// SPDX-License-Identifier: GPL-3.0-or-later
// Copyright (C) 2026 Andrea Mazzoleni

#include "os/portable.h"

#ifdef __MINGW32__ /* only for MingW */

#include "os.h"

#include "tommyds/tommylist.h"

#include <userenv.h> /* CreateEnvironmentBlock */

/****************************************************************************/
/* global */

/* add missing Windows declaration */

/* for SetThreadExecutionState */
#ifndef WIN32_ES_SYSTEM_REQUIRED
#define WIN32_ES_SYSTEM_REQUIRED      0x00000001L
#endif
#ifndef WIN32_ES_DISPLAY_REQUIRED
#define WIN32_ES_DISPLAY_REQUIRED     0x00000002L
#endif
#ifndef WIN32_ES_USER_PRESENT
#define WIN32_ES_USER_PRESENT         0x00000004L
#endif
#ifndef WIN32_ES_AWAYMODE_REQUIRED
#define WIN32_ES_AWAYMODE_REQUIRED    0x00000040L
#endif
#ifndef WIN32_ES_CONTINUOUS
#define WIN32_ES_CONTINUOUS           0x80000000L
#endif

/* for SetSearchPathMode */
#ifndef BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE
#define BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE 0x00000001
#endif
#ifndef BASE_SEARCH_PATH_PERMANENT
#define BASE_SEARCH_PATH_PERMANENT 0x00008000
#endif

/* file Index */
#undef FILE_INVALID_FILE_ID
#define FILE_INVALID_FILE_ID          ((ULONGLONG)-1LL)
#undef FILE_UNSUPPORTED_FILE_ID
#define FILE_UNSUPPORTED_FILE_ID      0

/**
 * Direct access to RtlGenRandom().
 * This function is accessible only with LoadLibrary() and it's available from Windows XP.
 */
static BOOLEAN(WINAPI * ptr_RtlGenRandom)(PVOID, ULONG);

/**
 * Description of the last error.
 * It's stored in the thread local storage.
 */
static windows_key_t last_error;

/**
 * Monotone os_tick counter
 */
static windows_mutex_t tick_lock;
static uint64_t tick_last;
static uint64_t tick_frequency;

/**
 * Mutex for process reference publication, termination, and unpublication.
 */
static windows_mutex_t exec_mutex;

#define PID_NONE ((pid_t)0) /**< No process is active. */
#define PID_SPAWN ((pid_t)-1) /**< Process creation is in progress. */
#define PID_TERM ((pid_t)-2) /**< Process termination was requested while creation is in progress. */
#define PID_KILL ((pid_t)-3) /**< Process kill was requested; rejects future spawns or terminates in-progress/active processes. */

/**
 * Acquire the process execution mutex.
 */
static void exec_lock(void)
{
	windows_mutex_lock(&exec_mutex);
}

/**
 * Release the process execution mutex.
 */
static void exec_unlock(void)
{
	windows_mutex_unlock(&exec_mutex);
}

/**
 * Mark the start of process creation in a process-reference slot.
 */
static int pid_spawn_begin(pid_t* pid_slot)
{
	if (pid_slot == 0)
		return 0;

	exec_lock();
	if (*pid_slot == PID_KILL) {
		exec_unlock();
		errno = ECANCELED;
		return -1;
	}
	*pid_slot = PID_SPAWN;
	exec_unlock();
	return 0;
}

/**
 * Forcibly terminate the specified raw process reference.
 */
static int pid_kill(pid_t pid)
{
	if (pid <= 0) {
		errno = EINVAL;
		return -1;
	}

	HANDLE h = (void*)pid;

	if (!TerminateProcess(h, 1)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

/**
 * Gracefully terminate a process created by os_spawn() on Windows.
 *
 * os_spawn() creates console applications with both CREATE_NO_WINDOW and
 * CREATE_NEW_PROCESS_GROUP.
 *
 * CREATE_NO_WINDOW does not mean that the child is created as a detached
 * process with no console support. For a console application it provides a
 * windowless console, so the process can still receive console control events.
 *
 * Note that the Microsoft documentation is somewhat ambiguous here: it says
 * that with CREATE_NO_WINDOW "the console handle for the application is not
 * set", which can be misread as meaning that the process has no console at all.
 * In practice, CREATE_NO_WINDOW creates a console session without a visible
 * console window, and is distinct from DETACHED_PROCESS, which creates a
 * process with no attached console.
 *
 * This behavior is documented and experimentally verified here:
 * https://learn.microsoft.com/en-us/windows/win32/procthread/process-creation-flags
 * https://github.com/rprichard/win32-console-docs
 *
 * CREATE_NEW_PROCESS_GROUP creates a new process group whose identifier is
 * the process ID of the child created by CreateProcess(). This allows
 * CTRL_BREAK_EVENT to be directed specifically to the child's process group:
 *
 *     CREATE_NO_WINDOW
 *         -> child has a windowless console
 *
 *     CREATE_NEW_PROCESS_GROUP
 *         -> child PID is also the process-group ID
 *
 * GenerateConsoleCtrlEvent() can signal only processes sharing the console
 * of the caller. Therefore, this function first detaches the calling process
 * from its current console, if any, temporarily attaches it to the child's
 * console using AttachConsole(child_pid), and then sends:
 *
 *     GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT, child_pid)
 *
 * The child process group then receives CTRL_BREAK_EVENT and can perform an
 * orderly shutdown instead of being forcibly terminated.
 *
 * This works particularly well when called by a Windows Service. Services
 * normally have no console of their own, so the sequence is simply:
 *
 *     Service without a console
 *         -> AttachConsole(child_pid)
 *         -> GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT, child_pid)
 *         -> child receives CTRL_BREAK_EVENT
 *         -> FreeConsole()
 *         -> Service is console-less again
 *
 * Note that console attachment is process-wide. If the calling process was
 * already attached to a console, the initial FreeConsole() detaches it and
 * that previous console is not restored on return. FreeConsole() and
 * AttachConsole() also reset the process console control-handler table.
 * For this reason, this function is best suited to callers that normally
 * have no console, such as Windows Services.
 *
 * If attaching to the child's console fails, fall back to TerminateProcess().
 */
static int pid_term(pid_t pid)
{
	HANDLE h = (void*)pid;
	DWORD id = GetProcessId(h);

	if (id == 0) {
		errno = EINVAL;
		return -1;
	}

	/* detach from current console (if any; background service has no console) */
	FreeConsole();

	/* attach to the child's invisible console host */
	if (!AttachConsole(id)) {
		/* fallback: terminate process forcibly if console attachment fails */
		if (!TerminateProcess(h, 1)) {
			windows_errno(GetLastError());
			return -1;
		}
		return 0;
	}

	/* disable Ctrl-C for the PARENT so we don't kill ourselves */
	SetConsoleCtrlHandler(0, TRUE);

	/* this will now reach the child's SetConsoleCtrlHandler */
	GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT, id);

	/* detach from child console, returning calling service process to its console-less state */
	FreeConsole();

	return 0;
}

/**
 * Publish a newly created process reference, or terminate it immediately if canceled during spawn.
 */
static void pid_publish(pid_t* pid_slot, pid_t pid)
{
	if (pid_slot == 0)
		return;

	exec_lock();
	if (pid <= 0) {
		if (*pid_slot != PID_KILL)
			*pid_slot = PID_NONE;
	} else {
		pid_t prev = *pid_slot;
		if (prev == PID_KILL) {
			*pid_slot = PID_KILL;
			pid_kill(pid);
		} else {
			*pid_slot = pid;

			if (prev == PID_TERM)
				pid_term(pid);
		}
	}
	exec_unlock();
}

/**
 * Unpublish a process reference from a slot.
 */
static void pid_unpublish(pid_t* pid_slot, pid_t pid)
{
	if (pid_slot == 0)
		return;

	exec_lock();
	if (*pid_slot == pid || (*pid_slot < 0 && *pid_slot != PID_KILL))
		*pid_slot = PID_NONE;
	exec_unlock();
}

/**
 * If we are running in Wine.
 */
static int is_wine;

/**
 * If we should use the legacy FindFirst/Next way to list directories.
 */
static int is_scan_winfind;

/**
 * Loaded ADVAPI32.DLL.
 */
static HMODULE dll_advapi32;

/**
 * Executable dir.
 *
 * Or empty or terminating with '\'.
 */
static WCHAR exedir[PATH_MAX];

/****************************************************************************/
/* signal */

static void (*windows_handler_term)(int sig);

static BOOL WINAPI windows_ctrl_handler(DWORD ctrl_type)
{
	if (ctrl_type != CTRL_BREAK_EVENT)
		return FALSE;

	/*
	 * Treat Ctrl+Break exactly like Ctrl+C.
	 *
	 * CTRL_BREAK_EVENT can be targeted to a specific process group by
	 * GenerateConsoleCtrlEvent(), while CTRL_C_EVENT cannot. This allows
	 * external supervisors to request a graceful SnapRAID interruption.
	 */
	if (windows_handler_term != 0)
		windows_handler_term(SIGINT);

	return TRUE;
}

void os_signal_init(void (*handler_term)(int sig), void (*handler_hup)(int sig))
{
	(void)handler_hup;

	signal(SIGTERM, handler_term);
	signal(SIGINT, handler_term);

	windows_handler_term = handler_term;

	/*
	 * Register a console control handler to catch CTRL_BREAK_EVENT.
	 * Unlike CTRL_C_EVENT, Windows does not map Ctrl+Break to SIGINT via signal(),
	 * and by default it terminates the process abruptly. This handler translates
	 * Ctrl+Break into a graceful SIGINT interruption.
	 */
	SetConsoleCtrlHandler(windows_ctrl_handler, TRUE);
}

const char* os_signal_name(int sig)
{
	switch (sig) {
#ifdef SIGHUP
	case SIGHUP : return "SIGHUP";
#endif
#ifdef SIGINT
	case SIGINT : return "SIGINT";
#endif
#ifdef SIGQUIT
	case SIGQUIT : return "SIGQUIT";
#endif
#ifdef SIGILL
	case SIGILL : return "SIGILL";
#endif
#ifdef SIGTRAP
	case SIGTRAP : return "SIGTRAP";
#endif
#ifdef SIGABRT
	case SIGABRT : return "SIGABRT";
#endif
#ifdef SIGBUS
	case SIGBUS : return "SIGBUS";
#endif
#ifdef SIGFPE
	case SIGFPE : return "SIGFPE";
#endif
#ifdef SIGKILL
	case SIGKILL : return "SIGKILL";
#endif
#ifdef SIGUSR1
	case SIGUSR1 : return "SIGUSR1";
#endif
#ifdef SIGSEGV
	case SIGSEGV : return "SIGSEGV";
#endif
#ifdef SIGUSR2
	case SIGUSR2 : return "SIGUSR2";
#endif
#ifdef SIGPIPE
	case SIGPIPE : return "SIGPIPE";
#endif
#ifdef SIGALRM
	case SIGALRM : return "SIGALRM";
#endif
#ifdef SIGTERM
	case SIGTERM : return "SIGTERM";
#endif
	}

	return "UNKNOWN";
}

/****************************************************************************/
/* convert */

wchar_t* u8tou16_mayfail(wchar_t* conv_buf, size_t number_of_wchar, const char* src, size_t number_of_char, size_t* result_length_without_terminator)
{
	/* MB_ERR_INVALID_CHARS forces the API to fail on malformed UTF-8 sequences */
	int ret = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, src, number_of_char, conv_buf, number_of_wchar);
	if (ret <= 0) {
		windows_errno(GetLastError());
		return 0;
	}

	if (result_length_without_terminator)
		*result_length_without_terminator = ret;

	return conv_buf;
}

char* u16tou8_mayfail(char* conv_buf, size_t number_of_char, const wchar_t* src, size_t number_of_wchar, size_t* result_length_without_terminator)
{
	/* WC_ERR_INVALID_CHARS forces the API to fail on malformed UTF-16 sequences */
	int ret = WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS, src, number_of_wchar, conv_buf, number_of_char, 0, 0);
	if (ret <= 0) {
		windows_errno(GetLastError());
		return 0;
	}

	if (result_length_without_terminator)
		*result_length_without_terminator = ret;

	return conv_buf;
}

static wchar_t* u8tou16_force(wchar_t* conv_buf, size_t number_of_wchar, const char* src, size_t number_of_char, size_t* result_length_without_terminator)
{
	/* flags at 0 forces the API to never fail on malformed UTF-8 sequences */
	int ret = MultiByteToWideChar(CP_UTF8, 0, src, number_of_char, conv_buf, number_of_wchar);
	if (ret <= 0) {
		windows_errno(GetLastError());
		return 0;
	}

	if (result_length_without_terminator)
		*result_length_without_terminator = ret;

	return conv_buf;
}

static char* u16tou8_force(char* conv_buf, size_t number_of_char, const wchar_t* src, size_t number_of_wchar, size_t* result_length_without_terminator)
{
	/* flags at 0 forces the API to never fail on malformed UTF-16 sequences */
	int ret = WideCharToMultiByte(CP_UTF8, 0, src, number_of_wchar, conv_buf, number_of_char, 0, 0);
	if (ret <= 0) {
		windows_errno(GetLastError());
		return 0;
	}

	if (result_length_without_terminator)
		*result_length_without_terminator = ret;

	return conv_buf;
}

wchar_t* u8tou16(wchar_t* conv_buf, const char* src)
{
	/* convert also the 0 terminator */
	return u8tou16_force(conv_buf, CONV_MAX, src, strlen(src) + 1, 0);
}

char* u16tou8(char* conv_buf, const wchar_t* src)
{
	/* convert also the 0 terminator */
	return u16tou8_force(conv_buf, CONV_MAX, src, wcslen(src) + 1, 0);
}

/**
 * Check if the char is a forward or back slash.
 */
static int is_slash(char c)
{
	return c == '/' || c == '\\';
}

wchar_t* convert_arg(wchar_t* conv_buf, const char* src, int only_if_required)
{
	int ret;
	wchar_t* dst;
	int count;

	dst = conv_buf;

	/*
	 * Note that we always check for both / and \ because the path is blindly
	 * converted to unix format by path_import()
	 */

	if (only_if_required && strlen(src) < 260 - 12) {
		/*
		 * It's a short path
		 * 260 is the legacy MAX_PATH, including the terminating NUL
		 * 12 leaves room to append an 8.3 filename to the new directory's path
		 */

		/* do nothing */
	} else if (is_slash(src[0]) && is_slash(src[1]) && (src[2] == '?' || src[2] == '.') && is_slash(src[3])) {
		/* if it's already a '\\?\' or '\\.\' path */

		/* do nothing */
	} else if (is_slash(src[0]) && is_slash(src[1])) {
		/* if it is a UNC path, like '\\server' */

		/* prefix with '\\?\UNC\' */
		*dst++ = L'\\';
		*dst++ = L'\\';
		*dst++ = L'?';
		*dst++ = L'\\';
		*dst++ = L'U';
		*dst++ = L'N';
		*dst++ = L'C';
		*dst++ = L'\\';

		/* skip initial '\\' */
		src += 2;
	} else if (src[0] != 0 && src[1] == ':' && is_slash(src[2])) {
		/* if it is a disk designator path, like 'D:\' or 'D:/' */

		/* prefix with '\\?\' */
		*dst++ = L'\\';
		*dst++ = L'\\';
		*dst++ = L'?';
		*dst++ = L'\\';
	}

	/* chars already used */
	count = dst - conv_buf;

	ret = MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, CONV_MAX - count);
	if (ret <= 0) {
		windows_errno(GetLastError());
		return 0;
	}

	/*
	 * Convert any / to \
	 * note that in UTF-16, it's not possible to have '/' used as part
	 * of a pair of codes representing a single UNICODE char
	 * See: http://en.wikipedia.org/wiki/UTF-16
	 */
	while (*dst) {
		if (*dst == L'/')
			*dst = L'\\';
		++dst;
	}

	return conv_buf;
}

/****************************************************************************/
/* windows */

const wchar_t* windows_exedir(void)
{
	return exedir;
}

int windows_is_wine(void)
{
	return is_wine;
}

static BOOL GetReparseTagInfoByHandle(HANDLE hFile, FILE_ATTRIBUTE_TAG_INFO* lpFileAttributeTagInfo, DWORD dwFileAttributes)
{
	/* if not a reparse point, return no info */
	if ((dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0) {
		lpFileAttributeTagInfo->FileAttributes = dwFileAttributes;
		lpFileAttributeTagInfo->ReparseTag = 0;
		return TRUE;
	}

	/* do the real call */
	return GetFileInformationByHandleEx(hFile, FileAttributeTagInfo, lpFileAttributeTagInfo, sizeof(FILE_ATTRIBUTE_TAG_INFO));
}

