Index: qemu/hw/dma.c
===================================================================
--- qemu.orig/hw/dma.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/dma.c	2007-06-01 16:42:56.000000000 +0000
@@ -383,7 +383,7 @@
 int DMA_read_memory (int nchan, void *buf, int pos, int len)
 {
     struct dma_regs *r = &dma_controllers[nchan > 3].regs[nchan & 3];
-    target_ulong addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
+    target_phys_addr_t addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
 
     if (r->mode & 0x20) {
         int i;
@@ -405,7 +405,7 @@
 int DMA_write_memory (int nchan, void *buf, int pos, int len)
 {
     struct dma_regs *r = &dma_controllers[nchan > 3].regs[nchan & 3];
-    target_ulong addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
+    target_phys_addr_t addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR];
 
     if (r->mode & 0x20) {
         int i;
Index: qemu/hw/ds1225y.c
===================================================================
--- qemu.orig/hw/ds1225y.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/ds1225y.c	2007-06-01 16:42:56.000000000 +0000
@@ -33,7 +33,7 @@
 
 struct ds1225y_t
 {
-    target_ulong mem_base;
+    target_phys_addr_t mem_base;
     uint32_t capacity;
     const char *filename;
     QEMUFile *file;
@@ -99,7 +99,7 @@
 };
 
 /* Initialisation routine */
-ds1225y_t *ds1225y_init(target_ulong mem_base, const char *filename)
+ds1225y_t *ds1225y_init(target_phys_addr_t mem_base, const char *filename)
 {
     ds1225y_t *s;
     int mem_index1, mem_index2;
Index: qemu/hw/pckbd.c
===================================================================
--- qemu.orig/hw/pckbd.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/pckbd.c	2007-06-01 16:42:56.000000000 +0000
@@ -421,8 +421,8 @@
     &kbd_mm_writeb,
 };
 
-void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq, target_ulong base,
-                   int it_shift)
+void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
+                   target_phys_addr_t base, int it_shift)
 {
     KBDState *s = &kbd_state;
     int s_io_memory;
Index: qemu/hw/pflash_cfi02.c
===================================================================
--- qemu.orig/hw/pflash_cfi02.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/pflash_cfi02.c	2007-06-01 16:42:56.000000000 +0000
@@ -50,9 +50,9 @@
 
 struct pflash_t {
     BlockDriverState *bs;
-    target_ulong base;
-    target_ulong sector_len;
-    target_ulong total_len;
+    target_phys_addr_t base;
+    uint32_t sector_len;
+    uint32_t total_len;
     int width;
     int wcycle; /* if 0, the flash is read normally */
     int bypass;
@@ -85,9 +85,9 @@
     pfl->cmd = 0;
 }
 
-static uint32_t pflash_read (pflash_t *pfl, target_ulong offset, int width)
+static uint32_t pflash_read (pflash_t *pfl, uint32_t offset, int width)
 {
-    target_ulong boff;
+    uint32_t boff;
     uint32_t ret;
     uint8_t *p;
 
@@ -199,10 +199,10 @@
     }
 }
 
-static void pflash_write (pflash_t *pfl, target_ulong offset, uint32_t value,
+static void pflash_write (pflash_t *pfl, uint32_t offset, uint32_t value,
                           int width)
 {
-    target_ulong boff;
+    uint32_t boff;
     uint8_t *p;
     uint8_t cmd;
 
@@ -219,7 +219,7 @@
     DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d %d\n", __func__,
             offset, value, width, pfl->wcycle);
     if (pfl->wcycle == 0)
-        offset -= (target_ulong)(long)pfl->storage;
+        offset -= (uint32_t)(long)pfl->storage;
     else
         offset -= pfl->base;
         
@@ -521,14 +521,14 @@
     return ret;
 }
 
-pflash_t *pflash_register (target_ulong base, ram_addr_t off,
+pflash_t *pflash_register (target_phys_addr_t base, ram_addr_t off,
                            BlockDriverState *bs,
-                           target_ulong sector_len, int nb_blocs, int width,
+                           uint32_t sector_len, int nb_blocs, int width,
                            uint16_t id0, uint16_t id1, 
                            uint16_t id2, uint16_t id3)
 {
     pflash_t *pfl;
-    target_long total_len;
+    int32_t total_len;
 
     total_len = sector_len * nb_blocs;
     /* XXX: to be fixed */
Index: qemu/hw/serial.c
===================================================================
--- qemu.orig/hw/serial.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/serial.c	2007-06-01 16:42:56.000000000 +0000
@@ -86,7 +86,7 @@
     qemu_irq irq;
     CharDriverState *chr;
     int last_break_enable;
-    target_ulong base;
+    target_phys_addr_t base;
     int it_shift;
 };
 
@@ -423,7 +423,7 @@
     &serial_mm_writel,
 };
 
-SerialState *serial_mm_init (target_ulong base, int it_shift,
+SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
                              qemu_irq irq, CharDriverState *chr,
                              int ioregister)
 {
Index: qemu/vl.h
===================================================================
--- qemu.orig/vl.h	2007-06-01 16:42:54.000000000 +0000
+++ qemu/vl.h	2007-06-01 16:42:56.000000000 +0000
@@ -991,7 +991,7 @@
 
 /* ds1225y.c */
 typedef struct ds1225y_t ds1225y_t;
-ds1225y_t *ds1225y_init(target_ulong mem_base, const char *filename);
+ds1225y_t *ds1225y_init(target_phys_addr_t mem_base, const char *filename);
 
 /* es1370.c */
 int es1370_init (PCIBus *bus, AudioState *s);
@@ -1056,7 +1056,8 @@
 /* pckbd.c */
 
 void i8042_init(qemu_irq kbd_irq, qemu_irq mouse_irq, uint32_t io_base);
-void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq, target_ulong base, int it_shift);
+void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
+                   target_phys_addr_t base, int it_shift);
 
 /* mc146818rtc.c */
 
@@ -1071,7 +1072,7 @@
 
 typedef struct SerialState SerialState;
 SerialState *serial_init(int base, qemu_irq irq, CharDriverState *chr);
-SerialState *serial_mm_init (target_ulong base, int it_shift,
+SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
                              qemu_irq irq, CharDriverState *chr,
                              int ioregister);
 uint32_t serial_mm_readb (void *opaque, target_phys_addr_t addr);
@@ -1482,9 +1483,9 @@
 extern BlockDriverState *pflash_table[MAX_PFLASH];
 typedef struct pflash_t pflash_t;
 
-pflash_t *pflash_register (target_ulong base, ram_addr_t off,
+pflash_t *pflash_register (target_phys_addr_t base, ram_addr_t off,
                            BlockDriverState *bs,
-                           target_ulong sector_len, int nb_blocs, int width,
+                           uint32_t sector_len, int nb_blocs, int width,
                            uint16_t id0, uint16_t id1, 
                            uint16_t id2, uint16_t id3);
 
Index: qemu/hw/ppc405.h
===================================================================
--- qemu.orig/hw/ppc405.h	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/ppc405.h	2007-06-01 16:42:56.000000000 +0000
@@ -83,7 +83,8 @@
                        uint32_t dcr_base, int has_ssr, int has_vr);
 /* SDRAM controller */
 void ppc405_sdram_init (CPUState *env, qemu_irq irq, int nbanks,
-                        target_ulong *ram_bases, target_ulong *ram_sizes,
+                        target_phys_addr_t *ram_bases,
+                        target_phys_addr_t *ram_sizes,
                         int do_init);
 /* Peripheral controller */
 void ppc405_ebc_init (CPUState *env);
@@ -107,15 +108,17 @@
 /* Memory access layer */
 void ppc405_mal_init (CPUState *env, qemu_irq irqs[4]);
 /* PowerPC 405 microcontrollers */
-CPUState *ppc405cr_init (target_ulong ram_bases[4], target_ulong ram_sizes[4],
+CPUState *ppc405cr_init (target_phys_addr_t ram_bases[4],
+                         target_phys_addr_t ram_sizes[4],
                          uint32_t sysclk, qemu_irq **picp,
                          ram_addr_t *offsetp, int do_init);
-CPUState *ppc405ep_init (target_ulong ram_bases[2], target_ulong ram_sizes[2],
+CPUState *ppc405ep_init (target_phys_addr_t ram_bases[2],
+                         target_phys_addr_t ram_sizes[2],
                          uint32_t sysclk, qemu_irq **picp,
                          ram_addr_t *offsetp, int do_init);
 /* IBM STBxxx microcontrollers */
-CPUState *ppc_stb025_init (target_ulong ram_bases[2],
-                           target_ulong ram_sizes[2],
+CPUState *ppc_stb025_init (target_phys_addr_t ram_bases[2],
+                           target_phys_addr_t ram_sizes[2],
                            uint32_t sysclk, qemu_irq **picp,
                            ram_addr_t *offsetp);
 
