diff --git a/hw/acpi_ich9.c b/hw/acpi_ich9.c
new file mode 100644
index 0000000..59c0807
--- /dev/null
+++ b/hw/acpi_ich9.c
@@ -0,0 +1,315 @@
+/*
+ * ACPI implementation
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2 as published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+/*
+ *  Copyright (c) 2009 Isaku Yamahata <yamahata at valinux co jp>
+ *                     VA Linux Systems Japan K.K.
+ *
+ *  This is based on acpi.c.
+ */
+#include "hw.h"
+#include "pc.h"
+#include "pci.h"
+#include "qemu-timer.h"
+#include "sysemu.h"
+#include "acpi.h"
+
+#include "q35.h"
+
+//#define DEBUG
+
+#ifdef DEBUG
+#define ICH9_DEBUG(fmt, ...) \
+do { printf("%s "fmt, __func__, ## __VA_ARGS__); } while (0)
+#else
+#define ICH9_DEBUG(fmt, ...)    do { } while (0)
+#endif
+
+static void pm_ioport_write_fallback(void *opaque, uint32_t addr, int len,
+                                     uint32_t val);
+static uint32_t pm_ioport_read_fallback(void *opaque, uint32_t addr, int len);
+
+static void pm_update_sci(ICH9_LPCPmRegs *pm)
+{
+    int sci_level, pm1a_sts;
+
+    pm1a_sts = acpi_pm1_evt_get_sts(&pm->pm1a, pm->tmr.overflow_time);
+
+    sci_level = (((pm1a_sts & pm->pm1a.en) &
+                  (ACPI_BITMASK_RT_CLOCK_ENABLE |
+                   ACPI_BITMASK_POWER_BUTTON_ENABLE |
+                   ACPI_BITMASK_GLOBAL_LOCK_ENABLE |
+                   ACPI_BITMASK_TIMER_ENABLE)) != 0);
+    qemu_set_irq(pm->irq, sci_level);
+
+    /* schedule a timer interruption if needed */
+    acpi_pm_tmr_update(&pm->tmr,
+                       (pm->pm1a.en & ACPI_BITMASK_TIMER_ENABLE) &&
+                       !(pm1a_sts & ACPI_BITMASK_TIMER_STATUS));
+}
+
+static void ich9_pm_update_sci_fn(ACPIPMTimer *tmr)
+{
+    ICH9_LPCPmRegs *pm = container_of(tmr, ICH9_LPCPmRegs, tmr);
+    pm_update_sci(pm);
+}
+
+static void pm_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+
+    switch (addr & ICH9_PMIO_MASK) {
+    case ICH9_PMIO_GPE0_STS ... (ICH9_PMIO_GPE0_STS + ICH9_PMIO_GPE0_LEN - 1):
+        acpi_gpe_ioport_writeb(&pm->gpe0, addr, val);
+        break;
+    default:
+        break;
+    }
+
+    ICH9_DEBUG("port=0x%04x val=0x%04x\n", addr, val);
+}
+
+static uint32_t pm_ioport_readb(void *opaque, uint32_t addr)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+    uint32_t val = 0;
+
+    switch (addr & ICH9_PMIO_MASK) {
+    case ICH9_PMIO_GPE0_STS ... (ICH9_PMIO_GPE0_STS + ICH9_PMIO_GPE0_LEN - 1):
+        val = acpi_gpe_ioport_readb(&pm->gpe0, addr);
+        break;
+    default:
+        val = 0;
+        break;
+    }
+    ICH9_DEBUG("port=0x%04x val=0x%04x\n", addr, val);
+    return val;
+}
+
+static void pm_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+
+    switch (addr & ICH9_PMIO_MASK) {
+    case ICH9_PMIO_PM1_STS:
+        acpi_pm1_evt_write_sts(&pm->pm1a, &pm->tmr, val);
+        pm_update_sci(pm);
+        break;
+    case ICH9_PMIO_PM1_EN:
+        pm->pm1a.en = val;
+        pm_update_sci(pm);
+        break;
+    case ICH9_PMIO_PM1_CNT:
+        acpi_pm1_cnt_write(&pm->pm1a, &pm->pm1_cnt, val);
+        break;
+    default:
+        pm_ioport_write_fallback(opaque, addr, 2, val);
+        break;
+    }
+    ICH9_DEBUG("port=0x%04x val=0x%04x\n", addr, val);
+}
+
+static uint32_t pm_ioport_readw(void *opaque, uint32_t addr)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+    uint32_t val;
+
+    switch (addr & ICH9_PMIO_MASK) {
+    case ICH9_PMIO_PM1_STS:
+        val = acpi_pm1_evt_get_sts(&pm->pm1a, pm->tmr.overflow_time);
+        break;
+    case ICH9_PMIO_PM1_EN:
+        val = pm->pm1a.en;
+        break;
+    case ICH9_PMIO_PM1_CNT:
+        val = pm->pm1_cnt.cnt;
+        break;
+    default:
+        val = pm_ioport_read_fallback(opaque, addr, 2);
+        break;
+    }
+    ICH9_DEBUG("port=0x%04x val=0x%04x\n", addr, val);
+    return val;
+}
+
+static void pm_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+
+    switch (addr & ICH9_PMIO_MASK) {
+    case ICH9_PMIO_SMI_EN:
+        pm->smi_en = val;
+        break;
+    default:
+        pm_ioport_write_fallback(opaque, addr, 4, val);
+        break;
+    }
+    ICH9_DEBUG("port=0x%04x val=0x%08x\n", addr, val);
+}
+
+static uint32_t pm_ioport_readl(void *opaque, uint32_t addr)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+    uint32_t val;
+
+    switch (addr & ICH9_PMIO_MASK) {
+    case ICH9_PMIO_PM1_TMR:
+        val = acpi_pm_tmr_get(&pm->tmr);
+        break;
+    case ICH9_PMIO_SMI_EN:
+        val = pm->smi_en;
+        break;
+
+    default:
+        val = pm_ioport_read_fallback(opaque, addr, 4);
+        break;
+    }
+    ICH9_DEBUG("port=0x%04x val=0x%08x\n", addr, val);
+    return val;
+}
+
+static void pm_ioport_write_fallback(void *opaque, uint32_t addr, int len,
+                                     uint32_t val)
+ {
+    int subsize = (len == 4) ? 2 : 1;
+    IOPortWriteFunc *ioport_write =
+        (subsize == 2) ? pm_ioport_writew : pm_ioport_writeb;
+
+    int i;
+
+    for (i = 0; i < len; i += subsize) {
+        ioport_write(opaque, addr, val);
+        val >>= 8 * subsize;
+    }
+}
+
+static uint32_t pm_ioport_read_fallback(void *opaque, uint32_t addr, int len)
+{
+    int subsize = (len == 4) ? 2 : 1;
+    IOPortReadFunc *ioport_read =
+        (subsize == 2) ? pm_ioport_readw : pm_ioport_readb;
+
+    uint32_t val;
+    int i;
+
+    val = 0;
+    for (i = 0; i < len; i += subsize) {
+        val <<= 8 * subsize;
+        val |= ioport_read(opaque, addr);
+    }
+
+    return val;
+}
+
+void ich9_pm_iospace_update(ICH9_LPCPmRegs *pm, uint32_t pm_io_base)
+{
+    ICH9_DEBUG("to 0x%x\n", pm_io_base);
+
+    assert((pm_io_base & ICH9_PMIO_MASK) == 0);
+
+    if (pm->pm_io_base != 0) {
+        isa_unassign_ioport(pm->pm_io_base, ICH9_PMIO_SIZE);
+    }
+
+    /* don't map at 0 */
+    if (pm_io_base == 0) {
+        return;
+    }
+
+    register_ioport_write(pm_io_base, ICH9_PMIO_SIZE, 1, pm_ioport_writeb, pm);
+    register_ioport_read(pm_io_base, ICH9_PMIO_SIZE, 1, pm_ioport_readb, pm);
+    register_ioport_write(pm_io_base, ICH9_PMIO_SIZE, 2, pm_ioport_writew, pm);
+    register_ioport_read(pm_io_base, ICH9_PMIO_SIZE, 2, pm_ioport_readw, pm);
+    register_ioport_write(pm_io_base, ICH9_PMIO_SIZE, 4, pm_ioport_writel, pm);
+    register_ioport_read(pm_io_base, ICH9_PMIO_SIZE, 4, pm_ioport_readl, pm);
+
+    pm->pm_io_base = pm_io_base;
+    acpi_gpe_blk(&pm->gpe0, pm_io_base + ICH9_PMIO_GPE0_STS);
+}
+
+static int ich9_pm_post_load(void *opaque, int version_id)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+    uint32_t pm_io_base = pm->pm_io_base;
+    pm->pm_io_base = 0;
+    ich9_pm_iospace_update(pm, pm_io_base);
+    return 0;
+}
+
+#define VMSTATE_GPE_ARRAY(_field, _state)                            \
+ {                                                                   \
+     .name       = (stringify(_field)),                              \
+     .version_id = 0,                                                \
+     .num        = ICH9_PMIO_GPE0_LEN,                               \
+     .info       = &vmstate_info_uint8,                              \
+     .size       = sizeof(uint8_t),                                  \
+     .flags      = VMS_ARRAY | VMS_POINTER,                          \
+     .offset     = vmstate_offset_pointer(_state, _field, uint8_t),  \
+ }
+
+const VMStateDescription vmstate_ich9_pm = {
+    .name = "ich9_pm",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = ich9_pm_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT16(pm1a.sts, ICH9_LPCPmRegs),
+        VMSTATE_UINT16(pm1a.en, ICH9_LPCPmRegs),
+        VMSTATE_UINT16(pm1_cnt.cnt, ICH9_LPCPmRegs),
+        VMSTATE_TIMER(tmr.timer, ICH9_LPCPmRegs),
+        VMSTATE_INT64(tmr.overflow_time, ICH9_LPCPmRegs),
+        VMSTATE_GPE_ARRAY(gpe0.sts, ICH9_LPCPmRegs),
+        VMSTATE_GPE_ARRAY(gpe0.en, ICH9_LPCPmRegs),
+        VMSTATE_UINT32(smi_en, ICH9_LPCPmRegs),
+        VMSTATE_UINT32(smi_sts, ICH9_LPCPmRegs),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void pm_reset(void *opaque)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+    ich9_pm_iospace_update(pm, 0);
+
+    acpi_pm1_evt_reset(&pm->pm1a);
+    acpi_pm1_cnt_reset(&pm->pm1_cnt);
+    acpi_pm_tmr_reset(&pm->tmr);
+    acpi_gpe_reset(&pm->gpe0);
+
+    pm_update_sci(pm);
+}
+
+static void pm_powerdown(void *opaque, int irq, int power_failing)
+{
+    ICH9_LPCPmRegs *pm = opaque;
+    ACPIPM1EVT *pm1a = pm ? &pm->pm1a : NULL;
+    ACPIPMTimer *tmr = pm ? &pm->tmr : NULL;
+
+    acpi_pm1_evt_power_down(pm1a, tmr);
+}
+
+void ich9_pm_init(ICH9_LPCPmRegs *pm, qemu_irq sci_irq, qemu_irq cmos_s3)
+{
+    acpi_pm_tmr_init(&pm->tmr, ich9_pm_update_sci_fn);
+    acpi_pm1_cnt_init(&pm->pm1_cnt, cmos_s3);
+    acpi_gpe_init(&pm->gpe0, ICH9_PMIO_GPE0_LEN);
+
+    pm->irq = sci_irq;
+    qemu_register_reset(pm_reset, pm);
+    qemu_system_powerdown = *qemu_allocate_irqs(pm_powerdown, pm, 1);
+}
diff --git a/hw/acpi_ich9.h b/hw/acpi_ich9.h
new file mode 100644
index 0000000..f55c0e9
--- /dev/null
+++ b/hw/acpi_ich9.h
@@ -0,0 +1,53 @@
+/*
+ * QEMU GMCH/ICH9 LPC PM Emulation
+ *
+ *  Copyright (c) 2009 Isaku Yamahata <yamahata at valinux co jp>
+ *                     VA Linux Systems Japan K.K.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+
+#ifndef HW_ACPI_ICH9_H
+#define HW_ACPI_ICH9_H
+
+#include "acpi.h"
+
+typedef struct ICH9_LPCPmRegs {
+    ACPIPM1EVT pm1a;
+
+    /*
+     * In ich9 spec says that pm1_cnt register is 32bit width and
+     * that the upper 16bits are reserved and unused.
