271 files changed, 840 insertions, 497 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ebcef0ebe9..dce8f2d3f5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -87,11 +87,12 @@ build-tci:
  - ../configure --enable-tcg-interpreter
       --target-list="$(for tg in $TARGETS; do echo -n ${tg}'-softmmu '; done)"
  - make -j2
- - make tests/boot-serial-test tests/cdrom-test tests/pxe-test
+ - make tests/qtest/boot-serial-test tests/qtest/cdrom-test tests/qtest/pxe-test
  - for tg in $TARGETS ; do
      export QTEST_QEMU_BINARY="${tg}-softmmu/qemu-system-${tg}" ;
-     ./tests/boot-serial-test || exit 1 ;
-     ./tests/cdrom-test || exit 1 ;
+     ./tests/qtest/boot-serial-test || exit 1 ;
+     ./tests/qtest/cdrom-test || exit 1 ;
    done
- - QTEST_QEMU_BINARY="x86_64-softmmu/qemu-system-x86_64" ./tests/pxe-test
- - QTEST_QEMU_BINARY="s390x-softmmu/qemu-system-s390x" ./tests/pxe-test -m slow
+ - QTEST_QEMU_BINARY="x86_64-softmmu/qemu-system-x86_64" ./tests/qtest/pxe-test
+ - QTEST_QEMU_BINARY="s390x-softmmu/qemu-system-s390x"
+   ./tests/qtest/pxe-test -m slow
diff --git a/MAINTAINERS b/MAINTAINERS
index cd2dc137a3..483edfbc0b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -533,7 +533,7 @@ F: include/hw/misc/arm11scu.h
 F: include/hw/timer/a9gtimer.h
 F: include/hw/timer/arm_mptimer.h
 F: include/hw/timer/armv7m_systick.h
-F: tests/test-arm-mptimer.c
+F: tests/qtest/test-arm-mptimer.c
 
 Exynos
 M: Igor Mitsyanko <i.mitsyanko@gmail.com>
@@ -864,7 +864,7 @@ F: hw/*/nrf51*.c
 F: hw/*/microbit*.c
 F: include/hw/*/nrf51*.h
 F: include/hw/*/microbit*.h
-F: tests/microbit-test.c
+F: tests/qtest/microbit-test.c
 
 CRIS Machines
 -------------
@@ -1101,10 +1101,10 @@ F: include/hw/*/xics*
 F: pc-bios/slof.bin
 F: docs/specs/ppc-spapr-hcalls.txt
 F: docs/specs/ppc-spapr-hotplug.txt
-F: tests/spapr*
-F: tests/libqos/*spapr*
-F: tests/rtas*
-F: tests/libqos/rtas*
+F: tests/qtest/spapr*
+F: tests/qtest/libqos/*spapr*
+F: tests/qtest/rtas*
+F: tests/qtest/libqos/rtas*
 
 PowerNV (Non-Virtualized)
 M: Cédric Le Goater <clg@kaod.org>
@@ -1116,7 +1116,7 @@ F: hw/intc/pnv*
 F: hw/intc/xics_pnv.c
 F: include/hw/ppc/pnv*
 F: pc-bios/skiboot.lid
-F: tests/pnv*
+F: tests/qtest/pnv*
 
 virtex_ml507
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -1264,7 +1264,7 @@ F: hw/misc/sga.c
 F: hw/isa/apm.c
 F: include/hw/isa/apm.h
 F: tests/test-x86-cpuid.c
-F: tests/test-x86-cpuid-compat.c
+F: tests/qtest/test-x86-cpuid-compat.c
 
 PC Chipset
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -1360,10 +1360,10 @@ F: hw/ide/
 F: hw/block/block.c
 F: hw/block/cdrom.c
 F: hw/block/hd-geometry.c
-F: tests/ide-test.c
-F: tests/ahci-test.c
-F: tests/cdrom-test.c
-F: tests/libqos/ahci*
+F: tests/qtest/ide-test.c
+F: tests/qtest/ahci-test.c
+F: tests/qtest/cdrom-test.c
+F: tests/qtest/libqos/ahci*
 T: git https://github.com/jnsnow/qemu.git ide
 
 IPMI
@@ -1372,7 +1372,7 @@ S: Maintained
 F: include/hw/ipmi/*
 F: hw/ipmi/*
 F: hw/smbios/smbios_type_38.c
-F: tests/ipmi*
+F: tests/qtest/ipmi*
 T: git https://github.com/cminyard/qemu.git master-ipmi-rebase
 
 Floppy
@@ -1381,7 +1381,7 @@ L: qemu-block@nongnu.org
 S: Supported
 F: hw/block/fdc.c
 F: include/hw/block/fdc.h
-F: tests/fdc-test.c
+F: tests/qtest/fdc-test.c
 T: git https://github.com/jnsnow/qemu.git ide
 
 OMAP
@@ -1419,8 +1419,8 @@ F: hw/acpi/*
 F: hw/smbios/*
 F: hw/i386/acpi-build.[hc]
 F: hw/arm/virt-acpi-build.c
-F: tests/bios-tables-test.c
-F: tests/acpi-utils.[hc]
+F: tests/qtest/bios-tables-test.c
+F: tests/qtest/acpi-utils.[hc]
 F: tests/data/acpi/
 
 ppc4xx
@@ -1443,7 +1443,7 @@ M: Jason Wang <jasowang@redhat.com>
 S: Odd Fixes
 F: hw/net/
 F: include/hw/net/
-F: tests/virtio-net-test.c
+F: tests/qtest/virtio-net-test.c
 F: docs/virtio-net-failover.rst
 T: git https://github.com/jasowang/qemu.git net
 
@@ -1460,7 +1460,7 @@ R: Fam Zheng <fam@euphon.net>
 S: Supported
 F: include/hw/scsi/*
 F: hw/scsi/*
-F: tests/virtio-scsi-test.c
+F: tests/qtest/virtio-scsi-test.c
 T: git https://github.com/bonzini/qemu.git scsi-next
 
 SSI
@@ -1470,7 +1470,7 @@ F: hw/ssi/*
 F: hw/block/m25p80.c
 F: include/hw/ssi/ssi.h
 X: hw/ssi/xilinx_*
-F: tests/m25p80-test.c
+F: tests/qtest/m25p80-test.c
 
 Xilinx SPI
 M: Alistair Francis <alistair@alistair23.me>
@@ -1484,13 +1484,13 @@ F: include/hw/sd/sd*
 F: hw/sd/core.c
 F: hw/sd/sd*
 F: hw/sd/ssi-sd.c
-F: tests/sd*
+F: tests/qtest/sd*
 
 USB
 M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: hw/usb/*
-F: tests/usb-*-test.c
+F: tests/qtest/usb-*-test.c
 F: docs/usb2.txt
 F: docs/usb-storage.txt
 F: include/hw/usb.h
@@ -1552,7 +1552,6 @@ F: hw/virtio/Makefile.objs
 F: hw/virtio/trace-events
 F: net/vhost-user.c
 F: include/hw/virtio/
-F: tests/virtio-balloon-test.c
 
 virtio-9p
 M: Greg Kurz <groug@kaod.org>
@@ -1560,7 +1559,7 @@ S: Odd Fixes
 F: hw/9pfs/
 X: hw/9pfs/xen-9p*
 F: fsdev/
-F: tests/virtio-9p-test.c
+F: tests/qtest/virtio-9p-test.c
 T: git https://github.com/gkurz/qemu.git 9p-next
 
 virtio-blk
@@ -1569,7 +1568,7 @@ L: qemu-block@nongnu.org
 S: Supported
 F: hw/block/virtio-blk.c
 F: hw/block/dataplane/*
-F: tests/virtio-blk-test.c
+F: tests/qtest/virtio-blk-test.c
 T: git https://github.com/stefanha/qemu.git block
 
 virtio-ccw
@@ -1597,8 +1596,7 @@ S: Supported
 F: hw/char/virtio-serial-bus.c
 F: hw/char/virtio-console.c
 F: include/hw/virtio/virtio-serial.h
-F: tests/virtio-console-test.c
-F: tests/virtio-serial-test.c
+F: tests/qtest/virtio-serial-test.c
 
 virtio-rng
 M: Laurent Vivier <lvivier@redhat.com>
@@ -1608,7 +1606,7 @@ F: hw/virtio/virtio-rng.c
 F: include/hw/virtio/virtio-rng.h
 F: include/sysemu/rng*.h
 F: backends/rng*.c
-F: tests/virtio-rng-test.c
+F: tests/qtest/virtio-rng-test.c
 
 virtio-crypto
 M: Gonglei <arei.gonglei@huawei.com>
@@ -1622,7 +1620,7 @@ M: Keith Busch <keith.busch@intel.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: hw/block/nvme*
-F: tests/nvme-test.c
+F: tests/qtest/nvme-test.c
 
 megasas
 M: Hannes Reinecke <hare@suse.com>
@@ -1630,7 +1628,7 @@ L: qemu-block@nongnu.org
 S: Supported
 F: hw/scsi/megasas.c
 F: hw/scsi/mfi.h
-F: tests/megasas-test.c
+F: tests/qtest/megasas-test.c
 
 Network packet abstractions
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
@@ -1645,7 +1643,7 @@ M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/vmxnet*
 F: hw/scsi/vmw_pvscsi*
-F: tests/vmxnet3-test.c
+F: tests/qtest/vmxnet3-test.c
 
 Rocker
 M: Jiri Pirko <jiri@resnulli.us>
@@ -1693,7 +1691,7 @@ F: docs/generic-loader.txt
 Intel Hexadecimal Object File Loader
 M: Su Hang <suhang16@mails.ucas.ac.cn>
 S: Maintained
-F: tests/hexloader-test.c
+F: tests/qtest/hexloader-test.c
 F: tests/data/hex-loader/test.hex
 
 CHRP NVRAM
@@ -1701,7 +1699,7 @@ M: Thomas Huth <thuth@redhat.com>
 S: Maintained
 F: hw/nvram/chrp_nvram.c
 F: include/hw/nvram/chrp_nvram.h
-F: tests/prom-env-test.c
+F: tests/qtest/prom-env-test.c
 
 VM Generation ID
 M: Ben Warren <ben@skyportsystems.com>
@@ -1709,7 +1707,7 @@ S: Maintained
 F: hw/acpi/vmgenid.c
 F: include/hw/acpi/vmgenid.h
 F: docs/specs/vmgenid.txt
-F: tests/vmgenid-test.c
+F: tests/qtest/vmgenid-test.c
 F: stubs/vmgenid.c
 
 Unimplemented device
@@ -1778,8 +1776,8 @@ F: hw/nvram/fw_cfg.c
 F: stubs/fw_cfg.c
 F: include/hw/nvram/fw_cfg.h
 F: include/standard-headers/linux/qemu_fw_cfg.h
-F: tests/libqos/fw_cfg.c
-F: tests/fw_cfg-test.c
+F: tests/qtest/libqos/fw_cfg.c
+F: tests/qtest/fw_cfg-test.c
 T: git https://github.com/philmd/qemu.git fw_cfg-next
 
 XIVE
@@ -1799,9 +1797,9 @@ S: Maintained
 F: audio/
 F: hw/audio/
 F: include/hw/audio/
-F: tests/ac97-test.c
-F: tests/es1370-test.c
-F: tests/intel-hda-test.c
+F: tests/qtest/ac97-test.c
+F: tests/qtest/es1370-test.c
+F: tests/qtest/intel-hda-test.c
 
 Block layer core
 M: Kevin Wolf <kwolf@redhat.com>
@@ -2002,7 +2000,7 @@ F: monitor/hmp*
 F: hmp.h
 F: hmp-commands*.hx
 F: include/monitor/hmp-target.h
-F: tests/test-hmp.c
+F: tests/qtest/test-hmp.c
 F: include/qemu/qemu-print.h
 F: util/qemu-print.c
 
@@ -2128,8 +2126,8 @@ F: qapi/error.json
 F: docs/devel/*qmp-*
 F: docs/interop/*qmp-*
 F: scripts/qmp/
-F: tests/qmp-test.c
-F: tests/qmp-cmd-test.c
+F: tests/qtest/qmp-test.c
+F: tests/qtest/qmp-cmd-test.c
 T: git https://repo.or.cz/qemu/armbru.git qapi-next
 
 qtest
@@ -2139,9 +2137,7 @@ R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: qtest.c
 F: accel/qtest.c
-F: tests/libqtest*
-F: tests/libqos/
-F: tests/*-test.c
+F: tests/qtest/
 
 Register API
 M: Alistair Francis <alistair@alistair23.me>
@@ -2185,7 +2181,7 @@ F: include/hw/acpi/tpm.h
 F: include/sysemu/tpm*
 F: qapi/tpm.json
 F: backends/tpm.c
-F: tests/*tpm*
+F: tests/qtest/*tpm*
 T: git https://github.com/stefanberger/qemu-tpm.git tpm-next
 
 Checkpatch
@@ -2202,7 +2198,7 @@ F: include/migration/
 F: migration/
 F: scripts/vmstate-static-checker.py
 F: tests/vmstate-static-checker-data/
-F: tests/migration-test.c
+F: tests/qtest/migration-test.c
 F: docs/devel/migration.rst
 F: qapi/migration.json
 
@@ -2659,7 +2655,7 @@ F: tests/test-replication.c
 F: docs/block-replication.txt
 
 PVRDMA
-M: Yuval Shaia <yuval.shaia@oracle.com>
+M: Yuval Shaia <yuval.shaia.ml@gmail.com>
 M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
 S: Maintained
 F: hw/rdma/*
diff --git a/Makefile b/Makefile
index 56ff731a53..afa5cb6548 100644
--- a/Makefile
+++ b/Makefile
@@ -344,6 +344,7 @@ DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/
 DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
 DOCS+=docs/qemu-block-drivers.7
 DOCS+=docs/qemu-cpu-models.7
+DOCS+=$(MANUAL_BUILDDIR)/index.html
 ifdef CONFIG_VIRTFS
 DOCS+=fsdev/virtfs-proxy-helper.1
 endif
@@ -813,6 +814,7 @@ install-sphinxdocs: sphinxdocs
 
 install-doc: $(DOCS) install-sphinxdocs
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) $(MANUAL_BUILDDIR)/index.html "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) qemu-doc.html "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) qemu-doc.txt "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.html "$(DESTDIR)$(qemu_docdir)"
@@ -1019,6 +1021,10 @@ $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
 $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
 	$(call build-manual,interop,man)
 
+$(MANUAL_BUILDDIR)/index.html: $(SRC_PATH)/docs/index.html.in qemu-version.h
+	$(call quiet-command, sed "s|@@VERSION@@|${VERSION}|g" $< >$@, \
+             "GEN","$@")
+
 qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
 
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index b2f1a5bcb5..1ada2f4ecb 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -98,7 +98,7 @@ struct KVMState
     int kvm_shadow_mem;
     bool kernel_irqchip_allowed;
     bool kernel_irqchip_required;
-    bool kernel_irqchip_split;
+    OnOffAuto kernel_irqchip_split;
     bool sync_mmu;
     bool manual_dirty_log_protect;
     /* The man page (and posix) say ioctl numbers are signed int, but
@@ -1783,6 +1783,7 @@ static void kvm_irqchip_create(KVMState *s)
 {
     int ret;
 
+    assert(s->kernel_irqchip_split != ON_OFF_AUTO_AUTO);
     if (kvm_check_extension(s, KVM_CAP_IRQCHIP)) {
         ;
     } else if (kvm_check_extension(s, KVM_CAP_S390_IRQCHIP)) {
@@ -1799,7 +1800,7 @@ static void kvm_irqchip_create(KVMState *s)
      * in-kernel irqchip for us */
     ret = kvm_arch_irqchip_create(s);
     if (ret == 0) {
-        if (s->kernel_irqchip_split) {
+        if (s->kernel_irqchip_split == ON_OFF_AUTO_ON) {
             perror("Split IRQ chip mode not supported.");
             exit(1);
         } else {
@@ -2070,6 +2071,10 @@ static int kvm_init(MachineState *ms)
         goto err;
     }
 
+    if (s->kernel_irqchip_split == ON_OFF_AUTO_AUTO) {
+        s->kernel_irqchip_split = mc->default_kernel_irqchip_split ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+    }
+
     if (s->kernel_irqchip_allowed) {
         kvm_irqchip_create(s);
     }
@@ -3005,17 +3010,17 @@ static void kvm_set_kernel_irqchip(Object *obj, Visitor *v,
         case ON_OFF_SPLIT_ON:
             s->kernel_irqchip_allowed = true;
             s->kernel_irqchip_required = true;
-            s->kernel_irqchip_split = false;
+            s->kernel_irqchip_split = ON_OFF_AUTO_OFF;
             break;
         case ON_OFF_SPLIT_OFF:
             s->kernel_irqchip_allowed = false;
             s->kernel_irqchip_required = false;
-            s->kernel_irqchip_split = false;
+            s->kernel_irqchip_split = ON_OFF_AUTO_OFF;
             break;
         case ON_OFF_SPLIT_SPLIT:
             s->kernel_irqchip_allowed = true;
             s->kernel_irqchip_required = true;
-            s->kernel_irqchip_split = true;
+            s->kernel_irqchip_split = ON_OFF_AUTO_ON;
             break;
         default:
             /* The value was checked in visit_type_OnOffSplit() above. If
@@ -3038,7 +3043,7 @@ bool kvm_kernel_irqchip_required(void)
 
 bool kvm_kernel_irqchip_split(void)
 {
-    return kvm_state->kernel_irqchip_split;
+    return kvm_state->kernel_irqchip_split == ON_OFF_AUTO_ON;
 }
 
 static void kvm_accel_instance_init(Object *obj)
@@ -3046,6 +3051,8 @@ static void kvm_accel_instance_init(Object *obj)
     KVMState *s = KVM_STATE(obj);
 
     s->kvm_shadow_mem = -1;
+    s->kernel_irqchip_allowed = true;
+    s->kernel_irqchip_split = ON_OFF_AUTO_AUTO;
 }
 
 static void kvm_accel_class_init(ObjectClass *oc, void *data)
diff --git a/backends/cryptodev-vhost-user.c b/backends/cryptodev-vhost-user.c
index b344283940..6edada8e9e 100644
--- a/backends/cryptodev-vhost-user.c
+++ b/backends/cryptodev-vhost-user.c
@@ -152,7 +152,7 @@ cryptodev_vhost_claim_chardev(CryptoDevBackendVhostUser *s,
     return chr;
 }
 
-static void cryptodev_vhost_user_event(void *opaque, int event)
+static void cryptodev_vhost_user_event(void *opaque, QEMUChrEvent event)
 {
     CryptoDevBackendVhostUser *s = opaque;
     CryptoDevBackend *b = CRYPTODEV_BACKEND(s);
@@ -171,6 +171,11 @@ static void cryptodev_vhost_user_event(void *opaque, int event)
         b->ready = false;
         cryptodev_vhost_user_stop(queues, s);
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/block/linux-aio.c b/block/linux-aio.c
index c7eca9a256..91204a25a2 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -26,7 +26,7 @@
  *      than this we will get EAGAIN from io_submit which is communicated to
  *      the guest as an I/O error.
  */
-#define MAX_EVENTS 128
+#define MAX_EVENTS 1024
 
 struct qemu_laiocb {
     Coroutine *co;
diff --git a/chardev/char-mux.c b/chardev/char-mux.c
index 200c62a0d0..46c44af67c 100644
--- a/chardev/char-mux.c
+++ b/chardev/char-mux.c
@@ -117,7 +117,7 @@ static void mux_print_help(Chardev *chr)
     }
 }
 
-static void mux_chr_send_event(MuxChardev *d, int mux_nr, int event)
+static void mux_chr_send_event(MuxChardev *d, int mux_nr, QEMUChrEvent event)
 {
     CharBackend *be = d->backends[mux_nr];
 
@@ -126,7 +126,7 @@ static void mux_chr_send_event(MuxChardev *d, int mux_nr, int event)
     }
 }
 
-static void mux_chr_be_event(Chardev *chr, int event)
+static void mux_chr_be_event(Chardev *chr, QEMUChrEvent event)
 {
     MuxChardev *d = MUX_CHARDEV(chr);
 
@@ -232,7 +232,7 @@ static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
         }
 }
 
-void mux_chr_send_all_event(Chardev *chr, int event)
+void mux_chr_send_all_event(Chardev *chr, QEMUChrEvent event)
 {
     MuxChardev *d = MUX_CHARDEV(chr);
     int i;
@@ -247,7 +247,7 @@ void mux_chr_send_all_event(Chardev *chr, int event)
     }
 }
 
-static void mux_chr_event(void *opaque, int event)
+static void mux_chr_event(void *opaque, QEMUChrEvent event)
 {
     mux_chr_send_all_event(CHARDEV(opaque), event);
 }
diff --git a/chardev/char.c b/chardev/char.c
index e7e7492b0e..87237568df 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -49,7 +49,7 @@ static Object *get_chardevs_root(void)
     return container_get(object_get_root(), "/chardevs");
 }
 
-static void chr_be_event(Chardev *s, int event)
+static void chr_be_event(Chardev *s, QEMUChrEvent event)
 {
     CharBackend *be = s->be;
 
@@ -60,7 +60,7 @@ static void chr_be_event(Chardev *s, int event)
     be->chr_event(be->opaque, event);
 }
 
