Installing Qubes OS on NUC10I7FNH3

RobinMurison · ‎02-21-2021

Hi,

I tried installing Qubes on the above machine.

The Qubes installation failed even to boot let alone install.

What EUFI BIOS settings do I need to turn on or off to get the installation media to install.
While not connected to the internet.

I would like specifically disable the Wi-Fi network adapter. As I do not want any possibility of it connecting to the internet or a hot point accidentally before the OS is fully installed.

The error I received was:

> ACPI: Invalid sleep control/status register data: 0:0x8: 0x3 0:0x8:0x3
> ACPI: 32/64X FACS address mismatch in FADT 6f1b0000/0000000000000000, using 32
> IOAPIC[0]: apic_id 2, version 32, address 0xfec00000, GSI 0-119
> Enabling APIC mode: Phys. Using 1 I/O APICs
> Switched to APIC driver x2apic_cluster.
> xstate: size: 0x440 and states: 0x1f
> Unrecognised CPU model 0xa6 - assuming not reprpoline safe
> Unrecognised CPU model 0xa6 - assuming vulnerable to lazyFPU
> Speculative mitigation facilities:
> Hardware features: IBRS/IBPB STIBP L1D)FLUSH SSBD MD_CLEAR IBRS_ALL RDCL_NO SKIP_L1DFL...

> Compiled-in support: INDIRECT_THUNK
> Xen settings: BTI-Thunk JMP, SPEC_CTRL: IBRS+ SSBD-, Other: IBPB
> Support for VMs: PV: MSR_SPEC_CTRL RSB EAGER_FPU MD_CLEAR, HVM: MSR_SPEC_CTRL RSB EAGE...
LEAR
> XPTI (64-bit PV only): Dom0 disabled, domU disabled
> PV L1TF shadowing: Dom0 disabled, DomU disabled
> Using scheduler: SMP Credit Scheduler (credit)
> Platform timer is 23.999MHz HPET
> Detected 1608.088 MHz processor.
> Unknown cachability for MFNS 0xa0-0xff, assuming UC
> Unknown cachability for MFNS 0x78800-0x7cfff, assuming UC
> Initing memory sharing.> CPU0: No irq handler for vector 6c (IRQ -2147483648, LAPIC)
> Intel VT-d iommu 0 supported page sizes: 4kb, 3MB, 1GB.
> Intel VT-d iommu 1 supported page sizes: 4kb, 3MB, 1GB.
> Intel VT-d snoop Control not enabled.
> Intel VT-d Dom0 DAM passthrough not enabled.
> Intel VT-d Queued Invalidation enabled.
> Intel VT-d interupt mapping enabled.
> Intel VT-d Posted interupt not enabled.
> Intel VT-d Shared EPT tables enabled.
> I/O Virtualisation enabled
> - Dom0 mode: relaxed
> Interupt remapping enabled
> ENABLING IO-APIC IRQs
> -> Using old ACK method
> ..MP-BIOS bug: 8254 timer not connected to IO-APIC
> CPU0: No irq handler for vector e7 (IRQ -8)
> IRQ7 a=0001[0001,0000] v=60[ffffffff] t=IO-APIC-edge s=00000002
> failed :(.
>
> ****************************************
> Panic on CPU 0:
> IO-APIC + timer doesn't work! Boot with apic_verbosity=debug and send a report.
with the 'noapic' option
> ****************************************
>
> Reboot in five seconds...

AndrewG_Intel · ‎02-23-2021

Hello @RobinMurison

Thank you for posting on the Intel® communities.

It is worth mentioning that for the Intel® NUC 10 Performance kit - NUC10i7FNH only Windows® 10, 64-bit* is supported. Other operating systems like Qubes* OS haven't been validated by Intel. For more details, please refer to the following links:

Just to make sure, is the issue about installing Qubes* OS due to having the wireless LAN controller enabled during the install process? or is disabling the wireless LAN just one step (as part of others) that you are trying to achieve?

If it is the first one, you can enable or disable the onboard Wireless LAN Controller using the Checkbox on the BIOS following these steps:

Press F2 during boot to enter BIOS Setup.
Go to Advanced > Onboard Devices > WLAN.
Press F10 to save and exit BIOS Setup.

If the issue is not related to the wireless controller and if further assistance is needed regarding the installation of Qubes* OS, our recommendation is to check this further with the OS vendor for proper assistance and to confirm platform support/requirements. Here is the link to Qubes* OS support.

Best regards,

Andrew G.

Intel Customer Support Technician

*Links to third-party sites and references to third-party trademarks are provided for convenience and illustrative purposes only. Unless explicitly stated, Intel® is not responsible for the contents of such links, and no third-party endorsement of Intel® or any of its products is implied.

Hans_Bausewein · ‎02-24-2021

I could not find which Qubes version you tried. On new hardware I'd try the latest.

I've just installed Qubes Release 4.0.4-rc2 (latest testing) on my NUC8i7HVK2 and it seems to be fine:

could boot into dom0
iwlwifi logged some errors in dmesg.
amdgpu not found
graphics worked with a Radeon driver

Yours has Intel graphics so my experience may not be that useful.

Hans

RobinMurison · ‎02-28-2021

Yes it was 4.0.4 I was trying to install, But unfortunately I got the error as displayed and I have not got the foggiest clue what EUFI BIOS setting I need to change to get it to boot at all let alone install.

Did you have to change any settings? I just turned Secure Boot Off and turned off boot from LAN.

Not that I have a network connection at all.

I do not understand what the boot errors mean and so do not know what is wrong.

Hans_Bausewein · ‎02-28-2021

My guess is, that Qubes 4.0.4-rc2 is missing the latest Intel firmware.

Found this Intel November 2020 Microcode Update from RedHat, which lists model 0xa6 (Comet Lake U , 10th Generation Intel® Core™ Processor Family).

As reportedly logged by Xen in your first message:

Unrecognised CPU model 0xa6

I've compared your log with mine (which works).

Here's the same part of my /var/log/xen/console/hypervisor.log :

(XEN) Switched to APIC driver x2apic_cluster.
(XEN) xstate: size: 0x440 and states: 0x1f
(XEN) Intel machine check reporting enabled
(XEN) Speculative mitigation facilities:
(XEN) Hardware features: IBRS/IBPB STIBP L1D_FLUSH SSBD MD_CLEAR
(XEN) Compiled-in support: INDIRECT_THUNK
(XEN) Xen settings: BTI-Thunk JMP, SPEC_CTRL: IBRS+ SSBD-, Other: IBPB L1D_FLUSH VERW
(XEN) L1TF: believed vulnerable, maxphysaddr L1D 46, CPUID 39, Safe address 8000000000
(XEN) Support for VMs: PV: MSR_SPEC_CTRL RSB EAGER_FPU MD_CLEAR, HVM: MSR_SPEC_CTRL RSB EAGER_FPU MD_CLEAR
(XEN) XPTI (64-bit PV only): Dom0 enabled, DomU enabled
(XEN) PV L1TF shadowing: Dom0 disabled, DomU enabled
(XEN) Using scheduler: SMP Credit Scheduler (credit)

I think I'd try the latest Xen to see whether it has the same issue.

But the unrecognized CPU model may not be the problem here, because the function results ( in xen/arch/x86/spec_ctrl.c ) are exactly the same as for my CPU model 0x9e ( Kabylake D ). It logs, because it does not find it, but otherwise no difference.

Here's the part of my log where your boot process fails:

(XEN) I/O virtualisation enabled
(XEN) - Dom0 mode: Relaxed
(XEN) Interrupt remapping enabled
(XEN) nr_sockets: 1
(XEN) Enabled directed EOI with ioapic_ack_old on!
(XEN) ENABLING IO-APIC IRQs
(XEN) -> Using old ACK method
(XEN) ..TIMER: vector=0xF0 apic1=0 pin1=2 apic2=-1 pin2=-1
(XEN) TSC deadline timer enabled

Maybe it helps.

Hans

Hans_Bausewein · ‎02-28-2021

Robin,

This "Intel i7-1065G7 (10 Generation Support) - APIC Patches" looks very similar to your timer errors.

but that was one year ago.

Hans

AndrewG_Intel · ‎03-04-2021

Hello RobinMurison

We have not heard back from you so we will proceed to close this thread now from our end; however, we will leave the thread open in case other users want to participate. If you need any additional information, please submit a new question as this thread will no longer be monitored.

Best regards,

Andrew G.

Intel Customer Support Technician

Hans_Bausewein · ‎04-05-2021

@RobinMurison

Found the problem: Xen causes kernel panic during install - USB boot #5374

See my last comment on that GitHub thread.

From the patch (Fri, 5 Mar 2021 14:27:22):

/*
* Intel chipsets from Skylake/ApolloLake onwards can statically clock
* gate the 8259 PIT. This option is enabled by default in slightly later
* systems, as turning the PIT off is a prerequisite to entering the C11
* power saving state.
*
* Xen currently depends on the legacy timer interrupt being active while
* IRQ routing is configured.
*
* Reconfigure the HPET into legacy mode to re-establish the timer
* interrupt.
*/

I had the same issue on my new NUC10i3FNK, so I looked for the change in the upstream xen project. Version 4.14.1 worked, while 4.14.0 still failed.

I have applied the patch to the 4.8.5 xen hypervisor (latest in the 4.8 branch) and verified it works in Qubes OS.

Regards,

Hans