[qubes-users] Re: T490 HCL / power consumption after suspend

[andrewx192lc]

Ok, this wasn't expected but I actually see similar behavior on my T470 - 
power consumption is roughly 2X on the T470 after suspend/resume, and 3-4x 
on the T490. Can someone else try measuring power consumption before and 
after the first suspend/resume cycle and report back? I have a feeling this 
could be impacting more people.

On Friday, July 26, 2019 at 5:36:58 PM UTC-7, Andrew Sorensen wrote:
>
> I didn't see any reports of Qubes on the T490, so I figured I'd start one: 
> I just got a T490 (i7 model with 32GB of ram), and was able to get Qubes 
> 4.0.2rc1 installed and usable (after excluding the network card from FLR). 
> For the most part, it appears it will be as usable as Qubes on my T470 with 
> one problem: power consumption. On a cold boot, everything seems acceptable 
> and I get a good number of hours of battery life, however after suspending 
> the laptop and resuming, power consumption spikes from 4W to 15W+, reducing 
> battery life down to a few hours and keeping the fan pegged.
>
> I've tried upgrading to kernel-latest (e.g. 5.x) and using 
> tlp/powertop/xenpm to troubleshoot further, but nothing stuck out. I also 
> downloaded Fedora 30 and was able to suspend and resume without seeing the 
> additional power increase. My understanding is that power management is 
> handled by Xen, and not Dom0 so I think I'm pretty much out of options, but 
> figured I'd drop a note in case anyone else runs into this. I don't plan to 
> investigate much further since I also have the T470, but look forward to 
> trying again when Qubes 4.1 is available in some form.
>
> Also - if someone else wants to test/play around - make sure to use the 
> latest qubes release. I first tried with the version I used to setup my 
> T470 since I didn't have a lot of time, but there were graphical issues 
> (*very* slow painting of the installer/desktop UI), and wireless and wired 
> networking were unavailable.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fe6ee7af-44cf-4404-92f3-c3e2fbff0edd%40googlegroups.com.

Re: [qubes-users] R4 system requirements; AMD compatibility?

[Claudia]

brendan.h...@gmail.com:


On Friday, July 26, 2019 at 1:24:57 PM UTC-4, Claudia wrote:


Just to humor myself, I was going to try testing if I could hear sound
from Qubes after resume, but it seems audio isn't working at all. Which
is a whole 'nother problem. Aplay says "... unable to open slave; audio
open error: no such file or directory." `echo -e '\a'` doesn't work even
on a TTY (lsmod shows pcspkr), and `beep` isn't installed.



Notably, Xen does not pass the real PC speaker device to dom0 and while it
simulates it for dom0, it does not actually invoke the hardware. Something
something considered dangerous to expose adjacent-to-speaker hardware in
dom0, apparently.

So terminal beeps, etc. do nothing (except maybe flash the terminal window,
depending on your config).

I use a snippet I got from google:
function create_beep () {
 # create our beep file as xen does not expose the real "bell" device w/i
n the Qubes configuration and a simple echo "\007" does not work.
 > /tmp/sinewave.wav
 printf "\x52\x49\x46\x46\x64\x1F\x00\x00\x57\x41\x56\x45\x66\x6D\x74\x20
\x10\x00\x00\x00\x01\x00\x01\x00\x40\x1F\x00\x00\x40\x1F\x00\x00\x01\x00\x08\x00
\x64\x61\x74\x61\x40\x1F\x00\x00" >> /tmp/sinewave.wav
 for n in {0..999}
 do
 printf "\x80\x26\x00\x26\x7F\xD9\xFF\xD9" >> /tmp/sinewave.wav
 done
}

And then invoke the following when I need a beep (probably should be made a
function) in scripts dom0:

   aplay -q /tmp/sinewave.wav --duration=1
  
Brendan




The OS comes with some default wave files. It's just that aplay doesn't 
seem to be able to play anything. It detects the audio devices 
correctly, but it errors out when I try to play something. That's why I 
was trying the console bell, as I thought it might use a different 
(simpler) interface or something. Thanks for the info about Xen. I don't 
suppose there's a flag or something to tell Xen to actually invoke the 
hardware?


Not a top priority at the moment, but some kind of audio could be 
helpful for debugging suspend.


-
This free account was provided by VFEmail.net - report spam to ab...@vfemail.net

ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the 
NSA's hands!
$24.95 ONETIME Lifetime accounts with Privacy Features!  
15GB disk! No bandwidth quotas!
Commercial and Bulk Mail Options!  


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0df592c9-62fa-45e3-9623-4aaee0808d1f%40vfemail.net.

[qubes-users] T490 HCL / power consumption after suspend

[Andrew Sorensen]

I didn't see any reports of Qubes on the T490, so I figured I'd start one: 
I just got a T490 (i7 model with 32GB of ram), and was able to get Qubes 
4.0.2rc1 installed and usable (after excluding the network card from FLR). 
For the most part, it appears it will be as usable as Qubes on my T470 with 
one problem: power consumption. On a cold boot, everything seems acceptable 
and I get a good number of hours of battery life, however after suspending 
the laptop and resuming, power consumption spikes from 4W to 15W+, reducing 
battery life down to a few hours and keeping the fan pegged.

