Patches to address the 3 issues you list above have been posted to libvir-list for review:

  https://www.redhat.com/archives/libvir-list/2013-September/msg01458.html

I just pushed the following 6 commits upstream:

commit fbd9be484c3b1891412e9409d0133a07bbc3fc2b
Date:   Tue Sep 24 06:49:26 2013 -0400

    qemu: eliminate redundant if clauses in qemuCollectPCIAddress

commit 07af519298996f4341f62542c31c1c01969eeceb
Date:   Tue Sep 24 09:16:25 2013 -0400

    qemu: allow some PCI devices to be attached to PCIe slots

commit 8e0dab3a8e2e4b0c580739587fa4a474c7a4afc8
Date:   Tue Sep 24 09:38:32 2013 -0400

    qemu: replace multiple strcmps with a switch on an enum

commit b83d26f6c434f80c71a2a7a0823b1ec16b798ca3
Date:   Tue Sep 24 10:17:38 2013 -0400

    qemu: support ich9-intel-hda audio device

commit c484fe16cb58174b9ea1c532eeea70be5893ca3c
Date:   Wed Sep 25 06:59:46 2013 -0400

    qemu: turn if into switch in qemuDomainValidateDevicePCISlotsQ35
    
commit 386ebb47a5d707829edf0dccf4d80056ca199e63
Date:   Wed Sep 25 08:02:19 2013 -0400

    qemu: prefer to put a Q35 machine's dmi-to-pci-bridge at 00:1E.0

Verifying this bug with libvirt-1.1.1-8.el7:

Steps:
For the first problem:
 * The pci bridge (dmi-to-pci-bridge) is at 00:1e.0.
   libvirt picks another slot when auto-adding the device while
   creating the machine.  It is possible to move it though.
 
1. Add 'dmi-to-pci-bridge' to a q35 guest, and do not specify the address for it:
 # virsh edit test
 "
    <controller type='pci' index='1' model='dmi-to-pci-bridge'>
    </controller>
 "
 save.
 
 # virsh dumpxml test
 .....
     <controller type='pci' index='1' model='dmi-to-pci-bridge'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x1e' function='0x0'/>
    </controller>
 .....
 libvirt will add address: 00:1e.0 to it automatically.
 
2. Change the address for 'dmi-to-pci-bridge' to 00:02.0
 # virsh edit test
 "
    <controller type='pci' index='1' model='dmi-to-pci-bridge'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
    </controller>
 "
 save.
 
 # virsh dumpxml test
 ....
    <controller type='pci' index='1' model='dmi-to-pci-bridge'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
    </controller>
 ....
 it is not changed to 00:1e.0, and start guest will work.
 
For second problem:
 * The ehci+uhci controllers are in slot 00:1d (ehci1 + uhci1,2,3)
   and in 00:1a (ehci2 + uhci4,5,6).
   libvirt doesn't allow me to add the devices to bus 0.
   
1. Add 'ehci' + 'ich9-uhci1' to guest and do not add addresses to them:
 # virsh edit test
 "
    <controller type='usb' index='0' model='ehci'>
    </controller>
    <controller type='usb' index='0' model='ich9-uhci1'>
    </controller>
 "
 save
 
 # virsh dumpxml test
 ....
    <controller type='usb' index='0' model='ehci'>
      <address type='pci' domain='0x0000' bus='0x02' slot='0x02' function='0x0'/>
    </controller>
    <controller type='usb' index='0' model='ich9-uhci1'>
      <master startport='0'/>
      <address type='pci' domain='0x0000' bus='0x02' slot='0x03' function='0x0' multifunction='on'/>
    </controller>
 ....
 libvirt add addresses to them and attach to PCI automatically.

2. Modify addresses for 'ehci' and 'ich9-uhci1' :
 # virsh edit test
    <controller type='usb' index='0' model='ehci'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
    </controller>
    <controller type='usb' index='0' model='ich9-uhci1'>
      <master startport='0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
    </controller>
 save
 
 # virsh dumpxml test
 will see it works, libvirt support to specify the bus to 0, and can be started normally.
 
3. Repeat above steps for "ehci + ich9-uhci1, ich9-uhci2, ich9-uhci3, vt82c686b-uhci" and "ich9-ehci1 + ich9-uhci1, ich9-uhci2, ich9-uhci3, vt82c686b-uhci" all works well.
 
For the third problem:
 * The hda audio controller is at 00:1b.0.
   libvirt doesn't allow me to add the device to bus 0.
   qemu also provides a ich9-intel-hda device (identical to
   intel-hda except that it has ich9 pci ids).  Adding support
   for this device would be nice.
 
1. Add 'ich9-intel-hda' to guest:
 # virsh edit test
 "
     <sound model='ich9'>
    </sound>
 "
 save.
 
 # virsh dumpxml test
 ....
     <sound model='ich9'>
      <address type='pci' domain='0x0000' bus='0x02' slot='0x02' function='0x0'/>
    </sound>
 ....
 libvirt will add address and attach to PCI automatically.
 
 # ps aux | grep qemu
 ... -device ich9-intel-hda,id=sound0,bus=pci.2,addr=0x2 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 ....
 
2. Modify the address of ich9 device:
 # virsh edit test
    <sound model='ich9'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
    </sound>
 save.
 
 # virsh dumpxml test
 will see it works, libvirt support to specify the bus to 0, and can be started normally.
 
 # ps aux | grep qemu
 ... -device ich9-intel-hda,id=sound0,bus=pcie.0,addr=0x7 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 ...

So setting VERIFIED.

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.