Short list of laptops/desktops that work well with Qubes OS

@moonlitOrca … have you checked if it qualifies?

About Thinkpad T16 Gen 1

After making additional test and posting HCL I am planning to propose Thinkpad T16 Gen 1 to be in a recommended list.

Because it finally works with modern kernel and updated Qubes OS almost flawlessly:

  • It can have up to 48 GB of RAM.
  • I have no video, network, bluetooth, audio issues (but further testing may be required).
  • It supports S3 for suspend and it finally works well (it was not working due errors in Linux kernel).
  • Fans are working great (quiet, silent on idle) with thinkfan, quite a problem on Qubes OS on many laptops when fans are noisy compared to GNU/Linux.
  • No video glitches (because Qubes OS finally works fine with Intel Gen 11/12 CPUs).
  • It has PS/2 keyboard and thinkpoint (like mouse). It is deal-maker for some. BOTH keyboard and mouse works even if you screw the sys-usb completely!
  • Available for purchas. With different screen resolutions and etc.

Currently I see one not fixed problem - touchpad is not working properly after suspend in have of cases, the second suspend fixes the touchpad. But I have the similar problem on GNU/Linux (e.g. Ubuntu), so it is not Qubes OS related bug. And once again trackpoint works flawlessly as mouse in all situations.

About NovaCustom NV41 Series

I do not have the certified NovaCustom NV41 Series laptop, but to my opinion currently it looks a bit shady.

  • I also do not think we have “multiple community members” with this laptop on the forum to confirm it works as expected in sophisticated cases users face.
  • The owners of NovaCustom NV41 Series are not providing enough information about their laptop and do not reply to questions asked. Does not look good to me.
  • I have not seen really detailed report for NovaCustom NV41 Series, only HCL and some praising comments that everything works from the product owner.

I think if I had it I would have found issues with proper testing and different use cases.
So, for me personally NovaCustom NV41 Series is a less reliable than modern Thinkpad T16 Gen 1 that I know more about. So if I had a choice which one to take - I am not sure that I would go with the certified NovaCustom NV41. At least not until more information is provided by real buyers on the forum.

The only practical advantage of NovaCustom NV41 Series that I see is coreboot support. I am not sure how important it would be for me personally, but for the majority of users it probably does not matter. That is why coreboot is not a requirement for the recommended list, as we see there are models without it in the list.

Please look this up: Framework Laptop 13th Gen, Intel i5-1340P - #12 by balko

…since we added suspend to the requirements with R4.1, this would currently disqualify the T16. Maybe it’s fixed with R4.2?

I mistyped, in “half” of cases. And in cases the fix is - suspend and resume again. It is advice from Arch wiki, so I do not think that the bug is Qubes OS related. Note that on Kubuntu the touchpad is broken completely after suspend with no recovery, and this laptop is CERTIFIED by Ubuntu officially.

About working on R4.2: I do not know. I think it will be fix in GNU/Linux upstream eventually.


So, we currently have 1 laptop on the recommended list that can be bought new nowadays (I do not take into account all old models with old generation Intel CPUs).
And this 1 laptop lacks basic information what is really working and what is not, no proper and deep testing reported by any forum user. And the seller is not providing additional information about USB controllers and does not answer questions.
And we also have no hope to add any additional modern laptops to the list because there are no S3 mode on modern laptops except several Thinkpads that require workarounds.

I think, under these circumstances such list is not serving the purpose of its existence, and nobody should make a choice solely based on it. I would prefer to buy a modern laptop that is recommended by Qubes OS users requiring multiple workarounds instead of making choice between 1 model that is not properly tested by community. Maybe the list approach should be reconsidered?

I support @moonlitOrca’s intention and logic behind their proposal.

Oh, I forgot about Purism. OK, 2 modern laptops, both have limited market (not mass market like Thinkpads), both not sold world-wide (thus, too expensive to buy online).

Purism also have 1 USB controller and no keyboard nor mouse internally connected to PS/2, like Thinkpad T16 and some other Thinkpads have (if I am not mistaken).

I was talking about this list:

Well, Qubes team has tested it, I believe? I came to this conclusion because I saw UPDATE: 6.4.2 by fepitre-bot · Pull Request #791 · QubesOS/qubes-linux-kernel · GitHub then Linux 6.4.2 crashes sys-net on NovaCustom NV41 with Intel Killer Wi-Fi · Issue #8339 · QubesOS/qubes-issues · GitHub, so I think Qubes team has at least one NV41 laptop running their openqa test suite to make sure it would stay on the certified list.

1 Like

Thanks for the information! It is great that the Team put effort to fix something for NovoCustom NV41. But still, no real forum users, no long-time users (device is too new, of course) and, the most of all, no users who shared the experience and problems they have. For me personally it is hard to recommend it under such conditions.

I mean the certification is great, but I would like to see some detailed report and information about USB controllers, PS/2 input and other stuff.

1 Like

Yes, I did read through the requirements before posting, and the Framework (11th gen at least, since that’s what I can speak for directly) requires only one thing to meet them all in Qubes OS 4.2: the kernel argument mem_sleep_default=deep in order to enable S3 sleep (but I think that every laptop requires that for S3 sleep, so that’s not a workaround, right?),

To make everything work in 4.1 correctly, it needs the above mentioned kernel argument, but also a later kernel than shipped with the original 4.1 ISO for both Xen and Linux (something from the last year). Again, I don’t think that’s a workaround since every recent computer has the same requirement, and the kernels update in Qubes OS automatically. The only potential problem is if the original Qubes 4.1 ISO is used to install from more than a year ago and then one would need to update to kernel latest (or something newer than the disc) in order to get the AX210 wifi to operate correctly in order to get the updates.

  • Install for both 4.1 and 4.2 proceeds without workarounds (and 4.2 doesn’t even require a newer kernel)
  • Graphics, audio, and suspend work perfectly with the kernel argument (and 4.2 doesn’t need a newer kernel)
  • RAM slots are not soldered and can host as much RAM as 64GB
  • No ps/2 port, but that’s not required for laptops on the list, I believe.
  • Readily available for purchase and growing in popularity
  • I am happy to work with any community members to confirm things, as needed. I don’t have experience with the latest generation of Framework (13th Gen), but all the hardware is identical except the mainboard chipset and CPU, and so I do know almost everything should work. The latest HCL report for the 13th gen seems to say the same. Everything works as long as the kernel argument for deep sleep is added (Framework Laptop 13th Gen, Intel - #3 by b34)

I am just trying to honestly help and contribute to a project I value and care about, and I really think the Framework series presents one of the best Qubes OS options that exists at this time for latest hardware and nice design and upgradability. Plus it seems a number of forum members use it so there would be at least some support for new users to be had, and that’s always helpful too.

1 Like

I really like this suggestion by @fsflover:

And it will be great to extend it. E.g.:

  • separate outdated (old, sold-only-used) laptops to the separate list.
  • while the list is reasonably small it will be great to modify USB controllers column. Because 3 in it means nothing. It can be the same as 1 if keyboard, wifi, mouse, bluetooth and USB ports are on a single controller. Additional information is required. At least for modern laptops.
  • I also propose to add column PS/2 keyboard/mouse. Because it is very important in Qubes OS.
  • And Wifi being a separate PCI device and not connected to USB is also very important.

If we take this amount of properties then we, maybe, can reconsider the requirements of being added to the recommended list and consider models provided by @moonlitOrca , @augsch, me and other users objectively and deeper.

3 Likes

Please check it nonetheless. Thankpad T16 has PS/2 keyboard and mouse (trackpoint), to my surprise.

1 Like

I had no idea that ps/2 ports were still on some laptops! Thanks for pointing this out. There is not one on the Framework computers for sure though. They support USB C and USB A for peripherals and an integrated headphone jack as the only non-swappable port (the Framework laptops support swapping all the ports for things such as HDMI, DisplayPort, SD card reader, etc.) It s a very cool system.

No, I am not talking about physical connectors, not about real PS/2 ports on laptop case. But about how it is connected inside. Thinkpad T16 Gen 1 has both keyboard and trackpoint connected in the way that if sys-usb hangs, keyboard still works flawlessly. Because those are not connected internally via USB at all (unlike touchpad) but in some different way, probably PS/2. Maybe your Framework has the same.

Please answer this comment of mine to understand the situation: Framework Laptop 13th Gen, Intel i5-1340P - #12 by balko

The NV41 is certified, which means functionality is tested and ensured by the dev team. It is also available from Nitrokey, which might be more responsive to your inquires.

I guess you are in a first world nation with plenty of disposable income and need to have brand new shiny hardware. Good for you.

Other people might have other needs and perspectives. Some (like me) might find it intolerable to run ME and rather take a hit in performance, some might not have the budget or opportunity to buy a new computer. This has been discussed many times.

