diff --git a/arch/x86/cpu/qemu/Makefile b/arch/x86/cpu/qemu/Makefile
index 3f3958a..ad424ec 100644
--- a/arch/x86/cpu/qemu/Makefile
+++ b/arch/x86/cpu/qemu/Makefile
@@ -7,5 +7,5 @@
 ifndef CONFIG_EFI_STUB
 obj-y += car.o dram.o
 endif
-obj-y += qemu.o
+obj-y += qemu.o fw_cfg.o
 obj-$(CONFIG_GENERATE_ACPI_TABLE) += acpi.o dsdt.o
diff --git a/arch/x86/cpu/qemu/fw_cfg.c b/arch/x86/cpu/qemu/fw_cfg.c
new file mode 100644
index 0000000..5f5cc68
--- /dev/null
+++ b/arch/x86/cpu/qemu/fw_cfg.c
@@ -0,0 +1,241 @@
+/*
+ * (C) Copyright 2015 Miao Yan <yanmiaoebst@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <command.h>
+#include <errno.h>
+#include <malloc.h>
+#include <asm/io.h>
+#include "fw_cfg.h"
+
+static bool fwcfg_present;
+static bool fwcfg_dma_present;
+
+static void qemu_fwcfg_read_entry_pio(uint16_t entry,
+		uint32_t size, void *address)
+{
+	uint32_t i = 0;
+	uint8_t *data = address;
+
+	if (entry != FW_CFG_INVALID)
+		outw(entry, FW_CONTROL_PORT);
+	while (size--)
+		data[i++] = inb(FW_DATA_PORT);
+}
+
+static void qemu_fwcfg_read_entry_dma(uint16_t entry,
+		uint32_t size, void *address)
+{
+	struct fw_cfg_dma_access dma;
+
+	dma.length = cpu_to_be32(size);
+	dma.address = cpu_to_be64((uintptr_t)address);
+	dma.control = cpu_to_be32(FW_CFG_DMA_READ);
+	if (entry != FW_CFG_INVALID)
+		dma.control |= cpu_to_be32(FW_CFG_DMA_SELECT | (entry << 16));
+
+	barrier();
+
+	debug("qemu_fwcfg_dma_read_entry: addr %p, length %u control 0x%x\n",
+	      address, size, be32_to_cpu(dma.control));
+
+	outl(cpu_to_be32((uint32_t)&dma), FW_DMA_PORT_HIGH);
+
+	while (dma.control & ~FW_CFG_DMA_ERROR)
+		__asm__ __volatile__ ("pause");
+}
+
+static bool qemu_fwcfg_present(void)
+{
+	uint32_t qemu;
+
+	qemu_fwcfg_read_entry_pio(FW_CFG_SIGNATURE, 4, &qemu);
+	return be32_to_cpu(qemu) == QEMU_FW_CFG_SIGNATURE;
+}
+
+static bool qemu_fwcfg_dma_present(void)
+{
+	uint8_t dma_enabled;
+
+	qemu_fwcfg_read_entry_pio(FW_CFG_ID, 1, &dma_enabled);
+	if (dma_enabled & FW_CFG_DMA_ENABLED)
+		return 1;
+
+	return 0;
+}
+
+static void qemu_fwcfg_read_entry(uint16_t entry,
+		uint32_t length, void *address)
+{
+	if (fwcfg_dma_present)
+		qemu_fwcfg_read_entry_dma(entry, length, address);
+	else
+		qemu_fwcfg_read_entry_pio(entry, length, address);
+}
+
+int qemu_fwcfg_online_cpus(void)
+{
+	uint16_t nb_cpus;
+
+	if (!fwcfg_present)
+		return 1;
+
+	qemu_fwcfg_read_entry(FW_CFG_NB_CPUS, 2, &nb_cpus);
+
+	return le16_to_cpu(nb_cpus);
+}
+
+static int qemu_fwcfg_setup_kernel(void *load_addr)
+{
+	char *data_addr;
+	uint32_t setup_size, kernel_size, cmdline_size, initrd_size;
+
+	qemu_fwcfg_read_entry(FW_CFG_SETUP_SIZE, 4, &setup_size);
+	qemu_fwcfg_read_entry(FW_CFG_KERNEL_SIZE, 4, &kernel_size);
+
+	if (setup_size == 0 || kernel_size == 0) {
+		printf("warning: no kernel available\n");
+		return -1;
+	}
+
+	data_addr = load_addr;
+	qemu_fwcfg_read_entry(FW_CFG_SETUP_DATA,
+			      le32_to_cpu(setup_size), data_addr);
+	data_addr += le32_to_cpu(setup_size);
+
+	qemu_fwcfg_read_entry(FW_CFG_KERNEL_DATA,
+			      le32_to_cpu(kernel_size), data_addr);
+	data_addr += le32_to_cpu(kernel_size);
