Wayland in dom0 with KDE or qubes-wayland

privacyuser · June 7, 2024, 10:20pm

As far as I am aware, there are two ways to use wayland in qubes. The first is to install KDE, which lets you choose between a wayland session and an xorg session at the login screen. Second would be this: GitHub - DemiMarie/qubes-wayland
Just to clarify, that would switch dom0 over from xorg to wayland, yes?
And as for the vms themselves, if I were to install it inside of a hvm, then that would switch it from xorg to wayland also?
Are there any side effects such as the copy-paste breaking? (for the second option) How about the GUI vm? Is it possible to use sys-gui with wayland if dom0 is running on wayland?

apparatus · June 8, 2024, 4:48am

Wayland is not yet supported in Qubes OS:

github.com/QubesOS/qubes-issues

Use Wayland instead of X11 to increase performance

opened 05:47PM - 05 Dec 17 UTC

artemist

T: enhancement C: gui-virtualization P: major release notes S: in progress bounty

Although this is not a security issue due to the guid security model, there are …several advantages to using Wayland instead of X11: ## Advantages ### Higher performance If allocations are on page boundaries, then we can use xc_map_foreign_rage (or the equivalent in the HAL) to map framebuffer pages directly from the client in the VM to the compositor in the guivm ### Lower memory usage Since framebuffers are mapped instead of copied, the proxy wayland compositor should use less memory than xorg (On a VM which currently has 800M of RAM and two windows, Xorg is using 1/6th of the physical memory) ### Easier GPU acceleration support AFAIR, a lot of OpenGL operations are preformed within the X server through the X OpenGL extensions. Simply forwarding these commands to the guivm would be dangerous, so we would need to process within the Xorg server then send the displaylist sometime before the end of processing and rendering. With Wayland graphics processing happens within the context of the application, and only a framebuffer is shared to the compositor. This means that we can simply attach GVT-g or comparable hardware graphics virtualuization to VMs without complex modifications to guid. ### Multiple dpi support Wayland allows one to attach multiple displays with different densities, which is important for people with HiDPI laptops who want to use external displays. We can simply forward events for screen update to the client, although we have to deal with anonymity for anon-whonix, where position of multiple displays could be very revealing. ## Method Wayland has two communication methods; Commands over a Unix socket, and shared memory buffers through a file descriptor with mmap. Commands, including shared memory setup and keyboard input, should be proxied through a client in the guivm and a stub compositor in the appvm. However, wl_shm::create_pool and wl_shm events should be intercepted so that the stub compositor and guivm wayland client both create file descriptors in their VMs, and the guivm maps a foreign range (or asks dom0 to do so, I'm not sure quite how that would work) to link together the contents of those two memory ranges. ## Doing this I am starting work on forwarding Wayland between VMs. I would be interested in working on this for Google Summer of Code if the Qubes project decides to join.

kerob_labs · March 22, 2026, 8:08pm

I have a custom Fedora 43 Workstation (GNOME and Wayland) with KVM type-1 hypervisor with the same coloured window decoration used in Qubes, but does not implement the high-end cyber-security features.

I first tried to ask for help to setup Qubes on my laptop (AMD Ryzen AI 9 HX370 with Radeon 890M) but never got a reply, so I decided to first implement my own Qubes with Xen and X11. The experience was very disappointing, what motivated me to switch to KVM and Wayland.

Current status: the work is focused on Workstation environment and high-performance work (no cyber-security as done in Qubes), using Wayland. It has a network VM (it uses internal bridges for direct and VPN), personal VM (general browsing), office VM (with LibreOffice and related tools), development VM (with VSCode and all development related tools) and download VM (connected to VPN internal bridge). I also has a basic GNOME extension for VM workflow, but configuration is still by manually editing config files.

What is planned: prepare an ISO image for easy installation, Tor Gateway VM, improvements to the GNOME extension and possibly add more extensions for network monitoring. More improvements will come along as this is still a one-man-work.