Proper guide on how to use sys-audio (AudioVM) must be created

drwelander · May 15, 2024, 6:04pm

Hi @rjrizzuto . I have now since followed the guide here:

GammaSQ/qubes-doc/blob/sys-audio-setup/user/advanced-topics/audio-isolation.md

---
lang: en
layout: doc
permalink: /doc/sys-audio/
ref: 179
title: Dedicated VM for audio-isolation (sys-audio)
---

# Introduction

## General Concept
In Qubes, all VMs output sound to a virtual stream. By default, dom0 collects all these streams and relays them to the sound-device. This has the advantage of a very simple, robust setup. However, it requires dom0 to handle the sound card (a pci-device) and disables any additional sound devices. Since bluetooth-headsets are common or a broken sound-card requires using a USB-sound-device, a more flexible solution may be desirable.

## Setup Goals
A successful setup with this guide will provide a dedicated VM for sound processing. All VMs will output their sound through the new VM instead of dom0. New audio-devices can be added (e.g. via `qvm-usb`) and used as physical output. Microphone capability will be available as before.

## Caveats
Qubes 4.2 switched from pipewire to pulseaudio. Apart from some details (installed packages, required permissions), this doesn't seem to affect user experience at all.

The volume-tray-icon doesn't work for audio-VMs at the moment.

This file has been truncated. show original

That has worked like a charm on 4.2. Have gone through it with a fresh install multiple times. I am currently listening to bluetooth headsets via a sys-audio qube using that guide.

Isolator · November 23, 2025, 4:51pm

After my many previous unsuccessful attempts at setting up a pci usb audio qube, decided to give it another try with a simple usb audio following that guide. Still no luck.

To debug this is another nightmare: the behavior is all over the place, and it doesn’t help that Qubes audio stack is ridiculous (pipewire over pulseaudio over alsa over that vchan module or whatever that crap is).

Debian works, BUT only when there is a bunch of other vms running? And only until the first reboot of client vms? (but this might be due to another random bug Sys-audio drops qubes on restart) If I start it first, then pavucontrol hangs on trying to connect to pulseaudio (the same happens on a fedora based vm, irrespective if I start it first or not). And OBVIOUSLY with a ridiculous audio stack I don’t even know if I should look for a pipewire service or a pulseaudio service or a pipewire-pulseaudio (that get removed in fedora if you follow the guide ) service…

So it very much would be appreciated if someone could finally provide a simple guide listing what packages need to be installed, what services need to be running, what permissions need to be granted, to get not pci audio, hell, not even usb audio, but a simple sys audio cube that would show client vm streams in pavucontrol reliably!

Update:
Okay, after more poking around it appears that both fedora and debian behave identically - setting sys-audio audiovm property to itself before it starts gets pavucontrol stuck trying to connect to puseaudio, but if it’s already started then client vms can connect to it until their first reboot. Also tried to install pipewire-qubes in both templates - no difference.

drwelander · November 24, 2025, 7:58pm

I am sorry you are having such trouble. The link posted gives exactly what packages need to be installed, and running, as well as the permissions needed (including the 50-sys-audio policy file). Following that I have consistently gotten a sys-audio qube (minus the IOMMU issues with my dell hardware which is unrelated). Though I have not tried in 4.R3 yet. With that IOMMU issue (forum post here) sys-audio will not see my HDA audio device until I restart all my qubes, and then it may work randomly (thought it always sees my audio out for my HDMI connection). I don’t blame Qubes for that one, I blame Dell since its their handling.
Do you notice anything weird in any logs when this happens?

Isolator · November 29, 2025, 4:50pm

FINALLY figured it out! FINALLY getting some good quality audio on Qubes! It was indeed this bug that broke pulseaudio configuration on Qubes, so I dunno how y’all are getting your audio to work without patching? Anyway, as I use debian for services, I needed to patch /usr/lib/python3/dist-packages/qubesadmin/tools/qvm_start_daemon.py and then it all works even with sys-audio’s audiovm set to none.

So here’s my guide for sys-usb-audio:

In debian-minimal template install the following packages:
- qubes-audio-daemon
- qubes-core-admin-client
- qubes-usb-proxy
- alsa-utils
- pavucontrol
- pasystray
In dom0 create /etc/qubes/policy.d/40-sys-audio.policy file with the following content:

admin.Events   *                         sys-audio   @adminvm                 allow   target=dom0
admin.Events   +domain-stopped           sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.Events   +domain-shutdown          sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.Events   +domain-start             sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.Events   +connection-established   sys-audio   @tag:audiovm-sys-audio   allow   target=dom0

admin.vm.CurrentState   *   sys-audio   @adminvm                 allow   target=dom0
admin.vm.CurrentState   *   sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.vm.List           *   sys-audio   @adminvm                 allow   target=dom0
admin.vm.List           *   sys-audio   @tag:audiovm-sys-audio   allow   target=dom0

admin.vm.property.Get                +audiovm       sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.vm.property.Get                +xid           sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.vm.feature.CheckWithTemplate   +audio         sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.vm.feature.CheckWithTemplate   +audio-model   sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.vm.property.Get                +stubdom_xid   sys-audio   @tag:audiovm-sys-audio   allow   target=dom0

Patch /usr/lib/python3/dist-packages/qubesadmin/tools/qvm_start_daemon.py in the template as described in the link above.
Make a sys-usb-audio qube based on a debian-minimal template and add audiovm service in its services tab.
Change sys-usb-audio audiovm property to none by running a command qvm-prefs sys-usb-audio audiovm none in dom0, so that you could restart it when needed.
Change the default audiovm to sys-usb-audio by running a command qvm-prefs default_audiovm sys-usb-audio in dom0.
Start sys-usb-audio and check that pavucontol is connected to pulseaudio and displays client audio streams even after restart of client vms, and redirects the output to dummy output (as we don’t have a connected audio device yet).
Congratulations, your qubes pulseaudio configuration works as expected! Attach a usb audio card to your sys-usb-audio and the output should get redirected to it on the fly!

