diff --git a/MAINTAINERS b/MAINTAINERS
index 7df088259b..120788d8fb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1238,13 +1238,12 @@ M: Paolo Bonzini <pbonzini@redhat.com>
 M: Marc-André Lureau <marcandre.lureau@redhat.com>
 S: Maintained
 F: chardev/
-F: backends/msmouse.c
-F: backends/testdev.c
+F: include/chardev/
 
 Character Devices (Braille)
 M: Samuel Thibault <samuel.thibault@ens-lyon.org>
 S: Maintained
-F: backends/baum.c
+F: chardev/baum.c
 
 Command line option argument parsing
 M: Markus Armbruster <armbru@redhat.com>
diff --git a/Makefile.objs b/Makefile.objs
index 2100845ce2..0575802440 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -50,8 +50,6 @@ common-obj-$(CONFIG_LINUX) += fsdev/
 
 common-obj-y += migration/
 
-common-obj-$(CONFIG_SPICE) += spice-qemu-char.o
-
 common-obj-y += audio/
 common-obj-y += hw/
 common-obj-y += accel.o
@@ -70,6 +68,7 @@ common-obj-y += tpm.o
 common-obj-$(CONFIG_SLIRP) += slirp/
 
 common-obj-y += backends/
+common-obj-y += chardev/
 
 common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
 
@@ -121,6 +120,7 @@ trace-events-subdirs += io
 trace-events-subdirs += migration
 trace-events-subdirs += block
 trace-events-subdirs += backends
+trace-events-subdirs += chardev
 trace-events-subdirs += hw/block
 trace-events-subdirs += hw/block/dataplane
 trace-events-subdirs += hw/char
diff --git a/backends/Makefile.objs b/backends/Makefile.objs
index 0e0f1567b2..0400799efd 100644
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -1,10 +1,6 @@
 common-obj-y += rng.o rng-egd.o
 common-obj-$(CONFIG_POSIX) += rng-random.o
 
-common-obj-y += msmouse.o wctablet.o testdev.o
-common-obj-$(CONFIG_BRLAPI) += baum.o
-baum.o-cflags := $(SDL_CFLAGS)
-
 common-obj-$(CONFIG_TPM) += tpm.o
 
 common-obj-y += hostmem.o hostmem-ram.o
diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 380b19a0a1..e7ce2cac80 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -12,7 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "sysemu/rng.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 
@@ -145,7 +145,7 @@ static void rng_egd_finalize(Object *obj)
 {
     RngEgd *s = RNG_EGD(obj);
 
-    qemu_chr_fe_deinit(&s->chr);
+    qemu_chr_fe_deinit(&s->chr, false);
     g_free(s->chr_name);
 }
 
diff --git a/backends/trace-events b/backends/trace-events
index 8c3289a3f9..e69de29bb2 100644
--- a/backends/trace-events
+++ b/backends/trace-events
@@ -1,10 +0,0 @@
-# See docs/tracing.txt for syntax documentation.
-
-# backends/wctablet.c
-wct_init(void) ""
-wct_cmd_re(void) ""
-wct_cmd_st(void) ""
-wct_cmd_sp(void) ""
-wct_cmd_ts(int input) "0x%02x"
-wct_cmd_other(const char *cmd) "%s"
-wct_speed(int speed) "%d"
diff --git a/chardev/Makefile.objs b/chardev/Makefile.objs
index 1feda0f0ed..52a8127606 100644
--- a/chardev/Makefile.objs
+++ b/chardev/Makefile.objs
@@ -1,6 +1,7 @@
 chardev-obj-y += char.o
 chardev-obj-$(CONFIG_WIN32) += char-console.o
 chardev-obj-$(CONFIG_POSIX) += char-fd.o
+chardev-obj-y += char-fe.o
 chardev-obj-y += char-file.o
 chardev-obj-y += char-io.o
 chardev-obj-y += char-mux.o
@@ -15,3 +16,9 @@ chardev-obj-y += char-stdio.o
 chardev-obj-y += char-udp.o
 chardev-obj-$(CONFIG_WIN32) += char-win.o
 chardev-obj-$(CONFIG_WIN32) += char-win-stdio.o
+
+common-obj-y += msmouse.o wctablet.o testdev.o
+common-obj-$(CONFIG_BRLAPI) += baum.o
+baum.o-cflags := $(SDL_CFLAGS)
+
+common-obj-$(CONFIG_SPICE) += spice.o
diff --git a/backends/baum.c b/chardev/baum.c
similarity index 99%
rename from backends/baum.c
rename to chardev/baum.c
index 2eddcae119..302dd9666c 100644
--- a/backends/baum.c
+++ b/chardev/baum.c
@@ -24,7 +24,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qemu/timer.h"
 #include "hw/usb.h"
 #include "ui/console.h"
diff --git a/chardev/char-console.c b/chardev/char-console.c
index c824937fe6..535ed65136 100644
--- a/chardev/char-console.c
+++ b/chardev/char-console.c
@@ -22,14 +22,14 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "char-win.h"
+#include "chardev/char-win.h"
 
 static void qemu_chr_open_win_con(Chardev *chr,
                                   ChardevBackend *backend,
                                   bool *be_opened,
                                   Error **errp)
 {
-    qemu_chr_open_win_file(chr, GetStdHandle(STD_OUTPUT_HANDLE));
+    win_chr_set_file(chr, GetStdHandle(STD_OUTPUT_HANDLE), true);
 }
 
 static void char_console_class_init(ObjectClass *oc, void *data)
diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index 0b182c552c..1584a3de20 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -25,11 +25,11 @@
 #include "qemu/sockets.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "io/channel-file.h"
 
-#include "char-fd.h"
-#include "char-io.h"
+#include "chardev/char-fd.h"
+#include "chardev/char-io.h"
 
 /* Called with chr_write_lock held.  */
 static int fd_chr_write(Chardev *chr, const uint8_t *buf, int len)
diff --git a/chardev/char-fe.c b/chardev/char-fe.c
new file mode 100644
index 0000000000..3f90f0567c
--- /dev/null
+++ b/chardev/char-fe.c
@@ -0,0 +1,361 @@
+/*
+ * QEMU System Emulator
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "qapi-visit.h"
+#include "sysemu/replay.h"
+
+#include "chardev/char-fe.h"
+#include "chardev/char-io.h"
+#include "chardev/char-mux.h"
+
+int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
+{
+    Chardev *s = be->chr;
+
+    if (!s) {
+        return 0;
+    }
+
+    return qemu_chr_write(s, buf, len, false);
+}
+
+int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
+{
+    Chardev *s = be->chr;
+
+    if (!s) {
+        return 0;
+    }
+
+    return qemu_chr_write(s, buf, len, true);
+}
+
+int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len)
+{
+    Chardev *s = be->chr;
+    int offset = 0, counter = 10;
+    int res;
+
+    if (!s || !CHARDEV_GET_CLASS(s)->chr_sync_read) {
+        return 0;
+    }
+
+    if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
+        return replay_char_read_all_load(buf);
+    }
+
+    while (offset < len) {
+    retry:
+        res = CHARDEV_GET_CLASS(s)->chr_sync_read(s, buf + offset,
+                                                  len - offset);
+        if (res == -1 && errno == EAGAIN) {
+            g_usleep(100);
+            goto retry;
+        }
+
+        if (res == 0) {
+            break;
+        }
+
+        if (res < 0) {
+            if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
+                replay_char_read_all_save_error(res);
+            }
+            return res;
+        }
+
+        offset += res;
+
+        if (!counter--) {
+            break;
+        }
+    }
+
+    if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
+        replay_char_read_all_save_buf(buf, offset);
+    }
+    return offset;
+}
+
+int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg)
+{
+    Chardev *s = be->chr;
+    int res;
+
+    if (!s || !CHARDEV_GET_CLASS(s)->chr_ioctl || qemu_chr_replay(s)) {
+        res = -ENOTSUP;
+    } else {
+        res = CHARDEV_GET_CLASS(s)->chr_ioctl(s, cmd, arg);
+    }
+
+    return res;
+}
+
+int qemu_chr_fe_get_msgfd(CharBackend *be)
+{
+    Chardev *s = be->chr;
+    int fd;
+    int res = (qemu_chr_fe_get_msgfds(be, &fd, 1) == 1) ? fd : -1;
+    if (s && qemu_chr_replay(s)) {
+        error_report("Replay: get msgfd is not supported "
+                     "for serial devices yet");
+        exit(1);
+    }
+    return res;
+}
+
+int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int len)
+{
+    Chardev *s = be->chr;
+
+    if (!s) {
+        return -1;
+    }
+
+    return CHARDEV_GET_CLASS(s)->get_msgfds ?
+        CHARDEV_GET_CLASS(s)->get_msgfds(s, fds, len) : -1;
+}
+
+int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num)
+{
+    Chardev *s = be->chr;
+
+    if (!s) {
+        return -1;
+    }
+
+    return CHARDEV_GET_CLASS(s)->set_msgfds ?
+        CHARDEV_GET_CLASS(s)->set_msgfds(s, fds, num) : -1;
+}
+
+void qemu_chr_fe_accept_input(CharBackend *be)
+{
+    Chardev *s = be->chr;
+
+    if (!s) {
+        return;
+    }
+
+    if (CHARDEV_GET_CLASS(s)->chr_accept_input) {
+        CHARDEV_GET_CLASS(s)->chr_accept_input(s);
+    }
+    qemu_notify_event();
+}
+
+void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
+{
+    char buf[CHR_READ_BUF_LEN];
+    va_list ap;
+    va_start(ap, fmt);
+    vsnprintf(buf, sizeof(buf), fmt, ap);
+    /* XXX this blocks entire thread. Rewrite to use
+     * qemu_chr_fe_write and background I/O callbacks */
+    qemu_chr_fe_write_all(be, (uint8_t *)buf, strlen(buf));
+    va_end(ap);
+}
+
+Chardev *qemu_chr_fe_get_driver(CharBackend *be)
+{
+    return be->chr;
+}
+
+bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp)
+{
+    int tag = 0;
+
+    if (CHARDEV_IS_MUX(s)) {
+        MuxChardev *d = MUX_CHARDEV(s);
+
+        if (d->mux_cnt >= MAX_MUX) {
+            goto unavailable;
+        }
+
+        d->backends[d->mux_cnt] = b;
+        tag = d->mux_cnt++;
+    } else if (s->be) {
+        goto unavailable;
+    } else {
+        s->be = b;
+    }
+
+    b->fe_open = false;
+    b->tag = tag;
+    b->chr = s;
+    return true;
+
+unavailable:
+    error_setg(errp, QERR_DEVICE_IN_USE, s->label);
+    return false;
+}
+
+void qemu_chr_fe_deinit(CharBackend *b, bool del)
+{
+    assert(b);
+
+    if (b->chr) {
+        qemu_chr_fe_set_handlers(b, NULL, NULL, NULL, NULL, NULL, true);
+        if (b->chr->be == b) {
+            b->chr->be = NULL;
+        }
+        if (CHARDEV_IS_MUX(b->chr)) {
+            MuxChardev *d = MUX_CHARDEV(b->chr);
+            d->backends[b->tag] = NULL;
+        }
+        if (del) {
+            object_unparent(OBJECT(b->chr));
+        }
+        b->chr = NULL;
+    }
+}
+
+void qemu_chr_fe_set_handlers(CharBackend *b,
+                              IOCanReadHandler *fd_can_read,
+                              IOReadHandler *fd_read,
+                              IOEventHandler *fd_event,
+                              void *opaque,
+                              GMainContext *context,
+                              bool set_open)
+{
+    Chardev *s;
+    ChardevClass *cc;
+    int fe_open;
+
+    s = b->chr;
+    if (!s) {
+        return;
+    }
+
+    cc = CHARDEV_GET_CLASS(s);
+    if (!opaque && !fd_can_read && !fd_read && !fd_event) {
+        fe_open = 0;
+        remove_fd_in_watch(s);
+    } else {
+        fe_open = 1;
+    }
+    b->chr_can_read = fd_can_read;
+    b->chr_read = fd_read;
+    b->chr_event = fd_event;
+    b->opaque = opaque;
+    if (cc->chr_update_read_handler) {
+        cc->chr_update_read_handler(s, context);
+    }
+
+    if (set_open) {
+        qemu_chr_fe_set_open(b, fe_open);
+    }
+
+    if (fe_open) {
+        qemu_chr_fe_take_focus(b);
+        /* We're connecting to an already opened device, so let's make sure we
+           also get the open event */
+        if (s->be_open) {
+            qemu_chr_be_event(s, CHR_EVENT_OPENED);
+        }
+    }
+
+    if (CHARDEV_IS_MUX(s)) {
+        mux_chr_set_handlers(s, context);
+    }
+}
+
+void qemu_chr_fe_take_focus(CharBackend *b)
+{
+    if (!b->chr) {
+        return;
+    }
+
+    if (CHARDEV_IS_MUX(b->chr)) {
+        mux_set_focus(b->chr, b->tag);
+    }
+}
+
+int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp)
+{
+    if (!be->chr) {
+        error_setg(errp, "missing associated backend");
+        return -1;
+    }
+
+    return qemu_chr_wait_connected(be->chr, errp);
+}
+
+void qemu_chr_fe_set_echo(CharBackend *be, bool echo)
+{
+    Chardev *chr = be->chr;
+
+    if (chr && CHARDEV_GET_CLASS(chr)->chr_set_echo) {
+        CHARDEV_GET_CLASS(chr)->chr_set_echo(chr, echo);
+    }
+}
+
+void qemu_chr_fe_set_open(CharBackend *be, int fe_open)
+{
+    Chardev *chr = be->chr;
+
+    if (!chr) {
+        return;
+    }
+
+    if (be->fe_open == fe_open) {
+        return;
+    }
+    be->fe_open = fe_open;
+    if (CHARDEV_GET_CLASS(chr)->chr_set_fe_open) {
+        CHARDEV_GET_CLASS(chr)->chr_set_fe_open(chr, fe_open);
+    }
+}
+
+guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
+                            GIOFunc func, void *user_data)
+{
+    Chardev *s = be->chr;
+    GSource *src;
+    guint tag;
+
+    if (!s || CHARDEV_GET_CLASS(s)->chr_add_watch == NULL) {
+        return 0;
+    }
+
+    src = CHARDEV_GET_CLASS(s)->chr_add_watch(s, cond);
+    if (!src) {
+        return 0;
+    }
+
+    g_source_set_callback(src, (GSourceFunc)func, user_data, NULL);
+    tag = g_source_attach(src, NULL);
+    g_source_unref(src);
+
+    return tag;
+}
+
+void qemu_chr_fe_disconnect(CharBackend *be)
+{
+    Chardev *chr = be->chr;
+
+    if (chr && CHARDEV_GET_CLASS(chr)->chr_disconnect) {
+        CHARDEV_GET_CLASS(chr)->chr_disconnect(chr);
+    }
+}
diff --git a/chardev/char-file.c b/chardev/char-file.c
index 8bae25350d..a57b88aaf2 100644
--- a/chardev/char-file.c
+++ b/chardev/char-file.c
@@ -24,12 +24,12 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 #ifdef _WIN32
-#include "char-win.h"
+#include "chardev/char-win.h"
 #else
-#include "char-fd.h"
+#include "chardev/char-fd.h"
 #endif
 
 static void qmp_chardev_open_file(Chardev *chr,
@@ -65,7 +65,7 @@ static void qmp_chardev_open_file(Chardev *chr,
         return;
     }
 
-    qemu_chr_open_win_file(chr, out);
+    win_chr_set_file(chr, out, false);
 #else
     int flags, in = -1, out;
 
diff --git a/chardev/char-io.c b/chardev/char-io.c
index b5708eef45..f81052481a 100644
--- a/chardev/char-io.c
+++ b/chardev/char-io.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "char-io.h"
+#include "chardev/char-io.h"
 
 typedef struct IOWatchPoll {
     GSource parent;
diff --git a/chardev/char-mux.c b/chardev/char-mux.c
index 37d42c65c6..08570b915e 100644
--- a/chardev/char-mux.c
+++ b/chardev/char-mux.c
@@ -24,9 +24,9 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "sysemu/block-backend.h"
-#include "char-mux.h"
+#include "chardev/char-mux.h"
 
 /* MUX driver for serial I/O splitting */
 
@@ -266,7 +266,7 @@ static void char_mux_finalize(Object *obj)
             be->chr = NULL;
         }
     }
-    qemu_chr_fe_deinit(&d->chr);
+    qemu_chr_fe_deinit(&d->chr, false);
 }
 
 void mux_chr_set_handlers(Chardev *chr, GMainContext *context)
diff --git a/chardev/char-null.c b/chardev/char-null.c
index dc0d68ab2d..90bafe76f4 100644
--- a/chardev/char-null.c
+++ b/chardev/char-null.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 static void null_chr_open(Chardev *chr,
                           ChardevBackend *backend,
diff --git a/chardev/char-parallel.c b/chardev/char-parallel.c
index 3fa22ce29d..bce89f8c36 100644
--- a/chardev/char-parallel.c
+++ b/chardev/char-parallel.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qapi/error.h"
 #include <sys/ioctl.h>
 
@@ -41,8 +41,8 @@
 #endif
 #endif
 
-#include "char-fd.h"
-#include "char-parallel.h"
+#include "chardev/char-fd.h"
+#include "chardev/char-parallel.h"
 
 #if defined(__linux__)
 
diff --git a/chardev/char-pipe.c b/chardev/char-pipe.c
index 54240c863d..3a95e4c1b2 100644
--- a/chardev/char-pipe.c
+++ b/chardev/char-pipe.c
@@ -23,12 +23,12 @@
  */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 #ifdef _WIN32
-#include "char-win.h"
+#include "chardev/char-win.h"
 #else
-#include "char-fd.h"
+#include "chardev/char-fd.h"
 #endif
 
 #ifdef _WIN32
@@ -58,27 +58,27 @@ static int win_chr_pipe_init(Chardev *chr, const char *filename,
     }
 
     openname = g_strdup_printf("\\\\.\\pipe\\%s", filename);
-    s->hcom = CreateNamedPipe(openname,
+    s->file = CreateNamedPipe(openname,
                               PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
                               PIPE_TYPE_BYTE | PIPE_READMODE_BYTE |
                               PIPE_WAIT,
                               MAXCONNECT, NSENDBUF, NRECVBUF, NTIMEOUT, NULL);
     g_free(openname);
-    if (s->hcom == INVALID_HANDLE_VALUE) {
+    if (s->file == INVALID_HANDLE_VALUE) {
         error_setg(errp, "Failed CreateNamedPipe (%lu)", GetLastError());
-        s->hcom = NULL;
+        s->file = NULL;
         goto fail;
     }
 
     ZeroMemory(&ov, sizeof(ov));
     ov.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
-    ret = ConnectNamedPipe(s->hcom, &ov);
+    ret = ConnectNamedPipe(s->file, &ov);
     if (ret) {
         error_setg(errp, "Failed ConnectNamedPipe");
         goto fail;
     }
 
-    ret = GetOverlappedResult(s->hcom, &ov, &size, TRUE);
+    ret = GetOverlappedResult(s->file, &ov, &size, TRUE);
     if (!ret) {
         error_setg(errp, "Failed GetOverlappedResult");
         if (ov.hEvent) {
diff --git a/chardev/char-pty.c b/chardev/char-pty.c
index 35a175d796..e5d20a0e6a 100644
--- a/chardev/char-pty.c
+++ b/chardev/char-pty.c
@@ -24,12 +24,12 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "io/channel-file.h"
 #include "qemu/sockets.h"
 #include "qemu/error-report.h"
 
-#include "char-io.h"
+#include "chardev/char-io.h"
 
 #if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)      \
     || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) \
diff --git a/chardev/char-ringbuf.c b/chardev/char-ringbuf.c
index d130069e88..df52b04d22 100644
--- a/chardev/char-ringbuf.c
+++ b/chardev/char-ringbuf.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qmp-commands.h"
 #include "qemu/base64.h"
 
diff --git a/chardev/char-serial.c b/chardev/char-serial.c
index 094e08dca5..2f8f83821d 100644
--- a/chardev/char-serial.c
+++ b/chardev/char-serial.c
@@ -27,14 +27,14 @@
 #include "qapi/error.h"
 
 #ifdef _WIN32
-#include "char-win.h"
+#include "chardev/char-win.h"
 #else
 #include <sys/ioctl.h>
 #include <termios.h>
-#include "char-fd.h"
+#include "chardev/char-fd.h"
 #endif
 
-#include "char-serial.h"
+#include "chardev/char-serial.h"
 
 #ifdef _WIN32
 
@@ -45,7 +45,7 @@ static void qmp_chardev_open_serial(Chardev *chr,
 {
     ChardevHostdev *serial = backend->u.serial.data;
 
-    win_chr_init(chr, serial->device, errp);
+    win_chr_serial_init(chr, serial->device, errp);
 }
 
 #elif defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)      \
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index e2fb7f7cd5..ccc499cfa1 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -22,14 +22,14 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "io/channel-socket.h"
 #include "io/channel-tls.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qapi/clone-visitor.h"
 
-#include "char-io.h"
+#include "chardev/char-io.h"
 
 /***********************************************************/
 /* TCP Net console */
diff --git a/chardev/char-stdio.c b/chardev/char-stdio.c
index be4a65962c..6f5d798d7b 100644
--- a/chardev/char-stdio.c
+++ b/chardev/char-stdio.c
@@ -25,14 +25,14 @@
 #include "qemu/sockets.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 #ifdef _WIN32
-#include "char-win.h"
-#include "char-win-stdio.h"
+#include "chardev/char-win.h"
+#include "chardev/char-win-stdio.h"
 #else
 #include <termios.h>
-#include "char-fd.h"
+#include "chardev/char-fd.h"
 #endif
 
 #ifndef _WIN32
diff --git a/chardev/char-udp.c b/chardev/char-udp.c
index 607647642a..4ee11d3ebf 100644
--- a/chardev/char-udp.c
+++ b/chardev/char-udp.c
@@ -22,11 +22,11 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "io/channel-socket.h"
 #include "qapi/error.h"
 
-#include "char-io.h"
+#include "chardev/char-io.h"
 
 /***********************************************************/
 /* UDP Net console */
diff --git a/chardev/char-win-stdio.c b/chardev/char-win-stdio.c
index eb44afc17a..efcf7827eb 100644
--- a/chardev/char-win-stdio.c
+++ b/chardev/char-win-stdio.c
@@ -23,8 +23,8 @@
  */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "char-win.h"
-#include "char-win-stdio.h"
+#include "chardev/char-win.h"
+#include "chardev/char-win-stdio.h"
 
 typedef struct {
     Chardev parent;
diff --git a/chardev/char-win.c b/chardev/char-win.c
index e4b6957ded..05518e0958 100644
--- a/chardev/char-win.c
+++ b/chardev/char-win.c
@@ -24,23 +24,30 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qapi/error.h"
-#include "char-win.h"
+#include "chardev/char-win.h"
 
-static void win_chr_readfile(Chardev *chr)
+static void win_chr_read(Chardev *chr, DWORD len)
 {
     WinChardev *s = WIN_CHARDEV(chr);
-
+    int max_size = qemu_chr_be_can_write(chr);
     int ret, err;
     uint8_t buf[CHR_READ_BUF_LEN];
     DWORD size;
 
+    if (len > max_size) {
+        len = max_size;
+    }
+    if (len == 0) {
+        return;
+    }
+
     ZeroMemory(&s->orecv, sizeof(s->orecv));
     s->orecv.hEvent = s->hrecv;
-    ret = ReadFile(s->hcom, buf, s->len, &size, &s->orecv);
+    ret = ReadFile(s->file, buf, len, &size, &s->orecv);
     if (!ret) {
         err = GetLastError();
         if (err == ERROR_IO_PENDING) {
-            ret = GetOverlappedResult(s->hcom, &s->orecv, &size, TRUE);
+            ret = GetOverlappedResult(s->file, &s->orecv, &size, TRUE);
         }
     }
 
@@ -49,46 +56,22 @@ static void win_chr_readfile(Chardev *chr)
     }
 }
 
-static void win_chr_read(Chardev *chr)
-{
-    WinChardev *s = WIN_CHARDEV(chr);
-
-    if (s->len > s->max_size) {
-        s->len = s->max_size;
-    }
-    if (s->len == 0) {
-        return;
-    }
-
-    win_chr_readfile(chr);
-}
-
-static int win_chr_read_poll(Chardev *chr)
-{
-    WinChardev *s = WIN_CHARDEV(chr);
-
-    s->max_size = qemu_chr_be_can_write(chr);
-    return s->max_size;
-}
-
-static int win_chr_poll(void *opaque)
+static int win_chr_serial_poll(void *opaque)
 {
     Chardev *chr = CHARDEV(opaque);
     WinChardev *s = WIN_CHARDEV(opaque);
     COMSTAT status;
     DWORD comerr;
 
-    ClearCommError(s->hcom, &comerr, &status);
+    ClearCommError(s->file, &comerr, &status);
     if (status.cbInQue > 0) {
-        s->len = status.cbInQue;
-        win_chr_read_poll(chr);
-        win_chr_read(chr);
+        win_chr_read(chr, status.cbInQue);
         return 1;
     }
     return 0;
 }
 
-int win_chr_init(Chardev *chr, const char *filename, Error **errp)
+int win_chr_serial_init(Chardev *chr, const char *filename, Error **errp)
 {
     WinChardev *s = WIN_CHARDEV(chr);
     COMMCONFIG comcfg;
@@ -108,15 +91,15 @@ int win_chr_init(Chardev *chr, const char *filename, Error **errp)
         goto fail;
     }
 
-    s->hcom = CreateFile(filename, GENERIC_READ | GENERIC_WRITE, 0, NULL,
+    s->file = CreateFile(filename, GENERIC_READ | GENERIC_WRITE, 0, NULL,
                       OPEN_EXISTING, FILE_FLAG_OVERLAPPED, 0);
-    if (s->hcom == INVALID_HANDLE_VALUE) {
+    if (s->file == INVALID_HANDLE_VALUE) {
         error_setg(errp, "Failed CreateFile (%lu)", GetLastError());
-        s->hcom = NULL;
+        s->file = NULL;
         goto fail;
     }
 
-    if (!SetupComm(s->hcom, NRECVBUF, NSENDBUF)) {
+    if (!SetupComm(s->file, NRECVBUF, NSENDBUF)) {
         error_setg(errp, "Failed SetupComm");
         goto fail;
     }
@@ -127,27 +110,27 @@ int win_chr_init(Chardev *chr, const char *filename, Error **errp)
     comcfg.dcb.DCBlength = sizeof(DCB);
     CommConfigDialog(filename, NULL, &comcfg);
 
-    if (!SetCommState(s->hcom, &comcfg.dcb)) {
+    if (!SetCommState(s->file, &comcfg.dcb)) {
         error_setg(errp, "Failed SetCommState");
         goto fail;
     }
 
-    if (!SetCommMask(s->hcom, EV_ERR)) {
+    if (!SetCommMask(s->file, EV_ERR)) {
         error_setg(errp, "Failed SetCommMask");
         goto fail;
     }
 
     cto.ReadIntervalTimeout = MAXDWORD;
-    if (!SetCommTimeouts(s->hcom, &cto)) {
+    if (!SetCommTimeouts(s->file, &cto)) {
         error_setg(errp, "Failed SetCommTimeouts");
         goto fail;
     }
 
-    if (!ClearCommError(s->hcom, &err, &comstat)) {
+    if (!ClearCommError(s->file, &err, &comstat)) {
         error_setg(errp, "Failed ClearCommError");
         goto fail;
     }
-    qemu_add_polling_cb(win_chr_poll, chr);
+    qemu_add_polling_cb(win_chr_serial_poll, chr);
     return 0;
 
  fail:
@@ -160,11 +143,9 @@ int win_chr_pipe_poll(void *opaque)
     WinChardev *s = WIN_CHARDEV(opaque);
     DWORD size;
 
-    PeekNamedPipe(s->hcom, NULL, 0, NULL, &size, NULL);
+    PeekNamedPipe(s->file, NULL, 0, NULL, &size, NULL);
     if (size > 0) {
-        s->len = size;
-        win_chr_read_poll(chr);
-        win_chr_read(chr);
+        win_chr_read(chr, size);
         return 1;
     }
     return 0;
@@ -181,14 +162,14 @@ static int win_chr_write(Chardev *chr, const uint8_t *buf, int len1)
     s->osend.hEvent = s->hsend;
     while (len > 0) {
         if (s->hsend) {
-            ret = WriteFile(s->hcom, buf, len, &size, &s->osend);
+            ret = WriteFile(s->file, buf, len, &size, &s->osend);
         } else {
-            ret = WriteFile(s->hcom, buf, len, &size, NULL);
+            ret = WriteFile(s->file, buf, len, &size, NULL);
         }
         if (!ret) {
             err = GetLastError();
             if (err == ERROR_IO_PENDING) {
-                ret = GetOverlappedResult(s->hcom, &s->osend, &size, TRUE);
+                ret = GetOverlappedResult(s->file, &s->osend, &size, TRUE);
                 if (ret) {
                     buf += size;
                     len -= size;
@@ -211,34 +192,30 @@ static void char_win_finalize(Object *obj)
     Chardev *chr = CHARDEV(obj);
     WinChardev *s = WIN_CHARDEV(chr);
 
-    if (s->skip_free) {
-        return;
-    }
-
     if (s->hsend) {
         CloseHandle(s->hsend);
     }
     if (s->hrecv) {
         CloseHandle(s->hrecv);
     }
-    if (s->hcom) {
-        CloseHandle(s->hcom);
+    if (!s->keep_open && s->file) {
+        CloseHandle(s->file);
     }
     if (s->fpipe) {
         qemu_del_polling_cb(win_chr_pipe_poll, chr);
     } else {
-        qemu_del_polling_cb(win_chr_poll, chr);
+        qemu_del_polling_cb(win_chr_serial_poll, chr);
     }
 
