diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c
index f22634e73e..97c1645300 100644
--- a/src/esx/esx_driver.c
+++ b/src/esx/esx_driver.c
@@ -3298,7 +3298,7 @@ esxDomainIsPersistent(virDomainPtr domain ATTRIBUTE_UNUSED)
 
 static virDomainSnapshotPtr
 esxDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc,
-                           unsigned int flags ATTRIBUTE_UNUSED)
+                           unsigned int flags)
 {
     esxPrivate *priv = domain->conn->privateData;
     virDomainSnapshotDefPtr def = NULL;
@@ -3310,6 +3310,8 @@ esxDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc,
     esxVI_TaskInfoState taskInfoState;
     virDomainSnapshotPtr snapshot = NULL;
 
+    virCheckFlags(0, NULL);
+
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto failure;
     }
@@ -3371,7 +3373,7 @@ esxDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc,
 
 static char *
 esxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
-                         unsigned int flags ATTRIBUTE_UNUSED)
+                         unsigned int flags)
 {
     esxPrivate *priv = snapshot->domain->conn->privateData;
     esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL;
@@ -3381,6 +3383,8 @@ esxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
     char uuid_string[VIR_UUID_STRING_BUFLEN] = "";
     char *xml = NULL;
 
+    virCheckFlags(0, NULL);
+
     memset(&def, 0, sizeof (virDomainSnapshotDef));
 
     if (esxVI_EnsureSession(priv->host) < 0) {
@@ -3425,12 +3429,14 @@ esxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
 
 
 static int
-esxDomainSnapshotNum(virDomainPtr domain, unsigned int flags ATTRIBUTE_UNUSED)
+esxDomainSnapshotNum(virDomainPtr domain, unsigned int flags)
 {
     int result = 0;
     esxPrivate *priv = domain->conn->privateData;
     esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL;
 
+    virCheckFlags(0, -1);
+
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto failure;
     }
@@ -3457,12 +3463,14 @@ esxDomainSnapshotNum(virDomainPtr domain, unsigned int flags ATTRIBUTE_UNUSED)
 
 static int
 esxDomainSnapshotListNames(virDomainPtr domain, char **names, int nameslen,
-                           unsigned int flags ATTRIBUTE_UNUSED)
+                           unsigned int flags)
 {
     int result = 0;
     esxPrivate *priv = domain->conn->privateData;
     esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL;
 
+    virCheckFlags(0, -1);
+
     if (names == NULL || nameslen < 0) {
         ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid argument"));
         return -1;
@@ -3498,7 +3506,7 @@ esxDomainSnapshotListNames(virDomainPtr domain, char **names, int nameslen,
 
 static virDomainSnapshotPtr
 esxDomainSnapshotLookupByName(virDomainPtr domain, const char *name,
-                              unsigned int flags ATTRIBUTE_UNUSED)
+                              unsigned int flags)
 {
     esxPrivate *priv = domain->conn->privateData;
     esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL;
@@ -3506,6 +3514,8 @@ esxDomainSnapshotLookupByName(virDomainPtr domain, const char *name,
     esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL;
     virDomainSnapshotPtr snapshot = NULL;
 
+    virCheckFlags(0, NULL);
+
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto cleanup;
     }
@@ -3535,12 +3545,7 @@ esxDomainHasCurrentSnapshot(virDomainPtr domain, unsigned int flags)
     esxPrivate *priv = domain->conn->privateData;
     esxVI_VirtualMachineSnapshotTree *currentSnapshotTree = NULL;
 
-    if (flags != 0) {
-        ESX_ERROR(VIR_ERR_INVALID_ARG,
-                  _("Unsupported flags (0x%x) passed to %s"),
-                  flags, __FUNCTION__);
-        return -1;
-    }
+    virCheckFlags(0, -1);
 
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto failure;
@@ -3576,12 +3581,7 @@ esxDomainSnapshotCurrent(virDomainPtr domain, unsigned int flags)
     esxPrivate *priv = domain->conn->privateData;
     esxVI_VirtualMachineSnapshotTree *currentSnapshotTree = NULL;
 
-    if (flags != 0) {
-        ESX_ERROR(VIR_ERR_INVALID_ARG,
-                  _("Unsupported flags (0x%x) passed to %s"),
-                  flags, __FUNCTION__);
-        return NULL;
-    }
+    virCheckFlags(0, NULL);
 
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto cleanup;
@@ -3614,12 +3614,7 @@ esxDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, unsigned int flags)
     esxVI_ManagedObjectReference *task = NULL;
     esxVI_TaskInfoState taskInfoState;
 
