Blackmagic eGPU Pro + Proxmox

find /sys/kernel/iommu_groups/ -type l | sort -V

# What you see with a USB-C-only cable:
usb 3-3: Product: eGPU Pro
usb 3-3: Manufacturer: Blackmagic Design
usb 3-3: USB disconnect, device number 3   # immediately disconnects and reconnects

thunderbolt 1-1: new device found, vendor=0x4 device=0xa153
thunderbolt 1-1: Blackmagic Design eGPU Pro

# Check authorization state
cat /sys/bus/thunderbolt/devices/1-1/authorized
# 0 = unauthorized

# Authorize manually (for testing)
echo 1 > /sys/bus/thunderbolt/devices/1-1/authorized
# Wait ~3 seconds — GPU enumerates in lspci

options vfio-pci ids=1002:687f,1002:aaf8

vendor-reset
vfio
vfio_iommu_type1
vfio_pci

update-initramfs -u -k all

ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{vendor_name}=="Blackmagic Design", RUN+="/usr/local/bin/egpu-attach.sh %k"

#!/bin/bash
LOGFILE=/var/log/egpu-attach.log
echo "[$(date)] eGPU attach triggered: $1" >> $LOGFILE

AUTH_PATH="/sys/bus/thunderbolt/devices/${1}/authorized"
if [ -f "$AUTH_PATH" ]; then
    echo 1 > "$AUTH_PATH"
    echo "[$(date)] Authorized $1" >> $LOGFILE
fi

sleep 3

for vendor_dev in "1002:687f" "1002:aaf8"; do
    vendor=$(echo $vendor_dev | cut -d: -f1)
    device=$(echo $vendor_dev | cut -d: -f2)
    for syspath in /sys/bus/pci/devices/*/; do
        v=$(cat ${syspath}vendor 2>/dev/null | sed 's/0x//')
        d=$(cat ${syspath}device 2>/dev/null | sed 's/0x//')
        if [ "$v" = "$vendor" ] && [ "$d" = "$device" ]; then
            bdf=$(basename $syspath)
            drv=$(readlink ${syspath}driver 2>/dev/null | xargs basename 2>/dev/null)
            if [ "$drv" != "vfio-pci" ]; then
                echo "$bdf" > /sys/bus/pci/devices/${bdf}/driver/unbind 2>/dev/null
                echo "vfio-pci" > /sys/bus/pci/devices/${bdf}/driver_override
                echo "$bdf" > /sys/bus/pci/drivers/vfio-pci/bind 2>/dev/null
                echo "[$(date)] Bound $bdf to vfio-pci" >> $LOGFILE
            fi
        fi
    done
done
echo "[$(date)] eGPU attach complete" >> $LOGFILE

chmod +x /usr/local/bin/egpu-attach.sh

[Unit]
Description=Blackmagic eGPU Pro - authorize devices connected at boot
After=multi-user.target
Wants=multi-user.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/egpu-boot-auth.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

#!/bin/bash
LOGFILE=/var/log/egpu-attach.log
echo "[$(date)] eGPU boot-auth: scanning for connected devices" >> $LOGFILE

for dev in /sys/bus/thunderbolt/devices/*/; do
    name=$(cat ${dev}device_name 2>/dev/null)
    auth=$(cat ${dev}authorized 2>/dev/null)
    if [ "$name" = "eGPU Pro" ] && [ "$auth" = "0" ]; then
        echo 1 > ${dev}authorized 2>/dev/null
        echo "[$(date)] Boot-authorized $(basename $dev)" >> $LOGFILE
        sleep 5
        echo "[$(date)] Boot-auth complete for $(basename $dev)" >> $LOGFILE
    fi
done

[Unit]
Description=Blackmagic eGPU Pro - de-authorize before shutdown/reboot
DefaultDependencies=no
Before=shutdown.target reboot.target halt.target
After=sysinit.target

[Service]
Type=oneshot
ExecStart=/bin/true
ExecStop=/usr/local/bin/egpu-detach.sh
RemainAfterExit=yes
TimeoutStopSec=15

[Install]
WantedBy=multi-user.target

#!/bin/bash
LOGFILE=/var/log/egpu-attach.log
echo "[$(date)] eGPU detach triggered (pre-shutdown)" >> $LOGFILE

for vendor_dev in "1002:687f" "1002:aaf8"; do
    vendor=$(echo $vendor_dev | cut -d: -f1)
    device=$(echo $vendor_dev | cut -d: -f2)
    for syspath in /sys/bus/pci/devices/*/; do
        v=$(cat ${syspath}vendor 2>/dev/null | sed 's/0x//')
        d=$(cat ${syspath}device 2>/dev/null | sed 's/0x//')
        if [ "$v" = "$vendor" ] && [ "$d" = "$device" ]; then
            bdf=$(basename $syspath)
            echo "$bdf" > /sys/bus/pci/devices/${bdf}/driver/unbind 2>/dev/null
            echo "[$(date)] Unbound $bdf from vfio-pci" >> $LOGFILE
        fi
    done
done

