Cannot get USB qube with keyboard to work

[jagnopurka]

I have a desktop PC with USB keyboard and mouse so USB qube was not created with installation of Qubes.

I found this: USB qubes | Qubes OS

So I run sudo qubesctl state.sls qvm.usb-keyboard in dom0. It seemingly succeeded and created a usb qube. Once I started it though, it locked me out of my keyboard and mouse. After reboot too, so I found this solution:

Locked myself out after creating Sys-USB

EDIT - Removed because it was posted in the wrong thread. My apologies for the confusion. Yes, @Sven is right. to enter the BIOS.

I added qubes.skip_autostart to GRUB parameters, and it still didn’t work (endless loading screen on decryption menu).

So, I tried also removing usbcore.authorized_default=0 and now keyboard works.

Okay, I’m no longer locked out.

But still can’t get usb-qube to work with the keyboard.

In dom0 I checked /etc/qubes-rpc/policy dir and there was a file named qubes.USB containing just $anyvm $anyvm deny. Also, there are no /etc/qubes-rpc/policy/qubes.InputKeyboard or /etc/qubes-rpc/policy/qubes.InputMouse files at all!

But that deny rule seemed like a problem, so I changed it to:

sys-usb dom0 allow
$anyvm $anyvm deny

still no luck, keyboard is unavailable as soon as usb qube starts.
So I tried creating the /etc/qubes-rpc/policy/qubes.InputKeyboard and /etc/qubes-rpc/policy/qubes.InputMouse files manually with just sys-usb dom0 allow but this didn’t help either.

Is the docs wrong or outdated, or am I doing something wrong?
My goal is to allow USB keyboard and mouse in dom0 while having other devices like webcam be able to be passed to any other qube.

[DVM]

Are you currently on Qubes 4.1 or 4.2?

[jagnopurka]

4.2

[DVM]

The doc still point to the old policy directory. The new policy file is /etc/qubes/policy.d/50-config-input.policy
You can change the values from Qubes Global Config under “USB Devices”.
Make sure it’s allowed there.

[jagnopurka]

It contains

qubes.InputMouse * sys-usb dom0 ask default_target=dom0
qubes.InputKeyboard * sys-usb dom0 allow
# not configurable by this state
qubes.InputTablet * sys-usb dom0 deny

is this ok? what should I change?

[apparatus]

@jagnopurka

Once I started it though, it locked me out of my keyboard and mouse.

Did sys-usb started successfully or was there an error message?
Maybe there is some problem with your USB PCI controllers attached to sys-usb.

@jagnopurka

is this ok? what should I change?

Yes, the policy is configured properly.
That is if there is no policy config file with higher priority that overwrites this config file.

[DVM]

The policy looks correct. You can switch to “allow” for the mouse too if you want to (remove default_target=dom0 if you set it to allow).

The next step is to make sure you have your USB controllers attached to sys-usb (do you have “no-strict-reset” set to True?):

# dom0
qvm-pci ls | grep USB

Also, what is the template for sys-usb? Make sure you have the qubes-input-proxy package installed in the template.

[jagnopurka]

@apparatus

Did sys-usb started successfully or was there an error message?

(upload://7NYiHN5SA789p42YCF7rk7wwgDT.jpeg)
there is this error message when I started usb qube manually from already-booted Qubes

[apparatus]

Did you install Qubes OS on external USB drive?

[jagnopurka]

OMG yes! I have it installed on an external SSD connected via USB…
so that explains my problem, now I only need to fix it while still using external SSD

[apparatus]

You can use sys-usb only if you have multiple USB controllers available so you can dedicate one of them to dom0 to connect your external USB drive to it.
Then you can hide all other USB controllers from dom0 and use them for sys-usb:

Broken system after installing USB qube

Once you have identified the controllers, you can hide one of them from dom0 - not the one to which your USB device is attached, obviously. Try interrupting the boot and editing the command line to include: rd.qubes.hide_pci 00:1a.00 , or whatever your controller is. If that works as expected, then you can make the change permanent by editing the grub config. This will ensure that one controller is used from dom0, and the other can be safely allocated to sys-usb and used there.