-    if (flags != 0) {
-        ESX_ERROR(VIR_ERR_INVALID_ARG,
-                  _("Unsupported flags (0x%x) passed to %s"),
-                  flags, __FUNCTION__);
-        return -1;
-    }
+    virCheckFlags(0, -1);
 
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto failure;
@@ -3672,6 +3667,8 @@ esxDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags)
     esxVI_ManagedObjectReference *task = NULL;
     esxVI_TaskInfoState taskInfoState;
 
+    virCheckFlags(VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN, -1);
+
     if (esxVI_EnsureSession(priv->host) < 0) {
         goto failure;
     }
diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c
index 6bbbcc67e9..d37ee605fd 100644
--- a/src/nwfilter/nwfilter_driver.c
+++ b/src/nwfilter/nwfilter_driver.c
@@ -377,11 +377,13 @@ cleanup:
 
 static char *
 nwfilterDumpXML(virNWFilterPtr obj,
-                unsigned int flags ATTRIBUTE_UNUSED) {
+                unsigned int flags) {
     virNWFilterDriverStatePtr driver = obj->conn->nwfilterPrivateData;
     virNWFilterPoolObjPtr pool;
     char *ret = NULL;
 
+    virCheckFlags(0, NULL);
+
     nwfilterDriverLock(driver);
     pool = virNWFilterPoolObjFindByUUID(&driver->pools, obj->uuid);
     nwfilterDriverUnlock(driver);
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 7d2f3ef518..04aa305be1 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -4982,12 +4982,7 @@ qemuDomainManagedSave(virDomainPtr dom, unsigned int flags)
     int ret = -1;
     int compressed;
 
-    if (flags != 0) {
-        qemuReportError(VIR_ERR_INVALID_ARG,
-                        _("unsupported flags (0x%x) passed to '%s'"),
-                        flags, __FUNCTION__);
-        return -1;
-    }
+    virCheckFlags(0, -1);
 
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, dom->uuid);
@@ -5048,12 +5043,7 @@ qemuDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags)
     int ret = -1;
     char *name = NULL;
 
-    if (flags != 0) {
-        qemuReportError(VIR_ERR_INVALID_ARG,
-                        _("unsupported flags (0x%x) passed to '%s'"),
-                        flags, __FUNCTION__);
-        return -1;
-    }
+    virCheckFlags(0, -1);
 
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, dom->uuid);
@@ -5087,12 +5077,7 @@ qemuDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags)
     int ret = -1;
     char *name = NULL;
 
-    if (flags != 0) {
-        qemuReportError(VIR_ERR_INVALID_ARG,
-                        _("unsupported flags (0x%x) passed to '%s'"),
-                        flags, __FUNCTION__);
-        return -1;
-    }
+    virCheckFlags(0, -1);
 
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, dom->uuid);
@@ -7631,6 +7616,10 @@ static int qemuDomainUpdateDeviceFlags(virDomainPtr dom,
     virCgroupPtr cgroup = NULL;
     int ret = -1;
 
+    virCheckFlags(VIR_DOMAIN_DEVICE_MODIFY_CURRENT |
+                  VIR_DOMAIN_DEVICE_MODIFY_LIVE |
+                  VIR_DOMAIN_DEVICE_MODIFY_CONFIG, -1);
+
     if (flags & VIR_DOMAIN_DEVICE_MODIFY_CONFIG) {
         qemuReportError(VIR_ERR_OPERATION_INVALID,
                         "%s", _("cannot modify the persistent configuration of a domain"));
@@ -10519,11 +10508,7 @@ qemuDomainMigrateSetMaxDowntime(virDomainPtr dom,
     qemuDomainObjPrivatePtr priv;
     int ret = -1;
 
-    if (flags != 0) {
-        qemuReportError(VIR_ERR_INVALID_ARG,
-                        _("unsupported flags (0x%x) passed to '%s'"), flags, __FUNCTION__);
-        return -1;
-    }
+    virCheckFlags(0, -1);
 
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, dom->uuid);
@@ -10682,7 +10667,7 @@ static int qemuDomainSnapshotIsAllowed(virDomainObjPtr vm)
 
 static virDomainSnapshotPtr qemuDomainSnapshotCreateXML(virDomainPtr domain,
                                                         const char *xmlDesc,
-                                                        unsigned int flags ATTRIBUTE_UNUSED)
+                                                        unsigned int flags)
 {
     struct qemud_driver *driver = domain->conn->privateData;
     virDomainObjPtr vm = NULL;
@@ -10694,6 +10679,8 @@ static virDomainSnapshotPtr qemuDomainSnapshotCreateXML(virDomainPtr domain,
     const char *qemuimgarg[] = { NULL, "snapshot", "-c", NULL, NULL, NULL };
     int i;
 
+    virCheckFlags(0, NULL);
+
     qemuDriverLock(driver);
     virUUIDFormat(domain->uuid, uuidstr);
     vm = virDomainFindByUUID(&driver->domains, domain->uuid);
@@ -10799,12 +10786,14 @@ cleanup:
 
 static int qemuDomainSnapshotListNames(virDomainPtr domain, char **names,
                                        int nameslen,
-                                       unsigned int flags ATTRIBUTE_UNUSED)
+                                       unsigned int flags)
 {
     struct qemud_driver *driver = domain->conn->privateData;
     virDomainObjPtr vm = NULL;
     int n = -1;
 
+    virCheckFlags(0, -1);
+
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, domain->uuid);
     if (!vm) {
@@ -10825,12 +10814,14 @@ cleanup:
 }
 
 static int qemuDomainSnapshotNum(virDomainPtr domain,
-                                 unsigned int flags ATTRIBUTE_UNUSED)
+                                 unsigned int flags)
 {
     struct qemud_driver *driver = domain->conn->privateData;
     virDomainObjPtr vm = NULL;
     int n = -1;
 
+    virCheckFlags(0, -1);
+
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, domain->uuid);
     if (!vm) {
@@ -10852,13 +10843,15 @@ cleanup:
 
 static virDomainSnapshotPtr qemuDomainSnapshotLookupByName(virDomainPtr domain,
                                                            const char *name,
-                                                           unsigned int flags ATTRIBUTE_UNUSED)
+                                                           unsigned int flags)
 {
     struct qemud_driver *driver = domain->conn->privateData;
     virDomainObjPtr vm;
     virDomainSnapshotObjPtr snap = NULL;
     virDomainSnapshotPtr snapshot = NULL;
 
+    virCheckFlags(0, NULL);
+
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, domain->uuid);
     if (!vm) {
@@ -10886,12 +10879,14 @@ cleanup:
 }
 
 static int qemuDomainHasCurrentSnapshot(virDomainPtr domain,
-                                        unsigned int flags ATTRIBUTE_UNUSED)
+                                        unsigned int flags)
 {
     struct qemud_driver *driver = domain->conn->privateData;
     virDomainObjPtr vm;
     int ret = -1;
 
+    virCheckFlags(0, -1);
+
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, domain->uuid);
     if (!vm) {
@@ -10912,12 +10907,14 @@ cleanup:
 }
 
 static virDomainSnapshotPtr qemuDomainSnapshotCurrent(virDomainPtr domain,
-                                                      unsigned int flags ATTRIBUTE_UNUSED)
+                                                      unsigned int flags)
 {
     struct qemud_driver *driver = domain->conn->privateData;
     virDomainObjPtr vm;
     virDomainSnapshotPtr snapshot = NULL;
 
+    virCheckFlags(0, NULL);
+
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, domain->uuid);
     if (!vm) {
@@ -10944,7 +10941,7 @@ cleanup:
 }
 
 static char *qemuDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
-                                       unsigned int flags ATTRIBUTE_UNUSED)
+                                       unsigned int flags)
 {
     struct qemud_driver *driver = snapshot->domain->conn->privateData;
     virDomainObjPtr vm = NULL;
@@ -10952,6 +10949,8 @@ static char *qemuDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
     virDomainSnapshotObjPtr snap = NULL;
     char uuidstr[VIR_UUID_STRING_BUFLEN];
 
+    virCheckFlags(0, NULL);
+
     qemuDriverLock(driver);
     virUUIDFormat(snapshot->domain->uuid, uuidstr);
     vm = virDomainFindByUUID(&driver->domains, snapshot->domain->uuid);
@@ -10979,7 +10978,7 @@ cleanup:
 }
 
 static int qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot,
-                                      unsigned int flags ATTRIBUTE_UNUSED)
+                                      unsigned int flags)
 {
     struct qemud_driver *driver = snapshot->domain->conn->privateData;
     virDomainObjPtr vm = NULL;
@@ -10990,6 +10989,8 @@ static int qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot,
     qemuDomainObjPrivatePtr priv;
     int rc;
 
+    virCheckFlags(0, -1);
+
     qemuDriverLock(driver);
     virUUIDFormat(snapshot->domain->uuid, uuidstr);
     vm = virDomainFindByUUID(&driver->domains, snapshot->domain->uuid);
@@ -11215,6 +11216,8 @@ static int qemuDomainSnapshotDelete(virDomainSnapshotPtr snapshot,
     char uuidstr[VIR_UUID_STRING_BUFLEN];
     struct snap_remove rem;
 
+    virCheckFlags(VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN, -1);
+
     qemuDriverLock(driver);
     virUUIDFormat(snapshot->domain->uuid, uuidstr);
     vm = virDomainFindByUUID(&driver->domains, snapshot->domain->uuid);
diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
index d47682247f..2c69ba994a 100644
--- a/src/storage/storage_driver.c
+++ b/src/storage/storage_driver.c
@@ -1681,11 +1681,7 @@ storageVolumeWipe(virStorageVolPtr obj,
     virStorageVolDefPtr vol = NULL;
     int ret = -1;
 
-    if (flags != 0) {
-        virStorageReportError(VIR_ERR_INVALID_ARG,
-                              _("Unsupported flags (0x%x) passed to '%s'"), flags, __FUNCTION__);
-        goto out;
-    }
+    virCheckFlags(0, -1);
 
     storageDriverLock(driver);
     pool = virStoragePoolObjFindByName(&driver->pools, obj->pool);
diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c
index a07cf8e449..f564213dc7 100644
--- a/src/vbox/vbox_tmpl.c
+++ b/src/vbox/vbox_tmpl.c
@@ -4877,6 +4877,10 @@ static int vboxDomainAttachDeviceFlags(virDomainPtr dom, const char *xml,
 
 static int vboxDomainUpdateDeviceFlags(virDomainPtr dom, const char *xml,
                                        unsigned int flags) {
+    virCheckFlags(VIR_DOMAIN_DEVICE_MODIFY_CURRENT |
+                  VIR_DOMAIN_DEVICE_MODIFY_LIVE |
+                  VIR_DOMAIN_DEVICE_MODIFY_CONFIG, -1);
+
     if (flags & VIR_DOMAIN_DEVICE_MODIFY_CONFIG) {
         vboxError(VIR_ERR_OPERATION_INVALID, "%s",
                   _("cannot modify the persistent configuration of a domain"));
@@ -5166,7 +5170,7 @@ cleanup:
 static virDomainSnapshotPtr
 vboxDomainSnapshotCreateXML(virDomainPtr dom,
                             const char *xmlDesc,
-                            unsigned int flags ATTRIBUTE_UNUSED)
+                            unsigned int flags)
 {
     VBOX_OBJECT_CHECK(dom->conn, virDomainSnapshotPtr, NULL);
     virDomainSnapshotDefPtr def = NULL;
@@ -5185,6 +5189,8 @@ vboxDomainSnapshotCreateXML(virDomainPtr dom,
     PRInt32 result;
 #endif
 
+    virCheckFlags(0, NULL);
+
     if (!(def = virDomainSnapshotDefParseString(xmlDesc, 1)))
         goto cleanup;
 
@@ -5282,7 +5288,7 @@ cleanup:
 
 static char *
 vboxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
-                          unsigned int flags ATTRIBUTE_UNUSED)
+                          unsigned int flags)
 {
     virDomainPtr dom = snapshot->domain;
     VBOX_OBJECT_CHECK(dom->conn, char *, NULL);
@@ -5298,6 +5304,8 @@ vboxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot,
     PRBool online = PR_FALSE;
     char uuidstr[VIR_UUID_STRING_BUFLEN];
 
+    virCheckFlags(0, NULL);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(domiid) < 0) {
         virReportOOMError();
@@ -5399,7 +5407,7 @@ no_memory:
 
 static int
 vboxDomainSnapshotNum(virDomainPtr dom,
-                      unsigned int flags ATTRIBUTE_UNUSED)
+                      unsigned int flags)
 {
     VBOX_OBJECT_CHECK(dom->conn, int, -1);
     vboxIID *iid = NULL;
@@ -5407,6 +5415,8 @@ vboxDomainSnapshotNum(virDomainPtr dom,
     nsresult rc;
     PRUint32 snapshotCount;
 
