170hx-pve-gen2-controller

KO | EN

gitlite — search

#nlp #react-native #pdf #rust #kubernetes #rag #typescript #dotnet #deep-learning #react

170hx-pve-gen2-controller

(★ 9)

170hx-pve-gen2-controller

파일 탐색기

ZIP 다운로드

- - ci.yml
- - main.go
- guest.example.yaml
- host.example.yaml
- vfio-linkd-linux-amd64
- vfio-linkd-v0.2.0-linux-amd64.tar.gz
- architecture.md
- protocol.md
- proxmox.md
- troubleshooting.md
- - dedupe.go
  - dedupe_test.go
  - doctor.go
  - guest.go
  - helper.go
  - host.go
  - privilege_linux.go
  - privilege_unsupported.go
- - policy.go
  - policy_test.go
- - config_test.go
  - load.go
  - normalize.go
  - types.go
  - validate.go
- - client.go
  - peercred_linux.go
  - peercred_unsupported.go
  - server.go
  - server_linux_test.go
  - wire.go
- - backend.go
  - topology.go
  - types.go
  - types_test.go
- - errors.go
  - frame.go
  - protocol_test.go
  - request.go
  - response.go
- - locks.go
  - service.go
  - service_test.go
- - interfaces.go
- - vfio-linkd.conf
- - vfio-linkd-hook.sh
- - vfio-linkd-guest.service
  - vfio-linkd-helper.service
  - vfio-linkd-host.service
- - deployment_test.go
go.mod
go.sum
install.sh
LICENSE
Makefile
README.md
SECURITY.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

`vfio-linkd` is a policy-driven, least-privilege PCIe link orchestrator for VFIO passthrough devices. Its first target is the CMP 170HX workflow where a patched guest driver exposes Gen2 capability and the Proxmox/KVM host must safely retrain the real upstream port.

It is not a remote `setpci` service. Guests can request only `ensure_link(<logical-id>)`; all BDFs, PCI IDs, topology expectations, target generations, attempts, and risk acknowledgements come from immutable host policy.

## What is implemented

- One binary with `host`, `helper`, `guest`, `status`, `doctor`, `validate-config`, `render-qemu`, and `version` commands.
- AF_VSOCK and virtio-serial transports with a shared strict length-prefixed JSON protocol.
- CID/channel identity mapping, optional per-VM token authentication, bounded frames, timeouts, connection limits, and replay cache.
- Root helper isolation through a group-owned Unix socket and Linux `SO_PEERCRED` UID verification.
- Exact-BDF and attribute endpoint discovery, sysfs topology checks, PCI identity and VFIO driver checks, and shared-parent protection.
- Fixed-argument `setpci` backend, dry run, per-upstream locks, global concurrency limit, cooldown, retries, polling, and JSON audit logs.
- Fake PCI backend and coverage for validation, framing, authorization, idempotence, failure modes, cooldown, and concurrency.

## Build and test

Go 1.25 or newer is required.

```sh
go test -race ./...
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o vfio-linkd ./cmd/vfio-linkd
```

## Configure

Start from [configs/host.example.yaml](configs/host.example.yaml) and [configs/guest.example.yaml](configs/guest.example.yaml). Every hardware identifier in those files is an example and must match the real machine.

```sh
vfio-linkd validate-config --type host --config ./host.yaml
vfio-linkd validate-config --type guest --config ./guest.yaml
vfio-linkd doctor --type host --config ./host.yaml
```

The host example explicitly acknowledges live retraining because validation rejects a policy without both `allow_live_retrain: true` and `acknowledge_live_retrain_risk: true`. Keep `dry_run: true` for the first deployment pass.

## Interactive installation

The release archive contains `install.sh` and a static Linux amd64 binary. Extract it on the PVE host or guest and run:

```sh
chmod +x install.sh
sudo ./install.sh
```

On a new machine, select either the PVE/KVM host role or the guest-agent role. The installer prompts for transport, client identity, logical links, BDFs, expected PCI IDs, upstream ports, target generation, tokens, readiness checks, and verification. It validates the resulting YAML before replacing any existing configuration, creates a timestamped backup, installs the binary, and registers the appropriate systemd services.

The installer defaults a new host to Dry Run. Enabling real PCI writes requires typing an explicit risk acknowledgement. Host installation also loads `vhost_vsock`, persists it through `/etc/modules-load.d/vfio-linkd.conf`, and makes the frontend service wait for `/dev/vsock`.

The script installs itself as a persistent configuration manager. Run it again after installation to guided-reconfigure, update the binary, re-register services, validate configuration, restart services, or inspect service status:

```sh
sudo vfio-linkd-install
```

When upgrading from v0.1.x to v0.2.x, use guided Host reconfiguration. VM provider fields (`vm_providers`, client `vm`, `provider`, `id`, and `require_running`) were removed and are intentionally rejected by strict configuration decoding.

## Run

Install the units from [packaging/systemd](packaging/systemd), then start the helper before the frontend. Inside the VM, run the guest agent only after the patched driver is available; configured readiness checks handle normal startup delay. The Guest systemd unit retries every five seconds after a failed oneshot run, so an early boot attempt does not remain permanently failed.

```sh
systemctl enable --now vfio-linkd-helper.service vfio-linkd-host.service
vfio-linkd guest --config /etc/vfio-linkd/guest.yaml
vfio-linkd status --config /etc/vfio-linkd/guest.yaml
```

See [architecture](docs/architecture.md), [protocol](docs/protocol.md), [Proxmox setup](docs/proxmox.md), [troubleshooting](docs/troubleshooting.md), and [security policy](SECURITY.md).

## Hardware acceptance

Automated tests cannot prove that a specific root port, firmware, kernel, GPU, and guest driver tolerate live retraining. Before calling a deployment complete, verify Gen1 to Gen2 transition on the real host, confirm a second request returns `already_satisfied`, and validate NVIDIA/NVML operation inside the VM after retraining.

## License

Apache-2.0.

我比较懒，就把二进制也上传到仓库了，勿喷。
"# 170hx-pve-gen2-controller"

170hx-pve-gen2-controller

오너의 다른 레포

파일 탐색기

# CDN으로 사용하기

Was this content helpful?

Recent Feedback

170hx-pve-gen2-controller

오너의 다른 레포

파일 탐색기

# CDN으로 사용하기

Was this content helpful?

Recent Feedback

Download README