You are imposing your needs and perceptions on everybody. Others (like me) might think X230 and T430 are the only acceptable choices. In fact, we have four tiers of hardware choices for users to choose from:

  1. certified (just works, the dev team makes sure)
  2. community-recommended (just works, the community evaluates and to a degree supports)
  3. HCL (positive reports may still need troubleshooting and workarounds)
  4. system requirements (roll the dice and make it work on your own)

(1&2) are for users who need a reasonably secure laptop now and don’t have the time, will or skill to troubleshoot and apply workarounds. (3) is for folks like you: able to reason about their requirements, making an informed decision and then do what’s need to make it work and (4) is for the brave :wink:

4 Likes

I was not saying that old 10+ years laptops should be removed from the list, just in case you misunderstood me that way. I proposed them to be separated similar to what @fsflover proposed before.

I am concerned about modern versions of laptops in the recommended list. It has 2 options that are not easy to buy world-wide because those are not mass market options.

1 Like

I don’t think that will change anytime soon.

R4.1 (dom0) is based on Fedora 32, which in turn was released in April 2020. That means any computer newer than early 2020 will probably have some issues when you attempt to use it with R4.1.

R4.2 will be based on Fedora 37 which was released November last year.

You will always be better off using Qubes OS on a machine that is 3+ years old depending on how recent the last Qubes OS release was. We kind of joked about this before, but it’s true.

1 Like

A post was merged into an existing topic: HCL - System76 Galago Pro 2 (N131BU)

4 posts were merged into an existing topic: HCL - System76 Galago Pro 2 (N131BU)

Hello @balko ,

I just saw your comment on one of the laptops we offer.

@Sven thank you for already pointing to some of the points I am mentioning here again. To you, I would like to let you know that the NV41 Series has the ability to disable Intel ME by using the HAP disabling method. It’s a UEFI firmware option.

I do not have the certified NovaCustom NV41 Series laptop, but to my opinion currently it looks a bit shady.

We are not a brand that is as big as Lenovo, unfortunately. This is why less information might be available. Still there are some important things to consider.

Despite the fact that the NV41 Series being the most sold Series of NovaCustom, there are not so many reviews about this device. This is mainly because we had a technical issue with our review system for months, which has been solved now. The NV41 Series has been reviewed at least twice:

NV41 Series 14 inch coreboot laptop - NovaCustom → tab review
Trisquel 11 on NV41PZ: First impressions – Simon Josefsson's blog

The fact that there are so few issue reports of this laptop series is rather a good thing. This isn’t a surprise, as the laptop is Qubes OS certified, meaning that the firmware is being tested with Qubes OS before every new firmware update. Likewise, each new Qubes OS version is tested by Qubes OS main developers on the laptop before a new version of this operating system is released.

You can find more details about the laptop on the Specifications tab of the first link. For example, the laptop supports S3. If you are missing any important info, I would be happy to answer your questions. You can also point me to unanswered questions if you would like.

I’m not sure if our keyboard and touchpad are initialised as PS/2 device. If anyone knows how I can check this, I would be glad to know it. Same for the USB controller and the WiFi card: I would be glad to know what output you need.

We are working on Heads integration. I suggest to join the Dasharo Users Group (DUG) online, or to visit or follow the Qubes OS Summit in Berlin in the weekend of the 7th of October this year.

4 Likes

What I and probably other possible buyers would be interested in:

  1. What USB Controllers connected to. The HCL says it has 3 of them, but by itself it does not mean a lot (based on Thinkpad situation). Can you please provide information about what USB devices are shown in Qubes OS (run qvm-usb) and what exactly 3 USB controllers are connected to, including the physical USB ports on the laptop.
    E.g. something like:
  • USB Controller 1: two physical USB 3.0 on the left side, one type-C on the right.
  • USB Controller 2: keyboard and touchpad.
  • USB Controller 3: nothing.
  1. About keyboard and touchpad connection as PS/2, PCI or something else non-USB. it is kind of important.
    You can check it by running Qubes OS with sys-usb that manages all USB-controllers. When you shutdown sys-usb what happens with keyboard input or touchpad, how are they affected? Do they still work, do they freezes during shutdown process (it may happen in case it is passed back to dom0). Maybe, @Sven can provide more easy-to-understand explanation of what I am trying to ask.

  2. The HCL table is missing information about TPM in your laptop, it will be better to fill it, too.

Thank you for supporting FLOSS and and all.

4 Likes