diff --git a/hw/ads7846.c b/hw/ads7846.c
index 9fa18c7cf..1c65ffe15 100644
--- a/hw/ads7846.c
+++ b/hw/ads7846.c
@@ -7,11 +7,11 @@
  * This code is licensed under the GNU GPL v2.
  */
 
-#include "hw.h"
-#include "devices.h"
+#include "ssi.h"
 #include "console.h"
 
-struct ADS7846State {
+typedef struct {
+    SSISlave ssidev;
     qemu_irq interrupt;
 
     int input[8];
@@ -20,7 +20,7 @@ struct ADS7846State {
 
     int cycle;
     int output;
-};
+} ADS7846State;
 
 /* Control-byte bitfields */
 #define CB_PD0		(1 << 0)
@@ -52,16 +52,9 @@ static void ads7846_int_update(ADS7846State *s)
         qemu_set_irq(s->interrupt, s->pressure == 0);
 }
 
-uint32_t ads7846_read(void *opaque)
+static uint32_t ads7846_transfer(SSISlave *dev, uint32_t value)
 {
-    ADS7846State *s = (ADS7846State *) opaque;
-
-    return s->output;
-}
-
-void ads7846_write(void *opaque, uint32_t value)
-{
-    ADS7846State *s = (ADS7846State *) opaque;
+    ADS7846State *s = FROM_SSI_SLAVE(ADS7846State, dev);
 
     switch (s->cycle ++) {
     case 0:
@@ -89,6 +82,7 @@ void ads7846_write(void *opaque, uint32_t value)
         s->cycle = 0;
         break;
     }
+    return s->output;
 }
 
 static void ads7846_ts_event(void *opaque,
@@ -140,14 +134,11 @@ static int ads7846_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-ADS7846State *ads7846_init(qemu_irq penirq)
+static void ads7846_init(SSISlave *dev)
 {
-    ADS7846State *s;
-    s = (ADS7846State *)
-            qemu_mallocz(sizeof(ADS7846State));
-    memset(s, 0, sizeof(ADS7846State));
+    ADS7846State *s = FROM_SSI_SLAVE(ADS7846State, dev);
 
-    s->interrupt = penirq;
+    qdev_init_gpio_out(&dev->qdev, &s->interrupt, 1);
 
     s->input[0] = ADS_TEMP0;	/* TEMP0 */
     s->input[2] = ADS_VBAT;	/* VBAT */
@@ -161,6 +152,16 @@ ADS7846State *ads7846_init(qemu_irq penirq)
     ads7846_int_update(s);
 
     register_savevm("ads7846", -1, 0, ads7846_save, ads7846_load, s);
-
-    return s;
 }
+
+static SSISlaveInfo ads7846_info = {
+    .init = ads7846_init,
+    .transfer = ads7846_transfer
+};
+
+static void ads7846_register_devices(void)
+{
+    ssi_register_slave("ads7846", sizeof(ADS7846State), &ads7846_info);
+}
+
+device_init(ads7846_register_devices)
diff --git a/hw/devices.h b/hw/devices.h
index 1691a1437..156bde2a2 100644
--- a/hw/devices.h
+++ b/hw/devices.h
@@ -6,12 +6,6 @@
 /* smc91c111.c */
 void smc91c111_init(NICInfo *, uint32_t, qemu_irq);
 
-/* ads7846.c */
-typedef struct ADS7846State ADS7846State;
-uint32_t ads7846_read(void *opaque);
-void ads7846_write(void *opaque, uint32_t value);
-ADS7846State *ads7846_init(qemu_irq penirq);
-
 /* tsc210x.c */
 uWireSlave *tsc2102_init(qemu_irq pint);
 uWireSlave *tsc2301_init(qemu_irq penirq, qemu_irq kbirq, qemu_irq dav);
diff --git a/hw/i2c.h b/hw/i2c.h
index 55d6ec552..4e5a1ac8f 100644
--- a/hw/i2c.h
+++ b/hw/i2c.h
@@ -61,14 +61,6 @@ void i2c_register_slave(const char *name, int size, I2CSlaveInfo *type);
 
 DeviceState *i2c_create_slave(i2c_bus *bus, const char *name, int addr);
 
