Fix intel-laptop target

Signed-off-by: Yuri Nesterov <yuriy.nesterov@unikie.com>

Author: nesteroff

modules/common/services/killswitch.nix

@@ -21,103 +21,49 @@ let
     "bluetooth"
   ];
 
-  audioPciDevices =
-    if config.ghaf.common.hardware ? "audio" then config.ghaf.common.hardware.audio else [ ];
-  netPciDevices =
-    if config.ghaf.common.hardware ? "nics" then config.ghaf.common.hardware.nics else [ ];
-  camUsbDevices =
-    if config.ghaf.common.hardware ? "usb" then
-      lib.filter (d: lib.hasPrefix "cam" d.name) config.ghaf.common.hardware.usb
-    else
-      [ ];
-  btUsbDevices =
-    if config.ghaf.common.hardware ? "usb" then
-      lib.filter (d: lib.hasPrefix "bt" d.name) config.ghaf.common.hardware.usb
-    else
-      [ ];
-
   # A function to generate shell commands for PCI devices
   mkPciCommands =
     {
       command,
-      devices,
+      tag,
     }:
-    lib.concatStringsSep "\n" (
-      map (d: ''
-        vhotplugcli pci ${command} \
-          ${lib.optionalString (d.vendorId != null) "--vid ${d.vendorId}"} \
-          ${lib.optionalString (d.productId != null) "--did ${d.productId}"}
-      '') devices
-    );
+    ''
+      vhotplugcli pci ${command} --tag ${tag}
+    '';
 
   # A function to generate shell commands for USB devices
   mkUsbCommands =
     {
       command,
-      devices,
-      actionStr,
+      tag,
     }:
-    lib.concatStringsSep "\n" (
-      map (d: ''
-        echo "${actionStr} device ${d.name} ..."
-        vhotplugcli usb ${command} \
-          ${lib.optionalString (d.vendorId != null) "--vid ${d.vendorId}"} \
-          ${lib.optionalString (d.productId != null) "--pid ${d.productId}"} \
-          ${lib.optionalString (d.hostbus != null) "--bus ${d.hostbus}"} \
-          ${lib.optionalString (d.hostport != null) "--port ${d.hostport}"}
-      '') devices
-    );
+    ''
+      vhotplugcli usb ${command} --tag ${tag}
+    '';
 
   # A function to generate shell code for checking PCI device status
   mkPciStatusCheck =
     {
-      devices,
+      tag,
       blockedVar,
     }:
-    lib.concatStringsSep "\n" (
-      map (d: ''
-        vid="${lib.optionalString (d.vendorId != null) d.vendorId}"
-        did="${lib.optionalString (d.productId != null) d.productId}"
-        if [ -n "$vid" ] && [ -n "$did" ] && echo "$pci_out" | grep -qi "''${vid}:''${did}"; then
-          ${blockedVar}="true"
-        fi
-      '') devices
-    );
+    ''
+      if [ -z "$(vhotplugcli pci list --tag ${tag} --connected | tr -d '[:space:]')" ]; then
+        ${blockedVar}="true"
+      fi
+    '';
 
   # A function to generate shell code for checking USB device status
   mkUsbStatusCheck =
     {
-      devices,
+      tag,
       blockedVar,
     }:
-    lib.concatStringsSep "\n" (
-      map (d: ''
-        vid="${lib.optionalString (d.vendorId != null) d.vendorId}"
-        did="${lib.optionalString (d.productId != null) d.productId}"
-        hbus="${lib.optionalString (d.hostbus != null) d.hostbus}"
-        hport="${lib.optionalString (d.hostport != null) d.hostport}"
-
-        # Normalize to lowercase for case-insensitive matching
-        vid_l=$(echo "$vid" | tr '[:upper:]' '[:lower:]')
-        did_l=$(echo "$did" | tr '[:upper:]' '[:lower:]')
-
-        # Check if vid:pid match (case-insensitive)
-        if [ -n "$vid" ] && [ -n "$did" ]; then
-          if echo "$usb_out" | grep -qi "vid[[:space:]]*:[[:space:]]*$vid_l" \
-            && echo "$usb_out" | grep -qi "pid[[:space:]]*:[[:space:]]*$did_l"; then
-            ${blockedVar}="true"
-          fi
-        fi
-
-        # Check if busnum + portnum match
-        if [ -n "$hbus" ] && [ -n "$hport" ]; then
-          if echo "$usb_out" | grep -q "busnum[[:space:]]*:[[:space:]]*$hbus" \
-            && echo "$usb_out" | grep -q "portnum[[:space:]]*:[[:space:]]*$hport"; then
-            ${blockedVar}="true"
-          fi
-        fi
-      '') devices
-    );
+    ''
+      if [ -z "$(vhotplugcli usb list --tag ${tag} --connected | tr -d '[:space:]')" ]; then
+        ${blockedVar}="true"
+      fi
+    '';
 
