Commit fb9d616819 for qemu.org

commit fb9d616819a563a6956482055e1cbe2f053130db
Author: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Date:   Tue Apr 21 17:37:10 2026 +0800

    target/riscv: fix address masking

    The pmlen should get the corresponding value before shifting address.

    Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
    Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
    Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
    Message-ID: <20260421093715.2995067-2-frank.chang@sifive.com>
    Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index ab8dea45c9..d090db2641 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -222,8 +222,8 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
     if (!is_virt_addr) {
         signext = riscv_cpu_virt_mem_enabled(env);
     }
-    addr = addr << pmlen;
     pmlen = riscv_pm_get_pmlen(pmm);
+    addr = addr << pmlen;

     /* sign/zero extend masked address by N-1 bit */
     if (signext) {