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 }
 
-void qemu_chr_open_win_file(Chardev *chr, HANDLE fd_out)
+void win_chr_set_file(Chardev *chr, HANDLE file, bool keep_open)
 {
     WinChardev *s = WIN_CHARDEV(chr);
 
-    s->skip_free = true;
-    s->hcom = fd_out;
+    s->keep_open = keep_open;
+    s->file = file;
 }
 
 static void char_win_class_init(ObjectClass *oc, void *data)
diff --git a/chardev/char.c b/chardev/char.c
index 4e24dc39af..7aa0210765 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -22,22 +22,18 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "monitor/monitor.h"
 #include "sysemu/sysemu.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qmp-commands.h"
 #include "qapi-visit.h"
 #include "sysemu/replay.h"
 #include "qemu/help_option.h"
 
-#include "char-mux.h"
-#include "char-io.h"
-#include "char-parallel.h"
-#include "char-serial.h"
+#include "chardev/char-mux.h"
 
 /***********************************************************/
 /* character device */
@@ -70,8 +66,7 @@ void qemu_chr_be_event(Chardev *s, int event)
 
 /* Not reporting errors from writing to logfile, as logs are
  * defined to be "best effort" only */
-static void qemu_chr_fe_write_log(Chardev *s,
-                                  const uint8_t *buf, size_t len)
+static void qemu_chr_write_log(Chardev *s, const uint8_t *buf, size_t len)
 {
     size_t done = 0;
     ssize_t ret;
@@ -95,8 +90,9 @@ static void qemu_chr_fe_write_log(Chardev *s,
     }
 }
 
-static int qemu_chr_fe_write_buffer(Chardev *s,
-                                    const uint8_t *buf, int len, int *offset)
+static int qemu_chr_write_buffer(Chardev *s,
+                                 const uint8_t *buf, int len,
+                                 int *offset, bool write_all)
 {
     ChardevClass *cc = CHARDEV_GET_CLASS(s);
     int res = 0;
@@ -106,7 +102,7 @@ static int qemu_chr_fe_write_buffer(Chardev *s,
     while (*offset < len) {
     retry:
         res = cc->chr_write(s, buf + *offset, len - *offset);
-        if (res < 0 && errno == EAGAIN) {
+        if (res < 0 && errno == EAGAIN && write_all) {
             g_usleep(100);
             goto retry;
         }
@@ -116,68 +112,31 @@ static int qemu_chr_fe_write_buffer(Chardev *s,
         }
 
         *offset += res;
+        if (!write_all) {
+            break;
+        }
     }
     if (*offset > 0) {
-        qemu_chr_fe_write_log(s, buf, *offset);
+        qemu_chr_write_log(s, buf, *offset);
     }
     qemu_mutex_unlock(&s->chr_write_lock);
 
     return res;
 }
 
-static bool qemu_chr_replay(Chardev *chr)
+int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
 {
-    return qemu_chr_has_feature(chr, QEMU_CHAR_FEATURE_REPLAY);
-}
-
-int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
-{
-    Chardev *s = be->chr;
-    ChardevClass *cc;
-    int ret;
-
-    if (!s) {
-        return 0;
-    }
-
-    if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
-        int offset;
-        replay_char_write_event_load(&ret, &offset);
-        assert(offset <= len);
-        qemu_chr_fe_write_buffer(s, buf, offset, &offset);
-        return ret;
-    }
-
-    cc = CHARDEV_GET_CLASS(s);
-    qemu_mutex_lock(&s->chr_write_lock);
-    ret = cc->chr_write(s, buf, len);
-
-    if (ret > 0) {
-        qemu_chr_fe_write_log(s, buf, ret);
-    }
-
-    qemu_mutex_unlock(&s->chr_write_lock);
-    
-    if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
-        replay_char_write_event_save(ret, ret < 0 ? 0 : ret);
-    }
-    
-    return ret;
-}
-
-int qemu_chr_write_all(Chardev *s, const uint8_t *buf, int len)
-{
-    int offset;
+    int offset = 0;
     int res;
 
     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
         replay_char_write_event_load(&res, &offset);
         assert(offset <= len);
-        qemu_chr_fe_write_buffer(s, buf, offset, &offset);
+        qemu_chr_write_buffer(s, buf, offset, &offset, true);
         return res;
     }
 
-    res = qemu_chr_fe_write_buffer(s, buf, len, &offset);
+    res = qemu_chr_write_buffer(s, buf, len, &offset, write_all);
 
     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
         replay_char_write_event_save(res, offset);
@@ -189,78 +148,6 @@ int qemu_chr_write_all(Chardev *s, const uint8_t *buf, int len)
     return offset;
 }
 
-int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
-{
-    Chardev *s = be->chr;
-
-    if (!s) {
-        return 0;
-    }
-
-    return qemu_chr_write_all(s, buf, len);
-}
-
-int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len)
-{
-    Chardev *s = be->chr;
-    int offset = 0, counter = 10;
-    int res;
-
-    if (!s || !CHARDEV_GET_CLASS(s)->chr_sync_read) {
-        return 0;
-    }
-
-    if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
-        return replay_char_read_all_load(buf);
-    }
-
-    while (offset < len) {
-    retry:
-        res = CHARDEV_GET_CLASS(s)->chr_sync_read(s, buf + offset,
-                                                  len - offset);
-        if (res == -1 && errno == EAGAIN) {
-            g_usleep(100);
-            goto retry;
-        }
-
-        if (res == 0) {
-            break;
-        }
-
-        if (res < 0) {
-            if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
-                replay_char_read_all_save_error(res);
-            }
-            return res;
-        }
-
-        offset += res;
-
-        if (!counter--) {
-            break;
-        }
-    }
-
-    if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
-        replay_char_read_all_save_buf(buf, offset);
-    }
-    return offset;
-}
-
-int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg)
-{
-    Chardev *s = be->chr;
-    int res;
-
-    if (!s || !CHARDEV_GET_CLASS(s)->chr_ioctl || qemu_chr_replay(s)) {
-        res = -ENOTSUP;
-    } else {
-        res = CHARDEV_GET_CLASS(s)->chr_ioctl(s, cmd, arg);
-    }
-
-    return res;
-}
-
 int qemu_chr_be_can_write(Chardev *s)
 {
     CharBackend *be = s->be;
@@ -293,75 +180,12 @@ void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len)
     }
 }
 
-int qemu_chr_fe_get_msgfd(CharBackend *be)
-{
-    Chardev *s = be->chr;
-    int fd;
-    int res = (qemu_chr_fe_get_msgfds(be, &fd, 1) == 1) ? fd : -1;
-    if (s && qemu_chr_replay(s)) {
-        error_report("Replay: get msgfd is not supported "
-                     "for serial devices yet");
-        exit(1);
-    }
-    return res;
-}
-
-int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int len)
-{
-    Chardev *s = be->chr;
-
-    if (!s) {
-        return -1;
-    }
-
-    return CHARDEV_GET_CLASS(s)->get_msgfds ?
-        CHARDEV_GET_CLASS(s)->get_msgfds(s, fds, len) : -1;
-}
-
-int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num)
-{
-    Chardev *s = be->chr;
-
-    if (!s) {
-        return -1;
-    }
-
-    return CHARDEV_GET_CLASS(s)->set_msgfds ?
-        CHARDEV_GET_CLASS(s)->set_msgfds(s, fds, num) : -1;
-}
-
 int qemu_chr_add_client(Chardev *s, int fd)
 {
     return CHARDEV_GET_CLASS(s)->chr_add_client ?
         CHARDEV_GET_CLASS(s)->chr_add_client(s, fd) : -1;
 }
 
-void qemu_chr_fe_accept_input(CharBackend *be)
-{
-    Chardev *s = be->chr;
-
-    if (!s) {
-        return;
-    }
-
-    if (CHARDEV_GET_CLASS(s)->chr_accept_input) {
-        CHARDEV_GET_CLASS(s)->chr_accept_input(s);
-    }
-    qemu_notify_event();
-}
-
-void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
-{
-    char buf[CHR_READ_BUF_LEN];
-    va_list ap;
-    va_start(ap, fmt);
-    vsnprintf(buf, sizeof(buf), fmt, ap);
-    /* XXX this blocks entire thread. Rewrite to use
-     * qemu_chr_fe_write and background I/O callbacks */
-    qemu_chr_fe_write_all(be, (uint8_t *)buf, strlen(buf));
-    va_end(ap);
-}
-
 static void qemu_char_open(Chardev *chr, ChardevBackend *backend,
                            bool *be_opened, Error **errp)
 {
@@ -473,40 +297,6 @@ static Notifier muxes_realize_notify = {
     .notify = muxes_realize_done,
 };
 
-Chardev *qemu_chr_fe_get_driver(CharBackend *be)
-{
-    return be->chr;
-}
-
-bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp)
-{
-    int tag = 0;
-
-    if (CHARDEV_IS_MUX(s)) {
-        MuxChardev *d = MUX_CHARDEV(s);
-
-        if (d->mux_cnt >= MAX_MUX) {
-            goto unavailable;
-        }
-
-        d->backends[d->mux_cnt] = b;
-        tag = d->mux_cnt++;
-    } else if (s->be) {
-        goto unavailable;
-    } else {
-        s->be = b;
-    }
-
-    b->fe_open = false;
-    b->tag = tag;
-    b->chr = s;
-    return true;
-
-unavailable:
-    error_setg(errp, QERR_DEVICE_IN_USE, s->label);
-    return false;
-}
-
 static bool qemu_chr_is_busy(Chardev *s)
 {
     if (CHARDEV_IS_MUX(s)) {
@@ -517,84 +307,6 @@ static bool qemu_chr_is_busy(Chardev *s)
     }
 }
 
-void qemu_chr_fe_deinit(CharBackend *b)
-{
-    assert(b);
-
-    if (b->chr) {
-        qemu_chr_fe_set_handlers(b, NULL, NULL, NULL, NULL, NULL, true);
-        if (b->chr->be == b) {
-            b->chr->be = NULL;
-        }
-        if (CHARDEV_IS_MUX(b->chr)) {
-            MuxChardev *d = MUX_CHARDEV(b->chr);
-            d->backends[b->tag] = NULL;
-        }
-        b->chr = NULL;
-    }
-}
-
-void qemu_chr_fe_set_handlers(CharBackend *b,
-                              IOCanReadHandler *fd_can_read,
-                              IOReadHandler *fd_read,
-                              IOEventHandler *fd_event,
-                              void *opaque,
-                              GMainContext *context,
-                              bool set_open)
-{
-    Chardev *s;
-    ChardevClass *cc;
-    int fe_open;
-
-    s = b->chr;
-    if (!s) {
-        return;
-    }
-
-    cc = CHARDEV_GET_CLASS(s);
-    if (!opaque && !fd_can_read && !fd_read && !fd_event) {
-        fe_open = 0;
-        remove_fd_in_watch(s);
-    } else {
-        fe_open = 1;
-    }
-    b->chr_can_read = fd_can_read;
-    b->chr_read = fd_read;
-    b->chr_event = fd_event;
-    b->opaque = opaque;
-    if (cc->chr_update_read_handler) {
-        cc->chr_update_read_handler(s, context);
-    }
-
-    if (set_open) {
-        qemu_chr_fe_set_open(b, fe_open);
-    }
-
-    if (fe_open) {
-        qemu_chr_fe_take_focus(b);
-        /* We're connecting to an already opened device, so let's make sure we
-           also get the open event */
-        if (s->be_open) {
-            qemu_chr_be_event(s, CHR_EVENT_OPENED);
-        }
-    }
-
-    if (CHARDEV_IS_MUX(s)) {
-        mux_chr_set_handlers(s, context);
-    }
-}
-
-void qemu_chr_fe_take_focus(CharBackend *b)
-{
-    if (!b->chr) {
-        return;
-    }
-
-    if (CHARDEV_IS_MUX(b->chr)) {
-        mux_set_focus(b->chr, b->tag);
-    }
-}
-
 int qemu_chr_wait_connected(Chardev *chr, Error **errp)
 {
     ChardevClass *cc = CHARDEV_GET_CLASS(chr);
@@ -606,16 +318,6 @@ int qemu_chr_wait_connected(Chardev *chr, Error **errp)
     return 0;
 }
 
-int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp)
-{
-    if (!be->chr) {
-        error_setg(errp, "missing associated backend");
-        return -1;
-    }
-
-    return qemu_chr_wait_connected(be->chr, errp);
-}
-
 QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename)
 {
     char host[65], port[33], width[8], height[8];
@@ -841,7 +543,7 @@ chardev_name_foreach(void (*fn)(const char *name, void *opaque), void *opaque)
 
     object_class_foreach(chardev_class_foreach, TYPE_CHARDEV, false, &fe);
 
-    for (i = 0; i < ARRAY_SIZE(chardev_alias_table); i++) {
+    for (i = 0; i < (int)ARRAY_SIZE(chardev_alias_table); i++) {
         fn(chardev_alias_table[i].alias, opaque);
     }
 }
@@ -887,7 +589,7 @@ Chardev *qemu_chr_new_from_opts(QemuOpts *opts,
         return NULL;
     }
 
-    for (i = 0; i < ARRAY_SIZE(chardev_alias_table); i++) {
+    for (i = 0; i < (int)ARRAY_SIZE(chardev_alias_table); i++) {
         if (g_strcmp0(chardev_alias_table[i].alias, name) == 0) {
             name = chardev_alias_table[i].typename;
             break;
@@ -992,64 +694,6 @@ Chardev *qemu_chr_new(const char *label, const char *filename)
     return chr;
 }
 