for dev in /sys/bus/thunderbolt/devices/*/; do
    name=$(cat ${dev}device_name 2>/dev/null)
    auth=$(cat ${dev}authorized 2>/dev/null)
    if [ "$name" = "eGPU Pro" ] && [ "$auth" = "1" ]; then
        echo 0 > ${dev}authorized 2>/dev/null
        echo "[$(date)] De-authorized $(basename $dev)" >> $LOGFILE
    fi
done

echo "[$(date)] eGPU detach complete" >> $LOGFILE

chmod +x /usr/local/bin/egpu-detach.sh
systemctl daemon-reload
systemctl enable egpu-boot-auth.service egpu-shutdown.service
systemctl start egpu-shutdown.service
udevadm control --reload-rules

# Get MAC address (run with eGPU connected)
ip link show enp88s0
# example: link/ether 88:ae:dd:72:13:25

SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="88:ae:dd:72:13:25", NAME="lan0"

iface lan0 inet manual

auto vmbr0
iface vmbr0 inet static
  address 192.168.6.69/22
  gateway 192.168.4.1
  bridge-ports lan0
  bridge-stp off
  bridge-fd 0

udevadm control --reload-rules && udevadm trigger

error writing '1' to '/sys/bus/pci/devices/0000:30:00.0/reset': Inappropriate ioctl for device
failed to reset PCI device '0000:30:00.0', but trying to continue
org.freedesktop.DBus.Error.NoReply: Did not receive a reply.

apt-get install -y pve-headers-$(uname -r) dkms git build-essential
cd /usr/src
git clone https://github.com/gnif/vendor-reset.git
cd vendor-reset
echo 'ccflags-y += -Wno-missing-prototypes' >> src/Makefile
sed -i 's|asm/unaligned.h|linux/unaligned.h|g' $(grep -rl 'asm/unaligned.h' .)
dkms install .

mokutil --import /var/lib/dkms/mok.pub
# Enter a one-time password, then reboot
# At blue UEFI screen: Enroll MOK → Continue → Yes → enter password → Reboot

lsmod | grep vendor_reset
# vendor_reset           32768  0

qm set 100 -machine q35
qm set 100 -cpu host
qm set 100 -hostpci0 0000:30:00.0,pcie=1,rombar=1
qm set 100 -hostpci1 0000:30:00.1,pcie=1,rombar=0

apt-get install -y linux-modules-extra-$(uname -r)
apt-get install -y linux-firmware
modprobe amdgpu
ls /dev/dri/   # card0  renderD128

# Persist across reboots
echo 'amdgpu' > /etc/modules-load.d/amdgpu.conf

# Install Vulkan support in the guest
apt-get install -y vulkan-tools libvulkan1 mesa-vulkan-drivers

# Verify GPU is visible
vulkaninfo 2>&1 | grep deviceName
# AMD Radeon RX Vega (RADV VEGA10)

# Enable Vulkan backend in Ollama
mkdir -p /etc/systemd/system/ollama.service.d
cat > /etc/systemd/system/ollama.service.d/rocm.conf << 'EOF'
[Service]
Environment=OLLAMA_VULKAN=1
EOF
systemctl daemon-reload && systemctl restart ollama

# ldconfig for Ollama's bundled libraries
echo '/usr/local/lib/ollama/rocm' > /etc/ld.so.conf.d/ollama-rocm.conf
echo '/usr/local/lib/ollama' > /etc/ld.so.conf.d/ollama.conf
ldconfig

journalctl -u ollama | grep -E "Vulkan|inference compute|vram"

# Expected output:
inference compute  library=Vulkan  name=Vulkan0
description="AMD Radeon RX Vega (RADV VEGA10)"
type=discrete  total="8.0 GiB"  available="8.0 GiB"

# GPU bound to vfio-pci
lspci -nnk | grep -A2 "1002:687f\|1002:aaf8"
# expected: Kernel driver in use: vfio-pci

# TB authorization state
cat /sys/bus/thunderbolt/devices/1-1/authorized
# expected: 1

# Watch attach/detach log
tail -f /var/log/egpu-attach.log

# vendor-reset loaded
lsmod | grep vendor_reset

# IOMMU groups after hot-plug
find /sys/kernel/iommu_groups/ -type l | sort -V | grep "2[cdef]:\|3[01]:"

# GPU visible
lspci | grep AMD

# DRM devices
ls /dev/dri/

# Vulkan
vulkaninfo 2>&1 | grep deviceName

# Ollama GPU detection
journalctl -u ollama | grep -E "vram|Vulkan|inference compute"