diff --git a/memory-Introduce-IOMMU-Memory-Region-inject_faults-A.patch b/memory-Introduce-IOMMU-Memory-Region-inject_faults-A.patch
new file mode 100644
index 0000000..e541d9e
--- /dev/null
+++ b/memory-Introduce-IOMMU-Memory-Region-inject_faults-A.patch
@@ -0,0 +1,88 @@
+From d2dce19165f133935ff72e209f19bc43ab4d1421 Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Thu, 13 Sep 2018 14:13:04 +0200
+Subject: [PATCH] memory: Introduce IOMMU Memory Region inject_faults API
+
+This new API allows to inject @count iommu_faults into
+the IOMMU memory region.
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com>
+---
+ include/exec/memory.h | 24 ++++++++++++++++++++++++
+ softmmu/memory.c      | 10 ++++++++++
+ 2 files changed, 34 insertions(+)
+
+diff --git a/include/exec/memory.h b/include/exec/memory.h
+index 76ef99ed27..3e84d62e40 100644
+--- a/include/exec/memory.h
++++ b/include/exec/memory.h
+@@ -103,6 +103,8 @@ struct MemoryRegionSection {
+     bool nonvolatile;
+ };
+ 
++struct iommu_fault;
++
+ typedef struct IOMMUTLBEntry IOMMUTLBEntry;
+ 
+ /* See address_space_translate: bit 0 is read, bit 1 is write.  */
+@@ -523,6 +525,19 @@ struct IOMMUMemoryRegionClass {
+      int (*iommu_set_page_size_mask)(IOMMUMemoryRegion *iommu,
+                                      uint64_t page_size_mask,
+                                      Error **errp);
++
++    /*
++     * Inject @count faults into the IOMMU memory region
++     *
++     * Optional method: if this method is not provided, then
++     * memory_region_injection_faults() will return -ENOENT
++     *
++     * @iommu: the IOMMU memory region to inject the faults in
++     * @count: number of faults to inject
++     * @buf: fault buffer
++     */
++    int (*inject_faults)(IOMMUMemoryRegion *iommu, int count,
++                         struct iommu_fault *buf);
+ };
+ 
+ typedef struct RamDiscardListener RamDiscardListener;
+@@ -1819,6 +1834,15 @@ int memory_region_iommu_num_indexes(IOMMUMemoryRegion *iommu_mr);
+ int memory_region_iommu_set_page_size_mask(IOMMUMemoryRegion *iommu_mr,
+                                            uint64_t page_size_mask,
+                                            Error **errp);
++/**
++ * memory_region_inject_faults : inject @count faults stored in @buf
++ *
++ * @iommu_mr: the IOMMU memory region
++ * @count: number of faults to be injected
++ * @buf: buffer containing the faults
++ */
++int memory_region_inject_faults(IOMMUMemoryRegion *iommu_mr, int count,
++                                struct iommu_fault *buf);
+ 
+ /**
+  * memory_region_name: get a memory region's name
+diff --git a/softmmu/memory.c b/softmmu/memory.c
+index 7340e19ff5..9f98209ab2 100644
+--- a/softmmu/memory.c
++++ b/softmmu/memory.c
+@@ -2111,6 +2111,16 @@ void ram_discard_manager_unregister_listener(RamDiscardManager *rdm,
+     rdmc->unregister_listener(rdm, rdl);
+ }
+ 
++int memory_region_inject_faults(IOMMUMemoryRegion *iommu_mr, int count,
++                                struct iommu_fault *buf)
++{
++    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_GET_CLASS(iommu_mr);
++    if (!imrc->inject_faults) {
++        return -ENOENT;
++    }
++    return imrc->inject_faults(iommu_mr, count, buf);
++}
++
+ void memory_region_set_log(MemoryRegion *mr, bool log, unsigned client)
+ {
+     uint8_t mask = 1 << client;
+-- 
+2.27.0
+