-void qemu_chr_be_event(Chardev *s, int event)
+void qemu_chr_be_event(Chardev *s, QEMUChrEvent event)
 {
     /* Keep track if the char device is open */
     switch (event) {
@@ -70,6 +70,11 @@ void qemu_chr_be_event(Chardev *s, int event)
         case CHR_EVENT_CLOSED:
             s->be_open = 0;
             break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 
     CHARDEV_GET_CLASS(s)->chr_be_event(s, event);
diff --git a/configure b/configure
index 28ee2a254f..08c3a1c1f0 100755
--- a/configure
+++ b/configure
@@ -7963,8 +7963,8 @@ fi
 # so the build tree will be missing the link back to the new file, and
 # tests might fail. Prefer to keep the relevant files in their own
 # directory and symlink the directory instead.
-DIRS="tests tests/tcg tests/tcg/lm32 tests/libqos tests/qapi-schema tests/qemu-iotests tests/vm"
-DIRS="$DIRS tests/fp tests/qgraph"
+DIRS="tests tests/tcg tests/tcg/lm32 tests/qapi-schema tests/qtest/libqos"
+DIRS="$DIRS tests/qtest tests/qemu-iotests tests/vm tests/fp tests/qgraph"
 DIRS="$DIRS docs docs/interop fsdev scsi"
 DIRS="$DIRS pc-bios/optionrom pc-bios/s390-ccw"
 DIRS="$DIRS roms/seabios roms/vgabios"
diff --git a/cpus.c b/cpus.c
index b472378b70..be2d655f37 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1316,6 +1316,10 @@ static int64_t tcg_get_icount_limit(void)
          */
         deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
                                               QEMU_TIMER_ATTR_ALL);
+        /* Check realtime timers, because they help with input processing */
+        deadline = qemu_soonest_timeout(deadline,
+                qemu_clock_deadline_ns_all(QEMU_CLOCK_REALTIME,
+                                           QEMU_TIMER_ATTR_ALL));
 
         /* Maintain prior (possibly buggy) behaviour where if no deadline
          * was set (as there is no QEMU_CLOCK_VIRTUAL timer) or it is more than
diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
index bf86128a0c..61b78b844d 100644
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -1,7 +1,6 @@
 # Default configuration for ppc-softmmu
 
 # For embedded PPCs:
-CONFIG_MPC_I2C=y
 CONFIG_DS1338=y
 CONFIG_E500=y
 CONFIG_PPC405=y
diff --git a/docs/index.html.in b/docs/index.html.in
new file mode 100644
index 0000000000..94eb782cf7
--- /dev/null
+++ b/docs/index.html.in
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <title>QEMU @@VERSION@@ Documentation</title>
+    </head>
+    <body>
+        <h1>QEMU @@VERSION@@ Documentation</h1>
+        <ul>
+            <li><a href="qemu-doc.html">User Documentation</a></li>
+            <li><a href="qemu-qmp-ref.html">QMP Reference Manual</a></li>
+            <li><a href="qemu-ga-ref.html">Guest Agent Protocol Reference</a></li>
+            <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
+            <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
+        </ul>
+    </body>
+</html>
diff --git a/docs/replay.txt b/docs/replay.txt
index ce97c3f72f..f4619a62a3 100644
--- a/docs/replay.txt
+++ b/docs/replay.txt
@@ -67,6 +67,7 @@ Modifications of qemu include:
  * network filter for recording and replaying the packets
  * block driver for making block layer deterministic
  * serial port input record and replay
+ * recording of random numbers obtained from the external sources
 
 Locking and thread synchronisation
 ----------------------------------
diff --git a/gdbstub.c b/gdbstub.c
index 4cf8af365e..ce304ff482 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -3171,7 +3171,7 @@ static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void gdb_chr_event(void *opaque, int event)
+static void gdb_chr_event(void *opaque, QEMUChrEvent event)
 {
     int i;
     GDBState *s = (GDBState *) opaque;
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index cdafde2f76..950ff4239a 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -1955,7 +1955,7 @@ static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, int size)
     pxa2xx_fir_update(s);
 }
 
-static void pxa2xx_fir_event(void *opaque, int event)
+static void pxa2xx_fir_event(void *opaque, QEMUChrEvent event)
 {
 }
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 6bee034914..c6776e8479 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -1093,7 +1093,7 @@ static void strongarm_uart_receive(void *opaque, const uint8_t *buf, int size)
     strongarm_uart_update_int_status(s);
 }
 
-static void strongarm_uart_event(void *opaque, int event)
+static void strongarm_uart_event(void *opaque, QEMUChrEvent event)
 {
     StrongARMUARTState *s = opaque;
     if (event == CHR_EVENT_BREAK) {
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 63da9bb619..98b383f90e 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -361,7 +361,7 @@ static gboolean vhost_user_blk_watch(GIOChannel *chan, GIOCondition cond,
     return true;
 }
 
-static void vhost_user_blk_event(void *opaque, int event)
+static void vhost_user_blk_event(void *opaque, QEMUChrEvent event)
 {
     DeviceState *dev = opaque;
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
@@ -383,6 +383,11 @@ static void vhost_user_blk_event(void *opaque, int event)
             s->watch = 0;
         }
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 0e315b2376..51791bd217 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -348,7 +348,7 @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
     CadenceUARTState *s = opaque;
     uint8_t buf = '\0';
diff --git a/hw/char/digic-uart.c b/hw/char/digic-uart.c
index 974a2619dd..033eba0a6a 100644
--- a/hw/char/digic-uart.c
+++ b/hw/char/digic-uart.c
@@ -131,7 +131,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, int size)
     s->reg_rx = *buf;
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
 }
 
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 8f7bf322cb..c40c1d28f1 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -634,7 +634,7 @@ static void serial_receive1(void *opaque, const uint8_t *buf, int size)
     serial_receive_byte(s, buf[0]);
 }
 
-static void serial_event(void *opaque, int event)
+static void serial_event(void *opaque, QEMUChrEvent event)
 {
     ESCCChannelState *s = opaque;
     if (event == CHR_EVENT_BREAK)
diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index 15ac12ef22..f34f767c60 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -202,7 +202,7 @@ static int serial_can_receive(void *opaque)
     return sizeof(s->rx_fifo) - s->rx_fifo_len;
 }
 
-static void serial_event(void *opaque, int event)
+static void serial_event(void *opaque, QEMUChrEvent event)
 {
 
 }
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index d6b6b62366..7e5c5ce789 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -528,7 +528,7 @@ static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)
 }
 
 
-static void exynos4210_uart_event(void *opaque, int event)
+static void exynos4210_uart_event(void *opaque, QEMUChrEvent event)
 {
     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
 
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index fe3cbf41a3..8e59c3bc6e 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -155,7 +155,7 @@ static void grlib_apbuart_receive(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void grlib_apbuart_event(void *opaque, int event)
+static void grlib_apbuart_event(void *opaque, QEMUChrEvent event)
 {
     trace_grlib_apbuart_event(event);
 }
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index fddde9b43d..d09c210709 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -323,7 +323,7 @@ static void imx_receive(void *opaque, const uint8_t *buf, int size)
     imx_put_data(opaque, *buf);
 }
 
-static void imx_event(void *opaque, int event)
+static void imx_event(void *opaque, QEMUChrEvent event)
 {
     if (event == CHR_EVENT_BREAK) {
         imx_put_data(opaque, URXD_BRK | URXD_FRMERR | URXD_ERR);
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index 66c163ba26..80e9dff701 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -503,7 +503,7 @@ static void hostdev_receive(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void hostdev_event(void *opaque, int event)
+static void hostdev_event(void *opaque, QEMUChrEvent event)
 {
     SCC2698Channel *ch = opaque;
     switch (event) {
diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index e0b1bd6555..da9dd5668b 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -104,7 +104,7 @@ static int juart_can_rx(void *opaque)
     return !(s->jrx & JRX_FULL);
 }
 
-static void juart_event(void *opaque, int event)
+static void juart_event(void *opaque, QEMUChrEvent event)
 {
 }
 
diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index 32f29c44cf..8d7a475c91 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -235,7 +235,7 @@ static int uart_can_rx(void *opaque)
     return !(s->regs[R_LSR] & LSR_DR);
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
 }
 
diff --git a/hw/char/mcf_uart.c b/hw/char/mcf_uart.c
index 58323baf43..2de3680b5d 100644
--- a/hw/char/mcf_uart.c
+++ b/hw/char/mcf_uart.c
@@ -256,7 +256,7 @@ static void mcf_uart_push_byte(mcf_uart_state *s, uint8_t data)
     mcf_uart_update(s);
 }
 
-static void mcf_uart_event(void *opaque, int event)
+static void mcf_uart_event(void *opaque, QEMUChrEvent event)
 {
     mcf_uart_state *s = (mcf_uart_state *)opaque;
 
diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index c358ca07f3..1c7b61480e 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -180,7 +180,7 @@ static int uart_can_rx(void *opaque)
     return !(s->regs[R_STAT] & STAT_RX_EVT);
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
 }
 
diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
index 2777afe366..b67fd21089 100644
--- a/hw/char/nrf51_uart.c
+++ b/hw/char/nrf51_uart.c
@@ -245,7 +245,7 @@ static int uart_can_receive(void *opaque)
     return s->rx_started ? (UART_FIFO_LENGTH - s->rx_fifo_len) : 0;
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
     NRF51UARTState *s = NRF51_UART(opaque);
 
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index 84ad8ff9fb..23cd544cc5 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -280,7 +280,7 @@ static void pl011_receive(void *opaque, const uint8_t *buf, int size)
     pl011_put_fifo(opaque, *buf);
 }
 
-static void pl011_event(void *opaque, int event)
+static void pl011_event(void *opaque, QEMUChrEvent event)
 {
     if (event == CHR_EVENT_BREAK)
         pl011_put_fifo(opaque, 0x400);
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 6c327183c7..d167c43d40 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -635,7 +635,7 @@ static void serial_receive1(void *opaque, const uint8_t *buf, int size)
     serial_update_irq(s);
 }
 
-static void serial_event(void *opaque, int event)
+static void serial_event(void *opaque, QEMUChrEvent event)
 {
     SerialState *s = opaque;
     DPRINTF("event %x\n", event);
diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 07dc16be13..167f4d8cb9 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -358,7 +358,7 @@ static void sh_serial_receive1(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void sh_serial_event(void *opaque, int event)
+static void sh_serial_event(void *opaque, QEMUChrEvent event)
 {
     sh_serial_state *s = opaque;
     if (event == CHR_EVENT_BREAK)
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index 6859c1bcb2..f7aba12565 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -142,7 +142,7 @@ static void terminal_read(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void chr_event(void *opaque, int event)
+static void chr_event(void *opaque, QEMUChrEvent event)
 {
     Terminal3270 *t = opaque;
     CcwDevice *ccw_dev = CCW_DEVICE(t);
@@ -166,6 +166,11 @@ static void chr_event(void *opaque, int event)
         sch->curr_status.scsw.dstat = SCSW_DSTAT_DEVICE_END;
         css_conditional_io_interrupt(sch);
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index c13649f1ef..a7d34fe0ed 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -145,7 +145,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
     virtio_serial_write(port, buf, size);
 }
 
-static void chr_event(void *opaque, int event)
+static void chr_event(void *opaque, QEMUChrEvent event)
 {
     VirtConsole *vcon = opaque;
     VirtIOSerialPort *port = VIRTIO_SERIAL_PORT(vcon);
@@ -162,6 +162,11 @@ static void chr_event(void *opaque, int event)
         }
         virtio_serial_close(port);
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 2c47275068..aa6bf02e21 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -206,7 +206,7 @@ static int uart_can_rx(void *opaque)
     return s->rx_fifo_len < sizeof(s->rx_fifo);
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
 
 }
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 4f30fb5646..3e288bfceb 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -32,6 +32,8 @@ GlobalProperty hw_compat_4_2[] = {
     { "virtio-blk-device", "seg-max-adjust", "off"},
     { "virtio-scsi-device", "seg_max_adjust", "off"},
     { "vhost-blk-device", "seg_max_adjust", "off"},
+    { "usb-host", "suppress-remote-wake", "off" },
+    { "usb-redir", "suppress-remote-wake", "off" },
 };
 const size_t hw_compat_4_2_len = G_N_ELEMENTS(hw_compat_4_2);
 
diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index 91cf5843b4..cdc851598c 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -95,7 +95,7 @@ config Q35
 
 config MICROVM
     bool
-    imply SERIAL_ISA
+    select SERIAL_ISA # for serial_hds_isa_init()
     select ISA_BUS
     select APIC
     select IOAPIC
diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index d8bb5c2a96..9b9a4d5837 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -612,6 +612,7 @@ void x86_load_linux(X86MachineState *x86ms,
     vmode = strstr(kernel_cmdline, "vga=");
     if (vmode) {
         unsigned int video_mode;
+        const char *end;
         int ret;
         /* skip "vga=" */
         vmode += 4;
@@ -622,10 +623,9 @@ void x86_load_linux(X86MachineState *x86ms,
         } else if (!strncmp(vmode, "ask", 3)) {
             video_mode = 0xfffd;
         } else {
-            ret = qemu_strtoui(vmode, NULL, 0, &video_mode);
-            if (ret != 0) {
-                fprintf(stderr, "qemu: can't parse 'vga' parameter: %s\n",
-                        strerror(-ret));
+            ret = qemu_strtoui(vmode, &end, 0, &video_mode);
+            if (ret != 0 || (*end && *end != ' ')) {
+                fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n");
                 exit(1);
             }
         }
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 10a680b53a..a189d6fedd 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -3,6 +3,7 @@ config HEATHROW_PIC
 
 config I8259
     bool
+    select ISA_BUS
 
 config PL190
     bool
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index 87da9ff99c..16a4117ab0 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -87,10 +87,6 @@ typedef struct IPMIBmcExtern {
     bool send_reset;
 } IPMIBmcExtern;
 
-static int can_receive(void *opaque);
-static void receive(void *opaque, const uint8_t *buf, int size);
-static void chr_event(void *opaque, int event);
-
 static unsigned char
 ipmb_checksum(const unsigned char *data, int size, unsigned char start)
 {
@@ -383,7 +379,7 @@ static void receive(void *opaque, const uint8_t *buf, int size)
     handle_hw_op(ibe, hw_op);
 }
 
-static void chr_event(void *opaque, int event)
+static void chr_event(void *opaque, QEMUChrEvent event)
 {
     IPMIBmcExtern *ibe = opaque;
     IPMIInterface *s = ibe->parent.intf;
@@ -439,6 +435,12 @@ static void chr_event(void *opaque, int event)
             k->handle_rsp(s, ibe->outbuf[0], ibe->inbuf + 1, 3);
         }
         break;
+
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index 23fdd5ec6a..0df3a7755a 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -98,7 +98,7 @@ enum boston_plat_reg {
     PLAT_SYS_CTL        = 0x48,
 };
 
-static void boston_lcd_event(void *opaque, int event)
+static void boston_lcd_event(void *opaque, QEMUChrEvent event)
 {
     BostonState *s = opaque;
     if (event == CHR_EVENT_OPENED && !s->lcd_inited) {
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index ea92e5e27d..5aaeaa8d53 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -545,7 +545,7 @@ static void malta_fpga_reset(void *opaque)
     snprintf(s->display_text, 9, "        ");
 }
 
-static void malta_fgpa_display_event(void *opaque, int event)
+static void malta_fgpa_display_event(void *opaque, QEMUChrEvent event)
 {
     MaltaFPGAState *s = opaque;
 
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index 3856417d42..af6a11baf3 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -14,6 +14,7 @@ config EEPRO100_PCI
     bool
     default y if PCI_DEVICES
     depends on PCI
+    select NMC93XX_EEPROM
 
 config PCNET_PCI
     bool
@@ -28,6 +29,7 @@ config TULIP
     bool
     default y if PCI_DEVICES
     depends on PCI
+    select NMC93XX_EEPROM
 
 config E1000_PCI
     bool
diff --git a/hw/nvram/Kconfig b/hw/nvram/Kconfig
index ebaa749ce9..e872fcb194 100644
--- a/hw/nvram/Kconfig
+++ b/hw/nvram/Kconfig
@@ -7,3 +7,11 @@ config AT24C
 
 config MAC_NVRAM
     bool
+    select CHRP_NVRAM
+
+# NMC93XX uses the NS uWire interface (similar to SPI but less configurable)
+config NMC93XX_EEPROM
+    bool
+
+config CHRP_NVRAM
+    bool
diff --git a/hw/nvram/Makefile.objs b/hw/nvram/Makefile.objs
index 26f7b4ca35..090df63fcd 100644
--- a/hw/nvram/Makefile.objs
+++ b/hw/nvram/Makefile.objs
@@ -1,8 +1,8 @@
 common-obj-$(CONFIG_DS1225Y) += ds1225y.o
-common-obj-y += eeprom93xx.o
+common-obj-$(CONFIG_NMC93XX_EEPROM) += eeprom93xx.o
 common-obj-$(CONFIG_AT24C) += eeprom_at24c.o
 common-obj-y += fw_cfg.o
-common-obj-y += chrp_nvram.o
+common-obj-$(CONFIG_CHRP_NVRAM) += chrp_nvram.o
 common-obj-$(CONFIG_MAC_NVRAM) += mac_nvram.o
 obj-$(CONFIG_PSERIES) += spapr_nvram.o
 obj-$(CONFIG_NRF51_SOC) += nrf51_nvm.o
diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
index f927ec9c74..e27efe9a24 100644
--- a/hw/ppc/Kconfig
+++ b/hw/ppc/Kconfig
@@ -10,6 +10,8 @@ config PSERIES
     select XICS_SPAPR
     select XIVE_SPAPR
     select MSI_NONBROKEN
+    select FDT_PPC
+    select CHRP_NVRAM
 
 config SPAPR_RNG
     bool
@@ -26,6 +28,7 @@ config POWERNV
     select MC146818RTC
     select XICS
     select XIVE
+    select FDT_PPC
 
 config PPC405
     bool
@@ -42,6 +45,7 @@ config PPC440
     select PCI_EXPRESS
     select PPC4XX
     select SERIAL
+    select FDT_PPC
 
 config PPC4XX
     bool
@@ -50,6 +54,7 @@ config PPC4XX
 
 config SAM460EX
     bool
+    select PPC405
     select PFLASH_CFI01
     select IDE_SII3112
     select M41T80
@@ -59,6 +64,7 @@ config SAM460EX
     select SMBUS_EEPROM
     select USB_EHCI_SYSBUS
     select USB_OHCI
+    select FDT_PPC
 
 config PREP
     bool
@@ -71,6 +77,7 @@ config PREP
     select M48T59
     select PC87312
     select RS6000_MC
+    select FW_CFG_PPC
 
 config RS6000_MC
     bool
@@ -84,6 +91,7 @@ config MAC_OLDWORLD
     select GRACKLE_PCI
     select HEATHROW_PIC
     select MACIO
+    select FW_CFG_PPC
 
 config MAC_NEWWORLD
     bool
@@ -95,6 +103,7 @@ config MAC_NEWWORLD
     select MACIO_GPIO
     select MAC_PMU
     select UNIN_PCI
+    select FW_CFG_PPC
 
 config E500
     bool
@@ -105,13 +114,17 @@ config E500
     select PLATFORM_BUS
     select PPCE500_PCI
     select SERIAL
+    select MPC_I2C
+    select FDT_PPC
 
 config VIRTEX
     bool
+    select PPC4XX
     select PFLASH_CFI01
     select SERIAL
     select XILINX
     select XILINX_ETHLITE
+    select FDT_PPC
 
 config XIVE
     bool
@@ -127,3 +140,10 @@ config XIVE_KVM
     bool
     default y
     depends on XIVE_SPAPR && KVM
+
+# Only used by 64-bit targets
+config FW_CFG_PPC
+    bool
+
+config FDT_PPC
+    bool
diff --git a/hw/ppc/Makefile.objs b/hw/ppc/Makefile.objs
index 101e9fc591..a4bac57be6 100644
--- a/hw/ppc/Makefile.objs
+++ b/hw/ppc/Makefile.objs
@@ -1,5 +1,7 @@
 # shared objects
-obj-y += ppc.o ppc_booke.o fdt.o fw_cfg.o
+obj-y += ppc.o ppc_booke.o
+obj-$(CONFIG_FDT_PPC) += fdt.o
+obj-$(CONFIG_FW_CFG_PPC) += fw_cfg.o
 # IBM pSeries (sPAPR)
 obj-$(CONFIG_PSERIES) += spapr.o spapr_caps.o spapr_vio.o spapr_events.o
 obj-$(CONFIG_PSERIES) += spapr_hcall.o spapr_iommu.o spapr_rtas.o
@@ -7,14 +9,11 @@ obj-$(CONFIG_PSERIES) += spapr_pci.o spapr_rtc.o spapr_drc.o
 obj-$(CONFIG_PSERIES) += spapr_cpu_core.o spapr_ovec.o spapr_irq.o
 obj-$(CONFIG_PSERIES) += spapr_tpm_proxy.o
 obj-$(CONFIG_SPAPR_RNG) +=  spapr_rng.o
+obj-$(call land,$(CONFIG_PSERIES),$(CONFIG_LINUX)) += spapr_pci_vfio.o spapr_pci_nvlink2.o
 # IBM PowerNV
 obj-$(CONFIG_POWERNV) += pnv.o pnv_xscom.o pnv_core.o pnv_lpc.o pnv_psi.o pnv_occ.o pnv_bmc.o
 obj-$(CONFIG_POWERNV) += pnv_homer.o pnv_pnor.o
 
-
-ifeq ($(CONFIG_PCI)$(CONFIG_PSERIES)$(CONFIG_LINUX), yyy)
-obj-y += spapr_pci_vfio.o spapr_pci_nvlink2.o
-endif
 obj-$(CONFIG_PSERIES) += spapr_rtas_ddw.o
 # PowerPC 4xx boards
 obj-$(CONFIG_PPC405) += ppc405_boards.o ppc405_uc.o
diff --git a/hw/riscv/riscv_htif.c b/hw/riscv/riscv_htif.c
index 4f7b11dc37..ca87a5cf9f 100644
--- a/hw/riscv/riscv_htif.c
+++ b/hw/riscv/riscv_htif.c
@@ -96,7 +96,7 @@ static void htif_recv(void *opaque, const uint8_t *buf, int size)
  * Called by the char dev to supply special events to the HTIF console.
  * Not used for HTIF.
  */
-static void htif_event(void *opaque, int event)
+static void htif_event(void *opaque, QEMUChrEvent event)
 {
 
 }
diff --git a/hw/riscv/sifive_uart.c b/hw/riscv/sifive_uart.c
index a403ae90f5..9350482662 100644
--- a/hw/riscv/sifive_uart.c
+++ b/hw/riscv/sifive_uart.c
@@ -162,7 +162,7 @@ static int uart_can_rx(void *opaque)
     return s->rx_fifo_len < sizeof(s->rx_fifo);
 }
 
