diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 60ab8f3242..e5deb5195b 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -209,9 +209,9 @@ static void cp_reg_check_reset(gpointer key, gpointer value,  gpointer opaque)
 
 static void arm_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    ARMCPU *cpu = ARM_CPU(s);
-    ARMCPUClass *acc = ARM_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    ARMCPU *cpu = ARM_CPU(cs);
+    ARMCPUClass *acc = ARM_CPU_GET_CLASS(obj);
     CPUARMState *env = &cpu->env;
 
     if (acc->parent_phases.hold) {
@@ -228,7 +228,7 @@ static void arm_cpu_reset_hold(Object *obj)
     env->vfp.xregs[ARM_VFP_MVFR1] = cpu->isar.mvfr1;
     env->vfp.xregs[ARM_VFP_MVFR2] = cpu->isar.mvfr2;
 
-    cpu->power_state = s->start_powered_off ? PSCI_OFF : PSCI_ON;
+    cpu->power_state = cs->start_powered_off ? PSCI_OFF : PSCI_ON;
 
     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
@@ -433,7 +433,7 @@ static void arm_cpu_reset_hold(Object *obj)
 
         /* Load the initial SP and PC from offset 0 and 4 in the vector table */
         vecbase = env->v7m.vecbase[env->v7m.secure];
-        rom = rom_ptr_for_as(s->as, vecbase, 8);
+        rom = rom_ptr_for_as(cs->as, vecbase, 8);
         if (rom) {
             /* Address zero is covered by ROM which hasn't yet been
              * copied into physical memory.
@@ -446,8 +446,8 @@ static void arm_cpu_reset_hold(Object *obj)
              * it got copied into memory. In the latter case, rom_ptr
              * will return a NULL pointer and we should use ldl_phys instead.
              */
-            initial_msp = ldl_phys(s->as, vecbase);
-            initial_pc = ldl_phys(s->as, vecbase + 4);
+            initial_msp = ldl_phys(cs->as, vecbase);
+            initial_pc = ldl_phys(cs->as, vecbase + 4);
         }
 
         qemu_log_mask(CPU_LOG_INT,
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index f5cbdc4a8c..0f191a4c9d 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -74,7 +74,7 @@ static void avr_cpu_reset_hold(Object *obj)
 {
     CPUState *cs = CPU(obj);
     AVRCPU *cpu = AVR_CPU(cs);
-    AVRCPUClass *mcc = AVR_CPU_GET_CLASS(cpu);
+    AVRCPUClass *mcc = AVR_CPU_GET_CLASS(obj);
     CPUAVRState *env = &cpu->env;
 
     if (mcc->parent_phases.hold) {
diff --git a/target/cris/cpu.c b/target/cris/cpu.c
index 9ba08e8b0c..4187e0ef3c 100644
--- a/target/cris/cpu.c
+++ b/target/cris/cpu.c
@@ -60,7 +60,7 @@ static void cris_cpu_reset_hold(Object *obj)
 {
     CPUState *s = CPU(obj);
     CRISCPU *cpu = CRIS_CPU(s);
-    CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(cpu);
+    CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(obj);
     CPUCRISState *env = &cpu->env;
     uint32_t vr;
 
diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index c0cd739e15..085d6c0115 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -289,7 +289,7 @@ static void hexagon_cpu_reset_hold(Object *obj)
 {
     CPUState *cs = CPU(obj);
     HexagonCPU *cpu = HEXAGON_CPU(cs);
-    HexagonCPUClass *mcc = HEXAGON_CPU_GET_CLASS(cpu);
+    HexagonCPUClass *mcc = HEXAGON_CPU_GET_CLASS(obj);
     CPUHexagonState *env = &cpu->env;
 
     if (mcc->parent_phases.hold) {
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 03822d9ba8..66345c204a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6690,9 +6690,9 @@ static void x86_cpu_set_sgxlepubkeyhash(CPUX86State *env)
 
 static void x86_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    X86CPU *cpu = X86_CPU(s);
-    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    X86CPU *cpu = X86_CPU(cs);
+    X86CPUClass *xcc = X86_CPU_GET_CLASS(obj);
     CPUX86State *env = &cpu->env;
     target_ulong cr4;
     uint64_t xcr0;
@@ -6780,8 +6780,8 @@ static void x86_cpu_reset_hold(Object *obj)
     memset(env->dr, 0, sizeof(env->dr));
     env->dr[6] = DR6_FIXED_1;
     env->dr[7] = DR7_FIXED_1;
-    cpu_breakpoint_remove_all(s, BP_CPU);
-    cpu_watchpoint_remove_all(s, BP_CPU);
+    cpu_breakpoint_remove_all(cs, BP_CPU);
+    cpu_watchpoint_remove_all(cs, BP_CPU);
 
