Introspecting max32-riscv-cpu after rva23s64-riscv-cpu crashes

Watch this:

    $ qemu-system-riscv64 -S -nodefaults -display none -M none -qmp stdio
    {"QMP": {"version": {"qemu": {"micro": 50, "minor": 1, "major": 11}, "package": "v11.1.0-2545-g2d150b99ce-dirty"}, "capabilities": ["oob"]}}
    {"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
    {"return": {}}
    {"execute": "qom-list-properties", "arguments": {"typename": "rva23s64-riscv-cpu"}}
    [Expected output...]
    {"execute": "qom-list-properties", "arguments": {"typename": "max32-riscv-cpu"}}
    **
    ERROR:../target/riscv/cpu.c:516:satp_mode_str: code should not be reached
    Bail out! ERROR:../target/riscv/cpu.c:516:satp_mode_str: code should not be reached
    Aborted                    (core dumped) ../qemu/bld/qemu-system-riscv64 -S -nodefaults -display none -M none -qmp stdio

This is satp_mode_str(VM_1_10_SV39, false). Interesting part of stack backtrace:

    #4  0x00007f9d6e7cd447 in g_assertion_message_expr ()
        at /lib64/libglib-2.0.so.0
    #5  0x000055801fc2f556 in satp_mode_str
        (satp_mode=<optimized out>, is_32_bit=<optimized out>)
        at ../target/riscv/cpu.c:516
    #6  0x000055801fca193c in riscv_cpu_set_profile
        (cpu=0x55802e5b8c90, profile=profile@entry=0x5580209732e0 <RVA22S64>, enabled=enabled@entry=true) at ../target/riscv/tcg/tcg-cpu.c:1305
    #7  0x000055801fca1cf7 in riscv_cpu_add_profiles (cpu_obj=<optimized out>)
        at ../target/riscv/tcg/tcg-cpu.c:1549
    #8  riscv_cpu_add_user_properties (obj=0x55802e5b8c90)
        at ../target/riscv/tcg/tcg-cpu.c:1622
    #9  riscv_tcg_cpu_instance_init (cs=<optimized out>)
        at ../target/riscv/tcg/tcg-cpu.c:1741
    #10 0x000055801fd178a7 in object_init_with_type
        (obj=0x55802e5b8c90, ti=<optimized out>) at ../qom/object.c:430
    #11 object_init_with_type (obj=0x55802e5b8c90, ti=<optimized out>)
        at ../qom/object.c:426
    #12 object_init_with_type (obj=0x55802e5b8c90, ti=0x55802e2e0250)
        at ../qom/object.c:426
    #13 object_initialize_with_type
        (obj=0x55802e5b8c90, size=<optimized out>, type=0x55802e2e0250)
        at ../qom/object.c:512
    #14 0x000055801fd17c5f in object_new_with_type (type=0x55802e2e0250)
        at ../qom/object.c:710
    #15 0x000055801fe17276 in qmp_qom_list_properties
        (typename=0x55802e5ab3d0 "max32-riscv-cpu", errp=0x22c5a0, 
        errp@entry=0x7ffe4a494aa0) at ../qom/qom-qmp-cmds.c:283

Following commit 198265df8a7 ("target/riscv: convert profile CPU models to RISCVCPUDef"):

index f3d70afb866..ed88adef452 100644
@@ -540,6 +540,7 @@ struct ArchCPU {
 
 typedef struct RISCVCPUDef {
     RISCVMXL misa_mxl_max;  /* max mxl for this cpu */
+    RISCVCPUProfile *profile;
     uint32_t misa_ext;
     int priv_spec;
     int32_t vext_spec;

index 7dcaf72fc14..54fce767657 100644
@@ -1487,6 +1487,10 @@ static void riscv_cpu_init(Object *obj)
     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
     cpu->cfg.max_satp_mode = -1;
 
+    if (mcc->def->profile) {
+        mcc->def->profile->enabled = true;
+    }
 

This comes from commit f655704c3df ("target/riscv/tcg: decouple profile enablement from user prop") which ought to fix that issue...

Per-instance update of a shared class field? RISCVCPUProfile should really be const there.