cpu: Move breakpoints field from CPU_COMMON to CPUState

Most targets were using offsetof(CPUFooState, breakpoints) to determine
how much of CPUFooState to clear on reset. Use the next field after
CPU_COMMON instead, if any, or sizeof(CPUFooState) otherwise.

Signed-off-by: Andreas Färber <afaerber@suse.de>

43 files changed, 94 insertions, 73 deletions

diff --git a/exec.c b/exec.c
index ee5eff7734..6d9e13a0a6 100644
--- a/exec.c
+++ b/exec.c
@@ -484,7 +484,7 @@ void cpu_exec_init(CPUArchState *env)
     }
     cpu->cpu_index = cpu_index;
     cpu->numa_node = 0;
-    QTAILQ_INIT(&env->breakpoints);
+    QTAILQ_INIT(&cpu->breakpoints);
     QTAILQ_INIT(&cpu->watchpoints);
 #ifndef CONFIG_USER_ONLY
     cpu->as = &address_space_memory;
@@ -621,6 +621,7 @@ int cpu_breakpoint_insert(CPUArchState *env, target_ulong pc, int flags,
                           CPUBreakpoint **breakpoint)
 {
 #if defined(TARGET_HAS_ICE)
+    CPUState *cpu = ENV_GET_CPU(env);
     CPUBreakpoint *bp;
 
     bp = g_malloc(sizeof(*bp));
@@ -630,12 +631,12 @@ int cpu_breakpoint_insert(CPUArchState *env, target_ulong pc, int flags,
 
     /* keep all GDB-injected breakpoints in front */
     if (flags & BP_GDB) {
-        QTAILQ_INSERT_HEAD(&env->breakpoints, bp, entry);
+        QTAILQ_INSERT_HEAD(&cpu->breakpoints, bp, entry);
     } else {
-        QTAILQ_INSERT_TAIL(&env->breakpoints, bp, entry);
+        QTAILQ_INSERT_TAIL(&cpu->breakpoints, bp, entry);
     }
 
-    breakpoint_invalidate(ENV_GET_CPU(env), pc);
+    breakpoint_invalidate(cpu, pc);
 
     if (breakpoint) {
         *breakpoint = bp;
@@ -650,9 +651,10 @@ int cpu_breakpoint_insert(CPUArchState *env, target_ulong pc, int flags,
 int cpu_breakpoint_remove(CPUArchState *env, target_ulong pc, int flags)
 {
 #if defined(TARGET_HAS_ICE)
+    CPUState *cpu = ENV_GET_CPU(env);
     CPUBreakpoint *bp;
 
-    QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+    QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {
         if (bp->pc == pc && bp->flags == flags) {
             cpu_breakpoint_remove_by_ref(env, bp);
             return 0;
@@ -668,9 +670,11 @@ int cpu_breakpoint_remove(CPUArchState *env, target_ulong pc, int flags)
 void cpu_breakpoint_remove_by_ref(CPUArchState *env, CPUBreakpoint *breakpoint)
 {
 #if defined(TARGET_HAS_ICE)
-    QTAILQ_REMOVE(&env->breakpoints, breakpoint, entry);
+    CPUState *cpu = ENV_GET_CPU(env);
 
-    breakpoint_invalidate(ENV_GET_CPU(env), breakpoint->pc);
+    QTAILQ_REMOVE(&cpu->breakpoints, breakpoint, entry);
+
+    breakpoint_invalidate(cpu, breakpoint->pc);
 
     g_free(breakpoint);
 #endif
@@ -680,9 +684,10 @@ void cpu_breakpoint_remove_by_ref(CPUArchState *env, CPUBreakpoint *breakpoint)
 void cpu_breakpoint_remove_all(CPUArchState *env, int mask)
 {
 #if defined(TARGET_HAS_ICE)
+    CPUState *cpu = ENV_GET_CPU(env);
     CPUBreakpoint *bp, *next;
 
-    QTAILQ_FOREACH_SAFE(bp, &env->breakpoints, entry, next) {
+    QTAILQ_FOREACH_SAFE(bp, &cpu->breakpoints, entry, next) {
         if (bp->flags & mask)
             cpu_breakpoint_remove_by_ref(env, bp);
     }
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 31aac691c5..2dd6206d4a 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -114,19 +114,9 @@ QEMU_BUILD_BUG_ON(sizeof(CPUTLBEntry) != (1 << CPU_TLB_ENTRY_BITS));
 #endif
 
