add pcie passthrough config to pve role (#40)

roles/pve/README.md

@@ -1,13 +1,18 @@
 # maxhoesel.proxmox.pve
 
-Configure an existing Proxmox Virtual Environment hosts system.
+A role to perform basic setup tasks on a PVE node, such as repository and CPU configuration.
 
-Note that this role does not manage PVE settings itself (such as VMS and storage), but rather
-the underlying system. Right now, it manages the root users password and configures the PVE repository
+The following features are available and can be enabled/disabled individually:
+
+- Set a PVE repository (enterprise, no-subscription, test) (required)
+- Set the PVE root password (required)
+- Set the CPU governor to save power or improve performance
+- Support PCIe Passthrough by enabling the required modules
 
 ## Requirements
 
 - A PVE host accessible via SSH and a user with become privileges
+- This role needs to be run with `become: true`
 
 ## Role Variables
 
@@ -23,6 +28,8 @@ the underlying system. Right now, it manages the root users password and configu
 - Please note that this role does not configure your subscription key, you will have to do so yourself
 - Default: `no-subscription`
 
+### CPU Settings
+
 ##### `pve_set_cpu`
 - Whether to modify the CPU configuration, such as the chosen governor.
 - Default: `false`
@@ -37,3 +44,16 @@ the underlying system. Right now, it manages the root users password and configu
   - Proxmox defaults to `performance` due to potential [BSODs in Windows guests when running with variable frequency](https://forum.proxmox.com/threads/windows-7-x64-vms-crashing-randomly-during-process-termination.18238/#post-93273)
   - `ondemand` and `schedutil` both scale CPU frequency dynamically and may improve power consumption.
 - Default: `performance`. Set to `schedutil` if you want to save power and aware of the limitations mentioned above.
+
+### PCIe Passthrough
+
+##### `pve_enable_pcie_passthrough`
+- Whether to enable and configure PCIe passthrough on the host
+- If enabled, this will load the required kernel modules (and add intel_iommu=on to the kernel commandline on Intel CPUs)
+- Default: `false`
+
+##### `pve_pcie_reboot_for_kernel`
+- Whether to automatically reboot the node to load the required kernel modules
+- If set to `false`, you may have to manually reboot the node to enable PCIe passthrough
+- This has no effect if `pve_enable_pcie_passthrough` is disabled
+- Default: `true`

roles/pve/defaults/main.yml

@@ -2,3 +2,6 @@ pve_repo_type: no-subscription
 
 pve_set_cpu: no
 pve_cpu_governor: performance
+
+pve_enable_pcie_passthrough: no
+pve_pcie_reboot_for_kernel: yes

roles/pve/files/intel-iommu.cfg

@@ -0,0 +1 @@
+GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} intel_iommu=on"

roles/pve/files/vfio.conf

@@ -0,0 +1,4 @@
+ vfio
+ vfio_iommu_type1
+ vfio_pci
+ vfio_virqfd

roles/pve/handlers/main.yml

@@ -0,0 +1,6 @@
+- name: update initramfs
+  command: update-initramfs -u -k all
+
+- name: reboot host to enable vifo kernel modules
+  ansible.builtin.reboot:
+  when: pve_pcie_reboot_for_kernel

roles/pve/tasks/main.yml

@@ -15,3 +15,5 @@
 - include_tasks: repo.yml
 - include_tasks: cpu.yml
   when: pve_set_cpu
+- include_tasks: pcie_passthrough.yml
+  when: pve_enable_pcie_passthrough

roles/pve/tasks/pcie_passthrough.yml

@@ -0,0 +1,20 @@
+- name: intel_iommu=on kernel parameter is enabled
+  copy:
+    src: intel-iommu.cfg
+    dest: /etc/default/grub.d/intel-iommu.cfg
+    owner: root
+    group: root
+    mode: "644"
+  when: '"GenuineIntel" in ansible_processor | unique'
+  notify: reboot host to enable vifo kernel modules
+
+- name: vfio kernel modules are enabled
+  copy:
+    src: vfio.conf
+    dest: /etc/modules-load.d/vfio.conf
+    owner: root
+    group: root
+    mode: "644"
+  notify:
+    - update initramfs
+    - reboot host to enable vifo kernel modules