diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 2082f59..7aa3020 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -141,12 +141,12 @@
 
     dev = qdev_create(NULL, "ARM,bitband-memory");
     qdev_set_prop_int(dev, "base", 0x20000000);
-    qdev_init(dev);
+    qdev_init_nofail(dev);
     sysbus_mmio_map(sysbus_from_qdev(dev), 0, 0x22000000);
 
     dev = qdev_create(NULL, "ARM,bitband-memory");
     qdev_set_prop_int(dev, "base", 0x40000000);
-    qdev_init(dev);
+    qdev_init_nofail(dev);
     sysbus_mmio_map(sysbus_from_qdev(dev), 0, 0x42000000);
 }
 
@@ -203,7 +203,7 @@
 
     nvic = qdev_create(NULL, "armv7m_nvic");
     env->nvic = nvic;
-    qdev_init(nvic);
+    qdev_init_nofail(nvic);
     cpu_pic = arm_pic_init_cpu(ENV_GET_CPU(env));
     sysbus_connect_irq(sysbus_from_qdev(nvic), 0, cpu_pic[ARM_PIC_CPU_IRQ]);
     for (i = 0; i < 64; i++) {
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index e9c5a61..8e60042 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -216,12 +216,26 @@
 #endif
 }
 
+DeviceInfo* qdev_get_device_info(DeviceState *dev) {
+    return dev->type->info;
+}
+
 /* Initialize a device.  Device properties should be set before calling
    this function.  IRQs and MMIO regions should be connected/mapped after
    calling this function.  */
-void qdev_init(DeviceState *dev)
+int qdev_init(DeviceState *dev)
 {
-    dev->type->info->init(dev, dev->type->info);
+    return dev->type->info->init(dev);
+}
+
+void qdev_init_nofail(DeviceState *dev)
+{
+    const char *typename = dev->type->info->name;
+
+    if (qdev_init(dev) < 0) {
+        error_report("Initialization of device %s failed", typename);
+        exit(1);
+    }
 }
 
 /* Unlink device from bus and free the structure.  */
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 7903938..bfae3a8 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -76,11 +76,13 @@
     dev->mmio[n].iofunc = iofunc;
 }
 
-static void sysbus_device_init(DeviceState *dev, DeviceInfo *base)
+static int sysbus_device_init(DeviceState *dev)
 {
+    DeviceInfo *base = qdev_get_device_info(dev);
     SysBusDeviceInfo *info = container_of(base, SysBusDeviceInfo, qdev);
 
     info->init(sysbus_from_qdev(dev));
+    return 0;
 }
 
 void sysbus_register_withprop(SysBusDeviceInfo *info)
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index 247a05e..0356534 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -112,7 +112,7 @@
     return ctz32(value);
 }
 
-static inline void set_bit(uint32_t *tab, int index)
+static inline void apic_set_bit(uint32_t *tab, int index)
 {
     int i, mask;
     i = index >> 5;
@@ -120,7 +120,7 @@
     tab[i] |= mask;
 }
 
-static inline void reset_bit(uint32_t *tab, int index)
+static inline void apic_reset_bit(uint32_t *tab, int index)
 {
     int i, mask;
     i = index >> 5;
@@ -128,7 +128,7 @@
     tab[i] &= ~mask;
 }
 
-static inline int get_bit(uint32_t *tab, int index)
+static inline int apic_get_bit(uint32_t *tab, int index)
 {
     int i, mask;
     i = index >> 5;
@@ -180,7 +180,7 @@
         case APIC_DM_FIXED:
             if (!(lvt & APIC_LVT_LEVEL_TRIGGER))
                 break;
-            reset_bit(s->irr, lvt & 0xff);
+            apic_reset_bit(s->irr, lvt & 0xff);
             /* fall through */
         case APIC_DM_EXTINT:
             cpu_reset_interrupt(ENV_GET_CPU(env), CPU_INTERRUPT_HARD);
@@ -381,13 +381,13 @@
 
 static void apic_set_irq(APICState *s, int vector_num, int trigger_mode)
 {
-    apic_irq_delivered += !get_bit(s->irr, vector_num);
+    apic_irq_delivered += !apic_get_bit(s->irr, vector_num);
 
-    set_bit(s->irr, vector_num);
+    apic_set_bit(s->irr, vector_num);
     if (trigger_mode)
-        set_bit(s->tmr, vector_num);
+        apic_set_bit(s->tmr, vector_num);
     else
-        reset_bit(s->tmr, vector_num);
+        apic_reset_bit(s->tmr, vector_num);
     apic_update_irq(s);
 }
 