+     * PM1a_CNT_BLK = 2 in FADT so it is defined as uint16_t.
+     */
+    ACPIPM1CNT pm1_cnt;
+
+    ACPIPMTimer tmr;
+
+    ACPIGPE gpe0;
+
+    uint32_t smi_en;
+    uint32_t smi_sts;
+
+    qemu_irq irq;      /* SCI */
+
+    uint32_t pm_io_base;
+} ICH9_LPCPmRegs;
+
+void ich9_pm_init(ICH9_LPCPmRegs *pm,
+                  qemu_irq sci_irq, qemu_irq cmos_s3_resume);
+void ich9_pm_iospace_update(ICH9_LPCPmRegs *pm, uint32_t pm_io_base);
+extern const VMStateDescription vmstate_ich9_pm;
+
+#endif /* HW_ACPI_ICH9_H */
diff --git a/hw/pc_q35.c b/hw/pc_q35.c
new file mode 100644
index 0000000..4f75d97
--- /dev/null
+++ b/hw/pc_q35.c
@@ -0,0 +1,378 @@
+/*
+ * QEMU PC System Emulator
+ *
+ * Copyright (c) 2003-2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+/*
+ *  Q35 chipset based pc system emulator
+ *
+ *  Copyright (c) 2009, 2010
+ *                     Isaku Yamahata <yamahata at valinux co jp>
+ *                     VA Linux Systems Japan K.K.
+ *
+ *  This is based on pc.c, but heavily modified.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+#include "hw.h"
+#include "arch_init.h"
+#include "pc.h"
+#include "fdc.h"
+#include "pci.h"
+#include "pci_bridge.h"
+#include "pci_p2pbr.h"
+#include "ioh3420.h"
+#include "xio3130_upstream.h"
+#include "xio3130_downstream.h"
+#include "block.h"
+#include "blockdev.h"
+#include "sysemu.h"
+#include "audio/audio.h"
+#include "net.h"
+#include "smbus.h"
+#include "boards.h"
+#include "monitor.h"
+#include "fw_cfg.h"
+#include "hpet_emul.h"
+#include "watchdog.h"
+#include "smbios.h"
+#include "ide.h"
+#include "usb-uhci.h"
+
+#include "q35.h"
+
+/* ICH9 AHCI has 6 ports */
+#define MAX_SATA_PORTS     6
+
+#define I21154_REV            0x05
+#define I21154_PI             0x00
+
+static PCIBridge *i21154_init(PCIBus *bus, int devfn, const char *bus_name,
+                              bool multifunction)
+{
+    const PCIP2PBridgeInit init = {
+        .bus = bus,
+        .devfn = devfn,
+        .multifunction = multifunction,
+
+        .bus_name = bus_name,
+        .map_irq = pci_swizzle_map_irq_fn,
+    };
+    const PCIP2PBridgeProp prop = {
+        .vendor_id = PCI_VENDOR_ID_DEC,
+        .device_id = PCI_DEVICE_ID_DEC_21154,
+        .revision_id = I21154_REV,
+        .prog_interface = I21154_PI,
+    };
+    return pci_p2pbr_create_simple(&init, &prop);
+}
+
+static void pc_q35_bridge_init(PCIBus *host_bus, PCIBus *pci_bus)
+{
+    uint8_t dev;
+    uint8_t sec_bus;
+    uint8_t port = 0;
+    uint8_t chassis = 0;
+    uint16_t slot = 0;
+    uint8_t upstream_port;
+    PCIESlot *s;
+    uint8_t fn;
+    PCIESlot *root_port;
+    PCIBus *root_port_bus;
+    char buf[16];
+
+    /* PCI to PCI bridge b6:d[29 - 31]:f0, 6:[1c - 1f].0 with subordinate bus
+       of 7 - 9 on b0:d30:f0, 0.1e.0 = bus */
+#define Q35_P2P_BRDIGE_DEV_BASE         28
+#define Q35_P2P_BRDIGE_DEV_MAX          32
+#define Q35_P2P_BRDIGE_SUBBUS_BASE      (ICH9_D2P_SECONDARY_DEFAULT + 1)
+    for (dev = Q35_P2P_BRDIGE_DEV_BASE; dev < Q35_P2P_BRDIGE_DEV_MAX; dev++) {
+        PCIBridge *br;
+        sec_bus = Q35_P2P_BRDIGE_SUBBUS_BASE + dev - Q35_P2P_BRDIGE_DEV_BASE;
+
+        snprintf(buf, sizeof(buf), "pci.%d", sec_bus);
+        br = i21154_init(pci_bus, PCI_DEVFN(dev, 0), buf, true);
+    }
+
+    /* PCIe root port b0:d1:f0 in GMCH.
+     * Actually it's vid/did = 0x8086:0x29c1, but we substitute ioh for it.
+     */
+    sec_bus = 32;
+    snprintf(buf, sizeof(buf), "pcie.%d", sec_bus);
+    s = ioh3420_init(host_bus, PCI_DEVFN(GMCH_PCIE_DEV, GMCH_PCIE_FUNC), true,
+                     buf, pci_swizzle_map_irq_fn, port, chassis, slot);
+
+
+    /* more slots. ICH9 doesn't have those, but many slots are wanted. */
+//#define Q35_MANY_SLOTS
+#undef Q35_MANY_SLOTS
+
+#ifdef Q35_MANY_SLOTS
+#define Q35_NR_ROOTPORT         6
+#define Q35_NR_UPSTREAM         8
+#define Q35_NR_DOWNSTREAM       16
+#else
+#define Q35_NR_ROOTPORT         1
+#define Q35_NR_UPSTREAM         1
+#define Q35_NR_DOWNSTREAM       1
+#endif
+
+    /* PCIe root port b0:d23:f[0-5], 0.17.[0-5] */
+    for (fn = 0; fn < Q35_NR_ROOTPORT; fn++) {
+        sec_bus++;
+        port++;
+        slot++;
+
+        snprintf(buf, sizeof(buf), "pcie.%d", sec_bus);
+        s = ioh3420_init(host_bus, PCI_DEVFN(23, fn), true,
+                         buf, pci_swizzle_map_irq_fn, port, chassis, slot);
+    }
+
+    /* PCIe root port b0:d24:f0 */
+    sec_bus++;
+    port++;
+    slot++;
+    snprintf(buf, sizeof(buf), "pcie.%d", sec_bus);
+    root_port = ioh3420_init(host_bus, PCI_DEVFN(24, 0), true,
+                             buf, pci_swizzle_map_irq_fn, port, chassis, slot);
+    root_port_bus = pci_bridge_get_sec_bus(&root_port->port.br);
+
+    /* 8 * 16 = 128 slots */
+    upstream_port = 0;
+    for (fn = 0; fn < Q35_NR_UPSTREAM; fn++) {
+        PCIEPort *upstream;
+        PCIBus *upstream_bus;
+        uint16_t downstream_port;
+
+        uint8_t ds_dev_max;
+        uint8_t ds_dev;
+        uint8_t ds_fn_max;
+        uint8_t ds_fn;
+
+        /* PCIe upstream port d0:f[0-7] */
+        sec_bus++;
+        snprintf(buf, sizeof(buf), "pcie.%d", sec_bus);
+        upstream = xio3130_upstream_init(root_port_bus, PCI_DEVFN(0, fn),
+                                         true, buf, pci_swizzle_map_irq_fn,
+                                         upstream_port);
+
+        upstream_bus = pci_bridge_get_sec_bus(&upstream->br);
+        upstream_port++;
+
+        /* PCIe downstream port */
+        downstream_port = 0;
+        ds_fn_max = MIN(Q35_NR_DOWNSTREAM / PCI_SLOT_MAX, PCI_FUNC_MAX);
+        ds_dev_max = MIN(Q35_NR_DOWNSTREAM / (ds_fn_max + 1), PCI_SLOT_MAX);
+
+        for (ds_dev = 0; ds_dev <= ds_dev_max &&
+                 downstream_port < Q35_NR_DOWNSTREAM; ds_dev++) {
+            for (ds_fn = 0; ds_fn <= ds_fn_max &&
+                     downstream_port < Q35_NR_DOWNSTREAM; ds_fn++) {
+                sec_bus++;
+                slot++;
+                snprintf(buf, sizeof(buf), "pcie.%d", sec_bus);
+
+                xio3130_downstream_init(upstream_bus, PCI_DEVFN(ds_dev, ds_fn),
+                                        true, buf, pci_swizzle_map_irq_fn,
+                                        downstream_port, chassis, slot);
+                downstream_port++;
+            }
+        }
+    }
+
+    /* PCIe root port b0:d28:f[0-6] in ICH9.
+     * Actually it's vid/did = 0x8086:0x294[02468A], but we substitute ioh
+     * for them.
