Special Mainboard for QubeOS?

General Topics
1

It is possible that Framework Team can create mainboard as certified and specially for QubeOS?

2

Possible? Sure!
Likely? Not in my opinion. :grinning_face_with_smiling_eyes:
Framework doesn’t yet seem to have the spare resources to dedicate to niche alternative mainboards like that.

But if QubeOS desired, they could make a special mainboard.

DeepComputing did it with their RISC-V Mainboard.
frame.work/products/deep-computing-risc-v-mainboard

Just wondering, what would QubeOS even need special for a mainboard?

1 Like
3

100% this. QubesOS is just way too niche, and Framework is too small a team to make products with such a limited market. Official QubesOS certification requires open-source firmware, which has long been requested but is unlikely any time soon due to the amount of resources it would require to switch firmware vendors.

4

Qubes OS currently targets x86_64 only and requires Intel VT-x/VT-d or AMD-V/AMD-Vi. The RISC-V StarFive JH7110 (SiFive U74 cores) used in the RISC-V Framework 13 mainboard does not have the RISC-V Hypervisor “H” extension, so you don’t get hardware virtualization/IOMMU needed for Xen/Qubes. Xen-on-RISC-V is making progress in upstream, but Qubes hasn’t added a RISC-V port and provides installers only for x86_64. The RISC-V mainboard itself is positioned as a developer board, not a consumer-ready Qubes target.

5

They were not suggesting using the RISC-V board for QubesOS, they were suggesting that QubesOS could make their own board, just as DeepComputing did.

2 Likes
6

Look at the requirements list for QubesOS certification, it’s clear that Qubes will run through the tests but that they expect submitted devices to be prepared by the submitters making the hardware.

Selling with QubesOS pre-installed seems achievable if the other challenges can be overcome – the worst seems to be:

  • one untrusted USB plus trusted PS/2 keyboard and trackpad for on-device control or dual USB controllers with one trusted and hard-wired to on-device keyboard and trackpad
  • ec-firmware being fully open-source with “(properly authenticated) CPU-vendor-provided blobs for silicon and memory initialization”

K3n.

7

I mean, they can expect anything they want.

I can expect a solid gold award for… simply existing, ain’t going to get it. :grinning_face_with_smiling_eyes: Likewise, I just don’t think Qubes will get a special tailor-made mainboard, just for them. Someday, when FW gets coreboot, and it no longer requires anything tailor-made, maybe they’ll go for Qubes certification.

Looking over the list of current Qubes-certified devices, were any of them made just for Qubes? Or were they just already existing devices that happened to already meet Qube’s requirements and needed limited effort to get certification.

Brand Model Certification details
NovaCustom V54 Series Certification details
Nitrokey NitroPad V56 Certification details
NovaCustom V56 Series Certification details
Nitrokey NitroPC Pro 2 Certification details
Star Labs StarBook Certification details
Nitrokey NitroPC Pro Certification details
NovaCustom NV41 Series Certification details
3mdeb Dasharo FidelisGuard Z690 Certification details
Nitrokey NitroPad T430 Certification details
Nitrokey NitroPad X230 Certification details
Insurgo PrivacyBeast X230 Certification details
8

British English is my first language, so I apologise for using loose phrasing when I meant to say “Qubes Team have a set of rules by which they will judge any hardware as certified and, to get certified by Qubes Team by following the rules they have set out, you send them hardware you have prepared yourself.”

Clicking on the links, this stands out:

  • The V54 and V56 product names are shared between a couple of vendors and have identical product images (and crucially coreboot firmware) so I infer that’s a whitebox design you might buy by the hundred from an OEM.
  • The X230 and T430 are both refurbished ThinkPads (which also run coreboot).
  • The NitroPC Pro 1 & 2 and the Dasharo FidelisGuard Z690 have PS/2 ports on the back for local keyboard+mouse and configure the USB for use in guest VM’s.

I have no guess on how much ‘limited extra effort’ is needed.

This is going to sound sarcastic because of this forum setting, but I mean it sincerely :smiley: : Please have today’s solid gold award for simply existing. You do you.

1 Like
9

You might want to try Genode /Sculpt which has many similarities in concept such as heavy use of virtualization for security.

I would argue Sculpt is actually more sophisticated because it is a clean sheet design with such things as capability based security and microkernel rather than a Linux distribution that has been kludged to achieve these ends.

Genode have a Framework in house they use for testing Sculpt, so you could say framework is an approved product.