Howto: Enable WWAN (LTE Sierra EM7345) in Qubes OS (Howto install ModemManager in Qubes)

[piitb...@gmail.com]

In order to switch to Qubes OS as primary OS I need to get my WWAN Card running as I need to be able to connect to my corporate virtual desktop.

The WWAN card is a LTE Sierra EM7345 which works out of the box when running a Linux Desktop OS.
Unfortunately I don't see an option to enable WWAN in the NetworkManager Applet (v1.0.10) within Qubes OS.

Two places to start:

• Mobile broadband card not recognized by NetworkManager in Fedora 22
  https://ask.fedoraproject.org/en/question/70765/mobile-broadband-card-not-recognized-by-networkmanager-in-fedora-22/
  

• No more broadband after Fedora 22 fresh installbroadbandfedora22
  https://ask.fedoraproject.org/en/question/69412/no-more-broadband-after-fedora-22-fresh-install/?answer=69676#post-id-69676
  

The card is listed via lsusb:

[pr@dom0 ~]$ lsusb

Bus 003 Device 002: ID 8087:8000 Intel Corp.
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 005: ID 0765:5010 X-Rite, Inc.
Bus 001 Device 004: ID 04f2:b39a Chicony Electronics Co., Ltd
Bus 001 Device 003: ID 8087:07dc Intel Corp.
Bus 001 Device 015: ID 1199:a001 Sierra Wireless, Inc.
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

and I have also found information via dmesg:

[pr@dom0 ~]$  dmesg | grep -i cdc

[   23.447323] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[   23.448273] usbcore: registered new interface driver cdc_acm
[   23.448278] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[   23.449052] usbcore: registered new interface driver cdc_ncm
[   23.450577] usbcore: registered new interface driver cdc_wdm
[   23.474909] cdc_mbim 1-10:1.0: setting rx_max = 16384
[   23.475375] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[   23.475538] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 0a:5f:ca:8d:ff:6d
[   23.475568] usbcore: registered new interface driver cdc_mbim
[   23.493585] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[ 1633.400218] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[ 1649.140234] cdc_mbim 1-10:1.0: setting rx_max = 16384
[ 1649.140848] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[ 1649.141460] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 0a:5f:ca:8d:ff:6d
[ 1649.142892] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[ 1649.245869] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[ 2201.130848] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[ 2201.605340] cdc_mbim 1-10:1.0: setting rx_max = 16384
[ 2201.605794] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[ 2201.605969] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 0a:5f:ca:8d:ff:6d
[ 2201.606986] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[ 2201.637417] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[ 3652.810576] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[ 3665.214809] cdc_mbim 1-10:1.0: setting rx_max = 16384
[ 3665.215297] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[ 3665.215450] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 0a:5f:ca:8d:ff:6d
[ 3665.216253] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[ 3665.256472] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[47563.959697] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[47564.427561] cdc_mbim 1-10:1.0: setting rx_max = 16384
[47564.428016] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[47564.428191] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 0a:5f:ca:8d:ff:6d
[47564.429156] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[47564.463699] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[48323.840902] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[48324.307287] cdc_mbim 1-10:1.0: setting rx_max = 16384
[48324.307934] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[48324.308397] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 0a:5f:ca:8d:ff:6d
[48324.309851] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[48324.408488] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[51616.379179] usbcore: deregistering interface driver cdc_mbim
[51616.379227] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[51616.414567] usbcore: deregistering interface driver cdc_ncm
[51616.453756] usbcore: deregistering interface driver cdc_wdm
[51629.929470] usbcore: registered new interface driver cdc_wdm
[51634.310225] usbcore: registered new interface driver cdc_ncm
[51641.176562] cdc_mbim 1-10:1.0: setting rx_max = 16384
[51641.177544] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[51641.177749] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 36:1c:08:a6:52:81
[51641.177773] usbcore: registered new interface driver cdc_mbim
[51641.190233] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0
[52690.171631] cdc_mbim 1-10:1.0 wwp0s20u10: unregister 'cdc_mbim' usb-0000:00:14.0-10, CDC MBIM
[52690.647032] cdc_mbim 1-10:1.0: setting rx_max = 16384
[52690.647652] cdc_mbim 1-10:1.0: cdc-wdm0: USB WDM device
[52690.648124] cdc_mbim 1-10:1.0 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-10, CDC MBIM, 36:1c:08:a6:52:81
[52690.649630] cdc_acm 1-10:1.2: ttyACM0: USB ACM device
[52690.715952] cdc_mbim 1-10:1.0 wwp0s20u10: renamed from wwan0

From what I understood so far it seems that the WWAN card is recognized from the system

[pr@dom0 ~]$ lsmod | grep cdc

cdc_mbim               16384  0
cdc_ncm                32768  1 cdc_mbim
usbnet                 45056  2 cdc_mbim,cdc_ncm
cdc_wdm                20480  1 cdc_mbim
cdc_acm                36864  0

From the above links it seems that enabling ModemManager could do the trick.

While there is a package available for Fedora 23, my question is how and where do I need to install it?

ModemManager-1.4.10-2.fc23 RPM for i686

"The ModemManager service manages WWAN modems and provides a consistent API for interacting with these devices to client applications."

https://www.rpmfind.net/linux/RPM/fedora/23/x86_64/m/ModemManager-1.4.10-2.fc23.i686.html

Do I need to install it in sys-net / dom0 oder do I need to setup an USB-VM?

I would like to manage my WWAN Card the same way I'm currently managing LAN and Wifi (via the Network Manager Applet).

