubsystem::checkAddress(reinterpret_cast<uintptr_t>(buf), capacity,
                                    PosixSubsystem::SafeWrite)) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
 
  // User memory may fault: never copy to it while holding the log spinlock.
  TerminationDeferral lifetime;
  char* snapshot = new char[capacity];
  if (!snapshot) {
    SYSCALL_ERROR(OutOfMemory);
    return -1;
  }
  const size_t copied = Log::instance().copyText(snapshot, capacity);
  const bool valid = PosixSubsystem::copyToUser(buf, snapshot, copied);
  delete[] snapshot;
  if (!valid) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  return static_cast<int>(copied);
}
 
int posix_syslog(const char* msg, int prio) {
  String msgCopy;
  if (!copyUserString(msg, msgCopy)) {
    SC_NOTICE("klog -> invalid address");
    return -1;
  }
 
  uint64_t id = Processor::information().getCurrentThread()->getParent()->getId();
  if (id <= 1) {
    if (prio <= LOG_CRIT)
      FATAL("[" << Dec << id << Hex << "]\tklog: " << msgCopy);
  }
 
  if (prio <= LOG_ERR)
    ERROR("[" << Dec << id << Hex << "]\tklog: " << msgCopy);
  else if (prio == LOG_WARNING)
    WARNING("[" << Dec << id << Hex << "]\tklog: " << msgCopy);
  else if (prio == LOG_NOTICE || prio == LOG_INFO)
    NOTICE("[" << Dec << id << Hex << "]\tklog: " << msgCopy);
#if DEBUGGER
  else
    NOTICE("[" << Dec << id << Hex << "]\tklog: " << msgCopy);
#endif
  return 0;
}
 
int posix_reboot(uint32_t magic1, uint32_t magic2, uint32_t command) {
  if (Processor::information().getCurrentThread()->getParent()->getEffectiveUserId() != 0) {
    SYSCALL_ERROR(NotEnoughPermissions);
    return -1;
  }
  if (magic1 != 0xfee1dead ||
      (magic2 != 672274793 && magic2 != 85072278 && magic2 != 369367448 && magic2 != 537993216)) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  Machine::ShutdownType type;
  switch (command) {
    case 0x00000000:  // CAD_OFF
    case 0x89abcdef:  // CAD_ON
      // There is no kernel Ctrl-Alt-Del policy to change.
      return 0;
    case 0x01234567:
      type = Machine::ShutdownType::Restart;
      break;
    case 0xcdef0123:
      type = Machine::ShutdownType::Halt;
      break;
    case 0x4321fedc:
      type = Machine::ShutdownType::PowerOff;
      break;
    default:
      // RESTART2, suspend and kexec require contracts we do not implement.
      SYSCALL_ERROR(InvalidArgument);
      return -1;
  }
 
  // Catch known writeback failures before committing to terminal teardown.
  // Module shutdown closes writers and performs the final cache drains.
  const auto status = VFS::instance().syncAll();
  if (status == Filesystem::SyncStatus::IoError || status == Filesystem::SyncStatus::NoMemory) {
    syscallError(status == Filesystem::SyncStatus::IoError ? Error::IoError : Error::OutOfMemory);
    return -1;
  }
  if (!SyscallManager::instance().requestReboot(type)) {
    SYSCALL_ERROR(DeviceBusy);
    return -1;
  }
  return 0;
}
 
EXPORTED_PUBLIC int pedigree_reboot() {
  return posix_reboot(0xfee1dead, 672274793, 0x01234567);
}
 
int posix_prctl(int option, uint64_t arg2, uint64_t arg3, uint64_t arg4, uint64_t arg5) {
  NOTICE("prctl(" << Hex << option << ", " << arg2 << ", " << arg3 << ", " << arg4 << ", " << arg5
                  << ")");
 
  Thread* thread = Processor::information().getCurrentThread();
  if (option == 3 || option == 4) {
    PosixProcess* process = getPosixProcess();
    if (!process) {
      SYSCALL_ERROR(InvalidArgument);
      return -1;
    }
    if (option == 3) {
      thread->setErrno(0);
      return process->snapshotCredentials().dumpable ? 1 : 0;
    }
    if (arg2 > 1) {
      SYSCALL_ERROR(InvalidArgument);
      return -1;
    }
    process->setDumpable(arg2 != 0);
    thread->setErrno(0);
    return 0;
  }
 
  if (option == LINUX_PR_SET_NAME) {
    String requested;
    const PosixSubsystem::UserStringResult result = PosixSubsystem::copyUserString(
        reinterpret_cast<const char*>(arg2), requested, LINUX_TASK_NAME_LENGTH);
    if (result == PosixSubsystem::UserStringBadAddress) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
 
