[PATCH v2 0/4] target/riscv: fix reserved/illegal instruction encodings

This series fixes four RISC-V instruction legality defects in the
translator:

  target/riscv: honor zicbo* envcfg gating in linux-user mode
    cbo.inval/cbo.flush/cbo.zero retired unconditionally in linux-user
    because check_zicbo_envcfg() skipped the envcfg check entirely in
    user-only builds.  Add a senvcfg-based gate and initialize
    SENVCFG_CBZE at reset when ext_zicboz is enabled, so cbo.zero stays
    usable while cbo.inval/cbo.flush remain illegal, matching the
    user-mode view of a typical firmware/kernel setup.
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4107

  target/riscv: reject FMV.X.W/FMV.W.X under Zfinx
    Zfinx explicitly excludes the FMV transfer instructions, but the
    translators used REQUIRE_ZFINX_OR_F so a Zfinx-only CPU accepted
    them.  Require RVF instead so the transfers trap with an illegal
    instruction when only Zfinx is present.
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4108

  target/riscv: enforce even register constraints for Zdinx fcvt pairs
    fcvt.d.h and fcvt.h.d access a 64-bit double held in a register
    pair, so under Zdinx/Zhinxmin the odd-rd (fcvt.d.h) and odd-rs1
    (fcvt.h.d) encodings are reserved.  Add the missing REQUIRE_EVEN
    checks so those encodings raise an illegal-instruction exception
    instead of retiring.
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4109

  target/riscv: make cm.mva01s/cm.mvsa01 high-sreg forms illegal on RV32E
    The Zcmp pseudocode marks cm.mva01s/cm.mvsa01 as reserved on RV32E
    when either compressed saved-register selector is above s1, but the
    translators only checked REQUIRE_ZCMP.  Add a gate that returns
    false when RVE is enabled and either operand exceeds x9, so the
    high-sreg forms raise an illegal-instruction exception while the
    s0/s1 forms and all RV32I forms keep retiring.
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4110

Each fix was verified with an affected/fixed probe pair against QEMU
builds and native RISC-V hardware, with legal-encoding controls
regressing unchanged.  All four patches were reviewed by Alistair
Francis in the v1 thread; v2 adds this cover letter per his request and
records the Reviewed-by tags, with no code changes.

wangyang (4):
  target/riscv: honor zicbo* envcfg gating in linux-user mode
  target/riscv: reject FMV.X.W/FMV.W.X under Zfinx
  target/riscv: enforce even register constraints for Zdinx fcvt pairs
  target/riscv: make cm.mva01s/cm.mvsa01 high-sreg forms illegal on RV32E