diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 8e50b8caacdb4ea10ed795b3f088a3baf0748295..45b0f618b9b41ca9170fe1e1837c0fa46c77f0d8 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -5587,7 +5587,7 @@ qemu-kvm -net nic,model=? /dev/null
     <p>
       A shared memory device allows to share a memory region between
       different virtual machines and the host.
-      <span class="since">Since 1.2.9, QEMU and KVM only</span>
+      <span class="since">Since 1.2.10, QEMU and KVM only</span>
     </p>
 
 <pre>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 6c07ed6086722ab53795f6f69baed74a806b8343..a9c6f05d57d706b81fd9b7d4748e00da673f438f 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -17603,7 +17603,7 @@ virDomainShmemDefFormat(virBufferPtr buf,
                         virDomainShmemDefPtr def,
                         unsigned int flags)
 {
-    virBufferAsprintf(buf, "<shmem name='%s'", def->name);
+    virBufferEscapeString(buf, "<shmem name='%s'", def->name);
 
     if (!def->size &&
         !def->server.enabled &&
@@ -17618,8 +17618,7 @@ virDomainShmemDefFormat(virBufferPtr buf,
     virBufferAdjustIndent(buf, 2);
 
     if (def->size)
-        virBufferAsprintf(buf, "<size unit='M'>%llu</size>\n",
-                          VIR_DIV_UP(def->size, 1024 * 1024));
+        virBufferAsprintf(buf, "<size unit='M'>%llu</size>\n", def->size >> 20);
 
     if (def->server.enabled) {
         virBufferAddLit(buf, "<server");
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 6c22630bb32577055abdc336ba7aa16156837770..8cb0865d985f1169ed29ee5d97393f3c25d5d582 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -7549,7 +7549,7 @@ qemuBuildShmemDevCmd(virCommandPtr cmd,
         /*
          * Thanks to our parsing code, we have a guarantee that the
          * size is power of two and is at least a mebibyte in size.
-         * But because it may change inthe future, the checks are
+         * But because it may change in the future, the checks are
          * doubled in here.
          */
         if (shmem->size & (shmem->size - 1)) {
@@ -7562,8 +7562,7 @@ qemuBuildShmemDevCmd(virCommandPtr cmd,
                            _("shmem size must be at least 1 MiB"));
             goto error;
         }
-        virBufferAsprintf(&buf, ",size=%llum",
-                          VIR_DIV_UP(shmem->size, 1024 * 1024));
+        virBufferAsprintf(&buf, ",size=%llum", shmem->size >> 20);
     }
 
     if (!shmem->server.enabled) {