TCG plugin crashes qemu-system-riscv64 on vtype register read

Host environment

• QEMU flavor:

  qemu-system-riscv64

• QEMU version:

  any after 9.0.50 (v9.0.0-1145-g638181a180)

• QEMU command line:

  qemu-system-riscv64 -cpu rv64,v=true,vlen=256 -plugin ./contrib/plugins/libexeclog.so,reg=vtype -d plugin -machine virt -nographic

Description of problem

If trying to read register vtype, on vcpu_init_cb on TCG plugins on riscv64 full-system qemu crashes

bool read_vtype = qemu_plugin_read_register(c->vtype_handle, c->buf_vtype_value);

Bisected to 638181a1 and as the plugin initialization was moved from cpu_common_realizefn to and earlier cpu_common_initfn , my guess is that env->xl is not initialized and that is why

static RISCVException read_vtype(CPURISCVState *env, int csrno,
                                 target_ulong *val)
{
    uint64_t vill;
    switch (env->xl) {
    case MXL_RV32:
        vill = (uint32_t)env->vill << 31;
        break;
    case MXL_RV64:
        vill = (uint64_t)env->vill << 63;
        break;
    default:
        g_assert_not_reached();
    }
    *val = (target_ulong)vill | env->vtype;
    return RISCV_EXCP_NONE;
}

qemu enters the assert and crashes.

This can be easily tested with the execlog plugin with the reg=vtype