-static void uart_event(void *opaque, int event)
+static void uart_event(void *opaque, QEMUChrEvent event)
 {
 }
 
diff --git a/hw/rtc/Kconfig b/hw/rtc/Kconfig
index 45daa8d655..3dc2dd6888 100644
--- a/hw/rtc/Kconfig
+++ b/hw/rtc/Kconfig
@@ -17,6 +17,7 @@ config TWL92230
     depends on I2C
 
 config MC146818RTC
+    depends on ISA_BUS
     bool
 
 config SUN4V_RTC
diff --git a/hw/scsi/Kconfig b/hw/scsi/Kconfig
index b3ba540c17..77d397c949 100644
--- a/hw/scsi/Kconfig
+++ b/hw/scsi/Kconfig
@@ -34,6 +34,7 @@ config ESP_PCI
     default y if PCI_DEVICES
     depends on PCI
     select ESP
+    select NMC93XX_EEPROM
 
 config SPAPR_VSCSI
     bool
diff --git a/hw/sparc/Kconfig b/hw/sparc/Kconfig
index 2a83a8010e..22aff2f5b7 100644
--- a/hw/sparc/Kconfig
+++ b/hw/sparc/Kconfig
@@ -12,6 +12,7 @@ config SUN4M
     select LANCE
     select M48T59
     select STP2000
+    select CHRP_NVRAM
 
 config LEON3
     bool
diff --git a/hw/sparc64/Kconfig b/hw/sparc64/Kconfig
index f9f8b0f73a..980a201bb7 100644
--- a/hw/sparc64/Kconfig
+++ b/hw/sparc64/Kconfig
@@ -12,6 +12,7 @@ config SUN4U
     select IDE_CMD646
     select PCKBD
     select SIMBA
+    select CHRP_NVRAM
 
 config NIAGARA
     bool
diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig
index a990f9fe35..59b3f44d69 100644
--- a/hw/timer/Kconfig
+++ b/hw/timer/Kconfig
@@ -15,6 +15,7 @@ config HPET
 
 config I8254
     bool
+    depends on ISA_BUS
 
 config ALTERA_TIMER
     bool
diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index 0ab20f9d73..0052d49ce1 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -39,9 +39,11 @@ common-obj-$(CONFIG_USB_STORAGE_MTP)  += dev-mtp.o
 endif
 
 # usb redirection
+ifeq ($(CONFIG_USB),y)
 common-obj-$(CONFIG_USB_REDIR) += redirect.o quirks.o
 redirect.o-cflags = $(USB_REDIR_CFLAGS)
 redirect.o-libs = $(USB_REDIR_LIBS)
+endif
 
 # usb pass-through
 ifeq ($(CONFIG_USB_LIBUSB)$(CONFIG_USB),yy)
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 267ed9a8a0..3d40b700db 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -307,7 +307,7 @@ static void ccid_card_vscard_read(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void ccid_card_vscard_event(void *opaque, int event)
+static void ccid_card_vscard_event(void *opaque, QEMUChrEvent event)
 {
     PassthruState *card = opaque;
 
@@ -318,6 +318,11 @@ static void ccid_card_vscard_event(void *opaque, int event)
     case CHR_EVENT_OPENED:
         DPRINTF(card, D_INFO, "%s: CHR_EVENT_OPENED\n", __func__);
         break;
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+    case CHR_EVENT_CLOSED:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 45cc74128a..9646fe77da 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -461,7 +461,7 @@ static void usb_serial_read(void *opaque, const uint8_t *buf, int size)
     s->recv_used += size;
 }
 
-static void usb_serial_event(void *opaque, int event)
+static void usb_serial_event(void *opaque, QEMUChrEvent event)
 {
     USBSerialState *s = opaque;
 
@@ -479,6 +479,10 @@ static void usb_serial_event(void *opaque, int event)
                 usb_device_detach(&s->dev);
             }
             break;
+        case CHR_EVENT_MUX_IN:
+        case CHR_EVENT_MUX_OUT:
+            /* Ignore */
+            break;
     }
 }
 
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 80988bb305..fb05de4b05 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1861,6 +1861,13 @@ static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
     xhci_kick_epctx(epctx, streamid);
 }
 
+static bool xhci_slot_ok(XHCIState *xhci, int slotid)
+{
+    return (xhci->slots[slotid - 1].uport &&
+            xhci->slots[slotid - 1].uport->dev &&
+            xhci->slots[slotid - 1].uport->dev->attached);
+}
+
 static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid)
 {
     XHCIState *xhci = epctx->xhci;
@@ -1878,9 +1885,7 @@ static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid)
 
     /* If the device has been detached, but the guest has not noticed this
        yet the 2 above checks will succeed, but we must NOT continue */
-    if (!xhci->slots[epctx->slotid - 1].uport ||
-        !xhci->slots[epctx->slotid - 1].uport->dev ||
-        !xhci->slots[epctx->slotid - 1].uport->dev->attached) {
+    if (!xhci_slot_ok(xhci, epctx->slotid)) {
         return;
     }
 
@@ -1987,6 +1992,10 @@ static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid)
         } else {
             xhci_fire_transfer(xhci, xfer, epctx);
         }
+        if (!xhci_slot_ok(xhci, epctx->slotid)) {
+            /* surprise removal -> stop processing */
+            break;
+        }
         if (xfer->complete) {
             /* update ring dequeue ptr */
             xhci_set_ep_state(xhci, epctx, stctx, epctx->state);
@@ -2000,6 +2009,7 @@ static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid)
         if (xfer != NULL && xfer->running_retry) {
             DPRINTF("xhci: xfer nacked, stopping schedule\n");
             epctx->retry = xfer;
+            xhci_xfer_unmap(xfer);
             break;
         }
         if (count++ > TRANSFER_LIMIT) {
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index fcf48c0193..00e0e36369 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -88,6 +88,7 @@ struct USBHostDevice {
     bool                             needs_autoscan;
     bool                             allow_one_guest_reset;
     bool                             allow_all_guest_resets;
+    bool                             suppress_remote_wake;
 
     /* state */
     QTAILQ_ENTRY(USBHostDevice)      next;
@@ -386,6 +387,8 @@ static void LIBUSB_CALL usb_host_req_complete_ctrl(struct libusb_transfer *xfer)
     r->p->status = status_map[xfer->status];
     r->p->actual_length = xfer->actual_length;
     if (r->in && xfer->actual_length) {
+        USBDevice *udev = USB_DEVICE(s);
+        struct libusb_config_descriptor *conf = (void *)r->cbuf;
         memcpy(r->cbuf, r->buffer + 8, xfer->actual_length);
 
         /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
@@ -394,6 +397,21 @@ static void LIBUSB_CALL usb_host_req_complete_ctrl(struct libusb_transfer *xfer)
             r->cbuf[7] == 9) {
             r->cbuf[7] = 64;
         }
+        /*
+         *If this is GET_DESCRIPTOR request for configuration descriptor,
+         * remove 'remote wakeup' flag from it to prevent idle power down
+         * in Windows guest
+         */
+        if (s->suppress_remote_wake &&
+            udev->setup_buf[0] == USB_DIR_IN &&
+            udev->setup_buf[1] == USB_REQ_GET_DESCRIPTOR &&
+            udev->setup_buf[3] == USB_DT_CONFIG && udev->setup_buf[2] == 0 &&
+            xfer->actual_length >
+                offsetof(struct libusb_config_descriptor, bmAttributes) &&
+            (conf->bmAttributes & USB_CFG_ATT_WAKEUP)) {
+                trace_usb_host_remote_wakeup_removed(s->bus_num, s->addr);
+                conf->bmAttributes &= ~USB_CFG_ATT_WAKEUP;
+        }
     }
     trace_usb_host_req_complete(s->bus_num, s->addr, r->p,
                                 r->p->status, r->p->actual_length);
@@ -1596,6 +1614,8 @@ static Property usb_host_dev_properties[] = {
                        LIBUSB_LOG_LEVEL_WARNING),
     DEFINE_PROP_BIT("pipeline",    USBHostDevice, options,
                     USB_HOST_OPT_PIPELINE, true),
+    DEFINE_PROP_BOOL("suppress-remote-wake", USBHostDevice,
+                     suppress_remote_wake, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index e0f5ca6f81..efdbcc074c 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -113,6 +113,8 @@ struct USBRedirDevice {
     /* Properties */
     CharBackend cs;
     bool enable_streams;
+    bool suppress_remote_wake;
+    bool in_write;
     uint8_t debug;
     int32_t bootindex;
     char *filter_str;
@@ -290,6 +292,13 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
         return 0;
     }
 
+    /* Recursion check */
+    if (dev->in_write) {
+        DPRINTF("usbredir_write recursion\n");
+        return 0;
+    }
+    dev->in_write = true;
+
     r = qemu_chr_fe_write(&dev->cs, data, count);
     if (r < count) {
         if (!dev->watch) {
@@ -300,6 +309,7 @@ static int usbredir_write(void *priv, uint8_t *data, int count)
             r = 0;
         }
     }
+    dev->in_write = false;
     return r;
 }
 
@@ -1354,7 +1364,7 @@ static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
     usbredirparser_do_write(dev->parser);
 }
 
-static void usbredir_chardev_event(void *opaque, int event)
+static void usbredir_chardev_event(void *opaque, QEMUChrEvent event)
 {
     USBRedirDevice *dev = opaque;
 
@@ -1370,6 +1380,11 @@ static void usbredir_chardev_event(void *opaque, int event)
         DPRINTF("chardev close\n");
         qemu_bh_schedule(dev->chardev_close_bh);
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
@@ -1989,6 +2004,23 @@ static void usbredir_control_packet(void *priv, uint64_t id,
             memcpy(dev->dev.data_buf, data, data_len);
         }
         p->actual_length = len;
+        /*
+         * If this is GET_DESCRIPTOR request for configuration descriptor,
+         * remove 'remote wakeup' flag from it to prevent idle power down
+         * in Windows guest
+         */
+        if (dev->suppress_remote_wake &&
+            control_packet->requesttype == USB_DIR_IN &&
+            control_packet->request == USB_REQ_GET_DESCRIPTOR &&
+            control_packet->value == (USB_DT_CONFIG << 8) &&
+            control_packet->index == 0 &&
+            /* bmAttributes field of config descriptor */
+            len > 7 && (dev->dev.data_buf[7] & USB_CFG_ATT_WAKEUP)) {
+                DPRINTF("Removed remote wake %04X:%04X\n",
+                    dev->device_info.vendor_id,
+                    dev->device_info.product_id);
+                dev->dev.data_buf[7] &= ~USB_CFG_ATT_WAKEUP;
+            }
         usb_generic_async_ctrl_complete(&dev->dev, p);
     }
     free(data);
@@ -2530,6 +2562,8 @@ static Property usbredir_properties[] = {
     DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
     DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
     DEFINE_PROP_BOOL("streams", USBRedirDevice, enable_streams, true),
+    DEFINE_PROP_BOOL("suppress-remote-wake", USBRedirDevice,
+                     suppress_remote_wake, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 2d3713351c..1c24d82c09 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -266,3 +266,4 @@ usb_host_parse_config(int bus, int addr, int value, int active) "dev %d:%d, valu
 usb_host_parse_interface(int bus, int addr, int num, int alt, int active) "dev %d:%d, num %d, alt %d, active %d"
 usb_host_parse_endpoint(int bus, int addr, int ep, const char *dir, const char *type, int active) "dev %d:%d, ep %d, %s, %s, active %d"
 usb_host_parse_error(int bus, int addr, const char *errmsg) "dev %d:%d, msg %s"
+usb_host_remote_wakeup_removed(int bus, int addr) "dev %d:%d"
diff --git a/include/chardev/char-fe.h b/include/chardev/char-fe.h
index 67601dc9a4..a553843364 100644
--- a/include/chardev/char-fe.h
+++ b/include/chardev/char-fe.h
@@ -4,7 +4,7 @@
 #include "chardev/char.h"
 #include "qemu/main-loop.h"
 
-typedef void IOEventHandler(void *opaque, int event);
+typedef void IOEventHandler(void *opaque, QEMUChrEvent event);
 typedef int BackendChangeHandler(void *opaque);
 
 /* This is the backend as seen by frontend, the actual backend is
diff --git a/include/chardev/char-mux.h b/include/chardev/char-mux.h
index 572cefd517..417fe32eed 100644
--- a/include/chardev/char-mux.h
+++ b/include/chardev/char-mux.h
@@ -56,6 +56,6 @@ typedef struct MuxChardev {
     object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_MUX)
 
 void mux_set_focus(Chardev *chr, int focus);
-void mux_chr_send_all_event(Chardev *chr, int event);
+void mux_chr_send_all_event(Chardev *chr, QEMUChrEvent event);
 
 #endif /* CHAR_MUX_H */
diff --git a/include/chardev/char.h b/include/chardev/char.h
index 087b202b62..00589a6025 100644
--- a/include/chardev/char.h
+++ b/include/chardev/char.h
@@ -210,7 +210,7 @@ void qemu_chr_be_update_read_handlers(Chardev *s,
  *
  * Send an event from the back end to the front end.
  */
-void qemu_chr_be_event(Chardev *s, int event);
+void qemu_chr_be_event(Chardev *s, QEMUChrEvent event);
 
 int qemu_chr_add_client(Chardev *s, int fd);
 Chardev *qemu_chr_find(const char *name);
@@ -273,7 +273,7 @@ typedef struct ChardevClass {
     void (*chr_accept_input)(Chardev *chr);
     void (*chr_set_echo)(Chardev *chr, bool echo);
     void (*chr_set_fe_open)(Chardev *chr, int fe_open);
-    void (*chr_be_event)(Chardev *s, int event);
+    void (*chr_be_event)(Chardev *s, QEMUChrEvent event);
     /* Return 0 if succeeded, 1 if failed */
     int (*chr_machine_done)(Chardev *chr);
 } ChardevClass;
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 61f8bb8e5a..fb1b43d5b9 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -271,9 +271,6 @@ struct MachineState {
 
     /*< public >*/
 
-    bool kernel_irqchip_allowed;
-    bool kernel_irqchip_required;
-    bool kernel_irqchip_split;
     char *dtb;
     char *dumpdtb;
     int phandle_start;
diff --git a/include/sysemu/replay.h b/include/sysemu/replay.h
index 8df517298c..5471bb514d 100644
--- a/include/sysemu/replay.h
+++ b/include/sysemu/replay.h
@@ -117,6 +117,13 @@ int64_t replay_read_clock(ReplayClockKind kind);
             ? replay_save_clock((clock), (value), cpu_get_icount_raw_locked()) \
         : (value))
 
+/* Processing data from random generators */
+
+/* Saves the values from the random number generator */
+void replay_save_random(int ret, void *buf, size_t len);
+/* Loads the saved values for the random number generator */
+int replay_read_random(void *buf, size_t len);
+
 /* Events */
 
 /*! Called when qemu shutdown is requested. */
diff --git a/include/ui/console.h b/include/ui/console.h
index 281f9c145b..f35b4fc082 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -442,6 +442,7 @@ void qemu_display_register(QemuDisplay *ui);
 bool qemu_display_find_default(DisplayOptions *opts);
 void qemu_display_early_init(DisplayOptions *opts);
 void qemu_display_init(DisplayState *ds, DisplayOptions *opts);
+void qemu_display_help(void);
 
 /* vnc.c */
 void vnc_display_init(const char *id, Error **errp);
diff --git a/include/ui/gtk.h b/include/ui/gtk.h
index d9eedad976..d1b230848a 100644
--- a/include/ui/gtk.h
+++ b/include/ui/gtk.h
@@ -28,6 +28,8 @@
 #include "ui/egl-context.h"
 #endif
 
+#define MILLISEC_PER_SEC 1000000
+
 typedef struct GtkDisplayState GtkDisplayState;
 
 typedef struct VirtualGfxConsole {
diff --git a/monitor/hmp.c b/monitor/hmp.c
index 8942e28933..944fa9651e 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -1322,7 +1322,7 @@ static void monitor_read(void *opaque, const uint8_t *buf, int size)
     cur_mon = old_mon;
 }
 
-static void monitor_event(void *opaque, int event)
+static void monitor_event(void *opaque, QEMUChrEvent event)
 {
     Monitor *mon = opaque;
     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
@@ -1371,6 +1371,10 @@ static void monitor_event(void *opaque, int event)
         mon_refcount--;
         monitor_fdsets_cleanup();
         break;
+
+    case CHR_EVENT_BREAK:
+        /* Ignored */
+        break;
     }
 }
 
diff --git a/monitor/qmp.c b/monitor/qmp.c
index b67a8e7d1f..54c06ba824 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
@@ -337,7 +337,7 @@ static QDict *qmp_greeting(MonitorQMP *mon)
         ver, cap_list);
 }
 
-static void monitor_qmp_event(void *opaque, int event)
+static void monitor_qmp_event(void *opaque, QEMUChrEvent event)
 {
     QDict *data;
     MonitorQMP *mon = opaque;
@@ -365,6 +365,11 @@ static void monitor_qmp_event(void *opaque, int event)
         mon_refcount--;
         monitor_fdsets_cleanup();
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 }
 
diff --git a/nbd/server.c b/nbd/server.c
index 24ebc1a805..87fcd2e7bf 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -2384,20 +2384,12 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
                                                !client->export_meta.bitmap,
                                                NBD_META_ID_BASE_ALLOCATION,
                                                errp);
-                if (ret < 0) {
-                    return ret;
-                }
-            }
-
-            if (client->export_meta.bitmap) {
+            } else {              /* client->export_meta.bitmap */
                 ret = nbd_co_send_bitmap(client, request->handle,
                                          client->exp->export_bitmap,
                                          request->from, request->len,
                                          dont_fragment,
                                          true, NBD_META_ID_DIRTY_BITMAP, errp);
-                if (ret < 0) {
-                    return ret;
-                }
             }
 
             return ret;
diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index 8d36009c53..d83e815545 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -132,7 +132,7 @@ static void redirector_chr_read(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static void redirector_chr_event(void *opaque, int event)
+static void redirector_chr_event(void *opaque, QEMUChrEvent event)
 {
     NetFilterState *nf = opaque;
     MirrorState *s = FILTER_REDIRECTOR(nf);
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 014199d600..17532daaf3 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -218,7 +218,7 @@ static gboolean net_vhost_user_watch(GIOChannel *chan, GIOCondition cond,
     return TRUE;
 }
 
-static void net_vhost_user_event(void *opaque, int event);
+static void net_vhost_user_event(void *opaque, QEMUChrEvent event);
 
 static void chr_closed_bh(void *opaque)
 {
@@ -249,7 +249,7 @@ static void chr_closed_bh(void *opaque)
     }
 }
 
-static void net_vhost_user_event(void *opaque, int event)
+static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
 {
     const char *name = opaque;
     NetClientState *ncs[MAX_QUEUE_NUM];
@@ -294,6 +294,11 @@ static void net_vhost_user_event(void *opaque, int event)
             aio_bh_schedule_oneshot(ctx, chr_closed_bh, opaque);
         }
         break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
     }
 
     if (err) {
diff --git a/qemu-options.hx b/qemu-options.hx
index d4b73ef60c..709162c159 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1669,7 +1669,8 @@ STEXI
 @item -display @var{type}
 @findex -display
 Select type of display to use. This option is a replacement for the
-old style -sdl/-curses/... options. Valid values for @var{type} are
+old style -sdl/-curses/... options. Use @code{-display help} to list
+the available display types. Valid values for @var{type} are
 @table @option
 @item sdl
 Display video output via SDL (usually in a separate graphics
diff --git a/qtest.c b/qtest.c
index 8b50e2783e..12432f99cf 100644
--- a/qtest.c
+++ b/qtest.c
@@ -722,7 +722,7 @@ static int qtest_can_read(void *opaque)
     return 1024;
 }
 
-static void qtest_event(void *opaque, int event)
+static void qtest_event(void *opaque, QEMUChrEvent event)
 {
     int i;
 
diff --git a/replay/Makefile.objs b/replay/Makefile.objs
index cee6539a23..939be964a9 100644
--- a/replay/Makefile.objs
+++ b/replay/Makefile.objs
@@ -6,4 +6,5 @@ common-obj-y += replay-input.o
 common-obj-y += replay-char.o
 common-obj-y += replay-snapshot.o
 common-obj-y += replay-net.o
-common-obj-y += replay-audio.o
\ No newline at end of file
+common-obj-y += replay-audio.o
+common-obj-y += replay-random.o
diff --git a/replay/replay-internal.h b/replay/replay-internal.h
index 55fca1ac6b..33ac551e78 100644
--- a/replay/replay-internal.h
+++ b/replay/replay-internal.h
@@ -34,6 +34,8 @@ enum ReplayEvents {
     EVENT_AUDIO_OUT,
     /* for audio in event */
     EVENT_AUDIO_IN,
+    /* for random number generator */
+    EVENT_RANDOM,
     /* for clock read/writes */
     /* some of greater codes are reserved for clocks */
     EVENT_CLOCK,
diff --git a/replay/replay-random.c b/replay/replay-random.c
new file mode 100644
index 0000000000..afc7a0fccc
--- /dev/null
+++ b/replay/replay-random.c
@@ -0,0 +1,44 @@
+/*
+ * replay-random.c
+ *
+ * Copyright (c) 2010-2020 Institute for System Programming
+ *                         of the Russian Academy of Sciences.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "sysemu/replay.h"
+#include "replay-internal.h"
+
+void replay_save_random(int ret, void *buf, size_t len)
+{
+    g_assert(replay_mutex_locked());
+
+    replay_save_instructions();
+    replay_put_event(EVENT_RANDOM);
+    replay_put_dword(ret);
+    replay_put_array(buf, len);
+}
+
+int replay_read_random(void *buf, size_t len)
+{
+    int ret = 0;
+    g_assert(replay_mutex_locked());
+
+    replay_account_executed_instructions();
+    if (replay_next_event_is(EVENT_RANDOM)) {
+        size_t buf_size = 0;
+        ret = replay_get_dword();
+        replay_get_array(buf, &buf_size);
+        replay_finish_event();
+        g_assert(buf_size == len);
+    } else {
+        error_report("Missing random event in the replay log");
+        exit(1);
+    }
+    return ret;
+}
diff --git a/replay/replay.c b/replay/replay.c
index 5cc25bd2f8..706c7b4f4b 100644
--- a/replay/replay.c
+++ b/replay/replay.c
@@ -22,7 +22,7 @@
 
 /* Current version of the replay mechanism.
    Increase it when file format changes. */
-#define REPLAY_VERSION              0xe02008
+#define REPLAY_VERSION              0xe02009
 /* Size of replay log header */
 #define HEADER_SIZE                 (sizeof(uint32_t) + sizeof(uint64_t))
 
diff --git a/scripts/qemu-trace-stap b/scripts/qemu-trace-stap
index 91d1051cdc..90527eb974 100755
--- a/scripts/qemu-trace-stap
+++ b/scripts/qemu-trace-stap
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # -*- python -*-
 #
 # Copyright (C) 2019 Red Hat, Inc
@@ -18,8 +18,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <http://www.gnu.org/licenses/>.
 
