Using USB device with Windows 7 HVM?

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

I am new to Qubes OS and this group. Attached please find a PDF
outlining how I organized my setup in general. Getting right to the
point, here is what I have done so far:

* setup and using all fedora-23 based qubes / qubes-split-gpg ... all
works fine and as expected

* created Windows 7 HVM template [1]

* created USB qube [2] and verified that USB pass-through works using
the "dev" fedora-23 AppVM. Many of the hardware tools I use have Linux
clients [3][4][5]

My issue:

* other hardware tools I need to use have only Windows clients [6][7][8]

* it is my impression that the qubes-windows-tools do not (yet) support
USB pass-through - is that correct?

* I have also tried to assign the entire USB controller to the Windows
HVM but have failed. I can repeat and provide error messages if that
would be a valid approach.

My next steps:

* install VirtualBox [9] in a dedicated fedora-23 based AppVM

* run Windows 7 as a guest in VirtualBox inside the fedora-23 qube

I know that:

1) USB pass-through into fedora-23 AppVM works
2) I have used a Windows VBox on Linux installs before (non Qubes OS)
3) USB pass-through from Linux to the VBox worked too

So I see no reason other than performance that the above wouldn't work.

The purpose of this email is:

* confirm that qubes-windows-tools do not support USB pass-through and I
have not overlooked anything or made a mistake along the way

* evaluate whether assigning the entire USB controller to the HVM is a
viable solution ... some seem to have had success with that, but I
couldn't find much details on how to do it other than the obvious tab
in the Qubes VM Manager details for the respective qube.

* get feedback regarding my setup in general (attachment) ... does this
make sense?

* get feedback if anyone else is using the Windows VBox in fedora AppVM
approach to enable USB pass-through

Thank you for taking the time to read this. I am looking forward to any
feedback you are willing to share.

/Sven

[1]
https://www.qubes-os.org/doc/windows-appvms/#using-template-based-window
s-appvms-qubes-r2-beta-3-and-later
[2] https://www.qubes-os.org/doc/usb/
[3] https://www.totalphase.com/products/beagle-i2cspi/
[4] https://www.saleae.com/originallogic16
[5]
https://www.microchip.com/Developmenttools/ProductDetails.aspx?PartNO=DV
244005
[6] https://www.k2l.de/products/42/OptoLyzer%C2%AE%20MOCCA%20compact/
[7] https://www.k2l.de/products/15/MediaLB%C2%AE%20Analyzer/
[8] https://www.k2l.de/products/16/INIC%20Explorer/
[9] https://www.virtualbox.org/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZlJn1AAoJENpuFnuPVB+2qj4P/2FIG65UyErGMeX7JlVWh63s
fZBoSMH0hWenEY96UCGNvqYjIoqYPD68NczXjzOypWzW8/1vjbgKkgRPSglb83/N
X4iUU54gCnShiNSMTpqxBRpA/vXA/ynT6uPX2HnytK/4poEgA2w0VH8Xm2PfUVkn
WOUHd5QvoFMMczAQY8yu0eM6klI2SwqWo6kMBmXljfak43Mx/WWRgBuEqdZsOMwY
P1/ei7Yj98o+VONKO5IwQg9O7GcpCJB8EladQhTXA5/xt/VdjUdao+j8vX0Lr1Ld
wT8aD/SSmZuO4DwGV1goUy0eUdsvrwsc9Os0zlUysF4Z28bqyMdseJKNPmYj8Ntj
8skDgCD45BTczURwD63DTtbHC+akOBA1G/T2cIQJOIm2Y1iE3vxWQssZOS8MDJ6F
MM4jmjVqLX5oWQxm5VEw5Noajx/Vg0bFPfxfj1HVXidhf9ntaVBV2lS4TUkgCWQc
ICqwXfjxoj88O94sCFxoZCMrBS3lE+SEXtAJqkRNxeUGfIO+knSy5oaxKUrEQCQh
g6QDc4AaYLYvYvou4hLktWvwTNeeUmzSZGCu5NX3JKuEncVFDBh0KNdjuZGJ9WXG
CuW96jgdYvBSbPVrg30kKR3d1YlLCPm8vSvI4FwknclrrVhSBYL2kcInvBJW3aM0
9vqcQKtJgd/O8HTDCWZR
=dVhj
-----END PGP SIGNATURE-----

[Yethal]

99% one of two things happened.
1. VT-d is not enabled on your machine. In this case go to bios and enable it.
2. USB controller does not support function level reset. In this case use following command: qvm-prefs -s windowsvm pci_strictreset false and reboot your windows vm

[Sven Semmler]

On 08/16/2017 02:53 PM, Yethal wrote:
> 1. VT-d is not enabled on your machine. In this case go to bios and
> enable it.

It isn't. I am running Qubes 3.2 on a DELL Latitude E6410 ... which has
the issue that he Intel Graphics stop working as soon as VT-d is
enabled. At least that was the case for the installer. I will confirm
whether I can enable it after the install, but the HCL comment for the
E6410 doesn't make me optimistic:

> Intel graphics unusable with enabled VT-d

Thank you for pointing this out.

/Sven


[1] https://www.qubes-os.org/hcl/#hardware-laptops

[Yethal]

Issue might be resolved by adding iommu=no-igfx to GRUB config

[Sven Semmler]

On 08/17/2017 12:53 PM, Yethal wrote:
> Issue might be resolved by adding iommu=no-igfx to GRUB config

Thank you very much Yethal!

Yes, it resolved my graphics issues. I am now able to run Qubes with
VT-d enabled. :-)

I am also able to assign the USB controller to the Windows HWM! :-)

That means I can use USB either exclusively in the Windows HWM or via
sys-usb with all the other AppVMs and an external mouse. That's a
compromise I can live with.

Again, thank you. I could have used a second laptop running windows to
capture data, but this is far more convenient.

/Sven