diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 86e84153ad..206d552e16 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -58,10 +58,12 @@ typedef struct S390IPLState {
 
 static void s390_ipl_cpu(uint64_t pswaddr)
 {
-    CPUS390XState *env = &S390_CPU(qemu_get_cpu(0))->env;
+    S390CPU *cpu = S390_CPU(qemu_get_cpu(0));
+    CPUS390XState *env = &cpu->env;
+
     env->psw.addr = pswaddr;
     env->psw.mask = IPL_PSW_MASK;
-    s390_add_running_cpu(env);
+    s390_add_running_cpu(cpu);
 }
 
 static int s390_ipl_init(SysBusDevice *dev)
diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index 32f63b07ea..d4677814ca 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -113,12 +113,10 @@ VirtIOS390Bus *s390_virtio_bus_init(ram_addr_t *ram_size)
 
 static void s390_virtio_irq(S390CPU *cpu, int config_change, uint64_t token)
 {
-    CPUS390XState *env = &cpu->env;
-
     if (kvm_enabled()) {
         kvm_s390_virtio_irq(cpu, config_change, token);
     } else {
-        cpu_inject_ext(env, VIRTIO_EXT_CODE, config_change, token);
+        cpu_inject_ext(cpu, VIRTIO_EXT_CODE, config_change, token);
     }
 }
 
diff --git a/hw/s390x/s390-virtio.c b/hw/s390x/s390-virtio.c
index 2a1d9ac2da..e25c330320 100644
--- a/hw/s390x/s390-virtio.c
+++ b/hw/s390x/s390-virtio.c
@@ -130,8 +130,10 @@ static void s390_virtio_register_hcalls(void)
  */
 static unsigned s390_running_cpus;
 
-void s390_add_running_cpu(CPUS390XState *env)
+void s390_add_running_cpu(S390CPU *cpu)
 {
+    CPUS390XState *env = &cpu->env;
+
     if (env->halted) {
         s390_running_cpus++;
         env->halted = 0;
@@ -139,8 +141,10 @@ void s390_add_running_cpu(CPUS390XState *env)
     }
 }
 
-unsigned s390_del_running_cpu(CPUS390XState *env)
+unsigned s390_del_running_cpu(S390CPU *cpu)
 {
+    CPUS390XState *env = &cpu->env;
+
     if (env->halted == 0) {
         assert(s390_running_cpus >= 1);
         s390_running_cpus--;
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index a0c4479f39..d765e7b984 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -70,7 +70,7 @@ static void s390_cpu_reset(CPUState *s)
         log_cpu_state(env, 0);
     }
 
-    s390_del_running_cpu(env);
+    s390_del_running_cpu(cpu);
 
     scc->parent_reset(s);
 
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 9be4a475a3..01e59b99f0 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -375,8 +375,8 @@ static inline void kvm_s390_interrupt_internal(S390CPU *cpu, int type,
 }
 #endif
 S390CPU *s390_cpu_addr2state(uint16_t cpu_addr);
-void s390_add_running_cpu(CPUS390XState *env);
-unsigned s390_del_running_cpu(CPUS390XState *env);
+void s390_add_running_cpu(S390CPU *cpu);
+unsigned s390_del_running_cpu(S390CPU *cpu);
 
 /* service interrupts are floating therefore we must not pass an cpustate */
 void s390_sclp_extint(uint32_t parm);
@@ -385,11 +385,11 @@ void s390_sclp_extint(uint32_t parm);
 extern const hwaddr virtio_size;
 
 #else
-static inline void s390_add_running_cpu(CPUS390XState *env)
+static inline void s390_add_running_cpu(S390CPU *cpu)
 {
 }
 
-static inline unsigned s390_del_running_cpu(CPUS390XState *env)
+static inline unsigned s390_del_running_cpu(S390CPU *cpu)
 {
     return 0;
 }
@@ -975,9 +975,11 @@ static inline uint64_t time2tod(uint64_t ns) {
     return (ns << 9) / 125;
 }
 
