update 8.PVE开启硬件直通功能.md.

Signed-off-by: 秋刀狐狸 <alien_maker@qq.com>

1.PVE系统安装.md

@@ -78,7 +78,7 @@ PVE 下载地址：https://www.proxmox.com/en/downloads
 
 ## 1.PVE系统安装
 
-由于机型不同，BIOS 的设置也不同，所以本教程不演示具体如何将机器设置成从 U 盘启动。  
+由于机型不同，BIOS 的设置也不同，所以本文不演示具体如何将机器设置成从 U 盘启动。  
 
 在设置BIOS时需要注意以下几点：
 - 暂时关闭 **“安全启动”**

3.PVE系统调整.md

@@ -18,7 +18,7 @@ apt install iperf iperf3 iftop net-tools ethtool
 apt install cpufrequtils
 ```
 
-本篇教程后续命令，均在 SSH 终端下完成。
+本文后续命令，均在 SSH 终端下完成。
 
 
 ## 1.Fail2ban 配置
@@ -114,8 +114,11 @@ Wed, 20 Jul 2022 16:21:28 +0800
 ```bash
 ## 检查 CPU 当前调度器
 cpufreq-info
+```
+ **设备 CPU - J4125 参考输出** ：
 
-## 参考输出
+```bash
+##  J4125 参考输出
 cpufrequtils 008: cpufreq-info (C) Dominik Brodowski 2004-2009
 Report errors and bugs to cpufreq@vger.kernel.org, please.
 analyzing CPU 0:
@@ -123,17 +126,36 @@ analyzing CPU 0:
   CPUs which run at the same hardware frequency: 0
   CPUs which need to have their frequency coordinated by software: 0
   maximum transition latency: 20.0 us.
-  hardware limits: 800 MHz - 2.90 GHz                                                               
+  hardware limits: 800 MHz - 2.70 GHz
   available cpufreq governors: conservative, ondemand, userspace, powersave, performance, schedutil
-  current policy: frequency should be within 800 MHz and 2.90 GHz.                                  
+  current policy: frequency should be within 800 MHz and 2.70 GHz.
                   The governor "ondemand" may decide which speed to use
                   within this range.
-  current CPU frequency is 952 MHz.    
+  current CPU frequency is 1.84 GHz.   
+```
+
+ **设备 CPU - N5105 参考输出** ：
+
+```bash
+##  N5105 参考输出
+cpufrequtils 008: cpufreq-info (C) Dominik Brodowski 2004-2009
+Report errors and bugs to cpufreq@vger.kernel.org, please.
+analyzing CPU 0:
+  driver: intel_pstate
+  CPUs which run at the same hardware frequency: 0
+  CPUs which need to have their frequency coordinated by software: 0
+  maximum transition latency: 4294.55 ms.
+  hardware limits: 800 MHz - 2.90 GHz
+  available cpufreq governors: performance, powersave
+  current policy: frequency should be within 800 MHz and 2.90 GHz.
+                  The governor "performance" may decide which speed to use
+                  within this range.
+  current CPU frequency is 1.36 GHz.
 ```
 
 这里面主要关注两个点：
-- driver: intel_cpufreq
+- driver: `intel_cpufreq` 或 `intel_pstate`
-- current policy: governor "ondemand"
+- current policy: `governor "ondemand"` 或 `governor "performance"`
 
 当然还有另外一个命令可以用来显示 CPU 调度器：
 
@@ -141,11 +163,14 @@ analyzing CPU 0:
 ## 检查 CPU 当前调度器
 cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
 
-## 参考输出
+## J4125 参考输出
 ondemand
+
+## N5105 参考输出
+performance
 ```
 
-驱动一般不建议手动调整，而 `governor "ondemand"` 则显示了当前 CPU 的调度器是什么。  
+驱动一般不建议手动调整，而 `governor` 后面的参数则显示了当前 CPU 的调度器是什么。  
 
 接下来，我们需要了解当前系统 CPU 支持的调度器有哪些：
 
@@ -153,13 +178,20 @@ ondemand
 ## 检查 CPU 调度器支持情况
 cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors
 
