Qubes Windows Tool ISO Missing

philDunphy · December 13, 2023, 12:21am

I am fairly new to Qubes, but I have been able to get a up and running with alot of different qubes with this one exception.

Everytime I try to launch my windows VM from the dropdown menu in Qube Manager to launch the VM with Qubes Windows Tools it does not launch. So I tried launching it through the dom0 terminal with qvm-start and I get the error “losetup: /usr/lib/qubes/qubes-windows-tools.iso: failed to set up loop device: No such file or directory.”

Do I need to download the ISO, and if so where is it available for download?

I have tried “qubes-dom0-update qubes-windows-tools” and I get the same error in the dom0 terminal.

apparatus · December 13, 2023, 3:04am

Note: Due to the security problems described in QSB-091, installation of Qubes Windows Tools is currently blocked. Instead, a text file containing a warning is displayed. Currently, it is difficult to estimate the severity of the risks posed by the sources of the Xen drivers used in QWT possibly being compromised, so it was decided not to offer direct QWT installation until this problem could be treated properly. While Windows qubes are, in Qubes, generally not regarded as being very trustworthy, a possible compromise of the Xen drivers used in Qubes Windows Tools might create a risk for Xen or dom0 and thus be dangerous for Qubes itself. If you understand this risk and are willing to take it, you can still install the previous versions of Qubes Windows Tools, using the command
sudo qubes-dom0-update qubes-windows-tools-4.1.68
for Qubes R4.1.2, or
sudo qubes-dom0-update qubes-windows-tools-4.1.69
for Qubes R4.2.0, respectively, instead of the command listed in step 1 of the installation described below. This will provide the .iso file to be presented as installation drive to the Windows qube in step 3 of the QWT installation.

If you prefer to download the corresponding .rpm files for manual QWT installation, these are still available from the repositories (version 4.1.68-1 for Qubes R4.1.2 and version 4.1.69-1 for Qubes R4.2.0).

Warning: These older versions of Qubes Windows Tools will be replaced during the next dom0 update by the current dummy version 4.1.70-1. This can be inhibited by appending the line exclude=qubes-windows-tools to the file /etc/dnf/dnf.conf in dom0. But this will also stop any further QWT updates - so be sure to remove this line when - hopefully - a new functional version 4.1.71-1 of Qubes Windows Tools will be made available!!!

github.com

GWeck/qubes-doc/blob/41c4cc565cb047277870189dca0d613ece0584f0/user/templates/windows/qubes-windows-tools-4-1.md

---
lang: en
layout: doc
permalink: /doc/templates/windows/qubes-windows-tools-4-1/
redirect_from:
- /doc/templates/windows/windows-tools41/
- /user/templates/windows/windows-tools41/
title: Qubes Windows Tools (QWT)
---

Qubes Windows Tools (QWT) are a set of programs and drivers that provide integration of Windows 7, 8.1, 10 and 11 Standalone, TemplateVMs and AppVMs with the rest of the Qubes system. They contain several components than can be enabled or disabled during installation, and rely on specific functions of Qubes which support this integration:

- **Shared components (required)** - common libraries used by QWT components
- **Qubes GUI Agent** - video driver and GUI agent that enable the seamless GUI mode that integrates windows apps onto the common Qubes trusted desktop (currently only for Windows 7)
- **Disable UAC** - User Account Control may interfere with QWT and doesn't really provide any additional benefits in Qubes environment
- **Clipboard sender/receiver** - Support for [secure clipboard copy/paste](/doc/copy-paste/) between the Windows VM and other AppVMs
- **File sender/receiver** - Support for [secure file exchange](/doc/copying-files/) between the Windows VM and other AppVMs
- **Xen PV drivers** - drivers for the virtual hardware exposed by Xen for Windows that increase performance compared to QEMU emulated devices and are required for attaching USB devices
   - Base Xen PV Drivers (required): paravirtual bus and interface drivers
   - Xen PV Disk Drivers: paravirtual storage drivers

This file has been truncated. show original

philDunphy · December 13, 2023, 4:55am

Is there another way to connect a usb drive or transfer files to a Windows qube besides QWT?

apparatus · December 13, 2023, 4:59am

You can enable Windows USB integration without QWT:

craig0 · March 18, 2024, 10:09pm

Any idea when this will fixed. If i’m reading this correctly, it sounds like the Xen team replaced the possibly compromised drivers back on 7-14-2023.

