createEmpty() {
- return new VMInstanceStore(context);
+ var store = new VMInstanceStore(context);
+ // DataStore.load() parses into this throwaway store and then replace()s the items over,
+ // but each VMInstance keeps the store it was constructed with -- so whatever the loaded
+ // instances need to reach through their store has to be inherited here, or it is null for
+ // the rest of their life. That is how a VM with NICs ended up failing to start with
+ // "has networks but no network store".
+ store.networkStore = networkStore;
+ return store;
}
@NonNull
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/VMStartResult.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/VMStartResult.java
index 4d292d0f..8284786f 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/VMStartResult.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/VMStartResult.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm;
import cn.classfun.droidvm.lib.natives.NativeProcess;
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/AppGroups.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/AppGroups.java
new file mode 100644
index 00000000..4243d73e
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/AppGroups.java
@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.daemon.vm.backend;
+
+import static cn.classfun.droidvm.lib.Constants.DATA_DIR;
+import static cn.classfun.droidvm.lib.utils.FileUtils.readFile;
+import static cn.classfun.droidvm.lib.utils.FileUtils.writeFile;
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+import static cn.classfun.droidvm.lib.utils.StringUtils.pathJoin;
+
+import android.util.Log;
+
+import androidx.annotation.Nullable;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.List;
+
+import cn.classfun.droidvm.BuildConfig;
+
+/**
+ * The app's supplementary groups, for a device the VMM runs as the app instead of as root.
+ *
+ * Why they are needed at all: measured on device, a process that drops to the app's uid but
+ * carries no supplementary groups cannot even {@code stat()} a directory under
+ * {@code /storage/emulated/0} -- traversing the MediaProvider FUSE mount needs AID_EVERYBODY
+ * (9997), which every app process carries and no permission grants. The permission-derived
+ * groups (ext_data_rw and friends) turned out not to be the ones that gate it. Rather
+ * than hardcode a number whose meaning was inferred from one device, take the app's own list:
+ * whatever the platform decided the app is, the file server should look the same.
+ *
+ *
Which is why this reads the running app process rather than asking PackageManager.
+ * {@code getPackageGids()} knows only the permission-derived half; the framework-assigned half
+ * (the everybody gid, the cache gid, the shared gid) is added by Zygote at spawn time and exists
+ * assembled only in {@code /proc//status}. The daemon runs as root, so it can read it.
+ *
+ * And why it is cached to disk: a VM can be started over the daemon's IPC long after the UI
+ * process has gone away, and there would then be nothing to read. A stale list is not a hazard
+ * here -- these groups change only when the user changes a permission, and the failure mode of a
+ * stale one is a shared directory that cannot see its files, not one that sees too much.
+ */
+public final class AppGroups {
+ private static final String TAG = "AppGroups";
+ private static final String CACHE_PATH = pathJoin(DATA_DIR, "run", "app-gids");
+
+ @Nullable
+ private static volatile int[] cached;
+
+ private AppGroups() {
+ }
+
+ /**
+ * The app's supplementary groups, or {@code null} if they cannot be determined.
+ *
+ *
A {@code null} is not a reason to fall back to root: a caller that asked for the app's
+ * identity and cannot be given it should say so and stop, or the switch that requested the
+ * drop would silently mean its opposite.
+ */
+ @Nullable
+ public static int[] resolve(int appUid) {
+ var hit = cached;
+ if (hit != null) return hit;
+ synchronized (AppGroups.class) {
+ if (cached != null) return cached;
+ var live = readFromAppProcess(appUid);
+ if (live != null) {
+ cached = live;
+ persist(live);
+ Log.i(TAG, fmt("app groups from the running app process: %s", join(live)));
+ return live;
+ }
+ var stored = readCache();
+ if (stored != null) {
+ cached = stored;
+ Log.i(TAG, fmt("app groups from cache (app not running): %s", join(stored)));
+ return stored;
+ }
+ }
+ Log.w(TAG, "app groups unknown: the app is not running and nothing was cached");
+ return null;
+ }
+
+ /** Formats the list the way crosvm's `supp_gids=` key expects. */
+ public static String join(int[] gids) {
+ var sb = new StringBuilder();
+ for (int i = 0; i < gids.length; i++) {
+ if (i > 0) sb.append(',');
+ sb.append(gids[i]);
+ }
+ return sb.toString();
+ }
+
+ @Nullable
+ private static int[] readFromAppProcess(int appUid) {
+ var proc = new File("/proc").listFiles();
+ if (proc == null) return null;
+ for (var entry : proc) {
+ var name = entry.getName();
+ if (name.isEmpty() || !Character.isDigit(name.charAt(0))) continue;
+ try {
+ // Both checks matter: the daemon itself runs the app's code out of the app's
+ // CLASSPATH, so a name match alone would happily find a process running as root.
+ if (android.system.Os.stat(entry.getPath()).st_uid != appUid) continue;
+ var cmdline = readFile(new File(entry, "cmdline"));
+ int nul = cmdline.indexOf('\0');
+ if (nul >= 0) cmdline = cmdline.substring(0, nul);
+ if (!BuildConfig.APPLICATION_ID.equals(cmdline)) continue;
+ var gids = parseGroups(readFile(new File(entry, "status")));
+ if (gids != null) return gids;
+ } catch (Throwable ignored) {
+ // A pid that went away between listing and reading is ordinary, not an error.
+ }
+ }
+ return null;
+ }
+
+ /** Pulls the {@code Groups:} line out of {@code /proc//status}. */
+ @Nullable
+ private static int[] parseGroups(String status) {
+ for (var line : status.split("\n")) {
+ if (!line.startsWith("Groups:")) continue;
+ var out = new ArrayList();
+ for (var field : line.substring("Groups:".length()).trim().split("\\s+")) {
+ if (field.isEmpty()) continue;
+ try {
+ out.add(Integer.parseInt(field));
+ } catch (NumberFormatException ignored) {
+ }
+ }
+ return toArray(out);
+ }
+ return null;
+ }
+
+ private static int[] toArray(List list) {
+ var out = new int[list.size()];
+ for (int i = 0; i < out.length; i++) out[i] = list.get(i);
+ return out;
+ }
+
+ private static void persist(int[] gids) {
+ try {
+ writeFile(CACHE_PATH, join(gids));
+ } catch (Throwable t) {
+ Log.w(TAG, "could not cache the app groups", t);
+ }
+ }
+
+ @Nullable
+ private static int[] readCache() {
+ try {
+ var text = readFile(CACHE_PATH).trim();
+ if (text.isEmpty()) return null;
+ var out = new ArrayList();
+ for (var field : text.split(",")) {
+ field = field.trim();
+ if (!field.isEmpty()) out.add(Integer.parseInt(field));
+ }
+ return out.isEmpty() ? null : toArray(out);
+ } catch (Throwable t) {
+ return null;
+ }
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/BackendBase.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/BackendBase.java
index 41de6564..85c3b4ba 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/BackendBase.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/BackendBase.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.backend;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackend.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackend.java
index 37185f3c..b42f1520 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackend.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackend.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.backend;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackendInstance.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackendInstance.java
index af305008..1cf64a73 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackendInstance.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/CrosvmBackendInstance.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.backend;
import static android.net.LocalSocketAddress.Namespace.FILESYSTEM;
@@ -6,13 +9,12 @@
import static cn.classfun.droidvm.lib.Constants.PATH_EDK2_FIRMWARE;
import static cn.classfun.droidvm.lib.Constants.PATH_EDK2_VARS;
import static cn.classfun.droidvm.lib.store.enums.Enums.optEnum;
-import static cn.classfun.droidvm.lib.store.vm.DisplayBackend.SIMPLEFB;
-import static cn.classfun.droidvm.lib.store.vm.DisplayBackend.VIRTIO_GPU;
import static cn.classfun.droidvm.lib.store.vm.GpuApi.VULKAN;
import static cn.classfun.droidvm.lib.utils.AssetUtils.getPrebuiltBinaryPath;
import static cn.classfun.droidvm.lib.utils.FileUtils.deleteFile;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
import static cn.classfun.droidvm.lib.utils.StringUtils.pathJoin;
+import static cn.classfun.droidvm.lib.utils.ThreadUtils.threadSleep;
import android.net.LocalSocket;
import android.net.LocalSocketAddress;
@@ -24,57 +26,106 @@
import java.io.File;
import java.io.IOException;
import java.util.ArrayList;
+import java.util.LinkedHashMap;
import java.util.List;
+import java.util.Map;
+import cn.classfun.droidvm.BuildConfig;
import cn.classfun.droidvm.daemon.console.FDPipeConsoleStream;
import cn.classfun.droidvm.daemon.console.InputConsoleStream;
import cn.classfun.droidvm.daemon.console.SimpleConsoleStream;
+import cn.classfun.droidvm.daemon.display.DaemonSystemContext;
import cn.classfun.droidvm.daemon.server.ServerContext;
import cn.classfun.droidvm.daemon.vm.BootPlan;
import cn.classfun.droidvm.daemon.vm.SerialPipe;
+import cn.classfun.droidvm.daemon.vm.UsbAcmPool;
import cn.classfun.droidvm.daemon.vm.VMBackendInstance;
import cn.classfun.droidvm.daemon.vm.VMStartResult;
+import cn.classfun.droidvm.daemon.audio.HostAudioTable;
+import cn.classfun.droidvm.lib.data.HostAudioDevices;
import cn.classfun.droidvm.lib.natives.NativeProcess;
+import cn.classfun.droidvm.lib.utils.RunUtils;
import cn.classfun.droidvm.lib.store.base.DataItem;
import cn.classfun.droidvm.lib.store.disk.DiskBus;
-import cn.classfun.droidvm.lib.store.vm.DisplayBackend;
+import cn.classfun.droidvm.lib.store.vm.CpuPlacementPlan;
+import cn.classfun.droidvm.lib.store.vm.DisplayExporter;
+import cn.classfun.droidvm.lib.store.vm.DisplayTransportCap;
import cn.classfun.droidvm.lib.store.vm.GpuApi;
+import cn.classfun.droidvm.lib.store.vm.GpuMode;
+import cn.classfun.droidvm.lib.store.vm.GuestPoolSizing;
import cn.classfun.droidvm.lib.store.vm.GpuBackend;
+import cn.classfun.droidvm.lib.store.vm.GpuBlitProvider;
import cn.classfun.droidvm.lib.store.vm.LendMthpMode;
import cn.classfun.droidvm.lib.store.vm.NativeDisplay;
+import cn.classfun.droidvm.lib.store.vm.PeripheralType;
+import cn.classfun.droidvm.lib.store.vm.SerialBackend;
+import cn.classfun.droidvm.lib.store.vm.SerialHardware;
+import cn.classfun.droidvm.lib.store.vm.VMSerialConfig;
+import cn.classfun.droidvm.lib.store.vm.SoundMode;
import cn.classfun.droidvm.lib.store.vm.ProtectedVM;
import cn.classfun.droidvm.lib.store.vm.SharedDirCache;
import cn.classfun.droidvm.lib.store.vm.SharedDirType;
import cn.classfun.droidvm.lib.store.vm.VMBackend;
import cn.classfun.droidvm.lib.store.vm.VMConfig;
import cn.classfun.droidvm.lib.store.vm.VMHypervisor;
+import cn.classfun.droidvm.lib.store.vm.VMPeripheralConfig;
+import cn.classfun.droidvm.lib.store.vm.VMScreenConfig;
@SuppressWarnings("FieldCanBeLocal")
public final class CrosvmBackendInstance extends VMBackendInstance {
private static final String TAG = "CrosvmBackendInstance";
private static final String RUN_PATH = pathJoin(DATA_DIR, "run");
- private SerialPipe uart = null;
private String controlSocketPath = null;
+ /** Set by prepareGpuCgroup() once the cpuset exists and holds cores; else null. */
+ private String gpuCgroupPath = null;
/** Owns the per-VM native-display input sockets (crosvm-facing + UI-facing); see start(). */
private final NativeDisplayInputBridge inputBridge = new NativeDisplayInputBridge();
- private final FDPipeConsoleStream uartStream;
private final InputConsoleStream stdoutStream;
private final InputConsoleStream stderrStream;
private final SimpleConsoleStream stdioStream;
+ /**
+ * One configured serial port resolved for a run: its config plus whatever host resource
+ * backs it this time. The daemon owns every resource here; the UI only ever sees the
+ * config and the console stream. The pty backend holds nothing -- that is crosvm's own
+ * serial type.
+ */
+ private static final class ResolvedSerial {
+ final VMSerialConfig port;
+ SerialPipe pipe; // APP_CONSOLE
+ String acmDevPath; // USB_ACM: pool member's ttyGSn that crosvm opens
+
+ ResolvedSerial(@NonNull VMSerialConfig port) {
+ this.port = port;
+ }
+ }
+
+ private final List resolvedSerials = new ArrayList<>();
+ /** Console streams for APP_CONSOLE ports, keyed by stream name; registered once. */
+ private final Map serialStreams = new LinkedHashMap<>();
+
public CrosvmBackendInstance(
@NonNull ServerContext context,
@NonNull VMConfig config
) {
super(context, config);
- uartStream = new FDPipeConsoleStream(config, "uart", -1, -1);
stdoutStream = new InputConsoleStream(config, "stdout", null);
stderrStream = new InputConsoleStream(config, "stderr", null);
stdioStream = new SimpleConsoleStream(config, "stdio");
addStream(stdoutStream);
addStream(stderrStream);
addStream(stdioStream);
- addStream(uartStream);
+ // One text console per app-console serial port. Registered here, like the old fixed
+ // "uart" stream, so the stream list is stable across VM restarts.
+ VMSerialConfig.ensureDefaults(config.item);
+ for (var port : VMSerialConfig.listOf(config.item)) {
+ if (port.getBackend() != SerialBackend.APP_CONSOLE) continue;
+ var name = port.getStreamName();
+ if (serialStreams.containsKey(name)) continue;
+ var stream = new FDPipeConsoleStream(config, name, -1, -1);
+ serialStreams.put(name, stream);
+ addStream(stream);
+ }
}
@NonNull
@@ -84,15 +135,14 @@ public VMStartResult start() {
if (!new File(RUN_PATH).mkdirs())
Log.w(TAG, fmt("Failed to create run directory: %s", RUN_PATH));
try {
- uart = new SerialPipe(uartStream, "uart");
- if (!uart.isReady()) {
- Log.w(TAG, "UART pipe not ready, discarding");
- uart.close();
- uart = null;
- }
- } catch (Exception e) {
- Log.w(TAG, "Failed to create UART pipe", e);
- uart = null;
+ resolveSerialPorts();
+ } catch (IOException e) {
+ // A refused serial slot fails the whole start; the reason lands on the stdio
+ // console where every other boot failure already goes.
+ Log.e(TAG, "Serial setup refused", e);
+ stdioStream.appendBuffer(fmt("serial setup failed: %s\n", e.getMessage()));
+ closeSerialPorts();
+ return result;
}
controlSocketPath = pathJoin(RUN_PATH, fmt("%s.sock", config.getName()));
deleteFile(controlSocketPath);
@@ -102,32 +152,56 @@ public VMStartResult start() {
// the VM is up - so the daemon is the only process that can both bind the socket before
// crosvm starts and stay alive to feed it. We pre-bind + accept here; the UI forwards evdev
// to us via the vm_input IPC command (see InputHandler). Server fds released on cleanup().
- if (isNativeDisplayEnabled()) {
- if (!inputBridge.startListening(NativeDisplay.serviceName(config))) {
- Log.e(TAG, "Native display input sockets unavailable; crosvm will likely fail");
+ // Single source of truth: isInputBridgeNeeded() gates both this pre-bind and the --input
+ // args in buildCommand(), and touchscreenScreens()/nativeInputScreens() decide which
+ // screens get which per-screen device in both places, so the sockets and devices never
+ // diverge. The two lists differ: a VNC-exported screen's tablet and keyboard are crosvm's,
+ // not ours.
+ if (isInputBridgeNeeded()) {
+ try {
+ if (!inputBridge.startListening(config.getId().toString(),
+ touchscreenScreens(), nativeInputScreens())) {
+ Log.e(TAG, "Display input sockets unavailable; crosvm will likely fail");
+ }
+ } catch (IllegalArgumentException e) {
+ // A socket path too long for sun_path. crosvm would refuse the command line and
+ // our own bind() would truncate it in silence, so there is no half-working start
+ // to attempt: fail here, with the path and its length on the console the user is
+ // already looking at, the way a refused serial slot does.
+ Log.e(TAG, "Display input socket path refused", e);
+ stdioStream.appendBuffer(fmt("display input setup failed: %s\n", e.getMessage()));
+ inputBridge.release();
+ closeSerialPorts();
+ controlSocketPath = null;
+ return result;
}
}
+ // Must happen before buildCommand(): crosvm opens /tasks and never
+ // creates the directory, and buildCommand() only passes the flag if this worked.
+ prepareGpuCgroup();
var args = buildCommand();
Log.i(TAG, fmt("Executing: %s", String.join(" ", args)));
try {
var builder = new NativeProcess.Builder(args.toArray(new String[0]));
prepareProcess(builder);
- if (uart != null) {
- builder.preserveFd(uart.getOutputRemoteFd());
- builder.preserveFd(uart.getInputRemoteFd());
+ applyGfxstreamEnv(builder);
+ applyDisplayBlitEnv(builder);
+ applyGpuRtPrioEnv(builder);
+ for (var rs : resolvedSerials) {
+ if (rs.pipe != null) {
+ builder.preserveFd(rs.pipe.getOutputRemoteFd());
+ builder.preserveFd(rs.pipe.getInputRemoteFd());
+ }
}
var process = builder.start();
- if (uart != null)
- uart.closeRemoteFd();
+ for (var rs : resolvedSerials)
+ if (rs.pipe != null) rs.pipe.closeRemoteFd();
result.setProcess(process);
stdoutStream.setInputStream(process.getInputStream());
stderrStream.setInputStream(process.getErrorStream());
} catch (IOException e) {
Log.e(TAG, "Failed to start crosvm process", e);
- if (uart != null) {
- uart.close();
- uart = null;
- }
+ closeSerialPorts();
controlSocketPath = null;
inputBridge.release();
return result;
@@ -135,6 +209,89 @@ public VMStartResult start() {
return result;
}
+ /**
+ * Turns the config's serial list into live host resources for this run: a daemon pipe pair
+ * per app-console port. A port whose pipes cannot be opened degrades to a sink in
+ * buildSerialCommand rather than failing the start.
+ */
+ private void resolveSerialPorts() throws IOException {
+ closeSerialPorts();
+ for (var port : VMSerialConfig.listOf(config.item)) {
+ var rs = new ResolvedSerial(port);
+ var backend = port.getBackend();
+ if (backend == SerialBackend.APP_CONSOLE) {
+ var stream = serialStreams.get(port.getStreamName());
+ if (stream != null) {
+ try {
+ var pipe = new SerialPipe(stream, port.getStreamName());
+ if (pipe.isReady()) {
+ rs.pipe = pipe;
+ } else {
+ Log.w(TAG, fmt("Serial pipe %s not ready, discarding",
+ port.getStreamName()));
+ pipe.close();
+ }
+ } catch (Exception e) {
+ Log.w(TAG, fmt("Failed to create serial pipe %s",
+ port.getStreamName()), e);
+ }
+ }
+ } else if (backend == SerialBackend.USB_ACM) {
+ // Attaches the configured slot of the daemon-wide ACM pool; only the pool's
+ // first-time build rebinds USB. A busy or out-of-range slot aborts the start
+ // (SlotUnavailableException propagates): a VM silently landing on another
+ // host COM port -- or stealing one -- is worse than not booting. Only a
+ // broken gadget degrades to a sink.
+ try {
+ rs.acmDevPath = UsbAcmPool.acquire(port.getUsbSlot(),
+ acmOwnerToken(port), context.appConfig);
+ } catch (UsbAcmPool.SlotUnavailableException e) {
+ throw e;
+ } catch (IOException e) {
+ Log.w(TAG, fmt("USB ACM for %s unavailable; port degrades to sink",
+ port.getStreamName()), e);
+ }
+ }
+ resolvedSerials.add(rs);
+ }
+ }
+
+ @NonNull
+ private String acmOwnerToken(@NonNull VMSerialConfig port) {
+ return fmt("%s/%s", config.getId(), port.getStreamName());
+ }
+
+ private void closeSerialPorts() {
+ for (var rs : resolvedSerials) {
+ if (rs.pipe != null) rs.pipe.close();
+ if (rs.acmDevPath != null) UsbAcmPool.release(acmOwnerToken(rs.port));
+ }
+ resolvedSerials.clear();
+ }
+
+ /**
+ * Appends the guest-owned VRAM pool settings. Older configs only have the total pool size;
+ * their defaults keep the whole pool preallocated and leave dynamic grants disabled. The
+ * editor writes exactly those values (prealloc = pool, step 0, no grants) whenever its
+ * dynamic-vram switch is off over a guest pool, so a non-zero step here means the user
+ * asked for runtime growth. Only called under Gunyah.
+ */
+ private static void appendGuestPoolOptions(
+ @NonNull StringBuilder preAlloc,
+ @NonNull DataItem item,
+ long guestPool
+ ) {
+ if (guestPool <= 0) return;
+ long step = item.optLong("gpu_guest_step_mb", 0);
+ if (preAlloc.length() > 0) preAlloc.append(',');
+ preAlloc.append(fmt("gpu-guest-mb=%d", guestPool));
+ preAlloc.append(fmt(",gpu-guest-prealloc-mb=%d",
+ item.optLong("gpu_guest_prealloc_mb", guestPool)));
+ preAlloc.append(fmt(",gpu-guest-step-mb=%d", step));
+ preAlloc.append(fmt(",gpu-guest-max-grants=%d",
+ item.optLong("gpu_guest_max_grants", 0)));
+ }
+
@NonNull
private List buildCommand() {
var item = config.item;
@@ -151,10 +308,10 @@ private List buildCommand() {
args.add(String.valueOf(Math.max(item.optLong("memory_mb", 512), 64)));
args.add("--cpus");
args.add(String.valueOf(Math.max(item.optLong("cpu_count", 1), 1)));
+ buildCpuPlacementCommand(args);
var hyp = item.optString("hypervisor", "auto");
var hypervisor = VMHypervisor.valueOf(hyp.toUpperCase());
- if (hypervisor == VMHypervisor.AUTO)
- hypervisor = VMHypervisor.findPreferredHypervisor(VMBackend.CROSVM);
+ hypervisor = VMHypervisor.resolveConfigured(VMBackend.CROSVM, hypervisor);
if (hypervisor == null) throw new RuntimeException("No supported hypervisor found for CROSVM backend");
args.add("--hypervisor");
var defProtectedMode = ProtectedVM.PROTECTED_NORMAL;
@@ -162,22 +319,103 @@ private List buildCommand() {
case KVM:
args.add("kvm");
break;
- case GUNYAH:
+ case GUNYAH: {
+ boolean hasGpu = VMScreenConfig.hasGpuDevice(item);
+ boolean gfxstreamGpu = hasGpu
+ && optEnum(item, "gpu_backend", GpuBackend.NONE) == GpuBackend.GPU_GFXSTREAM;
+ boolean drm2kgslGpu = hasGpu
+ && optEnum(item, "gpu_backend", GpuBackend.NONE) == GpuBackend.GPU_VIRGLRENDERER
+ && effectiveGpuMode(item) == GpuMode.NATIVE;
+ boolean venusGpu = hasGpu
+ && optEnum(item, "gpu_backend", GpuBackend.NONE) == GpuBackend.GPU_VIRGLRENDERER
+ && effectiveGpuMode(item) == GpuMode.VULKAN;
+ // Dynamic mappings keep the normal RegisterMemory interface. The Gunyah backend
+ // transparently supplies the protected-VM SHARE/accept transport.
args.add("gunyah");
+ // The guest-alloc pool buys the host access to buffers the guest allocated, which
+ // in an ordinary protected VM it does not otherwise have. When the host can
+ // already reach the guest's RAM -- an unprotected VM, or a pseudo-unprotected one
+ // whose window is shared back before the payload runs -- the pool is memory taken
+ // from the guest to solve a problem that is not happening, and virtio-gpu with no
+ // pool node to find allocates from system RAM instead, which the host can read
+ // for the same reason. The editor hides the field in those modes; a config from
+ // the daemon API, or one saved before switching mode, still arrives with a size
+ // in it, so it is zeroed here rather than trusted.
+ // GuestPoolSizing holds that rule, shared with the huge-page preflight so the
+ // reserve is budgeted for exactly what is passed here.
+ long guestPool = GuestPoolSizing.bootGuestPoolMb(item);
+ // Pre-allocate the gfxstream host-visible pools (host arena + optional guest-alloc
+ // pool). Only meaningful for gfxstream on Gunyah.
+ if (gfxstreamGpu) {
+ boolean udmabuf = item.optBoolean("gpu_udmabuf", true);
+ long hostPool = item.optLong("gpu_host_pool_mb", 0);
+ if (hostPool > 0 || udmabuf) {
+ var preAlloc = new StringBuilder(fmt("gfx-host-mb=%d", hostPool));
+ if (udmabuf)
+ appendGuestPoolOptions(preAlloc, item, guestPool);
+ args.add("--pre-alloc");
+ args.add(preAlloc.toString());
+ }
+ }
+ // DRM native context. Two pools, and they hold different things:
+ // drm-host-mb the host arena, now only the per-context msm shmem rings, so
+ // single-digit MB rather than the gigabyte the BOs used to need.
+ // gpu-guest-mb the guest's drm_buddy pool, where every BO comes from. Same
+ // region and flag as the gfxstream guest pool -- the guest driver
+ // keeps one allocator and cannot tell the renderers apart.
+ // The guest pool needs udmabuf=true as well; that is what gates
+ // VIRTIO_GPU_F_CREATE_GUEST_HANDLE, and without it guest mesa silently keeps a
+ // host-allocating path this host no longer implements.
+ if (drm2kgslGpu) {
+ long drmHostPool = item.optLong("gpu_drm2kgsl_pool_mb", 0);
+ var preAlloc = new StringBuilder();
+ if (drmHostPool > 0)
+ preAlloc.append(fmt("drm-host-mb=%d", drmHostPool));
+ appendGuestPoolOptions(preAlloc, item, guestPool);
+ if (preAlloc.length() > 0) {
+ args.add("--pre-alloc");
+ args.add(preAlloc.toString());
+ }
+ }
+ // Venus host pool: the venus command-stream transport shmems (per-instance ring +
+ // CS/reply chunks) live here (venus-host-mb -> VenusPool). vkr sub-allocates every
+ // blob_id==0 shmem from this pre-shared region and the guest maps pool_base+offset
+ // with no runtime SHARE. venus's real VkDeviceMemory is separately guest-alloc and
+ // comes from the shared guest pool (gpu-guest-mb) -- the same region/flag drm2kgsl
+ // and gfxstream guest-alloc use; the guest driver keeps one allocator and cannot
+ // tell the renderers apart. Default sized for the KDE+vkmark transport peak (cs
+ // pool alone is >=8M/instance): too small forces a per-blob memfd fallback ->
+ // runtime SHARE, which SoC-resets the fragile sm8650 (8gen3) RM.
+ if (venusGpu) {
+ long venusHostPool = item.optLong("gpu_venus_pool_mb", 256);
+ var preAlloc = new StringBuilder();
+ if (venusHostPool > 0)
+ preAlloc.append(fmt("venus-host-mb=%d", venusHostPool));
+ appendGuestPoolOptions(preAlloc, item, guestPool);
+ if (preAlloc.length() > 0) {
+ args.add("--pre-alloc");
+ args.add(preAlloc.toString());
+ }
+ }
defProtectedMode = ProtectedVM.PROTECTED_WITHOUT_FIRMWARE;
break;
+ }
case GENIEZONE:
args.add("geniezone");
break;
default:throw new IllegalArgumentException(fmt("Unsupported hypervisor: %s", hypervisor));
}
- switch (optEnum(item, "protected_vm", defProtectedMode)) {
+ var protectedVm = optEnum(item, "protected_vm", defProtectedMode);
+ switch (protectedVm) {
case PROTECTED_PROTECTED:
args.add("--protected-vm");
break;
case PROTECTED_WITHOUT_FIRMWARE:
args.add("--protected-vm-without-firmware");
break;
+ case PSEUDO_UNPROTECTED:
+ args.add("--protected-vm-pseudo-unprotected");
+ break;
default:
break;
}
@@ -207,6 +445,18 @@ private List buildCommand() {
default:
break;
}
+ var swiotlbMb = item.optLong("swiotlb_mb", 0);
+ // A pseudo-unprotected VM has nothing to bounce through -- its RAM is shared to it, so the
+ // host can already reach every buffer the guest hands a device. A pool here would do only
+ // harm: it puts a restricted-dma-pool node in the tree of a guest that was never built to
+ // honour one, which is the exact thing this mode exists to avoid. Ignore the stored value
+ // rather than asking everyone who switches to this mode to zero it by hand.
+ if (protectedVm == ProtectedVM.PSEUDO_UNPROTECTED)
+ swiotlbMb = 0;
+ if (swiotlbMb > 0) {
+ args.add("--swiotlb");
+ args.add(String.valueOf(swiotlbMb));
+ }
var boot = BootPlan.of(config);
if (!boot.initrd.isEmpty()) {
args.add("--initrd");
@@ -220,17 +470,31 @@ private List buildCommand() {
args.add("--socket");
args.add(controlSocketPath);
}
+ // Real host CPU name for the guest: crosvm forwards it via FDT /chosen and EDK2 publishes
+ // it as SMBIOS Type 4 processor version, so UEFI guests (Windows) show e.g.
+ // "Qualcomm Snapdragon 8 Elite" instead of the firmware default "Gunyah vCPU".
+ var socName = HostSocName.get();
+ if (socName != null) {
+ args.add("--smbios");
+ args.add(fmt("processor-version=%s", socName));
+ }
buildDiskCommand(args);
buildNetCommand(args);
buildSharedDirCommand(args);
buildGpuCommand(args);
- buildVncCommand(args);
+ buildScreenExportersCommand(args);
+ // The evdev --input devices ride along whenever any app display path is active: the native
+ // display routes everything through them; the VNC display routes its MOUSE (relative) and
+ // TOUCH (multi-touch) modes here while the tablet pointer + keyboard stay on RFB.
+ if (isInputBridgeNeeded()) {
+ buildInputDevicesCommand(args);
+ }
+ buildPeripheralCommand(args);
buildSerialCommand(args);
item.opt("extra_options", DataItem.newArray())
.forEach(arg -> args.add(arg.getValue().asString()));
if (boot.uefi) {
- // crosvm has no custom-firmware support; always builtin EDK2
- args.add(PATH_EDK2_FIRMWARE);
+ args.add(boot.firmware.isEmpty() ? PATH_EDK2_FIRMWARE : boot.firmware);
if (boot.varsEnabled) {
var vars = boot.vars.isEmpty() ? PATH_EDK2_VARS : boot.vars;
args.add("--pflash");
@@ -249,6 +513,83 @@ private static long pflashBlockSize(@NonNull String path) {
return 262144;
}
+ /**
+ * Creates and configures the gpuworker cpuset cgroup before crosvm starts.
+ * crosvm opens {@code /tasks} without creating the directory; the cpuset
+ * requires non-empty {@code cpus}/{@code mems} before threads can join it.
+ *
+ * Soft-fail: any error is logged and {@link #gpuCgroupPath} stays null so
+ * {@link #buildCpuPlacementCommand} simply omits the flag. Better to run
+ * without GPU thread isolation than to refuse to start the VM.
+ */
+ private void prepareGpuCgroup() {
+ gpuCgroupPath = null;
+ var item = config.item;
+ // The switch and the device both: the threads this cpuset exists to hold are the
+ // virtio-gpu device's workers, so with no device there is nobody to put in it.
+ if (!CpuPlacementPlan.wantsGpuCgroup(item)) return;
+ var path = item.optString(CpuPlacementPlan.KEY_GPU_CGROUP_PATH,
+ CpuPlacementPlan.DEFAULT_GPU_CGROUP_PATH).trim();
+ var cpus = item.optString(CpuPlacementPlan.KEY_GPU_CGROUP_CPUS, "").trim();
+ if (path.isEmpty() || !path.startsWith("/")) {
+ Log.w(TAG, fmt("gpu-cgroup-path is not an absolute path: '%s'; skipping", path));
+ return;
+ }
+ if (cpus.isEmpty()) {
+ Log.w(TAG, "gpu_cgroup_cpus is empty; cannot set up cpuset, skipping");
+ return;
+ }
+ // Parent dir for inheriting cpuset.mems (single NUMA node = "0" on all
+ // Android devices, but copy the parent rather than hard-coding it).
+ var parent = new java.io.File(path).getParent();
+ if (parent == null) parent = "/dev/cpuset";
+ var ep = RunUtils.escapedString(path);
+ var ec = RunUtils.escapedString(cpus);
+ var eq = RunUtils.escapedString(parent);
+ // Shell.cmd feeds the whole string to the persistent root shell; newlines work.
+ // The three paths go in as shell variables, so the body below stays a plain
+ // literal instead of interleaving quoting with concatenation.
+ var script = fmt(
+ "p=%s\n" +
+ "c=%s\n" +
+ "q=%s\n" +
+ "mkdir -p \"$p\" || exit 1\n" +
+ // mems first: some kernels validate cpus against a non-empty mems
+ "for n in mems cpuset.mems; do\n" +
+ " if [ -e \"$p/$n\" ] && [ ! -s \"$p/$n\" ]; then\n" +
+ " v=$(cat \"$q/$n\" 2>/dev/null); [ -n \"$v\" ] || v=0\n" +
+ " echo \"$v\" > \"$p/$n\"\n" +
+ " fi\n" +
+ "done\n" +
+ // cpuset v1 (noprefix) uses 'cpus'; v2 uses 'cpuset.cpus' -- try both
+ "for n in cpus cpuset.cpus; do\n" +
+ " if [ -e \"$p/$n\" ]; then echo \"$c\" > \"$p/$n\"; fi\n" +
+ "done\n" +
+ // Last line output verifies the write; also becomes the script exit code
+ "cat \"$p/cpus\" 2>/dev/null || cat \"$p/cpuset.cpus\" 2>/dev/null",
+ ep, ec, eq);
+ var result = RunUtils.run(script);
+ if (!result.isSuccess() || result.getOutString().trim().isEmpty()) {
+ Log.e(TAG, fmt("Failed to set up gpuworker cpuset at %s (cpus=%s): %s",
+ path, cpus, result.getErrString()));
+ return;
+ }
+ Log.i(TAG, fmt("gpuworker cpuset ready: %s (cpus=%s)", path, result.getOutString().trim()));
+ gpuCgroupPath = path;
+ }
+
+ /**
+ * Appends CPU placement flags: per-vCPU host affinity, guest capacity, guest
+ * clusters, and (when the cpuset was successfully prepared) the GPU cgroup.
+ */
+ private void buildCpuPlacementCommand(@NonNull List args) {
+ CpuPlacementPlan.of(config.item).appendArgs(args);
+ if (gpuCgroupPath != null) {
+ args.add("--gpu-cgroup-path");
+ args.add(gpuCgroupPath);
+ }
+ }
+
private void buildDiskCommand(@NonNull List args) {
var disks = config.item.opt("disks", null);
if (disks == null) return;
@@ -315,138 +656,915 @@ private void buildSharedDirCommand(@NonNull List args) {
var path = dir.optString("path", "");
var tag = dir.optString("tag", "");
if (path.isEmpty() || tag.isEmpty()) continue;
- var type = optEnum(dir, "type", SharedDirType.FS);
+ // Only virtio-fs is wired up. The editor forces it, but a hand-edited vms.json can
+ // still say p9 -- and that is not a degraded mode, it is a VM that will not start:
+ // crosvm's 9p config accepts `ascii_casefold` and nothing else, so every key below
+ // makes the whole `--shared-dir` argument fail to parse.
+ if (optEnum(dir, "type", SharedDirType.FS) != SharedDirType.FS)
+ Log.w(TAG, fmt("Shared dir '%s': 9P is not implemented, using virtio-fs", tag));
+ // `dax` is deliberately absent: the fs device gates DAX on cfg!(target_arch =
+ // "x86_64"), so on this platform the key would only describe something that cannot
+ // happen.
var cache = optEnum(dir, "cache", SharedDirCache.AUTO);
- args.add("--shared-dir");
- args.add(fmt(
- "%s:%s:type=%s:cache=%s:timeout=%d:writeback=%s:dax=%s:posix_acl=%s",
+ var arg = new StringBuilder(fmt(
+ "%s:%s:type=fs:cache=%s:timeout=%d:writeback=%s:posix_acl=%s",
path, tag,
- type.name().toLowerCase(),
cache.name().toLowerCase(),
dir.optLong("timeout", 5),
dir.optBoolean("writeback", false),
- dir.optBoolean("dax", false),
dir.optBoolean("posix_acl", true)
));
+ // Root access off -- the default -- means the file server serves as the app rather
+ // than as the VMM. crosvm forks and pivot_roots this device either way; these keys
+ // only decide who it is once it gets there. Left as root it reaches every file root
+ // can, which under /storage/emulated/0 is every other app's data as well.
+ if (!dir.optBoolean("root_access", false)) {
+ int uid = getAppUid();
+ var gids = uid > 0 ? AppGroups.resolve(uid) : null;
+ if (gids == null) {
+ // Quietly serving as root instead would make the switch mean its opposite.
+ // That is the one outcome worth losing a shared directory over.
+ Log.e(TAG, fmt(
+ "Shared dir '%s': cannot resolve the app identity (uid=%d); skipped. "
+ + "Open DroidVM once, or turn on root access for this directory.",
+ tag, uid
+ ));
+ continue;
+ }
+ // An Android app's primary group is its uid. Say so rather than leaving gid
+ // unset, which would leave the process in root's group with the app's uid.
+ arg.append(fmt(":uid=%d:gid=%d", uid, uid));
+ if (gids.length > 0)
+ arg.append(fmt(":supp_gids=%s", AppGroups.join(gids)));
+ }
+ args.add("--shared-dir");
+ args.add(arg.toString());
}
}
+ // Resolve the effective hypervisor (mirrors buildCommand's --hypervisor logic) to gate
+ // Gunyah-only GPU behavior such as gunyah-pvm.
+ private boolean isGunyahHypervisor() {
+ var hyp = config.item.optString("hypervisor", "auto");
+ var hypervisor = VMHypervisor.valueOf(hyp.toUpperCase());
+ hypervisor = VMHypervisor.resolveConfigured(VMBackend.CROSVM, hypervisor);
+ return hypervisor == VMHypervisor.GUNYAH;
+ }
+
+ /**
+ * What the guest hands to the host: the {@code gpu_mode} row of the editor's three-level
+ * GPU section (renderer / mode / provider).
+ *
+ * Configs written before that split carry only {@code gpu_api}, whose meaning depended on
+ * the renderer, so fall back to the same migration the editor shows. Reading {@code gpu_api}
+ * directly is what this replaces: a VM configured through the new rows stores
+ * {@code gpu_mode=native} and no longer sets {@code gpu_api=drm2kgsl}, so the drm2kgsl branch below
+ * would silently not fire and the VM would come up without context-types=drm.
+ */
+ @NonNull
+ private static GpuMode effectiveGpuMode(@NonNull DataItem item) {
+ var mode = optEnum(item, "gpu_mode", GpuMode.NONE);
+ if (mode != GpuMode.NONE) return mode;
+ return GpuMode.fromLegacyApi(optEnum(item, "gpu_api", GpuApi.NONE));
+ }
+
+ /**
+ * The two display devices: {@code --gpu} for the virtio-gpu screen, {@code --simplefb} for the
+ * simplefb screen, each emitted exactly when its own switch is on.
+ *
+ *
One predicate per device, which is the whole point of the split. The arbitration-era
+ * version emitted the GPU device's {@code displays=} for either screen, because back then the
+ * simplefb bridge had no display of its own and handed its frames to this device -- so a VM
+ * with only the simplefb screen on still got a virtio-gpu scanout, a Linux guest saw a
+ * virtio-gpu output, drew its desktop onto it, and nobody exported it. That bridge is gone
+ * (crosvm's simplefb screen opens its own sink), so the geometry belongs to the screen it
+ * describes and to nothing else.
+ *
+ * {@code --gpu} and its {@code displays=} are one thing, never two: a virtio-gpu device
+ * with no scanout was tried and no guest desktop ever came up on it, so it is not a
+ * configuration this emits.
+ */
private void buildGpuCommand(@NonNull List args) {
var item = config.item;
- var useGpu = item.optBoolean("gpu_enabled", false);
- var useDisplay = item.optBoolean("display_enabled", false);
- var backend = optEnum(item, "display_backend", DisplayBackend.NONE);
+ var gpuScreen = isScreenEnabled(VMScreenConfig.ID_GPU0);
+ var fbScreen = isScreenEnabled(VMScreenConfig.ID_SIMPLEFB);
var api = optEnum(item, "gpu_api", GpuApi.NONE);
- if (!useGpu && !useDisplay) return;
- if (useGpu) {
+ if (!gpuScreen && !fbScreen) return;
+ if (gpuScreen) {
+ var gpu0 = VMScreenConfig.of(item, VMScreenConfig.ID_GPU0);
var gpuBackend = optEnum(item, "gpu_backend", GpuBackend.NONE);
+ var isGfxstream = gpuBackend == GpuBackend.GPU_GFXSTREAM;
var gpuArg = new StringBuilder();
gpuArg.append(gpuBackend.getName());
- if (useDisplay && backend == VIRTIO_GPU) {
- gpuArg.append(fmt(",displays=[[mode=windowed[%d,%d]",
- item.optLong("display_width", 1280),
- item.optLong("display_height", 720)));
- gpuArg.append(fmt(",refresh-rate=%d",
- item.optLong("display_refresh_rate", 60)));
- gpuArg.append(fmt(",dpi=[%d,%d]]]",
- item.optLong("display_dpi_h", 160),
- item.optLong("display_dpi_v", 160)));
+ // gfxstream host-visible Vulkan: the guest turnip (VK) + zink (GL-on-VK)
+ // stack needs the gfxstream-vulkan context type.
+ if (isGfxstream) {
+ gpuArg.append(",context-types=gfxstream-vulkan");
}
+ // This screen's own geometry, unconditionally: the device and its scanout are emitted
+ // together or not at all. What the guest is told here is what it gets -- crosvm turns
+ // it into the EDID and the display-info a Linux guest picks its mode from -- and it no
+ // longer has anything to do with the simplefb screen, which now carries its own size
+ // to its own device below.
+ gpuArg.append(fmt(",displays=[[mode=windowed[%d,%d]",
+ gpu0.getWidth(), gpu0.getHeight()));
+ gpuArg.append(fmt(",refresh-rate=%d", gpu0.getRefreshRate()));
+ gpuArg.append(fmt(",dpi=[%d,%d]]]", gpu0.getDpiH(), gpu0.getDpiV()));
- gpuArg.append(fmt(",vulkan=%s", String.valueOf(api == VULKAN)));
- switch (api) {
- case EGL:
- gpuArg.append(",egl=true");
- break;
- case OPENGLES:
- gpuArg.append(",gles=true");
- break;
- case ANGLE:
- gpuArg.append(",angle=true");
- break;
+ if (isGfxstream) {
+ // gfxstream serves both VK (turnip) and GL (zink) clients, so both
+ // capsets are on. pci-bar-size is the host-visible BAR window and
+ // doubles as the GPU memory ceiling (the guest has no
+ // device-local-only memory type); default 4 GiB.
+ gpuArg.append(",vulkan=true,gles=true");
+ gpuArg.append(fmt(",pci-bar-size=%d",
+ item.optLong("gpu_pci_bar_size", 0x100000000L)));
+ // Dynamic vram: a defined vram-limit is what enables runtime-shared host-visible
+ // memory (and, with a pre-alloc pool, fusion routing); leaving it undefined keeps
+ // every allocation inside the pool. crosvm ignores it in guest-alloc mode, where
+ // the guest pool is the cap, so only send it for host-alloc.
+ boolean udmabufGpu = item.optBoolean("gpu_udmabuf", true);
+ boolean dynamicVram = !udmabufGpu && item.optBoolean("gpu_dynamic_vram", false);
+ if (dynamicVram) {
+ // vram-limit supplies gfxstream's folio quota, the VK_EXT_memory_budget
+ // capacity handed to the guest driver, and -- by being defined and non-zero
+ // at all -- enables fusion routing. All are ignored under guest-alloc.
