On Monday, October 10, 2016 at 4:09:04 PM UTC-4, [email protected] wrote: > On Monday, October 10, 2016 at 3:26:16 PM UTC-4, [email protected] wrote: > > On Monday, October 10, 2016 at 1:08:10 AM UTC-4, David Shleifman wrote: > > > The PC system has 2 USB hubs: the first one is used for USB jacks on the > > > front panel, the second one is used for USB jacks on the rear panel. Each > > > hub has 3 controllers: > > > front.OHCI0 handles first 3 USB 1.1 devices that are plugged in (nothing > > > at the moment) > > > front.OHCI1 handles next 3 USB 1.1 devices that are plugged in (nothing > > > at the moment) > > > front.EHCI0 handles up to 6 USB 2.0 devices that are plugged in (DVD-RW > > > drive and flash stick at the moment) > > > rear.OHCI0 handles first 3 USB 1.1 devices that are plugged in (USB > > > keyboard and USB mouse are plugged in persistently) > > > > > > rear.OHCI1 handles next 3 USB 1.1 devices that are plugged in (nothing at > > > the moment) > > > > > > rear.EHCI0 handles up to 6 USB 2.0 devices that are plugged in (Web > > > camera, and CD-RW drive are plugged in persistently) > > > I followed the recommendation at > > > https://www.qubes-os.org/doc/usb/#creating-and-using-a-usb-qube. After > > > running > > > [dom0]$ qubesctl top.enable qvm.sys-usb > > > > > > [dom0]$ qubesctl state.highstate > > > > > > all 6 controllers have been assigned to sys-usb qube. It looks like a > > > very bad idea to mix security sensitive devices such as keyboard/mouse > > > with other devices. Where do I go from this point? > > > > > > A) Split controllers into two groups and assign each group to a different > > > sys-usb qube? Keyboard/mouse shall end up in a first group, while other > > > devices shall end up in the second group. Is this break down in line > > > with the security guidelines (see https://www.qubes-os.org/doc/usb/)? > > > > > > > > > B) Stay with a single sys-usb qube and assign rear.OHCI0 controller back > > > to dom0? Do > > > I need to remove "sys-usb dom0 ask" from > > > /etc/qubes-rpc/policy/qubes.InputKeyboard? Do I need to remove > > > GRUB_CMDLINE_LINUX rd.qubes.hide_all_usb from /etc/default/grub ? How to > > > instruct GRUB to hide all controllers except rear.OHCI0 ? > > > > look at finding right usb controller. > > https://www.qubes-os.org/doc/assigning-devices/ > > > > If really worried about using a usb keyboard you can use a ps2 one, or get > > a usb to ps2 adapter. > > I don't think you really have 6 controllers do you? its probably only three. > ohci0, ohci1, and ehci0 On mine I have only two echi's. one is for the > two low speed ports, next to the ps2 port which i use for mouse and keyboard, > and is assigned to dom0. The other controller is for everything else I have > in sys-usb. > > On another machine with xhvi (usb3.0) everything gets routed through that > one controller. the two ehvi controllers get routed through the usb 3.0 > making a single controller not 3. so its either use the two controllers the > same way I have on this box with xhvi disabled, or enable it then only > having a single controller if wanting 3.0 speeds (using the qubes input > proxy). To get 3 controllers to have seperates usb 2.0 and usb 3.0 you > need to find a lga 2011 socket mobo, like an x99, and make sure the bios > supports the manual routing feature. > > But I haven't tested the new ability to assign separate pci devices now in > the new qubes 3.2. Maybe this changes things?
again though on my one machine i opted to have a single controller so I can have 3.0 speeds, and use a usb to pci adapter for the keyboard. I'm not as concerned about the mouse, at least I hope I don't have to be lol. I use the lockscreen. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/bb7a6a04-b13a-4d9e-a602-72910f712ba0%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