We have removed all previous binaries from:

Index of /pvdrivers/win

A new set of drivers based on the current master branch
(9.0-unstable) and built on a trusted environment have been uploaded
on the same folder with the following hashes:

$ sha256sum xen*.tar
b089e46d52ffc64a14799c609272ccdded805c1552a88b45d95a64a27e775de7 xenbus.tar
afc6f11f9078cb457daa000b8b8d8ab69656d3950e7afbf6f40aaa5da217301a xencons.tar
7bbcedcda5e2ffa8ab32eb3d207d1c7db5b91e22926b26d75750bfadde6611f0 xenhid.tar
a8f3344e370647696e3ed39201f5c9db693aca1c093a638fde8b7a928a4416c2 xeniface.tar
560d7049f5e321545dda25c26b5f56e0975a7f62d35629f4c9a73f0fbd148cf3 xennet.tar
9cb34cd135aab045a2401098c4044c95dbd179c454718e43045e433401b8e3dd xenvbd.tar
47c1b9bc6e90e20d3f524036a3171cf7f8da1d94186febbae0d4a108db7bb3b5 xenvif.tar
09a4b108a9d3fca699c3c31aeb4836cfee2538e588462b0646dcccbde42a4263 xenvkbd.tar

AWhite · March 19, 2024, 12:28am

What version do you want? I have 9 different versions of the tools. I downloaded them ages ago and put them into my storage for use for whatever version I wanted instead of having to always configure things again and again.

I just attach the ISO as a BOOT TO DEVICE and it generally functions properly.
Otherwise I attach it as a device on booting via the CLI which the interface is supposed to do properly, but doesn’t do that functionality for some reason.

apparatus · March 19, 2024, 2:59am

The new binaries are not signed by Microsoft key and they require you to enable test-signing mode in Windows.
You can read more about this issue here:

You can track this issue here:

github.com/QubesOS/qubes-issues

Release-signing for Windows Xen PV drivers

opened 09:48AM - 07 Mar 24 UTC

omeg

T: enhancement C: windows-vm P: default

Currently the Windows PV drivers are test-signed because upstream doesn't provid…e signed binaries anymore. This requires all Windows VMs to enable test mode which is not ideal. Release signing requires a few steps: - A proper code signing certificate (any authenticode one from a public CA is fine). - Windows Hardware Compatibility Program certification. The drivers need to be tested in the [Hardware Lab Kit](https://learn.microsoft.com/en-us/windows-hardware/test/hlk/) with a proper set of rules, then the (passing) results sent along the binaries and the signing cert to Microsoft for certification. If all goes well we receive MS-signed binaries back. - Some modifications to the Xen backend/pvdrivers might be needed, specifically to change the PCI device IDs so they don't conflict with the upstream values. From my understanding only one set of drivers for a particular set of hardware IDs is permitted. - Changes to the building process to accommodate using a release cert, probably from an external storage/card reader. We would gain some significant usability improvements from this: - The drivers could be distributed via Windows Update, no need to bundle them with Qubes Windows Tools. - No need for test signing being enabled so reduced OS attack surface. - Possibly automatic crash dump collection from Windows Update (hopefully not needed). There are some disadvantages too: - The cost for the code signing cert (a few hundred dollars per year). - HLK testing is pretty involved and requires a special multi-VM setup. I wasn't able to get it to fully work in Qubes, there were some weird connectivity issues despite the VMs being properly connected via network. I was able to do tests in a native Windows environment though. - HLK certification needs to be done for every update (tests can easily take more than a day to fully run).

alaska · April 10, 2024, 11:50am

I didnt want to make a new thread about this:

How can we use Windows Machines in Qubes without W-Xen-Drivers ?

Via RDP from another qube, maybe?

Thanks

adw · April 10, 2024, 1:30pm

You can just use them like any normal HVM:

alaska · April 10, 2024, 4:56pm

Thank you @adw.

AWhite · April 12, 2024, 5:59am

Just install the QWT and use them… Not hard…

I still use the drivers, as there is no issue with anything that I’m doing on my Windows to worry about this “vulnerabilty”.

I posted earlier that I have 9 different versions, and asked what one you wanted, but noone wants them even though they are asking about them and wanting them?