My adventures with Qubes 4.1.1 on a Lenovo T14 Gen 3

User Support
1

Hi :slight_smile:

My workplace has provided me with a new Lenovo ThinkPad T14 Gen 3[1] with a Ryzen™ 5 PRO 6650U and AMD Radeon™ 660M GPU. I can experiment on it (as long as my old laptop works), so I’m trying to get Qubes 4.1.1 running on it. :slight_smile:

My first attempts at getting the installer running didn’t go well … so I tried to read this forum and found bits and pieces and after a lot of errors, found this combination that will allow me to start the installer on the machine:

ISO: QUBES-20221015-KERNEL-LATEST-X86
Xen-args: dom0_max_vcpus=1 dom0_vcpus_pin=1
Kernel-args: module_blacklist=amdgpu acpi=off

  1. I don’t recall the posts/people that lead me to these options, so I can’t give credit to the correct authors :-/
  2. The builtin keyboard/mouse doesn’t work with these options - so I’ve attached a USB keyboard/mouse

Since my display is a 4K, I’ve also attached a docking station and an external monitor - so I’m able to actually read the options (without a magnifying glass). :slight_smile:

Running the installer, everything is fine, until Qubes tries to run efibootmgr and warns me, that the system will not be able to boot … but that can be fixed, so I just continue and reboots.

As warned, the machines won’t boot … but booting a live system (eg. SystemRescueCD) it can be fixed with:

mount /dev/nvme0n1p1 /mnt/
efibootmgr -c -d /dev/nvme0n1 -p 1 -L "QUBES" -l '\EFI\qubes\grubx64.efi'

Since Xen needs extra options to start, I also adds
dom0_max_vcpus=1 dom0_vcpus_pin=1 to /mnt/EFI/qubes/grub.cfg while the live system is running

At the next boot, Qubes starts the “Initial Setup” and it works until it tries to start sys-firewall - then I get:

stdout: ""
stderr: "Start failed: internal error: libxenlight fialed to create ne domain 'sys-firewall', see /var/log/libvirt/libxl/libxl-driver.log for details"

There is no alternativ to click “ok” and after this I have the login screen. After logging in, sys-net fails to start … but by limiting the number of vcpus to 1 for the domains and rebooting, I can actually get online (eg. start ‘personal’, open a terminal and start firefox).

Since the machine is a test anyway, I tried:

[user@dom0 ~]$ sudo qubes-dom0-update --disablerepo=* --enablerepo=qubes-dom0-current-testing

… but I still need both the Xen and the Kernel arguments to be able to boot … and vcpus=1 for domains also seems to be needed.

Next things I’ll try to look at:

  1. Can I set vcpus=1 at the initial setup - so the Initial Setup completes without an error?

My current Qubes seems to be missing parts - I assume the failure during Initial Setup is the cause for that.

  1. Why do I need acpi=off when booting?

I assume some ACPI tables are broken - a more precise disable might also make the internal keyboard/mouse work. I passed a topic about blacklisting some AMD devices - I have to find && read it again …

  1. Will an update to the amdgpu module, make module_blacklist=amdgpu superfluous?

The new kernel from qubes-dom0-current-testing seems to have improved somewhat - but it doesn’t quite boot yet … :-/

  1. Can I update Xen, so I don’t need to limit dom0?

I recall someone commenting that Ryzen CPUs should need 4.15 to work … I have to search the forum further on that topic …

Any suggestions to posts I might have missed (failed to understand/do right?) or things I should/could try, would be appreciated. :slight_smile:

[1]: Full HW details on: https://pcsupport.lenovo.com/dk/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-T-SERIES-LAPTOPS/THINKPAD-T14-GEN-3-TYPE-21CF-21CG/21CG/21CGS0PN00/

2 Likes
2

Okay - looks like I can credit @dylanger for some of the adventure - these posts over at Xen looks like where I got the inspiration for vcpus=1 - and sounds somewhat familiar:

https://xen.markmail.org/message/4e3azb7ngfqbke7q

:slight_smile:

… and it’s also a Lenovo with a Ryzen 6XXX CPU.

1 Like
3

I don’t suppose @ChrisA (or anyone else) managed to get things working smoothly on the T14 Gen 3? I’m not having any luck on mine sadly :frowning:

4

It’s still on my TODO … once Qubes 4.2 shows up on

https://qubes.notset.fr/iso/

I’ll give it a new attempt.

5

Thanks for your digging and sharing it. I also bought a T14 Gen 3 AMD and I intend to run Qubes OS on it, it will sit on my desk until it works :slight_smile:
I appreciate the link with Qubes images you shared as well, the image Qubes-4.1.20230211-x86_64.iso kind of boots up (using module_blacklist=amdgpu acpi=off, have not figured out how to set Xen-args yet.) but I get following error.

PXL_20230213_172111941
PXL_20230213_1721119411920×1446 391 KB

If I don’t set module_blacklist=amdgpu acpi=off installation media boots into a black screen and reboots quite quickly.

6

The Xen-args goes into the line above the kernel args:

  multiboot2 ... loglvl=all dom0_max_vcpus=1 dom0_vcpus_pin=1

(IIRC)

7

Thank you very much @ChrisA, now I got the installer UI to appear. But as you mentioned earlier the mouse pointer isn’t moving and the keyboard does not respond on key press.
I’ll keep trying as new builds of Qubes comes out.

8

If you have a USB Keyboard/Mouse, that can be used. :slight_smile:

I’m pretty sure you don’t need module_blacklist=amdgpu if you boot a 6.x.x kernel from Qubes-4.1.20230211-x86_64.iso :slight_smile:

9

I see, I’ll try it out later on. And thank you for the update on the module blacklist :slight_smile:
Hopefully I’ll end up with something that works, as my T480 is about to get retired.

