diff --git a/instances/jobs.py b/instances/jobs.py
index 7bb72489..21d2df8b 100644
--- a/instances/jobs.py
+++ b/instances/jobs.py
@@ -11,10 +11,12 @@ from django.utils.translation import gettext_noop
 from django.utils.translation import gettext_noop as _
 from libvirt import (VIR_CONNECT_LIST_STORAGE_POOLS_ACTIVE, VIR_DOMAIN_JOB_NONE, VIR_DOMAIN_SNAPSHOT_LIST_EXTERNAL,
                      VIR_ERR_NO_DOMAIN, VIR_ERR_NO_STORAGE_VOL, libvirtError)
+from lxml import etree
 from vrtManager import util
 from vrtManager.connection import wvmConnect
 from vrtManager.create import cpu_choices, wvmCreate
-from vrtManager.instance import check_snapshot_name, wvmInstance
+from vrtManager.instance import HOST_DEVICES, check_snapshot_name, wvmInstance
+from vrtManager.nodedevs import check_hostdevs
 
 from accounts.models import UserInstance, UserSSHKey
 from appsettings.settings import app_settings
@@ -349,6 +351,14 @@ def _current(proxy):
     return dom.snapshotCurrent(0).getName() if dom.hasCurrentSnapshot(0) else None
 
 
+def _snapshot_definitions(proxy, params):
+    """The VM's definitions in the snapshot a revert restores (as it runs,
+    and as saved), and whether they give it host devices."""
+    tree = etree.fromstring(proxy._snapshot(params["name"], params["external"]).getXMLDesc(0))
+    definitions = tree.xpath("domain | inactiveDomain")
+    return any(definition.xpath(HOST_DEVICES) for definition in definitions), definitions
+
+
 @register
 class RevertSnapshot(Kind):
     name = "snapshot.revert"
@@ -363,14 +373,20 @@ class RevertSnapshot(Kind):
         _proxy(_authorized(user, params["instance"]))._snapshot(params["name"], params["external"])
 
     def plan(self, user, params):
-        return _vm_plan(params)
+        plan = _vm_plan(params)
+        # a revert that gives the VM host devices holds the whole compute: no other VM takes them meanwhile
+        if _snapshot_definitions(_proxy(_instance(params["instance"])), params)[0]:
+            plan.claims[claims.compute_key(plan.intent["compute"])] = Claim.EXCLUSIVE
+        return plan
 
     def precheck(self, op, ctx):
         proxy = _checked_proxy(op)
         if op.params["external"]:
             proxy.check_external_revert(op.params["name"])
-        else:
-            proxy._snapshot(op.params["name"], False)
+        # a revert gives the VM the host devices it had then: not one given since to another VM
+        has_hostdevs, definitions = _snapshot_definitions(proxy, op.params)
+        if has_hostdevs:
+            check_hostdevs(proxy, proxy.instance.name(), definitions)
 
