move POSIX spawn, exec and child tracking into posixsrv, keep process transactions alive across reconnects and preserve stable PIDs across image replacement, flesh out spawn with ordered file actions, process-group selection and signal inheritance, implement execve with bootstrap validation and rollback before retiring the old process, add vfork children that share the native process while keeping separate POSIX descriptor and signal state, replace local spawn bookkeeping with child reaping, nonblocking and process-group waits and orphan cleanup, add signal dispositions, per-thread masks, pending delivery, process/group signalling and alarms, translate native exceptions into POSIX signals and inherit masks when creating threads, make pipe waits interruptible and raise SIGPIPE for broken pipes, pass arguments and environment into main and add getenv/environ, add direct user APC notifications that can run without an alertable wait, add current-thread capabilities and resume-and-wait, let accepted IPC endpoints open restricted peer process capabilities and preserve caller security during spawn and exec, make process preparation reusable and improve DLL lookup across current, executable and fallback directories, move keyboard repeat into RSSRV so PS/2 and USB share one repeat policy, fix video presentation, report launch failure stages and status codes, mooaaar tests.

code/public/ntlite/process_loader.h

@@ -13,6 +13,13 @@
 #define NTL_PROCESS_LOAD_FLAG_NONE 0x00000000u
 #define NTL_PROCESS_STARTUP_DATA_MAX 1024u
 
+// Generic userspace process vectors. The builder copies every view into the
+// child loader block; callers retain ownership of the source arrays/strings.
+typedef struct NTL_PROCESS_STRING_VECTOR {
+    const SYS_STRING_VIEW* Entries;
+    uint32_t Count;
+} NTL_PROCESS_STRING_VECTOR;
+
 // Describes one source capability to duplicate into a constructing child.
 typedef struct NTL_PROCESS_STARTUP_CAPABILITY {
     uint32_t Tag;
@@ -21,6 +28,35 @@ typedef struct NTL_PROCESS_STARTUP_CAPABILITY {
     uint32_t DuplicateFlags;
 } NTL_PROCESS_STARTUP_CAPABILITY;
 
+// Reusable inert-process builder used by policy services such as posixsrv.
+// The storage is opaque to callers; initialize it to zero before first use.
+#define NTL_PROCESS_BUILDER_OPAQUE_WORDS 160u
+typedef struct NTL_PROCESS_BUILDER {
+    uintptr_t Opaque[NTL_PROCESS_BUILDER_OPAQUE_WORDS];
+} NTL_PROCESS_BUILDER;
+
+// Describes construction of an inert child. Unlike NTL_CREATE_PROCESS_AT_REQUEST,
+// preparation does not start the process and therefore has no output handle field.
+typedef struct NTL_PROCESS_BUILDER_REQUEST {
+    uint32_t Size;
+    uint32_t Flags;
+    SYS_HANDLE RootHandle;
+    SYS_STRING_VIEW Path;
+    SYS_STRING_VIEW CommandLine;
+    SYS_STRING_VIEW CurrentDirectory;
+    SYS_HANDLE SecurityContext;
+    SYS_HANDLE ModuleRootHandle;
+    SYS_STRING_VIEW ModuleDirectory;
+    NTL_MODULE_NAME_RESOLVER ResolveModuleName;
+    void* ResolveContext;
+    const NTL_PROCESS_STARTUP_CAPABILITY* StartupCapabilities;
+    uint32_t StartupCapabilityCount;
+    NTL_PROCESS_STRING_VECTOR Arguments;
+    NTL_PROCESS_STRING_VECTOR Environment;
+    const void* StartupData;
+    size_t StartupDataSize;
+} NTL_PROCESS_BUILDER_REQUEST;
+
 // Creates and starts one PE32+ process entirely through the userspace image loader.
 typedef struct NTL_CREATE_PROCESS_AT_REQUEST {
     uint32_t Size;
@@ -37,6 +73,8 @@ typedef struct NTL_CREATE_PROCESS_AT_REQUEST {
     void* ResolveContext;
     const NTL_PROCESS_STARTUP_CAPABILITY* StartupCapabilities;
     uint32_t StartupCapabilityCount;
+    NTL_PROCESS_STRING_VECTOR Arguments;
+    NTL_PROCESS_STRING_VECTOR Environment;
     // Optional opaque userspace bootstrap data copied into the child's read-only loader block.
     const void* StartupData;
     size_t StartupDataSize;
@@ -59,6 +97,8 @@ typedef struct NTL_CREATE_SYSTEM_PROCESS_REQUEST {
     void* ResolveContext;
     const NTL_PROCESS_STARTUP_CAPABILITY* StartupCapabilities;
     uint32_t StartupCapabilityCount;
+    NTL_PROCESS_STRING_VECTOR Arguments;
+    NTL_PROCESS_STRING_VECTOR Environment;
     // Optional opaque userspace bootstrap data copied into the child's read-only loader block.
     const void* StartupData;
     size_t StartupDataSize;
@@ -73,11 +113,32 @@ typedef struct NTL_CREATE_SYSTEM_PROCESS_REQUEST {
 #define NTL_PROCESS_LOADER_API
 #endif
 