/**
 * Convert Windows attr to the Unix stat format.
 */
static void windows_attr2stat(DWORD FileAttributes, DWORD ReparseTag, struct windows_stat* st)
{
	/* convert special attributes */
	if ((FileAttributes & FILE_ATTRIBUTE_DEVICE) != 0) {
		st->st_mode = S_IFBLK;
		st->st_desc = "device";
	} else if ((FileAttributes & FILE_ATTRIBUTE_OFFLINE) != 0) { /* offline */
		st->st_mode = S_IFCHR;
		st->st_desc = "offline";
	} else if ((FileAttributes & FILE_ATTRIBUTE_TEMPORARY) != 0) { /* temporary */
		st->st_mode = S_IFCHR;
		st->st_desc = "temporary";
	} else if ((FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) { /* reparse point */
		switch (ReparseTag) {
		/* if we don't have the ReparseTag information */
		case 0 :
			/* don't set the st_mode, to set it later calling lstat_sync() */
			st->st_mode = 0;
			st->st_desc = "unknown";
			break;
		/* for deduplicated files, assume that they are regular ones */
		case IO_REPARSE_TAG_DEDUP :
			if ((FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) {
				st->st_mode = S_IFDIR;
				st->st_desc = "directory-dedup";
			} else {
				st->st_mode = S_IFREG;
				st->st_desc = "regular-dedup";
			}
			break;
		case IO_REPARSE_TAG_SYMLINK :
			if ((FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) {
				st->st_mode = S_IFLNKDIR;
				st->st_desc = "reparse-point-symlink-dir";
			} else {
				st->st_mode = S_IFLNK;
				st->st_desc = "reparse-point-symlink-file";
			}
			break;
		/* all the other are skipped as reparse-point */
		case IO_REPARSE_TAG_MOUNT_POINT :
			st->st_mode = S_IFCHR;
			st->st_desc = "reparse-point-mount";
			break;
		case IO_REPARSE_TAG_NFS :
			st->st_mode = S_IFCHR;
			st->st_desc = "reparse-point-nfs";
			break;
		default :
			st->st_mode = S_IFCHR;
			st->st_desc = "reparse-point";
			break;
		}
	} else if ((FileAttributes & FILE_ATTRIBUTE_SYSTEM) != 0) { /* system */
		if ((FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) {
			st->st_mode = S_IFCHR;
			st->st_desc = "system-directory";
		} else {
			st->st_mode = S_IFREG;
			st->st_desc = "system-file";
		}
	} else {
		if ((FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) {
			st->st_mode = S_IFDIR;
			st->st_desc = "directory";
		} else {
			st->st_mode = S_IFREG;
			st->st_desc = "regular";
		}
	}

	/* store the HIDDEN attribute in a separate field */
	st->st_hidden = (FileAttributes & FILE_ATTRIBUTE_HIDDEN) != 0;
}

/**
 * Convert Windows FILETIME to the Unix stat format.
 *
 * How To Convert a UNIX time_t to a Win32 FILETIME or SYSTEMTIME
 * http://support.microsoft.com/kb/167296
 */
static void windows_time2stat(int64_t filetime, struct windows_stat* st)
{
	int64_t mtime = filetime - 116444736000000000LL;
	int64_t sec = mtime / 10000000;
	int64_t rem = mtime % 10000000;

	/* in C99, negative division truncates towards zero; normalize so that rem >= 0 */
	if (rem < 0) {
		--sec;
		rem += 10000000;
	}

	st->st_mtime = sec;
	st->st_mtimensec = rem * 100;
}

/**
 * Convert Windows info to the Unix stat format.
 */
static int windows_info2stat(const BY_HANDLE_FILE_INFORMATION* info, const FILE_ATTRIBUTE_TAG_INFO* tag, struct windows_stat* st)
{
	int64_t mtime;

	windows_attr2stat(info->dwFileAttributes, tag->ReparseTag, st);

	st->st_size = info->nFileSizeHigh;
	st->st_size <<= 32;
	st->st_size |= info->nFileSizeLow;

	mtime = info->ftLastWriteTime.dwHighDateTime;
	mtime <<= 32;
	mtime |= info->ftLastWriteTime.dwLowDateTime;

	windows_time2stat(mtime, st);

	st->st_ino = info->nFileIndexHigh;
	st->st_ino <<= 32;
	st->st_ino |= info->nFileIndexLow;

	st->st_nlink = info->nNumberOfLinks;

	st->st_dev = info->dwVolumeSerialNumber;

	/* GetFileInformationByHandle() ensures to return synced information */
	st->st_sync = 1;

	/*
	 * In ReFS the IDs are 128 bit, and the 64 bit interface may fail.
	 *
	 * From Microsoft "Application Compatibility with ReFS"
	 * http://download.microsoft.com/download/C/B/3/CB3561DC-6BF6-443D-B5B9-9676ACDF7F75/Application%20Compatibility%20with%20ReFS.docx
	 * 64-bit file identifier can be obtained from GetFileInformationByHandle in
	 * the nFileIndexHigh and nFileIndexLow members. This API is an extended version
	 * that includes 128-bit file identifiers.  If GetFileInformationByHandle returns
	 * FILE_INVALID_FILE_ID, the identifier may only be described in 128 bit form.
	 *
	 * From Microsoft "[MS-FSCC]: File System Control Codes - 11/21/2025 v60.0 - 6 Appendix B: Product Behavior"
	 * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/d4bc551b-7aaf-4b4f-ba0e-3a75e7c528f0
	 *
	 * 64bitFileID Generate Stable Unique
	 * FAT           Yes      No     No
	 * EXFAT         Yes      No     No
	 * FAT32         Yes      No     No
	 * UDFS          Yes      Yes    Yes
	 * NTFS          Yes      Yes    Yes
	 * ReFS          Yes      Yes    Yes
	 *
	 * NTFS computes the 64-bit file ID as follows: the low 48 bits are the index of the
	 * file's primary record in the master file table (MFT); the remaining 16 bits are
	 * a sequence number. Therefore, it is possible, though rare, that a different file
	 * can have the same 64-bit file ID as a file on that volume had in the past.
	 *
	 * ReFS maps a subset of the possible 128-bit file ID values to a 64-bit value using
	 * a reversible algorithm; for values outside of this subset, ReFS sets the 64-bit
	 * file ID to -1.
	 *
	 * From Microsoft "[MS-FSCC]: File System Control Codes - 11/21/2025 v60.0 - 2.1.9 64-bit file ID"
	 * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/2d3333fe-fc98-4a6f-98a2-4bb805aff407?utm_source=chatgpt.com
	 *
	 * A 64-bit file ID value uniquely identifies a file within a given volume. This
	 * identifier is generated and stored by the file system. The identifier SHOULD
	 * be unique to the volume and stable until the file is deleted.
	 * For file systems that do not support a 64-bit file ID, this field MUST be
	 * set to 0, and MUST be ignored.
	 * For files for which a unique 64-bit file ID cannot be established, this
	 * field MUST be set to 0xFFFFFFFFFFFFFFFF, and MUST be ignored.
	 */
	if (st->st_ino == FILE_INVALID_FILE_ID || st->st_ino == FILE_UNSUPPORTED_FILE_ID)
		st->st_ino = INODE_INVALID;

	return 0;
}

/**
 * Convert Windows info to the Unix stat format.
 */
static int windows_stream2stat(const BY_HANDLE_FILE_INFORMATION* info, const FILE_ID_BOTH_DIR_INFO* stream, struct windows_stat* st)
{
	/*
	 * The FILE_ID_BOTH_DIR_INFO doesn't have the ReparseTag information
	 * we could use instead FILE_ID_EXTD_DIR_INFO, but it's available only
	 * from Windows Server 2012
	 */
	windows_attr2stat(stream->FileAttributes, 0, st);

	st->st_size = stream->EndOfFile.QuadPart;

	windows_time2stat(stream->LastWriteTime.QuadPart, st);

	st->st_ino = stream->FileId.QuadPart;

	/*
	 * FILE_ID_BOTH_DIR_INFO doesn't provide the hardlink count of the entry.
	 * The BY_HANDLE_FILE_INFORMATION refers to the directory itself, so its
	 * nNumberOfLinks cannot be used for the child.
	 */
	st->st_nlink = 0;

	st->st_dev = info->dwVolumeSerialNumber;

	/* directory listing doesn't ensure to return synced information */
	st->st_sync = 0;

	/* in ReFS the IDs are 128 bit, and the 64 bit interface may fail */
	if (st->st_ino == FILE_INVALID_FILE_ID || st->st_ino == FILE_UNSUPPORTED_FILE_ID)
		st->st_ino = INODE_INVALID;

	return 0;
}

/**
 * Convert Windows findfirst info to the Unix stat format.
 */
static void windows_finddata2stat(const WIN32_FIND_DATAW* info, struct windows_stat* st)
{
	int64_t mtime;

	windows_attr2stat(info->dwFileAttributes, info->dwReserved0, st);

	st->st_size = info->nFileSizeHigh;
	st->st_size <<= 32;
	st->st_size |= info->nFileSizeLow;

	mtime = info->ftLastWriteTime.dwHighDateTime;
	mtime <<= 32;
	mtime |= info->ftLastWriteTime.dwLowDateTime;

	windows_time2stat(mtime, st);

	/* no inode information available */
	st->st_ino = INODE_INVALID;

	/* no link information available */
	st->st_nlink = 0;

	/* no device information available */
	st->st_dev = 0;

	/* directory listing doesn't ensure to return synced information */
	st->st_sync = 0;
}

static int windows_finddata2dirent(const WIN32_FIND_DATAW* info, struct windows_dirent* dirent)
{
	char conv_buf[CONV_MAX];
	const char* name;
	size_t len;

	name = u16tou8_force(conv_buf, CONV_MAX, info->cFileName, wcslen(info->cFileName), &len);
	if (!name)
		return -1;

	if (len + 1 >= sizeof(dirent->d_name)) {
		errno = ENAMETOOLONG;
		return -1;
	}

	memcpy(dirent->d_name, name, len);
	dirent->d_name[len] = 0;

	windows_finddata2stat(info, &dirent->d_stat);
	return 0;
}

static int windows_stream2dirent(const BY_HANDLE_FILE_INFORMATION* info, const FILE_ID_BOTH_DIR_INFO* stream, struct windows_dirent* dirent)
{
	char conv_buf[CONV_MAX];
	const char* name;
	size_t len;

	name = u16tou8_force(conv_buf, CONV_MAX, stream->FileName, stream->FileNameLength / 2, &len);
	if (!name)
		return -1;

	if (len + 1 >= sizeof(dirent->d_name)) {
		errno = ENAMETOOLONG;
		return -1;
	}

	memcpy(dirent->d_name, name, len);
	dirent->d_name[len] = 0;

	return windows_stream2stat(info, stream, &dirent->d_stat);
}

/**
 * Convert Windows error to errno.
 */
void windows_errno(DWORD error)
{
	switch (error) {
	case ERROR_INVALID_HANDLE :
		/*
		 * We check for a bad handle calling _get_osfhandle()
		 * and in such case we return EBADF
		 * Other cases are here identified with EINVAL
		 */
		errno = EINVAL;
		break;
	case ERROR_HANDLE_EOF : /* in ReadFile() over the end of the file */
	case ERROR_INVALID_PARAMETER :
	case ERROR_INVALID_FLAGS :
		errno = EINVAL;
		break;
	case ERROR_FILE_NOT_FOUND :
	case ERROR_PATH_NOT_FOUND : /* in GetFileAttributeW() if internal path not found */
		errno = ENOENT;
		break;
	case ERROR_DIRECTORY :
		errno = ENOTDIR;
		break;
	case ERROR_ACCESS_DENIED : /* in CreateDirectoryW() if dir is scheduled for deletion */
	case ERROR_CURRENT_DIRECTORY : /* in RemoveDirectoryW() if removing the current directory */
	case ERROR_SHARING_VIOLATION : /* in RemoveDirectoryW() if in use */
	case ERROR_WRITE_PROTECT : /* when dealing with read-only media/snapshot and trying to write to them */
		errno = EACCES;
		break;
	case ERROR_ALREADY_EXISTS : /* in CreateDirectoryW() if already exists */
		errno = EEXIST;
		break;
	case ERROR_DISK_FULL : /* in SetEndOfFile() */
	case ERROR_HANDLE_DISK_FULL : /* in SetEndOfFile() */
	case ERROR_DISK_QUOTA_EXCEEDED : /* in SetEndOfFile() */
		errno = ENOSPC;
		break;
	case ERROR_FILE_TOO_LARGE : /* in SetEndOfFile() */
		errno = EFBIG;
		break;
	case ERROR_FILENAME_EXCED_RANGE :
	case ERROR_BUFFER_OVERFLOW :
	case ERROR_INSUFFICIENT_BUFFER : /* in MultiByteToWideChar() and WideCharToMultiByte() */
		errno = ENAMETOOLONG;
		break;
	case ERROR_NO_UNICODE_TRANSLATION : /* in MultiByteToWideChar() and WideCharToMultiByte() */
		errno = EILSEQ;
		break;
	case ERROR_NOT_ENOUGH_MEMORY :
		errno = ENOMEM;
		break;
	case ERROR_NO_SYSTEM_RESOURCES :
		errno = ENOBUFS; /* in ReadFile() and WriteFile() */
		break;
	case ERROR_NOT_SUPPORTED : /* in CreateSymlinkW() if not present in kernel32 */
		errno = ENOSYS;
		break;
	case ERROR_PRIVILEGE_NOT_HELD : /* in CreateSymlinkW() if no SeCreateSymbolicLinkPrivilige permission */
		errno = EPERM;
		break;
	case ERROR_IO_DEVICE : /* in ReadFile() and WriteFile() */
	case ERROR_FILE_CORRUPT :
	case ERROR_DISK_CORRUPT :
	case ERROR_CRC : /* in ReadFile() */
		errno = EIO;
		break;
	case ERROR_BROKEN_PIPE : /* in ReadFile() and WriteFile() */
	case ERROR_NO_DATA :
		errno = EPIPE;
		break;
	case WSAEADDRINUSE :
		errno = EADDRINUSE;
		break;
	default :
		errno = ENXIO;
		os_syslog(OS_LVL_INFO, "unexpected Windows error %lu", error);
		break;
	}
}

int windows_fstat(int fd, struct windows_stat* st)
{
	BY_HANDLE_FILE_INFORMATION info;
	FILE_ATTRIBUTE_TAG_INFO tag;
	HANDLE h;

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	if (!GetFileInformationByHandle(h, &info)) {
		windows_errno(GetLastError());
		return -1;
	}

	if (!GetReparseTagInfoByHandle(h, &tag, info.dwFileAttributes)) {
		windows_errno(GetLastError());
		return -1;
	}

	return windows_info2stat(&info, &tag, st);
}

int windows_get_file_attributes(const char* file)
{
	wchar_t conv_buf[CONV_MAX];

	if (!convert(conv_buf, file))
		return -1;

	DWORD ret = GetFileAttributesW(conv_buf);
	if (ret == INVALID_FILE_ATTRIBUTES) {
		windows_errno(GetLastError());
		return -1;
	}

	return ret;
}

int windows_set_file_attributes(const char* file, int attributes)
{
	wchar_t conv_buf[CONV_MAX];

	if (!convert(conv_buf, file))
		return -1;

	if (!SetFileAttributesW(conv_buf, attributes)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_lstat(const char* file, struct windows_stat* st)
{
	wchar_t conv_buf[CONV_MAX];
	HANDLE h;
	WIN32_FIND_DATAW data;
	size_t len = strlen(file);

	/*
	 * A trailing slash requires resolving the final component as a directory.
	 * Use the handle-based implementation because FindFirstFileW() rejects the
	 * trailing slash, while preserving its faster path for all normal entries.
	 */
	if (len != 0 && is_slash(file[len - 1]))
		return windows_stat(file, st);

	/* FindFirstFileW by default gets information of symbolic links and not of their targets */
	if (!convert(conv_buf, file))
		return -1;
	h = FindFirstFileW(conv_buf, &data);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	if (!FindClose(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	windows_finddata2stat(&data, st);

	return 0;
}

void windows_dirent_lstat(const struct windows_dirent* dd, struct windows_stat* st)
{
	memcpy(st, &dd->d_stat, sizeof(struct windows_stat));
}

int windows_mkdir(const char* file)
{
	wchar_t conv_buf[CONV_MAX];

	if (!convert(conv_buf, file))
		return -1;

	if (!CreateDirectoryW(conv_buf, 0)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_rmdir(const char* file)
{
	wchar_t conv_buf[CONV_MAX];

	if (!convert(conv_buf, file))
		return -1;

	if (!RemoveDirectoryW(conv_buf)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_stat(const char* file, struct windows_stat* st)
{
	wchar_t conv_buf[CONV_MAX];
	BY_HANDLE_FILE_INFORMATION info;
	FILE_ATTRIBUTE_TAG_INFO tag;
	HANDLE h;

