Anyone here running Qubes OS on a secured-core laptop (dell latitude, precision, modern thinkpads) and wouldn’t mind sharing their experience? I’m mainly wondering if the security features that are OS agnostic work properly and are supported on Qubes OS. As well as this, does Total Memory Encryption…

After reading up on what a secured-core PC is, it sounds to me like its windows specific, and mainly to handle USB based attacks. That being said, I didn’t spend too much time reading into it so maybe I missed some special feature. If you use qubes properly and don’t allow USB access past sys-usb t…

Secured-core PCs aim to mitigate firmware based attacks as much as possible and are therefore OS agnostic, not reliant on Windows. The link I mentioned above details most of these security features and the only ones reliant on Windows have to do with BitLocker and Windows Hello. I believe the advant…

Yes, most features seem Windows specific. Some of the use virtualization for extra security, with VT-x and VT-d(IOMMU) which are both already mandatory in Qubes. TPM 2.0 is afaik not yet supported for AEM. Secure boot is not yet supported for Qubes. Not sure about SMM isolation. As well as this…

Both TSME (AMD) and TME (Intel) work, it’s all done in the hardware. The multi key encryption (MKTME) from intel doesn’t work, as fare as I can tell. Have you tried using AMD’s secure encrypted virtualization (SEV)? It seems to be supported by libvirt, I’m guessing there is a chance it could work…

[image] anon40243023: Have you tried using AMD’s secure encrypted virtualization (SEV)? It seems to be supported by libvirt, I’m guessing there is a chance it could work with Qubes OS? There is no software support yet: Consider support for AMD's SEV for Ryzen PRO (4750U) Laptop · Issue #6105…

[image] Scumbag: TPM 2.0 is afaik not yet supported for AEM. Secure boot is not yet supported for Qubes. Yeah I was going to wait for them to be supported before getting the device. [image] Scumbag: AMD’s TSME works just fine with Qubes on my machine. Isn’t this only available on Ryz…

Yes, you need Ryzen Pro or enterprise CPU’s afaik. I have a Thinkpad L14 AMD Gen3, to my knowledge it does not have a Pluton chip.

Are you able to get firmware updates from Lenovo using LVFS in Qubes? I tried reading up on LVFS in Qubes but I couldn’t find much about it, although I know it is supported. Do you run the command in dom0?

Okay, I wasn’t sure if it worked. I was looking into MKTME, which doesn’t seem to have any support at all, where at least SEV seem to have some support from libvirt. https://libvirt.org/kbase/launch_security_sev.html

Does not having MKTME greatly undermined the RAM encryption?

Secured-core laptop compatibility with QubesOS?

User Support Hardware Issues

Scumbag April 21, 2024, 5:36pm 15

I tried but there is no documentation yet and the command didn’t work for me: