diff --git a/cpus.c b/cpus.c
index eda6d02..05016dc 100644
--- a/cpus.c
+++ b/cpus.c
@@ -140,7 +140,7 @@
     icount = qemu_icount;
     if (cpu) {
         CPUArchState *env = cpu->env_ptr;
-        if (!can_do_io(env)) {
+        if (!cpu_can_do_io(cpu)) {
             fprintf(stderr, "Bad clock read\n");
         }
         icount -= (env->icount_decr.u16.low + env->icount_extra);
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index bdcfefb3..068b6c1 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -157,7 +157,6 @@
         uint32_t u32;                                                   \
         icount_decr_u16 u16;                                            \
     } icount_decr;                                                      \
-    uint32_t can_do_io; /* nonzero if memory mapped IO is safe.  */     \
                                                                         \
     /* from this point: preserved by CPU reset */                       \
     /* ice debug support */                                             \
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index a387922..2179329 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -380,20 +380,25 @@
 /* cpu-exec.c */
 extern volatile sig_atomic_t exit_request;
 
-/* Deterministic execution requires that IO only be performed on the last
-   instruction of a TB so that interrupts take effect immediately.  */
-static inline int can_do_io(CPUArchState *env)
+/**
+ * cpu_can_do_io:
+ * @cpu: The CPU for which to check IO.
+ *
+ * Deterministic execution requires that IO only be performed on the last
+ * instruction of a TB so that interrupts take effect immediately.
+ *
+ * Returns: %true if memory-mapped IO is safe, %false otherwise.
+ */
+static inline bool cpu_can_do_io(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     if (!use_icount) {
-        return 1;
+        return true;
     }
     /* If not executing code then assume we are ok.  */
     if (cpu->current_tb == NULL) {
-        return 1;
+        return true;
     }
-    return env->can_do_io != 0;
+    return cpu->can_do_io != 0;
 }
 
 #endif
diff --git a/include/exec/gen-icount.h b/include/exec/gen-icount.h
index 39a6b61..f0dace3 100644
--- a/include/exec/gen-icount.h
+++ b/include/exec/gen-icount.h
@@ -51,14 +51,14 @@
 static inline void gen_io_start(void)
 {
     TCGv_i32 tmp = tcg_const_i32(1);
-    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUArchState, can_do_io));
+    tcg_gen_st_i32(tmp, cpu_env, -ENV_OFFSET + offsetof(CPUState, can_do_io));
     tcg_temp_free_i32(tmp);
 }
 
 static inline void gen_io_end(void)
 {
     TCGv_i32 tmp = tcg_const_i32(0);
-    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUArchState, can_do_io));
+    tcg_gen_st_i32(tmp, cpu_env, -ENV_OFFSET + offsetof(CPUState, can_do_io));
     tcg_temp_free_i32(tmp);
 }
 
diff --git a/include/exec/softmmu_template.h b/include/exec/softmmu_template.h
index c7cd937..ac825d2 100644
--- a/include/exec/softmmu_template.h
+++ b/include/exec/softmmu_template.h
@@ -127,7 +127,7 @@
 
     physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !can_do_io(env)) {
+    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu_can_do_io(cpu)) {
         cpu_io_recompile(env, retaddr);
     }
 
@@ -333,7 +333,7 @@
     MemoryRegion *mr = iotlb_to_region(cpu->as, physaddr);
 
     physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !can_do_io(env)) {
+    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu_can_do_io(cpu)) {
         cpu_io_recompile(env, retaddr);
     }
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 9d52cf3..f80036e 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -157,6 +157,7 @@
  * @tcg_exit_req: Set to force TCG to stop executing linked TBs for this
  *           CPU and return to its top level loop.
  * @singlestep_enabled: Flags for single-stepping.
+ * @can_do_io: Nonzero if memory-mapped IO is safe.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @gdb_regs: Additional GDB registers.
@@ -220,6 +221,7 @@
     /* TODO Move common fields from CPUArchState here. */
     int cpu_index; /* used by alpha TCG */
     uint32_t halted; /* used by alpha, cris, ppc TCG */
+    uint32_t can_do_io;
 };
 
 QTAILQ_HEAD(CPUTailQ, CPUState);
diff --git a/qom/cpu.c b/qom/cpu.c
index 4d60c03..e7d5999 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -241,6 +241,7 @@
     cpu->halted = 0;
     cpu->mem_io_pc = 0;
     cpu->mem_io_vaddr = 0;
+    cpu->can_do_io = 0;
 }
 
 static bool cpu_common_has_work(CPUState *cs)
diff --git a/translate-all.c b/translate-all.c
index dc35caa..a1af5ef 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -200,6 +200,7 @@
 static int cpu_restore_state_from_tb(TranslationBlock *tb, CPUArchState *env,
                                      uintptr_t searched_pc)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     TCGContext *s = &tcg_ctx;
     int j;
     uintptr_t tc_ptr;
@@ -218,7 +219,7 @@
         /* Reset the cycle counter to the start of the block.  */
         env->icount_decr.u16.low += tb->icount;
         /* Clear the IO flag.  */
-        env->can_do_io = 0;
+        cpu->can_do_io = 0;
     }
 
     /* find opc index corresponding to search_pc */
@@ -1409,7 +1410,7 @@
 
     if (use_icount) {
         env->icount_decr.u16.high = 0xffff;
-        if (!can_do_io(env)
+        if (!cpu_can_do_io(cpu)
             && (mask & ~old_mask) != 0) {
             cpu_abort(env, "Raised interrupt while not in I/O function");
         }