VFIO: Firmware has requested this device have a 1:1 IOMMU mapping

[madskills]

Hi everyone,

I'm hoping someone can help me understand what appears to be a firmware/IOMMU issue affecting GPU passthrough over USB4.

I've spent several days troubleshooting this and have ruled out most of the common passthrough problems.

Hardware

Host

Beelink SER10 MAX
AMD Ryzen AI 9 HX 470 (Strix Point)
64 GB RAM
BIOS: GPT.4xx.SERM1.V102.P8COM (2026-01-20)

GPU

NVIDIA GeForce RTX 3090
Connected through an ADT-Link UT3G USB4 eGPU enclosure

Software

Proxmox VE 9.1
QEMU 10.1.2
Tested with both:
Linux 7.0.0-3-pve
Linux 6.17.13-6-pve
Host works perfectly

The GPU works flawlessly on the Proxmox host.

Latest NVIDIA proprietary driver loads correctly
nvidia-smi works
CUDA works
Docker works
Ollama successfully uses the GPU
Stable CUDA inference under load

Example:

+------------------------------------------------------+
| NVIDIA GeForce RTX 3090 |
| Driver Version: 595.84 |
| CUDA Version: 13.2 |
+------------------------------------------------------+

PCIe link:

LnkSta: Speed 16GT/s, Width x4

(which is expected through the UT3G enclosure)

So this does not appear to be:

a USB4 bandwidth issue
PCIe link training
NVIDIA driver issue
GPU stability issue
IOMMU groups

The GPU is isolated correctly:

03:00.0 -> Group 18
03:00.1 -> Group 19

Nothing unexpected is present in either group.

Reserved regions

Both groups expose:

0x0000000000000000 0x0000000000000fff direct
0x00000000771f1000 0x00000000771f2fff direct
0x00000000fee00000 0x00000000feefffff msi
0x000000fd00000000 0x000000ffffffffff reserved
ACPI IVRS

I dumped and disassembled the IVRS table.

It contains IVMD entries that reference the same address range:

0x771f1000
0x771f2000

including Unity-mapped and reserved memory definitions.

Error

The VM never starts.

Kernel log:

vfio-pci 0000:03:00.0:
Firmware has requested this device have a 1:1 IOMMU mapping,
rejecting configuring the device without a 1:1 mapping.

QEMU reports:

failed to setup container for group 18:
Failed to set group container: Invalid argument
What I've already tried
Linux kernel 6.17
Linux kernel 7.0
Above 4G Decoding enabled
Re-Size BAR enabled
Re-Size BAR disabled
BME DMA Mitigation disabled
ACS Override
Legacy VFIO
iommufd
Different VFIO configurations
Different VM configurations
OVMF / Q35
Latest NVIDIA driver

The result is always identical.

BIOS investigation

I've gone through the BIOS extensively.

I checked:

AMD CBS
NBIO
DF
SOC
Chipset
Security

However, I could not find any options related to:

Kernel DMA Protection
USB4 DMA Protection
Thunderbolt Security
External DMA Protection
Identity Mapping

The BIOS appears to expose very few advanced IOMMU options.

My observations

The interesting part is that everything works until VFIO attempts to attach the device.

The GPU works perfectly on the host.

The PCIe link is stable.

The IOMMU groups are correct.

The failure occurs only when VFIO attempts to configure the IOMMU.

Because the error explicitly mentions firmware requesting a 1:1 IOMMU mapping, I suspect this may be related to:

AMD firmware (AGESA)
ACPI IVRS
USB4 PCIe tunneling
Reserved regions
Or a newer VFIO/IOMMU requirement

rather than a standard passthrough configuration issue.

Questions

Has anyone successfully passed through a USB4 eGPU on:

Ryzen AI HX 370
Ryzen AI HX 470
Beelink SER10 MAX
Beelink SER9

using VFIO?

If so, I'd really appreciate knowing:

BIOS version
Kernel version
USB4 enclosure (UT3G, UT4G, etc.)
Any required BIOS settings

Also, if anyone understands exactly which firmware condition causes VFIO to emit:

Firmware has requested this device have a 1:1 IOMMU mapping

I'd be very interested in understanding how Linux determines that requirement and whether there is any supported way to satisfy it.

Thanks in advance!

 

[dcsapak]

HI, can you post the iommu groups, the vm config and the output of dmesg here?

in general the error:

Firmware has requested this device have a 1:1 IOMMU mapping

is a mainboard/firmware limitation that the linux kernel enforces, so to really fix it, you'd have to either change some bios setting or ask the vendor for an updated bios

 

[madskills]

Thanks for the suggestions. I did some additional debugging and have a few new findings.

I removed the ACS override and repeated the tests.

Without ACS override, the GPU and its audio function are now in the same IOMMU group, which is expected:
03:00.0 NVIDIA RTX 3090
03:00.1 NVIDIA HD Audio

However, the failure remains identical.

The interesting part is that the kernel now reports the error against the upstream PCIe bridge, rather than the GPU itself:

pcieport 0000:02:00.0:
Firmware has requested this device have a 1:1 IOMMU mapping,
rejecting configuring the device without a 1:1 mapping.

The PCIe topology is:

00:01.1 AMD Strix PCIe USB4 Bridge
└─ 01:00.0 ASMedia PCIe Bridge
└─ 02:00.0 ASMedia PCIe Bridge
├─ 03:00.0 NVIDIA GeForce RTX 3090
└─ 03:00.1 NVIDIA HD Audio

The GPU itself works perfectly on the Proxmox host:

• NVIDIA proprietary driver loads correctly
• nvidia-smi works
• CUDA works
• Docker + Ollama use the GPU successfully
• PCIe link trains correctly at PCIe Gen4 x4 (16 GT/s)

The failure only occurs when VFIO attempts to assign the device to a VM.

I also extracted the ACPI IVRS table. The firmware contains IVMD entries matching the reserved/direct regions exposed by the kernel, for example:

0x00000000771f1000 0x00000000771f2fff direct

I contacted Beelink, and they suggested trying amd_iommu ivmd_unity_map=1. Unfortunately, that parameter does not exist on either the Proxmox 6.17 or 7.0 kernels, so I could not test it.

At this point it looks less like a GPU or VFIO configuration issue, and more like the firmware is requiring a 1:1 DMA mapping for the USB4 PCIe bridge.

Has anyone seen this behaviour on newer AMD USB4 platforms (Ryzen AI HX 370/HX 470 or similar), or knows whether this is a current Linux/VFIO limitation or a firmware issue?

 

[futiless]

Sorry to bloat the thread but I am using a totally different system Minisforum MS-A2. An April 1st bios update made my passthroughs fail with the "Firmware has requested this device this device have a 1:1 IOMMU mapping, rejecting the device without a 1:1 mapping. Contact your platform vendor. This has rendered my server next to useless !! Taking down WAN : LAN .. Pi$$ing me off .. sorry but similar.

 

[madskills]

Thanks for sharing this.

That's actually very interesting.

In my case, the problem also appeared to be firmware-related rather than a VFIO configuration issue. I've ruled out the usual suspects (IOMMU groups, ACS override, legacy VFIO, iommufd, different kernels, etc.), and the host uses the GPU perfectly with the NVIDIA driver, CUDA and Ollama.

One interesting finding is that, after removing ACS override, the kernel no longer reports the error against the GPU itself but against the upstream ASMedia PCIe bridge behind the USB4 tunnel:
pcieport 0000:02:00.0:
Firmware has requested this device have a 1:1 IOMMU mapping,
rejecting configuring the device without a 1:1 mapping.

That makes me wonder whether recent BIOS updates on newer AMD platforms are generating different IVRS/IVMD tables or enabling a new DMA protection policy that current VFIO rejects.

Out of curiosity:

• Which BIOS version worked before?
• Which BIOS version introduced the problem?
• Is your device connected through USB4/Thunderbolt, or is it an internal PCIe device?

If we're seeing the same regression on different AMD systems after BIOS updates, that could point towards an AGESA or firmware change rather than a Proxmox-specific issue.