     cr4 = 0;
     xcr0 = XSTATE_FP_MASK;
@@ -6832,9 +6832,9 @@ static void x86_cpu_reset_hold(Object *obj)
     env->triple_fault_pending = false;
 #if !defined(CONFIG_USER_ONLY)
     /* We hard-wire the BSP to the first CPU. */
-    apic_designate_bsp(cpu->apic_state, s->cpu_index == 0);
+    apic_designate_bsp(cpu->apic_state, cs->cpu_index == 0);
 
-    s->halted = !cpu_is_bsp(cpu);
+    cs->halted = !cpu_is_bsp(cpu);
 
     if (kvm_enabled()) {
         kvm_arch_reset_vcpu(cpu);
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 064540397d..3094bbc0d9 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -500,7 +500,7 @@ static void loongarch_cpu_reset_hold(Object *obj)
 {
     CPUState *cs = CPU(obj);
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
-    LoongArchCPUClass *lacc = LOONGARCH_CPU_GET_CLASS(cpu);
+    LoongArchCPUClass *lacc = LOONGARCH_CPU_GET_CLASS(obj);
     CPULoongArchState *env = &cpu->env;
 
     if (lacc->parent_phases.hold) {
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 1421e77c2c..4d14d04c33 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -68,9 +68,9 @@ static void m68k_unset_feature(CPUM68KState *env, int feature)
 
 static void m68k_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    M68kCPU *cpu = M68K_CPU(s);
-    M68kCPUClass *mcc = M68K_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    M68kCPU *cpu = M68K_CPU(cs);
+    M68kCPUClass *mcc = M68K_CPU_GET_CLASS(obj);
     CPUM68KState *env = &cpu->env;
     floatx80 nan = floatx80_default_nan(NULL);
     int i;
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index bbb3335cad..6d4b7c2c8f 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -167,9 +167,9 @@ static void microblaze_cpu_set_irq(void *opaque, int irq, int level)
 
 static void mb_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(s);
-    MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+    MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(obj);
     CPUMBState *env = &cpu->env;
 
     if (mcc->parent_phases.hold) {
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index a0023edd43..6ced52f985 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -188,7 +188,7 @@ static void mips_cpu_reset_hold(Object *obj)
 {
     CPUState *cs = CPU(obj);
     MIPSCPU *cpu = MIPS_CPU(cs);
-    MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(cpu);
+    MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(obj);
     CPUMIPSState *env = &cpu->env;
 
     if (mcc->parent_phases.hold) {
diff --git a/target/nios2/cpu.c b/target/nios2/cpu.c
index a27732bf2b..09b122e24d 100644
--- a/target/nios2/cpu.c
+++ b/target/nios2/cpu.c
@@ -61,7 +61,7 @@ static void nios2_cpu_reset_hold(Object *obj)
 {
     CPUState *cs = CPU(obj);
     Nios2CPU *cpu = NIOS2_CPU(cs);
-    Nios2CPUClass *ncc = NIOS2_CPU_GET_CLASS(cpu);
+    Nios2CPUClass *ncc = NIOS2_CPU_GET_CLASS(obj);
     CPUNios2State *env = &cpu->env;
 
     if (ncc->parent_phases.hold) {
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index 381ebe00d3..0fdadf9e55 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -75,9 +75,9 @@ static void openrisc_disas_set_info(CPUState *cpu, disassemble_info *info)
 
 static void openrisc_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    OpenRISCCPU *cpu = OPENRISC_CPU(s);
-    OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    OpenRISCCPU *cpu = OPENRISC_CPU(cs);
+    OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(obj);
 
     if (occ->parent_phases.hold) {
         occ->parent_phases.hold(obj);
@@ -88,7 +88,7 @@ static void openrisc_cpu_reset_hold(Object *obj)
     cpu->env.pc = 0x100;
     cpu->env.sr = SR_FO | SR_SM;
     cpu->env.lock_addr = -1;
-    s->exception_index = -1;
+    cs->exception_index = -1;
     cpu_set_fpcsr(&cpu->env, 0);
 
     set_float_detect_tininess(float_tininess_before_rounding,
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 344196a8ce..61b8495a90 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7107,9 +7107,9 @@ static bool ppc_cpu_has_work(CPUState *cs)
 
