Commit 96ccca6690 for qemu.org

commit 96ccca66908a5a23fb0cbba47e59f7232fd756a0
Author: Brian Cain <brian.cain@oss.qualcomm.com>
Date:   Sat Sep 26 19:43:46 2026 -0700

    target/hexagon: publish TLB updates before flushing

    Replace the shared architectural entry first, release its lock, and
    only then call tlb_flush_all_cpus_synced() when a valid mapping was
    replaced.

    The old ordering flushed remote soft TLBs before publishing the
    replacement, allowing a resumed vCPU to refill the stale mapping.

    Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
    Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

diff --git a/target/hexagon/hex_mmu.c b/target/hexagon/hex_mmu.c
index 7d5fb987e1..0ca52ed666 100644
--- a/target/hexagon/hex_mmu.c
+++ b/target/hexagon/hex_mmu.c
@@ -31,14 +31,12 @@ void hex_tlbw(CPUHexagonState *env, uint32_t index, uint64_t value)
 {
     uint32_t myidx = fTLB_NONPOW2WRAP(fTLB_IDXMASK(index));
     HexagonTLBState *tlb = env_archcpu(env)->tlb;
-    uint64_t old_entry = hexagon_tlb_read(tlb, myidx);
-
+    uint64_t old_entry = hexagon_tlb_write(tlb, myidx, value);
     bool old_entry_valid = extract64(old_entry, 63, 1);
     if (old_entry_valid && hexagon_cpu_mmu_enabled(env)) {
         CPUState *cs = env_cpu(env);
-        tlb_flush(cs);
+        tlb_flush_all_cpus_synced(cs);
     }
-    hexagon_tlb_write(tlb, myidx, value);
     hex_log_tlbw(myidx, value);
 }