review: evacuate stop, moved claims, docs and moves

boot/init/src/boot.rs

@@ -4,7 +4,7 @@ use std::fs;
 use std::path::Path;
 use std::time::{Duration, Instant};
 
-use crate::cfg::{self, BootCfg};
+use crate::cfg::{self, BootCfg, IpParam};
 use crate::sys;
 
 const LAYER_DIR: &str = "/l";
@@ -77,17 +77,12 @@ pub fn run() -> ! {
         uptime(),
         cfg.init
     );
-    let err = sys::exec_init(&cfg.init);
+    let err = sys::exec_init(cfg.init);
     sys::fatal(&format!("exec {}: {err}", cfg.init), cfg.debug)
 }
 
-fn assemble(cfg: &BootCfg, marks: &mut Marks) -> Result<(), String> {
-    let ids: Vec<&str> = cfg
-        .layers
-        .iter()
-        .map(String::as_str)
-        .chain([cfg.cow.as_str()])
-        .collect();
+fn assemble(cfg: &BootCfg<'_>, marks: &mut Marks) -> Result<(), String> {
+    let ids: Vec<&str> = cfg.layers.iter().copied().chain([cfg.cow]).collect();
     let mut devs = resolve_disks(&ids, cfg.timeout)?;
     let cow_dev = devs
         .pop()
@@ -119,7 +114,7 @@ fn assemble(cfg: &BootCfg, marks: &mut Marks) -> Result<(), String> {
     )?;
     marks.mark("overlay");
 
-    if let Some(hostname) = &cfg.hostname {
+    if let Some(hostname) = cfg.hostname {
         sys::sethostname(hostname)?;
     }
     // empty machine-id => systemd generates a fresh one per VM (clone identity).
@@ -140,7 +135,7 @@ fn assemble(cfg: &BootCfg, marks: &mut Marks) -> Result<(), String> {
 }
 
 /// Persists kernel ip= params as MAC-matched networkd units in the new root.
-fn persist_network(cfg: &BootCfg) {
+fn persist_network(cfg: &BootCfg<'_>) {
     if cfg.ips.is_empty() {
         return;
     }
@@ -149,8 +144,7 @@ fn persist_network(cfg: &BootCfg) {
         eprintln!("sandbox-init: WARN: mkdir {dir}: {err}");
         return;
     }
-    let devices: Vec<&str> = cfg.ips.iter().map(|ip| ip.device.as_str()).collect();
-    for (ip, mac) in cfg.ips.iter().zip(wait_nic_macs(&devices, NIC_TIMEOUT)) {
+    for (ip, mac) in cfg.ips.iter().zip(wait_nic_macs(&cfg.ips, NIC_TIMEOUT)) {
         let Some(mac) = mac else {
             eprintln!(
                 "sandbox-init: WARN: NIC {} not found, static config skipped",
@@ -166,11 +160,11 @@ fn persist_network(cfg: &BootCfg) {
 }
 
 /// Resolves every NIC MAC against one shared deadline, so a missing NIC costs the timeout once.
-fn wait_nic_macs(devices: &[&str], timeout: Duration) -> Vec<Option<String>> {
-    poll_slots(devices.len(), timeout, |found| {
-        for (slot, device) in found.iter_mut().zip(devices) {
+fn wait_nic_macs(ips: &[IpParam<'_>], timeout: Duration) -> Vec<Option<String>> {
+    poll_slots(ips.len(), timeout, |found| {
+        for (slot, ip) in found.iter_mut().zip(ips) {
             if slot.is_none() {
-                *slot = read_nic_mac(device);
+                *slot = read_nic_mac(ip.device);
             }
         }
     })
@@ -231,12 +225,8 @@ fn scan_serials(ids: &[&str], found: &mut [Option<String>]) {
             continue;
         }
         // the serial attribute location varies by kernel version.
-        let paths = [
-            format!("/sys/block/{name}/serial"),
-            format!("/sys/block/{name}/device/serial"),
-        ];
-        for path in paths {
-            let Ok(serial) = fs::read_to_string(&path) else {
+        for sub in ["serial", "device/serial"] {
+            let Ok(serial) = fs::read_to_string(format!("/sys/block/{name}/{sub}")) else {
                 continue;
             };
             if serial.trim_end().is_empty() {
@@ -266,10 +256,9 @@ fn record_serial(ids: &[&str], found: &mut [Option<String>], serial: &str, devic
 }
 
 fn uptime() -> String {
-    fs::read_to_string("/proc/uptime")
-        .ok()
-        .and_then(|s| s.split_ascii_whitespace().next().map(String::from))
-        .unwrap_or_else(|| "?".into())
+    let mut s = fs::read_to_string("/proc/uptime").unwrap_or_else(|_| "?".into());
+    s.truncate(s.find(' ').unwrap_or(s.len()));
+    s
 }
 