	/*
	 * Open the handle of the file.
	 *
	 * Use FILE_FLAG_BACKUP_SEMANTICS to open directories (it's just ignored for files).
	 */
	if (!convert(conv_buf, file))
		return -1;
	h = CreateFileW(conv_buf, 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	if (!GetFileInformationByHandle(h, &info)) {
		DWORD error = GetLastError();
		CloseHandle(h);
		windows_errno(error);
		return -1;
	}

	if (!GetReparseTagInfoByHandle(h, &tag, info.dwFileAttributes)) {
		DWORD error = GetLastError();
		CloseHandle(h);
		windows_errno(error);
		return -1;
	}

	if (!CloseHandle(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	return windows_info2stat(&info, &tag, st);
}

int windows_ftruncate(int fd, off64_t off)
{
	HANDLE h;
	LARGE_INTEGER pos;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	pos.QuadPart = off;
	if (!SetFilePointerEx(h, pos, 0, FILE_BEGIN)) {
		windows_errno(GetLastError());
		return -1;
	}

	/*
	 * Windows effectively reserves space, but it doesn't initialize it.
	 * It's then important to write starting from the begin to the end,
	 * to avoid to have Windows to fill the holes writing zeros.
	 *
	 * See:
	 * "Why does my single-byte write take forever?"
	 * http://blogs.msdn.com/b/oldnewthing/archive/2011/09/22/10215053.aspx
	 */
	if (!SetEndOfFile(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_fallocate(int fd, int mode, off64_t off, off64_t len)
{
	if (mode != 0)
		return -1;

	/* no difference with ftruncate because Windows doesn't use sparse files */
	return windows_ftruncate(fd, off + len);
}

int windows_fsync(int fd)
{
	HANDLE h;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	/*
	 * "The FlushFileBuffers API can be used to flush all the outstanding data
	 * and metadata on a single file or a whole volume. However, frequent use
	 * of this API can cause reduced throughput. Internally, Windows uses the
	 * SCSI Synchronize Cache or the IDE/ATAPI Flush cache commands."
	 *
	 * From:
	 * "Windows Write Caching - Part 2 An overview for Application Developers"
	 * http://winntfs.com/2012/11/29/windows-write-caching-part-2-an-overview-for-application-developers/
	 */
	if (!FlushFileBuffers(h)) {
		DWORD error = GetLastError();

		switch (error) {
		case ERROR_INVALID_HANDLE :
			/*
			 * FlushFileBuffers returns this error if the handle
			 * doesn't support buffering, like the console output.
			 *
			 * We had a report that also ATA-over-Ethernet returns
			 * this error, but not enough sure to ignore it.
			 * So, we use now an extended error reporting.
			 */
			windows_errno(error);
			os_syslog(OS_LVL_INFO, "unexpected Windows INVALID_HANDLE error in FlushFileBuffers()");
			os_syslog(OS_LVL_INFO, "are you using ATA-over-Ethernet? Please report it.");
			return -1;

		case ERROR_ACCESS_DENIED :
			/*
			 * FlushFileBuffers returns this error for read-only
			 * data, that cannot have to be flushed.
			 */
			return 0;

		default :
			windows_errno(error);
			return -1;
		}
	}

	return 0;
}

static int windows_vsync(const wchar_t* volume)
{
	HANDLE h;
	DWORD bytes;

	/* open the volume (volumeName already in \\?\Volume{GUID} format) */
	h = CreateFileW(volume, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	/*
	 * "The FlushFileBuffers API can be used to flush all the outstanding data
	 * and metadata on a single file or a whole volume. However, frequent use
	 * of this API can cause reduced throughput. Internally, Windows uses the
	 * SCSI Synchronize Cache or the IDE/ATAPI Flush cache commands."
	 *
	 * From:
	 * "Windows Write Caching - Part 2 An overview for Application Developers"
	 * http://winntfs.com/2012/11/29/windows-write-caching-part-2-an-overview-for-application-developers/
	 */
	if (!FlushFileBuffers(h)) {
		DWORD error = GetLastError();
		CloseHandle(h);

		switch (error) {
		case ERROR_INVALID_HANDLE :
			/*
			 * FlushFileBuffers returns this error if the handle
			 * doesn't support buffering, like the console output.
			 *
			 * We had a report that also ATA-over-Ethernet returns
			 * this error, but not enough sure to ignore it.
			 * So, we use now an extended error reporting.
			 */
			windows_errno(error);
			os_syslog(OS_LVL_INFO, "unexpected Windows INVALID_HANDLE error in FlushFileBuffers()");
			os_syslog(OS_LVL_INFO, "are you using ATA-over-Ethernet? Please report it.");
			return -1;

		case ERROR_ACCESS_DENIED :
			/*
			 * FlushFileBuffers returns this error for read-only
			 * data, that cannot have to be flushed.
			 */
			return 0;

		default :
			windows_errno(error);
			return -1;
		}
	}

	/* lock the volume (may fail if volume is in use, which is fine) */
	if (!DeviceIoControl(h, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0, &bytes, NULL)) {
		DWORD error = GetLastError();
		CloseHandle(h);

		switch (error) {
		case ERROR_ACCESS_DENIED :
			/*
			 * ERROR_ACCESS_DENIED (5) means volume is in use - this is expected and OK
			 */
			return 0;

		default :
			windows_errno(error);
			return -1;
		}
	}

	/* unlock immediately - the lock/unlock cycle helps ensure consistency */
	if (!DeviceIoControl(h, FSCTL_UNLOCK_VOLUME, NULL, 0, NULL, 0, &bytes, NULL)) {
		DWORD error = GetLastError();
		CloseHandle(h);
		windows_errno(error);
		return -1;
	}

	if (!CloseHandle(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

static int windows_async(void)
{
	HANDLE h;
	wchar_t volume[PATH_MAX];
	DWORD error = 0;
	DWORD count = 0;
	DWORD success = 0;

	h = FindFirstVolumeW(volume, sizeof(volume) / sizeof(wchar_t));
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	do {
		/* remove trailing backslash */
		size_t len = wcslen(volume);
		if (len > 0 && volume[len - 1] == L'\\')
			volume[len - 1] = L'\0';

		++count;

		if (windows_vsync(volume) == 0) {
			++success;
		} else {
			/* save the first error */
			if (error == 0)
				error = GetLastError();
		}
	} while (FindNextVolumeW(h, volume, sizeof(volume) / sizeof(wchar_t)));

	/* if at least one failed */
	if (count != success) {
		FindVolumeClose(h);
		windows_errno(error);
		return -1;
	}

	error = GetLastError();
	if (error != ERROR_NO_MORE_FILES) {
		FindVolumeClose(h);
		windows_errno(error);
		return -1;
	}

	if (!FindVolumeClose(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_sync(void)
{
	if (windows_async() != 0)
		return -1;

	return 0;
}

int windows_futimens(int fd, struct windows_timespec tv[2])
{
	HANDLE h;
	FILETIME ft;
	int64_t mtime;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	/*
	 * Convert to windows time
	 *
	 * How To Convert a UNIX time_t to a Win32 FILETIME or SYSTEMTIME
	 * http://support.microsoft.com/kb/167296
	 */
	mtime = tv[1].tv_sec;
	mtime *= 10000000;
	mtime += tv[1].tv_nsec / 100;
	mtime += 116444736000000000LL;

	ft.dwHighDateTime = mtime >> 32;
	ft.dwLowDateTime = mtime;

	if (!SetFileTime(h, 0, 0, &ft)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_utimensat(int fd, const char* file, struct windows_timespec tv[2], int flags)
{
	wchar_t conv_buf[CONV_MAX];
	HANDLE h;
	FILETIME ft;
	int64_t mtime;
	DWORD wflags;

	/*
	 * Support only the absolute paths
	 */
	if (fd != AT_FDCWD) {
		errno = EBADF;
		return -1;
	}

	/*
	 * Open the handle of the file.
	 *
	 * Use FILE_FLAG_BACKUP_SEMANTICS to open directories (it's just ignored for files).
	 * Use FILE_FLAG_OPEN_REPARSE_POINT to open symbolic links and not the their target.
	 *
	 * Note that even with FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
	 * and FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT some paths
	 * cannot be opened like "C:\System Volume Information" resulting
	 * in error ERROR_ACCESS_DENIED.
	 */
	wflags = FILE_FLAG_BACKUP_SEMANTICS;
	if ((flags & AT_SYMLINK_NOFOLLOW) != 0)
		wflags |= FILE_FLAG_OPEN_REPARSE_POINT;
	if (!convert(conv_buf, file))
		return -1;
	h = CreateFileW(conv_buf, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, wflags, 0);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	/*
	 * Convert to windows time
	 *
	 * How To Convert a UNIX time_t to a Win32 FILETIME or SYSTEMTIME
	 * http://support.microsoft.com/kb/167296
	 */
	mtime = tv[1].tv_sec;
	mtime *= 10000000;
	mtime += tv[1].tv_nsec / 100;
	mtime += 116444736000000000LL;

	ft.dwHighDateTime = mtime >> 32;
	ft.dwLowDateTime = mtime;

	if (!SetFileTime(h, 0, 0, &ft)) {
		windows_errno(GetLastError());
		CloseHandle(h);
		return -1;
	}

	if (!CloseHandle(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_rename(const char* from, const char* to)
{
	wchar_t conv_buf_from[CONV_MAX];
	wchar_t conv_buf_to[CONV_MAX];
	if (!convert(conv_buf_from, from) || !convert(conv_buf_to, to))
		return -1;

	/*
	 * Implements an atomic rename in Windows.
	 * Not really atomic at now to support XP.
	 *
	 * Is an atomic file rename (with overwrite) possible on Windows?
	 * http://stackoverflow.com/questions/167414/is-an-atomic-file-rename-with-overwrite-possible-on-windows
	 */
	if (!MoveFileExW(conv_buf_from, conv_buf_to, MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

int windows_remove(const char* file)
{
	wchar_t conv_buf[CONV_MAX];

	if (!convert(conv_buf, file))
		return -1;

	if (!DeleteFileW(conv_buf)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

FILE* windows_fopen(const char* file, const char* mode)
{
	wchar_t conv_buf_file[CONV_MAX];
	wchar_t conv_buf_mode[CONV_MAX];

	if (!convert(conv_buf_file, file) || !u8tou16(conv_buf_mode, mode))
		return 0;
	return _wfopen(conv_buf_file, conv_buf_mode);
}

int windows_open(const char* file, int flags, ...)
{
	wchar_t conv_buf[CONV_MAX];
	HANDLE h;
	int f;
	int truncate;
	int delete_on_close;
	DWORD access;
	DWORD share;
	DWORD create;
	DWORD attr;

	switch (flags & O_ACCMODE) {
	case O_RDONLY :
		access = GENERIC_READ;
		break;
	case O_WRONLY :
		access = GENERIC_WRITE;
		break;
	case O_RDWR :
		access = GENERIC_READ | GENERIC_WRITE;
		break;
	default :
		errno = EINVAL;
		return -1;
	}

	share = FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE;

	truncate = 0;
	delete_on_close = 0;
	switch (flags & (O_CREAT | O_EXCL | O_TRUNC)) {
	case 0 :
		create = OPEN_EXISTING;
		break;
	case O_CREAT :
		create = OPEN_ALWAYS;
		break;
	case O_CREAT | O_EXCL :
	case O_CREAT | O_EXCL | O_TRUNC :
		create = CREATE_NEW;
		break;
	case O_CREAT | O_TRUNC :
		if ((flags & O_NOFOLLOW) != 0) {
			create = OPEN_ALWAYS;
			truncate = 1;
		} else {
			create = CREATE_ALWAYS;
		}
		break;
	case O_TRUNC :
		if ((flags & O_NOFOLLOW) != 0) {
			create = OPEN_EXISTING;
			truncate = 1;
		} else {
			create = TRUNCATE_EXISTING;
		}
		break;
	default :
		errno = EINVAL;
		return -1;
	}

	attr = FILE_ATTRIBUTE_NORMAL;
	if ((flags & O_DIRECT) != 0)
		attr |= FILE_FLAG_NO_BUFFERING;
	if ((flags & O_DSYNC) != 0)
		attr |= FILE_FLAG_WRITE_THROUGH;
	if ((flags & O_RANDOM) != 0)
		attr |= FILE_FLAG_RANDOM_ACCESS;
	if ((flags & O_SEQUENTIAL) != 0)
		attr |= FILE_FLAG_SEQUENTIAL_SCAN;
	if ((flags & _O_SHORT_LIVED) != 0)
		attr |= FILE_ATTRIBUTE_TEMPORARY;
	if ((flags & O_TEMPORARY) != 0) {
		if ((flags & O_NOFOLLOW) != 0) {
			access |= DELETE;
			delete_on_close = 1;
		} else {
			attr |= FILE_FLAG_DELETE_ON_CLOSE;
		}
	}
	if ((flags & O_NOFOLLOW) != 0)
		attr |= FILE_FLAG_OPEN_REPARSE_POINT;

	if (!convert(conv_buf, file))
		return -1;
	h = CreateFileW(conv_buf, access, share, 0, create, attr, 0);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	if ((flags & O_NOFOLLOW) != 0) {
		BY_HANDLE_FILE_INFORMATION info;
		FILE_ATTRIBUTE_TAG_INFO tag;

		if (!GetFileInformationByHandle(h, &info)) {
			DWORD error = GetLastError();
			CloseHandle(h);
			windows_errno(error);
			return -1;
		}

		if (!GetReparseTagInfoByHandle(h, &tag, info.dwFileAttributes)) {
			DWORD error = GetLastError();
			CloseHandle(h);
			windows_errno(error);
			return -1;
		}

		if ((tag.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
			if (tag.ReparseTag != IO_REPARSE_TAG_DEDUP) {
				CloseHandle(h);
				errno = ELOOP;
				return -1;
			}

			/*
			 * Deduplicated files are reparse points, but they must be opened
			 * with normal reparse processing to access their logical data.
			 * Reopening by path intentionally accepts a TOCTOU window only
			 * for deduplicated files.
			 */
			if (!CloseHandle(h)) {
				windows_errno(GetLastError());
				return -1;
			}

			attr &= ~FILE_FLAG_OPEN_REPARSE_POINT;
			h = CreateFileW(conv_buf, access, share, 0, create, attr, 0);
			if (h == INVALID_HANDLE_VALUE) {
				windows_errno(GetLastError());
				return -1;
			}
		}
	}

	/*
	 * With O_NOFOLLOW delete-on-close must be enabled only after the opened
	 * object has been validated, otherwise closing a rejected reparse point
	 * could delete it.
	 */
	if (delete_on_close) {
		FILE_DISPOSITION_INFO disposition;

		disposition.DeleteFile = TRUE;
		if (!SetFileInformationByHandle(h, FileDispositionInfo, &disposition, sizeof(disposition))) {
			DWORD error = GetLastError();
			CloseHandle(h);
			windows_errno(error);
			return -1;
		}
	}

	/*
	 * With O_NOFOLLOW truncation must happen only after the opened object
	 * has been validated, otherwise a symbolic link target could already
	 * have been truncated before detecting the link.
	 */
	if (truncate) {
		LARGE_INTEGER pos;

		pos.QuadPart = 0;
		if (!SetFilePointerEx(h, pos, 0, FILE_BEGIN)) {
			DWORD error = GetLastError();
			CloseHandle(h);
			windows_errno(error);
			return -1;
		}

		if (!SetEndOfFile(h)) {
			DWORD error = GetLastError();
			CloseHandle(h);
			windows_errno(error);
			return -1;
		}
	}

	/* mask out flags unknown by Windows */
	flags &= ~(O_DIRECT | O_DSYNC | O_NOFOLLOW);

	f = _open_osfhandle((intptr_t)h, flags);
	if (f == -1) {
		CloseHandle(h);
		return -1;
	}

	return f;
}

struct windows_dir_struct {
	BY_HANDLE_FILE_INFORMATION info;
	WIN32_FIND_DATAW find;
	HANDLE h;
	struct windows_dirent entry;
	unsigned char* buffer;
	unsigned buffer_size;
	unsigned buffer_pos;
	int state;
};

