exec: Make stl_*_phys input an AddressSpace

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

25 files changed, 137 insertions, 119 deletions

diff --git a/exec.c b/exec.c
index 226cd96e9c..607375b4d6 100644
--- a/exec.c
+++ b/exec.c
@@ -1631,7 +1631,7 @@ static void watch_mem_write(void *opaque, hwaddr addr,
         stw_phys(addr, val);
         break;
     case 4:
-        stl_phys(addr, val);
+        stl_phys(&address_space_memory, addr, val);
         break;
     default: abort();
     }
@@ -2564,7 +2564,8 @@ void stl_phys_notdirty(hwaddr addr, uint32_t val)
 }
 
 /* warning: addr must be aligned */
-static inline void stl_phys_internal(hwaddr addr, uint32_t val,
+static inline void stl_phys_internal(AddressSpace *as,
+                                     hwaddr addr, uint32_t val,
                                      enum device_endian endian)
 {
     uint8_t *ptr;
@@ -2572,7 +2573,7 @@ static inline void stl_phys_internal(hwaddr addr, uint32_t val,
     hwaddr l = 4;
     hwaddr addr1;
 
-    mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
+    mr = address_space_translate(as, addr, &addr1, &l,
                                  true);
     if (l < 4 || !memory_access_is_direct(mr, true)) {
 #if defined(TARGET_WORDS_BIGENDIAN)
@@ -2604,19 +2605,19 @@ static inline void stl_phys_internal(hwaddr addr, uint32_t val,
     }
 }
 
-void stl_phys(hwaddr addr, uint32_t val)
+void stl_phys(AddressSpace *as, hwaddr addr, uint32_t val)
 {
-    stl_phys_internal(addr, val, DEVICE_NATIVE_ENDIAN);
+    stl_phys_internal(as, addr, val, DEVICE_NATIVE_ENDIAN);
 }
 
-void stl_le_phys(hwaddr addr, uint32_t val)
+void stl_le_phys(AddressSpace *as, hwaddr addr, uint32_t val)
 {
-    stl_phys_internal(addr, val, DEVICE_LITTLE_ENDIAN);
+    stl_phys_internal(as, addr, val, DEVICE_LITTLE_ENDIAN);
 }
 
-void stl_be_phys(hwaddr addr, uint32_t val)
+void stl_be_phys(AddressSpace *as, hwaddr addr, uint32_t val)
 {
-    stl_phys_internal(addr, val, DEVICE_BIG_ENDIAN);
+    stl_phys_internal(as, addr, val, DEVICE_BIG_ENDIAN);
 }
 
 /* XXX: optimize */
diff --git a/hw/net/vmware_utils.h b/hw/net/vmware_utils.h
index 4cf0e79a1b..2ed73afbb0 100644
--- a/hw/net/vmware_utils.h
+++ b/hw/net/vmware_utils.h
@@ -104,7 +104,7 @@ static inline void
 vmw_shmem_st32(hwaddr addr, uint32_t value)
 {
     VMW_SHPRN("SHMEM store32: %" PRIx64 " (value 0x%X)", addr, value);
-    stl_le_phys(addr, value);
+    stl_le_phys(&address_space_memory, addr, value);
 }
 
 static inline uint64_t
diff --git a/hw/pci/msi.c b/hw/pci/msi.c
index 2a04d18884..a4a3040d4d 100644
--- a/hw/pci/msi.c
+++ b/hw/pci/msi.c
@@ -291,7 +291,7 @@ void msi_notify(PCIDevice *dev, unsigned int vector)
                    "notify vector 0x%x"
                    " address: 0x%"PRIx64" data: 0x%"PRIx32"\n",
                    vector, msg.address, msg.data);
-    stl_le_phys(msg.address, msg.data);
+    stl_le_phys(&address_space_memory, msg.address, msg.data);
 }
 
 /* Normally called by pci_default_write_config(). */
diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index 3430770f33..5c49bfc304 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -439,7 +439,7 @@ void msix_notify(PCIDevice *dev, unsigned vector)
 
     msg = msix_get_message(dev, vector);
 
