diff --git a/hw/pc.c b/hw/pc.c
index 37a1172b51..c92384c125 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -507,7 +507,7 @@ static void load_linux(const char *kernel_filename,
     int setup_size, kernel_size, initrd_size, cmdline_size;
     uint32_t initrd_max;
     uint8_t header[1024];
-    uint8_t *real_addr, *prot_addr, *cmdline_addr, *initrd_addr;
+    target_phys_addr_t real_addr, prot_addr, cmdline_addr, initrd_addr;
     FILE *f, *fi;
 
     /* Align to 16 bytes as a paranoia measure */
@@ -533,19 +533,19 @@ static void load_linux(const char *kernel_filename,
 
     if (protocol < 0x200 || !(header[0x211] & 0x01)) {
 	/* Low kernel */
-	real_addr    = phys_ram_base + 0x90000;
-	cmdline_addr = phys_ram_base + 0x9a000 - cmdline_size;
-	prot_addr    = phys_ram_base + 0x10000;
+	real_addr    = 0x90000;
+	cmdline_addr = 0x9a000 - cmdline_size;
+	prot_addr    = 0x10000;
     } else if (protocol < 0x202) {
 	/* High but ancient kernel */
-	real_addr    = phys_ram_base + 0x90000;
-	cmdline_addr = phys_ram_base + 0x9a000 - cmdline_size;
-	prot_addr    = phys_ram_base + 0x100000;
+	real_addr    = 0x90000;
+	cmdline_addr = 0x9a000 - cmdline_size;
+	prot_addr    = 0x100000;
     } else {
 	/* High and recent kernel */
-	real_addr    = phys_ram_base + 0x10000;
-	cmdline_addr = phys_ram_base + 0x20000;
-	prot_addr    = phys_ram_base + 0x100000;
+	real_addr    = 0x10000;
+	cmdline_addr = 0x20000;
+	prot_addr    = 0x100000;
     }
 
 #if 0
@@ -553,9 +553,9 @@ static void load_linux(const char *kernel_filename,
 	    "qemu: real_addr     = %#zx\n"
 	    "qemu: cmdline_addr  = %#zx\n"
 	    "qemu: prot_addr     = %#zx\n",
-	    real_addr-phys_ram_base,
-	    cmdline_addr-phys_ram_base,
-	    prot_addr-phys_ram_base);
+	    real_addr,
+	    cmdline_addr,
+	    prot_addr);
 #endif
 
     /* highest address for loading the initrd */
@@ -568,10 +568,10 @@ static void load_linux(const char *kernel_filename,
 	initrd_max = ram_size-ACPI_DATA_SIZE-1;
 
     /* kernel command line */
-    pstrcpy((char*)cmdline_addr, 4096, kernel_cmdline);
+    pstrcpy_targphys(cmdline_addr, 4096, kernel_cmdline);
 
     if (protocol >= 0x202) {
-	stl_p(header+0x228, cmdline_addr-phys_ram_base);
+	stl_p(header+0x228, cmdline_addr);
     } else {
 	stw_p(header+0x20, 0xA33F);
 	stw_p(header+0x22, cmdline_addr-real_addr);
@@ -605,24 +605,24 @@ static void load_linux(const char *kernel_filename,
 	}
 
 	initrd_size = get_file_size(fi);
-	initrd_addr = phys_ram_base + ((initrd_max-initrd_size) & ~4095);
+	initrd_addr = (initrd_max-initrd_size) & ~4095;
 
 	fprintf(stderr, "qemu: loading initrd (%#x bytes) at %#zx\n",
-		initrd_size, initrd_addr-phys_ram_base);
+		initrd_size, initrd_addr);
 
-	if (fread(initrd_addr, 1, initrd_size, fi) != initrd_size) {
+	if (!fread_targphys_ok(initrd_addr, initrd_size, fi)) {
 	    fprintf(stderr, "qemu: read error on initial ram disk '%s'\n",
 		    initrd_filename);
 	    exit(1);
 	}
 	fclose(fi);
 
-	stl_p(header+0x218, initrd_addr-phys_ram_base);
+	stl_p(header+0x218, initrd_addr);
 	stl_p(header+0x21c, initrd_size);
     }
 
     /* store the finalized header and load the rest of the kernel */
-    memcpy(real_addr, header, 1024);
+    cpu_physical_memory_write(real_addr, header, 1024);
 
     setup_size = header[0x1f1];
     if (setup_size == 0)
@@ -631,8 +631,8 @@ static void load_linux(const char *kernel_filename,
     setup_size = (setup_size+1)*512;
     kernel_size -= setup_size;	/* Size of protected-mode code */
 
-    if (fread(real_addr+1024, 1, setup_size-1024, f) != setup_size-1024 ||
-	fread(prot_addr, 1, kernel_size, f) != kernel_size) {
+    if (!fread_targphys_ok(real_addr+1024, setup_size-1024, f) ||
+	!fread_targphys_ok(prot_addr, kernel_size, f)) {
 	fprintf(stderr, "qemu: read error on kernel '%s'\n",
 		kernel_filename);
 	exit(1);
@@ -640,7 +640,7 @@ static void load_linux(const char *kernel_filename,
     fclose(f);
 
     /* generate bootsector to set up the initial register state */
-    real_seg = (real_addr-phys_ram_base) >> 4;
+    real_seg = real_addr >> 4;
     seg[0] = seg[2] = seg[3] = seg[4] = seg[4] = real_seg;
     seg[1] = real_seg+0x20;	/* CS */
     memset(gpr, 0, sizeof gpr);