#define DIR_STATE_EOF -1 /**< End of the dir stream */
#define DIR_STATE_EMPTY 0 /**< The entry is empty. */
#define DIR_STATE_FILLED 1 /**< The entry is valid. */

static windows_dir* windows_opendir_find(const char* dir)
{
	wchar_t conv_buf[CONV_MAX];
	wchar_t* wdir;
	windows_dir* dirstream;
	size_t len;

	dirstream = malloc(sizeof(windows_dir));
	if (!dirstream) {
		errno = ENOMEM;
		return 0;
	}

	wdir = convert(conv_buf, dir);
	if (!wdir) {
		free(dirstream);
		return 0;
	}

	/* add final \ and * */
	len = wcslen(wdir);
	if (len + 3 > CONV_MAX) {
		free(dirstream);
		errno = ENAMETOOLONG;
		return 0;
	}

	if (len != 0 && wdir[len - 1] != '\\')
		wdir[len++] = L'\\';
	wdir[len++] = L'*';
	wdir[len++] = 0;

	dirstream->h = FindFirstFileW(wdir, &dirstream->find);
	if (dirstream->h == INVALID_HANDLE_VALUE) {
		DWORD error = GetLastError();

		if (error == ERROR_FILE_NOT_FOUND) {
			dirstream->state = DIR_STATE_EOF;
			return dirstream;
		}

		free(dirstream);
		windows_errno(error);
		return 0;
	}

	if (windows_finddata2dirent(&dirstream->find, &dirstream->entry) != 0) {
		FindClose(dirstream->h);
		free(dirstream);
		return 0;
	}
	dirstream->state = DIR_STATE_FILLED;

	return dirstream;
}

static struct windows_dirent* windows_readdir_find(windows_dir* dirstream)
{
	if (dirstream->state == DIR_STATE_EMPTY) {
		if (!FindNextFileW(dirstream->h, &dirstream->find)) {
			DWORD error = GetLastError();

			if (error != ERROR_NO_MORE_FILES) {
				windows_errno(error);
				return 0;
			}

			dirstream->state = DIR_STATE_EOF;
		} else {
			if (windows_finddata2dirent(&dirstream->find, &dirstream->entry) != 0)
				return 0;
			dirstream->state = DIR_STATE_FILLED;
		}
	}

	if (dirstream->state == DIR_STATE_FILLED) {
		dirstream->state = DIR_STATE_EMPTY;
		return &dirstream->entry;
	}

	/* otherwise it's the end of stream */
	assert(dirstream->state == DIR_STATE_EOF);
	errno = 0;

	return 0;
}

static int windows_closedir_find(windows_dir* dirstream)
{
	if (dirstream->h != INVALID_HANDLE_VALUE) {
		if (!FindClose(dirstream->h)) {
			DWORD error = GetLastError();

			free(dirstream);

			windows_errno(error);
			return -1;
		}
	}

	free(dirstream);

	return 0;
}

static int windows_first_stream(windows_dir* dirstream)
{
	FILE_ID_BOTH_DIR_INFO* fd;

	if (!GetFileInformationByHandleEx(dirstream->h, FileIdBothDirectoryInfo, dirstream->buffer, dirstream->buffer_size)) {
		DWORD error = GetLastError();

		if (error == ERROR_NO_MORE_FILES) {
			dirstream->state = DIR_STATE_EOF;
			return 0;
		}

		windows_errno(error);
		return -1;
	}

	/* get the first entry */
	dirstream->state = DIR_STATE_FILLED;
	dirstream->buffer_pos = 0;
	fd = (FILE_ID_BOTH_DIR_INFO*)dirstream->buffer;
	return windows_stream2dirent(&dirstream->info, fd, &dirstream->entry);
}

static int windows_next_stream(windows_dir* dirstream)
{
	FILE_ID_BOTH_DIR_INFO* fd;

	/* last entry read */
	fd = (FILE_ID_BOTH_DIR_INFO*)(dirstream->buffer + dirstream->buffer_pos);

	/* check if there is a next one */
	if (fd->NextEntryOffset == 0) {
		/* if not, fill it up again */
		if (windows_first_stream(dirstream) != 0)
			return -1;
		return 0;
	}

	/* go to the next one */
	dirstream->state = DIR_STATE_FILLED;
	dirstream->buffer_pos += fd->NextEntryOffset;
	fd = (FILE_ID_BOTH_DIR_INFO*)(dirstream->buffer + dirstream->buffer_pos);
	return windows_stream2dirent(&dirstream->info, fd, &dirstream->entry);
}

static windows_dir* windows_opendir_stream(const char* dir)
{
	wchar_t conv_buf[CONV_MAX];
	windows_dir* dirstream;

	dirstream = malloc(sizeof(windows_dir));
	if (!dirstream) {
		errno = ENOMEM;
		return 0;
	}

	/* uses a 64 kB buffer for reading directory */
	dirstream->buffer_size = 64 * 1024;
	dirstream->buffer = malloc(dirstream->buffer_size);
	if (!dirstream->buffer) {
		free(dirstream);
		errno = ENOMEM;
		return 0;
	}

	if (!convert(conv_buf, dir)) {
		free(dirstream->buffer);
		free(dirstream);
		return 0;
	}
	dirstream->h = CreateFileW(conv_buf, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0);
	if (dirstream->h == INVALID_HANDLE_VALUE) {
		DWORD error = GetLastError();
		free(dirstream->buffer);
		free(dirstream);
		windows_errno(error);
		return 0;
	}

	/*
	 * Get dir information for the VolumeSerialNumber
	 * this value is used for all the files in the dir
	 */
	if (!GetFileInformationByHandle(dirstream->h, &dirstream->info)) {
		DWORD error = GetLastError();
		CloseHandle(dirstream->h);
		free(dirstream->buffer);
		free(dirstream);
		windows_errno(error);
		return 0;
	}

	if (windows_first_stream(dirstream) != 0) {
		CloseHandle(dirstream->h);
		free(dirstream->buffer);
		free(dirstream);
		return 0;
	}

	return dirstream;
}

static struct windows_dirent* windows_readdir_stream(windows_dir* dirstream)
{
	if (dirstream->state == DIR_STATE_EMPTY) {
		if (windows_next_stream(dirstream) != 0)
			return 0;
	}

	if (dirstream->state == DIR_STATE_FILLED) {
		dirstream->state = DIR_STATE_EMPTY;
		return &dirstream->entry;
	}

	/* otherwise it's the end of stream */
	assert(dirstream->state == DIR_STATE_EOF);
	errno = 0;

	return 0;
}

static int windows_closedir_stream(windows_dir* dirstream)
{
	if (dirstream->h != INVALID_HANDLE_VALUE) {
		if (!CloseHandle(dirstream->h)) {
			DWORD error = GetLastError();

			free(dirstream->buffer);
			free(dirstream);

			windows_errno(error);
			return -1;
		}
	}

	free(dirstream->buffer);
	free(dirstream);

	return 0;
}

windows_dir* windows_opendir(const char* dir)
{
	if (!is_scan_winfind)
		return windows_opendir_stream(dir);
	else
		return windows_opendir_find(dir);
}

struct windows_dirent* windows_readdir(windows_dir* dirstream)
{
	if (!is_scan_winfind)
		return windows_readdir_stream(dirstream);
	else
		return windows_readdir_find(dirstream);
}

int windows_closedir(windows_dir* dirstream)
{
	if (!is_scan_winfind)
		return windows_closedir_stream(dirstream);
	else
		return windows_closedir_find(dirstream);
}

int windows_dirent_hidden(struct dirent* dd)
{
	return dd->d_stat.st_hidden;
}

const char* windows_stat_desc(struct stat* st)
{
	return st->st_desc;
}

unsigned windows_sleep(unsigned seconds)
{
	while (seconds) {
		if (os_signal_interrupt())         /* SIGINT should stop the sleep */
			break;
		Sleep(1000);
		--seconds;
	}

	return seconds;
}

int windows_link(const char* existing, const char* file)
{
	wchar_t conv_buf_file[CONV_MAX];
	wchar_t conv_buf_existing[CONV_MAX];

	if (!convert(conv_buf_file, file) || !convert(conv_buf_existing, existing))
		return -1;
	if (!CreateHardLinkW(conv_buf_file, conv_buf_existing, 0)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

/**
 * In Windows 10 allow creation of symlink by not privileged user.
 *
 * See: Symlinks in Windows 10!
 * https://blogs.windows.com/buildingapps/2016/12/02/symlinks-windows-10/#cQG7cx48oGH86lkI.97
 * "Specify this flag to allow creation of symbolic links when the process is not elevated"
 */
#ifndef SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE
#define SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE 0x2
#endif

static int windows_symlink_flags(const char* existing, const char* file, DWORD flags)
{
	wchar_t conv_buf_file[CONV_MAX];
	wchar_t conv_buf_existing[CONV_MAX];
	if (!convert(conv_buf_file, file) || !convert_if_required(conv_buf_existing, existing))
		return -1;

	/*
	 * We must convert to the extended-length \\?\ format if the path is too long
	 * otherwise the link creation fails.
	 * But we don't want to always convert it, to avoid to recreate
	 * user symlinks different than they were before
	 */
	if (!CreateSymbolicLinkW(conv_buf_file, conv_buf_existing,
		flags | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)
	) {
		DWORD error = GetLastError();
		if (GetLastError() != ERROR_INVALID_PARAMETER) {
			windows_errno(error);
			return -1;
		}

		/* retry without the new flag SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE */
		if (!CreateSymbolicLinkW(conv_buf_file, conv_buf_existing, flags)) {
			windows_errno(GetLastError());
			return -1;
		}
	}

	return 0;
}

int windows_symlink(const char* existing, const char* file)
{
	return windows_symlink_flags(existing, file, 0);
}

int windows_symlink_directory(const char* existing, const char* file)
{
	return windows_symlink_flags(existing, file, SYMBOLIC_LINK_FLAG_DIRECTORY);
}

/* adds missing definitions in MingW winnt.h */
#ifndef FSCTL_GET_REPARSE_POINT
#define FSCTL_GET_REPARSE_POINT 0x000900a8
#endif
#ifndef REPARSE_DATA_BUFFER_HEADER_SIZE
typedef struct _REPARSE_DATA_BUFFER {
	DWORD ReparseTag;
	WORD ReparseDataLength;
	WORD Reserved;
	_ANONYMOUS_UNION union {
		struct {
			WORD SubstituteNameOffset;
			WORD SubstituteNameLength;
			WORD PrintNameOffset;
			WORD PrintNameLength;
			ULONG Flags;
			WCHAR PathBuffer[1];
		} SymbolicLinkReparseBuffer;
		struct {
			WORD SubstituteNameOffset;
			WORD SubstituteNameLength;
			WORD PrintNameOffset;
			WORD PrintNameLength;
			WCHAR PathBuffer[1];
		} MountPointReparseBuffer;
		struct {
			BYTE DataBuffer[1];
		} GenericReparseBuffer;
	} DUMMYUNIONNAME;
} REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
#endif

int windows_readlink(const char* file, char* buffer, size_t size)
{
	wchar_t conv_buf_file[CONV_MAX];
	char conv_buf_name[CONV_MAX];
	HANDLE h;
	const char* name;
	size_t len;
	unsigned char rdb_buffer[MAXIMUM_REPARSE_DATA_BUFFER_SIZE];
	REPARSE_DATA_BUFFER* rdb = (REPARSE_DATA_BUFFER*)rdb_buffer;
	BOOL ret;
	DWORD n;

	/*
	 * Open the handle of the file.
	 *
	 * Use FILE_FLAG_BACKUP_SEMANTICS to open directories (it's just ignored for files).
	 * Use FILE_FLAG_OPEN_REPARSE_POINT to open symbolic links and not the their target.
	 */
	if (!convert(conv_buf_file, file))
		return -1;
	h = CreateFileW(conv_buf_file, 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, 0);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	/* read the reparse point */
	ret = DeviceIoControl(h, FSCTL_GET_REPARSE_POINT, 0, 0, rdb_buffer, sizeof(rdb_buffer), &n, 0);
	if (!ret) {
		windows_errno(GetLastError());
		CloseHandle(h);
		return -1;
	}

	CloseHandle(h);

	/* need at least the fixed headers */
	if (n < 20 || rdb->ReparseDataLength < 12 || (size_t)rdb->ReparseDataLength + 8 > n) {
		errno = EINVAL;
		return -1;
	}

	/* check if it's really a symbolic link */
	if (rdb->ReparseTag != IO_REPARSE_TAG_SYMLINK) {
		errno = EINVAL;
		return -1;
	}

	WORD off = rdb->SymbolicLinkReparseBuffer.PrintNameOffset;
	WORD bytes = rdb->SymbolicLinkReparseBuffer.PrintNameLength;
	size_t path_bytes = rdb->ReparseDataLength - 12;

	/*
	 * Require a canonical non-empty PrintName. It represents the user-visible
	 * symlink target, unlike SubstituteName which may use the NT namespace.
	 * Reject non-canonical reparse points instead of normalizing SubstituteName.
	 */
	if (bytes == 0) {
		errno = EINVAL;
		return -1;
	}

	/* validate alignment and bounds */
	if ((off % sizeof(WCHAR)) != 0 || (bytes % sizeof(WCHAR)) != 0 || (size_t)off + bytes > path_bytes) {
		errno = EINVAL;
		return -1;
	}

	const WCHAR* print = rdb->SymbolicLinkReparseBuffer.PathBuffer + (off / sizeof(WCHAR));
	size_t print_len = bytes / sizeof(WCHAR);

	/* convert the name to UTF-8 */
	name = u16tou8_force(conv_buf_name, CONV_MAX, print, print_len, &len);
	if (!name)
		return -1;

	/* check for overflow */
	if (len > size) {
		len = size;
	}

	memcpy(buffer, name, len);

	/* convert any \ to / */
	for (size_t i = 0; i < len; ++i) {
		if (buffer[i] == '\\')
			buffer[i] = '/';
	}

	return len;
}

/* ensure to call the real C strerror() */
#undef strerror

const char* windows_strerror(int err)
{
	/* get the normal C error from the specified err */
	char* error;
	char* previous;
	const char* str = strerror(err);
	size_t len = strlen(str);

	/* adds space for GetLastError() */
	len += 32;

	/* allocate a new one */
	error = malloc(len);
	if (!error)
		return str;
	snprintf(error, len, "%s [%d/%u]", str, err, (unsigned)GetLastError());

	/* get previous one, if any */
	previous = windows_getspecific(last_error);

	/* store in the thread local storage */
	if (windows_setspecific(last_error, error) != 0) {
		free(error);
		return str;
	}

	free(previous);
	return error;
}

/* restore the define used later */
#define  strerror windows_strerror

ssize_t windows_read(int fd, void* buffer, size_t size)
{
	HANDLE h;
	DWORD count;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	if (!ReadFile(h, buffer, size, &count, 0)) {
		DWORD error = GetLastError();

		/* a closed Windows pipe has the same read semantics as a POSIX pipe at EOF. */
		if (error == ERROR_BROKEN_PIPE)
			return 0;

		windows_errno(error);
		return -1;
	}

	return count;
}

ssize_t windows_write(int fd, const void* buffer, size_t size)
{
	HANDLE h;
	DWORD count;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	if (!WriteFile(h, buffer, size, &count, 0)) {
		windows_errno(GetLastError());
		return -1;
	}

	return count;
}

off_t windows_lseek(int fd, off_t offset, int whence)
{
	HANDLE h;
	LARGE_INTEGER pos;
	LARGE_INTEGER ret;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	/* we support only SEEK_SET */
	if (whence != SEEK_SET) {
		errno = EINVAL;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

	pos.QuadPart = offset;
	if (!SetFilePointerEx(h, pos, &ret, FILE_BEGIN)) {
		windows_errno(GetLastError());
		return -1;
	}

	return ret.QuadPart;
}

#define RETRY_MAX 10

ssize_t windows_pread(int fd, void* buffer, size_t size, off_t offset)
{
	HANDLE h;
	OVERLAPPED overlapped;
	DWORD count;
	unsigned retry = 0;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

loop:
	memset(&overlapped, 0, sizeof(overlapped));
	overlapped.Offset = offset & 0xFFFFFFFF;
	overlapped.OffsetHigh = offset >> 32;

	if (!ReadFile(h, buffer, size, &count, &overlapped)) {
		DWORD err = GetLastError();
		/*
		 * If Windows is not able to allocate memory from the PagedPool for the disk cache
		 * it could return the ERROR_NO_SYSTEM_RESOURCES error.
		 * In this case, the only possibility is to retry after a wait of few milliseconds.
		 *
		 * SQL Server reports operating system error 1450 or 1452 or 665 (retries)
		 * http://blogs.msdn.com/b/psssql/archive/2008/07/10/sql-server-reports-operating-system-error-1450-or-1452-or-665-retries.aspx
		 *
		 * 03-12-09 - ERROR_NO_SYSTEM_RESOURCES
		 * http://cbloomrants.blogspot.it/2009/03/03-12-09-errornosystemresources.html
		 *
		 * From SnapRAID Discussion Forum:
		 *
		 * Error reading file
		 * https://sourceforge.net/p/snapraid/discussion/1677233/thread/6657fdbf/
		 *
		 * Unexpected Windows ERROR_NO_SYSTEM_RESOURCES in pwrite(), retrying...
		 * https://sourceforge.net/p/snapraid/discussion/1677233/thread/a7c25ba9/
		 */
		if (err == ERROR_NO_SYSTEM_RESOURCES && retry < RETRY_MAX) {
			unsigned delay = 20 << retry;
			if (delay > 1000)
				delay = 1000;
			++retry;
			os_syslog(OS_LVL_ERROR, "unexpected Windows ERROR_NO_SYSTEM_RESOURCES in pread(), retry %u/%u after %u ms...", retry, RETRY_MAX, delay);
			Sleep(delay);
			goto loop;
		}

		if (err == ERROR_NO_SYSTEM_RESOURCES) {
			os_syslog(OS_LVL_ERROR, "giving up on ERROR_NO_SYSTEM_RESOURCES in pread() after %u retries", retry);
		}

		windows_errno(err);
		return -1;
	}

	return count;
}

ssize_t windows_pwrite(int fd, const void* buffer, size_t size, off_t offset)
{
	HANDLE h;
	OVERLAPPED overlapped;
	DWORD count;
	unsigned retry = 0;

	if (fd == -1) {
		errno = EBADF;
		return -1;
	}

	h = (HANDLE)_get_osfhandle(fd);
	if (h == INVALID_HANDLE_VALUE) {
		errno = EBADF;
		return -1;
	}

loop:
	memset(&overlapped, 0, sizeof(overlapped));
	overlapped.Offset = offset & 0xFFFFFFFF;
	overlapped.OffsetHigh = offset >> 32;

	if (!WriteFile(h, buffer, size, &count, &overlapped)) {
		DWORD err = GetLastError();

