Change MMIO callbacks to use offsets, not absolute addresses.

Signed-off-by: Paul Brook <paul@codesourcery.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5849 c046a42c-6fe2-441c-8c8c-71466251a162

80 files changed, 380 insertions, 846 deletions

diff --git a/hw/arm_gic.c b/hw/arm_gic.c
index 54e99f4d66..f36f147f86 100644
--- a/hw/arm_gic.c
+++ b/hw/arm_gic.c
@@ -23,14 +23,12 @@ do { printf("arm_gic: " fmt , ##args); } while (0)
 #ifdef NVIC
 static const uint8_t gic_id[] =
 { 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 };
-#define GIC_DIST_OFFSET 0
 /* The NVIC has 16 internal vectors.  However these are not exposed
    through the normal GIC interface.  */
 #define GIC_BASE_IRQ    32
 #else
 static const uint8_t gic_id[] =
 { 0x90, 0x13, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
-#define GIC_DIST_OFFSET 0x1000
 #define GIC_BASE_IRQ    0
 #endif
 
@@ -76,7 +74,6 @@ typedef struct gic_irq_state
 
 typedef struct gic_state
 {
-    uint32_t base;
     qemu_irq parent_irq[NCPU];
     int enabled;
     int cpu_enabled[NCPU];
@@ -252,7 +249,6 @@ static uint32_t gic_dist_readb(void *opaque, target_phys_addr_t offset)
 
     cpu = gic_get_current_cpu();
     cm = 1 << cpu;
-    offset -= s->base + GIC_DIST_OFFSET;
     if (offset < 0x100) {
 #ifndef NVIC
         if (offset == 0)
@@ -365,7 +361,7 @@ static uint32_t gic_dist_readl(void *opaque, target_phys_addr_t offset)
 #ifdef NVIC
     gic_state *s = (gic_state *)opaque;
     uint32_t addr;
-    addr = offset - s->base;
+    addr = offset;
     if (addr < 0x100 || addr > 0xd00)
         return nvic_readl(s->nvic, addr);
 #endif
@@ -383,7 +379,6 @@ static void gic_dist_writeb(void *opaque, target_phys_addr_t offset,
     int cpu;
 
     cpu = gic_get_current_cpu();
-    offset -= s->base + GIC_DIST_OFFSET;
     if (offset < 0x100) {
 #ifdef NVIC
         goto bad_reg;
@@ -526,13 +521,13 @@ static void gic_dist_writel(void *opaque, target_phys_addr_t offset,
     gic_state *s = (gic_state *)opaque;
 #ifdef NVIC
     uint32_t addr;
-    addr = offset - s->base;
+    addr = offset;
     if (addr < 0x100 || (addr > 0xd00 && addr != 0xf00)) {
         nvic_writel(s->nvic, addr, value);
         return;
     }
 #endif
-    if (offset - s->base == GIC_DIST_OFFSET + 0xf00) {
+    if (offset == 0xf00) {
         int cpu;
         int irq;
         int mask;
@@ -723,7 +718,7 @@ static int gic_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-static gic_state *gic_init(uint32_t base, qemu_irq *parent_irq)
+static gic_state *gic_init(uint32_t dist_base, qemu_irq *parent_irq)
 {
     gic_state *s;
     int iomemtype;
@@ -738,9 +733,8 @@ static gic_state *gic_init(uint32_t base, qemu_irq *parent_irq)
     }
     iomemtype = cpu_register_io_memory(0, gic_dist_readfn,
                                        gic_dist_writefn, s);
-    cpu_register_physical_memory(base + GIC_DIST_OFFSET, 0x00001000,
+    cpu_register_physical_memory(dist_base, 0x00001000,
                                  iomemtype);
-    s->base = base;
     gic_reset(s);
     register_savevm("arm_gic", -1, 1, gic_save, gic_load, s);
     return s;
diff --git a/hw/arm_sysctl.c b/hw/arm_sysctl.c
index 67ca154a30..ab22e840d7 100644
--- a/hw/arm_sysctl.c
+++ b/hw/arm_sysctl.c
@@ -14,7 +14,6 @@
 #define LOCK_VALUE 0xa05f
 
 typedef struct {
-    uint32_t base;
     uint32_t sys_id;
     uint32_t leds;
     uint16_t lockval;
@@ -29,7 +28,6 @@ static uint32_t arm_sysctl_read(void *opaque, target_phys_addr_t offset)
 {
     arm_sysctl_state *s = (arm_sysctl_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* ID */
         return s->sys_id;
@@ -108,7 +106,6 @@ static void arm_sysctl_write(void *opaque, target_phys_addr_t offset,
                           uint32_t val)
 {
     arm_sysctl_state *s = (arm_sysctl_state *)opaque;
-    offset -= s->base;
 
     switch (offset) {
     case 0x08: /* LED */
@@ -199,7 +196,6 @@ void arm_sysctl_init(uint32_t base, uint32_t sys_id)
     s = (arm_sysctl_state *)qemu_mallocz(sizeof(arm_sysctl_state));
     if (!s)
         return;
-    s->base = base;
     s->sys_id = sys_id;
     /* The MPcore bootloader uses these flags to start secondary CPUs.
        We don't use a bootloader, so do this here.  */
diff --git a/hw/arm_timer.c b/hw/arm_timer.c
index 5150fe9a5a..3ffe9965b4 100644
--- a/hw/arm_timer.c
+++ b/hw/arm_timer.c
@@ -190,7 +190,6 @@ static void *arm_timer_init(uint32_t freq, qemu_irq irq)
 typedef struct {
     void *timer[2];
     int level[2];
-    uint32_t base;
     qemu_irq irq;
 } sp804_state;
 
@@ -208,7 +207,6 @@ static uint32_t sp804_read(void *opaque, target_phys_addr_t offset)
     sp804_state *s = (sp804_state *)opaque;
 
     /* ??? Don't know the PrimeCell ID for this device.  */
-    offset -= s->base;
     if (offset < 0x20) {
         return arm_timer_read(s->timer[0], offset);
     } else {
@@ -221,7 +219,6 @@ static void sp804_write(void *opaque, target_phys_addr_t offset,
 {
     sp804_state *s = (sp804_state *)opaque;
 
-    offset -= s->base;
     if (offset < 0x20) {
         arm_timer_write(s->timer[0], offset, value);
     } else {
@@ -268,7 +265,6 @@ void sp804_init(uint32_t base, qemu_irq irq)
 
     s = (sp804_state *)qemu_mallocz(sizeof(sp804_state));
     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
-    s->base = base;
     s->irq = irq;
     /* ??? The timers are actually configurable between 32kHz and 1MHz, but
        we don't implement that.  */
@@ -285,7 +281,6 @@ void sp804_init(uint32_t base, qemu_irq irq)
 
 typedef struct {
     void *timer[3];
-    uint32_t base;
 } icp_pit_state;
 
 static uint32_t icp_pit_read(void *opaque, target_phys_addr_t offset)
@@ -294,7 +289,6 @@ static uint32_t icp_pit_read(void *opaque, target_phys_addr_t offset)
     int n;
 
     /* ??? Don't know the PrimeCell ID for this device.  */
-    offset -= s->base;
     n = offset >> 8;
     if (n > 3)
         cpu_abort(cpu_single_env, "sp804_read: Bad timer %d\n", n);
@@ -308,7 +302,6 @@ static void icp_pit_write(void *opaque, target_phys_addr_t offset,
     icp_pit_state *s = (icp_pit_state *)opaque;
     int n;
 
-    offset -= s->base;
     n = offset >> 8;
     if (n > 3)
         cpu_abort(cpu_single_env, "sp804_write: Bad timer %d\n", n);
@@ -335,7 +328,6 @@ void icp_pit_init(uint32_t base, qemu_irq *pic, int irq)
     icp_pit_state *s;
 
     s = (icp_pit_state *)qemu_mallocz(sizeof(icp_pit_state));
-    s->base = base;
     /* Timer 0 runs at the system clock speed (40MHz).  */
     s->timer[0] = arm_timer_init(40000000, pic[irq]);
     /* The other two timers run at 1MHz.  */
diff --git a/hw/armv7m.c b/hw/armv7m.c
index b2bad3c2e8..096193d8f3 100644
--- a/hw/armv7m.c
+++ b/hw/armv7m.c
@@ -14,11 +14,11 @@
 /* Bitbanded IO.  Each word corresponds to a single bit.  */
 
 /* Get the byte address of the real memory for a bitband acess.  */
-static inline uint32_t bitband_addr(uint32_t addr)
+static inline uint32_t bitband_addr(void * opaque, uint32_t addr)
 {
     uint32_t res;
 
-    res = addr & 0xe0000000;
+    res = *(uint32_t *)opaque;
     res |= (addr & 0x1ffffff) >> 5;
     return res;
 
@@ -27,7 +27,7 @@ static inline uint32_t bitband_addr(uint32_t addr)
 static uint32_t bitband_readb(void *opaque, target_phys_addr_t offset)
 {
     uint8_t v;
-    cpu_physical_memory_read(bitband_addr(offset), &v, 1);
+    cpu_physical_memory_read(bitband_addr(opaque, offset), &v, 1);
     return (v & (1 << ((offset >> 2) & 7))) != 0;
 }
 
@@ -37,7 +37,7 @@ static void bitband_writeb(void *opaque, target_phys_addr_t offset,
     uint32_t addr;
     uint8_t mask;
     uint8_t v;
-    addr = bitband_addr(offset);
+    addr = bitband_addr(opaque, offset);
     mask = (1 << ((offset >> 2) & 7));
     cpu_physical_memory_read(addr, &v, 1);
     if (value & 1)
@@ -52,7 +52,7 @@ static uint32_t bitband_readw(void *opaque, target_phys_addr_t offset)
     uint32_t addr;
     uint16_t mask;
     uint16_t v;
-    addr = bitband_addr(offset) & ~1;
+    addr = bitband_addr(opaque, offset) & ~1;
     mask = (1 << ((offset >> 2) & 15));
     mask = tswap16(mask);
     cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
@@ -65,7 +65,7 @@ static void bitband_writew(void *opaque, target_phys_addr_t offset,
     uint32_t addr;
     uint16_t mask;
     uint16_t v;
-    addr = bitband_addr(offset) & ~1;
+    addr = bitband_addr(opaque, offset) & ~1;
     mask = (1 << ((offset >> 2) & 15));
     mask = tswap16(mask);
     cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
@@ -81,7 +81,7 @@ static uint32_t bitband_readl(void *opaque, target_phys_addr_t offset)
     uint32_t addr;
     uint32_t mask;
     uint32_t v;
-    addr = bitband_addr(offset) & ~3;
+    addr = bitband_addr(opaque, offset) & ~3;
     mask = (1 << ((offset >> 2) & 31));
     mask = tswap32(mask);
     cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
@@ -94,7 +94,7 @@ static void bitband_writel(void *opaque, target_phys_addr_t offset,
     uint32_t addr;
     uint32_t mask;
     uint32_t v;
-    addr = bitband_addr(offset) & ~3;
+    addr = bitband_addr(opaque, offset) & ~3;
     mask = (1 << ((offset >> 2) & 31));
     mask = tswap32(mask);
     cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
@@ -120,10 +120,14 @@ static CPUWriteMemoryFunc *bitband_writefn[] = {
 static void armv7m_bitband_init(void)
 {
     int iomemtype;
+    static uint32_t bitband1_offset = 0x20000000;
+    static uint32_t bitband2_offset = 0x40000000;
 
     iomemtype = cpu_register_io_memory(0, bitband_readfn, bitband_writefn,
-                                       NULL);
+                                       &bitband1_offset);
     cpu_register_physical_memory(0x22000000, 0x02000000, iomemtype);
+    iomemtype = cpu_register_io_memory(0, bitband_readfn, bitband_writefn,
+                                       &bitband2_offset);
     cpu_register_physical_memory(0x42000000, 0x02000000, iomemtype);
 }
 
diff --git a/hw/ds1225y.c b/hw/ds1225y.c
index 3b91b4fa70..64c21b7227 100644
--- a/hw/ds1225y.c
+++ b/hw/ds1225y.c
@@ -30,7 +30,6 @@
 
 typedef struct ds1225y_t
 {
-    target_phys_addr_t mem_base;
     uint32_t chip_size;
     QEMUFile *file;
     uint8_t *contents;
@@ -41,14 +40,9 @@ typedef struct ds1225y_t
 static uint32_t nvram_readb (void *opaque, target_phys_addr_t addr)
 {
     ds1225y_t *s = opaque;
-    int64_t pos;
     uint32_t val;
 
-    pos = addr - s->mem_base;
-    if (pos >= s->chip_size)
-        pos -= s->chip_size;
-
-    val = s->contents[pos];
+    val = s->contents[addr];
 
 #ifdef DEBUG_NVRAM
     printf("nvram: read 0x%x at " TARGET_FMT_lx "\n", val, addr);
@@ -77,16 +71,14 @@ static uint32_t nvram_readl (void *opaque, target_phys_addr_t addr)
 static void nvram_writeb (void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     ds1225y_t *s = opaque;
-    int64_t pos;
 
 #ifdef DEBUG_NVRAM
     printf("nvram: write 0x%x at " TARGET_FMT_lx "\n", val, addr);
 #endif
 
-    pos = addr - s->mem_base;
-    s->contents[pos] = val & 0xff;
+    s->contents[addr] = val & 0xff;
     if (s->file) {
-        qemu_fseek(s->file, pos, SEEK_SET);
+        qemu_fseek(s->file, addr, SEEK_SET);
         qemu_put_byte(s->file, (int)val);
         qemu_fflush(s->file);
     }
@@ -117,7 +109,7 @@ static void nvram_writeb_protected (void *opaque, target_phys_addr_t addr, uint3
         return;
     }
 
-    nvram_writeb(opaque, addr - s->chip_size, val);
+    nvram_writeb(opaque, addr, val);
 }
 
 static void nvram_writew_protected (void *opaque, target_phys_addr_t addr, uint32_t val)
@@ -167,7 +159,6 @@ void *ds1225y_init(target_phys_addr_t mem_base, const char *filename)
     if (!s->contents) {
         return NULL;
     }
-    s->mem_base = mem_base;
     s->protection = 7;
 
     /* Read current file */
diff --git a/hw/e1000.c b/hw/e1000.c
index 71781e6e99..f07936fdc1 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -76,7 +76,6 @@ typedef struct E1000State_st {
     PCIDevice dev;
     VLANClientState *vc;
     NICInfo *nd;
-    uint32_t mmio_base;
     int mmio_index;
 
     uint32_t mac_reg[0x8000];
@@ -786,7 +785,7 @@ static void
 e1000_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     E1000State *s = opaque;
-    unsigned int index = ((addr - s->mmio_base) & 0x1ffff) >> 2;
+    unsigned int index = (addr & 0x1ffff) >> 2;
 
 #ifdef TARGET_WORDS_BIGENDIAN
     val = bswap32(val);
@@ -820,7 +819,7 @@ static uint32_t
 e1000_mmio_readl(void *opaque, target_phys_addr_t addr)
 {
     E1000State *s = opaque;
-    unsigned int index = ((addr - s->mmio_base) & 0x1ffff) >> 2;
+    unsigned int index = (addr & 0x1ffff) >> 2;
 
     if (index < NREADOPS && macreg_readops[index])
     {
@@ -870,7 +869,7 @@ nic_save(QEMUFile *f, void *opaque)
     int i, j;
 
     pci_device_save(&s->dev, f);
-    qemu_put_be32s(f, &s->mmio_base);
+    qemu_put_be32(f, 0);
     qemu_put_be32s(f, &s->rxbuf_size);
     qemu_put_be32s(f, &s->rxbuf_min_shift);
     qemu_put_be32s(f, &s->eecd_state.val_in);
@@ -916,7 +915,7 @@ nic_load(QEMUFile *f, void *opaque, int version_id)
         return ret;
     if (version_id == 1)
         qemu_get_sbe32s(f, &i); /* once some unused instance id */
-    qemu_get_be32s(f, &s->mmio_base);
+    qemu_get_be32(f); /* Ignored.  Was mmio_base.  */
     qemu_get_be32s(f, &s->rxbuf_size);
     qemu_get_be32s(f, &s->rxbuf_min_shift);
     qemu_get_be32s(f, &s->eecd_state.val_in);
@@ -1005,7 +1004,6 @@ e1000_mmio_map(PCIDevice *pci_dev, int region_num,
 
     DBGOUT(MMIO, "e1000_mmio_map addr=0x%08x 0x%08x\n", addr, size);
 
-    d->mmio_base = addr;
     cpu_register_physical_memory(addr, PNPMMIO_SIZE, d->mmio_index);
 }
 
diff --git a/hw/eepro100.c b/hw/eepro100.c
index 8db2098290..cb3ca09644 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1392,7 +1392,6 @@ static void pci_map(PCIDevice * pci_dev, int region_num,
 static void pci_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     EEPRO100State *s = opaque;
-    addr -= s->region[0];
     //~ logout("addr=%s val=0x%02x\n", regname(addr), val);
     eepro100_write1(s, addr, val);
 }
@@ -1400,7 +1399,6 @@ static void pci_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 static void pci_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     EEPRO100State *s = opaque;
-    addr -= s->region[0];
     //~ logout("addr=%s val=0x%02x\n", regname(addr), val);
     eepro100_write2(s, addr, val);
 }
@@ -1408,7 +1406,6 @@ static void pci_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
 static void pci_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     EEPRO100State *s = opaque;
-    addr -= s->region[0];
     //~ logout("addr=%s val=0x%02x\n", regname(addr), val);
     eepro100_write4(s, addr, val);
 }
@@ -1416,7 +1413,6 @@ static void pci_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
 static uint32_t pci_mmio_readb(void *opaque, target_phys_addr_t addr)
 {
     EEPRO100State *s = opaque;
-    addr -= s->region[0];
     //~ logout("addr=%s\n", regname(addr));
     return eepro100_read1(s, addr);
 }
@@ -1424,7 +1420,6 @@ static uint32_t pci_mmio_readb(void *opaque, target_phys_addr_t addr)
 static uint32_t pci_mmio_readw(void *opaque, target_phys_addr_t addr)
 {
     EEPRO100State *s = opaque;
-    addr -= s->region[0];
     //~ logout("addr=%s\n", regname(addr));
     return eepro100_read2(s, addr);
 }
@@ -1432,7 +1427,6 @@ static uint32_t pci_mmio_readw(void *opaque, target_phys_addr_t addr)
 static uint32_t pci_mmio_readl(void *opaque, target_phys_addr_t addr)
 {
     EEPRO100State *s = opaque;
-    addr -= s->region[0];
     //~ logout("addr=%s\n", regname(addr));
     return eepro100_read4(s, addr);
 }
diff --git a/hw/etraxfs_dma.c b/hw/etraxfs_dma.c
index 2e5de50cf6..54e55d1288 100644
--- a/hw/etraxfs_dma.c
+++ b/hw/etraxfs_dma.c
@@ -188,7 +188,6 @@ struct fs_dma_channel
 struct fs_dma_ctrl
 {
 	CPUState *env;
-	target_phys_addr_t base;
 
 	int nr_channels;
 	struct fs_dma_channel *channels;
@@ -212,10 +211,10 @@ static inline int channel_en(struct fs_dma_ctrl *ctrl, int c)
 		&& ctrl->channels[c].client;
 }
 
-static inline int fs_channel(target_phys_addr_t base, target_phys_addr_t addr)
+static inline int fs_channel(target_phys_addr_t addr)
 {
 	/* Every channel has a 0x2000 ctrl register map.  */
-	return (addr - base) >> 13;
+	return addr >> 13;
 }
 
 #ifdef USE_THIS_DEAD_CODE
@@ -572,7 +571,7 @@ dma_readl (void *opaque, target_phys_addr_t addr)
 	uint32_t r = 0;
 
 	/* Make addr relative to this instances base.  */
-	c = fs_channel(ctrl->base, addr);
+	c = fs_channel(addr);
 	addr &= 0x1fff;
 	switch (addr)
 	{
@@ -618,7 +617,7 @@ dma_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
 	int c;
 
         /* Make addr relative to this instances base.  */
-	c = fs_channel(ctrl->base, addr);
+	c = fs_channel(addr);
         addr &= 0x1fff;
         switch (addr)
 	{
@@ -753,7 +752,6 @@ void *etraxfs_dmac_init(CPUState *env,
 
         ctrl->bh = qemu_bh_new(DMA_run, ctrl);
 
-	ctrl->base = base;
 	ctrl->env = env;
 	ctrl->nr_channels = nr_channels;
 	ctrl->channels = qemu_mallocz(sizeof ctrl->channels[0] * nr_channels);
@@ -766,9 +764,9 @@ void *etraxfs_dmac_init(CPUState *env,
 								  dma_read, 
 								  dma_write, 
 								  ctrl);
-		cpu_register_physical_memory (base + i * 0x2000,
-					      sizeof ctrl->channels[i].regs, 
-					      ctrl->channels[i].regmap);
+		cpu_register_physical_memory_offset (base + i * 0x2000,
+                    sizeof ctrl->channels[i].regs, ctrl->channels[i].regmap,
+                    i * 0x2000);
 	}
 
 	return ctrl;
diff --git a/hw/etraxfs_eth.c b/hw/etraxfs_eth.c
index c49fbcc100..51a129abe9 100644
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -314,7 +314,6 @@ struct fs_eth
 {
 	CPUState *env;
 	qemu_irq *irq;
-	target_phys_addr_t base;
 	VLANClientState *vc;
 	int ethregs;
 
@@ -375,8 +374,6 @@ static uint32_t eth_readl (void *opaque, target_phys_addr_t addr)
 	struct fs_eth *eth = opaque;
 	uint32_t r = 0;
 
-	/* Make addr relative to this instances base.  */
-	addr -= eth->base;
 	switch (addr) {
 		case R_STAT:
 			/* Attach an MDIO/PHY abstraction.  */
@@ -428,8 +425,6 @@ eth_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
 	struct fs_eth *eth = opaque;
 
-	/* Make addr relative to this instances base.  */
-	addr -= eth->base;
 	switch (addr)
 	{
 		case RW_MA0_LO:
@@ -589,7 +584,6 @@ void *etraxfs_eth_init(NICInfo *nd, CPUState *env,
 	dma[1].client.pull = NULL;
 
 	eth->env = env;
-	eth->base = base;
 	eth->irq = irq;
 	eth->dma_out = dma;
 	eth->dma_in = dma + 1;
diff --git a/hw/etraxfs_pic.c b/hw/etraxfs_pic.c
index d145bec17d..fc1903a7f9 100644
--- a/hw/etraxfs_pic.c
+++ b/hw/etraxfs_pic.c
@@ -31,7 +31,6 @@
 struct fs_pic_state_t
 {
 	CPUState *env;
-	target_phys_addr_t base;
 
 	uint32_t rw_mask;
 	/* Active interrupt lines.  */
@@ -56,8 +55,6 @@ static uint32_t pic_readl (void *opaque, target_phys_addr_t addr)
 	struct fs_pic_state_t *fs = opaque;
 	uint32_t rval;
 
-	/* Transform this to a relative addr.  */
-	addr -= fs->base;
 	switch (addr)
 	{
 		case 0x0: 
@@ -99,8 +96,6 @@ pic_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
 	struct fs_pic_state_t *fs = opaque;
 	D(printf("%s addr=%x val=%x\n", __func__, addr, value));
-	/* Transform this to a relative addr.  */
-	addr -= fs->base;
 	switch (addr) 
 	{
 		case 0x0: 
@@ -233,7 +228,6 @@ struct etraxfs_pic *etraxfs_pic_init(CPUState *env, target_phys_addr_t base)
 
 	intr_vect_regs = cpu_register_io_memory(0, pic_read, pic_write, fs);
 	cpu_register_physical_memory(base, 0x14, intr_vect_regs);
-	fs->base = base;
 
 	return pic;
   err:
diff --git a/hw/etraxfs_ser.c b/hw/etraxfs_ser.c
index 11a0f22102..78c449ec4d 100644
--- a/hw/etraxfs_ser.c
+++ b/hw/etraxfs_ser.c
@@ -50,8 +50,6 @@ struct etrax_serial_t
 	CharDriverState *chr;
 	qemu_irq *irq;
 
-	target_phys_addr_t base;
-
 	int pending_tx;
 
 	/* Control registers.  */
@@ -240,8 +238,6 @@ void etraxfs_ser_init(CPUState *env, qemu_irq *irq, CharDriverState *chr,
 
 	s->env = env;
 	s->irq = irq;
-	s->base = base;
-
 	s->chr = chr;
 
 	/* transmitter begins ready and idle.  */
diff --git a/hw/etraxfs_timer.c b/hw/etraxfs_timer.c
index 8d45051927..ea0009aa8b 100644
--- a/hw/etraxfs_timer.c
+++ b/hw/etraxfs_timer.c
@@ -47,7 +47,6 @@ struct fs_timer_t {
 	CPUState *env;
 	qemu_irq *irq;
 	qemu_irq *nmi;
-	target_phys_addr_t base;
 
 	QEMUBH *bh_t0;
 	QEMUBH *bh_t1;
@@ -90,8 +89,6 @@ static uint32_t timer_readl (void *opaque, target_phys_addr_t addr)
 	struct fs_timer_t *t = opaque;
 	uint32_t r = 0;
 
-	/* Make addr relative to this instances base.  */
-	addr -= t->base;
 	switch (addr) {
 	case R_TMR0_DATA:
 		break;
@@ -273,8 +270,6 @@ timer_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
 	struct fs_timer_t *t = opaque;
 
-	/* Make addr relative to this instances base.  */
-	addr -= t->base;
 	switch (addr)
 	{
 		case RW_TMR0_DIV:
@@ -357,7 +352,6 @@ void etraxfs_timer_init(CPUState *env, qemu_irq *irqs, qemu_irq *nmi,
 	t->irq = irqs;
 	t->nmi = nmi;
 	t->env = env;
-	t->base = base;
 
 	timer_regs = cpu_register_io_memory(0, timer_read, timer_write, t);
 	cpu_register_physical_memory (base, 0x5c, timer_regs);
diff --git a/hw/g364fb.c b/hw/g364fb.c
index ed690ea805..64c29889e0 100644
--- a/hw/g364fb.c
+++ b/hw/g364fb.c
@@ -26,7 +26,6 @@
 //#define DEBUG_G364
 
 typedef struct G364State {
-    target_phys_addr_t vram_base;
     unsigned int vram_size;
     uint8_t *vram_buffer;
     uint32_t ctla;
@@ -300,9 +299,8 @@ static CPUWriteMemoryFunc *g364fb_ctrl_write[3] = {
 static uint32_t g364fb_mem_readb(void *opaque, target_phys_addr_t addr)
 {
     G364State *s = opaque;
-    target_phys_addr_t relative_addr = addr - s->vram_base;
 
-    return s->vram_buffer[relative_addr];
+    return s->vram_buffer[addr];
 }
 
 static uint32_t g364fb_mem_readw(void *opaque, target_phys_addr_t addr)
@@ -326,9 +324,8 @@ static uint32_t g364fb_mem_readl(void *opaque, target_phys_addr_t addr)
 static void g364fb_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     G364State *s = opaque;
-    target_phys_addr_t relative_addr = addr - s->vram_base;
 
