diff --git a/xen/drivers/passthrough/amd/iommu_acpi.c b/xen/drivers/passthrough/amd/iommu_acpi.c
index 64d10481d7..084dfeeefb 100644
--- a/xen/drivers/passthrough/amd/iommu_acpi.c
+++ b/xen/drivers/passthrough/amd/iommu_acpi.c
@@ -81,8 +81,8 @@ static void __init add_ivrs_mapping_entry(
              ivrs_mappings[alias_id].intremap_inuse = shared_intremap_inuse;
          }
     }
-    /* assgin iommu hardware */
-    ivrs_mappings[bdf].iommu = iommu;
+    /* Assign IOMMU hardware, but don't map an IOMMU by itself. */
+    ivrs_mappings[bdf].iommu = iommu->bdf != bdf ? iommu : NULL;
 }
 
 static struct amd_iommu * __init find_iommu_from_bdf_cap(
diff --git a/xen/drivers/passthrough/amd/pci_amd_iommu.c b/xen/drivers/passthrough/amd/pci_amd_iommu.c
index dc51d66769..4afbcd1609 100644
--- a/xen/drivers/passthrough/amd/pci_amd_iommu.c
+++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c
@@ -43,7 +43,7 @@ struct amd_iommu *find_iommu_for_device(int seg, int bdf)
     {
         unsigned int bd0 = bdf & ~PCI_FUNC(~0);
 
-        if ( ivrs_mappings[bd0].iommu )
+        if ( ivrs_mappings[bd0].iommu && ivrs_mappings[bd0].iommu->bdf != bdf )
         {
             struct ivrs_mappings tmp = ivrs_mappings[bd0];
 
@@ -424,6 +424,11 @@ static int amd_iommu_add_device(u8 devfn, struct pci_dev *pdev)
         return -EINVAL;
 
     bdf = PCI_BDF2(pdev->bus, pdev->devfn);
+
+    for_each_amd_iommu(iommu)
+        if ( pdev->seg == iommu->seg && bdf == iommu->bdf )
+            return is_hardware_domain(pdev->domain) ? 0 : -ENODEV;
+
     iommu = find_iommu_for_device(pdev->seg, bdf);
     if ( unlikely(!iommu) )
     {