     def run(self, op, ctx):
         proxy = _proxy(_instance(op.params["instance"]))
diff --git a/instances/templates/instance.html b/instances/templates/instance.html
index f2c14567..bba4f00e 100644
--- a/instances/templates/instance.html
+++ b/instances/templates/instance.html
@@ -428,6 +428,22 @@
     });
 </script>
 <script>
+    // the Host devices tab's add form: loaded once, when the tab first opens
+    var hostUsb = document.getElementById("host-usb");
+    if (hostUsb) {
+        document.querySelector('[data-bs-target="#hostdevs"]').addEventListener("shown.bs.tab", function () {
+            if (hostUsb.dataset.loaded) return;
+            hostUsb.dataset.loaded = "true";
+            fetch(hostUsb.dataset.url).then(function (response) {
+                if (!response.ok) throw new Error(response.statusText);
+                return response.text();
+            }).then(function (html) {
+                hostUsb.innerHTML = html;
+            }).catch(function () {
+                hostUsb.textContent = "{{ _("The host's USB devices could not be read.")|escapejs }}";
+            });
+        });
+    }
     function get_osinfo() {
         show_tab('#settings');
         show_tab('#osinfo');
diff --git a/instances/templates/instances/host_usb_form.html b/instances/templates/instances/host_usb_form.html
new file mode 100644
index 00000000..6e1a812f
--- /dev/null
+++ b/instances/templates/instances/host_usb_form.html
@@ -0,0 +1,15 @@
+{% load i18n %}
+{% load bootstrap_icons %}
+{% if error %}
+<div class="alert alert-warning mb-0">{% blocktrans %}The host's devices could not be read: {{ error }}{% endblocktrans %}</div>
+{% else %}
+<form method="post" action="{% url 'instances:add_usb_hostdev' instance.id %}" class="d-flex flex-wrap gap-2">{% csrf_token %}
+    <select name="usb_device" class="form-select w-auto mw-100" aria-label="{% trans "USB device of the host" %}" required>
+        <option value="" selected disabled>{% trans "Choose a USB device of the host…" %}</option>
+        {% for device in host_usb %}
+        <option value="{{ device.bus }}/{{ device.device }}"{% if device.problems %} disabled{% endif %}>{{ device.product }} ({{ device.ids }}, {{ device.bus }}/{{ device.device }}){% if device.problems %}: {{ device.problems|join:"; " }}{% endif %}</option>
+        {% endfor %}
+    </select>
+    <button type="submit" class="btn btn-primary">{% bs_icon 'plus-lg' %} {% trans "Add USB device" %}</button>
+</form>
+{% endif %}
diff --git a/instances/templates/instances/settings_tab.html b/instances/templates/instances/settings_tab.html
index b3d727a4..63e39448 100644
--- a/instances/templates/instances/settings_tab.html
+++ b/instances/templates/instances/settings_tab.html
@@ -38,6 +38,13 @@
                 </button>
             </li>
         {% endif %}
+        {% if show_hostdevs %}
+            <li class="nav-item" role="presentation">
+                <button class="nav-link" data-bs-toggle="tab" data-bs-target="#hostdevs" type="button" role="tab" aria-controls="hostdevs" aria-selected="false">
+                    {% trans "Host devices" %}
+                </button>
+            </li>
+        {% endif %}
         {% if can_clone %}
             <li class="nav-item" role="presentation">
                 <button class="nav-link" data-bs-toggle="tab" data-bs-target="#clone" type="button" role="tab" aria-controls="clone" aria-selected="false">
@@ -395,6 +402,8 @@
                                     </div>
                                 </td>
                                 <td>
+                                    {# a NIC that is a host device is changed in the XML editor #}
+                                    {% if network.type != "hostdev" %}
                                     <form action="{% url 'instances:change_network' instance.id %}" method="post" name="edit_network{{ forloop.counter0 }}" role="form">{% csrf_token %}
                                         <button class="btn btn-sm btn-primary"
                                                 type="button"
@@ -467,6 +476,7 @@
                                             </div>
                                         </div>
                                     </form>
+                                    {% endif %}
                                 </td>
                                 <td>
                                     <form action="{% url 'instances:set_qos' instance.id %}" method="post" name="add_qos{{ forloop.counter0 }}" role="form" aria-label="Add network qos form">
@@ -476,12 +486,14 @@
                                     </form>
                                 </td>
                                 <td>
+                                    {% if network.type != "hostdev" %}
                                     <form action="{% url 'instances:delete_network' instance.id %}" method="post" name="delete_network" role="form">{% csrf_token %}
                                         <button class="btn btn-sm btn-danger" value="{{ network.mac }}" name="delete_network" title="{% trans "Delete Device" %}"
  data-confirm="{% blocktrans with mac=network.mac %}Remove network card {{ mac }}? A running VM loses its connection through it at once.{% endblocktrans %}" onclick="return confirm(this.dataset.confirm)">
                                             {% bs_icon 'trash' %}
                                         </button>
                                     </form>
+                                    {% endif %}
                                 </td>
                             </tr>
                             <tr>
@@ -582,6 +594,63 @@
             {% endif %}
             <div class="clearfix"></div>
         </div>
+        {% if show_hostdevs %}
+        <div role="tabpanel" class="tab-pane border border-top-0 p-3" id="hostdevs">
+            <p class="small text-body-secondary">{% trans "Devices of the host given to the VM. The VM starts only on a host that has them; it is not migrated while it has them, and its clones get none." %}</p>
+            {% if request.user.is_superuser %}
+            {# the add form comes when the tab opens: its choices scan every VM of the host #}
+            <div id="host-usb" class="mb-3" data-url="{% url 'instances:host_usb' instance.id %}">
+                <span class="small text-body-secondary">{% trans "Reading the host's USB devices…" %}</span>
+            </div>
+            {% endif %}
+            {% if usb_hostdevs %}
+            <div class="table-responsive position-relative">
+                <table class="table align-middle">
+                    <thead>
+                        <tr>
+                            <th scope="col">{% trans "USB device" %}</th>
+                            <th scope="col">{% trans "Chosen by" %}</th>
+                            <th scope="col">{% trans "Running VM" %}</th>
+                            <th scope="col">{% trans "Next start" %}</th>
+                            {% if request.user.is_superuser %}<th scope="col"><span class="visually-hidden">{% trans "Actions" %}</span></th>{% endif %}
+                        </tr>
+                    </thead>
+                    <tbody>
+                    {% for device in usb_hostdevs %}
+                        <tr>
+                            <td>{{ device.name|default:"–" }} <span class="small text-body-secondary font-monospace">{{ device.vendor|slice:"2:" }}:{{ device.product|slice:"2:" }}</span></td>
+                            <td>{% if device.address %}{% blocktrans with bus=device.address.0 device=device.address.1 %}Its address {{ bus }}/{{ device }}{% endblocktrans %}{% else %}{% trans "Its model: any device of it" %}{% endif %}</td>
+                            <td>{% if device.now %}{% blocktrans with bus=device.now.0 device=device.now.1 %}Has {{ bus }}/{{ device }}{% endblocktrans %}{% else %}–{% endif %}</td>
+                            <td>{% if device.next %}{% trans "Yes" %}{% else %}{% trans "No" %}{% endif %}</td>
+                            {% if request.user.is_superuser %}
+                            <td class="text-end">
+                                <form method="post" action="{% url 'instances:delete_usb_hostdev' instance.id %}">{% csrf_token %}
+                                    <input type="hidden" name="vendor" value="{{ device.vendor }}">
+                                    <input type="hidden" name="product" value="{{ device.product }}">
+                                    <input type="hidden" name="address" value="{% if device.address %}{{ device.address.0 }}/{{ device.address.1 }}{% endif %}">
+                                    <button type="submit" class="btn btn-sm btn-outline-danger" aria-label="{% trans "Remove the USB device" %}"
+                                            data-confirm="{% trans "Remove this USB device from the VM? A running VM loses it at once." %}"
+                                            onclick="return confirm(this.dataset.confirm)">{% bs_icon 'trash' %}</button>
+                                </form>
+                            </td>
+                            {% endif %}
+                        </tr>
+                    {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+            {% endif %}
+            {% for device in other_hostdevs %}
+            <p class="mb-1">
+                {% if device.type == "nic" %}{% trans "Network interface" %}{% else %}{{ device.type|upper }}{% endif %} <span class="font-monospace">{{ device.address }}</span>
+                <span class="small text-body-secondary">{% if device.now and device.next %}{% trans "running VM and next start" %}{% elif device.now %}{% trans "running VM only" %}{% else %}{% trans "next start only" %}{% endif %}; {% trans "changed in the XML editor" %}</span>
+            </p>
+            {% endfor %}
+            {% if not usb_hostdevs and not other_hostdevs %}
+            <p class="small text-body-secondary mb-0">{% trans "The VM has no host devices." %}</p>
+            {% endif %}
+        </div>
+        {% endif %}
         <div role="tabpanel" class="tab-pane border border-top-0 p-3" id="migrate">
             <p>{% trans "For migration both host servers must have equal settings and OS type" %}</p>
             <form action="{% url 'instances:migrate' instance.id %}" class="ms-3 form" method="post" role="form" aria-label="Migrate instance form">
@@ -739,6 +808,7 @@
         {% if can_clone %}
         <div role="tabpanel" class="tab-pane border border-top-0 p-3" id="clone">
             <p class="fw-bold">{% trans "Create a clone" %}</p>
+            {% if usb_hostdevs or other_hostdevs %}<p class="small text-body-secondary">{% trans "The clone gets none of the VM's host devices: one VM holds a device of the host." %}</p>{% endif %}
             <form class="form" action="{% url 'instances:clone' instance.id %}" method="post" role="form" aria-label="Create clone form">{% csrf_token %}{% submission_key %}
                 <div class="row">
                     <label class="col-sm-3 col-form-label fw-normal">{% trans "Clone Name" %}</label>
diff --git a/instances/tests/test_console_listener.py b/instances/tests/test_console_listener.py
index 9553570d..7b057650 100644
--- a/instances/tests/test_console_listener.py
+++ b/instances/tests/test_console_listener.py
@@ -69,6 +69,7 @@ class ConsoleListenerTests(TestCase):
             proxy.get_console_listener_addr.return_value = "127.0.0.1"
             for name in ("get_networks", "get_ifaces", "get_storages", "get_disk_devices", "get_media_devices", "get_net_devices"):
                 getattr(proxy, name).return_value = []
+            proxy.get_hostdevs.return_value = ([], [])
             proxy.get_status.return_value = 5
             response = self.client.get(reverse("instances:instance", args=[self.vm.id]))
         form = response.context["console_form"]
diff --git a/instances/tests/test_console_settings_access.py b/instances/tests/test_console_settings_access.py
index b9195803..9a26885f 100644
--- a/instances/tests/test_console_settings_access.py
+++ b/instances/tests/test_console_settings_access.py
@@ -61,6 +61,7 @@ class ConsoleSettingsAccessTestCase(TestCase):
             proxy.get_max_memory.return_value = 4096
             proxy.get_networks.return_value = []
             proxy.get_ifaces.return_value = []
+            proxy.get_hostdevs.return_value = ([], [])
             proxy.get_storages.return_value = []
             proxy.get_console_passwd.return_value = VNC_PASSWORD
             proxy.get_console_type.return_value = "vnc"
diff --git a/instances/tests/test_host_devices.py b/instances/tests/test_host_devices.py
new file mode 100644
index 00000000..a45dd252
--- /dev/null
+++ b/instances/tests/test_host_devices.py
@@ -0,0 +1,230 @@
+"""A VM's host devices: USB devices of its host given and taken back, each
+named once whether the running VM or its next start has it; the checks that
+keep a device to one VM and away from what the host uses itself, also for a
+snapshot revert; clones get none, and a VM with any is not migrated."""
+
+import unittest
+from unittest.mock import MagicMock, patch
+
+import libvirt
+from computes.models import Compute
+from django.contrib.auth import get_user_model
+from django.contrib.messages import get_messages
+from django.test import SimpleTestCase, TestCase
+from django.urls import reverse
+from instances.models import Instance
+from lxml import etree, html
+from nodedevs.tests.test_nodedevs import NODES, node
+from vrtManager.instance import wvmInstance
+from vrtManager.util import OperationError
+
+from vrtManager.tests.test_migration import FakeSource, destination, with_disks
+
+MIGRATABLE = libvirt.VIR_DOMAIN_XML_MIGRATABLE
+CONTROLLER = "<controller type='usb' model='qemu-xhci'/>"
+BY_MODEL = "<hostdev mode='subsystem' type='usb' managed='yes'><source{auto}><vendor id='0x0627'/><product id='0x0001'/>{address}</source></hostdev>"
+
+
+def by_model(address="", auto=""):
+    return BY_MODEL.format(address=address, auto=auto)
+
+
+def domain(*devices):
+    return f"<domain><name>kiosk-1</name><devices>{''.join(devices)}</devices></domain>"
+
+
+def vm(running, saved, active=True, migratable=None):
+    """A wvmInstance whose running VM is running, as XMLDesc gives it (and as
+    the migratable XML marks it), and whose next start is saved."""
+    proxy = wvmInstance.__new__(wvmInstance)
+    proxy._read_cache = None
+    proxy.instance = MagicMock(**{"isActive.return_value": active})
+
+    def describe(flags=0):
+        if flags & libvirt.VIR_DOMAIN_XML_INACTIVE:
+            return saved
+        return migratable if flags & MIGRATABLE and migratable else running
+    proxy.instance.XMLDesc.side_effect = describe
+    return proxy
+
+
+class UsbHostdevTests(SimpleTestCase):
+    def test_a_device_chosen_by_model_is_one_row_with_the_device_it_holds(self):
+        # the running VM writes the address libvirt resolved; only its migratable XML marks it
+        proxy = vm(domain(CONTROLLER, by_model("<address bus='1' device='3'/>")), domain(CONTROLLER, by_model()),
+                   migratable=domain(CONTROLLER, by_model("<address bus='1' device='3'/>", " autoAddress='yes'")))
+        usb, others = proxy.get_hostdevs()
+        self.assertEqual(usb, [{"vendor": "0x0627", "product": "0x0001", "address": None, "now": (1, 3), "next": True}])
+        self.assertEqual(others, [])
+
+    def test_a_device_is_taken_from_each_definition_as_it_describes_it(self):
+        proxy = vm(domain(CONTROLLER, by_model("<address bus='1' device='3'/>")), domain(CONTROLLER, by_model()),
+                   migratable=domain(CONTROLLER, by_model("<address bus='1' device='3'/>", " autoAddress='yes'")))
+        proxy.delete_usb_hostdev(("0x0627", "0x0001", None))
+        live, config = proxy.instance.detachDeviceFlags.call_args_list
+        self.assertEqual(live.args[1], libvirt.VIR_DOMAIN_AFFECT_LIVE)
+        self.assertEqual(etree.fromstring(live.args[0]).xpath("string(source/address/@device)"), "3")
+        self.assertEqual((config.args[1], etree.fromstring(config.args[0]).find("source/address")),
+                         (libvirt.VIR_DOMAIN_AFFECT_CONFIG, None))
+        with self.assertRaisesRegex(OperationError, "no such USB device"):
+            proxy.delete_usb_hostdev(("0x0627", "0x0001", (1, 2)))
+
+    def test_a_device_is_given_by_model_or_by_address_with_a_usb_controller(self):
+        proxy = vm(domain(CONTROLLER), domain(CONTROLLER))
+        proxy.add_usb_hostdev("0x0627", "0x0001", (1, 3))
+        added = etree.fromstring(proxy.instance.attachDeviceFlags.call_args.args[0])
+        self.assertEqual((added.get("type"), added.xpath("string(source/vendor/@id)"), added.xpath("string(source/address/@device)")),
+                         ("usb", "0x0627", "3"))
+        for xml in (domain(), domain("<controller type='usb' model='none'/>")):
+            proxy = vm(xml, xml, active=False)
+            with self.subTest(xml=xml), self.assertRaisesRegex(OperationError, "no USB controller"):
+                proxy.add_usb_hostdev("0x0627", "0x0001")
+            proxy.instance.attachDeviceFlags.assert_not_called()
+
+    def test_a_device_the_host_has_one_of_is_given_by_model(self):
+        proxy = vm(domain(CONTROLLER), domain(CONTROLLER))
+        proxy.add_usb_hostdev("0x0627", "0x0001")
+        self.assertIsNone(etree.fromstring(proxy.instance.attachDeviceFlags.call_args.args[0]).find("source/address"))
+
+    def test_other_host_devices_as_the_running_vm_and_its_next_start_have_them(self):
+        pci = "<hostdev mode='subsystem' type='pci'><source><address domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/></source></hostdev>"
+        nic = "<interface type='hostdev'><source><address type='pci' domain='0x0000' bus='0x00' slot='0x0b' function='0x0'/></source></interface>"
+        network_nic = ("<interface type='network'><source network='sriov'/><actual type='hostdev'><source>"
+                       "<address type='pci' domain='0x0000' bus='0x00' slot='0x0c' function='0x1'/></source></actual></interface>")
+        mdev = "<hostdev mode='subsystem' type='mdev'><source><address uuid='{}'/></source></hostdev>"
+        running = domain(pci, nic, network_nic, mdev.format("00000000-0000-4000-8000-00000000a001"))
+        _, others = vm(running, domain(nic, mdev.format("00000000-0000-4000-8000-00000000a002"))).get_hostdevs()
+        self.assertEqual(others, [{"type": "pci", "address": "0000:00:0a.0", "now": True, "next": False},
+                                  {"type": "nic", "address": "0000:00:0b.0", "now": True, "next": True},
+                                  {"type": "nic", "address": "0000:00:0c.1", "now": True, "next": False},
+                                  {"type": "mdev", "address": "00000000-0000-4000-8000-00000000a001", "now": True, "next": False},
+                                  {"type": "mdev", "address": "00000000-0000-4000-8000-00000000a002", "now": False, "next": True}])
+
+    def test_a_nic_that_is_a_host_device_is_left_to_the_xml_editor(self):
+        nic = "<interface type='hostdev'><mac address='52:54:00:00:00:0a'/><source><address type='pci' bus='0x00' slot='0x0a'/></source></interface>"
+        proxy = vm(domain(nic), domain(nic))
+        with self.assertRaisesRegex(OperationError, "XML editor"):
+            proxy.delete_network("52:54:00:00:00:0a")
+        with self.assertRaisesRegex(OperationError, "XML editor"):
+            proxy.change_network("52:54:00:00:00:0a", "52:54:00:00:00:0b", "default", "net", "virtio", "")
+        proxy.instance.detachDeviceFlags.assert_not_called()
+
+    def test_a_clone_gets_no_host_device_and_its_nics_keep_their_numbers(self):
+        proxy = vm("", domain(by_model(),
+                              "<interface type='hostdev'><mac address='52:54:00:00:00:0a'/></interface>",
+                              "<interface type='network'><mac address='52:54:00:00:00:0b'/><source network='default'/></interface>"))
+        proxy.get_instances = lambda: []
+        tree, _ = proxy._clone_definition({"name": "kiosk-2", "clone-net-mac-1": "52:54:00:00:00:1b"},
+                                          "99999999-2222-3333-4444-555555555555")
+        self.assertEqual(tree.xpath("devices/hostdev"), [])
+        self.assertEqual(tree.xpath("devices/interface/mac/@address"), ["52:54:00:00:00:1b"])
+
+
+class MigrationTests(unittest.TestCase):
+    def test_a_vm_with_host_devices_is_not_migrated(self):
+        for devices, state in ((by_model(), 1), (by_model(), 5), ("<hostdev mode='subsystem' type='pci'/>", 1)):
+            source = FakeSource(state, xml=with_disks(devices))
+            with self.subTest(state=state), self.assertRaisesRegex(OperationError, "host devices cannot be migrated"):
+                destination().moveto(source, "vm", live=state == 1, unsafe=False, offline=state == 5)
+            self.assertEqual(source.instance.calls, [])
+
+
+class HostUsbViewTests(TestCase):
+    def setUp(self):
+        self.compute = Compute.objects.create(name="hd", hostname="192.0.2.31", login="root", password="", type=1)
+        self.instance = Instance.objects.create(compute=self.compute, name="kiosk-1", uuid="00000000-0000-4000-8000-0000000000e1")
+        self.client.force_login(get_user_model().objects.create_superuser("hd", "hd@example.com", "pw"))
+        patcher = patch("instances.models.wvmInstance")
+        self.proxy = patcher.start().return_value
+        self.addCleanup(patcher.stop)
+        # the host of the node device fixture; another VM holds tablet 1/3 by address
+        other = MagicMock(**{"name.return_value": "db-1", "isPersistent.return_value": False,
+                             "XMLDesc.return_value": domain(by_model("<address bus='1' device='3'/>"))})
+        self.proxy.wvm.listAllDevices.return_value = [node(*n) for n in NODES]
+        self.proxy.domain_trees.side_effect = lambda: [("db-1", [etree.fromstring(other.XMLDesc())])]
+
+    def test_the_form_offers_what_can_be_given_and_says_why_not(self):
+        page = html.fromstring(self.client.get(reverse("instances:host_usb", args=[self.instance.id])).content)
+        options = {o.get("value"): (o.get("disabled") is not None, o.text_content()) for o in page.xpath("//option[@value!='']")}
+        self.assertEqual(sorted(options), ["1/1", "1/2", "1/3"])
+        self.assertTrue(options["1/1"][0] and "is a hub" in options["1/1"][1])
+        self.assertTrue(options["1/3"][0] and "is given to db-1" in options["1/3"][1])
+        self.assertFalse(options["1/2"][0])
+        # a device the VM has already
+        self.proxy.domain_trees.side_effect = lambda: [("kiosk-1", [etree.fromstring(domain(by_model("<address bus='1' device='2'/>")))])]
+        page = html.fromstring(self.client.get(reverse("instances:host_usb", args=[self.instance.id])).content)
+        self.assertEqual(page.xpath("//option[@value='1/2']/@disabled"), ["disabled"])
+
+    def test_a_device_is_given_by_address_when_the_host_has_several_of_its_model(self):
+        url = reverse("instances:add_usb_hostdev", args=[self.instance.id])
+        response = self.client.post(url, {"usb_device": "1/2"})
+        self.assertEqual(response.status_code, 302)
+        self.proxy.add_usb_hostdev.assert_called_once_with("0x0627", "0x0001", (1, 2))
+        # refused on the server too: another VM's device, a hub
+        for chosen, why in (("1/3", "is given to db-1"), ("1/1", "is a hub"), ("9/9", "has no USB device")):
+            response = self.client.post(url, {"usb_device": chosen})
+            with self.subTest(chosen=chosen):
+                self.assertIn(why, " ".join(str(m) for m in get_messages(response.wsgi_request)))
+        self.assertEqual(self.proxy.add_usb_hostdev.call_count, 1)
+
+    def test_a_device_is_given_by_model_when_the_host_has_one_of_it(self):
+        self.proxy.wvm.listAllDevices.return_value = [node(*n) for n in NODES if n[0] not in ("usb_1_2", "usb_1_2_1_0")]
+        self.client.post(reverse("instances:add_usb_hostdev", args=[self.instance.id]), {"usb_device": "1/2"})
+        self.proxy.add_usb_hostdev.assert_called_once_with("0x0627", "0x0001", None)
+
+    def test_a_device_is_taken_back_by_its_selector(self):
+        url = reverse("instances:delete_usb_hostdev", args=[self.instance.id])
+        self.client.post(url, {"vendor": "0x0627", "product": "0x0001", "address": ""})
+        self.client.post(url, {"vendor": "0x0627", "product": "0x0001", "address": "1/3"})
+        self.assertEqual([c.args[0] for c in self.proxy.delete_usb_hostdev.call_args_list],
+                         [("0x0627", "0x0001", None), ("0x0627", "0x0001", (1, 3))])
+
+    def test_only_superusers(self):
+        self.client.force_login(get_user_model().objects.create_user("hd-user", "u@example.com", "pw"))
+        self.assertEqual(self.client.get(reverse("instances:host_usb", args=[self.instance.id])).status_code, 403)
+        self.client.post(reverse("instances:add_usb_hostdev", args=[self.instance.id]), {"usb_device": "1/2"})
+        self.proxy.add_usb_hostdev.assert_not_called()
+
+
+class RevertTests(TestCase):
+    """A revert gives the VM the host devices of the snapshot, as it ran and
+    as saved: not one another VM names; and it holds the compute meanwhile."""
+
+    def setUp(self):
+        from instances.jobs import RevertSnapshot
+
+        self.kind = RevertSnapshot()
+        compute = Compute.objects.create(name="rv", hostname="192.0.2.32", login="root", password="", type=1)
+        self.instance = Instance.objects.create(compute=compute, name="kiosk-1", uuid="00000000-0000-4000-8000-0000000000e2")
+        patcher = patch("instances.jobs.wvmInstance")
+        self.proxy = patcher.start().return_value
+        self.addCleanup(patcher.stop)
+        self.proxy.instance.name.return_value = "kiosk-1"
+        self.proxy.wvm.listAllDevices.return_value = [node(*n) for n in NODES]
+        self.proxy.domain_trees.side_effect = lambda: [("db-1", [etree.fromstring(domain(by_model("<address bus='1' device='3'/>")))])]
+        self.params = {"instance": self.instance.id, "name": "s1", "external": False}
+
+    def snapshot(self, running, saved=None):
+        saved = f"<inactiveDomain><devices>{saved}</devices></inactiveDomain>" if saved is not None else ""
+        self.proxy._snapshot.return_value.getXMLDesc.return_value = \
+            f"<domainsnapshot><domain><devices>{running}</devices></domain>{saved}</domainsnapshot>"
+
+    def precheck(self):
+        op = MagicMock(params=self.params, intent={"compute": self.instance.compute_id}, user=MagicMock(is_superuser=True))
+        with patch("instances.jobs._authorized", return_value=self.instance):
+            self.kind.precheck(op, None)
+
+    def test_a_device_another_vm_names_is_not_given_back(self):
+        for running, saved in ((by_model(), None), ("", by_model())):  # the saved definition counts too
+            self.snapshot(running, saved)
+            with self.subTest(saved=saved), self.assertRaisesRegex(OperationError, "is given to db-1"):
+                self.precheck()
+
+    def test_the_compute_is_held_only_for_a_revert_with_host_devices(self):
+        compute = f"compute:{self.instance.compute_id}"
+        self.snapshot(by_model())
+        self.assertEqual(self.kind.plan(None, self.params).claims[compute], "exclusive")
+        self.snapshot("")
+        self.assertEqual(self.kind.plan(None, self.params).claims[compute], "shared")
+        self.precheck()  # no host device: the host's devices are not read
+        self.proxy.wvm.listAllDevices.assert_not_called()
diff --git a/instances/tests/test_page_controls.py b/instances/tests/test_page_controls.py
index 739670db..80beb392 100644
--- a/instances/tests/test_page_controls.py
+++ b/instances/tests/test_page_controls.py
@@ -72,6 +72,7 @@ class PageControls:
                            "get_media_devices", "get_net_devices", "get_snapshot",
                            "get_snapshot_jobs"):
                 getattr(proxy, getter).return_value = []
+            proxy.get_hostdevs.return_value = ([], [])
             proxy.get_console_type.return_value = "vnc"
             proxy.get_status.return_value = status
             response = self.client.get(reverse("instances:instance", args=[self.instance.id]))
diff --git a/instances/tests/test_pending_edits.py b/instances/tests/test_pending_edits.py
index 77612ef3..6c1e5ca4 100644
--- a/instances/tests/test_pending_edits.py
+++ b/instances/tests/test_pending_edits.py
@@ -47,6 +47,7 @@ class PendingEditsTestCase(TestCase):
             for getter in ("get_networks", "get_ifaces", "get_storages", "get_media_devices", "get_net_devices",
                            "get_snapshot", "get_snapshot_jobs"):
                 getattr(proxy, getter).return_value = []
+            proxy.get_hostdevs.return_value = ([], [])
             proxy.get_disk_devices.side_effect = lambda **kw: config if kw.get("config") else live
             proxy.get_all_qos.side_effect = lambda **kw: qos[1] if kw.get("config") else qos[0]
             proxy.get_console_type.return_value = "vnc"
diff --git a/instances/tests/test_quota.py b/instances/tests/test_quota.py
index c7322526..3183f629 100644
--- a/instances/tests/test_quota.py
+++ b/instances/tests/test_quota.py
@@ -205,6 +205,7 @@ class DetailPageQuotaTests(TestCase):
             proxy.get_max_memory.return_value = 4096
             for name in ("get_networks", "get_ifaces", "get_storages", "get_disk_devices", "get_media_devices", "get_net_devices"):
                 getattr(proxy, name).return_value = []
+            proxy.get_hostdevs.return_value = ([], [])
             proxy.get_status.return_value = 5
             response = self.client.get(reverse("instances:instance", args=[vm.id]))
         self.assertEqual(response.status_code, 200)
diff --git a/instances/tests/test_snapshot_jobs.py b/instances/tests/test_snapshot_jobs.py
index fa98a9de..7a65c382 100644
--- a/instances/tests/test_snapshot_jobs.py
+++ b/instances/tests/test_snapshot_jobs.py
@@ -27,6 +27,7 @@ class SnapshotJobsTestCase(TransactionTestCase):
         self.proxy = patcher.start().return_value
         self.addCleanup(patcher.stop)
         self.proxy.instance.snapshotListNames.return_value = []
+        self.proxy._snapshot.return_value.getXMLDesc.return_value = "<domainsnapshot><domain/></domainsnapshot>"
         self.proxy.instance.isActive.return_value = False
         self.proxy.instance.hasCurrentSnapshot.return_value = 0
 
diff --git a/instances/tests/test_snapshot_views.py b/instances/tests/test_snapshot_views.py
index e899b08e..980ceb8c 100644
--- a/instances/tests/test_snapshot_views.py
+++ b/instances/tests/test_snapshot_views.py
@@ -101,6 +101,7 @@ class SnapshotTabTestCase(TestCase):
             for getter in ("get_networks", "get_ifaces", "get_storages", "get_disk_devices",
                            "get_media_devices", "get_net_devices"):
                 getattr(proxy, getter).return_value = []
+            proxy.get_hostdevs.return_value = ([], [])
             proxy.get_snapshot.side_effect = lambda flag: {
                 libvirt.VIR_DOMAIN_SNAPSHOT_LIST_INTERNAL: list(internal),
                 libvirt.VIR_DOMAIN_SNAPSHOT_LIST_EXTERNAL: list(external),
diff --git a/instances/tests/test_states.py b/instances/tests/test_states.py
index 08b153d0..c2d7a858 100644
--- a/instances/tests/test_states.py
+++ b/instances/tests/test_states.py
@@ -221,6 +221,7 @@ class DetailStateTests(TestCase):
                 proxy.get_max_memory.return_value = 4096
                 for name in ("get_networks", "get_ifaces", "get_storages", "get_disk_devices", "get_media_devices", "get_net_devices"):
                     getattr(proxy, name).return_value = []
+                proxy.get_hostdevs.return_value = ([], [])
                 proxy.get_status.return_value = state
                 page = self.client.get(reverse("instances:instance", args=[vm.id])).content.decode()
                 self.assertIn(f'">{label}</span>', page.replace("\n", "").replace("  ", ""))
diff --git a/instances/tests/test_xss.py b/instances/tests/test_xss.py
index fc830c40..bce5dfdb 100644
--- a/instances/tests/test_xss.py
+++ b/instances/tests/test_xss.py
@@ -137,6 +137,7 @@ ALLOWED_HTML_SINKS = {
     ("accounts/templates/login.html", "$btn.html("): "static spinner markup",
     ("accounts/templates/accounts/otp_login.html", "$btn.html("): "static spinner markup",
     ("instances/templates/instance.html", "//sto_input.innerHTML = pool;"): "comment",
+    ("instances/templates/instance.html", "hostUsb.innerHTML = html;"): "the panel's own fragment, host_usb_form.html, escaped by Django",
 }
 
 
diff --git a/instances/urls.py b/instances/urls.py
index 244f195e..0d2b146e 100755
--- a/instances/urls.py
+++ b/instances/urls.py
@@ -57,6 +57,9 @@ urlpatterns = [
     path("<int:pk>/change_network/", views.change_network, name="change_network"),
     path("<int:pk>/add_network/", views.add_network, name="add_network"),
     path("<int:pk>/delete_network/", views.delete_network, name="delete_network"),
+    path("<int:pk>/host_usb/", views.host_usb, name="host_usb"),
+    path("<int:pk>/add_usb_hostdev/", views.add_usb_hostdev, name="add_usb_hostdev"),
+    path("<int:pk>/delete_usb_hostdev/", views.delete_usb_hostdev, name="delete_usb_hostdev"),
     path("<int:pk>/set_link_state/", views.set_link_state, name="set_link_state"),
     path("<int:pk>/set_qos/", views.set_qos, name="set_qos"),
     path("<int:pk>/unset_qos/", views.unset_qos, name="unset_qos"),
diff --git a/instances/views.py b/instances/views.py
index 17c891bb..065bf1b1 100755
--- a/instances/views.py
+++ b/instances/views.py
@@ -49,6 +49,7 @@ from vrtManager import util
 from vrtManager.create import cpu_choices, wvmCreate
 from vrtManager.instance import USAGE_MAX_WINDOW
 from vrtManager.interface import wvmInterface
+from vrtManager.nodedevs import hostdev_problems, node_devices, usb_names
 from vrtManager.storage import wvmStorage
 from vrtManager.util import randomPasswd
 