+
+	qemu_fwcfg_read_entry(FW_CFG_INITRD_SIZE, 4, &initrd_size);
+	if (initrd_size == 0) {
+		printf("warning: no initrd available\n");
+	} else {
+		qemu_fwcfg_read_entry(FW_CFG_INITRD_DATA,
+				      le32_to_cpu(initrd_size), data_addr);
+		data_addr += le32_to_cpu(initrd_size);
+	}
+
+	qemu_fwcfg_read_entry(FW_CFG_CMDLINE_SIZE, 4, &cmdline_size);
+	qemu_fwcfg_read_entry(FW_CFG_CMDLINE_DATA,
+			      le32_to_cpu(cmdline_size), data_addr);
+
+	printf("loading kernel to address %p", load_addr);
+	if (initrd_size)
+		printf(" initrd %p\n",
+		       (char *)load_addr +
+		       le32_to_cpu(setup_size) +
+		       le32_to_cpu(kernel_size));
+	else
+		printf("\n");
+
+	return setenv("bootargs", data_addr);
+}
+
+static int qemu_fwcfg_list_firmware(void)
+{
+	int i;
+	uint32_t count;
+	struct fw_cfg_files *files;
+
+	qemu_fwcfg_read_entry(FW_CFG_FILE_DIR, 4, &count);
+	if (!count)
+		return 0;
+
+	count = be32_to_cpu(count);
+	files = malloc(count * sizeof(struct fw_cfg_file));
+	if (!files)
+		return -ENOMEM;
+
+	files->count = count;
+	qemu_fwcfg_read_entry(FW_CFG_INVALID,
+			      count * sizeof(struct fw_cfg_file),
+			      files->files);
+
+	for (i = 0; i < files->count; i++)
+		printf("%-56s\n", files->files[i].name);
+	free(files);
+	return 0;
+}
+
+void qemu_fwcfg_init(void)
+{
+	fwcfg_present = qemu_fwcfg_present();
+	if (fwcfg_present)
+		fwcfg_dma_present = qemu_fwcfg_dma_present();
+}
+
+static int qemu_fwcfg_do_list(cmd_tbl_t *cmdtp, int flag,
+		int argc, char * const argv[])
+{
+	qemu_fwcfg_list_firmware();
+
+	return 0;
+}
+
+static int qemu_fwcfg_do_cpus(cmd_tbl_t *cmdtp, int flag,
+		int argc, char * const argv[])
+{
+	printf("%u cpu(s) online\n", qemu_fwcfg_online_cpus());
+
+	return 0;
+}
+
+static int qemu_fwcfg_do_load(cmd_tbl_t *cmdtp, int flag,
+		int argc, char * const argv[])
+{
+	void *load_addr;
+
+	if (argc == 3) {
+		load_addr = (void *)simple_strtoul(argv[2], NULL, 16);
+	} else {
+		load_addr = getenv("loadaddr");
+		if (!load_addr)
+			load_addr = (void *)CONFIG_SYS_LOAD_ADDR;
+		else
+			load_addr = (void *)simple_strtoul(load_addr,
+							   NULL, 16);
+	}
+
+	return qemu_fwcfg_setup_kernel(load_addr);
+}
+
+static cmd_tbl_t fwcfg_commands[] = {
+	U_BOOT_CMD_MKENT(list, 0, 1, qemu_fwcfg_do_list, "", ""),
+	U_BOOT_CMD_MKENT(cpus, 0, 1, qemu_fwcfg_do_cpus, "", ""),
+	U_BOOT_CMD_MKENT(load, 1, 1, qemu_fwcfg_do_load, "", ""),
+};
+
+int do_qemu_fw(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+	int ret;
+	cmd_tbl_t *fwcfg_cmd;
+
+	if (!fwcfg_present) {
+		printf("QEMU fw_cfg interface not found\n");
+		return CMD_RET_USAGE;
+	}
+
+	fwcfg_cmd = find_cmd_tbl(argv[1], fwcfg_commands,
+			         ARRAY_SIZE(fwcfg_commands));
+	argc -= 3;
+	argv += 3;
+	if (!fwcfg_cmd || argc > fwcfg_cmd->maxargs)
+		return CMD_RET_USAGE;
+
+	ret = fwcfg_cmd->cmd(fwcfg_cmd, flag, argc, argv);
+
+	return cmd_process_error(fwcfg_cmd, ret);
+}
+
+U_BOOT_CMD(
+	fw,	3,	1,	do_qemu_fw,
+	"QEMU firmware interface",
+	"<command>\n"
+	"    - list        : print firmware(s) currently loaded\n"
+	"    - cpus        : print online cpu number\n"
