What would ideal hardware for Qubes look like?

Certainly, don’t allow the perfect to be the enemy of the good. “Good and existent” beats “perfect and nonexistent” every time. But since this thread is asking about the ideal hardware (even if it doesn’t exist), I’m going all out with the wish list. :slight_smile:


Maybe Qubes will run on ARM in the future. I think there’s no nasty management engines on ARM, but I’m not sure.

I had ARM-based chromebook some years ago. It was pretty good experience, so this is not totally scifi.

Yes, following a guide that is still being worked on by @Plexus.

thanks very much, really helpful for everyone.

sys-njalla is one of my VPN providers and that qube uses the Qubes OS
firewall to make sure sys-njalla can only connect to the respective VPN
servers and nothing else.

not sure, whether my understanding is correct,

all traffic, to various IP destination, are encrypted by sys-vpn,
and will be decrypted in VPN server, somewhere outside our device,
before then being forwarded to various IP destination.

so, if sys-vpn, resides before sys-firewall,

does it mean, sys-vpn doesn’t know, what IP is blocked by sys-firewall ?

also, does it mean, sys-firewall doesn’t know,
whether the encrypted traffic, sent to VPN server, by sys-vpn,
contains the blocked IP or not ?

There is something even better on the horizon: Port Qubes to ppc64 [3 bitcoin bounty] · Issue #4318 · QubesOS/qubes-issues · GitHub.

If I understand this correctly it would then use KVM as a hypervisor backend?

Good point. My honest question wasn’t meant to point out that no other alternative exists–it was simply what I wanted to know at the time. When I first started writing my original post, I wrote a wish list of what the ultimate Qubes PC might look like:

  • No ME/PSP or equivalent
  • As many cores as practical for tasks in mind, with some redundancy
  • Optimized for virtualization
  • Speculative execution never even installed
  • Clock speed as high as practical for tasks in mind, with some redundancy

I scrapped it because it was basically what a child might send to santa, but you pointed out that this is exactly what I myself asked for.


Sometimes ideas that are just thrown out there despite being utterly fantastical might actually lead to something.

Maybe people posting their hardware wish list (or even Qubes features) in this thread should be required to start their posts with “Dear Santa”?

1 Like

Intel laptops without Intel ME are very weak, but there are also Amd laptops without PSP, G505s as an example, it supports coreboot and 16GB of RAM along with a10 processor


Dear Santa
I want a small lightweight device that

  • is powerful
  • is efficient
  • is designed to last
  • is open and verifiable
  • is completely documented
  • is user owned and owner controlled
  • is secure without secret architecture
  • is repairable, modifiable, and extendable
  • has intuitive awe-inspiring human interfaces
  • will do what I need it to do tommorrow even though I don’t know what that is today

But back to reality in 2021…
Not that anyone asked but I think the KGPE-D16 is still a unique AMD pre-PSP option. Imperfect and challenging, certainly, but still interesting. See this and this if you’re curious why.


As I understand it, it still supports coreboot / libreboot and two processors, surprisingly

Yes, you can get one with coreboot and QOS preinstalled (+ QOS donation)

Greetings @rakibiy676

Compatible processors include “Abu Dhabi” Opterons with the most powerful (aka power hungry) being the 6386SE Hexadeca-core. Last I checked, Qubes 4.0 applies the 63xx microcode updates properly during boot. Although I only use one OS6386YETGGHK and four EEC 16GB RDIMMs, it is possibile to install two (thus 32 cores) and at least 192GB DDR3 with a “blobless” coreboot. Heads on coreboot 4.11 with TPM support is possible too! It may not be a good choice for many but for anyone seriously looking at systems without Intel ME or AMD PSP I think the KGPE-D16 shouldn’t be overlooked.

Best regards…

I was interested in this board a few years ago but then support was dropped in Coreboot and I read about trouble getting a distro like debian to boot. I don’t know if anything has changed over the past few years and if this is even compatible with Qubes?

Unfortunately I can’t speak to troubles with debian or the current efforts to revive coreboot support. I’m following the Heads github issue #719 - Re-upstreaming and maintainership of the KGPE-D16
At the time I read your message, the latest comment says there will be a meeting Monday 23rd August 15:00 UTC on https://meet.3mdeb.com/kgpe-d16-refresh

I also added a HCL report for the Asus KGPE-D16 (6386SE) with stock firmware here.

Best regards…

1 Like

Thanks a lot, very interesting information! I will follow the development, maybe I’ll get one of these boards one day.

Also, thanks for the detailed HCL report, it’s good to know what’s working and/or how to get there. :+1:

I’d also recommend reviewing Thomas’ 2/24/2020 qubes-users mailing list post containing notes of his experience getting Qubes R4.0 running on the KGPE-D16 with Coreboot 4.11 and GRUB2 at https://groups.google.com/g/qubes-users/c/nbwWa9b-Eo0
Note: My experience does not completely coincide with the last post in that thread.

Also for anyone considering the KGPE-D16, the May 2020 Qubes Certified Desktop qubes-users thread at https://groups.google.com/g/qubes-users/c/19J1nfca3HY is worth reading imho.

Have a good weekend…

This should definitely branch off into “If you could design the perfect Qubes OS laptop and desktop machines, what would they be like? Be as detailed as you can, because we might actually be able to crowdfund this!”


I also agree with all of @Sven’s points, with a few of my own:


  • The internal keyboard and trackpad must be on its own bus
  • all other internal peripherals should either be on their own dedicated bus, or at the very least grouped by function/purpose
  • integrated graphics AND discrete GPU (possibly multiple GPUs, for passthrough fir gaming, video editing and mining)
  • Multiple M.2 slots for SSDs
  • MANY MANY SODIMM slots for RAM for Qubes
  • Kill-switches for camera
  • Ports ports and more ports, of all varieties (maybe even interchangeable like the Framework Laptop, allowing more flexibility to port passthrough)
  • Maybe some kind of “USB Condom” on all USB ports
  • FOSS-friendly Ethernet (potentially multiple RJ45 ports) and wifi (preferably multiple antennas, for pentesting)
  • Enough battery life for 3-4 hours of use at full load
  • 4k display (potentially touchscreen)
  • Rugged enough to “take a beating”, but elegant enough to not look like you’re on an archaeological excavation endeavour

I don’t care if it’s a brick, I’ll still carry it round :wink:


  • LOTS of PCI slots
  • LOTS of separate USB Buses (preferably max two ports per bus, as you can always use adapters to connect more devices)
  • Maybe some kind of “USB Condom” on all USB ports
  • FOSS-friendly Ethernet and wifi
  • FOSS BIOS (ideally Heads or a fork of Heads)
  • UPS (just in case, even if it’s only a 10-minute battery, just so your machine can shut down properly)
  • SILENT FANS, or no fans at all! (I’ve done my time in a server room)

Am I missing anything?

Disclaimer: This is a wishlist, and I’m fully aware that all of this in a single machine would be difficult, if not impossible….:joy:

1 Like

Merged this post from another thread, but it also sort-of belongs in that thread (too bad I can’t copy instead of splitting or merging). Definitely a post that should start with ‘Dear Santa’.

Perhaps there is wishlist material here & then couldn’t there also be sensible material (two separate lists?)? Plus a call to arms for consumers/populace to insist upon electronics designed to assist them in their aim to be secure in their persons & the devices that they purchase (long term & unlikely to take much root - heh)? Open hardware & companies that support consumer rights…

1 Like

This is more of a ‘for fun’ list (hence “Dear Santa”), since a sensible list wouldn’t make any difference. Users are confined to the x86 product ecosystem (at least until the ppc64 port is released, though few will actually get their hands on a compatible system).

1 Like