diff --git a/src/fw/shadow.c b/src/fw/shadow.c
index 987eaf4..4c627a8 100644
--- a/src/fw/shadow.c
+++ b/src/fw/shadow.c
@@ -173,9 +173,9 @@
         return;
     // QEMU doesn't map 0xc0000-0xfffff back to the original rom on a
     // reset, so do that manually before invoking a hard reset.
-    void *cstart = VSYMBOL(code32flat_start), *cend = VSYMBOL(code32flat_end);
-    void *hrp = &HaveRunPost;
-    if (readl(hrp + BIOS_SRC_OFFSET)) {
+    void *flash = (void*)BIOS_SRC_OFFSET;
+    u32 hrp = (u32)&HaveRunPost;
+    if (readl(flash + hrp)) {
         // There isn't a pristine copy of the BIOS at 0xffff0000 to copy
         if (HaveRunPost == 3) {
             // In a reboot loop.  Try to shutdown the machine instead.
@@ -187,8 +187,9 @@
     } else {
         // Copy the BIOS making sure to only reset HaveRunPost at end
         make_bios_writable();
-        memcpy(cstart, cstart + BIOS_SRC_OFFSET, hrp - cstart);
-        memcpy(hrp + 4, hrp + 4 + BIOS_SRC_OFFSET, cend - (hrp + 4));
+        u32 cstart = SYMBOL(code32flat_start), cend = SYMBOL(code32flat_end);
+        memcpy((void*)cstart, flash + cstart, hrp - cstart);
+        memcpy((void*)hrp + 4, flash + hrp + 4, cend - (hrp + 4));
         barrier();
         HaveRunPost = 0;
         barrier();