diff --git a/cpus.c b/cpus.c
index c8bc8ad..353208c 100644
--- a/cpus.c
+++ b/cpus.c
@@ -407,10 +407,10 @@ void hw_error(const char *fmt, ...)
 
 void cpu_synchronize_all_states(void)
 {
-    CPUArchState *cpu;
+    CPUArchState *env;
 
-    for (cpu = first_cpu; cpu; cpu = cpu->next_cpu) {
-        cpu_synchronize_state(cpu);
+    for (env = first_cpu; env; env = env->next_cpu) {
+        cpu_synchronize_state(ENV_GET_CPU(env));
     }
 }
 
@@ -1219,7 +1219,7 @@ CpuInfoList *qmp_query_cpus(Error **errp)
         CPUState *cpu = ENV_GET_CPU(env);
         CpuInfoList *info;
 
-        cpu_synchronize_state(env);
+        cpu_synchronize_state(cpu);
 
         info = g_malloc0(sizeof(*info));
         info->value = g_malloc0(sizeof(*info->value));
diff --git a/gdbstub.c b/gdbstub.c
index 9ffb376..663549c 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2033,7 +2033,7 @@ static void gdb_breakpoint_remove_all(void)
 
 static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 {
-    cpu_synchronize_state(s->c_cpu);
+    cpu_synchronize_state(ENV_GET_CPU(s->c_cpu));
 #if defined(TARGET_I386)
     s->c_cpu->eip = pc;
 #elif defined (TARGET_PPC)
@@ -2228,7 +2228,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         }
         break;
     case 'g':
-        cpu_synchronize_state(s->g_cpu);
+        cpu_synchronize_state(ENV_GET_CPU(s->g_cpu));
         env = s->g_cpu;
         len = 0;
         for (addr = 0; addr < num_g_regs; addr++) {
@@ -2239,7 +2239,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         put_packet(s, buf);
         break;
     case 'G':
-        cpu_synchronize_state(s->g_cpu);
+        cpu_synchronize_state(ENV_GET_CPU(s->g_cpu));
         env = s->g_cpu;
         registers = mem_buf;
         len = strlen(p) / 2;
@@ -2407,7 +2407,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             env = find_cpu(thread);
             if (env != NULL) {
                 CPUState *cpu = ENV_GET_CPU(env);
-                cpu_synchronize_state(env);
+                cpu_synchronize_state(cpu);
                 len = snprintf((char *)mem_buf, sizeof(mem_buf),
                                "CPU#%d [%s]", cpu->cpu_index,
                                cpu->halted ? "halted " : "running");
diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index 8f80425..bd0bdd8 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -129,7 +129,7 @@ static void do_inject_external_nmi(void *data)
     uint32_t lvt;
     int ret;
 
-    cpu_synchronize_state(&s->cpu->env);
+    cpu_synchronize_state(cpu);
 
     lvt = s->lvt[APIC_LVT_LINT1];
     if (!(lvt & APIC_LVT_MASKED) && ((lvt >> 8) & 7) == APIC_DM_NMI) {
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 655483b..f93629f 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -456,7 +456,7 @@ void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cs);
 
     if (evaluate_tpr_instruction(s, env, &ip, access) < 0) {
         if (s->state == VAPIC_ACTIVE) {
@@ -627,7 +627,7 @@ static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
     hwaddr rom_paddr;
     VAPICROMState *s = opaque;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(x86_env_get_cpu(env)));
 
     /*
      * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
diff --git a/hw/misc/vmport.c b/hw/misc/vmport.c
index 57b71f5..8363dfd 100644
--- a/hw/misc/vmport.c
+++ b/hw/misc/vmport.c
@@ -66,7 +66,7 @@ static uint64_t vmport_ioport_read(void *opaque, hwaddr addr,
     unsigned char command;
     uint32_t eax;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(x86_env_get_cpu(env)));
 
     eax = env->regs[R_EAX];
     if (eax != VMPORT_MAGIC)
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 1290d37..ea65414 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -98,7 +98,7 @@ static void spin_kick(void *data)
     hwaddr map_size = 64 * 1024 * 1024;
     hwaddr map_start;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cpu);
     stl_p(&curspin->pir, env->spr[SPR_PIR]);
     env->nip = ldq_p(&curspin->addr) & (map_size - 1);
     env->gpr[3] = ldq_p(&curspin->r3);
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 3e1db28..06da2b3 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -263,10 +263,10 @@ void kvm_cpu_synchronize_state(CPUState *cpu);
 
 /* generic hooks - to be moved/refactored once there are more users */
 
-static inline void cpu_synchronize_state(CPUArchState *env)
+static inline void cpu_synchronize_state(CPUState *cpu)
 {
     if (kvm_enabled()) {
-        kvm_cpu_synchronize_state(ENV_GET_CPU(env));
+        kvm_cpu_synchronize_state(cpu);
     }
 }
 
diff --git a/monitor.c b/monitor.c
index 70ae8f5..19c297d 100644
--- a/monitor.c
+++ b/monitor.c
@@ -191,7 +191,7 @@ struct Monitor {
     QString *outbuf;
     ReadLineState *rs;
     MonitorControl *mc;
-    CPUArchState *mon_cpu;
+    CPUState *mon_cpu;
     BlockDriverCompletionFunc *password_completion_cb;
     void *password_opaque;
     QError *error;
@@ -900,7 +900,7 @@ int monitor_set_cpu(int cpu_index)
     if (cpu == NULL) {
         return -1;
     }
-    cur_mon->mon_cpu = cpu->env_ptr;
+    cur_mon->mon_cpu = cpu;
     return 0;
 }
 
@@ -910,7 +910,7 @@ static CPUArchState *mon_get_cpu(void)
         monitor_set_cpu(0);
     }
     cpu_synchronize_state(cur_mon->mon_cpu);
-    return cur_mon->mon_cpu;
+    return cur_mon->mon_cpu->env_ptr;
 }
 
 int monitor_get_cpu_index(void)
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 158710a..803945d 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -187,7 +187,7 @@ void cpu_dump_state(CPUX86State *env, FILE *f, fprintf_function cpu_fprintf,
     char cc_op_name[32];
     static const char *seg_name[6] = { "ES", "CS", "SS", "DS", "FS", "GS" };
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cs);
 
     eflags = cpu_compute_eflags(env);
 #ifdef TARGET_X86_64
@@ -1116,7 +1116,7 @@ static void do_inject_x86_mce(void *data)
     CPUState *cpu = CPU(params->cpu);
     uint64_t *banks = cenv->mce_banks + 4 * params->bank;
 
-    cpu_synchronize_state(cenv);
+    cpu_synchronize_state(cpu);
 
     /*
      * If there is an MCE exception being processed, ignore this SRAO MCE
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 0b0adfd..39f4fbb 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -2079,7 +2079,7 @@ static int kvm_handle_debug(X86CPU *cpu,
         ret = EXCP_DEBUG;
     }
     if (ret == 0) {
-        cpu_synchronize_state(env);
+        cpu_synchronize_state(CPU(cpu));
         assert(env->exception_injected == -1);
 
         /* pass to guest */
diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 43ccf45..5c67ec3 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -78,7 +78,7 @@ void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
     int i;
     uint64_t slbe, slbv;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(ppc_env_get_cpu(env)));
 
     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
     for (i = 0; i < env->slb_nr; i++) {
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 4590c6f..076cdac 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -9534,7 +9534,7 @@ void cpu_dump_state (CPUPPCState *env, FILE *f, fprintf_function cpu_fprintf,
 
     int i;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(ppc_env_get_cpu(env)));
 
     cpu_fprintf(f, "NIP " TARGET_FMT_lx "   LR " TARGET_FMT_lx " CTR "
                 TARGET_FMT_lx " XER " TARGET_FMT_lx "\n",
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 650d3a5..b524c35 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -450,7 +450,7 @@ static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
     uint64_t code;
     int r = 0;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(cpu));
     sccb = env->regs[ipbh0 & 0xf];
     code = env->regs[(ipbh0 & 0xf0) >> 4];
 
@@ -656,16 +656,17 @@ static int s390_store_status(CPUS390XState *env, uint32_t parameter)
 
 static int s390_cpu_initial_reset(S390CPU *cpu)
 {
+    CPUState *cs = CPU(cpu);
     CPUS390XState *env = &cpu->env;
     int i;
 
     s390_del_running_cpu(cpu);
-    if (kvm_vcpu_ioctl(CPU(cpu), KVM_S390_INITIAL_RESET, NULL) < 0) {
+    if (kvm_vcpu_ioctl(cs, KVM_S390_INITIAL_RESET, NULL) < 0) {
         perror("cannot init reset vcpu");
     }
 
     /* Manually zero out all registers */
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(cs);
     for (i = 0; i < 16; i++) {
         env->regs[i] = 0;
     }
@@ -685,7 +686,7 @@ static int handle_sigp(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
     S390CPU *target_cpu;
     CPUS390XState *target_env;
 
-    cpu_synchronize_state(env);
+    cpu_synchronize_state(CPU(cpu));
 
     /* get order code */
     order_code = run->s390_sieic.ipb >> 28;
