Currently all read-only bits of the CP0_WatchHi registers are cleared by
MTC0, including the M bit which indicates whether more watch registers
exist, and the IRW bits which would be set when a watch is hit (if
watchpoints were actually fully supported by QEMU) and are only cleared
when 1 is written to them. Fix it so that the read-only bits are
properly preserved.

Reported-by: Tam Robb <tam.robb@imgtec.com>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Yongbok Kim <yongbok.kim@imgtec.com>
Cc: qemu-devel@nongnu.org
---
 target/mips/op_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index 320f2b0dc473..f7d740118f8b 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -1662,7 +1662,7 @@ void helper_mtc0_watchlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
 void helper_mtc0_watchhi(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
 {
     int mask = 0x40000FF8 | (env->CP0_EntryHi_ASID_mask << CP0WH_ASID);
-    env->CP0_WatchHi[sel] = arg1 & mask;
+    env->CP0_WatchHi[sel] ^= (env->CP0_WatchHi[sel] ^ arg1) & mask;
     env->CP0_WatchHi[sel] &= ~(env->CP0_WatchHi[sel] & arg1 & 0x7);
 }
 
-- 
git-series 0.8.10