 #[cfg(test)]

boot/init/src/cfg.rs

@@ -3,24 +3,24 @@
 use std::fmt::Write as _;
 use std::time::Duration;
 
-pub const DEFAULT_INIT: &str = "/sbin/init";
+const DEFAULT_INIT: &str = "/sbin/init";
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);
 // cap the timeout: `Instant + Duration` panics on overflow, and a PID 1 panic is a kernel panic.
 const MAX_TIMEOUT_SECS: u64 = 86_400;
 
 #[derive(Debug, PartialEq, Eq)]
-pub struct BootCfg {
+pub struct BootCfg<'a> {
     /// Layer disk serials in lowerdir order (first = uppermost lower layer).
-    pub layers: Vec<String>,
+    pub layers: Vec<&'a str>,
     /// Writable ext4 COW disk ID (same resolution rules as layers).
-    pub cow: String,
+    pub cow: &'a str,
     /// Wait budget for the whole disk set; NICs get a fixed 200 ms.
     pub timeout: Duration,
-    pub hostname: Option<String>,
+    pub hostname: Option<&'a str>,
     /// Static per-NIC config, persisted as networkd units and never applied in the initramfs.
-    pub ips: Vec<IpParam>,
+    pub ips: Vec<IpParam<'a>>,
     /// Handoff target inside the assembled rootfs.
-    pub init: String,
+    pub init: &'a str,
     /// Fatal errors drop to /bin/sh (debug initramfs) instead of poweroff.
     pub debug: bool,
     /// Emit one pre-handoff line with per-phase µs timings (sandbox.trace=1).
@@ -29,51 +29,46 @@ pub struct BootCfg {
 
 /// One kernel `ip=` param, as cocoon emits it per NIC.
 #[derive(Debug, PartialEq, Eq)]
-pub struct IpParam {
-    pub addr: String,
+pub struct IpParam<'a> {
+    pub addr: &'a str,
     pub prefix: u8,
-    pub gateway: Option<String>,
-    pub dns: Vec<String>,
+    pub gateway: Option<&'a str>,
+    pub dns: Vec<&'a str>,
     /// Initramfs-time device name, used only to look up the MAC the persisted unit matches on.
-    pub device: String,
+    pub device: &'a str,
 }
 
-pub fn parse(cmdline: &str) -> Result<BootCfg, String> {
+pub fn parse(cmdline: &str) -> Result<BootCfg<'_>, String> {
     let mut cfg = BootCfg {
         layers: Vec::new(),
-        cow: String::new(),
+        cow: "",
         timeout: DEFAULT_TIMEOUT,
         hostname: None,
         ips: Vec::new(),
-        init: DEFAULT_INIT.to_string(),
+        init: DEFAULT_INIT,
         debug: false,
         trace: false,
     };
     for (key, val) in params(cmdline) {
         match key {
             "cocoon.layers" => {
-                cfg.layers = val
-                    .split(',')
-                    .filter(|s| !s.is_empty())
-                    .map(String::from)
-                    .collect();
+                cfg.layers = val.split(',').filter(|s| !s.is_empty()).collect();
             }
-            "cocoon.cow" => cfg.cow = val.to_string(),
-            // a junk value keeps the default, matching the old initramfs hook.
+            "cocoon.cow" => cfg.cow = val,
             "cocoon.timeout" => {
                 if let Ok(secs) = val.parse::<u64>() {
                     cfg.timeout = Duration::from_secs(secs.min(MAX_TIMEOUT_SECS));
                 }
             }
-            "cocoon.hostname" if !val.is_empty() => cfg.hostname = Some(val.to_string()),
+            "cocoon.hostname" if !val.is_empty() => cfg.hostname = Some(val),
             "sandbox.debug" => cfg.debug = debug_token(val),
             "sandbox.trace" => cfg.trace = debug_token(val),
             "ip" => {
                 if let Some(param) = parse_ip_param(val) {
                     cfg.ips.push(param);
                 }
             }
-            "sandbox.init" if !val.is_empty() => cfg.init = val.to_string(),
+            "sandbox.init" if !val.is_empty() => cfg.init = val,
             _ => {}
         }
     }
@@ -128,24 +123,24 @@ fn debug_token(val: &str) -> bool {
 }
 
 /// Kernel ip= fields: client:server:gw:netmask:hostname:device:autoconf[:dns0[:dns1]]; anything else is ignored.
-fn parse_ip_param(val: &str) -> Option<IpParam> {
+fn parse_ip_param(val: &str) -> Option<IpParam<'_>> {
     let f: Vec<&str> = val.split(':').collect();
     if f.len() < 7 || f[0].is_empty() || f[5].is_empty() {
         return None;
     }
     let prefix = mask_to_prefix(f[3])?;
-    let gateway = (!f[2].is_empty() && f[2] != "0.0.0.0").then(|| f[2].to_string());
+    let gateway = (!f[2].is_empty() && f[2] != "0.0.0.0").then_some(f[2]);
     let dns = f[7..]
         .iter()
-        .filter(|d| !d.is_empty() && **d != "0.0.0.0")
-        .map(|d| d.to_string())
+        .copied()
+        .filter(|d| !d.is_empty() && *d != "0.0.0.0")
         .collect();
     Some(IpParam {
-        addr: f[0].to_string(),
+        addr: f[0],
         prefix,
         gateway,
         dns,
-        device: f[5].to_string(),
+        device: f[5],
     })
 }
 
