#!/bin/execlineb -W
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>

if {
  backtick -D "" mnt {
    importas -Siu 1
    if { cgroup-setup --no-wait /vm-services.slice/vm-${1}.slice }
    nsenter --mount=/run/vm/by-id/${1}/ns/mnt
    findmnt -no FSTYPE,SOURCE /run/fs/${1}/disk
  }

  multisubstitute {
    importas -Siu mnt
    importas -Siu 1
  }

  case $mnt {
    "^$|^tmpfs fallback$" {
      if { udevadm wait /dev/null }
      s6-envuidgid fs
      s6-applyuidgid -Uzu 0
      nsenter --preserve-credentials -S0
        --mount=/run/vm/by-id/${1}/ns/mnt
        --user=/run/vm/by-id/${1}/ns/user
      foreground {
        redirfd -w 2 /dev/null
        umount -- /run/fs/${1}/disk
      }
      mount -t tmpfs -o mode=0700 -- fallback /run/fs/${1}/disk
    }
  }
}

elgetpositionals

if { rm -f /run/vsock/${1}/vsock }

s6-ipcserver-socketbinder -B /run/vm/by-id/${1}/vmm

getpid -E vmm_pid
background -d {
  ifelse -n { start-vmm $@ }
  { kill $vmm_pid }

  if {
    if -t {
      backtick -E netvm_id {
        backtick -E link_path { readlink /run/vm/by-name/sys.netvm }
        basename -- $link_path
      }
      test $1 = $netvm_id
    }
    assign-devices
  }

  # Find any net-provider relationships this VM is involved in
  cd /run/vm/by-id
  elglob -0 providers */config/providers/net/*
  forx -pE path { $providers }
  backtick -E client_id {
   awk -v path=${path} -F / "BEGIN { split(path, p); print p[1] }"
  }
  backtick -E router_id {
    backtick -E router { basename -- $path }
    backtick -E link_path { readlink /run/vm/by-name/${router} }
    basename -- $link_path
  }
  # This VM may be either the driver or the client
  if -n {
    if { test $client_id != $1 }
    test $router_id != $1
  }

  if {
    s6-svc -U /run/service/vm-services/instance/${router_id}/data/service/spectrum-router
  }
  if {
    s6-svwait -U /run/service/vmm/instance/${router_id}
  }
  # Adding the interface is re-entrant and may be called multiple times. Thus, accept failures.
  redirfd -w 2 /dev/null
  ch-remote --api-socket /run/vm/by-id/${router_id}/vmm add-net id=router,vhost_user=on,socket=/run/vm/by-id/${router_id}/router-driver.sock,mac=02:01:00:00:00:01
}
unexport !
fdmove -c 3 0
redirfd -r 0 /dev/null

s6-softlimit -H -l 18446744073709551615
if { udevadm wait /dev/kvm }

cgroup-setup --leaf /vm-services.slice/vm-${1}.slice/vmm
s6-envuidgid vmm-${1}
s6-applyuidgid -Uz
bwrap
  --unshare-all
  --unshare-user
  --dev /dev
  --dev-bind /dev/kvm /dev/kvm
  --dev-bind /dev/pts /dev/pts
  --dev-bind /dev/vfio /dev/vfio
  --tmpfs /dev/shm
  --tmpfs /tmp
  --tmpfs /var/tmp
  --ro-bind /etc /etc
  --ro-bind /lib /lib
  --ro-bind /nix /nix
  --ro-bind /usr /usr
  --ro-bind /sys /sys
  --bind /run /run
  --proc /proc
  --ro-bind /proc/sys /proc/sys
  --tmpfs /proc/fs
  --remount-ro /proc/fs
  --tmpfs /proc/irq
  --remount-ro /proc/irq
  --ro-bind /dev/null /proc/kallsyms
  --

cloud-hypervisor --api-socket fd=3