diff --git a/target/ppc/internal.h b/target/ppc/internal.h
index 66ce22bbe9..753fae219c 100644
--- a/target/ppc/internal.h
+++ b/target/ppc/internal.h
@@ -251,7 +251,7 @@ static inline int check_prot_access_type(int prot, MMUAccessType access_type)
 
 /* PowerPC MMU emulation */
 
-bool ppc_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp,
                       int mmu_idx, bool guest_visible);
 
diff --git a/target/ppc/mmu-booke.c b/target/ppc/mmu-booke.c
index 55e5dd7c6b..dd4ea48151 100644
--- a/target/ppc/mmu-booke.c
+++ b/target/ppc/mmu-booke.c
@@ -473,12 +473,11 @@ static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
     env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
 }
 
-bool ppc_booke_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_booke_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                      hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                      bool guest_visible)
 {
-    CPUState *cs = CPU(cpu);
-    CPUPPCState *env = &cpu->env;
+    CPUPPCState *env = cpu_env(cs);
     hwaddr raddr;
     int prot, ret;
 
diff --git a/target/ppc/mmu-booke.h b/target/ppc/mmu-booke.h
index f972843bbb..6c90139be0 100644
--- a/target/ppc/mmu-booke.h
+++ b/target/ppc/mmu-booke.h
@@ -10,7 +10,7 @@ int mmu40x_get_physical_address(CPUPPCState *env, hwaddr *raddr, int *prot,
 hwaddr booke206_tlb_to_page_size(CPUPPCState *env, ppcmas_tlb_t *tlb);
 int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb, hwaddr *raddrp,
                      target_ulong address, uint32_t pid);
-bool ppc_booke_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_booke_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                      hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                      bool guest_visible);
 
diff --git a/target/ppc/mmu-hash32.c b/target/ppc/mmu-hash32.c
index f18faf0f46..82a02881c2 100644
--- a/target/ppc/mmu-hash32.c
+++ b/target/ppc/mmu-hash32.c
@@ -279,11 +279,11 @@ static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
     return pte_addr;
 }
 
-bool ppc_hash32_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_hash32_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                       bool guest_visible)
 {
-    CPUState *cs = CPU(cpu);
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
     CPUPPCState *env = &cpu->env;
     target_ulong sr;
     hwaddr pte_addr, raddr;
diff --git a/target/ppc/mmu-hash32.h b/target/ppc/mmu-hash32.h
index ec8d881def..d9e4977bdc 100644
--- a/target/ppc/mmu-hash32.h
+++ b/target/ppc/mmu-hash32.h
@@ -3,7 +3,7 @@
 
 #ifndef CONFIG_USER_ONLY
 
-bool ppc_hash32_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_hash32_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                       bool guest_visible);
 
diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index 5e1983e334..1559683626 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -979,11 +979,11 @@ static int build_vrma_slbe(PowerPCCPU *cpu, ppc_slb_t *slb)
     return -1;
 }
 
-bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_hash64_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                       bool guest_visible)
 {
-    CPUState *cs = CPU(cpu);
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
     CPUPPCState *env = &cpu->env;
     ppc_slb_t vrma_slbe;
     ppc_slb_t *slb;
diff --git a/target/ppc/mmu-hash64.h b/target/ppc/mmu-hash64.h
index ae8d4b37ae..0c475642e0 100644
--- a/target/ppc/mmu-hash64.h
+++ b/target/ppc/mmu-hash64.h
@@ -7,7 +7,7 @@
 void dump_slb(PowerPCCPU *cpu);
 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
                   target_ulong esid, target_ulong vsid);
-bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_hash64_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                       bool guest_visible);
 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu,
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index be7a45f254..1ca7f9089a 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -675,11 +675,12 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
  *              | = On        | Process Scoped |    Scoped     |
  *              +-------------+----------------+---------------+
  */
-static bool ppc_radix64_xlate_impl(PowerPCCPU *cpu, vaddr eaddr,
+static bool ppc_radix64_xlate_impl(CPUState *cs, vaddr eaddr,
                                    MMUAccessType access_type, hwaddr *raddr,
                                    int *psizep, int *protp, int mmu_idx,
                                    bool guest_visible)
 {
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
     CPUPPCState *env = &cpu->env;
     uint64_t lpid, pid;
     ppc_v3_pate_t pate;
@@ -805,11 +806,11 @@ static bool ppc_radix64_xlate_impl(PowerPCCPU *cpu, vaddr eaddr,
     return true;
 }
 
-bool ppc_radix64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_radix64_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                        hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
                        bool guest_visible)
 {
-    bool ret = ppc_radix64_xlate_impl(cpu, eaddr, access_type, raddrp,
+    bool ret = ppc_radix64_xlate_impl(cs, eaddr, access_type, raddrp,
                                       psizep, protp, mmu_idx, guest_visible);
 
