diff --git a/src/libxl/xen_common.c b/src/libxl/xen_common.c
index 73ce412fe7..56702a2a76 100644
--- a/src/libxl/xen_common.c
+++ b/src/libxl/xen_common.c
@@ -373,16 +373,18 @@ xenParsePCI(char *entry)
 {
     virDomainHostdevDefPtr hostdev = NULL;
     VIR_AUTOSTRINGLIST tokens = NULL;
+    VIR_AUTOSTRINGLIST options = NULL;
     size_t ntokens = 0;
     size_t nexttoken = 0;
-    char *slotstr;
-    char *funcstr;
+    char *str;
+    char *nextstr;
     int domain = 0x0;
     int bus;
     int slot;
     int func;
+    virTristateBool filtered = VIR_TRISTATE_BOOL_ABSENT;
 
-    /* pci=['00:1b.0','0000:00:13.0'] */
+    /* pci=['00:1b.0','0000:00:13.0,permissive=1'] */
     if (!(tokens = virStringSplitCount(entry, ":", 3, &ntokens)))
         return NULL;
 
@@ -398,24 +400,57 @@ xenParsePCI(char *entry)
         return NULL;
     nexttoken++;
 
-    /* slot and function */
-    slotstr = tokens[nexttoken];
-    if (!(funcstr = strchr(slotstr, '.'))) {
+    /* slot, function, and options */
+    str = tokens[nexttoken];
+    if (!(nextstr = strchr(str, '.'))) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
-                       _("Malformed PCI address %s"), slotstr);
+                       _("Malformed PCI address %s"), str);
         return NULL;
     }
-    *funcstr = '\0';
-    funcstr++;
-    if (virStrToLong_i(slotstr, NULL, 16, &slot) < 0)
+    *nextstr = '\0';
+    nextstr++;
+    if (virStrToLong_i(str, NULL, 16, &slot) < 0)
         return NULL;
-    if (virStrToLong_i(funcstr, NULL, 16, &func) < 0)
+    str = nextstr++;
+
+    nextstr = strchr(str, ',');
+    if (nextstr) {
+        *nextstr = '\0';
+        nextstr++;
+    }
+    if (virStrToLong_i(str, NULL, 16, &func) < 0)
         return NULL;
 
+    str = nextstr;
+    if (str && (options = virStringSplit(str, ",", 0))) {
+        size_t i;
+
+        for (i = 0; options[i] != NULL; i++) {
+            char *val;
+
+            if (!(val = strchr(options[i], '='))) {
+                virReportError(VIR_ERR_INTERNAL_ERROR,
+                               _("Malformed PCI options %s"), str);
+                return NULL;
+            }
+            *val = '\0';
+            val++;
+            if (STREQ(options[i], "permissive")) {
+                int intval;
+
+                /* xl.cfg(5) specifies false as 0 and true as any other numeric value */
+                if (virStrToLong_i(val, NULL, 10, &intval) < 0)
+                    return NULL;
+                filtered = intval ? VIR_TRISTATE_BOOL_NO : VIR_TRISTATE_BOOL_YES;
+            }
+        }
+    }
+
     if (!(hostdev = virDomainHostdevDefNew()))
        return NULL;
 
     hostdev->managed = false;
+    hostdev->writeFiltering = filtered;
     hostdev->source.subsys.type = VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI;
     hostdev->source.subsys.u.pci.addr.domain = domain;
     hostdev->source.subsys.u.pci.addr.bus = bus;
@@ -1830,12 +1865,28 @@ xenFormatPCI(virConfPtr conf, virDomainDefPtr def)
             def->hostdevs[i]->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI) {
             virConfValuePtr val, tmp;
             char *buf;
+            const char *permissive_str = NULL;
 
