[PULL 2/9] target/hexagon: read BADVA as an alias of BADVA0/1

[Brian Cain <brian.cain@oss.qualcomm.com>]

BADVA is sort of a virtual register: it reads back as either BADVA0
or BADVA1, selected by SSR[BVS].  sreg_read() instead returned the
separate copy that set_badva_regs() stores in t_sreg[HEX_SREG_BADVA].

Guest code that writes BADVA0/BADVA1 directly was reading back a stale BADVA.

Uncovered by the h2 hypervisor kernel/mem/tlbmiss test.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/op_helper.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 71555a7ba36..5d64c5523bb 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -1889,6 +1889,13 @@ static inline QEMU_ALWAYS_INLINE uint32_t sreg_read(CPUHexagonState *env,
     HexagonCPU *cpu;
 
     g_assert(bql_locked());
+    if (reg == HEX_SREG_BADVA) {
+        uint32_t ssr = env->t_sreg[HEX_SREG_SSR];
+        if (GET_SSR_FIELD(SSR_BVS, ssr)) {
+            return env->t_sreg[HEX_SREG_BADVA1];
+        }
+        return env->t_sreg[HEX_SREG_BADVA0];
+    }
     if (reg < HEX_SREG_GLB_START) {
         return env->t_sreg[reg];
     }
-- 
2.34.1