diff --git a/hw/eepro100.c b/hw/eepro100.c
index 97afa2c..74e1d15 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -43,6 +43,7 @@
 
 #include <stddef.h>             /* offsetof */
 #include "hw.h"
+#include "iommu.h"
 #include "pci.h"
 #include "net.h"
 #include "eeprom93xx.h"
@@ -306,10 +307,13 @@ static const uint16_t eepro100_mdi_mask[] = {
 };
 
 /* XXX: optimize */
-static void stl_le_phys(target_phys_addr_t addr, uint32_t val)
+static void stl_le_phys(struct iommu *iommu,
+                        DeviceState *dev,
+                        target_phys_addr_t addr,
+                        uint32_t val)
 {
     val = cpu_to_le32(val);
-    cpu_physical_memory_write(addr, (const uint8_t *)&val, sizeof(val));
+    iommu_write(iommu, dev, addr, (const uint8_t *)&val, sizeof(val));
 }
 
 #define POLYNOMIAL 0x04c11db6
@@ -687,17 +691,25 @@ static void set_ru_state(EEPRO100State * s, ru_state_t state)
 
 static void dump_statistics(EEPRO100State * s)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+    
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     /* Dump statistical data. Most data is never changed by the emulation
      * and always 0, so we first just copy the whole block and then those
      * values which really matter.
      * Number of data should check configuration!!!
      */
-    cpu_physical_memory_write(s->statsaddr,
-                              (uint8_t *) & s->statistics, s->stats_size);
-    stl_le_phys(s->statsaddr + 0, s->statistics.tx_good_frames);
-    stl_le_phys(s->statsaddr + 36, s->statistics.rx_good_frames);
-    stl_le_phys(s->statsaddr + 48, s->statistics.rx_resource_errors);
-    stl_le_phys(s->statsaddr + 60, s->statistics.rx_short_frame_errors);
+    err = iommu_write(iommu, dev, s->statsaddr,
+                      (uint8_t *) &s->statistics, s->stats_size);
+    stl_le_phys(iommu, dev, s->statsaddr + 0, s->statistics.tx_good_frames);
+    stl_le_phys(iommu, dev, s->statsaddr + 36, s->statistics.rx_good_frames);
+    stl_le_phys(iommu, dev,
+                s->statsaddr + 48, s->statistics.rx_resource_errors);
+    stl_le_phys(iommu, dev,
+                s->statsaddr + 60, s->statistics.rx_short_frame_errors);
 #if 0
     stw_le_phys(s->statsaddr + 76, s->statistics.xmt_tco_frames);
     stw_le_phys(s->statsaddr + 78, s->statistics.rcv_tco_frames);
@@ -707,7 +719,13 @@ static void dump_statistics(EEPRO100State * s)
 
