From b956d6f5f5332afcb628b3084f17a4835fe6036f Mon Sep 17 00:00:00 2001 From: deeplow Date: Sat, 26 Sep 2020 15:47:17 -0400 Subject: [PATCH 01/27] move QWT instructions and make them step-by-step --- external/os-guides/windows/windows-tools.md | 75 ++++++++++++++++++--- external/os-guides/windows/windows-vm.md | 45 ------------- 2 files changed, 67 insertions(+), 53 deletions(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 345c1fd7..d313175a 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -19,22 +19,34 @@ Qubes Windows Tools Qubes Windows Tools are a set of programs and drivers that provide integration of Windows AppVMs with the rest of the Qubes system. Currently the following features are available for Windows VMs after installation of those tools: -- Seamless GUI mode that integrates apps windows onto the common Qubes trusted desktop -- Support for [secure clipboard copy/paste](/doc/copy-paste/) between the Windows VM and other AppVMs -- Support for [secure file exchange](/doc/copying-files/) between the Windows VM and other AppVMs -- Support for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) -- Xen PV drivers for Windows that increase performance compared to qemu emulated devices +- **Qubes Video Driver** - provides for the Seamless GUI mode that integrates apps windows onto the common Qubes trusted desktop +- **File sender/receiver** - Support for [secure clipboard copy/paste](/doc/copy-paste/) between the Windows VM and other AppVMs +- ***File sender/receiver** - Support for [secure file exchange](/doc/copying-files/) between the Windows VM and other AppVMs +- **Copy/Edit in Dipostable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) +- **Xen PV drivers** for Windows that increase performance compared to qemu emulated devices + +Bellow is a breakdown of the feature availablility depending on the windows version: + +| Feature | Windows 7 x64 | Windows 10 x64 | +| ------------------------------------ | :------------: | :------------: | +| Qubes Video Driver | + | - | +| Qubes Network Setup | + | + | +| Private Volume Setup (move profiles) | + | + | +| File sender/receiver | + | + | +| Clipboard Copy/Paste | + | + | +| Application shortcuts | + | + | +| Copy/Edit in Disposible VM | + | + | +| Block device | + | + | +| USB device | - | - | +| Audio | - | - | Qubes Windows Tools are open source and are distributed under a GPL license. NOTES: - Qubes Windows Tools are currently unmaintained - Currently only 64-bit versions of Windows 7 are supported by Qubes Windows Tools. Only emulated SVGA GPU is supported (although [there has been reports](https://groups.google.com/forum/#!topic/qubes-users/cmPRMOkxkdA) on working GPU passthrough). -- There is currently no audio support for Windows HVMs. -- There is currently no USB pass-through support for Windows HVMs. - __This page documents the process of installing Qubes Windows Tools on versions up to R3.2.__. Installation on Qubes R4.0 is possible but is a work in progress and there are limitations/bugs (see [issue #3585](https://github.com/QubesOS/qubes-issues/issues/3585)). - Installing Windows OS in a Qubes VM ----------------------------------- @@ -42,6 +54,51 @@ Please refer to [this page](/doc/windows-vm/) for instructions on how to install NOTE: It is strongly suggested to enable autologon for any Windows HVMs that will have Qubes Tools installed. To do so, run `netplwiz` command from the `Win+R`/Start menu and uncheck the *Users must enter a user name and password to use this computer* option. +Installing Qubes guest tools in Windows 10 VMs +---------------------------------------------- + +This will allow you to installs the Qubes Windows Tools on Windows 10 both as a StandaloneVM as well as a template VM and a corresponding AppVM. But some features are not available: + +TODO available features + + 1. In the Windows 10 VM, download from the [XEN website](https://xenproject.org/downloads/windows-pv-drivers/windows-pv-drivers-9-series/windows-pv-drivers-9-0-0/) the installation kits for Xen bus (`xenbus`) and storage drivers (`xenvbd`) Version 9.0.0 (two files`xenvbd.tar`and `xenbus.tar`). + + 2. Use an archive extractor like [7-zip](https://www.7-zip.org/) to extract the contents of the `.tar` files. + + 3. - Install `xenvbd` and `xenbus` by starting the file `dpinst.exe` from the `x64` directories of the extracted tar-files. If during installation, the Xen driver requests a reboot, select "No" and let the installation continue. + + 4. After installation, reboot. + + 5. Download the Qubes Windows Tools (`qubes-tools-4.0.1.3.exe`) from [the qubes FTP server](TODO add ftp link) and move it to `C:\`. + + 6. Check the integrity of the file `qubes-tools-4.0.1.3.exe`by comparing its hash checksum. This can be done using the Windows command `certutil` on the windows command prompt (`cmd.exe`) and specifying an appropriate hash algorithm like: + + certutil --hashfile C:\qubes-tools-4.0.1.3.exe SHA256 + + And compare it the value to `148A2A993F0C746B48FA6C5C9A5D1B504E09A7CFBA3FB931A4DCF86FDA4EC9B1` (**it has to exactly match for security reasons**). If it matches, feel free to continue the installation. If not, repeat the download to make sure it was not corrupted due to a network problem. If keeps on not matching it might be an attacker attempting to do something nasty to your system -- Ask for support. + + > **Note**: this is a workaround for installing the qubes windows tools on windows 10 since the standard way is broken. + + 7. Install Qubes Windows Tools 4.0.1.3 by starting `qubes-tools-4.0.1.3.exe`, not selecting the `Xen PV disk drivers` and the `Move user profiles` (which would probably lead to problems in Windows, anyhow). If during installation, the Xen driver requests a reboot, select "No" and let the installation continue - the system will be rebooted later. + + 8. Shut down Windows. + + 9. On a `dom0` terminal write: *(where `` is the name of your Windows 10 VM)* + + `qvm-features gui 1` + + 10. Reboot Windows. If the VM starts, but does not show any window then shutdown Windows from the Qube manager and reboot Windows once more. + + 11. Now the system should be up, with QWT running correctly. + + 12. Lastly to enable file copy operations to a Windows 10 VM the `default_user` property should be set the `` that you use to login to the Windows VM. This can be done via the following command on a `dom0` terminal: *(where `` is the name of your Windows 10 VM)* + + qvm-prefs win10 default_user + + > **Note:** If this property is not set or set to a wrong value, files copied to this VM are stored in the folder `C:\Windows\System32\config\systemprofile\Documents\QubesIncoming\`. + > If the target VM is an AppVM, this has the consequence that the files are stored in the corresponding TemplateVM and so are lost on AppVM shutdown. + + Installing Qubes guest tools in Windows 7 VMs --------------------------------------------- @@ -94,6 +151,8 @@ qvm-prefs -s qrexec_timeout 300 Using Windows AppVMs in seamless mode ------------------------------------- +> **Note:** This feature is only available for Windows 7 + Once you start a Windows-based AppVM with Qubes Tools installed, you can easily start individual applications from the VM (note the `-a` switch used here, which will auto-start the VM if it is not running): ~~~ diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 59de22f5..59b6e28c 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -211,51 +211,6 @@ qvm-prefs win7new qrexec_timeout 300 At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](#xen-pv-drivers-and-qubes-windows-tools) below). It is a good time to clone the VM again. -### Installing Qubes Windows Tools on Windows 10 - -If the Xen bus and storage drivers version 9.0.0 are installed in a Windows 10 system without Qubes Windows Tools, and QWT 4.0.1.3 are installed after the Xen installation has finished, the Qubes interface works correctly. Files can be exchanged with other VMs, and the common clipboard works in both directions. - -The installation of Qubes Windows Tools should **not** be done by using the parameter `--install-windows-tools`or by directly specifying `--cdrom=...