chardev: Convert IO handlers to use unsigned type

index bf0b7ee0f5..8c78b9804b 100644
@@ -85,10 +85,6 @@ typedef struct IPMIBmcExtern {
     bool send_reset;
 } IPMIBmcExtern;
 
-static int can_receive(void *opaque);
-static void receive(void *opaque, const uint8_t *buf, int size);
-static void chr_event(void *opaque, int event);
-
 static unsigned char
 ipmb_checksum(const unsigned char *data, int size, unsigned char start)
 {

index 2f76216276..e389069f0b 100644
@@ -161,7 +161,6 @@ typedef struct XtensaSimConsole {
 
 static XtensaSimConsole *sim_console;
 
-static IOCanReadHandler sim_console_can_read;
 static int sim_console_can_read(void *opaque)
 {
     XtensaSimConsole *p = opaque;

@@ -169,7 +168,6 @@ static int sim_console_can_read(void *opaque)
     return sizeof(p->input.buffer) - p->input.offset;
 }
 
-static IOReadHandler sim_console_read;
 static void sim_console_read(void *opaque, const uint8_t *buf, int size)
 {
     XtensaSimConsole *p = opaque;

index 2c9b2ce567..2421d8e216 100644
@@ -69,13 +69,13 @@ static gboolean fd_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
     return TRUE;
 }
 
-static int fd_chr_read_poll(void *opaque)
+static gboolean fd_chr_read_poll(void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     FDChardev *s = FD_CHARDEV(opaque);
 
     s->max_size = qemu_chr_be_can_write(chr);
-    return s->max_size;
+    return s->max_size > 0;
 }
 
 static GSource *fd_chr_add_watch(Chardev *chr, GIOCondition cond)

index 8ced184160..a264d4e7fd 100644
@@ -30,7 +30,7 @@ typedef struct IOWatchPoll {
     QIOChannel *ioc;
     GSource *src;
 
-    IOCanReadHandler *fd_can_read;
+    GSourceFunc fd_can_read;
     GSourceFunc fd_read;
     void *opaque;
 } IOWatchPoll;

@@ -76,7 +76,7 @@ static GSourceFuncs io_watch_poll_funcs = {
 
 GSource *io_add_watch_poll(Chardev *chr,
                         QIOChannel *ioc,
-                        IOCanReadHandler *fd_can_read,
+                        GSourceFunc fd_can_read,
                         QIOChannelFunc fd_read,
                         gpointer user_data,
                         GMainContext *context)

index e8d9a53476..626ca30cb3 100644
@@ -148,13 +148,13 @@ static GSource *pty_chr_add_watch(Chardev *chr, GIOCondition cond)
     return qio_channel_create_watch(s->ioc, cond);
 }
 
-static int pty_chr_read_poll(void *opaque)
+static gboolean pty_chr_read_poll(void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     PtyChardev *s = PTY_CHARDEV(opaque);
 
     s->read_bytes = qemu_chr_be_can_write(chr);
-    return s->read_bytes;
+    return s->read_bytes > 0;
 }
 
 static gboolean pty_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)

index a75b46d9fe..76cc3c48b0 100644
@@ -120,7 +120,7 @@ static void tcp_chr_accept(QIONetListener *listener,
                            QIOChannelSocket *cioc,
                            void *opaque);
 
-static int tcp_chr_read_poll(void *opaque);
+static gboolean tcp_chr_read_poll(void *opaque);
 static void tcp_chr_disconnect(Chardev *chr);
 
 /* Called with chr_write_lock held.  */

@@ -157,7 +157,7 @@ static int tcp_chr_write(Chardev *chr, const uint8_t *buf, int len)
     }
 }
 
-static int tcp_chr_read_poll(void *opaque)
+static gboolean tcp_chr_read_poll(void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     SocketChardev *s = SOCKET_CHARDEV(opaque);

@@ -165,7 +165,7 @@ static int tcp_chr_read_poll(void *opaque)
         return 0;
     }
     s->max_size = qemu_chr_be_can_write(chr);
-    return s->max_size;
+    return s->max_size > 0;
 }
 
 static void tcp_chr_process_IAC_bytes(Chardev *chr,

index 097a2f0f42..b6e399e983 100644
@@ -65,7 +65,7 @@ static void udp_chr_flush_buffer(UdpChardev *s)
     }
 }
 
-static int udp_chr_read_poll(void *opaque)
+static gboolean udp_chr_read_poll(void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     UdpChardev *s = UDP_CHARDEV(opaque);

@@ -77,7 +77,7 @@ static int udp_chr_read_poll(void *opaque)
      */
     udp_chr_flush_buffer(s);
 
-    return s->max_size;
+    return s->max_size > 0;
 }
 
 static gboolean udp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)

index 9638da5100..a173874538 100644
@@ -31,7 +31,7 @@
 /* Can only be used for read */
 GSource *io_add_watch_poll(Chardev *chr,
                         QIOChannel *ioc,
-                        IOCanReadHandler *fd_can_read,
+                        GSourceFunc fd_can_read,
                         QIOChannelFunc fd_read,
                         gpointer user_data,
                         GMainContext *context);

index e115166995..952f9c9bcc 100644
@@ -159,12 +159,15 @@ int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
 int qemu_chr_be_can_write(Chardev *s)
 {
     CharBackend *be = s->be;
+    int res;
 
     if (!be || !be->chr_can_read) {
         return 0;
     }
 
-    return be->chr_can_read(be->opaque);
+    res = be->chr_can_read(be->opaque);
+    assert(res >= 0);
+    return res;
 }
 
 void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len)

index 76cc3c48b0..7e627b243e 100644
@@ -494,7 +494,7 @@ static gboolean tcp_chr_hup(QIOChannel *channel,
     return G_SOURCE_REMOVE;
 }
 
-static int tcp_chr_sync_read(Chardev *chr, const uint8_t *buf, int len)
+static size_t tcp_chr_sync_read(Chardev *chr, const uint8_t *buf, size_t len)
 {
     SocketChardev *s = SOCKET_CHARDEV(chr);
     int size;

index 7becd8c80c..ef4509bfa3 100644
@@ -251,7 +251,7 @@ typedef struct ChardevClass {
                  bool *be_opened, Error **errp);
 
     int (*chr_write)(Chardev *s, const uint8_t *buf, int len);
-    int (*chr_sync_read)(Chardev *s, const uint8_t *buf, int len);
+    size_t (*chr_sync_read)(Chardev *s, const uint8_t *buf, size_t len);
     GSource *(*chr_add_watch)(Chardev *s, GIOCondition cond);
     void (*chr_update_read_handler)(Chardev *s);
     int (*chr_ioctl)(Chardev *s, int cmd, void *arg);

index 78b0c87625..5367d82f53 100644
@@ -479,7 +479,7 @@ static int baum_eat_packet(BaumChardev *baum, const uint8_t *buf, int len)
 }
 
 /* The other end is writing some data.  Store it and try to interpret */
-static int baum_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t baum_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     BaumChardev *baum = BAUM_CHARDEV(chr);
     int tocopy, cur, eaten, orig_len = len;

index 2421d8e216..bb426fa4b1 100644
@@ -32,7 +32,7 @@
 #include "chardev/char-io.h"
 
 /* Called with chr_write_lock held.  */
-static int fd_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t fd_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     FDChardev *s = FD_CHARDEV(chr);
 

index 6055e76293..3ca732d3a8 100644
@@ -33,7 +33,7 @@
 /* MUX driver for serial I/O splitting */
 
