Qubes OS will ship pre-installed on Purism’s security-focused Librem 13 laptop

This is made possible by a combination of Xen, laptops/desktops with CPU/BIOS which support Intel VT-d, and software like Qubes which mediate among the separated workloads. Non-interactve VMs are typically used to perform I/O, e.g. NICs. If you don't need 3D graphics, guest VM graphics can be virtualized into "windows" with colored borders. If you are on a desktop, discrete GPUs can be dedicated to a VM via VT-d, which enables 3D graphics with near-native performance.

With the right (supported) hardware and BIOS, it works. Hence the benefit of this pre-validated bundle. Hopefully more OEMs move to support concurrent Windows & Linux, since manufacturers can use the open-source software to evaluate the compatibiilty of pre-release hardware like the upcoming Skylake Xeon laptops.

Purism (and the vendors that preceded them) deserve credit for prioritizing security and privacy, despite current opaqueness of Intel platform implementations. Intel's customers are OEMs, not end-users. To influence Intel's multi-year roadmaps, more OEMs will need to make similar security/privacy requests to Intel. OEMs can benefit from upstream contributions that integrated with their unique hardware improvements, like kill switches for sensors.

> If you are on a desktop, discrete GPUs can be dedicated to a VM via VT-d, which enables 3D graphics with near-native performance.

Well this is the theory. You'd better be a Unix guru if you want to make it work, they have some questions about it on their Google group and it looks shaky.

It widens the attack surface too.

Xen GPU passthrough works if the GPU vendor supports VT-d passthrough. Many AMD discrete GPUs work in this configuration, from low end to high end versions. Nvidia high end models may work, but low end models are unlikely to work.

Yes, the attack surface is widened to include the GPU, with isolation theoretically provided by the VT-d IOMMU. Some recent Intel CPUs support hardware virtualization of the integrated GPU, which likely further widens the attack surface, but enables multiple VMs to have hardware-accelerated graphics. This supports KVM and Xen, but is not (yet?) supported by Qubes, https://01.org/igvt-g/blogs/wangbo85/2015/intel-gvt-g-xengt-.... If the guest workload is OpenGL, http://www.virtualgl.org/About/Introduction could be an alternative.

It "works", but have you ever deployed that in production? Kernel updates frequently break it, and the setups tends to be extremely flimsy.