Proxmox GPU Passthrough

Turn on the IOMMU

Find out which bootloader the host uses:

proxmox-boot-tool status

Kernel options to add:

Option	When
intel_iommu=on	Intel CPUs. On by default on recent Proxmox kernels, but harmless to add.
iommu=pt	Always. Better performance for devices that aren't passed through.
initcall_blacklist=sysfb_init	Only when passing through the primary GPU. Stops the host console from claiming it. Replaces the old video=efifb:off, which no longer works on current kernels.
pcie_acs_override=downstream,multifunction	Last resort, only if the GPU shares an IOMMU group with other devices (see step 3). It weakens isolation between devices.

AMD systems don't need an amd_iommu option because it is on by default.

If the host boots with GRUB

nano /etc/default/grub

Edit the existing line, for example on an Intel host passing through the primary GPU:

GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt initcall_blacklist=sysfb_init"

Save (Ctrl+X, Y, Enter), then:

update-grub

If the host boots with systemd-boot (ZFS root on UEFI)

Add the same options to the end of the single line in /etc/kernel/cmdline, then:

proxmox-boot-tool refresh

Load the VFIO modules

cat >> /etc/modules <<'EOF'
vfio
vfio_iommu_type1
vfio_pci
EOF

vfio_virqfd from older guides is now built into the kernel and is no longer needed.

Some guest drivers make unsupported CPU calls that crash the VM. This setting tells KVM to ignore them:

echo "options kvm ignore_msrs=1 report_ignored_msrs=0" > /etc/modprobe.d/kvm.conf

Reboot, then confirm the IOMMU is active:

dmesg | grep -e DMAR -e IOMMU -e AMD-Vi

You should see a line like DMAR: IOMMU enabled or AMD-Vi: Interrupt remapping enabled.

Find the GPU and check its IOMMU group

lspci -nn | grep -i -e vga -e 3d -e audio

Example output:

01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GP104 [GeForce GTX 1070] [10de:1b81] (rev a1)
01:00.1 Audio device [0403]: NVIDIA Corporation GP104 High Definition Audio Controller [10de:10f0] (rev a1)

• 01:00 is the card's PCI address. .0 is the GPU and .1 is its HDMI audio. Newer cards may also have .2 and .3 (USB-C and serial bus controllers).
• The values in square brackets at the end, 10de:1b81 and 10de:10f0, are the device IDs. Note every one of them.

In the web UI, open Datacenter → your node → System → PCI Devices (or check Hardware → Add → PCI Device on any VM) to see the IOMMU group column. The GPU's functions should be alone in their group. If other devices share the group, try another PCIe slot before resorting to the ACS override.

Reserve the GPU for VFIO

Bind the card to vfio-pci before any host driver can take it. Use your device IDs:

echo "options vfio-pci ids=10de:1b81,10de:10f0 disable_vga=1" > /etc/modprobe.d/vfio.conf
cat >> /etc/modprobe.d/vfio.conf <<'EOF'
softdep nouveau pre: vfio-pci
softdep nvidia pre: vfio-pci
softdep radeon pre: vfio-pci
softdep amdgpu pre: vfio-pci
softdep snd_hda_intel pre: vfio-pci
EOF

If the host has no other GPU that needs a driver, you can also blacklist the drivers completely:

printf "blacklist nouveau\nblacklist nvidia\nblacklist nvidiafb\nblacklist radeon\nblacklist amdgpu\n" >> /etc/modprobe.d/blacklist.conf

Apply and reboot:

update-initramfs -u -k all
reboot

Confirm the card is now held by VFIO:

lspci -nnk -s 01:00

Every function should show Kernel driver in use: vfio-pci.

Add the GPU to a VM

1. Create the VM (or edit an existing one) with:
   • Machine: q35
   • BIOS: OVMF (UEFI), with an EFI disk added
   • CPU type: host
2. Go to Hardware → Add → PCI Device → Raw Device and choose the GPU (01:00.0).
3. Tick All Functions (passes the audio and other functions too), ROM-Bar and PCI-Express.
4. Tick Primary GPU only if the VM should use this card as its only display. Proxmox's noVNC console stops working when you do.
5. Start the VM and install the normal NVIDIA or AMD drivers inside the guest.