     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx
diff --git a/target/ppc/mmu-radix64.h b/target/ppc/mmu-radix64.h
index 6620b3d648..3758393883 100644
--- a/target/ppc/mmu-radix64.h
+++ b/target/ppc/mmu-radix64.h
@@ -14,7 +14,7 @@
 #define R_EADDR_QUADRANT2       0x8000000000000000
 #define R_EADDR_QUADRANT3       0xC000000000000000
 
-bool ppc_radix64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_radix64_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                        hwaddr *raddr, int *psizep, int *protp, int mmu_idx,
                        bool guest_visible);
 
diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
index ab055ca96b..8d590a9496 100644
--- a/target/ppc/mmu_common.c
+++ b/target/ppc/mmu_common.c
@@ -579,11 +579,11 @@ void dump_mmu(CPUPPCState *env)
 }
 
 
-static bool ppc_real_mode_xlate(PowerPCCPU *cpu, vaddr eaddr,
+static bool ppc_real_mode_xlate(CPUState *cs, vaddr eaddr,
                                 MMUAccessType access_type,
                                 hwaddr *raddrp, int *psizep, int *protp)
 {
-    CPUPPCState *env = &cpu->env;
+    CPUPPCState *env = cpu_env(cs);
 
     if (access_type == MMU_INST_FETCH ? !FIELD_EX64(env->msr, MSR, IR)
                                       : !FIELD_EX64(env->msr, MSR, DR)) {
@@ -592,21 +592,20 @@ static bool ppc_real_mode_xlate(PowerPCCPU *cpu, vaddr eaddr,
         *psizep = TARGET_PAGE_BITS;
         return true;
     } else if (env->mmu_model == POWERPC_MMU_REAL) {
-        cpu_abort(CPU(cpu), "PowerPC in real mode shold not do translation\n");
+        cpu_abort(cs, "PowerPC in real mode shold not do translation\n");
     }
     return false;
 }
 
-static bool ppc_40x_xlate(PowerPCCPU *cpu, vaddr eaddr,
+static bool ppc_40x_xlate(CPUState *cs, vaddr eaddr,
                           MMUAccessType access_type,
                           hwaddr *raddrp, int *psizep, int *protp,
                           int mmu_idx, bool guest_visible)
 {
-    CPUState *cs = CPU(cpu);
-    CPUPPCState *env = &cpu->env;
+    CPUPPCState *env = cpu_env(cs);
     int ret;
 
-    if (ppc_real_mode_xlate(cpu, eaddr, access_type, raddrp, psizep, protp)) {
+    if (ppc_real_mode_xlate(cs, eaddr, access_type, raddrp, psizep, protp)) {
         return true;
     }
 
@@ -665,18 +664,17 @@ static bool ppc_40x_xlate(PowerPCCPU *cpu, vaddr eaddr,
     return false;
 }
 
-static bool ppc_6xx_xlate(PowerPCCPU *cpu, vaddr eaddr,
+static bool ppc_6xx_xlate(CPUState *cs, vaddr eaddr,
                           MMUAccessType access_type,
                           hwaddr *raddrp, int *psizep, int *protp,
                           int mmu_idx, bool guest_visible)
 {
-    CPUState *cs = CPU(cpu);
-    CPUPPCState *env = &cpu->env;
+    CPUPPCState *env = cpu_env(cs);
     hwaddr hash = 0; /* init to 0 to avoid used uninit warning */
     bool key;
     int type, ret;
 
-    if (ppc_real_mode_xlate(cpu, eaddr, access_type, raddrp, psizep, protp)) {
+    if (ppc_real_mode_xlate(cs, eaddr, access_type, raddrp, psizep, protp)) {
         return true;
     }
 
@@ -803,15 +801,15 @@ tlb_miss:
 
 /*****************************************************************************/
 
-bool ppc_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
+bool ppc_xlate(CPUState *cs, vaddr eaddr, MMUAccessType access_type,
                       hwaddr *raddrp, int *psizep, int *protp,
                       int mmu_idx, bool guest_visible)
 {
-    switch (cpu->env.mmu_model) {
+    switch (cpu_env(cs)->mmu_model) {
 #if defined(TARGET_PPC64)
     case POWERPC_MMU_3_00:
-        if (ppc64_v3_radix(&cpu->env)) {
-            return ppc_radix64_xlate(cpu, eaddr, access_type, raddrp,
+        if (ppc64_v3_radix(cpu_env(cs))) {
+            return ppc_radix64_xlate(cs, eaddr, access_type, raddrp,
                                      psizep, protp, mmu_idx, guest_visible);
         }
         /* fall through */
@@ -819,36 +817,36 @@ bool ppc_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
     case POWERPC_MMU_2_03:
     case POWERPC_MMU_2_06:
     case POWERPC_MMU_2_07:
-        return ppc_hash64_xlate(cpu, eaddr, access_type,
+        return ppc_hash64_xlate(cs, eaddr, access_type,
                                 raddrp, psizep, protp, mmu_idx, guest_visible);
 #endif
 
     case POWERPC_MMU_32B:
-        return ppc_hash32_xlate(cpu, eaddr, access_type, raddrp,
+        return ppc_hash32_xlate(cs, eaddr, access_type, raddrp,
                                psizep, protp, mmu_idx, guest_visible);
     case POWERPC_MMU_BOOKE:
     case POWERPC_MMU_BOOKE206:
-        return ppc_booke_xlate(cpu, eaddr, access_type, raddrp,
+        return ppc_booke_xlate(cs, eaddr, access_type, raddrp,
                                psizep, protp, mmu_idx, guest_visible);
     case POWERPC_MMU_SOFT_4xx:
-        return ppc_40x_xlate(cpu, eaddr, access_type, raddrp,
+        return ppc_40x_xlate(cs, eaddr, access_type, raddrp,
                              psizep, protp, mmu_idx, guest_visible);
     case POWERPC_MMU_SOFT_6xx:
-        return ppc_6xx_xlate(cpu, eaddr, access_type, raddrp,
+        return ppc_6xx_xlate(cs, eaddr, access_type, raddrp,
                              psizep, protp, mmu_idx, guest_visible);
     case POWERPC_MMU_REAL:
-        return ppc_real_mode_xlate(cpu, eaddr, access_type, raddrp, psizep,
+        return ppc_real_mode_xlate(cs, eaddr, access_type, raddrp, psizep,
                                    protp);
     case POWERPC_MMU_MPC8xx:
-        cpu_abort(env_cpu(&cpu->env), "MPC8xx MMU model is not implemented\n");
+        cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
     default:
-        cpu_abort(CPU(cpu), "Unknown or invalid MMU model\n");
+        cpu_abort(cs, "Unknown or invalid MMU model\n");
     }
 }
 
 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
-    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    CPUPPCState *env = cpu_env(cs);
     hwaddr raddr;
     int s, p;
 
@@ -857,10 +855,10 @@ hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
      * try an MMU_DATA_LOAD, we may not be able to read instructions
      * mapped by code TLBs, so we also try a MMU_INST_FETCH.
      */
-    if (ppc_xlate(cpu, addr, MMU_DATA_LOAD, &raddr, &s, &p,
-                  ppc_env_mmu_index(&cpu->env, false), false) ||
-        ppc_xlate(cpu, addr, MMU_INST_FETCH, &raddr, &s, &p,
-                  ppc_env_mmu_index(&cpu->env, true), false)) {
+    if (ppc_xlate(cs, addr, MMU_DATA_LOAD, &raddr, &s, &p,
+                  ppc_env_mmu_index(env, false), false) ||
+        ppc_xlate(cs, addr, MMU_INST_FETCH, &raddr, &s, &p,
+                  ppc_env_mmu_index(env, true), false)) {
         return raddr & TARGET_PAGE_MASK;
     }
     return -1;
diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
index b0a0676beb..cf7ee3b92d 100644
--- a/target/ppc/mmu_helper.c
+++ b/target/ppc/mmu_helper.c
@@ -1361,12 +1361,11 @@ bool ppc_cpu_tlb_fill(CPUState *cs, vaddr eaddr, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool probe, uintptr_t retaddr)
 {
-    PowerPCCPU *cpu = POWERPC_CPU(cs);
     hwaddr raddr;
     int page_size, prot;
 
-    if (ppc_xlate(cpu, eaddr, access_type, &raddr,
-                  &page_size, &prot, mmu_idx, !probe)) {
+    if (ppc_xlate(cs, eaddr, access_type, &raddr, &page_size, &prot,
+                  mmu_idx, !probe)) {
         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
                      prot, mmu_idx, 1UL << page_size);
         return true;
@@ -1374,6 +1373,6 @@ bool ppc_cpu_tlb_fill(CPUState *cs, vaddr eaddr, int size,
     if (probe) {
         return false;
     }
-    raise_exception_err_ra(&cpu->env, cs->exception_index,
-                           cpu->env.error_code, retaddr);
+    raise_exception_err_ra(cpu_env(cs), cs->exception_index,
+                           cpu_env(cs)->error_code, retaddr);
 }