-    stl_le_phys(msg.address, msg.data);
+    stl_le_phys(&address_space_memory, msg.address, msg.data);
 }
 
 void msix_reset(PCIDevice *dev)
diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
index 8109f92200..47a4242512 100644
--- a/hw/ppc/ppc405_uc.c
+++ b/hw/ppc/ppc405_uc.c
@@ -44,6 +44,7 @@
 ram_addr_t ppc405_set_bootinfo (CPUPPCState *env, ppc4xx_bd_info_t *bd,
                                 uint32_t flags)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     ram_addr_t bdloc;
     int i, n;
 
@@ -52,30 +53,30 @@ ram_addr_t ppc405_set_bootinfo (CPUPPCState *env, ppc4xx_bd_info_t *bd,
         bdloc = 0x01000000UL - sizeof(struct ppc4xx_bd_info_t);
     else
         bdloc = bd->bi_memsize - sizeof(struct ppc4xx_bd_info_t);
-    stl_be_phys(bdloc + 0x00, bd->bi_memstart);
-    stl_be_phys(bdloc + 0x04, bd->bi_memsize);
-    stl_be_phys(bdloc + 0x08, bd->bi_flashstart);
-    stl_be_phys(bdloc + 0x0C, bd->bi_flashsize);
-    stl_be_phys(bdloc + 0x10, bd->bi_flashoffset);
-    stl_be_phys(bdloc + 0x14, bd->bi_sramstart);
-    stl_be_phys(bdloc + 0x18, bd->bi_sramsize);
-    stl_be_phys(bdloc + 0x1C, bd->bi_bootflags);
-    stl_be_phys(bdloc + 0x20, bd->bi_ipaddr);
+    stl_be_phys(cs->as, bdloc + 0x00, bd->bi_memstart);
+    stl_be_phys(cs->as, bdloc + 0x04, bd->bi_memsize);
+    stl_be_phys(cs->as, bdloc + 0x08, bd->bi_flashstart);
+    stl_be_phys(cs->as, bdloc + 0x0C, bd->bi_flashsize);
+    stl_be_phys(cs->as, bdloc + 0x10, bd->bi_flashoffset);
+    stl_be_phys(cs->as, bdloc + 0x14, bd->bi_sramstart);
+    stl_be_phys(cs->as, bdloc + 0x18, bd->bi_sramsize);
+    stl_be_phys(cs->as, bdloc + 0x1C, bd->bi_bootflags);
+    stl_be_phys(cs->as, bdloc + 0x20, bd->bi_ipaddr);
     for (i = 0; i < 6; i++) {
         stb_phys(bdloc + 0x24 + i, bd->bi_enetaddr[i]);
     }
     stw_be_phys(bdloc + 0x2A, bd->bi_ethspeed);
-    stl_be_phys(bdloc + 0x2C, bd->bi_intfreq);
-    stl_be_phys(bdloc + 0x30, bd->bi_busfreq);
-    stl_be_phys(bdloc + 0x34, bd->bi_baudrate);
+    stl_be_phys(cs->as, bdloc + 0x2C, bd->bi_intfreq);
+    stl_be_phys(cs->as, bdloc + 0x30, bd->bi_busfreq);
+    stl_be_phys(cs->as, bdloc + 0x34, bd->bi_baudrate);
     for (i = 0; i < 4; i++) {
         stb_phys(bdloc + 0x38 + i, bd->bi_s_version[i]);
     }
     for (i = 0; i < 32; i++) {
         stb_phys(bdloc + 0x3C + i, bd->bi_r_version[i]);
     }
-    stl_be_phys(bdloc + 0x5C, bd->bi_plb_busfreq);
-    stl_be_phys(bdloc + 0x60, bd->bi_pci_busfreq);
+    stl_be_phys(cs->as, bdloc + 0x5C, bd->bi_plb_busfreq);
+    stl_be_phys(cs->as, bdloc + 0x60, bd->bi_pci_busfreq);
     for (i = 0; i < 6; i++) {
         stb_phys(bdloc + 0x64 + i, bd->bi_pci_enetaddr[i]);
     }
@@ -84,10 +85,10 @@ ram_addr_t ppc405_set_bootinfo (CPUPPCState *env, ppc4xx_bd_info_t *bd,
         for (i = 0; i < 6; i++)
             stb_phys(bdloc + n++, bd->bi_pci_enetaddr2[i]);
     }
-    stl_be_phys(bdloc + n, bd->bi_opbfreq);
+    stl_be_phys(cs->as, bdloc + n, bd->bi_opbfreq);
     n += 4;
     for (i = 0; i < 2; i++) {
-        stl_be_phys(bdloc + n, bd->bi_iic_fast[i]);
+        stl_be_phys(cs->as, bdloc + n, bd->bi_iic_fast[i]);
         n += 4;
     }
 
