Need some help getting KB+M USB devices in dom0 (laptop)

User Support
1

Hello, I’m not getting my usb devices to work the way I’d like and looking for a little help. Just trying to get my keyboard and mouse functioning in dom0, “passed through” up to dom0 so that I can still use the usb device VM for hdd, sdd, usb disk, etc, just having the KB+M be available in dom0. And I don’t need them for for luks decryption, I will just decrypt with the laptop keyboard.

I’m following along at the qubes-doc for usb qubes:
Qubes-Doc: USB

I’m on a thinkpad t460p with a docking station. I have my usb keyboard and mouse plugged into the two usb ports on the right side on the laptop itself, not via dock. Plugging in the dock will add usb devices to my usb vm “usb” (which was cloned from sys-usb, just renamed), but the usb ports on the side don’t seem to modify or change - as expected.

Actions
Configs & Changes I’ve made to configuration files from following the Qubes Doc USB KB/M guide:
USB VM template already has qubes-input-proxy-sender and qubes-usb-proxy

usb autostart
set my usb vm to autostart

[user@dom0 ~]$ qvm-prefs --set usb autostart True

/etc/qubes-rpc/policy/qubes.InputMouse
I added the top line to allow the mouse.

usb dom0 allow,default_target=dom0
$anyvm $anyvm deny

/etc/qubes-rpc/policy/qubes.InputKeyboard
I added the top line to allow the keyboard

usb dom0 allow
$anyvm $anyvm deny

/etc/default/grub
I appended the GRUB_CMDLINE_LINUX var with usbcore portion, since the statement about USBGuard makes me think I should. but i don’t really care to use KB+M in early boot for luks decryption, I am fine with using laptop keyboard at Plymouth luks prompt; so unsure if this change is necessary for me. I rebuild my efi grub afterwards with grub2-mkconfig efi command that is in the next section.

GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX rd.qubes.hide_all_usb usbcore.authorized_default=0"

so, I have modified /etc/default/grub, then rebuilt efi-grub after making changes to qubes.InputMouse and qubes.InputKeyboard. I’m still not getting any usb or mouse controls working in dom0. other observations, I can see that the light on my mouse turns on, but the NUMLK light indicator doesn’t turn on for my keyboard when I hit it; power to one but not the other?

if there’s any other information I can provide, please let me know.

I don’t use the salt formulas to configure vms because I have custom names for everything and I haven’t had the chance/time to learn salt and reconfigure it, so everything is just apt-update and qubes-dom0-update, maybe there’s a configuration issue that way that I have gotten myself into.

2

The keyboard and mouse are working with the usb vm only, they still aren’t getting passed to dom0.

3

You need to add USB controller for the side ports to the Devices tab in usb Qube Settings.

UPD:

NVM then, there should be another problem.

4

Diagnostic Commands

user@usb:~$ sudo lsusb

Bus 002 Device 001: ID 04d9:a0f8 Holtek Semiconductor, Inc. USB Gaming Keyboard
Bus 002 Device 010: ID 046d:c07d Logitech, Inc. G502 Mouse

[user@dom0 ~]$ qvm-usb

BACKEND:DEVID  DESCRIPTION                               USED BY
usb:2-1       Logitech_Gaming_Mouse_G502_0B8B34613835
usb:2-2       HOLDCHIP_USB_Gaming_Keyboard

Please suggest any other output I can provide?

5

You can check journalctl in usb qube and in dom0 for messages from KB/M when you disconnect/connect them in USB port.

6

Additional question: This user has the usbcore.authorized_default=0 in their /etc/qubes-rpc/policy/qubes.InputKeyboard.
Can that be right? The file has the format <source> <target> <rule/options>.

However, in the Manual Setup for USB Keyboards, the footnote in the bottom (for Qubes 4.1), it seems to be talking about the qubes.InputKeyboard file, and then in the following section Qubes 4.1: How to enable a USB keyboard on a separate USB controller, it is explicitly stated that it goes in /etc/default/grub.

7

No, it was an error.

8

Alright, my system is now having more general problems.

I’ve just discovered that qvm-copy is returning Request Refused, across all VMs.

And related to the KB/M issue, dom0 doesn’t return anything interesting in the journal, but the usb vm’s journal did provide that qubes-input-sender-keyboard@event#.service and qubes-input-sender-mouse@event#.service are in failed state, and are also returning Request refused.

So what could be the deal here; it is across all VMs, I wonder if it is related to my recent changes to /etc/default/grub.

9
10

Most likely you have an error in one of the policy files.
Check the files in /etc/qubes/policy that you have edited
Most likely you have an error in one of the policy files.
Check any policy files you have edited.

Run journalctl in the usb vm and check status - you should see why
they failed.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.