`when starting the Windows VM, as this is bound to crash the VM on booting, showing the error `INACCESSIBLE BOOT DEVICE`- which makes no sense, but does happen. - -So to get a working Windows 10 system (Standalone or Template VM) under Qubes R4.0, the following steps should be performed: - -**to be replaced** -- Install Qubes Windows Tools in dom0: `sudo qubes-dom0-update qubes-windows-tools`. The iso will be the file `/usr/lib/qubes/qubes-windows-tools-4.0.1.3.iso`. -- Copy this file to some AppVM: `qvm-copy-to-vm VMname /usr/lib/qubes/qubes-windows-tools-4.0.1.3.iso`. -- In this VM, extract the file `qubes-tools-4.0.1.3.exe` from the iso, using the archive manager. -- Copy the installation kits of `xenvbd` and `xenbus` Version 9.0.0 (two Zip-files) from the Xen web site and the file `qubes-tools-4.0.1.3.exe` to the Windows system drive (normally `C:\`.) -**end of replaced text** - -**new text** -- In the Windows 10 VM, download the installation kits of `xenvbd` and `xenbus` Version 9.0.0 (two files`xenvbd.tar`and `xenbus.tar`) from the Xen web site and the file `qubes-tools-4.0.1.3.exe` from https://www.qubes-os.org/doc/windows-tools/ **enter the final url** and store them on the Windows system drive (normally `C:\`.) In order to extract the contents from the tar-archives, you will need an external utility like 7zip. -**end of new text** - -- Check the integrity of the file `qubes-tools-4.0.1.3.exe`by comparing its hash checksum. This can be done using the Windows command `certutil` specifying an appropriate hash algorithm like: -~~~ -certutil --hashfile qubes-tools-4.0.1.3.exe SHA256 -~~~ -This utility supports the algorithms MD5, SHA1, SHA256 and SHA512 (to be entered in uppercase!). The correct hash values can be retrieved from the Qubes website: https://www.qubes-os.org/doc/windows-tools/ **enter the final url** - -- Install `xenvbd` and `xenbus` version 9.0.0 by starting the file `dpinst.exe` from the `x64` directories of the extracted tar-files. If during installation, the Xen driver requests a reboot, select "No" and let the installation continue. -- After installation, reboot. -- Install Qubes Windows Tools 4.0.1.3 by starting `qubes-tools-4.0.1.3.exe`, not selecting the `Xen PV disk drivers` and the `Move user profiles` (which would probably lead to problems in Windows, anyhow). If during installation, the Xen driver requests a reboot, select "No" and let the installation continue - the system will be rebooted later. -- Shut down Windows. -- Set `qvm-features win10new gui 1` -- Reboot Windows. The VM starts, but does not show any window. -- Shutdown Windows from the Qube manager. -- Reboot Windows once more. Now the system is up, with QWT running correctly. - -For me, this sequence worked for Windows 10 as template VM, and a corresponding AppVM worked too. - -File copy operations to a Windows 10 VM are possible, if the Qubes OS `default_user` property is set to the user name used for access to that VM, which can be done via the command -~~~ -qvm-prefs default_user -~~~ -If this property is not set or set to a wrong value, files copied to this VM are stored in the folder -~~~ -C:\Windows\System32\config\systemprofile\Documents\QubesIncoming\ -~~~ -If the target VM is an AppVM, this has the consequence that the files are stored in the corresponding TemplateVM and so are lost on AppVM shutdown. Windows as TemplateVM --------------------- From 57f8bcf59b91c3fc2dccb742730c23785f3e6d39 Mon Sep 17 00:00:00 2001 From: deeplow Date: Sat, 26 Sep 2020 15:54:46 -0400 Subject: [PATCH 02/27] moved xen drivers and QWT info to windows-tools.md --- external/os-guides/windows/windows-tools.md | 30 +++++++++++++++++++++ external/os-guides/windows/windows-vm.md | 30 --------------------- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index d313175a..58cbba60 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -148,6 +148,36 @@ NOTE: it is recommended to increase the default value of Windows VM's `qrexec_ti qvm-prefs -s qrexec_timeout 300 ~~~ +Xen PV drivers and Qubes Windows Tools +-------------------------------------- + +Installing Xen's PV drivers in the VM will lower its resources usage when using network and/or I/O intensive applications, but *may* come at the price of system stability (although Xen's PV drivers on a Win7 VM are usually very stable). There are two ways of installing the drivers: + +1. installing the drivers independently, from Xen's [official site](https://www.xenproject.org/developers/teams/windows-pv-drivers.html) +2. installing Qubes Windows Tools (QWT), which bundles Xen's PV drivers. + +Notes about using Xen's VBD (storage) PV driver: +- **Windows 7:** installing the driver requires a fully updated VM or else you'll likely get a BSOD and a VM in a difficult to fix state. Updating Windows takes *hours* and for casual usage there isn't much of a performance between the disk PV driver and the default one; so there is likely no need to go through the lengthy Windows Update process if your VM doesn't have access to untrusted networks and if you don't use I/O intensive apps. If you plan to update your newly installed Windows VM it is recommended that you do so *before* installing Qubes Windows Tools (QWT). If QWT are installed, you should temporarily re-enable the standard VGA adapter in Windows and disable Qubes' (see the section above). +- the option to install the storage PV driver is disabled by default in Qubes Windows Tools +- in case you already had QWT installed without the storage PV driver and you then updated the VM, you may then install the driver from Xen's site (xenvbd.tar). + +**Caution:** Installing the version 9.0.0 Xen drivers on Windows 7 (a system without QWT - QWT uninstalled) leads to an unbootable system. The drivers install without error, but after reboot, the system aborts the reboot saying ´Missing driver xenbus.sys´. + +- **Windows 10:** The version 9.0.0 Xen drivers have to be installed before installing Qubes Windows Tools. Installing them on a system with QWT installed is likely to produce a system which crashes or has the tools in a non-functional state. Even if the tools were installed and then removed before installing the Xen drivers, they probably will not work as expected. + + +Installing Qubes Windows Tools: +- on R3.2: see [this page](/doc/windows-tools/) +- R4.0: you'll have to install QWT for Qubes R3.2. Be warned that QWT on R4.0 is a work in progress though (see [issue #3585](https://github.com/QubesOS/qubes-issues/issues/3585) for instructions and known issues). + + +With Qubes Windows Tools installed the early graphical console provided in debugging mode isn't needed anymore since Qubes' display driver will be used instead of the default VGA driver: + +~~~ +qvm-prefs -s win7new debug false +~~~ + + Using Windows AppVMs in seamless mode ------------------------------------- diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 59b6e28c..1ac220b6 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -252,36 +252,6 @@ Note: if you already have Qubes Windows Tools installed the video adapter in Win To avoid guessing the VM's state enable debugging (`qvm-prefs -s win7new debug true`) and in Windows' device manager (My computer -> Manage / Device manager / Display adapters) temporarily re-enable the standard VGA adapter and disable "Qubes video driver". You can disable debugging and revert to Qubes' display once the VM is updated. -Xen PV drivers and Qubes Windows Tools ------------------------------------- - -Installing Xen's PV drivers in the VM will lower its resources usage when using network and/or I/O intensive applications, but *may* come at the price of system stability (although Xen's PV drivers on a Win7 VM are usually very stable). There are two ways of installing the drivers: - -1. installing the drivers independently, from Xen's [official site](https://www.xenproject.org/developers/teams/windows-pv-drivers.html) -2. installing Qubes Windows Tools (QWT), which bundles Xen's PV drivers. - -Notes about using Xen's VBD (storage) PV driver: -- **Windows 7:** installing the driver requires a fully updated VM or else you'll likely get a BSOD and a VM in a difficult to fix state. Updating Windows takes *hours* and for casual usage there isn't much of a performance between the disk PV driver and the default one; so there is likely no need to go through the lengthy Windows Update process if your VM doesn't have access to untrusted networks and if you don't use I/O intensive apps. If you plan to update your newly installed Windows VM it is recommended that you do so *before* installing Qubes Windows Tools (QWT). If QWT are installed, you should temporarily re-enable the standard VGA adapter in Windows and disable Qubes' (see the section above). -- the option to install the storage PV driver is disabled by default in Qubes Windows Tools -- in case you already had QWT installed without the storage PV driver and you then updated the VM, you may then install the driver from Xen's site (xenvbd.tar). - -**Caution:** Installing the version 9.0.0 Xen drivers on Windows 7 (a system without QWT - QWT uninstalled) leads to an unbootable system. The drivers install without error, but after reboot, the system aborts the reboot saying ´Missing driver xenbus.sys´. - -- **Windows 10:** The version 9.0.0 Xen drivers have to be installed before installing Qubes Windows Tools. Installing them on a system with QWT installed is likely to produce a system which crashes or has the tools in a non-functional state. Even if the tools were installed and then removed before installing the Xen drivers, they probably will not work as expected. - - -Installing Qubes Windows Tools: -- on R3.2: see [this page](/doc/windows-tools/) -- R4.0: you'll have to install QWT for Qubes R3.2. Be warned that QWT on R4.0 is a work in progress though (see [issue #3585](https://github.com/QubesOS/qubes-issues/issues/3585) for instructions and known issues). - - -With Qubes Windows Tools installed the early graphical console provided in debugging mode isn't needed anymore since Qubes' display driver will be used instead of the default VGA driver: - -~~~ -qvm-prefs -s win7new debug false -~~~ - - Further customization --------------------- From 843f24bf549d62df65ef7818b6e23c4f8a6ebb20 Mon Sep 17 00:00:00 2001 From: deeplow Date: Sat, 26 Sep 2020 15:56:56 -0400 Subject: [PATCH 03/27] remove self-referencing note --- external/os-guides/windows/windows-tools.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 58cbba60..86fff9c7 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -166,11 +166,6 @@ Notes about using Xen's VBD (storage) PV driver: - **Windows 10:** The version 9.0.0 Xen drivers have to be installed before installing Qubes Windows Tools. Installing them on a system with QWT installed is likely to produce a system which crashes or has the tools in a non-functional state. Even if the tools were installed and then removed before installing the Xen drivers, they probably will not work as expected. -Installing Qubes Windows Tools: -- on R3.2: see [this page](/doc/windows-tools/) -- R4.0: you'll have to install QWT for Qubes R3.2. Be warned that QWT on R4.0 is a work in progress though (see [issue #3585](https://github.com/QubesOS/qubes-issues/issues/3585) for instructions and known issues). - - With Qubes Windows Tools installed the early graphical console provided in debugging mode isn't needed anymore since Qubes' display driver will be used instead of the default VGA driver: ~~~ From 00dd431397e758a5eb36f250d949024e57f1547a Mon Sep 17 00:00:00 2001 From: deeplow <47065258+deeplow@users.noreply.github.com> Date: Sat, 26 Sep 2020 21:09:18 +0000 Subject: [PATCH 04/27] formatting typo --- external/os-guides/windows/windows-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 86fff9c7..47cbf11d 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -65,7 +65,7 @@ TODO available features 2. Use an archive extractor like [7-zip](https://www.7-zip.org/) to extract the contents of the `.tar` files. - 3. - Install `xenvbd` and `xenbus` by starting the file `dpinst.exe` from the `x64` directories of the extracted tar-files. If during installation, the Xen driver requests a reboot, select "No" and let the installation continue. + 3. Install `xenvbd` and `xenbus` by starting the file `dpinst.exe` from the `x64` directories of the extracted tar-files. If during installation, the Xen driver requests a reboot, select "No" and let the installation continue. 4. After installation, reboot. From 7897944c942461aff42cfae04f9f2e04bcd7fcde Mon Sep 17 00:00:00 2001 From: deeplow <47065258+deeplow@users.noreply.github.com> Date: Sat, 26 Sep 2020 21:10:08 +0000 Subject: [PATCH 05/27] formatting typo --- external/os-guides/windows/windows-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 47cbf11d..027270b8 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -85,7 +85,7 @@ TODO available features 9. On a `dom0` terminal write: *(where `` is the name of your Windows 10 VM)* - `qvm-features gui 1` + qvm-features gui 1 10. Reboot Windows. If the VM starts, but does not show any window then shutdown Windows from the Qube manager and reboot Windows once more. From aaad075a794220b016ab1b1d54540f6bf203373e Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 27 Sep 2020 13:27:13 +0200 Subject: [PATCH 06/27] Update windows-vm.md --- external/os-guides/windows/windows-vm.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 1ac220b6..865676d2 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -119,7 +119,7 @@ MS Windows versions considerations: - The instructions *may* work on other versions than Windows 7 x64 but haven't been tested. - Qubes Windows Tools (QWT) only supports Windows 7 x64. Note that there are [known issues](https://github.com/QubesOS/qubes-issues/issues/3585) with QWT on Qubes 4.x -- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described below. +- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [https://www.qubes-os.org/doc/windows-tools/](https://www.qubes-os.org/doc/windows-tools/). Create a VM named win7new in [HVM](/doc/hvm/) mode (Xen's current PVH limitations precludes from using PVH): @@ -217,8 +217,7 @@ Windows as TemplateVM Windows 7 and 10 can be installed as TemplateVM by selecting ~~~ -qvm-create --class TemplateVM --property virt_mode=HVM --property kernel='' --label black Windows-7 -qvm-create --class TemplateVM --property virt_mode=HVM --property kernel='' --label black Windows-10 +qvm-create --class TemplateVM --property virt_mode=HVM --property kernel='' --label black Windows-template ~~~ when creating the VM. To have the user data stored in AppVMs depending on this template, Windows 7 and 10 have to be treated differently: From 55587a3493d96f99e8b62939a28d01a0adfbc912 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 27 Sep 2020 13:27:38 +0200 Subject: [PATCH 07/27] Update windows-tools.md --- external/os-guides/windows/windows-tools.md | 25 ++++++++++++--------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 027270b8..5d01c4e4 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -44,7 +44,7 @@ Qubes Windows Tools are open source and are distributed under a GPL license. NOTES: - Qubes Windows Tools are currently unmaintained -- Currently only 64-bit versions of Windows 7 are supported by Qubes Windows Tools. Only emulated SVGA GPU is supported (although [there has been reports](https://groups.google.com/forum/#!topic/qubes-users/cmPRMOkxkdA) on working GPU passthrough). +- Currently only 64-bit versions of Windows 7 and Windows 10 are supported by Qubes Windows Tools. Only emulated SVGA GPU is supported (although [there has been reports](https://groups.google.com/forum/#!topic/qubes-users/cmPRMOkxkdA) on working GPU passthrough). - __This page documents the process of installing Qubes Windows Tools on versions up to R3.2.__. Installation on Qubes R4.0 is possible but is a work in progress and there are limitations/bugs (see [issue #3585](https://github.com/QubesOS/qubes-issues/issues/3585)). Installing Windows OS in a Qubes VM @@ -57,9 +57,9 @@ NOTE: It is strongly suggested to enable autologon for any Windows HVMs that wil Installing Qubes guest tools in Windows 10 VMs ---------------------------------------------- -This will allow you to installs the Qubes Windows Tools on Windows 10 both as a StandaloneVM as well as a template VM and a corresponding AppVM. But some features are not available: +This will allow you to install the Qubes Windows Tools on Windows 10 both as a StandaloneVM as well as a Template VM and a corresponding AppVM. But some features are not available: -TODO available features +TODO available features - **not available: seamless mode - others?** 1. In the Windows 10 VM, download from the [XEN website](https://xenproject.org/downloads/windows-pv-drivers/windows-pv-drivers-9-series/windows-pv-drivers-9-0-0/) the installation kits for Xen bus (`xenbus`) and storage drivers (`xenvbd`) Version 9.0.0 (two files`xenvbd.tar`and `xenbus.tar`). @@ -92,8 +92,8 @@ TODO available features 11. Now the system should be up, with QWT running correctly. 12. Lastly to enable file copy operations to a Windows 10 VM the `default_user` property should be set the `` that you use to login to the Windows VM. This can be done via the following command on a `dom0` terminal: *(where `` is the name of your Windows 10 VM)* - - qvm-prefs win10 default_user + + `qvm-prefs default_user ` > **Note:** If this property is not set or set to a wrong value, files copied to this VM are stored in the folder `C:\Windows\System32\config\systemprofile\Documents\QubesIncoming\`. > If the target VM is an AppVM, this has the consequence that the files are stored in the corresponding TemplateVM and so are lost on AppVM shutdown. @@ -161,7 +161,7 @@ Notes about using Xen's VBD (storage) PV driver: - the option to install the storage PV driver is disabled by default in Qubes Windows Tools - in case you already had QWT installed without the storage PV driver and you then updated the VM, you may then install the driver from Xen's site (xenvbd.tar). -**Caution:** Installing the version 9.0.0 Xen drivers on Windows 7 (a system without QWT - QWT uninstalled) leads to an unbootable system. The drivers install without error, but after reboot, the system aborts the reboot saying ´Missing driver xenbus.sys´. +**Caution:** Installing the version 9.0.0 Xen drivers on Windows 7 (a system without QWT - QWT uninstalled) leads to an unbootable system. The drivers install without error, but after reboot, the system aborts the reboot saying `Missing driver xenbus.sys`. - **Windows 10:** The version 9.0.0 Xen drivers have to be installed before installing Qubes Windows Tools. Installing them on a system with QWT installed is likely to produce a system which crashes or has the tools in a non-functional state. Even if the tools were installed and then removed before installing the Xen drivers, they probably will not work as expected. @@ -217,7 +217,7 @@ Qubes allows HVM VMs to share a common root filesystem from a select Template VM In order to create a HVM TemplateVM one can use the following command, suitably adapted: ~~~ -qvm-create --class TemplateVM win7-x64-template --property virt_mode=HVM --property kernel='' -l green +qvm-create --class TemplateVM win-template --property virt_mode=HVM --property kernel='' -l green ~~~ ... , set memory as appropriate, and install Windows OS (or other OS) into this template the same way as you would install it into a normal HVM -- please see instructions on [this page](/doc/hvm-create/). @@ -227,7 +227,7 @@ If you use this Template as it is, then any HVMs that use it will effectively be If you want to retain the User directory between reboots, then it would make sense to store the `C:\Users` directory on the 2nd disk which is automatically exposed by Qubes to all HVMs. This 2nd disk is backed by the `private.img` file in the AppVMs' and is not reset upon AppVMs reboot, so the user's directories and profiles would survive the AppVMs reboot, unlike the "root" filesystem