search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
541 stars 48 forks source link

Persistent USB device attachment does not work after dom0 reboot #5736

Open greenrd opened 4 years ago

greenrd commented 4 years ago

Qubes OS version Qubes release 4.0 (R4.0)

Affected component(s) or functionality qvm-usb

Brief summary The qvm-usb -p option to attach a device to a VM persistently worked initially, but after rebooting dom0, the VM failed to start because Qubes thought the device didn't exist. However, the device did exist.

To Reproduce

  1. Enable USBVM and USB keyboard: sudo qubesctl state.sls qvm.usb-keyboard
  2. Create AppVM, let's call it "audio"
  3. Start AppVM
  4. Plug in USB device, e.g. USB webcam
  5. Attach USB device to new AppVM, e.g. qvm-usb attach -p audio sys-usb:2-4
  6. Shut down dom0
  7. Boot into Windows on host machine
  8. Reboot, boot into Qubes OS
  9. Observe that USB device is now numbered sys-usb:1-4
  10. Try to start AppVM

Expected behavior AppVM should start with USB device attached

Actual behavior AppVM fails to start with error saying USB device does not exist. It does exist, it just has a different number. (I think the device should be identified by its USB vendor and product ID, using the device number only to disambiguate if necessary, in case you have multiple devices with the same vendor and product ID.)

Relevant documentation you've consulted https://www.qubes-os.org/doc/usb-devices/ https://www.qubes-os.org/doc/device-handling/

Related, non-duplicate issues https://github.com/QubesOS/qubes-issues/issues/4780

greenrd commented 4 years ago

Workaround to allow VM to start, for the record: qvm-usb detach audio sys-usb:2-4

promovicz commented 4 years ago

Can confirm this bug. Same issue also applies to block devices. It happens with all persistent devices that have changing names.

The real issue with this is three-fold:

Same problem also occurs if you try to persistently attach a block devices, such as an LVM logical volume on another disk. This is highly annoying because it limits me to just the Qubes-managed volumes.

promovicz commented 4 years ago

Workaround that does it for me:

Install an RPC hook script on the dom0 that identifies and then attaches the right devices to the calling VM.

Something like this could also be part of a final solution by being integrated with the correct management interfaces, but I couldn't find the time yet to determine how that would work exactly.

promovicz commented 4 years ago

Observation about device identifiers:

The "description" of devices seems to be a more useful identifier than the "BACKEND:DEVID" tuple.

In case of LVM volumes it will be the VG and LV name, which is stable and useful. Not sure about straight LUKS.

For USB devices this works brilliantly if the device has a serial number, less so if not but possibly acceptable.

james-callahan commented 1 year ago

I've just had the same issue in qubes 4.1