@@ -397,7 +397,7 @@
     isrv = get_highest_priority_int(s->isr);
     if (isrv < 0)
         return;
-    reset_bit(s->isr, isrv);
+    apic_reset_bit(s->isr, isrv);
     /* XXX: send the EOI packet to the APIC bus to allow the I/O APIC to
             set the remote IRR bit for level triggered interrupts. */
     apic_update_irq(s);
@@ -433,7 +433,7 @@
             int idx = apic_find_dest(dest);
             memset(deliver_bitmask, 0x00, MAX_APIC_WORDS * sizeof(uint32_t));
             if (idx >= 0)
-                set_bit(deliver_bitmask, idx);
+                apic_set_bit(deliver_bitmask, idx);
         }
     } else {
         /* XXX: cluster mode */
@@ -443,11 +443,11 @@
             if (apic_iter) {
                 if (apic_iter->dest_mode == 0xf) {
                     if (dest & apic_iter->log_dest)
-                        set_bit(deliver_bitmask, i);
+                        apic_set_bit(deliver_bitmask, i);
                 } else if (apic_iter->dest_mode == 0x0) {
                     if ((dest & 0xf0) == (apic_iter->log_dest & 0xf0) &&
                         (dest & apic_iter->log_dest & 0x0f)) {
-                        set_bit(deliver_bitmask, i);
+                        apic_set_bit(deliver_bitmask, i);
                     }
                 }
             }
@@ -522,14 +522,14 @@
         break;
     case 1:
         memset(deliver_bitmask, 0x00, sizeof(deliver_bitmask));
-        set_bit(deliver_bitmask, s->idx);
+        apic_set_bit(deliver_bitmask, s->idx);
         break;
     case 2:
         memset(deliver_bitmask, 0xff, sizeof(deliver_bitmask));
         break;
     case 3:
         memset(deliver_bitmask, 0xff, sizeof(deliver_bitmask));
-        reset_bit(deliver_bitmask, s->idx);
+        apic_reset_bit(deliver_bitmask, s->idx);
         break;
     }
 
@@ -574,8 +574,8 @@
         return -1;
     if (s->tpr && intno <= s->tpr)
         return s->spurious_vec & 0xff;
-    reset_bit(s->irr, intno);
-    set_bit(s->isr, intno);
+    apic_reset_bit(s->irr, intno);
+    apic_set_bit(s->isr, intno);
     apic_update_irq(s);
     return intno;
 }
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index feaa687..fbdc673 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -810,7 +810,7 @@
     qemu_check_nic_model(nd, "smc91c111");
     dev = qdev_create(NULL, "smc91c111");
     qdev_set_netdev(dev, nd);
-    qdev_init(dev);
+    qdev_init_nofail(dev);
     s = sysbus_from_qdev(dev);
     sysbus_mmio_map(s, 0, base);
     sysbus_connect_irq(s, 0, irq);
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 8e280de..4843b47 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -828,7 +828,7 @@
             dev = qdev_create(&bus->qbus, pci_nic_names[i]);
             qdev_set_prop_int(dev, "devfn", devfn);
             qdev_set_netdev(dev, nd);
-            qdev_init(dev);
+            qdev_init_nofail(dev);
             nd->private = dev;
             return (PCIDevice *)dev;
         }
@@ -910,9 +910,10 @@
     pci_qdev_initfn init;
 } PCIDeviceInfo;
 
-static void pci_qdev_init(DeviceState *qdev, DeviceInfo *base)
+static int pci_qdev_init(DeviceState *qdev)
 {
     PCIDevice *pci_dev = (PCIDevice *)qdev;
+    DeviceInfo *base = qdev_get_device_info(qdev);
     PCIDeviceInfo *info = container_of(base, PCIDeviceInfo, qdev);
     PCIBus *bus;
     int devfn;
@@ -923,6 +924,7 @@
                                      NULL, NULL);//FIXME:config_read, config_write);
     assert(pci_dev);
     info->init(pci_dev);
+    return 0;
 }
 
 void pci_qdev_register(const char *name, int size, pci_qdev_initfn init)
@@ -945,7 +947,7 @@
 
     dev = qdev_create(&bus->qbus, name);
     qdev_set_prop_int(dev, "devfn", devfn);
-    qdev_init(dev);
+    qdev_init_nofail(dev);
 
     return (PCIDevice *)dev;
 }
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 5bf5c43..a86fcd0 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -1,8 +1,136 @@
 #ifndef QDEV_CORE_H
 #define QDEV_CORE_H
 
