diff --git a/hw/tpm/tpm_emulator.c b/hw/tpm/tpm_emulator.c
index a613cec456..6500b86b41 100644
--- a/hw/tpm/tpm_emulator.c
+++ b/hw/tpm/tpm_emulator.c
@@ -180,8 +180,7 @@ static void tpm_emulator_handle_request(TPMBackend *tb, TPMBackendCmd *cmd)
 
     DPRINTF("processing TPM command");
 
-    if (tpm_emulator_set_locality(tpm_emu,
-                                  tb->tpm_state->locty_number, &err) < 0) {
+    if (tpm_emulator_set_locality(tpm_emu, cmd->locty, &err) < 0) {
         goto error;
     }
 
diff --git a/hw/tpm/tpm_int.h b/hw/tpm/tpm_int.h
index 6d7b3dc850..252c4082ef 100644
--- a/hw/tpm/tpm_int.h
+++ b/hw/tpm/tpm_int.h
@@ -24,8 +24,6 @@ struct TPMState {
         TPMTISEmuState tis;
     } s;
 
-    uint8_t     locty_number;
-    TPMLocality *locty_data;
     TPMBackendCmd cmd;
 
     char *backend;
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index ffed7bfaf9..ad2845622e 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -203,12 +203,10 @@ static void tpm_tis_sts_set(TPMLocality *l, uint32_t flags)
 static void tpm_tis_tpm_send(TPMState *s, uint8_t locty)
 {
     TPMTISEmuState *tis = &s->s.tis;
+    TPMLocality *locty_data = &tis->loc[locty];
 
     tpm_tis_show_buffer(&tis->loc[locty].w_buffer, "tpm_tis: To TPM");
 
-    s->locty_number = locty;
-    s->locty_data = &tis->loc[locty];
-
     /*
      * w_offset serves as length indicator for length of data;
      * it's reset when the response comes back
@@ -217,10 +215,10 @@ static void tpm_tis_tpm_send(TPMState *s, uint8_t locty)
 
     s->cmd = (TPMBackendCmd) {
         .locty = locty,
-        .in = s->locty_data->w_buffer.buffer,
-        .in_len = s->locty_data->w_offset,
-        .out = s->locty_data->r_buffer.buffer,
-        .out_len = s->locty_data->r_buffer.size
+        .in = locty_data->w_buffer.buffer,
+        .in_len = locty_data->w_offset,
+        .out = locty_data->r_buffer.buffer,
+        .out_len = locty_data->r_buffer.size
     };
 
     tpm_backend_deliver_request(s->be_driver, &s->cmd);