+ gpuArg.append(
+ fmt(",vram-limit=%d", item.optLong("gpu_vram_quota_mb", 2048)));
+ // gfxstream allocation policy: only its fresh host-visible shmem is eligible
+ // for folio backing. Driver-exported DMA-BUFs remain untouched.
+ gpuArg.append(fmt(",vram-folio-threshold-kb=%d",
+ item.optLong("gpu_vram_folio_threshold_kb", 1024)));
+ // Fusion size gate: host-visible allocations up to this try the pre-alloc
+ // pool first, larger ones go straight to the runtime-SHARE path.
+ gpuArg.append(fmt(",pool-blob-max-kb=%d",
+ item.optLong("gpu_pool_blob_max_kb", 4096)));
+ }
+ // gunyah-pvm pins the RingBlob backing so the permanent Gunyah SHARE mapping
+ // stays stable. Only meaningful under the Gunyah hypervisor; other SoCs skip it.
+ if (isGunyahHypervisor()) {
+ gpuArg.append(",gunyah-pvm=true");
+ }
+ // Guest-allocated blobs: the guest owns the host-visible pool and hands
+ // dma-bufs to gfxstream via udmabuf, instead of the host growing the arena.
+ if (udmabufGpu) {
+ gpuArg.append(",udmabuf=true");
+ }
+ } else if (effectiveGpuMode(item) == GpuMode.NATIVE) {
+ // DRM native context: the guest runs its own turnip over vdrm and virglrenderer
+ // translates the msm protocol to KGSL ioctls, so nothing is remoted at the
+ // GL/VK level and the host exposes no Vulkan capset.
+ //
+ // Only the DRM capset is advertised. rutabaga now keeps vrend (classic 2D
+ // resources: fbcon, dumb buffers, llvmpipe scanout) initialised for every
+ // virglrenderer configuration, so "drm" alone no longer fails the first
+ // CREATE_2D. Not advertising VIRGL2 matters for a stock guest: with it, stock
+ // Mesa picks host-GL virgl and our CPU-copy scanout cannot read those frames
+ // back (black until the guest additions + mesa-guest-drm2kgsl are installed);
+ // without it stock Mesa falls back to llvmpipe, which displays fine.
+ gpuArg.append(",context-types=drm");
+ // No external-blob: create_gpu_device overwrites it with
+ // `is_sandboxed || fixed_blob_mapping` regardless of what the CLI said, so
+ // passing it would only suggest it does something.
+ gpuArg.append(",vulkan=false,egl=true,gles=true");
+ // udmabuf builds the dma-buf for a guest-allocated blob, and -- less obviously --
+ // it is what gates VIRTIO_GPU_F_CREATE_GUEST_HANDLE. Without it the feature is
+ // never offered, the guest reports has_create_guest_handle=0, and guest mesa
+ // falls back to a host-allocating path this host no longer implements. The VM
+ // boots and the desktop comes up; the failure waits for the first large buffer.
+ gpuArg.append(",udmabuf=true");
+ gpuArg.append(fmt(",pci-bar-size=%d",
+ item.optLong("gpu_pci_bar_size", 0x100000000L)));
+ } else if (effectiveGpuMode(item) == GpuMode.VULKAN) {
+ // Venus: virglrenderer's Vulkan proxy (capset venus, guest-allocated blobs).
+ // Only the venus capset is advertised (see the drm branch above: rutabaga keeps
+ // vrend initialised for the classic 2D path regardless, and not advertising
+ // VIRGL2 keeps a stock guest on llvmpipe instead of an unreadable host-GL
+ // virgl). vulkan=true maps to use_venus on the virgl path; the venus capset also
+ // forces use_venus and use_guest_vram host-side, so this is belt-and-suspenders.
+ gpuArg.append(",context-types=venus");
+ gpuArg.append(",vulkan=true,egl=true,gles=true");
+ // udmabuf gates VIRTIO_GPU_F_CREATE_GUEST_HANDLE, the guest-alloc blob path venus
+ // uses (guest owns the pool, hands the host dma-bufs) -- same contract as drm2kgsl.
+ // No external-blob: create_gpu_device forces it from is_sandboxed||fixed_blob_mapping
+ // (false under --disable-sandbox), so passing the CLI key would be inert.
+ gpuArg.append(",udmabuf=true");
+ gpuArg.append(fmt(",pci-bar-size=%d",
+ item.optLong("gpu_pci_bar_size", 0x100000000L)));
+ } else {
+ gpuArg.append(fmt(",vulkan=%s", String.valueOf(api == VULKAN)));
+ switch (api) {
+ case EGL:
+ gpuArg.append(",egl=true");
+ break;
+ case OPENGLES:
+ gpuArg.append(",gles=true");
+ break;
+ case ANGLE:
+ // crosvm has no `angle` --gpu key and rejects unknown ones outright, so
+ // emitting it would stop the VM from starting. Treat a config that
+ // still carries ANGLE as GLES, which is what the editor migrates it to.
+ gpuArg.append(",gles=true");
+ break;
+ }
}
args.add("--gpu");
args.add(gpuArg.toString());
}
- if (useDisplay && backend == SIMPLEFB) {
+ // The simplefb device is its own screen, so it rides on its own switch and carries its own
+ // size -- which is no longer required to equal the GPU screen's, and usually should not be.
+ //
+ // poll-hz is this screen's whole answer to "how often is there a picture": nothing in the
+ // device announces a frame, the guest maps the region write-combining and no write traps,
+ // so the host's sampling rate is the frame rate. Sent explicitly rather than left to
+ // crosvm's default, because it is a value the user can see in the editor and a default
+ // that only one of the two sides knows is a value nobody can check.
+ if (fbScreen) {
+ var fb = VMScreenConfig.of(item, VMScreenConfig.ID_SIMPLEFB);
args.add("--simplefb");
args.add(fmt(
- "width=%d,height=%d",
- item.optLong("display_width", 1280),
- item.optLong("display_height", 720)
+ "width=%d,height=%d,poll-hz=%d",
+ fb.getWidth(), fb.getHeight(), fb.getPollHz()
));
}
- // Native display: crosvm registers an ICrosvmAndroidDisplayService binder under a per-VM
- // name and renders the gfxstream/virtio-gpu output straight into the Android Surface the UI
- // hands it. Requires the GPU (virtio-gpu) path above. Touch/keyboard come back over the
- // per-VM unix sockets the root service listens on; their paths must match NativeDisplay.
- // Single source of truth for the enable check; isNativeDisplayEnabled() also gates the
- // socket pre-bind in start(), so the two must never diverge.
- if (isNativeDisplayEnabled()) {
- buildNativeDisplayCommand(args);
+ }
+
+ /**
+ * One exporter per screen: {@code --android-display-service} or {@code --vnc-server}, each
+ * naming the screen it is bound to.
+ *
+ * Native display means crosvm registers an ICrosvmAndroidDisplayService binder under that
+ * screen's name and renders its output straight into the Android Surface the UI hands it.
+ * Touch/keyboard come back over the VM's input sockets, whose paths must match NativeDisplay.
+ *
+ *
Every binding names its screen explicitly. crosvm still accepts an exporter with no
+ * {@code screen=} and resolves it to whichever screen a pre-screens command line would have
+ * landed on, but writing it out means the app and the VMM agree in the config file rather
+ * than in two copies of the same defaulting rule. crosvm rejects an exporter naming a screen
+ * whose device is not configured, which is why every binding here is gated on
+ * {@link #isScreenEnabled} -- the same predicate that decides whether {@code --gpu} and
+ * {@code --simplefb} are emitted at all.
+ */
+ private void buildScreenExportersCommand(@NonNull List args) {
+ for (var screen : VMScreenConfig.listOf(config.item)) {
+ if (!isScreenEnabled(screen.id)) continue;
+ switch (screen.getExporter()) {
+ case NATIVE:
+ args.add("--android-display-service");
+ args.add(fmt("name=%s,screen=%s%s",
+ NativeDisplay.serviceName(config, screen.id), screen.id,
+ transportCapArg(screen)));
+ break;
+ case VNC:
+ args.add("--vnc-server");
+ args.add(buildVncArg(screen) + transportCapArg(screen));
+ break;
+ default:
+ // A screen nobody is watching. Legal, and not the same thing as no screen.
+ break;
+ }
}
}
- private void buildNativeDisplayCommand(@NonNull List args) {
- var item = config.item;
- var serviceName = NativeDisplay.serviceName(config);
- var width = item.optLong("display_width", 1280);
- var height = item.optLong("display_height", 720);
- args.add("--android-display-service");
- args.add(serviceName);
- // multi-touch ABS range must equal the guest resolution so view coords scale straight onto
- // ABS_X/ABS_Y (see EvdevEncoder / TouchScaleCalculator).
- args.add("--input");
- args.add(fmt(
- "multi-touch[path=%s,width=%d,height=%d]",
- NativeDisplay.inputSocketPath(serviceName, NativeDisplay.MULTITOUCH), width, height
- ));
+ /**
+ * The ceiling on this binding's transport, as a key-value fragment for its exporter flag --
+ * or nothing at all, which is what a default configuration gets.
+ *
+ * A ceiling is emitted only where it asks for less than the pipeline would have
+ * given anyway; see {@link DisplayTransportCap#emittedToken}, which is where the rule lives so
+ * that a test can read the whole table off it. A flag whose presence and absence mean the same
+ * thing is worse than no flag, so the top rung of each ladder is spelt by saying nothing.
+ *
+ * VNC's ladder gained a middle now that the encoder is above it, and {@code gpu} is that
+ * middle: "blit this screen, but do not stand an encoder behind it". crosvm's
+ * {@code transport-cap} enum grew the same way -- new tokens added beside {@code cpu}, nothing
+ * re-spelt -- so this stays a lookup rather than a translation.
+ */
+ @NonNull
+ private static String transportCapArg(@NonNull VMScreenConfig screen) {
+ var token = DisplayTransportCap.emittedToken(
+ screen.id, screen.getExporter(), screen.getTransportCap());
+ return token == null ? "" : fmt(",transport-cap=%s", token);
+ }
+
+ // The virtio-input devices the UI drives; the daemon pre-binds the matching sockets (see
+ // start()) and the UI ships evdev records to them via vm_input / the direct sink.
+ //
+ // One of them is the VM's and three are each screen's. Only the relative pointer has no output
+ // binding at all -- the guest compositor routes it by focus and it walks from one output to
+ // the next -- so there is one of it for the VM. An absolute coordinate is only meaningful
+ // against one output's geometry, so multi-touch and the absolute pointer exist once per screen
+ // that has them, and each carries a name= built from the screen id: evdev has no "I belong to
+ // output N" field, so the guest is told which touchscreen is which output by hand, keyed on
+ // that name, in every guest OS. That is why the name is derived and never allocated -- it has
+ // to come back identical after a reboot or the user's mapping quietly stops matching. The
+ // keyboard is per screen on different grounds: input belongs to the scanout, so the screen's
+ // switch has to be able to turn typing off on that screen and only that screen.
+ //
+ // The three per-screen devices do not cover the same screens. The touchscreen is ours on
+ // either exporter, because multi-touch has no RFB representation -- the app synthesises it
+ // and injects it into that screen's socket while its console is up. The absolute pointer and
+ // the keyboard are ours only where the screen is exported natively: crosvm builds a
+ // VNC-exported screen's pair itself, behind that screen's own VNC server, and drives them from
+ // that server's RFB pointer and key events (see buildVncArg). Emitting either here too would
+ // hand the guest two devices under one evdev name, and the socket one would be the half
+ // nothing ever writes to.
+ private void buildInputDevicesCommand(@NonNull List args) {
+ var vmId = config.getId().toString();
+ // No screen for this one, and the empty string says exactly that: its socket name does not
+ // take one, so there is no screen a console could name that would move it.
+ //
+ // Relative-pointer mouse (REL_X/Y + buttons + wheel) for InputMode.MOUSE; the guest renders
+ // the cursor, which is what relative-motion consumers (FPS games) need.
args.add("--input");
args.add(fmt(
- "keyboard[path=%s]",
- NativeDisplay.inputSocketPath(serviceName, NativeDisplay.KEYBOARD)
+ "mouse[path=%s]",
+ NativeDisplay.inputSocketPath(vmId, "", NativeDisplay.MOUSE)
));
+ // multi-touch + absolute-mouse advertise a fixed normalized ABS range (crosvm
+ // NORMALIZED_ABS_MAX) because width/height are OMITTED here; the UI scales view coords to
+ // that range (EvdevEncoder.NORMALIZED_ABS_MAX / TouchScaleCalculator), so the mapping is
+ // resolution-independent and survives guest auto-resize -- no display size needed.
+ //
+ // crosvm's VM-global RFB device set is gone: --vnc-server no longer turns on
+ // display_window_mouse and no longer creates the "DroidVM VNC Touch"/Tablet/Mouse trio or
+ // the display-window keyboard. Those were one set for the whole VM, so with two VNC
+ // screens up both normalised into the same tablet and the guest had no way to tell which
+ // output a coordinate came from; and the set only ever reached the guest at all when no
+ // GPU device was configured. Each VNC binding now carries its own pair instead.
+ var nativeInputs = nativeInputScreens();
+ for (var screenId : touchscreenScreens()) {
+ args.add("--input");
+ args.add(fmt(
+ "multi-touch[path=%s,name=%s]",
+ NativeDisplay.inputSocketPath(vmId, screenId, NativeDisplay.MULTITOUCH),
+ NativeDisplay.touchDeviceName(screenId)
+ ));
+ // Tablet = crosvm's absolute-pointing mouse (qemu usb-tablet): ABS position + buttons
+ // + wheel, so it gives the guest pointer hover, right-click and scroll -- which
+ // single-touch (a BTN_TOUCH touchscreen) can't. The UI maps a host mouse/stylus onto
+ // it in TABLET mode.
+ //
+ // The tablet and the keyboard below are only for the natively exported screens; that
+ // list is a subset of the one being walked, so the gate sits inside the loop rather
+ // than beside it.
+ //
+ // It carries a name= for the same reason the touchscreen does. It could not before:
+ // crosvm's AbsoluteMouse option had no name field and its enum is deny_unknown_fields,
+ // so `absolute-mouse[...,name=X]` was not a device with an odd name but a command line
+ // crosvm refuses, and this screen's tablet fell back to the generated "Crosvm Virtio
+ // Absolute Mouse " -- an idx that counts emission order here and so moves when
+ // another screen's input is switched off. Both devices of the pair are pinnable now.
+ if (!nativeInputs.contains(screenId)) continue;
+ args.add("--input");
+ args.add(fmt(
+ "absolute-mouse[path=%s,name=%s]",
+ NativeDisplay.inputSocketPath(vmId, screenId, NativeDisplay.TABLET),
+ NativeDisplay.tabletDeviceName(screenId)
+ ));
+ // This screen's keyboard. There is no VM-wide one any more: a keyboard shared by every
+ // screen could not be switched off by any one of them, so a screen with its input off
+ // still typed, which is not what the switch says. Now typing on a console goes to that
+ // console's screen's keyboard and a screen with input off has none -- and the guest
+ // sees several keyboards, which costs it nothing, because unlike an absolute device a
+ // keyboard needs no output binding to be routed correctly: focus decides.
+ args.add("--input");
+ args.add(fmt(
+ "keyboard[path=%s,name=%s]",
+ NativeDisplay.inputSocketPath(vmId, screenId, NativeDisplay.KEYBOARD),
+ NativeDisplay.keyboardDeviceName(screenId)
+ ));
+ }
+ }
+
+ /**
+ * The screens that get their own multi-touch device, in schema order: the screen exists,
+ * something is watching it, and its input switch is on.
+ *
+ * Both exporters, because multi-touch is not an RFB protocol event: the app is what turns
+ * finger contacts into evdev slots, on the VNC console exactly as on the native one, and
+ * injects them into this screen's socket while that console is up. So a VNC-exported screen
+ * keeps its touchscreen socket and its {@code --input multi-touch} on the same terms it
+ * always had.
+ *
+ * One list, read by both the socket pre-bind and the {@code --input} args, because a screen
+ * in one and not the other is either a device crosvm cannot connect to (the VM does not
+ * start) or a socket nothing ever opens.
+ */
+ @NonNull
+ private List touchscreenScreens() {
+ var out = new ArrayList();
+ for (var screen : VMScreenConfig.absoluteInputOf(config.item))
+ out.add(screen.id);
+ return out;
+ }
+
+ /**
+ * The screens whose absolute pointer and keyboard are ours to bind -- a subset of
+ * {@link #touchscreenScreens}: the natively exported ones.
+ *
+ * A VNC-exported screen has both of those too, but crosvm builds them behind that screen's
+ * VNC server and writes the RFB pointer and key events straight into them, which is what makes
+ * a coordinate land under the geometry of the binding it arrived on and a keystroke reach the
+ * screen the client is looking at. There is no socket for the daemon to bind and no
+ * {@code --input} for it to emit; the whole of the daemon's say in them is the
+ * {@code view-only} flag on that screen's exporter (see {@link #buildVncArg}).
+ *
+ * One list for the pair, because the pair has one rule: both are the screen's, both exist
+ * only where the screen's input switch is on, and both are crosvm's on a VNC binding. Read by
+ * the socket pre-bind and the {@code --input} args alike, for the same reason the touchscreen
+ * list is.
+ */
+ @NonNull
+ private List nativeInputScreens() {
+ var out = new ArrayList();
+ for (var screen : VMScreenConfig.absoluteInputOf(config.item))
+ if (screen.getExporter() == DisplayExporter.NATIVE) out.add(screen.id);
+ return out;
}
- /** True iff the per-VM crosvm command will reference native-display input sockets. */
- private boolean isNativeDisplayEnabled() {
+ // crosvm can promote the virtio-gpu worker to SCHED_FIFO (CROSVM_GPU_RT_PRIO). On gfxstream its
+ // per-context render threads inherit that policy and, spin-waiting on the guest command ring,
+ // can starve the normal-priority vCPU that feeds them -- a priority inversion that caps the
+ // native-display present rate. So RT is opt-in and off by default: the graphics tab's
+ // "real-time scheduling" switch (inside the GPU Worker Cpuset section) stores gpu_rt_prio
+ // ("97" on / "" off); pass it through only when set so crosvm leaves scheduling normal
+ // otherwise.
+ //
+ // Requires the cpuset: RT confined to the picked cores trades vCPU latency for render
+ // throughput on those cores, which is the point of the switch. RT with no cpuset is a
+ // different thing entirely -- FIFO 97 threads eligible for every host core, above everything
+ // else Android is running -- so it is refused rather than silently applied. Called after
+ // prepareGpuCgroup(), whose gpuCgroupPath is non-null only once the cpuset exists, holds
+ // cores and is about to be handed to crosvm.
+ private void applyGpuRtPrioEnv(@NonNull NativeProcess.Builder builder) {
var item = config.item;
- if (!item.optBoolean("gpu_enabled", false)) return false;
- if (!item.optBoolean("display_enabled", false)) return false;
- var backend = optEnum(item, "display_backend", DisplayBackend.NONE);
- if (backend != DisplayBackend.VIRTIO_GPU) return false;
- return item.optBoolean("native_display_enabled", false);
+ if (!VMScreenConfig.hasGpuDevice(item)) return;
+ // gpu_rt_prio is the SCHED_FIFO level as a string, "" (unset) by default. Empty means leave
+ // CROSVM_GPU_RT_PRIO unset so crosvm applies no real-time scheduling (RT is opt-in).
+ String prio = item.optString("gpu_rt_prio", "");
+ if (prio.isEmpty()) return;
+ // The editor cannot save this combination; a config built straight through the daemon
+ // API can still carry it, as can one whose cpuset setup soft-failed (no root, bad path).
+ if (gpuCgroupPath == null) {
+ Log.w(TAG, "gpu_rt_prio set without a GPU worker cpuset; skipping real-time "
+ + "scheduling rather than leaving FIFO GPU threads free on every core");
+ return;
+ }
+ builder.environment("CROSVM_GPU_RT_PRIO", prio);
+ }
+
+ /**
+ * The host-Vulkan renderers (gfxstream, and venus on virglrenderer) need their host ICD
+ * selected, gfxstream its host-visible folio/blob env, and both a raised udmabuf import cap.
+ * No-op for OpenGL, Native and 2D.
+ */
+ private void applyGfxstreamEnv(@NonNull NativeProcess.Builder builder) {
+ var item = config.item;
+ if (!VMScreenConfig.hasGpuDevice(item)) return;
+ var backend = optEnum(item, "gpu_backend", GpuBackend.NONE);
+ boolean gfxstream = backend == GpuBackend.GPU_GFXSTREAM;
+ // Venus is Vulkan-on-virglrenderer: it drives the host GPU through the same host ICD
+ // and the same guest-alloc udmabuf blobs as gfxstream, so it needs this env too.
+ boolean venus = backend == GpuBackend.GPU_VIRGLRENDERER
+ && effectiveGpuMode(item) == GpuMode.VULKAN;
+ if (!gfxstream && !venus) return;
+ // gfxstream-only: advertise a device-local memory type to the guest. The folio budget
+ // (vram-limit) and Gunyah RingBlob pin (gunyah-pvm) are on the --gpu line.
+ if (gfxstream)
+ builder.environment("GFXSTREAM_DEVICE_LOCAL_MEMORY_TYPE", "1");
+ // Host Vulkan driver, for gfxstream and venus alike (both dlopen ANDROID_EMU_VK_LOADER_PATH
+ // ahead of the system loader: gfxstream's VulkanDispatch, venus's vkr_library). It follows
+ // gpu_api, which the editor derives from the provider row: VULKAN_SYSTEM / VULKAN_PANVK use
+ // the SoC's stock HAL (leave the env unset so the system loader picks the vendor ICD),
+ // anything else -- VULKAN_TURNIP, or plain VULKAN from a pre-provider config -- the
+ // bundled turnip. Either way the env falls back to the system HAL if the turnip file is
+ // missing.
+ var api = optEnum(item, "gpu_api", GpuApi.NONE);
+ boolean systemDriver = api == GpuApi.VULKAN_SYSTEM || api == GpuApi.VULKAN_PANVK;
+ if (!systemDriver) {
+ var turnip = pathJoin(DATA_DIR, "usr", "lib", "libvulkan_freedreno.so");
+ if (new File(turnip).exists()) {
+ builder.environment("ANDROID_EMU_VK_LOADER_PATH", turnip);
+ }
+ }
+ // udmabuf's default 64MB/handle cap chokes large blob imports; raise it so a
+ // whole host-visible allocation can be wrapped as one dma-buf. The glob covers
+ // both the in-tree driver (/sys/module/udmabuf) and the app-shipped fallback
+ // module for kernels without CONFIG_UDMABUF (/sys/module/udmabuf_gki_6.1 etc.).
+ RunUtils.run("for p in /sys/module/udmabuf*/parameters/size_limit_mb; do " +
+ "echo %d > \"$p\"; done 2>/dev/null || true",
+ item.optLong("gpu_udmabuf_limit_mb", 4096));
}
- private void buildVncCommand(@NonNull List args) {
+ /**
+ * Host Vulkan provider for the GPU blit ({@link GpuBlitProvider}) -- the dmabuf-import path
+ * every sink that does not memcpy goes through. It belongs to no one screen and to no one
+ * exporter: the same driver imports the virtio-gpu scanout and the simplefb framebuffer, and
+ * it is dlopened by the native bridge to blit into a Surface and by the VNC sink to blit into
+ * a headless target of its own. Any of those needs this pointed somewhere before it can use
+ * the GPU. This is a separate axis from the render host driver ({@link #applyGfxstreamEnv});
+ * the two can name the same turnip .so or differ.
+ *
+ * TURNIP points the crosvm bridge at the bundled turnip. OFF -- and, until they are wired,
+ * PANVK/SYSTEM -- forces crosvm's CPU copy so a stale or hand-edited value degrades cleanly
+ * instead of half-loading a wrong driver. (SYSTEM will instead leave the library unset and let
+ * the bridge load the SoC driver once the capability probe that gates it exists.)
+ */
+ private void applyDisplayBlitEnv(@NonNull NativeProcess.Builder builder) {
var item = config.item;
- if (!item.optBoolean("vnc_enabled", false)) return;
+ // Any binding this VM actually has whose transport could be a GPU one -- not the native
+ // display's in particular. The env var is process-wide, so it is set from whether that
+ // path exists at all, and it exists for the VNC sink just as much since it grew a blit of
+ // its own: same driver, same dma-buf import, a headless target instead of a Surface.
+ // Naming the native display here was the rule from when it was the only sink that blitted.
+ if (!VMScreenConfig.hasGpuBlitBinding(item)) return;
+ var provider = optEnum(item, "display_blit_provider", GpuBlitProvider.TURNIP);
+ switch (provider) {
+ case TURNIP: {
+ var turnip = pathJoin(DATA_DIR, "usr", "lib", "libvulkan_freedreno.so");
+ if (new File(turnip).exists())
+ builder.environment("CROSVM_DISPLAY_VULKAN_LIBRARY", turnip);
+ break;
+ }
+ case SYSTEM: {
+ // The SoC's stock Vulkan performs the blit. The bridge dlopens whatever it is
+ // pointed at as a hwvulkan HMI, and the vendor driver under /vendor/lib64/hw is one,
+ // so aim it there instead of turnip. The bridge's own extension probe drops to the
+ // CPU copy when the stock driver lacks raw-dmabuf import (as Qualcomm's does) or
+ // cannot be loaded -- so SYSTEM attempts the system Vulkan and degrades, it never
+ // forces the CPU path.
+ var sysVk = resolveSystemVulkanHal();
+ if (sysVk != null)
+ builder.environment("CROSVM_DISPLAY_VULKAN_LIBRARY", sysVk);
+ break;
+ }
+ case OFF:
+ case PANVK:
+ default:
+ // OFF is explicit; PANVK is not built yet (and is bounced in the editor). Force the
+ // CPU copy rather than letting the bridge load the wrong driver.
+ builder.environment("GPU_DISPLAY_COPY_MODE", "cpu");
+ break;
+ }
+ }
+
+ /**
+ * The SoC's stock Vulkan hwvulkan HAL under {@code /vendor/lib64/hw} -- a real hwvulkan HMI the
+ * display bridge can dlopen -- or null if only a software rasteriser is present. Used by the
+ * SYSTEM {@link GpuBlitProvider}.
+ */
+ private static String resolveSystemVulkanHal() {
+ var files = new File("/vendor/lib64/hw").listFiles(
+ (d, name) -> name.startsWith("vulkan.") && name.endsWith(".so"));
+ if (files == null) return null;
+ for (var vf : files) {
+ var n = vf.getName();
+ // Skip the software fallbacks (lvp/swiftshader/pastel); we want the GPU driver.
+ if (n.contains("lvp") || n.contains("swiftshader") || n.contains("pastel")) continue;
+ return vf.getAbsolutePath();
+ }
+ return null;
+ }
+
+ /** Whether this VM has [screenId]'s display device -- the screen's own switch, and nothing else. */
+ private boolean isScreenEnabled(@NonNull String screenId) {
+ var screen = VMScreenConfig.find(config.item, screenId);
+ return screen != null && screen.isEnabled();
+ }
+
+ /**
+ * The evdev input bridge (and matching --input devices) is needed by both app display paths:
+ * native uses it for every input; the VNC display uses it for MOUSE/TOUCH modes (tablet
+ * pointer + keyboard ride the RFB channel instead). So: any screen with any exporter on it.
+ *
+ *
Single source of truth: this gates both the socket pre-bind in start() and the --input
+ * args in buildCommand(), so the sockets and the devices never diverge. It is the gate on the
+ * VM-wide relative pointer; which screens additionally get a touchscreen is
+ * {@link #touchscreenScreens} and which get a socket tablet and keyboard is
+ * {@link #nativeInputScreens}, and a VM with every screen's input switched off still gets the
+ * relative pointer -- it is not a screen's to switch off. The keyboard used to be in that
+ * sentence and no longer is.
+ */
+ private boolean isInputBridgeNeeded() {
+ for (var screen : VMScreenConfig.listOf(config.item)) {
+ if (!isScreenEnabled(screen.id)) continue;
+ if (screen.getExporter() != DisplayExporter.NONE) return true;
+ }
+ return false;
+ }
+
+ @NonNull
+ private static String buildVncArg(@NonNull VMScreenConfig screen) {
var vncArg = new StringBuilder();
- var host = item.optString("vnc_host", "");
+ var host = screen.getVncHost();
if (!host.isEmpty()) {
vncArg.append("host=");
vncArg.append(host);
vncArg.append(",");
}
vncArg.append("port=");
- vncArg.append(Math.max(item.optLong("vnc_port", -1), 1));
- var password = item.optString("vnc_password", "");
+ vncArg.append(Math.max(screen.getVncPort(), 1));
+ var password = screen.getVncPassword();
if (!password.isEmpty()) {
vncArg.append(",password=");
vncArg.append(password);
}
- args.add("--vnc-server");
- args.add(vncArg.toString());
+ // No "h264-port=" here, and it must not come back: the hardware H.264 stream is served on
+ // the RFB port as encoding 50, so there is no second listener to place. crosvm now refuses
+ // to parse a command line that names the old key rather than ignoring it, which is what
+ // makes a mixed deploy fail loudly at start instead of running with a silently dropped
+ // flag. A config left over from before the change still carries the number; nothing reads
+ // it (see VMScreenConfig).
+ // This screen's input switch, spelt for the other side. false makes crosvm build one
+ // tablet and one keyboard for this binding and inject its RFB pointer/key events into
+ // them; true makes it build neither and drop both, which is the only way to say "watch,
+ // don't touch" now that the devices belong to the binding rather than to the VM.
+ //
+ // The devices are the binding's, so a coordinate is read against the geometry of the
+ // screen the client is actually looking at -- which is what the retired VM-global set
+ // could not do with two VNC screens up. Pointer semantics stay absolute-tablet for every
+ // client, third-party or the app's own console; the app's VNC console is an RFB client
+ // like any other for pointer and keys, and reaches around RFB only for its TOUCH mode
+ // (this screen's multi-touch socket) and its MOUSE mode (the VM's relative pointer).
+ //
+ // The old "input=tablet" key is not merely unused now: crosvm's VncConfig is
+ // deny_unknown_fields, so emitting it would be a command line it refuses rather than a
+ // flag it ignores. That is deliberate -- a half-updated pair fails at start.
+ vncArg.append(",view-only=");
+ vncArg.append(!screen.isInputEnabled());
+ vncArg.append(",screen=");
+ vncArg.append(screen.id);
+ return vncArg.toString();
+ }
+
+ /**
+ * Attaches the VM's peripherals. One peripheral is one guest device.
+ *
+ * A VIRTIO_SOUND peripheral is `--virtio-snd` with a `uid`: the audio has to leave
+ * the root process to be heard at all, because Android silences AAudio playback from uid 0
+ * outright and hands back zeroed buffers for capture. Measured on device with the same probe
+ * under different uids -- root muted both ways, shell, system and the app's own uid all fine.
+ * crosvm does the moving itself, re-execing its own `device snd` backend under that uid and
+ * reaching it over a socketpair. The daemon deliberately does not spawn that process: it did
+ * once, and every part of doing so -- `su`, a rendezvous socket to wait for, a pid to kill on
+ * teardown -- was a way to get it wrong.
+ *
+ * INTEL_HDA is accepted by the model and skipped here: crosvm emulates no HDA controller,
+ * and starting a VM that claims hardware nothing can serve is worse than starting without
+ * it. The UI says the same thing on the row.
+ */
+ private void buildPeripheralCommand(@NonNull List args) {
+ var peripherals = VMPeripheralConfig.listOf(config.item);
+ int appUid = getAppUid();
+ for (var peripheral : peripherals) {
+ var type = peripheral.getType();
+ if (type != PeripheralType.VIRTIO_SOUND) {
+ Log.w(TAG, fmt("peripheral %s skipped: no host backend", type));
+ continue;
+ }
+ if (appUid <= 0) {
+ Log.e(TAG, "cannot resolve app uid; sound device skipped");
+ continue;
+ }
+ if (peripheral.getEndpoints().isEmpty()) {
+ // A card with no endpoints is a device the guest would enumerate and find
+ // nothing behind, which is worse than not offering it.
+ Log.w(TAG, "virtio-snd card has no endpoints; skipped");
+ continue;
+ }
+ args.add("--virtio-snd");
+ args.add(buildSoundConfig(peripheral, appUid));
+ }
+ }
+
+ /**
+ * The `--virtio-snd` configuration for one peripheral.
+ *
+ * The `uid` is what makes this audible at all. Android decides whether a stream can be
+ * heard from the uid that opened it and silences uid 0 in both directions, and crosvm runs as
+ * root -- so crosvm re-execs itself under this uid and serves the device over a socketpair.
+ * Using the app's own uid rather than any other non-root one is what makes Android attribute
+ * the audio, and the microphone indicator, to DroidVM instead of to an anonymous process.
+ */
+ @NonNull
+ private String buildSoundConfig(@NonNull VMPeripheralConfig peripheral, int appUid) {
+ var endpoints = peripheral.getEndpoints();
+ var outputs = new ArrayList();
+ var inputs = new ArrayList();
+ for (var endpoint : endpoints) {
+ (endpoint.getMode().isInput() ? inputs : outputs).add(endpoint);
+ }
+
+ // A diagnostic escape hatch: with this marker present the card writes the periods it
+ // receives to stream-N.out instead of playing them, which is the only way to see what
+ // actually crossed the virtqueue rather than what everyone reports having sent. Gated on
+ // a file rather than a build so it can be turned off without shipping anything.
+ var dump = new java.io.File("/data/local/tmp/viosnd_dump");
+ var cfg = new StringBuilder(dump.exists() ? "backend=file" : "backend=aaudio");
+ if (dump.exists()) {
+ cfg.append(fmt(",playback_path=%s,playback_size=%d",
+ "/data/data/cn.classfun.droidvm/cache", 4 * 1024 * 1024));
+ }
+ // capture= is the card's own flag for whether it has any input at all.
+ cfg.append(fmt(",capture=%b", !inputs.isEmpty()));
+ cfg.append(fmt(",num_output_devices=%d", outputs.size()));
+ cfg.append(fmt(",num_input_devices=%d", inputs.size()));
+ // The endpoints go over by name, not by number. A number is only what the platform calls
+ // an endpoint today: reconnect a headset and it has a different one, while the name is
+ // unchanged -- so crosvm looks each one up in the table for itself, every time it opens a
+ // stream, and finds a returning device without being told.
+ cfg.append(fmt(",device_table=%s", HostAudioTable.PATH));
+ appendEndpoints(cfg, "output_device_config", outputs);
+ appendEndpoints(cfg, "input_device_config", inputs);
+ // Shared by every endpoint on the card, because they describe the device's queues rather
+ // than any one endpoint: one underrun policy, one buffer depth. Separate cards keep their
+ // own.
+ cfg.append(fmt(",underrun=%s", peripheral.getUnderrun().name().toLowerCase()));
+ // The latency knob. crosvm publishes it in the device's vendor config block; a driver
+ // that does not read the block keeps its own default, which is why this can be a hint.
+ cfg.append(fmt(",guest_outstanding_packets=%d", peripheral.getBuffer().getPackets()));
+ // Same field name as --shared-dir and --pmem-ext2 use for the process a device runs as.
+ // No supplementary groups: the VMM's are root's, and audio needs none -- recording was
+ // measured working with an empty group list.
+ cfg.append(fmt(",uid=%d", appUid));
+ Log.i(TAG, fmt("sound device: %s", cfg));
+ return cfg.toString();
+ }
+
+ /**
+ * Appends one direction's endpoints as a list of per-device settings.
+ *
+ * Their order here is their `hda_fn_nid` on the other side, which is what ties a stream to
+ * the endpoint it belongs to -- so it has to match the order the counts were taken in.
+ */
+ private void appendEndpoints(
+ @NonNull StringBuilder cfg, @NonNull String field,
+ @NonNull List endpoints
+ ) {
+ if (endpoints.isEmpty()) return;
+ cfg.append(fmt(",%s=[", field));
+ for (int i = 0; i < endpoints.size(); i++) {
+ var endpoint = endpoints.get(i);
+ // An unset field is what older configs stored for "follow the platform"; it names the
+ // same endpoint now, so everything downstream sees a device rather than an absence.
+ var hostKey = endpoint.getHostDevice();
+ if (hostKey.isEmpty()) hostKey = HostAudioDevices.SYSTEM_DEFAULT_KEY;
+ // Quoted, because a key is TYPE|address and the bar would otherwise read as a
+ // separator to the option parser.
+ cfg.append(fmt("%s[host_device=\"%s\"]", i == 0 ? "" : ",", hostKey));
+ // Only to say in the log which endpoint that name means right now.
+ resolveHostDevice(hostKey, endpoint.getMode().isInput(), endpoint.getMode());
+ }
+ cfg.append("]");
+ }
+
+ /** The app's uid, which the daemon can reach through its system context. */
+ private int getAppUid() {
+ try {
+ var sys = DaemonSystemContext.get();
+ if (sys != null) {
+ return sys.getPackageManager()
+ .getApplicationInfo(BuildConfig.APPLICATION_ID, 0).uid;
+ }
+ } catch (Throwable t) {
+ Log.w(TAG, "package manager lookup failed; falling back to the data dir owner", t);
+ }
+ // Fallback: the data directory belongs to the app uid by construction.
+ try {
+ return android.system.Os.stat(DATA_DIR).st_uid;
+ } catch (Throwable t) {
+ Log.w(TAG, "stat of the data dir failed", t);
+ return -1;
+ }
+ }
+
+ /**
+ * Live AAudio device id for a stored host endpoint, or 0 (AAUDIO_UNSPECIFIED) when it asked
+ * to follow the system or names something that is not connected right now. The ids are
+ * per-boot, which is why the config stores a descriptor and this happens at start.
+ */
+ private int resolveHostDevice(
+ @NonNull String key, boolean input, @NonNull SoundMode mode
+ ) {
+ if (key.isEmpty()) return HostAudioDevices.DEVICE_UNSPECIFIED;
+ var sys = DaemonSystemContext.get();
+ if (sys == null) {
+ Log.w(TAG, fmt("no system context; %s falls back to default audio routing", key));
+ return HostAudioDevices.DEVICE_UNSPECIFIED;
+ }
+ int id = HostAudioDevices.resolve(sys, input, key);
+ Log.i(TAG, fmt("%s -> host device %s (id=%d)", mode, key, id));
+ return id;
+ }
+
+
+ /** One port's crosvm argument pieces, resolved from its backend. */
+ private static final class SerialArg {
+ String type = "sink";
+ String path;
+ String input;
+ boolean interactive;
+ }
+
+ @NonNull
+ private SerialArg serialArgOf(@NonNull ResolvedSerial rs) {
+ var arg = new SerialArg();
+ var port = rs.port;
+ switch (port.getBackend()) {
+ case APP_CONSOLE:
+ if (rs.pipe != null) {
+ arg.type = "file";
+ arg.path = fmt("/proc/self/fd/%d", rs.pipe.getOutputRemoteFd());
+ arg.input = fmt("/proc/self/fd/%d", rs.pipe.getInputRemoteFd());
+ arg.interactive = true;
+ }
+ break;
+ case PTY:
+ // crosvm's own pty type: it holds the master; the optional path becomes
+ // a symlink to the slave for external consumers.
+ arg.type = "pty";
+ if (!port.getPath().isEmpty()) arg.path = port.getPath();
+ arg.interactive = true;
+ break;
+ case FILE:
+ arg.type = "file";
+ arg.path = port.getPath();
+ break;
+ case UNIX:
+ arg.type = "unix";
+ arg.path = port.getPath();
+ break;
+ case UNIX_STREAM:
+ // crosvm is the connecting side: the consumer must already listen there.
+ arg.type = "unix-stream";
+ arg.path = port.getPath();
+ arg.interactive = true;
+ break;
+ case STDOUT:
+ arg.type = "stdout";
+ break;
+ case SYSLOG:
+ arg.type = "syslog";
+ break;
+ case USB_ACM:
+ // A pool member was attached in resolveSerialPorts; crosvm opens the
+ // ttyGSn raw and non-blocking (drops output when the external host is
+ // not draining, so the guest console never stalls).
+ if (rs.acmDevPath != null) {
+ arg.type = "dev";
+ arg.path = rs.acmDevPath;
+ arg.interactive = true;
+ }
+ break;
+ case SINK:
+ default:
+ break;
+ }
+ return arg;
}
+ /**
+ * One --serial per configured port. Exactly one port carries console+earlycon -- that is
+ * what crosvm's FDT stdout-path (and so EDK2's SPCR, and so Windows EMS/SAC) points at.
+ * The port the user marked as console wins, whatever its backend: a sink console is a
+ * deliberate "discard the guest console". Only configs from before the explicit flag
+ * fall back to the historical rule, the first port that can carry a conversation.
+ */
private void buildSerialCommand(@NonNull List args) {
- if (uart == null) return;
- var serial = fmt(
- "type=file,hardware=serial,num=1,earlycon,console,path=/proc/self/fd/%d,input=/proc/self/fd/%d",
- uart.getOutputRemoteFd(), uart.getInputRemoteFd()
- );
- args.add("--serial");
- args.add(serial);
+ var serialArgs = new ArrayList(resolvedSerials.size());
+ for (var rs : resolvedSerials)
+ serialArgs.add(serialArgOf(rs));
+ var consoleIdx = -1;
+ for (int i = 0; i < resolvedSerials.size(); i++)
+ if (resolvedSerials.get(i).port.isConsole()) {
+ consoleIdx = i;
+ break;
+ }
+ if (consoleIdx < 0)
+ for (int i = 0; i < serialArgs.size(); i++)
+ if (serialArgs.get(i).interactive) {
+ consoleIdx = i;
+ break;
+ }
+ for (int i = 0; i < resolvedSerials.size(); i++) {
+ var port = resolvedSerials.get(i).port;
+ var arg = serialArgs.get(i);
+ var serial = new StringBuilder(fmt(
+ "type=%s,hardware=%s,num=%d",
+ arg.type, port.getHardware().getCrosvmName(), port.getNum()
+ ));
+ if (arg.path != null) serial.append(fmt(",path=%s", arg.path));
+ if (arg.input != null) serial.append(fmt(",input=%s", arg.input));
+ if (i == consoleIdx) {
+ serial.append(",console");
+ // earlycon is a UART notion; a virtio-console has no early MMIO registers.
+ if (port.getHardware() != SerialHardware.VIRTIO_CONSOLE)
+ serial.append(",earlycon");
+ }
+ args.add("--serial");
+ args.add(serial.toString());
+ }
}
@Nullable
@@ -512,8 +1630,8 @@ public boolean hasControlSocket() {
}
@Override
- public boolean writeNativeInput(int channel, @NonNull byte[] data) {
- return inputBridge.writeNativeInput(channel, data);
+ public boolean writeNativeInput(@NonNull String screenId, int channel, @NonNull byte[] data) {
+ return inputBridge.writeNativeInput(screenId, channel, data);
}
@Override
@@ -523,5 +1641,6 @@ public void cleanup() {
controlSocketPath = null;
}
inputBridge.release();
+ closeSerialPorts();
}
}
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/HostSocName.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/HostSocName.java
new file mode 100644
index 00000000..cc74f724
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/HostSocName.java
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.daemon.vm.backend;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import android.util.Log;
+
+import androidx.annotation.Nullable;
+
+import cn.classfun.droidvm.BuildConfig;
+import cn.classfun.droidvm.daemon.display.DaemonSystemContext;
+import cn.classfun.droidvm.lib.data.QcomChipName;
+
+/**
+ * Resolves the host SoC marketing name (e.g. "Qualcomm Snapdragon 8 Elite") inside the daemon so
+ * VM backends can forward it to guest firmware ({@code crosvm --smbios processor-version=...} ->
+ * FDT /chosen -> EDK2 SMBIOS Type 4), letting Windows show the real CPU name instead of the
+ * firmware's built-in "Gunyah vCPU".
+ *
+ * The lookup table lives in the app's {@code res/xml/qcom.xml}; the daemon reaches it through a
+ * package context created from its system context. Falls back to the raw SoC model string
+ * (e.g. "SM8750P") when resources are unavailable, and to null when even getprop yields nothing.