+     */
+    for (fn = 0; fn < ICH9_PCIE_FUNC_MAX; fn++) {
+        sec_bus++;
+        port++;
+        slot++;
+
+        snprintf(buf, sizeof(buf), "pcie.%d", sec_bus);
+        s = ioh3420_init(host_bus, PCI_DEVFN(ICH9_PCIE_DEV, fn), true,
+                         buf, pci_swizzle_map_irq_fn,
+                         port, chassis, slot);
+    }
+}
+
+static void pc_q35_init_early(qemu_irq *isa_irq, IsaIrqState *isa_irq_state,
+                              DeviceState **gmch_host_p,
+                              PCIBus **host_bus_p, PCIBus **pci_bus_p,
+                              PCIDevice **lpc_p)
+{
+    DeviceState *gmch_host;
+    PCIBus *host_bus;
+    PCIBus *pci_bus;
+
+    PCIDevice *gmch_state;
+    PCIDevice *lpc;
+
+    /* create pci host bus */
+    host_bus = gmch_host_init(&gmch_host, isa_irq, isa_irq_state->ioapic);
+    gmch_state = gmch_init(gmch_host, host_bus);
+
+    /* create conventional pci bus: pcie2pci bridge */
+    pci_bus = ich9_d2pbr_init(host_bus, PCI_DEVFN(ICH9_D2P_BRIDGE_DEV,
+                                                  ICH9_D2P_BRIDGE_FUNC),
+                              ICH9_D2P_SECONDARY_DEFAULT);
+
+    /* create child pci/pcie buses */
+    pc_q35_bridge_init(host_bus, pci_bus);
+
+    /* create ISA bus */
+    lpc = gmch_lpc_init(gmch_host, host_bus);
+
+    *gmch_host_p = gmch_host;
+    *host_bus_p = host_bus;
+    *pci_bus_p = pci_bus;
+    *lpc_p = lpc;
+}
+
+static void pc_q35_init_late(BusState **idebus, ISADevice *rtc_state,
+                             DeviceState *gmch_host,
+                             PCIBus *host_bus, PCIBus *pci_bus,
+                             PCIDevice *lpc)
+{
+    qemu_irq *cmos_s3;
+    PCIDevice *ahci;
+    DriveInfo *hd[MAX_SATA_PORTS * MAX_IDE_DEVS];
+
+    /* connect pm stuff to lpc */
+    cmos_s3 = qemu_allocate_irqs(pc_cmos_set_s3_resume, rtc_state, 1);
+    ich9_lpc_pm_init(gmch_host, lpc, *cmos_s3);
+
+    /* ahci and SATA device */
+    ide_drive_get(hd, MAX_SATA_PORTS);
+    ahci = pci_create_simple_multifunction(host_bus,
+                                           PCI_DEVFN(ICH9_SATA1_DEV,
+                                                     ICH9_SATA1_FUNC),
+                                           true, "ich9-ahci");
+    pci_ahci_ide_create_devs(ahci, hd);
+    idebus[0] = qdev_get_child_bus(&ahci->qdev, "ide.0");
+    idebus[1] = qdev_get_child_bus(&ahci->qdev, "ide.1");
+
+    if (usb_enabled) {
+        /* Should we create 6 UHCI according to ich9 spec? */
+        pci_create_simple_multifunction(
+            host_bus, PCI_DEVFN(ICH9_USB_UHCI1_DEV, ICH9_USB_UHCI1_FUNC),
+            true, "ich9-usb-uhci1");
+        /* XXX: EHCI */
+    }
+
+    /* TODO: Populate SPD eeprom data.  */
+    smbus_eeprom_init(ich9_smb_init(host_bus,
+                                    PCI_DEVFN(ICH9_SMB_DEV, ICH9_SMB_FUNC),
+                                    0xb100),
+                      8, NULL, 0);
+}
+
+/* PC hardware initialisation */
+static void pc_q35_init(ram_addr_t ram_size,
+                        const char *boot_device,
+                        const char *kernel_filename,
+                        const char *kernel_cmdline,
+                        const char *initrd_filename,
+                        const char *cpu_model)
+{
+    ram_addr_t below_4g_mem_size, above_4g_mem_size;
+    DeviceState *gmch_host;
+    PCIBus *host_bus;
+    PCIBus *pci_bus;
+    PCIDevice *lpc;
+    qemu_irq *isa_irq;
+    IsaIrqState *isa_irq_state;
+    BusState *idebus[MAX_SATA_PORTS];
+    ISADevice *rtc_state;
+    MemoryRegion *pci_memory;
+    MemoryRegion *rom_memory;
+    MemoryRegion *ram_memory;
+
+    pc_cpus_init(cpu_model);
+
+    /* FIXME: add kvm clock ? */
+
+    if (ram_size >= 0xe0000000) {
+        above_4g_mem_size = ram_size - 0xe0000000;
+        below_4g_mem_size = 0xe0000000;
+    } else {
+        above_4g_mem_size = 0;
+        below_4g_mem_size = ram_size;
+    }
+
+    /* pci enabled */
+    pci_memory = g_new(MemoryRegion, 1);
+    memory_region_init(pci_memory, "pci", INT64_MAX);
+    rom_memory = pci_memory;
+
+    /* allocate ram and load rom/bios */
+    pc_memory_init(get_system_memory(), kernel_filename, kernel_cmdline,
+                   initrd_filename, below_4g_mem_size, above_4g_mem_size,
+                   rom_memory, &ram_memory);
+
+    /* irq lines */
+    isa_irq = pc_isa_irq(&isa_irq_state);
+    ioapic_init(isa_irq_state);
+
+    pc_q35_init_early(isa_irq, isa_irq_state,
+                      &gmch_host, &host_bus, &pci_bus, &lpc);
+    isa_bus_irqs(isa_irq);
+    pc_register_ferr_irq(isa_get_irq(13));
+
+    /* init basic PC hardware */
+    pc_basic_device_init(isa_irq, &rtc_state, false);
+
+    pc_q35_init_late(idebus, rtc_state, gmch_host, host_bus, pci_bus, lpc);
+
+    pc_cmos_init(below_4g_mem_size, above_4g_mem_size, boot_device,
+                 idebus[0], idebus[1], rtc_state);
+
+    /* the rest devices to which pci devfn is automatically assigned */
+    pc_vga_init(host_bus);
+    audio_init(isa_irq, pci_bus);
+    pc_nic_init(pci_bus);
+    pc_pci_device_init(pci_bus);
+}
+
+static QEMUMachine pc_q35_machine = {
+    .name = "pc_q35",
+    .desc = "Q35 chipset PC",
+    .init = pc_q35_init,
+    .max_cpus = 255,
+};
+
+static void pc_q35_machine_init(void)
+{
+    qemu_register_machine(&pc_q35_machine);
+}
+
+machine_init(pc_q35_machine_init);
diff --git a/hw/pci_ids.h b/hw/pci_ids.h
index 6deeac0..50744dd 100644
--- a/hw/pci_ids.h
+++ b/hw/pci_ids.h
@@ -36,6 +36,7 @@
 #define PCI_CLASS_BRIDGE_HOST            0x0600
 #define PCI_CLASS_BRIDGE_ISA             0x0601
 #define PCI_CLASS_BRIDGE_PCI             0x0604
+#define  PCI_CLASS_BRDIGE_PCI_INF_SUB    0x01
 #define PCI_CLASS_BRIDGE_OTHER           0x0680
 
 #define PCI_CLASS_COMMUNICATION_OTHER    0x0780
@@ -115,6 +116,17 @@
 #define PCI_DEVICE_ID_INTEL_82371AB      0x7111
 #define PCI_DEVICE_ID_INTEL_82371AB_2    0x7112
 #define PCI_DEVICE_ID_INTEL_82371AB_3    0x7113
+
+#define PCI_DEVICE_ID_INTEL_ICH9_0       0x2910
+#define PCI_DEVICE_ID_INTEL_ICH9_1       0x2917
+#define PCI_DEVICE_ID_INTEL_ICH9_2       0x2912
+#define PCI_DEVICE_ID_INTEL_ICH9_3       0x2913
+#define PCI_DEVICE_ID_INTEL_ICH9_4       0x2914
+#define PCI_DEVICE_ID_INTEL_ICH9_5       0x2919
+#define PCI_DEVICE_ID_INTEL_ICH9_6       0x2930
+#define PCI_DEVICE_ID_INTEL_ICH9_7       0x2916
+#define PCI_DEVICE_ID_INTEL_ICH9_8       0x2918
+
 #define PCI_DEVICE_ID_INTEL_82801I_UHCI1 0x2934
 #define PCI_DEVICE_ID_INTEL_82801I_UHCI2 0x2935
 #define PCI_DEVICE_ID_INTEL_82801I_UHCI3 0x2936
@@ -125,6 +137,8 @@
 #define PCI_DEVICE_ID_INTEL_82801I_EHCI2 0x293c
 #define PCI_DEVICE_ID_INTEL_82599_SFP_VF 0x10ed
 
+#define PCI_DEVICE_ID_INTEL_Q35_MCH      0x29c0
+
 #define PCI_VENDOR_ID_XEN               0x5853
 #define PCI_DEVICE_ID_XEN_PLATFORM      0x0001
 
diff --git a/hw/q35.c b/hw/q35.c
new file mode 100644
index 0000000..1776ac3
--- /dev/null
+++ b/hw/q35.c
@@ -0,0 +1,877 @@
+/*
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+/*
+ * QEMU GMCH/ICH9 PCI Bridge Emulation
+ *
+ *  Copyright (c) 2009, 2010, 2011
+ *                Isaku Yamahata <yamahata at valinux co jp>
+ *                VA Linux Systems Japan K.K.
+ *
+ *  This is based on piix_pci.c, but heavily modified.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+
+#include "hw.h"
+#include "range.h"
+#include "isa.h"
+#include "sysbus.h"
+#include "pc.h"
+#include "apm.h"
+#include "apic.h"
+#include "pci.h"
+#include "pcie_host.h"
+#include "pci_bridge.h"
+#include "pci_p2pbr.h"
+#include "q35.h"
+#include "acpi.h"
+#include "acpi_ich9.h"
+#include "pam.h"
+
+
+struct ICH9_LPCState;
+
+typedef struct ICH9_LPCIrqState {
+    struct ICH9_LPCState *lpc;
+    qemu_irq *pic;
+    qemu_irq *ioapic;
+} ICH9_LPCIrqState;
+
+typedef struct GMCH_PCIHost {
+    PCIExpressHost      host;
+
+    PCIDevice    *dev;
+    ICH9_LPCIrqState irq_state;
+} GMCH_PCIHost;
+
+typedef struct GMCH_PCIState {
+    PCIDevice   d;
+    /*
+     * GMCH_PCIHost   *gmch_host;
+     * In order to get GMCH_PCIHost
+     *  PCIDevice -> qdev -> parent_bus -> qdev -upcast-> GMCH_PCIHost
+     */
+
+    PAM pam;
+} GMCH_PCIState;
+
+typedef struct ICH9_LPCState {
+    /* ICH9 LPC PCI to ISA bridge */
+    PCIDevice d;
+
+    /* (pci device, intx) -> pirq
+     * In real chipset case, the unused slots are never used
+     * as ICH9 supports only D25-D32 irq routing.
+     * On the other hand in qemu case, any slot/function can be populated
+     * via command line option.
+     * So fallback interrupt routing for any devices in any slots is necessary.
+     */
+    uint8_t irr[PCI_SLOT_MAX][PCI_NUM_PINS];
+
+    APMState apm;
+    ICH9_LPCPmRegs pm;
+    uint32_t sci_level; /* track sci level */
+
+    /* 10.1 Chipset Configuration registers(Memory Space)
+       which is pointed by RCBA */
+    uint8_t chip_config[ICH9_CC_SIZE];
+    int rbca_index;
+} ICH9_LPCState;
+
+
+/****************************************************************************
+ * GMCH PCI host
+ */
+/* ich9 irq */
+static int ich9_lpc_map_irq(void *opaque, PCIDevice *pci_dev, int intx);
+static void ich9_lpc_set_irq(void *opaque, int irq_num, int level);
+static int ich9_lpc_sci_irq(ICH9_LPCState *lpc);
+
+static GMCH_PCIHost *gmch_pcihost_from_qdev(DeviceState *gmch_host_qdev)
+{
+    SysBusDevice *sysdev = sysbus_from_qdev(gmch_host_qdev);
+    PCIHostState *pci = FROM_SYSBUS(PCIHostState, sysdev);
+    PCIExpressHost *pcie = DO_UPCAST(PCIExpressHost, pci, pci);
+    return DO_UPCAST(GMCH_PCIHost, host, pcie);
+}
+
+static int gmch_pcihost_initfn(SysBusDevice *dev)
+{
+    GMCH_PCIHost *s = gmch_pcihost_from_qdev(&dev->qdev);
+
+    pci_host_conf_register_ioport(GMCH_HOST_BRIDGE_CONFIG_ADDR, &s->host.pci);
+    pci_host_data_register_ioport(GMCH_HOST_BRIDGE_CONFIG_DATA, &s->host.pci);
+
+    if (pcie_host_init(&s->host) < 0) {
+        abort();
+    }
+
+    return 0;
+}
+
+static SysBusDeviceInfo gmch_pcihost_info = {
+    .init         = gmch_pcihost_initfn,
+    .qdev.name    = "gmch-pcihost",
+    .qdev.size    = sizeof(GMCH_PCIHost),
+    .qdev.no_user = 1,
+    .qdev.props = (Property[]) {
+        {
+            .name = "MCFG",
+            .info = &qdev_prop_uint64,
+            .offset = offsetof(GMCH_PCIHost, host.base_addr),
+            .defval = (uint64_t[]){ GMCH_HOST_BRIDGE_PCIEXBAR_DEFAULT },
+        },
+        DEFINE_PROP_END_OF_LIST(),
+    },
+};
+
+/* host bridge */
+PCIBus *gmch_host_init(DeviceState **gmch_hostp,
+                       qemu_irq *pic, qemu_irq *ioapic)
+{
+    DeviceState *dev;
+    GMCH_PCIHost *s;
+    PCIBus *b;
+
+    dev = qdev_create(NULL, "gmch-pcihost");
+    s = gmch_pcihost_from_qdev(dev);
+    s->irq_state.pic = pic;
+    s->irq_state.ioapic = ioapic;
+
+    b = pci_bus_new(dev, "pcie.0", 0);
+    pci_bus_irqs(b, ich9_lpc_set_irq, ich9_lpc_map_irq, &s->irq_state,
+                 ICH9_LPC_NB_PIRQS);
+    s->host.pci.bus = b;
+    qdev_init_nofail(dev);
+
+    *gmch_hostp = dev;
+    return b;
+}
+
+
+/****************************************************************************
+ * GMCH
+ */
+static GMCH_PCIState *gmch_from_pci(PCIDevice *gmch_pci)
+{
+    return DO_UPCAST(GMCH_PCIState, d, gmch_pci);
+}
+
+/* PCIE MMCFG */
+static void gmch_update_pciexbar(GMCH_PCIState *gs)
+{
+    PCIDevice *pci_dev = &gs->d;
+    BusState *bus = qdev_get_parent_bus(&pci_dev->qdev);
+    DeviceState *qdev = bus->parent;
+    GMCH_PCIHost *s = gmch_pcihost_from_qdev(qdev);
+
+    uint64_t pciexbar;
+    int enable;
+    uint64_t addr;
+    uint64_t addr_mask;
+    uint32_t length;
+
+    pciexbar = pci_get_quad(pci_dev->config + GMCH_HOST_BRIDGE_PCIEXBAR);
+    enable = pciexbar & GMCH_HOST_BRIDGE_PCIEXBAREN;
+
+    addr_mask = GMCH_HOST_BRIDGE_PCIEXBAR_ADMSK;
+    switch (pciexbar & GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_MASK) {
+    case GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_256M:
+        length = 256 * 1024 * 1024;
+        break;
+    case GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_128M:
+        length = 128 * 1024 * 1024;
+        addr_mask |= GMCH_HOST_BRIDGE_PCIEXBAR_128ADMSK |
+            GMCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
+        break;
+    case GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_64M:
+        length = 64 * 1024 * 1024;
+        addr_mask |= GMCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
+        break;
+    case GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
+    default:
+        enable = 0;
+        length = 0;
+        abort();
+        break;
+    }
+    addr = pciexbar & addr_mask;
+
+    pcie_host_mmcfg_update(&s->host, enable, addr, length);
+}
+
+/* PAM */
+static void gmch_update_pam(GMCH_PCIState *gs)
+{
+    int i;
+    for (i = 0; i <= PAM_IDX_MAX; i++) {
+        pam_update(&gs->pam, i, gs->d.config[GMCH_HOST_BRIDGE_PAM0 + i]);
+    }
+}
+
+/* SMRAM */
+static void gmch_update_smram(GMCH_PCIState *gs)
+{
+    smram_update(&gs->pam, gs->d.config[GMCH_HOST_BRDIGE_SMRAM]);
+}
+
+static void gmch_set_smm(int smm, void *arg)
+{
+    GMCH_PCIState *gs = arg;
+    smram_set_smm(&gs->pam, smm, gs->d.config[GMCH_HOST_BRDIGE_SMRAM]);
+}
+
+static void gmch_write_config(PCIDevice *d,
+                              uint32_t address, uint32_t val, int len)
+{
+    GMCH_PCIState *gs = gmch_from_pci(d);
+
+    /* XXX: implement SMRAM.D_LOCK */
+    pci_default_write_config(d, address, val, len);
+
+    if (ranges_overlap(address, len, GMCH_HOST_BRIDGE_PAM0,
+                       GMCH_HOST_BRIDGE_PAM_SIZE)) {
+        gmch_update_pam(gs);
+    }
+
+    if (ranges_overlap(address, len, GMCH_HOST_BRIDGE_PCIEXBAR,
+                       GMCH_HOST_BRIDGE_PCIEXBAR_SIZE)) {
+        gmch_update_pciexbar(gs);
+    }
+
+    if (ranges_overlap(address, len, GMCH_HOST_BRDIGE_SMRAM,
+                       GMCH_HOST_BRDIGE_SMRAM_SIZE)) {
+        gmch_update_smram(gs);
+    }
+}
+
+static void gmch_update(GMCH_PCIState *gs)
+{
+    gmch_update_pciexbar(gs);
+    gmch_update_pam(gs);
+    gmch_update_smram(gs);
+}
+
+static int gmch_post_load(void *opaque, int version_id)
+{
+    GMCH_PCIState *gs = opaque;
+    gmch_update(gs);
+    return 0;
+}
+
+static const VMStateDescription vmstate_gmch = {
+    .name = "gmch",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = gmch_post_load,
+    .fields = (VMStateField []) {
+        VMSTATE_PCI_DEVICE(d, GMCH_PCIState),
+        VMSTATE_UINT8(pam.smm_enabled, GMCH_PCIState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void gmch_reset(DeviceState *qdev)
+{
+    PCIDevice *d = DO_UPCAST(PCIDevice, qdev, qdev);
+    GMCH_PCIState *gs = gmch_from_pci(d);
+
+    pci_set_quad(d->config + GMCH_HOST_BRIDGE_PCIEXBAR,
+                 GMCH_HOST_BRIDGE_PCIEXBAR_DEFAULT);
+
+    d->config[GMCH_HOST_BRDIGE_SMRAM] = GMCH_HOST_BRIDGE_SMRAM_DEFAULT;
+
+    gmch_update(gs);
+}
+
+static int gmch_initfn(PCIDevice *d)
+{
+    GMCH_PCIState *gs = gmch_from_pci(d);
+
+    pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_INTEL);
+    pci_config_set_device_id(d->config, PCI_DEVICE_ID_INTEL_Q35_MCH);
+    pci_config_set_revision(d->config, GMCH_HOST_BRIDGE_REVISION_DEFUALT);
+    pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST);
+
+    cpu_smm_register(&gmch_set_smm, gs);
+    pam_init_memory_mappings(&gs->pam);
+
+    return 0;
+}
+
+static PCIDeviceInfo gmch_info = {
+    .qdev.name    = "gmch",
+    .qdev.desc    = "Host bridge",
+    .qdev.size    = sizeof(GMCH_PCIState),
+    .qdev.vmsd    = &vmstate_gmch,
+    .qdev.no_user = 1,
+    .init         = gmch_initfn,
+    .config_write = gmch_write_config,
+    .qdev.reset   = gmch_reset,
+};
+
+/* host bridge */
+PCIDevice *gmch_init(DeviceState *gmch_host, PCIBus *b)
+{
+    GMCH_PCIHost *s = gmch_pcihost_from_qdev(gmch_host);
+    PCIDevice *d;
+
+    d = pci_create_simple_multifunction(b, 0, false, "gmch");
+    s->dev = d;
+
+    return d;
+}
+
+/*****************************************************************************/
+/* ICH9 DMI-to-PCI bridge */
+#define I82801ba_SSVID_OFFSET   0x50
+#define I82801ba_SSVID_SVID     0
+#define I82801ba_SSVID_SSID     0
+
+static PCIBridge *i82801ba11_init(PCIBus *bus, int devfn, const char *bus_name,
+                                  bool multifunction)
+{
+    const PCIP2PBridgeInit init = {
+        .bus = bus,
+        .devfn = devfn,
+        .multifunction = multifunction,
+
+        .bus_name = bus_name,
+        .map_irq = pci_swizzle_map_irq_fn,
+    };
+    const PCIP2PBridgeProp prop = {
+        .vendor_id = PCI_VENDOR_ID_INTEL,
+        .device_id = PCI_DEVICE_ID_INTEL_82801BA_11,
+        .revision_id = ICH9_D2P_A2_REVISION,
+        .prog_interface = PCI_CLASS_BRDIGE_PCI_INF_SUB,
+
+        .ssvid_cap = I82801ba_SSVID_OFFSET,
+        .svid = I82801ba_SSVID_SVID,
+        .ssid = I82801ba_SSVID_SSID,
+    };
+    return pci_p2pbr_create_simple(&init, &prop);
+}
+
+PCIBus *ich9_d2pbr_init(PCIBus *bus, int devfn, int sec_bus)
+{
+    PCIBridge *br;
+    char buf[16];
+
+    snprintf(buf, sizeof(buf), "pci.%d", sec_bus);
+    br = i82801ba11_init(bus, devfn, buf, true);
+    if (br == NULL) {
+        return NULL;
+    }
+    return pci_bridge_get_sec_bus(br);
+}
+
+
+/*****************************************************************************/
+/* ICH9 LPC PCI to ISA bridge */
+
+static void ich9_lpc_reset(DeviceState *qdev);
+
+static ICH9_LPCState *ich9_lpc_from_pci(PCIDevice *lpc_pci)
+{
+    return DO_UPCAST(ICH9_LPCState, d, lpc_pci);
+}
+
+/* chipset configuration register
+ * to access chipset configuration registers, pci_[sg]et_{byte, word, long}
+ * are used.
+ * Although it's not pci configuration space, it's little endian as Intel.
+ */
+
+static void ich9_cc_update_ir(uint8_t irr[PCI_NUM_PINS], uint32_t ir)
+{
+    int intx;
+    for (intx = 0; intx < PCI_NUM_PINS; intx++) {
+        irr[intx] = (ir >> (intx * ICH9_CC_DIR_SHIFT)) & ICH9_CC_DIR_MASK;
+    }
+}
+
+static void ich9_cc_update(ICH9_LPCState *lpc)
+{
+    int slot;
+    int reg_offset;
+    int intx;
+
+    /* D{25 - 31}IR, but D30IR is read only to 0. */
+    for (slot = 25, reg_offset = 0; slot < 32; slot++, reg_offset++) {
+        if (slot != 30) {
+            ich9_cc_update_ir(lpc->irr[slot],
+                              lpc->chip_config[ICH9_CC_D31IR + reg_offset]);
+        }
+    }
+
+    /*
+     * D30: DMI2PCI bridge
+     * It is arbitrarily decided how INTx lines of PCI devicesbehind the bridge
+     * are connected to pirq lines. Our choice is PIRQ[E-H].
+     * INT[A-D] are connected to PIRQ[E-H]
+     */
+    for (intx = 0; intx < PCI_NUM_PINS; intx++) {
+        lpc->irr[30][intx] = intx + 4;
+    }
+}
+
+static void ich9_cc_init(ICH9_LPCState *lpc)
+{
+    int slot;
+    int intx;
+
+    /* the default irq routing is arbitrary as long as it matches with
+     * acpi irq routing table.
+     * The one that is incompatible with piix_pci(= bochs) one is
+     * intentionally chosen to let the users know that the different
+     * board is used.
+     *
+     * int[A-D] -> pirq[E-F]
+     * avoid pirq A-D because they are used for pci express port
+     */
+    for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
+        for (intx = 0; intx < PCI_NUM_PINS; intx++) {
+            lpc->irr[slot][intx] = (slot + intx) % 4 + 4;
+        }
+    }
+    ich9_cc_update(lpc);
+}
+
+static void ich9_cc_reset(ICH9_LPCState *lpc)
+{
+    uint8_t *c = lpc->chip_config;
+
+    memset(lpc->chip_config, 0, sizeof(lpc->chip_config));
+
+    pci_set_long(c + ICH9_CC_D31IR, ICH9_CC_DIR_DEFAULT);
+    pci_set_long(c + ICH9_CC_D30IR, ICH9_CC_D30IR_DEFAULT);
+    pci_set_long(c + ICH9_CC_D29IR, ICH9_CC_DIR_DEFAULT);
+    pci_set_long(c + ICH9_CC_D28IR, ICH9_CC_DIR_DEFAULT);
+    pci_set_long(c + ICH9_CC_D27IR, ICH9_CC_DIR_DEFAULT);
+    pci_set_long(c + ICH9_CC_D26IR, ICH9_CC_DIR_DEFAULT);
+    pci_set_long(c + ICH9_CC_D25IR, ICH9_CC_DIR_DEFAULT);
+
+    ich9_cc_update(lpc);
+}
+
+static void ich9_cc_addr_len(uint32_t *addr, int *len)
+{
+    *addr &= ICH9_CC_ADDR_MASK;
+    if (*addr + *len >= ICH9_CC_SIZE) {
+        *len = ICH9_CC_SIZE - *addr;
+    }
+}
+
+/* val: little endian */
+static void ich9_cc_write(ICH9_LPCState *lpc, uint32_t addr,
+                          uint32_t val, int len)
+{
+    ich9_cc_addr_len(&addr, &len);
+    memcpy(lpc->chip_config + addr, &val, len);
+}
+
+/* return value: little endian */
+static uint32_t ich9_cc_read(ICH9_LPCState *lpc, uint32_t addr, int len)
+{
+    uint32_t val = 0;
+    ich9_cc_addr_len(&addr, &len);
+    memcpy(&val, lpc->chip_config + addr, len);
+    return val;
+}
+
+#define ICH9_CC_MMIO_WRITE(type, len)                           \
+    static void ich9_cc_mmio_write ## type                      \
+    (void *opaque, target_phys_addr_t addr, uint32_t val)       \
+    {                                                           \
+        ich9_cc_write(opaque, addr, val, len);                  \
+    }
+
+#define ICH9_CC_MMIO_READ(type, len)            \
+    static uint32_t ich9_cc_mmio_read ## type   \
+    (void *opaque, target_phys_addr_t addr)     \
+    {                                           \
+        return ich9_cc_read(opaque, addr, len); \
+    }
+
+ICH9_CC_MMIO_WRITE(b, 1)
+ICH9_CC_MMIO_WRITE(w, 2)
+ICH9_CC_MMIO_WRITE(l, 4)
+
+ICH9_CC_MMIO_READ(b, 1)
+ICH9_CC_MMIO_READ(w, 2)
+ICH9_CC_MMIO_READ(l, 4)
+
+static CPUWriteMemoryFunc * const ich9_cc_mmio_write[] = {
+    ich9_cc_mmio_writeb,
+    ich9_cc_mmio_writew,
+    ich9_cc_mmio_writel,
+};
+
+static CPUReadMemoryFunc * const ich9_cc_mmio_read[] = {
+    ich9_cc_mmio_readb,
+    ich9_cc_mmio_readw,
+    ich9_cc_mmio_readl,
+};
+
+/* IRQ routing */
+/* */
+static void ich9_lpc_rout(uint8_t pirq_rout, int *pic_irq, int *pic_dis)
+{
+    *pic_irq = pirq_rout & ICH9_LPC_PIRQ_ROUT_MASK;
+    *pic_dis = pirq_rout & ICH9_LPC_PIRQ_ROUT_IRQEN;
+}
+
+static void ich9_lpc_pic_irq(ICH9_LPCState *lpc, int irq_num,
+                             int *pic_irq, int *pic_dis)
+{
+    switch (irq_num) {
+    case 0 ... 3: /* A-D */
+        ich9_lpc_rout(lpc->d.config[ICH9_LPC_PIRQA_ROUT + irq_num],
+                      pic_irq, pic_dis);
+        return;
+    case 4 ... 7: /* E-H */
+        ich9_lpc_rout(lpc->d.config[ICH9_LPC_PIRQE_ROUT + (irq_num - 4)],
+                      pic_irq, pic_dis);
+        return;
+    default:
+        break;
+    }
+    abort();
+}
+
+/* pic_irq: i8254 irq 0-15 */
+static void ich9_lpc_update_pic(ICH9_LPCIrqState *irq_state, int pic_irq)
+{
+    GMCH_PCIHost *s = container_of(irq_state, GMCH_PCIHost, irq_state);
+    ICH9_LPCState *lpc = irq_state->lpc;
+    int i, pic_level;
+
+    /* The pic level is the logical OR of all the PCI irqs mapped to it */
+    pic_level = 0;
+    for (i = 0; i < ICH9_LPC_NB_PIRQS; i++) {
+        int tmp_irq;
+        int tmp_dis;
+        ich9_lpc_pic_irq(lpc, i, &tmp_irq, &tmp_dis);
+        if (!tmp_dis && pic_irq == tmp_irq) {
+            pic_level |= pci_bus_get_irq_level(s->host.pci.bus, i);
+        }
+    }
+    if (pic_irq == ich9_lpc_sci_irq(lpc)) {
+        pic_level |= lpc->sci_level;
+    }
+
+    qemu_set_irq(irq_state->pic[pic_irq], pic_level);
+}
+
+/* pirq: pirq[A-H] 0-7*/
+static void ich9_lpc_update_by_pirq(ICH9_LPCIrqState *irq_state, int pirq)
+{
+    ICH9_LPCState *lpc = irq_state->lpc;
+    int pic_irq;
+    int pic_dis;
+
+    ich9_lpc_pic_irq(lpc, pirq, &pic_irq, &pic_dis);
+    assert(pic_irq < ICH9_LPC_PIC_NUM_PINS);
+    if (pic_dis) {
+        return;
+    }
+
+    ich9_lpc_update_pic(irq_state, pic_irq);
+}
+
+/* APIC mode: GSIx: PIRQ[A-H] -> GSI 16, ... no pirq shares same APIC pins. */
+static int ich9_pirq_to_gsi(int pirq)
+{
+    return pirq + ICH9_LPC_PIC_NUM_PINS;
+}
+
+static int ich9_gsi_to_pirq(int gsi)
+{
+    return gsi - ICH9_LPC_PIC_NUM_PINS;
+}
+
+static void ich9_lpc_update_apic(ICH9_LPCIrqState *irq_state, int gsi)
+{
+    GMCH_PCIHost *s = container_of(irq_state, GMCH_PCIHost, irq_state);
+    ICH9_LPCState *lpc = irq_state->lpc;
+    int level;
+
+    level = pci_bus_get_irq_level(s->host.pci.bus, ich9_gsi_to_pirq(gsi));
+    if (gsi == ich9_lpc_sci_irq(lpc)) {
+        level |= lpc->sci_level;
+    }
+
+    qemu_set_irq(irq_state->ioapic[gsi], level);
+}
+
+/* return the pirq number (PIRQ[A-H]:0-7) corresponding to
+   a given device irq pin. */
+static int ich9_lpc_map_irq(void *opaque, PCIDevice *pci_dev, int intx)
+{
+    ICH9_LPCIrqState *irq_state = opaque;
+    return irq_state->lpc->irr[PCI_SLOT(pci_dev->devfn)][intx];
+}
+
+static void ich9_lpc_set_irq(void *opaque, int pirq, int level)
+{
+    ICH9_LPCIrqState *irq_state = opaque;
+
+    assert(0 <= pirq);
+    assert(pirq < ICH9_LPC_NB_PIRQS);
+
+    ich9_lpc_update_apic(irq_state, ich9_pirq_to_gsi(pirq));
+    ich9_lpc_update_by_pirq(irq_state, pirq);
+}
+
+static int ich9_lpc_sci_irq(ICH9_LPCState *lpc)
+{
+    switch (lpc->d.config[ICH9_LPC_ACPI_CTRL] &
+            ICH9_LPC_ACPI_CTRL_SCI_IRQ_SEL_MASK) {
+    case ICH9_LPC_ACPI_CTRL_9:
+        return 9;
+    case ICH9_LPC_ACPI_CTRL_10:
+        return 10;
+    case ICH9_LPC_ACPI_CTRL_11:
+        return 11;
+    case ICH9_LPC_ACPI_CTRL_20:
+        return 20;
+    case ICH9_LPC_ACPI_CTRL_21:
+        return 21;
+    default:
+        /* reserved */
+        break;
+    }
+    return -1;
+}
+
+static void ich9_set_sci(void *opaque, int irq_num, int level)
+{
+    ICH9_LPCIrqState *irq_state = opaque;
+    ICH9_LPCState *lpc = irq_state->lpc;
+    int irq;
+
+    assert(irq_num == 0);
+    level = !!level;
+    if (level == lpc->sci_level) {
+        return;
+    }
+    lpc->sci_level = level;
+
+    irq = ich9_lpc_sci_irq(lpc);
+    if (irq < 0) {
+        return;
+    }
+
+    ich9_lpc_update_apic(irq_state, irq);
+    if (irq < ICH9_LPC_PIC_NUM_PINS) {
+        ich9_lpc_update_pic(irq_state, irq);
+    }
+}
+
+void ich9_lpc_pm_init(DeviceState *gmch_host, PCIDevice *lpc_pci,
+                      qemu_irq cmos_s3)
+{
+    GMCH_PCIHost *s = gmch_pcihost_from_qdev(gmch_host);
+    ICH9_LPCState *lpc = ich9_lpc_from_pci(lpc_pci);
+    qemu_irq *sci_irq;
+
+    sci_irq = qemu_allocate_irqs(ich9_set_sci, &s->irq_state, 1);
+    ich9_pm_init(&lpc->pm, sci_irq[0], cmos_s3);
+
+    ich9_lpc_reset(&lpc->d.qdev);
+}
+
+/* APM */
+static void ich9_apm_ctrl_changed(uint32_t val, void *arg)
+{
+    ICH9_LPCState *lpc = arg;
+
+    /* ACPI specs 3.0, 4.7.2.5 */
+    acpi_pm1_cnt_update(&lpc->pm.pm1_cnt,
+                        val == ICH9_APM_ACPI_ENABLE,
+                        val == ICH9_APM_ACPI_DISABLE);
+
+    /* SMI_EN = PMBASE + 30. SMI control and enable register */
+    if (lpc->pm.smi_en & ICH9_PMIO_SMI_EN_APMC_EN) {
+        cpu_interrupt(first_cpu, CPU_INTERRUPT_SMI);
+    }
+}
+
+/* config:PMBASE */
+static void
+ich9_lpc_pmbase_update(ICH9_LPCState *lpc)
+{
+    uint32_t pm_io_base = pci_get_long(lpc->d.config + ICH9_LPC_PMBASE);
+    pm_io_base &= ICH9_LPC_PMBASE_BASE_ADDRESS_MASK;
+
+    ich9_pm_iospace_update(&lpc->pm, pm_io_base);
+}
+
+/* config:RBCA */
+static void ich9_lpc_rcba_update(ICH9_LPCState *lpc, uint32_t rbca_old)
+{
+    uint32_t rbca = pci_get_long(lpc->d.config + ICH9_LPC_RCBA);
+
+    if (rbca_old & ICH9_LPC_RCBA_EN) {
+        cpu_register_physical_memory(rbca_old & ICH9_LPC_RCBA_BA_MASK,
+                                     ICH9_CC_SIZE, IO_MEM_UNASSIGNED);
+    }
+    if (rbca & ICH9_LPC_RCBA_EN) {
+        cpu_register_physical_memory(rbca & ICH9_LPC_RCBA_BA_MASK,
+                                     ICH9_CC_SIZE, lpc->rbca_index);
+    }
+}
+
+static int ich9_lpc_post_load(void *opaque, int version_id)
+{
+    ICH9_LPCState *lpc = opaque;
+
+    ich9_lpc_pmbase_update(lpc);
+    ich9_lpc_rcba_update(lpc, 0 /* disabled ICH9_LPC_RBCA_EN */);
+    return 0;
+}
+
+static void ich9_lpc_config_write(PCIDevice *d,
+                                  uint32_t addr, uint32_t val, int len)
+{
+    ICH9_LPCState *lpc = ich9_lpc_from_pci(d);
+    uint32_t rbca_old = pci_get_long(d->config + ICH9_LPC_RCBA);
+
+    pci_default_write_config(d, addr, val, len);
+    if (ranges_overlap(addr, len, ICH9_LPC_PMBASE, 4)) {
+        ich9_lpc_pmbase_update(lpc);
+    }
+    if (ranges_overlap(addr, len, ICH9_LPC_RCBA, 4)) {
+        ich9_lpc_rcba_update(lpc, rbca_old);
+    }
+}
+
+static void ich9_lpc_reset(DeviceState *qdev)
+{
+    PCIDevice *d = DO_UPCAST(PCIDevice, qdev, qdev);
+    ICH9_LPCState *lpc = ich9_lpc_from_pci(d);
+    uint32_t rbca_old = pci_get_long(d->config + ICH9_LPC_RCBA);
+    int i;
+
+    for (i = 0; i < 4; i++) {
+        pci_set_byte(d->config + ICH9_LPC_PIRQA_ROUT + i,
+                     ICH9_LPC_PIRQ_ROUT_DEFAULT);
+    }
+    for (i = 0; i < 4; i++) {
+        pci_set_byte(d->config + ICH9_LPC_PIRQE_ROUT + i,
+                     ICH9_LPC_PIRQ_ROUT_DEFAULT);
+    }
+    pci_set_byte(d->config + ICH9_LPC_ACPI_CTRL, ICH9_LPC_ACPI_CTRL_DEFAULT);
+
+    pci_set_long(d->config + ICH9_LPC_PMBASE, ICH9_LPC_PMBASE_DEFAULT);
+    pci_set_long(d->config + ICH9_LPC_RCBA, ICH9_LPC_RCBA_DEFAULT);
+
+    ich9_cc_reset(lpc);
+
+    ich9_lpc_pmbase_update(lpc);
+    ich9_lpc_rcba_update(lpc, rbca_old);
+
+    lpc->sci_level = 0;
+}
+
+static int ich9_lpc_initfn(PCIDevice *d)
+{
+    ICH9_LPCState *lpc = ich9_lpc_from_pci(d);
+
+    isa_bus_new(&d->qdev);
+    pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_INTEL);
+    pci_config_set_device_id(d->config, PCI_DEVICE_ID_INTEL_ICH9_8); /* ICH9 LPC */
+    pci_config_set_revision(d->config, ICH9_A2_LPC_REVISION);
+    pci_config_set_class(d->config, PCI_CLASS_BRIDGE_ISA);
+
+    pci_set_long(d->wmask + ICH9_LPC_PMBASE,
+                 ICH9_LPC_PMBASE_BASE_ADDRESS_MASK);
+
+    lpc->rbca_index = cpu_register_io_memory(ich9_cc_mmio_read,
+                                             ich9_cc_mmio_write,
+                                             lpc, DEVICE_LITTLE_ENDIAN);
+
+    ich9_cc_init(lpc);
+    apm_init(&lpc->apm, ich9_apm_ctrl_changed, lpc);
+    return 0;
+}
+
+static const VMStateDescription vmstate_ich9_lpc = {
+    .name = "ICH9LPC",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = ich9_lpc_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(d, ICH9_LPCState),
+        VMSTATE_STRUCT(apm, ICH9_LPCState, 0, vmstate_apm, APMState),
+        VMSTATE_STRUCT(pm, ICH9_LPCState, 0, vmstate_ich9_pm, ICH9_LPCPmRegs),
+        VMSTATE_UINT8_ARRAY(chip_config, ICH9_LPCState, ICH9_CC_SIZE),
+        VMSTATE_UINT32(sci_level, ICH9_LPCState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+PCIDevice *gmch_lpc_init(DeviceState *gmch_host, PCIBus *bus)
+{
+    GMCH_PCIHost *s = gmch_pcihost_from_qdev(gmch_host);
+    PCIDevice *d;
+    ICH9_LPCState *lpc;
+
+    d = pci_create_simple_multifunction(bus, PCI_DEVFN(ICH9_LPC_DEV,
+                                                       ICH9_LPC_FUNC),
+                                        true, "ICH9 LPC");
+    lpc = ich9_lpc_from_pci(d);
+    s->irq_state.lpc = lpc;
+    return &lpc->d;
+}
+
+static PCIDeviceInfo ich9_lpc_info = {
+    .qdev.name    = "ICH9 LPC",
+    .qdev.desc    = "ICH9 LPC bridge",
+    .qdev.size    = sizeof(ICH9_LPCState),
+    .qdev.vmsd    = &vmstate_ich9_lpc,
+    .qdev.no_user = 1,
+    .init         = ich9_lpc_initfn,
+    .config_write = ich9_lpc_config_write,
+    .qdev.reset   = ich9_lpc_reset,
+};
+
+static void q35_register(void)
+{
+    sysbus_register_withprop(&gmch_pcihost_info);
+    pci_qdev_register(&gmch_info);
+    pci_qdev_register(&ich9_lpc_info);
+}
+device_init(q35_register);
diff --git a/hw/q35.h b/hw/q35.h
new file mode 100644
index 0000000..be2e96b
--- /dev/null
+++ b/hw/q35.h
@@ -0,0 +1,272 @@
+/*
+ * q35.h
+ *
+ * Copyright (c) 2009 Isaku Yamahata <yamahata at valinux co jp>
+ *                    VA Linux Systems Japan K.K.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+
+#ifndef HW_Q35_H
+#define HW_Q35_H
+
+#include "sysbus.h"
+#include "acpi_ich9.h"
+
+PCIBus *gmch_host_init(DeviceState **gmch_hostp,
+                       qemu_irq *pic, qemu_irq *ioapic);
+
+PCIDevice *gmch_init(DeviceState *gmch_host, PCIBus *b);
+PCIBus *ich9_d2pbr_init(PCIBus *bus, int devfn, int sec_bus);
+PCIDevice *gmch_lpc_init(DeviceState *gmch_host, PCIBus *bus);
+void ich9_lpc_pm_init(DeviceState *gmch_host, PCIDevice *pci_lpc,
+                      qemu_irq cmos_s3);
+
+i2c_bus *ich9_smb_init(PCIBus *bus, int devfn, uint32_t smb_io_base);
+
+#define Q35_MASK(bit, ms_bit, ls_bit) \
+((uint##bit##_t)(((1ULL << ((ms_bit) + 1)) - 1) & ~((1ULL << ls_bit) - 1)))
+
+/*
+ * gmch part
+ */
+
+/* PCI configuration */
+#define GMCH_HOST_BRIDGE                        "GMCH"
+
+#define GMCH_HOST_BRIDGE_CONFIG_ADDR            0xcf8
+#define GMCH_HOST_BRIDGE_CONFIG_DATA            0xcfc
+
+/* D0:F0 configuration space */
+#define  GMCH_HOST_BRIDGE_REVISION_DEFUALT      0x0
+
+#define GMCH_HOST_BRIDGE_PCIEXBAR               0x60    /* 64bit register */
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_SIZE         8       /* 64bit register */
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_DEFAULT      0xe0000000
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_ADMSK        Q35_MASK(64, 35, 25) /* bit 35:28 */
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_128ADMSK     ((uint64_t)(1 << 26))
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_64ADMSK      ((uint64_t)(1 << 25))
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_MASK  ((uint64_t)(0x3 << 1))
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_256M  ((uint64_t)(0x0 << 1))
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_128M  ((uint64_t)(0x1 << 1))
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_64M   ((uint64_t)(0x2 << 1))
+#define  GMCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD   ((uint64_t)(0x3 << 1))
+#define  GMCH_HOST_BRIDGE_PCIEXBAREN            ((uint64_t)1)
+
+#define GMCH_HOST_BRIDGE_PAM_NB                 7
+#define GMCH_HOST_BRIDGE_PAM_SIZE               7
+#define GMCH_HOST_BRIDGE_PAM0                   0x90
+#define  GMCH_HOST_BRIDGE_PAM_BIOS_AREA         0xf0000
+#define  GMCH_HOST_BRIDGE_PAM_AREA_SIZE         0x10000 /* 16KB */
+#define GMCH_HOST_BRIDGE_PAM1                   0x91
+#define  GMCH_HOST_BRIDGE_PAM_EXPAN_AREA        0xc0000
+#define  GMCH_HOST_BRIDGE_PAM_EXPAN_SIZE        0x04000
+#define GMCH_HOST_BRIDGE_PAM2                   0x92
+#define GMCH_HOST_BRIDGE_PAM3                   0x93
+#define GMCH_HOST_BRIDGE_PAM4                   0x94
+#define  GMCH_HOST_BRIDGE_PAM_EXBIOS_AREA       0xe0000
+#define  GMCH_HOST_BRIDGE_PAM_EXBIOS_SIZE       0x04000
+#define GMCH_HOST_BRIDGE_PAM5                   0x95
+#define GMCH_HOST_BRIDGE_PAM6                   0x96
+#define  GMCH_HOST_BRIDGE_PAM_WE_HI             ((uint8_t)(0x2 << 4))
+#define  GMCH_HOST_BRIDGE_PAM_RE_HI             ((uint8_t)(0x1 << 4))
+#define  GMCH_HOST_BRIDGE_PAM_HI_MASK           ((uint8_t)(0x3 << 4))
+#define  GMCH_HOST_BRIDGE_PAM_WE_LO             ((uint8_t)0x2)
+#define  GMCH_HOST_BRIDGE_PAM_RE_LO             ((uint8_t)0x1)
+#define  GMCH_HOST_BRIDGE_PAM_LO_MASK           ((uint8_t)0x3)
+#define  GMCH_HOST_BRIDGE_PAM_WE                ((uint8_t)0x2)
+#define  GMCH_HOST_BRIDGE_PAM_RE                ((uint8_t)0x1)
+#define  GMCH_HOST_BRIDGE_PAM_MASK              ((uint8_t)0x3)
+
+#define GMCH_HOST_BRDIGE_SMRAM                  0x9d
+#define GMCH_HOST_BRDIGE_SMRAM_SIZE             1
+#define  GMCH_HOST_BRIDGE_SMRAM_DEFAULT         ((uint8_t)0x2)
+#define  GMCH_HOST_BRIDGE_SMRAM_D_OPEN          ((uint8_t)(1 << 6))
+#define  GMCH_HOST_BRIDGE_SMRAM_D_CLS           ((uint8_t)(1 << 5))
+#define  GMCH_HOST_BRIDGE_SMRAM_D_LCK           ((uint8_t)(1 << 4))
+#define  GMCH_HOST_BRIDGE_SMRAM_G_SMRAME        ((uint8_t)(1 << 3))
+#define  GMCH_HOST_BRIDGE_SMRAM_C_BASE_SEG_MASK ((uint8_t)0x7)
+#define  GMCH_HOST_BRIDGE_SMRAM_C_BASE_SEG      ((uint8_t)0x2)  /* hardwired to b010 */
+#define   GMCH_HOST_BRIDGE_SMRAM_C_BASE         0xa0000
+#define   GMCH_HOST_BRIDGE_SMRAM_C_END          0xc0000
+#define   GMCH_HOST_BRIDGE_SMRAM_C_SIZE         0x20000
+#define GMCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
+
+#define GMCH_HOST_BRIDGE_ESMRAMC                0x9e
+#define  GMCH_HOST_BRDIGE_ESMRAMC_H_SMRAME      ((uint8_t)(1 << 6))
+#define  GMCH_HOST_BRDIGE_ESMRAMC_E_SMERR       ((uint8_t)(1 << 5))
+#define  GMCH_HOST_BRDIGE_ESMRAMC_SM_CACHE      ((uint8_t)(1 << 4))
+#define  GMCH_HOST_BRDIGE_ESMRAMC_SM_L1         ((uint8_t)(1 << 3))
+#define  GMCH_HOST_BRDIGE_ESMRAMC_SM_L2         ((uint8_t)(1 << 2))
+#define  GMCH_HOST_BRDIGE_ESMRAMC_TSEG_SZ_MASK  ((uint8_t)(0x3 << 1))
+#define   GMCH_HOST_BRDIGE_ESMRAMC_TSEG_SZ_1MB  ((uint8_t)(0x0 << 1))
+#define   GMCH_HOST_BRDIGE_ESMRAMC_TSEG_SZ_2MB  ((uint8_t)(0x1 << 1))
+#define   GMCH_HOST_BRDIGE_ESMRAMC_TSEG_SZ_8MB  ((uint8_t)(0x2 << 1))
+#define  GMCH_HOST_BRDIGE_ESMRAMC_T_EN          ((uint8_t)1)
+
+/* D1:F0 PCIE* port*/
+#define GMCH_PCIE_DEV                           1
+#define GMCH_PCIE_FUNC                          0
+
+/*
+ * ich9 part
+ */
+
+/* ICH9: Chipset Configuration Registers */
+#define ICH9_CC_SIZE                            (16 * 1024)     /* 16KB */
+#define ICH9_CC_ADDR_MASK                       (ICH9_CC_SIZE - 1)
+
+#define ICH9_CC
+#define ICH9_CC_D28IP                           0x310C
+#define  ICH9_CC_D28IP_SHIFT                    4
+#define  ICH9_CC_D28IP_MASK                     0xf
+#define  ICH9_CC_D28IP_DEFAULT                  0x00214321
+#define ICH9_CC_D31IR                           0x3140
+#define ICH9_CC_D30IR                           0x3142
+#define ICH9_CC_D29IR                           0x3144
+#define ICH9_CC_D28IR                           0x3146
+#define ICH9_CC_D27IR                           0x3148
+#define ICH9_CC_D26IR                           0x314C
+#define ICH9_CC_D25IR                           0x3150
+#define  ICH9_CC_DIR_DEFAULT                    0x3210
+#define  ICH9_CC_D30IR_DEFAULT                  0x0
+#define  ICH9_CC_DIR_SHIFT                      4
+#define  ICH9_CC_DIR_MASK                       0x7
+#define ICH9_CC_OIC                             0x31FF
+#define  ICH9_CC_OIC_AEN                        0x1
+
+/* D28:F[0-5] */
+#define ICH9_PCIE_DEV                           28
+#define ICH9_PCIE_FUNC_MAX                      6
+
+
+/* D29:F0 USB UHCI Controller #1 */
+#define ICH9_USB_UHCI1_DEV                      29
+#define ICH9_USB_UHCI1_FUNC                     0
+
+/* D30:F0 DMI-to-PCI brdige */
+#define ICH9_D2P_BRIDGE                         "ICH9 D2P BRIDGE"
+#define ICH9_D2P_BRIDGE_SAVEVM_VERSION          0
+
+#define ICH9_D2P_BRIDGE_DEV                     30
+#define ICH9_D2P_BRIDGE_FUNC                    0
+
+#define ICH9_D2P_SECONDARY_DEFAULT              (256 - 8)
+
+#define ICH9_D2P_A2_REVISION                    0x92
+
+
+/* D31:F1 LPC controller */
+#define ICH9_A2_LPC                             "ICH9 A2 LPC"
+#define ICH9_A2_LPC_SAVEVM_VERSION              0
+
+#define ICH9_LPC_DEV                            31
+#define ICH9_LPC_FUNC                           0
+
+#define ICH9_A2_LPC_REVISION                    0x2
+#define ICH9_LPC_NB_PIRQS                       8       /* PCI A-H */
+
+#define ICH9_LPC_PMBASE                         0x40
+#define  ICH9_LPC_PMBASE_BASE_ADDRESS_MASK      Q35_MASK(32, 15, 7)
+#define  ICH9_LPC_PMBASE_RTE                    0x1
+#define  ICH9_LPC_PMBASE_DEFAULT                0x1
+#define ICH9_LPC_ACPI_CTRL                      0x44
+#define  ICH9_LPC_ACPI_CTRL_ACPI_EN             0x80
+#define  ICH9_LPC_ACPI_CTRL_SCI_IRQ_SEL_MASK    Q35_MASK(8, 2, 0)
+#define  ICH9_LPC_ACPI_CTRL_9                   0x0
+#define  ICH9_LPC_ACPI_CTRL_10                  0x1
+#define  ICH9_LPC_ACPI_CTRL_11                  0x2
+#define  ICH9_LPC_ACPI_CTRL_20                  0x4
+#define  ICH9_LPC_ACPI_CTRL_21                  0x5
+#define  ICH9_LPC_ACPI_CTRL_DEFAULT             0x0
+
+#define ICH9_LPC_PIRQA_ROUT                     0x60
+#define ICH9_LPC_PIRQB_ROUT                     0x61
+#define ICH9_LPC_PIRQC_ROUT                     0x62
