Device disconnects in Qubes OS

[slush0]

Model T works strange in Qubes OS; The device appears in dom0 normally and it is possible to attach it to the AppVm, but once any application (Chrome?) try to connect to such device in AppVm, device disappears from the system completely (including dom0).

[slush0]

User reports: https://www.reddit.com/r/TREZOR/comments/83yinw/unable_to_use_trezor_t_on_qubes_os/

[slush0]

It seems to be a QubesOS related bug. Other people report similar problems with different types of hardware:

https://groups.google.com/forum/#!topic/qubes-users/HMjY5KBKBOc

[slush0]

Qubes 3.2, kernel 4.9.56-21.pvops.qubes.x86_64. dmesg from AppVM for bootloader mode:

58785.270980] usb 2-1: New USB device found, idVendor=1209, idProduct=53c0
[58785.271001] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[58785.271016] usb 2-1: Product: TREZOR
[58785.271026] usb 2-1: Manufacturer: SatoshiLabs
[58785.271037] usb 2-1: SerialNumber: 000000000000000000000000
[58802.288325] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58803.169115] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58804.048183] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58804.928154] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58804.928416] usb 2-1: USB disconnect, device number 10
[58805.808111] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58806.688243] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58807.568108] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58808.448095] usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
[58808.448137] usb usb2-port1: unable to enumerate USB device

[smrtak]

Qubes OS R3.2

AppVM-template = Fedora-26
uname -r = 4.9.56-21.pvops.qubes.x86_64
rpms = trezor-udev-2-1.noarch; trezor-bridge-2.0.12-1.x86_64

sudo[1616]: user : TTY=pts/0 ; PWD=/home/user ; USER=root ; COMMAND=/bin/journalctl -f
audit[1616]: USER_CMD pid=1616 uid=1000 auid=xxx ses=xxx msg='cwd="/home/user" cmd=xxx terminal=pts/0 res=success'
audit[1616]: CRED_REFR pid=1616 uid=0 auid=xxx ses=xxx msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
sudo[1616]: pam_systemd(sudo:session): Cannot create session: Already running in a session
audit[1616]: USER_START pid=1616 uid=0 auid=xxx ses=xxx msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
sudo[1616]: pam_unix(sudo:session): session opened for user root by user(uid=0)
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: unable to enumerate USB device
kernel: vhci_hcd: connection closed
kernel: vhci_hcd: stop threads
kernel: vhci_hcd: release socket
kernel: vhci_hcd: disconnect device
qrexec-agent[454]: executed root:QUBESRPC qubes.USBAttach dom0 pid 1620
kernel: vhci_hcd vhci_hcd: pdev(0) rhport(0) sockfd(0)
kernel: vhci_hcd vhci_hcd: devid(262148) speed(2) speed_str(full-speed)
kernel: usb 2-1: new full-speed USB device number 127 using vhci_hcd
kernel: usb 2-1: SetAddress Request (127) to port 0
kernel: usb 2-1: New USB device found, idVendor=1209, idProduct=53c1
kernel: usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
kernel: usb 2-1: Product: TREZOR
kernel: usb 2-1: Manufacturer: SatoshiLabs
kernel: usb 2-1: SerialNumber: xxx
kernel: hid-generic 0003:1209:53C1.0005: hiddev0,hidraw0: USB HID v1.11 Device [SatoshiLabs TREZOR] on usb-vhci_hcd-1/input1
trezord[459]: 127.0.0.1 - - [03/May/2018:22:38:43 +0200] "POST /listen HTTP/1.1" 200 64
trezord[459]: 2018/05/03 22:40:07 POST /listen
qrexec-agent[454]: send exit code 0
qrexec-agent[454]: pid 1620 exited with 0
qrexec-agent[454]: eintr
trezord[459]: 2018/05/03 22:40:07 POST /acquire/web01/null
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb 2-1: USB disconnect, device number 127
trezord[459]: 2018/05/03 22:40:10 Warning: error at device reset: LIBUSB_ERROR_NOT_FOUND
trezord[459]: 2018/05/03 22:40:10 Warning: error at configuration set: LIBUSB_ERROR_NO_DEVICE
trezord[459]: 2018/05/03 22:40:11 Returning error: device not found
trezord[459]: 127.0.0.1 - - [03/May/2018:22:40:07 +0200] "POST /acquire/web01/null HTTP/1.1" 400 29
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
trezord[459]: 127.0.0.1 - - [03/May/2018:22:40:07 +0200] "POST /listen HTTP/1.1" 200 3
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: unable to enumerate USB device
trezord[459]: 2018/05/03 22:40:14 POST /listen
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: unable to enumerate USB device
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: unable to enumerate USB device
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: unable to enumerate USB device
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?
kernel: usb usb2-port1: Cannot enable. Maybe the USB cable is bad?

slush0 did you make it work? is there any workaround?

T1 works w/o any issues, just this new touch guy doesn't ;)

[prusnak]

Can anyone try latest stable QubesOS R4.0? If this does not happen in R4.0, then I consider this as fixed.

[GitCryptik]

I can confirm it is not working in R4 in either Fedora-26 or Debian-9 templates. I can get trezord running. I also added the udev rules manually. With trezord running in terminal, I can see the output as I am accessing beta-wallet.trezor.io. While I am accessing the page I see http requests in the terminal to 127.0.0.1 but the page always times out asking me to connect my trezor. I am not on that computer right now but I will post the output maybe tonight. I remember it saying something about LIBUSB.

There is no problem with the OS detecting the Trezor. You must unlock it before it shows up at which point I attach the device to the AppVM that is running trezord. Only at this point will the website detect the bridge is installed. After that is where the trouble happens.

I can also confirm that electrum-ltc will not detect the trezor T at all, no matter what I do, even tho the OS clearly sees it connected.

I also have a netbook which is running ubuntu. Everything works on that

[prusnak]

Not really sure what's causing this :-/

According to the mailing list above, this affects also another hardware (HackRF for example), so this problem is not specific to TREZOR, but it is probably caused by some specific usage in our embedded USB stack.

Maybe @rootkovska can help?

[rootkovska]

I believe @marmarek should have received the device by now so maybe could help...?

[marmarek]

I can confirm the same problem. Additionally to the above, on the USB VM side I've got:

kernel: usbip-host 1-1: endpoint 0 is stalled

[marmarek]

Do you have any technical documentation how the communication with the device should look like? I don't see HID endpoint, even in USB VM directly. Especially, what should be sent/received from endpoints 0/1?

As a workaround, I run trezor bridge in USB VM and connect to it using qrexec based proxy. Is there any privacy/integrity protection at USB protocol level (between the device and trezord)? If not, then this workaround may be even better (do not expose wallet client VM to the whole USB stuff, which could be fabricated by compromised USB VM). Anyway, it would be good to solve the problem anyway, as it affect other devices too.

There is one more issue here - for some reason /dev/bus/usb/.../ is owned by qubes group, which prevents trezord accessing it. Looks like a bug in one of Qubes udev rules.