+ */
+public final class HostSocName {
+ private static final String TAG = "HostSocName";
+ private static String cached;
+ private static boolean resolved;
+
+ private HostSocName() {
+ }
+
+ @Nullable
+ public static synchronized String get() {
+ if (resolved) return cached;
+ resolved = true;
+ try {
+ var soc = QcomChipName.getCurrentSoC();
+ if (soc == null || soc.trim().isEmpty()) return cached = null;
+ soc = soc.trim();
+ cached = soc;
+ var sys = DaemonSystemContext.get();
+ if (sys != null) {
+ var appCtx = sys.createPackageContext(BuildConfig.APPLICATION_ID, 0);
+ var name = new QcomChipName(appCtx).lookupChipName(soc);
+ if (name != null && !name.trim().isEmpty())
+ cached = name.trim();
+ }
+ Log.i(TAG, fmt("host SoC name: %s", cached));
+ } catch (Throwable t) {
+ Log.w(TAG, "failed to resolve host SoC name", t);
+ }
+ return cached;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/NativeDisplayInputBridge.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/NativeDisplayInputBridge.java
index af5a3c9b..5d4042c4 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/NativeDisplayInputBridge.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/NativeDisplayInputBridge.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.backend;
import static cn.classfun.droidvm.lib.utils.FileUtils.deleteFile;
@@ -6,91 +9,201 @@
import android.util.Log;
import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
import java.io.IOException;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
import cn.classfun.droidvm.lib.natives.UnixHelper;
import cn.classfun.droidvm.lib.network.FDSocket;
import cn.classfun.droidvm.lib.store.vm.NativeDisplay;
/**
- * Owns the per-VM native-display input sockets for one crosvm instance. crosvm's --input
+ * Owns the native-display input sockets for one crosvm instance. crosvm's --input
* [path=...] connects to a unix socket whose inode must already exist (crosvm is the
* *client*), so the daemon is the only process that can both bind the socket before crosvm starts
* and stay alive to feed it. This bridge pre-binds + accepts the crosvm-facing sockets; evdev from
- * the UI arrives via {@link #writeNativeInput(int, byte[])} - called either on the daemon's
+ * the UI arrives via {@link #writeNativeInput(String, int, byte[])} - called either on the daemon's
* native-display broker binder thread (touch hot path) or from the vm_input IPC handler - and is
* written straight to the matching crosvm peer. {@link CrosvmBackendInstance} drives the lifecycle:
- * {@link #startListening(String)} from start() and {@link #release()} from cleanup().
+ * {@link #startListening(String, List, List)} from start() and {@link #release()} from cleanup().
+ *
+ * The socket set is not one per channel: the relative pointer is VM-wide, while multi-touch,
+ * the absolute pointer and the keyboard exist once per screen that has them, so a slot is a
+ * (screen, channel) pair and the screens that get one are decided by the config. Everything here
+ * is therefore keyed rather than indexed -- a flat channel-indexed array cannot say which screen a
+ * write is for, and silently picking one would put touches, or typing, on the wrong output.
+ *
+ * The three per-screen channels do not cover the same screens, which is why they arrive as two
+ * lists rather than one. A VNC-exported screen's absolute pointer and keyboard are not ours:
+ * crosvm builds that screen's pair behind its own VNC server and feeds them from RFB pointer and
+ * key events, so there is no {@code --input} for either and a socket bound here would be an inode
+ * crosvm never connects to. Its touchscreen is still ours on the same terms as a native screen's,
+ * because multi-touch has no RFB event to arrive as.
*/
final class NativeDisplayInputBridge {
private static final String TAG = "NativeDisplayInput";
- /** Server fds for the per-VM native-display input sockets, kept while crosvm is running. */
- private volatile int[] inputServerFds = null;
- /** Paths of the input sockets we listened on, so {@link #release()} can unlink them. */
- private volatile String[] inputSocketPaths = null;
/**
- * The crosvm-side connection accepted on each input channel. crosvm connects to OUR socket at
- * startup (we are the only listener), so writing UI-forwarded evdev here is what actually
- * reaches the guest. Indexed by NativeDisplay channel constants. Volatile because the accept
- * threads, the write threads, and release() all touch it without a single shared lock.
+ * One crosvm-facing input socket: the inode we bound, the accepted crosvm connection, and the
+ * lock that keeps a write and a reconnect off each other. crosvm connects to OUR socket at
+ * startup (we are the only listener), so writing UI-forwarded evdev to {@link #peer} is what
+ * actually reaches the guest.
*/
- private volatile FDSocket[] inputPeers = null;
- /** Per-channel write lock; also guards swapping {@link #inputPeers} on reconnect. */
- private volatile Object[] inputWriteLocks = null;
+ private static final class Slot {
+ final String key;
+ final String path;
+ final int serverFd;
+ final Object lock = new Object();
+ /** Volatile: accept threads, write threads and release() all touch it without one lock. */
+ volatile FDSocket peer;
+
+ Slot(@NonNull String key, @NonNull String path, int serverFd) {
+ this.key = key;
+ this.path = path;
+ this.serverFd = serverFd;
+ }
+ }
+
+ /**
+ * Live slots by {@link #slotKey}. Replaced wholesale on start and cleared on release, so a
+ * reader either sees the whole set or none of it. Null until the first start.
+ */
+ private volatile Map slots = null;
private volatile boolean inputClosed = false;
/**
- * Pre-creates the per-VM native-display input sockets as listening unix sockets. crosvm
- * connects to these paths at startup, so a listener must exist before
- * {@link CrosvmBackendInstance#start()} execs the crosvm process. nativeUnixListen unlinks any
- * stale inode and re-binds, so a leftover socket file from a crashed run is replaced rather than
- * blocking us. Returns true iff every channel ended up with a live listener. Server fds we open
- * are tracked for release in {@link #release()}.
+ * Identity of one socket: the channel, plus the screen for the channels that have one per
+ * screen. The VM-wide channel collapses onto the empty screen so the same key comes out
+ * whatever screen the console that sent the bytes happens to be showing.
+ *
+ * {@link NativeDisplay#isPerScreen} is the only place that split is decided, so a channel
+ * becoming per screen moves the socket name and this key together -- there is no second copy
+ * of the rule here to forget to update.
*/
- boolean startListening(@NonNull String serviceName) {
+ @NonNull
+ private static String slotKey(@NonNull String screenId, int channel) {
+ return fmt("%s/%d", NativeDisplay.isPerScreen(channel) ? screenId : "", channel);
+ }
+
+ /**
+ * Pre-creates the input sockets as listening unix sockets. crosvm connects to these paths at
+ * startup, so a listener must exist before {@link CrosvmBackendInstance#start()} execs the
+ * crosvm process. nativeUnixListen unlinks any stale inode and re-binds, so a leftover socket
+ * file from a crashed run is replaced rather than blocking us. Returns true iff every slot
+ * ended up with a live listener.
+ *
+ * [touchScreens] are the screens that get a multi-touch device and [nativeScreens] the ones
+ * that get an absolute pointer and a keyboard -- the same two lists
+ * {@link CrosvmBackendInstance} emits {@code --input} devices from, so the sockets and the
+ * devices cannot diverge. They are not the same list: the second holds only the natively
+ * exported screens, because a VNC-exported screen's tablet and keyboard are crosvm's own. A
+ * screen left out of a list has no socket and no device on that channel; input aimed at it is
+ * refused rather than landing on some other screen's geometry, or on a screen whose user
+ * switched input off.
+ *
+ * Throws IllegalArgumentException if a path does not fit a unix socket address. That is the
+ * one failure here that is not survivable and not diagnosable after the fact: bind(2) truncates
+ * silently, so the daemon would report a live listener on an inode crosvm was never told about.
+ * The caller turns it into a refused start; see {@link NativeDisplay#requireBindablePath}.
+ *
+ * Whatever it bound before that throw is closed on the way out, because the set is not
+ * published until the loop finishes and {@link #release()} can only free what it can see. The
+ * screen that trips the length check is by definition not the first one, so there is always
+ * something bound behind it: listening fds, inodes under run/, and an accept thread each --
+ * parked in accept(2) forever, since only closing the fd it waits on ends one.
+ */
+ boolean startListening(@NonNull String vmId, @NonNull List touchScreens,
+ @NonNull List nativeScreens) {
if (!UnixHelper.isLoaded()) {
Log.w(TAG, "UnixHelper not loaded; cannot pre-bind native-display input sockets");
return false;
}
- var paths = new String[NativeDisplay.CHANNEL_COUNT];
- var fds = new int[NativeDisplay.CHANNEL_COUNT];
inputClosed = false;
- inputPeers = new FDSocket[NativeDisplay.CHANNEL_COUNT];
- inputWriteLocks = new Object[NativeDisplay.CHANNEL_COUNT];
+ var built = new LinkedHashMap();
+ boolean allListening;
+ try {
+ allListening = bindAll(vmId, touchScreens, nativeScreens, built);
+ } catch (RuntimeException e) {
+ closeSlots(built.values());
+ throw e;
+ }
+ // Published whole, so a write either finds the set this start built or finds nothing.
+ slots = built;
+ return allListening;
+ }
+
+ /**
+ * Binds every slot the config asks for into [built]. Returns false if any bind failed.
+ *
+ * A bind that fails is left behind rather than unwinding the rest: the VM still starts, with
+ * that one device missing, which is the behaviour the caller's warning describes. A path the
+ * kernel cannot hold is the other kind of failure and throws out of here -- see
+ * {@link #startListening}, which is where what is already in [built] is disposed of.
+ */
+ private boolean bindAll(@NonNull String vmId, @NonNull List touchScreens,
+ @NonNull List nativeScreens,
+ @NonNull Map built) {
boolean allListening = true;
for (int ch = 0; ch < NativeDisplay.CHANNEL_COUNT; ch++) {
- inputWriteLocks[ch] = new Object();
- var path = NativeDisplay.inputSocketPath(serviceName, ch);
- paths[ch] = path;
- var fd = UnixHelper.nativeUnixListen(path);
- if (fd < 0) {
- Log.w(TAG, fmt("Failed to pre-listen on input socket: %s", path));
- allListening = false;
- fds[ch] = -1;
- } else {
+ for (var screenId : screensFor(ch, touchScreens, nativeScreens)) {
+ // Before the syscall, not after: a path bind(2) cannot hold is truncated in
+ // silence and every check downstream then passes against the wrong inode.
+ var path = NativeDisplay.requireBindablePath(
+ NativeDisplay.inputSocketPath(vmId, screenId, ch));
+ var fd = UnixHelper.nativeUnixListen(path);
+ if (fd < 0) {
+ Log.w(TAG, fmt("Failed to pre-listen on input socket: %s", path));
+ allListening = false;
+ continue;
+ }
Log.i(TAG, fmt("Pre-listening on input socket: %s (fd=%d)", path, fd));
- fds[ch] = fd;
+ var slot = new Slot(slotKey(screenId, ch), path, fd);
+ built.put(slot.key, slot);
// Accept crosvm's connection in the background. crosvm is the client and connects
// at its own startup, so a peer may not arrive until after start() execs it.
- startInputAcceptThread(ch, fd);
+ startInputAcceptThread(slot);
}
}
- inputSocketPaths = paths;
- inputServerFds = fds;
return allListening;
}
/**
- * Accepts crosvm's connection on one input channel and keeps the live peer in
- * {@link #inputPeers}. Loops so a crosvm restart (new connection on the same socket) replaces
- * the dead peer; ends when {@link #release()} closes the server fd.
+ * The screens [channel] needs a socket for: its own list for the three per-screen channels, or
+ * just the VM itself for the relative pointer, which has no output binding.
+ *
+ * Switched on the channel rather than on {@link NativeDisplay#isPerScreen} alone, because
+ * "is this per screen" and "which screens" stopped having one answer when the VNC bindings
+ * took over their own tablets and keyboards. The tablet and the keyboard share a list: both
+ * are the screen's, both exist only where its input switch is on, and both are crosvm's on a
+ * VNC binding.
+ */
+ @NonNull
+ private static List screensFor(int channel, @NonNull List touchScreens,
+ @NonNull List nativeScreens) {
+ switch (channel) {
+ case NativeDisplay.MULTITOUCH:
+ return touchScreens;
+ case NativeDisplay.TABLET:
+ case NativeDisplay.KEYBOARD:
+ return nativeScreens;
+ default:
+ return List.of("");
+ }
+ }
+
+ /**
+ * Accepts crosvm's connection on one slot and keeps the live peer on it. Loops so a crosvm
+ * restart (new connection on the same socket) replaces the dead peer; ends when
+ * {@link #release()} closes the server fd.
*/
- private void startInputAcceptThread(int channel, int serverFd) {
+ private void startInputAcceptThread(@NonNull Slot slot) {
var t = new Thread(() -> {
while (!inputClosed) {
- int peerFd = UnixHelper.nativeUnixAccept(serverFd);
+ int peerFd = UnixHelper.nativeUnixAccept(slot.serverFd);
if (peerFd < 0) {
if (inputClosed) break;
try {
@@ -101,46 +214,36 @@ private void startInputAcceptThread(int channel, int serverFd) {
continue;
}
var peer = new FDSocket(peerFd);
- // Snapshot the lock/peer arrays: release() can null them concurrently.
- var locks = inputWriteLocks;
- if (locks == null) {
- peer.close();
- break;
- }
- synchronized (locks[channel]) {
- var peers = inputPeers;
- if (peers == null) {
+ synchronized (slot.lock) {
+ if (inputClosed) {
peer.close();
break;
}
- var old = peers[channel];
- peers[channel] = peer;
+ var old = slot.peer;
+ slot.peer = peer;
if (old != null) old.close();
}
- Log.i(TAG, fmt("crosvm input connected: channel %d", channel));
+ Log.i(TAG, fmt("crosvm input connected: %s", slot.path));
}
- }, fmt("CrosvmInputAccept-%d", channel));
+ }, fmt("CrosvmInputAccept-%s", slot.key));
t.setDaemon(true);
t.start();
}
/**
- * Writes pre-encoded evdev bytes (8-byte records) to the crosvm connection for [channel].
- * Called from the daemon IPC thread on behalf of the UI. Returns false if no crosvm peer is
- * connected yet or the write fails.
+ * Writes pre-encoded evdev bytes (8-byte records) to the crosvm connection for [channel] on
+ * [screenId]. Called from the daemon IPC thread or the broker binder thread on behalf of the
+ * UI. Returns false if the VM has no such device (a per-screen channel -- touch, tablet or
+ * keyboard -- on a screen whose input is switched off, or on a VNC-exported screen whose
+ * tablet and keyboard are crosvm's), no crosvm peer is connected yet, or the write fails --
+ * the caller reports that as "not delivered" rather than pretending it landed somewhere.
*/
- boolean writeNativeInput(int channel, @NonNull byte[] data) {
+ boolean writeNativeInput(@NonNull String screenId, int channel, @NonNull byte[] data) {
if (channel < 0 || channel >= NativeDisplay.CHANNEL_COUNT || data.length == 0) return false;
- // Snapshot the arrays once: release() nulls these fields concurrently, so dereferencing the
- // live field after the guard could NPE. The lock object itself stays valid for the session.
- var locks = inputWriteLocks;
- if (locks == null) return false;
- var lock = locks[channel];
- if (lock == null) return false;
- synchronized (lock) {
- var peers = inputPeers;
- if (peers == null) return false;
- var peer = peers[channel];
+ var slot = findSlot(screenId, channel);
+ if (slot == null) return false;
+ synchronized (slot.lock) {
+ var peer = slot.peer;
if (peer == null || !peer.isOpen()) return false;
try {
var os = peer.getOutputStream();
@@ -148,47 +251,50 @@ boolean writeNativeInput(int channel, @NonNull byte[] data) {
os.flush();
return true;
} catch (IOException e) {
- Log.w(TAG, fmt("input write channel %d failed: %s", channel, e.getMessage()));
- peers[channel] = null;
+ Log.w(TAG, fmt("input write to %s failed: %s", slot.path, e.getMessage()));
+ slot.peer = null;
peer.close();
return false;
}
}
}
+ @Nullable
+ private Slot findSlot(@NonNull String screenId, int channel) {
+ // Snapshot the map once: release() nulls the field concurrently.
+ var live = slots;
+ return live == null ? null : live.get(slotKey(screenId, channel));
+ }
+
+ /** Closes the input server fds we opened and unlinks the inodes we own. */
+ void release() {
+ var live = slots;
+ slots = null;
+ // Called unconditionally rather than under a null check, because latching inputClosed is
+ // half of what it does and a release with nothing published still has to do that half.
+ closeSlots(live == null ? List.of() : live.values());
+ }
+
/**
- * Closes the input server fds we opened and unlinks only the inodes we own. Channels that
- * fell through to the UI's listener (fd == -1) are left untouched so we don't yank a socket
- * the UI still holds.
+ * Gives back everything [live] holds: the accepted peer, the listening fd, and the inode.
+ *
+ * Latching {@code inputClosed} first is not tidiness but the order the accept loop needs.
+ * Closing a server fd is what unblocks the thread parked in accept(2) on it, and that thread
+ * then reads the flag to decide whether the failure means "we are shutting down" or "retry in
+ * 200 ms". Closing first would leave it retrying accept on a closed fd for the life of the
+ * daemon.
*/
- void release() {
- inputClosed = true; // stop accept loops; closing the server fd below unblocks nativeUnixAccept
- if (inputPeers != null) {
- for (int ch = 0; ch < inputPeers.length; ch++) {
- if (inputWriteLocks != null && inputWriteLocks[ch] != null) {
- synchronized (inputWriteLocks[ch]) {
- if (inputPeers[ch] != null) {
- inputPeers[ch].close();
- inputPeers[ch] = null;
- }
- }
+ private void closeSlots(@NonNull Collection live) {
+ inputClosed = true;
+ for (var slot : live) {
+ synchronized (slot.lock) {
+ if (slot.peer != null) {
+ slot.peer.close();
+ slot.peer = null;
}
}
- inputPeers = null;
- }
- inputWriteLocks = null;
- if (inputServerFds == null) {
- inputSocketPaths = null;
- return;
- }
- for (int ch = 0; ch < inputServerFds.length; ch++) {
- int fd = inputServerFds[ch];
- if (fd < 0) continue;
- UnixHelper.nativeCloseFd(fd);
- if (inputSocketPaths != null && inputSocketPaths[ch] != null)
- deleteFile(inputSocketPaths[ch]);
+ UnixHelper.nativeCloseFd(slot.serverFd);
+ deleteFile(slot.path);
}
- inputServerFds = null;
- inputSocketPaths = null;
}
}
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackend.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackend.java
index 6479786d..4bb9fde0 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackend.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackend.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.backend;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackendInstance.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackendInstance.java
index c8e33c79..80efe55e 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackendInstance.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/backend/QemuBackendInstance.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.backend;
import static android.net.LocalSocketAddress.Namespace.FILESYSTEM;
@@ -37,13 +40,16 @@
import cn.classfun.droidvm.lib.natives.NativeProcess;
import cn.classfun.droidvm.lib.store.base.DataItem;
import cn.classfun.droidvm.lib.store.disk.DiskBus;
-import cn.classfun.droidvm.lib.store.vm.DisplayBackend;
+import cn.classfun.droidvm.lib.store.vm.DisplayExporter;
+import cn.classfun.droidvm.lib.store.vm.VMScreenConfig;
import cn.classfun.droidvm.lib.store.vm.GpuBackend;
+import cn.classfun.droidvm.lib.store.vm.PeripheralType;
import cn.classfun.droidvm.lib.store.vm.ProtectedVM;
import cn.classfun.droidvm.lib.store.vm.SharedDirCache;
import cn.classfun.droidvm.lib.store.vm.VMBackend;
import cn.classfun.droidvm.lib.store.vm.VMConfig;
import cn.classfun.droidvm.lib.store.vm.VMHypervisor;
+import cn.classfun.droidvm.lib.store.vm.VMPeripheralConfig;
@SuppressWarnings("FieldCanBeLocal")
public final class QemuBackendInstance extends VMBackendInstance {
@@ -51,9 +57,13 @@ public final class QemuBackendInstance extends VMBackendInstance {
private static final String RUN_PATH = pathJoin(DATA_DIR, "run");
private String qmpSocketPath = null;
private String uartSocketPath = null;
+ private String agentSocketPath = null;
private int ioThreadCounter = 0;
private int driveCounter = 0;
+ private final boolean agentMode;
private final LocalSocketConsoleStream uartStream;
+ @Nullable
+ private final LocalSocketConsoleStream agentStream;
private final InputConsoleStream stdoutStream;
private final InputConsoleStream stderrStream;
private final SimpleConsoleStream stdioStream;
@@ -63,7 +73,12 @@ public QemuBackendInstance(
@NonNull VMConfig config
) {
super(context, config);
+ agentMode = config.item.optBoolean("agent_mode", false);
uartStream = new LocalSocketConsoleStream(config, "uart", null);
+ agentStream = agentMode
+ ? new LocalSocketConsoleStream(config, "agent", null) : null;
+ if (agentStream != null)
+ agentStream.setPersistentLogEnabled(false);
stdoutStream = new InputConsoleStream(config, "stdout", null);
stderrStream = new InputConsoleStream(config, "stderr", null);
stdioStream = new SimpleConsoleStream(config, "stdio");
@@ -71,6 +86,7 @@ public QemuBackendInstance(
addStream(stderrStream);
addStream(stdioStream);
addStream(uartStream);
+ if (agentStream != null) addStream(agentStream);
}
@NonNull
@@ -83,6 +99,10 @@ public VMStartResult start() {
deleteFile(qmpSocketPath);
uartSocketPath = pathJoin(RUN_PATH, fmt("%s-uart.sock", config.getName()));
deleteFile(uartSocketPath);
+ if (agentMode) {
+ agentSocketPath = pathJoin(RUN_PATH, fmt("%s-agent.sock", config.getName()));
+ deleteFile(agentSocketPath);
+ }
Log.i(TAG, fmt("QMP socket path: %s", qmpSocketPath));
var args = buildCommand();
Log.i(TAG, fmt("Executing: %s", String.join(" ", args)));
@@ -97,23 +117,32 @@ public VMStartResult start() {
Log.e(TAG, "Failed to start qemu process", e);
return result;
}
- waitForUartClient();
+ // agent0 is declared before the blocking UART chardev. Connect it first, then release
+ // QEMU's UART wait so no hvc0 boot output can race ahead of the daemon reader.
+ if (agentStream != null)
+ waitForSocketClient("agent", agentSocketPath, agentStream);
+ waitForSocketClient("UART", uartSocketPath, uartStream);
return result;
}
- private void waitForUartClient() {
+ private void waitForSocketClient(
+ @NonNull String label,
+ @NonNull String socketPath,
+ @NonNull LocalSocketConsoleStream stream
+ ) {
int i = 0;
- Log.i(TAG, fmt("UART socket path: %s", uartSocketPath));
+ Log.i(TAG, fmt("%s socket path: %s", label, socketPath));
while (true) {
try {
- var uart = new LocalSocket(LocalSocket.SOCKET_STREAM);
- uart.connect(new LocalSocketAddress(uartSocketPath, FILESYSTEM));
- Log.i(TAG, "UART client connected");
- uartStream.setSocket(uart);
+ var socket = new LocalSocket(LocalSocket.SOCKET_STREAM);
+ socket.connect(new LocalSocketAddress(socketPath, FILESYSTEM));
+ Log.i(TAG, fmt("%s client connected", label));
+ stream.setSocket(socket);
return;
} catch (Exception e) {
if (i >= 50) {
- Log.e(TAG, "failed to create UART socket after multiple attempts, giving up");
+ Log.e(TAG, fmt(
+ "failed to connect %s socket after multiple attempts, giving up", label));
throw new RuntimeException(e);
}
i++;
@@ -134,8 +163,7 @@ private List buildCommand() {
args.add(pathJoin(DATA_DIR, "usr", "share", "qemu"));
var hyp = item.optString("hypervisor", "auto");
var hypervisor = VMHypervisor.valueOf(hyp.toUpperCase());
- if (hypervisor == VMHypervisor.AUTO)
- hypervisor = VMHypervisor.findPreferredHypervisor(VMBackend.QEMU);
+ hypervisor = VMHypervisor.resolveConfigured(VMBackend.QEMU, hypervisor);
if (hypervisor == null) throw new RuntimeException("No supported hypervisor found for QEMU backend");
args.add("-accel");
var defProtectedMode = ProtectedVM.PROTECTED_NORMAL;
@@ -182,7 +210,7 @@ private List buildCommand() {
switch (protectedVm) {
case PROTECTED_PROTECTED:
case PROTECTED_WITHOUT_FIRMWARE:
- long swiotlbMb = Math.max(item.optLong("swiotlb_mb", 64), 1);
+ long swiotlbMb = Math.max(item.optLong("swiotlb_mb", 256), 1);
args.add("-object");
args.add(fmt("arm-confidential-guest,id=prot0,swiotlb-size=%dM", swiotlbMb));
break;
@@ -211,7 +239,7 @@ private List buildCommand() {
}
if (item.optBoolean("hugepages", true))
args.add("-mem-prealloc");
- if (item.optBoolean("rng", true)) {
+ if (!agentMode && item.optBoolean("rng", true)) {
args.add("-object");
args.add("rng-random,filename=/dev/urandom,id=rng0");
args.add("-device");
@@ -221,14 +249,25 @@ private List buildCommand() {
args.add("-device");
args.add("virtio-balloon-pci,disable-legacy=on,disable-modern=off");
}
- buildInputCommand(args);
- buildUsbCommand(args);
+ if (!agentMode) buildInputCommand(args);
+ if (!agentMode) buildUsbCommand(args);
buildDiskCommand(args);
- buildNetCommand(args);
- buildSharedDirCommand(args);
- buildAudioCommand(args);
- buildGpuCommand(args);
- buildVncCommand(args);
+ if (!agentMode) {
+ buildNetCommand(args);
+ buildSharedDirCommand(args);
+ buildAudioCommand(args);
+ buildGpuCommand(args);
+ buildVncCommand(args);
+ }
+ if (agentMode) {
+ args.add("-chardev");
+ args.add(fmt(
+ "socket,id=agent0,path=%s,server=on,wait=off", agentSocketPath));
+ args.add("-device");
+ args.add("virtio-serial-pci,id=agent-bus,disable-legacy=on,disable-modern=off");
+ args.add("-device");
+ args.add("virtconsole,chardev=agent0,name=org.droidvm.agent");
+ }
args.add("-chardev");
args.add(fmt("socket,id=uart0,path=%s,server=on,wait=on", uartSocketPath));
args.add("-serial");
@@ -308,7 +347,9 @@ private void buildDiskCommand(@NonNull List args) {
args.add(fmt("iothread,id=%s", ioId));
var driveArg = new StringBuilder();
driveArg.append(fmt("file=%s,if=none,id=%s", path, drId));
- driveArg.append(",cache=unsafe,aio=threads,discard=unmap");
+ driveArg.append(agentMode
+ ? ",cache=writeback,aio=threads,discard=unmap"
+ : ",cache=unsafe,aio=threads,discard=unmap");
if (readonly) driveArg.append(",readonly=on");
args.add("-drive");
args.add(driveArg.toString());
@@ -323,7 +364,7 @@ private void buildDiskCommand(@NonNull List args) {
}
private void buildInputCommand(@NonNull List args) {
- if (!config.item.optBoolean("display_enabled", false)) return;
+ if (!hasAnyScreen()) return;
args.add("-device");
args.add("virtio-multitouch-pci,disable-legacy=on,disable-modern=off");
args.add("-device");
@@ -334,7 +375,7 @@ private void buildUsbCommand(@NonNull List args) {
if (!config.item.optBoolean("usb", true)) return;
args.add("-device");
args.add("qemu-xhci,id=usb-bus,p2=15,p3=15");
- if (config.item.optBoolean("display_enabled", false)) {
+ if (hasAnyScreen()) {
args.add("-device");
args.add("usb-tablet,bus=usb-bus.0");
args.add("-device");
@@ -368,9 +409,27 @@ private void buildSharedDirCommand(@NonNull List args) {
}
}
+ /**
+ * One virtio-sound-pci card on QEMU's aaudio driver, present when the VM has any audio
+ * peripheral.
+ *
+ * Only the on/off decision is plumbed here. The mode, host endpoint, buffer and underrun
+ * settings of a VirtIO Sound peripheral are all crosvm-side concepts -- QEMU's aaudio driver
+ * opens whatever the platform routes to, in one process, as whatever uid QEMU runs as -- so
+ * they are ignored rather than half-honoured. Intel HDA is ignored here too, even though
+ * this QEMU does emulate one: wiring it would be a separate piece of work with its own
+ * verification. A config that predates the peripheral tab still works through the old
+ * {@code audio_enabled} key, which also stays available as an override.
+ */
private void buildAudioCommand(@NonNull List args) {
- var displayEnabled = config.item.optBoolean("display_enabled", false);
- if (!config.item.optBoolean("audio_enabled", displayEnabled)) return;
+ boolean anyAudio = false;
+ for (var peripheral : VMPeripheralConfig.listOf(config.item)) {
+ if (peripheral.getType() == PeripheralType.VIRTIO_SOUND)
+ anyAudio = true;
+ }
+ if (!anyAudio) {
+ if (!config.item.optBoolean("audio_enabled", hasAnyScreen())) return;
+ }
args.add("-audiodev");
args.add("aaudio,id=snd0");
args.add("-device");
@@ -411,13 +470,20 @@ private void buildNetCommand(@NonNull List args) {
}
}
+ /**
+ * The virtio-gpu device (with its renderer, if any) and QEMU's nearest thing to simplefb.
+ *
+ * The virtio-gpu screen's switch is the device, exactly as on crosvm; the renderer only
+ * decides which QEMU device model implements it. The geometry is that screen's own, so a VM
+ * with both screens no longer has to give them one size.
+ */
private void buildGpuCommand(@NonNull List args) {
var item = config.item;
- var useGpu = item.optBoolean("gpu_enabled", false);
- var useDisplay = item.optBoolean("display_enabled", false);
- if (!useGpu && !useDisplay) return;
- var backend = optEnum(item, "display_backend", DisplayBackend.NONE);
- if (useGpu) {
+ var gpuScreen = isScreenEnabled(VMScreenConfig.ID_GPU0);
+ var fbScreen = isScreenEnabled(VMScreenConfig.ID_SIMPLEFB);
+ if (!gpuScreen && !fbScreen) return;
+ if (gpuScreen) {
+ var gpu0 = VMScreenConfig.of(item, VMScreenConfig.ID_GPU0);
var gpuBackend = optEnum(item, "gpu_backend", GpuBackend.NONE);
var gpuArg = new StringBuilder();
boolean use3d = false;
@@ -431,16 +497,14 @@ private void buildGpuCommand(@NonNull List args) {
use3d = true;
break;
default:
+ // 2D, or a config that never named a renderer: the plain device, which is what
+ // "display without acceleration" is on this backend too.
gpuArg.append("virtio-gpu-pci");
break;
}
gpuArg.append(",disable-legacy=on,disable-modern=off");
- if (useDisplay && backend == DisplayBackend.VIRTIO_GPU) {
- long width = item.optLong("display_width", 1280);
- long height = item.optLong("display_height", 720);
- gpuArg.append(fmt(",xres=%d,yres=%d", width, height));
- gpuArg.append(",edid=on");
- }
+ gpuArg.append(fmt(",xres=%d,yres=%d", gpu0.getWidth(), gpu0.getHeight()));
+ gpuArg.append(",edid=on");
if (use3d) {
gpuArg.append(",blob=on");
args.add("-display");
@@ -448,30 +512,55 @@ private void buildGpuCommand(@NonNull List args) {
}
args.add("-device");
args.add(gpuArg.toString());
- } else if (backend == DisplayBackend.VIRTIO_GPU) {
- long width = item.optLong("display_width", 1280);
- long height = item.optLong("display_height", 720);
- args.add("-device");
- args.add(fmt("virtio-gpu-pci,disable-legacy=on,disable-modern=off,xres=%d,yres=%d,edid=on",
- width, height));
}
- if (useDisplay && backend == DisplayBackend.SIMPLEFB) {
+ // ramfb takes no size: QEMU's firmware-programmed framebuffer gets its geometry from the
+ // guest, so the simplefb screen's width and height have nowhere to go here.
+ if (fbScreen) {
args.add("-device");
args.add("ramfb");
}
}
+ /**
+ * Whether the config asks for [screenId]'s display device.
+ *
+ * QEMU has no {@code screen=} to bind an exporter to -- one {@code -vnc} serves whatever
+ * the machine displays -- so the per-screen model only reaches this far: the screen switches
+ * decide which devices exist, and the first screen exporting over VNC supplies the server's
+ * settings. Native display is refused for this backend in the editor, so it never appears
+ * here at all.
+ */
+ private boolean hasAnyScreen() {
+ for (var screen : VMScreenConfig.listOf(config.item))
+ if (screen.isEnabled()) return true;
+ return false;
+ }
+
+ private boolean isScreenEnabled(@NonNull String screenId) {
+ var screen = VMScreenConfig.find(config.item, screenId);
+ return screen != null && screen.isEnabled();
+ }
+
private void buildVncCommand(@NonNull List args) {
- var item = config.item;
- if (!item.optBoolean("vnc_enabled", false)) return;
- var host = item.optString("vnc_host", "0.0.0.0");
+ VMScreenConfig bound = null;
+ for (var screen : VMScreenConfig.listOf(config.item))
+ if (screen.isEnabled() && screen.getExporter() == DisplayExporter.VNC) {
+ bound = screen;
+ break;
+ }
+ if (bound == null) return;
+ var host = bound.getVncHost();
if (host.isEmpty()) host = "0.0.0.0";
- long port = Math.max(item.optLong("vnc_port", 5900), 1);
+ long port = Math.max(bound.getVncPort(), 1);
long displayNum = port - 5900;
if (displayNum < 0) displayNum = 0;
var vncArg = new StringBuilder();
+ // "host:display", so an IPv6 literal has to be bracketed or its own colons are read as the
+ // separator. Reachable now that the host field offers the phone's own addresses and half of
+ // those are v6; an IPv4 address is untouched.
+ if (host.indexOf(':') >= 0) host = fmt("[%s]", host);
vncArg.append(fmt("%s:%d", host, displayNum));
- var password = item.optString("vnc_password", "");
+ var password = bound.getVncPassword();
if (!password.isEmpty()) {
args.add("-object");
args.add(fmt("secret,id=vnc-password,data=%s", password));
@@ -575,6 +664,7 @@ public boolean hasControlSocket() {
@Override
public void cleanup() {
uartStream.close();
+ if (agentStream != null) agentStream.close();
if (qmpSocketPath != null) {
deleteFile(qmpSocketPath);
qmpSocketPath = null;
@@ -583,5 +673,9 @@ public void cleanup() {
deleteFile(uartSocketPath);
uartSocketPath = null;
}
+ if (agentSocketPath != null) {
+ deleteFile(agentSocketPath);
+ agentSocketPath = null;
+ }
}
}
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportTask.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportTask.java
index 8a8520c3..bee62969 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportTask.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportTask.java
@@ -1,8 +1,12 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.pkg;
import static java.nio.charset.StandardCharsets.UTF_8;
import static cn.classfun.droidvm.daemon.vm.pkg.VMExportUtils.buildHeader;
import static cn.classfun.droidvm.daemon.vm.pkg.VMExportUtils.collectBootFiles;
+import static cn.classfun.droidvm.daemon.vm.pkg.VMExportUtils.collectDisks;
import static cn.classfun.droidvm.daemon.vm.pkg.VMExportUtils.collectNetworks;
import static cn.classfun.droidvm.daemon.vm.pkg.VMExportUtils.sanitizeVM;
import static cn.classfun.droidvm.lib.archive.TarWriter.wrapCompressionOutput;
@@ -31,8 +35,6 @@
import cn.classfun.droidvm.daemon.server.Server;
import cn.classfun.droidvm.lib.archive.RandomAccessFileOutputStream;
import cn.classfun.droidvm.lib.archive.TarWriter;
-import cn.classfun.droidvm.lib.pkg.DiskEntry;
-import cn.classfun.droidvm.lib.pkg.DiskRef;
import cn.classfun.droidvm.lib.pkg.PackageConstants;
import cn.classfun.droidvm.lib.pkg.PackageManifest;
import cn.classfun.droidvm.lib.pkg.Phase;
@@ -56,7 +58,7 @@ public final class VMExportTask {
public VMExportTask(
@NonNull Server server,
@NonNull JSONObject request
- ) {
+ ) throws Exception {
this.server = server;
destPath = request.optString("dest_path");
if (!destPath.startsWith("/"))
@@ -75,18 +77,14 @@ public VMExportTask(
var wantedSet = new HashSet();
if (wanted != null) for (int i = 0; i < wanted.length(); i++)
wantedSet.add(wanted.optInt(i, -1));
- var arr = vm.item.opt("disks", DataItem.newArray());
- for (int i = 0; i < arr.size(); i++) {
- var e = arr.get(i);
- if (!e.is(DataItem.Type.OBJECT)) continue;
- if (!wantedSet.isEmpty() && !wantedSet.contains(i)) continue;
- var disk = new DiskEntry(new DiskRef(i, e));
- disk.build();
- manifest.disks.add(disk);
- }
+ // Walks the backing chains, so it can fail on an image whose base is gone. Doing it
+ // here, before the destination file is touched, keeps that a plain request error.
+ collectDisks(manifest, vm, wantedSet);
collectBootFiles(manifest);
collectNetworks(manifest, server.getContext().getNetworks(), vm);
manifest.vm.item.remove("disks");
+ // Stamp last: the version is the highest any collected part needs.
+ manifest.manifestVersion = manifest.resolveVersion();
totalItems = manifest.disks.size() + manifest.boots.size();
}
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportUtils.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportUtils.java
index 83f38224..039582f4 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportUtils.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMExportUtils.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.pkg;
import static java.nio.charset.StandardCharsets.UTF_8;
@@ -10,6 +13,7 @@
import static cn.classfun.droidvm.lib.Constants.PATH_MICRODROID_KERNEL;
import static cn.classfun.droidvm.lib.utils.BinaryUtils.putInt64LE;
import static cn.classfun.droidvm.lib.utils.BinaryUtils.putUInt16LE;
+import static cn.classfun.droidvm.lib.utils.FileUtils.canonicalPath;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
import android.util.Log;
@@ -17,6 +21,7 @@
import androidx.annotation.NonNull;
import java.io.IOException;
+import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.LinkedHashSet;
@@ -25,12 +30,16 @@
import cn.classfun.droidvm.BuildConfig;
import cn.classfun.droidvm.daemon.network.NetworkInstanceStore;
import cn.classfun.droidvm.lib.pkg.BootFile;
+import cn.classfun.droidvm.lib.pkg.DiskChainPlan;
+import cn.classfun.droidvm.lib.pkg.DiskEntry;
+import cn.classfun.droidvm.lib.pkg.DiskRef;
import cn.classfun.droidvm.lib.pkg.PackageConstants;
import cn.classfun.droidvm.lib.pkg.PackageManifest;
import cn.classfun.droidvm.lib.store.base.DataItem;
import cn.classfun.droidvm.lib.store.network.NetworkConfig;
import cn.classfun.droidvm.lib.store.vm.BootConfig;
import cn.classfun.droidvm.lib.store.vm.VMConfig;
+import cn.classfun.droidvm.lib.utils.ImageUtils;
public final class VMExportUtils {
private static final String TAG = "VMExportUtils";
@@ -72,7 +81,7 @@ public static byte[] buildHeader(
var hdr = new byte[PackageConstants.HEADER_SIZE];
var magic = PackageConstants.MAGIC.getBytes(UTF_8);
System.arraycopy(magic, 0, hdr, 0, magic.length);
- putUInt16LE(hdr, 6, PackageConstants.MANIFEST_VERSION);
+ putUInt16LE(hdr, 6, manifest.manifestVersion);
putUInt16LE(hdr, 8, BuildConfig.VERSION_CODE);
putUInt16LE(hdr, 10, manifestSize);
putUInt16LE(hdr, 12, manifest.compression.type);
@@ -99,6 +108,39 @@ private static void addBootFile(
manifest.boots.add(file);
}
+ /**
+ * The files the package must carry for the chosen disks: each selected VM disk plus, when it
+ * is a qcow2 overlay, every backing image under it. Packing the overlay alone was the whole
+ * bug - the guest reads the base too, and the copied header points at a path that only ever
+ * existed on the exporting phone.
+ *
+ * Reads the source images (headers only) and never writes to them; the exporting phone's
+ * disks and their registered parent links come out of an export exactly as they went in.
+ *
+ * @param wanted VM disk indices to include; empty means every disk.
+ */
+ public static void collectDisks(
+ @NonNull PackageManifest manifest,
+ @NonNull VMConfig vm,
+ @NonNull Set wanted
+ ) throws Exception {
+ var tops = new ArrayList();
+ var disks = vm.item.opt("disks", DataItem.newArray());
+ for (int i = 0; i < disks.size(); i++) {
+ var item = disks.get(i);
+ if (!item.is(DataItem.Type.OBJECT)) continue;
+ if (!wanted.isEmpty() && !wanted.contains(i)) continue;
+ var ref = new DiskRef(i, item);
+ if (ref.path.isEmpty()) continue;
+ // Canonical so that a base image reached both as a disk and as another disk's
+ // parent is recognised as the same file and packed once.
+ ref.path = canonicalPath(ref.path);
+ tops.add(ref);
+ }
+ for (var member : DiskChainPlan.build(tops, ImageUtils::backingOf))
+ manifest.disks.add(DiskEntry.of(member));
+ }
+
public static void collectBootFiles(@NonNull PackageManifest manifest) {
var builtins = new HashSet();
builtins.add(PATH_BUILTIN_KERNEL);
@@ -169,7 +211,13 @@ public static void collectNetworks(
var ref = exported.optString("pkg_network_ref", "");
if (netId.isEmpty() || ref.isEmpty() || !seen.add(netId)) continue;
var net = store.findById(netId);
- if (net == null) continue;
+ if (net == null) {
+ // The app registers every network it writes, so this means the registration was
+ // refused or never reached us. Say so: the package comes out with a NIC that
+ // references a network it does not carry, and nothing else would report it.
+ Log.w(TAG, fmt("Network %s is unknown here; leaving it out of the package", netId));
+ continue;
+ }
try {
var cfg = new NetworkConfig(net.toJson());
scrubUnique(cfg.item);
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportTask.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportTask.java
index 9f792600..c191d9f3 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportTask.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportTask.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.pkg;
import static cn.classfun.droidvm.daemon.vm.pkg.VMImportUtils.remapBootPaths;
@@ -5,9 +8,11 @@
import static cn.classfun.droidvm.daemon.vm.pkg.VMImportUtils.uniqueFile;
import static cn.classfun.droidvm.lib.pkg.PackageConstants.BUFFER;
import static cn.classfun.droidvm.lib.utils.BinaryUtils.readFully;
+import static cn.classfun.droidvm.lib.utils.NetUtils.generateRandomMac;
import static cn.classfun.droidvm.lib.utils.JsonUtils.listToJSONArray;
import static cn.classfun.droidvm.lib.utils.StringUtils.basename;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+import static cn.classfun.droidvm.lib.utils.StringUtils.safeFileName;
import static cn.classfun.droidvm.lib.utils.ThreadUtils.runOnPool;
import android.util.Log;
@@ -24,14 +29,15 @@
import java.io.InputStream;
import java.util.ArrayList;
import java.util.HashMap;
+import java.util.HashSet;
import java.util.List;
import java.util.UUID;
-import java.util.concurrent.atomic.AtomicBoolean;
import cn.classfun.droidvm.daemon.server.Server;
import cn.classfun.droidvm.lib.archive.TarReader;
import cn.classfun.droidvm.lib.pkg.BootFile;
import cn.classfun.droidvm.lib.pkg.DiskEntry;
+import cn.classfun.droidvm.lib.pkg.NetworkImportPlan;
import cn.classfun.droidvm.lib.pkg.PackageConstants;
import cn.classfun.droidvm.lib.pkg.PackageHeader;
import cn.classfun.droidvm.lib.pkg.PackageInput;
@@ -40,7 +46,10 @@
import cn.classfun.droidvm.lib.pkg.VolumeSet;
import cn.classfun.droidvm.lib.store.base.DataItem;
import cn.classfun.droidvm.lib.store.network.NetworkConfig;
+import cn.classfun.droidvm.lib.store.vm.NicLeaseOffsets;
import cn.classfun.droidvm.lib.store.vm.VMConfig;
+import cn.classfun.droidvm.lib.store.vm.VMNicConfig;
+import cn.classfun.droidvm.lib.utils.ImageUtils;
public final class VMImportTask {
private static final String TAG = "VMImportTask";
@@ -49,7 +58,13 @@ public final class VMImportTask {
private final Server server;
private final String srcPath;
private final File targetDir;
- private final String networkMode;
+ /** What to do with a packaged network the plan says nothing about. */
+ private final NetworkImportPlan.Action networkFallback;
+ private final List networkPlan;
+ /** This package's own folder under {@link #targetDir}; created before the first file lands. */
+ private File vmDir = null;
+ private String vmName = "";
+ private boolean registered = false;
private int totalItems;
private int volumeTotal = 0;
public VMConfig importedVM = null;
@@ -66,7 +81,11 @@ public VMImportTask(@NonNull Server server, @NonNull JSONObject request) {
if (!targetPath.startsWith("/"))
throw new IllegalArgumentException("missing target_dir");
targetDir = new File(targetPath);
- networkMode = request.optString("network_mode", "auto");
+ networkPlan = NetworkImportPlan.parse(request.optJSONArray("network_plan"));
+ // A caller with no plan gets the old whole-package behaviour: "skip" attaches nothing,
+ // anything else recreates every network the package carries.
+ networkFallback = request.optString("network_mode", "auto").equals("skip")
+ ? NetworkImportPlan.Action.SKIP : NetworkImportPlan.Action.CREATE;
}
public void startAsync() {
@@ -77,10 +96,11 @@ private void run() {
var data = DataItem.newObject();
try {
unpack();
- importedVM.setName(uniqueVMName(importedVM.getName()));
var networks = importNetworks(importedVM, importedManifest.networks);
+ resolveLeases(importedVM);
var vmId = server.getContext().getVMs().createVM(importedVM);
if (vmId == null || vmId.isEmpty()) throw new IOException("failed to register VM");
+ registered = true;
data.set("done", totalItems);
data.set("total", totalItems);
data.set("vm_id", vmId);
@@ -91,6 +111,7 @@ private void run() {
emit(data, Phase.DONE);
} catch (Exception e) {
Log.w(TAG, fmt("Import task %s failed", taskId), e);
+ discardPlacedFiles();
data.set("done", 0);
data.set("total", totalItems);
data.set("message", e.getMessage());
@@ -108,7 +129,7 @@ private void onTarItem(
) throws Exception{
var disk = importedManifest.findDisk(name);
if (disk != null) {
- var target = uniqueFile(targetDir, disk.name);
+ var target = uniqueFile(vmDir, disk.name);
copyEntry(content, target, size, placedDisks.size(), totalItems);
disk.target = target;
placedDisks.add(disk);
@@ -116,7 +137,7 @@ private void onTarItem(
}
var boot = importedManifest.findBoot(name);
if (boot != null) {
- var dir = new File(targetDir, "boot");
+ var dir = new File(vmDir, "boot");
if (!dir.exists() && !dir.mkdirs())
throw new IOException(fmt("Cannot create %s", dir));
var target = uniqueFile(dir, boot.name);
@@ -151,11 +172,71 @@ private void unpack() throws Exception {
}
var vm = new VMConfig(importedManifest.vm.toJson());
vm.setId(UUID.randomUUID());
+ vm.setName(vmName);
+ relinkBackingChains();
remapDiskPaths(vm, placedDisks);
remapBootPaths(vm, placedBoots);
importedVM = vm;
}
+ /**
+ * Re-point each imported overlay at the copy of its backing image that travelled with it.
+ * The packed header still names the exporting phone's path - exporting reads the source
+ * images and never rewrites them - so this is where a chain becomes usable again. Header
+ * only: the data is already there, the files just live somewhere else now.
+ */
+ private void relinkBackingChains() throws IOException {
+ var byArchive = new HashMap();
+ for (var disk : placedDisks) byArchive.put(disk.archivePath, disk);
+ for (var disk : placedDisks) {
+ if (disk.backingArchive.isEmpty() || disk.target == null) continue;
+ var parent = byArchive.get(disk.backingArchive);
+ if (parent == null || parent.target == null) throw new IOException(fmt(
+ "package is missing the backing image %s needed by %s",
+ disk.backingArchive, disk.archivePath
+ ));
+ ImageUtils.rebaseBacking(disk.target.getPath(), parent.target.getPath());
+ }
+ }
+
+ /**
+ * Drop what a failed import wrote. Safe to do bluntly because everything it wrote is inside
+ * one folder this import created for itself; nothing else has ever been in there.
+ */
+ private void discardPlacedFiles() {
+ var dir = vmDir;
+ if (dir == null || registered) return;
+ vmDir = null;
+ try {
+ deleteTree(dir);
+ } catch (Exception e) {
+ Log.w(TAG, fmt("Failed to clean up %s", dir), e);
+ }
+ }
+
+ private static void deleteTree(@NonNull File file) {
+ var children = file.listFiles();
+ if (children != null) for (var child : children) deleteTree(child);
+ //noinspection ResultOfMethodCallIgnored
+ file.delete();
+ }
+
+ /**
+ * The folder this package's files go in: named after the VM, unique within the chosen
+ * import folder. One package's disks - a backing chain can be several - stay together
+ * instead of piling into a folder shared with every other VM's images.
+ */
+ @NonNull
+ private File createVMDir(@NonNull String name) throws IOException {
+ var base = safeFileName(name, "vm");
+ var dir = new File(targetDir, base);
+ for (int i = 1; dir.exists(); i++)
+ dir = new File(targetDir, fmt("%s_%d", base, i));
+ if (!dir.mkdirs())
+ throw new IOException(fmt("Cannot create %s", dir));
+ return dir;
+ }
+
private int readVolumeCount(@NonNull String masterPath) throws Exception {
try (var in = new FileInputStream(masterPath)) {
var hdr = new byte[PackageConstants.HEADER_SIZE];
@@ -166,6 +247,10 @@ private int readVolumeCount(@NonNull String masterPath) throws Exception {
private void extract(@NonNull PackageInput pkg) throws Exception {
importedManifest = pkg.manifest;
+ // Settle the name and make the folder before any byte lands in it, so the files are
+ // together from the start and a failure has exactly one thing to clean up.
+ vmName = uniqueVMName(importedManifest.vm.getName());
+ vmDir = createVMDir(vmName);
totalItems = importedManifest.disks.size() + importedManifest.boots.size();
var data = DataItem.newObject();
data.set("done", 0);
@@ -179,6 +264,14 @@ private void extract(@NonNull PackageInput pkg) throws Exception {
pkg.validateDataConsumed();
}
+ /**
+ * Applies the import plan: each network the package carries is joined to one this phone
+ * already has, created here, or left behind, and every NIC that referenced it is re-pointed
+ * at what it ended up on. A NIC whose network was skipped -- or whose join target has since
+ * been deleted -- comes out unattached rather than pointing at nothing.
+ *
+ * @return the networks this import created, for the caller to persist
+ */
@NonNull
private JSONArray importNetworks(
@NonNull VMConfig vm,
@@ -186,24 +279,28 @@ private JSONArray importNetworks(
) throws Exception {
var refs = new HashMap();
var created = new JSONArray();
- if (networkMode.equals("skip")) {
- remapNetworks(vm, refs);
- return created;
- }
var store = server.getContext().getNetworks();
+ var plan = new NetworkImportPlan(store);
for (var source : configs) {
- var ref = source.item.optString("pkg_network_ref", "");
+ var ref = source.item.optString(NetworkImportPlan.REF_KEY, "");
if (ref.isEmpty()) continue;
- if (networkMode.equals("existing")) {
- var existing = store.findByName(source.getName());
- if (existing != null) refs.put(ref, existing.getId().toString());
+ var entry = NetworkImportPlan.findRef(networkPlan, ref);
+ var action = entry == null ? networkFallback : entry.action;
+ if (action == NetworkImportPlan.Action.SKIP) continue;
+ if (action == NetworkImportPlan.Action.JOIN) {
+ var target = entry == null || entry.networkId == null
+ ? null : store.findById(entry.networkId);
+ if (target == null) {
+ Log.w(TAG, fmt("Import %s: no network to join for %s", taskId, ref));
+ continue;
+ }
+ refs.put(ref, target.getId().toString());
continue;
}
- var cfg = new NetworkConfig(source.toJson());
- cfg.item.remove("pkg_network_ref");
- cfg.setId(UUID.randomUUID());
- cfg.setName(uniqueNetworkName(cfg.getName()));
- makeBridgeNameUnique(cfg);
+ // The screen prepared the config so the user could see what it would be; take it,
+ // but let the plan settle the names again against the store as it is right now.
+ var cfg = entry != null && entry.config != null
+ ? plan.adopt(entry.config) : plan.prepareCreate(source);
var id = store.createNetwork(cfg);
if (id == null || id.isEmpty()) continue;
refs.put(ref, id);
@@ -221,38 +318,65 @@ private void remapNetworks(
if (nets == null || !nets.is(DataItem.Type.ARRAY)) return;
for (var nic : nets.asArray()) {
if (!nic.is(DataItem.Type.OBJECT)) continue;
- var ref = nic.optString("pkg_network_ref", "");
- nic.remove("pkg_network_ref");
+ var ref = nic.optString(NetworkImportPlan.REF_KEY, "");
+ nic.remove(NetworkImportPlan.REF_KEY);
var id = refs.get(ref);
if (id == null || id.isEmpty()) nic.remove("network_id");
else nic.set("network_id", id);
}
}
- @NonNull
- private String uniqueNetworkName(@NonNull String name) {
- var store = server.getContext().getNetworks();
- if (store.findByName(name) == null) return name;
- int i = 1;
- while (store.findByName(fmt("%s_%d", name, i)) != null) i++;
- return fmt("%s_%d", name, i);
- }
-
- private void makeBridgeNameUnique(@NonNull NetworkConfig cfg) {
- var bridge = cfg.getBridgeName();
- if (bridge == null || bridge.isEmpty()) return;
- if (isBridgeNameUnique(bridge)) return;
- int i = 1;
- while (!isBridgeNameUnique(fmt("%s%d", bridge, i))) i++;
- cfg.setBridgeName(fmt("%s%d", bridge, i));
+ /**
+ * Makes every static DHCP lease the package brought fit the network its NIC actually landed
+ * on. An offset that came from the other phone is kept where it can be: it is what the guest
+ * has been answering on. Where it cannot -- another VM here already holds it, it falls inside
+ * this VLAN's dynamic pool, or the VLAN is smaller than it was over there -- the next free
+ * offset is taken instead, and only when the VLAN has nothing free at all (or does not serve
+ * that family, or the NIC ended up on no network) does the lease go back to a dynamic
+ * address. Refusing the import over an address a VM can perfectly well be given by DHCP
+ * would help nobody.
+ */
+ private void resolveLeases(@NonNull VMConfig vm) {
+ vm.forEachNic(nic -> {
+ resolveLease(vm, nic, NicLeaseOffsets.Family.IPV4);
+ resolveLease(vm, nic, NicLeaseOffsets.Family.IPV6);
+ });
}
- private boolean isBridgeNameUnique(@NonNull String bridgeName) {
- var unique = new AtomicBoolean(true);
- server.getContext().getNetworks().forEach((id, net) -> {
- if (bridgeName.equals(net.getBridgeName())) unique.set(false);
- });
- return unique.get();
+ private void resolveLease(
+ @NonNull VMConfig vm,
+ @NonNull VMNicConfig nic,
+ @NonNull NicLeaseOffsets.Family family
+ ) {
+ boolean ipv6 = family == NicLeaseOffsets.Family.IPV6;
+ if (!(ipv6 ? nic.isDhcp6LeaseEnabled() : nic.isDhcp4LeaseEnabled())) return;
+ var netId = nic.getNetworkId();
+ var network = netId == null ? null : server.getContext().getNetworks().findById(netId);
+ var vlan = network == null ? null : nic.resolveDhcpVlan(network);
+ if (vlan == null || !(ipv6 ? vlan.isDhcp6Enabled() : vlan.isDhcp4Enabled())) {
+ nic.setDhcpLeaseEnabled(ipv6, false);
+ return;
+ }
+ var used = new HashSet();
+ server.getContext().getVMs().forEach((id, other) ->
+ NicLeaseOffsets.addOffsets(used, other, network, vlan, family));
+ // this VM is not registered yet, so its own other NICs are only in the config in hand
+ NicLeaseOffsets.addOffsets(used, vm, network, vlan, family, nic);
+ boolean has = ipv6 ? nic.hasDhcp6Offset() : nic.hasDhcp4Offset();
+ long wanted = !has ? NicLeaseOffsets.FIRST
+ : (ipv6 ? nic.getDhcp6Offset() : nic.getDhcp4Offset());
+ long offset = NicLeaseOffsets.resolve(wanted, used, vlan, family);
+ if (offset < 0) {
+ Log.w(TAG, fmt("Import %s: no free lease offset on network %s", taskId, netId));
+ nic.setDhcpLeaseEnabled(ipv6, false);
+ return;
+ }
+ if (ipv6) nic.setDhcp6Offset(offset);
+ else nic.setDhcp4Offset(offset);
+ // Exporting strips NIC MAC addresses -- two phones must not hand out the same one -- but
+ // a static lease is keyed by MAC, so a kept lease needs one now rather than whenever the
+ // user next opens the NIC editor.
+ if (nic.getMacAddress() == null) nic.item.set("mac_address", generateRandomMac());
}
private void copyEntry(
diff --git a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportUtils.java b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportUtils.java
index 4f47f12a..df6ba273 100644
--- a/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportUtils.java
+++ b/app/src/main/java/cn/classfun/droidvm/daemon/vm/pkg/VMImportUtils.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.daemon.vm.pkg;
import static java.util.Objects.requireNonNull;
@@ -7,6 +10,7 @@
import java.io.File;
import java.util.ArrayList;
+import java.util.Comparator;
import java.util.HashMap;
import cn.classfun.droidvm.lib.pkg.BootFile;
@@ -19,13 +23,26 @@ public final class VMImportUtils {
private VMImportUtils() {
}
+ /**
+ * Rebuild the VM's disk list from the files the import placed. Only entries that fill a disk
+ * slot go in: a backing image is on disk for the overlay above it to read, not for the guest
+ * to see. Slot order comes from the manifest rather than from the order the tar happened to
+ * store the files in, which no longer matches once a chain is interleaved with its disks.
+ */
public static void remapDiskPaths(
@NonNull VMConfig vm,
@NonNull ArrayList placed
) {
- var disks = DataItem.newArray();
+ var attached = new ArrayList();
for (var disk : placed) {
- if (disk.target == null || disk.ref == null) continue;
+ if (disk.target == null || disk.ref == null || !disk.attached) continue;
+ attached.add(disk);
+ }
+ // Stable: packages written before the slot index existed carry 0 for every entry, and
+ // keep the order they were packed in.
+ attached.sort(Comparator.comparingInt((DiskEntry disk) -> disk.ref.index));
+ var disks = DataItem.newArray();
+ for (var disk : attached) {
var item = DataItem.newObject();
item.set("path", disk.target.getPath());
item.set("readonly", disk.ref.readonly);
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/Constants.java b/app/src/main/java/cn/classfun/droidvm/lib/Constants.java
index 852e863f..6a082d81 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/Constants.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/Constants.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/api/ApiInfo.java b/app/src/main/java/cn/classfun/droidvm/lib/api/ApiInfo.java
index 47fdde35..c6725f77 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/api/ApiInfo.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/api/ApiInfo.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.api;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/api/ApiManager.java b/app/src/main/java/cn/classfun/droidvm/lib/api/ApiManager.java
index b1f1cabd..753b8c6e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/api/ApiManager.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/api/ApiManager.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.api;
import static java.util.Objects.requireNonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/api/ApiServiceInfo.java b/app/src/main/java/cn/classfun/droidvm/lib/api/ApiServiceInfo.java
index cd35cee5..e5f90dc0 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/api/ApiServiceInfo.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/api/ApiServiceInfo.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.api;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/api/Privacy.java b/app/src/main/java/cn/classfun/droidvm/lib/api/Privacy.java
index 118fe518..7de20ecd 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/api/Privacy.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/api/Privacy.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.api;
import static cn.classfun.droidvm.lib.utils.AssetUtils.loadFromAssets;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/archive/Compression.java b/app/src/main/java/cn/classfun/droidvm/lib/archive/Compression.java
index 059234a2..fb0c732e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/archive/Compression.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/archive/Compression.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.archive;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/archive/LimitedInputStream.java b/app/src/main/java/cn/classfun/droidvm/lib/archive/LimitedInputStream.java
index 451ccfa0..3b3a2648 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/archive/LimitedInputStream.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/archive/LimitedInputStream.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.archive;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/archive/OutputStreamLimiter.java b/app/src/main/java/cn/classfun/droidvm/lib/archive/OutputStreamLimiter.java
index 8abc2991..bd6ff1f9 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/archive/OutputStreamLimiter.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/archive/OutputStreamLimiter.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.archive;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/archive/RandomAccessFileOutputStream.java b/app/src/main/java/cn/classfun/droidvm/lib/archive/RandomAccessFileOutputStream.java
index 6d32422c..4a968d59 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/archive/RandomAccessFileOutputStream.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/archive/RandomAccessFileOutputStream.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.archive;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/archive/TarReader.java b/app/src/main/java/cn/classfun/droidvm/lib/archive/TarReader.java
index 34f9b55e..d9f29122 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/archive/TarReader.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/archive/TarReader.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.archive;
import static java.nio.charset.StandardCharsets.UTF_8;
@@ -125,6 +128,14 @@ private static String cstr(@NonNull byte[] hdr, int off, int len) {
}
private static long parseOctal(@NonNull byte[] hdr, int off, int len) {
+ // GNU base-256: bit 7 of the first byte set, the rest big-endian. GNU tar, bsdtar and
+ // Python's tarfile all write sizes >= 8 GiB (12 octal digits won't fit) this way, and
+ // without this branch such an entry parsed as 0 -> a 0-byte disk on import.
+ if ((hdr[off] & 0x80) != 0) {
+ long v = hdr[off] & 0x7f;
+ for (int i = off + 1; i < off + len; i++) v = (v << 8) | (hdr[i] & 0xff);
+ return v;
+ }
var s = cstr(hdr, off, len);
if (s.isEmpty()) return 0;
var trimmed = s.trim();
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/archive/TarWriter.java b/app/src/main/java/cn/classfun/droidvm/lib/archive/TarWriter.java
index c47f0120..646f7d54 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/archive/TarWriter.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/archive/TarWriter.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.archive;
import static java.nio.charset.StandardCharsets.US_ASCII;
@@ -23,6 +26,9 @@
public final class TarWriter implements AutoCloseable {
private static final int BLOCK = 512;
+ // Fixed zstd worker count: each one costs roughly jobSize * 2 of extra
+ // memory, and the export runs next to whatever else the host is doing.
+ private static final int ZSTD_WORKERS = 4;
private final OutputStream out;
private boolean closed = false;
@@ -108,7 +114,19 @@ private void writeHeader(
field(hdr, 100, 8, padOctal(metadata.mode, 7));
field(hdr, 108, 8, padOctal(metadata.uid, 7));
field(hdr, 116, 8, padOctal(metadata.gid, 7));
- field(hdr, 124, 12, padOctal(size, 11));
+ if (size > 0777777777777L) {
+ // 12 octal digits top out just under 64 GiB; past that GNU base-256 (bit 7 flag, then
+ // big-endian), which TarReader, GNU tar, bsdtar and Python all read. Before this the
+ // 13-digit string was silently cut to 12 and the entry came out with a wrong size.
+ hdr[124] = (byte) 0x80;
+ long v = size;
+ for (int i = 135; i >= 125; i--) {
+ hdr[i] = (byte) (v & 0xff);
+ v >>= 8;
+ }
+ } else {
+ field(hdr, 124, 12, padOctal(size, 11));
+ }
field(hdr, 136, 12, padOctal(metadata.mtime, 11));
for (int i = 148; i < 156; i++) hdr[i] = ' ';
hdr[156] = (byte) type;
@@ -156,7 +174,11 @@ public static OutputStream wrapCompressionOutput(
case XZ:
return new XZOutputStream(out, new LZMA2Options());
case ZSTD:
- return new ZstdOutputStream(out, 3);
+ // setWorkers must be called before the first write, otherwise
+ // zstd-jni rejects it with IllegalStateException. Workers only
+ // affect encoder internals: the output stays a single standard
+ // zstd frame that any reader can decode.
+ return new ZstdOutputStream(out, 3).setWorkers(ZSTD_WORKERS);
default:
throw new IllegalArgumentException(fmt("unknown compression: %s", c));
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashFile.java b/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashFile.java
index 1e81355e..4ffd92ec 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashFile.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashFile.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.crypt;
import static cn.classfun.droidvm.lib.utils.FileUtils.loadJSONFile;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashItem.java b/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashItem.java
index eba503a7..97b8b078 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashItem.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/crypt/HashItem.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.crypt;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonClient.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonClient.java
index fcd02dfb..d0576735 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonClient.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonClient.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import static cn.classfun.droidvm.lib.daemon.Protocol.IPC_REQUEST_TIMEOUT_MS;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonConnection.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonConnection.java
index 3fb894f4..3588af70 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonConnection.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonConnection.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import static cn.classfun.droidvm.lib.daemon.DaemonHelper.getPortFile;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonHelper.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonHelper.java
index 3668efab..50a8d69b 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonHelper.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/DaemonHelper.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import static android.widget.Toast.LENGTH_LONG;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/ForegroundCallback.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/ForegroundCallback.java
index a210ab14..bc782b65 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/ForegroundCallback.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/ForegroundCallback.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import org.json.JSONObject;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/PendingRequest.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/PendingRequest.java
index 768d3eaf..afcd7ef7 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/PendingRequest.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/PendingRequest.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import org.json.JSONObject;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/Protocol.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/Protocol.java
index 5668a2c6..46407334 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/Protocol.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/Protocol.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import static java.nio.ByteOrder.LITTLE_ENDIAN;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/RequestContext.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/RequestContext.java
index a8f89320..497f8d9f 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/RequestContext.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/RequestContext.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import android.util.Log;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/daemon/VMEventHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/daemon/VMEventHandler.java
index da8923c4..19f32545 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/daemon/VMEventHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/daemon/VMEventHandler.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.daemon;
import static android.content.Context.MODE_PRIVATE;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/CrosvmExit.java b/app/src/main/java/cn/classfun/droidvm/lib/data/CrosvmExit.java
index db4920b3..15913e50 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/CrosvmExit.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/CrosvmExit.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
/**
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/HostAudioDevices.java b/app/src/main/java/cn/classfun/droidvm/lib/data/HostAudioDevices.java
new file mode 100644
index 00000000..2d83b2c3
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/HostAudioDevices.java
@@ -0,0 +1,385 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.data;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import android.content.Context;
+import android.media.AudioDeviceInfo;
+import android.media.AudioManager;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import cn.classfun.droidvm.R;
+
+/**
+ * Host audio endpoints, as Android reports them, in a form that survives a reboot.
+ *
+ * {@link AudioDeviceInfo#getId()} is what AAudio wants ({@code AAudioStreamBuilder_setDeviceId},
+ * which is how crosvm's virtio-snd pins a PCM device to one endpoint), but the ids are handed out
+ * per boot and change when something is plugged or paired. So a VM config stores the stable
+ * {@link #keyOf key} instead -- device type plus routing address -- and the backend
+ * {@link #resolve resolves} it to a live id when the VM starts.
+ *
+ * Usable from the daemon as well as the UI: the lookup only needs a Context that can reach
+ * AudioManager, which the daemon's system context can.
+ */
+public final class HostAudioDevices {
+ private static final String TAG = "HostAudioDevices";
+ /** AAUDIO_UNSPECIFIED: let the platform route the stream itself. */
+ public static final int DEVICE_UNSPECIFIED = 0;
+
+ /**
+ * The endpoint that means "whatever the platform would route to", named rather than left
+ * blank.
+ *
+ * An unset field said the same thing until now, and saying it by omission turned out to
+ * be worse in every direction: the config held a device with nothing in it, the command line
+ * carried an entry with no fields, and the option parser has no use for either. It also
+ * cannot be told apart from a field nobody filled in.
+ *
+ * It is shaped like any other key so nothing has to special-case it -- and it appears in
+ * the published device table against id 0, which is `AAUDIO_DEVICE_UNSPECIFIED`, so
+ * resolving it produces the platform's own routing by the ordinary path rather than by an
+ * exception to it. `DEFAULT` is not an AudioDeviceInfo type name, so a real endpoint can
+ * never collide with it.
+ */
+ public static final String SYSTEM_DEFAULT_KEY = "DEFAULT|system default";
+
+ /** One live host endpoint. */
+ public static final class Entry {
+ /** Stable descriptor stored in the VM config; see {@link #keyOf}. */
+ public final String key;
+ /** Human-readable name for the picker. */
+ public final String label;
+ /** Live AudioDeviceInfo id, valid only for this boot. */
+ public final int id;
+
+ Entry(@NonNull String key, @NonNull String label, int id) {
+ this.key = key;
+ this.label = label;
+ this.id = id;
+ }
+ }
+
+ private HostAudioDevices() {
+ }
+
+ /**
+ * Live output ({@code input == false}) or input endpoints, deduplicated by key. Empty when
+ * AudioManager is unreachable -- callers fall back to "platform default" routing.
+ */
+ @NonNull
+ public static List list(@NonNull Context context, boolean input) {
+ var out = new ArrayList();
+ var devices = query(context, input);
+ if (devices == null) return out;
+ for (var device : devices) {
+ // A sink that can't be targeted is noise in the picker (telephony, the guest's own
+ // loopback, ...); AAudio can only open real endpoints anyway.
+ if (!isSelectable(device, input)) continue;
+ var key = keyOf(device);
+ boolean dup = false;
+ for (var seen : out)
+ if (seen.key.equals(key)) dup = true;
+ if (dup) continue;
+ out.add(new Entry(key, labelOf(context, device), device.getId()));
+ }
+ return out;
+ }
+
+ /**
+ * The same endpoints as {@link #list}, as {@code id -> key} pairs and nothing else.
+ *
+ * Separate from {@code list} because that one builds a label for the picker, and a label
+ * needs the app's string resources. The daemon's context has none -- asking it for one throws
+ * {@code Resources$NotFoundException} -- and it has no use for a label anyway: it is
+ * publishing the endpoints for crosvm to match against, not showing them to anyone.
+ */
+ @NonNull
+ public static List idsAndKeys(@NonNull Context context, boolean input,
+ @NonNull List keysOut) {
+ var ids = new ArrayList();
+ var devices = query(context, input);
+ if (devices == null) return ids;
+ for (var device : devices) {
+ if (!isSelectable(device, input)) continue;
+ var key = keyOf(device);
+ if (keysOut.contains(key)) continue;
+ keysOut.add(key);
+ ids.add(new int[] {
+ device.getId(), soleValue(device.getSampleRates()),
+ soleValue(device.getChannelCounts()), kindOf(device, input)
+ });
+ }
+ return ids;
+ }
+
+ /**
+ * The one value in a capability list, or 0 when there is more than one.
+ *
+ * These lists say what an endpoint will accept, not what it runs at, and the two are only
+ * the same thing when there is a single entry. Picking a favourite out of several would be a
+ * guess, and a guessed hint is worse than none: the guest treats a hint as the format to
+ * default to, and would then default to something the platform converts. An empty list means
+ * the platform declined to say, which is the same answer.
+ */
+ private static int soleValue(int[] values) {
+ return values != null && values.length == 1 ? values[0] : 0;
+ }
+
+ /**
+ * What kind of thing the endpoint is, in the numbering the guest driver uses: 1 speaker,
+ * 2 headphones, 3 headset, 4 line out, 5 digital, 6 microphone, 7 telephony.
+ *
+ * This is what decides the name and icon Windows shows beside the endpoint, so an
+ * approximate answer is still much better than none.
+ */
+ public static int kindOf(@NonNull AudioDeviceInfo device, boolean input) {
+ switch (device.getType()) {
+ case AudioDeviceInfo.TYPE_TELEPHONY:
+ return 7;
+ case AudioDeviceInfo.TYPE_WIRED_HEADPHONES:
+ return 2;
+ case AudioDeviceInfo.TYPE_WIRED_HEADSET:
+ case AudioDeviceInfo.TYPE_USB_HEADSET:
+ case AudioDeviceInfo.TYPE_BLUETOOTH_SCO:
+ case AudioDeviceInfo.TYPE_BLE_HEADSET:
+ return 3;
+ case AudioDeviceInfo.TYPE_LINE_ANALOG:
+ case AudioDeviceInfo.TYPE_AUX_LINE:
+ return 4;
+ case AudioDeviceInfo.TYPE_HDMI:
+ case AudioDeviceInfo.TYPE_HDMI_ARC:
+ case AudioDeviceInfo.TYPE_LINE_DIGITAL:
+ case AudioDeviceInfo.TYPE_USB_DEVICE:
+ case AudioDeviceInfo.TYPE_USB_ACCESSORY:
+ case AudioDeviceInfo.TYPE_BLUETOOTH_A2DP:
+ case AudioDeviceInfo.TYPE_BLE_SPEAKER:
+ return 5;
+ default:
+ // Everything left is a built-in transducer of one kind or the other, and which
+ // one is decided by the direction rather than by the type.
+ return input ? 6 : 1;
+ }
+ }
+
+ /**
+ * Live AudioDeviceInfo id for a stored key, or {@link #DEVICE_UNSPECIFIED} when the key is
+ * empty (follow the platform) or names a device that is not currently present.
+ */
+ public static int resolve(@NonNull Context context, boolean input, @Nullable String key) {
+ // "" is what older configs stored for the same thing.
+ if (key == null || key.isEmpty() || SYSTEM_DEFAULT_KEY.equals(key)) {
+ return DEVICE_UNSPECIFIED;
+ }
+ var devices = query(context, input);
+ if (devices == null) return DEVICE_UNSPECIFIED;
+ for (var device : devices)
+ if (keyOf(device).equals(key)) return device.getId();
+ Log.w(TAG, fmt("host audio device %s is not present; falling back to default routing", key));
+ return DEVICE_UNSPECIFIED;
+ }
+
+ /**
+ * Separates the endpoint's name from what the stream is for.
+ *
+ * An address already contains most of the punctuation worth choosing: a Bluetooth address
+ * is a MAC with colons, a USB one looks like {@code card=1;device=0}. So the separator has to
+ * be something none of them use.
+ */
+ public static final char ATTR_SEPARATOR = '#';
+
+ /** The part of a stored key that names the endpoint, without what it is to be used for. */
+ @NonNull
+ public static String deviceOf(@NonNull String key) {
+ int at = key.indexOf(ATTR_SEPARATOR);
+ return at < 0 ? key : key.substring(0, at);
+ }
+
+ /** The {@code attr=value,...} part of a stored key, or "" when it carries none. */
+ @NonNull
+ public static String attrsOf(@NonNull String key) {
+ int at = key.indexOf(ATTR_SEPARATOR);
+ return at < 0 ? "" : key.substring(at + 1);
+ }
+
+ /** One attribute out of the {@code attr=value,...} part, or "" when it is not set. */
+ @NonNull
+ public static String attrOf(@NonNull String key, @NonNull String name) {
+ for (var pair : attrsOf(key).split(",")) {
+ int eq = pair.indexOf('=');
+ if (eq > 0 && pair.substring(0, eq).trim().equals(name)) {
+ return pair.substring(eq + 1).trim();
+ }
+ }
+ return "";
+ }
+
+ /** Rebuilds a key from an endpoint and its attributes; empty attributes are left out. */
+ @NonNull
+ public static String withAttrs(@NonNull String device, @NonNull List names,
+ @NonNull List values) {
+ var parts = new ArrayList();
+ for (int i = 0; i < names.size() && i < values.size(); i++) {
+ if (!values.get(i).isEmpty()) {
+ parts.add(fmt("%s=%s", names.get(i), values.get(i)));
+ }
+ }
+ return parts.isEmpty() ? device : device + ATTR_SEPARATOR + String.join(",", parts);
+ }
+
+ /**
+ * Stable descriptor for one endpoint: {@code "|"}. The type name (not its
+ * numeric constant) keeps the config readable, and the address separates one paired headset
+ * or USB card from another of the same type.
+ */
+ @NonNull
+ public static String keyOf(@NonNull AudioDeviceInfo device) {
+ var address = "";
+ try {
+ address = device.getAddress();
+ } catch (Throwable ignored) {
+ // getAddress() is @SystemApi-adjacent on some builds; the type alone still works
+ }
+ return fmt("%s|%s", typeName(device.getType()), address == null ? "" : address);
+ }
+
+ /** Localized type name, with the product name or address appended when it disambiguates. */
+ @NonNull
+ public static String labelOf(@NonNull Context context, @NonNull AudioDeviceInfo device) {
+ var name = typeLabel(context, device.getType());
+ var product = String.valueOf(device.getProductName()).trim();
+ var address = "";
+ try {
+ address = device.getAddress();
+ } catch (Throwable ignored) {
+ }
+ if (address != null && !address.isEmpty())
+ return fmt("%s (%s)", name, address);
+ if (!product.isEmpty() && !product.equalsIgnoreCase(name))
+ return fmt("%s (%s)", name, product);
+ return name;
+ }
+
+ @Nullable
+ private static AudioDeviceInfo[] query(@NonNull Context context, boolean input) {
+ try {
+ var am = context.getSystemService(AudioManager.class);
+ if (am == null) {
+ Log.w(TAG, "AudioManager unavailable");
+ return null;
+ }
+ return am.getDevices(input
+ ? AudioManager.GET_DEVICES_INPUTS
+ : AudioManager.GET_DEVICES_OUTPUTS);
+ } catch (Throwable t) {
+ Log.w(TAG, "failed to enumerate host audio devices", t);
+ return null;
+ }
+ }
+
+ /**
+ * The echo reference: the output mix, fed back so a capture path can subtract it. Android
+ * exposes it in the device list but only opens it for system callers, so an endpoint pinned
+ * to it appears in the guest and never produces a sample -- measured: PREPARE comes back
+ * VIRTIO_SND_S_IO_ERR, "Failed to open stream".
+ *
+ * By number because there is no public constant for it -- the SDK's list goes 25, 26, 27,
+ * 29 -- and a name that does not exist cannot be compiled against.
+ */
+ private static final int TYPE_ECHO_REFERENCE = 28;
+
+ /** Endpoints that make no sense as a VM's speaker or microphone. */
+ private static boolean isSelectable(@NonNull AudioDeviceInfo device, boolean input) {
+ switch (device.getType()) {
+ case TYPE_ECHO_REFERENCE:
+ case AudioDeviceInfo.TYPE_TELEPHONY:
+ case AudioDeviceInfo.TYPE_REMOTE_SUBMIX:
+ case AudioDeviceInfo.TYPE_FM:
+ case AudioDeviceInfo.TYPE_FM_TUNER:
+ case AudioDeviceInfo.TYPE_TV_TUNER:
+ return false;
+ default:
+ return input ? device.isSource() : device.isSink();
+ }
+ }
+
+ /** Stable, config-visible name for an AudioDeviceInfo type constant. */
+ @NonNull
+ private static String typeName(int type) {
+ switch (type) {
+ case AudioDeviceInfo.TYPE_BUILTIN_EARPIECE: return "BUILTIN_EARPIECE";
+ case AudioDeviceInfo.TYPE_BUILTIN_SPEAKER: return "BUILTIN_SPEAKER";
+ case AudioDeviceInfo.TYPE_BUILTIN_SPEAKER_SAFE: return "BUILTIN_SPEAKER_SAFE";
+ case AudioDeviceInfo.TYPE_WIRED_HEADSET: return "WIRED_HEADSET";
+ case AudioDeviceInfo.TYPE_WIRED_HEADPHONES: return "WIRED_HEADPHONES";
+ case AudioDeviceInfo.TYPE_LINE_ANALOG: return "LINE_ANALOG";
+ case AudioDeviceInfo.TYPE_LINE_DIGITAL: return "LINE_DIGITAL";
+ case AudioDeviceInfo.TYPE_BLUETOOTH_SCO: return "BLUETOOTH_SCO";
+ case AudioDeviceInfo.TYPE_BLUETOOTH_A2DP: return "BLUETOOTH_A2DP";
+ case AudioDeviceInfo.TYPE_BLE_HEADSET: return "BLE_HEADSET";
+ case AudioDeviceInfo.TYPE_BLE_SPEAKER: return "BLE_SPEAKER";
+ case AudioDeviceInfo.TYPE_HDMI: return "HDMI";
+ case AudioDeviceInfo.TYPE_HDMI_ARC: return "HDMI_ARC";
+ case AudioDeviceInfo.TYPE_USB_DEVICE: return "USB_DEVICE";
+ case AudioDeviceInfo.TYPE_USB_ACCESSORY: return "USB_ACCESSORY";
+ case AudioDeviceInfo.TYPE_USB_HEADSET: return "USB_HEADSET";
+ case AudioDeviceInfo.TYPE_DOCK: return "DOCK";
+ case AudioDeviceInfo.TYPE_AUX_LINE: return "AUX_LINE";
+ case AudioDeviceInfo.TYPE_IP: return "IP";
+ case AudioDeviceInfo.TYPE_BUS: return "BUS";
+ case AudioDeviceInfo.TYPE_BUILTIN_MIC: return "BUILTIN_MIC";
+ case AudioDeviceInfo.TYPE_REMOTE_SUBMIX: return "REMOTE_SUBMIX";
+ case AudioDeviceInfo.TYPE_TELEPHONY: return "TELEPHONY";
+ case AudioDeviceInfo.TYPE_FM: return "FM";
+ case AudioDeviceInfo.TYPE_FM_TUNER: return "FM_TUNER";
+ case AudioDeviceInfo.TYPE_TV_TUNER: return "TV_TUNER";
+ default: return fmt("TYPE_%d", type);
+ }
+ }
+
+ /** Localized name for the picker; unlisted types fall back to the stable name. */
+ @NonNull
+ private static String typeLabel(@NonNull Context context, int type) {
+ switch (type) {
+ case AudioDeviceInfo.TYPE_BUILTIN_EARPIECE:
+ return context.getString(R.string.audio_device_builtin_earpiece);
+ case AudioDeviceInfo.TYPE_BUILTIN_SPEAKER:
+ case AudioDeviceInfo.TYPE_BUILTIN_SPEAKER_SAFE:
+ return context.getString(R.string.audio_device_builtin_speaker);
+ case AudioDeviceInfo.TYPE_WIRED_HEADSET:
+ return context.getString(R.string.audio_device_wired_headset);
+ case AudioDeviceInfo.TYPE_WIRED_HEADPHONES:
+ return context.getString(R.string.audio_device_wired_headphones);
+ case AudioDeviceInfo.TYPE_BLUETOOTH_SCO:
+ return context.getString(R.string.audio_device_bluetooth_sco);
+ case AudioDeviceInfo.TYPE_BLUETOOTH_A2DP:
+ case AudioDeviceInfo.TYPE_BLE_HEADSET:
+ case AudioDeviceInfo.TYPE_BLE_SPEAKER:
+ return context.getString(R.string.audio_device_bluetooth);
+ case AudioDeviceInfo.TYPE_USB_DEVICE:
+ case AudioDeviceInfo.TYPE_USB_ACCESSORY:
+ case AudioDeviceInfo.TYPE_USB_HEADSET:
+ return context.getString(R.string.audio_device_usb);
+ case AudioDeviceInfo.TYPE_HDMI:
+ case AudioDeviceInfo.TYPE_HDMI_ARC:
+ return context.getString(R.string.audio_device_hdmi);
+ case AudioDeviceInfo.TYPE_DOCK:
+ case AudioDeviceInfo.TYPE_AUX_LINE:
+ case AudioDeviceInfo.TYPE_LINE_ANALOG:
+ case AudioDeviceInfo.TYPE_LINE_DIGITAL:
+ return context.getString(R.string.audio_device_line);
+ case AudioDeviceInfo.TYPE_BUILTIN_MIC:
+ return context.getString(R.string.audio_device_builtin_mic);
+ default:
+ return typeName(type);
+ }
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/HostCameraDevices.java b/app/src/main/java/cn/classfun/droidvm/lib/data/HostCameraDevices.java
new file mode 100644
index 00000000..6cbb68f3
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/HostCameraDevices.java
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.data;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import android.content.Context;
+import android.hardware.camera2.CameraCharacteristics;
+import android.hardware.camera2.CameraManager;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import cn.classfun.droidvm.R;
+
+/**
+ * The host cameras a camera peripheral can be pinned to.
+ *
+ * Unlike {@link HostAudioDevices}, the key stored in the VM config is the platform's own camera
+ * id, because that one is already stable: AudioDeviceInfo ids are handed out per boot, camera ids
+ * are a property of the device. The label is kept alongside it only so a row can still name a
+ * camera the current phone does not have -- a config copied between phones, or an external USB
+ * camera that is unplugged.
+ *
+ * Enumeration needs no CAMERA permission (the platform lets any uid read characteristics;
+ * measured on device), so the picker can be populated before the grant is asked for. Opening one
+ * does need it, and needs the uid to be foreground besides -- see {@code CameraPermission} and
+ * {@code PeripheralType.needsForegroundService}.
+ */
+public final class HostCameraDevices {
+ private static final String TAG = "HostCameraDevices";
+
+ /** "let the host pick", stored when no particular camera was chosen. */
+ public static final String DEFAULT_KEY = "";
+
+ public static final class Entry {
+ /** Platform camera id, stored in the VM config. */
+ public final String key;
+ /** Human-readable name for the picker. */
+ public final String label;
+ /** {@link CameraCharacteristics#LENS_FACING_FRONT} and friends, -1 when unknown. */
+ public final int facing;
+
+ Entry(@NonNull String key, @NonNull String label, int facing) {
+ this.key = key;
+ this.label = label;
+ this.facing = facing;
+ }
+ }
+
+ private HostCameraDevices() {
+ }
+
+ /** Every camera the platform reports, in its own order. Empty when CameraManager is
+ * unreachable, which the picker shows as "no camera on this host". */
+ @NonNull
+ public static List list(@NonNull Context context) {
+ var out = new ArrayList();
+ var manager = context.getSystemService(CameraManager.class);
+ if (manager == null) return out;
+ try {
+ for (var id : manager.getCameraIdList()) {
+ int facing = -1;
+ try {
+ var facingValue = manager.getCameraCharacteristics(id)
+ .get(CameraCharacteristics.LENS_FACING);
+ if (facingValue != null) facing = facingValue;
+ } catch (Exception e) {
+ // A camera the platform lists but will not describe is usually one this uid
+ // may not touch. Keep it in the list under its id rather than dropping it:
+ // the guest may still be able to open it, and a missing row looks like a bug.
+ Log.w(TAG, fmt("characteristics for camera %s unavailable", id), e);
+ }
+ out.add(new Entry(id, labelFor(context, id, facing), facing));
+ }
+ } catch (Exception e) {
+ Log.w(TAG, "camera enumeration failed", e);
+ }
+ return out;
+ }
+
+ /** The label to show for a stored key, falling back to the stored label for a camera this
+ * host does not have. */
+ @NonNull
+ public static String labelOf(@NonNull Context context, @Nullable String key,
+ @NonNull String storedLabel) {
+ if (key == null || key.isEmpty()) return context.getString(R.string.host_camera_default);
+ for (var entry : list(context)) {
+ if (entry.key.equals(key)) return entry.label;
+ }
+ return storedLabel.isEmpty() ? key : storedLabel;
+ }
+
+ @NonNull
+ private static String labelFor(@NonNull Context context, @NonNull String id, int facing) {
+ int nameId;
+ switch (facing) {
+ case CameraCharacteristics.LENS_FACING_FRONT:
+ nameId = R.string.host_camera_front;
+ break;
+ case CameraCharacteristics.LENS_FACING_BACK:
+ nameId = R.string.host_camera_back;
+ break;
+ case CameraCharacteristics.LENS_FACING_EXTERNAL:
+ nameId = R.string.host_camera_external;
+ break;
+ default:
+ return context.getString(R.string.host_camera_unknown, id);
+ }
+ return context.getString(nameId, id);
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/HostKernel.java b/app/src/main/java/cn/classfun/droidvm/lib/data/HostKernel.java
new file mode 100644
index 00000000..44659812
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/HostKernel.java
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.data;
+
+import static cn.classfun.droidvm.lib.utils.RunUtils.runList;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import java.util.regex.Pattern;
+
+/**
+ * Which kernel this phone is running, to the major.minor that behaviour actually turns on.
+ *
+ * The GKI series is the unit several things here are decided by, because it is the unit the
+ * vendor branches are cut on: a Gunyah resource manager, a CMA redirect, a driver's page-list
+ * allocation all behave one way on 6.1 and another on 6.6. The patch level below it never matters
+ * to any of them, so it is dropped rather than compared.