 static void read_cb(EEPRO100State *s)
 {
-    cpu_physical_memory_read(s->cb_address, (uint8_t *) &s->tx, sizeof(s->tx));
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
+    err = iommu_read(iommu, dev, s->cb_address, (uint8_t *) &s->tx, sizeof(s->tx));
     s->tx.status = le16_to_cpu(s->tx.status);
     s->tx.command = le16_to_cpu(s->tx.command);
     s->tx.link = le32_to_cpu(s->tx.link);
@@ -723,6 +741,12 @@ static void tx_command(EEPRO100State *s)
     uint8_t buf[2600];
     uint16_t size = 0;
     uint32_t tbd_address = s->cb_address + 0x10;
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     TRACE(RXTX, logout
         ("transmit, TBD array address 0x%08x, TCB byte count 0x%04x, TBD count %u\n",
          tbd_array, tcb_bytes, s->tx.tbd_count));
@@ -737,18 +761,18 @@ static void tx_command(EEPRO100State *s)
     }
     assert(tcb_bytes <= sizeof(buf));
     while (size < tcb_bytes) {
-        uint32_t tx_buffer_address = ldl_phys(tbd_address);
-        uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
+        uint32_t tx_buffer_address = iommu_ldl(iommu, dev, tbd_address);
+        uint16_t tx_buffer_size = iommu_lduw(iommu, dev, tbd_address + 4);
 #if 0
-        uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+        uint16_t tx_buffer_el = iommu_lduw(tbd_address + 6);
 #endif
         tbd_address += 8;
         TRACE(RXTX, logout
             ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
              tx_buffer_address, tx_buffer_size));
         tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
-        cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                 tx_buffer_size);
+        err = iommu_read(iommu, dev,
+                         tx_buffer_address, &buf[size], tx_buffer_size);
         size += tx_buffer_size;
     }
     if (tbd_array == 0xffffffff) {
@@ -759,16 +783,18 @@ static void tx_command(EEPRO100State *s)
         if (s->has_extended_tcb_support && !(s->configuration[6] & BIT(4))) {
             /* Extended Flexible TCB. */
             for (; tbd_count < 2; tbd_count++) {
-                uint32_t tx_buffer_address = ldl_phys(tbd_address);
-                uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
-                uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+                uint32_t tx_buffer_address = iommu_ldl(iommu, dev,
+                                                       tbd_address);
+                uint16_t tx_buffer_size = iommu_lduw(iommu, dev,
+                                                     tbd_address + 4);
+                uint16_t tx_buffer_el = iommu_lduw(iommu, dev, tbd_address + 6);
                 tbd_address += 8;
                 TRACE(RXTX, logout
                     ("TBD (extended flexible mode): buffer address 0x%08x, size 0x%04x\n",
                      tx_buffer_address, tx_buffer_size));
                 tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
-                cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                         tx_buffer_size);
+                err = iommu_read(iommu, dev, tx_buffer_address,
+                                 &buf[size], tx_buffer_size);
                 size += tx_buffer_size;
                 if (tx_buffer_el & 1) {
                     break;
@@ -777,16 +803,16 @@ static void tx_command(EEPRO100State *s)
         }
         tbd_address = tbd_array;
         for (; tbd_count < s->tx.tbd_count; tbd_count++) {
-            uint32_t tx_buffer_address = ldl_phys(tbd_address);
-            uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
-            uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+            uint32_t tx_buffer_address = iommu_ldl(iommu, dev, tbd_address);
+            uint16_t tx_buffer_size = iommu_lduw(iommu, dev, tbd_address + 4);
+            uint16_t tx_buffer_el = iommu_lduw(iommu, dev, tbd_address + 6);
             tbd_address += 8;
             TRACE(RXTX, logout
                 ("TBD (flexible mode): buffer address 0x%08x, size 0x%04x\n",
                  tx_buffer_address, tx_buffer_size));
             tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
-            cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                     tx_buffer_size);
+            err = iommu_read(iommu, dev,
+                             tx_buffer_address, &buf[size], tx_buffer_size);
             size += tx_buffer_size;
             if (tx_buffer_el & 1) {
                 break;
@@ -807,11 +833,17 @@ static void set_multicast_list(EEPRO100State *s)
 {
     uint16_t multicast_count = s->tx.tbd_array_addr & BITS(13, 0);
     uint16_t i;
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     memset(&s->mult[0], 0, sizeof(s->mult));
     TRACE(OTHER, logout("multicast list, multicast count = %u\n", multicast_count));
     for (i = 0; i < multicast_count; i += 6) {
         uint8_t multicast_addr[6];
-        cpu_physical_memory_read(s->cb_address + 10 + i, multicast_addr, 6);
+        err = iommu_read(iommu, dev, s->cb_address + 10 + i, multicast_addr, 6);
         TRACE(OTHER, logout("multicast entry %s\n", nic_dump(multicast_addr, 6)));
         unsigned mcast_idx = compute_mcast_idx(multicast_addr);
         assert(mcast_idx < 64);
@@ -821,6 +853,11 @@ static void set_multicast_list(EEPRO100State *s)
 
