diff --git a/hw/e1000.c b/hw/e1000.c
index 171ebe09b8..c5eb546998 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -1051,20 +1051,14 @@ pci_e1000_uninit(PCIDevice *dev)
     return 0;
 }
 
-PCIDevice *
-pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
+static void pci_e1000_init(PCIDevice *pci_dev)
 {
-    E1000State *d;
+    E1000State *d = (E1000State *)pci_dev;
     uint8_t *pci_conf;
     uint16_t checksum = 0;
     static const char info_str[] = "e1000";
     int i;
-
-    d = (E1000State *)pci_register_device(bus, "e1000",
-                sizeof(E1000State), devfn, NULL, NULL);
-
-    if (!d)
-	return NULL;
+    uint8_t macaddr[6];
 
     pci_conf = d->dev.config;
 
@@ -1089,8 +1083,9 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
 
     memmove(d->eeprom_data, e1000_eeprom_template,
         sizeof e1000_eeprom_template);
+    qdev_get_macaddr(&d->dev.qdev, macaddr);
     for (i = 0; i < 3; i++)
-        d->eeprom_data[i] = (nd->macaddr[2*i+1]<<8) | nd->macaddr[2*i];
+        d->eeprom_data[i] = (macaddr[2*i+1]<<8) | macaddr[2*i];
     for (i = 0; i < EEPROM_CHECKSUM_REG; i++)
         checksum += d->eeprom_data[i];
     checksum = (uint16_t) EEPROM_SUM - checksum;
@@ -1103,15 +1098,20 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
     d->rxbuf_min_shift = 1;
     memset(&d->tx, 0, sizeof d->tx);
 
-    d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    d->vc = qdev_get_vlan_client(&d->dev.qdev,
                                  e1000_receive, e1000_can_receive,
                                  e1000_cleanup, d);
     d->vc->link_status_changed = e1000_set_link_status;
 
-    qemu_format_nic_info_str(d->vc, nd->macaddr);
+    qemu_format_nic_info_str(d->vc, macaddr);
 
     register_savevm(info_str, -1, 2, nic_save, nic_load, d);
     d->dev.unregister = pci_e1000_uninit;
-
-    return (PCIDevice *)d;
 }
+
+static void e1000_register_devices(void)
+{
+    pci_qdev_register("e1000", sizeof(E1000State), pci_e1000_init);
+}
+
+device_init(e1000_register_devices)
diff --git a/hw/eepro100.c b/hw/eepro100.c
index 85434818ac..1689a3a60e 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1728,19 +1728,13 @@ static int pci_nic_uninit(PCIDevice *dev)
     return 0;
 }
 
-static PCIDevice *nic_init(PCIBus * bus, NICInfo * nd, uint32_t device)
+static void nic_init(PCIDevice *pci_dev, uint32_t device)
 {
-    PCIEEPRO100State *d;
+    PCIEEPRO100State *d = (PCIEEPRO100State *)pci_dev;
     EEPRO100State *s;
 
     logout("\n");
 
-    d = (PCIEEPRO100State *) pci_register_device(bus, nd->model,
-                                                 sizeof(PCIEEPRO100State), -1,
-                                                 NULL, NULL);
-    if (!d)
-        return NULL;
-
     d->dev.unregister = pci_nic_uninit;
 
     s = &d->eepro100;
@@ -1765,13 +1759,13 @@ static PCIDevice *nic_init(PCIBus * bus, NICInfo * nd, uint32_t device)
     pci_register_io_region(&d->dev, 2, PCI_FLASH_SIZE, PCI_ADDRESS_SPACE_MEM,
                            pci_mmio_map);
 
-    memcpy(s->macaddr, nd->macaddr, 6);
+    qdev_get_macaddr(&d->dev.qdev, s->macaddr);
     logout("macaddr: %s\n", nic_dump(&s->macaddr[0], 6));
     assert(s->region[1] == 0);
 
     nic_reset(s);
 
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    s->vc = qdev_get_vlan_client(&d->dev.qdev,
                                  nic_receive, nic_can_receive,
                                  nic_cleanup, s);
 
@@ -1780,22 +1774,31 @@ static PCIDevice *nic_init(PCIBus * bus, NICInfo * nd, uint32_t device)
     qemu_register_reset(nic_reset, s);
 
     register_savevm(s->vc->model, -1, 3, nic_save, nic_load, s);
-    return (PCIDevice *)d;
 }
 
-PCIDevice *pci_i82551_init(PCIBus * bus, NICInfo * nd, int devfn)
+static void pci_i82551_init(PCIDevice *dev)
 {
-    return nic_init(bus, nd, i82551);
+    nic_init(dev, i82551);
 }
 
-PCIDevice *pci_i82557b_init(PCIBus * bus, NICInfo * nd, int devfn)
+static void pci_i82557b_init(PCIDevice *dev)
 {
-    return nic_init(bus, nd, i82557B);
+    nic_init(dev, i82557B);
 }
 
-PCIDevice *pci_i82559er_init(PCIBus * bus, NICInfo * nd, int devfn)
+static void pci_i82559er_init(PCIDevice *dev)
 {
-    return nic_init(bus, nd, i82559ER);
+    nic_init(dev, i82559ER);
 }
 
-/* eof */
+static void eepro100_register_devices(void)
+{
+    pci_qdev_register("i82551", sizeof(PCIEEPRO100State),
+                      pci_i82551_init);
+    pci_qdev_register("i82557b", sizeof(PCIEEPRO100State),
+                      pci_i82557b_init);
+    pci_qdev_register("i82559er", sizeof(PCIEEPRO100State),
+                      pci_i82559er_init);
+}
+
+device_init(eepro100_register_devices)
diff --git a/hw/ne2000.c b/hw/ne2000.c
index d778cb4ca8..2af0d109b9 100644
--- a/hw/ne2000.c
+++ b/hw/ne2000.c
@@ -800,19 +800,12 @@ static void ne2000_cleanup(VLANClientState *vc)
     unregister_savevm("ne2000", s);
 }
 
-PCIDevice *pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn)
+static void pci_ne2000_init(PCIDevice *pci_dev)
 {
-    PCINE2000State *d;
+    PCINE2000State *d = (PCINE2000State *)pci_dev;
     NE2000State *s;
     uint8_t *pci_conf;
 
-    d = (PCINE2000State *)pci_register_device(bus,
-                                              "NE2000", sizeof(PCINE2000State),
-                                              devfn,
-                                              NULL, NULL);
-    if (!d)
-       return NULL;
-
     pci_conf = d->dev.config;
     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK);
     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_8029);
@@ -825,15 +818,20 @@ PCIDevice *pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn)
     s = &d->ne2000;
     s->irq = d->dev.irq[0];
     s->pci_dev = (PCIDevice *)d;
-    memcpy(s->macaddr, nd->macaddr, 6);
+    qdev_get_macaddr(&d->dev.qdev, s->macaddr);
     ne2000_reset(s);
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    s->vc = qdev_get_vlan_client(&d->dev.qdev,
                                  ne2000_receive, ne2000_can_receive,
                                  ne2000_cleanup, s);
 
     qemu_format_nic_info_str(s->vc, s->macaddr);
 
     register_savevm("ne2000", -1, 3, ne2000_save, ne2000_load, s);
-
-    return (PCIDevice *)d;
 }
+
+static void ne2000_register_devices(void)
+{
+    pci_qdev_register("ne2k_pci", sizeof(PCINE2000State), pci_ne2000_init);
+}
+
+device_init(ne2000_register_devices)
diff --git a/hw/pci.c b/hw/pci.c
index 8f067c664d..1a1a83daf0 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -799,17 +799,15 @@ static const char * const pci_nic_models[] = {
     NULL
 };
 
-typedef PCIDevice *(*PCINICInitFn)(PCIBus *, NICInfo *, int);
-
-static PCINICInitFn pci_nic_init_fns[] = {
-    pci_ne2000_init,
-    pci_i82551_init,
-    pci_i82557b_init,
-    pci_i82559er_init,
-    pci_rtl8139_init,
-    pci_e1000_init,
-    pci_pcnet_init,
-    virtio_net_init,
+static const char * const pci_nic_names[] = {
+    "ne2k_pci",
+    "i82551",
+    "i82557b",
+    "i82559er",
+    "rtl8139",
+    "e1000",
+    "pcnet",
+    "virtio_net",
     NULL
 };
 
@@ -817,18 +815,21 @@ static PCINICInitFn pci_nic_init_fns[] = {
 PCIDevice *pci_nic_init(PCIBus *bus, NICInfo *nd, int devfn,
                   const char *default_model)
 {
-    PCIDevice *pci_dev;
+    DeviceState *dev;
     int i;
 
     qemu_check_nic_model_list(nd, pci_nic_models, default_model);
 
-    for (i = 0; pci_nic_models[i]; i++)
+    for (i = 0; pci_nic_models[i]; i++) {
         if (strcmp(nd->model, pci_nic_models[i]) == 0) {
-            pci_dev = pci_nic_init_fns[i](bus, nd, devfn);
-            if (pci_dev)
-                nd->private = pci_dev;
-            return pci_dev;
+            dev = qdev_create(bus, pci_nic_names[i]);
+            qdev_set_prop_int(dev, "devfn", devfn);
+            qdev_set_netdev(dev, nd);
+            qdev_init(dev);
+            nd->private = dev;
+            return (PCIDevice *)dev;
         }
+    }
 
     return NULL;
 }
diff --git a/hw/pci.h b/hw/pci.h
index 63ceda29cc..09f9799dcd 100644
--- a/hw/pci.h
+++ b/hw/pci.h
@@ -239,26 +239,6 @@ void usb_uhci_piix4_init(PCIBus *bus, int devfn);
 /* usb-ohci.c */
 void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn);
 
-/* eepro100.c */
-
-PCIDevice *pci_i82551_init(PCIBus *bus, NICInfo *nd, int devfn);
-PCIDevice *pci_i82557b_init(PCIBus *bus, NICInfo *nd, int devfn);
-PCIDevice *pci_i82559er_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* ne2000.c */
-
-PCIDevice *pci_ne2000_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* rtl8139.c */
-
-PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* e1000.c */
-PCIDevice *pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn);
-
-/* pcnet.c */
-PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn);
-
 /* prep_pci.c */
 PCIBus *pci_prep_init(qemu_irq *pic);
 
diff --git a/hw/pcnet.c b/hw/pcnet.c
index 13f14bef0a..1f8e04b5e8 100644
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -35,7 +35,7 @@
  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR92C990.txt
  */
 
-#include "hw.h"
+#include "sysbus.h"
 #include "pci.h"
 #include "net.h"
 #include "qemu-timer.h"
@@ -60,22 +60,20 @@
 typedef struct PCNetState_st PCNetState;
 
 struct PCNetState_st {
-    PCIDevice dev;
     PCIDevice *pci_dev;
     VLANClientState *vc;
-    NICInfo *nd;
+    uint8_t macaddr[6];
     QEMUTimer *poll_timer;
-    int mmio_index, rap, isr, lnkst;
+    int rap, isr, lnkst;
     uint32_t rdra, tdra;
     uint8_t prom[16];
     uint16_t csr[128];
     uint16_t bcr[32];
     uint64_t timer;
-    int xmit_pos, recv_pos;
+    int mmio_index, xmit_pos, recv_pos;
     uint8_t buffer[4096];
     int tx_busy;
     qemu_irq irq;
-    qemu_irq *reset_irq;
     void (*phys_mem_read)(void *dma_opaque, target_phys_addr_t addr,
                          uint8_t *buf, int len, int do_bswap);
     void (*phys_mem_write)(void *dma_opaque, target_phys_addr_t addr,
@@ -84,6 +82,16 @@ struct PCNetState_st {
     int looptest;
 };
 
+typedef struct {
+    PCIDevice pci_dev;
+    PCNetState state;
+} PCIPCNetState;
+
+typedef struct {
+    SysBusDevice busdev;
+    PCNetState state;
+} SysBusPCNetState;
+
 struct qemu_ether_header {
     uint8_t ether_dhost[6];
     uint8_t ether_shost[6];
@@ -1593,8 +1601,7 @@ static void pcnet_h_reset(void *opaque)
 
     /* Initialize the PROM */
 
-    if (s->nd)
-        memcpy(s->prom, s->nd->macaddr, 6);
+    memcpy(s->prom, s->macaddr, 6);
     s->prom[12] = s->prom[13] = 0x00;
     s->prom[14] = s->prom[15] = 0x57;
 
@@ -1754,7 +1761,7 @@ static uint32_t pcnet_ioport_readl(void *opaque, uint32_t addr)
 static void pcnet_ioport_map(PCIDevice *pci_dev, int region_num,
                              uint32_t addr, uint32_t size, int type)
 {
-    PCNetState *d = (PCNetState *)pci_dev;
+    PCNetState *d = &((PCIPCNetState *)pci_dev)->state;
 
 #ifdef PCNET_DEBUG_IO
     printf("pcnet_ioport_map addr=0x%04x size=0x%04x\n", addr, size);
@@ -1938,23 +1945,17 @@ static void pcnet_common_cleanup(PCNetState *d)
     qemu_free_timer(d->poll_timer);
 }
 
-static void pcnet_common_init(PCNetState *d, NICInfo *nd, NetCleanup *cleanup)
+static void pcnet_common_init(DeviceState *dev, PCNetState *s,
+                              NetCleanup *cleanup)
 {
-    d->poll_timer = qemu_new_timer(vm_clock, pcnet_poll_timer, d);
+    s->poll_timer = qemu_new_timer(vm_clock, pcnet_poll_timer, s);
 
-    d->nd = nd;
-
-    if (nd && nd->vlan) {
-        d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
-                                     pcnet_receive, pcnet_can_receive,
-                                     cleanup, d);
-
-        qemu_format_nic_info_str(d->vc, d->nd->macaddr);
-    } else {
-        d->vc = NULL;
-    }
-    pcnet_h_reset(d);
-    register_savevm("pcnet", -1, 2, pcnet_save, pcnet_load, d);
+    qdev_get_macaddr(dev, s->macaddr);
+    s->vc = qdev_get_vlan_client(dev,
+                                 pcnet_receive, pcnet_can_receive,
+                                 cleanup, s);
+    pcnet_h_reset(s);
+    register_savevm("pcnet", -1, 2, pcnet_save, pcnet_load, s);
 }
 
 /* PCI interface */
@@ -1974,13 +1975,13 @@ static CPUReadMemoryFunc *pcnet_mmio_read[] = {
 static void pcnet_mmio_map(PCIDevice *pci_dev, int region_num,
                             uint32_t addr, uint32_t size, int type)
 {
-    PCNetState *d = (PCNetState *)pci_dev;
+    PCIPCNetState *d = (PCIPCNetState *)pci_dev;
 
 #ifdef PCNET_DEBUG_IO
     printf("pcnet_mmio_map addr=0x%08x 0x%08x\n", addr, size);
 #endif
 
-    cpu_register_physical_memory(addr, PCNET_PNPMMIO_SIZE, d->mmio_index);
+    cpu_register_physical_memory(addr, PCNET_PNPMMIO_SIZE, d->state.mmio_index);
 }
 
 static void pci_physical_memory_write(void *dma_opaque, target_phys_addr_t addr,
@@ -2004,16 +2005,17 @@ static void pci_pcnet_cleanup(VLANClientState *vc)
 
 static int pci_pcnet_uninit(PCIDevice *dev)
 {
-    PCNetState *d = (PCNetState *)dev;
+    PCIPCNetState *d = (PCIPCNetState *)dev;
 
-    cpu_unregister_io_memory(d->mmio_index);
+    cpu_unregister_io_memory(d->state.mmio_index);
 
     return 0;
 }
 
-PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
+static void pci_pcnet_init(PCIDevice *pci_dev)
 {
-    PCNetState *d;
+    PCIPCNetState *d = (PCIPCNetState *)pci_dev;
+    PCNetState *s = &d->state;
     uint8_t *pci_conf;
 
 #if 0
@@ -2021,14 +2023,9 @@ PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
         sizeof(struct pcnet_RMD), sizeof(struct pcnet_TMD));
 #endif
 
-    d = (PCNetState *)pci_register_device(bus, "PCNet", sizeof(PCNetState),
-                                          devfn, NULL, NULL);
-    if (!d)
-	return NULL;
+    pci_dev->unregister = pci_pcnet_uninit;
 
-    d->dev.unregister = pci_pcnet_uninit;
-
-    pci_conf = d->dev.config;
+    pci_conf = pci_dev->config;
 
     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_AMD);
     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_AMD_LANCE);
@@ -2047,8 +2044,8 @@ PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
     pci_conf[0x3f] = 0xff;
 
     /* Handler for memory-mapped I/O */
-    d->mmio_index =
-      cpu_register_io_memory(0, pcnet_mmio_read, pcnet_mmio_write, d);
+    s->mmio_index =
+      cpu_register_io_memory(0, pcnet_mmio_read, pcnet_mmio_write, &d->state);
 
     pci_register_io_region((PCIDevice *)d, 0, PCNET_IOPORT_SIZE,
                            PCI_ADDRESS_SPACE_IO, pcnet_ioport_map);
@@ -2056,14 +2053,12 @@ PCIDevice *pci_pcnet_init(PCIBus *bus, NICInfo *nd, int devfn)
     pci_register_io_region((PCIDevice *)d, 1, PCNET_PNPMMIO_SIZE,
                            PCI_ADDRESS_SPACE_MEM, pcnet_mmio_map);
 
-    d->irq = d->dev.irq[0];
-    d->phys_mem_read = pci_physical_memory_read;
-    d->phys_mem_write = pci_physical_memory_write;
-    d->pci_dev = &d->dev;
+    s->irq = pci_dev->irq[0];
+    s->phys_mem_read = pci_physical_memory_read;
+    s->phys_mem_write = pci_physical_memory_write;
+    s->pci_dev = pci_dev;
 
-    pcnet_common_init(d, nd, pci_pcnet_cleanup);
-
-    return (PCIDevice *)d;
+    pcnet_common_init(&pci_dev->qdev, s, pci_pcnet_cleanup);
 }
 
 /* SPARC32 interface */
@@ -2117,37 +2112,37 @@ static void lance_cleanup(VLANClientState *vc)
     PCNetState *d = vc->opaque;
 
     pcnet_common_cleanup(d);
-
-    qemu_free_irqs(d->reset_irq);
-
-    cpu_unregister_io_memory(d->mmio_index);
-
-    qemu_free(d);
 }
 
-void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
-                qemu_irq irq, qemu_irq *reset)
+static void lance_init(SysBusDevice *dev)
 {
-    PCNetState *d;
+    SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev);
+    PCNetState *s = &d->state;
 
-    qemu_check_nic_model(nd, "lance");
-
-    d = qemu_mallocz(sizeof(PCNetState));
-
-    d->mmio_index =
+    s->mmio_index =
         cpu_register_io_memory(0, lance_mem_read, lance_mem_write, d);
 
-    d->dma_opaque = dma_opaque;
+    s->dma_opaque = qdev_get_prop_ptr(&dev->qdev, "dma");
 
-    d->reset_irq = qemu_allocate_irqs(parent_lance_reset, d, 1);
-    *reset = *d->reset_irq;
+    qdev_init_irq_sink(&dev->qdev, parent_lance_reset, 1);
 
-    cpu_register_physical_memory(leaddr, 4, d->mmio_index);
+    sysbus_init_mmio(dev, 4, s->mmio_index);
 
-    d->irq = irq;
-    d->phys_mem_read = ledma_memory_read;
-    d->phys_mem_write = ledma_memory_write;
+    sysbus_init_irq(dev, &s->irq);
 
-    pcnet_common_init(d, nd, lance_cleanup);
+    s->phys_mem_read = ledma_memory_read;
+    s->phys_mem_write = ledma_memory_write;
+
+    pcnet_common_init(&dev->qdev, s, lance_cleanup);
 }
 #endif /* TARGET_SPARC */
+
+static void pcnet_register_devices(void)
+{
+    pci_qdev_register("pcnet", sizeof(PCIPCNetState), pci_pcnet_init);
+#if defined (TARGET_SPARC) && !defined(TARGET_SPARC64)
+    sysbus_register_dev("lance", sizeof(SysBusPCNetState), lance_init);
+#endif
+}
+
+device_init(pcnet_register_devices)
diff --git a/hw/qdev.c b/hw/qdev.c
index a97f42589c..a8de27841b 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -26,6 +26,7 @@
    inherit from a particular bus (e.g. PCI or I2C) rather than
    this API directly.  */
 
+#include "net.h"
 #include "qdev.h"
 #include "sysemu.h"
 
@@ -135,6 +136,12 @@ void qdev_set_prop_ptr(DeviceState *dev, const char *name, void *value)
     prop->value.ptr = value;
 }
 
+void qdev_set_netdev(DeviceState *dev, NICInfo *nd)
+{
+    assert(!dev->nd);
+    dev->nd = nd;
+}
+
 
 qemu_irq qdev_get_irq_sink(DeviceState *dev, int n)
 {
@@ -225,6 +232,24 @@ void qdev_connect_gpio_out(DeviceState * dev, int n, qemu_irq pin)
     dev->gpio_out[n] = pin;
 }
 
+VLANClientState *qdev_get_vlan_client(DeviceState *dev,
+                                      IOReadHandler *fd_read,
+                                      IOCanRWHandler *fd_can_read,
+                                      NetCleanup *cleanup,
+                                      void *opaque)
+{
+    NICInfo *nd = dev->nd;
+    assert(nd);
+    return qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+                                fd_read, fd_can_read, cleanup, opaque);
+}
+
+
+void qdev_get_macaddr(DeviceState *dev, uint8_t *macaddr)
+{
+    memcpy(macaddr, dev->nd->macaddr, 6);
+}
+
 static int next_block_unit[IF_COUNT];
 
 /* Get a block device.  This should only be used for single-drive devices
diff --git a/hw/qdev.h b/hw/qdev.h
index eb4ac2f6f9..210062a0af 100644
--- a/hw/qdev.h
+++ b/hw/qdev.h
@@ -24,6 +24,7 @@ struct DeviceState
     int num_gpio_in;
     qemu_irq *gpio_in;
     ChildBusList *child_bus;
+    NICInfo *nd;
 };
 
 /*** Board API.  This should go away once we have a machine config file.  ***/
@@ -34,6 +35,7 @@ void qdev_init(DeviceState *dev);
 /* Set properties between creation and init.  */
 void qdev_set_prop_int(DeviceState *dev, const char *name, int value);
 void qdev_set_prop_ptr(DeviceState *dev, const char *name, void *value);
+void qdev_set_netdev(DeviceState *dev, NICInfo *nd);
 
 qemu_irq qdev_get_irq_sink(DeviceState *dev, int n);
 qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index c0be1de829..d99f35c130 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -3441,19 +3441,12 @@ static int pci_rtl8139_uninit(PCIDevice *dev)
     return 0;
 }
 
-PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
+static void pci_rtl8139_init(PCIDevice *dev)
 {
-    PCIRTL8139State *d;
+    PCIRTL8139State *d = (PCIRTL8139State *)dev;
     RTL8139State *s;
     uint8_t *pci_conf;
 