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 5ce43ab817..f47c3eca6f 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -573,7 +573,7 @@ static target_ulong h_logical_store(PowerPCCPU *cpu, sPAPREnvironment *spapr,
         stw_phys(addr, val);
         return H_SUCCESS;
     case 4:
-        stl_phys(addr, val);
+        stl_phys(cs->as, addr, val);
         return H_SUCCESS;
     case 8:
         stq_phys(cs->as, addr, val);
@@ -638,7 +638,7 @@ static target_ulong h_logical_memop(PowerPCCPU *cpu, sPAPREnvironment *spapr,
             stw_phys(dst, tmp);
             break;
         case 2:
-            stl_phys(dst, tmp);
+            stl_phys(cs->as, dst, tmp);
             break;
         case 3:
             stq_phys(cs->as, dst, tmp);
diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index d42d7ecc1c..cfa8a9bf9f 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -670,7 +670,7 @@ static void css_update_chnmon(SubchDev *sch)
 
         count = ldl_phys(&address_space_memory, sch->curr_status.mba);
         count++;
-        stl_phys(sch->curr_status.mba, count);
+        stl_phys(&address_space_memory, sch->curr_status.mba, count);
     } else {
         /* Format 0, global area. */
         uint32_t offset;
diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index 87a1591b20..277130675a 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -388,7 +388,7 @@ void s390_virtio_device_sync(VirtIOS390Device *dev)
     cur_offs += num_vq * VIRTIO_VQCONFIG_LEN;
 
     /* Sync feature bitmap */
-    stl_le_phys(cur_offs, dev->host_features);
+    stl_le_phys(&address_space_memory, cur_offs, dev->host_features);
 
     dev->feat_offs = cur_offs + dev->feat_len;
     cur_offs += dev->feat_len * 2;
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 20ad77e779..4db10520ec 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -304,7 +304,7 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
                 /* Return zeroes if the guest supports more feature bits. */
                 features.features = 0;
             }
-            stl_le_phys(ccw.cda, features.features);
+            stl_le_phys(&address_space_memory, ccw.cda, features.features);
             sch->curr_status.scsw.count = ccw.count - sizeof(features);
             ret = 0;
         }
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 673cb6106c..e12f80ccf6 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -521,7 +521,8 @@ static void megasas_complete_frame(MegasasState *s, uint64_t context)
                         s->reply_queue_pa + queue_offset, context);
         } else {
             queue_offset = tail * sizeof(uint32_t);
-            stl_le_phys(s->reply_queue_pa + queue_offset, context);
+            stl_le_phys(&address_space_memory,
+                        s->reply_queue_pa + queue_offset, context);
         }
         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
         trace_megasas_qf_complete(context, tail, queue_offset,
@@ -1951,7 +1952,8 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
         if (s->producer_pa && megasas_intr_enabled(s)) {
             /* Update reply queue pointer */
             trace_megasas_qf_update(s->reply_queue_head, s->busy);
-            stl_le_phys(s->producer_pa, s->reply_queue_head);
+            stl_le_phys(&address_space_memory,
+                        s->producer_pa, s->reply_queue_head);
             if (!msix_enabled(pci_dev)) {
                 trace_megasas_irq_lower();
                 pci_irq_deassert(pci_dev);
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 6cc6c1b036..7d344b944e 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -46,7 +46,8 @@
     (ldl_le_phys(&address_space_memory, \
                  rs_pa + offsetof(struct PVSCSIRingsState, field)))
 #define RS_SET_FIELD(rs_pa, field, val) \
-    (stl_le_phys(rs_pa + offsetof(struct PVSCSIRingsState, field), val))
+    (stl_le_phys(&address_space_memory, \
+                 rs_pa + offsetof(struct PVSCSIRingsState, field), val))
 
 #define TYPE_PVSCSI "pvscsi"
 #define PVSCSI(obj) OBJECT_CHECK(PVSCSIState, (obj), TYPE_PVSCSI)
diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 7b1de85835..76ef8695e5 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -318,7 +318,7 @@ static void r2d_init(QEMUMachineInitArgs *args)
         }
 
