diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 72ec34950bc983e7d74f83dee72581349bac1e22..f183213eabebd24ba3a91f5873fd183865f7bdd9 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -60,8 +60,8 @@ static void s390_cpu_initfn(Object *obj)
     env->tod_offset = TOD_UNIX_EPOCH +
                       (time2tod(mktimegm(&tm)) * 1000000000ULL);
     env->tod_basetime = 0;
-    env->tod_timer = qemu_new_timer_ns(vm_clock, s390x_tod_timer, env);
-    env->cpu_timer = qemu_new_timer_ns(vm_clock, s390x_cpu_timer, env);
+    env->tod_timer = qemu_new_timer_ns(vm_clock, s390x_tod_timer, cpu);
+    env->cpu_timer = qemu_new_timer_ns(vm_clock, s390x_cpu_timer, cpu);
 #endif
     env->cpu_num = cpu_num++;
     env->ext_index = -1;
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index 6233f9ac3ea1b8c2d33af5ee14fc9ec9956ba883..209a69603cbaca7b79d64d0185dc7b255b8ada18 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -53,7 +53,8 @@
 #ifndef CONFIG_USER_ONLY
 void s390x_tod_timer(void *opaque)
 {
-    CPUS390XState *env = opaque;
+    S390CPU *cpu = opaque;
+    CPUS390XState *env = &cpu->env;
 
     env->pending_int |= INTERRUPT_TOD;
     cpu_interrupt(env, CPU_INTERRUPT_HARD);
@@ -61,7 +62,8 @@ void s390x_tod_timer(void *opaque)
 
 void s390x_cpu_timer(void *opaque)
 {
-    CPUS390XState *env = opaque;
+    S390CPU *cpu = opaque;
+    CPUS390XState *env = &cpu->env;
 
     env->pending_int |= INTERRUPT_CPUTIMER;
     cpu_interrupt(env, CPU_INTERRUPT_HARD);