-from __future__ import print_function
-
 import argparse
 import copy
 import os.path
@@ -104,7 +102,9 @@ def cmd_list(args):
         if verbose:
             print("Listing probes with name '%s'" % script)
         proc = subprocess.Popen(["stap", "-l", script],
-                                stdout=subprocess.PIPE, env=tapset_env(tapsets))
+                                stdout=subprocess.PIPE,
+                                universal_newlines=True,
+                                env=tapset_env(tapsets))
         out, err = proc.communicate()
         if proc.returncode != 0:
             print("No probes found, are the tapsets installed in %s" % tapset_dir(args.binary))
diff --git a/stubs/replay.c b/stubs/replay.c
index 10b3925e2f..5974ec1f50 100644
--- a/stubs/replay.c
+++ b/stubs/replay.c
@@ -79,3 +79,12 @@ void replay_mutex_lock(void)
 void replay_mutex_unlock(void)
 {
 }
+
+void replay_save_random(int ret, void *buf, size_t len)
+{
+}
+
+int replay_read_random(void *buf, size_t len)
+{
+    return 0;
+}
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 972c28c3c9..8c18cdff87 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -13585,6 +13585,8 @@ static void disas_crypto_three_reg_sha512(DisasContext *s, uint32_t insn)
             feature = dc_isar_feature(aa64_sha3, s);
             genfn = NULL;
             break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         switch (opcode) {
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 31556b7ec4..41f28cebf9 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3198,7 +3198,8 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_EDX_SPEC_CTRL_SSBD | CPUID_7_0_EDX_ARCH_CAPABILITIES,
         .features[FEAT_ARCH_CAPABILITIES] =
             MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
-            MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO,
+            MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
+            MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO,
         .features[FEAT_7_1_EAX] =
             CPUID_7_1_EAX_AVX512_BF16,
         /*
@@ -3213,6 +3214,54 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_XSAVE_XGETBV1,
         .features[FEAT_6_EAX] =
             CPUID_6_EAX_ARAT,
+        /* Missing: Mode-based execute control (XS/XU), processor tracing, TSC scaling */
+        .features[FEAT_VMX_BASIC] = MSR_VMX_BASIC_INS_OUTS |
+             MSR_VMX_BASIC_TRUE_CTLS,
+        .features[FEAT_VMX_ENTRY_CTLS] = VMX_VM_ENTRY_IA32E_MODE |
+             VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VMX_VM_ENTRY_LOAD_IA32_PAT |
+             VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_LOAD_IA32_EFER,
+        .features[FEAT_VMX_EPT_VPID_CAPS] = MSR_VMX_EPT_EXECONLY |
+             MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB |
+             MSR_VMX_EPT_1GB | MSR_VMX_EPT_INVEPT |
+             MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
+             MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
+             MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT | MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
+             MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS | MSR_VMX_EPT_AD_BITS,
+        .features[FEAT_VMX_EXIT_CTLS] =
+             VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
+             VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
+             VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_LOAD_IA32_EFER |
+             VMX_VM_EXIT_SAVE_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
+             VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
+        .features[FEAT_VMX_MISC] = MSR_VMX_MISC_ACTIVITY_HLT |
+             MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_VMWRITE_VMEXIT,
+        .features[FEAT_VMX_PINBASED_CTLS] = VMX_PIN_BASED_EXT_INTR_MASK |
+             VMX_PIN_BASED_NMI_EXITING | VMX_PIN_BASED_VIRTUAL_NMIS |
+             VMX_PIN_BASED_VMX_PREEMPTION_TIMER | VMX_PIN_BASED_POSTED_INTR,
+        .features[FEAT_VMX_PROCBASED_CTLS] = VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
+             VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
+             VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
+             VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
+             VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
+             VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_MOV_DR_EXITING |
+             VMX_CPU_BASED_UNCOND_IO_EXITING | VMX_CPU_BASED_USE_IO_BITMAPS |
+             VMX_CPU_BASED_MONITOR_EXITING | VMX_CPU_BASED_PAUSE_EXITING |
+             VMX_CPU_BASED_VIRTUAL_NMI_PENDING | VMX_CPU_BASED_USE_MSR_BITMAPS |
+             VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
+             VMX_CPU_BASED_MONITOR_TRAP_FLAG |
+             VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
+        .features[FEAT_VMX_SECONDARY_CTLS] =
+             VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+             VMX_SECONDARY_EXEC_WBINVD_EXITING | VMX_SECONDARY_EXEC_ENABLE_EPT |
+             VMX_SECONDARY_EXEC_DESC | VMX_SECONDARY_EXEC_RDTSCP |
+             VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+             VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
+             VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
+             VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+             VMX_SECONDARY_EXEC_RDRAND_EXITING | VMX_SECONDARY_EXEC_ENABLE_INVPCID |
+             VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
+             VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML,
+        .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
         .xlevel = 0x80000008,
         .model_id = "Intel Xeon Processor (Cooperlake)",
     },
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index af282936a7..594326a794 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -835,12 +835,15 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 #define CPUID_TOPOLOGY_LEVEL_DIE      (5U << 8)
 
 /* MSR Feature Bits */
-#define MSR_ARCH_CAP_RDCL_NO    (1U << 0)
-#define MSR_ARCH_CAP_IBRS_ALL   (1U << 1)
-#define MSR_ARCH_CAP_RSBA       (1U << 2)
+#define MSR_ARCH_CAP_RDCL_NO            (1U << 0)
+#define MSR_ARCH_CAP_IBRS_ALL           (1U << 1)
+#define MSR_ARCH_CAP_RSBA               (1U << 2)
 #define MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY (1U << 3)
-#define MSR_ARCH_CAP_SSB_NO     (1U << 4)
-#define MSR_ARCH_CAP_MDS_NO     (1U << 5)
+#define MSR_ARCH_CAP_SSB_NO             (1U << 4)
+#define MSR_ARCH_CAP_MDS_NO             (1U << 5)
+#define MSR_ARCH_CAP_PSCHANGE_MC_NO     (1U << 6)
+#define MSR_ARCH_CAP_TSX_CTRL_MSR       (1U << 7)
+#define MSR_ARCH_CAP_TAA_NO             (1U << 8)
 
 #define MSR_CORE_CAP_SPLIT_LOCK_DETECT  (1U << 5)
 
diff --git a/target/i386/gdbstub.c b/target/i386/gdbstub.c
index aef25b70f1..572ead641c 100644
--- a/target/i386/gdbstub.c
+++ b/target/i386/gdbstub.c
@@ -350,15 +350,15 @@ int x86_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
             env->segs[R_GS].base = ldl_p(mem_buf);
             return 4;
 
-#ifdef TARGET_X86_64
         case IDX_SEG_REGS + 8:
+#ifdef TARGET_X86_64
             if (env->hflags & HF_CS64_MASK) {
                 env->kernelgsbase = ldq_p(mem_buf);
                 return 8;
             }
             env->kernelgsbase = ldl_p(mem_buf);
-            return 4;
 #endif
+            return 4;
 
         case IDX_FP_REGS + 8:
             cpu_set_fpuc(env, ldl_p(mem_buf));
diff --git a/target/i386/kvm.c b/target/i386/kvm.c
index 0b511906e3..7ee3202634 100644
--- a/target/i386/kvm.c
+++ b/target/i386/kvm.c
@@ -2173,6 +2173,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     }
 
     if (kvm_check_extension(s, KVM_CAP_X86_SMM) &&
+        object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE) &&
         x86_machine_is_smm_enabled(X86_MACHINE(ms))) {
         smram_machine_done.notify = register_smram_listener;
         qemu_add_machine_init_done_notifier(&smram_machine_done);
diff --git a/tests/Makefile.include b/tests/Makefile.include
index c666448e03..c6827ce8c2 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -149,160 +149,6 @@ check-unit-y += tests/test-qapi-util$(EXESUF)
 
 check-block-$(call land,$(CONFIG_POSIX),$(CONFIG_SOFTMMU)) += tests/check-block.sh
 
-# All QTests for now are POSIX-only, but the dependencies are
-# really in libqtest, not in the testcases themselves.
-
-check-qtest-generic-y += tests/qmp-test$(EXESUF)
-check-qtest-generic-y += tests/qmp-cmd-test$(EXESUF)
-check-qtest-generic-$(CONFIG_MODULES) += tests/modules-test$(EXESUF)
-
-check-qtest-generic-y += tests/device-introspect-test$(EXESUF)
-check-qtest-generic-y += tests/cdrom-test$(EXESUF)
-DBUS_DAEMON := $(shell which dbus-daemon 2>/dev/null)
-ifneq ($(GDBUS_CODEGEN),)
-ifneq ($(DBUS_DAEMON),)
-check-qtest-pci-$(CONFIG_GIO) += tests/dbus-vmstate-test$(EXESUF)
-endif
-endif
-
-check-qtest-pci-$(CONFIG_RTL8139_PCI) += tests/rtl8139-test$(EXESUF)
-check-qtest-pci-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-check-qtest-pci-$(CONFIG_HDA) += tests/intel-hda-test$(EXESUF)
-check-qtest-pci-$(CONFIG_IVSHMEM_DEVICE) += tests/ivshmem-test$(EXESUF)
-check-qtest-i386-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-check-qtest-i386-y += tests/fdc-test$(EXESUF)
-check-qtest-i386-y += tests/ide-test$(EXESUF)
-check-qtest-i386-$(CONFIG_TOOLS) += tests/ahci-test$(EXESUF)
-check-qtest-i386-y += tests/hd-geo-test$(EXESUF)
-check-qtest-i386-y += tests/boot-order-test$(EXESUF)
-check-qtest-i386-y += tests/bios-tables-test$(EXESUF)
-check-qtest-i386-$(CONFIG_SGA) += tests/boot-serial-test$(EXESUF)
-check-qtest-i386-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
-check-qtest-i386-y += tests/rtc-test$(EXESUF)
-check-qtest-i386-$(CONFIG_ISA_IPMI_KCS) += tests/ipmi-kcs-test$(EXESUF)
-ifdef CONFIG_LINUX
-check-qtest-i386-$(CONFIG_ISA_IPMI_BT) += tests/ipmi-bt-test$(EXESUF)
-endif
-check-qtest-i386-y += tests/i440fx-test$(EXESUF)
-check-qtest-i386-y += tests/fw_cfg-test$(EXESUF)
-check-qtest-i386-y += tests/device-plug-test$(EXESUF)
-check-qtest-i386-y += tests/drive_del-test$(EXESUF)
-check-qtest-i386-$(CONFIG_WDT_IB700) += tests/wdt_ib700-test$(EXESUF)
-check-qtest-i386-y += tests/tco-test$(EXESUF)
-check-qtest-i386-y += $(check-qtest-pci-y)
-check-qtest-i386-$(CONFIG_PVPANIC) += tests/pvpanic-test$(EXESUF)
-check-qtest-i386-$(CONFIG_I82801B11) += tests/i82801b11-test$(EXESUF)
-check-qtest-i386-$(CONFIG_IOH3420) += tests/ioh3420-test$(EXESUF)
-check-qtest-i386-$(CONFIG_USB_UHCI) += tests/usb-hcd-uhci-test$(EXESUF)
-check-qtest-i386-$(call land,$(CONFIG_USB_EHCI),$(CONFIG_USB_UHCI)) += tests/usb-hcd-ehci-test$(EXESUF)
-check-qtest-i386-$(CONFIG_USB_XHCI_NEC) += tests/usb-hcd-xhci-test$(EXESUF)
-check-qtest-i386-y += tests/cpu-plug-test$(EXESUF)
-check-qtest-i386-y += tests/q35-test$(EXESUF)
-check-qtest-i386-y += tests/vmgenid-test$(EXESUF)
-check-qtest-i386-$(CONFIG_TPM_CRB) += tests/tpm-crb-swtpm-test$(EXESUF)
-check-qtest-i386-$(CONFIG_TPM_CRB) += tests/tpm-crb-test$(EXESUF)
-check-qtest-i386-$(CONFIG_TPM_TIS) += tests/tpm-tis-swtpm-test$(EXESUF)
-check-qtest-i386-$(CONFIG_TPM_TIS) += tests/tpm-tis-test$(EXESUF)
-check-qtest-i386-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
-check-qtest-i386-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
-check-qtest-i386-$(CONFIG_RTL8139_PCI) += tests/test-filter-redirector$(EXESUF)
-check-qtest-i386-y += tests/migration-test$(EXESUF)
-check-qtest-i386-y += tests/test-x86-cpuid-compat$(EXESUF)
-check-qtest-i386-y += tests/numa-test$(EXESUF)
-check-qtest-x86_64-y += $(check-qtest-i386-y)
-
-check-qtest-alpha-y += tests/boot-serial-test$(EXESUF)
-check-qtest-alpha-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-
-check-qtest-hppa-y += tests/boot-serial-test$(EXESUF)
-check-qtest-hppa-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-
-check-qtest-m68k-y = tests/boot-serial-test$(EXESUF)
-
-check-qtest-microblaze-y += tests/boot-serial-test$(EXESUF)
-
-check-qtest-mips-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-check-qtest-mips-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-
-check-qtest-mips64-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-check-qtest-mips64-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-
-check-qtest-mips64el-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-check-qtest-mips64el-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-
-check-qtest-moxie-y += tests/boot-serial-test$(EXESUF)
-
-check-qtest-ppc-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
-check-qtest-ppc-y += tests/prom-env-test$(EXESUF)
-check-qtest-ppc-y += tests/drive_del-test$(EXESUF)
-check-qtest-ppc-y += tests/boot-serial-test$(EXESUF)
-check-qtest-ppc-$(CONFIG_M48T59) += tests/m48t59-test$(EXESUF)
-
-check-qtest-ppc64-y += $(check-qtest-ppc-y)
-check-qtest-ppc64-$(CONFIG_PSERIES) += tests/device-plug-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_POWERNV) += tests/pnv-xscom-test$(EXESUF)
-check-qtest-ppc64-y += tests/migration-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_PSERIES) += tests/rtas-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_USB_UHCI) += tests/usb-hcd-uhci-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_USB_XHCI_NEC) += tests/usb-hcd-xhci-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
-check-qtest-ppc64-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
-check-qtest-ppc64-$(CONFIG_RTL8139_PCI) += tests/test-filter-redirector$(EXESUF)
-check-qtest-ppc64-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
-check-qtest-ppc64-y += tests/numa-test$(EXESUF)
-check-qtest-ppc64-$(CONFIG_IVSHMEM_DEVICE) += tests/ivshmem-test$(EXESUF)
-check-qtest-ppc64-y += tests/cpu-plug-test$(EXESUF)
-
-check-qtest-sh4-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-
-check-qtest-sh4eb-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-
-check-qtest-sparc-y += tests/prom-env-test$(EXESUF)
-check-qtest-sparc-y += tests/m48t59-test$(EXESUF)
-check-qtest-sparc-y += tests/boot-serial-test$(EXESUF)
-
-check-qtest-sparc64-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
-check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
-check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
-
-check-qtest-arm-y += tests/arm-cpu-features$(EXESUF)
-check-qtest-arm-y += tests/microbit-test$(EXESUF)
-check-qtest-arm-y += tests/m25p80-test$(EXESUF)
-check-qtest-arm-y += tests/test-arm-mptimer$(EXESUF)
-check-qtest-arm-y += tests/boot-serial-test$(EXESUF)
-check-qtest-arm-y += tests/hexloader-test$(EXESUF)
-check-qtest-arm-$(CONFIG_PFLASH_CFI02) += tests/pflash-cfi02-test$(EXESUF)
-
-check-qtest-aarch64-y += tests/arm-cpu-features$(EXESUF)
-check-qtest-aarch64-y += tests/numa-test$(EXESUF)
-check-qtest-aarch64-y += tests/boot-serial-test$(EXESUF)
-check-qtest-aarch64-y += tests/migration-test$(EXESUF)
-# TODO: once aarch64 TCG is fixed on ARM 32 bit host, make test unconditional
-ifneq ($(ARCH),arm)
-check-qtest-aarch64-y += tests/bios-tables-test$(EXESUF)
-endif
-
-check-qtest-microblazeel-y += $(check-qtest-microblaze-y)
-
-check-qtest-xtensaeb-y += $(check-qtest-xtensa-y)
-
-check-qtest-s390x-y = tests/boot-serial-test$(EXESUF)
-check-qtest-s390x-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
-check-qtest-s390x-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
-check-qtest-s390x-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
-check-qtest-s390x-$(CONFIG_POSIX) += tests/test-filter-redirector$(EXESUF)
-check-qtest-s390x-y += tests/drive_del-test$(EXESUF)
-check-qtest-s390x-y += tests/device-plug-test$(EXESUF)
-check-qtest-s390x-y += tests/virtio-ccw-test$(EXESUF)
-check-qtest-s390x-y += tests/cpu-plug-test$(EXESUF)
-check-qtest-s390x-y += tests/migration-test$(EXESUF)
-
-check-qtest-generic-y += tests/machine-none-test$(EXESUF)
-check-qtest-generic-y += tests/qom-test$(EXESUF)
-check-qtest-generic-y += tests/test-hmp$(EXESUF)
-
 qapi-schema += alternate-any.json
 qapi-schema += alternate-array.json
 qapi-schema += alternate-base.json
@@ -513,7 +359,7 @@ generated-files-y += tests/include/test-qapi-events-sub-module.h
 generated-files-y += tests/test-qapi-events-sub-sub-module.h
 generated-files-y += tests/test-qapi-introspect.h
 
-QEMU_CFLAGS += -I$(SRC_PATH)/tests
+QEMU_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest
 
 
 # Deps that are common to various different sets of tests below
@@ -545,7 +391,7 @@ tests/check-qlit$(EXESUF): tests/check-qlit.o $(test-util-obj-y)
 tests/check-qom-interface$(EXESUF): tests/check-qom-interface.o $(test-qom-obj-y)
 tests/check-qom-proplist$(EXESUF): tests/check-qom-proplist.o $(test-qom-obj-y)
 
-tests/test-char$(EXESUF): tests/test-char.o $(test-util-obj-y) $(qtest-obj-y) $(test-io-obj-y) $(chardev-obj-y) tests/socket-helpers.o
+tests/test-char$(EXESUF): tests/test-char.o $(test-util-obj-y) $(test-io-obj-y) $(chardev-obj-y) tests/socket-helpers.o
 tests/test-coroutine$(EXESUF): tests/test-coroutine.o $(test-block-obj-y)
 tests/test-aio$(EXESUF): tests/test-aio.o $(test-block-obj-y)
 tests/test-aio-multithread$(EXESUF): tests/test-aio-multithread.o $(test-block-obj-y)
@@ -595,6 +441,11 @@ tests/test-vmstate$(EXESUF): tests/test-vmstate.o \
 tests/test-timed-average$(EXESUF): tests/test-timed-average.o $(test-util-obj-y)
 tests/test-base64$(EXESUF): tests/test-base64.o $(test-util-obj-y)
 tests/ptimer-test$(EXESUF): tests/ptimer-test.o tests/ptimer-test-stubs.o hw/core/ptimer.o
+tests/test-qemu-opts$(EXESUF): tests/test-qemu-opts.o $(test-util-obj-y)
+tests/test-keyval$(EXESUF): tests/test-keyval.o $(test-util-obj-y) $(test-qapi-obj-y)
+tests/test-write-threshold$(EXESUF): tests/test-write-threshold.o $(test-block-obj-y)
+tests/test-uuid$(EXESUF): tests/test-uuid.o $(test-util-obj-y)
+tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y)
 
 tests/test-logging$(EXESUF): tests/test-logging.o $(test-util-obj-y)
 
@@ -644,18 +495,18 @@ tests/qapi-schema/doc-good.test.texi: $(SRC_PATH)/tests/qapi-schema/doc-good.jso
 	@mv tests/qapi-schema/doc-good-qapi-doc.texi $@
 	@rm -f tests/qapi-schema/doc-good-qapi-*.[ch] tests/qapi-schema/doc-good-qmp-*.[ch]
 
-tests/dbus-vmstate1.h tests/dbus-vmstate1.c: tests/dbus-vmstate1-gen-timestamp ;
-tests/dbus-vmstate1-gen-timestamp: $(SRC_PATH)/tests/dbus-vmstate1.xml
+tests/qtest/dbus-vmstate1.h tests/qtest/dbus-vmstate1.c: tests/qtest/dbus-vmstate1-gen-timestamp ;
+tests/qtest/dbus-vmstate1-gen-timestamp: $(SRC_PATH)/tests/qtest/dbus-vmstate1.xml
 	$(call quiet-command,$(GDBUS_CODEGEN) $< \
-		--interface-prefix org.qemu --generate-c-code tests/dbus-vmstate1, \
+		--interface-prefix org.qemu --generate-c-code tests/qtest/dbus-vmstate1, \
 		"GEN","$(@:%-timestamp=%)")
 	@>$@
 
-tests/dbus-vmstate-test.o-cflags := -DSRCDIR="$(SRC_PATH)"
-tests/dbus-vmstate1.o-cflags := $(GIO_CFLAGS)
-tests/dbus-vmstate1.o-libs := $(GIO_LIBS)
+tests/qtest/dbus-vmstate-test.o-cflags := -DSRCDIR="$(SRC_PATH)"
+tests/qtest/dbus-vmstate1.o-cflags := $(GIO_CFLAGS)
+tests/qtest/dbus-vmstate1.o-libs := $(GIO_LIBS)
 
