diff --git a/MAINTAINERS b/MAINTAINERS
index 93ad19d..654e2cb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -80,6 +80,7 @@
 S: Maintained
 F: target-lm32/
 F: hw/lm32/
+F: hw/char/lm32_*
 
 M68K
 M: Paul Brook <paul@codesourcery.com>
@@ -224,7 +225,7 @@
 Exynos
 M: Evgeny Voevodin <e.voevodin@samsung.com>
 M: Maksim Kozlov <m.kozlov@samsung.com>
-M: Igor Mitsyanko <i.mitsyanko@samsung.com>
+M: Igor Mitsyanko <i.mitsyanko@gmail.com>
 M: Dmitry Solodkiy <d.solodkiy@samsung.com>
 S: Maintained
 F: hw/*/exynos*
diff --git a/VERSION b/VERSION
index 88eb60e..80b2369 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.5.50
+1.5.91
diff --git a/block.c b/block.c
index c77cfd1..01b66d8 100644
--- a/block.c
+++ b/block.c
@@ -127,7 +127,7 @@
 {
     bs->io_limits_enabled = false;
 
-    while (qemu_co_queue_next(&bs->throttled_reqs));
+    do {} while (qemu_co_enter_next(&bs->throttled_reqs));
 
     if (bs->block_timer) {
         qemu_del_timer(bs->block_timer);
@@ -143,7 +143,7 @@
 {
     BlockDriverState *bs = opaque;
 
-    qemu_co_queue_next(&bs->throttled_reqs);
+    qemu_co_enter_next(&bs->throttled_reqs);
 }
 
 void bdrv_io_limits_enable(BlockDriverState *bs)
@@ -1452,8 +1452,7 @@
          * a busy wait.
          */
         QTAILQ_FOREACH(bs, &bdrv_states, list) {
-            if (!qemu_co_queue_empty(&bs->throttled_reqs)) {
-                qemu_co_queue_restart_all(&bs->throttled_reqs);
+            while (qemu_co_enter_next(&bs->throttled_reqs)) {
                 busy = true;
             }
         }
diff --git a/block/gluster.c b/block/gluster.c
index 6de418c..645b7f1 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -493,6 +493,19 @@
     return NULL;
 }
 
+static int qemu_gluster_truncate(BlockDriverState *bs, int64_t offset)
+{
+    int ret;
+    BDRVGlusterState *s = bs->opaque;
+
+    ret = glfs_ftruncate(s->fd, offset);
+    if (ret < 0) {
+        return -errno;
+    }
+
+    return 0;
+}
+
 static BlockDriverAIOCB *qemu_gluster_aio_readv(BlockDriverState *bs,
         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque)
@@ -631,6 +644,7 @@
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -650,6 +664,7 @@
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -669,6 +684,7 @@
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -688,6 +704,7 @@
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
diff --git a/block/iscsi.c b/block/iscsi.c
index 5f28c6a..e7c1c2b 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -247,7 +247,9 @@
 {
     if ((sector_num * BDRV_SECTOR_SIZE) % iscsilun->block_size ||
         (nb_sectors * BDRV_SECTOR_SIZE) % iscsilun->block_size) {
-            error_report("iSCSI misaligned request: iscsilun->block_size %u, sector_num %ld, nb_sectors %d",
+            error_report("iSCSI misaligned request: "
+                         "iscsilun->block_size %u, sector_num %" PRIi64
+                         ", nb_sectors %d",
                          iscsilun->block_size, sector_num, nb_sectors);
             return 0;
     }
diff --git a/block/sheepdog.c b/block/sheepdog.c
index 6a41ad9..a506137 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -242,14 +242,14 @@
     return !!inode->snap_ctime;
 }
 
-#undef dprintf
+#undef DPRINTF
 #ifdef DEBUG_SDOG
-#define dprintf(fmt, args...)                                       \
+#define DPRINTF(fmt, args...)                                       \
     do {                                                            \
         fprintf(stdout, "%s %d: " fmt, __func__, __LINE__, ##args); \
     } while (0)
 #else
-#define dprintf(fmt, args...)
+#define DPRINTF(fmt, args...)
 #endif
 
 typedef struct SheepdogAIOCB SheepdogAIOCB;
@@ -729,7 +729,7 @@
         break;
     case AIOCB_FLUSH_CACHE:
         if (rsp.result == SD_RES_INVALID_PARMS) {
-            dprintf("disable cache since the server doesn't support it\n");
+            DPRINTF("disable cache since the server doesn't support it\n");
             s->cache_flags = SD_FLAG_CMD_DIRECT;
             rsp.result = SD_RES_SUCCESS;
         }
@@ -1229,7 +1229,7 @@
          * the same object */
         QLIST_FOREACH(areq, &s->inflight_aio_head, aio_siblings) {
             if (areq != aio_req && areq->oid == aio_req->oid) {
-                dprintf("simultaneous CoW to %" PRIx64 "\n", aio_req->oid);
+                DPRINTF("simultaneous CoW to %" PRIx64 "\n", aio_req->oid);
                 QLIST_REMOVE(aio_req, aio_siblings);
                 QLIST_INSERT_HEAD(&s->pending_aio_head, aio_req, aio_siblings);
                 return SD_RES_SUCCESS;
@@ -1319,7 +1319,7 @@
     s->discard_supported = true;
 
     if (snapid || tag[0] != '\0') {
-        dprintf("%" PRIx32 " snapshot inode was open.\n", vid);
+        DPRINTF("%" PRIx32 " snapshot inode was open.\n", vid);
         s->is_snapshot = true;
     }
 
@@ -1554,7 +1554,7 @@
     unsigned int wlen, rlen = 0;
     int fd, ret;
 
-    dprintf("%s\n", s->name);
+    DPRINTF("%s\n", s->name);
 
     fd = connect_to_sdog(s);
     if (fd < 0) {
@@ -1714,7 +1714,7 @@
     char *buf;
     bool deleted;
 
-    dprintf("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
 
     buf = g_malloc(SD_INODE_SIZE);
 
@@ -1730,7 +1730,7 @@
         goto out;
     }
 
-    dprintf("%" PRIx32 " is created.\n", vid);
+    DPRINTF("%" PRIx32 " is created.\n", vid);
 
     fd = connect_to_sdog(s);
     if (fd < 0) {
@@ -1751,7 +1751,7 @@
 
     s->is_snapshot = false;
     ret = 0;
-    dprintf("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
 
 out:
     g_free(buf);
@@ -1841,11 +1841,11 @@
         }
 
         if (create) {
-            dprintf("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
+            DPRINTF("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
                     inode->vdi_id, oid,
                     vid_to_data_oid(inode->data_vdi_id[idx], idx), idx);
             oid = vid_to_data_oid(inode->vdi_id, idx);
-            dprintf("new oid %" PRIx64 "\n", oid);
+            DPRINTF("new oid %" PRIx64 "\n", oid);
         }
 
         aio_req = alloc_aio_req(s, acb, oid, len, offset, flags, old_oid, done);
@@ -1978,7 +1978,7 @@
     SheepdogInode *inode;
     unsigned int datalen;
 
-    dprintf("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
+    DPRINTF("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
             "is_snapshot %d\n", sn_info->name, sn_info->id_str,
             s->name, sn_info->vm_state_size, s->is_snapshot);
 
@@ -1989,7 +1989,7 @@
         return -EINVAL;
     }
 
-    dprintf("%s %s\n", sn_info->name, sn_info->id_str);
+    DPRINTF("%s %s\n", sn_info->name, sn_info->id_str);
 
     s->inode.vm_state_size = sn_info->vm_state_size;
     s->inode.vm_clock_nsec = sn_info->vm_clock_nsec;
@@ -2033,7 +2033,7 @@
     }
 
     memcpy(&s->inode, inode, datalen);
-    dprintf("s->inode: name %s snap_id %x oid %x\n",
+    DPRINTF("s->inode: name %s snap_id %x oid %x\n",
             s->inode.name, s->inode.snap_id, s->inode.vdi_id);
 
 cleanup:
diff --git a/block/vmdk.c b/block/vmdk.c
index 3756333..e6c50b1 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1200,8 +1200,10 @@
 /**
  * vmdk_write:
  * @zeroed:       buf is ignored (data is zero), use zeroed_grain GTE feature
- * if possible, otherwise return -ENOTSUP.
- * @zero_dry_run: used for zeroed == true only, don't update L2 table, just
+ *                if possible, otherwise return -ENOTSUP.
+ * @zero_dry_run: used for zeroed == true only, don't update L2 table, just try
+ *                with each cluster. By dry run we can find if the zero write
+ *                is possible without modifying image data.
  *
  * Returns: error code with 0 for success.
  */
@@ -1328,6 +1330,8 @@
     int ret;
     BDRVVmdkState *s = bs->opaque;
     qemu_co_mutex_lock(&s->lock);
+    /* write zeroes could fail if sectors not aligned to cluster, test it with
+     * dry_run == true before really updating image */
     ret = vmdk_write(bs, sector_num, NULL, nb_sectors, true, true);
     if (!ret) {
         ret = vmdk_write(bs, sector_num, NULL, nb_sectors, true, false);
diff --git a/blockdev.c b/blockdev.c
index 7879e85..41b0a49 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -46,6 +46,7 @@
 
 static QTAILQ_HEAD(drivelist, DriveInfo) drives = QTAILQ_HEAD_INITIALIZER(drives);
 extern QemuOptsList qemu_common_drive_opts;
+extern QemuOptsList qemu_old_drive_opts;
 
 static const char *const if_name[IF_COUNT] = {
     [IF_NONE] = "none",
@@ -745,6 +746,26 @@
 {
     const char *value;
 
+    /*
+     * Check that only old options are used by copying into a QemuOpts with
+     * stricter checks. Going through a QDict seems to be the easiest way to
+     * achieve this...
+     */
+    QemuOpts* check_opts;
+    QDict *qdict;
+    Error *local_err = NULL;
+
+    qdict = qemu_opts_to_qdict(all_opts, NULL);
+    check_opts = qemu_opts_from_qdict(&qemu_old_drive_opts, qdict, &local_err);
+    QDECREF(qdict);
+
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        return NULL;
+    }
+    qemu_opts_del(check_opts);
+
     /* Change legacy command line options into QMP ones */
     qemu_opt_rename(all_opts, "iops", "throttling.iops-total");
     qemu_opt_rename(all_opts, "iops_rd", "throttling.iops-read");
@@ -1971,6 +1992,128 @@
     },
 };
 
+QemuOptsList qemu_old_drive_opts = {
+    .name = "drive",
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_old_drive_opts.head),
+    .desc = {
+        {
+            .name = "bus",
+            .type = QEMU_OPT_NUMBER,
+            .help = "bus number",
+        },{
+            .name = "unit",
+            .type = QEMU_OPT_NUMBER,
+            .help = "unit number (i.e. lun for scsi)",
+        },{
+            .name = "if",
+            .type = QEMU_OPT_STRING,
+            .help = "interface (ide, scsi, sd, mtd, floppy, pflash, virtio)",
+        },{
+            .name = "index",
+            .type = QEMU_OPT_NUMBER,
+            .help = "index number",
+        },{
+            .name = "cyls",
+            .type = QEMU_OPT_NUMBER,
+            .help = "number of cylinders (ide disk geometry)",
+        },{
+            .name = "heads",
+            .type = QEMU_OPT_NUMBER,
+            .help = "number of heads (ide disk geometry)",
+        },{
+            .name = "secs",
+            .type = QEMU_OPT_NUMBER,
+            .help = "number of sectors (ide disk geometry)",
+        },{
+            .name = "trans",
+            .type = QEMU_OPT_STRING,
+            .help = "chs translation (auto, lba. none)",
+        },{
+            .name = "media",
+            .type = QEMU_OPT_STRING,
+            .help = "media type (disk, cdrom)",
+        },{
+            .name = "snapshot",
+            .type = QEMU_OPT_BOOL,
+            .help = "enable/disable snapshot mode",
+        },{
+            .name = "file",
+            .type = QEMU_OPT_STRING,
+            .help = "disk image",
+        },{
+            .name = "discard",
+            .type = QEMU_OPT_STRING,
+            .help = "discard operation (ignore/off, unmap/on)",
+        },{
+            .name = "cache",
+            .type = QEMU_OPT_STRING,
+            .help = "host cache usage (none, writeback, writethrough, "
+                    "directsync, unsafe)",
+        },{
+            .name = "aio",
+            .type = QEMU_OPT_STRING,
+            .help = "host AIO implementation (threads, native)",
+        },{
+            .name = "format",
+            .type = QEMU_OPT_STRING,
+            .help = "disk format (raw, qcow2, ...)",
+        },{
+            .name = "serial",
+            .type = QEMU_OPT_STRING,
+            .help = "disk serial number",
+        },{
+            .name = "rerror",
+            .type = QEMU_OPT_STRING,
+            .help = "read error action",
+        },{
+            .name = "werror",
+            .type = QEMU_OPT_STRING,
+            .help = "write error action",
+        },{
+            .name = "addr",
+            .type = QEMU_OPT_STRING,
+            .help = "pci address (virtio only)",
+        },{
+            .name = "readonly",
+            .type = QEMU_OPT_BOOL,
+            .help = "open drive file as read-only",
+        },{
+            .name = "iops",
+            .type = QEMU_OPT_NUMBER,
+            .help = "limit total I/O operations per second",
+        },{
+            .name = "iops_rd",
+            .type = QEMU_OPT_NUMBER,
+            .help = "limit read operations per second",
+        },{
+            .name = "iops_wr",
+            .type = QEMU_OPT_NUMBER,
+            .help = "limit write operations per second",
+        },{
+            .name = "bps",
+            .type = QEMU_OPT_NUMBER,
+            .help = "limit total bytes per second",
+        },{
+            .name = "bps_rd",
+            .type = QEMU_OPT_NUMBER,
+            .help = "limit read bytes per second",
+        },{
+            .name = "bps_wr",
+            .type = QEMU_OPT_NUMBER,
+            .help = "limit write bytes per second",
+        },{
+            .name = "copy-on-read",
+            .type = QEMU_OPT_BOOL,
+            .help = "copy read data from backing file into image file",
+        },{
+            .name = "boot",
+            .type = QEMU_OPT_BOOL,
+            .help = "(deprecated, ignored)",
+        },
+        { /* end of list */ }
+    },
+};
+
 QemuOptsList qemu_drive_opts = {
     .name = "drive",
     .head = QTAILQ_HEAD_INITIALIZER(qemu_drive_opts.head),
diff --git a/configure b/configure
index c205904..18fa608 100755
--- a/configure
+++ b/configure
@@ -231,7 +231,7 @@
 usb_redir=""
 glx=""
 zlib="yes"
-guest_agent="yes"
+guest_agent=""
 want_tools="yes"
 libiscsi=""
 coroutine=""
@@ -3444,10 +3444,15 @@
       virtfs=no
     fi
   fi
+fi
+if [ "$guest_agent" != "no" ]; then
   if [ "$linux" = "yes" -o "$bsd" = "yes" -o "$solaris" = "yes" ] ; then
-    if [ "$guest_agent" = "yes" ]; then
       tools="qemu-ga\$(EXESUF) $tools"
-    fi
+      guest_agent=yes
+  elif [ "$guest_agent" != yes ]; then
+      guest_agent=no
+  else
+      error_exit "Guest agent is not supported on this platform"
   fi
 fi
 
@@ -4502,8 +4507,7 @@
 fi
 
 # build tree in object directory in case the source is not in the current directory
-DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/tcg/xtensa"
-DIRS="$DIRS tests/libqos"
+DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos tests/qapi-schema tests/tcg/xtensa"
 DIRS="$DIRS pc-bios/optionrom pc-bios/spapr-rtas pc-bios/s390-ccw"
 DIRS="$DIRS roms/seabios roms/vgabios"
 DIRS="$DIRS qapi-generated"
diff --git a/exec.c b/exec.c
index c4f2894..3ca9381 100644
--- a/exec.c
+++ b/exec.c
@@ -402,11 +402,14 @@
 #if defined(CONFIG_USER_ONLY)
     cpu_list_unlock();
 #endif
-    vmstate_register(NULL, cpu_index, &vmstate_cpu_common, cpu);
+    if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
+        vmstate_register(NULL, cpu_index, &vmstate_cpu_common, cpu);
+    }
 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
     register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,
                     cpu_save, cpu_load, env);
     assert(cc->vmsd == NULL);
+    assert(qdev_get_vmsd(DEVICE(cpu)) == NULL);
 #endif
     if (cc->vmsd != NULL) {
         vmstate_register(NULL, cpu_index, cc->vmsd, cpu);
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 35e2af4..f0ffbe8 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -61,6 +61,8 @@
 
     s->vq = virtio_add_queue(vdev, MAX_REQ, handle_9p_output);
 
+    v9fs_path_init(&path);
+
     fse = get_fsdev_fsentry(s->fsconf.fsdev_id);
 
     if (!fse) {
@@ -111,7 +113,6 @@
      * call back to do that. Since we are in the init path, we don't
      * use co-routines here.
      */
-    v9fs_path_init(&path);
     if (s->ops->name_to_path(&s->ctx, NULL, "/", &path) < 0) {
         fprintf(stderr,
                 "error in converting name to path %s", strerror(errno));
@@ -149,6 +150,7 @@
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->props = virtio_9p_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_9p_device_init;
     vdc->get_features = virtio_9p_get_features;
     vdc->get_config = virtio_9p_get_config;
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 5b22e84..82d36fb 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -114,15 +114,21 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+#define TYPE_BITBAND "ARM,bitband-memory"
+#define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t base;
 } BitBandState;
 
 static int bitband_init(SysBusDevice *dev)
 {
-    BitBandState *s = FROM_SYSBUS(BitBandState, dev);
+    BitBandState *s = BITBAND(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &bitband_ops, &s->base,
                           "bitband", 0x02000000);
@@ -134,12 +140,12 @@
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "ARM,bitband-memory");
+    dev = qdev_create(NULL, TYPE_BITBAND);
     qdev_prop_set_uint32(dev, "base", 0x20000000);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x22000000);
 
-    dev = qdev_create(NULL, "ARM,bitband-memory");
+    dev = qdev_create(NULL, TYPE_BITBAND);
     qdev_prop_set_uint32(dev, "base", 0x40000000);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x42000000);
@@ -270,7 +276,7 @@
 }
 
 static const TypeInfo bitband_info = {
-    .name          = "ARM,bitband-memory",
+    .name          = TYPE_BITBAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(BitBandState),
     .class_init    = bitband_class_init,
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index be264d3..35d5511 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -116,8 +116,15 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+#define TYPE_HIGHBANK_REGISTERS "highbank-regs"
+#define HIGHBANK_REGISTERS(obj) \
+    OBJECT_CHECK(HighbankRegsState, (obj), TYPE_HIGHBANK_REGISTERS)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion *iomem;
     uint32_t regs[NUM_REGS];
 } HighbankRegsState;
@@ -135,8 +142,7 @@
 
 static void highbank_regs_reset(DeviceState *dev)
 {
-    SysBusDevice *sys_dev = SYS_BUS_DEVICE(dev);
-    HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, sys_dev);
+    HighbankRegsState *s = HIGHBANK_REGISTERS(dev);
 
     s->regs[0x40] = 0x05F20121;
     s->regs[0x41] = 0x2;
@@ -146,7 +152,7 @@
 
 static int highbank_regs_init(SysBusDevice *dev)
 {
-    HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, dev);
+    HighbankRegsState *s = HIGHBANK_REGISTERS(dev);
 
     s->iomem = g_new(MemoryRegion, 1);
     memory_region_init_io(s->iomem, OBJECT(s), &hb_mem_ops, s->regs,
@@ -168,7 +174,7 @@
 }
 
 static const TypeInfo highbank_regs_info = {
-    .name          = "highbank-regs",
+    .name          = TYPE_HIGHBANK_REGISTERS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(HighbankRegsState),
     .class_init    = highbank_regs_class_init,
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 249a430..d518188 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -15,8 +15,15 @@
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_INTEGRATOR_CM "integrator_core"
+#define INTEGRATOR_CM(obj) \
+    OBJECT_CHECK(IntegratorCMState, (obj), TYPE_INTEGRATOR_CM)
+
+typedef struct IntegratorCMState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t memsz;
     MemoryRegion flash;
@@ -31,7 +38,7 @@
     uint32_t int_level;
     uint32_t irq_enabled;
     uint32_t fiq_enabled;
-} integratorcm_state;
+} IntegratorCMState;
 
 static uint8_t integrator_spd[128] = {
    128, 8, 4, 11, 9, 1, 64, 0,  2, 0xa0, 0xa0, 0, 0, 8, 0, 1,
@@ -41,7 +48,7 @@
 static uint64_t integratorcm_read(void *opaque, hwaddr offset,
                                   unsigned size)
 {
-    integratorcm_state *s = (integratorcm_state *)opaque;
+    IntegratorCMState *s = opaque;
     if (offset >= 0x100 && offset < 0x200) {
         /* CM_SPD */
         if (offset >= 0x180)
@@ -108,7 +115,7 @@
     }
 }
 
-static void integratorcm_do_remap(integratorcm_state *s)
+static void integratorcm_do_remap(IntegratorCMState *s)
 {
     /* Sync memory region state with CM_CTRL REMAP bit:
      * bit 0 => flash at address 0; bit 1 => RAM
@@ -116,7 +123,7 @@
     memory_region_set_enabled(&s->flash, !(s->cm_ctrl & 4));
 }
 
-static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
+static void integratorcm_set_ctrl(IntegratorCMState *s, uint32_t value)
 {
     if (value & 8) {
         qemu_system_reset_request();
@@ -133,7 +140,7 @@
     integratorcm_do_remap(s);
 }
 
-static void integratorcm_update(integratorcm_state *s)
+static void integratorcm_update(IntegratorCMState *s)
 {
     /* ??? The CPU irq/fiq is raised when either the core module or base PIC
        are active.  */
@@ -144,7 +151,7 @@
 static void integratorcm_write(void *opaque, hwaddr offset,
                                uint64_t value, unsigned size)
 {
-    integratorcm_state *s = (integratorcm_state *)opaque;
+    IntegratorCMState *s = opaque;
     switch (offset >> 2) {
     case 2: /* CM_OSC */
         if (s->cm_lock == 0xa05f)
@@ -226,7 +233,7 @@
 
 static int integratorcm_init(SysBusDevice *dev)
 {
-    integratorcm_state *s = FROM_SYSBUS(integratorcm_state, dev);
+    IntegratorCMState *s = INTEGRATOR_CM(dev);
 
     s->cm_osc = 0x01000048;
     /* ??? What should the high bits of this value be?  */
@@ -264,15 +271,21 @@
 /* Integrator/CP hardware emulation.  */
 /* Primary interrupt controller.  */
 
-typedef struct icp_pic_state
-{
-  SysBusDevice busdev;
-  MemoryRegion iomem;
-  uint32_t level;
-  uint32_t irq_enabled;
-  uint32_t fiq_enabled;
-  qemu_irq parent_irq;
-  qemu_irq parent_fiq;
+#define TYPE_INTEGRATOR_PIC "integrator_pic"
+#define INTEGRATOR_PIC(obj) \
+   OBJECT_CHECK(icp_pic_state, (obj), TYPE_INTEGRATOR_PIC)
+
+typedef struct icp_pic_state {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    MemoryRegion iomem;
+    uint32_t level;
+    uint32_t irq_enabled;
+    uint32_t fiq_enabled;
+    qemu_irq parent_irq;
+    qemu_irq parent_fiq;
 } icp_pic_state;
 
 static void icp_pic_update(icp_pic_state *s)
@@ -367,16 +380,17 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int icp_pic_init(SysBusDevice *dev)
+static int icp_pic_init(SysBusDevice *sbd)
 {
-    icp_pic_state *s = FROM_SYSBUS(icp_pic_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    icp_pic_state *s = INTEGRATOR_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, icp_pic_set_irq, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
-    sysbus_init_irq(dev, &s->parent_fiq);
+    qdev_init_gpio_in(dev, icp_pic_set_irq, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
+    sysbus_init_irq(sbd, &s->parent_fiq);
     memory_region_init_io(&s->iomem, OBJECT(s), &icp_pic_ops, s,
                           "icp-pic", 0x00800000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -474,19 +488,19 @@
     memory_region_init_alias(ram_alias, NULL, "ram.alias", ram, 0, ram_size);
     memory_region_add_subregion(address_space_mem, 0x80000000, ram_alias);
 
-    dev = qdev_create(NULL, "integrator_core");
+    dev = qdev_create(NULL, TYPE_INTEGRATOR_CM);
     qdev_prop_set_uint32(dev, "memsz", ram_size >> 20);
     qdev_init_nofail(dev);
     sysbus_mmio_map((SysBusDevice *)dev, 0, 0x10000000);
 
     cpu_pic = arm_pic_init_cpu(cpu);
-    dev = sysbus_create_varargs("integrator_pic", 0x14000000,
+    dev = sysbus_create_varargs(TYPE_INTEGRATOR_PIC, 0x14000000,
                                 cpu_pic[ARM_PIC_CPU_IRQ],
                                 cpu_pic[ARM_PIC_CPU_FIQ], NULL);
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
     }
-    sysbus_create_simple("integrator_pic", 0xca000000, pic[26]);
+    sysbus_create_simple(TYPE_INTEGRATOR_PIC, 0xca000000, pic[26]);
     sysbus_create_varargs("integrator_pit", 0x13000000,
                           pic[5], pic[6], pic[7], NULL);
     sysbus_create_simple("pl031", 0x15000000, pic[8]);
@@ -524,7 +538,7 @@
 machine_init(integratorcp_machine_init);
 
 static Property core_properties[] = {
-    DEFINE_PROP_UINT32("memsz", integratorcm_state, memsz, 0),
+    DEFINE_PROP_UINT32("memsz", IntegratorCMState, memsz, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -538,9 +552,9 @@
 }
 
 static const TypeInfo core_info = {
-    .name          = "integrator_core",
+    .name          = TYPE_INTEGRATOR_CM,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(integratorcm_state),
+    .instance_size = sizeof(IntegratorCMState),
     .class_init    = core_class_init,
 };
 
@@ -552,7 +566,7 @@
 }
 
 static const TypeInfo icp_pic_info = {
-    .name          = "integrator_pic",
+    .name          = TYPE_INTEGRATOR_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pic_state),
     .class_init    = icp_pic_class_init,
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index b06d442..d715143 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -146,8 +146,15 @@
     uint32_t next;
 } mv88w8618_rx_desc;
 
+#define TYPE_MV88W8618_ETH "mv88w8618_eth"
+#define MV88W8618_ETH(obj) \
+    OBJECT_CHECK(mv88w8618_eth_state, (obj), TYPE_MV88W8618_ETH)
+
 typedef struct mv88w8618_eth_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t smir;
@@ -382,16 +389,17 @@
     .cleanup = eth_cleanup,
 };
 
-static int mv88w8618_eth_init(SysBusDevice *dev)
+static int mv88w8618_eth_init(SysBusDevice *sbd)
 {
-    mv88w8618_eth_state *s = FROM_SYSBUS(mv88w8618_eth_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mv88w8618_eth_state *s = MV88W8618_ETH(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->nic = qemu_new_nic(&net_mv88w8618_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_eth_ops, s,
                           "mv88w8618-eth", MP_ETH_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -429,7 +437,7 @@
 }
 
 static const TypeInfo mv88w8618_eth_info = {
-    .name          = "mv88w8618_eth",
+    .name          = TYPE_MV88W8618_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_eth_state),
     .class_init    = mv88w8618_eth_class_init,
@@ -454,8 +462,15 @@
 
 #define MP_LCD_TEXTCOLOR        0xe0e0ff /* RRGGBB */
 
+#define TYPE_MUSICPAL_LCD "musicpal_lcd"
+#define MUSICPAL_LCD(obj) \
+    OBJECT_CHECK(musicpal_lcd_state, (obj), TYPE_MUSICPAL_LCD)
+
 typedef struct musicpal_lcd_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t brightness;
     uint32_t mode;
@@ -534,7 +549,7 @@
 {
 }
 
-static void musicpal_lcd_gpio_brigthness_in(void *opaque, int irq, int level)
+static void musicpal_lcd_gpio_brightness_in(void *opaque, int irq, int level)
 {
     musicpal_lcd_state *s = opaque;
     s->brightness &= ~(1 << irq);
@@ -606,20 +621,21 @@
     .gfx_update  = lcd_refresh,
 };
 
-static int musicpal_lcd_init(SysBusDevice *dev)
+static int musicpal_lcd_init(SysBusDevice *sbd)
 {
-    musicpal_lcd_state *s = FROM_SYSBUS(musicpal_lcd_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_lcd_state *s = MUSICPAL_LCD(dev);
 
     s->brightness = 7;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_lcd_ops, s,
                           "musicpal-lcd", MP_LCD_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    s->con = graphic_console_init(DEVICE(dev), &musicpal_gfx_ops, s);
+    s->con = graphic_console_init(dev, &musicpal_gfx_ops, s);
     qemu_console_resize(s->con, 128*3, 64*3);
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brigthness_in, 3);
+    qdev_init_gpio_in(dev, musicpal_lcd_gpio_brightness_in, 3);
 
     return 0;
 }
@@ -650,7 +666,7 @@
 }
 
 static const TypeInfo musicpal_lcd_info = {
-    .name          = "musicpal_lcd",
+    .name          = TYPE_MUSICPAL_LCD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_lcd_state),
     .class_init    = musicpal_lcd_class_init,
@@ -661,9 +677,15 @@
 #define MP_PIC_ENABLE_SET       0x08
 #define MP_PIC_ENABLE_CLR       0x0C
 
-typedef struct mv88w8618_pic_state
-{
-    SysBusDevice busdev;
+#define TYPE_MV88W8618_PIC "mv88w8618_pic"
+#define MV88W8618_PIC(obj) \
+    OBJECT_CHECK(mv88w8618_pic_state, (obj), TYPE_MV88W8618_PIC)
+
+typedef struct mv88w8618_pic_state {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t level;
     uint32_t enabled;
@@ -721,8 +743,7 @@
 
 static void mv88w8618_pic_reset(DeviceState *d)
 {
-    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state,
-                                         SYS_BUS_DEVICE(d));
+    mv88w8618_pic_state *s = MV88W8618_PIC(d);
 
     s->level = 0;
     s->enabled = 0;
@@ -736,9 +757,9 @@
 
 static int mv88w8618_pic_init(SysBusDevice *dev)
 {
-    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state, dev);
+    mv88w8618_pic_state *s = MV88W8618_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, mv88w8618_pic_set_irq, 32);
+    qdev_init_gpio_in(DEVICE(dev), mv88w8618_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_pic_ops, s,
                           "musicpal-pic", MP_PIC_SIZE);
@@ -769,7 +790,7 @@
 }
 
 static const TypeInfo mv88w8618_pic_info = {
-    .name          = "mv88w8618_pic",
+    .name          = TYPE_MV88W8618_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_pic_state),
     .class_init    = mv88w8618_pic_class_init,
@@ -795,8 +816,15 @@
     qemu_irq irq;
 } mv88w8618_timer_state;
 
+#define TYPE_MV88W8618_PIT "mv88w8618_pit"
+#define MV88W8618_PIT(obj) \
+    OBJECT_CHECK(mv88w8618_pit_state, (obj), TYPE_MV88W8618_PIT)
+
 typedef struct mv88w8618_pit_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     mv88w8618_timer_state timer[4];
 } mv88w8618_pit_state;
@@ -878,8 +906,7 @@
 
 static void mv88w8618_pit_reset(DeviceState *d)
 {
-    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state,
-                                         SYS_BUS_DEVICE(d));
+    mv88w8618_pit_state *s = MV88W8618_PIT(d);
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -896,7 +923,7 @@
 
 static int mv88w8618_pit_init(SysBusDevice *dev)
 {
-    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state, dev);
+    mv88w8618_pit_state *s = MV88W8618_PIT(dev);
     int i;
 
     /* Letting them all run at 1 MHz is likely just a pragmatic
@@ -946,7 +973,7 @@
 }
 
 static const TypeInfo mv88w8618_pit_info = {
-    .name          = "mv88w8618_pit",
+    .name          = TYPE_MV88W8618_PIT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_pit_state),
     .class_init    = mv88w8618_pit_class_init,
@@ -955,8 +982,15 @@
 /* Flash config register offsets */
 #define MP_FLASHCFG_CFGR0    0x04
 
+#define TYPE_MV88W8618_FLASHCFG "mv88w8618_flashcfg"
+#define MV88W8618_FLASHCFG(obj) \
+    OBJECT_CHECK(mv88w8618_flashcfg_state, (obj), TYPE_MV88W8618_FLASHCFG)
+
 typedef struct mv88w8618_flashcfg_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t cfgr0;
 } mv88w8618_flashcfg_state;
@@ -996,7 +1030,7 @@
 
 static int mv88w8618_flashcfg_init(SysBusDevice *dev)
 {
-    mv88w8618_flashcfg_state *s = FROM_SYSBUS(mv88w8618_flashcfg_state, dev);
+    mv88w8618_flashcfg_state *s = MV88W8618_FLASHCFG(dev);
 
     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_flashcfg_ops, s,
@@ -1026,7 +1060,7 @@
 }
 
 static const TypeInfo mv88w8618_flashcfg_info = {
-    .name          = "mv88w8618_flashcfg",
+    .name          = TYPE_MV88W8618_FLASHCFG,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_flashcfg_state),
     .class_init    = mv88w8618_flashcfg_class_init,
@@ -1149,8 +1183,15 @@
 /* LCD brightness bits in GPIO_OE_HI */
 #define MP_OE_LCD_BRIGHTNESS    0x0007
 
+#define TYPE_MUSICPAL_GPIO "musicpal_gpio"
+#define MUSICPAL_GPIO(obj) \
+    OBJECT_CHECK(musicpal_gpio_state, (obj), TYPE_MUSICPAL_GPIO)
+
 typedef struct musicpal_gpio_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t lcd_brightness;
     uint32_t out_state;
@@ -1310,8 +1351,7 @@
 
 static void musicpal_gpio_reset(DeviceState *d)
 {
-    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state,
-                                         SYS_BUS_DEVICE(d));
+    musicpal_gpio_state *s = MUSICPAL_GPIO(d);
 
     s->lcd_brightness = 0;
     s->out_state = 0;
@@ -1321,19 +1361,20 @@
     s->isr = 0;
 }
 
-static int musicpal_gpio_init(SysBusDevice *dev)
+static int musicpal_gpio_init(SysBusDevice *sbd)
 {
-    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_gpio_state *s = MUSICPAL_GPIO(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_gpio_ops, s,
                           "musicpal-gpio", MP_GPIO_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
+    qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_gpio_pin_event, 32);
+    qdev_init_gpio_in(dev, musicpal_gpio_pin_event, 32);
 
     return 0;
 }
@@ -1365,7 +1406,7 @@
 }
 
 static const TypeInfo musicpal_gpio_info = {
-    .name          = "musicpal_gpio",
+    .name          = TYPE_MUSICPAL_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_gpio_state),
     .class_init    = musicpal_gpio_class_init,
@@ -1395,8 +1436,15 @@
 #define MP_KEY_BTN_VOLUME      (1 << 6)
 #define MP_KEY_BTN_NAVIGATION  (1 << 7)
 
+#define TYPE_MUSICPAL_KEY "musicpal_key"
+#define MUSICPAL_KEY(obj) \
+    OBJECT_CHECK(musicpal_key_state, (obj), TYPE_MUSICPAL_KEY)
+
 typedef struct musicpal_key_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t kbd_extended;
     uint32_t pressed_keys;
@@ -1480,17 +1528,18 @@
     s->kbd_extended = 0;
 }
 
-static int musicpal_key_init(SysBusDevice *dev)
+static int musicpal_key_init(SysBusDevice *sbd)
 {
-    musicpal_key_state *s = FROM_SYSBUS(musicpal_key_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_key_state *s = MUSICPAL_KEY(dev);
 
     memory_region_init(&s->iomem, OBJECT(s), "dummy", 0);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     s->kbd_extended = 0;
     s->pressed_keys = 0;
 
-    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
+    qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
 
     qemu_add_kbd_event_handler(musicpal_key_event, s);
 
@@ -1519,7 +1568,7 @@
 }
 
 static const TypeInfo musicpal_key_info = {
-    .name          = "musicpal_key",
+    .name          = TYPE_MUSICPAL_KEY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_key_state),
     .class_init    = musicpal_key_class_init,
@@ -1572,12 +1621,12 @@
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple("mv88w8618_pic", MP_PIC_BASE,
+    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                cpu_pic[ARM_PIC_CPU_IRQ]);
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
     }
-    sysbus_create_varargs("mv88w8618_pit", MP_PIT_BASE, pic[MP_TIMER1_IRQ],
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
@@ -1624,10 +1673,10 @@
 #endif
 
     }
-    sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE, NULL);
+    sysbus_create_simple(TYPE_MV88W8618_FLASHCFG, MP_FLASHCFG_BASE, NULL);
 
     qemu_check_nic_model(&nd_table[0], "mv88w8618");
-    dev = qdev_create(NULL, "mv88w8618_eth");
+    dev = qdev_create(NULL, TYPE_MV88W8618_ETH);
     qdev_set_nic_properties(dev, &nd_table[0]);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
@@ -1637,12 +1686,13 @@
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
-    dev = sysbus_create_simple("musicpal_gpio", MP_GPIO_BASE, pic[MP_GPIO_IRQ]);
+    dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
+                               pic[MP_GPIO_IRQ]);
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
-    lcd_dev = sysbus_create_simple("musicpal_lcd", MP_LCD_BASE, NULL);
-    key_dev = sysbus_create_simple("musicpal_key", -1, NULL);
+    lcd_dev = sysbus_create_simple(TYPE_MUSICPAL_LCD, MP_LCD_BASE, NULL);
+    key_dev = sysbus_create_simple(TYPE_MUSICPAL_KEY, -1, NULL);
 
     /* I2C read data */
     qdev_connect_gpio_out(i2c_dev, 0,
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 3c520d7..7de6453 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -457,9 +457,16 @@
     }
 };
 
+#define TYPE_PXA2XX_SSP "pxa2xx-ssp"
+#define PXA2XX_SSP(obj) \
+    OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
+
 /* Synchronous Serial Ports */
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq;
     int enable;
@@ -757,19 +764,20 @@
     return 0;
 }
 
-static int pxa2xx_ssp_init(SysBusDevice *dev)
+static int pxa2xx_ssp_init(SysBusDevice *sbd)
 {
-    PXA2xxSSPState *s = FROM_SYSBUS(PXA2xxSSPState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxSSPState *s = PXA2XX_SSP(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
                           "pxa2xx-ssp", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    register_savevm(&dev->qdev, "pxa2xx_ssp", -1, 0,
+    sysbus_init_mmio(sbd, &s->iomem);
+    register_savevm(dev, "pxa2xx_ssp", -1, 0,
                     pxa2xx_ssp_save, pxa2xx_ssp_load, s);
 
-    s->bus = ssi_create_bus(&dev->qdev, "ssi");
+    s->bus = ssi_create_bus(dev, "ssi");
     return 0;
 }
 
@@ -790,8 +798,15 @@
 #define RTCPICR		0x34	/* RTC Periodic Interrupt Counter register */
 #define PIAR		0x38	/* RTC Periodic Interrupt Alarm register */
 
+#define TYPE_PXA2XX_RTC "pxa2xx_rtc"
+#define PXA2XX_RTC(obj) \
+    OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t rttr;
     uint32_t rtsr;
@@ -1102,7 +1117,7 @@
 
 static int pxa2xx_rtc_init(SysBusDevice *dev)
 {
-    PXA2xxRTCState *s = FROM_SYSBUS(PXA2xxRTCState, dev);
+    PXA2xxRTCState *s = PXA2XX_RTC(dev);
     struct tm tm;
     int wom;
 
@@ -1197,7 +1212,7 @@
 }
 
 static const TypeInfo pxa2xx_rtc_sysbus_info = {
-    .name          = "pxa2xx_rtc",
+    .name          = TYPE_PXA2XX_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxRTCState),
     .class_init    = pxa2xx_rtc_sysbus_class_init,
@@ -1209,8 +1224,15 @@
     PXA2xxI2CState *host;
 } PXA2xxI2CSlaveState;
 
+#define TYPE_PXA2XX_I2C "pxa2xx_i2c"
+#define PXA2XX_I2C(obj) \
+    OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
+
 struct PXA2xxI2CState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     PXA2xxI2CSlaveState *slave;
     i2c_bus *bus;
@@ -1458,16 +1480,16 @@
     SysBusDevice *i2c_dev;
     PXA2xxI2CState *s;
 
-    i2c_dev = SYS_BUS_DEVICE(qdev_create(NULL, "pxa2xx_i2c"));
-    qdev_prop_set_uint32(&i2c_dev->qdev, "size", region_size + 1);
-    qdev_prop_set_uint32(&i2c_dev->qdev, "offset", base & region_size);
+    dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
+    qdev_prop_set_uint32(dev, "size", region_size + 1);
+    qdev_prop_set_uint32(dev, "offset", base & region_size);
+    qdev_init_nofail(dev);
 
-    qdev_init_nofail(&i2c_dev->qdev);
-
+    i2c_dev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
     sysbus_connect_irq(i2c_dev, 0, irq);
 
-    s = FROM_SYSBUS(PXA2xxI2CState, i2c_dev);
+    s = PXA2XX_I2C(i2c_dev);
     /* FIXME: Should the slave device really be on a separate bus?  */
     dev = i2c_create_slave(i2c_init_bus(NULL, "dummy"), "pxa2xx-i2c-slave", 0);
     s->slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, I2C_SLAVE(dev));
@@ -1476,16 +1498,17 @@
     return s;
 }
 
-static int pxa2xx_i2c_initfn(SysBusDevice *dev)
+static int pxa2xx_i2c_initfn(SysBusDevice *sbd)
 {
-    PXA2xxI2CState *s = FROM_SYSBUS(PXA2xxI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxI2CState *s = PXA2XX_I2C(dev);
 
-    s->bus = i2c_init_bus(&dev->qdev, "i2c");
+    s->bus = i2c_init_bus(dev, "i2c");
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
                           "pxa2xx-i2c", s->region_size);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     return 0;
 }
@@ -1513,7 +1536,7 @@
 }
 
 static const TypeInfo pxa2xx_i2c_info = {
-    .name          = "pxa2xx_i2c",
+    .name          = TYPE_PXA2XX_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxI2CState),
     .class_init    = pxa2xx_i2c_class_init,
@@ -2107,7 +2130,7 @@
     s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
         DeviceState *dev;
-        dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
+        dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
                         qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
     }
@@ -2120,7 +2143,7 @@
     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
 
-    sysbus_create_simple("pxa2xx_rtc", 0x40900000,
+    sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
 
     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
@@ -2238,7 +2261,7 @@
     s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
         DeviceState *dev;
-        dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
+        dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
                         qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
     }
@@ -2251,7 +2274,7 @@
     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
 
-    sysbus_create_simple("pxa2xx_rtc", 0x40900000,
+    sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
 
     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
@@ -2278,7 +2301,7 @@
 }
 
 static const TypeInfo pxa2xx_ssp_info = {
-    .name          = "pxa2xx-ssp",
+    .name          = TYPE_PXA2XX_SSP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxSSPState),
     .class_init    = pxa2xx_ssp_class_init,
diff --git a/hw/arm/pxa2xx_gpio.c b/hw/arm/pxa2xx_gpio.c
index f8c3ee0..ca77f56 100644
--- a/hw/arm/pxa2xx_gpio.c
+++ b/hw/arm/pxa2xx_gpio.c
@@ -13,9 +13,16 @@
 
 #define PXA2XX_GPIO_BANKS	4
 
+#define TYPE_PXA2XX_GPIO "pxa2xx-gpio"
+#define PXA2XX_GPIO(obj) \
+    OBJECT_CHECK(PXA2xxGPIOInfo, (obj), TYPE_PXA2XX_GPIO)
+
 typedef struct PXA2xxGPIOInfo PXA2xxGPIOInfo;
 struct PXA2xxGPIOInfo {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq0, irq1, irqX;
     int lines;
@@ -256,7 +263,7 @@
     CPUState *cs = CPU(cpu);
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "pxa2xx-gpio");
+    dev = qdev_create(NULL, TYPE_PXA2XX_GPIO);
     qdev_prop_set_int32(dev, "lines", lines);
     qdev_prop_set_int32(dev, "ncpu", cs->cpu_index);
     qdev_init_nofail(dev);
@@ -272,22 +279,21 @@
     return dev;
 }
 
-static int pxa2xx_gpio_initfn(SysBusDevice *dev)
+static int pxa2xx_gpio_initfn(SysBusDevice *sbd)
 {
-    PXA2xxGPIOInfo *s;
-
-    s = FROM_SYSBUS(PXA2xxGPIOInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxGPIOInfo *s = PXA2XX_GPIO(dev);
 
     s->cpu = ARM_CPU(qemu_get_cpu(s->ncpu));
 
-    qdev_init_gpio_in(&dev->qdev, pxa2xx_gpio_set, s->lines);
-    qdev_init_gpio_out(&dev->qdev, s->handler, s->lines);
+    qdev_init_gpio_in(dev, pxa2xx_gpio_set, s->lines);
+    qdev_init_gpio_out(dev, s->handler, s->lines);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq0);
-    sysbus_init_irq(dev, &s->irq1);
-    sysbus_init_irq(dev, &s->irqX);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq0);
+    sysbus_init_irq(sbd, &s->irq1);
+    sysbus_init_irq(sbd, &s->irqX);
 
     return 0;
 }
@@ -298,7 +304,8 @@
  */
 void pxa2xx_gpio_read_notifier(DeviceState *dev, qemu_irq handler)
 {
-    PXA2xxGPIOInfo *s = FROM_SYSBUS(PXA2xxGPIOInfo, SYS_BUS_DEVICE(dev));
+    PXA2xxGPIOInfo *s = PXA2XX_GPIO(dev);
+
     s->read_notify = handler;
 }
 
@@ -337,7 +344,7 @@
 }
 
 static const TypeInfo pxa2xx_gpio_info = {
-    .name          = "pxa2xx-gpio",
+    .name          = TYPE_PXA2XX_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxGPIOInfo),
     .class_init    = pxa2xx_gpio_class_init,
diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index 8929b6d..46d337c 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -31,8 +31,15 @@
 
 #define PXA2XX_PIC_SRCS	40
 
+#define TYPE_PXA2XX_PIC "pxa2xx_pic"
+#define PXA2XX_PIC(obj) \
+    OBJECT_CHECK(PXA2xxPICState, (obj), TYPE_PXA2XX_PIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     ARMCPU *cpu;
     uint32_t int_enabled[2];
@@ -260,9 +267,8 @@
 
 DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
 {
-    CPUARMState *env = &cpu->env;
-    DeviceState *dev = qdev_create(NULL, "pxa2xx_pic");
-    PXA2xxPICState *s = FROM_SYSBUS(PXA2xxPICState, SYS_BUS_DEVICE(dev));
+    DeviceState *dev = qdev_create(NULL, TYPE_PXA2XX_PIC);
+    PXA2xxPICState *s = PXA2XX_PIC(dev);
 
     s->cpu = cpu;
 
@@ -284,7 +290,7 @@
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 
     /* Enable IC coprocessor access.  */
-    define_arm_cp_regs_with_opaque(arm_env_get_cpu(env), pxa_pic_cp_reginfo, s);
+    define_arm_cp_regs_with_opaque(cpu, pxa_pic_cp_reginfo, s);
 
     return dev;
 }
@@ -321,7 +327,7 @@
 }
 
 static const TypeInfo pxa2xx_pic_info = {
-    .name          = "pxa2xx_pic",
+    .name          = TYPE_PXA2XX_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxPICState),
     .class_init    = pxa2xx_pic_class_init,
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 593b75e..34f9582 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -50,8 +50,12 @@
 #define FLASHCTL_RYBY		(1 << 5)
 #define FLASHCTL_NCE		(FLASHCTL_CE0 | FLASHCTL_CE1)
 
+#define TYPE_SL_NAND "sl-nand"
+#define SL_NAND(obj) OBJECT_CHECK(SLNANDState, (obj), TYPE_SL_NAND)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     DeviceState *nand;
     uint8_t ctl;
@@ -147,7 +151,7 @@
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "sl-nand");
+    dev = qdev_create(NULL, TYPE_SL_NAND);
 
     qdev_prop_set_uint8(dev, "manf_id", NAND_MFR_SAMSUNG);
     if (size == FLASH_128M)
@@ -159,12 +163,11 @@
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, FLASH_BASE);
 }
 
-static int sl_nand_init(SysBusDevice *dev) {
-    SLNANDState *s;
+static int sl_nand_init(SysBusDevice *dev)
+{
+    SLNANDState *s = SL_NAND(dev);
     DriveInfo *nand;
 
-    s = FROM_SYSBUS(SLNANDState, dev);
-
     s->ctl = 0;
     nand = drive_get(IF_MTD, 0, 0);
     s->nand = nand_init(nand ? nand->bdrv : NULL, s->manf_id, s->chip_id);
@@ -212,8 +215,13 @@
     SPITZ_GPIO_SWA, SPITZ_GPIO_SWB,
 };
 
+#define TYPE_SPITZ_KEYBOARD "spitz-keyboard"
+#define SPITZ_KEYBOARD(obj) \
+    OBJECT_CHECK(SpitzKeyboardState, (obj), TYPE_SPITZ_KEYBOARD)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq sense[SPITZ_KEY_SENSE_NUM];
     qemu_irq gpiomap[5];
     int keymap[0x80];
@@ -458,8 +466,8 @@
     DeviceState *dev;
     SpitzKeyboardState *s;
 
-    dev = sysbus_create_simple("spitz-keyboard", -1, NULL);
-    s = FROM_SYSBUS(SpitzKeyboardState, SYS_BUS_DEVICE(dev));
+    dev = sysbus_create_simple(TYPE_SPITZ_KEYBOARD, -1, NULL);
+    s = SPITZ_KEYBOARD(dev);
 
     for (i = 0; i < SPITZ_KEY_SENSE_NUM; i ++)
         qdev_connect_gpio_out(dev, i, qdev_get_gpio_in(cpu->gpio, spitz_gpio_key_sense[i]));
@@ -482,13 +490,12 @@
     qemu_add_kbd_event_handler(spitz_keyboard_handler, s);
 }
 
-static int spitz_keyboard_init(SysBusDevice *dev)
+static int spitz_keyboard_init(SysBusDevice *sbd)
 {
-    SpitzKeyboardState *s;
+    DeviceState *dev = DEVICE(sbd);
+    SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);
     int i, j;
 
-    s = FROM_SYSBUS(SpitzKeyboardState, dev);
-
     for (i = 0; i < 0x80; i ++)
         s->keymap[i] = -1;
     for (i = 0; i < SPITZ_KEY_SENSE_NUM + 1; i ++)
@@ -499,8 +506,8 @@
     spitz_keyboard_pre_map(s);
 
     s->kbdtimer = qemu_new_timer_ns(vm_clock, spitz_keyboard_tick, s);
-    qdev_init_gpio_in(&dev->qdev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
-    qdev_init_gpio_out(&dev->qdev, s->sense, SPITZ_KEY_SENSE_NUM);
+    qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
+    qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);
 
     return 0;
 }
@@ -1027,7 +1034,7 @@
 }
 
 static const TypeInfo sl_nand_info = {
-    .name          = "sl-nand",
+    .name          = TYPE_SL_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLNANDState),
     .class_init    = sl_nand_class_init,
@@ -1062,7 +1069,7 @@
 }
 
 static const TypeInfo spitz_keyboard_info = {
-    .name          = "spitz-keyboard",
+    .name          = TYPE_SPITZ_KEYBOARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SpitzKeyboardState),
     .class_init    = spitz_keyboard_class_init,
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index a2b6b17..79f6b4e 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -43,8 +43,13 @@
 
 /* General purpose timer module.  */
 
+#define TYPE_STELLARIS_GPTM "stellaris-gptm"
+#define STELLARIS_GPTM(obj) \
+    OBJECT_CHECK(gptm_state, (obj), TYPE_STELLARIS_GPTM)
+
 typedef struct gptm_state {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t config;
     uint32_t mode[2];
@@ -300,21 +305,22 @@
     }
 };
 
-static int stellaris_gptm_init(SysBusDevice *dev)
+static int stellaris_gptm_init(SysBusDevice *sbd)
 {
-    gptm_state *s = FROM_SYSBUS(gptm_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    gptm_state *s = STELLARIS_GPTM(dev);
 
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_out(&dev->qdev, &s->trigger, 1);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_out(dev, &s->trigger, 1);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &gptm_ops, s,
                           "gptm", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     s->opaque[0] = s->opaque[1] = s;
     s->timer[0] = qemu_new_timer_ns(vm_clock, gptm_tick, &s->opaque[0]);
     s->timer[1] = qemu_new_timer_ns(vm_clock, gptm_tick, &s->opaque[1]);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_gptm, s);
+    vmstate_register(dev, -1, &vmstate_stellaris_gptm, s);
     return 0;
 }
 
@@ -679,8 +685,13 @@
 
 /* I2C controller.  */
 
+#define TYPE_STELLARIS_I2C "stellaris-i2c"
+#define STELLARIS_I2C(obj) \
+    OBJECT_CHECK(stellaris_i2c_state, (obj), TYPE_STELLARIS_I2C)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     i2c_bus *bus;
     qemu_irq irq;
     MemoryRegion iomem;
@@ -853,21 +864,22 @@
     }
 };
 
-static int stellaris_i2c_init(SysBusDevice * dev)
+static int stellaris_i2c_init(SysBusDevice *sbd)
 {
-    stellaris_i2c_state *s = FROM_SYSBUS(stellaris_i2c_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_i2c_state *s = STELLARIS_I2C(dev);
     i2c_bus *bus;
 
-    sysbus_init_irq(dev, &s->irq);
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    sysbus_init_irq(sbd, &s->irq);
+    bus = i2c_init_bus(dev, "i2c");
     s->bus = bus;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_i2c_ops, s,
                           "i2c", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     /* ??? For now we only implement the master interface.  */
     stellaris_i2c_reset(s);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_i2c, s);
+    vmstate_register(dev, -1, &vmstate_stellaris_i2c, s);
     return 0;
 }
 
@@ -885,9 +897,13 @@
 #define STELLARIS_ADC_FIFO_EMPTY    0x0100
 #define STELLARIS_ADC_FIFO_FULL     0x1000
 
-typedef struct
-{
-    SysBusDevice busdev;
+#define TYPE_STELLARIS_ADC "stellaris-adc"
+#define STELLARIS_ADC(obj) \
+    OBJECT_CHECK(stellaris_adc_state, (obj), TYPE_STELLARIS_ADC)
+
+typedef struct StellarisADCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t actss;
     uint32_t ris;
@@ -1136,21 +1152,22 @@
     }
 };
 
-static int stellaris_adc_init(SysBusDevice *dev)
+static int stellaris_adc_init(SysBusDevice *sbd)
 {
-    stellaris_adc_state *s = FROM_SYSBUS(stellaris_adc_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_adc_state *s = STELLARIS_ADC(dev);
     int n;
 
     for (n = 0; n < 4; n++) {
-        sysbus_init_irq(dev, &s->irq[n]);
+        sysbus_init_irq(sbd, &s->irq[n]);
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_adc_ops, s,
                           "adc", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     stellaris_adc_reset(s);
-    qdev_init_gpio_in(&dev->qdev, stellaris_adc_trigger, 1);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_adc, s);
+    qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
+    vmstate_register(dev, -1, &vmstate_stellaris_adc, s);
     return 0;
 }
 
@@ -1207,7 +1224,7 @@
                       flash_size, sram_size, kernel_filename, cpu_model);
 
     if (board->dc1 & (1 << 16)) {
-        dev = sysbus_create_varargs("stellaris-adc", 0x40038000,
+        dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     pic[14], pic[15], pic[16], pic[17], NULL);
         adc = qdev_get_gpio_in(dev, 0);
     } else {
@@ -1215,7 +1232,7 @@
     }
     for (i = 0; i < 4; i++) {
         if (board->dc2 & (0x10000 << i)) {
-            dev = sysbus_create_simple("stellaris-gptm",
+            dev = sysbus_create_simple(TYPE_STELLARIS_GPTM,
                                        0x40030000 + i * 0x1000,
                                        pic[timer_irq[i]]);
             /* TODO: This is incorrect, but we get away with it because
@@ -1238,7 +1255,7 @@
     }
 
     if (board->dc2 & (1 << 12)) {
-        dev = sysbus_create_simple("stellaris-i2c", 0x40020000, pic[8]);
+        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000, pic[8]);
         i2c = (i2c_bus *)qdev_get_child_bus(dev, "i2c");
         if (board->peripherals & BP_OLED_I2C) {
             i2c_create_slave(i2c, "ssd0303", 0x3d);
@@ -1357,7 +1374,7 @@
 }
 
 static const TypeInfo stellaris_i2c_info = {
-    .name          = "stellaris-i2c",
+    .name          = TYPE_STELLARIS_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_i2c_state),
     .class_init    = stellaris_i2c_class_init,
@@ -1371,7 +1388,7 @@
 }
 
 static const TypeInfo stellaris_gptm_info = {
-    .name          = "stellaris-gptm",
+    .name          = TYPE_STELLARIS_GPTM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(gptm_state),
     .class_init    = stellaris_gptm_class_init,
@@ -1385,7 +1402,7 @@
 }
 
 static const TypeInfo stellaris_adc_info = {
-    .name          = "stellaris-adc",
+    .name          = TYPE_STELLARIS_ADC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_adc_state),
     .class_init    = stellaris_adc_class_init,
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index feaaf45..82a9492 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -70,8 +70,14 @@
 };
 
 /* Interrupt Controller */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_STRONGARM_PIC "strongarm_pic"
+#define STRONGARM_PIC(obj) \
+    OBJECT_CHECK(StrongARMPICState, (obj), TYPE_STRONGARM_PIC)
+
+typedef struct StrongARMPICState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq    irq;
     qemu_irq    fiq;
@@ -168,16 +174,17 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int strongarm_pic_initfn(SysBusDevice *dev)
+static int strongarm_pic_initfn(SysBusDevice *sbd)
 {
-    StrongARMPICState *s = FROM_SYSBUS(StrongARMPICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMPICState *s = STRONGARM_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, strongarm_pic_set_irq, SA_PIC_SRCS);
+    qdev_init_gpio_in(dev, strongarm_pic_set_irq, SA_PIC_SRCS);
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_pic_ops, s,
                           "pic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
 
     return 0;
 }
@@ -214,7 +221,7 @@
 }
 
 static const TypeInfo strongarm_pic_info = {
-    .name          = "strongarm_pic",
+    .name          = TYPE_STRONGARM_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMPICState),
     .class_init    = strongarm_pic_class_init,
@@ -235,8 +242,13 @@
  * trim delete isn't emulated, so
  * f = 32 768 / (RTTR_trim + 1) */
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_STRONGARM_RTC "strongarm-rtc"
+#define STRONGARM_RTC(obj) \
+    OBJECT_CHECK(StrongARMRTCState, (obj), TYPE_STRONGARM_RTC)
+
+typedef struct StrongARMRTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t rttr;
     uint32_t rtsr;
@@ -367,7 +379,7 @@
 
 static int strongarm_rtc_init(SysBusDevice *dev)
 {
-    StrongARMRTCState *s = FROM_SYSBUS(StrongARMRTCState, dev);
+    StrongARMRTCState *s = STRONGARM_RTC(dev);
     struct tm tm;
 
     s->rttr = 0x0;
@@ -436,7 +448,7 @@
 }
 
 static const TypeInfo strongarm_rtc_sysbus_info = {
-    .name          = "strongarm-rtc",
+    .name          = TYPE_STRONGARM_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMRTCState),
     .class_init    = strongarm_rtc_sysbus_class_init,
@@ -452,6 +464,10 @@
 #define GEDR 0x18
 #define GAFR 0x1c
 
+#define TYPE_STRONGARM_GPIO "strongarm-gpio"
+#define STRONGARM_GPIO(obj) \
+    OBJECT_CHECK(StrongARMGPIOInfo, (obj), TYPE_STRONGARM_GPIO)
+
 typedef struct StrongARMGPIOInfo StrongARMGPIOInfo;
 struct StrongARMGPIOInfo {
     SysBusDevice busdev;
@@ -618,7 +634,7 @@
     DeviceState *dev;
     int i;
 
-    dev = qdev_create(NULL, "strongarm-gpio");
+    dev = qdev_create(NULL, TYPE_STRONGARM_GPIO);
     qdev_init_nofail(dev);
 
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
@@ -629,24 +645,23 @@
     return dev;
 }
 
-static int strongarm_gpio_initfn(SysBusDevice *dev)
+static int strongarm_gpio_initfn(SysBusDevice *sbd)
 {
-    StrongARMGPIOInfo *s;
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMGPIOInfo *s = STRONGARM_GPIO(dev);
     int i;
 
-    s = FROM_SYSBUS(StrongARMGPIOInfo, dev);
-
-    qdev_init_gpio_in(&dev->qdev, strongarm_gpio_set, 28);
-    qdev_init_gpio_out(&dev->qdev, s->handler, 28);
+    qdev_init_gpio_in(dev, strongarm_gpio_set, 28);
+    qdev_init_gpio_out(dev, s->handler, 28);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_gpio_ops, s,
                           "gpio", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     for (i = 0; i < 11; i++) {
-        sysbus_init_irq(dev, &s->irqs[i]);
+        sysbus_init_irq(sbd, &s->irqs[i]);
     }
-    sysbus_init_irq(dev, &s->irqX);
+    sysbus_init_irq(sbd, &s->irqX);
 
     return 0;
 }
@@ -678,7 +693,7 @@
 }
 
 static const TypeInfo strongarm_gpio_info = {
-    .name          = "strongarm-gpio",
+    .name          = TYPE_STRONGARM_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMGPIOInfo),
     .class_init    = strongarm_gpio_class_init,
@@ -691,9 +706,14 @@
 #define PSDR 0x0c
 #define PPFR 0x10
 
+#define TYPE_STRONGARM_PPC "strongarm-ppc"
+#define STRONGARM_PPC(obj) \
+    OBJECT_CHECK(StrongARMPPCInfo, (obj), TYPE_STRONGARM_PPC)
+
 typedef struct StrongARMPPCInfo StrongARMPPCInfo;
 struct StrongARMPPCInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq handler[28];
 
@@ -802,19 +822,18 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int strongarm_ppc_init(SysBusDevice *dev)
+static int strongarm_ppc_init(SysBusDevice *sbd)
 {
-    StrongARMPPCInfo *s;
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMPPCInfo *s = STRONGARM_PPC(dev);
 
-    s = FROM_SYSBUS(StrongARMPPCInfo, dev);
-
-    qdev_init_gpio_in(&dev->qdev, strongarm_ppc_set, 22);
-    qdev_init_gpio_out(&dev->qdev, s->handler, 22);
+    qdev_init_gpio_in(dev, strongarm_ppc_set, 22);
+    qdev_init_gpio_out(dev, s->handler, 22);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ppc_ops, s,
                           "ppc", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -845,7 +864,7 @@
 }
 
 static const TypeInfo strongarm_ppc_info = {
-    .name          = "strongarm-ppc",
+    .name          = TYPE_STRONGARM_PPC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMPPCInfo),
     .class_init    = strongarm_ppc_class_init,
@@ -889,8 +908,13 @@
 #define RX_FIFO_FRE (1 << 9)
 #define RX_FIFO_ROR (1 << 10)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_STRONGARM_UART "strongarm-uart"
+#define STRONGARM_UART(obj) \
+    OBJECT_CHECK(StrongARMUARTState, (obj), TYPE_STRONGARM_UART)
+
+typedef struct StrongARMUARTState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CharDriverState *chr;
     qemu_irq irq;
@@ -1206,7 +1230,7 @@
 
 static int strongarm_uart_init(SysBusDevice *dev)
 {
-    StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
+    StrongARMUARTState *s = STRONGARM_UART(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_uart_ops, s,
                           "uart", 0x10000);
@@ -1229,7 +1253,7 @@
 
 static void strongarm_uart_reset(DeviceState *dev)
 {
-    StrongARMUARTState *s = DO_UPCAST(StrongARMUARTState, busdev.qdev, dev);
+    StrongARMUARTState *s = STRONGARM_UART(dev);
 
     s->utcr0 = UTCR0_DSS; /* 8 data, no parity */
     s->brd = 23;    /* 9600 */
@@ -1305,15 +1329,21 @@
 }
 
 static const TypeInfo strongarm_uart_info = {
-    .name          = "strongarm-uart",
+    .name          = TYPE_STRONGARM_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMUARTState),
     .class_init    = strongarm_uart_class_init,
 };
 
 /* Synchronous Serial Ports */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_STRONGARM_SSP "strongarm-ssp"
+#define STRONGARM_SSP(obj) \
+    OBJECT_CHECK(StrongARMSSPState, (obj), TYPE_STRONGARM_SSP)
+
+typedef struct StrongARMSSPState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     SSIBus *bus;
@@ -1495,23 +1525,25 @@
     return 0;
 }
 
-static int strongarm_ssp_init(SysBusDevice *dev)
+static int strongarm_ssp_init(SysBusDevice *sbd)
 {
-    StrongARMSSPState *s = FROM_SYSBUS(StrongARMSSPState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMSSPState *s = STRONGARM_SSP(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ssp_ops, s,
                           "ssp", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    s->bus = ssi_create_bus(&dev->qdev, "ssi");
+    s->bus = ssi_create_bus(dev, "ssi");
     return 0;
 }
 
 static void strongarm_ssp_reset(DeviceState *dev)
 {
-    StrongARMSSPState *s = DO_UPCAST(StrongARMSSPState, busdev.qdev, dev);
+    StrongARMSSPState *s = STRONGARM_SSP(dev);
+
     s->sssr = 0x03; /* 3 bit data, SPI, disabled */
     s->rx_start = 0;
     s->rx_level = 0;
@@ -1545,7 +1577,7 @@
 }
 
 static const TypeInfo strongarm_ssp_info = {
-    .name          = "strongarm-ssp",
+    .name          = TYPE_STRONGARM_SSP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMSSPState),
     .class_init    = strongarm_ssp_class_init,
@@ -1592,15 +1624,15 @@
                     qdev_get_gpio_in(s->pic, SA_PIC_OSTC3),
                     NULL);
 
-    sysbus_create_simple("strongarm-rtc", 0x90010000,
+    sysbus_create_simple(TYPE_STRONGARM_RTC, 0x90010000,
                     qdev_get_gpio_in(s->pic, SA_PIC_RTC_ALARM));
 
     s->gpio = strongarm_gpio_init(0x90040000, s->pic);
 
-    s->ppc = sysbus_create_varargs("strongarm-ppc", 0x90060000, NULL);
+    s->ppc = sysbus_create_varargs(TYPE_STRONGARM_PPC, 0x90060000, NULL);
 
     for (i = 0; sa_serial[i].io_base; i++) {
-        DeviceState *dev = qdev_create(NULL, "strongarm-uart");
+        DeviceState *dev = qdev_create(NULL, TYPE_STRONGARM_UART);
         qdev_prop_set_chr(dev, "chardev", serial_hds[i]);
         qdev_init_nofail(dev);
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
@@ -1609,7 +1641,7 @@
                 qdev_get_gpio_in(s->pic, sa_serial[i].irq));
     }
 
-    s->ssp = sysbus_create_varargs("strongarm-ssp", 0x80070000,
+    s->ssp = sysbus_create_varargs(TYPE_STRONGARM_SSP, 0x80070000,
                 qdev_get_gpio_in(s->pic, SA_PIC_SSP), NULL);
     s->ssp_bus = (SSIBus *)qdev_get_child_bus(s->ssp, "ssi");
 
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 725f60f..b48d84c 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -25,15 +25,19 @@
 
 /* Primary interrupt controller.  */
 
-typedef struct vpb_sic_state
-{
-  SysBusDevice busdev;
-  MemoryRegion iomem;
-  uint32_t level;
-  uint32_t mask;
-  uint32_t pic_enable;
-  qemu_irq parent[32];
-  int irq;
+#define TYPE_VERSATILE_PB_SIC "versatilepb_sic"
+#define VERSATILE_PB_SIC(obj) \
+    OBJECT_CHECK(vpb_sic_state, (obj), TYPE_VERSATILE_PB_SIC)
+
+typedef struct vpb_sic_state {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    uint32_t level;
+    uint32_t mask;
+    uint32_t pic_enable;
+    qemu_irq parent[32];
+    int irq;
 } vpb_sic_state;
 
 static const VMStateDescription vmstate_vpb_sic = {
@@ -144,19 +148,20 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int vpb_sic_init(SysBusDevice *dev)
+static int vpb_sic_init(SysBusDevice *sbd)
 {
-    vpb_sic_state *s = FROM_SYSBUS(vpb_sic_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    vpb_sic_state *s = VERSATILE_PB_SIC(dev);
     int i;
 
-    qdev_init_gpio_in(&dev->qdev, vpb_sic_set_irq, 32);
+    qdev_init_gpio_in(dev, vpb_sic_set_irq, 32);
     for (i = 0; i < 32; i++) {
-        sysbus_init_irq(dev, &s->parent[i]);
+        sysbus_init_irq(sbd, &s->parent[i]);
     }
     s->irq = 31;
     memory_region_init_io(&s->iomem, OBJECT(s), &vpb_sic_ops, s,
                           "vpb-sic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -213,7 +218,7 @@
     for (n = 0; n < 32; n++) {
         pic[n] = qdev_get_gpio_in(dev, n);
     }
-    dev = sysbus_create_simple("versatilepb_sic", 0x10003000, NULL);
+    dev = sysbus_create_simple(TYPE_VERSATILE_PB_SIC, 0x10003000, NULL);
     for (n = 0; n < 32; n++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), n, pic[n]);
         sic[n] = qdev_get_gpio_in(dev, n);
@@ -393,7 +398,7 @@
 }
 
 static const TypeInfo vpb_sic_info = {
-    .name          = "versatilepb_sic",
+    .name          = TYPE_VERSATILE_PB_SIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(vpb_sic_state),
     .class_init    = vpb_sic_class_init,
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 365b2f1..01b4dfb 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1420,6 +1420,7 @@
     k->device_id = PCI_DEVICE_ID_INTEL_82801AA_5;
     k->revision = 0x01;
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel 82801AA AC97 Audio";
     dc->vmsd = &vmstate_ac97;
     dc->props = ac97_properties;
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index f72e6ee..0421d47 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -364,6 +364,7 @@
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = adlib_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = ADLIB_DESC;
     dc->props = adlib_properties;
 }
diff --git a/hw/audio/cs4231.c b/hw/audio/cs4231.c
index fabe9e6..d19195a 100644
--- a/hw/audio/cs4231.c
+++ b/hw/audio/cs4231.c
@@ -33,8 +33,13 @@
 #define CS_DREGS 32
 #define CS_MAXDREG (CS_DREGS - 1)
 
+#define TYPE_CS4231 "SUNW,CS4231"
+#define CS4231(obj) \
+    OBJECT_CHECK(CSState, (obj), TYPE_CS4231)
+
 typedef struct CSState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t regs[CS_REGS];
@@ -47,7 +52,7 @@
 
 static void cs_reset(DeviceState *d)
 {
-    CSState *s = container_of(d, CSState, busdev.qdev);
+    CSState *s = CS4231(d);
 
     memset(s->regs, 0, CS_REGS * 4);
     memset(s->dregs, 0, CS_DREGS);
@@ -111,7 +116,7 @@
         break;
     case 4:
         if (val & 1) {
-            cs_reset(&s->busdev.qdev);
+            cs_reset(DEVICE(s));
         }
         val &= 0x7f;
         s->regs[saddr] = val;
@@ -142,7 +147,7 @@
 
 static int cs4231_init1(SysBusDevice *dev)
 {
-    CSState *s = FROM_SYSBUS(CSState, dev);
+    CSState *s = CS4231(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &cs_mem_ops, s, "cs4321",
                           CS_SIZE);
@@ -168,7 +173,7 @@
 }
 
 static const TypeInfo cs4231_info = {
-    .name          = "SUNW,CS4231",
+    .name          = TYPE_CS4231,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(CSState),
     .class_init    = cs4231_class_init,
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 7365c3c..666096b 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -685,6 +685,7 @@
 
     dc->realize = cs4231a_realizefn;
     dc->reset = cs4231a_reset;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Crystal Semiconductor CS4231A";
     dc->vmsd = &vmstate_cs4231a;
     dc->props = cs4231a_properties;
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index f2c40da..adb66ce 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -1069,6 +1069,7 @@
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
     k->subsystem_vendor_id = 0x4942;
     k->subsystem_id = 0x4c4c;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "ENSONIQ AudioPCI ES1370";
     dc->vmsd = &vmstate_es1370;
 }
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index f45ed0b..71be3c6 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -315,6 +315,7 @@
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = gus_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Gravis Ultrasound GF1";
     dc->vmsd = &vmstate_gus;
     dc->props = gus_properties;
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 362d8c0..9550c97 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -1034,6 +1034,7 @@
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, output-only (line-out)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
@@ -1055,6 +1056,7 @@
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, duplex (line-out, line-in)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
@@ -1076,6 +1078,7 @@
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, duplex (speaker, microphone)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 58984dc..32e44ad 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1258,6 +1258,7 @@
 
     k->device_id = 0x2668;
     k->revision = 1;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel HD Audio Controller (ich6)";
 }
 
@@ -1268,6 +1269,7 @@
 
     k->device_id = 0x293e;
     k->revision = 3;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel HD Audio Controller (ich9)";
 }
 
@@ -1296,6 +1298,7 @@
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = hda_codec_dev_init;
     k->exit = hda_codec_dev_exit;
+    set_bit(DEVICE_CATEGORY_SOUND, k->categories);
     k->bus_type = TYPE_HDA_BUS;
     k->props = hda_props;
 }
diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index b40ea43..97194ce 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -36,8 +36,13 @@
 #define MP_AUDIO_CLOCK_24MHZ    (1 << 9)
 #define MP_AUDIO_MONO           (1 << 14)
 
+#define TYPE_MV88W8618_AUDIO "mv88w8618_audio"
+#define MV88W8618_AUDIO(obj) \
+    OBJECT_CHECK(mv88w8618_audio_state, (obj), TYPE_MV88W8618_AUDIO)
+
 typedef struct mv88w8618_audio_state {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t playback_mode;
@@ -219,8 +224,7 @@
 
 static void mv88w8618_audio_reset(DeviceState *d)
 {
-    mv88w8618_audio_state *s = FROM_SYSBUS(mv88w8618_audio_state,
-                                           SYS_BUS_DEVICE(d));
+    mv88w8618_audio_state *s = MV88W8618_AUDIO(d);
 
     s->playback_mode = 0;
     s->status = 0;
@@ -238,7 +242,7 @@
 
 static int mv88w8618_audio_init(SysBusDevice *dev)
 {
-    mv88w8618_audio_state *s = FROM_SYSBUS(mv88w8618_audio_state, dev);
+    mv88w8618_audio_state *s = MV88W8618_AUDIO(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -287,7 +291,7 @@
 }
 
 static const TypeInfo mv88w8618_audio_info = {
-    .name          = "mv88w8618_audio",
+    .name          = TYPE_MV88W8618_AUDIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_audio_state),
     .class_init    = mv88w8618_audio_class_init,
diff --git a/hw/audio/milkymist-ac97.c b/hw/audio/milkymist-ac97.c
index 133de4e..9c0f7a0 100644
--- a/hw/audio/milkymist-ac97.c
+++ b/hw/audio/milkymist-ac97.c
@@ -51,8 +51,13 @@
     CTRL_EN = (1<<0),
 };
 
+#define TYPE_MILKYMIST_AC97 "milkymist-ac97"
+#define MILKYMIST_AC97(obj) \
+    OBJECT_CHECK(MilkymistAC97State, (obj), TYPE_MILKYMIST_AC97)
+
 struct MilkymistAC97State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     QEMUSoundCard card;
@@ -258,7 +263,7 @@
 
 static void milkymist_ac97_reset(DeviceState *d)
 {
-    MilkymistAC97State *s = container_of(d, MilkymistAC97State, busdev.qdev);
+    MilkymistAC97State *s = MILKYMIST_AC97(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -280,7 +285,7 @@
 
 static int milkymist_ac97_init(SysBusDevice *dev)
 {
-    MilkymistAC97State *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistAC97State *s = MILKYMIST_AC97(dev);
 
     struct audsettings as;
     sysbus_init_irq(dev, &s->crrequest_irq);
@@ -330,7 +335,7 @@
 }
 
 static const TypeInfo milkymist_ac97_info = {
-    .name          = "milkymist-ac97",
+    .name          = TYPE_MILKYMIST_AC97,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistAC97State),
     .class_init    = milkymist_ac97_class_init,
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 7ad59a1..9004ce3 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -191,6 +191,7 @@
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = pcspk_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->no_user = 1;
     dc->props = pcspk_properties;
 }
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index 7d331b9..5393b52 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -70,8 +70,12 @@
     uint8_t rx_sample_size;
 } pl041_channel;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL041 "pl041"
+#define PL041(obj) OBJECT_CHECK(PL041State, (obj), TYPE_PL041)
+
+typedef struct PL041State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -80,7 +84,7 @@
     pl041_regfile regs;
     pl041_channel fifo1;
     lm4549_state codec;
-} pl041_state;
+} PL041State;
 
 
 static const unsigned char pl041_default_id[8] = {
@@ -107,7 +111,7 @@
 }
 #endif
 
-static uint8_t pl041_compute_periphid3(pl041_state *s)
+static uint8_t pl041_compute_periphid3(PL041State *s)
 {
     uint8_t id3 = 1; /* One channel */
 
@@ -142,7 +146,7 @@
     return id3;
 }
 
-static void pl041_reset(pl041_state *s)
+static void pl041_reset(PL041State *s)
 {
     DBG_L1("pl041_reset\n");
 