I've tried upgrading to kernel-latest (e.g. 5.x) and using 
tlp/powertop/xenpm to troubleshoot further, but nothing stuck out. I also 
downloaded Fedora 30 and was able to suspend and resume without seeing the 
additional power increase. My understanding is that power management is 
handled by Xen, and not Dom0 so I think I'm pretty much out of options, but 
figured I'd drop a note in case anyone else runs into this. I don't plan to 
investigate much further since I also have the T470, but look forward to 
trying again when Qubes 4.1 is available in some form.

Also - if someone else wants to test/play around - make sure to use the 
latest qubes release. I first tried with the version I used to setup my 
T470 since I didn't have a lot of time, but there were graphical issues 
(*very* slow painting of the installer/desktop UI), and wireless and wired 
networking were unavailable.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/10248715-2b1f-483f-be80-7c3c7300e7b5%40googlegroups.com.

[qubes-users] Re: connection android w. android-studio

[Doesnt Work]

Forgot link:
[1]:
https://groups.google.com/forum/?_escaped_fragment_=msg/qubes-users/HGAT6DmuQkM/8g1oR2_sCwAJ

Doesnt Work:
> I've managed to start an andorid-x86 iso within qubes. Will go through
> the long process[1] of building and installing self-compiled images when
> I find the time.
>
> My goal is to do device-testing with android-studio. Since I can attach
> a physical phone to the android-studio-VM and run device-tests that way,
> I believe it should be possible to attach the android-x86-VM to the
> studio-VM and run tests on the VM instead of the virtual device.
> However, I can't find any resources how to even get started.
>
> Has anybody here tried the same thing or ideas how to get this
> (attaching android-VM as USB-device to studio-VM) working? Would be
> happy about pointers where to start as well.
>
> sincerely
>  GammaSQ
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6379d41d-2d70-1bdc-5c23-986a00be1b7a%40gmx.at.

[qubes-users] Changing brightness crashes XFCE power manager

[Lorenzo Lamas]

Using the brightness slider from the power manager tray icon regularly 
crashes power manager(R4.0.1). I've had this issue for quite a long time 
already, not sure if it was also present in R3.2.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c2b3f71a-7096-4d95-b7bf-a4310ab688da%40googlegroups.com.

[qubes-users] Re: Dual-booting Windows vs HVM

[Lorenzo Lamas]

If you dual-boot, the machine is only as safe as the unsafest OS. And 
Windows without security updates is very unsafe.

Afaik, this is the latest on using a Windows HVM for gaming:
https://github.com/Qubes-Community/Contents/blob/master/docs/customization/windows-gaming-hvm.md

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b10a3f95-ad62-4d94-96e9-1a72a76b5200%40googlegroups.com.

Re: [qubes-users] R4 system requirements; AMD compatibility?

[brendan . hoar]

On Friday, July 26, 2019 at 1:24:57 PM UTC-4, Claudia wrote:

> Just to humor myself, I was going to try testing if I could hear sound 
> from Qubes after resume, but it seems audio isn't working at all. Which 
> is a whole 'nother problem. Aplay says "... unable to open slave; audio 
> open error: no such file or directory." `echo -e '\a'` doesn't work even 
> on a TTY (lsmod shows pcspkr), and `beep` isn't installed. 
>

Notably, Xen does not pass the real PC speaker device to dom0 and while it 
simulates it for dom0, it does not actually invoke the hardware. Something 
something considered dangerous to expose adjacent-to-speaker hardware in 
dom0, apparently.

So terminal beeps, etc. do nothing (except maybe flash the terminal window, 
depending on your config).

I use a snippet I got from google:
function create_beep () {
# create our beep file as xen does not expose the real "bell" device w/i
n the Qubes configuration and a simple echo "\007" does not work.
> /tmp/sinewave.wav
printf "\x52\x49\x46\x46\x64\x1F\x00\x00\x57\x41\x56\x45\x66\x6D\x74\x20
\x10\x00\x00\x00\x01\x00\x01\x00\x40\x1F\x00\x00\x40\x1F\x00\x00\x01\x00\x08\x00
\x64\x61\x74\x61\x40\x1F\x00\x00" >> /tmp/sinewave.wav
for n in {0..999}
do
printf "\x80\x26\x00\x26\x7F\xD9\xFF\xD9" >> /tmp/sinewave.wav
done
}

And then invoke the following when I need a beep (probably should be made a 
function) in scripts dom0: 

  aplay -q /tmp/sinewave.wav --duration=1
 
Brendan

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/cdc16c4b-a197-48e7-b9aa-6a487cd43383%40googlegroups.com.

Re: [qubes-users] R4 system requirements; AMD compatibility?

[Claudia]

Chris Laprise:

On 7/25/19 11:04 AM, brendan.h...@gmail.com wrote:
...there are very very early test-builds of Qubes R4.1 out there 
utilizing Xen 4.12 and Fedora 30. This 2019-07-01 build appears 
semi-stable in light testing. It is, at a high level (and Marek can 
correct me if I am wrong), the R4.01 codebase with up-to-date Xen and 
dom0 Fedora w/ any Qubes-related changes to ensure these work with the 
Qubes code base.


I was able to install that particular test build on a Thinkpad X230 
for testing: https://openqa.qubes-os.org/tests/3021


(note: click on assets tab for link to download the ISO)

It might be worth installing one of those as well on another drive to 
see if newer Xen/Fedora combinations resolve sleep issues or get you 
closer to resolution.


