diff --git a/inc/hf/vm.h b/inc/hf/vm.h
index a6bda8b..c54c5f0 100644
--- a/inc/hf/vm.h
+++ b/inc/hf/vm.h
@@ -97,3 +97,4 @@
 struct vm *vm_get(uint32_t id);
 struct vm_locked vm_lock(struct vm *vm);
 void vm_unlock(struct vm_locked *locked);
+struct vcpu *vm_get_vcpu(struct vm *vm, uint32_t vcpu_index);
diff --git a/src/api.c b/src/api.c
index 16af2d0..7babccd 100644
--- a/src/api.c
+++ b/src/api.c
@@ -67,7 +67,7 @@
 					  enum vcpu_state secondary_state)
 {
 	struct vm *primary = vm_get(HF_PRIMARY_VM_ID);
-	struct vcpu *next = &primary->vcpus[cpu_index(current->cpu)];
+	struct vcpu *next = vm_get_vcpu(primary, cpu_index(current->cpu));
 
 	/*
 	 * If the secondary is blocked but has a timer running, sleep until the
@@ -491,7 +491,7 @@
 	}
 
 	/* Update state if allowed. */
-	vcpu = &vm->vcpus[vcpu_idx];
+	vcpu = vm_get_vcpu(vm, vcpu_idx);
 	if (!api_vcpu_prepare_run(current, vcpu, &ret)) {
 		goto out;
 	}
@@ -1159,7 +1159,7 @@
 		return -1;
 	}
 
-	target_vcpu = &target_vm->vcpus[target_vcpu_idx];
+	target_vcpu = vm_get_vcpu(target_vm, target_vcpu_idx);
 
 	dlog("Injecting IRQ %d for VM %d VCPU %d from VM %d VCPU %d\n", intid,
 	     target_vm_id, target_vcpu_idx, current->vm->id, current->cpu->id);
diff --git a/src/cpu.c b/src/cpu.c
index 7a2ffe2..7d181dc 100644
--- a/src/cpu.c
+++ b/src/cpu.c
@@ -123,7 +123,7 @@
 
 	if (!prev) {
 		struct vm *vm = vm_get(HF_PRIMARY_VM_ID);
-		struct vcpu *vcpu = &vm->vcpus[cpu_index(c)];
+		struct vcpu *vcpu = vm_get_vcpu(vm, cpu_index(c));
 		struct vcpu_locked vcpu_locked;
 
 		vcpu_locked = vcpu_lock(vcpu);
diff --git a/src/load.c b/src/load.c
index aa1f19d..c1da513 100644
--- a/src/load.c
+++ b/src/load.c
@@ -158,7 +158,7 @@
 			return false;
 		}
 
-		vcpu_locked = vcpu_lock(&vm->vcpus[0]);
+		vcpu_locked = vcpu_lock(vm_get_vcpu(vm, 0));
 		vcpu_on(vcpu_locked, ipa_from_pa(primary_begin), kernel_arg);
 		vcpu_unlock(&vcpu_locked);
 	}
@@ -352,7 +352,7 @@
 		dlog("Loaded with %u vcpus, entry at 0x%x\n", cpu,
 		     pa_addr(secondary_mem_begin));
 
-		vcpu = &vm->vcpus[0];
+		vcpu = vm_get_vcpu(vm, 0);
 		vcpu_secondary_reset_and_start(
 			vcpu, secondary_entry,
 			pa_difference(secondary_mem_begin, secondary_mem_end));
diff --git a/src/main.c b/src/main.c
index 6263c32..bd4c319 100644
--- a/src/main.c
+++ b/src/main.c
@@ -146,7 +146,7 @@
 		panic("mm_cpu_init failed");
 	}
 
-	vcpu = &vm_get(HF_PRIMARY_VM_ID)->vcpus[cpu_index(c)];
+	vcpu = vm_get_vcpu(vm_get(HF_PRIMARY_VM_ID), cpu_index(c));
 	vm = vcpu->vm;
 	vcpu->cpu = c;
 
diff --git a/src/vm.c b/src/vm.c
index e136e84..c154eca 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -60,7 +60,7 @@
 
 	/* Do basic initialization of vcpus. */
 	for (i = 0; i < vcpu_count; i++) {
-		vcpu_init(&vm->vcpus[i], vm);
+		vcpu_init(vm_get_vcpu(vm, i), vm);
 	}
 
 	++vm_count;
@@ -107,3 +107,13 @@
 	sl_unlock(&locked->vm->lock);
 	locked->vm = NULL;
 }
+
+/**
+ * Get the vCPU with the given index from the given VM.
+ * This assumes the index is valid, i.e. less than vm->vcpu_count.
+ */
+struct vcpu *vm_get_vcpu(struct vm *vm, uint32_t vcpu_index)
+{
+	assert(vcpu_index < vm->vcpu_count);
+	return &vm->vcpus[vcpu_index];
+}