[v1,13/22] exec: Make lduw_*_phys input an AddressSpace

diff --git a/exec.c b/exec.c
index db64e13..7ab6153 100644
--- a/exec.c
+++ b/exec.c
@@ -1597,7 +1597,7 @@  static uint64_t watch_mem_read(void *opaque, hwaddr addr,
     check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_READ);
     switch (size) {
     case 1: return ldub_phys(&address_space_memory, addr);
-    case 2: return lduw_phys(addr);
+    case 2: return lduw_phys(&address_space_memory, addr);
     case 4: return ldl_phys(&address_space_memory, addr);
     default: abort();
     }
@@ -2435,7 +2435,7 @@  uint32_t ldub_phys(AddressSpace *as, hwaddr addr)
 }
 
 /* warning: addr must be aligned */
-static inline uint32_t lduw_phys_internal(hwaddr addr,
+static inline uint32_t lduw_phys_internal(AddressSpace *as, hwaddr addr,
                                           enum device_endian endian)
 {
     uint8_t *ptr;
@@ -2444,7 +2444,7 @@  static inline uint32_t lduw_phys_internal(hwaddr addr,
     hwaddr l = 2;
     hwaddr addr1;
 
-    mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
+    mr = address_space_translate(as, addr, &addr1, &l,
                                  false);
     if (l < 2 || !memory_access_is_direct(mr, false)) {
         /* I/O case */
@@ -2478,19 +2478,19 @@  static inline uint32_t lduw_phys_internal(hwaddr addr,
     return val;
 }
 
-uint32_t lduw_phys(hwaddr addr)
+uint32_t lduw_phys(AddressSpace *as, hwaddr addr)
 {
-    return lduw_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
+    return lduw_phys_internal(as, addr, DEVICE_NATIVE_ENDIAN);
 }
 
-uint32_t lduw_le_phys(hwaddr addr)
+uint32_t lduw_le_phys(AddressSpace *as, hwaddr addr)
 {
-    return lduw_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
+    return lduw_phys_internal(as, addr, DEVICE_LITTLE_ENDIAN);
 }
 
-uint32_t lduw_be_phys(hwaddr addr)
+uint32_t lduw_be_phys(AddressSpace *as, hwaddr addr)
 {
-    return lduw_phys_internal(addr, DEVICE_BIG_ENDIAN);
+    return lduw_phys_internal(as, addr, DEVICE_BIG_ENDIAN);
 }
 
 /* warning: addr must be aligned. The ram page is not masked as dirty
diff --git a/hw/net/vmware_utils.h b/hw/net/vmware_utils.h
index eb98d2a..7877cb6 100644
--- a/hw/net/vmware_utils.h
+++ b/hw/net/vmware_utils.h
@@ -80,7 +80,7 @@  vmw_shmem_st8(hwaddr addr, uint8_t value)
 static inline uint32_t
 vmw_shmem_ld16(hwaddr addr)
 {
-    uint16_t res = lduw_le_phys(addr);
+    uint16_t res = lduw_le_phys(&address_space_memory, addr);
     VMW_SHPRN("SHMEM load16: %" PRIx64 " (value 0x%X)", addr, res);
     return res;
 }
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 942751b..b1d5b91 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -354,7 +354,7 @@  static target_ulong register_vpa(CPUPPCState *env, target_ulong vpa)
     }
     /* FIXME: bounds check the address */
 
-    size = lduw_be_phys(vpa + 0x4);
+    size = lduw_be_phys(env->as, vpa + 0x4);
 
     if (size < VPA_MIN_SIZE) {
         return H_PARAMETER;
@@ -540,7 +540,7 @@  static target_ulong h_logical_load(PowerPCCPU *cpu, sPAPREnvironment *spapr,
         args[0] = ldub_phys(cpu->env.as, addr);
         return H_SUCCESS;
     case 2:
-        args[0] = lduw_phys(addr);
+        args[0] = lduw_phys(cpu->env.as, addr);
         return H_SUCCESS;
     case 4:
         args[0] = ldl_phys(cpu->env.as, addr);
@@ -608,7 +608,7 @@  static target_ulong h_logical_memop(PowerPCCPU *cpu, sPAPREnvironment *spapr,
             tmp = ldub_phys(cpu->env.as, src);
             break;
         case 1:
-            tmp = lduw_phys(src);
+            tmp = lduw_phys(cpu->env.as, src);
             break;
         case 2:
             tmp = ldl_phys(cpu->env.as, src);
diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 41b1903..d42d7ec 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -677,7 +677,8 @@  static void css_update_chnmon(SubchDev *sch)
         uint16_t count;
 
