Description of Changes

• Adds a CLI tool to manage USB device passthrough.
• Updates USB configuration to handle static USB devices via vhotplug.
• Adds services to gracefully suspend and resume USB devices.
• Makes the killswitch for USB devices persistent.

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Related Issues / Tickets

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

Persistent Killswitch for USB Devices:

• Execute ghaf-killswitch block cam and ensure the integrated camera is detached from business-vm.
• Reboot and verify that it is still detached.
• Re-enable it by executing ghaf-killswitch unblock cam.

CLI Tool for USB Management:

• Execute vhotplugcli usb list to get a list of connected devices along with their properties. The CLI tool can be run either on the host or in gui-vm.
• Detach a USB device using one of the following commands:

vhotplugcli usb detach --vid 8087 --pid 0033
vhotplugcli usb detach --bus 3 --port 10
vhotplugcli usb detach --devnode /dev/bus/usb/003/005

• Use similar commands like vhotplugcli usb attach to reattach devices to VMs.
• For devices allowed to connect to multiple VMs, specify --vm business-vm in the attach command. Currently, external webcams can be connected to both chrome-vm and business-vm.

Graceful USB Suspend/Resume:

• During suspend, all USB devices are disconnected from VMs, which should be visible in the vhotplug logs. They should reconnect on resume and function normally.
• This may resolve issues related to USB devices being in use during suspend (e.g., SSRCSP-6721).