+ *
+ * Matched as a whole token and not by prefix. A {@code startsWith("6.1")} says yes to a 6.12
+ * kernel, which is a different series with the opposite behaviour in at least one of the places
+ * this is asked -- the same trap {@code KernelModuleManager} documents for its KMI directories.
+ *
+ * Runs {@code uname}, so not on the main thread. Cached for the life of the process; the kernel
+ * does not change under a running app.
+ */
+public final class HostKernel {
+ private static final Pattern MAJOR_MINOR = Pattern.compile("^(\\d+\\.\\d+)");
+ /** The 6.1 GKI. Named because several rules key off it and a bare "6.1" reads as nothing. */
+ public static final String GKI_6_1 = "6.1";
+
+ @Nullable
+ private static volatile String cached;
+
+ private HostKernel() {
+ }
+
+ /**
+ * The running kernel's {@code major.minor}, or null when {@code uname} could not be read.
+ *
+ * Null is "we do not know", and every caller has to treat it as such rather than as "not
+ * that version": the rules built on this are about a kernel that cannot do something, and
+ * guessing wrong in that direction turns a warning into a VM that does not start.
+ */
+ @Nullable
+ public static String majorMinor() {
+ var known = cached;
+ if (known != null) return known;
+ String release;
+ try {
+ release = runList("uname", "-r").getOutString().trim();
+ } catch (Exception e) {
+ return null;
+ }
+ var parsed = majorMinorOf(release);
+ cached = parsed;
+ return parsed;
+ }
+
+ /** {@link #majorMinor} for a {@code uname -r} string already in hand. Pure. */
+ @Nullable
+ public static String majorMinorOf(@Nullable String unameRelease) {
+ if (unameRelease == null) return null;
+ var m = MAJOR_MINOR.matcher(unameRelease.trim());
+ return m.find() ? m.group(1) : null;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/Images.java b/app/src/main/java/cn/classfun/droidvm/lib/data/Images.java
index 29985ee4..d5c84de1 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/Images.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/Images.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
import static android.os.Build.SUPPORTED_ABIS;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/Language.java b/app/src/main/java/cn/classfun/droidvm/lib/data/Language.java
index 1305c2a6..bd62411a 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/Language.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/Language.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
import static cn.classfun.droidvm.lib.utils.AssetUtils.loadYAMLFromAssets;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/License.java b/app/src/main/java/cn/classfun/droidvm/lib/data/License.java
index 51726f2a..2bae82c7 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/License.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/License.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
import static cn.classfun.droidvm.lib.utils.AssetUtils.loadYAMLFromAssets;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/QcomChipName.java b/app/src/main/java/cn/classfun/droidvm/lib/data/QcomChipName.java
index 851f814e..13549039 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/QcomChipName.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/QcomChipName.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
import static cn.classfun.droidvm.lib.utils.RunUtils.runListQuiet;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/QcomGunyahSupports.java b/app/src/main/java/cn/classfun/droidvm/lib/data/QcomGunyahSupports.java
index e1a5fff3..f15f0661 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/QcomGunyahSupports.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/QcomGunyahSupports.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
import static cn.classfun.droidvm.lib.utils.AssetUtils.loadYAMLFromAssets;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/Repos.java b/app/src/main/java/cn/classfun/droidvm/lib/data/Repos.java
index bf7577f8..c31177db 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/data/Repos.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/Repos.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.data;
import static java.util.Objects.requireNonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/data/SocIdentity.java b/app/src/main/java/cn/classfun/droidvm/lib/data/SocIdentity.java
new file mode 100644
index 00000000..7d7d5c82
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/data/SocIdentity.java
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.data;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import static cn.classfun.droidvm.lib.utils.RunUtils.runListQuiet;
+
+import android.os.Build;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+
+import java.util.Locale;
+
+/**
+ * Who made this device's SoC, as a stable token, plus its model string.
+ *
+ * Used to decide which host kernel modules even apply here: a Gunyah module is meaningless on a
+ * MediaTek phone, and a future MediaTek module would be meaningless on a Snapdragon one. The token
+ * is the vocabulary the module match rules are written against, so it must stay stable ({@code
+ * qualcomm}, {@code mediatek}, {@code google}, {@code samsung}, {@code unisoc}, {@code hisilicon},
+ * or {@code unknown}) even as the detection below grows more fallbacks.
+ *
+ *
Detection starts with the framework's own answer, which needs no shell and no root, and only
+ * then falls back to properties and {@code /proc/cpuinfo} -- vendors do leave {@code
+ * ro.soc.manufacturer} unset. Results are cached: an SoC does not change under a running process.
+ */
+public final class SocIdentity {
+ private static final String TAG = "SocIdentity";
+
+ public static final String QUALCOMM = "qualcomm";
+ public static final String MEDIATEK = "mediatek";
+ public static final String GOOGLE = "google";
+ public static final String SAMSUNG = "samsung";
+ public static final String UNISOC = "unisoc";
+ public static final String HISILICON = "hisilicon";
+ public static final String UNKNOWN = "unknown";
+
+ private static String vendor;
+ private static String model;
+
+ private SocIdentity() {
+ }
+
+ /** Vendor token for this device, never null. May run a shell: call off the main thread. */
+ @NonNull
+ public static synchronized String vendor() {
+ if (vendor == null) {
+ vendor = detectVendor();
+ Log.i(TAG, fmt("SoC vendor: %s (model %s)", vendor, model()));
+ }
+ return vendor;
+ }
+
+ /** Raw SoC model (e.g. "SM8650", "MT6989", "gs201"), or "" when nothing reports one. */
+ @NonNull
+ public static synchronized String model() {
+ if (model == null) {
+ var m = QcomChipName.getCurrentSoC(); // falls back to Build.SOC_MODEL
+ model = m == null ? "" : m.trim();
+ }
+ return model;
+ }
+
+ @NonNull
+ private static String detectVendor() {
+ var fromBuild = fromName(Build.SOC_MANUFACTURER);
+ if (!UNKNOWN.equals(fromBuild)) return fromBuild;
+
+ var fromProp = fromName(prop("ro.soc.manufacturer"));
+ if (!UNKNOWN.equals(fromProp)) return fromProp;
+
+ // QTI-only property: its mere presence identifies the vendor.
+ if (!prop("ro.vendor.qti.soc_model").isEmpty()) return QUALCOMM;
+
+ var hw = prop("ro.hardware").toLowerCase(Locale.ROOT);
+ if (hw.equals("qcom") || hw.startsWith("qcom")) return QUALCOMM;
+ if (hw.startsWith("mt")) return MEDIATEK;
+
+ var fromCpuinfo = fromName(hardwareLine());
+ if (!UNKNOWN.equals(fromCpuinfo)) return fromCpuinfo;
+
+ // Last resort: the model string's own family prefix.
+ var m = model().toUpperCase(Locale.ROOT);
+ if (m.matches("^(SM|SDM|QCS|QCM|MSM|APQ)\\d.*")) return QUALCOMM;
+ if (m.startsWith("MT")) return MEDIATEK;
+ if (m.startsWith("GS") || m.startsWith("ZUMA")) return GOOGLE;
+ if (m.startsWith("EXYNOS") || m.startsWith("S5E")) return SAMSUNG;
+ return UNKNOWN;
+ }
+
+ /** Map whatever a vendor calls itself onto our token. */
+ @NonNull
+ private static String fromName(String raw) {
+ if (raw == null) return UNKNOWN;
+ var s = raw.trim().toLowerCase(Locale.ROOT);
+ if (s.isEmpty() || s.equals("unknown")) return UNKNOWN;
+ if (s.contains("qualcomm") || s.equals("qti") || s.contains("qti ")) return QUALCOMM;
+ if (s.contains("mediatek") || s.contains("mtk")) return MEDIATEK;
+ if (s.contains("google")) return GOOGLE;
+ if (s.contains("samsung") || s.contains("exynos")) return SAMSUNG;
+ if (s.contains("unisoc") || s.contains("spreadtrum")) return UNISOC;
+ if (s.contains("hisilicon") || s.contains("kirin") || s.contains("huawei"))
+ return HISILICON;
+ return UNKNOWN;
+ }
+
+ @NonNull
+ private static String prop(@NonNull String key) {
+ try {
+ return runListQuiet("getprop", key).getOutString().trim();
+ } catch (Exception e) {
+ return "";
+ }
+ }
+
+ /** The {@code Hardware :} line of /proc/cpuinfo, which often names the vendor outright. */
+ @NonNull
+ private static String hardwareLine() {
+ try {
+ var r = runListQuiet("grep", "-m1", "^Hardware", "/proc/cpuinfo");
+ return r.getOutString().trim();
+ } catch (Exception e) {
+ return "";
+ }
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelper.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelper.java
index 35c61338..aa919645 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelper.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelper.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag;
import android.os.Handler;
@@ -62,6 +65,10 @@ public void onDaemonEvent(@NonNull JSONObject msg) {
var event = data.optString("event");
if (event.equals("exited")) {
vmLogContexts.remove(vmId);
+ // Dropping the context re-arms every once-handler for this vmId's next boot, so
+ // whatever they accumulated under it has to go at the same moment or the next boot
+ // inherits it -- the handlers are singletons, only their state is per VM.
+ for (var handler : handlers) handler.onLogContextReset(vmId);
return;
}
var logs = vmLogContexts.computeIfAbsent(vmId, k -> new LogContext(vmId));
@@ -73,6 +80,9 @@ public void onDaemonEvent(@NonNull JSONObject msg) {
buff.adds(text.getBytes(StandardCharsets.UTF_8));
var full = new String(buff.peekAll(), StandardCharsets.UTF_8);
for (var handler : handlers) {
+ // Before the disabled check, so a handler that reports what the log said keeps
+ // reading it after it has fired; match() below may rely on having been fed first.
+ handler.observe(vmId, stream, full);
if (logs.disabled.contains(handler)) continue;
if (!handler.match(vmId, stream, full)) continue;
Runnable show = () -> vmEventHandler.queueActivityTask(act -> handler.show(act, vmId, vmName));
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelperHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelperHandler.java
index e551bbcc..ab5cb1ab 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelperHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/LogHelperHandler.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag;
import static android.content.Intent.ACTION_VIEW;
@@ -6,8 +9,11 @@
import android.content.DialogInterface.OnClickListener;
import android.content.Intent;
import android.net.Uri;
+import android.text.util.Linkify;
+import android.widget.TextView;
import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
import androidx.annotation.StringRes;
import com.google.android.material.dialog.MaterialAlertDialogBuilder;
@@ -24,6 +30,28 @@ public boolean match(@NonNull UUID vmId, @NonNull String stream, @NonNull String
return false;
}
+ /**
+ * Every line, before {@link #match} and whether or not this handler has already fired.
+ *
+ *
For a handler that has to report what the log said rather than only that it said it:
+ * {@link #isOnce} takes the handler out of the match loop the moment it first matches, so
+ * match() cannot be where anything is gathered -- the lines that arrive during the show delay,
+ * and every line after it, would never be looked at.
+ */
+ public void observe(@NonNull UUID vmId, @NonNull String stream, @NonNull String text) {
+ }
+
+ /**
+ * Called when [vmId]'s log context is dropped, which is when that VM exits.
+ *
+ * Handler instances are process-wide singletons shared by every VM, so anything a handler
+ * accumulates is keyed by vmId and has to be forgotten here: the context takes the
+ * already-fired mark with it, so the next boot of the same VM re-arms this handler and must
+ * not inherit the last boot's findings.
+ */
+ public void onLogContextReset(@NonNull UUID vmId) {
+ }
+
public boolean isOnce() {
return true;
}
@@ -48,14 +76,54 @@ protected static void showDialog(
@StringRes int titleId,
@StringRes int messageId,
Object... args
+ ) {
+ showDialog(ctx, urlId, titleId, ctx.getString(messageId, args), 0, null);
+ }
+
+ /**
+ * The same dialog with the message already built, and one extra action beside OK and the wiki
+ * link. A message that lists what the VM actually did is not one format string, which is why
+ * this takes the text rather than a resource id.
+ *
+ * MaterialAlertDialog's three slots are all spoken for here: positive is OK, neutral is the
+ * wiki URL as everywhere else, so [actionId] takes negative. Pass 0 for no extra action.
+ *
+ * URLs left in the text are made tappable here because nothing else does it: the body is
+ * {@code @android:id/message} styled {@code materialAlertDialogBodyTextStyle}, and material
+ * 1.14.0 sets {@code autoLink} nowhere in the whole AAR, while AppCompat 1.7.0's
+ * AlertController only calls {@code setText} on it -- neither {@code setMovementMethod} nor
+ * {@code Linkify} appears in its bytecode. {@code Linkify.addLinks(TextView, int)} installs
+ * the movement method itself once it has a span to install it for.
+ */
+ protected static void showDialog(
+ @NonNull Context ctx,
+ @StringRes int urlId,
+ @StringRes int titleId,
+ @NonNull CharSequence message,
+ @StringRes int actionId,
+ @Nullable OnClickListener action
) {
var mab = new MaterialAlertDialogBuilder(ctx);
mab.setTitle(titleId);
- mab.setMessage(ctx.getString(messageId, args));
+ mab.setMessage(message);
mab.setPositiveButton(android.R.string.ok, null);
+ if (actionId != 0) mab.setNegativeButton(actionId, action);
var url = ctx.getString(urlId);
OnClickListener cb = (d, w) -> ctx.startActivity(new Intent(ACTION_VIEW, Uri.parse(url)));
if (!url.isEmpty()) mab.setNeutralButton(R.string.log_helper_open_url, cb);
- mab.show();
+ var dialog = mab.show();
+ TextView body = dialog.findViewById(android.R.id.message);
+ if (body == null) return;
+ // A message built from HTML anchors already carries its URLSpans, and Linkify would strip
+ // them while hunting for raw URLs -- so anchors get the movement method only, and plain
+ // text keeps the old raw-URL pass.
+ boolean hasAnchors = message instanceof android.text.Spanned
+ && ((android.text.Spanned) message)
+ .getSpans(0, message.length(), android.text.style.URLSpan.class).length > 0;
+ if (hasAnchors) {
+ body.setMovementMethod(android.text.method.LinkMovementMethod.getInstance());
+ } else {
+ Linkify.addLinks(body, Linkify.WEB_URLS);
+ }
}
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/BadSM8650HostKernelHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/BadSM8650HostKernelHandler.java
index 31f22079..a38248bf 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/BadSM8650HostKernelHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/BadSM8650HostKernelHandler.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag.handler;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/HugePageFaultHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/HugePageFaultHandler.java
index cc69844f..7bc35bed 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/HugePageFaultHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/HugePageFaultHandler.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag.handler;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/OsKernelWithoutRestrictPoolHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/OsKernelWithoutRestrictPoolHandler.java
index 5316f484..0f8655d6 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/OsKernelWithoutRestrictPoolHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/OsKernelWithoutRestrictPoolHandler.java
@@ -1,29 +1,128 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag.handler;
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
import android.content.Context;
+import android.content.Intent;
import androidx.annotation.NonNull;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
import cn.classfun.droidvm.R;
import cn.classfun.droidvm.lib.diag.LogHelperHandler;
+import cn.classfun.droidvm.ui.vm.console.VMConsoleActivity;
+/**
+ * A device could not reach memory the guest lent to the host in a protected VM.
+ *
+ * Two different faults print this same line, which is why the dialog names both: the guest
+ * kernel may have no restricted DMA pool to put the device's buffers in, or the guest driver for
+ * that particular device may not be one of the ported ones and so never allocated from the pool it
+ * does have. The device names are the only thing in the log that separates "the whole VM has no
+ * pool" from "this one driver is wrong", so they are listed rather than summarised away.
+ */
public final class OsKernelWithoutRestrictPoolHandler extends LogHelperHandler {
+ /**
+ * What the log page is prefiltered with -- the marker without the address, since the address
+ * differs per line. {@link #MARKER} is the same text plus the start of the address, which is
+ * what makes a line one of these rather than a mention of the words.
+ */
+ private static final String FILTER = "host access to lent memory region at";
+ private static final String MARKER = fmt("%s 0x", FILTER);
+ /**
+ * The failing device, which crosvm puts before " activate failed" on the same line:
+ * {@code ... virtio_pci_device] pcivu-sound activate failed: failed to get host address: host
+ * access to lent memory region at 0x105600000 (purpose=GuestMemoryRegion) in protected VM}
+ */
+ private static final Pattern DEVICE = Pattern.compile("(\\S+) activate failed");
+ private static final String BULLET = "\u2022 "; // U+2022, escaped to keep this file ASCII
+ private static final String STREAM = "stderr";
+
+ /**
+ * Distinct device names per VM, in the order the log named them. Keyed by vmId because one
+ * instance serves every VM, and emptied by {@link #onLogContextReset}.
+ */
+ private final Map> devices = new ConcurrentHashMap<>();
+
+ @Override
+ public void observe(@NonNull UUID vmId, @NonNull String stream, @NonNull String text) {
+ if (!stream.equals(STREAM) || !text.contains(MARKER)) return;
+ var found = devices.computeIfAbsent(
+ vmId, k -> Collections.synchronizedSet(new LinkedHashSet<>()));
+ for (var line : text.split("\n")) {
+ if (!line.contains(MARKER)) continue;
+ var m = DEVICE.matcher(line);
+ // A matching line that does not name a device goes in as it came: dropping it would
+ // report fewer devices than the log shows, which is the one thing this list is for.
+ found.add(m.find() ? m.group(1) : line.trim());
+ }
+ }
+
@Override
public boolean match(@NonNull UUID vmId, @NonNull String stream, @NonNull String text) {
- return
- stream.equals("stderr") &&
- text.contains("host access to lent memory region at 0x");
+ // observe() has already read this same text; a non-empty list is exactly "a line with the
+ // marker was seen", so the buffer is not scanned a second time.
+ return stream.equals(STREAM) && !namesOf(vmId).isEmpty();
+ }
+
+ @Override
+ public void onLogContextReset(@NonNull UUID vmId) {
+ devices.remove(vmId);
}
@Override
public void show(@NonNull Context ctx, @NonNull UUID vmId, @NonNull String vmName) {
+ var sb = new android.text.SpannableStringBuilder();
+ sb.append(ctx.getString(R.string.log_helper_no_restrict_pool_devices, vmName));
+ for (var device : namesOf(vmId)) sb.append('\n').append(BULLET).append(device);
+ sb.append("\n\n");
+ // The body carries its links as anchors with human labels, so it is HTML in the resource
+ // and spans here; a raw URL would be linkified downstream, but an tag would not.
+ sb.append(android.text.Html.fromHtml(
+ ctx.getString(R.string.log_helper_no_restrict_pool_message),
+ android.text.Html.FROM_HTML_MODE_LEGACY));
showDialog(ctx,
R.string.log_helper_no_restrict_pool_url,
R.string.log_helper_no_restrict_pool_title,
- R.string.log_helper_no_restrict_pool_message,
- vmName
+ sb,
+ R.string.log_helper_open_log,
+ (d, w) -> openLog(ctx, vmId, vmName)
);
}
+
+ /** A snapshot: observe() runs on the daemon's event thread and show() on the main one. */
+ @NonNull
+ private List namesOf(@NonNull UUID vmId) {
+ var found = devices.get(vmId);
+ if (found == null) return List.of();
+ synchronized (found) {
+ return new ArrayList<>(found);
+ }
+ }
+
+ /**
+ * The log page, on stderr, prefiltered to the lines the list above was read from -- the point
+ * of opening it here is to see those lines, not to land in the whole boot log.
+ */
+ private static void openLog(@NonNull Context ctx, @NonNull UUID vmId, @NonNull String vmName) {
+ var intent = new Intent(ctx, VMConsoleActivity.class);
+ intent.putExtra(VMConsoleActivity.EXTRA_VM_ID, vmId.toString());
+ intent.putExtra(VMConsoleActivity.EXTRA_VM_NAME, vmName);
+ intent.putExtra(VMConsoleActivity.EXTRA_STREAM, STREAM);
+ intent.putExtra(VMConsoleActivity.EXTRA_LOGS, true);
+ intent.putExtra(VMConsoleActivity.EXTRA_FILTER, FILTER);
+ ctx.startActivity(intent);
+ }
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedGunyahVersionHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedGunyahVersionHandler.java
index 8c55a0d6..72e1147c 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedGunyahVersionHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedGunyahVersionHandler.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag.handler;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedSandboxHandler.java b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedSandboxHandler.java
index 8a870273..85c64734 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedSandboxHandler.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/diag/handler/UnsupportedSandboxHandler.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.diag.handler;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadManager.java b/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadManager.java
index 0d2ff6b2..3758fd0b 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadManager.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadManager.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.download;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
@@ -60,6 +63,7 @@ public final class DiskDownloadManager {
private static final AtomicLong NEXT_ID = new AtomicLong(1);
private static final ConcurrentHashMap JOBS = new ConcurrentHashMap<>();
+ private static final java.util.Set RETAINED = ConcurrentHashMap.newKeySet();
private DiskDownloadManager() {
}
@@ -124,7 +128,9 @@ public static final class Result {
/**
* Registers a download and returns its id. Drops any earlier job for the same
- * destination and purges finished jobs. The caller then starts
+ * destination and purges failed/cancelled jobs. Successful jobs stay available
+ * until their source Activity consumes them, so a completed background download
+ * can still continue its import workflow. The caller then starts
* {@link DiskDownloadService} for this id, which runs the download.
*/
public static long enqueue(
@@ -185,6 +191,31 @@ public static Result getResult(long id) {
return new Result(d.folder, d.name, d.diskId);
}
+ /**
+ * Keeps a successful background result until its source screen has resumed and
+ * consumed it. This is opt-in so ordinary one-shot download screens retain
+ * their existing cleanup behaviour.
+ */
+ public static void retainUntilReleased(long id) {
+ if (JOBS.containsKey(id)) RETAINED.add(id);
+ }
+
+ /** Atomically consumes a successful result so two Activity instances cannot process it twice. */
+ @Nullable
+ public static Result consumeResult(long id) {
+ var d = JOBS.get(id);
+ if (d == null || d.state != STATE_SUCCESS || !JOBS.remove(id, d)) return null;
+ RETAINED.remove(id);
+ return new Result(d.folder, d.name, d.diskId);
+ }
+
+ /** Releases a terminal job after its source Activity has consumed the result. */
+ public static void release(long id) {
+ RETAINED.remove(id);
+ var d = JOBS.get(id);
+ if (d != null && (d.cancelled.get() || isTerminal(id))) JOBS.remove(id, d);
+ }
+
/** Ids of all known (in-flight or just-finished) downloads. */
@NonNull
public static long[] activeIds() {
@@ -441,15 +472,19 @@ private static void copyFile(File src, File dest) throws IOException {
}
}
- /** Drops finished jobs and any earlier job aimed at the same destination. */
+ /** Drops failed/cancelled jobs and any earlier job aimed at the same destination. */
private static void purgeFinishedAndDuplicates(String folder, String name) {
for (var e : JOBS.entrySet()) {
var d = e.getValue();
boolean duplicate = d.folder.equals(folder) && d.name.equals(name);
- boolean finished = d.state == STATE_SUCCESS
+ boolean terminal = d.state == STATE_SUCCESS
|| d.state == STATE_FAILED || d.state == STATE_CANCELLED;
+ boolean finished = terminal && !RETAINED.contains(d.id);
if (duplicate) d.cancelled.set(true);
- if (duplicate || finished) JOBS.remove(e.getKey());
+ if (duplicate || finished) {
+ JOBS.remove(e.getKey());
+ RETAINED.remove(e.getKey());
+ }
}
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadService.java b/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadService.java
index 6ea6a702..494c8c20 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadService.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/download/DiskDownloadService.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.download;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/hugepage/PoolPreflight.java b/app/src/main/java/cn/classfun/droidvm/lib/hugepage/PoolPreflight.java
new file mode 100644
index 00000000..0289d5c2
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/hugepage/PoolPreflight.java
@@ -0,0 +1,260 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.hugepage;
+
+import static cn.classfun.droidvm.lib.utils.FileUtils.shellCheckExists;
+import static cn.classfun.droidvm.lib.utils.FileUtils.shellReadFile;
+import static cn.classfun.droidvm.lib.utils.RunUtils.run;
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+import static cn.classfun.droidvm.lib.utils.StringUtils.pathJoin;
+import static cn.classfun.droidvm.lib.store.enums.Enums.optEnum;
+
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+
+import java.util.function.BooleanSupplier;
+
+import cn.classfun.droidvm.lib.store.base.DataItem;
+import cn.classfun.droidvm.lib.store.vm.GuestPoolSizing;
+import cn.classfun.droidvm.lib.store.vm.VMBackend;
+import cn.classfun.droidvm.lib.store.vm.VMHypervisor;
+
+/**
+ * Is the huge-page reserve able to back this VM right now?
+ *
+ * Every region a Gunyah VM gets at boot -- guest RAM, the GPU pools, swiotlb -- is served
+ * from {@code gh_hugepage_reserve} as isolated 2 MB folios, which the hypervisor can take
+ * without moving anything. When the pool is short the shortfall comes from ordinary movable
+ * memory instead, and that memory cannot be handed over without migrating it out of CMA first.
+ * On a phone with nothing spare that migration is where things end badly: measured outcomes were
+ * a multi-minute whole-host stall that ended with the kernel OOM-killing crosvm, and a
+ * {@code qcom_scm: Assign memory protection call failed -22} that reset the device.
+ *
+ *
The pool refills within a couple of seconds of a VM exiting, so the common way to hit this
+ * is simply starting the next VM too soon. That makes the fix cheap: look before starting, and
+ * either wait (background starts) or say so (foreground starts).
+ *
+ *
Asked only of the VMs it is about. A VM on any other hypervisor is not served from the reserve
+ * and cannot be delayed by it, so {@link #appliesTo} answers no before anything is read and every
+ * check on such a VM is free and silent.
+ *
+ *
Everything here is context-free and does shell I/O -- call it off the UI thread.
+ */
+public final class PoolPreflight {
+ private static final String TAG = "PoolPreflight";
+ private static final String SYSFS_PARAMS = "/sys/module/gh_hugepage_reserve/parameters";
+
+ /** The reserve deals in 2 MB pages; every count here is in those. */
+ public static final long PAGE_MB = 2;
+
+ /**
+ * The waiting policy for a start nobody is watching -- auto-start at daemon boot, and the
+ * relaunch that follows a guest reboot. Ten looks a second apart, asking the module to fetch
+ * more half way through, and start anyway at the end. See {@link #waitForPool}.
+ */
+ public static final int BACKGROUND_ATTEMPTS = 10;
+ public static final long BACKGROUND_INTERVAL_MS = 1000;
+ public static final int BACKGROUND_ACQUIRE_AT = 5;
+
+ /**
+ * The same policy, with more room, for the relaunch after a guest reboot. That start races
+ * the reserve taking back the memory the same VM has only just released, and measured on
+ * device that takes about ten seconds (drm2kgsl: enough again at ~9 s, full at ~16 s; venus:
+ * enough at ~9 s, full at ~13 s) -- too close to the ten of a plain background start to leave
+ * it there. Twice the measured worst case, and still bounded.
+ */
+ public static final int RELAUNCH_ATTEMPTS = 20;
+
+ private PoolPreflight() {
+ }
+
+ /** What the pool can serve versus what this VM will ask of it. */
+ public static final class Status {
+ /**
+ * This VM draws on the reserve and the module is loaded, so the numbers below mean
+ * something. False is the ordinary answer: see {@link #appliesTo}.
+ */
+ public final boolean applicable;
+ /** {@code pool_avail}: 2 MB pages sitting in the reserve, free. */
+ public final long availPages;
+ /** Estimated 2 MB pages this VM's boot-time regions will take. */
+ public final long neededPages;
+
+ Status(boolean applicable, long availPages, long neededPages) {
+ this.applicable = applicable;
+ this.availPages = availPages;
+ this.neededPages = neededPages;
+ }
+
+ public boolean isEnough() {
+ return !applicable || availPages >= neededPages;
+ }
+
+ public long availMb() {
+ return availPages * PAGE_MB;
+ }
+
+ public long neededMb() {
+ return neededPages * PAGE_MB;
+ }
+
+ public long shortMb() {
+ return Math.max(0, neededPages - availPages) * PAGE_MB;
+ }
+
+ @NonNull
+ @Override
+ public String toString() {
+ return fmt("pool_avail=%d need=%d (%d MB / %d MB)",
+ availPages, neededPages, availMb(), neededMb());
+ }
+ }
+
+ /**
+ * Whether the reserve has anything to do with this VM.
+ *
+ *
Only a Gunyah VM is served from it. That is what the reserve is: isolated folios for the
+ * one hypervisor that takes guest memory away from the host, and the danger it exists to avoid
+ * -- migrating pages out of CMA to hand them over -- is that hypervisor's transfer and nobody
+ * else's. KVM and GenieZone hand over nothing, and a TCG guest is ordinary process memory.
+ * Their VMs pay the reserve no attention, so the reserve must pay them none: a prompt or a wait
+ * for a pool they will not draw on is a delay with no failure behind it.
+ *
+ * The module being loaded is the second half of the question, not the first. It ships for
+ * Qualcomm SoCs alone -- {@code match.json} gates it on {@code soc_vendor}, and the kernel-module
+ * page hides the card everywhere else -- so on most phones the answer is no twice over. Read
+ * here rather than assumed, because a QEMU-on-Gunyah VM on a Qualcomm phone is both.
+ */
+ public static boolean appliesTo(@NonNull DataItem item) {
+ var backend = optEnum(item, "backend", VMBackend.DEFAULT);
+ var configured = optEnum(item, "hypervisor", VMHypervisor.DEFAULT);
+ return VMHypervisor.resolveConfigured(backend, configured) == VMHypervisor.GUNYAH;
+ }
+
+ /** Reads the reserve and sizes this VM against it. Never throws. */
+ @NonNull
+ public static Status check(@NonNull DataItem item) {
+ if (!appliesTo(item))
+ return new Status(false, 0, 0);
+ long avail = readPages("pool_avail", -1);
+ if (avail < 0)
+ return new Status(false, 0, 0);
+ return new Status(true, avail, neededPages(item));
+ }
+
+ /**
+ * The 2 MB pages this VM's boot-time regions will take out of the reserve.
+ *
+ * The memory size plus the guest pool, and nothing else. Everything else the backend passes
+ * is already inside {@code --mem}: crosvm carves the swiotlb and the framebuffer out of it, and
+ * as of the per-pool {@code consume_system_mem} tag so are the three renderer host pools --
+ * whichever of them a route uses, the VM still costs what its memory field says. Only the guest
+ * pool is added on top, because it is video memory the user asked for beside the RAM rather
+ * than out of it - and only when the backend will actually pass one, which
+ * {@link GuestPoolSizing} decides for both sides.
+ *
+ *
Growth grants (the runtime SHARE path) are deliberately not counted -- they happen later,
+ * one blob at a time, and a VM that cannot grow still boots. That is also why the guest pool
+ * contributes its pre-allocation and not its window.
+ */
+ public static long neededPages(@NonNull DataItem item) {
+ long mb = Math.max(item.optLong("memory_mb", 512), 64);
+ // Exactly what the backend will pre-allocate: nothing for a host-visible-RAM VM, and
+ // for gfxstream only with udmabuf. One rule, shared with the command builder.
+ mb += GuestPoolSizing.bootGuestPreallocMb(item);
+ return (mb + PAGE_MB - 1) / PAGE_MB;
+ }
+
+ /**
+ * Waits for the reserve to cover this VM, for background starts (auto-start, and the daemon
+ * re-launching VMs after a reboot) where there is nobody to ask.
+ *
+ *
One second between looks, because a normal refill lands in about two. Half way through
+ * it asks the module to go and get more; that is worth one shot and no more, since a reserve
+ * that cannot be filled will not be filled by asking twice. If the wait runs out we start
+ * anyway: refusing to boot a VM the user asked to auto-start is worse than a boot that may
+ * be slow, and the VMM has its own guard at the point where it actually hands memory over.
+ *
+ * @return true if the pool covered the VM before the attempts ran out
+ */
+ /** {@link #waitForPool} with the shared background policy. */
+ public static boolean waitForPool(@NonNull DataItem item) {
+ return waitForPool(item, BACKGROUND_ATTEMPTS, BACKGROUND_INTERVAL_MS, BACKGROUND_ACQUIRE_AT);
+ }
+
+ /** {@link #waitForPool} for a caller with nothing that would call the wait off. */
+ public static boolean waitForPool(@NonNull DataItem item, int attempts, long sleepMs,
+ int acquireAt) {
+ return waitForPool(item, attempts, sleepMs, acquireAt, () -> false);
+ }
+
+ /**
+ * The same wait, with [abort] read once a second so a caller can call it off.
+ *
+ *
Ten seconds is a long time to be inside when the daemon is going down, and the thing the
+ * wait is for -- a VM that has not started yet -- is exactly what a shutdown no longer wants
+ * started. Read between looks rather than by interrupting the thread, because an interrupt
+ * would also land on whatever the caller does after this returns.
+ */
+ public static boolean waitForPool(@NonNull DataItem item, int attempts, long sleepMs,
+ int acquireAt, @NonNull BooleanSupplier abort) {
+ var status = check(item);
+ if (!status.applicable || status.isEnough())
+ return true;
+ Log.i(TAG, fmt("waiting for the huge-page reserve: %s", status));
+ for (int i = 1; i <= attempts; i++) {
+ if (abort.getAsBoolean()) {
+ Log.i(TAG, fmt("the wait for the reserve was called off after %d attempt(s)", i - 1));
+ return false;
+ }
+ if (i == acquireAt) {
+ Log.i(TAG, fmt("reserve still short at attempt %d; asking it to acquire", i));
+ acquire(2);
+ }
+ try {
+ Thread.sleep(sleepMs);
+ } catch (InterruptedException e) {
+ Thread.currentThread().interrupt();
+ return false;
+ }
+ status = check(item);
+ if (status.isEnough()) {
+ Log.i(TAG, fmt("reserve recovered after %d attempt(s): %s", i, status));
+ return true;
+ }
+ }
+ Log.w(TAG, fmt("reserve still short after %d attempt(s): %s -- starting anyway",
+ attempts, status));
+ return false;
+ }
+
+ /**
+ * Asks the module to grow the reserve ({@code acquire=}), falling back to the older
+ * {@code manual_refill} knob. Best-effort: the caller carries on either way.
+ */
+ public static boolean acquire(int mode) {
+ if (writeKnob("acquire", Integer.toString(mode)))
+ return true;
+ return writeKnob("manual_refill", "1");
+ }
+
+ private static boolean writeKnob(@NonNull String knob, @NonNull String value) {
+ var path = pathJoin(SYSFS_PARAMS, knob);
+ if (!shellCheckExists(path))
+ return false;
+ return run("echo %s > %s", value, path).isSuccess();
+ }
+
+ private static long readPages(@NonNull String knob, long fallback) {
+ var path = pathJoin(SYSFS_PARAMS, knob);
+ try {
+ if (!shellCheckExists(path))
+ return fallback;
+ return Long.parseLong(shellReadFile(path).trim());
+ } catch (Exception e) {
+ return fallback;
+ }
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/natives/NativeProcess.java b/app/src/main/java/cn/classfun/droidvm/lib/natives/NativeProcess.java
index 9d43a59c..9781a3c8 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/natives/NativeProcess.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/natives/NativeProcess.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.natives;
import static java.lang.Thread.sleep;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/natives/UnixHelper.java b/app/src/main/java/cn/classfun/droidvm/lib/natives/UnixHelper.java
index ce361676..787f0720 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/natives/UnixHelper.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/natives/UnixHelper.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.natives;
import static cn.classfun.droidvm.lib.Constants.DATA_DIR;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/natives/VulkanBlitProbe.java b/app/src/main/java/cn/classfun/droidvm/lib/natives/VulkanBlitProbe.java
new file mode 100644
index 00000000..23ea627d
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/natives/VulkanBlitProbe.java
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.natives;
+
+import androidx.annotation.Nullable;
+
+/**
+ * Probes the platform's stock Vulkan driver for the extensions the native-display GPU blit needs.
+ *
+ * The crosvm display bridge enables a fixed set of device extensions to import the virtio-gpu
+ * scanout dmabuf and blit it into the SurfaceControl buffer; a driver missing them cannot run the
+ * blit and the bridge falls back to a CPU copy. {@link cn.classfun.droidvm.lib.store.vm.GpuBlitProvider#SYSTEM}
+ * points that bridge at the SoC's own driver, so this lets the editor tell the user up front which
+ * extensions (if any) their platform lacks. It is a general capability check -- it inspects the
+ * real driver's extension list, with no per-vendor assumptions.
+ *
+ *
The result is a property of the phone, not of any VM, so it is probed once and cached.
+ */
+public final class VulkanBlitProbe {
+ private static final boolean LOADED;
+
+ static {
+ boolean ok;
+ try {
+ System.loadLibrary("vkprobe");
+ ok = true;
+ } catch (Throwable t) {
+ ok = false;
+ }
+ LOADED = ok;
+ }
+
+ private static boolean probed;
+ @Nullable private static String[] cached;
+
+ private VulkanBlitProbe() {}
+
+ /**
+ * Required blit extensions the system Vulkan driver is missing.
+ *
+ * @return an empty array if a physical device supports all of them (SYSTEM blit is usable);
+ * a non-empty array naming the missing extensions; or {@code null} if the probe could not
+ * run at all (no loader / no device), i.e. capability is unknown.
+ */
+ @Nullable
+ public static synchronized String[] missingBlitExtensions() {
+ if (!probed) {
+ String[] r = null;
+ if (LOADED) {
+ try {
+ r = nativeMissingBlitExtensions();
+ } catch (Throwable t) {
+ r = null;
+ }
+ }
+ cached = r;
+ probed = true;
+ }
+ return cached == null ? null : cached.clone();
+ }
+
+ private static native String[] nativeMissingBlitExtensions();
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/FDSocket.java b/app/src/main/java/cn/classfun/droidvm/lib/network/FDSocket.java
index 731ab374..894617d4 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/FDSocket.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/FDSocket.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import android.os.ParcelFileDescriptor;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/IPAddress.java b/app/src/main/java/cn/classfun/droidvm/lib/network/IPAddress.java
index 283c03be..090e9a99 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/IPAddress.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/IPAddress.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/IPNetwork.java b/app/src/main/java/cn/classfun/droidvm/lib/network/IPNetwork.java
index ad3ac87d..6df9a358 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/IPNetwork.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/IPNetwork.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Address.java b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Address.java
index 90c58aa3..0e05fd4b 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Address.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Address.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Network.java b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Network.java
index e293d266..8f81d1ac 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Network.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv4Network.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Address.java b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Address.java
index 21b6c52c..3fe34f9e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Address.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Address.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import static java.lang.System.arraycopy;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Network.java b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Network.java
index 34b0918f..6d154c00 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Network.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/network/IPv6Network.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.network;
import static cn.classfun.droidvm.lib.network.IPv6Address.MAX_VALUE;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/perf/GamePerfHint.java b/app/src/main/java/cn/classfun/droidvm/lib/perf/GamePerfHint.java
new file mode 100644
index 00000000..0ba6e6d9
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/perf/GamePerfHint.java
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.perf;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import android.app.GameManager;
+import android.app.GameState;
+import android.content.Context;
+import android.os.Build;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+
+/**
+ * Declares a heavy, uninterruptible 3D workload to the platform while a VM display is in the
+ * foreground, so the device's own power policy raises CPU/GPU clocks -- the sanctioned way.
+ *
+ *
Why this exists: the Adreno {@code msm-adreno-tz} governor parks the GPU at its minimum clock
+ * under the bursty, latency-coupled gfxstream render pattern. Measured on an 8 Elite: a guest 3D
+ * workload registers only ~55% GPU busy at 160MHz (of 1100MHz), so the throughput-oriented
+ * governor never ramps up -- the GPU runs ~7x slower than it could, and a guest benchmark scores
+ * ~1800 instead of ~3900. Writing {@code /sys/class/kgsl/kgsl-3d0/devfreq/min_freq} fixes it, but
+ * that needs root and leaves a device-wide clock override that must be restored by hand. The
+ * platform path is a *declaration* instead: {@code android:appCategory="game"} in the manifest
+ * plus the {@link GameState} below, which feeds the OEM's game power profile.
+ *
+ *
Note on ADPF: the finer-grained {@link android.os.PerformanceHintManager} is deliberately not
+ * used here. It only accepts thread ids owned by the caller's uid, but crosvm is spawned by the
+ * root daemon (uid 0) while this code runs in the normal app process, so its threads cannot be
+ * registered. {@code GameState} is a device-level declaration, so the root-owned crosvm process
+ * still benefits from it. (A future option is for crosvm itself to open an ADPF session over its
+ * own render threads and report real frame durations, which is where per-frame accuracy would
+ * come from.)
+ */
+public final class GamePerfHint {
+ private static final String TAG = "GamePerfHint";
+
+ private GamePerfHint() {
+ }
+
+ /** Declares sustained heavy gameplay (a VM display is in the foreground and rendering). */
+ public static void enterGameplay(@NonNull Context context) {
+ setState(context, GameState.MODE_GAMEPLAY_UNINTERRUPTIBLE, "gameplay");
+ }
+
+ /** Clears the declaration when no VM display is in the foreground anymore. */
+ public static void exitGameplay(@NonNull Context context) {
+ setState(context, GameState.MODE_NONE, "none");
+ }
+
+ private static void setState(@NonNull Context context, int mode, @NonNull String what) {
+ // GameState landed in API 33, which is also our minSdk; keep the guard so a lower-API
+ // build (or a stripped OEM image without the service) degrades to a no-op.
+ if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return;
+ try {
+ var manager = context.getSystemService(GameManager.class);
+ if (manager == null) return;
+ manager.setGameState(new GameState(false, mode));
+ Log.i(TAG, fmt("declared game state: %s", what));
+ } catch (Exception e) {
+ // Not fatal: without it we simply run at whatever clocks the governor picks.
+ Log.w(TAG, fmt("failed to declare game state %s", what), e);
+ }
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/perf/SystemGestureGuard.java b/app/src/main/java/cn/classfun/droidvm/lib/perf/SystemGestureGuard.java
new file mode 100644
index 00000000..52db9bce
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/perf/SystemGestureGuard.java
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.perf;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+
+import cn.classfun.droidvm.lib.run.RunContext;
+import cn.classfun.droidvm.lib.run.RunResult;
+import cn.classfun.droidvm.lib.run.root.RootRunContext;
+
+/**
+ * Suppresses OEM full-screen touch gestures while a VM display is in the foreground, so
+ * multi-finger input reaches the guest instead of the host system.
+ *
+ *
Why this exists: ColorOS/OxygenOS intercepts three-finger touches globally -- swipe-down
+ * takes a screenshot, touch-and-hold starts a partial screenshot -- and unlike the navigation
+ * back gesture there is NO public per-app opt-out ({@code setSystemGestureExclusionRects} only
+ * covers screen-edge gestures, and the game-mode declaration in {@link GamePerfHint} does not
+ * suppress it either). A guest desktop, however, has its own three-finger gestures (pinch zoom,
+ * workspace switch), which the host eats before the guest ever sees a pointer event.
+ *
+ *
So: while (and only while) the native display is foreground, the OEM toggles below are
+ * turned off through the root shell, and restored to their previous values on exit. On devices
+ * without these keys (`settings get` prints "null") this is a no-op, so calling it
+ * unconditionally on every device is safe.
+ *
+ *
If the app process dies while the display is up, the exit path never runs and the user's
+ * gesture setting stays off until the next display session restores it on entry -- an accepted
+ * trade-off for not persisting state; the keys are re-read (not assumed) on every enter.
+ */
+public final class SystemGestureGuard {
+ private static final String TAG = "SystemGestureGuard";
+
+ /** OEM gesture toggles (system namespace) that swallow multi-finger touches. */
+ private static final String[] KEYS = {
+ // ColorOS/OxygenOS "smart apperceive" screenshot: three-finger swipe & touch-and-hold.
+ "oplus_customize_smart_apperceive_screen_capture",
+ // Three-finger sideways swipe to switch apps.
