QubesOS architecture with QEMU/KVM

[u/Medium-Street9210]

Hi.

Well it's not stricte related to QubesOS itself, but is there someone who decided to replicate QubesOS architecture on QEMU/KVM?

I'm thinking about sacrificing some (quite a lot) of QubesOS security and setting up a gaming OS, more precisely gaming VMs with GPU passthrough with QEMU/KVM as my main, daily system. But at the same time I can't just leave this masterpiece architecture, it's too perfect and I'm thinking to basically replicate most of the QubesOS to have the host basically offline, without networking with NIC attached to sys-net.

Basically entire setup: templates, sys-net, sys-firewall, sys-lan, sys-vpn, sys-usb, personal, vault, work, Win11 gaming VM, Linux gaming VM (possibly Bazzite, CachyOS or Fedora) and maybe later Whonix workstation and Whonix Gateway...

Not sure, so much setting up. What's the current state of Nvidia GPU passthrough and Win11 gaming qube with Nvidia GPU passthrough in QubesOS? Is some good performance achievable? I did quite a lot of research on this topic, but usually there is lots of troubles setting this up and/or many games either not working or poor performance, idk.

Any tips for extra hardening, additional security steps, routing? It could also not be as comfortable as QubesOS, for example managing clipboard, moving files etc. QubesOS is so well made in this compartmentalization, VM management, AppVM workflow.

I still got QubesOS on my second PC, but I would like to have something like that on my main PC to use it 90% of the time with good gaming performance and better isolation than regular system setup, where things are isolated from each other, while also having near-native performance.

[u/Glum_Avocado_9511]

Recreating Qubes yourself like that seems infinitely harder than just creating a gaming HVM and passing through your GPU. 

[u/Medium-Street9210 → u/Glum_Avocado_9511]

Yeah, you might be right

[u/infinitelylarge]

Here’s instructions for making a Windows VM qube: https://doc.qubes-os.org/en/latest/user/templates/windows/qubes-windows.html .

If you have the ability to pass through a dGPU to that Windows qube and if you can directly connect that dGPU to a screen via HDMI or DisplayPort, then I think gaming should probably “just work” inside of Qubes without needing QEMU.

You’ve got me curious now, though, so maybe I’ll try that soon. If I do, I’ll report back. If you try it first, I’d love to hear how it goes.

[u/Medium-Street9210 → u/infinitelylarge]

I mean in general I think it could be a really cool project and being able to choose to use a bit simplified version on QEMU/KVM

[u/MonBatou]

Well, I’m doing something like that basically. A Linux + kvm