diff --git a/hw/apic.c b/hw/apic.c
index c4dc52c95b..91c8d93a78 100644
--- a/hw/apic.c
+++ b/hw/apic.c
@@ -310,10 +310,8 @@ void apic_deliver_irq(uint8_t dest, uint8_t dest_mode,
                      trigger_mode);
 }
 
-void cpu_set_apic_base(CPUState *env, uint64_t val)
+void cpu_set_apic_base(APICState *s, uint64_t val)
 {
-    APICState *s = env->apic_state;
-
     DPRINTF("cpu_set_apic_base: %016" PRIx64 "\n", val);
     if (!s)
         return;
@@ -322,32 +320,28 @@ void cpu_set_apic_base(CPUState *env, uint64_t val)
     /* if disabled, cannot be enabled again */
     if (!(val & MSR_IA32_APICBASE_ENABLE)) {
         s->apicbase &= ~MSR_IA32_APICBASE_ENABLE;
-        env->cpuid_features &= ~CPUID_APIC;
+        s->cpu_env->cpuid_features &= ~CPUID_APIC;
         s->spurious_vec &= ~APIC_SV_ENABLE;
     }
 }
 
-uint64_t cpu_get_apic_base(CPUState *env)
+uint64_t cpu_get_apic_base(APICState *s)
 {
-    APICState *s = env->apic_state;
-
     DPRINTF("cpu_get_apic_base: %016" PRIx64 "\n",
             s ? (uint64_t)s->apicbase: 0);
     return s ? s->apicbase : 0;
 }
 
-void cpu_set_apic_tpr(CPUX86State *env, uint8_t val)
+void cpu_set_apic_tpr(APICState *s, uint8_t val)
 {
-    APICState *s = env->apic_state;
     if (!s)
         return;
     s->tpr = (val & 0x0f) << 4;
     apic_update_irq(s);
 }
 
-uint8_t cpu_get_apic_tpr(CPUX86State *env)
+uint8_t cpu_get_apic_tpr(APICState *s)
 {
-    APICState *s = env->apic_state;
     return s ? s->tpr >> 4 : 0;
 }
 
@@ -490,9 +484,8 @@ static void apic_get_delivery_bitmask(uint32_t *deliver_bitmask,
 }
 
 
-void apic_init_reset(CPUState *env)
+void apic_init_reset(APICState *s)
 {
-    APICState *s = env->apic_state;
     int i;
 
     if (!s)
@@ -516,7 +509,7 @@ void apic_init_reset(CPUState *env)
     s->next_time = 0;
     s->wait_for_sipi = 1;
 
-    env->halted = !(s->apicbase & MSR_IA32_APICBASE_BSP);
+    s->cpu_env->halted = !(s->apicbase & MSR_IA32_APICBASE_BSP);
 }
 
 static void apic_startup(APICState *s, int vector_num)
@@ -525,19 +518,19 @@ static void apic_startup(APICState *s, int vector_num)
     cpu_interrupt(s->cpu_env, CPU_INTERRUPT_SIPI);
 }
 
-void apic_sipi(CPUState *env)
+void apic_sipi(APICState *s)
 {
-    APICState *s = env->apic_state;
-
-    cpu_reset_interrupt(env, CPU_INTERRUPT_SIPI);
+    cpu_reset_interrupt(s->cpu_env, CPU_INTERRUPT_SIPI);
 
     if (!s->wait_for_sipi)
         return;
 
-    env->eip = 0;
-    cpu_x86_load_seg_cache(env, R_CS, s->sipi_vector << 8, s->sipi_vector << 12,
-                           env->segs[R_CS].limit, env->segs[R_CS].flags);
-    env->halted = 0;
+    s->cpu_env->eip = 0;
+    cpu_x86_load_seg_cache(s->cpu_env, R_CS, s->sipi_vector << 8,
+                           s->sipi_vector << 12,
+                           s->cpu_env->segs[R_CS].limit,
+                           s->cpu_env->segs[R_CS].flags);
+    s->cpu_env->halted = 0;
     s->wait_for_sipi = 0;
 }
 
@@ -957,7 +950,7 @@ static void apic_reset(void *opaque)
         (bsp ? MSR_IA32_APICBASE_BSP : 0) | MSR_IA32_APICBASE_ENABLE;
 
     cpu_reset(s->cpu_env);
-    apic_init_reset(s->cpu_env);
+    apic_init_reset(s);
 
     if (bsp) {
         /*
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 548ab80a3d..0b19fe3863 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -860,11 +860,12 @@ void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
 void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4);
 
 /* hw/apic.c */
-void cpu_set_apic_base(CPUX86State *env, uint64_t val);
-uint64_t cpu_get_apic_base(CPUX86State *env);
-void cpu_set_apic_tpr(CPUX86State *env, uint8_t val);
+typedef struct APICState APICState;
+void cpu_set_apic_base(APICState *s, uint64_t val);
+uint64_t cpu_get_apic_base(APICState *s);
+void cpu_set_apic_tpr(APICState *s, uint8_t val);
 #ifndef NO_CPU_IO_DEFS
-uint8_t cpu_get_apic_tpr(CPUX86State *env);
+uint8_t cpu_get_apic_tpr(APICState *s);
 #endif
 
