diff --git a/hw/sh.h b/hw/sh.h
index 116441a7dd..5e3c22bbb9 100644
--- a/hw/sh.h
+++ b/hw/sh.h
@@ -4,6 +4,9 @@
 
 #include "sh_intc.h"
 
+#define A7ADDR(x) ((x) & 0x1fffffff)
+#define P4ADDR(x) ((x) | 0xe0000000)
+
 /* sh7750.c */
 struct SH7750State;
 
diff --git a/hw/sh7750.c b/hw/sh7750.c
index afdb9f5bcb..af86f0e990 100644
--- a/hw/sh7750.c
+++ b/hw/sh7750.c
@@ -683,10 +683,16 @@ SH7750State *sh7750_init(CPUSH4State * cpu)
 					      sh7750_mem_write, s);
     cpu_register_physical_memory_offset(0x1f000000, 0x1000,
                                         sh7750_io_memory, 0x1f000000);
+    cpu_register_physical_memory_offset(0xff000000, 0x1000,
+                                        sh7750_io_memory, 0x1f000000);
     cpu_register_physical_memory_offset(0x1f800000, 0x1000,
                                         sh7750_io_memory, 0x1f800000);
+    cpu_register_physical_memory_offset(0xff800000, 0x1000,
+                                        sh7750_io_memory, 0x1f800000);
     cpu_register_physical_memory_offset(0x1fc00000, 0x1000,
                                         sh7750_io_memory, 0x1fc00000);
+    cpu_register_physical_memory_offset(0xffc00000, 0x1000,
+                                        sh7750_io_memory, 0x1fc00000);
 
     sh7750_mm_cache_and_tlb = cpu_register_io_memory(0,
 						     sh7750_mmct_read,
diff --git a/hw/sh_intc.c b/hw/sh_intc.c
index b62633d312..7d738d16ca 100644
--- a/hw/sh_intc.c
+++ b/hw/sh_intc.c
@@ -307,9 +307,12 @@ struct intc_source *sh_intc_source(struct intc_desc *desc, intc_enum id)
 static void sh_intc_register(struct intc_desc *desc, 
 			     unsigned long address)
 {
-    if (address)
-        cpu_register_physical_memory_offset(INTC_A7(address), 4,
+    if (address) {
+        cpu_register_physical_memory_offset(P4ADDR(address), 4,
                                             desc->iomemtype, INTC_A7(address));
+        cpu_register_physical_memory_offset(A7ADDR(address), 4,
+                                            desc->iomemtype, INTC_A7(address));
+    }
 }
 
 static void sh_intc_register_source(struct intc_desc *desc,
diff --git a/hw/sh_serial.c b/hw/sh_serial.c
index 8397739de9..843031e8a5 100644
--- a/hw/sh_serial.c
+++ b/hw/sh_serial.c
@@ -399,7 +399,8 @@ void sh_serial_init (target_phys_addr_t base, int feat,
 
     s_io_memory = cpu_register_io_memory(0, sh_serial_readfn,
 					 sh_serial_writefn, s);
-    cpu_register_physical_memory(base, 0x28, s_io_memory);
+    cpu_register_physical_memory(P4ADDR(base), 0x28, s_io_memory);
+    cpu_register_physical_memory(A7ADDR(base), 0x28, s_io_memory);
 
     s->chr = chr;
 
diff --git a/hw/sh_timer.c b/hw/sh_timer.c
index 4557a8354c..c5c45f50d2 100644
--- a/hw/sh_timer.c
+++ b/hw/sh_timer.c
@@ -320,6 +320,7 @@ void tmu012_init(target_phys_addr_t base, int feat, uint32_t freq,
 				    ch2_irq0); /* ch2_irq1 not supported */
     iomemtype = cpu_register_io_memory(0, tmu012_readfn,
                                        tmu012_writefn, s);
-    cpu_register_physical_memory(base, 0x00001000, iomemtype);
+    cpu_register_physical_memory(P4ADDR(base), 0x00001000, iomemtype);
+    cpu_register_physical_memory(A7ADDR(base), 0x00001000, iomemtype);
     /* ??? Save/restore.  */
 }
diff --git a/target-sh4/helper.c b/target-sh4/helper.c
index f077462f7d..c2cc4325e7 100644
--- a/target-sh4/helper.c
+++ b/target-sh4/helper.c
@@ -439,19 +439,7 @@ int get_physical_address(CPUState * env, target_ulong * physical,
 	if (address >= 0x80000000 && address < 0xc0000000) {
 	    /* Mask upper 3 bits for P1 and P2 areas */
 	    *physical = address & 0x1fffffff;
-        } else if (address >= 0xfd000000 && address < 0xfe000000) {
-            /* PCI memory space */
-            *physical = address;
-	} else if (address >= 0xfc000000) {
-	    /*
-	     * Mask upper 3 bits for control registers in P4 area,
-	     * to unify access to control registers via P0-P3 area.
-	     * The addresses for cache store queue, TLB address array
-	     * are not masked.
-	     */
-	*physical = address & 0x1fffffff;
 	} else {
-	    /* access to cache store queue, or TLB address array. */
 	    *physical = address;
 	}
 	*prot = PAGE_READ | PAGE_WRITE;