qvm-device – List/set VM devices


qvm-device DEVICE_CLASS {list,ls,l} [options] <vm-name>
qvm-device DEVICE_CLASS {attach,at,a} [options] <vm-name> <device>
qvm-device DEVICE_CLASS {detach,dt,d} [options] <vm-name> [<device>]
qvm-*DEVICE_CLASS* {list,ls,l,attach,at,a,detach,dt,d} [options] <vmname> …


qvm-block, qvm-usb and qvm-pci are just aliases for qvm-device block, qvm-device usb and qvm-device pci respectively.


--help, -h

Show this help message and exit

--verbose, -v

increase verbosity

--quiet, -q

decrease verbosity


list device classes



qvm-device DEVICE_CLASS list [-h] [–verbose] [–quiet] [VMNAME [VMNAME …]]

List devices.


List devices from all qubes. You can use --exclude to limit the qubes set.


Exclude the qube from --all.

aliases: ls, l


qvm-device DEVICE_CLASS attach [-h] [–verbose] [–quiet] [–ro] VMNAME BACKEND_DOMAIN:DEVICE_ID

Attach the device with DEVICE_ID from BACKEND_DOMAIN to the domain VMNAME

--option, -o

Specify device-class specific option, use name=value format. You can specify this option multiple times. See below for options specific to different device classes.


Alias for the read-only=yes option. If you specify both –ro and –option read-only=no, –ro takes precedence.

--persistent, -p

Attach device persistently, which means have it attached also after qube restart.

aliases: a, at


qvm-device DEVICE_CLASS detach [-h] [–verbose] [–quiet] VMNAME BACKEND_DOMAIN:DEVICE_ID

Detach the device with BACKEND_DOMAIN:DEVICE_ID from domain VMNAME. If no device is given, detach all DEVICE_CLASS devices.

aliases: d, dt

Device classes


Block device. Available options:

  • frontend-dev - device node in target domain, by default first available, starting from xvdi

  • read-only - attach device in read-only mode; default depends on device, if possible - attach read-write; if device itself is read-only, only read-only attach is allowed

  • devtype - type of device - either disk or cdrom; default: disk


USB device. This type of device does not support options.


PCI device. Only dom0 expose such devices. One should be very careful when attaching this type of devices, because some of them are strictly required to stay in dom0 (for example host bridge). Available options:

  • no-strict-reset - allow to attach device even if it does not support any reliable reset operation; switching such device to another domain (without full host restart) can be a security risk; default: False, accepted values: True, False (option absent)

  • permissive - allow write access to most of PCI config space, instead of only selected whitelisted rregisters; a workaround for some PCI passthrough problems, potentially unsafe; default: False, accepted values: True, False (option absent)


Microphone, or other audio input. Normally there is only one device of this type - dom0:mic. Use PulseAudio settings in dom0 to select which input source is used. This type of device does not support options.


Joanna Rutkowska <joanna at invisiblethingslab dot com>
Rafal Wojtczuk <rafal at invisiblethingslab dot com>
Marek Marczykowski <marmarek at invisiblethingslab dot com>
Frédéric Pierret <frederic.pierret at qubes dash os dot org>