@@ -308,6 +309,15 @@ def _instance_page(request, pk, instance, compute):
         instance.drbd = drbd_status(request, pk)
         instance.save()
 
+    usb_hostdevs, other_hostdevs = instance.proxy.get_hostdevs()
+    if usb_hostdevs:
+        names = usb_names(instance.proxy)
+        for row in usb_hostdevs:
+            row["name"] = names.get((row["vendor"], row["product"]), "")
+    # owners see the devices their VM has; only superusers change them
+    show_hostdevs = request.user.is_superuser or bool(usb_hostdevs or other_hostdevs)
+    show_settings = show_settings or show_hostdevs
+
     job_resource = claims.instance_key(instance.uuid)
     return render(request, "instance.html", locals(),)
 
@@ -1785,6 +1795,65 @@ def delete_network(request, pk):
     return _back(request, pk, "network")
 
 
+def _host_usb(instance):
+    """The host's USB devices, each with why it cannot be given to the VM
+    (hostdev_problems; none: it can) and how the VM would name it: by its
+    address when the host has more than one of its model, else by model."""
+    _pci, usb = node_devices(instance.proxy)
+    for device in usb:
+        address = (device["bus"], device["device"]) if device["same_model"] else None
+        device["selector"] = (*device["model"], address)
+        device["problems"] = hostdev_problems(instance.name, [], [device], set(), [device["selector"]])
+        if instance.name in device["vms"]:
+            device["problems"].append(_("The VM has it"))
+    return usb
+
+
+@superuser_only
+def host_usb(request, pk):
+    """The add form of the Host devices tab, loaded when the tab opens: its
+    choices scan every VM of the host."""
+    instance = get_instance(request.user, pk)
+    try:
+        context = {"instance": instance, "host_usb": _host_usb(instance)}
+    except libvirtError as err:
+        context = {"instance": instance, "error": err}
+    return render(request, "instances/host_usb_form.html", context)
+
+
+@require_POST
+@superuser_only
+@serialize_compute_mutation
+def add_usb_hostdev(request, pk):
+    """Gives the VM a USB device of its host; checked under the compute's
+    claim, so no other VM gets it meanwhile."""
+    instance = get_instance(request.user, pk)
+    chosen = request.POST.get("usb_device", "")
+    device = next((d for d in _host_usb(instance) if f"{d['bus']}/{d['device']}" == chosen), None)
+    if device is None:
+        messages.error(request, _("The host has no USB device %(device)s") % {"device": chosen})
+    elif device["problems"]:
+        messages.error(request, "; ".join(device["problems"]))
+    else:
+        vendor, product, address = device["selector"]
+        with audit_vm(request, instance, f"add USB device {device['ids']} ({device['product']})"):
+            instance.proxy.add_usb_hostdev(vendor, product, address)
+    return _back(request, pk, "hostdevs")
+
+
+@require_POST
+@superuser_only
+@serialize_instance_mutation
+def delete_usb_hostdev(request, pk):
+    instance = get_instance(request.user, pk)
+    vendor, product = request.POST.get("vendor", ""), request.POST.get("product", "")
+    bus, _sep, device = request.POST.get("address", "").partition("/")
+    address = (int(bus), int(device)) if bus.isdigit() and device.isdigit() else None
+    with audit_vm(request, instance, f"remove USB device {vendor[2:]}:{product[2:]}"):
+        instance.proxy.delete_usb_hostdev((vendor, product, address))
+    return _back(request, pk, "hostdevs")
+
+
 @require_POST
 @superuser_only
 @serialize_instance_mutation
diff --git a/nodedevs/tests/test_nodedevs.py b/nodedevs/tests/test_nodedevs.py
index edaa120e..48881957 100644
--- a/nodedevs/tests/test_nodedevs.py
+++ b/nodedevs/tests/test_nodedevs.py
@@ -13,7 +13,8 @@ from django.test import SimpleTestCase, TestCase
 from django.urls import reverse
 from instances.models import Instance
 from lxml import html
-from vrtManager.nodedevs import pci_address, wvmNodeDevices
+from vrtManager.connection import wvmConnect
+from vrtManager.nodedevs import node_devices, pci_address
 
