Commit 209fcdae5d for qemu.org

commit 209fcdae5de7140558f845802a5defe7c87bfa46
Author: Brian Cain <brian.cain@oss.qualcomm.com>
Date:   Thu Sep 3 11:56:20 2026 -0700

    hexagon: raise imprecise exception for multi-TLB matches

    The TLB walk stopped at the first matching entry, so instruction and data
    translations did not detect a second valid mapping for the same VA and ASID.

    Scan the remaining entries after selecting the translation.  On a second
    match, retain the first entry for the access but record
    HEX_CAUSE_IMPRECISE_MULTI_TLB_MATCH as a pending imprecise exception.

    Move that exception out of the synchronous TLB-fill result and check for it
    after every packet, rather than only packets containing tlbp.  This delivers
    the architectural imprecise exception after an ordinary memory access and
    avoids treating it as a precise permission fault.  Clear the pending state
    when starting a new translation and after delivering the exception.

    The v0.2.14 mmu_multi_tlb systest uncovered this bug.

    Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
    Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

diff --git a/hw/hexagon/hexagon_tlb.c b/hw/hexagon/hexagon_tlb.c
index c76805abac..157d03e51b 100644
--- a/hw/hexagon/hexagon_tlb.c
+++ b/hw/hexagon/hexagon_tlb.c
@@ -326,6 +326,16 @@ bool hexagon_tlb_find_match(HexagonTLBState *tlb, uint32_t asid,
     for (uint32_t i = 0; i < tlb->num_entries; i++) {
         if (hex_tlb_entry_match(tlb->entries[i], asid, VA, access_type,
                                 PA, prot, size, excp, cause_code, mmu_idx)) {
+            if (*excp == 0) {
+                for (i++; i < tlb->num_entries; i++) {
+                    if (hex_tlb_entry_match_noperm(tlb->entries[i], asid,
+                                                   VA)) {
+                        *excp = HEX_EVENT_IMPRECISE;
+                        *cause_code = HEX_CAUSE_IMPRECISE_MULTI_TLB_MATCH;
+                        break;
+                    }
+                }
+            }
             return true;
         }
     }
diff --git a/target/hexagon/hex_mmu.c b/target/hexagon/hex_mmu.c
index d6258c673d..d6ee7c4079 100644
--- a/target/hexagon/hex_mmu.c
+++ b/target/hexagon/hex_mmu.c
@@ -71,10 +71,16 @@ bool hex_tlb_find_match(CPUHexagonState *env, uint32_t VA,
     uint32_t ssr = env->t_sreg[HEX_SREG_SSR];
     uint8_t asid = GET_SSR_FIELD(SSR_ASID, ssr);
     int cause_code = 0;
+    bool found;

-    bool found = hexagon_tlb_find_match(cpu->tlb, asid, VA, access_type,
-                                        PA, prot, size, excp, &cause_code,
-                                        mmu_idx);
+    env->imprecise_exception = 0;
+    found = hexagon_tlb_find_match(cpu->tlb, asid, VA, access_type,
+                                   PA, prot, size, excp, &cause_code,
+                                   mmu_idx);
+    if (*excp == HEX_EVENT_IMPRECISE) {
+        env->imprecise_exception = *excp;
+        *excp = 0;
+    }
     if (cause_code) {
         env->cause_code = cause_code;
     }
diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c
index 75f0a9cc52..4705e915ae 100644
--- a/target/hexagon/hexswi.c
+++ b/target/hexagon/hexswi.c
@@ -934,6 +934,7 @@ void hexagon_cpu_do_interrupt(CPUState *cs)
         break;

     case HEX_EVENT_IMPRECISE:
+        env->imprecise_exception = 0;
         if (get_exe_mode(env) == HEX_EXE_MODE_WAIT) {
             env->gpr[HEX_REG_PC] = env->wait_next_pc - 4;
             clear_wait_mode(env);
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index be75e5fdeb..5d3d67e5d3 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -1065,20 +1065,14 @@ static void update_exec_counters(DisasContext *ctx)
  * A tlbp instruction may detect multiple TLB matches and set a pending
  * imprecise exception.  Raise it after the packet that ran the tlbp.
  */
-static void check_imprecise_exception(Packet *pkt)
+static void check_imprecise_exception(DisasContext *ctx)
 {
-    for (int i = 0; i < pkt->num_insns; i++) {
-        if (pkt->insn[i].opcode == Y2_tlbp) {
-            TCGv PC = tcg_constant_tl(pkt->pc);
-            TCGLabel *label = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, hex_imprecise_exception,
-                               0, label);
-            gen_helper_raise_exception(tcg_env,
-                                       hex_imprecise_exception, PC);
-            gen_set_label(label);
-            return;
-        }
-    }
+    TCGv PC = tcg_constant_tl(ctx->pkt.pc);
+    TCGLabel *label = gen_new_label();
+
+    tcg_gen_brcondi_tl(TCG_COND_EQ, hex_imprecise_exception, 0, label);
+    gen_helper_raise_exception(tcg_env, hex_imprecise_exception, PC);
+    gen_set_label(label);
 }
 #endif

@@ -1182,7 +1176,7 @@ static void gen_commit_packet(DisasContext *ctx)
     }

 #ifndef CONFIG_USER_ONLY
-    check_imprecise_exception(&ctx->pkt);
+    check_imprecise_exception(ctx);
 #endif

     if (ctx->pkt_ends_tb || ctx->base.is_jmp == DISAS_NORETURN) {