starry-kernel 0.10.2

use alloc::sync::Arc;

use ax_fs_ng::vfs::FS_CONTEXT;
use ax_runtime::hal::cpu::user::UserContext;
use bitflags::bitflags;
use linux_raw_sys::general::*;
use scope_local::Scope;
use starry_signal::Signo;

use super::schedule_abi::fork_schedule_policy;
use crate::{
    StarryError, StarryResult,
    file::{FD_TABLE, PidFd, PreparedFileDescriptor, prepare_file_like},
    mm::{MmHandle, VmMutPtr, copy_from_kernel},
    sync::RawSpinLock,
    task::{
        PidIdentity, PidReservation, PidReservationKind, ProcessData, ProcessDataInit,
        ProcessImage, Tgid, Thread, Tid, TidNumber, UserThreadInitialSchedulerState,
        UserThreadOptions, new_user_task, prepare_user_thread,
    },
};

/// Aborts PID identity publication if clone fails before spawn.
///
/// Prepared topology and scoped resources are owned by their own rollback
/// tokens; the PID reservation remains unpublished until the final commit.
struct CloneTransaction {
    identity: Arc<PidIdentity>,
    committed: bool,
}

impl CloneTransaction {
    fn new(identity: Arc<PidIdentity>) -> Self {
        Self {
            identity,
            committed: false,
        }
    }

    fn commit(&mut self) {
        self.committed = true;
    }
}

impl Drop for CloneTransaction {
    fn drop(&mut self) {
        if self.committed {
            return;
        }
        self.identity.abort_failed_task_publication();
    }
}

bitflags! {
    /// Options for use with [`sys_clone`] and [`sys_clone3`].
    #[derive(Debug, Clone, Copy, Default)]
    pub struct CloneFlags: u64 {
        /// The calling process and the child process run in the same memory space.
        const VM = CLONE_VM as u64;
        /// The caller and the child process share the same filesystem information.
        const FS = CLONE_FS as u64;
        /// The calling process and the child process share the same file descriptor table.
        const FILES = CLONE_FILES as u64;
        /// The calling process and the child process share the same table of signal handlers.
        const SIGHAND = CLONE_SIGHAND as u64;
        /// Sets pidfd to the child process's PID file descriptor.
        const PIDFD = CLONE_PIDFD as u64;
        /// If the calling process is being traced, then trace the child also.
        const PTRACE = CLONE_PTRACE as u64;
        /// The execution of the calling process is suspended until the child releases
        /// its virtual memory resources via a call to execve(2) or _exit(2) (as with vfork(2)).
        const VFORK = CLONE_VFORK as u64;
        /// The parent of the new child (as returned by getppid(2)) will be the same
        /// as that of the calling process.
        const PARENT = CLONE_PARENT as u64;
        /// The child is placed in the same thread group as the calling process.
        const THREAD = CLONE_THREAD as u64;
        /// The cloned child is started in a new mount namespace.
        const NEWNS = CLONE_NEWNS as u64;
        /// The child and the calling process share a single list of System V
        /// semaphore adjustment values.
        const SYSVSEM = CLONE_SYSVSEM as u64;
        /// The TLS (Thread Local Storage) descriptor is set to tls.
        const SETTLS = CLONE_SETTLS as u64;
        /// Store the child thread ID in the parent's memory.
        const PARENT_SETTID = CLONE_PARENT_SETTID as u64;
        /// Clear (zero) the child thread ID in child memory when the child exits,
        /// and do a wakeup on the futex at that address.
        const CHILD_CLEARTID = CLONE_CHILD_CLEARTID as u64;
        /// A tracing process cannot force `CLONE_PTRACE` on this child process.
        const UNTRACED = CLONE_UNTRACED as u64;
        /// Store the child thread ID in the child's memory.
        const CHILD_SETTID = CLONE_CHILD_SETTID as u64;
        /// Create the process in a new cgroup namespace.
        const NEWCGROUP = CLONE_NEWCGROUP as u64;
        /// Create the process in a new UTS namespace.
        const NEWUTS = CLONE_NEWUTS as u64;
        /// Create the process in a new IPC namespace.
        const NEWIPC = CLONE_NEWIPC as u64;
        /// Create the process in a new user namespace.
        const NEWUSER = CLONE_NEWUSER as u64;
        /// Create the process in a new PID namespace.
        const NEWPID = CLONE_NEWPID as u64;
        /// Create the process in a new network namespace.
        const NEWNET = CLONE_NEWNET as u64;
        /// The new process shares an I/O context with the calling process.
        const IO = CLONE_IO as u64;
        /// Clear signal handlers on clone (since Linux 5.5).
        const CLEAR_SIGHAND = 0x100000000u64;
        /// Clone into specific cgroup (since Linux 5.7).
        const INTO_CGROUP = 0x200000000u64;
        /// (Deprecated) Causes the parent not to receive a signal when the child terminated.
        const DETACHED = CLONE_DETACHED as u64;
    }
}

