1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
| | #!/bin/execlineb -W
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
if {
backtick -D "" mnt {
importas -Siu 1
if { cgroup-setup --no-wait /vm-services.slice/vm-${1}.slice }
nsenter --mount=/run/vm/by-id/${1}/ns/mnt
findmnt -no FSTYPE,SOURCE /run/fs/${1}/disk
}
multisubstitute {
importas -Siu mnt
importas -Siu 1
}
case $mnt {
"^$|^tmpfs fallback$" {
if { udevadm wait /dev/null }
s6-envuidgid fs
s6-applyuidgid -Uzu 0
nsenter --preserve-credentials -S0
--mount=/run/vm/by-id/${1}/ns/mnt
--user=/run/vm/by-id/${1}/ns/user
foreground {
redirfd -w 2 /dev/null
umount -- /run/fs/${1}/disk
}
mount -t tmpfs -o mode=0700 -- fallback /run/fs/${1}/disk
}
}
}
elgetpositionals
s6-ipcserver-socketbinder -B /run/vm/by-id/${1}/vmm
getpid -E vmm_pid
background -d {
ifelse -n { start-vmm $@ }
{ kill $vmm_pid }
if {
if -t {
backtick -E netvm_id {
backtick -E link_path { readlink /run/vm/by-name/sys.netvm }
basename -- $link_path
}
test $1 = $netvm_id
}
assign-devices
}
# Find any net-provider relationships this VM is involved in
cd /run/vm/by-id
elglob -0 providers */config/providers/net/*
forx -pE path { $providers }
backtick -E client_id {
awk -v path=${path} -F / "BEGIN { split(path, p); print p[1] }"
}
backtick -E router_id {
backtick -E router { basename -- $path }
backtick -E link_path { readlink /run/vm/by-name/${router} }
basename -- $link_path
}
# This VM may be either the driver or the client
if -n {
if { test $client_id != $1 }
test $router_id != $1
}
if {
s6-svc -U /run/service/vm-services/instance/${router_id}/data/service/spectrum-router
}
if {
s6-svwait -U /run/service/vmm/instance/${router_id}
}
# Adding the interface is re-entrant and may be called multiple times. Thus, accept failures.
redirfd -w 2 /dev/null
ch-remote --api-socket /run/vm/by-id/${router_id}/vmm add-net id=router,vhost_user=on,socket=/run/vm/by-id/${router_id}/router-driver.sock,mac=02:01:00:00:00:01
}
unexport !
fdmove -c 3 0
redirfd -r 0 /dev/null
s6-softlimit -H -l 18446744073709551615
if { udevadm wait /dev/kvm }
cgroup-setup --leaf --no-wait /vm-services.slice/vm-${1}.slice/vmm
s6-envuidgid vmm-${1}
s6-applyuidgid -Uz
bwrap
--unshare-all
--unshare-user
--dev /dev
--dev-bind /dev/kvm /dev/kvm
--dev-bind /dev/pts /dev/pts
--dev-bind /dev/vfio /dev/vfio
--tmpfs /dev/shm
--tmpfs /tmp
--tmpfs /var/tmp
--ro-bind /etc /etc
--ro-bind /lib /lib
--ro-bind /nix /nix
--ro-bind /usr /usr
--ro-bind /sys /sys
--bind /run /run
--proc /proc
--ro-bind /proc/sys /proc/sys
--tmpfs /proc/fs
--remount-ro /proc/fs
--tmpfs /proc/irq
--remount-ro /proc/irq
--ro-bind /dev/null /proc/kallsyms
--
cloud-hypervisor --api-socket fd=3
|