         offset = sch->curr_status.pmcw.mbi << 5;
-        count = lduw_phys(channel_subsys->chnmon_area + offset);
+        count = lduw_phys(&address_space_memory,
+                          channel_subsys->chnmon_area + offset);
         count++;
         stw_phys(channel_subsys->chnmon_area + offset, count);
     }
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index b86d94e..a92cbde 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -268,9 +268,11 @@  static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
             info.queue = ldq_phys(&address_space_memory, ccw.cda);
             info.align = ldl_phys(&address_space_memory,
                                   ccw.cda + sizeof(info.queue));
-            info.index = lduw_phys(ccw.cda + sizeof(info.queue)
+            info.index = lduw_phys(&address_space_memory,
+                                   ccw.cda + sizeof(info.queue)
                                    + sizeof(info.align));
-            info.num = lduw_phys(ccw.cda + sizeof(info.queue)
+            info.num = lduw_phys(&address_space_memory,
+                                 ccw.cda + sizeof(info.queue)
                                  + sizeof(info.align)
                                  + sizeof(info.index));
             ret = virtio_ccw_set_vqs(sch, info.queue, info.align, info.index,
@@ -472,7 +474,7 @@  static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw)
         if (!ccw.cda) {
             ret = -EFAULT;
         } else {
-            vq_config.index = lduw_phys(ccw.cda);
+            vq_config.index = lduw_phys(&address_space_memory, ccw.cda);
             vq_config.num_max = virtio_queue_get_num(vdev,
                                                      vq_config.index);
             stw_phys(ccw.cda + sizeof(vq_config.index), vq_config.num_max);
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index e5bd115..492022c 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -119,35 +119,35 @@  static inline uint16_t vring_desc_flags(hwaddr desc_pa, int i)
 {
     hwaddr pa;
     pa = desc_pa + sizeof(VRingDesc) * i + offsetof(VRingDesc, flags);
-    return lduw_phys(pa);
+    return lduw_phys(&address_space_memory, pa);
 }
 
 static inline uint16_t vring_desc_next(hwaddr desc_pa, int i)
 {
     hwaddr pa;
     pa = desc_pa + sizeof(VRingDesc) * i + offsetof(VRingDesc, next);
-    return lduw_phys(pa);
+    return lduw_phys(&address_space_memory, pa);
 }
 
 static inline uint16_t vring_avail_flags(VirtQueue *vq)
 {
     hwaddr pa;
     pa = vq->vring.avail + offsetof(VRingAvail, flags);
-    return lduw_phys(pa);
+    return lduw_phys(&address_space_memory, pa);
 }
 
 static inline uint16_t vring_avail_idx(VirtQueue *vq)
 {
     hwaddr pa;
     pa = vq->vring.avail + offsetof(VRingAvail, idx);
-    return lduw_phys(pa);
+    return lduw_phys(&address_space_memory, pa);
 }
 
 static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
 {
     hwaddr pa;
     pa = vq->vring.avail + offsetof(VRingAvail, ring[i]);
-    return lduw_phys(pa);
+    return lduw_phys(&address_space_memory, pa);
 }
 
 static inline uint16_t vring_used_event(VirtQueue *vq)
@@ -173,7 +173,7 @@  static uint16_t vring_used_idx(VirtQueue *vq)
 {
     hwaddr pa;
     pa = vq->vring.used + offsetof(VRingUsed, idx);
-    return lduw_phys(pa);
+    return lduw_phys(&address_space_memory, pa);
 }
 
 static inline void vring_used_idx_set(VirtQueue *vq, uint16_t val)
@@ -187,14 +187,14 @@  static inline void vring_used_flags_set_bit(VirtQueue *vq, int mask)
 {
     hwaddr pa;
     pa = vq->vring.used + offsetof(VRingUsed, flags);
-    stw_phys(pa, lduw_phys(pa) | mask);
+    stw_phys(pa, lduw_phys(&address_space_memory, pa) | mask);
 }
 
 static inline void vring_used_flags_unset_bit(VirtQueue *vq, int mask)
 {
     hwaddr pa;
     pa = vq->vring.used + offsetof(VRingUsed, flags);
-    stw_phys(pa, lduw_phys(pa) & ~mask);
+    stw_phys(pa, lduw_phys(&address_space_memory, pa) & ~mask);
 }
 
 static inline void vring_avail_event(VirtQueue *vq, uint16_t val)
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 086ae97..0a8f836 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -84,8 +84,8 @@  bool cpu_physical_memory_is_io(hwaddr phys_addr);
 void qemu_flush_coalesced_mmio_buffer(void);
 
 uint32_t ldub_phys(AddressSpace *as, hwaddr addr);
-uint32_t lduw_le_phys(hwaddr addr);
-uint32_t lduw_be_phys(hwaddr addr);
+uint32_t lduw_le_phys(AddressSpace *as, hwaddr addr);
+uint32_t lduw_be_phys(AddressSpace *as, hwaddr addr);
 uint32_t ldl_le_phys(AddressSpace *as, hwaddr addr);
 uint32_t ldl_be_phys(AddressSpace *as, hwaddr addr);
 uint64_t ldq_le_phys(AddressSpace *as, hwaddr addr);
@@ -99,7 +99,7 @@  void stq_le_phys(hwaddr addr, uint64_t val);
 void stq_be_phys(hwaddr addr, uint64_t val);
 
 #ifdef NEED_CPU_H
-uint32_t lduw_phys(hwaddr addr);
+uint32_t lduw_phys(AddressSpace *as, hwaddr addr);
 uint32_t ldl_phys(AddressSpace *as, hwaddr addr);
 uint64_t ldq_phys(AddressSpace *as, hwaddr addr);
 void stl_phys_notdirty(hwaddr addr, uint32_t val);
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index e591f83..7a9bfa1 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -192,28 +192,28 @@  void helper_rsm(CPUX86State *env)
     for (i = 0; i < 6; i++) {
         offset = 0x7e00 + i * 16;
         cpu_x86_load_seg_cache(env, i,
-                               lduw_phys(sm_state + offset),
+                               lduw_phys(env->as, sm_state + offset),
                                ldq_phys(env->as, sm_state + offset + 8),
                                ldl_phys(env->as, sm_state + offset + 4),
-                               (lduw_phys(sm_state + offset + 2) &
+                               (lduw_phys(env->as, sm_state + offset + 2) &
                                 0xf0ff) << 8);
     }
 
     env->gdt.base = ldq_phys(env->as, sm_state + 0x7e68);
     env->gdt.limit = ldl_phys(env->as, sm_state + 0x7e64);
 
-    env->ldt.selector = lduw_phys(sm_state + 0x7e70);
+    env->ldt.selector = lduw_phys(env->as, sm_state + 0x7e70);
     env->ldt.base = ldq_phys(env->as, sm_state + 0x7e78);
     env->ldt.limit = ldl_phys(env->as, sm_state + 0x7e74);
-    env->ldt.flags = (lduw_phys(sm_state + 0x7e72) & 0xf0ff) << 8;
+    env->ldt.flags = (lduw_phys(env->as, sm_state + 0x7e72) & 0xf0ff) << 8;
 
     env->idt.base = ldq_phys(env->as, sm_state + 0x7e88);
     env->idt.limit = ldl_phys(env->as, sm_state + 0x7e84);
 
-    env->tr.selector = lduw_phys(sm_state + 0x7e90);
+    env->tr.selector = lduw_phys(env->as, sm_state + 0x7e90);
     env->tr.base = ldq_phys(env->as, sm_state + 0x7e98);
     env->tr.limit = ldl_phys(env->as, sm_state + 0x7e94);
-    env->tr.flags = (lduw_phys(sm_state + 0x7e92) & 0xf0ff) << 8;
+    env->tr.flags = (lduw_phys(env->as, sm_state + 0x7e92) & 0xf0ff) << 8;
 
     env->regs[R_EAX] = ldq_phys(env->as, sm_state + 0x7ff8);
     env->regs[R_ECX] = ldq_phys(env->as, sm_state + 0x7ff0);
diff --git a/target-i386/svm_helper.c b/target-i386/svm_helper.c
index 2c61be2..72d92df 100644
--- a/target-i386/svm_helper.c
+++ b/target-i386/svm_helper.c
@@ -103,10 +103,11 @@  static inline void svm_load_seg(CPUX86State *env, hwaddr addr,
 {
     unsigned int flags;
 