-#include "hw/irq.h"
 #include "qemu/queue.h"
+#include "qemu/option.h"
+#include "qemu/typedefs.h"
+#include "qemu/bitmap.h"
+#include "qom/object.h"
+#include "hw/irq.h"
+#include "qapi/error.h"
+#include "hw/hotplug.h"
+
+enum {
+    DEV_NVECTORS_UNSPECIFIED = -1,
+};
+
+#define TYPE_DEVICE "device"
+#define DEVICE(obj) OBJECT_CHECK(DeviceState, (obj), TYPE_DEVICE)
+#define DEVICE_CLASS(klass) OBJECT_CLASS_CHECK(DeviceClass, (klass), TYPE_DEVICE)
+#define DEVICE_GET_CLASS(obj) OBJECT_GET_CLASS(DeviceClass, (obj), TYPE_DEVICE)
+
+typedef enum DeviceCategory {
+    DEVICE_CATEGORY_BRIDGE,
+    DEVICE_CATEGORY_USB,
+    DEVICE_CATEGORY_STORAGE,
+    DEVICE_CATEGORY_NETWORK,
+    DEVICE_CATEGORY_INPUT,
+    DEVICE_CATEGORY_DISPLAY,
+    DEVICE_CATEGORY_SOUND,
+    DEVICE_CATEGORY_MISC,
+    DEVICE_CATEGORY_MAX
+} DeviceCategory;
+
+typedef int (*qdev_initfn)(DeviceState *dev);
+typedef int (*qdev_event)(DeviceState *dev);
+typedef void (*qdev_resetfn)(DeviceState *dev);
+typedef void (*DeviceRealize)(DeviceState *dev, Error **errp);
+typedef void (*DeviceUnrealize)(DeviceState *dev, Error **errp);
+typedef void (*BusRealize)(BusState *bus, Error **errp);
+typedef void (*BusUnrealize)(BusState *bus, Error **errp);
+
+struct VMStateDescription;
+
+/**
+ * DeviceClass:
+ * @props: Properties accessing state fields.
+ * @realize: Callback function invoked when the #DeviceState:realized
+ * property is changed to %true. The default invokes @init if not %NULL.
+ * @unrealize: Callback function invoked when the #DeviceState:realized
+ * property is changed to %false.
+ * @init: Callback function invoked when the #DeviceState::realized property
+ * is changed to %true. Deprecated, new types inheriting directly from
+ * TYPE_DEVICE should use @realize instead, new leaf types should consult
+ * their respective parent type.
+ * @hotpluggable: indicates if #DeviceClass is hotpluggable, available
+ * as readonly "hotpluggable" property of #DeviceState instance
+ *
+ * # Realization #
+ * Devices are constructed in two stages,
+ * 1) object instantiation via object_initialize() and
+ * 2) device realization via #DeviceState:realized property.
+ * The former may not fail (it might assert or exit), the latter may return
+ * error information to the caller and must be re-entrant.
+ * Trivial field initializations should go into #TypeInfo.instance_init.
+ * Operations depending on @props static properties should go into @realize.
+ * After successful realization, setting static properties will fail.
+ *
+ * As an interim step, the #DeviceState:realized property is set by deprecated
+ * functions qdev_init() and qdev_init_nofail().
+ * In the future, devices will propagate this state change to their children
+ * and along busses they expose.
+ * The point in time will be deferred to machine creation, so that values
+ * set in @realize will not be introspectable beforehand. Therefore devices
+ * must not create children during @realize; they should initialize them via
+ * object_initialize() in their own #TypeInfo.instance_init and forward the
+ * realization events appropriately.
+ *
+ * The @init callback is considered private to a particular bus implementation
+ * (immediate abstract child types of TYPE_DEVICE). Derived leaf types set an
+ * "init" callback on their parent class instead.
+ *
+ * Any type may override the @realize and/or @unrealize callbacks but needs
+ * to call the parent type's implementation if keeping their functionality
+ * is desired. Refer to QOM documentation for further discussion and examples.
+ *
+ * <note>
+ *   <para>
+ * If a type derived directly from TYPE_DEVICE implements @realize, it does
+ * not need to implement @init and therefore does not need to store and call
+ * #DeviceClass' default @realize callback.
+ * For other types consult the documentation and implementation of the
+ * respective parent types.
+ *   </para>
+ * </note>
+ */
+typedef struct DeviceClass {
+    /*< private >*/
+    ObjectClass parent_class;
+    /*< public >*/
+
+    DECLARE_BITMAP(categories, DEVICE_CATEGORY_MAX);
+    const char *fw_name;
+    const char *desc;
+    Property *props;
+
+    /*
+     * Shall we hide this device model from -device / device_add?
+     * All devices should support instantiation with device_add, and
+     * this flag should not exist.  But we're not there, yet.  Some
+     * devices fail to instantiate with cryptic error messages.
+     * Others instantiate, but don't work.  Exposing users to such
+     * behavior would be cruel; this flag serves to protect them.  It
+     * should never be set without a comment explaining why it is set.
+     * TODO remove once we're there
+     */
+    bool cannot_instantiate_with_device_add_yet;
+    bool hotpluggable;
+
+    /* callbacks */
+    void (*reset)(DeviceState *dev);
+    DeviceRealize realize;
+    DeviceUnrealize unrealize;
+
+    /* device state */
+    const struct VMStateDescription *vmsd;
+
+    /* Private to qdev / bus.  */
+    qdev_initfn init; /* TODO remove, once users are converted to realize */
+    qdev_event unplug;
+    qdev_event exit; /* TODO remove, once users are converted to unrealize */
+    const char *bus_type;
+} DeviceClass;
+
 