-    s->vram_buffer[relative_addr] = val;
+    s->vram_buffer[addr] = val;
 }
 
 static void g364fb_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
@@ -375,14 +372,13 @@ int g364fb_mm_init(DisplayState *ds,
     g364fb_reset(s);
 
     s->ds = ds;
-    s->vram_base = vram_base;
 
     s->console = graphic_console_init(ds, g364fb_update_display,
                                       g364fb_invalidate_display,
                                       g364fb_screen_dump, NULL, s);
 
     io_vram = cpu_register_io_memory(0, g364fb_mem_read, g364fb_mem_write, s);
-    cpu_register_physical_memory(s->vram_base, vram_size, io_vram);
+    cpu_register_physical_memory(vram_base, vram_size, io_vram);
 
     io_ctrl = cpu_register_io_memory(0, g364fb_ctrl_read, g364fb_ctrl_write, s);
     cpu_register_physical_memory(ctrl_base, 0x10000, io_ctrl);
diff --git a/hw/integratorcp.c b/hw/integratorcp.c
index c0e2b66bc3..a2d3d4306c 100644
--- a/hw/integratorcp.c
+++ b/hw/integratorcp.c
@@ -38,7 +38,6 @@ static uint8_t integrator_spd[128] = {
 static uint32_t integratorcm_read(void *opaque, target_phys_addr_t offset)
 {
     integratorcm_state *s = (integratorcm_state *)opaque;
-    offset -= 0x10000000;
     if (offset >= 0x100 && offset < 0x200) {
         /* CM_SPD */
         if (offset >= 0x180)
@@ -141,7 +140,6 @@ static void integratorcm_write(void *opaque, target_phys_addr_t offset,
                                uint32_t value)
 {
     integratorcm_state *s = (integratorcm_state *)opaque;
-    offset -= 0x10000000;
     switch (offset >> 2) {
     case 2: /* CM_OSC */
         if (s->cm_lock == 0xa05f)
@@ -268,7 +266,6 @@ static void integratorcm_init(int memsz)
 
 typedef struct icp_pic_state
 {
-  uint32_t base;
   uint32_t level;
   uint32_t irq_enabled;
   uint32_t fiq_enabled;
@@ -300,7 +297,6 @@ static uint32_t icp_pic_read(void *opaque, target_phys_addr_t offset)
 {
     icp_pic_state *s = (icp_pic_state *)opaque;
 
-    offset -= s->base;
     switch (offset >> 2) {
     case 0: /* IRQ_STATUS */
         return s->level & s->irq_enabled;
@@ -329,7 +325,6 @@ static void icp_pic_write(void *opaque, target_phys_addr_t offset,
                           uint32_t value)
 {
     icp_pic_state *s = (icp_pic_state *)opaque;
-    offset -= s->base;
 
     switch (offset >> 2) {
     case 2: /* IRQ_ENABLESET */
@@ -386,7 +381,6 @@ static qemu_irq *icp_pic_init(uint32_t base,
     if (!s)
         return NULL;
     qi = qemu_allocate_irqs(icp_pic_set_irq, s, 32);
-    s->base = base;
     s->parent_irq = parent_irq;
     s->parent_fiq = parent_fiq;
     iomemtype = cpu_register_io_memory(0, icp_pic_readfn,
@@ -397,14 +391,8 @@ static qemu_irq *icp_pic_init(uint32_t base,
 }
 
 /* CP control registers.  */
-typedef struct {
-    uint32_t base;
-} icp_control_state;
-
 static uint32_t icp_control_read(void *opaque, target_phys_addr_t offset)
 {
-    icp_control_state *s = (icp_control_state *)opaque;
-    offset -= s->base;
     switch (offset >> 2) {
     case 0: /* CP_IDFIELD */
         return 0x41034003;
@@ -424,8 +412,6 @@ static uint32_t icp_control_read(void *opaque, target_phys_addr_t offset)
 static void icp_control_write(void *opaque, target_phys_addr_t offset,
                           uint32_t value)
 {
-    icp_control_state *s = (icp_control_state *)opaque;
-    offset -= s->base;
     switch (offset >> 2) {
     case 1: /* CP_FLASHPROG */
     case 2: /* CP_INTREG */
@@ -452,13 +438,10 @@ static CPUWriteMemoryFunc *icp_control_writefn[] = {
 static void icp_control_init(uint32_t base)
 {
     int iomemtype;
-    icp_control_state *s;
 
-    s = (icp_control_state *)qemu_mallocz(sizeof(icp_control_state));
     iomemtype = cpu_register_io_memory(0, icp_control_readfn,
-                                       icp_control_writefn, s);
+                                       icp_control_writefn, NULL);
     cpu_register_physical_memory(base, 0x00800000, iomemtype);
-    s->base = base;
     /* ??? Save/restore.  */
 }
 
diff --git a/hw/iommu.c b/hw/iommu.c
index fe6911e5e0..b56cd7e280 100644
--- a/hw/iommu.c
+++ b/hw/iommu.c
@@ -114,7 +114,6 @@ do { printf("IOMMU: " fmt , ##args); } while (0)
 #define PAGE_MASK       (PAGE_SIZE - 1)
 
 typedef struct IOMMUState {
-    target_phys_addr_t addr;
     uint32_t regs[IOMMU_NREGS];
     target_phys_addr_t iostart;
     uint32_t version;
@@ -127,7 +126,7 @@ static uint32_t iommu_mem_readl(void *opaque, target_phys_addr_t addr)
     target_phys_addr_t saddr;
     uint32_t ret;
 
-    saddr = (addr - s->addr) >> 2;
+    saddr = addr >> 2;
     switch (saddr) {
     default:
         ret = s->regs[saddr];
@@ -148,7 +147,7 @@ static void iommu_mem_writel(void *opaque, target_phys_addr_t addr,
     IOMMUState *s = opaque;
     target_phys_addr_t saddr;
 
-    saddr = (addr - s->addr) >> 2;
+    saddr = addr >> 2;
     DPRINTF("write reg[%d] = %x\n", (int)saddr, val);
     switch (saddr) {
     case IOMMU_CTRL:
@@ -358,7 +357,6 @@ void *iommu_init(target_phys_addr_t addr, uint32_t version, qemu_irq irq)
     if (!s)
         return NULL;
 
-    s->addr = addr;
     s->version = version;
     s->irq = irq;
 
diff --git a/hw/jazz_led.c b/hw/jazz_led.c
index c8ac26372f..a3aaec7a0c 100644
--- a/hw/jazz_led.c
+++ b/hw/jazz_led.c
@@ -34,7 +34,6 @@ typedef enum {
 } screen_state_t;
 
 typedef struct LedState {
-    target_phys_addr_t base;
     uint8_t segments;
     DisplayState *ds;
     QEMUConsole *console;
@@ -44,10 +43,9 @@ typedef struct LedState {
 static uint32_t led_readb(void *opaque, target_phys_addr_t addr)
 {
     LedState *s = opaque;
-    int relative_addr = addr - s->base;
     uint32_t val;
 
-    switch (relative_addr) {
+    switch (addr) {
         case 0:
             val = s->segments;
             break;
@@ -94,9 +92,8 @@ static uint32_t led_readl(void *opaque, target_phys_addr_t addr)
 static void led_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     LedState *s = opaque;
-    int relative_addr = addr - s->base;
 
-    switch (relative_addr) {
+    switch (addr) {
         case 0:
             s->segments = val;
             s->state |= REDRAW_SEGMENTS;
@@ -311,12 +308,11 @@ void jazz_led_init(DisplayState *ds, target_phys_addr_t base)
     if (!s)
         return;
 
-    s->base = base;
     s->ds = ds;
     s->state = REDRAW_SEGMENTS | REDRAW_BACKGROUND;
 
     io = cpu_register_io_memory(0, led_read, led_write, s);
-    cpu_register_physical_memory(s->base, 1, io);
+    cpu_register_physical_memory(base, 1, io);
 
     s->console = graphic_console_init(ds, jazz_led_update_display,
                                      jazz_led_invalidate_display,
diff --git a/hw/m48t59.c b/hw/m48t59.c
index b781f50bf9..a59f07c2ee 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -46,7 +46,6 @@ struct m48t59_t {
     /* Hardware parameters */
     qemu_irq IRQ;
     int mem_index;
-    target_phys_addr_t mem_base;
     uint32_t io_base;
     uint16_t size;
     /* RTC management */
@@ -514,7 +513,6 @@ static void nvram_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     m48t59_t *NVRAM = opaque;
 
-    addr -= NVRAM->mem_base;
     m48t59_write(NVRAM, addr, value & 0xff);
 }
 
@@ -522,7 +520,6 @@ static void nvram_writew (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     m48t59_t *NVRAM = opaque;
 
-    addr -= NVRAM->mem_base;
     m48t59_write(NVRAM, addr, (value >> 8) & 0xff);
     m48t59_write(NVRAM, addr + 1, value & 0xff);
 }
@@ -531,7 +528,6 @@ static void nvram_writel (void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     m48t59_t *NVRAM = opaque;
 
-    addr -= NVRAM->mem_base;
     m48t59_write(NVRAM, addr, (value >> 24) & 0xff);
     m48t59_write(NVRAM, addr + 1, (value >> 16) & 0xff);
     m48t59_write(NVRAM, addr + 2, (value >> 8) & 0xff);
@@ -543,7 +539,6 @@ static uint32_t nvram_readb (void *opaque, target_phys_addr_t addr)
     m48t59_t *NVRAM = opaque;
     uint32_t retval;
 
-    addr -= NVRAM->mem_base;
     retval = m48t59_read(NVRAM, addr);
     return retval;
 }
@@ -553,7 +548,6 @@ static uint32_t nvram_readw (void *opaque, target_phys_addr_t addr)
     m48t59_t *NVRAM = opaque;
     uint32_t retval;
 
-    addr -= NVRAM->mem_base;
     retval = m48t59_read(NVRAM, addr) << 8;
     retval |= m48t59_read(NVRAM, addr + 1);
     return retval;
@@ -564,7 +558,6 @@ static uint32_t nvram_readl (void *opaque, target_phys_addr_t addr)
     m48t59_t *NVRAM = opaque;
     uint32_t retval;
 
-    addr -= NVRAM->mem_base;
     retval = m48t59_read(NVRAM, addr) << 24;
     retval |= m48t59_read(NVRAM, addr + 1) << 16;
     retval |= m48t59_read(NVRAM, addr + 2) << 8;
@@ -636,7 +629,6 @@ m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,
     }
     s->IRQ = IRQ;
     s->size = size;
-    s->mem_base = mem_base;
     s->io_base = io_base;
     s->addr = 0;
     s->type = type;
diff --git a/hw/mac_nvram.c b/hw/mac_nvram.c
index 7304ac27e0..f608ace71d 100644
--- a/hw/mac_nvram.c
+++ b/hw/mac_nvram.c
@@ -26,7 +26,6 @@
 #include "ppc_mac.h"
 
 struct MacIONVRAMState {
-    target_phys_addr_t mem_base;
     target_phys_addr_t size;
     int mem_index;
     uint8_t data[0x2000];
@@ -62,7 +61,6 @@ static void macio_nvram_writeb (void *opaque,
 {
     MacIONVRAMState *s = opaque;
 
-    addr -= s->mem_base;
     addr = (addr >> 4) & 0x1fff;
     s->data[addr] = value;
     //    printf("macio_nvram_writeb %04x = %02x\n", addr, value);
@@ -73,7 +71,6 @@ static uint32_t macio_nvram_readb (void *opaque, target_phys_addr_t addr)
     MacIONVRAMState *s = opaque;
     uint32_t value;
 
-    addr -= s->mem_base;
     addr = (addr >> 4) & 0x1fff;
     value = s->data[addr];
     //    printf("macio_nvram_readb %04x = %02x\n", addr, value);
@@ -112,7 +109,6 @@ void macio_nvram_map (void *opaque, target_phys_addr_t mem_base)
     MacIONVRAMState *s;
 
     s = opaque;
-    s->mem_base = mem_base;
     cpu_register_physical_memory(mem_base, s->size, s->mem_index);
 }
 
diff --git a/hw/mc146818rtc.c b/hw/mc146818rtc.c
index 30bb0449da..ac41a947b8 100644
--- a/hw/mc146818rtc.c
+++ b/hw/mc146818rtc.c
@@ -59,7 +59,6 @@ struct RTCState {
     uint8_t cmos_index;
     struct tm current_tm;
     qemu_irq irq;
-    target_phys_addr_t base;
     int it_shift;
     /* periodic timer */
     QEMUTimer *periodic_timer;
@@ -492,7 +491,7 @@ static uint32_t cmos_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     RTCState *s = opaque;
 
-    return cmos_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFF;
+    return cmos_ioport_read(s, addr >> s->it_shift) & 0xFF;
 }
 
 static void cmos_mm_writeb (void *opaque,
@@ -500,7 +499,7 @@ static void cmos_mm_writeb (void *opaque,
 {
     RTCState *s = opaque;
 
-    cmos_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFF);
+    cmos_ioport_write(s, addr >> s->it_shift, value & 0xFF);
 }
 
 static uint32_t cmos_mm_readw (void *opaque, target_phys_addr_t addr)
@@ -508,7 +507,7 @@ static uint32_t cmos_mm_readw (void *opaque, target_phys_addr_t addr)
     RTCState *s = opaque;
     uint32_t val;
 
-    val = cmos_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFFFF;
+    val = cmos_ioport_read(s, addr >> s->it_shift) & 0xFFFF;
 #ifdef TARGET_WORDS_BIGENDIAN
     val = bswap16(val);
 #endif
@@ -522,7 +521,7 @@ static void cmos_mm_writew (void *opaque,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap16(value);
 #endif
-    cmos_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFFFF);
+    cmos_ioport_write(s, addr >> s->it_shift, value & 0xFFFF);
 }
 
 static uint32_t cmos_mm_readl (void *opaque, target_phys_addr_t addr)
@@ -530,7 +529,7 @@ static uint32_t cmos_mm_readl (void *opaque, target_phys_addr_t addr)
     RTCState *s = opaque;
     uint32_t val;
 
-    val = cmos_ioport_read(s, (addr - s->base) >> s->it_shift);
+    val = cmos_ioport_read(s, addr >> s->it_shift);
 #ifdef TARGET_WORDS_BIGENDIAN
     val = bswap32(val);
 #endif
@@ -544,7 +543,7 @@ static void cmos_mm_writel (void *opaque,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap32(value);
 #endif
-    cmos_ioport_write(s, (addr - s->base) >> s->it_shift, value);
+    cmos_ioport_write(s, addr >> s->it_shift, value);
 }
 
 static CPUReadMemoryFunc *rtc_mm_read[] = {
@@ -573,7 +572,6 @@ RTCState *rtc_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq)
     s->cmos_data[RTC_REG_B] = 0x02;
     s->cmos_data[RTC_REG_C] = 0x00;
     s->cmos_data[RTC_REG_D] = 0x80;
-    s->base = base;
 
     rtc_set_date_from_host(s);
 
diff --git a/hw/mcf5208.c b/hw/mcf5208.c
index f9ae588c2d..71ba3fb0a2 100644
--- a/hw/mcf5208.c
+++ b/hw/mcf5208.c
@@ -40,9 +40,10 @@ static void m5208_timer_update(m5208_timer_state *s)
         qemu_irq_lower(s->irq);
 }
 
-static void m5208_timer_write(m5208_timer_state *s, int offset,
+static void m5208_timer_write(void *opaque, target_phys_addr_t offset,
                               uint32_t value)
 {
+    m5208_timer_state *s = (m5208_timer_state *)opaque;
     int prescale;
     int limit;
     switch (offset) {
@@ -88,8 +89,9 @@ static void m5208_timer_write(m5208_timer_state *s, int offset,
     case 4:
         break;
     default:
-        /* Should never happen.  */
-        abort();
+        cpu_abort(cpu_single_env, "m5208_timer_write: Bad offset 0x%x\n",
+                  (int)offset);
+        break;
     }
     m5208_timer_update(s);
 }
@@ -101,31 +103,39 @@ static void m5208_timer_trigger(void *opaque)
     m5208_timer_update(s);
 }
 
-typedef struct {
-    m5208_timer_state timer[2];
-} m5208_sys_state;
+static uint32_t m5208_timer_read(void *opaque, target_phys_addr_t addr)
+{
+    m5208_timer_state *s = (m5208_timer_state *)opaque;
+    switch (addr) {
+    case 0:
+        return s->pcsr;
+    case 2:
+        return s->pmr;
+    case 4:
+        return ptimer_get_count(s->timer);
+    default:
+        cpu_abort(cpu_single_env, "m5208_timer_read: Bad offset 0x%x\n",
+                  (int)addr);
+        return 0;
+    }
+}
+
+static CPUReadMemoryFunc *m5208_timer_readfn[] = {
+   m5208_timer_read,
+   m5208_timer_read,
+   m5208_timer_read
+};
+
+static CPUWriteMemoryFunc *m5208_timer_writefn[] = {
+   m5208_timer_write,
+   m5208_timer_write,
+   m5208_timer_write
+};
 
 static uint32_t m5208_sys_read(void *opaque, target_phys_addr_t addr)
 {
-    m5208_sys_state *s = (m5208_sys_state *)opaque;
     switch (addr) {
-    /* PIT0 */
-    case 0xfc080000:
-        return s->timer[0].pcsr;
-    case 0xfc080002:
-        return s->timer[0].pmr;
-    case 0xfc080004:
-        return ptimer_get_count(s->timer[0].timer);
-    /* PIT1 */
-    case 0xfc084000:
-        return s->timer[1].pcsr;
-    case 0xfc084002:
-        return s->timer[1].pmr;
-    case 0xfc084004:
-        return ptimer_get_count(s->timer[1].timer);
-
-    /* SDRAM Controller.  */
-    case 0xfc0a8110: /* SDCS0 */
+    case 0x110: /* SDCS0 */
         {
             int n;
             for (n = 0; n < 32; n++) {
@@ -134,7 +144,7 @@ static uint32_t m5208_sys_read(void *opaque, target_phys_addr_t addr)
             }
             return (n - 1)  | 0x40000000;
         }
-    case 0xfc0a8114: /* SDCS1 */
+    case 0x114: /* SDCS1 */
         return 0;
 
     default:
@@ -147,25 +157,8 @@ static uint32_t m5208_sys_read(void *opaque, target_phys_addr_t addr)
 static void m5208_sys_write(void *opaque, target_phys_addr_t addr,
                             uint32_t value)
 {
-    m5208_sys_state *s = (m5208_sys_state *)opaque;
-    switch (addr) {
-    /* PIT0 */
-    case 0xfc080000:
-    case 0xfc080002:
-    case 0xfc080004:
-        m5208_timer_write(&s->timer[0], addr & 0xf, value);
-        return;
-    /* PIT1 */
-    case 0xfc084000:
-    case 0xfc084002:
-    case 0xfc084004:
-        m5208_timer_write(&s->timer[1], addr & 0xf, value);
-        return;
-    default:
-        cpu_abort(cpu_single_env, "m5208_sys_write: Bad offset 0x%x\n",
-                  (int)addr);
-        break;
-    }
+    cpu_abort(cpu_single_env, "m5208_sys_write: Bad offset 0x%x\n",
+              (int)addr);
 }
 
 static CPUReadMemoryFunc *m5208_sys_readfn[] = {
@@ -183,22 +176,24 @@ static CPUWriteMemoryFunc *m5208_sys_writefn[] = {
 static void mcf5208_sys_init(qemu_irq *pic)
 {
     int iomemtype;
-    m5208_sys_state *s;
+    m5208_timer_state *s;
     QEMUBH *bh;
     int i;
 
-    s = (m5208_sys_state *)qemu_mallocz(sizeof(m5208_sys_state));
     iomemtype = cpu_register_io_memory(0, m5208_sys_readfn,
-                                       m5208_sys_writefn, s);
+                                       m5208_sys_writefn, NULL);
     /* SDRAMC.  */
     cpu_register_physical_memory(0xfc0a8000, 0x00004000, iomemtype);
     /* Timers.  */
     for (i = 0; i < 2; i++) {
-        bh = qemu_bh_new(m5208_timer_trigger, &s->timer[i]);
-        s->timer[i].timer = ptimer_init(bh);
+        s = (m5208_timer_state *)qemu_mallocz(sizeof(m5208_timer_state));
+        bh = qemu_bh_new(m5208_timer_trigger, s);
+        s->timer = ptimer_init(bh);
+        iomemtype = cpu_register_io_memory(0, m5208_timer_readfn,
+                                           m5208_timer_writefn, s);
         cpu_register_physical_memory(0xfc080000 + 0x4000 * i, 0x00004000,
                                      iomemtype);
-        s->timer[i].irq = pic[4 + i];
+        s->irq = pic[4 + i];
     }
 }
 
diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index 5027f8dc84..972c71c9d8 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -433,6 +433,7 @@ static MaltaFPGAState *malta_fpga_init(target_phys_addr_t base, CPUState *env)
                                    malta_fpga_write, s);
 
     cpu_register_physical_memory(base, 0x900, malta);
+    /* 0xa00 is less than a page, so will still get the right offsets.  */
     cpu_register_physical_memory(base + 0xa00, 0x100000 - 0xa00, malta);
 
     s->display = qemu_chr_open("fpga", "vc:320x200");
diff --git a/hw/mpcore.c b/hw/mpcore.c
index d5b28fe4bd..17c8d6c6e1 100644
--- a/hw/mpcore.c
+++ b/hw/mpcore.c
@@ -265,7 +265,7 @@ static qemu_irq *mpcore_priv_init(uint32_t base, qemu_irq *pic_irq)
     s = (mpcore_priv_state *)qemu_mallocz(sizeof(mpcore_priv_state));
     if (!s)
         return NULL;
-    s->gic = gic_init(base, pic_irq);
+    s->gic = gic_init(base + 0x1000, pic_irq);
     if (!s->gic)
         return NULL;
     iomemtype = cpu_register_io_memory(0, mpcore_priv_readfn,
diff --git a/hw/mst_fpga.c b/hw/mst_fpga.c
index 2d5ac5ae8d..9327952cf3 100644
--- a/hw/mst_fpga.c
+++ b/hw/mst_fpga.c
@@ -14,7 +14,6 @@
 /* Mainstone FPGA for extern irqs */
 #define FPGA_GPIO_PIN	0
 #define MST_NUM_IRQS	16
-#define MST_BASE		MST_FPGA_PHYS
 #define MST_LEDDAT1		0x10
 #define MST_LEDDAT2		0x14
 #define MST_LEDCTRL		0x40
@@ -29,7 +28,6 @@
 #define MST_PCMCIA1		0xe4
 
 typedef struct mst_irq_state{
-	target_phys_addr_t target_base;
 	qemu_irq *parent;
 	qemu_irq *pins;
 
@@ -83,7 +81,6 @@ static uint32_t
 mst_fpga_readb(void *opaque, target_phys_addr_t addr)
 {
 	mst_irq_state *s = (mst_irq_state *) opaque;
-	addr -= s->target_base;
 
 	switch (addr) {
 	case MST_LEDDAT1:
@@ -121,7 +118,6 @@ static void
 mst_fpga_writeb(void *opaque, target_phys_addr_t addr, uint32_t value)
 {
 	mst_irq_state *s = (mst_irq_state *) opaque;
-	addr -= s->target_base;
 	value &= 0xffffffff;
 
 	switch (addr) {
@@ -231,7 +227,6 @@ qemu_irq *mst_irq_init(struct pxa2xx_state_s *cpu, uint32_t base, int irq)
 
 	if (!s)
 		return NULL;
-	s->target_base = base;
 	s->parent = &cpu->pic[irq];
 
 	/* alloc the external 16 irqs */
@@ -240,7 +235,7 @@ qemu_irq *mst_irq_init(struct pxa2xx_state_s *cpu, uint32_t base, int irq)
 
 	iomemtype = cpu_register_io_memory(0, mst_fpga_readfn,
 		mst_fpga_writefn, s);
-	cpu_register_physical_memory(MST_BASE, 0x00100000, iomemtype);
+	cpu_register_physical_memory(base, 0x00100000, iomemtype);
 	register_savevm("mainstone_fpga", 0, 0, mst_fpga_save, mst_fpga_load, s);
 	return qi;
 }
diff --git a/hw/musicpal.c b/hw/musicpal.c
index 313b1341cd..c5a5b6f122 100644
--- a/hw/musicpal.c
+++ b/hw/musicpal.c
@@ -239,7 +239,6 @@ static i2c_interface *mixer_i2c;
 static const char audio_name[] = "mv88w8618";
 
 typedef struct musicpal_audio_state {
-    uint32_t base;
     qemu_irq irq;
     uint32_t playback_mode;
     uint32_t status;
@@ -334,7 +333,6 @@ static uint32_t musicpal_audio_read(void *opaque, target_phys_addr_t offset)
 {
     musicpal_audio_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_AUDIO_PLAYBACK_MODE:
         return s->playback_mode;
@@ -361,7 +359,6 @@ static void musicpal_audio_write(void *opaque, target_phys_addr_t offset,
 {
     musicpal_audio_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_AUDIO_PLAYBACK_MODE:
         if (value & MP_AUDIO_PLAYBACK_EN &&
@@ -448,7 +445,6 @@ static i2c_interface *musicpal_audio_init(uint32_t base, qemu_irq irq)
     s = qemu_mallocz(sizeof(musicpal_audio_state));
     if (!s)
         return NULL;
-    s->base = base;
     s->irq = irq;
 
     i2c = qemu_mallocz(sizeof(i2c_interface));
@@ -549,7 +545,6 @@ typedef struct mv88w8618_rx_desc {
 } mv88w8618_rx_desc;
 
 typedef struct mv88w8618_eth_state {
-    uint32_t base;
     qemu_irq irq;
     uint32_t smir;
     uint32_t icr;
@@ -617,7 +612,6 @@ static uint32_t mv88w8618_eth_read(void *opaque, target_phys_addr_t offset)
 {
     mv88w8618_eth_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_ETH_SMIR:
         if (s->smir & MP_ETH_SMIR_OPCODE) {
@@ -660,7 +654,6 @@ static void mv88w8618_eth_write(void *opaque, target_phys_addr_t offset,
 {
     mv88w8618_eth_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_ETH_SMIR:
         s->smir = value;
@@ -724,7 +717,6 @@ static void mv88w8618_eth_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     s = qemu_mallocz(sizeof(mv88w8618_eth_state));
     if (!s)
         return;
-    s->base = base;
     s->irq = irq;
     s->vc = qemu_new_vlan_client(nd->vlan, eth_receive, eth_can_receive, s);
     iomemtype = cpu_register_io_memory(0, mv88w8618_eth_readfn,
@@ -752,7 +744,6 @@ static void mv88w8618_eth_init(NICInfo *nd, uint32_t base, qemu_irq irq)
 #define MP_LCD_TEXTCOLOR        0xe0e0ff /* RRGGBB */
 
 typedef struct musicpal_lcd_state {
-    uint32_t base;
     uint32_t mode;
     uint32_t irqctrl;
     int page;
@@ -852,7 +843,6 @@ static uint32_t musicpal_lcd_read(void *opaque, target_phys_addr_t offset)
 {
     musicpal_lcd_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_LCD_IRQCTRL:
         return s->irqctrl;
@@ -867,7 +857,6 @@ static void musicpal_lcd_write(void *opaque, target_phys_addr_t offset,
 {
     musicpal_lcd_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_LCD_IRQCTRL:
         s->irqctrl = value;
@@ -922,7 +911,6 @@ static void musicpal_lcd_init(DisplayState *ds, uint32_t base)
     s = qemu_mallocz(sizeof(musicpal_lcd_state));
     if (!s)
         return;
-    s->base = base;
     s->ds = ds;
     iomemtype = cpu_register_io_memory(0, musicpal_lcd_readfn,
                                        musicpal_lcd_writefn, s);
@@ -940,7 +928,6 @@ static void musicpal_lcd_init(DisplayState *ds, uint32_t base)
 
 typedef struct mv88w8618_pic_state
 {
-    uint32_t base;
     uint32_t level;
     uint32_t enabled;
     qemu_irq parent_irq;
@@ -966,7 +953,6 @@ static uint32_t mv88w8618_pic_read(void *opaque, target_phys_addr_t offset)
 {
     mv88w8618_pic_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_PIC_STATUS:
         return s->level & s->enabled;
@@ -981,7 +967,6 @@ static void mv88w8618_pic_write(void *opaque, target_phys_addr_t offset,
 {
     mv88w8618_pic_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_PIC_ENABLE_SET:
         s->enabled |= value;
@@ -1025,7 +1010,6 @@ static qemu_irq *mv88w8618_pic_init(uint32_t base, qemu_irq parent_irq)
     if (!s)
         return NULL;
     qi = qemu_allocate_irqs(mv88w8618_pic_set_irq, s, 32);
-    s->base = base;
     s->parent_irq = parent_irq;
     iomemtype = cpu_register_io_memory(0, mv88w8618_pic_readfn,
                                        mv88w8618_pic_writefn, s);
@@ -1059,7 +1043,6 @@ typedef struct mv88w8618_timer_state {
 typedef struct mv88w8618_pit_state {
     void *timer[4];
     uint32_t control;
-    uint32_t base;
 } mv88w8618_pit_state;
 
 static void mv88w8618_timer_tick(void *opaque)
@@ -1089,7 +1072,6 @@ static uint32_t mv88w8618_pit_read(void *opaque, target_phys_addr_t offset)
     mv88w8618_pit_state *s = opaque;
     mv88w8618_timer_state *t;
 
-    offset -= s->base;
     switch (offset) {
     case MP_PIT_TIMER1_VALUE ... MP_PIT_TIMER4_VALUE:
         t = s->timer[(offset-MP_PIT_TIMER1_VALUE) >> 2];
@@ -1107,7 +1089,6 @@ static void mv88w8618_pit_write(void *opaque, target_phys_addr_t offset,
     mv88w8618_timer_state *t;
     int i;
 
-    offset -= s->base;
     switch (offset) {
     case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:
         t = s->timer[offset >> 2];
@@ -1155,7 +1136,6 @@ static void mv88w8618_pit_init(uint32_t base, qemu_irq *pic, int irq)
     if (!s)
         return;
 
-    s->base = base;
     /* Letting them all run at 1 MHz is likely just a pragmatic
      * simplification. */
     s->timer[0] = mv88w8618_timer_init(1000000, pic[irq]);
@@ -1172,7 +1152,6 @@ static void mv88w8618_pit_init(uint32_t base, qemu_irq *pic, int irq)
 #define MP_FLASHCFG_CFGR0    0x04
 
 typedef struct mv88w8618_flashcfg_state {
-    uint32_t base;
     uint32_t cfgr0;
 } mv88w8618_flashcfg_state;
 
@@ -1181,7 +1160,6 @@ static uint32_t mv88w8618_flashcfg_read(void *opaque,
 {
     mv88w8618_flashcfg_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_FLASHCFG_CFGR0:
         return s->cfgr0;
@@ -1196,7 +1174,6 @@ static void mv88w8618_flashcfg_write(void *opaque, target_phys_addr_t offset,
 {
     mv88w8618_flashcfg_state *s = opaque;
 
-    offset -= s->base;
     switch (offset) {
     case MP_FLASHCFG_CFGR0:
         s->cfgr0 = value;
@@ -1225,7 +1202,6 @@ static void mv88w8618_flashcfg_init(uint32_t base)
     if (!s)
         return;
 
-    s->base = base;
     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
     iomemtype = cpu_register_io_memory(0, mv88w8618_flashcfg_readfn,
                        mv88w8618_flashcfg_writefn, s);
@@ -1266,7 +1242,6 @@ static void mv88w8618_flashcfg_init(uint32_t base)
 
 static uint32_t musicpal_read(void *opaque, target_phys_addr_t offset)
 {
-    offset -= 0x80000000;
     switch (offset) {
     case MP_BOARD_REVISION:
         return 0x0031;
@@ -1307,7 +1282,6 @@ static uint32_t musicpal_read(void *opaque, target_phys_addr_t offset)
 static void musicpal_write(void *opaque, target_phys_addr_t offset,
                            uint32_t value)
 {
-    offset -= 0x80000000;
     switch (offset) {
     case MP_GPIO_OE_HI: /* used for LCD brightness control */
         lcd_brightness = (lcd_brightness & MP_GPIO_LCD_BRIGHTNESS) |
diff --git a/hw/omap.h b/hw/omap.h
index 4c30436a3e..51a2021f4f 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -890,11 +890,9 @@ struct omap_mpu_state_s {
 
     struct omap_lcd_panel_s *lcd;
 
-    target_phys_addr_t ulpd_pm_base;
     uint32_t ulpd_pm_regs[21];
     int64_t ulpd_gauge_start;
 
-    target_phys_addr_t pin_cfg_base;
     uint32_t func_mux_ctrl[14];
     uint32_t comp_mode_ctrl[1];
     uint32_t pull_dwn_ctrl[4];
@@ -905,25 +903,19 @@ struct omap_mpu_state_s {
     int compat1509;
 
     uint32_t mpui_ctrl;
-    target_phys_addr_t mpui_base;
 
     struct omap_tipb_bridge_s *private_tipb;
     struct omap_tipb_bridge_s *public_tipb;
 
-    target_phys_addr_t tcmi_base;
     uint32_t tcmi_regs[17];
 
     struct dpll_ctl_s {
-        target_phys_addr_t base;
         uint16_t mode;
         omap_clk dpll;
     } dpll[3];
 
     omap_clk clks;
     struct {
-        target_phys_addr_t mpu_base;
-        target_phys_addr_t dsp_base;
-
         int cold_start;
         int clocking_scheme;
         uint16_t arm_ckctl;
@@ -944,10 +936,7 @@ struct omap_mpu_state_s {
 
     struct omap_gp_timer_s *gptimer[12];
 
-    target_phys_addr_t tap_base;
-
     struct omap_synctimer_s {
-        target_phys_addr_t base;
         uint32_t val;
         uint16_t readh;
     } synctimer;
diff --git a/hw/omap1.c b/hw/omap1.c
index 0c3b5cd234..85a253ea68 100644
--- a/hw/omap1.c
+++ b/hw/omap1.c
@@ -95,7 +95,6 @@ struct omap_intr_handler_bank_s {
 struct omap_intr_handler_s {
     qemu_irq *pins;
     qemu_irq parent_intr[2];
-    target_phys_addr_t base;
     unsigned char nbanks;
     int level_only;
 
@@ -202,7 +201,7 @@ static void omap_set_intr_noedge(void *opaque, int irq, int req)
 static uint32_t omap_inth_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int i, offset = addr - s->base;
+    int i, offset = addr;
     int bank_no = offset >> 8;
     int line_no;
     struct omap_intr_handler_bank_s *bank = &s->bank[bank_no];
@@ -280,7 +279,7 @@ static void omap_inth_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int i, offset = addr - s->base;
+    int i, offset = addr;
     int bank_no = offset >> 8;
     struct omap_intr_handler_bank_s *bank = &s->bank[bank_no];
     offset &= 0xff;
@@ -420,7 +419,6 @@ struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
 
     s->parent_intr[0] = parent_irq;
     s->parent_intr[1] = parent_fiq;
-    s->base = base;
     s->nbanks = nbanks;
     s->pins = qemu_allocate_irqs(omap_set_intr, s, nbanks * 32);
     if (pins)
@@ -430,7 +428,7 @@ struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_inth_readfn,
                     omap_inth_writefn, s);
-    cpu_register_physical_memory(s->base, size, iomemtype);
+    cpu_register_physical_memory(base, size, iomemtype);
 
     return s;
 }
@@ -438,7 +436,7 @@ struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,
 static uint32_t omap2_inth_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int offset = addr - s->base;
+    int offset = addr;
     int bank_no, line_no;
     struct omap_intr_handler_bank_s *bank = 0;
 
@@ -516,7 +514,7 @@ static void omap2_inth_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *) opaque;
-    int offset = addr - s->base;
+    int offset = addr;
     int bank_no, line_no;
     struct omap_intr_handler_bank_s *bank = 0;
 
@@ -640,7 +638,6 @@ struct omap_intr_handler_s *omap2_inth_init(target_phys_addr_t base,
 
     s->parent_intr[0] = parent_irq;
     s->parent_intr[1] = parent_fiq;
-    s->base = base;
     s->nbanks = nbanks;
     s->level_only = 1;
     s->pins = qemu_allocate_irqs(omap_set_intr_noedge, s, nbanks * 32);
@@ -651,7 +648,7 @@ struct omap_intr_handler_s *omap2_inth_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap2_inth_readfn,
                     omap2_inth_writefn, s);
-    cpu_register_physical_memory(s->base, size, iomemtype);
+    cpu_register_physical_memory(base, size, iomemtype);
 
     return s;
 }
@@ -660,7 +657,6 @@ struct omap_intr_handler_s *omap2_inth_init(target_phys_addr_t base,
 struct omap_mpu_timer_s {
     qemu_irq irq;
     omap_clk clk;
-    target_phys_addr_t base;
     uint32_t val;
     int64_t time;
     QEMUTimer *timer;
@@ -757,9 +753,8 @@ static void omap_timer_clk_setup(struct omap_mpu_timer_s *timer)
 static uint32_t omap_mpu_timer_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* CNTL_TIMER */
         return (s->enable << 5) | (s->ptv << 2) | (s->ar << 1) | s->st;
 
@@ -778,9 +773,8 @@ static void omap_mpu_timer_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* CNTL_TIMER */
         omap_timer_sync(s);
         s->enable = (value >> 5) & 1;
@@ -836,7 +830,6 @@ struct omap_mpu_timer_s *omap_mpu_timer_init(target_phys_addr_t base,
 
     s->irq = irq;
     s->clk = clk;
-    s->base = base;
     s->timer = qemu_new_timer(vm_clock, omap_timer_tick, s);
     s->tick = qemu_bh_new(omap_timer_fire, s);
     omap_mpu_timer_reset(s);
@@ -844,7 +837,7 @@ struct omap_mpu_timer_s *omap_mpu_timer_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_mpu_timer_readfn,
                     omap_mpu_timer_writefn, s);
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     return s;
 }
@@ -861,9 +854,8 @@ struct omap_watchdog_timer_s {
 static uint32_t omap_wd_timer_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *) opaque;
-    int offset = addr - s->timer.base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* CNTL_TIMER */
         return (s->timer.ptv << 9) | (s->timer.ar << 8) |
                 (s->timer.st << 7) | (s->free << 1);
@@ -883,9 +875,8 @@ static void omap_wd_timer_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *) opaque;
-    int offset = addr - s->timer.base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* CNTL_TIMER */
         omap_timer_sync(&s->timer);
         s->timer.ptv = (value >> 9) & 7;
@@ -963,14 +954,13 @@ struct omap_watchdog_timer_s *omap_wd_timer_init(target_phys_addr_t base,
 
     s->timer.irq = irq;
     s->timer.clk = clk;
-    s->timer.base = base;
     s->timer.timer = qemu_new_timer(vm_clock, omap_timer_tick, &s->timer);
     omap_wd_timer_reset(s);
     omap_timer_clk_setup(&s->timer);
 
     iomemtype = cpu_register_io_memory(0, omap_wd_timer_readfn,
                     omap_wd_timer_writefn, s);
-    cpu_register_physical_memory(s->timer.base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     return s;
 }
@@ -1066,14 +1056,13 @@ struct omap_32khz_timer_s *omap_os_timer_init(target_phys_addr_t base,
 
     s->timer.irq = irq;
     s->timer.clk = clk;
-    s->timer.base = base;
     s->timer.timer = qemu_new_timer(vm_clock, omap_timer_tick, &s->timer);
     omap_os_timer_reset(s);
     omap_timer_clk_setup(&s->timer);
 
     iomemtype = cpu_register_io_memory(0, omap_os_timer_readfn,
                     omap_os_timer_writefn, s);
-    cpu_register_physical_memory(s->timer.base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
@@ -1082,13 +1071,12 @@ struct omap_32khz_timer_s *omap_os_timer_init(target_phys_addr_t base,
 static uint32_t omap_ulpd_pm_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->ulpd_pm_base;
     uint16_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x14:	/* IT_STATUS */
-        ret = s->ulpd_pm_regs[offset >> 2];
-        s->ulpd_pm_regs[offset >> 2] = 0;
+        ret = s->ulpd_pm_regs[addr >> 2];
+        s->ulpd_pm_regs[addr >> 2] = 0;
         qemu_irq_lower(s->irq[1][OMAP_INT_GAUGE_32K]);
         return ret;
 
@@ -1113,7 +1101,7 @@ static uint32_t omap_ulpd_pm_read(void *opaque, target_phys_addr_t addr)
     case 0x48:	/* LOCL_TIME */
     case 0x4c:	/* APLL_CTRL */
     case 0x50:	/* POWER_CTRL */
-        return s->ulpd_pm_regs[offset >> 2];
+        return s->ulpd_pm_regs[addr >> 2];
     }
 
     OMAP_BAD_REG(addr);
@@ -1146,13 +1134,12 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->ulpd_pm_base;
     int64_t now, ticks;
     int div, mult;
     static const int bypass_div[4] = { 1, 2, 4, 4 };
     uint16_t diff;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* COUNTER_32_LSB */
     case 0x04:	/* COUNTER_32_MSB */
     case 0x08:	/* COUNTER_HIGH_FREQ_LSB */
@@ -1164,7 +1151,7 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
 
     case 0x10:	/* GAUGING_CTRL */
         /* Bits 0 and 1 seem to be confused in the OMAP 310 TRM */
-        if ((s->ulpd_pm_regs[offset >> 2] ^ value) & 1) {
+        if ((s->ulpd_pm_regs[addr >> 2] ^ value) & 1) {
             now = qemu_get_clock(vm_clock);
 
             if (value & 1)
@@ -1190,7 +1177,7 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
                 qemu_irq_raise(s->irq[1][OMAP_INT_GAUGE_32K]);
             }
         }
-        s->ulpd_pm_regs[offset >> 2] = value;
+        s->ulpd_pm_regs[addr >> 2] = value;
         break;
 
     case 0x18:	/* Reserved */
@@ -1203,18 +1190,18 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
     case 0x38:	/* COUNTER_32_FIQ */
     case 0x48:	/* LOCL_TIME */
     case 0x50:	/* POWER_CTRL */
-        s->ulpd_pm_regs[offset >> 2] = value;
+        s->ulpd_pm_regs[addr >> 2] = value;
         break;
 
     case 0x30:	/* CLOCK_CTRL */
-        diff = s->ulpd_pm_regs[offset >> 2] ^ value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0x3f;
+        diff = s->ulpd_pm_regs[addr >> 2] ^ value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0x3f;
         omap_ulpd_clk_update(s, diff, value);
         break;
 
     case 0x34:	/* SOFT_REQ */
-        diff = s->ulpd_pm_regs[offset >> 2] ^ value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0x1f;
+        diff = s->ulpd_pm_regs[addr >> 2] ^ value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0x1f;
         omap_ulpd_req_update(s, diff, value);
         break;
 
@@ -1223,8 +1210,8 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
          * omitted altogether, probably a typo.  */
         /* This register has identical semantics with DPLL(1:3) control
          * registers, see omap_dpll_write() */
-        diff = s->ulpd_pm_regs[offset >> 2] & value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0x2fff;
+        diff = s->ulpd_pm_regs[addr >> 2] & value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0x2fff;
         if (diff & (0x3ff << 2)) {
             if (value & (1 << 4)) {			/* PLL_ENABLE */
                 div = ((value >> 5) & 3) + 1;		/* PLL_DIV */
@@ -1237,17 +1224,17 @@ static void omap_ulpd_pm_write(void *opaque, target_phys_addr_t addr,
         }
 
         /* Enter the desired mode.  */
-        s->ulpd_pm_regs[offset >> 2] =
-                (s->ulpd_pm_regs[offset >> 2] & 0xfffe) |
-                ((s->ulpd_pm_regs[offset >> 2] >> 4) & 1);
+        s->ulpd_pm_regs[addr >> 2] =
+                (s->ulpd_pm_regs[addr >> 2] & 0xfffe) |
+                ((s->ulpd_pm_regs[addr >> 2] >> 4) & 1);
 
         /* Act as if the lock is restored.  */
-        s->ulpd_pm_regs[offset >> 2] |= 2;
+        s->ulpd_pm_regs[addr >> 2] |= 2;
         break;
 
     case 0x4c:	/* APLL_CTRL */
-        diff = s->ulpd_pm_regs[offset >> 2] & value;
-        s->ulpd_pm_regs[offset >> 2] = value & 0xf;
+        diff = s->ulpd_pm_regs[addr >> 2] & value;
+        s->ulpd_pm_regs[addr >> 2] = value & 0xf;
         if (diff & (1 << 0))				/* APLL_NDPLL_SWITCH */
             omap_clk_reparent(omap_findclk(s, "ck_48m"), omap_findclk(s,
                                     (value & (1 << 0)) ? "apll" : "dpll4"));
@@ -1303,8 +1290,7 @@ static void omap_ulpd_pm_init(target_phys_addr_t base,
     int iomemtype = cpu_register_io_memory(0, omap_ulpd_pm_readfn,
                     omap_ulpd_pm_writefn, mpu);
 
-    mpu->ulpd_pm_base = base;
-    cpu_register_physical_memory(mpu->ulpd_pm_base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
     omap_ulpd_pm_reset(mpu);
 }
 
@@ -1312,13 +1298,12 @@ static void omap_ulpd_pm_init(target_phys_addr_t base,
 static uint32_t omap_pin_cfg_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->pin_cfg_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* FUNC_MUX_CTRL_0 */
     case 0x04:	/* FUNC_MUX_CTRL_1 */
     case 0x08:	/* FUNC_MUX_CTRL_2 */
-        return s->func_mux_ctrl[offset >> 2];
+        return s->func_mux_ctrl[addr >> 2];
 
     case 0x0c:	/* COMP_MODE_CTRL_0 */
         return s->comp_mode_ctrl[0];
@@ -1334,13 +1319,13 @@ static uint32_t omap_pin_cfg_read(void *opaque, target_phys_addr_t addr)
     case 0x30:	/* FUNC_MUX_CTRL_B */
     case 0x34:	/* FUNC_MUX_CTRL_C */
     case 0x38:	/* FUNC_MUX_CTRL_D */
-        return s->func_mux_ctrl[(offset >> 2) - 1];
+        return s->func_mux_ctrl[(addr >> 2) - 1];
 
     case 0x40:	/* PULL_DWN_CTRL_0 */
     case 0x44:	/* PULL_DWN_CTRL_1 */
     case 0x48:	/* PULL_DWN_CTRL_2 */
     case 0x4c:	/* PULL_DWN_CTRL_3 */
-        return s->pull_dwn_ctrl[(offset & 0xf) >> 2];
+        return s->pull_dwn_ctrl[(addr & 0xf) >> 2];
 
     case 0x50:	/* GATE_INH_CTRL_0 */
         return s->gate_inh_ctrl[0];
@@ -1416,24 +1401,23 @@ static void omap_pin_cfg_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->pin_cfg_base;
     uint32_t diff;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* FUNC_MUX_CTRL_0 */
-        diff = s->func_mux_ctrl[offset >> 2] ^ value;
-        s->func_mux_ctrl[offset >> 2] = value;
+        diff = s->func_mux_ctrl[addr >> 2] ^ value;
+        s->func_mux_ctrl[addr >> 2] = value;
         omap_pin_funcmux0_update(s, diff, value);
         return;
 
     case 0x04:	/* FUNC_MUX_CTRL_1 */
-        diff = s->func_mux_ctrl[offset >> 2] ^ value;
-        s->func_mux_ctrl[offset >> 2] = value;
+        diff = s->func_mux_ctrl[addr >> 2] ^ value;
+        s->func_mux_ctrl[addr >> 2] = value;
         omap_pin_funcmux1_update(s, diff, value);
         return;
 
     case 0x08:	/* FUNC_MUX_CTRL_2 */
-        s->func_mux_ctrl[offset >> 2] = value;
+        s->func_mux_ctrl[addr >> 2] = value;
         return;
 
     case 0x0c:	/* COMP_MODE_CTRL_0 */
@@ -1454,14 +1438,14 @@ static void omap_pin_cfg_write(void *opaque, target_phys_addr_t addr,
     case 0x30:	/* FUNC_MUX_CTRL_B */
     case 0x34:	/* FUNC_MUX_CTRL_C */
     case 0x38:	/* FUNC_MUX_CTRL_D */
-        s->func_mux_ctrl[(offset >> 2) - 1] = value;
+        s->func_mux_ctrl[(addr >> 2) - 1] = value;
         return;
 
     case 0x40:	/* PULL_DWN_CTRL_0 */
     case 0x44:	/* PULL_DWN_CTRL_1 */
     case 0x48:	/* PULL_DWN_CTRL_2 */
     case 0x4c:	/* PULL_DWN_CTRL_3 */
-        s->pull_dwn_ctrl[(offset & 0xf) >> 2] = value;
+        s->pull_dwn_ctrl[(addr & 0xf) >> 2] = value;
         return;
 
     case 0x50:	/* GATE_INH_CTRL_0 */
@@ -1521,8 +1505,7 @@ static void omap_pin_cfg_init(target_phys_addr_t base,
     int iomemtype = cpu_register_io_memory(0, omap_pin_cfg_readfn,
                     omap_pin_cfg_writefn, mpu);
 
-    mpu->pin_cfg_base = base;
-    cpu_register_physical_memory(mpu->pin_cfg_base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
     omap_pin_cfg_reset(mpu);
 }
 
@@ -1591,19 +1574,18 @@ static void omap_id_init(struct omap_mpu_state_s *mpu)
 {
     int iomemtype = cpu_register_io_memory(0, omap_id_readfn,
                     omap_id_writefn, mpu);
-    cpu_register_physical_memory(0xfffe1800, 0x800, iomemtype);
-    cpu_register_physical_memory(0xfffed400, 0x100, iomemtype);
+    cpu_register_physical_memory_offset(0xfffe1800, 0x800, iomemtype, 0xfffe1800);
+    cpu_register_physical_memory_offset(0xfffed400, 0x100, iomemtype, 0xfffed400);
     if (!cpu_is_omap15xx(mpu))
-        cpu_register_physical_memory(0xfffe2000, 0x800, iomemtype);
+        cpu_register_physical_memory_offset(0xfffe2000, 0x800, iomemtype, 0xfffe2000);
 }
 
 /* MPUI Control (Dummy) */
 static uint32_t omap_mpui_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->mpui_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* CTRL */
         return s->mpui_ctrl;
     case 0x04:	/* DEBUG_ADDR */
@@ -1631,9 +1613,8 @@ static void omap_mpui_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->mpui_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* CTRL */
         s->mpui_ctrl = value & 0x007fffff;
         break;
@@ -1677,15 +1658,13 @@ static void omap_mpui_init(target_phys_addr_t base,
     int iomemtype = cpu_register_io_memory(0, omap_mpui_readfn,
                     omap_mpui_writefn, mpu);
 
-    mpu->mpui_base = base;
-    cpu_register_physical_memory(mpu->mpui_base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     omap_mpui_reset(mpu);
 }
 
 /* TIPB Bridges */
 struct omap_tipb_bridge_s {
-    target_phys_addr_t base;
     qemu_irq abort;
 
     int width_intr;
@@ -1698,9 +1677,8 @@ struct omap_tipb_bridge_s {
 static uint32_t omap_tipb_bridge_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* TIPB_CNTL */
         return s->control;
     case 0x04:	/* TIPB_BUS_ALLOC */
@@ -1725,9 +1703,8 @@ static void omap_tipb_bridge_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* TIPB_CNTL */
         s->control = value & 0xffff;
         break;
@@ -1785,12 +1762,11 @@ struct omap_tipb_bridge_s *omap_tipb_bridge_init(target_phys_addr_t base,
             qemu_mallocz(sizeof(struct omap_tipb_bridge_s));
 
     s->abort = abort_irq;
-    s->base = base;
     omap_tipb_bridge_reset(s);
 
     iomemtype = cpu_register_io_memory(0, omap_tipb_bridge_readfn,
                     omap_tipb_bridge_writefn, s);
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     return s;
 }
@@ -1799,10 +1775,9 @@ struct omap_tipb_bridge_s *omap_tipb_bridge_init(target_phys_addr_t base,
 static uint32_t omap_tcmi_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->tcmi_base;
     uint32_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* IMIF_PRIO */
     case 0x04:	/* EMIFS_PRIO */
     case 0x08:	/* EMIFF_PRIO */
@@ -1817,11 +1792,11 @@ static uint32_t omap_tcmi_read(void *opaque, target_phys_addr_t addr)
     case 0x30:	/* TIMEOUT3 */
     case 0x3c:	/* EMIFF_SDRAM_CONFIG_2 */
     case 0x40:	/* EMIFS_CFG_DYN_WAIT */
-        return s->tcmi_regs[offset >> 2];
+        return s->tcmi_regs[addr >> 2];
 
     case 0x20:	/* EMIFF_SDRAM_CONFIG */
-        ret = s->tcmi_regs[offset >> 2];
-        s->tcmi_regs[offset >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */
+        ret = s->tcmi_regs[addr >> 2];
+        s->tcmi_regs[addr >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */
         /* XXX: We can try using the VGA_DIRTY flag for this */
         return ret;
     }
@@ -1834,9 +1809,8 @@ static void omap_tcmi_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->tcmi_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* IMIF_PRIO */
     case 0x04:	/* EMIFS_PRIO */
     case 0x08:	/* EMIFF_PRIO */
@@ -1851,10 +1825,10 @@ static void omap_tcmi_write(void *opaque, target_phys_addr_t addr,
     case 0x30:	/* TIMEOUT3 */
     case 0x3c:	/* EMIFF_SDRAM_CONFIG_2 */
     case 0x40:	/* EMIFS_CFG_DYN_WAIT */
-        s->tcmi_regs[offset >> 2] = value;
+        s->tcmi_regs[addr >> 2] = value;
         break;
     case 0x0c:	/* EMIFS_CONFIG */
-        s->tcmi_regs[offset >> 2] = (value & 0xf) | (1 << 4);
+        s->tcmi_regs[addr >> 2] = (value & 0xf) | (1 << 4);
         break;
 
     default:
@@ -1899,8 +1873,7 @@ static void omap_tcmi_init(target_phys_addr_t base,
     int iomemtype = cpu_register_io_memory(0, omap_tcmi_readfn,
                     omap_tcmi_writefn, mpu);
 
-    mpu->tcmi_base = base;
-    cpu_register_physical_memory(mpu->tcmi_base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
     omap_tcmi_reset(mpu);
 }
 
@@ -1908,9 +1881,8 @@ static void omap_tcmi_init(target_phys_addr_t base,
 static uint32_t omap_dpll_read(void *opaque, target_phys_addr_t addr)
 {
     struct dpll_ctl_s *s = (struct dpll_ctl_s *) opaque;
-    int offset = addr - s->base;
 
-    if (offset == 0x00)	/* CTL_REG */
+    if (addr == 0x00)	/* CTL_REG */
         return s->mode;
 
     OMAP_BAD_REG(addr);
@@ -1922,11 +1894,10 @@ static void omap_dpll_write(void *opaque, target_phys_addr_t addr,
 {
     struct dpll_ctl_s *s = (struct dpll_ctl_s *) opaque;
     uint16_t diff;
-    int offset = addr - s->base;
     static const int bypass_div[4] = { 1, 2, 4, 4 };
     int div, mult;
 
-    if (offset == 0x00) {	/* CTL_REG */
+    if (addr == 0x00) {	/* CTL_REG */
         /* See omap_ulpd_pm_write() too */
         diff = s->mode & value;
         s->mode = value & 0x2fff;
@@ -1975,18 +1946,17 @@ static void omap_dpll_init(struct dpll_ctl_s *s, target_phys_addr_t base,
     int iomemtype = cpu_register_io_memory(0, omap_dpll_readfn,
                     omap_dpll_writefn, s);
 
-    s->base = base;
     s->dpll = clk;
     omap_dpll_reset(s);
 
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 }
 
 /* UARTs */
 struct omap_uart_s {
+    target_phys_addr_t base;
     SerialState *serial; /* TODO */
     struct omap_target_agent_s *ta;
-    target_phys_addr_t base;
     omap_clk fclk;
     qemu_irq irq;
 