-    sc->selector = lduw_phys(addr + offsetof(struct vmcb_seg, selector));
+    sc->selector = lduw_phys(env->as,
+                             addr + offsetof(struct vmcb_seg, selector));
     sc->base = ldq_phys(env->as, addr + offsetof(struct vmcb_seg, base));
     sc->limit = ldl_phys(env->as, addr + offsetof(struct vmcb_seg, limit));
-    flags = lduw_phys(addr + offsetof(struct vmcb_seg, attrib));
+    flags = lduw_phys(env->as, addr + offsetof(struct vmcb_seg, attrib));
     sc->flags = ((flags & 0xff) << 8) | ((flags & 0x0f00) << 12);
 }
 
@@ -178,16 +179,16 @@  void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
        vmcb in svm mode */
     env->intercept = ldq_phys(env->as, env->vm_vmcb + offsetof(struct vmcb,
                                                       control.intercept));
-    env->intercept_cr_read = lduw_phys(env->vm_vmcb +
+    env->intercept_cr_read = lduw_phys(env->as, env->vm_vmcb +
                                        offsetof(struct vmcb,
                                                 control.intercept_cr_read));
-    env->intercept_cr_write = lduw_phys(env->vm_vmcb +
+    env->intercept_cr_write = lduw_phys(env->as, env->vm_vmcb +
                                         offsetof(struct vmcb,
                                                  control.intercept_cr_write));
-    env->intercept_dr_read = lduw_phys(env->vm_vmcb +
+    env->intercept_dr_read = lduw_phys(env->as, env->vm_vmcb +
                                        offsetof(struct vmcb,
                                                 control.intercept_dr_read));
-    env->intercept_dr_write = lduw_phys(env->vm_vmcb +
+    env->intercept_dr_write = lduw_phys(env->as, env->vm_vmcb +
                                         offsetof(struct vmcb,
                                                  control.intercept_dr_write));
     env->intercept_exceptions = ldl_phys(env->as, env->vm_vmcb +
@@ -554,7 +555,7 @@  void helper_svm_check_io(CPUX86State *env, uint32_t port, uint32_t param,
                                  offsetof(struct vmcb, control.iopm_base_pa));
         uint16_t mask = (1 << ((param >> 4) & 7)) - 1;
 
-        if (lduw_phys(addr + port / 8) & (mask << (port & 7))) {
+        if (lduw_phys(env->as, addr + port / 8) & (mask << (port & 7))) {
             /* next env->eip */
             stq_phys(env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
                      env->eip + next_eip_addend);
diff --git a/target-sparc/ldst_helper.c b/target-sparc/ldst_helper.c
index e26c763..03afa86 100644
--- a/target-sparc/ldst_helper.c
+++ b/target-sparc/ldst_helper.c
@@ -611,7 +611,7 @@  uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr, int asi, int size,
             ret = ldub_phys(env->as, addr);
             break;
         case 2:
-            ret = lduw_phys(addr);
+            ret = lduw_phys(env->as, addr);
             break;
         default:
         case 4:
@@ -629,7 +629,7 @@  uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr, int asi, int size,
                             | ((hwaddr)(asi & 0xf) << 32));
             break;
         case 2:
-            ret = lduw_phys((hwaddr)addr
+            ret = lduw_phys(env->as, (hwaddr)addr
                             | ((hwaddr)(asi & 0xf) << 32));
             break;
         default:
@@ -1439,7 +1439,7 @@  uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr, int asi, int size,
                 ret = ldub_phys(env->as, addr);
                 break;
             case 2:
-                ret = lduw_phys(addr);
+                ret = lduw_phys(env->as, addr);
                 break;
             case 4:
                 ret = ldl_phys(env->as, addr);