-/* max111x.c */
-typedef struct MAX111xState MAX111xState;
-uint32_t max111x_read(void *opaque);
-void max111x_write(void *opaque, uint32_t value);
-MAX111xState *max1110_init(qemu_irq cb);
-MAX111xState *max1111_init(qemu_irq cb);
-void max111x_set_input(MAX111xState *s, int line, uint8_t value);
-
 /* max7310.c */
 void max7310_reset(i2c_slave *i2c);
 qemu_irq *max7310_gpio_in_get(i2c_slave *i2c);
diff --git a/hw/max111x.c b/hw/max111x.c
index c19154d74..217233cff 100644
--- a/hw/max111x.c
+++ b/hw/max111x.c
@@ -7,17 +7,17 @@
  * This code is licensed under the GNU GPLv2.
  */
 
-#include "hw.h"
-#include "i2c.h"
+#include "ssi.h"
 
-struct MAX111xState {
+typedef struct {
+    SSISlave ssidev;
     qemu_irq interrupt;
     uint8_t tb1, rb2, rb3;
     int cycle;
 
     int input[8];
     int inputs, com;
-};
+} MAX111xState;
 
 /* Control-byte bitfields */
 #define CB_PD0		(1 << 0)
@@ -34,10 +34,8 @@ struct MAX111xState {
 			 (((v) >> (3 + (b1))) & 2) |	\
 			 (((v) >> (4 + (b2))) & 1))
 
-uint32_t max111x_read(void *opaque)
+static uint32_t max111x_read(MAX111xState *s)
 {
-    MAX111xState *s = (MAX111xState *) opaque;
-
     if (!s->tb1)
         return 0;
 
@@ -52,9 +50,8 @@ uint32_t max111x_read(void *opaque)
 }
 
 /* Interpret a control-byte */
-void max111x_write(void *opaque, uint32_t value)
+static void max111x_write(MAX111xState *s, uint32_t value)
 {
-    MAX111xState *s = (MAX111xState *) opaque;
     int measure, chan;
 
     /* Ignore the value if START bit is zero */
@@ -86,8 +83,15 @@ void max111x_write(void *opaque, uint32_t value)
     s->rb2 = (measure >> 2) & 0x3f;
     s->rb3 = (measure << 6) & 0xc0;
 
-    if (s->interrupt)
-        qemu_irq_raise(s->interrupt);
+    /* FIXME: When should the IRQ be lowered?  */
+    qemu_irq_raise(s->interrupt);
+}
+
+static uint32_t max111x_transfer(SSISlave *dev, uint32_t value)
+{
+    MAX111xState *s = FROM_SSI_SLAVE(MAX111xState, dev);
+    max111x_write(s, value);
+    return max111x_read(s);
 }
 
 static void max111x_save(QEMUFile *f, void *opaque)
@@ -121,15 +125,13 @@ static int max111x_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-static MAX111xState *max111x_init(qemu_irq cb)
+static void max111x_init(SSISlave *dev, int inputs)
 {
-    MAX111xState *s;
-    s = (MAX111xState *)
-            qemu_mallocz(sizeof(MAX111xState));
-    memset(s, 0, sizeof(MAX111xState));
+    MAX111xState *s = FROM_SSI_SLAVE(MAX111xState, dev);
 
-    s->interrupt = cb;
+    qdev_init_gpio_out(&dev->qdev, &s->interrupt, 1);
 
+    s->inputs = inputs;
     /* TODO: add a user interface for setting these */
     s->input[0] = 0xf0;
     s->input[1] = 0xe0;
@@ -142,30 +144,39 @@ static MAX111xState *max111x_init(qemu_irq cb)
     s->com = 0;
 
     register_savevm("max111x", -1, 0, max111x_save, max111x_load, s);
-
-    return s;
 }
 
-MAX111xState *max1110_init(qemu_irq cb)
+static void max1110_init(SSISlave *dev)
 {
-    MAX111xState *s = max111x_init(cb);
-    s->inputs = 8;
-    return s;
+    max111x_init(dev, 8);
 }
 
-MAX111xState *max1111_init(qemu_irq cb)
+static void max1111_init(SSISlave *dev)
 {
-    MAX111xState *s = max111x_init(cb);
-    s->inputs = 4;
-    return s;
+    max111x_init(dev, 4);
 }
 
-void max111x_set_input(MAX111xState *s, int line, uint8_t value)
+void max111x_set_input(DeviceState *dev, int line, uint8_t value)
 {
-    if (line >= s->inputs) {
-        printf("%s: There's no input %i\n", __FUNCTION__, line);
-        return;
-    }
-
+    MAX111xState *s = FROM_SSI_SLAVE(MAX111xState, SSI_SLAVE_FROM_QDEV(dev));
+    assert(line >= 0 && line < s->inputs);
     s->input[line] = value;
 }
+
+static SSISlaveInfo max1110_info = {
+    .init = max1110_init,
+    .transfer = max111x_transfer
+};
+
+static SSISlaveInfo max1111_info = {
+    .init = max1111_init,
+    .transfer = max111x_transfer
+};
+
+static void max111x_register_devices(void)
+{
+    ssi_register_slave("max1110", sizeof(MAX111xState), &max1110_info);
+    ssi_register_slave("max1111", sizeof(MAX111xState), &max1111_info);
+}
+
+device_init(max111x_register_devices)
diff --git a/hw/pxa.h b/hw/pxa.h
index 97da6513e..2ca36c2f6 100644
--- a/hw/pxa.h
+++ b/hw/pxa.h
@@ -119,11 +119,6 @@ void pxa27x_register_keypad(PXA2xxKeyPadState *kp, struct keymap *map,
                 int size);
 
 /* pxa2xx.c */
-typedef struct PXA2xxSSPState PXA2xxSSPState;
-void pxa2xx_ssp_attach(PXA2xxSSPState *port,
-                uint32_t (*readfn)(void *opaque),
-                void (*writefn)(void *opaque, uint32_t value), void *opaque);
-
 typedef struct PXA2xxI2CState PXA2xxI2CState;
 PXA2xxI2CState *pxa2xx_i2c_init(target_phys_addr_t base,
                 qemu_irq irq, uint32_t page_size);
@@ -139,7 +134,7 @@ typedef struct {
     PXA2xxDMAState *dma;
     PXA2xxGPIOInfo *gpio;
     PXA2xxLCDState *lcd;
-    PXA2xxSSPState **ssp;
+    SSIBus **ssp;
     PXA2xxI2CState *i2c[2];
     PXA2xxMMCIState *mmc;
     PXA2xxPCMCIAState *pcmcia[2];
diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index b1ffa9f8f..d54ad194b 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -7,11 +7,12 @@
  * This code is licenced under the GPL.
  */
 
-#include "hw.h"
+#include "sysbus.h"
 #include "pxa.h"
 #include "sysemu.h"
 #include "pc.h"
 #include "i2c.h"
+#include "ssi.h"
 #include "qemu-timer.h"
 #include "qemu-char.h"
 
@@ -547,9 +548,11 @@ static int pxa2xx_mm_load(QEMUFile *f, void *opaque, int version_id)
 }
 
 /* Synchronous Serial Ports */
-struct PXA2xxSSPState {
+typedef struct {
+    SysBusDevice busdev;
     qemu_irq irq;
     int enable;
+    SSIBus *bus;
 
     uint32_t sscr[2];
     uint32_t sspsp;
@@ -563,11 +566,7 @@ struct PXA2xxSSPState {
     uint32_t rx_fifo[16];
     int rx_level;
     int rx_start;
-
-    uint32_t (*readfn)(void *opaque);
-    void (*writefn)(void *opaque, uint32_t value);
-    void *opaque;
-};
+} PXA2xxSSPState;
 
 #define SSCR0	0x00	/* SSP Control register 0 */
 #define SSCR1	0x04	/* SSP Control register 1 */
@@ -763,17 +762,13 @@ static void pxa2xx_ssp_write(void *opaque, target_phys_addr_t addr,
          * there directly to the slave, no need to buffer it.
          */
         if (s->enable) {
-            if (s->writefn)
-                s->writefn(s->opaque, value);
-
+            uint32_t readval;
+            readval = ssi_transfer(s->bus, value);
             if (s->rx_level < 0x10) {
-                if (s->readfn)
-                    s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] =
-                            s->readfn(s->opaque);
-                else
-                    s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = 0x0;
-            } else
+                s->rx_fifo[(s->rx_start + s->rx_level ++) & 0xf] = readval;
+            } else {
                 s->sssr |= SSSR_ROR;
+            }
         }
         pxa2xx_ssp_fifo_update(s);
         break;
@@ -796,20 +791,6 @@ static void pxa2xx_ssp_write(void *opaque, target_phys_addr_t addr,
     }
 }
 
