diff --git a/cpu-exec.c b/cpu-exec.c
index d7c21d35e5..192620f37b 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -23,10 +23,8 @@
 #include "qemu/atomic.h"
 #include "sysemu/qtest.h"
 
-void cpu_loop_exit(CPUArchState *env)
+void cpu_loop_exit(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     cpu->current_tb = NULL;
     siglongjmp(cpu->jmp_env, 1);
 }
@@ -325,7 +323,7 @@ int cpu_exec(CPUArchState *env)
                     if (interrupt_request & CPU_INTERRUPT_DEBUG) {
                         cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
                         cpu->exception_index = EXCP_DEBUG;
-                        cpu_loop_exit(env);
+                        cpu_loop_exit(cpu);
                     }
 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
     defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) || \
@@ -334,7 +332,7 @@ int cpu_exec(CPUArchState *env)
                         cpu->interrupt_request &= ~CPU_INTERRUPT_HALT;
                         cpu->halted = 1;
                         cpu->exception_index = EXCP_HLT;
-                        cpu_loop_exit(env);
+                        cpu_loop_exit(cpu);
                     }
 #endif
 #if defined(TARGET_I386)
@@ -349,7 +347,7 @@ int cpu_exec(CPUArchState *env)
                                                           0);
                             do_cpu_init(x86_cpu);
                             cpu->exception_index = EXCP_HALTED;
-                            cpu_loop_exit(env);
+                            cpu_loop_exit(cpu);
                     } else if (interrupt_request & CPU_INTERRUPT_SIPI) {
                             do_cpu_sipi(x86_cpu);
                     } else if (env->hflags2 & HF2_GIF_MASK) {
@@ -601,7 +599,7 @@ int cpu_exec(CPUArchState *env)
                 if (unlikely(cpu->exit_request)) {
                     cpu->exit_request = 0;
                     cpu->exception_index = EXCP_INTERRUPT;
-                    cpu_loop_exit(env);
+                    cpu_loop_exit(cpu);
                 }
                 spin_lock(&tcg_ctx.tb_ctx.tb_lock);
                 tb = tb_find_fast(env);
@@ -672,7 +670,7 @@ int cpu_exec(CPUArchState *env)
                             }
                             cpu->exception_index = EXCP_INTERRUPT;
                             next_tb = 0;
-                            cpu_loop_exit(env);
+                            cpu_loop_exit(cpu);
                         }
                         break;
                     }
diff --git a/exec.c b/exec.c
index 6d9e13a0a6..5f7c47244f 100644
--- a/exec.c
+++ b/exec.c
@@ -1608,7 +1608,7 @@ static void check_watchpoint(int offset, int len_mask, int flags)
                 tb_check_watchpoint(env);
                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
                     cpu->exception_index = EXCP_DEBUG;
-                    cpu_loop_exit(env);
+                    cpu_loop_exit(cpu);
                 } else {
                     cpu_get_tb_cpu_state(env, &pc, &cs_base, &cpu_flags);
                     tb_gen_code(env, pc, cs_base, cpu_flags, 1);
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index c8c3a1198b..80277eac32 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -89,7 +89,7 @@ TranslationBlock *tb_gen_code(CPUArchState *env,
                               target_ulong pc, target_ulong cs_base, int flags,
                               int cflags);
 void cpu_exec_init(CPUArchState *env);
-void QEMU_NORETURN cpu_loop_exit(CPUArchState *env1);
+void QEMU_NORETURN cpu_loop_exit(CPUState *cpu);
 int page_unprotect(target_ulong address, uintptr_t pc, void *puc);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
                                    int is_cpu_write_access);
diff --git a/target-alpha/helper.c b/target-alpha/helper.c
index 14f59a27a8..45f73e0ea2 100644
--- a/target-alpha/helper.c
+++ b/target-alpha/helper.c
@@ -513,7 +513,7 @@ void QEMU_NORETURN helper_excp(CPUAlphaState *env, int excp, int error)
 