-tests/dbus-vmstate-test.o: tests/dbus-vmstate1.h
+tests/qtest/dbus-vmstate-test.o: tests/qtest/dbus-vmstate1.h
 
 tests/test-string-output-visitor$(EXESUF): tests/test-string-output-visitor.o $(test-qapi-obj-y)
 tests/test-string-input-visitor$(EXESUF): tests/test-string-input-visitor.o $(test-qapi-obj-y)
@@ -704,12 +555,6 @@ tests/test-authz-pam$(EXESUF): tests/test-authz-pam.o $(test-authz-obj-y)
 tests/test-io-task$(EXESUF): tests/test-io-task.o $(test-io-obj-y)
 tests/test-io-channel-socket$(EXESUF): tests/test-io-channel-socket.o \
         tests/io-channel-helpers.o tests/socket-helpers.o $(test-io-obj-y)
-tests/tpm-crb-swtpm-test$(EXESUF): tests/tpm-crb-swtpm-test.o tests/tpm-emu.o \
-	tests/tpm-util.o tests/tpm-tests.o $(test-io-obj-y)
-tests/tpm-crb-test$(EXESUF): tests/tpm-crb-test.o tests/tpm-emu.o $(test-io-obj-y)
-tests/tpm-tis-swtpm-test$(EXESUF): tests/tpm-tis-swtpm-test.o tests/tpm-emu.o \
-	tests/tpm-util.o tests/tpm-tests.o $(test-io-obj-y)
-tests/tpm-tis-test$(EXESUF): tests/tpm-tis-test.o tests/tpm-emu.o $(test-io-obj-y)
 tests/test-io-channel-file$(EXESUF): tests/test-io-channel-file.o \
         tests/io-channel-helpers.o $(test-io-obj-y)
 tests/test-io-channel-tls$(EXESUF): tests/test-io-channel-tls.o \
@@ -724,152 +569,6 @@ tests/test-crypto-ivgen$(EXESUF): tests/test-crypto-ivgen.o $(test-crypto-obj-y)
 tests/test-crypto-afsplit$(EXESUF): tests/test-crypto-afsplit.o $(test-crypto-obj-y)
 tests/test-crypto-block$(EXESUF): tests/test-crypto-block.o $(test-crypto-obj-y)
 
-libqgraph-obj-y = tests/libqos/qgraph.o
-
-libqos-obj-y = $(libqgraph-obj-y) tests/libqos/pci.o tests/libqos/fw_cfg.o
-libqos-obj-y += tests/libqos/malloc.o
-libqos-obj-y += tests/libqos/libqos.o
-libqos-spapr-obj-y = $(libqos-obj-y) tests/libqos/malloc-spapr.o
-libqos-spapr-obj-y += tests/libqos/libqos-spapr.o
-libqos-spapr-obj-y += tests/libqos/rtas.o
-libqos-spapr-obj-y += tests/libqos/pci-spapr.o
-libqos-pc-obj-y = $(libqos-obj-y) tests/libqos/pci-pc.o
-libqos-pc-obj-y += tests/libqos/malloc-pc.o tests/libqos/libqos-pc.o
-libqos-pc-obj-y += tests/libqos/ahci.o
-libqos-usb-obj-y = $(libqos-spapr-obj-y) $(libqos-pc-obj-y) tests/libqos/usb.o
-
-# Devices
-qos-test-obj-y = tests/qos-test.o $(libqgraph-obj-y)
-qos-test-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y)
-qos-test-obj-y += tests/libqos/e1000e.o
-qos-test-obj-y += tests/libqos/i2c.o
-qos-test-obj-y += tests/libqos/i2c-imx.o
-qos-test-obj-y += tests/libqos/i2c-omap.o
-qos-test-obj-y += tests/libqos/sdhci.o
-qos-test-obj-y += tests/libqos/tpci200.o
-qos-test-obj-y += tests/libqos/virtio.o
-qos-test-obj-$(CONFIG_VIRTFS) += tests/libqos/virtio-9p.o
-qos-test-obj-y += tests/libqos/virtio-balloon.o
-qos-test-obj-y += tests/libqos/virtio-blk.o
-qos-test-obj-y += tests/libqos/virtio-mmio.o
-qos-test-obj-y += tests/libqos/virtio-net.o
-qos-test-obj-y += tests/libqos/virtio-pci.o
-qos-test-obj-y += tests/libqos/virtio-pci-modern.o
-qos-test-obj-y += tests/libqos/virtio-rng.o
-qos-test-obj-y += tests/libqos/virtio-scsi.o
-qos-test-obj-y += tests/libqos/virtio-serial.o
-
-# Machines
-qos-test-obj-y += tests/libqos/aarch64-xlnx-zcu102-machine.o
-qos-test-obj-y += tests/libqos/arm-imx25-pdk-machine.o
-qos-test-obj-y += tests/libqos/arm-n800-machine.o
-qos-test-obj-y += tests/libqos/arm-raspi2-machine.o
-qos-test-obj-y += tests/libqos/arm-sabrelite-machine.o
-qos-test-obj-y += tests/libqos/arm-smdkc210-machine.o
-qos-test-obj-y += tests/libqos/arm-virt-machine.o
-qos-test-obj-y += tests/libqos/arm-xilinx-zynq-a9-machine.o
-qos-test-obj-y += tests/libqos/ppc64_pseries-machine.o
-qos-test-obj-y += tests/libqos/x86_64_pc-machine.o
-
-# Tests
-qos-test-obj-y += tests/ac97-test.o
-qos-test-obj-y += tests/ds1338-test.o
-qos-test-obj-y += tests/e1000-test.o
-qos-test-obj-y += tests/e1000e-test.o
-qos-test-obj-y += tests/eepro100-test.o
-qos-test-obj-y += tests/es1370-test.o
-qos-test-obj-y += tests/ipoctal232-test.o
-qos-test-obj-y += tests/megasas-test.o
-qos-test-obj-y += tests/ne2000-test.o
-qos-test-obj-y += tests/nvme-test.o
-qos-test-obj-y += tests/pca9552-test.o
-qos-test-obj-y += tests/pci-test.o
-qos-test-obj-y += tests/pcnet-test.o
-qos-test-obj-y += tests/sdhci-test.o
-qos-test-obj-y += tests/spapr-phb-test.o
-qos-test-obj-y += tests/tmp105-test.o
-qos-test-obj-y += tests/usb-hcd-ohci-test.o $(libqos-usb-obj-y)
-qos-test-obj-$(CONFIG_VHOST_NET_USER) += tests/vhost-user-test.o $(chardev-obj-y) $(test-io-obj-y)
-qos-test-obj-y += tests/virtio-test.o
-qos-test-obj-$(CONFIG_VIRTFS) += tests/virtio-9p-test.o
-qos-test-obj-y += tests/virtio-blk-test.o
-qos-test-obj-y += tests/virtio-net-test.o
-qos-test-obj-y += tests/virtio-rng-test.o
-qos-test-obj-y += tests/virtio-scsi-test.o
-qos-test-obj-y += tests/virtio-serial-test.o
-qos-test-obj-y += tests/vmxnet3-test.o
-
-check-unit-y += tests/test-qgraph$(EXESUF)
-tests/test-qgraph$(EXESUF): tests/test-qgraph.o $(libqgraph-obj-y)
-
-check-qtest-generic-y += tests/qos-test$(EXESUF)
-tests/qos-test$(EXESUF): $(qos-test-obj-y)
-
-tests/qmp-test$(EXESUF): tests/qmp-test.o
-tests/qmp-cmd-test$(EXESUF): tests/qmp-cmd-test.o
-tests/device-introspect-test$(EXESUF): tests/device-introspect-test.o
-tests/rtc-test$(EXESUF): tests/rtc-test.o
-tests/m48t59-test$(EXESUF): tests/m48t59-test.o
-tests/hexloader-test$(EXESUF): tests/hexloader-test.o
-tests/pflash-cfi02$(EXESUF): tests/pflash-cfi02-test.o
-tests/endianness-test$(EXESUF): tests/endianness-test.o
-tests/prom-env-test$(EXESUF): tests/prom-env-test.o $(libqos-obj-y)
-tests/rtas-test$(EXESUF): tests/rtas-test.o $(libqos-spapr-obj-y)
-tests/fdc-test$(EXESUF): tests/fdc-test.o
-tests/ide-test$(EXESUF): tests/ide-test.o $(libqos-pc-obj-y)
-tests/ahci-test$(EXESUF): tests/ahci-test.o $(libqos-pc-obj-y) qemu-img$(EXESUF)
-tests/ipmi-kcs-test$(EXESUF): tests/ipmi-kcs-test.o
-tests/ipmi-bt-test$(EXESUF): tests/ipmi-bt-test.o
-tests/hd-geo-test$(EXESUF): tests/hd-geo-test.o $(libqos-obj-y)
-tests/boot-order-test$(EXESUF): tests/boot-order-test.o $(libqos-obj-y)
-tests/boot-serial-test$(EXESUF): tests/boot-serial-test.o $(libqos-obj-y)
-tests/bios-tables-test$(EXESUF): tests/bios-tables-test.o \
-	tests/boot-sector.o tests/acpi-utils.o $(libqos-obj-y)
-tests/pxe-test$(EXESUF): tests/pxe-test.o tests/boot-sector.o $(libqos-obj-y)
-tests/microbit-test$(EXESUF): tests/microbit-test.o
-tests/m25p80-test$(EXESUF): tests/m25p80-test.o
-tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
-tests/q35-test$(EXESUF): tests/q35-test.o $(libqos-pc-obj-y)
-tests/fw_cfg-test$(EXESUF): tests/fw_cfg-test.o $(libqos-pc-obj-y)
-tests/rtl8139-test$(EXESUF): tests/rtl8139-test.o $(libqos-pc-obj-y)
-tests/pnv-xscom-test$(EXESUF): tests/pnv-xscom-test.o
-tests/wdt_ib700-test$(EXESUF): tests/wdt_ib700-test.o
-tests/tco-test$(EXESUF): tests/tco-test.o $(libqos-pc-obj-y)
-tests/virtio-ccw-test$(EXESUF): tests/virtio-ccw-test.o
-tests/display-vga-test$(EXESUF): tests/display-vga-test.o
-tests/qom-test$(EXESUF): tests/qom-test.o
-tests/test-hmp$(EXESUF): tests/test-hmp.o
-tests/machine-none-test$(EXESUF): tests/machine-none-test.o
-tests/device-plug-test$(EXESUF): tests/device-plug-test.o
-tests/drive_del-test$(EXESUF): tests/drive_del-test.o
-tests/pvpanic-test$(EXESUF): tests/pvpanic-test.o
-tests/i82801b11-test$(EXESUF): tests/i82801b11-test.o
-tests/intel-hda-test$(EXESUF): tests/intel-hda-test.o
-tests/ioh3420-test$(EXESUF): tests/ioh3420-test.o
-tests/usb-hcd-uhci-test$(EXESUF): tests/usb-hcd-uhci-test.o $(libqos-usb-obj-y)
-tests/usb-hcd-ehci-test$(EXESUF): tests/usb-hcd-ehci-test.o $(libqos-usb-obj-y)
-tests/usb-hcd-xhci-test$(EXESUF): tests/usb-hcd-xhci-test.o $(libqos-usb-obj-y)
-tests/cpu-plug-test$(EXESUF): tests/cpu-plug-test.o
-tests/migration-test$(EXESUF): tests/migration-test.o tests/migration-helpers.o
-tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
-tests/test-qemu-opts$(EXESUF): tests/test-qemu-opts.o $(test-util-obj-y)
-tests/test-keyval$(EXESUF): tests/test-keyval.o $(test-util-obj-y) $(test-qapi-obj-y)
-tests/test-write-threshold$(EXESUF): tests/test-write-threshold.o $(test-block-obj-y)
-tests/test-netfilter$(EXESUF): tests/test-netfilter.o $(qtest-obj-y)
-tests/test-filter-mirror$(EXESUF): tests/test-filter-mirror.o $(qtest-obj-y)
-tests/test-filter-redirector$(EXESUF): tests/test-filter-redirector.o $(qtest-obj-y)
-tests/test-x86-cpuid-compat$(EXESUF): tests/test-x86-cpuid-compat.o $(qtest-obj-y)
-tests/ivshmem-test$(EXESUF): tests/ivshmem-test.o contrib/ivshmem-server/ivshmem-server.o $(libqos-pc-obj-y) $(libqos-spapr-obj-y)
-tests/dbus-vmstate-test$(EXESUF): tests/dbus-vmstate-test.o tests/migration-helpers.o tests/dbus-vmstate1.o $(libqos-pc-obj-y) $(libqos-spapr-obj-y)
-tests/vhost-user-bridge$(EXESUF): tests/vhost-user-bridge.o $(test-util-obj-y) libvhost-user.a
-tests/test-uuid$(EXESUF): tests/test-uuid.o $(test-util-obj-y)
-tests/test-arm-mptimer$(EXESUF): tests/test-arm-mptimer.o
-tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y)
-tests/numa-test$(EXESUF): tests/numa-test.o
-tests/vmgenid-test$(EXESUF): tests/vmgenid-test.o tests/boot-sector.o tests/acpi-utils.o
-tests/cdrom-test$(EXESUF): tests/cdrom-test.o tests/boot-sector.o $(libqos-obj-y)
-tests/arm-cpu-features$(EXESUF): tests/arm-cpu-features.o
-
 tests/migration/stress$(EXESUF): tests/migration/stress.o
 	$(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"LINK","$(TARGET_DIR)$@")
 
@@ -882,19 +581,7 @@ tests/migration/initrd-stress.img: tests/migration/stress$(EXESUF)
 	rm $(INITRD_WORK_DIR)/init
 	rmdir $(INITRD_WORK_DIR)
 
-# QTest rules
-
-TARGETS=$(patsubst %-softmmu,%, $(filter %-softmmu,$(TARGET_DIRS)))
-ifeq ($(CONFIG_POSIX),y)
-QTEST_TARGETS = $(TARGETS)
-check-qtest-y=$(foreach TARGET,$(TARGETS), $(check-qtest-$(TARGET)-y))
-check-qtest-y += $(check-qtest-generic-y)
-else
-QTEST_TARGETS =
-endif
-
-qtest-obj-y = tests/libqtest.o $(test-util-obj-y)
-$(check-qtest-y): $(qtest-obj-y)
+include $(SRC_PATH)/tests/qtest/Makefile.include
 
 tests/test-qga$(EXESUF): qemu-ga$(EXESUF)
 tests/test-qga$(EXESUF): tests/test-qga.o $(qtest-obj-y)
@@ -938,7 +625,7 @@ endef
 
 .PHONY: $(patsubst %, check-qtest-%, $(QTEST_TARGETS))
 $(patsubst %, check-qtest-%, $(QTEST_TARGETS)): check-qtest-%: %-softmmu/all $(check-qtest-y)
-	$(call do_test_human,$(check-qtest-$*-y) $(check-qtest-generic-y), \
+	$(call do_test_human,$(check-qtest-$*-y:%=tests/qtest/%$(EXESUF)) $(check-qtest-generic-y:%=tests/qtest/%$(EXESUF)), \
 	  QTEST_QEMU_BINARY=$*-softmmu/qemu-system-$* \
 	  QTEST_QEMU_IMG=qemu-img$(EXESUF))
 
@@ -951,7 +638,7 @@ check-speed: $(check-speed-y)
 # gtester tests with TAP output
 
 $(patsubst %, check-report-qtest-%.tap, $(QTEST_TARGETS)): check-report-qtest-%.tap: %-softmmu/all $(check-qtest-y)
-	$(call do_test_tap, $(check-qtest-$*-y) $(check-qtest-generic-y), \
+	$(call do_test_tap, $(check-qtest-$*-y:%=tests/qtest/%$(EXESUF)) $(check-qtest-generic-y:%=tests/qtest/%$(EXESUF)), \
 	  QTEST_QEMU_BINARY=$*-softmmu/qemu-system-$* \
 	  QTEST_QEMU_IMG=qemu-img$(EXESUF))
 
@@ -1216,10 +903,10 @@ check-block: $(patsubst %,check-%, $(check-block-y))
 endif
 check: check-block check-qapi-schema check-unit check-softfloat check-qtest check-decodetree
 check-clean:
-	rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
-	rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), $(check-qtest-$(target)-y)) $(check-qtest-generic-y))
+	rm -rf $(check-unit-y) tests/*.o tests/*/*.o $(QEMU_IOTESTS_HELPERS-y)
+	rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), $(check-qtest-$(target)-y:%=tests/qtest/%$(EXESUF))) $(check-qtest-generic-y:%=tests/qtest/%$(EXESUF)))
 	rm -f tests/test-qapi-gen-timestamp
-	rm -f tests/dbus-vmstate1-gen-timestamp
+	rm -f tests/qtest/dbus-vmstate1-gen-timestamp
 	rm -rf $(TESTS_VENV_DIR) $(TESTS_RESULTS_DIR)
 
 clean: check-clean
@@ -1229,6 +916,7 @@ clean: check-clean
 all: $(QEMU_IOTESTS_HELPERS-y)
 
 -include $(wildcard tests/*.d)
--include $(wildcard tests/libqos/*.d)
+-include $(wildcard tests/qtest/*.d)
+-include $(wildcard tests/qtest/qos/*.d)
 
 endif
diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
index e16c30ce57..9176b96c1c 100644
--- a/tests/ptimer-test.c
+++ b/tests/ptimer-test.c
@@ -14,7 +14,6 @@
 #include "qemu/main-loop.h"
 #include "hw/ptimer.h"
 
-#include "libqtest.h"
 #include "ptimer-test.h"
 
