Merge lp:~qrilka/ubuntu/precise/libvirt/libvirt-fix-1092826 into lp:ubuntu/precise/libvirt

[Kirill Zaborsky]

Fix for LP: #1092826

[Jamie Strandboge (jdstrand)]

Thanks for your patch! Unfortunately it cannot be incorporated into Ubuntu in its current state:
 * debian/patches/fix-poll.patch does not include DEP-3 comments
 * debian/changelog should reference precise-proposed, not precise
 * the patch does not apply cleanly to 0.9.8-2ubuntu17.5, the version that is currently in precise

Please feel free to make these changes and resubmit. Thanks!

review: Needs Fixing

[Jamie Strandboge (jdstrand)]

Also:
 * the version '0.9.8-2ubuntu17.4ppa1' is incorrect. It should be 0.9.8-2ubuntu17.6 since 0.9.8-2ubuntu17.5 is currently in precise-updates.

Unmerged revisions

211. By Kirill Zaborsky on 2012-12-22

adds proper handling for EINTR signal (LP: #1092826)

210. By Serge Hallyn on 2012-08-13

* storage-fix-a-potential-crash-when-creating-vol-object: avoid a crash
  on bad free() on error lvm storage. (LP: #1035320)
* add pm-utils as suggests to avoid log spamming with messages about
  pm-is-supported not being found. (LP: #994476)

209. By Serge Hallyn on 2012-07-25

debian/apparmor/libvirt-qemu: add ceph.conf (LP: #1026404)

208. By Serge Hallyn on 2012-06-11

* debian/libvirt-bin.install, debian/rules: name the apport file
  source_libvirt.py, not source_libvirt-bin.py. (LP: #1007405)
* install /etc/dnsmasq.d/libvirt to configure system wide dnsmasq to not
  listen on the libvirt bridge. (Following Stéphane's lxc example)
  (LP: #928524) (LP: #231060)
  - postinst: restart dnsmasq; postrm: remove dnsmasq.d/libvirt file and
    restart dnsmasq; rules, libvirt-bin.dirs and libvirt-bin.install:
    install new debian/libvirt-bin.dnsmasq file.
* Warn user about bad pc-0.12 machine type, and help user transition.
  (LP: #1001625)
  - qemu-warn-on-pc-0.12.patch: When defining or starting a VM which uses the
    pc-0.12 machine type, warn in libvirtd.log.
  - debian/libvirt-migrate-qemu-machinetype: automatically migrate QEMU VMs
    to newest machine type. This is not done automatically as there will
    be some users who have good reason to stay with pc-0.12.

207. By Serge Hallyn on 2012-05-02

debian/apparmor/usr.sbin.libvirtd: allow execution of /lib/udev/scsi_id
(LP: #992378)

=== added file '.pc/.quilt_patches'
--- .pc/.quilt_patches	1970-01-01 00:00:00 +0000
+++ .pc/.quilt_patches	2012-12-22 20:09:19 +0000
@@ -0,0 +1,1 @@
+debian/patches
 
=== added file '.pc/.quilt_series'
--- .pc/.quilt_series	1970-01-01 00:00:00 +0000
+++ .pc/.quilt_series	2012-12-22 20:09:19 +0000
@@ -0,0 +1,1 @@
+series
 
=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2012-04-05 11:43:15 +0000
+++ .pc/applied-patches	2012-12-22 20:09:19 +0000
@@ -34,3 +34,5 @@
 ubuntu/9024-qemu-allow-snapshotting-of-sheepdog-and-rbd-disks.patch
 ubuntu/9025-qemu-change-rbd-auth_supported-separation-character-.patch
 ubuntu/xen-config-no-vfb-for-hvm.patch
+ubuntu/qemu-warn-on-pc-0.12.patch
+ubuntu/storage-fix-a-potential-crash-when-creating-vol-object
 
