Framework Laptop 16 (AMD Ryzen 7040 Series)

Okay im not making it that far because the xen commamd line keeps saying “USB in dom0 is not resticted consider rd.qubes.hide_all_usb or usbcore.authorized_default-6.” But im not sure where to put the in the xen commandline. Ill keep looking around. Thanks. I also have a ryzen 7040u

Can you not even get into Qubes and dom0?
Please reply in either one of these threads, whichever one is for your laptop. This thread is for the Framework 16 and I would like to not have this thread get too off topic.

Regarding the keyboard issue, is an external keyboard not working as well? Would be nice to know if such workaround is possible.

So far I’ve been able to pin the keyboard not working on suspend wake issue to be due to sys-usb not being restarted/unpaused on suspend wake and since the keyboard is registered as a USB device, you can’t use it to unlock the laptop.
I’ve been trying to play around with the Qubes suspend hooks but so far haven’t gotten anywhere.

Due to it being a sys-usb issue though, even using an external keyboard would not work (I also tried before identifying the root cause and to no avail).

A temporary but very insecure workaround would be to disable lock on suspend so when waking up, you aren’t locked out and you can then proceed to manually restart sys-usb.

1 Like

As for the workaround, do you use touchpad to manually restart sys-usb? If so, would it be possible to use the virtual keyboard to enter the password and avoid disabling lock?

Yep exactly, I use the touchpad since as it is connected over i2c and not usb, it still works, and yes that would absolutely work! Good idea, hadn’t thought of that

Another idea is to re-create the sys-usb qube, but leave the USB controller responsible for the internal keyboard in dom0. The process described in this section of the docs.

Unfortunately, the USB controller that is responsible for the keyboard also handles anything connected via the expansion cards so that would significantly compromise the security and isolation of the laptop. This is because any USB device connected would be exposed directly to dom0.

The actual issue at play is sys-usb not getting restarted on suspend wake and that’s what needs to be resolved.
Haven’t had the chance to do more debugging and try and fix it since my prior comment, I’ve been quite busy and haven’t had the time to.

Does that mean there is only 1 usb controller for the whole device? Like in the Qube Manager for sys-usb it only shows one device selected? That would be a huge dealbreaker for me

No there are 6 USB controllers.
There are 6 devices passed on to sys-usb and you can also see that when running lsusb in sys-usb with no external devices connected:

[user@sys-usb ~]$ lsusb 
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd QEMU Tablet
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 002: ID 05e3:0610 Genesys Logic, Inc. Hub
Bus 002 Device 003: ID 05e3:0610 Genesys Logic, Inc. Hub
Bus 002 Device 004: ID 05e3:0610 Genesys Logic, Inc. Hub
Bus 002 Device 005: ID 0e8d:e616 MediaTek Inc. Wireless_Device
Bus 002 Device 006: ID 27c6:609c Shenzhen Goodix Technology Co.,Ltd. Goodix USB2.0 MISC
Bus 002 Device 007: ID 32ac:0012 Framework Laptop 16 Keyboard Module - ANSI
Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 002: ID 05e3:0625 Genesys Logic, Inc. USB3.2 Hub
Bus 004 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 006 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 006 Device 002: ID 32ac:0002 Framework HDMI Expansion Card
Bus 007 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 008 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 009 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

So is it possible to create up to 6 sys-usbs and attach each controller to a different one? And if so, can the keyboard be isolated this way?

1 Like

This HCL has been very helpful, thanks for putting this together. I just recently got my Framework 16 and am writing this from Qubes.

I can confirm the ioapic_ack=new line in the Xen command line makes the touchpad very reliable,

With respect to the keyboard on suspend, @tegas I can’t find the option for an onscreen virtual keyboard than I can use with a mouse, was this just an idea or something you have had setup?

Aothetlt partial workaround for the keyboard on suspend issue that I tested and have working is a cron script that checks every minute if sys-usb and restarts it if required. When the laptop wakes from suspend, the keyboard does not work immediately, but within a minute it does,

I have tested this both on the built in and external keyboards.

In dom0 execute crontab -e and enter the following:

* * * * * qvm-start --skip-if-running sys-usb > /dev/null 2>&1

Credit to @SteveC for the idea, and thanks to @fiftyfourthparallel for compiling the Quality of Life improvements where I found it.

I’m just the author of the thread; all credit for this tip should go to @SteveC


I had this set up automatically for me when I was using Qubes with KDE and SDDM. There was a “Virtual Keyboard” button in the bottom left corner on login screen. I don’t have it when I use XFCE , but according to the screenshots from their documentation XFCE should have this ability too, although I was not able to quickly find it (no need it myself right now).

To answer my own question I did some testing on this device. There are 6 controllers but it’s not as useful as that sounds.

1 - USB 2.0 Hub, not mapped to any port
2 - USB 2.0 Hub, not mapped to any port
3 - Top Left port
4 - Top Right Port
5 - Keyboard, Mediatek Wireless Device, Fingerprint Reader, Bottom 4 ports
6 - USB Camera

I don’t know what the first two controllers are for maybe the GPU module?
The fifth controller shares the keyboard and internet bluetooth so probably not acceptable for anyone that cares about isolating this. The camera is more isolated than the keyboard. You can maybe share some less important ports with the keyboard (chargers are maybe less likely to be a problem) but if you want ethernet that takes up 1 of the two other isolated ports you have because there is no dedicated ethernet pci port.
There are 3 controllers you can isolate ports with in total.

A framework 13 would at least be better because the keyboard and mouse is PS/2 Framework - Laptop 13 (Intel 13th Gen) - #6 by leee

But maybe a NovaCustom is better for isolation? NovaCustom NV41 Series - #19 by novacustom
It seems to have isolated keyboard/mouse, internet and audio with up to 3 isolated groups of USB ports?

1 Like

Mainboard circuit diagram is here Framework-Laptop-16/Mainboard at main · FrameworkComputer/Framework-Laptop-16 · GitHub but my testing shows that JUSB5 and the Input Module is connected to the USB 3.1 Gen2 Hub even though it’s not drawn connected. Not sure why that is.

Thanks for the HCL! I’ve been playing around with Qubes for the first time after (finally!) receiving my 16 and I’ve been kind of stuck on the audio portion, which you mention works fine for you. I haven’t been able to get it to work by following this guide.

  1. Which audio devices did you pass through to the sys-audio vm? I tried selecting both “audio” devices in the list, but when I started the qube I just an error message that the PCI device could not be reset. When I also added the multimedia controller, the system crashed whenever the app vm was started.
  2. How did you manage to pass through the bluetooth mediatek device? Currently, this device is attached to the sys-net qube. Or is it not possible to use bluetooth (for audio, via sys-audio) and wifi (via sys-net) at the same time?

Sorry if any of these questions are obviously “incorrect” / don’t make sense - first time Qubes user, as I said :slight_smile:

Do you have sys-net-usb qube that has both Network and USB controllers attached to it instead of having separate sys-net and sys-usb?
Bluetooth controller should be connected to USB based on info in this topic so you should be able to connect it from your sys-usb/sys-net-usb to your sys-audio using Qubes Devices widget:

Managed to get it working as expected with the links provided, thanks :slight_smile:
I have a split sys-net and sys-usb setup, but the passthrough of the mediatek device worked as expected.
I’m now suddenly hitting some other issues with sys-usb and the USB keyboard, but I don’t think that belongs in this thread :smiley: