diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index b8db76e3d6c7f900d7253a0f6a712c139af4a97b..c834577892bc22cb7ffe396da76c56ec0a19d683 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -1839,8 +1839,10 @@
       A "usb" controller has an optional attribute <code>model</code>,
       which is one of "piix3-uhci", "piix4-uhci", "ehci",
       "ich9-ehci1", "ich9-uhci1", "ich9-uhci2", "ich9-uhci3",
-      "vt82c686b-uhci", "pci-ohci" or "nec-xhci".  The PowerPC64
-      "spapr-vio" addresses do not have an associated controller.
+      "vt82c686b-uhci", "pci-ohci" or "nec-xhci". Additionally,
+      <span class="since">since 0.10.0</span>, if the USB bus needs to be
+      explicitly disabled for the guest, <code>model='none'</code> may be used.
+      The PowerPC64 "spapr-vio" addresses do not have an associated controller.
     </p>
 
     <p>
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index b7562adffde8dc64d3b0b30ce5c7c1c36008b8d5..c85d76307b3335e99cb2b4beaa824336a7cf9fc9 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1222,6 +1222,7 @@
             <value>vt82c686b-uhci</value>
             <value>pci-ohci</value>
             <value>nec-xhci</value>
+            <value>none</value>
           </choice>
         </attribute>
       </optional>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index ad391d2a40e2fe59751db0ddab2c79388b151710..78475414de74700c73f7174a6efd0861428b3a63 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -259,7 +259,8 @@ VIR_ENUM_IMPL(virDomainControllerModelUSB, VIR_DOMAIN_CONTROLLER_MODEL_USB_LAST,
               "ich9-uhci3",
               "vt82c686b-uhci",
               "pci-ohci",
-              "nec-xhci")
+              "nec-xhci",
+              "none")
 
 VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST,
               "mount",
@@ -7918,6 +7919,8 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
     virBitmapPtr bootMap = NULL;
     unsigned long bootMapSize = 0;
     xmlNodePtr cur;
+    bool usb_none = false;
+    bool usb_other = false;
 
     if (VIR_ALLOC(def) < 0) {
         virReportOOMError();
@@ -8643,6 +8646,27 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         if (!controller)
             goto error;
 
+        /* sanitize handling of "none" usb controller */
+        if (controller->type == VIR_DOMAIN_CONTROLLER_TYPE_USB) {
+            if (controller->model == VIR_DOMAIN_CONTROLLER_MODEL_USB_NONE) {
+                if (usb_other || usb_none) {
+                    virReportError(VIR_ERR_XML_DETAIL, "%s",
+                                   _("Can't add another USB controller: "
+                                     "USB is disabled for this domain"));
+                    goto error;
+                }
+                usb_none = true;
+            } else {
+                if (usb_none) {
+                    virReportError(VIR_ERR_XML_DETAIL, "%s",
+                                   _("Can't add another USB controller: "
+                                     "USB is disabled for this domain"));
+                    goto error;
+                }
+                usb_other = true;
+            }
+        }
+
         virDomainControllerInsertPreAlloced(def, controller);
     }
     VIR_FREE(nodes);
@@ -8917,6 +8941,13 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         if (!input)
             goto error;
 
+        /* Check if USB bus is required */
+        if (input->bus == VIR_DOMAIN_INPUT_BUS_USB && usb_none) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("Can't add USB input device. "
+                             "USB bus is disabled"));
+            goto error;
+        }
 
         /* With QEMU / KVM / Xen graphics, mouse + PS/2 is implicit
          * with graphics, so don't store it.
@@ -9044,6 +9075,14 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         if (!hostdev)
             goto error;
 
+        if (hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB &&
+            usb_none) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("Can't add host USB device: "
+                             "USB is disabled in this host"));
+            goto error;
+        }
+
         def->hostdevs[def->nhostdevs++] = hostdev;
     }
     VIR_FREE(nodes);
@@ -9113,6 +9152,13 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         if (!hub)
             goto error;
 
+        if (hub->type == VIR_DOMAIN_HUB_TYPE_USB && usb_none) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("Can't add USB hub: "
+                             "USB is disabled for this domain"));
+            goto error;
+        }
+
         def->hubs[def->nhubs++] = hub;
     }
     VIR_FREE(nodes);
@@ -9129,6 +9175,13 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         if (!redirdev)
             goto error;
 
+        if (redirdev->bus == VIR_DOMAIN_REDIRDEV_BUS_USB && usb_none) {
+             virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                            _("Can't add redirected USB device: "
+                              "USB is disabled for this domain"));
+            goto error;
+        }
+
         def->redirdevs[def->nredirdevs++] = redirdev;
     }
     VIR_FREE(nodes);
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 0db16933b9fa2f10a2a6a41ce4879f9667d18834..94525a34a180dc09aa3231c7b44b593ebe8175e5 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -634,6 +634,7 @@ enum virDomainControllerModelUSB {
     VIR_DOMAIN_CONTROLLER_MODEL_USB_VT82C686B_UHCI,
     VIR_DOMAIN_CONTROLLER_MODEL_USB_PCI_OHCI,
     VIR_DOMAIN_CONTROLLER_MODEL_USB_NEC_XHCI,
+    VIR_DOMAIN_CONTROLLER_MODEL_USB_NONE,
 
     VIR_DOMAIN_CONTROLLER_MODEL_USB_LAST
 };
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 403364480afa33baeef3b45b8bef17c9c1b51244..0f2adb1a0dc4f0889439ff005ad2a54b2bc1a273 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -107,7 +107,8 @@ VIR_ENUM_IMPL(qemuControllerModelUSB, VIR_DOMAIN_CONTROLLER_MODEL_USB_LAST,
               "ich9-usb-uhci3",
               "vt82c686b-usb-uhci",
               "pci-ohci",
-              "nec-usb-xhci");
+              "nec-usb-xhci",
+              "none");
 
 VIR_ENUM_DECL(qemuDomainFSDriver)
 VIR_ENUM_IMPL(qemuDomainFSDriver, VIR_DOMAIN_FS_DRIVER_TYPE_LAST,