diff --git a/cpu-exec.c b/cpu-exec.c
index 6559d5e922..4a03d83cba 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -650,15 +650,15 @@ int cpu_exec(CPUArchState *env)
                         int insns_left;
                         tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
                         insns_left = env->icount_decr.u32;
-                        if (env->icount_extra && insns_left >= 0) {
+                        if (cpu->icount_extra && insns_left >= 0) {
                             /* Refill decrementer and continue execution.  */
-                            env->icount_extra += insns_left;
-                            if (env->icount_extra > 0xffff) {
+                            cpu->icount_extra += insns_left;
+                            if (cpu->icount_extra > 0xffff) {
                                 insns_left = 0xffff;
                             } else {
-                                insns_left = env->icount_extra;
+                                insns_left = cpu->icount_extra;
                             }
-                            env->icount_extra -= insns_left;
+                            cpu->icount_extra -= insns_left;
                             env->icount_decr.u16.low = insns_left;
                         } else {
                             if (insns_left > 0) {
diff --git a/cpus.c b/cpus.c
index 05016dc9c7..e9c17ae942 100644
--- a/cpus.c
+++ b/cpus.c
@@ -143,7 +143,7 @@ static int64_t cpu_get_icount_locked(void)
         if (!cpu_can_do_io(cpu)) {
             fprintf(stderr, "Bad clock read\n");
         }
-        icount -= (env->icount_decr.u16.low + env->icount_extra);
+        icount -= (env->icount_decr.u16.low + cpu->icount_extra);
     }
     return qemu_icount_bias + (icount << icount_time_shift);
 }
@@ -1236,6 +1236,7 @@ int vm_stop_force_state(RunState state)
 
 static int tcg_cpu_exec(CPUArchState *env)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     int ret;
 #ifdef CONFIG_PROFILER
     int64_t ti;
@@ -1248,9 +1249,9 @@ static int tcg_cpu_exec(CPUArchState *env)
         int64_t count;
         int64_t deadline;
         int decr;
-        qemu_icount -= (env->icount_decr.u16.low + env->icount_extra);
+        qemu_icount -= (env->icount_decr.u16.low + cpu->icount_extra);
         env->icount_decr.u16.low = 0;
-        env->icount_extra = 0;
+        cpu->icount_extra = 0;
         deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
 
         /* Maintain prior (possibly buggy) behaviour where if no deadline
@@ -1267,7 +1268,7 @@ static int tcg_cpu_exec(CPUArchState *env)
         decr = (count > 0xffff) ? 0xffff : count;
         count -= decr;
         env->icount_decr.u16.low = decr;
-        env->icount_extra = count;
+        cpu->icount_extra = count;
     }
     ret = cpu_exec(env);
 #ifdef CONFIG_PROFILER
@@ -1276,10 +1277,9 @@ static int tcg_cpu_exec(CPUArchState *env)
     if (use_icount) {
         /* Fold pending instructions back into the
            instruction counter, and clear the interrupt flag.  */
-        qemu_icount -= (env->icount_decr.u16.low
-                        + env->icount_extra);
+        qemu_icount -= (env->icount_decr.u16.low + cpu->icount_extra);
         env->icount_decr.u32 = 0;
-        env->icount_extra = 0;
+        cpu->icount_extra = 0;
     }
     return ret;
 }
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 068b6c168f..8f9871c40e 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -149,7 +149,6 @@ typedef struct CPUWatchpoint {
     CPU_COMMON_TLB                                                      \
     struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];           \
                                                                         \
-    int64_t icount_extra; /* Instructions until next timer event.  */   \
     /* Number of cycles left, with interrupt flag in high bit.          \
        This allows a single read-compare-cbranch-write sequence to test \
        for both decrementer underflow and exceptions.  */               \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index f80036e99b..012a7e6e79 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -157,6 +157,7 @@ struct kvm_run;
  * @tcg_exit_req: Set to force TCG to stop executing linked TBs for this
  *           CPU and return to its top level loop.
  * @singlestep_enabled: Flags for single-stepping.
+ * @icount_extra: Instructions until next timer event.
  * @can_do_io: Nonzero if memory-mapped IO is safe.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
@@ -196,6 +197,7 @@ struct CPUState {
     volatile sig_atomic_t tcg_exit_req;
     uint32_t interrupt_request;
     int singlestep_enabled;
+    int64_t icount_extra;
 
     AddressSpace *as;
     MemoryListener *tcg_as_listener;
diff --git a/qom/cpu.c b/qom/cpu.c
index e7d59997ee..a4f6a784af 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -241,6 +241,7 @@ static void cpu_common_reset(CPUState *cpu)
     cpu->halted = 0;
     cpu->mem_io_pc = 0;
     cpu->mem_io_vaddr = 0;
+    cpu->icount_extra = 0;
     cpu->can_do_io = 0;
 }