To bad that is not a setting in my BIOS; the BIOS on this machine is really limited.
I’m still trying to get it to work in a normal way so nothing to dom0 if possible. The biggest trouble I now have is that I can’t wrap my head around what is going wrong so I can’t even start thinking about possible solutions.
Kind regards, Bloged
If you can find a thunderbolt device with a dedicated usb controller that actually works fine for passing through a displayport enabled dock since the usb controller appears as a separate pcie device that can be attached to VMs. Basically entirely bypasses the weird intel shared usb controller nonsense.
Actually I did a lot more testing.
So to summarize:
I did install bolt to check what’s going on in Dom0.
My BIOS does have a setting to disable PCIe tunneling over Thunderbolt.
I did try two different configurations:
Directly connecting monitors via MST.
(Type C port converts to DisplayPort which then does MST)
Technically all TB ports support this.
Not all Docks even use TB, many actually use DP alt. The main pros of TB over it is bandwidth and ability to attach more PCIe devices.
My advice if you want security:
Don’t use a TB dock. Less attack surface.
On that note, do install bolt in dom0, it’s an official Fedora package.
If you do disable loading of drivers for your TB controller, you will still be able to attach monitors to it. Because the DP Alt bypasses it.
I really think we need an official docs on DP Alt, Thunderbolt, Displayport, Docks, USB4, etc.
But to summarize my experience:
TB docks don’t hotplug for me. And the picture doesn’t come out immediately. But it does work fine.
However disabling PCI tunneling or hiding the PCI controller for the TB port makes it just do DP Alt. Which makes the picture come on instantly.
How do you use bolt? When I install it in dom0 and use monitor nothing happens when I plug in A USB-C TB device. Same goes when I monitor in sys-usb.
Regards, Bloged
If nothing happens when you try bolt, it means there’s no plugged TB device or you have no TB controller in dom0.
try boltctl domains and boltctl list.
Keep in mind, if your TB controller is not in dom0 or it hasn’t loaded the thunderbolt driver, boltctl won’t show anything.
I advice doing lspci -v and lsmod to verify that you have the TB NHI controller in Dom0 with the thunderbolt driver loaded.
But anyways, without the NHI driver, the port essentially acts as a Type C USB controller with Alt DP. So you can still get monitors out or connect other devices. TB4/5 docks should do this. TB3 might likely not work at all.
Do you really need TB though? Because if your Dock is working and your monitors are working, TB won’t give you much on top.
Also you need to have the Dock plugged in before boot for TB to work on Qubes because no PCI hotplug.
TB will usually add PCI-E devices too. Which would appear in dom0.
All in all, I see three reasons you might want TB over just using your TB Dock as Type C/Disp Alt:
Anyways, I personally see the external GPU as the main benefit of TB on a new Qubes laptop.
Output of lspci -v shows the following:
00:07.0 PCI bridge: Intel Corporation Meteor Lake-P Thunderbolt 4 PCI Express Root Port #0 (rev 10) (prog-if 00 [Normal decode])
Flags: bus master, fast devsel, latency 0, IRQ 268
Bus: primary=00, secondary=04, subordinate=18, sec-latency=0
I/O behind bridge: a000-afff [size=4K] [16-bit]
Memory behind bridge: 8c000000-91ffffff [size=96M] [32-bit]
Prefetchable memory behind bridge: ac20000000-b41fffffff [size=32G] [32-bit]
Capabilities: <access denied>
Kernel driver in use: pcieport
00:07.1 PCI bridge: Intel Corporation Meteor Lake-P Thunderbolt 4 PCI Express Root Port #1 (rev 10) (prog-if 00 [Normal decode])
Flags: bus master, fast devsel, latency 0, IRQ 269
Bus: primary=00, secondary=19, subordinate=2d, sec-latency=0
I/O behind bridge: b000-bfff [size=4K] [16-bit]
Memory behind bridge: 86000000-8bffffff [size=96M] [32-bit]
Prefetchable memory behind bridge: a420000000-ac1fffffff [size=32G] [32-bit]
Capabilities: <access denied>
Kernel driver in use: pcieport
00:0d.0 USB controller: Intel Corporation Meteor Lake-P Thunderbolt 4 USB Controller (rev 10) (prog-if 30 [XHCI])
DeviceName: Onboard - Other
Flags: bus master, medium devsel, latency 0
Memory at b4300a0000 (64-bit, non-prefetchable) [size=64K]
Capabilities: <access denied>
Kernel driver in use: pciback
Kernel modules: xhci_pci
00:0d.2 USB controller: Intel Corporation Meteor Lake-P Thunderbolt 4 NHI #0 (rev 10) (prog-if 40 [USB4 Host Interface])
DeviceName: Onboard - Other
Subsystem: Device 2222:1111
Flags: bus master, fast devsel, latency 0, IRQ 35
Memory at b430000000 (64-bit, non-prefetchable) [size=256K]
Memory at b4300b5000 (64-bit, non-prefetchable) [size=4K]
Capabilities: <access denied>
Kernel driver in use: pciback
Kernel modules: thunderbolt
So this should be correct. Or am I missing something obvious?