-void pxa2xx_ssp_attach(PXA2xxSSPState *port,
-                uint32_t (*readfn)(void *opaque),
-                void (*writefn)(void *opaque, uint32_t value), void *opaque)
-{
-    if (!port) {
-        printf("%s: no such SSP\n", __FUNCTION__);
-        exit(-1);
-    }
-
-    port->opaque = opaque;
-    port->readfn = readfn;
-    port->writefn = writefn;
-}
-
 static CPUReadMemoryFunc *pxa2xx_ssp_readfn[] = {
     pxa2xx_ssp_read,
     pxa2xx_ssp_read,
@@ -869,6 +850,23 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
+static void pxa2xx_ssp_init(SysBusDevice *dev)
+{
+    int iomemtype;
+    PXA2xxSSPState *s = FROM_SYSBUS(PXA2xxSSPState, dev);
+
+    sysbus_init_irq(dev, &s->irq);
+
+    iomemtype = cpu_register_io_memory(0, pxa2xx_ssp_readfn,
+                                       pxa2xx_ssp_writefn, s);
+    sysbus_init_mmio(dev, 0x1000, iomemtype);
+    register_savevm("pxa2xx_ssp", -1, 0,
+                    pxa2xx_ssp_save, pxa2xx_ssp_load, s);
+
+    s->bus = ssi_create_bus();
+    qdev_attach_child_bus(&dev->qdev, "ssi", s->bus);
+}
+
 /* Real-Time Clock */
 #define RCNR		0x00	/* RTC Counter register */
 #define RTAR		0x04	/* RTC Alarm register */
@@ -2034,7 +2032,6 @@ static void pxa2xx_reset(void *opaque, int line, int level)
 PXA2xxState *pxa270_init(unsigned int sdram_size, const char *revision)
 {
     PXA2xxState *s;
-    PXA2xxSSPState *ssp;
     int iomemtype, i;
     int index;
     s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
@@ -2115,21 +2112,12 @@ PXA2xxState *pxa270_init(unsigned int sdram_size, const char *revision)
     register_savevm("pxa2xx_pm", 0, 0, pxa2xx_pm_save, pxa2xx_pm_load, s);
 
     for (i = 0; pxa27x_ssp[i].io_base; i ++);
-    s->ssp = (PXA2xxSSPState **)
-            qemu_mallocz(sizeof(PXA2xxSSPState *) * i);
-    ssp = (PXA2xxSSPState *)
-            qemu_mallocz(sizeof(PXA2xxSSPState) * i);
+    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
-        target_phys_addr_t ssp_base;
-        s->ssp[i] = &ssp[i];
-        ssp_base = pxa27x_ssp[i].io_base;
-        ssp[i].irq = s->pic[pxa27x_ssp[i].irqn];
-
-        iomemtype = cpu_register_io_memory(0, pxa2xx_ssp_readfn,
-                        pxa2xx_ssp_writefn, &ssp[i]);
-        cpu_register_physical_memory(ssp_base, 0x1000, iomemtype);
-        register_savevm("pxa2xx_ssp", i, 0,
-                        pxa2xx_ssp_save, pxa2xx_ssp_load, s);
+        DeviceState *dev;
+        dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
+                                   s->pic[pxa27x_ssp[i].irqn]);
+        s->ssp[i] = qdev_get_child_bus(dev, "ssi");
     }
 
     if (usb_enabled) {
@@ -2163,7 +2151,6 @@ PXA2xxState *pxa270_init(unsigned int sdram_size, const char *revision)
 PXA2xxState *pxa255_init(unsigned int sdram_size)
 {
     PXA2xxState *s;
-    PXA2xxSSPState *ssp;
     int iomemtype, i;
     int index;
 
