Hotplug with multiple arduino boards only shows a single slot

[Merlijn Sebrechts]

When I plug in multiple arduino boards, I still only get one slot: core:usb20-serial. When I try to flash them from the arduino IDE, one of them randomly gives a “permission denied” error. In general, the last one you plug in is the one you can access, but sometimes it changes.

This is how the devices are show in lsusb:

    Bus 001 Device 011: ID 1a86:7523 QinHeng Electronics HL-340 USB-Serial adapter
    Bus 001 Device 010: ID 1a86:7523 QinHeng Electronics HL-340 USB-Serial adapter

This is how it's auto-connected to the arduino snap:

    $ snap connections arduino
    Interface Plug Slot Notes
    content[gtk-2-engines] arduino:gtk-2-engines gtk2-common-themes:gtk-2-engines -
    content[gtk-2-themes] arduino:gtk-2-themes gtk-common-themes:gtk-2-themes -
    content[icon-themes] arduino:icon-themes gtk-common-themes:icon-themes -
    content[sound-themes] arduino:sound-themes gtk-common-themes:sound-themes -
    home arduino:home :home -
    network arduino:network :network -
    network-bind arduino:network-bind :network-bind -
    raw-usb arduino:raw-usb :raw-usb manual
    removable-media arduino:removable-media - -
    serial-port arduino:serial-port :usb20-serial -
    unity7 arduino:unity7 :unity7 -
    x11 arduino:x11 :x11 -

    $ snap interface serial-port
    name: serial-port
    summary: allows accessing a specific serial port
    plugs:
    - arduino
    - s4a
    slots:
    - snapd:usb20-serial (allows accessing a specific serial port)

Though they show up as /dev/ttyUSB0 and /dev/ttyUSB1

[Maciej Borzecki (maciek-borzecki)]

Can you run `udevadm monitor`, plug the boards and collect the log?

[Merlijn Sebrechts (merlijn-sebrechts)]

This is the output. I plugged in the first board, waited 10 seconds and then plugged in the second board and waited 10 seconds again

[Paweł Stołowski (stolowski)]

@Merlijn Could you please also attach the output of 'udevadm info -e' (run it with at least two boards attached, both should be visible in the output).

It appears that snapd is not able to identify devices and distinguish their instances, most likely a problem with computation of the unique device key.

[Merlijn Sebrechts (merlijn-sebrechts)]

Attached is the output of udevadm info -e

[Paweł Stołowski (stolowski)]

Thank you. Right, as suspected, the two serial ports there have identical serial number (1a86_USB2.0-Serial), which makes it impossible to distinguish them for hotplug in snapd. It is expected that this will be an issue with generic serialport adapters. I'm not sure if there is anything we can do about it short-term, this needs some thinking and discussion.

[Paweł Stołowski (stolowski)]

I was thinking about how to handle this, two ideas that we might consider, recording them here so we don't forget:
- at the very least detect a situation where multiple identical devices are present on plugging and do something, e.g. warn and ignore, prevent from “collapsing” into a single slot.
- maybe have a policy where usb device is tracked by its type and usb port where it was originally plugged, ignoring serial numbers and not trying to give them identities. That’s of course disputable and breaks the initial plan where you can re-plug device in a different port and have the slot updated. Such policy could be conditional and configurable per-interface, e.g. with a blacklist of known generic devices that don't have serial numbers.

[Merlijn Sebrechts (merlijn-sebrechts)]

Some of my thoughts:

- Given that traditionally very few things go wrong when two devices have the same serial number, I think you can expect _many_ devices to have this issue.
- There is very little a user can do when multiple devices have the same serial number. Apart from the manufacturers themselves, few people will be able to "fix" this issue with their hardware.

This leads me to believe that whatever method you choose, it's important to support this use-case well. Otherwise, this interface introduces a major regression when compared to an unconfined application. In this context, a blacklist doesn't seem ideal, since it will never be complete, and a user has to contact a snapd developer in order to get something working that "worked before".

If I understand it correctly, the serial number is the only way to uniquely identify a device, right? In that case, I think it makes sense to treat these devices with the same security profiles. So instead of the app having access to one of the devices at random (as it is now), the app should simply have access to both of them.

The alternative of using the port as part of the unique identifier
1. doesn't add much security since an attacker could simply plug their device in the same port
2. has the potential to add a lot of confusion. "My app only sees my device when it is plugged in port X" would confuse me a lot.