-## 参考输出
+## J4125 参考输出
 conservative ondemand userspace powersave performance schedutil  
+
+## N5105 参考输出
+performance powersave
 ```
 
-这里有很多种调度器可供选择，至于每种调度器有什么优劣，欢迎大家深度挖掘。  
+根据 CPU 所使用的驱动不同，可选调度器也不同，至于每种调度器有什么优劣，欢迎大家深度挖掘。  
 
-本教程以使用 `schedutil` 调度器为演示。  
+CPU 驱动为 `intel_pstate` 时，建议使用 `powersave` 调度器。  
+
+CPU 驱动为 `intel_cpufreq` 时，建议使用 `schedutil` 调度器。  
+
+本文以使用 `powersave` 调度器为演示。  
 
 使用 `vim` 编辑器来编辑 `cpufrequtils` 的配置文件：
 
@@ -170,14 +202,14 @@ vim /etc/init.d/cpufrequtils
 ## 在配置文件中修改调度器
 
 ENABLE="true"
-GOVERNOR="schedutil"    ## 修改本行的调度器为 schedutil
+GOVERNOR="powersave"    ## 修改本行的调度器为 powersave
 MAX_SPEED="0"
 MIN_SPEED="0"
 ```
 
 按 `i` 键进入编辑模式，`esc` 键退出编辑模式，`:wq` 命令保存退出。  
 
-因为该配置文件很长，教程中留下一份已配置好的文件 [Fox_PVE_Cpufrequtils.conf](./src/Fox_PVE_Cpufrequtils.conf) ，以便对比。  
+因为该配置文件很长，文章中留下一份已配置好的文件 [Fox_PVE_Cpufrequtils.conf](./src/Fox_PVE_Cpufrequtils.conf) ，以便对比。  
 
 修改完成后，需要重新启动 PVE 服务器来使参数生效。  
 
@@ -307,7 +339,7 @@ Unattended-Upgrade::Automatic-Reboot-Time "05:00";
 - 自动重启：开启。
 - 自动重启时间：05:00。
 
-因为该配置文件很长，教程中留下一份 PVE 7.2 中已配置好的文件 [Fox_PVE_50unattended_Upgrades.conf](./src/Fox_PVE_50unattended_Upgrades.conf)，以便对比。  
+因为该配置文件很长，文章中留下一份 PVE 7.2 中已配置好的文件 [Fox_PVE_50unattended_Upgrades.conf](./src/Fox_PVE_50unattended_Upgrades.conf) ，以便对比。  
 
 仔细再仔细确认无误后，`esc` 键退出编辑模式，`:wq` 命令保存退出。  
 

5.PVE制作虚拟机模板.md

@@ -94,7 +94,10 @@ sudo apt dist-upgrade
 
 ```bash
 ## 安装系统软件
-sudo apt install qemu-guest-agent zsh git curl htop lm-sensors fail2ban vim tmux unattended-upgrades apt-listchanges powermgmt-base
+sudo apt install qemu-guest-agent zsh git curl htop lm-sensors fail2ban vim tmux
+
+## 安装系统自动更新工具
+sudo apt install unattended-upgrades apt-listchanges powermgmt-base python3-gi
 
 ## 安装网络工具
 sudo apt install iperf iperf3 iftop lsof dnsutils
@@ -178,6 +181,8 @@ net.ipv4.tcp_sack = 1
 net.ipv4.tcp_dsack = 1
 
 net.ipv4.icmp_ratelimit = 50
+
+kernel.panic = 20
 ```
 
