sys-usb not correctly created on install

[eloquence]

Qubes OS version 4.0.4

Affected component(s) or functionality
sys-usb

Summary
In a default install on a ThinkPad T490, sys-usb was not created as expected, even though the installation defaults were not modified (sys-net-usb was also not created; the USB controller was not attached to anything.)

Subsequent attempts to create it via sudo qubesctl state.sls qvm.sys-usb failed with a state failure on the ID sys-net-usb, as illustrated below.

Screenshot

Creating the sys-usb Qube manually partially resolved, but sys-usb would not start, failing with "Unable to reset PCI device".

Following the instructions in https://www.qubes-os.org/doc/pci-troubleshooting/#domain--has-failed-to-start-internal-error-unable-to-reset-pci-device--no-flr-pm-reset-or-bus-reset-available appears to finally have resolved.

[marmarek]

Can you check the logs in journalctl from the installation time?

Subsequent attempts to create it via sudo qubesctl state.sls qvm.sys-usb failed with a state failure on the ID sys-net-usb, as illustrated below.

This looks like combined sys-net + sys-usb was enabled during install. You can check this with qubesctl top.enabled pillar=True (look for sys-net-as-usbvm). Honestly, it is quite likely that using this state outside of installer is broken...

If your intention was to get separate sys-usb (as it is by default), then just disable this combined setting (qubesctl top.disable qvm.sys-net-as-usbvm pillar=True). If having sys-net as usbvm was the intention, then probably it's needed to set them both at the same time (use qubesctl top.enable qvm.sys-usb qvm.sys-net, and then qubesctl state.highstate). Or attach USB controller(s) to sys-net manually.

[DemiMarie]

qubesctl top.highstate

Did you mean qubesctl state.highstate?

[sssoleileraaa]

I recently installed Qubes 4.0.4 on a ThinkPad T490 and saw a similar issue with the sys-usb VM not being created by default, but I never ran into an error when running sudo qubesctl state.sls qvm.sys-usb, which, after reboot, fixed the issue for me.

Summary

I installed without changing any default configuration. At the end of the Qubes installation, there was a menu that appeared before I could click the FINISH CONFIGURATION button. The menu had a couple related checkbox items that were unchecked AND disabled (I could not check them even if I wanted to) that said::

- [ ] USB qube configuration disabled - you are using a USB keyboard or USB disk
    - [ ] Use sys-net qube for both network and USB devices

So I clicked FINISH CONFIGURATION and that completed the installation. When I logged into Qubes I did not see a wifi graphical icon in the upper right-hand corner, and I also did not see a sys-usb VM in the Qubes menu. USB drives were also not recognized. So, first, I tried qvm-start sys-net which failed with a popup notification that said:

Qubes Status: sys-net

Domain sys-net has failed to start: internal error: Unable to reset PCI device 0000:00:1f.6: no FLP, PM reset or bus reset available

I followed our own instructions here to get around this issue of network devices (Ethernet and Wi-Fi) not working with Qubes out of the box, and that worked great.

To solve the sys-usb issue, I ran sudo qubesctl state.sls qvm.sys-usb which immediately created the sys-usb VM. After reboot, USB drives were recognized and able to be attached to VMs.

[kord1e]

I got this message when installing 4.1.0-rc4 as well:

"USB qube configuration disabled - you are using a USB keyboard or USB disk"

and no USB Qube was created.

I do not have any USB disks, and I have a PS/2 keyboard and to my best knowledge, the motherboard has a real PS/2 controller, not an embedded PS/2-USB converter (nothing keyboard-related is listed in lsusb, I checked several different places and found references to AT translated set 2 keyboard, i8042 chip and so on).

However, my Steelseries USB mouse is recognised as both a mouse and a keyboard, for example, in xinput --list. Could this cause the installer to falsely detect a USB keyboard?

[marmarek]

However, my Steelseries USB mouse is recognised as both a mouse and a keyboard, for example, in xinput --list. Could this cause the installer to falsely detect a USB keyboard?

Yes, that's definitely it. Handling USB input devices is tricky and the risk of cutting yourself out of input access is great - that's why installer opt to the less risky default. But indeed, we need some improvements here. Further improvements in the installer regarding USB should land in R4.2, hopefully...

You can create USB-qube with a single command, see: https://www.qubes-os.org/doc/usb-qubes/#creating-and-using-a-usb-qube

[sssoleileraaa]

The installer falsely detects a USB keyboard and/or USB device when installing 4.1.0 and 4.1.1-rc1 on a T490 8th gen laptop with no USB keyboard or USB disk attached.

Here's an image back when testing 4.1.0 (4.1.1-rc1 looks the same except the default template is Fedora 36): https://user-images.githubusercontent.com/4522213/166519126-7c5ced5d-0c57-4438-8dcf-410cc0b247b1.png

@marmarek - you and I did some troubleshooting back in May (see freedomofpress/securedrop-workstation#769 (comment)) so I'm guessing a fix hasn't made it in yet?