10

I got it to start the installation but if failed to apply the grub/efi thingies. See photo.

PXL_20230214_124841117
PXL_20230214_1248411171920×1446 141 KB

11

Yes - that’s the efibootmgr that fails to add the boot option:

Looks like the current ISO has the same issues I found back i October. There might be a new Qubes 4.2 in
https://qubes.notset.fr/iso/

soon:

:crossed_fingers:

Edit (2023-02-18): Oh you are teasing me!
http://mirror.notset.fr/qubes/iso/Qubes-4.2.202302181608-x86_64.log

Edit (2023-02-19): Time to do some testing!

Qubes-4.2.202302191645-x86_64.iso                  19-Feb-2023 16:56          6252677120
Qubes-4.2.202302191645-x86_64.iso.DIGESTS          19-Feb-2023 17:04                1291
Qubes-4.2.202302191645-x86_64.iso.asc              19-Feb-2023 17:02                 833
Qubes-4.2.202302191645-x86_64.log                  19-Feb-2023 17:06             1348201
Qubes-4.2.202302191645-x86_64.torrent              19-Feb-2023 17:04              119868
1 Like
12

I guess it might be possible to create a soft link at /boot/efi/EFI/BOOT/bootx64.efi that points to /boot/efi/EFI/qubes/grubx64.efi, which will make the UEFI automatically add the boot entry.

13

Time for another set of tests:

:smiley:

14

How nice, I won’t have time to test for the time being though. When I do I’ll come back with results :blush:

15

I’ve tried Qubes-4.2.202302220603-x86_64.iso , there is no compability change what I can find. VCPU settings and acpi=off is still required, onboard keyboard and mouse does not work and grub still won’t get installed correctly so you have to boot into another liveCD to correct that.

16

Have you tried clocksource=tsc tsc=unstable hpetbroadcast=0 instead of the VCPU parameters? Works on my L14 Gen 3 AMD and Dom0 has a lot smoother performance without being limited to one vCPU.

17

Looks like my T14 Gen 3 is in a weird state at the moment - I tested Q4.2-alpha, so it’s not be the best state test …

I’ll try with a Q4.1.2-rc and see if

clocksource=tsc tsc=unstable hpetbroadcast=0

will allow it to boot … or I still need the acpi=off to avoid it rebooting when it starts … :-/

18

Okay - I’ve tried a series of combinations for the Qubes 4.1.2-rc1 image - some result in the machine:

Just rebooting 
XEN += clocksource=tsc tsc=unstable hpetbroadcast=0
Kernel -= quiet 

XEN += clocksource=tsc tsc=unstable hpetbroadcast=0
Kernel -= quiet 
Kernel += module_blacklist=amdgpu

XEN += clocksource=tsc tsc=unstable hpetbroadcast=0
Kernel -= quiet 
Kernel += nomodeset
``
Failing to reach the installer 
XEN += clocksource=tsc tsc=unstable hpetbroadcast=0
Kernel -= quiet 
Kernel += acpi=off module_blacklist=amdgpu

=> kernel running -- with errors like:
  xhci_hcd "Can't find IRQ for PCI INT .."
  nvme nvme0: I/O QID 0 timeout, completion polled

XEN += clocksource=tsc tsc=unstable hpetbroadcast=0 acpi=off
Kernel -= quiet 

XEN += dom0_max_vcpus=1 dom0_vcpus_pin=1 acpi=off
Kernel -= quiet 

=> Hang with
  "usb usb6. We don't know the algorithm for LMM for thsi host, disabling LMM"
Starts the installer - but with at 'sloppy' screen/mouse 
XEN += dom0_max_vcpus=1 dom0_vcpus_pin=1 acpi=off
Kernel -= quiet 
Kernel += module_blacklist=amdgpu

XEN += dom0_max_vcpus=1 dom0_vcpus_pin=1 acpi=off
Kernel -= quiet 
Kernel += nomodeset

XEN += clocksource=tsc tsc=unstable hpetbroadcast=0 acpi=off
Kernel -= quiet 
Kernel += nomodeset

I repeated some of the tests with the 6.1.7 kernel - the “best” result were with:

XEN += clocksource=tsc tsc=unstable hpetbroadcast=0 acpi=off
Kernel -= quiet 
Kernel += nomodeset

where the installer starts but tells me that my machine is “Unsupported Hardware”, without IOMMU/VT-d/AMD-Vi (after I accept running a release candidate) - and

XEN += clocksource=tsc tsc=unstable hpetbroadcast=0
Kernel -= quiet 
Kernel += acpi=off

ends with “Wait for Complete Device Initialization” and “nvme nvme0: I/O QID 0 timeout, completion polled” (before the installer starts).

Finally testing with

XEN += clocksource=dom0_max_cpus=1 dom0_vcpus_pin=1
Kernel -= quiet 
Kernel += acpi=off

I get to the point where I can select installation destination and actually install the system. This looks the same as the images I’ve tested from mirror.netset.fr.

I suspect something with ACPI - but any hints/suggestions to what to try next are welcome – I keep an eye on the Lenovo site, to see if/when a new BIOS should show up.

1 Like
19

Ah yes, during install I used the vCPU parameters, only after installation I used clocksource=tsc tsc=unstable hpetbroadcast=0

20

Right! – I didn’t get that … I’ll try! :slight_smile:

Does your machine work without adding the acpi=off (to either XEN or Kernel)? … I did update the BIOS to the latest from Lenovo (so I might have added some “new and unknown issue”) to my machine … :-/