 static void ppc_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    PowerPCCPU *cpu = POWERPC_CPU(s);
-    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(obj);
     CPUPPCState *env = &cpu->env;
     target_ulong msr;
     int i;
@@ -7158,8 +7158,8 @@ static void ppc_cpu_reset_hold(Object *obj)
     env->nip = env->hreset_vector | env->excp_prefix;
 
     if (tcg_enabled()) {
-        cpu_breakpoint_remove_all(s, BP_CPU);
-        cpu_watchpoint_remove_all(s, BP_CPU);
+        cpu_breakpoint_remove_all(cs, BP_CPU);
+        cpu_watchpoint_remove_all(cs, BP_CPU);
         if (env->mmu_model != POWERPC_MMU_REAL) {
             ppc_tlb_invalidate_all(env);
         }
@@ -7173,7 +7173,7 @@ static void ppc_cpu_reset_hold(Object *obj)
     env->reserve_addr = (target_ulong)-1ULL;
     /* Be sure no exception or interrupt is pending */
     env->pending_interrupts = 0;
-    s->exception_index = POWERPC_EXCP_NONE;
+    cs->exception_index = POWERPC_EXCP_NONE;
     env->error_code = 0;
     ppc_irq_reset(cpu);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 8cbfc7e781..1bd99bc5c6 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -875,7 +875,7 @@ static void riscv_cpu_reset_hold(Object *obj)
 #endif
     CPUState *cs = CPU(obj);
     RISCVCPU *cpu = RISCV_CPU(cs);
-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(obj);
     CPURISCVState *env = &cpu->env;
 
     if (mcc->parent_phases.hold) {
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index c5ffeffe32..58ca26184d 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -67,7 +67,7 @@ static bool rx_cpu_has_work(CPUState *cs)
 static void rx_cpu_reset_hold(Object *obj)
 {
     RXCPU *cpu = RX_CPU(obj);
-    RXCPUClass *rcc = RX_CPU_GET_CLASS(cpu);
+    RXCPUClass *rcc = RX_CPU_GET_CLASS(obj);
     CPURXState *env = &cpu->env;
     uint32_t *resetvec;
 
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 806a0ef875..1b03c7bcb1 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -91,9 +91,9 @@ static bool superh_cpu_has_work(CPUState *cs)
 
 static void superh_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    SuperHCPU *cpu = SUPERH_CPU(s);
-    SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+    SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(obj);
     CPUSH4State *env = &cpu->env;
 
     if (scc->parent_phases.hold) {
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index befa7fc4eb..152bee4f81 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -31,9 +31,9 @@
 
 static void sparc_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    SPARCCPU *cpu = SPARC_CPU(s);
-    SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    SPARCCPU *cpu = SPARC_CPU(cs);
+    SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(obj);
     CPUSPARCState *env = &cpu->env;
 
     if (scc->parent_phases.hold) {
diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 8acacdf0c0..9bdaa1593a 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -72,9 +72,9 @@ static void tricore_restore_state_to_opc(CPUState *cs,
 
 static void tricore_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    TriCoreCPU *cpu = TRICORE_CPU(s);
-    TriCoreCPUClass *tcc = TRICORE_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    TriCoreCPU *cpu = TRICORE_CPU(cs);
+    TriCoreCPUClass *tcc = TRICORE_CPU_GET_CLASS(obj);
     CPUTriCoreState *env = &cpu->env;
 
     if (tcc->parent_phases.hold) {
diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index 99c0ca130f..ce044466ad 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -90,9 +90,9 @@ bool xtensa_abi_call0(void)
 
 static void xtensa_cpu_reset_hold(Object *obj)
 {
-    CPUState *s = CPU(obj);
-    XtensaCPU *cpu = XTENSA_CPU(s);
-    XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(cpu);
+    CPUState *cs = CPU(obj);
+    XtensaCPU *cpu = XTENSA_CPU(cs);
+    XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(obj);
     CPUXtensaState *env = &cpu->env;
     bool dfpu = xtensa_option_enabled(env->config,
                                       XTENSA_OPTION_DFP_COPROCESSOR);
@@ -127,7 +127,7 @@ static void xtensa_cpu_reset_hold(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     reset_mmu(env);
-    s->halted = env->runstall;
+    cs->halted = env->runstall;
 #endif
     set_no_signaling_nans(!dfpu, &env->fp_status);
     set_use_first_nan(!dfpu, &env->fp_status);