+ "oplus_customize_three_fingers_switch_app",
+ };
+
+ /** Serializes enter/exit so a fast pause/resume cannot interleave get and put. */
+ private static final ExecutorService executor = Executors.newSingleThreadExecutor();
+
+ /** Keys that were "1" on enter and must go back to "1" on exit. */
+ private static final List suppressed = new ArrayList<>();
+
+ private SystemGestureGuard() {
+ }
+
+ /** Turns the OEM gestures off; call when the VM display becomes foreground. */
+ public static void enterDisplay() {
+ executor.execute(() -> {
+ RunContext shell = RootRunContext.getContext();
+ synchronized (suppressed) {
+ // A re-enter without exit (activity recreation) must not re-read "0" as the
+ // value to restore, so the restore list only grows from a clean slate.
+ if (!suppressed.isEmpty()) return;
+ for (String key : KEYS) {
+ RunResult get = shell.runQuiet(fmt("settings get system %s", key));
+ if (!get.isSuccess() || !"1".equals(get.getOutString())) continue;
+ if (shell.runQuiet(fmt("settings put system %s 0", key)).isSuccess()) {
+ suppressed.add(key);
+ Log.i(TAG, fmt("suppressed host gesture: %s", key));
+ }
+ }
+ }
+ });
+ }
+
+ /** Restores whatever {@link #enterDisplay} turned off; call when the display leaves. */
+ public static void exitDisplay() {
+ executor.execute(() -> {
+ RunContext shell = RootRunContext.getContext();
+ synchronized (suppressed) {
+ for (String key : suppressed) {
+ shell.runQuiet(fmt("settings put system %s 1", key));
+ Log.i(TAG, fmt("restored host gesture: %s", key));
+ }
+ suppressed.clear();
+ }
+ });
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/peripheral/PeripheralForegroundService.java b/app/src/main/java/cn/classfun/droidvm/lib/peripheral/PeripheralForegroundService.java
new file mode 100644
index 00000000..546b4e2d
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/peripheral/PeripheralForegroundService.java
@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.peripheral;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import android.app.NotificationChannel;
+import android.app.NotificationManager;
+import android.app.PendingIntent;
+import android.app.Service;
+import android.content.Context;
+import android.content.Intent;
+import android.os.IBinder;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+import androidx.core.app.NotificationCompat;
+
+import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.ui.main.MainActivity;
+
+/**
+ * Holds the app's uid in a foreground state while a running VM carries a peripheral that needs it.
+ *
+ * It exists because of where crosvm lives. The VM is a child of the root daemon, which is an
+ * {@code app_process} started through su and completely outside the Android lifecycle --
+ * ActivityManager does not know it exists, so nothing it does can affect its uid's process state.
+ * But the host APIs those peripherals reach are gated on exactly that: AppOps resolves a
+ * foreground-only permission by asking whether the uid carries the matching
+ * {@code PROCESS_CAPABILITY_FOREGROUND_*}, which only a process ActivityManager manages can
+ * supply. crosvm runs setuid to the app's uid, so a foreground service in the app process is what
+ * lets it through -- measured: an unmanaged setuid'd process gets frames precisely while some
+ * other process of the same uid is foreground, and ERROR_CAMERA_DISABLED otherwise.
+ *
+ * Nothing here names a kind of peripheral. The type mask comes from
+ * {@code PeripheralType.getForegroundServiceType}, so a device that starts needing this only has
+ * to say so there.
+ */
+public final class PeripheralForegroundService extends Service {
+ private static final String TAG = "PeripheralFgs";
+ private static final String CHANNEL_ID = "peripheral_foreground";
+ private static final int NOTIF_ID = 0x45_00_00_01;
+ private static final String EXTRA_TYPES = "types";
+
+ /**
+ * Brings the service in line with {@code typeMask}: starts or re-types it when non-zero,
+ * stops it when zero. Safe to call with the value it already has.
+ *
+ * Called from the daemon, which is uid 0: {@code ActiveServices} exempts a root caller by
+ * app id, and the background-start check seeds itself from that same verdict, so this works
+ * with no app process in the foreground and no UI open. An app-process caller would be
+ * refused in exactly that case, which is why the decision does not live there.
+ */
+ public static void apply(@NonNull Context context, int typeMask) {
+ var intent = new Intent(context, PeripheralForegroundService.class);
+ if (typeMask == 0) {
+ context.stopService(intent);
+ return;
+ }
+ intent.putExtra(EXTRA_TYPES, typeMask);
+ try {
+ context.startForegroundService(intent);
+ } catch (Exception e) {
+ // Background-start restrictions, or a missing FOREGROUND_SERVICE_* permission. The VM
+ // still runs; only the peripheral that wanted this is affected, and it will report its
+ // own failure to open.
+ Log.w(TAG, "could not raise the peripheral foreground service", e);
+ }
+ }
+
+ @Nullable
+ @Override
+ public IBinder onBind(Intent intent) {
+ return null;
+ }
+
+ @Override
+ public int onStartCommand(@Nullable Intent intent, int flags, int startId) {
+ int typeMask = intent == null ? 0 : intent.getIntExtra(EXTRA_TYPES, 0);
+ if (typeMask == 0) {
+ stopSelf();
+ return START_NOT_STICKY;
+ }
+ ensureChannel();
+ try {
+ startForeground(NOTIF_ID, buildNotification(), typeMask);
+ } catch (Exception e) {
+ // startForeground with a typed service throws when the matching runtime permission is
+ // not held -- the user declined CAMERA after the peripheral was added, say. Stopping
+ // is the honest outcome: a service that cannot carry the type it was raised for grants
+ // no capability, and leaving it up would show a notification that promises otherwise.
+ Log.w(TAG, fmt("startForeground rejected for types 0x%s",
+ Integer.toHexString(typeMask)), e);
+ stopSelf();
+ return START_NOT_STICKY;
+ }
+ // Not sticky: the policy re-applies from the live VM states, so a restart by the system
+ // with no VM running would raise a service nothing asked for.
+ return START_NOT_STICKY;
+ }
+
+ @NonNull
+ private android.app.Notification buildNotification() {
+ var open = PendingIntent.getActivity(this, 0, new Intent(this, MainActivity.class),
+ PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_IMMUTABLE);
+ return new NotificationCompat.Builder(this, CHANNEL_ID)
+ .setSmallIcon(R.drawable.ic_camera)
+ .setContentTitle(getString(R.string.peripheral_fgs_title))
+ .setContentText(getString(R.string.peripheral_fgs_text))
+ .setOngoing(true)
+ .setOnlyAlertOnce(true)
+ .setContentIntent(open)
+ .build();
+ }
+
+ private void ensureChannel() {
+ var nm = getSystemService(NotificationManager.class);
+ if (nm == null) return;
+ var channel = new NotificationChannel(CHANNEL_ID,
+ getString(R.string.notif_channel_peripheral_foreground),
+ NotificationManager.IMPORTANCE_LOW);
+ channel.setDescription(getString(R.string.notif_channel_peripheral_foreground_desc));
+ channel.setShowBadge(false);
+ nm.createNotificationChannel(channel);
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/BootFile.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/BootFile.java
index 70ece34e..8b22d0d1 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/BootFile.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/BootFile.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskChainPlan.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskChainPlan.java
new file mode 100644
index 00000000..8bf5393e
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskChainPlan.java
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.pkg;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.basename;
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+import static cn.classfun.droidvm.lib.utils.StringUtils.safeFileName;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * Which files a package must carry for one VM's disks. A qcow2 overlay is only half a disk: the
+ * guest reads its backing image too, so a package holding the overlay alone imports as a VM that
+ * cannot boot - the copied header still names a path that exists only on the machine it came
+ * from. This walks each selected disk down its backing chain and returns every file involved,
+ * child before parent, with:
+ *
+ * - one entry per file, so two disks sharing a base image ship it once;
+ * - unique archive names, so two disks named {@code disk.qcow2} in different folders do not
+ * collide inside the tar (they did before backing images made that likely);
+ * - the parent link recorded as an archive name, which is what the importer can act on -
+ * the on-disk path is meaningless once the files land somewhere else.
+ *
+ *
+ * Pure by design: it reads no files itself. The caller supplies the {@link BackingLookup},
+ * which is what makes the whole plan testable and lets the export UI predict, with the same
+ * code, exactly what the daemon will pack.
+ */
+public final class DiskChainPlan {
+ /**
+ * Chain length cap. Far above the depth the overlay UI allows (see {@code DiskTree}); this
+ * is only here so a corrupt header cannot spin the walk forever, hence the loud failure
+ * rather than a silent truncation - a truncated chain is exactly the broken package this
+ * class exists to prevent.
+ */
+ public static final int MAX_CHAIN = 64;
+
+ private DiskChainPlan() {
+ }
+
+ /** Resolves one image's backing file to an absolute path, or null when it has none. */
+ public interface BackingLookup {
+ @Nullable
+ String backingOf(@NonNull String path) throws Exception;
+ }
+
+ /** One file the package has to carry. */
+ public static final class Member {
+ /** Absolute path on the exporting device. */
+ public final String path;
+ /** Name inside the archive; unique across the package. */
+ public final String archivePath;
+ /**
+ * The VM disk slot this file fills, or null when it is in the package only because
+ * something else backs onto it. A file can start out as a backing image and turn out to
+ * be an attached disk as well, which is why this is not final.
+ */
+ @Nullable
+ public DiskRef attachment = null;
+ /** {@link #archivePath} of this file's own backing image, or "" when it has none. */
+ public String backingArchive = "";
+
+ private Member(@NonNull String path, @NonNull String archivePath) {
+ this.path = path;
+ this.archivePath = archivePath;
+ }
+ }
+
+ /**
+ * Expand {@code tops} - the VM disks the user chose, in slot order - into every file the
+ * package needs.
+ *
+ * @throws IOException when a chain loops or runs deeper than {@link #MAX_CHAIN}; whatever
+ * {@code lookup} throws for an unreadable image or a missing backing file propagates as
+ * it is, so the export fails with the path that caused it.
+ */
+ @NonNull
+ public static List build(
+ @NonNull List tops,
+ @NonNull BackingLookup lookup
+ ) throws Exception {
+ var order = new ArrayList();
+ var byPath = new HashMap();
+ var archives = new HashSet();
+ for (var top : tops) {
+ if (top.path == null || top.path.isEmpty()) continue;
+ var known = byPath.get(top.path);
+ Member member;
+ if (known == null) {
+ member = add(order, byPath, archives, top.path);
+ } else if (known.attachment == null) {
+ member = known; // already packed as a backing image; it is a disk of its own too
+ } else {
+ // The same file in two slots. Give the second slot its own copy rather than
+ // dropping it: a package that silently loses a disk is worse than a duplicate.
+ member = new Member(top.path, uniqueArchive(archives, basename(top.path)));
+ order.add(member);
+ }
+ member.attachment = top;
+ walkUp(order, byPath, archives, member, lookup);
+ }
+ return order;
+ }
+
+ /** Follow {@code start}'s backing chain upward, adding each file it reaches. */
+ private static void walkUp(
+ @NonNull List order,
+ @NonNull Map byPath,
+ @NonNull Set archives,
+ @NonNull Member start,
+ @NonNull BackingLookup lookup
+ ) throws Exception {
+ var seen = new HashSet();
+ seen.add(start.path);
+ var child = start;
+ for (int depth = 0; depth < MAX_CHAIN; depth++) {
+ var backing = lookup.backingOf(child.path);
+ if (backing == null || backing.isEmpty()) return;
+ if (!seen.add(backing)) throw new IOException(fmt(
+ "backing chain of %s loops at %s", basename(start.path), backing
+ ));
+ var known = byPath.get(backing);
+ var parent = known != null ? known : add(order, byPath, archives, backing);
+ child.backingArchive = parent.archivePath;
+ // A file already in the plan brought its own parents with it when it was added,
+ // so there is nothing above this point left to walk.
+ if (known != null) return;
+ child = parent;
+ }
+ throw new IOException(fmt(
+ "backing chain of %s is deeper than %d images", basename(start.path), MAX_CHAIN
+ ));
+ }
+
+ @NonNull
+ private static Member add(
+ @NonNull List order,
+ @NonNull Map byPath,
+ @NonNull Set archives,
+ @NonNull String path
+ ) {
+ var member = new Member(path, uniqueArchive(archives, basename(path)));
+ order.add(member);
+ byPath.put(path, member);
+ return member;
+ }
+
+ /** {@code name} as an archive entry name no other member has taken. */
+ @NonNull
+ private static String uniqueArchive(@NonNull Set taken, @NonNull String name) {
+ var base = safeFileName(name, "disk.img");
+ if (taken.add(base)) return base;
+ int dot = base.lastIndexOf('.');
+ var stem = dot > 0 ? base.substring(0, dot) : base;
+ var ext = dot > 0 ? base.substring(dot) : "";
+ for (int i = 1; ; i++) {
+ var candidate = fmt("%s_%d%s", stem, i, ext);
+ if (taken.add(candidate)) return candidate;
+ }
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskEntry.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskEntry.java
index 0017d0e6..933c1701 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskEntry.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskEntry.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import static cn.classfun.droidvm.lib.store.enums.Enums.optEnum;
@@ -8,16 +11,29 @@
import org.json.JSONObject;
import java.io.File;
+import java.util.Set;
import cn.classfun.droidvm.lib.store.base.JSONSerialize;
import cn.classfun.droidvm.ui.disk.create.DiskFormat;
-public final class DiskEntry implements JSONSerialize {
+public final class DiskEntry implements JSONSerialize, ManifestFeature.Carrier {
+ /** {@link DiskRef#index} of a file that fills no VM disk slot. */
+ public static final int INDEX_BACKING = -1;
+
public DiskRef ref;
public String name = null;
public DiskFormat format = null;
public long size = 0;
public String archivePath = null;
+ /**
+ * Whether this file fills a VM disk slot. False for a file the package carries only because
+ * another one backs onto it: the importer has to restore it, but must not hand it to the
+ * guest as a disk of its own. Absent in packages written before backing chains were packed,
+ * where every entry was a disk, hence the default.
+ */
+ public boolean attached = true;
+ /** {@link #archivePath} of this file's backing image inside the package, or "". */
+ public String backingArchive = "";
public File target = null;
public DiskEntry(DiskRef ref) {
@@ -25,11 +41,13 @@ public DiskEntry(DiskRef ref) {
}
public DiskEntry(@NonNull JSONObject o) {
- ref = new DiskRef(0, o);
+ ref = new DiskRef(o.optInt("index", 0), o);
name = o.optString("name", "disk.img");
format = optEnum(o, "format", DiskFormat.RAW);
size = o.optLong("size");
archivePath = o.optString("archive_path");
+ attached = o.optBoolean("attached", true);
+ backingArchive = o.optString("backing_archive", "");
}
@NonNull
@@ -45,27 +63,37 @@ public JSONObject toJson() throws JSONException {
o.put("format", format.name().toLowerCase());
o.put("size", size);
o.put("archive_path", archivePath);
+ o.put("attached", attached);
+ if (!backingArchive.isEmpty()) o.put("backing_archive", backingArchive);
return o;
}
- private static @NonNull String sanitize(@NonNull String name) {
- var sb = new StringBuilder();
- for (int i = 0; i < name.length(); i++) {
- char c = name.charAt(i);
- if (c == '/' || c == '\\' || c < 0x20) c = '_';
- sb.append(c);
- }
- return sb.toString();
+ @Override
+ public void collectFeatures(@NonNull Set into) {
+ if (!attached || !backingArchive.isEmpty()) into.add(ManifestFeature.BACKING_CHAIN);
}
- public void build() {
+ public void build(@NonNull String archivePath) {
var file = new File(ref.path);
name = file.getName();
- archivePath = sanitize(name);
+ this.archivePath = archivePath;
format = DiskFormat.fromFilename(name);
size = file.length();
}
+ /** The manifest entry for one file of a {@link DiskChainPlan}. */
+ @NonNull
+ public static DiskEntry of(@NonNull DiskChainPlan.Member member) {
+ var attachment = member.attachment;
+ var entry = new DiskEntry(attachment != null
+ ? attachment
+ : new DiskRef(INDEX_BACKING, member.path));
+ entry.attached = attachment != null;
+ entry.backingArchive = member.backingArchive;
+ entry.build(member.archivePath);
+ return entry;
+ }
+
@NonNull
public static DiskEntry from(Object o) throws JSONException {
if (o instanceof JSONObject)
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskRef.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskRef.java
index 768b9876..37adca62 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskRef.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/DiskRef.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import static java.util.Objects.requireNonNull;
@@ -26,6 +29,14 @@ public DiskRef(int index, @NonNull JSONObject jo) {
this.bus = optEnum(jo, "bus", DiskBus.VIRTIO);
}
+ /** A file with no VM disk slot of its own - a backing image the package carries. */
+ public DiskRef(int index, @NonNull String path) {
+ this.index = index;
+ this.path = path;
+ this.readonly = true;
+ this.bus = DiskBus.VIRTIO;
+ }
+
public DiskRef(int index, @NonNull DataItem o) {
this.index = index;
this.path = o.optString("path", "");
@@ -46,6 +57,7 @@ public boolean isCDROM() {
@Override
public JSONObject toJson() throws JSONException {
var d = new JSONObject();
+ d.put("index", index);
d.put("readonly", readonly);
d.put("bus", bus);
d.put("path", path);
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/ManifestFeature.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/ManifestFeature.java
new file mode 100644
index 00000000..981330d6
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/ManifestFeature.java
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.pkg;
+
+import androidx.annotation.NonNull;
+
+import java.util.EnumSet;
+import java.util.Set;
+
+/**
+ * Everything a package can contain that a reader from before it would misread, each with the
+ * manifest version that introduced it. A package is stamped with the highest {@link #since} among
+ * the features it actually uses ({@link #versionFor}), so one that uses none stays readable by
+ * every build that ever wrote a package, and what a build can read is simply {@link #latest()}.
+ *
+ * Adding a feature is one constant here plus the {@link Carrier} that reports using it. The
+ * version arithmetic never changes and no feature has to know about any other, which is the
+ * point: a chain of "if this then 3, else if that then 2" would have to be kept in the right
+ * order by hand, and a wrong order silently stamps a package lower than it needs.
+ */
+public enum ManifestFeature {
+ /**
+ * Files the VM does not attach, and overlay-to-base links ({@code attached} and
+ * {@code backing_archive} on a disk entry). A reader without it attaches every file as a
+ * disk and never re-points the overlays at their copied bases.
+ */
+ BACKING_CHAIN(2);
+
+ /** The manifest version that introduced the feature. */
+ public final int since;
+
+ ManifestFeature(int since) {
+ this.since = since;
+ }
+
+ /** A part of a manifest that can use features; it says which ones it actually does. */
+ public interface Carrier {
+ void collectFeatures(@NonNull Set into);
+ }
+
+ /** The version a package using exactly {@code used} must be stamped with. */
+ public static int versionFor(@NonNull Set used) {
+ int version = PackageConstants.MANIFEST_VERSION_BASE;
+ for (var feature : used) version = Math.max(version, feature.since);
+ return version;
+ }
+
+ /** The newest version any feature needs: the most a build with this list can read. */
+ public static int latest() {
+ return versionFor(EnumSet.allOf(ManifestFeature.class));
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/NetworkImportPlan.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/NetworkImportPlan.java
new file mode 100644
index 00000000..432f01dd
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/NetworkImportPlan.java
@@ -0,0 +1,347 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.pkg;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.UUID;
+
+import cn.classfun.droidvm.lib.network.IPv4Network;
+import cn.classfun.droidvm.lib.network.IPv6Network;
+import cn.classfun.droidvm.lib.store.base.DataStore;
+import cn.classfun.droidvm.lib.store.network.NetworkConfig;
+import cn.classfun.droidvm.lib.store.network.NetworkConfigValidator;
+import cn.classfun.droidvm.lib.store.network.NetworkConflicts;
+import cn.classfun.droidvm.lib.store.network.UplinkMode;
+
+/**
+ * What happens to each network a package carries: join one this phone already has, create it, or
+ * leave it behind. One instance answers for one import against one set of existing networks, and
+ * remembers the names its own creations have claimed, so two packaged networks that want the same
+ * name do not both end up asking for it.
+ *
+ * The screen and the import task share this class so that what the user is shown is what gets
+ * built: the same rules pick which networks may be joined, decide whether creating is possible at
+ * all, and settle the name a created network ends up with.
+ */
+public final class NetworkImportPlan {
+ /** The manifest field carrying a packaged network's reference key. */
+ public static final String REF_KEY = "pkg_network_ref";
+
+ private final List existing;
+ private final Set takenNames = new HashSet<>();
+ private final Set takenBridges = new HashSet<>();
+ private final Set takenIds = new HashSet<>();
+
+ public NetworkImportPlan(@NonNull DataStore store) {
+ this(NetworkConflicts.snapshot(store));
+ }
+
+ public NetworkImportPlan(@NonNull List existing) {
+ this.existing = existing;
+ for (var net : existing) {
+ var name = net.getName();
+ if (name != null) takenNames.add(name);
+ var bridge = net.getBridgeName();
+ if (bridge != null && !bridge.isEmpty()) takenBridges.add(bridge);
+ var id = net.item.optString("id", "");
+ if (!id.isEmpty()) takenIds.add(id);
+ }
+ }
+
+ /** What to do with one packaged network. */
+ public enum Action {
+ JOIN("join"),
+ CREATE("create"),
+ SKIP("skip");
+
+ private final String key;
+
+ Action(@NonNull String key) {
+ this.key = key;
+ }
+
+ @NonNull
+ public String key() {
+ return key;
+ }
+
+ /** The action for a wire key; unknown keys read as {@link #CREATE}, the old default. */
+ @NonNull
+ public static Action fromKey(@Nullable String key) {
+ for (var v : values())
+ if (v.key.equals(key)) return v;
+ return CREATE;
+ }
+ }
+
+ /** One decision, keyed by the packaged network's {@link #REF_KEY}. */
+ public static final class Entry {
+ @NonNull
+ public final String ref;
+ @NonNull
+ public final Action action;
+ /** The network to join, for {@link Action#JOIN}. */
+ @Nullable
+ public final String networkId;
+ /** The network to create, for {@link Action#CREATE}; null to derive it on the spot. */
+ @Nullable
+ public final NetworkConfig config;
+
+ public Entry(
+ @NonNull String ref,
+ @NonNull Action action,
+ @Nullable String networkId,
+ @Nullable NetworkConfig config
+ ) {
+ this.ref = ref;
+ this.action = action;
+ this.networkId = networkId;
+ this.config = config;
+ }
+
+ @NonNull
+ public JSONObject toJson() throws JSONException {
+ var o = new JSONObject();
+ o.put("ref", ref);
+ o.put("action", action.key());
+ if (networkId != null) o.put("network_id", networkId);
+ if (config != null) o.put("config", config.toJson());
+ return o;
+ }
+
+ @NonNull
+ public static Entry fromJson(@NonNull JSONObject o) throws JSONException {
+ var cfgJson = o.optJSONObject("config");
+ NetworkConfig cfg = null;
+ if (cfgJson != null) cfg = new NetworkConfig(cfgJson);
+ var id = o.optString("network_id", "");
+ return new Entry(
+ o.optString("ref", ""),
+ Action.fromKey(o.optString("action", "")),
+ id.isEmpty() ? null : id,
+ cfg
+ );
+ }
+ }
+
+ /** Reads a plan array; entries that cannot be parsed are dropped rather than failing it. */
+ @NonNull
+ public static List parse(@Nullable JSONArray arr) {
+ var out = new ArrayList();
+ if (arr == null) return out;
+ for (int i = 0; i < arr.length(); i++) {
+ var o = arr.optJSONObject(i);
+ if (o == null) continue;
+ try {
+ var entry = Entry.fromJson(o);
+ if (!entry.ref.isEmpty()) out.add(entry);
+ } catch (JSONException ignored) {
+ }
+ }
+ return out;
+ }
+
+ /** The entry for a ref, or null when the plan says nothing about it. */
+ @Nullable
+ public static Entry findRef(@NonNull List plan, @NonNull String ref) {
+ for (var entry : plan)
+ if (entry.ref.equals(ref)) return entry;
+ return null;
+ }
+
+ /**
+ * The networks this packaged one may be joined to, closest match first.
+ *
+ * Only networks of the same kind qualify: joining is what carries the packaged VM's
+ * kind-specific settings across intact -- an L3 network's DHCP pool offsets, a gVisor
+ * network's IPv6 SNAT -- and none of that survives being attached to a network built the
+ * other way. An empty list means this package's network has nothing here to join.
+ */
+ @NonNull
+ public List candidates(@NonNull NetworkConfig packaged) {
+ var out = new ArrayList();
+ for (var net : existing)
+ if (NetworkConflicts.sameKind(packaged, net)) out.add(net);
+ out.sort(Comparator
+ .comparingLong((NetworkConfig net) -> distance(packaged, net))
+ .thenComparing(net -> net.getName() == null ? "" : net.getName()));
+ return out;
+ }
+
+ /**
+ * Why creating this packaged network here would collide, or null when it would not. Same
+ * rules as the network editor: an overlapping prefix on a network of the same bridge type,
+ * or an L2 uplink another network already bridges.
+ */
+ @Nullable
+ public NetworkConflicts.Conflict createConflict(@NonNull NetworkConfig packaged) {
+ return NetworkConflicts.find(packaged, existing, null);
+ }
+
+ /**
+ * The network a packaged one would be created as: its own config, given a fresh id and
+ * whatever name and bridge name are still free. Names are the one thing an import is allowed
+ * to change quietly -- they must be unique across every network on the phone whatever its
+ * kind, and a collision there says nothing about whether the network itself fits.
+ *
+ * Claims the names it hands out, so calling this once per network being created gives each
+ * of them a different one.
+ */
+ @NonNull
+ public NetworkConfig prepareCreate(@NonNull NetworkConfig packaged) {
+ NetworkConfig cfg;
+ try {
+ cfg = new NetworkConfig(packaged.toJson());
+ } catch (JSONException e) {
+ throw new IllegalArgumentException("packaged network is not serializable", e);
+ }
+ cfg.item.remove(REF_KEY);
+ cfg.item.remove("id");
+ return adopt(cfg);
+ }
+
+ /**
+ * Settles a config that is already meant to be created here: a free id, and names that are
+ * still free. Applied to what the screen prepared as well, because the two run against their
+ * own copies of the store and a network may have appeared in between -- an import that
+ * renames one network too many is a great deal better than one that fails on a duplicate.
+ *
+ *
Mutates and returns {@code cfg}, and claims what it hands out.
+ */
+ @NonNull
+ public NetworkConfig adopt(@NonNull NetworkConfig cfg) {
+ var id = cfg.item.optString("id", "");
+ if (id.isEmpty() || takenIds.contains(id)) {
+ id = UUID.randomUUID().toString();
+ cfg.setId(id);
+ }
+ takenIds.add(id);
+ var name = uniqueName(cfg.getName());
+ cfg.setName(name);
+ takenNames.add(name);
+ var bridge = cfg.getBridgeName();
+ if (bridge != null && !bridge.isEmpty()) {
+ var unique = uniqueBridge(bridge);
+ cfg.setBridgeName(unique);
+ takenBridges.add(unique);
+ }
+ return cfg;
+ }
+
+ /** {@code base} or the first free {@code base_N}. */
+ @NonNull
+ private String uniqueName(@Nullable String base) {
+ var name = base == null || base.trim().isEmpty() ? "network" : base;
+ if (!takenNames.contains(name)) return name;
+ for (int i = 1; ; i++) {
+ var candidate = fmt("%s_%d", name, i);
+ if (!takenNames.contains(candidate)) return candidate;
+ }
+ }
+
+ /**
+ * {@code base} or the first free {@code baseN}, trimmed so the suffix still fits the
+ * interface-name cap -- a bridge name over it is refused outright, so growing one past it to
+ * dodge a duplicate would only trade a collision for a rejection.
+ */
+ @NonNull
+ private String uniqueBridge(@NonNull String base) {
+ if (!takenBridges.contains(base)) return base;
+ for (int i = 1; i < 100000; i++) {
+ var suffix = String.valueOf(i);
+ int room = NetworkConfigValidator.MAX_BRIDGE_NAME_LEN - suffix.length();
+ var head = base.length() > room ? base.substring(0, Math.max(1, room)) : base;
+ var candidate = fmt("%s%s", head, suffix);
+ if (!takenBridges.contains(candidate)) return candidate;
+ }
+ return base;
+ }
+
+ /**
+ * How far a candidate is from the packaged network, lower being closer: for L2 the uplink it
+ * bridges, for L3 the primary IPv4 prefix, falling back to IPv6 when the packaged network has
+ * no IPv4 of its own. The point is that the network the user most likely means -- the same
+ * segment, the same uplink, carried over from the other phone -- is the one already selected.
+ */
+ private static long distance(@NonNull NetworkConfig packaged, @NonNull NetworkConfig other) {
+ if (packaged.getUplinkMode() == UplinkMode.L2) {
+ var mine = packaged.getL2Uplink();
+ var theirs = other.getL2Uplink();
+ if (mine == null || theirs == null) return 1000;
+ if (mine.trim().equalsIgnoreCase(theirs.trim())) return 0;
+ return 1000 - commonChars(mine, theirs);
+ }
+ var mine4 = primaryV4(packaged);
+ if (mine4 != null) {
+ var theirs4 = primaryV4(other);
+ return theirs4 == null ? 1000 : 32 - commonBits4(mine4, theirs4);
+ }
+ var mine6 = primaryV6(packaged);
+ if (mine6 != null) {
+ var theirs6 = primaryV6(other);
+ return theirs6 == null ? 1000 : 128 - commonBits6(mine6, theirs6);
+ }
+ return 500;
+ }
+
+ /** The first IPv4 network this config addresses, untagged VLAN first. */
+ @Nullable
+ private static IPv4Network primaryV4(@NonNull NetworkConfig cfg) {
+ IPv4Network first = null;
+ for (var vlan : cfg.getVlans()) {
+ var net = vlan.getIpv4Network();
+ if (net == null) continue;
+ if (vlan.isUntagged()) return net;
+ if (first == null) first = net;
+ }
+ return first;
+ }
+
+ @Nullable
+ private static IPv6Network primaryV6(@NonNull NetworkConfig cfg) {
+ IPv6Network first = null;
+ for (var vlan : cfg.getVlans()) {
+ var net = vlan.getIpv6Network();
+ if (net == null) continue;
+ if (vlan.isUntagged()) return net;
+ if (first == null) first = net;
+ }
+ return first;
+ }
+
+ private static long commonBits4(@NonNull IPv4Network a, @NonNull IPv4Network b) {
+ long diff = a.networkAddress().value() ^ b.networkAddress().value();
+ int bits = 0;
+ for (int i = 31; i >= 0 && ((diff >> i) & 1L) == 0; i--) bits++;
+ return bits;
+ }
+
+ private static long commonBits6(@NonNull IPv6Network a, @NonNull IPv6Network b) {
+ var diff = a.networkAddress().value().xor(b.networkAddress().value());
+ int bits = 0;
+ for (int i = 127; i >= 0 && !diff.testBit(i); i--) bits++;
+ return bits;
+ }
+
+ private static long commonChars(@NonNull String a, @NonNull String b) {
+ int n = Math.min(a.length(), b.length());
+ int i = 0;
+ while (i < n && Character.toLowerCase(a.charAt(i)) == Character.toLowerCase(b.charAt(i)))
+ i++;
+ return i;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageConstants.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageConstants.java
index c45a8af7..43e1f624 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageConstants.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageConstants.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import cn.classfun.droidvm.lib.archive.Compression;
@@ -8,7 +11,13 @@ public final class PackageConstants {
public static final String MAGIC = "VMPKG";
public static final int HEADER_SIZE = 24;
public static final int BUFFER = 64 * 1024;
- public static final int MANIFEST_VERSION = 1;
+ // BASE is the manifest of a package that uses none of the ManifestFeatures - the original
+ // one-file-per-disk layout. Every later addition is a ManifestFeature carrying the version
+ // that introduced it; a package is stamped with the highest one it uses, and what this
+ // build can read follows from the list rather than from a constant kept in step by hand.
+ // Readers accept anything up to MANIFEST_VERSION and refuse what is newer.
+ public static final int MANIFEST_VERSION_BASE = 1;
+ public static final int MANIFEST_VERSION = ManifestFeature.latest();
public static final String MANIFEST_NAME = "manifest.json";
public static final Compression DEFAULT_COMPRESSION = Compression.ZSTD;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageHeader.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageHeader.java
index 64956cf5..4f89a879 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageHeader.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageHeader.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import static java.nio.charset.StandardCharsets.UTF_8;
@@ -40,7 +43,9 @@ public void parseFromData(@NonNull byte[] hdr) throws IOException {
}
public void validate() throws IOException {
- if (manifestVersion != PackageConstants.MANIFEST_VERSION)
+ // Older packages still import; newer ones are refused rather than half-understood.
+ if (manifestVersion < PackageConstants.MANIFEST_VERSION_BASE
+ || manifestVersion > PackageConstants.MANIFEST_VERSION)
throw new IOException(fmt("unsupported vmpkg manifest version: %d", manifestVersion));
if (Compression.fromType(compression) == null)
throw new IOException(fmt("unsupported vmpkg compression: %d", compression));
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageInput.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageInput.java
index 397c2b1e..daac35f2 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageInput.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageInput.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import static cn.classfun.droidvm.lib.archive.TarWriter.wrapCompressionInput;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageManifest.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageManifest.java
index eaa90096..8f906f8f 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageManifest.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/PackageManifest.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
import static cn.classfun.droidvm.lib.store.enums.Enums.optEnum;
@@ -16,7 +19,9 @@
import java.io.InputStream;
import java.util.ArrayList;
+import java.util.EnumSet;
import java.util.List;
+import java.util.Set;
import cn.classfun.droidvm.BuildConfig;
import cn.classfun.droidvm.lib.archive.Compression;
@@ -25,7 +30,7 @@
import cn.classfun.droidvm.lib.store.vm.VMConfig;
public final class PackageManifest implements JSONSerialize {
- public int manifestVersion = PackageConstants.MANIFEST_VERSION;
+ public int manifestVersion = PackageConstants.MANIFEST_VERSION_BASE;
public String format = PackageConstants.EXTENSION;
public long createdAt = System.currentTimeMillis();
public String appVersion = BuildConfig.VERSION_NAME;
@@ -55,6 +60,23 @@ public JSONObject toJson() throws JSONException{
return o;
}
+ /** The {@link ManifestFeature}s this package's contents actually use. */
+ @NonNull
+ public Set features() {
+ var used = EnumSet.noneOf(ManifestFeature.class);
+ for (var disk : disks) disk.collectFeatures(used);
+ return used;
+ }
+
+ /**
+ * The oldest manifest version that can describe this package - the highest any feature in
+ * it needs - so a plain one-disk export stays importable by builds that predate the rest.
+ * Ask only once everything is collected: the answer is a function of all of it.
+ */
+ public int resolveVersion() {
+ return ManifestFeature.versionFor(features());
+ }
+
@Nullable
public DiskEntry findDisk(@NonNull String archivePath) {
for (var disk : disks)
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/pkg/Phase.java b/app/src/main/java/cn/classfun/droidvm/lib/pkg/Phase.java
index 41646fe3..ce3400d6 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/pkg/Phase.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/pkg/Phase.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.pkg;
public enum Phase {
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/run/RunContext.java b/app/src/main/java/cn/classfun/droidvm/lib/run/RunContext.java
index 86c80644..2ede507e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/run/RunContext.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/run/RunContext.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.run;
import static cn.classfun.droidvm.lib.utils.RunUtils.escapedString;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/run/RunResult.java b/app/src/main/java/cn/classfun/droidvm/lib/run/RunResult.java
index 4c42bfdf..f95a1a68 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/run/RunResult.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/run/RunResult.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.run;
import android.util.Log;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunContext.java b/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunContext.java
index 9fd450b1..d9f15691 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunContext.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunContext.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.run.root;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunResult.java b/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunResult.java
index 03849259..e2e350ac 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunResult.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/run/root/RootRunResult.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.run.root;
import com.topjohnwu.superuser.Shell;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunContext.java b/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunContext.java
index 72e5ed5c..0325cccf 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunContext.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunContext.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.run.system;
import static java.util.Objects.requireNonNullElse;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunResult.java b/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunResult.java
index 0a8a3e64..103fe830 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunResult.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/run/system/SystemRunResult.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.run.system;
import static cn.classfun.droidvm.lib.utils.RunUtils.outStringToList;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/size/SizeNumber.java b/app/src/main/java/cn/classfun/droidvm/lib/size/SizeNumber.java
index bc3ef75d..8cf230d5 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/size/SizeNumber.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/size/SizeNumber.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.size;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUnit.java b/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUnit.java
index 4e482d88..50f627ad 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUnit.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUnit.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.size;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUtils.java b/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUtils.java
index b5870fb2..19e33428 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUtils.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/size/SizeUtils.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.size;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataConfig.java b/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataConfig.java
index 09ea8351..cf6d6395 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataConfig.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataConfig.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.base;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataItem.java b/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataItem.java
index e1de9147..18bda4f2 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataItem.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataItem.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.base;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataStore.java b/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataStore.java
index 87a1949a..4284dee3 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataStore.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/base/DataStore.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.base;
import static cn.classfun.droidvm.lib.utils.FileUtils.loadJSONFile;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/base/JSONSerialize.java b/app/src/main/java/cn/classfun/droidvm/lib/store/base/JSONSerialize.java
index 89625af0..fff22428 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/base/JSONSerialize.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/base/JSONSerialize.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.base;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/base/RingBuffer.java b/app/src/main/java/cn/classfun/droidvm/lib/store/base/RingBuffer.java
index 95e54110..1b65fd1e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/base/RingBuffer.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/base/RingBuffer.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.base;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskBus.java b/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskBus.java
index f9bd3b99..0491b8c3 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskBus.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskBus.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.disk;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskConfig.java b/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskConfig.java
index cc8ac0fd..139d97f1 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskConfig.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskConfig.java
@@ -1,8 +1,12 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.disk;
import static cn.classfun.droidvm.lib.utils.StringUtils.pathJoin;
import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
import org.json.JSONException;
import org.json.JSONObject;
@@ -27,6 +31,27 @@ public String getFullPath() {
return pathJoin(item.optString("folder", ""), getName());
}
+ /**
+ * The registered disk this one is an overlay of (mirrors the qcow2 header's backing file;
+ * the header stays the ground truth, this link is what the UI trees and lock rules read).
+ * Null for a standalone disk or when the parent isn't registered.
+ */
+ @Nullable
+ public UUID getParentId() {
+ var s = item.optString("parent", "");
+ if (s.isEmpty()) return null;
+ try {
+ return UUID.fromString(s);
+ } catch (IllegalArgumentException e) {
+ return null;
+ }
+ }
+
+ public void setParentId(@Nullable UUID id) {
+ if (id == null) item.remove("parent");
+ else item.set("parent", id.toString());
+ }
+
@NonNull
public DiskFormat getFormat() {
return DiskFormat.fromFilename(getName());
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskStore.java b/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskStore.java
index 1dce22b4..bb70d7e3 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskStore.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/disk/DiskStore.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.disk;
import android.content.Context;
@@ -9,6 +12,9 @@
import org.json.JSONObject;
import java.io.File;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
import cn.classfun.droidvm.lib.store.base.DataStore;
@@ -71,4 +77,33 @@ public DiskConfig findByPath(@NonNull String path) {
}
return null;
}
+
+ // Overlay-tree helpers. Linear scans: the registry holds tens of entries, so scanning IS the
+ // fast lookup, and unlike a cached index it can never go stale. Full-tree construction
+ // (cycle guard, depth cap, flattening) lives in DiskTree.
+
+ /** Whether any registered disk is an overlay of {@code id} - the disk is then locked. */
+ public boolean hasChildren(@NonNull UUID id) {
+ for (int i = 0; i < size(); i++)
+ if (id.equals(get(i).getParentId())) return true;
+ return false;
+ }
+
+ /** All direct overlays of {@code id}, in registry order. */
+ @NonNull
+ public List childrenOf(@NonNull UUID id) {
+ var out = new ArrayList();
+ for (int i = 0; i < size(); i++) {
+ var cfg = get(i);
+ if (id.equals(cfg.getParentId())) out.add(cfg);
+ }
+ return out;
+ }
+
+ /** The registered parent of {@code config}, or null (standalone / broken link). */
+ @Nullable
+ public DiskConfig parentOf(@NonNull DiskConfig config) {
+ var parentId = config.getParentId();
+ return parentId == null ? null : findById(parentId);
+ }
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/ColorEnum.java b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/ColorEnum.java
index 4832cc1d..28d2abd1 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/ColorEnum.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/ColorEnum.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.enums;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/EnumPicker.java b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/EnumPicker.java
index 11af0711..a9d65600 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/EnumPicker.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/EnumPicker.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.enums;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
@@ -13,14 +16,22 @@
import com.google.android.material.dialog.MaterialAlertDialogBuilder;
import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashSet;
import java.util.List;
+import java.util.Set;
public final class EnumPicker> {
private final Context context;
private final Class enumClass;
private final List items = new ArrayList<>();
+ /** Items listed but refused; see {@link #setDisabledItems}. */
+ private final Set disabled = new LinkedHashSet<>();
+ private CharSequence disabledNote = null;
private EnumPickerChanged onValueChanged = null;
private int selectedIndex = -1;
+ /** Where a refused selection lands; see {@link #setDefaultItem}. */
+ private int defaultIndex = 0;
public interface EnumPickerChanged {
@SuppressWarnings("unused")
@@ -38,19 +49,15 @@ public AlertDialog showDialog(@Nullable CharSequence title) {
if (items.isEmpty())
throw new IllegalStateException("Items cannot be empty");
var labels = new String[items.size()];
- for (int i = 0; i < items.size(); i++) {
- var item = items.get(i);
- var label = item.toString();
- if (item instanceof StringEnum) {
- var se = (StringEnum) item;
- label = se.getDisplayString(context);
- }
- labels[i] = label;
- }
+ for (int i = 0; i < items.size(); i++)
+ labels[i] = menuLabel(items.get(i));
var b = new MaterialAlertDialogBuilder(context);
if (title != null)
b.setTitle(title);
b.setSingleChoiceItems(labels, selectedIndex, (dialog, which) -> {
+ // A refused row leaves the dialog open rather than closing on a value it did not
+ // apply, which would read as having been accepted.
+ if (disabled.contains(items.get(which))) return;
setSelectedIndex(which);
dialog.dismiss();
});
@@ -64,12 +71,9 @@ public void showPopup(@NonNull View anchor) {
var menu = popup.getMenu();
for (int i = 0; i < items.size(); i++) {
var item = items.get(i);
- var label = item.name();
- if (item instanceof StringEnum) {
- var se = (StringEnum) item;
- label = se.getDisplayString(context);
- }
- menu.add(0, i, i, label);
+ // MaterialMenu's adapter already honours isEnabled(): it greys the row and swallows
+ // the tap, so nothing here has to re-check on the way back out.
+ menu.add(0, i, i, menuLabel(item)).setEnabled(!disabled.contains(item));
}
popup.setOnMenuItemClickListener(menuItem -> {
setSelectedIndex(menuItem.getItemId());
@@ -78,8 +82,45 @@ public void showPopup(@NonNull View anchor) {
popup.show();
}
+ /** This item's label, plus the disabled note when it is one of the refused ones. */
+ @NonNull
+ private String menuLabel(@NonNull E item) {
+ var label = item instanceof StringEnum
+ ? ((StringEnum) item).getDisplayString(context) : item.name();
+ if (disabledNote == null || !disabled.contains(item)) return label;
+ return fmt("%s (%s)", label, disabledNote);
+ }
+
+ /**
+ * Items the picker lists but will not select.
+ *
+ * For a set of choices that is easier to read whole than pruned -- a ladder whose upper
+ * rungs are designed but not built, say. Hiding them makes the remaining values look like the
+ * entire vocabulary and makes each one that lands later look like a feature out of nowhere;
+ * listing them greyed, with {@code note} saying why, says what the set is and where this build
+ * stands in it.
+ *
+ * Refused means refused from every direction, a stored config included: a value the picker
+ * will not let the user pick is not one it will sit on and hand back to save(). A selection
+ * this call refuses moves to {@link #setDefaultItem the default}, the same way
+ * {@link #setSelectedItem} answers one. The item stays listed, so the set still reads whole --
+ * what it no longer does is leave a VM quietly pointed down a path this build cannot take.
+ *
+ * Cleared by {@link #setItems} and {@link #autoItems}, since a new item set has its own
+ * answer -- the same constant can be reachable under one and not under another.
