diff --git a/hw/virtio-9p-local.c b/hw/virtio-9p-local.c
index 204437c..9752f76 100644
--- a/hw/virtio-9p-local.c
+++ b/hw/virtio-9p-local.c
@@ -72,9 +72,16 @@ static int local_setuid(void *opaque, uid_t uid)
     return 0;
 }
 
+static ssize_t local_readlink(void *opaque, const char *path,
+			      char *buf, size_t bufsz)
+{
+    return readlink(rpath(path), buf, bufsz);
+}
+
 static V9fsPosixFileOperations ops = {
     .lstat = local_lstat,
     .setuid = local_setuid,
+    .readlink = local_readlink,
 };
 
 V9fsPosixFileOperations *virtio_9p_init_local(const char *path)
diff --git a/hw/virtio-9p.c b/hw/virtio-9p.c
index c63ac80..10bcd89 100644
--- a/hw/virtio-9p.c
+++ b/hw/virtio-9p.c
@@ -102,6 +102,21 @@ static int posix_setuid(V9fsState *s, uid_t uid)
     return s->ops->setuid(s->ops->opaque, uid);
 }
 
+static ssize_t posix_readlink(V9fsState *s, V9fsString *path, V9fsString *buf)
+{
+    ssize_t len;
+
+    buf->data = qemu_malloc(1024);
+
+    len = s->ops->readlink(s->ops->opaque, path->data, buf->data, 1024 - 1);
+    if (len > -1) {
+	buf->size = len;
+	buf->data[len] = 0;
+    }
+
+    return len;
+}
+
 static void v9fs_string_free(V9fsString *str)
 {
     free(str->data);
@@ -109,6 +124,11 @@ static void v9fs_string_free(V9fsString *str)
     str->size = 0;
 }
 
+static void v9fs_string_null(V9fsString *str)
+{
+    v9fs_string_free(str);
+}
+
 static void v9fs_string_sprintf(V9fsString *str, const char *fmt, ...)
 {
     va_list ap;
@@ -124,6 +144,11 @@ static void v9fs_string_sprintf(V9fsString *str, const char *fmt, ...)
     str->size = err;
 }
 
+static size_t v9fs_string_size(V9fsString *str)
+{
+    return str->size;
+}
+
 static V9fsFidState *lookup_fid(V9fsState *s, int32_t fid)
 {
     V9fsFidState *f;
@@ -436,6 +461,15 @@ static size_t pdu_marshal(V9fsPDU *pdu, size_t offset, const char *fmt, ...)
     return offset - old_offset;
 }
 
+static void v9fs_stat_free(V9fsStat *stat)
+{
+    v9fs_string_free(&stat->name);
+    v9fs_string_free(&stat->uid);
+    v9fs_string_free(&stat->gid);
+    v9fs_string_free(&stat->muid);
+    v9fs_string_free(&stat->extension);
+}
+
 static void complete_pdu(V9fsState *s, V9fsPDU *pdu, ssize_t len)
 {
     int8_t id = pdu->id + 1; /* Response */
@@ -474,6 +508,88 @@ static void complete_pdu(V9fsState *s, V9fsPDU *pdu, ssize_t len)
     free_pdu(s, pdu);
 }
 
