Issues with Installing Windows 10/11 in Qubes using qvm-create-windows-qube (QSB-091: Windows PV drivers potentially compromised)

User Support
, , ,
1

Hello Qubes Community,

I’m seeking help with installing Windows 10 or 11 in Qubes OS using the qvm-create-windows-qube method by Elliot Killick. I need Windows for specific software like Adobe Illustrator, Microsoft PowerBI, and ESRI ArcGIS.

Background:

Questions:

  • How can I install Windows 10 or 11 in Qubes using Killick’s method, considering the QSB-091 issue?

  • Did anyone else encounter this issue, and if so, how did you resolve it?

  • Is it possible to use Windows Qubes without Qubes Windows Tools (QWT), and if so, are there any limitations or workarounds?

  • Are there any updated instructions or alternatives to Killick’s method that can help me achieve a successful installation?

Additional Context:

  • I’m hesitant to try the advanced installation method on the Qubes website, as I recently bricked my Qubes OS audio while trying to implement sys-audio for Bluetooth and had to reinstall the OS afresh from a bootable USB.

  • Additionally, I only have one PC at the moment thus no spare PC lying around for Windows-specific tasks.

Any guidance or advice/ up-to-date installation method would be greatly appreciated!

2

Install qubes-windows-tools following the guide:

Note: Due to the security problems described in QSB-091, installation of Qubes Windows Tools is currently blocked. Instead, a text file containing a warning is displayed. Currently, it is difficult to estimate the severity of the risks posed by the sources of the Xen drivers used in QWT possibly being compromised, so it was decided not to offer direct QWT installation until this problem could be treated properly. While Windows qubes are, in Qubes, generally not regarded as being very trustworthy, a possible compromise of the Xen drivers used in Qubes Windows Tools might create a risk for Xen or dom0 and thus be dangerous for Qubes itself. This risk may be small or even non-existent, as stated in QSB-091. If you understand this risk and are willing to take it, you can still install the previous versions of Qubes Windows Tools, using the command

sudo qubes-dom0-update qubes-windows-tools-4.1.68

for Qubes R4.1.2, or

sudo qubes-dom0-update qubes-windows-tools-4.1.69

for Qubes R4.2.0, respectively, instead of the command listed in step 1 of the installation described below. This will provide the .iso file to be presented as an installation drive to the Windows qube in step 3 of the QWT installation.

If you prefer to download the corresponding .rpm files for manual QWT installation, these are still available from the repositories (version 4.1.68-1 for Qubes R4.1.2 and version 4.1.69-1 for Qubes R4.2.0). After downloading, copy the file to dom0 as described in How to copy from dom0 and install it via sudo dnf install /path/to/rpmfile. Now you can proceed according to step 3 of the description below.

Warning: These older versions of Qubes Windows Tools will be replaced during the next dom0 update by the current dummy version 4.1.70-1. This can be inhibited by appending the line exclude=qubes-windows-tools to the file /etc/dnf/dnf.conf in dom0. But this will also stop any further QWT updates - so be sure to remove this line when - hopefully - a new functional version 4.1.71-1 of Qubes Windows Tools will be made available!!!

Qubes Windows Tools (QWT) | Qubes OS

Then retry qvm-create-windows-qube.

You can use Windows without QWT but it won’t have clipboard sharing, file copy/move between qubes etc. It’s described at the start of the guide linked above.

2 Likes
3

Thanks @apparatus for the guide. I successfully installed Windows 10, but I’m having trouble installing QWT (Qubes Windows Tools) during the Windows installation process. This is a major issue because without QWT, my Windows qube is essentially unusable since I don’t have access to sys-usb, sys-net, and sys-firewall.

I also followed the guide for QWT and appended the line exclude=qubes-windows-tools to the file /etc/dnf/dnf.conf in dom0. You can see the steps I followed in the block quote below:

Kindly help me out. Thanks

4

What’s issue do you have with installing the QWT?
Did you follow the guide?

1 Like
5

Yes I followed the guide by doing the following in the newly created Windows HVM. However, I am stuck at step 4 of the guide shown below:

  1. For Windows 8.1, 10 and 11: From the Windows command line, disable hibernation in order to avoid incomplete Windows shutdown, which may lead to corruption of the VM’s disk.
powercfg -H off

Also, these versions of Windows won’t show the CD-ROM drive after starting the qube with qvm-start vm --cdrom ... or qvm-start ... --install-windows-tools. The solution is to disable hibernation in Windows with this command. (That command is included in QWT’s setup but it’s necessary to run it manually in order to be able to open QWT’s setup ISO/CD-ROM in Windows).

  1. To install the Qubes Windows Tools in a Windows VM one should start the VM passing the additional option --install-windows-tools:
qvm-start <VMname> --install-windows-tools

Once the Windows VM boots, a CDROM should appear in the ‘My Computer’ menu (typically as D: or E:) with the setup program qubes-tools-x64.msi in its main directory.

  1. Install Qubes Windows Tools by starting qubes-tools-x64.msi (logged in as administrator), optionally selecting the Xen PV disk drivers. For installation in a template, you should select Move user profiles.

Issue: “Please Insert Disk Error” during Qubes Windows Tools installation

Description: I’m trying to install Qubes Windows Tools by running the qubes-tools-x64.msi file as an administrator in Windows HVM. However, during the setup wizard, I’m encountering a “Please Insert Disk Error” message, which prevents me from completing the installation. I’ve tried selecting the Xen PV disk drivers and Move user profiles, but the issue persists.

Question: Is there any known solutions or workarounds?

6

I’ve installed QWT in WIndows 10 a few months ago and I didn’t have this issue.
What Windows version are you trying to install?
Maybe try to update Windows before trying to install QWT.
Can you make a screenshot of the error?

7

See attached screenshot for reference to the issue.

8

The image is empty.

9

Apologies for that @apparatus.

Attached is the screenshot: 93.7 KB file on MEGA

10

Not sure what’s the cause of this issue.
Try to copy the QWT installer from the CD-ROM to the desktop and execute it from there.

11

Thanks @apparatus.

I’ve successfully installed Windows 10 HVM qube with QWT. However, I have two questions:

  1. Is it possible to run Windows HVM in full-screen mode? I’ve tried right-clicking the top menubar and selecting “fullscreen”, but it doesn’t work.
  2. The HVM is running slowly. My PC has 16GB RAM, with 4GB allocated to dom0. I’ve increased the HVM RAM to 8GB, but this limits my ability to use other Fedora qubes. What are the recommended CPU core and RAM allocations to improve performance?
  3. The audio in the Windows HVM is quite choppy. What can be done about this?
12

Set Windows display resolution to be the same as dom0 resolution an you’ll be able to enter fullscreen mode.

You can increase the number of VCPUs assigned to your HVM if the CPU is the bottleneck.

It depends on the workload that you have in the Windows.

I saw similar reports about it but with no solution. You can try to search the forum for more info.

13

Hello,
1 question, “fullscreen” , qubes os is the super security system , so by definition…you use on the same screen 2-3 and more different systemes , separated ( this is the “hard” of security); I use Dell screen, not sophisticated but large 32 ’ I thing , and manage several windows on.
2/concerning Hardware …I tried on differents machines …now ( with success) i use …IntelXeon 3.7 GHz; RAM 32 ( minimum) and 256 GB NVMe disc .This system is based on virtuality, so the maximum RAM 's is better.
3/audio in windows ( installed by iso …Win 7) works but not audio…but it is very rapid