diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
index 5f54ca650f..22bf78ecd5 100644
--- a/src/qemu/qemu_cgroup.c
+++ b/src/qemu/qemu_cgroup.c
@@ -461,9 +461,7 @@ static int
 qemuSetupMemoryCgroup(virDomainObjPtr vm)
 {
     qemuDomainObjPrivatePtr priv = vm->privateData;
-    unsigned long long hard_limit;
     int rc;
-    int i;
 
     if (!virCgroupHasController(priv->cgroup,VIR_CGROUP_CONTROLLER_MEMORY)) {
         if (vm->def->mem.hard_limit != 0 ||
@@ -477,23 +475,8 @@ qemuSetupMemoryCgroup(virDomainObjPtr vm)
         }
     }
 
-    hard_limit = vm->def->mem.hard_limit;
-    if (!hard_limit) {
-        /* If there is no hard_limit set, set a reasonable one to avoid
-         * system thrashing caused by exploited qemu.  A 'reasonable
-         * limit' has been chosen:
-         *     (1 + k) * (domain memory + total video memory) + (32MB for
-         *     cache per each disk) + F
-         * where k = 0.5 and F = 200MB.  The cache for disks is important as
-         * kernel cache on the host side counts into the RSS limit. */
-        hard_limit = vm->def->mem.max_balloon;
-        for (i = 0; i < vm->def->nvideos; i++)
-            hard_limit += vm->def->videos[i]->vram;
-        hard_limit = hard_limit * 1.5 + 204800;
-        hard_limit += vm->def->ndisks * 32768;
-    }
-
-    rc = virCgroupSetMemoryHardLimit(priv->cgroup, hard_limit);
+    rc = virCgroupSetMemoryHardLimit(priv->cgroup,
+                                     qemuDomainMemoryLimit(vm->def));
     if (rc != 0) {
         virReportSystemError(-rc,
                              _("Unable to set memory hard limit for domain %s"),
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 8d79066451..92cf4b64d9 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -2181,3 +2181,36 @@ cleanup:
     virObjectUnref(cfg);
     return ret;
 }
+
+
+unsigned long long
+qemuDomainMemoryLimit(virDomainDefPtr def)
+{
+    unsigned long long mem;
+    int i;
+
+    if (def->mem.hard_limit) {
+        mem = def->mem.hard_limit;
+    } else {
+        /* If there is no hard_limit set, compute a reasonable one to avoid
+         * system thrashing caused by exploited qemu.  A 'reasonable
+         * limit' has been chosen:
+         *     (1 + k) * (domain memory + total video memory) + (32MB for
+         *     cache per each disk) + F
+         * where k = 0.5 and F = 200MB.  The cache for disks is important as
+         * kernel cache on the host side counts into the RSS limit.
+         *
+         * Technically, the disk cache does not have to be included in
+         * RLIMIT_MEMLOCK but it doesn't hurt as it's just an upper limit and
+         * it makes this function and its usage simpler.
+         */
+        mem = def->mem.max_balloon;
+        for (i = 0; i < def->nvideos; i++)
+            mem += def->videos[i]->vram;
+        mem *= 1.5;
+        mem += def->ndisks * 32768;
+        mem += 204800;
+    }
+
+    return mem;
+}
diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
index 9ff6de4e15..750841f7c3 100644
--- a/src/qemu/qemu_domain.h
+++ b/src/qemu/qemu_domain.h
@@ -358,4 +358,6 @@ extern virDomainXMLPrivateDataCallbacks virQEMUDriverPrivateDataCallbacks;
 extern virDomainXMLNamespace virQEMUDriverDomainXMLNamespace;
 extern virDomainDefParserConfig virQEMUDriverDomainDefParserConfig;
 
+unsigned long long qemuDomainMemoryLimit(virDomainDefPtr def);
+
 #endif /* __QEMU_DOMAIN_H__ */