=== added directory '.pc/ubuntu/qemu-warn-on-pc-0.12.patch'
=== added directory '.pc/ubuntu/qemu-warn-on-pc-0.12.patch/src'
=== added directory '.pc/ubuntu/qemu-warn-on-pc-0.12.patch/src/qemu'
=== added file '.pc/ubuntu/qemu-warn-on-pc-0.12.patch/src/qemu/qemu_command.c'
--- .pc/ubuntu/qemu-warn-on-pc-0.12.patch/src/qemu/qemu_command.c	1970-01-01 00:00:00 +0000
+++ .pc/ubuntu/qemu-warn-on-pc-0.12.patch/src/qemu/qemu_command.c	2012-12-22 20:09:19 +0000
@@ -0,0 +1,7527 @@
+/*
+ * qemu_command.c: QEMU command generation
+ *
+ * Copyright (C) 2006-2011 Red Hat, Inc.
+ * Copyright (C) 2006 Daniel P. Berrange
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+ *
+ * Author: Daniel P. Berrange <[e-mail]>
+ */
+
+#include <config.h>
+
+#include "qemu_command.h"
+#include "qemu_capabilities.h"
+#include "qemu_bridge_filter.h"
+#include "cpu/cpu.h"
+#include "memory.h"
+#include "logging.h"
+#include "virterror_internal.h"
+#include "util.h"
+#include "virfile.h"
+#include "uuid.h"
+#include "c-ctype.h"
+#include "domain_nwfilter.h"
+#include "domain_audit.h"
+#include "domain_conf.h"
+#include "network/bridge_driver.h"
+#include "virnetdevtap.h"
+#include "base64.h"
+
+#include <sys/utsname.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#define VIR_FROM_THIS VIR_FROM_QEMU
+
+
+VIR_ENUM_DECL(virDomainDiskQEMUBus)
+VIR_ENUM_IMPL(virDomainDiskQEMUBus, VIR_DOMAIN_DISK_BUS_LAST,
+              "ide",
+              "floppy",
+              "scsi",
+              "virtio",
+              "xen",
+              "usb",
+              "uml",
+              "sata")
+
+
+VIR_ENUM_DECL(qemuDiskCacheV1)
+VIR_ENUM_DECL(qemuDiskCacheV2)
+
+VIR_ENUM_IMPL(qemuDiskCacheV1, VIR_DOMAIN_DISK_CACHE_LAST,
+              "default",
+              "off",
+              "off",  /* writethrough not supported, so for safety, disable */
+              "on",   /* Old 'on' was equivalent to 'writeback' */
+              "off",  /* directsync not supported, for safety, disable */
+              "off"); /* unsafe not supported, for safety, disable */
+
+VIR_ENUM_IMPL(qemuDiskCacheV2, VIR_DOMAIN_DISK_CACHE_LAST,
+              "default",
+              "none",
+              "writethrough",
+              "writeback",
+              "directsync",
+              "unsafe");
+
+VIR_ENUM_DECL(qemuVideo)
+
+VIR_ENUM_IMPL(qemuVideo, VIR_DOMAIN_VIDEO_TYPE_LAST,
+              "std",
+              "cirrus",
+              "vmware",
+              "", /* no arg needed for xen */
+              "", /* don't support vbox */
+              "qxl");
+
+VIR_ENUM_DECL(qemuControllerModelUSB)
+
+VIR_ENUM_IMPL(qemuControllerModelUSB, VIR_DOMAIN_CONTROLLER_MODEL_USB_LAST,
+              "piix3-usb-uhci",
+              "piix4-usb-uhci",
+              "usb-ehci",
+              "ich9-usb-ehci1",
+              "ich9-usb-uhci1",
+              "ich9-usb-uhci2",
+              "ich9-usb-uhci3",
+              "vt82c686b-usb-uhci",
+              "pci-ohci");
+
+VIR_ENUM_DECL(qemuDomainFSDriver)
+VIR_ENUM_IMPL(qemuDomainFSDriver, VIR_DOMAIN_FS_DRIVER_TYPE_LAST,
+              "local",
+              "local",
+              "handle");
+
+
+static void
+uname_normalize (struct utsname *ut)
+{
+    uname(ut);
+
+    /* Map i386, i486, i586 to i686.  */
+    if (ut->machine[0] == 'i' &&
+        ut->machine[1] != '\0' &&
+        ut->machine[2] == '8' &&
+        ut->machine[3] == '6' &&
+        ut->machine[4] == '\0')
+        ut->machine[1] = '6';
+}
+
+
+/**
+ * qemuPhysIfaceConnect:
+ * @def: the definition of the VM (needed by 802.1Qbh and audit)
+ * @driver: pointer to the qemud_driver
+ * @net: pointer to he VM's interface description with direct device type
+ * @qemuCaps: flags for qemu
+ * @vmop: VM operation type
+ *
+ * Returns a filedescriptor on success or -1 in case of error.
+ */
+int
+qemuPhysIfaceConnect(virDomainDefPtr def,
+                     struct qemud_driver *driver,
+                     virDomainNetDefPtr net,
+                     virBitmapPtr qemuCaps,
+                     enum virNetDevVPortProfileOp vmop)
+{
+    int rc;
+    char *res_ifname = NULL;
+    int vnet_hdr = 0;
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_VNET_HDR) &&
+        net->model && STREQ(net->model, "virtio"))
+        vnet_hdr = 1;
+
+    rc = virNetDevMacVLanCreateWithVPortProfile(
+        net->ifname, net->mac,
+        virDomainNetGetActualDirectDev(net),
+        virDomainNetGetActualDirectMode(net),
+        true, vnet_hdr, def->uuid,
+        virDomainNetGetActualDirectVirtPortProfile(net),
+        &res_ifname,
+        vmop, driver->stateDir,
+        virDomainNetGetActualBandwidth(net));
+    if (rc >= 0) {
+        virDomainAuditNetDevice(def, net, res_ifname, true);
+        VIR_FREE(net->ifname);
+        net->ifname = res_ifname;
+    }
+
+    return rc;
+}
+
+
+int
+qemuNetworkIfaceConnect(virDomainDefPtr def,
+                        virConnectPtr conn,
+                        struct qemud_driver *driver,
+                        virDomainNetDefPtr net,
+                        virBitmapPtr qemuCaps)
+{
+    char *brname = NULL;
+    int err;
+    int tapfd = -1;
+    int vnet_hdr = 0;
+    bool template_ifname = false;
+    unsigned char tapmac[VIR_MAC_BUFLEN];
+    int actualType = virDomainNetGetActualType(net);
+
+    if (actualType == VIR_DOMAIN_NET_TYPE_NETWORK) {
+        int active, fail = 0;
+        virErrorPtr errobj;
+        virNetworkPtr network = virNetworkLookupByName(conn,
+                                                       net->data.network.name);
+        if (!network)
+            return -1;
+
+        active = virNetworkIsActive(network);
+        if (active != 1) {
+            fail = 1;
+
+            if (active == 0)
+                qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                _("Network '%s' is not active."),
+                                net->data.network.name);
+        }
+
+        if (!fail) {
+            brname = virNetworkGetBridgeName(network);
+            if (brname == NULL)
+                fail = 1;
+        }
+
+        /* Make sure any above failure is preserved */
+        errobj = virSaveLastError();
+        virNetworkFree(network);
+        virSetError(errobj);
+        virFreeError(errobj);
+
+        if (fail)
+            return -1;
+
+    } else if (actualType == VIR_DOMAIN_NET_TYPE_BRIDGE) {
+        if (!(brname = strdup(virDomainNetGetActualBridgeName(net)))) {
+            virReportOOMError();
+            return -1;
+        }
+    } else {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("Network type %d is not supported"),
+                        virDomainNetGetActualType(net));
+        return -1;
+    }
+
+    if (!net->ifname ||
+        STRPREFIX(net->ifname, VIR_NET_GENERATED_PREFIX) ||
+        strchr(net->ifname, '%')) {
+        VIR_FREE(net->ifname);
+        if (!(net->ifname = strdup(VIR_NET_GENERATED_PREFIX "%d"))) {
+            virReportOOMError();
+            goto cleanup;
+        }
+        /* avoid exposing vnet%d in getXMLDesc or error outputs */
+        template_ifname = true;
+    }
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_VNET_HDR) &&
+        net->model && STREQ(net->model, "virtio"))
+        vnet_hdr = 1;
+
+    memcpy(tapmac, net->mac, VIR_MAC_BUFLEN);
+    tapmac[0] = 0xFE; /* Discourage bridge from using TAP dev MAC */
+    err = virNetDevTapCreateInBridgePort(brname, &net->ifname, tapmac,
+                                         vnet_hdr, true, &tapfd);
+    virDomainAuditNetDevice(def, net, "/dev/net/tun", tapfd >= 0);
+    if (err < 0) {
+        if (template_ifname)
+            VIR_FREE(net->ifname);
+        tapfd = -1;
+    }
+
+    if (driver->macFilter) {
+        if ((err = networkAllowMacOnPort(driver, net->ifname, net->mac))) {
+            virReportSystemError(err,
+                 _("failed to add ebtables rule to allow MAC address on  '%s'"),
+                                 net->ifname);
+        }
+    }
+
+    if (tapfd >= 0 &&
+        virNetDevBandwidthSet(net->ifname,
+                              virDomainNetGetActualBandwidth(net)) < 0) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("cannot set bandwidth limits on %s"),
+                        net->ifname);
+        VIR_FORCE_CLOSE(tapfd);
+        goto cleanup;
+    }
+
+    if (tapfd >= 0) {
+        if ((net->filter) && (net->ifname)) {
+            err = virDomainConfNWFilterInstantiate(conn, net);
+            if (err)
+                VIR_FORCE_CLOSE(tapfd);
+        }
+    }
+
+cleanup:
+    VIR_FREE(brname);
+
+    return tapfd;
+}
+
+
+int
+qemuOpenVhostNet(virDomainDefPtr def,
+                 virDomainNetDefPtr net,
+                 virBitmapPtr qemuCaps,
+                 int *vhostfd)
+{
+    *vhostfd = -1;   /* assume we won't use vhost */
+
+    /* If the config says explicitly to not use vhost, return now */
+    if (net->driver.virtio.name == VIR_DOMAIN_NET_BACKEND_TYPE_QEMU) {
+       return 0;
+    }
+
+    /* If qemu doesn't support vhost-net mode (including the -netdev command
+     * option), don't try to open the device.
+     */
+    if (!(qemuCapsGet(qemuCaps, QEMU_CAPS_VHOST_NET) &&
+          qemuCapsGet(qemuCaps, QEMU_CAPS_NETDEV) &&
+          qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))) {
+        if (net->driver.virtio.name == VIR_DOMAIN_NET_BACKEND_TYPE_VHOST) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            "%s", _("vhost-net is not supported with "
+                                    "this QEMU binary"));
+            return -1;
+        }
+        return 0;
+    }
+
+    /* If the nic model isn't virtio, don't try to open. */
+    if (!(net->model && STREQ(net->model, "virtio"))) {
+        if (net->driver.virtio.name == VIR_DOMAIN_NET_BACKEND_TYPE_VHOST) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            "%s", _("vhost-net is only supported for "
+                                    "virtio network interfaces"));
+            return -1;
+        }
+        return 0;
+    }
+
+    *vhostfd = open("/dev/vhost-net", O_RDWR);
+    virDomainAuditNetDevice(def, net, "/dev/vhost-net", *vhostfd >= 0);
+
+    /* If the config says explicitly to use vhost and we couldn't open it,
+     * report an error.
+     */
+    if ((*vhostfd < 0) &&
+        (net->driver.virtio.name == VIR_DOMAIN_NET_BACKEND_TYPE_VHOST)) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        "%s", _("vhost-net was requested for an interface, "
+                                "but is unavailable"));
+        return -1;
+    }
+    return 0;
+}
+
+
+static int qemuDomainDeviceAliasIndex(virDomainDeviceInfoPtr info,
+                                      const char *prefix)
+{
+    int idx;
+
+    if (!info->alias)
+        return -1;
+    if (!STRPREFIX(info->alias, prefix))
+        return -1;
+
+    if (virStrToLong_i(info->alias + strlen(prefix), NULL, 10, &idx) < 0)
+        return -1;
+
+    return idx;
+}
+
+
+int qemuDomainNetVLAN(virDomainNetDefPtr def)
+{
+    return qemuDomainDeviceAliasIndex(&def->info, "net");
+}
+
+
+/* Names used before -drive existed */
+static int qemuAssignDeviceDiskAliasLegacy(virDomainDiskDefPtr disk)
+{
+    char *dev_name;
+
+    if (disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM &&
+        STREQ(disk->dst, "hdc"))
+        dev_name = strdup("cdrom");
+    else
+        dev_name = strdup(disk->dst);
+
+    if (!dev_name) {
+        virReportOOMError();
+        return -1;
+    }
+
+    disk->info.alias = dev_name;
+    return 0;
+}
+
+
+char *qemuDeviceDriveHostAlias(virDomainDiskDefPtr disk,
+                               virBitmapPtr qemuCaps)
+{
+    char *ret;
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+        if (virAsprintf(&ret, "%s%s", QEMU_DRIVE_HOST_PREFIX, disk->info.alias) < 0) {
+            virReportOOMError();
+            return NULL;
+        }
+    } else {
+        if (!(ret = strdup(disk->info.alias))) {
+            virReportOOMError();
+            return NULL;
+        }
+    }
+    return ret;
+}
+
+
+/* Names used before -drive supported the id= option */
+static int qemuAssignDeviceDiskAliasFixed(virDomainDiskDefPtr disk)
+{
+    int busid, devid;
+    int ret;
+    char *dev_name;
+
+    if (virDiskNameToBusDeviceIndex(disk, &busid, &devid) < 0) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("cannot convert disk '%s' to bus/device index"),
+                        disk->dst);
+        return -1;
+    }
+
+    switch (disk->bus) {
+    case VIR_DOMAIN_DISK_BUS_IDE:
+        if (disk->device== VIR_DOMAIN_DISK_DEVICE_DISK)
+            ret = virAsprintf(&dev_name, "ide%d-hd%d", busid, devid);
+        else
+            ret = virAsprintf(&dev_name, "ide%d-cd%d", busid, devid);
+        break;
+    case VIR_DOMAIN_DISK_BUS_SCSI:
+        if (disk->device == VIR_DOMAIN_DISK_DEVICE_DISK)
+            ret = virAsprintf(&dev_name, "scsi%d-hd%d", busid, devid);
+        else
+            ret = virAsprintf(&dev_name, "scsi%d-cd%d", busid, devid);
+        break;
+    case VIR_DOMAIN_DISK_BUS_FDC:
+        ret = virAsprintf(&dev_name, "floppy%d", devid);
+        break;
+    case VIR_DOMAIN_DISK_BUS_VIRTIO:
+        ret = virAsprintf(&dev_name, "virtio%d", devid);
+        break;
+    case VIR_DOMAIN_DISK_BUS_XEN:
+        ret = virAsprintf(&dev_name, "xenblk%d", devid);
+        break;
+    default:
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("Unsupported disk name mapping for bus '%s'"),
+                        virDomainDiskBusTypeToString(disk->bus));
+        return -1;
+    }
+
+    if (ret == -1) {
+        virReportOOMError();
+        return -1;
+    }
+
+    disk->info.alias = dev_name;
+
+    return 0;
+}
+
+
+/* Our custom -drive naming scheme used with id= */
+static int qemuAssignDeviceDiskAliasCustom(virDomainDiskDefPtr disk)
+{
+    const char *prefix = virDomainDiskBusTypeToString(disk->bus);
+    if (disk->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE) {
+        if (virAsprintf(&disk->info.alias, "%s%d-%d-%d", prefix,
+                        disk->info.addr.drive.controller,
+                        disk->info.addr.drive.bus,
+                        disk->info.addr.drive.unit) < 0)
+            goto no_memory;
+    } else {
+        int idx = virDiskNameToIndex(disk->dst);
+        if (virAsprintf(&disk->info.alias, "%s-disk%d", prefix, idx) < 0)
+            goto no_memory;
+    }
+
+    return 0;
+
+no_memory:
+    virReportOOMError();
+    return -1;
+}
+
+
+int
+qemuAssignDeviceDiskAlias(virDomainDiskDefPtr def, virBitmapPtr qemuCaps)
+{
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE)) {
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+            return qemuAssignDeviceDiskAliasCustom(def);
+        else
+            return qemuAssignDeviceDiskAliasFixed(def);
+    } else {
+        return qemuAssignDeviceDiskAliasLegacy(def);
+    }
+}
+
+
+int
+qemuAssignDeviceNetAlias(virDomainDefPtr def, virDomainNetDefPtr net, int idx)
+{
+    if (idx == -1) {
+        int i;
+        idx = 0;
+        for (i = 0 ; i < def->nnets ; i++) {
+            int thisidx;
+            if ((thisidx = qemuDomainDeviceAliasIndex(&def->nets[i]->info, "net")) < 0) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("Unable to determine device index for network device"));
+                return -1;
+            }
+            if (thisidx >= idx)
+                idx = thisidx + 1;
+        }
+    }
+
+    if (virAsprintf(&net->info.alias, "net%d", idx) < 0) {
+        virReportOOMError();
+        return -1;
+    }
+
+    return 0;
+}
+
+
+int
+qemuAssignDeviceHostdevAlias(virDomainDefPtr def, virDomainHostdevDefPtr hostdev, int idx)
+{
+    if (idx == -1) {
+        int i;
+        idx = 0;
+        for (i = 0 ; i < def->nhostdevs ; i++) {
+            int thisidx;
+            if ((thisidx = qemuDomainDeviceAliasIndex(&def->hostdevs[i]->info, "hostdev")) < 0) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("Unable to determine device index for hostdev device"));
+                return -1;
+            }
+            if (thisidx >= idx)
+                idx = thisidx + 1;
+        }
+    }
+
+    if (virAsprintf(&hostdev->info.alias, "hostdev%d", idx) < 0) {
+        virReportOOMError();
+        return -1;
+    }
+
+    return 0;
+}
+
+
+int
+qemuAssignDeviceRedirdevAlias(virDomainDefPtr def, virDomainRedirdevDefPtr redirdev, int idx)
+{
+    if (idx == -1) {
+        int i;
+        idx = 0;
+        for (i = 0 ; i < def->nredirdevs ; i++) {
+            int thisidx;
+            if ((thisidx = qemuDomainDeviceAliasIndex(&def->redirdevs[i]->info, "redir")) < 0) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("Unable to determine device index for redirected device"));
+                return -1;
+            }
+            if (thisidx >= idx)
+                idx = thisidx + 1;
+        }
+    }
+
+    if (virAsprintf(&redirdev->info.alias, "redir%d", idx) < 0) {
+        virReportOOMError();
+        return -1;
+    }
+
+    return 0;
+}
+
+
+int
+qemuAssignDeviceControllerAlias(virDomainControllerDefPtr controller)
+{
+    const char *prefix = virDomainControllerTypeToString(controller->type);
+
+    if (virAsprintf(&controller->info.alias,  "%s%d", prefix,
+                    controller->idx) < 0) {
+        virReportOOMError();
+        return -1;
+    }
+
+    return 0;
+}
+
+
+int
+qemuAssignDeviceAliases(virDomainDefPtr def, virBitmapPtr qemuCaps)
+{
+    int i;
+
+    for (i = 0; i < def->ndisks ; i++) {
+        if (qemuAssignDeviceDiskAlias(def->disks[i], qemuCaps) < 0)
+            return -1;
+    }
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_NET_NAME) ||
+        qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+        for (i = 0; i < def->nnets ; i++) {
+            if (qemuAssignDeviceNetAlias(def, def->nets[i], i) < 0)
+                return -1;
+        }
+    }
+
+    if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+        return 0;
+
+    for (i = 0; i < def->nfss ; i++) {
+        if (virAsprintf(&def->fss[i]->info.alias, "fs%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nsounds ; i++) {
+        if (virAsprintf(&def->sounds[i]->info.alias, "sound%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nhostdevs ; i++) {
+        if (qemuAssignDeviceHostdevAlias(def, def->hostdevs[i], i) < 0)
+            return -1;
+    }
+    for (i = 0; i < def->nredirdevs ; i++) {
+        if (qemuAssignDeviceRedirdevAlias(def, def->redirdevs[i], i) < 0)
+            return -1;
+    }
+    for (i = 0; i < def->nvideos ; i++) {
+        if (virAsprintf(&def->videos[i]->info.alias, "video%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->ncontrollers ; i++) {
+        if (qemuAssignDeviceControllerAlias(def->controllers[i]) < 0)
+            return -1;
+    }
+    for (i = 0; i < def->ninputs ; i++) {
+        if (virAsprintf(&def->inputs[i]->info.alias, "input%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nparallels ; i++) {
+        if (virAsprintf(&def->parallels[i]->info.alias, "parallel%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nserials ; i++) {
+        if (virAsprintf(&def->serials[i]->info.alias, "serial%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nchannels ; i++) {
+        if (virAsprintf(&def->channels[i]->info.alias, "channel%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nconsoles ; i++) {
+        if (virAsprintf(&def->consoles[i]->info.alias, "console%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nhubs ; i++) {
+        if (virAsprintf(&def->hubs[i]->info.alias, "hub%d", i) < 0)
+            goto no_memory;
+    }
+    for (i = 0; i < def->nsmartcards ; i++) {
+        if (virAsprintf(&def->smartcards[i]->info.alias, "smartcard%d", i) < 0)
+            goto no_memory;
+    }
+    if (def->watchdog) {
+        if (virAsprintf(&def->watchdog->info.alias, "watchdog%d", 0) < 0)
+            goto no_memory;
+    }
+    if (def->memballoon) {
+        if (virAsprintf(&def->memballoon->info.alias, "balloon%d", 0) < 0)
+            goto no_memory;
+    }
+
+    return 0;
+
+    no_memory:
+    virReportOOMError();
+    return -1;
+}
+
+
+#define QEMU_PCI_ADDRESS_LAST_SLOT 31
+#define QEMU_PCI_ADDRESS_LAST_FUNCTION 8
+struct _qemuDomainPCIAddressSet {
+    virHashTablePtr used;
+    int nextslot;
+};
+
+
+static char *qemuPCIAddressAsString(virDomainDeviceInfoPtr dev)
+{
+    char *addr;
+
+    if (dev->addr.pci.domain != 0 ||
+        dev->addr.pci.bus != 0) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                        _("Only PCI domain 0 and bus 0 are available"));
+        return NULL;
+    }
+
+    if (virAsprintf(&addr, "%d:%d:%d.%d",
+                    dev->addr.pci.domain,
+                    dev->addr.pci.bus,
+                    dev->addr.pci.slot,
+                    dev->addr.pci.function) < 0) {
+        virReportOOMError();
+        return NULL;
+    }
+    return addr;
+}
+
+
+static int qemuCollectPCIAddress(virDomainDefPtr def ATTRIBUTE_UNUSED,
+                                 virDomainDeviceInfoPtr dev,
+                                 void *opaque)
+{
+    int ret = -1;
+    char *addr = NULL;
+    qemuDomainPCIAddressSetPtr addrs = opaque;
+
+    if (dev->type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI)
+        return 0;
+
+    addr = qemuPCIAddressAsString(dev);
+    if (!addr)
+        goto cleanup;
+
+    if (virHashLookup(addrs->used, addr)) {
+        if (dev->addr.pci.function != 0) {
+            qemuReportError(VIR_ERR_XML_ERROR,
+                            _("Attempted double use of PCI Address '%s' "
+                              "(may need \"multifunction='on'\" for device on function 0"),
+                            addr);
+        } else {
+            qemuReportError(VIR_ERR_XML_ERROR,
+                            _("Attempted double use of PCI Address '%s'"), addr);
+        }
+        goto cleanup;
+    }
+
+    VIR_DEBUG("Remembering PCI addr %s", addr);
+    if (virHashAddEntry(addrs->used, addr, addr) < 0)
+        goto cleanup;
+    addr = NULL;
+
+    if ((dev->addr.pci.function == 0) &&
+        (dev->addr.pci.multi != VIR_DOMAIN_DEVICE_ADDRESS_PCI_MULTI_ON)) {
+        /* a function 0 w/o multifunction=on must reserve the entire slot */
+        int function;
+        virDomainDeviceInfo temp_dev = *dev;
+
+        for (function = 1; function < QEMU_PCI_ADDRESS_LAST_FUNCTION; function++) {
+            temp_dev.addr.pci.function = function;
+            addr = qemuPCIAddressAsString(&temp_dev);
+            if (!addr)
+                goto cleanup;
+
+            if (virHashLookup(addrs->used, addr)) {
+                qemuReportError(VIR_ERR_XML_ERROR,
+                                _("Attempted double use of PCI Address '%s'"
+                                  "(need \"multifunction='off'\" for device on function 0)"),
+                                addr);
+                goto cleanup;
+            }
+
+            VIR_DEBUG("Remembering PCI addr %s (multifunction=off for function 0)", addr);
+            if (virHashAddEntry(addrs->used, addr, addr))
+                goto cleanup;
+            addr = NULL;
+        }
+    }
+    ret = 0;
+cleanup:
+    VIR_FREE(addr);
+    return ret;
+}
+
+
+int
+qemuDomainAssignPCIAddresses(virDomainDefPtr def)
+{
+    int ret = -1;
+    virBitmapPtr qemuCaps = NULL;
+    qemuDomainPCIAddressSetPtr addrs = NULL;
+
+    if (qemuCapsExtractVersionInfo(def->emulator, def->os.arch,
+                                   NULL,
+                                   &qemuCaps) < 0)
+        goto cleanup;
