Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hardware definition refactoring #541

Merged
merged 4 commits into from
May 9, 2024
Merged

Hardware definition refactoring #541

merged 4 commits into from
May 9, 2024

Conversation

mbssrc
Copy link
Collaborator

@mbssrc mbssrc commented Apr 3, 2024 •
edited
Loading

Description of changes

This PR introduces

  1. Refactoring of hardware definition:
    • Moving hardware from common into a dedicated flake-module. This implies that hardware definition is no longer part of the VM namespace by default.
    • Re-factoring generation parameter, which is now an option
  2. Moving TPM related code to generic-x86_64 as hardware dependent module
  3. Enabling fingerprint reader in the guivm

Checklist for things done

  • Summary of the proposed changes in the PR description
  • More detailed description in the commit message(s)
  • Commits are squashed into relevant entities - avoid a lot of minimal dev time commits in the PR
  • Contribution guidelines followed
  • Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
  • PR linked to architecture documentation and requirement(s) (ticket id)
  • Test procedure described (or includes tests). Select one or more:
    • Tested on Lenovo X1 x86_64
    • Tested on Jetson Orin NX or AGX aarch64
    • Tested on Polarfire riscv64
  • Author has run nix flake check --accept-flake-config and it passes
  • All automatic Github Action checks pass - see actions
  • Author has added reviewers and removed PR draft status

Testing

Tested by author:

  1. Build + run .#lenovo-x1-carbon-gen11-debug
  2. Builld + run .#vm-debug
  3. Build + run .#generic-x86_64-debug (on x1)
  4. Verified TPM stack running on x1 host
  5. Fingerprint: (more info in commit message)
    • tested enrollment (+multiple fingers)
    • tested verification: sudo, systemd, and swaylock

Test instructions:

  1. Normal build + run on all x86-based targets with functionality test
  2. TPM: Verify that abrmd service runs on host
  3. Fingerprint:
    • In terminal, use fprintd-enroll to enroll fingerprint. Run a sudo command and systemctl restart systemd-timesyncd.service, authenticate with fingerprint. In-depth testing not required at this point, as features are missing (see commit message). Expected outcome: fingerprint enrollment works, sudo and systemctl (system) commands can be authenticated with fingerprint
    • To test swaylock, enable config.ghaf.graphics.labwc.lock.enable and build, enroll fingerprint, then run swaylock (e.g., run in terminal), press Enter and use fingerprint reader to authenticate. Expected outcome: fingerprint authentication unlocks swaylock

@mbssrc mbssrc temporarily deployed to internal-build-workflow April 3, 2024 19:25 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 3, 2024 19:29 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 17:27 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 17:28 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 17:32 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 17:40 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 17:42 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 18:09 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 18:34 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 4, 2024 18:46 — with GitHub Actions Inactive
@mbssrc mbssrc marked this pull request as ready for review April 5, 2024 09:21
@Mic92
Copy link
Collaborator

Mic92 commented Apr 8, 2024

General approach taken here, looks good to me.

@mikatammi
Copy link
Contributor

This is now in conflict, please rebase

@mbssrc mbssrc temporarily deployed to internal-build-workflow April 29, 2024 11:06 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 29, 2024 11:09 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 29, 2024 11:14 — with GitHub Actions Inactive
@mbssrc mbssrc temporarily deployed to internal-build-workflow April 29, 2024 11:20 — with GitHub Actions Inactive
@mbssrc mbssrc requested a review from Mic92 April 29, 2024 11:32
@mbssrc mbssrc added the Needs Testing CI Team to pre-verify label Apr 30, 2024
@mbssrc mbssrc temporarily deployed to internal-build-workflow May 1, 2024 12:11 — with GitHub Actions Inactive
mbssrc added 4 commits May 1, 2024 16:19
@mbssrc
Hardware re-factoring:
fb62e84 
- moved hardware from common to a flake-module
- re-factored 'generation' as parameter to hardware definition
- quick fixed network device required in desktop stack (hw definition not available in vm namespaces)
- fix references to modules/common/hardware

Signed-off-by: Manuel Bluhm <manuel@ssrc.tii.ae>
@mbssrc
Move TPM related code to hardware x86_64-generic as hardware dependen…
b72e9bc 
…t module.

Signed-off-by: Manuel Bluhm <manuel@ssrc.tii.ae>
@mbssrc
Add fingerprint functionality to guivm
2d2b250 
- module with qemu rules, required packages and services, and polkit/pam configs; conditionally applied to guivmExtraModules
- allows ghaf user to enroll and verify fingerprints
- works with swaylock, sudo, systemctl (note: swaylock needs to be enabled)
- swaylock works with password w/o fingerprint, when fp is enrolled it allows either password or fp. To use fp auth, press Enter and then do fp auth

Further work required:
- persistent fingerprint data storage required
- proper integration with login manager (when ready)
- potential enrollment application
- swaylock bugs have been observed (some even w/o fingerprint)

Signed-off-by: Manuel Bluhm <manuel@ssrc.tii.ae>
@mbssrc
Minor fixes addressing comments
4d8e632 
Signed-off-by: Manuel Bluhm <manuel@ssrc.tii.ae>
@mbssrc mbssrc temporarily deployed to internal-build-workflow May 1, 2024 12:28 — with GitHub Actions Inactive
@barnabakos barnabakos added Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon and removed Needs Testing CI Team to pre-verify labels May 2, 2024
@barnabakos
Copy link
Collaborator

ci-test-automation passed;
apps launch;
missing fingerprint testing instructions, though it works;
missing tpm testing instructions

barnabakos
barnabakos approved these changes May 8, 2024
View reviewed changes
Copy link
Collaborator

@barnabakos barnabakos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated test instructions look good enough

mikatammi
mikatammi approved these changes May 8, 2024
View reviewed changes
Copy link
Contributor

@mikatammi mikatammi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test sets also run nicely 👍

@mikatammi mikatammi added Tested on NUC This PR has been tested on Intel NUC Tested on RISC-V This PR has been tested on RISC-V - Microchip Polarfire Icicle-kit board labels May 8, 2024
@brianmcgillion brianmcgillion merged commit 48eab62 into tiiuae:main May 9, 2024
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikatammi mikatammi mikatammi approved these changes

@brianmcgillion brianmcgillion brianmcgillion approved these changes

@barnabakos barnabakos barnabakos approved these changes

@Mic92 Mic92 Awaiting requested review from Mic92

Assignees
No one assigned
Labels
Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon Tested on NUC This PR has been tested on Intel NUC Tested on RISC-V This PR has been tested on RISC-V - Microchip Polarfire Icicle-kit board
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@mbssrc @Mic92 @mikatammi @barnabakos @brianmcgillion