// The `sched:sched_process_fork` tracepoint is defined here, next to its sole
// emission site in `CloneArgs::do_clone` (which all of clone/clone3/fork/vfork
// funnel through), so the event schema and the fast-path call stay together.
// Registration into the global `.tracepoint` section is by link section, so
// the definition's module location is immaterial to discovery.
ax_tracepoint::define_event_trace!(
    sched_process_fork,
    TP_kops(crate::tracepoint::KernelTraceAux),
    TP_system(sched),
    TP_PROTO(parent_tid: u64, child_tid: u64),
    TP_STRUCT__entry {
        parent_tid: u64,
        child_tid: u64,
    },
    TP_fast_assign {
        parent_tid: parent_tid,
        child_tid: child_tid,
    },
    TP_ident(__entry),
    TP_printk({
        alloc::format!(
            "parent_tid={} child_tid={}",
            __entry.parent_tid,
            __entry.child_tid,
        )
    })
);

fn emit_sched_process_fork(parent_tid: TidNumber, child_tid: TidNumber) {
    trace_sched_process_fork(parent_tid.get() as u64, child_tid.get() as u64);
}

/// Unified arguments for clone/clone3/fork/vfork.
#[derive(Debug, Clone, Copy, Default)]
pub struct CloneArgs {
    pub flags: CloneFlags,
    pub exit_signal: u64,
    pub stack: usize,
    pub tls: usize,
    pub parent_tid: usize,
    pub child_tid: usize,
    pub pidfd: usize,
}

impl CloneArgs {
    fn validate(&self) -> StarryResult<()> {
        let Self { flags, .. } = self;
        if flags.contains(CloneFlags::THREAD)
            && !flags.contains(CloneFlags::VM | CloneFlags::SIGHAND)
        {
            return Err(StarryError::InvalidInput);
        }
        if flags.contains(CloneFlags::SIGHAND) && !flags.contains(CloneFlags::VM) {
            return Err(StarryError::InvalidInput);
        }
        if flags.contains(CloneFlags::PIDFD | CloneFlags::DETACHED) {
            return Err(StarryError::InvalidInput);
        }
        if flags.contains(CloneFlags::NEWNS | CloneFlags::FS) {
            return Err(StarryError::InvalidInput);
        }
        // A thread must remain in the PID namespace of its thread group.
        // CLONE_PARENT only changes parentage, so Linux permits it with
        // CLONE_NEWPID. clone3 separately requires a zero exit signal when
        // CLONE_PARENT is present.
        if flags.contains(CloneFlags::NEWPID | CloneFlags::THREAD) {
            return Err(StarryError::InvalidInput);
        }
        if flags.contains(CloneFlags::INTO_CGROUP | CloneFlags::THREAD) {
            return Err(StarryError::InvalidInput);
        }

        Ok(())
    }

    fn validate_cgroup_target(&self, has_requested_cgroup: bool) -> StarryResult<()> {
        self.validate()?;
        if self.flags.contains(CloneFlags::INTO_CGROUP) != has_requested_cgroup {
            return Err(StarryError::InvalidInput);
        }
        Ok(())
    }

    pub fn do_clone(
        self,
        current: &crate::task::UserTaskRef,
        uctx: &UserContext,
    ) -> crate::StarryResult<isize> {
        self.do_clone_in_cgroup(current, uctx, None)
    }

    pub(super) fn do_clone_in_cgroup(
        self,
        current: &crate::task::UserTaskRef,
        uctx: &UserContext,
        requested_cgroup: Option<Arc<ax_cgroup::CgroupNode>>,
    ) -> StarryResult<isize> {
        self.validate_cgroup_target(requested_cgroup.is_some())?;

        let Self {
            flags,
            exit_signal,
            stack,
            tls,
            parent_tid: parent_tid_ptr,
            child_tid,
            pidfd,
        } = self;

        debug!(
            "do_clone <= flags: {:?}, exit_signal: {}, stack: {:#x}, tls: {:#x}",
            flags, exit_signal, stack, tls
        );

        let exit_signal = if exit_signal > 0 {
            Some(Signo::from_repr(exit_signal as u8).ok_or(StarryError::InvalidInput)?)
        } else {
            None
        };

        // Linux blocks the parent for every CLONE_VFORK clone until the child
        // execs or exits, regardless of whether the caller passed a child stack.
        // BusyBox shell/timeout paths rely on that ordering when they combine
        // CLONE_VM, CLONE_VFORK, and a private child stack.
        let needs_vfork_block = flags.contains(CloneFlags::VFORK);

        let mut new_uctx = *uctx;
        new_uctx.prepare_clone_child_return_state();
        if stack != 0 {
            new_uctx.set_sp(stack);
        }
        if flags.contains(CloneFlags::SETTLS) {
            new_uctx.set_tls(tls);
        }
        new_uctx.set_retval(0);
        #[cfg(target_arch = "riscv64")]
        let child_fp_fs = match uctx.sstatus.fs() {
            riscv::register::sstatus::FS::Dirty => riscv::register::sstatus::FS::Clean,
            fs => fs,
        };
        #[cfg(target_arch = "riscv64")]
        new_uctx.sstatus.set_fs(child_fp_fs);

        let set_child_tid = if flags.contains(CloneFlags::CHILD_SETTID) {
            child_tid
        } else {
            0
        };

        let curr = current;
        let curr_thread = curr.as_thread();
        let old_proc_data = &curr_thread.proc_data;
        if flags.contains(CloneFlags::NEWCGROUP) && !curr_thread.cred().has_cap_sys_admin() {
            return Err(StarryError::OperationNotPermitted);
        }
        let (child_policy, child_reset_on_fork) =
            fork_schedule_policy(curr.base_policy(), curr.reset_on_fork())?;
        let child_nice = match child_policy {
            ax_std::os::arceos::task::sched::SchedulePolicy::Fair { nice, .. } => {
                i32::from(nice.get())
            }
            _ => curr_thread.nice(),
        };
        let child_scheduler_state = UserThreadInitialSchedulerState::new(
            child_policy,
            curr.affinity(),
            child_reset_on_fork,
        );

        #[cfg(target_arch = "riscv64")]
        let child_fp_state = {
            let mut fp_state = ax_cpu::registers::FpState::default();
            fp_state.save();
            fp_state.fs = child_fp_fs;
            fp_state
        };

        let parent_pid_ns = curr_thread.active_pid_namespace();
        let target_pid_ns = if flags.contains(CloneFlags::THREAD) {
            parent_pid_ns.clone()
        } else if flags.contains(CloneFlags::NEWPID) {
            crate::namespace::PidNamespace::new_child(parent_pid_ns.clone())
        } else {
            old_proc_data.nsproxy.lock().pid_ns_for_children.clone()
        };
        let reservation_kind = if flags.contains(CloneFlags::THREAD) {
            PidReservationKind::Thread
        } else {
            PidReservationKind::ProcessLeader
        };
        let reservation = PidReservation::reserve(&target_pid_ns, reservation_kind)?;
        let root_tid = TidNumber::from(
            reservation
                .number_in(&crate::task::ROOT_PID_NS)
                .ok_or(StarryError::BadState)?,
        );
        let parent_visible_tid = TidNumber::from(
            reservation
                .number_in(&parent_pid_ns)
                .ok_or(StarryError::BadState)?,
        );
        let child_visible_tid = TidNumber::from(
            reservation
                .number_in(&target_pid_ns)
                .ok_or(StarryError::BadState)?,
        );
        let identity = reservation.identity();
        let tid_lease = identity.acquire_role::<Tid>()?;
        let mut tgid_lease = (!flags.contains(CloneFlags::THREAD))
            .then(|| identity.acquire_role::<Tgid>())
            .transpose()?;
        let mut clone_transaction = CloneTransaction::new(identity.clone());
        let mut prepared_fork = None;

        let child_kind = if flags.contains(CloneFlags::THREAD) {
            ax_cgroup::CgroupChildKind::Thread
        } else {
            ax_cgroup::CgroupChildKind::Process
        };
        let mut cgroup_guard = match (child_kind, requested_cgroup) {
            (ax_cgroup::CgroupChildKind::Process, Some(target)) => {
                crate::cgroup::begin_process_at(target, &identity)?
            }
            (kind, None) => crate::cgroup::begin_task(old_proc_data, &identity, kind)?,
            (ax_cgroup::CgroupChildKind::Thread, Some(_)) => {
                unreachable!("CLONE_INTO_CGROUP with CLONE_THREAD passed validation")
            }
        };
        let child_cgroup = cgroup_guard.cgroup();
        let mut prepared_nsproxy = (!flags.contains(CloneFlags::THREAD)).then(|| {
            let mut nsproxy = old_proc_data.nsproxy.lock().clone_all();
            if flags.contains(CloneFlags::NEWUTS) {
                nsproxy.unshare_uts();
            }
            if flags.contains(CloneFlags::NEWIPC) {
                nsproxy.unshare_ipc();
            }
            if flags.contains(CloneFlags::NEWNS) {
                nsproxy.unshare_mnt();
            }
            if flags.contains(CloneFlags::NEWNET) {
                nsproxy.unshare_net();
            }
            if flags.contains(CloneFlags::NEWUSER) {
                nsproxy.unshare_user();
            }
            if flags.contains(CloneFlags::NEWCGROUP) {
                nsproxy.unshare_cgroup(child_cgroup.clone());
            }
            if flags.contains(CloneFlags::NEWPID) {
                nsproxy.pid_ns_for_children = target_pid_ns.clone();
            }
            nsproxy
        });

        let new_proc_data = if flags.contains(CloneFlags::THREAD) {
            old_proc_data.clone()
        } else {
            let prepared = if flags.contains(CloneFlags::PARENT) {
                old_proc_data
                    .proc
                    .parent()
                    .ok_or(StarryError::InvalidInput)?
            } else {
                old_proc_data.proc.clone()
            }
            .prepare_fork(identity.clone())?;
            let proc = prepared.process().clone();
            prepared_fork = Some(prepared);

            let aspace = if flags.contains(CloneFlags::VM) {
                old_proc_data
                    .clone_aspace_user_ref()
                    .map_err(|_| StarryError::InvalidInput)?
            } else {
                let parent_mm = old_proc_data.pin_aspace()?;
                let aspace = parent_mm.lock().try_clone()?;
                copy_from_kernel(&mut aspace.lock())?;
                MmHandle::from_arc(aspace).map_err(|_| StarryError::BadState)?
            };

            let signal_actions = if flags.contains(CloneFlags::SIGHAND) {
                old_proc_data.signal.actions()
            } else if flags.contains(CloneFlags::CLEAR_SIGHAND) {
                Arc::new(RawSpinLock::new(Default::default()))
            } else {
                Arc::new(RawSpinLock::new(
                    old_proc_data.signal.actions().lock_irqsave().clone(),
                ))
            };

            let process_image = ProcessImage::new(
                old_proc_data.exe_path().as_ref().clone(),
                old_proc_data.cmdline(),
                old_proc_data.envp(),
                old_proc_data.auxv().as_ref().clone(),
                old_proc_data.root_path().as_ref().clone(),
                old_proc_data.cwd_path().as_ref().clone(),
            );
            let mut process_init = ProcessDataInit::new(
                process_image,
                aspace,
                signal_actions,
                prepared_nsproxy
                    .take()
                    .expect("process clone must prepare one namespace proxy"),
                exit_signal,
                curr_thread.tid_number(),
            )
            .with_cgroup(child_cgroup.clone());
            if flags.contains(CloneFlags::VM) {
                process_init = process_init.with_shared_memory(old_proc_data);
            }
            let proc_data = ProcessData::new(
                proc,
                identity.clone(),
                tgid_lease
                    .take()
                    .expect("process clone must own one TGID lease"),
                process_init,
            );
            proc_data.set_umask(old_proc_data.umask());
            proc_data.replace_personality(old_proc_data.personality());
            // Inherit parent dumpable (PR_SET_DUMPABLE state). Linux: child
            // fork/clone copies mm->dumpable from parent; without this, a
            // child of `prctl(PR_SET_DUMPABLE, 0) -> fork()` would reset to
            // SUID_DUMP_USER (1), breaking the safety semantics this PR is
            // supposed to enforce. Verified via Linux host: parent sets 0,
            // fork child PR_GET_DUMPABLE returns 0.
            proc_data.set_dumpable(old_proc_data.dumpable());
            proc_data.set_transparent_huge_page_mode(old_proc_data.transparent_huge_page_mode())?;

            proc_data
        };

