LMDE 7 Mean Machine

Complete Installation, Hardening & Virtualization Guide for QEMU/KVM

A full‑length, detailed, phase‑driven guide to build a secure, stable, low‑latency LMDE 7 host for serious QEMU/KVM workloads.

Reading & Usage Notes

This is Part 1 of 3 of the master document
Content is not summarized or pruned
Each phase builds on the previous one
You can safely stop after any phase

SECTION I — FOUNDATION

Phase 1: Pre‑Installation Planning & Firmware Preparation

1.1 Hardware Baseline & Sizing

Minimum viable configuration:

64‑bit CPU with virtualization extensions
- Intel: VT‑x + VT‑d
- AMD: SVM + IOMMU
16 GB RAM (32 GB+ strongly recommended for multi‑VM workloads)
SSD or NVMe storage (VMs on HDDs will bottleneck)
Reliable PSU and cooling (virtualization stresses sustained load)

Recommended for advanced use:

Dedicated GPU for passthrough
iGPU or second GPU for host
Dual‑NIC setup (management vs VM traffic)

1.2 BIOS / UEFI Configuration (Critical)

Enter firmware setup before installation and configure:

CPU & Chipset

Enable virtualization extensions
Enable IOMMU / VT‑d
Enable SR‑IOV (if available)

Boot & Security

Boot mode: UEFI only
Disable Secure Boot (recommended)
- Simplifies DKMS, VFIO, unsigned modules

Storage

SATA mode: AHCI (not RAID / RST)
Disable fake RAID unless explicitly required

Power & Stability

Disable aggressive C‑states (optional, latency‑sensitive systems)
Update BIOS/UEFI firmware if vendor provides fixes

1.3 Installation Media Preparation

Download LMDE 7 ISO from official Linux Mint sources
Verify checksum/signature
Use a reliable USB writer (Balena Etcher / dd)

Phase 2: Expert Mode Installation (Disk Layout & Encryption)

This phase defines long‑term system stability. Avoid automatic layouts.

2.1 Installer Mode Selection

Boot LMDE installer
Choose Expert / Manual partitioning
Confirm UEFI installation

2.2 Partitioning Strategy (Recommended)

Mount Point	Size	Filesystem	Purpose
/boot/efi	512 MB	FAT32	EFI System Partition
swap	RAM + 2 GB	swap	Memory pressure & hibernation
/	40–60 GB	ext4	OS only
/var/lib/libvirt	Large	XFS or Btrfs	VM images & storage
/home	Remaining	ext4	User data

Rationale

Separating /var/lib/libvirt prevents VM I/O from fragmenting root FS
ext4 for OS is predictable and stable
XFS excels at large sparse files (QCOW2, RAW images)
Btrfs enables snapshots and cloning (advanced users)

2.3 Filesystem Notes

ext4

Stable
Low overhead
Minimal tuning required

XFS

Excellent for VM disks
Avoid shrinking
Use with regular backups

Btrfs

Snapshot‑capable
Compression support
Requires operational discipline

2.4 Encryption Strategy

Recommended balance:

Enable LUKS for /home
Optional: LUKS for /var/lib/libvirt
Leave /boot unencrypted

Why:

Avoids early‑boot keyboard/layout issues
Preserves unattended reboot capability
Protects user and VM data at rest

2.5 User & Host Identity

Choose a strong local password
Avoid enabling automatic login
Hostname: meaningful, stable (e.g., lmde‑kvm‑host)

SECTION II — BASE SYSTEM STABILIZATION

Phase 3: Core System Updates & Base Setup

3.1 First Boot Checklist

After logging in:

Disable Welcome Screen auto‑start
Verify correct timezone and locale
Enable NTP time sync

sudo timedatectl set-ntp true

3.2 Full System Update

sudo apt update
sudo apt full-upgrade -y
sudo apt install -y build-essential dkms linux-headers-$(uname -r)

Reboot once updates complete.

3.3 CPU Microcode (Mandatory for Stability)

# Intel
sudo apt install intel-microcode

# AMD
sudo apt install amd64-microcode

Why this matters:

Fixes errata affecting virtualization
Prevents rare but catastrophic VM crashes

Reboot after installation.

Phase 4: Drivers, Firmware & SSD Reliability Tweaks

4.1 Verify Kernel & Drivers

uname -r
lsmod | less

Ensure no errors in:

dmesg -l err,crit,alert,emerg

4.2 SSD / NVMe I/O Scheduler Optimization

Modern Linux allows per‑device schedulers.