-void qemu_chr_fe_set_echo(CharBackend *be, bool echo)
-{
-    Chardev *chr = be->chr;
-
-    if (chr && CHARDEV_GET_CLASS(chr)->chr_set_echo) {
-        CHARDEV_GET_CLASS(chr)->chr_set_echo(chr, echo);
-    }
-}
-
-void qemu_chr_fe_set_open(CharBackend *be, int fe_open)
-{
-    Chardev *chr = be->chr;
-
-    if (!chr) {
-        return;
-    }
-
-    if (be->fe_open == fe_open) {
-        return;
-    }
-    be->fe_open = fe_open;
-    if (CHARDEV_GET_CLASS(chr)->chr_set_fe_open) {
-        CHARDEV_GET_CLASS(chr)->chr_set_fe_open(chr, fe_open);
-    }
-}
-
-guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
-                            GIOFunc func, void *user_data)
-{
-    Chardev *s = be->chr;
-    GSource *src;
-    guint tag;
-
-    if (!s || CHARDEV_GET_CLASS(s)->chr_add_watch == NULL) {
-        return 0;
-    }
-
-    src = CHARDEV_GET_CLASS(s)->chr_add_watch(s, cond);
-    if (!src) {
-        return 0;
-    }
-
-    g_source_set_callback(src, (GSourceFunc)func, user_data, NULL);
-    tag = g_source_attach(src, NULL);
-    g_source_unref(src);
-
-    return tag;
-}
-
-void qemu_chr_fe_disconnect(CharBackend *be)
-{
-    Chardev *chr = be->chr;
-
-    if (chr && CHARDEV_GET_CLASS(chr)->chr_disconnect) {
-        CHARDEV_GET_CLASS(chr)->chr_disconnect(chr);
-    }
-}
-
 static int qmp_query_chardev_foreach(Object *obj, void *data)
 {
     Chardev *chr = CHARDEV(obj);
diff --git a/backends/msmouse.c b/chardev/msmouse.c
similarity index 99%
rename from backends/msmouse.c
rename to chardev/msmouse.c
index d2c3162f1e..0ffd137ce8 100644
--- a/backends/msmouse.c
+++ b/chardev/msmouse.c
@@ -23,7 +23,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "ui/console.h"
 #include "ui/input.h"
 
diff --git a/spice-qemu-char.c b/chardev/spice.c
similarity index 99%
rename from spice-qemu-char.c
rename to chardev/spice.c
index 4d1c76e8a4..a312078812 100644
--- a/spice-qemu-char.c
+++ b/chardev/spice.c
@@ -1,7 +1,7 @@
 #include "qemu/osdep.h"
-#include "trace-root.h"
+#include "trace.h"
 #include "ui/qemu-spice.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qemu/error-report.h"
 #include <spice.h>
 #include <spice/protocol.h>
diff --git a/backends/testdev.c b/chardev/testdev.c
similarity index 99%
rename from backends/testdev.c
rename to chardev/testdev.c
index 7df9248a13..031e9a23e8 100644
--- a/backends/testdev.c
+++ b/chardev/testdev.c
@@ -25,7 +25,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 #define BUF_SIZE 32
 
diff --git a/chardev/trace-events b/chardev/trace-events
new file mode 100644
index 0000000000..822dde668b
--- /dev/null
+++ b/chardev/trace-events
@@ -0,0 +1,18 @@
+# See docs/tracing.txt for syntax documentation.
+
+# chardev/wctablet.c
+wct_init(void) ""
+wct_cmd_re(void) ""
+wct_cmd_st(void) ""
+wct_cmd_sp(void) ""
+wct_cmd_ts(int input) "0x%02x"
+wct_cmd_other(const char *cmd) "%s"
+wct_speed(int speed) "%d"
+
+# chardev/spice.c
+spice_vmc_write(ssize_t out, int len) "spice wrote %zd of requested %d"
+spice_vmc_read(int bytes, int len) "spice read %d of requested %d"
+spice_vmc_register_interface(void *scd) "spice vmc registered interface %p"
+spice_vmc_unregister_interface(void *scd) "spice vmc unregistered interface %p"
+spice_vmc_event(int event) "spice vmc event %d"
+
diff --git a/backends/wctablet.c b/chardev/wctablet.c
similarity index 99%
rename from backends/wctablet.c
rename to chardev/wctablet.c
index a4d3ae098a..6c13c2c58a 100644
--- a/backends/wctablet.c
+++ b/chardev/wctablet.c
@@ -32,7 +32,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char-serial.h"
 #include "ui/console.h"
 #include "ui/input.h"
 #include "trace.h"
diff --git a/gdbstub.c b/gdbstub.c
index 86eed4f97c..ec4e4b25be 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -25,7 +25,8 @@
 #include "qemu.h"
 #else
 #include "monitor/monitor.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/sysemu.h"
 #include "exec/gdbstub.h"
 #endif
@@ -1677,9 +1678,6 @@ void gdb_exit(CPUArchState *env, int code)
 {
   GDBState *s;
   char buf[4];
-#ifndef CONFIG_USER_ONLY
-  Chardev *chr;
-#endif
 
   s = gdbserver_state;
   if (!s) {
@@ -1689,19 +1687,13 @@ void gdb_exit(CPUArchState *env, int code)
   if (gdbserver_fd < 0 || s->fd < 0) {
       return;
   }
-#else
-  chr = qemu_chr_fe_get_driver(&s->chr);
-  if (!chr) {
-      return;
-  }
 #endif
 
   snprintf(buf, sizeof(buf), "W%02x", (uint8_t)code);
   put_packet(s, buf);
 
 #ifndef CONFIG_USER_ONLY
-  qemu_chr_fe_deinit(&s->chr);
-  object_unparent(OBJECT(chr));
+  qemu_chr_fe_deinit(&s->chr, true);
 #endif
 }
 
@@ -2001,9 +1993,7 @@ int gdbserver_start(const char *device)
                                    NULL, &error_abort);
         monitor_init(mon_chr, 0);
     } else {
-        if (qemu_chr_fe_get_driver(&s->chr)) {
-            object_unparent(OBJECT(qemu_chr_fe_get_driver(&s->chr)));
-        }
+        qemu_chr_fe_deinit(&s->chr, true);
         mon_chr = s->mon_chr;
         memset(s, 0, sizeof(GDBState));
         s->mon_chr = mon_chr;
diff --git a/hmp.c b/hmp.c
index ad723903a6..8c72c58b20 100644
--- a/hmp.c
+++ b/hmp.c
@@ -17,7 +17,7 @@
 #include "hmp.h"
 #include "net/net.h"
 #include "net/eth.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/sysemu.h"
 #include "qemu/config-file.h"
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index 369ef1e3bd..502f04c02a 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -13,7 +13,6 @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/misc/bcm2835_mbox_defs.h"
 #include "hw/arm/raspi_platform.h"
-#include "sysemu/char.h"
 #include "sysemu/sysemu.h"
 
 /* Peripheral base address on the VC (GPU) system bus */
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index 9056f27bf8..40666b68a3 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -30,7 +30,7 @@
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 static void fsl_imx25_init(Object *obj)
 {
diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
index d7e2d832b2..c30130667e 100644
--- a/hw/arm/fsl-imx31.c
+++ b/hw/arm/fsl-imx31.c
@@ -27,7 +27,7 @@
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 static void fsl_imx31_init(Object *obj)
 {
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index 6969e734ad..27773c9c47 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -24,7 +24,7 @@
 #include "qemu-common.h"
 #include "hw/arm/fsl-imx6.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qemu/error-report.h"
 
 #define NAME_SIZE 20
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index 8afb854c74..91f573338c 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -30,7 +30,7 @@
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "hw/block/flash.h"
 #include "hw/arm/soc_dma.h"
 #include "hw/sysbus.h"
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index eea551dc16..629e6c64e6 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -17,7 +17,7 @@
 #include "hw/char/serial.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
 #include "qemu/cutils.h"
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 3311cc38a4..7683edc9e5 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -34,7 +34,8 @@
 #include "strongarm.h"
 #include "qemu/error-report.h"
 #include "hw/arm/arm.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
+#include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
 #include "hw/ssi/ssi.h"
 #include "qemu/cutils.h"
diff --git a/hw/bt/hci-csr.c b/hw/bt/hci-csr.c
index 3c193848fc..d13192b9b5 100644
--- a/hw/bt/hci-csr.c
+++ b/hw/bt/hci-csr.c
@@ -20,7 +20,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "sysemu/char.h"
+#include "chardev/char-serial.h"
 #include "qemu/timer.h"
 #include "qemu/bswap.h"
 #include "hw/irq.h"
@@ -82,17 +82,14 @@ enum {
 
 static inline void csrhci_fifo_wake(struct csrhci_s *s)
 {
-    Chardev *chr = (Chardev *)s;
-    CharBackend *be = chr->be;
+    Chardev *chr = CHARDEV(s);
 
     if (!s->enable || !s->out_len)
         return;
 
     /* XXX: Should wait for s->modem_state & CHR_TIOCM_RTS? */
-    if (be && be->chr_can_read && be->chr_can_read(be->opaque) &&
-        be->chr_read) {
-        be->chr_read(be->opaque,
-                     s->outfifo + s->out_start++, 1);
+    if (qemu_chr_be_can_write(chr)) {
+        qemu_chr_be_write(chr, s->outfifo + s->out_start++, 1);
         s->out_len--;
         if (s->out_start >= s->out_size) {
             s->out_start = 0;
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 4dcee571c0..4a2c124104 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -23,7 +23,8 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
+#include "chardev/char-serial.h"
 #include "qemu/timer.h"
 #include "qemu/log.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index 80dce07e7f..762e3d8ada 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -27,7 +27,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/hw.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "hw/isa/isa.h"
 #include "hw/i386/pc.h"
 
diff --git a/hw/char/digic-uart.c b/hw/char/digic-uart.c
index 029f5bbf5e..34306e11ff 100644
--- a/hw/char/digic-uart.c
+++ b/hw/char/digic-uart.c
@@ -29,7 +29,7 @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/log.h"
 
 #include "hw/char/digic-uart.h"
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 9228091cec..3f787632c7 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -26,7 +26,8 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "hw/char/escc.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
+#include "chardev/char-serial.h"
 #include "ui/console.h"
 #include "ui/input.h"
 #include "trace.h"
diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index 54383878e0..c1fba9f50f 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/log.h"
 
 #define D(x)
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index bff706ab3a..b51d44a321 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -23,7 +23,8 @@
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
+#include "chardev/char-serial.h"
 
 #include "hw/arm/exynos4210.h"
 
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index db686e6a6f..32d98edf49 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #include "trace.h"
 
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 52e67f8dc9..af250305be 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "hw/char/imx_serial.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
 #include "qemu/log.h"
 
 #ifndef DEBUG_IMX_UART
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index 93929c2880..337a3e566a 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include "hw/ipack/ipack.h"
 #include "qemu/bitops.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 /* #define DEBUG_IPOCTAL */
 
diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index f8c1e0d076..3948dcd332 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -21,7 +21,7 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "trace.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #include "hw/char/lm32_juart.h"
 
diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index 7f3597c4b0..cff8c38f90 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -26,7 +26,7 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "trace.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/error-report.h"
 
 enum {
diff --git a/hw/char/mcf_uart.c b/hw/char/mcf_uart.c
index e69672f4e9..fe12ad5ccb 100644
--- a/hw/char/mcf_uart.c
+++ b/hw/char/mcf_uart.c
@@ -9,7 +9,7 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "hw/m68k/mcf.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "exec/address-spaces.h"
 #include "qapi/error.h"
 
diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index ae8e2f3554..e19d0f6520 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -25,7 +25,7 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "trace.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/error-report.h"
 
 enum {
diff --git a/hw/char/omap_uart.c b/hw/char/omap_uart.c
index 31ebb1592c..6fd1b9cf6b 100644
--- a/hw/char/omap_uart.c
+++ b/hw/char/omap_uart.c
@@ -18,7 +18,7 @@
  * with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "hw/hw.h"
 #include "hw/arm/omap.h"
 #include "hw/char/serial.h"
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index c71a4a0f4f..75a1a2f55e 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -25,7 +25,8 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/hw.h"
-#include "sysemu/char.h"
+#include "chardev/char-parallel.h"
+#include "chardev/char-fe.h"
 #include "hw/isa/isa.h"
 #include "hw/i386/pc.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index 24ea9738b6..33802f00c8 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -9,7 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/log.h"
 #include "trace.h"
 
diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index 07d6ebd112..1b15046690 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -17,7 +17,7 @@
 #include "hw/qdev.h"
 #include "qemu/thread.h"
 #include "qemu/error-report.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #include "hw/s390x/sclp.h"
 #include "hw/s390x/event-facility.h"
diff --git a/hw/char/sclpconsole.c b/hw/char/sclpconsole.c
index b78f240a73..4a107a268d 100644
--- a/hw/char/sclpconsole.c
+++ b/hw/char/sclpconsole.c
@@ -19,7 +19,7 @@
 
 #include "hw/s390x/sclp.h"
 #include "hw/s390x/event-facility.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 typedef struct ASCIIConsoleData {
     EventBufferHeader ebh;
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 03d890ca24..e1f12507bf 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -25,7 +25,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/char/serial.h"
-#include "sysemu/char.h"
+#include "chardev/char-serial.h"
 #include "qapi/error.h"
 #include "qemu/timer.h"
 #include "exec/address-spaces.h"
@@ -905,7 +905,7 @@ void serial_realize_core(SerialState *s, Error **errp)
 
 void serial_exit_core(SerialState *s)
 {
-    qemu_chr_fe_deinit(&s->chr);
+    qemu_chr_fe_deinit(&s->chr, false);
 
     timer_del(s->modem_status_poll);
     timer_free(s->modem_status_poll);
diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 303eb0a678..ca9816d045 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -27,7 +27,7 @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/sh4/sh.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "exec/address-spaces.h"
 #include "qapi/error.h"
 
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index e30c8da57c..8f02f3a612 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -4,7 +4,7 @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/qdev.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "hw/ppc/spapr.h"
 #include "hw/ppc/spapr_vio.h"
 
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index b2dda01baa..7b10a04f18 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -13,7 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "hw/s390x/3270-ccw.h"
 
 /* Enough spaces for different window sizes. */
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index 798d9b69fd..0cb1668c8a 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -11,7 +11,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/error-report.h"
 #include "trace.h"
 #include "hw/virtio/virtio-serial.h"
diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c
index c01f41090e..f9af8cadf4 100644
--- a/hw/char/xen_console.c
+++ b/hw/char/xen_console.c
@@ -25,7 +25,7 @@
 
 #include "qapi/error.h"
 #include "hw/hw.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "hw/xen/xen_backend.h"
 #include "qapi/error.h"
 
@@ -261,7 +261,7 @@ static void con_disconnect(struct XenDevice *xendev)
 {
     struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);
 
-    qemu_chr_fe_deinit(&con->chr);
+    qemu_chr_fe_deinit(&con->chr, false);
     xen_pv_unbind_evtchn(&con->xendev);
 
     if (con->sring) {
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 37d313b429..71ed2fc1be 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #define DUART(x)
 
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 79c2014135..3bef41914d 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -20,7 +20,7 @@
 #include "hw/block/block.h"
 #include "net/hub.h"
 #include "qapi/visitor.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/iothread.h"
 
 static void get_pointer(Object *obj, Visitor *v, Property *prop,
@@ -225,7 +225,7 @@ static void release_chr(Object *obj, const char *name, void *opaque)
     Property *prop = opaque;
     CharBackend *be = qdev_get_prop_ptr(dev, prop);
 
-    qemu_chr_fe_deinit(be);
+    qemu_chr_fe_deinit(be, false);
 }
 
 PropertyInfo qdev_prop_chr = {
diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index fa3617db2d..9f1a497322 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -9,7 +9,7 @@
 #include "hw/block/block.h"
 #include "net/hub.h"
 #include "qapi/visitor.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 void qdev_prop_set_after_realize(DeviceState *dev, const char *name,
                                   Error **errp)
diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 7a8727aa21..e76c0d805c 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -28,7 +28,6 @@
 
 #include "hw/hw.h"
 #include "ui/console.h"
-#include "sysemu/char.h"
 #include "hw/xen/xen_backend.h"
 
 #include <xen/event_channel.h>
diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index 919f09b694..1acd4de405 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -18,7 +18,6 @@
 #include "hw/xen/xen_backend.h"
 #include "qmp-commands.h"
 