+ */
+ public void setDisabledItems(@Nullable CharSequence note, @NonNull Collection refused) {
+ disabled.clear();
+ disabled.addAll(refused);
+ disabledNote = note;
+ if (selectedIndex >= 0 && selectedIndex < items.size()
+ && disabled.contains(items.get(selectedIndex)))
+ setSelectedIndex(fallbackIndex());
+ }
+
public void autoItems() {
items.clear();
+ disabled.clear();
for (var item : getConstants()) {
if (item instanceof StringEnum) {
var se = (StringEnum) item;
@@ -89,6 +130,7 @@ public void autoItems() {
}
if (items.isEmpty())
throw new IllegalStateException("No displayable constants found");
+ defaultIndex = 0;
selectedIndex = -1;
setSelectedIndex(0);
}
@@ -106,6 +148,8 @@ public void setItems(@NonNull List constants) {
throw new IllegalArgumentException("Constants cannot be empty");
items.clear();
items.addAll(constants);
+ disabled.clear();
+ defaultIndex = 0;
selectedIndex = -1;
setSelectedIndex(0);
}
@@ -131,6 +175,7 @@ public void setOnValueChangedListener(@Nullable Runnable listener) {
setOnValueChangedListener(listener == null ? null : (o, n) -> listener.run());
}
+ @SuppressWarnings("unused")
public int getSelectedIndex() {
return selectedIndex;
}
@@ -153,11 +198,78 @@ public E getSelectedItem() {
return items.get(selectedIndex);
}
- public void setSelectedItem(@NonNull E item) {
+ /**
+ * Selects {@code item}, or the default when this picker will not take it.
+ *
+ * Stored values outlive the sets that produced them. An option gets retired between
+ * releases; several rows build their item set out of another row's value, so a config written
+ * under one combination is routinely read back under another. Answering that with an exception
+ * made every restore path a crash waiting for the first user whose VM predates the current
+ * build -- which is what it was: an old VM naming a GL provider, under a backend whose set no
+ * longer lists one, took the editor down as it opened.
+ *
+ * So an item this picker does not list, or lists only to refuse (see
+ * {@link #setDisabledItems}), lands on {@link #setDefaultItem the default} and the call says
+ * so. A caller restoring a config does not have to work out which values belong to the set it
+ * just installed -- the set already knows, and that is the one copy of the rule.
+ *
+ * @return whether {@code item} itself was selected
+ */
+ public boolean setSelectedItem(@NonNull E item) {
int index = items.indexOf(item);
- if (index < 0)
- throw new IllegalArgumentException("Item not found in items");
+ if (index < 0 || disabled.contains(item)) {
+ setSelectedIndex(fallbackIndex());
+ return false;
+ }
setSelectedIndex(index);
+ return true;
+ }
+
+ /**
+ * The item a refused selection falls back to. Defaults to the first one, which is also what a
+ * freshly installed set selects.
+ *
+ * Worth naming wherever the head of the list is not the sensible answer -- a ladder whose
+ * bottom rung is the safe one but whose default is the highest rung this build reaches, say.
+ * Falling back to the head there would answer a value the build cannot honour with the slowest
+ * thing it can do, a downgrade the user never asked for and would have no way to notice.
+ *
+ * Set it after the {@link #setItems} that installs the set: a new set resets this along
+ * with everything else that was true of the old one.
+ */
+ public void setDefaultItem(@NonNull E item) {
+ int index = items.indexOf(item);
+ if (index < 0)
+ throw new IllegalArgumentException("Default item not found in items");
+ defaultIndex = index;
+ }
+
+ /** The default's index, or the first selectable item when the default is itself refused. */
+ private int fallbackIndex() {
+ if (defaultIndex >= 0 && defaultIndex < items.size()
+ && !disabled.contains(items.get(defaultIndex)))
+ return defaultIndex;
+ for (int i = 0; i < items.size(); i++)
+ if (!disabled.contains(items.get(i))) return i;
+ // Every item refused. Nothing here is selectable, so the head is as good an answer as any
+ // -- and better than leaving the picker with no selection for getSelectedItem() to fail on.
+ return 0;
+ }
+
+ /**
+ * Steps to the next item, refused ones skipped: the rotate-mode button's whole gesture.
+ *
+ * Rotation is the one way in that has no menu to grey a row out in, so the skip has to
+ * happen here. Without it the gesture walks onto values the dialog and the popup both refuse,
+ * which is the same picker answering the same question two ways.
+ */
+ public void selectNext() {
+ for (int step = 1; step <= items.size(); step++) {
+ var index = (selectedIndex + step) % items.size();
+ if (disabled.contains(items.get(index))) continue;
+ setSelectedIndex(index);
+ return;
+ }
}
@NonNull
@@ -170,6 +282,7 @@ public String getSelectedString() {
return item.name();
}
+ @SuppressWarnings("unused")
public int getItemCount() {
return items.size();
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/Enums.java b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/Enums.java
index 5918898f..251a0969 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/Enums.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/Enums.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.enums;
import android.widget.TextView;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/StringEnum.java b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/StringEnum.java
index dea25264..72d41928 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/enums/StringEnum.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/enums/StringEnum.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.enums;
import android.content.Context;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/BridgeType.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/BridgeType.java
index bd8f10da..1fa5e26b 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/BridgeType.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/BridgeType.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/Ipv6Source.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/Ipv6Source.java
index e27728bb..fae94108 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/Ipv6Source.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/Ipv6Source.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfig.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfig.java
index d44e27af..9ce83272 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfig.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfig.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfigValidator.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfigValidator.java
index 8ba24cfc..e02fc9d3 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfigValidator.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConfigValidator.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
@@ -18,6 +21,13 @@
* with a human-readable message on the first violation found.
*/
public final class NetworkConfigValidator {
+ /**
+ * Cap on a bridge interface name. 12, so the longest derived name still fits IFNAMSIZ (15
+ * usable): a per-VLAN bridge / trunk leg appends "v" or "." plus a 2-char VLAN code (bridge
+ * + 3). See LinuxNetwork.vlanCode / perVlanBridge.
+ */
+ public static final int MAX_BRIDGE_NAME_LEN = 12;
+
private NetworkConfigValidator() {
}
@@ -28,11 +38,9 @@ public static void validate(@NonNull NetworkConfig config) {
var bridgeName = config.getBridgeName();
if (bridgeName == null || !bridgeName.matches("[a-zA-Z][a-zA-Z0-9_-]*"))
throw new IllegalArgumentException(fmt("Invalid bridge name: %s", bridgeName));
- // Cap at 12 so the longest derived name still fits IFNAMSIZ (15 usable):
- // a per-VLAN bridge / trunk leg appends "v" or "." plus a 2-char VLAN
- // code (bridge + 3). See LinuxNetwork.vlanCode / perVlanBridge.
- if (bridgeName.length() > 12)
- throw new IllegalArgumentException("Bridge name longer than 12 characters");
+ if (bridgeName.length() > MAX_BRIDGE_NAME_LEN)
+ throw new IllegalArgumentException(fmt(
+ "Bridge name longer than %d characters", MAX_BRIDGE_NAME_LEN));
var type = config.getBridgeType();
var mode = config.getUplinkMode();
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConflicts.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConflicts.java
new file mode 100644
index 00000000..437e81aa
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkConflicts.java
@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.network;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+
+import cn.classfun.droidvm.lib.network.IPv4Network;
+import cn.classfun.droidvm.lib.network.IPv6Network;
+import cn.classfun.droidvm.lib.store.base.DataStore;
+
+/**
+ * What two networks may not share, and -- the point of this class -- which two networks that
+ * question is even asked about.
+ *
+ * An address conflict is a conflict only where both networks are actually seen by the same
+ * stack. Two Linux bridges route in the host kernel, so their prefixes must not overlap; two
+ * gVisor networks collide the same way inside their own user-space stacks. A Linux bridge and a
+ * gVisor network never see each other's routes at all -- gVisor's addressing lives entirely in
+ * its own process, the kernel has no idea the prefix exists -- so the same subnet on both is
+ * fine, and refusing it only costs the user address space for no reason. An L2 network has no
+ * prefix to conflict with in the first place; what it cannot share is the physical uplink it
+ * bridges onto, which one network at a time owns.
+ *
+ *
Names are the exception and are deliberately not scoped here: the display name and the
+ * bridge interface name stay unique app-wide across every kind, because they name a thing the
+ * user picks from one list and the host resolves in one namespace. Those are the store's
+ * {@code isNameUnique} / {@code isBridgeNameUnique}.
+ */
+public final class NetworkConflicts {
+ private NetworkConflicts() {
+ }
+
+ /** What collided. */
+ public enum Kind {
+ IPV4,
+ IPV6,
+ UPLINK,
+ }
+
+ /** One collision: what of ours hit what of theirs, and whose. */
+ public static final class Conflict {
+ @NonNull
+ public final Kind kind;
+ /** Our subnet / uplink, as text. */
+ @NonNull
+ public final String mine;
+ /** Theirs, as text. */
+ @NonNull
+ public final String theirs;
+ /** The network we collided with. */
+ @NonNull
+ public final NetworkConfig other;
+
+ Conflict(
+ @NonNull Kind kind,
+ @NonNull String mine,
+ @NonNull String theirs,
+ @NonNull NetworkConfig other
+ ) {
+ this.kind = kind;
+ this.mine = mine;
+ this.theirs = theirs;
+ this.other = other;
+ }
+
+ /** The other network's display name, never null for a message. */
+ @NonNull
+ public String otherName() {
+ var name = other.getName();
+ return name == null ? "" : name;
+ }
+ }
+
+ /**
+ * Whether a conflict between these two is even possible: same bridge type, and -- since an
+ * L2 network conflicts on its uplink and an L3 one on its prefixes -- same uplink mode. This
+ * is also exactly the set a packaged network may be imported into, so that every setting
+ * that is specific to a kind (L3 DHCP pool offsets, gVisor's IPv6 SNAT) carries over intact.
+ */
+ public static boolean sameKind(@NonNull NetworkConfig a, @NonNull NetworkConfig b) {
+ return a.getBridgeType() == b.getBridgeType()
+ && a.getUplinkMode() == b.getUplinkMode();
+ }
+
+ /** The first conflict between {@code cfg} and anything in the store, or null if it is free. */
+ @Nullable
+ public static Conflict find(
+ @NonNull NetworkConfig cfg,
+ @NonNull DataStore store,
+ @Nullable UUID exclude
+ ) {
+ return find(cfg, snapshot(store), exclude);
+ }
+
+ /** The same, against an explicit list. */
+ @Nullable
+ public static Conflict find(
+ @NonNull NetworkConfig cfg,
+ @NonNull List others,
+ @Nullable UUID exclude
+ ) {
+ var mine4 = new ArrayList();
+ var mine6 = new ArrayList();
+ collectSubnets(cfg.getVlans(), mine4, mine6);
+ var myUplink = cfg.getUplinkMode() == UplinkMode.L2 ? cfg.getL2Uplink() : null;
+ for (var other : others) {
+ if (exclude != null && exclude.toString().equals(other.item.optString("id", "")))
+ continue;
+ if (!sameKind(cfg, other)) continue;
+ if (myUplink != null) {
+ var theirs = other.getL2Uplink();
+ if (theirs != null && theirs.trim().equalsIgnoreCase(myUplink.trim()))
+ return new Conflict(Kind.UPLINK, myUplink, theirs, other);
+ continue;
+ }
+ var conflict = findAddressConflict(mine4, mine6, other);
+ if (conflict != null) return conflict;
+ }
+ return null;
+ }
+
+ @Nullable
+ private static Conflict findAddressConflict(
+ @NonNull List mine4,
+ @NonNull List mine6,
+ @NonNull NetworkConfig other
+ ) {
+ var their4 = new ArrayList();
+ var their6 = new ArrayList();
+ collectSubnets(other.getVlans(), their4, their6);
+ for (var mine : mine4)
+ for (var theirs : their4)
+ if (mine.overlaps(theirs)) return new Conflict(
+ Kind.IPV4, mine.toString(), theirs.toString(), other);
+ for (var mine : mine6)
+ for (var theirs : their6)
+ if (mine.overlaps(theirs)) return new Conflict(
+ Kind.IPV6, mine.toString(), theirs.toString(), other);
+ return null;
+ }
+
+ /**
+ * The first pair of this config's own subnets that overlap each other, as {@code {a, b}}, or
+ * null when it is self-consistent. Not scoped by anything: one network's VLANs share a stack
+ * by definition.
+ */
+ @Nullable
+ public static String[] findSelfOverlap(@NonNull NetworkConfig cfg) {
+ var mine4 = new ArrayList();
+ var mine6 = new ArrayList();
+ collectSubnets(cfg.getVlans(), mine4, mine6);
+ for (int i = 0; i < mine4.size(); i++)
+ for (int j = i + 1; j < mine4.size(); j++)
+ if (mine4.get(i).overlaps(mine4.get(j))) return new String[]{
+ mine4.get(i).toString(), mine4.get(j).toString()};
+ for (int i = 0; i < mine6.size(); i++)
+ for (int j = i + 1; j < mine6.size(); j++)
+ if (mine6.get(i).overlaps(mine6.get(j))) return new String[]{
+ mine6.get(i).toString(), mine6.get(j).toString()};
+ return null;
+ }
+
+ /** Appends every subnet these VLANs hold, primary and secondary, to the given lists. */
+ public static void collectSubnets(
+ @NonNull Iterable vlans,
+ @NonNull List out4,
+ @NonNull List out6
+ ) {
+ for (var vlan : vlans) {
+ var net4 = vlan.getIpv4Network();
+ if (net4 != null) out4.add(net4);
+ for (var cidr : vlan.getIpv4Secondary()) {
+ try {
+ out4.add(IPv4Network.parse(cidr));
+ } catch (Exception ignored) {
+ }
+ }
+ var net6 = vlan.getIpv6Network();
+ if (net6 != null) out6.add(net6);
+ for (var cidr : vlan.getIpv6Secondary()) {
+ try {
+ out6.add(IPv6Network.parse(cidr));
+ } catch (Exception ignored) {
+ }
+ }
+ }
+ }
+
+ /** Every config in a store, as a plain list. */
+ @NonNull
+ public static List snapshot(@NonNull DataStore store) {
+ var out = new ArrayList();
+ for (int i = 0; i < store.size(); i++) out.add(store.get(i));
+ return out;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkState.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkState.java
index e46628c1..ff565547 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkState.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkState.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import androidx.annotation.ColorRes;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkStore.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkStore.java
index b2b7f7d8..6e160edb 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkStore.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/NetworkStore.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/UplinkMode.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/UplinkMode.java
index b5a6d013..cd0468e3 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/UplinkMode.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/UplinkMode.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/network/VlanConfig.java b/app/src/main/java/cn/classfun/droidvm/lib/store/network/VlanConfig.java
index 8bf15f15..ca416143 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/network/VlanConfig.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/network/VlanConfig.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.network;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/BootConfig.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/BootConfig.java
index 97a0f551..d0f79e19 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/BootConfig.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/BootConfig.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.vm;
import androidx.annotation.NonNull;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/CpuPlacementDraft.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/CpuPlacementDraft.java
new file mode 100644
index 00000000..15ef0ab8
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/CpuPlacementDraft.java
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.NonNull;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * A vCPU placement as the editor holds it, before it becomes a
+ * {@link CpuPlacementPlan}: the affinity map, the CPU count it is keyed
+ * against, and the guest topology fields that describe it.
+ *
+ * These five travel together everywhere -- they are one decision seen from
+ * several sides, which {@link CpuPlacementPlan} explains -- so they cross the
+ * editor/dialog boundary as one value instead of five positional arguments.
+ * The affinity map is copied in, so a draft cannot be edited through the map
+ * the caller still holds.
+ */
+public final class CpuPlacementDraft {
+ /** vCPU index to the host cores it may run on; ordered, never null. */
+ @NonNull
+ public final Map> affinity;
+ /** The VM's CPU count. Simple mode derives it from the bound host cores. */
+ public final int vcpuCount;
+ /** Derive guest capacity/cluster from the affinity instead of the fields below. */
+ public final boolean auto;
+ /** Hand-written {@code --cpu-capacity}, only meaningful when {@link #auto} is off. */
+ @NonNull
+ public final String manualCapacity;
+ /** Hand-written {@code --cpu-cluster}, only meaningful when {@link #auto} is off. */
+ @NonNull
+ public final String manualClusters;
+
+ public CpuPlacementDraft(
+ @NonNull Map> affinity,
+ int vcpuCount,
+ boolean auto,
+ @NonNull String manualCapacity,
+ @NonNull String manualClusters
+ ) {
+ this.affinity = CpuPlacementPlan.orderedCopy(affinity);
+ this.vcpuCount = Math.max(1, vcpuCount);
+ this.auto = auto;
+ this.manualCapacity = manualCapacity;
+ this.manualClusters = manualClusters;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/CpuPlacementPlan.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/CpuPlacementPlan.java
new file mode 100644
index 00000000..1fe87831
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/CpuPlacementPlan.java
@@ -0,0 +1,411 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import static cn.classfun.droidvm.lib.utils.StringUtils.fmt;
+
+import androidx.annotation.NonNull;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.NavigableMap;
+import java.util.TreeMap;
+import java.util.TreeSet;
+
+import cn.classfun.droidvm.lib.store.base.DataItem;
+import cn.classfun.droidvm.lib.utils.CpuUtils;
+
+/**
+ * Where a VM's vCPUs run on the host, and what the guest is told about it.
+ *
+ * The three crosvm flags this resolves are one decision seen from three
+ * sides, not independent knobs:
+ *
+ * - {@code --cpu-affinity} pins each vCPU thread to host cores.
+ *
- {@code --cpu-capacity} writes {@code capacity-dmips-mhz} into the guest
+ * device tree, so the guest scheduler knows how strong each vCPU is.
+ *
- {@code --cpu-cluster} writes the guest {@code cpu-map}, so the guest
+ * sees the same big/little split as the host.
+ *
+ * The last two are keyed by guest vCPU index and their correct values
+ * follow from the first plus host topology, which is why {@link #KEY_AUTO}
+ * (default on) derives them and the manual fields only exist as an override.
+ *
+ * Syntax matters here: crosvm's per-vCPU affinity form separates assignments
+ * with {@code ':'} and uses {@code ','} only inside one assignment's host set,
+ * i.e. {@code 0=4,5:1=6} means vCPU0 floats over host cores 4 and 5 while vCPU1
+ * is pinned to core 6. A vCPU absent from the map gets no mask at all.
+ */
+public final class CpuPlacementPlan {
+ public static final String KEY_AFFINITY = "cpu_affinity";
+ public static final String KEY_AUTO = "cpu_topology_auto";
+ public static final String KEY_CAPACITY = "cpu_capacity";
+ public static final String KEY_CLUSTERS = "cpu_clusters";
+ public static final String KEY_GPU_CGROUP = "gpu_cgroup_enabled";
+ public static final String KEY_GPU_CGROUP_PATH = "gpu_cgroup_path";
+ public static final String KEY_GPU_CGROUP_CPUS = "gpu_cgroup_cpus";
+
+ public static final String DEFAULT_GPU_CGROUP_PATH = "/dev/cpuset/gpuworker";
+ /** Separates clusters in the stored {@link #KEY_CLUSTERS} string. */
+ private static final String CLUSTER_SEP = ";";
+
+ /** vCPU index to the host cores it may run on; ascending, never null. */
+ @NonNull
+ public final Map> affinity;
+ /** vCPU index to guest-visible capacity; only for vCPUs that have one. */
+ @NonNull
+ public final Map capacity;
+ /** Guest cluster membership, each entry a set of vCPU indices. */
+ @NonNull
+ public final List> clusters;
+
+ private CpuPlacementPlan(
+ @NonNull Map> affinity,
+ @NonNull Map capacity,
+ @NonNull List> clusters
+ ) {
+ this.affinity = affinity;
+ this.capacity = capacity;
+ this.clusters = clusters;
+ }
+
+ /**
+ * Resolve a stored config into the placement actually to be applied. An
+ * empty affinity string yields an empty plan: capacity and clusters are
+ * dropped along with it, since without knowing which host core backs a vCPU
+ * there is nothing truthful to tell the guest.
+ */
+ @NonNull
+ public static CpuPlacementPlan of(@NonNull DataItem item) {
+ var affinity = parseAffinity(item.optString(KEY_AFFINITY, ""));
+ if (affinity.isEmpty())
+ return new CpuPlacementPlan(affinity, new TreeMap<>(), new ArrayList<>());
+ if (item.optBoolean(KEY_AUTO, true)) {
+ var cap = deriveCapacity(affinity, CpuUtils.getCores());
+ int vcpuCount = (int) Math.max(item.optLong("cpu_count", 1), 1);
+ return new CpuPlacementPlan(affinity, cap, deriveClusters(cap, vcpuCount));
+ }
+ return new CpuPlacementPlan(
+ affinity,
+ parseCapacity(item.optString(KEY_CAPACITY, "")),
+ parseClusters(item.optString(KEY_CLUSTERS, ""))
+ );
+ }
+
+ /** Appends the crosvm flags for this plan; a no-op when no vCPU is pinned. */
+ public void appendArgs(@NonNull List args) {
+ if (affinity.isEmpty()) return;
+ args.add("--cpu-affinity");
+ args.add(formatAffinity(affinity));
+ if (!capacity.isEmpty()) {
+ args.add("--cpu-capacity");
+ args.add(formatCapacity(capacity));
+ }
+ // One flag per cluster; a lone cluster is what crosvm does by default
+ // anyway, so it is not worth an FDT cpu-map.
+ if (clusters.size() > 1) {
+ for (var cluster : clusters) {
+ if (cluster.isEmpty()) continue;
+ args.add("--cpu-cluster");
+ args.add(CpuUtils.compactRanges(joinCsv(cluster)));
+ }
+ }
+ }
+
+ /**
+ * Whether this VM's GPU worker cpuset should be built and named at all.
+ *
+ * Two conditions, because the switch alone was never the whole question: what
+ * {@code --gpu-cgroup-path} moves into the cpuset is the virtio-gpu device's worker threads,
+ * and a VM without that device has none. Emitting it there handed crosvm a flag with nothing
+ * to put in the group and left a directory on the host that no thread would ever join. The
+ * editor says the same thing in its own way -- the rows live inside the renderer section, so
+ * they grey out with the device -- but the stored switch outlives that, both from a config
+ * written before the device was turned off and from a file edited by hand.
+ */
+ public static boolean wantsGpuCgroup(@NonNull DataItem item) {
+ return item.optBoolean(KEY_GPU_CGROUP, false) && VMScreenConfig.hasGpuDevice(item);
+ }
+
+ // --- affinity ---
+
+ /**
+ * Parse the per-vCPU affinity form. Assignments are {@code ':'}-separated
+ * and each maps one vCPU to a CPUSET; malformed assignments and empty host
+ * sets are dropped. The plain global-CPUSET form crosvm also accepts is not
+ * represented here -- the editor always writes per-vCPU assignments -- so a
+ * hand-written global mask parses to empty and is simply not carried over.
+ */
+ @NonNull
+ public static Map> parseAffinity(@NonNull String spec) {
+ var out = new TreeMap>();
+ if (spec.trim().isEmpty()) return out;
+ for (var assignment : spec.split(":")) {
+ assignment = assignment.trim();
+ if (assignment.isEmpty()) continue;
+ int eq = assignment.indexOf('=');
+ if (eq <= 0) continue;
+ int vcpu;
+ try {
+ vcpu = Integer.parseInt(assignment.substring(0, eq).trim());
+ } catch (NumberFormatException e) {
+ continue;
+ }
+ if (vcpu < 0) continue;
+ var hosts = CpuUtils.parseCpuSet(assignment.substring(eq + 1));
+ if (hosts.isEmpty()) continue;
+ out.put(vcpu, hosts);
+ }
+ return out;
+ }
+
+ @NonNull
+ public static String formatAffinity(@NonNull Map> affinity) {
+ var sb = new StringBuilder();
+ for (var entry : new TreeMap<>(affinity).entrySet()) {
+ if (entry.getValue().isEmpty()) continue;
+ if (sb.length() > 0) sb.append(':');
+ sb.append(entry.getKey()).append('=')
+ .append(CpuUtils.compactRanges(joinCsv(entry.getValue())));
+ }
+ return sb.toString();
+ }
+
+ /**
+ * True when {@code affinity} is exactly what the editor's simple mode can
+ * express: every vCPU below {@code vcpuCount} bound to one host core of its
+ * own, no core shared, and nothing bound past the count. A vCPU floating
+ * over several cores, an unbound vCPU or two vCPUs on one core all need the
+ * per-vCPU editor to be described, and answer false here.
+ */
+ public static boolean isOneToOne(
+ @NonNull Map> affinity, int vcpuCount
+ ) {
+ if (vcpuCount <= 0 || affinity.size() != vcpuCount) return false;
+ var hosts = new TreeSet();
+ for (int vcpu = 0; vcpu < vcpuCount; vcpu++) {
+ var bound = affinity.get(vcpu);
+ if (bound == null || bound.size() != 1) return false;
+ if (!hosts.add(bound.get(0))) return false;
+ }
+ return true;
+ }
+
+ /**
+ * The 1:1 map over {@code hostCores}: lowest core index becomes vCPU 0, the
+ * next vCPU 1, and so on. Inverse of {@link #oneToOneHosts}.
+ */
+ @NonNull
+ public static Map> oneToOne(@NonNull Collection hostCores) {
+ var out = new TreeMap>();
+ int vcpu = 0;
+ for (var host : new TreeSet<>(hostCores))
+ out.put(vcpu++, new ArrayList<>(List.of(host)));
+ return out;
+ }
+
+ /**
+ * The host cores a 1:1 map pins, ascending; empty when the map is not 1:1
+ * over {@code vcpuCount} vCPUs.
+ */
+ @NonNull
+ public static List oneToOneHosts(
+ @NonNull Map> affinity, int vcpuCount
+ ) {
+ if (!isOneToOne(affinity, vcpuCount)) return new ArrayList<>();
+ var hosts = new TreeSet();
+ for (var bound : affinity.values()) hosts.add(bound.get(0));
+ return new ArrayList<>(hosts);
+ }
+
+ /**
+ * The 1:1 selection closest to an arbitrary map, for the advanced-to-simple
+ * switch: each vCPU in turn keeps the lowest core it is bound to that an
+ * earlier vCPU has not already claimed; its remaining cores, and a vCPU left
+ * with nothing to claim, are dropped. Ascending, so the result can be handed
+ * straight to {@link #oneToOne} -- which is why the vCPU a core ends up on
+ * need not be the one it came from.
+ */
+ @NonNull
+ public static List flattenToOneToOne(
+ @NonNull Map> affinity
+ ) {
+ var taken = new TreeSet();
+ for (var entry : new TreeMap<>(affinity).entrySet()) {
+ for (var host : entry.getValue())
+ if (taken.add(host)) break;
+ }
+ return new ArrayList<>(taken);
+ }
+
+ // --- capacity ---
+
+ /** Parse {@code 0=792,6=1024}; unparsable pairs are dropped. */
+ @NonNull
+ public static Map parseCapacity(@NonNull String spec) {
+ var out = new TreeMap();
+ for (var pair : spec.split(",")) {
+ pair = pair.trim();
+ if (pair.isEmpty()) continue;
+ int eq = pair.indexOf('=');
+ if (eq <= 0) continue;
+ try {
+ var vcpu = Integer.parseInt(pair.substring(0, eq).trim());
+ var cap = Long.parseLong(pair.substring(eq + 1).trim());
+ if (vcpu >= 0 && cap > 0) out.put(vcpu, cap);
+ } catch (NumberFormatException ignored) {
+ }
+ }
+ return out;
+ }
+
+ @NonNull
+ public static String formatCapacity(@NonNull Map capacity) {
+ var sb = new StringBuilder();
+ for (var entry : new TreeMap<>(capacity).entrySet()) {
+ if (sb.length() > 0) sb.append(',');
+ sb.append(fmt("%d=%d", entry.getKey(), entry.getValue()));
+ }
+ return sb.toString();
+ }
+
+ /**
+ * Capacity of each pinned vCPU: the weakest host core it can land on. Taking
+ * the minimum rather than the maximum keeps the guest scheduler honest -- a
+ * vCPU floating across a little and a big core can end up on the little one,
+ * and promising the big core's capacity would make the guest over-commit it.
+ */
+ @NonNull
+ public static Map deriveCapacity(
+ @NonNull Map> affinity,
+ @NonNull List cores
+ ) {
+ var byIndex = new TreeMap();
+ for (var core : cores) byIndex.put(core.index, core.capacity);
+ var out = new TreeMap();
+ for (var entry : affinity.entrySet()) {
+ long min = 0;
+ for (var host : entry.getValue()) {
+ var cap = byIndex.get(host);
+ if (cap == null || cap <= 0) continue;
+ min = min == 0 ? cap : Math.min(min, cap);
+ }
+ if (min > 0) out.put(entry.getKey(), min);
+ }
+ return out;
+ }
+
+ // --- clusters ---
+
+ /** Parse {@code 0-5;6} into one vCPU list per cluster. */
+ @NonNull
+ public static List> parseClusters(@NonNull String spec) {
+ var out = new ArrayList>();
+ for (var group : spec.split(CLUSTER_SEP)) {
+ var members = CpuUtils.parseCpuSet(group);
+ if (!members.isEmpty()) out.add(members);
+ }
+ return out;
+ }
+
+ @NonNull
+ public static String formatClusters(@NonNull List> clusters) {
+ var sb = new StringBuilder();
+ for (var cluster : clusters) {
+ if (cluster.isEmpty()) continue;
+ if (sb.length() > 0) sb.append(CLUSTER_SEP);
+ sb.append(CpuUtils.compactRanges(joinCsv(cluster)));
+ }
+ return sb.toString();
+ }
+
+ /**
+ * The vCPUs sharing each capacity value, weakest capacity first. Both the
+ * cluster split and the UI's capacity summary are views of this grouping.
+ */
+ @NonNull
+ public static NavigableMap> groupByCapacity(
+ @NonNull Map capacity) {
+ var byCapacity = new TreeMap>();
+ for (var entry : new TreeMap<>(capacity).entrySet()) {
+ byCapacity.computeIfAbsent(entry.getValue(), k -> new ArrayList<>())
+ .add(entry.getKey());
+ }
+ return byCapacity;
+ }
+
+ /**
+ * Group vCPUs of equal capacity into one cluster each, weakest first, which
+ * reproduces the host's big/little split on the guest side.
+ *
+ * Every vCPU below {@code vcpuCount} lands in exactly one cluster: crosvm
+ * builds the guest {@code cpu-map} all-or-nothing, so a vCPU left out of the
+ * cluster list would get no topology placement at all while its siblings do.
+ * An unpinned vCPU floats across every host core, so the weakest cluster is
+ * both the truthful and the conservative home for it.
+ */
+ @NonNull
+ public static List> deriveClusters(
+ @NonNull Map capacity, int vcpuCount) {
+ var byCapacity = groupByCapacity(capacity);
+ if (byCapacity.isEmpty()) return new ArrayList<>();
+ var weakest = byCapacity.firstEntry().getValue();
+ for (int vcpu = 0; vcpu < vcpuCount; vcpu++) {
+ if (!capacity.containsKey(vcpu)) weakest.add(vcpu);
+ }
+ weakest.sort(Integer::compareTo);
+ return new ArrayList<>(byCapacity.values());
+ }
+
+ // --- shared helpers ---
+
+ /** vCPU indices that appear in more than one cluster (crosvm rejects those). */
+ @NonNull
+ public static List findClusterOverlaps(@NonNull List> clusters) {
+ var seen = new TreeSet();
+ var dupes = new TreeSet();
+ for (var cluster : clusters)
+ for (var vcpu : cluster)
+ if (!seen.add(vcpu)) dupes.add(vcpu);
+ return new ArrayList<>(dupes);
+ }
+
+ /** Host cores shared between a vCPU affinity map and a CPUSET spec. */
+ @NonNull
+ public static List findHostOverlaps(
+ @NonNull Map> affinity,
+ @NonNull String cpuSet
+ ) {
+ var other = new TreeSet<>(CpuUtils.parseCpuSet(cpuSet));
+ var shared = new TreeSet();
+ for (var hosts : affinity.values())
+ for (var host : hosts)
+ if (other.contains(host)) shared.add(host);
+ return new ArrayList<>(shared);
+ }
+
+ /** Ordered copy keyed by vCPU, so callers can edit without losing order. */
+ @NonNull
+ public static Map> orderedCopy(
+ @NonNull Map> affinity
+ ) {
+ var out = new LinkedHashMap>();
+ for (var entry : new TreeMap<>(affinity).entrySet())
+ out.put(entry.getKey(), new ArrayList<>(entry.getValue()));
+ return out;
+ }
+
+ @NonNull
+ private static String joinCsv(@NonNull List values) {
+ var sb = new StringBuilder();
+ for (var value : values) {
+ if (sb.length() > 0) sb.append(',');
+ sb.append(value);
+ }
+ return sb.toString();
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayBackend.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayBackend.java
index c8d91240..4735a92e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayBackend.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayBackend.java
@@ -1,43 +1,18 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.vm;
-import androidx.annotation.StringRes;
-
-import cn.classfun.droidvm.R;
-import cn.classfun.droidvm.lib.store.enums.StringEnum;
-
-public enum DisplayBackend implements StringEnum {
- NONE(0, "none", R.string.nullptr),
- SIMPLEFB(1, "simple", R.string.create_vm_display_backend_simplefb),
- VIRTIO_GPU(2, "virtio-gpu", R.string.create_vm_display_backend_virtio_gpu);
-
- private final int value;
- private final String name;
- private final @StringRes int stringId;
-
- DisplayBackend(int value, String name, @StringRes int stringId) {
- this.value = value;
- this.name = name;
- this.stringId = stringId;
- }
-
- @SuppressWarnings("unused")
- public int getValue() {
- return value;
- }
-
- @SuppressWarnings("unused")
- public String getName() {
- return name;
- }
-
- @Override
- @StringRes
- public int getStringId() {
- return stringId;
- }
-
- @Override
- public boolean isDisplay() {
- return stringId != R.string.nullptr;
- }
+/**
+ * The legacy either/or display producer: one display, and this said which device made it.
+ *
+ * Superseded by {@link VMScreenConfig} -- the two devices are independent screens now, and a
+ * VM can have both -- so nothing reads this except {@link VMScreenConfig#migrate}, which reads
+ * each old config's value exactly once and then drops the key. It is no longer a
+ * {@code StringEnum} and carries no labels: it is never shown, only decoded.
+ */
+public enum DisplayBackend {
+ NONE,
+ SIMPLEFB,
+ VIRTIO_GPU,
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayExporter.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayExporter.java
new file mode 100644
index 00000000..28280252
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayExporter.java
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.StringRes;
+
+import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.lib.store.enums.StringEnum;
+
+/**
+ * Who consumes one screen's frames -- the export side of a {@link VMScreenConfig} binding.
+ *
+ * A screen drives at most one exporter. That is a decision, not a limitation waiting to be
+ * lifted: the alternative to the old silent race (two sinks configured, VNC wins, the app's
+ * Surface never gets a binder) was either mirroring or an error, and this picks the error.
+ * crosvm enforces the same rule on its side and refuses to start a VM with two exporters on
+ * one screen, so the editor must never write one.
+ *
+ * The names are persisted, so they are the stable part; they say nothing about which screen
+ * the binding is on, because that is the key the binding is stored under.
+ */
+public enum DisplayExporter implements StringEnum {
+ // Declaration order is the picker's row order: EnumPicker.autoItems() walks
+ // getEnumConstants() and appends, with no comparator anywhere. So the two exporters lead and
+ // the sink comes last. Reordering is safe because nothing here is ordinal-shaped -- the
+ // stored value is name().toLowerCase(), nothing in the tree reads ordinal() or getValue() on
+ // this enum, and the picker's initial selection is set by configure(cls, value) rather than
+ // by which constant happens to be first.
+ NATIVE(1, "native", R.string.create_vm_screen_exporter_native),
+ VNC(2, "vnc", R.string.create_vm_screen_exporter_vnc),
+ // Unlike the NONE sentinels of the other persisted enums, this one is a real, selectable
+ // choice: a screen nobody is watching is a state, not a fault -- crosvm accepts it too. So
+ // it carries a label instead of R.string.nullptr; a nullptr entry reports isDisplay() ==
+ // false and EnumPicker.autoItems() would drop it from the picker. The label says sink rather
+ // than none because the screen still exists and still produces frames; they go nowhere.
+ NONE(0, "none", R.string.create_vm_screen_exporter_none);
+
+ private final int value;
+ private final String name;
+ private final @StringRes int stringId;
+
+ DisplayExporter(int value, String name, @StringRes int stringId) {
+ this.value = value;
+ this.name = name;
+ this.stringId = stringId;
+ }
+
+ @SuppressWarnings("unused")
+ public int getValue() {
+ return value;
+ }
+
+ @SuppressWarnings("unused")
+ public String getName() {
+ return name;
+ }
+
+ @Override
+ @StringRes
+ public int getStringId() {
+ return stringId;
+ }
+
+ @Override
+ public boolean isDisplay() {
+ return stringId != R.string.nullptr;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayTransportCap.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayTransportCap.java
new file mode 100644
index 00000000..8837fd44
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/DisplayTransportCap.java
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+import androidx.annotation.StringRes;
+
+import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.lib.store.enums.StringEnum;
+
+/**
+ * How far up the pipeline one screen's frames are allowed to travel to reach its exporter.
+ *
+ *
The transport is not a property of the screen or of the exporter but of the edge between
+ * them, and it is negotiated: the source says what it can produce (CPU bytes, a dmabuf), the
+ * exporter says what it can consume, and the highest rung both reach wins. So it is not a thing
+ * the user picks outright. What the user can have is a ceiling, and that distinction is
+ * the whole reason this enum reads the way it does.
+ *
+ * It only restricts downward. The transport is settled at or below the rung named here,
+ * so every value is always satisfiable -- CPU copy is the bottom of the ladder and needs nothing
+ * from either end. "At least GPU copy" would not be: a source that cannot export a dmabuf leaves
+ * only a silent downgrade (which looks like success and is not) or a loud failure (a VM that
+ * refuses to start over a preference). A ceiling has neither failure mode. It is also why there is
+ * no separate "automatic" entry -- the top rung of the offered set already is automatic.
+ *
+ * The ladder is not the same on every edge, because the rung above a copy is a different
+ * mechanism on each. The native display can be lent a render target the guest draws straight into
+ * ({@link #ZERO}) -- but only when the guest's rendering can be aimed at it, which rules simplefb
+ * out: its framebuffer is a fixed window of guest memory named in the device tree, and no
+ * AHardwareBuffer can be made to wrap that. VNC has nowhere to lend a target at all, and its rung
+ * above a GPU blit is handing the frame to a hardware video encoder instead of an RFB rectangle
+ * ({@link #GPU_HW}). So the offered set is a function of both ends, and {@link #optionsFor} is
+ * where that lives.
+ *
+ * Rungs that are designed but not built are offered and refused rather than hidden: the ladder
+ * is easier to understand whole, and a value that appears later must not look like a new feature
+ * arriving out of nowhere. {@link #isImplemented} says which is which today.
+ */
+public enum DisplayTransportCap implements StringEnum {
+ /** Always reachable: host memcpy into the sink's own buffer. The bottom of every ladder. */
+ CPU(0, "cpu", R.string.create_vm_screen_transport_cpu),
+ /** A Vulkan blit on the host, which gets a format conversion thrown in for free. */
+ GPU(1, "gpu", R.string.create_vm_screen_transport_gpu),
+ /** Native display only: the sink lends its render target and the content never crosses. */
+ ZERO(2, "zero", R.string.create_vm_screen_transport_zero),
+ /** VNC only: the blit's result goes to a hardware video encoder rather than into RFB. */
+ GPU_HW(3, "gpu-hw", R.string.create_vm_screen_transport_gpu_hw);
+
+ /**
+ * The width granularity a screen whose stride is exactly {@code width * 4} needs before the
+ * GPU copy can take it, in pixels.
+ *
+ * The blit imports the frame as a LINEAR dma-buf and turnip accepts one only when its row
+ * pitch is 64-byte aligned. A virtio-gpu scanout is allocated by the host and rounded up to
+ * whatever the importer wants, so it never meets this rule by accident -- it meets it by
+ * construction. simplefb's framebuffer is a window of guest memory the device tree already
+ * described, {@code width * 4} bytes per row with nothing to pad it with, so there the whole
+ * rule collapses to {@code width * 4 % 64 == 0}, which is this. Measured on device: 1400 falls
+ * back to the CPU copy, 1408 does not.
+ */
+ public static final long GPU_COPY_WIDTH_ALIGN = 16;
+
+ private final int value;
+ private final String token;
+ private final @StringRes int stringId;
+
+ DisplayTransportCap(int value, String token, @StringRes int stringId) {
+ this.value = value;
+ this.token = token;
+ this.stringId = stringId;
+ }
+
+ @SuppressWarnings("unused")
+ public int getValue() {
+ return value;
+ }
+
+ /**
+ * The stored spelling, which is also the token crosvm's {@code transport-cap=} takes. Lower
+ * case and hyphenated, unlike the other persisted enums, because this one is written onto a
+ * command line as well as into the config and one value must not have two spellings. That is
+ * also why it is parsed by {@link #fromToken} rather than by the generic enum helper, whose
+ * upper-casing cannot round-trip a hyphen.
+ */
+ @NonNull
+ public String getToken() {
+ return token;
+ }
+
+ @Override
+ @StringRes
+ public int getStringId() {
+ return stringId;
+ }
+
+ @Override
+ public boolean isDisplay() {
+ return stringId != R.string.nullptr;
+ }
+
+ /** The stored token back to a constant, or null for absent, empty or unrecognised. */
+ @Nullable
+ public static DisplayTransportCap fromToken(@Nullable String stored) {
+ if (stored == null || stored.isEmpty()) return null;
+ for (var cap : values())
+ if (cap.token.equalsIgnoreCase(stored)) return cap;
+ return null;
+ }
+
+ /**
+ * The ladder this (screen, exporter) edge has, bottom rung first.
+ *
+ * Both ends decide it, which is why the screen is a parameter. The native display's top
+ * rung is a render target it lends the guest to draw into -- and simplefb cannot be drawn into
+ * that way at all: its framebuffer is a fixed window of guest memory the guest was told about
+ * in the device tree, and an AHardwareBuffer cannot be made to wrap it. That rung is not
+ * "unbuilt" there, it is unreachable, so it is absent rather than greyed. Offering it would be
+ * describing a choice nobody will ever be able to make.
+ *
+ * An exporter with no edge -- nobody is watching the screen -- has no ladder, and the empty
+ * array is how callers know not to offer one rather than having to ask the question twice.
+ */
+ @NonNull
+ public static DisplayTransportCap[] optionsFor(@NonNull String screenId,
+ @NonNull DisplayExporter exporter) {
+ switch (exporter) {
+ case NATIVE:
+ return VMScreenConfig.ID_GPU0.equals(screenId)
+ ? new DisplayTransportCap[]{CPU, GPU, ZERO}
+ : new DisplayTransportCap[]{CPU, GPU};
+ case VNC:
+ return new DisplayTransportCap[]{CPU, GPU, GPU_HW};
+ default:
+ return new DisplayTransportCap[0];
+ }
+ }
+
+ /** Whether [cap] is one of the rungs this edge has at all. */
+ public static boolean isOfferedFor(@NonNull String screenId,
+ @NonNull DisplayExporter exporter,
+ @NonNull DisplayTransportCap cap) {
+ for (var option : optionsFor(screenId, exporter))
+ if (option == cap) return true;
+ return false;
+ }
+
+ /**
+ * Whether this build can actually reach [cap] on this edge.
+ *
+ * VNC's ladder is now built to the top: the same blit that feeds an RFB rectangle can feed a
+ * hardware H.264 encoder instead, and the app's own console reads the result off a side channel
+ * beside the RFB port. What is left unbuilt is zero copy on the native display. Unimplemented
+ * rungs are still offered -- see the class comment -- so this is what decides which of them the
+ * picker refuses.
+ *
+ * The two exporters no longer answer the same way, which is the point: they climbed to
+ * different heights by different mechanisms, and writing that as one shared list of caps would
+ * have made the day VNC overtook the native display look like a typo.