@@ -2237,21 +2224,12 @@ PXA2xxState *pxa255_init(unsigned int sdram_size)
     register_savevm("pxa2xx_pm", 0, 0, pxa2xx_pm_save, pxa2xx_pm_load, s);
 
     for (i = 0; pxa255_ssp[i].io_base; i ++);
-    s->ssp = (PXA2xxSSPState **)
-            qemu_mallocz(sizeof(PXA2xxSSPState *) * i);
-    ssp = (PXA2xxSSPState *)
-            qemu_mallocz(sizeof(PXA2xxSSPState) * i);
+    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
-        target_phys_addr_t ssp_base;
-        s->ssp[i] = &ssp[i];
-        ssp_base = pxa255_ssp[i].io_base;
-        ssp[i].irq = s->pic[pxa255_ssp[i].irqn];
-
-        iomemtype = cpu_register_io_memory(0, pxa2xx_ssp_readfn,
-                        pxa2xx_ssp_writefn, &ssp[i]);
-        cpu_register_physical_memory(ssp_base, 0x1000, iomemtype);
-        register_savevm("pxa2xx_ssp", i, 0,
-                        pxa2xx_ssp_save, pxa2xx_ssp_load, s);
+        DeviceState *dev;
+        dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
+                                   s->pic[pxa255_ssp[i].irqn]);
+        s->ssp[i] = qdev_get_child_bus(dev, "ssi");
     }
 
     if (usb_enabled) {
@@ -2283,6 +2261,7 @@ static void pxa2xx_register_devices(void)
 {
     i2c_register_slave("pxa2xx-i2c-slave", sizeof(PXA2xxI2CSlaveState),
                        &pxa2xx_i2c_slave_info);
+    sysbus_register_dev("pxa2xx-ssp", sizeof(PXA2xxSSPState), pxa2xx_ssp_init);
 }
 
 device_init(pxa2xx_register_devices)
diff --git a/hw/spitz.c b/hw/spitz.c
index f59f39c1c..c902006fc 100644
--- a/hw/spitz.c
+++ b/hw/spitz.c
@@ -13,6 +13,7 @@
 #include "sysemu.h"
 #include "pcmcia.h"
 #include "i2c.h"
+#include "ssi.h"
 #include "flash.h"
 #include "qemu-timer.h"
 #include "devices.h"
@@ -525,40 +526,50 @@ static void spitz_keyboard_register(PXA2xxState *cpu)
 #define LCDTG_PICTRL	0x06
 #define LCDTG_POLCTRL	0x07
 
-static int bl_intensity, bl_power;
+typedef struct {
+    SSISlave ssidev;
+    int bl_intensity;
+    int bl_power;
+} SpitzLCDTG;
 
-static void spitz_bl_update(PXA2xxState *s)
+static void spitz_bl_update(SpitzLCDTG *s)
 {
-    if (bl_power && bl_intensity)
-        zaurus_printf("LCD Backlight now at %i/63\n", bl_intensity);
+    if (s->bl_power && s->bl_intensity)
+        zaurus_printf("LCD Backlight now at %i/63\n", s->bl_intensity);
     else
         zaurus_printf("LCD Backlight now off\n");
 }
 
+/* FIXME: Implement GPIO properly and remove this hack.  */
+static SpitzLCDTG *spitz_lcdtg;
+
 static inline void spitz_bl_bit5(void *opaque, int line, int level)
 {
-    int prev = bl_intensity;
+    SpitzLCDTG *s = spitz_lcdtg;
+    int prev = s->bl_intensity;
 
     if (level)
-        bl_intensity &= ~0x20;
+        s->bl_intensity &= ~0x20;
     else
-        bl_intensity |= 0x20;
+        s->bl_intensity |= 0x20;
 
-    if (bl_power && prev != bl_intensity)
-        spitz_bl_update((PXA2xxState *) opaque);
+    if (s->bl_power && prev != s->bl_intensity)
+        spitz_bl_update(s);
 }
 
 static inline void spitz_bl_power(void *opaque, int line, int level)
 {
-    bl_power = !!level;
-    spitz_bl_update((PXA2xxState *) opaque);
+    SpitzLCDTG *s = spitz_lcdtg;
+    s->bl_power = !!level;
+    spitz_bl_update(s);
 }
 
