diff --git a/hw/esp.c b/hw/esp.c
index 67f02bad56..6d3f5d239b 100644
--- a/hw/esp.c
+++ b/hw/esp.c
@@ -395,7 +395,7 @@ static void esp_do_dma(ESPState *s)
     esp_dma_done(s);
 }
 
-static void esp_command_complete(SCSIRequest *req, uint32_t arg)
+static void esp_command_complete(SCSIRequest *req, uint32_t status)
 {
     ESPState *s = DO_UPCAST(ESPState, busdev.qdev, req->bus->qbus.parent);
 
@@ -406,10 +406,10 @@ static void esp_command_complete(SCSIRequest *req, uint32_t arg)
     s->ti_size = 0;
     s->dma_left = 0;
     s->async_len = 0;
-    if (arg) {
+    if (status) {
         DPRINTF("Command failed\n");
     }
-    s->status = arg;
+    s->status = status;
     s->rregs[ESP_RSTAT] = STAT_ST;
     esp_dma_done(s);
     if (s->current_req) {
@@ -419,12 +419,12 @@ static void esp_command_complete(SCSIRequest *req, uint32_t arg)
     }
 }
 
-static void esp_transfer_data(SCSIRequest *req, uint32_t arg)
+static void esp_transfer_data(SCSIRequest *req, uint32_t len)
 {
     ESPState *s = DO_UPCAST(ESPState, busdev.qdev, req->bus->qbus.parent);
 
     DPRINTF("transfer %d/%d\n", s->dma_left, s->ti_size);
-    s->async_len = arg;
+    s->async_len = len;
     s->async_buf = scsi_req_get_buf(req);
     if (s->dma_left) {
         esp_do_dma(s);
diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index c965ed40d8..83084b6b6a 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -680,7 +680,7 @@ static void lsi_request_cancelled(SCSIRequest *req)
 
 /* Record that data is available for a queued command.  Returns zero if
    the device was reselected, nonzero if the IO is deferred.  */
-static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
+static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t len)
 {
     lsi_request *p;
 
@@ -693,7 +693,7 @@ static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
     if (p->pending) {
         BADF("Multiple IO pending for tag %d\n", tag);
     }
-    p->pending = arg;
+    p->pending = len;
     /* Reselect if waiting for it, or if reselection triggers an IRQ
        and the bus is free.
        Since no interrupt stacking is implemented in the emulation, it
@@ -707,20 +707,20 @@ static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
         return 0;
     } else {
         DPRINTF("Queueing IO tag=0x%x\n", tag);
-        p->pending = arg;
+        p->pending = len;
         return 1;
     }
 }
 
  /* Callback to indicate that the SCSI layer has completed a command.  */
-static void lsi_command_complete(SCSIRequest *req, uint32_t arg)
+static void lsi_command_complete(SCSIRequest *req, uint32_t status)
 {
     LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
     int out;
 
     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
-    DPRINTF("Command complete status=%d\n", (int)arg);
-    s->status = arg;
+    DPRINTF("Command complete status=%d\n", (int)status);
+    s->status = status;
     s->command_complete = 2;
     if (s->waiting && s->dbc != 0) {
         /* Raise phase mismatch for short transfers.  */
@@ -738,14 +738,14 @@ static void lsi_command_complete(SCSIRequest *req, uint32_t arg)
 }
 
  /* Callback to indicate that the SCSI layer has completed a transfer.  */
-static void lsi_transfer_data(SCSIRequest *req, uint32_t arg)
+static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
 {
     LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
     int out;
 
     if (s->waiting == 1 || !s->current || req->tag != s->current->tag ||
         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
-        if (lsi_queue_tag(s, req->tag, arg)) {
+        if (lsi_queue_tag(s, req->tag, len)) {
             return;
         }
     }
@@ -753,8 +753,8 @@ static void lsi_transfer_data(SCSIRequest *req, uint32_t arg)
     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 
     /* host adapter (re)connected */
-    DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, arg);
-    s->current->dma_len = arg;
+    DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
+    s->current->dma_len = len;
     s->command_complete = 1;
     if (s->waiting) {
         if (s->waiting == 1 || s->dbc == 0) {
diff --git a/hw/spapr_vscsi.c b/hw/spapr_vscsi.c
index fea1f2f8b7..1c901ef6eb 100644
--- a/hw/spapr_vscsi.c
+++ b/hw/spapr_vscsi.c
@@ -480,15 +480,15 @@ static void vscsi_send_request_sense(VSCSIState *s, vscsi_req *req)
 }
 
 /* Callback to indicate that the SCSI layer has completed a transfer.  */
-static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t arg)
+static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t len)
 {
     VSCSIState *s = DO_UPCAST(VSCSIState, vdev.qdev, sreq->bus->qbus.parent);
     vscsi_req *req = vscsi_find_req(s, sreq);
     uint8_t *buf;
-    int len, rc = 0;
+    int rc = 0;
 