		/* see windows_pread() for comments on this error management */
		if (err == ERROR_NO_SYSTEM_RESOURCES && retry < RETRY_MAX) {
			unsigned delay = 20 << retry;
			if (delay > 1000)
				delay = 1000;
			++retry;
			os_syslog(OS_LVL_ERROR, "unexpected Windows ERROR_NO_SYSTEM_RESOURCES in pwrite(), retry %u/%u after %u ms...", retry, RETRY_MAX, delay);
			Sleep(delay);
			goto loop;
		}

		if (err == ERROR_NO_SYSTEM_RESOURCES) {
			os_syslog(OS_LVL_ERROR, "giving up on ERROR_NO_SYSTEM_RESOURCES in pwrite() after %u retries", retry);
		}

		windows_errno(err);
		return -1;
	}

	return count;
}

struct tm* windows_gmtime_r(const time_t* timer, struct tm* result)
{
	/* Windows returns 0 on success, unlike POSIX which returns the pointer */
	if (gmtime_s(result, timer) == 0) {
		return result;
	}
	return NULL;
}

struct tm* windows_localtime_r(const time_t* timer, struct tm* result)
{
	/* Windows returns 0 on success, unlike POSIX which returns the pointer */
	if (localtime_s(result, timer) == 0) {
		return result;
	}
	return NULL;
}

char* windows_realpath(const char* path, char* resolved_path)
{
	wchar_t conv_buf[CONV_MAX];
	HANDLE h;
	if (!convert(conv_buf, path))
		return 0;
	h = CreateFileW(conv_buf, 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return 0;
	}

	DWORD result = GetFinalPathNameByHandleW(h, conv_buf, CONV_MAX, FILE_NAME_NORMALIZED);
	DWORD error = GetLastError();

	CloseHandle(h);

	if (result >= CONV_MAX) {
		errno = ENAMETOOLONG;
		return 0;
	}
	if (result == 0) {
		windows_errno(error);
		return 0;
	}

	if (!u16tou8(resolved_path, conv_buf))
		return 0;

	/*
	 * Windows prefixes normalized paths with "\\?\" (for local drives)
	 * or "\\?\UNC\" (for network shares). Convert them to standard format.
	 */
	if (strncmp(resolved_path, "\\\\?\\UNC\\", 8) == 0) {
		/* replace "\\?\UNC\" with "\\" */
		resolved_path[0] = '\\';
		resolved_path[1] = '\\';
		memmove(resolved_path + 2, resolved_path + 8, strlen(resolved_path + 8) + 1);
	} else if (strncmp(resolved_path, "\\\\?\\", 4) == 0) {
		/* skip "\\?\" */
		memmove(resolved_path, resolved_path + 4, strlen(resolved_path + 4) + 1);
	}

	return resolved_path;
}

/****************************************************************************/
/* fs */

char* absolutepath(const char* restrict path, char* restrict resolved_path)
{
	if (path == 0 || path[0] == 0 || resolved_path == 0) {
		errno = EINVAL;
		return 0;
	}

	wchar_t wpath[CONV_MAX];
	wchar_t wfull[CONV_MAX];

	if (!u8tou16_mayfail(wpath, CONV_MAX, path, strlen(path) + 1, 0))
		return 0;

	DWORD len = GetFullPathNameW(wpath, CONV_MAX, wfull, 0);
	if (len == 0) {
		windows_errno(GetLastError());
		return 0;
	}

	if (len >= CONV_MAX) {
		errno = ENAMETOOLONG;
		return 0;
	}

	if (!u16tou8_mayfail(resolved_path, CONV_MAX, wfull, len + 1, 0))
		return 0;

	return resolved_path;
}

static BOOL GetFilePhysicalOffset(HANDLE h, uint64_t* physical)
{
	STARTING_VCN_INPUT_BUFFER svib;
	unsigned char rpb_buffer[sizeof(RETRIEVAL_POINTERS_BUFFER)];
	RETRIEVAL_POINTERS_BUFFER* rpb = (RETRIEVAL_POINTERS_BUFFER*)&rpb_buffer;
	BOOL ret;
	DWORD n;

	/* in Wine FSCTL_GET_RETRIEVAL_POINTERS is not supported */
	if (is_wine) {
		*physical = FILEPHY_UNREPORTED_OFFSET;
		return TRUE;
	}

	/* set the output variable, just to be safe */
	rpb->ExtentCount = 0;

	/* read the physical address */
	svib.StartingVcn.QuadPart = 0;
	ret = DeviceIoControl(h, FSCTL_GET_RETRIEVAL_POINTERS, &svib, sizeof(svib), rpb_buffer, sizeof(rpb_buffer), &n, 0);
	if (!ret) {
		DWORD error = GetLastError();
		if (error == ERROR_MORE_DATA) {
			/*
			 * We ignore ERROR_MODE_DATA because we are interested only at the first entry
			 * and this is the expected error if the files has more entries
			 */
		} else if (error == ERROR_HANDLE_EOF) {
			/*
			 * If the file is small, it can be stored in the Master File Table (MFT)
			 * and then it doesn't have a physical address
			 * In such case we report a specific fake address, to report this special condition
			 * that it's different from the 0 offset reported by the underline file system
			 */
			*physical = FILEPHY_WITHOUT_OFFSET;
			return TRUE;
		} else if (error == ERROR_NOT_SUPPORTED) {
			/* for disks shared on network this operation is not supported */
			*physical = FILEPHY_UNREPORTED_OFFSET;
			return TRUE;
		} else {
			return FALSE;
		}
	}

	if (rpb->ExtentCount < 1)
		*physical = FILEPHY_UNREPORTED_OFFSET;
	else
		*physical = rpb->Extents[0].Lcn.QuadPart + FILEPHY_REAL_OFFSET;

	return TRUE;
}

int lstat_sync(const char* file, struct windows_stat* st, uint64_t* physical)
{
	wchar_t conv_buf[CONV_MAX];
	BY_HANDLE_FILE_INFORMATION info;
	FILE_ATTRIBUTE_TAG_INFO tag;
	HANDLE h;

	/*
	 * Open the handle of the file.
	 *
	 * Use FILE_FLAG_BACKUP_SEMANTICS to open directories (it's just ignored for files).
	 * Use FILE_FLAG_OPEN_REPARSE_POINT to open symbolic links and not the their target.
	 *
	 * Note that even with FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
	 * and FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT some paths
	 * cannot be opened like "C:\System Volume Information" resulting
	 * in error ERROR_ACCESS_DENIED.
	 */
	if (!convert(conv_buf, file))
		return -1;
	h = CreateFileW(conv_buf, 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, 0);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	if (!GetFileInformationByHandle(h, &info)) {
		DWORD error = GetLastError();
		CloseHandle(h);
		windows_errno(error);
		return -1;
	}

	if (!GetReparseTagInfoByHandle(h, &tag, info.dwFileAttributes)) {
		DWORD error = GetLastError();
		CloseHandle(h);
		windows_errno(error);
		return -1;
	}

	/* read the physical offset, only if a pointer is provided */
	if (physical != 0) {
		if (!GetFilePhysicalOffset(h, physical)) {
			DWORD error = GetLastError();
			CloseHandle(h);
			windows_errno(error);
			return -1;
		}
	}

	if (!CloseHandle(h)) {
		windows_errno(GetLastError());
		return -1;
	}

	return windows_info2stat(&info, &tag, st);
}

int filephy(const char* file, uint64_t size, uint64_t* physical)
{
	wchar_t conv_buf[CONV_MAX];
	HANDLE h;

	(void)size;

	/* open the handle of the file */
	if (!convert(conv_buf, file))
		return -1;
	h = CreateFileW(conv_buf, 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0, OPEN_EXISTING, 0, 0);
	if (h == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		return -1;
	}

	if (!GetFilePhysicalOffset(h, physical)) {
		DWORD error = GetLastError();
		CloseHandle(h);
		windows_errno(error);
		return -1;
	}

	CloseHandle(h);
	return 0;
}

/****************************************************************************/
/* pthread like interface */

int windows_mutex_init(windows_mutex_t* mutex, void* attr)
{
	(void)attr;

	InitializeCriticalSection(mutex);

	return 0;
}

int windows_mutex_destroy(windows_mutex_t* mutex)
{
	DeleteCriticalSection(mutex);

	return 0;
}

int windows_mutex_lock(windows_mutex_t* mutex)
{
	EnterCriticalSection(mutex);

	return 0;
}

int windows_mutex_unlock(windows_mutex_t* mutex)
{
	LeaveCriticalSection(mutex);

	return 0;
}

int windows_cond_init(windows_cond_t* cond, void* attr)
{
	(void)attr;

	InitializeConditionVariable(cond);

	return 0;
}

int windows_cond_destroy(windows_cond_t* cond)
{
	/* note that in Windows there is no DeleteConditionVariable() to call */
	(void)cond;

	return 0;
}

int windows_cond_signal(windows_cond_t* cond)
{
	WakeConditionVariable(cond);

	return 0;
}

int windows_cond_broadcast(windows_cond_t* cond)
{
	WakeAllConditionVariable(cond);

	return 0;
}

int windows_cond_wait(windows_cond_t* cond, windows_mutex_t* mutex)
{
	if (!SleepConditionVariableCS(cond, mutex, INFINITE))
		return -1;

	return 0;
}

int windows_rwlock_init(windows_rwlock_t* rwlock, void* attr)
{
	(void)attr;
	InitializeSRWLock(&rwlock->srw);
	rwlock->exclusive = 0;

	return 0;
}

int windows_rwlock_destroy(windows_rwlock_t* rwlock)
{
	(void)rwlock;

	return 0;
}

int windows_rwlock_rdlock(windows_rwlock_t* rwlock)
{
	AcquireSRWLockShared(&rwlock->srw);

	return 0;
}

int windows_rwlock_wrlock(windows_rwlock_t* rwlock)
{
	AcquireSRWLockExclusive(&rwlock->srw);
	rwlock->exclusive = 1;

	return 0;
}

int windows_rwlock_unlock(windows_rwlock_t* rwlock)
{
	if (rwlock->exclusive) {
		rwlock->exclusive = 0;
		ReleaseSRWLockExclusive(&rwlock->srw);
	} else {
		ReleaseSRWLockShared(&rwlock->srw);
	}

	return 0;
}

struct windows_key_context {
	void (*func)(void*);
	DWORD key;
	tommy_node node;
};

/* list of all keys with destructor */
static tommy_list windows_key_list = { 0 };

int windows_key_create(windows_key_t* key, void (*destructor)(void*))
{
	struct windows_key_context* context;

	context = malloc(sizeof(struct windows_key_context));
	if (!context) {
		errno = ENOMEM;
		return -1;
	}

	context->func = destructor;
	context->key = TlsAlloc();
	if (context->key == 0xFFFFFFFF) {
		windows_errno(GetLastError());
		free(context);
		return -1;
	}

	/* insert in the list of destructors */
	if (context->func)
		tommy_list_insert_tail(&windows_key_list, &context->node, context);

	*key = context;

	return 0;
}

int windows_key_delete(windows_key_t key)
{
	struct windows_key_context* context = key;

	/* use the destructor for the local variable and remove from the list of destructors */
	if (context->func) {
		void* value = windows_getspecific(context);
		if (value)
			context->func(value);
		tommy_list_remove_existing(&windows_key_list, &context->node);
	}

	TlsFree(context->key);

	free(context);

	return 0;
}

void* windows_getspecific(windows_key_t key)
{
	struct windows_key_context* context = key;

	return TlsGetValue(context->key);
}

int windows_setspecific(windows_key_t key, void* value)
{
	struct windows_key_context* context = key;

	if (!TlsSetValue(context->key, value)) {
		windows_errno(GetLastError());
		return -1;
	}

	return 0;
}

struct windows_thread_context {
	HANDLE h;
	unsigned id;
	void* (*func)(void*);
	void* arg;
	void* ret;
};

/* forwarder to change the function declaration */
static unsigned __stdcall windows_thread_func(void* arg)
{
	struct windows_thread_context* context = arg;
	tommy_node* i;

	context->ret = context->func(context->arg);

	/* call the destructor of all the keys */
	i = tommy_list_head(&windows_key_list);
	while (i) {
		struct windows_key_context* key = i->data;
		if (key->func) {
			void* value = windows_getspecific(key);
			if (value)
				key->func(value);
		}
		i = i->next;
	}

	return 0;
}

int windows_create(thread_id_t* thread, void* attr, void* (*func)(void*), void* arg)
{
	struct windows_thread_context* context;

	(void)attr;

	context = malloc(sizeof(struct windows_thread_context));
	if (!context) {
		errno = ENOMEM;
		return -1;
	}

	context->func = func;
	context->arg = arg;
	context->ret = 0;
	context->h = (void*)_beginthreadex(0, 0, windows_thread_func, context, 0, &context->id);

	if (context->h == 0) {
		free(context);
		return -1;
	}

	*thread = context;

	return 0;
}

int windows_join(thread_id_t thread, void** retval)
{
	struct windows_thread_context* context = thread;

	if (WaitForSingleObject(context->h, INFINITE) != WAIT_OBJECT_0) {
		windows_errno(GetLastError());
		CloseHandle(context->h);
		free(context);
		return -1;
	}

	if (!CloseHandle(context->h)) {
		windows_errno(GetLastError());
		free(context);
		return -1;
	}

	*retval = context->ret;

	free(context);

	return 0;
}

/****************************************************************************/
/* exec */

#define COMMAND_LINE_MAX 32767

static int needs_quote(const WCHAR* arg)
{
	if (*arg == 0)
		return 1;

	while (*arg) {
		if (*arg == L' ' || *arg == L'\t' || *arg == L'"')
			return 1;
		++arg;
	}

	return 0;
}

#define charcat(c) \
	do { \
		if (pos + 1 >= size) { \
			errno = E2BIG; \
			return -1; \
		} \
		cmd[pos++] = (c); \
	} while (0)

static int fixcat(WCHAR* cmd, int size, int pos, const WCHAR* arg)
{
	while (*arg)
		charcat(*arg++);

	return pos;
}

/**
 * Append one argument using the Microsoft C runtime command-line
 * quoting rules. Use this when building a normal CreateProcessW()
 * command line that the target process will parse back into argv[].
 *
 * Do not use this for cmd.exe /c or batch-script arguments: cmd.exe
 * applies an additional command language with different metacharacter
 * parsing rules.
 */
static int argcat(WCHAR* cmd, int size, int pos, const WCHAR* arg)
{
	int has_quote;

	/* space separator */
	if (pos != 0)
		charcat(L' ');

	has_quote = needs_quote(arg);

	if (!has_quote) {
		while (*arg)
			charcat(*arg++);
	} else {
		/* starting quote */
		charcat(L'"');

		while (*arg) {
			int bl = 0;
			while (*arg == L'\\') {
				++arg;
				++bl;
			}

			if (*arg == 0) {
				/* double backslashes before closing quote */
				bl = bl * 2;
				while (bl--)
					charcat(L'\\');
			} else if (*arg == '"') {
				/* double backslashes + escape the quote */
				bl = bl * 2 + 1;
				while (bl--)
					charcat(L'\\');
				charcat(L'"');
				++arg;
			} else {
				/* normal backslashes */
				while (bl--)
					charcat(L'\\');
				charcat(*arg);
				++arg;
			}
		}