-#include "sysemu/char.h"
 #include "qemu/error-report.h"
 #include "qemu/range.h"
 #include "sysemu/xen-mapcache.h"
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index e8e3d250b6..329b03e17f 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -30,7 +30,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/timer.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/sysemu.h"
 #include "hw/ipmi/ipmi.h"
 
diff --git a/hw/isa/pc87312.c b/hw/isa/pc87312.c
index c707d24db4..5ce9f0a062 100644
--- a/hw/isa/pc87312.c
+++ b/hw/isa/pc87312.c
@@ -30,7 +30,7 @@
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "trace.h"
 
 
diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index 53d1e0ce45..a4677f7da4 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -35,7 +35,7 @@
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
 #include "qemu/log.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/qtest.h"
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index e636c3abaa..dbe2805acb 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -32,7 +32,6 @@
 #include "hw/mips/mips.h"
 #include "hw/mips/cpudevs.h"
 #include "hw/pci/pci.h"
-#include "sysemu/char.h"
 #include "sysemu/sysemu.h"
 #include "audio/audio.h"
 #include "qemu/log.h"
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 7814c39654..95cdabb2dd 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -37,7 +37,6 @@
 #include "hw/mips/mips.h"
 #include "hw/mips/cpudevs.h"
 #include "hw/pci/pci.h"
-#include "sysemu/char.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/arch_init.h"
 #include "qemu/log.h"
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 475e36a4c7..6367d041f0 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -29,7 +29,7 @@
 #include "qemu/error-report.h"
 #include "qemu/event_notifier.h"
 #include "qom/object_interfaces.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/hostmem.h"
 #include "sysemu/qtest.h"
 #include "qapi/visitor.h"
diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index 46b1aa17fa..0843bf185c 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -26,7 +26,6 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
 #include "qemu/log.h"
 #include "net/net.h"
 #include "net/checksum.h"
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index 73e2a1884f..57acd85a87 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -28,7 +28,6 @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
 #include "hw/qdev.h"
 #include "sysemu/device_tree.h"
 
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 128d993d04..b666a4c15c 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -29,7 +29,6 @@
 #include "qemu/log.h"
 #include "qemu/error-report.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
 #include "hw/qdev.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/cpus.h"
diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index 6e16478413..f415997649 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -28,7 +28,6 @@
 #include "hw/hw.h"
 #include "qemu/timer.h"
 #include "hw/ptimer.h"
-#include "sysemu/char.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index 99627860a3..e646eb243b 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -33,7 +33,7 @@
 #include <vcard_emul.h>
 
 #include "qemu/thread.h"
-#include "sysemu/char.h"
+#include "qemu/main-loop.h"
 #include "ccid.h"
 
 #define DPRINTF(card, lvl, fmt, ...) \
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index a41b0d6ec5..ac1725eeae 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -9,7 +9,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/error-report.h"
 #include "qemu/sockets.h"
 #include "ccid.h"
@@ -264,10 +264,7 @@ static void ccid_card_vscard_handle_message(PassthruState *card,
 
 static void ccid_card_vscard_drop_connection(PassthruState *card)
 {
-    Chardev *chr = qemu_chr_fe_get_driver(&card->cs);
-
-    qemu_chr_fe_deinit(&card->cs);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&card->cs, true);
     card->vscard_in_pos = card->vscard_in_hdr = 0;
 }
 
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 76ceca1f5c..bfbf7cdce7 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -15,7 +15,8 @@
 #include "qemu/error-report.h"
 #include "hw/usb.h"
 #include "hw/usb/desc.h"
-#include "sysemu/char.h"
+#include "chardev/char-serial.h"
+#include "chardev/char-fe.h"
 
 //#define DEBUG_Serial
 
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index ad5ef783a6..aa22d69216 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -33,7 +33,7 @@
 #include "qapi/qmp/qerror.h"
 #include "qemu/error-report.h"
 #include "qemu/iov.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #include <usbredirparser.h>
 #include <usbredirfilter.h>
@@ -1419,10 +1419,8 @@ static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
 static void usbredir_unrealize(USBDevice *udev, Error **errp)
 {
     USBRedirDevice *dev = USB_REDIRECT(udev);
-    Chardev *chr = qemu_chr_fe_get_driver(&dev->cs);
 
-    qemu_chr_fe_deinit(&dev->cs);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&dev->cs, true);
 
     /* Note must be done after qemu_chr_close, as that causes a close event */
     qemu_bh_delete(dev->chardev_close_bh);
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 7a9bb1d406..958ee09bcb 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -13,7 +13,7 @@
 #include "hw/virtio/vhost.h"
 #include "hw/virtio/vhost-backend.h"
 #include "hw/virtio/virtio-net.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/kvm.h"
 #include "qemu/error-report.h"
 #include "qemu/sockets.h"
diff --git a/hw/xen/xen-common.c b/hw/xen/xen-common.c
index a9055e9eba..0bed5770c9 100644
--- a/hw/xen/xen-common.c
+++ b/hw/xen/xen-common.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include "hw/xen/xen_backend.h"
 #include "qmp-commands.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "sysemu/accel.h"
 #include "migration/migration.h"
 
diff --git a/hw/xen/xen_backend.c b/hw/xen/xen_backend.c
index 3570f37e56..c46cbb0759 100644
--- a/hw/xen/xen_backend.c
+++ b/hw/xen/xen_backend.c
@@ -28,7 +28,6 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "sysemu/char.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
 #include "hw/xen/xen_backend.h"
diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 4636f8e934..d5ac080d4a 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -40,7 +40,7 @@
 #include "hw/sysbus.h"
 #include "hw/block/flash.h"
 #include "sysemu/block-backend.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "qemu/error-report.h"
 #include "bootparam.h"
diff --git a/chardev/char-fd.h b/include/chardev/char-fd.h
similarity index 98%
rename from chardev/char-fd.h
rename to include/chardev/char-fd.h
index d8327982fb..55ae5b47b0 100644
--- a/chardev/char-fd.h
+++ b/include/chardev/char-fd.h
@@ -25,7 +25,7 @@
 #define CHAR_FD_H
 
 #include "io/channel.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 typedef struct FDChardev {
     Chardev parent;
diff --git a/include/chardev/char-fe.h b/include/chardev/char-fe.h
new file mode 100644
index 0000000000..2cbb262f66
--- /dev/null
+++ b/include/chardev/char-fe.h
@@ -0,0 +1,251 @@
+#ifndef QEMU_CHAR_FE_H
+#define QEMU_CHAR_FE_H
+
+#include "chardev/char.h"
+
+typedef void IOEventHandler(void *opaque, int event);
+
+/* This is the backend as seen by frontend, the actual backend is
+ * Chardev */
+struct CharBackend {
+    Chardev *chr;
+    IOEventHandler *chr_event;
+    IOCanReadHandler *chr_can_read;
+    IOReadHandler *chr_read;
+    void *opaque;
+    int tag;
+    int fe_open;
+};
+
+/**
+ * @qemu_chr_fe_init:
+ *
+ * Initializes a front end for the given CharBackend and
+ * Chardev. Call qemu_chr_fe_deinit() to remove the association and
+ * release the driver.
+ *
+ * Returns: false on error.
+ */
+bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp);
+
+/**
+ * @qemu_chr_fe_deinit:
+ * @b: a CharBackend
+ * @del: if true, delete the chardev backend
+*
+ * Dissociate the CharBackend from the Chardev.
+ *
+ * Safe to call without associated Chardev.
+ */
+void qemu_chr_fe_deinit(CharBackend *b, bool del);
+
+/**
+ * @qemu_chr_fe_get_driver:
+ *
+ * Returns the driver associated with a CharBackend or NULL if no
+ * associated Chardev.
+ */
+Chardev *qemu_chr_fe_get_driver(CharBackend *be);
+
+/**
+ * @qemu_chr_fe_set_handlers:
+ * @b: a CharBackend
+ * @fd_can_read: callback to get the amount of data the frontend may
+ *               receive
+ * @fd_read: callback to receive data from char
+ * @fd_event: event callback
+ * @opaque: an opaque pointer for the callbacks
+ * @context: a main loop context or NULL for the default
+ * @set_open: whether to call qemu_chr_fe_set_open() implicitely when
+ * any of the handler is non-NULL
+ *
+ * Set the front end char handlers. The front end takes the focus if
+ * any of the handler is non-NULL.
+ *
+ * Without associated Chardev, nothing is changed.
+ */
+void qemu_chr_fe_set_handlers(CharBackend *b,
+                              IOCanReadHandler *fd_can_read,
+                              IOReadHandler *fd_read,
+                              IOEventHandler *fd_event,
+                              void *opaque,
+                              GMainContext *context,
+                              bool set_open);
+
+/**
+ * @qemu_chr_fe_take_focus:
+ *
+ * Take the focus (if the front end is muxed).
+ *
+ * Without associated Chardev, nothing is changed.
+ */
+void qemu_chr_fe_take_focus(CharBackend *b);
+
+/**
+ * @qemu_chr_fe_accept_input:
+ *
+ * Notify that the frontend is ready to receive data
+ */
+void qemu_chr_fe_accept_input(CharBackend *be);
+
+/**
+ * @qemu_chr_fe_disconnect:
+ *
+ * Close a fd accpeted by character backend.
+ * Without associated Chardev, do nothing.
+ */
+void qemu_chr_fe_disconnect(CharBackend *be);
+
+/**
+ * @qemu_chr_fe_wait_connected:
+ *
+ * Wait for characted backend to be connected, return < 0 on error or
+ * if no assicated Chardev.
+ */
+int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp);
+
+/**
+ * @qemu_chr_fe_set_echo:
+ *
+ * Ask the backend to override its normal echo setting.  This only really
+ * applies to the stdio backend and is used by the QMP server such that you
+ * can see what you type if you try to type QMP commands.
+ * Without associated Chardev, do nothing.
+ *
+ * @echo true to enable echo, false to disable echo
+ */
+void qemu_chr_fe_set_echo(CharBackend *be, bool echo);
+
+/**
+ * @qemu_chr_fe_set_open:
+ *
+ * Set character frontend open status.  This is an indication that the
+ * front end is ready (or not) to begin doing I/O.
+ * Without associated Chardev, do nothing.
+ */
+void qemu_chr_fe_set_open(CharBackend *be, int fe_open);
+
+/**
+ * @qemu_chr_fe_printf:
+ *
+ * Write to a character backend using a printf style interface.  This
+ * function is thread-safe. It does nothing without associated
+ * Chardev.
+ *
+ * @fmt see #printf
+ */
+void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
+    GCC_FMT_ATTR(2, 3);
+
+/**
+ * @qemu_chr_fe_add_watch:
+ *
+ * If the backend is connected, create and add a #GSource that fires
+ * when the given condition (typically G_IO_OUT|G_IO_HUP or G_IO_HUP)
+ * is active; return the #GSource's tag.  If it is disconnected,
+ * or without associated Chardev, return 0.
+ *
+ * @cond the condition to poll for
+ * @func the function to call when the condition happens
+ * @user_data the opaque pointer to pass to @func
+ *
+ * Returns: the source tag
+ */
+guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
+                            GIOFunc func, void *user_data);
+
+/**
+ * @qemu_chr_fe_write:
+ *
+ * Write data to a character backend from the front end.  This function
+ * will send data from the front end to the back end.  This function
+ * is thread-safe.
+ *
+ * @buf the data
+ * @len the number of bytes to send
+ *
+ * Returns: the number of bytes consumed (0 if no assicated Chardev)
+ */
+int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len);
+
+/**
+ * @qemu_chr_fe_write_all:
+ *
+ * Write data to a character backend from the front end.  This function will
+ * send data from the front end to the back end.  Unlike @qemu_chr_fe_write,
+ * this function will block if the back end cannot consume all of the data
+ * attempted to be written.  This function is thread-safe.
+ *
+ * @buf the data
+ * @len the number of bytes to send
+ *
+ * Returns: the number of bytes consumed (0 if no assicated Chardev)
+ */
+int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len);
+
+/**
+ * @qemu_chr_fe_read_all:
+ *
+ * Read data to a buffer from the back end.
+ *
+ * @buf the data buffer
+ * @len the number of bytes to read
+ *
+ * Returns: the number of bytes read (0 if no assicated Chardev)
+ */
+int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len);
+
+/**
+ * @qemu_chr_fe_ioctl:
+ *
+ * Issue a device specific ioctl to a backend.  This function is thread-safe.
+ *
+ * @cmd see CHR_IOCTL_*
+ * @arg the data associated with @cmd
+ *
+ * Returns: if @cmd is not supported by the backend or there is no
+ *          associated Chardev, -ENOTSUP, otherwise the return
+ *          value depends on the semantics of @cmd
+ */
+int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg);
+
+/**
+ * @qemu_chr_fe_get_msgfd:
+ *
+ * For backends capable of fd passing, return the latest file descriptor passed
+ * by a client.
+ *
+ * Returns: -1 if fd passing isn't supported or there is no pending file
+ *          descriptor.  If a file descriptor is returned, subsequent calls to
+ *          this function will return -1 until a client sends a new file
+ *          descriptor.
+ */
+int qemu_chr_fe_get_msgfd(CharBackend *be);
+
+/**
+ * @qemu_chr_fe_get_msgfds:
+ *
+ * For backends capable of fd passing, return the number of file received
+ * descriptors and fills the fds array up to num elements
+ *
+ * Returns: -1 if fd passing isn't supported or there are no pending file
+ *          descriptors.  If file descriptors are returned, subsequent calls to
+ *          this function will return -1 until a client sends a new set of file
+ *          descriptors.
+ */
+int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int num);
+
+/**
+ * @qemu_chr_fe_set_msgfds:
+ *
+ * For backends capable of fd passing, set an array of fds to be passed with
+ * the next send operation.
+ * A subsequent call to this function before calling a write function will
+ * result in overwriting the fd array with the new value without being send.
+ * Upon writing the message the fd array is freed.
+ *
+ * Returns: -1 if fd passing isn't supported or no associated Chardev.
+ */
+int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num);
+
+#endif /* QEMU_CHAR_FE_H */
diff --git a/chardev/char-io.h b/include/chardev/char-io.h
similarity index 98%
rename from chardev/char-io.h
rename to include/chardev/char-io.h
index 55973a7671..9638da5100 100644
--- a/chardev/char-io.h
+++ b/include/chardev/char-io.h
@@ -26,7 +26,7 @@
 
 #include "qemu-common.h"
 #include "io/channel.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 /* Can only be used for read */
 GSource *io_add_watch_poll(Chardev *chr,
diff --git a/chardev/char-mux.h b/include/chardev/char-mux.h
similarity index 97%
rename from chardev/char-mux.h
rename to include/chardev/char-mux.h
index 3f41dfcfd2..8928977897 100644
--- a/chardev/char-mux.h
+++ b/include/chardev/char-mux.h
@@ -24,7 +24,8 @@
 #ifndef CHAR_MUX_H
 #define CHAR_MUX_H
 