Create udev rule:

sudo nano /etc/udev/rules.d/60-ioschedulers.rules

# NVMe
ACTION=="add|change", KERNEL=="nvme[0-9]n[0-9]", ATTR{queue/scheduler}="none"

# SATA SSD
ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="mq-deadline"

Reload rules:

sudo udevadm control --reload

4.3 Enable Periodic TRIM

sudo systemctl enable --now fstrim.timer

Verify:

systemctl status fstrim.timer

4.4 Mount Options for SSD Longevity

Edit /etc/fstab and add noatime:

UUID=xxxx  /  ext4  errors=remount-ro,noatime  0  1

Benefits:

Reduced write amplification
Faster metadata access

LMDE 7 Mean Machine — Part 2 of 3

Virtualization Core, Security, Desktop & Power Management

This part builds the operational core of the system. After completing Part 2, the host is a fully usable, secure, low-latency KVM workstation.

SECTION III — VIRTUALIZATION CORE

Phase 5: QEMU + KVM Stack Installation & Validation

5.1 Conceptual Overview

QEMU provides hardware emulation, while KVM leverages CPU virtualization extensions to achieve near-native performance. libvirt acts as the management layer, and virt-manager provides a GUI frontend.

LMDE uses Debian Stable libvirt, which prioritizes correctness and isolation over bleeding-edge features — ideal for long-running VM hosts.

5.2 Package Installation

Install the complete virtualization stack:

sudo apt install -y \
  qemu-kvm \
  libvirt-daemon-system \
  libvirt-clients \
  virt-manager \
  bridge-utils \
  ovmf

Key components:

qemu-kvm – hypervisor engine
libvirt-daemon-system – VM lifecycle manager
virt-manager – GUI management tool
ovmf – UEFI firmware for modern guests

5.3 User Permissions & Groups

Add your user to required groups to avoid running virt-manager as root:

sudo usermod -aG kvm,libvirt,libvirt-qemu $USER

Log out and log back in for changes to apply.

5.4 Enable & Validate libvirt

sudo systemctl enable --now libvirtd

Verify service:

systemctl status libvirtd

Validate host capabilities:

virt-host-validate

All checks should report PASS or WARN (no FAIL).

Phase 6: IOMMU, Kernel Parameters & Boot Configuration

6.1 Why IOMMU Matters

IOMMU is required for:

PCI / GPU passthrough (VFIO)
DMA isolation
Better device security boundaries

Even without passthrough, enabling IOMMU improves robustness.

6.2 Enable IOMMU via GRUB

Edit GRUB configuration:

sudo nano /etc/default/grub

Append to GRUB_CMDLINE_LINUX_DEFAULT:

Intel:

intel_iommu=on iommu=pt

AMD:

amd_iommu=on iommu=pt

Example:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash intel_iommu=on iommu=pt"

Apply and reboot:

sudo update-grub
sudo reboot

6.3 Verify IOMMU Activation

dmesg | grep -e IOMMU -e DMAR

Expected output indicates enabled IOMMU groups.

SECTION IV — SECURITY, PERFORMANCE & USABILITY

Phase 7: Firewall, Hardening & Latency Reduction

7.1 Firewall Baseline (UFW)

A default-deny inbound policy significantly reduces attack surface.

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh   # only if remote access is required
sudo ufw enable

Verify:

sudo ufw status verbose

7.2 Kernel Memory Behavior (VM-Friendly)

Reduce unnecessary swapping and writeback latency.

Create tuning file:

sudo nano /etc/sysctl.d/99-vm-tuning.conf

vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

Apply:

sudo sysctl --system

7.3 Network Stack Hardening & Latency

Create network tuning file:

sudo nano /etc/sysctl.d/99-network-tuning.conf

# Reverse path filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# TCP fast open
net.ipv4.tcp_fastopen = 3

# Increase socket buffers
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216

Apply:

sudo sysctl --system

7.4 Mandatory Access Control (AppArmor)

Ensure AppArmor is active:

sudo aa-status

Do not disable AppArmor. Libvirt relies on it for VM isolation.

8.1 Reduce Desktop Overhead

Cinnamon effects consume GPU cycles better used by VMs.

