diff --git a/cputlb.c b/cputlb.c
index a999d49..220e7f9 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -324,6 +324,9 @@
 {
     int mmu_idx, page_index, pd;
     void *p;
+#if !defined(TARGET_SPARC) && !defined(TARGET_MIPS)
+    CPUState *cpu = ENV_GET_CPU(env1);
+#endif
 
     page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     mmu_idx = cpu_mmu_index(env1);
@@ -336,7 +339,8 @@
 #if defined(TARGET_SPARC) || defined(TARGET_MIPS)
         cpu_unassigned_access(env1, addr, 0, 1, 0, 4);
 #else
-        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x" TARGET_FMT_lx "\n", addr);
+        cpu_abort(cpu, "Trying to execute code outside RAM or ROM at 0x"
+                  TARGET_FMT_lx "\n", addr);
 #endif
     }
     p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
diff --git a/exec.c b/exec.c
index ef45e00..83c28d1 100644
--- a/exec.c
+++ b/exec.c
@@ -468,10 +468,8 @@
     cpu_unlink_tb(cpu->env_ptr);
 }
 
-void cpu_abort(CPUArchState *env, const char *fmt, ...)
+void cpu_abort(CPUState *cpu, const char *fmt, ...)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     va_list ap;
     va_list ap2;
 
diff --git a/hw/android/goldfish/audio.c b/hw/android/goldfish/audio.c
index 9d15b8c..152a62c 100644
--- a/hw/android/goldfish/audio.c
+++ b/hw/android/goldfish/audio.c
@@ -419,7 +419,7 @@
 	    return s->read_buffer_available;
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_audio_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
             return 0;
@@ -496,7 +496,7 @@
             break;
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_audio_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/android/goldfish/battery.c b/hw/android/goldfish/battery.c
index 796d5dc..f9c83af 100644
--- a/hw/android/goldfish/battery.c
+++ b/hw/android/goldfish/battery.c
@@ -118,7 +118,7 @@
 		    return s->capacity;
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_battery_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
             return 0;
@@ -138,7 +138,7 @@
             break;
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_audio_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/android/goldfish/device.c b/hw/android/goldfish/device.c
index 3b11a14..23925ee 100644
--- a/hw/android/goldfish/device.c
+++ b/hw/android/goldfish/device.c
@@ -54,10 +54,13 @@
 
 void goldfish_device_set_irq(struct goldfish_device *dev, int irq, int level)
 {
-    if(irq >= dev->irq_count)
-        cpu_abort (cpu_single_env, "goldfish_device_set_irq: Bad irq %d >= %d\n", irq, dev->irq_count);
-    else
+    if(irq >= dev->irq_count) {
+        cpu_abort(current_cpu,
+                  "goldfish_device_set_irq: Bad irq %d >= %d\n",
+                  irq, dev->irq_count);
+    } else {
         qemu_set_irq(goldfish_pic[dev->irq + irq], level);
+    }
 }
 
 int goldfish_add_device_no_io(struct goldfish_device *dev)
@@ -143,7 +146,7 @@
         case PDEV_BUS_IRQ_COUNT:
             return s->current ? s->current->irq_count : 0;
     default:
-        cpu_abort(cpu_single_env,
+        cpu_abort(current_cpu,
                   "goldfish_bus_read: Bad offset %" HWADDR_PRIx "\n",
                   offset);
         return 0;
@@ -172,7 +175,7 @@
                     goldfish_bus_op_init(s);
                     break;
                 default:
-                    cpu_abort(cpu_single_env,
+                    cpu_abort(current_cpu,
                               "goldfish_bus_write: Bad PDEV_BUS_OP value %x\n",
                               value);
             };
@@ -188,7 +191,7 @@
             goldfish_64bit_guest = 1;
             break;
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_bus_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/android/goldfish/fb.c b/hw/android/goldfish/fb.c
index bbb392a..6d19ea2 100644
--- a/hw/android/goldfish/fb.c
+++ b/hw/android/goldfish/fb.c
@@ -578,7 +578,7 @@
             return goldfish_fb_get_pixel_format(s);
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_fb_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
             return 0;
@@ -622,7 +622,7 @@
             s->need_update = 1;
             break;
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_fb_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/android/goldfish/interrupt.c b/hw/android/goldfish/interrupt.c
index 5b60151..db5a0ac 100644
--- a/hw/android/goldfish/interrupt.c
+++ b/hw/android/goldfish/interrupt.c
@@ -114,7 +114,7 @@
         return 0;
     }
     default:
-        cpu_abort(cpu_single_env,
+        cpu_abort(current_cpu,
                   "goldfish_int_read: Bad offset %" HWADDR_PRIx "\n",
                   offset);
         return 0;
@@ -148,7 +148,7 @@
             break;
 
     default:
-        cpu_abort(cpu_single_env,
+        cpu_abort(current_cpu,
                   "goldfish_int_write: Bad offset %" HWADDR_PRIx "\n",
                   offset);
         return;
diff --git a/hw/android/goldfish/mmc.c b/hw/android/goldfish/mmc.c
index aece344..547e42c 100644
--- a/hw/android/goldfish/mmc.c
+++ b/hw/android/goldfish/mmc.c
@@ -339,11 +339,11 @@
                 }
                 capacity -= 1;
                 if (exponent < 2) {
-                    cpu_abort(cpu_single_env, "SDCard too small, must be at least 9MB\n");
+                    cpu_abort(current_cpu, "SDCard too small, must be at least 9MB\n");
                 }
                 exponent -= 2;
                 if (exponent > 7) {
-                    cpu_abort(cpu_single_env, "SDCard too large.\n");
+                    cpu_abort(current_cpu, "SDCard too large.\n");
                 }
 
                 s->resp[2] |= (((uint32_t)capacity >> 2) & 0x3FF);  // high 10 bits to bottom of resp[2]
@@ -488,7 +488,7 @@
             return ret;
         }
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_mmc_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
             return 0;
@@ -540,7 +540,7 @@
             break;
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_mmc_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/android/goldfish/nand.c b/hw/android/goldfish/nand.c
index 47c5ffb..e964d23 100644
--- a/hw/android/goldfish/nand.c
+++ b/hw/android/goldfish/nand.c
@@ -549,7 +549,7 @@
             return 0;
         return 0;
     default:
-        cpu_abort(cpu_single_env, "nand_dev_do_cmd: Bad command %x\n", cmd);
+        cpu_abort(current_cpu, "nand_dev_do_cmd: Bad command %x\n", cmd);
         return 0;
     }
 }
@@ -563,7 +563,7 @@
     case NAND_DEV:
         s->dev = value;
         if(s->dev >= nand_dev_count) {
-            cpu_abort(cpu_single_env, "nand_dev_write: Bad dev %x\n", value);
+            cpu_abort(current_cpu, "nand_dev_write: Bad dev %x\n", value);
         }
         break;
     case NAND_ADDR_HIGH:
@@ -604,7 +604,7 @@
         }
         break;
     default:
-        cpu_abort(cpu_single_env,
+        cpu_abort(current_cpu,
                   "nand_dev_write: Bad offset %" HWADDR_PRIx "\n",
                   offset);
         break;
@@ -654,7 +654,7 @@
         return (uint32_t)(dev->max_size >> 32);
 
     default:
-        cpu_abort(cpu_single_env,
+        cpu_abort(current_cpu,
                   "nand_dev_read: Bad offset %" HWADDR_PRIx "\n",
                   offset);
         return 0;
diff --git a/hw/android/goldfish/timer.c b/hw/android/goldfish/timer.c
index d4dd5f8..9daf65d 100644
--- a/hw/android/goldfish/timer.c
+++ b/hw/android/goldfish/timer.c
@@ -84,7 +84,7 @@
         case TIMER_TIME_HIGH:
             return s->now_ns >> 32;
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_timer_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
             return 0;
@@ -118,7 +118,7 @@
             goldfish_device_set_irq(&s->dev, 0, 0);
             break;
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_timer_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
@@ -172,7 +172,7 @@
         case 0x4:
             return s->now >> 32;
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_rtc_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
             return 0;
@@ -193,7 +193,7 @@
             goldfish_device_set_irq(&s->dev, 0, 0);
             break;
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_rtc_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/android/goldfish/trace.c b/hw/android/goldfish/trace.c
index c6f31c9..e4bd9fa 100644
--- a/hw/android/goldfish/trace.c
+++ b/hw/android/goldfish/trace.c
@@ -229,7 +229,7 @@
 
     default:
         if (offset < 4096) {
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "trace_dev_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
         } else {
@@ -253,7 +253,7 @@
 
