[3.2rc1] USB Passthrough debugging

[Alex]

Hello everybody,
I'm testing the new USB passthrough functions in Qubes 3.2 rc1, namely
I'm trying to pass a whole Android smartphone to an AppVM (a cube? :).

I can see it in dom0 with qvm-usb, and I tried to pass it with a naïve
command line like:
$ qvm-usb -a work dom0:1-4

Problem is, the operation fails (ERROR: Device attach failed). Adding a
couple lines in qubesutils.py tells me that the call to
vm.run_service('qubes.USBAttach') on line 621 fails with error code 1.

Should I expect the USB passthrough of an Android smartphone to work? If
this is the case, how can I further debug this failure?

--
Alex

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Are you sure you have qubes-usb-proxy package available in both source
and target VM?
If so, take a look at logs in both VMs (`sudo journalctl`) for more
details.

On my system it looks like phone simulate disconnect + connect each time
the driver is unbound from it (which is needed also during USB
passthrough...).
It looks like this:

[root@sys-usb devices]# ls -l /sys/bus/usb/devices/3-1.2/driver
lrwxrwxrwx 1 root root 0 Jul 1 09:48 /sys/bus/usb/devices/3-1.2/driver
-> ../../../../../../../bus/usb/drivers/usb
[root@sys-usb devices]# echo 3-1.2 > /sys/bus/usb/drivers/usb/unbind

Jul 01 09:50:23 sys-usb kernel: usb 3-1.2: USB disconnect, device number
11
Jul 01 09:50:23 sys-usb kernel: usb 3-1.2: new high-speed USB device
number 12 using ehci-pci
(...)

Unfortunately, this makes it incompatible with USB passthrough. Maybe
there is a way to prevent such behaviour? Or prevent attaching "usb"
driver initially, so it will not be necessary to unbind it?

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXdiJHAAoJENuP0xzK19cs74QH/0KEs8qRhiianmqz7N8eWBF3
MMmOjiYLX5PiLk/414q0h8S9oT17eTxW4g8CWr8IsUWguTpvHswRvLkICRkHbs0R
ClkCGZFhPgzth622R9ZUQ35UckIyaVSOnWSww/QMJ3RtzZKXcM5caUeFlOMu31EZ
6W4gzy7E+5XTdEHKwT+HOu8mjoBSzx975BwJdY9gp18E1VYfD2jdWS+If9cZl1Z5
JhMzaOlsCSQ7Lc9mPs1dTbyjoXH/Cz9CHsqeBBresdxx8/qUwKyZQcMBnVtn6nzc
Sw/nc6c02NgqMrQ+X4f7SWgKX/jnPNKBLU9Z/C+oucmFYXGxChpD4yHfihKGa/U=
=7GL6
-----END PGP SIGNATURE-----

[Alex]

On 07/01/2016 09:56 AM, Marek Marczykowski-Górecki wrote:
> Are you sure you have qubes-usb-proxy package available in both
> source and target VM? If so, take a look at logs in both VMs (`sudo
> journalctl`) for more details.

Mmm so should I have qubes-usb-proxy in dom0? It doesn't seem to be a
package available to install... Do I need to have the USB controller in
a usbVM to use passthrough?

In the journal of dom0, when an attempt fails, I find this entry:
dom0 qubes.USB+1-4-work[14779]: /bin/sh: /etc/qubes-rpc/qubes.USB: No
such file or directory

which, as far as I can tell, is not meaningful - that file is created by
qubesutils.py in usb_attach() if it does not exist, and then deleted
afterwards. If I create it manually with the same contents it expects,
the file is not deleted and this line does not appear, so I don't think
this means much.

> On my system it looks like phone simulate disconnect + connect each
> time the driver is unbound from it (which is needed also during USB
> passthrough...). It looks like this:
>
> [root@sys-usb devices]# ls -l /sys/bus/usb/devices/3-1.2/driver
> lrwxrwxrwx 1 root root 0 Jul 1 09:48
> /sys/bus/usb/devices/3-1.2/driver ->
> ../../../../../../../bus/usb/drivers/usb [root@sys-usb devices]# echo
> 3-1.2 > /sys/bus/usb/drivers/usb/unbind
>
> Jul 01 09:50:23 sys-usb kernel: usb 3-1.2: USB disconnect, device
> number 11 Jul 01 09:50:23 sys-usb kernel: usb 3-1.2: new high-speed
> USB device number 12 using ehci-pci (...)
>
> Unfortunately, this makes it incompatible with USB passthrough.
> Maybe there is a way to prevent such behaviour? Or prevent attaching
> "usb" driver initially, so it will not be necessary to unbind it?

I will try anyway, but if you confirm to me that an usbVM is absolutely
necessary for passthrough (i.e.: it does not work from dom0 because
there's no qubes-usb-proxy) I'll first go buy a PCI-USB adapter.

--
Alex

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Jul 01, 2016 at 10:07:48AM +0200, Alex wrote:
> On 07/01/2016 09:56 AM, Marek Marczykowski-Górecki wrote:
> > Are you sure you have qubes-usb-proxy package available in both
> > source and target VM? If so, take a look at logs in both VMs (`sudo
> > journalctl`) for more details.
> Mmm so should I have qubes-usb-proxy in dom0? It doesn't seem to be a
> package available to install... Do I need to have the USB controller in
> a usbVM to use passthrough?

Yes, it is required to have USB VM to use this feature. Which is good
idea anyway.