-#include "sysemu/char.h"
+#include "chardev/char.h"
+#include "chardev/char-fe.h"
 
 extern bool muxes_realized;
 
diff --git a/chardev/char-parallel.h b/include/chardev/char-parallel.h
similarity index 70%
rename from chardev/char-parallel.h
rename to include/chardev/char-parallel.h
index 26742f9d5c..3284a1b96b 100644
--- a/chardev/char-parallel.h
+++ b/include/chardev/char-parallel.h
@@ -24,9 +24,27 @@
 #ifndef CHAR_PARALLEL_H
 #define CHAR_PARALLEL_H
 
-#if defined(__linux__) || defined(__FreeBSD__) || \
+#include "chardev/char.h"
+
+#if defined(__linux__) || defined(__FreeBSD__) ||               \
     defined(__FreeBSD_kernel__) || defined(__DragonFly__)
 #define HAVE_CHARDEV_PARPORT 1
 #endif
 
+#define CHR_IOCTL_PP_READ_DATA        3
+#define CHR_IOCTL_PP_WRITE_DATA       4
+#define CHR_IOCTL_PP_READ_CONTROL     5
+#define CHR_IOCTL_PP_WRITE_CONTROL    6
+#define CHR_IOCTL_PP_READ_STATUS      7
+#define CHR_IOCTL_PP_EPP_READ_ADDR    8
+#define CHR_IOCTL_PP_EPP_READ         9
+#define CHR_IOCTL_PP_EPP_WRITE_ADDR  10
+#define CHR_IOCTL_PP_EPP_WRITE       11
+#define CHR_IOCTL_PP_DATA_DIR        12
+
+struct ParallelIOArg {
+    void *buffer;
+    int count;
+};
+
 #endif /* CHAR_PARALLEL_H */
diff --git a/chardev/char-serial.h b/include/chardev/char-serial.h
similarity index 75%
rename from chardev/char-serial.h
rename to include/chardev/char-serial.h
index 64a27f63b1..cb2e59e82a 100644
--- a/chardev/char-serial.h
+++ b/include/chardev/char-serial.h
@@ -24,6 +24,8 @@
 #ifndef CHAR_SERIAL_H
 #define CHAR_SERIAL_H
 
+#include "chardev/char.h"
+
 #ifdef _WIN32
 #define HAVE_CHARDEV_SERIAL 1
 #elif defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)    \
@@ -32,4 +34,24 @@
 #define HAVE_CHARDEV_SERIAL 1
 #endif
 
+#define CHR_IOCTL_SERIAL_SET_PARAMS   1
+typedef struct {
+    int speed;
+    int parity;
+    int data_bits;
+    int stop_bits;
+} QEMUSerialSetParams;
+
+#define CHR_IOCTL_SERIAL_SET_BREAK    2
+
+#define CHR_IOCTL_SERIAL_SET_TIOCM   13
+#define CHR_IOCTL_SERIAL_GET_TIOCM   14
+
+#define CHR_TIOCM_CTS   0x020
+#define CHR_TIOCM_CAR   0x040
+#define CHR_TIOCM_DSR   0x100
+#define CHR_TIOCM_RI    0x080
+#define CHR_TIOCM_DTR   0x002
+#define CHR_TIOCM_RTS   0x004
+
 #endif
diff --git a/chardev/char-win-stdio.h b/include/chardev/char-win-stdio.h
similarity index 100%
rename from chardev/char-win-stdio.h
rename to include/chardev/char-win-stdio.h
diff --git a/chardev/char-win.h b/include/chardev/char-win.h
similarity index 84%
rename from chardev/char-win.h
rename to include/chardev/char-win.h
index d78a7d7972..fa59e9e423 100644
--- a/chardev/char-win.h
+++ b/include/chardev/char-win.h
@@ -24,20 +24,18 @@
 #ifndef CHAR_WIN_H
 #define CHAR_WIN_H
 
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 typedef struct {
     Chardev parent;
-    int max_size;
-    HANDLE hcom, hrecv, hsend;
+
+    bool keep_open; /* console do not close file */
+    HANDLE file, hrecv, hsend;
     OVERLAPPED orecv;
     BOOL fpipe;
-    DWORD len;
 
     /* Protected by the Chardev chr_write_lock.  */
     OVERLAPPED osend;
-    /* FIXME: file/console do not finalize */
-    bool skip_free;
 } WinChardev;
 
 #define NSENDBUF 2048
@@ -46,8 +44,8 @@ typedef struct {
 #define TYPE_CHARDEV_WIN "chardev-win"
 #define WIN_CHARDEV(obj) OBJECT_CHECK(WinChardev, (obj), TYPE_CHARDEV_WIN)
 
-void qemu_chr_open_win_file(Chardev *chr, HANDLE fd_out);
-int win_chr_init(Chardev *chr, const char *filename, Error **errp);
+void win_chr_set_file(Chardev *chr, HANDLE file, bool keep_open);
+int win_chr_serial_init(Chardev *chr, const char *filename, Error **errp);
 int win_chr_pipe_poll(void *opaque);
 
 #endif /* CHAR_WIN_H */
diff --git a/include/chardev/char.h b/include/chardev/char.h
new file mode 100644
index 0000000000..8a9ade4931
--- /dev/null
+++ b/include/chardev/char.h
@@ -0,0 +1,229 @@
+#ifndef QEMU_CHAR_H
+#define QEMU_CHAR_H
+
+#include "qemu-common.h"
+#include "qemu/option.h"
+#include "qemu/main-loop.h"
+#include "qemu/bitmap.h"
+#include "qom/object.h"
+
+#define IAC_EOR 239
+#define IAC_SE 240
+#define IAC_NOP 241
+#define IAC_BREAK 243
+#define IAC_IP 244
+#define IAC_SB 250
+#define IAC 255
+
+/* character device */
+typedef struct CharBackend CharBackend;
+
+typedef enum {
+    CHR_EVENT_BREAK, /* serial break char */
+    CHR_EVENT_OPENED, /* new connection established */
+    CHR_EVENT_MUX_IN, /* mux-focus was set to this terminal */
+    CHR_EVENT_MUX_OUT, /* mux-focus will move on */
+    CHR_EVENT_CLOSED /* connection closed */
+} QEMUChrEvent;
+
+#define CHR_READ_BUF_LEN 4096
+
+typedef enum {
+    /* Whether the chardev peer is able to close and
+     * reopen the data channel, thus requiring support
+     * for qemu_chr_wait_connected() to wait for a
+     * valid connection */
+    QEMU_CHAR_FEATURE_RECONNECTABLE,
+    /* Whether it is possible to send/recv file descriptors
+     * over the data channel */
+    QEMU_CHAR_FEATURE_FD_PASS,
+    /* Whether replay or record mode is enabled */
+    QEMU_CHAR_FEATURE_REPLAY,
+
+    QEMU_CHAR_FEATURE_LAST,
+} ChardevFeature;
+
+#define qemu_chr_replay(chr) qemu_chr_has_feature(chr, QEMU_CHAR_FEATURE_REPLAY)
+
+struct Chardev {
+    Object parent_obj;
+
+    QemuMutex chr_write_lock;
+    CharBackend *be;
+    char *label;
+    char *filename;
+    int logfd;
+    int be_open;
+    GSource *gsource;
+    DECLARE_BITMAP(features, QEMU_CHAR_FEATURE_LAST);
+};
+
+/**
+ * @qemu_chr_new_from_opts:
+ *
+ * Create a new character backend from a QemuOpts list.
+ *
+ * @opts see qemu-config.c for a list of valid options
+ *
+ * Returns: a new character backend
+ */
+Chardev *qemu_chr_new_from_opts(QemuOpts *opts,
+                                Error **errp);
+
+/**
+ * @qemu_chr_parse_common:
+ *
+ * Parse the common options available to all character backends.
+ *
+ * @opts the options that still need parsing
+ * @backend a new backend
+ */
+void qemu_chr_parse_common(QemuOpts *opts, ChardevCommon *backend);
+
+/**
+ * @qemu_chr_new:
+ *
+ * Create a new character backend from a URI.
+ *
+ * @label the name of the backend
+ * @filename the URI
+ *
+ * Returns: a new character backend
+ */
+Chardev *qemu_chr_new(const char *label, const char *filename);
+
+/**
+ * @qemu_chr_cleanup:
+ *
+ * Delete all chardevs (when leaving qemu)
+ */
+void qemu_chr_cleanup(void);
+
+/**
+ * @qemu_chr_new_noreplay:
+ *
+ * Create a new character backend from a URI.
+ * Character device communications are not written
+ * into the replay log.
+ *
+ * @label the name of the backend
+ * @filename the URI
+ *
+ * Returns: a new character backend
+ */
+Chardev *qemu_chr_new_noreplay(const char *label, const char *filename);
+
+/**
+ * @qemu_chr_be_can_write:
+ *
+ * Determine how much data the front end can currently accept.  This function
+ * returns the number of bytes the front end can accept.  If it returns 0, the
+ * front end cannot receive data at the moment.  The function must be polled
+ * to determine when data can be received.
+ *
+ * Returns: the number of bytes the front end can receive via @qemu_chr_be_write
+ */
+int qemu_chr_be_can_write(Chardev *s);
+
+/**
+ * @qemu_chr_be_write:
+ *
+ * Write data from the back end to the front end.  Before issuing this call,
+ * the caller should call @qemu_chr_be_can_write to determine how much data
+ * the front end can currently accept.
+ *
+ * @buf a buffer to receive data from the front end
+ * @len the number of bytes to receive from the front end
+ */
+void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len);
+
+/**
+ * @qemu_chr_be_write_impl:
+ *
+ * Implementation of back end writing. Used by replay module.
+ *
+ * @buf a buffer to receive data from the front end
+ * @len the number of bytes to receive from the front end
+ */
+void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len);
+
+/**
+ * @qemu_chr_be_event:
+ *
+ * Send an event from the back end to the front end.
+ *
+ * @event the event to send
+ */
+void qemu_chr_be_event(Chardev *s, int event);
+
+int qemu_chr_add_client(Chardev *s, int fd);
+Chardev *qemu_chr_find(const char *name);
+
+bool qemu_chr_has_feature(Chardev *chr,
+                          ChardevFeature feature);
+void qemu_chr_set_feature(Chardev *chr,
+                          ChardevFeature feature);
+QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename);
+int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all);
+#define qemu_chr_write_all(s, buf, len) qemu_chr_write(s, buf, len, true)
+int qemu_chr_wait_connected(Chardev *chr, Error **errp);
+
+#define TYPE_CHARDEV "chardev"
+#define CHARDEV(obj) OBJECT_CHECK(Chardev, (obj), TYPE_CHARDEV)
+#define CHARDEV_CLASS(klass) \
+    OBJECT_CLASS_CHECK(ChardevClass, (klass), TYPE_CHARDEV)
+#define CHARDEV_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(ChardevClass, (obj), TYPE_CHARDEV)
+
+#define TYPE_CHARDEV_NULL "chardev-null"
+#define TYPE_CHARDEV_MUX "chardev-mux"
+#define TYPE_CHARDEV_RINGBUF "chardev-ringbuf"
+#define TYPE_CHARDEV_PTY "chardev-pty"
+#define TYPE_CHARDEV_CONSOLE "chardev-console"
+#define TYPE_CHARDEV_STDIO "chardev-stdio"
+#define TYPE_CHARDEV_PIPE "chardev-pipe"
+#define TYPE_CHARDEV_MEMORY "chardev-memory"
+#define TYPE_CHARDEV_PARALLEL "chardev-parallel"
+#define TYPE_CHARDEV_FILE "chardev-file"
+#define TYPE_CHARDEV_SERIAL "chardev-serial"
+#define TYPE_CHARDEV_SOCKET "chardev-socket"
+#define TYPE_CHARDEV_UDP "chardev-udp"
+
+#define CHARDEV_IS_RINGBUF(chr) \
+    object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_RINGBUF)
+#define CHARDEV_IS_PTY(chr) \
+    object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_PTY)
+
+typedef struct ChardevClass {
+    ObjectClass parent_class;
+
+    bool internal; /* TODO: eventually use TYPE_USER_CREATABLE */
+    void (*parse)(QemuOpts *opts, ChardevBackend *backend, Error **errp);
+
+    void (*open)(Chardev *chr, ChardevBackend *backend,
+                 bool *be_opened, Error **errp);
+
+    int (*chr_write)(Chardev *s, const uint8_t *buf, int len);
+    int (*chr_sync_read)(Chardev *s, const uint8_t *buf, int len);
+    GSource *(*chr_add_watch)(Chardev *s, GIOCondition cond);
+    void (*chr_update_read_handler)(Chardev *s, GMainContext *context);
+    int (*chr_ioctl)(Chardev *s, int cmd, void *arg);
+    int (*get_msgfds)(Chardev *s, int* fds, int num);
+    int (*set_msgfds)(Chardev *s, int *fds, int num);
+    int (*chr_add_client)(Chardev *chr, int fd);
+    int (*chr_wait_connected)(Chardev *chr, Error **errp);
+    void (*chr_disconnect)(Chardev *chr);
+    void (*chr_accept_input)(Chardev *chr);
+    void (*chr_set_echo)(Chardev *chr, bool echo);
+    void (*chr_set_fe_open)(Chardev *chr, int fe_open);
+} ChardevClass;
+
+Chardev *qemu_chardev_new(const char *id, const char *typename,
+                          ChardevBackend *backend, Error **errp);
+
+extern int term_escape_char;
+
+/* console.c */
+void qemu_chr_parse_vc(QemuOpts *opts, ChardevBackend *backend, Error **errp);
+
+#endif
diff --git a/include/hw/char/bcm2835_aux.h b/include/hw/char/bcm2835_aux.h
index 6865f154bc..cdbf7e3e37 100644
--- a/include/hw/char/bcm2835_aux.h
+++ b/include/hw/char/bcm2835_aux.h
@@ -9,7 +9,7 @@
 #define BCM2835_AUX_H
 
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #define TYPE_BCM2835_AUX "bcm2835-aux"
 #define BCM2835_AUX(obj) OBJECT_CHECK(BCM2835AuxState, (obj), TYPE_BCM2835_AUX)
diff --git a/include/hw/char/cadence_uart.h b/include/hw/char/cadence_uart.h
index c836db4b74..118e3f10de 100644
--- a/include/hw/char/cadence_uart.h
+++ b/include/hw/char/cadence_uart.h
@@ -19,7 +19,7 @@
 #ifndef CADENCE_UART_H
 
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/timer.h"
 
 #define CADENCE_UART_RX_FIFO_SIZE           16
diff --git a/include/hw/char/digic-uart.h b/include/hw/char/digic-uart.h
index 340c8e1111..de9a3e3551 100644
--- a/include/hw/char/digic-uart.h
+++ b/include/hw/char/digic-uart.h
@@ -19,7 +19,7 @@
 #define HW_CHAR_DIGIC_UART_H
 
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #define TYPE_DIGIC_UART "digic-uart"
 #define DIGIC_UART(obj) \
diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index 4cc3fbc395..baeec3183f 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -19,7 +19,7 @@
 #define IMX_SERIAL_H
 