     default:
         if (offset < 4096) {
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "trace_dev_read: Bad offset %" HWADDR_PRIx "\n",
                       offset);
         } else {
diff --git a/hw/android/goldfish/tty.c b/hw/android/goldfish/tty.c
index 27c9c70..561b425 100644
--- a/hw/android/goldfish/tty.c
+++ b/hw/android/goldfish/tty.c
@@ -87,7 +87,7 @@
         case TTY_BYTES_READY:
             return s->data_count;
     default:
-        cpu_abort(cpu_single_env,
+        cpu_abort(current_cpu,
                   "goldfish_tty_read: Bad offset %" HWADDR_PRIx "\n",
                   offset);
         return 0;
@@ -150,7 +150,7 @@
 
                 case TTY_CMD_READ_BUFFER:
                     if(s->ptr_len > s->data_count)
-                        cpu_abort (cpu_single_env, "goldfish_tty_write: reading more data than available %d %d\n", s->ptr_len, s->data_count);
+                        cpu_abort(current_cpu, "goldfish_tty_write: reading more data than available %d %d\n", s->ptr_len, s->data_count);
                     safe_memory_rw_debug(current_cpu, s->ptr, s->data, s->ptr_len,1);
                     //printf("goldfish_tty_write: read %d bytes to %llx\n", s->ptr_len, (unsigned long long)s->ptr);
                     if(s->data_count > s->ptr_len)
@@ -161,7 +161,7 @@
                     break;
 
                 default:
-                    cpu_abort (cpu_single_env, "goldfish_tty_write: Bad command %x\n", value);
+                    cpu_abort(current_cpu, "goldfish_tty_write: Bad command %x\n", value);
             };
             break;
 
@@ -178,7 +178,7 @@
             break;
 
         default:
-            cpu_abort(cpu_single_env,
+            cpu_abort(current_cpu,
                       "goldfish_tty_write: Bad offset %" HWADDR_PRIx "\n",
                       offset);
     }
diff --git a/hw/mips/mips_pic.c b/hw/mips/mips_pic.c
index bb54037..c1480c5 100644
--- a/hw/mips/mips_pic.c
+++ b/hw/mips/mips_pic.c
@@ -16,24 +16,25 @@
 
 static void mips_cpu_irq_handler(void *opaque, int irq, int level)
 {
-    CPUOldState *env = (CPUOldState *)opaque;
+    CPUState *cs = opaque;
+    CPUArchState *env = cs->env_ptr;
     int causebit;
 
     if (irq < 0 || 7 < irq)
-        cpu_abort(env, "mips_pic_cpu_handler: Bad interrupt line %d\n",
+        cpu_abort(cs, "mips_pic_cpu_handler: Bad interrupt line %d\n",
                   irq);
 
     causebit = 0x00000100 << irq;
     if (level) {
         env->CP0_Cause |= causebit;
-        cpu_interrupt(ENV_GET_CPU(env), CPU_INTERRUPT_HARD);
+        cpu_interrupt(cs, CPU_INTERRUPT_HARD);
     } else {
         env->CP0_Cause &= ~causebit;
-        cpu_reset_interrupt(ENV_GET_CPU(env), CPU_INTERRUPT_HARD);
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
     }
 }
 
-qemu_irq *mips_cpu_irq_init(CPUOldState *env)
+qemu_irq *mips_cpu_irq_init(CPUArchState *env)
 {
-    return qemu_allocate_irqs(mips_cpu_irq_handler, env, 8);
+    return qemu_allocate_irqs(mips_cpu_irq_handler, ENV_GET_CPU(env), 8);
 }
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 1a7b2ab..63492fa 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -361,9 +361,6 @@
 int page_check_range(target_ulong start, target_ulong len, int flags);
 #endif
 
-void QEMU_NORETURN cpu_abort(CPUArchState *env, const char *fmt, ...)
-    GCC_FMT_ATTR(2, 3);
-
 /* Flags for use in ENV->INTERRUPT_PENDING.
 
    The numbers assigned here are non-sequential in order to preserve
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index dcab7d4..ea5a370 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -21,6 +21,7 @@
 #define QEMU_CPU_H
 
 #include <signal.h>
+#include <setjmp.h>
 #include "hw/qdev-core.h"
 #include "exec/hwaddr.h"
 #include "qemu/queue.h"
@@ -28,7 +29,8 @@
 #include "qemu/tls.h"
 #include "qemu/typedefs.h"
 
-typedef int (*WriteCoreDumpFunction)(void *buf, size_t size, void *opaque);
+typedef int (*WriteCoreDumpFunction)(const void *buf, size_t size,
+                                     void *opaque);
 
 /**
  * vaddr:
@@ -42,6 +44,12 @@
 #define VADDR_PRIX PRIX64
 #define VADDR_MAX UINT64_MAX
 
+/* Since this macro is used a lot in hot code paths and in conjunction with
+ * FooCPU *foo_env_get_cpu(), we deviate from usual QOM practice by using
+ * an unchecked cast.
+ */
+#define CPU(obj) ((CPUState *)(obj))
+
 typedef struct CPUState CPUState;
 
 typedef void (*CPUUnassignedAccess)(CPUState *cpu, hwaddr addr,
@@ -50,6 +58,9 @@
 
 struct TranslationBlock;
 
+struct KVMState;
+struct kvm_run;
+
 // TODO(digit): Make this a proper QOM object that inherits from
 // DeviceState/DeviceClass.
 struct CPUState {
@@ -60,7 +71,7 @@
     struct QemuThread *thread;
 
     uint32_t host_tid; /* host thread ID */
-    int running; /* Nonzero if cpu is currently running(usermode).  */
+    bool running;
     struct QemuCond *halt_cond;
     struct qemu_work_item *queued_work_first, *queued_work_last;
 
@@ -80,7 +91,7 @@
     const char *cpu_model_str;
 
     int kvm_fd;
-    int kvm_vcpu_dirty;
+    bool kvm_vcpu_dirty;
     struct KVMState *kvm_state;
     struct kvm_run *kvm_run;
 
@@ -91,8 +102,6 @@
     uint32_t halted; /* used by alpha, cris, ppc TCG */
 };
 
-#define CPU(obj)  ((CPUState*)(obj))
-
 QTAILQ_HEAD(CPUTailQ, CPUState);
 extern struct CPUTailQ cpus;
 #define CPU_NEXT(cpu) QTAILQ_NEXT(cpu, node)
@@ -263,4 +272,7 @@
  */
 void cpu_single_step(CPUState *cpu, int enabled);
 
+void QEMU_NORETURN cpu_abort(CPUState *cpu, const char *fmt, ...)
+    GCC_FMT_ATTR(2, 3);
+
 #endif  // QEMU_CPU_H
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 9357ca4..6cbea7c 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -283,7 +283,7 @@
         env->cp15.c1_sys = 0x00000070;
         break;
     default:
-        cpu_abort(env, "Bad CPU ID: %x\n", id);
+        cpu_abort(ENV_GET_CPU(env), "Bad CPU ID: %x\n", id);
         break;
     }
 
@@ -640,41 +640,56 @@
 /* These should probably raise undefined insn exceptions.  */
 void HELPER(set_cp15)(CPUARMState *env, uint32_t insn, uint32_t val)
 {
-    cpu_abort(env, "cp15 insn %08x\n", insn);
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    cpu_abort(CPU(cpu), "cp15 insn %08x\n", insn);
 }
 
 uint32_t HELPER(get_cp15)(CPUARMState *env, uint32_t insn)
 {
-    cpu_abort(env, "cp15 insn %08x\n", insn);
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    cpu_abort(CPU(cpu), "cp15 insn %08x\n", insn);
     return 0;
 }
 
 /* These should probably raise undefined insn exceptions.  */
 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
 {
-    cpu_abort(env, "v7m_mrs %d\n", reg);
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
 }
 
 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
 {
-    cpu_abort(env, "v7m_mrs %d\n", reg);
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
     return 0;
 }
 
 void switch_mode(CPUARMState *env, int mode)
 {
-    if (mode != ARM_CPU_MODE_USR)
-        cpu_abort(env, "Tried to switch out of user mode\n");
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    if (mode != ARM_CPU_MODE_USR) {
+        cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
+    }
 }
 
 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
 {
-    cpu_abort(env, "banked r13 write\n");
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    cpu_abort(CPU(cpu), "banked r13 write\n");
 }
 
 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
 {
-    cpu_abort(env, "banked r13 read\n");
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
+    cpu_abort(CPU(cpu), "banked r13 read\n");
     return 0;
 }
 
@@ -683,7 +698,7 @@
 extern int semihosting_enabled;
 
 /* Map CPU modes onto saved register banks.  */
-static inline int bank_number (CPUARMState *env, int mode)
+int bank_number(int mode)
 {
     switch (mode) {
     case ARM_CPU_MODE_USR:
@@ -700,8 +715,7 @@
     case ARM_CPU_MODE_FIQ:
         return 5;
     }
-    cpu_abort(env, "Bad mode %x\n", mode);
-    return -1;
+    hw_error("bank number requested for bad CPSR mode value 0x%x\n", mode);
 }
 
 void switch_mode(CPUARMState *env, int mode)
@@ -721,12 +735,12 @@
         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
     }
 
-    i = bank_number(env, old_mode);
+    i = bank_number(old_mode);
     env->banked_r13[i] = env->regs[13];
     env->banked_r14[i] = env->regs[14];
     env->banked_spsr[i] = env->spsr;
 
-    i = bank_number(env, mode);
+    i = bank_number(mode);
     env->regs[13] = env->banked_r13[i];
     env->regs[14] = env->banked_r14[i];
     env->spsr = env->banked_spsr[i];
@@ -791,6 +805,7 @@
 
 static void do_interrupt_v7m(CPUARMState *env)
 {
+    CPUState *cs = CPU(arm_env_get_cpu(env));
     uint32_t xpsr = xpsr_read(env);
     uint32_t lr;
     uint32_t addr;
@@ -836,7 +851,7 @@
         do_v7m_exception_exit(env);
         return;
     default:
-        cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
+        cpu_abort(cs, "Unhandled exception 0x%x\n", env->exception_index);
         return; /* Never happens.  Keep compiler happy.  */
     }
 
@@ -867,6 +882,7 @@
 /* Handle a CPU exception.  */
 void do_interrupt(CPUARMState *env)
 {
+    CPUState *cs = CPU(arm_env_get_cpu(env));
     uint32_t addr;
     uint32_t mask;
     int new_mode;
@@ -949,7 +965,7 @@
         offset = 4;
         break;
     default:
-        cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
+        cpu_abort(cs, "Unhandled exception 0x%x\n", env->exception_index);
         return; /* Never happens.  Keep compiler happy.  */
     }
     if (arm_feature(env, ARM_FEATURE_TRUSTZONE)) {
@@ -1860,7 +1876,7 @@
     return;
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
+    cpu_abort(ENV_GET_CPU(env), "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
               (insn >> 16) & 0xf, crm, op1, op2);
 }
 
@@ -2245,7 +2261,7 @@
     }
 bad_reg:
     /* ??? For debugging only.  Should raise illegal instruction exception.  */
-    cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
+    cpu_abort(ENV_GET_CPU(env), "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
               (insn >> 16) & 0xf, crm, op1, op2);
     return 0;
 }
@@ -2255,7 +2271,7 @@
     if ((env->uncached_cpsr & CPSR_M) == mode) {
         env->regs[13] = val;
     } else {
-    env->banked_r13[bank_number(env, mode)] = val;
+        env->banked_r13[bank_number(mode)] = val;
 }
 }
 
@@ -2264,12 +2280,13 @@
     if ((env->uncached_cpsr & CPSR_M) == mode) {
         return env->regs[13];
     } else {
-    return env->banked_r13[bank_number(env, mode)];
+        return env->banked_r13[bank_number(mode)];
     }
 }
 
 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
 {
+    ARMCPU *cpu = arm_env_get_cpu(env);
     switch (reg) {
     case 0: /* APSR */
         return xpsr_read(env) & 0xf8000000;
@@ -2300,13 +2317,14 @@
         return env->v7m.control;
     default:
         /* ??? For debugging only.  */
-        cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
+        cpu_abort(CPU(cpu), "Unimplemented system register read (%d)\n", reg);
         return 0;
     }
 }
 
 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
 {
+    ARMCPU *cpu = arm_env_get_cpu(env);
     switch (reg) {
     case 0: /* APSR */
         xpsr_write(env, val, 0xf8000000);
@@ -2367,7 +2385,7 @@
         break;
     default:
         /* ??? For debugging only.  */
-        cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
+        cpu_abort(CPU(cpu), "Unimplemented system register write (%d)\n", reg);
         return;
     }
 }
@@ -2376,8 +2394,10 @@
                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
                 void *opaque)
 {
+    ARMCPU *cpu = arm_env_get_cpu(env);
+
     if (cpnum < 0 || cpnum > 14) {
-        cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
+        cpu_abort(CPU(cpu), "Bad coprocessor number: %i\n", cpnum);
         return;
     }
 
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 8e2976f..a878df5 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -9797,6 +9797,7 @@
                                                   TranslationBlock *tb,
                                                   int search_pc)
 {
+    CPUState *cs = ENV_GET_CPU(env);
     DisasContext dc1, *dc = &dc1;
     CPUBreakpoint *bp;
     uint16_t *gen_opc_end;
@@ -9815,7 +9816,7 @@
 
     dc->is_jmp = DISAS_NEXT;
     dc->pc = pc_start;
-    dc->singlestep_enabled = ENV_GET_CPU(env)->singlestep_enabled;
+    dc->singlestep_enabled = cs->singlestep_enabled;
     dc->condjmp = 0;
     dc->thumb = ARM_TBFLAG_THUMB(tb->flags);
     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
@@ -9976,7 +9977,7 @@
         if (dc->condjmp) {
             /* FIXME:  This can theoretically happen with self-modifying
                code.  */
-            cpu_abort(env, "IO on conditional branch instruction");
+            cpu_abort(cs, "IO on conditional branch instruction");
         }
         gen_io_end();
     }
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index 1795e69..e8a4345 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -95,6 +95,7 @@
 static inline void get_ss_esp_from_tss(CPUX86State *env, uint32_t *ss_ptr,
                                        uint32_t *esp_ptr, int dpl)
 {
+    X86CPU *cpu = x86_env_get_cpu(env);
     int type, index, shift;
 
 #if 0
@@ -112,11 +113,11 @@
 #endif
 
     if (!(env->tr.flags & DESC_P_MASK)) {
-        cpu_abort(env, "invalid tss");
+        cpu_abort(CPU(cpu), "invalid tss");
     }
     type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf;
     if ((type & 7) != 1) {
-        cpu_abort(env, "invalid tss type");
+        cpu_abort(CPU(cpu), "invalid tss type");
     }
     shift = type >> 3;
     index = (dpl * 4 + 2) << shift;
@@ -774,6 +775,7 @@
 
 static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level)
 {
+    X86CPU *cpu = x86_env_get_cpu(env);
     int index;
 
 #if 0
@@ -782,7 +784,7 @@
 #endif
 
     if (!(env->tr.flags & DESC_P_MASK)) {
-        cpu_abort(env, "invalid tss");
+        cpu_abort(CPU(cpu), "invalid tss");
     }
     index = 8 * level + 4;
     if ((index + 7) > env->tr.limit) {
diff --git a/target-mips/helper.c b/target-mips/helper.c
index b078991..dc353b2 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -292,6 +292,8 @@
 
 static inline target_ulong cpu_mips_get_pgd(CPUMIPSState *env)
 {
+    MIPSCPU *cpu = mips_env_get_cpu(env);
+
     if (unlikely(linux_pte_info.pgd_current_p == 0)) {
         int i;
         uint32_t lui_ins, lw_ins, srl_ins;
@@ -341,7 +343,7 @@
                 printf("TLBMiss handler dump:\n");
             for (i = 0; i < 0x80; i+= 4)
                 printf("0x%08x: 0x%08x\n", ebase + i, ldl_phys(ebase + i));
-            cpu_abort(env, "TLBMiss handler signature not recognised\n");
+            cpu_abort(CPU(cpu), "TLBMiss handler signature not recognised\n");
         }
 
         address = (lui_ins & 0xffff) << 16;
@@ -351,7 +353,7 @@
         else if (address >= 0xa0000000 && address <= 0xc0000000)
             address -= 0xa0000000;
         else
-            cpu_abort(env, "pgd_current_p not in KSEG0/KSEG1\n");
+            cpu_abort(CPU(cpu), "pgd_current_p not in KSEG0/KSEG1\n");
 
         linux_pte_info.pgd_current_p = address;
         linux_pte_info.softshift = (srl_ins >> 6) & 0x1f;
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 66c2cab..8a252f8 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -1205,6 +1205,7 @@
 
 void helper_mtc0_status(CPUMIPSState *env, target_ulong arg1)
 {
+    MIPSCPU *cpu = mips_env_get_cpu(env);
     uint32_t val, old;
     uint32_t mask = env->CP0_Status_rw_bitmask;
 
@@ -1226,7 +1227,9 @@
         case MIPS_HFLAG_UM: qemu_log(", UM\n"); break;
         case MIPS_HFLAG_SM: qemu_log(", SM\n"); break;
         case MIPS_HFLAG_KM: qemu_log("\n"); break;
-        default: cpu_abort(env, "Invalid MMU mode!\n"); break;
+        default:
+            cpu_abort(CPU(cpu), "Invalid MMU mode!\n");
+            break;
         }
     }
     cpu_mips_update_irq(env);
@@ -1802,6 +1805,7 @@
 
 static void debug_post_eret(CPUMIPSState *env)
 {
+    MIPSCPU *cpu = mips_env_get_cpu(env);
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         qemu_log("  =>  PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx,
                 env->active_tc.PC, env->CP0_EPC);
@@ -1813,7 +1817,9 @@
         case MIPS_HFLAG_UM: qemu_log(", UM\n"); break;
         case MIPS_HFLAG_SM: qemu_log(", SM\n"); break;
         case MIPS_HFLAG_KM: qemu_log("\n"); break;
-        default: cpu_abort(env, "Invalid MMU mode!\n"); break;
+        default:
+            cpu_abort(CPU(cpu), "Invalid MMU mode!\n");
+            break;
         }
     }
 }
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index fd4ecc4..f3a10c0 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -495,6 +495,7 @@
 
 static void mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
+    MIPSCPU *cpu = mips_env_get_cpu(env);
     env->tlb = g_malloc0(sizeof(CPUMIPSTLBContext));
 
     switch (def->mmu_type) {
@@ -511,7 +512,7 @@
         case MMU_TYPE_R6000:
         case MMU_TYPE_R8000:
         default:
-            cpu_abort(env, "MMU type not supported\n");
+            cpu_abort(CPU(cpu), "MMU type not supported\n");
     }
 }
 #endif /* CONFIG_USER_ONLY */
diff --git a/translate-all.c b/translate-all.c
index 351d949..d6c5d37 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -726,7 +726,7 @@
 /* XXX: tb_flush is currently not thread safe */
 void tb_flush(CPUArchState *env1)
 {
-    CPUState *cpu;
+    CPUState *cpu = ENV_GET_CPU(env1);
 #if defined(DEBUG_FLUSH)
     printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
            (unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer),
@@ -736,7 +736,7 @@
 #endif
     if ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)
         > tcg_ctx.code_gen_buffer_size) {
-        cpu_abort(env1, "Internal error: code buffer overflow\n");
+        cpu_abort(cpu, "Internal error: code buffer overflow\n");
     }
     tcg_ctx.tb_ctx.nb_tbs = 0;
 
@@ -1408,11 +1408,12 @@
 
 void tb_check_watchpoint(CPUArchState *env)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     TranslationBlock *tb;
 
     tb = tb_find_pc(env->mem_io_pc);
     if (!tb) {
-        cpu_abort(env, "check_watchpoint: could not find TB for pc=%p",
+        cpu_abort(cpu, "check_watchpoint: could not find TB for pc=%p",
                   (void *)env->mem_io_pc);
     }
     cpu_restore_state_from_tb(tb, env, env->mem_io_pc);
@@ -1442,7 +1443,7 @@
         env->icount_decr.u16.high = 0xffff;
         if (!can_do_io(env)
             && (mask & ~old_mask) != 0) {
-            cpu_abort(env, "Raised interrupt while not in I/O function");
+            cpu_abort(cpu, "Raised interrupt while not in I/O function");
         }
     } else {
         // cpu->tcg_exit_req = 1;
@@ -1499,6 +1500,7 @@
    must be at the end of the TB */
 void cpu_io_recompile(CPUArchState *env, uintptr_t retaddr)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     TranslationBlock *tb;
     uint32_t n, cflags;
     target_ulong pc, cs_base;
@@ -1506,7 +1508,7 @@
 
     tb = tb_find_pc(retaddr);
     if (!tb) {
-        cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
+        cpu_abort(cpu, "cpu_io_recompile: could not find TB for pc=%p",
                   (void *)retaddr);
     }
     n = env->icount_decr.u16.low + tb->icount;
@@ -1536,7 +1538,7 @@
 #endif
     /* This should never happen.  */
     if (n > CF_COUNT_MASK) {
-        cpu_abort(env, "TB too big during recompile");
+        cpu_abort(cpu, "TB too big during recompile");
     }
 
     cflags = n | CF_LAST_IO;