diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -1064,8 +1064,10 @@
          *  1: flushing cache (wbinvd) when the guest is scheduled out if
          *     there is no wbinvd exit, or
          *  2: execute wbinvd on all dirty pCPUs when guest wbinvd exits.
+         * If VT-d engine can force snooping, we don't need to do these.
          */
-        if ( has_arch_pdevs(v->domain) && !cpu_has_wbinvd_exiting )
+        if ( has_arch_pdevs(v->domain) && !iommu_snoop
+                && !cpu_has_wbinvd_exiting )
         {
             int cpu = v->arch.hvm_vmx.active_cpu;
             if ( cpu != -1 )
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2089,6 +2089,9 @@
     if ( !has_arch_mmios(current->domain) )
         return;
 
+    if ( iommu_snoop )
+        return;
+
     if ( cpu_has_wbinvd_exiting )
         on_each_cpu(wbinvd_ipi, NULL, 1);
     else