		/* ending quote */
		charcat(L'"');
	}

	return pos;
}

/**
 * Append one argument for a batch script invoked through cmd.exe /c.
 * Unlike argcat(), this must preserve the argument boundary while
 * preventing cmd.exe command metacharacters from changing the command
 * structure.
 *
 * Use this only for intentional .bat/.cmd execution through cmd.exe.
 * Do not use it for normal CreateProcessW() argv serialization.
 */
static int scriptcat(WCHAR* cmd, int size, int pos, const WCHAR* arg)
{
	int has_space = 0;
	const WCHAR* p;

	/* space separator */
	if (pos != 0)
		charcat(L' ');

	/* empty argument requires quotes to preserve it as a parameter */
	if (*arg == 0) {
		charcat(L'"');
		charcat(L'"');
		return pos;
	}

	/* check for embedded quotes and whitespace */
	for (p = arg; *p; ++p) {
		if (*p == L'"') {
			/* embedded double quotes in script arguments are unsupported */
			errno = EINVAL;
			return -1;
		}
		if (*p == L' ' || *p == L'\t')
			has_space = 1;
	}

	if (has_space) {
		/* enclose arguments containing whitespace in double quotes */
		charcat(L'"');
		while (*arg)
			charcat(*arg++);
		charcat(L'"');
	} else {
		/* escape cmd.exe structural metacharacters using caret (^) */
		while (*arg) {
			switch (*arg) {
			case L'&' :
			case L'|' :
			case L'<' :
			case L'>' :
			case L'^' :
			case L'(' :
			case L')' :
				charcat(L'^');
				charcat(*arg);
				break;
			default :
				charcat(*arg);
				break;
			}
			++arg;
		}
	}

	return pos;
}

static HANDLE os_job_handle = 0;

struct process_startup {
	STARTUPINFOEXW si;
	LPPROC_THREAD_ATTRIBUTE_LIST attribute_list;
	HANDLE handle_list[3];
};

static void process_startup_done(struct process_startup* startup)
{
	if (startup->attribute_list != 0) {
		DeleteProcThreadAttributeList(startup->attribute_list);
		free(startup->attribute_list);
		startup->attribute_list = 0;
	}
}

static int process_startup_init(struct process_startup* startup, HANDLE stdin_handle, HANDLE stdout_handle, HANDLE stderr_handle)
{
	HANDLE std_handles[3];
	SIZE_T attribute_size = 0;
	DWORD handle_count = 0;

	ZeroMemory(startup, sizeof(*startup));
	startup->si.StartupInfo.cb = sizeof(startup->si);
	startup->si.StartupInfo.hStdInput = stdin_handle;
	startup->si.StartupInfo.hStdOutput = stdout_handle;
	startup->si.StartupInfo.hStdError = stderr_handle;
	startup->si.StartupInfo.dwFlags |= STARTF_USESTDHANDLES;

	std_handles[0] = stdin_handle;
	std_handles[1] = stdout_handle;
	std_handles[2] = stderr_handle;
	for (DWORD i = 0; i < 3; ++i) {
		int found = 0;
		for (DWORD j = 0; j < handle_count; ++j) {
			if (std_handles[i] == startup->handle_list[j]) {
				found = 1;
				break;
			}
		}
		if (!found)
			startup->handle_list[handle_count++] = std_handles[i];
	}

	InitializeProcThreadAttributeList(0, 1, 0, &attribute_size);
	startup->attribute_list = malloc(attribute_size);
	if (startup->attribute_list == 0) {
		errno = ENOMEM;
		return -1;
	}

	if (!InitializeProcThreadAttributeList(startup->attribute_list, 1, 0, &attribute_size)) {
		windows_errno(GetLastError());
		free(startup->attribute_list);
		startup->attribute_list = 0;
		return -1;
	}

	startup->si.lpAttributeList = startup->attribute_list;
	if (!UpdateProcThreadAttribute(startup->attribute_list, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
		startup->handle_list, handle_count * sizeof(HANDLE), 0, 0)) {
		windows_errno(GetLastError());
		process_startup_done(startup);
		return -1;
	}

	return 0;
}

pid_t os_spawn(char** argv, int* stdout_read_int, int* stderr_read_int, const char* run_as_user, pid_t* pid_slot)
{
	wchar_t conv[CONV_MAX];
	HANDLE stdout_write_handle = INVALID_HANDLE_VALUE;
	HANDLE stdout_read_handle = INVALID_HANDLE_VALUE;
	HANDLE stderr_write_handle = INVALID_HANDLE_VALUE;
	HANDLE stderr_read_handle = INVALID_HANDLE_VALUE;
	SECURITY_ATTRIBUTES sa;
	PROCESS_INFORMATION pi;
	struct process_startup startup;
	BOOL ret;
	DWORD create_error = ERROR_SUCCESS;
	int has_out = (stdout_read_int != NULL);
	int has_err = (stderr_read_int != NULL);
	int out_f = -1;
	int err_f = -1;

	/* set the bInheritHandle flag so pipe handles are inherited */
	sa.nLength = sizeof(SECURITY_ATTRIBUTES);
	sa.bInheritHandle = TRUE;
	sa.lpSecurityDescriptor = NULL;

	if (has_out) {
		/* create a pipe for the child process's STDOUT */
		if (!CreatePipe(&stdout_read_handle, &stdout_write_handle, &sa, 0)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to create pipe for spawn, errno=%s(%d)", strerror(errno), errno);
			return -1;
		}

		/* ensure the reading handle to the pipe is not inherited */
		if (!SetHandleInformation(stdout_read_handle, HANDLE_FLAG_INHERIT, 0)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to handle information for spawn, errno=%s(%d)", strerror(errno), errno);
			CloseHandle(stdout_write_handle);
			CloseHandle(stdout_read_handle);
			return -1;
		}

		out_f = _open_osfhandle((intptr_t)stdout_read_handle, O_RDONLY | O_BINARY);
		if (out_f == -1) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to open osfhandle for spawn, errno=%s(%d)", strerror(errno), errno);
			CloseHandle(stdout_write_handle);
			CloseHandle(stdout_read_handle);
			return -1;
		}
	}

	if (has_err) {
		/* create a pipe for the child process's STDERR */
		if (!CreatePipe(&stderr_read_handle, &stderr_write_handle, &sa, 0)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to create pipe for spawn, errno=%s(%d)", strerror(errno), errno);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			return -1;
		}

		/* ensure the reading handle to the pipe is not inherited */
		if (!SetHandleInformation(stderr_read_handle, HANDLE_FLAG_INHERIT, 0)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to handle information for spawn, errno=%s(%d)", strerror(errno), errno);
			CloseHandle(stderr_write_handle);
			CloseHandle(stderr_read_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			return -1;
		}

		err_f = _open_osfhandle((intptr_t)stderr_read_handle, O_RDONLY | O_BINARY);
		if (err_f == -1) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to open osfhandle for spawn, errno=%s(%d)", strerror(errno), errno);
			CloseHandle(stderr_write_handle);
			CloseHandle(stderr_read_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			return -1;
		}
	}

	/* open NUL to redirect stdin and any uncaptured stdout or stderr */
	HANDLE nul_handle = CreateFileW(L"NUL", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, &sa, OPEN_EXISTING, 0, NULL);
	if (nul_handle == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to open NUL for spawn, errno=%s(%d)", strerror(errno), errno);
		if (has_out) {
			CloseHandle(stdout_write_handle);
			close(out_f);
		}
		if (has_err) {
			CloseHandle(stderr_write_handle);
			close(err_f);
		}
		return -1;
	}

	/* prepare command line string (Windows uses a single string, not an array) */
	WCHAR cmd_buffer[COMMAND_LINE_MAX];
	int pos = 0;
	for (int i = 0; argv[i]; ++i) {
		if (!u8tou16(conv, argv[i])) {
			CloseHandle(nul_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			if (has_err) {
				CloseHandle(stderr_write_handle);
				close(err_f);
			}
			return -1;
		}
		pos = argcat(cmd_buffer, COMMAND_LINE_MAX, pos, conv);
		if (pos < 0) {
			os_syslog(OS_LVL_INFO, "command to long for spawn");
			CloseHandle(nul_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			if (has_err) {
				CloseHandle(stderr_write_handle);
				close(err_f);
			}
			return -1;
		}
	}
	cmd_buffer[pos] = 0;

	/* set up standard handles and the explicit inheritance whitelist */
	ZeroMemory(&pi, sizeof(pi));
	if (process_startup_init(&startup, nul_handle,
		has_out ? stdout_write_handle : nul_handle,
		has_err ? stderr_write_handle : nul_handle) != 0) {
		os_syslog(OS_LVL_INFO, "failed to create handle list for spawn, errno=%s(%d)", strerror(errno), errno);
		CloseHandle(nul_handle);
		if (has_out) {
			CloseHandle(stdout_write_handle);
			close(out_f);
		}
		if (has_err) {
			CloseHandle(stderr_write_handle);
			close(err_f);
		}
		return -1;
	}

	/*
	 * Set the Working Directory to the root of the C drive.
	 * For safety, we avoid defaulting to C:\Windows\System32.
	 */
	const wchar_t* cwd = L"C:\\";

	if (pid_spawn_begin(pid_slot) != 0) {
		CloseHandle(nul_handle);
		if (has_out) {
			CloseHandle(stdout_write_handle);
			close(out_f);
		}
		if (has_err) {
			CloseHandle(stderr_write_handle);
			close(err_f);
		}
		process_startup_done(&startup);
		return -1;
	}

	/* create the child process */
	if (run_as_user == 0 || run_as_user[0] == 0) {
		ret = CreateProcessW(
			NULL,
			cmd_buffer,
			NULL, NULL,
			TRUE, /* inherit handles from the explicit list */
			CREATE_SUSPENDED | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT,
			NULL, cwd,
			&startup.si.StartupInfo, &pi
		);
		if (!ret)
			create_error = GetLastError();
	} else {
		/* drop to restricted service account */
		HANDLE h_token = NULL;

		/* validate that the requested user is actually a supported Service Account before attempting logon */
		if (_stricmp(run_as_user, "LocalService") != 0 && _stricmp(run_as_user, "NetworkService") != 0) {
			os_syslog(OS_LVL_INFO, "only supported users are LocalService and NetworkService");
			pid_unpublish(pid_slot, 0);
			process_startup_done(&startup);
			CloseHandle(nul_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			if (has_err) {
				CloseHandle(stderr_write_handle);
				close(err_f);
			}
			return -1;
		}

		const wchar_t* wuser = _stricmp(run_as_user, "LocalService") == 0 ? L"LocalService" : L"NetworkService";
		if (!LogonUserW(wuser, L"NT AUTHORITY", NULL, LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT, &h_token)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to logon user %s, errno=%s(%d)", run_as_user, strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			process_startup_done(&startup);
			CloseHandle(nul_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			if (has_err) {
				CloseHandle(stderr_write_handle);
				close(err_f);
			}
			return -1;
		}

		/* create an environment block to ensure PATH is loaded */
		LPVOID env = NULL;
		if (!CreateEnvironmentBlock(&env, h_token, FALSE)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to get user %s environment, errno=%s(%d)", run_as_user, strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			CloseHandle(h_token);
			process_startup_done(&startup);
			CloseHandle(nul_handle);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			if (has_err) {
				CloseHandle(stderr_write_handle);
				close(err_f);
			}
			return -1;
		}

		ret = CreateProcessAsUserW(
			h_token,
			NULL,
			cmd_buffer,
			NULL, NULL,
			TRUE, /* inherit handles from the explicit list */
			CREATE_SUSPENDED | CREATE_NEW_PROCESS_GROUP | CREATE_UNICODE_ENVIRONMENT | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT,
			env, cwd,
			&startup.si.StartupInfo, &pi
		);
		if (!ret)
			create_error = GetLastError();

		if (env)
			DestroyEnvironmentBlock(env);
		CloseHandle(h_token);
	}
	process_startup_done(&startup);
	if (!ret) {
		windows_errno(create_error);
		os_syslog(OS_LVL_INFO, "failed to create process '%s' for spawn, errno=%s(%d)", argv[0], strerror(errno), errno);
		pid_unpublish(pid_slot, 0);
		CloseHandle(nul_handle);
		if (has_out) {
			CloseHandle(stdout_write_handle);
			close(out_f);
		}
		if (has_err) {
			CloseHandle(stderr_write_handle);
			close(err_f);
		}
		return -1;
	}

	/* close NUL handle in parent */
	CloseHandle(nul_handle);

	/*
	 * Assign spawned process to Job Object configured with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE.
	 * This ensures Windows automatically terminates child processes if the daemon crashes unexpectedly.
	 */
	if (os_job_handle != 0) {
		if (!AssignProcessToJobObject(os_job_handle, pi.hProcess)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to assign process to job object, errno=%s(%d)", strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			TerminateProcess(pi.hProcess, 1);
			CloseHandle(pi.hThread);
			CloseHandle(pi.hProcess);
			if (has_out) {
				CloseHandle(stdout_write_handle);
				close(out_f);
			}
			if (has_err) {
				CloseHandle(stderr_write_handle);
				close(err_f);
			}
			return -1;
		}
	}

	/* resume the primary thread now that the process is assigned to the job object */
	if (ResumeThread(pi.hThread) == (DWORD)-1) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to resume thread for spawn, errno=%s(%d)", strerror(errno), errno);
		pid_unpublish(pid_slot, 0);
		TerminateProcess(pi.hProcess, 1);
		CloseHandle(pi.hThread);
		CloseHandle(pi.hProcess);
		if (has_out) {
			CloseHandle(stdout_write_handle);
			close(out_f);
		}
		if (has_err) {
			CloseHandle(stderr_write_handle);
			close(err_f);
		}
		return -1;
	}

	/* close the write end of the pipes in the parent */
	if (has_out) {
		CloseHandle(stdout_write_handle);
	}
	if (has_err) {
		CloseHandle(stderr_write_handle);
	}

	/* close the handle to the primary thread, we don't need it */
	CloseHandle(pi.hThread);

	if (has_out) {
		*stdout_read_int = out_f;
	}
	if (has_err) {
		*stderr_read_int = err_f;
	}

	pid_t pid = (intptr_t)pi.hProcess;
	pid_publish(pid_slot, pid);

	return pid;
}

/**
 * Get the operating system process ID suitable for display or logging.
 * This function is intended for display purposes only and not as a process reference.
 */
uint64_t os_pid(pid_t pid)
{
	if (pid <= 0)
		return 0;

	HANDLE h = (void*)pid;
	return (uint64_t)GetProcessId(h);
}

/**
 * Get the operating system process ID of a published process slot suitable for display or logging.
 * This function is intended for display purposes only and not as a process reference.
 */
uint64_t os_slot_pid(const pid_t* pid_slot)
{
	if (pid_slot == 0)
		return 0;

	exec_lock();
	uint64_t pid = os_pid(*pid_slot);
	exec_unlock();

	return pid;
}

/**
 * Wait for the child process to terminate.
 */
pid_t os_wait(pid_t pid, int* status, pid_t* pid_slot)
{
	HANDLE h = (void*)pid;
	DWORD exit_code;

	WaitForSingleObject(h, INFINITE);

	if (GetExitCodeProcess(h, &exit_code)) {
		*status = exit_code;
		if (pid_slot != 0)
			pid_unpublish(pid_slot, pid);
		return pid;
	} else {
		windows_errno(GetLastError());
		if (pid_slot != 0)
			pid_unpublish(pid_slot, pid);
		return -1;
	}
}

/**
 * Release the process reference returned by os_spawn().
 */
void os_dispose(pid_t pid)
{
	if (pid > 0)
		CloseHandle((HANDLE)(intptr_t)pid);
}

/**
 * Gracefully terminate a published process.
 */
int os_term(pid_t* pid_slot)
{
	if (pid_slot == 0) {
		errno = EINVAL;
		return -1;
	}

	exec_lock();
	pid_t pid = *pid_slot;
	if (pid == PID_SPAWN) {
		*pid_slot = PID_TERM;
		exec_unlock();
		return 0;
	}
	if (pid == PID_NONE || pid == PID_TERM || pid == PID_KILL) {
		exec_unlock();
		return 0;
	}
	int ret = pid_term(pid);
	exec_unlock();
	return ret;
}

/**
 * Forcibly terminate a published process.
 */
int os_kill(pid_t* pid_slot)
{
	if (pid_slot == 0) {
		errno = EINVAL;
		return -1;
	}

	exec_lock();
	pid_t pid = *pid_slot;
	if (pid == PID_NONE || pid == PID_SPAWN || pid == PID_TERM) {
		*pid_slot = PID_KILL;
		exec_unlock();
		return 0;
	}
	if (pid == PID_KILL) {
		exec_unlock();
		return 0;
	}
	*pid_slot = PID_KILL;
	int ret = pid_kill(pid);
	exec_unlock();
	return ret;
}