-    dprintf("VSCSI: SCSI xfer complete tag=0x%x arg=0x%x, req=%p\n",
-            sreq->tag, arg, req);
+    dprintf("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
+            sreq->tag, len, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
         return;
@@ -497,7 +497,7 @@ static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t arg)
     if (req->sensing) {
         uint8_t *buf = scsi_req_get_buf(sreq);
 
-        len = MIN(arg, SCSI_SENSE_BUF_SIZE);
+        len = MIN(len, SCSI_SENSE_BUF_SIZE);
         dprintf("VSCSI: Sense data, %d bytes:\n", len);
         dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 buf[0], buf[1], buf[2], buf[3],
@@ -511,12 +511,9 @@ static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t arg)
         return;
     }
 
-    /* "arg" is how much we have read for reads and how much we want
-     * to write for writes (ie, how much is to be DMA'd)
-     */
-    if (arg) {
+    if (len) {
         buf = scsi_req_get_buf(sreq);
-        rc = vscsi_srp_transfer_data(s, req, req->writing, buf, arg);
+        rc = vscsi_srp_transfer_data(s, req, req->writing, buf, len);
     }
     if (rc < 0) {
         fprintf(stderr, "VSCSI: RDMA error rc=%d!\n", rc);
@@ -531,30 +528,30 @@ static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t arg)
 }
 
 /* Callback to indicate that the SCSI layer has completed a transfer.  */
-static void vscsi_command_complete(SCSIRequest *sreq, uint32_t arg)
+static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status)
 {
     VSCSIState *s = DO_UPCAST(VSCSIState, vdev.qdev, sreq->bus->qbus.parent);
     vscsi_req *req = vscsi_find_req(s, sreq);
     int32_t res_in = 0, res_out = 0;
 
-    dprintf("VSCSI: SCSI cmd complete, r=0x%x tag=0x%x arg=0x%x, req=%p\n",
-            reason, sreq->tag, arg, req);
+    dprintf("VSCSI: SCSI cmd complete, r=0x%x tag=0x%x status=0x%x, req=%p\n",
+            reason, sreq->tag, status, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
         return;
     }
 
-    if (!req->sensing && arg == CHECK_CONDITION) {
+    if (!req->sensing && status == CHECK_CONDITION) {
         vscsi_send_request_sense(s, req);
         return;
     }
 
     if (req->sensing) {
         dprintf("VSCSI: Sense done !\n");
-        arg = CHECK_CONDITION;
+        status = CHECK_CONDITION;
     } else {
-        dprintf("VSCSI: Command complete err=%d\n", arg);
-        if (arg == 0) {
+        dprintf("VSCSI: Command complete err=%d\n", status);
+        if (status == 0) {
             /* We handle overflows, not underflows for normal commands,
              * but hopefully nobody cares
              */
diff --git a/hw/usb-msd.c b/hw/usb-msd.c
index 4ebf6eb5f6..6ec2255bce 100644
--- a/hw/usb-msd.c
+++ b/hw/usb-msd.c
@@ -208,7 +208,7 @@ static void usb_msd_send_status(MSDState *s, USBPacket *p)
     memcpy(p->data, &csw, len);
 }
 
-static void usb_msd_transfer_data(SCSIRequest *req, uint32_t arg)
+static void usb_msd_transfer_data(SCSIRequest *req, uint32_t len)
 {
     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
     USBPacket *p = s->packet;
@@ -218,7 +218,7 @@ static void usb_msd_transfer_data(SCSIRequest *req, uint32_t arg)
     }
 
     assert((s->mode == USB_MSDM_DATAOUT) == (req->cmd.mode == SCSI_XFER_TO_DEV));
-    s->scsi_len = arg;
+    s->scsi_len = len;
     s->scsi_buf = scsi_req_get_buf(req);
     if (p) {
         usb_msd_copy_data(s);
@@ -233,7 +233,7 @@ static void usb_msd_transfer_data(SCSIRequest *req, uint32_t arg)
     }
 }
 
-static void usb_msd_command_complete(SCSIRequest *req, uint32_t arg)
+static void usb_msd_command_complete(SCSIRequest *req, uint32_t status)
 {
     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
     USBPacket *p = s->packet;
@@ -241,9 +241,9 @@ static void usb_msd_command_complete(SCSIRequest *req, uint32_t arg)
     if (req->tag != s->tag) {
         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", req->tag);
     }
-    DPRINTF("Command complete %d\n", arg);
+    DPRINTF("Command complete %d\n", status);
     s->residue = s->data_len;
-    s->result = arg != 0;
+    s->result = status != 0;
     if (s->packet) {
         if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
             /* A deferred packet with no write data remaining must be