diff --git a/hw/apb_pci.c b/hw/apb_pci.c
index 6fa885e9ea..3ebe3207fe 100644
--- a/hw/apb_pci.c
+++ b/hw/apb_pci.c
@@ -21,6 +21,11 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
+
+/* XXX This file and most of its contests are somewhat misnamed.  The
+   Ultrasparc PCI host is called the PCI Bus Module (PBM).  The APB is
+   the secondary PCI bridge.  */
+
 #include "vl.h"
 typedef target_phys_addr_t pci_addr_t;
 #include "pci_host.h"
@@ -179,17 +184,25 @@ static CPUReadMemoryFunc *pci_apb_ioread[] = {
     &pci_apb_ioreadl,
 };
 
+/* The APB host has an IRQ line for each IRQ line of each slot.  */
 static int pci_apb_map_irq(PCIDevice *pci_dev, int irq_num)
 {
-    /* ??? As mentioned below this is probably wrong.  */
-    return irq_num;
+    return ((pci_dev->devfn & 0x18) >> 1) + irq_num;
+}
+
+static int pci_pbm_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+    int bus_offset;
+    if (pci_dev->devfn & 1)
+        bus_offset = 16;
+    else
+        bus_offset = 0;
+    return bus_offset + irq_num;
 }
 
 static void pci_apb_set_irq(void *pic, int irq_num, int level)
 {
-    /* ??? This is almost certainly wrong.  However the rest of the sun4u
-       IRQ handling is missing, as is OpenBIOS support, so it wouldn't work
-       anyway.  */
+    /* PCI IRQ map onto the first 32 INO.  */
     pic_set_irq_new(pic, irq_num, level);
 }
 
@@ -199,10 +212,12 @@ PCIBus *pci_apb_init(target_ulong special_base, target_ulong mem_base,
     APBState *s;
     PCIDevice *d;
     int pci_mem_config, pci_mem_data, apb_config, pci_ioport;
+    PCIDevice *apb;
+    PCIBus *secondary;
 
     s = qemu_mallocz(sizeof(APBState));
-    /* Ultrasparc APB main bus */
-    s->bus = pci_register_bus(pci_apb_set_irq, pci_apb_map_irq, pic, 0);
+    /* Ultrasparc PBM main bus */
+    s->bus = pci_register_bus(pci_apb_set_irq, pci_pbm_map_irq, pic, 0, 32);
 
     pci_mem_config = cpu_register_io_memory(0, pci_apb_config_read,
                                             pci_apb_config_write, s);
@@ -219,7 +234,7 @@ PCIBus *pci_apb_init(target_ulong special_base, target_ulong mem_base,
     cpu_register_physical_memory(mem_base, 0x10000000, pci_mem_data); // XXX size should be 4G-prom
 
     d = pci_register_device(s->bus, "Advanced PCI Bus", sizeof(PCIDevice), 
-                            -1, NULL, NULL);
+                            0, NULL, NULL);
     d->config[0x00] = 0x8e; // vendor_id : Sun
     d->config[0x01] = 0x10;
     d->config[0x02] = 0x00; // device_id
@@ -234,7 +249,11 @@ PCIBus *pci_apb_init(target_ulong special_base, target_ulong mem_base,
     d->config[0x0B] = 0x06; // class_base = PCI_bridge
     d->config[0x0D] = 0x10; // latency_timer
     d->config[0x0E] = 0x00; // header_type
-    return s->bus;
+
+    /* APB secondary busses */
+    secondary = pci_bridge_init(s->bus, 8, 0x108e5000, pci_apb_map_irq);
+    pci_bridge_init(s->bus, 9, 0x108e5000, pci_apb_map_irq);
+    return secondary;
 }
 
 
diff --git a/hw/grackle_pci.c b/hw/grackle_pci.c
index 8f8e5c0638..4004f9942f 100644
--- a/hw/grackle_pci.c
+++ b/hw/grackle_pci.c
@@ -92,7 +92,8 @@ PCIBus *pci_grackle_init(uint32_t base, void *pic)
     int pci_mem_config, pci_mem_data;
 
     s = qemu_mallocz(sizeof(GrackleState));
-    s->bus = pci_register_bus(pci_grackle_set_irq, pci_grackle_map_irq, pic, 0);
+    s->bus = pci_register_bus(pci_grackle_set_irq, pci_grackle_map_irq,
+                              pic, 0, 0);
 
     pci_mem_config = cpu_register_io_memory(0, pci_grackle_config_read, 
                                             pci_grackle_config_write, s);
diff --git a/hw/pci.c b/hw/pci.c
index 78f05cd90f..7c9db0e8d4 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -35,9 +35,11 @@ struct PCIBus {
     SetIRQFunc *low_set_irq;
     void *irq_opaque;
     PCIDevice *devices[256];
+    PCIDevice *parent_dev;
+    PCIBus *next;
     /* The bus IRQ state is the logical OR of the connected devices.
        Keep a count of the number of devices with raised IRQs.  */
-    int irq_count[4];
+    int irq_count[];
 };
 
 static void pci_update_mappings(PCIDevice *d);
@@ -47,19 +49,29 @@ static int pci_irq_index;
 static PCIBus *first_bus;
 
 PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
-                         void *pic, int devfn_min)
+                         void *pic, int devfn_min, int nirq)
 {
     PCIBus *bus;
-    bus = qemu_mallocz(sizeof(PCIBus));
+    bus = qemu_mallocz(sizeof(PCIBus) + (nirq * sizeof(int)));
     bus->set_irq = set_irq;
     bus->map_irq = map_irq;
     bus->irq_opaque = pic;
     bus->devfn_min = devfn_min;
-    memset(bus->irq_count, 0, sizeof(bus->irq_count));
     first_bus = bus;
     return bus;
 }
 
+PCIBus *pci_register_secondary_bus(PCIDevice *dev, pci_map_irq_fn map_irq)
+{
+    PCIBus *bus;
+    bus = qemu_mallocz(sizeof(PCIBus));
+    bus->map_irq = map_irq;
+    bus->parent_dev = dev;
+    bus->next = dev->bus->next;
+    dev->bus->next = bus;
+    return bus;
+}
+
 int pci_bus_num(PCIBus *s)
 {
     return s->bus_num;
@@ -351,7 +363,9 @@ void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len)
            addr, val, len);
 #endif
     bus_num = (addr >> 16) & 0xff;
-    if (bus_num != 0)
+    while (s && s->bus_num != bus_num)
+        s = s->next;
+    if (!s)
         return;
     pci_dev = s->devices[(addr >> 8) & 0xff];
     if (!pci_dev)
@@ -372,7 +386,9 @@ uint32_t pci_data_read(void *opaque, uint32_t addr, int len)
     uint32_t val;
 
     bus_num = (addr >> 16) & 0xff;
-    if (bus_num != 0)
+    while (s && s->bus_num != bus_num)
+        s= s->next;
+    if (!s)
         goto fail;
     pci_dev = s->devices[(addr >> 8) & 0xff];
     if (!pci_dev) {
@@ -411,11 +427,21 @@ uint32_t pci_data_read(void *opaque, uint32_t addr, int len)
 /* 0 <= irq_num <= 3. level must be 0 or 1 */
 void pci_set_irq(PCIDevice *pci_dev, int irq_num, int level)
 {
-    PCIBus *bus = pci_dev->bus;
+    PCIBus *bus;
+    int change;
+    
+    change = level - pci_dev->irq_state[irq_num];
+    if (!change)
+        return;
 