-static void spitz_lcdtg_dac_put(void *opaque, uint8_t cmd)
+static uint32_t spitz_lcdtg_transfer(SSISlave *dev, uint32_t value)
 {
-    int addr, value;
-    addr = cmd >> 5;
-    value = cmd & 0x1f;
+    SpitzLCDTG *s = FROM_SSI_SLAVE(SpitzLCDTG, dev);
+    int addr;
+    addr = value >> 5;
+    value &= 0x1f;
 
     switch (addr) {
     case LCDTG_RESCTL:
@@ -569,16 +580,44 @@ static void spitz_lcdtg_dac_put(void *opaque, uint8_t cmd)
         break;
 
     case LCDTG_DUTYCTRL:
-        bl_intensity &= ~0x1f;
-        bl_intensity |= value;
-        if (bl_power)
-            spitz_bl_update((PXA2xxState *) opaque);
+        s->bl_intensity &= ~0x1f;
+        s->bl_intensity |= value;
+        if (s->bl_power)
+            spitz_bl_update(s);
         break;
 
     case LCDTG_POWERREG0:
         /* Set common voltage to M62332FP */
         break;
     }
+    return 0;
+}
+
+static void spitz_lcdtg_save(QEMUFile *f, void *opaque)
+{
+    SpitzLCDTG *s = (SpitzLCDTG *)opaque;
+    qemu_put_be32(f, s->bl_intensity);
+    qemu_put_be32(f, s->bl_power);
+}
+
+static int spitz_lcdtg_load(QEMUFile *f, void *opaque, int version_id)
+{
+    SpitzLCDTG *s = (SpitzLCDTG *)opaque;
+    s->bl_intensity = qemu_get_be32(f);
+    s->bl_power = qemu_get_be32(f);
+    return 0;
+}
+
+static void spitz_lcdtg_init(SSISlave *dev)
+{
+    SpitzLCDTG *s = FROM_SSI_SLAVE(SpitzLCDTG, dev);
+
+    spitz_lcdtg = s;
+    s->bl_power = 0;
+    s->bl_intensity = 0x20;
+
+    register_savevm("spitz-lcdtg", -1, 1,
+                    spitz_lcdtg_save, spitz_lcdtg_load, s);
 }
 
 /* SSP devices */
@@ -590,45 +629,33 @@ static void spitz_lcdtg_dac_put(void *opaque, uint8_t cmd)
 #define SPITZ_GPIO_MAX1111_CS	20
 #define SPITZ_GPIO_TP_INT	11
 
-static int lcd_en, ads_en, max_en;
-static MAX111xState *max1111;
-static ADS7846State *ads7846;
+static DeviceState *max1111;
 
 /* "Demux" the signal based on current chipselect */
-static uint32_t corgi_ssp_read(void *opaque)
-{
-    if (lcd_en)
-        return 0;
-    if (ads_en)
-        return ads7846_read(ads7846);
-    if (max_en)
-        return max111x_read(max1111);
-    return 0;
-}
+typedef struct {
+    SSISlave ssidev;
+    SSIBus *bus[3];
+    int enable[3];
+} CorgiSSPState;
 
-static void corgi_ssp_write(void *opaque, uint32_t value)
+static uint32_t corgi_ssp_transfer(SSISlave *dev, uint32_t value)
 {
-    if (lcd_en)
-        spitz_lcdtg_dac_put(opaque, value);
-    if (ads_en)
-        ads7846_write(ads7846, value);
-    if (max_en)
-        max111x_write(max1111, value);
+    CorgiSSPState *s = FROM_SSI_SLAVE(CorgiSSPState, dev);
+    int i;
+
+    for (i = 0; i < 3; i++) {
+        if (s->enable[i]) {
+            return ssi_transfer(s->bus[i], value);
+        }
+    }
+    return 0;
 }
 
 static void corgi_ssp_gpio_cs(void *opaque, int line, int level)
 {
-    switch (line) {
-    case 0:
-        lcd_en = !level;
-        break;
-    case 1:
-        ads_en = !level;
-        break;
-    case 2:
-        max_en = !level;
-        break;
-    }
+    CorgiSSPState *s = (CorgiSSPState *)opaque;
+    assert(line >= 0 && line < 3);
+    s->enable[line] = !level;
 }
 
 #define MAX1111_BATT_VOLT	1
@@ -652,49 +679,71 @@ static void spitz_adc_temp_on(void *opaque, int line, int level)
 
 static void spitz_ssp_save(QEMUFile *f, void *opaque)
 {
-    qemu_put_be32(f, lcd_en);
-    qemu_put_be32(f, ads_en);
-    qemu_put_be32(f, max_en);
-    qemu_put_be32(f, bl_intensity);
-    qemu_put_be32(f, bl_power);
+    CorgiSSPState *s = (CorgiSSPState *)opaque;
+    int i;
+
+    for (i = 0; i < 3; i++) {
+        qemu_put_be32(f, s->enable[i]);
+    }
 }
 
 static int spitz_ssp_load(QEMUFile *f, void *opaque, int version_id)
 {
-    lcd_en = qemu_get_be32(f);
-    ads_en = qemu_get_be32(f);
-    max_en = qemu_get_be32(f);
-    bl_intensity = qemu_get_be32(f);
-    bl_power = qemu_get_be32(f);
+    CorgiSSPState *s = (CorgiSSPState *)opaque;
+    int i;
 
+    if (version_id != 1) {
+        return -EINVAL;
+    }
+    for (i = 0; i < 3; i++) {
+        s->enable[i] = qemu_get_be32(f);
+    }
     return 0;
 }
 
+static void corgi_ssp_init(SSISlave *dev)
+{
+    CorgiSSPState *s = FROM_SSI_SLAVE(CorgiSSPState, dev);
+
+    qdev_init_gpio_in(&dev->qdev, corgi_ssp_gpio_cs, 3);
+    s->bus[0] = ssi_create_bus();
+    qdev_attach_child_bus(&dev->qdev, "ssi0", s->bus[0]);
+    s->bus[1] = ssi_create_bus();
+    qdev_attach_child_bus(&dev->qdev, "ssi1", s->bus[1]);
+    s->bus[2] = ssi_create_bus();
+    qdev_attach_child_bus(&dev->qdev, "ssi2", s->bus[2]);
+
+    register_savevm("spitz_ssp", -1, 1, spitz_ssp_save, spitz_ssp_load, s);
+}
+
 static void spitz_ssp_attach(PXA2xxState *cpu)
 {
-    qemu_irq *chipselects;
+    DeviceState *mux;
+    DeviceState *dev;
+    void *bus;
 
-    lcd_en = ads_en = max_en = 0;
+    mux = ssi_create_slave(cpu->ssp[CORGI_SSP_PORT - 1], "corgi-ssp");
 
-    ads7846 = ads7846_init(pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_TP_INT]);
+    bus = qdev_get_child_bus(mux, "ssi0");
+    dev = ssi_create_slave(bus, "spitz-lcdtg");
 
-    max1111 = max1111_init(0);
+    bus = qdev_get_child_bus(mux, "ssi1");
+    dev = ssi_create_slave(bus, "ads7846");
+    qdev_connect_gpio_out(dev, 0,
+                          pxa2xx_gpio_in_get(cpu->gpio)[SPITZ_GPIO_TP_INT]);
+
+    bus = qdev_get_child_bus(mux, "ssi2");
+    max1111 = ssi_create_slave(bus, "max1111");
     max111x_set_input(max1111, MAX1111_BATT_VOLT, SPITZ_BATTERY_VOLT);
     max111x_set_input(max1111, MAX1111_BATT_TEMP, 0);
     max111x_set_input(max1111, MAX1111_ACIN_VOLT, SPITZ_CHARGEON_ACIN);
 
-    pxa2xx_ssp_attach(cpu->ssp[CORGI_SSP_PORT - 1], corgi_ssp_read,
-                    corgi_ssp_write, cpu);
-
-    chipselects = qemu_allocate_irqs(corgi_ssp_gpio_cs, cpu, 3);
-    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_LCDCON_CS,  chipselects[0]);
-    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_ADS7846_CS, chipselects[1]);
-    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_MAX1111_CS, chipselects[2]);
-
-    bl_intensity = 0x20;
-    bl_power = 0;
-
-    register_savevm("spitz_ssp", 0, 0, spitz_ssp_save, spitz_ssp_load, cpu);
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_LCDCON_CS,
+                        qdev_get_gpio_in(mux, 0));
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_ADS7846_CS,
+                        qdev_get_gpio_in(mux, 1));
+    pxa2xx_gpio_out_set(cpu->gpio, SPITZ_GPIO_MAX1111_CS,
+                        qdev_get_gpio_in(mux, 2));
 }
 