         /* initialization which should be done by firmware */
-        stl_phys(SH7750_BCR1, 1<<3); /* cs3 SDRAM */
+        stl_phys(&address_space_memory, SH7750_BCR1, 1<<3); /* cs3 SDRAM */
         stw_phys(SH7750_BCR2, 3<<(3*2)); /* cs3 32bit */
         reset_info->vector = (SDRAM_BASE + LINUX_LOAD_OFFSET) | 0xa0000000; /* Start from P2 area */
     }
diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 2fbbeb1735..1264dfd46a 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -206,7 +206,8 @@ static void update_irq(struct HPETTimer *timer, int set)
             }
         }
     } else if (timer_fsb_route(timer)) {
-        stl_le_phys(timer->fsb >> 32, timer->fsb & 0xffffffff);
+        stl_le_phys(&address_space_memory,
+                    timer->fsb >> 32, timer->fsb & 0xffffffff);
     } else if (timer->config & HPET_TN_TYPE_LEVEL) {
         s->isr |= mask;
         /* fold the ICH PIRQ# pin's internal inversion logic into hpet */
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 3c2b0a035a..4606e68bf7 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -159,14 +159,14 @@ static inline void vring_used_ring_id(VirtQueue *vq, int i, uint32_t val)
 {
     hwaddr pa;
     pa = vq->vring.used + offsetof(VRingUsed, ring[i].id);
-    stl_phys(pa, val);
+    stl_phys(&address_space_memory, pa, val);
 }
 
 static inline void vring_used_ring_len(VirtQueue *vq, int i, uint32_t val)
 {
     hwaddr pa;
     pa = vq->vring.used + offsetof(VRingUsed, ring[i].len);
-    stl_phys(pa, val);
+    stl_phys(&address_space_memory, pa, val);
 }
 
 static uint16_t vring_used_idx(VirtQueue *vq)
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 856062e091..d005c98796 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -93,8 +93,8 @@ uint64_t ldq_be_phys(AddressSpace *as, hwaddr addr);
 void stb_phys(hwaddr addr, uint32_t val);
 void stw_le_phys(hwaddr addr, uint32_t val);
 void stw_be_phys(hwaddr addr, uint32_t val);
-void stl_le_phys(hwaddr addr, uint32_t val);
-void stl_be_phys(hwaddr addr, uint32_t val);
+void stl_le_phys(AddressSpace *as, hwaddr addr, uint32_t val);
+void stl_be_phys(AddressSpace *as, hwaddr addr, uint32_t val);
 void stq_le_phys(AddressSpace *as, hwaddr addr, uint64_t val);
 void stq_be_phys(AddressSpace *as, hwaddr addr, uint64_t val);
 
@@ -104,7 +104,7 @@ uint32_t ldl_phys(AddressSpace *as, hwaddr addr);
 uint64_t ldq_phys(AddressSpace *as, hwaddr addr);
 void stl_phys_notdirty(hwaddr addr, uint32_t val);
 void stw_phys(hwaddr addr, uint32_t val);
-void stl_phys(hwaddr addr, uint32_t val);
+void stl_phys(AddressSpace *as, hwaddr addr, uint32_t val);
 void stq_phys(AddressSpace *as, hwaddr addr, uint64_t val);
 #endif
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 6c705f1b18..449fc7ca2d 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -353,7 +353,7 @@ static inline uint32_t rtas_ld(target_ulong phys, int n)
 
 static inline void rtas_st(target_ulong phys, int n, uint32_t val)
 {
-    stl_be_phys(ppc64_phys_to_real(phys + 4*n), val);
+    stl_be_phys(&address_space_memory, ppc64_phys_to_real(phys + 4*n), val);
 }
 