+	"    - load <addr> : load kernel (if any) to address <addr>, and setup for zboot\n"
+)
diff --git a/arch/x86/cpu/qemu/fw_cfg.h b/arch/x86/cpu/qemu/fw_cfg.h
new file mode 100644
index 0000000..f3d06d1
--- /dev/null
+++ b/arch/x86/cpu/qemu/fw_cfg.h
@@ -0,0 +1,97 @@
+/*
+ * (C) Copyright 2015 Miao Yan <yanmiaobest@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#ifndef __FW_CFG__
+#define __FW_CFG__
+
+#define FW_CONTROL_PORT         0x510
+#define FW_DATA_PORT            0x511
+#define FW_DMA_PORT_LOW         0x514
+#define FW_DMA_PORT_HIGH        0x518
+
+enum qemu_fwcfg_items {
+	FW_CFG_SIGNATURE       = 0x00,
+	FW_CFG_ID              = 0x01,
+	FW_CFG_UUID            = 0x02,
+	FW_CFG_RAM_SIZE        = 0x03,
+	FW_CFG_NOGRAPHIC       = 0x04,
+	FW_CFG_NB_CPUS         = 0x05,
+	FW_CFG_MACHINE_ID      = 0x06,
+	FW_CFG_KERNEL_ADDR     = 0x07,
+	FW_CFG_KERNEL_SIZE     = 0x08,
+	FW_CFG_KERNEL_CMDLINE  = 0x09,
+	FW_CFG_INITRD_ADDR     = 0x0a,
+	FW_CFG_INITRD_SIZE     = 0x0b,
+	FW_CFG_BOOT_DEVICE     = 0x0c,
+	FW_CFG_NUMA            = 0x0d,
+	FW_CFG_BOOT_MENU       = 0x0e,
+	FW_CFG_MAX_CPUS        = 0x0f,
+	FW_CFG_KERNEL_ENTRY    = 0x10,
+	FW_CFG_KERNEL_DATA     = 0x11,
+	FW_CFG_INITRD_DATA     = 0x12,
+	FW_CFG_CMDLINE_ADDR    = 0x13,
+	FW_CFG_CMDLINE_SIZE    = 0x14,
+	FW_CFG_CMDLINE_DATA    = 0x15,
+	FW_CFG_SETUP_ADDR      = 0x16,
+	FW_CFG_SETUP_SIZE      = 0x17,
+	FW_CFG_SETUP_DATA      = 0x18,
+	FW_CFG_FILE_DIR        = 0x19,
+	FW_CFG_FILE_FIRST      = 0x20,
+	FW_CFG_FILE_SLOTS      = 0x10,
+	FW_CFG_WRITE_CHANNEL   = 0x4000,
+	FW_CFG_ARCH_LOCAL      = 0x8000,
+	FW_CFG_INVALID         = 0xffff,
+};
+
+#define FW_CFG_MAX_ENTRY        (FW_CFG_FILE_FIRST+FW_CFG_FILE_SLOTS)
+#define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
+
+#define FW_CFG_MAX_FILE_PATH    56
+
+#define QEMU_FW_CFG_SIGNATURE (('Q' << 24) | ('E' << 16) | ('M' << 8) | 'U')
+
+#define FW_CFG_DMA_ERROR  (0x1 << 0)
+#define FW_CFG_DMA_READ   (0x1 << 1)
+#define FW_CFG_DMA_SKIP   (0x1 << 2)
+#define FW_CFG_DMA_SELECT (0x1 << 3)
+
+#define FW_CFG_DMA_ENABLED      0x1
+
+struct fw_cfg_file {
+	__be32 size;
+	__be16 select;
+	__be16 reserved;
+	char name[FW_CFG_MAX_FILE_PATH];
+};
+
+struct fw_cfg_files {
+	__be32 count;
+	struct fw_cfg_file files[];
+};
+
+struct fw_cfg_dma_access {
+	__be32 control;
+	__be32 length;
+	__be64 address;
+};
+
+/**
+ * Initialize QEMU fw_cfg interface
+ *
+ * @retval:   None
+ */
+
+void qemu_fwcfg_init(void);
+
+/**
+ * Get system cpu number
+ *
+ * @retval:   cpu number in system
+ */
+
+int qemu_fwcfg_online_cpus(void);
+
+#endif
diff --git a/arch/x86/cpu/qemu/qemu.c b/arch/x86/cpu/qemu/qemu.c
index 1f93f72..d9ae066 100644
--- a/arch/x86/cpu/qemu/qemu.c
+++ b/arch/x86/cpu/qemu/qemu.c
@@ -11,6 +11,7 @@
 #include <asm/processor.h>
 #include <asm/arch/device.h>
 #include <asm/arch/qemu.h>
+#include "fw_cfg.h"
 
 static bool i440fx;
 
@@ -57,6 +58,8 @@ static void qemu_chipset_init(void)
 		x86_pci_write_config32(PCI_BDF(0, 0, 0), PCIEX_BAR,
 				       CONFIG_PCIE_ECAM_BASE | BAR_EN);
 	}
+
+	qemu_fwcfg_init();
 }
 
 int arch_cpu_init(void)