        let mut scope = Scope::new();
        let current_fd_table = crate::file::current_fd_table();
        if flags.contains(CloneFlags::FILES) {
            // Synchronize with close_all_fds: holding a read lock ensures
            // close_all_fds either observes our strong-count increment or
            // blocks until the new thread has installed the shared Arc.
            let _guard = current_fd_table.read();
            FD_TABLE
                .scope_mut(&mut scope)
                .clone_from(&crate::file::new_file_table_scope(current_fd_table.clone()));
        } else {
            FD_TABLE
                .scope_mut(&mut scope)
                .clone_from(&crate::file::clone_file_table_scope(&current_fd_table));
        }

        let current_fs_context = ax_fs_ng::vfs::current_fs_context();
        if flags.contains(CloneFlags::FS) {
            FS_CONTEXT
                .scope_mut(&mut scope)
                .clone_from(&Some(current_fs_context));
        } else {
            let mut fs_context = current_fs_context.lock().clone();
            if flags.contains(CloneFlags::NEWNS) {
                fs_context.unshare_mount_namespace()?;
            }
            *FS_CONTEXT.scope_mut(&mut scope) = Some(fs_context.into_shared());
        }

        let parent_cred = Some(curr_thread.cred());
        let thr = Thread::new(
            identity.clone(),
            tid_lease,
            new_proc_data.clone(),
            parent_cred,
            curr_thread.signal().blocked(),
            scope,
        )?;
        thr.set_nice(child_nice);
        if flags.contains(CloneFlags::CHILD_CLEARTID) {
            thr.set_clear_child_tid(child_tid);
        }
        let mut prepared_pidfd: Option<PreparedFileDescriptor> = None;
        let mut pidfd_copyout = None;
        if flags.contains(CloneFlags::PIDFD) {
            // The pidfd and later namespace publication share the prepared
            // identity. Until the final commit, PID-number lookup cannot see it.
            let pidfd_obj = if flags.contains(CloneFlags::THREAD) {
                PidFd::new_thread(identity.clone(), &thr, root_tid)
            } else {
                PidFd::new_process(identity.clone())
            };
            let prepared = prepare_file_like(
                || Ok(Arc::try_new(pidfd_obj).map_err(|_| StarryError::NoMemory)?),
                true,
            )?;
            let fd = prepared.fd();
            prepared_pidfd = Some(prepared);
            pidfd_copyout = Some((pidfd as *mut i32, fd));
        }

        // vfork(2) and clone(CLONE_VFORK) must sleep the parent until the child
        // execs or exits. Use PollSet so the parent's wait remains
        // interruptible by task.interrupt().
        if needs_vfork_block {
            thr.prepare_vfork_done()?;
        }

        let options = UserThreadOptions::new(curr.name().as_ref())
            .map_err(map_task_creation_error)?
            .with_scheduler_state(child_scheduler_state);
        #[cfg(target_arch = "riscv64")]
        let options = options.with_fp_state(child_fp_state);
        #[cfg(not(target_arch = "riscv64"))]
        let options = options.inherit_current_fp();
        let prepared_task = prepare_user_thread(
            new_user_task(new_uctx, set_child_tid, child_visible_tid),
            thr,
            options,
        )
        .map_err(map_task_creation_error)?;

        #[cfg(target_arch = "aarch64")]
        prepared_task
            .with_task(|task| crate::perf::task::on_clone_inherit(curr_thread, task.as_thread()));
        let staged_task = prepared_task.stage().map_err(map_task_creation_error)?;
        staged_task
            .with_task(|task| crate::perf::sw::on_clone_inherit(curr_thread, task.as_thread()));
        if let Some((pidfd_ptr, fd)) = pidfd_copyout {
            pidfd_ptr.vm_write(current, fd)?;
        }
        cgroup_guard.publish()?;

        // All resource preparation is complete. Publish topology while the
        // PID reservation and scheduler start gate still make the child
        // unreachable; the token rolls topology back if PID publication fails.
        let published_fork = prepared_fork
            .take()
            .map(|prepared| prepared.publish().ok_or(StarryError::WouldBlock))
            .transpose()?;