 
 def pci(slot, product, code, driver=None, group=None):
@@ -76,10 +77,10 @@ USB_MODEL = "<hostdev mode='subsystem' type='usb'><source><vendor id='0x0627'/><
 
 
 def devices(nodes=NODES, domains=()):
-    conn = wvmNodeDevices.__new__(wvmNodeDevices)
+    conn = wvmConnect.__new__(wvmConnect)
     conn.wvm = MagicMock(**{"listAllDevices.return_value": [node(*n) for n in nodes],
                             "listAllDomains.return_value": list(domains)})
-    return conn.get_node_devices()
+    return node_devices(conn)
 
 
 class NodeDevicesTests(SimpleTestCase):
@@ -140,13 +141,13 @@ class NodeDevicesTests(SimpleTestCase):
             err.get_error_code = lambda code=code: code
             gone = node("pci_0000_00_0b_0", "")
             gone.XMLDesc.side_effect = err
-            conn = wvmNodeDevices.__new__(wvmNodeDevices)
+            conn = wvmConnect.__new__(wvmConnect)
             conn.wvm = MagicMock(**{"listAllDevices.return_value": [gone, node(*NODES[0])], "listAllDomains.return_value": []})
             with self.subTest(code=code):
                 if raised:
-                    self.assertRaises(libvirt.libvirtError, conn.get_node_devices)
+                    self.assertRaises(libvirt.libvirtError, node_devices, conn)
                 else:
-                    self.assertEqual([d["address"] for d in conn.get_node_devices()[0]], ["0000:00:06.0"])
+                    self.assertEqual([d["address"] for d in node_devices(conn)[0]], ["0000:00:06.0"])
 
     def test_a_pci_address_from_libvirts_hex_or_numbers(self):
         self.assertEqual(pci_address("0x0000", "0x00", "0x1f", "0x3"), pci_address(0, 0, 31, 3))
diff --git a/nodedevs/views.py b/nodedevs/views.py
index c4ba333b..1bd7568c 100644
--- a/nodedevs/views.py
+++ b/nodedevs/views.py
@@ -4,7 +4,8 @@ from django.contrib import messages
 from django.shortcuts import get_object_or_404, render
 from instances.models import Instance
 from libvirt import libvirtError
-from vrtManager.nodedevs import wvmNodeDevices
+from vrtManager.connection import wvmConnect
+from vrtManager.nodedevs import node_devices
 
 
 @superuser_only
@@ -14,8 +15,7 @@ def nodedevs(request, compute_id):
     compute = get_object_or_404(Compute, pk=compute_id)
     context = {"compute": compute}
     try:
-        conn = wvmNodeDevices(compute.hostname, compute.login, compute.password, compute.type)
-        pci, usb = conn.get_node_devices()
+        pci, usb = node_devices(wvmConnect(compute.hostname, compute.login, compute.password, compute.type))
         vm_ids = dict(Instance.objects.filter(compute=compute).values_list("name", "id"))
         for device in pci + usb:
             device["vms"] = [{"name": name, "id": vm_ids.get(name)} for name in device["vms"]]
diff --git a/vrtManager/instance.py b/vrtManager/instance.py
index 14d60351..c5ed1f5d 100644
--- a/vrtManager/instance.py
+++ b/vrtManager/instance.py
@@ -61,6 +61,7 @@ from lxml import etree
 
 from vrtManager import util
 from vrtManager.connection import NVRAM_DIR, wvmConnect
+from vrtManager.nodedevs import pci_address, usb_selector
 from vrtManager.storage import wvmStorage, wvmStorages
 
 # Edits that redefine the domain start from this: the persistent definition,
@@ -68,6 +69,10 @@ from vrtManager.storage import wvmStorage, wvmStorages
 # password.
 PERSISTENT_XML = VIR_DOMAIN_XML_INACTIVE | VIR_DOMAIN_XML_SECURE
 
+USB_HOSTDEVS = "devices/hostdev[@mode='subsystem'][@type='usb']"
+# what of the host a VM holds: host devices, and NICs that are host devices
+HOST_DEVICES = "devices/hostdev | devices/interface[@type='hostdev'] | devices/interface/actual[@type='hostdev']"
+
 # External snapshot names become part of overlay and memory file names.
 SNAPSHOT_NAME = re.compile(r"[A-Za-z0-9_-][A-Za-z0-9._-]{0,63}")
 # the longest window wvmInstance.usage() averages over
@@ -141,6 +146,9 @@ class wvmInstances(wvmConnect):
         definitions = {dom.XMLDesc(0)}
         if state != 5:
             definitions.add(dom.XMLDesc(VIR_DOMAIN_XML_INACTIVE))
+        # a host device is of the source host: the destination may have none, or another one
+        if any(etree.fromstring(xml).xpath(HOST_DEVICES) for xml in definitions):
+            raise util.OperationError("A VM with host devices cannot be migrated; remove them first")
         missing = self.missing_disks(definitions)
         if missing:
             raise util.OperationError(
@@ -1993,7 +2001,13 @@ class wvmInstance(wvmConnect):
                 raise ValueError("Cannot clone a disk without a supported source and destination")
             disks.append((source, dev))
 
+        # a host device is one VM's: the clone gets none (the clone form says so)
+        for hostdev in tree.findall("devices/hostdev"):
+            hostdev.getparent().remove(hostdev)
         for num, net in enumerate(tree.findall("devices/interface")):
+            if net.get("type") == "hostdev":  # numbered as the form numbers the VM's NICs
+                net.getparent().remove(net)
+                continue
             mac = clone_data.get(f"clone-net-mac-{num}")
             if not mac:
                 raise ValueError(f"No MAC address for network interface {num}")
@@ -2324,6 +2338,8 @@ class wvmInstance(wvmConnect):
         removed = None
         for xml_flags, affect in self._definitions():
             nic = self._nic(xml_flags, mac_address)
+            if nic is not None and nic.get("type") == "hostdev":
+                raise util.OperationError("A network interface that is a host device is removed in the XML editor")
             if nic is not None:
                 removed = etree.tostring(nic).decode()
                 self.instance.detachDeviceFlags(removed, affect)
@@ -2340,6 +2356,8 @@ class wvmInstance(wvmConnect):
         if not found:
             raise util.OperationError(f"No network interface with MAC {old_mac}")
         iface = found[0]
+        if iface.get("type") == "hostdev":
+            raise util.OperationError("A network interface that is a host device is changed in the XML editor")
 
         iface_type = {"net": "network", "bridge": "bridge"}.get(source_type, "direct")
         iface.set("type", iface_type)
@@ -2362,6 +2380,79 @@ class wvmInstance(wvmConnect):
 
         self._defineXML(etree.tostring(tree).decode())
 