- Piit

[Jeremy Rand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 03/19/2016 10:10 AM, piitb...@gmail.com wrote:
> In order to switch to Qubes OS as primary OS I need to get my WWAN
> Card running as I need to be able to connect to my corporate
> virtual desktop.
>
> The WWAN card is a LTE Sierra EM7345 which works out of the box
> when running a Linux Desktop OS. Unfortunately I don't see an
> option to enable WWAN in the NetworkManager Applet (v1.0.10) within
> Qubes OS.
>
> Two places to start:
>

> * *Mobile broadband card not recognized by NetworkManager in Fedora
> 22*
> https://ask.fedoraproject.org/en/question/70765/mobile-broadband-card-
not-recognized-by-networkmanager-in-fedora-22/*
>
>
*
>
> * *No more broadband after Fedora 22 fresh
> installbroadbandfedora22*
> https://ask.fedoraproject.org/en/question/69412/no-more-broadband-afte

r-fedora-22-fresh-install/?answer=69676#post-id-69676
>
>
>
> The card is listed via lsusb:
>
>
> | [pr@dom0 ~]$ lsusb
>
> Bus003Device002:ID 8087:8000IntelCorp. Bus003Device001:ID
> 1d6b:0002LinuxFoundation2.0root hub Bus002Device001:ID
> 1d6b:0003LinuxFoundation3.0root hub Bus001Device005:ID
> 0765:5010X-Rite,Inc. Bus001Device004:ID 04f2:b39a
> ChiconyElectronicsCo.,Ltd Bus001Device003:ID 8087:07dcIntelCorp.
> Bus001Device015:ID 1199:a001 SierraWireless,Inc. Bus001Device001:ID

> 1d6b:0002LinuxFoundation2.0root hub |

>
>
> and I have also found information via dmesg:
>
>
> | [pr@dom0 ~]$ dmesg |grep -i cdc
>
> [ 23.447323]cdc_acm 1-10:1.2:ttyACM0:USB ACM device [
> 23.448273]usbcore:registered newinterfacedriver cdc_acm [
> 23.448278]cdc_acm:USB AbstractControlModeldriver forUSB modems
> andISDN adapters [ 23.449052]usbcore:registered newinterfacedriver

> cdc_ncm [ 23.450577]usbcore:registered newinterfacedriver cdc_wdm

> [ 23.474909]cdc_mbim 1-10:1.0:setting rx_max =16384 [
> 23.475375]cdc_mbim 1-10:1.0:cdc-wdm0:USB WDM device [

> 23.475538]cdc_mbim 1-10:1.0wwan0:register'cdc_mbim'at
> usb-0000:00:14.0-10,CDC MBIM,0a:5f:ca:8d:ff:6d [

> 23.475568]usbcore:registered newinterfacedriver cdc_mbim [
> 23.493585]cdc_mbim 1-10:1.0wwp0s20u10:renamed fromwwan0
> [1633.400218]cdc_mbim 1-10:1.0wwp0s20u10:unregister

> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM [1649.140234]cdc_mbim
> 1-10:1.0:setting rx_max =16384 [1649.140848]cdc_mbim

> 1-10:1.0:cdc-wdm0:USB WDM device [1649.141460]cdc_mbim

> 1-10:1.0wwan0:register'cdc_mbim'at usb-0000:00:14.0-10,CDC
> MBIM,0a:5f:ca:8d:ff:6d [1649.142892]cdc_acm 1-10:1.2:ttyACM0:USB

> ACM device [1649.245869]cdc_mbim 1-10:1.0wwp0s20u10:renamed
> fromwwan0 [2201.130848]cdc_mbim 1-10:1.0wwp0s20u10:unregister

> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM [2201.605340]cdc_mbim
> 1-10:1.0:setting rx_max =16384 [2201.605794]cdc_mbim

> 1-10:1.0:cdc-wdm0:USB WDM device [2201.605969]cdc_mbim

> 1-10:1.0wwan0:register'cdc_mbim'at usb-0000:00:14.0-10,CDC
> MBIM,0a:5f:ca:8d:ff:6d [2201.606986]cdc_acm 1-10:1.2:ttyACM0:USB

> ACM device [2201.637417]cdc_mbim 1-10:1.0wwp0s20u10:renamed
> fromwwan0 [3652.810576]cdc_mbim 1-10:1.0wwp0s20u10:unregister

> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM [3665.214809]cdc_mbim
> 1-10:1.0:setting rx_max =16384 [3665.215297]cdc_mbim

> 1-10:1.0:cdc-wdm0:USB WDM device [3665.215450]cdc_mbim

> 1-10:1.0wwan0:register'cdc_mbim'at usb-0000:00:14.0-10,CDC
> MBIM,0a:5f:ca:8d:ff:6d [3665.216253]cdc_acm 1-10:1.2:ttyACM0:USB

> ACM device [3665.256472]cdc_mbim 1-10:1.0wwp0s20u10:renamed
> fromwwan0 [47563.959697]cdc_mbim 1-10:1.0wwp0s20u10:unregister

> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM [47564.427561]cdc_mbim
> 1-10:1.0:setting rx_max =16384 [47564.428016]cdc_mbim

> 1-10:1.0:cdc-wdm0:USB WDM device [47564.428191]cdc_mbim

> 1-10:1.0wwan0:register'cdc_mbim'at usb-0000:00:14.0-10,CDC
> MBIM,0a:5f:ca:8d:ff:6d [47564.429156]cdc_acm 1-10:1.2:ttyACM0:USB

> ACM device [47564.463699]cdc_mbim 1-10:1.0wwp0s20u10:renamed
> fromwwan0 [48323.840902]cdc_mbim 1-10:1.0wwp0s20u10:unregister

> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM [48324.307287]cdc_mbim
> 1-10:1.0:setting rx_max =16384 [48324.307934]cdc_mbim

> 1-10:1.0:cdc-wdm0:USB WDM device [48324.308397]cdc_mbim

> 1-10:1.0wwan0:register'cdc_mbim'at usb-0000:00:14.0-10,CDC
> MBIM,0a:5f:ca:8d:ff:6d [48324.309851]cdc_acm 1-10:1.2:ttyACM0:USB

> ACM device [48324.408488]cdc_mbim 1-10:1.0wwp0s20u10:renamed
> fromwwan0 [51616.379179]usbcore:deregistering interfacedriver
> cdc_mbim [51616.379227]cdc_mbim 1-10:1.0wwp0s20u10:unregister
> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM
> [51616.414567]usbcore:deregistering interfacedriver cdc_ncm
> [51616.453756]usbcore:deregistering interfacedriver cdc_wdm
> [51629.929470]usbcore:registered newinterfacedriver cdc_wdm

> [51634.310225]usbcore:registered newinterfacedriver cdc_ncm

> [51641.176562]cdc_mbim 1-10:1.0:setting rx_max =16384
> [51641.177544]cdc_mbim 1-10:1.0:cdc-wdm0:USB WDM device

> [51641.177749]cdc_mbim 1-10:1.0wwan0:register'cdc_mbim'at
> usb-0000:00:14.0-10,CDC MBIM,36:1c:08:a6:52:81

> [51641.177773]usbcore:registered newinterfacedriver cdc_mbim
> [51641.190233]cdc_mbim 1-10:1.0wwp0s20u10:renamed fromwwan0
> [52690.171631]cdc_mbim 1-10:1.0wwp0s20u10:unregister

> 'cdc_mbim'usb-0000:00:14.0-10,CDC MBIM [52690.647032]cdc_mbim
> 1-10:1.0:setting rx_max =16384 [52690.647652]cdc_mbim

> 1-10:1.0:cdc-wdm0:USB WDM device [52690.648124]cdc_mbim

> 1-10:1.0wwan0:register'cdc_mbim'at usb-0000:00:14.0-10,CDC
> MBIM,36:1c:08:a6:52:81 [52690.649630]cdc_acm 1-10:1.2:ttyACM0:USB

> ACM device [52690.715952]cdc_mbim 1-10:1.0wwp0s20u10:renamed
> fromwwan0 |
>
>
> From what I understood so far it seems that the WWAN card is
> recognized from the system
>
>
> | [pr@dom0 ~]$ lsmod |grep cdc
>
> cdc_mbim 16384 0 cdc_ncm 32768
> 1cdc_mbim usbnet 45056 2cdc_mbim,cdc_ncm cdc_wdm

> 20480 1cdc_mbim cdc_acm 36864 0 |

>
>
> From the above links it seems that enabling ModemManager could do
> the trick.
>
> While there is a package available for Fedora 23, my question is
> how and where do I need to install it?
>
>

> *ModemManager-1.4.10-2.fc23 RPM for i686*

>
> "The ModemManager service manages WWAN modems and provides a
> consistent API for interacting with these devices to client
> applications."
>
> https://www.rpmfind.net/linux/RPM/fedora/23/x86_64/m/ModemManager-1.4.
10-2.fc23.i686.html
>
>
>
> Do I need to install it in sys-net / dom0 oder do I need to setup
> an USB-VM?
>
> I would like to manage my WWAN Card the same way I'm currently
> managing LAN and Wifi (via the Network Manager Applet).
>
> - Piit

It looks to me that the problem is that your WWAN card is connected to
your computer via a USB controller, and that USB controller is
connected to dom0 (because you don't have a USB VM), while
NetworkManager is running in your Net VM. As a result, NetworkManager
doesn't see the WWAN card.

You have two options that I can think of.

One is to assign the PCI device that is your USB controller, to your
Net VM. (I'm pretty sure the Qubes documentation explains how to
assign PCI devices.) The benefit of this approach is that you can use
the same NetworkManager instance to manage your WWAN card as you use
to manage Ethernet and WiFi. The downside is that it means that any
adversary who compromises your NetVM (e.g. by attacking a WiFi driver)
will have access to your USB controller (and whatever devices are
inserted into it). It also means that any other USB devices that
you've inserted into that USB controller will only be accessible from
the Net VM.

Another option is to create a USB VM, and then enable NetworkManager
in it. I'm 90% certain that either Marek or Joanna said this is
possible as of 3.1, but I can't remember where I read that, so
hopefully I'm not misremembering. Assuming that I'm remembering
correctly, this will give you somewhat better isolation (someone who
compromises your WiFi won't be able to attack your USB devices), and
also you'll be able to use USB devices as you would with a standard
USB VM. The downside is that this effectively means you would have to
switch your Firewall VM's upstream VM between your regular Net VM and
your USB VM when you want to switch between Ethernet/WiFi and WWAN,
which might be a bother depending on how often you do this.

It's possible that I'm wrong on some details, but if so, presumably
someone will jump in to correct me.

Cheers,
- -Jeremy Rand
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW7lQDAAoJEAHN/EbZ1y06iHsQAKbeAVj2a3vMSK1CPamYYiV6
uUCHfsikEGM3wYKmk9NRlxv1foioJxIsGp0Qk5Pj/NEw+gom+cglWddvbAmlZyrd
AkEs+Y4rZgka/MPlTQYbyQP/yluNJmGbFyQ9LkDK/g70F36voJlSNQsQGEx/TNEK
MdXge5hRsPG7m7roRGulPDSHq2hcnzAxAUHVH8WOwx55y78KerpGkSW6Pg3RNrc4
YVeJ4/ykpx+5rPxzkN5wZSTpHpGncYHLwGh8jfflrMcm4UBRkLX4DZSwRDKuUzsQ
vq96wQpWId5dt+aFmZXiRfj+OtSgKnd7Vlfsu0iGcg9D+5bRzPlSf5758tvndnH3
B0V69L3/b6NL1yR2np5/zrqdM/SnoDUF8FRLFXBFn2g/y4bSMi6S25D6gWDktA3y
+UGP72b8DDoIRQtVYmOxlOLLYCFW8OdpNlFevOT1dK9BBu+ddbn+sGV3ChpXOhDT
F4PZEx6ykGj0kd+ZLC8PzrET4JChfk6YY+JslIv1YVllh0Ot68En1rDckR8ZYO42
rSD5giJNpvfA/XLYymn+joa4POgwnIAYp2DuaTid9psqkeT4zdBeSKLO1tgfREUM
CF1cJLCvOZQBL7NZux98QX0+oWWp7IxTQ6vAbeBhAxn8kFCV2jlQEVOn7+q3Ye1D
d0bZpqE/VvZRY2L5+lWR
=wj7a
-----END PGP SIGNATURE-----

[piitb...@gmail.com]

Hello Jeremy

Am Sonntag, 20. März 2016 08:42:53 UTC+1 schrieb Jeremy Rand:

(...)

It looks to me that the problem is that your WWAN card is connected to
your computer via a USB controller, and that USB controller is
connected to dom0 (because you don't have a USB VM), while
NetworkManager is running in your Net VM.  As a result, NetworkManager
doesn't see the WWAN card.

(...)

As the WWAN Card was not listed under lspci, i expected that it is presented as USB device to the system, but I wasn't sure.
From which information did you know that the LTE Card is really attached as USB device?
 

You have two options that I can think of.

Option I - Assign PCI-device (USB Controller) to NetVM
 

One is to assign the PCI device that is your USB controller, to your
Net VM.  (I'm pretty sure the Qubes documentation explains how to
assign PCI devices.)  The benefit of this approach is that you can use
the same NetworkManager instance to manage your WWAN card as you use
to manage Ethernet and WiFi.  The downside is that it means that any
adversary who compromises your NetVM (e.g. by attacking a WiFi driver)
will have access to your USB controller (and whatever devices are
inserted into it).  It also means that any other USB devices that
you've inserted into that USB controller will only be accessible from
the Net VM.

 
Option II - Create USB-VM and enable NetworkManager in it

Another option is to create a USB VM, and then enable NetworkManager
in it.  I'm 90% certain that either Marek or Joanna said this is
possible as of 3.1, but I can't remember where I read that, so
hopefully I'm not misremembering.  Assuming that I'm remembering
correctly, this will give you somewhat better isolation (someone who
compromises your WiFi won't be able to attack your USB devices), and
also you'll be able to use USB devices as you would with a standard
USB VM.  The downside is that this effectively means you would have to
switch your Firewall VM's upstream VM between your regular Net VM and
your USB VM when you want to switch between Ethernet/WiFi and WWAN,
which might be a bother depending on how often you do this. 

Thank you for the two options, currently I have some difficulties to decide which way is the best.
As far as I know I have more than one USB Controller in my Laptop. I have two USB ports on the left and two on the right side.
How can I find which devices are conected to which USB controller?

From a usability-perspective I think the best way is to manage all Network related task from one management instance (NetVM).
As such I think Option 1 (attach the USB Controller to the NetVM) seems to be easier
If I know if (and which) other USB-devices/ports are also connected to the same USB Controller, I can decide not to use those ports or maybe disable the component.

Q1: What do you think? Are there any "Best Practises" about how to work with WWAN-Card in Qubes OS?

Q2: Unfortunately I decided not to install the USB-VM upon installation as this was marked with the "experimental" tag.
How can I setup the USB-VM after installation?

Q3: As far I understand the current implementation of XEN and the USB VM can only pass mass storage devices to other cubes.
As such if I decide not use USB mass storages at all, I didn't gain anything from setting up a USV VM correctly?

Kind regards

- Piit

[piitb...@gmail.com]

The next step would be to find which USB-Controller I need to pass to my NetVM in order to have the WWAN-Card available in this VM, correct?

List of USB-devices:

[user@dom0 ~] lsusb

Bus 003 Device 002: ID 8087:8000 Intel Corp.
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

Bus 001 Device 006: ID 093a:2510 Pixart Imaging, Inc. Optical Mouse

Bus 001 Device 005: ID 0765:5010 X-Rite, Inc.
Bus 001 Device 004: ID 04f2:b39a Chicony Electronics Co., Ltd
Bus 001 Device 003: ID 8087:07dc Intel Corp.

Bus 001 Device 008: ID 1199:a001 Sierra Wireless, Inc.

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

List of PCI-devices:

[user@dom0 ~] lspci
00:00.0 Host bridge: Intel Corporation Xeon E3-1200 v3/4th Gen Core Processor DRAM Controller (rev 06)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200 v3/4th Gen Core Processor PCI Express x16 Controller (rev 06)
00:02.0 VGA compatible controller: Intel Corporation 4th Gen Core Processor Integrated Graphics Controller (rev 06)
00:03.0 Audio device: Intel Corporation Xeon E3-1200 v3/4th Gen Core Processor HD Audio Controller (rev 06)
00:14.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB xHCI (rev 04)
00:16.0 Communication controller: Intel Corporation 8 Series/C220 Series Chipset Family MEI Controller #1 (rev 04)
00:19.0 Ethernet controller: Intel Corporation Ethernet Connection I217-LM (rev 04)
00:1b.0 Audio device: Intel Corporation 8 Series/C220 Series Chipset High Definition Audio Controller (rev 04)
00:1c.0 PCI bridge: Intel Corporation 8 Series/C220 Series Chipset Family PCI Express Root Port #1 (rev d4)
00:1c.1 PCI bridge: Intel Corporation 8 Series/C220 Series Chipset Family PCI Express Root Port #2 (rev d4)
00:1c.4 PCI bridge: Intel Corporation 8 Series/C220 Series Chipset Family PCI Express Root Port #5 (rev d4)
00:1d.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #1 (rev 04)
00:1f.0 ISA bridge: Intel Corporation QM87 Express LPC Controller (rev 04)
00:1f.2 SATA controller: Intel Corporation 8 Series/C220 Series Chipset Family 6-port SATA Controller 1 [AHCI mode] (rev 04)
00:1f.3 SMBus: Intel Corporation 8 Series/C220 Series Chipset Family SMBus Controller (rev 04)
01:00.0 VGA compatible controller: NVIDIA Corporation GK106GLM [Quadro K2100M] (rev a1)
03:00.0 Network controller: Intel Corporation Wireless 7260 (rev 83)

From my understanding only the USB devices are relevant, the details from the USB devices.

[user@dom0 ~] lspci -v
[...]
00:14.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB xHCI (rev 04) (prog-if 30 [XHCI])
    Subsystem: Lenovo Device 2211
    Flags: bus master, medium devsel, latency 0, IRQ 86
    Memory at b3920000 (64-bit, non-prefetchable) [size=64K]
    Capabilities: <access denied>
    Kernel driver in use: xhci_hcd
    Kernel modules: xhci_pci
[...]
00:1d.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #1 (rev 04) (prog-if 20 [EHCI])
    Subsystem: Lenovo Device 2211
    Flags: bus master, medium devsel, latency 0, IRQ 23
    Memory at b393d000 (32-bit, non-prefetchable) [size=1K]
    Capabilities: <access denied>
    Kernel driver in use: ehci-pci
    Kernel modules: ehci_pci
[...]

How can I find out which of the PCI-devices I need to connect to the NetVM in order to have the WWAN Card availabe in the NetVM?

The problem could be that important USB devices like Audio or the WebCam will also be gone (pinned to the NetVM) while I need those maybe in a NetVM.

- Piit

[piitb...@gmail.com]

Bingo!
I got WWAN working and as such Qubes OS has been qualified to be "ready for business" :-)

1. find out if your WWAN card can be seen by the OS (lsusb)
2. find out which USB Bus belongs to which PCI-USB-controller
3. attach the USB-Controller to sys-net
4. right click network manager and add a new mobile broadband connection
   Hint: Make sure to enable "Automatically connect this network when it is available" as no new entry "Mobile Broadband" is added to the normal Network Manager Menu (when you left click the icon in the taskbar)
5. Your WWAN Card should be connected automatically
6. You can enable/disable the WWAN-connection by right clicking the Network Manager icon

Unfortunately I lost 2h because I didn't enable "Automatically connect this network when it is available" and tried to work on my mobile connection from the konsole window.

Strangely i was able to see that the WWAN Card was working but I couldn't connect via terminal and get an IP address.

Some helpfull commands:

mmcli:

• See status of modem: mmcli -m 0
• Connect from CLI: mmcli -m 0 --simple-connect="apn=foo.carrier.com"
  (I didn't get an IP when trying to connect manualy)
  
• Disconnect from CLI: mmcli -m 0 --simple-disconnect

nmcli (yes this a N in the beginning)

• See general status: nmcli g
  
• See status of radio switches: nmcli r
• See status of connections: nmlci c
• See status of devices: nmcli d

A strange thing is that the WWAN card is named cdc-wdm0 in network manager.

When looking at the IP configuration from the terminal (ifconfig or ip a) the WAN-connection is named wwp0s2u1u6.

I'll am willing to add a more detailed description (if requested) at a later point.

@Jeremy:

Thank you for the inital idea. I didn't expect to get things working so fast :-)

- Piit

[Jeremy Rand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 03/20/2016 07:02 PM, piitb...@gmail.com wrote:
> Bingo! I got WWAN working and as such Qubes OS has been qualified
> to be "ready for business" :-)
>

> 1. find out if your WWAN card can be seen by the OS (lsusb) 2. find
> out which USB Bus belongs to which PCI-USB-controller 3. attach the
> USB-Controller to sys-net 4. right click network manager and add a

> new mobile broadband connection Hint: Make sure to enable
> "Automatically connect this network when it is available" as no new
> entry "Mobile Broadband" is added to the normal Network Manager

> Menu (when you left click the icon in the taskbar) 5. Your WWAN
> Card should be connected automatically 6. You can enable/disable

> the WWAN-connection by right clicking the Network Manager icon
>
> Unfortunately I lost 2h because I didn't enable "Automatically
> connect this network when it is available" and tried to work on my
> mobile connection from the konsole window.
>
> Strangely i was able to see that the WWAN Card was working but I
> couldn't connect via terminal and get an IP address.
>
>
> Some helpfull commands:
>
>
> mmcli:
>

> * See status of modem: mmcli -m 0 * Connect from CLI: mmcli -m 0

> --simple-connect="apn=foo.carrier.com" (I didn't get an IP when

> trying to connect manualy) * Disconnect from CLI: mmcli -m 0

> --simple-disconnect
>
> nmcli (yes this a N in the beginning)
>

> * See general status: nmcli g * See status of radio switches: nmcli
> r * See status of connections: nmlci c * See status of devices:
> nmcli d
>
> A strange thing is that the WWAN card is named *cdc-wdm0* in

> network manager.
>
> When looking at the IP configuration from the terminal (ifconfig or

> ip a) the WAN-connection is named *wwp0s2u1u6*.

>
>
> I'll am willing to add a more detailed description (if requested)
> at a later point.
>
>
> @Jeremy:
>
> Thank you for the inital idea. I didn't expect to get things
> working so fast :-)
>
>
> - Piit

Awesome, great to hear you got it working!

Cheers,
- -Jeremy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW72SJAAoJEAHN/EbZ1y06/vcP/iTh//tm/BYDPgosb0vRUJyG
FiCwHhtT/PguMxNhrjqT9FGDrPvVzTA6yyFsdd8qIzpCDMYMI7sps/FxtE1Qukgt
3WpimeO5RPonwOsezbQkuUlY+rsAA+h04PrUr8ta7Ey09cQ8IqZvCDomANLFL7cz
PJU5xp/9aBvgbnI6caT0umwqDXyqJEUaOhGfPrPkk1DJ+u6WtvV7mNtf11I7mBRU
acuIJvC1E1fTO4vEhn/cXFtiDpSK/kTQ8aTjgK6y6v+bk1Dx+pyUCPkH645t1Yoh
Tx/+/6F9LjAAUdNvFZ5tnsslEiFriC2x9N7cdIzkSuOivT9Jo2x/mJGBi4RNDtRV
8JZAfkcWHoUlnDoTVnFzrmCBn6RM7jc+RLUCsSdtA1f8bRF/i1tat/JRmGi0lXk+
30F3biWf7OmO5XovY5sqWow8MYMVxmalpOv8Cdfs4JVwsQ1VwORPKJyM/jbTgv9h
F5uhLkER8rJo2SgZDSkdNL0xRwUJjH6irxIQawO5oav2JoXHskAx299759Vqdu8e
aEv7L0StHxHUP++ZY7W7ff16zX4cLXy86cGolZe6lYW520MEmZAoCBi40Kziv3Te
YxE0gfmYLkIEXte6MzcrxHjJX0SEhTaDJiVMlGZBzRQMSCTfxZmPhUR6q64DHZop
h7HAHuOjkKtdVXOQi193
=K+bW
-----END PGP SIGNATURE-----

[piitb...@gmail.com]

Hello,

I have discovered a strange behaviour regarding the USB connections on my W540 after i have attached one of the USB Controllers to my sys-net VM to have the internal LTE card available:

The Leneovo W540 has four USB-Ports - view from above on the Laptop:

==== screen ====

L1                        R1

L2                        R2

L1 and R1 are USB2-Ports
L2 and R2 are USB3-Ports, as I have disabled USB3 in the BIOS they behave like USB2 Ports.

I've attached one USB Controller to my sys-net VM, which has now the following USB devices available:

[user@sys-net ~]$ lsusb

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 002 Device 004: ID 0765:5010 X-Rite, Inc.
Bus 002 Device 003: ID 1199:a001 Sierra Wireless, Inc.
Bus 002 Device 002: ID 8087:8000 Intel Corp.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

While I have expected to loose maybe two of my USB-ports as those ports are now terminated within the sys-net VM, it seems that 3 of my 4 USB ports are now "lost" to sys-net.
If I attach an extern USB-drive the notification messages says that this device has been attached to sys-net.

Do you see any chance to get at least of my USB ports back, to be able to attach an USB mouse AND(!) anothr USB device at the same time, without loosing it to sys-net?

- philipp

[Andrew]

piitb...@gmail.com:

> Do you see any chance to get at least of my USB ports back, to be able to
> attach an USB mouse AND(!) anothr USB device at the same time, without
> loosing it to sys-net?

Regardless of anything else, couldn't you use an external USB hub? I
understand it's not an ideal solution...

Andrew

[Achim Patzner]

On 03/24/2016 12:28 AM, piitb...@gmail.com wrote:
> Do you see any chance to get at least of my USB ports back, to be able
> to attach an USB mouse AND(!) anothr USB device at the same time,
> without loosing it to sys-net?

Not on that horribly laid-out bus design of a W540. I went around that
by adding a dual-port ExpressCard (whose firmware you'll have to
trust).Depending on how much value you put on your time you might be
better of with a cheap mobils UMTS router (people are selling them
quite a lot lately to get an upgrade to LTE). The Lenovo device is not
the best choice anyway and the system maintenance controller will keep
you from even launching EFI if you put any other USB modem into that slot.


Achim

[piitb...@gmail.com]

Am Freitag, 25. März 2016 18:05:46 UTC+1 schrieb Achim Patzner:

> On 03/24/2016 12:28 AM, piitberlin@ wrote:
> > Do you see any chance to get at least of my USB ports back, to be able
> > to attach an USB mouse AND(!) anothr USB device at the same time,
> > without loosing it to sys-net?
>
> Not on that horribly laid-out bus design of a W540. I went around that
> by adding a dual-port ExpressCard (whose firmware you'll have to
> trust).

Can you send me the exakt model nr/SKU?
As this would save me the time to buy a card, just to find out that it is not fully supported.

> Depending on how much value you put on your time you might be
> better of with a cheap mobils UMTS router (people are selling them
> quite a lot lately to get an upgrade to LTE).

As I need the laptop to be portable I don't want to carry around additional hardware. Also I need LTE speed.

> The Lenovo device is not
> the best choice anyway and the system maintenance controller will keep
> you from even launching EFI if you put any other USB modem into that slot.

I know that Lenovo going the wrong way with all those limitations.
But the W540 is my corporate device and will not be changed the next 3y (it was just to expensive for that).

I hope that we'll see more modern laptops which will support core boot/ libretto boot.
One good reason why I like the X200.

- Piit

[piitb...@gmail.com]

For the Qubes OS google group, to provide help for others (again I think a wiki to collect "stuff" is a good thing) :

Am Montag, 21. März 2016 01:02:59 UTC+1 schrieb piitb...@gmail.com:

I got WWAN working and as such Qubes OS has been qualified to be "ready for business" :-)

[...]

I'll am willing to add a more detailed description (if requested) at a later point.

Task:
Make an internal LTE-Card work in Qubes OS so that it can be managed through network manager (which is running in the sys-net VM).

Solution:
As the LTE card is connected to the internal USB Bus, a simple approach is to pass the USB-Controller (the PCI-Device) to the sys-net VM.

Howto:
We need to find out where the internal LTE card is connected to.
As it presented as an internal USB device, we use lsusb to list all USB-devices:

[pr@dom0 ~]$ lsusb
Bus 002 Device 005: ID 0765:5010 X-Rite, Inc.
Bus 002 Device 004: ID 1199:a001 Sierra Wireless, Inc.
Bus 002 Device 002: ID 8087:8000 Intel Corp.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 005: ID 04f2:b39a Chicony Electronics Co., Ltd
Bus 001 Device 004: ID 8087:07dc Intel Corp.
Bus 001 Device 003: ID 093a:2510 Pixart Imaging, Inc. Optical Mouse
Bus 001 Device 002: ID 8087:8008 Intel Corp.
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

The LTE card is the 2nd one from above (Sierra Wireless) and is located at USB Bus 002.
To find out which USB bus belongs to which USB Controller:

[pr@dom0 ~]$ readlink /sys/bus/usb/devices/usb?
../../../devices/pci0000:00/0000:00:1a.0/usb1
../../../devices/pci0000:00/0000:00:1d.0/usb2

As the LTE card is attached to USB bus 002 (usb2) the controller we're looking for is 00:1d.0.

Show the full name of this PCI-device

[pr@dom0 ~]$ lspci | grep USB
00:1a.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #2 (rev 04)

00:1d.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #1 (rev 04)

Add this PCI-device to the sys-net VM (Qubes VM Manager, right Click VM Settings, Tab: Devices).
You need to shutdown sys-firewall and afterwards sys-net to add the PCI-devices to sys-net.

After adding the PCI-device to sys-net and booting it up, some USB-devices will disappear from Dom0 ...

[pr@dom0 ~]$ lsusb
Bus 001 Device 005: ID 04f2:b39a Chicony Electronics Co., Ltd
Bus 001 Device 004: ID 8087:07dc Intel Corp.
Bus 001 Device 003: ID 093a:2510 Pixart Imaging, Inc. Optical Mouse
Bus 001 Device 002: ID 8087:8008 Intel Corp.
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

... and appear in sys-net:

[pr@sys-net ~]$ lsusb

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 002 Device 004: ID 0765:5010 X-Rite, Inc.
Bus 002 Device 003: ID 1199:a001 Sierra Wireless, Inc.
Bus 002 Device 002: ID 8087:8000 Intel Corp.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

When the LTE-card is available in sys-net you can use network manager to configure a mobile broadband connection.
Right click on network manager icon and enable mobile broadband, then right click and use "edit connections" to add a new connection.

Some helpfull commands:

mmcli:

    See status of modem: mmcli -m 0
    Connect from CLI: mmcli -m 0 --simple-connect="apn=foo.carrier.com"
    (I didn't get an IP when trying to connect manualy)
    Disconnect from CLI: mmcli -m 0 --simple-disconnect

nmcli (yes this a N in the beginning)

    See general status: nmcli g
    See status of radio switches: nmcli r
    See status of connections: nmlci c
    See status of devices: nmcli d

A strange thing is that the WWAN card is named cdc-wdm0 in network manager.
When looking at the IP configuration from the terminal (ifconfig or ip a) the WAN-connection is named wwp0s2u1u6

As you might guess all other USB devices that are connected to the same Bus / same USB-Controller will also be "lost" to the sys-net VM.
On the Lenovo W540 notebook this means that 3 out of 4 USB ports are passed through to sys-net.
Only the 1st USB port on the right site is still working in Dom0 as this port is connected to a different USB Bus.