 /* hw/pc.c */
@@ -942,8 +943,8 @@ static inline void cpu_get_tb_cpu_state(CPUState *env, target_ulong *pc,
         (env->eflags & (IOPL_MASK | TF_MASK | RF_MASK | VM_MASK));
 }
 
-void apic_init_reset(CPUState *env);
-void apic_sipi(CPUState *env);
+void apic_init_reset(APICState *s);
+void apic_sipi(APICState *s);
 void do_cpu_init(CPUState *env);
 void do_cpu_sipi(CPUState *env);
 #endif /* CPU_I386_H */
diff --git a/target-i386/helper.c b/target-i386/helper.c
index c9508a8169..718394cfc9 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1150,12 +1150,12 @@ void do_cpu_init(CPUState *env)
     int sipi = env->interrupt_request & CPU_INTERRUPT_SIPI;
     cpu_reset(env);
     env->interrupt_request = sipi;
-    apic_init_reset(env);
+    apic_init_reset(env->apic_state);
 }
 
 void do_cpu_sipi(CPUState *env)
 {
-    apic_sipi(env);
+    apic_sipi(env->apic_state);
 }
 #else
 void do_cpu_init(CPUState *env)
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index d6b12edab7..545323961a 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -540,8 +540,8 @@ static int kvm_put_sregs(CPUState *env)
     sregs.cr3 = env->cr[3];
     sregs.cr4 = env->cr[4];
 
-    sregs.cr8 = cpu_get_apic_tpr(env);
-    sregs.apic_base = cpu_get_apic_base(env);
+    sregs.cr8 = cpu_get_apic_tpr(env->apic_state);
+    sregs.apic_base = cpu_get_apic_base(env->apic_state);
 
     sregs.efer = env->efer;
 
@@ -652,10 +652,10 @@ static int kvm_get_sregs(CPUState *env)
     env->cr[3] = sregs.cr3;
     env->cr[4] = sregs.cr4;
 
-    cpu_set_apic_base(env, sregs.apic_base);
+    cpu_set_apic_base(env->apic_state, sregs.apic_base);
 
     env->efer = sregs.efer;
-    //cpu_set_apic_tpr(env, sregs.cr8);
+    //cpu_set_apic_tpr(env->apic_state, sregs.cr8);
 
 #define HFLAG_COPY_MASK ~( \
 			HF_CPL_MASK | HF_PE_MASK | HF_MP_MASK | HF_EM_MASK | \
@@ -1055,7 +1055,7 @@ int kvm_arch_pre_run(CPUState *env, struct kvm_run *run)
         run->request_interrupt_window = 0;
 
     DPRINTF("setting tpr\n");
-    run->cr8 = cpu_get_apic_tpr(env);
+    run->cr8 = cpu_get_apic_tpr(env->apic_state);
 
     return 0;
 }
@@ -1067,8 +1067,8 @@ int kvm_arch_post_run(CPUState *env, struct kvm_run *run)
     else
         env->eflags &= ~IF_MASK;
     
-    cpu_set_apic_tpr(env, run->cr8);
-    cpu_set_apic_base(env, run->apic_base);
+    cpu_set_apic_tpr(env->apic_state, run->cr8);
+    cpu_set_apic_base(env->apic_state, run->apic_base);
 
     return 0;
 }
diff --git a/target-i386/op_helper.c b/target-i386/op_helper.c
index dcbdfe7e0b..c1256f4abd 100644
--- a/target-i386/op_helper.c
+++ b/target-i386/op_helper.c
@@ -2888,7 +2888,7 @@ target_ulong helper_read_crN(int reg)
         break;
     case 8:
         if (!(env->hflags2 & HF2_VINTR_MASK)) {
-            val = cpu_get_apic_tpr(env);
+            val = cpu_get_apic_tpr(env->apic_state);
         } else {
             val = env->v_tpr;
         }
@@ -2912,7 +2912,7 @@ void helper_write_crN(int reg, target_ulong t0)
         break;
     case 8:
         if (!(env->hflags2 & HF2_VINTR_MASK)) {
-            cpu_set_apic_tpr(env, t0);
+            cpu_set_apic_tpr(env->apic_state, t0);
         }
         env->v_tpr = t0 & 0x0f;
         break;
@@ -3020,7 +3020,7 @@ void helper_wrmsr(void)
         env->sysenter_eip = val;
         break;
     case MSR_IA32_APICBASE:
-        cpu_set_apic_base(env, val);
+        cpu_set_apic_base(env->apic_state, val);
         break;
     case MSR_EFER:
         {
@@ -3153,7 +3153,7 @@ void helper_rdmsr(void)
         val = env->sysenter_eip;
         break;
     case MSR_IA32_APICBASE:
-        val = cpu_get_apic_base(env);
+        val = cpu_get_apic_base(env->apic_state);
         break;
     case MSR_EFER:
         val = env->efer;