diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 01e1117..5757a1b 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -408,7 +408,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
     if (!kvm_enabled()) {
         CPUClass *cc = CPU_GET_CLASS(cs);
 
-        cpu_restore_state(env, cs->mem_io_pc);
+        cpu_restore_state(cs, cs->mem_io_pc);
         cc->get_tb_cpu_state(cs, &current_pc, &current_cs_base,
                              &current_flags);
     }
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index f6b9eac..c25951c 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -80,7 +80,7 @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
 void cpu_gen_init(void);
 int cpu_gen_code(CPUArchState *env, struct TranslationBlock *tb,
                  int *gen_code_size_ptr);
-bool cpu_restore_state(CPUArchState *env, uintptr_t searched_pc);
+bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
 
 void QEMU_NORETURN cpu_resume_from_signal(CPUArchState *env1, void *puc);
 void QEMU_NORETURN cpu_io_recompile(CPUArchState *env, uintptr_t retaddr);
diff --git a/target-alpha/helper.c b/target-alpha/helper.c
index 41a1394..f0ba5dd 100644
--- a/target-alpha/helper.c
+++ b/target-alpha/helper.c
@@ -525,7 +525,7 @@ void QEMU_NORETURN dynamic_excp(CPUAlphaState *env, uintptr_t retaddr,
     cs->exception_index = excp;
     env->error_code = error;
     if (retaddr) {
-        cpu_restore_state(env, retaddr);
+        cpu_restore_state(cs, retaddr);
     }
     cpu_loop_exit(cs);
 }
diff --git a/target-alpha/mem_helper.c b/target-alpha/mem_helper.c
index c2bd64a..a807aa0 100644
--- a/target-alpha/mem_helper.c
+++ b/target-alpha/mem_helper.c
@@ -97,7 +97,7 @@ static void do_unaligned_access(CPUAlphaState *env, target_ulong addr,
     uint32_t insn;
 
     if (retaddr) {
-        cpu_restore_state(env, retaddr);
+        cpu_restore_state(cs, retaddr);
     }
 
     pc = env->pc;
@@ -151,11 +151,8 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write,
 
     ret = alpha_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret != 0)) {
-        AlphaCPU *cpu = ALPHA_CPU(cs);
-        CPUAlphaState *env = &cpu->env;
-
         if (retaddr) {
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         /* Exception index and error code are already set */
         cpu_loop_exit(cs);
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index 552ca3d..7bd698c 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -87,7 +87,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         raise_exception(env, cs->exception_index);
     }
diff --git a/target-cris/op_helper.c b/target-cris/op_helper.c
index d80b6c9..d28bd61 100644
--- a/target-cris/op_helper.c
+++ b/target-cris/op_helper.c
@@ -67,7 +67,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
     if (unlikely(ret)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            if (cpu_restore_state(env, retaddr)) {
+            if (cpu_restore_state(cs, retaddr)) {
 		/* Evaluate flags after retranslation.  */
                 helper_top_evaluate_flags(env);
             }
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 557c94f..c571589 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1258,7 +1258,7 @@ void cpu_report_tpr_access(CPUX86State *env, TPRAccess access)
 
         cpu_interrupt(cs, CPU_INTERRUPT_TPR);
     } else {
-        cpu_restore_state(env, cs->mem_io_pc);
+        cpu_restore_state(cs, cs->mem_io_pc);
 
         apic_handle_tpr_access_report(env->apic_state, env->eip, access);
     }
diff --git a/target-i386/mem_helper.c b/target-i386/mem_helper.c
index 2f0691b..b3b811b 100644
--- a/target-i386/mem_helper.c
+++ b/target-i386/mem_helper.c
@@ -145,7 +145,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         raise_exception_err(env, cs->exception_index, env->error_code);
     }
diff --git a/target-lm32/op_helper.c b/target-lm32/op_helper.c
index acf2412..59877ac 100644
--- a/target-lm32/op_helper.c
+++ b/target-lm32/op_helper.c
@@ -87,12 +87,9 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
     ret = lm32_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret)) {
-        LM32CPU *cpu = LM32_CPU(cs);
-        CPULM32State *env = &cpu->env;
-
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
diff --git a/target-m68k/op_helper.c b/target-m68k/op_helper.c
index 6ab1927..59cb33d 100644
--- a/target-m68k/op_helper.c
+++ b/target-m68k/op_helper.c
@@ -60,12 +60,9 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
     ret = m68k_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret)) {
-        M68kCPU *cpu = M68K_CPU(cs);
-        CPUM68KState *env = &cpu->env;
-
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c
index f476132..f8fb7f9 100644
--- a/target-microblaze/op_helper.c
+++ b/target-microblaze/op_helper.c
@@ -49,12 +49,9 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
     ret = mb_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret)) {
-        MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-        CPUMBState *env = &cpu->env;
-
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 0e0c540..dc0c1cc 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -48,7 +48,7 @@ static inline void QEMU_NORETURN do_raise_exception_err(CPUMIPSState *env,
 