 typedef void (*spapr_rtas_fn)(PowerPCCPU *cpu, sPAPREnvironment *spapr,
diff --git a/target-alpha/helper.h b/target-alpha/helper.h
index c67266b057..4f127c49c5 100644
--- a/target-alpha/helper.h
+++ b/target-alpha/helper.h
@@ -105,7 +105,7 @@ DEF_HELPER_2(ldl_phys, i64, env, i64)
 DEF_HELPER_2(ldq_phys, i64, env, i64)
 DEF_HELPER_2(ldl_l_phys, i64, env, i64)
 DEF_HELPER_2(ldq_l_phys, i64, env, i64)
-DEF_HELPER_2(stl_phys, void, i64, i64)
+DEF_HELPER_3(stl_phys, void, env, i64, i64)
 DEF_HELPER_3(stq_phys, void, env, i64, i64)
 DEF_HELPER_3(stl_c_phys, i64, env, i64, i64)
 DEF_HELPER_3(stq_c_phys, i64, env, i64, i64)
diff --git a/target-alpha/mem_helper.c b/target-alpha/mem_helper.c
index 7e4ddc42ed..ea587043d4 100644
--- a/target-alpha/mem_helper.c
+++ b/target-alpha/mem_helper.c
@@ -50,9 +50,10 @@ uint64_t helper_ldq_l_phys(CPUAlphaState *env, uint64_t p)
     return env->lock_value = ldq_phys(cs->as, p);
 }
 
-void helper_stl_phys(uint64_t p, uint64_t v)
+void helper_stl_phys(CPUAlphaState *env, uint64_t p, uint64_t v)
 {
-    stl_phys(p, v);
+    CPUState *cs = ENV_GET_CPU(env);
+    stl_phys(cs->as, p, v);
 }
 
 void helper_stq_phys(CPUAlphaState *env, uint64_t p, uint64_t v)
@@ -69,7 +70,7 @@ uint64_t helper_stl_c_phys(CPUAlphaState *env, uint64_t p, uint64_t v)
     if (p == env->lock_addr) {
         int32_t old = ldl_phys(cs->as, p);
         if (old == (int32_t)env->lock_value) {
-            stl_phys(p, v);
+            stl_phys(cs->as, p, v);
             ret = 1;
         }
     }
diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index 69e2334c55..4c94bed704 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -3225,7 +3225,7 @@ static ExitStatus translate_one(DisasContext *ctx, uint32_t insn)
             switch ((insn >> 12) & 0xF) {
             case 0x0:
                 /* Longword physical access */
-                gen_helper_stl_phys(addr, val);
+                gen_helper_stl_phys(cpu_env, addr, val);
                 break;
             case 0x1:
                 /* Quadword physical access */
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 6a3db66059..5ae08c9ad1 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -2449,8 +2449,9 @@ void switch_mode(CPUARMState *env, int mode)
 
 static void v7m_push(CPUARMState *env, uint32_t val)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     env->regs[13] -= 4;
-    stl_phys(env->regs[13], val);
+    stl_phys(cs->as, env->regs[13], val);
 }
 
 static uint32_t v7m_pop(CPUARMState *env)
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index 6b18b3e41e..959212bfe3 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -1146,11 +1146,12 @@ static void handle_even_inj(CPUX86State *env, int intno, int is_int,
         event_inj = intno | type | SVM_EVTINJ_VALID;
         if (!rm && exception_has_error_code(intno)) {
             event_inj |= SVM_EVTINJ_VALID_ERR;
-            stl_phys(env->vm_vmcb + offsetof(struct vmcb,
+            stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                              control.event_inj_err),
                      error_code);
         }
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
                  event_inj);
     }
 }
@@ -1231,7 +1232,8 @@ static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
                                       offsetof(struct vmcb,
                                                control.event_inj));
 
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
                  event_inj & ~SVM_EVTINJ_VALID);
     }
 #endif
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index d62261cf4f..88f6d7f7c2 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -62,24 +62,24 @@ void do_smm_enter(X86CPU *cpu)
         offset = 0x7e00 + i * 16;
         stw_phys(sm_state + offset, dt->selector);
         stw_phys(sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
-        stl_phys(sm_state + offset + 4, dt->limit);
+        stl_phys(cs->as, sm_state + offset + 4, dt->limit);
         stq_phys(cs->as, sm_state + offset + 8, dt->base);
     }
 
     stq_phys(cs->as, sm_state + 0x7e68, env->gdt.base);
-    stl_phys(sm_state + 0x7e64, env->gdt.limit);
+    stl_phys(cs->as, sm_state + 0x7e64, env->gdt.limit);
 