 /* Called with chr_write_lock held.  */
-static int mux_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t mux_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     MuxChardev *d = MUX_CHARDEV(chr);
     int ret;

index 626ca30cb3..a2b78b44d8 100644
@@ -125,7 +125,7 @@ static void pty_chr_update_read_handler(Chardev *chr)
 }
 
 /* Called with chr_write_lock held.  */
-static int char_pty_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t char_pty_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     PtyChardev *s = PTY_CHARDEV(chr);
 

index 87832e2792..b805a585e3 100644
@@ -49,12 +49,12 @@ static size_t ringbuf_count(const Chardev *chr)
     return d->prod - d->cons;
 }
 
-static int ringbuf_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t ringbuf_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     RingBufChardev *d = RINGBUF_CHARDEV(chr);
     int i;
 
-    if (!buf || (len < 0)) {
+    if (!buf) {
         return -1;
     }
 

index 7e627b243e..7c7fb06d48 100644
@@ -124,7 +124,7 @@ static gboolean tcp_chr_read_poll(void *opaque);
 static void tcp_chr_disconnect(Chardev *chr);
 
 /* Called with chr_write_lock held.  */
-static int tcp_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t tcp_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     SocketChardev *s = SOCKET_CHARDEV(chr);
 

index b6e399e983..577d049d78 100644
@@ -45,7 +45,7 @@ typedef struct {
 #define UDP_CHARDEV(obj) OBJECT_CHECK(UdpChardev, (obj), TYPE_CHARDEV_UDP)
 
 /* Called with chr_write_lock held.  */
-static int udp_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t udp_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     UdpChardev *s = UDP_CHARDEV(chr);
 

index 952f9c9bcc..608c2569f4 100644
@@ -245,7 +245,7 @@ static void char_init(Object *obj)
     qemu_mutex_init(&chr->chr_write_lock);
 }
 
-static int null_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t null_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     return len;
 }

index 0ffd137ce8..0aad738cae 100644
@@ -133,7 +133,7 @@ static void msmouse_input_sync(DeviceState *dev)
     msmouse_chr_accept_input(chr);
 }
 
-static int msmouse_chr_write(struct Chardev *s, const uint8_t *buf, int len)
+static size_t msmouse_chr_write(struct Chardev *s, const uint8_t *buf, size_t len)
 {
     /* Ignore writes to mouse port */
     return len;

index e66e3ad568..a9e7b4e374 100644
@@ -193,7 +193,7 @@ static GSource *spice_chr_add_watch(Chardev *chr, GIOCondition cond)
     return (GSource *)src;
 }
 
-static int spice_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t spice_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     SpiceChardev *s = SPICE_CHARDEV(chr);
     int read_bytes;

index 031e9a23e8..6ebaf5fdaf 100644
@@ -82,7 +82,7 @@ static int testdev_eat_packet(TestdevChardev *testdev)
 }
 
 /* The other end is writing some data.  Store it and try to interpret */
-static int testdev_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t testdev_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     TestdevChardev *testdev = TESTDEV_CHARDEV(chr);
     int tocopy, eaten, orig_len = len;

index 969d014574..52acbdb609 100644
@@ -203,8 +203,8 @@ static void wctablet_chr_accept_input(Chardev *chr)
     }
 }
 
-static int wctablet_chr_write(struct Chardev *chr,
-                              const uint8_t *buf, int len)
+static size_t wctablet_chr_write(struct Chardev *chr,
+                              const uint8_t *buf, size_t len)
 {
     TabletChardev *tablet = WCTABLET_CHARDEV(chr);
     unsigned int i, clen;

index c8478de8f5..bbbb1cfcc1 100644
@@ -1955,7 +1955,7 @@ static void gdb_monitor_output(GDBState *s, const char *msg, int len)
     put_packet(s, buf);
 }
 
-static int gdb_monitor_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t gdb_monitor_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     const char *p = (const char *)buf;
     int max_sz;

index 0341ded50c..21ac388675 100644
@@ -314,8 +314,8 @@ static void csrhci_ready_for_next_inpkt(struct csrhci_s *s)
     s->in_hdr = INT_MAX;
 }
 
-static int csrhci_write(struct Chardev *chr,
-                const uint8_t *buf, int len)
+static size_t csrhci_write(struct Chardev *chr,
+                const uint8_t *buf, size_t len)
 {
     struct csrhci_s *s = (struct csrhci_s *)chr;
     int total = 0;

index ef4509bfa3..091a514022 100644
@@ -250,7 +250,7 @@ typedef struct ChardevClass {
     void (*open)(Chardev *chr, ChardevBackend *backend,
                  bool *be_opened, Error **errp);
 
-    int (*chr_write)(Chardev *s, const uint8_t *buf, int len);
+    size_t (*chr_write)(Chardev *s, const uint8_t *buf, size_t len);
     size_t (*chr_sync_read)(Chardev *s, const uint8_t *buf, size_t len);
     GSource *(*chr_add_watch)(Chardev *s, GIOCondition cond);
     void (*chr_update_read_handler)(Chardev *s);

index 3a285bae00..5fed0504f4 100644
@@ -1080,7 +1080,7 @@ typedef struct VCChardev {
 #define TYPE_CHARDEV_VC "chardev-vc"
 #define VC_CHARDEV(obj) OBJECT_CHECK(VCChardev, (obj), TYPE_CHARDEV_VC)
 
-static int vc_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t vc_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     VCChardev *drv = VC_CHARDEV(chr);
     QemuConsole *s = drv->console;

index 3ddb5fe162..7990b58833 100644
@@ -1842,7 +1842,7 @@ static void gd_vc_adjustment_changed(GtkAdjustment *adjustment, void *opaque)
     }
 }
 
-static int gd_vc_chr_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t gd_vc_chr_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     VCChardev *vcd = VC_CHARDEV(chr);
     VirtualConsole *vc = vcd->console;

index d2b9ce6cbf..b51c01f664 100644
@@ -61,7 +61,7 @@ static int rng_egd_chr_can_read(void *opaque)
     return size;
 }
 
-static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
+static void rng_egd_chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     RngEgd *s = RNG_EGD(opaque);
     size_t buf_offset = 0;

index 3ca732d3a8..d8d6eaa646 100644
@@ -209,7 +209,7 @@ static int mux_chr_can_read(void *opaque)
     return 0;
 }
 
-static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
+static void mux_chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     Chardev *chr = CHARDEV(opaque);
     MuxChardev *d = MUX_CHARDEV(opaque);

index bbbb1cfcc1..a2fc3682ce 100644
@@ -1923,7 +1923,7 @@ static int gdb_chr_can_receive(void *opaque)
   return MAX_PACKET_LENGTH;
 }
 
-static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)
+static void gdb_chr_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     int i;
 

index f598a1c053..75b6aa2772 100644
@@ -1929,7 +1929,7 @@ static int pxa2xx_fir_is_empty(void *opaque)
     return (s->rx_len < 64);
 }
 
-static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, int size)
+static void pxa2xx_fir_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
     if (!(s->control[0] & (1 << 4)))			/* RXE */

index ec2627374d..40db4e5e0a 100644
@@ -1072,7 +1072,8 @@ static int strongarm_uart_can_receive(void *opaque)
     return 1;
 }
 