/**
 * Waits for a process with an optional timeout, terminating it if exceeded.
 */
static void wait_process_timeout(HANDLE process, uint64_t timeout_sec, int* timed_out)
{
	DWORD wait_ms = INFINITE;

	if (timeout_sec != 0) {
		if (timeout_sec > 0xFFFFFFFE / 1000)
			wait_ms = 0xFFFFFFFE;
		else
			wait_ms = (DWORD)(timeout_sec * 1000);
	}

	*timed_out = 0;

	DWORD wait_res = WaitForSingleObject(process, wait_ms);
	if (wait_res == WAIT_TIMEOUT) {
		*timed_out = 1;
		TerminateProcess(process, 1);
		WaitForSingleObject(process, INFINITE);
	}
}

/**
 * Execute a shell command synchronously and wait for termination.
 */
int os_command(const char* command, const char* run_as_user, const char* stdin_text, uint64_t timeout_sec, pid_t* pid_slot)
{
	wchar_t conv[CONV_MAX];
	HANDLE stdin_read_handle;
	HANDLE stdin_write_handle;
	SECURITY_ATTRIBUTES sa;
	PROCESS_INFORMATION pi;
	struct process_startup startup;
	BOOL ret;
	DWORD create_error = ERROR_SUCCESS;
	int64_t start, stop;

	if (!u8tou16(conv, command))
		return -1;

	start = os_tick_sec();

	sa.nLength = sizeof(SECURITY_ATTRIBUTES);
	sa.bInheritHandle = TRUE;
	sa.lpSecurityDescriptor = NULL;

	/* create pipe for child's STDIN */
	if (!CreatePipe(&stdin_read_handle, &stdin_write_handle, &sa, 0)) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to create pipe for command, errno=%s(%d)", strerror(errno), errno);
		return -1;
	}

	/* ensure the parent's write end is NOT inherited */
	if (!SetHandleInformation(stdin_write_handle, HANDLE_FLAG_INHERIT, 0)) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to handle information for spawn, errno=%s(%d)", strerror(errno), errno);
		CloseHandle(stdin_read_handle);
		CloseHandle(stdin_write_handle);
		return -1;
	}

	/* create a handle to the NUL device */
	HANDLE nul = CreateFileW(
		L"NUL",
		GENERIC_WRITE,
		FILE_SHARE_WRITE | FILE_SHARE_READ,
		&sa,
		OPEN_EXISTING,
		0,
		NULL);
	if (nul == INVALID_HANDLE_VALUE) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to create nul device, errno=%s(%d)", strerror(errno), errno);
		CloseHandle(stdin_read_handle);
		CloseHandle(stdin_write_handle);
		return -1;
	}

	ZeroMemory(&pi, sizeof(pi));
	if (process_startup_init(&startup, stdin_read_handle, nul, nul) != 0) {
		os_syslog(OS_LVL_INFO, "failed to create handle list for command, errno=%s(%d)", strerror(errno), errno);
		CloseHandle(stdin_read_handle);
		CloseHandle(stdin_write_handle);
		CloseHandle(nul);
		return -1;
	}

	/*
	 * Set the Working Directory to the root of the C drive.
	 * For safety, we avoid defaulting to C:\Windows\System32.
	 */
	const wchar_t* cwd = L"C:\\";

	if (pid_spawn_begin(pid_slot) != 0) {
		CloseHandle(stdin_read_handle);
		CloseHandle(stdin_write_handle);
		CloseHandle(nul);
		process_startup_done(&startup);
		return -1;
	}

	/*
	 * No drop of privilege requested
	 * Run exactly as the parent daemon
	 */
	if (run_as_user == 0 || run_as_user[0] == 0) {
		/* create the child process */
		ret = CreateProcessW(
			NULL,
			conv,
			NULL, NULL,
			TRUE, /* inherit handles from the explicit list */
			CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT,
			NULL, cwd,
			&startup.si.StartupInfo, &pi
		);
		if (!ret)
			create_error = GetLastError();
	} else {
		/*
		 * Drop to restricted service account.
		 */
		HANDLE h_token = NULL;

		/*
		 * Validate that the requested user is actually a supported
		 * Service Account before attempting logon.
		 */
		if (_stricmp(run_as_user, "LocalService") != 0 && _stricmp(run_as_user, "NetworkService") != 0) {
			os_syslog(OS_LVL_INFO, "only supported users are LocalService and NetworkService");
			pid_unpublish(pid_slot, 0);
			process_startup_done(&startup);
			CloseHandle(stdin_read_handle);
			CloseHandle(stdin_write_handle);
			CloseHandle(nul);
			return -1;
		}

		const wchar_t* wuser = _stricmp(run_as_user, "LocalService") == 0 ? L"LocalService" : L"NetworkService";
		if (!LogonUserW(wuser, L"NT AUTHORITY", NULL, LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT, &h_token)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to logon user %s, errno=%s(%d)", run_as_user, strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			process_startup_done(&startup);
			CloseHandle(stdin_read_handle);
			CloseHandle(stdin_write_handle);
			CloseHandle(nul);
			return -1;
		}

		/*
		 * Create an environment block to ensure PATH is loaded.
		 */
		LPVOID env = NULL;
		if (!CreateEnvironmentBlock(&env, h_token, FALSE)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to get user %s environment, errno=%s(%d)", run_as_user, strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			process_startup_done(&startup);
			CloseHandle(stdin_read_handle);
			CloseHandle(stdin_write_handle);
			CloseHandle(nul);
			CloseHandle(h_token);
			return -1;
		}

		ret = CreateProcessAsUserW(
			h_token,
			NULL,
			conv,
			NULL, NULL,
			TRUE, /* inherit handles from the explicit list */
			CREATE_SUSPENDED | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT | EXTENDED_STARTUPINFO_PRESENT,
			env, cwd,
			&startup.si.StartupInfo, &pi
		);
		if (!ret)
			create_error = GetLastError();

		if (env)
			DestroyEnvironmentBlock(env);
		CloseHandle(h_token);
	}
	process_startup_done(&startup);
	if (!ret) {
		windows_errno(create_error);
		os_syslog(OS_LVL_INFO, "failed to create process '%s' for command, errno=%s(%d)", command, strerror(errno), errno);
		pid_unpublish(pid_slot, 0);
		CloseHandle(stdin_read_handle);
		CloseHandle(stdin_write_handle);
		CloseHandle(nul);
		return -1;
	}

	/* close nul device */
	CloseHandle(nul);

	/* close the read end in the parent immediately */
	CloseHandle(stdin_read_handle);

	/* assign the process to the global job object before allowing it to run */
	if (os_job_handle != 0) {
		if (!AssignProcessToJobObject(os_job_handle, pi.hProcess)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to assign command process to job object, errno=%s(%d)", strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			TerminateProcess(pi.hProcess, 1);
			CloseHandle(pi.hThread);
			CloseHandle(pi.hProcess);
			CloseHandle(stdin_write_handle);
			return -1;
		}
	}

	/* resume the primary thread now that the process is assigned to the job object */
	if (ResumeThread(pi.hThread) == (DWORD)-1) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to resume thread for command, errno=%s(%d)", strerror(errno), errno);
		pid_unpublish(pid_slot, 0);
		TerminateProcess(pi.hProcess, 1);
		CloseHandle(pi.hThread);
		CloseHandle(pi.hProcess);
		CloseHandle(stdin_write_handle);
		return -1;
	}

	pid_t pid = (intptr_t)pi.hProcess;
	pid_publish(pid_slot, pid);

	/* write the string to the child's STDIN */
	if (stdin_text != 0) {
		size_t len = strlen(stdin_text);
		size_t written = 0;
		while (written < len) {
			DWORD count;
			if (!WriteFile(stdin_write_handle, stdin_text + written, len - written, &count, 0)) {
				DWORD error = GetLastError();
				if (error == ERROR_BROKEN_PIPE || error == ERROR_NO_DATA)
					break; /* child closed stdin early */
				windows_errno(error);
				os_syslog(OS_LVL_INFO, "failed to write stdin to command %s, errno=%s(%d)", command, strerror(errno), errno);
				break;
			}
			written += count;
		}
	}

	/* closing the write handle sends EOF to the child */
	CloseHandle(stdin_write_handle);

	/* wait for completion and get exit code */
	int timed_out;
	wait_process_timeout(pi.hProcess, timeout_sec, &timed_out);

	DWORD status;
	GetExitCodeProcess(pi.hProcess, &status);

	pid_unpublish(pid_slot, pid);

	CloseHandle(pi.hThread);
	CloseHandle(pi.hProcess);

	stop = os_tick_sec();
	int64_t execution_time = stop - start;

	if (timed_out) {
		os_syslog(OS_LVL_INFO, "command %s timeout after %" PRId64 " seconds", command, execution_time);
		return -1;
	}

	if (execution_time > 30)
		os_syslog(OS_LVL_WARNING, "command %s ran for %" PRId64 " seconds that is unexpectedly long", command, execution_time);

	if (WIFEXITED(status)) {
		int exit_code = WEXITSTATUS(status);
		if (exit_code == 0)
			os_syslog(OS_LVL_INFO, "command %s terminated in %" PRId64 " seconds with success", command, execution_time);
		else
			os_syslog(OS_LVL_INFO, "command %s terminated in %" PRId64 " seconds with exit code %d", command, execution_time, exit_code);
		return exit_code;
	} else if (WIFSIGNALED(status)) {
		/* child died from a signal */
		int sig = WTERMSIG(status);
		os_syslog(OS_LVL_INFO, "command %s terminated in %" PRId64 " seconds with signal %s(%d)", command, execution_time, os_signal_name(sig), sig);
		return 128 + sig;
	} else {
		/* in Windows it can happen */
		os_syslog(OS_LVL_INFO, "command %s terminated in %" PRId64 " seconds for unknown reason, status=0x%08x", command, execution_time, (unsigned)status);
		return -1;
	}
}

struct env_item {
	tommy_node node;
	WCHAR str[1];
};

static size_t env_key_len(const WCHAR* s)
{
	size_t i = 0;
	if (s[0] == '=')
		i = 1;
	while (s[i] != 0 && s[i] != '=')
		++i;
	return i;
}

/**
 * Case-insensitive comparison of environment variable names (keys only).
 *
 * Compares two environment strings up to the '=' character separating the key from the value.
 * Returns negative if a < b, positive if a > b, or 0 if key names match.
 */
static int env_item_compare(const void* void_a, const void* void_b)
{
	const struct env_item* a = void_a;
	const struct env_item* b = void_b;

	size_t len_a = env_key_len(a->str);
	size_t len_b = env_key_len(b->str);
	size_t min_len = len_a < len_b ? len_a : len_b;

	int cmp = _wcsnicmp(a->str, b->str, min_len);
	if (cmp != 0)
		return cmp;

	if (len_a < len_b)
		return -1;
	if (len_a > len_b)
		return 1;

	return 0;
}

/**
 * Combine base environment strings with extra envp variables into a single block.
 *
 * Win32 CreateProcessW requires environment blocks to be sorted alphabetically
 * (case-insensitive) by variable name. Unsorted environment blocks cause Win32 CRT
 * variable lookups (e.g. GetEnvironmentVariableW) in child processes to fail.
 */
static WCHAR* env_combine(const WCHAR* base_env, char** envp)
{
	tommy_list list;
	tommy_list_init(&list);

	size_t total_len = 0;
	WCHAR* new_env = NULL;

	/* add base_env strings */
	if (base_env) {
		const WCHAR* p = base_env;
		while (*p != 0) {
			size_t len = wcslen(p);
			struct env_item* item = malloc(sizeof(struct env_item) + len * sizeof(WCHAR));
			if (!item) {
				errno = ENOMEM;
				goto bail;
			}
			memcpy(item->str, p, (len + 1) * sizeof(WCHAR));
			tommy_list_insert_tail(&list, &item->node, item);
			total_len += len + 1;
			p += len + 1;
		}
	}

	/* add envp strings */
	if (envp) {
		for (int i = 0; envp[i] != NULL; ++i) {
			wchar_t conv[CONV_MAX];
			if (!u8tou16(conv, envp[i]))
				goto bail;
			size_t len = wcslen(conv);
			struct env_item* item = malloc(sizeof(struct env_item) + len * sizeof(WCHAR));
			if (!item) {
				errno = ENOMEM;
				goto bail;
			}
			memcpy(item->str, conv, (len + 1) * sizeof(WCHAR));
			tommy_list_insert_tail(&list, &item->node, item);
			total_len += len + 1;
		}
	}

	if (total_len == 0) {
		WCHAR* empty_env = malloc(2 * sizeof(WCHAR));
		if (!empty_env)
			errno = ENOMEM;
		if (empty_env) {
			empty_env[0] = 0;
			empty_env[1] = 0;
		}
		return empty_env;
	}

	tommy_list_sort(&list, env_item_compare);

	new_env = malloc((total_len + 1) * sizeof(WCHAR));
	if (!new_env)
		errno = ENOMEM;
	if (new_env) {
		WCHAR* dst = new_env;
		for (tommy_node* node = tommy_list_head(&list); node; node = node->next) {
			struct env_item* item = node->data;
			if (node->next) {
				struct env_item* next_item = node->next->data;

				/* skip earlier duplicates so only the latest value is kept */
				if (env_item_compare(item, next_item) == 0)
					continue;
			}

			size_t len = wcslen(item->str);
			memcpy(dst, item->str, (len + 1) * sizeof(WCHAR));
			dst += len + 1;
		}
		*dst = 0; /* double-null terminator */
	}

bail:
	/* free all list items */
	while (tommy_list_head(&list)) {
		tommy_node* head = tommy_list_head(&list);
		struct env_item* item = head->data;
		tommy_list_remove_existing(&list, head);
		free(item);
	}

	return new_env;
}

/**
 * Execute an external script synchronously and wait for termination.
 */
int os_script(char** argv, char** envp, const char* run_as_user, uint64_t timeout_sec, pid_t* pid_slot)
{
	wchar_t conv[CONV_MAX];
	PROCESS_INFORMATION pi;
	STARTUPINFOW si;
	BOOL ret;
	char resolved_path[PATH_MAX];
	int64_t start, stop;
	const char* script_path = argv[0];

	/* resolve the script path to prevent symlink attacks */
	if (!realpath(script_path, resolved_path)) {
		os_syslog(OS_LVL_INFO, "failed to resolve script, path=%s, errno=%s(%d)", script_path, strerror(errno), errno);
		return -1;
	}

	start = os_tick_sec();

	ZeroMemory(&pi, sizeof(pi));
	ZeroMemory(&si, sizeof(si));
	si.cb = sizeof(si);

	/* prepare command line string (Windows uses a single string, not an array) */
	WCHAR cmd_buffer[COMMAND_LINE_MAX];
	int pos = 0;

	/*
	 * We add an extra set of quotes: cmd.exe /d /v:off /c " "path with spaces" arg1 "arg 2" "
	 * This ensures cmd.exe parses the internal quotes correctly.
	 * /d disables AutoRun registry commands to ensure deterministic execution.
	 * /v:off explicitly disables delayed environment variable expansion (!VAR!).
	 */
	pos = fixcat(cmd_buffer, COMMAND_LINE_MAX, pos, L"cmd.exe /d /v:off /c \" ");
	if (!u8tou16(conv, resolved_path))
		return -1;
	pos = scriptcat(cmd_buffer, COMMAND_LINE_MAX, pos, conv);
	if (pos < 0) {
		if (errno == EINVAL)
			os_syslog(OS_LVL_INFO, "unsupported embedded double quote in script path");
		else
			os_syslog(OS_LVL_INFO, "command to long for script");
		return -1;
	}
	for (int i = 1; argv[i]; ++i) {
		if (!u8tou16(conv, argv[i]))
			return -1;
		pos = scriptcat(cmd_buffer, COMMAND_LINE_MAX, pos, conv);
		if (pos < 0) {
			if (errno == EINVAL)
				os_syslog(OS_LVL_INFO, "unsupported embedded double quote in script argument");
			else
				os_syslog(OS_LVL_INFO, "command to long for script");
			return -1;
		}
	}
	pos = fixcat(cmd_buffer, COMMAND_LINE_MAX, pos, L" \"");
	if (pos < 0) {
		os_syslog(OS_LVL_INFO, "command to long for script");
		return -1;
	}
	cmd_buffer[pos] = 0;