 static bool triggered;
diff --git a/tests/qtest/Makefile.include b/tests/qtest/Makefile.include
new file mode 100644
index 0000000000..e6bb4ab28c
--- /dev/null
+++ b/tests/qtest/Makefile.include
@@ -0,0 +1,318 @@
+# All QTests for now are POSIX-only, but the dependencies are
+# really in libqtest, not in the testcases themselves.
+
+check-qtest-generic-y += cdrom-test
+check-qtest-generic-y += device-introspect-test
+check-qtest-generic-y += machine-none-test
+check-qtest-generic-y += qmp-test
+check-qtest-generic-y += qmp-cmd-test
+check-qtest-generic-y += qom-test
+check-qtest-generic-$(CONFIG_MODULES) += modules-test
+check-qtest-generic-y += test-hmp
+
+check-qtest-pci-$(CONFIG_RTL8139_PCI) += rtl8139-test
+check-qtest-pci-$(CONFIG_VGA) += display-vga-test
+check-qtest-pci-$(CONFIG_HDA) += intel-hda-test
+check-qtest-pci-$(CONFIG_IVSHMEM_DEVICE) += ivshmem-test
+
+DBUS_DAEMON := $(shell which dbus-daemon 2>/dev/null)
+ifneq ($(GDBUS_CODEGEN),)
+ifneq ($(DBUS_DAEMON),)
+check-qtest-pci-$(CONFIG_GIO) += dbus-vmstate-test
+endif
+endif
+
+check-qtest-i386-$(CONFIG_ISA_TESTDEV) = endianness-test
+check-qtest-i386-y += fdc-test
+check-qtest-i386-y += ide-test
+check-qtest-i386-$(CONFIG_TOOLS) += ahci-test
+check-qtest-i386-y += hd-geo-test
+check-qtest-i386-y += boot-order-test
+check-qtest-i386-y += bios-tables-test
+check-qtest-i386-$(CONFIG_SGA) += boot-serial-test
+check-qtest-i386-$(CONFIG_SLIRP) += pxe-test
+check-qtest-i386-y += rtc-test
+check-qtest-i386-$(CONFIG_ISA_IPMI_KCS) += ipmi-kcs-test
+ifdef CONFIG_LINUX
+check-qtest-i386-$(CONFIG_ISA_IPMI_BT) += ipmi-bt-test
+endif
+check-qtest-i386-y += i440fx-test
+check-qtest-i386-y += fw_cfg-test
+check-qtest-i386-y += device-plug-test
+check-qtest-i386-y += drive_del-test
+check-qtest-i386-$(CONFIG_WDT_IB700) += wdt_ib700-test
+check-qtest-i386-y += tco-test
+check-qtest-i386-y += $(check-qtest-pci-y)
+check-qtest-i386-$(CONFIG_PVPANIC) += pvpanic-test
+check-qtest-i386-$(CONFIG_I82801B11) += i82801b11-test
+check-qtest-i386-$(CONFIG_IOH3420) += ioh3420-test
+check-qtest-i386-$(CONFIG_USB_UHCI) += usb-hcd-uhci-test
+check-qtest-i386-$(call land,$(CONFIG_USB_EHCI),$(CONFIG_USB_UHCI)) += usb-hcd-ehci-test
+check-qtest-i386-$(CONFIG_USB_XHCI_NEC) += usb-hcd-xhci-test
+check-qtest-i386-y += cpu-plug-test
+check-qtest-i386-y += q35-test
+check-qtest-i386-y += vmgenid-test
+check-qtest-i386-$(CONFIG_TPM_CRB) += tpm-crb-swtpm-test
+check-qtest-i386-$(CONFIG_TPM_CRB) += tpm-crb-test
+check-qtest-i386-$(CONFIG_TPM_TIS) += tpm-tis-swtpm-test
+check-qtest-i386-$(CONFIG_TPM_TIS) += tpm-tis-test
+check-qtest-i386-$(CONFIG_SLIRP) += test-netfilter
+check-qtest-i386-$(CONFIG_POSIX) += test-filter-mirror
+check-qtest-i386-$(CONFIG_RTL8139_PCI) += test-filter-redirector
+check-qtest-i386-y += migration-test
+check-qtest-i386-y += test-x86-cpuid-compat
+check-qtest-i386-y += numa-test
+
+check-qtest-x86_64-y += $(check-qtest-i386-y)
+
+check-qtest-alpha-y += boot-serial-test
+check-qtest-alpha-$(CONFIG_VGA) += display-vga-test
+
+check-qtest-hppa-y += boot-serial-test
+check-qtest-hppa-$(CONFIG_VGA) += display-vga-test
+
+check-qtest-m68k-y = boot-serial-test
+
+check-qtest-microblaze-y += boot-serial-test
+
+check-qtest-mips-$(CONFIG_ISA_TESTDEV) = endianness-test
+check-qtest-mips-$(CONFIG_VGA) += display-vga-test
+
+check-qtest-mips64-$(CONFIG_ISA_TESTDEV) = endianness-test
+check-qtest-mips64-$(CONFIG_VGA) += display-vga-test
+
+check-qtest-mips64el-$(CONFIG_ISA_TESTDEV) = endianness-test
+check-qtest-mips64el-$(CONFIG_VGA) += display-vga-test
+
+check-qtest-moxie-y += boot-serial-test
+
+check-qtest-ppc-$(CONFIG_ISA_TESTDEV) = endianness-test
+check-qtest-ppc-y += boot-order-test
+check-qtest-ppc-y += prom-env-test
+check-qtest-ppc-y += drive_del-test
+check-qtest-ppc-y += boot-serial-test
+check-qtest-ppc-$(CONFIG_M48T59) += m48t59-test
+
+check-qtest-ppc64-y += $(check-qtest-ppc-y)
+check-qtest-ppc64-$(CONFIG_PSERIES) += device-plug-test
+check-qtest-ppc64-$(CONFIG_POWERNV) += pnv-xscom-test
+check-qtest-ppc64-y += migration-test
+check-qtest-ppc64-$(CONFIG_PSERIES) += rtas-test
+check-qtest-ppc64-$(CONFIG_SLIRP) += pxe-test
+check-qtest-ppc64-$(CONFIG_USB_UHCI) += usb-hcd-uhci-test
+check-qtest-ppc64-$(CONFIG_USB_XHCI_NEC) += usb-hcd-xhci-test
+check-qtest-ppc64-$(CONFIG_SLIRP) += test-netfilter
+check-qtest-ppc64-$(CONFIG_POSIX) += test-filter-mirror
+check-qtest-ppc64-$(CONFIG_RTL8139_PCI) += test-filter-redirector
+check-qtest-ppc64-$(CONFIG_VGA) += display-vga-test
+check-qtest-ppc64-y += numa-test
+check-qtest-ppc64-$(CONFIG_IVSHMEM_DEVICE) += ivshmem-test
+check-qtest-ppc64-y += cpu-plug-test
+
+check-qtest-sh4-$(CONFIG_ISA_TESTDEV) = endianness-test
+
+check-qtest-sh4eb-$(CONFIG_ISA_TESTDEV) = endianness-test
+
+check-qtest-sparc-y += prom-env-test
+check-qtest-sparc-y += m48t59-test
+check-qtest-sparc-y += boot-serial-test
+
+check-qtest-sparc64-$(CONFIG_ISA_TESTDEV) = endianness-test
+check-qtest-sparc64-y += prom-env-test
+check-qtest-sparc64-y += boot-serial-test
+
+check-qtest-arm-y += arm-cpu-features
+check-qtest-arm-y += microbit-test
+check-qtest-arm-y += m25p80-test
+check-qtest-arm-y += test-arm-mptimer
+check-qtest-arm-y += boot-serial-test
+check-qtest-arm-y += hexloader-test
+check-qtest-arm-$(CONFIG_PFLASH_CFI02) += pflash-cfi02-test
+
+check-qtest-aarch64-y += arm-cpu-features
+check-qtest-aarch64-y += numa-test
+check-qtest-aarch64-y += boot-serial-test
+check-qtest-aarch64-y += migration-test
+
+# TODO: once aarch64 TCG is fixed on ARM 32 bit host, make test unconditional
+ifneq ($(ARCH),arm)
+check-qtest-aarch64-y += bios-tables-test
+endif
+
+check-qtest-microblazeel-y += $(check-qtest-microblaze-y)
+
+check-qtest-xtensaeb-y += $(check-qtest-xtensa-y)
+
+check-qtest-s390x-y = boot-serial-test
+check-qtest-s390x-$(CONFIG_SLIRP) += pxe-test
+check-qtest-s390x-$(CONFIG_SLIRP) += test-netfilter
+check-qtest-s390x-$(CONFIG_POSIX) += test-filter-mirror
+check-qtest-s390x-$(CONFIG_POSIX) += test-filter-redirector
+check-qtest-s390x-y += drive_del-test
+check-qtest-s390x-y += device-plug-test
+check-qtest-s390x-y += virtio-ccw-test
+check-qtest-s390x-y += cpu-plug-test
+check-qtest-s390x-y += migration-test
+
+# libqos / qgraph :
+libqgraph-obj-y = tests/qtest/libqos/qgraph.o
+
+libqos-obj-y = $(libqgraph-obj-y) tests/qtest/libqos/pci.o tests/qtest/libqos/fw_cfg.o
+libqos-obj-y += tests/qtest/libqos/malloc.o
+libqos-obj-y += tests/qtest/libqos/libqos.o
+libqos-spapr-obj-y = $(libqos-obj-y) tests/qtest/libqos/malloc-spapr.o
+libqos-spapr-obj-y += tests/qtest/libqos/libqos-spapr.o
+libqos-spapr-obj-y += tests/qtest/libqos/rtas.o
+libqos-spapr-obj-y += tests/qtest/libqos/pci-spapr.o
+libqos-pc-obj-y = $(libqos-obj-y) tests/qtest/libqos/pci-pc.o
+libqos-pc-obj-y += tests/qtest/libqos/malloc-pc.o tests/qtest/libqos/libqos-pc.o
+libqos-pc-obj-y += tests/qtest/libqos/ahci.o
+libqos-usb-obj-y = $(libqos-spapr-obj-y) $(libqos-pc-obj-y) tests/qtest/libqos/usb.o
+
+# qos devices:
+qos-test-obj-y = tests/qtest/qos-test.o $(libqgraph-obj-y)
+qos-test-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y)
+qos-test-obj-y += tests/qtest/libqos/e1000e.o
+qos-test-obj-y += tests/qtest/libqos/i2c.o
+qos-test-obj-y += tests/qtest/libqos/i2c-imx.o
+qos-test-obj-y += tests/qtest/libqos/i2c-omap.o
+qos-test-obj-y += tests/qtest/libqos/sdhci.o
+qos-test-obj-y += tests/qtest/libqos/tpci200.o
+qos-test-obj-y += tests/qtest/libqos/virtio.o
+qos-test-obj-$(CONFIG_VIRTFS) += tests/qtest/libqos/virtio-9p.o
+qos-test-obj-y += tests/qtest/libqos/virtio-balloon.o
+qos-test-obj-y += tests/qtest/libqos/virtio-blk.o
+qos-test-obj-y += tests/qtest/libqos/virtio-mmio.o
+qos-test-obj-y += tests/qtest/libqos/virtio-net.o
+qos-test-obj-y += tests/qtest/libqos/virtio-pci.o
+qos-test-obj-y += tests/qtest/libqos/virtio-pci-modern.o
+qos-test-obj-y += tests/qtest/libqos/virtio-rng.o
+qos-test-obj-y += tests/qtest/libqos/virtio-scsi.o
+qos-test-obj-y += tests/qtest/libqos/virtio-serial.o
+
+# qos machines:
+qos-test-obj-y += tests/qtest/libqos/aarch64-xlnx-zcu102-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-imx25-pdk-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-n800-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-raspi2-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-sabrelite-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-smdkc210-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-virt-machine.o
+qos-test-obj-y += tests/qtest/libqos/arm-xilinx-zynq-a9-machine.o
+qos-test-obj-y += tests/qtest/libqos/ppc64_pseries-machine.o
+qos-test-obj-y += tests/qtest/libqos/x86_64_pc-machine.o
+
+# qos tests:
+qos-test-obj-y += tests/qtest/ac97-test.o
+qos-test-obj-y += tests/qtest/ds1338-test.o
+qos-test-obj-y += tests/qtest/e1000-test.o
+qos-test-obj-y += tests/qtest/e1000e-test.o
+qos-test-obj-y += tests/qtest/eepro100-test.o
+qos-test-obj-y += tests/qtest/es1370-test.o
+qos-test-obj-y += tests/qtest/ipoctal232-test.o
+qos-test-obj-y += tests/qtest/megasas-test.o
+qos-test-obj-y += tests/qtest/ne2000-test.o
+qos-test-obj-y += tests/qtest/nvme-test.o
+qos-test-obj-y += tests/qtest/pca9552-test.o
+qos-test-obj-y += tests/qtest/pci-test.o
+qos-test-obj-y += tests/qtest/pcnet-test.o
+qos-test-obj-y += tests/qtest/sdhci-test.o
+qos-test-obj-y += tests/qtest/spapr-phb-test.o
+qos-test-obj-y += tests/qtest/tmp105-test.o
+qos-test-obj-y += tests/qtest/usb-hcd-ohci-test.o $(libqos-usb-obj-y)
+qos-test-obj-$(CONFIG_VHOST_NET_USER) += tests/qtest/vhost-user-test.o $(chardev-obj-y) $(test-io-obj-y)
+qos-test-obj-y += tests/qtest/virtio-test.o
+qos-test-obj-$(CONFIG_VIRTFS) += tests/qtest/virtio-9p-test.o
+qos-test-obj-y += tests/qtest/virtio-blk-test.o
+qos-test-obj-y += tests/qtest/virtio-net-test.o
+qos-test-obj-y += tests/qtest/virtio-rng-test.o
+qos-test-obj-y += tests/qtest/virtio-scsi-test.o
+qos-test-obj-y += tests/qtest/virtio-serial-test.o
+qos-test-obj-y += tests/qtest/vmxnet3-test.o
+
+check-unit-y += tests/test-qgraph$(EXESUF)
+tests/test-qgraph$(EXESUF): tests/test-qgraph.o $(libqgraph-obj-y)
+
+check-qtest-generic-y += qos-test
+tests/qtest/qos-test$(EXESUF): $(qos-test-obj-y)
+
+# QTest dependencies:
+tests/qtest/qmp-test$(EXESUF): tests/qtest/qmp-test.o
+tests/qtest/qmp-cmd-test$(EXESUF): tests/qtest/qmp-cmd-test.o
+tests/qtest/device-introspect-test$(EXESUF): tests/qtest/device-introspect-test.o
+tests/qtest/rtc-test$(EXESUF): tests/qtest/rtc-test.o
+tests/qtest/m48t59-test$(EXESUF): tests/qtest/m48t59-test.o
+tests/qtest/hexloader-test$(EXESUF): tests/qtest/hexloader-test.o
+tests/qtest/pflash-cfi02$(EXESUF): tests/qtest/pflash-cfi02-test.o
+tests/qtest/endianness-test$(EXESUF): tests/qtest/endianness-test.o
+tests/qtest/prom-env-test$(EXESUF): tests/qtest/prom-env-test.o $(libqos-obj-y)
+tests/qtest/rtas-test$(EXESUF): tests/qtest/rtas-test.o $(libqos-spapr-obj-y)
+tests/qtest/fdc-test$(EXESUF): tests/qtest/fdc-test.o
+tests/qtest/ide-test$(EXESUF): tests/qtest/ide-test.o $(libqos-pc-obj-y)
+tests/qtest/ahci-test$(EXESUF): tests/qtest/ahci-test.o $(libqos-pc-obj-y) qemu-img$(EXESUF)
+tests/qtest/ipmi-kcs-test$(EXESUF): tests/qtest/ipmi-kcs-test.o
+tests/qtest/ipmi-bt-test$(EXESUF): tests/qtest/ipmi-bt-test.o
+tests/qtest/hd-geo-test$(EXESUF): tests/qtest/hd-geo-test.o $(libqos-obj-y)
+tests/qtest/boot-order-test$(EXESUF): tests/qtest/boot-order-test.o $(libqos-obj-y)
+tests/qtest/boot-serial-test$(EXESUF): tests/qtest/boot-serial-test.o $(libqos-obj-y)
+tests/qtest/bios-tables-test$(EXESUF): tests/qtest/bios-tables-test.o \
+	tests/qtest/boot-sector.o tests/qtest/acpi-utils.o $(libqos-obj-y)
+tests/qtest/pxe-test$(EXESUF): tests/qtest/pxe-test.o tests/qtest/boot-sector.o $(libqos-obj-y)
+tests/qtest/microbit-test$(EXESUF): tests/qtest/microbit-test.o
+tests/qtest/m25p80-test$(EXESUF): tests/qtest/m25p80-test.o
+tests/qtest/i440fx-test$(EXESUF): tests/qtest/i440fx-test.o $(libqos-pc-obj-y)
+tests/qtest/q35-test$(EXESUF): tests/qtest/q35-test.o $(libqos-pc-obj-y)
+tests/qtest/fw_cfg-test$(EXESUF): tests/qtest/fw_cfg-test.o $(libqos-pc-obj-y)
+tests/qtest/rtl8139-test$(EXESUF): tests/qtest/rtl8139-test.o $(libqos-pc-obj-y)
+tests/qtest/pnv-xscom-test$(EXESUF): tests/qtest/pnv-xscom-test.o
+tests/qtest/wdt_ib700-test$(EXESUF): tests/qtest/wdt_ib700-test.o
+tests/qtest/tco-test$(EXESUF): tests/qtest/tco-test.o $(libqos-pc-obj-y)
+tests/qtest/virtio-ccw-test$(EXESUF): tests/qtest/virtio-ccw-test.o
+tests/qtest/display-vga-test$(EXESUF): tests/qtest/display-vga-test.o
+tests/qtest/qom-test$(EXESUF): tests/qtest/qom-test.o
+tests/qtest/test-hmp$(EXESUF): tests/qtest/test-hmp.o
+tests/qtest/machine-none-test$(EXESUF): tests/qtest/machine-none-test.o
+tests/qtest/device-plug-test$(EXESUF): tests/qtest/device-plug-test.o
+tests/qtest/drive_del-test$(EXESUF): tests/qtest/drive_del-test.o
+tests/qtest/pvpanic-test$(EXESUF): tests/qtest/pvpanic-test.o
+tests/qtest/i82801b11-test$(EXESUF): tests/qtest/i82801b11-test.o
+tests/qtest/intel-hda-test$(EXESUF): tests/qtest/intel-hda-test.o
+tests/qtest/ioh3420-test$(EXESUF): tests/qtest/ioh3420-test.o
+tests/qtest/usb-hcd-uhci-test$(EXESUF): tests/qtest/usb-hcd-uhci-test.o $(libqos-usb-obj-y)
+tests/qtest/usb-hcd-ehci-test$(EXESUF): tests/qtest/usb-hcd-ehci-test.o $(libqos-usb-obj-y)
+tests/qtest/usb-hcd-xhci-test$(EXESUF): tests/qtest/usb-hcd-xhci-test.o $(libqos-usb-obj-y)
+tests/qtest/cpu-plug-test$(EXESUF): tests/qtest/cpu-plug-test.o
+tests/qtest/migration-test$(EXESUF): tests/qtest/migration-test.o tests/qtest/migration-helpers.o
+tests/qtest/qemu-iotests/qtest/socket_scm_helper$(EXESUF): tests/qtest/qemu-iotests/qtest/socket_scm_helper.o
+tests/qtest/test-netfilter$(EXESUF): tests/qtest/test-netfilter.o $(qtest-obj-y)
+tests/qtest/test-filter-mirror$(EXESUF): tests/qtest/test-filter-mirror.o $(qtest-obj-y)
+tests/qtest/test-filter-redirector$(EXESUF): tests/qtest/test-filter-redirector.o $(qtest-obj-y)
+tests/qtest/test-x86-cpuid-compat$(EXESUF): tests/qtest/test-x86-cpuid-compat.o $(qtest-obj-y)
+tests/qtest/ivshmem-test$(EXESUF): tests/qtest/ivshmem-test.o contrib/ivshmem-server/ivshmem-server.o $(libqos-pc-obj-y) $(libqos-spapr-obj-y)
+tests/qtest/dbus-vmstate-test$(EXESUF): tests/qtest/dbus-vmstate-test.o tests/qtest/migration-helpers.o tests/qtest/dbus-vmstate1.o $(libqos-pc-obj-y) $(libqos-spapr-obj-y)
+tests/qtest/vhost-user-bridge$(EXESUF): tests/qtest/vhost-user-bridge.o $(test-util-obj-y) libvhost-user.a
+tests/qtest/test-arm-mptimer$(EXESUF): tests/qtest/test-arm-mptimer.o
+tests/qtest/numa-test$(EXESUF): tests/qtest/numa-test.o
+tests/qtest/vmgenid-test$(EXESUF): tests/qtest/vmgenid-test.o tests/qtest/boot-sector.o tests/qtest/acpi-utils.o
+tests/qtest/cdrom-test$(EXESUF): tests/qtest/cdrom-test.o tests/qtest/boot-sector.o $(libqos-obj-y)
+tests/qtest/arm-cpu-features$(EXESUF): tests/qtest/arm-cpu-features.o
+tests/qtest/tpm-crb-swtpm-test$(EXESUF): tests/qtest/tpm-crb-swtpm-test.o tests/qtest/tpm-emu.o \
+	tests/qtest/tpm-util.o tests/qtest/tpm-tests.o $(test-io-obj-y)
+tests/qtest/tpm-crb-test$(EXESUF): tests/qtest/tpm-crb-test.o tests/qtest/tpm-emu.o $(test-io-obj-y)
+tests/qtest/tpm-tis-swtpm-test$(EXESUF): tests/qtest/tpm-tis-swtpm-test.o tests/qtest/tpm-emu.o \
+	tests/qtest/tpm-util.o tests/qtest/tpm-tests.o $(test-io-obj-y)
+tests/qtest/tpm-tis-test$(EXESUF): tests/qtest/tpm-tis-test.o tests/qtest/tpm-emu.o $(test-io-obj-y)
+
+# QTest rules
+
+TARGETS=$(patsubst %-softmmu,%, $(filter %-softmmu,$(TARGET_DIRS)))
+ifeq ($(CONFIG_POSIX),y)
+QTEST_TARGETS = $(TARGETS)
+check-qtest-y=$(foreach TARGET,$(TARGETS), $(check-qtest-$(TARGET)-y:%=tests/qtest/%$(EXESUF)))
+check-qtest-y += $(check-qtest-generic-y:%=tests/qtest/%$(EXESUF))
+else
+QTEST_TARGETS =
+endif
+
+qtest-obj-y = tests/qtest/libqtest.o $(test-util-obj-y)
+$(check-qtest-y): $(qtest-obj-y)
diff --git a/tests/ac97-test.c b/tests/qtest/ac97-test.c
index b084e31bff..b084e31bff 100644
--- a/tests/ac97-test.c
+++ b/tests/qtest/ac97-test.c
diff --git a/tests/acpi-utils.c b/tests/qtest/acpi-utils.c
index d2a202efca..d2a202efca 100644
--- a/tests/acpi-utils.c
+++ b/tests/qtest/acpi-utils.c
diff --git a/tests/acpi-utils.h b/tests/qtest/acpi-utils.h
index 0c86780689..0c86780689 100644
--- a/tests/acpi-utils.h
+++ b/tests/qtest/acpi-utils.h
diff --git a/tests/ahci-test.c b/tests/qtest/ahci-test.c
index c8d42ceea0..c8d42ceea0 100644
--- a/tests/ahci-test.c
+++ b/tests/qtest/ahci-test.c
diff --git a/tests/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index bef3ed24b6..bef3ed24b6 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
diff --git a/tests/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..dfb8523c8b 100644
--- a/tests/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
diff --git a/tests/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index f1ac2d7e96..f1ac2d7e96 100644
--- a/tests/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
diff --git a/tests/boot-order-test.c b/tests/qtest/boot-order-test.c
index a725bce729..a725bce729 100644
--- a/tests/boot-order-test.c
+++ b/tests/qtest/boot-order-test.c
diff --git a/tests/boot-sector.c b/tests/qtest/boot-sector.c
index 9e66c6d013..9e66c6d013 100644
--- a/tests/boot-sector.c
+++ b/tests/qtest/boot-sector.c
diff --git a/tests/boot-sector.h b/tests/qtest/boot-sector.h
index 6ee6bb4d97..6ee6bb4d97 100644
--- a/tests/boot-sector.h
+++ b/tests/qtest/boot-sector.h
diff --git a/tests/boot-serial-test.c b/tests/qtest/boot-serial-test.c
index 05c7f44457..05c7f44457 100644
--- a/tests/boot-serial-test.c
+++ b/tests/qtest/boot-serial-test.c
diff --git a/tests/cdrom-test.c b/tests/qtest/cdrom-test.c
index 67635e387a..67635e387a 100644
--- a/tests/cdrom-test.c
+++ b/tests/qtest/cdrom-test.c
diff --git a/tests/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
index e8ffbbce4b..e8ffbbce4b 100644
--- a/tests/cpu-plug-test.c
+++ b/tests/qtest/cpu-plug-test.c
diff --git a/tests/dbus-vmstate-test.c b/tests/qtest/dbus-vmstate-test.c
index 2e5e47dec2..2e5e47dec2 100644
--- a/tests/dbus-vmstate-test.c
+++ b/tests/qtest/dbus-vmstate-test.c
diff --git a/tests/dbus-vmstate1.xml b/tests/qtest/dbus-vmstate1.xml
index cc8563be4c..cc8563be4c 100644
--- a/tests/dbus-vmstate1.xml
+++ b/tests/qtest/dbus-vmstate1.xml
diff --git a/tests/device-introspect-test.c b/tests/qtest/device-introspect-test.c
index 04f22903b0..04f22903b0 100644
--- a/tests/device-introspect-test.c
+++ b/tests/qtest/device-introspect-test.c
diff --git a/tests/device-plug-test.c b/tests/qtest/device-plug-test.c
index 318e422d51..318e422d51 100644
--- a/tests/device-plug-test.c
+++ b/tests/qtest/device-plug-test.c
diff --git a/tests/display-vga-test.c b/tests/qtest/display-vga-test.c
index ace3bb28e0..ace3bb28e0 100644
--- a/tests/display-vga-test.c
+++ b/tests/qtest/display-vga-test.c
diff --git a/tests/drive_del-test.c b/tests/qtest/drive_del-test.c
index 5f8839b232..5f8839b232 100644
--- a/tests/drive_del-test.c
+++ b/tests/qtest/drive_del-test.c
diff --git a/tests/ds1338-test.c b/tests/qtest/ds1338-test.c
index f6ade9a050..f6ade9a050 100644
--- a/tests/ds1338-test.c
+++ b/tests/qtest/ds1338-test.c
diff --git a/tests/e1000-test.c b/tests/qtest/e1000-test.c
index c387984ef6..c387984ef6 100644
--- a/tests/e1000-test.c
+++ b/tests/qtest/e1000-test.c
diff --git a/tests/e1000e-test.c b/tests/qtest/e1000e-test.c
index 1a232a663a..1a232a663a 100644
--- a/tests/e1000e-test.c
+++ b/tests/qtest/e1000e-test.c
diff --git a/tests/eepro100-test.c b/tests/qtest/eepro100-test.c
index 8dbffff0b8..8dbffff0b8 100644
--- a/tests/eepro100-test.c
+++ b/tests/qtest/eepro100-test.c
diff --git a/tests/endianness-test.c b/tests/qtest/endianness-test.c
index 58527952a5..58527952a5 100644
--- a/tests/endianness-test.c
+++ b/tests/qtest/endianness-test.c
diff --git a/tests/es1370-test.c b/tests/qtest/es1370-test.c
index adccdac1be..adccdac1be 100644
--- a/tests/es1370-test.c
+++ b/tests/qtest/es1370-test.c
diff --git a/tests/fdc-test.c b/tests/qtest/fdc-test.c
index 26b69f7c5c..26b69f7c5c 100644
--- a/tests/fdc-test.c
+++ b/tests/qtest/fdc-test.c
diff --git a/tests/fw_cfg-test.c b/tests/qtest/fw_cfg-test.c
index 5dc807ba23..5dc807ba23 100644
--- a/tests/fw_cfg-test.c
+++ b/tests/qtest/fw_cfg-test.c
diff --git a/tests/hd-geo-test.c b/tests/qtest/hd-geo-test.c
index a249800544..a249800544 100644
--- a/tests/hd-geo-test.c
+++ b/tests/qtest/hd-geo-test.c
diff --git a/tests/hexloader-test.c b/tests/qtest/hexloader-test.c
index 8b7aa2d72d..8b7aa2d72d 100644
--- a/tests/hexloader-test.c
+++ b/tests/qtest/hexloader-test.c
diff --git a/tests/i440fx-test.c b/tests/qtest/i440fx-test.c
index 1f57d9684b..1f57d9684b 100644
--- a/tests/i440fx-test.c
+++ b/tests/qtest/i440fx-test.c
diff --git a/tests/i82801b11-test.c b/tests/qtest/i82801b11-test.c
index 4345da338b..4345da338b 100644
--- a/tests/i82801b11-test.c
+++ b/tests/qtest/i82801b11-test.c
diff --git a/tests/ide-test.c b/tests/qtest/ide-test.c
index 0277e7d5a9..0277e7d5a9 100644
--- a/tests/ide-test.c
+++ b/tests/qtest/ide-test.c
diff --git a/tests/intel-hda-test.c b/tests/qtest/intel-hda-test.c
index fc25ccc33c..fc25ccc33c 100644
--- a/tests/intel-hda-test.c
+++ b/tests/qtest/intel-hda-test.c
diff --git a/tests/ioh3420-test.c b/tests/qtest/ioh3420-test.c
index f6ca43cca7..f6ca43cca7 100644
--- a/tests/ioh3420-test.c
+++ b/tests/qtest/ioh3420-test.c
diff --git a/tests/ipmi-bt-test.c b/tests/qtest/ipmi-bt-test.c
index a42207d416..a42207d416 100644
--- a/tests/ipmi-bt-test.c
+++ b/tests/qtest/ipmi-bt-test.c
diff --git a/tests/ipmi-kcs-test.c b/tests/qtest/ipmi-kcs-test.c
index 693a6aacb5..693a6aacb5 100644
--- a/tests/ipmi-kcs-test.c
+++ b/tests/qtest/ipmi-kcs-test.c
diff --git a/tests/ipoctal232-test.c b/tests/qtest/ipoctal232-test.c
index 53a8c9b13c..53a8c9b13c 100644
--- a/tests/ipoctal232-test.c
+++ b/tests/qtest/ipoctal232-test.c