-static void strongarm_uart_receive(void *opaque, const uint8_t *buf, int size)
+static void strongarm_uart_receive(void *opaque, const uint8_t *buf,
+                                   size_t size)
 {
     StrongARMUARTState *s = opaque;
     int i;

index 0364596c55..cb26df40f8 100644
@@ -235,7 +235,7 @@ static void bcm2835_aux_put_fifo(void *opaque, uint8_t value)
     bcm2835_aux_update(s);
 }
 
-static void bcm2835_aux_receive(void *opaque, const uint8_t *buf, int size)
+static void bcm2835_aux_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     bcm2835_aux_put_fifo(opaque, *buf);
 }

index fbdbd463bb..eb5cc974a1 100644
@@ -332,7 +332,7 @@ static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
     cadence_uart_xmit(NULL, G_IO_OUT, s);
 }
 
-static void uart_receive(void *opaque, const uint8_t *buf, int size)
+static void uart_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     CadenceUARTState *s = opaque;
     uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;

index ddfbb25c24..774986d88d 100644
@@ -119,7 +119,7 @@ static int uart_can_receive(void *opaque)
     return 0;
 }
 
-static void uart_receive(void *opaque, const uint8_t *buf, int size)
+static void uart_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 

index ccc75eaa4d..0f41a23b54 100644
@@ -119,7 +119,7 @@ static int uart_can_rx(void *opaque)
     return !(s->reg_st & ST_RX_RDY);
 }
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     DigicUartState *s = opaque;
 

index 628f5f81f7..e655b86273 100644
@@ -601,7 +601,7 @@ static void serial_receive_break(ESCCChannelState *s)
     escc_update_irq(s);
 }
 
-static void serial_receive1(void *opaque, const uint8_t *buf, int size)
+static void serial_receive1(void *opaque, const uint8_t *buf, size_t size)
 {
     ESCCChannelState *s = opaque;
     serial_receive_byte(s, buf[0]);

index a184026410..79cd8d2dc1 100644
@@ -166,7 +166,7 @@ static Property etraxfs_ser_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static void serial_receive(void *opaque, const uint8_t *buf, int size)
+static void serial_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     ETRAXSerial *s = opaque;
     int i;

index a5a285655f..5fdf5b1f37 100644
@@ -495,7 +495,8 @@ static int exynos4210_uart_can_receive(void *opaque)
 }
 
 
-static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)
+static void exynos4210_uart_receive(void *opaque, const uint8_t *buf,
+                                    size_t size)
 {
     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
     int i;

index bac11bec58..d370609a52 100644
@@ -137,7 +137,7 @@ static int grlib_apbuart_can_receive(void *opaque)
     return FIFO_LENGTH - uart->len;
 }
 
-static void grlib_apbuart_receive(void *opaque, const uint8_t *buf, int size)
+static void grlib_apbuart_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     UART *uart = opaque;
 

index 1e363190e3..b9fdfaeb38 100644
@@ -315,7 +315,7 @@ static void imx_put_data(void *opaque, uint32_t value)
     imx_update(s);
 }
 
-static void imx_receive(void *opaque, const uint8_t *buf, int size)
+static void imx_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     imx_put_data(opaque, *buf);
 }

index 5e09caf851..08e3f9e45f 100644
@@ -468,7 +468,7 @@ static int hostdev_can_receive(void *opaque)
     return ch->rx_enabled ? available_bytes : 0;
 }
 
-static void hostdev_receive(void *opaque, const uint8_t *buf, int size)
+static void hostdev_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     SCC2698Channel *ch = opaque;
     IPOctalState *dev = ch->ipoctal;

index d75c835ad2..ecb61ee086 100644
@@ -88,7 +88,7 @@ void lm32_juart_set_jrx(DeviceState *d, uint32_t jtx)
     s->jrx &= ~JRX_FULL;
 }
 
-static void juart_rx(void *opaque, const uint8_t *buf, int size)
+static void juart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     LM32JuartState *s = opaque;
 

index c4a3b9b275..ee0bf8e117 100644
@@ -211,7 +211,7 @@ static const MemoryRegionOps uart_ops = {
     },
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     LM32UartState *s = opaque;
 

index 787f985db6..e126860b46 100644
@@ -274,7 +274,7 @@ static int mcf_uart_can_receive(void *opaque)
     return s->rx_enabled && (s->sr & MCF_UART_FFULL) == 0;
 }
 
-static void mcf_uart_receive(void *opaque, const uint8_t *buf, int size)
+static void mcf_uart_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     mcf_uart_state *s = (mcf_uart_state *)opaque;
 

index 548ee27bca..a10c0957ff 100644
@@ -158,7 +158,7 @@ static const MemoryRegionOps uart_mmio_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     MilkymistUartState *s = opaque;
 

index 2aa277fc4f..37973c32ce 100644
@@ -260,7 +260,7 @@ static void pl011_put_fifo(void *opaque, uint32_t value)
     }
 }
 
-static void pl011_receive(void *opaque, const uint8_t *buf, int size)
+static void pl011_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     pl011_put_fifo(opaque, *buf);
 }

index dbc91a1e5b..a04a2a9d80 100644
@@ -71,7 +71,7 @@ static int chr_can_read(void *opaque)
     return 1;
 }
 
-static void chr_read(void *opaque, const uint8_t *buf, int size)
+static void chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     SCLPConsoleLM *scon = opaque;
 

index 1fa16e9055..62395c19f4 100644
@@ -59,7 +59,7 @@ static int chr_can_read(void *opaque)
 }
 
 /* Send data from a char device over to the guest */
-static void chr_read(void *opaque, const uint8_t *buf, int size)
+static void chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     SCLPConsole *scon = opaque;
 

index 02463e3388..69baed105b 100644
@@ -105,7 +105,7 @@ do { fprintf(stderr, "serial: " fmt , ## __VA_ARGS__); } while (0)
 do {} while (0)
 #endif
 
-static void serial_receive1(void *opaque, const uint8_t *buf, int size);
+static void serial_receive1(void *opaque, const uint8_t *buf, size_t size);
 static void serial_xmit(SerialState *s);
 
 static inline void recv_fifo_put(SerialState *s, uint8_t chr)

@@ -606,7 +606,7 @@ static int serial_can_receive1(void *opaque)
     return serial_can_receive(s);
 }
 
-static void serial_receive1(void *opaque, const uint8_t *buf, int size)
+static void serial_receive1(void *opaque, const uint8_t *buf, size_t size)
 {
     SerialState *s = opaque;
 

index 12831561a6..04fdcee328 100644
@@ -327,7 +327,7 @@ static void sh_serial_timeout_int(void *opaque)
     }
 }
 
-static void sh_serial_receive1(void *opaque, const uint8_t *buf, int size)
+static void sh_serial_receive1(void *opaque, const uint8_t *buf, size_t size)
 {
     sh_serial_state *s = opaque;
 

index 6748334ded..42b4b61cce 100644
@@ -28,7 +28,7 @@ static int vty_can_receive(void *opaque)
     return VTERM_BUFSIZE - (dev->in - dev->out);
 }
 
-static void vty_receive(void *opaque, const uint8_t *buf, int size)
+static void vty_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     VIOsPAPRVTYDevice *dev = VIO_SPAPR_VTY_DEVICE(opaque);
     int i;