        staged_task.with_task(|task| {
            publish_clone(curr_thread, task.as_thread(), || {
                // PID publication is the final fallible visibility edge.
                let published_identity = reservation.publish()?;
                debug_assert!(Arc::ptr_eq(&published_identity, &identity));
                if let Some(published) = published_fork {
                    let process = published.commit();
                    debug_assert!(Arc::ptr_eq(&process, &new_proc_data.proc));
                }
                task.as_thread().attach_pid_task(task);
                new_proc_data.proc.add_thread(root_tid);
                Ok(())
            })
        })?;
        if let Some(pidfd) = prepared_pidfd.take() {
            pidfd.install();
        }
        if flags.contains(CloneFlags::PARENT_SETTID) && parent_tid_ptr != 0 {
            // Linux performs this copyout after the child is visible and does
            // not roll the child back if a concurrent unmap makes it fail.
            let _ = (parent_tid_ptr as *mut u32).vm_write(current, parent_visible_tid.get());
        }

        let parent_pid = curr.as_thread().proc_data.proc.pid_number();
        // The user-visible tid, not the scheduler id: they diverge for the init
        // process (pid/tid pinned to 1, scheduler id higher). Signal delivery
        // and ptrace below look this up in the tid-keyed task table.
        let parent_tid = curr.as_thread().tid_number();
        let ptrace_event = if flags.contains(CloneFlags::THREAD) {
            super::ptrace::PTRACE_EVENT_CLONE
        } else if flags.contains(CloneFlags::VFORK) {
            super::ptrace::PTRACE_EVENT_VFORK
        } else {
            super::ptrace::PTRACE_EVENT_FORK
        };
        let trace_clone =
            super::ptrace::ptrace_notify_clone(parent_pid, parent_tid, &identity, ptrace_event);
        if trace_clone && let Some(tracer) = curr.as_thread().proc_data.ptrace_tracer_identity() {
            if !flags.contains(CloneFlags::THREAD) {
                new_proc_data.set_ptrace_tracer(&tracer);
                let attach_mode = if curr.as_thread().proc_data.is_ptrace_seized() {
                    crate::task::PtraceAttachMode::Seize
                } else {
                    crate::task::PtraceAttachMode::Attach
                };
                new_proc_data.set_ptrace_attach_mode(attach_mode);
            }
            new_proc_data.set_ptrace_stop(root_tid, starry_signal::Signo::SIGSTOP, &new_uctx);
        }

        cgroup_guard.commit();
        clone_transaction.commit();
        let task = staged_task.activate();

        if trace_clone && needs_vfork_block {
            let _ = crate::task::send_signal_to_thread(
                None,
                parent_tid,
                Some(starry_signal::SignalInfo::new_kernel(
                    starry_signal::Signo::SIGTRAP,
                )),
            );
        }

        // Fire before any potential vfork-wait so observers see the fork edge
        // even when the parent blocks below.
        emit_sched_process_fork(curr_thread.tid(), root_tid);

        // perf side-band: tell any `attr.task` event watching the parent that it
        // forked a child (PERF_RECORD_FORK), so `perf record` can account it.
        // Emitted before any vfork-wait below, in the parent's context.
        #[cfg(target_arch = "aarch64")]
        crate::perf::task::on_clone_sideband(
            curr.as_thread(),
            &new_proc_data.identity(),
            &identity,
        );

        // Block the parent until the child exec's or exits.
        if needs_vfork_block && task.as_thread().wait_vfork_done(current) {
            let _ = super::ptrace::ptrace_notify_vfork_done(parent_pid, parent_tid, &identity);
        }

        Ok(parent_visible_tid.get() as _)
    }
}

fn publish_clone(
    parent: &Thread,
    child: &Thread,
    publish: impl FnOnce() -> StarryResult<()>,
) -> StarryResult<()> {
    // Linux copy_seccomp and TSYNC hold a common lock through thread-group
    // insertion. Refresh only after private preparation, while TASK_NEW cannot
    // execute; TSYNC either precedes this snapshot or includes the published child.
    let _update = parent.proc_data.thread_group_update();
    // Linux copy_process checks fatal_signal_pending under the publication
    // lock and returns EINTR before the child becomes Linux-visible.
    if parent.signal().pending().has(Signo::SIGKILL) {
        return Err(StarryError::Interrupted);
    }
    child.inherit_security(parent)?;
    publish()
}

fn map_task_creation_error(error: ax_std::os::arceos::task::thread::TaskError) -> StarryError {
    use ax_std::os::arceos::task::thread::TaskError;

    match error {
        TaskError::ThreadCapacity => StarryError::WouldBlock,
        TaskError::TimerCapacity => StarryError::NoMemory,
        TaskError::RuntimeFailure(status)
            if status == ax_std::os::arceos::task::runtime::RuntimeStatus::NoMemory as u32 =>
        {
            StarryError::NoMemory
        }
        TaskError::DeadlineAdmission | TaskError::ThreadBusy => StarryError::ResourceBusy,
        _ => StarryError::BadState,
    }
}