-            buf = g_strdup_printf("%04x:%02x:%02x.%x",
+            switch (def->hostdevs[i]->writeFiltering) {
+                case VIR_TRISTATE_BOOL_YES:
+                    permissive_str = ",permissive=0";
+                    break;
+                case VIR_TRISTATE_BOOL_NO:
+                    permissive_str = ",permissive=1";
+                    break;
+                case VIR_TRISTATE_BOOL_ABSENT:
+                case VIR_TRISTATE_BOOL_LAST:
+                    permissive_str = "";
+                    break;
+            }
+
+            buf = g_strdup_printf("%04x:%02x:%02x.%x%s",
                                   def->hostdevs[i]->source.subsys.u.pci.addr.domain,
                                   def->hostdevs[i]->source.subsys.u.pci.addr.bus,
                                   def->hostdevs[i]->source.subsys.u.pci.addr.slot,
-                                  def->hostdevs[i]->source.subsys.u.pci.addr.function);
+                                  def->hostdevs[i]->source.subsys.u.pci.addr.function,
+                                  permissive_str);
+
 
             if (VIR_ALLOC(val) < 0) {
                 VIR_FREE(buf);
diff --git a/tests/xlconfigdata/test-fullvirt-pci.cfg b/tests/xlconfigdata/test-fullvirt-pci.cfg
new file mode 100644
index 0000000000..5a3f572e25
--- /dev/null
+++ b/tests/xlconfigdata/test-fullvirt-pci.cfg
@@ -0,0 +1,25 @@
+name = "XenGuest2"
+uuid = "c7a5fdb2-cdaf-9455-926a-d65c16db1809"
+maxmem = 579
+memory = 394
+vcpus = 1
+pae = 1
+acpi = 1
+apic = 1
+viridian = 0
+rtc_timeoffset = 0
+localtime = 0
+on_poweroff = "destroy"
+on_reboot = "restart"
+on_crash = "restart"
+device_model = "/usr/lib/xen/bin/qemu-system-i386"
+sdl = 0
+vnc = 1
+vncunused = 1
+vnclisten = "127.0.0.1"
+pci = [ "0000:01:1a.1", "0000:02:00.0,permissive=1" ]
+parallel = "none"
+serial = "none"
+builder = "hvm"
+boot = "d"
+disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2" ]
diff --git a/tests/xlconfigdata/test-fullvirt-pci.xml b/tests/xlconfigdata/test-fullvirt-pci.xml
new file mode 100644
index 0000000000..75aa6ac25b
--- /dev/null
+++ b/tests/xlconfigdata/test-fullvirt-pci.xml
@@ -0,0 +1,53 @@
+<domain type='xen'>
+  <name>XenGuest2</name>
+  <uuid>c7a5fdb2-cdaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>592896</memory>
+  <currentMemory unit='KiB'>403456</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='x86_64' machine='xenfv'>hvm</type>
+    <loader type='rom'>/usr/lib/xen/boot/hvmloader</loader>
+    <boot dev='cdrom'/>
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+    <pae/>
+  </features>
+  <clock offset='variable' adjustment='0' basis='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>restart</on_crash>
+  <devices>
+    <emulator>/usr/lib/xen/bin/qemu-system-i386</emulator>
+    <disk type='block' device='disk'>
+      <driver name='phy' type='raw'/>
+      <source dev='/dev/HostVG/XenGuest2'/>
+      <target dev='hda' bus='ide'/>
+      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
+    </disk>
+    <controller type='xenbus' index='0'/>
+    <controller type='ide' index='0'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1'>
+      <listen type='address' address='127.0.0.1'/>
+    </graphics>
+    <video>
+      <model type='cirrus' vram='8192' heads='1' primary='yes'/>
+    </video>
+    <hostdev mode='subsystem' type='pci' managed='no'>
+      <driver name='xen'/>
+      <source>
+        <address domain='0x0000' bus='0x01' slot='0x1a' function='0x1'/>
+      </source>
+    </hostdev>
+    <hostdev mode='subsystem' type='pci' managed='no'>
+      <driver name='xen'/>
+      <source writeFiltering='no'>
+        <address domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
+      </source>
+    </hostdev>
+    <memballoon model='xen'/>
+  </devices>
+</domain>
diff --git a/tests/xlconfigtest.c b/tests/xlconfigtest.c
index b606164742..3ad66ccfa1 100644
--- a/tests/xlconfigtest.c
+++ b/tests/xlconfigtest.c
@@ -260,6 +260,7 @@ mymain(void)
     DO_TEST("fullvirt-nestedhvm-disabled");
     DO_TEST("fullvirt-cpuid");
     DO_TEST("fullvirt-acpi-slic");
+    DO_TEST("fullvirt-pci");
 #ifdef LIBXL_HAVE_VNUMA
     DO_TEST("fullvirt-vnuma");
     DO_TEST_PARSE("fullvirt-vnuma-autocomplete", false);