diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 71154070a7..5ae83405c8 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -404,4 +404,28 @@ static inline CPUState *env_cpu(CPUArchState *env)
     return &env_archcpu(env)->parent_obj;
 }
 
+/**
+ * env_neg(env)
+ * @env: The architecture environment
+ *
+ * Return the CPUNegativeOffsetState associated with the environment.
+ */
+static inline CPUNegativeOffsetState *env_neg(CPUArchState *env)
+{
+    ArchCPU *arch_cpu = container_of(env, ArchCPU, env);
+    return &arch_cpu->neg;
+}
+
+/**
+ * cpu_neg(cpu)
+ * @cpu: The generic CPUState
+ *
+ * Return the CPUNegativeOffsetState associated with the cpu.
+ */
+static inline CPUNegativeOffsetState *cpu_neg(CPUState *cpu)
+{
+    ArchCPU *arch_cpu = container_of(cpu, ArchCPU, parent_obj);
+    return &arch_cpu->neg;
+}
+
 #endif /* CPU_ALL_H */
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index b9ec261b01..921fbb4c36 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -227,4 +227,12 @@ typedef struct CPUTLB {
 
 #endif  /* !CONFIG_USER_ONLY && CONFIG_TCG */
 
+/*
+ * This structure must be placed in ArchCPU immedately
+ * before CPUArchState, as a field named "neg".
+ */
+typedef struct CPUNegativeOffsetState {
+    /* Empty */
+} CPUNegativeOffsetState;
+
 #endif
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index 361f85c976..94fbc00a3b 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -272,6 +272,7 @@ struct AlphaCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUAlphaState env;
 
     /* This alarm doesn't exist in real hardware; we wish it did.  */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index abe6fce7ab..5965c52f0c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -721,6 +721,7 @@ struct ARMCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUARMState env;
 
     /* Coprocessor information */
diff --git a/target/cris/cpu.h b/target/cris/cpu.h
index 83c350377a..ad93d1a9ee 100644
--- a/target/cris/cpu.h
+++ b/target/cris/cpu.h
@@ -180,6 +180,7 @@ struct CRISCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUCRISState env;
 };
 
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 7f9f54731b..f7c6205218 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -218,6 +218,7 @@ struct HPPACPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUHPPAState env;
     QEMUTimer *alarm_timer;
 };
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 3a155c12d3..e7580a86e5 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1369,6 +1369,7 @@ struct X86CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUX86State env;
 
     bool hyperv_vapic;
diff --git a/target/lm32/cpu.h b/target/lm32/cpu.h
index 2c934472d6..324bc90f81 100644
--- a/target/lm32/cpu.h
+++ b/target/lm32/cpu.h
@@ -186,6 +186,7 @@ struct LM32CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPULM32State env;
 
     uint32_t revision;
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 4006663494..d92263b750 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -160,6 +160,7 @@ struct M68kCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUM68KState env;
 };
 
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index a17c12ca2f..d90c4fbcb5 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -287,6 +287,9 @@ struct MicroBlazeCPU {
 
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
+    CPUMBState env;
+
     /* Microblaze Configuration Settings */
     struct {
         bool stackprot;
@@ -306,8 +309,6 @@ struct MicroBlazeCPU {
         char *version;
         uint8_t pvr;
     } cfg;
-
-    CPUMBState env;
 };
 
 
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 24fe25f61c..62af24937d 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1068,6 +1068,7 @@ struct MIPSCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUMIPSState env;
 };
 
diff --git a/target/moxie/cpu.h b/target/moxie/cpu.h
index 3d418c8f1d..c6b681531d 100644
--- a/target/moxie/cpu.h
+++ b/target/moxie/cpu.h
@@ -87,6 +87,7 @@ typedef struct MoxieCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUMoxieState env;
 } MoxieCPU;
 
diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
index c96d797dda..8cc3d4971e 100644
--- a/target/nios2/cpu.h
+++ b/target/nios2/cpu.h
@@ -182,7 +182,9 @@ typedef struct Nios2CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUNios2State env;
+
     bool mmu_present;
     uint32_t pid_num_bits;
     uint32_t tlb_num_ways;
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index 39e2765aa2..51723e9312 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -313,8 +313,8 @@ typedef struct OpenRISCCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUOpenRISCState env;
-
 } OpenRISCCPU;
 
 
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 73b92c189c..e8962e4655 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1184,7 +1184,9 @@ struct PowerPCCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUPPCState env;
+
     int vcpu_id;
     uint32_t compat_pvr;
     PPCVirtualHypervisor *vhyp;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index d9611eaced..0ed7031915 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -210,6 +210,7 @@ typedef struct RISCVCPU {
     /*< private >*/
     CPUState parent_obj;
     /*< public >*/
+    CPUNegativeOffsetState neg;
     CPURISCVState env;
 
     /* Configuration Settings */
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index 971dc0ccbd..ebcf7863e4 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -156,6 +156,7 @@ struct S390CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUS390XState env;
     S390CPUModel *model;
     /* needed for live migration */
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 610a8db6de..e266db411f 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -204,6 +204,7 @@ struct SuperHCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUSH4State env;
 };
 
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 0cc36873ce..a3c4f47d40 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -529,6 +529,7 @@ struct SPARCCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUSPARCState env;
 };
 
diff --git a/target/tilegx/cpu.h b/target/tilegx/cpu.h
index 643b7dbd17..deb3e836ea 100644
--- a/target/tilegx/cpu.h
+++ b/target/tilegx/cpu.h
@@ -135,6 +135,7 @@ typedef struct TileGXCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUTLGState env;
 } TileGXCPU;
 
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index 9f45bb5c24..03b293c1f6 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -205,6 +205,7 @@ struct TriCoreCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUTriCoreState env;
 };
 
diff --git a/target/unicore32/cpu.h b/target/unicore32/cpu.h
index c1130e9548..39beb32366 100644
--- a/target/unicore32/cpu.h
+++ b/target/unicore32/cpu.h
@@ -73,6 +73,7 @@ struct UniCore32CPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUUniCore32State env;
 };
 
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index e89605747a..e2d7e8371d 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -556,6 +556,7 @@ struct XtensaCPU {
     CPUState parent_obj;
     /*< public >*/
 
+    CPUNegativeOffsetState neg;
     CPUXtensaState env;
 };
 