ax_tracepoint::define_event_trace!(
    sys_clone,
    TP_kops(crate::tracepoint::KernelTraceAux),
    TP_system(syscalls),
    TP_PROTO(flags: u32, stack: usize, parent_tid: usize),
    TP_STRUCT__entry {
        stack: usize,
        parent_tid: usize,
        flags: u32,
    },
    TP_fast_assign {
        flags: flags,
        stack: stack,
        parent_tid: parent_tid,
    },
    TP_ident(__entry),
    TP_printk({
        let flags = __entry.flags;
        let stack = __entry.stack;
        let parent_tid = __entry.parent_tid;
        alloc::format!("clone with flags: {flags}, stack: {stack:#x}, parent_tid: {parent_tid:#x}")
    })
);

pub fn sys_clone(
    current: &crate::task::UserTaskRef,
    uctx: &UserContext,
    flags: u32,
    stack: usize,
    parent_tid: usize,
    #[cfg(any(target_arch = "x86_64", target_arch = "loongarch64"))] child_tid: usize,
    tls: usize,
    #[cfg(not(any(target_arch = "x86_64", target_arch = "loongarch64")))] child_tid: usize,
) -> StarryResult<isize> {
    const FLAG_MASK: u32 = 0xff;
    let clone_flags = CloneFlags::from_bits_truncate((flags & !FLAG_MASK) as u64);
    let exit_signal = (flags & FLAG_MASK) as u64;

    trace_sys_clone(clone_flags.bits() as _, stack, parent_tid);

    if clone_flags.contains(CloneFlags::PIDFD | CloneFlags::PARENT_SETTID) {
        return Err(StarryError::InvalidInput);
    }

    let args = CloneArgs {
        flags: clone_flags,
        exit_signal,
        stack,
        tls,
        parent_tid,
        child_tid,
        // In sys_clone, parent_tid is reused for pidfd when CLONE_PIDFD is set
        pidfd: if clone_flags.contains(CloneFlags::PIDFD) {
            parent_tid
        } else {
            0
        },
    };

    args.do_clone(current, uctx)
}

#[cfg(target_arch = "x86_64")]
pub fn sys_fork(
    current: &crate::task::UserTaskRef,
    uctx: &UserContext,
) -> crate::StarryResult<isize> {
    sys_clone(current, uctx, SIGCHLD, 0, 0, 0, 0)
}

#[cfg(target_arch = "x86_64")]
pub fn sys_vfork(
    current: &crate::task::UserTaskRef,
    uctx: &UserContext,
) -> crate::StarryResult<isize> {
    let flags = (CloneFlags::VFORK | CloneFlags::VM).bits() as u32 | SIGCHLD;
    sys_clone(current, uctx, flags, 0, 0, 0, 0)
}

#[cfg(all(test, axtest))]
mod axtests {
    use alloc::sync::Arc;

    use super::CloneTransaction;
    use crate::task::{PidReservation, PidReservationKind, Tgid, Tid};

