diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 6f6b61b798..2ce06725bf 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -7906,13 +7906,24 @@ qemuBuildCommandLine(virConnectPtr conn,
         if (hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS &&
             hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI) {
 
-            if ((hostdev->source.subsys.u.pci.backend
-                 == VIR_DOMAIN_HOSTDEV_PCI_BACKEND_TYPE_VFIO) &&
-                !virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_VFIO_PCI)) {
-                virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
-                               _("VFIO PCI device assignment is not supported by "
-                                 "this version of qemu"));
-                goto error;
+            if (hostdev->source.subsys.u.pci.backend
+                == VIR_DOMAIN_HOSTDEV_PCI_BACKEND_TYPE_VFIO) {
+                unsigned long long memKB;
+
+                if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_VFIO_PCI)) {
+                    virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                   _("VFIO PCI device assignment is not "
+                                     "supported by this version of qemu"));
+                    goto error;
+                }
+                /* VFIO requires all of the guest's memory to be
+                 * locked resident, plus some amount for IO
+                 * space. Alex Williamson suggested adding 1GiB for IO
+                 * space just to be safe (some finer tuning might be
+                 * nice, though).
+                 */
+                memKB = def->mem.max_balloon + (1024 * 1024);
+                virCommandSetMaxMemLock(cmd, memKB * 1024);
             }
 
             if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index f608ec41f8..15cca080b4 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -38,6 +38,7 @@
 #include "viralloc.h"
 #include "virpci.h"
 #include "virfile.h"
+#include "virprocess.h"
 #include "qemu_cgroup.h"
 #include "locking/domain_lock.h"
 #include "network/bridge_driver.h"
@@ -999,13 +1000,25 @@ int qemuDomainAttachHostPciDevice(virQEMUDriverPtr driver,
                                      &hostdev, 1) < 0)
         return -1;
 
-    if ((hostdev->source.subsys.u.pci.backend
-         == VIR_DOMAIN_HOSTDEV_PCI_BACKEND_TYPE_VFIO) &&
-        !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE_VFIO_PCI)) {
-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
-                       _("VFIO PCI device assignment is not supported by "
-                         "this version of qemu"));
-        goto error;
+    if (hostdev->source.subsys.u.pci.backend
+        == VIR_DOMAIN_HOSTDEV_PCI_BACKEND_TYPE_VFIO) {
+        unsigned long long memKB;
+
+        if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE_VFIO_PCI)) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("VFIO PCI device assignment is not "
+                             "supported by this version of qemu"));
+            goto error;
+        }
+        /* VFIO requires all of the guest's memory to be locked
+         * resident, plus some amount for IO space. Alex Williamson
+         * suggested adding 1GiB for IO space just to be safe (some
+         * finer tuning might be nice, though).
+         * In this case, the guest's memory may already be locked, but
+         * it doesn't hurt to "change" the limit to the same value.
+         */
+        memKB = vm->def->mem.max_balloon + (1024 * 1024);
+        virProcessSetMaxMemLock(vm->pid, memKB * 1024);
     }
 
     if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE)) {