External GPU shows 7f? Trace the whole connection.

1. Separate USB connectivity from PCIe connectivity

Write down the chain: host model and port → cable → enclosure or dock → graphics card. Verify that the port, cable and enclosure support the PCIe connection needed by the product. The connector’s physical shape is not sufficient information.

Linux’s Thunderbolt documentation describes security levels in which PCIe tunneling requires device authorization. An unauthorized device is a different problem from an already enumerated endpoint that later becomes unreadable. Use your distribution’s trusted Thunderbolt device settings to inspect and authorize your own enclosure where required. Linux kernel: USB4 and Thunderbolt authorization and PCIe tunnels.

Do not disable platform security globally just to make an unknown device appear. Record the enclosure identity, authorization state and relevant firmware settings.

2. Compare the host view at each stage

Capture the PCI tree with the enclosure disconnected, connected and working, and then after the failure. If your distribution includes boltctl, its list view can help record authorization state.

boltctl list
lspci -Dnn
lspci -t
# Replace the example with the GPU address, if it appears.
lspci -s 0000:01:00.0 -nnk
sudo journalctl -k -b --no-pager

If boltctl is unavailable, use the distribution’s device settings and the kernel log; missing that utility does not prove missing Thunderbolt hardware. A changed bus address after reconnection means you must re-identify the device rather than reuse an old BDF.

Look at whether the upstream bridge and other dock devices disappear too. This is a useful comparison to give support, not proof that any one cable or bridge is defective.

3. Isolate one variable at a time

1. Establish a supported baseline. Use the enclosure maker’s recommended connection and power-up order. Check host and enclosure compatibility information.
2. Compare startup and hotplug. Record whether it works when connected at boot but fails on reconnect, or only fails after host suspend.
3. Compare the physical path. Where the vendor supports it, try a known compatible cable or another supported host port, without adding adapters.
4. Compare software deliberately. Record host kernel, GPU driver and firmware versions; choose a supported update or previous working release with a rollback route.

Before disconnecting, close GPU workloads and displays as your platform requires. If the enclosure also carries storage, safely stop its I/O and unmount it first. Never treat pulling a live dock cable as a general reset procedure.

When should I investigate the GPU driver?

Once the PCIe path is present and the GPU is accessible, inspect driver binding and display behavior. For an NVIDIA card, follow the NVIDIA GPU guide. If the failure is after a VM releases the external card, also record the passthrough lifecycle.

Retest the action that caused the fault: reconnect, suspend/resume or workload start. A single successful boot is a baseline, not proof that hotplug is fixed.

Common dock questions

Why does my USB keyboard work but the GPU does not?

They use different functions and connection paths. Verify the enclosure’s PCIe tunnel and GPU visibility separately from USB connectivity.

Will a more expensive cable fix 7f?

Price is not a diagnostic test. Verify the required specification and test a known compatible cable before buying replacements.

What should I tell the enclosure vendor?

Send the full connection chain, authorization status, before/after PCI tree, trigger and versions. State whether startup, hotplug and resume behave differently.