   ghaf-killswitch = pkgs.writeShellApplication {
     name = "ghaf-killswitch";
@@ -177,51 +123,31 @@ let
         case "$device" in
           net)
             echo "Blocking net device ..."
-            ${
-              if netPciDevices == [ ] then
-                ''echo "No net devices to block"''
-              else
-                mkPciCommands {
-                  command = "detach";
-                  devices = netPciDevices;
-                }
-            }
+            ${mkPciCommands {
+              command = "detach";
+              tag = "net";
+            }}
             ;;
           mic)
             echo "Blocking mic device ..."
-            ${
-              if audioPciDevices == [ ] then
-                ''echo "No mic devices to block"''
-              else
-                mkPciCommands {
-                  command = "detach";
-                  devices = audioPciDevices;
-                }
-            }
+            ${mkPciCommands {
+              command = "detach";
+              tag = "audio";
+            }}
             ;;
           cam)
-            ${
-              if camUsbDevices == [ ] then
-                ''echo "No cam devices to block"''
-              else
-                mkUsbCommands {
-                  command = "detach";
-                  devices = camUsbDevices;
-                  actionStr = "Blocking";
-                }
-            }
+            echo "Blocking cam device ..."
+            ${mkUsbCommands {
+              command = "detach";
+              tag = "cam";
+            }}
             ;;
           bluetooth)
-            ${
-              if btUsbDevices == [ ] then
-                ''echo "No bluetooth devices to block"''
-              else
-                mkUsbCommands {
-                  command = "detach";
-                  devices = btUsbDevices;
-                  actionStr = "Blocking";
-                }
-            }
+            echo "Blocking bluetooth device ..."
+            ${mkUsbCommands {
+              command = "detach";
+              tag = "bt";
+            }}
             ;;
         esac
       }
@@ -230,90 +156,65 @@ let
         case "$device" in
           net)
             echo "Unblocking net device ..."
-            ${
-              if netPciDevices == [ ] then
-                ''echo "No net devices to unblock"''
-              else
-                mkPciCommands {
-                  command = "attach";
-                  devices = netPciDevices;
-                }
-            }
+            ${mkPciCommands {
+              command = "attach";
+              tag = "net";
+            }}
             ;;
           mic)
             echo "Unblocking mic device ..."
-            ${
-              if audioPciDevices == [ ] then
-                ''echo "No mic devices to unblock"''
-              else
-                mkPciCommands {
-                  command = "attach";
-                  devices = audioPciDevices;
-                }
-            }
+            ${mkPciCommands {
+              command = "attach";
+              tag = "audio";
+            }}
             ;;
           cam)
-            ${
-              if camUsbDevices == [ ] then
-                ''echo "No cam devices to unblock"''
-              else
-                mkUsbCommands {
-                  command = "attach";
-                  devices = camUsbDevices;
-                  actionStr = "Unblocking";
-                }
-            }
+            echo "Unblocking cam device ..."
+            ${mkUsbCommands {
+              command = "attach";
+              tag = "cam";
+            }}
             ;;
           bluetooth)
-            ${
-              if btUsbDevices == [ ] then
-                ''echo "No bluetooth devices to unblock"''
-              else
-                mkUsbCommands {
-                  command = "attach";
-                  devices = btUsbDevices;
-                  actionStr = "Unblocking";
-                }
-            }
+            echo "Unblocking bluetooth device ..."
+            ${mkUsbCommands {
+              command = "attach";
+              tag = "bt";
+            }}
             ;;
         esac
       }
 
       show_status() {
-        pci_out="$(vhotplugcli pci list --short --disconnected)"
 
         # Check for Mic status
         mic_blocked="false"
         ${mkPciStatusCheck {
-          devices = audioPciDevices;
+          tag = "audio";
           blockedVar = "mic_blocked";
         }}
         [ "$mic_blocked" = true ] && echo "mic: blocked" || echo "mic: unblocked"
 
         # Check for Network status
         net_blocked="false"
         ${mkPciStatusCheck {
-          devices = netPciDevices;
+          tag = "net";
           blockedVar = "net_blocked";
         }}
         [ "$net_blocked" = true ] && echo "net: blocked" || echo "net: unblocked"
 