@@ -156,7 +160,7 @@
 }
 
 
-static void pl041_fifo1_write(pl041_state *s, uint32_t value)
+static void pl041_fifo1_write(PL041State *s, uint32_t value)
 {
     pl041_channel *channel = &s->fifo1;
     pl041_fifo *fifo = &s->fifo1.tx_fifo;
@@ -239,7 +243,7 @@
     DBG_L2("fifo1_push sr1 = 0x%08x\n", s->regs.sr1);
 }
 
-static void pl041_fifo1_transmit(pl041_state *s)
+static void pl041_fifo1_transmit(PL041State *s)
 {
     pl041_channel *channel = &s->fifo1;
     pl041_fifo *fifo = &s->fifo1.tx_fifo;
@@ -291,7 +295,7 @@
     }
 }
 
-static void pl041_isr1_update(pl041_state *s)
+static void pl041_isr1_update(PL041State *s)
 {
     /* Update ISR1 */
     if (s->regs.sr1 & TXUNDERRUN) {
@@ -320,7 +324,7 @@
 
 static void pl041_request_data(void *opaque)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
 
     /* Trigger pending transfers */
     pl041_fifo1_transmit(s);
@@ -330,7 +334,7 @@
 static uint64_t pl041_read(void *opaque, hwaddr offset,
                                 unsigned size)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
     int value;
 
     if ((offset >= PL041_periphid0) && (offset <= PL041_pcellid3)) {
@@ -364,7 +368,7 @@
 static void pl041_write(void *opaque, hwaddr offset,
                              uint64_t value, unsigned size)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
     uint16_t control, data;
     uint32_t result;
 
@@ -504,7 +508,7 @@
 
 static void pl041_device_reset(DeviceState *d)
 {
-    pl041_state *s = DO_UPCAST(pl041_state, busdev.qdev, d);
+    PL041State *s = PL041(d);
 
     pl041_reset(s);
 }
@@ -517,7 +521,7 @@
 
 static int pl041_init(SysBusDevice *dev)
 {
-    pl041_state *s = FROM_SYSBUS(pl041_state, dev);
+    PL041State *s = PL041(dev);
 
     DBG_L1("pl041_init 0x%08x\n", (uint32_t)s);
 
@@ -603,12 +607,12 @@
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(fifo_depth, pl041_state),
-        VMSTATE_STRUCT(regs, pl041_state, 0,
+        VMSTATE_UINT32(fifo_depth, PL041State),
+        VMSTATE_STRUCT(regs, PL041State, 0,
                        vmstate_pl041_regfile, pl041_regfile),
-        VMSTATE_STRUCT(fifo1, pl041_state, 0,
+        VMSTATE_STRUCT(fifo1, PL041State, 0,
                        vmstate_pl041_channel, pl041_channel),
-        VMSTATE_STRUCT(codec, pl041_state, 0,
+        VMSTATE_STRUCT(codec, PL041State, 0,
                        vmstate_lm4549_state, lm4549_state),
         VMSTATE_END_OF_LIST()
     }
@@ -616,7 +620,8 @@
 
 static Property pl041_device_properties[] = {
     /* Non-compact FIFO depth property */
-    DEFINE_PROP_UINT32("nc_fifo_depth", pl041_state, fifo_depth, DEFAULT_FIFO_DEPTH),
+    DEFINE_PROP_UINT32("nc_fifo_depth", PL041State, fifo_depth,
+                       DEFAULT_FIFO_DEPTH),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -626,6 +631,7 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl041_init;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->no_user = 1;
     dc->reset = pl041_device_reset;
     dc->vmsd = &vmstate_pl041;
@@ -633,9 +639,9 @@
 }
 
 static const TypeInfo pl041_device_info = {
-    .name          = "pl041",
+    .name          = TYPE_PL041,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl041_state),
+    .instance_size = sizeof(PL041State),
     .class_init    = pl041_device_class_init,
 };
 
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index e697bc1..3e58688 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -1412,6 +1412,7 @@
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = sb16_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Creative Sound Blaster 16";
     dc->vmsd = &vmstate_sb16;
     dc->props = sb16_properties;
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 2faed43..411becc 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -18,7 +18,6 @@
 #include "qemu/error-report.h"
 #include "hw/virtio/dataplane/vring.h"
 #include "ioq.h"
-#include "migration/migration.h"
 #include "block/block.h"
 #include "hw/virtio/virtio-blk.h"
 #include "virtio-blk.h"
@@ -69,8 +68,6 @@
                                              queue */
 
     unsigned int num_reqs;
-
-    Error *migration_blocker;
 };
 
 /* Raise an interrupt to signal guest, if necessary */
@@ -418,6 +415,14 @@
         return false;
     }
 
+    /* If dataplane is (re-)enabled while the guest is running there could be
+     * block jobs that can conflict.
+     */
+    if (bdrv_in_use(blk->conf.bs)) {
+        error_report("cannot start dataplane thread while device is in use");
+        return false;
+    }
+
     fd = raw_get_aio_fd(blk->conf.bs);
     if (fd < 0) {
         error_report("drive is incompatible with x-data-plane, "
@@ -433,10 +438,6 @@
     /* Prevent block operations that conflict with data plane thread */
     bdrv_set_in_use(blk->conf.bs, 1);
 
-    error_setg(&s->migration_blocker,
-            "x-data-plane does not support migration");
-    migrate_add_blocker(s->migration_blocker);
-
     *dataplane = s;
     return true;
 }
@@ -448,8 +449,6 @@
     }
 
     virtio_blk_data_plane_stop(s);
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
     bdrv_set_in_use(s->blk->conf.bs, 0);
     g_free(s);
 }
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index d32f6ba..e35ed2e 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -544,7 +544,7 @@
     uint8_t timer1;
 };
 
-#define TYPE_SYSBUS_FDC "sysbus-fdc"
+#define TYPE_SYSBUS_FDC "base-sysbus-fdc"
 #define SYSBUS_FDC(obj) OBJECT_CHECK(FDCtrlSysBus, (obj), TYPE_SYSBUS_FDC)
 
 typedef struct FDCtrlSysBus {
@@ -2055,7 +2055,7 @@
     SysBusDevice *sbd;
     FDCtrlSysBus *sys;
 
-    dev = qdev_create(NULL, TYPE_SYSBUS_FDC);
+    dev = qdev_create(NULL, "sysbus-fdc");
     sys = SYSBUS_FDC(dev);
     fdctrl = &sys->state;
     fdctrl->dma_chann = dma_chann; /* FIXME */
@@ -2153,60 +2153,49 @@
 
 static void sysbus_fdc_initfn(Object *obj)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
 
-    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_ops, fdctrl,
-                          "fdc", 0x08);
-}
-
-static void sysbus_fdc_realize(DeviceState *dev, Error **errp)
-{
-    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
-    FDCtrl *fdctrl = &sys->state;
-    SysBusDevice *b = SYS_BUS_DEVICE(dev);
-    Error *err = NULL;
-
-    sysbus_init_mmio(b, &fdctrl->iomem);
-    sysbus_init_irq(b, &fdctrl->irq);
-    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
     fdctrl->dma_chann = -1;
 
-    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    fdctrl_realize_common(fdctrl, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
-        return;
-    }
+    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_ops, fdctrl,
+                          "fdc", 0x08);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
 }
 
 static void sun4m_fdc_initfn(Object *obj)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
 
+    fdctrl->sun4m = 1;
+
     memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
                           fdctrl, "fdctrl", 0x08);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
 }
 
-static void sun4m_fdc_realize(DeviceState *dev, Error **errp)
+static void sysbus_fdc_common_initfn(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    FDCtrlSysBus *sys = SYSBUS_FDC(obj);
+    FDCtrl *fdctrl = &sys->state;
+
+    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
+
+    sysbus_init_irq(sbd, &fdctrl->irq);
+    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
+}
+
+static void sysbus_fdc_common_realize(DeviceState *dev, Error **errp)
 {
     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    Error *err = NULL;
 
-    sysbus_init_mmio(sbd, &fdctrl->iomem);
-    sysbus_init_irq(sbd, &fdctrl->irq);
-    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
-
-    fdctrl->sun4m = 1;
-    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    fdctrl_realize_common(fdctrl, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
-        return;
-    }
+    fdctrl_realize_common(fdctrl, errp);
 }
 
 FDriveType isa_fdc_get_drive_type(ISADevice *fdc, int i)
@@ -2249,6 +2238,7 @@
     dc->reset = fdctrl_external_reset_isa;
     dc->vmsd = &vmstate_isa_fdc;
     dc->props = isa_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo isa_fdc_info = {
@@ -2278,16 +2268,13 @@
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = sysbus_fdc_realize;
-    dc->reset = fdctrl_external_reset_sysbus;
-    dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sysbus_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_fdc_info = {
-    .name          = TYPE_SYSBUS_FDC,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FDCtrlSysBus),
+    .name          = "sysbus-fdc",
+    .parent        = TYPE_SYSBUS_FDC,
     .instance_init = sysbus_fdc_initfn,
     .class_init    = sysbus_fdc_class_init,
 };
@@ -2301,23 +2288,39 @@
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = sun4m_fdc_realize;
-    dc->reset = fdctrl_external_reset_sysbus;
-    dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sun4m_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sun4m_fdc_info = {
     .name          = "SUNW,fdtwo",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FDCtrlSysBus),
+    .parent        = TYPE_SYSBUS_FDC,
     .instance_init = sun4m_fdc_initfn,
     .class_init    = sun4m_fdc_class_init,
 };
 
+static void sysbus_fdc_common_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = sysbus_fdc_common_realize;
+    dc->reset = fdctrl_external_reset_sysbus;
+    dc->vmsd = &vmstate_sysbus_fdc;
+}
+
+static const TypeInfo sysbus_fdc_type_info = {
+    .name          = TYPE_SYSBUS_FDC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(FDCtrlSysBus),
+    .instance_init = sysbus_fdc_common_initfn,
+    .abstract      = true,
+    .class_init    = sysbus_fdc_common_class_init,
+};
+
 static void fdc_register_types(void)
 {
     type_register_static(&isa_fdc_info);
+    type_register_static(&sysbus_fdc_type_info);
     type_register_static(&sysbus_fdc_info);
     type_register_static(&sun4m_fdc_info);
 }
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index f15f04a..0263e5c 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -866,6 +866,7 @@
     pc->revision = 1;
     pc->is_express = 1;
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "Non-Volatile Memory Express";
     dc->props = nvme_props;
     dc->vmsd = &nvme_vmstate;
diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 2776f64..aae9ee7 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -34,8 +34,12 @@
 /* Fixed */
 #define BLOCK_SHIFT	(PAGE_SHIFT + 6)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_ONE_NAND "onenand"
+#define ONE_NAND(obj) OBJECT_CHECK(OneNANDState, (obj), TYPE_ONE_NAND)
+
+typedef struct OneNANDState {
+    SysBusDevice parent_obj;
+
     struct {
         uint16_t man;
         uint16_t dev;
@@ -226,7 +230,9 @@
 
 static void onenand_system_reset(DeviceState *dev)
 {
-    onenand_reset(FROM_SYSBUS(OneNANDState, SYS_BUS_DEVICE(dev)), 1);
+    OneNANDState *s = ONE_NAND(dev);
+
+    onenand_reset(s, 1);
 }
 
 static inline int onenand_load_main(OneNANDState *s, int sec, int secn,
@@ -757,11 +763,13 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int onenand_initfn(SysBusDevice *dev)
+static int onenand_initfn(SysBusDevice *sbd)
 {
-    OneNANDState *s = (OneNANDState *)dev;
+    DeviceState *dev = DEVICE(sbd);
+    OneNANDState *s = ONE_NAND(dev);
     uint32_t size = 1 << (24 + ((s->id.dev >> 4) & 7));
     void *ram;
+
     s->base = (hwaddr)-1;
     s->rdy = NULL;
     s->blocks = size >> BLOCK_SHIFT;
@@ -794,9 +802,9 @@
     s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
     s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);
     onenand_mem_setup(s);
-    sysbus_init_irq(dev, &s->intr);
-    sysbus_init_mmio(dev, &s->container);
-    vmstate_register(&dev->qdev,
+    sysbus_init_irq(sbd, &s->intr);
+    sysbus_init_mmio(sbd, &s->container);
+    vmstate_register(dev,
                      ((s->shift & 0x7f) << 24)
                      | ((s->id.man & 0xff) << 16)
                      | ((s->id.dev & 0xff) << 8)
@@ -825,7 +833,7 @@
 }
 
 static const TypeInfo onenand_info = {
-    .name          = "onenand",
+    .name          = TYPE_ONE_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OneNANDState),
     .class_init    = onenand_class_init,
@@ -838,7 +846,9 @@
 
 void *onenand_raw_otp(DeviceState *onenand_device)
 {
-    return FROM_SYSBUS(OneNANDState, SYS_BUS_DEVICE(onenand_device))->otp;
+    OneNANDState *s = ONE_NAND(onenand_device);
+
+    return s->otp;
 }
 
 type_init(onenand_register_types)
diff --git a/hw/block/pc_sysfw.c b/hw/block/pc_sysfw.c
index 0669410..7db68f0 100644
--- a/hw/block/pc_sysfw.c
+++ b/hw/block/pc_sysfw.c
@@ -286,6 +286,7 @@
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "PC System Firmware";
     dc->init = pcsysfw_init;
     dc->props = pcsysfw_properties;
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 2973859..825011d 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -723,6 +723,7 @@
     dc->realize = pflash_cfi01_realize;
     dc->props = pflash_cfi01_properties;
     dc->vmsd = &vmstate_pflash;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index cf12469..e2f55cc 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -19,6 +19,7 @@
 #include "hw/virtio/virtio-blk.h"
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
 # include "dataplane/virtio-blk.h"
+# include "migration/migration.h"
 #endif
 #include "block/scsi.h"
 #ifdef __linux__
@@ -628,6 +629,34 @@
     memcpy(&(s->blk), blk, sizeof(struct VirtIOBlkConf));
 }
 
+#ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+/* Disable dataplane thread during live migration since it does not
+ * update the dirty memory bitmap yet.
+ */
+static void virtio_blk_migration_state_changed(Notifier *notifier, void *data)
+{
+    VirtIOBlock *s = container_of(notifier, VirtIOBlock,
+                                  migration_state_notifier);
+    MigrationState *mig = data;
+
+    if (migration_in_setup(mig)) {
+        if (!s->dataplane) {
+            return;
+        }
+        virtio_blk_data_plane_destroy(s->dataplane);
+        s->dataplane = NULL;
+    } else if (migration_has_finished(mig) ||
+               migration_has_failed(mig)) {
+        if (s->dataplane) {
+            return;
+        }
+        bdrv_drain_all(); /* complete in-flight non-dataplane requests */
+        virtio_blk_data_plane_create(VIRTIO_DEVICE(s), &s->blk,
+                                     &s->dataplane);
+    }
+}
+#endif /* CONFIG_VIRTIO_BLK_DATA_PLANE */
+
 static int virtio_blk_device_init(VirtIODevice *vdev)
 {
     DeviceState *qdev = DEVICE(vdev);
@@ -664,6 +693,8 @@
         virtio_cleanup(vdev);
         return -1;
     }
+    s->migration_state_notifier.notify = virtio_blk_migration_state_changed;
+    add_migration_state_change_notifier(&s->migration_state_notifier);
 #endif
 
     s->change = qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
@@ -683,6 +714,7 @@
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOBlock *s = VIRTIO_BLK(dev);
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    remove_migration_state_change_notifier(&s->migration_state_notifier);
     virtio_blk_data_plane_destroy(s->dataplane);
     s->dataplane = NULL;
 #endif
@@ -704,6 +736,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_blk_device_exit;
     dc->props = virtio_blk_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_blk_device_init;
     vdc->get_config = virtio_blk_update_config;
     vdc->set_config = virtio_blk_set_config;
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 4d457f8..3c2e960 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -106,8 +106,12 @@
 
 #define R_MAX (R_TTRIG + 1)
 
+#define TYPE_CADENCE_UART "cadence_uart"
+#define CADENCE_UART(obj) OBJECT_CHECK(UartState, (obj), TYPE_CADENCE_UART)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t r[R_MAX];
     uint8_t r_fifo[RX_FIFO_SIZE];
@@ -442,7 +446,7 @@
 
 static int cadence_uart_init(SysBusDevice *dev)
 {
-    UartState *s = FROM_SYSBUS(UartState, dev);
+    UartState *s = CADENCE_UART(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &uart_ops, s, "uart", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -504,7 +508,7 @@
 }
 
 static const TypeInfo cadence_uart_info = {
-    .name          = "cadence_uart",
+    .name          = TYPE_CADENCE_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(UartState),
     .class_init    = cadence_uart_class_init,
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index 03db12f..02d0d57 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -122,6 +122,7 @@
 
     dc->realize = debugcon_isa_realizefn;
     dc->props = debugcon_isa_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo debugcon_isa_info = {
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 4c42198..6397f6f 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -96,8 +96,11 @@
     uint8_t rx, tx;
 } ChannelState;
 
+#define ESCC(obj) OBJECT_CHECK(ESCCState, (obj), TYPE_ESCC)
+
 typedef struct ESCCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     struct ChannelState chn[2];
     uint32_t it_shift;
     MemoryRegion mmio;
@@ -309,7 +312,7 @@
 
 static void escc_reset(DeviceState *d)
 {
-    ESCCState *s = container_of(d, ESCCState, busdev.qdev);
+    ESCCState *s = ESCC(d);
 
     escc_reset_chn(&s->chn[0]);
     escc_reset_chn(&s->chn[1]);
@@ -534,7 +537,7 @@
                 escc_reset_chn(&serial->chn[1]);
                 return;
             case MINTR_RST_ALL:
-                escc_reset(&serial->busdev.qdev);
+                escc_reset(DEVICE(serial));
                 return;
             }
             break;
@@ -691,7 +694,7 @@
     SysBusDevice *s;
     ESCCState *d;
 
-    dev = qdev_create(NULL, "escc");
+    dev = qdev_create(NULL, TYPE_ESCC);
     qdev_prop_set_uint32(dev, "disabled", 0);
     qdev_prop_set_uint32(dev, "frequency", clock);
     qdev_prop_set_uint32(dev, "it_shift", it_shift);
@@ -707,7 +710,7 @@
         sysbus_mmio_map(s, 0, base);
     }
 
-    d = FROM_SYSBUS(ESCCState, s);
+    d = ESCC(s);
     return &d->mmio;
 }
 
@@ -852,7 +855,7 @@
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "escc");
+    dev = qdev_create(NULL, TYPE_ESCC);
     qdev_prop_set_uint32(dev, "disabled", disabled);
     qdev_prop_set_uint32(dev, "frequency", clock);
     qdev_prop_set_uint32(dev, "it_shift", it_shift);
@@ -869,7 +872,7 @@
 
 static int escc_init1(SysBusDevice *dev)
 {
-    ESCCState *s = FROM_SYSBUS(ESCCState, dev);
+    ESCCState *s = ESCC(dev);
     unsigned int i;
 
     s->chn[0].disabled = s->disabled;
@@ -924,7 +927,7 @@
 }
 
 static const TypeInfo escc_info = {
-    .name          = "escc",
+    .name          = TYPE_ESCC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ESCCState),
     .class_init    = escc_class_init,
diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index d19af00..460094e 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -44,9 +44,13 @@
 #define STAT_TR_IDLE 22
 #define STAT_TR_RDY  24
 
-struct etrax_serial
-{
-    SysBusDevice busdev;
+#define TYPE_ETRAX_FS_SERIAL "etraxfs,serial"
+#define ETRAX_SERIAL(obj) \
+    OBJECT_CHECK(ETRAXSerial, (obj), TYPE_ETRAX_FS_SERIAL)
+
+typedef struct ETRAXSerial {
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     CharDriverState *chr;
     qemu_irq irq;
@@ -59,9 +63,9 @@
 
     /* Control registers.  */
     uint32_t regs[R_MAX];
-};
+} ETRAXSerial;
 
-static void ser_update_irq(struct etrax_serial *s)
+static void ser_update_irq(ETRAXSerial *s)
 {
 
     if (s->rx_fifo_len) {
@@ -77,7 +81,7 @@
 static uint64_t
 ser_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     uint32_t r = 0;
 
     addr >>= 2;
@@ -112,7 +116,7 @@
 ser_write(void *opaque, hwaddr addr,
           uint64_t val64, unsigned int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     uint32_t value = val64;
     unsigned char ch = val64;
 
@@ -156,7 +160,7 @@
 
 static void serial_receive(void *opaque, const uint8_t *buf, int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     int i;
 
     /* Got a byte.  */
@@ -177,7 +181,7 @@
 
 static int serial_can_receive(void *opaque)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     int r;
 
     /* Is the receiver enabled?  */
@@ -196,7 +200,7 @@
 
 static void etraxfs_ser_reset(DeviceState *d)
 {
-    struct etrax_serial *s = container_of(d, typeof(*s), busdev.qdev);
+    ETRAXSerial *s = ETRAX_SERIAL(d);
 
     /* transmitter begins ready and idle.  */
     s->regs[RS_STAT_DIN] |= (1 << STAT_TR_RDY);
@@ -208,7 +212,7 @@
 
 static int etraxfs_ser_init(SysBusDevice *dev)
 {
-    struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
+    ETRAXSerial *s = ETRAX_SERIAL(dev);
 
     sysbus_init_irq(dev, &s->irq);
     memory_region_init_io(&s->mmio, OBJECT(s), &ser_ops, s,
@@ -216,10 +220,11 @@
     sysbus_init_mmio(dev, &s->mmio);
 
     s->chr = qemu_char_get_next_serial();
-    if (s->chr)
+    if (s->chr) {
         qemu_chr_add_handlers(s->chr,
-                      serial_can_receive, serial_receive,
-                      serial_event, s);
+                              serial_can_receive, serial_receive,
+                              serial_event, s);
+    }
     return 0;
 }
 
@@ -233,9 +238,9 @@
 }
 
 static const TypeInfo etraxfs_ser_info = {
-    .name          = "etraxfs,serial",
+    .name          = TYPE_ETRAX_FS_SERIAL,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct etrax_serial),
+    .instance_size = sizeof(ETRAXSerial),
     .class_init    = etraxfs_ser_class_init,
 };
 
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index 855ce7a..eef23a0 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -166,8 +166,13 @@
     uint32_t    size;
 } Exynos4210UartFIFO;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_EXYNOS4210_UART "exynos4210.uart"
+#define EXYNOS4210_UART(obj) \
+    OBJECT_CHECK(Exynos4210UartState, (obj), TYPE_EXYNOS4210_UART)
+
+typedef struct Exynos4210UartState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t             reg[EXYNOS4210_UART_REGS_MEM_SIZE / sizeof(uint32_t)];
@@ -538,8 +543,7 @@
 
 static void exynos4210_uart_reset(DeviceState *dev)
 {
-    Exynos4210UartState *s =
-            container_of(dev, Exynos4210UartState, busdev.qdev);
+    Exynos4210UartState *s = EXYNOS4210_UART(dev);
     int regs_number = sizeof(exynos4210_uart_regs)/sizeof(Exynos4210UartReg);
     int i;
 
@@ -582,10 +586,10 @@
 };
 
 DeviceState *exynos4210_uart_create(hwaddr addr,
-                                 int fifo_size,
-                                 int channel,
-                                 CharDriverState *chr,
-                                 qemu_irq irq)
+                                    int fifo_size,
+                                    int channel,
+                                    CharDriverState *chr,
+                                    qemu_irq irq)
 {
     DeviceState  *dev;
     SysBusDevice *bus;
@@ -593,7 +597,7 @@
     const char chr_name[] = "serial";
     char label[ARRAY_SIZE(chr_name) + 1];
 
-    dev = qdev_create(NULL, "exynos4210.uart");
+    dev = qdev_create(NULL, TYPE_EXYNOS4210_UART);
 
     if (!chr) {
         if (channel >= MAX_SERIAL_PORTS) {
@@ -627,7 +631,7 @@
 
 static int exynos4210_uart_init(SysBusDevice *dev)
 {
-    Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
+    Exynos4210UartState *s = EXYNOS4210_UART(dev);
 
     /* memory mapping */
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_uart_ops, s,
@@ -662,7 +666,7 @@
 }
 
 static const TypeInfo exynos4210_uart_info = {
-    .name          = "exynos4210.uart",
+    .name          = TYPE_EXYNOS4210_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210UartState),
     .class_init    = exynos4210_uart_class_init,
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index 82e1b95..35ef661 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -67,8 +67,13 @@
 
 #define FIFO_LENGTH 1024
 
+#define TYPE_GRLIB_APB_UART "grlib,apbuart"
+#define GRLIB_APB_UART(obj) \
+    OBJECT_CHECK(UART, (obj), TYPE_GRLIB_APB_UART)
+
 typedef struct UART {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -232,7 +237,7 @@
 
 static int grlib_apbuart_init(SysBusDevice *dev)
 {
-    UART *uart = FROM_SYSBUS(typeof(*uart), dev);
+    UART *uart = GRLIB_APB_UART(dev);
 
     qemu_chr_add_handlers(uart->chr,
                           grlib_apbuart_can_receive,
@@ -252,7 +257,7 @@
 
 static void grlib_apbuart_reset(DeviceState *d)
 {
-    UART *uart = container_of(d, UART, busdev.qdev);
+    UART *uart = GRLIB_APB_UART(d);
 
     /* Transmitter FIFO and shift registers are always empty in QEMU */
     uart->status =  UART_TRANSMIT_FIFO_EMPTY | UART_TRANSMIT_SHIFT_EMPTY;
@@ -279,7 +284,7 @@
 }
 
 static const TypeInfo grlib_apbuart_info = {
-    .name          = "grlib,apbuart",
+    .name          = TYPE_GRLIB_APB_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(UART),
     .class_init    = grlib_apbuart_class_init,
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 69b9ed2..7f16835 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -43,8 +43,12 @@
 #  define IPRINTF(fmt, args...) do {} while (0)
 #endif
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_SERIAL "imx-serial"
+#define IMX_SERIAL(obj) OBJECT_CHECK(IMXSerialState, (obj), TYPE_IMX_SERIAL)
+
+typedef struct IMXSerialState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int32_t readbuff;
 
@@ -169,7 +173,7 @@
 
 static void imx_serial_reset_at_boot(DeviceState *dev)
 {
-    IMXSerialState *s = container_of(dev, IMXSerialState, busdev.qdev);
+    IMXSerialState *s = IMX_SERIAL(dev);
 
     imx_serial_reset(s);
 
@@ -383,7 +387,7 @@
 
 static int imx_serial_init(SysBusDevice *dev)
 {
-    IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
+    IMXSerialState *s = IMX_SERIAL(dev);
 
 
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_serial_ops, s,
@@ -410,7 +414,7 @@
     const char chr_name[] = "serial";
     char label[ARRAY_SIZE(chr_name) + 1];
 
-    dev = qdev_create(NULL, "imx-serial");
+    dev = qdev_create(NULL, TYPE_IMX_SERIAL);
 
     if (uart >= MAX_SERIAL_PORTS) {
         hw_error("Cannot assign uart %d: QEMU supports only %d ports\n",
@@ -449,12 +453,13 @@
     k->init = imx_serial_init;
     dc->vmsd = &vmstate_imx_serial;
     dc->reset = imx_serial_reset_at_boot;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "i.MX series UART";
     dc->props = imx32_serial_properties;
 }
 
 static const TypeInfo imx_serial_info = {
-    .name = "imx-serial",
+    .name = TYPE_IMX_SERIAL,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXSerialState),
     .class_init = imx_serial_class_init,
diff --git a/hw/char/ipack.c b/hw/char/ipack.c
index e15540d..f890471 100644
--- a/hw/char/ipack.c
+++ b/hw/char/ipack.c
@@ -74,6 +74,7 @@
 static void ipack_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
+    set_bit(DEVICE_CATEGORY_INPUT, k->categories);
     k->bus_type = TYPE_IPACK_BUS;
     k->init = ipack_device_dev_init;
     k->exit = ipack_device_dev_exit;
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index c9698a6..88e2cca 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -585,6 +585,7 @@
     ic->mem_read8   = mem_read8;
     ic->mem_write8  = mem_write8;
 
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc    = "GE IP-Octal 232 8-channel RS-232 IndustryPack";
     dc->props   = ipoctal_properties;
     dc->vmsd    = &vmstate_ipoctal;
diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index 839f3eb..252fe46 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -22,7 +22,7 @@
 #include "trace.h"
 #include "sysemu/char.h"
 
-#include "hw/lm32/lm32_juart.h"
+#include "hw/char/lm32_juart.h"
 
 enum {
     LM32_JUART_MIN_SAVE_VERSION = 0,
@@ -38,8 +38,11 @@
     JRX_FULL = (1<<8),
 };
 
+#define LM32_JUART(obj) OBJECT_CHECK(LM32JuartState, (obj), TYPE_LM32_JUART)
+
 struct LM32JuartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     CharDriverState *chr;
 
     uint32_t jtx;
@@ -49,7 +52,7 @@
 
 uint32_t lm32_juart_get_jtx(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_get_jtx(s->jtx);
     return s->jtx;
@@ -57,7 +60,7 @@
 
 uint32_t lm32_juart_get_jrx(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_get_jrx(s->jrx);
     return s->jrx;
@@ -65,7 +68,7 @@
 
 void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
     unsigned char ch = jtx & 0xff;
 
     trace_lm32_juart_set_jtx(s->jtx);
@@ -78,7 +81,7 @@
 
 void lm32_juart_set_jrx(DeviceState *d, uint32_t jtx)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_set_jrx(s->jrx);
     s->jrx &= ~JRX_FULL;
@@ -104,7 +107,7 @@
 
 static void juart_reset(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     s->jtx = 0;
     s->jrx = 0;
@@ -112,7 +115,7 @@
 
 static int lm32_juart_init(SysBusDevice *dev)
 {
-    LM32JuartState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32JuartState *s = LM32_JUART(dev);
 
     s->chr = qemu_char_get_next_serial();
     if (s->chr) {
@@ -145,7 +148,7 @@
 }
 
 static const TypeInfo lm32_juart_info = {
-    .name          = "lm32-juart",
+    .name          = TYPE_LM32_JUART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32JuartState),
     .class_init    = lm32_juart_class_init,
diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index 37b38ba..85d7265 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -89,8 +89,12 @@
     MSR_DCD  = (1<<7),
 };
 
+#define TYPE_LM32_UART "lm32-uart"
+#define LM32_UART(obj) OBJECT_CHECK(LM32UartState, (obj), TYPE_LM32_UART)
+
 struct LM32UartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CharDriverState *chr;
     qemu_irq irq;
@@ -233,7 +237,7 @@
 
 static void uart_reset(DeviceState *d)
 {
-    LM32UartState *s = container_of(d, LM32UartState, busdev.qdev);
+    LM32UartState *s = LM32_UART(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -246,7 +250,7 @@
 
 static int lm32_uart_init(SysBusDevice *dev)
 {
-    LM32UartState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32UartState *s = LM32_UART(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -284,7 +288,7 @@
 }
 
 static const TypeInfo lm32_uart_info = {
-    .name          = "lm32-uart",
+    .name          = TYPE_LM32_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32UartState),
     .class_init    = lm32_uart_class_init,
diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index 46deab2..2e4b5c5 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -52,8 +52,13 @@
     DBG_BREAK_EN = (1<<0),
 };
 
+#define TYPE_MILKYMIST_UART "milkymist-uart"
+#define MILKYMIST_UART(obj) \
+    OBJECT_CHECK(MilkymistUartState, (obj), TYPE_MILKYMIST_UART)
+
 struct MilkymistUartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -179,7 +184,7 @@
 
 static void milkymist_uart_reset(DeviceState *d)
 {
-    MilkymistUartState *s = container_of(d, MilkymistUartState, busdev.qdev);
+    MilkymistUartState *s = MILKYMIST_UART(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -192,12 +197,12 @@
 
 static int milkymist_uart_init(SysBusDevice *dev)
 {
-    MilkymistUartState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistUartState *s = MILKYMIST_UART(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
     memory_region_init_io(&s->regs_region, OBJECT(s), &uart_mmio_ops, s,
-            "milkymist-uart", R_MAX * 4);
+                          "milkymist-uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     s->chr = qemu_char_get_next_serial();
@@ -230,7 +235,7 @@
 }
 
 static const TypeInfo milkymist_uart_info = {
-    .name          = "milkymist-uart",
+    .name          = TYPE_MILKYMIST_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistUartState),
     .class_init    = milkymist_uart_class_init,
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index ad96ea5..7a3b264 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -607,6 +607,7 @@
 
     dc->realize = parallel_isa_realizefn;
     dc->props = parallel_isa_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo parallel_isa_info = {
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index ebec64f..a8ae6f4 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -10,8 +10,12 @@
 #include "hw/sysbus.h"
 #include "sysemu/char.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL011 "pl011"
+#define PL011(obj) OBJECT_CHECK(PL011State, (obj), TYPE_PL011)
+
+typedef struct PL011State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t readbuff;
     uint32_t flags;
@@ -31,7 +35,7 @@
     CharDriverState *chr;
     qemu_irq irq;
     const unsigned char *id;
-} pl011_state;
+} PL011State;
 
 #define PL011_INT_TX 0x20
 #define PL011_INT_RX 0x10
@@ -46,7 +50,7 @@
 static const unsigned char pl011_id_luminary[8] =
   { 0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl011_update(pl011_state *s)
+static void pl011_update(PL011State *s)
 {
     uint32_t flags;
 
@@ -57,7 +61,7 @@
 static uint64_t pl011_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     uint32_t c;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -113,7 +117,7 @@
     }
 }
 
-static void pl011_set_read_trigger(pl011_state *s)
+static void pl011_set_read_trigger(PL011State *s)
 {
 #if 0
     /* The docs say the RX interrupt is triggered when the FIFO exceeds
@@ -130,7 +134,7 @@
 static void pl011_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     unsigned char ch;
 
     switch (offset >> 2) {
@@ -191,7 +195,7 @@
 
 static int pl011_can_receive(void *opaque)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
 
     if (s->lcr & 0x10)
         return s->read_count < 16;
@@ -201,7 +205,7 @@
 
 static void pl011_put_fifo(void *opaque, uint32_t value)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     int slot;
 
     slot = s->read_pos + s->read_count;
@@ -242,83 +246,81 @@
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(readbuff, pl011_state),
-        VMSTATE_UINT32(flags, pl011_state),
-        VMSTATE_UINT32(lcr, pl011_state),
-        VMSTATE_UINT32(cr, pl011_state),
-        VMSTATE_UINT32(dmacr, pl011_state),
-        VMSTATE_UINT32(int_enabled, pl011_state),
-        VMSTATE_UINT32(int_level, pl011_state),
-        VMSTATE_UINT32_ARRAY(read_fifo, pl011_state, 16),
-        VMSTATE_UINT32(ilpr, pl011_state),
-        VMSTATE_UINT32(ibrd, pl011_state),
-        VMSTATE_UINT32(fbrd, pl011_state),
-        VMSTATE_UINT32(ifl, pl011_state),
-        VMSTATE_INT32(read_pos, pl011_state),
-        VMSTATE_INT32(read_count, pl011_state),
-        VMSTATE_INT32(read_trigger, pl011_state),
+        VMSTATE_UINT32(readbuff, PL011State),
+        VMSTATE_UINT32(flags, PL011State),
+        VMSTATE_UINT32(lcr, PL011State),
+        VMSTATE_UINT32(cr, PL011State),
+        VMSTATE_UINT32(dmacr, PL011State),
+        VMSTATE_UINT32(int_enabled, PL011State),
+        VMSTATE_UINT32(int_level, PL011State),
+        VMSTATE_UINT32_ARRAY(read_fifo, PL011State, 16),
+        VMSTATE_UINT32(ilpr, PL011State),
+        VMSTATE_UINT32(ibrd, PL011State),
+        VMSTATE_UINT32(fbrd, PL011State),
+        VMSTATE_UINT32(ifl, PL011State),
+        VMSTATE_INT32(read_pos, PL011State),
+        VMSTATE_INT32(read_count, PL011State),
+        VMSTATE_INT32(read_trigger, PL011State),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static int pl011_init(SysBusDevice *dev, const unsigned char *id)
+static void pl011_init(Object *obj)
 {
-    pl011_state *s = FROM_SYSBUS(pl011_state, dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    PL011State *s = PL011(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl011_ops, s, "pl011", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->id = id;
-    s->chr = qemu_char_get_next_serial();
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->read_trigger = 1;
     s->ifl = 0x12;
     s->cr = 0x300;
     s->flags = 0x90;
+
+    s->id = pl011_id_arm;
+}
+
+static void pl011_realize(DeviceState *dev, Error **errp)
+{
+    PL011State *s = PL011(dev);
+
+    s->chr = qemu_char_get_next_serial();
+
     if (s->chr) {
         qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
                               pl011_event, s);
     }
-    vmstate_register(&dev->qdev, -1, &vmstate_pl011, s);
-    return 0;
 }
 
-static int pl011_arm_init(SysBusDevice *dev)
+static void pl011_class_init(ObjectClass *oc, void *data)
 {
-    return pl011_init(dev, pl011_id_arm);
-}
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-static int pl011_luminary_init(SysBusDevice *dev)
-{
-    return pl011_init(dev, pl011_id_luminary);
-}
-
-static void pl011_arm_class_init(ObjectClass *klass, void *data)
-{
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
-
-    sdc->init = pl011_arm_init;
+    dc->realize = pl011_realize;
+    dc->vmsd = &vmstate_pl011;
 }
 
 static const TypeInfo pl011_arm_info = {
-    .name          = "pl011",
+    .name          = TYPE_PL011,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl011_state),
-    .class_init    = pl011_arm_class_init,
+    .instance_size = sizeof(PL011State),
+    .instance_init = pl011_init,
+    .class_init    = pl011_class_init,
 };
 
-static void pl011_luminary_class_init(ObjectClass *klass, void *data)
+static void pl011_luminary_init(Object *obj)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    PL011State *s = PL011(obj);
 
-    sdc->init = pl011_luminary_init;
+    s->id = pl011_id_luminary;
 }
 
 static const TypeInfo pl011_luminary_info = {
     .name          = "pl011_luminary",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl011_state),
-    .class_init    = pl011_luminary_class_init,
+    .parent        = TYPE_PL011,
+    .instance_init = pl011_luminary_init,
 };
 
 static void pl011_register_types(void)
diff --git a/hw/char/sclpconsole.c b/hw/char/sclpconsole.c
index bcc7893..eb3988c 100644
--- a/hw/char/sclpconsole.c
+++ b/hw/char/sclpconsole.c
@@ -184,8 +184,6 @@
 static ssize_t write_console_data(SCLPEvent *event, const uint8_t *buf,
                                   size_t len)
 {
-    ssize_t ret = 0;
-    const uint8_t *iov_offset;
     SCLPConsole *scon = DO_UPCAST(SCLPConsole, event, event);
 
     if (!scon->chr) {
@@ -193,21 +191,7 @@
         return len;
     }
 
-    iov_offset = buf;
-    while (len > 0) {
-        ret = qemu_chr_fe_write(scon->chr, buf, len);
-        if (ret == 0) {
-            /* a pty doesn't seem to be connected - no error */
-            len = 0;
-        } else if (ret == -EAGAIN || (ret > 0 && ret < len)) {
-            len -= ret;
-            iov_offset += ret;
-        } else {
-            len = 0;
-        }
-    }
-
-    return ret;
+    return qemu_chr_fe_write_all(scon->chr, buf, len);
 }
 
 static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index cea8212..5cb77b3 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -102,6 +102,7 @@
     dc->realize = serial_isa_realizefn;
     dc->vmsd = &vmstate_isa_serial;
     dc->props = serial_isa_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_isa_info = {
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index a17c702..aec6705 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -205,6 +205,7 @@
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_serial;
     dc->props = serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
@@ -219,6 +220,7 @@
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_multi_serial;
     dc->props = multi_2x_serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static void multi_4x_serial_pci_class_initfn(ObjectClass *klass, void *data)
@@ -233,6 +235,7 @@
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_multi_serial;
     dc->props = multi_4x_serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_pci_info = {
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 2993848..a799721 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -142,6 +142,21 @@
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_vty = {
+    .name = "spapr_vty",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVTYDevice),
+
+        VMSTATE_UINT32(in, VIOsPAPRVTYDevice),
+        VMSTATE_UINT32(out, VIOsPAPRVTYDevice),
+        VMSTATE_BUFFER(buf, VIOsPAPRVTYDevice),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vty_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -152,6 +167,7 @@
     k->dt_type = "serial";
     k->dt_compatible = "hvterm1";
     dc->props = spapr_vty_properties;
+    dc->vmsd = &vmstate_spapr_vty;
 }
 
 static const TypeInfo spapr_vty_info = {
diff --git a/hw/char/tpci200.c b/hw/char/tpci200.c
index a199e57..d9e17b2 100644
--- a/hw/char/tpci200.c
+++ b/hw/char/tpci200.c
@@ -652,6 +652,7 @@
     k->class_id = PCI_CLASS_BRIDGE_OTHER;
     k->subsystem_vendor_id = PCI_VENDOR_ID_TEWS;
     k->subsystem_id = 0x300A;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "TEWS TPCI200 IndustryPack carrier";
     dc->vmsd = &vmstate_tpci200;
 }
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index 6759e51..2e00ad2 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -185,6 +185,7 @@
     VirtIOSerialPortClass *k = VIRTIO_SERIAL_PORT_CLASS(klass);
 
     k->init = virtconsole_initfn;
+    k->exit = virtconsole_exitfn;
     k->have_data = flush_buf;
     k->set_guest_connected = set_guest_connected;
     dc->props = virtserialport_properties;
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index cc3d1dd..da417c7 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -971,6 +971,7 @@
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = virtser_port_qdev_init;
+    set_bit(DEVICE_CATEGORY_INPUT, k->categories);
     k->bus_type = TYPE_VIRTIO_SERIAL_BUS;
     k->exit = virtser_port_qdev_exit;
     k->unplug = qdev_simple_unplug_cb;
@@ -1017,6 +1018,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_serial_device_exit;
     dc->props = virtio_serial_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     vdc->init = virtio_serial_device_init;
     vdc->get_features = get_features;
     vdc->get_config = get_config;
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index feca497..b0d1d04 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -46,9 +46,13 @@
 #define CONTROL_RST_RX    0x02
 #define CONTROL_IE        0x10
 
-struct xlx_uartlite
-{
-    SysBusDevice busdev;
+#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
+#define XILINX_UARTLITE(obj) \
+    OBJECT_CHECK(XilinxUARTLite, (obj), TYPE_XILINX_UARTLITE)
+
+typedef struct XilinxUARTLite {
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     CharDriverState *chr;
     qemu_irq irq;
@@ -58,9 +62,9 @@
     unsigned int rx_fifo_len;
 
     uint32_t regs[R_MAX];
-};
+} XilinxUARTLite;
 
-static void uart_update_irq(struct xlx_uartlite *s)
+static void uart_update_irq(XilinxUARTLite *s)
 {
     unsigned int irq;
 
@@ -71,7 +75,7 @@
     qemu_set_irq(s->irq, irq);
 }
 
-static void uart_update_status(struct xlx_uartlite *s)
+static void uart_update_status(XilinxUARTLite *s)
 {
     uint32_t r;
 
@@ -86,7 +90,7 @@
 static uint64_t
 uart_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
     uint32_t r = 0;
     addr >>= 2;
     switch (addr)
@@ -113,7 +117,7 @@
 uart_write(void *opaque, hwaddr addr,
            uint64_t val64, unsigned int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
     uint32_t value = val64;
     unsigned char ch = value;
 
@@ -164,7 +168,7 @@
 
 static void uart_rx(void *opaque, const uint8_t *buf, int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
 
     /* Got a byte.  */
     if (s->rx_fifo_len >= 8) {
@@ -182,7 +186,7 @@
 
 static int uart_can_rx(void *opaque)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
 
     return s->rx_fifo_len < sizeof(s->rx_fifo);
 }
@@ -194,7 +198,7 @@
 
 static int xilinx_uartlite_init(SysBusDevice *dev)
 {
-    struct xlx_uartlite *s = FROM_SYSBUS(typeof (*s), dev);
+    XilinxUARTLite *s = XILINX_UARTLITE(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -217,9 +221,9 @@
 }
 
 static const TypeInfo xilinx_uartlite_info = {
-    .name          = "xlnx.xps-uartlite",
+    .name          = TYPE_XILINX_UARTLITE,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof (struct xlx_uartlite),
+    .instance_size = sizeof(XilinxUARTLite),
     .class_init    = xilinx_uartlite_class_init,
 };
 
diff --git a/hw/core/empty_slot.c b/hw/core/empty_slot.c
index e624991..612b109 100644
--- a/hw/core/empty_slot.c
+++ b/hw/core/empty_slot.c
@@ -22,8 +22,12 @@
 #define DPRINTF(fmt, ...) do {} while (0)
 #endif
 
+#define TYPE_EMPTY_SLOT "empty_slot"
+#define EMPTY_SLOT(obj) OBJECT_CHECK(EmptySlot, (obj), TYPE_EMPTY_SLOT)
+
 typedef struct EmptySlot {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint64_t size;
 } EmptySlot;
@@ -55,9 +59,9 @@
         SysBusDevice *s;
         EmptySlot *e;
 
-        dev = qdev_create(NULL, "empty_slot");
+        dev = qdev_create(NULL, TYPE_EMPTY_SLOT);
         s = SYS_BUS_DEVICE(dev);
-        e = FROM_SYSBUS(EmptySlot, s);
+        e = EMPTY_SLOT(dev);
         e->size = slot_size;
 
         qdev_init_nofail(dev);
@@ -68,7 +72,7 @@
 
 static int empty_slot_init1(SysBusDevice *dev)
 {
-    EmptySlot *s = FROM_SYSBUS(EmptySlot, dev);
+    EmptySlot *s = EMPTY_SLOT(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &empty_slot_ops, s,
                           "empty-slot", s->size);
@@ -84,7 +88,7 @@
 }
 
 static const TypeInfo empty_slot_info = {
-    .name          = "empty_slot",
+    .name          = TYPE_EMPTY_SLOT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(EmptySlot),
     .class_init    = empty_slot_class_init,
diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 3a324fb..dc8ae69 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -74,13 +74,14 @@
     }
 }
 
-static int print_bit(DeviceState *dev, Property *prop, char *dest, size_t len)
+static int prop_print_bit(DeviceState *dev, Property *prop, char *dest,
+                          size_t len)
 {
     uint32_t *p = qdev_get_prop_ptr(dev, prop);
     return snprintf(dest, len, (*p & qdev_get_prop_mask(prop)) ? "on" : "off");
 }
 
-static void get_bit(Object *obj, Visitor *v, void *opaque,
+static void prop_get_bit(Object *obj, Visitor *v, void *opaque,
                     const char *name, Error **errp)
 {
     DeviceState *dev = DEVICE(obj);
@@ -91,7 +92,7 @@
     visit_type_bool(v, &value, name, errp);
 }
 
-static void set_bit(Object *obj, Visitor *v, void *opaque,
+static void prop_set_bit(Object *obj, Visitor *v, void *opaque,
                     const char *name, Error **errp)
 {
     DeviceState *dev = DEVICE(obj);
@@ -115,9 +116,9 @@
 PropertyInfo qdev_prop_bit = {
     .name  = "boolean",
     .legacy_name  = "on/off",
-    .print = print_bit,
-    .get   = get_bit,
-    .set   = set_bit,
+    .print = prop_print_bit,
+    .get   = prop_get_bit,
+    .set   = prop_set_bit,
 };
 
 /* --- bool --- */
@@ -1134,3 +1135,64 @@
         class = object_class_get_parent(class);
     } while (class);
 }
+
+/* --- 64bit unsigned int 'size' type --- */
+
+static void get_size(Object *obj, Visitor *v, void *opaque,
+                     const char *name, Error **errp)
+{
+    DeviceState *dev = DEVICE(obj);
+    Property *prop = opaque;
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+
+    visit_type_size(v, ptr, name, errp);
+}
+
+static void set_size(Object *obj, Visitor *v, void *opaque,
+                     const char *name, Error **errp)
+{
+    DeviceState *dev = DEVICE(obj);
+    Property *prop = opaque;
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+
+    visit_type_size(v, ptr, name, errp);
+}
+
+static int parse_size(DeviceState *dev, Property *prop, const char *str)
+{
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+    Error *errp = NULL;
+
+    if (str != NULL) {
+        parse_option_size(prop->name, str, ptr, &errp);
+    }
+    assert_no_error(errp);
+    return 0;
+}
+
+static int print_size(DeviceState *dev, Property *prop, char *dest, size_t len)
+{
+    static const char suffixes[] = { 'B', 'K', 'M', 'G', 'T' };
+    uint64_t div, val = *(uint64_t *)qdev_get_prop_ptr(dev, prop);
+    int i;
+
+    /* Compute floor(log2(val)).  */
+    i = 64 - clz64(val);
+
+    /* Find the power of 1024 that we'll display as the units.  */
+    i /= 10;
+    if (i >= ARRAY_SIZE(suffixes)) {
+        i = ARRAY_SIZE(suffixes) - 1;
+    }
+    div = 1ULL << (i * 10);
+
+    return snprintf(dest, len, "%0.03f%c", (double)val/div, suffixes[i]);
+}
+
+PropertyInfo qdev_prop_size = {
+    .name  = "size",
+    .parse = parse_size,
+    .print = print_size,
+    .get = get_size,
+    .set = set_size,
+};
diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index c736257..4f37964 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -23,8 +23,15 @@
 
 /* A15MP private memory region.  */
 
+#define TYPE_A15MPCORE_PRIV "a15mpcore_priv"
+#define A15MPCORE_PRIV(obj) \
+    OBJECT_CHECK(A15MPPrivState, (obj), TYPE_A15MPCORE_PRIV)
+
 typedef struct A15MPPrivState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     uint32_t num_irq;
     MemoryRegion container;
@@ -39,7 +46,7 @@
 
 static int a15mp_priv_init(SysBusDevice *dev)
 {
-    A15MPPrivState *s = FROM_SYSBUS(A15MPPrivState, dev);
+    A15MPPrivState *s = A15MPCORE_PRIV(dev);
     SysBusDevice *busdev;
     const char *gictype = "arm_gic";
 
@@ -58,7 +65,7 @@
     sysbus_pass_irq(dev, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, a15mp_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(DEVICE(dev), a15mp_priv_set_irq, s->num_irq - 32);
 
     /* Memory map (addresses are offsets from PERIPHBASE):
      *  0x0000-0x0fff -- reserved
@@ -101,7 +108,7 @@
 }
 
 static const TypeInfo a15mp_priv_info = {
-    .name  = "a15mpcore_priv",
+    .name  = TYPE_A15MPCORE_PRIV,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(A15MPPrivState),
     .class_init = a15mp_priv_class_init,
diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 6c00a59..3e675e3 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -10,8 +10,15 @@
 
 #include "hw/sysbus.h"
 
+#define TYPE_A9MPCORE_PRIV "a9mpcore_priv"
+#define A9MPCORE_PRIV(obj) \
+    OBJECT_CHECK(A9MPPrivState, (obj), TYPE_A9MPCORE_PRIV)
+
 typedef struct A9MPPrivState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     MemoryRegion container;
     DeviceState *mptimer;
@@ -29,7 +36,7 @@
 
 static int a9mp_priv_init(SysBusDevice *dev)
 {
-    A9MPPrivState *s = FROM_SYSBUS(A9MPPrivState, dev);
+    A9MPPrivState *s = A9MPCORE_PRIV(dev);
     SysBusDevice *timerbusdev, *wdtbusdev, *gicbusdev, *scubusdev;
     int i;
 
@@ -43,7 +50,7 @@
     sysbus_pass_irq(dev, gicbusdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, a9mp_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(DEVICE(dev), a9mp_priv_set_irq, s->num_irq - 32);
 
     s->scu = qdev_create(NULL, "a9-scu");
     qdev_prop_set_uint32(s->scu, "num-cpu", s->num_cpu);
@@ -124,7 +131,7 @@
 }
 
 static const TypeInfo a9mp_priv_info = {
-    .name          = "a9mpcore_priv",
+    .name          = TYPE_A9MPCORE_PRIV,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(A9MPPrivState),
     .class_init    = a9mp_priv_class_init,
diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 8eeb53e..a786c62 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -12,8 +12,13 @@
 
 /* MPCore private memory region.  */
 
+#define TYPE_ARM11MPCORE_PRIV "arm11mpcore_priv"
+#define ARM11MPCORE_PRIV(obj) \
+    OBJECT_CHECK(ARM11MPCorePriveState, (obj), TYPE_ARM11MPCORE_PRIV)
+
 typedef struct ARM11MPCorePriveState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t scu_control;
     int iomemtype;
     uint32_t old_timer_status[8];
@@ -125,9 +130,10 @@
     }
 }
 
-static int mpcore_priv_init(SysBusDevice *dev)
+static int mpcore_priv_init(SysBusDevice *sbd)
 {
-    ARM11MPCorePriveState *s = FROM_SYSBUS(ARM11MPCorePriveState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    ARM11MPCorePriveState *s = ARM11MPCORE_PRIV(dev);
 
     s->gic = qdev_create(NULL, "arm_gic");
     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
@@ -137,10 +143,10 @@
     qdev_init_nofail(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, SYS_BUS_DEVICE(s->gic));
+    sysbus_pass_irq(sbd, SYS_BUS_DEVICE(s->gic));
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, mpcore_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(dev, mpcore_priv_set_irq, s->num_irq - 32);
 
     s->mptimer = qdev_create(NULL, "arm_mptimer");
     qdev_prop_set_uint32(s->mptimer, "num-cpu", s->num_cpu);
@@ -151,15 +157,20 @@
     qdev_init_nofail(s->wdtimer);
 
     mpcore_priv_map_setup(s);
-    sysbus_init_mmio(dev, &s->container);
+    sysbus_init_mmio(sbd, &s->container);
     return 0;
 }
 
+#define TYPE_REALVIEW_MPCORE_RIRQ "realview_mpcore"
+#define REALVIEW_MPCORE_RIRQ(obj) \
+    OBJECT_CHECK(mpcore_rirq_state, (obj), TYPE_REALVIEW_MPCORE_RIRQ)
+
 /* Dummy PIC to route IRQ lines.  The baseboard has 4 independent IRQ
    controllers.  The output of these, plus some of the raw input lines
    are fed into a single SMP-aware interrupt controller on the CPU.  */
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     SysBusDevice *priv;
     qemu_irq cpuic[32];
     qemu_irq rvic[4][64];
@@ -190,19 +201,20 @@
     }
 }
 
-static int realview_mpcore_init(SysBusDevice *dev)
+static int realview_mpcore_init(SysBusDevice *sbd)
 {
-    mpcore_rirq_state *s = FROM_SYSBUS(mpcore_rirq_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mpcore_rirq_state *s = REALVIEW_MPCORE_RIRQ(dev);
     DeviceState *gic;
     DeviceState *priv;
     int n;
     int i;
 
-    priv = qdev_create(NULL, "arm11mpcore_priv");
+    priv = qdev_create(NULL, TYPE_ARM11MPCORE_PRIV);
     qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
     qdev_init_nofail(priv);
     s->priv = SYS_BUS_DEVICE(priv);
-    sysbus_pass_irq(dev, s->priv);
+    sysbus_pass_irq(sbd, s->priv);
     for (i = 0; i < 32; i++) {
         s->cpuic[i] = qdev_get_gpio_in(priv, i);
     }
@@ -214,8 +226,8 @@
             s->rvic[n][i] = qdev_get_gpio_in(gic, i);
         }
     }
-    qdev_init_gpio_in(&dev->qdev, mpcore_rirq_set_irq, 64);
-    sysbus_init_mmio(dev, sysbus_mmio_get_region(s->priv, 0));
+    qdev_init_gpio_in(dev, mpcore_rirq_set_irq, 64);
+    sysbus_init_mmio(sbd, sysbus_mmio_get_region(s->priv, 0));
     return 0;
 }
 
@@ -234,7 +246,7 @@
 }
 
 static const TypeInfo mpcore_rirq_info = {
-    .name          = "realview_mpcore",
+    .name          = TYPE_REALVIEW_MPCORE_RIRQ,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mpcore_rirq_state),
     .class_init    = mpcore_rirq_class_init,
@@ -264,7 +276,7 @@
 }
 
 static const TypeInfo mpcore_priv_info = {
-    .name          = "arm11mpcore_priv",
+    .name          = TYPE_ARM11MPCORE_PRIV,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARM11MPCorePriveState),
     .class_init    = mpcore_priv_class_init,
diff --git a/hw/cpu/icc_bus.c b/hw/cpu/icc_bus.c
index 8788144..8748cc5 100644
--- a/hw/cpu/icc_bus.c
+++ b/hw/cpu/icc_bus.c
@@ -101,11 +101,19 @@
     s->icc_bus.apic_address_space = &s->apic_container;
 }
 
+static void icc_bridge_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
 static const TypeInfo icc_bridge_info = {
     .name  = TYPE_ICC_BRIDGE,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_init  = icc_bridge_init,
     .instance_size  = sizeof(ICCBridgeState),
+    .class_init = icc_bridge_class_init,
 };
 
 
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index a440575..dbd1f4a 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2937,6 +2937,7 @@
     dc->vmsd  = &vmstate_cirrus_vga;
     dc->realize = isa_cirrus_vga_realizefn;
     dc->props = isa_cirrus_vga_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo isa_cirrus_vga_info = {
@@ -3002,6 +3003,7 @@
     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
     k->device_id = CIRRUS_ID_CLGD5446;
     k->class_id = PCI_CLASS_DISPLAY_VGA;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Cirrus CLGD 54xx VGA";
     dc->vmsd = &vmstate_pci_cirrus_vga;
     dc->props = pci_vga_cirrus_properties;
diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index eb168ea..65cca1d 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -292,8 +292,13 @@
     hwaddr fb_len;       /* Framebuffer length */
 };
 
+#define TYPE_EXYNOS4210_FIMD "exynos4210.fimd"
+#define EXYNOS4210_FIMD(obj) \
+    OBJECT_CHECK(Exynos4210fimdState, (obj), TYPE_EXYNOS4210_FIMD)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QemuConsole *console;
     qemu_irq irq[3];
@@ -1108,6 +1113,7 @@
  * VIDOSDA, VIDOSDB, VIDWADDx and SHADOWCON registers */
 static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     Exynos4210fimdWindow *w = &s->window[win];
     hwaddr fb_start_addr, fb_mapped_len;
 
@@ -1131,8 +1137,8 @@
      * does not support hot-unplug.
      */
     memory_region_unref(w->mem_section.mr);
-    w->mem_section = memory_region_find(sysbus_address_space(&s->busdev),
-            fb_start_addr, w->fb_len);
+    w->mem_section = memory_region_find(sysbus_address_space(sbd),
+                                        fb_start_addr, w->fb_len);
     assert(w->mem_section.mr);
     assert(w->mem_section.offset_within_address_space == fb_start_addr);
     DPRINT_TRACE("Window %u framebuffer changed: address=0x%08x, len=0x%x\n",
@@ -1328,7 +1334,7 @@
 
 static void exynos4210_fimd_reset(DeviceState *d)
 {
-    Exynos4210fimdState *s = DO_UPCAST(Exynos4210fimdState, busdev.qdev, d);
+    Exynos4210fimdState *s = EXYNOS4210_FIMD(d);
     unsigned w;
 
     DPRINT_TRACE("Display controller reset\n");
@@ -1900,7 +1906,7 @@
 
 static int exynos4210_fimd_init(SysBusDevice *dev)
 {
-    Exynos4210fimdState *s = FROM_SYSBUS(Exynos4210fimdState, dev);
+    Exynos4210fimdState *s = EXYNOS4210_FIMD(dev);
 
     s->ifb = NULL;
 
@@ -1927,7 +1933,7 @@
 }
 
 static const TypeInfo exynos4210_fimd_info = {
-    .name = "exynos4210.fimd",
+    .name = TYPE_EXYNOS4210_FIMD,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210fimdState),
     .class_init = exynos4210_fimd_class_init,
diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 79a0a50..7082171 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -493,26 +493,33 @@
     memory_region_set_coalescing(&s->mem_vram);
 }
 
+#define TYPE_G364 "sysbus-g364"
+#define G364(obj) OBJECT_CHECK(G364SysBusState, (obj), TYPE_G364)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     G364State g364;
 } G364SysBusState;
 
-static int g364fb_sysbus_init(SysBusDevice *dev)
+static int g364fb_sysbus_init(SysBusDevice *sbd)
 {
-    G364State *s = &FROM_SYSBUS(G364SysBusState, dev)->g364;
+    DeviceState *dev = DEVICE(sbd);
+    G364SysBusState *sbs = G364(dev);
+    G364State *s = &sbs->g364;
 
-    g364fb_init(&dev->qdev, s);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_mmio(dev, &s->mem_ctrl);
-    sysbus_init_mmio(dev, &s->mem_vram);
+    g364fb_init(dev, s);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_mmio(sbd, &s->mem_ctrl);
+    sysbus_init_mmio(sbd, &s->mem_vram);
 
     return 0;
 }
 
 static void g364fb_sysbus_reset(DeviceState *d)
 {
-    G364SysBusState *s = DO_UPCAST(G364SysBusState, busdev.qdev, d);
+    G364SysBusState *s = G364(d);
+
     g364fb_reset(&s->g364);
 }
 
@@ -528,6 +535,7 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = g364fb_sysbus_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "G364 framebuffer";
     dc->reset = g364fb_sysbus_reset;
     dc->vmsd = &vmstate_g364fb;
@@ -535,7 +543,7 @@
 }
 
 static const TypeInfo g364fb_sysbus_info = {
-    .name          = "sysbus-g364",
+    .name          = TYPE_G364,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(G364SysBusState),
     .class_init    = g364fb_sysbus_class_init,
diff --git a/hw/display/jazz_led.c b/hw/display/jazz_led.c
index 7f82037..8407e6c 100644
--- a/hw/display/jazz_led.c
+++ b/hw/display/jazz_led.c
@@ -32,8 +32,12 @@
     REDRAW_NONE = 0, REDRAW_SEGMENTS = 1, REDRAW_BACKGROUND = 2,
 } screen_state_t;
 
+#define TYPE_JAZZ_LED "jazz-led"
+#define JAZZ_LED(obj) OBJECT_CHECK(LedState, (obj), TYPE_JAZZ_LED)
+
 typedef struct LedState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint8_t segments;
     QemuConsole *con;
@@ -262,7 +266,7 @@
 
 static int jazz_led_init(SysBusDevice *dev)
 {
-    LedState *s = FROM_SYSBUS(LedState, dev);
+    LedState *s = JAZZ_LED(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &led_ops, s, "led", 1);
     sysbus_init_mmio(dev, &s->iomem);
@@ -274,7 +278,7 @@
 
 static void jazz_led_reset(DeviceState *d)
 {
-    LedState *s = DO_UPCAST(LedState, busdev.qdev, d);
+    LedState *s = JAZZ_LED(d);
 
     s->segments = 0;
     s->state = REDRAW_SEGMENTS | REDRAW_BACKGROUND;
@@ -293,7 +297,7 @@
 }
 
 static const TypeInfo jazz_led_info = {
-    .name          = "jazz-led",
+    .name          = TYPE_JAZZ_LED,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LedState),
     .class_init    = jazz_led_class_init,
diff --git a/hw/display/milkymist-tmu2.c b/hw/display/milkymist-tmu2.c
index efda082..b2a5fba 100644
--- a/hw/display/milkymist-tmu2.c
+++ b/hw/display/milkymist-tmu2.c
@@ -75,8 +75,13 @@
     int y;
 } QEMU_PACKED;
 
+#define TYPE_MILKYMIST_TMU2 "milkymist-tmu2"
+#define MILKYMIST_TMU2(obj) \
+    OBJECT_CHECK(MilkymistTMU2State, (obj), TYPE_MILKYMIST_TMU2)
+
 struct MilkymistTMU2State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -429,7 +434,7 @@
 
 static void milkymist_tmu2_reset(DeviceState *d)
 {
-    MilkymistTMU2State *s = container_of(d, MilkymistTMU2State, busdev.qdev);
+    MilkymistTMU2State *s = MILKYMIST_TMU2(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -439,7 +444,7 @@
 
 static int milkymist_tmu2_init(SysBusDevice *dev)
 {
-    MilkymistTMU2State *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistTMU2State *s = MILKYMIST_TMU2(dev);
 
     if (tmu2_glx_init(s)) {
         return 1;
@@ -476,7 +481,7 @@
 }
 
 static const TypeInfo milkymist_tmu2_info = {
-    .name          = "milkymist-tmu2",
+    .name          = TYPE_MILKYMIST_TMU2,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistTMU2State),
     .class_init    = milkymist_tmu2_class_init,
diff --git a/hw/display/milkymist-vgafb.c b/hw/display/milkymist-vgafb.c
index 870b339..5150cb4 100644
--- a/hw/display/milkymist-vgafb.c
+++ b/hw/display/milkymist-vgafb.c
@@ -63,8 +63,13 @@
     CTRL_RESET = (1<<0),
 };
 
+#define TYPE_MILKYMIST_VGAFB "milkymist-vgafb"
+#define MILKYMIST_VGAFB(obj) \
+    OBJECT_CHECK(MilkymistVgafbState, (obj), TYPE_MILKYMIST_VGAFB)
+
 struct MilkymistVgafbState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     QemuConsole *con;
 
@@ -84,6 +89,7 @@
 static void vgafb_update_display(void *opaque)
 {
     MilkymistVgafbState *s = opaque;
+    SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
     int first = 0;
     int last = 0;
@@ -93,6 +99,7 @@
         return;
     }
 
+    sbd = SYS_BUS_DEVICE(s);
     int dest_width = s->regs[R_HRES];
 
     switch (surface_bits_per_pixel(surface)) {
@@ -122,7 +129,7 @@
         break;
     }
 
-    framebuffer_update_display(surface, sysbus_address_space(&s->busdev),
+    framebuffer_update_display(surface, sysbus_address_space(sbd),
                                s->regs[R_BASEADDRESS] + s->fb_offset,
                                s->regs[R_HRES],
                                s->regs[R_VRES],
@@ -256,7 +263,7 @@
 
 static void milkymist_vgafb_reset(DeviceState *d)
 {
-    MilkymistVgafbState *s = container_of(d, MilkymistVgafbState, busdev.qdev);
+    MilkymistVgafbState *s = MILKYMIST_VGAFB(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -277,7 +284,7 @@
 
 static int milkymist_vgafb_init(SysBusDevice *dev)
 {
-    MilkymistVgafbState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistVgafbState *s = MILKYMIST_VGAFB(dev);
 
     memory_region_init_io(&s->regs_region, OBJECT(s), &vgafb_mmio_ops, s,
             "milkymist-vgafb", R_MAX * 4);
@@ -324,7 +331,7 @@
 }
 
 static const TypeInfo milkymist_vgafb_info = {
-    .name          = "milkymist-vgafb",
+    .name          = TYPE_MILKYMIST_VGAFB,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistVgafbState),
     .class_init    = milkymist_vgafb_class_init,
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 60afcf3..e79ab4b 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -39,8 +39,12 @@
     PL111
 };
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL110 "pl110"
+#define PL110(obj) OBJECT_CHECK(PL110State, (obj), TYPE_PL110)
+
+typedef struct PL110State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QemuConsole *con;
 
@@ -59,7 +63,7 @@
     uint32_t palette[256];
     uint32_t raw_palette[128];
     qemu_irq irq;
-} pl110_state;
+} PL110State;
 
 static int vmstate_pl110_post_load(void *opaque, int version_id);
 
@@ -69,20 +73,20 @@
     .minimum_version_id = 1,
     .post_load = vmstate_pl110_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_INT32(version, pl110_state),
-        VMSTATE_UINT32_ARRAY(timing, pl110_state, 4),
-        VMSTATE_UINT32(cr, pl110_state),
-        VMSTATE_UINT32(upbase, pl110_state),
-        VMSTATE_UINT32(lpbase, pl110_state),
-        VMSTATE_UINT32(int_status, pl110_state),
-        VMSTATE_UINT32(int_mask, pl110_state),
-        VMSTATE_INT32(cols, pl110_state),
-        VMSTATE_INT32(rows, pl110_state),
-        VMSTATE_UINT32(bpp, pl110_state),
-        VMSTATE_INT32(invalidate, pl110_state),
-        VMSTATE_UINT32_ARRAY(palette, pl110_state, 256),
-        VMSTATE_UINT32_ARRAY(raw_palette, pl110_state, 128),
-        VMSTATE_UINT32_V(mux_ctrl, pl110_state, 2),
+        VMSTATE_INT32(version, PL110State),
+        VMSTATE_UINT32_ARRAY(timing, PL110State, 4),
+        VMSTATE_UINT32(cr, PL110State),
+        VMSTATE_UINT32(upbase, PL110State),
+        VMSTATE_UINT32(lpbase, PL110State),
+        VMSTATE_UINT32(int_status, PL110State),
+        VMSTATE_UINT32(int_mask, PL110State),
+        VMSTATE_INT32(cols, PL110State),
+        VMSTATE_INT32(rows, PL110State),
+        VMSTATE_UINT32(bpp, PL110State),
+        VMSTATE_INT32(invalidate, PL110State),
+        VMSTATE_UINT32_ARRAY(palette, PL110State, 256),
+        VMSTATE_UINT32_ARRAY(raw_palette, PL110State, 128),
+        VMSTATE_UINT32_V(mux_ctrl, PL110State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -121,14 +125,15 @@
 #define BITS 32
 #include "pl110_template.h"
 
-static int pl110_enabled(pl110_state *s)
+static int pl110_enabled(PL110State *s)
 {
   return (s->cr & PL110_CR_EN) && (s->cr & PL110_CR_PWR);
 }
 
 static void pl110_update_display(void *opaque)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
+    SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
     drawfn* fntable;
     drawfn fn;
@@ -138,8 +143,11 @@
     int first;
     int last;
 
-    if (!pl110_enabled(s))
+    if (!pl110_enabled(s)) {
         return;
+    }
+
+    sbd = SYS_BUS_DEVICE(s);
 
     switch (surface_bits_per_pixel(surface)) {
     case 0:
@@ -232,7 +240,7 @@
     }
     dest_width *= s->cols;
     first = 0;
-    framebuffer_update_display(surface, sysbus_address_space(&s->busdev),
+    framebuffer_update_display(surface, sysbus_address_space(sbd),
                                s->upbase, s->cols, s->rows,
                                src_width, dest_width, 0,
                                s->invalidate,
@@ -246,14 +254,14 @@
 
 static void pl110_invalidate_display(void * opaque)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     s->invalidate = 1;
     if (pl110_enabled(s)) {
         qemu_console_resize(s->con, s->cols, s->rows);
     }
 }
 
-static void pl110_update_palette(pl110_state *s, int n)
+static void pl110_update_palette(PL110State *s, int n)
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int i;
@@ -289,7 +297,7 @@
     }
 }
 
-static void pl110_resize(pl110_state *s, int width, int height)
+static void pl110_resize(PL110State *s, int width, int height)
 {
     if (width != s->cols || height != s->rows) {
         if (pl110_enabled(s)) {
@@ -301,7 +309,7 @@
 }
 
 /* Update interrupts.  */
-static void pl110_update(pl110_state *s)
+static void pl110_update(PL110State *s)
 {
   /* TODO: Implement interrupts.  */
 }
@@ -309,7 +317,7 @@
 static uint64_t pl110_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
         return idregs[s->version][(offset - 0xfe0) >> 2];
@@ -359,7 +367,7 @@
 static void pl110_write(void *opaque, hwaddr offset,
                         uint64_t val, unsigned size)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     int n;
 
     /* For simplicity invalidate the display whenever a control register
@@ -432,13 +440,13 @@
 
 static void pl110_mux_ctrl_set(void *opaque, int line, int level)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     s->mux_ctrl = level;
 }
 
 static int vmstate_pl110_post_load(void *opaque, int version_id)
 {
-    pl110_state *s = opaque;
+    PL110State *s = opaque;
     /* Make sure we redraw, and at the right size */
     pl110_invalidate_display(s);
     return 0;
@@ -449,30 +457,38 @@
     .gfx_update  = pl110_update_display,
 };
 
-static int pl110_init(SysBusDevice *dev)
+static int pl110_initfn(SysBusDevice *sbd)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL110State *s = PL110(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);
-    s->con = graphic_console_init(DEVICE(dev), &pl110_gfx_ops, s);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
+    s->con = graphic_console_init(dev, &pl110_gfx_ops, s);
     return 0;
 }
 
-static int pl110_versatile_init(SysBusDevice *dev)
+static void pl110_init(Object *obj)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
-    s->version = PL110_VERSATILE;
-    return pl110_init(dev);
+    PL110State *s = PL110(obj);
+
+    s->version = PL110;
 }
 
-static int pl111_init(SysBusDevice *dev)
+static void pl110_versatile_init(Object *obj)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = PL110(obj);
+
+    s->version = PL110_VERSATILE;
+}
+
+static void pl111_init(Object *obj)
+{
+    PL110State *s = PL110(obj);
+
     s->version = PL111;
-    return pl110_init(dev);
 }
 
 static void pl110_class_init(ObjectClass *klass, void *data)
@@ -480,50 +496,30 @@
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pl110_init;
+    k->init = pl110_initfn;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
 
 static const TypeInfo pl110_info = {
-    .name          = "pl110",
+    .name          = TYPE_PL110,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
+    .instance_init = pl110_init,
     .class_init    = pl110_class_init,
 };
 
-static void pl110_versatile_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl110_versatile_init;
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl110;
-}
-
 static const TypeInfo pl110_versatile_info = {
     .name          = "pl110_versatile",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
-    .class_init    = pl110_versatile_class_init,
+    .parent        = TYPE_PL110,
+    .instance_init = pl110_versatile_init,
 };
 
-static void pl111_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl111_init;
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl110;
-}
-
 static const TypeInfo pl111_info = {
     .name          = "pl111",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
-    .class_init    = pl111_class_init,
+    .parent        = TYPE_PL110,
+    .instance_init = pl111_init,
 };
 
 static void pl110_register_types(void)
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index ddefa06..c537057 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2323,6 +2323,7 @@
     k->vendor_id = REDHAT_PCI_VENDOR_ID;
     k->device_id = QXL_DEVICE_ID_STABLE;
     k->class_id = PCI_CLASS_DISPLAY_VGA;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Spice QXL GPU (primary, vga compatible)";
     dc->reset = qxl_reset_handler;
     dc->vmsd = &qxl_vmstate;
@@ -2345,6 +2346,7 @@
     k->vendor_id = REDHAT_PCI_VENDOR_ID;
     k->device_id = QXL_DEVICE_ID_STABLE;
     k->class_id = PCI_CLASS_DISPLAY_OTHER;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Spice QXL GPU (secondary)";
     dc->reset = qxl_reset_handler;
     dc->vmsd = &qxl_vmstate;
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 9fd48b5..24876d3 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -34,8 +34,12 @@
 #define TCX_THC_NREGS_24 0x1000
 #define TCX_TEC_NREGS    0x1000
 
+#define TYPE_TCX "SUNW,tcx"
+#define TCX(obj) OBJECT_CHECK(TCXState, (obj), TYPE_TCX)
+
 typedef struct TCXState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     QemuConsole *con;
     uint8_t *vram;
     uint32_t *vram24, *cplane;
@@ -423,7 +427,7 @@
 
 static void tcx_reset(DeviceState *d)
 {
-    TCXState *s = container_of(d, TCXState, busdev.qdev);
+    TCXState *s = TCX(d);
 
     /* Initialize palette */
     memset(s->r, 0, 256);
@@ -523,7 +527,7 @@
 
 static int tcx_init1(SysBusDevice *dev)
 {
-    TCXState *s = FROM_SYSBUS(TCXState, dev);
+    TCXState *s = TCX(dev);
     ram_addr_t vram_offset = 0;
     int size;
     uint8_t *vram_base;
@@ -609,7 +613,7 @@
 }
 
 static const TypeInfo tcx_info = {
-    .name          = "SUNW,tcx",
+    .name          = TYPE_TCX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(TCXState),
     .class_init    = tcx_class_init,
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 8d560ec..c2a19ad 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -87,6 +87,7 @@
     dc->reset = vga_isa_reset;
     dc->vmsd = &vmstate_vga_common;
     dc->props = vga_isa_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vga_isa_info = {
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 3e150ab..b3a45c8 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -198,6 +198,7 @@
     k->class_id = PCI_CLASS_DISPLAY_VGA;
     dc->vmsd = &vmstate_vga_pci;
     dc->props = vga_pci_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vga_info = {
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 3536cde..a6a8cdc 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1306,6 +1306,7 @@
     dc->reset = vmsvga_reset;
     dc->vmsd = &vmstate_vmware_vga;
     dc->props = vga_vmware_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vmsvga_info = {
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 7937c3e..35b9015 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -35,8 +35,12 @@
     uint32_t conf;
 } pl080_channel;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL080 "pl080"
+#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
+
+typedef struct PL080State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint8_t tc_int;
     uint8_t tc_mask;
@@ -51,7 +55,7 @@
     /* Flag to avoid recursive DMA invocations.  */
     int running;
     qemu_irq irq;
-} pl080_state;
+} PL080State;
 
 static const VMStateDescription vmstate_pl080_channel = {
     .name = "pl080_channel",
@@ -72,20 +76,20 @@
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_mask, pl080_state),
-        VMSTATE_UINT8(err_int, pl080_state),
-        VMSTATE_UINT8(err_mask, pl080_state),
-        VMSTATE_UINT32(conf, pl080_state),
-        VMSTATE_UINT32(sync, pl080_state),
-        VMSTATE_UINT32(req_single, pl080_state),
-        VMSTATE_UINT32(req_burst, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_STRUCT_ARRAY(chan, pl080_state, PL080_MAX_CHANNELS,
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_mask, PL080State),
+        VMSTATE_UINT8(err_int, PL080State),
+        VMSTATE_UINT8(err_mask, PL080State),
+        VMSTATE_UINT32(conf, PL080State),
+        VMSTATE_UINT32(sync, PL080State),
+        VMSTATE_UINT32(req_single, PL080State),
+        VMSTATE_UINT32(req_burst, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_STRUCT_ARRAY(chan, PL080State, PL080_MAX_CHANNELS,
                              1, vmstate_pl080_channel, pl080_channel),
-        VMSTATE_INT32(running, pl080_state),
+        VMSTATE_INT32(running, PL080State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -96,7 +100,7 @@
 static const unsigned char pl081_id[] =
 { 0x81, 0x10, 0x04, 0x0a, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl080_update(pl080_state *s)
+static void pl080_update(PL080State *s)
 {
     if ((s->tc_int & s->tc_mask)
             || (s->err_int & s->err_mask))
@@ -105,7 +109,7 @@
         qemu_irq_lower(s->irq);
 }
 