+#define ICH9_LPC_PIRQD_ROUT                     0x63
+
+#define ICH9_LPC_PIRQE_ROUT                     0x68
+#define ICH9_LPC_PIRQF_ROUT                     0x69
+#define ICH9_LPC_PIRQG_ROUT                     0x6a
+#define ICH9_LPC_PIRQH_ROUT                     0x6b
+
+#define  ICH9_LPC_PIRQ_ROUT_IRQEN               0x80
+#define  ICH9_LPC_PIRQ_ROUT_MASK                Q35_MASK(8, 3, 0)
+#define  ICH9_LPC_PIRQ_ROUT_DEFAULT             0x80
+
+#define ICH9_LPC_RCBA                           0xf0
+#define  ICH9_LPC_RCBA_BA_MASK                  Q35_MASK(32, 31, 14)
+#define  ICH9_LPC_RCBA_EN                       0x1
+#define  ICH9_LPC_RCBA_DEFAULT                  0x0
+
+#define ICH9_LPC_PIC_NUM_PINS                   16
+#define ICH9_LPC_IOAPIC_NUM_PINS                24
+
+/* D31:F2 SATA Controller #1 */
+#define ICH9_SATA1_DEV                          31
+#define ICH9_SATA1_FUNC                         2
+
+/* D30:F1 power management I/O registers
+   offset from the address ICH9_LPC_PMBASE */
+
+/* ICH9 LPC PM I/O registers are 128 ports and 128-aligned */
+#define ICH9_PMIO_SIZE                          128
+#define ICH9_PMIO_MASK                          (ICH9_PMIO_SIZE - 1)
+
+#define ICH9_PMIO_PM1_STS                       0x00
+#define ICH9_PMIO_PM1_EN                        0x02
+#define ICH9_PMIO_PM1_CNT                       0x04
+#define ICH9_PMIO_PM1_TMR                       0x08
+#define ICH9_PMIO_GPE0_STS                      0x20
+#define ICH9_PMIO_GPE0_EN                       0x28
+#define  ICH9_PMIO_GPE0_LEN                     16
+#define ICH9_PMIO_SMI_EN                        0x30
+#define  ICH9_PMIO_SMI_EN_APMC_EN               (1 << 5)
+#define ICH9_PMIO_SMI_STS                       0x34
+
+/* FADT ACPI_ENABLE/ACPI_DISABLE */
+#define ICH9_APM_ACPI_ENABLE                    0x2
+#define ICH9_APM_ACPI_DISABLE                   0x3
+
+
+/* D31:F3 SMBus controller */
+#define ICH9_A2_SMB_REVISION                    0x02
+#define ICH9_SMB_PI                             0x00
+
+#define ICH9_SMB_SMBMBAR0                       0x10
+#define ICH9_SMB_SMBMBAR1                       0x14
+#define  ICH9_SMB_SMBM_BAR                      0
+#define  ICH9_SMB_SMBM_SIZE                     (1 << 8)
+#define ICH9_SMB_SMB_BASE                       0x20
+#define  ICH9_SMB_SMB_BASE_BAR                  4
+#define  ICH9_SMB_SMB_BASE_SIZE                 (1 << 5)
+#define ICH9_SMB_HOSTC                          0x40
+#define  ICH9_SMB_HOSTC_SSRESET                 ((uint8_t)(1 << 3))
+#define  ICH9_SMB_HOSTC_I2C_EN                  ((uint8_t)(1 << 2))
+#define  ICH9_SMB_HOSTC_SMB_SMI_EN              ((uint8_t)(1 << 1))
+#define  ICH9_SMB_HOSTC_HST_EN                  ((uint8_t)(1 << 0))
+
+/* D31:F3 SMBus I/O and memory mapped I/O registers */
+#define ICH9_SMB_DEV                            31
+#define ICH9_SMB_FUNC                           3
+
+#define ICH9_SMB_HST_STS                        0x00
+#define ICH9_SMB_HST_CNT                        0x02
+#define ICH9_SMB_HST_CMD                        0x03
+#define ICH9_SMB_XMIT_SLVA                      0x04
+#define ICH9_SMB_HST_D0                         0x05
+#define ICH9_SMB_HST_D1                         0x06
+#define ICH9_SMB_HOST_BLOCK_DB                  0x07
+
+#endif /* HW_Q35_H */
diff --git a/hw/q35_smbus.c b/hw/q35_smbus.c
new file mode 100644
index 0000000..fe445ac
--- /dev/null
+++ b/hw/q35_smbus.c
@@ -0,0 +1,154 @@
+/*
+ * ACPI implementation
+ *
+ * Copyright (c) 2006 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2 as published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>
+ */
+/*
+ *  Copyright (c) 2009 Isaku Yamahata <yamahata at valinux co jp>
+ *                     VA Linux Systems Japan K.K.
+ *
+ *  This is based on acpi.c, but heavily rewritten.
+ */
+#include "hw.h"
+#include "pc.h"
+#include "pm_smbus.h"
+#include "pci.h"
+#include "sysemu.h"
+#include "i2c.h"
+#include "smbus.h"
+
+#include "q35.h"
+
+typedef struct ICH9_SMBState {
+    PCIDevice dev;
+
+    PMSMBus smb;
+} ICH9_SMBState;
+
+static ICH9_SMBState *ich9_pci_to_smb(PCIDevice* pci_dev)
+{
+    return DO_UPCAST(ICH9_SMBState, dev, pci_dev);
+}
+
+static const VMStateDescription vmstate_ich9_smbus = {
+    .name = "ich9_smb",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, struct ICH9_SMBState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void ich9_smb_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
+{
+    ICH9_SMBState *s = opaque;
+    uint8_t hostc = s->dev.config[ICH9_SMB_HOSTC];
+
+    if ((hostc & ICH9_SMB_HOSTC_HST_EN) && !(hostc & ICH9_SMB_HOSTC_I2C_EN)) {
+        uint64_t offset = addr - s->dev.io_regions[ICH9_SMB_SMB_BASE_BAR].addr;
+        smb_ioport_writeb(&s->smb, offset, val);
+    }
+}
+
+static uint32_t ich9_smb_ioport_readb(void *opaque, uint32_t addr)
+{
+    ICH9_SMBState *s = opaque;
+    uint8_t hostc = s->dev.config[ICH9_SMB_HOSTC];
+
+    if ((hostc & ICH9_SMB_HOSTC_HST_EN) && !(hostc & ICH9_SMB_HOSTC_I2C_EN)) {
+        uint64_t offset = addr - s->dev.io_regions[ICH9_SMB_SMB_BASE_BAR].addr;
+        return smb_ioport_readb(&s->smb, offset);
+    }
+
+    return 0xff;
+}
+
+static void ich9_smb_map_ioport(PCIDevice *dev, int region_num,
+                                uint64_t addr, uint64_t size, int type)
+{
+    ICH9_SMBState *s = ich9_pci_to_smb(dev);
+
+    assert(size == ICH9_SMB_SMB_BASE_SIZE);
+    assert(type == PCI_BASE_ADDRESS_SPACE_IO);
+
+    register_ioport_write(addr, 64, 1, ich9_smb_ioport_writeb, s);
+    register_ioport_read(addr, 64, 1, ich9_smb_ioport_readb, s);
+}
+
+static int ich9_smb_initfn(PCIDevice *d)
+{
+    ICH9_SMBState *s = ich9_pci_to_smb(d);
+
+    pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_INTEL);
+    pci_config_set_device_id(d->config, PCI_DEVICE_ID_INTEL_ICH9_6);
+
+    pci_set_word(d->wmask + PCI_STATUS,
+                 PCI_STATUS_SIG_SYSTEM_ERROR | PCI_STATUS_DETECTED_PARITY);
+
+    pci_config_set_revision(d->config, ICH9_A2_SMB_REVISION);
+    pci_config_set_prog_interface(d->config, ICH9_SMB_PI);
+    pci_config_set_class(d->config, PCI_CLASS_SERIAL_SMBUS);
+
+    /* TODO? D31IP.SMIP in chipset configuration space */
+    pci_config_set_interrupt_pin(d->config, 0x01); /* interrupt pin 1 */
+
+    pci_set_byte(d->config + ICH9_SMB_HOSTC, 0);
+
+    /*
+     * update parameters based on
+     * paralell_hds[0]
+     * serial_hds[0]
+     * serial_hds[0]
+     * fdc
+     *
+     * Is there any OS that depends on them?
+     */
+
+    /* TODO smb_io_base */
+    pci_set_byte(d->config + ICH9_SMB_HOSTC, 0);
+    /* TODO bar0, bar1: 64bit BAR support*/
+    pci_register_bar(d, ICH9_SMB_SMB_BASE_BAR,
+                     ICH9_SMB_SMB_BASE_SIZE, PCI_BASE_ADDRESS_SPACE_IO,
+                     &ich9_smb_map_ioport);
+
+    pm_smbus_init(&d->qdev, &s->smb);
+    return 0;
+}
+
+i2c_bus *ich9_smb_init(PCIBus *bus, int devfn, uint32_t smb_io_base)
+{
+    PCIDevice *d =
+        pci_create_simple_multifunction(bus, devfn, true, "ICH9 SMB");
+    ICH9_SMBState *s = ich9_pci_to_smb(d);
+    return s->smb.smbus;
+}
+
+static PCIDeviceInfo ich9_smb_info = {
+    .qdev.name = "ICH9 SMB",
+    .qdev.desc = "ICH9 SMBUS Bridge",
+    .qdev.size = sizeof(ICH9_SMBState),
+    .qdev.vmsd = &vmstate_ich9_smbus,
+    .qdev.no_user = 1,
+    .init = ich9_smb_initfn,
+};
+
+static void ich9_smb_register(void)
+{
+    pci_qdev_register(&ich9_smb_info);
+}
+
+device_init(ich9_smb_register);