which will be reverted to the "golden image" from the Template VM automatically. To facilitate such separation of user profiles, Qubes Windows Tools provide an option to automatically move `C:\Users` directory to the 2nd disk backed by `private.img`. -It's a selectable feature of the installer, enabled by default. +It's a selectable feature of the installer, enabled by default, but working only for Windows 7. If that feature is selected during installation, completion of the process requires two reboots: - The private disk is initialized and formatted on the first reboot after tools installation. It can't be done **during** the installation because Xen mass storage drivers are not yet active. @@ -236,8 +236,13 @@ Reboot is required because the "mover utility" runs very early in the boot proce This can take some time depending on the profiles' size and because the GUI agent is not yet active dom0/Qubes Manager may complain that the AppVM failed to boot. That's a false alarm (you can increase AppVM's default boot timeout using `qvm-prefs`), the VM should appear "green" in Qubes Manager shortly after. -It also makes sense to disable Automatic Updates for all the template-based AppVMs -- of course this should be done in the Template VM, not in individual AppVMs, because the system-wide settings are stored in the root filesystem (which holds the system-wide registry hives). -Then, periodically check for updates in the Template VM and the changes will be carried over to any child AppVMs. +For Windows 10, the user directories have to be moved manually, because the automatic transfer during QWT installation is bound to crash due to undocumented new features of NTFS, and a system having the directory `users`on another disk than `C:` will break on Windows update. So the following steps should be taken: + +- The Windows disk manager may be used to add the private volume as disk `D:`, and you may, using the documented Windows operations, move the user directories `C:\users\\Documents` to this new disk, allowing depending AppVMs to have their own private volumes. Moving the hidden application directories `AppData`, however, is likely to invite trouble - the same trouble that occurs if, during QWT installation, the option `Move user profiles` is selected. + +- Configuration data like those stored in directories like `AppData` still remain in the TemplateVM, such that their changes are lost each time the AppVM shuts down. In order to make permanent changes to these configuration data, they have to be changed in the TemplateVM, meaning that applications have to be started there, which violates and perhaps even endangers the security of the TemplateVM. Such changes should be done only if absolutely necessary and with great care. It is a good idea to test them first in a cloned TemplateVM before applying them in the production VM. + +It also makes sense to disable Automatic Updates for all the template-based AppVMs -- of course this should be done in the Template VM, not in individual AppVMs, because the system-wide settings are stored in the root filesystem (which holds the system-wide registry hives). Then, periodically check for updates in the Template VM and the changes will be carried over to any child AppVMs. Once the template has been created and installed it is easy to create AppVMs based on it: From 52d62dd194a742352eef33f7d6a2484c6d429914 Mon Sep 17 00:00:00 2001 From: deeplow Date: Sun, 27 Sep 2020 15:26:45 -0400 Subject: [PATCH 08/27] remove TODO on feature availability --- external/os-guides/windows/windows-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 5d01c4e4..72640bad 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -59,7 +59,7 @@ Installing Qubes guest tools in Windows 10 VMs This will allow you to install the Qubes Windows Tools on Windows 10 both as a StandaloneVM as well as a Template VM and a corresponding AppVM. But some features are not available: -TODO available features - **not available: seamless mode - others?** +> **Note:** seamless mode is currently not available for windows. Please check the top of this document for the full feature availability breakdown. 1. In the Windows 10 VM, download from the [XEN website](https://xenproject.org/downloads/windows-pv-drivers/windows-pv-drivers-9-series/windows-pv-drivers-9-0-0/) the installation kits for Xen bus (`xenbus`) and storage drivers (`xenvbd`) Version 9.0.0 (two files`xenvbd.tar`and `xenbus.tar`). From c56ce62179ec3302d05f2118a772a59d995e8c05 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Mon, 28 Sep 2020 12:42:09 +0200 Subject: [PATCH 09/27] Update windows-vm.md --- external/os-guides/windows/windows-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 865676d2..f488d782 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -119,7 +119,7 @@ MS Windows versions considerations: - The instructions *may* work on other versions than Windows 7 x64 but haven't been tested. - Qubes Windows Tools (QWT) only supports Windows 7 x64. Note that there are [known issues](https://github.com/QubesOS/qubes-issues/issues/3585) with QWT on Qubes 4.x -- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [https://www.qubes-os.org/doc/windows-tools/](https://www.qubes-os.org/doc/windows-tools/). +- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Wndows Tools](/doc/windows-tools/). Create a VM named win7new in [HVM](/doc/hvm/) mode (Xen's current PVH limitations precludes from using PVH): From ab4ee0595379b010055b037641687f9c2bdbc28a Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Mon, 28 Sep 2020 12:42:22 +0200 Subject: [PATCH 10/27] Update windows-tools.md --- external/os-guides/windows/windows-tools.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 72640bad..90632698 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -25,7 +25,7 @@ Qubes Windows Tools are a set of programs and drivers that provide integration o - **Copy/Edit in Dipostable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) - **Xen PV drivers** for Windows that increase performance compared to qemu emulated devices -Bellow is a breakdown of the feature availablility depending on the windows version: +Below is a breakdown of the feature availablility depending on the windows version: | Feature | Windows 7 x64 | Windows 10 x64 | | ------------------------------------ | :------------: | :------------: | @@ -69,7 +69,7 @@ This will allow you to install the Qubes Windows Tools on Windows 10 both as a S 4. After installation, reboot. - 5. Download the Qubes Windows Tools (`qubes-tools-4.0.1.3.exe`) from [the qubes FTP server](TODO add ftp link) and move it to `C:\`. + 5. Download the Qubes Windows Tools (`qubes-tools-4.0.1.3.exe`) from [the qubes FTP server](https://ftp.qubes-os.org/qubes-windows-tools/) and move it to `C:\`. 6. Check the integrity of the file `qubes-tools-4.0.1.3.exe`by comparing its hash checksum. This can be done using the Windows command `certutil` on the windows command prompt (`cmd.exe`) and specifying an appropriate hash algorithm like: From afc2c29146a1d407723be6d40b82685242e25c1b Mon Sep 17 00:00:00 2001 From: PROTechThor Date: Fri, 2 Oct 2020 09:15:32 +0100 Subject: [PATCH 11/27] Consolidate UEFI Troubleshooting, move file --- doc.md | 2 +- .../installation-troubleshooting.md | 80 ------------------- .../uefi-troubleshooting.md | 55 ++++++++----- 3 files changed, 34 insertions(+), 103 deletions(-) delete mode 100644 user/troubleshooting/installation-troubleshooting.md rename user/{advanced-configuration => troubleshooting}/uefi-troubleshooting.md (87%) diff --git a/doc.md b/doc.md index 743c6477..f782dfe9 100644 --- a/doc.md +++ b/doc.md @@ -112,7 +112,6 @@ Core documentation for Qubes users. * [Making Any File Persistent Using `bind-dirs`](/doc/bind-dirs/) * [GUI Configuration](/doc/gui-configuration/) * [Resizing Disk Images](/doc/resize-disk-image/) - * [Troubleshooting UEFI](/doc/uefi-troubleshooting/) * [Troubleshooting Newer Hardware](/doc/newer-hardware-troubleshooting/) * [Mounting and Decrypting Qubes Partitions from Outside Qubes](/doc/mount-from-other-os/) * [KDE](/doc/kde/) @@ -122,6 +121,7 @@ Core documentation for Qubes users. ### Troubleshooting * [Installation Troubleshooting](/doc/installation-troubleshooting) + * [UEFI Troubleshooting](/doc/uefi-troubleshooting/) * [Home directory is out of disk space error](/doc/out-of-memory/) * [Installing on system with new AMD GPU (missing firmware problem)](https://groups.google.com/group/qubes-devel/browse_thread/thread/e27a57b0eda62f76) * [How to install an Nvidia driver in dom0](/doc/install-nvidia-driver/) diff --git a/user/troubleshooting/installation-troubleshooting.md b/user/troubleshooting/installation-troubleshooting.md deleted file mode 100644 index c54dd07d..00000000 --- a/user/troubleshooting/installation-troubleshooting.