diff --git a/hw/apic.h b/hw/apic.h
index d6d6d44..62179ce 100644
--- a/hw/apic.h
+++ b/hw/apic.h
@@ -22,7 +22,7 @@ void apic_handle_tpr_access_report(DeviceState *d, target_ulong ip,
                                    TPRAccess access);
 
 /* pc.c */
-int cpu_is_bsp(CPUState *env);
+int cpu_is_bsp(CPUX86State *env);
 DeviceState *cpu_get_current_apic(void);
 
 #endif
diff --git a/hw/kvm/apic.c b/hw/kvm/apic.c
index 9ca68f8..ffe7a52 100644
--- a/hw/kvm/apic.c
+++ b/hw/kvm/apic.c
@@ -124,7 +124,7 @@ static void kvm_apic_vapic_base_update(APICCommonState *s)
 static void do_inject_external_nmi(void *data)
 {
     APICCommonState *s = data;
-    CPUState *env = s->cpu_env;
+    CPUX86State *env = s->cpu_env;
     uint32_t lvt;
     int ret;
 
diff --git a/hw/kvmvapic.c b/hw/kvmvapic.c
index e8bfeec..5d83625 100644
--- a/hw/kvmvapic.c
+++ b/hw/kvmvapic.c
@@ -142,7 +142,7 @@ static void update_guest_rom_state(VAPICROMState *s)
     write_guest_rom_state(s);
 }
 
-static int find_real_tpr_addr(VAPICROMState *s, CPUState *env)
+static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env)
 {
     target_phys_addr_t paddr;
     target_ulong addr;
@@ -185,7 +185,7 @@ static bool opcode_matches(uint8_t *opcode, const TPRInstruction *instr)
          modrm_reg(opcode[1]) == instr->modrm_reg);
 }
 
-static int evaluate_tpr_instruction(VAPICROMState *s, CPUState *env,
+static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env,
                                     target_ulong *pip, TPRAccess access)
 {
     const TPRInstruction *instr;
@@ -267,7 +267,7 @@ instruction_ok:
     return 0;
 }
 
-static int update_rom_mapping(VAPICROMState *s, CPUState *env, target_ulong ip)
+static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong ip)
 {
     target_phys_addr_t paddr;
     uint32_t rom_state_vaddr;
@@ -330,7 +330,7 @@ static int update_rom_mapping(VAPICROMState *s, CPUState *env, target_ulong ip)
  * cannot be accessed or is considered invalid. This also ensures that we are
  * not patching the wrong guest.
  */
-static int get_kpcr_number(CPUState *env)
+static int get_kpcr_number(CPUX86State *env)
 {
     struct kpcr {
         uint8_t  fill1[0x1c];
@@ -347,7 +347,7 @@ static int get_kpcr_number(CPUState *env)
     return kpcr.number;
 }
 
-static int vapic_enable(VAPICROMState *s, CPUState *env)
+static int vapic_enable(VAPICROMState *s, CPUX86State *env)
 {
     int cpu_number = get_kpcr_number(env);
     target_phys_addr_t vapic_paddr;
@@ -367,12 +367,12 @@ static int vapic_enable(VAPICROMState *s, CPUState *env)
     return 0;
 }
 
-static void patch_byte(CPUState *env, target_ulong addr, uint8_t byte)
+static void patch_byte(CPUX86State *env, target_ulong addr, uint8_t byte)
 {
     cpu_memory_rw_debug(env, addr, &byte, 1, 1);
 }
 
-static void patch_call(VAPICROMState *s, CPUState *env, target_ulong ip,
+static void patch_call(VAPICROMState *s, CPUX86State *env, target_ulong ip,
                        uint32_t target)
 {
     uint32_t offset;
@@ -382,7 +382,7 @@ static void patch_call(VAPICROMState *s, CPUState *env, target_ulong ip,
     cpu_memory_rw_debug(env, ip + 1, (void *)&offset, sizeof(offset), 1);
 }
 
-static void patch_instruction(VAPICROMState *s, CPUState *env, target_ulong ip)
+static void patch_instruction(VAPICROMState *s, CPUX86State *env, target_ulong ip)
 {
     target_phys_addr_t paddr;
     VAPICHandlers *handlers;
@@ -439,7 +439,7 @@ void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip,
                              TPRAccess access)
 {
     VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
-    CPUState *env = cpu;
+    CPUX86State *env = cpu;
 
     cpu_synchronize_state(env);
 
@@ -475,7 +475,7 @@ static void vapic_enable_tpr_reporting(bool enable)
     VAPICEnableTPRReporting info = {
         .enable = enable,
     };
-    CPUState *env;
+    CPUX86State *env;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
         info.apic = env->apic_state;
@@ -606,7 +606,7 @@ static int vapic_prepare(VAPICROMState *s)
 static void vapic_write(void *opaque, target_phys_addr_t addr, uint64_t data,
                         unsigned int size)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
     target_phys_addr_t rom_paddr;
     VAPICROMState *s = opaque;
 
diff --git a/hw/pc.c b/hw/pc.c
index aca4460..83a1b5b 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -140,7 +140,7 @@ void cpu_smm_register(cpu_set_smm_t callback, void *arg)
     smm_arg = arg;
 }
 
