Commit 41515b4886 for qemu.org

commit 41515b48867dae8d87d65fc35203be39905866c4
Author: Brian Cain <brian.cain@oss.qualcomm.com>
Date:   Thu Sep 3 11:56:16 2026 -0700

    target/hexagon: read BADVA as an alias of BADVA0/1

    BADVA is sort of a virtual register: it reads back as either BADVA0
    or BADVA1, selected by SSR[BVS].  sreg_read() instead returned the
    separate copy that set_badva_regs() stores in t_sreg[HEX_SREG_BADVA].

    Guest code that writes BADVA0/BADVA1 directly was reading back a stale BADVA.

    Uncovered by the h2 hypervisor kernel/mem/tlbmiss test.

    Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
    Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 71555a7ba3..5d64c5523b 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -1889,6 +1889,13 @@ static inline QEMU_ALWAYS_INLINE uint32_t sreg_read(CPUHexagonState *env,
     HexagonCPU *cpu;

     g_assert(bql_locked());
+    if (reg == HEX_SREG_BADVA) {
+        uint32_t ssr = env->t_sreg[HEX_SREG_SSR];
+        if (GET_SSR_FIELD(SSR_BVS, ssr)) {
+            return env->t_sreg[HEX_SREG_BADVA1];
+        }
+        return env->t_sreg[HEX_SREG_BADVA0];
+    }
     if (reg < HEX_SREG_GLB_START) {
         return env->t_sreg[reg];
     }