 保存该配置文件后，重启系统或者执行以下命令让配置生效：
@@ -290,7 +295,7 @@ APT::Periodic::AutocleanInterval "1";
 APT::Periodic::CleanInterval "1";
 ```
 
-其中，用来控制系统更新周期的为 `APT::Periodic::Unattended-Upgrade` 这行内容，其中的“5”表示更新周期为“5”天。  
+其中，用来控制系统更新周期的为 `APT::Periodic::Unattended-Upgrade` 这行内容，其中参数 `"5"` 表示更新周期为 `5` 天。  
 
 再调整 apt 的 `50unattended-upgrades` 配置文件，所有修改项目汇聚如下：
 
@@ -318,6 +323,8 @@ Unattended-Upgrade::Automatic-Reboot "true";
 Unattended-Upgrade::Automatic-Reboot-Time "04:30";
 ```
 
+因为该配置文件很长，文章中留下一份 Debian 中已配置好的文件 [Fox_Debian_50unattended_Upgrades.conf](./src/Fox_Debian_50unattended_Upgrades.conf) ，以便对比。  
+
 两个配置文件均修改完成后，需要重设系统自动更新触发器，执行以下命令：
 
 ```bash

8.PVE开启硬件直通功能.md

@@ -0,0 +1,127 @@
+## 1.修改系统Grub参数
+
+参考官方文档 [qm_pci_passthrough](https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_pci_passthrough) 开启 PVE 硬件直通功能。
+
+使用 SSH 工具登录到 PVE 服务器，编辑系统 Grub 的配置文件 `/etc/default/grub` ：
+
+```bash
+## 编辑 Grub 配置文件
+nano /etc/default/grub
+```
+
+在 `nano` 编辑器对话框中修改 `GRUB_CMDLINE_LINUX_DEFAULT` 参数，注意命令中间的空格：  
+
+```bash
+## Intel 处理器添加参数
+GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on"
+```
+
+根据官方文档的说明，AMD 处理器下硬件直通功能将会自动打开，否则需要手动修改 Grub 配置文件：  
+
+```bash
+## AMD 处理器添加参数
+GRUB_CMDLINE_LINUX_DEFAULT="quiet amd_iommu=on"
+```
+
+修改并保存后，需要更新系统 Grub ：
+
+```bash
+## 更新系统 Grub
+update-grub
+```
+
+## 2.加载系统内核模块
+
+修改系统 `/etc/modules` 配置文件，增加必要的系统模块：
+
+```bash
+## 编辑系统配置文件
+nano /etc/modules
+```
+
+在配置文件末尾输入以下内容：
+
+```txt
+vfio
+vfio_iommu_type1
+vfio_pci
+vfio_virqfd
+```
+
+将配置文件保存，并重启 PVE 服务器。  
+
+PVE 服务器重启完成后，再次使用 SSH 工具登录，并使用以下命令检查硬件直通状态：
+
+```bash
+## 检查系统硬件直通状态
+dmesg | grep -e DMAR -e IOMMU -e AMD-Vi
+```
+
+检查 `IOMMU` 、 `Directed I/O` 或 `Interrupt Remapping` 的启用状态。  
+
+N5105 处理器示例输出如下：
+
+```txt
+[    0.016437] ACPI: DMAR 0x00000000787BF000 000088 (v02 INTEL  EDK2     00000002      01000013)
+[    0.016472] ACPI: Reserving DMAR table memory at [mem 0x787bf000-0x787bf087]
+[    0.052437] DMAR: IOMMU enabled
+[    0.144431] DMAR: Host address width 39
+[    0.144432] DMAR: DRHD base: 0x000000fed90000 flags: 0x0
+[    0.144439] DMAR: dmar0: reg_base_addr fed90000 ver 4:0 cap 1c0000c40660462 ecap 49e2ff0505e
+[    0.144441] DMAR: DRHD base: 0x000000fed91000 flags: 0x1
+[    0.144446] DMAR: dmar1: reg_base_addr fed91000 ver 1:0 cap d2008c40660462 ecap f050da
+[    0.144449] DMAR: RMRR base: 0x0000007b800000 end: 0x0000007fbfffff
+[    0.144452] DMAR-IR: IOAPIC id 2 under DRHD base  0xfed91000 IOMMU 1
+[    0.144453] DMAR-IR: HPET id 0 under DRHD base 0xfed91000
+[    0.144454] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping.
+[    0.146335] DMAR-IR: Enabled IRQ remapping in x2apic mode
+[    0.333509] pci 0000:00:02.0: DMAR: Skip IOMMU disabling for graphics
+[    0.410824] DMAR: No ATSR found
+[    0.410824] DMAR: No SATC found
+[    0.410826] DMAR: IOMMU feature fl1gp_support inconsistent
+[    0.410827] DMAR: IOMMU feature pgsel_inv inconsistent
+[    0.410829] DMAR: IOMMU feature nwfs inconsistent
+[    0.410829] DMAR: IOMMU feature pds inconsistent
+[    0.410830] DMAR: IOMMU feature eafs inconsistent
+[    0.410831] DMAR: IOMMU feature prs inconsistent
+[    0.410831] DMAR: IOMMU feature nest inconsistent
+[    0.410832] DMAR: IOMMU feature mts inconsistent
+[    0.410832] DMAR: IOMMU feature sc_support inconsistent