-void cpu_smm_update(CPUState *env)
+void cpu_smm_update(CPUX86State *env)
 {
     if (smm_set && smm_arg && env == first_cpu)
         smm_set(!!(env->hflags & HF_SMM_MASK), smm_arg);
@@ -148,7 +148,7 @@ void cpu_smm_update(CPUState *env)
 
 
 /* IRQ handling */
-int cpu_get_pic_interrupt(CPUState *env)
+int cpu_get_pic_interrupt(CPUX86State *env)
 {
     int intno;
 
@@ -167,7 +167,7 @@ int cpu_get_pic_interrupt(CPUState *env)
 
 static void pic_irq_request(void *opaque, int irq, int level)
 {
-    CPUState *env = first_cpu;
+    CPUX86State *env = first_cpu;
 
     DPRINTF("pic_irqs: %s irq %d\n", level? "raise" : "lower", irq);
     if (env->apic_state) {
@@ -522,7 +522,7 @@ type_init(port92_register_types)
 
 static void handle_a20_line_change(void *opaque, int irq, int level)
 {
-    CPUState *cpu = opaque;
+    CPUX86State *cpu = opaque;
 
     /* XXX: send to all CPUs ? */
     /* XXX: add logic to handle multiple A20 line sources */
@@ -869,7 +869,7 @@ void pc_init_ne2k_isa(ISABus *bus, NICInfo *nd)
     nb_ne2k++;
 }
 
-int cpu_is_bsp(CPUState *env)
+int cpu_is_bsp(CPUX86State *env)
 {
     /* We hard-wire the BSP to the first CPU. */
     return env->cpu_index == 0;
@@ -917,7 +917,7 @@ static DeviceState *apic_init(void *env, uint8_t apic_id)
 
 void pc_acpi_smi_interrupt(void *opaque, int irq, int level)
 {
-    CPUState *s = opaque;
+    CPUX86State *s = opaque;
 
     if (level) {
         cpu_interrupt(s, CPU_INTERRUPT_SMI);
@@ -926,15 +926,15 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level)
 
 static void pc_cpu_reset(void *opaque)
 {
-    CPUState *env = opaque;
+    CPUX86State *env = opaque;
 
     cpu_state_reset(env);
     env->halted = !cpu_is_bsp(env);
 }
 
-static CPUState *pc_new_cpu(const char *cpu_model)
+static CPUX86State *pc_new_cpu(const char *cpu_model)
 {
-    CPUState *env;
+    CPUX86State *env;
 
     env = cpu_init(cpu_model);
     if (!env) {
@@ -1070,7 +1070,7 @@ DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus)
 
 static void cpu_request_exit(void *opaque, int irq, int level)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
 
     if (env && level) {
         cpu_exit(env);
diff --git a/hw/vmport.c b/hw/vmport.c
index 9373be9..a4f52ee 100644
--- a/hw/vmport.c
+++ b/hw/vmport.c
@@ -57,7 +57,7 @@ void vmport_register(unsigned char command, IOPortReadFunc *func, void *opaque)
 static uint32_t vmport_ioport_read(void *opaque, uint32_t addr)
 {
     VMPortState *s = opaque;
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
     unsigned char command;
     uint32_t eax;
 
@@ -83,21 +83,21 @@ static uint32_t vmport_ioport_read(void *opaque, uint32_t addr)
 
 static void vmport_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
 
     env->regs[R_EAX] = vmport_ioport_read(opaque, addr);
 }
 
 static uint32_t vmport_cmd_get_version(void *opaque, uint32_t addr)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
     env->regs[R_EBX] = VMPORT_MAGIC;
     return 6;
 }
 
 static uint32_t vmport_cmd_ram_size(void *opaque, uint32_t addr)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
     env->regs[R_EBX] = 0x1177;
     return ram_size;
 }
@@ -105,7 +105,7 @@ static uint32_t vmport_cmd_ram_size(void *opaque, uint32_t addr)
 /* vmmouse helpers */
 void vmmouse_get_data(uint32_t *data)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
 
     data[0] = env->regs[R_EAX]; data[1] = env->regs[R_EBX];
     data[2] = env->regs[R_ECX]; data[3] = env->regs[R_EDX];
@@ -114,7 +114,7 @@ void vmmouse_get_data(uint32_t *data)
 
 void vmmouse_set_data(const uint32_t *data)
 {
-    CPUState *env = cpu_single_env;
+    CPUX86State *env = cpu_single_env;
 
     env->regs[R_EAX] = data[0]; env->regs[R_EBX] = data[1];
     env->regs[R_ECX] = data[2]; env->regs[R_EDX] = data[3];
diff --git a/hw/xen_machine_pv.c b/hw/xen_machine_pv.c
index 7985d11..7eee770 100644
--- a/hw/xen_machine_pv.c
+++ b/hw/xen_machine_pv.c
@@ -36,7 +36,7 @@ static void xen_init_pv(ram_addr_t ram_size,
 			const char *initrd_filename,
 			const char *cpu_model)
 {
-    CPUState *env;
+    CPUX86State *env;
     DriveInfo *dinfo;
     int i;
 
