Commit 80cccdb055 for qemu.org

commit 80cccdb05571e816503c257ed9aca0e7e5a441fb
Author: Marco Liebel <marco.liebel@oss.qualcomm.com>
Date:   Mon Nov 9 15:21:40 2026 -0800

    target/hexagon: preserve guest event fault and CFI state

    Guest event entry must select BADVA0 or BADVA1 through SSR.BVS
    instead of copying the stale BADVA array slot. It must also save
    SSR.CFI into GSR.CFI so guest return can restore the interrupted
    CFI state.

    Signed-off-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
    Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
    Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c
index 663d9fe49e..f22d4a7751 100644
--- a/target/hexagon/hexswi.c
+++ b/target/hexagon/hexswi.c
@@ -809,6 +809,9 @@ static void guest_event_entry(CPUHexagonState *env, uint32_t cause,
     gsr = deposit32(gsr, reg_field_info[GSR_IE].offset,
                     reg_field_info[GSR_IE].width,
                     GET_FIELD(CCR_GIE, env->t_sreg[HEX_SREG_CCR]));
+    gsr = deposit32(gsr, reg_field_info[GSR_CFI].offset,
+                    reg_field_info[GSR_CFI].width,
+                    GET_FIELD(SSR_CFI, old_ssr));
     env->greg[HEX_GREG_GSR] = gsr;
     SET_SYSTEM_FIELD(env, HEX_SREG_SSR, SSR_SS, 0);
     SET_SYSTEM_FIELD(env, HEX_SREG_SSR, SSR_GM, 1);
@@ -816,7 +819,8 @@ static void guest_event_entry(CPUHexagonState *env, uint32_t cause,
     SET_SYSTEM_FIELD(env, HEX_SREG_CCR, CCR_GIE, 0);
     env->greg[HEX_GREG_GELR] = event_pc;
     if (set_gbadva) {
-        env->greg[HEX_GREG_GBADVA] = env->t_sreg[HEX_SREG_BADVA];
+        env->greg[HEX_GREG_GBADVA] = env->t_sreg[
+            GET_FIELD(SSR_BVS, old_ssr) ? HEX_SREG_BADVA1 : HEX_SREG_BADVA0];
     }
     env->gpr[HEX_REG_PC] = gevb + vec_offset;
 }