+[    0.410833] DMAR: IOMMU feature dev_iotlb_support inconsistent
+[    0.410835] DMAR: dmar0: Using Queued invalidation
+[    0.410838] DMAR: dmar1: Using Queued invalidation
+[    0.412755] DMAR: Intel(R) Virtualization Technology for Directed I/O
+```
+
+检查系统 `IOMMU` 分组：
+
+```bash
+## 检查 IOMMU group
+find /sys/kernel/iommu_groups/ -type l
+```
+
+示例输出如下：
+
+```txt
+/sys/kernel/iommu_groups/7/devices/0000:00:1c.4
+/sys/kernel/iommu_groups/15/devices/0000:04:00.0
+/sys/kernel/iommu_groups/5/devices/0000:00:17.0
+/sys/kernel/iommu_groups/13/devices/0000:02:00.0
+/sys/kernel/iommu_groups/3/devices/0000:00:14.2
+/sys/kernel/iommu_groups/3/devices/0000:00:14.0
+/sys/kernel/iommu_groups/11/devices/0000:00:1f.0
+/sys/kernel/iommu_groups/11/devices/0000:00:1f.5
+/sys/kernel/iommu_groups/11/devices/0000:00:1f.3
+/sys/kernel/iommu_groups/11/devices/0000:00:1f.4
+/sys/kernel/iommu_groups/1/devices/0000:00:02.0
+/sys/kernel/iommu_groups/8/devices/0000:00:1c.5
+/sys/kernel/iommu_groups/16/devices/0000:05:00.0
+/sys/kernel/iommu_groups/6/devices/0000:00:1c.0
+/sys/kernel/iommu_groups/14/devices/0000:03:00.0
+/sys/kernel/iommu_groups/4/devices/0000:00:16.0
+/sys/kernel/iommu_groups/12/devices/0000:01:00.0
+/sys/kernel/iommu_groups/2/devices/0000:00:04.0
+/sys/kernel/iommu_groups/10/devices/0000:00:1c.7
+/sys/kernel/iommu_groups/0/devices/0000:00:00.0
+/sys/kernel/iommu_groups/9/devices/0000:00:1c.6
+```

README.md

@@ -4,17 +4,19 @@
 PVE 虚拟化平台的安装以及折腾手记。  
 
 - PVE ISO 版本：7.2-1 (Last update: 04 May 2022)
+
 - 演示机：
     - CPU：N5105
     - 内存：16G
     - 硬盘：SSD 512G
-- 网络：
+
+- 内部网络：
     - IP地址：172.16.1.250
     - 子网掩码：255.255.255.0
     - 网关：172.16.1.1
     - DNS：172.16.1.1
 
-### 教程章节
+### 系列章节
 
 0.  [硬件BIOS配置](./0.硬件BIOS配置.md)
 1.  [PVE系统安装](./1.PVE系统安装.md)
@@ -24,9 +26,10 @@ PVE虚拟化平台的安装以及折腾手记。
 5.  [PVE制作虚拟机模板](./5.PVE制作虚拟机模板.md)
 6.  [PVE用模板克隆虚拟机](./6.PVE用模板克隆虚拟机.md)
 7.  [PVE自动备份虚拟机](./7.PVE自动备份虚拟机.md)
+8.  [PVE开启硬件直通功能](./8.PVE开启硬件直通功能.md)
 
-### 教程说明
+### 文章说明
 
-1.  本教程涉及的部分参数需要人为调整来符合切实使用需求。
+1.  本系列文章涉及的部分参数需要手动调整来符合切实使用需求。
 2.  随着 PVE 系统的迭代更新，截图中的内容和实际页面显示可能存在差异。
-3.  如需引用，请注明本教程出处。
+3.  如需引用，请注明本文出处。

src/Fox_Debian_50unattended_Upgrades.conf

@@ -0,0 +1,164 @@
+// Unattended-Upgrade::Origins-Pattern controls which packages are
+// upgraded.
+//
+// Lines below have the format "keyword=value,...".  A
+// package will be upgraded only if the values in its metadata match
+// all the supplied keywords in a line.  (In other words, omitted
+// keywords are wild cards.) The keywords originate from the Release
+// file, but several aliases are accepted.  The accepted keywords are:
+//   a,archive,suite (eg, "stable")
+//   c,component     (eg, "main", "contrib", "non-free")
+//   l,label         (eg, "Debian", "Debian-Security")
+//   o,origin        (eg, "Debian", "Unofficial Multimedia Packages")
+//   n,codename      (eg, "jessie", "jessie-updates")
+//     site          (eg, "http.debian.net")
+// The available values on the system are printed by the command
+// "apt-cache policy", and can be debugged by running
+// "unattended-upgrades -d" and looking at the log file.
+//
+// Within lines unattended-upgrades allows 2 macros whose values are
+// derived from /etc/debian_version:
+//   ${distro_id}            Installed origin.
+//   ${distro_codename}      Installed codename (eg, "buster")
+Unattended-Upgrade::Origins-Pattern {
+        // Codename based matching:
+        // This will follow the migration of a release through different
+        // archives (e.g. from testing to stable and later oldstable).
+        // Software will be the latest available for the named release,
+        // but the Debian release itself will not be automatically upgraded.
+        "origin=Debian,codename=${distro_codename}-updates";
+//      "origin=Debian,codename=${distro_codename}-proposed-updates";
+        "origin=Debian,codename=${distro_codename},label=Debian";
+        "origin=Debian,codename=${distro_codename},label=Debian-Security";
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+
+        // Archive or Suite based matching:
+        // Note that this will silently match a different release after
+        // migration to the specified archive (e.g. testing becomes the
+        // new stable).
+//      "o=Debian,a=stable";
+//      "o=Debian,a=stable-updates";
+//      "o=Debian,a=proposed-updates";
+//      "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports";
+};
+
+// Python regular expressions, matching packages to exclude from upgrading
+Unattended-Upgrade::Package-Blacklist {
+    // The following matches all packages starting with linux-
+//  "linux-";
+
+    // Use $ to explicitely define the end of a package name. Without
+    // the $, "libc6" would match all of them.
+//  "libc6$";
+//  "libc6-dev$";
+//  "libc6-i686$";
+
+    // Special characters need escaping
+//  "libstdc\+\+6$";
+
+    // The following matches packages like xen-system-amd64, xen-utils-4.1,
+    // xenstore-utils and libxenstore3.0
+//  "(lib)?xen(store)?";
+
+    // For more information about Python regular expressions, see
+    // https://docs.python.org/3/howto/regex.html
+};
+
+// This option allows you to control if on a unclean dpkg exit
+// unattended-upgrades will automatically run
+//   dpkg --force-confold --configure -a
+// The default is true, to ensure updates keep getting installed
+Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+
+// Split the upgrade into the smallest possible chunks so that
+// they can be interrupted with SIGTERM. This makes the upgrade
+// a bit slower but it has the benefit that shutdown while a upgrade
+// is running is possible (with a small delay)
+//Unattended-Upgrade::MinimalSteps "true";
+
+// Install all updates when the machine is shutting down
+// instead of doing it in the background while the machine is running.
+// This will (obviously) make shutdown slower.
+// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s.
+// This allows more time for unattended-upgrades to shut down gracefully
+// or even install a few packages in InstallOnShutdown mode, but is still a
+// big step back from the 30 minutes allowed for InstallOnShutdown previously.
+// Users enabling InstallOnShutdown mode are advised to increase
+// InhibitDelayMaxSec even further, possibly to 30 minutes.
+//Unattended-Upgrade::InstallOnShutdown "false";
+
+// Send email to this address for problems or packages upgrades
+// If empty or unset then no email is sent, make sure that you
