diff --git a/Makefile.target b/Makefile.target
index 1db1cdf68..9e7a1bb09 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -583,6 +583,7 @@ OBJS+= ide.o pckbd.o ps2.o vga.o $(SOUND_HW) dma.o
 OBJS+= fdc.o mc146818rtc.o serial.o i8259.o i8254.o pcspk.o pc.o
 OBJS+= cirrus_vga.o apic.o parallel.o acpi.o piix_pci.o
 OBJS+= usb-uhci.o vmmouse.o vmport.o vmware_vga.o hpet.o
+OBJS += device-hotplug.o pci-hotplug.o
 CPPFLAGS += -DHAS_AUDIO -DHAS_AUDIO_CHOICE
 endif
 ifeq ($(TARGET_BASE_ARCH), ppc)
diff --git a/hw/acpi.c b/hw/acpi.c
index 0702017c6..feceb6935 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -679,8 +679,12 @@ static uint32_t pciej_read(void *opaque, uint32_t addr)
 
 static void pciej_write(void *opaque, uint32_t addr, uint32_t val)
 {
+#if defined (TARGET_I386)
     int slot = ffs(val) - 1;
 
+    pci_device_hot_remove_success(0, slot);
+#endif
+
 #if defined(DEBUG)
     printf("pciej write %lx <== %d\n", addr, val);
 #endif
diff --git a/hw/boards.h b/hw/boards.h
index 0577f06ba..7384817cf 100644
--- a/hw/boards.h
+++ b/hw/boards.h
@@ -25,6 +25,8 @@ typedef struct QEMUMachine {
 int qemu_register_machine(QEMUMachine *m);
 void register_machines(void);
 
+extern QEMUMachine *current_machine;
+
 /* Axis ETRAX.  */
 extern QEMUMachine bareetraxfs_machine;
 extern QEMUMachine axisdev88_machine;
diff --git a/hw/device-hotplug.c b/hw/device-hotplug.c
new file mode 100644
index 000000000..e58ecd6df
--- /dev/null
+++ b/hw/device-hotplug.c
@@ -0,0 +1,85 @@
+/*
+ * QEMU device hotplug helpers
+ *
+ * Copyright (c) 2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw.h"
+#include "boards.h"
+#include "net.h"
+#include "block_int.h"
+#include "sysemu.h"
+
+int add_init_drive(const char *opts)
+{
+    int drive_opt_idx, drive_idx;
+    int ret = -1;
+
+    drive_opt_idx = drive_add(NULL, "%s", opts);
+    if (!drive_opt_idx)
+        return ret;
+
+    drive_idx = drive_init(&drives_opt[drive_opt_idx], 0, current_machine);
+    if (drive_idx == -1) {
+        drive_remove(drive_opt_idx);
+        return ret;
+    }
+
+    return drive_idx;
+}
+
+void destroy_nic(dev_match_fn *match_fn, void *arg)
+{
+    int i;
+    NICInfo *nic;
+
+    for (i = 0; i < MAX_NICS; i++)
+        nic = &nd_table[i];
+        if (nic->used) {
+            if (nic->private && match_fn(nic->private, arg)) {
+                if (nic->vlan) {
+                    VLANClientState *vc;
+                    vc = qemu_find_vlan_client(nic->vlan, nic->private);
+                    if (vc)
+                        qemu_del_vlan_client(vc);
+                }
+                net_client_uninit(nic);
+            }
+        }
+}
+
+void destroy_bdrvs(dev_match_fn *match_fn, void *arg)
+{
+    int i;
+    struct BlockDriverState *bs;
+
+    for (i = 0; i <= MAX_DRIVES; i++) {
+        bs = drives_table[i].bdrv;
+        if (bs) {
+            if (bs->private && match_fn(bs->private, arg)) {
+                drive_uninit(bs);
+                bdrv_delete(bs);
+            }
+        }
+    }
+}
+
+
diff --git a/hw/pci-hotplug.c b/hw/pci-hotplug.c
new file mode 100644
index 000000000..628676444
--- /dev/null
+++ b/hw/pci-hotplug.c
@@ -0,0 +1,219 @@
+/*
+ * QEMU PCI hotplug support
+ *
+ * Copyright (c) 2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw.h"
+#include "boards.h"
+#include "pci.h"
+#include "net.h"
+#include "sysemu.h"
+#include "pc.h"
+#include "console.h"
+#include "block_int.h"
+#include "virtio-blk.h"
+
+#if defined(TARGET_I386) || defined(TARGET_X86_64)
+static PCIDevice *qemu_pci_hot_add_nic(PCIBus *pci_bus, const char *opts)
+{
+    int ret;
+
+    ret = net_client_init ("nic", opts);
+    if (ret < 0 || !nd_table[ret].model)
+        return NULL;
+    return pci_nic_init (pci_bus, &nd_table[ret], -1, "rtl8139");
+}
+
+void drive_hot_add(const char *pci_addr, const char *opts)
+{
+    int dom, pci_bus;
+    unsigned slot;
+    int drive_idx, type, bus;
+    int success = 0;
+    PCIDevice *dev;
+
+    if (pci_read_devaddr(pci_addr, &dom, &pci_bus, &slot)) {
+        term_printf("Invalid pci address\n");
+        return;
+    }
+
+    dev = pci_find_device(pci_bus, slot, 0);
+    if (!dev) {
+        term_printf("no pci device with address %s\n", pci_addr);
+        return;
+    }
+
+    drive_idx = add_init_drive(opts);
+    if (drive_idx < 0)
+        return;
+    type = drives_table[drive_idx].type;
+    bus = drive_get_max_bus (type);
+
+    switch (type) {
+    case IF_SCSI:
+        success = 1;
+        lsi_scsi_attach (dev, drives_table[drive_idx].bdrv,
+                         drives_table[drive_idx].unit);
+        break;
+    default:
+        term_printf("Can't hot-add drive to type %d\n", type);
+    }
+
+    if (success)
+        term_printf("OK bus %d, unit %d\n", drives_table[drive_idx].bus,
+                                            drives_table[drive_idx].unit);
+    return;
+}
+
+static PCIDevice *qemu_pci_hot_add_storage(PCIBus *pci_bus, const char *opts)
+{
+    void *opaque = NULL;
+    int type = -1, drive_idx = -1;
+    char buf[128];
+
+    if (get_param_value(buf, sizeof(buf), "if", opts)) {
+        if (!strcmp(buf, "scsi"))
+            type = IF_SCSI;
+        else if (!strcmp(buf, "virtio")) {
+            type = IF_VIRTIO;
+        }
+    } else {
+        term_printf("no if= specified\n");
+        return NULL;
+    }
+
+    if (get_param_value(buf, sizeof(buf), "file", opts)) {
+        drive_idx = add_init_drive(opts);
+        if (drive_idx < 0)
+            return NULL;
+    } else if (type == IF_VIRTIO) {
+        term_printf("virtio requires a backing file/device.\n");
+        return NULL;
+    }
+
+    switch (type) {
+    case IF_SCSI:
+        opaque = lsi_scsi_init (pci_bus, -1);
+        if (opaque && drive_idx >= 0)
+            lsi_scsi_attach (opaque, drives_table[drive_idx].bdrv,
+                             drives_table[drive_idx].unit);
+        break;
+    case IF_VIRTIO:
+        opaque = virtio_blk_init (pci_bus, drives_table[drive_idx].bdrv);
+        break;
+    default:
+        term_printf ("type %s not a hotpluggable PCI device.\n", buf);
+    }
+
+    return opaque;
+}
+
+void pci_device_hot_add(const char *pci_addr, const char *type, const char *opts)
+{
+    PCIDevice *dev = NULL;
+    PCIBus *pci_bus;
+    int dom, bus;
+    unsigned slot;
+
+    if (pci_assign_devaddr(pci_addr, &dom, &bus, &slot)) {
+        term_printf("Invalid pci address\n");
+        return;
+    }
+
+    pci_bus = pci_find_bus(bus);
+    if (!pci_bus) {
+        term_printf("Can't find pci_bus %d\n", bus);
+        return;
+    }
+
+    if (strcmp(type, "nic") == 0)
+        dev = qemu_pci_hot_add_nic(pci_bus, opts);
+    else if (strcmp(type, "storage") == 0)
+        dev = qemu_pci_hot_add_storage(pci_bus, opts);
+    else
+        term_printf("invalid type: %s\n", type);
+
+    if (dev) {
+        qemu_system_device_hot_add(bus, PCI_SLOT(dev->devfn), 1);
+        term_printf("OK domain %d, bus %d, slot %d, function %d\n",
+                    0, pci_bus_num(dev->bus), PCI_SLOT(dev->devfn),
+                    PCI_FUNC(dev->devfn));
+    } else
+        term_printf("failed to add %s\n", opts);
+}
+#endif
+
+void pci_device_hot_remove(const char *pci_addr)
+{
+    PCIDevice *d;
+    int dom, bus;
+    unsigned slot;
+
+    if (pci_read_devaddr(pci_addr, &dom, &bus, &slot)) {
+        term_printf("Invalid pci address\n");
+        return;
+    }
+
+    d = pci_find_device(bus, slot, 0);
+    if (!d) {
+        term_printf("slot %d empty\n", slot);
+        return;
+    }
+
+    qemu_system_device_hot_add(bus, slot, 0);
+}
+
+static int pci_match_fn(void *dev_private, void *arg)
+{
+    PCIDevice *dev = dev_private;
+    PCIDevice *match = arg;
+
+    return (dev == match);
+}
+
+/*
+ * OS has executed _EJ0 method, we now can remove the device
+ */
+void pci_device_hot_remove_success(int pcibus, int slot)
+{
+    PCIDevice *d = pci_find_device(pcibus, slot, 0);
+    int class_code;
+
+    if (!d) {
+        term_printf("invalid slot %d\n", slot);
+        return;
+    }
+
+    class_code = d->config_read(d, PCI_CLASS_DEVICE+1, 1);
+
+    switch(class_code) {
+    case PCI_BASE_CLASS_STORAGE:
+        destroy_bdrvs(pci_match_fn, d);
+        break;
+    case PCI_BASE_CLASS_NETWORK:
+        destroy_nic(pci_match_fn, d);
+        break;
+    }
+
+    pci_unregister_device(d);
+}
+
diff --git a/hw/pci.h b/hw/pci.h
index 7e25821df..8c301d097 100644
--- a/hw/pci.h
+++ b/hw/pci.h
@@ -14,6 +14,9 @@ extern target_phys_addr_t pci_mem_base;
 