Index: qemu/hw/ppc405_boards.c
===================================================================
--- qemu.orig/hw/ppc405_boards.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/ppc405_boards.c	2007-06-01 16:42:56.000000000 +0000
@@ -184,7 +184,7 @@
     CPUPPCState *env;
     qemu_irq *pic;
     ram_addr_t sram_offset, bios_offset, bdloc;
-    target_ulong ram_bases[2], ram_sizes[2];
+    target_phys_addr_t ram_bases[2], ram_sizes[2];
     target_ulong sram_size, bios_size;
     //int phy_addr = 0;
     //static int phy_addr = 1;
@@ -506,7 +506,7 @@
     CPUPPCState *env;
     qemu_irq *pic;
     ram_addr_t bios_offset;
-    target_ulong ram_bases[2], ram_sizes[2];
+    target_phys_addr_t ram_bases[2], ram_sizes[2];
     target_ulong bios_size;
     target_ulong kernel_base, kernel_size, initrd_base, initrd_size;
     int linux_boot;
Index: qemu/hw/ppc405_uc.c
===================================================================
--- qemu.orig/hw/ppc405_uc.c	2007-06-01 16:42:01.000000000 +0000
+++ qemu/hw/ppc405_uc.c	2007-06-01 16:42:56.000000000 +0000
@@ -903,8 +903,8 @@
 struct ppc4xx_sdram_t {
     uint32_t addr;
     int nbanks;
-    target_ulong ram_bases[4];
-    target_ulong ram_sizes[4];
+    target_phys_addr_t ram_bases[4];
+    target_phys_addr_t ram_sizes[4];
     uint32_t besr0;
     uint32_t besr1;
     uint32_t bear;
@@ -924,7 +924,7 @@
     SDRAM0_CFGDATA = 0x011,
 };
 
-static uint32_t sdram_bcr (target_ulong ram_base, target_ulong ram_size)
+static uint32_t sdram_bcr (target_phys_addr_t ram_base, target_phys_addr_t ram_size)
 {
     uint32_t bcr;
 
@@ -960,7 +960,7 @@
     return bcr;
 }
 
-static inline target_ulong sdram_base (uint32_t bcr)
+static inline target_phys_addr_t sdram_base (uint32_t bcr)
 {
     return bcr & 0xFF800000;
 }
@@ -1206,7 +1206,8 @@
 }
 
 void ppc405_sdram_init (CPUState *env, qemu_irq irq, int nbanks,
-                        target_ulong *ram_bases, target_ulong *ram_sizes,
+                        target_phys_addr_t *ram_bases,
+                        target_phys_addr_t *ram_sizes,
                         int do_init)
 {
     ppc4xx_sdram_t *sdram;
@@ -1215,10 +1216,10 @@
     if (sdram != NULL) {
         sdram->irq = irq;
         sdram->nbanks = nbanks;
-        memset(sdram->ram_bases, 0, 4 * sizeof(target_ulong));
-        memcpy(sdram->ram_bases, ram_bases, nbanks * sizeof(target_ulong));
-        memset(sdram->ram_sizes, 0, 4 * sizeof(target_ulong));
-        memcpy(sdram->ram_sizes, ram_sizes, nbanks * sizeof(target_ulong));
+        memset(sdram->ram_bases, 0, 4 * sizeof(target_phys_addr_t));
+        memcpy(sdram->ram_bases, ram_bases, nbanks * sizeof(target_phys_addr_t));
+        memset(sdram->ram_sizes, 0, 4 * sizeof(target_phys_addr_t));
+        memcpy(sdram->ram_sizes, ram_sizes, nbanks * sizeof(target_phys_addr_t));
         sdram_reset(sdram);
         qemu_register_reset(&sdram_reset, sdram);
         ppc_dcr_register(env, SDRAM0_CFGADDR,
@@ -3017,7 +3018,8 @@
     }
 }
 
-CPUState *ppc405cr_init (target_ulong ram_bases[4], target_ulong ram_sizes[4],
+CPUState *ppc405cr_init (target_phys_addr_t ram_bases[4],
+                         target_phys_addr_t ram_sizes[4],
                          uint32_t sysclk, qemu_irq **picp,
                          ram_addr_t *offsetp, int do_init)
 {
@@ -3365,7 +3367,8 @@
     }
 }
 
-CPUState *ppc405ep_init (target_ulong ram_bases[2], target_ulong ram_sizes[2],
+CPUState *ppc405ep_init (target_phys_addr_t ram_bases[2],
+                         target_phys_addr_t ram_sizes[2],
                          uint32_t sysclk, qemu_irq **picp,
                          ram_addr_t *offsetp, int do_init)
 {