System Settings → Effects
- Disable window, dialog & desktop effects

8.2 Startup Application Cleanup

System Settings → Startup Applications
Disable:
- Welcome Screen
- Print Queue Applet (if unused)
- Unused tray services

8.3 Useful Lightweight Tools

sudo apt install -y guake htop neofetch

guake – drop-down terminal for VM control
htop – CPU / NUMA / memory pressure visibility

Phase 9: Power Management & CPU Governance

9.1 Power Strategy Overview

The host must balance:

Fast CPU wake-up (low VM latency)
Reasonable power efficiency
Thermal stability

9.2 Install & Enable TLP

sudo apt install -y tlp tlp-rdw
sudo systemctl enable --now tlp

Verify:

tlp-stat -s

9.3 CPU Governor Policy

Edit TLP config:

sudo nano /etc/tlp.conf

Uncomment or add:

CPU_SCALING_GOVERNOR_ON_AC=performance
CPU_SCALING_GOVERNOR_ON_BAT=powersave

Apply:

sudo tlp start

9.4 Prevent Host Suspend During VM Runtime

Power Management → Suspend
Set suspend/hibernate to Never when on AC power

This prevents VM corruption or unexpected pauses.

LMDE 7 Mean Machine — Part 3 of 3

Advanced Virtualization, Storage, Security Profiles & Automation

Scope: Expert / Optional

This part enables near-bare-metal performance, advanced networking, snapshot-based recovery, and profile-driven security. Proceed incrementally and validate each phase.

SECTION V — ADVANCED VIRTUALIZATION

Phase 10: VFIO GPU Passthrough (AMD & NVIDIA)

Risk Level: High
Rollback Complexity: Moderate
Prerequisite: Working IOMMU (Phase 6)

GPU passthrough allows a virtual machine to directly control a physical GPU with near-native performance. This is commonly used for:

Windows gaming or workstation VMs
CUDA / ROCm compute workloads
Strong isolation between host and guest graphics stacks

10.1 Hardware & Topology Requirements

CPU + motherboard with IOMMU support
Dedicated GPU for passthrough (recommended)
Separate GPU or iGPU for host display
UEFI firmware (OVMF) for guests

Verify IOMMU:

dmesg | grep -e IOMMU -e DMAR

10.2 Identify GPU and Associated Devices

lspci -nn | grep -E "VGA|3D|Audio"

Example:

01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GP106 [10de:1c03]
01:00.1 Audio device [0403]: NVIDIA Corporation GP106 HDMI Audio [10de:10f1]

Important: Always passthrough all functions belonging to the GPU (graphics + audio).

10.3 Isolate the GPU from the Host

Create VFIO binding configuration:

sudo nano /etc/modprobe.d/vfio.conf

options vfio-pci ids=10de:1c03,10de:10f1 disable_vga=1

Prevent host drivers from binding:

sudo nano /etc/modprobe.d/blacklist-gpu.conf

blacklist nouveau
blacklist nvidia
blacklist radeon
blacklist amdgpu

Load VFIO modules early:

sudo nano /etc/modules

vfio
vfio_iommu_type1
vfio_pci
vfio_virqfd

Update initramfs and reboot:

sudo update-initramfs -u
sudo reboot

Verify binding:

lspci -nnk -d 10de:1c03

10.4 Guest Configuration Notes

General:

Use OVMF (UEFI) firmware
Use Q35 machine type
Assign hugepages if configured

NVIDIA-specific:

Add to VM XML:

<kvm>
  <hidden state='on'/>
</kvm>

AMD-specific:

Usually resets cleanly
Older GPUs may require vendor-reset module

10.5 Rollback Procedure

To revert GPU passthrough:

Remove VFIO IDs from /etc/modprobe.d/vfio.conf
Remove GPU blacklist
Regenerate initramfs
Reboot

Phase 11: HugePages & NUMA Optimization

Risk Level: Medium
Rollback Complexity: Low

HugePages reduce TLB misses and improve memory locality for large VMs.