@@ -2025,9 +1995,9 @@ struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
 static uint32_t omap_uart_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_uart_s *s = (struct omap_uart_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    addr &= 0xff;
+    switch (addr) {
     case 0x20:	/* MDR1 */
         return s->mdr[0];
     case 0x24:	/* MDR2 */
@@ -2058,9 +2028,9 @@ static void omap_uart_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_uart_s *s = (struct omap_uart_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    addr &= 0xff;
+    switch (addr) {
     case 0x20:	/* MDR1 */
         s->mdr[0] = value & 0x7f;
         break;
@@ -2118,7 +2088,7 @@ struct omap_uart_s *omap2_uart_init(struct omap_target_agent_s *ta,
 
     s->ta = ta;
 
-    cpu_register_physical_memory(s->base + 0x20, 0x100, iomemtype);
+    cpu_register_physical_memory(base + 0x20, 0x100, iomemtype);
 
     return s;
 }
@@ -2135,9 +2105,8 @@ void omap_uart_attach(struct omap_uart_s *s, CharDriverState *chr)
 static uint32_t omap_clkm_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.mpu_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* ARM_CKCTL */
         return s->clkm.arm_ckctl;
 
@@ -2333,7 +2302,6 @@ static void omap_clkm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.mpu_base;
     uint16_t diff;
     omap_clk clk;
     static const char *clkschemename[8] = {
@@ -2341,7 +2309,7 @@ static void omap_clkm_write(void *opaque, target_phys_addr_t addr,
         "mix mode 1", "mix mode 2", "bypass mode", "mix mode 3", "mix mode 4",
     };
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* ARM_CKCTL */
         diff = s->clkm.arm_ckctl ^ value;
         s->clkm.arm_ckctl = value & 0x7fff;
@@ -2423,9 +2391,8 @@ static CPUWriteMemoryFunc *omap_clkm_writefn[] = {
 static uint32_t omap_clkdsp_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.dsp_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x04:	/* DSP_IDLECT1 */
         return s->clkm.dsp_idlect1;
 
@@ -2464,10 +2431,9 @@ static void omap_clkdsp_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    int offset = addr - s->clkm.dsp_base;
     uint16_t diff;
 
-    switch (offset) {
+    switch (addr) {
     case 0x04:	/* DSP_IDLECT1 */
         diff = s->clkm.dsp_idlect1 ^ value;
         s->clkm.dsp_idlect1 = value & 0x01f7;
@@ -2536,21 +2502,18 @@ static void omap_clkm_init(target_phys_addr_t mpu_base,
         cpu_register_io_memory(0, omap_clkdsp_readfn, omap_clkdsp_writefn, s),
     };
 
-    s->clkm.mpu_base = mpu_base;
-    s->clkm.dsp_base = dsp_base;
     s->clkm.arm_idlect1 = 0x03ff;
     s->clkm.arm_idlect2 = 0x0100;
     s->clkm.dsp_idlect1 = 0x0002;
     omap_clkm_reset(s);
     s->clkm.cold_start = 0x3a;
 
-    cpu_register_physical_memory(s->clkm.mpu_base, 0x100, iomemtype[0]);
-    cpu_register_physical_memory(s->clkm.dsp_base, 0x1000, iomemtype[1]);
+    cpu_register_physical_memory(mpu_base, 0x100, iomemtype[0]);
+    cpu_register_physical_memory(dsp_base, 0x1000, iomemtype[1]);
 }
 
 /* MPU I/O */
 struct omap_mpuio_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq kbd_irq;
     qemu_irq *in;
@@ -2783,7 +2746,6 @@ struct omap_mpuio_s *omap_mpuio_init(target_phys_addr_t base,
     struct omap_mpuio_s *s = (struct omap_mpuio_s *)
             qemu_mallocz(sizeof(struct omap_mpuio_s));
 
-    s->base = base;
     s->irq = gpio_int;
     s->kbd_irq = kbd_int;
     s->wakeup = wakeup;
@@ -2792,7 +2754,7 @@ struct omap_mpuio_s *omap_mpuio_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_mpuio_readfn,
                     omap_mpuio_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     omap_clk_adduser(clk, qemu_allocate_irqs(omap_mpuio_onoff, s, 1)[0]);
 
@@ -2827,7 +2789,6 @@ void omap_mpuio_key(struct omap_mpuio_s *s, int row, int col, int down)
 
 /* General-Purpose I/O */
 struct omap_gpio_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq *in;
     qemu_irq handler[16];
@@ -2984,14 +2945,13 @@ struct omap_gpio_s *omap_gpio_init(target_phys_addr_t base,
     struct omap_gpio_s *s = (struct omap_gpio_s *)
             qemu_mallocz(sizeof(struct omap_gpio_s));
 
-    s->base = base;
     s->irq = irq;
     s->in = qemu_allocate_irqs(omap_gpio_set, s, 16);
     omap_gpio_reset(s);
 
     iomemtype = cpu_register_io_memory(0, omap_gpio_readfn,
                     omap_gpio_writefn, s);
-    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
+    cpu_register_physical_memory(base, 0x1000, iomemtype);
 
     return s;
 }
@@ -3010,7 +2970,6 @@ void omap_gpio_out_set(struct omap_gpio_s *s, int line, qemu_irq handler)
 
 /* MicroWire Interface */
 struct omap_uwire_s {
-    target_phys_addr_t base;
     qemu_irq txirq;
     qemu_irq rxirq;
     qemu_irq txdrq;
@@ -3155,7 +3114,6 @@ struct omap_uwire_s *omap_uwire_init(target_phys_addr_t base,
     struct omap_uwire_s *s = (struct omap_uwire_s *)
             qemu_mallocz(sizeof(struct omap_uwire_s));
 
-    s->base = base;
     s->txirq = irq[0];
     s->rxirq = irq[1];
     s->txdrq = dma;
@@ -3163,7 +3121,7 @@ struct omap_uwire_s *omap_uwire_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_uwire_readfn,
                     omap_uwire_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
@@ -3364,7 +3322,6 @@ static void omap_pwt_init(target_phys_addr_t base, struct omap_mpu_state_s *s,
 
 /* Real-time Clock module */
 struct omap_rtc_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq alarm;
     QEMUTimer *clk;
@@ -3775,7 +3732,6 @@ struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
     struct omap_rtc_s *s = (struct omap_rtc_s *)
             qemu_mallocz(sizeof(struct omap_rtc_s));
 
-    s->base = base;
     s->irq = irq[0];
     s->alarm = irq[1];
     s->clk = qemu_new_timer(rt_clock, omap_rtc_tick, s);
@@ -3784,14 +3740,13 @@ struct omap_rtc_s *omap_rtc_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_rtc_readfn,
                     omap_rtc_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
 
 /* Multi-channel Buffered Serial Port interfaces */
 struct omap_mcbsp_s {
-    target_phys_addr_t base;
     qemu_irq txirq;
     qemu_irq rxirq;
     qemu_irq txdrq;
@@ -4295,7 +4250,6 @@ struct omap_mcbsp_s *omap_mcbsp_init(target_phys_addr_t base,
     struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)
             qemu_mallocz(sizeof(struct omap_mcbsp_s));
 
-    s->base = base;
     s->txirq = irq[0];
     s->rxirq = irq[1];
     s->txdrq = dma[0];
@@ -4306,7 +4260,7 @@ struct omap_mcbsp_s *omap_mcbsp_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_mcbsp_readfn,
                     omap_mcbsp_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
@@ -4340,7 +4294,6 @@ void omap_mcbsp_i2s_attach(struct omap_mcbsp_s *s, struct i2s_codec_s *slave)
 
 /* LED Pulse Generators */
 struct omap_lpg_s {
-    target_phys_addr_t base;
     QEMUTimer *tm;
 
     uint8_t control;
@@ -4473,14 +4426,13 @@ struct omap_lpg_s *omap_lpg_init(target_phys_addr_t base, omap_clk clk)
     struct omap_lpg_s *s = (struct omap_lpg_s *)
             qemu_mallocz(sizeof(struct omap_lpg_s));
 
-    s->base = base;
     s->tm = qemu_new_timer(rt_clock, omap_lpg_tick, s);
 
     omap_lpg_reset(s);
 
     iomemtype = cpu_register_io_memory(0, omap_lpg_readfn,
                     omap_lpg_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);
 
diff --git a/hw/omap2.c b/hw/omap2.c
index 495e72f453..aee26a0296 100644
--- a/hw/omap2.c
+++ b/hw/omap2.c
@@ -36,7 +36,6 @@ struct omap_gp_timer_s {
     qemu_irq in;
     qemu_irq out;
     omap_clk clk;
-    target_phys_addr_t base;
     QEMUTimer *timer;
     QEMUTimer *match;
     struct omap_target_agent_s *ta;
@@ -269,9 +268,8 @@ static void omap_gp_timer_reset(struct omap_gp_timer_s *s)
 static uint32_t omap_gp_timer_readw(void *opaque, target_phys_addr_t addr)
 {
     struct omap_gp_timer_s *s = (struct omap_gp_timer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* TIDR */
         return 0x21;
 
@@ -357,9 +355,8 @@ static void omap_gp_timer_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_gp_timer_s *s = (struct omap_gp_timer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* TIDR */
     case 0x14:	/* TISTAT */
     case 0x34:	/* TWPS */
@@ -489,7 +486,7 @@ struct omap_gp_timer_s *omap_gp_timer_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_gp_timer_readfn,
                     omap_gp_timer_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
 
     return s;
 }
@@ -507,9 +504,8 @@ static void omap_synctimer_reset(struct omap_synctimer_s *s)
 static uint32_t omap_synctimer_readw(void *opaque, target_phys_addr_t addr)
 {
     struct omap_synctimer_s *s = (struct omap_synctimer_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* 32KSYNCNT_REV */
         return 0x21;
 
@@ -559,13 +555,12 @@ void omap_synctimer_init(struct omap_target_agent_s *ta,
     struct omap_synctimer_s *s = &mpu->synctimer;
 
     omap_synctimer_reset(s);
-    s->base = omap_l4_attach(ta, 0, l4_register_io_memory(0,
-                            omap_synctimer_readfn, omap_synctimer_writefn, s));
+    omap_l4_attach(ta, 0, l4_register_io_memory(0,
+                      omap_synctimer_readfn, omap_synctimer_writefn, s));
 }
 
 /* General-Purpose Interface of OMAP2 */
 struct omap2_gpio_s {
-    target_phys_addr_t base;
     qemu_irq irq[2];
     qemu_irq wkup;
     qemu_irq *in;
@@ -668,9 +663,8 @@ static void omap_gpio_module_reset(struct omap2_gpio_s *s)
 static uint32_t omap_gpio_module_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap2_gpio_s *s = (struct omap2_gpio_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* GPIO_REVISION */
         return 0x18;
 
@@ -742,11 +736,10 @@ static void omap_gpio_module_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap2_gpio_s *s = (struct omap2_gpio_s *) opaque;
-    int offset = addr - s->base;
     uint32_t diff;
     int ln;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* GPIO_REVISION */
     case 0x14:	/* GPIO_SYSSTATUS */
     case 0x38:	/* GPIO_DATAIN */
@@ -889,12 +882,10 @@ static uint32_t omap_gpio_module_readp(void *opaque, target_phys_addr_t addr)
 static void omap_gpio_module_writep(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
-    struct omap2_gpio_s *s = (struct omap2_gpio_s *) opaque;
-    int offset = addr - s->base;
     uint32_t cur = 0;
     uint32_t mask = 0xffff;
 
-    switch (offset & ~3) {
+    switch (addr & ~3) {
     case 0x00:	/* GPIO_REVISION */
     case 0x14:	/* GPIO_SYSSTATUS */
     case 0x38:	/* GPIO_DATAIN */
@@ -964,14 +955,13 @@ static void omap_gpio_module_init(struct omap2_gpio_s *s,
 
     iomemtype = l4_register_io_memory(0, omap_gpio_module_readfn,
                     omap_gpio_module_writefn, s);
-    s->base = omap_l4_attach(ta, region, iomemtype);
+    omap_l4_attach(ta, region, iomemtype);
 }
 
 struct omap_gpif_s {
     struct omap2_gpio_s module[5];
     int modules;
 
-    target_phys_addr_t topbase;
     int autoidle;
     int gpo;
 };
@@ -990,9 +980,8 @@ static void omap_gpif_reset(struct omap_gpif_s *s)
 static uint32_t omap_gpif_top_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_gpif_s *s = (struct omap_gpif_s *) opaque;
-    int offset = addr - s->topbase;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* IPGENERICOCPSPL_REVISION */
         return 0x18;
 
@@ -1020,9 +1009,8 @@ static void omap_gpif_top_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_gpif_s *s = (struct omap_gpif_s *) opaque;
-    int offset = addr - s->topbase;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* IPGENERICOCPSPL_REVISION */
     case 0x14:	/* IPGENERICOCPSPL_SYSSTATUS */
     case 0x18:	/* IPGENERICOCPSPL_IRQSTATUS */
@@ -1075,7 +1063,7 @@ struct omap_gpif_s *omap2_gpio_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_gpif_top_readfn,
                     omap_gpif_top_writefn, s);
-    s->topbase = omap_l4_attach(ta, 1, iomemtype);
+    omap_l4_attach(ta, 1, iomemtype);
 
     return s;
 }
@@ -1097,7 +1085,6 @@ void omap2_gpio_out_set(struct omap_gpif_s *s, int line, qemu_irq handler)
 
 /* Multichannel SPI */
 struct omap_mcspi_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     int chnum;
 
@@ -1206,11 +1193,10 @@ static void omap_mcspi_reset(struct omap_mcspi_s *s)
 static uint32_t omap_mcspi_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mcspi_s *s = (struct omap_mcspi_s *) opaque;
-    int offset = addr - s->base;
     int ch = 0;
     uint32_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* MCSPI_REVISION */
         return 0x91;
 
@@ -1277,10 +1263,9 @@ static void omap_mcspi_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_mcspi_s *s = (struct omap_mcspi_s *) opaque;
-    int offset = addr - s->base;
     int ch = 0;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* MCSPI_REVISION */
     case 0x14:	/* MCSPI_SYSSTATUS */
     case 0x30:	/* MCSPI_CHSTAT0 */
@@ -1405,7 +1390,7 @@ struct omap_mcspi_s *omap_mcspi_init(struct omap_target_agent_s *ta, int chnum,
 
     iomemtype = l4_register_io_memory(0, omap_mcspi_readfn,
                     omap_mcspi_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
 
     return s;
 }
@@ -1424,7 +1409,6 @@ void omap_mcspi_attach(struct omap_mcspi_s *s,
 
 /* Enhanced Audio Controller (CODEC only) */
 struct omap_eac_s {
-    target_phys_addr_t base;
     qemu_irq irq;
 
     uint16_t sysconfig;
@@ -1719,10 +1703,9 @@ static void omap_eac_reset(struct omap_eac_s *s)
 static uint32_t omap_eac_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_eac_s *s = (struct omap_eac_s *) opaque;
-    int offset = addr - s->base;
     uint32_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* CPCFR1 */
         return s->config[0];
     case 0x004:	/* CPCFR2 */
@@ -1832,9 +1815,8 @@ static void omap_eac_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_eac_s *s = (struct omap_eac_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x098:	/* APD1LCR */
     case 0x09c:	/* APD1RCR */
     case 0x0a0:	/* APD2LCR */
@@ -1999,7 +1981,7 @@ struct omap_eac_s *omap_eac_init(struct omap_target_agent_s *ta,
 
     iomemtype = cpu_register_io_memory(0, omap_eac_readfn,
                     omap_eac_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
 #endif
 
     return s;
@@ -2007,8 +1989,6 @@ struct omap_eac_s *omap_eac_init(struct omap_target_agent_s *ta,
 
 /* STI/XTI (emulation interface) console - reverse engineered only */
 struct omap_sti_s {
-    target_phys_addr_t base;
-    target_phys_addr_t channel_base;
     qemu_irq irq;
     CharDriverState *chr;
 
@@ -2042,9 +2022,8 @@ static void omap_sti_reset(struct omap_sti_s *s)
 static uint32_t omap_sti_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_sti_s *s = (struct omap_sti_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* STI_REVISION */
         return 0x10;
 
@@ -2080,9 +2059,8 @@ static void omap_sti_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_sti_s *s = (struct omap_sti_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* STI_REVISION */
     case 0x14:	/* STI_SYSSTATUS / STI_RX_STATUS / XTI_SYSSTATUS */
         OMAP_RO_REG(addr);
@@ -2145,8 +2123,7 @@ static void omap_sti_fifo_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_sti_s *s = (struct omap_sti_s *) opaque;
-    int offset = addr - s->channel_base;
-    int ch = offset >> 6;
+    int ch = addr >> 6;
     uint8_t byte = value;
 
     if (ch == STI_TRACE_CONTROL_CHANNEL) {
@@ -2189,12 +2166,11 @@ static struct omap_sti_s *omap_sti_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_sti_readfn,
                     omap_sti_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
 
     iomemtype = cpu_register_io_memory(0, omap_sti_fifo_readfn,
                     omap_sti_fifo_writefn, s);
-    s->channel_base = channel_base;
-    cpu_register_physical_memory(s->channel_base, 0x10000, iomemtype);
+    cpu_register_physical_memory(channel_base, 0x10000, iomemtype);
 
     return s;
 }
@@ -2331,9 +2307,8 @@ struct omap_l4_s *omap_l4_init(target_phys_addr_t base, int ta_num)
 static uint32_t omap_l4ta_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_target_agent_s *s = (struct omap_target_agent_s *) opaque;
-    target_phys_addr_t reg = addr - s->base;
 
-    switch (reg) {
+    switch (addr) {
     case 0x00:	/* COMPONENT */
         return s->component;
 
@@ -2352,9 +2327,8 @@ static void omap_l4ta_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_target_agent_s *s = (struct omap_target_agent_s *) opaque;
-    target_phys_addr_t reg = addr - s->base;
 
-    switch (reg) {
+    switch (addr) {
     case 0x00:	/* COMPONENT */
     case 0x28:	/* AGENT_STATUS */
         OMAP_RO_REG(addr);
@@ -2656,9 +2630,8 @@ target_phys_addr_t omap_l4_attach(struct omap_target_agent_s *ta, int region,
 static uint32_t omap_tap_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;
-    target_phys_addr_t reg = addr - s->tap_base;
 
-    switch (reg) {
+    switch (addr) {
     case 0x204:	/* IDCODE_reg */
         switch (s->mpu_model) {
         case omap2420:
@@ -2739,13 +2712,12 @@ static CPUWriteMemoryFunc *omap_tap_writefn[] = {
 void omap_tap_init(struct omap_target_agent_s *ta,
                 struct omap_mpu_state_s *mpu)
 {
-    mpu->tap_base = omap_l4_attach(ta, 0, l4_register_io_memory(0,
+    omap_l4_attach(ta, 0, l4_register_io_memory(0,
                             omap_tap_readfn, omap_tap_writefn, mpu));
 }
 
 /* Power, Reset, and Clock Management */
 struct omap_prcm_s {
-    target_phys_addr_t base;
     qemu_irq irq[3];
     struct omap_mpu_state_s *mpu;
 
@@ -2789,10 +2761,9 @@ static void omap_prcm_int_update(struct omap_prcm_s *s, int dom)
 static uint32_t omap_prcm_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_prcm_s *s = (struct omap_prcm_s *) opaque;
-    int offset = addr - s->base;
     uint32_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* PRCM_REVISION */
         return 0x10;
 
@@ -2849,7 +2820,7 @@ static uint32_t omap_prcm_read(void *opaque, target_phys_addr_t addr)
     case 0x0f4:	/* GENERAL_PURPOSE18 */
     case 0x0f8:	/* GENERAL_PURPOSE19 */
     case 0x0fc:	/* GENERAL_PURPOSE20 */
-        return s->scratch[(offset - 0xb0) >> 2];
+        return s->scratch[(addr - 0xb0) >> 2];
 
     case 0x140:	/* CM_CLKSEL_MPU */
         return s->clksel[0];
@@ -3098,9 +3069,8 @@ static void omap_prcm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_prcm_s *s = (struct omap_prcm_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* PRCM_REVISION */
     case 0x054:	/* PRCM_VOLTST */
     case 0x084:	/* PRCM_CLKCFG_STATUS */
@@ -3185,7 +3155,7 @@ static void omap_prcm_write(void *opaque, target_phys_addr_t addr,
     case 0x0f4:	/* GENERAL_PURPOSE18 */
     case 0x0f8:	/* GENERAL_PURPOSE19 */
     case 0x0fc:	/* GENERAL_PURPOSE20 */
-        s->scratch[(offset - 0xb0) >> 2] = value;
+        s->scratch[(addr - 0xb0) >> 2] = value;
         break;
 
     case 0x140:	/* CM_CLKSEL_MPU */
@@ -3557,7 +3527,7 @@ struct omap_prcm_s *omap_prcm_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_prcm_readfn,
                     omap_prcm_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
     omap_l4_attach(ta, 1, iomemtype);
 
     return s;
@@ -3565,7 +3535,6 @@ struct omap_prcm_s *omap_prcm_init(struct omap_target_agent_s *ta,
 
 /* System and Pinout control */
 struct omap_sysctl_s {
-    target_phys_addr_t base;
     struct omap_mpu_state_s *mpu;
 
     uint32_t sysconfig;
@@ -3580,14 +3549,13 @@ static uint32_t omap_sysctl_read8(void *opaque, target_phys_addr_t addr)
 {
 
     struct omap_sysctl_s *s = (struct omap_sysctl_s *) opaque;
-    int offset = addr - s->base;
     int pad_offset, byte_offset;
     int value;
 
-    switch (offset) {
+    switch (addr) {
     case 0x030 ... 0x140:	/* CONTROL_PADCONF - only used in the POP */
-        pad_offset = (offset - 0x30) >> 2;
-        byte_offset = (offset - 0x30) & (4 - 1);
+        pad_offset = (addr - 0x30) >> 2;
+        byte_offset = (addr - 0x30) & (4 - 1);
 
         value = s->padconf[pad_offset];
         value = (value >> (byte_offset * 8)) & 0xff;
@@ -3605,9 +3573,8 @@ static uint32_t omap_sysctl_read8(void *opaque, target_phys_addr_t addr)
 static uint32_t omap_sysctl_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_sysctl_s *s = (struct omap_sysctl_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* CONTROL_REVISION */
         return 0x20;
 
@@ -3615,7 +3582,7 @@ static uint32_t omap_sysctl_read(void *opaque, target_phys_addr_t addr)
         return s->sysconfig;
 
     case 0x030 ... 0x140:	/* CONTROL_PADCONF - only used in the POP */
-        return s->padconf[(offset - 0x30) >> 2];
+        return s->padconf[(addr - 0x30) >> 2];
 
     case 0x270:	/* CONTROL_DEBOBS */
         return s->obs;
@@ -3707,14 +3674,13 @@ static void omap_sysctl_write8(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_sysctl_s *s = (struct omap_sysctl_s *) opaque;
-    int offset = addr - s->base;
     int pad_offset, byte_offset;
     int prev_value;
 
-    switch (offset) {
+    switch (addr) {
     case 0x030 ... 0x140:	/* CONTROL_PADCONF - only used in the POP */
-        pad_offset = (offset - 0x30) >> 2;
-        byte_offset = (offset - 0x30) & (4 - 1);
+        pad_offset = (addr - 0x30) >> 2;
+        byte_offset = (addr - 0x30) & (4 - 1);
 
         prev_value = s->padconf[pad_offset];
         prev_value &= ~(0xff << (byte_offset * 8));
@@ -3732,9 +3698,8 @@ static void omap_sysctl_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_sysctl_s *s = (struct omap_sysctl_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* CONTROL_REVISION */
     case 0x2a4:	/* CONTROL_MSUSPENDMUX_5 */
     case 0x2c0:	/* CONTROL_PSA_VALUE */
@@ -3769,7 +3734,7 @@ static void omap_sysctl_write(void *opaque, target_phys_addr_t addr,
 
     case 0x030 ... 0x140:	/* CONTROL_PADCONF - only used in the POP */
         /* XXX: should check constant bits */
-        s->padconf[(offset - 0x30) >> 2] = value & 0x1f1f1f1f;
+        s->padconf[(addr - 0x30) >> 2] = value & 0x1f1f1f1f;
         break;
 
     case 0x270:	/* CONTROL_DEBOBS */
@@ -3932,7 +3897,7 @@ struct omap_sysctl_s *omap_sysctl_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_sysctl_readfn,
                     omap_sysctl_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
     omap_l4_attach(ta, 0, iomemtype);
 
     return s;
@@ -3940,8 +3905,6 @@ struct omap_sysctl_s *omap_sysctl_init(struct omap_target_agent_s *ta,
 
 /* SDRAM Controller Subsystem */
 struct omap_sdrc_s {
-    target_phys_addr_t base;
-
     uint8_t config;
 };
 
@@ -3953,9 +3916,8 @@ static void omap_sdrc_reset(struct omap_sdrc_s *s)
 static uint32_t omap_sdrc_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_sdrc_s *s = (struct omap_sdrc_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* SDRC_REVISION */
         return 0x20;
 
@@ -4005,9 +3967,8 @@ static void omap_sdrc_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_sdrc_s *s = (struct omap_sdrc_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* SDRC_REVISION */
     case 0x14:	/* SDRC_SYSSTATUS */
     case 0x48:	/* SDRC_ERR_ADDR */
@@ -4077,19 +4038,17 @@ struct omap_sdrc_s *omap_sdrc_init(target_phys_addr_t base)
     struct omap_sdrc_s *s = (struct omap_sdrc_s *)
             qemu_mallocz(sizeof(struct omap_sdrc_s));
 
-    s->base = base;
     omap_sdrc_reset(s);
 
     iomemtype = cpu_register_io_memory(0, omap_sdrc_readfn,
                     omap_sdrc_writefn, s);
-    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
+    cpu_register_physical_memory(base, 0x1000, iomemtype);
 
     return s;
 }
 
 /* General-Purpose Memory Controller */
 struct omap_gpmc_s {
-    target_phys_addr_t base;
     qemu_irq irq;
 
     uint8_t sysconfig;
@@ -4201,11 +4160,10 @@ static void omap_gpmc_reset(struct omap_gpmc_s *s)
 static uint32_t omap_gpmc_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_gpmc_s *s = (struct omap_gpmc_s *) opaque;
-    int offset = addr - s->base;
     int cs;
     struct omap_gpmc_cs_file_s *f;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* GPMC_REVISION */
         return 0x20;
 
@@ -4235,10 +4193,10 @@ static uint32_t omap_gpmc_read(void *opaque, target_phys_addr_t addr)
         return 0x001;
 
     case 0x060 ... 0x1d4:
-        cs = (offset - 0x060) / 0x30;
-        offset -= cs * 0x30;
+        cs = (addr - 0x060) / 0x30;
+        addr -= cs * 0x30;
         f = s->cs_file + cs;
-        switch (offset) {
+        switch (addr) {
             case 0x60:	/* GPMC_CONFIG1 */
                 return f->config[0];
             case 0x64:	/* GPMC_CONFIG2 */
@@ -4277,7 +4235,7 @@ static uint32_t omap_gpmc_read(void *opaque, target_phys_addr_t addr)
     case 0x1fc:	/* GPMC_ECC_SIZE_CONFIG */
         return s->ecc_cfg;
     case 0x200 ... 0x220:	/* GPMC_ECC_RESULT */
-        cs = (offset & 0x1f) >> 2;
+        cs = (addr & 0x1f) >> 2;
         /* TODO: check correctness */
         return
                 ((s->ecc[cs].cp    &  0x07) <<  0) |
@@ -4300,11 +4258,10 @@ static void omap_gpmc_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_gpmc_s *s = (struct omap_gpmc_s *) opaque;
-    int offset = addr - s->base;
     int cs;
     struct omap_gpmc_cs_file_s *f;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* GPMC_REVISION */
     case 0x014:	/* GPMC_SYSSTATUS */
     case 0x054:	/* GPMC_STATUS */
@@ -4347,10 +4304,10 @@ static void omap_gpmc_write(void *opaque, target_phys_addr_t addr,
         break;
 
     case 0x060 ... 0x1d4:
-        cs = (offset - 0x060) / 0x30;
-        offset -= cs * 0x30;
+        cs = (addr - 0x060) / 0x30;
+        addr -= cs * 0x30;
         f = s->cs_file + cs;
-        switch (offset) {
+        switch (addr) {
             case 0x60:	/* GPMC_CONFIG1 */
                 f->config[0] = value & 0xffef3e13;
                 break;
@@ -4455,12 +4412,11 @@ struct omap_gpmc_s *omap_gpmc_init(target_phys_addr_t base, qemu_irq irq)
     struct omap_gpmc_s *s = (struct omap_gpmc_s *)
             qemu_mallocz(sizeof(struct omap_gpmc_s));
 
-    s->base = base;
     omap_gpmc_reset(s);
 
     iomemtype = cpu_register_io_memory(0, omap_gpmc_readfn,
                     omap_gpmc_writefn, s);
-    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
+    cpu_register_physical_memory(base, 0x1000, iomemtype);
 
     return s;
 }
diff --git a/hw/omap_dma.c b/hw/omap_dma.c
index ba980df5e1..00d4e6508c 100644
--- a/hw/omap_dma.c
+++ b/hw/omap_dma.c
@@ -106,7 +106,6 @@ struct omap_dma_s {
     struct soc_dma_s *dma;
 
     struct omap_mpu_state_s *mpu;
-    target_phys_addr_t base;
     omap_clk clk;
     qemu_irq irq[4];
     void (*intr_update)(struct omap_dma_s *s);
@@ -1447,20 +1446,20 @@ static int omap_dma_sys_read(struct omap_dma_s *s, int offset,
 static uint32_t omap_dma_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
-    int reg, ch, offset = addr - s->base;
+    int reg, ch;
     uint16_t ret;
 
-    switch (offset) {
+    switch (addr) {
     case 0x300 ... 0x3fe:
         if (s->model <= omap_dma_3_1 || !s->omap_3_1_mapping_disabled) {
-            if (omap_dma_3_1_lcd_read(&s->lcd_ch, offset, &ret))
+            if (omap_dma_3_1_lcd_read(&s->lcd_ch, addr, &ret))
                 break;
             return ret;
         }
         /* Fall through. */
     case 0x000 ... 0x2fe:
-        reg = offset & 0x3f;
-        ch = (offset >> 6) & 0x0f;
+        reg = addr & 0x3f;
+        ch = (addr >> 6) & 0x0f;
         if (omap_dma_ch_reg_read(s, &s->ch[ch], reg, &ret))
             break;
         return ret;
@@ -1470,13 +1469,13 @@ static uint32_t omap_dma_read(void *opaque, target_phys_addr_t addr)
             break;
         /* Fall through. */
     case 0x400:
-        if (omap_dma_sys_read(s, offset, &ret))
+        if (omap_dma_sys_read(s, addr, &ret))
             break;
         return ret;
 
     case 0xb00 ... 0xbfe:
         if (s->model == omap_dma_3_2 && s->omap_3_1_mapping_disabled) {
-            if (omap_dma_3_2_lcd_read(&s->lcd_ch, offset, &ret))
+            if (omap_dma_3_2_lcd_read(&s->lcd_ch, addr, &ret))
                 break;
             return ret;
         }
@@ -1491,19 +1490,19 @@ static void omap_dma_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
-    int reg, ch, offset = addr - s->base;
+    int reg, ch;
 
-    switch (offset) {
+    switch (addr) {
     case 0x300 ... 0x3fe:
         if (s->model <= omap_dma_3_1 || !s->omap_3_1_mapping_disabled) {
-            if (omap_dma_3_1_lcd_write(&s->lcd_ch, offset, value))
+            if (omap_dma_3_1_lcd_write(&s->lcd_ch, addr, value))
                 break;
             return;
         }
         /* Fall through.  */
     case 0x000 ... 0x2fe:
-        reg = offset & 0x3f;
-        ch = (offset >> 6) & 0x0f;
+        reg = addr & 0x3f;
+        ch = (addr >> 6) & 0x0f;
         if (omap_dma_ch_reg_write(s, &s->ch[ch], reg, value))
             break;
         return;
@@ -1513,13 +1512,13 @@ static void omap_dma_write(void *opaque, target_phys_addr_t addr,
             break;
     case 0x400:
         /* Fall through. */
-        if (omap_dma_sys_write(s, offset, value))
+        if (omap_dma_sys_write(s, addr, value))
             break;
         return;
 
     case 0xb00 ... 0xbfe:
         if (s->model == omap_dma_3_2 && s->omap_3_1_mapping_disabled) {
-            if (omap_dma_3_2_lcd_write(&s->lcd_ch, offset, value))
+            if (omap_dma_3_2_lcd_write(&s->lcd_ch, addr, value))
                 break;
             return;
         }
@@ -1628,7 +1627,6 @@ struct soc_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
         num_irqs = 16;
         memsize = 0xc00;
     }
-    s->base = base;
     s->model = model;
     s->mpu = mpu;
     s->clk = clk;
@@ -1660,7 +1658,7 @@ struct soc_dma_s *omap_dma_init(target_phys_addr_t base, qemu_irq *irqs,
 
     iomemtype = cpu_register_io_memory(0, omap_dma_readfn,
                     omap_dma_writefn, s);
-    cpu_register_physical_memory(s->base, memsize, iomemtype);
+    cpu_register_physical_memory(base, memsize, iomemtype);
 
     mpu->drq = s->dma->drq;
 
@@ -1691,10 +1689,10 @@ static void omap_dma_interrupts_4_update(struct omap_dma_s *s)
 static uint32_t omap_dma4_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
-    int irqn = 0, chnum, offset = addr - s->base;
+    int irqn = 0, chnum;
     struct omap_dma_channel_s *ch;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* DMA4_REVISION */
         return 0x40;
 
@@ -1735,10 +1733,10 @@ static uint32_t omap_dma4_read(void *opaque, target_phys_addr_t addr)
         return s->gcr;
 
     case 0x80 ... 0xfff:
-        offset -= 0x80;
-        chnum = offset / 0x60;
+        addr -= 0x80;
+        chnum = addr / 0x60;
         ch = s->ch + chnum;
-        offset -= chnum * 0x60;
+        addr -= chnum * 0x60;
         break;
 
     default:
@@ -1747,7 +1745,7 @@ static uint32_t omap_dma4_read(void *opaque, target_phys_addr_t addr)
     }
 
     /* Per-channel registers */
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* DMA4_CCR */
         return (ch->buf_disable << 25) |
                 (ch->src_sync << 24) |
@@ -1837,10 +1835,10 @@ static void omap_dma4_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_dma_s *s = (struct omap_dma_s *) opaque;
-    int chnum, irqn = 0, offset = addr - s->base;
+    int chnum, irqn = 0;
     struct omap_dma_channel_s *ch;
 
-    switch (offset) {
+    switch (addr) {
     case 0x14:	/* DMA4_IRQSTATUS_L3 */
         irqn ++;
     case 0x10:	/* DMA4_IRQSTATUS_L2 */
@@ -1878,10 +1876,10 @@ static void omap_dma4_write(void *opaque, target_phys_addr_t addr,
         return;
 
     case 0x80 ... 0xfff:
-        offset -= 0x80;
-        chnum = offset / 0x60;
+        addr -= 0x80;
+        chnum = addr / 0x60;
         ch = s->ch + chnum;
-        offset -= chnum * 0x60;
+        addr -= chnum * 0x60;
         break;
 
     case 0x00:	/* DMA4_REVISION */
@@ -1899,7 +1897,7 @@ static void omap_dma4_write(void *opaque, target_phys_addr_t addr,
     }
 
     /* Per-channel registers */
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* DMA4_CCR */
         ch->buf_disable = (value >> 25) & 1;
         ch->src_sync = (value >> 24) & 1;	/* XXX For CamDMA must be 1 */
@@ -2041,7 +2039,6 @@ struct soc_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
     struct omap_dma_s *s = (struct omap_dma_s *)
             qemu_mallocz(sizeof(struct omap_dma_s));
 
-    s->base = base;
     s->model = omap_dma_4;
     s->chans = chans;
     s->mpu = mpu;
@@ -2068,7 +2065,7 @@ struct soc_dma_s *omap_dma4_init(target_phys_addr_t base, qemu_irq *irqs,
 
     iomemtype = cpu_register_io_memory(0, omap_dma4_readfn,
                     omap_dma4_writefn, s);
-    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
+    cpu_register_physical_memory(base, 0x1000, iomemtype);
 
     mpu->drq = s->dma->drq;
 
diff --git a/hw/omap_dss.c b/hw/omap_dss.c
index ba7153f29b..87c91aa7f0 100644
--- a/hw/omap_dss.c
+++ b/hw/omap_dss.c
@@ -24,11 +24,6 @@
 #include "omap.h"
 
 struct omap_dss_s {
-    target_phys_addr_t diss_base;
-    target_phys_addr_t disc_base;
-    target_phys_addr_t rfbi_base;
-    target_phys_addr_t venc_base;
-    target_phys_addr_t im3_base;
     qemu_irq irq;
     qemu_irq drq;
     DisplayState *state;
@@ -177,9 +172,8 @@ void omap_dss_reset(struct omap_dss_s *s)
 static uint32_t omap_diss_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->diss_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* DSS_REVISIONNUMBER */
         return 0x20;
 
@@ -212,9 +206,8 @@ static void omap_diss_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->diss_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* DSS_REVISIONNUMBER */
     case 0x14:	/* DSS_SYSSTATUS */
     case 0x50:	/* DSS_PSA_LCD_REG_1 */
@@ -254,9 +247,8 @@ static CPUWriteMemoryFunc *omap_diss1_writefn[] = {
 static uint32_t omap_disc_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->disc_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x000:	/* DISPC_REVISION */
         return 0x20;
 
@@ -376,9 +368,8 @@ static void omap_disc_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->disc_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x010:	/* DISPC_SYSCONFIG */
         if (value & 2)						/* SOFTRESET */
             omap_dss_reset(s);
@@ -667,9 +658,8 @@ static void omap_rfbi_transfer_start(struct omap_dss_s *s)
 static uint32_t omap_rfbi_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->rfbi_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* RFBI_REVISION */
         return 0x10;
 
@@ -731,9 +721,8 @@ static void omap_rfbi_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->rfbi_base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x10:	/* RFBI_SYSCONFIG */
         if (value & 2)						/* SOFTRESET */
             omap_rfbi_reset(s);
@@ -866,10 +855,7 @@ static CPUWriteMemoryFunc *omap_rfbi1_writefn[] = {
 
 static uint32_t omap_venc_read(void *opaque, target_phys_addr_t addr)
 {
-    struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->venc_base;
-
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* REV_ID */
     case 0x04:	/* STATUS */
     case 0x08:	/* F_CONTROL */
@@ -925,10 +911,7 @@ static uint32_t omap_venc_read(void *opaque, target_phys_addr_t addr)
 static void omap_venc_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
-    struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->venc_base;
-
-    switch (offset) {
+    switch (addr) {
     case 0x08:	/* F_CONTROL */
     case 0x10:	/* VIDOUT_CTRL */
     case 0x14:	/* SYNC_CTRL */
@@ -991,10 +974,7 @@ static CPUWriteMemoryFunc *omap_venc1_writefn[] = {
 
 static uint32_t omap_im3_read(void *opaque, target_phys_addr_t addr)
 {
-    struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->im3_base;
-
-    switch (offset) {
+    switch (addr) {
     case 0x0a8:	/* SBIMERRLOGA */
     case 0x0b0:	/* SBIMERRLOG */
     case 0x190:	/* SBIMSTATE */
@@ -1016,10 +996,7 @@ static uint32_t omap_im3_read(void *opaque, target_phys_addr_t addr)
 static void omap_im3_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
-    struct omap_dss_s *s = (struct omap_dss_s *) opaque;
-    int offset = addr - s->im3_base;
-
-    switch (offset) {
+    switch (addr) {
     case 0x0b0:	/* SBIMERRLOG */
     case 0x190:	/* SBIMSTATE */
     case 0x198:	/* SBTMSTATE_L */
@@ -1070,12 +1047,10 @@ struct omap_dss_s *omap_dss_init(struct omap_target_agent_s *ta,
                     omap_venc1_writefn, s);
     iomemtype[4] = cpu_register_io_memory(0, omap_im3_readfn,
                     omap_im3_writefn, s);
-    s->diss_base = omap_l4_attach(ta, 0, iomemtype[0]);
-    s->disc_base = omap_l4_attach(ta, 1, iomemtype[1]);
-    s->rfbi_base = omap_l4_attach(ta, 2, iomemtype[2]);
-    s->venc_base = omap_l4_attach(ta, 3, iomemtype[3]);
-    s->im3_base = l3_base;
-    cpu_register_physical_memory(s->im3_base, 0x1000, iomemtype[4]);
+    omap_l4_attach(ta, 0, iomemtype[0]);
+    omap_l4_attach(ta, 1, iomemtype[1]);
+    omap_l4_attach(ta, 3, iomemtype[3]);
+    cpu_register_physical_memory(l3_base, 0x1000, iomemtype[4]);
 
 #if 0
     if (ds)
diff --git a/hw/omap_i2c.c b/hw/omap_i2c.c
index 127e69ca0a..3b7fa60662 100644
--- a/hw/omap_i2c.c
+++ b/hw/omap_i2c.c
@@ -23,7 +23,6 @@
 #include "omap.h"
 
 struct omap_i2c_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq drq[2];
     i2c_slave slave;
@@ -493,7 +492,6 @@ struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
 
     /* TODO: set a value greater or equal to real hardware */
     s->revision = 0x11;
-    s->base = base;
     s->irq = irq;
     s->drq[0] = dma[0];
     s->drq[1] = dma[1];
@@ -505,7 +503,7 @@ struct omap_i2c_s *omap_i2c_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_i2c_readfn,
                     omap_i2c_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     return s;
 }
@@ -529,7 +527,7 @@ struct omap_i2c_s *omap2_i2c_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_i2c_readfn,
                     omap_i2c_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
 
     return s;
 }
diff --git a/hw/omap_lcdc.c b/hw/omap_lcdc.c
index 66cc8dfe23..a27f244a9e 100644
--- a/hw/omap_lcdc.c
+++ b/hw/omap_lcdc.c
@@ -23,7 +23,6 @@
 #include "omap.h"
 
 struct omap_lcd_panel_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     DisplayState *state;
     QEMUConsole *console;
@@ -366,9 +365,8 @@ static void omap_lcd_update(struct omap_lcd_panel_s *s) {
 static uint32_t omap_lcdc_read(void *opaque, target_phys_addr_t addr)
 {
     struct omap_lcd_panel_s *s = (struct omap_lcd_panel_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* LCD_CONTROL */
         return (s->tft << 23) | (s->plm << 20) |
                 (s->tft << 7) | (s->interrupts << 3) |
@@ -400,9 +398,8 @@ static void omap_lcdc_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct omap_lcd_panel_s *s = (struct omap_lcd_panel_s *) opaque;
-    int offset = addr - s->base;
 
-    switch (offset) {
+    switch (addr) {
     case 0x00:	/* LCD_CONTROL */
         s->plm = (value >> 20) & 3;
         s->tft = (value >> 7) & 1;
@@ -485,7 +482,6 @@ struct omap_lcd_panel_s *omap_lcdc_init(target_phys_addr_t base, qemu_irq irq,
 
     s->irq = irq;
     s->dma = dma;
-    s->base = base;
     s->state = ds;
     s->imif_base = imif_base;
     s->emiff_base = emiff_base;
@@ -493,7 +489,7 @@ struct omap_lcd_panel_s *omap_lcdc_init(target_phys_addr_t base, qemu_irq irq,
 
     iomemtype = cpu_register_io_memory(0, omap_lcdc_readfn,
                     omap_lcdc_writefn, s);
-    cpu_register_physical_memory(s->base, 0x100, iomemtype);
+    cpu_register_physical_memory(base, 0x100, iomemtype);
 
     s->console = graphic_console_init(ds, omap_update_display,
                                       omap_invalidate_display,
diff --git a/hw/omap_mmc.c b/hw/omap_mmc.c
index bc46edf560..df3bd49869 100644
--- a/hw/omap_mmc.c
+++ b/hw/omap_mmc.c
@@ -23,7 +23,6 @@
 #include "sd.h"
 
 struct omap_mmc_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     qemu_irq *dma;
     qemu_irq coverswitch;
@@ -581,7 +580,6 @@ struct omap_mmc_s *omap_mmc_init(target_phys_addr_t base,
             qemu_mallocz(sizeof(struct omap_mmc_s));
 
     s->irq = irq;
-    s->base = base;
     s->dma = dma;
     s->clk = clk;
     s->lines = 1;	/* TODO: needs to be settable per-board */
@@ -591,7 +589,7 @@ struct omap_mmc_s *omap_mmc_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, omap_mmc_readfn,
                     omap_mmc_writefn, s);
-    cpu_register_physical_memory(s->base, 0x800, iomemtype);
+    cpu_register_physical_memory(base, 0x800, iomemtype);
 
     /* Instantiate the storage */
     s->card = sd_init(bd, 0);
@@ -617,7 +615,7 @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
 
     iomemtype = l4_register_io_memory(0, omap_mmc_readfn,
                     omap_mmc_writefn, s);
-    s->base = omap_l4_attach(ta, 0, iomemtype);
+    omap_l4_attach(ta, 0, iomemtype);
 
     /* Instantiate the storage */
     s->card = sd_init(bd, 0);
diff --git a/hw/onenand.c b/hw/onenand.c
index 762da278a3..9bf4630c47 100644
--- a/hw/onenand.c
+++ b/hw/onenand.c
@@ -113,8 +113,8 @@ void onenand_base_update(void *opaque, target_phys_addr_t new)
                     0xbe00 << s->shift,
                     (s->ram +(0x0200 << s->shift)) | IO_MEM_RAM);
     if (s->iomemtype)
-        cpu_register_physical_memory(s->base + (0xc000 << s->shift),
-                        0x4000 << s->shift, s->iomemtype);
+        cpu_register_physical_memory_offset(s->base + (0xc000 << s->shift),
+                    0x4000 << s->shift, s->iomemtype, (0xc000 << s->shift));
 }
 
 void onenand_base_unmap(void *opaque)
@@ -449,11 +449,11 @@ static void onenand_command(struct onenand_s *s, int cmd)
 static uint32_t onenand_read(void *opaque, target_phys_addr_t addr)
 {
     struct onenand_s *s = (struct onenand_s *) opaque;
-    int offset = (addr - s->base) >> s->shift;
+    int offset = addr >> s->shift;
 
     switch (offset) {
     case 0x0000 ... 0xc000:
-        return lduw_le_p(s->boot[0] + (addr - s->base));
+        return lduw_le_p(s->boot[0] + addr);
 
     case 0xf000:	/* Manufacturer ID */
         return (s->id >> 16) & 0xff;
@@ -514,7 +514,7 @@ static void onenand_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct onenand_s *s = (struct onenand_s *) opaque;
-    int offset = (addr - s->base) >> s->shift;
+    int offset = addr >> s->shift;
     int sec;
 
     switch (offset) {
diff --git a/hw/parallel.c b/hw/parallel.c
index 66bc715fa4..025067af6f 100644
--- a/hw/parallel.c
+++ b/hw/parallel.c
@@ -75,7 +75,6 @@ struct ParallelState {
     int epp_timeout;
     uint32_t last_read_offset; /* For debugging */
     /* Memory-mapped interface */
-    target_phys_addr_t base;
     int it_shift;
 };
 
@@ -477,7 +476,7 @@ static uint32_t parallel_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     ParallelState *s = opaque;
 
-    return parallel_ioport_read_sw(s, (addr - s->base) >> s->it_shift) & 0xFF;
+    return parallel_ioport_read_sw(s, addr >> s->it_shift) & 0xFF;
 }
 
 static void parallel_mm_writeb (void *opaque,
@@ -485,14 +484,14 @@ static void parallel_mm_writeb (void *opaque,
 {
     ParallelState *s = opaque;
 
-    parallel_ioport_write_sw(s, (addr - s->base) >> s->it_shift, value & 0xFF);
+    parallel_ioport_write_sw(s, addr >> s->it_shift, value & 0xFF);
 }
 
 static uint32_t parallel_mm_readw (void *opaque, target_phys_addr_t addr)
 {
     ParallelState *s = opaque;
 
-    return parallel_ioport_read_sw(s, (addr - s->base) >> s->it_shift) & 0xFFFF;
+    return parallel_ioport_read_sw(s, addr >> s->it_shift) & 0xFFFF;
 }
 
 static void parallel_mm_writew (void *opaque,
@@ -500,14 +499,14 @@ static void parallel_mm_writew (void *opaque,
 {
     ParallelState *s = opaque;
 
-    parallel_ioport_write_sw(s, (addr - s->base) >> s->it_shift, value & 0xFFFF);
+    parallel_ioport_write_sw(s, addr >> s->it_shift, value & 0xFFFF);
 }
 
 static uint32_t parallel_mm_readl (void *opaque, target_phys_addr_t addr)
 {
     ParallelState *s = opaque;
 
-    return parallel_ioport_read_sw(s, (addr - s->base) >> s->it_shift);
+    return parallel_ioport_read_sw(s, addr >> s->it_shift);
 }
 
 static void parallel_mm_writel (void *opaque,
@@ -515,7 +514,7 @@ static void parallel_mm_writel (void *opaque,
 {
     ParallelState *s = opaque;
 
-    parallel_ioport_write_sw(s, (addr - s->base) >> s->it_shift, value);
+    parallel_ioport_write_sw(s, addr >> s->it_shift, value);
 }
 
 static CPUReadMemoryFunc *parallel_mm_read_sw[] = {
@@ -540,7 +539,6 @@ ParallelState *parallel_mm_init(target_phys_addr_t base, int it_shift, qemu_irq
     if (!s)
         return NULL;
     parallel_reset(s, irq, chr);
-    s->base = base;
     s->it_shift = it_shift;
 
     io_sw = cpu_register_io_memory(0, parallel_mm_read_sw, parallel_mm_write_sw, s);
diff --git a/hw/pckbd.c b/hw/pckbd.c
index 2176b83329..cceea4a5d1 100644
--- a/hw/pckbd.c
+++ b/hw/pckbd.c
@@ -125,7 +125,6 @@ typedef struct KBDState {
 
     qemu_irq irq_kbd;
     qemu_irq irq_mouse;
-    target_phys_addr_t base;
     int it_shift;
 } KBDState;
 
@@ -392,7 +391,7 @@ static uint32_t kbd_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     KBDState *s = opaque;
 
-    switch ((addr - s->base) >> s->it_shift) {
+    switch (addr >> s->it_shift) {
     case 0:
         return kbd_read_data(s, 0) & 0xff;
     case 1:
@@ -406,7 +405,7 @@ static void kbd_mm_writeb (void *opaque, target_phys_addr_t addr, uint32_t value
 {
     KBDState *s = opaque;
 
-    switch ((addr - s->base) >> s->it_shift) {
+    switch (addr >> s->it_shift) {
     case 0:
         kbd_write_data(s, 0, value & 0xff);
         break;
@@ -436,7 +435,6 @@ void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
 
     s->irq_kbd = kbd_irq;
     s->irq_mouse = mouse_irq;
-    s->base = base;
     s->it_shift = it_shift;
 
     kbd_reset(s);
diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
index 57892c251e..6113fa648b 100644
--- a/hw/pflash_cfi01.c
+++ b/hw/pflash_cfi01.c
@@ -103,7 +103,6 @@ static uint32_t pflash_read (pflash_t *pfl, target_ulong offset, int width)
     uint8_t *p;
 
     ret = -1;
-    offset -= pfl->base;
     boff = offset & 0xFF; /* why this here ?? */
 
     if (pfl->width == 2)
@@ -203,7 +202,6 @@ static void pflash_write (pflash_t *pfl, target_ulong offset, uint32_t value,
     uint8_t cmd;
 
     cmd = value;
-    offset -= pfl->base;
 
     DPRINTF("%s: writing offset " TARGET_FMT_lx " value %08x width %d wcycle 0x%x\n",
             __func__, offset, value, width, pfl->wcycle);
diff --git a/hw/pflash_cfi02.c b/hw/pflash_cfi02.c
index 5530841bf0..5849902807 100644
--- a/hw/pflash_cfi02.c
+++ b/hw/pflash_cfi02.c
@@ -112,7 +112,6 @@ static uint32_t pflash_read (pflash_t *pfl, uint32_t offset, int width)
 
     DPRINTF("%s: offset " TARGET_FMT_lx "\n", __func__, offset);
     ret = -1;
-    offset -= pfl->base;
     if (pfl->rom_mode) {
         /* Lazy reset of to ROMD mode */
         if (pfl->wcycle == 0)
@@ -241,7 +240,6 @@ static void pflash_write (pflash_t *pfl, uint32_t offset, uint32_t value,
     }
     DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d %d\n", __func__,
             offset, value, width, pfl->wcycle);
-    offset -= pfl->base;
     offset &= pfl->chip_len - 1;
 
     DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d\n", __func__,
diff --git a/hw/pl011.c b/hw/pl011.c
index bbef0a4c6d..dd6994c41f 100644
--- a/hw/pl011.c
+++ b/hw/pl011.c
@@ -12,7 +12,6 @@
 #include "primecell.h"
 
 typedef struct {
-    uint32_t base;
     uint32_t readbuff;
     uint32_t flags;
     uint32_t lcr;
@@ -59,7 +58,6 @@ static uint32_t pl011_read(void *opaque, target_phys_addr_t offset)
     pl011_state *s = (pl011_state *)opaque;
     uint32_t c;
 
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
         return pl011_id[s->type][(offset - 0xfe0) >> 2];
     }
@@ -130,7 +128,6 @@ static void pl011_write(void *opaque, target_phys_addr_t offset,
     pl011_state *s = (pl011_state *)opaque;
     unsigned char ch;
 
-    offset -= s->base;
     switch (offset >> 2) {
     case 0: /* UARTDR */
         /* ??? Check if transmitter is enabled.  */
@@ -299,7 +296,6 @@ void pl011_init(uint32_t base, qemu_irq irq,
     iomemtype = cpu_register_io_memory(0, pl011_readfn,
                                        pl011_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->irq = irq;
     s->type = type;
     s->chr = chr;
diff --git a/hw/pl022.c b/hw/pl022.c
index a9d20c517b..ee166ffc46 100644
--- a/hw/pl022.c
+++ b/hw/pl022.c
@@ -40,7 +40,6 @@ do { fprintf(stderr, "pl022: error: " fmt , ##args);} while (0)
 #define PL022_INT_TX  0x08
 
 typedef struct {
-    uint32_t base;
     uint32_t cr0;
     uint32_t cr1;
     uint32_t bitmask;
@@ -137,7 +136,6 @@ static uint32_t pl022_read(void *opaque, target_phys_addr_t offset)
     pl022_state *s = (pl022_state *)opaque;
     int val;
 
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
         return pl022_id[(offset - 0xfe0) >> 2];
     }
@@ -181,7 +179,6 @@ static void pl022_write(void *opaque, target_phys_addr_t offset,
 {
     pl022_state *s = (pl022_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* CR0 */
         s->cr0 = value;
@@ -303,7 +300,6 @@ void pl022_init(uint32_t base, qemu_irq irq, int (*xfer_cb)(void *, int),
     iomemtype = cpu_register_io_memory(0, pl022_readfn,
                                        pl022_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->irq = irq;
     s->xfer_cb = xfer_cb;
     s->opaque = opaque;
diff --git a/hw/pl031.c b/hw/pl031.c
index bb5a69d039..cd8759faa8 100644
--- a/hw/pl031.c
+++ b/hw/pl031.c
@@ -35,7 +35,6 @@ do { printf("pl031: " fmt , ##args); } while (0)
 typedef struct {
     QEMUTimer *timer;
     qemu_irq irq;
-    uint32_t base;
 
     uint64_t start_time;
     uint32_t tick_offset;
@@ -97,8 +96,6 @@ static uint32_t pl031_read(void *opaque, target_phys_addr_t offset)
 {
     pl031_state *s = (pl031_state *)opaque;
 
-    offset -= s->base;
-
     if (offset >= 0xfe0  &&  offset < 0x1000)
         return pl031_id[(offset - 0xfe0) >> 2];
 
@@ -136,7 +133,6 @@ static void pl031_write(void * opaque, target_phys_addr_t offset,
 {
     pl031_state *s = (pl031_state *)opaque;
 
-    offset -= s->base;
 
     switch (offset) {
     case RTC_LR:
@@ -207,7 +203,6 @@ void pl031_init(uint32_t base, qemu_irq irq)
 
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
 
-    s->base = base;
     s->irq  = irq;
     /* ??? We assume vm_clock is zero at this point.  */
     qemu_get_timedate(&tm, 0);
diff --git a/hw/pl050.c b/hw/pl050.c
index 7b890e9c99..e74a6dcd34 100644
--- a/hw/pl050.c
+++ b/hw/pl050.c
@@ -13,7 +13,6 @@
 
 typedef struct {
     void *dev;
-    uint32_t base;
     uint32_t cr;
     uint32_t clk;
     uint32_t last;
@@ -47,7 +46,6 @@ static void pl050_update(void *opaque, int level)
 static uint32_t pl050_read(void *opaque, target_phys_addr_t offset)
 {
     pl050_state *s = (pl050_state *)opaque;
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000)
         return pl050_id[(offset - 0xfe0) >> 2];
 
@@ -90,7 +88,6 @@ static void pl050_write(void *opaque, target_phys_addr_t offset,
                           uint32_t value)
 {
     pl050_state *s = (pl050_state *)opaque;
-    offset -= s->base;
     switch (offset >> 2) {
     case 0: /* KMICR */
         s->cr = value;
@@ -134,7 +131,6 @@ void pl050_init(uint32_t base, qemu_irq irq, int is_mouse)
     iomemtype = cpu_register_io_memory(0, pl050_readfn,
                                        pl050_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->irq = irq;
     s->is_mouse = is_mouse;
     if (is_mouse)
diff --git a/hw/pl061.c b/hw/pl061.c
index 6db5e393b1..a4d59c793e 100644
--- a/hw/pl061.c
+++ b/hw/pl061.c
@@ -28,7 +28,6 @@ static const uint8_t pl061_id[12] =
   { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
 typedef struct {
-    uint32_t base;
     int locked;
     uint8_t data;
     uint8_t old_data;
@@ -83,7 +82,6 @@ static uint32_t pl061_read(void *opaque, target_phys_addr_t offset)
 {
     pl061_state *s = (pl061_state *)opaque;
 
-    offset -= s->base;
     if (offset >= 0xfd0 && offset < 0x1000) {
         return pl061_id[(offset - 0xfd0) >> 2];
     }
@@ -140,7 +138,6 @@ static void pl061_write(void *opaque, target_phys_addr_t offset,
     pl061_state *s = (pl061_state *)opaque;
     uint8_t mask;
 
-    offset -= s->base;
     if (offset < 0x400) {
         mask = (offset >> 2) & s->dir;
         s->data = (s->data & ~mask) | (value & mask);
@@ -306,7 +303,6 @@ qemu_irq *pl061_init(uint32_t base, qemu_irq irq, qemu_irq **out)
     iomemtype = cpu_register_io_memory(0, pl061_readfn,
                                        pl061_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->irq = irq;
     pl061_reset(s);
     if (out)
diff --git a/hw/pl080.c b/hw/pl080.c
index 66d0398fda..1be30354fd 100644
--- a/hw/pl080.c
+++ b/hw/pl080.c
@@ -37,7 +37,6 @@ typedef struct {
 } pl080_channel;
 
 typedef struct {
-    uint32_t base;
     uint8_t tc_int;
     uint8_t tc_mask;
     uint8_t err_int;
@@ -187,7 +186,6 @@ static uint32_t pl080_read(void *opaque, target_phys_addr_t offset)
     uint32_t i;
     uint32_t mask;
 
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
         if (s->nchannels == 8) {
             return pl080_id[(offset - 0xfe0) >> 2];
@@ -255,7 +253,6 @@ static void pl080_write(void *opaque, target_phys_addr_t offset,
     pl080_state *s = (pl080_state *)opaque;
     int i;
 
-    offset -= s->base;
     if (offset >= 0x100 && offset < 0x200) {
         i = (offset & 0xe0) >> 5;
         if (i >= s->nchannels)
@@ -334,7 +331,6 @@ void *pl080_init(uint32_t base, qemu_irq irq, int nchannels)
     iomemtype = cpu_register_io_memory(0, pl080_readfn,
                                        pl080_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->irq = irq;
     s->nchannels = nchannels;
     /* ??? Save/restore.  */
diff --git a/hw/pl110.c b/hw/pl110.c
index 06541aece8..d0c00a9405 100644
--- a/hw/pl110.c
+++ b/hw/pl110.c
@@ -28,7 +28,6 @@ enum pl110_bppmode
 };
 
 typedef struct {
-    uint32_t base;
     DisplayState *ds;
     QEMUConsole *console;
 
@@ -289,7 +288,6 @@ static uint32_t pl110_read(void *opaque, target_phys_addr_t offset)
 {
     pl110_state *s = (pl110_state *)opaque;
 
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
         if (s->versatile)
             return pl110_versatile_id[(offset - 0xfe0) >> 2];
@@ -344,7 +342,6 @@ static void pl110_write(void *opaque, target_phys_addr_t offset,
     /* For simplicity invalidate the display whenever a control register
        is writen to.  */
     s->invalidate = 1;
-    offset -= s->base;
     if (offset >= 0x200 && offset < 0x400) {
         /* Pallette.  */
         n = (offset - 0x200) >> 2;
@@ -423,7 +420,6 @@ void *pl110_init(DisplayState *ds, uint32_t base, qemu_irq irq,
     iomemtype = cpu_register_io_memory(0, pl110_readfn,
                                        pl110_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->ds = ds;
     s->versatile = versatile;
     s->irq = irq;
diff --git a/hw/pl181.c b/hw/pl181.c
index 75c3143e27..8583490d92 100644
--- a/hw/pl181.c
+++ b/hw/pl181.c
@@ -24,7 +24,6 @@ do { printf("pl181: " fmt , ##args); } while (0)
 
 typedef struct {
     SDState *card;
-    uint32_t base;
     uint32_t clock;
     uint32_t power;
     uint32_t cmdarg;
@@ -261,7 +260,6 @@ static uint32_t pl181_read(void *opaque, target_phys_addr_t offset)
     pl181_state *s = (pl181_state *)opaque;
     uint32_t tmp;
 
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
         return pl181_id[(offset - 0xfe0) >> 2];
     }
@@ -344,7 +342,6 @@ static void pl181_write(void *opaque, target_phys_addr_t offset,
 {
     pl181_state *s = (pl181_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* Power */
         s->power = value & 0xff;
@@ -457,7 +454,6 @@ void pl181_init(uint32_t base, BlockDriverState *bd,
     iomemtype = cpu_register_io_memory(0, pl181_readfn,
                                        pl181_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->card = sd_init(bd, 0);
     s->irq[0] = irq0;
     s->irq[1] = irq1;
diff --git a/hw/pl190.c b/hw/pl190.c
index 267c26bce1..b5863f78f8 100644
--- a/hw/pl190.c
+++ b/hw/pl190.c
@@ -18,7 +18,6 @@
 #define PL190_NUM_PRIO 17
 
 typedef struct {
-    uint32_t base;
     uint32_t level;
     uint32_t soft_level;
     uint32_t irq_enable;
@@ -92,7 +91,6 @@ static uint32_t pl190_read(void *opaque, target_phys_addr_t offset)
     pl190_state *s = (pl190_state *)opaque;
     int i;
 
-    offset -= s->base;
     if (offset >= 0xfe0 && offset < 0x1000) {
         return pl190_id[(offset - 0xfe0) >> 2];
     }
@@ -148,7 +146,6 @@ static void pl190_write(void *opaque, target_phys_addr_t offset, uint32_t val)
 {
     pl190_state *s = (pl190_state *)opaque;
 
-    offset -= s->base;
     if (offset >= 0x100 && offset < 0x140) {
         s->vect_addr[(offset - 0x100) >> 2] = val;
         pl190_update_vectors(s);
@@ -241,7 +238,6 @@ qemu_irq *pl190_init(uint32_t base, qemu_irq irq, qemu_irq fiq)
                                        pl190_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
     qi = qemu_allocate_irqs(pl190_set_irq, s, 32);
-    s->base = base;
     s->irq = irq;
     s->fiq = fiq;
     pl190_reset(s);
diff --git a/hw/ppc405_boards.c b/hw/ppc405_boards.c
index c7a69596c7..4144daeefa 100644
--- a/hw/ppc405_boards.c
+++ b/hw/ppc405_boards.c
@@ -54,7 +54,6 @@
  */
 typedef struct ref405ep_fpga_t ref405ep_fpga_t;
 struct ref405ep_fpga_t {
-    uint32_t base;
     uint8_t reg0;
     uint8_t reg1;
 };
@@ -65,7 +64,6 @@ static uint32_t ref405ep_fpga_readb (void *opaque, target_phys_addr_t addr)
     uint32_t ret;
 
     fpga = opaque;
-    addr -= fpga->base;
     switch (addr) {
     case 0x0:
         ret = fpga->reg0;
@@ -87,7 +85,6 @@ static void ref405ep_fpga_writeb (void *opaque,
     ref405ep_fpga_t *fpga;
 
     fpga = opaque;
-    addr -= fpga->base;
     switch (addr) {
     case 0x0:
         /* Read only */
@@ -166,7 +163,6 @@ static void ref405ep_fpga_init (uint32_t base)
 
     fpga = qemu_mallocz(sizeof(ref405ep_fpga_t));
     if (fpga != NULL) {
-        fpga->base = base;
         fpga_memory = cpu_register_io_memory(0, ref405ep_fpga_read,
                                              ref405ep_fpga_write, fpga);
         cpu_register_physical_memory(base, 0x00000100, fpga_memory);
@@ -382,7 +378,6 @@ QEMUMachine ref405ep_machine = {
  */
 typedef struct taihu_cpld_t taihu_cpld_t;
 struct taihu_cpld_t {
-    uint32_t base;
     uint8_t reg0;
     uint8_t reg1;
 };
@@ -393,7 +388,6 @@ static uint32_t taihu_cpld_readb (void *opaque, target_phys_addr_t addr)
     uint32_t ret;
 
     cpld = opaque;
-    addr -= cpld->base;
     switch (addr) {
     case 0x0:
         ret = cpld->reg0;
@@ -415,7 +409,6 @@ static void taihu_cpld_writeb (void *opaque,
     taihu_cpld_t *cpld;
 
     cpld = opaque;
-    addr -= cpld->base;
     switch (addr) {
     case 0x0:
         /* Read only */
@@ -494,7 +487,6 @@ static void taihu_cpld_init (uint32_t base)
 
     cpld = qemu_mallocz(sizeof(taihu_cpld_t));
     if (cpld != NULL) {
-        cpld->base = base;
         cpld_memory = cpu_register_io_memory(0, taihu_cpld_read,
                                              taihu_cpld_write, cpld);
         cpu_register_physical_memory(base, 0x00000100, cpld_memory);
diff --git a/hw/ppc4xx_devs.c b/hw/ppc4xx_devs.c
index d240f0e293..ff67011911 100644
--- a/hw/ppc4xx_devs.c
+++ b/hw/ppc4xx_devs.c
@@ -115,13 +115,13 @@ static uint32_t mmio_readlen (ppc4xx_mmio_t *mmio,
     uint32_t ret;
     int idx;
 
-    idx = MMIO_IDX(addr - mmio->base);
+    idx = MMIO_IDX(addr);
 #if defined(DEBUG_MMIO)
     printf("%s: mmio %p len %d addr " PADDRX " idx %d\n", __func__,
            mmio, len, addr, idx);
 #endif
     mem_read = mmio->mem_read[idx];
-    ret = (*mem_read[len])(mmio->opaque[idx], addr - mmio->base);
+    ret = (*mem_read[len])(mmio->opaque[idx], addr);
 
     return ret;
 }
@@ -132,13 +132,13 @@ static void mmio_writelen (ppc4xx_mmio_t *mmio,
     CPUWriteMemoryFunc **mem_write;
     int idx;
 
-    idx = MMIO_IDX(addr - mmio->base);
+    idx = MMIO_IDX(addr);
 #if defined(DEBUG_MMIO)
     printf("%s: mmio %p len %d addr " PADDRX " idx %d value %08" PRIx32 "\n",
            __func__, mmio, len, addr, idx, value);
 #endif
     mem_write = mmio->mem_write[idx];
-    (*mem_write[len])(mmio->opaque[idx], addr - mmio->base, value);
+    (*mem_write[len])(mmio->opaque[idx], addr, value);
 }
 
 static uint32_t mmio_readb (void *opaque, target_phys_addr_t addr)
diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 8b5f85cad8..dccd9eacfb 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -122,7 +122,7 @@ static always_inline uint32_t _PPC_intack_read (target_phys_addr_t addr)
 {
     uint32_t retval = 0;
 
-    if (addr == 0xBFFFFFF0)
+    if (addr & 0xf == 0)
         retval = pic_intack_read(isa_pic);
 //   printf("%s: 0x" PADDRX " <= %08" PRIx32 "\n", __func__, addr, retval);
 
diff --git a/hw/pxa.h b/hw/pxa.h
index 16a68d936c..63e5335bc3 100644
--- a/hw/pxa.h
+++ b/hw/pxa.h
@@ -192,7 +192,6 @@ struct pxa2xx_state_s {
 };
 
 struct pxa2xx_i2s_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     struct pxa2xx_dma_state_s *dma;
     void (*data_req)(void *, int, int);
diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index 2c838e5e9d..f4295b0523 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -90,7 +90,6 @@ static PXASSPDef pxa27x_ssp[] = {
 static uint32_t pxa2xx_pm_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->pm_base;
 
     switch (addr) {
     case PMCR ... PCMD31:
@@ -110,7 +109,6 @@ static void pxa2xx_pm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->pm_base;
 
     switch (addr) {
     case PMCR:
@@ -175,7 +173,6 @@ static int pxa2xx_pm_load(QEMUFile *f, void *opaque, int version_id)
 static uint32_t pxa2xx_cm_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->cm_base;
 
     switch (addr) {
     case CCCR:
@@ -197,7 +194,6 @@ static void pxa2xx_cm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->cm_base;
 
     switch (addr) {
     case CCCR:
@@ -487,7 +483,6 @@ static void pxa2xx_cp14_write(void *opaque, int op2, int reg, int crm,
 static uint32_t pxa2xx_mm_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->mm_base;
 
     switch (addr) {
     case MDCNFG ... SA1110:
@@ -505,7 +500,6 @@ static void pxa2xx_mm_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->mm_base;
 
     switch (addr) {
     case MDCNFG ... SA1110:
@@ -554,7 +548,6 @@ static int pxa2xx_mm_load(QEMUFile *f, void *opaque, int version_id)
 
 /* Synchronous Serial Ports */
 struct pxa2xx_ssp_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     int enable;
 
@@ -668,7 +661,6 @@ static uint32_t pxa2xx_ssp_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_ssp_s *s = (struct pxa2xx_ssp_s *) opaque;
     uint32_t retval;
-    addr -= s->base;
 
     switch (addr) {
     case SSCR0:
@@ -714,7 +706,6 @@ static void pxa2xx_ssp_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct pxa2xx_ssp_s *s = (struct pxa2xx_ssp_s *) opaque;
-    addr -= s->base;
 
     switch (addr) {
     case SSCR0:
@@ -1022,7 +1013,6 @@ static inline void pxa2xx_rtc_pi_tick(void *opaque)
 static uint32_t pxa2xx_rtc_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->rtc_base;
 
     switch (addr) {
     case RTTR:
@@ -1069,7 +1059,6 @@ static void pxa2xx_rtc_write(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct pxa2xx_state_s *s = (struct pxa2xx_state_s *) opaque;
-    addr -= s->rtc_base;
 
     switch (addr) {
     case RTTR:
@@ -1270,7 +1259,6 @@ static int pxa2xx_rtc_load(QEMUFile *f, void *opaque, int version_id)
 struct pxa2xx_i2c_s {
     i2c_slave slave;
     i2c_bus *bus;
-    target_phys_addr_t base;
     qemu_irq irq;
 
     uint16_t control;
@@ -1351,8 +1339,8 @@ static int pxa2xx_i2c_tx(i2c_slave *i2c, uint8_t data)
 static uint32_t pxa2xx_i2c_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_i2c_s *s = (struct pxa2xx_i2c_s *) opaque;
-    addr -= s->base;
 
+    addr &= 0xff;
     switch (addr) {
     case ICR:
         return s->control;
@@ -1380,8 +1368,8 @@ static void pxa2xx_i2c_write(void *opaque, target_phys_addr_t addr,
 {
     struct pxa2xx_i2c_s *s = (struct pxa2xx_i2c_s *) opaque;
     int ack;
-    addr -= s->base;
 
+    addr &= 0xff;
     switch (addr) {
     case ICR:
         s->control = value & 0xfff7;
@@ -1493,7 +1481,6 @@ struct pxa2xx_i2c_s *pxa2xx_i2c_init(target_phys_addr_t base,
     struct pxa2xx_i2c_s *s = (struct pxa2xx_i2c_s *)
             i2c_slave_init(i2c_init_bus(), 0, sizeof(struct pxa2xx_i2c_s));
 
-    s->base = base;
     s->irq = irq;
     s->slave.event = pxa2xx_i2c_event;
     s->slave.recv = pxa2xx_i2c_rx;
@@ -1502,7 +1489,7 @@ struct pxa2xx_i2c_s *pxa2xx_i2c_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, pxa2xx_i2c_readfn,
                     pxa2xx_i2c_writefn, s);
-    cpu_register_physical_memory(s->base & ~page_size, page_size, iomemtype);
+    cpu_register_physical_memory(base & ~page_size, page_size + 1, iomemtype);
 
     register_savevm("pxa2xx_i2c", base, 1,
                     pxa2xx_i2c_save, pxa2xx_i2c_load, s);
@@ -1573,7 +1560,6 @@ static inline void pxa2xx_i2s_update(struct pxa2xx_i2s_s *i2s)
 static uint32_t pxa2xx_i2s_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_i2s_s *s = (struct pxa2xx_i2s_s *) opaque;
-    addr -= s->base;
 
     switch (addr) {
     case SACR0:
@@ -1607,7 +1593,6 @@ static void pxa2xx_i2s_write(void *opaque, target_phys_addr_t addr,
 {
     struct pxa2xx_i2s_s *s = (struct pxa2xx_i2s_s *) opaque;
     uint32_t *sample;
-    addr -= s->base;
 
     switch (addr) {
     case SACR0:
@@ -1733,7 +1718,6 @@ static struct pxa2xx_i2s_s *pxa2xx_i2s_init(target_phys_addr_t base,
     struct pxa2xx_i2s_s *s = (struct pxa2xx_i2s_s *)
             qemu_mallocz(sizeof(struct pxa2xx_i2s_s));
 
-    s->base = base;
     s->irq = irq;
     s->dma = dma;
     s->data_req = pxa2xx_i2s_data_req;
@@ -1742,7 +1726,7 @@ static struct pxa2xx_i2s_s *pxa2xx_i2s_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, pxa2xx_i2s_readfn,
                     pxa2xx_i2s_writefn, s);
-    cpu_register_physical_memory(s->base & 0xfff00000, 0x100000, iomemtype);
+    cpu_register_physical_memory(base, 0x100000, iomemtype);
 
     register_savevm("pxa2xx_i2s", base, 0,
                     pxa2xx_i2s_save, pxa2xx_i2s_load, s);
@@ -1752,7 +1736,6 @@ static struct pxa2xx_i2s_s *pxa2xx_i2s_init(target_phys_addr_t base,
 
 /* PXA Fast Infra-red Communications Port */
 struct pxa2xx_fir_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     struct pxa2xx_dma_state_s *dma;
     int enable;
@@ -1826,7 +1809,6 @@ static uint32_t pxa2xx_fir_read(void *opaque, target_phys_addr_t addr)
 {
     struct pxa2xx_fir_s *s = (struct pxa2xx_fir_s *) opaque;
     uint8_t ret;
-    addr -= s->base;
 
     switch (addr) {
     case ICCR0:
@@ -1865,7 +1847,6 @@ static void pxa2xx_fir_write(void *opaque, target_phys_addr_t addr,
 {
     struct pxa2xx_fir_s *s = (struct pxa2xx_fir_s *) opaque;
     uint8_t ch;
-    addr -= s->base;
 
     switch (addr) {
     case ICCR0:
@@ -1996,7 +1977,6 @@ static struct pxa2xx_fir_s *pxa2xx_fir_init(target_phys_addr_t base,
     struct pxa2xx_fir_s *s = (struct pxa2xx_fir_s *)
             qemu_mallocz(sizeof(struct pxa2xx_fir_s));
 
-    s->base = base;
     s->irq = irq;
     s->dma = dma;
     s->chr = chr;
@@ -2005,7 +1985,7 @@ static struct pxa2xx_fir_s *pxa2xx_fir_init(target_phys_addr_t base,
 
     iomemtype = cpu_register_io_memory(0, pxa2xx_fir_readfn,
                     pxa2xx_fir_writefn, s);
-    cpu_register_physical_memory(s->base, 0x1000, iomemtype);
+    cpu_register_physical_memory(base, 0x1000, iomemtype);
 
     if (chr)
         qemu_chr_add_handlers(chr, pxa2xx_fir_is_empty,
@@ -2118,13 +2098,14 @@ struct pxa2xx_state_s *pxa270_init(unsigned int sdram_size,
     ssp = (struct pxa2xx_ssp_s *)
             qemu_mallocz(sizeof(struct pxa2xx_ssp_s) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
+        target_phys_addr_t ssp_base;
         s->ssp[i] = &ssp[i];
-        ssp[i].base = pxa27x_ssp[i].io_base;
+        ssp_base = pxa27x_ssp[i].io_base;
         ssp[i].irq = s->pic[pxa27x_ssp[i].irqn];
 
         iomemtype = cpu_register_io_memory(0, pxa2xx_ssp_readfn,
                         pxa2xx_ssp_writefn, &ssp[i]);
-        cpu_register_physical_memory(ssp[i].base, 0x1000, iomemtype);
+        cpu_register_physical_memory(ssp_base, 0x1000, iomemtype);
         register_savevm("pxa2xx_ssp", i, 0,
                         pxa2xx_ssp_save, pxa2xx_ssp_load, s);
     }
@@ -2241,13 +2222,14 @@ struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size,
     ssp = (struct pxa2xx_ssp_s *)
             qemu_mallocz(sizeof(struct pxa2xx_ssp_s) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
+        target_phys_addr_t ssp_base;
         s->ssp[i] = &ssp[i];
-        ssp[i].base = pxa255_ssp[i].io_base;
+        ssp_base = pxa255_ssp[i].io_base;
         ssp[i].irq = s->pic[pxa255_ssp[i].irqn];
 
         iomemtype = cpu_register_io_memory(0, pxa2xx_ssp_readfn,
                         pxa2xx_ssp_writefn, &ssp[i]);
-        cpu_register_physical_memory(ssp[i].base, 0x1000, iomemtype);
+        cpu_register_physical_memory(ssp_base, 0x1000, iomemtype);
         register_savevm("pxa2xx_ssp", i, 0,
                         pxa2xx_ssp_save, pxa2xx_ssp_load, s);
     }
diff --git a/hw/pxa2xx_dma.c b/hw/pxa2xx_dma.c
index 8219392bbd..8c47189646 100644
--- a/hw/pxa2xx_dma.c
+++ b/hw/pxa2xx_dma.c
@@ -25,7 +25,6 @@ typedef void (*pxa2xx_dma_handler_t)(void *opaque, int irq, int level);
 
 struct pxa2xx_dma_state_s {
     pxa2xx_dma_handler_t handler;
-    target_phys_addr_t base;
     qemu_irq irq;
 
     uint32_t stopintr;
@@ -257,7 +256,6 @@ static uint32_t pxa2xx_dma_read(void *opaque, target_phys_addr_t offset)
 {
     struct pxa2xx_dma_state_s *s = (struct pxa2xx_dma_state_s *) opaque;
     unsigned int channel;
-    offset -= s->base;
 
     switch (offset) {
     case DRCMR64 ... DRCMR74:
@@ -313,7 +311,6 @@ static void pxa2xx_dma_write(void *opaque,
 {
     struct pxa2xx_dma_state_s *s = (struct pxa2xx_dma_state_s *) opaque;
     unsigned int channel;
-    offset -= s->base;
 
     switch (offset) {
     case DRCMR64 ... DRCMR74:
@@ -498,7 +495,6 @@ static struct pxa2xx_dma_state_s *pxa2xx_dma_init(target_phys_addr_t base,
 
     s->channels = channels;
     s->chan = qemu_mallocz(sizeof(struct pxa2xx_dma_channel_s) * s->channels);
-    s->base = base;
     s->irq = irq;
     s->handler = (pxa2xx_dma_handler_t) pxa2xx_dma_request;
     s->req = qemu_mallocz(sizeof(uint8_t) * PXA2XX_DMA_NUM_REQUESTS);
diff --git a/hw/pxa2xx_gpio.c b/hw/pxa2xx_gpio.c
index e3a30bc45e..0f3dcb101a 100644
--- a/hw/pxa2xx_gpio.c
+++ b/hw/pxa2xx_gpio.c
@@ -13,7 +13,6 @@
 #define PXA2XX_GPIO_BANKS	4
 
 struct pxa2xx_gpio_info_s {
-    target_phys_addr_t base;
     qemu_irq *pic;
     int lines;
     CPUState *cpu_env;
@@ -140,7 +139,6 @@ static uint32_t pxa2xx_gpio_read(void *opaque, target_phys_addr_t offset)
     struct pxa2xx_gpio_info_s *s = (struct pxa2xx_gpio_info_s *) opaque;
     uint32_t ret;
     int bank;
-    offset -= s->base;
     if (offset >= 0x200)
         return 0;
 
@@ -193,7 +191,6 @@ static void pxa2xx_gpio_write(void *opaque,
 {
     struct pxa2xx_gpio_info_s *s = (struct pxa2xx_gpio_info_s *) opaque;
     int bank;
-    offset -= s->base;
     if (offset >= 0x200)
         return;
 
@@ -308,7 +305,6 @@ struct pxa2xx_gpio_info_s *pxa2xx_gpio_init(target_phys_addr_t base,
     s = (struct pxa2xx_gpio_info_s *)
             qemu_mallocz(sizeof(struct pxa2xx_gpio_info_s));
     memset(s, 0, sizeof(struct pxa2xx_gpio_info_s));
-    s->base = base;
     s->pic = pic;
     s->lines = lines;
     s->cpu_env = env;
diff --git a/hw/pxa2xx_keypad.c b/hw/pxa2xx_keypad.c
index c6c7528b63..522c9c1e2f 100644
--- a/hw/pxa2xx_keypad.c
+++ b/hw/pxa2xx_keypad.c
@@ -80,7 +80,6 @@
 #define PXAKBD_MAXCOL   8
 
 struct pxa2xx_keypad_s{
-    target_phys_addr_t base;
     qemu_irq    irq;
     struct  keymap *map;
 
@@ -159,7 +158,6 @@ static uint32_t pxa2xx_keypad_read(void *opaque, target_phys_addr_t offset)
 {
     struct pxa2xx_keypad_s *s = (struct pxa2xx_keypad_s *) opaque;
     uint32_t tmp;
-    offset -= s->base;
 
     switch (offset) {
     case KPC:
@@ -222,7 +220,6 @@ static void pxa2xx_keypad_write(void *opaque,
                 target_phys_addr_t offset, uint32_t value)
 {
     struct pxa2xx_keypad_s *s = (struct pxa2xx_keypad_s *) opaque;
-    offset -= s->base;
 
     switch (offset) {
     case KPC:
@@ -316,7 +313,6 @@ struct pxa2xx_keypad_s *pxa27x_keypad_init(target_phys_addr_t base,
     struct pxa2xx_keypad_s *s;
 
     s = (struct pxa2xx_keypad_s *) qemu_mallocz(sizeof(struct pxa2xx_keypad_s));
-    s->base = base;
     s->irq = irq;
 
     iomemtype = cpu_register_io_memory(0, pxa2xx_keypad_readfn,
diff --git a/hw/pxa2xx_lcd.c b/hw/pxa2xx_lcd.c
index 715b2f1a48..c36ff3644b 100644
--- a/hw/pxa2xx_lcd.c
+++ b/hw/pxa2xx_lcd.c
@@ -17,7 +17,6 @@
 typedef void (*drawfn)(uint32_t *, uint8_t *, const uint8_t *, int, int);
 
 struct pxa2xx_lcdc_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     int irqlevel;
 
@@ -322,7 +321,6 @@ static uint32_t pxa2xx_lcdc_read(void *opaque, target_phys_addr_t offset)
 {
     struct pxa2xx_lcdc_s *s = (struct pxa2xx_lcdc_s *) opaque;
     int ch;
-    offset -= s->base;
 
     switch (offset) {
     case LCCR0:
@@ -418,7 +416,6 @@ static void pxa2xx_lcdc_write(void *opaque,
 {
     struct pxa2xx_lcdc_s *s = (struct pxa2xx_lcdc_s *) opaque;
     int ch;
-    offset -= s->base;
 
     switch (offset) {
     case LCCR0:
@@ -991,7 +988,6 @@ struct pxa2xx_lcdc_s *pxa2xx_lcdc_init(target_phys_addr_t base, qemu_irq irq,
     struct pxa2xx_lcdc_s *s;
 
     s = (struct pxa2xx_lcdc_s *) qemu_mallocz(sizeof(struct pxa2xx_lcdc_s));
-    s->base = base;
     s->invalidated = 1;
     s->irq = irq;
     s->ds = ds;
diff --git a/hw/pxa2xx_mmci.c b/hw/pxa2xx_mmci.c
index 60e7ba4efc..46258b49be 100644
--- a/hw/pxa2xx_mmci.c
+++ b/hw/pxa2xx_mmci.c
@@ -12,7 +12,6 @@
 #include "sd.h"
 
 struct pxa2xx_mmci_s {
-    target_phys_addr_t base;
     qemu_irq irq;
     void *dma;
 
@@ -216,7 +215,6 @@ static uint32_t pxa2xx_mmci_read(void *opaque, target_phys_addr_t offset)
 {
     struct pxa2xx_mmci_s *s = (struct pxa2xx_mmci_s *) opaque;
     uint32_t ret;
-    offset -= s->base;
 
     switch (offset) {
     case MMC_STRPCL:
@@ -279,7 +277,6 @@ static void pxa2xx_mmci_write(void *opaque,
                 target_phys_addr_t offset, uint32_t value)
 {
     struct pxa2xx_mmci_s *s = (struct pxa2xx_mmci_s *) opaque;
-    offset -= s->base;
 
     switch (offset) {
     case MMC_STRPCL:
@@ -529,7 +526,6 @@ struct pxa2xx_mmci_s *pxa2xx_mmci_init(target_phys_addr_t base,
     struct pxa2xx_mmci_s *s;
 
     s = (struct pxa2xx_mmci_s *) qemu_mallocz(sizeof(struct pxa2xx_mmci_s));
-    s->base = base;
     s->irq = irq;
     s->dma = dma;
 
diff --git a/hw/pxa2xx_pcmcia.c b/hw/pxa2xx_pcmcia.c
index 1e96ee44b5..b26c59753d 100644
--- a/hw/pxa2xx_pcmcia.c
+++ b/hw/pxa2xx_pcmcia.c
@@ -14,9 +14,6 @@
 struct pxa2xx_pcmcia_s {
     struct pcmcia_socket_s slot;
     struct pcmcia_card_s *card;
-    target_phys_addr_t common_base;
-    target_phys_addr_t attr_base;
-    target_phys_addr_t io_base;
 
     qemu_irq irq;
     qemu_irq cd_irq;
@@ -28,7 +25,6 @@ static uint32_t pxa2xx_pcmcia_common_read(void *opaque,
     struct pxa2xx_pcmcia_s *s = (struct pxa2xx_pcmcia_s *) opaque;
 
     if (s->slot.attached) {
-        offset -= s->common_base;
         return s->card->common_read(s->card->state, offset);
     }
 
@@ -41,7 +37,6 @@ static void pxa2xx_pcmcia_common_write(void *opaque,
     struct pxa2xx_pcmcia_s *s = (struct pxa2xx_pcmcia_s *) opaque;
 
     if (s->slot.attached) {
-        offset -= s->common_base;
         s->card->common_write(s->card->state, offset, value);
     }
 }
@@ -52,7 +47,6 @@ static uint32_t pxa2xx_pcmcia_attr_read(void *opaque,
     struct pxa2xx_pcmcia_s *s = (struct pxa2xx_pcmcia_s *) opaque;
 
     if (s->slot.attached) {
-        offset -= s->attr_base;
         return s->card->attr_read(s->card->state, offset);
     }
 
@@ -65,7 +59,6 @@ static void pxa2xx_pcmcia_attr_write(void *opaque,
     struct pxa2xx_pcmcia_s *s = (struct pxa2xx_pcmcia_s *) opaque;
 
     if (s->slot.attached) {
-        offset -= s->attr_base;
         s->card->attr_write(s->card->state, offset, value);
     }
 }
@@ -76,7 +69,6 @@ static uint32_t pxa2xx_pcmcia_io_read(void *opaque,
     struct pxa2xx_pcmcia_s *s = (struct pxa2xx_pcmcia_s *) opaque;
 
     if (s->slot.attached) {
-        offset -= s->io_base;
         return s->card->io_read(s->card->state, offset);
     }
 
@@ -89,7 +81,6 @@ static void pxa2xx_pcmcia_io_write(void *opaque,
     struct pxa2xx_pcmcia_s *s = (struct pxa2xx_pcmcia_s *) opaque;
 
     if (s->slot.attached) {
-        offset -= s->io_base;
         s->card->io_write(s->card->state, offset, value);
     }
 }
@@ -148,24 +139,21 @@ struct pxa2xx_pcmcia_s *pxa2xx_pcmcia_init(target_phys_addr_t base)
             qemu_mallocz(sizeof(struct pxa2xx_pcmcia_s));
 
     /* Socket I/O Memory Space */
-    s->io_base = base | 0x00000000;
     iomemtype = cpu_register_io_memory(0, pxa2xx_pcmcia_io_readfn,
                     pxa2xx_pcmcia_io_writefn, s);
-    cpu_register_physical_memory(s->io_base, 0x04000000, iomemtype);
+    cpu_register_physical_memory(base | 0x00000000, 0x04000000, iomemtype);
 
     /* Then next 64 MB is reserved */
 
     /* Socket Attribute Memory Space */
-    s->attr_base = base | 0x08000000;
     iomemtype = cpu_register_io_memory(0, pxa2xx_pcmcia_attr_readfn,
                     pxa2xx_pcmcia_attr_writefn, s);
-    cpu_register_physical_memory(s->attr_base, 0x04000000, iomemtype);
+    cpu_register_physical_memory(base | 0x08000000, 0x04000000, iomemtype);
 
     /* Socket Common Memory Space */
-    s->common_base = base | 0x0c000000;
     iomemtype = cpu_register_io_memory(0, pxa2xx_pcmcia_common_readfn,
                     pxa2xx_pcmcia_common_writefn, s);
-    cpu_register_physical_memory(s->common_base, 0x04000000, iomemtype);
+    cpu_register_physical_memory(base | 0x0c000000, 0x04000000, iomemtype);
 
     if (base == 0x30000000)
         s->slot.slot_string = "PXA PC Card Socket 1";
diff --git a/hw/pxa2xx_pic.c b/hw/pxa2xx_pic.c
index a3611b88ba..e8a601dbb7 100644
--- a/hw/pxa2xx_pic.c
+++ b/hw/pxa2xx_pic.c
@@ -31,7 +31,6 @@
 #define PXA2XX_PIC_SRCS	40
 
 struct pxa2xx_pic_state_s {
-    target_phys_addr_t base;
     CPUState *cpu_env;
     uint32_t int_enabled[2];
     uint32_t int_pending[2];
@@ -117,7 +116,6 @@ static inline uint32_t pxa2xx_pic_highest(struct pxa2xx_pic_state_s *s) {
 static uint32_t pxa2xx_pic_mem_read(void *opaque, target_phys_addr_t offset)
 {
     struct pxa2xx_pic_state_s *s = (struct pxa2xx_pic_state_s *) opaque;
-    offset -= s->base;
 
     switch (offset) {
     case ICIP:	/* IRQ Pending register */
@@ -158,7 +156,6 @@ static void pxa2xx_pic_mem_write(void *opaque, target_phys_addr_t offset,
                 uint32_t value)
 {
     struct pxa2xx_pic_state_s *s = (struct pxa2xx_pic_state_s *) opaque;
-    offset -= s->base;
 
     switch (offset) {
     case ICMR:	/* Mask register */
@@ -207,7 +204,6 @@ static const int pxa2xx_cp_reg_map[0x10] = {
 
 static uint32_t pxa2xx_pic_cp_read(void *opaque, int op2, int reg, int crm)
 {
-    struct pxa2xx_pic_state_s *s = (struct pxa2xx_pic_state_s *) opaque;
     target_phys_addr_t offset;
 
     if (pxa2xx_cp_reg_map[reg] == -1) {
@@ -215,14 +211,13 @@ static uint32_t pxa2xx_pic_cp_read(void *opaque, int op2, int reg, int crm)
         return 0;
     }
 
-    offset = s->base + pxa2xx_cp_reg_map[reg];
+    offset = pxa2xx_cp_reg_map[reg];
     return pxa2xx_pic_mem_read(opaque, offset);
 }
 
 static void pxa2xx_pic_cp_write(void *opaque, int op2, int reg, int crm,
                 uint32_t value)
 {
-    struct pxa2xx_pic_state_s *s = (struct pxa2xx_pic_state_s *) opaque;
     target_phys_addr_t offset;
 
     if (pxa2xx_cp_reg_map[reg] == -1) {
@@ -230,7 +225,7 @@ static void pxa2xx_pic_cp_write(void *opaque, int op2, int reg, int crm,
         return;
     }
 
-    offset = s->base + pxa2xx_cp_reg_map[reg];
+    offset = pxa2xx_cp_reg_map[reg];
     pxa2xx_pic_mem_write(opaque, offset, value);
 }
 
@@ -293,7 +288,6 @@ qemu_irq *pxa2xx_pic_init(target_phys_addr_t base, CPUState *env)
         return NULL;
 
     s->cpu_env = env;
-    s->base = base;
 
     s->int_pending[0] = 0;
     s->int_pending[1] = 0;
diff --git a/hw/pxa2xx_timer.c b/hw/pxa2xx_timer.c
index 01cfc4fab9..dd17fcf773 100644
--- a/hw/pxa2xx_timer.c
+++ b/hw/pxa2xx_timer.c
@@ -78,7 +78,6 @@ struct pxa2xx_timer4_s {
 };
 
 typedef struct {
-    target_phys_addr_t base;
     int32_t clock;
     int32_t oldclock;
     uint64_t lastload;
@@ -140,8 +139,6 @@ static uint32_t pxa2xx_timer_read(void *opaque, target_phys_addr_t offset)
     pxa2xx_timer_info *s = (pxa2xx_timer_info *) opaque;
     int tm = 0;
 
-    offset -= s->base;
-
     switch (offset) {
     case OSMR3:  tm ++;
     case OSMR2:  tm ++;
@@ -221,8 +218,6 @@ static void pxa2xx_timer_write(void *opaque, target_phys_addr_t offset,
     int i, tm = 0;
     pxa2xx_timer_info *s = (pxa2xx_timer_info *) opaque;
 
-    offset -= s->base;
-
     switch (offset) {
     case OSMR3:  tm ++;
     case OSMR2:  tm ++;
@@ -442,7 +437,6 @@ static pxa2xx_timer_info *pxa2xx_timer_init(target_phys_addr_t base,
     pxa2xx_timer_info *s;
 
     s = (pxa2xx_timer_info *) qemu_mallocz(sizeof(pxa2xx_timer_info));
-    s->base = base;
     s->irq_enabled = 0;
     s->oldclock = 0;
     s->clock = 0;
diff --git a/hw/r2d.c b/hw/r2d.c
index 853479375b..5f9f56971b 100644
--- a/hw/r2d.c
+++ b/hw/r2d.c
@@ -39,8 +39,6 @@
 #define PA_OUTPORT	0x36
 
 typedef struct {
-    target_phys_addr_t base;
-
     uint16_t bcr;
     uint16_t irlmon;
     uint16_t cfctl;
@@ -68,8 +66,6 @@ static uint32_t r2d_fpga_read(void *opaque, target_phys_addr_t addr)
 {
     r2d_fpga_t *s = opaque;
 
-    addr -= s->base;
-
     switch (addr) {
     case PA_OUTPORT:
 	return s->outport;
@@ -87,8 +83,6 @@ r2d_fpga_write(void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     r2d_fpga_t *s = opaque;
 
-    addr -= s->base;
-
     switch (addr) {
     case PA_OUTPORT:
 	s->outport = value;
@@ -123,7 +117,6 @@ static void r2d_fpga_init(target_phys_addr_t base)
     if (!s)
 	return;
 
-    s->base = base;
     iomemtype = cpu_register_io_memory(0, r2d_fpga_readfn,
 				       r2d_fpga_writefn, s);
     cpu_register_physical_memory(base, 0x40, iomemtype);
diff --git a/hw/realview_gic.c b/hw/realview_gic.c
index b4ef2ccf3c..e9645c27c0 100644
--- a/hw/realview_gic.c
+++ b/hw/realview_gic.c
@@ -25,7 +25,6 @@ gic_get_current_cpu(void)
 static uint32_t realview_gic_cpu_read(void *opaque, target_phys_addr_t offset)
 {
     gic_state *s = (gic_state *)opaque;
-    offset -= s->base;
     return gic_cpu_read(s, gic_get_current_cpu(), offset);
 }
 
@@ -33,7 +32,6 @@ static void realview_gic_cpu_write(void *opaque, target_phys_addr_t offset,
                           uint32_t value)
 {
     gic_state *s = (gic_state *)opaque;
-    offset -= s->base;
     gic_cpu_write(s, gic_get_current_cpu(), offset, value);
 }
 
@@ -54,7 +52,7 @@ qemu_irq *realview_gic_init(uint32_t base, qemu_irq parent_irq)
     gic_state *s;
     int iomemtype;
 
-    s = gic_init(base, &parent_irq);
+    s = gic_init(base + 0x1000, &parent_irq);
     if (!s)
         return NULL;
     iomemtype = cpu_register_io_memory(0, realview_gic_cpu_readfn,
diff --git a/hw/serial.c b/hw/serial.c
index 2167b79831..513ad27c90 100644
--- a/hw/serial.c
+++ b/hw/serial.c
@@ -125,7 +125,6 @@ struct SerialState {
     qemu_irq irq;
     CharDriverState *chr;
     int last_break_enable;
-    target_phys_addr_t base;
     int it_shift;
     int baudbase;
     int tsr_retry;
@@ -750,7 +749,7 @@ uint32_t serial_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     SerialState *s = opaque;
 
-    return serial_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFF;
+    return serial_ioport_read(s, addr >> s->it_shift) & 0xFF;
 }
 
 void serial_mm_writeb (void *opaque,
@@ -758,7 +757,7 @@ void serial_mm_writeb (void *opaque,
 {
     SerialState *s = opaque;
 
-    serial_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFF);
+    serial_ioport_write(s, addr >> s->it_shift, value & 0xFF);
 }
 
 uint32_t serial_mm_readw (void *opaque, target_phys_addr_t addr)
@@ -766,7 +765,7 @@ uint32_t serial_mm_readw (void *opaque, target_phys_addr_t addr)
     SerialState *s = opaque;
     uint32_t val;
 
-    val = serial_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFFFF;
+    val = serial_ioport_read(s, addr >> s->it_shift) & 0xFFFF;
 #ifdef TARGET_WORDS_BIGENDIAN
     val = bswap16(val);
 #endif
@@ -780,7 +779,7 @@ void serial_mm_writew (void *opaque,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap16(value);
 #endif
-    serial_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFFFF);
+    serial_ioport_write(s, addr >> s->it_shift, value & 0xFFFF);
 }
 
 uint32_t serial_mm_readl (void *opaque, target_phys_addr_t addr)
@@ -788,7 +787,7 @@ uint32_t serial_mm_readl (void *opaque, target_phys_addr_t addr)
     SerialState *s = opaque;
     uint32_t val;
 
-    val = serial_ioport_read(s, (addr - s->base) >> s->it_shift);
+    val = serial_ioport_read(s, addr >> s->it_shift);
 #ifdef TARGET_WORDS_BIGENDIAN
     val = bswap32(val);
 #endif
@@ -802,7 +801,7 @@ void serial_mm_writel (void *opaque,
 #ifdef TARGET_WORDS_BIGENDIAN
     value = bswap32(value);
 #endif
-    serial_ioport_write(s, (addr - s->base) >> s->it_shift, value);
+    serial_ioport_write(s, addr >> s->it_shift, value);
 }
 
 static CPUReadMemoryFunc *serial_mm_read[] = {
@@ -828,7 +827,6 @@ SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
     if (!s)
         return NULL;
 
-    s->base = base;
     s->it_shift = it_shift;
 
     serial_init_core(s, irq, baudbase, chr);
diff --git a/hw/sh7750.c b/hw/sh7750.c
index 33e733704e..1d18010282 100644
--- a/hw/sh7750.c
+++ b/hw/sh7750.c
@@ -643,7 +643,8 @@ SH7750State *sh7750_init(CPUSH4State * cpu)
     sh7750_io_memory = cpu_register_io_memory(0,
 					      sh7750_mem_read,
 					      sh7750_mem_write, s);
-    cpu_register_physical_memory(0x1c000000, 0x04000000, sh7750_io_memory);
+    cpu_register_physical_memory_offset(0x1c000000, 0x04000000,
+                                        sh7750_io_memory, 0x1c000000);
 
     sh7750_mm_cache_and_tlb = cpu_register_io_memory(0,
 						     sh7750_mmct_read,
diff --git a/hw/sh_intc.c b/hw/sh_intc.c
index a78419bede..99db51c6df 100644
--- a/hw/sh_intc.c
+++ b/hw/sh_intc.c
@@ -308,7 +308,8 @@ static void sh_intc_register(struct intc_desc *desc,
 			     unsigned long address)
 {
     if (address)
-        cpu_register_physical_memory(INTC_A7(address), 4, desc->iomemtype);
+        cpu_register_physical_memory_offset(INTC_A7(address), 4,
+                                            desc->iomemtype, INTC_A7(address));
 }
 
 static void sh_intc_register_source(struct intc_desc *desc,
diff --git a/hw/sh_serial.c b/hw/sh_serial.c
index 814bd38a5a..8397739de9 100644
--- a/hw/sh_serial.c
+++ b/hw/sh_serial.c
@@ -53,7 +53,6 @@ typedef struct {
     uint8_t rx_tail;
     uint8_t rx_head;
 
-    target_phys_addr_t base;
     int freq;
     int feat;
     int flags;
@@ -82,8 +81,8 @@ static void sh_serial_ioport_write(void *opaque, uint32_t offs, uint32_t val)
     unsigned char ch;
 
 #ifdef DEBUG_SERIAL
-    printf("sh_serial: write base=0x%08lx offs=0x%02x val=0x%02x\n",
-	   (unsigned long) s->base, offs, val);
+    printf("sh_serial: write offs=0x%02x val=0x%02x\n",
+	   offs, val);
 #endif
     switch(offs) {
     case 0x00: /* SMR */
@@ -278,8 +277,8 @@ static uint32_t sh_serial_ioport_read(void *opaque, uint32_t offs)
 #endif
     }
 #ifdef DEBUG_SERIAL
-    printf("sh_serial: read base=0x%08lx offs=0x%02x val=0x%x\n",
-	   (unsigned long) s->base, offs, ret);
+    printf("sh_serial: read offs=0x%02x val=0x%x\n",
+	   offs, ret);
 #endif
 
     if (ret & ~((1 << 16) - 1)) {
@@ -343,14 +342,14 @@ static void sh_serial_event(void *opaque, int event)
 static uint32_t sh_serial_read (void *opaque, target_phys_addr_t addr)
 {
     sh_serial_state *s = opaque;
-    return sh_serial_ioport_read(s, addr - s->base);
+    return sh_serial_ioport_read(s, addr);
 }
 
 static void sh_serial_write (void *opaque,
                              target_phys_addr_t addr, uint32_t value)
 {
     sh_serial_state *s = opaque;
-    sh_serial_ioport_write(s, addr - s->base, value);
+    sh_serial_ioport_write(s, addr, value);
 }
 
 static CPUReadMemoryFunc *sh_serial_readfn[] = {
@@ -380,7 +379,6 @@ void sh_serial_init (target_phys_addr_t base, int feat,
     if (!s)
         return;
 
-    s->base = base;
     s->feat = feat;
     s->flags = SH_SERIAL_FLAG_TEND | SH_SERIAL_FLAG_TDE;
     s->rtrg = 1;
diff --git a/hw/sh_timer.c b/hw/sh_timer.c
index 743a970a4b..4557a8354c 100644
--- a/hw/sh_timer.c
+++ b/hw/sh_timer.c
@@ -211,7 +211,6 @@ typedef struct {
     int level[3];
     uint32_t tocr;
     uint32_t tstr;
-    target_phys_addr_t base;
     int feat;
 } tmu012_state;
 
@@ -222,7 +221,6 @@ static uint32_t tmu012_read(void *opaque, target_phys_addr_t offset)
 #ifdef DEBUG_TIMER
     printf("tmu012_read 0x%lx\n", (unsigned long) offset);
 #endif
-    offset -= s->base;
 
     if (offset >= 0x20) {
         if (!(s->feat & TMU012_FEAT_3CHAN))
@@ -256,7 +254,6 @@ static void tmu012_write(void *opaque, target_phys_addr_t offset,
 #ifdef DEBUG_TIMER
     printf("tmu012_write 0x%lx 0x%08x\n", (unsigned long) offset, value);
 #endif
-    offset -= s->base;
 
     if (offset >= 0x20) {
         if (!(s->feat & TMU012_FEAT_3CHAN))
@@ -315,7 +312,6 @@ void tmu012_init(target_phys_addr_t base, int feat, uint32_t freq,
     int timer_feat = (feat & TMU012_FEAT_EXTCLK) ? TIMER_FEAT_EXTCLK : 0;
 
     s = (tmu012_state *)qemu_mallocz(sizeof(tmu012_state));
-    s->base = base;
     s->feat = feat;
     s->timer[0] = sh_timer_init(freq, timer_feat, ch0_irq);
     s->timer[1] = sh_timer_init(freq, timer_feat, ch1_irq);
diff --git a/hw/slavio_intctl.c b/hw/slavio_intctl.c
index 6a5d505030..eaceda0c81 100644
--- a/hw/slavio_intctl.c
+++ b/hw/slavio_intctl.c
@@ -387,8 +387,8 @@ void *slavio_intctl_init(target_phys_addr_t addr, target_phys_addr_t addrg,
                                                          slavio_intctl_mem_read,
                                                          slavio_intctl_mem_write,
                                                          s);
-        cpu_register_physical_memory(addr + i * TARGET_PAGE_SIZE, INTCTL_SIZE,
-                                     slavio_intctl_io_memory);
+        cpu_register_physical_memory_offset(addr + i * TARGET_PAGE_SIZE,
+                INTCTL_SIZE, slavio_intctl_io_memory, i * TARGET_PAGE_SIZE);
         s->cpu_irqs[i] = parent_irq[i];
     }
 
diff --git a/hw/slavio_misc.c b/hw/slavio_misc.c
index 2890cfda02..197880f2f3 100644
--- a/hw/slavio_misc.c
+++ b/hw/slavio_misc.c
@@ -431,11 +431,14 @@ void *slavio_misc_init(target_phys_addr_t base, target_phys_addr_t power_base,
         io = cpu_register_io_memory(0, slavio_misc_mem_read,
                                     slavio_misc_mem_write, s);
         // Slavio control
-        cpu_register_physical_memory(base + MISC_CFG, MISC_SIZE, io);
+        cpu_register_physical_memory_offset(base + MISC_CFG, MISC_SIZE, io,
+                                            MISC_CFG);
         // Diagnostics
-        cpu_register_physical_memory(base + MISC_DIAG, MISC_SIZE, io);
+        cpu_register_physical_memory_offset(base + MISC_DIAG, MISC_SIZE, io,
+                                            MISC_DIAG);
         // Modem control
-        cpu_register_physical_memory(base + MISC_MDM, MISC_SIZE, io);
+        cpu_register_physical_memory_offset(base + MISC_MDM, MISC_SIZE, io,
+                                            MISC_MDM);
 
         /* 16 bit registers */
         io = cpu_register_io_memory(0, slavio_led_mem_read,
diff --git a/hw/sm501.c b/hw/sm501.c
index 64d5731e46..de6107521c 100644
--- a/hw/sm501.c
+++ b/hw/sm501.c
@@ -529,12 +529,10 @@ static uint32_t get_local_mem_size_index(uint32_t size)
 static uint32_t sm501_system_config_read(void *opaque, target_phys_addr_t addr)
 {
     SM501State * s = (SM501State *)opaque;
-    uint32_t offset = addr - (s->base + MMIO_BASE_OFFSET);
     uint32_t ret = 0;
-    SM501_DPRINTF("sm501 system config regs : read addr=%x, offset=%x\n",
-		  addr, offset);
+    SM501_DPRINTF("sm501 system config regs : read addr=%x\n", (int)addr);
 
-    switch(offset) {
+    switch(addr) {
     case SM501_SYSTEM_CONTROL:
 	ret = s->system_control;
 	break;
@@ -573,7 +571,7 @@ static uint32_t sm501_system_config_read(void *opaque, target_phys_addr_t addr)
 
     default:
 	printf("sm501 system config : not implemented register read."
-	       " addr=%x, offset=%x\n", addr, offset);
+	       " addr=%x\n", (int)addr);
 	assert(0);
     }
 
@@ -584,11 +582,10 @@ static void sm501_system_config_write(void *opaque,
 				      target_phys_addr_t addr, uint32_t value)
 {
     SM501State * s = (SM501State *)opaque;
-    uint32_t offset = addr - (s->base + MMIO_BASE_OFFSET);
-    SM501_DPRINTF("sm501 system config regs : write addr=%x, ofs=%x, val=%x\n",
-		  addr, offset, value);
+    SM501_DPRINTF("sm501 system config regs : write addr=%x, val=%x\n",
+		  addr, value);
 
-    switch(offset) {
+    switch(addr) {
     case SM501_SYSTEM_CONTROL:
 	s->system_control = value & 0xE300B8F7;
 	break;
@@ -624,7 +621,7 @@ static void sm501_system_config_write(void *opaque,
 
     default:
 	printf("sm501 system config : not implemented register write."
-	       " addr=%x, val=%x\n", addr, value);
+	       " addr=%x, val=%x\n", (int)addr, value);
 	assert(0);
     }
 }
@@ -641,16 +638,13 @@ static CPUWriteMemoryFunc *sm501_system_config_writefn[] = {
     &sm501_system_config_write,
 };
 
-static uint32_t sm501_disp_ctrl_read(void *opaque,
-					      target_phys_addr_t addr)
+static uint32_t sm501_disp_ctrl_read(void *opaque, target_phys_addr_t addr)
 {
     SM501State * s = (SM501State *)opaque;
-    uint32_t offset = addr - (s->base + MMIO_BASE_OFFSET + SM501_DC);
     uint32_t ret = 0;
-    SM501_DPRINTF("sm501 disp ctrl regs : read addr=%x, offset=%x\n",
-		  addr, offset);
+    SM501_DPRINTF("sm501 disp ctrl regs : read addr=%x\n", (int)addr);
 
-    switch(offset) {
+    switch(addr) {
 
     case SM501_DC_PANEL_CONTROL:
 	ret = s->dc_panel_control;
@@ -727,7 +721,7 @@ static uint32_t sm501_disp_ctrl_read(void *opaque,
 
     default:
 	printf("sm501 disp ctrl : not implemented register read."
-	       " addr=%x, offset=%x\n", addr, offset);
+	       " addr=%x\n", (int)addr);
 	assert(0);
     }
 
@@ -739,11 +733,10 @@ static void sm501_disp_ctrl_write(void *opaque,
 					   uint32_t value)
 {
     SM501State * s = (SM501State *)opaque;
-    uint32_t offset = addr - (s->base + MMIO_BASE_OFFSET + SM501_DC);
-    SM501_DPRINTF("sm501 disp ctrl regs : write addr=%x, ofs=%x, val=%x\n",
-		  addr, offset, value);
+    SM501_DPRINTF("sm501 disp ctrl regs : write addr=%x, val=%x\n",
+		  addr, value);
 
-    switch(offset) {
+    switch(addr) {
     case SM501_DC_PANEL_CONTROL:
 	s->dc_panel_control = value & 0x0FFF73FF;
 	break;
@@ -832,7 +825,7 @@ static void sm501_disp_ctrl_write(void *opaque,
 
     default:
 	printf("sm501 disp ctrl : not implemented register write."
-	       " addr=%x, val=%x\n", addr, value);
+	       " addr=%x, val=%x\n", (int)addr, value);
 	assert(0);
     }
 }
@@ -852,31 +845,27 @@ static CPUWriteMemoryFunc *sm501_disp_ctrl_writefn[] = {
 static uint32_t sm501_palette_read(void *opaque, target_phys_addr_t addr)
 {
     SM501State * s = (SM501State *)opaque;
-    uint32_t offset = addr - (s->base + MMIO_BASE_OFFSET
-			      + SM501_DC + SM501_DC_PANEL_PALETTE);
-    SM501_DPRINTF("sm501 palette read addr=%x, offset=%x\n", addr, offset);
+    SM501_DPRINTF("sm501 palette read addr=%x\n", (int)addr);
 
     /* TODO : consider BYTE/WORD access */
     /* TODO : consider endian */
 
-    assert(0 <= offset && offset < 0x400 * 3);
-    return *(uint32_t*)&s->dc_palette[offset];
+    assert(0 <= addr && addr < 0x400 * 3);
+    return *(uint32_t*)&s->dc_palette[addr];
 }
 
 static void sm501_palette_write(void *opaque,
 				target_phys_addr_t addr, uint32_t value)
 {
     SM501State * s = (SM501State *)opaque;
-    uint32_t offset = addr - (s->base + MMIO_BASE_OFFSET
-			      + SM501_DC + SM501_DC_PANEL_PALETTE);
-    SM501_DPRINTF("sm501 palette write addr=%x, ofs=%x, val=%x\n",
-		  addr, offset, value);
+    SM501_DPRINTF("sm501 palette write addr=%x, val=%x\n",
+		  (int)addr, value);
 
     /* TODO : consider BYTE/WORD access */
     /* TODO : consider endian */
 
-    assert(0 <= offset && offset < 0x400 * 3);
-    *(uint32_t*)&s->dc_palette[offset] = value;
+    assert(0 <= addr && addr < 0x400 * 3);
+    *(uint32_t*)&s->dc_palette[addr] = value;
 }
 
 static CPUReadMemoryFunc *sm501_palette_readfn[] = {
diff --git a/hw/smc91c111.c b/hw/smc91c111.c
index 410051d3cc..a517033b71 100644
--- a/hw/smc91c111.c
+++ b/hw/smc91c111.c
@@ -17,7 +17,6 @@
 #define NUM_PACKETS 4
 
 typedef struct {
-    uint32_t base;
     VLANClientState *vc;
     uint16_t tcr;
     uint16_t rcr;
@@ -249,7 +248,6 @@ static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
 {
     smc91c111_state *s = (smc91c111_state *)opaque;
 
-    offset -= s->base;
     if (offset == 14) {
         s->bank = value;
         return;
@@ -422,7 +420,6 @@ static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
 {
     smc91c111_state *s = (smc91c111_state *)opaque;
 
-    offset -= s->base;
     if (offset == 14) {
         return s->bank;
     }
@@ -571,10 +568,9 @@ static void smc91c111_writew(void *opaque, target_phys_addr_t offset,
 static void smc91c111_writel(void *opaque, target_phys_addr_t offset,
                              uint32_t value)
 {
-    smc91c111_state *s = (smc91c111_state *)opaque;
     /* 32-bit writes to offset 0xc only actually write to the bank select
        register (offset 0xe)  */
-    if (offset != s->base + 0xc)
+    if (offset != 0xc)
         smc91c111_writew(opaque, offset, value & 0xffff);
     smc91c111_writew(opaque, offset + 2, value >> 16);
 }
@@ -703,7 +699,6 @@ void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     iomemtype = cpu_register_io_memory(0, smc91c111_readfn,
                                        smc91c111_writefn, s);
     cpu_register_physical_memory(base, 16, iomemtype);
-    s->base = base;
     s->irq = irq;
     memcpy(s->macaddr, nd->macaddr, 6);
 
diff --git a/hw/spitz.c b/hw/spitz.c
index fc7717460e..e551fa68b0 100644
--- a/hw/spitz.c
+++ b/hw/spitz.c
@@ -48,7 +48,6 @@
 #define FLASHCTL_NCE		(FLASHCTL_CE0 | FLASHCTL_CE1)
 
 struct sl_nand_s {
-    target_phys_addr_t target_base;
     struct nand_flash_s *nand;
     uint8_t ctl;
     struct ecc_state_s ecc;
@@ -58,7 +57,6 @@ static uint32_t sl_readb(void *opaque, target_phys_addr_t addr)
 {
     struct sl_nand_s *s = (struct sl_nand_s *) opaque;
     int ryby;
-    addr -= s->target_base;
 
     switch (addr) {
 #define BSHR(byte, from, to)	((s->ecc.lp[byte] >> (from - to)) & (1 << to))
@@ -96,7 +94,6 @@ static uint32_t sl_readb(void *opaque, target_phys_addr_t addr)
 static uint32_t sl_readl(void *opaque, target_phys_addr_t addr)
 {
     struct sl_nand_s *s = (struct sl_nand_s *) opaque;
-    addr -= s->target_base;
 
     if (addr == FLASH_FLASHIO)
         return ecc_digest(&s->ecc, nand_getio(s->nand)) |
@@ -109,7 +106,6 @@ static void sl_writeb(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct sl_nand_s *s = (struct sl_nand_s *) opaque;
-    addr -= s->target_base;
 
     switch (addr) {
     case FLASH_ECCCLRR:
@@ -175,7 +171,6 @@ static void sl_flash_register(struct pxa2xx_state_s *cpu, int size)
     };
 
     s = (struct sl_nand_s *) qemu_mallocz(sizeof(struct sl_nand_s));
-    s->target_base = FLASH_BASE;
     s->ctl = 0;
     if (size == FLASH_128M)
         s->nand = nand_init(NAND_MFR_SAMSUNG, 0x73);
@@ -184,7 +179,7 @@ static void sl_flash_register(struct pxa2xx_state_s *cpu, int size)
 
     iomemtype = cpu_register_io_memory(0, sl_readfn,
                     sl_writefn, s);
-    cpu_register_physical_memory(s->target_base, 0x40, iomemtype);
+    cpu_register_physical_memory(FLASH_BASE, 0x40, iomemtype);
 
     register_savevm("sl_flash", 0, 0, sl_save, sl_load, s);
 }
diff --git a/hw/stellaris.c b/hw/stellaris.c
index 5948079e17..703ef7e42c 100644
--- a/hw/stellaris.c
+++ b/hw/stellaris.c
@@ -57,7 +57,6 @@ typedef struct gptm_state {
     uint32_t rtc;
     int64_t tick[2];
     struct gptm_state *opaque[2];
-    uint32_t base;
     QEMUTimer *timer[2];
     /* The timers have an alternate output used to trigger the ADC.  */
     qemu_irq trigger;
@@ -148,7 +147,6 @@ static uint32_t gptm_read(void *opaque, target_phys_addr_t offset)
 {
     gptm_state *s = (gptm_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* CFG */
         return s->config;
@@ -198,7 +196,6 @@ static void gptm_write(void *opaque, target_phys_addr_t offset, uint32_t value)
     gptm_state *s = (gptm_state *)opaque;
     uint32_t oldval;
 
-    offset -= s->base;
     /* The timers should be disabled before changing the configuration.
        We take advantage of this and defer everything until the timer
        is enabled.  */
@@ -351,7 +348,6 @@ static void stellaris_gptm_init(uint32_t base, qemu_irq irq, qemu_irq trigger)
     gptm_state *s;
 
     s = (gptm_state *)qemu_mallocz(sizeof(gptm_state));
-    s->base = base;
     s->irq = irq;
     s->trigger = trigger;
     s->opaque[0] = s->opaque[1] = s;
@@ -368,7 +364,6 @@ static void stellaris_gptm_init(uint32_t base, qemu_irq irq, qemu_irq trigger)
 /* System controller.  */
 
 typedef struct {
-    uint32_t base;
     uint32_t pborctl;
     uint32_t ldopctl;
     uint32_t int_status;
@@ -433,7 +428,6 @@ static uint32_t ssys_read(void *opaque, target_phys_addr_t offset)
 {
     ssys_state *s = (ssys_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x000: /* DID0 */
         return s->board->did0;
@@ -520,7 +514,6 @@ static void ssys_write(void *opaque, target_phys_addr_t offset, uint32_t value)
 {
     ssys_state *s = (ssys_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x030: /* PBORCTL */
         s->pborctl = value & 0xffff;
@@ -672,7 +665,6 @@ static void stellaris_sys_init(uint32_t base, qemu_irq irq,
     ssys_state *s;
 
     s = (ssys_state *)qemu_mallocz(sizeof(ssys_state));
-    s->base = base;
     s->irq = irq;
     s->board = board;
     /* Most devices come preprogrammed with a MAC address in the user data. */
@@ -692,7 +684,6 @@ static void stellaris_sys_init(uint32_t base, qemu_irq irq,
 typedef struct {
     i2c_bus *bus;
     qemu_irq irq;
-    uint32_t base;
     uint32_t msa;
     uint32_t mcs;
     uint32_t mdr;
@@ -714,7 +705,6 @@ static uint32_t stellaris_i2c_read(void *opaque, target_phys_addr_t offset)
 {
     stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* MSA */
         return s->msa;
@@ -753,7 +743,6 @@ static void stellaris_i2c_write(void *opaque, target_phys_addr_t offset,
 {
     stellaris_i2c_state *s = (stellaris_i2c_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* MSA */
         s->msa = value & 0xff;
@@ -890,7 +879,6 @@ static void stellaris_i2c_init(uint32_t base, qemu_irq irq, i2c_bus *bus)
     int iomemtype;
 
     s = (stellaris_i2c_state *)qemu_mallocz(sizeof(stellaris_i2c_state));
-    s->base = base;
     s->irq = irq;
     s->bus = bus;
 
@@ -919,7 +907,6 @@ static void stellaris_i2c_init(uint32_t base, qemu_irq irq, i2c_bus *bus)
 
 typedef struct
 {
-    uint32_t base;
     uint32_t actss;
     uint32_t ris;
     uint32_t im;
@@ -1013,7 +1000,6 @@ static uint32_t stellaris_adc_read(void *opaque, target_phys_addr_t offset)
     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
 
     /* TODO: Implement this.  */
-    offset -= s->base;
     if (offset >= 0x40 && offset < 0xc0) {
         int n;
         n = (offset - 0x40) >> 5;
@@ -1062,7 +1048,6 @@ static void stellaris_adc_write(void *opaque, target_phys_addr_t offset,
     stellaris_adc_state *s = (stellaris_adc_state *)opaque;
 
     /* TODO: Implement this.  */
-    offset -= s->base;
     if (offset >= 0x40 && offset < 0xc0) {
         int n;
         n = (offset - 0x40) >> 5;
@@ -1194,7 +1179,6 @@ static qemu_irq stellaris_adc_init(uint32_t base, qemu_irq irq)
     qemu_irq *qi;
 
     s = (stellaris_adc_state *)qemu_mallocz(sizeof(stellaris_adc_state));
-    s->base = base;
     s->irq = irq;
 
     iomemtype = cpu_register_io_memory(0, stellaris_adc_readfn,
diff --git a/hw/stellaris_enet.c b/hw/stellaris_enet.c
index 8057f80f31..09d92b1344 100644
--- a/hw/stellaris_enet.c
+++ b/hw/stellaris_enet.c
@@ -44,7 +44,6 @@ do { fprintf(stderr, "stellaris_enet: error: " fmt , ##args);} while (0)
 #define SE_TCTL_DUPLEX  0x08
 
 typedef struct {
-    uint32_t base;
     uint32_t ris;
     uint32_t im;
     uint32_t rctl;
@@ -133,7 +132,6 @@ static uint32_t stellaris_enet_read(void *opaque, target_phys_addr_t offset)
     stellaris_enet_state *s = (stellaris_enet_state *)opaque;
     uint32_t val;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* RIS */
         DPRINTF("IRQ status %02x\n", s->ris);
@@ -202,7 +200,6 @@ static void stellaris_enet_write(void *opaque, target_phys_addr_t offset,
 {
     stellaris_enet_state *s = (stellaris_enet_state *)opaque;
 
-    offset -= s->base;
     switch (offset) {
     case 0x00: /* IACK */
         s->ris &= ~value;
@@ -396,7 +393,6 @@ void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     iomemtype = cpu_register_io_memory(0, stellaris_enet_readfn,
                                        stellaris_enet_writefn, s);
     cpu_register_physical_memory(base, 0x00001000, iomemtype);
-    s->base = base;
     s->irq = irq;
     memcpy(s->macaddr, nd->macaddr, 6);
 
diff --git a/hw/tc6393xb.c b/hw/tc6393xb.c
index 3af791fab5..a5fed5f1a1 100644
--- a/hw/tc6393xb.c
+++ b/hw/tc6393xb.c
@@ -79,7 +79,6 @@
 #define NAND_MODE_ECC_RST   0x60
 
 struct tc6393xb_s {
-    target_phys_addr_t target_base;
     qemu_irq irq;
     qemu_irq *sub_irqs;
     struct {
@@ -498,7 +497,6 @@ static void tc6393xb_update_display(void *opaque)
 
 static uint32_t tc6393xb_readb(void *opaque, target_phys_addr_t addr) {
     struct tc6393xb_s *s = opaque;
-    addr -= s->target_base;
 
     switch (addr >> 8) {
         case 0:
@@ -520,7 +518,6 @@ static uint32_t tc6393xb_readb(void *opaque, target_phys_addr_t addr) {
 
 static void tc6393xb_writeb(void *opaque, target_phys_addr_t addr, uint32_t value) {
     struct tc6393xb_s *s = opaque;
-    addr -= s->target_base;
 
     switch (addr >> 8) {
         case 0:
@@ -582,7 +579,6 @@ struct tc6393xb_s *tc6393xb_init(uint32_t base, qemu_irq irq, DisplayState *ds)
     };
 
     s = (struct tc6393xb_s *) qemu_mallocz(sizeof(struct tc6393xb_s));
-    s->target_base = base;
     s->irq = irq;
     s->gpio_in = qemu_allocate_irqs(tc6393xb_gpio_set, s, TC6393XB_GPIOS);
 
@@ -595,12 +591,12 @@ struct tc6393xb_s *tc6393xb_init(uint32_t base, qemu_irq irq, DisplayState *ds)
 
     iomemtype = cpu_register_io_memory(0, tc6393xb_readfn,
                     tc6393xb_writefn, s);
-    cpu_register_physical_memory(s->target_base, 0x10000, iomemtype);
+    cpu_register_physical_memory(base, 0x10000, iomemtype);
 
     if (ds) {
         s->ds = ds;
         s->vram_addr = qemu_ram_alloc(0x100000);
-        cpu_register_physical_memory(s->target_base + 0x100000, 0x100000, s->vram_addr);
+        cpu_register_physical_memory(base + 0x100000, 0x100000, s->vram_addr);
         s->scr_width = 480;
         s->scr_height = 640;
         s->console = graphic_console_init(ds,
diff --git a/hw/usb-ohci.c b/hw/usb-ohci.c
index 55cb77b79a..585f3a4635 100644
--- a/hw/usb-ohci.c
+++ b/hw/usb-ohci.c
@@ -66,7 +66,6 @@ enum ohci_type {
 typedef struct {
     qemu_irq irq;
     enum ohci_type type;
-    target_phys_addr_t mem_base;
     int mem;
     int num_ports;
     const char *name;
@@ -1362,8 +1361,6 @@ static uint32_t ohci_mem_read(void *ptr, target_phys_addr_t addr)
 {
     OHCIState *ohci = ptr;
 
-    addr -= ohci->mem_base;
-
     /* Only aligned reads are allowed on OHCI */
     if (addr & 3) {
         fprintf(stderr, "usb-ohci: Mis-aligned read\n");
@@ -1460,8 +1457,6 @@ static void ohci_mem_write(void *ptr, target_phys_addr_t addr, uint32_t val)
 {
     OHCIState *ohci = ptr;
 
-    addr -= ohci->mem_base;
-
     /* Only aligned reads are allowed on OHCI */
     if (addr & 3) {
         fprintf(stderr, "usb-ohci: Mis-aligned write\n");
@@ -1638,7 +1633,6 @@ static void ohci_mapfunc(PCIDevice *pci_dev, int i,
             uint32_t addr, uint32_t size, int type)
 {
     OHCIPCIState *ohci = (OHCIPCIState *)pci_dev;
-    ohci->state.mem_base = addr;
     cpu_register_physical_memory(addr, size, ohci->state.mem);
 }
 
@@ -1678,7 +1672,6 @@ void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
 
     usb_ohci_init(ohci, num_ports, devfn, irq,
                   OHCI_TYPE_PXA, "OHCI USB");
-    ohci->mem_base = base;
 
-    cpu_register_physical_memory(ohci->mem_base, 0x1000, ohci->mem);
+    cpu_register_physical_memory(base, 0x1000, ohci->mem);
 }
diff --git a/hw/versatilepb.c b/hw/versatilepb.c
index f9e9988fc6..e5d02f2bb9 100644
--- a/hw/versatilepb.c
+++ b/hw/versatilepb.c
@@ -20,7 +20,6 @@
 
 typedef struct vpb_sic_state
 {
-  uint32_t base;
   uint32_t level;
   uint32_t mask;
   uint32_t pic_enable;
@@ -65,7 +64,6 @@ static uint32_t vpb_sic_read(void *opaque, target_phys_addr_t offset)
 {
     vpb_sic_state *s = (vpb_sic_state *)opaque;
 
-    offset -= s->base;
     switch (offset >> 2) {
     case 0: /* STATUS */
         return s->level & s->mask;
@@ -87,7 +85,6 @@ static void vpb_sic_write(void *opaque, target_phys_addr_t offset,
                           uint32_t value)
 {
     vpb_sic_state *s = (vpb_sic_state *)opaque;
-    offset -= s->base;
 
     switch (offset >> 2) {
     case 2: /* ENSET */
@@ -141,7 +138,6 @@ static qemu_irq *vpb_sic_init(uint32_t base, qemu_irq *parent, int irq)
     if (!s)
         return NULL;
     qi = qemu_allocate_irqs(vpb_sic_set_irq, s, 32);
-    s->base = base;
     s->parent = parent;
     s->irq = irq;
     iomemtype = cpu_register_io_memory(0, vpb_sic_readfn,
diff --git a/hw/vga.c b/hw/vga.c
index 492d3f9ace..132dd0bd1a 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -2263,7 +2263,7 @@ static uint32_t vga_mm_readb (void *opaque, target_phys_addr_t addr)
 {
     VGAState *s = opaque;
 
-    return vga_ioport_read(s, (addr - s->base_ctrl) >> s->it_shift) & 0xff;
+    return vga_ioport_read(s, addr >> s->it_shift) & 0xff;
 }
 
 static void vga_mm_writeb (void *opaque,
@@ -2271,14 +2271,14 @@ static void vga_mm_writeb (void *opaque,
 {
     VGAState *s = opaque;
 
-    vga_ioport_write(s, (addr - s->base_ctrl) >> s->it_shift, value & 0xff);
+    vga_ioport_write(s, addr >> s->it_shift, value & 0xff);
 }
 
 static uint32_t vga_mm_readw (void *opaque, target_phys_addr_t addr)
 {
     VGAState *s = opaque;
 
-    return vga_ioport_read(s, (addr - s->base_ctrl) >> s->it_shift) & 0xffff;
+    return vga_ioport_read(s, addr >> s->it_shift) & 0xffff;
 }
 
 static void vga_mm_writew (void *opaque,
@@ -2286,14 +2286,14 @@ static void vga_mm_writew (void *opaque,
 {
     VGAState *s = opaque;
 
-    vga_ioport_write(s, (addr - s->base_ctrl) >> s->it_shift, value & 0xffff);
+    vga_ioport_write(s, addr >> s->it_shift, value & 0xffff);
 }
 
 static uint32_t vga_mm_readl (void *opaque, target_phys_addr_t addr)
 {
     VGAState *s = opaque;
 
-    return vga_ioport_read(s, (addr - s->base_ctrl) >> s->it_shift);
+    return vga_ioport_read(s, addr >> s->it_shift);
 }
 
 static void vga_mm_writel (void *opaque,
@@ -2301,7 +2301,7 @@ static void vga_mm_writel (void *opaque,
 {
     VGAState *s = opaque;
 
-    vga_ioport_write(s, (addr - s->base_ctrl) >> s->it_shift, value);
+    vga_ioport_write(s, addr >> s->it_shift, value);
 }
 
 static CPUReadMemoryFunc *vga_mm_read_ctrl[] = {
@@ -2321,7 +2321,6 @@ static void vga_mm_init(VGAState *s, target_phys_addr_t vram_base,
 {
     int s_ioport_ctrl, vga_io_memory;
 
-    s->base_ctrl = ctrl_base;
     s->it_shift = it_shift;
     s_ioport_ctrl = cpu_register_io_memory(0, vga_mm_read_ctrl, vga_mm_write_ctrl, s);
     vga_io_memory = cpu_register_io_memory(0, vga_mem_read, vga_mem_write, s);
diff --git a/hw/vga_int.h b/hw/vga_int.h
index b360d3e013..0c6ae7e71d 100644
--- a/hw/vga_int.h
+++ b/hw/vga_int.h
@@ -109,7 +109,6 @@ typedef void (* vga_update_retrace_info_fn)(struct VGAState *s);
     uint32_t lfb_vram_mapped; /* whether 0xa0000 is mapped as ram */    \
     unsigned long bios_offset;                                          \
     unsigned int bios_size;                                             \
-    target_phys_addr_t base_ctrl;                                       \
     int it_shift;                                                       \
     PCIDevice *pci_dev;                                                 \
     uint32_t latch;                                                     \
diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index 2b7c7d3d16..f7be907a3e 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -992,7 +992,6 @@ static void vmsvga_text_update(void *opaque, console_ch_t *chardata)
 static uint32_t vmsvga_vram_readb(void *opaque, target_phys_addr_t addr)
 {
     struct vmsvga_state_s *s = (struct vmsvga_state_s *) opaque;
-    addr -= s->vram_base;
     if (addr < s->fb_size)
         return *(uint8_t *) (ds_get_data(s->ds) + addr);
     else
@@ -1002,7 +1001,6 @@ static uint32_t vmsvga_vram_readb(void *opaque, target_phys_addr_t addr)
 static uint32_t vmsvga_vram_readw(void *opaque, target_phys_addr_t addr)
 {
     struct vmsvga_state_s *s = (struct vmsvga_state_s *) opaque;
-    addr -= s->vram_base;
     if (addr < s->fb_size)
         return *(uint16_t *) (ds_get_data(s->ds) + addr);
     else
@@ -1012,7 +1010,6 @@ static uint32_t vmsvga_vram_readw(void *opaque, target_phys_addr_t addr)
 static uint32_t vmsvga_vram_readl(void *opaque, target_phys_addr_t addr)
 {
     struct vmsvga_state_s *s = (struct vmsvga_state_s *) opaque;
-    addr -= s->vram_base;
     if (addr < s->fb_size)
         return *(uint32_t *) (ds_get_data(s->ds) + addr);
     else
@@ -1023,7 +1020,6 @@ static void vmsvga_vram_writeb(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct vmsvga_state_s *s = (struct vmsvga_state_s *) opaque;
-    addr -= s->vram_base;
     if (addr < s->fb_size)
         *(uint8_t *) (ds_get_data(s->ds) + addr) = value;
     else
@@ -1034,7 +1030,6 @@ static void vmsvga_vram_writew(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct vmsvga_state_s *s = (struct vmsvga_state_s *) opaque;
-    addr -= s->vram_base;
     if (addr < s->fb_size)
         *(uint16_t *) (ds_get_data(s->ds) + addr) = value;
     else
@@ -1045,7 +1040,6 @@ static void vmsvga_vram_writel(void *opaque, target_phys_addr_t addr,
                 uint32_t value)
 {
     struct vmsvga_state_s *s = (struct vmsvga_state_s *) opaque;
-    addr -= s->vram_base;
     if (addr < s->fb_size)
         *(uint32_t *) (ds_get_data(s->ds) + addr) = value;
     else
diff --git a/hw/zaurus.c b/hw/zaurus.c
index 8ba2d4acf9..b840dfc03a 100644
--- a/hw/zaurus.c
+++ b/hw/zaurus.c
@@ -31,7 +31,6 @@
 /* SCOOP devices */
 
 struct scoop_info_s {
-    target_phys_addr_t target_base;
     qemu_irq handler[16];
     qemu_irq *in;
     uint16_t status;
@@ -76,7 +75,6 @@ static inline void scoop_gpio_handler_update(struct scoop_info_s *s) {
 static uint32_t scoop_readb(void *opaque, target_phys_addr_t addr)
 {
     struct scoop_info_s *s = (struct scoop_info_s *) opaque;
-    addr -= s->target_base;
 
     switch (addr) {
     case SCOOP_MCR:
@@ -110,7 +108,6 @@ static uint32_t scoop_readb(void *opaque, target_phys_addr_t addr)
 static void scoop_writeb(void *opaque, target_phys_addr_t addr, uint32_t value)
 {
     struct scoop_info_s *s = (struct scoop_info_s *) opaque;
-    addr -= s->target_base;
     value &= 0xffff;
 
     switch (addr) {
@@ -234,12 +231,11 @@ struct scoop_info_s *scoop_init(struct pxa2xx_state_s *cpu,
             qemu_mallocz(sizeof(struct scoop_info_s));
     memset(s, 0, sizeof(struct scoop_info_s));
 
-    s->target_base = target_base;
     s->status = 0x02;
     s->in = qemu_allocate_irqs(scoop_gpio_set, s, 16);
     iomemtype = cpu_register_io_memory(0, scoop_readfn,
                     scoop_writefn, s);
-    cpu_register_physical_memory(s->target_base, 0x1000, iomemtype);
+    cpu_register_physical_memory(target_base, 0x1000, iomemtype);
     register_savevm("scoop", instance, 1, scoop_save, scoop_load, s);
 
     return s;