Qubes 4.2.0 on non-boot NVMe with separate USB boot device; sys-usb concern re kernel/GRUB updates

User Support General
1

Hello, world! Long time listener, first time caller.

I’m using Qubes on a very beefy machine but which unfortunately cannot boot from NVMe due to the lack of a NVMe EFI driver. (Yes, I know this can often be hacked into place and reflashed, but I’d really rather not go there.) The machine has a small USB flash drive inserted (which will never be removed when the machine is running) and an NVMe drive in a PCIe slot.

I installed R4.2.0 (non-RC) with custom (non-Blivet) partitioning, placing /boot and /boot/efi on two separate partitions on the USB drive, and the LUKS volume with LVM etc on the NVMe.

Installation went perfectly, and the box came up as expected upon rebooting at the end of installation. That said, the template installation step was resulting in a Python exception because it ran out of space. This is probably a bug, no? (Debian, Fedora, and Whonix templates were all selected, and I set the default to debian-12.)

I then enabled sys-usb via sudo qubesctl state.sls qvm.usb-keyboard and rebooted.

If it makes a difference, I installed with kernel-latest; sys-net, sys-firewall, and sys-usb are disposable and running on a clone of debian-12-minimal with the requisite packages installed.

I notice now that the boot drive, being USB, is attached to sys-usb and thus dom0 cannot see it… and thus likely can’t update it either. This will prevent kernel (and grub) updates from being applied, no?

How should I proceed?

Thanks in advance!

2

You can copy files from your USB /boot and /boot/efi partitions to the dom0 root /boot and /boot/efi directories and after kernel/grub update just copy the files from dom0 to your USB using some intermediate offline dispvm.

3

Thank you for taking the time to reply.

That sounds like a terrible hack. I’d like a proper solution, if possible.

4

The solution I am going with is to add another USB controller to the system which will not be passed to sys-usb. It’s not pretty, but it’ll do: an inexpensive PCIe USB controller with no external ports and one internal Type-E port plus a USB Type-E male to Type-A female adapter to plug the flash drive into (variant D).

The flash drive is tiny, so it will barely stick out of the adapter.

Thanks to @marmarek for his advice on GitHub leading me to this solution.