@@ -42,7 +42,7 @@ static void vty_receive(void *opaque, const uint8_t *buf, int size)
             static bool reported;
             if (!reported) {
                 error_report("VTY input buffer exhausted - characters dropped."
-                             " (input size = %i)", size);
+                             " (input size = %zu)", size);
                 reported = true;
             }
             break;

index 032b5fda13..78bf142678 100644
@@ -49,7 +49,8 @@ static int stm32f2xx_usart_can_receive(void *opaque)
     return 0;
 }
 
-static void stm32f2xx_usart_receive(void *opaque, const uint8_t *buf, int size)
+static void stm32f2xx_usart_receive(void *opaque, const uint8_t *buf,
+                                    size_t size)
 {
     STM32F2XXUsartState *s = opaque;
 

index e9c45e55b1..076516991e 100644
@@ -90,7 +90,7 @@ static gboolean send_timing_mark_cb(gpointer opaque)
  * As of now, for such case, we simply terminate the connection,
  * and we should come back here later with a better solution.
  */
-static void terminal_read(void *opaque, const uint8_t *buf, int size)
+static void terminal_read(void *opaque, const uint8_t *buf, size_t size)
 {
     Terminal3270 *t = opaque;
     CcwDevice *ccw_dev = CCW_DEVICE(t);

index 2cbe1d4ed5..e3d368b976 100644
@@ -134,7 +134,7 @@ static int chr_can_read(void *opaque)
 }
 
 /* Send data from a char device over to the guest */
-static void chr_read(void *opaque, const uint8_t *buf, int size)
+static void chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     VirtConsole *vcon = opaque;
     VirtIOSerialPort *port = VIRTIO_SERIAL_PORT(vcon);

index 44f7236382..ca90c5c17e 100644
@@ -122,7 +122,7 @@ static int xencons_can_receive(void *opaque)
     return ring_free_bytes(con);
 }
 
-static void xencons_receive(void *opaque, const uint8_t *buf, int len)
+static void xencons_receive(void *opaque, const uint8_t *buf, size_t len)
 {
     struct XenConsole *con = opaque;
     struct xencons_interface *intf = con->sring;

index 2a8bc1e497..b1abf8b604 100644
@@ -177,7 +177,7 @@ static Property xilinx_uartlite_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     XilinxUARTLite *s = opaque;
 

index 8c78b9804b..c52f80f771 100644
@@ -312,7 +312,7 @@ static int can_receive(void *opaque)
     return 1;
 }
 
-static void receive(void *opaque, const uint8_t *buf, int size)
+static void receive(void *opaque, const uint8_t *buf, size_t size)
 {
     IPMIBmcExtern *ibe = opaque;
     int i;

index 8cb17b9dd4..f506479845 100644
@@ -628,14 +628,14 @@ static int ivshmem_can_receive(void *opaque)
     return sizeof(s->msg_buf) - s->msg_buffered_bytes;
 }
 
-static void ivshmem_read(void *opaque, const uint8_t *buf, int size)
+static void ivshmem_read(void *opaque, const uint8_t *buf, size_t size)
 {
     IVShmemState *s = opaque;
     Error *err = NULL;
     int fd;
     int64_t msg;
 
-    assert(size >= 0 && s->msg_buffered_bytes + size <= sizeof(s->msg_buf));
+    assert(s->msg_buffered_bytes + size <= sizeof(s->msg_buf));
     memcpy((unsigned char *)&s->msg_buf + s->msg_buffered_bytes, buf, size);
     s->msg_buffered_bytes += size;
     if (s->msg_buffered_bytes < sizeof(s->msg_buf)) {

index 4f7b11dc37..2625f5e9e8 100644
@@ -74,7 +74,7 @@ static int htif_can_recv(void *opaque)
  * Called by the char dev to supply input to HTIF console.
  * We assume that we will receive one character at a time.
  */
-static void htif_recv(void *opaque, const uint8_t *buf, int size)
+static void htif_recv(void *opaque, const uint8_t *buf, size_t size)
 {
     HTIFState *htifstate = opaque;
 

index b0c3798cf2..d4cbf91b9f 100644
@@ -123,7 +123,7 @@ static const MemoryRegionOps uart_ops = {
     }
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     SiFiveUARTState *s = opaque;
 

index 0a6c657228..b6fa35a4b4 100644
@@ -270,13 +270,13 @@ static void ccid_card_vscard_drop_connection(PassthruState *card)
     card->vscard_in_pos = card->vscard_in_hdr = 0;
 }
 
-static void ccid_card_vscard_read(void *opaque, const uint8_t *buf, int size)
+static void ccid_card_vscard_read(void *opaque, const uint8_t *buf, size_t size)
 {
     PassthruState *card = opaque;
     VSCMsgHeader *hdr;
 
     if (card->vscard_in_pos + size > VSCARD_IN_SIZE) {
-        error_report("no room for data: pos %u +  size %d > %" PRId64 "."
+        error_report("no room for data: pos %u +  size %zu > %" PRId64 "."
                      " dropping connection.",
                      card->vscard_in_pos, size, VSCARD_IN_SIZE);
         ccid_card_vscard_drop_connection(card);

index 98d1ca3c91..efaeab484d 100644
@@ -431,7 +431,7 @@ static int usb_serial_can_read(void *opaque)
     return RECV_BUF - s->recv_used;
 }
 
-static void usb_serial_read(void *opaque, const uint8_t *buf, int size)
+static void usb_serial_read(void *opaque, const uint8_t *buf, size_t size)
 {
     USBSerialState *s = opaque;
     int first_size, start;

index 99094a721e..a73076ba78 100644
@@ -1302,7 +1302,7 @@ static int usbredir_chardev_can_read(void *opaque)
     return 1 * MiB;
 }
 
-static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
+static void usbredir_chardev_read(void *opaque, const uint8_t *buf, size_t size)
 {
     USBRedirDevice *dev = opaque;
 

index e59f9ae1e9..c5a7299266 100644
@@ -167,7 +167,7 @@ void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque);
 
 /* async I/O support */
 
-typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
+typedef void IOReadHandler(void *opaque, const uint8_t *buf, size_t size);
 
 /**
  * IOCanReadHandler: Return the number of bytes that #IOReadHandler can accept

index b9258a7438..12401ec60b 100644
@@ -4240,14 +4240,14 @@ static void handle_qmp_command(void *opaque, QObject *req, Error *err)
     qemu_bh_schedule(qmp_dispatcher_bh);
 }
 
-static void monitor_qmp_read(void *opaque, const uint8_t *buf, int size)
+static void monitor_qmp_read(void *opaque, const uint8_t *buf, size_t size)
 {
     Monitor *mon = opaque;
 
     json_message_parser_feed(&mon->qmp.parser, (const char *) buf, size);
 }
 
-static void monitor_read(void *opaque, const uint8_t *buf, int size)
+static void monitor_read(void *opaque, const uint8_t *buf, size_t size)
 {
     Monitor *old_mon = cur_mon;
     int i;

index dd745a491b..433e9ba287 100644
@@ -692,7 +692,7 @@ static int compare_chr_can_read(void *opaque)
  * Called from the main thread on the primary for packets
  * arriving over the socket from the primary.
  */
-static void compare_pri_chr_in(void *opaque, const uint8_t *buf, int size)
+static void compare_pri_chr_in(void *opaque, const uint8_t *buf, size_t size)
 {
     CompareState *s = COLO_COMPARE(opaque);
     int ret;

@@ -709,7 +709,7 @@ static void compare_pri_chr_in(void *opaque, const uint8_t *buf, int size)
  * Called from the main thread on the primary for packets
  * arriving over the socket from the secondary.
  */
-static void compare_sec_chr_in(void *opaque, const uint8_t *buf, int size)
+static void compare_sec_chr_in(void *opaque, const uint8_t *buf, size_t size)
 {
     CompareState *s = COLO_COMPARE(opaque);
     int ret;

index 3a61cf21e8..27b6e52a1d 100644
@@ -119,7 +119,7 @@ static int redirector_chr_can_read(void *opaque)
     return REDIRECTOR_MAX_LEN;
 }
 
-static void redirector_chr_read(void *opaque, const uint8_t *buf, int size)
+static void redirector_chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     NetFilterState *nf = opaque;
     MirrorState *s = FILTER_REDIRECTOR(nf);

index 99884de204..5e864f4a4f 100644
@@ -718,7 +718,7 @@ static int guestfwd_can_read(void *opaque)
     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
 }
 
-static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
+static void guestfwd_read(void *opaque, const uint8_t *buf, size_t size)
 {
     struct GuestFwd *fwd = opaque;
     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);

index 69b9e9962b..0494afdfb3 100644
@@ -657,7 +657,7 @@ static void qtest_process_inbuf(CharBackend *chr, GString *inbuf)
     }
 }
 
-static void qtest_read(void *opaque, const uint8_t *buf, int size)
+static void qtest_read(void *opaque, const uint8_t *buf, size_t size)
 {
     CharBackend *chr = opaque;
 

index e389069f0b..241874ea4e 100644
@@ -168,7 +168,7 @@ static int sim_console_can_read(void *opaque)
     return sizeof(p->input.buffer) - p->input.offset;
 }
 
-static void sim_console_read(void *opaque, const uint8_t *buf, int size)
+static void sim_console_read(void *opaque, const uint8_t *buf, size_t size)
 {
     XtensaSimConsole *p = opaque;
     size_t copy = sizeof(p->input.buffer) - p->input.offset;

index b51c01f664..4a9a92a8e7 100644
@@ -48,11 +48,11 @@ static void rng_egd_request_entropy(RngBackend *b, RngRequest *req)
     }
 }
 
-static int rng_egd_chr_can_read(void *opaque)
+static size_t rng_egd_chr_can_read(void *opaque)
 {
     RngEgd *s = RNG_EGD(opaque);
     RngRequest *req;
-    int size = 0;
+    size_t size = 0;
 
     QSIMPLEQ_FOREACH(req, &s->parent.requests, next) {
         size += req->size - req->offset;

index d8d6eaa646..98db12cf77 100644
@@ -192,7 +192,7 @@ static void mux_chr_accept_input(Chardev *chr)
     }
 }
 
-static int mux_chr_can_read(void *opaque)
+static size_t mux_chr_can_read(void *opaque)
 {
     MuxChardev *d = MUX_CHARDEV(opaque);
     int m = d->focus;

index a2fc3682ce..86d1fa62f8 100644
@@ -1916,7 +1916,7 @@ void gdbserver_fork(CPUState *cpu)
     cpu_watchpoint_remove_all(cpu, BP_GDB);
 }
 #else
-static int gdb_chr_can_receive(void *opaque)
+static size_t gdb_chr_can_receive(void *opaque)
 {
   /* We can handle an arbitrarily large amount of data.
    Pick the maximum packet size, which is as good as anything.  */

index 75b6aa2772..a72d9bd4fe 100644
@@ -1923,7 +1923,7 @@ static const MemoryRegionOps pxa2xx_fir_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pxa2xx_fir_is_empty(void *opaque)
+static size_t pxa2xx_fir_is_empty(void *opaque)
 {
     PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;
     return (s->rx_len < 64);

index 40db4e5e0a..6fdd4da3d0 100644
@@ -1058,7 +1058,7 @@ static void strongarm_uart_rx_push(StrongARMUARTState *s, uint16_t c)
         s->rx_fifo[(s->rx_start + 11) % 12] |= RX_FIFO_ROR;
 }
 
-static int strongarm_uart_can_receive(void *opaque)
+static size_t strongarm_uart_can_receive(void *opaque)
 {
     StrongARMUARTState *s = opaque;
 

index cb26df40f8..5dd1b652c0 100644
@@ -211,7 +211,7 @@ static void bcm2835_aux_write(void *opaque, hwaddr offset, uint64_t value,
     bcm2835_aux_update(s);
 }
 
-static int bcm2835_aux_can_receive(void *opaque)
+static size_t bcm2835_aux_can_receive(void *opaque)
 {
     BCM2835AuxState *s = opaque;
 

index eb5cc974a1..5835362038 100644
@@ -216,10 +216,10 @@ static void uart_parameters_setup(CadenceUARTState *s)
     qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 }
 
-static int uart_can_receive(void *opaque)
+static size_t uart_can_receive(void *opaque)
 {
     CadenceUARTState *s = opaque;
-    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
+    size_t ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
     uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {

index 774986d88d..c1437674a5 100644
@@ -108,7 +108,7 @@ static void cmsdk_apb_uart_update(CMSDKAPBUART *s)
     qemu_set_irq(s->uartint, !!(s->intstatus));
 }
 
-static int uart_can_receive(void *opaque)
+static size_t uart_can_receive(void *opaque)
 {
     CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 

index 0f41a23b54..f805ee5766 100644
@@ -112,7 +112,7 @@ static const MemoryRegionOps uart_mmio_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int uart_can_rx(void *opaque)
+static size_t uart_can_rx(void *opaque)
 {
     DigicUartState *s = opaque;
 

index e655b86273..decc35b990 100644
@@ -166,7 +166,7 @@
 #define R_EXTINT 15
 
 static void handle_kbd_command(ESCCChannelState *s, int val);
-static int serial_can_receive(void *opaque);
+static size_t serial_can_receive(void *opaque);
 static void serial_receive_byte(ESCCChannelState *s, int ch);
 
 static void clear_queue(void *opaque)

@@ -573,10 +573,10 @@ static const MemoryRegionOps escc_mem_ops = {
     },
 };
 
-static int serial_can_receive(void *opaque)
+static size_t serial_can_receive(void *opaque)
 {
     ESCCChannelState *s = opaque;
-    int ret;
+    size_t ret;
 
     if (((s->wregs[W_RXCTRL] & RXCTRL_RXEN) == 0) // Rx not enabled
         || ((s->rregs[R_STATUS] & STATUS_RXAV) == STATUS_RXAV))

index 79cd8d2dc1..970f6a6e90 100644
@@ -187,7 +187,7 @@ static void serial_receive(void *opaque, const uint8_t *buf, size_t size)
     ser_update_irq(s);
 }
 
-static int serial_can_receive(void *opaque)
+static size_t serial_can_receive(void *opaque)
 {
     ETRAXSerial *s = opaque;
 

index 5fdf5b1f37..b93edec08a 100644
@@ -487,7 +487,7 @@ static const MemoryRegionOps exynos4210_uart_ops = {
     },
 };
 
-static int exynos4210_uart_can_receive(void *opaque)
+static size_t exynos4210_uart_can_receive(void *opaque)
 {
     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
 

index d370609a52..7b57dce7fb 100644
@@ -130,7 +130,7 @@ static void uart_add_to_fifo(UART          *uart,
     uart->len += length;
 }
 