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+        if (!(addrs = qemuDomainPCIAddressSetCreate(def)))
+            goto cleanup;
+
+        if (qemuAssignDevicePCISlots(def, addrs) < 0)
+            goto cleanup;
+    }
+
+    ret = 0;
+
+cleanup:
+    qemuCapsFree(qemuCaps);
+    qemuDomainPCIAddressSetFree(addrs);
+
+    return ret;
+}
+
+
+static void
+qemuDomainPCIAddressSetFreeEntry(void *payload,
+                                 const void *name ATTRIBUTE_UNUSED)
+{
+    VIR_FREE(payload);
+}
+
+qemuDomainPCIAddressSetPtr qemuDomainPCIAddressSetCreate(virDomainDefPtr def)
+{
+    qemuDomainPCIAddressSetPtr addrs;
+
+    if (VIR_ALLOC(addrs) < 0)
+        goto no_memory;
+
+    if (!(addrs->used = virHashCreate(10, qemuDomainPCIAddressSetFreeEntry)))
+        goto error;
+
+    if (virDomainDeviceInfoIterate(def, qemuCollectPCIAddress, addrs) < 0)
+        goto error;
+
+    return addrs;
+
+no_memory:
+    virReportOOMError();
+error:
+    qemuDomainPCIAddressSetFree(addrs);
+    return NULL;
+}
+
+/* check whether the slot is used by the other device
+ * Return 0 if the slot is not used by the other device, or -1 if the slot
+ * is used by the other device.
+ */
+static int qemuDomainPCIAddressCheckSlot(qemuDomainPCIAddressSetPtr addrs,
+                                         virDomainDeviceInfoPtr dev)
+{
+    char *addr;
+    virDomainDeviceInfo temp_dev;
+    int function;
+
+    temp_dev = *dev;
+    for (function = 0; function < QEMU_PCI_ADDRESS_LAST_FUNCTION; function++) {
+        temp_dev.addr.pci.function = function;
+        addr = qemuPCIAddressAsString(&temp_dev);
+        if (!addr)
+            return -1;
+
+        if (virHashLookup(addrs->used, addr)) {
+            VIR_FREE(addr);
+            return -1;
+        }
+
+        VIR_FREE(addr);
+    }
+
+    return 0;
+}
+
+int qemuDomainPCIAddressReserveAddr(qemuDomainPCIAddressSetPtr addrs,
+                                    virDomainDeviceInfoPtr dev)
+{
+    char *addr;
+
+    addr = qemuPCIAddressAsString(dev);
+    if (!addr)
+        return -1;
+
+    VIR_DEBUG("Reserving PCI addr %s", addr);
+
+    if (virHashLookup(addrs->used, addr)) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("unable to reserve PCI address %s"), addr);
+        VIR_FREE(addr);
+        return -1;
+    }
+
+    if (virHashAddEntry(addrs->used, addr, addr)) {
+        VIR_FREE(addr);
+        return -1;
+    }
+
+    if (dev->addr.pci.slot > addrs->nextslot) {
+        addrs->nextslot = dev->addr.pci.slot + 1;
+        if (QEMU_PCI_ADDRESS_LAST_SLOT < addrs->nextslot)
+            addrs->nextslot = 0;
+    }
+
+    return 0;
+}
+
+int qemuDomainPCIAddressReserveFunction(qemuDomainPCIAddressSetPtr addrs,
+                                        int slot, int function)
+{
+    virDomainDeviceInfo dev;
+
+    dev.addr.pci.domain = 0;
+    dev.addr.pci.bus = 0;
+    dev.addr.pci.slot = slot;
+    dev.addr.pci.function = function;
+
+    return qemuDomainPCIAddressReserveAddr(addrs, &dev);
+}
+
+int qemuDomainPCIAddressReserveSlot(qemuDomainPCIAddressSetPtr addrs,
+                                    int slot)
+{
+    int function;
+
+    for (function = 0; function < QEMU_PCI_ADDRESS_LAST_FUNCTION; function++) {
+        if (qemuDomainPCIAddressReserveFunction(addrs, slot, function) < 0)
+            goto cleanup;
+    }
+
+    return 0;
+
+cleanup:
+    for (function--; function >= 0; function--) {
+        qemuDomainPCIAddressReleaseFunction(addrs, slot, function);
+    }
+    return -1;
+}
+
+int qemuDomainPCIAddressEnsureAddr(qemuDomainPCIAddressSetPtr addrs,
+                                    virDomainDeviceInfoPtr dev)
+{
+    int ret = 0;
+    if (dev->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+        /* We do not support hotplug multi-function PCI device now, so we should
+         * reserve the whole slot. The function of the PCI device must be 0.
+         */
+        if (dev->addr.pci.function != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("Only PCI device addresses with function=0"
+                              " are supported"));
+            return -1;
+        }
+
+        ret = qemuDomainPCIAddressReserveSlot(addrs, dev->addr.pci.slot);
+    } else {
+        ret = qemuDomainPCIAddressSetNextAddr(addrs, dev);
+    }
+    return ret;
+}
+
+
+int qemuDomainPCIAddressReleaseAddr(qemuDomainPCIAddressSetPtr addrs,
+                                    virDomainDeviceInfoPtr dev)
+{
+    char *addr;
+    int ret;
+
+    addr = qemuPCIAddressAsString(dev);
+    if (!addr)
+        return -1;
+
+    ret = virHashRemoveEntry(addrs->used, addr);
+
+    VIR_FREE(addr);
+
+    return ret;
+}
+
+int qemuDomainPCIAddressReleaseFunction(qemuDomainPCIAddressSetPtr addrs,
+                                        int slot, int function)
+{
+    virDomainDeviceInfo dev;
+
+    dev.addr.pci.domain = 0;
+    dev.addr.pci.bus = 0;
+    dev.addr.pci.slot = slot;
+    dev.addr.pci.function = function;
+
+    return qemuDomainPCIAddressReleaseAddr(addrs, &dev);
+}
+
+int qemuDomainPCIAddressReleaseSlot(qemuDomainPCIAddressSetPtr addrs, int slot)
+{
+    virDomainDeviceInfo dev;
+    char *addr;
+    int ret = 0;
+    unsigned int *function = &dev.addr.pci.function;
+
+    dev.addr.pci.domain = 0;
+    dev.addr.pci.bus = 0;
+    dev.addr.pci.slot = slot;
+
+    for (*function = 0; *function < QEMU_PCI_ADDRESS_LAST_FUNCTION; (*function)++) {
+        addr = qemuPCIAddressAsString(&dev);
+        if (!addr)
+            return -1;
+
+        if (!virHashLookup(addrs->used, addr)) {
+            VIR_FREE(addr);
+            continue;
+        }
+
+        VIR_FREE(addr);
+
+        if (qemuDomainPCIAddressReleaseFunction(addrs, slot, *function) < 0)
+            ret = -1;
+    }
+
+    return ret;
+}
+
+void qemuDomainPCIAddressSetFree(qemuDomainPCIAddressSetPtr addrs)
+{
+    if (!addrs)
+        return;
+
+    virHashFree(addrs->used);
+    VIR_FREE(addrs);
+}
+
+
+int qemuDomainPCIAddressSetNextAddr(qemuDomainPCIAddressSetPtr addrs,
+                                    virDomainDeviceInfoPtr dev)
+{
+    int i;
+    int iteration;
+
+    for (i = addrs->nextslot, iteration = 0;
+         iteration <= QEMU_PCI_ADDRESS_LAST_SLOT; i++, iteration++) {
+        virDomainDeviceInfo maybe;
+        char *addr;
+
+        if (QEMU_PCI_ADDRESS_LAST_SLOT < i)
+            i = 0;
+        memset(&maybe, 0, sizeof(maybe));
+        maybe.addr.pci.domain = 0;
+        maybe.addr.pci.bus = 0;
+        maybe.addr.pci.slot = i;
+        maybe.addr.pci.function = 0;
+
+        if (!(addr = qemuPCIAddressAsString(&maybe)))
+            return -1;
+
+        if (qemuDomainPCIAddressCheckSlot(addrs, &maybe) < 0) {
+            VIR_DEBUG("PCI addr %s already in use", addr);
+            VIR_FREE(addr);
+            continue;
+        }
+
+        VIR_DEBUG("Allocating PCI addr %s", addr);
+        VIR_FREE(addr);
+
+        if (qemuDomainPCIAddressReserveSlot(addrs, i) < 0)
+            return -1;
+
+        dev->type = VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI;
+        dev->addr.pci = maybe.addr.pci;
+
+        addrs->nextslot = i + 1;
+        if (QEMU_PCI_ADDRESS_LAST_SLOT < addrs->nextslot)
+            addrs->nextslot = 0;
+
+        return 0;
+    }
+
+    qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                    "%s", _("No more available PCI addresses"));
+    return -1;
+}
+
+/*
+ * This assigns static PCI slots to all configured devices.
+ * The ordering here is chosen to match the ordering used
+ * with old QEMU < 0.12, so that if a user updates a QEMU
+ * host from old QEMU to QEMU >= 0.12, their guests should
+ * get PCI addresses in the same order as before.
+ *
+ * NB, if they previously hotplugged devices then all bets
+ * are off. Hotplug for old QEMU was unfixably broken wrt
+ * to stable PCI addressing.
+ *
+ * Order is:
+ *
+ *  - Host bridge (slot 0)
+ *  - PIIX3 ISA bridge, IDE controller, something else unknown, USB controller (slot 1)
+ *  - Video (slot 2)
+ *
+ * Incrementally assign slots from 3 onwards:
+ *
+ *  - Net
+ *  - Sound
+ *  - SCSI controllers
+ *  - VirtIO block
+ *  - VirtIO balloon
+ *  - Host device passthrough
+ *  - Watchdog (not IB700)
+ *
+ * Prior to this function being invoked, qemuCollectPCIAddress() will have
+ * added all existing PCI addresses from the 'def' to 'addrs'. Thus this
+ * function must only try to reserve addresses if info.type == NONE and
+ * skip over info.type == PCI
+ */
+int
+qemuAssignDevicePCISlots(virDomainDefPtr def, qemuDomainPCIAddressSetPtr addrs)
+{
+    int i;
+    bool reservedIDE = false;
+    bool reservedUSB = false;
+    bool reservedVGA = false;
+    int function;
+
+    /* Host bridge */
+    if (qemuDomainPCIAddressReserveSlot(addrs, 0) < 0)
+        goto error;
+
+    /* Verify that first IDE and USB controllers (if any) is on the PIIX3, fn 1 */
+    for (i = 0; i < def->ncontrollers ; i++) {
+        /* First IDE controller lives on the PIIX3 at slot=1, function=1 */
+        if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_IDE &&
+            def->controllers[i]->idx == 0) {
+            if (def->controllers[i]->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+                if (def->controllers[i]->info.addr.pci.domain != 0 ||
+                    def->controllers[i]->info.addr.pci.bus != 0 ||
+                    def->controllers[i]->info.addr.pci.slot != 1 ||
+                    def->controllers[i]->info.addr.pci.function != 1) {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                    _("Primary IDE controller must have PCI address 0:0:1.1"));
+                    goto error;
+                }
+                /* If TYPE==PCI, then qemuCollectPCIAddress() function
+                 * has already reserved the address, so we must skip */
+                reservedIDE = true;
+            } else {
+                def->controllers[i]->info.type = VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI;
+                def->controllers[i]->info.addr.pci.domain = 0;
+                def->controllers[i]->info.addr.pci.bus = 0;
+                def->controllers[i]->info.addr.pci.slot = 1;
+                def->controllers[i]->info.addr.pci.function = 1;
+            }
+        } else if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_USB &&
+                   def->controllers[i]->idx == 0 &&
+                   (def->controllers[i]->model == VIR_DOMAIN_CONTROLLER_MODEL_USB_PIIX3_UHCI ||
+                    def->controllers[i]->model == -1)) {
+            if (def->controllers[i]->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+                if (def->controllers[i]->info.addr.pci.domain != 0 ||
+                    def->controllers[i]->info.addr.pci.bus != 0 ||
+                    def->controllers[i]->info.addr.pci.slot != 1 ||
+                    def->controllers[i]->info.addr.pci.function != 2) {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                    _("PIIX3 USB controller must have PCI address 0:0:1.2"));
+                    goto error;
+                }
+                reservedUSB = true;
+            } else {
+                def->controllers[i]->info.type = VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI;
+                def->controllers[i]->info.addr.pci.domain = 0;
+                def->controllers[i]->info.addr.pci.bus = 0;
+                def->controllers[i]->info.addr.pci.slot = 1;
+                def->controllers[i]->info.addr.pci.function = 2;
+            }
+        }
+    }
+
+    /* PIIX3 (ISA bridge, IDE controller, something else unknown, USB controller)
+     * hardcoded slot=1, multifunction device
+     */
+    for (function = 0; function < QEMU_PCI_ADDRESS_LAST_FUNCTION; function++) {
+        if ((function == 1 && reservedIDE) ||
+            (function == 2 && reservedUSB))
+            /* we have reserved this pci address */
+            continue;
+
+        if (qemuDomainPCIAddressReserveFunction(addrs, 1, function) < 0)
+            goto error;
+    }
+
+    /* First VGA is hardcoded slot=2 */
+    if (def->nvideos > 0) {
+        if (def->videos[0]->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+            if (def->videos[0]->info.addr.pci.domain != 0 ||
+                def->videos[0]->info.addr.pci.bus != 0 ||
+                def->videos[0]->info.addr.pci.slot != 2 ||
+                def->videos[0]->info.addr.pci.function != 0) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("Primary video card must have PCI address 0:0:2.0"));
+                goto error;
+            }
+            /* If TYPE==PCI, then qemuCollectPCIAddress() function
+             * has already reserved the address, so we must skip */
+            reservedVGA = true;
+        } else {
+            def->videos[0]->info.type = VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI;
+            def->videos[0]->info.addr.pci.domain = 0;
+            def->videos[0]->info.addr.pci.bus = 0;
+            def->videos[0]->info.addr.pci.slot = 2;
+            def->videos[0]->info.addr.pci.function = 0;
+        }
+    }
+
+    if (!reservedVGA
+        && qemuDomainPCIAddressReserveSlot(addrs, 2) < 0)
+        goto error;
+
+    for (i = 0; i < def->nfss ; i++) {
+        if (def->fss[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE)
+            continue;
+
+        /* Only support VirtIO-9p-pci so far. If that changes,
+         * we might need to skip devices here */
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->fss[i]->info) < 0)
+            goto error;
+    }
+
+    /* Network interfaces */
+    for (i = 0; i < def->nnets ; i++) {
+        if (def->nets[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE)
+            continue;
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->nets[i]->info) < 0)
+            goto error;
+    }
+
+    /* Sound cards */
+    for (i = 0; i < def->nsounds ; i++) {
+        if (def->sounds[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE)
+            continue;
+        /* Skip ISA sound card, and PCSPK */
+        if (def->sounds[i]->model == VIR_DOMAIN_SOUND_MODEL_SB16 ||
+            def->sounds[i]->model == VIR_DOMAIN_SOUND_MODEL_PCSPK)
+            continue;
+
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->sounds[i]->info) < 0)
+            goto error;
+    }
+
+    /* Disk controllers (SCSI only for now) */
+    for (i = 0; i < def->ncontrollers ; i++) {
+        /* FDC lives behind the ISA bridge; CCID is a usb device */
+        if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_FDC ||
+            def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_CCID)
+            continue;
+
+        /* First IDE controller lives on the PIIX3 at slot=1, function=1,
+           dealt with earlier on*/
+        if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_IDE &&
+            def->controllers[i]->idx == 0)
+            continue;
+
+        if (def->controllers[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE)
+            continue;
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->controllers[i]->info) < 0)
+            goto error;
+    }
+
+    /* Disks (VirtIO only for now) */
+    for (i = 0; i < def->ndisks ; i++) {
+        /* Only VirtIO disks use PCI addrs */
+        if (def->disks[i]->bus != VIR_DOMAIN_DISK_BUS_VIRTIO)
+            continue;
+
+        if (def->disks[i]->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI)
+            continue;
+
+        if (def->disks[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                          _("virtio only support device address type 'PCI'"));
+            goto error;
+        }
+
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->disks[i]->info) < 0)
+            goto error;
+    }
+
+    /* Host PCI devices */
+    for (i = 0; i < def->nhostdevs ; i++) {
+        if (def->hostdevs[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE)
+            continue;
+        if (def->hostdevs[i]->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS ||
+            def->hostdevs[i]->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI)
+            continue;
+
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->hostdevs[i]->info) < 0)
+            goto error;
+    }
+
+    /* VirtIO balloon */
+    if (def->memballoon &&
+        def->memballoon->model == VIR_DOMAIN_MEMBALLOON_MODEL_VIRTIO &&
+        def->memballoon->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE) {
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->memballoon->info) < 0)
+            goto error;
+    }
+
+    /* A watchdog - skip IB700, it is not a PCI device */
+    if (def->watchdog &&
+        def->watchdog->model != VIR_DOMAIN_WATCHDOG_MODEL_IB700 &&
+        def->watchdog->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE) {
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->watchdog->info) < 0)
+            goto error;
+    }
+
+    /* Further non-primary video cards */
+    for (i = 1; i < def->nvideos ; i++) {
+        if (def->videos[i]->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE)
+            continue;
+        if (qemuDomainPCIAddressSetNextAddr(addrs, &def->videos[i]->info) < 0)
+            goto error;
+    }
+    for (i = 0; i < def->ninputs ; i++) {
+        /* Nada - none are PCI based (yet) */
+    }
+    for (i = 0; i < def->nparallels ; i++) {
+        /* Nada - none are PCI based (yet) */
+    }
+    for (i = 0; i < def->nserials ; i++) {
+        /* Nada - none are PCI based (yet) */
+    }
+    for (i = 0; i < def->nchannels ; i++) {
+        /* Nada - none are PCI based (yet) */
+    }
+    for (i = 0; i < def->nhubs ; i++) {
+        /* Nada - none are PCI based (yet) */
+    }
+
+    return 0;
+
+error:
+    return -1;
+}
+
+static void
+qemuUsbId(virBufferPtr buf, int idx)
+{
+    if (idx == 0)
+        virBufferAsprintf(buf, "usb");
+    else
+        virBufferAsprintf(buf, "usb%d", idx);
+}
+
+static int
+qemuBuildDeviceAddressStr(virBufferPtr buf,
+                          virDomainDeviceInfoPtr info,
+                          virBitmapPtr qemuCaps)
+{
+    if (info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+        if (info->addr.pci.domain != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("Only PCI device addresses with domain=0 are supported"));
+            return -1;
+        }
+        if (info->addr.pci.bus != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("Only PCI device addresses with bus=0 are supported"));
+            return -1;
+        }
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_PCI_MULTIFUNCTION)) {
+            if (info->addr.pci.function > 7) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("The function of PCI device addresses must "
+                                  "less than 8"));
+                return -1;
+            }
+        } else {
+            if (info->addr.pci.function != 0) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("Only PCI device addresses with function=0 "
+                                  "are supported with this QEMU binary"));
+                return -1;
+            }
+            if (info->addr.pci.multi == VIR_DOMAIN_DEVICE_ADDRESS_PCI_MULTI_ON) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("'multifunction=on' is not supported with "
+                                  "this QEMU binary"));
+                return -1;
+            }
+        }
+
+        /* XXX
+         * When QEMU grows support for > 1 PCI bus, then pci.0 changes
+         * to pci.1, pci.2, etc
+         * When QEMU grows support for > 1 PCI domain, then pci.0 change
+         * to pciNN.0  where NN is the domain number
+         */
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_PCI_MULTIBUS))
+            virBufferAsprintf(buf, ",bus=pci.0");
+        else
+            virBufferAsprintf(buf, ",bus=pci");
+        if (info->addr.pci.multi == VIR_DOMAIN_DEVICE_ADDRESS_PCI_MULTI_ON)
+            virBufferAddLit(buf, ",multifunction=on");
+        else if (info->addr.pci.multi == VIR_DOMAIN_DEVICE_ADDRESS_PCI_MULTI_OFF)
+            virBufferAddLit(buf, ",multifunction=off");
+        virBufferAsprintf(buf, ",addr=0x%x", info->addr.pci.slot);
+        if (info->addr.pci.function != 0)
+           virBufferAsprintf(buf, ".0x%x", info->addr.pci.function);
+    } else if (info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_USB) {
+        virBufferAsprintf(buf, ",bus=");
+        qemuUsbId(buf, info->addr.usb.bus);
+        virBufferAsprintf(buf, ".0,port=%s", info->addr.usb.port);
+    }
+
+    return 0;
+}
+
+static int
+qemuBuildIoEventFdStr(virBufferPtr buf,
+                      enum virDomainIoEventFd use,
+                      virBitmapPtr qemuCaps)
+{
+    if (use && qemuCapsGet(qemuCaps, QEMU_CAPS_VIRTIO_IOEVENTFD))
+        virBufferAsprintf(buf, ",ioeventfd=%s",
+                          virDomainIoEventFdTypeToString(use));
+    return 0;
+}
+
+#define QEMU_SERIAL_PARAM_ACCEPTED_CHARS \
+  "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_"
+
+static int
+qemuSafeSerialParamValue(const char *value)
+{
+    if (strspn(value, QEMU_SERIAL_PARAM_ACCEPTED_CHARS) != strlen (value)) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("driver serial '%s' contains unsafe characters"),
+                        value);
+        return -1;
+    }
+
+    return 0;
+}
+
+static int
+qemuBuildRBDString(virConnectPtr conn,
+                   virDomainDiskDefPtr disk,
+                   virBufferPtr opt)
+{
+    int i, ret = 0;
+    virSecretPtr sec = NULL;
+    char *secret = NULL;
+    size_t secret_size;
+
+    virBufferAsprintf(opt, "rbd:%s", disk->src);
+    if (disk->auth.username) {
+        virBufferEscape(opt, ":", ":id=%s", disk->auth.username);
+        /* look up secret */
+        switch (disk->auth.secretType) {
+        case VIR_DOMAIN_DISK_SECRET_TYPE_UUID:
+            sec = virSecretLookupByUUID(conn,
+                                        disk->auth.secret.uuid);
+            break;
+        case VIR_DOMAIN_DISK_SECRET_TYPE_USAGE:
+            sec = virSecretLookupByUsage(conn,
+                                         VIR_SECRET_USAGE_TYPE_CEPH,
+                                         disk->auth.secret.usage);
+            break;
+        }
+
+        if (sec) {
+            char *base64 = NULL;
+
+            secret = (char *)conn->secretDriver->getValue(sec, &secret_size, 0,
+                                                          VIR_SECRET_GET_VALUE_INTERNAL_CALL);
+            if (secret == NULL) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                _("could not get the value of the secret for username %s"),
+                                disk->auth.username);
+                goto error;
+            }
+            /* qemu/librbd wants it base64 encoded */
+            base64_encode_alloc(secret, secret_size, &base64);
+            if (!base64) {
+                virReportOOMError();
+                goto error;
+            }
+            virBufferEscape(opt, ":;", ":key=%s:auth_supported=cephx\\;none",
+                            base64);
+            VIR_FREE(base64);
+        } else {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("rbd username '%s' specified but secret not found"),
+                            disk->auth.username);
+            goto error;
+        }
+    }
+
+    if (disk->nhosts > 0) {
+        virBufferAddLit(opt, ":mon_host=");
+        for (i = 0; i < disk->nhosts; ++i) {
+            if (i) {
+                virBufferAddLit(opt, "\\;");
+            }
