diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index 453e642948..bbc73228e6 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -679,13 +679,13 @@ static void prom_set(int index, const char *string, ...)
     }
 
     table_addr = ENVP_ADDR + sizeof(int32_t) * ENVP_NB_ENTRIES
-                 + index * ENVP_ENTRY_SIZE + VIRT_TO_PHYS_ADDEND;
-    stl_raw(p, table_addr);
+                 + index * ENVP_ENTRY_SIZE;
+    stl_phys(p, table_addr);
 
     va_start(ap, string);
     vsnprintf(buf, ENVP_ENTRY_SIZE, string, ap);
     va_end(ap);
-    pstrcpy_targphys(table_addr, ENVP_ENTRY_SIZE, buf);
+    pstrcpy_targphys(table_addr + VIRT_TO_PHYS_ADDEND, ENVP_ENTRY_SIZE, buf);
 }
 
 /* Kernel */