target/riscv: avoid abort when reading vtype before env->xl is set
TCG plugins may read registers from the vcpu_init_cb() callback. For vtype, this reaches read_vtype() before env->xl has been initialized. In that case read_vtype() currently hits g_assert_not_reached() because env->xl is zero. Fall back to the CPU's maximum XLEN only for this early-init case. Fixes: 638181a180bd ("core/cpu-common: initialise plugin state before thread creation") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3545 Signed-off-by: ZhengXiang Qin <qinzhengxiang@foxmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <tencent_FB929239B227F05F30D62745E38BA01D4307@qq.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
ZhengXiang Qin committed
Jun 15, 2026 at 21:24 UTC
46d96da1309869af6261d1997623b7a5212814d8
1 file changed
+10
-1
target/riscv/csr.c
+10
-1
@@ -949,7 +949,16 @@ static RISCVException read_vtype(CPURISCVState *env, int csrno,
949
target_ulong *val)
950
{
951
uint64_t vill;
952
- switch (env->xl) {
952
+ int xl = env->xl;
953
+ /*
954
+ * TCG plugins can read registers before env->xl is initialized.
955
+ * Fall back to the CPU's maximum XLEN in that early-init case.
956
+ */
957
+ if (xl == 0) {
958
+ xl = riscv_cpu_mxl(env);
959
+ }
960
+
961
+ switch (xl) {
962
case MXL_RV32:
963
vill = (uint32_t)env->vill << 31;
964
break;