+            if (disk->hosts[i].port) {
+                virBufferAsprintf(opt, "%s\\:%s",
+                                  disk->hosts[i].name,
+                                  disk->hosts[i].port);
+            } else {
+                virBufferAsprintf(opt, "%s", disk->hosts[i].name);
+            }
+        }
+    }
+
+cleanup:
+    VIR_FREE(secret);
+    if (sec)
+        virUnrefSecret(sec);
+
+    return ret;
+
+error:
+    ret = -1;
+    goto cleanup;
+}
+
+static int qemuAddRBDHost(virDomainDiskDefPtr disk, char *hostport)
+{
+    char *port;
+
+    disk->nhosts++;
+    if (VIR_REALLOC_N(disk->hosts, disk->nhosts) < 0)
+        goto no_memory;
+
+    port = strstr(hostport, "\\:");
+    if (port) {
+        *port = '\0';
+        port += 2;
+        disk->hosts[disk->nhosts-1].port = strdup(port);
+        if (!disk->hosts[disk->nhosts-1].port)
+            goto no_memory;
+    } else {
+        disk->hosts[disk->nhosts-1].port = strdup("6789");
+        if (!disk->hosts[disk->nhosts-1].port)
+            goto no_memory;
+    }
+    disk->hosts[disk->nhosts-1].name = strdup(hostport);
+    if (!disk->hosts[disk->nhosts-1].name)
+        goto no_memory;
+    return 0;
+
+no_memory:
+    virReportOOMError();
+    VIR_FREE(disk->hosts[disk->nhosts-1].port);
+    VIR_FREE(disk->hosts[disk->nhosts-1].name);
+    return -1;
+}
+
+/* disk->src initially has everything after the rbd: prefix */
+static int qemuParseRBDString(virDomainDiskDefPtr disk)
+{
+    char *options = NULL;
+    char *p, *e, *next;
+
+    p = strchr(disk->src, ':');
+    if (p) {
+        options = strdup(p + 1);
+        if (!options)
+            goto no_memory;
+        *p = '\0';
+    }
+
+    /* options */
+    if (!options)
+        return 0; /* all done */
+
+    p = options;
+    while (*p) {
+        /* find : delimiter or end of string */
+        for (e = p; *e && *e != ':'; ++e) {
+            if (*e == '\\') {
+                e++;
+                if (*e == '\0')
+                    break;
+            }
+        }
+        if (*e == '\0') {
+            next = e;    /* last kv pair */
+        } else {
+            next = e + 1;
+            *e = '\0';
+        }
+
+        if (STRPREFIX(p, "id=")) {
+            disk->auth.username = strdup(p + strlen("id="));
+            if (!disk->auth.username)
+                goto no_memory;
+        }
+        if (STRPREFIX(p, "mon_host=")) {
+            char *h, *sep;
+
+            h = p + strlen("mon_host=");
+            while (h < e) {
+                for (sep = h; sep < e; ++sep) {
+                    if (*sep == '\\' && (sep[1] == ',' ||
+                                         sep[1] == ';' ||
+                                         sep[1] == ' ')) {
+                        *sep = '\0';
+                        sep += 2;
+                        break;
+                    }
+                }
+                if (qemuAddRBDHost(disk, h) < 0) {
+                    return -1;
+                }
+                h = sep;
+            }
+        }
+
+        p = next;
+    }
+    return 0;
+
+no_memory:
+    virReportOOMError();
+    return -1;
+}
+
+char *
+qemuBuildDriveStr(virConnectPtr conn ATTRIBUTE_UNUSED,
+                  virDomainDiskDefPtr disk,
+                  bool bootable,
+                  virBitmapPtr qemuCaps)
+{
+    virBuffer opt = VIR_BUFFER_INITIALIZER;
+    const char *bus = virDomainDiskQEMUBusTypeToString(disk->bus);
+    int idx = virDiskNameToIndex(disk->dst);
+    int busid = -1, unitid = -1;
+
+    if (idx < 0) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("unsupported disk type '%s'"), disk->dst);
+        goto error;
+    }
+
+    switch (disk->bus) {
+    case VIR_DOMAIN_DISK_BUS_SCSI:
+        if (disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("unexpected address type for scsi disk"));
+            goto error;
+        }
+
+        /* Setting bus= attr for SCSI drives, causes a controller
+         * to be created. Yes this is slightly odd. It is not possible
+         * to have > 1 bus on a SCSI controller (yet). */
+        if (disk->info.addr.drive.bus != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            "%s", _("SCSI controller only supports 1 bus"));
+            goto error;
+        }
+        busid = disk->info.addr.drive.controller;
+        unitid = disk->info.addr.drive.unit;
+        break;
+
+    case VIR_DOMAIN_DISK_BUS_IDE:
+        if (disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("unexpected address type for ide disk"));
+            goto error;
+        }
+        /* We can only have 1 IDE controller (currently) */
+        if (disk->info.addr.drive.controller != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("Only 1 %s controller is supported"), bus);
+            goto error;
+        }
+        busid = disk->info.addr.drive.bus;
+        unitid = disk->info.addr.drive.unit;
+        break;
+
+    case VIR_DOMAIN_DISK_BUS_FDC:
+        if (disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("unexpected address type for fdc disk"));
+            goto error;
+        }
+        /* We can only have 1 FDC controller (currently) */
+        if (disk->info.addr.drive.controller != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("Only 1 %s controller is supported"), bus);
+            goto error;
+        }
+        /* We can only have 1 FDC bus (currently) */
+        if (disk->info.addr.drive.bus != 0) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("Only 1 %s bus is supported"), bus);
+            goto error;
+        }
+        unitid = disk->info.addr.drive.unit;
+
+        break;
+
+    case VIR_DOMAIN_DISK_BUS_VIRTIO:
+        /* Each virtio drive is a separate PCI device, no unit/busid or index */
+        idx = -1;
+        break;
+
+    case VIR_DOMAIN_DISK_BUS_XEN:
+        /* Xen has no address type currently, so assign based on index */
+        break;
+    }
+
+    /* disk->src is NULL when we use nbd disks */
+    if (disk->src || (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK &&
+                      disk->protocol == VIR_DOMAIN_DISK_PROTOCOL_NBD)) {
+        if (disk->type == VIR_DOMAIN_DISK_TYPE_DIR) {
+            /* QEMU only supports magic FAT format for now */
+            if (disk->driverType &&
+                STRNEQ(disk->driverType, "fat")) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                _("unsupported disk driver type for '%s'"),
+                                disk->driverType);
+                goto error;
+            }
+            if (!disk->readonly) {
+                qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("cannot create virtual FAT disks in read-write mode"));
+                goto error;
+            }
+            if (disk->device == VIR_DOMAIN_DISK_DEVICE_FLOPPY)
+                virBufferAsprintf(&opt, "file=fat:floppy:%s,", disk->src);
+            else
+                virBufferAsprintf(&opt, "file=fat:%s,", disk->src);
+        } else if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) {
+            switch (disk->protocol) {
+            case VIR_DOMAIN_DISK_PROTOCOL_NBD:
+                if (disk->nhosts != 1) {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                    _("NBD accepts only one host"));
+                    goto error;
+                }
+                virBufferAsprintf(&opt, "file=nbd:%s:%s,",
+                                  disk->hosts->name, disk->hosts->port);
+                break;
+            case VIR_DOMAIN_DISK_PROTOCOL_RBD:
+                virBufferAddLit(&opt, "file=");
+                if (qemuBuildRBDString(conn, disk, &opt) < 0)
+                    goto error;
+                virBufferAddChar(&opt, ',');
+                break;
+            case VIR_DOMAIN_DISK_PROTOCOL_SHEEPDOG:
+                if (disk->nhosts == 0)
+                    virBufferAsprintf(&opt, "file=sheepdog:%s,", disk->src);
+                else
+                    /* only one host is supported now */
+                    virBufferAsprintf(&opt, "file=sheepdog:%s:%s:%s,",
+                                      disk->hosts->name, disk->hosts->port,
+                                      disk->src);
+                break;
+            }
+        } else {
+            virBufferAsprintf(&opt, "file=%s,", disk->src);
+        }
+    }
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+        virBufferAddLit(&opt, "if=none");
+    else
+        virBufferAsprintf(&opt, "if=%s", bus);
+
+    if (disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM)
+        virBufferAddLit(&opt, ",media=cdrom");
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+        virBufferAsprintf(&opt, ",id=%s%s", QEMU_DRIVE_HOST_PREFIX, disk->info.alias);
+    } else {
+        if (busid == -1 && unitid == -1) {
+            if (idx != -1)
+                virBufferAsprintf(&opt, ",index=%d", idx);
+        } else {
+            if (busid != -1)
+                virBufferAsprintf(&opt, ",bus=%d", busid);
+            if (unitid != -1)
+                virBufferAsprintf(&opt, ",unit=%d", unitid);
+        }
+    }
+    if (bootable &&
+        qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_BOOT) &&
+        disk->device == VIR_DOMAIN_DISK_DEVICE_DISK &&
+        disk->bus != VIR_DOMAIN_DISK_BUS_IDE)
+        virBufferAddLit(&opt, ",boot=on");
+    if (disk->readonly &&
+        qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_READONLY))
+        virBufferAddLit(&opt, ",readonly=on");
+    if (disk->transient) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("transient disks not supported yet"));
+        goto error;
+    }
+    if (disk->driverType && *disk->driverType != '\0' &&
+        disk->type != VIR_DOMAIN_DISK_TYPE_DIR &&
+        qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_FORMAT))
+        virBufferAsprintf(&opt, ",format=%s", disk->driverType);
+    if (disk->serial &&
+        qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_SERIAL)) {
+        if (qemuSafeSerialParamValue(disk->serial) < 0)
+            goto error;
+        virBufferAsprintf(&opt, ",serial=%s", disk->serial);
+    }
+
+    if (disk->cachemode) {
+        const char *mode = NULL;
+
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_CACHE_V2)) {
+            mode = qemuDiskCacheV2TypeToString(disk->cachemode);
+
+            if (disk->cachemode == VIR_DOMAIN_DISK_CACHE_DIRECTSYNC &&
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_CACHE_DIRECTSYNC)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("disk cache mode 'directsync' is not "
+                                  "supported by this QEMU"));
+                goto error;
+            } else if (disk->cachemode == VIR_DOMAIN_DISK_CACHE_UNSAFE &&
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_CACHE_UNSAFE)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("disk cache mode 'unsafe' is not "
+                                  "supported by this QEMU"));
+                goto error;
+            }
+        } else {
+            mode = qemuDiskCacheV1TypeToString(disk->cachemode);
+        }
+
+        virBufferAsprintf(&opt, ",cache=%s", mode);
+    } else if (disk->shared && !disk->readonly) {
+        virBufferAddLit(&opt, ",cache=off");
+    }
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_MONITOR_JSON)) {
+        const char *wpolicy = NULL, *rpolicy = NULL;
+
+        if (disk->error_policy)
+            wpolicy = virDomainDiskErrorPolicyTypeToString(disk->error_policy);
+        if (disk->rerror_policy)
+            rpolicy = virDomainDiskErrorPolicyTypeToString(disk->rerror_policy);
+
+        if (disk->error_policy == VIR_DOMAIN_DISK_ERROR_POLICY_ENOSPACE) {
+            /* in the case of enospace, the option is spelled
+             * differently in qemu, and it's only valid for werror,
+             * not for rerror, so leave leave rerror NULL.
+             */
+            wpolicy = "enospc";
+        } else if (!rpolicy) {
+            /* for other policies, rpolicy can match wpolicy */
+            rpolicy = wpolicy;
+        }
+
+        if (wpolicy)
+            virBufferAsprintf(&opt, ",werror=%s", wpolicy);
+        if (rpolicy)
+            virBufferAsprintf(&opt, ",rerror=%s", rpolicy);
+    }
+
+    if (disk->iomode) {
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_AIO)) {
+            virBufferAsprintf(&opt, ",aio=%s",
+                              virDomainDiskIoTypeToString(disk->iomode));
+        } else {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("disk aio mode not supported with this "
+                              "QEMU binary"));
+            goto error;
+        }
+    }
+
+    /* block I/O throttling */
+    if (disk->blkdeviotune.total_bytes_sec) {
+        virBufferAsprintf(&opt, ",bps=%llu",
+                          disk->blkdeviotune.total_bytes_sec);
+    }
+
+    if (disk->blkdeviotune.read_bytes_sec) {
+        virBufferAsprintf(&opt, ",bps_rd=%llu",
+                          disk->blkdeviotune.read_bytes_sec);
+    }
+
+    if (disk->blkdeviotune.write_bytes_sec) {
+        virBufferAsprintf(&opt, ",bps_wr=%llu",
+                          disk->blkdeviotune.write_bytes_sec);
+    }
+
+    if (disk->blkdeviotune.total_iops_sec) {
+        virBufferAsprintf(&opt, ",iops=%llu",
+                          disk->blkdeviotune.total_iops_sec);
+    }
+
+    if (disk->blkdeviotune.read_iops_sec) {
+        virBufferAsprintf(&opt, ",iops_rd=%llu",
+                          disk->blkdeviotune.read_iops_sec);
+    }
+
+    if (disk->blkdeviotune.write_iops_sec) {
+        virBufferAsprintf(&opt, ",iops_wr=%llu",
+                          disk->blkdeviotune.write_iops_sec);
+    }
+
+    if (virBufferError(&opt)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&opt);
+
+error:
+    virBufferFreeAndReset(&opt);
+    return NULL;
+}
+
+
+char *
+qemuBuildDriveDevStr(virDomainDiskDefPtr disk,
+                     int bootindex,
+                     virBitmapPtr qemuCaps)
+{
+    virBuffer opt = VIR_BUFFER_INITIALIZER;
+    const char *bus = virDomainDiskQEMUBusTypeToString(disk->bus);
+    int idx = virDiskNameToIndex(disk->dst);
+
+    if (idx < 0) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("unsupported disk type '%s'"), disk->dst);
+        goto error;
+    }
+
+    switch (disk->bus) {
+    case VIR_DOMAIN_DISK_BUS_IDE:
+        virBufferAddLit(&opt, "ide-drive");
+        virBufferAsprintf(&opt, ",bus=ide.%d,unit=%d",
+                          disk->info.addr.drive.bus,
+                          disk->info.addr.drive.unit);
+        break;
+    case VIR_DOMAIN_DISK_BUS_SCSI:
+        virBufferAddLit(&opt, "scsi-disk");
+        virBufferAsprintf(&opt, ",bus=scsi%d.%d,scsi-id=%d",
+                          disk->info.addr.drive.controller,
+                          disk->info.addr.drive.bus,
+                          disk->info.addr.drive.unit);
+        break;
+    case VIR_DOMAIN_DISK_BUS_SATA:
+        virBufferAddLit(&opt, "ide-drive");
+        virBufferAsprintf(&opt, ",bus=ahci%d.%d",
+                          disk->info.addr.drive.controller,
+                          disk->info.addr.drive.unit);
+        break;
+    case VIR_DOMAIN_DISK_BUS_VIRTIO:
+        virBufferAddLit(&opt, "virtio-blk-pci");
+        qemuBuildIoEventFdStr(&opt, disk->ioeventfd, qemuCaps);
+        if (disk->event_idx &&
+            qemuCapsGet(qemuCaps, QEMU_CAPS_VIRTIO_BLK_EVENT_IDX)) {
+            virBufferAsprintf(&opt, ",event_idx=%s",
+                              virDomainVirtioEventIdxTypeToString(disk->event_idx));
+        }
+        if (qemuBuildDeviceAddressStr(&opt, &disk->info, qemuCaps) < 0)
+            goto error;
+        break;
+    case VIR_DOMAIN_DISK_BUS_USB:
+        virBufferAddLit(&opt, "usb-storage");
+        break;
+    default:
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("unsupported disk bus '%s' with device setup"), bus);
+        goto error;
+    }
+    virBufferAsprintf(&opt, ",drive=%s%s", QEMU_DRIVE_HOST_PREFIX, disk->info.alias);
+    virBufferAsprintf(&opt, ",id=%s", disk->info.alias);
+    if (bootindex && qemuCapsGet(qemuCaps, QEMU_CAPS_BOOTINDEX))
+        virBufferAsprintf(&opt, ",bootindex=%d", bootindex);
+
+    if (virBufferError(&opt)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&opt);
+
+error:
+    virBufferFreeAndReset(&opt);
+    return NULL;
+}
+
+
+char *qemuBuildFSStr(virDomainFSDefPtr fs,
+                     virBitmapPtr qemuCaps ATTRIBUTE_UNUSED)
+{
+    virBuffer opt = VIR_BUFFER_INITIALIZER;
+    const char *driver = qemuDomainFSDriverTypeToString(fs->fsdriver);
+
+    if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("only supports mount filesystem type"));
+        goto error;
+    }
+
+    if (!driver) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("Filesystem driver type not supported"));
+        goto error;
+    }
+    virBufferAdd(&opt, driver, -1);
+
+    if (fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_MAPPED) {
+        virBufferAddLit(&opt, ",security_model=mapped");
+    } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) {
+        virBufferAddLit(&opt, ",security_model=passthrough");
+    } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_SQUASH) {
+        virBufferAddLit(&opt, ",security_model=none");
+    }
+    virBufferAsprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias);
+    virBufferAsprintf(&opt, ",path=%s", fs->src);
+
+    if (virBufferError(&opt)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&opt);
+
+error:
+    virBufferFreeAndReset(&opt);
+    return NULL;
+}
+
+
+char *
+qemuBuildFSDevStr(virDomainFSDefPtr fs,
+                  virBitmapPtr qemuCaps)
+{
+    virBuffer opt = VIR_BUFFER_INITIALIZER;
+
+    if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("can only passthrough directories"));
+        goto error;
+    }
+
+    virBufferAddLit(&opt, "virtio-9p-pci");
+    virBufferAsprintf(&opt, ",id=%s", fs->info.alias);
+    virBufferAsprintf(&opt, ",fsdev=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias);
+    virBufferAsprintf(&opt, ",mount_tag=%s", fs->dst);
+
+    if (qemuBuildDeviceAddressStr(&opt, &fs->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&opt)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&opt);
+
+error:
+    virBufferFreeAndReset(&opt);
+    return NULL;
+}
+
+
+static int
+qemuControllerModelUSBToCaps(int model)
+{
+    switch (model) {
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_PIIX3_UHCI:
+        return QEMU_CAPS_PIIX3_USB_UHCI;
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_PIIX4_UHCI:
+        return QEMU_CAPS_PIIX4_USB_UHCI;
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_EHCI:
+        return QEMU_CAPS_USB_EHCI;
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_ICH9_EHCI1:
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_ICH9_UHCI1:
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_ICH9_UHCI2:
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_ICH9_UHCI3:
+        return QEMU_CAPS_ICH9_USB_EHCI1;
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_VT82C686B_UHCI:
+        return QEMU_CAPS_VT82C686B_USB_UHCI;
+    case VIR_DOMAIN_CONTROLLER_MODEL_USB_PCI_OHCI:
+        return QEMU_CAPS_PCI_OHCI;
+    default:
+        return -1;
+    }
+}
+
+
+static int
+qemuBuildUSBControllerDevStr(virDomainControllerDefPtr def,
+                             virBitmapPtr qemuCaps,
+                             virBuffer *buf)
+{
+    const char *smodel;
+    int model, caps;
+
+    model = def->model;
+    if (model == -1)
+        model = VIR_DOMAIN_CONTROLLER_MODEL_USB_PIIX3_UHCI;
+
+    smodel = qemuControllerModelUSBTypeToString(model);
+    caps = qemuControllerModelUSBToCaps(model);
+
+    if (caps == -1 || !qemuCapsGet(qemuCaps, caps)) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("%s not supported in this QEMU binary"), smodel);
+        return -1;
+    }
+
+    virBufferAsprintf(buf, "%s", smodel);
+
+    if (def->info.mastertype == VIR_DOMAIN_CONTROLLER_MASTER_USB) {
+        virBufferAsprintf(buf, ",masterbus=");
+        qemuUsbId(buf, def->idx);
+        virBufferAsprintf(buf, ".0,firstport=%d", def->info.master.usb.startport);
+    } else {
+        virBufferAsprintf(buf, ",id=");
+        qemuUsbId(buf, def->idx);
+    }
+
+    return 0;
+}
+
+char *
+qemuBuildControllerDevStr(virDomainControllerDefPtr def,
+                          virBitmapPtr qemuCaps,
+                          int *nusbcontroller)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    switch (def->type) {
+    case VIR_DOMAIN_CONTROLLER_TYPE_SCSI:
+        virBufferAddLit(&buf, "lsi");
+        virBufferAsprintf(&buf, ",id=scsi%d", def->idx);
+        break;
+
+    case VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL:
+        if (def->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+            virBufferAddLit(&buf, "virtio-serial-pci");
+        } else {
+            virBufferAddLit(&buf, "virtio-serial");
+        }
+        virBufferAsprintf(&buf, ",id=" QEMU_VIRTIO_SERIAL_PREFIX "%d",
+                          def->idx);
+        if (def->opts.vioserial.ports != -1) {
+            virBufferAsprintf(&buf, ",max_ports=%d",
+                              def->opts.vioserial.ports);
+        }
+        if (def->opts.vioserial.vectors != -1) {
+            virBufferAsprintf(&buf, ",vectors=%d",
+                              def->opts.vioserial.vectors);
+        }
+        break;
+
+    case VIR_DOMAIN_CONTROLLER_TYPE_CCID:
+        virBufferAsprintf(&buf, "usb-ccid,id=ccid%d", def->idx);
+        break;
+
+    case VIR_DOMAIN_CONTROLLER_TYPE_SATA:
+        virBufferAsprintf(&buf, "ahci,id=ahci%d", def->idx);
+        break;
+
+    case VIR_DOMAIN_CONTROLLER_TYPE_USB:
+        if (qemuBuildUSBControllerDevStr(def, qemuCaps, &buf) == -1)
+            goto error;
+
+        if (nusbcontroller)
+            *nusbcontroller += 1;
+
+        break;
+
+    /* We always get an IDE controller, whether we want it or not. */
+    case VIR_DOMAIN_CONTROLLER_TYPE_IDE:
+    default:
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("Unknown controller type: %s"),
+                        virDomainControllerTypeToString(def->type));
+        goto error;
+    }
+
+    if (qemuBuildDeviceAddressStr(&buf, &def->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildNicStr(virDomainNetDefPtr net,
+                const char *prefix,
+                int vlan)
+{
+    char *str;
+    if (virAsprintf(&str,
+                    "%smacaddr=%02x:%02x:%02x:%02x:%02x:%02x,vlan=%d%s%s%s%s",
+                    prefix ? prefix : "",
+                    net->mac[0], net->mac[1],
+                    net->mac[2], net->mac[3],
+                    net->mac[4], net->mac[5],
+                    vlan,
+                    (net->model ? ",model=" : ""),
+                    (net->model ? net->model : ""),
+                    (net->info.alias ? ",name=" : ""),
+                    (net->info.alias ? net->info.alias : "")) < 0) {
+        virReportOOMError();
+        return NULL;
+    }
+
+    return str;
+}
+
+
+char *
+qemuBuildNicDevStr(virDomainNetDefPtr net,
+                   int vlan,
+                   int bootindex,
+                   virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    const char *nic;
+    bool usingVirtio = false;
+
+    if (!net->model) {
+        nic = "rtl8139";
+    } else if (STREQ(net->model, "virtio")) {
+        nic = "virtio-net-pci";
+        usingVirtio = true;
+    } else {
+        nic = net->model;
