diff --git a/cpu-all.h b/cpu-all.h
index 0356684e2f42c07765f676ee709ebcb01f8dd56a..c9c51b83ac4c3e811f7827fab1a72dfca0f8a6e8 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -464,7 +464,6 @@ void cpu_watchpoint_remove_all(CPUArchState *env, int mask);
 #define SSTEP_NOTIMER 0x4  /* Do not Timers while single stepping */
 
 void cpu_single_step(CPUArchState *env, int enabled);
-void run_on_cpu(CPUArchState *env, void (*func)(void *data), void *data);
 
 #if !defined(CONFIG_USER_ONLY)
 
diff --git a/cpus.c b/cpus.c
index 76f32fc0501470438aab2a9853a945a3dd38df8a..bee09b996fb34ef3aa5405c0cebbbf2562632054 100644
--- a/cpus.c
+++ b/cpus.c
@@ -640,9 +640,8 @@ void qemu_init_cpu_loop(void)
     qemu_thread_get_self(&io_thread);
 }
 
-void run_on_cpu(CPUArchState *env, void (*func)(void *data), void *data)
+void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
     struct qemu_work_item wi;
 
     if (qemu_cpu_is_self(cpu)) {
diff --git a/hw/kvm/apic.c b/hw/kvm/apic.c
index e4a7307ca5cebf797b58d07cb6e1053864b77643..8b65d513dba6d21509f758800938de5c4abf5e56 100644
--- a/hw/kvm/apic.c
+++ b/hw/kvm/apic.c
@@ -143,7 +143,7 @@ static void do_inject_external_nmi(void *data)
 
 static void kvm_apic_external_nmi(APICCommonState *s)
 {
-    run_on_cpu(&s->cpu->env, do_inject_external_nmi, s);
+    run_on_cpu(CPU(s->cpu), do_inject_external_nmi, s);
 }
 
 static uint64_t kvm_apic_mem_read(void *opaque, hwaddr addr,
diff --git a/hw/kvmvapic.c b/hw/kvmvapic.c
index 5e0a7c9384205c81a56bdb1ba507338f62219df4..dc111ee8e69232b330ae9365c1d82c507b6858ff 100644
--- a/hw/kvmvapic.c
+++ b/hw/kvmvapic.c
@@ -475,11 +475,13 @@ static void vapic_enable_tpr_reporting(bool enable)
     VAPICEnableTPRReporting info = {
         .enable = enable,
     };
+    X86CPU *cpu;
     CPUX86State *env;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        cpu = x86_env_get_cpu(env);
         info.apic = env->apic_state;
-        run_on_cpu(env, vapic_do_enable_tpr_reporting, &info);
+        run_on_cpu(CPU(cpu), vapic_do_enable_tpr_reporting, &info);
     }
 }
 
@@ -717,7 +719,7 @@ static int vapic_post_load(void *opaque, int version_id)
     }
     if (s->state == VAPIC_ACTIVE) {
         if (smp_cpus == 1) {
-            run_on_cpu(first_cpu, do_vapic_enable, s);
+            run_on_cpu(ENV_GET_CPU(first_cpu), do_vapic_enable, s);
         } else {
             zero = g_malloc0(s->rom_state.vapic_size);
             cpu_physical_memory_rw(s->vapic_paddr, zero,
diff --git a/hw/ppce500_spin.c b/hw/ppce500_spin.c
index 7f8c8428b62f26bee31f991924978eea1018b9b1..c1a155bd31636ffa43a6518f0dd2e877e6bc9f7d 100644
--- a/hw/ppce500_spin.c
+++ b/hw/ppce500_spin.c
@@ -163,7 +163,7 @@ static void spin_write(void *opaque, hwaddr addr, uint64_t value,
             .spin = curspin,
         };
 
-        run_on_cpu(env, spin_kick, &kick);
+        run_on_cpu(CPU(kick.cpu), spin_kick, &kick);
     }
 }
 
diff --git a/include/qemu/cpu.h b/include/qemu/cpu.h
index f04da6ec4f58dd11fd5a05b14a0c1e0c9dfac484..33f01d9a6f3ab87b9bc320f9857c32b591afe576 100644
--- a/include/qemu/cpu.h
+++ b/include/qemu/cpu.h
@@ -125,5 +125,15 @@ void qemu_cpu_kick(CPUState *cpu);
  */
 bool cpu_is_stopped(CPUState *cpu);
 
+/**
+ * run_on_cpu:
+ * @cpu: The vCPU to run on.
+ * @func: The function to be executed.
+ * @data: Data to pass to the function.
+ *
+ * Schedules the function @func for execution on the vCPU @cpu.
+ */
+void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data);
+
 
 #endif
diff --git a/kvm-all.c b/kvm-all.c
index e41e1c9531a9d7b010e823d421d1d832cff9867c..b6d04835765638f4457c98a1b83e2a8dc69aa848 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1500,8 +1500,10 @@ static void do_kvm_cpu_synchronize_state(void *_env)
 
 void kvm_cpu_synchronize_state(CPUArchState *env)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
+
     if (!env->kvm_vcpu_dirty) {
-        run_on_cpu(env, do_kvm_cpu_synchronize_state, env);
+        run_on_cpu(cpu, do_kvm_cpu_synchronize_state, env);
     }
 }
 
@@ -1787,6 +1789,7 @@ static void kvm_invoke_set_guest_debug(void *data)
 
 int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     struct kvm_set_guest_debug_data data;
 
     data.dbg.control = reinject_trap;
@@ -1797,7 +1800,7 @@ int kvm_update_guest_debug(CPUArchState *env, unsigned long reinject_trap)
     kvm_arch_update_guest_debug(env, &data.dbg);
     data.env = env;
 
-    run_on_cpu(env, kvm_invoke_set_guest_debug, &data);
+    run_on_cpu(cpu, kvm_invoke_set_guest_debug, &data);
     return data.err;
 }
 
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 45f4bed57f5219fdb018646af70c6f66aadd9ec8..bf206cfa97f803771916f7ce498ad82cdea15625 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1177,7 +1177,7 @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
         return;
     }
 
-    run_on_cpu(cenv, do_inject_x86_mce, &params);
+    run_on_cpu(CPU(cpu), do_inject_x86_mce, &params);
     if (flags & MCE_INJECT_BROADCAST) {
         params.bank = 1;
         params.status = MCI_STATUS_VAL | MCI_STATUS_UC;
@@ -1189,7 +1189,7 @@ void cpu_x86_inject_mce(Monitor *mon, X86CPU *cpu, int bank,
                 continue;
             }
             params.env = env;
-            run_on_cpu(cenv, do_inject_x86_mce, &params);
+            run_on_cpu(CPU(cpu), do_inject_x86_mce, &params);
         }
     }
 }