    // Linux task names are a 16-byte field including the terminator. Direct
    // prctl callers are truncated; pthread_setname_np applies its own ERANGE.
    const size_t length = requested.length() < (LINUX_TASK_NAME_LENGTH - 1)
                              ? requested.length()
                              : (LINUX_TASK_NAME_LENGTH - 1);
    thread->setName(String(requested.cstr(), length, true));
    return 0;
  }
 
  if (option == LINUX_PR_GET_NAME) {
    char name[LINUX_TASK_NAME_LENGTH] = {};
    const String& current = thread->getName();
    const size_t length = current.length() < (LINUX_TASK_NAME_LENGTH - 1)
                              ? current.length()
                              : (LINUX_TASK_NAME_LENGTH - 1);
    MemoryCopy(name, current.cstr(), length);
    if (!PosixSubsystem::copyToUser(reinterpret_cast<void*>(arg2), name, sizeof(name))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
    return 0;
  }
 
  SYSCALL_ERROR(InvalidArgument);
  return -1;
}
 
int posix_arch_prctl(int code, unsigned long addr) {
  Thread* current = Processor::information().getCurrentThread();
  switch (code) {
#if X64 && !HOSTED
    case ARCH_SET_GS:
      // Paranoid entry distinguishes kernel and user GS by the address half.
      // FSGSBASE stays disabled, so userspace cannot bypass this restriction.
      if (addr >= current->getParent()->getAddressSpace()->getKernelStart() ||
          addr >= 0x0000800000000000ULL) {
        SYSCALL_ERROR(NotEnoughPermissions);
        return -1;
      }
      current->setUserGsBase(addr);
      break;
 
    case ARCH_GET_GS: {
      const unsigned long base = Processor::getUserGsBase();
      if (!PosixSubsystem::copyToUser(reinterpret_cast<void*>(addr), &base, sizeof(base))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
      break;
    }
#endif
    case ARCH_SET_FS:
      if (addr >= current->getParent()->getAddressSpace()->getKernelStart()
#if X64
          || addr >= 0x0000800000000000ULL
#endif
      ) {
        SYSCALL_ERROR(NotEnoughPermissions);
        return -1;
      }
      current->setTlsBase(addr);
      break;
 
    case ARCH_GET_FS: {
      const unsigned long base = current->getTlsBase();
      if (!PosixSubsystem::copyToUser(reinterpret_cast<void*>(addr), &base, sizeof(base))) {
        SYSCALL_ERROR(BadAddress);
        return -1;
      }
      break;
    }
 
    default:
      SYSCALL_ERROR(InvalidArgument);
      return -1;
  }
  return 0;
}
 
int posix_pause() {
  SC_NOTICE("pause");
 
  Processor::information().getCurrentThread()->waitForEvent();
 
  SYSCALL_ERROR(Interrupted);
  return -1;
}
 
int posix_membarrier(int command, unsigned int flags, int cpuId) {
  SC_NOTICE("membarrier(" << Dec << command << ", " << flags << ", " << cpuId << ")");
 
  // A zero query result truthfully advertises that no membarrier commands are
  // available. Callers can then select their ordinary synchronization path.
  if (command == 0 && flags == 0) {
    return 0;
  }
 
  SYSCALL_ERROR(InvalidArgument);
  return -1;
}
 
int posix_getpriority(int which, int who, bool linuxAbi) {
  SC_NOTICE("getpriority(" << which << ", " << Dec << who << ")");
  if (which != PRIO_PROCESS && which != PRIO_PGRP && which != PRIO_USER) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
  if (who < 0) {
    SYSCALL_ERROR(NoSuchProcess);
    return -1;
  }
 
  PosixProcess* caller = getPosixProcess();
  if (!caller) {
    SYSCALL_ERROR(NoSuchProcess);
    return -1;
  }
 
  // POSIX nice values are not mutable yet. Linux returns 20 minus nice,
  // while the native POSIX service exposes the public value directly.
  const int priority = linuxAbi ? 20 : 0;
  if (which == PRIO_PROCESS) {
    if (!who || static_cast<size_t>(who) == caller->getUserspaceId()) {
      return priority;
    }
    Scheduler::ProcessLease candidate;
    if (Scheduler::instance().acquireProcessByUserspaceId(candidate, static_cast<size_t>(who)) &&
        candidate->getType() == Process::Posix && candidate->getState() != Process::Reaped) {
      return priority;
    }
    SYSCALL_ERROR(NoSuchProcess);
    return -1;
  }
 
  if (which == PRIO_USER) {
    if (!who || static_cast<int64_t>(who) == caller->getUserId()) {
      return priority;
    }
    // The scheduler has no stable process snapshot for another user's set.
    // Index-based scans can miss a live match when an earlier process exits.
    SYSCALL_ERROR(Unimplemented);
    return -1;
  }
 
  size_t callerGroup = 0;
  const bool hasCallerGroup = caller->getProcessGroupId(callerGroup);
  if (hasCallerGroup && (!who || static_cast<size_t>(who) == callerGroup)) {
    return priority;
  }
  if (who) {
    SYSCALL_ERROR(Unimplemented);
    return -1;
  }
 