+    }
+
+    virBufferAdd(&buf, nic, strlen(nic));
+    if (usingVirtio && net->driver.virtio.txmode) {
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_VIRTIO_TX_ALG)) {
+            virBufferAddLit(&buf, ",tx=");
+            switch (net->driver.virtio.txmode) {
+                case VIR_DOMAIN_NET_VIRTIO_TX_MODE_IOTHREAD:
+                    virBufferAddLit(&buf, "bh");
+                    break;
+
+                case VIR_DOMAIN_NET_VIRTIO_TX_MODE_TIMER:
+                    virBufferAddLit(&buf, "timer");
+                    break;
+                default:
+                    /* this should never happen, if it does, we need
+                     * to add another case to this switch.
+                     */
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                    _("unrecognized virtio-net-pci 'tx' option"));
+                    goto error;
+            }
+        } else {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("virtio-net-pci 'tx' option not supported in this QEMU binary"));
+            goto error;
+        }
+    }
+    if (usingVirtio) {
+        qemuBuildIoEventFdStr(&buf, net->driver.virtio.ioeventfd, qemuCaps);
+        if (net->driver.virtio.event_idx &&
+            qemuCapsGet(qemuCaps, QEMU_CAPS_VIRTIO_NET_EVENT_IDX)) {
+            virBufferAsprintf(&buf, ",event_idx=%s",
+                              virDomainVirtioEventIdxTypeToString(net->driver.virtio.event_idx));
+        }
+    }
+    if (vlan == -1)
+        virBufferAsprintf(&buf, ",netdev=host%s", net->info.alias);
+    else
+        virBufferAsprintf(&buf, ",vlan=%d", vlan);
+    virBufferAsprintf(&buf, ",id=%s", net->info.alias);
+    virBufferAsprintf(&buf, ",mac=%02x:%02x:%02x:%02x:%02x:%02x",
+                      net->mac[0], net->mac[1],
+                      net->mac[2], net->mac[3],
+                      net->mac[4], net->mac[5]);
+    if (qemuBuildDeviceAddressStr(&buf, &net->info, qemuCaps) < 0)
+        goto error;
+    if (bootindex && qemuCapsGet(qemuCaps, QEMU_CAPS_BOOTINDEX))
+        virBufferAsprintf(&buf, ",bootindex=%d", bootindex);
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildHostNetStr(virDomainNetDefPtr net,
+                    char type_sep,
+                    int vlan,
+                    const char *tapfd,
+                    const char *vhostfd)
+{
+    bool is_tap = false;
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    switch (virDomainNetGetActualType(net)) {
+    case VIR_DOMAIN_NET_TYPE_NETWORK:
+    case VIR_DOMAIN_NET_TYPE_BRIDGE:
+    case VIR_DOMAIN_NET_TYPE_DIRECT:
+        virBufferAddLit(&buf, "tap");
+        virBufferAsprintf(&buf, "%cfd=%s", type_sep, tapfd);
+        type_sep = ',';
+        is_tap = true;
+        break;
+
+    case VIR_DOMAIN_NET_TYPE_ETHERNET:
+        virBufferAddLit(&buf, "tap");
+        if (net->ifname) {
+            virBufferAsprintf(&buf, "%cifname=%s", type_sep, net->ifname);
+            type_sep = ',';
+        }
+        if (net->data.ethernet.script) {
+            virBufferAsprintf(&buf, "%cscript=%s", type_sep,
+                              net->data.ethernet.script);
+            type_sep = ',';
+        }
+        is_tap = true;
+        break;
+
+    case VIR_DOMAIN_NET_TYPE_CLIENT:
+    case VIR_DOMAIN_NET_TYPE_SERVER:
+    case VIR_DOMAIN_NET_TYPE_MCAST:
+        virBufferAddLit(&buf, "socket");
+        switch (virDomainNetGetActualType(net)) {
+        case VIR_DOMAIN_NET_TYPE_CLIENT:
+            virBufferAsprintf(&buf, "%cconnect=%s:%d",
+                              type_sep,
+                              net->data.socket.address,
+                              net->data.socket.port);
+            break;
+        case VIR_DOMAIN_NET_TYPE_SERVER:
+            virBufferAsprintf(&buf, "%clisten=%s:%d",
+                              type_sep,
+                              net->data.socket.address,
+                              net->data.socket.port);
+            break;
+        case VIR_DOMAIN_NET_TYPE_MCAST:
+            virBufferAsprintf(&buf, "%cmcast=%s:%d",
+                              type_sep,
+                              net->data.socket.address,
+                              net->data.socket.port);
+            break;
+        case VIR_DOMAIN_NET_TYPE_USER:
+        case VIR_DOMAIN_NET_TYPE_ETHERNET:
+        case VIR_DOMAIN_NET_TYPE_NETWORK:
+        case VIR_DOMAIN_NET_TYPE_BRIDGE:
+        case VIR_DOMAIN_NET_TYPE_INTERNAL:
+        case VIR_DOMAIN_NET_TYPE_DIRECT:
+        case VIR_DOMAIN_NET_TYPE_LAST:
+            break;
+        }
+        type_sep = ',';
+        break;
+
+    case VIR_DOMAIN_NET_TYPE_USER:
+    default:
+        virBufferAddLit(&buf, "user");
+        break;
+    }
+
+    if (vlan >= 0) {
+        virBufferAsprintf(&buf, "%cvlan=%d", type_sep, vlan);
+        if (net->info.alias)
+            virBufferAsprintf(&buf, ",name=host%s",
+                              net->info.alias);
+    } else {
+        virBufferAsprintf(&buf, "%cid=host%s",
+                          type_sep, net->info.alias);
+    }
+
+    if (is_tap) {
+        if (vhostfd && *vhostfd)
+            virBufferAsprintf(&buf, ",vhost=on,vhostfd=%s", vhostfd);
+        if (net->tune.sndbuf_specified)
+            virBufferAsprintf(&buf, ",sndbuf=%lu", net->tune.sndbuf);
+    }
+
+    if (virBufferError(&buf)) {
+        virBufferFreeAndReset(&buf);
+        virReportOOMError();
+        return NULL;
+    }
+
+    return virBufferContentAndReset(&buf);
+}
+
+
+char *
+qemuBuildWatchdogDevStr(virDomainWatchdogDefPtr dev,
+                        virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    const char *model = virDomainWatchdogModelTypeToString(dev->model);
+    if (!model) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        "%s", _("missing watchdog model"));
+        goto error;
+    }
+
+    virBufferAsprintf(&buf, "%s,id=%s", model, dev->info.alias);
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildMemballoonDevStr(virDomainMemballoonDefPtr dev,
+                          virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    virBufferAddLit(&buf, "virtio-balloon-pci");
+    virBufferAsprintf(&buf, ",id=%s", dev->info.alias);
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildUSBInputDevStr(virDomainInputDefPtr dev,
+                        virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    virBufferAsprintf(&buf, "%s,id=%s",
+                      dev->type == VIR_DOMAIN_INPUT_TYPE_MOUSE ?
+                      "usb-mouse" : "usb-tablet", dev->info.alias);
+
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildSoundDevStr(virDomainSoundDefPtr sound,
+                     virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    const char *model = virDomainSoundModelTypeToString(sound->model);
+
+    if (!model) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        "%s", _("invalid sound model"));
+        goto error;
+    }
+
+    /* Hack for weirdly unusual devices name in QEMU */
+    if (STREQ(model, "es1370"))
+        model = "ES1370";
+    else if (STREQ(model, "ac97"))
+        model = "AC97";
+    else if (STREQ(model, "ich6"))
+        model = "intel-hda";
+
+    virBufferAsprintf(&buf, "%s,id=%s", model, sound->info.alias);
+    if (qemuBuildDeviceAddressStr(&buf, &sound->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+static char *
+qemuBuildSoundCodecStr(virDomainSoundDefPtr sound,
+                       const char *codec)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    int cad = 0;
+
+    virBufferAsprintf(&buf, "%s,id=%s-codec%d,bus=%s.0,cad=%d",
+                      codec, sound->info.alias, cad, sound->info.alias, cad);
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+static char *
+qemuBuildVideoDevStr(virDomainVideoDefPtr video,
+                     virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    const char *model = qemuVideoTypeToString(video->type);
+
+    if (!model) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        "%s", _("invalid video model"));
+        goto error;
+    }
+
+    virBufferAsprintf(&buf, "%s,id=%s", model, video->info.alias);
+
+    if (video->type == VIR_DOMAIN_VIDEO_TYPE_QXL) {
+        if (video->vram > (UINT_MAX / 1024)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("value for 'vram' must be less than '%u'"),
+                            UINT_MAX / 1024);
+            goto error;
+        }
+
+        /* QEMU accepts bytes for vram_size. */
+        virBufferAsprintf(&buf, ",vram_size=%u", video->vram * 1024);
+    }
+
+    if (qemuBuildDeviceAddressStr(&buf, &video->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+int
+qemuOpenPCIConfig(virDomainHostdevDefPtr dev)
+{
+    char *path = NULL;
+    int configfd = -1;
+
+    if (virAsprintf(&path, "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/config",
+                    dev->source.subsys.u.pci.domain,
+                    dev->source.subsys.u.pci.bus,
+                    dev->source.subsys.u.pci.slot,
+                    dev->source.subsys.u.pci.function) < 0) {
+        virReportOOMError();
+        return -1;
+    }
+
+    configfd = open(path, O_RDWR, 0);
+
+    if (configfd < 0)
+        virReportSystemError(errno, _("Failed opening %s"), path);
+
+    VIR_FREE(path);
+
+    return configfd;
+}
+
+char *
+qemuBuildPCIHostdevDevStr(virDomainHostdevDefPtr dev, const char *configfd,
+                          virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    virBufferAddLit(&buf, "pci-assign");
+    virBufferAsprintf(&buf, ",host=%.2x:%.2x.%.1x",
+                      dev->source.subsys.u.pci.bus,
+                      dev->source.subsys.u.pci.slot,
+                      dev->source.subsys.u.pci.function);
+    virBufferAsprintf(&buf, ",id=%s", dev->info.alias);
+    if (configfd && *configfd)
+        virBufferAsprintf(&buf, ",configfd=%s", configfd);
+    if (dev->bootIndex)
+        virBufferAsprintf(&buf, ",bootindex=%d", dev->bootIndex);
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (dev->rombar) {
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_PCI_ROMBAR)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            "%s", _("rombar not supported in this QEMU binary"));
+            goto error;
+        }
+
+        switch (dev->rombar) {
+        case VIR_DOMAIN_PCI_ROMBAR_OFF:
+            virBufferAddLit(&buf, ",rombar=0");
+            break;
+        case VIR_DOMAIN_PCI_ROMBAR_ON:
+            virBufferAddLit(&buf, ",rombar=1");
+            break;
+        default:
+            break;
+        }
+    }
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildPCIHostdevPCIDevStr(virDomainHostdevDefPtr dev)
+{
+    char *ret = NULL;
+
+    if (virAsprintf(&ret, "host=%.2x:%.2x.%.1x",
+                    dev->source.subsys.u.pci.bus,
+                    dev->source.subsys.u.pci.slot,
+                    dev->source.subsys.u.pci.function) < 0)
+        virReportOOMError();
+
+    return ret;
+}
+
+
+char *
+qemuBuildRedirdevDevStr(virDomainRedirdevDefPtr dev,
+                        virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    if (dev->bus != VIR_DOMAIN_REDIRDEV_BUS_USB) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("Redirection bus %s is not supported by QEMU"),
+                        virDomainRedirdevBusTypeToString(dev->bus));
+        goto error;
+    }
+
+    if (!qemuCapsGet(qemuCaps, QEMU_CAPS_USB_REDIR)) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("USB redirection is not supported "
+                          "by this version of QEMU"));
+        goto error;
+    }
+
+    virBufferAsprintf(&buf, "usb-redir,chardev=char%s,id=%s",
+                      dev->info.alias,
+                      dev->info.alias);
+
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+char *
+qemuBuildUSBHostdevDevStr(virDomainHostdevDefPtr dev,
+                          virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    if (!dev->source.subsys.u.usb.bus &&
+        !dev->source.subsys.u.usb.device) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                        _("USB host device is missing bus/device information"));
+        return NULL;
+    }
+
+    virBufferAsprintf(&buf, "usb-host,hostbus=%d,hostaddr=%d,id=%s",
+                      dev->source.subsys.u.usb.bus,
+                      dev->source.subsys.u.usb.device,
+                      dev->info.alias);
+
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildHubDevStr(virDomainHubDefPtr dev,
+                   virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    if (dev->type != VIR_DOMAIN_HUB_TYPE_USB) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("hub type %s not supported"),
+                        virDomainHubTypeToString(dev->type));
+        goto error;
+    }
+
+    if (!qemuCapsGet(qemuCaps, QEMU_CAPS_USB_HUB)) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("usb-hub not supported by QEMU binary"));
+        goto error;
+    }
+
+    virBufferAddLit(&buf, "usb-hub");
+    virBufferAsprintf(&buf, ",id=%s", dev->info.alias);
+    if (qemuBuildDeviceAddressStr(&buf, &dev->info, qemuCaps) < 0)
+        goto error;
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+char *
+qemuBuildUSBHostdevUsbDevStr(virDomainHostdevDefPtr dev)
+{
+    char *ret = NULL;
+
+    if (!dev->source.subsys.u.usb.bus &&
+        !dev->source.subsys.u.usb.device) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                        _("USB host device is missing bus/device information"));
+        return NULL;
+    }
+
+    if (virAsprintf(&ret, "host:%d.%d",
+                    dev->source.subsys.u.usb.bus,
+                    dev->source.subsys.u.usb.device) < 0)
+        virReportOOMError();
+
+    return ret;
+}
+
+
+
+/* This function outputs a -chardev command line option which describes only the
+ * host side of the character device */
+static char *
+qemuBuildChrChardevStr(virDomainChrSourceDefPtr dev, const char *alias,
+                       virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    bool telnet;
+
+    switch(dev->type) {
+    case VIR_DOMAIN_CHR_TYPE_NULL:
+        virBufferAsprintf(&buf, "null,id=char%s", alias);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_VC:
+        virBufferAsprintf(&buf, "vc,id=char%s", alias);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_PTY:
+        virBufferAsprintf(&buf, "pty,id=char%s", alias);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_DEV:
+        virBufferAsprintf(&buf, "tty,id=char%s,path=%s", alias,
+                          dev->data.file.path);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_FILE:
+        virBufferAsprintf(&buf, "file,id=char%s,path=%s", alias,
+                          dev->data.file.path);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_PIPE:
+        virBufferAsprintf(&buf, "pipe,id=char%s,path=%s", alias,
+                          dev->data.file.path);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_STDIO:
+        virBufferAsprintf(&buf, "stdio,id=char%s", alias);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_UDP: {
+        const char *connectHost = dev->data.udp.connectHost;
+        const char *bindHost = dev->data.udp.bindHost;
+        const char *bindService = dev->data.udp.bindService;
+
+        if (connectHost == NULL)
+            connectHost = "";
+        if (bindHost == NULL)
+            bindHost = "";
+        if (bindService == NULL)
+            bindService = "0";
+
+        virBufferAsprintf(&buf,
+                          "udp,id=char%s,host=%s,port=%s,localaddr=%s,"
+                          "localport=%s",
+                          alias,
+                          connectHost,
+                          dev->data.udp.connectService,
+                          bindHost, bindService);
+        break;
+    }
+    case VIR_DOMAIN_CHR_TYPE_TCP:
+        telnet = dev->data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET;
+        virBufferAsprintf(&buf,
+                          "socket,id=char%s,host=%s,port=%s%s%s",
+                          alias,
+                          dev->data.tcp.host,
+                          dev->data.tcp.service,
+                          telnet ? ",telnet" : "",
+                          dev->data.tcp.listen ? ",server,nowait" : "");
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_UNIX:
+        virBufferAsprintf(&buf,
+                          "socket,id=char%s,path=%s%s",
+                          alias,
+                          dev->data.nix.path,
+                          dev->data.nix.listen ? ",server,nowait" : "");
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_SPICEVMC:
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV_SPICEVMC)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("spicevmc not supported in this QEMU binary"));
+            goto error;
+        }
+        virBufferAsprintf(&buf, "spicevmc,id=char%s,name=%s", alias,
+                          virDomainChrSpicevmcTypeToString(dev->data.spicevmc));
+        break;
+
+    default:
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("unsupported chardev '%s'"),
+                        virDomainChrTypeToString(dev->type));
+        goto error;
+    }
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+static char *
+qemuBuildChrArgStr(virDomainChrSourceDefPtr dev, const char *prefix)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    if (prefix)
+        virBufferAdd(&buf, prefix, strlen(prefix));
+
+    switch (dev->type) {
+    case VIR_DOMAIN_CHR_TYPE_NULL:
+        virBufferAddLit(&buf, "null");
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_VC:
+        virBufferAddLit(&buf, "vc");
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_PTY:
+        virBufferAddLit(&buf, "pty");
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_DEV:
+        virBufferStrcat(&buf, dev->data.file.path, NULL);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_FILE:
+        virBufferAsprintf(&buf, "file:%s", dev->data.file.path);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_PIPE:
+        virBufferAsprintf(&buf, "pipe:%s", dev->data.file.path);
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_STDIO:
+        virBufferAddLit(&buf, "stdio");
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_UDP: {
+        const char *connectHost = dev->data.udp.connectHost;
+        const char *bindHost = dev->data.udp.bindHost;
+        const char *bindService  = dev->data.udp.bindService;
+
+        if (connectHost == NULL)
+            connectHost = "";
+        if (bindHost == NULL)
+            bindHost = "";
+        if (bindService == NULL)
+            bindService = "0";
+
+        virBufferAsprintf(&buf, "udp:%s:%s@%s:%s",
+                          connectHost,
+                          dev->data.udp.connectService,
+                          bindHost,
+                          bindService);
+        break;
+    }
+    case VIR_DOMAIN_CHR_TYPE_TCP:
+        if (dev->data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET) {
+            virBufferAsprintf(&buf, "telnet:%s:%s%s",
+                              dev->data.tcp.host,
+                              dev->data.tcp.service,
+                              dev->data.tcp.listen ? ",server,nowait" : "");
+        } else {
+            virBufferAsprintf(&buf, "tcp:%s:%s%s",
+                              dev->data.tcp.host,
+                              dev->data.tcp.service,
+                              dev->data.tcp.listen ? ",server,nowait" : "");
+        }
+        break;
+
+    case VIR_DOMAIN_CHR_TYPE_UNIX:
+        virBufferAsprintf(&buf, "unix:%s%s",
+                          dev->data.nix.path,
+                          dev->data.nix.listen ? ",server,nowait" : "");
+        break;
+    }
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+static char *
+qemuBuildVirtioSerialPortDevStr(virDomainChrDefPtr dev,
+                                virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    switch (dev->deviceType) {
+    case VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE:
+        virBufferAddLit(&buf, "virtconsole");
+        break;
+    case VIR_DOMAIN_CHR_DEVICE_TYPE_CHANNEL:
+        /* Legacy syntax  '-device spicevmc' */
+        if (dev->source.type == VIR_DOMAIN_CHR_TYPE_SPICEVMC &&
+            qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE_SPICEVMC)) {
+            virBufferAddLit(&buf, "spicevmc");
+        } else {
+            virBufferAddLit(&buf, "virtserialport");
+        }
+        break;
+    default:
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("Cannot use virtio serial for parallel/serial devices"));
+        return NULL;
+    }
+
+    if (dev->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE) {
+        /* Check it's a virtio-serial address */
+        if (dev->info.type !=
+            VIR_DOMAIN_DEVICE_ADDRESS_TYPE_VIRTIO_SERIAL)
+        {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            "%s", _("virtio serial device has invalid address type"));
+            goto error;
+        }
+
+        virBufferAsprintf(&buf,
+                          ",bus=" QEMU_VIRTIO_SERIAL_PREFIX "%d.%d",
+                          dev->info.addr.vioserial.controller,
+                          dev->info.addr.vioserial.bus);
+        virBufferAsprintf(&buf,
+                          ",nr=%d",
+                          dev->info.addr.vioserial.port);
+    }
+
+    if (dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CHANNEL &&
+        dev->source.type == VIR_DOMAIN_CHR_TYPE_SPICEVMC &&
+        dev->target.name &&
+        STRNEQ(dev->target.name, "com.redhat.spice.0")) {
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("Unsupported spicevmc target name '%s'"),
+                        dev->target.name);
+        goto error;
+    }
+
+    if (!(dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CHANNEL &&
+          dev->source.type == VIR_DOMAIN_CHR_TYPE_SPICEVMC &&
+          qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE_SPICEVMC))) {
+        virBufferAsprintf(&buf, ",chardev=char%s,id=%s",
+                          dev->info.alias, dev->info.alias);
+        if (dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CHANNEL &&
+            dev->target.name) {
+            virBufferAsprintf(&buf, ",name=%s", dev->target.name);
+        }
+    } else {
+        virBufferAsprintf(&buf, ",id=%s", dev->info.alias);
+    }
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+static char *qemuBuildSmbiosBiosStr(virSysinfoDefPtr def)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    if ((def->bios_vendor == NULL) && (def->bios_version == NULL) &&
+        (def->bios_date == NULL) && (def->bios_release == NULL))
+        return(NULL);
+
+    virBufferAddLit(&buf, "type=0");
+
+    /* 0:Vendor */
+    if (def->bios_vendor)
+        virBufferAsprintf(&buf, ",vendor=%s", def->bios_vendor);
+    /* 0:BIOS Version */
+    if (def->bios_version)
+        virBufferAsprintf(&buf, ",version=%s", def->bios_version);
+    /* 0:BIOS Release Date */
+    if (def->bios_date)
+        virBufferAsprintf(&buf, ",date=%s", def->bios_date);
+    /* 0:System BIOS Major Release and 0:System BIOS Minor Release */
+    if (def->bios_release)
+        virBufferAsprintf(&buf, ",release=%s", def->bios_release);
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return(NULL);
+}
+
+static char *qemuBuildSmbiosSystemStr(virSysinfoDefPtr def, bool skip_uuid)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    if ((def->system_manufacturer == NULL) && (def->system_sku == NULL) &&