11.1 Determine HugePage Size

grep Hugepagesize /proc/meminfo

Typical value: 2048 kB

11.2 Allocate HugePages

Example: 16 GB allocation

sudo nano /etc/sysctl.d/99-hugepages.conf

vm.nr_hugepages=8192

Apply and verify:

sudo sysctl --system
grep HugePages /proc/meminfo

11.3 libvirt Configuration

sudo nano /etc/libvirt/qemu.conf

hugetlbfs_mount = "/dev/hugepages"

Restart libvirt:

sudo systemctl restart libvirtd

Enable per-VM:

<memoryBacking>
  <hugepages/>
</memoryBacking>

11.4 NUMA Awareness

Check topology:

numactl --hardware

Best practices:

Pin VM vCPUs to one NUMA node
Allocate VM memory from same node
Avoid cross-node memory traffic

SECTION VI — NETWORKING, STORAGE & SECURITY MODELS

Phase 12: Bridged Networking (br0) with libvirt

Risk Level: Medium
Rollback Complexity: Low

Bridged networking places VMs directly on the LAN.

12.1 Create Linux Bridge (NetworkManager)

Replace eno1 with your physical interface.

nmcli connection add type bridge ifname br0 con-name br0
nmcli connection add type ethernet slave-type bridge ifname eno1 master br0
nmcli connection modify br0 ipv4.method auto ipv6.method ignore
nmcli connection up br0

Verify:

ip addr show br0

12.2 Integrate Bridge with libvirt

sudo virsh net-define /dev/stdin <<EOF
<network>
  <name>br0</name>
  <forward mode='bridge'/>
  <bridge name='br0'/>
</network>
EOF

sudo virsh net-start br0
sudo virsh net-autostart br0

12.3 Network Isolation Models

NAT: Safe default
Bridge: Full LAN exposure
Isolated: Malware testing / labs

Use separate networks per trust zone.

Phase 13: Btrfs Snapshot Strategy for VM Images

Risk Level: Low
Rollback Complexity: Low

Snapshots enable instant rollback and experimentation safety.

13.1 Recommended Layout

/var/lib/libvirt
 ├── images
 ├── snapshots
 └── backups

Mount options:

noatime,compress=zstd,space_cache=v2

13.2 Snapshot Workflow

Create snapshot:

btrfs subvolume snapshot \
 /var/lib/libvirt/images/vm1 \
 /var/lib/libvirt/snapshots/vm1-$(date +%F)

Rollback:

btrfs subvolume delete /var/lib/libvirt/images/vm1
btrfs subvolume snapshot \
 /var/lib/libvirt/snapshots/vm1-2024-01-01 \
 /var/lib/libvirt/images/vm1

13.3 Snapshot Rotation Policy

Daily: 7
Weekly: 4
Monthly: 3

Automate via systemd timers or cron.

Phase 14: Security Profiles & Deployment Models

14.1 Workstation Profile

Desktop enabled
NAT networking
UFW enabled
AppArmor enforced
No PCI passthrough by default

14.2 Lab / Homelab Profile

VFIO enabled
Multiple libvirt networks
Isolated malware VMs
Frequent snapshots

14.3 Internet-Facing Host Profile

No GUI exposure
SSH keys only
Fail2ban
Separate management NIC
Full disk encryption

ANNEXURE A — Automated Host Configuration Script

Purpose: Apply non-destructive tuning from this guide.
Safe: Yes (idempotent, no VFIO binding).

#!/usr/bin/env bash
set -euo pipefail

CONF_SYSCTL="/etc/sysctl.d/99-lmde-kvm.conf"
CONF_VM="/etc/sysctl.d/99-vm-tuning.conf"
CONF_NET="/etc/sysctl.d/99-network-tuning.conf"

apply_sysctl() {
  sudo tee "$1" >/dev/null <<EOF
$2
EOF
}

echo "Applying LMDE 7 KVM host tuning..."

apply_sysctl "$CONF_VM" "vm.swappiness=10
vm.dirty_ratio=15
vm.dirty_background_ratio=5"

apply_sysctl "$CONF_NET" "net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.tcp_fastopen=3
net.core.rmem_max=16777216
net.core.wmem_max=16777216"

sudo sysctl --system

sudo systemctl enable --now fstrim.timer libvirtd tlp
sudo udevadm control --reload

virt-host-validate || true

echo "Tuning complete. Reboot recommended."

LMDE 7 Mean Machine — Part 4 of 4

Troubleshooting, Failure Modes & Rollback Annexures

Audience: Operators, maintainers, advanced users
Purpose: Recovery, diagnosis, and safe rollback when things go wrong
Astro Book Note: This file is designed to work as a standalone chapter (part-4.mdx) in an Astro content collection.

SECTION VII — TROUBLESHOOTING & FAILURE MODES

Phase 15: Troubleshooting & Failure Modes

This phase documents real-world failure scenarios commonly encountered on KVM hosts and how to recover from them safely.