+    def _usb_hostdevs(self, xml_flags):
+        """(element, selector) of each USB host device of a definition. The
+        selector (usb_selector) is read from the migratable XML, the only one
+        that marks the addresses libvirt resolved for a running VM."""
+        elements = etree.fromstring(self._XMLDesc(xml_flags)).xpath(USB_HOSTDEVS)
+        marked = etree.fromstring(self._XMLDesc(xml_flags | VIR_DOMAIN_XML_MIGRATABLE)).xpath(USB_HOSTDEVS)
+        return [(element, usb_selector(mark.find("source"))) for element, mark in zip(elements, marked)]
+
+    def get_hostdevs(self):
+        """The VM's USB host devices, each once: its selector (vendor,
+        product, address), whether the running VM has it and the device it
+        holds there, whether its next start has it. And its other host
+        devices (PCI, SCSI, mediated, NICs that are host devices), by type
+        and PCI address, likewise: the panel does not change them."""
+        usb = {}
+        for xml_flags, affect in self._definitions():
+            for element, selector in self._usb_hostdevs(xml_flags):
+                row = usb.setdefault(selector, {"vendor": selector[0], "product": selector[1], "address": selector[2],
+                                                "now": None, "next": False})
+                if affect == VIR_DOMAIN_AFFECT_LIVE:
+                    held = element.find("source/address")
+                    row["now"] = (int(held.get("bus")), int(held.get("device"))) if held is not None else selector[2]
+                else:
+                    row["next"] = True
+        others = {}
+        for xml_flags, affect in self._definitions():
+            tree = etree.fromstring(self._XMLDesc(xml_flags))
+            for device in tree.xpath("devices/hostdev[not(@type='usb')]"
+                                     " | devices/interface[@type='hostdev' or actual/@type='hostdev']"):
+                if device.tag == "interface" and device.get("type") != "hostdev":
+                    source = device.find("actual/source")  # a NIC of a network that gives host devices
+                else:
+                    source = device.find("source")
+                address = source.find("address") if source is not None else None
+                if address is not None and address.get("slot") is not None:
+                    label = pci_address(address.get("domain", "0"), address.get("bus"), address.get("slot"),
+                                        address.get("function"))
+                else:  # a mediated device's UUID; a SCSI device as its source
+                    label = address.get("uuid", "") if address is not None else ""
+                kind = "nic" if device.tag == "interface" else device.get("type", device.get("mode"))
+                source_text = " ".join(etree.tostring(source, encoding="unicode").split()) if source is not None else ""
+                row = others.setdefault((kind, label or source_text),
+                                        {"type": kind, "address": label, "now": False, "next": False})
+                row["now" if affect == VIR_DOMAIN_AFFECT_LIVE else "next"] = True
+        return list(usb.values()), list(others.values())
+
+    def add_usb_hostdev(self, vendor, product, address=None):
+        """Gives the VM the host's USB device of vendor and product, at
+        address (bus, device) when given: the host has more than one of the
+        model. Refused without a USB controller."""
+        for xml_flags, _ in self._definitions():
+            if not etree.fromstring(self._XMLDesc(xml_flags)).xpath("devices/controller[@type='usb'][not(@model='none')]"):
+                raise util.OperationError("The VM has no USB controller")
+        hostdev = etree.Element("hostdev", mode="subsystem", type="usb", managed="yes")
+        source = etree.SubElement(hostdev, "source")
+        etree.SubElement(source, "vendor", id=vendor)
+        etree.SubElement(source, "product", id=product)
+        if address:
+            etree.SubElement(source, "address", bus=str(address[0]), device=str(address[1]))
+        self._attach_device(etree.tostring(hostdev, encoding="unicode"))
+
+    def delete_usb_hostdev(self, selector):
+        """Takes the USB host device of selector (usb_selector) from each
+        definition that has it, as that definition describes it."""
+        found = False
+        for xml_flags, affect in self._definitions():
+            for element, own in self._usb_hostdevs(xml_flags):
+                if own == selector:
+                    found = True
+                    self.instance.detachDeviceFlags(etree.tostring(element, encoding="unicode"), affect)
+        if not found:
+            raise util.OperationError("The VM has no such USB device")
+
     def set_link_state(self, mac_address, state):
         for xml_flags, affect in self._definitions():
             nic = self._nic(xml_flags, mac_address)
diff --git a/vrtManager/nodedevs.py b/vrtManager/nodedevs.py
index 8cfb35b9..6cdd7a64 100644
--- a/vrtManager/nodedevs.py
+++ b/vrtManager/nodedevs.py
@@ -1,8 +1,8 @@
 from django.utils.translation import gettext_lazy as _
-from libvirt import VIR_ERR_NO_NODE_DEVICE, libvirtError
+from libvirt import VIR_CONNECT_LIST_NODE_DEVICES_CAP_USB_DEV, VIR_ERR_NO_NODE_DEVICE, libvirtError
 from lxml import etree
 
-from vrtManager.connection import wvmConnect
+from vrtManager import util
 
 # PCI base classes by their code (the class's first byte)
 PCI_CLASSES = {
@@ -30,6 +30,8 @@ USB_CLASSES = {
     0xFF: _("Vendor specific"),
 }
 
+USB_HUB = 0x09
+
 
 def pci_address(domain, bus, slot, function):
     """A PCI address as lspci writes it, from its parts as integers or as
@@ -55,21 +57,27 @@ def host_resources(name, nodes, children):
     return found
 
 
+def usb_selector(source):
+    """(vendor, product, (bus, device) or None) of a USB <hostdev>'s <source>,
+    the parts libvirt picks a device by. An address libvirt resolved for a
+    running VM (autoAddress, in its migratable XML) is not one of them."""
+    address = source.find("address")
+    given = address is not None and source.get("autoAddress") != "yes"
+    return (source.xpath("string(vendor/@id)").lower(), source.xpath("string(product/@id)").lower(),
+            (int(address.get("bus")), int(address.get("device"))) if given else None)
+
+
 def hostdev_users(trees):
     """What a VM's definitions give it of the host: PCI addresses (of a
     <hostdev>, or of a NIC that is a host device) and USB selectors
-    (vendor, product, (bus, device) or None), as libvirt picks a USB device:
-    by the parts given, all of them."""
+    (usb_selector)."""
     pci, usb = set(), []
     for tree in trees:
         for address in tree.xpath("devices/hostdev[@mode='subsystem'][@type='pci']/source/address"
                                   " | devices/interface[@type='hostdev']/source/address"
                                   " | devices/interface/actual[@type='hostdev']/source/address"):
             pci.add(pci_address(address.get("domain", "0"), address.get("bus"), address.get("slot"), address.get("function")))
-        for source in tree.xpath("devices/hostdev[@mode='subsystem'][@type='usb']/source"):
-            address = source.find("address")
-            usb.append((source.xpath("string(vendor/@id)").lower(), source.xpath("string(product/@id)").lower(),
-                        (int(address.get("bus")), int(address.get("device"))) if address is not None else None))
+        usb.extend(usb_selector(source) for source in tree.xpath("devices/hostdev[@mode='subsystem'][@type='usb']/source"))
     return pci, usb
 
 
@@ -86,79 +94,136 @@ def usb_named(selector, model, address):
     return "model" if selected is None else None
 
 
-class wvmNodeDevices(wvmConnect):
-    def get_node_devices(self):
-        """The host's PCI and USB devices, each with what the host has on it
-        (host_resources) and the VMs whose definitions name it: one listing
-        of every node device, one XML read each (a device gone meanwhile is
-        left out), and the VMs' definitions read once (domain_trees)."""
-        nodes = {}
-        for device in self.wvm.listAllDevices(0):
-            try:
-                nodes[device.name()] = etree.fromstring(device.XMLDesc(0))
-            except libvirtError as err:
-                if err.get_error_code() != VIR_ERR_NO_NODE_DEVICE:
-                    raise
-        children = {}
-        for name, node in nodes.items():
-            children.setdefault(node.findtext("parent"), []).append(name)
+def device_problems(label, vms, resources, vm):
+    """Why a host device cannot be given to the VM named vm: the other VMs
+    that name it, and what the host has on it."""
+    problems = []
+    if others := sorted(set(vms) - {vm}):
+        problems.append(f"{label} is given to {', '.join(others)}")
+    if resources:
+        problems.append(f"{label} holds the host's {', '.join(resources)}")
+    return problems
 
-        vms = [(vm, *hostdev_users(trees)) for vm, trees in self.domain_trees()]
-        pci = [self._pci(name, node, nodes, children, vms) for name, node in nodes.items()
-               if node.find("capability").get("type") == "pci"]
-        usb = [self._usb(name, node, nodes, children, vms) for name, node in nodes.items()
-               if node.find("capability").get("type") == "usb_device"]
-        # a model the host has more than one of: a VM that names it by model alone may take any of them
-        models = [device["model"] for device in usb]
-        for device in usb:
-            device["same_model"] = models.count(device["model"]) > 1
-        pci.sort(key=lambda device: (device["group"] is None, device["group"] or 0, device["address"]))
-        usb.sort(key=lambda device: (device["bus"], device["device"]))
-        return pci, usb
 
-    @staticmethod
-    def _pci(name, node, nodes, children, vms):
-        cap = node.find("capability")
-        address = pci_address(cap.findtext("domain"), cap.findtext("bus"), cap.findtext("slot"), cap.findtext("function"))
-        code = int(cap.findtext("class") or "0", 16)
-        group = cap.xpath("string(iommuGroup/@number)")
-        # SR-IOV: a virtual function's physical one
-        physfn = cap.find("capability[@type='phys_function']/address")
-        return {
-            "address": address,
-            "vendor": cap.findtext("vendor") or cap.xpath("string(vendor/@id)"),
-            "product": cap.findtext("product") or cap.xpath("string(product/@id)"),
-            "ids": f"{cap.xpath('string(vendor/@id)')[2:]}:{cap.xpath('string(product/@id)')[2:]}",
-            "kind": PCI_CLASSES.get(code >> 16, _("Other")),
-            "driver": node.findtext("driver/name") or "",
-            "group": int(group) if group else None,
-            "resources": host_resources(name, nodes, children),
-            "vms": [vm for vm, pci, _ in vms if address in pci],
-            "physfn": pci_address(physfn.get("domain"), physfn.get("bus"), physfn.get("slot"), physfn.get("function"))
-            if physfn is not None else "",
-            "vfs": len(cap.xpath("capability[@type='virt_functions']/address")),
-        }
+def hostdev_problems(vm, pci, usb, wanted_pci, wanted_usb):
+    """Why the host's devices pci and usb (get_node_devices) that the VM
+    named vm wants (hostdev_users) cannot be given to it: another VM names
+    them too, the host has its own network interfaces, disks or graphics
+    card on them, or they are USB hubs."""
+    problems = []
+    for device in pci:
+        if device["address"] in wanted_pci:
+            problems += device_problems(f"PCI device {device['address']}", device["vms"], device["resources"], vm)
+    for device in usb:
+        address = (device["bus"], device["device"])
+        if any(usb_named(selector, device["model"], address) for selector in wanted_usb):
+            label = f"USB device {device['bus']}/{device['device']} ({device['product']})"
+            problems += device_problems(label, device["vms"] + device["by_model"], device["resources"], vm)
+            if device["hub"]:
+                problems.append(f"{label} is a hub")
+    return problems
 
-    @staticmethod
-    def _usb(name, node, nodes, children, vms):
-        cap = node.find("capability")
-        bus, device = int(cap.findtext("bus")), int(cap.findtext("device"))
-        model = (cap.xpath("string(vendor/@id)").lower(), cap.xpath("string(product/@id)").lower())
-        # a USB device's classes are its interfaces'
-        codes = [int(nodes[child].findtext("capability/class") or "0") for child in children.get(name, [])
-                 if nodes[child].find("capability").get("type") == "usb"]
-        named = [(vm, usb_named(selector, model, (bus, device))) for vm, _, selectors in vms for selector in selectors]
-        by_address = sorted({vm for vm, how in named if how == "address"})
-        return {
-            "bus": bus,
-            "device": device,
-            "vendor": cap.findtext("vendor") or model[0],
-            "product": cap.findtext("product") or model[1],
-            "model": model,
-            "ids": f"{model[0][2:]}:{model[1][2:]}",
-            "kinds": sorted({str(USB_CLASSES.get(code, _("Other"))) for code in codes}),
-            "resources": host_resources(name, nodes, children),
-            "vms": by_address,
-            # VMs that name its model only: which device of the model they take is known only when they start
-            "by_model": sorted({vm for vm, how in named if how == "model"} - set(by_address)),
-        }
+
+def _pci(name, node, nodes, children, vms):
+    cap = node.find("capability")
+    address = pci_address(cap.findtext("domain"), cap.findtext("bus"), cap.findtext("slot"), cap.findtext("function"))
+    code = int(cap.findtext("class") or "0", 16)
+    group = cap.xpath("string(iommuGroup/@number)")
+    # SR-IOV: a virtual function's physical one
+    physfn = cap.find("capability[@type='phys_function']/address")
+    return {
+        "address": address,
+        "vendor": cap.findtext("vendor") or cap.xpath("string(vendor/@id)"),
+        "product": cap.findtext("product") or cap.xpath("string(product/@id)"),
+        "ids": f"{cap.xpath('string(vendor/@id)')[2:]}:{cap.xpath('string(product/@id)')[2:]}",
+        "kind": PCI_CLASSES.get(code >> 16, _("Other")),
+        "driver": node.findtext("driver/name") or "",
+        "group": int(group) if group else None,
+        "resources": host_resources(name, nodes, children),
+        "vms": [vm for vm, pci, _ in vms if address in pci],
+        "physfn": pci_address(physfn.get("domain"), physfn.get("bus"), physfn.get("slot"), physfn.get("function"))
+        if physfn is not None else "",
+        "vfs": len(cap.xpath("capability[@type='virt_functions']/address")),
+    }
+
+
+
+def _usb(name, node, nodes, children, vms):
+    cap = node.find("capability")
+    bus, device = int(cap.findtext("bus")), int(cap.findtext("device"))
+    model = (cap.xpath("string(vendor/@id)").lower(), cap.xpath("string(product/@id)").lower())
+    # a USB device's classes are its interfaces'
+    codes = [int(nodes[child].findtext("capability/class") or "0") for child in children.get(name, [])
+             if nodes[child].find("capability").get("type") == "usb"]
+    named = [(vm, usb_named(selector, model, (bus, device))) for vm, _, selectors in vms for selector in selectors]
+    by_address = sorted({vm for vm, how in named if how == "address"})
+    return {
+        "bus": bus,
+        "device": device,
+        "vendor": cap.findtext("vendor") or model[0],
+        "product": cap.findtext("product") or model[1],
+        "model": model,
+        "ids": f"{model[0][2:]}:{model[1][2:]}",
+        "kinds": sorted({str(USB_CLASSES.get(code, _("Other"))) for code in codes}),
+        "hub": USB_HUB in codes,
+        "resources": host_resources(name, nodes, children),
+        "vms": by_address,
+        # VMs that name its model only: which device of the model they take is known only when they start
+        "by_model": sorted({vm for vm, how in named if how == "model"} - set(by_address)),
+    }
+
+
+def node_devices(conn):
+    """The PCI and USB devices of the host of conn (a wvmConnect), each with what the host has on it
+    (host_resources) and the VMs whose definitions name it: one listing
+    of every node device, one XML read each (a device gone meanwhile is
+    left out), and the VMs' definitions read once (domain_trees)."""
+    nodes = {}
+    for device in conn.wvm.listAllDevices(0):
+        try:
+            nodes[device.name()] = etree.fromstring(device.XMLDesc(0))
+        except libvirtError as err:
+            if err.get_error_code() != VIR_ERR_NO_NODE_DEVICE:
+                raise
+    children = {}
+    for name, node in nodes.items():
+        children.setdefault(node.findtext("parent"), []).append(name)
+
+    vms = [(vm, *hostdev_users(trees)) for vm, trees in conn.domain_trees()]
+    pci = [_pci(name, node, nodes, children, vms) for name, node in nodes.items()
+           if node.find("capability").get("type") == "pci"]
+    usb = [_usb(name, node, nodes, children, vms) for name, node in nodes.items()
+           if node.find("capability").get("type") == "usb_device"]
+    # a model the host has more than one of: a VM that names it by model alone may take any of them
+    models = [device["model"] for device in usb]
+    for device in usb:
+        device["same_model"] = models.count(device["model"]) > 1
+    pci.sort(key=lambda device: (device["group"] is None, device["group"] or 0, device["address"]))
+    usb.sort(key=lambda device: (device["bus"], device["device"]))
+    return pci, usb
+
+
+def usb_names(conn):
+    """The product names of the host's USB devices, by their (vendor, product)
+    IDs: one listing of the USB devices, one XML read each; none when they
+    cannot be read, as the names are only shown."""
+    names = {}
+    try:
+        for device in conn.wvm.listAllDevices(VIR_CONNECT_LIST_NODE_DEVICES_CAP_USB_DEV):
+            cap = etree.fromstring(device.XMLDesc(0)).find("capability")
+            model = (cap.xpath("string(vendor/@id)").lower(), cap.xpath("string(product/@id)").lower())
+            names[model] = cap.findtext("product") or ""
+    except libvirtError:  # a device gone meanwhile, or the host: the IDs are shown
+        return {}
+    return names
+
+
+def check_hostdevs(conn, vm, trees):
+    """Refuses the host devices the definitions trees give the VM named vm,
+    on the host of conn, when they cannot be (hostdev_problems)."""
+    wanted = hostdev_users(trees)
+    if not any(wanted):
+        return
+    pci, usb = node_devices(conn)
+    if problems := hostdev_problems(vm, pci, usb, *wanted):
+        raise util.OperationError("; ".join(problems))