+        (def->system_product == NULL) && (def->system_version == NULL) &&
+        (def->system_serial == NULL) && (def->system_family == NULL) &&
+        (def->system_uuid == NULL || skip_uuid))
+        return NULL;
+
+    virBufferAddLit(&buf, "type=1");
+
+    /* 1:Manufacturer */
+    if (def->system_manufacturer)
+        virBufferAsprintf(&buf, ",manufacturer=%s",
+                          def->system_manufacturer);
+     /* 1:Product Name */
+    if (def->system_product)
+        virBufferAsprintf(&buf, ",product=%s", def->system_product);
+    /* 1:Version */
+    if (def->system_version)
+        virBufferAsprintf(&buf, ",version=%s", def->system_version);
+    /* 1:Serial Number */
+    if (def->system_serial)
+        virBufferAsprintf(&buf, ",serial=%s", def->system_serial);
+    /* 1:UUID */
+    if (def->system_uuid && !skip_uuid)
+        virBufferAsprintf(&buf, ",uuid=%s", def->system_uuid);
+    /* 1:SKU Number */
+    if (def->system_sku)
+        virBufferAsprintf(&buf, ",sku=%s", def->system_sku);
+    /* 1:Family */
+    if (def->system_family)
+        virBufferAsprintf(&buf, ",family=%s", def->system_family);
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return(NULL);
+}
+
+static char *
+qemuBuildClockArgStr(virDomainClockDefPtr def)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    switch (def->offset) {
+    case VIR_DOMAIN_CLOCK_OFFSET_UTC:
+        virBufferAddLit(&buf, "base=utc");
+        break;
+
+    case VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME:
+    case VIR_DOMAIN_CLOCK_OFFSET_TIMEZONE:
+        virBufferAddLit(&buf, "base=localtime");
+        break;
+
+    case VIR_DOMAIN_CLOCK_OFFSET_VARIABLE: {
+        time_t now = time(NULL);
+        struct tm nowbits;
+
+        now += def->data.adjustment;
+        gmtime_r(&now, &nowbits);
+
+        virBufferAsprintf(&buf, "base=%d-%02d-%02dT%02d:%02d:%02d",
+                          nowbits.tm_year + 1900,
+                          nowbits.tm_mon + 1,
+                          nowbits.tm_mday,
+                          nowbits.tm_hour,
+                          nowbits.tm_min,
+                          nowbits.tm_sec);
+    }   break;
+
+    default:
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("unsupported clock offset '%s'"),
+                        virDomainClockOffsetTypeToString(def->offset));
+        goto error;
+    }
+
+    /* Look for an 'rtc' timer element, and add in appropriate clock= and driftfix= */
+    int i;
+    for (i = 0; i < def->ntimers; i++) {
+        if (def->timers[i]->name == VIR_DOMAIN_TIMER_NAME_RTC) {
+            switch (def->timers[i]->track) {
+            case -1: /* unspecified - use hypervisor default */
+                break;
+            case VIR_DOMAIN_TIMER_TRACK_BOOT:
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                _("unsupported rtc timer track '%s'"),
+                                virDomainTimerTrackTypeToString(def->timers[i]->track));
+                goto error;
+            case VIR_DOMAIN_TIMER_TRACK_GUEST:
+                virBufferAddLit(&buf, ",clock=vm");
+                break;
+            case VIR_DOMAIN_TIMER_TRACK_WALL:
+                virBufferAddLit(&buf, ",clock=host");
+                break;
+            }
+
+            switch (def->timers[i]->tickpolicy) {
+            case -1:
+            case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY:
+                /* This is the default - missed ticks delivered when
+                   next scheduled, at normal rate */
+                break;
+            case VIR_DOMAIN_TIMER_TICKPOLICY_CATCHUP:
+                /* deliver ticks at a faster rate until caught up */
+                virBufferAddLit(&buf, ",driftfix=slew");
+                break;
+            case VIR_DOMAIN_TIMER_TICKPOLICY_MERGE:
+            case VIR_DOMAIN_TIMER_TICKPOLICY_DISCARD:
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                _("unsupported rtc timer tickpolicy '%s'"),
+                                virDomainTimerTickpolicyTypeToString(def->timers[i]->tickpolicy));
+                goto error;
+            }
+            break; /* no need to check other timers - there is only one rtc */
+        }
+    }
+
+    if (virBufferError(&buf)) {
+        virReportOOMError();
+        goto error;
+    }
+
+    return virBufferContentAndReset(&buf);
+
+error:
+    virBufferFreeAndReset(&buf);
+    return NULL;
+}
+
+
+static int
+qemuBuildCpuArgStr(const struct qemud_driver *driver,
+                   const virDomainDefPtr def,
+                   const char *emulator,
+                   virBitmapPtr qemuCaps,
+                   const struct utsname *ut,
+                   char **opt,
+                   bool *hasHwVirt)
+{
+    const virCPUDefPtr host = driver->caps->host.cpu;
+    virCPUDefPtr guest = NULL;
+    unsigned int ncpus = 0;
+    const char **cpus = NULL;
+    union cpuData *data = NULL;
+    int ret = -1;
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    int i;
+
+    *hasHwVirt = false;
+
+    if (def->cpu && def->cpu->model) {
+        if (host &&
+            qemuCapsProbeCPUModels(emulator, qemuCaps, host->arch,
+                                   &ncpus, &cpus) < 0)
+            goto cleanup;
+
+        if (!ncpus || !host) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("CPU specification not supported by hypervisor"));
+            goto cleanup;
+        }
+    }
+
+    if (ncpus > 0 && host) {
+        virCPUCompareResult cmp;
+        const char *preferred;
+        int hasSVM;
+
+        cmp = cpuGuestData(host, def->cpu, &data);
+        switch (cmp) {
+        case VIR_CPU_COMPARE_INCOMPATIBLE:
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            "%s", _("guest CPU is not compatible with host CPU"));
+            /* fall through */
+        case VIR_CPU_COMPARE_ERROR:
+            goto cleanup;
+
+        default:
+            break;
+        }
+
+        if (VIR_ALLOC(guest) < 0 || !(guest->arch = strdup(host->arch)))
+            goto no_memory;
+
+        if (def->cpu->match == VIR_CPU_MATCH_MINIMUM)
+            preferred = host->model;
+        else
+            preferred = def->cpu->model;
+
+        guest->type = VIR_CPU_TYPE_GUEST;
+        if (cpuDecode(guest, data, cpus, ncpus, preferred) < 0)
+            goto cleanup;
+
+        /* Only 'svm' requires --enable-nesting. The nested
+         * 'vmx' patches now simply hook off the CPU features
+         */
+        hasSVM = cpuHasFeature(guest->arch, data, "svm");
+        if (hasSVM < 0)
+            goto cleanup;
+        *hasHwVirt = hasSVM > 0 ? true : false;
+
+        virBufferAdd(&buf, guest->model, -1);
+        for (i = 0; i < guest->nfeatures; i++) {
+            char sign;
+            if (guest->features[i].policy == VIR_CPU_FEATURE_DISABLE)
+                sign = '-';
+            else
+                sign = '+';
+
+            virBufferAsprintf(&buf, ",%c%s", sign, guest->features[i].name);
+        }
+    }
+    else {
+        /*
+         * Need to force a 32-bit guest CPU type if
+         *
+         *  1. guest OS is i686
+         *  2. host OS is x86_64
+         *  3. emulator is qemu-kvm or kvm
+         *
+         * Or
+         *
+         *  1. guest OS is i686
+         *  2. emulator is qemu-system-x86_64
+         */
+        if (STREQ(def->os.arch, "i686") &&
+            ((STREQ(ut->machine, "x86_64") &&
+              strstr(emulator, "kvm")) ||
+             strstr(emulator, "x86_64")))
+            virBufferAddLit(&buf, "qemu32");
+    }
+
+    if (virBufferError(&buf))
+        goto no_memory;
+
+    *opt = virBufferContentAndReset(&buf);
+
+    ret = 0;
+
+cleanup:
+    if (guest)
+        cpuDataFree(guest->arch, data);
+    virCPUDefFree(guest);
+
+    if (cpus) {
+        for (i = 0; i < ncpus; i++)
+            VIR_FREE(cpus[i]);
+        VIR_FREE(cpus);
+    }
+
+    return ret;
+
+no_memory:
+    virReportOOMError();
+    goto cleanup;
+}
+
+static char *
+qemuBuildSmpArgStr(const virDomainDefPtr def,
+                   virBitmapPtr qemuCaps)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    virBufferAsprintf(&buf, "%u", def->vcpus);
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_SMP_TOPOLOGY)) {
+        if (def->vcpus != def->maxvcpus)
+            virBufferAsprintf(&buf, ",maxcpus=%u", def->maxvcpus);
+        /* sockets, cores, and threads are either all zero
+         * or all non-zero, thus checking one of them is enough */
+        if (def->cpu && def->cpu->sockets) {
+            virBufferAsprintf(&buf, ",sockets=%u", def->cpu->sockets);
+            virBufferAsprintf(&buf, ",cores=%u", def->cpu->cores);
+            virBufferAsprintf(&buf, ",threads=%u", def->cpu->threads);
+        }
+        else {
+            virBufferAsprintf(&buf, ",sockets=%u", def->maxvcpus);
+            virBufferAsprintf(&buf, ",cores=%u", 1);
+            virBufferAsprintf(&buf, ",threads=%u", 1);
+        }
+    } else if (def->vcpus != def->maxvcpus) {
+        virBufferFreeAndReset(&buf);
+        /* FIXME - consider hot-unplugging cpus after boot for older qemu */
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                        _("setting current vcpu count less than maximum is "
+                          "not supported with this QEMU binary"));
+        return NULL;
+    }
+
+    if (virBufferError(&buf)) {
+        virBufferFreeAndReset(&buf);
+        virReportOOMError();
+        return NULL;
+    }
+
+    return virBufferContentAndReset(&buf);
+}
+
+static void
+qemuBuildNumaCPUArgStr(char *cpumask, virBufferPtr buf)
+{
+    int i, first, last;
+    int cpuSet = 0;
+
+    first = last = 0;
+    for (i = 0; i < VIR_DOMAIN_CPUMASK_LEN; i++) {
+        if (cpumask[i]) {
+            if (cpuSet) {
+                last = i;
+            } else {
+                first = last = i;
+                cpuSet = 1;
+            }
+        } else {
+            if (!cpuSet)
+                continue;
+            if (first == last)
+                virBufferAsprintf(buf, "%d,", first);
+            else
+                virBufferAsprintf(buf, "%d-%d,", first, last);
+            cpuSet = 0;
+        }
+    }
+
+    if (cpuSet) {
+        if (first == last)
+            virBufferAsprintf(buf, "%d,", first);
+        else
+            virBufferAsprintf(buf, "%d-%d,", first, last);
+    }
+}
+
+static int
+qemuBuildNumaArgStr(const virDomainDefPtr def, virCommandPtr cmd)
+{
+    int i;
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+    for (i = 0; i < def->cpu->ncells; i++) {
+        virCommandAddArg(cmd, "-numa");
+        virBufferAsprintf(&buf, "node,nodeid=%d", def->cpu->cells[i].cellid);
+        virBufferAddLit(&buf, ",cpus=");
+        qemuBuildNumaCPUArgStr(def->cpu->cells[i].cpumask, &buf);
+        virBufferAsprintf(&buf, "mem=%d",
+            VIR_DIV_UP(def->cpu->cells[i].mem, 1024));
+
+        if (virBufferError(&buf))
+            goto error;
+
+        virCommandAddArgBuffer(cmd, &buf);
+    }
+    return 0;
+
+error:
+    virBufferFreeAndReset(&buf);
+    virReportOOMError();
+    return -1;
+}
+
+/*
+ * Constructs a argv suitable for launching qemu with config defined
+ * for a given virtual machine.
+ *
+ * XXX 'conn' is only required to resolve network -> bridge name
+ * figure out how to remove this requirement some day
+ */
+virCommandPtr
+qemuBuildCommandLine(virConnectPtr conn,
+                     struct qemud_driver *driver,
+                     virDomainDefPtr def,
+                     virDomainChrSourceDefPtr monitor_chr,
+                     bool monitor_json,
+                     virBitmapPtr qemuCaps,
+                     const char *migrateFrom,
+                     int migrateFd,
+                     virDomainSnapshotObjPtr snapshot,
+                     enum virNetDevVPortProfileOp vmop)
+{
+    int i;
+    struct utsname ut;
+    int disableKQEMU = 0;
+    int enableKQEMU = 0;
+    int disableKVM = 0;
+    int enableKVM = 0;
+    const char *emulator;
+    char uuid[VIR_UUID_STRING_BUFLEN];
+    char *cpu;
+    char *smp;
+    int last_good_net = -1;
+    bool hasHwVirt = false;
+    virCommandPtr cmd;
+    bool emitBootindex = false;
+    int usbcontroller = 0;
+    bool usblegacy = false;
+    uname_normalize(&ut);
+
+    virUUIDFormat(def->uuid, uuid);
+
+    emulator = def->emulator;
+
+    /*
+     * do not use boot=on for drives when not using KVM since this
+     * is not supported at all in upstream QEmu.
+     */
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_KVM) &&
+        (def->virtType == VIR_DOMAIN_VIRT_QEMU))
+        qemuCapsClear(qemuCaps, QEMU_CAPS_DRIVE_BOOT);
+
+    switch (def->virtType) {
+    case VIR_DOMAIN_VIRT_QEMU:
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_KQEMU))
+            disableKQEMU = 1;
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_KVM))
+            disableKVM = 1;
+        break;
+
+    case VIR_DOMAIN_VIRT_KQEMU:
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_KVM))
+            disableKVM = 1;
+
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_ENABLE_KQEMU)) {
+            enableKQEMU = 1;
+        } else if (!qemuCapsGet(qemuCaps, QEMU_CAPS_KQEMU)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("the QEMU binary %s does not support kqemu"),
+                            emulator);
+        }
+        break;
+
+    case VIR_DOMAIN_VIRT_KVM:
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_KQEMU))
+            disableKQEMU = 1;
+
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_ENABLE_KVM)) {
+            enableKVM = 1;
+        } else if (!qemuCapsGet(qemuCaps, QEMU_CAPS_KVM)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("the QEMU binary %s does not support kvm"),
+                            emulator);
+        }
+        break;
+
+    case VIR_DOMAIN_VIRT_XEN:
+        /* XXX better check for xenner */
+        break;
+
+    default:
+        qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("the QEMU binary %s does not support %s"),
+                        emulator, virDomainVirtTypeToString(def->virtType));
+        break;
+    }
+
+    cmd = virCommandNewArgList(emulator, "-S", NULL);
+
+    virCommandAddEnvPassCommon(cmd);
+
+    /* This should *never* be NULL, since we always provide
+     * a machine in the capabilities data for QEMU. So this
+     * check is just here as a safety in case the unexpected
+     * happens */
+    if (def->os.machine)
+        virCommandAddArgList(cmd, "-M", def->os.machine, NULL);
+
+    if (qemuBuildCpuArgStr(driver, def, emulator, qemuCaps,
+                           &ut, &cpu, &hasHwVirt) < 0)
+        goto error;
+
+    if (cpu) {
+        virCommandAddArgList(cmd, "-cpu", cpu, NULL);
+        VIR_FREE(cpu);
+
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_NESTING) &&
+            hasHwVirt)
+            virCommandAddArg(cmd, "-enable-nesting");
+    }
+
+    if (disableKQEMU)
+        virCommandAddArg(cmd, "-no-kqemu");
+    else if (enableKQEMU)
+        virCommandAddArgList(cmd, "-enable-kqemu", "-kernel-kqemu", NULL);
+    if (disableKVM)
+        virCommandAddArg(cmd, "-no-kvm");
+    if (enableKVM)
+        virCommandAddArg(cmd, "-enable-kvm");
+
+    /* Set '-m MB' based on maxmem, because the lower 'memory' limit
+     * is set post-startup using the balloon driver. If balloon driver
+     * is not supported, then they're out of luck anyway
+     */
+    virCommandAddArg(cmd, "-m");
+    virCommandAddArgFormat(cmd, "%lu", VIR_DIV_UP(def->mem.max_balloon, 1024));
+    if (def->mem.hugepage_backed) {
+        if (!driver->hugetlbfs_mount) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            "%s", _("hugetlbfs filesystem is not mounted"));
+            goto error;
+        }
+        if (!driver->hugepage_path) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            "%s", _("hugepages are disabled by administrator config"));
+            goto error;
+        }
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_MEM_PATH)) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("hugepage backing not supported by '%s'"),
+                            def->emulator);
+            goto error;
+        }
+        virCommandAddArgList(cmd, "-mem-prealloc", "-mem-path",
+                             driver->hugepage_path, NULL);
+    }
+
+    virCommandAddArg(cmd, "-smp");
+    if (!(smp = qemuBuildSmpArgStr(def, qemuCaps)))
+        goto error;
+    virCommandAddArg(cmd, smp);
+    VIR_FREE(smp);
+
+    if (def->cpu && def->cpu->ncells)
+        if (qemuBuildNumaArgStr(def, cmd) < 0)
+            goto error;
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_NAME)) {
+        virCommandAddArg(cmd, "-name");
+        if (driver->setProcessName &&
+            qemuCapsGet(qemuCaps, QEMU_CAPS_NAME_PROCESS)) {
+            virCommandAddArgFormat(cmd, "%s,process=qemu:%s",
+                                   def->name, def->name);
+        } else {
+            virCommandAddArg(cmd, def->name);
+        }
+    }
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_UUID))
+        virCommandAddArgList(cmd, "-uuid", uuid, NULL);
+    if (def->virtType == VIR_DOMAIN_VIRT_XEN ||
+        STREQ(def->os.type, "xen") ||
+        STREQ(def->os.type, "linux")) {
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_DOMID)) {
+            virCommandAddArg(cmd, "-domid");
+            virCommandAddArgFormat(cmd, "%d", def->id);
+        } else if (qemuCapsGet(qemuCaps, QEMU_CAPS_XEN_DOMID)) {
+            virCommandAddArg(cmd, "-xen-attach");
+            virCommandAddArg(cmd, "-xen-domid");
+            virCommandAddArgFormat(cmd, "%d", def->id);
+        } else {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("qemu emulator '%s' does not support xen"),
+                            def->emulator);
+            goto error;
+        }
+    }
+
+    if ((def->os.smbios_mode != VIR_DOMAIN_SMBIOS_NONE) &&
+        (def->os.smbios_mode != VIR_DOMAIN_SMBIOS_EMULATE)) {
+        virSysinfoDefPtr source = NULL;
+        bool skip_uuid = false;
+
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SMBIOS_TYPE)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                    _("the QEMU binary %s does not support smbios settings"),
+                            emulator);
+            goto error;
+        }
+
+        /* should we really error out or just warn in those cases ? */
+        if (def->os.smbios_mode == VIR_DOMAIN_SMBIOS_HOST) {
+            if (driver->hostsysinfo == NULL) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("Host SMBIOS information is not available"));
+                goto error;
+            }
+            source = driver->hostsysinfo;
+            /* Host and guest uuid must differ, by definition of UUID. */
+            skip_uuid = true;
+        } else if (def->os.smbios_mode == VIR_DOMAIN_SMBIOS_SYSINFO) {
+            if (def->sysinfo == NULL) {
+                qemuReportError(VIR_ERR_XML_ERROR,
+                            _("Domain '%s' sysinfo are not available"),
+                               def->name);
+                goto error;
+            }
+            source = def->sysinfo;
+            /* domain_conf guaranteed that system_uuid matches guest uuid. */
+        }
+        if (source != NULL) {
+            char *smbioscmd;
+
+            smbioscmd = qemuBuildSmbiosBiosStr(source);
+            if (smbioscmd != NULL) {
+                virCommandAddArgList(cmd, "-smbios", smbioscmd, NULL);
+                VIR_FREE(smbioscmd);
+            }
+            smbioscmd = qemuBuildSmbiosSystemStr(source, skip_uuid);
+            if (smbioscmd != NULL) {
+                virCommandAddArgList(cmd, "-smbios", smbioscmd, NULL);
+                VIR_FREE(smbioscmd);
+            }
+        }
+    }
+
+    /*
+     * NB, -nographic *MUST* come before any serial, or monitor
+     * or parallel port flags due to QEMU craziness, where it
+     * decides to change the serial port & monitor to be on stdout
+     * if you ask for nographic. So we have to make sure we override
+     * these defaults ourselves...
+     */
+    if (!def->graphics)
+        virCommandAddArg(cmd, "-nographic");
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_NODEFCONFIG))
+            virCommandAddArg(cmd,
+                             "-nodefconfig"); /* Disable global config files */
+        virCommandAddArg(cmd,
+                         "-nodefaults");  /* Disable default guest devices */
+    }
+
+    /* Serial graphics adapter */
+    if (def->os.bios.useserial == VIR_DOMAIN_BIOS_USESERIAL_YES) {
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("qemu does not support -device"));
+            goto error;
+        }
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SGA)) {
+            qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                            _("qemu does not support SGA"));
+            goto error;
+        }
+        if (!def->nserials) {
+            qemuReportError(VIR_ERR_XML_ERROR, "%s",
+                            _("need at least one serial port to use SGA"));
+            goto error;
+        }
+        virCommandAddArgList(cmd, "-device", "sga", NULL);
+    }
+
+    if (monitor_chr) {
+        char *chrdev;
+        /* Use -chardev if it's available */
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV)) {
+
+            virCommandAddArg(cmd, "-chardev");
+            if (!(chrdev = qemuBuildChrChardevStr(monitor_chr, "monitor",
+                                                  qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, chrdev);
+            VIR_FREE(chrdev);
+
+            virCommandAddArg(cmd, "-mon");
+            virCommandAddArgFormat(cmd,
+                                   "chardev=charmonitor,id=monitor,mode=%s",
+                                   monitor_json ? "control" : "readline");
+        } else {
+            const char *prefix = NULL;
+            if (monitor_json)
+                prefix = "control,";
+
+            virCommandAddArg(cmd, "-monitor");
+            if (!(chrdev = qemuBuildChrArgStr(monitor_chr, prefix)))
+                goto error;
+            virCommandAddArg(cmd, chrdev);
+            VIR_FREE(chrdev);
+        }
+    }
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_RTC)) {
+        const char *rtcopt;
+        virCommandAddArg(cmd, "-rtc");
+        if (!(rtcopt = qemuBuildClockArgStr(&def->clock)))
+            goto error;
+        virCommandAddArg(cmd, rtcopt);
+        VIR_FREE(rtcopt);
+    } else {
+        switch (def->clock.offset) {
+        case VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME:
+        case VIR_DOMAIN_CLOCK_OFFSET_TIMEZONE:
+            virCommandAddArg(cmd, "-localtime");
+            break;
+
+        case VIR_DOMAIN_CLOCK_OFFSET_UTC:
+            /* Nothing, its the default */
+            break;
+
+        default:
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("unsupported clock offset '%s'"),
+                            virDomainClockOffsetTypeToString(def->clock.offset));
+            goto error;
+        }
+    }
+    if (def->clock.offset == VIR_DOMAIN_CLOCK_OFFSET_TIMEZONE &&
+        def->clock.data.timezone) {
+        virCommandAddEnvPair(cmd, "TZ", def->clock.data.timezone);
+    }
+
+    for (i = 0; i < def->clock.ntimers; i++) {
+        switch (def->clock.timers[i]->name) {
+        default:
+        case VIR_DOMAIN_TIMER_NAME_PLATFORM:
+        case VIR_DOMAIN_TIMER_NAME_TSC:
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("unsupported timer type (name) '%s'"),
+                            virDomainTimerNameTypeToString(def->clock.timers[i]->name));
+            goto error;
+
+        case VIR_DOMAIN_TIMER_NAME_RTC:
+            /* This has already been taken care of (in qemuBuildClockArgStr)
+               if QEMU_CAPS_RTC is set (mutually exclusive with
+               QEMUD_FLAG_RTC_TD_HACK) */
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_RTC_TD_HACK)) {
+                switch (def->clock.timers[i]->tickpolicy) {
+                case -1:
+                case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY:
+                    /* the default - do nothing */
+                    break;
+                case VIR_DOMAIN_TIMER_TICKPOLICY_CATCHUP:
+                    virCommandAddArg(cmd, "-rtc-td-hack");
+                    break;
+                case VIR_DOMAIN_TIMER_TICKPOLICY_MERGE:
+                case VIR_DOMAIN_TIMER_TICKPOLICY_DISCARD:
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    _("unsupported rtc tickpolicy '%s'"),
+                                    virDomainTimerTickpolicyTypeToString(def->clock.timers[i]->tickpolicy));
+                goto error;
+                }
+            } else if (!qemuCapsGet(qemuCaps, QEMU_CAPS_RTC)
+                       && (def->clock.timers[i]->tickpolicy
+                           != VIR_DOMAIN_TIMER_TICKPOLICY_DELAY)
+                       && (def->clock.timers[i]->tickpolicy != -1)) {
+                /* a non-default rtc policy was given, but there is no
+                   way to implement it in this version of qemu */
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                _("unsupported rtc tickpolicy '%s'"),
+                                virDomainTimerTickpolicyTypeToString(def->clock.timers[i]->tickpolicy));
+                goto error;
+            }
+            break;
+
+        case VIR_DOMAIN_TIMER_NAME_PIT:
+            switch (def->clock.timers[i]->tickpolicy) {
+            case -1:
+            case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY:
+                /* delay is the default if we don't have kernel
+                   (-no-kvm-pit), otherwise, the default is catchup. */
+                if (qemuCapsGet(qemuCaps, QEMU_CAPS_NO_KVM_PIT))
+                    virCommandAddArg(cmd, "-no-kvm-pit-reinjection");
+                break;
+            case VIR_DOMAIN_TIMER_TICKPOLICY_CATCHUP:
+                if (qemuCapsGet(qemuCaps, QEMU_CAPS_NO_KVM_PIT)) {
+                    /* do nothing - this is default for kvm-pit */
+                } else if (qemuCapsGet(qemuCaps, QEMU_CAPS_TDF)) {
+                    /* -tdf switches to 'catchup' with userspace pit. */
+                    virCommandAddArg(cmd, "-tdf");
+                } else {
+                    /* can't catchup if we have neither pit mode */
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    _("unsupported pit tickpolicy '%s'"),
+                                    virDomainTimerTickpolicyTypeToString(def->clock.timers[i]->tickpolicy));
+                    goto error;
+                }
+                break;
+            case VIR_DOMAIN_TIMER_TICKPOLICY_MERGE:
+            case VIR_DOMAIN_TIMER_TICKPOLICY_DISCARD:
+                /* no way to support these modes for pit in qemu */
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                _("unsupported pit tickpolicy '%s'"),
+                                virDomainTimerTickpolicyTypeToString(def->clock.timers[i]->tickpolicy));
+                goto error;
+            }
+            break;
+
+        case VIR_DOMAIN_TIMER_NAME_HPET:
+            /* the only meaningful attribute for hpet is "present". If
+             * present is -1, that means it wasn't specified, and
+             * should be left at the default for the
+             * hypervisor. "default" when -no-hpet exists is "yes",
+             * and when -no-hpet doesn't exist is "no". "confusing"?
+             * "yes"! */
+
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_NO_HPET)) {
+                if (def->clock.timers[i]->present == 0)
+                    virCommandAddArg(cmd, "-no-hpet");
+            } else {
+                /* no hpet timer available. The only possible action
+                   is to raise an error if present="yes" */
+                if (def->clock.timers[i]->present == 1) {
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    "%s", _("pit timer is not supported"));
+                }
+            }
+            break;
+        }
+    }
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_NO_REBOOT) &&
+        def->onReboot != VIR_DOMAIN_LIFECYCLE_RESTART)
+        virCommandAddArg(cmd, "-no-reboot");
+
+    /* If JSON monitor is enabled, we can receive an event
+     * when QEMU stops. If we use no-shutdown, then we can
+     * watch for this event and do a soft/warm reboot.
+     */
+    if (monitor_json && qemuCapsGet(qemuCaps, QEMU_CAPS_NO_SHUTDOWN))
+        virCommandAddArg(cmd, "-no-shutdown");
+
+    if (!(def->features & (1 << VIR_DOMAIN_FEATURE_ACPI)))
+        virCommandAddArg(cmd, "-no-acpi");
+
+    if (!def->os.bootloader) {
+        /*
+         * We prefer using explicit bootindex=N parameters for predictable
+         * results even though domain XML doesn't use per device boot elements.
+         * However, we can't use bootindex if boot menu was requested.
+         */
+        if (!def->os.nBootDevs) {
+            /* def->os.nBootDevs is guaranteed to be > 0 unless per-device boot
+             * configuration is used
+             */
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_BOOTINDEX)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("hypervisor lacks deviceboot feature"));
+                goto error;
+            }
+            emitBootindex = true;
+        } else if (qemuCapsGet(qemuCaps, QEMU_CAPS_BOOTINDEX) &&
+                   (def->os.bootmenu != VIR_DOMAIN_BOOT_MENU_ENABLED ||
+                    !qemuCapsGet(qemuCaps, QEMU_CAPS_BOOT_MENU))) {
+            emitBootindex = true;
+        }
+
+        if (!emitBootindex) {
+            virBuffer boot_buf = VIR_BUFFER_INITIALIZER;
+            char boot[VIR_DOMAIN_BOOT_LAST+1];
+
+            for (i = 0 ; i < def->os.nBootDevs ; i++) {
+                switch (def->os.bootDevs[i]) {
+                case VIR_DOMAIN_BOOT_CDROM:
+                    boot[i] = 'd';
+                    break;
+                case VIR_DOMAIN_BOOT_FLOPPY:
+                    boot[i] = 'a';
+                    break;
+                case VIR_DOMAIN_BOOT_DISK:
+                    boot[i] = 'c';
+                    break;
+                case VIR_DOMAIN_BOOT_NET:
+                    boot[i] = 'n';
+                    break;
+                default:
+                    boot[i] = 'c';
+                    break;
+                }
+            }
+            boot[def->os.nBootDevs] = '\0';
+
+            virCommandAddArg(cmd, "-boot");
+
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_BOOT_MENU) &&
+                def->os.bootmenu != VIR_DOMAIN_BOOT_MENU_DEFAULT) {
+                if (def->os.bootmenu == VIR_DOMAIN_BOOT_MENU_ENABLED)
+                    virBufferAsprintf(&boot_buf, "order=%s,menu=on", boot);
+                else if (def->os.bootmenu == VIR_DOMAIN_BOOT_MENU_DISABLED)
+                    virBufferAsprintf(&boot_buf, "order=%s,menu=off", boot);
+            } else {
+                virBufferAdd(&boot_buf, boot, -1);
+            }
+
+            virCommandAddArgBuffer(cmd, &boot_buf);
+        }
+
+        if (def->os.kernel)
+            virCommandAddArgList(cmd, "-kernel", def->os.kernel, NULL);
+        if (def->os.initrd)
+            virCommandAddArgList(cmd, "-initrd", def->os.initrd, NULL);
+        if (def->os.cmdline)
+            virCommandAddArgList(cmd, "-append", def->os.cmdline, NULL);
+    } else {
+        virCommandAddArgList(cmd, "-bootloader", def->os.bootloader, NULL);
+    }
+
+    for (i = 0 ; i < def->ndisks ; i++) {
+        virDomainDiskDefPtr disk = def->disks[i];
+
+        if (disk->driverName != NULL &&
+            !STREQ(disk->driverName, "qemu")) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("unsupported driver name '%s' for disk '%s'"),
+                            disk->driverName, disk->src);
+            goto error;
+        }
+    }
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+        for (i = 0 ; i < def->ncontrollers ; i++) {
+            virDomainControllerDefPtr cont = def->controllers[i];
+
+            /* We don't add an explicit IDE or FD controller because the
+             * provided PIIX4 device already includes one. It isn't possible to
+             * remove the PIIX4. */
+            if (cont->type == VIR_DOMAIN_CONTROLLER_TYPE_IDE ||
+                cont->type == VIR_DOMAIN_CONTROLLER_TYPE_FDC)
+                continue;
+
+            /* Only recent QEMU implements a SATA (AHCI) controller */
+            if (cont->type == VIR_DOMAIN_CONTROLLER_TYPE_SATA) {
+                if (!qemuCapsGet(qemuCaps, QEMU_CAPS_ICH9_AHCI)) {
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    "%s", _("SATA is not supported with this QEMU binary"));
+                    goto error;
+                } else {
+                    char *devstr;
+
+                    virCommandAddArg(cmd, "-device");
+                    if (!(devstr = qemuBuildControllerDevStr(cont, qemuCaps, NULL)))
+                        goto error;
+
+                    virCommandAddArg(cmd, devstr);
+                    VIR_FREE(devstr);
+                }
+            } else if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_USB &&
+                def->controllers[i]->model == -1 &&
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_PIIX3_USB_UHCI)) {
+                if (usblegacy) {
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    _("Multiple legacy USB controller not supported"));
+                    goto error;
+                }
+                usblegacy = true;
+            } else {
+                virCommandAddArg(cmd, "-device");
+
+                char *devstr;
+                if (!(devstr = qemuBuildControllerDevStr(def->controllers[i], qemuCaps,
+                                                         &usbcontroller)))
+                    goto error;
+
+                virCommandAddArg(cmd, devstr);
+                VIR_FREE(devstr);
+            }
+        }
+    }
+
+    /* If QEMU supports -drive param instead of old -hda, -hdb, -cdrom .. */
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE)) {
+        int bootCD = 0, bootFloppy = 0, bootDisk = 0;
+
+        if ((qemuCapsGet(qemuCaps, QEMU_CAPS_DRIVE_BOOT) || emitBootindex) &&
+            !def->os.kernel) {
+            /* bootDevs will get translated into either bootindex=N or boot=on
+             * depending on what qemu supports */
+            for (i = 0 ; i < def->os.nBootDevs ; i++) {
+                switch (def->os.bootDevs[i]) {
+                case VIR_DOMAIN_BOOT_CDROM:
+                    bootCD = i + 1;
+                    break;
+                case VIR_DOMAIN_BOOT_FLOPPY:
+                    bootFloppy = i + 1;
+                    break;
+                case VIR_DOMAIN_BOOT_DISK:
+                    bootDisk = i + 1;
+                    break;
+                }
+            }
+        }
+
+        for (i = 0 ; i < def->ndisks ; i++) {
+            char *optstr;
+            int bootindex = 0;
+            virDomainDiskDefPtr disk = def->disks[i];
+            int withDeviceArg = 0;
+            bool deviceFlagMasked = false;
+
+            /* Unless we have -device, then USB disks need special
+               handling */
+            if ((disk->bus == VIR_DOMAIN_DISK_BUS_USB) &&
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                if (disk->device == VIR_DOMAIN_DISK_DEVICE_DISK) {
+                    virCommandAddArg(cmd, "-usbdevice");
+                    virCommandAddArgFormat(cmd, "disk:%s", disk->src);
+                } else {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                    _("unsupported usb disk type for '%s'"),
+                                    disk->src);
+                    goto error;
+                }
+                continue;
+            }
+
+            switch (disk->device) {
+            case VIR_DOMAIN_DISK_DEVICE_CDROM:
+                bootindex = bootCD;
+                bootCD = 0;
+                break;
+            case VIR_DOMAIN_DISK_DEVICE_FLOPPY:
+                bootindex = bootFloppy;
+                bootFloppy = 0;
+                break;
+            case VIR_DOMAIN_DISK_DEVICE_DISK:
+                bootindex = bootDisk;
+                bootDisk = 0;
+                break;
+            }
+
+            virCommandAddArg(cmd, "-drive");
+
+            /* Unfortunately it is not possible to use
+               -device for floppies, or Xen paravirt
+               devices. Fortunately, those don't need
+               static PCI addresses, so we don't really
+               care that we can't use -device */
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                if (disk->bus != VIR_DOMAIN_DISK_BUS_XEN) {
+                    withDeviceArg = 1;
+                } else {
+                    qemuCapsClear(qemuCaps, QEMU_CAPS_DEVICE);
+                    deviceFlagMasked = true;
+                }
+            }
+            optstr = qemuBuildDriveStr(conn, disk,
+                                       emitBootindex ? false : !!bootindex,
+                                       qemuCaps);
+            if (deviceFlagMasked)
+                qemuCapsSet(qemuCaps, QEMU_CAPS_DEVICE);
+            if (!optstr)
+                goto error;
+            virCommandAddArg(cmd, optstr);
+            VIR_FREE(optstr);
+
+            if (!emitBootindex)
+                bootindex = 0;
+            else if (disk->bootIndex)
+                bootindex = disk->bootIndex;
+
+            if (withDeviceArg) {
+                if (disk->bus == VIR_DOMAIN_DISK_BUS_FDC) {
+                    virCommandAddArg(cmd, "-global");
+                    virCommandAddArgFormat(cmd, "isa-fdc.drive%c=drive-%s",
+                                           disk->info.addr.drive.unit
+                                           ? 'B' : 'A',
+                                           disk->info.alias);
+
+                    if (bootindex) {
+                        virCommandAddArg(cmd, "-global");
+                        virCommandAddArgFormat(cmd, "isa-fdc.bootindex%c=%d",
+                                               disk->info.addr.drive.unit
+                                               ? 'B' : 'A',
+                                               bootindex);
+                    }
+                } else {
+                    virCommandAddArg(cmd, "-device");
+
+                    if (!(optstr = qemuBuildDriveDevStr(disk, bootindex,
+                                                        qemuCaps)))
+                        goto error;
+                    virCommandAddArg(cmd, optstr);
+                    VIR_FREE(optstr);
+                }
+            }
+        }
+    } else {
+        for (i = 0 ; i < def->ndisks ; i++) {
+            char dev[NAME_MAX];
+            char *file;
+            const char *fmt;
+            virDomainDiskDefPtr disk = def->disks[i];
+
+            if (disk->bus == VIR_DOMAIN_DISK_BUS_USB) {
+                if (disk->device == VIR_DOMAIN_DISK_DEVICE_DISK) {
+                    virCommandAddArg(cmd, "-usbdevice");
+                    virCommandAddArgFormat(cmd, "disk:%s", disk->src);
+                } else {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                    _("unsupported usb disk type for '%s'"),
+                                    disk->src);
+                    goto error;
+                }
+                continue;
+            }
+
+            if (STREQ(disk->dst, "hdc") &&
+                disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM) {
+                if (disk->src) {
+                    snprintf(dev, NAME_MAX, "-%s", "cdrom");
+                } else {
+                    continue;
+                }
+            } else {
+                if (STRPREFIX(disk->dst, "hd") ||
+                    STRPREFIX(disk->dst, "fd")) {
+                    snprintf(dev, NAME_MAX, "-%s", disk->dst);
+                } else {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                    _("unsupported disk type '%s'"), disk->dst);
+                    goto error;
+                }
+            }
+
+            if (disk->type == VIR_DOMAIN_DISK_TYPE_DIR) {
+                /* QEMU only supports magic FAT format for now */
+                if (disk->driverType &&
+                    STRNEQ(disk->driverType, "fat")) {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                                    _("unsupported disk driver type for '%s'"),
+                                    disk->driverType);
+                    goto error;
+                }
+                if (!disk->readonly) {
+                    qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                    _("cannot create virtual FAT disks in read-write mode"));
+                    goto error;
+                }
+                if (disk->device == VIR_DOMAIN_DISK_DEVICE_FLOPPY)
+                    fmt = "fat:floppy:%s";
+                else
+                    fmt = "fat:%s";
+
+                if (virAsprintf(&file, fmt, disk->src) < 0) {
+                    goto no_memory;
+                }
+            } else if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) {
+                switch (disk->protocol) {
+                case VIR_DOMAIN_DISK_PROTOCOL_NBD:
+                    if (disk->nhosts != 1) {
+                        qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                        _("NBD accepts only one host"));
+                        goto error;
+                    }
+                    if (virAsprintf(&file, "nbd:%s:%s,", disk->hosts->name,
+                                    disk->hosts->port) < 0) {
+                        goto no_memory;
+                    }
+                    break;
+                case VIR_DOMAIN_DISK_PROTOCOL_RBD:
+                    {
+                        virBuffer opt = VIR_BUFFER_INITIALIZER;
+                        if (qemuBuildRBDString(conn, disk, &opt) < 0)
+                            goto error;
+                        if (virBufferError(&opt)) {
+                            virReportOOMError();
+                            goto error;
+                        }
+                        file = virBufferContentAndReset(&opt);
+                    }
+                    break;
+                case VIR_DOMAIN_DISK_PROTOCOL_SHEEPDOG:
+                    if (disk->nhosts == 0) {
+                        if (virAsprintf(&file, "sheepdog:%s,", disk->src) < 0) {
+                            goto no_memory;
+                        }
+                    } else {
+                        /* only one host is supported now */
+                        if (virAsprintf(&file, "sheepdog:%s:%s:%s,",
+                                        disk->hosts->name, disk->hosts->port,
+                                        disk->src) < 0) {
+                            goto no_memory;
+                        }
+                    }
+                    break;
+                }
+            } else {
+                if (!(file = strdup(disk->src))) {
+                    goto no_memory;
+                }
+            }
+
+            virCommandAddArgList(cmd, dev, file, NULL);
+            VIR_FREE(file);
+        }
+    }
+
+    if (qemuCapsGet(qemuCaps, QEMU_CAPS_FSDEV)) {
+        for (i = 0 ; i < def->nfss ; i++) {
+            char *optstr;
+            virDomainFSDefPtr fs = def->fss[i];
+
+            virCommandAddArg(cmd, "-fsdev");
+            if (!(optstr = qemuBuildFSStr(fs, qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, optstr);
+            VIR_FREE(optstr);
+
+            virCommandAddArg(cmd, "-device");
+            if (!(optstr = qemuBuildFSDevStr(fs, qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, optstr);
+            VIR_FREE(optstr);
+        }
+    } else {
+        if (def->nfss) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("filesystem passthrough not supported by this QEMU"));
+            goto error;
+        }
+    }
+
+    if (!def->nnets) {
+        /* If we have -device, then we set -nodefault already */
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+            virCommandAddArgList(cmd, "-net", "none", NULL);
+    } else {
+        int bootNet = 0;
+
+        if (emitBootindex) {
+            /* convert <boot dev='network'/> to bootindex since we didn't emit
+             * -boot n
+             */
+            for (i = 0 ; i < def->os.nBootDevs ; i++) {
+                if (def->os.bootDevs[i] == VIR_DOMAIN_BOOT_NET) {
+                    bootNet = i + 1;
+                    break;
+                }
+            }
+        }
+
+        for (i = 0 ; i < def->nnets ; i++) {
+            virDomainNetDefPtr net = def->nets[i];
+            char *nic, *host;
+            char tapfd_name[50];
+            char vhostfd_name[50] = "";
+            int vlan;
+            int bootindex = bootNet;
+            int actualType;
+
+            bootNet = 0;
+            if (!bootindex)
+                bootindex = net->bootIndex;
+
+            /* VLANs are not used with -netdev, so don't record them */
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_NETDEV) &&
+                qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+                vlan = -1;
+            else
+                vlan = i;
+
+            /* If appropriate, grab a physical device from the configured
+             * network's pool of devices, or resolve bridge device name
+             * to the one defined in the network definition.
+             */
+            if (networkAllocateActualDevice(net) < 0)
+               goto error;
+
+            actualType = virDomainNetGetActualType(net);
+            if (actualType == VIR_DOMAIN_NET_TYPE_NETWORK ||
+                actualType == VIR_DOMAIN_NET_TYPE_BRIDGE) {
+                int tapfd = qemuNetworkIfaceConnect(def, conn, driver, net,
+                                                    qemuCaps);
+                if (tapfd < 0)
+                    goto error;
+
+                last_good_net = i;
+                virCommandTransferFD(cmd, tapfd);
+
+                if (snprintf(tapfd_name, sizeof(tapfd_name), "%d",
+                             tapfd) >= sizeof(tapfd_name))
+                    goto no_memory;
+            } else if (actualType == VIR_DOMAIN_NET_TYPE_DIRECT) {
+                int tapfd = qemuPhysIfaceConnect(def, driver, net,
+                                                 qemuCaps, vmop);
+                if (tapfd < 0)
+                    goto error;
+
+                last_good_net = i;
+                virCommandTransferFD(cmd, tapfd);
+
+                if (snprintf(tapfd_name, sizeof(tapfd_name), "%d",
+                             tapfd) >= sizeof(tapfd_name))
+                    goto no_memory;
+            }
+
+            if (actualType == VIR_DOMAIN_NET_TYPE_NETWORK ||
+                actualType == VIR_DOMAIN_NET_TYPE_BRIDGE ||
+                actualType == VIR_DOMAIN_NET_TYPE_DIRECT) {
+                /* Attempt to use vhost-net mode for these types of
+                   network device */
+                int vhostfd;
+
+                if (qemuOpenVhostNet(def, net, qemuCaps, &vhostfd) < 0)
+                    goto error;
+                if (vhostfd >= 0) {
+                    virCommandTransferFD(cmd, vhostfd);
+
+                    if (snprintf(vhostfd_name, sizeof(vhostfd_name), "%d",
+                                 vhostfd) >= sizeof(vhostfd_name))
+                        goto no_memory;
+                }
+            }
+            /* Possible combinations:
+             *
+             *  1. Old way:   -net nic,model=e1000,vlan=1 -net tap,vlan=1
+             *  2. Semi-new:  -device e1000,vlan=1        -net tap,vlan=1
+             *  3. Best way:  -netdev type=tap,id=netdev1 -device e1000,id=netdev1
+             *
+             * NB, no support for -netdev without use of -device
+             */
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_NETDEV) &&
+                qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                virCommandAddArg(cmd, "-netdev");
+                if (!(host = qemuBuildHostNetStr(net, ',', vlan,
+                                                 tapfd_name, vhostfd_name)))
+                    goto error;
+                virCommandAddArg(cmd, host);
+                VIR_FREE(host);
+            }
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                virCommandAddArg(cmd, "-device");
+                nic = qemuBuildNicDevStr(net, vlan, bootindex, qemuCaps);
+                if (!nic)
+                    goto error;
+                virCommandAddArg(cmd, nic);
+                VIR_FREE(nic);
+            } else {
+                virCommandAddArg(cmd, "-net");
+                if (!(nic = qemuBuildNicStr(net, "nic,", vlan)))
+                    goto error;
+                virCommandAddArg(cmd, nic);
+                VIR_FREE(nic);
+            }
+            if (!(qemuCapsGet(qemuCaps, QEMU_CAPS_NETDEV) &&
+                  qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))) {
+                virCommandAddArg(cmd, "-net");
+                if (!(host = qemuBuildHostNetStr(net, ',', vlan,
+                                                 tapfd_name, vhostfd_name)))
+                    goto error;
+                virCommandAddArg(cmd, host);
+                VIR_FREE(host);
+            }
+        }
+    }
+
+    if (def->nsmartcards) {
+        /* -device usb-ccid was already emitted along with other
+         * controllers.  For now, qemu handles only one smartcard.  */
+        virDomainSmartcardDefPtr smartcard = def->smartcards[0];
+        char *devstr;
+        virBuffer opt = VIR_BUFFER_INITIALIZER;
+        int j;
+        const char *database;
+
+        if (def->nsmartcards > 1 ||
+            smartcard->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCID ||
+            smartcard->info.addr.ccid.controller != 0 ||
+            smartcard->info.addr.ccid.slot != 0) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("this QEMU binary lacks multiple smartcard "
+                              "support"));
+            virBufferFreeAndReset(&opt);
+            goto error;
+        }
+
+        switch (smartcard->type) {
+        case VIR_DOMAIN_SMARTCARD_TYPE_HOST:
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV) ||
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_CCID_EMULATED)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("this QEMU binary lacks smartcard host "
+                                  "mode support"));
+                goto error;
+            }
+
+            virBufferAddLit(&opt, "ccid-card-emulated,backend=nss-emulated");
+            break;
+
+        case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV) ||
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_CCID_EMULATED)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("this QEMU binary lacks smartcard host "
+                                  "mode support"));
+                goto error;
+            }
+
+            virBufferAddLit(&opt, "ccid-card-emulated,backend=certificates");
+            for (j = 0; j < VIR_DOMAIN_SMARTCARD_NUM_CERTIFICATES; j++) {
+                if (strchr(smartcard->data.cert.file[j], ',')) {
+                    virBufferFreeAndReset(&opt);
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    _("invalid certificate name: %s"),
+                                    smartcard->data.cert.file[j]);
+                    goto error;
+                }
+                virBufferAsprintf(&opt, ",cert%d=%s", j + 1,
+                                  smartcard->data.cert.file[j]);
+            }
+            if (smartcard->data.cert.database) {
+                if (strchr(smartcard->data.cert.database, ',')) {
+                    virBufferFreeAndReset(&opt);
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    _("invalid database name: %s"),
+                                    smartcard->data.cert.database);
+                    goto error;
+                }
+                database = smartcard->data.cert.database;
+            } else {
+                database = VIR_DOMAIN_SMARTCARD_DEFAULT_DATABASE;
+            }
+            virBufferAsprintf(&opt, ",database=%s", database);
+            break;
+
+        case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV) ||
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_CCID_PASSTHRU)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                _("this QEMU binary lacks smartcard "
+                                  "passthrough mode support"));
+                goto error;
+            }
+
+            virCommandAddArg(cmd, "-chardev");
+            if (!(devstr = qemuBuildChrChardevStr(&smartcard->data.passthru,
+                                                  smartcard->info.alias,
+                                                  qemuCaps))) {
+                virBufferFreeAndReset(&opt);
+                goto error;
+            }
+            virCommandAddArg(cmd, devstr);
+            VIR_FREE(devstr);
+
+            virBufferAsprintf(&opt, "ccid-card-passthru,chardev=char%s",
+                              smartcard->info.alias);
+            break;
+
+        default:
+            qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("unexpected smartcard type %d"),
+                            smartcard->type);
+            virBufferFreeAndReset(&opt);
+            goto error;
+        }
+        virCommandAddArg(cmd, "-device");
+        virBufferAsprintf(&opt, ",id=%s,bus=ccid0.0", smartcard->info.alias);
+        virCommandAddArgBuffer(cmd, &opt);
+    }
+
+    if (!def->nserials) {
+        /* If we have -device, then we set -nodefault already */
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+            virCommandAddArgList(cmd, "-serial", "none", NULL);
+    } else {
+        for (i = 0 ; i < def->nserials ; i++) {
+            virDomainChrDefPtr serial = def->serials[i];
+            char *devstr;
+
+            /* Use -chardev with -device if they are available */
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV) &&
+                qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                virCommandAddArg(cmd, "-chardev");
+                if (!(devstr = qemuBuildChrChardevStr(&serial->source,
+                                                      serial->info.alias,
+                                                      qemuCaps)))
+                    goto error;
+                virCommandAddArg(cmd, devstr);
+                VIR_FREE(devstr);
+
+                virCommandAddArg(cmd, "-device");
+                virCommandAddArgFormat(cmd, "isa-serial,chardev=char%s,id=%s",
+                                       serial->info.alias, serial->info.alias);
+            } else {
+                virCommandAddArg(cmd, "-serial");
+                if (!(devstr = qemuBuildChrArgStr(&serial->source, NULL)))
+                    goto error;
+                virCommandAddArg(cmd, devstr);
+                VIR_FREE(devstr);
+            }
+        }
+    }
+
+    if (!def->nparallels) {
+        /* If we have -device, then we set -nodefault already */
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE))
+            virCommandAddArgList(cmd, "-parallel", "none", NULL);
+    } else {
+        for (i = 0 ; i < def->nparallels ; i++) {
+            virDomainChrDefPtr parallel = def->parallels[i];
+            char *devstr;
+
+            /* Use -chardev with -device if they are available */
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV) &&
+                qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                virCommandAddArg(cmd, "-chardev");
+                if (!(devstr = qemuBuildChrChardevStr(&parallel->source,
+                                                      parallel->info.alias,
+                                                      qemuCaps)))
+                    goto error;
+                virCommandAddArg(cmd, devstr);
+                VIR_FREE(devstr);
+
+                virCommandAddArg(cmd, "-device");
+                virCommandAddArgFormat(cmd, "isa-parallel,chardev=char%s,id=%s",
+                                       parallel->info.alias,
+                                       parallel->info.alias);
+            } else {
+                virCommandAddArg(cmd, "-parallel");
+                if (!(devstr = qemuBuildChrArgStr(&parallel->source, NULL)))
+                      goto error;
+                virCommandAddArg(cmd, devstr);
+                VIR_FREE(devstr);
+            }
+        }
+    }
+
+    for (i = 0 ; i < def->nchannels ; i++) {
+        virDomainChrDefPtr channel = def->channels[i];
+        char *devstr;
+        char *addr;
+        int port;
+
+        switch(channel->targetType) {
+        case VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_GUESTFWD:
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_CHARDEV) ||
+                !qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                "%s", _("guestfwd requires QEMU to support -chardev & -device"));
+                goto error;
+            }
+
+            virCommandAddArg(cmd, "-chardev");
+            if (!(devstr = qemuBuildChrChardevStr(&channel->source,
+                                                  channel->info.alias,
+                                                  qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, devstr);
+            VIR_FREE(devstr);
+
+            addr = virSocketAddrFormat(channel->target.addr);
+            if (!addr)
+                goto error;
+            port = virSocketAddrGetPort(channel->target.addr);
+
+            virCommandAddArg(cmd, "-netdev");
+            virCommandAddArgFormat(cmd,
+                                   "user,guestfwd=tcp:%s:%i,chardev=char%s,id=user-%s",
+                                   addr, port, channel->info.alias,
+                                   channel->info.alias);
+            VIR_FREE(addr);
+            break;
+
+        case VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO:
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                    _("virtio channel requires QEMU to support -device"));
+                goto error;
+            }
+
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE_SPICEVMC) &&
+                channel->source.type == VIR_DOMAIN_CHR_TYPE_SPICEVMC) {
+                /* spicevmc was originally introduced via a -device
+                 * with a backend internal to qemu; although we prefer
+                 * the newer -chardev interface.  */
+                ;
+            } else {
+                virCommandAddArg(cmd, "-chardev");
+                if (!(devstr = qemuBuildChrChardevStr(&channel->source,
+                                                      channel->info.alias,
+                                                      qemuCaps)))
+                    goto error;
+                virCommandAddArg(cmd, devstr);
+                VIR_FREE(devstr);
+            }
+
+            virCommandAddArg(cmd, "-device");
+            if (!(devstr = qemuBuildVirtioSerialPortDevStr(channel,
+                                                           qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, devstr);
+            VIR_FREE(devstr);
+            break;
+        }
+    }
+
+    /* Explicit console devices */
+    for (i = 0 ; i < def->nconsoles ; i++) {
+        virDomainChrDefPtr console = def->consoles[i];
+        char *devstr;
+
+        switch(console->targetType) {
+        case VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_VIRTIO:
+            if (!qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                    _("virtio channel requires QEMU to support -device"));
+                goto error;
+            }
+
+            virCommandAddArg(cmd, "-chardev");
+            if (!(devstr = qemuBuildChrChardevStr(&console->source,
+                                                  console->info.alias,
+                                                  qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, devstr);
+            VIR_FREE(devstr);
+
+            virCommandAddArg(cmd, "-device");
+            if (!(devstr = qemuBuildVirtioSerialPortDevStr(console,
+                                                           qemuCaps)))
+                goto error;
+            virCommandAddArg(cmd, devstr);
+            VIR_FREE(devstr);
+            break;
+
+        case VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL:
+            break;
+
+        default:
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("unsupported console target type %s"),
+                            NULLSTR(virDomainChrConsoleTargetTypeToString(console->targetType)));
+            goto error;
+        }
+    }
+
+    if (usbcontroller == 0)
+        virCommandAddArg(cmd, "-usb");
+
+    for (i = 0 ; i < def->nhubs ; i++) {
+        virDomainHubDefPtr hub = def->hubs[i];
+        char *optstr;
+
+        virCommandAddArg(cmd, "-device");
+        if (!(optstr = qemuBuildHubDevStr(hub, qemuCaps)))
+            goto error;
+        virCommandAddArg(cmd, optstr);
+        VIR_FREE(optstr);
+    }
+
+    for (i = 0 ; i < def->ninputs ; i++) {
+        virDomainInputDefPtr input = def->inputs[i];
+
+        if (input->bus == VIR_DOMAIN_INPUT_BUS_USB) {
+            if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                char *optstr;
+                virCommandAddArg(cmd, "-device");
+                if (!(optstr = qemuBuildUSBInputDevStr(input, qemuCaps)))
+                    goto error;
+                virCommandAddArg(cmd, optstr);
+                VIR_FREE(optstr);
+            } else {
+                virCommandAddArgList(cmd, "-usbdevice",
+                                     input->type == VIR_DOMAIN_INPUT_TYPE_MOUSE
+                                     ? "mouse" : "tablet", NULL);
+            }
+        }
+    }
+
+    if (def->ngraphics > 1) {
+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
+                        "%s", _("only 1 graphics device is supported"));
+        goto error;
+    }
+
+    if ((def->ngraphics == 1) &&
+        def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC) {
+        virBuffer opt = VIR_BUFFER_INITIALIZER;
+
+        if (def->graphics[0]->data.vnc.socket ||
+            driver->vncAutoUnixSocket) {
+
+            if (!def->graphics[0]->data.vnc.socket &&
+                virAsprintf(&def->graphics[0]->data.vnc.socket,
+                            "%s/%s.vnc", driver->libDir, def->name) == -1) {
+                goto no_memory;
+            }
+
+            virBufferAsprintf(&opt, "unix:%s",
+                              def->graphics[0]->data.vnc.socket);
+
+        } else if (qemuCapsGet(qemuCaps, QEMU_CAPS_VNC_COLON)) {
+            const char *listenNetwork;
+            const char *listenAddr = NULL;
+            char *netAddr = NULL;
+            bool escapeAddr;
+            int ret;
+
+            switch (virDomainGraphicsListenGetType(def->graphics[0], 0)) {
+            case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_ADDRESS:
+                listenAddr = virDomainGraphicsListenGetAddress(def->graphics[0], 0);
+                break;
+
+            case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_NETWORK:
+                listenNetwork = virDomainGraphicsListenGetNetwork(def->graphics[0], 0);
+                if (!listenNetwork)
+                    break;
+                ret = networkGetNetworkAddress(listenNetwork, &netAddr);
+                if (ret <= -2) {
+                    qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                    "%s", _("network-based listen not possible, "
+                                            "network driver not present"));
+                    goto error;
+                }
+                if (ret < 0) {
+                    qemuReportError(VIR_ERR_XML_ERROR,
+                                    _("listen network '%s' had no usable address"),
+                                    listenNetwork);
+                    goto error;
+                }
+                listenAddr = netAddr;
+                /* store the address we found in the <graphics> element so it will
+                 * show up in status. */
+                if (virDomainGraphicsListenSetAddress(def->graphics[0], 0,
+                                                      listenAddr, -1, false) < 0)
+                   goto error;
+                break;
+            }
+
+            if (!listenAddr)
+                listenAddr = driver->vncListen;
+
+            escapeAddr = strchr(listenAddr, ':') != NULL;
+            if (escapeAddr)
+                virBufferAsprintf(&opt, "[%s]", listenAddr);
+            else
+                virBufferAdd(&opt, listenAddr, -1);
+            virBufferAsprintf(&opt, ":%d",
+                              def->graphics[0]->data.vnc.port - 5900);
+
+            VIR_FREE(netAddr);
+        } else {
+            virBufferAsprintf(&opt, "%d",
+                              def->graphics[0]->data.vnc.port - 5900);
+        }
+
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_VNC_COLON)) {
+            if (def->graphics[0]->data.vnc.auth.passwd ||
+                driver->vncPassword)
+                virBufferAddLit(&opt, ",password");
+
+            if (driver->vncTLS) {
+                virBufferAddLit(&opt, ",tls");
+                if (driver->vncTLSx509verify) {
+                    virBufferAsprintf(&opt, ",x509verify=%s",
+                                      driver->vncTLSx509certdir);
+                } else {
+                    virBufferAsprintf(&opt, ",x509=%s",
+                                      driver->vncTLSx509certdir);
+                }
+            }
+
+            if (driver->vncSASL) {
+                virBufferAddLit(&opt, ",sasl");
+
+                if (driver->vncSASLdir)
+                    virCommandAddEnvPair(cmd, "SASL_CONF_DIR",
+                                         driver->vncSASLdir);
+
+                /* TODO: Support ACLs later */
+            }
+        }
+
+        virCommandAddArg(cmd, "-vnc");
+        virCommandAddArgBuffer(cmd, &opt);
+        if (def->graphics[0]->data.vnc.keymap) {
+            virCommandAddArgList(cmd, "-k", def->graphics[0]->data.vnc.keymap,
+                                 NULL);
+        }
+
+        /* Unless user requested it, set the audio backend to none, to
+         * prevent it opening the host OS audio devices, since that causes
+         * security issues and might not work when using VNC.
+         */
+        if (driver->vncAllowHostAudio) {
+            virCommandAddEnvPass(cmd, "QEMU_AUDIO_DRV");
+        } else {
+            virCommandAddEnvString(cmd, "QEMU_AUDIO_DRV=none");
+        }
+    } else if ((def->ngraphics == 1) &&
+               def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) {
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_0_10) &&
+            !qemuCapsGet(qemuCaps, QEMU_CAPS_SDL)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                            _("sdl not supported by '%s'"),
+                            def->emulator);
+            goto error;
+        }
+
+        if (def->graphics[0]->data.sdl.xauth)
+            virCommandAddEnvPair(cmd, "XAUTHORITY",
+                                 def->graphics[0]->data.sdl.xauth);
+        if (def->graphics[0]->data.sdl.display)
+            virCommandAddEnvPair(cmd, "DISPLAY",
+                                 def->graphics[0]->data.sdl.display);
+        if (def->graphics[0]->data.sdl.fullscreen)
+            virCommandAddArg(cmd, "-full-screen");
+
+        /* If using SDL for video, then we should just let it
+         * use QEMU's host audio drivers, possibly SDL too
+         * User can set these two before starting libvirtd
+         */
+        virCommandAddEnvPass(cmd, "QEMU_AUDIO_DRV");
+        virCommandAddEnvPass(cmd, "SDL_AUDIODRIVER");
+
+        /* New QEMU has this flag to let us explicitly ask for
+         * SDL graphics. This is better than relying on the
+         * default, since the default changes :-( */
+        if (qemuCapsGet(qemuCaps, QEMU_CAPS_SDL))
+            virCommandAddArg(cmd, "-sdl");
+
+    } else if ((def->ngraphics == 1) &&
+               def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SPICE) {
+        virBuffer opt = VIR_BUFFER_INITIALIZER;
+        const char *listenNetwork;
+        const char *listenAddr = NULL;
+        char *netAddr = NULL;
+        int ret;
+
+        if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SPICE)) {
+            qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("spice graphics are not supported with this QEMU"));
+            goto error;
+        }
+
+        virBufferAsprintf(&opt, "port=%u", def->graphics[0]->data.spice.port);
+
+        if (driver->spiceTLS && def->graphics[0]->data.spice.tlsPort != -1)
+            virBufferAsprintf(&opt, ",tls-port=%u", def->graphics[0]->data.spice.tlsPort);
+
+        switch (virDomainGraphicsListenGetType(def->graphics[0], 0)) {
+        case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_ADDRESS:
+            listenAddr = virDomainGraphicsListenGetAddress(def->graphics[0], 0);
+            break;
+
+        case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_NETWORK:
+            listenNetwork = virDomainGraphicsListenGetNetwork(def->graphics[0], 0);
+            if (!listenNetwork)
+                break;
+            ret = networkGetNetworkAddress(listenNetwork, &netAddr);
+            if (ret <= -2) {
+                qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                "%s", _("network-based listen not possible, "
+                                        "network driver not present"));
+                goto error;
+            }
+            if (ret < 0) {
+                qemuReportError(VIR_ERR_XML_ERROR,
+                                _("listen network '%s' had no usable address"),
+                                listenNetwork);
+                goto error;
+            }
+            listenAddr = netAddr;
+            /* store the address we found in the <graphics> element so it will
+             * show up in status. */
+            if (virDomainGraphicsListenSetAddress(def->graphics[0], 0,
+                                                  listenAddr, -1, false) < 0)
+               goto error;
+            break;