     if (pc) {
         /* now we have a real cpu fault */
-        cpu_restore_state(env, pc);
+        cpu_restore_state(cs, pc);
     }
 
     cpu_loop_exit(cs);
diff --git a/target-moxie/helper.c b/target-moxie/helper.c
index 3994c09..04b36b7 100644
--- a/target-moxie/helper.c
+++ b/target-moxie/helper.c
@@ -49,14 +49,12 @@
 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
               uintptr_t retaddr)
 {
-    MoxieCPU *cpu = MOXIE_CPU(cs);
-    CPUMoxieState *env = &cpu->env;
     int ret;
 
     ret = moxie_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret)) {
         if (retaddr) {
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
     }
     cpu_loop_exit(cs);
@@ -70,7 +68,7 @@ void helper_raise_exception(CPUMoxieState *env, int ex)
     /* Stash the exception type.  */
     env->sregs[2] = ex;
     /* Stash the address where the exception occurred.  */
-    cpu_restore_state(env, GETPC());
+    cpu_restore_state(cs, GETPC());
     env->sregs[5] = env->pc;
     /* Jump the the exception handline routine.  */
     env->pc = env->sregs[1];
diff --git a/target-openrisc/mmu_helper.c b/target-openrisc/mmu_helper.c
index 5f7f6f5..fb457c7 100644
--- a/target-openrisc/mmu_helper.c
+++ b/target-openrisc/mmu_helper.c
@@ -44,12 +44,9 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write,
     ret = openrisc_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
 
     if (ret) {
-        OpenRISCCPU *cpu = OPENRISC_CPU(cs);
-        CPUOpenRISCState *env = &cpu->env;
-
         if (retaddr) {
             /* now we have a real cpu fault.  */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         /* Raise Exception.  */
         cpu_loop_exit(cs);
diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index cc31482..e214316 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -2908,7 +2908,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
     if (unlikely(ret != 0)) {
         if (likely(retaddr)) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         helper_raise_exception_err(env, cs->exception_index, env->error_code);
     }
diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
index 44a5557..6a79385 100644
--- a/target-s390x/mem_helper.c
+++ b/target-s390x/mem_helper.c
@@ -51,12 +51,9 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
     ret = s390_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret != 0)) {
-        S390CPU *cpu = S390_CPU(cs);
-        CPUS390XState *env = &cpu->env;
-
         if (likely(retaddr)) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c
index 2b1aa83..54e6d36 100644
--- a/target-s390x/misc_helper.c
+++ b/target-s390x/misc_helper.c
@@ -53,7 +53,7 @@ void QEMU_NORETURN runtime_exception(CPUS390XState *env, int excp,
     env->int_pgm_code = excp;
 
     /* Use the (ultimate) callers address to find the insn that trapped.  */
-    cpu_restore_state(env, retaddr);
+    cpu_restore_state(cs, retaddr);
 
     /* Advance past the insn.  */
     t = cpu_ldub_code(env, env->psw.addr);
diff --git a/target-sh4/op_helper.c b/target-sh4/op_helper.c
index 271401f..b3ce7ba 100644
--- a/target-sh4/op_helper.c
+++ b/target-sh4/op_helper.c
@@ -46,11 +46,8 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
     ret = superh_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (ret) {
         /* now we have a real cpu fault */
-        SuperHCPU *cpu = SUPERH_CPU(cs);
-        CPUSH4State *env = &cpu->env;
-
         if (retaddr) {
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
@@ -75,7 +72,7 @@ static inline void QEMU_NORETURN raise_exception(CPUSH4State *env, int index,
 
     cs->exception_index = index;
     if (retaddr) {
-        cpu_restore_state(env, retaddr);
+        cpu_restore_state(cs, retaddr);
     }
     cpu_loop_exit(cs);
 }
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index fb5f6ec..8d1b72d 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -79,7 +79,7 @@ static target_ulong helper_udiv_common(CPUSPARCState *env, target_ulong a,
     x1 = (b & 0xffffffff);
 
     if (x1 == 0) {
-        cpu_restore_state(env, GETPC());
+        cpu_restore_state(ENV_GET_CPU(env), GETPC());
         helper_raise_exception(env, TT_DIV_ZERO);
     }
 
@@ -118,7 +118,7 @@ static target_ulong helper_sdiv_common(CPUSPARCState *env, target_ulong a,
     x1 = (b & 0xffffffff);
 
     if (x1 == 0) {
-        cpu_restore_state(env, GETPC());
+        cpu_restore_state(ENV_GET_CPU(env), GETPC());
         helper_raise_exception(env, TT_DIV_ZERO);
     }
 
@@ -151,7 +151,7 @@ int64_t helper_sdivx(CPUSPARCState *env, int64_t a, int64_t b)
 {
     if (b == 0) {
         /* Raise divide by zero trap.  */
-        cpu_restore_state(env, GETPC());
+        cpu_restore_state(ENV_GET_CPU(env), GETPC());
         helper_raise_exception(env, TT_DIV_ZERO);
     } else if (b == -1) {
         /* Avoid overflow trap with i386 divide insn.  */
@@ -165,7 +165,7 @@ uint64_t helper_udivx(CPUSPARCState *env, uint64_t a, uint64_t b)
 {
     if (b == 0) {
         /* Raise divide by zero trap.  */
-        cpu_restore_state(env, GETPC());
+        cpu_restore_state(ENV_GET_CPU(env), GETPC());
         helper_raise_exception(env, TT_DIV_ZERO);
     }
     return a / b;
@@ -197,7 +197,7 @@ target_ulong helper_taddcctv(CPUSPARCState *env, target_ulong src1,
     return dst;
 
  tag_overflow:
-    cpu_restore_state(env, GETPC());
+    cpu_restore_state(ENV_GET_CPU(env), GETPC());
     helper_raise_exception(env, TT_TOVF);
 }
 
@@ -226,7 +226,7 @@ target_ulong helper_tsubcctv(CPUSPARCState *env, target_ulong src1,
     return dst;
 
  tag_overflow:
-    cpu_restore_state(env, GETPC());
+    cpu_restore_state(ENV_GET_CPU(env), GETPC());
     helper_raise_exception(env, TT_TOVF);
 }
 
diff --git a/target-sparc/ldst_helper.c b/target-sparc/ldst_helper.c
index 65ce724..b222dff 100644
--- a/target-sparc/ldst_helper.c
+++ b/target-sparc/ldst_helper.c
@@ -2421,7 +2421,7 @@ static void QEMU_NORETURN do_unaligned_access(CPUSPARCState *env,
            "\n", addr, env->pc);
 #endif
     if (retaddr) {
-        cpu_restore_state(env, retaddr);
+        cpu_restore_state(ENV_GET_CPU(env), retaddr);
     }
     helper_raise_exception(env, TT_UNALIGNED);
 }
@@ -2437,11 +2437,8 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
 
     ret = sparc_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (ret) {
-        SPARCCPU *cpu = SPARC_CPU(cs);
-        CPUSPARCState *env = &cpu->env;
-
         if (retaddr) {
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
diff --git a/target-unicore32/op_helper.c b/target-unicore32/op_helper.c
index c2bf834..4c6950d 100644
--- a/target-unicore32/op_helper.c
+++ b/target-unicore32/op_helper.c
@@ -264,12 +264,9 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write,
 
     ret = uc32_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
     if (unlikely(ret)) {
-        UniCore32CPU *cpu = UNICORE32_CPU(cs);
-        CPUUniCore32State *env = &cpu->env;
-
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         cpu_loop_exit(cs);
     }
diff --git a/target-xtensa/op_helper.c b/target-xtensa/op_helper.c
index 17d7f35..24f7579 100644
--- a/target-xtensa/op_helper.c
+++ b/target-xtensa/op_helper.c
@@ -53,7 +53,7 @@ static void do_unaligned_access(CPUXtensaState *env,
 {
     if (xtensa_option_enabled(env->config, XTENSA_OPTION_UNALIGNED_EXCEPTION) &&
             !xtensa_option_enabled(env->config, XTENSA_OPTION_HW_ALIGNMENT)) {
-        cpu_restore_state(env, retaddr);
+        cpu_restore_state(ENV_GET_CPU(env), retaddr);
         HELPER(exception_cause_vaddr)(env,
                 env->pc, LOAD_STORE_ALIGNMENT_CAUSE, addr);
     }
@@ -79,7 +79,7 @@ void tlb_fill(CPUState *cs,
                 paddr & TARGET_PAGE_MASK,
                 access, mmu_idx, page_size);
     } else {
-        cpu_restore_state(env, retaddr);
+        cpu_restore_state(cs, retaddr);
         HELPER(exception_cause_vaddr)(env, env->pc, ret, vaddr);
     }
 }
diff --git a/translate-all.c b/translate-all.c
index ef34936..5673420 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -249,8 +249,9 @@ static int cpu_restore_state_from_tb(TranslationBlock *tb, CPUArchState *env,
     return 0;
 }
 
-bool cpu_restore_state(CPUArchState *env, uintptr_t retaddr)
+bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
 {
+    CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb;
 
     tb = tb_find_pc(retaddr);
diff --git a/user-exec.c b/user-exec.c
index e149c97..75c6d54 100644
--- a/user-exec.c
+++ b/user-exec.c
@@ -117,7 +117,7 @@ static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
         return 1; /* the MMU fault was handled without causing real CPU fault */
     }
     /* now we have a real cpu fault */
-    cpu_restore_state(env, pc);
+    cpu_restore_state(cpu, pc);
 
     /* we restore the process signal mask as the sigreturn should
        do it (XXX: use sigsetjmp) */