+// Prepares an inert child and materializes its image/dependencies/bootstrap data.
+// imageFile may be SYS_HANDLE_INVALID to open request->Path relative to RootHandle.
+NTL_PROCESS_LOADER_API KSTATUS NtlProcessBuilderPrepare(NTL_PROCESS_BUILDER* builder,
+                                                        const NTL_PROCESS_BUILDER_REQUEST* request,
+                                                        SYS_HANDLE imageFile);
+// Returns the prepared process capability without transferring ownership from the builder.
+// The borrowed handle remains valid only until Start or Abort consumes the builder.
+NTL_PROCESS_LOADER_API KSTATUS NtlProcessBuilderGetProcessHandle(NTL_PROCESS_BUILDER* builder,
+                                                                 SYS_HANDLE* processHandleOut);
+// Starts a prepared child and returns the retained process capability to the caller.
+// On success the builder is consumed and reset to the empty state.
+NTL_PROCESS_LOADER_API KSTATUS NtlProcessBuilderStart(NTL_PROCESS_BUILDER* builder,
+                                                      SYS_HANDLE* processHandleOut);
+// Aborts a prepared child, terminating the inert native process and releasing loader state.
+NTL_PROCESS_LOADER_API void NtlProcessBuilderAbort(NTL_PROCESS_BUILDER* builder);
+
 NTL_PROCESS_LOADER_API KSTATUS NtlCreateProcessAt(const NTL_CREATE_PROCESS_AT_REQUEST* request);
 NTL_PROCESS_LOADER_API KSTATUS NtlCreateSystemProcess(const NTL_CREATE_SYSTEM_PROCESS_REQUEST* request);
 // Copies the optional opaque startup data supplied by the userspace process builder.
 NTL_PROCESS_LOADER_API KSTATUS NtlGetProcessStartupData(void* buffer,
                                                         size_t bufferSize,
                                                         size_t* sizeOut);
+// Returns one immutable argument/environment entry from the current loader block.
+NTL_PROCESS_LOADER_API KSTATUS NtlGetProcessArgumentCount(uint32_t* countOut);
+NTL_PROCESS_LOADER_API KSTATUS NtlGetProcessArgument(uint32_t index, SYS_STRING_VIEW* argumentOut);
+NTL_PROCESS_LOADER_API KSTATUS NtlGetProcessEnvironmentCount(uint32_t* countOut);
+NTL_PROCESS_LOADER_API KSTATUS NtlGetProcessEnvironment(uint32_t index, SYS_STRING_VIEW* entryOut);
 
 #undef NTL_PROCESS_LOADER_API