tiiuae / ghaf

TII SSRC Secure Technologies: Ghaf Framework
https://tiiuae.github.io/ghaf/
Apache License 2.0
35 stars 56 forks source link

Hardware detection scanner #692

Closed mbssrc closed 1 month ago

mbssrc commented 1 month ago

Description of changes

Adding a (temporary) hardware detection script to generate hardware definition files for different laptop hardware. The script can generate a Ghaf laptop target compatible hardware definition file (details below).

Main changes:

Checklist for things done

Instructions

Generate the hardware-scan package

nix build .#packages.x86_64-linux.hardware-scan
./result/bin/hardware-scan

or run directly with nix run github:tiiuae/ghaf/<commit>#hardware-scan

Generate and run hardware-scan on a laptop

  1. Add your ssh key
  2. Build target nix build .#laptop-hw-scan
  3. Flash dd if=/result/iso/ghaf-... of=/dev/sdX bs=32M status=progress; sync
  4. Boot, then type hardware-scan
  5. The script should ask you if you want to select various devices for passthrough. If selected, the respective entries are generated. Note that there may be errors caused by IOMMU group dependencies.
  6. Move the generated files to your development machine (e.g., scp -r nixos@<your-ip>:~/* local-dir/)
  7. The script should generate a hardware definition profile, as well as a hwinfo/ folder with dumps from udevadm, lspci, etc.
  8. Use the generated .nix as basis for your hardware definition

Few words of caution:

Testing

(Optional) Feel free to run the hardware-scan on various targets and report any findings (Optional) Report any SKU identifiers to be added to the x1 definitions

brianmcgillion commented 1 month ago

the nix fmtproblem is from modules/hardware/laptop.nix. also because there is no file extension on hardware-scan there is a new WARN emitted:

❯ nix fmt
WARN format: no formatter for path: packages/hardware-scan/hardware-scan
nesteroff commented 1 month ago

That's a great script. It should be a lot easier to add new targets now.

I just wanted to mention that in #686, I added a service for hot-plugging that can also dynamically enumerate input devices, find those that are not defined statically and attach them to the GUIVM. Initially, I needed it so that hot-plugged devices survive a system reboot but it turns out that it can also work for non-USB devices. I'm currently testing it but it looks like everything continues to work on my X1 even when guivmVirtioInputHostEvdevModule is commented out.

mbssrc commented 1 month ago

That's a great script. It should be a lot easier to add new targets now.

I just wanted to mention that in #686, I added a service for hot-plugging that can also dynamically enumerate input devices, find those that are not defined statically and attach them to the GUIVM. Initially, I needed it so that hot-plugged devices survive a system reboot but it turns out that it can also work for non-USB devices. I'm currently testing it but it looks like everything continues to work on my X1 even when guivmVirtioInputHostEvdevModule is commented out.

Yes #686 is a good solution - I was actually just testing it now, may comment on it later. Getting rid of the static input device enumeration completely would simplify things a lot. My guess is that we have to keep the evdev module for some of the extra hardware dependencies though...

milva-unikie commented 1 month ago

Tested on Lenovo-X1 nix build github:mbssrc/ghaf/hw-tooling#lenovo-x1-carbon-gen11-debug and nix build github:mbssrc/ghaf/hw-tooling#lenovo-x1-carbon-gen11-debug-installer

Issues found:

I think there is something wrong with camera. With this PR it seems like the camera is not working in any of the vm:s (chromium, element and trusted browser). Restarting chromium did not claim it either.

Some background for camera: There is a known problem on Lenovo-X1 that only one vm can have access to the camera at a time. The vm seems to be chosen randomly at startup between chromium, element and trusted browser. If you restart a vm from host, restarted vm should claim the camera for itself (working at least for the browsers).

Working:

Also tried running hardware scan on X1, no problems found.

mbssrc commented 1 month ago

Tested on Lenovo-X1 nix build github:mbssrc/ghaf/hw-tooling#lenovo-x1-carbon-gen11-debug and nix build github:mbssrc/ghaf/hw-tooling#lenovo-x1-carbon-gen11-debug-installer

Issues found:

I think there is something wrong with camera. With this PR it seems like the camera is not working in any of the vm:s (chromium, element and trusted browser). Restarting chromium did not claim it either.

Some background for camera: There is a known problem on Lenovo-X1 that only one vm can have access to the camera at a time. The vm seems to be chosen randomly at startup between chromium, element and trusted browser. If you restart a vm from host, restarted vm should claim the camera for itself (working at least for the browsers).

Working:

* `udevadm verify` showed no fails

* installer works

* test-automation passes

* integrated microphone and speaker work

* 3,5 mm headset works

* all of the keyboard buttons that were working previously are still working (including F1, F2, F3, F5, F6 and PrtSc)

* touchpad, trackpoint and mouse buttons work

Also tried running hardware scan on X1, no problems found.

Thanks - some part of the USB naming update got lost. Fixed now

milva-unikie commented 1 month ago

Camera is working now on Lenovo-X1!