The thing is I should have on USB-C port and one USB-C/TB port. External monitors won’t work in either of my two USB-c ports… so I think there is something else at play!
Both boltctl domains and boltctl list give empty responses.
I have an mini-displayport… might try a mini-displayport to two HDMI-ports dongle (MST) and see if that works.
Kind regards, Bloged
@Bloged You are hiding your thunderbolt NHI device from Dom0. So boltctl in Dom0 isn’t going to see it. I need pcie from thunderbolt so I don’t use bolt.
I’m using a Gigabyte Z890 Aorus Master with usb-c video and it works fine for the most part if I don’t overclock anything. If I overclock the RAM using XMP1, I don’t get a signal after waking from sleep unless I disconnect the HDMI cable.
00:0d.2 USB controller: Intel Corporation Meteor Lake-P Thunderbolt 4 NHI #0 (rev 10) (prog-if 40 [USB4 Host Interface])
DeviceName: Onboard - Other
Subsystem: Device 2222:1111
Flags: bus master, fast devsel, latency 0, IRQ 35
Memory at b430000000 (64-bit, non-prefetchable) [size=256K]
Memory at b4300b5000 (64-bit, non-prefetchable) [size=4K]
Capabilities: <access denied>
Kernel driver in use: pciback
Kernel modules: thunderbolt
This is not correct. The driver in use is pciback. This means you have told Dom0 not to load the thunderbolt driver.
It would happen for two different reasons - you either have kernel flags to hide it or you’ve added it to sys-usb which when launched would make Dom0 drop the device - unload the Thunderbolt driver.
Even with this setup, I am able to get monitors out of a TB dock or directly via a Type C cable to the monitor.
It should work with a TB4 port since it can do Disp Alt, essentially bypassing the TB and directly connecting the DP.
Ditto for the TB Dock which should fallback to Disp Alt.
Thinking about it… the only reason not to work would be too high of a resolution.
It seems I have it attached to sys-usb… later I will try if it works when adding it to dom0 just to confirm. But I don’t really care about TB just USB-c would be totally fine for me. The resolution isn’t the problem
Ok now for the really weird thing: when I boot with two monitors attached via USB-C (directly from monitor) one works during boot until HDD decryption. After that it goes blank. This is expected behavior. Now login is on a blank monitor so not on the laptop one. This I can do blind so no real problem 
. When I now use ARandR to enable the monitors both are shown as active; but both stay blank/no signal. When I now invert one monitor (doesn’t matter which) and apply. I get the same error as normal, but when reverting to previous settings one of the monitors will receive signal (always the same one no matter what.
I can have this same behavior on the Dell and the Icy docks as well… so what is going on. The Dell docking station previously worked on a Qubes 4.2.4 installation on a Dell XPS laptop and it still has the same Full HD monitors attached.
Kind regards, Bloged