diff --git a/cpus.c b/cpus.c
index 5acb98b..439a0d8 100644
--- a/cpus.c
+++ b/cpus.c
@@ -128,7 +128,7 @@ int64_t cpu_get_icount(void)
     icount = qemu_icount;
     if (cpu) {
         CPUArchState *env = cpu->env_ptr;
-        if (!can_do_io(env)) {
+        if (!cpu_can_do_io(cpu)) {
             fprintf(stderr, "Bad clock read\n");
         }
         icount -= (env->icount_decr.u16.low + env->icount_extra);
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index d8e1af8..a2726c1 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -156,7 +156,6 @@ typedef struct CPUWatchpoint {
         uint32_t u32;                                                   \
         icount_decr_u16 u16;                                            \
     } icount_decr;                                                      \
-    uint32_t can_do_io; /* nonzero if memory mapped IO is safe.  */     \
                                                                         \
     /* from this point: preserved by CPU reset */                       \
     /* ice debug support */                                             \
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index beb4149..e61b3f1 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -422,20 +422,25 @@ extern int singlestep;
 /* cpu-exec.c */
 extern volatile sig_atomic_t exit_request;
 
-/* Deterministic execution requires that IO only be performed on the last
-   instruction of a TB so that interrupts take effect immediately.  */
-static inline int can_do_io(CPUArchState *env)
+/**
+ * cpu_can_do_io:
+ * @cpu: The CPU for which to check IO.
+ *
+ * Deterministic execution requires that IO only be performed on the last
+ * instruction of a TB so that interrupts take effect immediately.
+ *
+ * Returns: %true if memory-mapped IO is safe, %false otherwise.
+ */
+static inline bool cpu_can_do_io(CPUState *cpu)
 {
-    CPUState *cpu = ENV_GET_CPU(env);
-
     if (!use_icount) {
-        return 1;
+        return true;
     }
     /* If not executing code then assume we are ok.  */
     if (cpu->current_tb == NULL) {
-        return 1;
+        return true;
     }
-    return env->can_do_io != 0;
+    return cpu->can_do_io != 0;
 }
 
 #endif
diff --git a/include/exec/gen-icount.h b/include/exec/gen-icount.h
index 39a6b61..f0dace3 100644
--- a/include/exec/gen-icount.h
+++ b/include/exec/gen-icount.h
@@ -51,14 +51,14 @@ static void gen_tb_end(TranslationBlock *tb, int num_insns)
 static inline void gen_io_start(void)
 {
     TCGv_i32 tmp = tcg_const_i32(1);
-    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUArchState, can_do_io));
+    tcg_gen_st_i32(tmp, cpu_env, -ENV_OFFSET + offsetof(CPUState, can_do_io));
     tcg_temp_free_i32(tmp);
 }
 
 static inline void gen_io_end(void)
 {
     TCGv_i32 tmp = tcg_const_i32(0);
-    tcg_gen_st_i32(tmp, cpu_env, offsetof(CPUArchState, can_do_io));
+    tcg_gen_st_i32(tmp, cpu_env, -ENV_OFFSET + offsetof(CPUState, can_do_io));
     tcg_temp_free_i32(tmp);
 }
 
diff --git a/include/exec/softmmu_template.h b/include/exec/softmmu_template.h
index 8b74d4f..bbfda31 100644
--- a/include/exec/softmmu_template.h
+++ b/include/exec/softmmu_template.h
@@ -81,7 +81,7 @@ static inline DATA_TYPE glue(io_read, SUFFIX)(CPUArchState *env,
 
     physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
     cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !can_do_io(env)) {
+    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu_can_do_io(cpu)) {
         cpu_io_recompile(env, retaddr);
     }
 
@@ -201,7 +201,7 @@ static inline void glue(io_write, SUFFIX)(CPUArchState *env,
     MemoryRegion *mr = iotlb_to_region(physaddr);
 
     physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !can_do_io(env)) {
+    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu_can_do_io(cpu)) {
         cpu_io_recompile(env, retaddr);
     }
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index d79466a..88cbb9d 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -160,6 +160,7 @@ struct kvm_run;
  * @tcg_exit_req: Set to force TCG to stop executing linked TBs for this
  *           CPU and return to its top level loop.
  * @singlestep_enabled: Flags for single-stepping.
+ * @can_do_io: Nonzero if memory-mapped IO is safe.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @gdb_regs: Additional GDB registers.
@@ -220,6 +221,7 @@ struct CPUState {
     /* TODO Move common fields from CPUArchState here. */
     int cpu_index; /* used by alpha TCG */
     uint32_t halted; /* used by alpha, cris, ppc TCG */
+    uint32_t can_do_io;
 };
 
 QTAILQ_HEAD(CPUTailQ, CPUState);
diff --git a/qom/cpu.c b/qom/cpu.c
index bf3c913..96b8771 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -200,6 +200,7 @@ static void cpu_common_reset(CPUState *cpu)
     cpu->halted = 0;
     cpu->mem_io_pc = 0;
     cpu->mem_io_vaddr = 0;
+    cpu->can_do_io = 0;
 }
 
 static int cpu_common_mmu_index(const CPUState *cs)
diff --git a/translate-all.c b/translate-all.c
index 73ff1cf..69dea6e 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -196,6 +196,7 @@ int cpu_gen_code(CPUArchState *env, TranslationBlock *tb, int *gen_code_size_ptr
 static int cpu_restore_state_from_tb(TranslationBlock *tb, CPUArchState *env,
                                      uintptr_t searched_pc)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     TCGContext *s = &tcg_ctx;
     int j;
     uintptr_t tc_ptr;
@@ -214,7 +215,7 @@ static int cpu_restore_state_from_tb(TranslationBlock *tb, CPUArchState *env,
         /* Reset the cycle counter to the start of the block.  */
         env->icount_decr.u16.low += tb->icount;
         /* Clear the IO flag.  */
-        env->can_do_io = 0;
+        cpu->can_do_io = 0;
     }
 
     /* find opc index corresponding to search_pc */
@@ -1422,7 +1423,7 @@ static void tcg_handle_interrupt(CPUState *cpu, int mask)
 
     if (use_icount) {
         env->icount_decr.u16.high = 0xffff;
-        if (!can_do_io(env)
+        if (!cpu_can_do_io(cpu)
             && (mask & ~old_mask) != 0) {
             cpu_abort(env, "Raised interrupt while not in I/O function");
         }