-    irq_num = bus->map_irq(pci_dev, irq_num);
-    bus->irq_count[irq_num] += level - pci_dev->irq_state[irq_num];
     pci_dev->irq_state[irq_num] = level;
+    bus = pci_dev->bus;
+    while (!bus->set_irq) {
+        irq_num = bus->map_irq(pci_dev, irq_num);
+        pci_dev = bus->parent_dev;
+        bus = pci_dev->bus;
+    }
+    bus->irq_count[irq_num] += change;
     bus->set_irq(bus->irq_opaque, irq_num, bus->irq_count[irq_num] != 0);
 }
 
@@ -465,6 +491,9 @@ static void pci_info_device(PCIDevice *d)
     if (d->config[PCI_INTERRUPT_PIN] != 0) {
         term_printf("      IRQ %d.\n", d->config[PCI_INTERRUPT_LINE]);
     }
+    if (class == 0x0604) {
+        term_printf("      BUS %d.\n", d->config[0x19]);
+    }
     for(i = 0;i < PCI_NUM_REGIONS; i++) {
         r = &d->io_regions[i];
         if (r->size != 0) {
@@ -478,14 +507,19 @@ static void pci_info_device(PCIDevice *d)
             }
         }
     }
+    if (class == 0x0604 && d->config[0x19] != 0) {
+        pci_for_each_device(d->config[0x19], pci_info_device);
+    }
 }
 
-void pci_for_each_device(void (*fn)(PCIDevice *d))
+void pci_for_each_device(int bus_num, void (*fn)(PCIDevice *d))
 {
     PCIBus *bus = first_bus;
     PCIDevice *d;
     int devfn;
     
+    while (bus && bus->bus_num != bus_num)
+        bus = bus->next;
     if (bus) {
         for(devfn = 0; devfn < 256; devfn++) {
             d = bus->devices[devfn];
@@ -497,7 +531,7 @@ void pci_for_each_device(void (*fn)(PCIDevice *d))
 
 void pci_info(void)
 {
-    pci_for_each_device(pci_info_device);
+    pci_for_each_device(0, pci_info_device);
 }
 
 /* Initialize a PCI NIC.  */
@@ -515,3 +549,50 @@ void pci_nic_init(PCIBus *bus, NICInfo *nd)
     }
 }
 
+typedef struct {
+    PCIDevice dev;
+    PCIBus *bus;
+} PCIBridge;
+
+void pci_bridge_write_config(PCIDevice *d, 
+                             uint32_t address, uint32_t val, int len)
+{
+    PCIBridge *s = (PCIBridge *)d;
+
+    if (address == 0x19 || (address == 0x18 && len > 1)) {
+        if (address == 0x19)
+            s->bus->bus_num = val & 0xff;
+        else
+            s->bus->bus_num = (val >> 8) & 0xff;
+#if defined(DEBUG_PCI)
+        printf ("pci-bridge: %s: Assigned bus %d\n", d->name, s->bus->bus_num);
+#endif
+    }
+    pci_default_write_config(d, address, val, len);
+}
+
+PCIBus *pci_bridge_init(PCIBus *bus, int devfn, uint32_t id,
+                        pci_map_irq_fn map_irq, const char *name)
+{
+    PCIBridge *s;
+    s = (PCIBridge *)pci_register_device(bus, name, sizeof(PCIBridge), 
+                                         devfn, NULL, pci_bridge_write_config);
+    s->dev.config[0x00] = id >> 16;
+    s->dev.config[0x01] = id > 24;
+    s->dev.config[0x02] = id; // device_id
+    s->dev.config[0x03] = id >> 8;
+    s->dev.config[0x04] = 0x06; // command = bus master, pci mem
+    s->dev.config[0x05] = 0x00;
+    s->dev.config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error
+    s->dev.config[0x07] = 0x00; // status = fast devsel
+    s->dev.config[0x08] = 0x00; // revision
+    s->dev.config[0x09] = 0x00; // programming i/f
+    s->dev.config[0x0A] = 0x04; // class_sub = PCI to PCI bridge
+    s->dev.config[0x0B] = 0x06; // class_base = PCI_bridge
+    s->dev.config[0x0D] = 0x10; // latency_timer
+    s->dev.config[0x0E] = 0x81; // header_type
+    s->dev.config[0x1E] = 0xa0; // secondary status
+
+    s->bus = pci_register_secondary_bus(&s->dev, map_irq);
+    return s->bus;
+}
diff --git a/hw/piix_pci.c b/hw/piix_pci.c
index 939521c7bb..d618f00623 100644
--- a/hw/piix_pci.c
+++ b/hw/piix_pci.c
@@ -59,7 +59,7 @@ PCIBus *i440fx_init(void)
     I440FXState *s;
 
     s = qemu_mallocz(sizeof(I440FXState));
-    b = pci_register_bus(piix3_set_irq, pci_slot_get_pirq, NULL, 0);
+    b = pci_register_bus(piix3_set_irq, pci_slot_get_pirq, NULL, 0, 4);
     s->bus = b;
 
     register_ioport_write(0xcf8, 4, 4, i440fx_addr_writel, s);
@@ -226,6 +226,7 @@ static uint32_t pci_bios_io_addr;
 static uint32_t pci_bios_mem_addr;
 /* host irqs corresponding to PCI irqs A-D */
 static uint8_t pci_irqs[4] = { 11, 9, 11, 9 };
+static int pci_bios_next_bus;
 
 static void pci_config_writel(PCIDevice *d, uint32_t addr, uint32_t val)
 {
@@ -320,6 +321,14 @@ static void pci_bios_init_device(PCIDevice *d)
             pci_set_io_region_addr(d, 3, 0x374);
         }
         break;
+    case 0x0604:
+        /* PCI to PCI bridge.  Assign bus ID and recurse to configure
+           devices on the secondary bus.  */
+        i = pci_bios_next_bus++;
+        pci_config_writeb(d, 0x18, pci_bus_num(d->bus));
+        pci_config_writeb(d, 0x19, i);
+        pci_for_each_device(i, pci_bios_init_device);
+        break;
     case 0x0300:
         if (vendor_id != 0x1234)
             goto default_map;
@@ -398,6 +407,7 @@ void pci_bios_init(void)
     isa_outb(elcr[0], 0x4d0);
     isa_outb(elcr[1], 0x4d1);
 
-    pci_for_each_device(pci_bios_init_device);
+    pci_bios_next_bus = 1;
+    pci_for_each_device(0, pci_bios_init_device);
 }
 
diff --git a/hw/prep_pci.c b/hw/prep_pci.c
index b5ff8eb0ff..3d93c065ff 100644
--- a/hw/prep_pci.c
+++ b/hw/prep_pci.c
@@ -120,18 +120,12 @@ static CPUReadMemoryFunc *PPC_PCIIO_read[] = {
 /* Don't know if this matches real hardware, but it agrees with OHW.  */
 static int prep_map_irq(PCIDevice *pci_dev, int irq_num)
 {
-    return (irq_num + (pci_dev->devfn >> 3)) & 3;
+    return (irq_num + (pci_dev->devfn >> 3)) & 1;
 }
 
-static int prep_irq_levels[4];
-
 static void prep_set_irq(void *pic, int irq_num, int level)
 {
-    int pic_irq_num;
-    prep_irq_levels[irq_num] = level;
-    level |= prep_irq_levels[irq_num ^ 2];
-    pic_irq_num = (irq_num == 0 || irq_num == 2) ? 9 : 11;
-    pic_set_irq(pic_irq_num, level);
+    pic_set_irq(irq_num ? 11 : 9, level);
 }
 
