Lspci in dom0 shows network and USB controllers

General Discussion
1

When I run lspci inside dom0 terminal, it shows all network and USB controller PCI devices as well, even if they are supposed to not be assigned to dom0, but sys-net and sys-usb instead.

Is this expected, and why?

How can I list what PCI devices are actually assigned to and accessible by dom0?

How does QubesOS handle making sure (possibly compromised) network and USB hardware never touches dom0 at any point during boot?

2

qvm-pci

1 Like
3

From that page:

By default, when a device is detached from a VM (or when a VM with an attached PCI device is shut down), the device is not automatically attached back to dom0.

This is an intended feature.

A device which was previously attached to a VM less trusted than dom0 (which, in Qubes, is all of them) could attack dom0 if it were automatically reattached there.

In order to re-enable the device in dom0, either:

  • Reboot the physical machine. (Best practice)

So, do I understand it correctly that, briefly during the startup of the computer, network and USB controller devices will be attached to dom0?

How is dom0 protected from compromise in this situation, in case the firmware itself on the network device is compromised?

Or if a malicious USB device is plugged in already during boot?

If sys-net isn’t auto-started, would there now suddenly be internet connectivity in dom0? Or how is this prevented?

4

Apparently, someone was thinking along exactly the same lines, and asked pretty much these exact same questions 10 days ago.

There is apparently a script called qubes-pciback.sh which runs really early during startup, before devices are initialized, and assigns the network and USB controllers into a dummy “pciback” driver that does nothing, so that the devices cannot be claimed by the real drivers. The network PCI devices are always assigned to pciback, USB controllers if the “rd.qubes.hide_all_usb” grub option is supplied, which it is for me.

So, a compromised network or USB controller device should not be able to do any harm to dom0 at all. They are attached to dom0 though, there just won’t be any driver talking to them, so it is more or less like if they weren’t assigned to dom0 at all.

1 Like
5