+    virCheckFlags(0, -1);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(iid) < 0) {
         virReportOOMError();
@@ -5442,7 +5452,7 @@ static int
 vboxDomainSnapshotListNames(virDomainPtr dom,
                             char **names,
                             int nameslen,
-                            unsigned int flags ATTRIBUTE_UNUSED)
+                            unsigned int flags)
 {
     VBOX_OBJECT_CHECK(dom->conn, int, -1);
     vboxIID *iid = NULL;
@@ -5452,6 +5462,8 @@ vboxDomainSnapshotListNames(virDomainPtr dom,
     int count = 0;
     int i;
 
+    virCheckFlags(0, -1);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(iid) < 0) {
         virReportOOMError();
@@ -5512,7 +5524,7 @@ cleanup:
 static virDomainSnapshotPtr
 vboxDomainSnapshotLookupByName(virDomainPtr dom,
                                const char *name,
-                               unsigned int flags ATTRIBUTE_UNUSED)
+                               unsigned int flags)
 {
     VBOX_OBJECT_CHECK(dom->conn, virDomainSnapshotPtr, NULL);
     vboxIID *iid = NULL;
@@ -5520,6 +5532,8 @@ vboxDomainSnapshotLookupByName(virDomainPtr dom,
     ISnapshot *snapshot = NULL;
     nsresult rc;
 
+    virCheckFlags(0, NULL);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(iid) < 0) {
         virReportOOMError();
@@ -5549,7 +5563,7 @@ cleanup:
 
 static int
 vboxDomainHasCurrentSnapshot(virDomainPtr dom,
-                             unsigned int flags ATTRIBUTE_UNUSED)
+                             unsigned int flags)
 {
     VBOX_OBJECT_CHECK(dom->conn, int, -1);
     vboxIID *iid = NULL;
@@ -5557,6 +5571,8 @@ vboxDomainHasCurrentSnapshot(virDomainPtr dom,
     ISnapshot *snapshot = NULL;
     nsresult rc;
 
+    virCheckFlags(0, -1);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(iid) < 0) {
         virReportOOMError();
@@ -5592,7 +5608,7 @@ cleanup:
 
 static virDomainSnapshotPtr
 vboxDomainSnapshotCurrent(virDomainPtr dom,
-                          unsigned int flags ATTRIBUTE_UNUSED)
+                          unsigned int flags)
 {
     VBOX_OBJECT_CHECK(dom->conn, virDomainSnapshotPtr, NULL);
     vboxIID *iid = NULL;
@@ -5602,6 +5618,8 @@ vboxDomainSnapshotCurrent(virDomainPtr dom,
     char *name = NULL;
     nsresult rc;
 
+    virCheckFlags(0, NULL);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(iid) < 0) {
         virReportOOMError();
@@ -5763,7 +5781,7 @@ cleanup:
 
 static int
 vboxDomainRevertToSnapshot(virDomainSnapshotPtr snapshot,
-                           unsigned int flags ATTRIBUTE_UNUSED)
+                           unsigned int flags)
 {
     virDomainPtr dom = snapshot->domain;
     VBOX_OBJECT_CHECK(dom->conn, int, -1);
@@ -5775,6 +5793,8 @@ vboxDomainRevertToSnapshot(virDomainSnapshotPtr snapshot,
     PRUint32 state;
     nsresult rc;
 
+    virCheckFlags(0, -1);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(domiid) < 0) {
         virReportOOMError();
@@ -5941,6 +5961,8 @@ vboxDomainSnapshotDelete(virDomainSnapshotPtr snapshot,
     PRUint32 state;
     nsresult rc;
 
+    virCheckFlags(VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN, -1);
+
 #if VBOX_API_VERSION == 2002
     if (VIR_ALLOC(domiid) < 0) {
         virReportOOMError();
diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c
index 950f1b5f10..ea5addd51c 100644
--- a/src/xen/xend_internal.c
+++ b/src/xen/xend_internal.c
@@ -4205,6 +4205,10 @@ xenDaemonUpdateDeviceFlags(virDomainPtr domain, const char *xml,
     virBuffer buf = VIR_BUFFER_INITIALIZER;
     char class[8], ref[80];
 
+    virCheckFlags(VIR_DOMAIN_DEVICE_MODIFY_CURRENT |
+                  VIR_DOMAIN_DEVICE_MODIFY_LIVE |
+                  VIR_DOMAIN_DEVICE_MODIFY_CONFIG, -1);
+
     if ((domain == NULL) || (domain->conn == NULL) || (domain->name == NULL)) {
         virXendError(VIR_ERR_INVALID_ARG, __FUNCTION__);
         return -1;