     stw_phys(sm_state + 0x7e70, env->ldt.selector);
     stq_phys(cs->as, sm_state + 0x7e78, env->ldt.base);
-    stl_phys(sm_state + 0x7e74, env->ldt.limit);
+    stl_phys(cs->as, sm_state + 0x7e74, env->ldt.limit);
     stw_phys(sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
 
     stq_phys(cs->as, sm_state + 0x7e88, env->idt.base);
-    stl_phys(sm_state + 0x7e84, env->idt.limit);
+    stl_phys(cs->as, sm_state + 0x7e84, env->idt.limit);
 
     stw_phys(sm_state + 0x7e90, env->tr.selector);
     stq_phys(cs->as, sm_state + 0x7e98, env->tr.base);
-    stl_phys(sm_state + 0x7e94, env->tr.limit);
+    stl_phys(cs->as, sm_state + 0x7e94, env->tr.limit);
     stw_phys(sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
 
     stq_phys(cs->as, sm_state + 0x7ed0, env->efer);
@@ -96,47 +96,47 @@ void do_smm_enter(X86CPU *cpu)
         stq_phys(cs->as, sm_state + 0x7ff8 - i * 8, env->regs[i]);
     }
     stq_phys(cs->as, sm_state + 0x7f78, env->eip);
-    stl_phys(sm_state + 0x7f70, cpu_compute_eflags(env));
-    stl_phys(sm_state + 0x7f68, env->dr[6]);
-    stl_phys(sm_state + 0x7f60, env->dr[7]);
+    stl_phys(cs->as, sm_state + 0x7f70, cpu_compute_eflags(env));
+    stl_phys(cs->as, sm_state + 0x7f68, env->dr[6]);
+    stl_phys(cs->as, sm_state + 0x7f60, env->dr[7]);
 
-    stl_phys(sm_state + 0x7f48, env->cr[4]);
-    stl_phys(sm_state + 0x7f50, env->cr[3]);
-    stl_phys(sm_state + 0x7f58, env->cr[0]);
+    stl_phys(cs->as, sm_state + 0x7f48, env->cr[4]);
+    stl_phys(cs->as, sm_state + 0x7f50, env->cr[3]);
+    stl_phys(cs->as, sm_state + 0x7f58, env->cr[0]);
 
