diff --git a/cpu-exec.c b/cpu-exec.c
index af9bdc9..b026154 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -48,9 +48,8 @@
     return cpu_has_work(cpu);
 }
 
-void cpu_loop_exit(CPUArchState* env)
+void cpu_loop_exit(CPUState* cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     cpu->current_tb = NULL;
     siglongjmp(cpu->jmp_env, 1);
 }
@@ -59,9 +58,8 @@
    restored in a state compatible with the CPU emulator
  */
 #if defined(CONFIG_SOFTMMU)
-void cpu_resume_from_signal(CPUArchState *env, void *puc)
+void cpu_resume_from_signal(CPUState *cpu, void *puc)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
 
     /* XXX: restore cpu registers saved in host registers */
     cpu->exception_index = -1;
@@ -71,7 +69,8 @@
 
 /* Execute the code without caching the generated code. An interpreter
    could be used if available. */
-static void cpu_exec_nocache(CPUArchState *env, int max_cycles, TranslationBlock *orig_tb)
+static void cpu_exec_nocache(CPUArchState *env, int max_cycles,
+                             TranslationBlock *orig_tb)
 {
     CPUState *cpu = ENV_GET_CPU(env);
     tcg_target_ulong next_tb;
@@ -82,7 +81,7 @@
     if (max_cycles > CF_COUNT_MASK)
         max_cycles = CF_COUNT_MASK;
 
-    tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
+    tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
                      max_cycles);
     cpu->current_tb = tb;
     /* execute the generated code */
@@ -140,7 +139,7 @@
     }
  not_found:
    /* if no translated code available, then translate it now */
-    tb = tb_gen_code(env, pc, cs_base, flags, 0);
+    tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
 
  found:
     /* Move the last found TB to the head of the list */
@@ -323,7 +322,7 @@
                     if (interrupt_request & CPU_INTERRUPT_DEBUG) {
                         cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
                         cpu->exception_index = EXCP_DEBUG;
-                        cpu_loop_exit(env);
+                        cpu_loop_exit(cpu);
                     }
 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
     defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) || \
@@ -332,7 +331,7 @@
                         cpu->interrupt_request &= ~CPU_INTERRUPT_HALT;
                         cpu->halted = 1;
                         cpu->exception_index = EXCP_HLT;
-                        cpu_loop_exit(env);
+                        cpu_loop_exit(cpu);
                     }
 #endif
 #if defined(TARGET_I386)
@@ -340,7 +339,7 @@
                             svm_check_intercept(env, SVM_EXIT_INIT);
                             do_cpu_init(env);
                             cpu->exception_index = EXCP_HALTED;
-                            cpu_loop_exit(env);
+                            cpu_loop_exit(cpu);
                     } else if (interrupt_request & CPU_INTERRUPT_SIPI) {
                             do_cpu_sipi(env);
                     } else if (env->hflags2 & HF2_GIF_MASK) {
@@ -586,7 +585,7 @@
                 if (unlikely(cpu->exit_request)) {
                     cpu->exit_request = 0;
                     cpu->exception_index = EXCP_INTERRUPT;
-                    cpu_loop_exit(env);
+                    cpu_loop_exit(cpu);
                 }
 #if defined(DEBUG_DISAS) || defined(CONFIG_DEBUG_EXEC)
                 if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
@@ -666,14 +665,14 @@
                             }
                             cpu->exception_index = EXCP_INTERRUPT;
                             next_tb = 0;
-                            cpu_loop_exit(env);
+                            cpu_loop_exit(cpu);
                         }
                     }
                 }
                 cpu->current_tb = NULL;
 #ifdef CONFIG_HAX
                 if (hax_enabled() && hax_stop_emulation(cpu))
-                    cpu_loop_exit(env);
+                    cpu_loop_exit(cpu);
 #endif
                 /* reset soft MMU for next block (it can currently
                    only be set by a memory fault) */
diff --git a/exec.c b/exec.c
index 7976fda..558cb41 100644
--- a/exec.c
+++ b/exec.c
@@ -448,9 +448,8 @@
     cpu_set_log(loglevel);
 }
 
