Index: ioemu/hw/pci.c
===================================================================
--- ioemu.orig/hw/pci.c	2007-05-03 15:20:35.000000000 +0100
+++ ioemu/hw/pci.c	2007-05-03 15:20:43.000000000 +0100
@@ -289,6 +289,7 @@
             case 0x0b:
             case 0x0e:
             case 0x10 ... 0x27: /* base */
+            case 0x2c ... 0x2f: /* subsystem vendor id, subsystem id */
             case 0x30 ... 0x33: /* rom */
             case 0x3d:
                 can_write = 0;
@@ -321,6 +322,18 @@
             break;
         }
         if (can_write) {
+            if( addr == 0x05 ) {
+                /* In Command Register, bits 15:11 are reserved */
+                val &= 0x07; 
+            } else if ( addr == 0x06 ) {
+                /* In Status Register, bits 6, 2:0 are reserved, */
+                /* and bits 7,5,4,3 are read only */
+                val = d->config[addr];
+            } else if ( addr == 0x07 ) {
+                /* In Status Register, bits 10,9 are reserved, */
+                val = (val & ~0x06) | (d->config[addr] & 0x06);
+            }
+
             d->config[addr] = val;
         }
         addr++;
Index: ioemu/hw/rtl8139.c
===================================================================
--- ioemu.orig/hw/rtl8139.c	2007-05-03 15:20:35.000000000 +0100
+++ ioemu/hw/rtl8139.c	2007-05-03 15:20:43.000000000 +0100
@@ -3424,6 +3424,8 @@
     pci_conf[0x0e] = 0x00; /* header_type */
     pci_conf[0x3d] = 1;    /* interrupt pin 0 */
     pci_conf[0x34] = 0xdc;
+    pci_conf[0x2c] = pci_conf[0x00]; // same as Vendor ID
+    pci_conf[0x2d] = pci_conf[0x01];
 
     s = &d->rtl8139;
 
Index: ioemu/hw/usb-uhci.c
===================================================================
--- ioemu.orig/hw/usb-uhci.c	2007-05-03 15:20:35.000000000 +0100
+++ ioemu/hw/usb-uhci.c	2007-05-03 15:20:43.000000000 +0100
@@ -704,6 +704,8 @@
     pci_conf[0x0e] = 0x00; // header_type
     pci_conf[0x3d] = 4; // interrupt pin 3
     pci_conf[0x60] = 0x10; // release number
+    pci_conf[0x2c] = pci_conf[0x00]; // same as Vendor ID
+    pci_conf[0x2d] = pci_conf[0x01];
     
     for(i = 0; i < NB_PORTS; i++) {
         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
Index: ioemu/vl.h
===================================================================
--- ioemu.orig/vl.h	2007-05-03 15:20:43.000000000 +0100
+++ ioemu/vl.h	2007-05-03 15:20:43.000000000 +0100
@@ -650,8 +650,11 @@
 #define PCI_MAX_LAT		0x3f	/* 8 bits */
 
 struct PCIDevice {
-    /* PCI config space */
-    uint8_t config[256];
+    /*
+     * PCI config space. The 4 extra bytes are a safety buffer for guest
+     * word/dword writes that can extend past byte 0xff.
+     */
+    uint8_t config[256+4];
 
     /* the following fields are read only */
     PCIBus *bus;
