diff --git a/ocaml/xapi-idl/xen/xenops_types.ml b/ocaml/xapi-idl/xen/xenops_types.ml
index 2ed03daf79..fdce3746d0 100644
--- a/ocaml/xapi-idl/xen/xenops_types.ml
+++ b/ocaml/xapi-idl/xen/xenops_types.ml
@@ -139,7 +139,7 @@ module Vm = struct
 
   type id = string [@@deriving rpcty, sexp]
 
-  type action = Coredump | Shutdown | Start | Pause | Softreboot
+  type action = Coredump | Shutdown | Start | Pause | Softreboot | Recover
   [@@deriving rpcty, sexp]
 
   type scheduler_params = {
diff --git a/ocaml/xenopsd/lib/xenops_server.ml b/ocaml/xenopsd/lib/xenops_server.ml
index 54d528829f..7b188ca28c 100644
--- a/ocaml/xenopsd/lib/xenops_server.ml
+++ b/ocaml/xenopsd/lib/xenops_server.ml
@@ -3240,7 +3240,7 @@ and perform_exn ?result (op : operation) (t : Xenops_task.task_handle) : unit =
               vm.Vm.on_crash
         | Some Needs_suspend ->
             warn "VM %s has unexpectedly suspended" id ;
-            [Vm.Shutdown]
+            [Vm.Recover]
         | Some Needs_softreset ->
             vm.Vm.on_softreboot
         | None ->
@@ -3252,6 +3252,12 @@ and perform_exn ?result (op : operation) (t : Xenops_task.task_handle) : unit =
             []
         | Vm.Shutdown ->
             [VM_shutdown (id, None)]
+        | Vm.Recover ->
+            [VM_shutdown (id, None)]
+            (* This could instead try to recover the device model and
+               fast-resume the VM. Recovery of the device model is the^
+               difficult part. As part of it, qemu must be unpaused.
+            *)
         | Vm.Start ->
             let delay =
               if run_time < B.VM.minimum_reboot_delay then (