diff --git a/tests/ivshmem-test.c b/tests/qtest/ivshmem-test.c
index ecda256472..ecda256472 100644
--- a/tests/ivshmem-test.c
+++ b/tests/qtest/ivshmem-test.c
diff --git a/tests/libqos/aarch64-xlnx-zcu102-machine.c b/tests/qtest/libqos/aarch64-xlnx-zcu102-machine.c
index 1d5de5af00..1d5de5af00 100644
--- a/tests/libqos/aarch64-xlnx-zcu102-machine.c
+++ b/tests/qtest/libqos/aarch64-xlnx-zcu102-machine.c
diff --git a/tests/libqos/ahci.c b/tests/qtest/libqos/ahci.c
index cc1b08eabe..cc1b08eabe 100644
--- a/tests/libqos/ahci.c
+++ b/tests/qtest/libqos/ahci.c
diff --git a/tests/libqos/ahci.h b/tests/qtest/libqos/ahci.h
index f05b3e5fce..f05b3e5fce 100644
--- a/tests/libqos/ahci.h
+++ b/tests/qtest/libqos/ahci.h
diff --git a/tests/libqos/arm-imx25-pdk-machine.c b/tests/qtest/libqos/arm-imx25-pdk-machine.c
index 25066fb8a9..25066fb8a9 100644
--- a/tests/libqos/arm-imx25-pdk-machine.c
+++ b/tests/qtest/libqos/arm-imx25-pdk-machine.c
diff --git a/tests/libqos/arm-n800-machine.c b/tests/qtest/libqos/arm-n800-machine.c
index 87279bdb26..87279bdb26 100644
--- a/tests/libqos/arm-n800-machine.c
+++ b/tests/qtest/libqos/arm-n800-machine.c
diff --git a/tests/libqos/arm-raspi2-machine.c b/tests/qtest/libqos/arm-raspi2-machine.c
index 12a7cb7e4b..12a7cb7e4b 100644
--- a/tests/libqos/arm-raspi2-machine.c
+++ b/tests/qtest/libqos/arm-raspi2-machine.c
diff --git a/tests/libqos/arm-sabrelite-machine.c b/tests/qtest/libqos/arm-sabrelite-machine.c
index e6df43795a..e6df43795a 100644
--- a/tests/libqos/arm-sabrelite-machine.c
+++ b/tests/qtest/libqos/arm-sabrelite-machine.c
diff --git a/tests/libqos/arm-smdkc210-machine.c b/tests/qtest/libqos/arm-smdkc210-machine.c
index 215b628a7d..215b628a7d 100644
--- a/tests/libqos/arm-smdkc210-machine.c
+++ b/tests/qtest/libqos/arm-smdkc210-machine.c
diff --git a/tests/libqos/arm-virt-machine.c b/tests/qtest/libqos/arm-virt-machine.c
index 96ffe3ee5c..96ffe3ee5c 100644
--- a/tests/libqos/arm-virt-machine.c
+++ b/tests/qtest/libqos/arm-virt-machine.c
diff --git a/tests/libqos/arm-xilinx-zynq-a9-machine.c b/tests/qtest/libqos/arm-xilinx-zynq-a9-machine.c
index 5bc95f2e73..5bc95f2e73 100644
--- a/tests/libqos/arm-xilinx-zynq-a9-machine.c
+++ b/tests/qtest/libqos/arm-xilinx-zynq-a9-machine.c
diff --git a/tests/libqos/e1000e.c b/tests/qtest/libqos/e1000e.c
index 560e7a2bb2..560e7a2bb2 100644
--- a/tests/libqos/e1000e.c
+++ b/tests/qtest/libqos/e1000e.c
diff --git a/tests/libqos/e1000e.h b/tests/qtest/libqos/e1000e.h
index dc4ab10f58..dc4ab10f58 100644
--- a/tests/libqos/e1000e.h
+++ b/tests/qtest/libqos/e1000e.h
diff --git a/tests/libqos/fw_cfg.c b/tests/qtest/libqos/fw_cfg.c
index 1f46258f96..1f46258f96 100644
--- a/tests/libqos/fw_cfg.c
+++ b/tests/qtest/libqos/fw_cfg.c
diff --git a/tests/libqos/fw_cfg.h b/tests/qtest/libqos/fw_cfg.h
index 13325cc4ff..13325cc4ff 100644
--- a/tests/libqos/fw_cfg.h
+++ b/tests/qtest/libqos/fw_cfg.h
diff --git a/tests/libqos/i2c-imx.c b/tests/qtest/libqos/i2c-imx.c
index f33ece55a3..f33ece55a3 100644
--- a/tests/libqos/i2c-imx.c
+++ b/tests/qtest/libqos/i2c-imx.c
diff --git a/tests/libqos/i2c-omap.c b/tests/qtest/libqos/i2c-omap.c
index 9ae8214fa8..9ae8214fa8 100644
--- a/tests/libqos/i2c-omap.c
+++ b/tests/qtest/libqos/i2c-omap.c
diff --git a/tests/libqos/i2c.c b/tests/qtest/libqos/i2c.c
index 156114e745..156114e745 100644
--- a/tests/libqos/i2c.c
+++ b/tests/qtest/libqos/i2c.c
diff --git a/tests/libqos/i2c.h b/tests/qtest/libqos/i2c.h
index 945b65b34c..945b65b34c 100644
--- a/tests/libqos/i2c.h
+++ b/tests/qtest/libqos/i2c.h
diff --git a/tests/libqos/libqos-pc.c b/tests/qtest/libqos/libqos-pc.c
index d04abc548b..d04abc548b 100644
--- a/tests/libqos/libqos-pc.c
+++ b/tests/qtest/libqos/libqos-pc.c
diff --git a/tests/libqos/libqos-pc.h b/tests/qtest/libqos/libqos-pc.h
index a0e4c45516..a0e4c45516 100644
--- a/tests/libqos/libqos-pc.h
+++ b/tests/qtest/libqos/libqos-pc.h
diff --git a/tests/libqos/libqos-spapr.c b/tests/qtest/libqos/libqos-spapr.c
index 8766d543ce..8766d543ce 100644
--- a/tests/libqos/libqos-spapr.c
+++ b/tests/qtest/libqos/libqos-spapr.c
diff --git a/tests/libqos/libqos-spapr.h b/tests/qtest/libqos/libqos-spapr.h
index dcb5c43ad3..dcb5c43ad3 100644
--- a/tests/libqos/libqos-spapr.h
+++ b/tests/qtest/libqos/libqos-spapr.h
diff --git a/tests/libqos/libqos.c b/tests/qtest/libqos/libqos.c
index f229eb2cb8..f229eb2cb8 100644
--- a/tests/libqos/libqos.c
+++ b/tests/qtest/libqos/libqos.c
diff --git a/tests/libqos/libqos.h b/tests/qtest/libqos/libqos.h
index 8e971c25a3..8e971c25a3 100644
--- a/tests/libqos/libqos.h
+++ b/tests/qtest/libqos/libqos.h
diff --git a/tests/libqos/malloc-pc.c b/tests/qtest/libqos/malloc-pc.c
index 6f92ce4135..6f92ce4135 100644
--- a/tests/libqos/malloc-pc.c
+++ b/tests/qtest/libqos/malloc-pc.c
diff --git a/tests/libqos/malloc-pc.h b/tests/qtest/libqos/malloc-pc.h
index 21e75ae004..21e75ae004 100644
--- a/tests/libqos/malloc-pc.h
+++ b/tests/qtest/libqos/malloc-pc.h
diff --git a/tests/libqos/malloc-spapr.c b/tests/qtest/libqos/malloc-spapr.c
index 2a6b7e3776..2a6b7e3776 100644
--- a/tests/libqos/malloc-spapr.c
+++ b/tests/qtest/libqos/malloc-spapr.c
diff --git a/tests/libqos/malloc-spapr.h b/tests/qtest/libqos/malloc-spapr.h
index e5fe9bfc4b..e5fe9bfc4b 100644
--- a/tests/libqos/malloc-spapr.h
+++ b/tests/qtest/libqos/malloc-spapr.h
diff --git a/tests/libqos/malloc.c b/tests/qtest/libqos/malloc.c
index 615422a5c4..615422a5c4 100644
--- a/tests/libqos/malloc.c
+++ b/tests/qtest/libqos/malloc.c
diff --git a/tests/libqos/malloc.h b/tests/qtest/libqos/malloc.h
index 4d1a2e2bef..4d1a2e2bef 100644
--- a/tests/libqos/malloc.h
+++ b/tests/qtest/libqos/malloc.h
diff --git a/tests/libqos/pci-pc.c b/tests/qtest/libqos/pci-pc.c
index 0bc591d1da..0bc591d1da 100644
--- a/tests/libqos/pci-pc.c
+++ b/tests/qtest/libqos/pci-pc.c
diff --git a/tests/libqos/pci-pc.h b/tests/qtest/libqos/pci-pc.h
index 4690005232..4690005232 100644
--- a/tests/libqos/pci-pc.h
+++ b/tests/qtest/libqos/pci-pc.h
diff --git a/tests/libqos/pci-spapr.c b/tests/qtest/libqos/pci-spapr.c
index d6f8c01cb7..d6f8c01cb7 100644
--- a/tests/libqos/pci-spapr.c
+++ b/tests/qtest/libqos/pci-spapr.c
diff --git a/tests/libqos/pci-spapr.h b/tests/qtest/libqos/pci-spapr.h
index d9e25631c6..d9e25631c6 100644
--- a/tests/libqos/pci-spapr.h
+++ b/tests/qtest/libqos/pci-spapr.h
diff --git a/tests/libqos/pci.c b/tests/qtest/libqos/pci.c
index 2309a724e4..2309a724e4 100644
--- a/tests/libqos/pci.c
+++ b/tests/qtest/libqos/pci.c
diff --git a/tests/libqos/pci.h b/tests/qtest/libqos/pci.h
index 590c175190..590c175190 100644
--- a/tests/libqos/pci.h
+++ b/tests/qtest/libqos/pci.h
diff --git a/tests/libqos/ppc64_pseries-machine.c b/tests/qtest/libqos/ppc64_pseries-machine.c
index 867f27a3c8..867f27a3c8 100644
--- a/tests/libqos/ppc64_pseries-machine.c
+++ b/tests/qtest/libqos/ppc64_pseries-machine.c
diff --git a/tests/libqos/qgraph.c b/tests/qtest/libqos/qgraph.c
index 7a7ae2a19e..7a7ae2a19e 100644
--- a/tests/libqos/qgraph.c
+++ b/tests/qtest/libqos/qgraph.c
diff --git a/tests/libqos/qgraph.h b/tests/qtest/libqos/qgraph.h
index 3a25dda4b2..3a25dda4b2 100644
--- a/tests/libqos/qgraph.h
+++ b/tests/qtest/libqos/qgraph.h
diff --git a/tests/libqos/qgraph_internal.h b/tests/qtest/libqos/qgraph_internal.h
index f4734c8681..f4734c8681 100644
--- a/tests/libqos/qgraph_internal.h
+++ b/tests/qtest/libqos/qgraph_internal.h
diff --git a/tests/libqos/rtas.c b/tests/qtest/libqos/rtas.c
index d81ff4274d..d81ff4274d 100644
--- a/tests/libqos/rtas.c
+++ b/tests/qtest/libqos/rtas.c
diff --git a/tests/libqos/rtas.h b/tests/qtest/libqos/rtas.h
index 459e23aaf4..459e23aaf4 100644
--- a/tests/libqos/rtas.h
+++ b/tests/qtest/libqos/rtas.h
diff --git a/tests/libqos/sdhci.c b/tests/qtest/libqos/sdhci.c
index 309794bc52..309794bc52 100644
--- a/tests/libqos/sdhci.c
+++ b/tests/qtest/libqos/sdhci.c
diff --git a/tests/libqos/sdhci.h b/tests/qtest/libqos/sdhci.h
index a88b45ae9d..a88b45ae9d 100644
--- a/tests/libqos/sdhci.h
+++ b/tests/qtest/libqos/sdhci.h
diff --git a/tests/libqos/tpci200.c b/tests/qtest/libqos/tpci200.c
index ae590a456e..ae590a456e 100644
--- a/tests/libqos/tpci200.c
+++ b/tests/qtest/libqos/tpci200.c
diff --git a/tests/libqos/usb.c b/tests/qtest/libqos/usb.c
index d7a9cb3c72..d7a9cb3c72 100644
--- a/tests/libqos/usb.c
+++ b/tests/qtest/libqos/usb.c
diff --git a/tests/libqos/usb.h b/tests/qtest/libqos/usb.h
index eeced39a2f..eeced39a2f 100644
--- a/tests/libqos/usb.h
+++ b/tests/qtest/libqos/usb.h
diff --git a/tests/libqos/virtio-9p.c b/tests/qtest/libqos/virtio-9p.c
index 77dbfb62ad..77dbfb62ad 100644
--- a/tests/libqos/virtio-9p.c
+++ b/tests/qtest/libqos/virtio-9p.c
diff --git a/tests/libqos/virtio-9p.h b/tests/qtest/libqos/virtio-9p.h
index b54e89b3a1..b54e89b3a1 100644
--- a/tests/libqos/virtio-9p.h
+++ b/tests/qtest/libqos/virtio-9p.h
diff --git a/tests/libqos/virtio-balloon.c b/tests/qtest/libqos/virtio-balloon.c
index 42a4c5831e..42a4c5831e 100644
--- a/tests/libqos/virtio-balloon.c
+++ b/tests/qtest/libqos/virtio-balloon.c
diff --git a/tests/libqos/virtio-balloon.h b/tests/qtest/libqos/virtio-balloon.h
index 52661cc87d..52661cc87d 100644
--- a/tests/libqos/virtio-balloon.h
+++ b/tests/qtest/libqos/virtio-balloon.h
diff --git a/tests/libqos/virtio-blk.c b/tests/qtest/libqos/virtio-blk.c
index 726e93c5c1..726e93c5c1 100644
--- a/tests/libqos/virtio-blk.c
+++ b/tests/qtest/libqos/virtio-blk.c
diff --git a/tests/libqos/virtio-blk.h b/tests/qtest/libqos/virtio-blk.h
index c05adc659d..c05adc659d 100644
--- a/tests/libqos/virtio-blk.h
+++ b/tests/qtest/libqos/virtio-blk.h
diff --git a/tests/libqos/virtio-mmio.c b/tests/qtest/libqos/virtio-mmio.c
index e0a2bd7bc6..e0a2bd7bc6 100644
--- a/tests/libqos/virtio-mmio.c
+++ b/tests/qtest/libqos/virtio-mmio.c
diff --git a/tests/libqos/virtio-mmio.h b/tests/qtest/libqos/virtio-mmio.h
index 0e45778b07..0e45778b07 100644
--- a/tests/libqos/virtio-mmio.h
+++ b/tests/qtest/libqos/virtio-mmio.h
diff --git a/tests/libqos/virtio-net.c b/tests/qtest/libqos/virtio-net.c
index 710d440c3d..710d440c3d 100644
--- a/tests/libqos/virtio-net.c
+++ b/tests/qtest/libqos/virtio-net.c
diff --git a/tests/libqos/virtio-net.h b/tests/qtest/libqos/virtio-net.h
index 855c67d00f..855c67d00f 100644
--- a/tests/libqos/virtio-net.h
+++ b/tests/qtest/libqos/virtio-net.h
diff --git a/tests/libqos/virtio-pci-modern.c b/tests/qtest/libqos/virtio-pci-modern.c
index 18d118866f..18d118866f 100644
--- a/tests/libqos/virtio-pci-modern.c
+++ b/tests/qtest/libqos/virtio-pci-modern.c
diff --git a/tests/libqos/virtio-pci-modern.h b/tests/qtest/libqos/virtio-pci-modern.h
index 6bf2b207c3..6bf2b207c3 100644
--- a/tests/libqos/virtio-pci-modern.h
+++ b/tests/qtest/libqos/virtio-pci-modern.h
diff --git a/tests/libqos/virtio-pci.c b/tests/qtest/libqos/virtio-pci.c
index 62851c29bb..62851c29bb 100644
--- a/tests/libqos/virtio-pci.c
+++ b/tests/qtest/libqos/virtio-pci.c
diff --git a/tests/libqos/virtio-pci.h b/tests/qtest/libqos/virtio-pci.h
index 294d5567ee..294d5567ee 100644
--- a/tests/libqos/virtio-pci.h
+++ b/tests/qtest/libqos/virtio-pci.h
diff --git a/tests/libqos/virtio-rng.c b/tests/qtest/libqos/virtio-rng.c
index b86349e2fd..b86349e2fd 100644
--- a/tests/libqos/virtio-rng.c
+++ b/tests/qtest/libqos/virtio-rng.c
diff --git a/tests/libqos/virtio-rng.h b/tests/qtest/libqos/virtio-rng.h
index 9e192f11f7..9e192f11f7 100644
--- a/tests/libqos/virtio-rng.h
+++ b/tests/qtest/libqos/virtio-rng.h
diff --git a/tests/libqos/virtio-scsi.c b/tests/qtest/libqos/virtio-scsi.c
index de739bec5f..de739bec5f 100644
--- a/tests/libqos/virtio-scsi.c
+++ b/tests/qtest/libqos/virtio-scsi.c
diff --git a/tests/libqos/virtio-scsi.h b/tests/qtest/libqos/virtio-scsi.h
index 4ca19a6a7a..4ca19a6a7a 100644
--- a/tests/libqos/virtio-scsi.h
+++ b/tests/qtest/libqos/virtio-scsi.h
diff --git a/tests/libqos/virtio-serial.c b/tests/qtest/libqos/virtio-serial.c
index 3e5b8b82c7..3e5b8b82c7 100644
--- a/tests/libqos/virtio-serial.c
+++ b/tests/qtest/libqos/virtio-serial.c
diff --git a/tests/libqos/virtio-serial.h b/tests/qtest/libqos/virtio-serial.h
index 080fa8428d..080fa8428d 100644
--- a/tests/libqos/virtio-serial.h
+++ b/tests/qtest/libqos/virtio-serial.h
diff --git a/tests/libqos/virtio.c b/tests/qtest/libqos/virtio.c
index 9aa360620c..9aa360620c 100644
--- a/tests/libqos/virtio.c
+++ b/tests/qtest/libqos/virtio.c
diff --git a/tests/libqos/virtio.h b/tests/qtest/libqos/virtio.h
index 529ef7555a..529ef7555a 100644
--- a/tests/libqos/virtio.h
+++ b/tests/qtest/libqos/virtio.h
diff --git a/tests/libqos/x86_64_pc-machine.c b/tests/qtest/libqos/x86_64_pc-machine.c
index 6dfa705217..6dfa705217 100644
--- a/tests/libqos/x86_64_pc-machine.c
+++ b/tests/qtest/libqos/x86_64_pc-machine.c
diff --git a/tests/libqtest-single.h b/tests/qtest/libqtest-single.h
index 6f1bb1331c..6f1bb1331c 100644
--- a/tests/libqtest-single.h
+++ b/tests/qtest/libqtest-single.h
diff --git a/tests/libqtest.c b/tests/qtest/libqtest.c
index 76c9f8eade..76c9f8eade 100644
--- a/tests/libqtest.c
+++ b/tests/qtest/libqtest.c
diff --git a/tests/libqtest.h b/tests/qtest/libqtest.h
index c9e21e05b3..c9e21e05b3 100644
--- a/tests/libqtest.h
+++ b/tests/qtest/libqtest.h
diff --git a/tests/m25p80-test.c b/tests/qtest/m25p80-test.c
index 50c6b79fb3..50c6b79fb3 100644
--- a/tests/m25p80-test.c
+++ b/tests/qtest/m25p80-test.c
diff --git a/tests/m48t59-test.c b/tests/qtest/m48t59-test.c
index b94a1230f7..b94a1230f7 100644
--- a/tests/m48t59-test.c
+++ b/tests/qtest/m48t59-test.c
diff --git a/tests/machine-none-test.c b/tests/qtest/machine-none-test.c
index 5953d31755..5953d31755 100644
--- a/tests/machine-none-test.c
+++ b/tests/qtest/machine-none-test.c
diff --git a/tests/megasas-test.c b/tests/qtest/megasas-test.c
index d6796b9bd7..d6796b9bd7 100644
--- a/tests/megasas-test.c
+++ b/tests/qtest/megasas-test.c
diff --git a/tests/microbit-test.c b/tests/qtest/microbit-test.c
index 04e199ec33..04e199ec33 100644
--- a/tests/microbit-test.c
+++ b/tests/qtest/microbit-test.c
diff --git a/tests/migration-helpers.c b/tests/qtest/migration-helpers.c
index 516093b39a..516093b39a 100644
--- a/tests/migration-helpers.c
+++ b/tests/qtest/migration-helpers.c
diff --git a/tests/migration-helpers.h b/tests/qtest/migration-helpers.h
index a11808b3b7..a11808b3b7 100644
--- a/tests/migration-helpers.h
+++ b/tests/qtest/migration-helpers.h
diff --git a/tests/migration-test.c b/tests/qtest/migration-test.c
index 53afec4395..53afec4395 100644
--- a/tests/migration-test.c
+++ b/tests/qtest/migration-test.c
diff --git a/tests/modules-test.c b/tests/qtest/modules-test.c
index 88217686e1..88217686e1 100644
--- a/tests/modules-test.c
+++ b/tests/qtest/modules-test.c
diff --git a/tests/ne2000-test.c b/tests/qtest/ne2000-test.c
index 3fc0e555d5..3fc0e555d5 100644
--- a/tests/ne2000-test.c
+++ b/tests/qtest/ne2000-test.c
diff --git a/tests/numa-test.c b/tests/qtest/numa-test.c
index 17dd807d2a..17dd807d2a 100644
--- a/tests/numa-test.c
+++ b/tests/qtest/numa-test.c
diff --git a/tests/nvme-test.c b/tests/qtest/nvme-test.c
index ff0442150c..ff0442150c 100644
--- a/tests/nvme-test.c
+++ b/tests/qtest/nvme-test.c
diff --git a/tests/pca9552-test.c b/tests/qtest/pca9552-test.c
index 4b800d3c3e..4b800d3c3e 100644
--- a/tests/pca9552-test.c
+++ b/tests/qtest/pca9552-test.c
diff --git a/tests/pci-test.c b/tests/qtest/pci-test.c
index 4b2092b949..4b2092b949 100644
--- a/tests/pci-test.c
+++ b/tests/qtest/pci-test.c
diff --git a/tests/pcnet-test.c b/tests/qtest/pcnet-test.c
index 900944fa7e..900944fa7e 100644
--- a/tests/pcnet-test.c
+++ b/tests/qtest/pcnet-test.c
diff --git a/tests/pflash-cfi02-test.c b/tests/qtest/pflash-cfi02-test.c
index 17aa669b2e..17aa669b2e 100644
--- a/tests/pflash-cfi02-test.c
+++ b/tests/qtest/pflash-cfi02-test.c
diff --git a/tests/pnv-xscom-test.c b/tests/qtest/pnv-xscom-test.c
index 2c46d5cf6d..2c46d5cf6d 100644
--- a/tests/pnv-xscom-test.c
+++ b/tests/qtest/pnv-xscom-test.c
diff --git a/tests/prom-env-test.c b/tests/qtest/prom-env-test.c
index 9be52c766f..9be52c766f 100644
--- a/tests/prom-env-test.c
+++ b/tests/qtest/prom-env-test.c
diff --git a/tests/pvpanic-test.c b/tests/qtest/pvpanic-test.c
index ff9176adf3..ff9176adf3 100644
--- a/tests/pvpanic-test.c
+++ b/tests/qtest/pvpanic-test.c
diff --git a/tests/pxe-test.c b/tests/qtest/pxe-test.c
index f68d0aadbb..f68d0aadbb 100644
--- a/tests/pxe-test.c
+++ b/tests/qtest/pxe-test.c
diff --git a/tests/q35-test.c b/tests/qtest/q35-test.c
index a68183d513..a68183d513 100644
--- a/tests/q35-test.c
+++ b/tests/qtest/q35-test.c
diff --git a/tests/qmp-cmd-test.c b/tests/qtest/qmp-cmd-test.c
index 9f5228cd99..9f5228cd99 100644
--- a/tests/qmp-cmd-test.c
+++ b/tests/qtest/qmp-cmd-test.c
diff --git a/tests/qmp-test.c b/tests/qtest/qmp-test.c
index 1b0eb69832..1b0eb69832 100644
--- a/tests/qmp-test.c
+++ b/tests/qtest/qmp-test.c
diff --git a/tests/qom-test.c b/tests/qtest/qom-test.c
index 4f94cc678c..4f94cc678c 100644
--- a/tests/qom-test.c
+++ b/tests/qtest/qom-test.c
diff --git a/tests/qos-test.c b/tests/qtest/qos-test.c
index fd70d73ea5..fd70d73ea5 100644
--- a/tests/qos-test.c
+++ b/tests/qtest/qos-test.c
diff --git a/tests/rtas-test.c b/tests/qtest/rtas-test.c
index 167b42db38..167b42db38 100644
--- a/tests/rtas-test.c
+++ b/tests/qtest/rtas-test.c
diff --git a/tests/rtc-test.c b/tests/qtest/rtc-test.c
index c7af34f6b1..c7af34f6b1 100644
--- a/tests/rtc-test.c
+++ b/tests/qtest/rtc-test.c
diff --git a/tests/rtl8139-test.c b/tests/qtest/rtl8139-test.c
index 4506049264..4506049264 100644
--- a/tests/rtl8139-test.c
+++ b/tests/qtest/rtl8139-test.c
diff --git a/tests/sdhci-test.c b/tests/qtest/sdhci-test.c
index 6275e7626c..6275e7626c 100644
--- a/tests/sdhci-test.c
+++ b/tests/qtest/sdhci-test.c
diff --git a/tests/spapr-phb-test.c b/tests/qtest/spapr-phb-test.c
index 093dc22f2f..093dc22f2f 100644
--- a/tests/spapr-phb-test.c
+++ b/tests/qtest/spapr-phb-test.c
diff --git a/tests/tco-test.c b/tests/qtest/tco-test.c
index 254f735370..254f735370 100644
--- a/tests/tco-test.c
+++ b/tests/qtest/tco-test.c
diff --git a/tests/test-arm-mptimer.c b/tests/qtest/test-arm-mptimer.c
index 7a56d56da9..7a56d56da9 100644
--- a/tests/test-arm-mptimer.c
+++ b/tests/qtest/test-arm-mptimer.c
diff --git a/tests/test-filter-mirror.c b/tests/qtest/test-filter-mirror.c
index 1e3ced84a9..1e3ced84a9 100644
--- a/tests/test-filter-mirror.c
+++ b/tests/qtest/test-filter-mirror.c
diff --git a/tests/test-filter-redirector.c b/tests/qtest/test-filter-redirector.c
index e4d53220fd..e4d53220fd 100644
--- a/tests/test-filter-redirector.c
+++ b/tests/qtest/test-filter-redirector.c
diff --git a/tests/test-hmp.c b/tests/qtest/test-hmp.c
index 5029c4d2c9..5029c4d2c9 100644
--- a/tests/test-hmp.c
+++ b/tests/qtest/test-hmp.c
diff --git a/tests/test-netfilter.c b/tests/qtest/test-netfilter.c
index 22927ee6ab..22927ee6ab 100644
--- a/tests/test-netfilter.c
+++ b/tests/qtest/test-netfilter.c
diff --git a/tests/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
index 772287bdb4..772287bdb4 100644
--- a/tests/test-x86-cpuid-compat.c
+++ b/tests/qtest/test-x86-cpuid-compat.c
diff --git a/tests/tmp105-test.c b/tests/qtest/tmp105-test.c
index f930a96b83..f930a96b83 100644
--- a/tests/tmp105-test.c
+++ b/tests/qtest/tmp105-test.c
diff --git a/tests/tpm-crb-swtpm-test.c b/tests/qtest/tpm-crb-swtpm-test.c
index 2c4fb8ae29..2c4fb8ae29 100644
--- a/tests/tpm-crb-swtpm-test.c
+++ b/tests/qtest/tpm-crb-swtpm-test.c
diff --git a/tests/tpm-crb-test.c b/tests/qtest/tpm-crb-test.c
index 632fb7fbd8..632fb7fbd8 100644
--- a/tests/tpm-crb-test.c
+++ b/tests/qtest/tpm-crb-test.c
diff --git a/tests/tpm-emu.c b/tests/qtest/tpm-emu.c
index c43ac4aef8..c43ac4aef8 100644
--- a/tests/tpm-emu.c
+++ b/tests/qtest/tpm-emu.c
diff --git a/tests/tpm-emu.h b/tests/qtest/tpm-emu.h
index a4f1d64226..a4f1d64226 100644
--- a/tests/tpm-emu.h
+++ b/tests/qtest/tpm-emu.h
diff --git a/tests/tpm-tests.c b/tests/qtest/tpm-tests.c
index 6e45a0ba85..6e45a0ba85 100644
--- a/tests/tpm-tests.c
+++ b/tests/qtest/tpm-tests.c
diff --git a/tests/tpm-tests.h b/tests/qtest/tpm-tests.h
index b97688fe75..b97688fe75 100644
--- a/tests/tpm-tests.h
+++ b/tests/qtest/tpm-tests.h
diff --git a/tests/tpm-tis-swtpm-test.c b/tests/qtest/tpm-tis-swtpm-test.c
index 9f58a3a92b..9f58a3a92b 100644
--- a/tests/tpm-tis-swtpm-test.c
+++ b/tests/qtest/tpm-tis-swtpm-test.c
diff --git a/tests/tpm-tis-test.c b/tests/qtest/tpm-tis-test.c
index dcf30e05b7..dcf30e05b7 100644
--- a/tests/tpm-tis-test.c
+++ b/tests/qtest/tpm-tis-test.c
diff --git a/tests/tpm-util.c b/tests/qtest/tpm-util.c
index e08b137651..e08b137651 100644
--- a/tests/tpm-util.c
+++ b/tests/qtest/tpm-util.c
diff --git a/tests/tpm-util.h b/tests/qtest/tpm-util.h
index 5755698ad2..5755698ad2 100644
--- a/tests/tpm-util.h
+++ b/tests/qtest/tpm-util.h
diff --git a/tests/usb-hcd-ehci-test.c b/tests/qtest/usb-hcd-ehci-test.c
index 5251d539e9..5251d539e9 100644
--- a/tests/usb-hcd-ehci-test.c
+++ b/tests/qtest/usb-hcd-ehci-test.c
diff --git a/tests/usb-hcd-ohci-test.c b/tests/qtest/usb-hcd-ohci-test.c
index 19d760f3fb..19d760f3fb 100644
--- a/tests/usb-hcd-ohci-test.c
+++ b/tests/qtest/usb-hcd-ohci-test.c
diff --git a/tests/usb-hcd-uhci-test.c b/tests/qtest/usb-hcd-uhci-test.c
index 7a117b64d9..7a117b64d9 100644
--- a/tests/usb-hcd-uhci-test.c
+++ b/tests/qtest/usb-hcd-uhci-test.c
diff --git a/tests/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
index 10ef9d2a91..10ef9d2a91 100644
--- a/tests/usb-hcd-xhci-test.c
+++ b/tests/qtest/usb-hcd-xhci-test.c
diff --git a/tests/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index 91ea373ba5..2324b964ad 100644
--- a/tests/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -499,7 +499,7 @@ static TestServer *test_server_new(const gchar *name)
     return server;
 }
 