+static uint32_t stat_to_v9mode(const struct stat *stbuf)
+{
+    uint32_t mode;
+
+    mode = stbuf->st_mode & 0777;
+    if (S_ISDIR(stbuf->st_mode))
+	mode |= P9_STAT_MODE_DIR;
+
+    if (dotu) {
+	if (S_ISLNK(stbuf->st_mode))
+	    mode |= P9_STAT_MODE_SYMLINK;
+	if (S_ISSOCK(stbuf->st_mode))
+	    mode |= P9_STAT_MODE_SOCKET;
+	if (S_ISFIFO(stbuf->st_mode))
+	    mode |= P9_STAT_MODE_NAMED_PIPE;
+	if (S_ISBLK(stbuf->st_mode) || S_ISCHR(stbuf->st_mode))
+	    mode |= P9_STAT_MODE_DEVICE;
+	if (stbuf->st_mode & S_ISUID)
+	    mode |= P9_STAT_MODE_SETUID;
+	if (stbuf->st_mode & S_ISGID)
+	    mode |= P9_STAT_MODE_SETGID;
+	if (stbuf->st_mode & S_ISVTX)
+	    mode |= P9_STAT_MODE_SETVTX;
+    }
+
+    return mode;
+}
+
+static void stat_to_v9stat(V9fsState *s, V9fsString *name,
+			   const struct stat *stbuf,
+			   V9fsStat *v9stat)
+{
+    int err;
+    const char *str;
+
+    memset(v9stat, 0, sizeof(*v9stat));
+
+    stat_to_qid(stbuf, &v9stat->qid);
+    v9stat->mode = stat_to_v9mode(stbuf);
+    v9stat->atime = stbuf->st_atime;
+    v9stat->mtime = stbuf->st_mtime;
+    v9stat->length = stbuf->st_size;
+
+    v9fs_string_null(&v9stat->uid);
+    v9fs_string_null(&v9stat->gid);
+    v9fs_string_null(&v9stat->muid);
+
+    if (dotu) {
+	v9stat->n_uid = stbuf->st_uid;
+	v9stat->n_gid = stbuf->st_gid;
+	v9stat->n_muid = 0;
+
+	v9fs_string_null(&v9stat->extension);
+
+	if (v9stat->mode & P9_STAT_MODE_SYMLINK) {
+	    err = posix_readlink(s, name, &v9stat->extension);
+	    BUG_ON(err == -1);
+	    v9stat->extension.data[err] = 0;
+	    v9stat->extension.size = err;
+	} else if (v9stat->mode & P9_STAT_MODE_DEVICE) {
+	    v9fs_string_sprintf(&v9stat->extension, "%c %u %u",
+				S_ISCHR(stbuf->st_mode) ? 'c' : 'b',
+				major(stbuf->st_rdev), minor(stbuf->st_rdev));
+	}
+    }
+
+    str = strrchr(name->data, '/');
+    if (str)
+	str += 1;
+    else
+	str = name->data;
+
+    v9fs_string_sprintf(&v9stat->name, "%s", str);
+
+    v9stat->size = 61 +
+	v9fs_string_size(&v9stat->name) +
+	v9fs_string_size(&v9stat->uid) +
+	v9fs_string_size(&v9stat->gid) +
+	v9fs_string_size(&v9stat->muid) +
+	v9fs_string_size(&v9stat->extension);
+}
+
 static void v9fs_version(V9fsState *s, V9fsPDU *pdu)
 {
     int32_t msize;
@@ -520,10 +636,59 @@ out:
     v9fs_string_free(&aname);
 }
 
+typedef struct V9fsStatState {
+    V9fsPDU *pdu;
+    size_t offset;
+    int32_t fid;
+    V9fsStat v9stat;
+    V9fsFidState *fidp;
+    struct stat stbuf;
+} V9fsStatState;
+
+static void v9fs_stat_post_lstat(V9fsState *s, V9fsStatState *vs, int err)
+{
+    if (err == -1) {
+        err = -errno;
+        goto out;
+    }
+
+    stat_to_v9stat(s, &vs->fidp->path, &vs->stbuf, &vs->v9stat);
+    vs->offset += pdu_marshal(vs->pdu, vs->offset, "wS", 0, &vs->v9stat);
+    err = vs->offset;
+
+out:
+    complete_pdu(s, vs->pdu, err);
+    v9fs_stat_free(&vs->v9stat);
+    qemu_free(vs);
+}
+
 static void v9fs_stat(V9fsState *s, V9fsPDU *pdu)
 {
-    if (debug_9p_pdu)
-	pprint_pdu(pdu);
+    V9fsStatState *vs;
+    ssize_t err = 0;
+
+    vs = qemu_malloc(sizeof(*vs));
+    vs->pdu = pdu;
+    vs->offset = 7;
+
+    memset(&vs->v9stat, 0, sizeof(vs->v9stat));
+
+    pdu_unmarshal(vs->pdu, vs->offset, "d", &vs->fid);
+
+    vs->fidp = lookup_fid(s, vs->fid);
+    if (vs->fidp == NULL) {
+	    err = -ENOENT;
+        goto out;
+    }
+
+    err = posix_lstat(s, &vs->fidp->path, &vs->stbuf);
+    v9fs_stat_post_lstat(s, vs, err);
+    return;
+
+out:
+    complete_pdu(s, vs->pdu, err);
+    v9fs_stat_free(&vs->v9stat);
+    qemu_free(vs);
 }
 
 static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)