 
-typedef struct CPUBreakpoint {
-    target_ulong pc;
-    int flags; /* BP_* */
-    QTAILQ_ENTRY(CPUBreakpoint) entry;
-} CPUBreakpoint;
-
 #define CPU_TEMP_BUF_NLONGS 128
 #define CPU_COMMON                                                      \
     /* soft mmu support */                                              \
     CPU_COMMON_TLB                                                      \
-                                                                        \
-    /* from this point: preserved by CPU reset */                       \
-    /* ice debug support */                                             \
-    QTAILQ_HEAD(breakpoints_head, CPUBreakpoint) breakpoints;            \
 
 #endif
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index c7420e070b..3bbda08eac 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -151,6 +151,12 @@ typedef struct icount_decr_u16 {
 } icount_decr_u16;
 #endif
 
+typedef struct CPUBreakpoint {
+    vaddr pc;
+    int flags; /* BP_* */
+    QTAILQ_ENTRY(CPUBreakpoint) entry;
+} CPUBreakpoint;
+
 typedef struct CPUWatchpoint {
     vaddr vaddr;
     vaddr len_mask;
@@ -238,6 +244,9 @@ struct CPUState {
     int gdb_num_g_regs;
     QTAILQ_ENTRY(CPUState) node;
 
+    /* ice debug support */
+    QTAILQ_HEAD(breakpoints_head, CPUBreakpoint) breakpoints;
+
     QTAILQ_HEAD(watchpoints_head, CPUWatchpoint) watchpoints;
     CPUWatchpoint *watchpoint_hit;
 
diff --git a/linux-user/main.c b/linux-user/main.c
index 5a06192ec4..dbc04b7d0f 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3450,10 +3450,10 @@ CPUArchState *cpu_copy(CPUArchState *env)
     /* Clone all break/watchpoints.
        Note: Once we support ptrace with hw-debug register access, make sure
        BP_CPU break/watchpoints are handled correctly on clone. */
-    QTAILQ_INIT(&env->breakpoints);
+    QTAILQ_INIT(&cpu->breakpoints);
     QTAILQ_INIT(&cpu->watchpoints);
 #if defined(TARGET_HAS_ICE)
-    QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+    QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {
         cpu_breakpoint_insert(new_env, bp->pc, bp->flags, NULL);
     }
     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index 4c94bed704..a9ef1a7507 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -3463,8 +3463,8 @@ static inline void gen_intermediate_code_internal(AlphaCPU *cpu,
 
     gen_tb_start();
     do {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == ctx.pc) {
                     gen_excp(&ctx, EXCP_DEBUG, 0);
                     break;
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index be17d72537..ecd0b7ecde 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -82,7 +82,7 @@ static void arm_cpu_reset(CPUState *s)
 
     acc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUARMState, breakpoints));
+    memset(env, 0, offsetof(CPUARMState, features));
     g_hash_table_foreach(cpu->cp_regs, cp_reg_reset, cpu);
     env->vfp.xregs[ARM_VFP_FPSID] = cpu->reset_fpsid;
     env->vfp.xregs[ARM_VFP_MVFR0] = cpu->mvfr0;
diff --git a/target-arm/translate-a64.c b/target-arm/translate-a64.c
index 37e05e81f7..2fd9113628 100644
--- a/target-arm/translate-a64.c
+++ b/target-arm/translate-a64.c
@@ -9061,8 +9061,8 @@ void gen_intermediate_code_internal_a64(ARMCPU *cpu,
     tcg_clear_temp_count();
 
     do {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == dc->pc) {
                     gen_exception_insn(dc, 0, EXCP_DEBUG);
                     /* Advance PC so that clearing the breakpoint will
diff --git a/target-arm/translate.c b/target-arm/translate.c
index df259debcc..2f02c183a7 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -10733,8 +10733,8 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu,
         }
 #endif
 
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == dc->pc) {
                     gen_exception_insn(dc, 0, EXCP_DEBUG);
                     /* Advance PC so that clearing the breakpoint will
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index ff27e7f773..95b6a8889b 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -49,7 +49,7 @@ static void cris_cpu_reset(CPUState *s)
     ccc->parent_reset(s);
 
     vr = env->pregs[PR_VR];
-    memset(env, 0, offsetof(CPUCRISState, breakpoints));
+    memset(env, 0, offsetof(CPUCRISState, load_info));
     env->pregs[PR_VR] = vr;
     tlb_flush(env, 1);
 
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index 6cc0616523..b88c147518 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -171,8 +171,8 @@ typedef struct CPUCRISState {
 
 	CPU_COMMON
 
-	/* Members after CPU_COMMON are preserved across resets.  */
-	void *load_info;
+    /* Members from load_info on are preserved across resets.  */
+    void *load_info;
 } CPUCRISState;
 
 #include "cpu-qom.h"
diff --git a/target-cris/translate.c b/target-cris/translate.c
index f990d591c7..7e70940c9b 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3089,10 +3089,11 @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
 
 static void check_breakpoint(CPUCRISState *env, DisasContext *dc)
 {
+    CPUState *cs = CPU(cris_env_get_cpu(env));
     CPUBreakpoint *bp;
 
-    if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-        QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+    if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == dc->pc) {
                 cris_evaluate_flags(dc);
                 tcg_gen_movi_tl(env_pc, dc->pc);
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 63ba2194cb..fab0f55735 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2410,7 +2410,7 @@ static void x86_cpu_reset(CPUState *s)
     xcc->parent_reset(s);
 
 
-    memset(env, 0, offsetof(CPUX86State, breakpoints));
+    memset(env, 0, offsetof(CPUX86State, pat));
 
     tlb_flush(env, 1);
 
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 906018757d..4d1374c6cc 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -875,7 +875,7 @@ typedef struct CPUX86State {
     target_ulong exception_next_eip;
     target_ulong dr[8]; /* debug registers */
     union {
-        CPUBreakpoint *cpu_breakpoint[4];
+        struct CPUBreakpoint *cpu_breakpoint[4];
         struct CPUWatchpoint *cpu_watchpoint[4];
     }; /* break/watchpoints for dr[0..3] */
     uint32_t smbase;
@@ -887,6 +887,7 @@ typedef struct CPUX86State {
 
     CPU_COMMON
 
+    /* Fields from here on are preserved across CPU reset. */
     uint64_t pat;
 
     /* processor features (e.g. for CPUID insn) */
diff --git a/target-i386/helper.c b/target-i386/helper.c
index bd8da20946..59736d7a4f 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1101,7 +1101,7 @@ void breakpoint_handler(CPUX86State *env)
             }
         }
     } else {
-        QTAILQ_FOREACH(bp, &env->breakpoints, entry)
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == env->eip) {
                 if (bp->flags & BP_CPU) {
                     check_hw_breakpoints(env, true);
@@ -1109,6 +1109,7 @@ void breakpoint_handler(CPUX86State *env)
                 }
                 break;
             }
+        }
     }
 }
 
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 707ebd5ca0..02625e31c2 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -7965,8 +7965,8 @@ static inline void gen_intermediate_code_internal(X86CPU *cpu,
 
     gen_tb_start();
     for(;;) {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == pc_ptr &&
                     !((bp->flags & BP_CPU) && (tb->flags & HF_RF_MASK))) {
                     gen_debug(dc, pc_ptr - dc->cs_base);
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index daec499502..d0c66bc0f5 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -125,7 +125,7 @@ static void lm32_cpu_reset(CPUState *s)
     lcc->parent_reset(s);
 
     /* reset cpu state */
-    memset(env, 0, offsetof(CPULM32State, breakpoints));
+    memset(env, 0, offsetof(CPULM32State, eba));
 
     lm32_cpu_init_cfg_reg(cpu);
     tlb_flush(env, 1);
diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index d50726bce7..24bde78502 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -166,11 +166,12 @@ struct CPULM32State {
     uint32_t bp[4];     /* breakpoints */
     uint32_t wp[4];     /* watchpoints */
 
-    CPUBreakpoint * cpu_breakpoint[4];
+    struct CPUBreakpoint *cpu_breakpoint[4];
     struct CPUWatchpoint *cpu_watchpoint[4];
 
     CPU_COMMON
 
+    /* Fields from here on are preserved across CPU reset. */
     uint32_t eba;       /* exception base address */
     uint32_t deba;      /* debug exception base address */
 
diff --git a/target-lm32/helper.c b/target-lm32/helper.c
index 67ba278e27..eadc7277a7 100644
--- a/target-lm32/helper.c
+++ b/target-lm32/helper.c
@@ -131,7 +131,7 @@ void lm32_debug_excp_handler(CPULM32State *env)
             }
         }
     } else {
-        QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == env->pc) {
                 if (bp->flags & BP_CPU) {
                     raise_exception(env, EXCP_BREAKPOINT);
diff --git a/target-lm32/translate.c b/target-lm32/translate.c
index 80bffc7b27..c8abd1f27e 100644
--- a/target-lm32/translate.c
+++ b/target-lm32/translate.c
@@ -1037,10 +1037,11 @@ static inline void decode(DisasContext *dc, uint32_t ir)
 
 static void check_breakpoint(CPULM32State *env, DisasContext *dc)
 {
+    CPUState *cs = CPU(lm32_env_get_cpu(env));
     CPUBreakpoint *bp;
 
-    if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-        QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+    if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == dc->pc) {
                 tcg_gen_movi_tl(cpu_pc, dc->pc);
                 t_gen_raise_exception(dc, EXCP_DEBUG);
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 46601dcd5d..a88da20b46 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -49,7 +49,7 @@ static void m68k_cpu_reset(CPUState *s)
 
     mcc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUM68KState, breakpoints));
+    memset(env, 0, offsetof(CPUM68KState, features));
 #if !defined(CONFIG_USER_ONLY)
     env->sr = 0x2700;
 #endif
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index dd1794feac..6e4001d523 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -110,6 +110,7 @@ typedef struct CPUM68KState {
 
     CPU_COMMON
 
+    /* Fields from here on are preserved across CPU reset. */
     uint32_t features;
 } CPUM68KState;
 
diff --git a/target-m68k/translate.c b/target-m68k/translate.c
index 4f06443532..a0e2f19e15 100644
--- a/target-m68k/translate.c
+++ b/target-m68k/translate.c
@@ -3003,8 +3003,8 @@ gen_intermediate_code_internal(M68kCPU *cpu, TranslationBlock *tb,
     do {
         pc_offset = dc->pc - pc_start;
         gen_throws_exception = NULL;
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == dc->pc) {
                     gen_exception(dc, dc->pc, EXCP_DEBUG);
                     dc->is_jmp = DISAS_JUMP;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 86ec25811e..3177fe6d12 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -63,7 +63,7 @@ static void mb_cpu_reset(CPUState *s)
 
     mcc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUMBState, breakpoints));
+    memset(env, 0, sizeof(CPUMBState));
     env->res_addr = RES_ADDR_NONE;
     tlb_flush(env, 1);
 
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 270138c6d2..fbd6951d1a 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1660,10 +1660,11 @@ static inline void decode(DisasContext *dc, uint32_t ir)
 
 static void check_breakpoint(CPUMBState *env, DisasContext *dc)
 {
+    CPUState *cs = CPU(mb_env_get_cpu(env));
     CPUBreakpoint *bp;
 
-    if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-        QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+    if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == dc->pc) {
                 t_gen_raise_exception(dc, EXCP_DEBUG);
                 dc->is_jmp = DISAS_UPDATE;
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 8c304ac832..cf4d856d6b 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -83,7 +83,7 @@ static void mips_cpu_reset(CPUState *s)
 
     mcc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUMIPSState, breakpoints));
+    memset(env, 0, offsetof(CPUMIPSState, mvp));
     tlb_flush(env, 1);
 
     cpu_state_reset(env);
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index a1d85efea1..3ba3229e66 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -482,6 +482,7 @@ struct CPUMIPSState {
 
     CPU_COMMON
 
+    /* Fields from here on are preserved across CPU reset. */
     CPUMIPSMVPContext *mvp;
 #if !defined(CONFIG_USER_ONLY)
     CPUMIPSTLBContext *tlb;
diff --git a/target-mips/translate.c b/target-mips/translate.c
index d1c25d2b22..71dccaea55 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -15613,8 +15613,8 @@ gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb,
     LOG_DISAS("\ntb %p idx %d hflags %04x\n", tb, ctx.mem_idx, ctx.hflags);
     gen_tb_start();
     while (ctx.bstate == BS_NONE) {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == ctx.pc) {
                     save_cpu_state(&ctx, 1);
                     ctx.bstate = BS_BRANCH;
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 03d8eb13d7..14d1a24438 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -42,7 +42,7 @@ static void moxie_cpu_reset(CPUState *s)
 
     mcc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUMoxieState, breakpoints));
+    memset(env, 0, sizeof(CPUMoxieState));
     env->pc = 0x1000;
 
     tlb_flush(env, 1);
diff --git a/target-moxie/translate.c b/target-moxie/translate.c
index a93196f47b..63f889fd7f 100644
--- a/target-moxie/translate.c
+++ b/target-moxie/translate.c
@@ -845,8 +845,8 @@ gen_intermediate_code_internal(MoxieCPU *cpu, TranslationBlock *tb,
 
     gen_tb_start();
     do {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (ctx.pc == bp->pc) {
                     tcg_gen_movi_i32(cpu_pc, ctx.pc);
                     gen_helper_debug(cpu_env);
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index b601de009c..a00369bef5 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -41,7 +41,11 @@ static void openrisc_cpu_reset(CPUState *s)
 
     occ->parent_reset(s);
 
-    memset(&cpu->env, 0, offsetof(CPUOpenRISCState, breakpoints));
+#ifndef CONFIG_USER_ONLY
+    memset(&cpu->env, 0, offsetof(CPUOpenRISCState, tlb));
+#else
+    memset(&cpu->env, 0, offsetof(CPUOpenRISCState, irq));
+#endif
 
     tlb_flush(&cpu->env, 1);
     /*tb_flush(&cpu->env);    FIXME: Do we need it?  */
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 660bb4f1e7..4512f459bf 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -304,6 +304,7 @@ typedef struct CPUOpenRISCState {
 
     CPU_COMMON
 
+    /* Fields from here on are preserved across CPU reset. */
 #ifndef CONFIG_USER_ONLY
     CPUOpenRISCTLBContext * tlb;
 
diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c
index 776cb6eece..852b5e6107 100644
--- a/target-openrisc/translate.c
+++ b/target-openrisc/translate.c
@@ -1619,10 +1619,11 @@ static void disas_openrisc_insn(DisasContext *dc, OpenRISCCPU *cpu)
 
 static void check_breakpoint(OpenRISCCPU *cpu, DisasContext *dc)
 {
+    CPUState *cs = CPU(cpu);
     CPUBreakpoint *bp;
 
-    if (unlikely(!QTAILQ_EMPTY(&cpu->env.breakpoints))) {
-        QTAILQ_FOREACH(bp, &cpu->env.breakpoints, entry) {
+    if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == dc->pc) {
                 tcg_gen_movi_tl(cpu_pc, dc->pc);
                 gen_exception(dc, EXCP_DEBUG);
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 91c33dcd1d..e3fcb03c26 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -11377,8 +11377,8 @@ static inline void gen_intermediate_code_internal(PowerPCCPU *cpu,
     /* Set env in case of segfault during code fetch */
     while (ctx.exception == POWERPC_EXCP_NONE
             && tcg_ctx.gen_opc_ptr < gen_opc_end) {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == ctx.nip) {
                     gen_debug_exception(ctxp);
                     break;
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 993d924e52..ae78ebc5f7 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -109,7 +109,7 @@ static void s390_cpu_initial_reset(CPUState *s)
 
     s390_cpu_reset(s);
     /* initial reset does not touch regs,fregs and aregs */
-    memset(&env->fpc, 0, offsetof(CPUS390XState, breakpoints) -
+    memset(&env->fpc, 0, offsetof(CPUS390XState, cpu_num) -
                          offsetof(CPUS390XState, fpc));
 
     /* architectured initial values for CR 0 and 14 */
@@ -139,7 +139,7 @@ static void s390_cpu_full_reset(CPUState *s)
 
     scc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUS390XState, breakpoints));
+    memset(env, 0, offsetof(CPUS390XState, cpu_num));
 
     /* architectured initial values for CR 0 and 14 */
     env->cregs[0] = CR0_RESET;
diff --git a/target-s390x/translate.c b/target-s390x/translate.c
index bc99a378a7..81b7e330ab 100644
--- a/target-s390x/translate.c
+++ b/target-s390x/translate.c
@@ -4795,8 +4795,8 @@ static inline void gen_intermediate_code_internal(S390CPU *cpu,
         }
 
         status = NO_EXIT;
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == dc.pc) {
                     status = EXIT_PC_STALE;
                     do_debug = true;
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 88960c8512..4e0e2179cc 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -53,7 +53,7 @@ static void superh_cpu_reset(CPUState *s)
 
     scc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUSH4State, breakpoints));
+    memset(env, 0, offsetof(CPUSH4State, id));
     tlb_flush(env, 1);
 
     env->pc = 0xA0000000;
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index a85571087d..a2e9e2c031 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -175,6 +175,7 @@ typedef struct CPUSH4State {
 
     CPU_COMMON
 
+    /* Fields from here on are preserved over CPU reset. */
     int id;			/* CPU model */
 
     /* The features that we should emulate. See sh_features above.  */
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 661fc6c887..2360609a0a 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -1889,8 +1889,8 @@ gen_intermediate_code_internal(SuperHCPU *cpu, TranslationBlock *tb,
         max_insns = CF_COUNT_MASK;
     gen_tb_start();
     while (ctx.bstate == BS_NONE && tcg_ctx.gen_opc_ptr < gen_opc_end) {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (ctx.pc == bp->pc) {
 		    /* We have hit a breakpoint - make sure PC is up-to-date */
 		    tcg_gen_movi_i32(cpu_pc, ctx.pc);
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 3e6e7a754e..8465a0b18a 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -33,7 +33,7 @@ static void sparc_cpu_reset(CPUState *s)
 
     scc->parent_reset(s);
 
-    memset(env, 0, offsetof(CPUSPARCState, breakpoints));
+    memset(env, 0, offsetof(CPUSPARCState, version));
     tlb_flush(env, 1);
     env->cwp = 0;
 #ifndef TARGET_SPARC64
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 893caa0576..f72451d53e 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -423,6 +423,7 @@ struct CPUSPARCState {
 
     CPU_COMMON
 
+    /* Fields from here on are preserved across CPU reset. */
     target_ulong version;
     uint32_t nwindows;
 
diff --git a/target-sparc/translate.c b/target-sparc/translate.c
index 46d7859e97..2de1c4a58d 100644
--- a/target-sparc/translate.c
+++ b/target-sparc/translate.c
@@ -5270,8 +5270,8 @@ static inline void gen_intermediate_code_internal(SPARCCPU *cpu,
         max_insns = CF_COUNT_MASK;
     gen_tb_start();
     do {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == dc->pc) {
                     if (dc->pc != pc_start)
                         save_state(dc);
diff --git a/target-unicore32/translate.c b/target-unicore32/translate.c
index 4572890ffa..5032bbe2a0 100644
--- a/target-unicore32/translate.c
+++ b/target-unicore32/translate.c
@@ -1922,8 +1922,8 @@ static inline void gen_intermediate_code_internal(UniCore32CPU *cpu,
 
     gen_tb_start();
     do {
-        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+        if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+            QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
                 if (bp->pc == dc->pc) {
                     gen_set_pc_im(dc->pc);
                     gen_exception(EXCP_DEBUG);
diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index 9f5895e021..764cee96f3 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -2948,10 +2948,11 @@ invalid_opcode:
 
 static void check_breakpoint(CPUXtensaState *env, DisasContext *dc)
 {
+    CPUState *cs = CPU(xtensa_env_get_cpu(env));
     CPUBreakpoint *bp;
 
-    if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
-        QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
+    if (unlikely(!QTAILQ_EMPTY(&cs->breakpoints))) {
+        QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
             if (bp->pc == dc->pc) {
                 tcg_gen_movi_i32(cpu_pc, dc->pc);
                 gen_exception(dc, EXCP_DEBUG);