-static void chr_event(void *opaque, int event)
+static void chr_event(void *opaque, QEMUChrEvent event)
 {
     TestServer *s = opaque;
 
diff --git a/tests/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c
index e7b58e3a0c..e7b58e3a0c 100644
--- a/tests/virtio-9p-test.c
+++ b/tests/qtest/virtio-9p-test.c
diff --git a/tests/virtio-blk-test.c b/tests/qtest/virtio-blk-test.c
index 2a23698211..2a23698211 100644
--- a/tests/virtio-blk-test.c
+++ b/tests/qtest/virtio-blk-test.c
diff --git a/tests/virtio-ccw-test.c b/tests/qtest/virtio-ccw-test.c
index d05236407b..d05236407b 100644
--- a/tests/virtio-ccw-test.c
+++ b/tests/qtest/virtio-ccw-test.c
diff --git a/tests/virtio-net-test.c b/tests/qtest/virtio-net-test.c
index a08e2ffe12..a08e2ffe12 100644
--- a/tests/virtio-net-test.c
+++ b/tests/qtest/virtio-net-test.c
diff --git a/tests/virtio-rng-test.c b/tests/qtest/virtio-rng-test.c
index 092ba13068..092ba13068 100644
--- a/tests/virtio-rng-test.c
+++ b/tests/qtest/virtio-rng-test.c
diff --git a/tests/virtio-scsi-test.c b/tests/qtest/virtio-scsi-test.c
index 0415e75876..0415e75876 100644
--- a/tests/virtio-scsi-test.c
+++ b/tests/qtest/virtio-scsi-test.c
diff --git a/tests/virtio-serial-test.c b/tests/qtest/virtio-serial-test.c
index 2541034822..2541034822 100644
--- a/tests/virtio-serial-test.c
+++ b/tests/qtest/virtio-serial-test.c
diff --git a/tests/virtio-test.c b/tests/qtest/virtio-test.c
index f7c6afdcf1..f7c6afdcf1 100644
--- a/tests/virtio-test.c
+++ b/tests/qtest/virtio-test.c
diff --git a/tests/vmgenid-test.c b/tests/qtest/vmgenid-test.c
index efba76e716..efba76e716 100644
--- a/tests/vmgenid-test.c
+++ b/tests/qtest/vmgenid-test.c
diff --git a/tests/vmxnet3-test.c b/tests/qtest/vmxnet3-test.c
index a81025252c..a81025252c 100644
--- a/tests/vmxnet3-test.c
+++ b/tests/qtest/vmxnet3-test.c
diff --git a/tests/wdt_ib700-test.c b/tests/qtest/wdt_ib700-test.c
index 797288d939..797288d939 100644
--- a/tests/wdt_ib700-test.c
+++ b/tests/qtest/wdt_ib700-test.c
diff --git a/tests/test-char.c b/tests/test-char.c
index 45e42af290..3afc9b1b8d 100644
--- a/tests/test-char.c
+++ b/tests/test-char.c
@@ -54,7 +54,7 @@ static void fe_read(void *opaque, const uint8_t *buf, int size)
     quit = true;
 }
 
-static void fe_event(void *opaque, int event)
+static void fe_event(void *opaque, QEMUChrEvent event)
 {
     FeHandler *h = opaque;
     bool new_open_state;
@@ -633,7 +633,7 @@ typedef struct {
 
 
 static void
-char_socket_event(void *opaque, int event)
+char_socket_event(void *opaque, QEMUChrEvent event)
 {
     CharSocketTestData *data = opaque;
     data->event = event;
@@ -1006,7 +1006,7 @@ static void char_socket_client_test(gconstpointer opaque)
 }
 
 static void
-count_closed_event(void *opaque, int event)
+count_closed_event(void *opaque, QEMUChrEvent event)
 {
     int *count = opaque;
     if (event == CHR_EVENT_CLOSED) {
diff --git a/ui/console.c b/ui/console.c
index ac79d679f5..69339b028b 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -2333,6 +2333,21 @@ void qemu_display_init(DisplayState *ds, DisplayOptions *opts)
     dpys[opts->type]->init(ds, opts);
 }
 
+void qemu_display_help(void)
+{
+    int idx;
+
+    printf("Available display backend types:\n");
+    for (idx = DISPLAY_TYPE_NONE; idx < DISPLAY_TYPE__MAX; idx++) {
+        if (!dpys[idx]) {
+            ui_module_load_one(DisplayType_str(idx));
+        }
+        if (dpys[idx]) {
+            printf("%s\n",  DisplayType_str(dpys[idx]->type));
+        }
+    }
+}
+
 void qemu_chr_parse_vc(QemuOpts *opts, ChardevBackend *backend, Error **errp)
 {
     int val;
diff --git a/ui/gtk.c b/ui/gtk.c
index 692ccc7bbb..7355d34fcf 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1966,6 +1966,11 @@ static GSList *gd_vc_gfx_init(GtkDisplayState *s, VirtualConsole *vc,
                               GSList *group, GtkWidget *view_menu)
 {
     bool zoom_to_fit = false;
+    int refresh_rate_millihz;
+
+    GdkDisplay *dpy = gtk_widget_get_display(s->window);
+    GdkWindow *win = gtk_widget_get_window(s->window);
+    GdkMonitor *monitor = gdk_display_get_monitor_at_window(dpy, win);
 
     vc->label = qemu_console_get_label(con);
     vc->s = s;
@@ -2026,6 +2031,12 @@ static GSList *gd_vc_gfx_init(GtkDisplayState *s, VirtualConsole *vc,
 
     vc->gfx.kbd = qkbd_state_init(con);
     vc->gfx.dcl.con = con;
+
+    refresh_rate_millihz = gdk_monitor_get_refresh_rate(monitor);
+    if (refresh_rate_millihz) {
+        vc->gfx.dcl.update_interval = MILLISEC_PER_SEC / refresh_rate_millihz;
+    }
+
     register_displaychangelistener(&vc->gfx.dcl);
 
     gd_connect_vc_gfx_signals(vc);
diff --git a/util/guest-random.c b/util/guest-random.c
index 9453968bd7..086115bd67 100644
--- a/util/guest-random.c
+++ b/util/guest-random.c
@@ -14,6 +14,7 @@
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
 #include "crypto/random.h"
+#include "sysemu/replay.h"
 
 
 static __thread GRand *thread_rand;
@@ -44,13 +45,21 @@ static int glib_random_bytes(void *buf, size_t len)
 
 int qemu_guest_getrandom(void *buf, size_t len, Error **errp)
 {
+    int ret;
+    if (replay_mode == REPLAY_MODE_PLAY) {
+        return replay_read_random(buf, len);
+    }
     if (unlikely(deterministic)) {
         /* Deterministic implementation using Glib's Mersenne Twister.  */
-        return glib_random_bytes(buf, len);
+        ret = glib_random_bytes(buf, len);
     } else {
         /* Non-deterministic implementation using crypto routines.  */
-        return qcrypto_random_bytes(buf, len, errp);
+        ret = qcrypto_random_bytes(buf, len, errp);
+    }
+    if (replay_mode == REPLAY_MODE_RECORD) {
+        replay_save_random(ret, buf, len);
     }
+    return ret;
 }
 
 void qemu_guest_getrandom_nofail(void *buf, size_t len)
diff --git a/util/module.c b/util/module.c
index e9fe3e5422..8c5315a7a3 100644
--- a/util/module.c
+++ b/util/module.c
@@ -214,6 +214,7 @@ bool module_load_one(const char *prefix, const char *lib_name)
 
     if (!success) {
         g_hash_table_remove(loaded_modules, module_name);
+        g_free(module_name);
     }
 
     for (i = 0; i < n_dirs; i++) {
diff --git a/vl.c b/vl.c
index b211921258..751401214c 100644
--- a/vl.c
+++ b/vl.c
@@ -1869,6 +1869,11 @@ static void parse_display(const char *p)
 {
     const char *opts;
 
+    if (is_help_option(p)) {
+        qemu_display_help();
+        exit(0);
+    }
+
     if (strstart(p, "sdl", &opts)) {
         /*
          * sdl DisplayType needs hand-crafted parser instead of
@@ -2788,6 +2793,7 @@ static void configure_accelerators(const char *progname)
                 error_report("invalid accelerator %s", *tmp);
             }
         }
+        g_strfreev(accel_list);
     } else {
         if (accel != NULL) {
             error_report("The -accel and \"-machine accel=\" options are incompatible");