15.1 System Fails to Boot After Kernel / GRUB Changes

Symptoms

System stuck at GRUB
Black screen after boot
Immediate reboot loop

Recovery Procedure

At GRUB menu, select Advanced options
Boot into previous kernel
Log in and inspect recent changes

Check GRUB parameters:

cat /etc/default/grub

Revert unsafe parameters (example):

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

Apply and rebuild:

sudo update-grub
sudo reboot

15.2 IOMMU Enabled but VFIO Not Working

Symptoms

virt-host-validate reports IOMMU but passthrough fails
VM fails to start with PCI device errors

Diagnosis

dmesg | grep -i iommu
find /sys/kernel/iommu_groups/ -type l

Common Causes

ACS grouping limitations
Device shares IOMMU group with host-critical devices

Mitigation

Use a different PCI slot
Avoid ACS override unless absolutely necessary

15.3 Black Screen in GPU Passthrough VM

Symptoms

VM starts but display remains black

NVIDIA-Specific Fixes

Ensure UEFI (OVMF) firmware
Add hidden KVM state:

<kvm>
  <hidden state='on'/>
</kvm>

Use HDMI dummy plug if needed

15.4 Host Loses Network After br0 Setup

Symptoms

No connectivity after bridge creation

Recovery

Temporarily restore original connection:

nmcli connection down br0 || true
nmcli connection up "Wired connection 1"

Verify:

ip route

15.5 VM Performance Degradation

Symptoms

High latency
Stuttering under load

Checks

htop
numactl --hardware
iostat -xz 1

Remedies

Verify HugePages allocation
Ensure NUMA locality
Reduce host background services

15.6 Storage Corruption or Snapshot Failure (Btrfs)

Symptoms

Snapshot fails
Read-only filesystem

Recovery

sudo btrfs check --readonly /dev/nvme0n1pX
sudo mount -o remount,rw /

Always snapshot before repair attempts.

ANNEXURE B — ROLLBACK & CLEANUP SCRIPTS

Goal: Safely revert changes applied in earlier phases
Design: Explicit, readable, non-destructive

B.1 Rollback Kernel & GRUB Changes

#!/usr/bin/env bash
set -e

echo "Reverting GRUB kernel parameters..."

sudo sed -i 's/ iommu=pt//g; s/intel_iommu=on//g; s/amd_iommu=on//g' /etc/default/grub
sudo update-grub

echo "GRUB rollback complete. Reboot recommended."

B.2 Rollback VFIO GPU Passthrough

#!/usr/bin/env bash
set -e

echo "Removing VFIO bindings..."

sudo rm -f /etc/modprobe.d/vfio.conf
sudo rm -f /etc/modprobe.d/blacklist-gpu.conf
sudo sed -i '/^vfio/d' /etc/modules

sudo update-initramfs -u

echo "VFIO rollback complete. Reboot required."

B.3 Rollback HugePages Configuration

#!/usr/bin/env bash
set -e

echo "Disabling HugePages..."

sudo rm -f /etc/sysctl.d/99-hugepages.conf
sudo sysctl --system

echo "HugePages disabled."

B.4 Rollback Bridged Networking (br0)

#!/usr/bin/env bash
set -e

echo "Removing br0 bridge..."

nmcli connection down br0 || true
nmcli connection delete br0 || true

nmcli connection up "Wired connection 1" || true

echo "Network rollback complete."

B.5 Rollback Sysctl & Host Tuning

#!/usr/bin/env bash
set -e

echo "Removing custom sysctl tuning..."

sudo rm -f /etc/sysctl.d/99-lmde-kvm.conf
sudo rm -f /etc/sysctl.d/99-vm-tuning.conf
sudo rm -f /etc/sysctl.d/99-network-tuning.conf

sudo sysctl --system

echo "Sysctl rollback complete."

B.6 Full Cleanup (Safe Mode)

Warning: This removes all advanced tuning but keeps VMs intact.

#!/usr/bin/env bash
set -e

echo "Performing full LMDE KVM cleanup..."

sudo systemctl disable --now tlp || true
sudo systemctl disable --now libvirtd || true

sudo rm -rf /etc/modprobe.d/vfio.conf \
            /etc/modprobe.d/blacklist-gpu.conf \
            /etc/sysctl.d/99-*kvm* \
            /etc/sysctl.d/99-*vm* \
            /etc/sysctl.d/99-*network*

sudo update-initramfs -u
sudo update-grub

sudo systemctl enable --now libvirtd

sudo sysctl --system

echo "Cleanup complete. Reboot strongly recommended."