Interesting link!

I was just thinking this could be an "old Fedora" problem. But that also 
suggests there may be a way to patch the current dom0 to handle suspend 
correctly. Of course, domU is a factor if sys-net or sys-usb are running.


... But it works on Fedora 29 with 4.18, and not Qubes R4.0.1 with 4.19.

Is a Fedora 29 kernel 4.18 different than a Fedora 25 kernel 4.18? i.e. 
different branches/backports or something? Or could something besides 
the kernel be causing the difference in behavior?




Trying Fedora 25 with 4.8.6, just for good measure... This is 
interesting. At resume, the fan comes on but the screen doesn't power on 
(just as in Qubes), but this time, unlike in Qubes, pressing caps lock 
*does* turn on the light. Alt-SysRq-B doesn't do anything (it might be 
disabled), but incidentally, when I pressed Print Screen I heard a 
camera shutter sound effect, and Ctrl-Alt-Del powered it off after 60 
seconds. So, the OS is responsive after resume (unlike Qubes), just the 
screen is still powered off.


Also, instead of powering off the screen due to inactivity, it just 
turns it black instead, much like Qubes.


So it's almost starting to sound like it was a graphics driver issue or 
something that was fixed sometime between Fedora 25 and Fedora 29, but 
somehow still hasn't made it to Qubes. Still way too early to say, though.




Claudia:

Have you tried suspend/resume with no VMs running at all? This can be 
accomplished by manually shutting down appVMs then service VMs, or with 
the command 'qvm-shutdown --all --force --wait'.


Pretty sure I did, but re-tested to be certain. With all VMs stopped, 
resuming makes the fan come on, but the screen doesn't power on, and 
pressing the caps-lock key doesn't turn its light on. I have to 
long-press the power button and restart.


I could have sworn when I tested this before, resume wouldn't make the 
fan come on or anything at all. Although, it would be easy to mistake 
one for the other, because the fan isn't the most reliable output 
channel. From the time I tested Ubuntu onward, I started using 
`sha256sum /dev/urandom` to intentionally get the fan running before 
suspend. So it makes sense, in prior testing the fan probably just 
wasn't running loud enough to hear.


So, if that's the case, that means I'm getting the same result in normal 
Qubes as in Qubes with VT-x & VT-d disabled. This is good news, as means 
it's probably not some firmware-related virtualization problem, right?


Just to humor myself, I was going to try testing if I could hear sound 
from Qubes after resume, but it seems audio isn't working at all. Which 
is a whole 'nother problem. Aplay says "... unable to open slave; audio 
open error: no such file or directory." `echo -e '\a'` doesn't work even 
on a TTY (lsmod shows pcspkr), and `beep` isn't installed.


If this works, then the problem may be in the VMs such as sys-net or 
sys-usb. This is possible because those VMs control hardware that must 
also respond to special commands related to sleep/wake.


Makes sense, but unfortunately (or fortunately) I couldn't even get it 
to resume properly under Qubes even with VT-x & VT-d disabled.


If it doesn't work, then the problem is probably entirely in dom0 and 
Fedora 25. Assuming you already have the testing 4.19 kernel, have you 


Well, that's good news. At least, I'd rather the problem be in dom0 
kernel than in firmware! It also means it's probably not device-related, 
if I'm following correctly. But, there's still a chance it could be Xen, 
too, right?


I don't suppose it's possible to upgrade Qubes to Fedora 29, or so?

thought of upgrading it to the even newer 5.x one as 'latest'? The 
latest kernel is installed by specifying the special package named 
'kernel-latest'.




Installed 5.1.15-1. Hangs between Xen and dom0 kernel (blank screen with 
no underscore) about 50% of the time. Same result. Fan comes back on, 
but no caps lock light. Tried again with all VMs stopped. Same result.


So all this kind of makes me think
1) there are special kernel patches or something in Fedora and Ubuntu 
that aren't in Qubes, or

2) the issue is caused by something other than the kernel entirely, or
3) it's 

[qubes-users] Enabling a VM to move the cursor

[Daniel Moerner]

On other distributions I enjoy using the Acme text editor 
(http://acme.cat-v.org/). Part of using Acme efficiently involves allowing 
it to move the mouse for you, e.g., to search for a term you right-click on 
a word, and the cursor jumps to the next instance of the word in the open 
file.


Obviously this doesn't work on Qubes, since the gui agent doesn't let 
programs in VMs move the cursor.


I was thinking about the best way to selectively allow a VM to move the 
cursor, and I thought that the easiest and most secure way to do it would 
probably be to wrap Acme's cursor movements up into a dummy device, and use 
qubes-app-linux-input-proxy to treat the VM running Acme as if it has an 
input device attached.


Has anyone tried something like this before?


Daniel

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e181ea30-25d6-46a9-81dc-1e3a4205f40d%40googlegroups.com.

Re: [qubes-users] Creating and running VMs on a RAM DISK?

[Brendan Hoar]

On Fri, Jul 26, 2019 at 11:31 AM unman  wrote:

> On Fri, Jul 26, 2019 at 05:57:02AM -0700, brendan wrote:
> > Or, should I just utilize the straightforward approach of adding the
> amount
> > of RAM I wish to use as a RAM disk to the baseline dom0 RAM
> configuration,
> > and then set up the RAM disk in dom0?
>
> Straightforward works fine.
> You can use file driver or create thin pool in /dev/shm and register it
> with Qubes as normal.