If you enable USB3 in the BIOS you will even loose all 4 USB ports to sys-net. I have disabled USB3 in the BIOS and will use a USB3-PCMCIA Express Card to have USB3 available if I need it (as suggested in another thread)

- Piit

[akiral...@googlemail.com]

Thanks for this howto, Piit.

I am trying to get the build-in LTE card running on my ThinkPad T540p. Its a Sierra Wireless USB connected card. I can identify the USB bus, it's the first USB bus (Intel family xHCI rev 04), where the fingerprint reader and some other internal stuff also is located.

When I attach this USB device to sys-net VM, this VM does not start any more, however, but throws the error: "qubes sys-net modem VM: internal error: unable to reset PCI device : no FLR, PM reset or bus reset available"

Rebooting the whole Qubes (3.2) doesn't help either.

Any ideas?

[[799]]

Hello,

have you tried this:

qvm-prefs usbVM -s pci_strictreset false

See also:
https://www.qubes-os.org/doc/assigning-devices/

[799]





-------- Original-Nachricht --------

--
You received this message because you are subscribed to the Google Groups "qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users...@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/c6dcb667-815e-4efe-9a99-9e55f33ea833%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[akiral...@googlemail.com]

Hi 799,

> have you tried this:
> qvm-prefs usbVM -s pci_strictreset false
> See also:
> https://www.qubes-os.org/doc/assigning-devices/

no, I didn't, and yes, that did the trick. Thanks!

Best,
Akira

[akiral...@googlemail.com]

> As you might guess all other USB devices that are connected to the same Bus / same USB-Controller will also be "lost" to the sys-net VM.
> On the Lenovo W540 notebook this means that 3 out of 4 USB ports are passed through to sys-net.

> If you enable USB3 in the BIOS you will even loose all 4 USB ports to sys-net. I have disabled USB3 in the BIOS and will use a USB3-PCMCIA Express Card to have USB3 available if I need it (as suggested in another thread)

On a T540p, I loose all USB ports to sys-net, making the whole notebook quite unusable, since you cannot connect mice or disks any more.

Everything seems to be on one bus (003):

[user@dom0 ~]$ lsusb

Bus 002 Device 002: ID 8087:8000 Intel Corp.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 001 Device 002: ID 8087:8008 Intel Corp.
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 004 Device 002: ID 17ef:1010 Lenovo
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 008: ID 046d:c526 Logitech, Inc. Nano Receiver
Bus 003 Device 006: ID 17ef:100f Lenovo
Bus 003 Device 004: ID 17ef:1010 Lenovo
Bus 003 Device 003: ID 138a:0017 Validity Sensors, Inc. Fingerprint Reader
Bus 003 Device 002: ID 058f:9540 Alcor Micro Corp. AU9540 Smartcard Reader
Bus 003 Device 009: ID 5986:026a Acer, Inc
Bus 003 Device 007: ID 8087:07da Intel Corp.
Bus 003 Device 005: ID 1199:a001 Sierra Wireless, Inc.
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

[user@dom0 ~]$ readlink /sys/bus/usb/devices/usb?

../../../devices/pci0000:00/0000:00:1a.0/usb1
../../../devices/pci0000:00/0000:00:1d.0/usb2

../../../devices/pci0000:00/0000:00:14.0/usb3
../../../devices/pci0000:00/0000:00:14.0/usb4

[user@dom0 ~]$ lspci | grep USB
00:14.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB xHCI (rev 04)

00:1a.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #2 (rev 04)
00:1d.0 USB controller: Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #1 (rev 04)

Why do you have to disable USB3 in BIOS?
And what about bus 001 and 002, where may they be connected to?

If I delegate device 00:14.0 to sys-net, I cannot use any physical USB port in dom0 any more.

[awokd]

On Mon, March 12, 2018 5:40 pm, akiraloopback via qubes-users wrote:
>> As you might guess all other USB devices that are connected to the same
>> Bus / same USB-Controller will also be "lost" to the sys-net VM.
>> On the Lenovo W540 notebook this means that 3 out of 4 USB ports are
>> passed through to sys-net. If you enable USB3 in the BIOS you will even
>> loose all 4 USB ports to sys-net. I have disabled USB3 in the BIOS and
>> will use a USB3-PCMCIA Express Card to have USB3 available if I need it
>> (as suggested in another thread)
>>
>
> On a T540p, I loose all USB ports to sys-net, making the whole notebook
> quite unusable, since you cannot connect mice or disks any more.
>
> Everything seems to be on one bus (003):

If I understand the theory right, if you disable the strict-reset
requirement you should still be able to assign different devices on the
same bus to different VMs. Have you tried that?

[akiral...@googlemail.com]

Maybe. No. I just installed sys-usb now, delegating the LTE device to sys-net:
[root@dom0 ~]# qubesctl state.sls qvm.sys-usb
[user@dom0 ~]$ qvm-usb -a sys-net sys-usb:4-10

Seems to work well.

[799]

Hello,

happy to heat, that you made it work.
For some reason sometimes the exalt USB ID changes (example same device which was sys-usb:4-10 before is then sys-usb:5-10).

I have thereof written a small helper script which will attach the WWAN-card based on the name:

#!/bin/bash
# Attaches internal LTE-Card to sys-net
qvm-usb attach sys-net `qvm-usb | grep H5321 | gawk '{ print $1 }'`

You might need to change H5321 in your case so that the string is within the description of your WWAN card.

[799]

[M]

Have you tried to make your USB modem work with Qubes OS 4.0.3 and do it work correctly ?

If so, have you done the same to make it work correctly as mentioned in this thread or have you done something else and if so what ?