Closing Notes

Treat rollback scripts as surgical tools, not routine commands
Always snapshot before risky changes
Prefer incremental changes over bulk modifications

Final Result

You now have a complete, phase-structured, enterprise-grade LMDE 7 virtualization guide:

Stable Debian base
Hardened host
Near-bare-metal VM performance
Snapshot-backed recovery
Profile-driven security

Stable. Predictable. Mean.

End of Master Guide

LMDE 7 Mean Machine is now complete — from installation to recovery.

LMDE 7 Mean Machine

LMDE 7 Mean Machine

Complete Installation, Hardening & Virtualization Guide for QEMU/KVM

Reading & Usage Notes

SECTION I — FOUNDATION

Phase 1: Pre‑Installation Planning & Firmware Preparation

1.1 Hardware Baseline & Sizing

1.2 BIOS / UEFI Configuration (Critical)

1.3 Installation Media Preparation

Phase 2: Expert Mode Installation (Disk Layout & Encryption)

2.1 Installer Mode Selection

2.2 Partitioning Strategy (Recommended)

Rationale

2.3 Filesystem Notes

2.4 Encryption Strategy

2.5 User & Host Identity

SECTION II — BASE SYSTEM STABILIZATION

Phase 3: Core System Updates & Base Setup

3.1 First Boot Checklist

3.2 Full System Update

3.3 CPU Microcode (Mandatory for Stability)

Phase 4: Drivers, Firmware & SSD Reliability Tweaks

4.1 Verify Kernel & Drivers

4.2 SSD / NVMe I/O Scheduler Optimization

4.3 Enable Periodic TRIM

4.4 Mount Options for SSD Longevity

LMDE 7 Mean Machine — Part 2 of 3

Virtualization Core, Security, Desktop & Power Management

SECTION III — VIRTUALIZATION CORE

Phase 5: QEMU + KVM Stack Installation & Validation

5.1 Conceptual Overview

5.2 Package Installation

5.3 User Permissions & Groups

5.4 Enable & Validate libvirt

Phase 6: IOMMU, Kernel Parameters & Boot Configuration

6.1 Why IOMMU Matters

6.2 Enable IOMMU via GRUB

6.3 Verify IOMMU Activation

SECTION IV — SECURITY, PERFORMANCE & USABILITY

Phase 7: Firewall, Hardening & Latency Reduction

7.1 Firewall Baseline (UFW)

7.2 Kernel Memory Behavior (VM-Friendly)

7.3 Network Stack Hardening & Latency

7.4 Mandatory Access Control (AppArmor)

Phase 8: Desktop Optimization & Visual Refinement (Cinnamon)

8.1 Reduce Desktop Overhead

8.2 Startup Application Cleanup

8.3 Useful Lightweight Tools

Phase 9: Power Management & CPU Governance

9.1 Power Strategy Overview

9.2 Install & Enable TLP

9.3 CPU Governor Policy

9.4 Prevent Host Suspend During VM Runtime

LMDE 7 Mean Machine — Part 3 of 3

Advanced Virtualization, Storage, Security Profiles & Automation

SECTION V — ADVANCED VIRTUALIZATION

Phase 10: VFIO GPU Passthrough (AMD & NVIDIA)

10.1 Hardware & Topology Requirements

10.2 Identify GPU and Associated Devices

10.3 Isolate the GPU from the Host

10.4 Guest Configuration Notes

10.5 Rollback Procedure

Phase 11: HugePages & NUMA Optimization

11.1 Determine HugePage Size

11.2 Allocate HugePages

11.3 libvirt Configuration

11.4 NUMA Awareness

SECTION VI — NETWORKING, STORAGE & SECURITY MODELS

Phase 12: Bridged Networking (br0) with libvirt

12.1 Create Linux Bridge (NetworkManager)

12.2 Integrate Bridge with libvirt

12.3 Network Isolation Models

Phase 13: Btrfs Snapshot Strategy for VM Images

13.1 Recommended Layout

13.2 Snapshot Workflow

13.3 Snapshot Rotation Policy

Phase 14: Security Profiles & Deployment Models

14.1 Workstation Profile

14.2 Lab / Homelab Profile

14.3 Internet-Facing Host Profile