Thanks unman. Hmm tmpfs can swap (though unusual). Hmm...thinking LVM on
ramfs if there is plenty of RAM, maybe, as ramfs isn’t supposed to swap.

Of course if a randomly keyed encryption layer is involved, i’d lean
towards LVM on tmpfs.

I’m curious how and when tmpfs knows to release memory. Another rabbit
hole...

For safety I delete qubes, clean up and deregister...
>

I too cleanup for various reasons, including that the disk usage widget
doesn’t like registered but missing pools (it reports divide by zero error
and exits).

Thanks!
Brendan



-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAOajFed%3DYF29ceFY7YaqtYWaW2L_ML7t6P9pC03sw-OJ%2BGLbOg%40mail.gmail.com.

[qubes-users] Re: signature for deb.qubes-os.org/r4.0/vm

[marmot-te]

Hi,

because of impatience I finally modify my laptop by sacrifing an
internal antenna connected to the internal modem, soldering the coax
cable to a SMA connector and fixing it to the chassis.

this way I am able to passtrought the modem to my kali HVM and connect
directly more powerfull antennas to the modem, and optionnally test in
the same time multiple antennas with multiple net VMs. Great.

However, I am still interested to know how to use USB devices in HVM.


marmot-te:
> Hi,
> 
> I am trying to install thoses qubes packages into a fresh kali HVM with
> objective to manage USB passtrought and be able to connect a wifi dongle
> to it ...
> 
> So I add the repository into source.list.d/
> but I continue to search the right way to add the right keys ring for
> being able to update and go on.
> OptionnallyI also spent some time to bypass this with options like
> trusted=yes and allow-insecure=yes ... and fail.
> 
> Can someone relocate me to the right way? ;)
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8ceedb2b-b75d-0670-85c8-3a7fc0ef27e5%40riseup.net.


pEpkey.asc
Description: application/pgp-keys

Re: [qubes-users] Creating and running VMs on a RAM DISK?

[unman]

On Fri, Jul 26, 2019 at 05:57:02AM -0700, brendan.h...@gmail.com wrote:
> Hi,
> 
> Does XEN expose any sort of configuration-controlled feature or interface 
> that would sets aside XEN-owned memory in a way that can be exposed as a 
> block device within dom0, for use as a RAM disk?
> 
> Or, should I just utilize the straightforward approach of adding the amount 
> of RAM I wish to use as a RAM disk to the baseline dom0 RAM configuration, 
> and then set up the RAM disk in dom0?
> 
> B
> 

Straightforward works fine. 
You can use file driver or create thin pool in /dev/shm and register it
with Qubes as normal.
For safety I delete qubes, clean up and deregister the pool on shutdown,
but I don't think this is necessary.

unman

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20190726153141.xrguhdedjel6win5%40thirdeyesecurity.org.

Re: [qubes-users] Re: QSB #050: Reinstalling a TemplateVM does not reset the private volume

[Claudio Chinicz @ Gmail]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Hey,

Thanks a lot, this has ended a 3 weeks fight to reinstall whonix. I've
changed default firewall to UpdateVM and it worked.

Best Regards

On 26/07/2019 15:12, 'awokd' via qubes-users wrote:
> Claudio Chinicz: > >> Using mirage-firewall-wifi as UpdateVM to download 
> updates for
Dom0; this >> may take some time... > > Don't think Mirage supports
running as UpdateVM. Try a Debian or Fedora > based AppVM instead. >
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEwqrWIZ87/1+fYNr8Qc96sKyouBUFAl07CcUACgkQQc96sKyo
uBXLig//VFSf5+TWjLe4xPKSiTabReLOujaPR6Ids71z9655WBmOcD70H1grLCVX
J/bxXuaLXmaJcDaLBtikExtarHh5UY5gf/hdUrSIp3nvV2gZI6bNHbvI1GXLJ4ez
Y7A9f+afQa+gVlxydCw6jwX5oc7OZYSL6RbPoiz0tclMYnggidaeIuSxqAhp7AOn
jpqR0fLCil3w6M2ALL/NfrnOHTryKTb1eFTNEaT8HH1tIz7jXgpxFSCUAqBfqUcx
PnkppqvKaB6xqZLUIcstD3y7QgipPr+uZKL+MuLGJf31T1xVwH6VXAzxSkhjp72j
+Y9PZSBz/Kg3p5yuMfmjRarNLvROZzqbdvpvoOhu5dtooultaxDL0is9cdyc96WS
rN8Nar4x5JqXDdHuFc7q48m5N38bLV8EXHw6uqrUU7q5DlhGAOMcNn9ajiB0h2MR
Ov9xjNU7exuk5jQSGdNQkeO7sgAMa9dnLS9VirLZHC6Xtvw2PZGmDYyvk25WNQWp
3aYr6vRV+uiLtnmGY8Ta/yLJ6OdRmZp6NOYOl72wXtQBtcWNceykSLaqh0mHwPbD
GBq2MCRTi+IPjF87ajT7qZmGP5amBn88Bfx+FpMEc6y4D01HW88hvZwEMYmLFMQU
4qqQ5IQTKpXz3eKrmTmTki8HZ+9ULHwLDx5ExIduyaGeXF1dwHg=
=XY4U
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7098c3fd-f483-7100-4556-95f0967023df%40gmail.com.