-        # Disable the warning that appears when no USB devices
-        # shellcheck disable=SC2034
-        usb_out="$(vhotplugcli usb list --disconnected)"
-
         # Check for camera status
         cam_blocked="false"
         ${mkUsbStatusCheck {
-          devices = camUsbDevices;
+          tag = "cam";
           blockedVar = "cam_blocked";
         }}
         [ "$cam_blocked" = true ] && echo "cam: blocked" || echo "cam: unblocked"
 
         # Check for bluetooth status
         bt_blocked="false"
         ${mkUsbStatusCheck {
-          devices = btUsbDevices;
+          tag = "bt";
           blockedVar = "bt_blocked";
         }}
         [ "$bt_blocked" = true ] && echo "bluetooth: blocked" || echo "bluetooth: unblocked"

modules/hardware/passthrough/pci-acs-override/pci-acs-override.nix

@@ -7,7 +7,6 @@
 }:
 let
   cfg = config.ghaf.hardware.passthrough.pciAcsOverride;
-  hwDef = config.ghaf.hardware.definition;
   inherit (lib)
     mkEnableOption
     mkOption
@@ -17,15 +16,6 @@ let
 
   # Convert device IDs to kernel parameter format (id:VENDOR:DEVICE)
   idOptions = map (id: "id:${id}") cfg.ids;
-
-  # Get all known PCI device IDs from all *.pciDevices in hardware definition
-  allPciDevices = hwDef.network.pciDevices ++ hwDef.gpu.pciDevices ++ hwDef.audio.pciDevices;
-  devicePciIds = map (dev: "${dev.vendorId}:${dev.productId}") (
-    builtins.filter (dev: dev.vendorId != null && dev.productId != null) allPciDevices
-  );
-
-  # Check which IDs are not in the hardware definition
-  unmatchedIds = builtins.filter (id: !(builtins.elem id devicePciIds)) cfg.ids;
 in
 {
   options.ghaf.hardware.passthrough.pciAcsOverride = {
@@ -54,14 +44,6 @@ in
         assertion = cfg.ids != [ ];
         message = "pciAcsOverride: 'ids' cannot be empty when enabled.";
       }
-      {
-        assertion = unmatchedIds == [ ];
-        message = ''
-          pciAcsOverride: IDs must match devices in hardware definition (*.pciDevices).
-          Unmatched IDs: ${lib.concatStringsSep ", " unmatchedIds}
-          Device PCI IDs: ${lib.concatStringsSep ", " devicePciIds}
-        '';
-      }
     ];
 
     boot.kernelPatches = [

modules/hardware/passthrough/pci-rules.nix

@@ -35,7 +35,6 @@ let
         description = "Auto-detected PCI Devices for GUIVM";
         targetVm = "gui-vm";
         skipOnSuspend = true;
-        pciIommuAddAll = true;
         allow = [
           {
             deviceClass = 3;
@@ -50,6 +49,7 @@ let
       {
         description = "Static PCI Devices for NetVM";
         targetVm = "net-vm";
+        tag = "net";
         allow = map (d: {
           address = d.path;
           deviceId = d.productId;
@@ -63,7 +63,7 @@ let
       {
         description = "Auto-detected PCI Devices for NetVM";
         targetVm = "net-vm";
-        pciIommuSkipIfShared = true;
+        tag = "net";
         allow = [
           {
             deviceClass = 2;
@@ -78,6 +78,7 @@ let
       {
         description = "PCI Devices for AudioVM";
         targetVm = "audio-vm";
+        tag = "audio";
         allow = map (d: {
           address = d.path;
           deviceId = d.productId;
@@ -90,6 +91,7 @@ let
         description = "Auto-detected Devices for AudioVM";
         targetVm = "audio-vm";
         pciIommuAddAll = true;
+        tag = "audio";
         allow = [
           {
             deviceClass = 4;
@@ -117,7 +119,7 @@ let
   busPrefix = config.ghaf.hardware.passthrough.pciPorts.pcieBusPrefix;
   hwDetectModule = vm: [
     {
-      microvm.extraArgsScript = "${lib.getExe' pkgs.vhotplug "vhotplugcli"} vmm args --vm ${vm} --qemu-bus-prefix ${busPrefix}";
+      microvm.extraArgsScript = "${lib.getExe' pkgs.vhotplug "vhotplugcli"} vmm args --vm ${vm} --qemu-bus-prefix ${busPrefix} --qemu-bus-start-index 1";
     }
   ];