diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 1ed7d1e005..b42741f273 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -403,4 +403,29 @@ static inline CPUState *env_cpu(CPUArchState *env)
 {
     return &env_archcpu(env)->parent_obj;
 }
+
+/**
+ * env_neg(env)
+ * @env: The architecture environment
+ *
+ * Return the CPUNegativeOffsetState associated with the environment.
+ */
+static inline CPUNegativeOffsetState *env_neg(CPUArchState *env)
+{
+    ArchCPU *arch_cpu = container_of(env, ArchCPU, env);
+    return &arch_cpu->neg;
+}
+
+/**
+ * cpu_neg(cpu)
+ * @cpu: The generic CPUState
+ *
+ * Return the CPUNegativeOffsetState associated with the cpu.
+ */
+static inline CPUNegativeOffsetState *cpu_neg(CPUState *cpu)
+{
+    ArchCPU *arch_cpu = container_of(cpu, ArchCPU, parent_obj);
+    return &arch_cpu->neg;
+}
+
 #endif /* CPU_ALL_H */
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index fbe8945606..ad97991faf 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -227,4 +227,12 @@ typedef struct CPUTLB {
 
 #endif  /* !CONFIG_USER_ONLY && CONFIG_TCG */
 
+/*
+ * This structure must be placed in ArchCPU immedately
+ * before CPUArchState, as a field named "neg".
+ */
+typedef struct CPUNegativeOffsetState {
+    /* Empty */
+} CPUNegativeOffsetState;
+
 #endif
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index 93919bbaa2..c63fa929f6 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -267,6 +267,7 @@ struct AlphaCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUAlphaState env;
 
     /* This alarm doesn't exist in real hardware; we wish it did.  */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index df0409a703..cae0f509fc 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -711,6 +711,7 @@ struct ARMCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUARMState env;
 
     /* Coprocessor information */
diff --git a/target/cris/cpu.h b/target/cris/cpu.h
index b87a559137..9191553cd7 100644
--- a/target/cris/cpu.h
+++ b/target/cris/cpu.h
@@ -180,6 +180,7 @@ struct CRISCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUCRISState env;
 };
 
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 65986dacbf..21395c115c 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -218,6 +218,7 @@ struct HPPACPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUHPPAState env;
     QEMUTimer *alarm_timer;
 };
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index c5351bea7e..239f907f76 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1366,6 +1366,7 @@ struct X86CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUX86State env;
 
     bool hyperv_vapic;
diff --git a/target/lm32/cpu.h b/target/lm32/cpu.h
index deb83153b3..ff5c6893bc 100644
--- a/target/lm32/cpu.h
+++ b/target/lm32/cpu.h
@@ -186,6 +186,7 @@ struct LM32CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPULM32State env;
 
     uint32_t revision;
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 2b180cf18d..087e73f9e2 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -160,6 +160,7 @@ struct M68kCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUM68KState env;
 };
 
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index ff3abb61af..618fc8ff1f 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -287,6 +287,9 @@ struct MicroBlazeCPU {
 
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
+    CPUMBState env;
+
     /* Microblaze Configuration Settings */
     struct {
         bool stackprot;
@@ -306,8 +309,6 @@ struct MicroBlazeCPU {
         char *version;
         uint8_t pvr;
     } cfg;
-
-    CPUMBState env;
 };
 
 
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 49c226b587..0cb8c94be5 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1048,6 +1048,7 @@ struct MIPSCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUMIPSState env;
 };
 
diff --git a/target/moxie/cpu.h b/target/moxie/cpu.h
index 00b1486659..9be228c383 100644
--- a/target/moxie/cpu.h
+++ b/target/moxie/cpu.h
@@ -87,6 +87,7 @@ typedef struct MoxieCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUMoxieState env;
 } MoxieCPU;
 
diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
index 39a2471b18..875daa2d55 100644
--- a/target/nios2/cpu.h
+++ b/target/nios2/cpu.h
@@ -181,7 +181,9 @@ typedef struct Nios2CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUNios2State env;
+
     bool mmu_present;
     uint32_t pid_num_bits;
     uint32_t tlb_num_ways;
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index ad2118b599..20bc673dda 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -313,8 +313,8 @@ typedef struct OpenRISCCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUOpenRISCState env;
-
 } OpenRISCCPU;
 
 
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 038e2499ed..f2f5a498a4 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1172,7 +1172,9 @@ struct PowerPCCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUPPCState env;
+
     int vcpu_id;
     uint32_t compat_pvr;
     PPCVirtualHypervisor *vhyp;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 9e71297ca7..dd5d6a59ee 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -208,6 +208,7 @@ typedef struct RISCVCPU {
     /*< private >*/
     CPUState parent_obj;
     /*< public >*/
+    CPUNegativeOffsetState neg;
     CPURISCVState env;
 } RISCVCPU;
 
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 3a6a5ada86..6020de558e 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -156,6 +156,7 @@ struct S390CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUS390XState env;
     S390CPUModel *model;
     /* needed for live migration */
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 02269c09b8..249b11bda2 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -204,6 +204,7 @@ struct SuperHCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUSH4State env;
 };
 
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 02e40d381b..3c2b849b5a 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -529,6 +529,7 @@ struct SPARCCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUSPARCState env;
 };
 
diff --git a/target/tilegx/cpu.h b/target/tilegx/cpu.h
index 643b7dbd17..deb3e836ea 100644
--- a/target/tilegx/cpu.h
+++ b/target/tilegx/cpu.h
@@ -135,6 +135,7 @@ typedef struct TileGXCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUTLGState env;
 } TileGXCPU;
 
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index 9e60ef981b..8106c4be37 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -205,6 +205,7 @@ struct TriCoreCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUTriCoreState env;
 };
 
diff --git a/target/unicore32/cpu.h b/target/unicore32/cpu.h
index 12b8268f7b..83f9f36058 100644
--- a/target/unicore32/cpu.h
+++ b/target/unicore32/cpu.h
@@ -73,6 +73,7 @@ struct UniCore32CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUUniCore32State env;
 };
 
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index 6fddac3a2b..8cb041c93d 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -526,6 +526,7 @@ struct XtensaCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUXtensaState env;
 };
 