	/*
	 * Set the Working Directory to the root of the C drive.
	 * For safety, we avoid defaulting to C:\Windows\System32.
	 */
	const wchar_t* cwd = L"C:\\";

	if (pid_spawn_begin(pid_slot) != 0) {
		return -1;
	}

	/*
	 * No drop of privilege requested
	 * Run exactly as the parent daemon
	 */
	if (run_as_user == 0 || run_as_user[0] == 0) {
		WCHAR* base_env = NULL;
		WCHAR* combined_env = NULL;
		DWORD creation_flags = CREATE_SUSPENDED | CREATE_NO_WINDOW;

		if (envp != NULL) {
			base_env = GetEnvironmentStringsW();
			if (!base_env) {
				windows_errno(GetLastError());
				os_syslog(OS_LVL_INFO, "failed to get environment strings, errno=%s(%d)", strerror(errno), errno);
				pid_unpublish(pid_slot, 0);
				return -1;
			}
			combined_env = env_combine(base_env, envp);
			FreeEnvironmentStringsW(base_env);
			if (!combined_env) {
				os_syslog(OS_LVL_INFO, "failed to combine environment strings, errno=%s(%d)", strerror(errno), errno);
				pid_unpublish(pid_slot, 0);
				return -1;
			}
			creation_flags |= CREATE_UNICODE_ENVIRONMENT;
		}

		/* create the child process */
		ret = CreateProcessW(
			NULL,
			cmd_buffer,
			NULL, NULL,
			FALSE, /* no need to inherit handles */
			creation_flags,
			combined_env, cwd,
			&si, &pi
		);

		if (combined_env)
			free(combined_env);
	} else {
		/*
		 * Drop to restricted service account.
		 */
		HANDLE h_token = NULL;

		/*
		 * Validate that the requested user is actually a supported
		 * Service Account before attempting logon.
		 */
		if (_stricmp(run_as_user, "LocalService") != 0 && _stricmp(run_as_user, "NetworkService") != 0) {
			os_syslog(OS_LVL_INFO, "only supported users are LocalService and NetworkService");
			pid_unpublish(pid_slot, 0);
			return -1;
		}

		const wchar_t* wuser = _stricmp(run_as_user, "LocalService") == 0 ? L"LocalService" : L"NetworkService";
		if (!LogonUserW(wuser, L"NT AUTHORITY", NULL, LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT, &h_token)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to logon user %s, errno=%s(%d)", run_as_user, strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			return -1;
		}

		/*
		 * Create an environment block to ensure PATH is loaded.
		 */
		LPVOID env = NULL;
		if (!CreateEnvironmentBlock(&env, h_token, FALSE)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to get user %s environment, errno=%s(%d)", run_as_user, strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			CloseHandle(h_token);
			return -1;
		}

		WCHAR* combined_env = NULL;
		if (envp != NULL) {
			combined_env = env_combine((const WCHAR*)env, envp);
			if (!combined_env) {
				os_syslog(OS_LVL_INFO, "failed to combine environment strings, errno=%s(%d)", strerror(errno), errno);
				pid_unpublish(pid_slot, 0);
				DestroyEnvironmentBlock(env);
				CloseHandle(h_token);
				return -1;
			}
		}

		ret = CreateProcessAsUserW(
			h_token,
			NULL,
			cmd_buffer,
			NULL, NULL,
			FALSE, /* no need to inherit handles */
			CREATE_SUSPENDED | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT,
			combined_env ? combined_env : env, cwd,
			&si, &pi
		);

		if (combined_env)
			free(combined_env);
		if (env)
			DestroyEnvironmentBlock(env);
		CloseHandle(h_token);
	}
	if (!ret) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to create process '%s' for script, errno=%s(%d)", resolved_path, strerror(errno), errno);
		pid_unpublish(pid_slot, 0);
		return -1;
	}

	/* assign the process to the global job object before allowing it to run */
	if (os_job_handle != 0) {
		if (!AssignProcessToJobObject(os_job_handle, pi.hProcess)) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_INFO, "failed to assign script process to job object, errno=%s(%d)", strerror(errno), errno);
			pid_unpublish(pid_slot, 0);
			TerminateProcess(pi.hProcess, 1);
			CloseHandle(pi.hThread);
			CloseHandle(pi.hProcess);
			return -1;
		}
	}

	/* resume the primary thread now that the process is assigned to the job object */
	if (ResumeThread(pi.hThread) == (DWORD)-1) {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_INFO, "failed to resume thread for script, errno=%s(%d)", strerror(errno), errno);
		pid_unpublish(pid_slot, 0);
		TerminateProcess(pi.hProcess, 1);
		CloseHandle(pi.hThread);
		CloseHandle(pi.hProcess);
		return -1;
	}

	pid_t pid = (intptr_t)pi.hProcess;
	pid_publish(pid_slot, pid);

	/* wait for completion and get exit code */
	int timed_out;
	wait_process_timeout(pi.hProcess, timeout_sec, &timed_out);

	DWORD status;
	GetExitCodeProcess(pi.hProcess, &status);

	pid_unpublish(pid_slot, pid);

	CloseHandle(pi.hThread);
	CloseHandle(pi.hProcess);

	stop = os_tick_sec();
	int64_t execution_time = stop - start;

	if (timed_out) {
		os_syslog(OS_LVL_INFO, "script %s timeout after %" PRId64 " seconds", resolved_path, execution_time);
		return -1;
	}

	if (execution_time > 30)
		os_syslog(OS_LVL_WARNING, "script %s took %" PRId64 " seconds", resolved_path, execution_time);

	if (WIFEXITED(status)) {
		int exit_code = WEXITSTATUS(status);
		if (exit_code == 0)
			os_syslog(OS_LVL_INFO, "script %s terminated in %" PRId64 " seconds with success", resolved_path, execution_time);
		else
			os_syslog(OS_LVL_INFO, "script %s terminated in %" PRId64 " seconds with exit code %d", resolved_path, execution_time, exit_code);
		return exit_code;
	} else if (WIFSIGNALED(status)) {
		/* child died from a signal */
		int sig = WTERMSIG(status);
		os_syslog(OS_LVL_INFO, "script %s terminated in %" PRId64 " seconds with signal %s(%d)", resolved_path, execution_time, os_signal_name(sig), sig);
		return 128 + sig;
	} else {
		/* in Windows it can happen */
		os_syslog(OS_LVL_INFO, "script %s terminated in %" PRId64 " seconds for unknown reason, status=0x%08x", resolved_path, execution_time, (unsigned)status);
		return -1;
	}
}

/****************************************************************************/
/* os */

int os_randomize(void* void_ptr, size_t size)
{
	unsigned char* ptr = void_ptr;

	/* try RtlGenRandom */
	if (ptr_RtlGenRandom != 0 && ptr_RtlGenRandom(ptr, size) != 0)
		return 0;

	return -1;
}

OS_FILE* os_popen(const char** argv)
{
	int stdout_fd = -1;
	int saved_errno;
	int status;
	pid_t pid;
	FILE* fp;
	OS_FILE* os_file;

	os_file = malloc(sizeof(OS_FILE));
	if (!os_file)
		return 0;

	/* os_spawn() only reads argv and its strings, so dropping const here does not allow the callee to modify them. */
	pid = os_spawn((char**)argv, &stdout_fd, 0, 0, 0);
	if (pid < 0) {
		free(os_file);
		return 0;
	}

	/* os_spawn() exposes Windows pipes as binary CRT descriptors; restore the text semantics previously provided by _wpopen(..., L"rt"). */
	if (_setmode(stdout_fd, O_TEXT) == -1)
		goto fail_child;

	fp = fdopen(stdout_fd, "r");
	if (!fp)
		goto fail_child;

	os_file->fp = fp;
	os_file->pid = pid;

	return os_file;

fail_child:
	saved_errno = errno;
	close(stdout_fd);
	/* terminate and reap the child immediately so no process or handle is leaked on stream creation failure. */
	pid_kill(pid);
	status = 0;
	os_wait(pid, &status, 0);
	os_dispose(pid);
	free(os_file);
	errno = saved_errno;
	return 0;
}

char* os_fgets(char* s, int size, OS_FILE* stream)
{
	return fgets(s, size, stream->fp);
}

int os_pclose(OS_FILE* stream)
{
	FILE* fp = stream->fp;
	pid_t pid = stream->pid;
	int status = 0;
	int saved_errno = 0;
	int close_ret;
	pid_t wait_ret;

	/* keep the owned resources locally so the OS_FILE container can be released immediately. */
	free(stream);

	/* closing the stream also closes the CRT descriptor and the underlying stdout pipe handle. */
	close_ret = fclose(fp);
	if (close_ret != 0)
		saved_errno = errno;

	/* always reap the child even if closing the stream failed. */
	wait_ret = os_wait(pid, &status, 0);
	if (wait_ret < 0 && saved_errno == 0)
		saved_errno = errno;

	/* os_wait() does not release the Windows process HANDLE. */
	os_dispose(pid);

	if (close_ret != 0 || wait_ret < 0) {
		errno = saved_errno != 0 ? saved_errno : EIO;
		return -1;
	}

	return status;
}

void os_clear(void)
{
	HANDLE console;
	CONSOLE_SCREEN_BUFFER_INFO screen;
	COORD coord;
	DWORD written;

	/* get the console */
	console = GetStdHandle(STD_OUTPUT_HANDLE);
	if (console == INVALID_HANDLE_VALUE)
		return;

	/* get the screen size */
	if (!GetConsoleScreenBufferInfo(console, &screen))
		return;

	/* fill the screen with spaces */
	coord.X = 0;
	coord.Y = 0;
	FillConsoleOutputCharacterA(console, ' ', screen.dwSize.X * screen.dwSize.Y, coord, &written);

	/* set the cursor at the top left corner */
	SetConsoleCursorPosition(console, coord);
}

uint64_t os_tick(void)
{
	LARGE_INTEGER t;
	uint64_t r;

	/*
	 * Ensure to return a strict monotone os_tick counter.
	 *
	 * We had reports of invalid stats due faulty High Precision Event Timer.
	 * See: https://sourceforge.net/p/snapraid/discussion/1677233/thread/a2122fd6/
	 */
	windows_mutex_lock(&tick_lock);

	/*
	 * MSDN 'QueryPerformanceCounter'
	 * "On systems that run Windows XP or later, the function"
	 * "will always succeed and will thus never return zero."
	 */
	r = 0;
	if (QueryPerformanceCounter(&t))
		r = t.QuadPart;

	if (r < tick_last)
		r = tick_last;
	tick_last = r;

	windows_mutex_unlock(&tick_lock);

	return r;
}

uint64_t os_tick_sec(void)
{
	return GetTickCount64() / 1000;
}

uint64_t os_tick_ms(void)
{
	return GetTickCount64();
}

uint64_t os_tick_us(void)
{
	uint64_t ticks = os_tick();
	uint64_t sec = ticks / tick_frequency;
	uint64_t rem = ticks % tick_frequency;

	return sec * 1000000ULL + (rem * 1000000ULL) / tick_frequency;
}

uint64_t os_tick_ns(void)
{
	uint64_t ticks = os_tick();
	uint64_t sec = ticks / tick_frequency;
	uint64_t rem = ticks % tick_frequency;

	return sec * 1000000000ULL + (rem * 1000000000ULL) / tick_frequency;
}

int os_usleep(uint64_t usec)
{
	while (usec > 0) {
		unsigned chunk = 1000000;
		if (usec < chunk)
			chunk = (unsigned)usec;

		if (os_signal_interrupt()) {
			errno = EINTR;
			return -1;
		}

		Sleep(chunk / 1000);

		usec -= chunk;
	}

	return 0;
}

void os_privileges_acquire(void)
{
}

void os_privileges_release(void)
{
}

int os_privileges_drop(void)
{
	return 0;
}

void os_abort(void)
{
	void* stack[32];
	size_t size;
	unsigned i;

	fprintf(stderr, "Stacktrace of " PACKAGE " v" VERSION);
	fprintf(stderr, ", mingw");
#ifdef __GNUC__
	fprintf(stderr, ", gcc " __VERSION__);
#endif
	fprintf(stderr, ", %d-bit", (int)sizeof(void*) * 8);
	fprintf(stderr, ", PATH_MAX=%d", PATH_MAX);
	fprintf(stderr, "\n");

	/* get stackstrace, but without symbols */
	size = CaptureStackBackTrace(0, 32, stack, 0);

	for (i = 0; i < size; ++i)
		fprintf(stderr, "[bt] %02u: %p\n", i, stack[i]);

	fprintf(stderr, "Please report this error to the SnapRAID Issues:\n");
	fprintf(stderr, "https://github.com/amadvance/snapraid/issues\n");
	fflush(stderr);

	/* use exit(134) (128 + SIGABRT) and not abort to avoid the Windows abort dialog while distinguishing abort from normal failure */
	exit(134);
}

void os_exit(void)
{
	exit(EXIT_FAILURE);
}

/**
 * Set the executable dir.
 */
static void exedir_init(void)
{
	DWORD size;
	WCHAR* slash;

	size = GetModuleFileNameW(0, exedir, PATH_MAX);
	if (size == 0 || size == PATH_MAX) {
		/* use empty dir */
		exedir[0] = 0;
		return;
	}

	slash = wcsrchr(exedir, L'\\');
	if (!slash) {
		/* use empty dir */
		exedir[0] = 0;
		return;
	}

	/* cut exe name */
	slash[1] = 0;
}

void os_init(unsigned opt)
{
	HMODULE ntdll, kernel32;

	is_scan_winfind = (opt & OS_INIT_OPT_WINFIND) != 0;

	/* initialize the thread local storage for strerror(), using free() as destructor */
	if (windows_key_create(&last_error, free) != 0) {
		os_syslog(OS_LVL_CRITICAL, "error calling windows_key_create()");
		os_exit();
	}

	tick_last = 0;
	if (windows_mutex_init(&tick_lock, 0) != 0) {
		os_syslog(OS_LVL_CRITICAL, "error calling windows_mutex_init()");
		os_exit();
	}

	LARGE_INTEGER freq;
	if (!QueryPerformanceFrequency(&freq) || freq.QuadPart <= 0) {
		os_syslog(OS_LVL_CRITICAL, "error calling QueryPerformanceFrequency()");
		os_exit();
	}
	tick_frequency = freq.QuadPart;

	if (windows_mutex_init(&exec_mutex, 0) != 0) {
		os_syslog(OS_LVL_CRITICAL, "error calling windows_mutex_init()");
		os_exit();
	}

	ntdll = GetModuleHandle("NTDLL.DLL");
	if (!ntdll) {
		os_syslog(OS_LVL_CRITICAL, "error loading the NTDLL module");
		os_exit();
	}

	kernel32 = GetModuleHandle("KERNEL32.DLL");
	if (!kernel32) {
		os_syslog(OS_LVL_CRITICAL, "error loading the KERNEL32 module");
		os_exit();
	}

	/* enable safe search path mode permanently to prevent binary hijacking from CWD */
	SetSearchPathMode(BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE | BASE_SEARCH_PATH_PERMANENT);

	dll_advapi32 = LoadLibrary("ADVAPI32.DLL");
	if (!dll_advapi32) {
		os_syslog(OS_LVL_CRITICAL, "error loading the ADVAPI32 module");
		os_exit();
	}

	/* initialize job object to terminate child processes if daemon dies */
	os_job_handle = CreateJobObjectW(0, 0);
	if (os_job_handle != 0) {
		JOBOBJECT_EXTENDED_LIMIT_INFORMATION info;
		ZeroMemory(&info, sizeof(info));
		info.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
		if (!SetInformationJobObject(os_job_handle, JobObjectExtendedLimitInformation, &info, sizeof(info))) {
			windows_errno(GetLastError());
			os_syslog(OS_LVL_WARNING, "failed to configure job object, errno=%s(%d)", strerror(errno), errno);
			CloseHandle(os_job_handle);
			os_job_handle = 0;
		}
	} else {
		windows_errno(GetLastError());
		os_syslog(OS_LVL_WARNING, "failed to create job object, errno=%s(%d)", strerror(errno), errno);
	}

	/* check for Wine presence */
	is_wine = GetProcAddress(ntdll, "wine_get_version") != 0;

	/* get pointer to RtlGenRandom, note that it was reported missing in some cases */
	ptr_RtlGenRandom = (void*)GetProcAddress(dll_advapi32, "SystemFunction036");

	if ((opt & OS_INIT_OPT_AVOID_SLEEP) != 0) {
		/*
		 * Set the thread execution level to avoid sleep
		 * first try for Windows 7
		 */
		if (SetThreadExecutionState(WIN32_ES_CONTINUOUS | WIN32_ES_SYSTEM_REQUIRED | WIN32_ES_AWAYMODE_REQUIRED) == 0) {
			/* retry with the XP variant */
			SetThreadExecutionState(WIN32_ES_CONTINUOUS | WIN32_ES_SYSTEM_REQUIRED);
		}
	}

	exedir_init();
}

void os_done(void)
{
	if (os_job_handle != 0) {
		CloseHandle(os_job_handle);
		os_job_handle = 0;
	}

	/* delete the thread local storage for strerror() */
	windows_key_delete(last_error);

	windows_mutex_destroy(&exec_mutex);
	windows_mutex_destroy(&tick_lock);
	tick_frequency = 0;

	/* restore the normal execution level */
	SetThreadExecutionState(WIN32_ES_CONTINUOUS);

	FreeLibrary(dll_advapi32);
}

#endif