diff --git a/cputlb.c b/cputlb.c
index 343ede2bbb..8a00330db3 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -261,7 +261,7 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
     }
 
     code_address = address;
-    iotlb = memory_region_section_get_iotlb(env, section, vaddr, paddr, xlat,
+    iotlb = memory_region_section_get_iotlb(cpu, section, vaddr, paddr, xlat,
                                             prot, &address);
 
     index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
diff --git a/exec.c b/exec.c
index 7b377cdb70..82580c5e0d 100644
--- a/exec.c
+++ b/exec.c
@@ -799,14 +799,13 @@ static void cpu_physical_memory_set_dirty_tracking(bool enable)
     in_migration = enable;
 }
 
-hwaddr memory_region_section_get_iotlb(CPUArchState *env,
+hwaddr memory_region_section_get_iotlb(CPUState *cpu,
                                        MemoryRegionSection *section,
                                        target_ulong vaddr,
                                        hwaddr paddr, hwaddr xlat,
                                        int prot,
                                        target_ulong *address)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     hwaddr iotlb;
     CPUWatchpoint *wp;
 
diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index 31df03c525..b8ecd6f68d 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -36,7 +36,7 @@ void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr);
 MemoryRegionSection *
 address_space_translate_for_iotlb(AddressSpace *as, hwaddr addr, hwaddr *xlat,
                                   hwaddr *plen);
-hwaddr memory_region_section_get_iotlb(CPUArchState *env,
+hwaddr memory_region_section_get_iotlb(CPUState *cpu,
                                        MemoryRegionSection *section,
                                        target_ulong vaddr,
                                        hwaddr paddr, hwaddr xlat,