Windows qubes do not display in sys-gui

[jmynes]

Qubes OS release

Qubes OS 4.2

Brief summary

Launching Windows qubes (with their guivm set to sys-gui) does not display Windows in sys-gui

Steps to reproduce

1. qvm-prefs your-windows-qube guivm sys-gui (and maybe its template)
2. Launch the Windows qube in sys-gui
3. Observe

Expected behavior

Windows qubes should launch a window as usual

Actual behavior

Windows starts, but does not display anything.

qvm-run --pass-io your-windows-qube "ping 8.8.8.8" for instance works from dom0, however.

Additional information

This bug looked a bit related, but is marked as closed, and was about HVM qubes in particular:
#9385

I tried changing a fedora-41 qube from PVH to HVM in sys-gui, and it works perfectly fine.

[marmarek]

Do you have QWT installed there? If so, which version? Only the new QWT version supports GUI domain

[jmynes]

I have tried:

• Win10 with QWT 4.1.69
• Win10 with QWT 4.1.70 installed
  • (But because it intentionally removes the drivers, does it actually install into windows?)
• Win10 without QWT
• WinXP (obviously without QWT)

I also discussed this a bit in the Matrix server today, if you want to see chatlogs.

[marmarek]

• Win10 with QWT 4.1.69

• Win10 with QWT 4.1.70 installed

  • (But because it intentionally removes the drivers, does it actually install into windows?)

None of those are supposed to work with GUI domain

The new QWT version is currently available on R4.3 only, but theoretically the same binary could be used on R4.2. You can fetch it from https://yum.qubes-os.org/r4.3/current-testing/host/fc41/rpm/qubes-windows-tools-4.2.0-1.fc41.noarch.rpm (verify package signature...)

[jmynes]

From Qubes 4.2 (fully up to date)

1. Downloaded: https://yum.qubes-os.org/r4.3/current-testing/host/fc41/rpm/qubes-windows-tools-4.2.0-1.fc41.noarch.rpm
2. In dom0: qvm-run --pass-io browserqube "cat /home/user/Downloads/qubes-windows-tools-4.2.0-1.fc41.noarch.rpm" > qubes-windows-tools-4.2.0-1.fc41.noarch.rpm
3. In dom0: sudo qubes-dom0-update qubes-windows-tools-4.2.0-1.fc41.noarch.rpm in dom0
4. Per: https://github.com/ElliotKillick/qvm-create-windows-qube, deleted windows-mgmt and ran ./install.sh
5. In dom0: qvm-create-windows-qube -n sys-firewall -oyp firefox,notepadplusplus,office365proplus -i win10x64.iso -a win10x64-pro.xml work-win10
6. Booted work-win10, runs fine in dom0
7. Ran qvm-prefs work-win10 guivm sys-gui
8. Logged out of dom0, logged into sys-gui
9. Tried to run work-win10

---

My Windows qube still unfortunately does not display in sys-gui from 4.2.
I can try installing 4.3 on my laptop, however.

[jmynes]

Okay, I went and installed 4.3 on my laptop, and then set up Win10 + sys-gui, which was a bit of a journey.

Upon initial 4.3 install, I made sure all packages were up to date, and then set up sys-gui.

I then found out that I could not install qvm-create-windows-qube, until I enabled other repositories in global settings. Once I managed to setup a Windows Qube, I changed its guivm to sys-gui, then rebooted my laptop.

Unfortunately, when I logged into sys-gui, it looked like vanilla Fedora, without almost any of the Qubes tools installed into it, and none of the UI configurations. From Salt logs, I found out a number of packages didn't install. I suspect this has to do with the repositories from a few sentences prior in this comment.

Next, I went into the fedora-42-xfce template, and updated all packages within; I was prompted to accept 3 Qubes keys, which then updated many packages. I then shut down the template.

This time, after deleting and setting up sys-gui again, I did manage to get a fully working sys-gui setup, but Windows unfortunately still did not display, the same as in 4.2

[jmynes]

One workaround at the moment is to try this:

• Set up a (for example, Debian) TemplateVM and install xfreerdp3
  • e.g. sudo apt-get install freerdp3-x11
• Create an AppVM for your RDP client, then in Settings > Advanced, enable Provides Network
• Set the above AppVM as the NetVM for your Windows AppVM or StandaloneVM
• In your Windows TemplateVM, set a password, and enable Remote Desktop from Settings
• Shut down all 3 or 4 qubes described above
• Set qvm-prefs qubenamehere guivm sys-gui for all qubes mentioned above

Then, from sys-gui:

• Run xfreerdp3 /v:10.xx.yy.zz /u:USERNAME /p:PASSWORD /dynamic-resolution
  • Replace 10.xx.yy.zz with your Windows AppVM's IP Address
  • If your username is user, you can skip /u:, otherwise, replace USERNAME
  • Replace PASSWORD with the password you set for your qube (or find another way to authenticate)
  • The /dynamic-resolution flag will make the resolution of your Windows qube RDP session match the size of the window its in!

This enabled me to use Windows 10 successfully from QubesOS 4.2 and QubesOS 4.3

---

Alternatively, to connect without setting a password:

1. Open the Group Policy Editor by typing gpedit.msc in the Run dialog (Win + R)
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security and disable "Require user authentication for remote connections by using Network Level Authentication"
3. Go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options and disable "Accounts: Limit local account use of blank passwords to console logon only"

---

If qvm-prefs sys-usb guivm sys-gui is set, then you can also attach USB devices to your Windows machine in sys-gui

---

Similarly, for Windows 7 I was able to use rdesktop 10.xx.yy.zz -u USER -p PASSWORD to RDP in, with dynamic scaling

[marmarek]

Ok, so apparently new QWT almost supports GUI domain... All the mechanisms are there, just are not configured correctly: https://github.com/QubesOS/qubes-gui-agent-windows/blob/master/gui-agent/vchan.c#L62 - hardcoded "0" for GUI domain (dom0), instead of g_GuiDomainId variable.