 typedef struct DeviceType DeviceType;
 
@@ -23,6 +151,11 @@
     QLIST_ENTRY(DeviceState) sibling;
 };
 
+#define TYPE_BUS "bus"
+#define BUS(obj) OBJECT_CHECK(BusState, (obj), TYPE_BUS)
+#define BUS_CLASS(klass) OBJECT_CLASS_CHECK(BusClass, (klass), TYPE_BUS)
+#define BUS_GET_CLASS(obj) OBJECT_GET_CLASS(BusClass, (obj), TYPE_BUS)
+
 typedef enum {
     BUS_TYPE_SYSTEM,
     BUS_TYPE_PCI,
@@ -39,10 +172,41 @@
     QLIST_ENTRY(BusState) sibling;
 };
 
+struct Property {
+    const char   *name;
+    PropertyInfo *info;
+    int          offset;
+    uint8_t      bitnr;
+    uint8_t      qtype;
+    int64_t      defval;
+    int          arrayoffset;
+    PropertyInfo *arrayinfo;
+    int          arrayfieldsize;
+};
+
+struct PropertyInfo {
+    const char *name;
+    const char *legacy_name;
+    const char **enum_table;
+    int (*print)(DeviceState *dev, Property *prop, char *dest, size_t len);
+    ObjectPropertyAccessor *get;
+    ObjectPropertyAccessor *set;
+    ObjectPropertyRelease *release;
+};
+
+typedef struct GlobalProperty {
+    const char *driver;
+    const char *property;
+    const char *value;
+    QTAILQ_ENTRY(GlobalProperty) next;
+} GlobalProperty;
+
 /*** Board API.  This should go away once we have a machine config file.  ***/
 
 DeviceState *qdev_create(BusState *bus, const char *name);
-void qdev_init(DeviceState *dev);
+DeviceState *qdev_try_create(BusState *bus, const char *name);
+int qdev_init(DeviceState *dev) QEMU_WARN_UNUSED_RESULT;
+void qdev_init_nofail(DeviceState *dev);
 void qdev_free(DeviceState *dev);
 
 /* Set properties between creation and init.  */
@@ -54,6 +218,8 @@
 qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
 void qdev_connect_gpio_out(DeviceState *dev, int n, qemu_irq pin);
 
+BusState *qdev_get_child_bus(DeviceState *dev, const char *name);
+
 /*** Device API.  ***/
 
 typedef enum {
@@ -69,7 +235,6 @@
 
 typedef struct DeviceInfo DeviceInfo;
 
-typedef void (*qdev_initfn)(DeviceState *dev, DeviceInfo *info);
 typedef void (*SCSIAttachFn)(DeviceState *host, BlockDriverState *bdrv,
               int unit);
 
@@ -85,6 +250,9 @@
 
 void qdev_register(DeviceInfo *info);
 
+// TODO(digit): Remove this.
+DeviceInfo* qdev_get_device_info(DeviceState *dev);
+
 /* Register device properties.  */
 /* GPIO inputs also double as IRQ sinks.  */
 void qdev_init_gpio_in(DeviceState *dev, qemu_irq_handler handler, int n);
diff --git a/include/qemu/config-file.h b/include/qemu/config-file.h
index 20d707f..d3502c6 100644
--- a/include/qemu/config-file.h
+++ b/include/qemu/config-file.h
@@ -7,6 +7,7 @@
 
 QemuOptsList *qemu_find_opts(const char *group);
 void qemu_add_opts(QemuOptsList *list);
+void qemu_add_drive_opts(QemuOptsList *list);
 int qemu_set_option(const char *str);
 int qemu_global_option(const char *str);
 void qemu_add_globals(void);