-    d = (PCIRTL8139State *)pci_register_device(bus,
-                                              "RTL8139", sizeof(PCIRTL8139State),
-                                              devfn,
-                                              NULL, NULL);
-    if (!d)
-	return NULL;
-
     d->dev.unregister = pci_rtl8139_uninit;
 
     pci_conf = d->dev.config;
@@ -3479,9 +3472,9 @@ PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
                            PCI_ADDRESS_SPACE_MEM, rtl8139_mmio_map);
 
     s->pci_dev = (PCIDevice *)d;
-    memcpy(s->macaddr, nd->macaddr, 6);
+    qdev_get_macaddr(&dev->qdev, s->macaddr);
     rtl8139_reset(s);
-    s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
+    s->vc = qdev_get_vlan_client(&dev->qdev,
                                  rtl8139_receive, rtl8139_can_receive,
                                  rtl8139_cleanup, s);
 
@@ -3499,5 +3492,11 @@ PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
     qemu_mod_timer(s->timer,
         rtl8139_get_next_tctr_time(s,qemu_get_clock(vm_clock)));
 #endif /* RTL8139_ONBOARD_TIMER */
-    return (PCIDevice *)d;
 }
+
+static void rtl8139_register_devices(void)
+{
+    pci_qdev_register("rtl8139", sizeof(PCIRTL8139State), pci_rtl8139_init);
+}
+
+device_init(rtl8139_register_devices)
diff --git a/hw/sun4m.c b/hw/sun4m.c
index 786b731b9e..28491104f9 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-#include "hw.h"
+#include "sysbus.h"
 #include "qemu-timer.h"
 #include "sun4m.h"
 #include "nvram.h"
@@ -364,6 +364,24 @@ static unsigned long sun4m_load_kernel(const char *kernel_filename,
     return kernel_size;
 }
 
+static void lance_init(NICInfo *nd, target_phys_addr_t leaddr,
+                       void *dma_opaque, qemu_irq irq, qemu_irq *reset)
+{
+    DeviceState *dev;
+    SysBusDevice *s;
+
+    qemu_check_nic_model(&nd_table[0], "lance");
+
+    dev = qdev_create(NULL, "lance");
+    qdev_set_netdev(dev, nd);
+    qdev_set_prop_ptr(dev, "dma", dma_opaque);
+    qdev_init(dev);
+    s = sysbus_from_qdev(dev);
+    sysbus_mmio_map(s, 0, leaddr);
+    sysbus_connect_irq(s, 0, irq);
+    *reset = qdev_get_irq_sink(dev, 0);
+}
+
 static void sun4m_hw_init(const struct sun4m_hwdef *hwdef, ram_addr_t RAM_size,
                           const char *boot_device,
                           const char *kernel_filename,
diff --git a/hw/sun4m.h b/hw/sun4m.h
index 726cd18646..c5605f48d9 100644
--- a/hw/sun4m.h
+++ b/hw/sun4m.h
@@ -62,10 +62,6 @@ void cs_init(target_phys_addr_t base, int irq, void *intctl);
 /* sparc32_dma.c */
 #include "sparc32_dma.h"
 
-/* pcnet.c */
-void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,
-                qemu_irq irq, qemu_irq *reset);
-
 /* eccmemctl.c */
 void *ecc_init(target_phys_addr_t base, qemu_irq irq, uint32_t version);
 
diff --git a/net.h b/net.h
index cdf63a4b1e..41a3082ce8 100644
--- a/net.h
+++ b/net.h
@@ -127,4 +127,11 @@ void net_host_device_remove(Monitor *mon, int vlan_id, const char *device);
 #define SMBD_COMMAND "/usr/sbin/smbd"
 #endif
 
+void qdev_get_macaddr(DeviceState *dev, uint8_t *macaddr);
+VLANClientState *qdev_get_vlan_client(DeviceState *dev,
+                                      IOReadHandler *fd_read,
+                                      IOCanRWHandler *fd_can_read,
+                                      NetCleanup *cleanup,
+                                      void *opaque);
+
 #endif