Passthrough problem

[mururoa]

Hi there,
I have a big problem with PCI Passthrough on Proxmox.
I follow this guide carefully : https://pve.proxmox.com/wiki/PCI_Passthrough#systemd-boot but it dont work for me.
I have hostpci0: 0000:06:00,pcie=1 in vm .conf and root=ZFS=rpool/ROOT/pve-1 boot=zfs quiet intel_iommu=on iommu=pt in cmdline
All seems ok, iommu activated, remapping ok, iommu isolation, ...
But when I start the vm, the server just reboot. No message that I can find in logs.
I really need to get this passthrough since it's destinated to the pfsense firewall that is just behind the internet router and the server has 6 lan ports.
The CPU is Intel(R) Core(TM) i5-8265U and the PCI-e device is Ethernet Controller I225-V (rev 03) (2.5 Gb).
For now pfsense run on another server using vmware ESXi flawlessly. No Passthrough there since the server has 2 network cards, one on lan switch and the other on wan switch and the network cards in pfsense are connected to the right switch.
Maybe I could do that in Proxmox : have one bridge with lan 0 on the server reserved for wan and an other bridge witn lan 1-5 for lan but I cant manage to find some howto to do that.
So my choice is have passthrough working or have 2 bridges on the server or drop Proxmox and use ESXi.
For sure I prefer options 1 or 2 so I ask for you help.

 

[leesteken]

But when I start the vm, the server just reboot. No message that I can find in logs.

Check your IOMMU groups: cat /proc/cmdline; for d in /sys/kernel/iommu_groups/*/devices/*; do n=${d#*/iommu_groups/*}; n=${n%%/*}; printf 'IOMMU group %s ' "$n"; lspci -nns "${d##*/}"; done. You cannot share devices from the same group between VMs or between a VM and the Proxmox host. PCI(e) devices, which can read memory, in the same group can communicate with each other bypassing the IOMMU security.

 

[leesteken]

Maybe I could do that in Proxmox : have one bridge with lan 0 on the server reserved for wan and an other bridge witn lan 1-5 for lan but I cant manage to find some howto to do that.

Yes, this is probably very well possible. Maybe just configure a second virtual bridge on one of the ports and connect the VM to that bridge.

 

[mururoa]

Okay, I'm gone the bridge way. In fact not so complicated.
So looking further I understood that only one network port was attached to vmbr0. So far I thought that all network ports were attached to the bridge.
I did not set an address for vmbr1 since this is the wan and it is set by dhcp from ISP router and there will be only pfsense on that bridge so no need for the host to participate.
So far so good, pfsense is installed and no more server reboot. This need some more testing but looks ok.