     cs->exception_index = excp;
     env->error_code = error;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 /* This may be called from any of the helpers to set up EXCEPTION_INDEX.  */
@@ -528,7 +528,7 @@ void QEMU_NORETURN dynamic_excp(CPUAlphaState *env, uintptr_t retaddr,
     if (retaddr) {
         cpu_restore_state(env, retaddr);
     }
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void QEMU_NORETURN arith_excp(CPUAlphaState *env, uintptr_t retaddr,
diff --git a/target-alpha/mem_helper.c b/target-alpha/mem_helper.c
index 3447f828ed..1957c566b9 100644
--- a/target-alpha/mem_helper.c
+++ b/target-alpha/mem_helper.c
@@ -116,7 +116,7 @@ static void do_unaligned_access(CPUAlphaState *env, target_ulong addr,
     env->trap_arg2 = (insn >> 21) & 31;         /* dest regno */
     cs->exception_index = EXCP_UNALIGN;
     env->error_code = 0;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void alpha_cpu_unassigned_access(CPUState *cs, hwaddr addr,
@@ -166,7 +166,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write,
             cpu_restore_state(env, retaddr);
         }
         /* Exception index and error code are already set */
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 #endif /* CONFIG_USER_ONLY */
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index 932f5e218d..f8e535e8ce 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -28,7 +28,7 @@ static void raise_exception(CPUARMState *env, int tt)
     CPUState *cs = CPU(cpu);
 
     cs->exception_index = tt;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
@@ -229,7 +229,7 @@ void HELPER(wfi)(CPUARMState *env)
 
     cs->exception_index = EXCP_HLT;
     cs->halted = 1;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(wfe)(CPUARMState *env)
@@ -240,7 +240,7 @@ void HELPER(wfe)(CPUARMState *env)
      * level loop
      */
     cs->exception_index = EXCP_YIELD;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(exception)(CPUARMState *env, uint32_t excp)
@@ -248,7 +248,7 @@ void HELPER(exception)(CPUARMState *env, uint32_t excp)
     CPUState *cs = CPU(arm_env_get_cpu(env));
 
     cs->exception_index = excp;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 uint32_t HELPER(cpsr_read)(CPUARMState *env)
diff --git a/target-cris/op_helper.c b/target-cris/op_helper.c
index 68a5caa2a7..d80b6c966d 100644
--- a/target-cris/op_helper.c
+++ b/target-cris/op_helper.c
@@ -72,7 +72,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
                 helper_top_evaluate_flags(env);
             }
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 
@@ -83,7 +83,7 @@ void helper_raise_exception(CPUCRISState *env, uint32_t index)
     CPUState *cs = CPU(cris_env_get_cpu(env));
 
     cs->exception_index = index;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_tlb_flush_pid(CPUCRISState *env, uint32_t pid)
diff --git a/target-i386/excp_helper.c b/target-i386/excp_helper.c
index ec76eba760..f337fd20fb 100644
--- a/target-i386/excp_helper.c
+++ b/target-i386/excp_helper.c
@@ -108,7 +108,7 @@ static void QEMU_NORETURN raise_interrupt2(CPUX86State *env, int intno,
     env->error_code = error_code;
     env->exception_is_int = is_int;
     env->exception_next_eip = env->eip + next_eip_addend;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 /* shortcuts to generate exceptions */
diff --git a/target-i386/misc_helper.c b/target-i386/misc_helper.c
index 582ad34ffe..8c6b9bfce2 100644
--- a/target-i386/misc_helper.c
+++ b/target-i386/misc_helper.c
@@ -569,11 +569,10 @@ void helper_rdmsr(CPUX86State *env)
 static void do_pause(X86CPU *cpu)
 {
     CPUState *cs = CPU(cpu);
-    CPUX86State *env = &cpu->env;
 
     /* Just let another CPU run.  */
     cs->exception_index = EXCP_INTERRUPT;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 static void do_hlt(X86CPU *cpu)
@@ -584,7 +583,7 @@ static void do_hlt(X86CPU *cpu)
     env->hflags &= ~HF_INHIBIT_IRQ_MASK; /* needed if sti is just before */
     cs->halted = 1;
     cs->exception_index = EXCP_HLT;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_hlt(CPUX86State *env, int next_eip_addend)
@@ -642,5 +641,5 @@ void helper_debug(CPUX86State *env)
     CPUState *cs = CPU(x86_env_get_cpu(env));
 
     cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index c8fd572d99..4e134e4338 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -939,7 +939,7 @@ void helper_syscall(CPUX86State *env, int next_eip_addend)
 
     cs->exception_index = EXCP_SYSCALL;
     env->exception_next_eip = env->eip + next_eip_addend;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 #else
 void helper_syscall(CPUX86State *env, int next_eip_addend)
diff --git a/target-i386/svm_helper.c b/target-i386/svm_helper.c
index 5e0504d7f0..de2c2eebe0 100644
--- a/target-i386/svm_helper.c
+++ b/target-i386/svm_helper.c
@@ -334,7 +334,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
             env->exception_is_int = 0;
             env->exception_next_eip = env->eip;
             qemu_log_mask(CPU_LOG_TB_IN_ASM, "NMI");
-            cpu_loop_exit(env);
+            cpu_loop_exit(cs);
             break;
         case SVM_EVTINJ_TYPE_EXEPT:
             cs->exception_index = vector;
@@ -342,7 +342,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
             env->exception_is_int = 0;
             env->exception_next_eip = -1;
             qemu_log_mask(CPU_LOG_TB_IN_ASM, "EXEPT");
-            cpu_loop_exit(env);
+            cpu_loop_exit(cs);
             break;
         case SVM_EVTINJ_TYPE_SOFT:
             cs->exception_index = vector;
@@ -350,7 +350,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
             env->exception_is_int = 1;
             env->exception_next_eip = env->eip;
             qemu_log_mask(CPU_LOG_TB_IN_ASM, "SOFT");
-            cpu_loop_exit(env);
+            cpu_loop_exit(cs);
             break;
         }
         qemu_log_mask(CPU_LOG_TB_IN_ASM, " %#x %#x\n", cs->exception_index,
@@ -772,7 +772,7 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     env->error_code = 0;
     env->old_exception = -1;
 
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
diff --git a/target-lm32/op_helper.c b/target-lm32/op_helper.c
index 7fc9191e19..f0859aab6d 100644
--- a/target-lm32/op_helper.c
+++ b/target-lm32/op_helper.c
@@ -28,7 +28,7 @@ void raise_exception(CPULM32State *env, int index)
     CPUState *cs = CPU(lm32_env_get_cpu(env));
 
     cs->exception_index = index;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(raise_exception)(CPULM32State *env, uint32_t index)
@@ -42,7 +42,7 @@ void HELPER(hlt)(CPULM32State *env)
 
     cs->halted = 1;
     cs->exception_index = EXCP_HLT;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(ill)(CPULM32State *env)
@@ -167,7 +167,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
             /* now we have a real cpu fault */
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 #endif
diff --git a/target-m68k/op_helper.c b/target-m68k/op_helper.c
index b1745b8796..d6268cd6b9 100644
--- a/target-m68k/op_helper.c
+++ b/target-m68k/op_helper.c
@@ -67,7 +67,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
             /* now we have a real cpu fault */
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 
@@ -114,7 +114,7 @@ static void do_interrupt_all(CPUM68KState *env, int is_hw)
             }
             cs->halted = 1;
             cs->exception_index = EXCP_HLT;
-            cpu_loop_exit(env);
+            cpu_loop_exit(cs);
             return;
         }
         if (cs->exception_index >= EXCP_TRAP0
@@ -170,7 +170,7 @@ static void raise_exception(CPUM68KState *env, int tt)
     CPUState *cs = CPU(m68k_env_get_cpu(env));
 
     cs->exception_index = tt;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(raise_exception)(CPUM68KState *env, uint32_t tt)
diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c
index 9e394114c8..f47613241d 100644
--- a/target-microblaze/op_helper.c
+++ b/target-microblaze/op_helper.c
@@ -56,7 +56,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
             /* now we have a real cpu fault */
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 #endif
@@ -101,7 +101,7 @@ void helper_raise_exception(CPUMBState *env, uint32_t index)
     CPUState *cs = CPU(mb_env_get_cpu(env));
 
     cs->exception_index = index;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_debug(CPUMBState *env)
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 8c050fc247..c65350187f 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -51,7 +51,7 @@ static inline void QEMU_NORETURN do_raise_exception_err(CPUMIPSState *env,
         cpu_restore_state(env, pc);
     }
 
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 static inline void QEMU_NORETURN do_raise_exception(CPUMIPSState *env,
@@ -280,7 +280,7 @@ static inline hwaddr do_translate_address(CPUMIPSState *env,
     lladdr = cpu_mips_translate_address(env, address, rw);
 
     if (lladdr == -1LL) {
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(mips_env_get_cpu(env)));
     } else {
         return lladdr;
     }
diff --git a/target-moxie/helper.c b/target-moxie/helper.c
index 06a4c728ee..3994c0910d 100644
--- a/target-moxie/helper.c
+++ b/target-moxie/helper.c
@@ -59,7 +59,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
             cpu_restore_state(env, retaddr);
         }
     }
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_raise_exception(CPUMoxieState *env, int ex)
@@ -74,7 +74,7 @@ void helper_raise_exception(CPUMoxieState *env, int ex)
     env->sregs[5] = env->pc;
     /* Jump the the exception handline routine.  */
     env->pc = env->sregs[1];
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 uint32_t helper_div(CPUMoxieState *env, uint32_t a, uint32_t b)
@@ -104,7 +104,7 @@ void helper_debug(CPUMoxieState *env)
     CPUState *cs = CPU(moxie_env_get_cpu(env));
 
     cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 #if defined(CONFIG_USER_ONLY)
diff --git a/target-openrisc/exception.c b/target-openrisc/exception.c
index b96f3f8963..74652a58f6 100644
--- a/target-openrisc/exception.c
+++ b/target-openrisc/exception.c
@@ -25,5 +25,5 @@ void QEMU_NORETURN raise_exception(OpenRISCCPU *cpu, uint32_t excp)
     CPUState *cs = CPU(cpu);
 
     cs->exception_index = excp;
-    cpu_loop_exit(&cpu->env);
+    cpu_loop_exit(cs);
 }
diff --git a/target-openrisc/mmu_helper.c b/target-openrisc/mmu_helper.c
index e3fe6c7127..5f7f6f5ac4 100644
--- a/target-openrisc/mmu_helper.c
+++ b/target-openrisc/mmu_helper.c
@@ -52,7 +52,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write,
             cpu_restore_state(env, retaddr);
         }
         /* Raise Exception.  */
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 #endif
diff --git a/target-ppc/excp_helper.c b/target-ppc/excp_helper.c
index a58655b5c7..4a587303a8 100644
--- a/target-ppc/excp_helper.c
+++ b/target-ppc/excp_helper.c
@@ -823,7 +823,7 @@ void helper_raise_exception_err(CPUPPCState *env, uint32_t exception,
 #endif
     cs->exception_index = exception;
     env->error_code = error_code;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_raise_exception(CPUPPCState *env, uint32_t exception)
diff --git a/target-s390x/cc_helper.c b/target-s390x/cc_helper.c
index a6d60bf885..d845f20de5 100644
--- a/target-s390x/cc_helper.c
+++ b/target-s390x/cc_helper.c
@@ -548,7 +548,7 @@ uint32_t HELPER(calc_cc)(CPUS390XState *env, uint32_t cc_op, uint64_t src,
 void HELPER(load_psw)(CPUS390XState *env, uint64_t mask, uint64_t addr)
 {
     load_psw(env, mask, addr);
-    cpu_loop_exit(env);
+    cpu_loop_exit(CPU(s390_env_get_cpu(env)));
 }
 
 void HELPER(sacf)(CPUS390XState *env, uint64_t a1)
diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
index 1e74e4d7e4..e89fcac4e2 100644
--- a/target-s390x/mem_helper.c
+++ b/target-s390x/mem_helper.c
@@ -58,7 +58,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
             /* now we have a real cpu fault */
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 
@@ -971,12 +971,12 @@ static uint32_t mvc_asc(CPUS390XState *env, int64_t l, uint64_t a1,
     }
 
     if (mmu_translate(env, a1 & TARGET_PAGE_MASK, 1, mode1, &dest, &flags)) {
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(s390_env_get_cpu(env)));
     }
     dest |= a1 & ~TARGET_PAGE_MASK;
 
     if (mmu_translate(env, a2 & TARGET_PAGE_MASK, 0, mode2, &src, &flags)) {
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(s390_env_get_cpu(env)));
     }
     src |= a2 & ~TARGET_PAGE_MASK;
 
diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c
index 69da9e56a9..2beec61a2b 100644
--- a/target-s390x/misc_helper.c
+++ b/target-s390x/misc_helper.c
@@ -61,7 +61,7 @@ void QEMU_NORETURN runtime_exception(CPUS390XState *env, int excp,
     env->int_pgm_ilen = t = get_ilen(t);
     env->psw.addr += 2 * t;
 
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 /* Raise an exception statically from a TB.  */
@@ -71,7 +71,7 @@ void HELPER(exception)(CPUS390XState *env, uint32_t excp)
 
     HELPER_LOG("%s: exception %d\n", __func__, excp);
     cs->exception_index = excp;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -93,7 +93,7 @@ void program_interrupt(CPUS390XState *env, uint32_t code, int ilen)
         env->int_pgm_code = code;
         env->int_pgm_ilen = ilen;
         cs->exception_index = EXCP_PGM;
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 
@@ -456,11 +456,11 @@ uint32_t HELPER(sigp)(CPUS390XState *env, uint64_t order_code, uint32_t r1,
 #if !defined(CONFIG_USER_ONLY)
     case SIGP_RESTART:
         qemu_system_reset_request();
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(s390_env_get_cpu(env)));
         break;
     case SIGP_STOP:
         qemu_system_shutdown_request();
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(s390_env_get_cpu(env)));
         break;
 #endif
     default:
diff --git a/target-sh4/op_helper.c b/target-sh4/op_helper.c
index 6e527cfcf3..271401f699 100644
--- a/target-sh4/op_helper.c
+++ b/target-sh4/op_helper.c
@@ -52,7 +52,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
         if (retaddr) {
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 
@@ -77,7 +77,7 @@ static inline void QEMU_NORETURN raise_exception(CPUSH4State *env, int index,
     if (retaddr) {
         cpu_restore_state(env, retaddr);
     }
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_raise_illegal_instruction(CPUSH4State *env)
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index a393ef0a48..fb5f6ecd38 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -27,7 +27,7 @@ void helper_raise_exception(CPUSPARCState *env, int tt)
     CPUState *cs = CPU(sparc_env_get_cpu(env));
 
     cs->exception_index = tt;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void helper_debug(CPUSPARCState *env)
@@ -35,7 +35,7 @@ void helper_debug(CPUSPARCState *env)
     CPUState *cs = CPU(sparc_env_get_cpu(env));
 
     cs->exception_index = EXCP_DEBUG;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 #ifdef TARGET_SPARC64
@@ -239,6 +239,6 @@ void helper_power_down(CPUSPARCState *env)
     cs->exception_index = EXCP_HLT;
     env->pc = env->npc;
     env->npc = env->pc + 4;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 #endif
diff --git a/target-sparc/ldst_helper.c b/target-sparc/ldst_helper.c
index 32d0bfda18..8302bb14c2 100644
--- a/target-sparc/ldst_helper.c
+++ b/target-sparc/ldst_helper.c
@@ -2451,7 +2451,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
         if (retaddr) {
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 #endif
diff --git a/target-unicore32/op_helper.c b/target-unicore32/op_helper.c
index 3efc6a80a4..c2bf834c27 100644
--- a/target-unicore32/op_helper.c
+++ b/target-unicore32/op_helper.c
@@ -19,7 +19,7 @@ void HELPER(exception)(CPUUniCore32State *env, uint32_t excp)
     CPUState *cs = CPU(uc32_env_get_cpu(env));
 
     cs->exception_index = excp;
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 static target_ulong asr_read(CPUUniCore32State *env)
@@ -271,7 +271,7 @@ void tlb_fill(CPUState *cs, target_ulong addr, int is_write,
             /* now we have a real cpu fault */
             cpu_restore_state(env, retaddr);
         }
-        cpu_loop_exit(env);
+        cpu_loop_exit(cs);
     }
 }
 #endif
diff --git a/target-xtensa/op_helper.c b/target-xtensa/op_helper.c
index 1c80e310ab..42653784cd 100644
--- a/target-xtensa/op_helper.c
+++ b/target-xtensa/op_helper.c
@@ -105,7 +105,7 @@ void HELPER(exception)(CPUXtensaState *env, uint32_t excp)
     if (excp == EXCP_DEBUG) {
         env->exception_taken = 0;
     }
-    cpu_loop_exit(env);
+    cpu_loop_exit(cs);
 }
 
 void HELPER(exception_cause)(CPUXtensaState *env, uint32_t pc, uint32_t cause)
@@ -391,7 +391,7 @@ void HELPER(waiti)(CPUXtensaState *env, uint32_t pc, uint32_t intlevel)
         (intlevel << PS_INTLEVEL_SHIFT);
     check_interrupts(env);
     if (env->pending_irq_level) {
-        cpu_loop_exit(env);
+        cpu_loop_exit(CPU(xtensa_env_get_cpu(env)));
         return;
     }
 
diff --git a/user-exec.c b/user-exec.c
index dbb9c8d0a7..e149c9732f 100644
--- a/user-exec.c
+++ b/user-exec.c
@@ -40,12 +40,12 @@
 
 static void exception_action(CPUArchState *env1)
 {
-#if defined(TARGET_I386)
     CPUState *cpu = ENV_GET_CPU(env1);
 
+#if defined(TARGET_I386)
     raise_exception_err(env1, cpu->exception_index, env1->error_code);
 #else
-    cpu_loop_exit(env1);
+    cpu_loop_exit(cpu);
 #endif
 }