> In the journal of dom0, when an attempt fails, I find this entry:
> dom0 qubes.USB+1-4-work[14779]: /bin/sh: /etc/qubes-rpc/qubes.USB: No
> such file or directory
>
> which, as far as I can tell, is not meaningful - that file is created by
> qubesutils.py in usb_attach() if it does not exist, and then deleted
> afterwards.

No. This isn't the same file:
/etc/qubes-rpc/qubes.USB+1-4
vs
/etc/qubes-rpc/policy/qubes.USB+1-4

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXdiY0AAoJENuP0xzK19csVNMH/ipqmKYMoUbvoBWf4Jbp97a8
wM6OZK2DE1NVRqMpzRGWJY+JmVoiV7y5VgqsRhEDjjgJsgg/1CCifR7rTLb0waC3
E0zzsq1cygtpdgevgVu6af525r3LJWNshijsMwuZyi0+w81hO2Izoh4B1FDL/K6x
pWVIYGGU+AWYxcsD1q5QQ6o+fhZY4GfCcGsYZdx1kskmyRY+rL9ibX4NVNj4HPfA
EOo61U7kLfI39x0vLUjUSwJvs3XCyezamr9vkb6l7EqVgxOdx3gNNgymGaz41Nta
USeg5aF5cRYaYVSsaFqko+xMl29RL5wYvw14upz1UuhTE6PYZLInqbeuk0P2ZB8=
=yzCC
-----END PGP SIGNATURE-----

[Alex]

On 07/01/2016 10:13 AM, Marek Marczykowski-Górecki wrote:
> On Fri, Jul 01, 2016 at 10:07:48AM +0200, Alex wrote:
>> which, as far as I can tell, is not meaningful - that file is created by
>> qubesutils.py in usb_attach() if it does not exist, and then deleted
>> afterwards.
>
> No. This isn't the same file:
> /etc/qubes-rpc/qubes.USB+1-4
> vs
> /etc/qubes-rpc/policy/qubes.USB+1-4

My bad, so I have been mistaken. Is it necessary for that file to exist?
Should I ignore it?

--
Alex

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

/etc/qubes-rpc/qubes.USB is part of qubes-usb-proxy package, which isn't
available for dom0. Theoretically it could be adjusted to work also in
dom0, but in general we want to get rid as many as possible devices out
of dom0.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXdig6AAoJENuP0xzK19cs7g8H/1uTDqtqCULAdo9ZlG/dIZf9
SMjWQhwQ2ViGNyzlAJxsHUmtGf03TYR9tNwiXymR5Fb7c4C0o+cqBh7Z6WfQW0E6
/dcNw0fL5wncyuKUsG7npYtQ+umrRWiwsR8w1G+lRorZlT3bUd11kgYfrbSeGjSn
1DPH41v7BmrKMr5zxvw7PPVsUM2r0gp1T5XR5sz+of4VrLv+3ZgK2utHUacQibl/
nAFz2TV7IHwl1F8cUya6bG5A2STsd30LdT4nw2N/p1jSI7kjeyEtEBcU0lXhkmpv
HYFRlRUCR/q3IgsPCBfZBjmrscsACe/vtnzhwOutRaodc9YhQemFARg6fDMAhIM=
=763v
-----END PGP SIGNATURE-----

[Alex]

On 07/01/2016 10:22 AM, Marek Marczykowski-Górecki wrote:
> On Fri, Jul 01, 2016 at 10:15:59AM +0200, Alex wrote:
>> On 07/01/2016 10:13 AM, Marek Marczykowski-Górecki wrote:
>>> On Fri, Jul 01, 2016 at 10:07:48AM +0200, Alex wrote:
>>>> which, as far as I can tell, is not meaningful - that file is created by
>>>> qubesutils.py in usb_attach() if it does not exist, and then deleted
>>>> afterwards.
>>>
>>> No. This isn't the same file:
>>> /etc/qubes-rpc/qubes.USB+1-4
>>> vs
>>> /etc/qubes-rpc/policy/qubes.USB+1-4
>> My bad, so I have been mistaken. Is it necessary for that file to exist?
>> Should I ignore it?
>
> /etc/qubes-rpc/qubes.USB is part of qubes-usb-proxy package, which isn't
> available for dom0. Theoretically it could be adjusted to work also in
> dom0, but in general we want to get rid as many as possible devices out
> of dom0.

That makes sense, thank you for your explanation.

Do you think it would be sensible to add a single-phrase warning to
https://www.qubes-os.org/doc/usb/ like "Please note that you cannot pass
through devices from dom0"?

--
Alex

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Yes, added, thanks :)

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXdiq1AAoJENuP0xzK19csexgH/R4PmW6+KB/uVnD1Tl3P7DBf
czBkhy8C4PO4T5fDUil2G8b4wdXysKigdq5AkSyMMxcnnj03MNlcmBvb4RNbHvCU
hD0dPbplP7vQfw1MHesZqpCAtC4Ix82ASnQnARMyiSuXT7MyxerAb5J4qGVUKWTh
Ni0PWgW0AzOcE44EABm9lgDaV0XtGzPoqjWLUTHvX+JXxqtQsBEhoudSmLIb+jIN
c5mJfOP0nzGrvmDKOZMP8W7qSMCPryfa8Mx1dLDcSkhOki608Pf6n5b1eF0bBIno
b0e8F+RixOlnGBjxjdX8GC7FfeeBlTlOjeb/SNaQXL50B5IcckElXvd0r02yGu8=
=E1fO
-----END PGP SIGNATURE-----