Re: [qubes-users] is it possible to have two sys-net for one firewall vm?

[unman]

On Mon, Jul 22, 2019 at 11:40:54PM -0700, alain.cor...@gmail.com wrote:
> Hello Unman,
> Thanks for your answer.
> Yes it is in fact to separate traffic. It is an security requirement.
> I've differents use cases in my project, others including port forwarding, 
> DNAT and filter  iptables, for that it's OK.
> But when  i want create 2 sys-net for 1 firewall, the second sys-net don't 
> have vif interface and so, I can't reach him from firewall.
> Is there a solution to add vif interface manualy?
> Thanks 
> alain
> Le lundi 22 juillet 2019 17:44:11 UTC+2, unman a ??crit :
> >
> > On Mon, Jul 22, 2019 at 07:51:32AM -0700, alain...@gmail.com  
> > wrote: 
> > > hello, 
> > > I use Qubes-os 4 on a computer which provides 2 ethernet intefaces. For 
> > my 
> > > project iI need to separate these 2 interfaces (sys-net1, sys-net2). But 
> > i 
> > > have to use only 1 firewall on which the 2 sys-net would be linked. 
> > > Is it possible? 
> > > I don't find the solution for the moment. One of these 2 sys-net is 
> > created 
> > > without vif interface... 
> > > Thanks a lot! 
> > > Alain 
> > > 
> >
> > hello Alain 
> >
> > Can you explain why you only want to have one sys-firewall? It would be 
> > much cleaner to separate the traffic completely. 
> >
> > It *is* possible to do what you want, but you need to play with the Qubes 
> > networking model, and manipulate NAT and routing on the sys-firewall. 
> > In particular, you will need to attach sys-net2 as a client to 
> > sys-firewall, and follow the procedures for allowing inter qube traffic. 
> >
> > I've posted on this before. If you need some pointers, give some 
> > more detail on your setup and needs, (and level of knowledge), and I'll 
> > try to help. 
> >
> > unman 

Hello Alain,

Please don't top post.

What you can do is this:

Net1-sys-net1
  |
 sys-firewall
 |  |
Net2-sys-net2   qube

sys-net2 has sys-firewall as netvm.
Attach NIC to sys-net2.

On sys-firewall you put custom rules that allow traffic between qube and
sys-net2.
You also need to set routing correctly,  modify raw table to allow
inbound traffic from Net2 on the sys-net2 vif.
If done right no configuration is needed on client qubes.
(You will, of course, need nat and filter rules on sys-net2 also.)

I do this to use openBSD HVMs as netVMs, and it works fine.

unman

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20190726135054.qt6xwonon3th42da%40thirdeyesecurity.org.

Re: [qubes-users] Troubleshooting help - Qubes R4.0.1 - frozen at "Installing boot loader" on HP Elitebook 8570p

['awokd' via qubes-users]

robbie.sha...@gmail.com:
> Hey, 
> 
> Just learned about Qubes OS a few days ago.
> 
> Jos seemed to have had a successful install of R3.0 with manual wireless 
> driver install -> HCL - HP Elitebook 8570p 

The actual text is greatly preferred over pictures, but from what I was
able to make out, looks like it freezes when trying to write the boot
block. Some UEFI's have an option (so called antivirus) that block
writes to MBR- check yours for that and disable temporarily. Also try
switching to legacy boot mode if that's not it.


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bd10b400-2339-b153-44da-e07d8b2449d1%40danwin1210.me.

Re: [qubes-users] Re: Confuse Update QUbes OS

[unman]

On Fri, Jul 26, 2019 at 06:16:34AM +, Jon deps wrote:
> I use thunderbird to read the qubes-users, then I right click and "respond
> to all" it populates and email  with
> 
> qubes-users-/jypxa39uh5tlh3mboc...@public.gmane.org
> 
> 
> awokd 
> 
> in the "To:" fields
> 
> then there is a "newsgroup:" field  gmane.os.qubes.user
> 
> I retitle the "to:" field to  qubes-users@googlegroups.com
> 
> 
> and delete the other fields
> 
> but actually have no idea if this is  the  best method for   gmane  use
> 
> 
> so seems gmane does work at least for reading  the newsgroup  sir unman   :)
> 

Thanks.
I stopped using gmane some while back: I had no idea the service was
still running, (albeit with some bugs.)

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20190726133445.v5imq2suzmo22dm3%40thirdeyesecurity.org.

Re: [qubes-users] R4 system requirements; AMD compatibility?

[Chris Laprise]

On 7/26/19 7:52 AM, brendan.h...@gmail.com wrote:



On Thursday, July 25, 2019 at 12:16:00 PM UTC-4, Chris Laprise wrote:

On 7/25/19 11:04 AM, brend...@gmail.com wrote:
 > I was able to install that particular test build on a Thinkpad
X230 for
 > testing: https://openqa.qubes-os.org/tests/3021

 >
 > (note: click on assets tab for link to download the ISO)

Interesting link!


As a side note, when you opened the ticket asking about back-porting 
"lvm-thin tools" to R4.01 (Fedora 25) for your backup tool work...I was 
wondering if you were aware that some of the (again, very very early 
test) builds of R4.1 were semi usable.