 static void action_command(EEPRO100State *s)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     for (;;) {
         bool bit_el;
         bool bit_s;
@@ -845,12 +882,14 @@ static void action_command(EEPRO100State *s)
             /* Do nothing. */
             break;
         case CmdIASetup:
-            cpu_physical_memory_read(s->cb_address + 8, &s->conf.macaddr.a[0], 6);
+            iommu_read(iommu, dev,
+                       s->cb_address + 8, &s->conf.macaddr.a[0], 6);
             TRACE(OTHER, logout("macaddr: %s\n", nic_dump(&s->conf.macaddr.a[0], 6)));
             break;
         case CmdConfigure:
-            cpu_physical_memory_read(s->cb_address + 8, &s->configuration[0],
-                                     sizeof(s->configuration));
+            iommu_read(iommu, dev,
+                       s->cb_address + 8, &s->configuration[0],
+                       sizeof(s->configuration));
             TRACE(OTHER, logout("configuration: %s\n", nic_dump(&s->configuration[0], 16)));
             break;
         case CmdMulticastList:
@@ -880,7 +919,8 @@ static void action_command(EEPRO100State *s)
             break;
         }
         /* Write new status. */
-        stw_phys(s->cb_address, s->tx.status | ok_status | STATUS_C);
+        iommu_stw(iommu, dev,
+                  s->cb_address, s->tx.status | ok_status | STATUS_C);
         if (bit_i) {
             /* CU completed action. */
             eepro100_cx_interrupt(s);
@@ -907,6 +947,11 @@ static void action_command(EEPRO100State *s)
 static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
 {
     cu_state_t cu_state;
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     switch (val) {
     case CU_NOP:
         /* No operation. */
@@ -947,7 +992,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
         /* Dump statistical counters. */
         TRACE(OTHER, logout("val=0x%02x (dump stats)\n", val));
         dump_statistics(s);
-        stl_le_phys(s->statsaddr + s->stats_size, 0xa005);
+        stl_le_phys(iommu, dev, s->statsaddr + s->stats_size, 0xa005);
         break;
     case CU_CMD_BASE:
         /* Load CU base. */
@@ -958,7 +1003,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
         /* Dump and reset statistical counters. */
         TRACE(OTHER, logout("val=0x%02x (dump stats and reset)\n", val));
         dump_statistics(s);
-        stl_le_phys(s->statsaddr + s->stats_size, 0xa007);
+        stl_le_phys(iommu, dev, s->statsaddr + s->stats_size, 0xa007);
         memset(&s->statistics, 0, sizeof(s->statistics));
         break;
     case CU_SRESUME:
@@ -1252,6 +1297,11 @@ static void eepro100_write_port(EEPRO100State * s, uint32_t val)
     val = le32_to_cpu(val);
     uint32_t address = (val & ~PORT_SELECTION_MASK);
     uint8_t selection = (val & PORT_SELECTION_MASK);
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     switch (selection) {
     case PORT_SOFTWARE_RESET:
         nic_reset(s);
@@ -1259,10 +1309,12 @@ static void eepro100_write_port(EEPRO100State * s, uint32_t val)
     case PORT_SELFTEST:
         TRACE(OTHER, logout("selftest address=0x%08x\n", address));
         eepro100_selftest_t data;
-        cpu_physical_memory_read(address, (uint8_t *) & data, sizeof(data));
+        iommu_read(iommu, dev,
+                   address, (uint8_t *) &data, sizeof(data));
         data.st_sign = 0xffffffff;
         data.st_result = 0;
-        cpu_physical_memory_write(address, (uint8_t *) & data, sizeof(data));
+        iommu_write(iommu, dev,
+                    address, (uint8_t *) &data, sizeof(data));
         break;
     case PORT_SELECTIVE_RESET:
         TRACE(OTHER, logout("selective reset, selftest address=0x%08x\n", address));
@@ -1646,6 +1698,10 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
     uint16_t rfd_status = 0xa000;
     static const uint8_t broadcast_macaddr[6] =
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
 
     /* TODO: check multiple IA bit. */
     if (s->configuration[20] & BIT(6)) {
@@ -1721,8 +1777,9 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
     }
     /* !!! */
     eepro100_rx_t rx;
-    cpu_physical_memory_read(s->ru_base + s->ru_offset, (uint8_t *) & rx,
-                             offsetof(eepro100_rx_t, packet));
+    iommu_read(iommu, dev,
+               s->ru_base + s->ru_offset, (uint8_t *) & rx,
+               offsetof(eepro100_rx_t, packet));
     uint16_t rfd_command = le16_to_cpu(rx.command);
     uint16_t rfd_size = le16_to_cpu(rx.size);
 
@@ -1736,9 +1793,12 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
     }
     TRACE(OTHER, logout("command 0x%04x, link 0x%08x, addr 0x%08x, size %u\n",
           rfd_command, rx.link, rx.rx_buf_addr, rfd_size));
-    stw_phys(s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, status),
-             rfd_status);
-    stw_phys(s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, count), size);
+    iommu_stw(iommu, dev,
+              s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, status),
+              rfd_status);
+    iommu_stw(iommu, dev,
+              s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, count),
+              size);
     /* Early receive interrupt not supported. */
 #if 0
     eepro100_er_interrupt(s);
@@ -1752,8 +1812,9 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
 #if 0
     assert(!(s->configuration[17] & BIT(0)));
 #endif
-    cpu_physical_memory_write(s->ru_base + s->ru_offset +
-                              offsetof(eepro100_rx_t, packet), buf, size);
+    iommu_write(iommu, dev,
+                s->ru_base + s->ru_offset +
+                offsetof(eepro100_rx_t, packet), buf, size);
     s->statistics.rx_good_frames++;
     eepro100_fr_interrupt(s);
     s->ru_offset = le32_to_cpu(rx.link);