+// have a working mail setup on your system. A package that provides
+// 'mailx' must be installed. E.g. "user@example.com"
+//Unattended-Upgrade::Mail "";
+
+// Set this value to one of:
+//    "always", "only-on-error" or "on-change"
+// If this is not set, then any legacy MailOnlyOnError (boolean) value
+// is used to chose between "only-on-error" and "on-change"
+//Unattended-Upgrade::MailReport "on-change";
+
+// Remove unused automatically installed kernel-related packages
+// (kernel images, kernel headers and kernel version locked tools).
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+
+// Do automatic removal of newly unused dependencies after the upgrade
+Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+
+// Do automatic removal of unused packages after the upgrade
+// (equivalent to apt-get autoremove)
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+
+// Automatically reboot *WITHOUT CONFIRMATION* if
+//  the file /var/run/reboot-required is found after the upgrade
+Unattended-Upgrade::Automatic-Reboot "true";
+
+// Automatically reboot even if there are users currently logged in
+// when Unattended-Upgrade::Automatic-Reboot is set to true
+//Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
+
+// If automatic reboot is enabled and needed, reboot at the specific
+// time instead of immediately
+//  Default: "now"
+Unattended-Upgrade::Automatic-Reboot-Time "04:30";
+
+// Use apt bandwidth limit feature, this example limits the download
+// speed to 70kb/sec
+//Acquire::http::Dl-Limit "70";
+
+// Enable logging to syslog. Default is False
+// Unattended-Upgrade::SyslogEnable "false";
+
+// Specify syslog facility. Default is daemon
+// Unattended-Upgrade::SyslogFacility "daemon";
+
+// Download and install upgrades only on AC power
+// (i.e. skip or gracefully stop updates on battery)
+// Unattended-Upgrade::OnlyOnACPower "true";
+
+// Download and install upgrades only on non-metered connection
+// (i.e. skip or gracefully stop updates on a metered connection)
+// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
+
+// Verbose logging
+// Unattended-Upgrade::Verbose "false";
+
+// Print debugging information both in unattended-upgrades and
+// in unattended-upgrade-shutdown
+// Unattended-Upgrade::Debug "false";
+
+// Allow package downgrade if Pin-Priority exceeds 1000
+// Unattended-Upgrade::Allow-downgrade "false";
+
+// When APT fails to mark a package to be upgraded or installed try adjusting
+// candidates of related packages to help APT's resolver in finding a solution
+// where the package can be upgraded or installed.
+// This is a workaround until APT's resolver is fixed to always find a
+// solution if it exists. (See Debian bug #711128.)
+// The fallback is enabled by default, except on Debian's sid release because
+// uninstallable packages are frequent there.
+// Disabling the fallback speeds up unattended-upgrades when there are
+// uninstallable packages at the expense of rarely keeping back packages which
+// could be upgraded or installed.
+// Unattended-Upgrade::Allow-APT-Mark-Fallback "true";

src/Fox_PVE_Cpufrequtils.conf

@@ -40,7 +40,7 @@ CPUFREQ_OPTIONS=""
 #       MIN_SPEED=500
 
 ENABLE="true"
-GOVERNOR="schedutil"
+GOVERNOR="powersave"
 MAX_SPEED="0"
 MIN_SPEED="0"