-static void pl080_run(pl080_state *s)
+static void pl080_run(PL080State *s)
 {
     int c;
     int flow;
@@ -221,7 +225,7 @@
 static uint64_t pl080_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl080_state *s = (pl080_state *)opaque;
+    PL080State *s = (PL080State *)opaque;
     uint32_t i;
     uint32_t mask;
 
@@ -290,7 +294,7 @@
 static void pl080_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl080_state *s = (pl080_state *)opaque;
+    PL080State *s = (PL080State *)opaque;
     int i;
 
     if (offset >= 0x100 && offset < 0x200) {
@@ -355,59 +359,44 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl08x_init(SysBusDevice *dev, int nchannels)
+static void pl080_init(Object *obj)
 {
-    pl080_state *s = FROM_SYSBUS(pl080_state, dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    PL080State *s = PL080(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->nchannels = nchannels;
-    return 0;
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->nchannels = 8;
 }
 
-static int pl080_init(SysBusDevice *dev)
+static void pl081_init(Object *obj)
 {
-    return pl08x_init(dev, 8);
+    PL080State *s = PL080(obj);
+
+    s->nchannels = 2;
 }
 
-static int pl081_init(SysBusDevice *dev)
+static void pl080_class_init(ObjectClass *oc, void *data)
 {
-    return pl08x_init(dev, 2);
-}
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-static void pl080_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl080_init;
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl080;
 }
 
 static const TypeInfo pl080_info = {
-    .name          = "pl080",
+    .name          = TYPE_PL080,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl080_state),
+    .instance_size = sizeof(PL080State),
+    .instance_init = pl080_init,
     .class_init    = pl080_class_init,
 };
 
-static void pl081_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl081_init;
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl080;
-}
-
 static const TypeInfo pl081_info = {
     .name          = "pl081",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl080_state),
-    .class_init    = pl081_class_init,
+    .parent        = TYPE_PL080,
+    .instance_init = pl081_init,
 };
 
 /* The PL080 and PL081 are the same except for the number of channels
diff --git a/hw/dma/puv3_dma.c b/hw/dma/puv3_dma.c
index 36004ae..101bd7f 100644
--- a/hw/dma/puv3_dma.c
+++ b/hw/dma/puv3_dma.c
@@ -18,8 +18,12 @@
 #define PUV3_DMA_CH_MASK        (0xff)
 #define PUV3_DMA_CH(offset)     ((offset) >> 8)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_DMA "puv3_dma"
+#define PUV3_DMA(obj) OBJECT_CHECK(PUV3DMAState, (obj), TYPE_PUV3_DMA)
+
+typedef struct PUV3DMAState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t reg_CFG[PUV3_DMA_CH_NR];
 } PUV3DMAState;
@@ -73,7 +77,7 @@
 
 static int puv3_dma_init(SysBusDevice *dev)
 {
-    PUV3DMAState *s = FROM_SYSBUS(PUV3DMAState, dev);
+    PUV3DMAState *s = PUV3_DMA(dev);
     int i;
 
     for (i = 0; i < PUV3_DMA_CH_NR; i++) {
@@ -95,7 +99,7 @@
 }
 
 static const TypeInfo puv3_dma_info = {
-    .name = "puv3_dma",
+    .name = TYPE_PUV3_DMA,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3DMAState),
     .class_init = puv3_dma_class_init,
diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index bc7bf4c..c013abb 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -26,8 +26,12 @@
     int request;
 } PXA2xxDMAChannel;
 
+#define TYPE_PXA2XX_DMA "pxa2xx-dma"
+#define PXA2XX_DMA(obj) OBJECT_CHECK(PXA2xxDMAState, (obj), TYPE_PXA2XX_DMA)
+
 typedef struct PXA2xxDMAState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -445,11 +449,11 @@
     }
 }
 
-static int pxa2xx_dma_init(SysBusDevice *dev)
+static int pxa2xx_dma_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxDMAState *s = PXA2XX_DMA(dev);
     int i;
-    PXA2xxDMAState *s;
-    s = FROM_SYSBUS(PXA2xxDMAState, dev);
 
     if (s->channels <= 0) {
         return -1;
@@ -463,12 +467,12 @@
 
     memset(s->req, 0, sizeof(uint8_t) * PXA2XX_DMA_NUM_REQUESTS);
 
-    qdev_init_gpio_in(&dev->qdev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
+    qdev_init_gpio_in(dev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_dma_ops, s,
                           "pxa2xx.dma", 0x00010000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     return 0;
 }
@@ -560,7 +564,7 @@
 }
 
 static const TypeInfo pxa2xx_dma_info = {
-    .name          = "pxa2xx-dma",
+    .name          = TYPE_PXA2XX_DMA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxDMAState),
     .class_init    = pxa2xx_dma_class_init,
diff --git a/hw/dma/sparc32_dma.c b/hw/dma/sparc32_dma.c
index be6275f..2a92ffb 100644
--- a/hw/dma/sparc32_dma.c
+++ b/hw/dma/sparc32_dma.c
@@ -60,10 +60,14 @@
 /* XXX SCSI and ethernet should have different read-only bit masks */
 #define DMA_CSR_RO_MASK 0xfe000007
 
+#define TYPE_SPARC32_DMA "sparc32_dma"
+#define SPARC32_DMA(obj) OBJECT_CHECK(DMAState, (obj), TYPE_SPARC32_DMA)
+
 typedef struct DMAState DMAState;
 
 struct DMAState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t dmaregs[DMA_REGS];
     qemu_irq irq;
@@ -249,7 +253,7 @@
 
 static void dma_reset(DeviceState *d)
 {
-    DMAState *s = container_of(d, DMAState, busdev.qdev);
+    DMAState *s = SPARC32_DMA(d);
 
     memset(s->dmaregs, 0, DMA_SIZE);
     s->dmaregs[0] = DMA_VER;
@@ -266,20 +270,21 @@
     }
 };
 
-static int sparc32_dma_init1(SysBusDevice *dev)
+static int sparc32_dma_init1(SysBusDevice *sbd)
 {
-    DMAState *s = FROM_SYSBUS(DMAState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    DMAState *s = SPARC32_DMA(dev);
     int reg_size;
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     reg_size = s->is_ledma ? DMA_ETH_SIZE : DMA_SIZE;
     memory_region_init_io(&s->iomem, OBJECT(s), &dma_mem_ops, s,
                           "dma", reg_size);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
-    qdev_init_gpio_out(&dev->qdev, s->gpio, 2);
+    qdev_init_gpio_in(dev, dma_set_irq, 1);
+    qdev_init_gpio_out(dev, s->gpio, 2);
 
     return 0;
 }
@@ -302,7 +307,7 @@
 }
 
 static const TypeInfo sparc32_dma_info = {
-    .name          = "sparc32_dma",
+    .name          = TYPE_SPARC32_DMA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(DMAState),
     .class_init    = sparc32_dma_class_init,
diff --git a/hw/dma/sun4m_iommu.c b/hw/dma/sun4m_iommu.c
index edb93f3..a04409a 100644
--- a/hw/dma/sun4m_iommu.c
+++ b/hw/dma/sun4m_iommu.c
@@ -126,8 +126,12 @@
 #define IOMMU_PAGE_SIZE     (1 << IOMMU_PAGE_SHIFT)
 #define IOMMU_PAGE_MASK     ~(IOMMU_PAGE_SIZE - 1)
 
+#define TYPE_SUN4M_IOMMU "iommu"
+#define SUN4M_IOMMU(obj) OBJECT_CHECK(IOMMUState, (obj), TYPE_SUN4M_IOMMU)
+
 typedef struct IOMMUState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t regs[IOMMU_NREGS];
     hwaddr iostart;
@@ -332,7 +336,7 @@
 
 static void iommu_reset(DeviceState *d)
 {
-    IOMMUState *s = container_of(d, IOMMUState, busdev.qdev);
+    IOMMUState *s = SUN4M_IOMMU(d);
 
     memset(s->regs, 0, IOMMU_NREGS * 4);
     s->iostart = 0;
@@ -345,7 +349,7 @@
 
 static int iommu_init1(SysBusDevice *dev)
 {
-    IOMMUState *s = FROM_SYSBUS(IOMMUState, dev);
+    IOMMUState *s = SUN4M_IOMMU(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -373,7 +377,7 @@
 }
 
 static const TypeInfo iommu_info = {
-    .name          = "iommu",
+    .name          = TYPE_SUN4M_IOMMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IOMMUState),
     .class_init    = iommu_class_init,
diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 855afae..b8f572b 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -35,8 +35,13 @@
     uint16_t pins;
 };
 
+#define TYPE_OMAP1_GPIO "omap-gpio"
+#define OMAP1_GPIO(obj) \
+    OBJECT_CHECK(struct omap_gpif_s, (obj), TYPE_OMAP1_GPIO)
+
 struct omap_gpif_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int mpu_model;
     void *clk;
@@ -203,8 +208,13 @@
     uint8_t delay;
 };
 
+#define TYPE_OMAP2_GPIO "omap2-gpio"
+#define OMAP2_GPIO(obj) \
+    OBJECT_CHECK(struct omap2_gpif_s, (obj), TYPE_OMAP2_GPIO)
+
 struct omap2_gpif_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int mpu_model;
     void *iclk;
@@ -587,16 +597,16 @@
 
 static void omap_gpif_reset(DeviceState *dev)
 {
-    struct omap_gpif_s *s = FROM_SYSBUS(struct omap_gpif_s,
-                    SYS_BUS_DEVICE(dev));
+    struct omap_gpif_s *s = OMAP1_GPIO(dev);
+
     omap_gpio_reset(&s->omap1);
 }
 
 static void omap2_gpif_reset(DeviceState *dev)
 {
+    struct omap2_gpif_s *s = OMAP2_GPIO(dev);
     int i;
-    struct omap2_gpif_s *s = FROM_SYSBUS(struct omap2_gpif_s,
-                    SYS_BUS_DEVICE(dev));
+
     for (i = 0; i < s->modulecount; i++) {
         omap2_gpio_module_reset(&s->modules[i]);
     }
@@ -648,7 +658,7 @@
 
     case 0x10:	/* IPGENERICOCPSPL_SYSCONFIG */
         if (value & (1 << 1))					/* SOFTRESET */
-            omap2_gpif_reset(&s->busdev.qdev);
+            omap2_gpif_reset(DEVICE(s));
         s->autoidle = value & 1;
         break;
 
@@ -668,25 +678,29 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int omap_gpio_init(SysBusDevice *dev)
+static int omap_gpio_init(SysBusDevice *sbd)
 {
-    struct omap_gpif_s *s = FROM_SYSBUS(struct omap_gpif_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_gpif_s *s = OMAP1_GPIO(dev);
+
     if (!s->clk) {
         hw_error("omap-gpio: clk not connected\n");
     }
-    qdev_init_gpio_in(&dev->qdev, omap_gpio_set, 16);
-    qdev_init_gpio_out(&dev->qdev, s->omap1.handler, 16);
-    sysbus_init_irq(dev, &s->omap1.irq);
+    qdev_init_gpio_in(dev, omap_gpio_set, 16);
+    qdev_init_gpio_out(dev, s->omap1.handler, 16);
+    sysbus_init_irq(sbd, &s->omap1.irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &omap_gpio_ops, &s->omap1,
                           "omap.gpio", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
-static int omap2_gpio_init(SysBusDevice *dev)
+static int omap2_gpio_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    struct omap2_gpif_s *s = OMAP2_GPIO(dev);
     int i;
-    struct omap2_gpif_s *s = FROM_SYSBUS(struct omap2_gpif_s, dev);
+
     if (!s->iclk) {
         hw_error("omap2-gpio: iclk not connected\n");
     }
@@ -694,14 +708,14 @@
         s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;
         memory_region_init_io(&s->iomem, OBJECT(s), &omap2_gpif_top_ops, s,
                               "omap2.gpio", 0x1000);
-        sysbus_init_mmio(dev, &s->iomem);
+        sysbus_init_mmio(sbd, &s->iomem);
     } else {
         s->modulecount = 6;
     }
     s->modules = g_malloc0(s->modulecount * sizeof(struct omap2_gpio_s));
     s->handler = g_malloc0(s->modulecount * 32 * sizeof(qemu_irq));
-    qdev_init_gpio_in(&dev->qdev, omap2_gpio_set, s->modulecount * 32);
-    qdev_init_gpio_out(&dev->qdev, s->handler, s->modulecount * 32);
+    qdev_init_gpio_in(dev, omap2_gpio_set, s->modulecount * 32);
+    qdev_init_gpio_out(dev, s->handler, s->modulecount * 32);
     for (i = 0; i < s->modulecount; i++) {
         struct omap2_gpio_s *m = &s->modules[i];
         if (!s->fclk[i]) {
@@ -709,12 +723,12 @@
         }
         m->revision = (s->mpu_model < omap3430) ? 0x18 : 0x25;
         m->handler = &s->handler[i * 32];
-        sysbus_init_irq(dev, &m->irq[0]); /* mpu irq */
-        sysbus_init_irq(dev, &m->irq[1]); /* dsp irq */
-        sysbus_init_irq(dev, &m->wkup);
+        sysbus_init_irq(sbd, &m->irq[0]); /* mpu irq */
+        sysbus_init_irq(sbd, &m->irq[1]); /* dsp irq */
+        sysbus_init_irq(sbd, &m->wkup);
         memory_region_init_io(&m->iomem, OBJECT(s), &omap2_gpio_module_ops, m,
                               "omap.gpio-module", 0x1000);
-        sysbus_init_mmio(dev, &m->iomem);
+        sysbus_init_mmio(sbd, &m->iomem);
     }
     return 0;
 }
@@ -748,7 +762,7 @@
 }
 
 static const TypeInfo omap_gpio_info = {
-    .name          = "omap-gpio",
+    .name          = TYPE_OMAP1_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap_gpif_s),
     .class_init    = omap_gpio_class_init,
@@ -777,7 +791,7 @@
 }
 
 static const TypeInfo omap2_gpio_info = {
-    .name          = "omap2-gpio",
+    .name          = TYPE_OMAP2_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap2_gpif_s),
     .class_init    = omap2_gpio_class_init,
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index a0bbf08..dd4ea29 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -28,8 +28,12 @@
 static const uint8_t pl061_id_luminary[12] =
   { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL061 "pl061"
+#define PL061(obj) OBJECT_CHECK(PL061State, (obj), TYPE_PL061)
+
+typedef struct PL061State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t locked;
     uint32_t data;
@@ -55,39 +59,39 @@
     qemu_irq irq;
     qemu_irq out[8];
     const unsigned char *id;
-} pl061_state;
+} PL061State;
 
 static const VMStateDescription vmstate_pl061 = {
     .name = "pl061",
     .version_id = 2,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(locked, pl061_state),
-        VMSTATE_UINT32(data, pl061_state),
-        VMSTATE_UINT32(old_data, pl061_state),
-        VMSTATE_UINT32(dir, pl061_state),
-        VMSTATE_UINT32(isense, pl061_state),
-        VMSTATE_UINT32(ibe, pl061_state),
-        VMSTATE_UINT32(iev, pl061_state),
-        VMSTATE_UINT32(im, pl061_state),
-        VMSTATE_UINT32(istate, pl061_state),
-        VMSTATE_UINT32(afsel, pl061_state),
-        VMSTATE_UINT32(dr2r, pl061_state),
-        VMSTATE_UINT32(dr4r, pl061_state),
-        VMSTATE_UINT32(dr8r, pl061_state),
-        VMSTATE_UINT32(odr, pl061_state),
-        VMSTATE_UINT32(pur, pl061_state),
-        VMSTATE_UINT32(pdr, pl061_state),
-        VMSTATE_UINT32(slr, pl061_state),
-        VMSTATE_UINT32(den, pl061_state),
-        VMSTATE_UINT32(cr, pl061_state),
-        VMSTATE_UINT32(float_high, pl061_state),
-        VMSTATE_UINT32_V(amsel, pl061_state, 2),
+        VMSTATE_UINT32(locked, PL061State),
+        VMSTATE_UINT32(data, PL061State),
+        VMSTATE_UINT32(old_data, PL061State),
+        VMSTATE_UINT32(dir, PL061State),
+        VMSTATE_UINT32(isense, PL061State),
+        VMSTATE_UINT32(ibe, PL061State),
+        VMSTATE_UINT32(iev, PL061State),
+        VMSTATE_UINT32(im, PL061State),
+        VMSTATE_UINT32(istate, PL061State),
+        VMSTATE_UINT32(afsel, PL061State),
+        VMSTATE_UINT32(dr2r, PL061State),
+        VMSTATE_UINT32(dr4r, PL061State),
+        VMSTATE_UINT32(dr8r, PL061State),
+        VMSTATE_UINT32(odr, PL061State),
+        VMSTATE_UINT32(pur, PL061State),
+        VMSTATE_UINT32(pdr, PL061State),
+        VMSTATE_UINT32(slr, PL061State),
+        VMSTATE_UINT32(den, PL061State),
+        VMSTATE_UINT32(cr, PL061State),
+        VMSTATE_UINT32(float_high, PL061State),
+        VMSTATE_UINT32_V(amsel, PL061State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static void pl061_update(pl061_state *s)
+static void pl061_update(PL061State *s)
 {
     uint8_t changed;
     uint8_t mask;
@@ -116,7 +120,7 @@
 static uint64_t pl061_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
 
     if (offset >= 0xfd0 && offset < 0x1000) {
         return s->id[(offset - 0xfd0) >> 2];
@@ -173,7 +177,7 @@
 static void pl061_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
     uint8_t mask;
 
     if (offset < 0x400) {
@@ -246,7 +250,7 @@
     pl061_update(s);
 }
 
-static void pl061_reset(pl061_state *s)
+static void pl061_reset(PL061State *s)
 {
   s->locked = 1;
   s->cr = 0xff;
@@ -254,7 +258,7 @@
 
 static void pl061_set_irq(void * opaque, int irq, int level)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
     uint8_t mask;
 
     mask = 1 << irq;
@@ -272,27 +276,32 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl061_init(SysBusDevice *dev, const unsigned char *id)
+static int pl061_initfn(SysBusDevice *sbd)
 {
-    pl061_state *s = FROM_SYSBUS(pl061_state, dev);
-    s->id = id;
+    DeviceState *dev = DEVICE(sbd);
+    PL061State *s = PL061(dev);
+
     memory_region_init_io(&s->iomem, OBJECT(s), &pl061_ops, s, "pl061", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&dev->qdev, pl061_set_irq, 8);
-    qdev_init_gpio_out(&dev->qdev, s->out, 8);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, pl061_set_irq, 8);
+    qdev_init_gpio_out(dev, s->out, 8);
     pl061_reset(s);
     return 0;
 }
 
-static int pl061_init_luminary(SysBusDevice *dev)
+static void pl061_luminary_init(Object *obj)
 {
-    return pl061_init(dev, pl061_id_luminary);
+    PL061State *s = PL061(obj);
+
+    s->id = pl061_id_luminary;
 }
 
-static int pl061_init_arm(SysBusDevice *dev)
+static void pl061_init(Object *obj)
 {
-    return pl061_init(dev, pl061_id);
+    PL061State *s = PL061(obj);
+
+    s->id = pl061_id;
 }
 
 static void pl061_class_init(ObjectClass *klass, void *data)
@@ -300,31 +309,22 @@
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pl061_init_arm;
+    k->init = pl061_initfn;
     dc->vmsd = &vmstate_pl061;
 }
 
 static const TypeInfo pl061_info = {
-    .name          = "pl061",
+    .name          = TYPE_PL061,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl061_state),
+    .instance_size = sizeof(PL061State),
+    .instance_init = pl061_init,
     .class_init    = pl061_class_init,
 };
 
-static void pl061_luminary_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl061_init_luminary;
-    dc->vmsd = &vmstate_pl061;
-}
-
 static const TypeInfo pl061_luminary_info = {
     .name          = "pl061_luminary",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl061_state),
-    .class_init    = pl061_luminary_class_init,
+    .parent        = TYPE_PL061,
+    .instance_init = pl061_luminary_init,
 };
 
 static void pl061_register_types(void)
diff --git a/hw/gpio/puv3_gpio.c b/hw/gpio/puv3_gpio.c
index 18671eb..39840aa 100644
--- a/hw/gpio/puv3_gpio.c
+++ b/hw/gpio/puv3_gpio.c
@@ -14,8 +14,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_GPIO "puv3_gpio"
+#define PUV3_GPIO(obj) OBJECT_CHECK(PUV3GPIOState, (obj), TYPE_PUV3_GPIO)
+
+typedef struct PUV3GPIOState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq[9];
 
@@ -96,7 +100,7 @@
 
 static int puv3_gpio_init(SysBusDevice *dev)
 {
-    PUV3GPIOState *s = FROM_SYSBUS(PUV3GPIOState, dev);
+    PUV3GPIOState *s = PUV3_GPIO(dev);
 
     s->reg_GPLR = 0;
     s->reg_GPDR = 0;
@@ -127,7 +131,7 @@
 }
 
 static const TypeInfo puv3_gpio_info = {
-    .name = "puv3_gpio",
+    .name = TYPE_PUV3_GPIO,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3GPIOState),
     .class_init = puv3_gpio_class_init,
diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index c235c3e..dc79a8b 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -24,9 +24,13 @@
 
 /* SCOOP devices */
 
+#define TYPE_SCOOP "scoop"
+#define SCOOP(obj) OBJECT_CHECK(ScoopInfo, (obj), TYPE_SCOOP)
+
 typedef struct ScoopInfo ScoopInfo;
 struct ScoopInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq handler[16];
     MemoryRegion iomem;
     uint16_t status;
@@ -162,16 +166,17 @@
         s->gpio_level &= ~(1 << line);
 }
 
-static int scoop_init(SysBusDevice *dev)
+static int scoop_init(SysBusDevice *sbd)
 {
-    ScoopInfo *s = FROM_SYSBUS(ScoopInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    ScoopInfo *s = SCOOP(dev);
 
     s->status = 0x02;
-    qdev_init_gpio_out(&s->busdev.qdev, s->handler, 16);
-    qdev_init_gpio_in(&s->busdev.qdev, scoop_gpio_set, 16);
+    qdev_init_gpio_out(dev, s->handler, 16);
+    qdev_init_gpio_in(dev, scoop_gpio_set, 16);
     memory_region_init_io(&s->iomem, OBJECT(s), &scoop_ops, s, "scoop", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -237,7 +242,7 @@
 }
 
 static const TypeInfo scoop_sysbus_info = {
-    .name          = "scoop",
+    .name          = TYPE_SCOOP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ScoopInfo),
     .class_init    = scoop_sysbus_class_init,
diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index 5f8b972..ca59456 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -185,8 +185,13 @@
 }
 
 /* GPIO interface.  */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_GPIO_I2C "gpio_i2c"
+#define GPIO_I2C(obj) OBJECT_CHECK(GPIOI2CState, (obj), TYPE_GPIO_I2C)
+
+typedef struct GPIOI2CState {
+    SysBusDevice parent_obj;
+
     MemoryRegion dummy_iomem;
     bitbang_i2c_interface *bitbang;
     int last_level;
@@ -204,19 +209,20 @@
     }
 }
 
-static int gpio_i2c_init(SysBusDevice *dev)
+static int gpio_i2c_init(SysBusDevice *sbd)
 {
-    GPIOI2CState *s = FROM_SYSBUS(GPIOI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    GPIOI2CState *s = GPIO_I2C(dev);
     i2c_bus *bus;
 
     memory_region_init(&s->dummy_iomem, OBJECT(s), "gpio_i2c", 0);
-    sysbus_init_mmio(dev, &s->dummy_iomem);
+    sysbus_init_mmio(sbd, &s->dummy_iomem);
 
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    bus = i2c_init_bus(dev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
 
-    qdev_init_gpio_in(&dev->qdev, bitbang_i2c_gpio_set, 2);
-    qdev_init_gpio_out(&dev->qdev, &s->out, 1);
+    qdev_init_gpio_in(dev, bitbang_i2c_gpio_set, 2);
+    qdev_init_gpio_out(dev, &s->out, 1);
 
     return 0;
 }
@@ -227,11 +233,12 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = gpio_i2c_init;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Virtual GPIO to I2C bridge";
 }
 
 static const TypeInfo gpio_i2c_info = {
-    .name          = "gpio_i2c",
+    .name          = TYPE_GPIO_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GPIOI2CState),
     .class_init    = gpio_i2c_class_init,
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index 22ef3b9..c97e7f7 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -224,6 +224,7 @@
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = i2c_slave_qdev_init;
+    set_bit(DEVICE_CATEGORY_MISC, k->categories);
     k->bus_type = TYPE_I2C_BUS;
     k->props = i2c_props;
 }
diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index 42f5e89..ce5f849 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -80,7 +80,8 @@
 #endif
 
 typedef struct Exynos4210I2CState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     i2c_bus *bus;
     qemu_irq irq;
@@ -297,15 +298,16 @@
     s->scl_free = true;
 }
 
-static int exynos4210_i2c_realize(SysBusDevice *dev)
+static int exynos4210_i2c_realize(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
     Exynos4210I2CState *s = EXYNOS4_I2C(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_i2c_ops, s,
                           TYPE_EXYNOS4_I2C, EXYNOS4_I2C_MEM_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->bus = i2c_init_bus(&dev->qdev, "i2c");
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->bus = i2c_init_bus(dev, "i2c");
     return 0;
 }
 
diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index f0eb448..f528b2b 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -21,9 +21,12 @@
 #include "hw/arm/omap.h"
 #include "hw/sysbus.h"
 
+#define TYPE_OMAP_I2C "omap_i2c"
+#define OMAP_I2C(obj) OBJECT_CHECK(OMAPI2CState, (obj), TYPE_OMAP_I2C)
 
 typedef struct OMAPI2CState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     qemu_irq drq[2];
@@ -130,8 +133,8 @@
 
 static void omap_i2c_reset(DeviceState *dev)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState,
-                                  SYS_BUS_DEVICE(dev));
+    OMAPI2CState *s = OMAP_I2C(dev);
+
     s->mask = 0;
     s->stat = 0;
     s->dma = 0;
@@ -316,15 +319,17 @@
             return;
         }
 
-        if (value & 2)
-            omap_i2c_reset(&s->busdev.qdev);
+        if (value & 2) {
+            omap_i2c_reset(DEVICE(s));
+        }
         break;
 
     case 0x24:	/* I2C_CON */
         s->control = value & 0xcf87;
         if (~value & (1 << 15)) {				/* I2C_EN */
-            if (s->revision < OMAP2_INTR_REV)
-                omap_i2c_reset(&s->busdev.qdev);
+            if (s->revision < OMAP2_INTR_REV) {
+                omap_i2c_reset(DEVICE(s));
+            }
             break;
         }
         if ((value & (1 << 15)) && !(value & (1 << 10))) {	/* MST */
@@ -434,9 +439,10 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int omap_i2c_init(SysBusDevice *dev)
+static int omap_i2c_init(SysBusDevice *sbd)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    OMAPI2CState *s = OMAP_I2C(dev);
 
     if (!s->fclk) {
         hw_error("omap_i2c: fclk not connected\n");
@@ -445,13 +451,13 @@
         /* Note that OMAP1 doesn't have a separate interface clock */
         hw_error("omap_i2c: iclk not connected\n");
     }
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->drq[0]);
-    sysbus_init_irq(dev, &s->drq[1]);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->drq[0]);
+    sysbus_init_irq(sbd, &s->drq[1]);
     memory_region_init_io(&s->iomem, OBJECT(s), &omap_i2c_ops, s, "omap.i2c",
                           (s->revision < OMAP2_INTR_REV) ? 0x800 : 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    s->bus = i2c_init_bus(&dev->qdev, NULL);
+    sysbus_init_mmio(sbd, &s->iomem);
+    s->bus = i2c_init_bus(dev, NULL);
     return 0;
 }
 
@@ -472,7 +478,7 @@
 }
 
 static const TypeInfo omap_i2c_info = {
-    .name = "omap_i2c",
+    .name = TYPE_OMAP_I2C,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OMAPI2CState),
     .class_init = omap_i2c_class_init,
@@ -485,7 +491,7 @@
 
 i2c_bus *omap_i2c_bus(DeviceState *omap_i2c)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState, SYS_BUS_DEVICE(omap_i2c));
+    OMAPI2CState *s = OMAP_I2C(omap_i2c);
     return s->bus;
 }
 
diff --git a/hw/i2c/versatile_i2c.c b/hw/i2c/versatile_i2c.c
index 204dd3d..02e9f17 100644
--- a/hw/i2c/versatile_i2c.c
+++ b/hw/i2c/versatile_i2c.c
@@ -24,8 +24,13 @@
 #include "hw/sysbus.h"
 #include "bitbang_i2c.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_VERSATILE_I2C "versatile_i2c"
+#define VERSATILE_I2C(obj) \
+    OBJECT_CHECK(VersatileI2CState, (obj), TYPE_VERSATILE_I2C)
+
+typedef struct VersatileI2CState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     bitbang_i2c_interface *bitbang;
     int out;
@@ -72,16 +77,17 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int versatile_i2c_init(SysBusDevice *dev)
+static int versatile_i2c_init(SysBusDevice *sbd)
 {
-    VersatileI2CState *s = FROM_SYSBUS(VersatileI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    VersatileI2CState *s = VERSATILE_I2C(dev);
     i2c_bus *bus;
 
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    bus = i2c_init_bus(dev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
     memory_region_init_io(&s->iomem, OBJECT(s), &versatile_i2c_ops, s,
                           "versatile_i2c", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -93,7 +99,7 @@
 }
 
 static const TypeInfo versatile_i2c_info = {
-    .name          = "versatile_i2c",
+    .name          = TYPE_VERSATILE_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(VersatileI2CState),
     .class_init    = versatile_i2c_class_init,
diff --git a/hw/i386/kvm/ioapic.c b/hw/i386/kvm/ioapic.c
index 688cb5c..f11a540 100644
--- a/hw/i386/kvm/ioapic.c
+++ b/hw/i386/kvm/ioapic.c
@@ -112,7 +112,7 @@
 
 static void kvm_ioapic_reset(DeviceState *dev)
 {
-    IOAPICCommonState *s = DO_UPCAST(IOAPICCommonState, busdev.qdev, dev);
+    IOAPICCommonState *s = IOAPIC_COMMON(dev);
 
     ioapic_reset_common(dev);
     kvm_ioapic_put(s);
@@ -131,7 +131,7 @@
 {
     memory_region_init_reservation(&s->io_memory, NULL, "kvm-ioapic", 0x1000);
 
-    qdev_init_gpio_in(&s->busdev.qdev, kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(s), kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
 }
 
 static Property kvm_ioapic_properties[] = {
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index ff33dc8..5618173 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -1856,6 +1856,7 @@
     dc->props       = assigned_dev_properties;
     dc->vmsd        = &vmstate_assigned_device;
     dc->reset       = reset_assigned_device;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc        = "KVM-based PCI passthrough";
 }
 
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index a4506bc..15beb80 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -456,7 +456,7 @@
 void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
                              TPRAccess access)
 {
-    VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
+    VAPICROMState *s = VAPIC(dev);
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
@@ -508,7 +508,7 @@
 
 static void vapic_reset(DeviceState *dev)
 {
-    VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
+    VAPICROMState *s = VAPIC(dev);
 
     if (s->state == VAPIC_ACTIVE) {
         s->state = VAPIC_STANDBY;
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 2a87563..a2b9d88 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -55,6 +55,7 @@
 #include "hw/acpi/acpi.h"
 #include "hw/cpu/icc_bus.h"
 #include "hw/boards.h"
+#include "hw/pci/pci_host.h"
 
 /* debug PC/ISA interrupts */
 //#define DEBUG_IRQ
@@ -75,8 +76,6 @@
 #define FW_CFG_E820_TABLE (FW_CFG_ARCH_LOCAL + 3)
 #define FW_CFG_HPET (FW_CFG_ARCH_LOCAL + 4)
 
-#define IO_APIC_DEFAULT_ADDRESS 0xfec00000
-
 #define E820_NR_ENTRIES		16
 
 struct e820_entry {
@@ -1005,15 +1004,27 @@
 static void pc_fw_cfg_guest_info(PcGuestInfo *guest_info)
 {
     PcRomPciInfo *info;
+    Object *pci_info;
+    bool ambiguous = false;
+
     if (!guest_info->has_pci_info || !guest_info->fw_cfg) {
         return;
     }
+    pci_info = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
+    g_assert(!ambiguous);
+    if (!pci_info) {
+        return;
+    }
 
     info = g_malloc(sizeof *info);
-    info->w32_min = cpu_to_le64(guest_info->pci_info.w32.begin);
-    info->w32_max = cpu_to_le64(guest_info->pci_info.w32.end);
-    info->w64_min = cpu_to_le64(guest_info->pci_info.w64.begin);
-    info->w64_max = cpu_to_le64(guest_info->pci_info.w64.end);
+    info->w32_min = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE_START, NULL));
+    info->w32_max = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE_END, NULL));
+    info->w64_min = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE64_START, NULL));
+    info->w64_max = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE64_END, NULL));
     /* Pass PCI hole info to guest via a side channel.
      * Required so guest PCI enumeration does the right thing. */
     fw_cfg_add_file(guest_info->fw_cfg, "etc/pci-info", info, sizeof *info);
@@ -1039,29 +1050,28 @@
     PcGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state);
     PcGuestInfo *guest_info = &guest_info_state->info;
 
-    guest_info->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
-    if (sizeof(hwaddr) == 4) {
-        guest_info->pci_info.w64.begin = 0;
-        guest_info->pci_info.w64.end = 0;
-    } else {
-        /*
-         * BIOS does not set MTRR entries for the 64 bit window, so no need to
-         * align address to power of two.  Align address at 1G, this makes sure
-         * it can be exactly covered with a PAT entry even when using huge
-         * pages.
-         */
-        guest_info->pci_info.w64.begin =
-            ROUND_UP((0x1ULL << 32) + above_4g_mem_size, 0x1ULL << 30);
-        guest_info->pci_info.w64.end = guest_info->pci_info.w64.begin +
-            (0x1ULL << 62);
-        assert(guest_info->pci_info.w64.begin <= guest_info->pci_info.w64.end);
-    }
-
     guest_info_state->machine_done.notify = pc_guest_info_machine_done;
     qemu_add_machine_init_done_notifier(&guest_info_state->machine_done);
     return guest_info;
 }
 
+void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
+                        uint64_t pci_hole64_size)
+{
+    if ((sizeof(hwaddr) == 4) || (!pci_hole64_size)) {
+        return;
+    }
+    /*
+     * BIOS does not set MTRR entries for the 64 bit window, so no need to
+     * align address to power of two.  Align address at 1G, this makes sure
+     * it can be exactly covered with a PAT entry even when using huge
+     * pages.
+     */
+    pci_info->w64.begin = ROUND_UP(pci_hole64_start, 0x1ULL << 30);
+    pci_info->w64.end = pci_info->w64.begin + pci_hole64_size;
+    assert(pci_info->w64.begin <= pci_info->w64.end);
+}
+
 void pc_acpi_init(const char *default_dsdt)
 {
     char *filename;
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index b58c255..ab25458 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -129,15 +129,6 @@
     guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
     guest_info->has_pci_info = has_pci_info;
 
-    /* Set PCI window size the way seabios has always done it. */
-    /* Power of 2 so bios can cover it with a single MTRR */
-    if (ram_size <= 0x80000000)
-        guest_info->pci_info.w32.begin = 0x80000000;
-    else if (ram_size <= 0xc0000000)
-        guest_info->pci_info.w32.begin = 0xc0000000;
-    else
-        guest_info->pci_info.w32.begin = 0xe0000000;
-
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
         fw_cfg = pc_memory_init(system_memory,
@@ -160,10 +151,7 @@
                               system_memory, system_io, ram_size,
                               below_4g_mem_size,
                               0x100000000ULL - below_4g_mem_size,
-                              0x100000000ULL + above_4g_mem_size,
-                              (sizeof(hwaddr) == 4
-                               ? 0
-                               : ((uint64_t)1 << 62)),
+                              above_4g_mem_size,
                               pci_memory, ram_memory);
     } else {
         pci_bus = NULL;
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 0b1d2e3..2f35d12 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -131,6 +131,7 @@
     /* create pci host bus */
     q35_host = Q35_HOST_DEVICE(qdev_create(NULL, TYPE_Q35_HOST_DEVICE));
 
+    object_property_add_child(qdev_get_machine(), "q35", OBJECT(q35_host), NULL);
     q35_host->mch.ram_memory = ram_memory;
     q35_host->mch.pci_address_space = pci_memory;
     q35_host->mch.system_memory = get_system_memory();
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 419adde..bba150f 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1338,6 +1338,7 @@
     dc->vmsd = &vmstate_sysbus_ahci;
     dc->props = sysbus_ahci_properties;
     dc->reset = sysbus_ahci_reset;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_ahci_info = {
diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index 33be386..d6ef799 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -127,7 +127,7 @@
                            unsigned size)
 {
     BMDMAState *bm = opaque;
-    PCIIDEState *pci_dev = bm->pci_dev;
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     uint32_t val;
 
     if (size != 1) {
@@ -139,16 +139,16 @@
         val = bm->cmd;
         break;
     case 1:
-        val = pci_dev->dev.config[MRDMODE];
+        val = pci_dev->config[MRDMODE];
         break;
     case 2:
         val = bm->status;
         break;
     case 3:
-        if (bm == &pci_dev->bmdma[0]) {
-            val = pci_dev->dev.config[UDIDETCR0];
+        if (bm == &bm->pci_dev->bmdma[0]) {
+            val = pci_dev->config[UDIDETCR0];
         } else {
-            val = pci_dev->dev.config[UDIDETCR1];
+            val = pci_dev->config[UDIDETCR1];
         }
         break;
     default:
@@ -165,7 +165,7 @@
                         uint64_t val, unsigned size)
 {
     BMDMAState *bm = opaque;
-    PCIIDEState *pci_dev = bm->pci_dev;
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
 
     if (size != 1) {
         return;
@@ -179,18 +179,19 @@
         bmdma_cmd_writeb(bm, val);
         break;
     case 1:
-        pci_dev->dev.config[MRDMODE] =
-            (pci_dev->dev.config[MRDMODE] & ~0x30) | (val & 0x30);
-        cmd646_update_irq(pci_dev);
+        pci_dev->config[MRDMODE] =
+            (pci_dev->config[MRDMODE] & ~0x30) | (val & 0x30);
+        cmd646_update_irq(bm->pci_dev);
         break;
     case 2:
         bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
         break;
     case 3:
-        if (bm == &pci_dev->bmdma[0])
-            pci_dev->dev.config[UDIDETCR0] = val;
-        else
-            pci_dev->dev.config[UDIDETCR1] = val;
+        if (bm == &bm->pci_dev->bmdma[0]) {
+            pci_dev->config[UDIDETCR0] = val;
+        } else {
+            pci_dev->config[UDIDETCR1] = val;
+        }
         break;
     }
 }
@@ -222,25 +223,29 @@
    registers */
 static void cmd646_update_irq(PCIIDEState *d)
 {
+    PCIDevice *pd = PCI_DEVICE(d);
     int pci_level;
-    pci_level = ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH0) &&
-                 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH0)) ||
-        ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH1) &&
-         !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH1));
-    qemu_set_irq(d->dev.irq[0], pci_level);
+
+    pci_level = ((pd->config[MRDMODE] & MRDMODE_INTR_CH0) &&
+                 !(pd->config[MRDMODE] & MRDMODE_BLK_CH0)) ||
+        ((pd->config[MRDMODE] & MRDMODE_INTR_CH1) &&
+         !(pd->config[MRDMODE] & MRDMODE_BLK_CH1));
+    qemu_set_irq(pd->irq[0], pci_level);
 }
 
 /* the PCI irq level is the logical OR of the two channels */
 static void cmd646_set_irq(void *opaque, int channel, int level)
 {
     PCIIDEState *d = opaque;
+    PCIDevice *pd = PCI_DEVICE(d);
     int irq_mask;
 
     irq_mask = MRDMODE_INTR_CH0 << channel;
-    if (level)
-        d->dev.config[MRDMODE] |= irq_mask;
-    else
-        d->dev.config[MRDMODE] &= ~irq_mask;
+    if (level) {
+        pd->config[MRDMODE] |= irq_mask;
+    } else {
+        pd->config[MRDMODE] &= ~irq_mask;
+    }
     cmd646_update_irq(d);
 }
 
@@ -257,8 +262,8 @@
 /* CMD646 PCI IDE controller */
 static int pci_cmd646_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
     qemu_irq *irq;
     int i;
 
@@ -284,7 +289,7 @@
 
     irq = qemu_allocate_irqs(cmd646_set_irq, d, 2);
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(dev), i, 2);
         ide_init2(&d->bus[i], irq[i]);
 
         bmdma_init(&d->bus[i], &d->bmdma[i], d);
@@ -293,14 +298,14 @@
                                          &d->bmdma[i].dma);
     }
 
-    vmstate_register(&dev->qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
     qemu_register_reset(cmd646_reset, d);
     return 0;
 }
 
 static void pci_cmd646_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -347,8 +352,7 @@
 
 static const TypeInfo cmd646_ide_info = {
     .name          = "cmd646-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = cmd646_ide_class_init,
 };
 
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index 4eb5488..bff952b 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -160,6 +160,7 @@
     k->class_id = PCI_CLASS_STORAGE_SATA;
     dc->vmsd = &vmstate_ich9_ahci;
     dc->reset = pci_ich9_reset;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo ich_ahci_info = {
diff --git a/hw/ide/isa.c b/hw/ide/isa.c
index 7243c82..bbc8c6b 100644
--- a/hw/ide/isa.c
+++ b/hw/ide/isa.c
@@ -118,6 +118,7 @@
     dc->fw_name = "ide";
     dc->reset = isa_ide_reset;
     dc->props = isa_ide_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo isa_ide_info = {
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 635a364..91151fc 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -56,13 +56,14 @@
 {
     BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
     IDEState *s = bmdma_active_if(bm);
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     struct {
         uint32_t addr;
         uint32_t size;
     } prd;
     int l, len;
 
-    pci_dma_sglist_init(&s->sg, &bm->pci_dev->dev,
+    pci_dma_sglist_init(&s->sg, pci_dev,
                         s->nsector / (BMDMA_PAGE_SIZE / 512) + 1);
     s->io_buffer_size = 0;
     for(;;) {
@@ -71,7 +72,7 @@
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
                 return s->io_buffer_size != 0;
-            pci_dma_read(&bm->pci_dev->dev, bm->cur_addr, &prd, 8);
+            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);
@@ -98,6 +99,7 @@
 {
     BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
     IDEState *s = bmdma_active_if(bm);
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     struct {
         uint32_t addr;
         uint32_t size;
@@ -113,7 +115,7 @@
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
                 return 0;
-            pci_dma_read(&bm->pci_dev->dev, bm->cur_addr, &prd, 8);
+            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);
@@ -128,10 +130,10 @@
             l = bm->cur_prd_len;
         if (l > 0) {
             if (is_write) {
-                pci_dma_write(&bm->pci_dev->dev, bm->cur_prd_addr,
+                pci_dma_write(pci_dev, bm->cur_prd_addr,
                               s->io_buffer + s->io_buffer_index, l);
             } else {
-                pci_dma_read(&bm->pci_dev->dev, bm->cur_prd_addr,
+                pci_dma_read(pci_dev, bm->cur_prd_addr,
                              s->io_buffer + s->io_buffer_index, l);
             }
             bm->cur_prd_addr += l;
@@ -480,7 +482,7 @@
     .minimum_version_id_old = 0,
     .post_load = ide_pci_post_load,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, PCIIDEState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIIDEState),
         VMSTATE_STRUCT_ARRAY(bmdma, PCIIDEState, 2, 0,
                              vmstate_bmdma, BMDMAState),
         VMSTATE_IDE_BUS_ARRAY(bus, PCIIDEState, 2),
@@ -492,7 +494,7 @@
 
 void pci_ide_create_devs(PCIDevice *dev, DriveInfo **hd_table)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     static const int bus[4]  = { 0, 0, 1, 1 };
     static const int unit[4] = { 0, 1, 0, 1 };
     int i;
@@ -531,3 +533,17 @@
     bus->irq = *irq;
     bm->pci_dev = d;
 }
+
+static const TypeInfo pci_ide_type_info = {
+    .name = TYPE_PCI_IDE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCIIDEState),
+    .abstract = true,
+};
+
+static void pci_ide_register_types(void)
+{
+    type_register_static(&pci_ide_type_info);
+}
+
+type_init(pci_ide_register_types)
diff --git a/hw/ide/pci.h b/hw/ide/pci.h
index a694e54..2428275 100644
--- a/hw/ide/pci.h
+++ b/hw/ide/pci.h
@@ -37,8 +37,14 @@
     struct PCIIDEState *pci_dev;
 } CMD646BAR;
 
+#define TYPE_PCI_IDE "pci-ide"
+#define PCI_IDE(obj) OBJECT_CHECK(PCIIDEState, (obj), TYPE_PCI_IDE)
+
 typedef struct PCIIDEState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     IDEBus bus[2];
     BMDMAState bmdma[2];
     uint32_t secondary; /* used only for cmd646 */
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 58532fe..e6e6c0b 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -106,7 +106,8 @@
 static void piix3_reset(void *opaque)
 {
     PCIIDEState *d = opaque;
-    uint8_t *pci_conf = d->dev.config;
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
     int i;
 
     for (i = 0; i < 2; i++) {
@@ -135,7 +136,7 @@
     int i;
 
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(d), i, 2);
         ide_init_ioport(&d->bus[i], NULL, port_info[i].iobase,
                         port_info[i].iobase2);
         ide_init2(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
@@ -149,17 +150,17 @@
 
 static int pci_piix_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
 
     pci_conf[PCI_CLASS_PROG] = 0x80; // legacy ATA mode
 
     qemu_register_reset(piix3_reset, d);
 
     bmdma_setup_bar(d);
-    pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(&d->dev.qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
     pci_piix_init_ports(d);
 
@@ -168,13 +169,11 @@
 
 static int pci_piix3_xen_ide_unplug(DeviceState *dev)
 {
-    PCIDevice *pci_dev;
     PCIIDEState *pci_ide;
     DriveInfo *di;
     int i = 0;
 
-    pci_dev = DO_UPCAST(PCIDevice, qdev, dev);
-    pci_ide = DO_UPCAST(PCIIDEState, dev, pci_dev);
+    pci_ide = PCI_IDE(dev);
 
     for (; i < 3; i++) {
         di = drive_get_by_index(IF_IDE, i);
@@ -188,7 +187,7 @@
             drive_put_ref(di);
         }
     }
-    qdev_reset_all(&(pci_ide->dev.qdev));
+    qdev_reset_all(DEVICE(dev));
     return 0;
 }
 
@@ -203,7 +202,7 @@
 
 static void pci_piix_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -248,13 +247,13 @@
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
 static const TypeInfo piix3_ide_info = {
     .name          = "piix3-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix3_ide_class_init,
 };
 
@@ -267,14 +266,14 @@
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
     dc->unplug = pci_piix3_xen_ide_unplug;
 }
 
 static const TypeInfo piix3_ide_xen_info = {
     .name          = "piix3-ide-xen",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix3_ide_xen_class_init,
 };
 
@@ -289,13 +288,13 @@
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371AB;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
 static const TypeInfo piix4_ide_info = {
     .name          = "piix4-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix4_ide_class_init,
 };
 
diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
index 6a272b0..1d84e15 100644
--- a/hw/ide/qdev.c
+++ b/hw/ide/qdev.c
@@ -282,6 +282,7 @@
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = ide_qdev_init;
+    set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
     k->bus_type = TYPE_IDE_BUS;
     k->props = ide_props;
 }
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 5a83191..e5fb297 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -108,7 +108,8 @@
 static void via_reset(void *opaque)
 {
     PCIIDEState *d = opaque;
-    uint8_t *pci_conf = d->dev.config;
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
     int i;
 
     for (i = 0; i < 2; i++) {
@@ -158,7 +159,7 @@
     int i;
 
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(d), i, 2);
         ide_init_ioport(&d->bus[i], NULL, port_info[i].iobase,
                         port_info[i].iobase2);
         ide_init2(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
@@ -173,17 +174,17 @@
 /* via ide func */
 static int vt82c686b_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
 
     pci_config_set_prog_interface(pci_conf, 0x8a); /* legacy ATA mode */
     pci_set_long(pci_conf + PCI_CAPABILITY_LIST, 0x000000c0);
 
     qemu_register_reset(via_reset, d);
     bmdma_setup_bar(d);
-    pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(&dev->qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
     vt82c686b_init_ports(d);
 
@@ -192,7 +193,7 @@
 
 static void vt82c686b_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -223,13 +224,13 @@
     k->device_id = PCI_DEVICE_ID_VIA_IDE;
     k->revision = 0x06;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
 static const TypeInfo via_ide_info = {
     .name          = "via-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = via_ide_class_init,
 };
 
diff --git a/hw/input/milkymist-softusb.c b/hw/input/milkymist-softusb.c
index 942cb79..ecde33c 100644
--- a/hw/input/milkymist-softusb.c
+++ b/hw/input/milkymist-softusb.c
@@ -44,8 +44,13 @@
 #define COMLOC_KEVT_PRODUCE  0x1142
 #define COMLOC_KEVT_BASE     0x1143
 
+#define TYPE_MILKYMIST_SOFTUSB "milkymist-softusb"
+#define MILKYMIST_SOFTUSB(obj) \
+    OBJECT_CHECK(MilkymistSoftUsbState, (obj), TYPE_MILKYMIST_SOFTUSB)
+
 struct MilkymistSoftUsbState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     HIDState hid_kbd;
     HIDState hid_mouse;
 
@@ -242,8 +247,7 @@
 
 static void milkymist_softusb_reset(DeviceState *d)
 {
-    MilkymistSoftUsbState *s =
-            container_of(d, MilkymistSoftUsbState, busdev.qdev);
+    MilkymistSoftUsbState *s = MILKYMIST_SOFTUSB(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -261,7 +265,7 @@
 
 static int milkymist_softusb_init(SysBusDevice *dev)
 {
-    MilkymistSoftUsbState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistSoftUsbState *s = MILKYMIST_SOFTUSB(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -320,7 +324,7 @@
 }
 
 static const TypeInfo milkymist_softusb_info = {
-    .name          = "milkymist-softusb",
+    .name          = TYPE_MILKYMIST_SOFTUSB,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistSoftUsbState),
     .class_init    = milkymist_softusb_class_init,
diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 2312ffc..c1b08d5 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -10,8 +10,12 @@
 #include "hw/sysbus.h"
 #include "hw/input/ps2.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL050 "pl050"
+#define PL050(obj) OBJECT_CHECK(PL050State, (obj), TYPE_PL050)
+
+typedef struct PL050State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     void *dev;
     uint32_t cr;
@@ -19,18 +23,18 @@
     uint32_t last;
     int pending;
     qemu_irq irq;
-    int is_mouse;
-} pl050_state;
+    bool is_mouse;
+} PL050State;
 
 static const VMStateDescription vmstate_pl050 = {
     .name = "pl050",
     .version_id = 2,
     .minimum_version_id = 2,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(cr, pl050_state),
-        VMSTATE_UINT32(clk, pl050_state),
-        VMSTATE_UINT32(last, pl050_state),
-        VMSTATE_INT32(pending, pl050_state),
+        VMSTATE_UINT32(cr, PL050State),
+        VMSTATE_UINT32(clk, PL050State),
+        VMSTATE_UINT32(last, PL050State),
+        VMSTATE_INT32(pending, PL050State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -48,7 +52,7 @@
 
 static void pl050_update(void *opaque, int level)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     int raise;
 
     s->pending = level;
@@ -60,7 +64,7 @@
 static uint64_t pl050_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     if (offset >= 0xfe0 && offset < 0x1000)
         return pl050_id[(offset - 0xfe0) >> 2];
 
@@ -103,7 +107,7 @@
 static void pl050_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     switch (offset >> 2) {
     case 0: /* KMICR */
         s->cr = value;
@@ -133,65 +137,67 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl050_init(SysBusDevice *dev, int is_mouse)
+static int pl050_initfn(SysBusDevice *dev)
 {
-    pl050_state *s = FROM_SYSBUS(pl050_state, dev);
+    PL050State *s = PL050(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
-    s->is_mouse = is_mouse;
-    if (s->is_mouse)
+    if (s->is_mouse) {
         s->dev = ps2_mouse_init(pl050_update, s);
-    else
+    } else {
         s->dev = ps2_kbd_init(pl050_update, s);
+    }
     return 0;
 }
 
-static int pl050_init_keyboard(SysBusDevice *dev)
+static void pl050_keyboard_init(Object *obj)
 {
-    return pl050_init(dev, 0);
+    PL050State *s = PL050(obj);
+
+    s->is_mouse = false;
 }
 
-static int pl050_init_mouse(SysBusDevice *dev)
+static void pl050_mouse_init(Object *obj)
 {
-    return pl050_init(dev, 1);
-}
+    PL050State *s = PL050(obj);
 
-static void pl050_kbd_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl050_init_keyboard;
-    dc->vmsd = &vmstate_pl050;
+    s->is_mouse = true;
 }
 
 static const TypeInfo pl050_kbd_info = {
     .name          = "pl050_keyboard",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl050_state),
-    .class_init    = pl050_kbd_class_init,
+    .parent        = TYPE_PL050,
+    .instance_init = pl050_keyboard_init,
 };
 
-static void pl050_mouse_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl050_init_mouse;
-    dc->vmsd = &vmstate_pl050;
-}
-
 static const TypeInfo pl050_mouse_info = {
     .name          = "pl050_mouse",
+    .parent        = TYPE_PL050,
+    .instance_init = pl050_mouse_init,
+};
+
+static void pl050_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc);
+
+    sdc->init = pl050_initfn;
+    dc->vmsd = &vmstate_pl050;
+}
+
+static const TypeInfo pl050_type_info = {
+    .name          = TYPE_PL050,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl050_state),
-    .class_init    = pl050_mouse_class_init,
+    .instance_size = sizeof(PL050State),
+    .abstract      = true,
+    .class_init    = pl050_class_init,
 };
 
 static void pl050_register_types(void)
 {
+    type_register_static(&pl050_type_info);
     type_register_static(&pl050_kbd_info);
     type_register_static(&pl050_mouse_info);
 }
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index 8e34004..d431b7a 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -639,6 +639,7 @@
 
 void gic_init_irqs_and_distributor(GICState *s, int num_irq)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     int i;
 
     i = s->num_irq - GIC_INTERNAL;
@@ -652,9 +653,9 @@
     if (s->revision != REV_NVIC) {
         i += (GIC_INTERNAL * s->num_cpu);
     }
-    qdev_init_gpio_in(&s->busdev.qdev, gic_set_irq, i);
+    qdev_init_gpio_in(DEVICE(s), gic_set_irq, i);
     for (i = 0; i < NUM_CPU(s); i++) {
-        sysbus_init_irq(&s->busdev, &s->parent_irq[i]);
+        sysbus_init_irq(sbd, &s->parent_irq[i]);
     }
     memory_region_init_io(&s->iomem, OBJECT(s), &gic_dist_ops, s,
                           "gic_dist", 0x1000);
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index 08560f2..709b5c2 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -110,7 +110,7 @@
 
 static void arm_gic_common_reset(DeviceState *dev)
 {
-    GICState *s = FROM_SYSBUS(GICState, SYS_BUS_DEVICE(dev));
+    GICState *s = ARM_GIC_COMMON(dev);
     int i;
     memset(s->irq_state, 0, GIC_MAXIRQ * sizeof(gic_irq_state));
     for (i = 0 ; i < s->num_cpu; i++) {
diff --git a/hw/intc/etraxfs_pic.c b/hw/intc/etraxfs_pic.c
index ce3a3f6..e02da53 100644
--- a/hw/intc/etraxfs_pic.c
+++ b/hw/intc/etraxfs_pic.c
@@ -36,9 +36,14 @@
 #define R_R_GURU    4
 #define R_MAX       5
 
+#define TYPE_ETRAX_FS_PIC "etraxfs,pic"
+#define ETRAX_FS_PIC(obj) \
+    OBJECT_CHECK(struct etrax_pic, (obj), TYPE_ETRAX_FS_PIC)
+
 struct etrax_pic
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     void *interrupt_vector;
     qemu_irq parent_irq;
@@ -138,17 +143,18 @@
     pic_update(fs);
 }
 
-static int etraxfs_pic_init(SysBusDevice *dev)
+static int etraxfs_pic_init(SysBusDevice *sbd)
 {
-    struct etrax_pic *s = FROM_SYSBUS(typeof (*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct etrax_pic *s = ETRAX_FS_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
-    sysbus_init_irq(dev, &s->parent_nmi);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
+    sysbus_init_irq(sbd, &s->parent_nmi);
 
     memory_region_init_io(&s->mmio, OBJECT(s), &pic_ops, s,
                           "etraxfs-pic", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -167,7 +173,7 @@
 }
 
 static const TypeInfo etraxfs_pic_info = {
-    .name          = "etraxfs,pic",
+    .name          = TYPE_ETRAX_FS_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct etrax_pic),
     .class_init    = etraxfs_pic_class_init,
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index 3b40976..ef5e8eb 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -56,8 +56,13 @@
     uint8_t src_pending;        /* Pending source interrupts before masking */
 } CombinerGroupState;
 
+#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
+#define EXYNOS4210_COMBINER(obj) \
+    OBJECT_CHECK(Exynos4210CombinerState, (obj), TYPE_EXYNOS4210_COMBINER)
+
 typedef struct Exynos4210CombinerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     struct CombinerGroupState group[IIC_NGRP];
@@ -402,24 +407,24 @@
 /*
  * Internal Combiner initialization.
  */
-static int exynos4210_combiner_init(SysBusDevice *dev)
+static int exynos4210_combiner_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210CombinerState *s = EXYNOS4210_COMBINER(dev);
     unsigned int i;
-    struct Exynos4210CombinerState *s =
-            FROM_SYSBUS(struct Exynos4210CombinerState, dev);
 
     /* Allocate general purpose input signals and connect a handler to each of
      * them */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_combiner_handler, IIC_NIRQ);
+    qdev_init_gpio_in(dev, exynos4210_combiner_handler, IIC_NIRQ);
 
     /* Connect SysBusDev irqs to device specific irqs */
     for (i = 0; i < IIC_NIRQ; i++) {
-        sysbus_init_irq(dev, &s->output_irq[i]);
+        sysbus_init_irq(sbd, &s->output_irq[i]);
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_combiner_ops, s,
-            "exynos4210-combiner", IIC_REGION_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+                          "exynos4210-combiner", IIC_REGION_SIZE);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -441,7 +446,7 @@
 }
 
 static const TypeInfo exynos4210_combiner_info = {
-    .name          = "exynos4210.combiner",
+    .name          = TYPE_EXYNOS4210_COMBINER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210CombinerState),
     .class_init    = exynos4210_combiner_class_init,
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index 6147f04..5b913f7 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -260,8 +260,13 @@
 
 /********* GIC part *********/
 
+#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
+#define EXYNOS4210_GIC(obj) \
+    OBJECT_CHECK(Exynos4210GicState, (obj), TYPE_EXYNOS4210_GIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion cpu_container;
     MemoryRegion dist_container;
     MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
@@ -276,9 +281,10 @@
     qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);
 }
 
-static int exynos4210_gic_init(SysBusDevice *dev)
+static int exynos4210_gic_init(SysBusDevice *sbd)
 {
-    Exynos4210GicState *s = FROM_SYSBUS(Exynos4210GicState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210GicState *s = EXYNOS4210_GIC(dev);
     uint32_t i;
     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
     const char dist_prefix[] = "exynos4210-gic-alias_dist";
@@ -293,10 +299,10 @@
     busdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, busdev);
+    sysbus_pass_irq(sbd, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_gic_set_irq,
+    qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
                       EXYNOS4210_GIC_NIRQ - 32);
 
     memory_region_init(&s->cpu_container, OBJECT(s), "exynos4210-cpu-container",
@@ -326,8 +332,8 @@
                 EXYNOS4210_EXT_GIC_DIST_GET_OFFSET(i), &s->dist_alias[i]);
     }
 
-    sysbus_init_mmio(dev, &s->cpu_container);
-    sysbus_init_mmio(dev, &s->dist_container);
+    sysbus_init_mmio(sbd, &s->cpu_container);
+    sysbus_init_mmio(sbd, &s->dist_container);
 
     return 0;
 }
@@ -347,7 +353,7 @@
 }
 
 static const TypeInfo exynos4210_gic_info = {
-    .name          = "exynos4210.gic",
+    .name          = TYPE_EXYNOS4210_GIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210GicState),
     .class_init    = exynos4210_gic_class_init,
@@ -366,8 +372,13 @@
  * output sysbus IRQ line. The output IRQ level is formed as OR between all
  * gpio inputs.
  */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
+#define EXYNOS4210_IRQ_GATE(obj) \
+    OBJECT_CHECK(Exynos4210IRQGateState, (obj), TYPE_EXYNOS4210_IRQ_GATE)
+
+typedef struct Exynos4210IRQGateState {
+    SysBusDevice parent_obj;
 
     uint32_t n_in;      /* inputs amount */
     uint32_t *level;    /* input levels */
@@ -412,8 +423,7 @@
 
 static void exynos4210_irq_gate_reset(DeviceState *d)
 {
-    Exynos4210IRQGateState *s =
-            DO_UPCAST(Exynos4210IRQGateState, busdev.qdev, d);
+    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
 
     memset(s->level, 0, s->n_in * sizeof(*s->level));
 }
@@ -421,17 +431,18 @@
 /*
  * IRQ Gate initialization.
  */
-static int exynos4210_irq_gate_init(SysBusDevice *dev)
+static int exynos4210_irq_gate_init(SysBusDevice *sbd)
 {
-    Exynos4210IRQGateState *s = FROM_SYSBUS(Exynos4210IRQGateState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
 
     /* Allocate general purpose input signals and connect a handler to each of
      * them */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_irq_gate_handler, s->n_in);
+    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
 
     s->level = g_malloc0(s->n_in * sizeof(*s->level));
 
-    sysbus_init_irq(dev, &s->out);
+    sysbus_init_irq(sbd, &s->out);
 
     return 0;
 }
@@ -448,7 +459,7 @@
 }
 
 static const TypeInfo exynos4210_irq_gate_info = {
-    .name          = "exynos4210.irq_gate",
+    .name          = TYPE_EXYNOS4210_IRQ_GATE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210IRQGateState),
     .class_init    = exynos4210_irq_gate_class_init,
diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
index 99a3bc3..1426437 100644
--- a/hw/intc/gic_internal.h
+++ b/hw/intc/gic_internal.h
@@ -70,7 +70,10 @@
 } gic_irq_state;
 
 typedef struct GICState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     qemu_irq parent_irq[NCPU];
     bool enabled;
     bool cpu_enabled[NCPU];
diff --git a/hw/intc/grlib_irqmp.c b/hw/intc/grlib_irqmp.c
index 181f614..42e00bc 100644
--- a/hw/intc/grlib_irqmp.c
+++ b/hw/intc/grlib_irqmp.c
@@ -45,10 +45,14 @@
 #define FORCE_OFFSET     0x80
 #define EXTENDED_OFFSET  0xC0
 
+#define TYPE_GRLIB_IRQMP "grlib,irqmp"
+#define GRLIB_IRQMP(obj) OBJECT_CHECK(IRQMP, (obj), TYPE_GRLIB_IRQMP)
+
 typedef struct IRQMPState IRQMPState;
 
 typedef struct IRQMP {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     void *set_pil_in;
@@ -102,19 +106,10 @@
 
 void grlib_irqmp_ack(DeviceState *dev, int intno)
 {
-    SysBusDevice *sdev;
-    IRQMP        *irqmp;
+    IRQMP        *irqmp = GRLIB_IRQMP(dev);
     IRQMPState   *state;
     uint32_t      mask;
 
-    assert(dev != NULL);
-
-    sdev = SYS_BUS_DEVICE(dev);
-    assert(sdev != NULL);
-
-    irqmp = FROM_SYSBUS(typeof(*irqmp), sdev);
-    assert(irqmp != NULL);
-
     state = irqmp->state;
     assert(state != NULL);
 
@@ -132,15 +127,10 @@
 
 void grlib_irqmp_set_irq(void *opaque, int irq, int level)
 {
-    IRQMP      *irqmp;
+    IRQMP      *irqmp = GRLIB_IRQMP(opaque);
     IRQMPState *s;
     int         i = 0;
 
-    assert(opaque != NULL);
-
-    irqmp = FROM_SYSBUS(typeof(*irqmp), SYS_BUS_DEVICE(opaque));
-    assert(irqmp != NULL);
-
     s = irqmp->state;
     assert(s         != NULL);
     assert(s->parent != NULL);
@@ -325,8 +315,7 @@
 
 static void grlib_irqmp_reset(DeviceState *d)
 {
-    IRQMP *irqmp = container_of(d, IRQMP, busdev.qdev);
-    assert(irqmp        != NULL);
+    IRQMP *irqmp = GRLIB_IRQMP(d);
     assert(irqmp->state != NULL);
 
     memset(irqmp->state, 0, sizeof *irqmp->state);
@@ -335,9 +324,7 @@
 
 static int grlib_irqmp_init(SysBusDevice *dev)
 {
-    IRQMP *irqmp = FROM_SYSBUS(typeof(*irqmp), dev);
-
-    assert(irqmp != NULL);
+    IRQMP *irqmp = GRLIB_IRQMP(dev);
 
     /* Check parameters */
     if (irqmp->set_pil_in == NULL) {
@@ -371,7 +358,7 @@
 }
 
 static const TypeInfo grlib_irqmp_info = {
-    .name          = "grlib,irqmp",
+    .name          = TYPE_GRLIB_IRQMP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IRQMP),
     .class_init    = grlib_irqmp_class_init,
diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index 75c8ffd..fb00e91 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -55,8 +55,13 @@
 #define PRIO_PER_WORD (sizeof(uint32_t) * 8 / 4)
 #define PRIO_WORDS (IMX_AVIC_NUM_IRQS/PRIO_PER_WORD)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_AVIC "imx_avic"
+#define IMX_AVIC(obj) \
+    OBJECT_CHECK(IMXAVICState, (obj), TYPE_IMX_AVIC)
+
+typedef struct IMXAVICState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint64_t pending;
     uint64_t enabled;
@@ -359,7 +364,8 @@
 
 static void imx_avic_reset(DeviceState *dev)
 {
-    IMXAVICState *s = container_of(dev, IMXAVICState, busdev.qdev);
+    IMXAVICState *s = IMX_AVIC(dev);
+
     s->pending = 0;
     s->enabled = 0;
     s->is_fiq = 0;
@@ -368,17 +374,18 @@
     memset(s->prio, 0, sizeof s->prio);
 }
 
-static int imx_avic_init(SysBusDevice *dev)
+static int imx_avic_init(SysBusDevice *sbd)
 {
-    IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    IMXAVICState *s = IMX_AVIC(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_avic_ops, s,
                           "imx_avic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    qdev_init_gpio_in(dev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
 
     return 0;
 }
@@ -395,7 +402,7 @@
 }
 
 static const TypeInfo imx_avic_info = {
-    .name = "imx_avic",
+    .name = TYPE_IMX_AVIC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXAVICState),
     .class_init = imx_avic_class_init,
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 5d064fe..d866e00 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -230,7 +230,7 @@
     memory_region_init_io(&s->io_memory, OBJECT(s), &ioapic_io_ops, s,
                           "ioapic", 0x1000);
 
-    qdev_init_gpio_in(&s->busdev.qdev, ioapic_set_irq, IOAPIC_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(s), ioapic_set_irq, IOAPIC_NUM_PINS);
 
     ioapics[instance_no] = s;
 }
diff --git a/hw/intc/lm32_pic.c b/hw/intc/lm32_pic.c
index b4e80c8..32d009f 100644
--- a/hw/intc/lm32_pic.c
+++ b/hw/intc/lm32_pic.c
@@ -26,8 +26,12 @@
 #include "trace.h"
 #include "hw/lm32/lm32_pic.h"
 
+#define TYPE_LM32_PIC "lm32-pic"
+#define LM32_PIC(obj) OBJECT_CHECK(LM32PicState, (obj), TYPE_LM32_PIC)
+
 struct LM32PicState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq parent_irq;
     uint32_t im;        /* interrupt mask */
     uint32_t ip;        /* interrupt pending */
@@ -99,7 +103,7 @@
 
 void lm32_pic_set_im(DeviceState *d, uint32_t im)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_set_im(im);
     s->im = im;
@@ -109,7 +113,7 @@
 
 void lm32_pic_set_ip(DeviceState *d, uint32_t ip)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_set_ip(ip);
 
@@ -121,7 +125,7 @@
 
 uint32_t lm32_pic_get_im(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_get_im(s->im);
     return s->im;
@@ -129,7 +133,7 @@
 
 uint32_t lm32_pic_get_ip(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_get_ip(s->ip);
     return s->ip;
@@ -137,7 +141,7 @@
 
 static void pic_reset(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
     int i;
 
     s->im = 0;
@@ -148,12 +152,13 @@
     }
 }
 
-static int lm32_pic_init(SysBusDevice *dev)
+static int lm32_pic_init(SysBusDevice *sbd)
 {
-    LM32PicState *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    LM32PicState *s = LM32_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
 
     pic = s;
 
@@ -185,7 +190,7 @@
 }
 
 static const TypeInfo lm32_pic_info = {
-    .name          = "lm32-pic",
+    .name          = TYPE_LM32_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32PicState),
     .class_init    = lm32_pic_class_init,
diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index bca8585..7dd63da 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -32,8 +32,13 @@
     unsigned char priority[32];
 };
 
+#define TYPE_OMAP_INTC "common-omap-intc"
+#define OMAP_INTC(obj) \
+    OBJECT_CHECK(struct omap_intr_handler_s, (obj), TYPE_OMAP_INTC)
+
 struct omap_intr_handler_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq *pins;
     qemu_irq parent_intr[2];
     MemoryRegion mmio;
@@ -328,8 +333,7 @@
 
 static void omap_inth_reset(DeviceState *dev)
 {
-    struct omap_intr_handler_s *s = FROM_SYSBUS(struct omap_intr_handler_s,
-                                                SYS_BUS_DEVICE(dev));
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
     int i;
 
     for (i = 0; i < s->nbanks; ++i){
@@ -356,20 +360,21 @@
     qemu_set_irq(s->parent_intr[1], 0);
 }
 
-static int omap_intc_init(SysBusDevice *dev)
+static int omap_intc_init(SysBusDevice *sbd)
 {
-    struct omap_intr_handler_s *s;
-    s = FROM_SYSBUS(struct omap_intr_handler_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
+
     if (!s->iclk) {
         hw_error("omap-intc: clk not connected\n");
     }
     s->nbanks = 1;
-    sysbus_init_irq(dev, &s->parent_intr[0]);
-    sysbus_init_irq(dev, &s->parent_intr[1]);
-    qdev_init_gpio_in(&dev->qdev, omap_set_intr, s->nbanks * 32);
+    sysbus_init_irq(sbd, &s->parent_intr[0]);
+    sysbus_init_irq(sbd, &s->parent_intr[1]);
+    qdev_init_gpio_in(dev, omap_set_intr, s->nbanks * 32);
     memory_region_init_io(&s->mmio, OBJECT(s), &omap_inth_mem_ops, s,
                           "omap-intc", s->size);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -391,8 +396,7 @@
 
 static const TypeInfo omap_intc_info = {
     .name          = "omap-intc",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct omap_intr_handler_s),
+    .parent        = TYPE_OMAP_INTC,
     .class_init    = omap_intc_class_init,
 };
 
@@ -500,8 +504,9 @@
     case 0x10:	/* INTC_SYSCONFIG */
         s->autoidle &= 4;
         s->autoidle |= (value & 1) << 2;
-        if (value & 2)						/* SOFTRESET */
-            omap_inth_reset(&s->busdev.qdev);
+        if (value & 2) {                                        /* SOFTRESET */
+            omap_inth_reset(DEVICE(s));
+        }
         return;
 
     case 0x48:	/* INTC_CONTROL */
@@ -594,10 +599,11 @@
     },
 };
 
-static int omap2_intc_init(SysBusDevice *dev)
+static int omap2_intc_init(SysBusDevice *sbd)
 {
-    struct omap_intr_handler_s *s;
-    s = FROM_SYSBUS(struct omap_intr_handler_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
+
     if (!s->iclk) {
         hw_error("omap2-intc: iclk not connected\n");
     }
@@ -606,12 +612,12 @@
     }
     s->level_only = 1;
     s->nbanks = 3;
-    sysbus_init_irq(dev, &s->parent_intr[0]);
-    sysbus_init_irq(dev, &s->parent_intr[1]);
-    qdev_init_gpio_in(&dev->qdev, omap_set_intr_noedge, s->nbanks * 32);
+    sysbus_init_irq(sbd, &s->parent_intr[0]);
+    sysbus_init_irq(sbd, &s->parent_intr[1]);
+    qdev_init_gpio_in(dev, omap_set_intr_noedge, s->nbanks * 32);
     memory_region_init_io(&s->mmio, OBJECT(s), &omap2_inth_mem_ops, s,
                           "omap2-intc", 0x1000);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -635,13 +641,20 @@
 
 static const TypeInfo omap2_intc_info = {
     .name          = "omap2-intc",
+    .parent        = TYPE_OMAP_INTC,
+    .class_init    = omap2_intc_class_init,
+};
+
+static const TypeInfo omap_intc_type_info = {
+    .name          = TYPE_OMAP_INTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap_intr_handler_s),
-    .class_init    = omap2_intc_class_init,
+    .abstract      = true,
 };
 
 static void omap_intc_register_types(void)
 {
+    type_register_static(&omap_intc_type_info);
     type_register_static(&omap_intc_info);
     type_register_static(&omap2_intc_info);
 }
diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index fdb29d7..329680d 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -15,8 +15,12 @@
 
 #define PL190_NUM_PRIO 17
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL190 "pl190"
+#define PL190(obj) OBJECT_CHECK(PL190State, (obj), TYPE_PL190)
+
+typedef struct PL190State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t level;
     uint32_t soft_level;
@@ -32,18 +36,18 @@
     int prev_prio[PL190_NUM_PRIO];
     qemu_irq irq;
     qemu_irq fiq;
-} pl190_state;
+} PL190State;
 
 static const unsigned char pl190_id[] =
 { 0x90, 0x11, 0x04, 0x00, 0x0D, 0xf0, 0x05, 0xb1 };
 
-static inline uint32_t pl190_irq_level(pl190_state *s)
+static inline uint32_t pl190_irq_level(PL190State *s)
 {
     return (s->level | s->soft_level) & s->irq_enable & ~s->fiq_select;
 }
 
 /* Update interrupts.  */
-static void pl190_update(pl190_state *s)
+static void pl190_update(PL190State *s)
 {
     uint32_t level = pl190_irq_level(s);
     int set;
@@ -56,7 +60,7 @@
 
 static void pl190_set_irq(void *opaque, int irq, int level)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
 
     if (level)
         s->level |= 1u << irq;
@@ -65,7 +69,7 @@
     pl190_update(s);
 }
 
-static void pl190_update_vectors(pl190_state *s)
+static void pl190_update_vectors(PL190State *s)
 {
     uint32_t mask;
     int i;
@@ -88,7 +92,7 @@
 static uint64_t pl190_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
     int i;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -152,7 +156,7 @@
 static void pl190_write(void *opaque, hwaddr offset,
                         uint64_t val, unsigned size)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
 
     if (offset >= 0x100 && offset < 0x140) {
         s->vect_addr[(offset - 0x100) >> 2] = val;
@@ -218,29 +222,29 @@
 
 static void pl190_reset(DeviceState *d)
 {
-  pl190_state *s = DO_UPCAST(pl190_state, busdev.qdev, d);
-  int i;
+    PL190State *s = PL190(d);
+    int i;
 
-  for (i = 0; i < 16; i++)
-    {
-      s->vect_addr[i] = 0;
-      s->vect_control[i] = 0;
+    for (i = 0; i < 16; i++) {
+        s->vect_addr[i] = 0;
+        s->vect_control[i] = 0;
     }
-  s->vect_addr[16] = 0;
-  s->prio_mask[17] = 0xffffffff;
-  s->priority = PL190_NUM_PRIO;
-  pl190_update_vectors(s);
+    s->vect_addr[16] = 0;
+    s->prio_mask[17] = 0xffffffff;
+    s->priority = PL190_NUM_PRIO;
+    pl190_update_vectors(s);
 }
 
-static int pl190_init(SysBusDevice *dev)
+static int pl190_init(SysBusDevice *sbd)
 {
-    pl190_state *s = FROM_SYSBUS(pl190_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL190State *s = PL190(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl190_ops, s, "pl190", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    qdev_init_gpio_in(&dev->qdev, pl190_set_irq, 32);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    qdev_init_gpio_in(dev, pl190_set_irq, 32);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
     return 0;
 }
 
@@ -249,16 +253,16 @@
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(level, pl190_state),
-        VMSTATE_UINT32(soft_level, pl190_state),
-        VMSTATE_UINT32(irq_enable, pl190_state),
-        VMSTATE_UINT32(fiq_select, pl190_state),
-        VMSTATE_UINT8_ARRAY(vect_control, pl190_state, 16),
-        VMSTATE_UINT32_ARRAY(vect_addr, pl190_state, PL190_NUM_PRIO),
-        VMSTATE_UINT32_ARRAY(prio_mask, pl190_state, PL190_NUM_PRIO+1),
-        VMSTATE_INT32(protected, pl190_state),
-        VMSTATE_INT32(priority, pl190_state),
-        VMSTATE_INT32_ARRAY(prev_prio, pl190_state, PL190_NUM_PRIO),
+        VMSTATE_UINT32(level, PL190State),
+        VMSTATE_UINT32(soft_level, PL190State),
+        VMSTATE_UINT32(irq_enable, PL190State),
+        VMSTATE_UINT32(fiq_select, PL190State),
+        VMSTATE_UINT8_ARRAY(vect_control, PL190State, 16),
+        VMSTATE_UINT32_ARRAY(vect_addr, PL190State, PL190_NUM_PRIO),
+        VMSTATE_UINT32_ARRAY(prio_mask, PL190State, PL190_NUM_PRIO+1),
+        VMSTATE_INT32(protected, PL190State),
+        VMSTATE_INT32(priority, PL190State),
+        VMSTATE_INT32_ARRAY(prev_prio, PL190State, PL190_NUM_PRIO),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -275,9 +279,9 @@
 }
 
 static const TypeInfo pl190_info = {
-    .name          = "pl190",
+    .name          = TYPE_PL190,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl190_state),
+    .instance_size = sizeof(PL190State),
     .class_init    = pl190_class_init,
 };
 
diff --git a/hw/intc/puv3_intc.c b/hw/intc/puv3_intc.c
index 44b6651..c2803d0 100644
--- a/hw/intc/puv3_intc.c
+++ b/hw/intc/puv3_intc.c
@@ -13,8 +13,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_INTC "puv3_intc"
+#define PUV3_INTC(obj) OBJECT_CHECK(PUV3INTCState, (obj), TYPE_PUV3_INTC)
+
+typedef struct PUV3INTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq parent_irq;
 
@@ -96,19 +100,20 @@
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int puv3_intc_init(SysBusDevice *dev)
+static int puv3_intc_init(SysBusDevice *sbd)
 {
-    PUV3INTCState *s = FROM_SYSBUS(PUV3INTCState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PUV3INTCState *s = PUV3_INTC(dev);
 
-    qdev_init_gpio_in(&s->busdev.qdev, puv3_intc_handler, PUV3_IRQS_NR);
-    sysbus_init_irq(&s->busdev, &s->parent_irq);
+    qdev_init_gpio_in(dev, puv3_intc_handler, PUV3_IRQS_NR);
+    sysbus_init_irq(sbd, &s->parent_irq);
 
     s->reg_ICMR = 0;
     s->reg_ICPR = 0;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &puv3_intc_ops, s, "puv3_intc",
-            PUV3_REGS_OFFSET);
-    sysbus_init_mmio(dev, &s->iomem);
+                          PUV3_REGS_OFFSET);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -121,7 +126,7 @@
 }
 
 static const TypeInfo puv3_intc_info = {
-    .name = "puv3_intc",
+    .name = TYPE_PUV3_INTC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3INTCState),
     .class_init = puv3_intc_class_init,
diff --git a/hw/intc/realview_gic.c b/hw/intc/realview_gic.c
index e122c2c..ce80447 100644
--- a/hw/intc/realview_gic.c
+++ b/hw/intc/realview_gic.c
@@ -9,8 +9,13 @@
 
 #include "hw/sysbus.h"
 
+#define TYPE_REALVIEW_GIC "realview_gic"
+#define REALVIEW_GIC(obj) \
+    OBJECT_CHECK(RealViewGICState, (obj), TYPE_REALVIEW_GIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     DeviceState *gic;
     MemoryRegion container;
 } RealViewGICState;
@@ -21,9 +26,10 @@
     qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);
 }
 
-static int realview_gic_init(SysBusDevice *dev)
+static int realview_gic_init(SysBusDevice *sbd)
 {
-    RealViewGICState *s = FROM_SYSBUS(RealViewGICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    RealViewGICState *s = REALVIEW_GIC(dev);
     SysBusDevice *busdev;
     /* The GICs on the RealView boards have a fixed nonconfigurable
      * number of interrupt lines, so we don't need to expose this as
@@ -38,10 +44,10 @@
     busdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, busdev);
+    sysbus_pass_irq(sbd, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, realview_gic_set_irq, numirq - 32);
+    qdev_init_gpio_in(dev, realview_gic_set_irq, numirq - 32);
 
     memory_region_init(&s->container, OBJECT(s),
                        "realview-gic-container", 0x2000);
@@ -49,7 +55,7 @@
                                 sysbus_mmio_get_region(busdev, 1));
     memory_region_add_subregion(&s->container, 0x1000,
                                 sysbus_mmio_get_region(busdev, 0));
-    sysbus_init_mmio(dev, &s->container);
+    sysbus_init_mmio(sbd, &s->container);
     return 0;
 }
 
@@ -61,7 +67,7 @@
 }
 
 static const TypeInfo realview_gic_info = {
-    .name          = "realview_gic",
+    .name          = TYPE_REALVIEW_GIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RealViewGICState),
     .class_init    = realview_gic_class_init,
diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index b47d0f0..41a1672 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -53,8 +53,13 @@
     uint32_t irl_out;
 } SLAVIO_CPUINTCTLState;
 
+#define TYPE_SLAVIO_INTCTL "slavio_intctl"
+#define SLAVIO_INTCTL(obj) \
+    OBJECT_CHECK(SLAVIO_INTCTLState, (obj), TYPE_SLAVIO_INTCTL)
+
 typedef struct SLAVIO_INTCTLState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 #ifdef DEBUG_IRQ_COUNT
     uint64_t irq_count[32];
@@ -206,12 +211,9 @@
 
 void slavio_pic_info(Monitor *mon, DeviceState *dev)
 {
-    SysBusDevice *sd;
-    SLAVIO_INTCTLState *s;
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     int i;
 
-    sd = SYS_BUS_DEVICE(dev);
-    s = FROM_SYSBUS(SLAVIO_INTCTLState, sd);
     for (i = 0; i < MAX_CPUS; i++) {
         monitor_printf(mon, "per-cpu %d: pending 0x%08x\n", i,
                        s->slaves[i].intreg_pending);
@@ -225,13 +227,11 @@
 #ifndef DEBUG_IRQ_COUNT
     monitor_printf(mon, "irq statistic code not compiled.\n");
 #else
-    SysBusDevice *sd;
-    SLAVIO_INTCTLState *s;
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     int i;
     int64_t count;
 
-    sd = SYS_BUS_DEVICE(dev);
-    s = FROM_SYSBUS(SLAVIO_INTCTLState, sd);
+    s = SLAVIO_INTCTL(dev);
     monitor_printf(mon, "IRQ statistics:\n");
     for (i = 0; i < 32; i++) {
         count = s->irq_count[i];
@@ -406,7 +406,7 @@
 
 static void slavio_intctl_reset(DeviceState *d)
 {
-    SLAVIO_INTCTLState *s = container_of(d, SLAVIO_INTCTLState, busdev.qdev);
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(d);
     int i;
 
     for (i = 0; i < MAX_CPUS; i++) {
@@ -419,27 +419,28 @@
     slavio_check_interrupts(s, 0);
 }
 
-static int slavio_intctl_init1(SysBusDevice *dev)
+static int slavio_intctl_init1(SysBusDevice *sbd)
 {
-    SLAVIO_INTCTLState *s = FROM_SYSBUS(SLAVIO_INTCTLState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     unsigned int i, j;
     char slave_name[45];
 
-    qdev_init_gpio_in(&dev->qdev, slavio_set_irq_all, 32 + MAX_CPUS);
+    qdev_init_gpio_in(dev, slavio_set_irq_all, 32 + MAX_CPUS);
     memory_region_init_io(&s->iomem, OBJECT(s), &slavio_intctlm_mem_ops, s,
                           "master-interrupt-controller", INTCTLM_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     for (i = 0; i < MAX_CPUS; i++) {
         snprintf(slave_name, sizeof(slave_name),
                  "slave-interrupt-controller-%i", i);
         for (j = 0; j < MAX_PILS; j++) {
-            sysbus_init_irq(dev, &s->cpu_irqs[i][j]);
+            sysbus_init_irq(sbd, &s->cpu_irqs[i][j]);
         }
         memory_region_init_io(&s->slaves[i].iomem, OBJECT(s),
                               &slavio_intctl_mem_ops,
                               &s->slaves[i], slave_name, INTCTL_SIZE);
-        sysbus_init_mmio(dev, &s->slaves[i].iomem);
+        sysbus_init_mmio(sbd, &s->slaves[i].iomem);
         s->slaves[i].cpu = i;
         s->slaves[i].master = s;
     }
@@ -458,7 +459,7 @@
 }
 
 static const TypeInfo slavio_intctl_info = {
-    .name          = "slavio_intctl",
+    .name          = TYPE_SLAVIO_INTCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLAVIO_INTCTLState),
     .class_init    = slavio_intctl_class_init,
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 091912e..6b3c071 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -34,34 +34,19 @@
  * ICP: Presentation layer
  */
 
-struct icp_server_state {
-    uint32_t xirr;
-    uint8_t pending_priority;
-    uint8_t mfrr;
-    qemu_irq output;
-};
-
 #define XISR_MASK  0x00ffffff
 #define CPPR_MASK  0xff000000
 
 #define XISR(ss)   (((ss)->xirr) & XISR_MASK)
 #define CPPR(ss)   (((ss)->xirr) >> 24)
 
-struct ics_state;
+static void ics_reject(ICSState *ics, int nr);
+static void ics_resend(ICSState *ics);
+static void ics_eoi(ICSState *ics, int nr);
 
-struct icp_state {
-    long nr_servers;
-    struct icp_server_state *ss;
-    struct ics_state *ics;
-};
-
-static void ics_reject(struct ics_state *ics, int nr);
-static void ics_resend(struct ics_state *ics);
-static void ics_eoi(struct ics_state *ics, int nr);
-
-static void icp_check_ipi(struct icp_state *icp, int server)
+static void icp_check_ipi(XICSState *icp, int server)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     if (XISR(ss) && (ss->pending_priority <= ss->mfrr)) {
         return;
@@ -78,9 +63,9 @@
     qemu_irq_raise(ss->output);
 }
 
-static void icp_resend(struct icp_state *icp, int server)
+static void icp_resend(XICSState *icp, int server)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     if (ss->mfrr < CPPR(ss)) {
         icp_check_ipi(icp, server);
@@ -88,9 +73,9 @@
     ics_resend(icp->ics);
 }
 
-static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
+static void icp_set_cppr(XICSState *icp, int server, uint8_t cppr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
     uint8_t old_cppr;
     uint32_t old_xisr;
 
@@ -112,9 +97,9 @@
     }
 }
 
-static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
+static void icp_set_mfrr(XICSState *icp, int server, uint8_t mfrr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     ss->mfrr = mfrr;
     if (mfrr < CPPR(ss)) {
@@ -122,7 +107,7 @@
     }
 }
 
-static uint32_t icp_accept(struct icp_server_state *ss)
+static uint32_t icp_accept(ICPState *ss)
 {
     uint32_t xirr = ss->xirr;
 
@@ -135,9 +120,9 @@
     return xirr;
 }
 
-static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
+static void icp_eoi(XICSState *icp, int server, uint32_t xirr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     /* Send EOI -> ICS */
     ss->xirr = (ss->xirr & ~CPPR_MASK) | (xirr & CPPR_MASK);
@@ -148,9 +133,9 @@
     }
 }
 
-static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
+static void icp_irq(XICSState *icp, int server, int nr, uint8_t priority)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     trace_xics_icp_irq(server, nr, priority);
 
@@ -168,39 +153,59 @@
     }
 }
 
+static const VMStateDescription vmstate_icp_server = {
+    .name = "icp/server",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32(xirr, ICPState),
+        VMSTATE_UINT8(pending_priority, ICPState),
+        VMSTATE_UINT8(mfrr, ICPState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void icp_reset(DeviceState *dev)
+{
+    ICPState *icp = ICP(dev);
+
+    icp->xirr = 0;
+    icp->pending_priority = 0xff;
+    icp->mfrr = 0xff;
+
+    /* Make all outputs are deasserted */
+    qemu_set_irq(icp->output, 0);
+}
+
+static void icp_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = icp_reset;
+    dc->vmsd = &vmstate_icp_server;
+}
+
+static TypeInfo icp_info = {
+    .name = TYPE_ICP,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(ICPState),
+    .class_init = icp_class_init,
+};
+
 /*
  * ICS: Source layer
  */
-
-struct ics_irq_state {
-    int server;
-    uint8_t priority;
-    uint8_t saved_priority;
-#define XICS_STATUS_ASSERTED           0x1
-#define XICS_STATUS_SENT               0x2
-#define XICS_STATUS_REJECTED           0x4
-#define XICS_STATUS_MASKED_PENDING     0x8
-    uint8_t status;
-};
-
-struct ics_state {
-    int nr_irqs;
-    int offset;
-    qemu_irq *qirqs;
-    bool *islsi;
-    struct ics_irq_state *irqs;
-    struct icp_state *icp;
-};
-
-static int ics_valid_irq(struct ics_state *ics, uint32_t nr)
+static int ics_valid_irq(ICSState *ics, uint32_t nr)
 {
     return (nr >= ics->offset)
         && (nr < (ics->offset + ics->nr_irqs));
 }
 
-static void resend_msi(struct ics_state *ics, int srcno)
+static void resend_msi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     /* FIXME: filter by server#? */
     if (irq->status & XICS_STATUS_REJECTED) {
@@ -212,9 +217,9 @@
     }
 }
 
-static void resend_lsi(struct ics_state *ics, int srcno)
+static void resend_lsi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     if ((irq->priority != 0xff)
         && (irq->status & XICS_STATUS_ASSERTED)
@@ -224,9 +229,9 @@
     }
 }
 
-static void set_irq_msi(struct ics_state *ics, int srcno, int val)
+static void set_irq_msi(ICSState *ics, int srcno, int val)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_set_irq_msi(srcno, srcno + ics->offset);
 
@@ -240,9 +245,9 @@
     }
 }
 
-static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
+static void set_irq_lsi(ICSState *ics, int srcno, int val)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_set_irq_lsi(srcno, srcno + ics->offset);
     if (val) {
@@ -255,7 +260,7 @@
 
 static void ics_set_irq(void *opaque, int srcno, int val)
 {
-    struct ics_state *ics = (struct ics_state *)opaque;
+    ICSState *ics = (ICSState *)opaque;
 
     if (ics->islsi[srcno]) {
         set_irq_lsi(ics, srcno, val);
@@ -264,9 +269,9 @@
     }
 }
 
-static void write_xive_msi(struct ics_state *ics, int srcno)
+static void write_xive_msi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     if (!(irq->status & XICS_STATUS_MASKED_PENDING)
         || (irq->priority == 0xff)) {
@@ -277,16 +282,16 @@
     icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
 }
 
-static void write_xive_lsi(struct ics_state *ics, int srcno)
+static void write_xive_lsi(ICSState *ics, int srcno)
 {
     resend_lsi(ics, srcno);
 }
 
-static void ics_write_xive(struct ics_state *ics, int nr, int server,
+static void ics_write_xive(ICSState *ics, int nr, int server,
                            uint8_t priority, uint8_t saved_priority)
 {
     int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     irq->server = server;
     irq->priority = priority;
@@ -301,16 +306,16 @@
     }
 }
 
-static void ics_reject(struct ics_state *ics, int nr)
+static void ics_reject(ICSState *ics, int nr)
 {
-    struct ics_irq_state *irq = ics->irqs + nr - ics->offset;
+    ICSIRQState *irq = ics->irqs + nr - ics->offset;
 
     trace_xics_ics_reject(nr, nr - ics->offset);
     irq->status |= XICS_STATUS_REJECTED; /* Irrelevant but harmless for LSI */
     irq->status &= ~XICS_STATUS_SENT; /* Irrelevant but harmless for MSI */
 }
 
-static void ics_resend(struct ics_state *ics)
+static void ics_resend(ICSState *ics)
 {
     int i;
 
@@ -324,10 +329,10 @@
     }
 }
 
-static void ics_eoi(struct ics_state *ics, int nr)
+static void ics_eoi(ICSState *ics, int nr)
 {
     int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_ics_eoi(nr);
 
@@ -336,11 +341,92 @@
     }
 }
 
+static void ics_reset(DeviceState *dev)
+{
+    ICSState *ics = ICS(dev);
+    int i;
+
+    memset(ics->irqs, 0, sizeof(ICSIRQState) * ics->nr_irqs);
+    for (i = 0; i < ics->nr_irqs; i++) {
+        ics->irqs[i].priority = 0xff;
+        ics->irqs[i].saved_priority = 0xff;
+    }
+}
+
+static int ics_post_load(void *opaque, int version_id)
+{
+    int i;
+    ICSState *ics = opaque;
+
+    for (i = 0; i < ics->icp->nr_servers; i++) {
+        icp_resend(ics->icp, i);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_ics_irq = {
+    .name = "ics/irq",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(server, ICSIRQState),
+        VMSTATE_UINT8(priority, ICSIRQState),
+        VMSTATE_UINT8(saved_priority, ICSIRQState),
+        VMSTATE_UINT8(status, ICSIRQState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_ics = {
+    .name = "ics",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = ics_post_load,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(nr_irqs, ICSState),
+
+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(irqs, ICSState, nr_irqs,
+                                             vmstate_ics_irq, ICSIRQState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static int ics_realize(DeviceState *dev)
+{
+    ICSState *ics = ICS(dev);
+
+    ics->irqs = g_malloc0(ics->nr_irqs * sizeof(ICSIRQState));
+    ics->islsi = g_malloc0(ics->nr_irqs * sizeof(bool));
+    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, ics->nr_irqs);
+
+    return 0;
+}
+
+static void ics_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->init = ics_realize;
+    dc->vmsd = &vmstate_ics;
+    dc->reset = ics_reset;
+}
+
+static TypeInfo ics_info = {
+    .name = TYPE_ICS,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(ICSState),
+    .class_init = ics_class_init,
+};
+
 /*
  * Exported functions
  */
 
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
+qemu_irq xics_get_qirq(XICSState *icp, int irq)
 {
     if (!ics_valid_irq(icp->ics, irq)) {
         return NULL;
@@ -349,13 +435,17 @@
     return icp->ics->qirqs[irq - icp->ics->offset];
 }
 
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi)
+void xics_set_irq_type(XICSState *icp, int irq, bool lsi)
 {
     assert(ics_valid_irq(icp->ics, irq));
 
     icp->ics->islsi[irq - icp->ics->offset] = lsi;
 }
 
+/*
+ * Guest interfaces
+ */
+
 static target_ulong h_cppr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                            target_ulong opcode, target_ulong *args)
 {
@@ -405,7 +495,7 @@
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr, server, priority;
 
     if ((nargs != 3) || (nret != 1)) {
@@ -433,7 +523,7 @@
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 3)) {
@@ -458,7 +548,7 @@
                          uint32_t nargs, target_ulong args,
                          uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 1)) {
@@ -484,7 +574,7 @@
                         uint32_t nargs, target_ulong args,
                         uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 1)) {
@@ -506,32 +596,27 @@
     rtas_st(rets, 0, 0); /* Success */
 }
 
-static void xics_reset(void *opaque)
+/*
+ * XICS
+ */
+
+static void xics_reset(DeviceState *d)
 {
-    struct icp_state *icp = (struct icp_state *)opaque;
-    struct ics_state *ics = icp->ics;
+    XICSState *icp = XICS(d);
     int i;
 
     for (i = 0; i < icp->nr_servers; i++) {
-        icp->ss[i].xirr = 0;
-        icp->ss[i].pending_priority = 0xff;
-        icp->ss[i].mfrr = 0xff;
-        /* Make all outputs are deasserted */
-        qemu_set_irq(icp->ss[i].output, 0);
+        device_reset(DEVICE(&icp->ss[i]));
     }
 
-    memset(ics->irqs, 0, sizeof(struct ics_irq_state) * ics->nr_irqs);
-    for (i = 0; i < ics->nr_irqs; i++) {
-        ics->irqs[i].priority = 0xff;
-        ics->irqs[i].saved_priority = 0xff;
-    }
+    device_reset(DEVICE(icp->ics));
 }
 
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
+void xics_cpu_setup(XICSState *icp, PowerPCCPU *cpu)
 {
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
-    struct icp_server_state *ss = &icp->ss[cs->cpu_index];
+    ICPState *ss = &icp->ss[cs->cpu_index];
 
     assert(cs->cpu_index < icp->nr_servers);
 
@@ -551,37 +636,73 @@
     }
 }
 
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs)
+static void xics_realize(DeviceState *dev, Error **errp)
 {
-    struct icp_state *icp;
-    struct ics_state *ics;
+    XICSState *icp = XICS(dev);
+    ICSState *ics = icp->ics;
+    int i;
 
-    icp = g_malloc0(sizeof(*icp));
-    icp->nr_servers = nr_servers;
-    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
-
-    ics = g_malloc0(sizeof(*ics));
-    ics->nr_irqs = nr_irqs;
+    ics->nr_irqs = icp->nr_irqs;
     ics->offset = XICS_IRQ_BASE;
-    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
-    ics->islsi = g_malloc0(nr_irqs * sizeof(bool));
-
-    icp->ics = ics;
     ics->icp = icp;
+    qdev_init_nofail(DEVICE(ics));
 
-    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
+    icp->ss = g_malloc0(icp->nr_servers*sizeof(ICPState));
+    for (i = 0; i < icp->nr_servers; i++) {
+        char buffer[32];
+        object_initialize(&icp->ss[i], TYPE_ICP);
+        snprintf(buffer, sizeof(buffer), "icp[%d]", i);
+        object_property_add_child(OBJECT(icp), buffer, OBJECT(&icp->ss[i]), NULL);
+        qdev_init_nofail(DEVICE(&icp->ss[i]));
+    }
+}
 
-    spapr_register_hypercall(H_CPPR, h_cppr);
-    spapr_register_hypercall(H_IPI, h_ipi);
-    spapr_register_hypercall(H_XIRR, h_xirr);
-    spapr_register_hypercall(H_EOI, h_eoi);
+static void xics_initfn(Object *obj)
+{
+    XICSState *xics = XICS(obj);
+
+    xics->ics = ICS(object_new(TYPE_ICS));
+    object_property_add_child(obj, "ics", OBJECT(xics->ics), NULL);
+}
+
+static Property xics_properties[] = {
+    DEFINE_PROP_UINT32("nr_servers", XICSState, nr_servers, -1),
+    DEFINE_PROP_UINT32("nr_irqs", XICSState, nr_irqs, -1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xics_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = xics_realize;
+    dc->props = xics_properties;
+    dc->reset = xics_reset;
 
     spapr_rtas_register("ibm,set-xive", rtas_set_xive);
     spapr_rtas_register("ibm,get-xive", rtas_get_xive);
     spapr_rtas_register("ibm,int-off", rtas_int_off);
     spapr_rtas_register("ibm,int-on", rtas_int_on);
 
-    qemu_register_reset(xics_reset, icp);
-
-    return icp;
+    spapr_register_hypercall(H_CPPR, h_cppr);
+    spapr_register_hypercall(H_IPI, h_ipi);
+    spapr_register_hypercall(H_XIRR, h_xirr);
+    spapr_register_hypercall(H_EOI, h_eoi);
 }
+
+static const TypeInfo xics_info = {
+    .name          = TYPE_XICS,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XICSState),
+    .class_init    = xics_class_init,
+    .instance_init = xics_initfn,
+};
+
+static void xics_register_types(void)
+{
+    type_register_static(&xics_info);
+    type_register_static(&ics_info);
+    type_register_static(&icp_info);
+}
+
+type_init(xics_register_types)
diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index 25d2057..4a10398 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -37,9 +37,13 @@
 #define R_MER       7
 #define R_MAX       8
 
+#define TYPE_XILINX_INTC "xlnx.xps-intc"
+#define XILINX_INTC(obj) OBJECT_CHECK(struct xlx_pic, (obj), TYPE_XILINX_INTC)
+
 struct xlx_pic
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq parent_irq;
 
@@ -153,16 +157,17 @@
     update_irq(p);
 }
 
-static int xilinx_intc_init(SysBusDevice *dev)
+static int xilinx_intc_init(SysBusDevice *sbd)
 {
-    struct xlx_pic *p = FROM_SYSBUS(typeof (*p), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct xlx_pic *p = XILINX_INTC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &p->parent_irq);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &p->parent_irq);
 
     memory_region_init_io(&p->mmio, OBJECT(p), &pic_ops, p, "xlnx.xps-intc",
                           R_MAX * 4);
-    sysbus_init_mmio(dev, &p->mmio);
+    sysbus_init_mmio(sbd, &p->mmio);
     return 0;
 }
 
@@ -181,7 +186,7 @@
 }
 
 static const TypeInfo xilinx_intc_info = {
-    .name          = "xlnx.xps-intc",
+    .name          = TYPE_XILINX_INTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct xlx_pic),
     .class_init    = xilinx_intc_class_init,
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index b25ed04..a7d9aa6 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -22,135 +22,28 @@
 #include "hw/timer/i8254.h"
 #include "hw/audio/pcspk.h"
 
-//#define DEBUG_I82378
-
-#ifdef DEBUG_I82378
-#define DPRINTF(fmt, ...) \
-do { fprintf(stderr, "i82378: " fmt , ## __VA_ARGS__); } while (0)
-#else
-#define DPRINTF(fmt, ...) \
-do {} while (0)
-#endif
-
-#define BADF(fmt, ...) \
-do { fprintf(stderr, "i82378 ERROR: " fmt , ## __VA_ARGS__); } while (0)
+#define TYPE_I82378 "i82378"
+#define I82378(obj) \
+    OBJECT_CHECK(I82378State, (obj), TYPE_I82378)
 
 typedef struct I82378State {
+    PCIDevice parent_obj;
+
     qemu_irq out[2];
     qemu_irq *i8259;
     MemoryRegion io;
-    MemoryRegion mem;
 } I82378State;
 
-typedef struct PCIi82378State {
-    PCIDevice pci_dev;
-    uint32_t isa_io_base;
-    uint32_t isa_mem_base;
-    I82378State state;
-} PCIi82378State;
-
-static const VMStateDescription vmstate_pci_i82378 = {
+static const VMStateDescription vmstate_i82378 = {
     .name = "pci-i82378",
     .version_id = 0,
     .minimum_version_id = 0,
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(pci_dev, PCIi82378State),
+        VMSTATE_PCI_DEVICE(parent_obj, I82378State),
         VMSTATE_END_OF_LIST()
     },
 };
 
-static void i82378_io_write(void *opaque, hwaddr addr,
-                            uint64_t value, unsigned int size)
-{
-    switch (size) {
-    case 1:
-        DPRINTF("%s: " TARGET_FMT_plx "=%02" PRIx64 "\n", __func__,
-                addr, value);
-        cpu_outb(addr, value);
-        break;
-    case 2:
-        DPRINTF("%s: " TARGET_FMT_plx "=%04" PRIx64 "\n", __func__,
-                addr, value);
-        cpu_outw(addr, value);
-        break;
-    case 4:
-        DPRINTF("%s: " TARGET_FMT_plx "=%08" PRIx64 "\n", __func__,
-                addr, value);
-        cpu_outl(addr, value);
-        break;
-    default:
-        abort();
-    }
-}
-
-static uint64_t i82378_io_read(void *opaque, hwaddr addr,
-                               unsigned int size)
-{
-    DPRINTF("%s: " TARGET_FMT_plx "\n", __func__, addr);
-    switch (size) {
-    case 1:
-        return cpu_inb(addr);
-    case 2:
-        return cpu_inw(addr);
-    case 4:
-        return cpu_inl(addr);
-    default:
-        abort();
-    }
-}
-
-static const MemoryRegionOps i82378_io_ops = {
-    .read = i82378_io_read,
-    .write = i82378_io_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-static void i82378_mem_write(void *opaque, hwaddr addr,
-                             uint64_t value, unsigned int size)
-{
-    switch (size) {
-    case 1:
-        DPRINTF("%s: " TARGET_FMT_plx "=%02" PRIx64 "\n", __func__,
-                addr, value);
-        cpu_outb(addr, value);
-        break;
-    case 2:
-        DPRINTF("%s: " TARGET_FMT_plx "=%04" PRIx64 "\n", __func__,
-                addr, value);
-        cpu_outw(addr, value);
-        break;
-    case 4:
-        DPRINTF("%s: " TARGET_FMT_plx "=%08" PRIx64 "\n", __func__,
-                addr, value);
-        cpu_outl(addr, value);
-        break;
-    default:
-        abort();
-    }
-}
-
-static uint64_t i82378_mem_read(void *opaque, hwaddr addr,
-                                unsigned int size)
-{
-    DPRINTF("%s: " TARGET_FMT_plx "\n", __func__, addr);
-    switch (size) {
-    case 1:
-        return cpu_inb(addr);
-    case 2:
-        return cpu_inw(addr);
-    case 4:
-        return cpu_inl(addr);
-    default:
-        abort();
-    }
-}
-
-static const MemoryRegionOps i82378_mem_ops = {
-    .read = i82378_mem_read,
-    .write = i82378_mem_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 static void i82378_request_out0_irq(void *opaque, int irq, int level)
 {
     I82378State *s = opaque;
@@ -160,19 +53,30 @@
 static void i82378_request_pic_irq(void *opaque, int irq, int level)
 {
     DeviceState *dev = opaque;
-    PCIDevice *pci = DO_UPCAST(PCIDevice, qdev, dev);
-    PCIi82378State *s = DO_UPCAST(PCIi82378State, pci_dev, pci);
+    I82378State *s = I82378(dev);
 
-    qemu_set_irq(s->state.i8259[irq], level);
+    qemu_set_irq(s->i8259[irq], level);
 }
 
-static void i82378_init(DeviceState *dev, I82378State *s)
+static int i82378_initfn(PCIDevice *pci)
 {
-    ISABus *isabus = ISA_BUS(qdev_get_child_bus(dev, "isa.0"));
-    ISADevice *pit;
+    DeviceState *dev = DEVICE(pci);
+    I82378State *s = I82378(dev);
+    uint8_t *pci_conf;
+    ISABus *isabus;
     ISADevice *isa;
     qemu_irq *out0_irq;
 
+    pci_conf = pci->config;
+    pci_set_word(pci_conf + PCI_COMMAND,
+                 PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+    pci_set_word(pci_conf + PCI_STATUS,
+                 PCI_STATUS_DEVSEL_MEDIUM);
+
+    pci_config_set_interrupt_pin(pci_conf, 1); /* interrupt pin 0 */
+
+    isabus = isa_bus_new(dev, pci_address_space_io(pci));
+
     /* This device has:
        2 82C59 (irq)
        1 82C54 (pit)
@@ -183,9 +87,6 @@
        All devices accept byte access only, except timer
      */
 
-    qdev_init_gpio_out(dev, s->out, 2);
-    qdev_init_gpio_in(dev, i82378_request_pic_irq, 16);
-
     /* Workaround the fact that i8259 is not qdev'ified... */
     out0_irq = qemu_allocate_irqs(i82378_request_out0_irq, s, 1);
 
@@ -194,10 +95,10 @@
     isa_bus_irqs(isabus, s->i8259);
 
     /* 1 82C54 (pit) */
-    pit = pit_init(isabus, 0x40, 0, NULL);
+    isa = pit_init(isabus, 0x40, 0, NULL);
 
     /* speaker */
-    pcspk_init(isabus, pit);
+    pcspk_init(isabus, isa);
 
     /* 2 82C37 (dma) */
     isa = isa_create_simple(isabus, "i82374");
@@ -205,75 +106,44 @@
 
     /* timer */
     isa_create_simple(isabus, "mc146818rtc");
-}
-
-static int pci_i82378_init(PCIDevice *dev)
-{
-    PCIi82378State *pci = DO_UPCAST(PCIi82378State, pci_dev, dev);
-    I82378State *s = &pci->state;
-    uint8_t *pci_conf;
-
-    pci_conf = dev->config;
-    pci_set_word(pci_conf + PCI_COMMAND,
-                 PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
-    pci_set_word(pci_conf + PCI_STATUS,
-                 PCI_STATUS_DEVSEL_MEDIUM);
-
-    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin 0 */
-
-    memory_region_init_io(&s->io, OBJECT(pci), &i82378_io_ops, s,
-                          "i82378-io", 0x00010000);
-    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io);
-
-    memory_region_init_io(&s->mem, OBJECT(pci), &i82378_mem_ops, s,
-                          "i82378-mem", 0x01000000);
-    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
-
-    /* Make I/O address read only */
-    pci_set_word(dev->wmask + PCI_COMMAND, PCI_COMMAND_SPECIAL);
-    pci_set_long(dev->wmask + PCI_BASE_ADDRESS_0, 0);
-    pci_set_long(pci_conf + PCI_BASE_ADDRESS_0, pci->isa_io_base);
-
-    isa_mem_base = pci->isa_mem_base;
-    isa_bus_new(&dev->qdev, pci_address_space_io(dev));
-
-    i82378_init(&dev->qdev, s);
 
     return 0;
 }
 
-static Property i82378_properties[] = {
-    DEFINE_PROP_HEX32("iobase", PCIi82378State, isa_io_base, 0x80000000),
-    DEFINE_PROP_HEX32("membase", PCIi82378State, isa_mem_base, 0xc0000000),
-    DEFINE_PROP_END_OF_LIST()
-};
+static void i82378_init(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+    I82378State *s = I82378(obj);
 
-static void pci_i82378_class_init(ObjectClass *klass, void *data)
+    qdev_init_gpio_out(dev, s->out, 2);
+    qdev_init_gpio_in(dev, i82378_request_pic_irq, 16);
+}
+
+static void i82378_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    k->init = pci_i82378_init;
+    k->init = i82378_initfn;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82378;
     k->revision = 0x03;
     k->class_id = PCI_CLASS_BRIDGE_ISA;
-    k->subsystem_vendor_id = 0x0;
-    k->subsystem_id = 0x0;
-    dc->vmsd = &vmstate_pci_i82378;
-    dc->props = i82378_properties;
+    dc->vmsd = &vmstate_i82378;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
-static const TypeInfo pci_i82378_info = {
-    .name = "i82378",
+static const TypeInfo i82378_type_info = {
+    .name = TYPE_I82378,
     .parent = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIi82378State),
-    .class_init = pci_i82378_class_init,
+    .instance_size = sizeof(I82378State),
+    .instance_init = i82378_init,
+    .class_init = i82378_class_init,
 };
 
 static void i82378_register_types(void)
 {
-    type_register_static(&pci_i82378_info);
+    type_register_static(&i82378_type_info);
 }
 
 type_init(i82378_register_types)
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index d1921aa..5633d08 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -600,6 +600,7 @@
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = ich9_lpc_reset;
     k->init = ich9_lpc_initfn;
     dc->vmsd = &vmstate_ich9_lpc;
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 2174eaa..8fe4fcb 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -281,6 +281,7 @@
     k->device_id = PCI_DEVICE_ID_VIA_AC97;
     k->revision = 0x50;
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "AC97";
 }
 
@@ -322,6 +323,7 @@
     k->device_id = PCI_DEVICE_ID_VIA_MC97;
     k->class_id = PCI_CLASS_COMMUNICATION_OTHER;
     k->revision = 0x30;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "MC97";
 }
 
@@ -401,6 +403,7 @@
     k->revision = 0x40;
     dc->desc = "PM";
     dc->vmsd = &vmstate_acpi;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = via_pm_properties;
 }
 
diff --git a/hw/lm32/lm32.h b/hw/lm32/lm32.h
index 236686e..18aa6fd 100644
--- a/hw/lm32/lm32.h
+++ b/hw/lm32/lm32.h
@@ -1,8 +1,7 @@
 #ifndef HW_LM32_H
 #define HW_LM32_H 1
 
-
-#include "qemu-common.h"
+#include "hw/char/lm32_juart.h"
 
 static inline DeviceState *lm32_pic_init(qemu_irq cpu_irq)
 {
@@ -21,7 +20,7 @@
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "lm32-juart");
+    dev = qdev_create(NULL, TYPE_LM32_JUART);
     qdev_init_nofail(dev);
 
     return dev;
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index 9901441..b13750d 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -43,6 +43,7 @@
 #include "hw/timer/i8254.h"
 #include "sysemu/blockdev.h"
 #include "exec/address-spaces.h"
+#include "sysemu/qtest.h"
 
 #define DEBUG_FULONG2E_INIT
 
@@ -332,7 +333,8 @@
             bios_size = -1;
         }
 
-        if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
+        if ((bios_size < 0 || bios_size > BIOS_SIZE) &&
+            !kernel_filename && !qtest_enabled()) {
             fprintf(stderr, "qemu: Warning, could not load MIPS bios '%s'\n", bios_name);
         }
     }
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index d6e0860..36677cc 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -42,6 +42,7 @@
 #include "sysemu/blockdev.h"
 #include "hw/sysbus.h"
 #include "exec/address-spaces.h"
+#include "sysemu/qtest.h"
 
 enum jazz_model_e
 {
@@ -176,7 +177,7 @@
     } else {
         bios_size = -1;
     }
-    if (bios_size < 0 || bios_size > MAGNUM_BIOS_SIZE) {
+    if ((bios_size < 0 || bios_size > MAGNUM_BIOS_SIZE) && !qtest_enabled()) {
         fprintf(stderr, "qemu: Warning, could not load MIPS bios '%s'\n",
                 bios_name);
     }
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 1589b59..f56f34f 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -48,6 +48,7 @@
 #include "exec/address-spaces.h"
 #include "hw/sysbus.h"             /* SysBusDevice */
 #include "qemu/host-utils.h"
+#include "sysemu/qtest.h"
 
 //#define DEBUG_BOARD_INIT
 
@@ -1005,7 +1006,8 @@
             } else {
                 bios_size = -1;
             }
-            if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {
+            if ((bios_size < 0 || bios_size > BIOS_SIZE) &&
+                !kernel_filename && !qtest_enabled()) {
                 fprintf(stderr,
                         "qemu: Warning, could not load MIPS bios '%s', and no -kernel argument was specified\n",
                         bios_name);
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index 7af08b8..044f232 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -26,6 +26,7 @@
 #include "hw/timer/i8254.h"
 #include "sysemu/blockdev.h"
 #include "exec/address-spaces.h"
+#include "sysemu/qtest.h"
 
 #define MAX_IDE_BUS 2
 
@@ -244,8 +245,7 @@
                                    4, 0, 0, 0, 0, be)) {
             fprintf(stderr, "qemu: Error registering flash memory.\n");
 	}
-    }
-    else {
+    } else if (!qtest_enabled()) {
 	/* not fatal */
         fprintf(stderr, "qemu: Warning, could not load MIPS bios '%s'\n",
 		bios_name);
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index bfafa51..1e8d183 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -263,6 +263,7 @@
     dc->realize = applesmc_isa_realize;
     dc->reset = qdev_applesmc_isa_reset;
     dc->props = applesmc_isa_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo applesmc_isa_info = {
diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index 3d6acee..8e192cd 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -23,8 +23,12 @@
 /* L2C-310 r3p2 */
 #define CACHE_ID 0x410000c8
 
-typedef struct l2x0_state {
-    SysBusDevice busdev;
+#define TYPE_ARM_L2X0 "l2x0"
+#define ARM_L2X0(obj) OBJECT_CHECK(L2x0State, (obj), TYPE_ARM_L2X0)
+
+typedef struct L2x0State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t cache_type;
     uint32_t ctrl;
@@ -33,19 +37,19 @@
     uint32_t tag_ctrl;
     uint32_t filter_start;
     uint32_t filter_end;
-} l2x0_state;
+} L2x0State;
 
 static const VMStateDescription vmstate_l2x0 = {
     .name = "l2x0",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(ctrl, l2x0_state),
-        VMSTATE_UINT32(aux_ctrl, l2x0_state),
-        VMSTATE_UINT32(data_ctrl, l2x0_state),
-        VMSTATE_UINT32(tag_ctrl, l2x0_state),
-        VMSTATE_UINT32(filter_start, l2x0_state),
-        VMSTATE_UINT32(filter_end, l2x0_state),
+        VMSTATE_UINT32(ctrl, L2x0State),
+        VMSTATE_UINT32(aux_ctrl, L2x0State),
+        VMSTATE_UINT32(data_ctrl, L2x0State),
+        VMSTATE_UINT32(tag_ctrl, L2x0State),
+        VMSTATE_UINT32(filter_start, L2x0State),
+        VMSTATE_UINT32(filter_end, L2x0State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -55,7 +59,7 @@
                                unsigned size)
 {
     uint32_t cache_data;
-    l2x0_state *s = (l2x0_state *)opaque;
+    L2x0State *s = (L2x0State *)opaque;
     offset &= 0xfff;
     if (offset >= 0x730 && offset < 0x800) {
         return 0; /* cache ops complete */
@@ -97,7 +101,7 @@
 static void l2x0_priv_write(void *opaque, hwaddr offset,
                             uint64_t value, unsigned size)
 {
-    l2x0_state *s = (l2x0_state *)opaque;
+    L2x0State *s = (L2x0State *)opaque;
     offset &= 0xfff;
     if (offset >= 0x730 && offset < 0x800) {
         /* ignore */
@@ -137,7 +141,7 @@
 
 static void l2x0_priv_reset(DeviceState *dev)
 {
-    l2x0_state *s = DO_UPCAST(l2x0_state, busdev.qdev, dev);
+    L2x0State *s = ARM_L2X0(dev);
 
     s->ctrl = 0;
     s->aux_ctrl = 0x02020000;
@@ -155,7 +159,7 @@
 
 static int l2x0_priv_init(SysBusDevice *dev)
 {
-    l2x0_state *s = FROM_SYSBUS(l2x0_state, dev);
+    L2x0State *s = ARM_L2X0(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &l2x0_mem_ops, s,
                           "l2x0_cc", 0x1000);
@@ -164,7 +168,7 @@
 }
 
 static Property l2x0_properties[] = {
-    DEFINE_PROP_UINT32("cache-type", l2x0_state, cache_type, 0x1c100100),
+    DEFINE_PROP_UINT32("cache-type", L2x0State, cache_type, 0x1c100100),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -181,9 +185,9 @@
 }
 
 static const TypeInfo l2x0_info = {
-    .name = "l2x0",
+    .name = TYPE_ARM_L2X0,
     .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(l2x0_state),
+    .instance_size = sizeof(L2x0State),
     .class_init = l2x0_class_init,
 };
 
diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index 5906ae5..4a911d4 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -16,8 +16,13 @@
 
 #define LOCK_VALUE 0xa05f
 
+#define TYPE_ARM_SYSCTL "realview_sysctl"
+#define ARM_SYSCTL(obj) \
+    OBJECT_CHECK(arm_sysctl_state, (obj), TYPE_ARM_SYSCTL)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq pl110_mux_ctrl;
 
@@ -85,7 +90,7 @@
 
 static void arm_sysctl_reset(DeviceState *d)
 {
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, SYS_BUS_DEVICE(d));
+    arm_sysctl_state *s = ARM_SYSCTL(d);
     int i;
 
     s->leds = 0;
@@ -587,7 +592,7 @@
 {
     DeviceState *dev = DEVICE(obj);
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, sd);
+    arm_sysctl_state *s = ARM_SYSCTL(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &arm_sysctl_ops, s,
                           "arm-sysctl", 0x1000);
@@ -598,14 +603,15 @@
 
 static void arm_sysctl_realize(DeviceState *d, Error **errp)
 {
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, SYS_BUS_DEVICE(d));
+    arm_sysctl_state *s = ARM_SYSCTL(d);
+
     s->db_clock = g_new0(uint32_t, s->db_num_clocks);
 }
 
 static void arm_sysctl_finalize(Object *obj)
 {
-    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, dev);
+    arm_sysctl_state *s = ARM_SYSCTL(obj);
+
     g_free(s->db_voltage);
     g_free(s->db_clock);
     g_free(s->db_clock_reset);
@@ -634,7 +640,7 @@
 }
 
 static const TypeInfo arm_sysctl_info = {
-    .name          = "realview_sysctl",
+    .name          = TYPE_ARM_SYSCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(arm_sysctl_state),
     .instance_init = arm_sysctl_init,
diff --git a/hw/misc/debugexit.c b/hw/misc/debugexit.c
index d754cf1..9db5680 100644
--- a/hw/misc/debugexit.c
+++ b/hw/misc/debugexit.c
@@ -58,6 +58,7 @@
 
     dc->realize = debug_exit_realizefn;
     dc->props = debug_exit_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo debug_exit_info = {
diff --git a/hw/misc/eccmemctl.c b/hw/misc/eccmemctl.c
index 3de9675..96a69d4 100644
--- a/hw/misc/eccmemctl.c
+++ b/hw/misc/eccmemctl.c
@@ -120,8 +120,12 @@
 #define ECC_DIAG_SIZE  4
 #define ECC_DIAG_MASK  (ECC_DIAG_SIZE - 1)
 
+#define TYPE_ECC_MEMCTL "eccmemctl"
+#define ECC_MEMCTL(obj) OBJECT_CHECK(ECCState, (obj), TYPE_ECC_MEMCTL)
+
 typedef struct ECCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem, iomem_diag;
     qemu_irq irq;
     uint32_t regs[ECC_NREGS];
@@ -273,13 +277,14 @@
 
 static void ecc_reset(DeviceState *d)
 {
-    ECCState *s = container_of(d, ECCState, busdev.qdev);
+    ECCState *s = ECC_MEMCTL(d);
 
-    if (s->version == ECC_MCC)
+    if (s->version == ECC_MCC) {
         s->regs[ECC_MER] &= ECC_MER_REU;
-    else
+    } else {
         s->regs[ECC_MER] &= (ECC_MER_VER | ECC_MER_IMPL | ECC_MER_MRR |
                              ECC_MER_DCI);
+    }
     s->regs[ECC_MDR] = 0x20;
     s->regs[ECC_MFSR] = 0;
     s->regs[ECC_VCR] = 0;
@@ -292,7 +297,7 @@
 
 static int ecc_init1(SysBusDevice *dev)
 {
-    ECCState *s = FROM_SYSBUS(ECCState, dev);
+    ECCState *s = ECC_MEMCTL(dev);
 
     sysbus_init_irq(dev, &s->irq);
     s->regs[0] = s->version;
@@ -325,7 +330,7 @@
 }
 
 static const TypeInfo ecc_info = {
-    .name          = "eccmemctl",
+    .name          = TYPE_ECC_MEMCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ECCState),
     .class_init    = ecc_class_init,
diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index 28395ba..cbf0795 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -386,8 +386,13 @@
 #define PMU_NUM_OF_REGISTERS     \
     (sizeof(exynos4210_pmu_regs) / sizeof(Exynos4210PmuReg))
 
+#define TYPE_EXYNOS4210_PMU "exynos4210.pmu"
+#define EXYNOS4210_PMU(obj) \
+    OBJECT_CHECK(Exynos4210PmuState, (obj), TYPE_EXYNOS4210_PMU)
+
 typedef struct Exynos4210PmuState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t reg[PMU_NUM_OF_REGISTERS];
 } Exynos4210PmuState;
@@ -443,8 +448,7 @@
 
 static void exynos4210_pmu_reset(DeviceState *dev)
 {
-    Exynos4210PmuState *s =
-            container_of(dev, Exynos4210PmuState, busdev.qdev);
+    Exynos4210PmuState *s = EXYNOS4210_PMU(dev);
     unsigned i;
 
     /* Set default values for registers */
@@ -455,7 +459,7 @@
 
 static int exynos4210_pmu_init(SysBusDevice *dev)
 {
-    Exynos4210PmuState *s = FROM_SYSBUS(Exynos4210PmuState, dev);
+    Exynos4210PmuState *s = EXYNOS4210_PMU(dev);
 
     /* memory mapping */
     memory_region_init_io(&s->iomem, OBJECT(dev), &exynos4210_pmu_ops, s,
@@ -485,7 +489,7 @@
 }
 
 static const TypeInfo exynos4210_pmu_info = {
-    .name          = "exynos4210.pmu",
+    .name          = TYPE_EXYNOS4210_PMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210PmuState),
     .class_init    = exynos4210_pmu_class_init,
diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index 816d5e8..63e33a4 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -29,8 +29,12 @@
 
 static int imx_ccm_post_load(void *opaque, int version_id);
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_CCM "imx_ccm"
+#define IMX_CCM(obj) OBJECT_CHECK(IMXCCMState, (obj), TYPE_IMX_CCM)
+
+typedef struct IMXCCMState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t ccmr;
@@ -108,7 +112,7 @@
 
 uint32_t imx_clock_frequency(DeviceState *dev, IMXClk clock)
 {
-    IMXCCMState *s = container_of(dev, IMXCCMState, busdev.qdev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     switch (clock) {
     case NOCLK:
@@ -178,7 +182,7 @@
 
 static void imx_ccm_reset(DeviceState *dev)
 {
-    IMXCCMState *s = container_of(dev, IMXCCMState, busdev.qdev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     s->ccmr = 0x074b0b7b;
     s->pdr0 = 0xff870b48;
@@ -279,7 +283,7 @@
 
 static int imx_ccm_init(SysBusDevice *dev)
 {
-    IMXCCMState *s = FROM_SYSBUS(typeof(*s), dev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &imx_ccm_ops, s,
                           "imx_ccm", 0x1000);
@@ -308,7 +312,7 @@
 }
 
 static const TypeInfo imx_ccm_info = {
-    .name = "imx_ccm",
+    .name = TYPE_IMX_CCM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXCCMState),
     .class_init = imx_ccm_class_init,
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 4a74856..2838866 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -821,6 +821,7 @@
     k->class_id = PCI_CLASS_MEMORY_RAM;
     dc->reset = ivshmem_reset;
     dc->props = ivshmem_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo ivshmem_info = {
diff --git a/hw/misc/lm32_sys.c b/hw/misc/lm32_sys.c
index 060a5bf..9bdb781 100644
--- a/hw/misc/lm32_sys.c
+++ b/hw/misc/lm32_sys.c
@@ -44,8 +44,12 @@
 
 #define MAX_TESTNAME_LEN 16
 
+#define TYPE_LM32_SYS "lm32-sys"
+#define LM32_SYS(obj) OBJECT_CHECK(LM32SysState, (obj), TYPE_LM32_SYS)
+
 struct LM32SysState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t base;
     uint32_t regs[R_MAX];
@@ -104,7 +108,7 @@
 
 static void sys_reset(DeviceState *d)
 {
-    LM32SysState *s = container_of(d, LM32SysState, busdev.qdev);
+    LM32SysState *s = LM32_SYS(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -115,7 +119,7 @@
 
 static int lm32_sys_init(SysBusDevice *dev)
 {
-    LM32SysState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32SysState *s = LM32_SYS(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &sys_ops , s,
                           "sys", R_MAX * 4);
@@ -158,7 +162,7 @@
 }
 
 static const TypeInfo lm32_sys_info = {
-    .name          = "lm32-sys",
+    .name          = TYPE_LM32_SYS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32SysState),
     .class_init    = lm32_sys_class_init,
diff --git a/hw/misc/milkymist-hpdmc.c b/hw/misc/milkymist-hpdmc.c
index a498881..aef135e 100644
--- a/hw/misc/milkymist-hpdmc.c
+++ b/hw/misc/milkymist-hpdmc.c
@@ -40,8 +40,13 @@
     IODELAY_PLL2_LOCKED  = (1<<7),
 };
 
+#define TYPE_MILKYMIST_HPDMC "milkymist-hpdmc"
+#define MILKYMIST_HPDMC(obj) \
+    OBJECT_CHECK(MilkymistHpdmcState, (obj), TYPE_MILKYMIST_HPDMC)
+
 struct MilkymistHpdmcState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     uint32_t regs[R_MAX];
@@ -111,7 +116,7 @@
 
 static void milkymist_hpdmc_reset(DeviceState *d)
 {
-    MilkymistHpdmcState *s = container_of(d, MilkymistHpdmcState, busdev.qdev);
+    MilkymistHpdmcState *s = MILKYMIST_HPDMC(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -125,7 +130,7 @@
 
 static int milkymist_hpdmc_init(SysBusDevice *dev)
 {
-    MilkymistHpdmcState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistHpdmcState *s = MILKYMIST_HPDMC(dev);
 
     memory_region_init_io(&s->regs_region, OBJECT(dev), &hpdmc_mmio_ops, s,
             "milkymist-hpdmc", R_MAX * 4);
@@ -156,7 +161,7 @@
 }
 
 static const TypeInfo milkymist_hpdmc_info = {
-    .name          = "milkymist-hpdmc",
+    .name          = TYPE_MILKYMIST_HPDMC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistHpdmcState),
     .class_init    = milkymist_hpdmc_class_init,
diff --git a/hw/misc/milkymist-pfpu.c b/hw/misc/milkymist-pfpu.c
index 2b64ee7..b3b2143 100644
--- a/hw/misc/milkymist-pfpu.c
+++ b/hw/misc/milkymist-pfpu.c
@@ -116,8 +116,13 @@
 };
 #endif
 
+#define TYPE_MILKYMIST_PFPU "milkymist-pfpu"
+#define MILKYMIST_PFPU(obj) \
+    OBJECT_CHECK(MilkymistPFPUState, (obj), TYPE_MILKYMIST_PFPU)
+
 struct MilkymistPFPUState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -473,7 +478,7 @@
 
 static void milkymist_pfpu_reset(DeviceState *d)
 {
-    MilkymistPFPUState *s = container_of(d, MilkymistPFPUState, busdev.qdev);
+    MilkymistPFPUState *s = MILKYMIST_PFPU(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -493,7 +498,7 @@
 
 static int milkymist_pfpu_init(SysBusDevice *dev)
 {
-    MilkymistPFPUState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistPFPUState *s = MILKYMIST_PFPU(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -530,7 +535,7 @@
 }
 
 static const TypeInfo milkymist_pfpu_info = {
-    .name          = "milkymist-pfpu",
+    .name          = TYPE_MILKYMIST_PFPU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistPFPUState),
     .class_init    = milkymist_pfpu_class_init,
diff --git a/hw/misc/mst_fpga.c b/hw/misc/mst_fpga.c
index 604be5e..c96810f 100644
--- a/hw/misc/mst_fpga.c
+++ b/hw/misc/mst_fpga.c
@@ -35,25 +35,30 @@
 #define MST_PCMCIA_CD0_IRQ	9
 #define MST_PCMCIA_CD1_IRQ	13
 
+#define TYPE_MAINSTONE_FPGA "mainstone-fpga"
+#define MAINSTONE_FPGA(obj) \
+    OBJECT_CHECK(mst_irq_state, (obj), TYPE_MAINSTONE_FPGA)
+
 typedef struct mst_irq_state{
-	SysBusDevice busdev;
-	MemoryRegion iomem;
+    SysBusDevice parent_obj;
 
-	qemu_irq parent;
+    MemoryRegion iomem;
 
-	uint32_t prev_level;
-	uint32_t leddat1;
-	uint32_t leddat2;
-	uint32_t ledctrl;
-	uint32_t gpswr;
-	uint32_t mscwr1;
-	uint32_t mscwr2;
-	uint32_t mscwr3;
-	uint32_t mscrd;
-	uint32_t intmskena;
-	uint32_t intsetclr;
-	uint32_t pcmcia0;
-	uint32_t pcmcia1;
+    qemu_irq parent;
+
+    uint32_t prev_level;
+    uint32_t leddat1;
+    uint32_t leddat2;
+    uint32_t ledctrl;
+    uint32_t gpswr;
+    uint32_t mscwr1;
+    uint32_t mscwr2;
+    uint32_t mscwr3;
+    uint32_t mscrd;
+    uint32_t intmskena;
+    uint32_t intsetclr;
+    uint32_t pcmcia0;
+    uint32_t pcmcia1;
 }mst_irq_state;
 
 static void
@@ -194,24 +199,23 @@
 	return 0;
 }
 
-static int mst_fpga_init(SysBusDevice *dev)
+static int mst_fpga_init(SysBusDevice *sbd)
 {
-	mst_irq_state *s;
+    DeviceState *dev = DEVICE(sbd);
+    mst_irq_state *s = MAINSTONE_FPGA(dev);
 
-	s = FROM_SYSBUS(mst_irq_state, dev);
+    s->pcmcia0 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
+    s->pcmcia1 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
 
-	s->pcmcia0 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
-	s->pcmcia1 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
+    sysbus_init_irq(sbd, &s->parent);
 
-	sysbus_init_irq(dev, &s->parent);
+    /* alloc the external 16 irqs */
+    qdev_init_gpio_in(dev, mst_fpga_set_irq, MST_NUM_IRQS);
 
-	/* alloc the external 16 irqs */
-	qdev_init_gpio_in(&dev->qdev, mst_fpga_set_irq, MST_NUM_IRQS);
-
-	memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
-			    "fpga", 0x00100000);
-	sysbus_init_mmio(dev, &s->iomem);
-	return 0;
+    memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
+                          "fpga", 0x00100000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    return 0;
 }
 
 static VMStateDescription vmstate_mst_fpga_regs = {
@@ -249,7 +253,7 @@
 }
 
 static const TypeInfo mst_fpga_info = {
-    .name          = "mainstone-fpga",
+    .name          = TYPE_MAINSTONE_FPGA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mst_irq_state),
     .class_init    = mst_fpga_class_init,
diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index 5867c70..18e94e0 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -188,6 +188,7 @@
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->realize = testdev_realizefn;
 }
 
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index d69ff33..ca53b3f 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -315,6 +315,7 @@
     k->revision = 0x00;
     k->class_id = PCI_CLASS_OTHERS;
     dc->desc = "PCI Test Device";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->reset = qdev_pci_testdev_reset;
 }
 
diff --git a/hw/misc/puv3_pm.c b/hw/misc/puv3_pm.c
index 5592560..37f2369 100644
--- a/hw/misc/puv3_pm.c
+++ b/hw/misc/puv3_pm.c
@@ -14,8 +14,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_PM "puv3_pm"
+#define PUV3_PM(obj) OBJECT_CHECK(PUV3PMState, (obj), TYPE_PUV3_PM)
+
+typedef struct PUV3PMState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t reg_PMCR;
@@ -116,7 +120,7 @@
 
 static int puv3_pm_init(SysBusDevice *dev)
 {
-    PUV3PMState *s = FROM_SYSBUS(PUV3PMState, dev);
+    PUV3PMState *s = PUV3_PM(dev);
 
     s->reg_PCGR = 0x0;
 
@@ -135,7 +139,7 @@
 }
 
 static const TypeInfo puv3_pm_info = {
-    .name = "puv3_pm",
+    .name = TYPE_PUV3_PM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3PMState),
     .class_init = puv3_pm_class_init,
diff --git a/hw/misc/sga.c b/hw/misc/sga.c
index 08803e7..83d2fd9 100644
--- a/hw/misc/sga.c
+++ b/hw/misc/sga.c
@@ -47,6 +47,7 @@
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->realize = sga_realizefn;
     dc->desc = "Serial Graphics Adapter";
 }
diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index 00d9542..767544e 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -34,8 +34,12 @@
  * This also includes the PMC CPU idle controller.
  */
 
+#define TYPE_SLAVIO_MISC "slavio_misc"
+#define SLAVIO_MISC(obj) OBJECT_CHECK(MiscState, (obj), TYPE_SLAVIO_MISC)
+
 typedef struct MiscState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion cfg_iomem;
     MemoryRegion diag_iomem;
     MemoryRegion mdm_iomem;
@@ -53,8 +57,12 @@
     uint16_t leds;
 } MiscState;
 
+#define TYPE_APC "apc"
+#define APC(obj) OBJECT_CHECK(APCState, (obj), TYPE_APC)
+
 typedef struct APCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq cpu_halt;
 } APCState;
@@ -88,7 +96,7 @@
 
 static void slavio_misc_reset(DeviceState *d)
 {
-    MiscState *s = container_of(d, MiscState, busdev.qdev);
+    MiscState *s = SLAVIO_MISC(d);
 
     // Diagnostic and system control registers not cleared in reset
     s->config = s->aux1 = s->aux2 = s->mctrl = 0;
@@ -407,7 +415,7 @@
 
 static int apc_init1(SysBusDevice *dev)
 {
-    APCState *s = FROM_SYSBUS(APCState, dev);
+    APCState *s = APC(dev);
 
     sysbus_init_irq(dev, &s->cpu_halt);
 
@@ -418,52 +426,53 @@
     return 0;
 }
 
-static int slavio_misc_init1(SysBusDevice *dev)
+static int slavio_misc_init1(SysBusDevice *sbd)
 {
-    MiscState *s = FROM_SYSBUS(MiscState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    MiscState *s = SLAVIO_MISC(dev);
 
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fdc_tc);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fdc_tc);
 
     /* 8 bit registers */
     /* Slavio control */
     memory_region_init_io(&s->cfg_iomem, OBJECT(s), &slavio_cfg_mem_ops, s,
                           "configuration", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->cfg_iomem);
+    sysbus_init_mmio(sbd, &s->cfg_iomem);
 
     /* Diagnostics */
     memory_region_init_io(&s->diag_iomem, OBJECT(s), &slavio_diag_mem_ops, s,
                           "diagnostic", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->diag_iomem);
+    sysbus_init_mmio(sbd, &s->diag_iomem);
 
     /* Modem control */
     memory_region_init_io(&s->mdm_iomem, OBJECT(s), &slavio_mdm_mem_ops, s,
                           "modem", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->mdm_iomem);
+    sysbus_init_mmio(sbd, &s->mdm_iomem);
 
     /* 16 bit registers */
     /* ss600mp diag LEDs */
     memory_region_init_io(&s->led_iomem, OBJECT(s), &slavio_led_mem_ops, s,
                           "leds", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->led_iomem);
+    sysbus_init_mmio(sbd, &s->led_iomem);
 
     /* 32 bit registers */
     /* System control */
     memory_region_init_io(&s->sysctrl_iomem, OBJECT(s), &slavio_sysctrl_mem_ops, s,
                           "system-control", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->sysctrl_iomem);
+    sysbus_init_mmio(sbd, &s->sysctrl_iomem);
 
     /* AUX 1 (Misc System Functions) */
     memory_region_init_io(&s->aux1_iomem, OBJECT(s), &slavio_aux1_mem_ops, s,
                           "misc-system-functions", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->aux1_iomem);
+    sysbus_init_mmio(sbd, &s->aux1_iomem);
 
     /* AUX 2 (Software Powerdown Control) */
     memory_region_init_io(&s->aux2_iomem, OBJECT(s), &slavio_aux2_mem_ops, s,
                           "software-powerdown-control", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->aux2_iomem);
+    sysbus_init_mmio(sbd, &s->aux2_iomem);
 
-    qdev_init_gpio_in(&dev->qdev, slavio_set_power_fail, 1);
+    qdev_init_gpio_in(dev, slavio_set_power_fail, 1);
 
     return 0;
 }
@@ -479,7 +488,7 @@
 }
 
 static const TypeInfo slavio_misc_info = {
-    .name          = "slavio_misc",
+    .name          = TYPE_SLAVIO_MISC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MiscState),
     .class_init    = slavio_misc_class_init,
@@ -493,7 +502,7 @@
 }
 
 static const TypeInfo apc_info = {
-    .name          = "apc",
+    .name          = TYPE_APC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MiscState),
     .class_init    = apc_class_init,
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index ad8ce77..017e693 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -3299,6 +3299,7 @@
     dc->props = vfio_pci_dev_properties;
     dc->vmsd = &vfio_pci_vmstate;
     dc->desc = "VFIO-based PCI device assignment";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     pdc->init = vfio_initfn;
     pdc->exit = vfio_exitfn;
     pdc->config_read = vfio_pci_read_config;
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index fc7a85f..e42a5b0 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -114,8 +114,12 @@
   RESET_MAX
 } ResetValues;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_ZYNQ_SLCR "xilinx,zynq_slcr"
+#define ZYNQ_SLCR(obj) OBJECT_CHECK(ZynqSLCRState, (obj), TYPE_ZYNQ_SLCR)
+
+typedef struct ZynqSLCRState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     union {
@@ -158,9 +162,8 @@
 
 static void zynq_slcr_reset(DeviceState *d)
 {
+    ZynqSLCRState *s = ZYNQ_SLCR(d);
     int i;
-    ZynqSLCRState *s =
-            FROM_SYSBUS(ZynqSLCRState, SYS_BUS_DEVICE(d));
 
     DB_PRINT("RESET\n");
 
@@ -492,7 +495,7 @@
 
 static int zynq_slcr_init(SysBusDevice *dev)
 {
-    ZynqSLCRState *s = FROM_SYSBUS(ZynqSLCRState, dev);
+    ZynqSLCRState *s = ZYNQ_SLCR(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &slcr_ops, s, "slcr", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -523,7 +526,7 @@
 
 static const TypeInfo zynq_slcr_info = {
     .class_init = zynq_slcr_class_init,
-    .name  = "xilinx,zynq_slcr",
+    .name  = TYPE_ZYNQ_SLCR,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(ZynqSLCRState),
 };
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index ac929cb..4a355bb 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -315,8 +315,12 @@
     desc[1] |= len;
 }
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_CADENCE_GEM "cadence_gem"
+#define GEM(obj) OBJECT_CHECK(GemState, (obj), TYPE_CADENCE_GEM)
+
+typedef struct GemState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     NICState *nic;
     NICConf conf;
@@ -945,7 +949,7 @@
 
 static void gem_reset(DeviceState *d)
 {
-    GemState *s = FROM_SYSBUS(GemState, SYS_BUS_DEVICE(d));
+    GemState *s = GEM(d);
 
     DB_PRINT("\n");
 
@@ -1155,22 +1159,22 @@
     .link_status_changed = gem_set_link,
 };
 
-static int gem_init(SysBusDevice *dev)
+static int gem_init(SysBusDevice *sbd)
 {
-    GemState *s;
+    DeviceState *dev = DEVICE(sbd);
+    GemState *s = GEM(dev);
 
     DB_PRINT("\n");
 
-    s = FROM_SYSBUS(GemState, dev);
     gem_init_register_masks(s);
     memory_region_init_io(&s->iomem, OBJECT(s), &gem_ops, s,
                           "enet", sizeof(s->regs));
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_gem_info, &s->conf,
-            object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+            object_get_typename(OBJECT(dev)), dev->id, s);
 
     return 0;
 }
@@ -1206,10 +1210,10 @@
 }
 
 static const TypeInfo gem_info = {
-    .class_init = gem_class_init,
-    .name  = "cadence_gem",
+    .name  = TYPE_CADENCE_GEM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(GemState),
+    .class_init = gem_class_init,
 };
 
 static void gem_register_types(void)
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index b952d8d..fdb1f89 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1400,6 +1400,7 @@
     k->device_id = E1000_DEVID;
     k->revision = 0x03;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "Intel Gigabit Ethernet";
     dc->reset = qdev_e1000_reset;
     dc->vmsd = &vmstate_e1000;
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index e0befb2..ffa60d5 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -47,6 +47,7 @@
 #include "hw/nvram/eeprom93xx.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/dma.h"
+#include "qemu/bitops.h"
 
 /* QEMU sends frames smaller than 60 bytes to ethernet nics.
  * Such frames are rejected by real nics and their emulations.
@@ -105,7 +106,6 @@
 #define PCI_IO_SIZE             64
 #define PCI_FLASH_SIZE          (128 * KiB)
 
-#define BIT(n) (1 << (n))
 #define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
 
 /* The SCB accepts the following controls for the Tx and Rx units: */
@@ -2083,6 +2083,7 @@
 
     info = eepro100_get_class_by_name(object_class_get_name(klass));
 
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = e100_properties;
     dc->desc = info->desc;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index ab9a215..78ebbbc 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -322,9 +322,14 @@
 #define R_STAT          0x0b
 #define FS_ETH_MAX_REGS      0x17
 
-struct fs_eth
+#define TYPE_ETRAX_FS_ETH "etraxfs-eth"
+#define ETRAX_FS_ETH(obj) \
+    OBJECT_CHECK(ETRAXFSEthState, (obj), TYPE_ETRAX_FS_ETH)
+
+typedef struct ETRAXFSEthState
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     NICState *nic;
     NICConf conf;
@@ -349,9 +354,9 @@
 
     /* PHY.     */
     struct qemu_phy phy;
-};
+} ETRAXFSEthState;
 
-static void eth_validate_duplex(struct fs_eth *eth)
+static void eth_validate_duplex(ETRAXFSEthState *eth)
 {
     struct qemu_phy *phy;
     unsigned int phy_duplex;
@@ -382,7 +387,7 @@
 static uint64_t
 eth_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
     uint32_t r = 0;
 
     addr >>= 2;
@@ -399,7 +404,7 @@
     return r;
 }
 
-static void eth_update_ma(struct fs_eth *eth, int ma)
+static void eth_update_ma(ETRAXFSEthState *eth, int ma)
 {
     int reg;
     int i = 0;
@@ -428,7 +433,7 @@
 eth_write(void *opaque, hwaddr addr,
           uint64_t val64, unsigned int size)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
     uint32_t value = val64;
 
     addr >>= 2;
@@ -472,7 +477,7 @@
 /* The ETRAX FS has a groupt address table (GAT) which works like a k=1 bloom
    filter dropping group addresses we have not joined.    The filter has 64
    bits (m). The has function is a simple nible xor of the group addr.    */
-static int eth_match_groupaddr(struct fs_eth *eth, const unsigned char *sa)
+static int eth_match_groupaddr(ETRAXFSEthState *eth, const unsigned char *sa)
 {
     unsigned int hsh;
     int m_individual = eth->regs[RW_REC_CTRL] & 4;
@@ -523,7 +528,7 @@
 static ssize_t eth_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
     unsigned char sa_bcast[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
     int use_ma0 = eth->regs[RW_REC_CTRL] & 1;
     int use_ma1 = eth->regs[RW_REC_CTRL] & 2;
     int r_bcast = eth->regs[RW_REC_CTRL] & 8;
@@ -547,12 +552,12 @@
     /* FIXME: Find another way to pass on the fake csum.  */
     etraxfs_dmac_input(eth->dma_in, (void *)buf, size + 4, 1);
 
-        return size;
+    return size;
 }
 
 static int eth_tx_push(void *opaque, unsigned char *buf, int len, bool eop)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
 
     D(printf("%s buf=%p len=%d\n", __func__, buf, len));
     qemu_send_packet(qemu_get_queue(eth->nic), buf, len);
@@ -561,7 +566,7 @@
 
 static void eth_set_link(NetClientState *nc)
 {
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
     D(printf("%s %d\n", __func__, nc->link_down));
     eth->phy.link = !nc->link_down;
 }
@@ -578,7 +583,7 @@
 
 static void eth_cleanup(NetClientState *nc)
 {
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
 
     /* Disconnect the client.  */
     eth->dma_out->client.push = NULL;
@@ -597,9 +602,10 @@
     .link_status_changed = eth_set_link,
 };
 
-static int fs_eth_init(SysBusDevice *dev)
+static int fs_eth_init(SysBusDevice *sbd)
 {
-    struct fs_eth *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    ETRAXFSEthState *s = ETRAX_FS_ETH(dev);
 
     if (!s->dma_out || !s->dma_in) {
         hw_error("Unconnected ETRAX-FS Ethernet MAC.\n");
@@ -612,11 +618,11 @@
 
     memory_region_init_io(&s->mmio, OBJECT(dev), &eth_ops, s,
                           "etraxfs-eth", 0x5c);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_etraxfs_info, &s->conf,
-                          object_get_typename(OBJECT(s)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(s)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
 
@@ -626,10 +632,10 @@
 }
 
 static Property etraxfs_eth_properties[] = {
-    DEFINE_PROP_UINT32("phyaddr", struct fs_eth, phyaddr, 1),
-    DEFINE_PROP_PTR("dma_out", struct fs_eth, vdma_out),
-    DEFINE_PROP_PTR("dma_in", struct fs_eth, vdma_in),
-    DEFINE_NIC_PROPERTIES(struct fs_eth, conf),
+    DEFINE_PROP_UINT32("phyaddr", ETRAXFSEthState, phyaddr, 1),
+    DEFINE_PROP_PTR("dma_out", ETRAXFSEthState, vdma_out),
+    DEFINE_PROP_PTR("dma_in", ETRAXFSEthState, vdma_in),
+    DEFINE_NIC_PROPERTIES(ETRAXFSEthState, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -643,9 +649,9 @@
 }
 
 static const TypeInfo etraxfs_eth_info = {
-    .name          = "etraxfs-eth",
+    .name          = TYPE_ETRAX_FS_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct fs_eth),
+    .instance_size = sizeof(ETRAXFSEthState),
     .class_init    = etraxfs_eth_class_init,
 };
 
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index 3323f48..2c838f6 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -170,8 +170,12 @@
     }
 };
 
+#define TYPE_LAN9118 "lan9118"
+#define LAN9118(obj) OBJECT_CHECK(lan9118_state, (obj), TYPE_LAN9118)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     qemu_irq irq;
@@ -401,7 +405,8 @@
 
 static void lan9118_reset(DeviceState *d)
 {
-    lan9118_state *s = FROM_SYSBUS(lan9118_state, SYS_BUS_DEVICE(d));
+    lan9118_state *s = LAN9118(d);
+
     s->irq_cfg &= (IRQ_TYPE | IRQ_POL);
     s->int_sts = 0;
     s->int_en = 0;
@@ -1053,7 +1058,7 @@
     case CSR_HW_CFG:
         if (val & 1) {
             /* SRST */
-            lan9118_reset(&s->busdev.qdev);
+            lan9118_reset(DEVICE(s));
         } else {
             s->hw_cfg = (val & 0x003f300) | (s->hw_cfg & 0x4);
         }
@@ -1320,9 +1325,10 @@
     .link_status_changed = lan9118_set_link,
 };
 
-static int lan9118_init1(SysBusDevice *dev)
+static int lan9118_init1(SysBusDevice *sbd)
 {
-    lan9118_state *s = FROM_SYSBUS(lan9118_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    lan9118_state *s = LAN9118(dev);
     QEMUBH *bh;
     int i;
     const MemoryRegionOps *mem_ops =
@@ -1330,12 +1336,12 @@
 
     memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                           "lan9118-mmio", 0x100);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_lan9118_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     s->eeprom[0] = 0xa5;
     for (i = 0; i < 6; i++) {
@@ -1370,7 +1376,7 @@
 }
 
 static const TypeInfo lan9118_info = {
-    .name          = "lan9118",
+    .name          = TYPE_LAN9118,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(lan9118_state),
     .class_init    = lan9118_class_init,
@@ -1389,7 +1395,7 @@
     SysBusDevice *s;
 
     qemu_check_nic_model(nd, "lan9118");
-    dev = qdev_create(NULL, "lan9118");
+    dev = qdev_create(NULL, TYPE_LAN9118);
     qdev_set_nic_properties(dev, nd);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
diff --git a/hw/net/lance.c b/hw/net/lance.c
index 98bcdfc..e339f02 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -43,8 +43,13 @@
 #include "pcnet.h"
 #include "trace.h"
 
+#define TYPE_LANCE "lance"
+#define SYSBUS_PCNET(obj) \
+    OBJECT_CHECK(SysBusPCNetState, (obj), TYPE_LANCE)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     PCNetState state;
 } SysBusPCNetState;
 
@@ -112,28 +117,29 @@
     }
 };
 
-static int lance_init(SysBusDevice *dev)
+static int lance_init(SysBusDevice *sbd)
 {
-    SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SysBusPCNetState *d = SYSBUS_PCNET(dev);
     PCNetState *s = &d->state;
 
     memory_region_init_io(&s->mmio, OBJECT(d), &lance_mem_ops, d,
                           "lance-mmio", 4);
 
-    qdev_init_gpio_in(&dev->qdev, parent_lance_reset, 1);
+    qdev_init_gpio_in(dev, parent_lance_reset, 1);
 
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->phys_mem_read = ledma_memory_read;
     s->phys_mem_write = ledma_memory_write;
-    return pcnet_common_init(&dev->qdev, s, &net_lance_info);
+    return pcnet_common_init(dev, s, &net_lance_info);
 }
 
 static void lance_reset(DeviceState *dev)
 {
-    SysBusPCNetState *d = DO_UPCAST(SysBusPCNetState, busdev.qdev, dev);
+    SysBusPCNetState *d = SYSBUS_PCNET(dev);
 
     pcnet_h_reset(&d->state);
 }
@@ -150,6 +156,7 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = lance_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->fw_name = "ethernet";
     dc->reset = lance_reset;
     dc->vmsd = &vmstate_lance;
@@ -157,7 +164,7 @@
 }
 
 static const TypeInfo lance_info = {
-    .name          = "lance",
+    .name          = TYPE_LANCE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusPCNetState),
     .class_init    = lance_class_init,
diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index becd26c..1e92379 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -90,8 +90,13 @@
 };
 typedef struct MilkymistMinimac2MdioState MilkymistMinimac2MdioState;
 
+#define TYPE_MILKYMIST_MINIMAC2 "milkymist-minimac2"
+#define MILKYMIST_MINIMAC2(obj) \
+    OBJECT_CHECK(MilkymistMinimac2State, (obj), TYPE_MILKYMIST_MINIMAC2)
+
 struct MilkymistMinimac2State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     char *phy_model;
@@ -429,8 +434,7 @@
 
 static void milkymist_minimac2_reset(DeviceState *d)
 {
-    MilkymistMinimac2State *s =
-            container_of(d, MilkymistMinimac2State, busdev.qdev);
+    MilkymistMinimac2State *s = MILKYMIST_MINIMAC2(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -453,17 +457,18 @@
     .cleanup = minimac2_cleanup,
 };
 