 /* CF Microdrive */
@@ -1018,3 +1067,21 @@ QEMUMachine terrierpda_machine = {
     .desc = "Terrier PDA (PXA270)",
     .init = terrier_init,
 };
+
+static SSISlaveInfo corgi_ssp_info = {
+    .init = corgi_ssp_init,
+    .transfer = corgi_ssp_transfer
+};
+
+static SSISlaveInfo spitz_lcdtg_info = {
+    .init = spitz_lcdtg_init,
+    .transfer = spitz_lcdtg_transfer
+};
+
+static void spitz_register_devices(void)
+{
+    ssi_register_slave("corgi-ssp", sizeof(CorgiSSPState), &corgi_ssp_info);
+    ssi_register_slave("spitz-lcdtg", sizeof(SpitzLCDTG), &spitz_lcdtg_info);
+}
+
+device_init(spitz_register_devices)
diff --git a/hw/ssi.h b/hw/ssi.h
index d9865e64d..aab740fc5 100644
--- a/hw/ssi.h
+++ b/hw/ssi.h
@@ -38,4 +38,7 @@ SSIBus *ssi_create_bus(void);
 
 uint32_t ssi_transfer(SSIBus *bus, uint32_t val);
 
+/* max111x.c */
+void max111x_set_input(DeviceState *dev, int line, uint8_t value);
+
 #endif
diff --git a/hw/tosa.c b/hw/tosa.c
index 1f87e54f0..24227d83d 100644
--- a/hw/tosa.c
+++ b/hw/tosa.c
@@ -18,6 +18,7 @@
 #include "block.h"
 #include "boards.h"
 #include "i2c.h"
+#include "ssi.h"
 
 #define TOSA_RAM    0x04000000
 #define TOSA_ROM	0x00800000
@@ -114,14 +115,15 @@ static void tosa_gpio_setup(PXA2xxState *cpu,
     scoop_gpio_out_set(scp1, TOSA_GPIO_TC6393XB_L3V_ON, tc6393xb_l3v_get(tmio));
 }
 
-static uint32_t tosa_ssp_read(void *opaque)
+static uint32_t tosa_ssp_tansfer(SSISlave *dev, uint32_t value)
 {
+    fprintf(stderr, "TG: %d %02x\n", value >> 5, value & 0x1f);
     return 0;
 }
 
-static void tosa_ssp_write(void *opaque, uint32_t value)
+static void tosa_ssp_init(SSISlave *dev)
 {
-    fprintf(stderr, "TG: %d %02x\n", value >> 5, value & 0x1f);
+    /* Nothing to do.  */
 }
 
 typedef struct {
@@ -187,8 +189,7 @@ static void tosa_tg_init(PXA2xxState *cpu)
 {
     i2c_bus *bus = pxa2xx_i2c_bus(cpu->i2c[0]);
     i2c_create_slave(bus, "tosa_dac", DAC_BASE);
-    pxa2xx_ssp_attach(cpu->ssp[1], tosa_ssp_read,
-                    tosa_ssp_write, cpu);
+    ssi_create_slave(cpu->ssp[1], "tosa-ssp");
 }
 
 
@@ -250,9 +251,15 @@ static I2CSlaveInfo tosa_dac_info = {
     .send = tosa_dac_send
 };
 
+static SSISlaveInfo tosa_ssp_info = {
+    .init = tosa_ssp_init,
+    .transfer = tosa_ssp_tansfer
+};
+
 static void tosa_register_devices(void)
 {
     i2c_register_slave("tosa_dac", sizeof(TosaDACState), &tosa_dac_info);
+    ssi_register_slave("tosa-ssp", sizeof(SSISlave), &tosa_ssp_info);
 }
 
 device_init(tosa_register_devices)