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -layout: doc -title: Installation Troubleshooting -permalink: /doc/installation-troubleshooting/ ---- -# Installation Troubleshooting # - -## "An unknown error has occured" error during installation ## - -Some people have encountered this error message when trying to install Qubes on drives that already have data on them. -The solution is to exit the installer, wipe all data or delete all partitions, then restart the Qubes installation. - -## Trouble installing from USB stick ## - -If you are facing issues when booting using UEFI mode, see the [UEFI troubleshooting guide](/doc/uefi-troubleshooting/). - -There are a variety of other problems that could arise when using a USB installation medium, and some of the issues can be fixed by doing one or more of the following: - -* **Use a different USB drive:** -If possible, try several drives of different sizes and formats. -This determines whether the problem stems from the flash drive or Qubes installer. -Some laptops cannot read from an external boot device larger than 8GB. -If you encounter a black screen when performing an installation from a USB stick, ensure you are using a USB drive less than 8GB, or a partition on that USB less than 8GB and of format FAT32. -* **Verify your Qubes ISO:** -Errors will occur if the Qubes installer is corrupted. -Ensure that the installer is correct and complete before writing it to a flash drive by [verifying the ISO](/security/verifying-signatures/#how-to-verify-qubes-iso-signatures). -* **Change the method you used to [write your ISO to a USB key](/doc/installation-guide/#copying-the-iso-onto-the-installation-medium):** -Some people use the ``dd`` command (recommended), others use tools like Rufus and balenaEtcher. -If installation fails after using one tool, try a different one. -For example, if you are facing trouble installing Qubes after writing the ISO using Rufus, then try using other tools like balenaEtcher or the ``dd`` command. - - -## Boot screen does not appear / system does not detect your installation medium ## - -If the boot screen does not appear, there are several options to troubleshoot. -First, try rebooting your computer. -If it still loads your currently installed operating system or does not detect your installation medium, make sure the boot order is set up appropriately. - -The process to change the boot order varies depending on the currently installed system and the motherboard manufacturer. - -If **Windows 10** is installed on your machine, you may need to follow specific instructions to change the boot order. -This may require an [advanced reboot](https://support.microsoft.com/en-us/help/4026206/windows-10-find-safe-mode-and-other-startup-settings). - -## "Not asking for VNC because we don't have a network" / "X startup failed, aborting installation" / "Pane is dead" error during installation ## - -The boot mode in use may be causing these error messages. -Try to install after enabling both UEFI and legacy boot modes. -If that doesn't help, then disable one and try the other. -Visit the [UEFI Troubleshooting guide](/doc/uefi-troubleshooting/) if other errors arise during UEFI booting. - -These errors may also occur due to an incompatible Nvidia graphics card. If you have one, follow the following instructions: -1. Disable secure/fast boot and use legacy mode -2. Enter GRUB, move the selection to the first choice, and then press the Tab key. -3. Now, you are in edit mode. Move the text cursor with your arrow key and after ``kernel=`` line, add: - - ``nouveau.modeset=0 rd.driver.blacklist=nouveau video=vesa:off`` - - If the above code doesn't fix the problem, replace it with: - - ``noexitboot=1 modprobe.blacklist=nouveau rd.driver.blacklist=nouveau --- intitrd.img`` - -For more information, look at the [Nvidia Troubleshooting guide](/doc/nvidia-troubleshooting/#disabling-nouveau). - - -## Installation freezes at "Setting up Networking" ## - -If you are facing this problem on an Apple computer, check out the [Macbook Troubleshooting guide](/doc/macbook-troubleshooting/). - -This issue occurs due to the network card, which may be missing some drivers or is incompatible with Qubes. - -First, install all available drivers for the card. -You can install the drivers without internet access by first downloading them on another machine, then transferring them over to the current machine (e.g., with a USB drive). - -If installing the available drivers does not help, disable the network card in the BIOS and perform the installation before re-enabling the card. -If this solves the issue, it confirms the PCI card is incompatible with Qubes. -In this case, you may want to consider replacing it with a network card of a different brand. -Broadcom cards are notoriously problematic with Qubes. - - - diff --git a/user/advanced-configuration/uefi-troubleshooting.md b/user/troubleshooting/uefi-troubleshooting.md similarity index 87% rename from user/advanced-configuration/uefi-troubleshooting.md rename to user/troubleshooting/uefi-troubleshooting.md index d9feffcc..fd36527a 100644 --- a/user/advanced-configuration/uefi-troubleshooting.md +++ b/user/troubleshooting/uefi-troubleshooting.md @@ -4,11 +4,9 @@ title: UEFI Troubleshooting permalink: /doc/uefi-troubleshooting/ --- -Troubleshooting UEFI related problems -======================================== +# Troubleshooting UEFI related problems # -Change installer kernel parameters in UEFI ---------------------- +## Successfully installed in legacy mode, but had to change some kernel parameters ## If you've installed successfully in legacy mode but had to change some kernel parameters for it to work, you should try installing in UEFI mode with the same parameters. @@ -25,12 +23,14 @@ If you've installed successfully in legacy mode but had to change some kernel pa 05. Save your changes, unmount and dd to usb device -Installation freezes before displaying installer ------------------------------------------------------------ +## Installation freezes before displaying installer ## + +If you have an Nvidia card, see also [Nvidia Troubleshooting](/doc/nvidia-troubleshooting/#disabling-nouveau). + +### Removing `noexitboot` and `mapbs` ### Some systems can freeze with the default UEFI install options. You can try the following to remove `noexitboot` and `mapbs`. -If you have an Nvidia card, see also [Nvidia Troubleshooting](/doc/nvidia-troubleshooting/#disabling-nouveau). 1. Follow the [steps here](/doc/uefi-troubleshooting/#change-installer-kernel-parameters-in-uefi) to edit the `[qubes-verbose]` section of your installer's `BOOTX64.cfg`. You want to comment out the `mapbs` and `noexitboot` lines. @@ -59,9 +59,26 @@ This is also a good time to make permanent any other changes needed to get the i 5. Go back to `tty6` (Ctrl-Alt-F6) and click `Reboot`. 6. Continue with setting up default templates and logging in to Qubes. +### Changing `options=console=` parameter to `none` ### -Installation freezes before displaying installer / disable EFI runtime services ------------------------------------------------------------------------------- +If removing `noexitboot` and `mapbs` did not help, you can try changing the `options=console=` parameter to `none`. The detailed solution can be found in the comments of [this GitHub issue](https://github.com/QubesOS/qubes-issues/issues/5383) + +1. Follow the [steps here](/doc/uefi-troubleshooting/#change-installer-kernel-parameters-in-uefi) to edit the `[qubes-verbose]` section of your installer's `BOOTX64.cfg`. + You want to change `options=console=vga` to `options=console=none`. + The end result should look like this: + + ~~~ + [qubes-verbose] + options=console=none efi=attr=uc + noexitboot=1 + mapbs=1 + kernel=vmlinuz inst.stage2=hd:LABEL=Qubes-R4.0-x86_64 i915.alpha_support=1 + ramdisk=initrd.img + ~~~ + +2. Boot the installer and continue to install as normal + +### Disable EFI runtime services ### On some early, buggy UEFI implementations, you may need to disable EFI under Qubes completely. This can sometimes be done by switching to legacy mode in your BIOS/UEFI configuration. @@ -105,13 +122,11 @@ Consider this approach as a last resort, because it will make every Xen update a Whenever there is a kernel or Xen update for Qubes, you will need to follow [these steps](/doc/uefi-troubleshooting/#boot-device-not-recognized-after-installing) because your system is using the fallback UEFI bootloader in `[...]/EFI/BOOT` instead of directly booting to the Qubes entry under `[...]/EFI/qubes`. -Installation from USB stick hangs on black screen ---------------------- +## Installation from USB stick hangs on black screen ## -Some laptops cannot read from an external boot device larger than 8GB. If you encounter a black screen when performing an installation from a USB stick, ensure you are using a USB drive less than 8GB, or a partition on that USB lesser than 8GB and of format fat32. +Some laptops cannot read from an external boot device larger than 8GB. If you encounter a black screen when performing an installation from a USB stick, ensure you are using a USB drive less than 8GB, or a partition on that USB lesser than 8GB and of format FAT32. -Installation completes successfully but then boot loops or hangs on black screen ---------------------- +## Installation completes successfully but then boot loops or hangs on black screen ## There is a [common bug in UEFI implementation](http://xen.markmail.org/message/f6lx2ab4o2fch35r) affecting mostly Lenovo systems, but probably some others too. While some systems need `mapbs` and/or `noexitboot` disabled to boot, others require them enabled at all times. @@ -152,8 +167,7 @@ Or if you have already rebooted after the first stage install and have encounter 4. Continue with setting up default templates and logging in to Qubes. -Installation completes successfully but then system crash/restarts on next boot -------------------------------------------- +## Installation