-void cpu_unlink_tb(CPUArchState *env)
+void cpu_unlink_tb(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     /* FIXME: TB unchaining isn't SMP safe.  For now just ignore the
        problem and hope the cpu will stop of its own accord.  For userspace
        emulation this often isn't actually as bad as it sounds.  Often
@@ -477,7 +476,7 @@
 void cpu_exit(CPUState *cpu)
 {
     cpu->exit_request = 1;
-    cpu_unlink_tb(cpu->env_ptr);
+    cpu_unlink_tb(cpu);
 }
 
 void cpu_abort(CPUState *cpu, const char *fmt, ...)
@@ -1556,14 +1555,14 @@
             wp->flags |= BP_WATCHPOINT_HIT;
             if (!cpu->watchpoint_hit) {
                 cpu->watchpoint_hit = wp;
-                tb_check_watchpoint(env);
+                tb_check_watchpoint(cpu);
                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                     cpu->exception_index = EXCP_DEBUG;
-                    cpu_loop_exit(env);
+                    cpu_loop_exit(cpu);
                 } else {
                     cpu_get_tb_cpu_state(env, &pc, &cs_base, &cpu_flags);
-                    tb_gen_code(env, pc, cs_base, cpu_flags, 1);
-                    cpu_resume_from_signal(env, NULL);
+                    tb_gen_code(cpu, pc, cs_base, cpu_flags, 1);
+                    cpu_resume_from_signal(cpu, NULL);
                 }
             }
         } else {
diff --git a/hw/android/goldfish/trace.c b/hw/android/goldfish/trace.c
index 4140186..1fca88a 100644
--- a/hw/android/goldfish/trace.c
+++ b/hw/android/goldfish/trace.c
@@ -39,7 +39,7 @@
 // TODO(digit): Re-enable tracing some day?
 #define tracing 0
 
-extern void cpu_loop_exit(CPUArchState* env);
+extern void cpu_loop_exit(CPUState* cpu);
 
 extern const char *trace_filename;
 
@@ -201,7 +201,7 @@
         current_cpu->exception_index = EXCP_HLT;
         current_cpu->halted = 1;
         qemu_system_shutdown_request();
-        cpu_loop_exit(cpu_single_env);
+        cpu_loop_exit(current_cpu);
         break;
 
     case TRACE_DEV_REG_ENABLE:          // tracing enable: 0 = stop, 1 = start
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 416d7cd..9b83c0c 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -84,15 +84,16 @@
 void tcg_exec_init(unsigned long tb_size);
 int cpu_gen_code(CPUArchState *env, struct TranslationBlock *tb,
                  int *gen_code_size_ptr);
-bool cpu_restore_state(CPUArchState *env, uintptr_t searched_pc);
+bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
+void page_size_init(void);
 
-void QEMU_NORETURN cpu_resume_from_signal(CPUArchState *env1, void *puc);
-void QEMU_NORETURN cpu_io_recompile(CPUArchState *env, uintptr_t retaddr);
-TranslationBlock *tb_gen_code(CPUArchState *env, 
+void QEMU_NORETURN cpu_resume_from_signal(CPUState *cpu, void *puc);
+void QEMU_NORETURN cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
+TranslationBlock *tb_gen_code(CPUState *cpu,
                               target_ulong pc, target_ulong cs_base, int flags,
                               int cflags);
 void cpu_exec_init(CPUArchState *env);
-void QEMU_NORETURN cpu_loop_exit(CPUArchState *env1);
+void QEMU_NORETURN cpu_loop_exit(CPUState *cpu);
 int page_unprotect(target_ulong address, uintptr_t pc, void *puc);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
                                    int is_cpu_write_access);
@@ -349,8 +350,6 @@
 
 void phys_mem_set_alloc(void *(*alloc)(size_t));
 
-TranslationBlock *tb_find_pc(uintptr_t pc_ptr);
-
 uint64_t io_mem_read(int index, hwaddr addr, unsigned size);
 void io_mem_write(int index, hwaddr addr, uint64_t value, unsigned size);
 
diff --git a/include/exec/softmmu_template.h b/include/exec/softmmu_template.h
index 5f81c4d..9249486 100644
--- a/include/exec/softmmu_template.h
+++ b/include/exec/softmmu_template.h
@@ -123,7 +123,7 @@
     physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
     if (index > (IO_MEM_NOTDIRTY >> IO_MEM_SHIFT) && !cpu_can_do_io(cpu)) {
-        cpu_io_recompile(env, retaddr);
+        cpu_io_recompile(cpu, retaddr);
     }
 
     cpu->mem_io_vaddr = addr;
@@ -339,7 +339,7 @@
     physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
     if (index > (IO_MEM_NOTDIRTY >> IO_MEM_SHIFT)
             && !cpu_can_do_io(cpu)) {
-        cpu_io_recompile(env, retaddr);
+        cpu_io_recompile(cpu, retaddr);
     }
 
     cpu->mem_io_vaddr = addr;
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index dcfaba8..2537658 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -23,16 +23,14 @@
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 
-#if !defined(CONFIG_USER_ONLY)
 static void raise_exception(CPUARMState *env, int tt)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
 
     cs->exception_index = tt;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
-#endif
 
 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
                           uint32_t rn, uint32_t maxindex)
@@ -89,7 +87,7 @@
     if (unlikely(ret)) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         raise_exception(env, cs->exception_index);
     }
@@ -273,7 +271,7 @@
 
     cs->exception_index = EXCP_HLT;
     cs->halted = 1;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(exception)(CPUARMState *env, uint32_t excp)
@@ -281,7 +279,7 @@
     CPUState *cs = CPU(arm_env_get_cpu(env));
 
     cs->exception_index = excp;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 uint32_t HELPER(cpsr_read)(CPUARMState *env)
diff --git a/target-i386/excp_helper.c b/target-i386/excp_helper.c
index 0b2fbc9..7698ac4 100644
--- a/target-i386/excp_helper.c
+++ b/target-i386/excp_helper.c
@@ -106,7 +106,7 @@
     env->error_code = error_code;
     env->exception_is_int = is_int;
     env->exception_next_eip = env->eip + next_eip_addend;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 /* shortcuts to generate exceptions */
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 301e56d..f0de097 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1414,7 +1414,7 @@
 {
     target_ulong dr6;
     int reg, type;
-    int hit_enabled = 0;
+    bool hit_enabled = false;
 
     dr6 = env->dr[6] & ~0xf;
     for (reg = 0; reg < 4; reg++) {
@@ -1423,12 +1423,14 @@
             ((type & 1) && env->cpu_watchpoint[reg] &&
              (env->cpu_watchpoint[reg]->flags & BP_WATCHPOINT_HIT))) {
             dr6 |= 1 << reg;
-            if (hw_breakpoint_enabled(env->dr[7], reg))
-                hit_enabled = 1;
+            if (hw_breakpoint_enabled(env->dr[7], reg)) {
+                hit_enabled = true;
+            }
         }
     }
-    if (hit_enabled || force_dr6_update)
+    if (hit_enabled || force_dr6_update) {
         env->dr[6] = dr6;
+    }
     return hit_enabled;
 }
 
@@ -1440,17 +1442,17 @@
     if (cs->watchpoint_hit) {
         if (cs->watchpoint_hit->flags & BP_CPU) {
             cs->watchpoint_hit = NULL;
-            if (check_hw_breakpoints(env, 0)) {
+            if (check_hw_breakpoints(env, false)) {
                 raise_exception(env, EXCP01_DB);
             } else {
-                cpu_resume_from_signal(env, NULL);
+                cpu_resume_from_signal(cs, NULL);
             }
         }
     } else {
         QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == env->eip) {
                 if (bp->flags & BP_CPU) {
-                    check_hw_breakpoints(env, 1);
+                    check_hw_breakpoints(env, true);
                     raise_exception(env, EXCP01_DB);
                 }
                 break;
diff --git a/target-i386/mem_helper.c b/target-i386/mem_helper.c
index 0799b38..a21cf47 100644
--- a/target-i386/mem_helper.c
+++ b/target-i386/mem_helper.c
@@ -141,7 +141,7 @@
     if (ret) {
         if (retaddr) {
             /* now we have a real cpu fault */
-            cpu_restore_state(env, retaddr);
+            cpu_restore_state(cs, retaddr);
         }
         raise_exception_err(env, cs->exception_index, env->error_code);
     }
diff --git a/target-i386/misc_helper.c b/target-i386/misc_helper.c
index fea8e78..4825e3a 100644
--- a/target-i386/misc_helper.c
+++ b/target-i386/misc_helper.c
@@ -554,7 +554,7 @@
     env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
     cs->halted = 1;
     cs->exception_index = EXCP_HLT;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_hlt(CPUX86State *env, int next_eip_addend)
@@ -603,5 +603,5 @@
     CPUState *cs = CPU(x86_env_get_cpu(env));
 
     cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index e7f314f..f5221ef 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -931,7 +931,7 @@
 {
     env->exception_index = EXCP_SYSCALL;
     env->exception_next_eip = env->eip + next_eip_addend;
-    cpu_loop_exit(env);
+    cpu_loop_exit(ENV_GET_CPU(env));
 }
 #else
 void helper_syscall(CPUX86State *env, int next_eip_addend)
diff --git a/target-i386/svm_helper.c b/target-i386/svm_helper.c
index b6ac3cc..b5e177e 100644
--- a/target-i386/svm_helper.c
+++ b/target-i386/svm_helper.c
@@ -260,7 +260,7 @@
                 env->exception_is_int = 0;
             env->exception_next_eip = env->eip;
                 qemu_log_mask(CPU_LOG_TB_IN_ASM, "NMI");
-                cpu_loop_exit(env);
+            cpu_loop_exit(cs);
                 break;
         case SVM_EVTINJ_TYPE_EXEPT:
             cs->exception_index = vector;
@@ -268,7 +268,7 @@
                 env->exception_is_int = 0;
                 env->exception_next_eip = -1;
                 qemu_log_mask(CPU_LOG_TB_IN_ASM, "EXEPT");
-                cpu_loop_exit(env);
+            cpu_loop_exit(cs);
                 break;
         case SVM_EVTINJ_TYPE_SOFT:
             cs->exception_index = vector;
@@ -276,7 +276,7 @@
                 env->exception_is_int = 1;
             env->exception_next_eip = env->eip;
                 qemu_log_mask(CPU_LOG_TB_IN_ASM, "SOFT");
-                cpu_loop_exit(env);
+            cpu_loop_exit(cs);
                 break;
         }
         qemu_log_mask(CPU_LOG_TB_IN_ASM, " %#x %#x\n", cs->exception_index,
@@ -620,14 +620,14 @@
 
     /* If the host's rIP reloaded by #VMEXIT is outside the limit of the
        host's code segment or non-canonical (in the case of long mode), a
-       #GP fault is delivered inside the host.) */
+       #GP fault is delivered inside the host. */
 
     /* remove any pending exception */
     cs->exception_index = -1;
     env->error_code = 0;
     env->old_exception = -1;
 
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 #endif
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 470af8a..3321b3e 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -82,8 +82,10 @@
 /*****************************************************************************/
 /* Exceptions processing helpers */
 
-void helper_raise_exception_err (CPUMIPSState *env,
-                                 uint32_t exception, int error_code)
+static inline void QEMU_NORETURN do_raise_exception_err(CPUMIPSState *env,
+                                                        uint32_t exception,
+                                                        int error_code,
+                                                        uintptr_t pc)
 {
     CPUState *cs = CPU(mips_env_get_cpu(env));
 
@@ -92,12 +94,30 @@
     }
     cs->exception_index = exception;
     env->error_code = error_code;
-    cpu_loop_exit(env);
+    if (pc) {
+        /* now we have a real cpu fault */
+        cpu_restore_state(cs, pc);
+    }
+    cpu_loop_exit(cs);
 }
 
-void helper_raise_exception (CPUMIPSState *env, uint32_t exception)
+static inline void QEMU_NORETURN do_raise_exception(CPUMIPSState *env,
+                                                    uint32_t exception,
+                                                    uintptr_t pc)
 {
-    helper_raise_exception_err(env, exception, 0);
+    do_raise_exception_err(env, exception, 0, pc);
+}
+
+
+void helper_raise_exception_err(CPUMIPSState *env, uint32_t exception,
+                                int error_code)
+{
+    do_raise_exception_err(env, exception, error_code, 0);
+}
+
+void helper_raise_exception(CPUMIPSState *env, uint32_t exception)
+{
+    do_raise_exception(env, exception, 0);
 }
 
 void helper_interrupt_restart (CPUMIPSState *env)
@@ -112,18 +132,6 @@
     }
 }
 
-#if !defined(CONFIG_USER_ONLY)
-static void do_restore_state (CPUMIPSState *env, uintptr_t pc)
-{
-    TranslationBlock *tb;
-
-    tb = tb_find_pc (pc);
-    if (tb) {
-        cpu_restore_state (env, pc);
-    }
-}
-#endif
-
 #if defined(CONFIG_USER_ONLY)
 #define HELPER_LD(name, insn, type)                                     \
 static inline type do_##name(CPUMIPSState *env, target_ulong addr,      \
@@ -362,7 +370,7 @@
     lladdr = cpu_mips_translate_address(env, address, rw);
 
     if (lladdr == (hwaddr)-1LL) {
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(mips_env_get_cpu(env)));
     } else {
         return lladdr;
     }
@@ -1956,29 +1964,19 @@
                                 int is_write, int is_user, uintptr_t retaddr)
 {
     env->CP0_BadVAddr = addr;
-    do_restore_state (env, retaddr);
-    helper_raise_exception(env, (is_write == 1) ? EXCP_AdES : EXCP_AdEL);
+    do_raise_exception(env, (is_write == 1) ? EXCP_AdES : EXCP_AdEL, retaddr);
 }
 
 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
                uintptr_t retaddr)
 {
     CPUMIPSState *env = cs->env_ptr;
-    TranslationBlock *tb;
     int ret;
 
     ret = cpu_mips_handle_mmu_fault(env, addr, is_write, mmu_idx);
     if (ret) {
-        if (retaddr) {
-            /* now we have a real cpu fault */
-            tb = tb_find_pc(retaddr);
-            if (tb) {
-                /* the PC is inside the translated code. It means that we have
-                   a virtual CPU fault */
-                cpu_restore_state(env, retaddr);
-            }
-        }
-        helper_raise_exception_err(env, cs->exception_index, env->error_code);
+        do_raise_exception_err(env, cs->exception_index,
+                               env->error_code, retaddr);
     }
 }
 
diff --git a/translate-all.c b/translate-all.c
index 78c643d..30a270d 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -76,12 +76,15 @@
 # define L1_MAP_ADDR_SPACE_BITS  TARGET_VIRT_ADDR_SPACE_BITS
 #endif
 
+/* Size of the L2 (and L3, etc) page tables.  */
+#define V_L2_BITS 10
+#define V_L2_SIZE (1 << V_L2_BITS)
 /* The bits remaining after N lower levels of page tables.  */
 #define V_L1_BITS_REM \
-    ((L1_MAP_ADDR_SPACE_BITS - TARGET_PAGE_BITS) % L2_BITS)
+    ((L1_MAP_ADDR_SPACE_BITS - TARGET_PAGE_BITS) % V_L2_BITS)
 
 #if V_L1_BITS_REM < 4
-#define V_L1_BITS  (V_L1_BITS_REM + L2_BITS)
+#define V_L1_BITS  (V_L1_BITS_REM + V_L2_BITS)
 #else
 #define V_L1_BITS  V_L1_BITS_REM
 #endif
@@ -122,6 +125,39 @@
 
 static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
                          tb_page_addr_t phys_page2);
+static TranslationBlock *tb_find_pc(uintptr_t tc_ptr);
+
+#ifdef CONFIG_ANDROID_MEMCHECK
+/* Gets guest PC for a given translated PC.
+ * Return:
+ *  Guest PC for a given translated PC, or NULL if there was no pair, matching
+ *  translated PC in tb's tpc2gpc array.
+ */
+target_ulong tb_guest_pc_from_host_pc(uintptr_t tb_pc)
+{
+    const TranslationBlock* tb = tb_find_pc(tb_pc);
+    if (!tb || !tb->tpc2gpc || !tb->tpc2gpc_pairs) {
+        return 0;
+    }
+    unsigned int m_min = 0;
+    unsigned int m_max = (tb->tpc2gpc_pairs - 1) << 1;
+    /* Make sure that tb_pc is within TB array. */
+    if (tb_pc < tb->tpc2gpc[0]) {
+        return 0;
+    }
+    while (m_min <= m_max) {
+        const unsigned int m = ((m_min + m_max) >> 1) & ~1;
+        if (tb_pc < tb->tpc2gpc[m]) {
+            m_max = m - 2;
+        } else if (m == m_max || tb_pc < tb->tpc2gpc[m + 2]) {
+            return tb->tpc2gpc[m + 1];
+        } else {
+            m_min = m + 2;
+        }
+    }
+    return tb->tpc2gpc[m_max + 1];
+}
+#endif  // CONFIG_ANDROID_MEMCHECK
 
 void cpu_gen_init(void)
 {
@@ -195,10 +231,10 @@
 
 /* The cpu state corresponding to 'searched_pc' is restored.
  */
-static int cpu_restore_state_from_tb(TranslationBlock *tb, CPUArchState *env,
+static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                      uintptr_t searched_pc)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUArchState *env = cpu->env_ptr;
     TCGContext *s = &tcg_ctx;
     int j;
     uintptr_t tc_ptr;
@@ -251,13 +287,13 @@
     return 0;
 }
 
-bool cpu_restore_state(CPUArchState *env, uintptr_t retaddr)
+bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
 {
     TranslationBlock *tb;
 
     tb = tb_find_pc(retaddr);
     if (tb) {
-        cpu_restore_state_from_tb(tb, env, retaddr);
+        cpu_restore_state_from_tb(cpu, tb, retaddr);
         return true;
     }
     return false;
@@ -288,17 +324,15 @@
 }
 #endif
 
-static void page_init(void)
+void page_size_init(void)
 {
     /* NOTE: we can always suppose that qemu_host_page_size >=
        TARGET_PAGE_SIZE */
 #ifdef _WIN32
-    {
-        SYSTEM_INFO system_info;
+    SYSTEM_INFO system_info;
 
-        GetSystemInfo(&system_info);
-        qemu_real_host_page_size = system_info.dwPageSize;
-    }
+    GetSystemInfo(&system_info);
+    qemu_real_host_page_size = system_info.dwPageSize;
 #else
     qemu_real_host_page_size = getpagesize();
 #endif
@@ -309,7 +343,11 @@
         qemu_host_page_size = TARGET_PAGE_SIZE;
     }
     qemu_host_page_mask = ~(qemu_host_page_size - 1);
+}
 
+static void page_init(void)
+{
+    page_size_init();
 #if defined(CONFIG_BSD) && defined(CONFIG_USER_ONLY)
     {
 #ifdef HAVE_KINFO_GETVMMAP
@@ -398,18 +436,18 @@
     lp = l1_map + ((index >> V_L1_SHIFT) & (V_L1_SIZE - 1));
 
     /* Level 2..N-1.  */
-    for (i = V_L1_SHIFT / L2_BITS - 1; i > 0; i--) {
+    for (i = V_L1_SHIFT / V_L2_BITS - 1; i > 0; i--) {
         void **p = *lp;
 
         if (p == NULL) {
             if (!alloc) {
                 return NULL;
             }
-            ALLOC(p, sizeof(void *) * L2_SIZE);
+            ALLOC(p, sizeof(void *) * V_L2_SIZE);
             *lp = p;
         }
 
-        lp = p + ((index >> (i * L2_BITS)) & (L2_SIZE - 1));
+        lp = p + ((index >> (i * V_L2_BITS)) & (V_L2_SIZE - 1));
     }
 
     pd = *lp;
@@ -417,13 +455,13 @@
         if (!alloc) {
             return NULL;
         }
-        ALLOC(pd, sizeof(PageDesc) * L2_SIZE);
+        ALLOC(pd, sizeof(PageDesc) * V_L2_SIZE);
         *lp = pd;
     }
 
 #undef ALLOC
 
-    return pd + (index & (L2_SIZE - 1));
+    return pd + (index & (V_L2_SIZE - 1));
 }
 
 static inline PageDesc *page_find(tb_page_addr_t index)
@@ -441,18 +479,18 @@
     lp = l1_phys_map + ((index >> V_L1_SHIFT) & (V_L1_SIZE - 1));
 
     /* Level 2..N-1 */
-    for (i = V_L1_SHIFT / L2_BITS - 1; i > 0; i--) {
+    for (i = V_L1_SHIFT / V_L2_BITS - 1; i > 0; i--) {
         void **p = *lp;
 
         if (p == NULL) {
             if (!alloc) {
                 return NULL;
             }
-            p = g_malloc0(sizeof(void *) * L2_SIZE);
+            p = g_malloc0(sizeof(void *) * V_L2_SIZE);
             *lp = p;
         }
 
-        lp = p + ((index >> (i * L2_BITS)) & (L2_SIZE - 1));
+        lp = p + ((index >> (i * V_L2_BITS)) & (V_L2_SIZE - 1));
     }
 
     pd = *lp;
@@ -460,14 +498,14 @@
         if (!alloc) {
             return NULL;
         }
-        pd = g_malloc(sizeof(PhysPageDesc) * L2_SIZE);
+        pd = g_malloc(sizeof(PhysPageDesc) * V_L2_SIZE);
         *lp = pd;
-        for (i = 0; i < L2_SIZE; i++) {
+        for (i = 0; i < V_L2_SIZE; i++) {
             pd[i].phys_offset = IO_MEM_UNASSIGNED;
             pd[i].region_offset = (index + i) << TARGET_PAGE_BITS;
         }
     }
-    return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
+    return ((PhysPageDesc *)pd) + (index & (V_L2_SIZE - 1));
 }
 
