diff --git a/hw/usb-ohci.c b/hw/usb-ohci.c
index 240e840..ff27024 100644
--- a/hw/usb-ohci.c
+++ b/hw/usb-ohci.c
@@ -116,6 +116,11 @@ typedef struct {
 
 } OHCIState;
 
+typedef struct {
+    PCIDevice pci_dev;
+    OHCIState state;
+} OHCIPCIState;
+
 /* Host Controller Communications Area */
 struct ohci_hcca {
     uint32_t intr[32];
@@ -427,12 +432,14 @@ static void ohci_reset(void *opaque)
 static inline int get_dwords(OHCIState *ohci,
                              uint32_t addr, uint32_t *buf, int num)
 {
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+    DMADevice *dma = &s->pci_dev.dma;
     int i;
 
     addr += ohci->localmem_base;
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
-        cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
+        dma_memory_rw(dma, addr, (uint8_t *)buf, sizeof(*buf), 0);
         *buf = le32_to_cpu(*buf);
     }
 
@@ -443,13 +450,15 @@ static inline int get_dwords(OHCIState *ohci,
 static inline int put_dwords(OHCIState *ohci,
                              uint32_t addr, uint32_t *buf, int num)
 {
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+    DMADevice *dma = &s->pci_dev.dma;
     int i;
 
     addr += ohci->localmem_base;
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
         uint32_t tmp = cpu_to_le32(*buf);
-        cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
+        dma_memory_rw(dma, addr, (uint8_t *)&tmp, sizeof(tmp), 1);
     }
 
     return 1;
@@ -459,12 +468,14 @@ static inline int put_dwords(OHCIState *ohci,
 static inline int get_words(OHCIState *ohci,
                             uint32_t addr, uint16_t *buf, int num)
 {
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+    DMADevice *dma = &s->pci_dev.dma;
     int i;
 
     addr += ohci->localmem_base;
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
-        cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
+        dma_memory_rw(dma, addr, (uint8_t *)buf, sizeof(*buf), 0);
         *buf = le16_to_cpu(*buf);
     }
 
@@ -475,13 +486,15 @@ static inline int get_words(OHCIState *ohci,
 static inline int put_words(OHCIState *ohci,
                             uint32_t addr, uint16_t *buf, int num)
 {
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+    DMADevice *dma = &s->pci_dev.dma;
     int i;
 
     addr += ohci->localmem_base;
 
     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
         uint16_t tmp = cpu_to_le16(*buf);
-        cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
+        dma_memory_rw(dma, addr, (uint8_t *)&tmp, sizeof(tmp), 1);
     }
 
     return 1;
@@ -509,8 +522,12 @@ static inline int ohci_read_iso_td(OHCIState *ohci,
 static inline int ohci_read_hcca(OHCIState *ohci,
                                  uint32_t addr, struct ohci_hcca *hcca)
 {
-    cpu_physical_memory_rw(addr + ohci->localmem_base,
-                           (uint8_t *)hcca, sizeof(*hcca), 0);
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+
+    dma_memory_rw(&s->pci_dev.dma,
+                  addr + ohci->localmem_base,
+                  (uint8_t *)hcca, sizeof(*hcca), 0);
+
     return 1;
 }
 
@@ -536,8 +553,12 @@ static inline int ohci_put_iso_td(OHCIState *ohci,
 static inline int ohci_put_hcca(OHCIState *ohci,
                                 uint32_t addr, struct ohci_hcca *hcca)
 {
-    cpu_physical_memory_rw(addr + ohci->localmem_base,
-                           (uint8_t *)hcca, sizeof(*hcca), 1);
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+
+    dma_memory_rw(&s->pci_dev.dma,
+                  addr + ohci->localmem_base,
+                  (uint8_t *)hcca, sizeof(*hcca), 1);
+
     return 1;
 }
 
@@ -545,6 +566,8 @@ static inline int ohci_put_hcca(OHCIState *ohci,
 static void ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
                          uint8_t *buf, int len, int write)
 {
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+    DMADevice *dma = &s->pci_dev.dma;
     uint32_t ptr;
     uint32_t n;
 
@@ -552,12 +575,12 @@ static void ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
     n = 0x1000 - (ptr & 0xfff);
     if (n > len)
         n = len;
-    cpu_physical_memory_rw(ptr + ohci->localmem_base, buf, n, write);
+    dma_memory_rw(dma, ptr + ohci->localmem_base, buf, n, write);
     if (n == len)
         return;
     ptr = td->be & ~0xfffu;
     buf += n;
-    cpu_physical_memory_rw(ptr + ohci->localmem_base, buf, len - n, write);
+    dma_memory_rw(dma, ptr + ohci->localmem_base, buf, len - n, write);
 }
 
 /* Read/Write the contents of an ISO TD from/to main memory.  */
@@ -565,6 +588,8 @@ static void ohci_copy_iso_td(OHCIState *ohci,
                              uint32_t start_addr, uint32_t end_addr,
                              uint8_t *buf, int len, int write)
 {
+    OHCIPCIState *s = container_of(ohci, OHCIPCIState, state);
+    DMADevice *dma = &s->pci_dev.dma;
     uint32_t ptr;
     uint32_t n;
 
@@ -572,12 +597,12 @@ static void ohci_copy_iso_td(OHCIState *ohci,
     n = 0x1000 - (ptr & 0xfff);
     if (n > len)
         n = len;
-    cpu_physical_memory_rw(ptr + ohci->localmem_base, buf, n, write);
+    dma_memory_rw(dma, ptr + ohci->localmem_base, buf, n, write);
     if (n == len)
         return;
     ptr = end_addr & ~0xfffu;
     buf += n;
-    cpu_physical_memory_rw(ptr + ohci->localmem_base, buf, len - n, write);
+    dma_memory_rw(dma, ptr + ohci->localmem_base, buf, len - n, write);
 }
 
 static void ohci_process_lists(OHCIState *ohci, int completion);
@@ -1706,11 +1731,6 @@ static void usb_ohci_init(OHCIState *ohci, DeviceState *dev,
     qemu_register_reset(ohci_reset, ohci);
 }
 
-typedef struct {
-    PCIDevice pci_dev;
-    OHCIState state;
-} OHCIPCIState;
-
 static void ohci_mapfunc(PCIDevice *pci_dev, int i,
             pcibus_t addr, pcibus_t size, int type)
 {