Not that we should have to wait to do fast, stable backups until R4.1... :)
Brendan


I wasn't aware, but there's no ETA for R4.1 anyway.


--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/aa4520d3-63d4-ee47-f417-57232b3ca610%40posteo.net.

[qubes-users] Troubleshooting help - Qubes R4.0.1 - frozen at "Installing boot loader" on HP Elitebook 8570p

[robbie . sharma]

Hey, 

Just learned about Qubes OS a few days ago.

Jos seemed to have had a successful install of R3.0 with manual wireless 
driver install -> HCL - HP Elitebook 8570p 


I'm using a 32gb USB stick for install.  Used rufus to dd the 4.0 iso to 
the drive from windows.

Here is a screenshot of the log screen just before it freezing (ie. 
CTRL+F2, ALT+TAB):

https://ibb.co/Nttd8z5

Here are screenshots of the bios screens:

https://ibb.co/8Dq1J8F
https://ibb.co/qsr6gbf
https://ibb.co/C25N89F

I installed this multiple times, first with only the GUI screen then 
switching to the anaconda shell during install. Same issue every time. 
Tried manual disk provisioning too but gave up because my knowledge of 
fdisk is very minimal: https://www.qubes-os.org/doc/custom-install/

I'm an average Linux user although I'll give some questions/thoughts that 
may help:

   - The laptop has an HP flavor BIOS menu and I can't turn the "HP 
   Hypervisor" setting on 
   - The /dev/sda1 device and volume qubes_dom0-root probably aren't 
   provisioned properly
   - Bootloader image ie: pyanaconda.bootloader.LinuxBootLoaderImage object 
   at 0x7ebc56fbea20 -> It seems it crashes when the bootloader object is 
   being written or device is being opened/configured for writing? How do we 
   check deeper here?
   - Running lsblk before install, it showed a few /dev/loop devices... 
   could that be a problem? Need to google what these are...
   - When it freezes, I can't switch between screens with CTRL+F2... why? 
   
Let me know if there is more info I should post or something I can do to 
move forward/troubleshoot this.  Very excited to get his running.

Thanks,

Robbie

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/57af5d76-074c-4a26-9b36-bc6b8e5f9536%40googlegroups.com.

[qubes-users] Creating and running VMs on a RAM DISK?

[brendan . hoar]

Hi,

Does XEN expose any sort of configuration-controlled feature or interface 
that would sets aside XEN-owned memory in a way that can be exposed as a 
block device within dom0, for use as a RAM disk?

Or, should I just utilize the straightforward approach of adding the amount 
of RAM I wish to use as a RAM disk to the baseline dom0 RAM configuration, 
and then set up the RAM disk in dom0?

B

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ade46719-2d43-4b40-b023-0e4b88b474d4%40googlegroups.com.

Re: [qubes-users] Hi

['awokd' via qubes-users]

Jules Octave:
> I am trying to install qubeOS on my new dell xps 13 model 9380 to no avail.
> It s just freeze at installation point .
> 
> I also would like to know how to change the iso parameter as indicated
> https://www.qubes-os.org/doc/uefi-troubleshooting/
> I follow the steps change  and save but when I umount the changes are gone
> back to the usual on the iso

Try the "Change xen configuration directly in an iso image" procedure
instead. I don't think "Change the xen configuration on a USB media"
works any more.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e8758cd1-a98e-1888-be0a-f9168329233c%40danwin1210.me.

Re: [qubes-users] usb modem via PCIe installation issue

['awokd' via qubes-users]

alain.cor...@gmail.com:
> Hi awork,
> 
> thanks for your answer.
> I do not attach the device to dom0 but since Dom0 (backend) to my VM.
> but when I list the usb devices from Dom0 with qvm-usb, I see nothing.
> however my device appears correctly in / sys / bus / usb / devices / usb1
> it seems me that qvm-usb is derivated of qvm-device, as qvm-pci. Is that 
> true?
> 
> 
> Le jeudi 25 juillet 2019 15:43:21 UTC+2, awokd a écrit :
>>
>> alain...@gmail.com : 
>>> Hi, 
>>> I need to use a telit lte modem plugged on PCIe. 
>>> I found informations 
>>>   dmesg: usb 1-2: product Telit... 
>>>   lsusb: bus 001 Device 002: ID Telit .. 
>>>   readlink: /sys/bus/usb/devices/usb1 
>>>..device/pci.00:14.0/usb1 
>>> it's ok, but... 
>>> when i attach the usb device from dom0 
>>> qvm-device pci attach myVm dom0:00_14.0 
>>>
>>> Qubes-Os stops. 
>>> I don't have no more acces at nothing. 
>>> keyboard, mouse which are usb devices are lost. 
>>> I have to unplugge the supply to reboot. 
>>> has somebody a solution? 
>>> Thanks 
>>> alain 
>>>
>> Since it shows up as a USB device, try attaching it with the appropriate 
>> qvm-usb commands instead. Also, you should almost never attach devices 
>> to dom0. Attach to a qube instead, such as sys-net. 
>>
> 
Yes, "qvm-block, qvm-usb and qvm-pci are just aliases for qvm-device
block, qvm-device usb and qvm-device pci respectively." However, the
symptoms you describe are what happens if you mistakenly try to reassign
the USB controller your keyboard & mouse are using.
https://www.qubes-os.org/doc/usb-qubes/. Do you have a sys-usb? What is
listed in lspci? PCIe cards normally have their own major number like
08_00.0 whereas PCIe root ports are in the 00_14.0 range so you might be
trying to reassign the wrong thing.