 PCIBus *pci_prep_init(void)
@@ -141,7 +135,7 @@ PCIBus *pci_prep_init(void)
     int PPC_io_memory;
 
     s = qemu_mallocz(sizeof(PREPPCIState));
-    s->bus = pci_register_bus(prep_set_irq, prep_map_irq, NULL, 0);
+    s->bus = pci_register_bus(prep_set_irq, prep_map_irq, NULL, 0, 2);
 
     register_ioport_write(0xcf8, 4, 4, pci_prep_addr_writel, s);
     register_ioport_read(0xcf8, 4, 4, pci_prep_addr_readl, s);
diff --git a/hw/unin_pci.c b/hw/unin_pci.c
index d132d6ec2e..e47f4b3ac0 100644
--- a/hw/unin_pci.c
+++ b/hw/unin_pci.c
@@ -161,7 +161,7 @@ PCIBus *pci_pmac_init(void *pic)
     /* Uninorth main bus */
     s = qemu_mallocz(sizeof(UNINState));
     s->bus = pci_register_bus(pci_unin_set_irq, pci_unin_map_irq,
-                              pic, 11 << 3);
+                              pic, 11 << 3, 4);
 
     pci_mem_config = cpu_register_io_memory(0, pci_unin_main_config_read, 
                                             pci_unin_main_config_write, s);
diff --git a/hw/versatile_pci.c b/hw/versatile_pci.c
index 9addda8f01..32854c2f94 100644
--- a/hw/versatile_pci.c
+++ b/hw/versatile_pci.c
@@ -11,7 +11,7 @@
 
 static inline uint32_t vpb_pci_config_addr(target_phys_addr_t addr)
 {
-    return addr & 0xf8ff;
+    return addr & 0xffffff;
 }
 
 static void pci_vpb_config_writeb (void *opaque, target_phys_addr_t addr,
@@ -105,15 +105,15 @@ PCIBus *pci_vpb_init(void *pic, int irq, int realview)
         base = 0x40000000;
         name = "Versatile/PB PCI Controller";
     }
-    s = pci_register_bus(pci_vpb_set_irq, pci_vpb_map_irq, pic, 11 << 3);
+    s = pci_register_bus(pci_vpb_set_irq, pci_vpb_map_irq, pic, 11 << 3, 4);
     /* ??? Register memory space.  */
 
     mem_config = cpu_register_io_memory(0, pci_vpb_config_read,
                                         pci_vpb_config_write, s);
     /* Selfconfig area.  */
-    cpu_register_physical_memory(base + 0x01000000, 0x10000, mem_config);
+    cpu_register_physical_memory(base + 0x01000000, 0x1000000, mem_config);
     /* Normal config area.  */
-    cpu_register_physical_memory(base + 0x02000000, 0x10000, mem_config);
+    cpu_register_physical_memory(base + 0x02000000, 0x1000000, mem_config);
 
     d = pci_register_device(s, name, sizeof(PCIDevice), -1, NULL, NULL);
 
diff --git a/vl.h b/vl.h
index 3f654f2f4a..124e7d776f 100644
--- a/vl.h
+++ b/vl.h
@@ -759,15 +759,17 @@ int pci_device_load(PCIDevice *s, QEMUFile *f);
 typedef void (*pci_set_irq_fn)(void *pic, int irq_num, int level);
 typedef int (*pci_map_irq_fn)(PCIDevice *pci_dev, int irq_num);
 PCIBus *pci_register_bus(pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
-                         void *pic, int devfn_min);
+                         void *pic, int devfn_min, int nirq);
 
 void pci_nic_init(PCIBus *bus, NICInfo *nd);
 void pci_data_write(void *opaque, uint32_t addr, uint32_t val, int len);
 uint32_t pci_data_read(void *opaque, uint32_t addr, int len);
 int pci_bus_num(PCIBus *s);
-void pci_for_each_device(void (*fn)(PCIDevice *d));
+void pci_for_each_device(int bus_num, void (*fn)(PCIDevice *d));
 
 void pci_info(void);
+PCIBus *pci_bridge_init(PCIBus *bus, int devfn, uint32_t id,
+                        pci_map_irq_fn map_irq, const char *name);
 
 /* prep_pci.c */
 PCIBus *pci_prep_init(void);