Well it did do so for a while and now no longer does (even though I checked start on startup). Apparently it’s being started by a systemctl job, but that now fails.
More disturbing to me is that until it starts my mouse is frozen (not surprising) but then it asks for permission before controlling the mouse! That works on my laptop (which has a built in keyboard and touchpad that’s not USB, so I can say “OK”). But it had better not do that on my desktop as I will have no way to activate the OK button.
As for permission to run mouse, go to Q menu, cog wheel menu, Qubes Tools, Qubes OS Global Config, USB Device tab.
Switch Keyboard: and Mouse: from always ask to enable.
As for sys-usb not autostarting it might be trouble with device connected to sys-usb, maybe trouble with PCI usb device driver.
I could…but this time it worked! No idea what the difference could be.
OK, this plus what @KitsuneNoBaka said is enormously helpful. (Or in your case would be, if only it would stay broken )
My last concern is what if my desktop ends up in the same mode…no way to go into the settings gui and tell it don’t ask since all input devices are through USB. There’s probably something done during installation to prevent this, do you happen to know what that is?
If not, there’s a workaround I already know about: I tested the following on my laptop…add “qubes.skip_autostart” to grub AND (new for 4.3 apparently) remove rd.qubes_hide_all_usb from grub.
(It makes sense because unlike before, the devices are hidden before sys-usb even starts! Safer that way but you have to know to remove that parameter from GRUB.)
Anyway, if it breaks again I will run those commands and post them here.
SO…one more thing. If I build my own sys-usb from a minimal template, is there ANYTHING I need to do differently in 4.3 versus 4.2 or even 4.1?
× qubes-vm@sys-usb.service - Start Qubes VM sys-usb
Loaded: loaded (/usr/lib/systemd/system/qubes-vm@.service; enabled; preset: disabled)
Drop-In: /usr/lib/systemd/system/service.d
└─10-timeout-abort.conf, 50-keep-warm.conf
Active: failed (Result: exit-code) since Sat 2026-06-20 16:57:22 MDT; 9min ago
Invocation: c47da29d69524af29795dd11a13991ce
Process: 3868 ExecStart=/usr/bin/qvm-start --skip-if-running -- sys-usb (code=exited, status=1/FAILURE)
Main PID: 3868 (code=exited, status=1/FAILURE)
Mem peak: 12.4M
CPU: 227ms
Jun 20 16:56:03 dom0 systemd[1]: Starting qubes-vm@sys-usb.service - Start Qubes VM sys-usb...
Jun 20 16:57:22 dom0 qvm-start[3868]: Error: Cannot connect to qrexec agent for 60 seconds, see /var/log/xen/console/guest-sys-usb.log for details
Jun 20 16:57:22 dom0 systemd[1]: qubes-vm@sys-usb.service: Main process exited, code=exited, status=1/FAILURE
Jun 20 16:57:22 dom0 systemd[1]: qubes-vm@sys-usb.service: Failed with result 'exit-code'.
Jun 20 16:57:22 dom0 systemd[1]: Failed to start qubes-vm@sys-usb.service - Start Qubes VM sys-usb.
and journalctl output
Jun 20 16:56:03 dom0 systemd[1]: Starting qubes-vm@sys-usb.service - Start Qubes VM sys-usb...
░░ Subject: A start job for unit qubes-vm@sys-usb.service has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A start job for unit qubes-vm@sys-usb.service has begun execution.
░░
░░ The job identifier is 349.
Jun 20 16:57:22 dom0 qvm-start[3868]: Error: Cannot connect to qrexec agent for 60 seconds, see /var/log/xen/console/guest-sys-usb.log for details
Jun 20 16:57:22 dom0 systemd[1]: qubes-vm@sys-usb.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ An ExecStart= process belonging to unit qubes-vm@sys-usb.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Jun 20 16:57:22 dom0 systemd[1]: qubes-vm@sys-usb.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ The unit qubes-vm@sys-usb.service has entered the 'failed' state with result 'exit-code'.
Jun 20 16:57:22 dom0 systemd[1]: Failed to start qubes-vm@sys-usb.service - Start Qubes VM sys-usb.
░░ Subject: A start job for unit qubes-vm@sys-usb.service has failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A start job for unit qubes-vm@sys-usb.service has finished with a failure.
░░
░░ The job identifier is 349 and the job result is failed.
Make a copy of this file for each boot. Compare the good and bad ones… especially the last parts. You are either looking for error/fail/timeout/etc or for some long process that does not complete.
Just one idea: did you possibly keep your sys-usb from 4.2, and make a new one? If both are on AutoStart, then they will race to win the USB controller, but only one named"sys-usb" can be useful. So works/not works depends on who wins.
[added in edit…]
Another idea: if you see sys-usb runs until qrexec-timeout, is it doing some housekeeping? You can increase the timeout, so it gets to finish:
Will give your suggestion to increase memory a try.
The problem is intermittent, so I won’t know for certain for a while. (Fortunately on that box, I can just start sys-usb if it doesn’t start on its own. I am a bit more worried about my desktop system though–keyboard and mouse belong to sys-usb on that, so upgrading that one could cause real issues.)
Try cloning sys-usb and changing the kernel in advanced as well as removing some of the USB pci in devices tab. I had an issue where my usb 2.0 port combined with newer kernel gave autostart issues. Basically try to narrow down the cause.
You could also try an addtl pci USB card if you have one
For the desktop case I would prepare the escape path before upgrading: make sure you know how to boot one GRUB entry where USB hiding/autostart is disabled, and test it once while you still have working input. Otherwise you can end up debugging the correct sys-usb problem but without any way to click the policy prompt. Keeping a separate minimal sys-usb clone for testing also makes it easier to switch kernel/RAM/PCI assignments without breaking the known-good one.
An update on all of this. Increasing my sys-usb memory to 600MB on my laptop seems to work; at least it hasn’t failed yet.
I just upgraded to 4.3 on my desktop but specifically did NOT have it build sys-usb (yeah, that makes me a coward I suppose). And that system doesn’t even see my printer–it doesn’t evens show notification balloons when I unplug it / plug it back in. Nor does anything at all show when I run qvm-usb; even when I have thumb drives plugged in [which the system can see just fine]. I wonder if “rd.qubes_hide_all_usb” is set even so (will check it this evening); that would likely explain what’s going on and creating sys-usb will fix it.
It appears that thumbdrives and other block storage are treated one way, keyboard and mouse another (they are allowed to function), and printers are just masked without sys-usb being there.
[If I am wrong about rd.qubes_hide_all_usb, then I’d be interested to know how to undo that even though I plan to do sys-usb…if I can undo it, I can wait til next week to create sys-usb, otherwise I’m in a time crunch to do that.]
Another thing I can check before taking the sys-usb plunge is whether my laptop can see the printer or not. If so I can probably do the one or two urgent things (scanning documents) on my laptop tonight
)