-static int grlib_apbuart_can_receive(void *opaque)
+static size_t grlib_apbuart_can_receive(void *opaque)
 {
     UART *uart = opaque;
 

index b9fdfaeb38..abbe68571d 100644
@@ -293,7 +293,7 @@ static void imx_serial_write(void *opaque, hwaddr offset,
     }
 }
 
-static int imx_can_receive(void *opaque)
+static size_t imx_can_receive(void *opaque)
 {
     IMXSerialState *s = (IMXSerialState *)opaque;
     return !(s->usr1 & USR1_RRDY);

index 08e3f9e45f..be21303dcd 100644
@@ -461,10 +461,10 @@ static void mem_write8(IPackDevice *ip, uint32_t addr, uint8_t val)
     }
 }
 
-static int hostdev_can_receive(void *opaque)
+static size_t hostdev_can_receive(void *opaque)
 {
     SCC2698Channel *ch = opaque;
-    int available_bytes = RX_FIFO_SIZE - ch->rx_pending;
+    size_t available_bytes = RX_FIFO_SIZE - ch->rx_pending;
     return ch->rx_enabled ? available_bytes : 0;
 }
 

index ecb61ee086..51e598c570 100644
@@ -95,7 +95,7 @@ static void juart_rx(void *opaque, const uint8_t *buf, size_t size)
     s->jrx = *buf | JRX_FULL;
 }
 
-static int juart_can_rx(void *opaque)
+static size_t juart_can_rx(void *opaque)
 {
     LM32JuartState *s = opaque;
 

index ee0bf8e117..2593434f8f 100644
@@ -225,7 +225,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
     uart_update_irq(s);
 }
 
-static int uart_can_rx(void *opaque)
+static size_t uart_can_rx(void *opaque)
 {
     LM32UartState *s = opaque;
 

index e126860b46..cd9c499a51 100644
@@ -267,7 +267,7 @@ static void mcf_uart_event(void *opaque, int event)
     }
 }
 
-static int mcf_uart_can_receive(void *opaque)
+static size_t mcf_uart_can_receive(void *opaque)
 {
     mcf_uart_state *s = (mcf_uart_state *)opaque;
 

index a10c0957ff..0efcd829ce 100644
@@ -170,7 +170,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
     uart_update_irq(s);
 }
 
-static int uart_can_rx(void *opaque)
+static size_t uart_can_rx(void *opaque)
 {
     MilkymistUartState *s = opaque;
 

index a80da47ecf..fe0e5c8756 100644
@@ -513,7 +513,7 @@ static const VMStateDescription vmstate_parallel_isa = {
     }
 };
 
-static int parallel_can_receive(void *opaque)
+static size_t parallel_can_receive(void *opaque)
 {
      return 1;
 }

index 37973c32ce..10195679b4 100644
@@ -224,10 +224,10 @@ static void pl011_write(void *opaque, hwaddr offset,
     }
 }
 
-static int pl011_can_receive(void *opaque)
+static size_t pl011_can_receive(void *opaque)
 {
     PL011State *s = (PL011State *)opaque;
-    int r;
+    size_t r;
 
     if (s->lcr & 0x10) {
         r = s->read_count < 16;

index a04a2a9d80..ad5f791227 100644
@@ -61,7 +61,7 @@ typedef struct SCLPConsoleLM {
  * truncated to the guest in case it doesn't fit into the SCCB.
  */
 
-static int chr_can_read(void *opaque)
+static size_t chr_can_read(void *opaque)
 {
     SCLPConsoleLM *scon = opaque;
 

index 62395c19f4..5ec1c4b607 100644
@@ -47,10 +47,10 @@ typedef struct SCLPConsole {
 /* character layer call-back functions */
 
 /* Return number of bytes that fit into iov buffer */
-static int chr_can_read(void *opaque)
+static size_t chr_can_read(void *opaque)
 {
     SCLPConsole *scon = opaque;
-    int avail = SIZE_BUFFER_VT220 - scon->iov_data_len;
+    size_t avail = SIZE_BUFFER_VT220 - scon->iov_data_len;
 
     if (avail == 0) {
         scon->notify = true;

index 69baed105b..f83bb8ee4e 100644
@@ -561,7 +561,7 @@ static uint64_t serial_ioport_read(void *opaque, hwaddr addr, unsigned size)
     return ret;
 }
 
-static int serial_can_receive(SerialState *s)
+static size_t serial_can_receive(SerialState *s)
 {
     if(s->fcr & UART_FCR_FE) {
         if (s->recv_fifo.num < UART_FIFO_LENGTH) {

@@ -600,7 +600,7 @@ static void fifo_timeout_int (void *opaque) {
     }
 }
 
-static int serial_can_receive1(void *opaque)
+static size_t serial_can_receive1(void *opaque)
 {
     SerialState *s = opaque;
     return serial_can_receive(s);

index 04fdcee328..f5402d3b5c 100644
@@ -300,7 +300,7 @@ static uint64_t sh_serial_read(void *opaque, hwaddr offs,
     return ret;
 }
 
-static int sh_serial_can_receive(sh_serial_state *s)
+static size_t sh_serial_can_receive(sh_serial_state *s)
 {
     return s->scr & (1 << 4);
 }

@@ -311,7 +311,7 @@ static void sh_serial_receive_break(sh_serial_state *s)
         s->sr |= (1 << 4);
 }
 
-static int sh_serial_can_receive1(void *opaque)
+static size_t sh_serial_can_receive1(void *opaque)
 {
     sh_serial_state *s = opaque;
     return sh_serial_can_receive(s);

index 42b4b61cce..0ac9dc8448 100644
@@ -21,7 +21,7 @@ typedef struct VIOsPAPRVTYDevice {
 #define VIO_SPAPR_VTY_DEVICE(obj) \
      OBJECT_CHECK(VIOsPAPRVTYDevice, (obj), TYPE_VIO_SPAPR_VTY_DEVICE)
 
-static int vty_can_receive(void *opaque)
+static size_t vty_can_receive(void *opaque)
 {
     VIOsPAPRVTYDevice *dev = VIO_SPAPR_VTY_DEVICE(opaque);
 

index 78bf142678..63256da77b 100644
@@ -38,7 +38,7 @@
 
 #define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
 
-static int stm32f2xx_usart_can_receive(void *opaque)
+static size_t stm32f2xx_usart_can_receive(void *opaque)
 {
     STM32F2XXUsartState *s = opaque;
 

index 076516991e..a9db0a3401 100644
@@ -38,7 +38,7 @@ typedef struct Terminal3270 {
 #define TERMINAL_3270(obj) \
         OBJECT_CHECK(Terminal3270, (obj), TYPE_TERMINAL_3270)
 
-static int terminal_can_read(void *opaque)
+static size_t terminal_can_read(void *opaque)
 {
     Terminal3270 *t = opaque;
 

index e3d368b976..b942159d82 100644
@@ -126,7 +126,7 @@ static void guest_writable(VirtIOSerialPort *port)
 }
 
 /* Readiness of the guest to accept data on a port */
-static int chr_can_read(void *opaque)
+static size_t chr_can_read(void *opaque)
 {
     VirtConsole *vcon = opaque;
 

index ca90c5c17e..0a1cbaeafa 100644
@@ -116,7 +116,7 @@ static int ring_free_bytes(struct XenConsole *con)
     return (sizeof(intf->in) - space);
 }
 
-static int xencons_can_receive(void *opaque)
+static size_t xencons_can_receive(void *opaque)
 {
     struct XenConsole *con = opaque;
     return ring_free_bytes(con);

index b1abf8b604..2473cb0ad7 100644
@@ -195,7 +195,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
     uart_update_irq(s);
 }
 