+ */
+ public static boolean isImplemented(@NonNull DisplayExporter exporter,
+ @NonNull DisplayTransportCap cap) {
+ switch (exporter) {
+ case NATIVE:
+ return cap == CPU || cap == GPU;
+ case VNC:
+ return cap == CPU || cap == GPU || cap == GPU_HW;
+ default:
+ return false;
+ }
+ }
+
+ /** The rungs this edge shows but cannot honour yet, in {@link #optionsFor} order. */
+ @NonNull
+ public static DisplayTransportCap[] unimplementedFor(@NonNull String screenId,
+ @NonNull DisplayExporter exporter) {
+ var options = optionsFor(screenId, exporter);
+ var n = 0;
+ for (var option : options)
+ if (!isImplemented(exporter, option)) n++;
+ var out = new DisplayTransportCap[n];
+ var i = 0;
+ for (var option : options)
+ if (!isImplemented(exporter, option)) out[i++] = option;
+ return out;
+ }
+
+ /**
+ * Whether a GPU-copy ceiling on this edge will settle on the CPU copy anyway, because the
+ * screen is [width] pixels wide and the blit cannot import a frame that shape.
+ *
+ * This is the negotiation working exactly as designed -- the ceiling only restricts
+ * downward, so nothing here is a misconfiguration and nothing needs refusing. But it is the one
+ * downgrade whose cause is a number the user typed rather than a rung the build has not
+ * reached, so it is the one worth saying out loud in the editor: a width off by eight pixels
+ * costs the whole GPU path and there is no other way to find that out.
+ *
+ * Only simplefb has the constraint, and only where the ceiling actually asks for a blit --
+ * see {@link #GPU_COPY_WIDTH_ALIGN}. Asking {@link #isImplemented} rather than naming the
+ * native display is what made VNC's GPU half inherit the rule the day it landed: it imports the
+ * same dma-buf under the same 64-byte pitch rule, and this condition did not have to be found
+ * and changed for the warning to start appearing there.
+ *
+ * The encoder rung asks for the same import -- it is the same blit with a different
+ * destination -- so it is named here too. It had to be: the moment VNC's default rose to it,
+ * a condition that only knew about {@link #GPU} would have gone quiet for exactly the
+ * configuration it was written for, and a warning that disappears when the default moves is
+ * indistinguishable from one that was never right.
+ */
+ public static boolean cpuFallbackFromWidth(@NonNull String screenId,
+ @NonNull DisplayExporter exporter,
+ @NonNull DisplayTransportCap ceiling,
+ long width) {
+ if (!VMScreenConfig.ID_SIMPLEFB.equals(screenId)) return false;
+ if (ceiling != GPU && ceiling != GPU_HW) return false;
+ if (!isImplemented(exporter, ceiling)) return false;
+ return width % GPU_COPY_WIDTH_ALIGN != 0;
+ }
+
+ /**
+ * The ceiling a screen gets when it has not named one: the highest rung this build can
+ * actually reach on that edge.
+ *
+ * Not the highest rung offered -- that would default every VM to a ceiling nothing can
+ * satisfy today, which is a promise the negotiation would quietly break. It is the highest
+ * implemented one, so the default never restricts anything that works, and it rises
+ * on its own as the rungs land.
+ *
+ * Which is how VNC's default became the hardware encoder, and that reads more
+ * expensive than it is. A ceiling is not a request: the encoder is built when a client opens
+ * the H.264 side channel and never otherwise, so a VM at this default that nobody watches over
+ * that channel does exactly what the same VM did at the GPU rung -- one blit, an RFB rectangle,
+ * no encoder. Every ordinary RFB client keeps working unchanged; what the top rung buys is that
+ * the app's own console can ask for H.264 instead of pixels.
+ */
+ @NonNull
+ public static DisplayTransportCap defaultFor(@NonNull String screenId,
+ @NonNull DisplayExporter exporter) {
+ var best = CPU;
+ for (var option : optionsFor(screenId, exporter))
+ if (isImplemented(exporter, option)) best = option;
+ return best;
+ }
+
+ /**
+ * The token {@code transport-cap=} should carry for this binding, or null to send no flag.
+ *
+ * A ceiling at the top of what this build can reach is the same instruction as no ceiling at
+ * all, so the flag is written only when it says something the host would not work out on its
+ * own: the user asked for less than the pipeline could have given. The absence of the
+ * flag is therefore not "unspecified", it is the top rung -- which is also what makes the
+ * default configuration emit nothing, on either exporter.
+ *
+ * Position in {@link #optionsFor}, not the enum's own order, decides what "below" means. The
+ * two ladders diverge above the blit -- {@link #ZERO} on one, {@link #GPU_HW} on the other --
+ * so an ordinal comparison would be comparing rungs from different ladders. It also keeps a
+ * ceiling stored under another exporter from ever being emitted: {@link VMScreenConfig} has
+ * already resolved such a value to this edge's default, and this refuses to name anything the
+ * edge does not offer.
+ */
+ @Nullable
+ public static String emittedToken(@NonNull String screenId,
+ @NonNull DisplayExporter exporter,
+ @NonNull DisplayTransportCap ceiling) {
+ var options = optionsFor(screenId, exporter);
+ var top = defaultFor(screenId, exporter);
+ var ceilingAt = -1;
+ var topAt = -1;
+ for (var i = 0; i < options.length; i++) {
+ if (options[i] == ceiling) ceilingAt = i;
+ if (options[i] == top) topAt = i;
+ }
+ if (ceilingAt < 0 || ceilingAt >= topAt) return null;
+ return ceiling.token;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuApi.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuApi.java
index fb449411..a5f7ff79 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuApi.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuApi.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.vm;
import androidx.annotation.StringRes;
@@ -10,7 +13,17 @@ public enum GpuApi implements StringEnum {
VULKAN(1, "vulkan", R.string.create_vm_gpu_api_vulkan),
EGL(2, "egl", R.string.create_vm_gpu_api_egl),
OPENGLES(3, "gles", R.string.create_vm_gpu_api_opengles),
- ANGLE(4, "angle", R.string.create_vm_gpu_api_angle);
+ ANGLE(4, "angle", R.string.create_vm_gpu_api_angle),
+ // gfxstream host Vulkan driver (ANDROID_EMU_VK_LOADER_PATH). SYSTEM = the SoC's stock
+ // Vulkan HAL; TURNIP = bundled Mesa turnip (Adreno); PANVK = Mesa PanVK (Mali) -- not yet wired.
+ VULKAN_SYSTEM(5, "vulkan-system", R.string.create_vm_gpu_api_vulkan_system),
+ VULKAN_TURNIP(6, "vulkan-turnip", R.string.create_vm_gpu_api_vulkan_turnip),
+ VULKAN_PANVK(7, "vulkan-panvk", R.string.create_vm_gpu_api_vulkan_panvk),
+ // virglrenderer DRM native context: the guest runs its own turnip over vdrm and
+ // virglrenderer translates the msm protocol to KGSL ioctls. Not a translation API like the
+ // others -- nothing is remoted at the GL/VK level -- but it is the same choice for the user:
+ // how the guest reaches the GPU.
+ DRM2KGSL(8, "drm2kgsl", R.string.create_vm_gpu_api_drm2kgsl);
private final int value;
private final String name;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBackend.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBackend.java
index c8628da8..d17b0cc9 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBackend.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBackend.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.vm;
import androidx.annotation.StringRes;
@@ -5,11 +8,19 @@
import cn.classfun.droidvm.R;
import cn.classfun.droidvm.lib.store.enums.StringEnum;
+/**
+ * Which renderer serves the guest's graphics, listed in the order the editor offers them: software
+ * 2D first, then the two proxying renderers.
+ *
+ * Declaration order is menu order (the picker walks the constants), so it is a UI decision, not
+ * a storage one -- the config carries the constant's name ({@code Enums.optEnum}), never its
+ * position, so reordering here does not touch a stored VM.
+ */
public enum GpuBackend implements StringEnum {
NONE(0, "none", R.string.nullptr),
GPU_2D(1, "2d", R.string.create_vm_gpu_backend_2d),
- GPU_VIRGLRENDERER(2, "virglrenderer", R.string.create_vm_gpu_backend_virglrenderer),
- GPU_GFXSTREAM(3, "gfxstream", R.string.create_vm_gpu_backend_gfxstream);
+ GPU_GFXSTREAM(3, "gfxstream", R.string.create_vm_gpu_backend_gfxstream),
+ GPU_VIRGLRENDERER(2, "virglrenderer", R.string.create_vm_gpu_backend_virglrenderer);
private final int value;
private final String name;
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBlitProvider.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBlitProvider.java
new file mode 100644
index 00000000..a6e88f28
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuBlitProvider.java
@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.StringRes;
+
+import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.lib.store.enums.StringEnum;
+
+/**
+ * WHICH host Vulkan driver performs the native display's GPU blit -- import the virtio-gpu scanout
+ * dmabuf as a VkImage and blit it into the SurfaceControl buffer (the "1-gpu-copy" path in
+ * devices/src/virtio/gpu). This is a separate axis from the render {@link GpuProvider}: the driver
+ * that executes the guest's proxied calls and the driver that composites the scanout need not be
+ * the same one. Only the accelerated scanout uses it at all -- VNC and simplefb present through
+ * crosvm's CPU copy and ignore this entirely.
+ *
+ * The Vulkan providers are peers, chosen and gated by the same rule: a provider is usable when
+ * it exposes the raw-dmabuf-import extensions the blit needs (VK_EXT_external_memory_dma_buf et
+ * al.). Turnip is not special -- it is simply the provider that passes on Adreno; the current
+ * platforms just happen to all be Qualcomm. {@link #SYSTEM} defers to the SoC's stock driver
+ * (offered only where a capability probe passes) and {@link #PANVK} to Mesa PanVK on Mali (not
+ * wired yet). {@link #OFF} forces crosvm's CPU copy (GPU_DISPLAY_COPY_MODE=cpu), the universal
+ * path every compositor accepts.
+ *
+ *
On any Vulkan provider the crosvm bridge probes the extensions itself and falls back to the
+ * CPU copy if they are missing, so a wrong choice degrades rather than breaks.
+ *
+ *
Persisted as {@code display_blit_provider}; only meaningful with the native display on the
+ * virtio-gpu backend.
+ */
+public enum GpuBlitProvider implements StringEnum {
+ TURNIP(0, "turnip", R.string.create_vm_gpu_api_vulkan_turnip),
+ PANVK(1, "panvk", R.string.create_vm_gpu_api_vulkan_panvk),
+ SYSTEM(2, "system", R.string.create_vm_gpu_api_vulkan_system),
+ OFF(3, "off", R.string.create_vm_display_blit_off);
+
+ private final int value;
+ private final String name;
+ private final @StringRes int stringId;
+
+ GpuBlitProvider(int value, String name, @StringRes int stringId) {
+ this.value = value;
+ this.name = name;
+ this.stringId = stringId;
+ }
+
+ @SuppressWarnings("unused")
+ public int getValue() {
+ return value;
+ }
+
+ @SuppressWarnings("unused")
+ public String getName() {
+ return name;
+ }
+
+ @NonNull
+ @SuppressWarnings("unused")
+ public static GpuBlitProvider fromValue(int value) {
+ for (var v : values())
+ if (v.value == value) return v;
+ return TURNIP;
+ }
+
+ /** True for the providers that are wired today. Only PanVK is still unbuilt. */
+ public boolean isImplemented() {
+ return this != PANVK;
+ }
+
+ @Override
+ @StringRes
+ public int getStringId() {
+ return stringId;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuMode.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuMode.java
new file mode 100644
index 00000000..caa75e59
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuMode.java
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.StringRes;
+
+import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.lib.store.enums.StringEnum;
+
+/**
+ * WHERE the guest is intercepted -- the virtio-gpu context type, in plain terms.
+ *
+ *
This is the axis rutabaga actually has: a capset belongs to a renderer component, and the
+ * component decides how much of the guest's graphics work crosses the boundary.
+ *
+ *
+ * - {@link #OPENGL} -- GL calls are proxied. Guest runs mesa's virgl gallium driver;
+ * virglrenderer replays the command stream on a host GL context. Capset virgl2.
+ *
- {@link #VULKAN} -- Vulkan calls are proxied. On gfxstream that is its Vulkan
+ * component (capset gfxstream-vulkan); on virglrenderer it is venus (capset venus). Either
+ * way the host side needs an ICD, which is what {@link GpuProvider}'s VK_* row picks.
+ *
- {@link #NATIVE} -- only kernel ioctls are proxied. The guest runs its REAL driver
+ * (turnip over vdrm here) and the host translates the DRM uAPI. Capset drm; which DRM
+ * backend answers is a property of the device, KGSL on Adreno.
+ *
+ *
+ * Persisted as {@code gpu_mode}; older configs carry the pre-split {@code gpu_api} and are
+ * migrated by {@link #fromLegacyApi}.
+ */
+public enum GpuMode implements StringEnum {
+ NONE(0, "none", R.string.nullptr),
+ OPENGL(1, "opengl", R.string.create_vm_gpu_mode_opengl),
+ VULKAN(2, "vulkan", R.string.create_vm_gpu_mode_vulkan),
+ NATIVE(3, "native", R.string.create_vm_gpu_mode_native);
+
+ private final int value;
+ private final String name;
+ private final @StringRes int stringId;
+
+ GpuMode(int value, String name, @StringRes int stringId) {
+ this.value = value;
+ this.name = name;
+ this.stringId = stringId;
+ }
+
+ @SuppressWarnings("unused")
+ public int getValue() {
+ return value;
+ }
+
+ @SuppressWarnings("unused")
+ public String getName() {
+ return name;
+ }
+
+ /** The mode implied by a pre-split {@code gpu_api} value. */
+ @NonNull
+ public static GpuMode fromLegacyApi(@NonNull GpuApi api) {
+ switch (api) {
+ case EGL:
+ case OPENGLES:
+ case ANGLE:
+ return OPENGL;
+ case VULKAN:
+ case VULKAN_SYSTEM:
+ case VULKAN_TURNIP:
+ case VULKAN_PANVK:
+ return VULKAN;
+ case DRM2KGSL:
+ return NATIVE;
+ default:
+ return NONE;
+ }
+ }
+
+ @Override
+ @StringRes
+ public int getStringId() {
+ return stringId;
+ }
+
+ @Override
+ public boolean isDisplay() {
+ return stringId != R.string.nullptr;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuProvider.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuProvider.java
new file mode 100644
index 00000000..be2a18dc
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GpuProvider.java
@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.StringRes;
+
+import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.lib.store.enums.StringEnum;
+
+/**
+ * WHICH host driver serves the proxied calls, once {@link GpuMode} has decided what is proxied.
+ *
+ *
The two halves are the same question asked of two renderers, which is why they share a
+ * control: with {@link GpuMode#OPENGL} virglrenderer needs a host GL context, and with
+ * {@link GpuMode#VULKAN} both gfxstream and virglrenderer (venus) need a host Vulkan driver.
+ * "Vulkan on virglrenderer" IS venus -- the mode already says so -- so this row never names
+ * venus; it names the ICD venus dlopens: turnip, PanVK, or the SoC's stock HAL.
+ *
+ *
{@link GpuMode#NATIVE} has one entry today, {@link #DRM2KGSL}. The row is still shown for
+ * it: which DRM backend answers is a real axis (msm on a drm/msm kernel, KGSL on Adreno's
+ * downstream one), this device just has a single answer, and leaving the row visible keeps the
+ * three levels legible instead of making NATIVE look like it has no host driver at all.
+ *
+ *
Persisted as {@code gpu_provider}; older configs carry the pre-split {@code gpu_api} and
+ * are migrated by {@link #fromLegacyApi}.
+ */
+public enum GpuProvider implements StringEnum {
+ NONE(0, "none", R.string.nullptr),
+ // Host GL, for virglrenderer's OpenGL mode. Passed through as --gpu egl= / gles=.
+ //
+ // There is deliberately no ANGLE. GpuParameters carries no `angle` field and is declared
+ // #[serde(deny_unknown_fields)], so `--gpu ...,angle=true` does not enable anything -- it
+ // makes crosvm reject the whole --gpu argument and the VM never starts.
+ EGL(1, "egl", R.string.create_vm_gpu_api_egl),
+ GLES(2, "gles", R.string.create_vm_gpu_api_opengles),
+ // Host Vulkan, for GpuMode.VULKAN on either renderer (gfxstream, or venus on virglrenderer).
+ // Selects ANDROID_EMU_VK_LOADER_PATH, which both gfxstream's VulkanDispatch and venus's
+ // vkr_library honour: the SoC's stock Vulkan HAL, the bundled Mesa turnip (Adreno), or Mesa
+ // PanVK (Mali) -- PanVK is not wired yet.
+ VK_SYSTEM(4, "vulkan-system", R.string.create_vm_gpu_api_vulkan_system),
+ VK_TURNIP(5, "vulkan-turnip", R.string.create_vm_gpu_api_vulkan_turnip),
+ VK_PANVK(6, "vulkan-panvk", R.string.create_vm_gpu_api_vulkan_panvk),
+ // The DRM backend for GpuMode.NATIVE. virglrenderer receives the msm wire protocol and
+ // re-synthesises it as KGSL ioctls against the host's /dev/kgsl-3d0; the guest never sees
+ // a KGSL device of its own. Selects --gpu context-types=virgl2:drm.
+ DRM2KGSL(7, "drm2kgsl", R.string.create_vm_gpu_provider_drm2kgsl);
+ // Value 8 was a short-lived "venus" entry that put the proxy, not the host driver, in this
+ // row. Retired: venus is implied by virglrenderer + GpuMode.VULKAN, and configs that still
+ // carry gpu_provider=venus fall back through fromLegacyApi(VULKAN) to VK_TURNIP -- the
+ // driver they always ran on.
+
+ private final int value;
+ private final String name;
+ private final @StringRes int stringId;
+
+ GpuProvider(int value, String name, @StringRes int stringId) {
+ this.value = value;
+ this.name = name;
+ this.stringId = stringId;
+ }
+
+ @SuppressWarnings("unused")
+ public int getValue() {
+ return value;
+ }
+
+ @SuppressWarnings("unused")
+ public String getName() {
+ return name;
+ }
+
+ /** The provider implied by a pre-split {@code gpu_api} value. */
+ @NonNull
+ public static GpuProvider fromLegacyApi(@NonNull GpuApi api) {
+ switch (api) {
+ case EGL: return EGL;
+ case OPENGLES: return GLES;
+ // A saved ANGLE could never have booted (see above); land it on GLES rather than
+ // carrying a value that only fails.
+ case ANGLE: return GLES;
+ case VULKAN_SYSTEM: return VK_SYSTEM;
+ case VULKAN_TURNIP: return VK_TURNIP;
+ case VULKAN_PANVK: return VK_PANVK;
+ case DRM2KGSL: return DRM2KGSL;
+ // Plain VULKAN is what the retired "venus" provider wrote as gpu_api (and what the
+ // pre-venus virglrenderer `vulkan=true` did). Both ran on the bundled turnip -- the
+ // launcher's non-SYSTEM/PANVK default -- so name that explicitly.
+ case VULKAN: return VK_TURNIP;
+ default: return NONE;
+ }
+ }
+
+ @Override
+ @StringRes
+ public int getStringId() {
+ return stringId;
+ }
+
+ @Override
+ public boolean isDisplay() {
+ return stringId != R.string.nullptr;
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GuestPoolSizing.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GuestPoolSizing.java
new file mode 100644
index 00000000..10ffc186
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/GuestPoolSizing.java
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import static cn.classfun.droidvm.lib.store.enums.Enums.optEnum;
+
+import androidx.annotation.NonNull;
+
+import cn.classfun.droidvm.lib.store.base.DataItem;
+
+/**
+ * How much guest-owned VRAM pool a VM actually gets at boot, as one rule shared by the crosvm
+ * command builder (which passes it) and the huge-page preflight (which budgets for it). The two
+ * drifted once: the daemon zeroed the pool for host-visible-RAM modes while the preflight still
+ * added it, so a 5 GB pseudo-unprotected VM was told it needed 6 GB of reserve.
+ *
+ *
The guest-alloc pool buys the host access to buffers the guest allocated, which in an
+ * ordinary protected VM it does not otherwise have. When the host can already reach the guest's
+ * RAM (an unprotected VM, or a pseudo-unprotected one whose window is shared back before the
+ * payload runs) the pool is memory taken from the guest to solve a problem that is not
+ * happening, so it is dropped. gfxstream additionally needs udmabuf, which is what gates
+ * guest-created handles; without it there is nothing to pre-allocate.
+ */
+public final class GuestPoolSizing {
+ private GuestPoolSizing() {
+ }
+
+ /** The host can read the guest's RAM directly, so no guest pool is passed. */
+ public static boolean hostVisibleRam(@NonNull DataItem item) {
+ var pvm = optEnum(item, "protected_vm", ProtectedVM.PROTECTED_WITHOUT_FIRMWARE);
+ return pvm == ProtectedVM.PROTECTED_NORMAL || pvm == ProtectedVM.PSEUDO_UNPROTECTED;
+ }
+
+ /** The pool window ({@code gpu-guest-mb}) crosvm will be given, 0 when none. */
+ public static long bootGuestPoolMb(@NonNull DataItem item) {
+ if (!VMScreenConfig.hasGpuDevice(item)) return 0;
+ if (hostVisibleRam(item)) return 0;
+ long pool = Math.max(item.optLong("gpu_guest_pool_mb", 0), 0);
+ var backend = optEnum(item, "gpu_backend", GpuBackend.NONE);
+ if (backend == GpuBackend.GPU_GFXSTREAM)
+ return item.optBoolean("gpu_udmabuf", true) ? pool : 0;
+ if (backend == GpuBackend.GPU_VIRGLRENDERER)
+ return pool;
+ return 0;
+ }
+
+ /**
+ * The part of that window pre-allocated at boot ({@code gpu-guest-prealloc-mb}) - what the
+ * huge-page reserve pays up front. Older configs carry no prealloc field and keep the whole
+ * pool preallocated; growth grants come later, one blob at a time, and are not counted.
+ */
+ public static long bootGuestPreallocMb(@NonNull DataItem item) {
+ long pool = bootGuestPoolMb(item);
+ if (pool <= 0) return 0;
+ return Math.max(Math.min(item.optLong("gpu_guest_prealloc_mb", pool), pool), 0);
+ }
+}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/LendMthpMode.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/LendMthpMode.java
index d45676c4..2c4a8e63 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/LendMthpMode.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/LendMthpMode.java
@@ -1,11 +1,19 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.vm;
import static cn.classfun.droidvm.lib.store.enums.Enums.optEnum;
+import android.content.Context;
+import android.util.Log;
+
import androidx.annotation.NonNull;
import androidx.annotation.StringRes;
import cn.classfun.droidvm.R;
+import cn.classfun.droidvm.lib.data.QcomChipName;
+import cn.classfun.droidvm.lib.data.QcomGunyahSupports;
import cn.classfun.droidvm.lib.store.base.DataItem;
import cn.classfun.droidvm.lib.store.enums.StringEnum;
@@ -16,6 +24,7 @@ public enum LendMthpMode implements StringEnum {
public static final String KEY = "prepare_lend_mthp";
public static final LendMthpMode DEFAULT = CHUNKED;
+ private static final String TAG = "LendMthpMode";
private final @StringRes int stringId;
@@ -38,4 +47,28 @@ public static LendMthpMode fromItem(@NonNull DataItem item) {
return raw.asBoolean() ? CHUNKED : DISABLED;
return optEnum(item, KEY, DEFAULT);
}
+
+ /**
+ * Device-aware default used by every new-VM path. Keep the priority identical to the
+ * capability table: a more specific supported mode later in the list wins. In particular,
+ * Snapdragon 8 Gen 3 advertises only {@code mthp_single} and must never default to chunked
+ * preallocation.
+ */
+ @NonNull
+ public static LendMthpMode defaultForDevice(@NonNull Context context) {
+ var mode = DEFAULT;
+ try {
+ var socModel = QcomChipName.getCurrentSoC();
+ var gunyah = new QcomGunyahSupports(context);
+ if (gunyah.isCapacitySupported(socModel, "no_mthp"))
+ mode = DISABLED;
+ if (gunyah.isCapacitySupported(socModel, "mthp_chunked"))
+ mode = CHUNKED;
+ if (gunyah.isCapacitySupported(socModel, "mthp_single"))
+ mode = SINGLE;
+ } catch (Exception e) {
+ Log.w(TAG, "Failed to resolve device MTHP default", e);
+ }
+ return mode;
+ }
}
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NativeDisplay.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NativeDisplay.java
index b0445760..36df5f7e 100644
--- a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NativeDisplay.java
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NativeDisplay.java
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
package cn.classfun.droidvm.lib.store.vm;
import static cn.classfun.droidvm.lib.Constants.DATA_DIR;
@@ -6,20 +9,61 @@
import androidx.annotation.NonNull;
+import java.nio.charset.StandardCharsets;
+
/**
* Shared naming for the native (crosvm android-display) backend. The daemon (launching crosvm and
* hosting the native-display binder) and the UI (looking up the display binder / sending input)
- * both derive the per-VM service name and socket paths from here, so they agree and different VMs
- * never collide.
+ * both derive the service names and socket paths from here, so they agree and different VMs never
+ * collide.
+ *
+ * The names the outside world sees hang off one per-VM root, {@link #channelKeyFromId}: a screen's
+ * display service is that root plus the screen's id. The root is a pure function of the VM's UUID,
+ * which is why a crosvm that died and restarted re-registers under exactly the name the app is
+ * still waiting on.
+ *
+ * A display service is per screen, not per VM: two screens exporting natively at once would
+ * otherwise want one servicemanager name for two Surfaces, and a service holds two slots (main +
+ * cursor), not N.
+ *
+ * The input sockets split the same way, but not all of them: the relative pointer alone stays on
+ * the VM root, because it has no output binding at all -- the guest compositor routes it by focus
+ * and it walks from one output to the next. The multi-touch and absolute-pointer devices are per
+ * screen because an absolute coordinate only means anything under one output's geometry; the
+ * keyboard is per screen for a different reason, which is that input belongs to the scanout. A
+ * screen's input switch has to be able to turn typing off on that screen, and a VM-wide keyboard
+ * could not be turned off by any one screen -- so a keyboard the console types into is the
+ * console's screen's keyboard, and a screen with input off has none at all.
*
- * The service name doubles as the vmKey: it identifies both the servicemanager entry crosvm
- * registers (--android-display-service) and the VM's input-socket set.
+ * The socket filenames are the one set of names here that is not identity-bearing, and
+ * they are deliberately terse. A unix socket address holds 107 bytes of path plus a NUL, and this
+ * app's run directory already spends 35 of them ({@code /data/data/cn.classfun.droidvm/run/}); the
+ * old {@code droidvm_disp__input_multitouch.sock} came to 106 -- one byte of headroom -- so
+ * the moment the screen id joined it the per-screen names hit 115 and 111 and crosvm refused the
+ * whole command line with "path must be shorter than SUN_LEN". Nothing outside this process pair
+ * ever reads these names: the daemon binds the inode and crosvm is handed the path on the command
+ * line it is started with, so unlike the service name and the evdev names, which the guest and the
+ * user's saved mappings key on across reboots, a socket filename can be abbreviated freely.
+ * {@link #inputSocketPath} therefore builds {@code dvmin_[_]_.sock} out of
+ * two-to-three-letter tags, worst case 90 bytes, and {@link #requireBindablePath} makes the
+ * remaining margin a wall rather than a hope -- see its note on what bind(2) does otherwise.
*/
public final class NativeDisplay {
- /** Input channels (MVP: multi-touch + keyboard). */
+ /**
+ * Input channels. Each maps to one crosvm {@code --input } virtio-input device and one
+ * unix socket, and the UI routes to whichever the current {@code InputMode} selects
+ * (multi-touch, relative mouse, or absolute single-touch tablet). Ordinals are the wire
+ * channel ids shared with the daemon's InputHandler; append new channels, never renumber.
+ *
+ * A channel is not by itself a device any more: {@link #isPerScreen} says whether the VM
+ * has one of them or one per screen, so the daemon binds a socket per (screen, channel) pair
+ * that exists rather than {@link #CHANNEL_COUNT} of them.
+ */
public static final int MULTITOUCH = 0;
public static final int KEYBOARD = 1;
- public static final int CHANNEL_COUNT = 2;
+ public static final int MOUSE = 2;
+ public static final int TABLET = 3;
+ public static final int CHANNEL_COUNT = 4;
/**
* Broadcast the daemon (running as root) sends to hand its INativeDisplayRootService binder to
@@ -35,28 +79,241 @@ public final class NativeDisplay {
/** Per-attach random token; the UI only accepts a broadcast carrying the nonce it requested. */
public static final String EXTRA_NONCE = "nonce";
- private static final String[] KINDS = {"multitouch", "keyboard"};
+ // Socket filename tags per channel (index == channel constant). "ms"/"tab" are our tags; the
+ // crosvm device kinds they pair with are "mouse" (relative) and "absolute-mouse". Short
+ // because the whole path has to fit sun_path (see the class note); still self-describing,
+ // because the next person reading `ls run/` deserves to know which inode is the touchscreen.
+ private static final String[] CHANNEL_TAGS = {"mt", "kbd", "ms", "tab"};
+
+ /**
+ * Socket filename tag per screen, positionally paired with {@link VMScreenConfig#IDS}. A
+ * screen id is a word ("simplefb"); a socket name has a couple of bytes to spend on it. The
+ * static check below is the wall a third screen walks into: adding an id without adding its
+ * tag fails at class load rather than minting a name that overflows or collides.
+ */
+ private static final String[] SCREEN_TAGS = {"g0", "sfb"};
+
+ static {
+ if (SCREEN_TAGS.length != VMScreenConfig.IDS.length)
+ throw new IllegalStateException("every screen id needs an input-socket tag");
+ }
+
private static final String RUN_PATH = pathJoin(DATA_DIR, "run");
+ /** Prefix every name built here starts with; {@link #vmIdFromServiceName} reads it back. */
+ private static final String NAME_PREFIX = "droidvm_disp_";
+
+ /** Prefix of the input socket filenames; short, and not a name anything looks up by. */
+ private static final String SOCKET_PREFIX = "dvmin_";
+
+ /**
+ * Bytes of {@code sockaddr_un.sun_path} on Linux -- 108, of which the last must be the NUL,
+ * so 107 is the longest bindable path. Not a tunable: it is the kernel's array size.
+ */
+ public static final int SUN_PATH_SIZE = 108;
+
+ /** The longest path {@link #requireBindablePath} will pass: {@link #SUN_PATH_SIZE} less NUL. */
+ public static final int MAX_UNIX_PATH = SUN_PATH_SIZE - 1;
+
private NativeDisplay() {
}
- /** Per-VM crosvm display service name; also used as the vmKey for input sockets. */
+ /**
+ * The VM's display-channel root: the stem every per-screen service name is built on, and the
+ * name a pre-screens build registered on its own. Stable across boots because the VM's UUID
+ * is. Taken as a raw id rather than a config because half its callers only have the id, out
+ * of an Intent extra or a service name being read back.
+ */
+ @NonNull
+ public static String channelKeyFromId(@NonNull String vmId) {
+ return fmt("%s%s", NAME_PREFIX, sanitize(vmId));
+ }
+
+ /**
+ * The servicemanager name crosvm registers for one screen's native display -- the value of
+ * that screen's {@code --android-display-service name=}, and what the UI looks up.
+ *
+ * The screen id rides in the name rather than in a separate field because the name is the
+ * whole identity of a channel on both sides of the binder, and because it has to survive a
+ * crosvm restart unchanged: it is derived, never allocated. The charset stays the one
+ * {@link #sanitize} allows, so the name is legal both as a binder service name and inside a
+ * socket filename.
+ */
+ @NonNull
+ public static String serviceName(@NonNull VMConfig config, @NonNull String screenId) {
+ return serviceNameFromId(config.getId().toString(), screenId);
+ }
+
+ /** Same as {@link #serviceName(VMConfig, String)} but from a raw VM id. */
+ @NonNull
+ public static String serviceNameFromId(@NonNull String vmId, @NonNull String screenId) {
+ return fmt("%s_%s", channelKeyFromId(vmId), sanitize(screenId));
+ }
+
+ /**
+ * The VM id a name built here belongs to, or an empty string when the name is not ours.
+ *
+ * The daemon uses this to decide whether a display binder is worth waiting for, so it has to
+ * be the exact inverse of the two builders above -- which is why it lives next to them
+ * instead of being a prefix-strip written out again at the call site.
+ */
+ @NonNull
+ public static String vmIdFromServiceName(@NonNull String serviceName) {
+ if (!serviceName.startsWith(NAME_PREFIX)) return "";
+ var rest = serviceName.substring(NAME_PREFIX.length());
+ for (var screenId : VMScreenConfig.IDS) {
+ var suffix = fmt("_%s", sanitize(screenId));
+ if (rest.endsWith(suffix))
+ return rest.substring(0, rest.length() - suffix.length());
+ }
+ return rest;
+ }
+
+ /**
+ * Whether [channel]'s device belongs to one screen rather than to the whole VM.
+ *
+ * The two absolute devices are: their coordinates are read against one output's geometry,
+ * so a VM with two screens needs two of each and the guest has to be told by hand which is
+ * which. The keyboard is too, on the different ground that input is a property of the scanout:
+ * the screen's input switch governs it, so it cannot be one device shared by screens that
+ * disagree about whether input is on. Only the relative pointer is left VM-wide -- it has no
+ * output binding, and the guest compositor sends it wherever focus is.
+ *
+ * This one predicate is what makes a channel per screen everywhere at once: it picks the
+ * socket filename ({@link #inputSocketPath}), the daemon's slot key, and therefore whether the
+ * screen the console names reaches the write at all. The UI already sends its screen id on
+ * every channel, so a channel moving across this line needs no change on that side.
+ */
+ public static boolean isPerScreen(int channel) {
+ return channel == MULTITOUCH || channel == TABLET || channel == KEYBOARD;
+ }
+
+ /**
+ * The socket filename tag for [screenId], or the sanitized id itself if the screen is one
+ * {@link #SCREEN_TAGS} has never heard of -- a long name the length check will catch, which is
+ * the failure worth having over a short one that might collide with another screen's tag.
+ */
@NonNull
- public static String serviceName(@NonNull VMConfig config) {
- return serviceNameFromId(config.getId().toString());
+ private static String screenTag(@NonNull String screenId) {
+ for (int i = 0; i < VMScreenConfig.IDS.length; i++)
+ if (VMScreenConfig.IDS[i].equals(screenId)) return SCREEN_TAGS[i];
+ return sanitize(screenId);
}
- /** Same as {@link #serviceName(VMConfig)} but from a raw VM id (e.g. an Intent extra). */
+ /**
+ * The socket path for [channel] on [screenId] of [vmId]: {@code dvmin___.sock},
+ * with the screen tag left out entirely for the VM-wide channel -- so passing the empty
+ * screen id for the relative pointer is exact rather than a placeholder, and no screen a
+ * console could name reaches its inode.
+ *
+ * The daemon binds these and crosvm's {@code --input ...[path=]} connects to them, and the
+ * two sides agree because they call this one function rather than each composing the name and
+ * the directory themselves.
+ *
+ * Terse on purpose, and safe to be terse: unlike the service name and the evdev names, this
+ * string is born and dies inside one VM start -- see the class note for what the long form
+ * cost. Worst case here is 90 bytes of the 107 a unix socket address holds; the margin is
+ * asserted in the tests and enforced by {@link #requireBindablePath} at the bind.
+ */
@NonNull
- public static String serviceNameFromId(@NonNull String vmId) {
- return fmt("droidvm_disp_%s", sanitize(vmId));
+ public static String inputSocketPath(@NonNull String vmId, @NonNull String screenId,
+ int channel) {
+ var screen = isPerScreen(channel) ? fmt("_%s", screenTag(screenId)) : "";
+ return pathJoin(RUN_PATH, fmt("%s%s%s_%s.sock",
+ SOCKET_PREFIX, sanitize(vmId), screen, CHANNEL_TAGS[channel]));
}
- /** The socket path crosvm connects to for [vmKey]'s [channel]. Must match across all callers. */
+ /**
+ * Returns [path] if a unix socket can actually be bound to it, and throws naming the path and
+ * its length if not.
+ *
+ * This exists because the two ends disagree about what to do with an over-long path, and
+ * both answers are bad. crosvm refuses the command line outright ("path must be shorter than
+ * SUN_LEN") and the VM never starts. bind(2) as this daemon reaches it does the opposite: the
+ * path is copied into a 108-byte {@code sun_path} and silently truncated, so the
+ * daemon binds some other inode, logs a successful pre-listen, and waits forever for a crosvm
+ * that was told the untruncated name -- run/ on the test phone still held two of those stubs,
+ * {@code ..._simplefb_input_multito} and {@code ..._simplefb_input_tablet.}, as the only trace
+ * that anything had gone wrong. So the length is checked here, before the syscall, and a name
+ * that grows past the limit hits a wall with the number in the message instead of a mystery.
+ *
+ * Measured in bytes, not chars: the kernel copies bytes, and {@link #sanitize} keeps the
+ * two equal only as long as every name it is fed is ASCII.
+ */
+ @NonNull
+ public static String requireBindablePath(@NonNull String path) {
+ int len = path.getBytes(StandardCharsets.UTF_8).length;
+ if (len > MAX_UNIX_PATH)
+ throw new IllegalArgumentException(fmt(
+ "unix socket path is %d bytes, over the %d sun_path allows: %s",
+ len, MAX_UNIX_PATH, path));
+ return path;
+ }
+
+ /**
+ * The evdev name crosvm gives [screenId]'s multi-touch device -- what the guest sees as the
+ * touchscreen's name, and the whole of its identity there.
+ *
+ * Neither evdev nor HID has a field for "I belong to output N", so every guest OS maps a
+ * touchscreen to an output by the device's name: kwin stores it by name,
+ * {@code xinput map-to-output} takes it by name, Windows' Tablet PC setup remembers the one
+ * it was pointed at. That makes the name the only lever there is, and it has to be a pure
+ * function of the screen and never change -- rename it and the user's mapping silently stops
+ * matching anything, with no error to notice.
+ *
+ * Its absolute-pointer sibling is named by {@link #tabletDeviceName} for the same reason
+ * and on the same terms.
+ */
+ @NonNull
+ public static String touchDeviceName(@NonNull String screenId) {
+ return fmt("DroidVM Touch (%s)", screenId);
+ }
+
+ /**
+ * The evdev name crosvm gives [screenId]'s absolute-pointer (tablet) device.
+ *
+ * Everything {@link #touchDeviceName} says applies here unchanged -- an absolute pointer is
+ * as much a per-output device as a touchscreen, and the guest maps it to an output by name in
+ * exactly the same places. It used to have no name at all, because crosvm's
+ * {@code absolute-mouse} option had no {@code name} field and its option enum rejects unknown
+ * keys, so the device fell back to crosvm's generated "Crosvm Virtio Absolute Mouse <idx>"
+ * -- an index that counts emission order and therefore moves when another screen's input is
+ * switched off, which is the one thing a mapping key must never do. crosvm takes the field
+ * now, so the tablet is pinnable on the same terms as the touchscreen.
+ *
+ * Cross-repo seam. This string is produced in two places. A natively exported screen's
+ * tablet is the {@code --input absolute-mouse} the daemon emits with this name. A VNC-exported
+ * screen's tablet is built by crosvm itself, behind that screen's VNC server, and crosvm names
+ * it by reproducing this format -- there is no command-line key carrying it, so the format is
+ * the contract. Changing the format here means changing crosvm's VNC device setup in the same
+ * breath; changing only one silently unpins every guest-side mapping on the other. Which
+ * screens get which is {@code CrosvmBackendInstance.nativeInputScreens}. The same seam applies
+ * to {@link #keyboardDeviceName}.
+ */
+ @NonNull
+ public static String tabletDeviceName(@NonNull String screenId) {
+ return fmt("DroidVM Tablet (%s)", screenId);
+ }
+
+ /**
+ * The evdev name [screenId]'s keyboard carries.
+ *
+ * A keyboard is not an absolute device and the guest binds no output to it, so unlike its
+ * two siblings this name is not what a mapping keys on. It is still derived per screen, for
+ * two reasons. The guest lists these side by side and a user looking at several identical
+ * "DroidVM Keyboard" entries cannot tell which screen's switch turns which one off; and the
+ * name is the only thing distinguishing them, since a keyboard advertises nothing else that
+ * differs.
+ *
+ * Cross-repo seam, on the same terms as {@link #tabletDeviceName} and in both
+ * directions: the daemon emits this string in {@code --input keyboard[...,name=]} for a
+ * natively exported screen, and crosvm builds a VNC-exported screen's keyboard itself and
+ * names it by reproducing this format. Two producers, one format, and no command-line key
+ * carrying it between them.
+ */
@NonNull
- public static String inputSocketPath(@NonNull String vmKey, int channel) {
- return pathJoin(RUN_PATH, fmt("%s_input_%s.sock", sanitize(vmKey), KINDS[channel]));
+ public static String keyboardDeviceName(@NonNull String screenId) {
+ return fmt("DroidVM Keyboard (%s)", screenId);
}
/** Keep socket/service names to a filesystem- and binder-safe charset. */
diff --git a/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NicLeaseOffsets.java b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NicLeaseOffsets.java
new file mode 100644
index 00000000..7f7c3f09
--- /dev/null
+++ b/app/src/main/java/cn/classfun/droidvm/lib/store/vm/NicLeaseOffsets.java
@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright DroidVM contributors
+// Additional permissions apply; see ADDITIONAL-PERMISSIONS in the repository root.
+package cn.classfun.droidvm.lib.store.vm;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import java.math.BigInteger;
+import java.util.Set;
+
+import cn.classfun.droidvm.lib.store.network.NetworkConfig;
+import cn.classfun.droidvm.lib.store.network.VlanConfig;
+
+/**
+ * Which DHCP static-lease offsets a VLAN has left, and which one a NIC should take.
+ *
+ * An offset is what a static lease actually stores: the host part, counted from the VLAN's
+ * network address, so the lease survives the network being re-addressed. Two NICs on the same
+ * VLAN holding the same offset would be handed the same IP, so an offset is allocated against
+ * everything already on that VLAN -- every other VM's NICs, and the VM's own other NICs.
+ *
+ *
Pure arithmetic over configs: no store, no context, no side effects. Callers decide where
+ * the VMs come from and what to do with the answer.
+ */
+public final class NicLeaseOffsets {
+ /** Static leases start here, leaving 1..63 for whatever the host wants at the low end. */
+ public static final long FIRST = 64;
+ /** Cap on how far a search walks before it gives up, so a huge VLAN cannot hang it. */
+ private static final long MAX_PROBES = 1L << 16;
+
+ private NicLeaseOffsets() {
+ }
+
+ /** Which address family's lease is meant. */
+ public enum Family {
+ IPV4,
+ IPV6,
+ }
+
+ /**
+ * The offsets one VM's NICs hold on this network/VLAN, appended to {@code used}. Callers walk
+ * their own store: everything on the VLAN counts, including the resolving VM's other NICs, so
+ * that two NICs resolved in one pass cannot land on the same offset.
+ */
+ public static void addOffsets(
+ @NonNull Set used,
+ @NonNull VMConfig vm,
+ @NonNull NetworkConfig network,
+ @NonNull VlanConfig vlan,
+ @NonNull Family family
+ ) {
+ addOffsets(used, vm, network, vlan, family, null);
+ }
+
+ /**
+ * The same, with one NIC left out -- the one being resolved, whose own offset is the thing
+ * being asked about and so must not count as taken.
+ */
+ public static void addOffsets(
+ @NonNull Set used,
+ @NonNull VMConfig vm,
+ @NonNull NetworkConfig network,
+ @NonNull VlanConfig vlan,
+ @NonNull Family family,
+ @Nullable VMNicConfig exclude
+ ) {
+ var netIdStr = network.item.optString("id", "");
+ if (netIdStr.isEmpty()) return;
+ vm.forEachNic(nic -> {
+ // same underlying entry, re-wrapped by forEachNic
+ if (exclude != null && nic.item == exclude.item) return;
+ if (!netIdStr.equals(nic.getNetworkId())) return;
+ if (!hasOffset(nic, family)) return;
+ var nicVlan = nic.resolveDhcpVlan(network);
+ if (nicVlan == null || nicVlan.getVlanId() != vlan.getVlanId()) return;
+ used.add(offsetOf(nic, family));
+ });
+ }
+
+ /**
+ * The offset a NIC should end up with: {@code wanted} when nothing is in its way, otherwise
+ * the next free one above it, wrapping back to {@link #FIRST} when the top of the VLAN is
+ * reached. Returns -1 when the VLAN has no free offset at all (or cannot host one), which is
+ * the caller's cue to fall back to a dynamic address.
+ *
+ *