-static int milkymist_minimac2_init(SysBusDevice *dev)
+static int milkymist_minimac2_init(SysBusDevice *sbd)
 {
-    MilkymistMinimac2State *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    MilkymistMinimac2State *s = MILKYMIST_MINIMAC2(dev);
     size_t buffers_size = TARGET_PAGE_ALIGN(3 * MINIMAC2_BUFFER_SIZE);
 
-    sysbus_init_irq(dev, &s->rx_irq);
-    sysbus_init_irq(dev, &s->tx_irq);
+    sysbus_init_irq(sbd, &s->rx_irq);
+    sysbus_init_irq(sbd, &s->tx_irq);
 
     memory_region_init_io(&s->regs_region, OBJECT(dev), &minimac2_ops, s,
                           "milkymist-minimac2", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->regs_region);
+    sysbus_init_mmio(sbd, &s->regs_region);
 
     /* register buffers memory */
     memory_region_init_ram(&s->buffers, OBJECT(dev), "milkymist-minimac2.buffers",
@@ -473,11 +478,11 @@
     s->rx1_buf = s->rx0_buf + MINIMAC2_BUFFER_SIZE;
     s->tx_buf = s->rx1_buf + MINIMAC2_BUFFER_SIZE;
 
-    sysbus_init_mmio(dev, &s->buffers);
+    sysbus_init_mmio(sbd, &s->buffers);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_milkymist_minimac2_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     return 0;
@@ -532,7 +537,7 @@
 }
 
 static const TypeInfo milkymist_minimac2_info = {
-    .name          = "milkymist-minimac2",
+    .name          = TYPE_MILKYMIST_MINIMAC2,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMinimac2State),
     .class_init    = milkymist_minimac2_class_init,
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 9080850..e421b86 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -19,8 +19,11 @@
 
 #define MAX_ETH_FRAME_SIZE	1514
 
+#define TYPE_MIPS_NET "mipsnet"
+#define MIPS_NET(obj) OBJECT_CHECK(MIPSnetState, (obj), TYPE_MIPS_NET)
+
 typedef struct MIPSnetState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
 
     uint32_t busy;
     uint32_t rx_count;
@@ -231,17 +234,18 @@
     .impl.max_access_size = 4,
 };
 
-static int mipsnet_sysbus_init(SysBusDevice *dev)
+static int mipsnet_sysbus_init(SysBusDevice *sbd)
 {
-    MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev, dev);
+    DeviceState *dev = DEVICE(sbd);
+    MIPSnetState *s = MIPS_NET(dev);
 
     memory_region_init_io(&s->io, OBJECT(dev), &mipsnet_ioport_ops, s,
                           "mipsnet-io", 36);
-    sysbus_init_mmio(dev, &s->io);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->io);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->nic = qemu_new_nic(&net_mipsnet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     return 0;
@@ -249,7 +253,7 @@
 
 static void mipsnet_sysbus_reset(DeviceState *dev)
 {
-    MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev.qdev, dev);
+    MIPSnetState *s = MIPS_NET(dev);
     mipsnet_reset(s);
 }
 
@@ -264,6 +268,7 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = mipsnet_sysbus_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "MIPS Simulator network device";
     dc->reset = mipsnet_sysbus_reset;
     dc->vmsd = &vmstate_mipsnet;
@@ -271,7 +276,7 @@
 }
 
 static const TypeInfo mipsnet_info = {
-    .name          = "mipsnet",
+    .name          = TYPE_MIPS_NET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MIPSnetState),
     .class_init    = mipsnet_class_init,
diff --git a/hw/net/ne2000-isa.c b/hw/net/ne2000-isa.c
index e3c8076..26b83ce 100644
--- a/hw/net/ne2000-isa.c
+++ b/hw/net/ne2000-isa.c
@@ -98,6 +98,7 @@
 
     dc->realize = isa_ne2000_realizefn;
     dc->props = ne2000_isa_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo ne2000_isa_info = {
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 8d43fd9..31afd28 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -772,6 +772,7 @@
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
     dc->vmsd = &vmstate_pci_ne2000;
     dc->props = ne2000_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo ne2000_info = {
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index 4637557..4118d54 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -267,8 +267,12 @@
 
 #define DEFAULT_PHY 1
 
+#define TYPE_OPEN_ETH "open_eth"
+#define OPEN_ETH(obj) OBJECT_CHECK(OpenEthState, (obj), TYPE_OPEN_ETH)
+
 typedef struct OpenEthState {
-    SysBusDevice dev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     MemoryRegion reg_io;
@@ -677,28 +681,30 @@
     .write = open_eth_desc_write,
 };
 
-static int sysbus_open_eth_init(SysBusDevice *dev)
+static int sysbus_open_eth_init(SysBusDevice *sbd)
 {
-    OpenEthState *s = DO_UPCAST(OpenEthState, dev, dev);
+    DeviceState *dev = DEVICE(sbd);
+    OpenEthState *s = OPEN_ETH(dev);
 
     memory_region_init_io(&s->reg_io, OBJECT(dev), &open_eth_reg_ops, s,
             "open_eth.regs", 0x54);
-    sysbus_init_mmio(dev, &s->reg_io);
+    sysbus_init_mmio(sbd, &s->reg_io);
 
     memory_region_init_io(&s->desc_io, OBJECT(dev), &open_eth_desc_ops, s,
             "open_eth.desc", 0x400);
-    sysbus_init_mmio(dev, &s->desc_io);
+    sysbus_init_mmio(sbd, &s->desc_io);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->nic = qemu_new_nic(&net_open_eth_info, &s->conf,
-                          object_get_typename(OBJECT(s)), s->dev.qdev.id, s);
+                          object_get_typename(OBJECT(s)), dev->id, s);
     return 0;
 }
 
 static void qdev_open_eth_reset(DeviceState *dev)
 {
-    OpenEthState *d = DO_UPCAST(OpenEthState, dev.qdev, dev);
+    OpenEthState *d = OPEN_ETH(dev);
+
     open_eth_reset(d);
 }
 
@@ -713,13 +719,14 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = sysbus_open_eth_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "Opencores 10/100 Mbit Ethernet";
     dc->reset = qdev_open_eth_reset;
     dc->props = open_eth_properties;
 }
 
 static const TypeInfo open_eth_info = {
-    .name          = "open_eth",
+    .name          = TYPE_OPEN_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OpenEthState),
     .class_init    = open_eth_class_init,
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index 6ef28f7..2c2301c 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -366,6 +366,7 @@
     dc->reset = pci_reset;
     dc->vmsd = &vmstate_pci_pcnet;
     dc->props = pcnet_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo pcnet_info = {
diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index b606d2b..63aa73a 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -861,6 +861,8 @@
 
     s->csr[0] |= 0x0101;
     s->csr[0] &= ~0x0004;       /* clear STOP bit */
+
+    qemu_flush_queued_packets(qemu_get_queue(s->nic));
 }
 
 static void pcnet_start(PCNetState *s)
@@ -878,6 +880,8 @@
     s->csr[0] &= ~0x0004;       /* clear STOP bit */
     s->csr[0] |= 0x0002;
     pcnet_poll_timer(s);
+
+    qemu_flush_queued_packets(qemu_get_queue(s->nic));
 }
 
 static void pcnet_stop(PCNetState *s)
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 6552034..ee3b690 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3563,6 +3563,7 @@
     dc->reset = rtl8139_reset;
     dc->vmsd = &vmstate_rtl8139;
     dc->props = rtl8139_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo rtl8139_info = {
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index c49e37a..f5963e2 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -16,8 +16,12 @@
 /* Number of 2k memory pages available.  */
 #define NUM_PACKETS 4
 
+#define TYPE_SMC91C111 "smc91c111"
+#define SMC91C111(obj) OBJECT_CHECK(smc91c111_state, (obj), TYPE_SMC91C111)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     uint16_t tcr;
@@ -254,7 +258,8 @@
 
 static void smc91c111_reset(DeviceState *dev)
 {
-    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, SYS_BUS_DEVICE(dev));
+    smc91c111_state *s = SMC91C111(dev);
+
     s->bank = 0;
     s->tx_fifo_len = 0;
     s->tx_fifo_done_len = 0;
@@ -302,8 +307,9 @@
             return;
         case 5:
             SET_HIGH(rcr, value);
-            if (s->rcr & RCR_SOFT_RST)
-                smc91c111_reset(&s->busdev.qdev);
+            if (s->rcr & RCR_SOFT_RST) {
+                smc91c111_reset(DEVICE(s));
+            }
             return;
         case 10: case 11: /* RPCR */
             /* Ignored */
@@ -744,16 +750,18 @@
     .cleanup = smc91c111_cleanup,
 };
 
-static int smc91c111_init1(SysBusDevice *dev)
+static int smc91c111_init1(SysBusDevice *sbd)
 {
-    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    smc91c111_state *s = SMC91C111(dev);
+
     memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
                           "smc91c111-mmio", 16);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     /* ??? Save/restore.  */
     return 0;
@@ -776,7 +784,7 @@
 }
 
 static const TypeInfo smc91c111_info = {
-    .name          = "smc91c111",
+    .name          = TYPE_SMC91C111,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(smc91c111_state),
     .class_init    = smc91c111_class_init,
@@ -795,7 +803,7 @@
     SysBusDevice *s;
 
     qemu_check_nic_model(nd, "smc91c111");
-    dev = qdev_create(NULL, "smc91c111");
+    dev = qdev_create(NULL, TYPE_SMC91C111);
     qdev_set_nic_properties(dev, nd);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 03a09f2..4ff0411 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -38,9 +38,9 @@
 /*#define DEBUG*/
 
 #ifdef DEBUG
-#define dprintf(fmt...) do { fprintf(stderr, fmt); } while (0)
+#define DPRINTF(fmt...) do { fprintf(stderr, fmt); } while (0)
 #else
-#define dprintf(fmt...)
+#define DPRINTF(fmt...)
 #endif
 
 /*
@@ -81,9 +81,9 @@
     VIOsPAPRDevice sdev;
     NICConf nicconf;
     NICState *nic;
-    int isopen;
+    bool isopen;
     target_ulong buf_list;
-    int add_buf_ptr, use_buf_ptr, rx_bufs;
+    uint32_t add_buf_ptr, use_buf_ptr, rx_bufs;
     target_ulong rxq_ptr;
 } VIOsPAPRVLANDevice;
 
@@ -105,7 +105,7 @@
     uint64_t handle;
     uint8_t control;
 
-    dprintf("spapr_vlan_receive() [%s] rx_bufs=%d\n", sdev->qdev.id,
+    DPRINTF("spapr_vlan_receive() [%s] rx_bufs=%d\n", sdev->qdev.id,
             dev->rx_bufs);
 
     if (!dev->isopen) {
@@ -123,7 +123,7 @@
         }
 
         bd = vio_ldq(sdev, dev->buf_list + buf_ptr);
-        dprintf("use_buf_ptr=%d bd=0x%016llx\n",
+        DPRINTF("use_buf_ptr=%d bd=0x%016llx\n",
                 buf_ptr, (unsigned long long)bd);
     } while ((!(bd & VLAN_BD_VALID) || (VLAN_BD_LEN(bd) < (size + 8)))
              && (buf_ptr != dev->use_buf_ptr));
@@ -138,14 +138,14 @@
     dev->use_buf_ptr = buf_ptr;
     vio_stq(sdev, dev->buf_list + dev->use_buf_ptr, 0);
 
-    dprintf("Found buffer: ptr=%d num=%d\n", dev->use_buf_ptr, dev->rx_bufs);
+    DPRINTF("Found buffer: ptr=%d num=%d\n", dev->use_buf_ptr, dev->rx_bufs);
 
     /* Transfer the packet data */
     if (spapr_vio_dma_write(sdev, VLAN_BD_ADDR(bd) + 8, buf, size) < 0) {
         return -1;
     }
 
-    dprintf("spapr_vlan_receive: DMA write completed\n");
+    DPRINTF("spapr_vlan_receive: DMA write completed\n");
 
     /* Update the receive queue */
     control = VLAN_RXQC_TOGGLE | VLAN_RXQC_VALID;
@@ -159,7 +159,7 @@
     vio_sth(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr + 2, 8);
     vio_stb(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr, control);
 
-    dprintf("wrote rxq entry (ptr=0x%llx): 0x%016llx 0x%016llx\n",
+    DPRINTF("wrote rxq entry (ptr=0x%llx): 0x%016llx 0x%016llx\n",
             (unsigned long long)dev->rxq_ptr,
             (unsigned long long)vio_ldq(sdev, VLAN_BD_ADDR(rxq_bd) +
                                         dev->rxq_ptr),
@@ -374,7 +374,7 @@
     VIOsPAPRVLANDevice *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
     vlan_bd_t bd;
 
-    dprintf("H_ADD_LOGICAL_LAN_BUFFER(0x" TARGET_FMT_lx
+    DPRINTF("H_ADD_LOGICAL_LAN_BUFFER(0x" TARGET_FMT_lx
             ", 0x" TARGET_FMT_lx ")\n", reg, buf);
 
     if (!sdev) {
@@ -405,7 +405,7 @@
 
     dev->rx_bufs++;
 
-    dprintf("h_add_logical_lan_buffer():  Added buf  ptr=%d  rx_bufs=%d"
+    DPRINTF("h_add_logical_lan_buffer():  Added buf  ptr=%d  rx_bufs=%d"
             " bd=0x%016llx\n", dev->add_buf_ptr, dev->rx_bufs,
             (unsigned long long)buf);
 
@@ -425,14 +425,14 @@
     int i, nbufs;
     int ret;
 
-    dprintf("H_SEND_LOGICAL_LAN(0x" TARGET_FMT_lx ", <bufs>, 0x"
+    DPRINTF("H_SEND_LOGICAL_LAN(0x" TARGET_FMT_lx ", <bufs>, 0x"
             TARGET_FMT_lx ")\n", reg, continue_token);
 
     if (!sdev) {
         return H_PARAMETER;
     }
 
-    dprintf("rxbufs = %d\n", dev->rx_bufs);
+    DPRINTF("rxbufs = %d\n", dev->rx_bufs);
 
     if (!dev->isopen) {
         return H_DROPPED;
@@ -444,7 +444,7 @@
 
     total_len = 0;
     for (i = 0; i < 6; i++) {
-        dprintf("   buf desc: 0x" TARGET_FMT_lx "\n", bufs[i]);
+        DPRINTF("   buf desc: 0x" TARGET_FMT_lx "\n", bufs[i]);
         if (!(bufs[i] & VLAN_BD_VALID)) {
             break;
         }
@@ -452,7 +452,7 @@
     }
 
     nbufs = i;
-    dprintf("h_send_logical_lan() %d buffers, total length 0x%x\n",
+    DPRINTF("h_send_logical_lan() %d buffers, total length 0x%x\n",
             nbufs, total_len);
 
     if (total_len == 0) {
@@ -500,6 +500,25 @@
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_llan = {
+    .name = "spapr_llan",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVLANDevice),
+        /* LLAN state */
+        VMSTATE_BOOL(isopen, VIOsPAPRVLANDevice),
+        VMSTATE_UINTTL(buf_list, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(add_buf_ptr, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(use_buf_ptr, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(rx_bufs, VIOsPAPRVLANDevice),
+        VMSTATE_UINTTL(rxq_ptr, VIOsPAPRVLANDevice),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vlan_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -514,6 +533,7 @@
     k->signal_mask = 0x1;
     dc->props = spapr_vlan_properties;
     k->rtce_window_size = 0x10000000;
+    dc->vmsd = &vmstate_spapr_llan;
 }
 
 static const TypeInfo spapr_vlan_info = {
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index aac7c76..9dd77f7 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -42,8 +42,13 @@
 #define SE_TCTL_CRC     0x04
 #define SE_TCTL_DUPLEX  0x08
 
+#define TYPE_STELLARIS_ENET "stellaris_enet"
+#define STELLARIS_ENET(obj) \
+    OBJECT_CHECK(stellaris_enet_state, (obj), TYPE_STELLARIS_ENET)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t ris;
     uint32_t im;
     uint32_t rctl;
@@ -386,11 +391,7 @@
 {
     stellaris_enet_state *s = qemu_get_nic_opaque(nc);
 
-    unregister_savevm(&s->busdev.qdev, "stellaris_enet", s);
-
-    memory_region_destroy(&s->mmio);
-
-    g_free(s);
+    s->nic = NULL;
 }
 
 static NetClientInfo net_stellaris_enet_info = {
@@ -401,26 +402,36 @@
     .cleanup = stellaris_enet_cleanup,
 };
 
-static int stellaris_enet_init(SysBusDevice *dev)
+static int stellaris_enet_init(SysBusDevice *sbd)
 {
-    stellaris_enet_state *s = FROM_SYSBUS(stellaris_enet_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_enet_state *s = STELLARIS_ENET(dev);
 
     memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,
                           "stellaris_enet", 0x1000);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_stellaris_enet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     stellaris_enet_reset(s);
-    register_savevm(&s->busdev.qdev, "stellaris_enet", -1, 1,
+    register_savevm(dev, "stellaris_enet", -1, 1,
                     stellaris_enet_save, stellaris_enet_load, s);
     return 0;
 }
 
+static void stellaris_enet_unrealize(DeviceState *dev, Error **errp)
+{
+    stellaris_enet_state *s = STELLARIS_ENET(dev);
+
+    unregister_savevm(DEVICE(s), "stellaris_enet", s);
+
+    memory_region_destroy(&s->mmio);
+}
+
 static Property stellaris_enet_properties[] = {
     DEFINE_NIC_PROPERTIES(stellaris_enet_state, conf),
     DEFINE_PROP_END_OF_LIST(),
@@ -432,11 +443,12 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = stellaris_enet_init;
+    dc->unrealize = stellaris_enet_unrealize;
     dc->props = stellaris_enet_properties;
 }
 
 static const TypeInfo stellaris_enet_info = {
-    .name          = "stellaris_enet",
+    .name          = TYPE_STELLARIS_ENET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_enet_state),
     .class_init    = stellaris_enet_class_init,
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 679f50c..aa1880c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1638,6 +1638,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_net_device_exit;
     dc->props = virtio_net_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     vdc->init = virtio_net_device_init;
     vdc->get_config = virtio_net_get_config;
     vdc->set_config = virtio_net_set_config;
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 0f3c58c..49c2466 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2453,6 +2453,7 @@
     dc->reset = vmxnet3_qdev_reset;
     dc->vmsd = &vmstate_vmxnet3;
     dc->props = vmxnet3_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo vmxnet3_info = {
diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index 997a5b5..9384fa0 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -135,8 +135,12 @@
     uint64_t rx_mcast;
 } RxTxStats;
 
+#define TYPE_XGMAC "xgmac"
+#define XGMAC(obj) OBJECT_CHECK(XgmacState, (obj), TYPE_XGMAC)
+
 typedef struct XgmacState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq sbd_irq;
     qemu_irq pmt_irq;
@@ -173,14 +177,14 @@
     }
 };
 
-static void xgmac_read_desc(struct XgmacState *s, struct desc *d, int rx)
+static void xgmac_read_desc(XgmacState *s, struct desc *d, int rx)
 {
     uint32_t addr = rx ? s->regs[DMA_CUR_RX_DESC_ADDR] :
         s->regs[DMA_CUR_TX_DESC_ADDR];
     cpu_physical_memory_read(addr, d, sizeof(*d));
 }
 
-static void xgmac_write_desc(struct XgmacState *s, struct desc *d, int rx)
+static void xgmac_write_desc(XgmacState *s, struct desc *d, int rx)
 {
     int reg = rx ? DMA_CUR_RX_DESC_ADDR : DMA_CUR_TX_DESC_ADDR;
     uint32_t addr = s->regs[reg];
@@ -195,7 +199,7 @@
     cpu_physical_memory_write(addr, d, sizeof(*d));
 }
 
-static void xgmac_enet_send(struct XgmacState *s)
+static void xgmac_enet_send(XgmacState *s)
 {
     struct desc bd;
     int frame_size;
@@ -246,7 +250,7 @@
     }
 }
 
-static void enet_update_irq(struct XgmacState *s)
+static void enet_update_irq(XgmacState *s)
 {
     int stat = s->regs[DMA_STATUS] & s->regs[DMA_INTR_ENA];
     qemu_set_irq(s->sbd_irq, !!stat);
@@ -254,7 +258,7 @@
 
 static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
 {
-    struct XgmacState *s = opaque;
+    XgmacState *s = opaque;
     uint64_t r = 0;
     addr >>= 2;
 
@@ -274,7 +278,7 @@
 static void enet_write(void *opaque, hwaddr addr,
                        uint64_t value, unsigned size)
 {
-    struct XgmacState *s = opaque;
+    XgmacState *s = opaque;
 
     addr >>= 2;
     switch (addr) {
@@ -310,7 +314,7 @@
 
 static int eth_can_rx(NetClientState *nc)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
 
     /* RX enabled?  */
     return s->regs[DMA_CONTROL] & DMA_CONTROL_SR;
@@ -318,7 +322,7 @@
 
 static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
     static const unsigned char sa_bcast[6] = {0xff, 0xff, 0xff,
                                               0xff, 0xff, 0xff};
     int unicast, broadcast, multicast;
@@ -366,7 +370,8 @@
 
 static void eth_cleanup(NetClientState *nc)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
+
     s->nic = NULL;
 }
 
@@ -378,20 +383,21 @@
     .cleanup = eth_cleanup,
 };
 
-static int xgmac_enet_init(SysBusDevice *dev)
+static int xgmac_enet_init(SysBusDevice *sbd)
 {
-    struct XgmacState *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    XgmacState *s = XGMAC(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
                           "xgmac", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->sbd_irq);
-    sysbus_init_irq(dev, &s->pmt_irq);
-    sysbus_init_irq(dev, &s->mci_irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->sbd_irq);
+    sysbus_init_irq(sbd, &s->pmt_irq);
+    sysbus_init_irq(sbd, &s->mci_irq);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_xgmac_enet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     s->regs[XGMAC_ADDR_HIGH(0)] = (s->conf.macaddr.a[5] << 8) |
@@ -405,7 +411,7 @@
 }
 
 static Property xgmac_properties[] = {
-    DEFINE_NIC_PROPERTIES(struct XgmacState, conf),
+    DEFINE_NIC_PROPERTIES(XgmacState, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -420,9 +426,9 @@
 }
 
 static const TypeInfo xgmac_enet_info = {
-    .name          = "xgmac",
+    .name          = TYPE_XGMAC,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct XgmacState),
+    .instance_size = sizeof(XgmacState),
     .class_init    = xgmac_enet_class_init,
 };
 
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 2afc91a..3a2a6c2 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -47,9 +47,14 @@
 #define CTRL_P     0x2
 #define CTRL_S     0x1
 
+#define TYPE_XILINX_ETHLITE "xlnx.xps-ethernetlite"
+#define XILINX_ETHLITE(obj) \
+    OBJECT_CHECK(struct xlx_ethlite, (obj), TYPE_XILINX_ETHLITE)
+
 struct xlx_ethlite
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     NICState *nic;
@@ -214,20 +219,21 @@
     .cleanup = eth_cleanup,
 };
 
-static int xilinx_ethlite_init(SysBusDevice *dev)
+static int xilinx_ethlite_init(SysBusDevice *sbd)
 {
-    struct xlx_ethlite *s = FROM_SYSBUS(typeof (*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct xlx_ethlite *s = XILINX_ETHLITE(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->rxbuf = 0;
 
     memory_region_init_io(&s->mmio, OBJECT(s), &eth_ops, s,
                           "xlnx.xps-ethernetlite", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_xilinx_ethlite_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     return 0;
 }
@@ -249,7 +255,7 @@
 }
 
 static const TypeInfo xilinx_ethlite_info = {
-    .name          = "xlnx.xps-ethernetlite",
+    .name          = TYPE_XILINX_ETHLITE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct xlx_ethlite),
     .class_init    = xilinx_ethlite_class_init,
diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index fa218ce..f9a700b 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -26,7 +26,6 @@
 #include "trace.h"
 
 typedef struct {
-    DeviceState qdev;
     MemoryRegion iomem;
     uint32_t chip_size;
     char *filename;
@@ -105,14 +104,19 @@
     }
 };
 
+#define TYPE_DS1225Y "ds1225y"
+#define DS1225Y(obj) OBJECT_CHECK(SysBusNvRamState, (obj), TYPE_DS1225Y)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NvRamState nvram;
 } SysBusNvRamState;
 
 static int nvram_sysbus_initfn(SysBusDevice *dev)
 {
-    NvRamState *s = &FROM_SYSBUS(SysBusNvRamState, dev)->nvram;
+    SysBusNvRamState *sys = DS1225Y(dev);
+    NvRamState *s = &sys->nvram;
     FILE *file;
 
     s->contents = g_malloc0(s->chip_size);
@@ -152,7 +156,7 @@
 }
 
 static const TypeInfo nvram_sysbus_info = {
-    .name          = "ds1225y",
+    .name          = TYPE_DS1225Y,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusNvRamState),
     .class_init    = nvram_sysbus_class_init,
diff --git a/hw/pci-bridge/dec.c b/hw/pci-bridge/dec.c
index efc07c4..e5e3be8 100644
--- a/hw/pci-bridge/dec.c
+++ b/hw/pci-bridge/dec.c
@@ -74,7 +74,7 @@
 
 static const TypeInfo dec_21154_pci_bridge_info = {
     .name          = "dec-21154-p2p-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridge),
     .class_init    = dec_21154_pci_bridge_class_init,
 };
@@ -86,7 +86,7 @@
 
     dev = pci_create_multifunction(parent_bus, devfn, false,
                                    "dec-21154-p2p-bridge");
-    br = DO_UPCAST(PCIBridge, dev, dev);
+    br = PCI_BRIDGE(dev);
     pci_bridge_map_irq(br, "DEC 21154 PCI-PCI bridge", dec_map_irq);
     qdev_init_nofail(&dev->qdev);
     return pci_bridge_get_sec_bus(br);
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index b98bfb0..8a5e426 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -52,7 +52,9 @@
 #define I82801ba_SSVID_SSID     0
 
 typedef struct I82801b11Bridge {
-    PCIBridge br;
+    /*< private >*/
+    PCIBridge parent_obj;
+    /*< public >*/
 } I82801b11Bridge;
 
 static int i82801b11_bridge_initfn(PCIDevice *d)
@@ -81,17 +83,19 @@
 static void i82801b11_bridge_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     k->is_bridge = 1;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82801BA_11;
     k->revision = ICH9_D2P_A2_REVISION;
     k->init = i82801b11_bridge_initfn;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo i82801b11_bridge_info = {
     .name          = "i82801b11-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(I82801b11Bridge),
     .class_init    = i82801b11_bridge_class_init,
 };
@@ -107,8 +111,8 @@
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
-    qdev = &br->dev.qdev;
+    br = PCI_BRIDGE(d);
+    qdev = DEVICE(d);
 
     snprintf(buf, sizeof(buf), "pci.%d", sec_bus);
     pci_bridge_map_irq(br, buf, pci_swizzle_map_irq_fn);
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bb541eb..0f7f209 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -92,9 +92,8 @@
 
 static int ioh3420_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIEPort *p = PCIE_PORT(d);
+    PCIESlot *s = PCIE_SLOT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -148,9 +147,7 @@
 
 static void ioh3420_exitfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIESlot *s = PCIE_SLOT(d);
 
     pcie_aer_exit(d);
     pcie_chassis_del_slot(s);
@@ -171,16 +168,16 @@
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_prop_set_uint8(qdev, "chassis", chassis);
     qdev_prop_set_uint16(qdev, "slot", slot);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIESlot, port, DO_UPCAST(PCIEPort, br, br));
+    return PCIE_SLOT(d);
 }
 
 static const VMStateDescription vmstate_ioh3420 = {
@@ -190,23 +187,13 @@
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.dev, PCIESlot),
-        VMSTATE_STRUCT(port.br.dev.exp.aer_log, PCIESlot, 0,
-                       vmstate_pcie_aer_log, PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(parent_obj.parent_obj.parent_obj.exp.aer_log,
+                       PCIESlot, 0, vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property ioh3420_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIESlot, port.port, 0),
-    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
-    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-    port.br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void ioh3420_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -220,16 +207,15 @@
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_IOH_EPORT;
     k->revision = PCI_DEVICE_ID_IOH_REV;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Intel IOH device id 3420 PCIE Root Port";
     dc->reset = ioh3420_reset;
     dc->vmsd = &vmstate_ioh3420;
-    dc->props = ioh3420_properties;
 }
 
 static const TypeInfo ioh3420_info = {
     .name          = "ioh3420",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIESlot),
+    .parent        = TYPE_PCIE_SLOT,
     .class_init    = ioh3420_class_init,
 };
 
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 5f11323..a9392c7 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -27,8 +27,15 @@
 #include "exec/memory.h"
 #include "hw/pci/pci_bus.h"
 
+#define TYPE_PCI_BRIDGE_DEV "pci-bridge"
+#define PCI_BRIDGE_DEV(obj) \
+    OBJECT_CHECK(PCIBridgeDev, (obj), TYPE_PCI_BRIDGE_DEV)
+
 struct PCIBridgeDev {
-    PCIBridge bridge;
+    /*< private >*/
+    PCIBridge parent_obj;
+    /*< public >*/
+
     MemoryRegion bar;
     uint8_t chassis_nr;
 #define PCI_BRIDGE_DEV_F_MSI_REQ 0
@@ -38,8 +45,8 @@
 
 static int pci_bridge_dev_initfn(PCIDevice *dev)
 {
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
-    PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
+    PCIBridge *br = PCI_BRIDGE(dev);
+    PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
     int err;
 
     err = pci_bridge_initfn(dev, TYPE_PCI_BUS);
@@ -81,8 +88,7 @@
 
 static void pci_bridge_dev_exitfn(PCIDevice *dev)
 {
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
-    PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
+    PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
     if (msi_present(dev)) {
         msi_uninit(dev);
     }
@@ -104,7 +110,7 @@
 
 static void qdev_pci_bridge_dev_reset(DeviceState *qdev)
 {
-    PCIDevice *dev = DO_UPCAST(PCIDevice, qdev, qdev);
+    PCIDevice *dev = PCI_DEVICE(qdev);
 
     pci_bridge_reset(qdev);
     shpc_reset(dev);
@@ -120,8 +126,8 @@
 static const VMStateDescription pci_bridge_dev_vmstate = {
     .name = "pci_bridge",
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(bridge.dev, PCIBridgeDev),
-        SHPC_VMSTATE(bridge.dev.shpc, PCIBridgeDev),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIBridge),
+        SHPC_VMSTATE(shpc, PCIDevice),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -141,11 +147,12 @@
     dc->reset = qdev_pci_bridge_dev_reset;
     dc->props = pci_bridge_dev_properties;
     dc->vmsd = &pci_bridge_dev_vmstate;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo pci_bridge_dev_info = {
-    .name = "pci-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .name          = TYPE_PCI_BRIDGE_DEV,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridgeDev),
     .class_init = pci_bridge_dev_class_init,
 };
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 1810dd2..94f9781 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -56,9 +56,8 @@
 
 static int xio3130_downstream_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIEPort *p = PCIE_PORT(d);
+    PCIESlot *s = PCIE_SLOT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -113,9 +112,7 @@
 
 static void xio3130_downstream_exitfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIESlot *s = PCIE_SLOT(d);
 
     pcie_aer_exit(d);
     pcie_chassis_del_slot(s);
@@ -138,16 +135,16 @@
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_prop_set_uint8(qdev, "chassis", chassis);
     qdev_prop_set_uint16(qdev, "slot", slot);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIESlot, port, DO_UPCAST(PCIEPort, br, br));
+    return PCIE_SLOT(d);
 }
 
 static const VMStateDescription vmstate_xio3130_downstream = {
@@ -157,23 +154,13 @@
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.dev, PCIESlot),
-        VMSTATE_STRUCT(port.br.dev.exp.aer_log, PCIESlot, 0,
-                       vmstate_pcie_aer_log, PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(parent_obj.parent_obj.parent_obj.exp.aer_log,
+                       PCIESlot, 0, vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property xio3130_downstream_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIESlot, port.port, 0),
-    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
-    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-    port.br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -187,16 +174,15 @@
     k->vendor_id = PCI_VENDOR_ID_TI;
     k->device_id = PCI_DEVICE_ID_TI_XIO3130D;
     k->revision = XIO3130_REVISION;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "TI X3130 Downstream Port of PCI Express Switch";
     dc->reset = xio3130_downstream_reset;
     dc->vmsd = &vmstate_xio3130_downstream;
-    dc->props = xio3130_downstream_properties;
 }
 
 static const TypeInfo xio3130_downstream_info = {
     .name          = "xio3130-downstream",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIESlot),
+    .parent        = TYPE_PCIE_SLOT,
     .class_init    = xio3130_downstream_class_init,
 };
 
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 8e0d97a..59f97f6 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -53,8 +53,7 @@
 
 static int xio3130_upstream_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
+    PCIEPort *p = PCIE_PORT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -118,14 +117,14 @@
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIEPort, br, br);
+    return PCIE_PORT(d);
 }
 
 static const VMStateDescription vmstate_xio3130_upstream = {
@@ -134,20 +133,13 @@
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(br.dev, PCIEPort),
-        VMSTATE_STRUCT(br.dev.exp.aer_log, PCIEPort, 0, vmstate_pcie_aer_log,
-                       PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj, PCIEPort),
+        VMSTATE_STRUCT(parent_obj.parent_obj.exp.aer_log, PCIEPort, 0,
+                       vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property xio3130_upstream_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIEPort, br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -161,16 +153,15 @@
     k->vendor_id = PCI_VENDOR_ID_TI;
     k->device_id = PCI_DEVICE_ID_TI_XIO3130U;
     k->revision = XIO3130_REVISION;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "TI X3130 Upstream Port of PCI Express Switch";
     dc->reset = xio3130_upstream_reset;
     dc->vmsd = &vmstate_xio3130_upstream;
-    dc->props = xio3130_upstream_properties;
 }
 
 static const TypeInfo xio3130_upstream_info = {
     .name          = "x3130-upstream",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIEPort),
+    .parent        = TYPE_PCIE_PORT,
     .class_init    = xio3130_upstream_class_init,
 };
 
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 3756ce9..92f289f 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -423,7 +423,7 @@
     /* APB secondary busses */
     pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 0), true,
                                    "pbm-bridge");
-    br = DO_UPCAST(PCIBridge, dev, pci_dev);
+    br = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 1",
                        pci_apb_map_irq);
     qdev_init_nofail(&pci_dev->qdev);
@@ -431,7 +431,7 @@
 
     pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 1), true,
                                    "pbm-bridge");
-    br = DO_UPCAST(PCIBridge, dev, pci_dev);
+    br = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 2",
                        pci_apb_map_irq);
     qdev_init_nofail(&pci_dev->qdev);
@@ -536,6 +536,7 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pci_pbm_init_device;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = pci_pbm_reset;
 }
 
@@ -558,14 +559,14 @@
     k->revision = 0x11;
     k->config_write = pci_bridge_write_config;
     k->is_bridge = 1;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = pci_bridge_reset;
     dc->vmsd = &vmstate_pci_device;
 }
 
 static const TypeInfo pbm_pci_bridge_info = {
     .name          = "pbm-bridge",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIBridge),
+    .parent        = TYPE_PCI_BRIDGE,
     .class_init    = pbm_pci_bridge_class_init,
 };
 
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 3908860..dc1718f 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -32,14 +32,22 @@
 #include "hw/xen/xen.h"
 #include "hw/pci-host/pam.h"
 #include "sysemu/sysemu.h"
+#include "hw/i386/ioapic.h"
+#include "qapi/visitor.h"
 
 /*
  * I440FX chipset data sheet.
  * http://download.intel.com/design/chipsets/datashts/29054901.pdf
  */
 
+#define TYPE_I440FX_PCI_HOST_BRIDGE "i440FX-pcihost"
+#define I440FX_PCI_HOST_BRIDGE(obj) \
+    OBJECT_CHECK(I440FXState, (obj), TYPE_I440FX_PCI_HOST_BRIDGE)
+
 typedef struct I440FXState {
     PCIHostState parent_obj;
+    PcPciInfo pci_info;
+    uint64_t pci_hole64_size;
 } I440FXState;
 
 #define PIIX_NUM_PIC_IRQS       16      /* i8259 * 2 */
@@ -203,14 +211,71 @@
     }
 };
 
+static void i440fx_pcihost_get_pci_hole_start(Object *obj, Visitor *v,
+                                              void *opaque, const char *name,
+                                              Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+    uint32_t value = s->pci_info.w32.begin;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole_end(Object *obj, Visitor *v,
+                                            void *opaque, const char *name,
+                                            Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+    uint32_t value = s->pci_info.w32.end;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole64_start(Object *obj, Visitor *v,
+                                                void *opaque, const char *name,
+                                                Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+
+    visit_type_uint64(v, &s->pci_info.w64.begin, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v,
+                                              void *opaque, const char *name,
+                                              Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+
+    visit_type_uint64(v, &s->pci_info.w64.end, name, errp);
+}
+
 static void i440fx_pcihost_initfn(Object *obj)
 {
     PCIHostState *s = PCI_HOST_BRIDGE(obj);
+    I440FXState *d = I440FX_PCI_HOST_BRIDGE(obj);
 
     memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
     memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s,
                           "pci-conf-data", 4);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "int",
+                        i440fx_pcihost_get_pci_hole_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "int",
+                        i440fx_pcihost_get_pci_hole_end,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "int",
+                        i440fx_pcihost_get_pci_hole64_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "int",
+                        i440fx_pcihost_get_pci_hole64_end,
+                        NULL, NULL, NULL, NULL);
+
+    d->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
 }
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
@@ -235,19 +300,17 @@
     return 0;
 }
 
-static PCIBus *i440fx_common_init(const char *device_name,
-                                  PCII440FXState **pi440fx_state,
-                                  int *piix3_devfn,
-                                  ISABus **isa_bus, qemu_irq *pic,
-                                  MemoryRegion *address_space_mem,
-                                  MemoryRegion *address_space_io,
-                                  ram_addr_t ram_size,
-                                  hwaddr pci_hole_start,
-                                  hwaddr pci_hole_size,
-                                  hwaddr pci_hole64_start,
-                                  hwaddr pci_hole64_size,
-                                  MemoryRegion *pci_address_space,
-                                  MemoryRegion *ram_memory)
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
+                    int *piix3_devfn,
+                    ISABus **isa_bus, qemu_irq *pic,
+                    MemoryRegion *address_space_mem,
+                    MemoryRegion *address_space_io,
+                    ram_addr_t ram_size,
+                    hwaddr pci_hole_start,
+                    hwaddr pci_hole_size,
+                    ram_addr_t above_4g_mem_size,
+                    MemoryRegion *pci_address_space,
+                    MemoryRegion *ram_memory)
 {
     DeviceState *dev;
     PCIBus *b;
@@ -256,8 +319,9 @@
     PIIX3State *piix3;
     PCII440FXState *f;
     unsigned i;
+    I440FXState *i440fx;
 
-    dev = qdev_create(NULL, "i440FX-pcihost");
+    dev = qdev_create(NULL, TYPE_I440FX_PCI_HOST_BRIDGE);
     s = PCI_HOST_BRIDGE(dev);
     b = pci_bus_new(dev, NULL, pci_address_space,
                     address_space_io, 0, TYPE_PCI_BUS);
@@ -265,20 +329,37 @@
     object_property_add_child(qdev_get_machine(), "i440fx", OBJECT(dev), NULL);
     qdev_init_nofail(dev);
 
-    d = pci_create_simple(b, 0, device_name);
+    d = pci_create_simple(b, 0, TYPE_I440FX_PCI_DEVICE);
     *pi440fx_state = I440FX_PCI_DEVICE(d);
     f = *pi440fx_state;
     f->system_memory = address_space_mem;
     f->pci_address_space = pci_address_space;
     f->ram_memory = ram_memory;
+
+    i440fx = I440FX_PCI_HOST_BRIDGE(dev);
+    /* Set PCI window size the way seabios has always done it. */
+    /* Power of 2 so bios can cover it with a single MTRR */
+    if (ram_size <= 0x80000000) {
+        i440fx->pci_info.w32.begin = 0x80000000;
+    } else if (ram_size <= 0xc0000000) {
+        i440fx->pci_info.w32.begin = 0xc0000000;
+    } else {
+        i440fx->pci_info.w32.begin = 0xe0000000;
+    }
+
     memory_region_init_alias(&f->pci_hole, OBJECT(d), "pci-hole", f->pci_address_space,
                              pci_hole_start, pci_hole_size);
     memory_region_add_subregion(f->system_memory, pci_hole_start, &f->pci_hole);
+
+    pc_init_pci64_hole(&i440fx->pci_info, 0x100000000ULL + above_4g_mem_size,
+                       i440fx->pci_hole64_size);
     memory_region_init_alias(&f->pci_hole_64bit, OBJECT(d), "pci-hole64",
                              f->pci_address_space,
-                             pci_hole64_start, pci_hole64_size);
-    if (pci_hole64_size) {
-        memory_region_add_subregion(f->system_memory, pci_hole64_start,
+                             i440fx->pci_info.w64.begin,
+                             i440fx->pci_hole64_size);
+    if (i440fx->pci_hole64_size) {
+        memory_region_add_subregion(f->system_memory,
+                                    i440fx->pci_info.w64.begin,
                                     &f->pci_hole_64bit);
     }
     memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
@@ -326,29 +407,6 @@
     return b;
 }
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn,
-                    ISABus **isa_bus, qemu_irq *pic,
-                    MemoryRegion *address_space_mem,
-                    MemoryRegion *address_space_io,
-                    ram_addr_t ram_size,
-                    hwaddr pci_hole_start,
-                    hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
-                    MemoryRegion *pci_memory, MemoryRegion *ram_memory)
-
-{
-    PCIBus *b;
-
-    b = i440fx_common_init(TYPE_I440FX_PCI_DEVICE, pi440fx_state,
-                           piix3_devfn, isa_bus, pic,
-                           address_space_mem, address_space_io, ram_size,
-                           pci_hole_start, pci_hole_size,
-                           pci_hole64_start, pci_hole64_size,
-                           pci_memory, ram_memory);
-    return b;
-}
-
 /* PIIX3 PCI to ISA bridge */
 static void piix3_set_irq_pic(PIIX3State *piix3, int pic_irq)
 {
@@ -649,6 +707,12 @@
     return "0000";
 }
 
+static Property i440fx_props[] = {
+    DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, I440FXState,
+                     pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -658,10 +722,11 @@
     dc->realize = i440fx_pcihost_realize;
     dc->fw_name = "pci";
     dc->no_user = 1;
+    dc->props = i440fx_props;
 }
 
 static const TypeInfo i440fx_pcihost_info = {
-    .name          = "i440FX-pcihost",
+    .name          = TYPE_I440FX_PCI_HOST_BRIDGE,
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(I440FXState),
     .instance_init = i440fx_pcihost_initfn,
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 646204e..f00793d 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -407,6 +407,7 @@
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = e500_pcihost_initfn;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = pcihost_properties;
     dc->vmsd = &vmstate_ppce500_pci;
 }
diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index b41d564..e120058 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -119,6 +119,8 @@
     MemoryRegion *address_space_mem = get_system_memory();
     int i;
 
+    isa_mem_base = 0xc0000000;
+
     for (i = 0; i < 4; i++) {
         sysbus_init_irq(dev, &s->irq[i]);
     }
@@ -210,6 +212,7 @@
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->realize = raven_pcihost_realizefn;
     dc->fw_name = "pci";
     dc->no_user = 1;
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 6b1b3b7..12314d8 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
  */
 #include "hw/hw.h"
 #include "hw/pci-host/q35.h"
+#include "qapi/visitor.h"
 
 /****************************************************************************
  * Q35 host
@@ -64,9 +65,49 @@
     return "0000";
 }
 
+static void q35_host_get_pci_hole_start(Object *obj, Visitor *v,
+                                        void *opaque, const char *name,
+                                        Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    uint32_t value = s->mch.pci_info.w32.begin;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void q35_host_get_pci_hole_end(Object *obj, Visitor *v,
+                                      void *opaque, const char *name,
+                                      Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    uint32_t value = s->mch.pci_info.w32.end;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void q35_host_get_pci_hole64_start(Object *obj, Visitor *v,
+                                          void *opaque, const char *name,
+                                          Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+
+    visit_type_uint64(v, &s->mch.pci_info.w64.begin, name, errp);
+}
+
+static void q35_host_get_pci_hole64_end(Object *obj, Visitor *v,
+                                        void *opaque, const char *name,
+                                        Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+
+    visit_type_uint64(v, &s->mch.pci_info.w64.end, name, errp);
+}
+
 static Property mch_props[] = {
     DEFINE_PROP_UINT64("MCFG", Q35PCIHost, parent_obj.base_addr,
                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
+    DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, Q35PCIHost,
+                     mch.pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -78,6 +119,7 @@
     hc->root_bus_path = q35_host_root_bus_path;
     dc->realize = q35_host_realize;
     dc->props = mch_props;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->fw_name = "pci";
 }
 
@@ -95,6 +137,31 @@
     object_property_add_child(OBJECT(s), "mch", OBJECT(&s->mch), NULL);
     qdev_prop_set_uint32(DEVICE(&s->mch), "addr", PCI_DEVFN(0, 0));
     qdev_prop_set_bit(DEVICE(&s->mch), "multifunction", false);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "int",
+                        q35_host_get_pci_hole_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "int",
+                        q35_host_get_pci_hole_end,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "int",
+                        q35_host_get_pci_hole64_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "int",
+                        q35_host_get_pci_hole64_end,
+                        NULL, NULL, NULL, NULL);
+
+    /* Leave enough space for the biggest MCFG BAR */
+    /* TODO: this matches current bios behaviour, but
+     * it's not a power of two, which means an MTRR
+     * can't cover it exactly.
+     */
+    s->mch.pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
+        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
+    s->mch.pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
 }
 
 static const TypeInfo q35_host_info = {
@@ -252,17 +319,8 @@
 static int mch_init(PCIDevice *d)
 {
     int i;
-    hwaddr pci_hole64_size;
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
-    /* Leave enough space for the biggest MCFG BAR */
-    /* TODO: this matches current bios behaviour, but
-     * it's not a power of two, which means an MTRR
-     * can't cover it exactly.
-     */
-    mch->guest_info->pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
-        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
-
     /* setup pci memory regions */
     memory_region_init_alias(&mch->pci_hole, OBJECT(mch), "pci-hole",
                              mch->pci_address_space,
@@ -270,15 +328,16 @@
                              0x100000000ULL - mch->below_4g_mem_size);
     memory_region_add_subregion(mch->system_memory, mch->below_4g_mem_size,
                                 &mch->pci_hole);
-    pci_hole64_size = (sizeof(hwaddr) == 4 ? 0 :
-                       ((uint64_t)1 << 62));
+
+    pc_init_pci64_hole(&mch->pci_info, 0x100000000ULL + mch->above_4g_mem_size,
+                       mch->pci_hole64_size);
     memory_region_init_alias(&mch->pci_hole_64bit, OBJECT(mch), "pci-hole64",
                              mch->pci_address_space,
-                             0x100000000ULL + mch->above_4g_mem_size,
-                             pci_hole64_size);
-    if (pci_hole64_size) {
+                             mch->pci_info.w64.begin,
+                             mch->pci_hole64_size);
+    if (mch->pci_hole64_size) {
         memory_region_add_subregion(mch->system_memory,
-                                    0x100000000ULL + mch->above_4g_mem_size,
+                                    mch->pci_info.w64.begin,
                                     &mch->pci_hole_64bit);
     }
     /* smram */
@@ -306,6 +365,7 @@
     k->init = mch_init;
     k->config_write = mch_write_config;
     dc->reset = mch_reset;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Host bridge";
     dc->vmsd = &vmstate_mch;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 81cf5a9..4c004f5 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -397,7 +397,7 @@
 
     pci_update_mappings(s);
     if (pc->is_bridge) {
-        PCIBridge *b = container_of(s, PCIBridge, dev);
+        PCIBridge *b = PCI_BRIDGE(s);
         pci_bridge_update_mappings(b);
     }
 
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 02a396b..a90671d 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -141,8 +141,9 @@
                                   MemoryRegion *parent_space,
                                   bool enabled)
 {
-    pcibus_t base = pci_bridge_get_base(&bridge->dev, type);
-    pcibus_t limit = pci_bridge_get_limit(&bridge->dev, type);
+    PCIDevice *bridge_dev = PCI_DEVICE(bridge);
+    pcibus_t base = pci_bridge_get_base(bridge_dev, type);
+    pcibus_t limit = pci_bridge_get_limit(bridge_dev, type);
     /* TODO: this doesn't handle base = 0 limit = 2^64 - 1 correctly.
      * Apparently no way to do this with existing memory APIs. */
     pcibus_t size = enabled && limit >= base ? limit + 1 - base : 0;
@@ -154,7 +155,8 @@
 static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
                                         MemoryRegion *alias_vga)
 {
-    uint16_t brctl = pci_get_word(br->dev.config + PCI_BRIDGE_CONTROL);
+    PCIDevice *pd = PCI_DEVICE(br);
+    uint16_t brctl = pci_get_word(pd->config + PCI_BRIDGE_CONTROL);
 
     memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO], OBJECT(br),
                              "pci_bridge_vga_io_lo", &br->address_space_io,
@@ -167,7 +169,7 @@
                              QEMU_PCI_VGA_MEM_BASE, QEMU_PCI_VGA_MEM_SIZE);
 
     if (brctl & PCI_BRIDGE_CTL_VGA) {
-        pci_register_vga(&br->dev, &alias_vga[QEMU_PCI_VGA_MEM],
+        pci_register_vga(pd, &alias_vga[QEMU_PCI_VGA_MEM],
                          &alias_vga[QEMU_PCI_VGA_IO_LO],
                          &alias_vga[QEMU_PCI_VGA_IO_HI]);
     }
@@ -175,9 +177,10 @@
 
 static PCIBridgeWindows *pci_bridge_region_init(PCIBridge *br)
 {
-    PCIBus *parent = br->dev.bus;
+    PCIDevice *pd = PCI_DEVICE(br);
+    PCIBus *parent = pd->bus;
     PCIBridgeWindows *w = g_new(PCIBridgeWindows, 1);
-    uint16_t cmd = pci_get_word(br->dev.config + PCI_COMMAND);
+    uint16_t cmd = pci_get_word(pd->config + PCI_COMMAND);
 
     pci_bridge_init_alias(br, &w->alias_pref_mem,
                           PCI_BASE_ADDRESS_MEM_PREFETCH,
@@ -205,12 +208,13 @@
 
 static void pci_bridge_region_del(PCIBridge *br, PCIBridgeWindows *w)
 {
-    PCIBus *parent = br->dev.bus;
+    PCIDevice *pd = PCI_DEVICE(br);
+    PCIBus *parent = pd->bus;
 
     memory_region_del_subregion(parent->address_space_io, &w->alias_io);
     memory_region_del_subregion(parent->address_space_mem, &w->alias_mem);
     memory_region_del_subregion(parent->address_space_mem, &w->alias_pref_mem);
-    pci_unregister_vga(&br->dev);
+    pci_unregister_vga(pd);
 }
 
 static void pci_bridge_region_cleanup(PCIBridge *br, PCIBridgeWindows *w)
@@ -241,7 +245,7 @@
 void pci_bridge_write_config(PCIDevice *d,
                              uint32_t address, uint32_t val, int len)
 {
-    PCIBridge *s = container_of(d, PCIBridge, dev);
+    PCIBridge *s = PCI_BRIDGE(d);
     uint16_t oldctl = pci_get_word(d->config + PCI_BRIDGE_CONTROL);
     uint16_t newctl;
 
@@ -331,7 +335,7 @@
 int pci_bridge_initfn(PCIDevice *dev, const char *typename)
 {
     PCIBus *parent = dev->bus;
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBus *sec_bus = &br->sec_bus;
 
     pci_word_test_and_set_mask(dev->config + PCI_STATUS,
@@ -379,7 +383,7 @@
 /* default qdev clean up function for PCI-to-PCI bridge */
 void pci_bridge_exitfn(PCIDevice *pci_dev)
 {
-    PCIBridge *s = DO_UPCAST(PCIBridge, dev, pci_dev);
+    PCIBridge *s = PCI_BRIDGE(pci_dev);
     assert(QLIST_EMPTY(&s->sec_bus.child));
     QLIST_REMOVE(&s->sec_bus, sibling);
     pci_bridge_region_del(s, s->windows);
@@ -400,3 +404,17 @@
     br->map_irq = map_irq;
     br->bus_name = bus_name;
 }
+
+static const TypeInfo pci_bridge_type_info = {
+    .name = TYPE_PCI_BRIDGE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCIBridge),
+    .abstract = true,
+};
+
+static void pci_bridge_register_types(void)
+{
+    type_register_static(&pci_bridge_type_info);
+}
+
+type_init(pci_bridge_register_types)
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 62bd0b8..50af3c1 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -305,7 +305,7 @@
 
     dev->exp.hpev_notified = false;
 
-    pci_bus_hotplug(pci_bridge_get_sec_bus(DO_UPCAST(PCIBridge, dev, dev)),
+    pci_bus_hotplug(pci_bridge_get_sec_bus(PCI_BRIDGE(dev)),
                     pcie_cap_slot_hotplug, &dev->qdev);
 }
 
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index 91b53a0..2adb030 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -116,3 +116,55 @@
 {
     QLIST_REMOVE(s, next);
 }
+
+static Property pcie_port_props[] = {
+    DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
+    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
+                       parent_obj.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void pcie_port_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->props = pcie_port_props;
+}
+
+static const TypeInfo pcie_port_type_info = {
+    .name = TYPE_PCIE_PORT,
+    .parent = TYPE_PCI_BRIDGE,
+    .instance_size = sizeof(PCIEPort),
+    .abstract = true,
+    .class_init = pcie_port_class_init,
+};
+
+static Property pcie_slot_props[] = {
+    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
+    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void pcie_slot_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->props = pcie_slot_props;
+}
+
+static const TypeInfo pcie_slot_type_info = {
+    .name = TYPE_PCIE_SLOT,
+    .parent = TYPE_PCIE_PORT,
+    .instance_size = sizeof(PCIESlot),
+    .abstract = true,
+    .class_init = pcie_slot_class_init,
+};
+
+static void pcie_port_register_types(void)
+{
+    type_register_static(&pcie_port_type_info);
+    type_register_static(&pcie_slot_type_info);
+}
+
+type_init(pcie_port_register_types)
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 11b7de2..78b23fa 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -42,8 +42,12 @@
     uint64_t reserved;
 } QEMU_PACKED SpinInfo;
 
-typedef struct spin_state {
-    SysBusDevice busdev;
+#define TYPE_E500_SPIN "e500-spin"
+#define E500_SPIN(obj) OBJECT_CHECK(SpinState, (obj), TYPE_E500_SPIN)
+
+typedef struct SpinState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     SpinInfo spin[MAX_CPUS];
 } SpinState;
@@ -187,9 +191,7 @@
 
 static int ppce500_spin_initfn(SysBusDevice *dev)
 {
-    SpinState *s;
-
-    s = FROM_SYSBUS(SpinState, SYS_BUS_DEVICE(dev));
+    SpinState *s = E500_SPIN(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &spin_rw_ops, s,
                           "e500 spin pv device", sizeof(SpinInfo) * MAX_CPUS);
@@ -208,7 +210,7 @@
 }
 
 static const TypeInfo ppce500_spin_info = {
-    .name          = "e500-spin",
+    .name          = TYPE_E500_SPIN,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SpinState),
     .class_init    = ppce500_spin_class_init,
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 48ae092..16bfab9 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -32,6 +32,7 @@
 #include "sysemu/cpus.h"
 #include "sysemu/kvm.h"
 #include "kvm_ppc.h"
+#include "mmu-hash64.h"
 
 #include "hw/boards.h"
 #include "hw/ppc/ppc.h"
@@ -128,6 +129,34 @@
     return first;
 }
 
+static XICSState *try_create_xics(const char *type, int nr_servers,
+                                  int nr_irqs)
+{
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, type);
+    qdev_prop_set_uint32(dev, "nr_servers", nr_servers);
+    qdev_prop_set_uint32(dev, "nr_irqs", nr_irqs);
+    if (qdev_init(dev) < 0) {
+        return NULL;
+    }
+
+    return XICS(dev);
+}
+
+static XICSState *xics_system_init(int nr_servers, int nr_irqs)
+{
+    XICSState *icp = NULL;
+
+    icp = try_create_xics(TYPE_XICS, nr_servers, nr_irqs);
+    if (!icp) {
+        perror("Failed to create XICS\n");
+        abort();
+    }
+
+    return icp;
+}
+
 static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
 {
     int ret = 0, offset;
@@ -666,7 +695,7 @@
 
     env->spr[SPR_HIOR] = 0;
 
-    env->external_htab = spapr->htab;
+    env->external_htab = (uint8_t *)spapr->htab;
     env->htab_base = -1;
     env->htab_mask = HTAB_SIZE(spapr) - 1;
     env->spr[SPR_SDR1] = (target_ulong)(uintptr_t)spapr->htab |
@@ -710,6 +739,330 @@
     }
 }
 
+static const VMStateDescription vmstate_spapr = {
+    .name = "spapr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(next_irq, sPAPREnvironment),
+
+        /* RTC offset */
+        VMSTATE_UINT64(rtc_offset, sPAPREnvironment),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+#define HPTE(_table, _i)   (void *)(((uint64_t *)(_table)) + ((_i) * 2))
+#define HPTE_VALID(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_VALID)
+#define HPTE_DIRTY(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_HPTE_DIRTY)
+#define CLEAN_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) &= tswap64(~HPTE64_V_HPTE_DIRTY))
+
+static int htab_save_setup(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+
+    /* "Iteration" header */
+    qemu_put_be32(f, spapr->htab_shift);
+
+    if (spapr->htab) {
+        spapr->htab_save_index = 0;
+        spapr->htab_first_pass = true;
+    } else {
+        assert(kvm_enabled());
+
+        spapr->htab_fd = kvmppc_get_htab_fd(false);
+        if (spapr->htab_fd < 0) {
+            fprintf(stderr, "Unable to open fd for reading hash table from KVM: %s\n",
+                    strerror(errno));
+            return -1;
+        }
+    }
+
+
+    return 0;
+}
+
+static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                 int64_t max_ns)
+{
+    int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
+    int index = spapr->htab_save_index;
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+
+    assert(spapr->htab_first_pass);
+
+    do {
+        int chunkstart;
+
+        /* Consume invalid HPTEs */
+        while ((index < htabslots)
+               && !HPTE_VALID(HPTE(spapr->htab, index))) {
+            index++;
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+        }
+
+        /* Consume valid HPTEs */
+        chunkstart = index;
+        while ((index < htabslots)
+               && HPTE_VALID(HPTE(spapr->htab, index))) {
+            index++;
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+        }
+
+        if (index > chunkstart) {
+            int n_valid = index - chunkstart;
+
+            qemu_put_be32(f, chunkstart);
+            qemu_put_be16(f, n_valid);
+            qemu_put_be16(f, 0);
+            qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
+                            HASH_PTE_SIZE_64 * n_valid);
+
+            if ((qemu_get_clock_ns(rt_clock) - starttime) > max_ns) {
+                break;
+            }
+        }
+    } while ((index < htabslots) && !qemu_file_rate_limit(f));
+
+    if (index >= htabslots) {
+        assert(index == htabslots);
+        index = 0;
+        spapr->htab_first_pass = false;
+    }
+    spapr->htab_save_index = index;
+}
+
+static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                int64_t max_ns)
+{
+    bool final = max_ns < 0;
+    int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
+    int examined = 0, sent = 0;
+    int index = spapr->htab_save_index;
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+
+    assert(!spapr->htab_first_pass);
+
+    do {
+        int chunkstart, invalidstart;
+
+        /* Consume non-dirty HPTEs */
+        while ((index < htabslots)
+               && !HPTE_DIRTY(HPTE(spapr->htab, index))) {
+            index++;
+            examined++;
+        }
+
+        chunkstart = index;
+        /* Consume valid dirty HPTEs */
+        while ((index < htabslots)
+               && HPTE_DIRTY(HPTE(spapr->htab, index))
+               && HPTE_VALID(HPTE(spapr->htab, index))) {
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+            index++;
+            examined++;
+        }
+
+        invalidstart = index;
+        /* Consume invalid dirty HPTEs */
+        while ((index < htabslots)
+               && HPTE_DIRTY(HPTE(spapr->htab, index))
+               && !HPTE_VALID(HPTE(spapr->htab, index))) {
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+            index++;
+            examined++;
+        }
+
+        if (index > chunkstart) {
+            int n_valid = invalidstart - chunkstart;
+            int n_invalid = index - invalidstart;
+
+            qemu_put_be32(f, chunkstart);
+            qemu_put_be16(f, n_valid);
+            qemu_put_be16(f, n_invalid);
+            qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
+                            HASH_PTE_SIZE_64 * n_valid);
+            sent += index - chunkstart;
+
+            if (!final && (qemu_get_clock_ns(rt_clock) - starttime) > max_ns) {
+                break;
+            }
+        }
+
+        if (examined >= htabslots) {
+            break;
+        }
+
+        if (index >= htabslots) {
+            assert(index == htabslots);
+            index = 0;
+        }
+    } while ((examined < htabslots) && (!qemu_file_rate_limit(f) || final));
+
+    if (index >= htabslots) {
+        assert(index == htabslots);
+        index = 0;
+    }
+
+    spapr->htab_save_index = index;
+
+    return (examined >= htabslots) && (sent == 0) ? 1 : 0;
+}
+
+#define MAX_ITERATION_NS    5000000 /* 5 ms */
+#define MAX_KVM_BUF_SIZE    2048
+
+static int htab_save_iterate(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+    int rc = 0;
+
+    /* Iteration header */
+    qemu_put_be32(f, 0);
+
+    if (!spapr->htab) {
+        assert(kvm_enabled());
+
+        rc = kvmppc_save_htab(f, spapr->htab_fd,
+                              MAX_KVM_BUF_SIZE, MAX_ITERATION_NS);
+        if (rc < 0) {
+            return rc;
+        }
+    } else  if (spapr->htab_first_pass) {
+        htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
+    } else {
+        rc = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
+    }
+
+    /* End marker */
+    qemu_put_be32(f, 0);
+    qemu_put_be16(f, 0);
+    qemu_put_be16(f, 0);
+
+    return rc;
+}
+
+static int htab_save_complete(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+
+    /* Iteration header */
+    qemu_put_be32(f, 0);
+
+    if (!spapr->htab) {
+        int rc;
+
+        assert(kvm_enabled());
+
+        rc = kvmppc_save_htab(f, spapr->htab_fd, MAX_KVM_BUF_SIZE, -1);
+        if (rc < 0) {
+            return rc;
+        }
+        close(spapr->htab_fd);
+        spapr->htab_fd = -1;
+    } else {
+        htab_save_later_pass(f, spapr, -1);
+    }
+
+    /* End marker */
+    qemu_put_be32(f, 0);
+    qemu_put_be16(f, 0);
+    qemu_put_be16(f, 0);
+
+    return 0;
+}
+
+static int htab_load(QEMUFile *f, void *opaque, int version_id)
+{
+    sPAPREnvironment *spapr = opaque;
+    uint32_t section_hdr;
+    int fd = -1;
+
+    if (version_id < 1 || version_id > 1) {
+        fprintf(stderr, "htab_load() bad version\n");
+        return -EINVAL;
+    }
+
+    section_hdr = qemu_get_be32(f);
+
+    if (section_hdr) {
+        /* First section, just the hash shift */
+        if (spapr->htab_shift != section_hdr) {
+            return -EINVAL;
+        }
+        return 0;
+    }
+
+    if (!spapr->htab) {
+        assert(kvm_enabled());
+
+        fd = kvmppc_get_htab_fd(true);
+        if (fd < 0) {
+            fprintf(stderr, "Unable to open fd to restore KVM hash table: %s\n",
+                    strerror(errno));
+        }
+    }
+
+    while (true) {
+        uint32_t index;
+        uint16_t n_valid, n_invalid;
+
+        index = qemu_get_be32(f);
+        n_valid = qemu_get_be16(f);
+        n_invalid = qemu_get_be16(f);
+
+        if ((index == 0) && (n_valid == 0) && (n_invalid == 0)) {
+            /* End of Stream */
+            break;
+        }
+
+        if ((index + n_valid + n_invalid) >
+            (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
+            /* Bad index in stream */
+            fprintf(stderr, "htab_load() bad index %d (%hd+%hd entries) "
+                    "in htab stream (htab_shift=%d)\n", index, n_valid, n_invalid,
+                    spapr->htab_shift);
+            return -EINVAL;
+        }
+
+        if (spapr->htab) {
+            if (n_valid) {
+                qemu_get_buffer(f, HPTE(spapr->htab, index),
+                                HASH_PTE_SIZE_64 * n_valid);
+            }
+            if (n_invalid) {
+                memset(HPTE(spapr->htab, index + n_valid), 0,
+                       HASH_PTE_SIZE_64 * n_invalid);
+            }
+        } else {
+            int rc;
+
+            assert(fd >= 0);
+
+            rc = kvmppc_load_htab_chunk(f, fd, index, n_valid, n_invalid);
+            if (rc < 0) {
+                return rc;
+            }
+        }
+    }
+
+    if (!spapr->htab) {
+        assert(fd >= 0);
+        close(fd);
+    }
+
+    return 0;
+}
+
+static SaveVMHandlers savevm_htab_handlers = {
+    .save_live_setup = htab_save_setup,
+    .save_live_iterate = htab_save_iterate,
+    .save_live_complete = htab_save_complete,
+    .load_state = htab_load,
+};
+
 /* pSeries LPAR / sPAPR hardware init */
 static void ppc_spapr_init(QEMUMachineInitArgs *args)
 {
@@ -848,9 +1201,6 @@
     /* Set up EPOW events infrastructure */
     spapr_events_init(spapr);
 
-    /* Set up IOMMU */
-    spapr_iommu_init();
-
     /* Set up VIO bus */
     spapr->vio_bus = spapr_vio_bus_init();
 
@@ -953,6 +1303,10 @@
 
     spapr->entry_point = 0x100;
 
+    vmstate_register(NULL, 0, &vmstate_spapr, spapr);
+    register_savevm_live(NULL, "spapr/htab", -1, 1,
+                         &savevm_htab_handlers, spapr);
+
     /* Prepare the device tree */
     spapr->fdt_skel = spapr_create_fdt_skel(cpu_model,
                                             initrd_base, initrd_size,
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index ed32dec..67d6cd9 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -115,7 +115,7 @@
     }
     ppc_hash64_store_hpte1(env, hpte, ptel);
     /* eieio();  FIXME: need some sort of barrier for smp? */
-    ppc_hash64_store_hpte0(env, hpte, pteh);
+    ppc_hash64_store_hpte0(env, hpte, pteh | HPTE64_V_HPTE_DIRTY);
 
     args[0] = pte_index + i;
     return H_SUCCESS;
@@ -152,7 +152,7 @@
     }
     *vp = v;
     *rp = r;
-    ppc_hash64_store_hpte0(env, hpte, 0);
+    ppc_hash64_store_hpte0(env, hpte, HPTE64_V_HPTE_DIRTY);
     rb = compute_tlbie_rb(v, r, ptex);
     ppc_tlb_invalidate_one(env, rb);
     return REMOVE_SUCCESS;
@@ -282,11 +282,11 @@
     r |= (flags << 48) & HPTE64_R_KEY_HI;
     r |= flags & (HPTE64_R_PP | HPTE64_R_N | HPTE64_R_KEY_LO);
     rb = compute_tlbie_rb(v, r, pte_index);
-    ppc_hash64_store_hpte0(env, hpte, v & ~HPTE64_V_VALID);
+    ppc_hash64_store_hpte0(env, hpte, (v & ~HPTE64_V_VALID) | HPTE64_V_HPTE_DIRTY);
     ppc_tlb_invalidate_one(env, rb);
     ppc_hash64_store_hpte1(env, hpte, r);
     /* Don't need a memory barrier, due to qemu's global lock */
-    ppc_hash64_store_hpte0(env, hpte, v);
+    ppc_hash64_store_hpte0(env, hpte, v | HPTE64_V_HPTE_DIRTY);
     return H_SUCCESS;
 }
 
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 89b33a5..3d4a1fc 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -36,17 +36,6 @@
     SPAPR_TCE_RW = 3,
 };
 
-struct sPAPRTCETable {
-    uint32_t liobn;
-    uint32_t window_size;
-    sPAPRTCE *table;
-    bool bypass;
-    int fd;
-    MemoryRegion iommu;
-    QLIST_ENTRY(sPAPRTCETable) list;
-};
-
-
 QLIST_HEAD(spapr_tce_tables, sPAPRTCETable) spapr_tce_tables;
 
 static sPAPRTCETable *spapr_tce_find_by_liobn(uint32_t liobn)
@@ -96,7 +85,7 @@
         return (IOMMUTLBEntry) { .perm = IOMMU_NONE };
     }
 
-    tce = tcet->table[addr >> SPAPR_TCE_PAGE_SHIFT].tce;
+    tce = tcet->table[addr >> SPAPR_TCE_PAGE_SHIFT];
 
 #ifdef DEBUG_TCE
     fprintf(stderr, " ->  *paddr=0x%llx, *len=0x%llx\n",
@@ -112,10 +101,68 @@
     };
 }
 
+static int spapr_tce_table_pre_load(void *opaque)
+{
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(opaque);
+
+    tcet->nb_table = tcet->window_size >> SPAPR_TCE_PAGE_SHIFT;
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_spapr_tce_table = {
+    .name = "spapr_iommu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .pre_load = spapr_tce_table_pre_load,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(liobn, sPAPRTCETable),
+        VMSTATE_UINT32_EQUAL(window_size, sPAPRTCETable),
+
+        /* IOMMU state */
+        VMSTATE_BOOL(bypass, sPAPRTCETable),
+        VMSTATE_VARRAY_UINT32(table, sPAPRTCETable, nb_table, 0, vmstate_info_uint64, uint64_t),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static MemoryRegionIOMMUOps spapr_iommu_ops = {
     .translate = spapr_tce_translate_iommu,
 };
 
+static int spapr_tce_table_realize(DeviceState *dev)
+{
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);
+
+    if (kvm_enabled()) {
+        tcet->table = kvmppc_create_spapr_tce(tcet->liobn,
+                                              tcet->window_size,
+                                              &tcet->fd);
+    }
+
+    if (!tcet->table) {
+        size_t table_size = (tcet->window_size >> SPAPR_TCE_PAGE_SHIFT)
+            * sizeof(uint64_t);
+        tcet->table = g_malloc0(table_size);
+    }
+    tcet->nb_table = tcet->window_size >> SPAPR_TCE_PAGE_SHIFT;
+
+#ifdef DEBUG_TCE
+    fprintf(stderr, "spapr_iommu: New TCE table @ %p, liobn=0x%x, "
+            "table @ %p, fd=%d\n", tcet, liobn, tcet->table, tcet->fd);
+#endif
+
+    memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
+                             "iommu-spapr", UINT64_MAX);
+
+    QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
+
+    return 0;
+}
+
 sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, size_t window_size)
 {
     sPAPRTCETable *tcet;
@@ -130,37 +177,21 @@
         return NULL;
     }
 
-    tcet = g_malloc0(sizeof(*tcet));
+    tcet = SPAPR_TCE_TABLE(object_new(TYPE_SPAPR_TCE_TABLE));
     tcet->liobn = liobn;
     tcet->window_size = window_size;
 
-    if (kvm_enabled()) {
-        tcet->table = kvmppc_create_spapr_tce(liobn,
-                                              window_size,
-                                              &tcet->fd);
-    }
+    object_property_add_child(OBJECT(owner), "tce-table", OBJECT(tcet), NULL);
 
-    if (!tcet->table) {
-        size_t table_size = (window_size >> SPAPR_TCE_PAGE_SHIFT)
-            * sizeof(sPAPRTCE);
-        tcet->table = g_malloc0(table_size);
-    }
-
-#ifdef DEBUG_TCE
-    fprintf(stderr, "spapr_iommu: New TCE table @ %p, liobn=0x%x, "
-            "table @ %p, fd=%d\n", tcet, liobn, tcet->table, tcet->fd);
-#endif
-
-    memory_region_init_iommu(&tcet->iommu, OBJECT(owner), &spapr_iommu_ops,
-                             "iommu-spapr", UINT64_MAX);
-
-    QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
+    qdev_init_nofail(DEVICE(tcet));
 
     return tcet;
 }
 
-void spapr_tce_free(sPAPRTCETable *tcet)
+static void spapr_tce_table_finalize(Object *obj)
 {
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(obj);
+
     QLIST_REMOVE(tcet, list);
 
     if (!kvm_enabled() ||
@@ -168,8 +199,6 @@
                                  tcet->window_size) != 0)) {
         g_free(tcet->table);
     }
-
-    g_free(tcet);
 }
 
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet)
@@ -182,10 +211,11 @@
     tcet->bypass = bypass;
 }
 
-void spapr_tce_reset(sPAPRTCETable *tcet)
+static void spapr_tce_reset(DeviceState *dev)
 {
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);
     size_t table_size = (tcet->window_size >> SPAPR_TCE_PAGE_SHIFT)
-        * sizeof(sPAPRTCE);
+        * sizeof(uint64_t);
 
     tcet->bypass = false;
     memset(tcet->table, 0, table_size);
@@ -194,7 +224,6 @@
 static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,
                                 target_ulong tce)
 {
-    sPAPRTCE *tcep;
     IOMMUTLBEntry entry;
 
     if (ioba >= tcet->window_size) {
@@ -203,8 +232,7 @@
         return H_PARAMETER;
     }
 
-    tcep = tcet->table + (ioba >> SPAPR_TCE_PAGE_SHIFT);
-    tcep->tce = tce;
+    tcet->table[ioba >> SPAPR_TCE_PAGE_SHIFT] = tce;
 
     entry.target_as = &address_space_memory,
     entry.iova = ioba & ~SPAPR_TCE_PAGE_MASK;
@@ -238,14 +266,6 @@
     return H_PARAMETER;
 }
 
-void spapr_iommu_init(void)
-{
-    QLIST_INIT(&spapr_tce_tables);
-
-    /* hcall-tce */
-    spapr_register_hypercall(H_PUT_TCE, h_put_tce);
-}
-
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
                  uint32_t liobn, uint64_t window, uint32_t size)
 {
@@ -286,3 +306,31 @@
     return spapr_dma_dt(fdt, node_off, propname,
                         tcet->liobn, 0, tcet->window_size);
 }
+
+static void spapr_tce_table_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    dc->vmsd = &vmstate_spapr_tce_table;
+    dc->init = spapr_tce_table_realize;
+    dc->reset = spapr_tce_reset;
+
+    QLIST_INIT(&spapr_tce_tables);
+
+    /* hcall-tce */
+    spapr_register_hypercall(H_PUT_TCE, h_put_tce);
+}
+
+static TypeInfo spapr_tce_table_info = {
+    .name = TYPE_SPAPR_TCE_TABLE,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(sPAPRTCETable),
+    .class_init = spapr_tce_table_class_init,
+    .instance_finalize = spapr_tce_table_finalize,
+};
+
+static void register_types(void)
+{
+    type_register_static(&spapr_tce_table_info);
+}
+
+type_init(register_types);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c880a75..1ca35a0 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -479,6 +479,7 @@
 
 static int spapr_phb_init(SysBusDevice *s)
 {
+    DeviceState *dev = DEVICE(s);
     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
     const char *busname;
@@ -596,14 +597,14 @@
      * since it's unique by construction, and makes the guest visible
      * BUID clear.
      */
-    if (s->qdev.id) {
+    if (dev->id) {
         busname = NULL;
     } else if (sphb->index == 0) {
         busname = "pci";
     } else {
         busname = sphb->dtbusname;
     }
-    bus = pci_register_bus(DEVICE(s), busname,
+    bus = pci_register_bus(dev, busname,
                            pci_spapr_set_irq, pci_spapr_map_irq, sphb,
                            &sphb->memspace, &sphb->iospace,
                            PCI_DEVFN(0, 0), PCI_NUM_PINS, TYPE_PCI_BUS);
@@ -611,7 +612,7 @@
 
     sphb->dma_window_start = 0;
     sphb->dma_window_size = 0x40000000;
-    sphb->tcet = spapr_tce_new_table(DEVICE(sphb), sphb->dma_liobn,
+    sphb->tcet = spapr_tce_new_table(dev, sphb->dma_liobn,
                                      sphb->dma_window_size);
     if (!sphb->tcet) {
         fprintf(stderr, "Unable to create TCE table for %s\n", sphb->dtbusname);
@@ -645,7 +646,7 @@
     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
 
     /* Reset the IOMMU state */
-    spapr_tce_reset(sphb->tcet);
+    device_reset(DEVICE(sphb->tcet));
 }
 
 static Property spapr_phb_properties[] = {
@@ -662,6 +663,54 @@
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_pci_lsi = {
+    .name = "spapr_pci/lsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32_EQUAL(irq, struct spapr_pci_lsi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_spapr_pci_msi = {
+    .name = "spapr_pci/lsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(config_addr, struct spapr_pci_msi),
+        VMSTATE_UINT32(irq, struct spapr_pci_msi),
+        VMSTATE_UINT32(nvec, struct spapr_pci_msi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_spapr_pci = {
+    .name = "spapr_pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64_EQUAL(buid, sPAPRPHBState),
+        VMSTATE_UINT32_EQUAL(dma_liobn, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(mem_win_addr, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(mem_win_size, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(io_win_addr, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(io_win_size, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(msi_win_addr, sPAPRPHBState),
+        VMSTATE_STRUCT_ARRAY(lsi_table, sPAPRPHBState, PCI_NUM_PINS, 0,
+                             vmstate_spapr_pci_lsi, struct spapr_pci_lsi),
+        VMSTATE_STRUCT_ARRAY(msi_table, sPAPRPHBState, SPAPR_MSIX_MAX_DEVS, 0,
+                             vmstate_spapr_pci_msi, struct spapr_pci_msi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const char *spapr_phb_root_bus_path(PCIHostState *host_bridge,
                                            PCIBus *rootbus)
 {
@@ -680,6 +729,7 @@
     sdc->init = spapr_phb_init;
     dc->props = spapr_phb_properties;
     dc->reset = spapr_phb_reset;
+    dc->vmsd = &vmstate_spapr_pci;
 }
 
 static const TypeInfo spapr_phb_info = {
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 7c6f6e4..a6a0a51 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -39,10 +39,10 @@
 /* #define DEBUG_SPAPR */
 
 #ifdef DEBUG_SPAPR
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -201,7 +201,7 @@
     dev->crq.qsize = queue_len;
     dev->crq.qnext = 0;
 
-    dprintf("CRQ for dev 0x" TARGET_FMT_lx " registered at 0x"
+    DPRINTF("CRQ for dev 0x" TARGET_FMT_lx " registered at 0x"
             TARGET_FMT_lx "/0x" TARGET_FMT_lx "\n",
             reg, queue_addr, queue_len);
     return H_SUCCESS;
@@ -213,7 +213,7 @@
     dev->crq.qsize = 0;
     dev->crq.qnext = 0;
 
-    dprintf("CRQ for dev 0x%" PRIx32 " freed\n", dev->reg);
+    DPRINTF("CRQ for dev 0x%" PRIx32 " freed\n", dev->reg);
 
     return H_SUCCESS;
 }
@@ -316,7 +316,7 @@
 static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)
 {
     if (dev->tcet) {
-        spapr_tce_reset(dev->tcet);
+        device_reset(DEVICE(dev->tcet));
     }
     free_crq(dev);
 }
@@ -542,6 +542,26 @@
     .class_init    = spapr_vio_bridge_class_init,
 };
 
+const VMStateDescription vmstate_spapr_vio = {
+    .name = "spapr_vio",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(reg, VIOsPAPRDevice),
+        VMSTATE_UINT32_EQUAL(irq, VIOsPAPRDevice),
+
+        /* General VIO device state */
+        VMSTATE_UINTTL(signal_state, VIOsPAPRDevice),
+        VMSTATE_UINT64(crq.qladdr, VIOsPAPRDevice),
+        VMSTATE_UINT32(crq.qsize, VIOsPAPRDevice),
+        VMSTATE_UINT32(crq.qnext, VIOsPAPRDevice),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void vio_spapr_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index 207eb82..f0aa941 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -38,10 +38,10 @@
 /* #define DEBUG_S390 */
 
 #ifdef DEBUG_S390
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
diff --git a/hw/s390x/s390-virtio.c b/hw/s390x/s390-virtio.c
index edbde00..439d732 100644
--- a/hw/s390x/s390-virtio.c
+++ b/hw/s390x/s390-virtio.c
@@ -41,10 +41,10 @@
 //#define DEBUG_S390
 
 #ifdef DEBUG_S390
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 2ac21d4..d7ec173 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -392,6 +392,7 @@
     k->device_id = PCI_DEVICE_ID_AMD_SCSI;
     k->revision = 0x10;
     k->class_id = PCI_CLASS_STORAGE_SCSI;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "AMD Am53c974 PCscsi-PCI SCSI adapter";
     dc->reset = esp_pci_hard_reset;
     dc->vmsd = &vmstate_esp_pci_scsi;
@@ -512,6 +513,7 @@
     k->init = dc390_scsi_init;
     k->config_read = dc390_read_config;
     k->config_write = dc390_write_config;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "Tekram DC-390 SCSI adapter";
 }
 
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 94639b8..101e957 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -720,6 +720,7 @@
     dc->realize = sysbus_esp_realize;
     dc->reset = sysbus_esp_hard_reset;
     dc->vmsd = &vmstate_sysbus_esp_scsi;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_esp_info = {
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 776e31a..611f2aa 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2141,6 +2141,7 @@
     k->subsystem_id = 0x1000;
     dc->reset = lsi_scsi_reset;
     dc->vmsd = &vmstate_lsi_scsi;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo lsi_info = {
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index eb52164..a6d5285 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2213,6 +2213,7 @@
     dc->props = megasas_properties;
     dc->reset = megasas_scsi_reset;
     dc->vmsd = &vmstate_megasas;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "LSI MegaRAID SAS 1078";
 }
 
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index b5a863a..fbf9173 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -1881,6 +1881,7 @@
 static void scsi_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
+    set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
     k->bus_type = TYPE_SCSI_BUS;
     k->init     = scsi_qdev_init;
     k->unplug   = scsi_qdev_unplug;
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 55b44b9..e9090e5 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -45,10 +45,10 @@
 /*#define DEBUG_VSCSI*/
 
 #ifdef DEBUG_VSCSI
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -75,20 +75,19 @@
     /* SCSI request tracking */
     SCSIRequest             *sreq;
     uint32_t                qtag; /* qemu tag != srp tag */
-    int                     lun;
-    int                     active;
-    long                    data_len;
-    int                     writing;
-    int                     senselen;
+    bool                    active;
+    uint32_t                data_len;
+    bool                    writing;
+    uint32_t                senselen;
     uint8_t                 sense[SCSI_SENSE_BUF_SIZE];
 
     /* RDMA related bits */
     uint8_t                 dma_fmt;
-    struct srp_direct_buf   ext_desc;
-    struct srp_direct_buf   *cur_desc;
-    struct srp_indirect_buf *ind_desc;
-    int                     local_desc;
-    int                     total_desc;
+    uint16_t                local_desc;
+    uint16_t                total_desc;
+    uint16_t                cdb_offset;
+    uint16_t                cur_desc_num;
+    uint16_t                cur_desc_offset;
 } vscsi_req;
 
 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi"
@@ -217,8 +216,9 @@
     union viosrp_iu *iu = &req->iu;
     uint64_t tag = iu->srp.rsp.tag;
     int total_len = sizeof(iu->srp.rsp);
+    uint8_t sol_not = iu->srp.cmd.sol_not;
 
-    dprintf("VSCSI: Sending resp status: 0x%x, "
+    DPRINTF("VSCSI: Sending resp status: 0x%x, "
             "res_in: %d, res_out: %d\n", status, res_in, res_out);
 
     memset(iu, 0, sizeof(struct srp_rsp));
@@ -249,7 +249,7 @@
     /* Handle success vs. failure */
     iu->srp.rsp.status = status;
     if (status) {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x04) >> 2;
+        iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2;
         if (req->senselen) {
             req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID;
             req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen);
@@ -257,114 +257,167 @@
             total_len += req->senselen;
         }
     } else {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x02) >> 1;
+        iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1;
     }
 
     vscsi_send_iu(s, req, total_len, VIOSRP_SRP_FORMAT);
     return 0;
 }
 
-static inline void vscsi_swap_desc(struct srp_direct_buf *desc)
+static inline struct srp_direct_buf vscsi_swap_desc(struct srp_direct_buf desc)
 {
-    desc->va = be64_to_cpu(desc->va);
-    desc->len = be32_to_cpu(desc->len);
+    desc.va = be64_to_cpu(desc.va);
+    desc.len = be32_to_cpu(desc.len);
+    return desc;
+}
+
+static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
+                            unsigned n, unsigned buf_offset,
+                            struct srp_direct_buf *ret)
+{
+    struct srp_cmd *cmd = &req->iu.srp.cmd;
+
+    switch (req->dma_fmt) {
+    case SRP_NO_DATA_DESC: {
+        DPRINTF("VSCSI: no data descriptor\n");
+        return 0;
+    }
+    case SRP_DATA_DESC_DIRECT: {
+        memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret));
+        assert(req->cur_desc_num == 0);
+        DPRINTF("VSCSI: direct segment\n");
+        break;
+    }
+    case SRP_DATA_DESC_INDIRECT: {
+        struct srp_indirect_buf *tmp = (struct srp_indirect_buf *)
+                                       (cmd->add_data + req->cdb_offset);
+        if (n < req->local_desc) {
+            *ret = tmp->desc_list[n];
+            DPRINTF("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
+                    req->qtag, n, req->local_desc);
+
+        } else if (n < req->total_desc) {
+            int rc;
+            struct srp_direct_buf tbl_desc = vscsi_swap_desc(tmp->table_desc);
+            unsigned desc_offset = n * sizeof(struct srp_direct_buf);
+
+            if (desc_offset >= tbl_desc.len) {
+                DPRINTF("VSCSI:   #%d is ouf of range (%d bytes)\n",
+                        n, desc_offset);
+                return -1;
+            }
+            rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset,
+                                    ret, sizeof(struct srp_direct_buf));
+            if (rc) {
+                DPRINTF("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
+                        rc);
+                return -1;
+            }
+            DPRINTF("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
+                    req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len);
+        } else {
+            DPRINTF("VSCSI:   Out of descriptors !\n");
+            return 0;
+        }
+        break;
+    }
+    default:
+        fprintf(stderr, "VSCSI:   Unknown format %x\n", req->dma_fmt);
+        return -1;
+    }
+
+    *ret = vscsi_swap_desc(*ret);
+    if (buf_offset > ret->len) {
+        DPRINTF("   offset=%x is out of a descriptor #%d boundary=%x\n",
+                buf_offset, req->cur_desc_num, ret->len);
+        return -1;
+    }
+    ret->va += buf_offset;
+    ret->len -= buf_offset;
+
+    DPRINTF("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
+            req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len);
+
+    return ret->len ? 1 : 0;
 }
 
 static int vscsi_srp_direct_data(VSCSIState *s, vscsi_req *req,
                                  uint8_t *buf, uint32_t len)
 {
-    struct srp_direct_buf *md = req->cur_desc;
+    struct srp_direct_buf md;
     uint32_t llen;
     int rc = 0;
 
-    dprintf("VSCSI: direct segment 0x%x bytes, va=0x%llx desc len=0x%x\n",
-            len, (unsigned long long)md->va, md->len);
+    rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
+    if (rc < 0) {
+        return -1;
+    } else if (rc == 0) {
+        return 0;
+    }
 
-    llen = MIN(len, md->len);
+    llen = MIN(len, md.len);
     if (llen) {
         if (req->writing) { /* writing = to device = reading from memory */
-            rc = spapr_vio_dma_read(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
         } else {
-            rc = spapr_vio_dma_write(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
     }
-    md->len -= llen;
-    md->va += llen;
 
     if (rc) {
         return -1;
     }
+    req->cur_desc_offset += llen;
+
     return llen;
 }
 
 static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
                                    uint8_t *buf, uint32_t len)
 {
-    struct srp_direct_buf *td = &req->ind_desc->table_desc;
-    struct srp_direct_buf *md = req->cur_desc;
+    struct srp_direct_buf md;
     int rc = 0;
     uint32_t llen, total = 0;
 
-    dprintf("VSCSI: indirect segment 0x%x bytes, td va=0x%llx len=0x%x\n",
-            len, (unsigned long long)td->va, td->len);
+    DPRINTF("VSCSI: indirect segment 0x%x bytes\n", len);
 
     /* While we have data ... */
     while (len) {
-        /* If we have a descriptor but it's empty, go fetch a new one */
-        if (md && md->len == 0) {
-            /* More local available, use one */
-            if (req->local_desc) {
-                md = ++req->cur_desc;
-                --req->local_desc;
-                --req->total_desc;
-                td->va += sizeof(struct srp_direct_buf);
-            } else {
-                md = req->cur_desc = NULL;
-            }
-        }
-        /* No descriptor at hand, fetch one */
-        if (!md) {
-            if (!req->total_desc) {
-                dprintf("VSCSI:   Out of descriptors !\n");
-                break;
-            }
-            md = req->cur_desc = &req->ext_desc;
-            dprintf("VSCSI:   Reading desc from 0x%llx\n",
-                    (unsigned long long)td->va);
-            rc = spapr_vio_dma_read(&s->vdev, td->va, md,
-                                    sizeof(struct srp_direct_buf));
-            if (rc) {
-                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
-                        rc);
-                break;
-            }
-            vscsi_swap_desc(md);
-            td->va += sizeof(struct srp_direct_buf);
-            --req->total_desc;
-        }
-        dprintf("VSCSI:   [desc va=0x%llx,len=0x%x] remaining=0x%x\n",
-                (unsigned long long)md->va, md->len, len);
-
-        /* Perform transfer */
-        llen = MIN(len, md->len);
-        if (req->writing) { /* writing = to device = reading from memory */
-            rc = spapr_vio_dma_read(&s->vdev, md->va, buf, llen);
-        } else {
-            rc = spapr_vio_dma_write(&s->vdev, md->va, buf, llen);
-        }
-        if (rc) {
-            dprintf("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
+        rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
+        if (rc < 0) {
+            return -1;
+        } else if (rc == 0) {
             break;
         }
-        dprintf("VSCSI:     data: %02x %02x %02x %02x...\n",
+
+        /* Perform transfer */
+        llen = MIN(len, md.len);
+        if (req->writing) { /* writing = to device = reading from memory */
+            rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
+        } else {
+            rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
+        }
+        if (rc) {
+            DPRINTF("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
+            break;
+        }
+        DPRINTF("VSCSI:     data: %02x %02x %02x %02x...\n",
                 buf[0], buf[1], buf[2], buf[3]);
 
         len -= llen;
         buf += llen;
+
         total += llen;
-        md->va += llen;
-        md->len -= llen;
+
+        /* Update current position in the current descriptor */
+        req->cur_desc_offset += llen;
+        if (md.len == llen) {
+            /* Go to the next descriptor if the current one finished */
+            ++req->cur_desc_num;
+            req->cur_desc_offset = 0;
+        }
     }
+
     return rc ? -1 : total;
 }
 
@@ -375,7 +428,7 @@
 
     switch (req->dma_fmt) {
     case SRP_NO_DATA_DESC:
-        dprintf("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
+        DPRINTF("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
         break;
     case SRP_DATA_DESC_DIRECT:
         err = vscsi_srp_direct_data(s, req, buf, len);
@@ -412,14 +465,13 @@
 static int vscsi_preprocess_desc(vscsi_req *req)
 {
     struct srp_cmd *cmd = &req->iu.srp.cmd;
-    int offset, i;
 
-    offset = cmd->add_cdb_len & ~3;
+    req->cdb_offset = cmd->add_cdb_len & ~3;
 
     if (req->writing) {
         req->dma_fmt = cmd->buf_fmt >> 4;
     } else {
-        offset += data_out_desc_size(cmd);
+        req->cdb_offset += data_out_desc_size(cmd);
         req->dma_fmt = cmd->buf_fmt & ((1U << 4) - 1);
     }
 
@@ -427,31 +479,18 @@
     case SRP_NO_DATA_DESC:
         break;
     case SRP_DATA_DESC_DIRECT:
-        req->cur_desc = (struct srp_direct_buf *)(cmd->add_data + offset);
         req->total_desc = req->local_desc = 1;
-        vscsi_swap_desc(req->cur_desc);
-        dprintf("VSCSI: using direct RDMA %s, 0x%x bytes MD: 0x%llx\n",
-                req->writing ? "write" : "read",
-                req->cur_desc->len, (unsigned long long)req->cur_desc->va);
         break;
-    case SRP_DATA_DESC_INDIRECT:
-        req->ind_desc = (struct srp_indirect_buf *)(cmd->add_data + offset);
-        vscsi_swap_desc(&req->ind_desc->table_desc);
-        req->total_desc = req->ind_desc->table_desc.len /
-            sizeof(struct srp_direct_buf);
+    case SRP_DATA_DESC_INDIRECT: {
+        struct srp_indirect_buf *ind_tmp = (struct srp_indirect_buf *)
+                (cmd->add_data + req->cdb_offset);
+
+        req->total_desc = be32_to_cpu(ind_tmp->table_desc.len) /
+                          sizeof(struct srp_direct_buf);
         req->local_desc = req->writing ? cmd->data_out_desc_cnt :
-            cmd->data_in_desc_cnt;
-        for (i = 0; i < req->local_desc; i++) {
-            vscsi_swap_desc(&req->ind_desc->desc_list[i]);
-        }
-        req->cur_desc = req->local_desc ? &req->ind_desc->desc_list[0] : NULL;
-        dprintf("VSCSI: using indirect RDMA %s, 0x%x bytes %d descs "
-                "(%d local) VA: 0x%llx\n",
-                req->writing ? "read" : "write",
-                be32_to_cpu(req->ind_desc->len),
-                req->total_desc, req->local_desc,
-                (unsigned long long)req->ind_desc->table_desc.va);
+                          cmd->data_in_desc_cnt;
         break;
+    }
     default:
         fprintf(stderr,
                 "vscsi_preprocess_desc: Unknown format %x\n", req->dma_fmt);
@@ -469,7 +508,7 @@
     uint8_t *buf;
     int rc = 0;
 
-    dprintf("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
+    DPRINTF("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
             sreq->tag, len, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
@@ -499,8 +538,8 @@
     vscsi_req *req = sreq->hba_private;
     int32_t res_in = 0, res_out = 0;
 
-    dprintf("VSCSI: SCSI cmd complete, r=0x%x tag=0x%x status=0x%x, req=%p\n",
-            reason, sreq->tag, status, req);
+    DPRINTF("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
+            sreq->tag, status, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
         return;
@@ -509,16 +548,16 @@
     if (status == CHECK_CONDITION) {
         req->senselen = scsi_req_get_sense(req->sreq, req->sense,
                                            sizeof(req->sense));
-        dprintf("VSCSI: Sense data, %d bytes:\n", len);
-        dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
+        DPRINTF("VSCSI: Sense data, %d bytes:\n", req->senselen);
+        DPRINTF("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[0], req->sense[1], req->sense[2], req->sense[3],
                 req->sense[4], req->sense[5], req->sense[6], req->sense[7]);
-        dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
+        DPRINTF("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[8], req->sense[9], req->sense[10], req->sense[11],
                 req->sense[12], req->sense[13], req->sense[14], req->sense[15]);
     }
 
-    dprintf("VSCSI: Command complete err=%d\n", status);
+    DPRINTF("VSCSI: Command complete err=%d\n", status);
     if (status == 0) {
         /* We handle overflows, not underflows for normal commands,
          * but hopefully nobody cares
@@ -540,13 +579,76 @@
     vscsi_put_req(req);
 }
 
+static const VMStateDescription vmstate_spapr_vscsi_req = {
+    .name = "spapr_vscsi_req",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_BUFFER(crq.raw, vscsi_req),
+        VMSTATE_BUFFER(iu.srp.reserved, vscsi_req),
+        VMSTATE_UINT32(qtag, vscsi_req),
+        VMSTATE_BOOL(active, vscsi_req),
+        VMSTATE_UINT32(data_len, vscsi_req),
+        VMSTATE_BOOL(writing, vscsi_req),
+        VMSTATE_UINT32(senselen, vscsi_req),
+        VMSTATE_BUFFER(sense, vscsi_req),
+        VMSTATE_UINT8(dma_fmt, vscsi_req),
+        VMSTATE_UINT16(local_desc, vscsi_req),
+        VMSTATE_UINT16(total_desc, vscsi_req),
+        VMSTATE_UINT16(cdb_offset, vscsi_req),
+      /*Restart SCSI request from the beginning for now */
+      /*VMSTATE_UINT16(cur_desc_num, vscsi_req),
+        VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
+{
+    vscsi_req *req = sreq->hba_private;
+    assert(req->active);
+
+    vmstate_save_state(f, &vmstate_spapr_vscsi_req, req);
+
+    DPRINTF("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
+            req->qtag, req->cur_desc_num, req->cur_desc_offset);
+}
+
+static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
+{
+    SCSIBus *bus = sreq->bus;
+    VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(bus->qbus.parent);
+    vscsi_req *req;
+    int rc;
+
+    assert(sreq->tag < VSCSI_REQ_LIMIT);
+    req = &s->reqs[sreq->tag];
+    assert(!req->active);
+
+    memset(req, 0, sizeof(*req));
+    rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1);
+    if (rc) {
+        fprintf(stderr, "VSCSI: failed loading request tag#%u\n", sreq->tag);
+        return NULL;
+    }
+    assert(req->active);
+
+    req->sreq = scsi_req_ref(sreq);
+
+    DPRINTF("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
+            req->qtag, req->cur_desc_num, req->cur_desc_offset);
+
+    return req;
+}
+
 static void vscsi_process_login(VSCSIState *s, vscsi_req *req)
 {
     union viosrp_iu *iu = &req->iu;
     struct srp_login_rsp *rsp = &iu->srp.login_rsp;
     uint64_t tag = iu->srp.rsp.tag;
 
-    dprintf("VSCSI: Got login, sendin response !\n");
+    DPRINTF("VSCSI: Got login, sendin response !\n");
 
     /* TODO handle case that requested size is wrong and
      * buffer format is wrong
@@ -612,7 +714,8 @@
 
     sdev = vscsi_device_find(&s->bus, be64_to_cpu(srp->cmd.lun), &lun);
     if (!sdev) {
-        dprintf("VSCSI: Command for lun %08" PRIx64 " with no drive\n", be64_to_cpu(srp->cmd.lun));
+        DPRINTF("VSCSI: Command for lun %08" PRIx64 " with no drive\n",
+                be64_to_cpu(srp->cmd.lun));
         if (srp->cmd.cdb[0] == INQUIRY) {
             vscsi_inquiry_no_target(s, req);
         } else {
@@ -621,12 +724,11 @@
         } return 1;
     }
 
-    req->lun = lun;
     req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req);
     n = scsi_req_enqueue(req->sreq);
 
-    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x ID %d LUN %d ret: %d\n",
-            req->qtag, srp->cmd.cdb[0], id, lun, n);
+    DPRINTF("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
+            req->qtag, srp->cmd.cdb[0], lun, n);
 
     if (n) {
         /* Transfer direction must be set before preprocessing the
@@ -838,7 +940,7 @@
     crq.s.IU_length = be16_to_cpu(crq.s.IU_length);
     crq.s.IU_data_ptr = be64_to_cpu(crq.s.IU_data_ptr);
 
-    dprintf("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
+    DPRINTF("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
 
     switch (crq.s.valid) {
     case 0xc0: /* Init command/response */
@@ -895,7 +997,9 @@
 
     .transfer_data = vscsi_transfer_data,
     .complete = vscsi_command_complete,
-    .cancel = vscsi_request_cancelled
+    .cancel = vscsi_request_cancelled,
+    .save_request = vscsi_save_request,
+    .load_request = vscsi_load_request,
 };
 
 static void spapr_vscsi_reset(VIOsPAPRDevice *dev)
@@ -959,6 +1063,20 @@
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_vscsi = {
+    .name = "spapr_vscsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(vdev, VSCSIState),
+        /* VSCSI state */
+        /* ???? */
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -973,6 +1091,7 @@
     k->signal_mask = 0x00000001;
     dc->props = spapr_vscsi_properties;
     k->rtce_window_size = 0x10000000;
+    dc->vmsd = &vmstate_spapr_vscsi;
 }
 
 static const TypeInfo spapr_vscsi_info = {
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 785e93f..9e770fb 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -267,6 +267,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = vhost_scsi_exit;
     dc->props = vhost_scsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = vhost_scsi_init;
     vdc->get_features = vhost_scsi_get_features;
     vdc->set_config = vhost_scsi_set_config;
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 42cb73b..05da56b 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -669,8 +669,10 @@
 static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 {
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     vdc->get_config = virtio_scsi_get_config;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static void virtio_scsi_class_init(ObjectClass *klass, void *data)
@@ -679,6 +681,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_scsi_device_exit;
     dc->props = virtio_scsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_scsi_device_init;
     vdc->set_config = virtio_scsi_set_config;
     vdc->get_features = virtio_scsi_get_features;
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index e1074e1..d42b359 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1197,6 +1197,7 @@
     dc->reset = pvscsi_reset;
     dc->vmsd = &vmstate_pvscsi;
     dc->props = pvscsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     k->config_write = pvscsi_write_config;
 }
 
diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index f69775c..42613b3 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -58,8 +58,13 @@
     R_MAX
 };
 
+#define TYPE_MILKYMIST_MEMCARD "milkymist-memcard"
+#define MILKYMIST_MEMCARD(obj) \
+    OBJECT_CHECK(MilkymistMemcardState, (obj), TYPE_MILKYMIST_MEMCARD)
+
 struct MilkymistMemcardState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     SDState *card;
 
@@ -231,8 +236,7 @@
 
 static void milkymist_memcard_reset(DeviceState *d)
 {
-    MilkymistMemcardState *s =
-            container_of(d, MilkymistMemcardState, busdev.qdev);
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(d);
     int i;
 
     s->command_write_ptr = 0;
@@ -246,7 +250,7 @@
 
 static int milkymist_memcard_init(SysBusDevice *dev)
 {
-    MilkymistMemcardState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
     DriveInfo *dinfo;
 
     dinfo = drive_get_next(IF_SD);
@@ -289,7 +293,7 @@
 }
 
 static const TypeInfo milkymist_memcard_info = {
-    .name          = "milkymist-memcard",
+    .name          = TYPE_MILKYMIST_MEMCARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMemcardState),
     .class_init    = milkymist_memcard_class_init,
diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index f5eb1e4..03875bf 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -22,8 +22,12 @@
 
 #define PL181_FIFO_LEN 16
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL181 "pl181"
+#define PL181(obj) OBJECT_CHECK(PL181State, (obj), TYPE_PL181)
+
+typedef struct PL181State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     SDState *card;
     uint32_t clock;
@@ -50,29 +54,29 @@
     qemu_irq irq[2];
     /* GPIO outputs for 'card is readonly' and 'card inserted' */
     qemu_irq cardstatus[2];
-} pl181_state;
+} PL181State;
 
 static const VMStateDescription vmstate_pl181 = {
     .name = "pl181",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(clock, pl181_state),
-        VMSTATE_UINT32(power, pl181_state),
-        VMSTATE_UINT32(cmdarg, pl181_state),
-        VMSTATE_UINT32(cmd, pl181_state),
-        VMSTATE_UINT32(datatimer, pl181_state),
-        VMSTATE_UINT32(datalength, pl181_state),
-        VMSTATE_UINT32(respcmd, pl181_state),
-        VMSTATE_UINT32_ARRAY(response, pl181_state, 4),
-        VMSTATE_UINT32(datactrl, pl181_state),
-        VMSTATE_UINT32(datacnt, pl181_state),
-        VMSTATE_UINT32(status, pl181_state),
-        VMSTATE_UINT32_ARRAY(mask, pl181_state, 2),
-        VMSTATE_INT32(fifo_pos, pl181_state),
-        VMSTATE_INT32(fifo_len, pl181_state),
-        VMSTATE_INT32(linux_hack, pl181_state),
-        VMSTATE_UINT32_ARRAY(fifo, pl181_state, PL181_FIFO_LEN),
+        VMSTATE_UINT32(clock, PL181State),
+        VMSTATE_UINT32(power, PL181State),
+        VMSTATE_UINT32(cmdarg, PL181State),
+        VMSTATE_UINT32(cmd, PL181State),
+        VMSTATE_UINT32(datatimer, PL181State),
+        VMSTATE_UINT32(datalength, PL181State),
+        VMSTATE_UINT32(respcmd, PL181State),
+        VMSTATE_UINT32_ARRAY(response, PL181State, 4),
+        VMSTATE_UINT32(datactrl, PL181State),
+        VMSTATE_UINT32(datacnt, PL181State),
+        VMSTATE_UINT32(status, PL181State),
+        VMSTATE_UINT32_ARRAY(mask, PL181State, 2),
+        VMSTATE_INT32(fifo_pos, PL181State),
+        VMSTATE_INT32(fifo_len, PL181State),
+        VMSTATE_INT32(linux_hack, PL181State),
+        VMSTATE_UINT32_ARRAY(fifo, PL181State, PL181_FIFO_LEN),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -125,7 +129,7 @@
 static const unsigned char pl181_id[] =
 { 0x81, 0x11, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl181_update(pl181_state *s)
+static void pl181_update(PL181State *s)
 {
     int i;
     for (i = 0; i < 2; i++) {
@@ -133,7 +137,7 @@
     }
 }
 
-static void pl181_fifo_push(pl181_state *s, uint32_t value)
+static void pl181_fifo_push(PL181State *s, uint32_t value)
 {
     int n;
 
@@ -147,7 +151,7 @@
     DPRINTF("FIFO push %08x\n", (int)value);
 }
 
-static uint32_t pl181_fifo_pop(pl181_state *s)
+static uint32_t pl181_fifo_pop(PL181State *s)
 {
     uint32_t value;
 
@@ -162,7 +166,7 @@
     return value;
 }
 
-static void pl181_send_command(pl181_state *s)
+static void pl181_send_command(PL181State *s)
 {
     SDRequest request;
     uint8_t response[16];
@@ -207,7 +211,7 @@
    the FIFO holding 32-bit words and the card taking data in single byte
    chunks.  FIFO bytes are transferred in little-endian order.  */
 
-static void pl181_fifo_run(pl181_state *s)
+static void pl181_fifo_run(PL181State *s)
 {
     uint32_t bits;
     uint32_t value = 0;
@@ -288,7 +292,7 @@
 static uint64_t pl181_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl181_state *s = (pl181_state *)opaque;
+    PL181State *s = (PL181State *)opaque;
     uint32_t tmp;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -372,7 +376,7 @@
 static void pl181_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl181_state *s = (pl181_state *)opaque;
+    PL181State *s = (PL181State *)opaque;
 
     switch (offset) {
     case 0x00: /* Power */
@@ -449,7 +453,7 @@
 
 static void pl181_reset(DeviceState *d)
 {
-    pl181_state *s = DO_UPCAST(pl181_state, busdev.qdev, d);
+    PL181State *s = PL181(d);
 
     s->power = 0;
     s->cmdarg = 0;
@@ -474,16 +478,17 @@
     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
 }
 
-static int pl181_init(SysBusDevice *dev)
+static int pl181_init(SysBusDevice *sbd)
 {
-    pl181_state *s = FROM_SYSBUS(pl181_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL181State *s = PL181(dev);
     DriveInfo *dinfo;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, "pl181", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq[0]);
-    sysbus_init_irq(dev, &s->irq[1]);
-    qdev_init_gpio_out(&s->busdev.qdev, s->cardstatus, 2);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq[0]);
+    sysbus_init_irq(sbd, &s->irq[1]);
+    qdev_init_gpio_out(dev, s->cardstatus, 2);
     dinfo = drive_get_next(IF_SD);
     s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     return 0;
@@ -501,9 +506,9 @@
 }
 
 static const TypeInfo pl181_info = {
-    .name          = "pl181",
+    .name          = TYPE_PL181,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl181_state),
+    .instance_size = sizeof(PL181State),
     .class_init    = pl181_class_init,
 };
 
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 5c7bd31..942ca37c 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -559,6 +559,9 @@
 }
 
 /* NCR89C100/MACIO Internal ID register */
+
+#define TYPE_MACIO_ID_REGISTER "macio_idreg"
+
 static const uint8_t idreg_data[] = { 0xfe, 0x81, 0x01, 0x03 };
 
 static void idreg_init(hwaddr addr)
@@ -566,7 +569,7 @@
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "macio_idreg");
+    dev = qdev_create(NULL, TYPE_MACIO_ID_REGISTER);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -574,14 +577,18 @@
     cpu_physical_memory_write_rom(addr, idreg_data, sizeof(idreg_data));
 }
 
+#define MACIO_ID_REGISTER(obj) \
+    OBJECT_CHECK(IDRegState, (obj), TYPE_MACIO_ID_REGISTER)
+
 typedef struct IDRegState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mem;
 } IDRegState;
 
 static int idreg_init1(SysBusDevice *dev)
 {
-    IDRegState *s = FROM_SYSBUS(IDRegState, dev);
+    IDRegState *s = MACIO_ID_REGISTER(dev);
 
     memory_region_init_ram(&s->mem, OBJECT(s),
                            "sun4m.idreg", sizeof(idreg_data));
@@ -599,14 +606,18 @@
 }
 
 static const TypeInfo idreg_info = {
-    .name          = "macio_idreg",
+    .name          = TYPE_MACIO_ID_REGISTER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IDRegState),
     .class_init    = idreg_class_init,
 };
 
+#define TYPE_TCX_AFX "tcx_afx"
+#define TCX_AFX(obj) OBJECT_CHECK(AFXState, (obj), TYPE_TCX_AFX)
+
 typedef struct AFXState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mem;
 } AFXState;
 
@@ -616,7 +627,7 @@
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "tcx_afx");
+    dev = qdev_create(NULL, TYPE_TCX_AFX);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -625,7 +636,7 @@
 
 static int afx_init1(SysBusDevice *dev)
 {
-    AFXState *s = FROM_SYSBUS(AFXState, dev);
+    AFXState *s = TCX_AFX(dev);
 
     memory_region_init_ram(&s->mem, OBJECT(s), "sun4m.afx", 4);
     vmstate_register_ram_global(&s->mem);
@@ -641,14 +652,18 @@
 }
 
 static const TypeInfo afx_info = {
-    .name          = "tcx_afx",
+    .name          = TYPE_TCX_AFX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AFXState),
     .class_init    = afx_class_init,
 };
 
+#define TYPE_OPENPROM "openprom"
+#define OPENPROM(obj) OBJECT_CHECK(PROMState, (obj), TYPE_OPENPROM)
+
 typedef struct PROMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion prom;
 } PROMState;
 
@@ -666,7 +681,7 @@
     char *filename;
     int ret;
 
-    dev = qdev_create(NULL, "openprom");
+    dev = qdev_create(NULL, TYPE_OPENPROM);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -695,7 +710,7 @@
 
 static int prom_init1(SysBusDevice *dev)
 {
-    PROMState *s = FROM_SYSBUS(PROMState, dev);
+    PROMState *s = OPENPROM(dev);
 
     memory_region_init_ram(&s->prom, OBJECT(s), "sun4m.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
@@ -718,15 +733,18 @@
 }
 
 static const TypeInfo prom_info = {
-    .name          = "openprom",
+    .name          = TYPE_OPENPROM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PROMState),
     .class_init    = prom_class_init,
 };
 
-typedef struct RamDevice
-{
-    SysBusDevice busdev;
+#define TYPE_SUN4M_MEMORY "memory"
+#define SUN4M_RAM(obj) OBJECT_CHECK(RamDevice, (obj), TYPE_SUN4M_MEMORY)
+
+typedef struct RamDevice {
+    SysBusDevice parent_obj;
+
     MemoryRegion ram;
     uint64_t size;
 } RamDevice;
@@ -734,7 +752,7 @@
 /* System RAM */
 static int ram_init1(SysBusDevice *dev)
 {
-    RamDevice *d = FROM_SYSBUS(RamDevice, dev);
+    RamDevice *d = SUN4M_RAM(dev);
 
     memory_region_init_ram(&d->ram, OBJECT(d), "sun4m.ram", d->size);
     vmstate_register_ram_global(&d->ram);
@@ -760,7 +778,7 @@
     dev = qdev_create(NULL, "memory");
     s = SYS_BUS_DEVICE(dev);
 
-    d = FROM_SYSBUS(RamDevice, s);
+    d = SUN4M_RAM(dev);
     d->size = RAM_size;
     qdev_init_nofail(dev);
 
@@ -782,7 +800,7 @@
 }
 
 static const TypeInfo ram_info = {
-    .name          = "memory",
+    .name          = TYPE_SUN4M_MEMORY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RamDevice),
     .class_init    = ram_class_init,
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 34a5e73..a7214a3 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -632,8 +632,12 @@
     .class_init    = ebus_class_init,
 };
 
+#define TYPE_OPENPROM "openprom"
+#define OPENPROM(obj) OBJECT_CHECK(PROMState, (obj), TYPE_OPENPROM)
+
 typedef struct PROMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion prom;
 } PROMState;
 
@@ -651,7 +655,7 @@
     char *filename;
     int ret;
 
-    dev = qdev_create(NULL, "openprom");
+    dev = qdev_create(NULL, TYPE_OPENPROM);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -680,7 +684,7 @@
 
 static int prom_init1(SysBusDevice *dev)
 {
-    PROMState *s = FROM_SYSBUS(PROMState, dev);
+    PROMState *s = OPENPROM(dev);
 
     memory_region_init_ram(&s->prom, OBJECT(s), "sun4u.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
@@ -703,16 +707,19 @@
 }
 
 static const TypeInfo prom_info = {
-    .name          = "openprom",
+    .name          = TYPE_OPENPROM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PROMState),
     .class_init    = prom_class_init,
 };
 
 
-typedef struct RamDevice
-{
-    SysBusDevice busdev;
+#define TYPE_SUN4U_MEMORY "memory"
+#define SUN4U_RAM(obj) OBJECT_CHECK(RamDevice, (obj), TYPE_SUN4U_MEMORY)
+
+typedef struct RamDevice {
+    SysBusDevice parent_obj;
+
     MemoryRegion ram;
     uint64_t size;
 } RamDevice;
@@ -720,7 +727,7 @@
 /* System RAM */
 static int ram_init1(SysBusDevice *dev)
 {
-    RamDevice *d = FROM_SYSBUS(RamDevice, dev);
+    RamDevice *d = SUN4U_RAM(dev);
 
     memory_region_init_ram(&d->ram, OBJECT(d), "sun4u.ram", d->size);
     vmstate_register_ram_global(&d->ram);
@@ -735,10 +742,10 @@
     RamDevice *d;
 
     /* allocate RAM */
-    dev = qdev_create(NULL, "memory");
+    dev = qdev_create(NULL, TYPE_SUN4U_MEMORY);
     s = SYS_BUS_DEVICE(dev);
 
-    d = FROM_SYSBUS(RamDevice, s);
+    d = SUN4U_RAM(dev);
     d->size = RAM_size;
     qdev_init_nofail(dev);
 
@@ -760,7 +767,7 @@
 }
 
 static const TypeInfo ram_info = {
-    .name          = "memory",
+    .name          = TYPE_SUN4U_MEMORY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RamDevice),
     .class_init    = ram_class_init,
diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index 711a0c1..fd479ef 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -39,8 +39,12 @@
 #define PL022_INT_RX  0x04
 #define PL022_INT_TX  0x08
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL022 "pl022"
+#define PL022(obj) OBJECT_CHECK(PL022State, (obj), TYPE_PL022)
+
+typedef struct PL022State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t cr0;
     uint32_t cr1;
@@ -58,12 +62,12 @@
     uint16_t rx_fifo[8];
     qemu_irq irq;
     SSIBus *ssi;
-} pl022_state;
+} PL022State;
 
 static const unsigned char pl022_id[8] =
   { 0x22, 0x10, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl022_update(pl022_state *s)
+static void pl022_update(PL022State *s)
 {
     s->sr = 0;
     if (s->tx_fifo_len == 0)
@@ -85,7 +89,7 @@
     qemu_set_irq(s->irq, (s->is & s->im) != 0);
 }
 
-static void pl022_xfer(pl022_state *s)
+static void pl022_xfer(PL022State *s)
 {
     int i;
     int o;
@@ -133,7 +137,7 @@
 static uint64_t pl022_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl022_state *s = (pl022_state *)opaque;
+    PL022State *s = (PL022State *)opaque;
     int val;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -177,7 +181,7 @@
 static void pl022_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl022_state *s = (pl022_state *)opaque;
+    PL022State *s = (PL022State *)opaque;
 
     switch (offset) {
     case 0x00: /* CR0 */
@@ -221,7 +225,7 @@
     }
 }
 
-static void pl022_reset(pl022_state *s)
+static void pl022_reset(PL022State *s)
 {
     s->rx_fifo_len = 0;
     s->tx_fifo_len = 0;
@@ -242,47 +246,48 @@
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(cr0, pl022_state),
-        VMSTATE_UINT32(cr1, pl022_state),
-        VMSTATE_UINT32(bitmask, pl022_state),
-        VMSTATE_UINT32(sr, pl022_state),
-        VMSTATE_UINT32(cpsr, pl022_state),
-        VMSTATE_UINT32(is, pl022_state),
-        VMSTATE_UINT32(im, pl022_state),
-        VMSTATE_INT32(tx_fifo_head, pl022_state),
-        VMSTATE_INT32(rx_fifo_head, pl022_state),
-        VMSTATE_INT32(tx_fifo_len, pl022_state),
-        VMSTATE_INT32(rx_fifo_len, pl022_state),
-        VMSTATE_UINT16(tx_fifo[0], pl022_state),
-        VMSTATE_UINT16(rx_fifo[0], pl022_state),
-        VMSTATE_UINT16(tx_fifo[1], pl022_state),
-        VMSTATE_UINT16(rx_fifo[1], pl022_state),
-        VMSTATE_UINT16(tx_fifo[2], pl022_state),
-        VMSTATE_UINT16(rx_fifo[2], pl022_state),
-        VMSTATE_UINT16(tx_fifo[3], pl022_state),
-        VMSTATE_UINT16(rx_fifo[3], pl022_state),
-        VMSTATE_UINT16(tx_fifo[4], pl022_state),
-        VMSTATE_UINT16(rx_fifo[4], pl022_state),
-        VMSTATE_UINT16(tx_fifo[5], pl022_state),
-        VMSTATE_UINT16(rx_fifo[5], pl022_state),
-        VMSTATE_UINT16(tx_fifo[6], pl022_state),
-        VMSTATE_UINT16(rx_fifo[6], pl022_state),
-        VMSTATE_UINT16(tx_fifo[7], pl022_state),
-        VMSTATE_UINT16(rx_fifo[7], pl022_state),
+        VMSTATE_UINT32(cr0, PL022State),
+        VMSTATE_UINT32(cr1, PL022State),
+        VMSTATE_UINT32(bitmask, PL022State),
+        VMSTATE_UINT32(sr, PL022State),
+        VMSTATE_UINT32(cpsr, PL022State),
+        VMSTATE_UINT32(is, PL022State),
+        VMSTATE_UINT32(im, PL022State),
+        VMSTATE_INT32(tx_fifo_head, PL022State),
+        VMSTATE_INT32(rx_fifo_head, PL022State),
+        VMSTATE_INT32(tx_fifo_len, PL022State),
+        VMSTATE_INT32(rx_fifo_len, PL022State),
+        VMSTATE_UINT16(tx_fifo[0], PL022State),
+        VMSTATE_UINT16(rx_fifo[0], PL022State),
+        VMSTATE_UINT16(tx_fifo[1], PL022State),
+        VMSTATE_UINT16(rx_fifo[1], PL022State),
+        VMSTATE_UINT16(tx_fifo[2], PL022State),
+        VMSTATE_UINT16(rx_fifo[2], PL022State),
+        VMSTATE_UINT16(tx_fifo[3], PL022State),
+        VMSTATE_UINT16(rx_fifo[3], PL022State),
+        VMSTATE_UINT16(tx_fifo[4], PL022State),
+        VMSTATE_UINT16(rx_fifo[4], PL022State),
+        VMSTATE_UINT16(tx_fifo[5], PL022State),
+        VMSTATE_UINT16(rx_fifo[5], PL022State),
+        VMSTATE_UINT16(tx_fifo[6], PL022State),
+        VMSTATE_UINT16(rx_fifo[6], PL022State),
+        VMSTATE_UINT16(tx_fifo[7], PL022State),
+        VMSTATE_UINT16(rx_fifo[7], PL022State),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static int pl022_init(SysBusDevice *dev)
+static int pl022_init(SysBusDevice *sbd)
 {
-    pl022_state *s = FROM_SYSBUS(pl022_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL022State *s = PL022(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl022_ops, s, "pl022", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->ssi = ssi_create_bus(&dev->qdev, "ssi");
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->ssi = ssi_create_bus(dev, "ssi");
     pl022_reset(s);
-    vmstate_register(&dev->qdev, -1, &vmstate_pl022, s);
+    vmstate_register(dev, -1, &vmstate_pl022, s);
     return 0;
 }
 
@@ -294,9 +299,9 @@
 }
 
 static const TypeInfo pl022_info = {
-    .name          = "pl022",
+    .name          = TYPE_PL022,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl022_state),
+    .instance_size = sizeof(PL022State),
     .class_init    = pl022_class_init,
 };
 
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index 7a9fd81..d44caae 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -73,8 +73,12 @@
 
 #define FIFO_CAPACITY 256
 
+#define TYPE_XILINX_SPI "xlnx.xps-spi"
+#define XILINX_SPI(obj) OBJECT_CHECK(XilinxSPI, (obj), TYPE_XILINX_SPI)
+
 typedef struct XilinxSPI {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
 
     qemu_irq irq;
@@ -109,7 +113,7 @@
 
 static void xlx_spi_update_cs(XilinxSPI *s)
 {
-   int i;
+    int i;
 
     for (i = 0; i < s->num_cs; ++i) {
         qemu_set_irq(s->cs_lines[i], !(~s->regs[R_SPISSR] & 1 << i));
@@ -154,7 +158,7 @@
 
 static void xlx_spi_reset(DeviceState *d)
 {
-    xlx_spi_do_reset(DO_UPCAST(XilinxSPI, busdev.qdev, d));
+    xlx_spi_do_reset(XILINX_SPI(d));
 }
 
 static inline int spi_master_enabled(XilinxSPI *s)
@@ -314,25 +318,26 @@
     }
 };
 
-static int xilinx_spi_init(SysBusDevice *dev)
+static int xilinx_spi_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    XilinxSPI *s = XILINX_SPI(dev);
     int i;
-    XilinxSPI *s = FROM_SYSBUS(typeof(*s), dev);
 
     DB_PRINT("\n");
 
-    s->spi = ssi_create_bus(&dev->qdev, "spi");
+    s->spi = ssi_create_bus(dev, "spi");
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->cs_lines = g_new(qemu_irq, s->num_cs);
-    ssi_auto_connect_slaves(DEVICE(s), s->cs_lines, s->spi);
+    ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
     for (i = 0; i < s->num_cs; ++i) {
-        sysbus_init_irq(dev, &s->cs_lines[i]);
+        sysbus_init_irq(sbd, &s->cs_lines[i]);
     }
 
     memory_region_init_io(&s->mmio, OBJECT(s), &spi_ops, s,
                           "xilinx-spi", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     s->irqline = -1;
 
@@ -372,7 +377,7 @@
 }
 
 static const TypeInfo xilinx_spi_info = {
-    .name           = "xlnx.xps-spi",
+    .name           = TYPE_XILINX_SPI,
     .parent         = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(XilinxSPI),
     .class_init     = xilinx_spi_class_init,
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 0ceb240..9277315 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -41,8 +41,15 @@
     MemoryRegion iomem;
 } TimerBlock;
 
+#define TYPE_ARM_MPTIMER "arm_mptimer"
+#define ARM_MPTIMER(obj) \
+    OBJECT_CHECK(ARMMPTimerState, (obj), TYPE_ARM_MPTIMER)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     TimerBlock timerblock[MAX_CPUS];
     MemoryRegion iomem;
@@ -210,9 +217,9 @@
 
 static void arm_mptimer_reset(DeviceState *dev)
 {
-    ARMMPTimerState *s =
-        FROM_SYSBUS(ARMMPTimerState, SYS_BUS_DEVICE(dev));
+    ARMMPTimerState *s = ARM_MPTIMER(dev);
     int i;
+
     for (i = 0; i < ARRAY_SIZE(s->timerblock); i++) {
         timerblock_reset(&s->timerblock[i]);
     }
@@ -220,8 +227,9 @@
 
 static int arm_mptimer_init(SysBusDevice *dev)
 {
-    ARMMPTimerState *s = FROM_SYSBUS(ARMMPTimerState, dev);
+    ARMMPTimerState *s = ARM_MPTIMER(dev);
     int i;
+
     if (s->num_cpu < 1 || s->num_cpu > MAX_CPUS) {
         hw_error("%s: num-cpu must be between 1 and %d\n", __func__, MAX_CPUS);
     }
@@ -294,7 +302,7 @@
 }
 
 static const TypeInfo arm_mptimer_info = {
-    .name          = "arm_mptimer",
+    .name          = TYPE_ARM_MPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARMMPTimerState),
     .class_init    = arm_mptimer_class_init,
diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 798a8da..acfea59 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -179,14 +179,18 @@
  * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0271d/index.html
 */
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_SP804 "sp804"
+#define SP804(obj) OBJECT_CHECK(SP804State, (obj), TYPE_SP804)
+
+typedef struct SP804State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     arm_timer_state *timer[2];
     uint32_t freq0, freq1;
     int level[2];
     qemu_irq irq;
-} sp804_state;
+} SP804State;
 
 static const uint8_t sp804_ids[] = {
     /* Timer ID */
@@ -198,7 +202,7 @@
 /* Merge the IRQs from the two component devices.  */
 static void sp804_set_irq(void *opaque, int irq, int level)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     s->level[irq] = level;
     qemu_set_irq(s->irq, s->level[0] || s->level[1]);
@@ -207,7 +211,7 @@
 static uint64_t sp804_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     if (offset < 0x20) {
         return arm_timer_read(s->timer[0], offset);
@@ -239,7 +243,7 @@
 static void sp804_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     if (offset < 0x20) {
         arm_timer_write(s->timer[0], offset, value);
@@ -268,33 +272,39 @@
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_INT32_ARRAY(level, sp804_state, 2),
+        VMSTATE_INT32_ARRAY(level, SP804State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static int sp804_init(SysBusDevice *dev)
+static int sp804_init(SysBusDevice *sbd)
 {
-    sp804_state *s = FROM_SYSBUS(sp804_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SP804State *s = SP804(dev);
     qemu_irq *qi;
 
     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->timer[0] = arm_timer_init(s->freq0);
     s->timer[1] = arm_timer_init(s->freq1);
     s->timer[0]->irq = qi[0];
     s->timer[1]->irq = qi[1];
     memory_region_init_io(&s->iomem, OBJECT(s), &sp804_ops, s,
                           "sp804", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    vmstate_register(&dev->qdev, -1, &vmstate_sp804, s);
+    sysbus_init_mmio(sbd, &s->iomem);
+    vmstate_register(dev, -1, &vmstate_sp804, s);
     return 0;
 }
 
 /* Integrator/CP timer module.  */
 
+#define TYPE_INTEGRATOR_PIT "integrator_pit"
+#define INTEGRATOR_PIT(obj) \
+    OBJECT_CHECK(icp_pit_state, (obj), TYPE_INTEGRATOR_PIT)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     arm_timer_state *timer[3];
 } icp_pit_state;
@@ -336,7 +346,7 @@
 
 static int icp_pit_init(SysBusDevice *dev)
 {
-    icp_pit_state *s = FROM_SYSBUS(icp_pit_state, dev);
+    icp_pit_state *s = INTEGRATOR_PIT(dev);
 
     /* Timer 0 runs at the system clock speed (40MHz).  */
     s->timer[0] = arm_timer_init(40000000);
@@ -364,15 +374,15 @@
 }
 
 static const TypeInfo icp_pit_info = {
-    .name          = "integrator_pit",
+    .name          = TYPE_INTEGRATOR_PIT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pit_state),
     .class_init    = icp_pit_class_init,
 };
 
 static Property sp804_properties[] = {
-    DEFINE_PROP_UINT32("freq0", sp804_state, freq0, 1000000),
-    DEFINE_PROP_UINT32("freq1", sp804_state, freq1, 1000000),
+    DEFINE_PROP_UINT32("freq0", SP804State, freq0, 1000000),
+    DEFINE_PROP_UINT32("freq1", SP804State, freq1, 1000000),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -386,9 +396,9 @@
 }
 
 static const TypeInfo sp804_info = {
-    .name          = "sp804",
+    .name          = TYPE_SP804,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(sp804_state),
+    .instance_size = sizeof(SP804State),
     .class_init    = sp804_class_init,
 };
 
diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index a861049..888f9ce 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -64,8 +64,13 @@
     qemu_irq irq;
 } CadenceTimerState;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_CADENCE_TTC "cadence_ttc"
+#define CADENCE_TTC(obj) \
+    OBJECT_CHECK(CadenceTTCState, (obj), TYPE_CADENCE_TTC)
+
+typedef struct CadenceTTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CadenceTimerState timer[3];
 } CadenceTTCState;
@@ -401,7 +406,7 @@
 
 static int cadence_ttc_init(SysBusDevice *dev)
 {
-    CadenceTTCState *s = FROM_SYSBUS(CadenceTTCState, dev);
+    CadenceTTCState *s = CADENCE_TTC(dev);
     int i;
 
     for (i = 0; i < 3; ++i) {
@@ -476,7 +481,7 @@
 }
 
 static const TypeInfo cadence_ttc_info = {
-    .name  = "cadence_ttc",
+    .name  = TYPE_CADENCE_TTC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(CadenceTTCState),
     .class_init = cadence_ttc_class_init,
diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 6dd1072..a38d9e4 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -42,8 +42,13 @@
 #define R_INTR        0x50
 #define R_MASKED_INTR 0x54
 
-struct etrax_timer {
-    SysBusDevice busdev;
+#define TYPE_ETRAX_FS_TIMER "etraxfs,timer"
+#define ETRAX_TIMER(obj) \
+    OBJECT_CHECK(ETRAXTimerState, (obj), TYPE_ETRAX_FS_TIMER)
+
+typedef struct ETRAXTimerState {
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     qemu_irq nmi;
@@ -72,12 +77,12 @@
     uint32_t rw_ack_intr;
     uint32_t r_intr;
     uint32_t r_masked_intr;
-};
+} ETRAXTimerState;
 
 static uint64_t
 timer_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     uint32_t r = 0;
 
     switch (addr) {
@@ -103,7 +108,7 @@
     return r;
 }
 
-static void update_ctrl(struct etrax_timer *t, int tnum)
+static void update_ctrl(ETRAXTimerState *t, int tnum)
 {
     unsigned int op;
     unsigned int freq;
@@ -167,7 +172,7 @@
     }
 }
 
-static void timer_update_irq(struct etrax_timer *t)
+static void timer_update_irq(ETRAXTimerState *t)
 {
     t->r_intr &= ~(t->rw_ack_intr);
     t->r_masked_intr = t->r_intr & t->rw_intr_mask;
@@ -178,21 +183,21 @@
 
 static void timer0_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     t->r_intr |= 1;
     timer_update_irq(t);
 }
 
 static void timer1_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     t->r_intr |= 2;
     timer_update_irq(t);
 }
 
 static void watchdog_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     if (t->wd_hits == 0) {
         /* real hw gives a single tick before reseting but we are
            a bit friendlier to compensate for our slower execution.  */
@@ -206,7 +211,7 @@
     t->wd_hits++;
 }
 
-static inline void timer_watchdog_update(struct etrax_timer *t, uint32_t value)
+static inline void timer_watchdog_update(ETRAXTimerState *t, uint32_t value)
 {
     unsigned int wd_en = t->rw_wd_ctrl & (1 << 8);
     unsigned int wd_key = t->rw_wd_ctrl >> 9;
@@ -245,7 +250,7 @@
 timer_write(void *opaque, hwaddr addr,
             uint64_t val64, unsigned int size)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     uint32_t value = val64;
 
     switch (addr)
@@ -298,7 +303,7 @@
 
 static void etraxfs_timer_reset(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
 
     ptimer_stop(t->ptimer_t0);
     ptimer_stop(t->ptimer_t1);
@@ -311,7 +316,7 @@
 
 static int etraxfs_timer_init(SysBusDevice *dev)
 {
-    struct etrax_timer *t = FROM_SYSBUS(typeof (*t), dev);
+    ETRAXTimerState *t = ETRAX_TIMER(dev);
 
     t->bh_t0 = qemu_bh_new(timer0_hit, t);
     t->bh_t1 = qemu_bh_new(timer1_hit, t);
@@ -338,9 +343,9 @@
 }
 
 static const TypeInfo etraxfs_timer_info = {
-    .name          = "etraxfs,timer",
+    .name          = TYPE_ETRAX_FS_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof (struct etrax_timer),
+    .instance_size = sizeof(ETRAXTimerState),
     .class_init    = etraxfs_timer_class_init,
 };
 
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 28ebe5d..a8009a4 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -240,8 +240,13 @@
 
 } Exynos4210MCTLT;
 
+#define TYPE_EXYNOS4210_MCT "exynos4210.mct"
+#define EXYNOS4210_MCT(obj) \
+    OBJECT_CHECK(Exynos4210MCTState, (obj), TYPE_EXYNOS4210_MCT)
+
 typedef struct Exynos4210MCTState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     /* Registers */
@@ -955,7 +960,7 @@
 /* set defaul_timer values for all fields */
 static void exynos4210_mct_reset(DeviceState *d)
 {
-    Exynos4210MCTState *s = (Exynos4210MCTState *)d;
+    Exynos4210MCTState *s = EXYNOS4210_MCT(d);
     uint32_t i;
 
     s->reg_mct_cfg = 0;
@@ -1424,7 +1429,7 @@
 static int exynos4210_mct_init(SysBusDevice *dev)
 {
     int i;
-    Exynos4210MCTState *s = FROM_SYSBUS(Exynos4210MCTState, dev);
+    Exynos4210MCTState *s = EXYNOS4210_MCT(dev);
     QEMUBH *bh[2];
 
     /* Global timer */
@@ -1467,7 +1472,7 @@
 }
 
 static const TypeInfo exynos4210_mct_info = {
-    .name          = "exynos4210.mct",
+    .name          = TYPE_EXYNOS4210_MCT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210MCTState),
     .class_init    = exynos4210_mct_class_init,
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index 8fa0bb2..a52f0f6 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -97,9 +97,13 @@
 
 } Exynos4210PWM;
 
+#define TYPE_EXYNOS4210_PWM "exynos4210.pwm"
+#define EXYNOS4210_PWM(obj) \
+    OBJECT_CHECK(Exynos4210PWMState, (obj), TYPE_EXYNOS4210_PWM)
 
 typedef struct Exynos4210PWMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t    reg_tcfg[2];
@@ -352,7 +356,7 @@
  */
 static void exynos4210_pwm_reset(DeviceState *d)
 {
-    Exynos4210PWMState *s = (Exynos4210PWMState *)d;
+    Exynos4210PWMState *s = EXYNOS4210_PWM(d);
     int i;
     s->reg_tcfg[0] = 0x0101;
     s->reg_tcfg[1] = 0x0;
@@ -378,7 +382,7 @@
  */
 static int exynos4210_pwm_init(SysBusDevice *dev)
 {
-    Exynos4210PWMState *s = FROM_SYSBUS(Exynos4210PWMState, dev);
+    Exynos4210PWMState *s = EXYNOS4210_PWM(dev);
     int i;
     QEMUBH *bh;
 
@@ -408,7 +412,7 @@
 }
 
 static const TypeInfo exynos4210_pwm_info = {
-    .name          = "exynos4210.pwm",
+    .name          = TYPE_EXYNOS4210_PWM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210PWMState),
     .class_init    = exynos4210_pwm_class_init,
diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index 7fca071..3f2c8c5 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -79,8 +79,13 @@
 
 #define     RTC_BASE_FREQ       32768
 
+#define TYPE_EXYNOS4210_RTC "exynos4210.rtc"
+#define EXYNOS4210_RTC(obj) \
+    OBJECT_CHECK(Exynos4210RTCState, (obj), TYPE_EXYNOS4210_RTC)
+
 typedef struct Exynos4210RTCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     /* registers */
@@ -507,7 +512,7 @@
  */
 static void exynos4210_rtc_reset(DeviceState *d)
 {
-    Exynos4210RTCState *s = (Exynos4210RTCState *)d;
+    Exynos4210RTCState *s = EXYNOS4210_RTC(d);
 
     qemu_get_timedate(&s->current_tm, 0);
 
@@ -544,7 +549,7 @@
  */
 static int exynos4210_rtc_init(SysBusDevice *dev)
 {
-    Exynos4210RTCState *s = FROM_SYSBUS(Exynos4210RTCState, dev);
+    Exynos4210RTCState *s = EXYNOS4210_RTC(dev);
     QEMUBH *bh;
 
     bh = qemu_bh_new(exynos4210_rtc_tick, s);
@@ -577,7 +582,7 @@
 }
 
 static const TypeInfo exynos4210_rtc_info = {
-    .name          = "exynos4210.rtc",
+    .name          = TYPE_EXYNOS4210_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210RTCState),
     .class_init    = exynos4210_rtc_class_init,
diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index 37ba47d..7c1055a 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -50,6 +50,10 @@
 #define COUNTER_RELOAD_OFFSET 0x04
 #define TIMER_BASE            0x10
 
+#define TYPE_GRLIB_GPTIMER "grlib,gptimer"
+#define GRLIB_GPTIMER(obj) \
+    OBJECT_CHECK(GPTimerUnit, (obj), TYPE_GRLIB_GPTIMER)
+
 typedef struct GPTimer     GPTimer;
 typedef struct GPTimerUnit GPTimerUnit;
 
@@ -68,7 +72,8 @@
 };
 
 struct GPTimerUnit {
-    SysBusDevice  busdev;
+    SysBusDevice  parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t nr_timers;         /* Number of timers available */
@@ -314,7 +319,7 @@
 
 static void grlib_gptimer_reset(DeviceState *d)
 {
-    GPTimerUnit *unit = container_of(d, GPTimerUnit, busdev.qdev);
+    GPTimerUnit *unit = GRLIB_GPTIMER(d);
     int          i    = 0;
 
     assert(unit != NULL);
@@ -343,7 +348,7 @@
 
 static int grlib_gptimer_init(SysBusDevice *dev)
 {
-    GPTimerUnit  *unit = FROM_SYSBUS(typeof(*unit), dev);
+    GPTimerUnit  *unit = GRLIB_GPTIMER(dev);
     unsigned int  i;
 
     assert(unit->nr_timers > 0);
@@ -391,7 +396,7 @@
 }
 
 static const TypeInfo grlib_gptimer_info = {
-    .name          = "grlib,gptimer",
+    .name          = TYPE_GRLIB_GPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GPTimerUnit),
     .class_init    = grlib_gptimer_class_init,
diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index 016dade..986e6a1 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -50,8 +50,12 @@
     CR_STOP  = (1 << 3),
 };
 
+#define TYPE_LM32_TIMER "lm32-timer"
+#define LM32_TIMER(obj) OBJECT_CHECK(LM32TimerState, (obj), TYPE_LM32_TIMER)
+
 struct LM32TimerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     QEMUBH *bh;
@@ -161,7 +165,7 @@
 
 static void timer_reset(DeviceState *d)
 {
-    LM32TimerState *s = container_of(d, LM32TimerState, busdev.qdev);
+    LM32TimerState *s = LM32_TIMER(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -172,7 +176,7 @@
 
 static int lm32_timer_init(SysBusDevice *dev)
 {
-    LM32TimerState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32TimerState *s = LM32_TIMER(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -217,7 +221,7 @@
 }
 
 static const TypeInfo lm32_timer_info = {
-    .name          = "lm32-timer",
+    .name          = TYPE_LM32_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32TimerState),
     .class_init    = lm32_timer_class_init,
diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
index be3490b..0cc9e5b 100644
--- a/hw/timer/m48t59.c
+++ b/hw/timer/m48t59.c
@@ -83,8 +83,12 @@
     MemoryRegion io;
 } M48t59ISAState;
 
+#define SYSBUS_M48T59(obj) \
+    OBJECT_CHECK(M48t59SysBusState, (obj), TYPE_SYSBUS_M48T59)
+
 typedef struct M48t59SysBusState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     M48t59State state;
     MemoryRegion io;
 } M48t59SysBusState;
@@ -621,7 +625,7 @@
 
 static void m48t59_reset_sysbus(DeviceState *d)
 {
-    M48t59SysBusState *sys = container_of(d, M48t59SysBusState, busdev.qdev);
+    M48t59SysBusState *sys = SYSBUS_M48T59(d);
     M48t59State *NVRAM = &sys->state;
 
     m48t59_reset_common(NVRAM);
@@ -646,13 +650,13 @@
     M48t59SysBusState *d;
     M48t59State *state;
 
-    dev = qdev_create(NULL, "m48t59");
+    dev = qdev_create(NULL, TYPE_SYSBUS_M48T59);
     qdev_prop_set_uint32(dev, "model", model);
     qdev_prop_set_uint32(dev, "size", size);
     qdev_prop_set_uint32(dev, "io_base", io_base);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
-    d = FROM_SYSBUS(M48t59SysBusState, s);
+    d = SYSBUS_M48T59(dev);
     state = &d->state;
     sysbus_connect_irq(s, 0, IRQ);
     memory_region_init_io(&d->io, OBJECT(d), &m48t59_io_ops, state,
@@ -716,7 +720,7 @@
 
 static int m48t59_init1(SysBusDevice *dev)
 {
-    M48t59SysBusState *d = FROM_SYSBUS(M48t59SysBusState, dev);
+    M48t59SysBusState *d = SYSBUS_M48T59(dev);
     M48t59State *s = &d->state;
     Error *err = NULL;
 
@@ -776,7 +780,7 @@
 }
 
 static const TypeInfo m48t59_info = {
-    .name          = "m48t59",
+    .name          = TYPE_SYSBUS_M48T59,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(M48t59SysBusState),
     .class_init    = m48t59_class_init,
diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index 5009394..94246e5 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -57,8 +57,13 @@
     R_MAX
 };
 
+#define TYPE_MILKYMIST_SYSCTL "milkymist-sysctl"
+#define MILKYMIST_SYSCTL(obj) \
+    OBJECT_CHECK(MilkymistSysctlState, (obj), TYPE_MILKYMIST_SYSCTL)
+
 struct MilkymistSysctlState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     QEMUBH *bh0;
@@ -246,8 +251,7 @@
 
 static void milkymist_sysctl_reset(DeviceState *d)
 {
-    MilkymistSysctlState *s =
-            container_of(d, MilkymistSysctlState, busdev.qdev);
+    MilkymistSysctlState *s = MILKYMIST_SYSCTL(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -267,7 +271,7 @@
 
 static int milkymist_sysctl_init(SysBusDevice *dev)
 {
-    MilkymistSysctlState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistSysctlState *s = MILKYMIST_SYSCTL(dev);
 
     sysbus_init_irq(dev, &s->gpio_irq);
     sysbus_init_irq(dev, &s->timer0_irq);
@@ -324,7 +328,7 @@
 }
 
 static const TypeInfo milkymist_sysctl_info = {
-    .name          = "milkymist-sysctl",
+    .name          = TYPE_MILKYMIST_SYSCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistSysctlState),
     .class_init    = milkymist_sysctl_class_init,
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index 3ce6ed8..d5e2f3e 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -33,8 +33,12 @@
 #define RTC_MIS     0x18    /* Masked interrupt status register */
 #define RTC_ICR     0x1c    /* Interrupt clear register */
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PL031 "pl031"
+#define PL031(obj) OBJECT_CHECK(PL031State, (obj), TYPE_PL031)
+
+typedef struct PL031State {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QEMUTimer *timer;
     qemu_irq irq;
@@ -51,34 +55,34 @@
     uint32_t cr;
     uint32_t im;
     uint32_t is;
-} pl031_state;
+} PL031State;
 
 static const unsigned char pl031_id[] = {
     0x31, 0x10, 0x14, 0x00,         /* Device ID        */
     0x0d, 0xf0, 0x05, 0xb1          /* Cell ID      */
 };
 
-static void pl031_update(pl031_state *s)
+static void pl031_update(PL031State *s)
 {
     qemu_set_irq(s->irq, s->is & s->im);
 }
 
 static void pl031_interrupt(void * opaque)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
     s->is = 1;
     DPRINTF("Alarm raised\n");
     pl031_update(s);
 }
 
-static uint32_t pl031_get_count(pl031_state *s)
+static uint32_t pl031_get_count(PL031State *s)
 {
     int64_t now = qemu_get_clock_ns(rtc_clock);
     return s->tick_offset + now / get_ticks_per_sec();
 }
 
-static void pl031_set_alarm(pl031_state *s)
+static void pl031_set_alarm(PL031State *s)
 {
     uint32_t ticks;
 
@@ -98,7 +102,7 @@
 static uint64_t pl031_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
     if (offset >= 0xfe0  &&  offset < 0x1000)
         return pl031_id[(offset - 0xfe0) >> 2];
@@ -136,7 +140,7 @@
 static void pl031_write(void * opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
 
     switch (offset) {
@@ -189,7 +193,7 @@
 
 static int pl031_init(SysBusDevice *dev)
 {
-    pl031_state *s = FROM_SYSBUS(pl031_state, dev);
+    PL031State *s = PL031(dev);
     struct tm tm;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000);
@@ -205,7 +209,7 @@
 
 static void pl031_pre_save(void *opaque)
 {
-    pl031_state *s = opaque;
+    PL031State *s = opaque;
 
     /* tick_offset is base_time - rtc_clock base time.  Instead, we want to
      * store the base time relative to the vm_clock for backwards-compatibility.  */
@@ -215,7 +219,7 @@
 
 static int pl031_post_load(void *opaque, int version_id)
 {
-    pl031_state *s = opaque;
+    PL031State *s = opaque;
 
     int64_t delta = qemu_get_clock_ns(rtc_clock) - qemu_get_clock_ns(vm_clock);
     s->tick_offset = s->tick_offset_vmstate - delta / get_ticks_per_sec();
@@ -230,12 +234,12 @@
     .pre_save = pl031_pre_save,
     .post_load = pl031_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(tick_offset_vmstate, pl031_state),
-        VMSTATE_UINT32(mr, pl031_state),
-        VMSTATE_UINT32(lr, pl031_state),
-        VMSTATE_UINT32(cr, pl031_state),
-        VMSTATE_UINT32(im, pl031_state),
-        VMSTATE_UINT32(is, pl031_state),
+        VMSTATE_UINT32(tick_offset_vmstate, PL031State),
+        VMSTATE_UINT32(mr, PL031State),
+        VMSTATE_UINT32(lr, PL031State),
+        VMSTATE_UINT32(cr, PL031State),
+        VMSTATE_UINT32(im, PL031State),
+        VMSTATE_UINT32(is, PL031State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -251,9 +255,9 @@
 }
 
 static const TypeInfo pl031_info = {
-    .name          = "pl031",
+    .name          = TYPE_PL031,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl031_state),
+    .instance_size = sizeof(PL031State),
     .class_init    = pl031_class_init,
 };
 
diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index 63f2c9f..4bd2b76 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -14,9 +14,13 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
+#define TYPE_PUV3_OST "puv3_ost"
+#define PUV3_OST(obj) OBJECT_CHECK(PUV3OSTState, (obj), TYPE_PUV3_OST)
+
 /* puv3 ostimer implementation. */
-typedef struct {
-    SysBusDevice busdev;
+typedef struct PUV3OSTState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QEMUBH *bh;
     qemu_irq irq;
@@ -109,7 +113,7 @@
 
 static int puv3_ost_init(SysBusDevice *dev)
 {
-    PUV3OSTState *s = FROM_SYSBUS(PUV3OSTState, dev);
+    PUV3OSTState *s = PUV3_OST(dev);
 
     s->reg_OIER = 0;
     s->reg_OSSR = 0;
@@ -137,7 +141,7 @@
 }
 
 static const TypeInfo puv3_ost_info = {
-    .name = "puv3_ost",
+    .name = TYPE_PUV3_OST,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3OSTState),
     .class_init = puv3_ost_class_init,
diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index 4d28719..cdabccd 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -60,6 +60,10 @@
     [5 ... 7] = 0,
 };
 
+#define TYPE_PXA2XX_TIMER "pxa2xx-timer"
+#define PXA2XX_TIMER(obj) \
+    OBJECT_CHECK(PXA2xxTimerInfo, (obj), TYPE_PXA2XX_TIMER)
+
 typedef struct PXA2xxTimerInfo PXA2xxTimerInfo;
 
 typedef struct {
@@ -80,7 +84,8 @@
 } PXA2xxTimer4;
 
 struct PXA2xxTimerInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t flags;
 
@@ -429,10 +434,9 @@
 
 static int pxa2xx_timer_init(SysBusDevice *dev)
 {
+    PXA2xxTimerInfo *s = PXA2XX_TIMER(dev);
     int i;
-    PXA2xxTimerInfo *s;
 
-    s = FROM_SYSBUS(PXA2xxTimerInfo, dev);
     s->irq_enabled = 0;
     s->oldclock = 0;
     s->clock = 0;
@@ -527,24 +531,21 @@
 static Property pxa25x_timer_dev_properties[] = {
     DEFINE_PROP_UINT32("freq", PXA2xxTimerInfo, freq, PXA25X_FREQ),
     DEFINE_PROP_BIT("tm4", PXA2xxTimerInfo, flags,
-    PXA2XX_TIMER_HAVE_TM4, false),
+                    PXA2XX_TIMER_HAVE_TM4, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
 static void pxa25x_timer_dev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pxa2xx_timer_init;
     dc->desc = "PXA25x timer";
-    dc->vmsd = &vmstate_pxa2xx_timer_regs;
     dc->props = pxa25x_timer_dev_properties;
 }
 
 static const TypeInfo pxa25x_timer_dev_info = {
     .name          = "pxa25x-timer",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PXA2XX_TIMER,
     .instance_size = sizeof(PXA2xxTimerInfo),
     .class_init    = pxa25x_timer_dev_class_init,
 };
@@ -552,30 +553,45 @@
 static Property pxa27x_timer_dev_properties[] = {
     DEFINE_PROP_UINT32("freq", PXA2xxTimerInfo, freq, PXA27X_FREQ),
     DEFINE_PROP_BIT("tm4", PXA2xxTimerInfo, flags,
-    PXA2XX_TIMER_HAVE_TM4, true),
+                    PXA2XX_TIMER_HAVE_TM4, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
 static void pxa27x_timer_dev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pxa2xx_timer_init;
     dc->desc = "PXA27x timer";
-    dc->vmsd = &vmstate_pxa2xx_timer_regs;
     dc->props = pxa27x_timer_dev_properties;
 }
 
 static const TypeInfo pxa27x_timer_dev_info = {
     .name          = "pxa27x-timer",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PXA2XX_TIMER,
     .instance_size = sizeof(PXA2xxTimerInfo),
     .class_init    = pxa27x_timer_dev_class_init,
 };
 
+static void pxa2xx_timer_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc);
+
+    sdc->init = pxa2xx_timer_init;
+    dc->vmsd = &vmstate_pxa2xx_timer_regs;
+}
+
+static const TypeInfo pxa2xx_timer_type_info = {
+    .name          = TYPE_PXA2XX_TIMER,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(PXA2xxTimerInfo),
+    .abstract      = true,
+    .class_init    = pxa2xx_timer_class_init,
+};
+
 static void pxa2xx_timer_register_types(void)
 {
+    type_register_static(&pxa2xx_timer_type_info);
     type_register_static(&pxa25x_timer_dev_info);
     type_register_static(&pxa27x_timer_dev_info);
 }
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index 7f844d7..33e8f6c 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -54,8 +54,13 @@
     uint64_t limit;
 } CPUTimerState;
 
+#define TYPE_SLAVIO_TIMER "slavio_timer"
+#define SLAVIO_TIMER(obj) \
+    OBJECT_CHECK(SLAVIO_TIMERState, (obj), TYPE_SLAVIO_TIMER)
+
 typedef struct SLAVIO_TIMERState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t num_cpus;
     uint32_t cputimer_mode;
     CPUTimerState cputimer[MAX_CPUS + 1];
@@ -354,7 +359,7 @@
 
 static void slavio_timer_reset(DeviceState *d)
 {
-    SLAVIO_TIMERState *s = container_of(d, SLAVIO_TIMERState, busdev.qdev);
+    SLAVIO_TIMERState *s = SLAVIO_TIMER(d);
     unsigned int i;
     CPUTimerState *curr_timer;
 
@@ -375,7 +380,7 @@
 
 static int slavio_timer_init1(SysBusDevice *dev)
 {
-    SLAVIO_TIMERState *s = FROM_SYSBUS(SLAVIO_TIMERState, dev);
+    SLAVIO_TIMERState *s = SLAVIO_TIMER(dev);
     QEMUBH *bh;
     unsigned int i;
     TimerContext *tc;
@@ -421,7 +426,7 @@
 }
 
 static const TypeInfo slavio_timer_info = {
-    .name          = "slavio_timer",
+    .name          = TYPE_SLAVIO_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLAVIO_TIMERState),
     .class_init    = slavio_timer_class_init,
diff --git a/hw/timer/tusb6010.c b/hw/timer/tusb6010.c
index 47b6809..c48ecf8 100644
--- a/hw/timer/tusb6010.c
+++ b/hw/timer/tusb6010.c
@@ -26,8 +26,12 @@
 #include "hw/devices.h"
 #include "hw/sysbus.h"
 
+#define TYPE_TUSB6010 "tusb6010"
+#define TUSB(obj) OBJECT_CHECK(TUSBState, (obj), TYPE_TUSB6010)
+
 typedef struct TUSBState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem[2];
     qemu_irq irq;
     MUSBState *musb;
@@ -740,7 +744,7 @@
 
 static void tusb6010_reset(DeviceState *dev)
 {
-    TUSBState *s = FROM_SYSBUS(TUSBState, SYS_BUS_DEVICE(dev));
+    TUSBState *s = TUSB(dev);
     int i;
 
     s->test_reset = TUSB_PROD_TEST_RESET_VAL;
@@ -774,18 +778,20 @@
     musb_reset(s->musb);
 }
 
-static int tusb6010_init(SysBusDevice *dev)
+static int tusb6010_init(SysBusDevice *sbd)
 {
-    TUSBState *s = FROM_SYSBUS(TUSBState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    TUSBState *s = TUSB(dev);
+
     s->otg_timer = qemu_new_timer_ns(vm_clock, tusb_otg_tick, s);
     s->pwr_timer = qemu_new_timer_ns(vm_clock, tusb_power_tick, s);
     memory_region_init_io(&s->iomem[1], OBJECT(s), &tusb_async_ops, s,
                           "tusb-async", UINT32_MAX);
-    sysbus_init_mmio(dev, &s->iomem[0]);
-    sysbus_init_mmio(dev, &s->iomem[1]);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&dev->qdev, tusb6010_irq, musb_irq_max + 1);
-    s->musb = musb_init(&dev->qdev, 1);
+    sysbus_init_mmio(sbd, &s->iomem[0]);
+    sysbus_init_mmio(sbd, &s->iomem[1]);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, tusb6010_irq, musb_irq_max + 1);
+    s->musb = musb_init(dev, 1);
     return 0;
 }
 
@@ -799,7 +805,7 @@
 }
 
 static const TypeInfo tusb6010_info = {
-    .name          = "tusb6010",
+    .name          = TYPE_TUSB6010,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(TUSBState),
     .class_init    = tusb6010_class_init,
diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index ee53834..5f2c902 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -57,9 +57,14 @@
     uint32_t regs[R_MAX];
 };
 
+#define TYPE_XILINX_TIMER "xlnx.xps-timer"
+#define XILINX_TIMER(obj) \
+    OBJECT_CHECK(struct timerblock, (obj), TYPE_XILINX_TIMER)
+
 struct timerblock
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     uint8_t one_timer_only;
@@ -200,7 +205,7 @@
 
 static int xilinx_timer_init(SysBusDevice *dev)
 {
-    struct timerblock *t = FROM_SYSBUS(typeof (*t), dev);
+    struct timerblock *t = XILINX_TIMER(dev);
     unsigned int i;
 
     /* All timers share a single irq line.  */
@@ -241,7 +246,7 @@
 }
 
 static const TypeInfo xilinx_timer_info = {
-    .name          = "xlnx.xps-timer",
+    .name          = TYPE_XILINX_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct timerblock),
     .class_init    = xilinx_timer_class_init,
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index deb6d47..aa913df 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -592,6 +592,7 @@
     cc->exitfn = emulated_exitfn;
     cc->get_atr = emulated_get_atr;
     cc->apdu_from_guest = emulated_apdu_from_guest;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "emulated smartcard";
     dc->props = emulated_card_properties;
 }
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 5f01ff1..10f1d30 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -392,6 +392,7 @@
     cc->exitfn = passthru_exitfn;
     cc->get_atr = passthru_get_atr;
     cc->apdu_from_guest = passthru_apdu_from_guest;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "passthrough smartcard";
     dc->vmsd = &passthru_vmstate;
     dc->props = passthru_card_properties;
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index 04933a9..c5420eb 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -673,6 +673,7 @@
 
     dc->vmsd          = &vmstate_usb_audio;
     dc->props         = usb_audio_properties;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     k->product_desc   = "QEMU USB Audio Interface";
     k->usb_desc       = &desc_audio;
     k->init           = usb_audio_initfn;
diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index 68cc1d4..f2fc2a8 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -553,6 +553,7 @@
     uc->handle_data    = usb_bt_handle_data;
     uc->handle_destroy = usb_bt_handle_destroy;
     dc->vmsd = &vmstate_usb_bt;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo bt_info = {
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 31f3cde..66c6331 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -658,6 +658,7 @@
     uc->product_desc   = "QEMU USB Tablet";
     dc->vmsd = &vmstate_usb_ptr;
     dc->props = usb_tablet_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo usb_tablet_info = {
@@ -677,6 +678,7 @@
     uc->product_desc   = "QEMU USB Mouse";
     uc->usb_desc       = &desc_mouse;
     dc->vmsd = &vmstate_usb_ptr;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo usb_mouse_info = {
@@ -696,6 +698,7 @@
     uc->product_desc   = "QEMU USB Keyboard";
     uc->usb_desc       = &desc_keyboard;
     dc->vmsd = &vmstate_usb_kbd;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo usb_keyboard_info = {
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 0b71abd..e865a98 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -574,6 +574,7 @@
     uc->handle_control = usb_hub_handle_control;
     uc->handle_data    = usb_hub_handle_data;
     uc->handle_destroy = usb_hub_handle_destroy;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->fw_name = "hub";
     dc->vmsd = &vmstate_usb_hub;
 }
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 5473ac2..660d774 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1429,6 +1429,7 @@
     uc->handle_control = usb_net_handle_control;
     uc->handle_data    = usb_net_handle_data;
     uc->handle_destroy = usb_net_handle_destroy;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->fw_name = "network";
     dc->vmsd = &vmstate_usb_net;
     dc->props = net_properties;
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 2fc8a3b..0b150d4 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -590,6 +590,7 @@
     uc->handle_data    = usb_serial_handle_data;
     dc->vmsd = &vmstate_usb_serial;
     dc->props = serial_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_info = {
@@ -617,6 +618,7 @@
     uc->handle_data    = usb_serial_handle_data;
     dc->vmsd = &vmstate_usb_serial;
     dc->props = braille_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo braille_info = {
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index b33eb25..2233c54 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1449,6 +1449,7 @@
     dc->desc = "CCID Rev 1.1 smartcard reader";
     dc->vmsd = &ccid_vmstate;
     dc->props = ccid_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo ccid_info = {
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 1954811..a8dc2fa 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -746,6 +746,7 @@
     uc->handle_reset   = usb_msd_handle_reset;
     uc->handle_control = usb_msd_handle_control;
     uc->handle_data    = usb_msd_handle_data;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->fw_name = "storage";
     dc->vmsd = &vmstate_usb_msd;
 }
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 6efab62..63ad12e 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -916,6 +916,7 @@
     uc->handle_control = usb_uas_handle_control;
     uc->handle_data    = usb_uas_handle_data;
     uc->handle_destroy = usb_uas_handle_destroy;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->fw_name = "storage";
     dc->vmsd = &vmstate_usb_uas;
 }
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index 3be5cde..1b09235 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -362,6 +362,7 @@
     uc->handle_control = usb_wacom_handle_control;
     uc->handle_data    = usb_wacom_handle_data;
     uc->handle_destroy = usb_wacom_handle_destroy;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "QEMU PenPartner Tablet";
     dc->vmsd = &vmstate_usb_wacom;
 }
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 5d229bc..4d21a0b 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -140,11 +140,13 @@
 static void ehci_data_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
     EHCIPCIInfo *i = data;
 
     k->vendor_id = i->vendor_id;
     k->device_id = i->device_id;
     k->revision = i->revision;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static struct EHCIPCIInfo ehci_pci_info[] = {
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 54147b5..fe6eea5 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -70,6 +70,7 @@
     dc->realize = usb_ehci_sysbus_realize;
     dc->vmsd = &vmstate_ehci_sysbus;
     dc->props = ehci_sysbus_properties;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_type_info = {
@@ -85,7 +86,9 @@
 static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     sec->capsbase = 0x100;
     sec->opregbase = 0x140;
 }
@@ -99,9 +102,11 @@
 static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x0;
     sec->opregbase = 0x10;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_exynos4210_type_info = {
@@ -113,9 +118,11 @@
 static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x100;
     sec->opregbase = 0x140;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_tegra2_type_info = {
@@ -183,11 +190,13 @@
 static void fusbh200_ehci_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x0;
     sec->opregbase = 0x10;
     sec->portscbase = 0x20;
     sec->portnr = 1;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_fusbh200_type_info = {
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 2bab8ff..d7836d6 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -22,7 +22,6 @@
  *  o Allocate bandwidth in frames properly
  *  o Disable timers when nothing needs to be done, or remove timer usage
  *    all together.
- *  o Handle unrecoverable errors properly
  *  o BIOS work to boot from USB storage
 */
 
@@ -308,6 +307,8 @@
 
 #define OHCI_HRESET_FSBIR       (1 << 0)
 
+static void ohci_die(OHCIState *ohci);
+
 /* Update IRQ levels */
 static inline void ohci_intr_update(OHCIState *ohci)
 {
@@ -508,11 +509,13 @@
     addr += ohci->localmem_base;
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
-        dma_memory_read(ohci->as, addr, buf, sizeof(*buf));
+        if (dma_memory_read(ohci->as, addr, buf, sizeof(*buf))) {
+            return -1;
+        }
         *buf = le32_to_cpu(*buf);
     }
 
-    return 1;
+    return 0;
 }
 
 /* Put an array of dwords in to main memory */
@@ -525,10 +528,12 @@
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
         uint32_t tmp = cpu_to_le32(*buf);
-        dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp));
+        if (dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp))) {
+            return -1;
+        }
     }
 
-    return 1;
+    return 0;
 }
 
 /* Get an array of words from main memory */
@@ -540,11 +545,13 @@
     addr += ohci->localmem_base;
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
-        dma_memory_read(ohci->as, addr, buf, sizeof(*buf));
+        if (dma_memory_read(ohci->as, addr, buf, sizeof(*buf))) {
+            return -1;
+        }
         *buf = le16_to_cpu(*buf);
     }
 
-    return 1;
+    return 0;
 }
 
 /* Put an array of words in to main memory */
@@ -557,10 +564,12 @@
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
         uint16_t tmp = cpu_to_le16(*buf);
-        dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp));
+        if (dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp))) {
+            return -1;
+        }
     }
 
-    return 1;
+    return 0;
 }
 
 static inline int ohci_read_ed(OHCIState *ohci,
@@ -578,15 +587,15 @@
 static inline int ohci_read_iso_td(OHCIState *ohci,
                                    dma_addr_t addr, struct ohci_iso_td *td)
 {
-    return (get_dwords(ohci, addr, (uint32_t *)td, 4) &&
-            get_words(ohci, addr + 16, td->offset, 8));
+    return get_dwords(ohci, addr, (uint32_t *)td, 4) ||
+           get_words(ohci, addr + 16, td->offset, 8);
 }
 
 static inline int ohci_read_hcca(OHCIState *ohci,
                                  dma_addr_t addr, struct ohci_hcca *hcca)
 {
-    dma_memory_read(ohci->as, addr + ohci->localmem_base, hcca, sizeof(*hcca));
-    return 1;
+    return dma_memory_read(ohci->as, addr + ohci->localmem_base,
+                           hcca, sizeof(*hcca));
 }
 
 static inline int ohci_put_ed(OHCIState *ohci,
@@ -610,23 +619,22 @@
 static inline int ohci_put_iso_td(OHCIState *ohci,
                                   dma_addr_t addr, struct ohci_iso_td *td)
 {
-    return (put_dwords(ohci, addr, (uint32_t *)td, 4) &&
-            put_words(ohci, addr + 16, td->offset, 8));
+    return put_dwords(ohci, addr, (uint32_t *)td, 4 ||
+           put_words(ohci, addr + 16, td->offset, 8));
 }
 
 static inline int ohci_put_hcca(OHCIState *ohci,
                                 dma_addr_t addr, struct ohci_hcca *hcca)
 {
-    dma_memory_write(ohci->as,
-                     addr + ohci->localmem_base + HCCA_WRITEBACK_OFFSET,
-                     (char *)hcca + HCCA_WRITEBACK_OFFSET,
-                     HCCA_WRITEBACK_SIZE);
-    return 1;
+    return dma_memory_write(ohci->as,
+                            addr + ohci->localmem_base + HCCA_WRITEBACK_OFFSET,
+                            (char *)hcca + HCCA_WRITEBACK_OFFSET,
+                            HCCA_WRITEBACK_SIZE);
 }
 
 /* Read/Write the contents of a TD from/to main memory.  */
-static void ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
-                         uint8_t *buf, int len, DMADirection dir)
+static int ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
+                        uint8_t *buf, int len, DMADirection dir)
 {
     dma_addr_t ptr, n;
 
@@ -634,18 +642,26 @@
     n = 0x1000 - (ptr & 0xfff);
     if (n > len)
         n = len;
-    dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir);
-    if (n == len)
-        return;
+
+    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
+        return -1;
+    }
+    if (n == len) {
+        return 0;
+    }
     ptr = td->be & ~0xfffu;
     buf += n;
-    dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, len - n, dir);
+    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
+                      len - n, dir)) {
+        return -1;
+    }
+    return 0;
 }
 
 /* Read/Write the contents of an ISO TD from/to main memory.  */
-static void ohci_copy_iso_td(OHCIState *ohci,
-                             uint32_t start_addr, uint32_t end_addr,
-                             uint8_t *buf, int len, DMADirection dir)
+static int ohci_copy_iso_td(OHCIState *ohci,
+                            uint32_t start_addr, uint32_t end_addr,
+                            uint8_t *buf, int len, DMADirection dir)
 {
     dma_addr_t ptr, n;
 
@@ -653,12 +669,20 @@
     n = 0x1000 - (ptr & 0xfff);
     if (n > len)
         n = len;
-    dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir);
-    if (n == len)
-        return;
+
+    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
+        return -1;
+    }
+    if (n == len) {
+        return 0;
+    }
     ptr = end_addr & ~0xfffu;
     buf += n;
-    dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, len - n, dir);
+    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
+                      len - n, dir)) {
+        return -1;
+    }
+    return 0;
 }
 
 static void ohci_process_lists(OHCIState *ohci, int completion);
@@ -698,8 +722,9 @@
 
     addr = ed->head & OHCI_DPTR_MASK;
 
-    if (!ohci_read_iso_td(ohci, addr, &iso_td)) {
+    if (ohci_read_iso_td(ohci, addr, &iso_td)) {
         printf("usb-ohci: ISO_TD read error at %x\n", addr);
+        ohci_die(ohci);
         return 0;
     }
 
@@ -740,7 +765,10 @@
         i = OHCI_BM(iso_td.flags, TD_DI);
         if (i < ohci->done_count)
             ohci->done_count = i;
-        ohci_put_iso_td(ohci, addr, &iso_td);
+        if (ohci_put_iso_td(ohci, addr, &iso_td)) {
+            ohci_die(ohci);
+            return 1;
+        }
         return 0;
     }
 
@@ -821,8 +849,11 @@
     }
 
     if (len && dir != OHCI_TD_DIR_IN) {
-        ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, len,
-                         DMA_DIRECTION_TO_DEVICE);
+        if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, len,
+                             DMA_DIRECTION_TO_DEVICE)) {
+            ohci_die(ohci);
+            return 1;
+        }
     }
 
     if (!completion) {
@@ -852,8 +883,11 @@
     /* Writeback */
     if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
         /* IN transfer succeeded */
-        ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, ret,
-                         DMA_DIRECTION_FROM_DEVICE);
+        if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, ret,
+                             DMA_DIRECTION_FROM_DEVICE)) {
+            ohci_die(ohci);
+            return 1;
+        }
         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
                     OHCI_CC_NOERROR);
         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
@@ -910,7 +944,9 @@
         if (i < ohci->done_count)
             ohci->done_count = i;
     }
-    ohci_put_iso_td(ohci, addr, &iso_td);
+    if (ohci_put_iso_td(ohci, addr, &iso_td)) {
+        ohci_die(ohci);
+    }
     return 1;
 }
 
@@ -943,8 +979,9 @@
 #endif
         return 1;
     }
-    if (!ohci_read_td(ohci, addr, &td)) {
+    if (ohci_read_td(ohci, addr, &td)) {
         fprintf(stderr, "usb-ohci: TD read error at %x\n", addr);
+        ohci_die(ohci);
         return 0;
     }
 
@@ -997,8 +1034,10 @@
                 pktlen = len;
             }
             if (!completion) {
-                ohci_copy_td(ohci, &td, ohci->usb_buf, pktlen,
-                             DMA_DIRECTION_TO_DEVICE);
+                if (ohci_copy_td(ohci, &td, ohci->usb_buf, pktlen,
+                                 DMA_DIRECTION_TO_DEVICE)) {
+                    ohci_die(ohci);
+                }
             }
         }
     }
@@ -1055,8 +1094,10 @@
 
     if (ret >= 0) {
         if (dir == OHCI_TD_DIR_IN) {
-            ohci_copy_td(ohci, &td, ohci->usb_buf, ret,
-                         DMA_DIRECTION_FROM_DEVICE);
+            if (ohci_copy_td(ohci, &td, ohci->usb_buf, ret,
+                             DMA_DIRECTION_FROM_DEVICE)) {
+                ohci_die(ohci);
+            }
 #ifdef DEBUG_PACKET
             DPRINTF("  data:");
             for (i = 0; i < ret; i++)
@@ -1133,7 +1174,10 @@
     if (i < ohci->done_count)
         ohci->done_count = i;
 exit_no_retire:
-    ohci_put_td(ohci, addr, &td);
+    if (ohci_put_td(ohci, addr, &td)) {
+        ohci_die(ohci);
+        return 1;
+    }
     return OHCI_BM(td.flags, TD_CC) != OHCI_CC_NOERROR;
 }
 
@@ -1151,8 +1195,9 @@
         return 0;
 
     for (cur = head; cur; cur = next_ed) {
-        if (!ohci_read_ed(ohci, cur, &ed)) {
+        if (ohci_read_ed(ohci, cur, &ed)) {
             fprintf(stderr, "usb-ohci: ED read error at %x\n", cur);
+            ohci_die(ohci);
             return 0;
         }
 
@@ -1194,7 +1239,10 @@
             }
         }
 
-        ohci_put_ed(ohci, cur, &ed);
+        if (ohci_put_ed(ohci, cur, &ed)) {
+            ohci_die(ohci);
+            return 0;
+        }
     }
 
     return active;
@@ -1236,7 +1284,11 @@
     OHCIState *ohci = opaque;
     struct ohci_hcca hcca;
 
-    ohci_read_hcca(ohci, ohci->hcca, &hcca);
+    if (ohci_read_hcca(ohci, ohci->hcca, &hcca)) {
+        fprintf(stderr, "usb-ohci: HCCA read error at %x\n", ohci->hcca);
+        ohci_die(ohci);
+        return;
+    }
 
     /* Process all the lists at the end of the frame */
     if (ohci->ctl & OHCI_CTL_PLE) {
@@ -1257,6 +1309,11 @@
     ohci->old_ctl = ohci->ctl;
     ohci_process_lists(ohci, 0);
 
+    /* Stop if UnrecoverableError happened or ohci_sof will crash */
+    if (ohci->intr_status & OHCI_INTR_UE) {
+        return;
+    }
+
     /* Frame boundary, so do EOF stuf here */
     ohci->frt = ohci->fit;
 
@@ -1282,7 +1339,9 @@
     ohci_sof(ohci);
 
     /* Writeback HCCA */
-    ohci_put_hcca(ohci, ohci->hcca, &hcca);
+    if (ohci_put_hcca(ohci, ohci->hcca, &hcca)) {
+        ohci_die(ohci);
+    }
 }
 
 /* Start sending SOF tokens across the USB bus, lists are processed in
@@ -1296,7 +1355,7 @@
 
     if (ohci->eof_timer == NULL) {
         fprintf(stderr, "usb-ohci: %s: qemu_new_timer_ns failed\n", ohci->name);
-        /* TODO: Signal unrecoverable error */
+        ohci_die(ohci);
         return 0;
     }
 
@@ -1857,6 +1916,22 @@
     uint32_t firstport;
 } OHCIPCIState;
 
+/** A typical O/EHCI will stop operating, set itself into error state
+ * (which can be queried by MMIO) and will set PERR in its config
+ * space to signal that it got an error
+ */
+static void ohci_die(OHCIState *ohci)
+{
+    OHCIPCIState *dev = container_of(ohci, OHCIPCIState, state);
+
+    fprintf(stderr, "%s: DMA error\n", __func__);
+
+    ohci_set_interrupt(ohci, OHCI_INTR_UE);
+    ohci_bus_stop(ohci);
+    pci_set_word(dev->parent_obj.config + PCI_STATUS,
+                 PCI_STATUS_DETECTED_PARITY);
+}
+
 static int usb_ohci_initfn_pci(PCIDevice *dev)
 {
     OHCIPCIState *ohci = PCI_OHCI(dev);
@@ -1917,6 +1992,7 @@
     k->device_id = PCI_DEVICE_ID_APPLE_IPID_USB;
     k->class_id = PCI_CLASS_SERIAL_USB;
     k->no_hotplug = 1;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     dc->desc = "Apple USB Controller";
     dc->props = ohci_pci_properties;
 }
@@ -1939,6 +2015,7 @@
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = ohci_realize_pxa;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     dc->desc = "OHCI USB Controller";
     dc->props = ohci_sysbus_properties;
 }
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 066072e..ac82833 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -189,6 +189,7 @@
 
 static void uhci_async_cancel(UHCIAsync *async);
 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
+static void uhci_resume(void *opaque);
 
 static inline int32_t uhci_queue_token(UHCI_TD *td)
 {
@@ -498,6 +499,12 @@
             return;
         }
         s->cmd = val;
+        if (val & UHCI_CMD_EGSM) {
+            if ((s->ports[0].ctrl & UHCI_PORT_RD) ||
+                (s->ports[1].ctrl & UHCI_PORT_RD)) {
+                uhci_resume(s);
+            }
+        }
         break;
     case 0x02:
         s->status &= ~val;
@@ -1315,6 +1322,7 @@
     k->no_hotplug = 1;
     dc->vmsd = &vmstate_uhci;
     dc->props = uhci_properties;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     u->info = *info;
 }
 
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 9ba3e3e..ff5f681 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1429,7 +1429,6 @@
 {
     XHCISlot *slot;
     XHCIEPContext *epctx;
-    USBDevice *dev;
 
     trace_usb_xhci_ep_reset(slotid, epid);
     assert(slotid >= 1 && slotid <= xhci->numslots);
@@ -1465,8 +1464,8 @@
         ep |= 0x80;
     }
 
-    dev = xhci->slots[slotid-1].uport->dev;
-    if (!dev) {
+    if (!xhci->slots[slotid-1].uport ||
+        !xhci->slots[slotid-1].uport->dev) {
         return CC_USB_TRANSACTION_ERROR;
     }
 
@@ -1741,6 +1740,7 @@
     trace_usb_xhci_xfer_error(xfer, xfer->packet.status);
     switch (xfer->packet.status) {
     case USB_RET_NODEV:
+    case USB_RET_IOERROR:
         xfer->status = CC_USB_TRANSACTION_ERROR;
         xhci_xfer_report(xfer);
         xhci_stall_ep(xfer);
@@ -3591,6 +3591,7 @@
     dc->vmsd    = &vmstate_xhci;
     dc->props   = xhci_properties;
     dc->reset   = xhci_reset;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     k->init         = usb_xhci_initfn;
     k->vendor_id    = PCI_VENDOR_ID_NEC;
     k->device_id    = PCI_DEVICE_ID_NEC_UPD720200;
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index e2f3cc8..f660770 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1351,6 +1351,7 @@
     uc->flush_ep_queue = usb_host_flush_ep_queue;
     dc->vmsd = &vmstate_usb_host;
     dc->props = usb_host_dev_properties;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static TypeInfo usb_host_dev_info = {
diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index ca09a89..7901f4c 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -1530,6 +1530,7 @@
     uc->handle_destroy = usb_host_handle_destroy;
     dc->vmsd = &vmstate_usb_host;
     dc->props = usb_host_dev_properties;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo usb_host_dev_info = {
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index a594e95..e3b9f32 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -1334,6 +1334,7 @@
     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
 
     qemu_chr_delete(dev->cs);
+    dev->cs = NULL;
     /* Note must be done after qemu_chr_close, as that causes a close event */
     qemu_bh_delete(dev->chardev_close_bh);
 
@@ -2362,6 +2363,7 @@
     uc->ep_stopped     = usbredir_ep_stopped;
     dc->vmsd           = &usbredir_vmstate;
     dc->props          = usbredir_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo usbredir_dev_info = {
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 337cfa5..aac7f83 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -392,6 +392,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_balloon_device_exit;
     dc->props = virtio_balloon_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     vdc->init = virtio_balloon_device_init;
     vdc->get_config = virtio_balloon_get_config;
     vdc->set_config = virtio_balloon_set_config;
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 54d6679..88cf994 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -370,6 +370,7 @@
 
     dc->realize = virtio_mmio_realizefn;
     dc->reset = virtio_mmio_reset;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo virtio_mmio_info = {
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c38cfd1..d37037e 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -911,6 +911,7 @@
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_9P;
     pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
     pcidev_k->class_id = 0x2;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_9p_pci_properties;
 }
 
@@ -1065,6 +1066,7 @@
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_blk_pci_properties;
     k->init = virtio_blk_pci_init;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
@@ -1135,6 +1137,7 @@
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_scsi_pci_init_pci;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_scsi_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
@@ -1191,6 +1194,7 @@
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = vhost_scsi_pci_init_pci;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = vhost_scsi_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
@@ -1271,6 +1275,7 @@
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_balloon_pci_init;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = virtio_balloon_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_BALLOON;
@@ -1356,6 +1361,7 @@
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_serial_pci_init;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->props = virtio_serial_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_CONSOLE;
@@ -1417,6 +1423,7 @@
     k->device_id = PCI_DEVICE_ID_VIRTIO_NET;
     k->revision = VIRTIO_PCI_ABI_VERSION;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = virtio_net_properties;
     vpciklass->init = virtio_net_pci_init;
 }
@@ -1468,6 +1475,7 @@
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
     k->init = virtio_rng_pci_init;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = virtio_rng_pci_properties;
 
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index cb787c7..bac8421 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -207,6 +207,7 @@
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_rng_device_exit;
     dc->props = virtio_rng_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     vdc->init = virtio_rng_device_init;
     vdc->get_features = get_features;
 }
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 85aebc2..2e064ba 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -451,6 +451,7 @@
     k->class_id = PCI_CLASS_SYSTEM_OTHER;
     dc->reset = i6300esb_reset;
     dc->vmsd = &vmstate_i6300esb;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo i6300esb_info = {
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index c788554..e97b4c3 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -137,6 +137,7 @@
     dc->realize = wdt_ib700_realize;
     dc->reset = wdt_ib700_reset;
     dc->vmsd = &vmstate_ib700;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo wdt_ib700_info = {
diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index 6a8ba7e..79bf0b3 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -428,6 +428,7 @@
     k->subsystem_vendor_id = PCI_VENDOR_ID_XEN;
     k->subsystem_id = PCI_DEVICE_ID_XEN_PLATFORM;
     k->revision = 1;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc = "XEN platform pci device";
     dc->reset = platform_reset;
     dc->vmsd = &vmstate_xen_platform;
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index d15a729..ca2d460 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -830,6 +830,7 @@
     k->exit = xen_pt_unregister_device;
     k->config_read = xen_pt_pci_read_config;
     k->config_write = xen_pt_pci_write_config;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc = "Assign an host PCI device with Xen";
     dc->props = xen_pci_passthrough_properties;
 };
diff --git a/include/block/coroutine.h b/include/block/coroutine.h
index 377805a..1f2db3e 100644
--- a/include/block/coroutine.h
+++ b/include/block/coroutine.h
@@ -130,12 +130,17 @@
  *
  * Returns true if a coroutine was restarted, false if the queue is empty.
  */
-bool qemu_co_queue_next(CoQueue *queue);
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
 
 /**
  * Restarts all coroutines in the CoQueue and leaves the queue empty.
  */
-void qemu_co_queue_restart_all(CoQueue *queue);
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
+
+/**
+ * Enter the next coroutine in the queue
+ */
+bool qemu_co_enter_next(CoQueue *queue);
 
 /**
  * Checks if the CoQueue is empty.
diff --git a/include/elf.h b/include/elf.h
index cf0d3e2..58bfbf8 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -1348,11 +1348,17 @@
 
 /* Notes used in ET_CORE */
 #define NT_PRSTATUS	1
+#define NT_FPREGSET     2
 #define NT_PRFPREG	2
 #define NT_PRPSINFO	3
 #define NT_TASKSTRUCT	4
 #define NT_AUXV		6
 #define NT_PRXFPREG     0x46e62b7f      /* copied from gdb5.1/include/elf/common.h */
+#define NT_S390_PREFIX  0x305           /* s390 prefix register */
+#define NT_S390_CTRS    0x304           /* s390 control registers */
+#define NT_S390_TODPREG 0x303           /* s390 TOD programmable register */
+#define NT_S390_TODCMP  0x302           /* s390 TOD clock comparator register */
+#define NT_S390_TIMER   0x301           /* s390 timer register */
 
 
 /* Note header in a PT_NOTE section */
diff --git a/include/hw/char/escc.h b/include/hw/char/escc.h
index bda3213..2742d70 100644
--- a/include/hw/char/escc.h
+++ b/include/hw/char/escc.h
@@ -2,6 +2,7 @@
 #define HW_ESCC_H 1
 
 /* escc.c */
+#define TYPE_ESCC "escc"
 #define ESCC_SIZE 4
 MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
               CharDriverState *chrA, CharDriverState *chrB,
diff --git a/include/hw/lm32/lm32_juart.h b/include/hw/char/lm32_juart.h
similarity index 65%
rename from include/hw/lm32/lm32_juart.h
rename to include/hw/char/lm32_juart.h
index 67fc586..70dc416 100644
--- a/include/hw/lm32/lm32_juart.h
+++ b/include/hw/char/lm32_juart.h
@@ -1,7 +1,9 @@
-#ifndef QEMU_HW_LM32_JUART_H
-#define QEMU_HW_LM32_JUART_H
+#ifndef QEMU_HW_CHAR_LM32_JUART_H
+#define QEMU_HW_CHAR_LM32_JUART_H
 
-#include "qemu-common.h"
+#include "hw/qdev.h"
+
+#define TYPE_LM32_JUART "lm32-juart"
 
 uint32_t lm32_juart_get_jtx(DeviceState *d);
 uint32_t lm32_juart_get_jrx(DeviceState *d);
diff --git a/include/hw/i386/ioapic.h b/include/hw/i386/ioapic.h
index 86e63da..6245388 100644
--- a/include/hw/i386/ioapic.h
+++ b/include/hw/i386/ioapic.h
@@ -21,6 +21,7 @@
 #define HW_IOAPIC_H
 
 #define IOAPIC_NUM_PINS 24
+#define IO_APIC_DEFAULT_ADDRESS 0xfec00000
 
 void ioapic_eoi_broadcast(int vector);
 
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 7fb97b0..3a0c4e3 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -18,7 +18,6 @@
 } PcPciInfo;
 
 struct PcGuestInfo {
-    PcPciInfo pci_info;
     bool has_pci_info;
     FWCfgState *fw_cfg;
 };
@@ -101,6 +100,16 @@
 PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
                                 ram_addr_t above_4g_mem_size);
 
+#define PCI_HOST_PROP_PCI_HOLE_START   "pci-hole-start"
+#define PCI_HOST_PROP_PCI_HOLE_END     "pci-hole-end"
+#define PCI_HOST_PROP_PCI_HOLE64_START "pci-hole64-start"
+#define PCI_HOST_PROP_PCI_HOLE64_END   "pci-hole64-end"
+#define PCI_HOST_PROP_PCI_HOLE64_SIZE  "pci-hole64-size"
+#define DEFAULT_PCI_HOLE64_SIZE (1ULL << 31)
+
+void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
+                        uint64_t pci_hole64_size);
+
 FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
@@ -150,8 +159,7 @@
                     ram_addr_t ram_size,
                     hwaddr pci_hole_start,
                     hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
+                    ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_memory,
                     MemoryRegion *ram_memory);
 
@@ -235,6 +243,10 @@
             .driver   = "virtio-net-pci",\
             .property = "any_layout",\
             .value    = "off",\
+        },{\
+            .driver = TYPE_X86_CPU,\
+            .property = "pmu",\
+            .value = "on",\
         }
 
 #define PC_COMPAT_1_4 \
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 3cb631e..6eb7ab6 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -55,9 +55,11 @@
     MemoryRegion smram_region;
     MemoryRegion pci_hole;
     MemoryRegion pci_hole_64bit;
+    PcPciInfo pci_info;
     uint8_t smm_enabled;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
+    uint64_t pci_hole64_size;
     PcGuestInfo *guest_info;
 } MCHPCIState;
 
diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
index 1e23dbf..93f9511 100644
--- a/include/hw/pci-host/spapr.h
+++ b/include/hw/pci-host/spapr.h
@@ -52,14 +52,14 @@
     sPAPRTCETable *tcet;
     AddressSpace iommu_as;
 
-    struct {
+    struct spapr_pci_lsi {
         uint32_t irq;
     } lsi_table[PCI_NUM_PINS];
 
-    struct {
+    struct spapr_pci_msi {
         uint32_t config_addr;
         uint32_t irq;
-        int nvec;
+        uint32_t nvec;
     } msi_table[SPAPR_MSIX_MAX_DEVS];
 
     QLIST_ENTRY(sPAPRPHBState) list;
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
index 66762f6..9df1788 100644
--- a/include/hw/pci/pci_bus.h
+++ b/include/hw/pci/pci_bus.h
@@ -53,8 +53,13 @@
     MemoryRegion alias_vga[QEMU_PCI_VGA_NUM_REGIONS];
 };
 
+#define TYPE_PCI_BRIDGE "base-pci-bridge"
+#define PCI_BRIDGE(obj) OBJECT_CHECK(PCIBridge, (obj), TYPE_PCI_BRIDGE)
+
 struct PCIBridge {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
 
     /* private member */
     PCIBus sec_bus;
diff --git a/include/hw/pci/pcie_port.h b/include/hw/pci/pcie_port.h
index d89aa61..e167bf7 100644
--- a/include/hw/pci/pcie_port.h
+++ b/include/hw/pci/pcie_port.h
@@ -24,8 +24,13 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_bus.h"
 
+#define TYPE_PCIE_PORT "pcie-port"
+#define PCIE_PORT(obj) OBJECT_CHECK(PCIEPort, (obj), TYPE_PCIE_PORT)
+
 struct PCIEPort {
-    PCIBridge   br;
+    /*< private >*/
+    PCIBridge   parent_obj;
+    /*< public >*/
 
     /* pci express switch port */
     uint8_t     port;
@@ -33,8 +38,13 @@
 
 void pcie_port_init_reg(PCIDevice *d);
 
+#define TYPE_PCIE_SLOT "pcie-slot"
+#define PCIE_SLOT(obj) OBJECT_CHECK(PCIESlot, (obj), TYPE_PCIE_SLOT)
+
 struct PCIESlot {
-    PCIEPort    port;
+    /*< private >*/
+    PCIEPort    parent_obj;
+    /*< public >*/
 
     /* pci express switch port with slot */
     uint8_t     chassis;
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index de95480..9fc1972 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -7,30 +7,36 @@
 struct VIOsPAPRBus;
 struct sPAPRPHBState;
 struct sPAPRNVRAM;
-struct icp_state;
+
+#define HPTE64_V_HPTE_DIRTY     0x0000000000000040ULL
 
 typedef struct sPAPREnvironment {
     struct VIOsPAPRBus *vio_bus;
     QLIST_HEAD(, sPAPRPHBState) phbs;
     struct sPAPRNVRAM *nvram;
-    struct icp_state *icp;
+    XICSState *icp;
 
     hwaddr ram_limit;
     void *htab;
-    long htab_shift;
+    uint32_t htab_shift;
     hwaddr rma_size;
     int vrma_adjust;
     hwaddr fdt_addr, rtas_addr;
     long rtas_size;
     void *fdt_skel;
     target_ulong entry_point;
-    int next_irq;
-    int rtc_offset;
+    uint32_t next_irq;
+    uint64_t rtc_offset;
     char *cpu_model;
     bool has_graphics;
 
     uint32_t epow_irq;
     Notifier epow_notifier;
+
+    /* Migration state */
+    int htab_save_index;
+    bool htab_first_pass;
+    int htab_fd;
 } sPAPREnvironment;
 
 #define H_SUCCESS         0
@@ -334,10 +340,6 @@
 #define SPAPR_TCE_PAGE_SIZE    (1ULL << SPAPR_TCE_PAGE_SHIFT)
 #define SPAPR_TCE_PAGE_MASK    (SPAPR_TCE_PAGE_SIZE - 1)
 
-typedef struct sPAPRTCE {
-    uint64_t tce;
-} sPAPRTCE;
-
 #define SPAPR_VIO_BASE_LIOBN    0x00000000
 #define SPAPR_PCI_BASE_LIOBN    0x80000000
 
@@ -345,14 +347,27 @@
 
 typedef struct sPAPRTCETable sPAPRTCETable;
 
-void spapr_iommu_init(void);
+#define TYPE_SPAPR_TCE_TABLE "spapr-tce-table"
+#define SPAPR_TCE_TABLE(obj) \
+    OBJECT_CHECK(sPAPRTCETable, (obj), TYPE_SPAPR_TCE_TABLE)
+
+struct sPAPRTCETable {
+    DeviceState parent;
+    uint32_t liobn;
+    uint32_t window_size;
+    uint32_t nb_table;
+    uint64_t *table;
+    bool bypass;
+    int fd;
+    MemoryRegion iommu;
+    QLIST_ENTRY(sPAPRTCETable) list;
+};
+
 void spapr_events_init(sPAPREnvironment *spapr);
 void spapr_events_fdt_skel(void *fdt, uint32_t epow_irq);
 sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn,
                                    size_t window_size);
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet);
-void spapr_tce_free(sPAPRTCETable *tcet);
-void spapr_tce_reset(sPAPRTCETable *tcet);
 void spapr_tce_set_bypass(sPAPRTCETable *tcet, bool bypass);
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
                  uint32_t liobn, uint64_t window, uint32_t size);
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 3609327..46edc2a 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -134,4 +134,9 @@
 
 void spapr_vio_quiesce(void);
 
+extern const VMStateDescription vmstate_spapr_vio;
+
+#define VMSTATE_SPAPR_VIO(_f, _s) \
+    VMSTATE_STRUCT(_f, _s, 0, vmstate_spapr_vio, VIOsPAPRDevice)
+
 #endif /* _HW_SPAPR_VIO_H */
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index 6bce042..66364c5 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -27,15 +27,77 @@
 #if !defined(__XICS_H__)
 #define __XICS_H__
 
+#include "hw/sysbus.h"
+
+#define TYPE_XICS "xics"
+#define XICS(obj) OBJECT_CHECK(XICSState, (obj), TYPE_XICS)
+
 #define XICS_IPI        0x2
-#define XICS_IRQ_BASE   0x10
+#define XICS_BUID       0x1
+#define XICS_IRQ_BASE   (XICS_BUID << 12)
 
-struct icp_state;
+/*
+ * We currently only support one BUID which is our interrupt base
+ * (the kernel implementation supports more but we don't exploit
+ *  that yet)
+ */
+typedef struct XICSState XICSState;
+typedef struct ICPState ICPState;
+typedef struct ICSState ICSState;
+typedef struct ICSIRQState ICSIRQState;
 
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq);
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi);
+struct XICSState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+    uint32_t nr_servers;
+    uint32_t nr_irqs;
+    ICPState *ss;
+    ICSState *ics;
+};
 
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs);
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu);
+#define TYPE_ICP "icp"
+#define ICP(obj) OBJECT_CHECK(ICPState, (obj), TYPE_ICP)
+
+struct ICPState {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+    uint32_t xirr;
+    uint8_t pending_priority;
+    uint8_t mfrr;
+    qemu_irq output;
+};
+
+#define TYPE_ICS "ics"
+#define ICS(obj) OBJECT_CHECK(ICSState, (obj), TYPE_ICS)
+
+struct ICSState {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+    uint32_t nr_irqs;
+    uint32_t offset;
+    qemu_irq *qirqs;
+    bool *islsi;
+    ICSIRQState *irqs;
+    XICSState *icp;
+};
+
+struct ICSIRQState {
+    uint32_t server;
+    uint8_t priority;
+    uint8_t saved_priority;
+#define XICS_STATUS_ASSERTED           0x1
+#define XICS_STATUS_SENT               0x2
+#define XICS_STATUS_REJECTED           0x4
+#define XICS_STATUS_MASKED_PENDING     0x8
+    uint8_t status;
+};
+
+qemu_irq xics_get_qirq(XICSState *icp, int irq);
+void xics_set_irq_type(XICSState *icp, int irq, bool lsi);
+
+void xics_cpu_setup(XICSState *icp, PowerPCCPU *cpu);
 
 #endif /* __XICS_H__ */
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 7fbffcb..46972f4 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -4,6 +4,7 @@
 #include "qemu/queue.h"
 #include "qemu/option.h"
 #include "qemu/typedefs.h"
+#include "qemu/bitmap.h"
 #include "qom/object.h"
 #include "hw/irq.h"
 #include "qapi/error.h"
@@ -17,6 +18,34 @@
 #define DEVICE_CLASS(klass) OBJECT_CLASS_CHECK(DeviceClass, (klass), TYPE_DEVICE)
 #define DEVICE_GET_CLASS(obj) OBJECT_GET_CLASS(DeviceClass, (obj), TYPE_DEVICE)
 
+typedef enum DeviceCategory {
+    DEVICE_CATEGORY_BRIDGE,
+    DEVICE_CATEGORY_USB,
+    DEVICE_CATEGORY_STORAGE,
+    DEVICE_CATEGORY_NETWORK,
+    DEVICE_CATEGORY_INPUT,
+    DEVICE_CATEGORY_DISPLAY,
+    DEVICE_CATEGORY_SOUND,
+    DEVICE_CATEGORY_MISC,
+    DEVICE_CATEGORY_MAX
+} DeviceCategory;
+
+static inline const char *qdev_category_get_name(DeviceCategory category)
+{
+    static const char *category_names[DEVICE_CATEGORY_MAX] = {
+        [DEVICE_CATEGORY_BRIDGE]  = "Controller/Bridge/Hub",
+        [DEVICE_CATEGORY_USB]     = "USB",
+        [DEVICE_CATEGORY_STORAGE] = "Storage",
+        [DEVICE_CATEGORY_NETWORK] = "Network",
+        [DEVICE_CATEGORY_INPUT]   = "Input",
+        [DEVICE_CATEGORY_DISPLAY] = "Display",
+        [DEVICE_CATEGORY_SOUND]   = "Sound",
+        [DEVICE_CATEGORY_MISC]    = "Misc",
+    };
+
+    return category_names[category];
+};
+
 typedef int (*qdev_initfn)(DeviceState *dev);
 typedef int (*qdev_event)(DeviceState *dev);
 typedef void (*qdev_resetfn)(DeviceState *dev);
@@ -80,6 +109,7 @@
     ObjectClass parent_class;
     /*< public >*/
 
+    DECLARE_BITMAP(categories, DEVICE_CATEGORY_MAX);
     const char *fw_name;
     const char *desc;
     Property *props;
diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index 39448b7..692f82e 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -15,6 +15,7 @@
 extern PropertyInfo qdev_prop_hex8;
 extern PropertyInfo qdev_prop_hex32;
 extern PropertyInfo qdev_prop_hex64;
+extern PropertyInfo qdev_prop_size;
 extern PropertyInfo qdev_prop_string;
 extern PropertyInfo qdev_prop_chr;
 extern PropertyInfo qdev_prop_ptr;
@@ -116,6 +117,8 @@
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex32, uint32_t)
 #define DEFINE_PROP_HEX64(_n, _s, _f, _d)                       \
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex64, uint64_t)
+#define DEFINE_PROP_SIZE(_n, _s, _f, _d)                       \
+    DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_size, uint64_t)
 #define DEFINE_PROP_PCI_DEVFN(_n, _s, _f, _d)                   \
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t)
 
diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 8c17165..bb50a87 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -42,7 +42,10 @@
 } SysBusDeviceClass;
 
 struct SysBusDevice {
-    DeviceState qdev;
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+
     int num_irq;
     qemu_irq irqs[QDEV_MAX_IRQ];
     qemu_irq *irqp[QDEV_MAX_IRQ];
@@ -55,10 +58,6 @@
     pio_addr_t pio[QDEV_MAX_PIO];
 };
 
-/* Macros to compensate for lack of type inheritance in C.  */
-#define FROM_SYSBUS(type, dev) DO_UPCAST(type, busdev, dev)
-
-void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory);
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
 void sysbus_init_irq(SysBusDevice *dev, qemu_irq *p);
diff --git a/include/hw/timer/m48t59.h b/include/hw/timer/m48t59.h
index 59337fa..8217522 100644
--- a/include/hw/timer/m48t59.h
+++ b/include/hw/timer/m48t59.h
@@ -21,6 +21,9 @@
                           uint32_t initrd_image, uint32_t initrd_size,
                           uint32_t NVRAM_image,
                           int width, int height, int depth);
+
+#define TYPE_SYSBUS_M48T59 "m48t59"
+
 typedef struct M48t59State M48t59State;
 
 void m48t59_write (void *private, uint32_t addr, uint32_t val);
diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index fc71853..b87cf49 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -125,6 +125,7 @@
     unsigned short sector_mask;
     VMChangeStateEntry *change;
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    Notifier migration_state_notifier;
     struct VirtIOBlockDataPlane *dataplane;
 #endif
 } VirtIOBlock;
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 08c772d..140e6b4 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -90,7 +90,7 @@
 
 void add_migration_state_change_notifier(Notifier *notify);
 void remove_migration_state_change_notifier(Notifier *notify);
-bool migration_is_active(MigrationState *);
+bool migration_in_setup(MigrationState *);
 bool migration_has_finished(MigrationState *);
 bool migration_has_failed(MigrationState *);
 MigrationState *migrate_get_current(void);
diff --git a/include/qemu/option.h b/include/qemu/option.h
index 13f5e72..7a58e47 100644
--- a/include/qemu/option.h
+++ b/include/qemu/option.h
@@ -73,6 +73,8 @@
     QEMUOptionParameter *list);
 QEMUOptionParameter *parse_option_parameters(const char *param,
     QEMUOptionParameter *list, QEMUOptionParameter *dest);
+void parse_option_size(const char *name, const char *value,
+                       uint64_t *ret, Error **errp);
 void free_option_parameters(QEMUOptionParameter *list);
 void print_option_parameters(QEMUOptionParameter *list);
 void print_option_help(QEMUOptionParameter *list);
diff --git a/include/sysemu/char.h b/include/sysemu/char.h
index e65e4a4..8053130 100644
--- a/include/sysemu/char.h
+++ b/include/sysemu/char.h
@@ -77,6 +77,7 @@
     int explicit_fe_open;
     int explicit_be_open;
     int avail_connections;
+    int is_mux;
     QemuOpts *opts;
     QTAILQ_ENTRY(CharDriverState) next;
 };
diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index 3caeb66..d7a77b6 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -103,7 +103,6 @@
 
 extern int vga_interface_type;
 #define xenfb_enabled (vga_interface_type == VGA_XENFB)
-#define qxl_enabled (vga_interface_type == VGA_QXL)
 
 extern int graphic_width;
 extern int graphic_height;
diff --git a/include/ui/qemu-spice.h b/include/ui/qemu-spice.h
index eba6d77..c6c756b 100644
--- a/include/ui/qemu-spice.h
+++ b/include/ui/qemu-spice.h
@@ -27,6 +27,7 @@
 #include "monitor/monitor.h"
 
 extern int using_spice;
+extern int spice_displays;
 
 void qemu_spice_init(void);
 void qemu_spice_input_init(void);
@@ -57,6 +58,7 @@
 #include "monitor/monitor.h"
 
 #define using_spice 0
+#define spice_displays 0
 static inline int qemu_spice_set_passwd(const char *passwd,
                                         bool fail_if_connected,
                                         bool disconnect_if_connected)
diff --git a/linux-user/signal.c b/linux-user/signal.c
index a5e8906..23d65da 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -1552,7 +1552,7 @@
 static long do_sigreturn_v1(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct sigframe_v1 *frame;
+        struct sigframe_v1 *frame = NULL;
 	target_sigset_t set;
         sigset_t host_set;
         int i;
@@ -1562,10 +1562,11 @@
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1693,17 +1694,18 @@
 static long do_sigreturn_v2(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct sigframe_v2 *frame;
+        struct sigframe_v2 *frame = NULL;
 
 	/*
 	 * Since we stacked the signal on a 64-bit boundary,
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1731,7 +1733,7 @@
 static long do_rt_sigreturn_v1(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct rt_sigframe_v1 *frame;
+        struct rt_sigframe_v1 *frame = NULL;
         sigset_t host_set;
 
 	/*
@@ -1739,10 +1741,11 @@
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1772,17 +1775,18 @@
 static long do_rt_sigreturn_v2(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct rt_sigframe_v2 *frame;
+        struct rt_sigframe_v2 *frame = NULL;
 
 	/*
 	 * Since we stacked the signal on a 64-bit boundary,
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -4603,7 +4607,7 @@
 {
     struct target_sigcontext *sc = NULL;
     struct target_mcontext *sr = NULL;
-    target_ulong sr_addr, sc_addr;
+    target_ulong sr_addr = 0, sc_addr;
     sigset_t blocked;
     target_sigset_t set;
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 3f6db4b..f986548 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8523,6 +8523,7 @@
       {
           TaskState *ts = ((CPUArchState *)cpu_env)->opaque;
           ts->tp_value = arg1;
+          ret = 0;
           break;
       }
 #else
diff --git a/memory.c b/memory.c
index 1494e95..886f838 100644
--- a/memory.c
+++ b/memory.c
@@ -18,7 +18,7 @@
 #include "exec/ioport.h"
 #include "qemu/bitops.h"
 #include "qom/object.h"
-#include "sysemu/kvm.h"
+#include "trace.h"
 #include <assert.h>
 
 #include "exec/memory-internal.h"
@@ -388,6 +388,7 @@
     uint64_t tmp;
 
     tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr);
+    trace_memory_region_ops_read(mr, addr, tmp, size);
     *value |= (tmp & mask) << shift;
 }
 
@@ -404,6 +405,7 @@
         qemu_flush_coalesced_mmio_buffer();
     }
     tmp = mr->ops->read(mr->opaque, addr, size);
+    trace_memory_region_ops_read(mr, addr, tmp, size);
     *value |= (tmp & mask) << shift;
 }
 
@@ -417,6 +419,7 @@
     uint64_t tmp;
 
     tmp = (*value >> shift) & mask;
+    trace_memory_region_ops_write(mr, addr, tmp, size);
     mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, tmp);
 }
 
@@ -433,6 +436,7 @@
         qemu_flush_coalesced_mmio_buffer();
     }
     tmp = (*value >> shift) & mask;
+    trace_memory_region_ops_write(mr, addr, tmp, size);
     mr->ops->write(mr->opaque, addr, tmp, size);
 }
 
diff --git a/migration.c b/migration.c
index e12e784..1402fa7 100644
--- a/migration.c
+++ b/migration.c
@@ -231,6 +231,7 @@
 
         info->has_status = true;
         info->status = g_strdup("completed");
+        info->has_total_time = true;
         info->total_time = s->total_time;
         info->has_downtime = true;
         info->downtime = s->downtime;
@@ -338,9 +339,9 @@
     notifier_remove(notify);
 }
 
-bool migration_is_active(MigrationState *s)
+bool migration_in_setup(MigrationState *s)
 {
-    return s->state == MIG_STATE_ACTIVE;
+    return s->state == MIG_STATE_SETUP;
 }
 
 bool migration_has_finished(MigrationState *s)
@@ -399,8 +400,8 @@
     MigrationParams params;
     const char *p;
 
-    params.blk = blk;
-    params.shared = inc;
+    params.blk = has_blk && blk;
+    params.shared = has_inc && inc;
 
     if (s->state == MIG_STATE_ACTIVE || s->state == MIG_STATE_SETUP) {
         error_set(errp, QERR_MIGRATION_ACTIVE);
@@ -658,7 +659,9 @@
     qemu_file_set_rate_limit(s->file,
                              s->bandwidth_limit / XFER_LIMIT_RATIO);
 
+    /* Notify before starting migration thread */
+    notifier_list_notify(&migration_state_notifiers, s);
+
     qemu_thread_create(&s->thread, migration_thread, s,
                        QEMU_THREAD_JOINABLE);
-    notifier_list_notify(&migration_state_notifiers, s);
 }
diff --git a/pc-bios/README b/pc-bios/README
index 53b5289..e404a22 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -11,8 +11,8 @@
   firmware implementation. The goal is to implement a 100% IEEE
   1275-1994 (referred to as Open Firmware) compliant firmware.
   The included images for PowerPC (for 32 and 64 bit PPC CPUs),
-  Sparc32 and Sparc64 are built from OpenBIOS 1.1 release (SVN
-  revision 1136).
+  Sparc32 and Sparc64 are built from OpenBIOS SVN revision
+  1198.
 
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
diff --git a/pc-bios/openbios-ppc b/pc-bios/openbios-ppc
index 77eb55d..c6b3319 100644
--- a/pc-bios/openbios-ppc
+++ b/pc-bios/openbios-ppc
Binary files differ
diff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
index c5ba6ae..2aa400c 100644
--- a/pc-bios/openbios-sparc32
+++ b/pc-bios/openbios-sparc32
Binary files differ
diff --git a/pc-bios/openbios-sparc64 b/pc-bios/openbios-sparc64
index c4aaa05..f6ee286 100644
--- a/pc-bios/openbios-sparc64
+++ b/pc-bios/openbios-sparc64
Binary files differ
diff --git a/qapi-schema.json b/qapi-schema.json
index f82d829..a51f7d2 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3362,15 +3362,15 @@
                                  '*rows'   : 'int' } }
 
 ##
-# @ChardevMemory:
+# @ChardevRingbuf:
 #
-# Configuration info for memory chardevs
+# Configuration info for ring buffer chardevs.
 #
-# @size: #optional Ringbuffer size, must be power of two, default is 65536
+# @size: #optional ring buffer size, must be power of two, default is 65536
 #
 # Since: 1.5
 ##
-{ 'type': 'ChardevMemory', 'data': { '*size'  : 'int' } }
+{ 'type': 'ChardevRingbuf', 'data': { '*size'  : 'int' } }
 
 ##
 # @ChardevBackend:
@@ -3397,7 +3397,9 @@
                                        'spicevmc' : 'ChardevSpiceChannel',
                                        'spiceport' : 'ChardevSpicePort',
                                        'vc'     : 'ChardevVC',
-                                       'memory' : 'ChardevMemory' } }
+                                       'ringbuf': 'ChardevRingbuf',
+                                       # next one is just for compatibility
+                                       'memory' : 'ChardevRingbuf' } }
 
 ##
 # @ChardevReturn:
diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c
index d6a4012..6451a21 100644
--- a/qapi/qapi-visit-core.c
+++ b/qapi/qapi-visit-core.c
@@ -263,8 +263,17 @@
 
 void visit_type_size(Visitor *v, uint64_t *obj, const char *name, Error **errp)
 {
+    int64_t value;
     if (!error_is_set(errp)) {
-        (v->type_size ? v->type_size : v->type_uint64)(v, obj, name, errp);
+        if (v->type_size) {
+            v->type_size(v, obj, name, errp);
+        } else if (v->type_uint64) {
+            v->type_uint64(v, obj, name, errp);
+        } else {
+            value = *obj;
+            v->type_int(v, &value, name, errp);
+            *obj = value;
+        }
     }
 }
 
diff --git a/qdev-monitor.c b/qdev-monitor.c
index e5adf6c..410cdcb 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -75,24 +75,27 @@
     return (qdev_class_get_alias(dc) != NULL);
 }
 
-static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
+static void qdev_print_class_devinfo(DeviceClass *dc)
 {
-    DeviceClass *dc;
-    bool *show_no_user = opaque;
+    DeviceCategory category;
 
-    dc = (DeviceClass *)object_class_dynamic_cast(klass, TYPE_DEVICE);
-
-    if (!dc || (show_no_user && !*show_no_user && dc->no_user)) {
+    if (!dc) {
         return;
     }
 
-    error_printf("name \"%s\"", object_class_get_name(klass));
+    error_printf("name \"%s\"", object_class_get_name(OBJECT_CLASS(dc)));
     if (dc->bus_type) {
         error_printf(", bus %s", dc->bus_type);
     }
     if (qdev_class_has_alias(dc)) {
         error_printf(", alias \"%s\"", qdev_class_get_alias(dc));
     }
+    error_printf(", categories");
+    for (category = 0; category < DEVICE_CATEGORY_MAX; ++category) {
+        if (test_bit(category, dc->categories)) {
+            error_printf(" \"%s\"", qdev_category_get_name(category));
+        }
+    }
     if (dc->desc) {
         error_printf(", desc \"%s\"", dc->desc);
     }
@@ -102,6 +105,15 @@
     error_printf("\n");
 }
 
+static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
+{
+    DeviceClass *dc;
+
+    dc = (DeviceClass *)object_class_dynamic_cast(klass, TYPE_DEVICE);
+
+    qdev_print_class_devinfo(dc);
+}
+
 static int set_property(const char *name, const char *value, void *opaque)
 {
     DeviceState *dev = opaque;
@@ -139,6 +151,21 @@
     return NULL;
 }
 
+static void qdev_print_category_devices(DeviceCategory category)
+{
+    DeviceClass *dc;
+    GSList *list, *curr;
+
+    list = object_class_get_list(TYPE_DEVICE, false);
+    for (curr = list; curr; curr = g_slist_next(curr)) {
+        dc = (DeviceClass *)object_class_dynamic_cast(curr->data, TYPE_DEVICE);
+        if (!dc->no_user && test_bit(category, dc->categories)) {
+            qdev_print_class_devinfo(dc);
+        }
+    }
+    g_slist_free(list);
+}
+
 int qdev_device_help(QemuOpts *opts)
 {
     const char *driver;
@@ -147,8 +174,11 @@
 
     driver = qemu_opt_get(opts, "driver");
     if (driver && is_help_option(driver)) {
-        bool show_no_user = false;
-        object_class_foreach(qdev_print_devinfo, TYPE_DEVICE, false, &show_no_user);
+        DeviceCategory category;
+        for (category = 0; category < DEVICE_CATEGORY_MAX; ++category) {
+            qdev_print_category_devices(category);
+        }
+
         return 1;
     }
 
diff --git a/qemu-char.c b/qemu-char.c
index c86ce4b..16f3ad7 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -476,6 +476,46 @@
     mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_IN);
 }
 
+static bool muxes_realized;
+
+/**
+ * Called after processing of default and command-line-specified
+ * chardevs to deliver CHR_EVENT_OPENED events to any FEs attached
+ * to a mux chardev. This is done here to ensure that
+ * output/prompts/banners are only displayed for the FE that has
+ * focus when initial command-line processing/machine init is
+ * completed.
+ *
+ * After this point, any new FE attached to any new or existing
+ * mux will receive CHR_EVENT_OPENED notifications for the BE
+ * immediately.
+ */
+static void muxes_realize_done(Notifier *notifier, void *unused)
+{
+    CharDriverState *chr;
+
+    QTAILQ_FOREACH(chr, &chardevs, next) {
+        if (chr->is_mux) {
+            MuxDriver *d = chr->opaque;
+            int i;
+
+            /* send OPENED to all already-attached FEs */
+            for (i = 0; i < d->mux_cnt; i++) {
+                mux_chr_send_event(d, i, CHR_EVENT_OPENED);
+            }
+            /* mark mux as OPENED so any new FEs will immediately receive
+             * OPENED event
+             */
+            qemu_chr_be_generic_open(chr);
+        }
+    }
+    muxes_realized = true;
+}
+
+static Notifier muxes_realize_notify = {
+    .notify = muxes_realize_done,
+};
+
 static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
 {
     CharDriverState *chr;
@@ -492,6 +532,11 @@
     chr->chr_accept_input = mux_chr_accept_input;
     /* Frontend guest-open / -close notification is not support with muxes */
     chr->chr_set_fe_open = NULL;
+    /* only default to opened state if we've realized the initial
+     * set of muxes
+     */
+    chr->explicit_be_open = muxes_realized ? 0 : 1;
+    chr->is_mux = 1;
 
     return chr;
 }
@@ -2783,8 +2828,8 @@
     chr->opaque = NULL;
 }
 
-static CharDriverState *qemu_chr_open_memory(ChardevMemory *opts,
-                                             Error **errp)
+static CharDriverState *qemu_chr_open_ringbuf(ChardevRingbuf *opts,
+                                              Error **errp)
 {
     CharDriverState *chr;
     RingBufCharDriver *d;
@@ -2796,7 +2841,7 @@
 
     /* The size must be power of 2 */
     if (d->size & (d->size - 1)) {
-        error_setg(errp, "size of memory chardev must be power of two");
+        error_setg(errp, "size of ringbuf chardev must be power of two");
         goto fail;
     }
 
@@ -3105,17 +3150,17 @@
     backend->pipe->device = g_strdup(device);
 }
 
-static void qemu_chr_parse_memory(QemuOpts *opts, ChardevBackend *backend,
-                                  Error **errp)
+static void qemu_chr_parse_ringbuf(QemuOpts *opts, ChardevBackend *backend,
+                                   Error **errp)
 {
     int val;
 
-    backend->memory = g_new0(ChardevMemory, 1);
+    backend->ringbuf = g_new0(ChardevRingbuf, 1);
 
     val = qemu_opt_get_size(opts, "size", 0);
     if (val != 0) {
-        backend->memory->has_size = true;
-        backend->memory->size = val;
+        backend->ringbuf->has_size = true;
+        backend->ringbuf->size = val;
     }
 }
 
@@ -3723,8 +3768,9 @@
     case CHARDEV_BACKEND_KIND_VC:
         chr = vc_init(backend->vc);
         break;
+    case CHARDEV_BACKEND_KIND_RINGBUF:
     case CHARDEV_BACKEND_KIND_MEMORY:
-        chr = qemu_chr_open_memory(backend->memory, errp);
+        chr = qemu_chr_open_ringbuf(backend->ringbuf, errp);
         break;
     default:
         error_setg(errp, "unknown chardev backend (%d)", backend->kind);
@@ -3774,8 +3820,8 @@
     register_char_driver_qapi("null", CHARDEV_BACKEND_KIND_NULL, NULL);
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
-    register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
-                              qemu_chr_parse_memory);
+    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_RINGBUF,
+                              qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
     register_char_driver_qapi("stdio", CHARDEV_BACKEND_KIND_STDIO,
@@ -3794,6 +3840,14 @@
                               qemu_chr_parse_pipe);
     register_char_driver_qapi("mux", CHARDEV_BACKEND_KIND_MUX,
                               qemu_chr_parse_mux);
+    /* Bug-compatibility: */
+    register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
+                              qemu_chr_parse_ringbuf);
+    /* this must be done after machine init, since we register FEs with muxes
+     * as part of realize functions like serial_isa_realizefn when -nographic
+     * is specified
+     */
+    qemu_add_machine_init_done_notifier(&muxes_realize_notify);
 }
 
 type_init(register_types);
diff --git a/qemu-coroutine-lock.c b/qemu-coroutine-lock.c
index d9fea49..aeb33b9 100644
--- a/qemu-coroutine-lock.c
+++ b/qemu-coroutine-lock.c
@@ -88,16 +88,32 @@
     return true;
 }
 
-bool qemu_co_queue_next(CoQueue *queue)
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue)
 {
+    assert(qemu_in_coroutine());
     return qemu_co_queue_do_restart(queue, true);
 }
 
-void qemu_co_queue_restart_all(CoQueue *queue)
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue)
 {
+    assert(qemu_in_coroutine());
     qemu_co_queue_do_restart(queue, false);
 }
 
+bool qemu_co_enter_next(CoQueue *queue)
+{
+    Coroutine *next;
+
+    next = QTAILQ_FIRST(&queue->entries);
+    if (!next) {
+        return false;
+    }
+
+    QTAILQ_REMOVE(&queue->entries, next, co_queue_next);
+    qemu_coroutine_enter(next, NULL);
+    return true;
+}
+
 bool qemu_co_queue_empty(CoQueue *queue)
 {
     return (QTAILQ_FIRST(&queue->entries) == NULL);
diff --git a/qemu-options.hx b/qemu-options.hx
index 25ecb55..d15338e 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1783,7 +1783,7 @@
     "-chardev msmouse,id=id[,mux=on|off]\n"
     "-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]\n"
     "         [,mux=on|off]\n"
-    "-chardev memory,id=id[,size=size]\n"
+    "-chardev ringbuf,id=id[,size=size]\n"
     "-chardev file,id=id,path=path[,mux=on|off]\n"
     "-chardev pipe,id=id,path=path[,mux=on|off]\n"
 #ifdef _WIN32
@@ -1821,7 +1821,7 @@
 @option{udp},
 @option{msmouse},
 @option{vc},
-@option{memory},
+@option{ringbuf},
 @option{file},
 @option{pipe},
 @option{console},
@@ -1930,7 +1930,7 @@
 @option{cols} and @option{rows} specify that the console be sized to fit a text
 console with the given dimensions.
 
-@item -chardev memory ,id=@var{id} [,size=@var{size}]
+@item -chardev ringbuf ,id=@var{id} [,size=@var{size}]
 
 Create a ring buffer with fixed size @option{size}.
 @var{size} must be a power of two, and defaults to @code{64K}).
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 3298de8..37d38f8 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -30,6 +30,7 @@
     { SCMP_SYS(sendto), 250 },
     { SCMP_SYS(socketcall), 250 },
     { SCMP_SYS(read), 249 },
+    { SCMP_SYS(io_submit), 249 },
     { SCMP_SYS(brk), 248 },
     { SCMP_SYS(clone), 247 },
     { SCMP_SYS(mmap), 247 },
@@ -214,8 +215,10 @@
     { SCMP_SYS(recvmmsg), 241 },
     { SCMP_SYS(prlimit64), 241 },
     { SCMP_SYS(waitid), 241 },
+    { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
-    { SCMP_SYS(io_destroy), 241 }
+    { SCMP_SYS(io_destroy), 241 },
+    { SCMP_SYS(arch_prctl), 240 }
 };
 
 int seccomp_start(void)
diff --git a/qom/cpu.c b/qom/cpu.c
index dbc9fb6..aa95108 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -228,8 +228,6 @@
 {
     CPUState *cpu = CPU(dev);
 
-    qemu_init_vcpu(cpu);
-
     if (dev->hotplugged) {
         cpu_synchronize_post_init(cpu);
         notifier_list_notify(&cpu_added_notifiers, dev);
diff --git a/roms/openbios b/roms/openbios
index 569e40c..0f3d51e 160000
--- a/roms/openbios
+++ b/roms/openbios
@@ -1 +1 @@
-Subproject commit 569e40c517e9623e672be38a21da7bcec046e3be
+Subproject commit 0f3d51ef22ec9166beb3ed434d253029ed7cfe84
diff --git a/roms/seabios b/roms/seabios
index c02c219..d4f7d90 160000
--- a/roms/seabios
+++ b/roms/seabios
@@ -1 +1 @@
-Subproject commit c02c219cd79299a0a153ecf862f0e301a057f2cb
+Subproject commit d4f7d90f47462b4e8836899adc5060fbde5253e9
diff --git a/scripts/qapi.py b/scripts/qapi.py
index 38c808e..0ebea94 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -2,14 +2,17 @@
 # QAPI helper library
 #
 # Copyright IBM, Corp. 2011
+# Copyright (c) 2013 Red Hat Inc.
 #
 # Authors:
 #  Anthony Liguori <aliguori@us.ibm.com>
+#  Markus Armbruster <armbru@redhat.com>
 #
 # This work is licensed under the terms of the GNU GPLv2.
 # See the COPYING.LIB file in the top-level directory.
 
 from ordereddict import OrderedDict
+import sys
 
 builtin_types = [
     'str', 'int', 'number', 'bool',
@@ -32,99 +35,147 @@
     'uint64':   'QTYPE_QINT',
 }
 
-def tokenize(data):
-    while len(data):
-        ch = data[0]
-        data = data[1:]
-        if ch in ['{', '}', ':', ',', '[', ']']:
-            yield ch
-        elif ch in ' \n':
-            None
-        elif ch == "'":
-            string = ''
-            esc = False
-            while True:
-                if (data == ''):
-                    raise Exception("Mismatched quotes")
-                ch = data[0]
-                data = data[1:]
-                if esc:
-                    string += ch
-                    esc = False
-                elif ch == "\\":
-                    esc = True
-                elif ch == "'":
-                    break
-                else:
-                    string += ch
-            yield string
+class QAPISchemaError(Exception):
+    def __init__(self, schema, msg):
+        self.fp = schema.fp
+        self.msg = msg
+        self.line = self.col = 1
+        for ch in schema.src[0:schema.pos]:
+            if ch == '\n':
+                self.line += 1
+                self.col = 1
+            elif ch == '\t':
+                self.col = (self.col + 7) % 8 + 1
+            else:
+                self.col += 1
 
-def parse(tokens):
-    if tokens[0] == '{':
-        ret = OrderedDict()
-        tokens = tokens[1:]
-        while tokens[0] != '}':
-            key = tokens[0]
-            tokens = tokens[1:]
+    def __str__(self):
+        return "%s:%s:%s: %s" % (self.fp.name, self.line, self.col, self.msg)
 
-            tokens = tokens[1:] # :
+class QAPISchema:
 
-            value, tokens = parse(tokens)
+    def __init__(self, fp):
+        self.fp = fp
+        self.src = fp.read()
+        if self.src == '' or self.src[-1] != '\n':
+            self.src += '\n'
+        self.cursor = 0
+        self.exprs = []
+        self.accept()
 
-            if tokens[0] == ',':
-                tokens = tokens[1:]
+        while self.tok != None:
+            self.exprs.append(self.get_expr(False))
 
-            ret[key] = value
-        tokens = tokens[1:]
-        return ret, tokens
-    elif tokens[0] == '[':
-        ret = []
-        tokens = tokens[1:]
-        while tokens[0] != ']':
-            value, tokens = parse(tokens)
-            if tokens[0] == ',':
-                tokens = tokens[1:]
-            ret.append(value)
-        tokens = tokens[1:]
-        return ret, tokens
-    else:
-        return tokens[0], tokens[1:]
+    def accept(self):
+        while True:
+            self.tok = self.src[self.cursor]
+            self.pos = self.cursor
+            self.cursor += 1
+            self.val = None
 
-def evaluate(string):
-    return parse(map(lambda x: x, tokenize(string)))[0]
+            if self.tok == '#':
+                self.cursor = self.src.find('\n', self.cursor)
+            elif self.tok in ['{', '}', ':', ',', '[', ']']:
+                return
+            elif self.tok == "'":
+                string = ''
+                esc = False
+                while True:
+                    ch = self.src[self.cursor]
+                    self.cursor += 1
+                    if ch == '\n':
+                        raise QAPISchemaError(self,
+                                              'Missing terminating "\'"')
+                    if esc:
+                        string += ch
+                        esc = False
+                    elif ch == "\\":
+                        esc = True
+                    elif ch == "'":
+                        self.val = string
+                        return
+                    else:
+                        string += ch
+            elif self.tok == '\n':
+                if self.cursor == len(self.src):
+                    self.tok = None
+                    return
+            elif not self.tok.isspace():
+                raise QAPISchemaError(self, 'Stray "%s"' % self.tok)
 
-def get_expr(fp):
-    expr = ''
+    def get_members(self):
+        expr = OrderedDict()
+        if self.tok == '}':
+            self.accept()
+            return expr
+        if self.tok != "'":
+            raise QAPISchemaError(self, 'Expected string or "}"')
+        while True:
+            key = self.val
+            self.accept()
+            if self.tok != ':':
+                raise QAPISchemaError(self, 'Expected ":"')
+            self.accept()
+            expr[key] = self.get_expr(True)
+            if self.tok == '}':
+                self.accept()
+                return expr
+            if self.tok != ',':
+                raise QAPISchemaError(self, 'Expected "," or "}"')
+            self.accept()
+            if self.tok != "'":
+                raise QAPISchemaError(self, 'Expected string')
 
-    for line in fp:
-        if line.startswith('#') or line == '\n':
-            continue
+    def get_values(self):
+        expr = []
+        if self.tok == ']':
+            self.accept()
+            return expr
+        if not self.tok in [ '{', '[', "'" ]:
+            raise QAPISchemaError(self, 'Expected "{", "[", "]" or string')
+        while True:
+            expr.append(self.get_expr(True))
+            if self.tok == ']':
+                self.accept()
+                return expr
+            if self.tok != ',':
+                raise QAPISchemaError(self, 'Expected "," or "]"')
+            self.accept()
 
-        if line.startswith(' '):
-            expr += line
-        elif expr:
-            yield expr
-            expr = line
+    def get_expr(self, nested):
+        if self.tok != '{' and not nested:
+            raise QAPISchemaError(self, 'Expected "{"')
+        if self.tok == '{':
+            self.accept()
+            expr = self.get_members()
+        elif self.tok == '[':
+            self.accept()
+            expr = self.get_values()
+        elif self.tok == "'":
+            expr = self.val
+            self.accept()
         else:
-            expr += line
-
-    if expr:
-        yield expr
+            raise QAPISchemaError(self, 'Expected "{", "[" or string')
+        return expr
 
 def parse_schema(fp):
+    try:
+        schema = QAPISchema(fp)
+    except QAPISchemaError as e:
+        print >>sys.stderr, e
+        exit(1)
+
     exprs = []
 
-    for expr in get_expr(fp):
-        expr_eval = evaluate(expr)
-
-        if expr_eval.has_key('enum'):
-            add_enum(expr_eval['enum'])
-        elif expr_eval.has_key('union'):
-            add_union(expr_eval)
-            add_enum('%sKind' % expr_eval['union'])
-        elif expr_eval.has_key('type'):
-            add_struct(expr_eval)
-        exprs.append(expr_eval)
+    for expr in schema.exprs:
+        if expr.has_key('enum'):
+            add_enum(expr['enum'])
+        elif expr.has_key('union'):
+            add_union(expr)
+            add_enum('%sKind' % expr['union'])
+        elif expr.has_key('type'):
+            add_struct(expr)
+        exprs.append(expr)
 
     return exprs
 
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 64c70bc..cfad2ea 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -33,8 +33,11 @@
 
 static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     AlphaCPUClass *acc = ALPHA_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(cs);
+
     acc->parent_realize(dev, errp);
 }
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 87d35c6..5a7566b 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -159,6 +159,7 @@
 
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     ARMCPU *cpu = ARM_CPU(dev);
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
     CPUARMState *env = &cpu->env;
@@ -214,7 +215,8 @@
 
     init_cpreg_list(cpu);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     acc->parent_realize(dev, errp);
 }
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 45f2d6b..44301a4 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -137,10 +137,11 @@
 
 static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    CRISCPU *cpu = CRIS_CPU(dev);
+    CPUState *cs = CPU(dev);
     CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     ccc->parent_realize(dev, errp);
 }
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 60d2b5d..53b4c34 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -68,6 +68,13 @@
 
     /* Features that were filtered out because of missing host capabilities */
     uint32_t filtered_features[FEATURE_WORDS];
+
+    /* Enable PMU CPUID bits. This can't be enabled by default yet because
+     * it doesn't have ABI stability guarantees, as it passes all PMU CPUID
+     * bits returned by GET_SUPPORTED_CPUID (that depend on host CPU and kernel
+     * capabilities) directly to the guest.
+     */
+    bool enable_pmu;
 } X86CPU;
 
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 2b59b7d..71ab915 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1475,9 +1475,11 @@
     error_propagate(errp, err);
 }
 
-static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *name)
+static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
+                                const char *name)
 {
     x86_def_t *def;
+    Error *err = NULL;
     int i;
 
     if (name == NULL) {
@@ -1485,6 +1487,8 @@
     }
     if (kvm_enabled() && strcmp(name, "host") == 0) {
         kvm_cpu_fill_host(x86_cpu_def);
+        object_property_set_bool(OBJECT(cpu), true, "pmu", &err);
+        assert_no_error(err);
         return 0;
     }
 
@@ -1742,7 +1746,7 @@
 
     memset(def, 0, sizeof(*def));
 
-    if (cpu_x86_find_by_name(def, name) < 0) {
+    if (cpu_x86_find_by_name(cpu, def, name) < 0) {
         error_setg(errp, "Unable to find CPU definition: %s", name);
         return;
     }
@@ -2016,7 +2020,7 @@
         break;
     case 0xA:
         /* Architectural Performance Monitoring Leaf */
-        if (kvm_enabled()) {
+        if (kvm_enabled() && cpu->enable_pmu) {
             KVMState *s = cs->kvm_state;
 
             *eax = kvm_arch_get_supported_cpuid(s, 0xA, count, R_EAX);
@@ -2333,6 +2337,7 @@
 
 static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     X86CPU *cpu = X86_CPU(dev);
     X86CPUClass *xcc = X86_CPU_GET_CLASS(dev);
     CPUX86State *env = &cpu->env;
@@ -2387,12 +2392,13 @@
 #endif
 
     mce_init(cpu);
+    qemu_init_vcpu(cs);
 
     x86_cpu_apic_realize(cpu, &local_err);
     if (local_err != NULL) {
         goto out;
     }
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
 
     xcc->parent_realize(dev, &local_err);
 out:
@@ -2520,6 +2526,11 @@
     cpu->env.eip = tb->pc - tb->cs_base;
 }
 
+static Property x86_cpu_properties[] = {
+    DEFINE_PROP_BOOL("pmu", X86CPU, enable_pmu, false),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -2529,6 +2540,7 @@
     xcc->parent_realize = dc->realize;
     dc->realize = x86_cpu_realizefn;
     dc->bus_type = TYPE_ICC_BUS;
+    dc->props = x86_cpu_properties;
 
     xcc->parent_reset = cc->reset;
     cc->reset = x86_cpu_reset;
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 962d553..869878c 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -46,10 +46,12 @@
 
 static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    LM32CPU *cpu = LM32_CPU(dev);
+    CPUState *cs = CPU(dev);
     LM32CPUClass *lcc = LM32_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+
+    qemu_init_vcpu(cs);
 
     lcc->parent_realize(dev, errp);
 }
diff --git a/target-lm32/op_helper.c b/target-lm32/op_helper.c
index f106873..2dab9f2 100644
--- a/target-lm32/op_helper.c
+++ b/target-lm32/op_helper.c
@@ -4,7 +4,7 @@
 #include "qemu/host-utils.h"
 
 #include "hw/lm32/lm32_pic.h"
-#include "hw/lm32/lm32_juart.h"
+#include "hw/char/lm32_juart.h"
 
 #if !defined(CONFIG_USER_ONLY)
 #define MMUSUFFIX _mmu
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index c0bcb0d..008d8db 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -143,12 +143,14 @@
 
 static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     M68kCPU *cpu = M68K_CPU(dev);
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(dev);
 
     m68k_cpu_init_gdb(cpu);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index c75d1bd..0ef9aa4 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -90,10 +90,11 @@
 
 static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(dev);
+    CPUState *cs = CPU(dev);
     MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index f81f9e9..9dd47e8 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -62,10 +62,11 @@
 
 static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MIPSCPU *cpu = MIPS_CPU(dev);
+    CPUState *cs = CPU(dev);
     MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index 7cf238f..c45b1b2 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -274,14 +274,13 @@
                        (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA) |
                        (1 << CP0C1_CA),
         .CP0_Config2 = MIPS_CONFIG2,
-        .CP0_Config3 = MIPS_CONFIG3 | (1 << CP0C3_VInt) | (1 << CP0C3_MT),
+        .CP0_Config3 = MIPS_CONFIG3 | (1 << CP0C3_VInt) | (1 << CP0C3_MT) |
+                       (1 << CP0C3_DSPP),
         .CP0_LLAddr_rw_bitmask = 0,
         .CP0_LLAddr_shift = 0,
         .SYNCI_Step = 32,
         .CCRes = 2,
-        /* No DSP implemented. */
-        .CP0_Status_rw_bitmask = 0x3678FF1F,
-        /* No DSP implemented. */
+        .CP0_Status_rw_bitmask = 0x3778FF1F,
         .CP0_TCStatus_rw_bitmask = (0 << CP0TCSt_TCU3) | (0 << CP0TCSt_TCU2) |
                     (1 << CP0TCSt_TCU1) | (1 << CP0TCSt_TCU0) |
                     (0 << CP0TCSt_TMX) | (1 << CP0TCSt_DT) |
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 6550be5..d97a091 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -45,10 +45,11 @@
 
 static void moxie_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MoxieCPU *cpu = MOXIE_CPU(dev);
+    CPUState *cs = CPU(dev);
     MoxieCPUClass *mcc = MOXIE_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index aa269fb..075f00a 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -66,10 +66,11 @@
 
 static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    OpenRISCCPU *cpu = OPENRISC_CPU(dev);
+    CPUState *cs = CPU(dev);
     OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     occ->parent_realize(dev, errp);
 }
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index fc0d737..f3c710a 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -109,4 +109,8 @@
 int ppc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int ppc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_ppc_cpu;
+#endif
+
 #endif
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 6f51e1f..711db08 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -948,7 +948,7 @@
 #if defined(TARGET_PPC64)
     /* PowerPC 64 SLB area */
     ppc_slb_t slb[64];
-    int slb_nr;
+    int32_t slb_nr;
 #endif
     /* segment registers */
     hwaddr htab_base;
@@ -957,11 +957,11 @@
     /* externally stored hash table */
     uint8_t *external_htab;
     /* BATs */
-    int nb_BATs;
+    uint32_t nb_BATs;
     target_ulong DBAT[2][8];
     target_ulong IBAT[2][8];
     /* PowerPC TLB registers (for 4xx, e500 and 60x software driven TLBs) */
-    int nb_tlb;      /* Total number of TLB                                  */
+    int32_t nb_tlb;      /* Total number of TLB                              */
     int tlb_per_way; /* Speed-up helper: used to avoid divisions at run time */
     int nb_ways;     /* Number of ways in the TLB set                        */
     int last_way;    /* Last used way used to allocate TLB in a LRU way      */
@@ -1176,8 +1176,6 @@
 #define cpu_signal_handler cpu_ppc_signal_handler
 #define cpu_list ppc_cpu_list
 
-#define CPU_SAVE_VERSION 4
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _user
 #define MMU_MODE1_SUFFIX _kernel
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index b0099e1..30a870e 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -40,10 +40,10 @@
 //#define DEBUG_KVM
 
 #ifdef DEBUG_KVM
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -65,6 +65,7 @@
 static int cap_epr;
 static int cap_ppc_watchdog;
 static int cap_papr;
+static int cap_htab_fd;
 
 /* XXX We have a race condition where we actually have a level triggered
  *     interrupt, but the infrastructure can't expose that yet, so the guest
@@ -101,6 +102,7 @@
     cap_ppc_watchdog = kvm_check_extension(s, KVM_CAP_PPC_BOOKE_WATCHDOG);
     /* Note: we don't set cap_papr here, because this capability is
      * only activated after this by kvmppc_set_papr() */
+    cap_htab_fd = kvm_check_extension(s, KVM_CAP_PPC_HTAB_FD);
 
     if (!cap_interrupt_level) {
         fprintf(stderr, "KVM: Couldn't find level irq capability. Expect the "
@@ -548,7 +550,7 @@
         reg.addr = (uintptr_t)&fpscr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set FPSCR to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set FPSCR to KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -562,7 +564,7 @@
 
             ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to set %s%d to KVM: %s\n", vsx ? "VSR" : "FPR",
+                DPRINTF("Unable to set %s%d to KVM: %s\n", vsx ? "VSR" : "FPR",
                         i, strerror(errno));
                 return ret;
             }
@@ -574,7 +576,7 @@
         reg.addr = (uintptr_t)&env->vscr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VSCR to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VSCR to KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -583,7 +585,7 @@
             reg.addr = (uintptr_t)&env->avr[i];
             ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to set VR%d to KVM: %s\n", i, strerror(errno));
+                DPRINTF("Unable to set VR%d to KVM: %s\n", i, strerror(errno));
                 return ret;
             }
         }
@@ -608,7 +610,7 @@
         reg.addr = (uintptr_t)&fpscr;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to get FPSCR from KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to get FPSCR from KVM: %s\n", strerror(errno));
             return ret;
         } else {
             env->fpscr = fpscr;
@@ -622,7 +624,7 @@
 
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to get %s%d from KVM: %s\n",
+                DPRINTF("Unable to get %s%d from KVM: %s\n",
                         vsx ? "VSR" : "FPR", i, strerror(errno));
                 return ret;
             } else {
@@ -639,7 +641,7 @@
         reg.addr = (uintptr_t)&env->vscr;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to get VSCR from KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to get VSCR from KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -648,7 +650,7 @@
             reg.addr = (uintptr_t)&env->avr[i];
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to get VR%d from KVM: %s\n",
+                DPRINTF("Unable to get VR%d from KVM: %s\n",
                         i, strerror(errno));
                 return ret;
             }
@@ -670,7 +672,7 @@
     reg.addr = (uintptr_t)&env->vpa_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get VPA address from KVM: %s\n", strerror(errno));
+        DPRINTF("Unable to get VPA address from KVM: %s\n", strerror(errno));
         return ret;
     }
 
@@ -680,7 +682,7 @@
     reg.addr = (uintptr_t)&env->slb_shadow_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get SLB shadow state from KVM: %s\n",
+        DPRINTF("Unable to get SLB shadow state from KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -690,7 +692,7 @@
     reg.addr = (uintptr_t)&env->dtl_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get dispatch trace log state from KVM: %s\n",
+        DPRINTF("Unable to get dispatch trace log state from KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -716,7 +718,7 @@
         reg.addr = (uintptr_t)&env->vpa_addr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VPA address to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VPA address to KVM: %s\n", strerror(errno));
             return ret;
         }
     }
@@ -727,7 +729,7 @@
     reg.addr = (uintptr_t)&env->slb_shadow_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to set SLB shadow state to KVM: %s\n", strerror(errno));
+        DPRINTF("Unable to set SLB shadow state to KVM: %s\n", strerror(errno));
         return ret;
     }
 
@@ -736,7 +738,7 @@
     reg.addr = (uintptr_t)&env->dtl_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to set dispatch trace log state to KVM: %s\n",
+        DPRINTF("Unable to set dispatch trace log state to KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -746,7 +748,7 @@
         reg.addr = (uintptr_t)&env->vpa_addr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VPA address to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VPA address to KVM: %s\n", strerror(errno));
             return ret;
         }
     }
@@ -864,7 +866,7 @@
 #ifdef TARGET_PPC64
         if (cap_papr) {
             if (kvm_put_vpa(cs) < 0) {
-                dprintf("Warning: Unable to set VPA information to KVM\n");
+                DPRINTF("Warning: Unable to set VPA information to KVM\n");
             }
         }
 #endif /* TARGET_PPC64 */
@@ -1073,7 +1075,7 @@
 #ifdef TARGET_PPC64
         if (cap_papr) {
             if (kvm_get_vpa(cs) < 0) {
-                dprintf("Warning: Unable to get VPA information from KVM\n");
+                DPRINTF("Warning: Unable to get VPA information from KVM\n");
             }
         }
 #endif
@@ -1127,7 +1129,7 @@
          */
         irq = KVM_INTERRUPT_SET;
 
-        dprintf("injected interrupt %d\n", irq);
+        DPRINTF("injected interrupt %d\n", irq);
         r = kvm_vcpu_ioctl(cs, KVM_INTERRUPT, &irq);
         if (r < 0) {
             printf("cpu %d fail inject %x\n", cs->cpu_index, irq);
@@ -1191,20 +1193,20 @@
     switch (run->exit_reason) {
     case KVM_EXIT_DCR:
         if (run->dcr.is_write) {
-            dprintf("handle dcr write\n");
+            DPRINTF("handle dcr write\n");
             ret = kvmppc_handle_dcr_write(env, run->dcr.dcrn, run->dcr.data);
         } else {
-            dprintf("handle dcr read\n");
+            DPRINTF("handle dcr read\n");
             ret = kvmppc_handle_dcr_read(env, run->dcr.dcrn, &run->dcr.data);
         }
         break;
     case KVM_EXIT_HLT:
-        dprintf("handle halt\n");
+        DPRINTF("handle halt\n");
         ret = kvmppc_handle_halt(cpu);
         break;
 #if defined(TARGET_PPC64)
     case KVM_EXIT_PAPR_HCALL:
-        dprintf("handle PAPR hypercall\n");
+        DPRINTF("handle PAPR hypercall\n");
         run->papr_hcall.ret = spapr_hypercall(cpu,
                                               run->papr_hcall.nr,
                                               run->papr_hcall.args);
@@ -1212,12 +1214,12 @@
         break;
 #endif
     case KVM_EXIT_EPR:
-        dprintf("handle epr\n");
+        DPRINTF("handle epr\n");
         run->epr.epr = ldl_phys(env->mpic_iack);
         ret = 0;
         break;
     case KVM_EXIT_WATCHDOG:
-        dprintf("handle watchdog expiry\n");
+        DPRINTF("handle watchdog expiry\n");
         watchdog_perform_action();
         ret = 0;
         break;
@@ -1626,7 +1628,7 @@
         return NULL;
     }
 
-    len = (window_size / SPAPR_TCE_PAGE_SIZE) * sizeof(sPAPRTCE);
+    len = (window_size / SPAPR_TCE_PAGE_SIZE) * sizeof(uint64_t);
     /* FIXME: round this up to page size */
 
     table = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
@@ -1649,7 +1651,7 @@
         return -1;
     }
 
-    len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(sPAPRTCE);
+    len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(uint64_t);
     if ((munmap(table, len) < 0) ||
         (close(fd) < 0)) {
         fprintf(stderr, "KVM: Unexpected error removing TCE table: %s",
@@ -1788,6 +1790,73 @@
 }
 
 
+int kvmppc_get_htab_fd(bool write)
+{
+    struct kvm_get_htab_fd s = {
+        .flags = write ? KVM_GET_HTAB_WRITE : 0,
+        .start_index = 0,
+    };
+
+    if (!cap_htab_fd) {
+        fprintf(stderr, "KVM version doesn't support saving the hash table\n");
+        return -1;
+    }
+
+    return kvm_vm_ioctl(kvm_state, KVM_PPC_GET_HTAB_FD, &s);
+}
+
+int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns)
+{
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+    uint8_t buf[bufsize];
+    ssize_t rc;
+
+    do {
+        rc = read(fd, buf, bufsize);
+        if (rc < 0) {
+            fprintf(stderr, "Error reading data from KVM HTAB fd: %s\n",
+                    strerror(errno));
+            return rc;
+        } else if (rc) {
+            /* Kernel already retuns data in BE format for the file */
+            qemu_put_buffer(f, buf, rc);
+        }
+    } while ((rc != 0)
+             && ((max_ns < 0)
+                 || ((qemu_get_clock_ns(rt_clock) - starttime) < max_ns)));
+
+    return (rc == 0) ? 1 : 0;
+}
+
+int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                           uint16_t n_valid, uint16_t n_invalid)
+{
+    struct kvm_get_htab_header *buf;
+    size_t chunksize = sizeof(*buf) + n_valid*HASH_PTE_SIZE_64;
+    ssize_t rc;
+
+    buf = alloca(chunksize);
+    /* This is KVM on ppc, so this is all big-endian */
+    buf->index = index;
+    buf->n_valid = n_valid;
+    buf->n_invalid = n_invalid;
+
+    qemu_get_buffer(f, (void *)(buf + 1), HASH_PTE_SIZE_64*n_valid);
+
+    rc = write(fd, buf, chunksize);
+    if (rc < 0) {
+        fprintf(stderr, "Error writing KVM hash table: %s\n",
+                strerror(errno));
+        return rc;
+    }
+    if (rc != chunksize) {
+        /* We should never get a short write on a single chunk */
+        fprintf(stderr, "Short write, restoring KVM hash table\n");
+        return -1;
+    }
+    return 0;
+}
+
 bool kvm_arch_stop_on_emulation_error(CPUState *cpu)
 {
     return true;
diff --git a/target-ppc/kvm_ppc.h b/target-ppc/kvm_ppc.h
index 771cfbe..4ae7bf2 100644
--- a/target-ppc/kvm_ppc.h
+++ b/target-ppc/kvm_ppc.h
@@ -38,6 +38,10 @@
 #endif /* !CONFIG_USER_ONLY */
 int kvmppc_fixup_cpu(PowerPCCPU *cpu);
 bool kvmppc_has_cap_epr(void);
+int kvmppc_get_htab_fd(bool write);
+int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns);
+int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                           uint16_t n_valid, uint16_t n_invalid);
 
 #else
 
@@ -159,6 +163,24 @@
 {
     return false;
 }
+
+static inline int kvmppc_get_htab_fd(bool write)
+{
+    return -1;
+}
+
+static inline int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize,
+                                   int64_t max_ns)
+{
+    abort();
+}
+
+static inline int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                                         uint16_t n_valid, uint16_t n_invalid)
+{
+    abort();
+}
+
 #endif
 
 #ifndef CONFIG_KVM
diff --git a/target-ppc/machine.c b/target-ppc/machine.c
index 2d10adb..12e1512 100644
--- a/target-ppc/machine.c
+++ b/target-ppc/machine.c
@@ -1,96 +1,12 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
 #include "sysemu/kvm.h"
+#include "helper_regs.h"
 
-void cpu_save(QEMUFile *f, void *opaque)
+static int cpu_load_old(QEMUFile *f, void *opaque, int version_id)
 {
-    CPUPPCState *env = (CPUPPCState *)opaque;
-    unsigned int i, j;
-    uint32_t fpscr;
-    target_ulong xer;
-
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->gpr[i]);
-#if !defined(TARGET_PPC64)
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->gprh[i]);
-#endif
-    qemu_put_betls(f, &env->lr);
-    qemu_put_betls(f, &env->ctr);
-    for (i = 0; i < 8; i++)
-        qemu_put_be32s(f, &env->crf[i]);
-    xer = cpu_read_xer(env);
-    qemu_put_betls(f, &xer);
-    qemu_put_betls(f, &env->reserve_addr);
-    qemu_put_betls(f, &env->msr);
-    for (i = 0; i < 4; i++)
-        qemu_put_betls(f, &env->tgpr[i]);
-    for (i = 0; i < 32; i++) {
-        union {
-            float64 d;
-            uint64_t l;
-        } u;
-        u.d = env->fpr[i];
-        qemu_put_be64(f, u.l);
-    }
-    fpscr = env->fpscr;
-    qemu_put_be32s(f, &fpscr);
-    qemu_put_sbe32s(f, &env->access_type);
-#if defined(TARGET_PPC64)
-    qemu_put_betls(f, &env->spr[SPR_ASR]);
-    qemu_put_sbe32s(f, &env->slb_nr);
-#endif
-    qemu_put_betls(f, &env->spr[SPR_SDR1]);
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->sr[i]);
-    for (i = 0; i < 2; i++)
-        for (j = 0; j < 8; j++)
-            qemu_put_betls(f, &env->DBAT[i][j]);
-    for (i = 0; i < 2; i++)
-        for (j = 0; j < 8; j++)
-            qemu_put_betls(f, &env->IBAT[i][j]);
-    qemu_put_sbe32s(f, &env->nb_tlb);
-    qemu_put_sbe32s(f, &env->tlb_per_way);
-    qemu_put_sbe32s(f, &env->nb_ways);
-    qemu_put_sbe32s(f, &env->last_way);
-    qemu_put_sbe32s(f, &env->id_tlbs);
-    qemu_put_sbe32s(f, &env->nb_pids);
-    if (env->tlb.tlb6) {
-        // XXX assumes 6xx
-        for (i = 0; i < env->nb_tlb; i++) {
-            qemu_put_betls(f, &env->tlb.tlb6[i].pte0);
-            qemu_put_betls(f, &env->tlb.tlb6[i].pte1);
-            qemu_put_betls(f, &env->tlb.tlb6[i].EPN);
-        }
-    }
-    for (i = 0; i < 4; i++)
-        qemu_put_betls(f, &env->pb[i]);
-    for (i = 0; i < 1024; i++)
-        qemu_put_betls(f, &env->spr[i]);
-    qemu_put_be32s(f, &env->vscr);
-    qemu_put_be64s(f, &env->spe_acc);
-    qemu_put_be32s(f, &env->spe_fscr);
-    qemu_put_betls(f, &env->msr_mask);
-    qemu_put_be32s(f, &env->flags);
-    qemu_put_sbe32s(f, &env->error_code);
-    qemu_put_be32s(f, &env->pending_interrupts);
-    qemu_put_be32s(f, &env->irq_input_state);
-    for (i = 0; i < POWERPC_EXCP_NB; i++)
-        qemu_put_betls(f, &env->excp_vectors[i]);
-    qemu_put_betls(f, &env->excp_prefix);
-    qemu_put_betls(f, &env->ivor_mask);
-    qemu_put_betls(f, &env->ivpr_mask);
-    qemu_put_betls(f, &env->hreset_vector);
-    qemu_put_betls(f, &env->nip);
-    qemu_put_betls(f, &env->hflags);
-    qemu_put_betls(f, &env->hflags_nmsr);
-    qemu_put_sbe32s(f, &env->mmu_idx);
-    qemu_put_sbe32(f, 0);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-    CPUPPCState *env = (CPUPPCState *)opaque;
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
     unsigned int i, j;
     target_ulong sdr1;
     uint32_t fpscr;
@@ -177,3 +93,442 @@
 
     return 0;
 }
+
+static int get_avr(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_avr_t *v = pv;
+
+    v->u64[0] = qemu_get_be64(f);
+    v->u64[1] = qemu_get_be64(f);
+
+    return 0;
+}
+
+static void put_avr(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_avr_t *v = pv;
+
+    qemu_put_be64(f, v->u64[0]);
+    qemu_put_be64(f, v->u64[1]);
+}
+
+const VMStateInfo vmstate_info_avr = {
+    .name = "avr",
+    .get  = get_avr,
+    .put  = put_avr,
+};
+
+#define VMSTATE_AVR_ARRAY_V(_f, _s, _n, _v)                       \
+    VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_avr, ppc_avr_t)
+
+#define VMSTATE_AVR_ARRAY(_f, _s, _n)                             \
+    VMSTATE_AVR_ARRAY_V(_f, _s, _n, 0)
+
+static void cpu_pre_save(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    env->spr[SPR_LR] = env->lr;
+    env->spr[SPR_CTR] = env->ctr;
+    env->spr[SPR_XER] = env->xer;
+#if defined(TARGET_PPC64)
+    env->spr[SPR_CFAR] = env->cfar;
+#endif
+    env->spr[SPR_BOOKE_SPEFSCR] = env->spe_fscr;
+
+    for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
+        env->spr[SPR_DBAT0U + 2*i] = env->DBAT[0][i];
+        env->spr[SPR_DBAT0U + 2*i + 1] = env->DBAT[1][i];
+        env->spr[SPR_IBAT0U + 2*i] = env->IBAT[0][i];
+        env->spr[SPR_IBAT0U + 2*i + 1] = env->IBAT[1][i];
+    }
+    for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
+        env->spr[SPR_DBAT4U + 2*i] = env->DBAT[0][i+4];
+        env->spr[SPR_DBAT4U + 2*i + 1] = env->DBAT[1][i+4];
+        env->spr[SPR_IBAT4U + 2*i] = env->IBAT[0][i+4];
+        env->spr[SPR_IBAT4U + 2*i + 1] = env->IBAT[1][i+4];
+    }
+}
+
+static int cpu_post_load(void *opaque, int version_id)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    env->lr = env->spr[SPR_LR];
+    env->ctr = env->spr[SPR_CTR];
+    env->xer = env->spr[SPR_XER];
+#if defined(TARGET_PPC64)
+    env->cfar = env->spr[SPR_CFAR];
+#endif
+    env->spe_fscr = env->spr[SPR_BOOKE_SPEFSCR];
+
+    for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
+        env->DBAT[0][i] = env->spr[SPR_DBAT0U + 2*i];
+        env->DBAT[1][i] = env->spr[SPR_DBAT0U + 2*i + 1];
+        env->IBAT[0][i] = env->spr[SPR_IBAT0U + 2*i];
+        env->IBAT[1][i] = env->spr[SPR_IBAT0U + 2*i + 1];
+    }
+    for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
+        env->DBAT[0][i+4] = env->spr[SPR_DBAT4U + 2*i];
+        env->DBAT[1][i+4] = env->spr[SPR_DBAT4U + 2*i + 1];
+        env->IBAT[0][i+4] = env->spr[SPR_IBAT4U + 2*i];
+        env->IBAT[1][i+4] = env->spr[SPR_IBAT4U + 2*i + 1];
+    }
+
+    /* Restore htab_base and htab_mask variables */
+    ppc_store_sdr1(env, env->spr[SPR_SDR1]);
+
+    hreg_compute_hflags(env);
+    hreg_compute_mem_idx(env);
+
+    return 0;
+}
+
+static bool fpu_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags & PPC_FLOAT);
+}
+
+static const VMStateDescription vmstate_fpu = {
+    .name = "cpu/fpu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_FLOAT64_ARRAY(env.fpr, PowerPCCPU, 32),
+        VMSTATE_UINTTL(env.fpscr, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool altivec_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags & PPC_ALTIVEC);
+}
+
+static const VMStateDescription vmstate_altivec = {
+    .name = "cpu/altivec",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_AVR_ARRAY(env.avr, PowerPCCPU, 32),
+        VMSTATE_UINT32(env.vscr, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool vsx_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags2 & PPC2_VSX);
+}
+
+static const VMStateDescription vmstate_vsx = {
+    .name = "cpu/vsx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64_ARRAY(env.vsr, PowerPCCPU, 32),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool sr_needed(void *opaque)
+{
+#ifdef TARGET_PPC64
+    PowerPCCPU *cpu = opaque;
+
+    return !(cpu->env.mmu_model & POWERPC_MMU_64);
+#else
+    return true;
+#endif
+}
+
+static const VMStateDescription vmstate_sr = {
+    .name = "cpu/sr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL_ARRAY(env.sr, PowerPCCPU, 32),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+#ifdef TARGET_PPC64
+static int get_slbe(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_slb_t *v = pv;
+
+    v->esid = qemu_get_be64(f);
+    v->vsid = qemu_get_be64(f);
+
+    return 0;
+}
+
+static void put_slbe(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_slb_t *v = pv;
+
+    qemu_put_be64(f, v->esid);
+    qemu_put_be64(f, v->vsid);
+}
+
+const VMStateInfo vmstate_info_slbe = {
+    .name = "slbe",
+    .get  = get_slbe,
+    .put  = put_slbe,
+};
+
+#define VMSTATE_SLB_ARRAY_V(_f, _s, _n, _v)                       \
+    VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_slbe, ppc_slb_t)
+
+#define VMSTATE_SLB_ARRAY(_f, _s, _n)                             \
+    VMSTATE_SLB_ARRAY_V(_f, _s, _n, 0)
+
+static bool slb_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    /* We don't support any of the old segment table based 64-bit CPUs */
+    return (cpu->env.mmu_model & POWERPC_MMU_64);
+}
+
+static const VMStateDescription vmstate_slb = {
+    .name = "cpu/slb",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.slb_nr, PowerPCCPU),
+        VMSTATE_SLB_ARRAY(env.slb, PowerPCCPU, 64),
+        VMSTATE_END_OF_LIST()
+    }
+};
+#endif /* TARGET_PPC64 */
+
+static const VMStateDescription vmstate_tlb6xx_entry = {
+    .name = "cpu/tlb6xx_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL(pte0, ppc6xx_tlb_t),
+        VMSTATE_UINTTL(pte1, ppc6xx_tlb_t),
+        VMSTATE_UINTTL(EPN, ppc6xx_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlb6xx_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_6XX);
+}
+
+static const VMStateDescription vmstate_tlb6xx = {
+    .name = "cpu/tlb6xx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlb6, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlb6xx_entry,
+                                            ppc6xx_tlb_t),
+        VMSTATE_UINTTL_ARRAY(env.tgpr, PowerPCCPU, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_tlbemb_entry = {
+    .name = "cpu/tlbemb_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(RPN, ppcemb_tlb_t),
+        VMSTATE_UINTTL(EPN, ppcemb_tlb_t),
+        VMSTATE_UINTTL(PID, ppcemb_tlb_t),
+        VMSTATE_UINTTL(size, ppcemb_tlb_t),
+        VMSTATE_UINT32(prot, ppcemb_tlb_t),
+        VMSTATE_UINT32(attr, ppcemb_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlbemb_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_EMB);
+}
+
+static bool pbr403_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    uint32_t pvr = cpu->env.spr[SPR_PVR];
+
+    return (pvr & 0xffff0000) == 0x00200000;
+}
+
+static const VMStateDescription vmstate_pbr403 = {
+    .name = "cpu/pbr403",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL_ARRAY(env.pb, PowerPCCPU, 4),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_tlbemb = {
+    .name = "cpu/tlb6xx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbe, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlbemb_entry,
+                                            ppcemb_tlb_t),
+        /* 403 protection registers */
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection []) {
+        {
+            .vmsd = &vmstate_pbr403,
+            .needed = pbr403_needed,
+        } , {
+            /* empty */
+        }
+    }
+};
+
+static const VMStateDescription vmstate_tlbmas_entry = {
+    .name = "cpu/tlbmas_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(mas8, ppcmas_tlb_t),
+        VMSTATE_UINT32(mas1, ppcmas_tlb_t),
+        VMSTATE_UINT64(mas2, ppcmas_tlb_t),
+        VMSTATE_UINT64(mas7_3, ppcmas_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlbmas_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_MAS);
+}
+
+static const VMStateDescription vmstate_tlbmas = {
+    .name = "cpu/tlbmas",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbm, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlbmas_entry,
+                                            ppcmas_tlb_t),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+const VMStateDescription vmstate_ppc_cpu = {
+    .name = "cpu",
+    .version_id = 5,
+    .minimum_version_id = 5,
+    .minimum_version_id_old = 4,
+    .load_state_old = cpu_load_old,
+    .pre_save = cpu_pre_save,
+    .post_load = cpu_post_load,
+    .fields      = (VMStateField []) {
+        /* Verify we haven't changed the pvr */
+        VMSTATE_UINTTL_EQUAL(env.spr[SPR_PVR], PowerPCCPU),
+
+        /* User mode architected state */
+        VMSTATE_UINTTL_ARRAY(env.gpr, PowerPCCPU, 32),
+#if !defined(TARGET_PPC64)
+        VMSTATE_UINTTL_ARRAY(env.gprh, PowerPCCPU, 32),
+#endif
+        VMSTATE_UINT32_ARRAY(env.crf, PowerPCCPU, 8),
+        VMSTATE_UINTTL(env.nip, PowerPCCPU),
+
+        /* SPRs */
+        VMSTATE_UINTTL_ARRAY(env.spr, PowerPCCPU, 1024),
+        VMSTATE_UINT64(env.spe_acc, PowerPCCPU),
+
+        /* Reservation */
+        VMSTATE_UINTTL(env.reserve_addr, PowerPCCPU),
+
+        /* Supervisor mode architected state */
+        VMSTATE_UINTTL(env.msr, PowerPCCPU),
+
+        /* Internal state */
+        VMSTATE_UINTTL(env.hflags_nmsr, PowerPCCPU),
+        /* FIXME: access_type? */
+
+        /* Sanity checking */
+        VMSTATE_UINTTL_EQUAL(env.msr_mask, PowerPCCPU),
+        VMSTATE_UINT64_EQUAL(env.insns_flags, PowerPCCPU),
+        VMSTATE_UINT64_EQUAL(env.insns_flags2, PowerPCCPU),
+        VMSTATE_UINT32_EQUAL(env.nb_BATs, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection []) {
+        {
+            .vmsd = &vmstate_fpu,
+            .needed = fpu_needed,
+        } , {
+            .vmsd = &vmstate_altivec,
+            .needed = altivec_needed,
+        } , {
+            .vmsd = &vmstate_vsx,
+            .needed = vsx_needed,
+        } , {
+            .vmsd = &vmstate_sr,
+            .needed = sr_needed,
+        } , {
+#ifdef TARGET_PPC64
+            .vmsd = &vmstate_slb,
+            .needed = slb_needed,
+        } , {
+#endif /* TARGET_PPC64 */
+            .vmsd = &vmstate_tlb6xx,
+            .needed = tlb6xx_needed,
+        } , {
+            .vmsd = &vmstate_tlbemb,
+            .needed = tlbemb_needed,
+        } , {
+            .vmsd = &vmstate_tlbmas,
+            .needed = tlbmas_needed,
+        } , {
+            /* empty */
+        }
+    }
+};
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 8215946..b14aec8 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7825,7 +7825,7 @@
             error_setg(errp, "Unable to virtualize selected CPU with KVM");
             return;
         }
-    } else {
+    } else if (tcg_enabled()) {
         if (ppc_fixup_cpu(cpu) != 0) {
             error_setg(errp, "Unable to emulate selected CPU with TCG");
             return;
@@ -7861,6 +7861,8 @@
                                  34, "power-spe.xml", 0);
     }
 
+    qemu_init_vcpu(cs);
+
     pcc->parent_realize(dev, errp);
 
 #if defined(PPC_DUMP_CPU)
@@ -8462,6 +8464,7 @@
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
+    cc->vmsd = &vmstate_ppc_cpu;
 #endif
 
     cc->gdb_num_core_regs = 71;
diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
index ab938e7..f873146 100644
--- a/target-s390x/Makefile.objs
+++ b/target-s390x/Makefile.objs
@@ -1,5 +1,5 @@
 obj-y += translate.o helper.o cpu.o interrupt.o
 obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
 obj-y += gdbstub.o
-obj-$(CONFIG_SOFTMMU) += ioinst.o
+obj-$(CONFIG_SOFTMMU) += ioinst.o arch_dump.o
 obj-$(CONFIG_KVM) += kvm.o
diff --git a/target-s390x/arch_dump.c b/target-s390x/arch_dump.c
new file mode 100644
index 0000000..f3e5144
--- /dev/null
+++ b/target-s390x/arch_dump.c
@@ -0,0 +1,212 @@
+/*
+ * writing ELF notes for s390x arch
+ *
+ *
+ * Copyright IBM Corp. 2012, 2013
+ *
+ *     Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "cpu.h"
+#include "elf.h"
+#include "exec/cpu-all.h"
+#include "sysemu/dump.h"
+#include "sysemu/kvm.h"
+
+
+struct S390xUserRegsStruct {
+    uint64_t psw[2];
+    uint64_t gprs[16];
+    uint32_t acrs[16];
+} QEMU_PACKED;
+
+typedef struct S390xUserRegsStruct S390xUserRegs;
+
+struct S390xElfPrstatusStruct {
+    uint8_t pad1[32];
+    uint32_t pid;
+    uint8_t pad2[76];
+    S390xUserRegs regs;
+    uint8_t pad3[16];
+} QEMU_PACKED;
+
+typedef struct S390xElfPrstatusStruct S390xElfPrstatus;
+
+struct S390xElfFpregsetStruct {
+    uint32_t fpc;
+    uint32_t pad;
+    uint64_t fprs[16];
+} QEMU_PACKED;
+
+typedef struct S390xElfFpregsetStruct S390xElfFpregset;
+
+typedef struct noteStruct {
+    Elf64_Nhdr hdr;
+    char name[5];
+    char pad3[3];
+    union {
+        S390xElfPrstatus prstatus;
+        S390xElfFpregset fpregset;
+        uint32_t prefix;
+        uint64_t timer;
+        uint64_t todcmp;
+        uint32_t todpreg;
+        uint64_t ctrs[16];
+    } contents;
+} QEMU_PACKED Note;
+
+static void s390x_write_elf64_prstatus(Note *note, S390CPU *cpu)
+{
+    int i;
+    S390xUserRegs *regs;
+
+    note->hdr.n_type = cpu_to_be32(NT_PRSTATUS);
+
+    regs = &(note->contents.prstatus.regs);
+    regs->psw[0] = cpu_to_be64(cpu->env.psw.mask);
+    regs->psw[1] = cpu_to_be64(cpu->env.psw.addr);
+    for (i = 0; i <= 15; i++) {
+        regs->acrs[i] = cpu_to_be32(cpu->env.aregs[i]);
+        regs->gprs[i] = cpu_to_be64(cpu->env.regs[i]);
+    }
+}
+
+static void s390x_write_elf64_fpregset(Note *note, S390CPU *cpu)
+{
+    int i;
+
+    note->hdr.n_type = cpu_to_be32(NT_FPREGSET);
+    note->contents.fpregset.fpc = cpu_to_be32(cpu->env.fpc);
+    for (i = 0; i <= 15; i++) {
+        note->contents.fpregset.fprs[i] = cpu_to_be64(cpu->env.fregs[i].ll);
+    }
+}
+
+
+static void s390x_write_elf64_timer(Note *note, S390CPU *cpu)
+{
+    note->hdr.n_type = cpu_to_be32(NT_S390_TIMER);
+    note->contents.timer = cpu_to_be64((uint64_t)(cpu->env.cputm));
+}
+
+static void s390x_write_elf64_todcmp(Note *note, S390CPU *cpu)
+{
+    note->hdr.n_type = cpu_to_be32(NT_S390_TODCMP);
+    note->contents.todcmp = cpu_to_be64((uint64_t)(cpu->env.ckc));
+}
+
+static void s390x_write_elf64_todpreg(Note *note, S390CPU *cpu)
+{
+    note->hdr.n_type = cpu_to_be32(NT_S390_TODPREG);
+    note->contents.todpreg = cpu_to_be32((uint32_t)(cpu->env.todpr));
+}
+
+static void s390x_write_elf64_ctrs(Note *note, S390CPU *cpu)
+{
+    int i;
+
+    note->hdr.n_type = cpu_to_be32(NT_S390_CTRS);
+
+    for (i = 0; i <= 15; i++) {
+        note->contents.ctrs[i] = cpu_to_be64(cpu->env.cregs[i]);
+    }
+}
+
+static void s390x_write_elf64_prefix(Note *note, S390CPU *cpu)
+{
+    note->hdr.n_type = cpu_to_be32(NT_S390_PREFIX);
+    note->contents.prefix = cpu_to_be32((uint32_t)(cpu->env.psa));
+}
+
+
+struct NoteFuncDescStruct {
+    int contents_size;
+    void (*note_contents_func)(Note *note, S390CPU *cpu);
+} note_func[] = {
+    {sizeof(((Note *)0)->contents.prstatus), s390x_write_elf64_prstatus},
+    {sizeof(((Note *)0)->contents.prefix),   s390x_write_elf64_prefix},
+    {sizeof(((Note *)0)->contents.fpregset), s390x_write_elf64_fpregset},
+    {sizeof(((Note *)0)->contents.ctrs),     s390x_write_elf64_ctrs},
+    {sizeof(((Note *)0)->contents.timer),    s390x_write_elf64_timer},
+    {sizeof(((Note *)0)->contents.todcmp),   s390x_write_elf64_todcmp},
+    {sizeof(((Note *)0)->contents.todpreg),  s390x_write_elf64_todpreg},
+    { 0, NULL}
+};
+
+typedef struct NoteFuncDescStruct NoteFuncDesc;
+
+
+static int s390x_write_all_elf64_notes(const char *note_name,
+                                       WriteCoreDumpFunction f,
+                                       S390CPU *cpu, int id,
+                                       void *opaque)
+{
+    Note note;
+    NoteFuncDesc *nf;
+    int note_size;
+    int ret = -1;
+
+    for (nf = note_func; nf->note_contents_func; nf++) {
+        note.hdr.n_namesz = cpu_to_be32(sizeof(note.name));
+        note.hdr.n_descsz = cpu_to_be32(nf->contents_size);
+        strncpy(note.name, note_name, sizeof(note.name));
+        (*nf->note_contents_func)(&note, cpu);
+
+        note_size = sizeof(note) - sizeof(note.contents) + nf->contents_size;
+        ret = f(&note, note_size, opaque);
+
+        if (ret < 0) {
+            return -1;
+        }
+
+    }
+
+    return 0;
+}
+
+
+int s390_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
+                              int cpuid, void *opaque)
+{
+    S390CPU *cpu = S390_CPU(cs);
+    return s390x_write_all_elf64_notes("CORE", f, cpu, cpuid, opaque);
+}
+
+int cpu_get_dump_info(ArchDumpInfo *info)
+{
+    info->d_machine = EM_S390;
+    info->d_endian = ELFDATA2MSB;
+    info->d_class = ELFCLASS64;
+
+    return 0;
+}
+
+ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
+{
+    int name_size = 8; /* "CORE" or "QEMU" rounded */
+    size_t elf_note_size = 0;
+    int note_head_size;
+    NoteFuncDesc *nf;
+
+    assert(class == ELFCLASS64);
+    assert(machine == EM_S390);
+
+    note_head_size = sizeof(Elf64_Nhdr);
+
+    for (nf = note_func; nf->note_contents_func; nf++) {
+        elf_note_size = elf_note_size + note_head_size + name_size +
+                        nf->contents_size;
+    }
+
+    return (elf_note_size) * nr_cpus;
+}
+
+int s390_cpu_write_elf64_qemunote(WriteCoreDumpFunction f,
+                                  CPUState *cpu, void *opaque)
+{
+    return 0;
+}
diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index 0d63b1c..cbe2341 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -74,6 +74,11 @@
 void s390_cpu_do_interrupt(CPUState *cpu);
 void s390_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
                          int flags);
+int s390_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
+                              int cpuid, void *opaque);
+
+int s390_cpu_write_elf64_qemunote(WriteCoreDumpFunction f,
+                                  CPUState *cpu, void *opaque);
 hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 int s390_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int s390_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 1d16da3..6be6c08 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -101,10 +101,11 @@
 
 static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    S390CPU *cpu = S390_CPU(dev);
+    CPUState *cs = CPU(dev);
     S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     scc->parent_realize(dev, errp);
 }
@@ -177,6 +178,8 @@
     cc->gdb_write_register = s390_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = s390_cpu_get_phys_page_debug;
+    cc->write_elf64_note = s390_cpu_write_elf64_note;
+    cc->write_elf64_qemunote = s390_cpu_write_elf64_qemunote;
 #endif
     dc->vmsd = &vmstate_s390_cpu;
     cc->gdb_num_core_regs = S390_NUM_REGS;
diff --git a/target-s390x/ioinst.c b/target-s390x/ioinst.c
index 28c508d..85fd285 100644
--- a/target-s390x/ioinst.c
+++ b/target-s390x/ioinst.c
@@ -151,23 +151,24 @@
     int cc;
     hwaddr len = sizeof(*schib);
 
-    if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
-        program_interrupt(env, PGM_OPERAND, 2);
+    addr = decode_basedisp_s(env, ipb);
+    if (addr & 3) {
+        program_interrupt(env, PGM_SPECIFICATION, 2);
         return -EIO;
     }
-    trace_ioinst_sch_id("msch", cssid, ssid, schid);
-    addr = decode_basedisp_s(env, ipb);
     schib = s390_cpu_physical_memory_map(env, addr, &len, 0);
     if (!schib || len != sizeof(*schib)) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         cc = -EIO;
         goto out;
     }
-    if (!ioinst_schib_valid(schib)) {
+    if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
+        !ioinst_schib_valid(schib)) {
         program_interrupt(env, PGM_OPERAND, 2);
         cc = -EIO;
         goto out;
     }
+    trace_ioinst_sch_id("msch", cssid, ssid, schid);
     sch = css_find_subch(m, cssid, ssid, schid);
     if (sch && css_subch_visible(sch)) {
         ret = css_do_msch(sch, schib);
@@ -222,24 +223,25 @@
     int cc;
     hwaddr len = sizeof(*orig_orb);
 
-    if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
-        program_interrupt(env, PGM_OPERAND, 2);
+    addr = decode_basedisp_s(env, ipb);
+    if (addr & 3) {
+        program_interrupt(env, PGM_SPECIFICATION, 2);
         return -EIO;
     }
-    trace_ioinst_sch_id("ssch", cssid, ssid, schid);
-    addr = decode_basedisp_s(env, ipb);
     orig_orb = s390_cpu_physical_memory_map(env, addr, &len, 0);
     if (!orig_orb || len != sizeof(*orig_orb)) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         cc = -EIO;
         goto out;
     }
     copy_orb_from_guest(&orb, orig_orb);
-    if (!ioinst_orb_valid(&orb)) {
+    if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
+        !ioinst_orb_valid(&orb)) {
         program_interrupt(env, PGM_OPERAND, 2);
         cc = -EIO;
         goto out;
     }
+    trace_ioinst_sch_id("ssch", cssid, ssid, schid);
     sch = css_find_subch(m, cssid, ssid, schid);
     if (sch && css_subch_visible(sch)) {
         ret = css_do_ssch(sch, &orb);
@@ -272,9 +274,13 @@
     hwaddr len = sizeof(*crw);
 
     addr = decode_basedisp_s(env, ipb);
+    if (addr & 3) {
+        program_interrupt(env, PGM_SPECIFICATION, 2);
+        return -EIO;
+    }
     crw = s390_cpu_physical_memory_map(env, addr, &len, 1);
     if (!crw || len != sizeof(*crw)) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         cc = -EIO;
         goto out;
     }
@@ -294,18 +300,24 @@
     SCHIB *schib;
     hwaddr len = sizeof(*schib);
 
-    if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
-        program_interrupt(env, PGM_OPERAND, 2);
+    addr = decode_basedisp_s(env, ipb);
+    if (addr & 3) {
+        program_interrupt(env, PGM_SPECIFICATION, 2);
         return -EIO;
     }
-    trace_ioinst_sch_id("stsch", cssid, ssid, schid);
-    addr = decode_basedisp_s(env, ipb);
     schib = s390_cpu_physical_memory_map(env, addr, &len, 1);
     if (!schib || len != sizeof(*schib)) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         cc = -EIO;
         goto out;
     }
+
+    if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
+        program_interrupt(env, PGM_OPERAND, 2);
+        cc = -EIO;
+        goto out;
+    }
+    trace_ioinst_sch_id("stsch", cssid, ssid, schid);
     sch = css_find_subch(m, cssid, ssid, schid);
     if (sch) {
         if (css_subch_visible(sch)) {
@@ -345,9 +357,13 @@
     }
     trace_ioinst_sch_id("tsch", cssid, ssid, schid);
     addr = decode_basedisp_s(env, ipb);
+    if (addr & 3) {
+        program_interrupt(env, PGM_SPECIFICATION, 2);
+        return -EIO;
+    }
     irb = s390_cpu_physical_memory_map(env, addr, &len, 1);
     if (!irb || len != sizeof(*irb)) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         cc = -EIO;
         goto out;
     }
@@ -580,7 +596,7 @@
     }
     req = s390_cpu_physical_memory_map(env, addr, &map_size, 1);
     if (!req || map_size != TARGET_PAGE_SIZE) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         ret = -EIO;
         goto out;
     }
@@ -625,12 +641,17 @@
 
     trace_ioinst("tpi");
     addr = decode_basedisp_s(env, ipb);
+    if (addr & 3) {
+        program_interrupt(env, PGM_SPECIFICATION, 2);
+        return -EIO;
+    }
+
     lowcore = addr ? 0 : 1;
     len = lowcore ? 8 /* two words */ : 12 /* three words */;
     orig_len = len;
     int_code = s390_cpu_physical_memory_map(env, addr, &len, 1);
     if (!int_code || (len != orig_len)) {
-        program_interrupt(env, PGM_SPECIFICATION, 2);
+        program_interrupt(env, PGM_ADDRESSING, 2);
         ret = -EIO;
         goto out;
     }
@@ -663,7 +684,7 @@
     update = SCHM_REG1_UPD(reg1);
     dct = SCHM_REG1_DCT(reg1);
 
-    if (update && (reg2 & 0x0000000000000fff)) {
+    if (update && (reg2 & 0x000000000000001f)) {
         program_interrupt(env, PGM_OPERAND, 2);
         return -EIO;
     }
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 85f0112..26d18e3 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -40,10 +40,10 @@
 /* #define DEBUG_KVM */
 
 #ifdef DEBUG_KVM
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -528,50 +528,19 @@
         no_cc = 1;
         r = ioinst_handle_sal(env, env->regs[1]);
         break;
+    case PRIV_SIGA:
+        /* Not provided, set CC = 3 for subchannel not operational */
+        r = 3;
+        break;
     default:
-        r = -1;
-        break;
+        return -1;
     }
 
-    if (r >= 0) {
-        if (!no_cc) {
-            setcc(cpu, r);
-        }
-        r = 0;
-    } else if (r < -1) {
-        r = 0;
-    }
-    return r;
-}
-
-static int is_ioinst(uint8_t ipa0, uint8_t ipa1, uint8_t ipb)
-{
-    int ret = 0;
-    uint16_t ipa = (ipa0 << 8) | ipa1;
-
-    switch (ipa) {
-    case IPA0_B2 | PRIV_CSCH:
-    case IPA0_B2 | PRIV_HSCH:
-    case IPA0_B2 | PRIV_MSCH:
-    case IPA0_B2 | PRIV_SSCH:
-    case IPA0_B2 | PRIV_STSCH:
-    case IPA0_B2 | PRIV_TPI:
-    case IPA0_B2 | PRIV_SAL:
-    case IPA0_B2 | PRIV_RSCH:
-    case IPA0_B2 | PRIV_STCRW:
-    case IPA0_B2 | PRIV_STCPS:
-    case IPA0_B2 | PRIV_RCHP:
-    case IPA0_B2 | PRIV_SCHM:
-    case IPA0_B2 | PRIV_CHSC:
-    case IPA0_B2 | PRIV_SIGA:
-    case IPA0_B2 | PRIV_XSCH:
-    case IPA0_B9 | PRIV_EQBS:
-    case IPA0_EB | PRIV_SQBS:
-        ret = 1;
-        break;
+    if (r >= 0 && !no_cc) {
+        setcc(cpu, r);
     }
 
-    return ret;
+    return 0;
 }
 
 static int handle_priv(S390CPU *cpu, struct kvm_run *run,
@@ -581,21 +550,15 @@
     uint16_t ipbh0 = (run->s390_sieic.ipb & 0xffff0000) >> 16;
     uint8_t ipb = run->s390_sieic.ipb & 0xff;
 
-    dprintf("KVM: PRIV: %d\n", ipa1);
+    DPRINTF("KVM: PRIV: %d\n", ipa1);
     switch (ipa1) {
         case PRIV_SCLP_CALL:
             r = kvm_sclp_service_call(cpu, run, ipbh0);
             break;
         default:
-            if (is_ioinst(ipa0, ipa1, ipb)) {
-                r = kvm_handle_css_inst(cpu, run, ipa0, ipa1, ipb);
-                if (r == -1) {
-                    setcc(cpu, 3);
-                    r = 0;
-                }
-            } else {
-                dprintf("KVM: unknown PRIV: 0x%x\n", ipa1);
-                r = -1;
+            r = kvm_handle_css_inst(cpu, run, ipa0, ipa1, ipb);
+            if (r == -1) {
+                DPRINTF("KVM: unhandled PRIV: 0x%x\n", ipa1);
             }
             break;
     }
@@ -627,7 +590,7 @@
             sleep(10);
             break;
         default:
-            dprintf("KVM: unknown DIAG: 0x%x\n", ipb_code);
+            DPRINTF("KVM: unknown DIAG: 0x%x\n", ipb_code);
             r = -1;
             break;
     }
@@ -640,7 +603,7 @@
     kvm_s390_interrupt(cpu, KVM_S390_RESTART, 0);
     s390_add_running_cpu(cpu);
     qemu_cpu_kick(CPU(cpu));
-    dprintf("DONE: SIGP cpu restart: %p\n", &cpu->env);
+    DPRINTF("DONE: SIGP cpu restart: %p\n", &cpu->env);
     return 0;
 }
 
@@ -668,7 +631,7 @@
         env->regs[i] = 0;
     }
 
-    dprintf("DONE: SIGP initial reset: %p\n", env);
+    DPRINTF("DONE: SIGP initial reset: %p\n", env);
     return 0;
 }
 
@@ -730,14 +693,15 @@
     return 0;
 }
 
-static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
+static void handle_instruction(S390CPU *cpu, struct kvm_run *run)
 {
     unsigned int ipa0 = (run->s390_sieic.ipa & 0xff00);
     uint8_t ipa1 = run->s390_sieic.ipa & 0x00ff;
     int ipb_code = (run->s390_sieic.ipb & 0x0fff0000) >> 16;
     int r = -1;
 
-    dprintf("handle_instruction 0x%x 0x%x\n", run->s390_sieic.ipa, run->s390_sieic.ipb);
+    DPRINTF("handle_instruction 0x%x 0x%x\n",
+            run->s390_sieic.ipa, run->s390_sieic.ipb);
     switch (ipa0) {
     case IPA0_B2:
     case IPA0_B9:
@@ -755,7 +719,6 @@
     if (r < 0) {
         enter_pgmcheck(cpu, 0x0001);
     }
-    return 0;
 }
 
 static bool is_special_wait_psw(CPUState *cs)
@@ -771,11 +734,11 @@
     int icpt_code = run->s390_sieic.icptcode;
     int r = 0;
 
-    dprintf("intercept: 0x%x (at 0x%lx)\n", icpt_code,
+    DPRINTF("intercept: 0x%x (at 0x%lx)\n", icpt_code,
             (long)cs->kvm_run->psw_addr);
     switch (icpt_code) {
         case ICPT_INSTRUCTION:
-            r = handle_instruction(cpu, run);
+            handle_instruction(cpu, run);
             break;
         case ICPT_WAITPSW:
             /* disabled wait, since enabled wait is handled in kernel */
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index bda3c51..34b2b57 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -240,10 +240,11 @@
 
 static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    SuperHCPU *cpu = SUPERH_CPU(dev);
+    CPUState *cs = CPU(dev);
     SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     scc->parent_realize(dev, errp);
 }
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index c7b4a90..47ce60d 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -743,6 +743,8 @@
 {
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(CPU(dev));
+
     scc->parent_realize(dev, errp);
 }
 
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 46813e5..3f78208 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -92,6 +92,8 @@
 {
     UniCore32CPUClass *ucc = UNICORE32_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(CPU(dev));
+
     ucc->parent_realize(dev, errp);
 }
 
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index e966aa0..c19d17a 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -90,6 +90,8 @@
 
     cs->gdb_num_regs = xcc->config->gdb_regmap.num_regs;
 
+    qemu_init_vcpu(cs);
+
     xcc->parent_realize(dev, errp);
 }
 
diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.c
index d1241b5..e118bc7 100644
--- a/tcg/tci/tcg-target.c
+++ b/tcg/tci/tcg-target.c
@@ -34,9 +34,6 @@
         tcg_abort(); \
     } while (0)
 
-/* Single bit n. */
-#define BIT(n) (1 << (n))
-
 /* Bitfield n...m (in 32 bit value). */
 #define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
 
diff --git a/tests/Makefile b/tests/Makefile
index cdbb79e..d044908 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -83,6 +83,14 @@
 check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
 check-qtest-ppc64-y += tests/boot-order-test$(EXESUF)
 
+check-qapi-schema-y := $(addprefix tests/qapi-schema/, \
+        comments.json empty.json funny-char.json indented-expr.json \
+        missing-colon.json missing-comma-list.json \
+        missing-comma-object.json non-objects.json \
+        qapi-schema-test.json quoted-structural-chars.json \
+        trailing-comma-list.json trailing-comma-object.json \
+        unclosed-list.json unclosed-object.json unclosed-string.json)
+
 GENERATED_HEADERS += tests/test-qapi-types.h tests/test-qapi-visit.h tests/test-qmp-commands.h
 
 test-obj-y = tests/check-qint.o tests/check-qstring.o tests/check-qdict.o \
@@ -117,13 +125,13 @@
 tests/test-int128$(EXESUF): tests/test-int128.o
 
 tests/test-qapi-types.c tests/test-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 tests/test-qapi-visit.c tests/test-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 tests/test-qmp-commands.h tests/test-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 
 tests/test-string-output-visitor$(EXESUF): tests/test-string-output-visitor.o $(test-qapi-obj-y) libqemuutil.a libqemustub.a
@@ -171,6 +179,7 @@
 	@echo " make check-qtest-TARGET   Run qtest tests for given target"
 	@echo " make check-qtest          Run qtest tests"
 	@echo " make check-unit           Run qobject tests"
+	@echo " make check-qapi-schema    Run QAPI schema tests"
 	@echo " make check-block          Run block tests"
 	@echo " make check-report.html    Generates an HTML test report"
 	@echo
@@ -233,13 +242,24 @@
 check-tests/qemu-iotests-quick.sh: tests/qemu-iotests-quick.sh qemu-img$(EXESUF) qemu-io$(EXESUF)
 	$<
 
+.PHONY: check-tests/test-qapi.py
+check-tests/test-qapi.py: tests/test-qapi.py
+
+.PHONY: $(patsubst %, check-%, $(check-qapi-schema-y))
+$(patsubst %, check-%, $(check-qapi-schema-y)): check-%.json: $(SRC_PATH)/%.json
+	$(call quiet-command, PYTHONPATH=$(SRC_PATH)/scripts $(PYTHON) $(SRC_PATH)/tests/qapi-schema/test-qapi.py <$^ >$*.out 2>$*.err; echo $$? >$*.exit, "  TEST  $*.out")
+	@diff -q $(SRC_PATH)/$*.out $*.out
+	@diff -q $(SRC_PATH)/$*.err $*.err
+	@diff -q $(SRC_PATH)/$*.exit $*.exit
+
 # Consolidated targets
 
-.PHONY: check-qtest check-unit check
+.PHONY: check-qapi-schema check-qtest check-unit check
+check-qapi-schema: $(patsubst %,check-%, $(check-qapi-schema-y))
 check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
 check-unit: $(patsubst %,check-%, $(check-unit-y))
 check-block: $(patsubst %,check-%, $(check-block-y))
-check: check-unit check-qtest
+check: check-qapi-schema check-unit check-qtest
 
 -include $(wildcard tests/*.d)
 -include $(wildcard tests/libqos/*.d)
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/comments.err
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/comments.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/comments.json b/tests/qapi-schema/comments.json
new file mode 100644
index 0000000..e643f3a
--- /dev/null
+++ b/tests/qapi-schema/comments.json
@@ -0,0 +1,4 @@
+# Unindented comment
+{ 'enum': 'Status',             # Comment to the right of code
+  # Indented comment
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/comments.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/empty.err b/tests/qapi-schema/empty.err
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/empty.err
diff --git a/tests/qapi-schema/empty.exit b/tests/qapi-schema/empty.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/empty.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/empty.json b/tests/qapi-schema/empty.json
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/empty.json
diff --git a/tests/qapi-schema/empty.out b/tests/qapi-schema/empty.out
new file mode 100644
index 0000000..b7f89a4
--- /dev/null
+++ b/tests/qapi-schema/empty.out
@@ -0,0 +1,3 @@
+[]
+[]
+[]
diff --git a/tests/qapi-schema/funny-char.err b/tests/qapi-schema/funny-char.err
new file mode 100644
index 0000000..d3dd293
--- /dev/null
+++ b/tests/qapi-schema/funny-char.err
@@ -0,0 +1 @@
+<stdin>:2:36: Stray ";"
diff --git a/tests/qapi-schema/funny-char.exit b/tests/qapi-schema/funny-char.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/funny-char.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/funny-char.json b/tests/qapi-schema/funny-char.json
new file mode 100644
index 0000000..d4973a2
--- /dev/null
+++ b/tests/qapi-schema/funny-char.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly' ]; }
diff --git a/tests/qapi-schema/funny-char.out b/tests/qapi-schema/funny-char.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/funny-char.out
diff --git a/tests/qapi-schema/indented-expr.err b/tests/qapi-schema/indented-expr.err
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.err
diff --git a/tests/qapi-schema/indented-expr.exit b/tests/qapi-schema/indented-expr.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/indented-expr.json b/tests/qapi-schema/indented-expr.json
new file mode 100644
index 0000000..d80af60
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.json
@@ -0,0 +1,2 @@
+{ 'id' : 'eins' }
+ { 'id' : 'zwei' }
diff --git a/tests/qapi-schema/indented-expr.out b/tests/qapi-schema/indented-expr.out
new file mode 100644
index 0000000..98af89a
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.out
@@ -0,0 +1,3 @@
+[OrderedDict([('id', 'eins')]), OrderedDict([('id', 'zwei')])]
+[]
+[]
diff --git a/tests/qapi-schema/missing-colon.err b/tests/qapi-schema/missing-colon.err
new file mode 100644
index 0000000..9f2a355
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.err
@@ -0,0 +1 @@
+<stdin>:1:10: Expected ":"
diff --git a/tests/qapi-schema/missing-colon.exit b/tests/qapi-schema/missing-colon.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/missing-colon.json b/tests/qapi-schema/missing-colon.json
new file mode 100644
index 0000000..6fc27ce
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.json
@@ -0,0 +1,2 @@
+{ 'enum' 'Status',
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.out
diff --git a/tests/qapi-schema/missing-comma-list.err b/tests/qapi-schema/missing-comma-list.err
new file mode 100644
index 0000000..4fe0700
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.err
@@ -0,0 +1 @@
+<stdin>:2:20: Expected "," or "]"
diff --git a/tests/qapi-schema/missing-comma-list.exit b/tests/qapi-schema/missing-comma-list.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/missing-comma-list.json b/tests/qapi-schema/missing-comma-list.json
new file mode 100644
index 0000000..1af39b2
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good' 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-comma-list.out b/tests/qapi-schema/missing-comma-list.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.out
diff --git a/tests/qapi-schema/missing-comma-object.err b/tests/qapi-schema/missing-comma-object.err
new file mode 100644
index 0000000..b0121b5
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.err
@@ -0,0 +1 @@
+<stdin>:2:3: Expected "," or "}"
diff --git a/tests/qapi-schema/missing-comma-object.exit b/tests/qapi-schema/missing-comma-object.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/missing-comma-object.json b/tests/qapi-schema/missing-comma-object.json
new file mode 100644
index 0000000..50f5178
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status'
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-comma-object.out b/tests/qapi-schema/missing-comma-object.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.out
diff --git a/tests/qapi-schema/non-objects.err b/tests/qapi-schema/non-objects.err
new file mode 100644
index 0000000..a6c2dc2
--- /dev/null
+++ b/tests/qapi-schema/non-objects.err
@@ -0,0 +1 @@
+<stdin>:1:1: Expected "{"
diff --git a/tests/qapi-schema/non-objects.exit b/tests/qapi-schema/non-objects.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/non-objects.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/non-objects.json b/tests/qapi-schema/non-objects.json
new file mode 100644
index 0000000..f3fa851
--- /dev/null
+++ b/tests/qapi-schema/non-objects.json
@@ -0,0 +1,2 @@
+'string'
+[ ]
diff --git a/tests/qapi-schema/non-objects.out b/tests/qapi-schema/non-objects.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/non-objects.out
diff --git a/tests/qapi-schema/qapi-schema-test.err b/tests/qapi-schema/qapi-schema-test.err
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.err
diff --git a/tests/qapi-schema/qapi-schema-test.exit b/tests/qapi-schema/qapi-schema-test.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.exit
@@ -0,0 +1 @@
+0
diff --git a/qapi-schema-test.json b/tests/qapi-schema/qapi-schema-test.json
similarity index 100%
rename from qapi-schema-test.json
rename to tests/qapi-schema/qapi-schema-test.json
diff --git a/tests/qapi-schema/qapi-schema-test.out b/tests/qapi-schema/qapi-schema-test.out
new file mode 100644
index 0000000..fb00344
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.out
@@ -0,0 +1,19 @@
+[OrderedDict([('enum', 'EnumOne'), ('data', ['value1', 'value2', 'value3'])]),
+ OrderedDict([('type', 'NestedEnumsOne'), ('data', OrderedDict([('enum1', 'EnumOne'), ('*enum2', 'EnumOne'), ('enum3', 'EnumOne'), ('*enum4', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefOne'), ('data', OrderedDict([('integer', 'int'), ('string', 'str'), ('*enum1', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefTwo'), ('data', OrderedDict([('string', 'str'), ('dict', OrderedDict([('string', 'str'), ('dict', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')])), ('*dict2', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefNested'), ('data', OrderedDict([('string0', 'str'), ('dict1', OrderedDict([('string1', 'str'), ('dict2', OrderedDict([('userdef1', 'UserDefOne'), ('string2', 'str')])), ('*dict3', OrderedDict([('userdef2', 'UserDefOne'), ('string3', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefA'), ('data', OrderedDict([('boolean', 'bool')]))]),
+ OrderedDict([('type', 'UserDefB'), ('data', OrderedDict([('integer', 'int')]))]),
+ OrderedDict([('union', 'UserDefUnion'), ('data', OrderedDict([('a', 'UserDefA'), ('b', 'UserDefB')]))]),
+ OrderedDict([('union', 'UserDefNativeListUnion'), ('data', OrderedDict([('integer', ['int']), ('s8', ['int8']), ('s16', ['int16']), ('s32', ['int32']), ('s64', ['int64']), ('u8', ['uint8']), ('u16', ['uint16']), ('u32', ['uint32']), ('u64', ['uint64']), ('number', ['number']), ('boolean', ['bool']), ('string', ['str'])]))]),
+ OrderedDict([('command', 'user_def_cmd'), ('data', OrderedDict())]),
+ OrderedDict([('command', 'user_def_cmd1'), ('data', OrderedDict([('ud1a', 'UserDefOne')]))]),
+ OrderedDict([('command', 'user_def_cmd2'), ('data', OrderedDict([('ud1a', 'UserDefOne'), ('ud1b', 'UserDefOne')])), ('returns', 'UserDefTwo')])]
+['EnumOne', 'UserDefUnionKind', 'UserDefNativeListUnionKind']
+[OrderedDict([('type', 'NestedEnumsOne'), ('data', OrderedDict([('enum1', 'EnumOne'), ('*enum2', 'EnumOne'), ('enum3', 'EnumOne'), ('*enum4', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefOne'), ('data', OrderedDict([('integer', 'int'), ('string', 'str'), ('*enum1', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefTwo'), ('data', OrderedDict([('string', 'str'), ('dict', OrderedDict([('string', 'str'), ('dict', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')])), ('*dict2', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefNested'), ('data', OrderedDict([('string0', 'str'), ('dict1', OrderedDict([('string1', 'str'), ('dict2', OrderedDict([('userdef1', 'UserDefOne'), ('string2', 'str')])), ('*dict3', OrderedDict([('userdef2', 'UserDefOne'), ('string3', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefA'), ('data', OrderedDict([('boolean', 'bool')]))]),
+ OrderedDict([('type', 'UserDefB'), ('data', OrderedDict([('integer', 'int')]))])]
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
new file mode 100644
index 0000000..a6c2dc2
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.err
@@ -0,0 +1 @@
+<stdin>:1:1: Expected "{"
diff --git a/tests/qapi-schema/quoted-structural-chars.exit b/tests/qapi-schema/quoted-structural-chars.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/quoted-structural-chars.json b/tests/qapi-schema/quoted-structural-chars.json
new file mode 100644
index 0000000..9fe657a
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.json
@@ -0,0 +1 @@
+'{' 'key1' ':' 'value1' ',' 'key2' ':' '[' ']' '}'
diff --git a/tests/qapi-schema/quoted-structural-chars.out b/tests/qapi-schema/quoted-structural-chars.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.out
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
new file mode 100644
index 0000000..b3d1e1d
--- /dev/null
+++ b/tests/qapi-schema/test-qapi.py
@@ -0,0 +1,27 @@
+#
+# QAPI parser test harness
+#
+# Copyright (c) 2013 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or later.
+# See the COPYING file in the top-level directory.
+#
+
+from qapi import *
+from pprint import pprint
+import sys
+
+try:
+    exprs = parse_schema(sys.stdin)
+except SystemExit:
+    raise
+except:
+    print >>sys.stderr, "Crashed:", sys.exc_info()[0]
+    exit(1)
+
+pprint(exprs)
+pprint(enum_types)
+pprint(struct_types)
diff --git a/tests/qapi-schema/trailing-comma-list.err b/tests/qapi-schema/trailing-comma-list.err
new file mode 100644
index 0000000..ff839a3
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.err
@@ -0,0 +1 @@
+<stdin>:2:36: Expected "{", "[" or string
diff --git a/tests/qapi-schema/trailing-comma-list.exit b/tests/qapi-schema/trailing-comma-list.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/trailing-comma-list.json b/tests/qapi-schema/trailing-comma-list.json
new file mode 100644
index 0000000..9b0c8bd
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly', ] }
diff --git a/tests/qapi-schema/trailing-comma-list.out b/tests/qapi-schema/trailing-comma-list.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.out
diff --git a/tests/qapi-schema/trailing-comma-object.err b/tests/qapi-schema/trailing-comma-object.err
new file mode 100644
index 0000000..f540962
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.err
@@ -0,0 +1 @@
+<stdin>:2:38: Expected string
diff --git a/tests/qapi-schema/trailing-comma-object.exit b/tests/qapi-schema/trailing-comma-object.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/trailing-comma-object.json b/tests/qapi-schema/trailing-comma-object.json
new file mode 100644
index 0000000..bbaea55
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly' ], }
diff --git a/tests/qapi-schema/trailing-comma-object.out b/tests/qapi-schema/trailing-comma-object.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.out
diff --git a/tests/qapi-schema/unclosed-list.err b/tests/qapi-schema/unclosed-list.err
new file mode 100644
index 0000000..0e837a7
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.err
@@ -0,0 +1 @@
+<stdin>:1:20: Expected "," or "]"
diff --git a/tests/qapi-schema/unclosed-list.exit b/tests/qapi-schema/unclosed-list.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-list.json b/tests/qapi-schema/unclosed-list.json
new file mode 100644
index 0000000..e3e9566
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.json
@@ -0,0 +1 @@
+{ 'key': [ 'value' }
diff --git a/tests/qapi-schema/unclosed-list.out b/tests/qapi-schema/unclosed-list.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.out
diff --git a/tests/qapi-schema/unclosed-object.err b/tests/qapi-schema/unclosed-object.err
new file mode 100644
index 0000000..e6dc950
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.err
@@ -0,0 +1 @@
+<stdin>:1:21: Expected "," or "}"
diff --git a/tests/qapi-schema/unclosed-object.exit b/tests/qapi-schema/unclosed-object.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-object.json b/tests/qapi-schema/unclosed-object.json
new file mode 100644
index 0000000..8ac069d
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.json
@@ -0,0 +1 @@
+{ 'key': [ 'value' ]
diff --git a/tests/qapi-schema/unclosed-object.out b/tests/qapi-schema/unclosed-object.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.out
diff --git a/tests/qapi-schema/unclosed-string.err b/tests/qapi-schema/unclosed-string.err
new file mode 100644
index 0000000..948d883
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.err
@@ -0,0 +1 @@
+<stdin>:1:11: Missing terminating "'"
diff --git a/tests/qapi-schema/unclosed-string.exit b/tests/qapi-schema/unclosed-string.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-string.json b/tests/qapi-schema/unclosed-string.json
new file mode 100644
index 0000000..8c16b6b
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.json
@@ -0,0 +1,2 @@
+{ 'text': 'lorem ips
+}
diff --git a/tests/qapi-schema/unclosed-string.out b/tests/qapi-schema/unclosed-string.out
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.out
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index b1d03c7..69e208c 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -57,7 +57,7 @@
 048 img auto quick
 049 rw auto
 050 rw auto backing quick
-051 rw auto
+#051 rw auto
 052 rw auto backing
 053 rw auto
 054 rw auto
diff --git a/tests/tcg/mips/mips32-dsp/dpsq_s_w_ph.c b/tests/tcg/mips/mips32-dsp/dpsq_s_w_ph.c
index 22ab4d5..74058fe 100644
--- a/tests/tcg/mips/mips32-dsp/dpsq_s_w_ph.c
+++ b/tests/tcg/mips/mips32-dsp/dpsq_s_w_ph.c
@@ -9,8 +9,8 @@
 
     rs      = 0xBC0123AD;
     rt      = 0x01643721;
-    resulth = 0x04;
-    resultl = 0xEE9794A3;
+    resulth = 0x00000004;
+    resultl = 0xF15F94A3;
     __asm
         ("mthi  %0, $ac1\n\t"
          "mtlo  %1, $ac1\n\t"
@@ -23,12 +23,12 @@
     assert(ach == resulth);
     assert(acl == resultl);
 
-    ach = 0x1424Ef1f;
+    ach = 0x1424EF1F;
     acl = 0x1035219A;
     rs      = 0x800083AD;
     rt      = 0x80003721;
-    resulth = 0x1424ef1e;
-    resultl = 0x577ed901;
+    resulth = 0x1424EF1E;
+    resultl = 0xC5C0D901;
     __asm
         ("mthi  %0, $ac1\n\t"
          "mtlo  %1, $ac1\n\t"
diff --git a/tests/tcg/mips/mips32-dsp/maq_s_w_phl.c b/tests/tcg/mips/mips32-dsp/maq_s_w_phl.c
index 292d685..0f7c070 100644
--- a/tests/tcg/mips/mips32-dsp/maq_s_w_phl.c
+++ b/tests/tcg/mips/mips32-dsp/maq_s_w_phl.c
@@ -10,12 +10,12 @@
     int resulth, resultl;
     int resdsp;
 
-    achi = 0x05;
-    acli = 0xB4CB;
+    achi = 0x00000005;
+    acli = 0x0000B4CB;
     rs  = 0xFF060000;
     rt  = 0xCB000000;
-    resulth = 0x04;
-    resultl = 0x947438CB;
+    resulth = 0x00000005;
+    resultl = 0x006838CB;
 
     __asm
         ("mthi %2, $ac1\n\t"
@@ -29,12 +29,12 @@
     assert(resulth == acho);
     assert(resultl == aclo);
 
-    achi = 0x06;
-    acli = 0xB4CB;
+    achi = 0x00000006;
+    acli = 0x0000B4CB;
     rs  = 0x80000000;
     rt  = 0x80000000;
-    resulth = 0x6;
-    resultl = 0x8000b4ca;
+    resulth = 0x00000006;
+    resultl = 0x8000B4CA;
     resdsp = 1;
 
     __asm
diff --git a/tests/tcg/mips/mips32-dsp/maq_s_w_phr.c b/tests/tcg/mips/mips32-dsp/maq_s_w_phr.c
index 7b2ef2a..942722a 100644
--- a/tests/tcg/mips/mips32-dsp/maq_s_w_phr.c
+++ b/tests/tcg/mips/mips32-dsp/maq_s_w_phr.c
@@ -10,12 +10,12 @@
     int resulth, resultl;
     int resdsp;
 
-    achi = 0x05;
-    acli = 0xB4CB;
-    rs  = 0xFF06;
-    rt  = 0xCB00;
-    resulth = 0x04;
-    resultl = 0x947438CB;
+    achi = 0x00000005;
+    acli = 0x0000B4CB;
+    rs  = 0x0000FF06;
+    rt  = 0x0000CB00;
+    resulth = 0x00000005;
+    resultl = 0x006838CB;
 
     __asm
         ("mthi %2, $ac1\n\t"
@@ -29,12 +29,12 @@
     assert(resulth == acho);
     assert(resultl == aclo);
 
-    achi = 0x06;
-    acli = 0xB4CB;
-    rs  = 0x8000;
-    rt  = 0x8000;
-    resulth = 0x6;
-    resultl = 0x8000b4ca;
+    achi = 0x00000006;
+    acli = 0x0000B4CB;
+    rs  = 0x00008000;
+    rt  = 0x00008000;
+    resulth = 0x00000006;
+    resultl = 0x8000B4CA;
     resdsp = 1;
 
     __asm
diff --git a/tests/tcg/mips/mips32-dspr2/dpaqx_sa_w_ph.c b/tests/tcg/mips/mips32-dspr2/dpaqx_sa_w_ph.c
index 798c4da..d551d64 100644
--- a/tests/tcg/mips/mips32-dspr2/dpaqx_sa_w_ph.c
+++ b/tests/tcg/mips/mips32-dspr2/dpaqx_sa_w_ph.c
@@ -4,14 +4,17 @@
 int main()
 {
     int rs, rt, dsp;
-    int ach = 5, acl = 5;
+    int ach, acl;
     int resulth, resultl, resultdsp;
 
+    ach = 0x00000005;
+    acl = 0x00000005;
     rs     = 0x00FF00FF;
     rt     = 0x00010002;
     resulth = 0x00;
     resultl = 0x7FFFFFFF;
     resultdsp = 0x01;
+    dsp = 0;
     __asm
         ("wrdsp %2\n\t"
          "mthi  %0, $ac1\n\t"
@@ -27,13 +30,14 @@
     assert(ach == resulth);
     assert(acl == resultl);
 
-    ach = 9;
-    acl = 0xb;
+    ach = 0x00000009;
+    acl = 0x0000000B;
     rs     = 0x800000FF;
     rt     = 0x00018000;
     resulth = 0x00;
-    resultl = 0x7fffffff;
+    resultl = 0x7FFFFFFF;
     resultdsp = 0x01;
+    dsp = 0;
     __asm
         ("wrdsp %2\n\t"
          "mthi  %0, $ac1\n\t"
diff --git a/tests/tcg/mips/mips32-dspr2/dpsqx_s_w_ph.c b/tests/tcg/mips/mips32-dspr2/dpsqx_s_w_ph.c
index 14cdd7c..e40543f 100644
--- a/tests/tcg/mips/mips32-dspr2/dpsqx_s_w_ph.c
+++ b/tests/tcg/mips/mips32-dspr2/dpsqx_s_w_ph.c
@@ -9,8 +9,8 @@
 
     rs      = 0xBC0123AD;
     rt      = 0x01643721;
-    resulth = 0x04;
-    resultl = 0xAEA3E09B;
+    resulth = 0x00000005;
+    resultl = 0x1CE5E09B;
     resultdsp = 0x00;
     __asm
         ("mthi  %0, $ac1\n\t"
@@ -27,12 +27,12 @@
     assert(ach == resulth);
     assert(acl == resultl);
 
-    ach = 0x99f13005;
+    ach = 0x99F13005;
     acl = 0x51730062;
     rs      = 0x80008000;
     rt      = 0x80008000;
 
-    resulth = 0x99f13004;
+    resulth = 0x99F13004;
     resultl = 0x51730064;
     resultdsp = 0x01;
     __asm
diff --git a/tpm.c b/tpm.c
index f13c9bc..d68d69f 100644
--- a/tpm.c
+++ b/tpm.c
@@ -32,7 +32,7 @@
 };
 
 static enum TpmModel tpm_models[TPM_MAX_MODELS] = {
-    -1,
+    TPM_MODEL_MAX,
 };
 
 int tpm_register_model(enum TpmModel model)
@@ -40,7 +40,7 @@
     int i;
 
     for (i = 0; i < TPM_MAX_MODELS; i++) {
-        if (tpm_models[i] == -1) {
+        if (tpm_models[i] == TPM_MODEL_MAX) {
             tpm_models[i] = model;
             return 0;
         }
diff --git a/trace-events b/trace-events
index 0f7c8b4..3856b5c 100644
--- a/trace-events
+++ b/trace-events
@@ -1165,6 +1165,10 @@
 kvm_vcpu_ioctl(int cpu_index, int type, void *arg) "cpu_index %d, type %d, arg %p"
 kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 
+# memory.c
+memory_region_ops_read(void *mr, uint64_t addr, uint64_t value, unsigned size) "mr %p addr %#"PRIx64" value %#"PRIx64" size %u"
+memory_region_ops_write(void *mr, uint64_t addr, uint64_t value, unsigned size) "mr %p addr %#"PRIx64" value %#"PRIx64" size %u"
+
 # qom/object.c
 object_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
 object_class_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
diff --git a/ui/spice-core.c b/ui/spice-core.c
index f308fd9..bd7a248 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -48,6 +48,7 @@
 static time_t auth_expires = TIME_MAX;
 static int spice_migration_completed;
 int using_spice = 0;
+int spice_displays;
 
 static QemuThread me;
 
@@ -563,7 +564,7 @@
 {
     MigrationState *s = data;
 
-    if (migration_is_active(s)) {
+    if (migration_in_setup(s)) {
         spice_server_migrate_start(spice_server);
     } else if (migration_has_finished(s)) {
         spice_server_migrate_end(spice_server, true);
@@ -836,6 +837,10 @@
         qemu_add_vm_change_state_handler(vm_change_state_handler, NULL);
     }
 
+    if (strcmp(sin->sif->type, SPICE_INTERFACE_QXL) == 0) {
+        spice_displays++;
+    }
+
     return spice_server_add_interface(spice_server, sin);
 }
 
diff --git a/util/qemu-option.c b/util/qemu-option.c
index 5d686c8..7a1552a 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -173,8 +173,8 @@
     }
 }
 
-static void parse_option_size(const char *name, const char *value,
-                              uint64_t *ret, Error **errp)
+void parse_option_size(const char *name, const char *value,
+                       uint64_t *ret, Error **errp)
 {
     char *postfix;
     double sizef;
diff --git a/vl.c b/vl.c
index 25b8f2f..f422a1c 100644
--- a/vl.c
+++ b/vl.c
@@ -4387,7 +4387,7 @@
     }
 #endif
 #ifdef CONFIG_SPICE
-    if (using_spice && !qxl_enabled) {
+    if (using_spice && !spice_displays) {
         qemu_spice_display_init(ds);
     }
 #endif