-static inline void cpu_inject_ext(CPUS390XState *env, uint32_t code, uint32_t param,
+static inline void cpu_inject_ext(S390CPU *cpu, uint32_t code, uint32_t param,
                                   uint64_t param64)
 {
+    CPUS390XState *env = &cpu->env;
+
     if (env->ext_index == MAX_EXT_QUEUE - 1) {
         /* ugh - can't queue anymore. Let's drop. */
         return;
@@ -994,10 +996,11 @@ static inline void cpu_inject_ext(CPUS390XState *env, uint32_t code, uint32_t pa
     cpu_interrupt(env, CPU_INTERRUPT_HARD);
 }
 
-static inline void cpu_inject_io(CPUS390XState *env, uint16_t subchannel_id,
+static inline void cpu_inject_io(S390CPU *cpu, uint16_t subchannel_id,
                                  uint16_t subchannel_number,
                                  uint32_t io_int_parm, uint32_t io_int_word)
 {
+    CPUS390XState *env = &cpu->env;
     int isc = ffs(io_int_word << 2) - 1;
 
     if (env->io_index[isc] == MAX_IO_QUEUE - 1) {
@@ -1017,8 +1020,10 @@ static inline void cpu_inject_io(CPUS390XState *env, uint16_t subchannel_id,
     cpu_interrupt(env, CPU_INTERRUPT_HARD);
 }
 
-static inline void cpu_inject_crw_mchk(CPUS390XState *env)
+static inline void cpu_inject_crw_mchk(S390CPU *cpu)
 {
+    CPUS390XState *env = &cpu->env;
+
     if (env->mchk_index == MAX_MCHK_QUEUE - 1) {
         /* ugh - can't queue anymore. Let's drop. */
         return;
@@ -1090,7 +1095,7 @@ static inline void s390_io_interrupt(S390CPU *cpu,
         kvm_s390_io_interrupt(cpu, subchannel_id, subchannel_nr, io_int_parm,
                               io_int_word);
     } else {
-        cpu_inject_io(&cpu->env, subchannel_id, subchannel_nr, io_int_parm,
+        cpu_inject_io(cpu, subchannel_id, subchannel_nr, io_int_parm,
                       io_int_word);
     }
 }
@@ -1100,7 +1105,7 @@ static inline void s390_crw_mchk(S390CPU *cpu)
     if (kvm_enabled()) {
         kvm_s390_crw_mchk(cpu);
     } else {
-        cpu_inject_crw_mchk(&cpu->env);
+        cpu_inject_crw_mchk(cpu);
     }
 }
 
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index 857c89725c..3180b90ed8 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -387,7 +387,7 @@ int cpu_s390x_handle_mmu_fault(CPUS390XState *env, target_ulong orig_vaddr,
     int prot;
 
     DPRINTF("%s: address 0x%" PRIx64 " rw %d mmu_idx %d\n",
-            __func__, _vaddr, rw, mmu_idx);
+            __func__, orig_vaddr, rw, mmu_idx);
 
     orig_vaddr &= TARGET_PAGE_MASK;
     vaddr = orig_vaddr;
@@ -404,8 +404,8 @@ int cpu_s390x_handle_mmu_fault(CPUS390XState *env, target_ulong orig_vaddr,
 
     /* check out of RAM access */
     if (raddr > (ram_size + virtio_size)) {
-        DPRINTF("%s: aaddr %" PRIx64 " > ram_size %" PRIx64 "\n", __func__,
-                (uint64_t)aaddr, (uint64_t)ram_size);
+        DPRINTF("%s: raddr %" PRIx64 " > ram_size %" PRIx64 "\n", __func__,
+                (uint64_t)raddr, (uint64_t)ram_size);
         trigger_pgm_exception(env, PGM_ADDRESSING, ILEN_LATER);
         return 1;
     }
@@ -441,8 +441,9 @@ hwaddr cpu_get_phys_page_debug(CPUS390XState *env,
 void load_psw(CPUS390XState *env, uint64_t mask, uint64_t addr)
 {
     if (mask & PSW_MASK_WAIT) {
+        S390CPU *cpu = s390_env_get_cpu(env);
         if (!(mask & (PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK))) {
-            if (s390_del_running_cpu(env) == 0) {
+            if (s390_del_running_cpu(cpu) == 0) {
 #ifndef CONFIG_USER_ONLY
                 qemu_system_shutdown_request();
 #endif
@@ -737,10 +738,12 @@ static void do_mchk_interrupt(CPUS390XState *env)
 
 void do_interrupt(CPUS390XState *env)
 {
+    S390CPU *cpu = s390_env_get_cpu(env);
+
     qemu_log_mask(CPU_LOG_INT, "%s: %d at pc=%" PRIx64 "\n",
                   __func__, env->exception_index, env->psw.addr);
 
-    s390_add_running_cpu(env);
+    s390_add_running_cpu(cpu);
     /* handle machine checks */
     if ((env->psw.mask & PSW_MASK_MCHECK) &&
         (env->exception_index == -1)) {
@@ -755,12 +758,12 @@ void do_interrupt(CPUS390XState *env)
             /* code is already in env */
             env->exception_index = EXCP_EXT;
         } else if (env->pending_int & INTERRUPT_TOD) {
-            cpu_inject_ext(env, 0x1004, 0, 0);
+            cpu_inject_ext(cpu, 0x1004, 0, 0);
             env->exception_index = EXCP_EXT;
             env->pending_int &= ~INTERRUPT_EXT;
             env->pending_int &= ~INTERRUPT_TOD;
         } else if (env->pending_int & INTERRUPT_CPUTIMER) {
-            cpu_inject_ext(env, 0x1005, 0, 0);
+            cpu_inject_ext(cpu, 0x1005, 0, 0);
             env->exception_index = EXCP_EXT;
             env->pending_int &= ~INTERRUPT_EXT;
             env->pending_int &= ~INTERRUPT_TOD;
diff --git a/target-s390x/interrupt.c b/target-s390x/interrupt.c
index e51519dbd7..6d6580de3a 100644
--- a/target-s390x/interrupt.c
+++ b/target-s390x/interrupt.c
@@ -24,7 +24,7 @@ void s390_sclp_extint(uint32_t parm)
 #endif
     } else {
         env->psw.addr += 4;
-        cpu_inject_ext(env, EXT_SERVICE, parm, 0);
+        cpu_inject_ext(dummy_cpu, EXT_SERVICE, parm, 0);
     }
 }
 #endif
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 2c24182001..3929771182 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -570,12 +570,10 @@ static int handle_diag(CPUS390XState *env, struct kvm_run *run, int ipb_code)
 
 static int s390_cpu_restart(S390CPU *cpu)
 {
-    CPUS390XState *env = &cpu->env;
-
     kvm_s390_interrupt(cpu, KVM_S390_RESTART, 0);
-    s390_add_running_cpu(env);
+    s390_add_running_cpu(cpu);
     qemu_cpu_kick(CPU(cpu));
-    dprintf("DONE: SIGP cpu restart: %p\n", env);
+    dprintf("DONE: SIGP cpu restart: %p\n", &cpu->env);
     return 0;
 }
 
@@ -591,7 +589,7 @@ static int s390_cpu_initial_reset(S390CPU *cpu)
     CPUS390XState *env = &cpu->env;
     int i;
 
-    s390_del_running_cpu(env);
+    s390_del_running_cpu(cpu);
     if (kvm_vcpu_ioctl(CPU(cpu), KVM_S390_INITIAL_RESET, NULL) < 0) {
         perror("cannot init reset vcpu");
     }
@@ -701,7 +699,6 @@ static bool is_special_wait_psw(CPUState *cs)
 
 static int handle_intercept(S390CPU *cpu)
 {
-    CPUS390XState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
     struct kvm_run *run = cs->kvm_run;
     int icpt_code = run->s390_sieic.icptcode;
@@ -714,14 +711,14 @@ static int handle_intercept(S390CPU *cpu)
             r = handle_instruction(cpu, run);
             break;
         case ICPT_WAITPSW:
-            if (s390_del_running_cpu(env) == 0 &&
+            if (s390_del_running_cpu(cpu) == 0 &&
                 is_special_wait_psw(cs)) {
                 qemu_system_shutdown_request();
             }
             r = EXCP_HALTED;
             break;
         case ICPT_CPU_STOP:
-            if (s390_del_running_cpu(env) == 0) {
+            if (s390_del_running_cpu(cpu) == 0) {
                 qemu_system_shutdown_request();
             }
             r = EXCP_HALTED;