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 
 #define TYPE_IMX_SERIAL "imx.serial"
 #define IMX_SERIAL(obj) OBJECT_CHECK(IMXSerialState, (obj), TYPE_IMX_SERIAL)
diff --git a/include/hw/char/serial.h b/include/hw/char/serial.h
index daebb076c2..c4daf11a14 100644
--- a/include/hw/char/serial.h
+++ b/include/hw/char/serial.h
@@ -28,10 +28,10 @@
 
 #include "hw/hw.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "exec/memory.h"
 #include "qemu/fifo8.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 #define UART_FIFO_LENGTH    16      /* 16550A Fifo Length */
 
diff --git a/include/hw/char/stm32f2xx_usart.h b/include/hw/char/stm32f2xx_usart.h
index 3267523270..9d03a7527c 100644
--- a/include/hw/char/stm32f2xx_usart.h
+++ b/include/hw/char/stm32f2xx_usart.h
@@ -26,7 +26,7 @@
 #define HW_STM32F2XX_USART_H
 
 #include "hw/sysbus.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "hw/hw.h"
 
 #define USART_SR   0x00
diff --git a/include/sysemu/char.h b/include/sysemu/char.h
deleted file mode 100644
index fffc0f40d4..0000000000
--- a/include/sysemu/char.h
+++ /dev/null
@@ -1,499 +0,0 @@
-#ifndef QEMU_CHAR_H
-#define QEMU_CHAR_H
-
-#include "qemu-common.h"
-#include "qemu/option.h"
-#include "qemu/main-loop.h"
-#include "qemu/bitmap.h"
-#include "qom/object.h"
-
-#define IAC_EOR 239
-#define IAC_SE 240
-#define IAC_NOP 241
-#define IAC_BREAK 243
-#define IAC_IP 244
-#define IAC_SB 250
-#define IAC 255
-
-/* character device */
-
-typedef enum {
-    CHR_EVENT_BREAK, /* serial break char */
-    CHR_EVENT_OPENED, /* new connection established */
-    CHR_EVENT_MUX_IN, /* mux-focus was set to this terminal */
-    CHR_EVENT_MUX_OUT, /* mux-focus will move on */
-    CHR_EVENT_CLOSED /* connection closed */
-} QEMUChrEvent;
-
-#define CHR_READ_BUF_LEN 4096
-
-#define CHR_IOCTL_SERIAL_SET_PARAMS   1
-typedef struct {
-    int speed;
-    int parity;
-    int data_bits;
-    int stop_bits;
-} QEMUSerialSetParams;
-
-#define CHR_IOCTL_SERIAL_SET_BREAK    2
-
-#define CHR_IOCTL_PP_READ_DATA        3
-#define CHR_IOCTL_PP_WRITE_DATA       4
-#define CHR_IOCTL_PP_READ_CONTROL     5
-#define CHR_IOCTL_PP_WRITE_CONTROL    6
-#define CHR_IOCTL_PP_READ_STATUS      7
-#define CHR_IOCTL_PP_EPP_READ_ADDR    8
-#define CHR_IOCTL_PP_EPP_READ         9
-#define CHR_IOCTL_PP_EPP_WRITE_ADDR  10
-#define CHR_IOCTL_PP_EPP_WRITE       11
-#define CHR_IOCTL_PP_DATA_DIR        12
-
-struct ParallelIOArg {
-    void *buffer;
-    int count;
-};
-
-#define CHR_IOCTL_SERIAL_SET_TIOCM   13
-#define CHR_IOCTL_SERIAL_GET_TIOCM   14
-
-#define CHR_TIOCM_CTS	0x020
-#define CHR_TIOCM_CAR	0x040
-#define CHR_TIOCM_DSR	0x100
-#define CHR_TIOCM_RI	0x080
-#define CHR_TIOCM_DTR	0x002
-#define CHR_TIOCM_RTS	0x004
-
-typedef void IOEventHandler(void *opaque, int event);
-
-typedef enum {
-    /* Whether the chardev peer is able to close and
-     * reopen the data channel, thus requiring support
-     * for qemu_chr_wait_connected() to wait for a
-     * valid connection */
-    QEMU_CHAR_FEATURE_RECONNECTABLE,
-    /* Whether it is possible to send/recv file descriptors
-     * over the data channel */
-    QEMU_CHAR_FEATURE_FD_PASS,
-    /* Whether replay or record mode is enabled */
-    QEMU_CHAR_FEATURE_REPLAY,
-
-    QEMU_CHAR_FEATURE_LAST,
-} ChardevFeature;
-
-/* This is the backend as seen by frontend, the actual backend is
- * Chardev */
-typedef struct CharBackend {
-    Chardev *chr;
-    IOEventHandler *chr_event;
-    IOCanReadHandler *chr_can_read;
-    IOReadHandler *chr_read;
-    void *opaque;
-    int tag;
-    int fe_open;
-} CharBackend;
-
-struct Chardev {
-    Object parent_obj;
-
-    QemuMutex chr_write_lock;
-    CharBackend *be;
-    char *label;
-    char *filename;
-    int logfd;
-    int be_open;
-    GSource *gsource;
-    DECLARE_BITMAP(features, QEMU_CHAR_FEATURE_LAST);
-};
-
-/**
- * @qemu_chr_new_from_opts:
- *
- * Create a new character backend from a QemuOpts list.
- *
- * @opts see qemu-config.c for a list of valid options
- *
- * Returns: a new character backend
- */
-Chardev *qemu_chr_new_from_opts(QemuOpts *opts,
-                                Error **errp);
-
-/**
- * @qemu_chr_parse_common:
- *
- * Parse the common options available to all character backends.
- *
- * @opts the options that still need parsing
- * @backend a new backend
- */
-void qemu_chr_parse_common(QemuOpts *opts, ChardevCommon *backend);
-
-/**
- * @qemu_chr_new:
- *
- * Create a new character backend from a URI.
- *
- * @label the name of the backend
- * @filename the URI
- *
- * Returns: a new character backend
- */
-Chardev *qemu_chr_new(const char *label, const char *filename);
-
-
-/**
- * @qemu_chr_fe_disconnect:
- *
- * Close a fd accpeted by character backend.
- * Without associated Chardev, do nothing.
- */
-void qemu_chr_fe_disconnect(CharBackend *be);
-
-/**
- * @qemu_chr_cleanup:
- *
- * Delete all chardevs (when leaving qemu)
- */
-void qemu_chr_cleanup(void);
-
-/**
- * @qemu_chr_fe_wait_connected:
- *
- * Wait for characted backend to be connected, return < 0 on error or
- * if no assicated Chardev.
- */
-int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp);
-
-/**
- * @qemu_chr_new_noreplay:
- *
- * Create a new character backend from a URI.
- * Character device communications are not written
- * into the replay log.
- *
- * @label the name of the backend
- * @filename the URI
- *
- * Returns: a new character backend
- */
-Chardev *qemu_chr_new_noreplay(const char *label, const char *filename);
-
-/**
- * @qemu_chr_fe_set_echo:
- *
- * Ask the backend to override its normal echo setting.  This only really
- * applies to the stdio backend and is used by the QMP server such that you
- * can see what you type if you try to type QMP commands.
- * Without associated Chardev, do nothing.
- *
- * @echo true to enable echo, false to disable echo
- */
-void qemu_chr_fe_set_echo(CharBackend *be, bool echo);
-
-/**
- * @qemu_chr_fe_set_open:
- *
- * Set character frontend open status.  This is an indication that the
- * front end is ready (or not) to begin doing I/O.
- * Without associated Chardev, do nothing.
- */
-void qemu_chr_fe_set_open(CharBackend *be, int fe_open);
-
-/**
- * @qemu_chr_fe_printf:
- *
- * Write to a character backend using a printf style interface.  This
- * function is thread-safe. It does nothing without associated
- * Chardev.
- *
- * @fmt see #printf
- */
-void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
-    GCC_FMT_ATTR(2, 3);
-
-/**
- * @qemu_chr_fe_add_watch:
- *
- * If the backend is connected, create and add a #GSource that fires
- * when the given condition (typically G_IO_OUT|G_IO_HUP or G_IO_HUP)
- * is active; return the #GSource's tag.  If it is disconnected,
- * or without associated Chardev, return 0.
- *
- * @cond the condition to poll for
- * @func the function to call when the condition happens
- * @user_data the opaque pointer to pass to @func
- *
- * Returns: the source tag
- */
-guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
-                            GIOFunc func, void *user_data);
-
-/**
- * @qemu_chr_fe_write:
- *
- * Write data to a character backend from the front end.  This function
- * will send data from the front end to the back end.  This function
- * is thread-safe.
- *
- * @buf the data
- * @len the number of bytes to send
- *
- * Returns: the number of bytes consumed (0 if no assicated Chardev)
- */
-int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len);
-
-/**
- * @qemu_chr_fe_write_all:
- *
- * Write data to a character backend from the front end.  This function will
- * send data from the front end to the back end.  Unlike @qemu_chr_fe_write,
- * this function will block if the back end cannot consume all of the data
- * attempted to be written.  This function is thread-safe.
- *
- * @buf the data
- * @len the number of bytes to send
- *
- * Returns: the number of bytes consumed (0 if no assicated Chardev)
- */
-int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len);
-
-/**
- * @qemu_chr_fe_read_all:
- *
- * Read data to a buffer from the back end.
- *
- * @buf the data buffer
- * @len the number of bytes to read
- *
- * Returns: the number of bytes read (0 if no assicated Chardev)
- */
-int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len);
-
-/**
- * @qemu_chr_fe_ioctl:
- *
- * Issue a device specific ioctl to a backend.  This function is thread-safe.
- *
- * @cmd see CHR_IOCTL_*
- * @arg the data associated with @cmd
- *
- * Returns: if @cmd is not supported by the backend or there is no
- *          associated Chardev, -ENOTSUP, otherwise the return
- *          value depends on the semantics of @cmd
- */
-int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg);
-
-/**
- * @qemu_chr_fe_get_msgfd:
- *
- * For backends capable of fd passing, return the latest file descriptor passed
- * by a client.
- *
- * Returns: -1 if fd passing isn't supported or there is no pending file
- *          descriptor.  If a file descriptor is returned, subsequent calls to
- *          this function will return -1 until a client sends a new file
- *          descriptor.
- */
-int qemu_chr_fe_get_msgfd(CharBackend *be);
-
-/**
- * @qemu_chr_fe_get_msgfds:
- *
- * For backends capable of fd passing, return the number of file received
- * descriptors and fills the fds array up to num elements
- *
- * Returns: -1 if fd passing isn't supported or there are no pending file
- *          descriptors.  If file descriptors are returned, subsequent calls to
- *          this function will return -1 until a client sends a new set of file
- *          descriptors.
- */
-int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int num);
-
-/**
- * @qemu_chr_fe_set_msgfds:
- *
- * For backends capable of fd passing, set an array of fds to be passed with
- * the next send operation.
- * A subsequent call to this function before calling a write function will
- * result in overwriting the fd array with the new value without being send.
- * Upon writing the message the fd array is freed.
- *
- * Returns: -1 if fd passing isn't supported or no associated Chardev.
- */
-int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num);
-
-/**
- * @qemu_chr_be_can_write:
- *
- * Determine how much data the front end can currently accept.  This function
- * returns the number of bytes the front end can accept.  If it returns 0, the
- * front end cannot receive data at the moment.  The function must be polled
- * to determine when data can be received.
- *
- * Returns: the number of bytes the front end can receive via @qemu_chr_be_write
- */
-int qemu_chr_be_can_write(Chardev *s);
-
-/**
- * @qemu_chr_be_write:
- *
- * Write data from the back end to the front end.  Before issuing this call,
- * the caller should call @qemu_chr_be_can_write to determine how much data
- * the front end can currently accept.
- *
- * @buf a buffer to receive data from the front end
- * @len the number of bytes to receive from the front end
- */
-void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len);
-
-/**
- * @qemu_chr_be_write_impl:
- *
- * Implementation of back end writing. Used by replay module.
- *
- * @buf a buffer to receive data from the front end
- * @len the number of bytes to receive from the front end
- */
-void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len);
-
-/**
- * @qemu_chr_be_event:
- *
- * Send an event from the back end to the front end.
- *
- * @event the event to send
- */
-void qemu_chr_be_event(Chardev *s, int event);
-
-/**
- * @qemu_chr_fe_init:
- *
- * Initializes a front end for the given CharBackend and
- * Chardev. Call qemu_chr_fe_deinit() to remove the association and
- * release the driver.
- *
- * Returns: false on error.
- */
-bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp);
-
-/**
- * @qemu_chr_fe_get_driver:
- *
- * Returns the driver associated with a CharBackend or NULL if no
- * associated Chardev.
- */
-Chardev *qemu_chr_fe_get_driver(CharBackend *be);
-
-/**
- * @qemu_chr_fe_deinit:
- *
- * Dissociate the CharBackend from the Chardev.
- *
- * Safe to call without associated Chardev.
- */
-void qemu_chr_fe_deinit(CharBackend *b);
-
-/**
- * @qemu_chr_fe_set_handlers:
- * @b: a CharBackend
- * @fd_can_read: callback to get the amount of data the frontend may
- *               receive
- * @fd_read: callback to receive data from char
- * @fd_event: event callback
- * @opaque: an opaque pointer for the callbacks
- * @context: a main loop context or NULL for the default
- * @set_open: whether to call qemu_chr_fe_set_open() implicitely when
- * any of the handler is non-NULL
- *
- * Set the front end char handlers. The front end takes the focus if
- * any of the handler is non-NULL.
- *
- * Without associated Chardev, nothing is changed.
- */
-void qemu_chr_fe_set_handlers(CharBackend *b,
-                              IOCanReadHandler *fd_can_read,
-                              IOReadHandler *fd_read,
-                              IOEventHandler *fd_event,
-                              void *opaque,
-                              GMainContext *context,
-                              bool set_open);
-
-/**
- * @qemu_chr_fe_take_focus:
- *
- * Take the focus (if the front end is muxed).
- *
- * Without associated Chardev, nothing is changed.
- */
-void qemu_chr_fe_take_focus(CharBackend *b);
-
-void qemu_chr_fe_accept_input(CharBackend *be);
-int qemu_chr_add_client(Chardev *s, int fd);
-Chardev *qemu_chr_find(const char *name);
-
-bool qemu_chr_has_feature(Chardev *chr,
-                          ChardevFeature feature);
-void qemu_chr_set_feature(Chardev *chr,
-                          ChardevFeature feature);
-QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename);
-int qemu_chr_write_all(Chardev *s, const uint8_t *buf, int len);
-int qemu_chr_wait_connected(Chardev *chr, Error **errp);
-
-#define TYPE_CHARDEV "chardev"
-#define CHARDEV(obj) OBJECT_CHECK(Chardev, (obj), TYPE_CHARDEV)
-#define CHARDEV_CLASS(klass) \
-    OBJECT_CLASS_CHECK(ChardevClass, (klass), TYPE_CHARDEV)
-#define CHARDEV_GET_CLASS(obj) \
-    OBJECT_GET_CLASS(ChardevClass, (obj), TYPE_CHARDEV)
-
-#define TYPE_CHARDEV_NULL "chardev-null"
-#define TYPE_CHARDEV_MUX "chardev-mux"
-#define TYPE_CHARDEV_RINGBUF "chardev-ringbuf"
-#define TYPE_CHARDEV_PTY "chardev-pty"
-#define TYPE_CHARDEV_CONSOLE "chardev-console"
-#define TYPE_CHARDEV_STDIO "chardev-stdio"
-#define TYPE_CHARDEV_PIPE "chardev-pipe"
-#define TYPE_CHARDEV_MEMORY "chardev-memory"
-#define TYPE_CHARDEV_PARALLEL "chardev-parallel"
-#define TYPE_CHARDEV_FILE "chardev-file"
-#define TYPE_CHARDEV_SERIAL "chardev-serial"
-#define TYPE_CHARDEV_SOCKET "chardev-socket"
-#define TYPE_CHARDEV_UDP "chardev-udp"
-
-#define CHARDEV_IS_RINGBUF(chr) \
-    object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_RINGBUF)
-#define CHARDEV_IS_PTY(chr) \
-    object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_PTY)
-
-typedef struct ChardevClass {
-    ObjectClass parent_class;
-
-    bool internal; /* TODO: eventually use TYPE_USER_CREATABLE */
-    void (*parse)(QemuOpts *opts, ChardevBackend *backend, Error **errp);
-
-    void (*open)(Chardev *chr, ChardevBackend *backend,
-                 bool *be_opened, Error **errp);
-
-    int (*chr_write)(Chardev *s, const uint8_t *buf, int len);
-    int (*chr_sync_read)(Chardev *s, const uint8_t *buf, int len);
-    GSource *(*chr_add_watch)(Chardev *s, GIOCondition cond);
-    void (*chr_update_read_handler)(Chardev *s, GMainContext *context);
-    int (*chr_ioctl)(Chardev *s, int cmd, void *arg);
-    int (*get_msgfds)(Chardev *s, int* fds, int num);
-    int (*set_msgfds)(Chardev *s, int *fds, int num);
-    int (*chr_add_client)(Chardev *chr, int fd);
-    int (*chr_wait_connected)(Chardev *chr, Error **errp);
-    void (*chr_disconnect)(Chardev *chr);
-    void (*chr_accept_input)(Chardev *chr);
-    void (*chr_set_echo)(Chardev *chr, bool echo);
-    void (*chr_set_fe_open)(Chardev *chr, int fe_open);
-} ChardevClass;
-
-Chardev *qemu_chardev_new(const char *id, const char *typename,
-                          ChardevBackend *backend, Error **errp);
-
-extern int term_escape_char;
-
-/* console.c */
-void qemu_chr_parse_vc(QemuOpts *opts, ChardevBackend *backend, Error **errp);
-
-#endif
diff --git a/monitor.c b/monitor.c
index baa73c98b7..75e7cd26d0 100644
--- a/monitor.c
+++ b/monitor.c
@@ -35,7 +35,7 @@
 #include "exec/gdbstub.h"
 #include "net/net.h"
 #include "net/slirp.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "ui/qemu-spice.h"
 #include "sysemu/numa.h"
 #include "monitor/monitor.h"
@@ -578,7 +578,7 @@ static void monitor_data_init(Monitor *mon)
 