completes successfully but then system crash/restarts on next boot ## Some Dell systems and probably others have [another bug in UEFI firmware](http://markmail.org/message/amw5336otwhdxi76). These systems need `efi=attr=uc` enabled at all times. @@ -180,8 +194,7 @@ Or if you have already rebooted after the first stage install and have encounter 4. Continue with setting up default templates and logging in to Qubes. -Boot device not recognized after installing ------------------------------------------- +## Boot device not recognized after installing ## Some firmware will not recognize the default Qubes EFI configuration. As such, it will have to be manually edited to be bootable. @@ -202,8 +215,7 @@ This will need to be done after every kernel and Xen update to ensure you use th cp /boot/efi/EFI/qubes/xen-4.8.3.efi /boot/efi/EFI/BOOT/BOOTX64.efi -Installation finished but "Qubes" boot option is missing and xen.cfg is empty --------------------------------------------------------------------------------------- +## Installation finished but "Qubes" boot option is missing and xen.cfg is empty / Installation fails with "failed to set new efi boot target" ## In some cases installer fails to finish EFI setup and leave the system without a Qubes-specific EFI configuration. In such a case you need to finish those parts manually. @@ -237,8 +249,7 @@ You can do that just after installation (switch to `tty2` with Ctrl-Alt-F2), or efibootmgr -v -c -u -L Qubes -l /EFI/qubes/xen.efi -d /dev/sda -p 1 "placeholder /mapbs /noexitboot" -Accessing installer Rescue mode on UEFI ---------------------------------------- +## Accessing installer Rescue mode on UEFI ## In UEFI mode, the installer does not have a boot menu, but boots directly into the installation wizard. To get into Rescue mode, you need to switch to tty2 (Ctrl+Alt+F2) and then execute: From bd5ff1e36b9bec15d0f72e962d222f609a790d3c Mon Sep 17 00:00:00 2001 From: Enjeck Cleopatra <32180937+PROTechThor@users.noreply.github.com> Date: Mon, 5 Oct 2020 14:38:17 +0100 Subject: [PATCH 12/27] Fix links --- user/troubleshooting/uefi-troubleshooting.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user/troubleshooting/uefi-troubleshooting.md b/user/troubleshooting/uefi-troubleshooting.md index fd36527a..15bd8a7c 100644 --- a/user/troubleshooting/uefi-troubleshooting.md +++ b/user/troubleshooting/uefi-troubleshooting.md @@ -32,7 +32,7 @@ If you have an Nvidia card, see also [Nvidia Troubleshooting](/doc/nvidia-troubl Some systems can freeze with the default UEFI install options. You can try the following to remove `noexitboot` and `mapbs`. -1. Follow the [steps here](/doc/uefi-troubleshooting/#change-installer-kernel-parameters-in-uefi) to edit the `[qubes-verbose]` section of your installer's `BOOTX64.cfg`. +1. Follow the [steps here](/doc/uefi-troubleshooting/#successfully-installed-in-legacy-mode-but-had-to-change-some-kernel-parameters) to edit the `[qubes-verbose]` section of your installer's `BOOTX64.cfg`. You want to comment out the `mapbs` and `noexitboot` lines. The end result should look like this: @@ -63,7 +63,7 @@ This is also a good time to make permanent any other changes needed to get the i If removing `noexitboot` and `mapbs` did not help, you can try changing the `options=console=` parameter to `none`. The detailed solution can be found in the comments of [this GitHub issue](https://github.com/QubesOS/qubes-issues/issues/5383) -1. Follow the [steps here](/doc/uefi-troubleshooting/#change-installer-kernel-parameters-in-uefi) to edit the `[qubes-verbose]` section of your installer's `BOOTX64.cfg`. +1. Follow the [steps here](/doc/uefi-troubleshooting/#successfully-installed-in-legacy-mode-but-had-to-change-some-kernel-parameters) to edit the `[qubes-verbose]` section of your installer's `BOOTX64.cfg`. You want to change `options=console=vga` to `options=console=none`. The end result should look like this: @@ -85,7 +85,7 @@ This can sometimes be done by switching to legacy mode in your BIOS/UEFI configu If that's not an option there, or legacy mode does not work either, you can try the following to add `efi=no-rs`. Consider this approach as a last resort, because it will make every Xen update a manual process. -1. Follow the [steps here](/doc/uefi-troubleshooting/#change-installer-kernel-parameters-in-uefi) to edit the `[qubes-verbose]` section of your installer's `xen.cfg`. +1. Follow the [steps here](/doc/uefi-troubleshooting/#successfully-installed-in-legacy-mode-but-had-to-change-some-kernel-parameters) to edit the `[qubes-verbose]` section of your installer's `xen.cfg`. You want to modify the `efi=attr=uc` setting and comment out the `mapbs` and `noexitboot` lines. The end result should look like this: From 42c7c2209ce9326cddee372c84ef9a886a3bd3f6 Mon Sep 17 00:00:00 2001 From: Enjeck Cleopatra <32180937+PROTechThor@users.noreply.github.com> Date: Mon, 5 Oct 2020 16:12:26 +0100 Subject: [PATCH 13/27] Clarify how to edit EFI/BOOT/BOOTX64.cfg Addresses some parts of this issue: https://github.com/QubesOS/qubes-issues/issues/6104 --- user/troubleshooting/uefi-troubleshooting.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/user/troubleshooting/uefi-troubleshooting.md b/user/troubleshooting/uefi-troubleshooting.md index 15bd8a7c..bdfb6f38 100644 --- a/user/troubleshooting/uefi-troubleshooting.md +++ b/user/troubleshooting/uefi-troubleshooting.md @@ -12,8 +12,12 @@ If you've installed successfully in legacy mode but had to change some kernel pa **Change the xen configuration on a USB media** 01. Attach the usb disk, mount the EFI partition (second partition available on the disk) -02. As `su`, edit your xen config (`EFI/BOOT/BOOTX64.cfg`) changing the `kernel` key to add your kernel parameters on the boot entry of your choice -03. Install using your modified boot entry +02. Open a terminal and enter the command `sudo su -`. Use your preferred text editor (e.g `nano`) to edit your xen config (`EFI/BOOT/BOOTX64.cfg`): + ~~~ + nano EFI/BOOT/BOOTX64.cfg + ~~~ +03. Change the `kernel` key to add your kernel parameters on the boot entry of your choice +04. Install using your modified boot entry **Change xen configuration directly in an iso image** 01. Get EFI partition boundaries `parted Qubes-R4.0-rc4-x86_64.iso unit B print` From 46680ee236d1c4f88c6ddd95aef9a2d5d07f176e Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sat, 10 Oct 2020 11:50:11 +0200 Subject: [PATCH 14/27] Update windows-vm.md fixed typo --- external/os-guides/windows/windows-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index f488d782..bcc023c4 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -119,7 +119,7 @@ MS Windows versions considerations: - The instructions *may* work on other versions than Windows 7 x64 but haven't been tested. - Qubes Windows Tools (QWT) only supports Windows 7 x64. Note that there are [known issues](https://github.com/QubesOS/qubes-issues/issues/3585) with QWT on Qubes 4.x -- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Wndows Tools](/doc/windows-tools/). +- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](/doc/windows-tools/). Create a VM named win7new in [HVM](/doc/hvm/) mode (Xen's current PVH limitations precludes from using PVH): From 10871159159d24377390d2866829499239c1963e Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sat, 10 Oct 2020 13:57:01 +0200 Subject: [PATCH 15/27] Update windows-tools.md --- external/os-guides/windows/windows-tools.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index 90632698..b65350b8 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -22,10 +22,10 @@ Qubes Windows Tools are a set of programs and drivers that provide integration o - **Qubes Video Driver** - provides for the Seamless GUI mode that integrates apps windows onto the common Qubes trusted desktop - **File sender/receiver** - Support for [secure clipboard copy/paste](/doc/copy-paste/) between the Windows VM and other AppVMs - ***File sender/receiver** - Support for [secure file exchange](/doc/copying-files/) between the Windows VM and other AppVMs -- **Copy/Edit in Dipostable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) +- **Copy/Edit in Diposable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) - **Xen PV drivers** for Windows that increase performance compared to qemu emulated devices -Below is a breakdown of the feature availablility depending on the windows version: +Below is a breakdown of the feature availability depending on the windows version: | Feature | Windows 7 x64 | Windows 10 x64 | | ------------------------------------ | :------------: | :------------: | @@ -35,7 +35,7 @@ Below is a breakdown of the feature availablility depending on the windows versi | File sender/receiver | + | + | | Clipboard Copy/Paste | + | + | | Application shortcuts | + | + | -| Copy/Edit in Disposible VM | + | + | +| Copy/Edit in Disposable VM | + | + | | Block device | + | + | | USB device | - | - | | Audio | - | - | From 7718c50c52a67e20da6024b987b0e63b9bdd49df Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sat, 10 Oct 2020 14:23:29 +0200 Subject: [PATCH 16/27] Update windows-tools.md --- external/os-guides/windows/windows-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-tools.md b/external/os-guides/windows/windows-tools.md index b65350b8..4a5ff7d0 100644 --- a/external/os-guides/windows/windows-tools.md +++ b/external/os-guides/windows/windows-tools.md @@ -22,7 +22,7 @@ Qubes Windows Tools are a set of programs and drivers that provide integration o - **Qubes Video Driver** - provides for the Seamless GUI mode that integrates apps windows onto the common Qubes trusted desktop - **File sender/receiver** - Support for [secure clipboard copy/paste](/doc/copy-paste/) between the Windows VM and other AppVMs - ***File sender/receiver** - Support for [secure file exchange](/doc/copying-files/) between the Windows VM and other AppVMs -- **Copy/Edit in Diposable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) +- **Copy/Edit in Disposable VM** - Support for editing files in DisposableVMs as well as for qvm-run and generic qrexec for the Windows VM (e.g. ability to run custom service within/from the Windows VM) - **Xen PV drivers** for Windows that increase performance compared to qemu emulated devices Below is a breakdown of the feature availability depending on the windows version: From 6ffa1a3172a3fc189f196e2ece1df00880d4c378 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 11 Oct 2020 11:26:25 +0200 Subject: [PATCH 17/27] Update windows-vm.md --- external/os-guides/windows/windows-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index bcc023c4..328a3f83 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -209,7 +209,7 @@ Finally, increase the VM's `qrexec_timeout`: in case you happen to get a BSOD or qvm-prefs win7new qrexec_timeout 300 ~~~ -At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](#xen-pv-drivers-and-qubes-windows-tools) below). It is a good time to clone the VM again. +At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](./windows-tools#xen-pv-drivers-and-qubes-windows-tools) below). It is a good time to clone the VM again. Windows as TemplateVM From de48863a994423f7d2f0c0939806ef6520de15a1 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 11 Oct 2020 11:28:03 +0200 Subject: [PATCH 18/27] Update windows-vm.md --- external/os-guides/windows/windows-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 328a3f83..c7258d42 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -209,7 +209,7 @@ Finally, increase the VM's `qrexec_timeout`: in case you happen to get a BSOD or qvm-prefs win7new qrexec_timeout 300 ~~~ -At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](./windows-tools#xen-pv-drivers-and-qubes-windows-tools) below). It is a good time to clone the VM again. +At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](./windows-tools.md#xen-pv-drivers-and-qubes-windows-tools) below). It is a good time to clone the VM again. Windows as TemplateVM From e7bc300d1038eec74b8b69d143eaa18f59fadf8f Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 11 Oct 2020 11:57:55 +0200 Subject: [PATCH 19/27] Correct links to ther file --- external/os-guides/windows/windows-vm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index c7258d42..8a4611a9 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -119,7 +119,7 @@ MS Windows versions considerations: - The instructions *may* work on other versions than Windows 7 x64 but haven't been tested. - Qubes Windows Tools (QWT) only supports Windows 7 x64. Note that there are [known issues](https://github.com/QubesOS/qubes-issues/issues/3585) with QWT on Qubes 4.x -- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](/doc/windows-tools/). +- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](/external/os-guides/windows/windows-tools.md). Create a VM named win7new in [HVM](/doc/hvm/) mode (Xen's current PVH limitations precludes from using PVH): @@ -209,7 +209,7 @@ Finally, increase the VM's `qrexec_timeout`: in case you happen to get a BSOD or qvm-prefs win7new qrexec_timeout 300 ~~~ -At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](./windows-tools.md#xen-pv-drivers-and-qubes-windows-tools) below). It is a good time to clone the VM again. +At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](/external/os-guides/windows/windows-tools.md#xen-pv-drivers-and-qubes-windows-tools)). It is a good time to clone the VM again. Windows as TemplateVM From d5bcf3f318dd18f14c216ff9d6efee4e1ecbdc10 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 11 Oct 2020 12:20:51 +0200 Subject: [PATCH 20/27] Correct links to other file --- external/os-guides/windows/windows-vm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 8a4611a9..ca79f848 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -119,7 +119,7 @@ MS Windows versions considerations: - The instructions *may* work on other versions than Windows 7 x64 but haven't been tested. - Qubes Windows Tools (QWT) only supports Windows 7 x64. Note that there are [known issues](https://github.com/QubesOS/qubes-issues/issues/3585) with QWT on Qubes 4.x -- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](/external/os-guides/windows/windows-tools.md). +- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](./windows-tools.md). Create a VM named win7new in [HVM](/doc/hvm/) mode (Xen's current PVH limitations precludes from using PVH): @@ -209,7 +209,7 @@ Finally, increase the VM's `qrexec_timeout`: in case you happen to get a BSOD or qvm-prefs win7new qrexec_timeout 300 ~~~ -At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](/external/os-guides/windows/windows-tools.md#xen-pv-drivers-and-qubes-windows-tools)). It is a good time to clone the VM again. +At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](./windows-tools.md#xen-pv-drivers-and-qubes-windows-tools)). It is a good time to clone the VM again. Windows as TemplateVM From cf11226743c073ae0387fdd6f720daaca6557e8e Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 11 Oct 2020 12:52:06 +0200 Subject: [PATCH 21/27] Update windows-vm.md --- external/os-guides/windows/windows-vm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index ca79f848..7ea153e3 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -119,7 +119,7 @@ MS Windows versions considerations: - The instructions *may* work on other versions than Windows 7 x64 but haven't been tested. - Qubes Windows Tools (QWT) only supports Windows 7 x64. Note that there are [known issues](https://github.com/QubesOS/qubes-issues/issues/3585) with QWT on Qubes 4.x -- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](./windows-tools.md). +- For Windows 10 under Qubes 4.0, a way to install QWT 4.0.1.3, which has worked in several instances, is described in [Qubes Windows Tools](/doc/windows-tools/). Create a VM named win7new in [HVM](/doc/hvm/) mode (Xen's current PVH limitations precludes from using PVH): @@ -209,7 +209,7 @@ Finally, increase the VM's `qrexec_timeout`: in case you happen to get a BSOD or qvm-prefs win7new qrexec_timeout 300 ~~~ -At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](./windows-tools.md#xen-pv-drivers-and-qubes-windows-tools)). It is a good time to clone the VM again. +At that point you should have a functional and stable Windows VM, although without updates, Xen's PV drivers nor Qubes integration (see sections [Windows Update](#windows-update) and [Xen PV drivers and Qubes Windows Tools](/doc/windows-tools/#xen-pv-drivers-and-qubes-windows-tools)). It is a good time to clone the VM again. Windows as TemplateVM From 62bc8dc30873a3ab4371cfc8faef9951bb47af24 Mon Sep 17 00:00:00 2001 From: "Dr. Gerhard Weck" Date: Sun, 11 Oct 2020 13:38:15 +0200 Subject: [PATCH 22/27] Hopefully last try to get the syntax right --- external/os-guides/windows/windows-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/os-guides/windows/windows-vm.md b/external/os-guides/windows/windows-vm.md index 7ea153e3..5eeb7f67 100644 --- a/external/os-guides/windows/windows-vm.md +++ b/external/os-guides/windows/windows-vm.md @@ -111,7 +111,7 @@ qvm-prefs win7new qrexec_timeout 300 qvm-prefs win7new debug false ~~~ -To install Qubes Windows Tools, follow instructions [below](#xen-pv-drivers-and-qubes-windows-tools). +To install Qubes Windows Tools, follow instructions in [Qubes Windows Tools](/doc/windows-tools/). ### Detailed instructions ### From f12051086269531e7999654b4d948e7577815d98 Mon Sep 17 00:00:00 2001 From: Enjeck Cleopatra <32180937+PROTechThor@users.noreply.github.com> Date: Mon, 12 Oct 2020 18:59:11 +0100 Subject: [PATCH 23/27] Add installation-troubleshooting to fix conflict --- .../installation-troubleshooting.md | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 user/troubleshooting/installation-troubleshooting.md diff --git a/user/troubleshooting/installation-troubleshooting.md b/user/troubleshooting/installation-troubleshooting.md new file mode 100644 index 00000000..f3d51fcb --- /dev/null +++ b/user/troubleshooting/installation-troubleshooting.md @@ -0,0 +1,82 @@ +--- +layout: doc +title: Installation Troubleshooting +permalink: /doc/installation-troubleshooting/ +--- +# Installation Troubleshooting # + +## "An unknown error has occurred" error during installation ## + +Some people have encountered this error message when trying to install Qubes on drives that already have data on them. +The solution is to exit the installer, wipe all data or delete all partitions, then restart the Qubes installation. + +## Trouble installing from USB stick ## + +If you are facing issues when booting using UEFI mode, see the [UEFI troubleshooting guide](/doc/uefi-troubleshooting/). + +There are a variety of other problems that could arise when using a USB installation medium, and some of the issues can be fixed by doing one or more of