Checking laptop compatibility using boot from USB drive

[Vít Šesták]

I'll probably have an opportunity to verify some laptop's compatibility. My idea is to boot Qubes OS or its installer from USB and then to do some checks (most notably VT-d compatibility and USB controller topology). It should be something done in reasonable time and without installing QubesOS on the machine. How should I do that?

a. Boot the installer. It however does not seem to contain qubes-hcl-report (just unpacked it), so it does not seem to be easy to check VT-d this way. (I know the CPU supports it, but I can just guess if MoBo/BIOS do too.)
b. Boot LiveUSB. It is outdated and unsupported and AFAIR with some known bugs that could prevent booting if I am unlucky. So, this might work, but it might easily fail.
c. Install QubesOS on USB stick (and disable usbvm) and boot it. I am not sure if this will work when QubesOS is booted on a different hardware than it was installed with. I see some potential incompatibilities, e.g., wrong PCI device ids assigned to sys-net or too high vCPU count assigned to a VM (target laptop has fewer CPU cores) or addresses in fstab/crypttab. While the mentioned issues seem to be manageable (remove all PCI devices and fix vCPU count if it is too high and check fstab/crypttab), I am not sure if they are exhaustive. Maybe this will work well. (After all, I just need dom0 to boot, not other VMs.)

No option seems to be perfect. What would you suggest to try?

Regards,
Vít Šesták 'v6ak'

[ski...@wgu.edu]

This is something that I'm also interested in investigating. I'm currently drafting up some ideas on making a bootable USB stick (that likely won't be Qubes), but will start up, run some checks to test hardware compatibility for things (primarily the virtualization support). Following that, I'd like it to generate a report that might be able to be formatted for easy digestion into the Qubes HCL report. Whether or not this gets up off the ground for me, that's something else.

But with the Qubes live USB project getting mothballed, I think that going with a flavor of bootable Linux and then building a testing script on top of it is going to be the best way for me.

I'll be shopping for a new portable in the next six months and I'll be shopping for one with Qubes as the primary OS, so I'm hoping to get a script like this working to help me verify that what I'm looking to buy is going to be Qubes friendly.

[Rusty Bird]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Vít Šesták:

> I'll probably have an opportunity to verify some laptop's
> compatibility. My idea is to boot Qubes OS or its installer from USB
> and then to do some checks (most notably VT-d compatibility and USB
> controller topology). It should be something done in reasonable time
> and without installing QubesOS on the machine. How should I do that?
>

> [...]

> c. Install QubesOS on USB stick (and disable usbvm) and boot it. I
> am not sure if this will work when QubesOS is booted on a different
> hardware than it was installed with. I see some potential
> incompatibilities, e.g., wrong PCI device ids assigned to sys-net or
> too high vCPU count assigned to a VM (target laptop has fewer CPU
> cores) or addresses in fstab/crypttab. While the mentioned issues
> seem to be manageable (remove all PCI devices and fix vCPU count if
> it is too high and check fstab/crypttab), I am not sure if they are
> exhaustive. Maybe this will work well. (After all, I just need dom0
> to boot, not other VMs.)

dom0 should work alright if you switch dracut to no-hostonly mode,
which (mainly) adds all available kernel modules to the initrd:

# echo 'hostonly="no"' >/etc/dracut.conf.d/no-hostonly.conf
# dracut --regenerate-all --force

Rusty
-----BEGIN PGP SIGNATURE-----

iQJ8BAEBCgBmBQJZDRwIXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ4NEI1OUJDRkM2MkIxMjlGRTFCMDZEMDQ0
NjlENzhGNDdBQUYyQURGAAoJEEadePR6ryrf0XEP/0rhfOaoIkBxtfH33bPan3iR
j7e8THXJZrPR204XwKE6/IWuBEjXEFZ6p5uKO63/cBXCHBiyd+EGnpGBlkOF4S/h
CpHVsDcar37nAVse2219uB49d5fYS9rAaZBANRVep9gaSJk7ku5xE7HtXD/1Zsm0
YxsgSnJixhb0TuLD8o4mMzvKGQ1hm1Uw5d9Z5spkCEkI18Xg87kSDhy1n0PdX9og
56XWB8iZkGnCNtSbrizHnBMEopwmDRwXXkGqs4ga/9tAVDa4SLA4nEoQ8jBbMkmS
VreSzvJGHv+jnrskE/qQwG8+vlXmexpAx+9gLqGKORxfBxdyXq02EOI0lqulT+Gn
+Zc+DN7fSiOa5F5im90ZrYmo0YW40n2FJy6tSJxGGweSJ2ZfqMhuKv+5CfM2Evzb
IKfliH9xmPFGw5l4o7RLbHJNiBD2/ZWrOniRFRRdpl2YXVipmuz/TwLyBD345O+S
tajtccZdoFbZWghllBv3fK+yLNQF00e203U2SYSG5CEPK6E/uxFOAqskd+8Szir5
pqpms0CF67E1BEJLS0AtONWbT0BVC2RBqm/txQ8Izkh9Iilh4O7a9nirb1AOqyKJ
hoeZ/3IzSyTZ/0OymVNjhEExERQNXcCvkMSwQ4VcCcNsAUf9YlgD4EVkugwzAc8w
NPIpWWm9OC0idS1pYyNz
=rkv/
-----END PGP SIGNATURE-----