 PhysPageDesc *phys_page_find(hwaddr index)
@@ -702,14 +740,14 @@
     if (level == 0) {
         PageDesc *pd = *lp;
 
-        for (i = 0; i < L2_SIZE; ++i) {
+        for (i = 0; i < V_L2_SIZE; ++i) {
             pd[i].first_tb = NULL;
             invalidate_page_bitmap(pd + i);
         }
     } else {
         void **pp = *lp;
 
-        for (i = 0; i < L2_SIZE; ++i) {
+        for (i = 0; i < V_L2_SIZE; ++i) {
             page_flush_tb_1(level - 1, pp + i);
         }
     }
@@ -720,7 +758,7 @@
     int i;
 
     for (i = 0; i < V_L1_SIZE; i++) {
-        page_flush_tb_1(V_L1_SHIFT / L2_BITS - 1, l1_map + i);
+        page_flush_tb_1(V_L1_SHIFT / V_L2_BITS - 1, l1_map + i);
     }
 }
 
@@ -977,10 +1015,11 @@
     }
 }
 
-TranslationBlock *tb_gen_code(CPUArchState *env,
+TranslationBlock *tb_gen_code(CPUState *cpu,
                               target_ulong pc, target_ulong cs_base,
                               int flags, int cflags)
 {
+    CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb;
     uint8_t *tc_ptr;
     tb_page_addr_t phys_pc, phys_page2;
@@ -1113,7 +1152,7 @@
                 restore the CPU state */
 
                 current_tb_modified = 1;
-                cpu_restore_state_from_tb(current_tb, env, cpu->mem_io_pc);
+                cpu_restore_state_from_tb(cpu, current_tb, cpu->mem_io_pc);
                 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
                                      &current_flags);
             }
@@ -1150,8 +1189,8 @@
            modifying the memory. It will ensure that it cannot modify
            itself */
         cpu->current_tb = NULL;
-        tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
-        cpu_resume_from_signal(env, NULL);
+        tb_gen_code(cpu, current_pc, current_cs_base, current_flags, 1);
+        cpu_resume_from_signal(cpu, NULL);
     }
 #endif
 }
@@ -1236,7 +1275,7 @@
                    restore the CPU state */
 
             current_tb_modified = 1;
-            cpu_restore_state_from_tb(current_tb, env, pc);
+            cpu_restore_state_from_tb(cpu, current_tb, pc);
             cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
                                  &current_flags);
         }
@@ -1251,11 +1290,11 @@
            modifying the memory. It will ensure that it cannot modify
            itself */
         cpu->current_tb = NULL;
-        tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
+        tb_gen_code(cpu, current_pc, current_cs_base, current_flags, 1);
         if (locked) {
             mmap_unlock();
         }
-        cpu_resume_from_signal(env, puc);
+        cpu_resume_from_signal(cpu, puc);
     }
 #endif
 }
@@ -1365,7 +1404,7 @@
 
 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
    tb[1].tc_ptr. Return NULL if not found */
-TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
+static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
 {
     int m_min, m_max, m;
     uintptr_t v;
@@ -1416,9 +1455,8 @@
 #endif /* TARGET_HAS_ICE && !defined(CONFIG_USER_ONLY) */
 #endif  // !CONFIG_ANDROID
 
-void tb_check_watchpoint(CPUArchState *env)
+void tb_check_watchpoint(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     TranslationBlock *tb;
 
     tb = tb_find_pc(cpu->mem_io_pc);
@@ -1426,7 +1464,7 @@
         cpu_abort(cpu, "check_watchpoint: could not find TB for pc=%p",
                   (void *)cpu->mem_io_pc);
     }
-    cpu_restore_state_from_tb(tb, env, cpu->mem_io_pc);
+    cpu_restore_state_from_tb(cpu, tb, cpu->mem_io_pc);
     tb_phys_invalidate(tb, -1);
 }
 
