diff --git a/disasm/disasm.cc b/disasm/disasm.cc
index 9fc3e202..e4358b08 100644
--- a/disasm/disasm.cc
+++ b/disasm/disasm.cc
@@ -353,6 +353,30 @@ struct : public arg_t {
   }
 } x0;
 
+struct : public arg_t {
+  std::string to_string(insn_t insn) const {
+    std::stringstream s;
+    auto iorw = insn.iorw();
+    bool has_pre = false;
+    static const char type[] = "wroi";
+    for (int i = 7; i >= 4; --i) {
+      if (iorw & (1ul << i)) {
+        s << type[i - 4];
+        has_pre = true;
+      }
+    }
+
+    s << (has_pre ? "," : "");
+    for (int i = 3; i >= 0; --i) {
+      if (iorw & (1ul << i)) {
+        s << type[i];
+      }
+    }
+
+    return s.str();
+  }
+} iorw;
+
 typedef struct {
   reg_t match;
   reg_t mask;
@@ -562,7 +586,7 @@ disassembler_t::disassembler_t(int xlen)
   DEFINE_NOARG(mret);
   DEFINE_NOARG(dret);
   DEFINE_NOARG(wfi);
-  DEFINE_NOARG(fence);
+  add_insn(new disasm_insn_t("fence", match_fence, mask_fence, {&iorw}));
   DEFINE_NOARG(fence_i);
   DEFINE_SFENCE_TYPE(sfence_vma);
 
diff --git a/riscv/decode.h b/riscv/decode.h
index 6878e15f..b69416a0 100644
--- a/riscv/decode.h
+++ b/riscv/decode.h
@@ -91,6 +91,7 @@ public:
   uint64_t rs3() { return x(27, 5); }
   uint64_t rm() { return x(12, 3); }
   uint64_t csr() { return x(20, 12); }
+  uint64_t iorw() { return x(20, 8); }
 
   int64_t rvc_imm() { return x(2, 5) + (xs(12, 1) << 5); }
   int64_t rvc_zimm() { return x(2, 5) + (x(12, 1) << 5); }
@@ -1864,7 +1865,7 @@ for (reg_t i = 0; i < P.VU.vlmax && P.VU.vl != 0; ++i) { \
   require_vm; \
   reg_t from = P.VU.vsew / div; \
   require(from >= e8 && from <= e64); \
-  require(((float)P.VU.vflmul / div) >= ((float)P.VU.vsew_min / P.VU.ELEN)); \
+  require(((float)P.VU.vflmul / div) >= 0.125 && ((float)P.VU.vflmul / div) <= 8 ); \
   require_align(insn.rd(), P.VU.vflmul); \
   require_align(insn.rs2(), P.VU.vflmul / div); \
   if ((P.VU.vflmul / div) < 1) { \
diff --git a/riscv/processor.h b/riscv/processor.h
index 3e6b3e94..f0e31b34 100644
--- a/riscv/processor.h
+++ b/riscv/processor.h
@@ -249,7 +249,7 @@ typedef enum {
   IMPL_MMU_SV32,
   IMPL_MMU_SV39,
   IMPL_MMU_SV48,
-  IMPL_MMU_BARE,
+  IMPL_MMU_SBARE,
   IMPL_MMU,
 } impl_extension_t;
 
diff --git a/riscv/sim.cc b/riscv/sim.cc
index 20895d62..5fff0edd 100644
--- a/riscv/sim.cc
+++ b/riscv/sim.cc
@@ -120,14 +120,14 @@ sim_t::sim_t(const char* isa, const char* priv, const char* varch,
     char mmu_type[256] = "";
     rc = fdt_parse_mmu_type(fdt, cpu_offset, mmu_type);
     if (rc == 0) {
-      procs[cpu_idx]->set_mmu_capability(IMPL_MMU_BARE);
+      procs[cpu_idx]->set_mmu_capability(IMPL_MMU_SBARE);
       if (strncmp(mmu_type, "riscv,sv32", strlen("riscv,sv32")) == 0) {
         procs[cpu_idx]->set_mmu_capability(IMPL_MMU_SV32);
       } else if (strncmp(mmu_type, "riscv,sv39", strlen("riscv,sv39")) == 0) {
         procs[cpu_idx]->set_mmu_capability(IMPL_MMU_SV39);
       } else if (strncmp(mmu_type, "riscv,sv48", strlen("riscv,sv48")) == 0) {
         procs[cpu_idx]->set_mmu_capability(IMPL_MMU_SV48);
-      } else if (strncmp(mmu_type, "riscv,bare", strlen("riscv,bare")) == 0) {
+      } else if (strncmp(mmu_type, "riscv,sbare", strlen("riscv,sbare")) == 0) {
         //has been set in the beginning
       } else {
         std::cerr << "core ("