  SYSCALL_ERROR(NoSuchProcess);
  return -1;
}
 
int posix_setpriority(int which, int who, int prio) {
  SC_NOTICE("setpriority(" << which << ", " << Dec << who << ", " << prio << ")");
  return 0;
}
 
int posix_get_robust_list(int pid, struct robust_list_head** head_ptr, size_t* len_ptr,
                          bool linuxAbi) {
  SC_NOTICE("get_robust_list");
  Thread* current = Processor::information().getCurrentThread();
  Thread* target = current;
  Process::ThreadLease targetLease;
  const size_t currentId = linuxAbi ? current->getTaskId() : current->getId();
  if (pid < 0 || (pid && static_cast<size_t>(pid) != currentId &&
                  !(linuxAbi ? Scheduler::instance().acquireThreadByTaskId(targetLease, pid)
                             : current->getParent()->acquireThreadById(targetLease, pid)))) {
    SYSCALL_ERROR(NoSuchProcess);
    return -1;
  }
  if (targetLease) {
    target = targetLease.get();
  }
  if (target->getParent() != current->getParent()) {
    // Cross-process inspection needs a ptrace access policy which the
    // subsystem does not yet implement.
    SYSCALL_ERROR(NotEnoughPermissions);
    return -1;
  }
 
  auto* head = reinterpret_cast<struct robust_list_head*>(target->getRobustList());
  const size_t length = 3 * sizeof(uintptr_t);
  if (!PosixSubsystem::copyToUser(head_ptr, &head, sizeof(head)) ||
      !PosixSubsystem::copyToUser(len_ptr, &length, sizeof(length))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  return 0;
}
 
int posix_set_robust_list(struct robust_list_head* head, size_t len, bool linuxAbi) {
  SC_NOTICE("set_robust_list");
 
  if (len != 3 * sizeof(uintptr_t)) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  // The list is mutable userspace state. Linux registers its address without
  // touching it; exit processing must bound and validate each later access.
  Thread* current = Processor::information().getCurrentThread();
  current->setRobustList(reinterpret_cast<uintptr_t>(head),
                         linuxAbi ? current->getTaskId() : current->getId());
 
  return 0;
}
 
int posix_ioperm(unsigned long from, unsigned long num, int turn_on) {
  SC_NOTICE("ioperm(" << from << ", " << num << ", " << turn_on << ")");
 
  return 0;
}
 
int posix_iopl(int level) {
  SC_NOTICE("iopl(" << level << ")");
  return 0;
}
 
#undef SC_NOTICE
#define SC_NOTICE(x)
 
namespace {
constexpr Time::Timestamp MaximumLinuxTimerNanoseconds = 0x7FFFFFFFFFFFFFFFULL;
 
IntervalTimer* selectIntervalTimer(PosixProcess* process, int which) {
  switch (which) {
    case ITIMER_REAL:
      return &process->getRealIntervalTimer();
    case ITIMER_VIRTUAL:
      return &process->getVirtualIntervalTimer();
    case ITIMER_PROF:
      return &process->getProfileIntervalTimer();
    default:
      return nullptr;
  }
}
 
bool validIntervalTimeval(const struct timeval& value) {
  return value.tv_sec >= 0 && value.tv_usec >= 0 && value.tv_usec < 1000000;
}
 
Time::Timestamp intervalTimevalToNanoseconds(const struct timeval& value) {
  const Time::Timestamp microseconds =
      static_cast<Time::Timestamp>(value.tv_usec) * Time::Multiplier::Microsecond;
  const Time::Timestamp seconds = static_cast<Time::Timestamp>(value.tv_sec);
  if (seconds >= MaximumLinuxTimerNanoseconds / Time::Multiplier::Second) {
    return MaximumLinuxTimerNanoseconds;
  }
  return seconds * Time::Multiplier::Second + microseconds;
}
 
struct itimerval intervalTimerToUser(Time::Timestamp interval, Time::Timestamp value) {
  struct itimerval result = {};
  result.it_interval.tv_sec = interval / Time::Multiplier::Second;
  result.it_interval.tv_usec =
      (interval % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
  result.it_value.tv_sec = value / Time::Multiplier::Second;
  result.it_value.tv_usec = (value % Time::Multiplier::Second) / Time::Multiplier::Microsecond;
  return result;
}
}  // namespace
 
int posix_getitimer(int which, struct itimerval* curr_value) {
  SC_NOTICE("posix_getitimer(" << which << ", " << curr_value << ")");
 