-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0d681c8b-dcfb-ce50-22ef-7631e88d4225%40danwin1210.me.

Re: [qubes-users] Re: QSB #050: Reinstalling a TemplateVM does not reset the private volume

['awokd' via qubes-users]

Claudio Chinicz:

> Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; this 
> may take some time...

Don't think Mirage supports running as UpdateVM. Try a Debian or Fedora
based AppVM instead.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d30a6211-df1b-1b2e-8af9-2663b54eec15%40danwin1210.me.

Re: [qubes-users] R4 system requirements; AMD compatibility?

[brendan . hoar]

On Thursday, July 25, 2019 at 12:16:00 PM UTC-4, Chris Laprise wrote:
>
> On 7/25/19 11:04 AM, brend...@gmail.com  wrote: 
> > I was able to install that particular test build on a Thinkpad X230 for 
> > testing: https://openqa.qubes-os.org/tests/3021 
> > 
> > (note: click on assets tab for link to download the ISO) 
>
> Interesting link! 
>

As a side note, when you opened the ticket asking about back-porting 
"lvm-thin tools" to R4.01 (Fedora 25) for your backup tool work...I was 
wondering if you were aware that some of the (again, very very early test) 
builds of R4.1 were semi usable. 

Not that we should have to wait to do fast, stable backups until R4.1... :)
 
Brendan

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0f6a61b5-a5e4-4cc0-a5fa-ec1d55e80df9%40googlegroups.com.

[qubes-users] Re: is it possible to have two sys-net for one firewall vm?

[brendan . hoar]

Use xentop -f to show full names.

Those are likely the stub domains used for device handling, etc.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b33a3364-c696-4489-b209-10f5d8a5fc1c%40googlegroups.com.

[qubes-users] Re: QSB #050: Reinstalling a TemplateVM does not reset the private volume

[Claudio Chinicz]

Hi Andrew,

After removing all Whonix related templates and VMs, I've folllowed the 
link you suggested (https://www.whonix.org/wiki/Qubes/Install) and run into 
errors (see below).

Any ideas why the "sudo qubesctl state.sls qvm.anon-whonix" fails and 
reports the whonix-gw and ws are missing? I thought it would install the 
templates anew, specially because there are instructions saying we should 
first remove whonix completely.

Best

[claudio@dom0 ~]$ sudo qubesctl state.sls qvm.anon-whonix
[ERROR   ] Command '['systemd-run', '--scope', 'qubes-dom0-update', '-y', 
'--best', '--allowerasing', '--disablerepo=*', 
'--enablerepo=qubes-templates-community', '--clean', '--action=install', 
'qubes-template-whonix-ws-15']' failed with return code: 1
[ERROR   ] stdout: Running scope as unit: 
run-r73c74b031ca0467aa7984ab0632f7f78.scope
Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; this 
may take some time...
[ERROR   ] retcode: 1
[ERROR   ] Error occurred installing package(s). Additional info follows:

errors:
- Running scope as unit: run-r73c74b031ca0467aa7984ab0632f7f78.scope
  Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; 
this may take some time...
[WARNING ] /var/cache/salt/minion/extmods/states/ext_state_qvm.py:142: 
DeprecationWarning: BaseException.message has been deprecated as of Python 
2.6
  status = Status(retcode=1, result=False, stderr=err.message + '\n')

[ERROR   ] == ['features'] ==
Virtual Machine does not exist!

== ['tags'] ==
[SKIP] Skipping due to previous failure!
[ERROR   ] Command '['systemd-run', '--scope', 'qubes-dom0-update', '-y', 
'--best', '--allowerasing', '--disablerepo=*', 
'--enablerepo=qubes-templates-community', '--action=install', 
'qubes-template-whonix-gw-15']' failed with return code: 1
[ERROR   ] stdout: Running scope as unit: 
run-r40ec4f8030284021a2f80d44af49d36f.scope
Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; this 
may take some time...
[ERROR   ] retcode: 1
[ERROR   ] Error occurred installing package(s). Additional info follows:

errors:
- Running scope as unit: run-r40ec4f8030284021a2f80d44af49d36f.scope
  Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; 
this may take some time...
[ERROR   ] == ['features'] ==
Virtual Machine does not exist!

== ['tags'] ==
[SKIP] Skipping due to previous failure!
local:
--
  ID: template-whonix-ws-15
Function: pkg.installed
Name: qubes-template-whonix-ws-15
  Result: False
 Comment: Error occurred installing package(s). Additional info follows:
  
  errors:
  - Running scope as unit: 
run-r73c74b031ca0467aa7984ab0632f7f78.scope
Using mirage-firewall-wifi as UpdateVM to download 
updates for Dom0; this may take some time...
 Started: 11:16:43.589367
Duration: 5101.908 ms
 Changes:   
--
  ID: whonix-ws-tag
Function: qvm.vm
Name: whonix-ws-15
  Result: False
 Comment: == ['features'] ==
  Virtual Machine does not exist!
  
  == ['tags'] ==
  [SKIP] Skipping due to previous failure!
 Started: 11:16:48.694020
Duration: 17.289 ms
 Changes:   
--
  ID: whonix-ws-update-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.UpdatesProxy
  Result: True
 Comment: File /etc/qubes-rpc/policy/qubes.UpdatesProxy is in correct 
state
 Started: 11:16:48.713516
Duration: 3.164 ms
 Changes:   
--
  ID: whonix-get-date-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.GetDate
  Result: True
 Comment: File /etc/qubes-rpc/policy/qubes.GetDate is in correct state
 Started: 11:16:48.716793
Duration: 1.201 ms
 Changes:   
--
  ID: template-whonix-gw-15
Function: pkg.installed
Name: qubes-template-whonix-gw-15
  Result: False
 Comment: Error occurred installing package(s). Additional info follows:
  
  errors:
  - Running scope as unit: 
run-r40ec4f8030284021a2f80d44af49d36f.scope
Using mirage-firewall-wifi as UpdateVM to download 
updates for Dom0; this may take some time...
 Started: 11:16:48.718085
Duration: 2780.185 ms
 Changes:   
--
  ID: whonix-gw-tag
Function: qvm.vm
Name: whonix-gw-15
  Result: False
 Comment: == ['features'] ==
  Virtual Machine does not exist!
  
  == ['tags'] ==
  [SKIP] Skipping due to previous failure!
 Started: 11:16:51.498524
Duration: 15.627 ms
 Changes:   
--
  ID: whonix-gw-update-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.UpdatesProxy
  Result: True
 Comment: File 

[qubes-users] Hi

[Jules Octave]

I am trying to install qubeOS on my new dell xps 13 model 9380 to no avail.
It s just freeze at installation point .

I also would like to know how to change the iso parameter as indicated
https://www.qubes-os.org/doc/uefi-troubleshooting/
I follow the steps change  and save but when I umount the changes are gone
back to the usual on the iso

Looking forward to hearing from you soon


*Kind regards,*
*Jules*

*..*

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAOuULM6VqtyJcG71Vq7NX_0spEHCvd%2Ba0wW32q3RPeWf7yG%2BJA%40mail.gmail.com.

Re: [qubes-users] usb modem via PCIe installation issue

[alain . cordat]

Hi awork,

thanks for your answer.
I do not attach the device to dom0 but since Dom0 (backend) to my VM.
but when I list the usb devices from Dom0 with qvm-usb, I see nothing.
however my device appears correctly in / sys / bus / usb / devices / usb1
it seems me that qvm-usb is derivated of qvm-device, as qvm-pci. Is that 
true?


Le jeudi 25 juillet 2019 15:43:21 UTC+2, awokd a écrit :
>
> alain...@gmail.com : 
> > Hi, 
> > I need to use a telit lte modem plugged on PCIe. 
> > I found informations 
> >   dmesg: usb 1-2: product Telit... 
> >   lsusb: bus 001 Device 002: ID Telit .. 
> >   readlink: /sys/bus/usb/devices/usb1 
> >..device/pci.00:14.0/usb1 
> > it's ok, but... 
> > when i attach the usb device from dom0 
> > qvm-device pci attach myVm dom0:00_14.0 
> > 
> > Qubes-Os stops. 
> > I don't have no more acces at nothing. 
> > keyboard, mouse which are usb devices are lost. 
> > I have to unplugge the supply to reboot. 
> > has somebody a solution? 
> > Thanks 
> > alain 
> > 
> Since it shows up as a USB device, try attaching it with the appropriate 
> qvm-usb commands instead. Also, you should almost never attach devices 
> to dom0. Attach to a qube instead, such as sys-net. 
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e1e55ebc-fc5a-4fc8-a78d-9b21d2425072%40googlegroups.com.

[qubes-users] Re: Confuse Update QUbes OS

[Jon deps]

On 7/25/19 3:48 PM, unman wrote:

On Thu, Jul 25, 2019 at 08:49:00AM +, 'awokd' via qubes-users wrote:

Jon deps:


if the debian 10 sentence is current, is the documentation soon to be
updated ?

any guesstimate on the -10 fresh templates ETA <-- sorry to ask?? :)


The Debian 10 Qubes template isn't out yet. It's in testing so it should
be soon. Hopefully, associated documentation would be updated around the
same time.


PS: in tbird how does one reply to
awokd 

I can a popup error recipient name rejected no domain found


I don't know how Gmane works. Maybe you can't reply to posters directly
with it. Using the Qubes listserv with email does work for that.



Debian-10 is stuck in testing at the moment because it needs packages
from the *testing* repositories for updating. This could be confusing if
users install from current and don't want to use the testing
repositories.

Also, I've noticed a few regressions in the minimal template which need
fixing before release. So testing it remains.
Andrew will announce when the templates become available in "current".

I don't think that Gmane works any more, does it? If you have a message 
referenced
ed there you should be able to find it in archive.org, and reply from
there.




I use thunderbird to read the qubes-users, then I right click and 
"respond to all" it populates and email  with


qubes-users-/jypxa39uh5tlh3mboc...@public.gmane.org 



awokd 

in the "To:" fields

then there is a "newsgroup:" field  gmane.os.qubes.user

I retitle the "to:" field to  qubes-users@googlegroups.com 



and delete the other fields

but actually have no idea if this is  the  best method for   gmane  use


so seems gmane does work at least for reading  the newsgroup  sir unman   :)

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1a72fd20-a827-9f12-e6c7-6fc3195f82a1%40riseup.net.