-static int uart_can_rx(void *opaque)
+static size_t uart_can_rx(void *opaque)
 {
     XilinxUARTLite *s = opaque;
 

index c52f80f771..7107d2fe9f 100644
@@ -307,7 +307,7 @@ static void handle_msg(IPMIBmcExtern *ibe)
     k->handle_rsp(ibe->parent.intf, ibe->inbuf[0], ibe->inbuf + 1, ibe->inpos - 1);
 }
 
-static int can_receive(void *opaque)
+static size_t can_receive(void *opaque)
 {
     return 1;
 }

index f506479845..01b331aaab 100644
@@ -620,7 +620,7 @@ static void process_msg(IVShmemState *s, int64_t msg, int fd, Error **errp)
     }
 }
 
-static int ivshmem_can_receive(void *opaque)
+static size_t ivshmem_can_receive(void *opaque)
 {
     IVShmemState *s = opaque;
 

index 2625f5e9e8..565120df7d 100644
@@ -65,7 +65,7 @@ void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
 /*
  * Called by the char dev to see if HTIF is ready to accept input.
  */
-static int htif_can_recv(void *opaque)
+static size_t htif_can_recv(void *opaque)
 {
     return 1;
 }

index d4cbf91b9f..c6a8f5fbc4 100644
@@ -137,7 +137,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
     update_irq(s);
 }
 
-static int uart_can_rx(void *opaque)
+static size_t uart_can_rx(void *opaque)
 {
     SiFiveUARTState *s = opaque;
 

index b6fa35a4b4..5dc10ef850 100644
@@ -112,7 +112,7 @@ static void ccid_card_vscard_send_init(PassthruState *s)
                          (uint8_t *)&msg, sizeof(msg));
 }
 
-static int ccid_card_vscard_can_read(void *opaque)
+static size_t ccid_card_vscard_can_read(void *opaque)
 {
     PassthruState *card = opaque;
 

index efaeab484d..e9735d4b5d 100644
@@ -421,7 +421,7 @@ static void usb_serial_handle_data(USBDevice *dev, USBPacket *p)
     }
 }
 
-static int usb_serial_can_read(void *opaque)
+static size_t usb_serial_can_read(void *opaque)
 {
     USBSerialState *s = opaque;
 

index a73076ba78..f025c91d28 100644
@@ -1284,7 +1284,7 @@ static void usbredir_do_attach(void *opaque)
  * chardev callbacks
  */
 
-static int usbredir_chardev_can_read(void *opaque)
+static size_t usbredir_chardev_can_read(void *opaque)
 {
     USBRedirDevice *dev = opaque;
 

index c5a7299266..b51f9a5267 100644
@@ -182,7 +182,7 @@ typedef void IOReadHandler(void *opaque, const uint8_t *buf, size_t size);
  * is called again.  aio_notify() or qemu_notify_event() can be used to kick
  * the event loop.
  */
-typedef int IOCanReadHandler(void *opaque);
+typedef size_t IOCanReadHandler(void *opaque);
 
 /**
  * qemu_set_fd_handler: Register a file descriptor with the main loop

index 12401ec60b..3417c5f044 100644
@@ -4038,7 +4038,7 @@ cleanup:
     free_cmdline_args(args, nb_args);
 }
 
-static int monitor_can_read(void *opaque)
+static size_t monitor_can_read(void *opaque)
 {
     Monitor *mon = opaque;
 

index 433e9ba287..9321d81a98 100644
@@ -683,7 +683,7 @@ err:
     return ret < 0 ? ret : -EIO;
 }
 
-static int compare_chr_can_read(void *opaque)
+static size_t compare_chr_can_read(void *opaque)
 {
     return COMPARE_READ_LEN_MAX;
 }

index 27b6e52a1d..8e16535fad 100644
@@ -114,7 +114,7 @@ static void redirector_to_filter(NetFilterState *nf,
      }
 }
 
-static int redirector_chr_can_read(void *opaque)
+static size_t redirector_chr_can_read(void *opaque)
 {
     return REDIRECTOR_MAX_LEN;
 }

index 5e864f4a4f..9dbcaffb07 100644
@@ -712,7 +712,7 @@ struct GuestFwd {
     Slirp *slirp;
 };
 
-static int guestfwd_can_read(void *opaque)
+static size_t guestfwd_can_read(void *opaque)
 {
     struct GuestFwd *fwd = opaque;
     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);

index 0494afdfb3..bc685700cd 100644
@@ -665,7 +665,7 @@ static void qtest_read(void *opaque, const uint8_t *buf, size_t size)
     qtest_process_inbuf(chr, inbuf);
 }
 
-static int qtest_can_read(void *opaque)
+static size_t qtest_can_read(void *opaque)
 {
     return 1024;
 }

index 241874ea4e..a57e61ef4a 100644
@@ -161,7 +161,7 @@ typedef struct XtensaSimConsole {
 
 static XtensaSimConsole *sim_console;
 
-static int sim_console_can_read(void *opaque)
+static size_t sim_console_can_read(void *opaque)
 {
     XtensaSimConsole *p = opaque;
 

index a8931f7afd..b732f6566b 100644
@@ -31,7 +31,7 @@
 #include "chardev/char-io.h"
 #include "chardev/char-mux.h"
 
-int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
+size_t qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, size_t len)
 {
     Chardev *s = be->chr;
 

@@ -42,7 +42,7 @@ int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
     return qemu_chr_write(s, buf, len, false);
 }
 
-int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
+size_t qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, size_t len)
 {
     Chardev *s = be->chr;
 

@@ -53,10 +53,10 @@ int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
     return qemu_chr_write(s, buf, len, true);
 }
 
-int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len)
+size_t qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, size_t len)
 {
     Chardev *s = be->chr;
-    int offset = 0;
+    size_t offset = 0;
     int res;
 
     if (!s || !CHARDEV_GET_CLASS(s)->chr_sync_read) {

index efcf7827eb..6b1a97144b 100644
@@ -221,7 +221,7 @@ static void char_win_stdio_finalize(Object *obj)
     }
 }
 
-static int win_stdio_write(Chardev *chr, const uint8_t *buf, int len)
+static size_t win_stdio_write(Chardev *chr, const uint8_t *buf, size_t len)
 {
     HANDLE  hStdOut = GetStdHandle(STD_OUTPUT_HANDLE);
     DWORD   dwSize;

index 05518e0958..7ea7d0a371 100644
@@ -152,7 +152,7 @@ int win_chr_pipe_poll(void *opaque)
 }
 
 /* Called with chr_write_lock held.  */
-static int win_chr_write(Chardev *chr, const uint8_t *buf, int len1)
+static size_t win_chr_write(Chardev *chr, const uint8_t *buf, size_t len1)
 {
     WinChardev *s = WIN_CHARDEV(chr);
     DWORD len, ret, size, err;

index 46c997d352..2f95c890d8 100644
@@ -184,7 +184,7 @@ guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
  *
  * Returns: the number of bytes consumed (0 if no associated Chardev)
  */
-int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len);
+size_t qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_fe_write_all:

@@ -198,7 +198,7 @@ int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len);
  *
  * Returns: the number of bytes consumed (0 if no associated Chardev)
  */
-int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len);
+size_t qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_fe_read_all:

@@ -209,7 +209,7 @@ int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len);
  *
  * Returns: the number of bytes read (0 if no associated Chardev)
  */
-int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len);
+size_t qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_fe_ioctl:

index 608c2569f4..ef6d07e132 100644
@@ -100,7 +100,7 @@ static void qemu_chr_write_log(Chardev *s, const uint8_t *buf, size_t len)
 
 static int qemu_chr_write_buffer(Chardev *s,
                                  const uint8_t *buf, int len,
-                                 int *offset, bool write_all)
+                                 size_t *offset, bool write_all)
 {
     ChardevClass *cc = CHARDEV_GET_CLASS(s);
     int res = 0;

@@ -132,9 +132,10 @@ static int qemu_chr_write_buffer(Chardev *s,
     return res;
 }
 
-int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
+size_t qemu_chr_write(Chardev *s, const uint8_t *buf, size_t len,
+                      bool write_all)
 {
-    int offset = 0;
+    size_t offset = 0;
     int res;
 
     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {

@@ -156,21 +157,21 @@ int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
     return offset;
 }
 
-int qemu_chr_be_can_write(Chardev *s)
+size_t qemu_chr_be_can_write(Chardev *s)
 {
     CharBackend *be = s->be;
-    int res;
+    size_t res;
 
     if (!be || !be->chr_can_read) {
         return 0;
     }
 
     res = be->chr_can_read(be->opaque);
-    assert(res >= 0);
+    assert((ssize_t)res >= 0); /* "fail-safe" assertion */
     return res;
 }
 
-void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len)
+void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, size_t len)
 {
     CharBackend *be = s->be;
 

@@ -179,7 +180,7 @@ void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len)
     }
 }
 
-void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len)
+void qemu_chr_be_write(Chardev *s, uint8_t *buf, size_t len)
 {
     if (qemu_chr_replay(s)) {
         if (replay_mode == REPLAY_MODE_PLAY) {

index 091a514022..65f93adbd6 100644
@@ -163,7 +163,7 @@ Chardev *qemu_chr_new_noreplay(const char *label, const char *filename,
  *
  * Returns: the number of bytes the front end can receive via @qemu_chr_be_write
  */
-int qemu_chr_be_can_write(Chardev *s);
+size_t qemu_chr_be_can_write(Chardev *s);
 
 /**
  * qemu_chr_be_write:

@@ -174,7 +174,7 @@ int qemu_chr_be_can_write(Chardev *s);
  * the caller should call @qemu_chr_be_can_write to determine how much data
  * the front end can currently accept.
  */
-void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len);
+void qemu_chr_be_write(Chardev *s, uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_be_write_impl:

@@ -183,7 +183,7 @@ void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len);
  *
  * Implementation of back end writing. Used by replay module.
  */
-void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len);
+void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_be_update_read_handlers:

@@ -211,7 +211,8 @@ void qemu_chr_set_feature(Chardev *chr,
                           ChardevFeature feature);
 QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename,
                                 bool permit_mux_mon);
-int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all);
+size_t qemu_chr_write(Chardev *s, const uint8_t *buf, size_t len,
+                      bool write_all);
 #define qemu_chr_write_all(s, buf, len) qemu_chr_write(s, buf, len, true)
 int qemu_chr_wait_connected(Chardev *chr, Error **errp);
 

index 7f7a594eca..0856b66888 100644
@@ -148,17 +148,17 @@ uint64_t blkreplay_next_id(void);
 /*! Registers char driver to save it's events */
 void replay_register_char_driver(struct Chardev *chr);
 /*! Saves write to char device event to the log */
-void replay_chr_be_write(struct Chardev *s, uint8_t *buf, int len);
+void replay_chr_be_write(struct Chardev *s, uint8_t *buf, size_t len);
 /*! Writes char write return value to the replay log. */
-void replay_char_write_event_save(int res, int offset);
+void replay_char_write_event_save(int res, size_t offset);
 /*! Reads char write return value from the replay log. */
-void replay_char_write_event_load(int *res, int *offset);
+void replay_char_write_event_load(int *res, size_t *offset);
 /*! Reads information about read_all character event. */
 int replay_char_read_all_load(uint8_t *buf);
 /*! Writes character read_all error code into the replay log. */
 void replay_char_read_all_save_error(int res);
 /*! Writes character read_all execution result into the replay log. */
-void replay_char_read_all_save_buf(uint8_t *buf, int offset);
+void replay_char_read_all_save_buf(uint8_t *buf, size_t offset);
 
 /* Network */
 

index 736cc8c2e6..9c4ec3c794 100644
@@ -49,7 +49,7 @@ void replay_register_char_driver(Chardev *chr)
     char_drivers[drivers_count++] = chr;
 }
 
-void replay_chr_be_write(Chardev *s, uint8_t *buf, int len)
+void replay_chr_be_write(Chardev *s, uint8_t *buf, size_t len)
 {
     CharEvent *event = g_malloc0(sizeof(CharEvent));
 

@@ -94,7 +94,7 @@ void *replay_event_char_read_load(void)
     return event;
 }
 
-void replay_char_write_event_save(int res, int offset)
+void replay_char_write_event_save(int res, size_t offset)
 {
     g_assert(replay_mutex_locked());
 

@@ -104,7 +104,7 @@ void replay_char_write_event_save(int res, int offset)
     replay_put_dword(offset);
 }
 
-void replay_char_write_event_load(int *res, int *offset)
+void replay_char_write_event_load(int *res, size_t *offset)
 {
     g_assert(replay_mutex_locked());
 

@@ -150,7 +150,7 @@ void replay_char_read_all_save_error(int res)
     replay_put_dword(res);
 }
 
-void replay_char_read_all_save_buf(uint8_t *buf, int offset)
+void replay_char_read_all_save_buf(uint8_t *buf, size_t offset)
 {
     g_assert(replay_mutex_locked());
     replay_save_instructions();

index 04279abb2c..030f508aef 100644
@@ -34,17 +34,17 @@ void replay_register_char_driver(Chardev *chr)
 {
 }
 
-void replay_chr_be_write(Chardev *s, uint8_t *buf, int len)
+void replay_chr_be_write(Chardev *s, uint8_t *buf, size_t len)
 {
     abort();
 }
 
-void replay_char_write_event_save(int res, int offset)
+void replay_char_write_event_save(int res, size_t offset)
 {
     abort();
 }
 
-void replay_char_write_event_load(int *res, int *offset)
+void replay_char_write_event_load(int *res, size_t *offset)
 {
     abort();
 }

@@ -59,7 +59,7 @@ void replay_char_read_all_save_error(int res)
     abort();
 }
 
-void replay_char_read_all_save_buf(uint8_t *buf, int offset)
+void replay_char_read_all_save_buf(uint8_t *buf, size_t offset)
 {
     abort();
 }

index bb426fa4b1..900da2f935 100644
@@ -43,7 +43,7 @@ static gboolean fd_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     FDChardev *s = FD_CHARDEV(opaque);
-    int len;
+    size_t len;
     uint8_t buf[CHR_READ_BUF_LEN];
     ssize_t ret;
 

index e7c2b176f9..36c6b89cee 100644
@@ -31,7 +31,7 @@ typedef struct FDChardev {
     Chardev parent;
 
     QIOChannel *ioc_in, *ioc_out;
-    int max_size;
+    size_t max_size;
 } FDChardev;
 
 #define TYPE_CHARDEV_FD "chardev-fd"