  Thread* currentThread = Processor::information().getCurrentThread();
  PosixProcess* pProcess = static_cast<PosixProcess*>(currentThread->getParent());
 
  Time::Timestamp interval = 0;
  Time::Timestamp value = 0;
 
  IntervalTimer* itimer = selectIntervalTimer(pProcess, which);
  if (!itimer) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  if (which != ITIMER_REAL) {
    currentThread->trackTime(CpuTimeMode::Kernel);
  }
  itimer->getIntervalAndValue(interval, value);
 
  const struct itimerval result = intervalTimerToUser(interval, value);
  if (!PosixSubsystem::copyToUser(curr_value, &result, sizeof(result))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
 
  SC_NOTICE(" -> period = " << Dec << result.it_interval.tv_sec << "s "
                            << result.it_interval.tv_usec << "us");
  SC_NOTICE(" -> value = " << Dec << result.it_value.tv_sec << "s " << result.it_value.tv_usec
                           << "us");
 
  return 0;
}
 
int posix_setitimer(int which, const struct itimerval* new_value, struct itimerval* old_value) {
  SC_NOTICE("posix_setitimer(" << which << ", " << new_value << ", " << old_value << ")");
 
  struct itimerval requested = {};
  if (new_value && !PosixSubsystem::copyFromUser(&requested, new_value, sizeof(requested))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  if (!validIntervalTimeval(requested.it_interval) || !validIntervalTimeval(requested.it_value)) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  SC_NOTICE(" -> period = " << Dec << requested.it_interval.tv_sec << "s "
                            << requested.it_interval.tv_usec << "us");
  SC_NOTICE(" -> value = " << Dec << requested.it_value.tv_sec << "s " << requested.it_value.tv_usec
                           << "us");
 
  Thread* currentThread = Processor::information().getCurrentThread();
  PosixProcess* pProcess = static_cast<PosixProcess*>(currentThread->getParent());
 
  const Time::Timestamp interval = intervalTimevalToNanoseconds(requested.it_interval);
  const Time::Timestamp value = intervalTimevalToNanoseconds(requested.it_value);
  Time::Timestamp prevInterval = 0;
  Time::Timestamp prevValue = 0;
 
  IntervalTimer* itimer = selectIntervalTimer(pProcess, which);
  if (!itimer) {
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
 
  if (which != ITIMER_REAL) {
    currentThread->trackTime(CpuTimeMode::Kernel);
  }
  itimer->setIntervalAndValue(interval, value, &prevInterval, &prevValue);
 
  if (old_value) {
    const struct itimerval previous = intervalTimerToUser(prevInterval, prevValue);
    if (!PosixSubsystem::copyToUser(old_value, &previous, sizeof(previous))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
  }
 
  return 0;
}
 
int posix_capget(void* hdrp, void* datap) {
  if (!getPosixProcess()) {
    return -1;
  }
  cap_header header = {};
  if (!PosixSubsystem::copyFromUser(&header, hdrp, sizeof(header))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  if (header.version != _LINUX_CAPABILITY_VERSION_1) {
    const uint32_t version = _LINUX_CAPABILITY_VERSION_1;
    if (!PosixSubsystem::copyToUser(hdrp, &version, sizeof(version))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
  if (datap) {
    const cap_data data = {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF};
    if (!PosixSubsystem::copyToUser(datap, &data, sizeof(data))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
  }
  return 0;
}
 
int posix_capset(void* hdrp, const void* datap) {
  cap_header header = {};
  if (!PosixSubsystem::copyFromUser(&header, hdrp, sizeof(header))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  if (header.version != _LINUX_CAPABILITY_VERSION_1) {
    const uint32_t version = _LINUX_CAPABILITY_VERSION_1;
    if (!PosixSubsystem::copyToUser(hdrp, &version, sizeof(version))) {
      SYSCALL_ERROR(BadAddress);
      return -1;
    }
    SYSCALL_ERROR(InvalidArgument);
    return -1;
  }
  cap_data data = {};
  if (!PosixSubsystem::copyFromUser(&data, datap, sizeof(data))) {
    SYSCALL_ERROR(BadAddress);
    return -1;
  }
  // Capability policy remains the existing all-granted no-op contract.
  return 0;
}