@@ -1434,7 +1472,6 @@
 /* mask must never be zero, except for A20 change call */
 void cpu_interrupt(CPUState *cpu, int mask)
 {
-    CPUArchState *env = cpu->env_ptr;
     int old_mask;
 
     old_mask = cpu->interrupt_request;
@@ -1457,7 +1494,7 @@
         }
     } else {
         cpu->tcg_exit_req = 1;
-        cpu_unlink_tb(env);
+        cpu_unlink_tb(cpu);
     }
 }
 
@@ -1508,9 +1545,11 @@
 
 /* in deterministic execution mode, instructions doing device I/Os
    must be at the end of the TB */
-void cpu_io_recompile(CPUArchState *env, uintptr_t retaddr)
+void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
+#if defined(TARGET_MIPS) || defined(TARGET_SH4)
+    CPUArchState *env = cpu->env_ptr;
+#endif
     TranslationBlock *tb;
     uint32_t n, cflags;
     target_ulong pc, cs_base;
@@ -1522,7 +1561,7 @@
                   (void *)retaddr);
     }
     n = cpu->icount_decr.u16.low + tb->icount;
-    cpu_restore_state_from_tb(tb, env, retaddr);
+    cpu_restore_state_from_tb(cpu, tb, retaddr);
     /* Calculate how many instructions had been executed before the fault
        occurred.  */
     n = n - cpu->icount_decr.u16.low;
@@ -1558,13 +1597,13 @@
     tb_phys_invalidate(tb, -1);
     /* FIXME: In theory this could raise an exception.  In practice
        we have already translated the block once so it's probably ok.  */
-    tb_gen_code(env, pc, cs_base, flags, cflags);
+    tb_gen_code(cpu, pc, cs_base, flags, cflags);
     /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
        the first in the TB) then we end up generating a whole new TB and
        repeating the fault, which is horribly inefficient.
        Better would be to execute just this insn uncached, or generate a
        second new TB.  */
-    cpu_resume_from_signal(env, NULL);
+    cpu_resume_from_signal(cpu, NULL);
 }
 
 void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr)
@@ -1693,7 +1732,7 @@
     if (level == 0) {
         PageDesc *pd = *lp;
 
-        for (i = 0; i < L2_SIZE; ++i) {
+        for (i = 0; i < V_L2_SIZE; ++i) {
             int prot = pd[i].flags;
 
             pa = base | (i << TARGET_PAGE_BITS);
@@ -1707,9 +1746,9 @@
     } else {
         void **pp = *lp;
 
-        for (i = 0; i < L2_SIZE; ++i) {
+        for (i = 0; i < V_L2_SIZE; ++i) {
             pa = base | ((abi_ulong)i <<
-                (TARGET_PAGE_BITS + L2_BITS * level));
+                (TARGET_PAGE_BITS + V_L2_BITS * level));
             rc = walk_memory_regions_1(data, pa, level - 1, pp + i);
             if (rc != 0) {
                 return rc;
@@ -1732,7 +1771,7 @@
 
     for (i = 0; i < V_L1_SIZE; i++) {
         int rc = walk_memory_regions_1(&data, (abi_ulong)i << V_L1_SHIFT,
-                                       V_L1_SHIFT / L2_BITS - 1, l1_map + i);
+                                       V_L1_SHIFT / V_L2_BITS - 1, l1_map + i);
 
         if (rc != 0) {
             return rc;
diff --git a/translate-all.h b/translate-all.h
index 498db1b..6b7a3f2 100644
--- a/translate-all.h
+++ b/translate-all.h
@@ -21,17 +21,10 @@
 
 #include <stdbool.h>
 
-/* Size of the L2 (and L3, etc) page tables.  */
-#define L2_BITS 10
-#define L2_SIZE (1 << L2_BITS)
-
-#define P_L2_LEVELS \
-    (((TARGET_PHYS_ADDR_SPACE_BITS - TARGET_PAGE_BITS - 1) / L2_BITS) + 1)
-
 /* translate-all.c */
 bool tcg_enabled(void);
 void tb_invalidate_phys_page_fast(tb_page_addr_t start, int len);
-void cpu_unlink_tb(CPUOldState *cpu);
-void tb_check_watchpoint(CPUArchState *env);
+void cpu_unlink_tb(CPUState *cpu);
+void tb_check_watchpoint(CPUState *cpu);
 
 #endif /* TRANSLATE_ALL_H */