 static void monitor_data_destroy(Monitor *mon)
 {
-    qemu_chr_fe_deinit(&mon->chr);
+    qemu_chr_fe_deinit(&mon->chr, false);
     if (monitor_is_qmp(mon)) {
         json_message_parser_destroy(&mon->qmp.parser);
     }
diff --git a/net/colo-compare.c b/net/colo-compare.c
index 2639c7f0a2..6d500e1dc4 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -25,7 +25,7 @@
 #include "qom/object.h"
 #include "qemu/typedefs.h"
 #include "net/queue.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/sockets.h"
 #include "qapi-visit.h"
 #include "net/colo.h"
@@ -801,11 +801,9 @@ static void colo_compare_finalize(Object *obj)
 {
     CompareState *s = COLO_COMPARE(obj);
 
-    qemu_chr_fe_set_handlers(&s->chr_pri_in, NULL, NULL, NULL, NULL,
-                             s->worker_context, true);
-    qemu_chr_fe_set_handlers(&s->chr_sec_in, NULL, NULL, NULL, NULL,
-                             s->worker_context, true);
-    qemu_chr_fe_deinit(&s->chr_out);
+    qemu_chr_fe_deinit(&s->chr_pri_in, false);
+    qemu_chr_fe_deinit(&s->chr_sec_in, false);
+    qemu_chr_fe_deinit(&s->chr_out, false);
 
     g_main_loop_quit(s->compare_loop);
     qemu_thread_join(&s->thread);
diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index 8b1b06977d..52d978fce2 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -20,7 +20,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/error-report.h"
 #include "trace.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/iov.h"
 #include "qemu/sockets.h"
 
@@ -178,15 +178,15 @@ static void filter_mirror_cleanup(NetFilterState *nf)
 {
     MirrorState *s = FILTER_MIRROR(nf);
 
-    qemu_chr_fe_deinit(&s->chr_out);
+    qemu_chr_fe_deinit(&s->chr_out, false);
 }
 
 static void filter_redirector_cleanup(NetFilterState *nf)
 {
     MirrorState *s = FILTER_REDIRECTOR(nf);
 
-    qemu_chr_fe_deinit(&s->chr_in);
-    qemu_chr_fe_deinit(&s->chr_out);
+    qemu_chr_fe_deinit(&s->chr_in, false);
+    qemu_chr_fe_deinit(&s->chr_out, false);
 }
 
 static void filter_mirror_setup(NetFilterState *nf, Error **errp)
diff --git a/net/slirp.c b/net/slirp.c
index c705a60b62..6a6d727999 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -37,7 +37,7 @@
 #include "qemu/sockets.h"
 #include "slirp/libslirp.h"
 #include "slirp/ip6.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/sysemu.h"
 #include "qemu/cutils.h"
 #include "qapi/error.h"
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 00a0c1cbc5..a042ec6a34 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -12,7 +12,7 @@
 #include "clients.h"
 #include "net/vhost_net.h"
 #include "net/vhost-user.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "qmp-commands.h"
@@ -151,10 +151,7 @@ static void vhost_user_cleanup(NetClientState *nc)
         s->vhost_net = NULL;
     }
     if (nc->queue_index == 0) {
-        Chardev *chr = qemu_chr_fe_get_driver(&s->chr);
-
-        qemu_chr_fe_deinit(&s->chr);
-        object_unparent(OBJECT(chr));
+        qemu_chr_fe_deinit(&s->chr, true);
     }
 
     qemu_purge_queued_packets(nc);
diff --git a/qmp.c b/qmp.c
index 84638e2b2b..7ee9bcfdcf 100644
--- a/qmp.c
+++ b/qmp.c
@@ -21,7 +21,7 @@
 #include "qemu/config-file.h"
 #include "qemu/uuid.h"
 #include "qmp-commands.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "ui/qemu-spice.h"
 #include "ui/vnc.h"
 #include "sysemu/kvm.h"
diff --git a/qtest.c b/qtest.c
index 5aa6636ca8..9a5d1dc50d 100644
--- a/qtest.c
+++ b/qtest.c
@@ -17,7 +17,7 @@
 #include "cpu.h"
 #include "sysemu/qtest.h"
 #include "hw/qdev.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "exec/ioport.h"
 #include "exec/memory.h"
 #include "hw/irq.h"
diff --git a/replay/replay-char.c b/replay/replay-char.c
index aa65955942..cbf7c04a9f 100755
--- a/replay/replay-char.c
+++ b/replay/replay-char.c
@@ -14,7 +14,7 @@
 #include "sysemu/replay.h"
 #include "replay-internal.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 
 /* Char drivers that generate qemu_chr_be_write events
    that should be saved into the log. */
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 2f2ec2c1b3..e79345bdfc 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -25,7 +25,7 @@
 #include "qemu-common.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "slirp.h"
 #include "hw/hw.h"
 #include "qemu/cutils.h"
diff --git a/tests/postcopy-test.c b/tests/postcopy-test.c
index e86f87656a..8142f2ab90 100644
--- a/tests/postcopy-test.c
+++ b/tests/postcopy-test.c
@@ -16,7 +16,7 @@
 #include "qemu/option.h"
 #include "qemu/range.h"
 #include "qemu/sockets.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "sysemu/sysemu.h"
 #include "hw/nvram/chrp_nvram.h"
 
diff --git a/tests/test-char.c b/tests/test-char.c
index 124d0c5439..dfe856cb85 100644
--- a/tests/test-char.c
+++ b/tests/test-char.c
@@ -4,7 +4,7 @@
 #include "qemu-common.h"
 #include "qemu/config-file.h"
 #include "qemu/sockets.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/sysemu.h"
 #include "qapi/error.h"
 #include "qom/qom-qobject.h"
@@ -97,8 +97,7 @@ static void char_stdio_test_subprocess(void)
     ret = qemu_chr_fe_write(&be, (void *)"buf", 4);
     g_assert_cmpint(ret, ==, 4);
 
-    qemu_chr_fe_deinit(&be);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&be, true);
 }
 
 static void char_stdio_test(void)
@@ -146,8 +145,7 @@ static void char_ringbuf_test(void)
     g_assert_cmpstr(data, ==, "");
     g_free(data);
 
-    qemu_chr_fe_deinit(&be);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&be, true);
 
     /* check alias */
     opts = qemu_opts_create(qemu_find_opts("chardev"), "memory-label",
@@ -231,9 +229,8 @@ static void char_mux_test(void)
     g_assert_cmpint(strlen(data), !=, 0);
     g_free(data);
 
-    qemu_chr_fe_deinit(&chr_be1);
-    qemu_chr_fe_deinit(&chr_be2);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&chr_be1, false);
+    qemu_chr_fe_deinit(&chr_be2, true);
 }
 
 typedef struct SocketIdleData {
@@ -396,8 +393,7 @@ static void char_pipe_test(void)
     g_assert_cmpint(fe.read_count, ==, 8);
     g_assert_cmpstr(fe.read_buf, ==, "pipe-in");
 
-    qemu_chr_fe_deinit(&be);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&be, true);
 
     g_assert(g_unlink(in) == 0);
     g_assert(g_unlink(out) == 0);
@@ -511,8 +507,7 @@ static void char_file_test(void)
 
         g_assert_cmpint(fe.read_count, ==, 8);
         g_assert_cmpstr(fe.read_buf, ==, "fifo-in");
-        qemu_chr_fe_deinit(&be);
-        object_unref(OBJECT(chr));
+        qemu_chr_fe_deinit(&be, true);
         g_unlink(fifo);
         g_free(fifo);
     }
@@ -549,7 +544,7 @@ static void char_null_test(void)
     error_free_or_abort(&err);
 
     /* deinit & reinit */
-    qemu_chr_fe_deinit(&be);
+    qemu_chr_fe_deinit(&be, false);
     qemu_chr_fe_init(&be, chr, &error_abort);
 
     qemu_chr_fe_set_open(&be, true);
@@ -563,8 +558,7 @@ static void char_null_test(void)
     ret = qemu_chr_fe_write(&be, (void *)"buf", 4);
     g_assert_cmpint(ret, ==, 4);
 
-    qemu_chr_fe_deinit(&be);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&be, true);
 }
 
 static void char_invalid_test(void)
diff --git a/tests/vhost-user-test.c b/tests/vhost-user-test.c
index 9095af267e..b3cc045765 100644
--- a/tests/vhost-user-test.c
+++ b/tests/vhost-user-test.c
@@ -16,7 +16,7 @@
 #include "qemu/option.h"
 #include "qemu/range.h"
 #include "qemu/sockets.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "sysemu/sysemu.h"
 #include "libqos/libqos.h"
 #include "libqos/pci-pc.h"
@@ -488,10 +488,8 @@ static inline void test_server_connect(TestServer *server)
 static gboolean _test_server_free(TestServer *server)
 {
     int i;
-    Chardev *chr = qemu_chr_fe_get_driver(&server->chr);
 
-    qemu_chr_fe_deinit(&server->chr);
-    object_unparent(OBJECT(chr));
+    qemu_chr_fe_deinit(&server->chr, true);
 
     for (i = 0; i < server->fds_num; i++) {
         close(server->fds[i]);
diff --git a/trace-events b/trace-events
index 433865fa97..d7a4d94168 100644
--- a/trace-events
+++ b/trace-events
@@ -41,13 +41,6 @@ system_wakeup_request(int reason) "reason=%d"
 qemu_system_shutdown_request(int reason) "reason=%d"
 qemu_system_powerdown_request(void) ""
 
-# spice-qemu-char.c
-spice_vmc_write(ssize_t out, int len) "spice wrote %zd of requested %d"
-spice_vmc_read(int bytes, int len) "spice read %d of requested %d"
-spice_vmc_register_interface(void *scd) "spice vmc registered interface %p"
-spice_vmc_unregister_interface(void *scd) "spice vmc unregistered interface %p"
-spice_vmc_event(int event) "spice vmc event %d"
-
 # monitor.c
 monitor_protocol_event_handler(uint32_t event, void *qdict) "event=%d data=%p"
 monitor_protocol_event_emit(uint32_t event, void *data) "event=%d data=%p"
diff --git a/ui/console.c b/ui/console.c
index ac66b3c910..d914cced53 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -27,7 +27,7 @@
 #include "hw/qdev-core.h"
 #include "qemu/timer.h"
 #include "qmp-commands.h"
-#include "sysemu/char.h"
+#include "chardev/char-fe.h"
 #include "trace.h"
 #include "exec/memory.h"
 
diff --git a/ui/gtk.c b/ui/gtk.c
index 0213ad0efc..5bd87c265a 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -54,7 +54,7 @@
 #include "qmp-commands.h"
 #include "x_keymap.h"
 #include "keymaps.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qom/object.h"
 
 #define MAX_VCS 10
diff --git a/util/event_notifier-posix.c b/util/event_notifier-posix.c
index acdbe3b483..73c4046b58 100644
--- a/util/event_notifier-posix.c
+++ b/util/event_notifier-posix.c
@@ -14,7 +14,6 @@
 #include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qemu/event_notifier.h"
-#include "sysemu/char.h"
 #include "qemu/main-loop.h"
 
 #ifdef CONFIG_EVENTFD
diff --git a/vl.c b/vl.c
index 80b86c0274..be4dcf25ba 100644
--- a/vl.c
+++ b/vl.c
@@ -81,7 +81,7 @@ int main(int argc, char **argv)
 #include "sysemu/numa.h"
 #include "exec/gdbstub.h"
 #include "qemu/timer.h"
-#include "sysemu/char.h"
+#include "chardev/char.h"
 #include "qemu/bitmap.h"
 #include "qemu/log.h"
 #include "sysemu/blockdev.h"