Side note: on debian all you really need is pipewire-pulse for audio to work.

Also, I have a question: how come policy file references @tag:audiovm-sys-audio even though qvm-tags doesn’t list this tag for my sys-usb-audio? Is this some hidden system tag that gets set automatically for each vm?

MrMrau · November 30, 2025, 7:55pm

Hello good people
I have been struggling with deploying sys-audio on QubesOS R4.2.4 for two day now.
I have been following both @Isolator and @neowutran solutions and some combination of them in faith that something would work.
The major issue is that no matter what I do my sys-audio qube does not recognize my audio device (just dummy output in the Default Sink). A bluetooth headset works perfectly :).
Dom0 on the other hand has no problem at all cooperating with (integrated) Audio card.
With the commad: qubes-prefs default_audiovm dom0 everything goes back to normal.
Every single time I experience these two errors:
Denied admin.vm.property.Get+xid …
Denied admin.vm.property.Get+audiovm …
Any ideas?

BACKEND:DEVID  DESCRIPTION                                                                                       USED BY
dom0:00_00.0   Host bridge: Intel Corporation 11th Gen Core Processor Host Bridge/DRAM Registers                 
dom0:00_02.0   VGA compatible controller: Intel Corporation TigerLake-LP GT2 [Iris Xe Graphics]                  
dom0:00_06.0   PCI bridge: Intel Corporation 11th Gen Core Processor PCIe Controller                             
dom0:00_07.0   PCI bridge: Intel Corporation Tiger Lake-LP Thunderbolt 4 PCI Express Root Port #1                
dom0:00_07.2   PCI bridge: Intel Corporation Tiger Lake-LP Thunderbolt 4 PCI Express Root Port #2                
dom0:00_08.0   System peripheral: Intel Corporation GNA Scoring Accelerator module                               
dom0:00_0d.0   USB controller: Intel Corporation Tiger Lake-LP Thunderbolt 4 USB Controller                      sys-usb (no-strict-reset=True)
dom0:00_0d.2   USB controller: Intel Corporation Tiger Lake-LP Thunderbolt 4 NHI #0                              sys-usb (no-strict-reset=True)
dom0:00_0d.3   USB controller: Intel Corporation Tiger Lake-LP Thunderbolt 4 NHI #1                              sys-usb (no-strict-reset=True)
dom0:00_14.0   USB controller: Intel Corporation Tiger Lake-LP USB 3.2 Gen 2x1 xHCI Host Controller              sys-usb (no-strict-reset=True)
dom0:00_14.2   RAM memory: Intel Corporation Tiger Lake-LP Shared SRAM                                           
dom0:00_14.3   Network controller: Intel Corporation Wi-Fi 6 AX201                                               sys-net
dom0:00_15.0   Serial bus controller: Intel Corporation Tiger Lake-LP Serial IO I2C Controller #0                
dom0:00_15.1   Serial bus controller: Intel Corporation Tiger Lake-LP Serial IO I2C Controller #1                
dom0:00_16.0   Communication controller: Intel Corporation Tiger Lake-LP Management Engine Interface             
dom0:00_16.3   Serial controller: Intel Corporation Tiger Lake-LP Active Management Technology - SOL             
dom0:00_17.0   SATA controller: Intel Corporation Tiger Lake-LP SATA Controller                                  
dom0:00_1d.0   PCI bridge: Intel Corporation Tiger Lake-LP PCI Express Root Port #10                             
dom0:00_1f.0   ISA bridge: Intel Corporation Tiger Lake-LP LPC Controller                                        
dom0:00_1f.3   Audio device: Intel Corporation Tiger Lake-LP Smart Sound Technology Audio Controller             sys-audio (no-strict-reset=true)
dom0:00_1f.4   SMBus: Intel Corporation Tiger Lake-LP SMBus Controller                                           
dom0:00_1f.5   Serial bus controller: Intel Corporation Tiger Lake-LP SPI Controller                             
dom0:01_00.0   Non-Volatile memory controller: Samsung Electronics Co Ltd NVMe SSD Controller SM981/PM981/PM983  
dom0:58_00.0   Ethernet controller: Intel Corporation Ethernet Controller I225-LM                                sys-net

Thank you

Isolator · December 13, 2025, 11:29am

You need these two lines in your policy file:

admin.vm.property.Get                +audiovm       sys-audio   @tag:audiovm-sys-audio   allow   target=dom0
admin.vm.property.Get                +xid           sys-audio   @tag:audiovm-sys-audio   allow   target=dom0

Are you sure you have a policy file for sys-audio in /etc/qubes/policy.d/? Btw, I couldn’t get it to work with pci audio card - some issues with pci passthrough. Check if your audio card is passed correctly by running aplay /usr/share/sounds/alsa/Noise.wav in sys-audio.

Anyways… does anybody know how I can use mic with my sys-usb audio? I can see recording streams in my sys-audio for each client vm, but nothing in the client vms themselves?