diff --git a/cpu-all.h b/cpu-all.h
index 366f47e..f2f8aac 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -906,6 +906,8 @@
 ram_addr_t cpu_get_physical_page_desc(target_phys_addr_t addr);
 ram_addr_t qemu_ram_alloc(ram_addr_t);
 void qemu_ram_free(ram_addr_t addr);
+/* This should only be used for ram local to a device.  */
+void *qemu_get_ram_ptr(ram_addr_t addr);
 int cpu_register_io_memory(int io_index,
                            CPUReadMemoryFunc **mem_read,
                            CPUWriteMemoryFunc **mem_write,
diff --git a/exec.c b/exec.c
index b41edef..9671199 100644
--- a/exec.c
+++ b/exec.c
@@ -2427,6 +2427,14 @@
 {
 }
 
+/* Return a host pointer to ram allocated with qemu_ram_alloc.
+   This may only be used if you actually allocated the ram, and
+   aready know how but the ram block is.  */
+void *qemu_get_ram_ptr(ram_addr_t addr)
+{
+    return phys_ram_base + addr;
+}
+
 static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
 {
 #ifdef DEBUG_UNASSIGNED
diff --git a/hw/sun4m.c b/hw/sun4m.c
index 9b3bab1..a459055 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -382,7 +382,7 @@
     qemu_irq *esp_reset, *le_reset;
     qemu_irq *fdc_tc;
     qemu_irq *cpu_halt;
-    ram_addr_t ram_offset, prom_offset, tcx_offset, idreg_offset;
+    ram_addr_t ram_offset, prom_offset, idreg_offset;
     unsigned long kernel_size;
     int ret;
     char buf[1024];
@@ -478,9 +478,8 @@
         fprintf(stderr, "qemu: Unsupported depth: %d\n", graphic_depth);
         exit (1);
     }
-    tcx_offset = qemu_ram_alloc(hwdef->vram_size);
-    tcx_init(hwdef->tcx_base, phys_ram_base + tcx_offset, tcx_offset,
-             hwdef->vram_size, graphic_width, graphic_height, graphic_depth);
+    tcx_init(hwdef->tcx_base, hwdef->vram_size, graphic_width, graphic_height,
+             graphic_depth);
 
     lance_init(&nd_table[0], hwdef->le_base, ledma, *ledma_irq, le_reset);
 
@@ -1183,7 +1182,7 @@
     qemu_irq *cpu_irqs[MAX_CPUS], *sbi_irq, *sbi_cpu_irq,
         *espdma_irq, *ledma_irq;
     qemu_irq *esp_reset, *le_reset;
-    ram_addr_t ram_offset, prom_offset, tcx_offset;
+    ram_addr_t ram_offset, prom_offset;
     unsigned long kernel_size;
     int ret;
     char buf[1024];
@@ -1264,9 +1263,8 @@
         fprintf(stderr, "qemu: Unsupported depth: %d\n", graphic_depth);
         exit (1);
     }
-    tcx_offset = qemu_ram_alloc(hwdef->vram_size);
-    tcx_init(hwdef->tcx_base, phys_ram_base + tcx_offset, tcx_offset,
-             hwdef->vram_size, graphic_width, graphic_height, graphic_depth);
+    tcx_init(hwdef->tcx_base, hwdef->vram_size, graphic_width, graphic_height,
+             graphic_depth);
 
     lance_init(&nd_table[0], hwdef->le_base, ledma, *ledma_irq, le_reset);
 
@@ -1409,7 +1407,7 @@
     qemu_irq *cpu_irqs, *slavio_irq, *espdma_irq, *ledma_irq;
     qemu_irq *esp_reset, *le_reset;
     qemu_irq *fdc_tc;
-    ram_addr_t ram_offset, prom_offset, tcx_offset;
+    ram_addr_t ram_offset, prom_offset;
     unsigned long kernel_size;
     int ret;
     char buf[1024];
@@ -1481,9 +1479,8 @@
         fprintf(stderr, "qemu: Unsupported depth: %d\n", graphic_depth);
         exit (1);
     }
-    tcx_offset = qemu_ram_alloc(hwdef->vram_size);
-    tcx_init(hwdef->tcx_base, phys_ram_base + tcx_offset, tcx_offset,
-             hwdef->vram_size, graphic_width, graphic_height, graphic_depth);
+    tcx_init(hwdef->tcx_base, hwdef->vram_size, graphic_width, graphic_height,
+             graphic_depth);
 
     lance_init(&nd_table[0], hwdef->le_base, ledma, *ledma_irq, le_reset);
 
diff --git a/hw/sun4m.h b/hw/sun4m.h
index 219aaef..726cd186 100644
--- a/hw/sun4m.h
+++ b/hw/sun4m.h
@@ -24,8 +24,7 @@
 }
 
 /* tcx.c */
-void tcx_init(target_phys_addr_t addr, uint8_t *vram_base,
-              unsigned long vram_offset, int vram_size, int width, int height,
+void tcx_init(target_phys_addr_t addr, int vram_size, int width, int height,
               int depth);
 
 /* slavio_intctl.c */
diff --git a/hw/tcx.c b/hw/tcx.c
index 4854815..4aa4b62 100644
--- a/hw/tcx.c
+++ b/hw/tcx.c
@@ -497,13 +497,17 @@
     tcx_dummy_writel,
 };
 
-void tcx_init(target_phys_addr_t addr, uint8_t *vram_base,
-              unsigned long vram_offset, int vram_size, int width, int height,
+void tcx_init(target_phys_addr_t addr, int vram_size, int width, int height,
               int depth)
 {
     TCXState *s;
     int io_memory, dummy_memory;
+    ram_addr_t vram_offset;
     int size;
+    uint8_t *vram_base;
+
+    vram_offset = qemu_ram_alloc(vram_size);
+    vram_base = qemu_get_ram_ptr(vram_offset);
 
     s = qemu_mallocz(sizeof(TCXState));
     s->addr = addr;