    #[axtest::axtest]
    fn clone_publication_refreshes_security_after_preparation() {
        use crate::task::{ROOT_PID_NS, Thread};
        let make_thread = || {
            let reservation =
                PidReservation::reserve(&ROOT_PID_NS, PidReservationKind::ProcessLeader).unwrap();
            let identity = reservation.identity();
            let tid = identity.acquire_role::<Tid>().unwrap();
            let tgid = identity.acquire_role::<Tgid>().unwrap();
            let process = crate::task::new_test_process_data(identity.clone(), tgid);
            let thread = Thread::new(
                identity,
                tid,
                process,
                None,
                Default::default(),
                scope_local::Scope::new(),
            )
            .unwrap();
            (reservation, thread)
        };
        let (_parent_reservation, parent) = make_thread();
        let (_child_reservation, child) = make_thread();
        child.set_seccomp_state(parent.seccomp_state());
        // A completed TSYNC may update the parent while clone is preparing
        // private execution resources and the child is absent from its scan.
        parent.set_no_new_privs();
        parent
            .append_seccomp_filter(alloc::vec![crate::task::SockFilter {
                code: 0x06, // BPF_RET | BPF_K
                jt: 0,
                jf: 0,
                k: 0x7fff_0000, // SECCOMP_RET_ALLOW
            }])
            .unwrap();
        let updated = parent.seccomp_state();
        let original = child.seccomp_state();
        let probe = ax_std::os::arceos::task::thread::ThreadAllocationProbe::fail_at(0).unwrap();
        let failed = super::publish_clone(&parent, &child, || {
            panic!("failed security inheritance must not publish a child")
        });
        let attempts = probe.attempts();
        drop(probe);
        assert_eq!(failed.unwrap_err().linux_errno(), syscalls::Errno::ENOMEM);
        assert_eq!(attempts, 1);
        assert!(Arc::ptr_eq(&original, &child.seccomp_state()));
        assert!(!child.no_new_privs());
        assert!(!child.has_seccomp_syscall_work());
        super::publish_clone(&parent, &child, || {
            assert!(child.no_new_privs(), "clone published stale no_new_privs");
            assert!(
                Arc::ptr_eq(&updated, &child.seccomp_state()),
                "clone published a stale seccomp snapshot"
            );
            assert!(child.has_seccomp_syscall_work());
            Ok(())
        })
        .unwrap();
        assert!(parent.signal().send_signal(
            starry_signal::SignalInfo::new_kernel(starry_signal::Signo::SIGKILL),
            false,
        ));
        let interrupted = super::publish_clone(&parent, &child, || {
            panic!("fatal parent must not publish a child")
        });
        assert_eq!(
            interrupted.unwrap_err().linux_errno(),
            syscalls::Errno::EINTR
        );
    }

    #[axtest::axtest]
    fn creation_errors_preserve_resource_domain() {
        use ax_std::os::arceos::task::{runtime::RuntimeStatus, thread::TaskError};
        use syscalls::Errno;
        let errors = [
            TaskError::ThreadCapacity,
            TaskError::RuntimeFailure(RuntimeStatus::NoMemory as u32),
            TaskError::RuntimeFailure(RuntimeStatus::Platform as u32),
        ];
        assert_eq!(
            errors.map(|error| super::map_task_creation_error(error).linux_errno()),
            [Errno::EAGAIN, Errno::ENOMEM, Errno::EFAULT],
            "clone must distinguish thread limits, OOM, and runtime faults"
        );
    }

    #[axtest::axtest]
    fn unpublished_process_rollback_releases_identity_and_topology() {
        let namespace = crate::task::new_test_pid_namespace();
        let reservation =
            PidReservation::reserve(&namespace, PidReservationKind::ProcessLeader).unwrap();
        let identity = reservation.identity();
        let retired_identity = Arc::downgrade(&identity);
        let tid = identity.acquire_role::<Tid>().unwrap();
        let tgid = identity.acquire_role::<Tgid>().unwrap();
        let transaction = CloneTransaction::new(identity.clone());
        let process = crate::task::new_test_process_data(identity.clone(), tgid);
        let retired_topology = Arc::downgrade(&process.proc);

        // Resource setup failed after binding process topology but before PID
        // publication. Run the actual clone transaction's cancellation path.
        drop(process);
        drop(transaction);
        drop(reservation);
        drop(tid);
        drop(identity);
        assert!(
            retired_topology.upgrade().is_none(),
            "cancelled clone retained process topology"
        );
        assert!(
            retired_identity.upgrade().is_none(),
            "cancelled clone retained PID identity"
        );
    }

    #[axtest::axtest]
    fn cancelled_process_releases_tgid_before_last_identity() {
        let namespace = crate::task::new_test_pid_namespace();
        let reservation =
            PidReservation::reserve(&namespace, PidReservationKind::ProcessLeader).unwrap();
        let identity = reservation.identity();
        let retired_identity = Arc::downgrade(&identity);
        let tid = identity.acquire_role::<Tid>().unwrap();
        let tgid = identity.acquire_role::<Tgid>().unwrap();
        let transaction = CloneTransaction::new(identity.clone());
        let process = crate::task::new_test_process_data(identity.clone(), tgid);
        let retired_topology = Arc::downgrade(&process.proc);

        // A staged task may retain ProcessData until the scheduler reclaims
        // its extension, after all caller-owned rollback tokens are gone.
        drop(transaction);
        drop(reservation);
        drop(tid);
        drop(identity);
        drop(process);
        assert!(
            retired_topology.upgrade().is_none(),
            "deferred clone retained process topology"
        );
        assert!(
            retired_identity.upgrade().is_none(),
            "deferred clone retained PID identity"
        );
    }
}