 /* Device classes and subclasses */
 
+#define PCI_BASE_CLASS_STORAGE           0x01
+#define PCI_BASE_CLASS_NETWORK           0x02
+
 #define PCI_CLASS_STORAGE_SCSI           0x0100
 #define PCI_CLASS_STORAGE_IDE            0x0101
 #define PCI_CLASS_STORAGE_OTHER          0x0180
diff --git a/monitor.c b/monitor.c
index 778f49fb3..35f014d21 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1511,6 +1511,20 @@ static const term_cmd_t term_cmds[] = {
       "", "cancel the current VM migration" },
     { "migrate_set_speed", "s", do_migrate_set_speed,
       "value", "set maximum speed (in bytes) for migrations" },
+#if defined(TARGET_I386)
+    { "drive_add", "ss", drive_hot_add, "pci_addr=[[<domain>:]<bus>:]<slot>\n"
+                                         "[file=file][,if=type][,bus=n]\n"
+                                        "[,unit=m][,media=d][index=i]\n"
+                                        "[,cyls=c,heads=h,secs=s[,trans=t]]\n"
+                                        "[snapshot=on|off][,cache=on|off]",
+                                        "add drive to PCI storage controller" },
+    { "pci_add", "sss", pci_device_hot_add, "pci_addr=auto|[[<domain>:]<bus>:]<slot> nic|storage [[vlan=n][,macaddr=addr][,model=type]] [file=file][,if=type][,bus=nr]...", "hot-add PCI device" },
+    { "pci_del", "s", pci_device_hot_remove, "pci_addr=[[<domain>:]<bus>:]<slot>", "hot remove PCI device" },
+    { "host_net_add", "ss", net_host_device_add,
+      "[tap,user,socket,vde] options", "add host VLAN client" },
+    { "host_net_remove", "is", net_host_device_remove,
+      "vlan_id name", "remove host VLAN client" },
+#endif
     { "balloon", "i", do_balloon,
       "target", "request VM to change it's memory allocation (in MB)" },
     { "set_link", "ss", do_set_link,
diff --git a/net.c b/net.c
index c61f66b76..27a3e4a79 100644
--- a/net.c
+++ b/net.c
@@ -1734,6 +1734,62 @@ void net_client_uninit(NICInfo *nd)
     free((void *)nd->model);
 }
 
+static int net_host_check_device(const char *device)
+{
+    int i;
+    const char *valid_param_list[] = { "tap", "socket"
+#ifdef CONFIG_SLIRP
+                                       ,"user"
+#endif
+#ifdef CONFIG_VDE
+                                       ,"vde"
+#endif
+    };
+    for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
+        if (!strncmp(valid_param_list[i], device,
+                     strlen(valid_param_list[i])))
+            return 1;
+    }
+
+    return 0;
+}
+
+void net_host_device_add(const char *device, const char *opts)
+{
+    if (!net_host_check_device(device)) {
+        term_printf("invalid host network device %s\n", device);
+        return;
+    }
+    net_client_init(device, opts);
+}
+
+void net_host_device_remove(int vlan_id, const char *device)
+{
+    VLANState *vlan;
+    VLANClientState *vc;
+
+    if (!net_host_check_device(device)) {
+        term_printf("invalid host network device %s\n", device);
+        return;
+    }
+
+    vlan = qemu_find_vlan(vlan_id);
+    if (!vlan) {
+        term_printf("can't find vlan %d\n", vlan_id);
+        return;
+    }
+
+   for(vc = vlan->first_client; vc != NULL; vc = vc->next)
+        if (!strcmp(vc->name, device))
+            break;
+
+    if (!vc) {
+        term_printf("can't find device %s\n", device);
+        return;
+    }
+    qemu_del_vlan_client(vc);
+}
+
 int net_client_parse(const char *str)
 {
     const char *p;
diff --git a/net.h b/net.h
index a982394ee..03c7f1831 100644
--- a/net.h
+++ b/net.h
@@ -102,6 +102,8 @@ void net_slirp_redir(const char *redir_str);
 void net_cleanup(void);
 int slirp_is_inited(void);
 void net_client_check(void);
+void net_host_device_add(const char *device, const char *opts);
+void net_host_device_remove(int vlan_id, const char *device);
 
 #define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
 #define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
diff --git a/sysemu.h b/sysemu.h
index 40e37158e..57217c1eb 100644
--- a/sysemu.h
+++ b/sysemu.h
@@ -170,6 +170,20 @@ extern int drive_init(struct drive_opt *arg, int snapshot, void *machine);
 void qemu_system_hot_add_init(void);
 void qemu_system_device_hot_add(int pcibus, int slot, int state);
 
+/* device-hotplug */
+
+typedef int (dev_match_fn)(void *dev_private, void *arg);
+
+int add_init_drive(const char *opts);
+void destroy_nic(dev_match_fn *match_fn, void *arg);
+void destroy_bdrvs(dev_match_fn *match_fn, void *arg);
+
+/* pci-hotplug */
+void pci_device_hot_add(const char *pci_addr, const char *type, const char *opts);
+void drive_hot_add(const char *pci_addr, const char *opts);
+void pci_device_hot_remove(const char *pci_addr);
+void pci_device_hot_remove_success(int pcibus, int slot);
+
 /* serial ports */
 
 #define MAX_SERIAL_PORTS 4
diff --git a/vl.c b/vl.c
index cdb91591c..5f237d0a0 100644
--- a/vl.c
+++ b/vl.c
@@ -3405,6 +3405,7 @@ static void qemu_bh_update_timeout(int *timeout)
 /* machine registration */
 
 static QEMUMachine *first_machine = NULL;
+QEMUMachine *current_machine = NULL;
 
 int qemu_register_machine(QEMUMachine *m)
 {
@@ -5587,6 +5588,8 @@ int main(int argc, char **argv, char **envp)
     machine->init(ram_size, vga_ram_size, boot_devices,
                   kernel_filename, kernel_cmdline, initrd_filename, cpu_model);
 
+    current_machine = machine;
+
     /* Set KVM's vcpu state to qemu's initial CPUState. */
     if (kvm_enabled()) {
         int ret;