-    stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
-    stl_phys(sm_state + 0x7f00, env->smbase);
+    stl_phys(cs->as, sm_state + 0x7efc, SMM_REVISION_ID);
+    stl_phys(cs->as, sm_state + 0x7f00, env->smbase);
 #else
-    stl_phys(sm_state + 0x7ffc, env->cr[0]);
-    stl_phys(sm_state + 0x7ff8, env->cr[3]);
-    stl_phys(sm_state + 0x7ff4, cpu_compute_eflags(env));
-    stl_phys(sm_state + 0x7ff0, env->eip);
-    stl_phys(sm_state + 0x7fec, env->regs[R_EDI]);
-    stl_phys(sm_state + 0x7fe8, env->regs[R_ESI]);
-    stl_phys(sm_state + 0x7fe4, env->regs[R_EBP]);
-    stl_phys(sm_state + 0x7fe0, env->regs[R_ESP]);
-    stl_phys(sm_state + 0x7fdc, env->regs[R_EBX]);
-    stl_phys(sm_state + 0x7fd8, env->regs[R_EDX]);
-    stl_phys(sm_state + 0x7fd4, env->regs[R_ECX]);
-    stl_phys(sm_state + 0x7fd0, env->regs[R_EAX]);
-    stl_phys(sm_state + 0x7fcc, env->dr[6]);
-    stl_phys(sm_state + 0x7fc8, env->dr[7]);
-
-    stl_phys(sm_state + 0x7fc4, env->tr.selector);
-    stl_phys(sm_state + 0x7f64, env->tr.base);
-    stl_phys(sm_state + 0x7f60, env->tr.limit);
-    stl_phys(sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
-
-    stl_phys(sm_state + 0x7fc0, env->ldt.selector);
-    stl_phys(sm_state + 0x7f80, env->ldt.base);
-    stl_phys(sm_state + 0x7f7c, env->ldt.limit);
-    stl_phys(sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
-
-    stl_phys(sm_state + 0x7f74, env->gdt.base);
-    stl_phys(sm_state + 0x7f70, env->gdt.limit);
-
-    stl_phys(sm_state + 0x7f58, env->idt.base);
-    stl_phys(sm_state + 0x7f54, env->idt.limit);
+    stl_phys(cs->as, sm_state + 0x7ffc, env->cr[0]);
+    stl_phys(cs->as, sm_state + 0x7ff8, env->cr[3]);
+    stl_phys(cs->as, sm_state + 0x7ff4, cpu_compute_eflags(env));
+    stl_phys(cs->as, sm_state + 0x7ff0, env->eip);
+    stl_phys(cs->as, sm_state + 0x7fec, env->regs[R_EDI]);
+    stl_phys(cs->as, sm_state + 0x7fe8, env->regs[R_ESI]);
+    stl_phys(cs->as, sm_state + 0x7fe4, env->regs[R_EBP]);
+    stl_phys(cs->as, sm_state + 0x7fe0, env->regs[R_ESP]);
+    stl_phys(cs->as, sm_state + 0x7fdc, env->regs[R_EBX]);
+    stl_phys(cs->as, sm_state + 0x7fd8, env->regs[R_EDX]);
+    stl_phys(cs->as, sm_state + 0x7fd4, env->regs[R_ECX]);
+    stl_phys(cs->as, sm_state + 0x7fd0, env->regs[R_EAX]);
+    stl_phys(cs->as, sm_state + 0x7fcc, env->dr[6]);
+    stl_phys(cs->as, sm_state + 0x7fc8, env->dr[7]);
+
+    stl_phys(cs->as, sm_state + 0x7fc4, env->tr.selector);
+    stl_phys(cs->as, sm_state + 0x7f64, env->tr.base);
+    stl_phys(cs->as, sm_state + 0x7f60, env->tr.limit);
+    stl_phys(cs->as, sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
+
+    stl_phys(cs->as, sm_state + 0x7fc0, env->ldt.selector);
+    stl_phys(cs->as, sm_state + 0x7f80, env->ldt.base);
+    stl_phys(cs->as, sm_state + 0x7f7c, env->ldt.limit);
+    stl_phys(cs->as, sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
+
+    stl_phys(cs->as, sm_state + 0x7f74, env->gdt.base);
+    stl_phys(cs->as, sm_state + 0x7f70, env->gdt.limit);
+
+    stl_phys(cs->as, sm_state + 0x7f58, env->idt.base);
+    stl_phys(cs->as, sm_state + 0x7f54, env->idt.limit);
 
     for (i = 0; i < 6; i++) {
         dt = &env->segs[i];
@@ -145,15 +145,15 @@ void do_smm_enter(X86CPU *cpu)
         } else {
             offset = 0x7f2c + (i - 3) * 12;
         }
-        stl_phys(sm_state + 0x7fa8 + i * 4, dt->selector);
-        stl_phys(sm_state + offset + 8, dt->base);
-        stl_phys(sm_state + offset + 4, dt->limit);
-        stl_phys(sm_state + offset, (dt->flags >> 8) & 0xf0ff);
+        stl_phys(cs->as, sm_state + 0x7fa8 + i * 4, dt->selector);
+        stl_phys(cs->as, sm_state + offset + 8, dt->base);
+        stl_phys(cs->as, sm_state + offset + 4, dt->limit);
+        stl_phys(cs->as, sm_state + offset, (dt->flags >> 8) & 0xf0ff);
     }
-    stl_phys(sm_state + 0x7f14, env->cr[4]);
+    stl_phys(cs->as, sm_state + 0x7f14, env->cr[4]);
 
-    stl_phys(sm_state + 0x7efc, SMM_REVISION_ID);
-    stl_phys(sm_state + 0x7ef8, env->smbase);
+    stl_phys(cs->as, sm_state + 0x7efc, SMM_REVISION_ID);
+    stl_phys(cs->as, sm_state + 0x7ef8, env->smbase);
 #endif
     /* init SMM cpu state */
 