@@ -171,7 +166,7 @@ mod tests {
         assert_eq!(cfg.layers, vec!["a", "b"]);
         assert_eq!(cfg.cow, "cow");
         assert_eq!(cfg.timeout, Duration::from_secs(3));
-        assert_eq!(cfg.hostname.as_deref(), Some("vm1"));
+        assert_eq!(cfg.hostname, Some("vm1"));
         assert_eq!(cfg.init, "/bin/systemd");
         assert!(cfg.debug);
         assert!(cfg.ips.is_empty());
@@ -213,11 +208,11 @@ mod tests {
 
     #[test]
     fn parse_huge_timeout_is_capped() {
-        let cfg = parse(&format!(
+        let cmdline = format!(
             "cocoon.layers=l0 cocoon.cow=cow cocoon.timeout={}",
             u64::MAX
-        ))
-        .unwrap();
+        );
+        let cfg = parse(&cmdline).unwrap();
         assert_eq!(cfg.timeout, Duration::from_secs(MAX_TIMEOUT_SECS));
     }
 
@@ -277,11 +272,11 @@ mod tests {
         assert_eq!(
             cfg.ips,
             vec![IpParam {
-                addr: "172.20.100.5".into(),
+                addr: "172.20.100.5",
                 prefix: 24,
-                gateway: Some("172.20.100.1".into()),
-                dns: vec!["8.8.8.8".into(), "8.8.4.4".into()],
-                device: "eth0".into(),
+                gateway: Some("172.20.100.1"),
+                dns: vec!["8.8.8.8", "8.8.4.4"],
+                device: "eth0",
             }]
         );
     }
@@ -315,11 +310,11 @@ mod tests {
     #[test]
     fn network_unit_layout() {
         let ip = IpParam {
-            addr: "172.20.100.5".into(),
+            addr: "172.20.100.5",
             prefix: 24,
-            gateway: Some("172.20.100.1".into()),
-            dns: vec!["8.8.8.8".into()],
-            device: "eth0".into(),
+            gateway: Some("172.20.100.1"),
+            dns: vec!["8.8.8.8"],
+            device: "eth0",
         };
         assert_eq!(
             network_unit(&ip, "aa:bb:cc:dd:ee:ff"),

docs/android.md

@@ -40,8 +40,9 @@ ln, err := sb.ProxyPort(ctx, "127.0.0.1:6555", 5555)
 
 ## What works, what differs
 
-- `sb.Exec` runs `/system/bin/sh` — there is no bash and no glibc, so the
-  session verbs (persistent bash) are unavailable; prefix commands with
+- There is no bash and no glibc, so pass `/system/bin/sh` as argv[0]
+  (`sb.Exec(ctx, "/system/bin/sh", "-c", ...)`), and the session verbs
+  (persistent bash) are unavailable; prefix commands with
   `PATH=/system/bin:/system/xbin:$PATH` when calling tools directly.
 - Files, port relay, and watch verbs work as on the Ubuntu flavors.
 - Checkpoint/branch of a booted Android works: a branch answers `ps` and

docs/benchmarks.md

@@ -72,14 +72,13 @@ prints a markdown table stamped with the host evidence: virtualization
 (`systemd-detect-virt`), CPU, kernel, cocoon version, image digest.
 On exit it removes every `sbx-*` VM on the cocoon root, a serving
 sandboxd's claims included, so run it only on a node that serves no claims.
+The daemon also reclaims every `sbx-` VM at start.
 
 Knobs (environment variables): `WARM`/`WARM_N` (warm-pool depth and burst
 size — the burst must stay within the depth, or refill loses the race and
 the tail measures clones), `CLONE_N`, `COLD_N`, `RPC_N`, `PULL_MB`,
 `PULL_N`, `BURST_N` (concurrent clone-claim burst; 0 skips the stage),
-`ADDR`/`TOKEN` (the throwaway daemon's listen address and token). Run the
-harness on a node with no live sandboxd: the daemon reclaims every `sbx-` VM at
-start, and the harness removes every `sbx-` VM at exit.
+`ADDR`/`TOKEN` (the throwaway daemon's listen address and token).
 
 Boot anatomy (where inside the cold tier the milliseconds go — kernel,
 initramfs phases, rootfs handoff) has its own harness: