fix: 修复 CH9329 健康检测错误和切换错误 #251 #255 #265

.github/workflows/docker.yml

@@ -0,0 +1,85 @@
+name: Docker
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Docker image tag
+        required: false
+        default: latest
+      platforms:
+        description: Docker platforms
+        required: false
+        default: linux/amd64,linux/arm64,linux/arm/v7
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  DOCKER_PLATFORMS: ${{ github.event_name == 'workflow_dispatch' && inputs.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
+  DOCKER_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+
+jobs:
+  docker:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y unzip xz-utils
+          cargo install cross --locked
+
+      - name: Build frontend
+        working-directory: web
+        run: |
+          npm ci
+          npm run build
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build linux binaries
+        run: bash build/build-images.sh
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to Aliyun Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.cn-hangzhou.aliyuncs.com
+          username: ${{ secrets.ALIYUN_USERNAME }}
+          password: ${{ secrets.ALIYUN_PASSWORD }}
+
+      - name: Publish Docker images
+        run: |
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry docker.io/silentwind0 --tag "$DOCKER_TAG" --push
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry registry.cn-hangzhou.aliyuncs.com/silentwind --tag "$DOCKER_TAG" --push
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry docker.io/silentwind0 --variant full --tag "$DOCKER_TAG" --push
+          ./build/package-docker.sh --platform "$DOCKER_PLATFORMS" --registry registry.cn-hangzhou.aliyuncs.com/silentwind --variant full --tag "$DOCKER_TAG" --push

Cargo.toml

@@ -20,6 +20,7 @@ desktop = [
     "dep:sqlx",
     "dep:serde",
     "dep:serde_json",
+    "dep:toml_edit",
     "dep:tracing",
     "dep:tracing-subscriber",
     "dep:thiserror",
@@ -38,6 +39,7 @@ desktop = [
     "dep:axum-server",
     "dep:clap",
     "dep:time",
+    "dep:tempfile",
     "dep:bytes",
     "dep:bytemuck",
     "dep:xxhash-rust",
@@ -98,6 +100,7 @@ android = [
     "dep:sdp-types",
     "dep:serde",
     "dep:serde_json",
+    "dep:toml_edit",
     "dep:serialport",
     "dep:sha2",
     "dep:sodiumoxide",
@@ -106,6 +109,7 @@ android = [
     "dep:audiopus",
     "dep:thiserror",
     "dep:time",
+    "dep:tempfile",
     "dep:tokio",
     "dep:tokio-tungstenite",
     "dep:tokio-util",
@@ -143,6 +147,7 @@ sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite"], optional = tru
 # Serialization
 serde = { version = "1", features = ["derive"], optional = true }
 serde_json = { version = "1", optional = true }
+toml_edit = { version = "0.25", optional = true }
 
 # Logging
 tracing = { version = "0.1", optional = true }
@@ -160,6 +165,7 @@ rand = { version = "0.9", optional = true }
 # Utilities
 uuid = { version = "1", features = ["v4", "serde"], optional = true }
 base64 = { version = "0.22", optional = true }
+tempfile = { version = "3", optional = true }
 
 # HTTP client (for URL downloads)
 # Use rustls by default, but allow native-tls for systems with older GLIBC

agents.md

@@ -1,14 +0,0 @@
-# Agents Notes
-
-## Windows MSVC Build
-
-Run from the repository root in PowerShell:
-
-```powershell
-$env:VCPKG_ROOT='C:\Users\mofen\code\vcpkg'
-$env:TURBOJPEG_SOURCE='explicit'
-$env:TURBOJPEG_LIB_DIR='C:\Users\mofen\code\vcpkg\installed\x64-windows-static\lib'
-$env:TURBOJPEG_INCLUDE_DIR='C:\Users\mofen\code\vcpkg\installed\x64-windows-static\include'
-
-cargo build --target x86_64-pc-windows-msvc
-```

android/app/build.gradle.kts

@@ -44,8 +44,6 @@ val oneKvmVersion = Regex("""(?m)^version\s*=\s*"([^"]+)"""")
     ?.groupValues
     ?.get(1)
     ?: throw GradleException("Failed to resolve version from root Cargo.toml")
-val androidFfmpegSourceDir = rootProject.layout.projectDirectory
-    .dir("../.tmp/android-ffmpeg-check/src/ffmpeg-rockchip")
 val localProperties = Properties().apply {
     val file = rootProject.file("local.properties")
     if (file.exists()) {
@@ -207,7 +205,6 @@ tasks.register<Exec>("buildAndroidFfmpegMediaCodec") {
     group = "build"
 
     val ffmpegRoot = file(androidFfmpegRoot.get())
-    val sourceDir = androidFfmpegSourceDir.asFile
     val scriptFile = androidFfmpegBuildScript.asFile
     val stampFile = ffmpegRoot.resolve(".one-kvm-android-ffmpeg.stamp")
 
@@ -215,8 +212,6 @@ tasks.register<Exec>("buildAndroidFfmpegMediaCodec") {
     commandLine(
         "bash",
         scriptFile.absolutePath,
-        "--source",
-        sourceDir.absolutePath,
         "--output",
         ffmpegRoot.absolutePath,
         "--ndk",
@@ -227,7 +222,6 @@ tasks.register<Exec>("buildAndroidFfmpegMediaCodec") {
         selectedAndroidAbis.joinToString(","),
     )
 
-    inputs.dir(sourceDir)
     inputs.file(scriptFile)
     outputs.dir(ffmpegRoot)
 
@@ -235,12 +229,6 @@ tasks.register<Exec>("buildAndroidFfmpegMediaCodec") {
         val hasAndroidFfmpeg = androidFfmpegRequiredFiles(ffmpegRoot).all { it.exists() }
         val hasCurrentBuildStamp =
             stampFile.exists() && stampFile.readText() == androidFfmpegBuildStamp(scriptFile)
-        if (!hasAndroidFfmpeg && !sourceDir.resolve("configure").exists()) {
-            throw GradleException(
-                "Missing Android FFmpeg MediaCodec build at ${ffmpegRoot.absolutePath}, " +
-                    "and source was not found at ${sourceDir.absolutePath}",
-            )
-        }
         !hasAndroidFfmpeg || !hasCurrentBuildStamp
     }
 

android/settings.gradle.kts

@@ -1,5 +1,16 @@
 pluginManagement {
+    fun isEnabled(value: String?): Boolean = when (value?.lowercase()) {
+        "1", "true", "yes", "on" -> true
+        else -> false
+    }
+    val mirrorAcceleration = isEnabled(System.getenv("CHINAMIRRO"))
+
     repositories {
+        if (mirrorAcceleration) {
+            maven("https://maven.aliyun.com/repository/google")
+            maven("https://maven.aliyun.com/repository/public")
+            maven("https://maven.aliyun.com/repository/gradle-plugin")
+        }
         google()
         mavenCentral()
         gradlePluginPortal()
@@ -7,8 +18,18 @@ pluginManagement {
 }
 
 dependencyResolutionManagement {
+    fun isEnabled(value: String?): Boolean = when (value?.lowercase()) {
+        "1", "true", "yes", "on" -> true
+        else -> false
+    }
+    val mirrorAcceleration = isEnabled(System.getenv("CHINAMIRRO"))
+
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
+        if (mirrorAcceleration) {
+            maven("https://maven.aliyun.com/repository/google")
+            maven("https://maven.aliyun.com/repository/public")
+        }
         google()
         mavenCentral()
     }

build/build-android.sh

@@ -17,28 +17,21 @@ fail() {
 build_android() {
     local arch="$1"
     local docker_build_args=()
-    local docker_mount_args=()
     local gradle_distribution_url="${ONE_KVM_GRADLE_DISTRIBUTION_URL:-}"
     local gradle_distribution_url_cn="${ONE_KVM_GRADLE_DISTRIBUTION_URL_CN:-https://mirrors.cloud.tencent.com/gradle/gradle-9.1.0-bin.zip}"
     local gradle_network_timeout="${ONE_KVM_GRADLE_NETWORK_TIMEOUT:-120000}"
-    local gradle_cache="${ONE_KVM_ANDROID_GRADLE_CACHE_DIR:-one-kvm-android-gradle-cache}"
-    local cargo_registry_cache="${ONE_KVM_ANDROID_CARGO_REGISTRY_CACHE_DIR:-one-kvm-android-cargo-registry}"
-    local cargo_git_cache="${ONE_KVM_ANDROID_CARGO_GIT_CACHE_DIR:-one-kvm-android-cargo-git}"
-
-    add_cache_mount() {
-        local source="$1"
-        local target="$2"
-
-        if [[ "$source" == /* || "$source" == ./* || "$source" == ../* ]]; then
-            mkdir -p "$source"
-            source="$(cd "$source" && pwd)"
-        fi
-
-        docker_mount_args+=("-v" "$source:$target")
-    }
 
     if [[ "${CHINAMIRRO:-}" == "1" ]]; then
         docker_build_args+=("--build-arg" "CHINAMIRRO=1")
+        docker_build_args+=("--build-arg" "DEBIAN_IMAGE=${DEBIAN_IMAGE:-docker.1ms.run/library/debian:11}")
+        docker_build_args+=("--build-arg" "RUSTUP_DIST_SERVER_CN=${RUSTUP_DIST_SERVER_CN:-https://rsproxy.cn}")
+        docker_build_args+=("--build-arg" "RUSTUP_UPDATE_ROOT_CN=${RUSTUP_UPDATE_ROOT_CN:-https://rsproxy.cn/rustup}")
+        docker_build_args+=("--build-arg" "CARGO_INDEX_CN=${CARGO_INDEX_CN:-https://rsproxy.cn/crates.io-index}")
+        docker_build_args+=("--build-arg" "CARGO_REGISTRY_CN=${CARGO_REGISTRY_CN:-sparse+https://rsproxy.cn/index/}")
+        docker_build_args+=("--build-arg" "MAVEN_REPOSITORY_CN=${MAVEN_REPOSITORY_CN:-https://maven.aliyun.com/repository/public}")
+        docker_build_args+=("--build-arg" "GOOGLE_MAVEN_REPOSITORY_CN=${GOOGLE_MAVEN_REPOSITORY_CN:-https://maven.aliyun.com/repository/google}")
+        docker_build_args+=("--build-arg" "GRADLE_PLUGIN_REPOSITORY_CN=${GRADLE_PLUGIN_REPOSITORY_CN:-https://maven.aliyun.com/repository/gradle-plugin}")
+        docker_build_args+=("--build-arg" "GRADLE_DISTRIBUTION_URL_CN=$gradle_distribution_url_cn")
         if [[ -z "$gradle_distribution_url" ]]; then
             gradle_distribution_url="$gradle_distribution_url_cn"
         fi
@@ -55,16 +48,12 @@ build_android() {
             "$PROJECT_ROOT/build/cross"
     fi
 
-    add_cache_mount "$gradle_cache" "/root/.gradle"
-    add_cache_mount "$cargo_registry_cache" "/root/.cargo/registry"
-    add_cache_mount "$cargo_git_cache" "/root/.cargo/git"
-
     echo "=== Building Android APK: $arch ==="
     docker run --rm \
         -v "$PROJECT_ROOT:/workspace" \
-        "${docker_mount_args[@]}" \
         -w /workspace \
         -e "CHINAMIRRO=${CHINAMIRRO:-0}" \
+        -e "GH_PROXY=${GH_PROXY:-https://gh-proxy.com}" \
         -e "ONE_KVM_GRADLE_DISTRIBUTION_URL=$gradle_distribution_url" \
         -e "ONE_KVM_GRADLE_DISTRIBUTION_URL_CN=$gradle_distribution_url_cn" \
         -e "ONE_KVM_GRADLE_NETWORK_TIMEOUT=$gradle_network_timeout" \
@@ -102,9 +91,6 @@ Examples:
   CHINAMIRRO=1 ONE_KVM_GRADLE_DISTRIBUTION_URL=https://mirrors.aliyun.com/macports/distfiles/gradle/gradle-9.1.0-bin.zip build/build-android.sh all
 
 Environment:
-  ONE_KVM_ANDROID_GRADLE_CACHE_DIR          Host Gradle cache path or Docker volume name
-  ONE_KVM_ANDROID_CARGO_REGISTRY_CACHE_DIR  Host Cargo registry cache path or Docker volume name
-  ONE_KVM_ANDROID_CARGO_GIT_CACHE_DIR       Host Cargo git cache path or Docker volume name
   ONE_KVM_ANDROID_SKIP_DOCKER_BUILD=1       Reuse an already loaded Docker image
 
 APK output:

build/build-images.sh

@@ -21,16 +21,21 @@ build_arch() {
 
     case "${CHINAMIRRO:-}" in
         1|true|TRUE|yes|YES|on|ON)
-            local cross_build_opts="${CROSS_BUILD_OPTS:+$CROSS_BUILD_OPTS }--build-arg CHINAMIRRO=1"
-            echo "=== China mirror acceleration: enabled (Tsinghua) ==="
+            local cross_build_opts="${CROSS_BUILD_OPTS:+$CROSS_BUILD_OPTS }--progress=plain --build-arg CHINAMIRRO=1 --build-arg GH_PROXY=${GH_PROXY:-https://gh-proxy.com/} --build-arg DEBIAN_IMAGE=${DEBIAN_IMAGE:-docker.1ms.run/library/debian:11}"
+            cross_build_opts="$cross_build_opts --build-arg HTTP_PROXY= --build-arg HTTPS_PROXY= --build-arg ALL_PROXY= --build-arg NO_PROXY="
+            cross_build_opts="$cross_build_opts --build-arg http_proxy= --build-arg https_proxy= --build-arg all_proxy= --build-arg no_proxy="
+            echo "=== China mirror acceleration: enabled ==="
             echo "=== Building: $rust_target (via cross with custom Dockerfile) ==="
             env \
                 CROSS_BUILD_OPTS="$cross_build_opts" \
-                CARGO_SOURCE_CRATES_IO_REPLACE_WITH=tuna \
-                CARGO_SOURCE_TUNA_REGISTRY=sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/ \
+                CARGO_SOURCE_CRATES_IO_REPLACE_WITH=rsproxy-sparse \
+                CARGO_SOURCE_RSPROXY_REGISTRY=https://rsproxy.cn/crates.io-index \
+                CARGO_SOURCE_RSPROXY_SPARSE_REGISTRY=sparse+https://rsproxy.cn/index/ \
+                CARGO_REGISTRIES_RSPROXY_INDEX=https://rsproxy.cn/crates.io-index \
                 CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse \
-                RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup \
-                RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup \
+                CARGO_NET_GIT_FETCH_WITH_CLI=true \
+                RUSTUP_DIST_SERVER=https://rsproxy.cn \
+                RUSTUP_UPDATE_ROOT=https://rsproxy.cn/rustup \
                 cross build --release --target "$rust_target"
             return
             ;;
@@ -66,7 +71,7 @@ case "${1:-all}" in
         echo "Examples:"
         echo "  $0              # Build all"
         echo "  $0 x86_64       # Build x86_64 only"
-        echo "  CHINAMIRRO=1 $0 arm64  # Build with Tsinghua mirrors"
+        echo "  CHINAMIRRO=1 $0 arm64  # Build with China mirrors"
         exit 0
         ;;
     *)
@@ -83,16 +88,4 @@ for target in "${ARCH_MAP[@]}"; do
     fi
 done
 echo ""
-echo "Static libraries:"
-for target in "${ARCH_MAP[@]}"; do
-    case "$target" in
-        x86_64-unknown-linux-gnu) gnu_target="x86_64-linux-gnu" ;;
-        aarch64-unknown-linux-gnu) gnu_target="aarch64-linux-gnu" ;;
-        armv7-unknown-linux-gnueabihf) gnu_target="armv7-linux-gnueabihf" ;;
-    esac
-    if [ -d "$PROJECT_DIR/target/one-kvm-libs/$gnu_target/lib" ]; then
-        echo "  $gnu_target: OK"
-    fi
-done
-echo ""
 echo "Next step: ./build/package-docker.sh or ./build/package-deb.sh"

build/cross/Dockerfile.android

@@ -1,7 +1,8 @@
 # Android build image for One-KVM
 # Based on Debian 11 for stable toolchain/runtime compatibility
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:11
+FROM ${DEBIAN_IMAGE}
 
 ARG CHINAMIRRO=0
 ARG ANDROID_SDK_ROOT=/root/android-sdk
@@ -10,11 +11,13 @@ ARG ANDROID_NDK_VERSION=27.3.13750724
 ARG ANDROID_PLATFORM=36
 ARG ANDROID_BUILD_TOOLS=36.0.0
 ARG CARGO_NDK_VERSION=4.1.2
-ARG RUSTUP_DIST_SERVER_CN=https://mirrors.tuna.tsinghua.edu.cn/rustup
-ARG RUSTUP_UPDATE_ROOT_CN=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup
-ARG CARGO_REGISTRY_CN=sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/
+ARG RUSTUP_DIST_SERVER_CN=https://rsproxy.cn
+ARG RUSTUP_UPDATE_ROOT_CN=https://rsproxy.cn/rustup
+ARG CARGO_INDEX_CN=https://rsproxy.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://rsproxy.cn/index/
 ARG MAVEN_REPOSITORY_CN=https://maven.aliyun.com/repository/public
 ARG GOOGLE_MAVEN_REPOSITORY_CN=https://maven.aliyun.com/repository/google
+ARG GRADLE_PLUGIN_REPOSITORY_CN=https://maven.aliyun.com/repository/gradle-plugin
 ARG GRADLE_DISTRIBUTION_URL_CN=https://mirrors.cloud.tencent.com/gradle/gradle-9.1.0-bin.zip
 ARG ANDROID_CMDLINE_TOOLS_URL=
 
@@ -29,9 +32,8 @@ ENV PATH=/root/.cargo/bin:${PATH}
 ENV ONE_KVM_GRADLE_DISTRIBUTION_URL_CN=${GRADLE_DISTRIBUTION_URL_CN}
 
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        sed -i \
-            -e 's|http://deb.debian.org/debian|http://mirrors.tuna.tsinghua.edu.cn/debian|g' \
-            -e 's|http://security.debian.org/debian-security|http://mirrors.tuna.tsinghua.edu.cn/debian-security|g' \
+        sed -i -E \
+            -e 's|http://deb.debian.org/debian([[:space:]])|http://mirrors.tuna.tsinghua.edu.cn/debian\1|g' \
             /etc/apt/sources.list; \
     fi
 
@@ -39,6 +41,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
     wget \
+    bzip2 \
     unzip \
     zip \
     git \
@@ -63,11 +66,15 @@ RUN if [ "$CHINAMIRRO" = "1" ]; then \
         mkdir -p /root/.cargo; \
         printf '%s\n' \
             '[source.crates-io]' \
-            "replace-with = 'tuna'" \
-            '[source.tuna]' \
+            "replace-with = 'rsproxy-sparse'" \
+            '[source.rsproxy]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.rsproxy-sparse]' \
             "registry = '${CARGO_REGISTRY_CN}'" \
-            '[registries.tuna]' \
-            "index = '${CARGO_REGISTRY_CN}'" \
+            '[registries.rsproxy]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
             > /root/.cargo/config.toml; \
     fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
@@ -102,6 +109,7 @@ RUN if [ "$CHINAMIRRO" = "1" ]; then \
             "beforeSettings { settings ->" \
             "    settings.pluginManagement.repositories.maven { url = uri('${GOOGLE_MAVEN_REPOSITORY_CN}') }" \
             "    settings.pluginManagement.repositories.maven { url = uri('${MAVEN_REPOSITORY_CN}') }" \
+            "    settings.pluginManagement.repositories.maven { url = uri('${GRADLE_PLUGIN_REPOSITORY_CN}') }" \
             "    settings.dependencyResolutionManagement.repositories.maven { url = uri('${GOOGLE_MAVEN_REPOSITORY_CN}') }" \
             "    settings.dependencyResolutionManagement.repositories.maven { url = uri('${MAVEN_REPOSITORY_CN}') }" \
             "}" \
@@ -238,7 +246,9 @@ RUN printf '%s\n' \
         '    '"'"' "$WRAPPER_PROPERTIES" > "$WRAPPER_PROPERTIES_TMP"' \
         '    cp "$WRAPPER_PROPERTIES_TMP" "$WRAPPER_PROPERTIES"' \
         '    rm -f "$WRAPPER_PROPERTIES_TMP"' \
-        '    find /root/.gradle/wrapper/dists -name "*.lck" -o -name "*.part" 2>/dev/null | xargs -r rm -f' \
+        '    if [[ -d /root/.gradle/wrapper/dists ]]; then' \
+        '        find /root/.gradle/wrapper/dists \( -name "*.lck" -o -name "*.part" \) -print0 | xargs -0 -r rm -f' \
+        '    fi' \
         'fi' \
         '' \
         'ensure_keystore' \

build/cross/Dockerfile.arm64

@@ -1,18 +1,26 @@
 # Cross-compilation image for ARM64 based on Debian 11
 # Build on Debian 11 (GLIBC 2.31) for maximum runtime compatibility
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:11
+FROM ${DEBIAN_IMAGE}
 
-# Linux headers used by v4l2r bindgen
-ARG LINUX_HEADERS_VERSION=6.6
-ARG LINUX_HEADERS_SHA256=
 ARG CHINAMIRRO=0
+ARG GH_PROXY=https://gh-proxy.com/
+ARG RUSTUP_DIST_SERVER_CN=https://rsproxy.cn
+ARG RUSTUP_UPDATE_ROOT_CN=https://rsproxy.cn/rustup
+ARG CARGO_INDEX_CN=https://rsproxy.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://rsproxy.cn/index/
+ARG LIBJPEG_TURBO_VERSION=3.1.4.1
+ARG LIBYUV_REV=957f295ea946cbbd13fcfc46e7066f2efa801233
+ARG LIBVPX_VERSION=1.16.0
+ARG X265_VERSION=3.4
+ARG OPUS_VERSION=1.5.2
+ARG FFMPEG_ROCKCHIP_REV=40c412daccf08164493da0de990eb99a8948116b
 
-# Optionally use Tsinghua mirrors for builds in China.
+# Optionally use China mirrors for builds in China.
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        sed -i \
-            -e 's|http://deb.debian.org/debian|http://mirrors.tuna.tsinghua.edu.cn/debian|g' \
-            -e 's|http://security.debian.org/debian-security|http://mirrors.tuna.tsinghua.edu.cn/debian-security|g' \
+        sed -i -E \
+            -e 's|http://deb.debian.org/debian([[:space:]])|http://mirrors.tuna.tsinghua.edu.cn/debian\1|g' \
             /etc/apt/sources.list; \
     fi
 
@@ -21,19 +29,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
     && if [ "$CHINAMIRRO" = "1" ]; then \
-        export RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup; \
-        export RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup; \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
     fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
     && if [ "$CHINAMIRRO" = "1" ]; then \
         mkdir -p /root/.cargo; \
         printf '%s\n' \
             '[source.crates-io]' \
-            "replace-with = 'tuna'" \
-            '[source.tuna]' \
-            'registry = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"' \
-            '[registries.tuna]' \
-            'index = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"' \
+            "replace-with = 'rsproxy-sparse'" \
+            '[source.rsproxy]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.rsproxy-sparse]' \
+            "registry = '${CARGO_REGISTRY_CN}'" \
+            '[registries.rsproxy]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
             > /root/.cargo/config.toml; \
     fi \
     && rm -rf /var/lib/apt/lists/*
@@ -69,6 +81,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Install ARM64 development libraries (without VAAPI/X11 for ARM)
 RUN apt-get update && apt-get install -y --no-install-recommends \
+    libssl1.1 \
+    libssl1.1:arm64 \
     libasound2-dev:arm64 \
     libv4l-dev:arm64 \
     libudev-dev:arm64 \
@@ -78,20 +92,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libdrm-dev:arm64 \
     && rm -rf /var/lib/apt/lists/*
 
-# Install newer V4L2 headers for v4l2r bindgen
-RUN mkdir -p /opt/v4l2-headers \
-    && wget -q https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_HEADERS_VERSION}.tar.xz -O /tmp/linux-headers.tar.xz \
-    && if [ -n "$LINUX_HEADERS_SHA256" ]; then echo "$LINUX_HEADERS_SHA256  /tmp/linux-headers.tar.xz" | sha256sum -c -; fi \
-    && tar -xf /tmp/linux-headers.tar.xz -C /tmp \
-    && cd /tmp/linux-${LINUX_HEADERS_VERSION} \
-    && make ARCH=arm64 headers_install INSTALL_HDR_PATH=/opt/v4l2-headers \
-    && rm -rf /tmp/linux-${LINUX_HEADERS_VERSION} /tmp/linux-headers.tar.xz
-
-ENV V4L2R_VIDEODEV2_H_PATH=/opt/v4l2-headers/include
-
 # Build static libjpeg-turbo from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libjpeg-turbo \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libjpeg-turbo \
     && cd /tmp/libjpeg-turbo \
+    && git remote add origin "${github_prefix}https://github.com/libjpeg-turbo/libjpeg-turbo.git" \
+    && git fetch --depth 1 origin "refs/tags/${LIBJPEG_TURBO_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/aarch64-linux-gnu \
@@ -105,8 +113,13 @@ RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libj
     && rm -rf /tmp/libjpeg-turbo
 
 # Build static libyuv from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
+RUN git init /tmp/libyuv \
     && cd /tmp/libyuv \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git remote add origin "${github_prefix}https://github.com/lemenkov/libyuv" \
+    && git fetch --depth 1 origin ${LIBYUV_REV} \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/aarch64-linux-gnu \
@@ -125,8 +138,13 @@ RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
 
 # Build static libvpx from source (cross-compile for ARM64)
 # CC/CXX/LD/AR must be environment variables, not configure arguments
-RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libvpx \
     && cd /tmp/libvpx \
+    && git remote add origin "${github_prefix}https://github.com/webmproject/libvpx.git" \
+    && git fetch --depth 1 origin "refs/tags/v${LIBVPX_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && echo "=== libvpx: Configuring for ARM64 ===" \
     && export CC=aarch64-linux-gnu-gcc \
     && export CXX=aarch64-linux-gnu-g++ \
@@ -149,7 +167,9 @@ RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
     && rm -rf /tmp/libvpx
 
 # Build static libx264 from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "${github_prefix}https://github.com/mirror/x264.git" /tmp/x264 \
     && cd /tmp/x264 \
     && export CC=aarch64-linux-gnu-gcc \
     && export AR=aarch64-linux-gnu-ar \
@@ -165,12 +185,18 @@ RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
     && rm -rf /tmp/x264
 
 # Build static libx265 from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://bitbucket.org/multicoreware/x265_git /tmp/x265 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/x265 \
     && cd /tmp/x265 \
+    && git remote add origin "${github_prefix}https://github.com/videolan/x265.git" \
+    && git fetch --depth 1 origin "refs/tags/${X265_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && cd source \
     && mkdir -p build \
     && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_NASM_FLAGS="-w-macro-params-legacy" \
         -DCMAKE_INSTALL_PREFIX=/usr/aarch64-linux-gnu \
         -DCMAKE_SYSTEM_NAME=Linux \
         -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
@@ -204,12 +230,15 @@ Cflags: -I\${includedir}
 EOF
 
 # Build static libopus from source (cross-compile for ARM64)
-RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && wget -O /tmp/opus.tar.gz "${github_prefix}https://github.com/xiph/opus/releases/download/v${OPUS_VERSION}/opus-${OPUS_VERSION}.tar.gz" \
+    && tar -xzf /tmp/opus.tar.gz -C /tmp \
+    && mv "/tmp/opus-${OPUS_VERSION}" /tmp/opus \
     && cd /tmp/opus \
     && export CC=aarch64-linux-gnu-gcc \
     && export AR=aarch64-linux-gnu-ar \
     && export RANLIB=aarch64-linux-gnu-ranlib \
-    && ./autogen.sh \
     && ./configure \
         --prefix=/usr/aarch64-linux-gnu \
         --host=aarch64-linux-gnu \
@@ -217,13 +246,20 @@ RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
         --disable-doc \
     && make -j$(nproc) \
     && make install \
-    && rm -rf /tmp/opus
+    && rm -rf /tmp/opus /tmp/opus.tar.gz
 
 # Download and build FFmpeg with RKMPP support
 RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
-    && wget -q https://files.mofeng.run/src/image/other/ffmpeg.tar.gz \
-    && tar -xzf ffmpeg.tar.gz \
-    && cd ffmpeg \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "https://gitee.com/nyanmisaka/mpp.git" rkmpp \
+    && git clone --depth 1 "https://gitee.com/nyanmisaka/rga.git" rkrga \
+    && git init ffmpeg-rockchip \
+    && cd ffmpeg-rockchip \
+    && git remote add origin "${github_prefix}https://github.com/nyanmisaka/ffmpeg-rockchip.git" \
+    && git fetch --depth 1 origin ${FFMPEG_ROCKCHIP_REV} \
+    && git checkout --detach FETCH_HEAD \
+    && cd .. \
     # Build RKMPP
     && mkdir -p rkmpp/build && cd rkmpp/build \
     && cmake .. \
@@ -354,8 +390,8 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
 
 # Add Rust target
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        export RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup; \
-        export RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup; \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
     fi \
     && rustup target add aarch64-unknown-linux-gnu
 

build/cross/Dockerfile.armv7

@@ -1,18 +1,26 @@
 # Cross-compilation image for ARMv7 based on Debian 11
 # Build on Debian 11 (GLIBC 2.31) for maximum runtime compatibility
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:11
+FROM ${DEBIAN_IMAGE}
 
-# Linux headers used by v4l2r bindgen
-ARG LINUX_HEADERS_VERSION=6.6
-ARG LINUX_HEADERS_SHA256=
 ARG CHINAMIRRO=0
+ARG GH_PROXY=https://gh-proxy.com/
+ARG RUSTUP_DIST_SERVER_CN=https://rsproxy.cn
+ARG RUSTUP_UPDATE_ROOT_CN=https://rsproxy.cn/rustup
+ARG CARGO_INDEX_CN=https://rsproxy.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://rsproxy.cn/index/
+ARG LIBJPEG_TURBO_VERSION=3.1.4.1
+ARG LIBYUV_REV=957f295ea946cbbd13fcfc46e7066f2efa801233
+ARG LIBVPX_VERSION=1.16.0
+ARG X265_VERSION=3.4
+ARG OPUS_VERSION=1.5.2
+ARG FFMPEG_ROCKCHIP_REV=40c412daccf08164493da0de990eb99a8948116b
 
-# Optionally use Tsinghua mirrors for builds in China.
+# Optionally use China mirrors for builds in China.
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        sed -i \
-            -e 's|http://deb.debian.org/debian|http://mirrors.tuna.tsinghua.edu.cn/debian|g' \
-            -e 's|http://security.debian.org/debian-security|http://mirrors.tuna.tsinghua.edu.cn/debian-security|g' \
+        sed -i -E \
+            -e 's|http://deb.debian.org/debian([[:space:]])|http://mirrors.tuna.tsinghua.edu.cn/debian\1|g' \
             /etc/apt/sources.list; \
     fi
 
@@ -21,19 +29,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
     && if [ "$CHINAMIRRO" = "1" ]; then \
-        export RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup; \
-        export RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup; \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
     fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
     && if [ "$CHINAMIRRO" = "1" ]; then \
         mkdir -p /root/.cargo; \
         printf '%s\n' \
             '[source.crates-io]' \
-            "replace-with = 'tuna'" \
-            '[source.tuna]' \
-            'registry = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"' \
-            '[registries.tuna]' \
-            'index = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"' \
+            "replace-with = 'rsproxy-sparse'" \
+            '[source.rsproxy]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.rsproxy-sparse]' \
+            "registry = '${CARGO_REGISTRY_CN}'" \
+            '[registries.rsproxy]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
             > /root/.cargo/config.toml; \
     fi \
     && rm -rf /var/lib/apt/lists/*
@@ -69,6 +81,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Install ARMv7 development libraries (without VAAPI/X11 for ARM)
 RUN apt-get update && apt-get install -y --no-install-recommends \
+    libssl1.1 \
+    libssl1.1:armhf \
     libasound2-dev:armhf \
     libv4l-dev:armhf \
     libudev-dev:armhf \
@@ -77,20 +91,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libdrm-dev:armhf \
     && rm -rf /var/lib/apt/lists/*
 
-# Install newer V4L2 headers for v4l2r bindgen
-RUN mkdir -p /opt/v4l2-headers \
-    && wget -q https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_HEADERS_VERSION}.tar.xz -O /tmp/linux-headers.tar.xz \
-    && if [ -n "$LINUX_HEADERS_SHA256" ]; then echo "$LINUX_HEADERS_SHA256  /tmp/linux-headers.tar.xz" | sha256sum -c -; fi \
-    && tar -xf /tmp/linux-headers.tar.xz -C /tmp \
-    && cd /tmp/linux-${LINUX_HEADERS_VERSION} \
-    && make ARCH=arm headers_install INSTALL_HDR_PATH=/opt/v4l2-headers \
-    && rm -rf /tmp/linux-${LINUX_HEADERS_VERSION} /tmp/linux-headers.tar.xz
-
-ENV V4L2R_VIDEODEV2_H_PATH=/opt/v4l2-headers/include
-
 # Build static libjpeg-turbo from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libjpeg-turbo \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libjpeg-turbo \
     && cd /tmp/libjpeg-turbo \
+    && git remote add origin "${github_prefix}https://github.com/libjpeg-turbo/libjpeg-turbo.git" \
+    && git fetch --depth 1 origin "refs/tags/${LIBJPEG_TURBO_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/arm-linux-gnueabihf \
@@ -104,8 +112,13 @@ RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libj
     && rm -rf /tmp/libjpeg-turbo
 
 # Build static libyuv from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
+RUN git init /tmp/libyuv \
     && cd /tmp/libyuv \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git remote add origin "${github_prefix}https://github.com/lemenkov/libyuv" \
+    && git fetch --depth 1 origin ${LIBYUV_REV} \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/arm-linux-gnueabihf \
@@ -123,8 +136,13 @@ RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
     && rm -rf /tmp/libyuv
 
 # Build static libvpx from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libvpx \
     && cd /tmp/libvpx \
+    && git remote add origin "${github_prefix}https://github.com/webmproject/libvpx.git" \
+    && git fetch --depth 1 origin "refs/tags/v${LIBVPX_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && export CC=arm-linux-gnueabihf-gcc \
     && export CXX=arm-linux-gnueabihf-g++ \
     && export LD=arm-linux-gnueabihf-ld \
@@ -141,7 +159,9 @@ RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
     && rm -rf /tmp/libvpx
 
 # Build static libx264 from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "${github_prefix}https://github.com/mirror/x264.git" /tmp/x264 \
     && cd /tmp/x264 \
     && export CC=arm-linux-gnueabihf-gcc \
     && export AR=arm-linux-gnueabihf-ar \
@@ -158,12 +178,18 @@ RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
     && rm -rf /tmp/x264
 
 # Build static libx265 from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://bitbucket.org/multicoreware/x265_git /tmp/x265 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/x265 \
     && cd /tmp/x265 \
+    && git remote add origin "${github_prefix}https://github.com/videolan/x265.git" \
+    && git fetch --depth 1 origin "refs/tags/${X265_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && cd source \
     && mkdir -p build \
     && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_NASM_FLAGS="-w-macro-params-legacy" \
         -DCMAKE_INSTALL_PREFIX=/usr/arm-linux-gnueabihf \
         -DCMAKE_SYSTEM_NAME=Linux \
         -DCMAKE_SYSTEM_PROCESSOR=arm \
@@ -193,12 +219,15 @@ Cflags: -I\${includedir}
 EOF
 
 # Build static libopus from source (cross-compile for ARMv7)
-RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && wget -O /tmp/opus.tar.gz "${github_prefix}https://github.com/xiph/opus/releases/download/v${OPUS_VERSION}/opus-${OPUS_VERSION}.tar.gz" \
+    && tar -xzf /tmp/opus.tar.gz -C /tmp \
+    && mv "/tmp/opus-${OPUS_VERSION}" /tmp/opus \
     && cd /tmp/opus \
     && export CC=arm-linux-gnueabihf-gcc \
     && export AR=arm-linux-gnueabihf-ar \
     && export RANLIB=arm-linux-gnueabihf-ranlib \
-    && ./autogen.sh \
     && ./configure \
         --prefix=/usr/arm-linux-gnueabihf \
         --host=arm-linux-gnueabihf \
@@ -206,13 +235,20 @@ RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
         --disable-doc \
     && make -j$(nproc) \
     && make install \
-    && rm -rf /tmp/opus
+    && rm -rf /tmp/opus /tmp/opus.tar.gz
 
 # Download and build FFmpeg with RKMPP support
 RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
-    && wget -q https://files.mofeng.run/src/image/other/ffmpeg.tar.gz \
-    && tar -xzf ffmpeg.tar.gz \
-    && cd ffmpeg \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "https://gitee.com/nyanmisaka/mpp.git" rkmpp \
+    && git clone --depth 1 "https://gitee.com/nyanmisaka/rga.git" rkrga \
+    && git init ffmpeg-rockchip \
+    && cd ffmpeg-rockchip \
+    && git remote add origin "${github_prefix}https://github.com/nyanmisaka/ffmpeg-rockchip.git" \
+    && git fetch --depth 1 origin ${FFMPEG_ROCKCHIP_REV} \
+    && git checkout --detach FETCH_HEAD \
+    && cd .. \
     # Build RKMPP
     && mkdir -p rkmpp/build && cd rkmpp/build \
     && cmake .. \
@@ -343,8 +379,8 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
 
 # Add Rust target
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        export RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup; \
-        export RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup; \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
     fi \
     && rustup target add armv7-unknown-linux-gnueabihf
 

build/cross/Dockerfile.x86_64

@@ -1,18 +1,26 @@
 # Cross-compilation image for x86_64 based on Debian 11
 # Build on Debian 11 (GLIBC 2.31) for maximum runtime compatibility
 
-FROM debian:11
+ARG DEBIAN_IMAGE=debian:11
+FROM ${DEBIAN_IMAGE}
 
-# Linux headers used by v4l2r bindgen
-ARG LINUX_HEADERS_VERSION=6.6
-ARG LINUX_HEADERS_SHA256=
 ARG CHINAMIRRO=0
+ARG GH_PROXY=https://gh-proxy.com/
+ARG RUSTUP_DIST_SERVER_CN=https://rsproxy.cn
+ARG RUSTUP_UPDATE_ROOT_CN=https://rsproxy.cn/rustup
+ARG CARGO_INDEX_CN=https://rsproxy.cn/crates.io-index
+ARG CARGO_REGISTRY_CN=sparse+https://rsproxy.cn/index/
+ARG LIBJPEG_TURBO_VERSION=3.1.4.1
+ARG LIBYUV_REV=957f295ea946cbbd13fcfc46e7066f2efa801233
+ARG LIBVPX_VERSION=1.16.0
+ARG X265_VERSION=3.4
+ARG OPUS_VERSION=1.5.2
+ARG FFMPEG_ROCKCHIP_REV=40c412daccf08164493da0de990eb99a8948116b
 
-# Optionally use Tsinghua mirrors for builds in China.
+# Optionally use China mirrors for builds in China.
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        sed -i \
-            -e 's|http://deb.debian.org/debian|http://mirrors.tuna.tsinghua.edu.cn/debian|g' \
-            -e 's|http://security.debian.org/debian-security|http://mirrors.tuna.tsinghua.edu.cn/debian-security|g' \
+        sed -i -E \
+            -e 's|http://deb.debian.org/debian([[:space:]])|http://mirrors.tuna.tsinghua.edu.cn/debian\1|g' \
             /etc/apt/sources.list; \
     fi
 
@@ -21,19 +29,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
     && if [ "$CHINAMIRRO" = "1" ]; then \
-        export RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup; \
-        export RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup; \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
     fi \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable \
     && if [ "$CHINAMIRRO" = "1" ]; then \
         mkdir -p /root/.cargo; \
         printf '%s\n' \
             '[source.crates-io]' \
-            "replace-with = 'tuna'" \
-            '[source.tuna]' \
-            'registry = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"' \
-            '[registries.tuna]' \
-            'index = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"' \
+            "replace-with = 'rsproxy-sparse'" \
+            '[source.rsproxy]' \
+            "registry = '${CARGO_INDEX_CN}'" \
+            '[source.rsproxy-sparse]' \
+            "registry = '${CARGO_REGISTRY_CN}'" \
+            '[registries.rsproxy]' \
+            "index = '${CARGO_INDEX_CN}'" \
+            '[net]' \
+            'git-fetch-with-cli = true' \
             > /root/.cargo/config.toml; \
     fi \
     && rm -rf /var/lib/apt/lists/*
@@ -76,20 +88,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libxdmcp-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Install newer V4L2 headers for v4l2r bindgen
-RUN mkdir -p /opt/v4l2-headers \
-    && wget -q https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_HEADERS_VERSION}.tar.xz -O /tmp/linux-headers.tar.xz \
-    && if [ -n "$LINUX_HEADERS_SHA256" ]; then echo "$LINUX_HEADERS_SHA256  /tmp/linux-headers.tar.xz" | sha256sum -c -; fi \
-    && tar -xf /tmp/linux-headers.tar.xz -C /tmp \
-    && cd /tmp/linux-${LINUX_HEADERS_VERSION} \
-    && make ARCH=x86 headers_install INSTALL_HDR_PATH=/opt/v4l2-headers \
-    && rm -rf /tmp/linux-${LINUX_HEADERS_VERSION} /tmp/linux-headers.tar.xz
-
-ENV V4L2R_VIDEODEV2_H_PATH=/opt/v4l2-headers/include
-
 # Build static libjpeg-turbo from source (needed by libyuv)
-RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libjpeg-turbo \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libjpeg-turbo \
     && cd /tmp/libjpeg-turbo \
+    && git remote add origin "${github_prefix}https://github.com/libjpeg-turbo/libjpeg-turbo.git" \
+    && git fetch --depth 1 origin "refs/tags/${LIBJPEG_TURBO_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DCMAKE_INSTALL_PREFIX=/usr/local \
@@ -100,8 +106,13 @@ RUN git clone --depth 1 https://github.com/libjpeg-turbo/libjpeg-turbo /tmp/libj
     && rm -rf /tmp/libjpeg-turbo
 
 # Build static libyuv from source (uses libjpeg-turbo headers)
-RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
+RUN git init /tmp/libyuv \
     && cd /tmp/libyuv \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git remote add origin "${github_prefix}https://github.com/lemenkov/libyuv" \
+    && git fetch --depth 1 origin ${LIBYUV_REV} \
+    && git checkout --detach FETCH_HEAD \
     && mkdir build && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
         -DJPEG_FOUND=TRUE \
@@ -114,17 +125,25 @@ RUN git clone --depth 1 https://github.com/lemenkov/libyuv /tmp/libyuv \
     && rm -rf /tmp/libyuv
 
 # Build static libvpx from source
-RUN git clone --depth 1 https://github.com/webmproject/libvpx /tmp/libvpx \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/libvpx \
     && cd /tmp/libvpx \
+    && git remote add origin "${github_prefix}https://github.com/webmproject/libvpx.git" \
+    && git fetch --depth 1 origin "refs/tags/v${LIBVPX_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && ./configure \
         --enable-static --disable-shared --enable-pic \
         --disable-examples --disable-tools --disable-docs \
+        --disable-unit-tests \
     && make -j$(nproc) \
     && make install \
     && rm -rf /tmp/libvpx
 
 # Build static libx264 from source
-RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git clone --depth 1 "${github_prefix}https://github.com/mirror/x264.git" /tmp/x264 \
     && cd /tmp/x264 \
     && ./configure --enable-static --disable-cli \
     && make -j$(nproc) \
@@ -132,12 +151,18 @@ RUN git clone --depth 1 https://code.videolan.org/videolan/x264.git /tmp/x264 \
     && rm -rf /tmp/x264
 
 # Build static libx265 from source
-RUN git clone --depth 1 https://bitbucket.org/multicoreware/x265_git /tmp/x265 \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init /tmp/x265 \
     && cd /tmp/x265 \
+    && git remote add origin "${github_prefix}https://github.com/videolan/x265.git" \
+    && git fetch --depth 1 origin "refs/tags/${X265_VERSION}" \
+    && git checkout --detach FETCH_HEAD \
     && cd source \
     && mkdir -p build \
     && cd build \
     && cmake .. -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_NASM_FLAGS="-w-macro-params-legacy" \
         -DENABLE_SHARED=OFF \
         -DENABLE_CLI=OFF \
         -DBUILD_SHARED_LIBS=OFF \
@@ -162,21 +187,28 @@ Cflags: -I\${includedir}
 EOF
 
 # Build static libopus from source
-RUN git clone --depth 1 https://github.com/xiph/opus /tmp/opus \
+RUN github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && wget -O /tmp/opus.tar.gz "${github_prefix}https://github.com/xiph/opus/releases/download/v${OPUS_VERSION}/opus-${OPUS_VERSION}.tar.gz" \
+    && tar -xzf /tmp/opus.tar.gz -C /tmp \
+    && mv "/tmp/opus-${OPUS_VERSION}" /tmp/opus \
     && cd /tmp/opus \
-    && ./autogen.sh \
     && ./configure \
         --enable-static --disable-shared \
         --disable-doc \
     && make -j$(nproc) \
     && make install \
-    && rm -rf /tmp/opus
+    && rm -rf /tmp/opus /tmp/opus.tar.gz
 
 # Download and build FFmpeg with minimal configuration for encoding only
 RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
-    && wget -q https://files.mofeng.run/src/image/other/ffmpeg.tar.gz \
-    && tar -xzf ffmpeg.tar.gz \
-    && cd ffmpeg/ffmpeg-rockchip \
+    && github_prefix="" \
+    && if [ "$CHINAMIRRO" = "1" ]; then github_prefix="${GH_PROXY%/}/"; fi \
+    && git init ffmpeg-rockchip \
+    && cd ffmpeg-rockchip \
+    && git remote add origin "${github_prefix}https://github.com/nyanmisaka/ffmpeg-rockchip.git" \
+    && git fetch --depth 1 origin ${FFMPEG_ROCKCHIP_REV} \
+    && git checkout --detach FETCH_HEAD \
     && ./configure \
         --enable-gpl \
         --enable-version3 \
@@ -249,8 +281,8 @@ RUN mkdir -p /tmp/ffmpeg-build && cd /tmp/ffmpeg-build \
 
 # Add Rust target
 RUN if [ "$CHINAMIRRO" = "1" ]; then \
-        export RUSTUP_DIST_SERVER=https://mirrors.tuna.tsinghua.edu.cn/rustup; \
-        export RUSTUP_UPDATE_ROOT=https://mirrors.tuna.tsinghua.edu.cn/rustup/rustup; \
+        export RUSTUP_DIST_SERVER=${RUSTUP_DIST_SERVER_CN}; \
+        export RUSTUP_UPDATE_ROOT=${RUSTUP_UPDATE_ROOT_CN}; \
     fi \
     && rustup target add x86_64-unknown-linux-gnu
 

build/package-deb.sh

@@ -125,8 +125,8 @@ EOF
     chmod 755 "$PKG_DIR/DEBIAN/prerm"
 
     # Create control file
-    BASE_DEPS="libc6 (>= 2.31), libgcc-s1, libstdc++6, libasound2 (>= 1.1), libdrm2 (>= 2.4)"
-    AMD64_DEPS="libva2 (>= 2.0), libva-drm2 (>= 2.10), libva-x11-2 (>= 2.10), libmfx1 (>= 21.1), libx11-6 (>= 1.6), libxcb1 (>= 1.14), i965-va-driver-shaders (>= 2.4), intel-media-va-driver-non-free (>= 21.1)"
+    BASE_DEPS="libc6 (>= 2.31), libgcc-s1, libstdc++6, libasound2t64 (>= 1.1) | libasound2 (>= 1.1), libdrm2 (>= 2.4)"
+    AMD64_DEPS="libva2 (>= 2.0), libva-drm2 (>= 2.10), libva-x11-2 (>= 2.10), libmfx-gen1.2 (>= 22.0) | libmfx1 (>= 21.1), libx11-6 (>= 1.6), libxcb1 (>= 1.14), i965-va-driver-shaders (>= 2.4), intel-media-va-driver-non-free (>= 21.1)"
     DEPS="$BASE_DEPS"
     if [ "$DEB_ARCH" = "amd64" ]; then
         DEPS="$DEPS, $AMD64_DEPS"

libs/v4l2r/README.md

@@ -15,9 +15,8 @@ parts are intentionally removed here so this dependency stays scoped to capture.
 
 ## Build options
 
-`cargo build` generates V4L2 bindings from `/usr/include/linux/videodev2.h` by
-default. Set `V4L2R_VIDEODEV2_H_PATH` to a directory containing `videodev2.h` to
-generate bindings from a different header.
+`cargo build` generates V4L2 bindings from the vendored Linux UAPI headers in
+`include/`.
 
 For Android targets, the build script uses the Android NDK sysroot. Set one of
 `ANDROID_NDK_HOME`, `ANDROID_NDK_ROOT`, `NDK_HOME`, `ANDROID_HOME`, or

libs/v4l2r/build.rs

@@ -1,14 +1,10 @@
-use std::env::{self, VarError};
+use std::env;
 use std::path::PathBuf;
 
 include!("bindgen.rs");
 
-/// Environment variable that can be set to point to the directory containing the `videodev2.h`
-/// file to use to generate the bindings.
-const V4L2R_VIDEODEV_ENV: &str = "V4L2R_VIDEODEV2_H_PATH";
-
-/// Default header file to parse if the `V4L2R_VIDEODEV2_H_PATH` environment variable is not set.
-const DEFAULT_VIDEODEV2_H_PATH: &str = "/usr/include/linux";
+/// Vendored Linux UAPI include root used for non-Android targets.
+const VENDORED_INCLUDE_DIR: &str = "include";
 
 /// Wrapper file to use as input of bindgen.
 const WRAPPER_H: &str = "v4l2r_wrapper.h";
@@ -20,29 +16,14 @@ fn main() {
     let target = env::var("TARGET").unwrap_or_default();
     let is_android = target.contains("android");
 
-    let default_videodev2_h_path = if is_android {
-        android_sysroot().join("usr/include").display().to_string()
+    let include_root = if is_android {
+        android_sysroot().join("usr/include")
     } else {
-        DEFAULT_VIDEODEV2_H_PATH.to_string()
+        PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("`CARGO_MANIFEST_DIR` is not set"))
+            .join(VENDORED_INCLUDE_DIR)
     };
+    let videodev2_h = include_root.join("linux/videodev2.h");
 
-    let videodev2_h_path = env::var(V4L2R_VIDEODEV_ENV)
-        .or_else(|e| {
-            if let VarError::NotPresent = e {
-                Ok(default_videodev2_h_path.clone())
-            } else {
-                Err(e)
-            }
-        })
-        .expect("invalid `V4L2R_VIDEODEV2_H_PATH` environment variable");
-
-    let videodev2_h = PathBuf::from(videodev2_h_path.clone()).join(if is_android {
-        "linux/videodev2.h"
-    } else {
-        "videodev2.h"
-    });
-
-    println!("cargo::rerun-if-env-changed={}", V4L2R_VIDEODEV_ENV);
     println!("cargo::rerun-if-env-changed=ANDROID_NDK_HOME");
     println!("cargo::rerun-if-env-changed=ANDROID_NDK_ROOT");
     println!("cargo::rerun-if-env-changed=NDK_HOME");
@@ -54,7 +35,7 @@ fn main() {
     println!("cargo::rerun-if-changed={}", WRAPPER_H);
 
     let mut clang_args = vec![
-        format!("-I{videodev2_h_path}"),
+        format!("-I{}", include_root.display()),
         #[cfg(all(feature = "arch64", not(feature = "arch32")))]
         "--target=x86_64-linux-gnu".into(),
         #[cfg(all(feature = "arch32", not(feature = "arch64")))]

libs/v4l2r/include/asm-generic/bitsperlong.h

@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_GENERIC_BITS_PER_LONG
+#define __ASM_GENERIC_BITS_PER_LONG
+
+#ifndef __BITS_PER_LONG
+/*
+ * In order to keep safe and avoid regression, only unify uapi
+ * bitsperlong.h for some archs which are using newer toolchains
+ * that have the definitions of __CHAR_BIT__ and __SIZEOF_LONG__.
+ * See the following link for more info:
+ * https://lore.kernel.org/linux-arch/b9624545-2c80-49a1-ac3c-39264a591f7b@app.fastmail.com/
+ */
+#if defined(__CHAR_BIT__) && defined(__SIZEOF_LONG__)
+#define __BITS_PER_LONG (__CHAR_BIT__ * __SIZEOF_LONG__)
+#else
+/*
+ * There seems to be no way of detecting this automatically from user
+ * space, so 64 bit architectures should override this in their
+ * bitsperlong.h. In particular, an architecture that supports
+ * both 32 and 64 bit user space must not rely on CONFIG_64BIT
+ * to decide it, but rather check a compiler provided macro.
+ */
+#define __BITS_PER_LONG 32
+#endif
+#endif
+
+#ifndef __BITS_PER_LONG_LONG
+#define __BITS_PER_LONG_LONG 64
+#endif
+
+#endif /* __ASM_GENERIC_BITS_PER_LONG */

libs/v4l2r/include/asm-generic/int-ll64.h

@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * asm-generic/int-ll64.h
+ *
+ * Integer declarations for architectures which use "long long"
+ * for 64-bit types.
+ */
+
+#ifndef _ASM_GENERIC_INT_LL64_H
+#define _ASM_GENERIC_INT_LL64_H
+
+#include <asm/bitsperlong.h>
+
+#ifndef __ASSEMBLY__
+/*
+ * __xx is ok: it doesn't pollute the POSIX namespace. Use these in the
+ * header files exported to user space
+ */
+
+typedef __signed__ char __s8;
+typedef unsigned char __u8;
+
+typedef __signed__ short __s16;
+typedef unsigned short __u16;
+
+typedef __signed__ int __s32;
+typedef unsigned int __u32;
+
+#ifdef __GNUC__
+__extension__ typedef __signed__ long long __s64;
+__extension__ typedef unsigned long long __u64;
+#else
+typedef __signed__ long long __s64;
+typedef unsigned long long __u64;
+#endif
+
+#endif /* __ASSEMBLY__ */
+
+
+#endif /* _ASM_GENERIC_INT_LL64_H */

libs/v4l2r/include/asm-generic/ioctl.h

@@ -0,0 +1,105 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _ASM_GENERIC_IOCTL_H
+#define _ASM_GENERIC_IOCTL_H
+
+/* ioctl command encoding: 32 bits total, command in lower 16 bits,
+ * size of the parameter structure in the lower 14 bits of the
+ * upper 16 bits.
+ * Encoding the size of the parameter structure in the ioctl request
+ * is useful for catching programs compiled with old versions
+ * and to avoid overwriting user space outside the user buffer area.
+ * The highest 2 bits are reserved for indicating the ``access mode''.
+ * NOTE: This limits the max parameter size to 16kB -1 !
+ */
+
+/*
+ * The following is for compatibility across the various Linux
+ * platforms.  The generic ioctl numbering scheme doesn't really enforce
+ * a type field.  De facto, however, the top 8 bits of the lower 16
+ * bits are indeed used as a type field, so we might just as well make
+ * this explicit here.  Please be sure to use the decoding macros
+ * below from now on.
+ */
+#define _IOC_NRBITS	8
+#define _IOC_TYPEBITS	8
+
+/*
+ * Let any architecture override either of the following before
+ * including this file.
+ */
+
+#ifndef _IOC_SIZEBITS
+# define _IOC_SIZEBITS	14
+#endif
+
+#ifndef _IOC_DIRBITS
+# define _IOC_DIRBITS	2
+#endif
+
+#define _IOC_NRMASK	((1 << _IOC_NRBITS)-1)
+#define _IOC_TYPEMASK	((1 << _IOC_TYPEBITS)-1)
+#define _IOC_SIZEMASK	((1 << _IOC_SIZEBITS)-1)
+#define _IOC_DIRMASK	((1 << _IOC_DIRBITS)-1)
+
+#define _IOC_NRSHIFT	0
+#define _IOC_TYPESHIFT	(_IOC_NRSHIFT+_IOC_NRBITS)
+#define _IOC_SIZESHIFT	(_IOC_TYPESHIFT+_IOC_TYPEBITS)
+#define _IOC_DIRSHIFT	(_IOC_SIZESHIFT+_IOC_SIZEBITS)
+
+/*
+ * Direction bits, which any architecture can choose to override
+ * before including this file.
+ *
+ * NOTE: _IOC_WRITE means userland is writing and kernel is
+ * reading. _IOC_READ means userland is reading and kernel is writing.
+ */
+
+#ifndef _IOC_NONE
+# define _IOC_NONE	0U
+#endif
+
+#ifndef _IOC_WRITE
+# define _IOC_WRITE	1U
+#endif
+
+#ifndef _IOC_READ
+# define _IOC_READ	2U
+#endif
+
+#define _IOC(dir,type,nr,size) \
+	(((dir)  << _IOC_DIRSHIFT) | \
+	 ((type) << _IOC_TYPESHIFT) | \
+	 ((nr)   << _IOC_NRSHIFT) | \
+	 ((size) << _IOC_SIZESHIFT))
+
+#define _IOC_TYPECHECK(t) (sizeof(t))
+
+/*
+ * Used to create numbers.
+ *
+ * NOTE: _IOW means userland is writing and kernel is reading. _IOR
+ * means userland is reading and kernel is writing.
+ */
+#define _IO(type,nr)		_IOC(_IOC_NONE,(type),(nr),0)
+#define _IOR(type,nr,size)	_IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOW(type,nr,size)	_IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOWR(type,nr,size)	_IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOR_BAD(type,nr,size)	_IOC(_IOC_READ,(type),(nr),sizeof(size))
+#define _IOW_BAD(type,nr,size)	_IOC(_IOC_WRITE,(type),(nr),sizeof(size))
+#define _IOWR_BAD(type,nr,size)	_IOC(_IOC_READ|_IOC_WRITE,(type),(nr),sizeof(size))
+
+/* used to decode ioctl numbers.. */
+#define _IOC_DIR(nr)		(((nr) >> _IOC_DIRSHIFT) & _IOC_DIRMASK)
+#define _IOC_TYPE(nr)		(((nr) >> _IOC_TYPESHIFT) & _IOC_TYPEMASK)
+#define _IOC_NR(nr)		(((nr) >> _IOC_NRSHIFT) & _IOC_NRMASK)
+#define _IOC_SIZE(nr)		(((nr) >> _IOC_SIZESHIFT) & _IOC_SIZEMASK)
+
+/* ...and for the drivers/sound files... */
+
+#define IOC_IN		(_IOC_WRITE << _IOC_DIRSHIFT)
+#define IOC_OUT		(_IOC_READ << _IOC_DIRSHIFT)
+#define IOC_INOUT	((_IOC_WRITE|_IOC_READ) << _IOC_DIRSHIFT)
+#define IOCSIZE_MASK	(_IOC_SIZEMASK << _IOC_SIZESHIFT)
+#define IOCSIZE_SHIFT	(_IOC_SIZESHIFT)
+
+#endif /* _ASM_GENERIC_IOCTL_H */

libs/v4l2r/include/asm-generic/posix_types.h

@@ -0,0 +1,99 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_GENERIC_POSIX_TYPES_H
+#define __ASM_GENERIC_POSIX_TYPES_H
+
+#include <asm/bitsperlong.h>
+/*
+ * This file is generally used by user-level software, so you need to
+ * be a little careful about namespace pollution etc.
+ *
+ * First the types that are often defined in different ways across
+ * architectures, so that you can override them.
+ */
+
+#ifndef __kernel_long_t
+typedef long		__kernel_long_t;
+typedef unsigned long	__kernel_ulong_t;
+#endif
+
+#ifndef __kernel_ino_t
+typedef __kernel_ulong_t __kernel_ino_t;
+#endif
+
+#ifndef __kernel_mode_t
+typedef unsigned int	__kernel_mode_t;
+#endif
+
+#ifndef __kernel_pid_t
+typedef int		__kernel_pid_t;
+#endif
+
+#ifndef __kernel_ipc_pid_t
+typedef int		__kernel_ipc_pid_t;
+#endif
+
+#ifndef __kernel_uid_t
+typedef unsigned int	__kernel_uid_t;
+typedef unsigned int	__kernel_gid_t;
+#endif
+
+#ifndef __kernel_suseconds_t
+typedef __kernel_long_t		__kernel_suseconds_t;
+#endif
+
+#ifndef __kernel_daddr_t
+typedef int		__kernel_daddr_t;
+#endif
+
+#ifndef __kernel_uid32_t
+typedef unsigned int	__kernel_uid32_t;
+typedef unsigned int	__kernel_gid32_t;
+#endif
+
+#ifndef __kernel_old_uid_t
+typedef __kernel_uid_t	__kernel_old_uid_t;
+typedef __kernel_gid_t	__kernel_old_gid_t;
+#endif
+
+#ifndef __kernel_old_dev_t
+typedef unsigned int	__kernel_old_dev_t;
+#endif
+
+/*
+ * Most 32 bit architectures use "unsigned int" size_t,
+ * and all 64 bit architectures use "unsigned long" size_t.
+ */
+#ifndef __kernel_size_t
+#if __BITS_PER_LONG != 64
+typedef unsigned int	__kernel_size_t;
+typedef int		__kernel_ssize_t;
+typedef int		__kernel_ptrdiff_t;
+#else
+typedef __kernel_ulong_t __kernel_size_t;
+typedef __kernel_long_t	__kernel_ssize_t;
+typedef __kernel_long_t	__kernel_ptrdiff_t;
+#endif
+#endif
+
+#ifndef __kernel_fsid_t
+typedef struct {
+	int	val[2];
+} __kernel_fsid_t;
+#endif
+
+/*
+ * anything below here should be completely generic
+ */
+typedef __kernel_long_t	__kernel_off_t;
+typedef long long	__kernel_loff_t;
+typedef __kernel_long_t	__kernel_old_time_t;
+typedef __kernel_long_t	__kernel_time_t;
+typedef long long __kernel_time64_t;
+typedef __kernel_long_t	__kernel_clock_t;
+typedef int		__kernel_timer_t;
+typedef int		__kernel_clockid_t;
+typedef char *		__kernel_caddr_t;
+typedef unsigned short	__kernel_uid16_t;
+typedef unsigned short	__kernel_gid16_t;
+
+#endif /* __ASM_GENERIC_POSIX_TYPES_H */

libs/v4l2r/include/asm-generic/types.h

@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _ASM_GENERIC_TYPES_H
+#define _ASM_GENERIC_TYPES_H
+/*
+ * int-ll64 is used everywhere now.
+ */
+#include <asm-generic/int-ll64.h>
+
+#endif /* _ASM_GENERIC_TYPES_H */

libs/v4l2r/include/linux/const.h

@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* const.h: Macros for dealing with constants.  */
+
+#ifndef _LINUX_CONST_H
+#define _LINUX_CONST_H
+
+/* Some constant macros are used in both assembler and
+ * C code.  Therefore we cannot annotate them always with
+ * 'UL' and other type specifiers unilaterally.  We
+ * use the following macros to deal with this.
+ *
+ * Similarly, _AT() will cast an expression with a type in C, but
+ * leave it unchanged in asm.
+ */
+
+#ifdef __ASSEMBLY__
+#define _AC(X,Y)	X
+#define _AT(T,X)	X
+#else
+#define __AC(X,Y)	(X##Y)
+#define _AC(X,Y)	__AC(X,Y)
+#define _AT(T,X)	((T)(X))
+#endif
+
+#define _UL(x)		(_AC(x, UL))
+#define _ULL(x)		(_AC(x, ULL))
+
+#define _BITUL(x)	(_UL(1) << (x))
+#define _BITULL(x)	(_ULL(1) << (x))
+
+#if !defined(__ASSEMBLY__)
+/*
+ * Missing __asm__ support
+ *
+ * __BIT128() would not work in the __asm__ code, as it shifts an
+ * 'unsigned __init128' data type as direct representation of
+ * 128 bit constants is not supported in the gcc compiler, as
+ * they get silently truncated.
+ *
+ * TODO: Please revisit this implementation when gcc compiler
+ * starts representing 128 bit constants directly like long
+ * and unsigned long etc. Subsequently drop the comment for
+ * GENMASK_U128() which would then start supporting __asm__ code.
+ */
+#define _BIT128(x)	((unsigned __int128)(1) << (x))
+#endif
+
+#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+#define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
+
+#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+
+#endif /* _LINUX_CONST_H */

libs/v4l2r/include/linux/ioctl.h

@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _LINUX_IOCTL_H
+#define _LINUX_IOCTL_H
+
+#include <asm/ioctl.h>
+
+#endif /* _LINUX_IOCTL_H */
+

libs/v4l2r/include/linux/posix_types.h

@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _LINUX_POSIX_TYPES_H
+#define _LINUX_POSIX_TYPES_H
+
+#include <linux/stddef.h>
+
+/*
+ * This allows for 1024 file descriptors: if NR_OPEN is ever grown
+ * beyond that you'll have to change this too. But 1024 fd's seem to be
+ * enough even for such "real" unices like OSF/1, so hopefully this is
+ * one limit that doesn't have to be changed [again].
+ *
+ * Note that POSIX wants the FD_CLEAR(fd,fdsetp) defines to be in
+ * <sys/time.h> (and thus <linux/time.h>) - but this is a more logical
+ * place for them. Solved by having dummy defines in <sys/time.h>.
+ */
+
+/*
+ * This macro may have been defined in <gnu/types.h>. But we always
+ * use the one here.
+ */
+#undef __FD_SETSIZE
+#define __FD_SETSIZE	1024
+
+typedef struct {
+	unsigned long fds_bits[__FD_SETSIZE / (8 * sizeof(long))];
+} __kernel_fd_set;
+
+/* Type of a signal handler.  */
+typedef void (*__kernel_sighandler_t)(int);
+
+/* Type of a SYSV IPC key.  */
+typedef int __kernel_key_t;
+typedef int __kernel_mqd_t;
+
+#include <asm/posix_types.h>
+
+#endif /* _LINUX_POSIX_TYPES_H */

libs/v4l2r/include/linux/stddef.h

@@ -0,0 +1,73 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _LINUX_STDDEF_H
+#define _LINUX_STDDEF_H
+
+
+
+#ifndef __always_inline
+#define __always_inline __inline__
+#endif
+
+/* Not all C++ standards support type declarations inside an anonymous union */
+#ifndef __cplusplus
+#define __struct_group_tag(TAG)		TAG
+#else
+#define __struct_group_tag(TAG)
+#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse (C only),
+ * as well as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+	union { \
+		struct { MEMBERS } ATTRS; \
+		struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
+	} ATTRS
+
+#ifdef __cplusplus
+/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */
+#define __DECLARE_FLEX_ARRAY(T, member)	\
+	T member[0]
+#else
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME)	\
+	struct { \
+		struct { } __empty_ ## NAME; \
+		TYPE NAME[]; \
+	}
+#endif
+
+#ifndef __counted_by
+#define __counted_by(m)
+#endif
+
+#ifndef __counted_by_le
+#define __counted_by_le(m)
+#endif
+
+#ifndef __counted_by_be
+#define __counted_by_be(m)
+#endif
+
+#endif /* _LINUX_STDDEF_H */

libs/v4l2r/include/linux/types.h

@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _LINUX_TYPES_H
+#define _LINUX_TYPES_H
+
+#include <asm/types.h>
+
+#ifndef __ASSEMBLY__
+
+#include <linux/posix_types.h>
+
+#ifdef __SIZEOF_INT128__
+typedef __signed__ __int128 __s128 __attribute__((aligned(16)));
+typedef unsigned __int128 __u128 __attribute__((aligned(16)));
+#endif
+
+/*
+ * Below are truly Linux-specific types that should never collide with
+ * any application/library that wants linux/types.h.
+ */
+
+/* sparse defines __CHECKER__; see Documentation/dev-tools/sparse.rst */
+#ifdef __CHECKER__
+#define __bitwise	__attribute__((bitwise))
+#else
+#define __bitwise
+#endif
+
+/* The kernel doesn't use this legacy form, but user space does */
+#define __bitwise__ __bitwise
+
+typedef __u16 __bitwise __le16;
+typedef __u16 __bitwise __be16;
+typedef __u32 __bitwise __le32;
+typedef __u32 __bitwise __be32;
+typedef __u64 __bitwise __le64;
+typedef __u64 __bitwise __be64;
+
+typedef __u16 __bitwise __sum16;
+typedef __u32 __bitwise __wsum;
+
+/*
+ * aligned_u64 should be used in defining kernel<->userspace ABIs to avoid
+ * common 32/64-bit compat problems.
+ * 64-bit values align to 4-byte boundaries on x86_32 (and possibly other
+ * architectures) and to 8-byte boundaries on 64-bit architectures.  The new
+ * aligned_64 type enforces 8-byte alignment so that structs containing
+ * aligned_64 values have the same alignment on 32-bit and 64-bit architectures.
+ * No conversions are necessary between 32-bit user-space and a 64-bit kernel.
+ */
+#define __aligned_u64 __u64 __attribute__((aligned(8)))
+#define __aligned_s64 __s64 __attribute__((aligned(8)))
+#define __aligned_be64 __be64 __attribute__((aligned(8)))
+#define __aligned_le64 __le64 __attribute__((aligned(8)))
+
+typedef unsigned __bitwise __poll_t;
+
+#endif /*  __ASSEMBLY__ */
+#endif /* _LINUX_TYPES_H */

libs/v4l2r/include/linux/v4l2-common.h

@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) */
+/*
+ * include/linux/v4l2-common.h
+ *
+ * Common V4L2 and V4L2 subdev definitions.
+ *
+ * Users are advised to #include this file either through videodev2.h
+ * (V4L2) or through v4l2-subdev.h (V4L2 subdev) rather than to refer
+ * to this file directly.
+ *
+ * Copyright (C) 2012 Nokia Corporation
+ * Contact: Sakari Ailus <sakari.ailus@iki.fi>
+ */
+
+#ifndef __V4L2_COMMON__
+#define __V4L2_COMMON__
+
+#include <linux/types.h>
+
+/*
+ *
+ * Selection interface definitions
+ *
+ */
+
+/* Current cropping area */
+#define V4L2_SEL_TGT_CROP		0x0000
+/* Default cropping area */
+#define V4L2_SEL_TGT_CROP_DEFAULT	0x0001
+/* Cropping bounds */
+#define V4L2_SEL_TGT_CROP_BOUNDS	0x0002
+/* Native frame size */
+#define V4L2_SEL_TGT_NATIVE_SIZE	0x0003
+/* Current composing area */
+#define V4L2_SEL_TGT_COMPOSE		0x0100
+/* Default composing area */
+#define V4L2_SEL_TGT_COMPOSE_DEFAULT	0x0101
+/* Composing bounds */
+#define V4L2_SEL_TGT_COMPOSE_BOUNDS	0x0102
+/* Current composing area plus all padding pixels */
+#define V4L2_SEL_TGT_COMPOSE_PADDED	0x0103
+
+/* Selection flags */
+#define V4L2_SEL_FLAG_GE		(1 << 0)
+#define V4L2_SEL_FLAG_LE		(1 << 1)
+#define V4L2_SEL_FLAG_KEEP_CONFIG	(1 << 2)
+
+struct v4l2_edid {
+	__u32 pad;
+	__u32 start_block;
+	__u32 blocks;
+	__u32 reserved[5];
+	__u8  *edid;
+};
+
+/* Backward compatibility target definitions --- to be removed. */
+#define V4L2_SEL_TGT_CROP_ACTIVE	V4L2_SEL_TGT_CROP
+#define V4L2_SEL_TGT_COMPOSE_ACTIVE	V4L2_SEL_TGT_COMPOSE
+#define V4L2_SUBDEV_SEL_TGT_CROP_ACTUAL	V4L2_SEL_TGT_CROP
+#define V4L2_SUBDEV_SEL_TGT_COMPOSE_ACTUAL V4L2_SEL_TGT_COMPOSE
+#define V4L2_SUBDEV_SEL_TGT_CROP_BOUNDS	V4L2_SEL_TGT_CROP_BOUNDS
+#define V4L2_SUBDEV_SEL_TGT_COMPOSE_BOUNDS V4L2_SEL_TGT_COMPOSE_BOUNDS
+
+/* Backward compatibility flag definitions --- to be removed. */
+#define V4L2_SUBDEV_SEL_FLAG_SIZE_GE	V4L2_SEL_FLAG_GE
+#define V4L2_SUBDEV_SEL_FLAG_SIZE_LE	V4L2_SEL_FLAG_LE
+#define V4L2_SUBDEV_SEL_FLAG_KEEP_CONFIG V4L2_SEL_FLAG_KEEP_CONFIG
+
+#endif /* __V4L2_COMMON__ */

scripts/build-android-alsa.sh

@@ -5,13 +5,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SOURCE_DIR=""
 OUTPUT_DIR="${PROJECT_ROOT}/dist/android-alsa"
 ANDROID_API="${ANDROID_API:-21}"
 NDK_ROOT="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
 BUILD_ABIS="arm64-v8a armeabi-v7a"
 JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
-ALSA_REPO="${ALSA_REPO:-https://github.com/alsa-project/alsa-lib.git}"
+ALSA_VERSION="${ALSA_VERSION:-1.2.15}"
 
 usage() {
     cat <<'EOF'
@@ -19,8 +18,6 @@ Usage:
   scripts/build-android-alsa.sh [options]
 
 Options:
-  --source <dir>          Existing alsa-lib source checkout. If omitted, the
-                          script clones it into .tmp/android-alsa-src.
   --output <dir>          Output root. Default: dist/android-alsa
   --ndk <dir>             Android NDK root. Defaults to ANDROID_NDK_HOME or ANDROID_NDK_ROOT.
   --api <level>           Android API level. Default: 21.
@@ -44,10 +41,6 @@ fail() {
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
-    --source)
-        SOURCE_DIR="${2:-}"
-        shift 2
-        ;;
     --output)
         OUTPUT_DIR="${2:-}"
         shift 2
@@ -77,16 +70,15 @@ done
 [[ -n "$NDK_ROOT" ]] || fail "--ndk or ANDROID_NDK_HOME/ANDROID_NDK_ROOT is required"
 [[ -d "$NDK_ROOT/toolchains/llvm/prebuilt" ]] || fail "Invalid NDK root: $NDK_ROOT"
 
-if [[ -z "$SOURCE_DIR" ]]; then
-    SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-alsa-src"
-    if [[ ! -d "$SOURCE_DIR/.git" ]]; then
-        rm -rf "$SOURCE_DIR"
-        git clone --depth 1 "$ALSA_REPO" "$SOURCE_DIR"
-    fi
-fi
-
-[[ -d "$SOURCE_DIR" ]] || fail "alsa-lib source not found: $SOURCE_DIR"
-[[ -f "$SOURCE_DIR/configure.ac" || -f "$SOURCE_DIR/configure" ]] || fail "alsa-lib source layout not recognized under: $SOURCE_DIR"
+SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-alsa-src"
+rm -rf "$SOURCE_DIR"
+mkdir -p "${PROJECT_ROOT}/.tmp"
+archive="${PROJECT_ROOT}/.tmp/alsa-lib-${ALSA_VERSION}.tar.bz2"
+url="https://www.alsa-project.org/files/pub/lib/alsa-lib-${ALSA_VERSION}.tar.bz2"
+echo "Downloading ALSA ${ALSA_VERSION}: $url"
+curl -fL "$url" -o "$archive"
+tar -xjf "$archive" -C "${PROJECT_ROOT}/.tmp"
+mv "${PROJECT_ROOT}/.tmp/alsa-lib-${ALSA_VERSION}" "$SOURCE_DIR"
 
 SOURCE_DIR="$(cd "$SOURCE_DIR" && pwd)"
 mkdir -p "$OUTPUT_DIR"
@@ -94,11 +86,6 @@ OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)"
 
 HOST_TAG="$(uname -s | tr '[:upper:]' '[:lower:]')-x86_64"
 TOOLCHAIN="${NDK_ROOT}/toolchains/llvm/prebuilt/${HOST_TAG}"
-ANDROID_TOOLCHAIN_FILE="${NDK_ROOT}/build/cmake/android.toolchain.cmake"
-[[ -d "$TOOLCHAIN/bin" ]] || fail "NDK LLVM toolchain not found: $TOOLCHAIN"
-[[ -f "$ANDROID_TOOLCHAIN_FILE" ]] || fail "NDK CMake toolchain not found: $ANDROID_TOOLCHAIN_FILE"
-command -v cmake >/dev/null 2>&1 || fail "cmake is required"
-command -v autoreconf >/dev/null 2>&1 || fail "autoreconf is required"
 
 normalize_abis() {
     printf '%s\n' "$BUILD_ABIS" | tr ',' ' '
@@ -147,14 +134,6 @@ build_one() {
 
     clean_generated_source_headers
 
-    if [[ -f "$SOURCE_DIR/config.status" || -f "$SOURCE_DIR/Makefile" ]]; then
-        (
-            cd "$SOURCE_DIR"
-            make distclean >/dev/null 2>&1 || true
-        )
-        clean_generated_source_headers
-    fi
-
     if [[ ! -x "$SOURCE_DIR/configure" ]]; then
         (
             cd "$SOURCE_DIR"
@@ -178,6 +157,8 @@ build_one() {
             --disable-doc \
             --disable-oss \
             --disable-seq \
+            --disable-ucm \
+            --disable-topology \
             --disable-rawmidi \
             --disable-hwdep \
             --disable-usb \

scripts/build-android-ffmpeg-mediacodec.sh

@@ -5,21 +5,17 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SOURCE_DIR=""
 OUTPUT_DIR="${PROJECT_ROOT}/dist/android-ffmpeg-mediacodec"
 ANDROID_API="${ANDROID_API:-21}"
 NDK_ROOT="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
 BUILD_ABIS="arm64-v8a armeabi-v7a"
 JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
+FFMPEG_ROCKCHIP_REV="${FFMPEG_ROCKCHIP_REV:-40c412daccf08164493da0de990eb99a8948116b}"
 
 usage() {
     cat <<'EOF'
 Usage:
-  scripts/build-android-ffmpeg-mediacodec.sh --source <ffmpeg-source-dir> [options]
-
-Required:
-  --source <dir>          FFmpeg source directory. For the downloaded package,
-                          use the extracted ffmpeg-rockchip directory.
+  scripts/build-android-ffmpeg-mediacodec.sh [options]
 
 Options:
   --output <dir>          Output root. Default: dist/android-ffmpeg-mediacodec
@@ -35,9 +31,7 @@ The output layout is compatible with ONE_KVM_ANDROID_FFMPEG_ROOT:
   <output>/armeabi-v7a/lib
 
 Example:
-  scripts/build-android-ffmpeg-mediacodec.sh \
-    --source .tmp/android-ffmpeg-check/src/ffmpeg-rockchip \
-    --output /opt/one-kvm/android-ffmpeg
+  scripts/build-android-ffmpeg-mediacodec.sh --output /opt/one-kvm/android-ffmpeg
 
   export ONE_KVM_ANDROID_FFMPEG_ROOT=/opt/one-kvm/android-ffmpeg
   cd android && ./gradlew :app:assembleDebug
@@ -51,10 +45,6 @@ fail() {
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
-    --source)
-        SOURCE_DIR="${2:-}"
-        shift 2
-        ;;
     --output)
         OUTPUT_DIR="${2:-}"
         shift 2
@@ -81,11 +71,24 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-[[ -n "$SOURCE_DIR" ]] || fail "--source is required"
-[[ -d "$SOURCE_DIR" ]] || fail "FFmpeg source not found: $SOURCE_DIR"
-[[ -x "$SOURCE_DIR/configure" ]] || fail "FFmpeg configure script not found under: $SOURCE_DIR"
+SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-ffmpeg-check/src/ffmpeg-rockchip"
+rm -rf "$SOURCE_DIR"
+mkdir -p "$(dirname "$SOURCE_DIR")"
+repo_url="https://github.com/nyanmisaka/ffmpeg-rockchip.git"
+if [[ "${CHINAMIRRO:-0}" == "1" ]]; then
+    repo_url="${GH_PROXY:-https://gh-proxy.com}"
+    repo_url="${repo_url%/}/https://github.com/nyanmisaka/ffmpeg-rockchip.git"
+fi
+echo "Cloning FFmpeg source: $repo_url"
+git init "$SOURCE_DIR"
+(
+    cd "$SOURCE_DIR"
+    git remote add origin "$repo_url"
+    git fetch --depth 1 origin "$FFMPEG_ROCKCHIP_REV"
+    git checkout --detach FETCH_HEAD
+)
+
 [[ -n "$NDK_ROOT" ]] || fail "--ndk or ANDROID_NDK_HOME/ANDROID_NDK_ROOT is required"
-[[ -d "$NDK_ROOT/toolchains/llvm/prebuilt" ]] || fail "Invalid NDK root: $NDK_ROOT"
 
 SOURCE_DIR="$(cd "$SOURCE_DIR" && pwd)"
 mkdir -p "$OUTPUT_DIR"
@@ -93,7 +96,6 @@ OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)"
 
 HOST_TAG="$(uname -s | tr '[:upper:]' '[:lower:]')-x86_64"
 TOOLCHAIN="${NDK_ROOT}/toolchains/llvm/prebuilt/${HOST_TAG}"
-[[ -d "$TOOLCHAIN/bin" ]] || fail "NDK LLVM toolchain not found: $TOOLCHAIN"
 
 normalize_abis() {
     printf '%s\n' "$BUILD_ABIS" | tr ',' ' '
@@ -106,11 +108,6 @@ patch_android_ffmpeg_mjpeg_mediacodec() {
     local allcodecs="${avcodec_dir}/allcodecs.c"
     local makefile="${avcodec_dir}/Makefile"
 
-    [[ -f "$mediacodecdec" ]] || fail "FFmpeg mediacodecdec.c not found: $mediacodecdec"
-    [[ -f "$allcodecs" ]] || fail "FFmpeg allcodecs.c not found: $allcodecs"
-    [[ -f "$makefile" ]] || fail "FFmpeg libavcodec Makefile not found: $makefile"
-    [[ -f "$configure_file" ]] || fail "FFmpeg configure not found: $configure_file"
-
     python3 - "$mediacodecdec" "$allcodecs" "$configure_file" "$makefile" <<'PY'
 from pathlib import Path
 import sys
@@ -218,8 +215,6 @@ build_one() {
     extra_cflags="-fPIC"
     extra_ldflags=""
 
-    [[ -x "$cc" ]] || fail "Missing compiler: $cc"
-
     if [[ "$abi" == "armeabi-v7a" ]]; then
         extra_cflags="${extra_cflags} -march=armv7-a -mfloat-abi=softfp -mfpu=neon"
         extra_ldflags="${extra_ldflags} -Wl,--fix-cortex-a8"

scripts/build-android-libyuv.sh

@@ -5,14 +5,13 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SOURCE_DIR=""
 OUTPUT_DIR="${PROJECT_ROOT}/dist/android-libyuv"
 JPEG_ROOT="${ONE_KVM_ANDROID_TURBOJPEG_ROOT:-${PROJECT_ROOT}/dist/android-turbojpeg}"
 ANDROID_API="${ANDROID_API:-21}"
 NDK_ROOT="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
 BUILD_ABIS="arm64-v8a armeabi-v7a"
 JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
-LIBYUV_REPO="${LIBYUV_REPO:-https://github.com/lemenkov/libyuv.git}"
+LIBYUV_REV="${LIBYUV_REV:-957f295ea946cbbd13fcfc46e7066f2efa801233}"
 
 usage() {
     cat <<'EOF'
@@ -20,8 +19,6 @@ Usage:
   scripts/build-android-libyuv.sh [options]
 
 Options:
-  --source <dir>          Existing libyuv source checkout. If omitted, the script
-                          clones libyuv into .tmp/android-libyuv-src.
   --output <dir>          Output root. Default: dist/android-libyuv
   --ndk <dir>             Android NDK root. Defaults to ANDROID_NDK_HOME or ANDROID_NDK_ROOT.
   --api <level>           Android API level. Default: 21.
@@ -51,10 +48,6 @@ fail() {
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
-    --source)
-        SOURCE_DIR="${2:-}"
-        shift 2
-        ;;
     --output)
         OUTPUT_DIR="${2:-}"
         shift 2
@@ -88,27 +81,29 @@ done
 [[ -n "$NDK_ROOT" ]] || fail "--ndk or ANDROID_NDK_HOME/ANDROID_NDK_ROOT is required"
 [[ -d "$NDK_ROOT/toolchains/llvm/prebuilt" ]] || fail "Invalid NDK root: $NDK_ROOT"
 
-if [[ -z "$SOURCE_DIR" ]]; then
-    SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-libyuv-src"
-    if [[ ! -d "$SOURCE_DIR/.git" ]]; then
-        rm -rf "$SOURCE_DIR"
-        git clone --depth 1 "$LIBYUV_REPO" "$SOURCE_DIR"
-    fi
+SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-libyuv-src"
+rm -rf "$SOURCE_DIR"
+repo_url="https://github.com/lemenkov/libyuv.git"
+if [[ "${CHINAMIRRO:-0}" == "1" ]]; then
+    repo_url="${GH_PROXY:-https://gh-proxy.com}"
+    repo_url="${repo_url%/}/https://github.com/lemenkov/libyuv.git"
 fi
-
-[[ -d "$SOURCE_DIR" ]] || fail "libyuv source not found: $SOURCE_DIR"
-[[ -f "$SOURCE_DIR/CMakeLists.txt" ]] || fail "libyuv CMakeLists.txt not found under: $SOURCE_DIR"
+echo "Cloning libyuv source: $repo_url"
+git init "$SOURCE_DIR"
+(
+    cd "$SOURCE_DIR"
+    git remote add origin "$repo_url"
+    git fetch --depth 1 origin "$LIBYUV_REV"
+    git checkout --detach FETCH_HEAD
+)
 
 SOURCE_DIR="$(cd "$SOURCE_DIR" && pwd)"
 mkdir -p "$OUTPUT_DIR"
 OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)"
 
 HOST_TAG="$(uname -s | tr '[:upper:]' '[:lower:]')-x86_64"
-TOOLCHAIN="${NDK_ROOT}/toolchains/llvm/prebuilt/${HOST_TAG}"
 ANDROID_TOOLCHAIN_FILE="${NDK_ROOT}/build/cmake/android.toolchain.cmake"
-[[ -d "$TOOLCHAIN/bin" ]] || fail "NDK LLVM toolchain not found: $TOOLCHAIN"
 [[ -f "$ANDROID_TOOLCHAIN_FILE" ]] || fail "NDK CMake toolchain not found: $ANDROID_TOOLCHAIN_FILE"
-command -v cmake >/dev/null 2>&1 || fail "cmake is required"
 
 normalize_abis() {
     printf '%s\n' "$BUILD_ABIS" | tr ',' ' '

scripts/build-android-opus.sh

@@ -5,16 +5,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SOURCE_DIR=""
 OUTPUT_DIR="${PROJECT_ROOT}/dist/android-opus"
 ANDROID_API="${ANDROID_API:-21}"
 NDK_ROOT="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
 BUILD_ABIS="arm64-v8a armeabi-v7a"
 JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
 OPUS_VERSION="${OPUS_VERSION:-1.5.2}"
-OPUS_TARBALL_URL="${OPUS_TARBALL_URL:-https://downloads.xiph.org/releases/opus/opus-${OPUS_VERSION}.tar.gz}"
-OPUS_TARBALL_SHA256="${OPUS_TARBALL_SHA256:-65c1d2f78b9f2fb20082c38cbe47c951ad5839345876e46941612ee87f9a7ce1}"
-LOCAL_OPUS_TARBALL="${LOCAL_OPUS_TARBALL:-${PROJECT_ROOT}/opus-${OPUS_VERSION}.tar.gz}"
 
 usage() {
     cat <<'EOF'
@@ -22,9 +18,6 @@ Usage:
   scripts/build-android-opus.sh [options]
 
 Options:
-  --source <dir>          Existing opus source checkout. If omitted, the script
-                          downloads and extracts the official source tarball
-                          into .tmp/android-opus-src.
   --output <dir>          Output root. Default: dist/android-opus
   --ndk <dir>             Android NDK root. Defaults to ANDROID_NDK_HOME or ANDROID_NDK_ROOT.
   --api <level>           Android API level. Default: 21.
@@ -46,10 +39,6 @@ fail() {
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
-    --source)
-        SOURCE_DIR="${2:-}"
-        shift 2
-        ;;
     --output)
         OUTPUT_DIR="${2:-}"
         shift 2
@@ -79,25 +68,13 @@ done
 [[ -n "$NDK_ROOT" ]] || fail "--ndk or ANDROID_NDK_HOME/ANDROID_NDK_ROOT is required"
 [[ -d "$NDK_ROOT/toolchains/llvm/prebuilt" ]] || fail "Invalid NDK root: $NDK_ROOT"
 
-if [[ -z "$SOURCE_DIR" ]]; then
-    SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-opus-src"
-    if [[ ! -f "$SOURCE_DIR/configure" ]]; then
-        rm -rf "$SOURCE_DIR"
-        mkdir -p "$SOURCE_DIR"
-        tarball="${PROJECT_ROOT}/.tmp/opus-${OPUS_VERSION}.tar.gz"
-        if [[ -f "$LOCAL_OPUS_TARBALL" ]]; then
-            cp "$LOCAL_OPUS_TARBALL" "$tarball"
-        else
-            command -v curl >/dev/null 2>&1 || fail "curl is required to download opus source"
-            curl -fsSL "$OPUS_TARBALL_URL" -o "$tarball"
-        fi
-        echo "${OPUS_TARBALL_SHA256}  ${tarball}" | sha256sum -c -
-        tar -xzf "$tarball" -C "$SOURCE_DIR" --strip-components=1
-    fi
-fi
-
-[[ -d "$SOURCE_DIR" ]] || fail "opus source not found: $SOURCE_DIR"
-[[ -x "$SOURCE_DIR/configure" || -f "$SOURCE_DIR/configure.ac" ]] || fail "opus source layout not recognized under: $SOURCE_DIR"
+SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-opus-src"
+rm -rf "$SOURCE_DIR"
+mkdir -p "$SOURCE_DIR"
+tarball="${PROJECT_ROOT}/.tmp/opus-${OPUS_VERSION}.tar.gz"
+url="https://downloads.xiph.org/releases/opus/opus-${OPUS_VERSION}.tar.gz"
+curl -fsSL "$url" -o "$tarball"
+tar -xzf "$tarball" -C "$SOURCE_DIR" --strip-components=1
 
 SOURCE_DIR="$(cd "$SOURCE_DIR" && pwd)"
 mkdir -p "$OUTPUT_DIR"
@@ -105,10 +82,6 @@ OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)"
 
 HOST_TAG="$(uname -s | tr '[:upper:]' '[:lower:]')-x86_64"
 TOOLCHAIN="${NDK_ROOT}/toolchains/llvm/prebuilt/${HOST_TAG}"
-ANDROID_TOOLCHAIN_FILE="${NDK_ROOT}/build/cmake/android.toolchain.cmake"
-[[ -d "$TOOLCHAIN/bin" ]] || fail "NDK LLVM toolchain not found: $TOOLCHAIN"
-[[ -f "$ANDROID_TOOLCHAIN_FILE" ]] || fail "NDK CMake toolchain not found: $ANDROID_TOOLCHAIN_FILE"
-command -v cmake >/dev/null 2>&1 || fail "cmake is required"
 
 normalize_abis() {
     printf '%s\n' "$BUILD_ABIS" | tr ',' ' '
@@ -161,14 +134,6 @@ build_one() {
         make install
     )
 
-    mkdir -p "$prefix/lib" "$prefix/include"
-    if [[ -f "$prefix/include/opus/opus.h" ]]; then
-        :
-    elif [[ -f "$SOURCE_DIR/include/opus/opus.h" ]]; then
-        mkdir -p "$prefix/include/opus"
-        cp "$SOURCE_DIR/include/opus/opus.h" "$prefix/include/opus/opus.h"
-    fi
-
     echo "Built Opus for ${abi}: ${prefix}"
 }
 

scripts/build-android-turbojpeg.sh

@@ -5,13 +5,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SOURCE_DIR=""
 OUTPUT_DIR="${PROJECT_ROOT}/dist/android-turbojpeg"
 ANDROID_API="${ANDROID_API:-21}"
 NDK_ROOT="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
 BUILD_ABIS="arm64-v8a armeabi-v7a"
 JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
-LIBJPEG_TURBO_REPO="${LIBJPEG_TURBO_REPO:-https://github.com/libjpeg-turbo/libjpeg-turbo.git}"
+LIBJPEG_TURBO_VERSION="${LIBJPEG_TURBO_VERSION:-3.1.4.1}"
 
 usage() {
     cat <<'EOF'
@@ -19,8 +18,6 @@ Usage:
   scripts/build-android-turbojpeg.sh [options]
 
 Options:
-  --source <dir>          Existing libjpeg-turbo source checkout. If omitted,
-                          the script clones it into .tmp/android-turbojpeg-src.
   --output <dir>          Output root. Default: dist/android-turbojpeg
   --ndk <dir>             Android NDK root. Defaults to ANDROID_NDK_HOME or ANDROID_NDK_ROOT.
   --api <level>           Android API level. Default: 21.
@@ -46,10 +43,6 @@ fail() {
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
-    --source)
-        SOURCE_DIR="${2:-}"
-        shift 2
-        ;;
     --output)
         OUTPUT_DIR="${2:-}"
         shift 2
@@ -79,27 +72,29 @@ done
 [[ -n "$NDK_ROOT" ]] || fail "--ndk or ANDROID_NDK_HOME/ANDROID_NDK_ROOT is required"
 [[ -d "$NDK_ROOT/toolchains/llvm/prebuilt" ]] || fail "Invalid NDK root: $NDK_ROOT"
 
-if [[ -z "$SOURCE_DIR" ]]; then
-    SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-turbojpeg-src"
-    if [[ ! -d "$SOURCE_DIR/.git" ]]; then
-        rm -rf "$SOURCE_DIR"
-        git clone --depth 1 "$LIBJPEG_TURBO_REPO" "$SOURCE_DIR"
-    fi
+SOURCE_DIR="${PROJECT_ROOT}/.tmp/android-turbojpeg-src"
+rm -rf "$SOURCE_DIR"
+repo_url="https://github.com/libjpeg-turbo/libjpeg-turbo.git"
+if [[ "${CHINAMIRRO:-0}" == "1" ]]; then
+    repo_url="${GH_PROXY:-https://gh-proxy.com}"
+    repo_url="${repo_url%/}/https://github.com/libjpeg-turbo/libjpeg-turbo.git"
 fi
-
-[[ -d "$SOURCE_DIR" ]] || fail "libjpeg-turbo source not found: $SOURCE_DIR"
-[[ -f "$SOURCE_DIR/CMakeLists.txt" ]] || fail "libjpeg-turbo CMakeLists.txt not found under: $SOURCE_DIR"
+echo "Cloning libjpeg-turbo ${LIBJPEG_TURBO_VERSION}: $repo_url"
+git init "$SOURCE_DIR"
+(
+    cd "$SOURCE_DIR"
+    git remote add origin "$repo_url"
+    git fetch --depth 1 origin "refs/tags/$LIBJPEG_TURBO_VERSION"
+    git checkout --detach FETCH_HEAD
+)
 
 SOURCE_DIR="$(cd "$SOURCE_DIR" && pwd)"
 mkdir -p "$OUTPUT_DIR"
 OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)"
 
 HOST_TAG="$(uname -s | tr '[:upper:]' '[:lower:]')-x86_64"
-TOOLCHAIN="${NDK_ROOT}/toolchains/llvm/prebuilt/${HOST_TAG}"
 ANDROID_TOOLCHAIN_FILE="${NDK_ROOT}/build/cmake/android.toolchain.cmake"
-[[ -d "$TOOLCHAIN/bin" ]] || fail "NDK LLVM toolchain not found: $TOOLCHAIN"
 [[ -f "$ANDROID_TOOLCHAIN_FILE" ]] || fail "NDK CMake toolchain not found: $ANDROID_TOOLCHAIN_FILE"
-command -v cmake >/dev/null 2>&1 || fail "cmake is required"
 
 normalize_abis() {
     printf '%s\n' "$BUILD_ABIS" | tr ',' ' '

src/config/schema/mod.rs

@@ -37,7 +37,14 @@ pub struct AppConfig {
 }
 
 impl AppConfig {
+    pub fn enforce_invariants(&mut self) {
+        if self.hid.backend != HidBackend::Otg {
+            self.msd.enabled = false;
+        }
+    }
+
     pub fn apply_platform_defaults(&mut self) {
         crate::platform::defaults::apply(self);
+        self.enforce_invariants();
     }
 }

src/config/store.rs

@@ -27,7 +27,8 @@ impl ConfigStore {
     }
 
     pub async fn load(&self) -> Result<()> {
-        let config = Self::load_config(&self.pool).await?;
+        let mut config = Self::load_config(&self.pool).await?;
+        config.enforce_invariants();
         self.cache.store(Arc::new(config));
         Ok(())
     }
@@ -73,6 +74,8 @@ impl ConfigStore {
 
     pub async fn set(&self, config: AppConfig) -> Result<()> {
         let _guard = self.write_lock.lock().await;
+        let mut config = config;
+        config.enforce_invariants();
         Self::save_config_to_db(&self.pool, &config).await?;
         self.cache.store(Arc::new(config));
 
@@ -91,6 +94,7 @@ impl ConfigStore {
         let current = self.cache.load();
         let mut config = (**current).clone();
         f(&mut config);
+        config.enforce_invariants();
 
         Self::save_config_to_db(&self.pool, &config).await?;
 

src/extensions/manager.rs

@@ -1,16 +1,18 @@
 use std::collections::{HashMap, VecDeque};
+use std::path::PathBuf;
 use std::process::Stdio;
 use std::sync::Arc;
 
+use tempfile::TempDir;
 use tokio::io::{AsyncBufReadExt, BufReader};
 use tokio::process::{Child, Command};
 use tokio::sync::RwLock;
+use toml_edit::DocumentMut;
 
 use super::types::*;
 use crate::events::EventBus;
 
 const LOG_BUFFER_SIZE: usize = 200;
-const LOG_BATCH_SIZE: usize = 16;
 
 #[cfg(unix)]
 pub const TTYD_SOCKET_PATH: &str = "/var/run/one-kvm/ttyd.sock";
@@ -25,6 +27,12 @@ const TTYD_TCP_PORT: &str = "7681";
 struct ExtensionProcess {
     child: Child,
     logs: Arc<RwLock<VecDeque<String>>>,
+    _temp_dir: Option<TempDir>,
+}
+
+struct ExtensionLaunch {
+    args: Vec<String>,
+    temp_dir: Option<TempDir>,
 }
 
 pub struct ExtensionManager {
@@ -82,6 +90,17 @@ impl ExtensionManager {
             ExtensionId::Easytier => {
                 config.easytier.enabled && !config.easytier.network_name.is_empty()
             }
+            ExtensionId::Frpc => {
+                config.frpc.enabled
+                    && match config.frpc.config_mode {
+                        FrpcConfigMode::Quick => {
+                            !config.frpc.proxy_name.trim().is_empty()
+                                && !config.frpc.server_addr.trim().is_empty()
+                                && !config.frpc.token.is_empty()
+                        }
+                        FrpcConfigMode::Full => !config.frpc.custom_toml.trim().is_empty(),
+                    }
+            }
         }
     }
 
@@ -135,17 +154,17 @@ impl ExtensionManager {
 
         self.stop(id).await.ok();
 
-        let args = self.build_args(id, config).await?;
+        let launch = self.build_launch(id, config).await?;
 
         tracing::info!(
             "Starting extension {}: {} {}",
             id,
             id.binary_path().display(),
-            Self::redact_args_for_log(&args).join(" ")
+            launch.args.join(" ")
         );
 
         let mut child = Command::new(id.binary_path())
-            .args(&args)
+            .args(&launch.args)
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
             .kill_on_drop(true)
@@ -172,9 +191,21 @@ impl ExtensionManager {
 
         let pid = child.id();
         tracing::info!("Extension {} started with PID {:?}", id, pid);
+        Self::push_log(
+            &logs,
+            format!("Extension {} started with PID {:?}", id, pid),
+        )
+        .await;
 
         let mut processes = self.processes.write().await;
-        processes.insert(id, ExtensionProcess { child, logs });
+        processes.insert(
+            id,
+            ExtensionProcess {
+                child,
+                logs,
+                _temp_dir: launch.temp_dir,
+            },
+        );
         drop(processes);
         self.mark_ttyd_status_dirty(id).await;
 
@@ -212,22 +243,14 @@ impl ExtensionManager {
     ) {
         let reader = BufReader::new(reader);
         let mut lines = reader.lines();
-        let mut local_buffer = Vec::with_capacity(LOG_BATCH_SIZE);
 
         loop {
             match lines.next_line().await {
                 Ok(Some(line)) => {
                     tracing::info!("[{}] {}", id, line);
-                    local_buffer.push(line);
-
-                    if local_buffer.len() >= LOG_BATCH_SIZE {
-                        Self::flush_logs(&logs, &mut local_buffer).await;
-                    }
+                    Self::push_log(&logs, line).await;
                 }
                 Ok(None) => {
-                    if !local_buffer.is_empty() {
-                        Self::flush_logs(&logs, &mut local_buffer).await;
-                    }
                     break;
                 }
                 Err(e) => {
@@ -238,29 +261,27 @@ impl ExtensionManager {
         }
     }
 
-    async fn flush_logs(logs: &RwLock<VecDeque<String>>, buffer: &mut Vec<String>) {
+    async fn push_log(logs: &RwLock<VecDeque<String>>, line: String) {
         let mut logs = logs.write().await;
-        for line in buffer.drain(..) {
-            if logs.len() >= LOG_BUFFER_SIZE {
-                logs.pop_front();
-            }
-            logs.push_back(line);
+        if logs.len() >= LOG_BUFFER_SIZE {
+            logs.pop_front();
         }
+        logs.push_back(line);
     }
 
-    async fn build_args(
+    async fn build_launch(
         &self,
         id: ExtensionId,
         config: &ExtensionsConfig,
-    ) -> Result<Vec<String>, String> {
-        match id {
+    ) -> Result<ExtensionLaunch, String> {
+        let args = match id {
             ExtensionId::Ttyd => {
                 let c = &config.ttyd;
 
                 let mut args = Self::build_ttyd_listen_args().await?;
 
                 args.push(c.shell.clone());
-                Ok(args)
+                args
             }
 
             ExtensionId::Gostc => {
@@ -282,7 +303,7 @@ impl ExtensionManager {
 
                 args.extend(["-key".to_string(), c.key.clone()]);
 
-                Ok(args)
+                args
             }
 
             ExtensionId::Easytier => {
@@ -314,9 +335,153 @@ impl ExtensionManager {
                     args.push("-d".to_string());
                 }
 
-                Ok(args)
+                args
+            }
+
+            ExtensionId::Frpc => {
+                return Self::build_frpc_launch(&config.frpc).await;
+            }
+        };
+
+        Ok(ExtensionLaunch {
+            args,
+            temp_dir: None,
+        })
+    }
+
+    async fn build_frpc_launch(config: &FrpcConfig) -> Result<ExtensionLaunch, String> {
+        let config_text = match config.config_mode {
+            FrpcConfigMode::Quick => Self::build_frpc_quick_toml(config)?,
+            FrpcConfigMode::Full => Self::validate_frpc_full_toml(config)?.to_string(),
+        };
+
+        let temp_dir =
+            tempfile::tempdir().map_err(|e| format!("Failed to create FRPC config dir: {}", e))?;
+        let config_path = temp_dir.path().join("frpc.toml");
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(temp_dir.path(), std::fs::Permissions::from_mode(0o700))
+                .map_err(|e| format!("Failed to protect FRPC config dir: {}", e))?;
+        }
+
+        tokio::fs::write(&config_path, config_text)
+            .await
+            .map_err(|e| format!("Failed to write FRPC config: {}", e))?;
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            tokio::fs::set_permissions(&config_path, std::fs::Permissions::from_mode(0o600))
+                .await
+                .map_err(|e| format!("Failed to protect FRPC config: {}", e))?;
+        }
+
+        Ok(ExtensionLaunch {
+            args: vec!["-c".to_string(), Self::path_to_arg(&config_path)],
+            temp_dir: Some(temp_dir),
+        })
+    }
+
+    fn validate_frpc_full_toml(config: &FrpcConfig) -> Result<&str, String> {
+        let trimmed = config.custom_toml.trim();
+        if trimmed.is_empty() {
+            return Err("FRPC full configuration is required".into());
+        }
+
+        trimmed
+            .parse::<DocumentMut>()
+            .map_err(|e| format!("FRPC full configuration is not valid TOML: {}", e))?;
+
+        Ok(config.custom_toml.as_str())
+    }
+
+    fn build_frpc_quick_toml(config: &FrpcConfig) -> Result<String, String> {
+        if config.proxy_name.trim().is_empty() {
+            return Err("FRPC proxy name is required".into());
+        }
+        if config.server_addr.trim().is_empty() {
+            return Err("FRPC server address is required".into());
+        }
+        if config.token.is_empty() {
+            return Err("FRPC token is required".into());
+        }
+        if config.local_ip.trim().is_empty() {
+            return Err("FRPC local IP is required".into());
+        }
+
+        let proxy_type = match config.proxy_type {
+            FrpProxyType::Tcp => "tcp",
+            FrpProxyType::Udp => "udp",
+            FrpProxyType::Http => "http",
+            FrpProxyType::Https => "https",
+            FrpProxyType::Stcp => "stcp",
+            FrpProxyType::Sudp => "sudp",
+            FrpProxyType::Xtcp => "xtcp",
+        };
+
+        let mut toml = String::new();
+        toml.push_str(&format!(
+            "serverAddr = {}\nserverPort = {}\n\n",
+            Self::toml_string(config.server_addr.trim()),
+            config.server_port
+        ));
+        toml.push_str("[auth]\n");
+        toml.push_str("method = \"token\"\n");
+        toml.push_str(&format!("token = {}\n\n", Self::toml_string(&config.token)));
+        toml.push_str("[transport]\n");
+        toml.push_str("protocol = \"tcp\"\n\n");
+        toml.push_str("[transport.tls]\n");
+        toml.push_str(&format!("enable = {}\n\n", config.tls));
+        toml.push_str("[[proxies]]\n");
+        toml.push_str(&format!(
+            "name = {}\ntype = {}\nlocalIP = {}\nlocalPort = {}\n",
+            Self::toml_string(config.proxy_name.trim()),
+            Self::toml_string(proxy_type),
+            Self::toml_string(config.local_ip.trim()),
+            config.local_port
+        ));
+
+        match config.proxy_type {
+            FrpProxyType::Tcp | FrpProxyType::Udp => {
+                let remote_port = config.remote_port.ok_or_else(|| {
+                    "FRPC remote port is required for TCP/UDP proxies".to_string()
+                })?;
+                toml.push_str(&format!("remotePort = {}\n", remote_port));
+            }
+            FrpProxyType::Http | FrpProxyType::Https => {
+                if let Some(domain) = config
+                    .custom_domain
+                    .as_ref()
+                    .map(|s| s.trim())
+                    .filter(|s| !s.is_empty())
+                {
+                    toml.push_str(&format!(
+                        "customDomains = [{}]\n",
+                        Self::toml_string(domain)
+                    ));
+                }
+            }
+            FrpProxyType::Stcp | FrpProxyType::Sudp | FrpProxyType::Xtcp => {
+                if !config.secret_key.is_empty() {
+                    toml.push_str(&format!(
+                        "secretKey = {}\n",
+                        Self::toml_string(&config.secret_key)
+                    ));
+                }
             }
         }
+
+        Ok(toml)
+    }
+
+    fn toml_string(value: &str) -> String {
+        serde_json::to_string(value).unwrap_or_else(|_| "\"\"".to_string())
+    }
+
+    fn path_to_arg(path: &PathBuf) -> String {
+        path.to_string_lossy().to_string()
     }
 
     #[cfg(unix)]
@@ -356,34 +521,6 @@ impl ExtensionManager {
         ])
     }
 
-    fn redact_args_for_log(args: &[String]) -> Vec<String> {
-        let mut redacted = Vec::with_capacity(args.len());
-        let mut redact_next = false;
-
-        for arg in args {
-            if redact_next {
-                redacted.push("****".to_string());
-                redact_next = false;
-                continue;
-            }
-
-            if arg == "-key" || arg == "--key" {
-                redacted.push(arg.clone());
-                redact_next = true;
-            } else if let Some((flag, _)) = arg.split_once('=') {
-                if flag == "-key" || flag == "--key" {
-                    redacted.push(format!("{}=****", flag));
-                } else {
-                    redacted.push(arg.clone());
-                }
-            } else {
-                redacted.push(arg.clone());
-            }
-        }
-
-        redacted
-    }
-
     #[cfg(unix)]
     async fn prepare_ttyd_socket() -> Result<(), String> {
         let socket_path = std::path::Path::new(TTYD_SOCKET_PATH);

src/extensions/software_linux.rs

@@ -7,6 +7,7 @@ pub fn default_binary_path(id: ExtensionId) -> &'static str {
         ExtensionId::Ttyd => "/usr/bin/ttyd",
         ExtensionId::Gostc => "/usr/bin/gostc",
         ExtensionId::Easytier => "/usr/bin/easytier-core",
+        ExtensionId::Frpc => "/usr/bin/frpc",
     }
 }
 

src/extensions/software_windows.rs

@@ -7,6 +7,7 @@ pub fn default_binary_path(id: ExtensionId) -> &'static str {
         ExtensionId::Ttyd => "ttyd.win32.exe",
         ExtensionId::Gostc => "gostc.exe",
         ExtensionId::Easytier => "easytier-core.exe",
+        ExtensionId::Frpc => "frpc.exe",
     }
 }
 

src/extensions/types.rs

@@ -10,6 +10,7 @@ pub enum ExtensionId {
     Ttyd,
     Gostc,
     Easytier,
+    Frpc,
 }
 
 impl ExtensionId {
@@ -18,7 +19,7 @@ impl ExtensionId {
     }
 
     pub fn all() -> &'static [ExtensionId] {
-        &[Self::Ttyd, Self::Gostc, Self::Easytier]
+        &[Self::Ttyd, Self::Gostc, Self::Easytier, Self::Frpc]
     }
 }
 
@@ -28,6 +29,7 @@ impl std::fmt::Display for ExtensionId {
             Self::Ttyd => write!(f, "ttyd"),
             Self::Gostc => write!(f, "gostc"),
             Self::Easytier => write!(f, "easytier"),
+            Self::Frpc => write!(f, "frpc"),
         }
     }
 }
@@ -40,6 +42,7 @@ impl std::str::FromStr for ExtensionId {
             "ttyd" => Ok(Self::Ttyd),
             "gostc" => Ok(Self::Gostc),
             "easytier" => Ok(Self::Easytier),
+            "frpc" => Ok(Self::Frpc),
             _ => Err(format!("Unknown extension: {}", s)),
         }
     }
@@ -114,6 +117,85 @@ pub struct EasytierConfig {
     pub virtual_ip: Option<String>,
 }
 
+#[typeshare]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum FrpProxyType {
+    Tcp,
+    Udp,
+    Http,
+    Https,
+    Stcp,
+    Sudp,
+    Xtcp,
+}
+
+impl Default for FrpProxyType {
+    fn default() -> Self {
+        Self::Tcp
+    }
+}
+
+#[typeshare]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum FrpcConfigMode {
+    Quick,
+    Full,
+}
+
+impl Default for FrpcConfigMode {
+    fn default() -> Self {
+        Self::Quick
+    }
+}
+
+#[typeshare]
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+pub struct FrpcConfig {
+    pub enabled: bool,
+    pub config_mode: FrpcConfigMode,
+    pub proxy_name: String,
+    pub proxy_type: FrpProxyType,
+    pub server_addr: String,
+    pub server_port: u16,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub token: String,
+    pub local_ip: String,
+    pub local_port: u16,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_port: Option<u16>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub custom_domain: Option<String>,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub secret_key: String,
+    pub tls: bool,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub custom_toml: String,
+}
+
+impl Default for FrpcConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_mode: FrpcConfigMode::Quick,
+            proxy_name: String::new(),
+            proxy_type: FrpProxyType::Tcp,
+            server_addr: String::new(),
+            server_port: 7000,
+            token: String::new(),
+            local_ip: "127.0.0.1".to_string(),
+            local_port: 22,
+            remote_port: None,
+            custom_domain: None,
+            secret_key: String::new(),
+            tls: true,
+            custom_toml: String::new(),
+        }
+    }
+}
+
 #[typeshare]
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 #[serde(default)]
@@ -121,6 +203,7 @@ pub struct ExtensionsConfig {
     pub ttyd: TtydConfig,
     pub gostc: GostcConfig,
     pub easytier: EasytierConfig,
+    pub frpc: FrpcConfig,
 }
 
 #[typeshare]
@@ -154,12 +237,21 @@ pub struct EasytierInfo {
     pub config: EasytierConfig,
 }
 
+#[typeshare]
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct FrpcInfo {
+    pub available: bool,
+    pub status: ExtensionStatus,
+    pub config: FrpcConfig,
+}
+
 #[typeshare]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ExtensionsStatus {
     pub ttyd: TtydInfo,
     pub gostc: GostcInfo,
     pub easytier: EasytierInfo,
+    pub frpc: FrpcInfo,
 }
 
 #[typeshare]

src/hid/ch9329.rs

@@ -15,7 +15,7 @@ use std::sync::{mpsc, Arc};
 use std::thread;
 use std::time::{Duration, Instant};
 use tokio::sync::watch;
-use tracing::{info, trace};
+use tracing::{info, trace, warn};
 
 use super::backend::{HidBackend, HidBackendRuntimeSnapshot};
 use super::ch9329_proto::{
@@ -36,6 +36,8 @@ const RECONNECT_DELAY_MS: u64 = 2000;
 
 const INIT_WAIT_MS: u64 = 3000;
 
+const RECONNECT_COMMAND_POLL_MS: u64 = 100;
+
 struct Ch9329RuntimeState {
     initialized: AtomicBool,
     online: AtomicBool,
@@ -117,15 +119,15 @@ pub struct Ch9329Backend {
     baud_rate: u32,
     worker_tx: Mutex<Option<mpsc::Sender<WorkerCommand>>>,
     worker_handle: Mutex<Option<thread::JoinHandle<()>>>,
-    keyboard_state: Mutex<KeyboardReport>,
-    mouse_buttons: AtomicU8,
+    keyboard_state: Arc<Mutex<KeyboardReport>>,
+    mouse_buttons: Arc<AtomicU8>,
     screen_resolution: RwLock<(u32, u32)>,
     chip_info: Arc<RwLock<Option<ChipInfo>>>,
     led_status: Arc<RwLock<LedStatus>>,
     address: u8,
-    last_abs_x: AtomicU16,
-    last_abs_y: AtomicU16,
-    relative_mouse_active: AtomicBool,
+    last_abs_x: Arc<AtomicU16>,
+    last_abs_y: Arc<AtomicU16>,
+    relative_mouse_active: Arc<AtomicBool>,
     runtime: Arc<Ch9329RuntimeState>,
 }
 
@@ -140,15 +142,15 @@ impl Ch9329Backend {
             baud_rate,
             worker_tx: Mutex::new(None),
             worker_handle: Mutex::new(None),
-            keyboard_state: Mutex::new(KeyboardReport::default()),
-            mouse_buttons: AtomicU8::new(0),
+            keyboard_state: Arc::new(Mutex::new(KeyboardReport::default())),
+            mouse_buttons: Arc::new(AtomicU8::new(0)),
             screen_resolution: RwLock::new((1920, 1080)),
             chip_info: Arc::new(RwLock::new(None)),
             led_status: Arc::new(RwLock::new(LedStatus::default())),
             address: DEFAULT_ADDR,
-            last_abs_x: AtomicU16::new(0),
-            last_abs_y: AtomicU16::new(0),
-            relative_mouse_active: AtomicBool::new(false),
+            last_abs_x: Arc::new(AtomicU16::new(0)),
+            last_abs_y: Arc::new(AtomicU16::new(0)),
+            relative_mouse_active: Arc::new(AtomicBool::new(false)),
             runtime: Arc::new(Ch9329RuntimeState::new()),
         })
     }
@@ -168,9 +170,27 @@ impl Ch9329Backend {
         std::path::Path::new(&self.port_path).exists()
     }
 
-    fn serial_error_to_hid_error(e: serialport::Error, operation: &str) -> AppError {
+    fn serial_error_to_hid_error(
+        port_path: &str,
+        e: serialport::Error,
+        operation: &str,
+    ) -> AppError {
+        let port_present = {
+            #[cfg(windows)]
+            {
+                crate::utils::list_serial_ports()
+                    .iter()
+                    .any(|port| port.eq_ignore_ascii_case(port_path))
+            }
+            #[cfg(not(windows))]
+            {
+                std::path::Path::new(port_path).exists()
+            }
+        };
+
         let error_code = match e.kind() {
-            serialport::ErrorKind::NoDevice => "port_not_found",
+            serialport::ErrorKind::NoDevice if !port_present => "port_not_found",
+            serialport::ErrorKind::NoDevice => "device_unavailable",
             serialport::ErrorKind::InvalidInput => "invalid_config",
             serialport::ErrorKind::Io(_) => "io_error",
             _ => "serial_error",
@@ -204,7 +224,7 @@ impl Ch9329Backend {
         serialport::new(port_path, baud_rate)
             .timeout(Duration::from_millis(RESPONSE_TIMEOUT_MS))
             .open()
-            .map_err(|e| Self::serial_error_to_hid_error(e, "Failed to open serial port"))
+            .map_err(|e| Self::serial_error_to_hid_error(port_path, e, "Failed to open serial port"))
     }
 
     fn write_packet(
@@ -302,6 +322,28 @@ impl Ch9329Backend {
             .ok_or_else(|| Self::backend_error("Failed to parse chip info", "invalid_response"))
     }
 
+    fn open_ready_port(
+        port_path: &str,
+        baud_rate: u32,
+        address: u8,
+    ) -> Result<(Box<dyn serialport::SerialPort>, ChipInfo)> {
+        Self::open_port(port_path, baud_rate).and_then(|mut port| {
+            let info = Self::query_chip_info_on_port(port.as_mut(), address)?;
+            Ok((port, info))
+        })
+    }
+
+    fn record_runtime_error(runtime: &Arc<Ch9329RuntimeState>, err: &AppError) {
+        if let AppError::HidError {
+            reason, error_code, ..
+        } = err
+        {
+            runtime.set_error(reason.clone(), error_code.clone());
+        } else {
+            runtime.set_error(err.to_string(), "error");
+        }
+    }
+
     fn update_chip_info_cache(
         chip_info: &Arc<RwLock<Option<ChipInfo>>>,
         led_status: &Arc<RwLock<LedStatus>>,
@@ -342,6 +384,49 @@ impl Ch9329Backend {
         })
     }
 
+    fn wait_reconnect_delay(rx: &mpsc::Receiver<WorkerCommand>) -> bool {
+        let deadline = Instant::now() + Duration::from_millis(RECONNECT_DELAY_MS);
+        loop {
+            let now = Instant::now();
+            if now >= deadline {
+                return true;
+            }
+
+            let remaining = deadline.saturating_duration_since(now);
+            let timeout = remaining.min(Duration::from_millis(RECONNECT_COMMAND_POLL_MS));
+            match rx.recv_timeout(timeout) {
+                Ok(WorkerCommand::Shutdown) | Err(mpsc::RecvTimeoutError::Disconnected) => {
+                    return false;
+                }
+                Ok(_) | Err(mpsc::RecvTimeoutError::Timeout) => {}
+            }
+        }
+    }
+
+    fn release_state_on_port(port: &mut dyn serialport::SerialPort, address: u8) -> Result<()> {
+        let reset_sequence = [(cmd::SEND_KB_GENERAL_DATA, vec![0; 8])];
+
+        for (cmd, data) in reset_sequence {
+            Self::xfer_packet(port, address, cmd, &data)?;
+        }
+
+        Ok(())
+    }
+
+    fn clear_local_state(
+        keyboard_state: &Arc<Mutex<KeyboardReport>>,
+        mouse_buttons: &Arc<AtomicU8>,
+        last_abs_x: &Arc<AtomicU16>,
+        last_abs_y: &Arc<AtomicU16>,
+        relative_mouse_active: &Arc<AtomicBool>,
+    ) {
+        keyboard_state.lock().clear();
+        mouse_buttons.store(0, Ordering::Relaxed);
+        last_abs_x.store(0, Ordering::Relaxed);
+        last_abs_y.store(0, Ordering::Relaxed);
+        relative_mouse_active.store(false, Ordering::Relaxed);
+    }
+
     fn worker_reconnect_loop(
         rx: &mpsc::Receiver<WorkerCommand>,
         port_path: &str,
@@ -351,18 +436,9 @@ impl Ch9329Backend {
         led_status: &Arc<RwLock<LedStatus>>,
         runtime: &Arc<Ch9329RuntimeState>,
     ) -> Option<Box<dyn serialport::SerialPort>> {
+        runtime.set_offline();
         loop {
-            match rx.recv_timeout(Duration::from_millis(RECONNECT_DELAY_MS)) {
-                Ok(WorkerCommand::Shutdown) => return None,
-                Ok(_) => continue,
-                Err(mpsc::RecvTimeoutError::Disconnected) => return None,
-                Err(mpsc::RecvTimeoutError::Timeout) => {}
-            }
-
-            match Self::open_port(port_path, baud_rate).and_then(|mut port| {
-                let info = Self::query_chip_info_on_port(port.as_mut(), address)?;
-                Ok((port, info))
-            }) {
+            match Self::open_ready_port(port_path, baud_rate, address) {
                 Ok((port, info)) => {
                     info!(
                         "CH9329 reconnected: {}, USB: {}",
@@ -380,11 +456,9 @@ impl Ch9329Backend {
                     return Some(port);
                 }
                 Err(err) => {
-                    if let AppError::HidError {
-                        reason, error_code, ..
-                    } = err
-                    {
-                        runtime.set_error(reason, error_code);
+                    Self::record_runtime_error(runtime, &err);
+                    if !Self::wait_reconnect_delay(rx) {
+                        return None;
                     }
                 }
             }
@@ -437,36 +511,43 @@ impl Ch9329Backend {
         chip_info: Arc<RwLock<Option<ChipInfo>>>,
         led_status: Arc<RwLock<LedStatus>>,
         runtime: Arc<Ch9329RuntimeState>,
+        keyboard_state: Arc<Mutex<KeyboardReport>>,
+        mouse_buttons: Arc<AtomicU8>,
+        last_abs_x: Arc<AtomicU16>,
+        last_abs_y: Arc<AtomicU16>,
+        relative_mouse_active: Arc<AtomicBool>,
         init_tx: mpsc::Sender<Result<ChipInfo>>,
     ) {
         runtime.set_initialized(true);
 
-        let mut port = match Self::open_port(&port_path, baud_rate).and_then(|mut port| {
-            let info = Self::query_chip_info_on_port(port.as_mut(), address)?;
-            Ok((port, info))
-        }) {
-            Ok((port, info)) => {
-                info!(
-                    "CH9329 serial port opened: {} @ {} baud",
-                    port_path, baud_rate
-                );
-                if Self::update_chip_info_cache(&chip_info, &led_status, info.clone()) {
-                    runtime.notify();
+        let mut init_tx = Some(init_tx);
+        let mut port = loop {
+            match Self::open_ready_port(&port_path, baud_rate, address) {
+                Ok((port, info)) => {
+                    info!(
+                        "CH9329 serial port opened: {} @ {} baud",
+                        port_path, baud_rate
+                    );
+                    if Self::update_chip_info_cache(&chip_info, &led_status, info.clone()) {
+                        runtime.notify();
+                    }
+                    runtime.set_online();
+                    if let Some(init_tx) = init_tx.take() {
+                        let _ = init_tx.send(Ok(info));
+                    }
+                    break port;
                 }
-                runtime.set_online();
-                let _ = init_tx.send(Ok(info));
-                port
-            }
-            Err(err) => {
-                if let AppError::HidError {
-                    reason, error_code, ..
-                } = &err
-                {
-                    runtime.set_error(reason.clone(), error_code.clone());
+                Err(err) => {
+                    Self::record_runtime_error(&runtime, &err);
+                    if let Some(init_tx) = init_tx.take() {
+                        let _ = init_tx.send(Err(err));
+                    }
+                    if !Self::wait_reconnect_delay(&rx) {
+                        runtime.set_offline();
+                        runtime.set_initialized(false);
+                        return;
+                    }
                 }
-                let _ = init_tx.send(Err(err));
-                runtime.set_initialized(false);
-                return;
             }
         };
 
@@ -482,6 +563,7 @@ impl Ch9329Backend {
                         }
 
                         Self::try_best_effort_reset(port.as_mut(), address);
+                        drop(port);
 
                         let Some(new_port) = Self::worker_reconnect_loop(
                             &rx,
@@ -500,28 +582,17 @@ impl Ch9329Backend {
                     }
                 }
                 Ok(WorkerCommand::ResetState) => {
-                    let reset_sequence = [
-                        (cmd::SEND_KB_GENERAL_DATA, vec![0; 8]),
-                        (cmd::SEND_MS_ABS_DATA, vec![0x02, 0, 0, 0, 0, 0, 0]),
-                        (cmd::SEND_KB_MEDIA_DATA, vec![0x02, 0x00, 0x00, 0x00]),
-                    ];
-
-                    let mut reset_failed = false;
-                    for (cmd, data) in reset_sequence {
-                        if let Err(err) = Self::xfer_packet(port.as_mut(), address, cmd, &data) {
-                            if let AppError::HidError {
-                                reason, error_code, ..
-                            } = err
-                            {
-                                runtime.set_error(reason, error_code);
-                            }
-                            reset_failed = true;
-                            Self::try_best_effort_reset(port.as_mut(), address);
-                            break;
-                        }
-                    }
-
-                    if reset_failed {
+                    Self::clear_local_state(
+                        &keyboard_state,
+                        &mouse_buttons,
+                        &last_abs_x,
+                        &last_abs_y,
+                        &relative_mouse_active,
+                    );
+                    if let Err(err) = Self::release_state_on_port(port.as_mut(), address) {
+                        Self::record_runtime_error(&runtime, &err);
+                        Self::try_best_effort_reset(port.as_mut(), address);
+                        drop(port);
                         let Some(new_port) = Self::worker_reconnect_loop(
                             &rx,
                             &port_path,
@@ -556,6 +627,7 @@ impl Ch9329Backend {
                             }
 
                             Self::try_best_effort_reset(port.as_mut(), address);
+                            drop(port);
 
                             let Some(new_port) = Self::worker_reconnect_loop(
                                 &rx,
@@ -596,12 +668,29 @@ impl HidBackend for Ch9329Backend {
         let chip_info = self.chip_info.clone();
         let led_status = self.led_status.clone();
         let runtime = self.runtime.clone();
+        let keyboard_state = self.keyboard_state.clone();
+        let mouse_buttons = self.mouse_buttons.clone();
+        let last_abs_x = self.last_abs_x.clone();
+        let last_abs_y = self.last_abs_y.clone();
+        let relative_mouse_active = self.relative_mouse_active.clone();
 
         let handle = thread::Builder::new()
             .name("ch9329-worker".to_string())
             .spawn(move || {
                 Self::worker_loop(
-                    port_path, baud_rate, address, rx, chip_info, led_status, runtime, init_tx,
+                    port_path,
+                    baud_rate,
+                    address,
+                    rx,
+                    chip_info,
+                    led_status,
+                    runtime,
+                    keyboard_state,
+                    mouse_buttons,
+                    last_abs_x,
+                    last_abs_y,
+                    relative_mouse_active,
+                    init_tx,
                 );
             })
             .map_err(|e| AppError::Internal(format!("Failed to spawn CH9329 worker: {}", e)))?;
@@ -626,7 +715,6 @@ impl HidBackend for Ch9329Backend {
                 Ok(())
             }
             Ok(Err(err)) => {
-                let _ = handle.join();
                 self.record_error(
                     format!(
                         "CH9329 not responding on {} @ {} baud: {}",
@@ -634,10 +722,13 @@ impl HidBackend for Ch9329Backend {
                     ),
                     "init_failed",
                 );
-                Err(AppError::Internal(format!(
-                    "CH9329 not responding on {} @ {} baud: {}",
+                warn!(
+                    "CH9329 not responding on {} @ {} baud, retrying in background: {}",
                     self.port_path, self.baud_rate, err
-                )))
+                );
+                *self.worker_tx.lock() = Some(tx);
+                *self.worker_handle.lock() = Some(handle);
+                Ok(())
             }
             Err(_) => {
                 let _ = tx.send(WorkerCommand::Shutdown);

src/otg/manager.rs

@@ -300,7 +300,10 @@ impl OtgGadgetManager {
 
         let strings_path = self.config_path.join("strings/0x409");
         create_dir(&strings_path)?;
-        write_file(&strings_path.join("configuration"), "Config 1: HID + MSD")?;
+        write_file(
+            &strings_path.join("configuration"),
+            self.configuration_label(),
+        )?;
 
         write_file(&self.config_path.join("MaxPower"), "500")?;
 
@@ -308,6 +311,18 @@ impl OtgGadgetManager {
         Ok(())
     }
 
+    fn configuration_label(&self) -> &'static str {
+        if self
+            .functions
+            .iter()
+            .any(|func| func.name().starts_with("mass_storage."))
+        {
+            "Config 1: HID + MSD"
+        } else {
+            "Config 1: HID"
+        }
+    }
+
     pub fn gadget_path(&self) -> &PathBuf {
         &self.gadget_path
     }

src/web/handlers/config/apply.rs

@@ -167,7 +167,8 @@ pub async fn apply_hid_config(
     new_config: &HidConfig,
     options: ConfigApplyOptions,
 ) -> Result<()> {
-    let current_msd_enabled = state.config.get().msd.enabled;
+    let current_config = state.config.get();
+    let current_msd_enabled = current_config.msd.enabled && new_config.backend == HidBackend::Otg;
     new_config.validate_otg_endpoint_budget(current_msd_enabled)?;
 
     let descriptor_changed = old_config.otg_descriptor != new_config.otg_descriptor;
@@ -235,18 +236,19 @@ pub async fn apply_msd_config(
     new_config: &MsdConfig,
     options: ConfigApplyOptions,
 ) -> Result<()> {
-    state
-        .config
-        .get()
+    let current_config = state.config.get();
+    let hid_backend_is_otg = current_config.hid.backend == HidBackend::Otg;
+    let effective_new_msd_enabled = new_config.enabled && hid_backend_is_otg;
+    current_config
         .hid
-        .validate_otg_endpoint_budget(new_config.enabled)?;
+        .validate_otg_endpoint_budget(effective_new_msd_enabled)?;
 
     tracing::info!("MSD config sent, checking if reload needed...");
     tracing::debug!("Old MSD config: {:?}", old_config);
     tracing::debug!("New MSD config: {:?}", new_config);
 
     let old_msd_enabled = old_config.enabled;
-    let new_msd_enabled = new_config.enabled;
+    let new_msd_enabled = effective_new_msd_enabled;
     let msd_dir_changed = old_config.msd_dir != new_config.msd_dir;
 
     tracing::info!(

src/web/handlers/config/hid.rs

@@ -25,6 +25,7 @@ pub async fn update_hid_config(
         .config
         .update(|config| {
             req.apply_to(&mut config.hid);
+            config.enforce_invariants();
         })
         .await?;
 

src/web/handlers/config/msd.rs

@@ -25,6 +25,7 @@ pub async fn update_msd_config(
         .config
         .update(|config| {
             req.apply_to(&mut config.msd);
+            config.enforce_invariants();
         })
         .await?;
 

src/web/handlers/extensions.rs

@@ -4,12 +4,14 @@ use axum::{
 };
 use serde::Deserialize;
 use std::sync::Arc;
+use toml_edit::DocumentMut;
 use typeshare::typeshare;
 
 use crate::error::{AppError, Result};
 use crate::extensions::{
     EasytierConfig, EasytierInfo, ExtensionId, ExtensionInfo, ExtensionLogs, ExtensionsStatus,
-    GostcConfig, GostcInfo, TtydConfig, TtydInfo,
+    FrpProxyType, FrpcConfig, FrpcConfigMode, FrpcInfo, GostcConfig, GostcInfo, TtydConfig,
+    TtydInfo,
 };
 use crate::state::AppState;
 
@@ -34,6 +36,46 @@ fn validate_easytier_enabled(config: &EasytierConfig) -> Result<()> {
     Ok(())
 }
 
+fn validate_frpc_enabled(config: &FrpcConfig) -> Result<()> {
+    match config.config_mode {
+        FrpcConfigMode::Quick => {
+            if config.proxy_name.trim().is_empty() {
+                return Err(AppError::BadRequest("FRPC proxy name is required".into()));
+            }
+            if config.server_addr.trim().is_empty() {
+                return Err(AppError::BadRequest(
+                    "FRPC server address is required".into(),
+                ));
+            }
+            if config.token.is_empty() {
+                return Err(AppError::BadRequest("FRPC token is required".into()));
+            }
+            if config.local_ip.trim().is_empty() {
+                return Err(AppError::BadRequest("FRPC local IP is required".into()));
+            }
+            if matches!(config.proxy_type, FrpProxyType::Tcp | FrpProxyType::Udp)
+                && config.remote_port.is_none()
+            {
+                return Err(AppError::BadRequest(
+                    "FRPC remote port is required for TCP/UDP proxies".into(),
+                ));
+            }
+        }
+        FrpcConfigMode::Full => {
+            let toml = config.custom_toml.trim();
+            if toml.is_empty() {
+                return Err(AppError::BadRequest(
+                    "FRPC full configuration is required".into(),
+                ));
+            }
+            toml.parse::<DocumentMut>().map_err(|e| {
+                AppError::BadRequest(format!("FRPC full configuration is not valid TOML: {}", e))
+            })?;
+        }
+    }
+    Ok(())
+}
+
 pub async fn list_extensions(State(state): State<Arc<AppState>>) -> Json<ExtensionsStatus> {
     let config = state.config.get();
     let mgr = &state.extensions;
@@ -54,6 +96,11 @@ pub async fn list_extensions(State(state): State<Arc<AppState>>) -> Json<Extensi
             status: mgr.status(ExtensionId::Easytier).await,
             config: config.extensions.easytier.clone(),
         },
+        frpc: FrpcInfo {
+            available: mgr.check_available(ExtensionId::Frpc),
+            status: mgr.status(ExtensionId::Frpc).await,
+            config: config.extensions.frpc.clone(),
+        },
     })
 }
 
@@ -159,6 +206,25 @@ pub struct EasytierConfigUpdate {
     pub virtual_ip: Option<String>,
 }
 
+#[typeshare]
+#[derive(Debug, Deserialize)]
+pub struct FrpcConfigUpdate {
+    pub enabled: Option<bool>,
+    pub config_mode: Option<FrpcConfigMode>,
+    pub proxy_name: Option<String>,
+    pub proxy_type: Option<FrpProxyType>,
+    pub server_addr: Option<String>,
+    pub server_port: Option<u16>,
+    pub token: Option<String>,
+    pub local_ip: Option<String>,
+    pub local_port: Option<u16>,
+    pub remote_port: Option<Option<u16>>,
+    pub custom_domain: Option<Option<String>>,
+    pub secret_key: Option<String>,
+    pub tls: Option<bool>,
+    pub custom_toml: Option<String>,
+}
+
 pub async fn update_ttyd_config(
     State(state): State<Arc<AppState>>,
     Json(req): Json<TtydConfigUpdate>,
@@ -295,3 +361,81 @@ pub async fn update_easytier_config(
 
     Ok(Json(new_config.extensions.easytier.clone()))
 }
+
+pub async fn update_frpc_config(
+    State(state): State<Arc<AppState>>,
+    Json(req): Json<FrpcConfigUpdate>,
+) -> Result<Json<FrpcConfig>> {
+    let current_config = state.config.get();
+    let was_enabled = current_config.extensions.frpc.enabled;
+    let mut next_frpc = current_config.extensions.frpc.clone();
+
+    if let Some(enabled) = req.enabled {
+        next_frpc.enabled = enabled;
+    }
+    if let Some(config_mode) = req.config_mode {
+        next_frpc.config_mode = config_mode;
+    }
+    if let Some(ref proxy_name) = req.proxy_name {
+        next_frpc.proxy_name = proxy_name.clone();
+    }
+    if let Some(proxy_type) = req.proxy_type {
+        next_frpc.proxy_type = proxy_type;
+    }
+    if let Some(ref addr) = req.server_addr {
+        next_frpc.server_addr = addr.clone();
+    }
+    if let Some(port) = req.server_port {
+        next_frpc.server_port = port;
+    }
+    if let Some(ref token) = req.token {
+        next_frpc.token = token.clone();
+    }
+    if let Some(ref local_ip) = req.local_ip {
+        next_frpc.local_ip = local_ip.clone();
+    }
+    if let Some(local_port) = req.local_port {
+        next_frpc.local_port = local_port;
+    }
+    if let Some(remote_port) = req.remote_port {
+        next_frpc.remote_port = remote_port;
+    }
+    if let Some(custom_domain) = req.custom_domain {
+        next_frpc.custom_domain = custom_domain;
+    }
+    if let Some(ref secret_key) = req.secret_key {
+        next_frpc.secret_key = secret_key.clone();
+    }
+    if let Some(tls) = req.tls {
+        next_frpc.tls = tls;
+    }
+    if let Some(ref custom_toml) = req.custom_toml {
+        next_frpc.custom_toml = custom_toml.clone();
+    }
+
+    if next_frpc.enabled || matches!(next_frpc.config_mode, FrpcConfigMode::Full) {
+        validate_frpc_enabled(&next_frpc)?;
+    }
+
+    state
+        .config
+        .update(|config| {
+            config.extensions.frpc = next_frpc.clone();
+        })
+        .await?;
+
+    let new_config = state.config.get();
+    let is_enabled = new_config.extensions.frpc.enabled;
+
+    if was_enabled && !is_enabled {
+        state.extensions.stop(ExtensionId::Frpc).await.ok();
+    } else if !was_enabled && is_enabled && state.extensions.check_available(ExtensionId::Frpc) {
+        state
+            .extensions
+            .start(ExtensionId::Frpc, &new_config.extensions)
+            .await
+            .ok();
+    }
+
+    Ok(Json(new_config.extensions.frpc.clone()))
+}

src/web/handlers/setup.rs

@@ -132,6 +132,7 @@ pub async fn setup_init(
             if let Some(enabled) = req.msd_enabled {
                 config.msd.enabled = enabled;
             }
+            config.enforce_invariants();
 
             // Extension settings
             if let Some(enabled) = req.ttyd_enabled {

src/web/routes.rs

@@ -205,6 +205,10 @@ pub fn create_router(state: Arc<AppState>) -> Router {
             "/extensions/easytier/config",
             patch(handlers::extensions::update_easytier_config),
         )
+        .route(
+            "/extensions/frpc/config",
+            patch(handlers::extensions::update_frpc_config),
+        )
         // Terminal (ttyd) reverse proxy - WebSocket and HTTP
         .route("/terminal", get(handlers::terminal::terminal_index))
         .route("/terminal/", get(handlers::terminal::terminal_index))

web/src/api/config.ts

@@ -24,6 +24,8 @@ import type {
   GostcConfigUpdate,
   EasytierConfig,
   EasytierConfigUpdate,
+  FrpcConfig,
+  FrpcConfigUpdate,
   WebConfigResponse,
   WebConfigUpdate,
 } from '@/types/generated'
@@ -159,6 +161,12 @@ export const extensionsApi = {
       method: 'PATCH',
       body: JSON.stringify(config),
     }),
+
+  updateFrpc: (config: FrpcConfigUpdate) =>
+    request<FrpcConfig>('/extensions/frpc/config', {
+      method: 'PATCH',
+      body: JSON.stringify(config),
+    }),
 }
 
 export interface RustDeskConfigResponse {

web/src/i18n/en-US.ts

@@ -522,6 +522,7 @@ export default {
     extRustdeskSubtitle: 'Remote graphical access via RustDesk',
     extRtspSubtitle: 'Provide an RTSP video stream for external clients',
     extRemoteAccessSubtitle: 'Remote access through NAT-traversal services',
+    extFrpcSubtitle: 'NAT traversal through the FRP client',
     aboutDesc: 'Open and Lightweight IP-KVM Solution',
     deviceInfo: 'Device Info',
     deviceInfoDesc: 'Host system information',
@@ -956,7 +957,7 @@ export default {
     binaryNotFound: '{path} not found, please install the required program',
     remoteAccess: {
       title: 'Remote Access',
-      desc: 'GOSTC NAT traversal and Easytier networking',
+      desc: 'GOSTC/FRPC NAT traversal and Easytier networking',
     },
     ttyd: {
       title: 'Ttyd Web Terminal',
@@ -987,6 +988,33 @@ export default {
       virtualIp: 'Virtual IP',
       virtualIpHint: 'Leave empty for DHCP, or specify with CIDR (e.g., 10.0.0.1/24)',
     },
+    frpc: {
+      title: 'FRPC NAT Traversal',
+      desc: 'Connect to an frps server through the FRP client',
+      quickConfig: 'Quick Config',
+      fullConfig: 'Full Config',
+      fullConfigHint: 'Paste the provider TOML configuration file here',
+      fullConfigRequired: 'Enter the full frpc.toml configuration',
+      proxyType: 'Proxy Type',
+      proxyName: 'Proxy Name',
+      proxyNamePlaceholder: 'one-kvm-ssh',
+      proxyNameRequired: 'Enter the FRPC proxy name',
+      serverAddr: 'Server Address',
+      serverAddrPlaceholder: 'frps.example.com',
+      serverAddrRequired: 'Enter the FRPC server address',
+      serverPort: 'Server Port',
+      token: 'Token',
+      tokenRequired: 'Enter the FRPC token',
+      localIp: 'Local Address',
+      localIpRequired: 'Enter the FRPC local address',
+      localPort: 'Local Port',
+      remotePort: 'Remote Port',
+      remotePortRequired: 'TCP/UDP proxies require a remote port',
+      customDomain: 'Custom Domain',
+      customDomainPlaceholder: 'kvm.example.com',
+      secretKey: 'Secret Key',
+      tls: 'Enable TLS',
+    },
     rustdesk: {
       title: 'RustDesk Remote',
       desc: 'Remote access via RustDesk client',

web/src/i18n/zh-CN.ts

@@ -521,6 +521,7 @@ export default {
     extRustdeskSubtitle: '通过 RustDesk 实现远程图形访问',
     extRtspSubtitle: '提供 RTSP 视频流以供其他客户端拉流',
     extRemoteAccessSubtitle: '通过内网穿透服务实现远程访问',
+    extFrpcSubtitle: '通过 FRP 客户端实现内网穿透',
     aboutDesc: '开放轻量的 IP-KVM 解决方案',
     deviceInfo: '设备信息',
     deviceInfoDesc: '主机系统信息',
@@ -955,7 +956,7 @@ export default {
     binaryNotFound: '未找到 {path}，请先安装对应程序',
     remoteAccess: {
       title: '远程访问',
-      desc: 'GOSTC 内网穿透与 Easytier 组网',
+      desc: 'GOSTC/FRPC 内网穿透与 Easytier 组网',
     },
     ttyd: {
       title: 'Ttyd 网页终端',
@@ -986,6 +987,33 @@ export default {
       virtualIp: '虚拟 IP',
       virtualIpHint: '留空则自动分配，手动指定需包含网段（如 10.0.0.1/24）',
     },
+    frpc: {
+      title: 'FRPC 内网穿透',
+      desc: '通过 FRP 客户端连接 frps 服务',
+      quickConfig: '快速配置',
+      fullConfig: '完整配置',
+      fullConfigHint: '可在此粘贴供应商 TOML 配置文件',
+      fullConfigRequired: '请填写完整 frpc.toml 配置',
+      proxyType: '代理类型',
+      proxyName: '代理名称',
+      proxyNamePlaceholder: 'one-kvm-ssh',
+      proxyNameRequired: '请填写 FRPC 代理名称',
+      serverAddr: '服务器地址',
+      serverAddrPlaceholder: 'frps.example.com',
+      serverAddrRequired: '请填写 FRPC 服务器地址',
+      serverPort: '服务器端口',
+      token: '认证令牌',
+      tokenRequired: '请填写 FRPC 认证令牌',
+      localIp: '本地地址',
+      localIpRequired: '请填写 FRPC 本地地址',
+      localPort: '本地端口',
+      remotePort: '远程端口',
+      remotePortRequired: 'TCP/UDP 代理需要填写远程端口',
+      customDomain: '自定义域名',
+      customDomainPlaceholder: 'kvm.example.com',
+      secretKey: '访问密钥',
+      tls: '启用 TLS',
+    },
     rustdesk: {
       title: 'RustDesk 远程',
       desc: '使用 RustDesk 客户端进行远程访问',

web/src/types/generated.ts

@@ -175,10 +175,43 @@ export interface EasytierConfig {
 	virtual_ip?: string;
 }
 
+export enum FrpProxyType {
+	Tcp = "tcp",
+	Udp = "udp",
+	Http = "http",
+	Https = "https",
+	Stcp = "stcp",
+	Sudp = "sudp",
+	Xtcp = "xtcp",
+}
+
+export enum FrpcConfigMode {
+	Quick = "quick",
+	Full = "full",
+}
+
+export interface FrpcConfig {
+	enabled: boolean;
+	config_mode: FrpcConfigMode;
+	proxy_name: string;
+	proxy_type: FrpProxyType;
+	server_addr: string;
+	server_port: number;
+	token: string;
+	local_ip: string;
+	local_port: number;
+	remote_port?: number;
+	custom_domain?: string;
+	secret_key: string;
+	tls: boolean;
+	custom_toml: string;
+}
+
 export interface ExtensionsConfig {
 	ttyd: TtydConfig;
 	gostc: GostcConfig;
 	easytier: EasytierConfig;
+	frpc: FrpcConfig;
 }
 
 export interface RustDeskConfig {
@@ -277,6 +310,23 @@ export interface EasytierConfigUpdate {
 	virtual_ip?: string;
 }
 
+export interface FrpcConfigUpdate {
+	enabled?: boolean;
+	config_mode?: FrpcConfigMode;
+	proxy_name?: string;
+	proxy_type?: FrpProxyType;
+	server_addr?: string;
+	server_port?: number;
+	token?: string;
+	local_ip?: string;
+	local_port?: number;
+	remote_port?: number;
+	custom_domain?: string;
+	secret_key?: string;
+	tls?: boolean;
+	custom_toml?: string;
+}
+
 export type ExtensionStatus = 
 	| { state: "unavailable", data?: undefined }
 	| { state: "stopped", data?: undefined }
@@ -299,6 +349,7 @@ export enum ExtensionId {
 	Ttyd = "ttyd",
 	Gostc = "gostc",
 	Easytier = "easytier",
+	Frpc = "frpc",
 }
 
 export interface ExtensionLogs {
@@ -318,10 +369,17 @@ export interface GostcInfo {
 	config: GostcConfig;
 }
 
+export interface FrpcInfo {
+	available: boolean;
+	status: ExtensionStatus;
+	config: FrpcConfig;
+}
+
 export interface ExtensionsStatus {
 	ttyd: TtydInfo;
 	gostc: GostcInfo;
 	easytier: EasytierInfo;
+	frpc: FrpcInfo;
 }
 
 export interface GostcConfigUpdate {
@@ -597,4 +655,3 @@ export enum CanonicalKey {
 	AltRight = "AltRight",
 	MetaRight = "MetaRight",
 }
-

web/src/views/ConsoleView.vue

@@ -319,6 +319,7 @@ function hidErrorHint(errorCode?: string | null, backend?: string | null, reason
     case 'io_error':
     case 'write_failed':
     case 'read_failed':
+    case 'device_unavailable':
       if (backend === 'otg') return t('hid.errorHints.otgIoError')
       if (backend === 'ch9329') return t('hid.errorHints.ch9329IoError')
       return t('hid.errorHints.ioError')

web/src/views/SettingsView.vue

@@ -43,6 +43,7 @@ import type {
   OtgHidProfile,
   OtgHidFunctions,
 } from '@/types/generated'
+import { FrpProxyType, FrpcConfigMode } from '@/types/generated'
 import { formatFpsLabel, toConfigFps } from '@/lib/fps'
 import { useClipboard } from '@/composables/useClipboard'
 import { getVideoFormatState } from '@/lib/video-format-support'
@@ -218,6 +219,7 @@ function selectSection(id: string) {
 function normalizeSettingsSection(value: unknown): SettingsSectionId | null {
   if (typeof value !== 'string') return null
   if (value === 'access-control') return 'account'
+  if (value === 'ext-frpc') return 'ext-remote-access'
   return isSettingsSectionId(value) ? value : null
 }
 
@@ -315,11 +317,13 @@ const extensionLogs = ref<Record<string, string[]>>({
   ttyd: [],
   gostc: [],
   easytier: [],
+  frpc: [],
 })
 const showLogs = ref<Record<string, boolean>>({
   ttyd: false,
   gostc: false,
   easytier: false,
+  frpc: false,
 })
 
 const showTerminalDialog = ref(false)
@@ -328,6 +332,22 @@ const extConfig = ref({
   ttyd: { enabled: false, shell: '/bin/bash' },
   gostc: { enabled: false, addr: '', key: '', tls: true },
   easytier: { enabled: false, network_name: '', network_secret: '', peer_urls: [] as string[], virtual_ip: '' },
+  frpc: {
+    enabled: false,
+    config_mode: FrpcConfigMode.Quick,
+    proxy_name: '',
+    proxy_type: FrpProxyType.Tcp,
+    server_addr: '',
+    server_port: 7000,
+    token: '',
+    local_ip: '127.0.0.1',
+    local_port: 22,
+    remote_port: undefined as number | undefined,
+    custom_domain: '',
+    secret_key: '',
+    tls: true,
+    custom_toml: '',
+  },
 })
 
 const gostcValidationMessage = computed(() => {
@@ -341,6 +361,25 @@ const easytierValidationMessage = computed(() => {
   return ''
 })
 
+const frpcRemotePortRequired = computed(() => ['tcp', 'udp'].includes(extConfig.value.frpc.proxy_type))
+const showFrpcRemotePort = computed(() => ['tcp', 'udp', 'stcp', 'sudp', 'xtcp'].includes(extConfig.value.frpc.proxy_type))
+const showFrpcCustomDomain = computed(() => ['http', 'https'].includes(extConfig.value.frpc.proxy_type))
+const showFrpcSecretKey = computed(() => ['stcp', 'sudp', 'xtcp'].includes(extConfig.value.frpc.proxy_type))
+const frpcQuickMode = computed(() => extConfig.value.frpc.config_mode === FrpcConfigMode.Quick)
+
+const frpcValidationMessage = computed(() => {
+  if (extConfig.value.frpc.config_mode === FrpcConfigMode.Full) {
+    if (!extConfig.value.frpc.custom_toml?.trim()) return t('extensions.frpc.fullConfigRequired')
+    return ''
+  }
+  if (!extConfig.value.frpc.proxy_name?.trim()) return t('extensions.frpc.proxyNameRequired')
+  if (!extConfig.value.frpc.server_addr?.trim()) return t('extensions.frpc.serverAddrRequired')
+  if (!extConfig.value.frpc.token) return t('extensions.frpc.tokenRequired')
+  if (!extConfig.value.frpc.local_ip?.trim()) return t('extensions.frpc.localIpRequired')
+  if (frpcRemotePortRequired.value && !extConfig.value.frpc.remote_port) return t('extensions.frpc.remotePortRequired')
+  return ''
+})
+
 const rustdeskConfig = ref<RustDeskConfigResponse | null>(null)
 const rustdeskStatus = ref<RustDeskStatusResponse | null>(null)
 const rustdeskPassword = ref<RustDeskPasswordResponse | null>(null)
@@ -1247,10 +1286,10 @@ async function saveConfig() {
         hidUpdate.otg_functions = { ...config.value.hid_otg_functions }
         hidUpdate.otg_keyboard_leds = config.value.hid_otg_keyboard_leds
       }
-      await configStore.updateMsd({
-        enabled: config.value.msd_enabled,
-      })
       await configStore.updateHid(hidUpdate)
+      await configStore.updateMsd({
+        enabled: config.value.hid_backend === 'otg' && config.value.msd_enabled,
+      })
     }
 
     if (activeSection.value === 'msd') {
@@ -1373,6 +1412,23 @@ async function loadExtensions() {
         peer_urls: easytier.peer_urls || [],
         virtual_ip: easytier.virtual_ip || '',
       }
+      const frpc = extensions.value.frpc.config
+      extConfig.value.frpc = {
+        enabled: frpc.enabled,
+        config_mode: frpc.config_mode || FrpcConfigMode.Quick,
+        proxy_name: frpc.proxy_name,
+        proxy_type: frpc.proxy_type,
+        server_addr: frpc.server_addr,
+        server_port: frpc.server_port,
+        token: frpc.token,
+        local_ip: frpc.local_ip,
+        local_port: frpc.local_port,
+        remote_port: frpc.remote_port,
+        custom_domain: frpc.custom_domain || '',
+        secret_key: frpc.secret_key,
+        tls: frpc.tls,
+        custom_toml: frpc.custom_toml || '',
+      }
     }
   } catch {
   } finally {
@@ -1380,8 +1436,11 @@ async function loadExtensions() {
   }
 }
 
-async function startExtension(id: 'ttyd' | 'gostc' | 'easytier') {
-  if ((id === 'gostc' || id === 'easytier') && !validateExtensionConfig(id)) return
+type ExtensionConfigId = 'ttyd' | 'gostc' | 'easytier' | 'frpc'
+type ValidatedExtensionConfigId = Exclude<ExtensionConfigId, 'ttyd'>
+
+async function startExtension(id: ExtensionConfigId) {
+  if (id !== 'ttyd' && !validateExtensionConfig(id)) return
 
   try {
     await extensionsApi.start(id)
@@ -1390,7 +1449,7 @@ async function startExtension(id: 'ttyd' | 'gostc' | 'easytier') {
   }
 }
 
-async function stopExtension(id: 'ttyd' | 'gostc' | 'easytier') {
+async function stopExtension(id: ExtensionConfigId) {
   try {
     await extensionsApi.stop(id)
     await loadExtensions()
@@ -1398,7 +1457,7 @@ async function stopExtension(id: 'ttyd' | 'gostc' | 'easytier') {
   }
 }
 
-async function refreshExtensionLogs(id: 'ttyd' | 'gostc' | 'easytier') {
+async function refreshExtensionLogs(id: ExtensionConfigId) {
   try {
     const result = await extensionsApi.logs(id, 100)
     extensionLogs.value[id] = result.logs
@@ -1406,8 +1465,12 @@ async function refreshExtensionLogs(id: 'ttyd' | 'gostc' | 'easytier') {
   }
 }
 
-async function saveExtensionConfig(id: 'ttyd' | 'gostc' | 'easytier') {
-  if ((id === 'gostc' || id === 'easytier') && extConfig.value[id].enabled && !validateExtensionConfig(id)) return
+async function saveExtensionConfig(id: ExtensionConfigId) {
+  if (id !== 'ttyd') {
+    const shouldValidate = extConfig.value[id].enabled
+      || (id === 'frpc' && extConfig.value.frpc.config_mode === FrpcConfigMode.Full)
+    if (shouldValidate && !validateExtensionConfig(id)) return
+  }
 
   loading.value = true
   try {
@@ -1417,6 +1480,14 @@ async function saveExtensionConfig(id: 'ttyd' | 'gostc' | 'easytier') {
       await extensionsApi.updateGostc(extConfig.value.gostc)
     } else if (id === 'easytier') {
       await extensionsApi.updateEasytier(extConfig.value.easytier)
+    } else if (id === 'frpc') {
+      const frpc = extConfig.value.frpc
+      await extensionsApi.updateFrpc({
+        ...frpc,
+        remote_port: frpcQuickMode.value && showFrpcRemotePort.value ? frpc.remote_port : undefined,
+        custom_domain: frpcQuickMode.value && showFrpcCustomDomain.value ? frpc.custom_domain || undefined : undefined,
+        secret_key: frpcQuickMode.value && showFrpcSecretKey.value ? frpc.secret_key : '',
+      })
     }
     await loadExtensions()
     saved.value = true
@@ -1662,10 +1733,15 @@ function showValidationError(message: string): boolean {
   return false
 }
 
-function validateExtensionConfig(id: 'gostc' | 'easytier'): boolean {
-  const message = id === 'gostc'
-    ? gostcValidationMessage.value
-    : easytierValidationMessage.value
+function validateExtensionConfig(id: ValidatedExtensionConfigId): boolean {
+  let message = ''
+  if (id === 'gostc') {
+    message = gostcValidationMessage.value
+  } else if (id === 'easytier') {
+    message = easytierValidationMessage.value
+  } else {
+    message = frpcValidationMessage.value
+  }
 
   return !message || showValidationError(message)
 }
@@ -3982,6 +4058,183 @@ watch(isWindows, () => {
                 <Loader2 v-if="loading" class="h-4 w-4 mr-2 animate-spin" /><Check v-else-if="saved" class="h-4 w-4 mr-2" /><Save v-else class="h-4 w-4 mr-2" />{{ loading ? t('actionbar.applying') : saved ? t('common.success') : t('common.save') }}
               </Button>
             </div>
+            <!-- FRPC -->
+            <Card>
+              <CardHeader>
+                <div class="flex items-center justify-between gap-4">
+                  <div class="space-y-1.5">
+                    <CardTitle>{{ t('extensions.frpc.title') }}</CardTitle>
+                    <CardDescription>{{ t('extensions.frpc.desc') }}</CardDescription>
+                  </div>
+                  <Badge :variant="extensions?.frpc?.available ? 'default' : 'destructive'">
+                    {{ extensions?.frpc?.available ? t('extensions.available') : t('extensions.unavailable') }}
+                  </Badge>
+                </div>
+              </CardHeader>
+              <CardContent class="space-y-4">
+                <div v-if="!extensions?.frpc?.available" class="text-sm text-muted-foreground bg-muted p-3 rounded-md">
+                  {{ t('extensions.binaryNotFound', { path: isWindows ? 'frpc.exe' : '/usr/bin/frpc' }) }}
+                </div>
+                <template v-else>
+                  <div class="flex items-center justify-between">
+                    <div class="flex items-center gap-2">
+                      <div :class="['w-2 h-2 rounded-full', getExtStatusClass(extensions?.frpc?.status)]" />
+                      <span class="text-sm">{{ getExtStatusText(extensions?.frpc?.status) }}</span>
+                    </div>
+                    <div class="flex gap-2">
+                      <Button
+                        v-if="!isExtRunning(extensions?.frpc?.status)"
+                        size="sm"
+                        @click="startExtension('frpc')"
+                        :disabled="extensionsLoading || !!frpcValidationMessage"
+                      >
+                        <Play class="h-4 w-4 mr-1" />
+                        {{ t('extensions.start') }}
+                      </Button>
+                      <Button
+                        v-else
+                        size="sm"
+                        variant="outline"
+                        @click="stopExtension('frpc')"
+                        :disabled="extensionsLoading"
+                      >
+                        <Square class="h-4 w-4 mr-1" />
+                        {{ t('extensions.stop') }}
+                      </Button>
+                    </div>
+                  </div>
+                  <Separator />
+                  <div class="grid gap-4">
+                    <div class="flex items-center justify-between">
+                      <Label>{{ t('extensions.autoStart') }}</Label>
+                      <Switch v-model="extConfig.frpc.enabled" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                    </div>
+                    <div class="grid grid-cols-2 rounded-md bg-muted p-1">
+                      <button
+                        type="button"
+                        :class="[
+                          'rounded-sm px-3 py-1.5 text-sm font-medium transition-colors disabled:cursor-not-allowed disabled:opacity-50',
+                          frpcQuickMode ? 'bg-background text-foreground shadow-sm' : 'text-muted-foreground hover:text-foreground'
+                        ]"
+                        :disabled="isExtRunning(extensions?.frpc?.status)"
+                        @click="extConfig.frpc.config_mode = FrpcConfigMode.Quick"
+                      >
+                        {{ t('extensions.frpc.quickConfig') }}
+                      </button>
+                      <button
+                        type="button"
+                        :class="[
+                          'rounded-sm px-3 py-1.5 text-sm font-medium transition-colors disabled:cursor-not-allowed disabled:opacity-50',
+                          !frpcQuickMode ? 'bg-background text-foreground shadow-sm' : 'text-muted-foreground hover:text-foreground'
+                        ]"
+                        :disabled="isExtRunning(extensions?.frpc?.status)"
+                        @click="extConfig.frpc.config_mode = FrpcConfigMode.Full"
+                      >
+                        {{ t('extensions.frpc.fullConfig') }}
+                      </button>
+                    </div>
+                    <template v-if="frpcQuickMode">
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.proxyType') }}</Label>
+                        <div class="sm:col-span-3">
+                          <RadioGroup v-model="extConfig.frpc.proxy_type" class="flex flex-wrap gap-4" :disabled="isExtRunning(extensions?.frpc?.status)">
+                            <div v-for="type in ['tcp', 'udp', 'http', 'https', 'stcp', 'sudp', 'xtcp']" :key="type" class="flex items-center space-x-2">
+                              <RadioGroupItem :value="type" :id="`frpc-${type}`" />
+                              <Label :for="`frpc-${type}`" class="cursor-pointer uppercase">{{ type }}</Label>
+                            </div>
+                          </RadioGroup>
+                        </div>
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.proxyName') }}</Label>
+                        <div class="sm:col-span-3 space-y-1">
+                          <Input v-model="extConfig.frpc.proxy_name" :placeholder="t('extensions.frpc.proxyNamePlaceholder')" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                          <p v-if="extConfig.frpc.enabled && !extConfig.frpc.proxy_name?.trim()" class="text-xs text-destructive">{{ t('extensions.frpc.proxyNameRequired') }}</p>
+                        </div>
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.serverAddr') }}</Label>
+                        <div class="sm:col-span-3 space-y-1">
+                          <Input v-model="extConfig.frpc.server_addr" :placeholder="t('extensions.frpc.serverAddrPlaceholder')" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                          <p v-if="extConfig.frpc.enabled && !extConfig.frpc.server_addr?.trim()" class="text-xs text-destructive">{{ t('extensions.frpc.serverAddrRequired') }}</p>
+                        </div>
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.serverPort') }}</Label>
+                        <Input v-model.number="extConfig.frpc.server_port" class="sm:col-span-3" type="number" min="1" max="65535" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.token') }}</Label>
+                        <div class="sm:col-span-3 space-y-1">
+                          <Input v-model="extConfig.frpc.token" type="password" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                          <p v-if="extConfig.frpc.enabled && !extConfig.frpc.token" class="text-xs text-destructive">{{ t('extensions.frpc.tokenRequired') }}</p>
+                        </div>
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.localIp') }}</Label>
+                        <div class="sm:col-span-3 space-y-1">
+                          <Input v-model="extConfig.frpc.local_ip" placeholder="127.0.0.1" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                          <p v-if="extConfig.frpc.enabled && !extConfig.frpc.local_ip?.trim()" class="text-xs text-destructive">{{ t('extensions.frpc.localIpRequired') }}</p>
+                        </div>
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.localPort') }}</Label>
+                        <Input v-model.number="extConfig.frpc.local_port" class="sm:col-span-3" type="number" min="1" max="65535" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                      </div>
+                      <div v-if="showFrpcRemotePort" class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.remotePort') }}</Label>
+                        <div class="sm:col-span-3 space-y-1">
+                          <Input v-model.number="extConfig.frpc.remote_port" type="number" min="1" max="65535" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                          <p v-if="extConfig.frpc.enabled && frpcRemotePortRequired && !extConfig.frpc.remote_port" class="text-xs text-destructive">{{ t('extensions.frpc.remotePortRequired') }}</p>
+                        </div>
+                      </div>
+                      <div v-if="showFrpcCustomDomain" class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.customDomain') }}</Label>
+                        <Input v-model="extConfig.frpc.custom_domain" class="sm:col-span-3" :placeholder="t('extensions.frpc.customDomainPlaceholder')" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                      </div>
+                      <div v-if="showFrpcSecretKey" class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.secretKey') }}</Label>
+                        <Input v-model="extConfig.frpc.secret_key" class="sm:col-span-3" type="password" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                      </div>
+                      <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                        <Label class="sm:text-right">{{ t('extensions.frpc.tls') }}</Label>
+                        <div class="sm:col-span-3">
+                          <Switch v-model="extConfig.frpc.tls" :disabled="isExtRunning(extensions?.frpc?.status)" />
+                        </div>
+                      </div>
+                    </template>
+                    <div v-else class="space-y-1">
+                      <Textarea
+                        v-model="extConfig.frpc.custom_toml"
+                        class="min-h-[300px] font-mono text-xs"
+                        spellcheck="false"
+                        :disabled="isExtRunning(extensions?.frpc?.status)"
+                      />
+                      <p class="text-xs text-muted-foreground">{{ t('extensions.frpc.fullConfigHint') }}</p>
+                      <p v-if="!extConfig.frpc.custom_toml?.trim()" class="text-xs text-destructive">{{ t('extensions.frpc.fullConfigRequired') }}</p>
+                    </div>
+                  </div>
+                  <div class="space-y-2">
+                    <button type="button" @click="showLogs.frpc = !showLogs.frpc; if (showLogs.frpc) refreshExtensionLogs('frpc')" class="flex items-center gap-2 text-sm text-muted-foreground hover:text-foreground">
+                      <ChevronRight :class="['h-4 w-4 transition-transform', showLogs.frpc ? 'rotate-90' : '']" />
+                      {{ t('extensions.viewLogs') }}
+                    </button>
+                    <div v-if="showLogs.frpc" class="space-y-2">
+                      <pre class="p-3 bg-muted rounded-md text-xs max-h-48 overflow-auto font-mono">{{ (extensionLogs.frpc || []).join('\n') || t('extensions.noLogs') }}</pre>
+                      <Button variant="ghost" size="sm" @click="refreshExtensionLogs('frpc')">
+                        <RefreshCw class="h-3 w-3 mr-1" />
+                        {{ t('common.refresh') }}
+                      </Button>
+                    </div>
+                  </div>
+                </template>
+              </CardContent>
+            </Card>
+            <div v-if="extensions?.frpc?.available" class="flex justify-end">
+              <Button :disabled="loading || isExtRunning(extensions?.frpc?.status)" @click="saveExtensionConfig('frpc')">
+                <Loader2 v-if="loading" class="h-4 w-4 mr-2 animate-spin" /><Check v-else-if="saved" class="h-4 w-4 mr-2" /><Save v-else class="h-4 w-4 mr-2" />{{ loading ? t('actionbar.applying') : saved ? t('common.success') : t('common.save') }}
+              </Button>
+            </div>
           </div>
 
           <!-- RTSP Section -->