diff --git a/target-i386/svm_helper.c b/target-i386/svm_helper.c
index 6b371c8eeb..b9fd779b11 100644
--- a/target-i386/svm_helper.c
+++ b/target-i386/svm_helper.c
@@ -93,7 +93,7 @@ static inline void svm_save_seg(CPUX86State *env, hwaddr addr,
              sc->selector);
     stq_phys(cs->as, addr + offsetof(struct vmcb_seg, base),
              sc->base);
-    stl_phys(addr + offsetof(struct vmcb_seg, limit),
+    stl_phys(cs->as, addr + offsetof(struct vmcb_seg, limit),
              sc->limit);
     stw_phys(addr + offsetof(struct vmcb_seg, attrib),
              ((sc->flags >> 8) & 0xff) | ((sc->flags >> 12) & 0x0f00));
@@ -145,12 +145,12 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     /* save the current CPU state in the hsave page */
     stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.gdtr.base),
              env->gdt.base);
-    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
+    stl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
              env->gdt.limit);
 
     stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.idtr.base),
              env->idt.base);
-    stl_phys(env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
+    stl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
              env->idt.limit);
 
     stq_phys(cs->as,
@@ -599,11 +599,13 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
                   env->eip);
 
     if (env->hflags & HF_INHIBIT_IRQ_MASK) {
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_state),
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.int_state),
                  SVM_INTERRUPT_SHADOW_MASK);
         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
     } else {
-        stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_state), 0);
+        stl_phys(cs->as,
+                 env->vm_vmcb + offsetof(struct vmcb, control.int_state), 0);
     }
 
     /* Save the VM state in the vmcb */
@@ -618,12 +620,12 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
 
     stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base),
              env->gdt.base);
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
+    stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
              env->gdt.limit);
 
     stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.idtr.base),
              env->idt.base);
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
+    stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
              env->idt.limit);
 
     stq_phys(cs->as,
@@ -644,7 +646,8 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
         int_ctl |= V_IRQ_MASK;
     }
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl);
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl);
 
     stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.rflags),
              cpu_compute_eflags(env));
@@ -728,13 +731,16 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1),
              exit_info_1);
 
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info),
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info),
              ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                               control.event_inj)));
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info_err),
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info_err),
              ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
                                               control.event_inj_err)));
-    stl_phys(env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 0);
+    stl_phys(cs->as,
+             env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 0);
 
     env->hflags2 &= ~HF2_GIF_MASK;
     /* FIXME: Resets the current ASID register to zero (host ASID). */
diff --git a/target-ppc/mmu-hash32.h b/target-ppc/mmu-hash32.h
index b403d7741f..4671141a32 100644
--- a/target-ppc/mmu-hash32.h
+++ b/target-ppc/mmu-hash32.h
@@ -84,15 +84,17 @@ static inline target_ulong ppc_hash32_load_hpte1(CPUPPCState *env,
 static inline void ppc_hash32_store_hpte0(CPUPPCState *env,
                                           hwaddr pte_offset, target_ulong pte0)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     assert(!env->external_htab); /* Not supported on 32-bit for now */
-    stl_phys(env->htab_base + pte_offset, pte0);
+    stl_phys(cs->as, env->htab_base + pte_offset, pte0);
 }
 
 static inline void ppc_hash32_store_hpte1(CPUPPCState *env,
                                           hwaddr pte_offset, target_ulong pte1)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     assert(!env->external_htab); /* Not supported on 32-bit for now */
-    stl_phys(env->htab_base + pte_offset + HASH_PTE_SIZE_32/2, pte1);
+    stl_phys(cs->as, env->htab_base + pte_offset + HASH_PTE_SIZE_32/2, pte1);
 }
 
 typedef struct {
diff --git a/target-sparc/ldst_helper.c b/target-sparc/ldst_helper.c
index ccd8b89c78..0e87d79e2d 100644
--- a/target-sparc/ldst_helper.c
+++ b/target-sparc/ldst_helper.c
@@ -1019,7 +1019,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val, int asi,
                 break;
             case 4:
             default:
-                stl_phys(addr, val);
+                stl_phys(cs->as, addr, val);
                 break;
             case 8:
                 stq_phys(cs->as, addr, val);
@@ -1040,7 +1040,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val, int asi,
                 break;
             case 4:
             default:
-                stl_phys((hwaddr)addr
+                stl_phys(cs->as, (hwaddr)addr
                          | ((hwaddr)(asi & 0xf) << 32), val);
                 break;
             case 8:
@@ -1817,7 +1817,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, target_ulong val,
                 stw_phys(addr, val);
                 break;
             case 4:
-                stl_phys(addr, val);
+                stl_phys(cs->as, addr, val);
                 break;
             case 8:
             default: