target/riscv: avoid abort when reading vtype before env->xl is set

[PATCH] target/riscv: avoid abort when reading vtype before env->xl is set

Posted by ZhengXiang Qin 1 month, 1 week ago

TCG plugins may read registers from the vcpu_init_cb() callback.  For
vtype, this reaches read_vtype() before env->xl has been initialized.

In that case read_vtype() currently hits g_assert_not_reached() because
env->xl is zero.  Fall back to the CPU's maximum XLEN only for this
early-init case.

Fixes: 638181a180bd ("core/cpu-common: initialise plugin state before thread creation")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3545
Signed-off-by: ZhengXiang Qin <qinzhengxiang@foxmail.com>
---
 target/riscv/csr.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 5514e0f455..6ade7ccb0b 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -936,7 +936,16 @@ static RISCVException read_vtype(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
     uint64_t vill;
-    switch (env->xl) {
+    int xl = env->xl;
+    /*
+     * TCG plugins can read registers before env->xl is initialized.
+     * Fall back to the CPU's maximum XLEN in that early-init case.
+     */
+    if (xl == 0) {
+        xl = riscv_cpu_mxl(env);
+    }
+
+    switch (xl) {
     case MXL_RV32:
         vill = (uint32_t)env->vill << 31;
         break;
-- 
2.43.0

Re: [PATCH] target/riscv: avoid abort when reading vtype before env->xl is set

Posted by Alistair Francis 1 month ago

On Tue, Jun 16, 2026 at 1:11 AM ZhengXiang Qin
<qinzhengxiang@foxmail.com> wrote:
>
> TCG plugins may read registers from the vcpu_init_cb() callback.  For
> vtype, this reaches read_vtype() before env->xl has been initialized.
>
> In that case read_vtype() currently hits g_assert_not_reached() because
> env->xl is zero.  Fall back to the CPU's maximum XLEN only for this
> early-init case.
>
> Fixes: 638181a180bd ("core/cpu-common: initialise plugin state before thread creation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3545
> Signed-off-by: ZhengXiang Qin <qinzhengxiang@foxmail.com>

Thanks!

Applied to riscv-to-apply.next

Alistair

> ---
>  target/riscv/csr.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/target/riscv/csr.c b/target/riscv/csr.c
> index 5514e0f455..6ade7ccb0b 100644
> --- a/target/riscv/csr.c
> +++ b/target/riscv/csr.c
> @@ -936,7 +936,16 @@ static RISCVException read_vtype(CPURISCVState *env, int csrno,
>                                   target_ulong *val)
>  {
>      uint64_t vill;
> -    switch (env->xl) {
> +    int xl = env->xl;
> +    /*
> +     * TCG plugins can read registers before env->xl is initialized.
> +     * Fall back to the CPU's maximum XLEN in that early-init case.
> +     */
> +    if (xl == 0) {
> +        xl = riscv_cpu_mxl(env);
> +    }
> +
> +    switch (xl) {
>      case MXL_RV32:
>          vill = (uint32_t)env->vill << 31;
>          break;
> --
> 2.43.0
>
>

Re: [PATCH] target/riscv: avoid abort when reading vtype before env->xl is set

Posted by Daniel Henrique Barboza 1 month, 1 week ago


On 6/15/2026 10:24 AM, ZhengXiang Qin wrote:
> TCG plugins may read registers from the vcpu_init_cb() callback.  For
> vtype, this reaches read_vtype() before env->xl has been initialized.
> 
> In that case read_vtype() currently hits g_assert_not_reached() because
> env->xl is zero.  Fall back to the CPU's maximum XLEN only for this
> early-init case.
> 
> Fixes: 638181a180bd ("core/cpu-common: initialise plugin state before thread creation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3545
> Signed-off-by: ZhengXiang Qin <qinzhengxiang@foxmail.com>
> ---

Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>

>   target/riscv/csr.c | 11 ++++++++++-
>   1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/target/riscv/csr.c b/target/riscv/csr.c
> index 5514e0f455..6ade7ccb0b 100644
> --- a/target/riscv/csr.c
> +++ b/target/riscv/csr.c
> @@ -936,7 +936,16 @@ static RISCVException read_vtype(CPURISCVState *env, int csrno,
>                                    target_ulong *val)
>   {
>       uint64_t vill;
> -    switch (env->xl) {
> +    int xl = env->xl;
> +    /*
> +     * TCG plugins can read registers before env->xl is initialized.
> +     * Fall back to the CPU's maximum XLEN in that early-init case.
> +     */
> +    if (xl == 0) {
> +        xl = riscv_cpu_mxl(env);
> +    }
> +
> +    switch (xl) {
>       case MXL_RV32:
>           vill = (uint32_t)env->vill << 31;
>           break;

Re: [PATCH] target/riscv: avoid abort when reading vtype before env->xl is set

Posted by ZhengXiang Qin 1 month, 1 week ago

Thanks Daniel!