the following: + +* **Use a different USB drive:** +If possible, try several drives of different sizes and formats. +This determines whether the problem stems from the flash drive or Qubes installer. +Some laptops cannot read from an external boot device larger than 8GB. +If you encounter a black screen when performing an installation from a USB stick, ensure you are using a USB drive less than 8GB, or a partition on that USB less than 8GB and of format FAT32. +Note that the Qubes installation image is over 4GB, so it may not fit on a smaller USB. +If a machine can not boot from a bigger USB, it may be too old to run Qubes. +* **Verify your Qubes ISO:** +Errors will occur if the Qubes installer is corrupted. +Ensure that the installer is correct and complete before writing it to a flash drive by [verifying the ISO](/security/verifying-signatures/#how-to-verify-qubes-iso-signatures). +* **Change the method you used to [write your ISO to a USB key](/doc/installation-guide/#copying-the-iso-onto-the-installation-medium):** +Some people use the ``dd`` command (recommended), others use tools like Rufus and balenaEtcher. +If installation fails after using one tool, try a different one. +For example, if you are facing trouble installing Qubes after writing the ISO using Rufus, then try using other tools like balenaEtcher or the ``dd`` command. + + +## Boot screen does not appear / system does not detect your installation medium ## + +If the boot screen does not appear, there are several options to troubleshoot. +First, try rebooting your computer. +If it still loads your currently installed operating system or does not detect your installation medium, make sure the boot order is set up appropriately. + +The process to change the boot order varies depending on the currently installed system and the motherboard manufacturer. + +If **Windows 10** is installed on your machine, you may need to follow specific instructions to change the boot order. +This may require an [advanced reboot](https://support.microsoft.com/en-us/help/4026206/windows-10-find-safe-mode-and-other-startup-settings). + +## "Not asking for VNC because we don't have a network" / "X startup failed, aborting installation" / "Pane is dead" error during installation ## + +The boot mode in use may be causing these error messages. +Try to install after enabling both UEFI and legacy boot modes. +If that doesn't help, then disable one and try the other. +Visit the [UEFI Troubleshooting guide](/doc/uefi-troubleshooting/) if other errors arise during UEFI booting. + +These errors may also occur due to an incompatible Nvidia graphics card. If you have one, follow the following instructions: +1. Disable secure/fast boot and use legacy mode +2. Enter GRUB, move the selection to the first choice, and then press the Tab key. +3. Now, you are in edit mode. Move the text cursor with your arrow key and after ``kernel=`` line, add: + + nouveau.modeset=0 rd.driver.blacklist=nouveau video=vesa:off + + If the above code doesn't fix the problem, replace it with: + + noexitboot=1 modprobe.blacklist=nouveau rd.driver.blacklist=nouveau --- intitrd.img + +For more information, look at the [Nvidia Troubleshooting guide](/doc/nvidia-troubleshooting/#disabling-nouveau). + + +## Installation freezes at "Setting up Networking" ## + +If you are facing this problem on an Apple computer, check out the [Macbook Troubleshooting guide](/doc/macbook-troubleshooting/). + +This issue occurs due to the network card, which may be missing some drivers or is incompatible with Qubes. + +First, install all available drivers for the card. +You can install the drivers without internet access by first downloading them on another machine, then transferring them over to the current machine (e.g., with a USB drive). + +If installing the available drivers does not help, disable the network card in the BIOS and perform the installation before re-enabling the card. +If this solves the issue, it confirms the PCI card is incompatible with Qubes. +In this case, you may want to consider replacing it with a network card of a different brand. +Broadcom cards are notoriously problematic with Qubes. + + + From 05616a71ba873f242000d7def81302cbd48111e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Mon, 12 Oct 2020 22:36:53 +0200 Subject: [PATCH 24/27] u2f: add info about non-default USB qube name --- user/security-in-qubes/u2f-proxy.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/user/security-in-qubes/u2f-proxy.md b/user/security-in-qubes/u2f-proxy.md index eff000d9..272a7d0b 100644 --- a/user/security-in-qubes/u2f-proxy.md +++ b/user/security-in-qubes/u2f-proxy.md @@ -112,6 +112,17 @@ Do not delete the file itself. The default model is to allow a qube to access all and only the keys that were enrolled by that qube. For example, if your `banking` qube enrolls your banking key, and your `twitter` qube enrolls your Twitter key, then your `banking` qube will have access to your banking key but not your Twitter key, and your `twitter` qube will have access to your Twitter key but not your banking key. +## Non-default USB qube name + +If your USB qube is named differently than `sys-usb`, then do the following in the appropriate template(s): + +``` +systemctl enable qubes-u2fproxy@USB_QUBE.service +systemctl disable qubes-u2fproxy@sys-usb.service +``` + +Replace `USB_QUBE` with the actual USB qube name. + ## TemplateVM and browser support The large number of possible combinations of TemplateVM (Fedora 27, 28; Debian 8, 9) and browser (multiple Google Chrome versions, multiple Chromium versions, multiple Firefox versions) made it impractical for us to test every combination that users are likely to attempt with the Qubes U2F Proxy. From e70e55984e0a60631116dfa5afae1c5b674e0fe6 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Mon, 12 Oct 2020 21:29:56 -0500 Subject: [PATCH 25/27] Fix link --- introduction/reporting-bugs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/introduction/reporting-bugs.md b/introduction/reporting-bugs.md index 53d9fa04..52d0530e 100644 --- a/introduction/reporting-bugs.md +++ b/introduction/reporting-bugs.md @@ -114,7 +114,7 @@ If the issue is closed without one of these specific resolutions, then it means, ## See also ## -- [Help, Support, and Mailing Lists] +- [Help, Support, Mailing Lists, and Forum] - [Testing New Releases and Updates][testing] - [How to Contribute] - [Contributing Code] From c59a852cd6a26defdfa2dea825baa90b4b75ba9e Mon Sep 17 00:00:00 2001 From: Michael Carbone Date: Tue, 13 Oct 2020 06:52:09 -0400 Subject: [PATCH 26/27] add warning about where public keys live in TB 78 --- user/security-in-qubes/split-gpg.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/user/security-in-qubes/split-gpg.md b/user/security-in-qubes/split-gpg.md index 252e5520..2dff3068 100644 --- a/user/security-in-qubes/split-gpg.md +++ b/user/security-in-qubes/split-gpg.md @@ -135,7 +135,8 @@ Note that, because this makes it easier to accept Split GPG's qrexec authorizati ### Thunderbird 78 and higher -Starting with version 78, Thunderbird has a built-in PGP feature. +Starting with version 78, Thunderbird has a built-in PGP feature and no longer requires the Enigmail extension. For users coming from the Enigmail extension, the built-in functionality is more limited currently, including that **public keys must live in your `work-email` qube with Thunderbird rather than your offline `work-gpg` qube**. + In `work-email`, use the Thunderbird config editor (found at the bottom of preferences/options), and search for `mail.openpgp.allow_external_gnupg`. Switch the value to true. Still in config editor, search for `mail.openpgp.alternative_gpg_path`. Set its value to `/usr/bin/qubes-gpg-client-wrapper`. Restart Thunderbird after this change. [![tb78-1.png](/attachment/wiki/SplitGpg/tb78-1.png)](/attachment/wiki/SplitGpg/tb78-1.png) From ea86127b84c2a17efd67d6375eb643ba5c13f495 Mon Sep 17 00:00:00 2001 From: Andrew David Wong Date: Fri, 16 Oct 2020 02:46:46 -0700 Subject: [PATCH 27/27] Add information about updating VMs with Salt Marek shard this information in: https://groups.google.com/d/msg/qubes-devel/n14n3Q295rw/-wYH6O44CAAJ --- user/advanced-configuration/salt.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/user/advanced-configuration/salt.md b/user/advanced-configuration/salt.md index dfb890af..e8427443 100644 --- a/user/advanced-configuration/salt.md +++ b/user/advanced-configuration/salt.md @@ -464,6 +464,26 @@ Whonix Gateway TemplateVM Whonix Workstation TemplateVM +#### `update.qubes-dom0` + +Updates dom0 + +#### `update.qubes-vm` + +Updates domUs. Example to update all TemplateVMs: + + sudo qubesctl --skip-dom0 --templates state.sls update.qubes-vm + +Useful options: + + - `--max-concurrency` --- Limits how many templates are updated at the same time. + Adjust to your available RAM. + The default is 4, and the GUI updater sets it to 1. + - `--targets=vm1,vm2,...` --- Limit to specific VMs, instead of all of them. + (Use instead of `--templates` or `--standalones`.) + - `--show-output` --- Show an update summary instead of just OK/FAIL. + +For other options, see `qubesctl --help`. ## The `qubes` Pillar Module @@ -488,6 +508,7 @@ Template name on which a given VM is based (if any). VM which provides network to the given VM + ## Debugging The output for each VM is logged in `/var/log/qubes/mgmt-VM_NAME.log`.