diff --git a/arch/risc-v/src/qemu-rv/qemu_rv_head.S b/arch/risc-v/src/qemu-rv/qemu_rv_head.S
index 4cce5e1ed25e0..896b5d9403a62 100644
--- a/arch/risc-v/src/qemu-rv/qemu_rv_head.S
+++ b/arch/risc-v/src/qemu-rv/qemu_rv_head.S
@@ -40,10 +40,67 @@
   .global __start
 
 __start:
+  /* Begin Test */
+
+  /* DO NOT MODIFY. Image Header expected by Linux bootloaders.
+   *
+   * This `li` instruction has no meaningful effect except that
+   * its opcode forms the magic "MZ" signature of a PE/COFF file
+   * that is required for UEFI applications.
+   *
+   * Some bootloaders check the magic "MZ" to see if the image is a valid
+   * Linux image. But modifying the bootLoader is unnecessary unless we
+   * need to do a customized secure boot. So we just put "MZ" in the
+   * header to make the bootloader happy.
+   */
+
+  c.li    s4, -13              /* Magic Signature "MZ" (2 bytes) */
+  j       real_start           /* Jump to Kernel Start (2 bytes) */
+  .long   0                    /* Executable Code padded to 8 bytes */
+  .quad   0x200000             /* Image load offset from start of RAM */
+  /* TODO: _e_initstack - __start */
+  .quad   171644               /* Effective size of kernel image, little-endian */
+  .quad   0x0                  /* Kernel flags, little-endian */
+  .long   0x2                  /* Version of this header */
+  .long   0                    /* Reserved */
+  .quad   0                    /* Reserved */
+  .ascii  "RISCV\x00\x00\x00"  /* Magic number, "RISCV" (8 bytes) */
+  .ascii  "RSC\x05"            /* Magic number 2, "RSC\x05" (4 bytes) */
+  .long   0                    /* Reserved for PE COFF offset */
+
+real_start:
+
+  /* Load UART Base Address to Register t0 */
+  li  t0, 0x10000000
+
+  /* Load `1` to Register t1 */
+  li  t1, 0x31
+  /* Store byte from Register t1 to UART Base Address, Offset 0 */
+  sb  t1, 0(t0)
+
+  /* Load `2` to Register t1 */
+  li  t1, 0x32
+  /* Store byte from Register t1 to UART Base Address, Offset 0 */
+  sb  t1, 0(t0)
+
+  /* Load `3` to Register t1 */
+  li  t1, 0x33
+  /* Store byte from Register t1 to UART Base Address, Offset 0 */
+  sb  t1, 0(t0)
+
+  /* End Test */
 
   /* Load mhartid (cpuid) */
+  /* Previously: csrr a0, mhartid */
+
+  /* We assume that OpenSBI has passed Hart ID (value 1) in Register a0. */
+  /* But NuttX expects Hart ID to start at 0, so we subtract 1. */
+  addi a0, a0, -1
 
-  csrr a0, mhartid
+  /* Print the Hart ID */
+  addi t1, a0, 0x30
+  /* Store byte from Register t1 to UART Base Address, Offset 0 */
+  sb   t1, 0(t0)
 
   /* Set stack pointer to the idle thread stack */
 
@@ -51,6 +108,10 @@ __start:
   la   sp, QEMU_RV_IDLESTACK_TOP
   j    2f
 1:
+  /* Print `4` */
+  li  t0, 0x10000000
+  li  t1, 0x34
+  sb  t1, 0(t0)
 
   /* Load the number of CPUs that the kernel supports */
 
@@ -63,10 +124,16 @@ __start:
   /* If a0 (mhartid) >= t1 (the number of CPUs), stop here */
 
   blt  a0, t1, 3f
-  csrw mie, zero
+  csrw sie, zero
+  /* Previously: csrw mie, zero */
   wfi
 
 3:
+  /* Print `5` */
+  li  t0, 0x10000000
+  li  t1, 0x35
+  sb  t1, 0(t0)
+
   /* To get g_cpu_basestack[mhartid], must get g_cpu_basestack first */
 
   la   t0, g_cpu_basestack
@@ -95,13 +162,25 @@ __start:
   add  sp, sp, t0
 
 2:
+  /* Print `6` */
+  li  t0, 0x10000000
+  li  t1, 0x36
+  sb  t1, 0(t0)
 
   /* Disable all interrupts (i.e. timer, external) in mie */
 
-	csrw	mie, zero
+  csrw	sie, zero
+  /* Previously: csrw	mie, zero */
+
+  /* Don't load the Interrupt Vector Table, use OpenSBI for crash logging */
+  /* la   t0, __trap_vec */
+  /* csrw stvec, t0 */
+  /* Previously: csrw mtvec, t0 */
 
-  la   t0, __trap_vec
-  csrw mtvec, t0
+  /* Print `7` */
+  li  t0, 0x10000000
+  li  t1, 0x37
+  sb  t1, 0(t0)
 
   /* Jump to qemu_rv_start */
 
diff --git a/arch/risc-v/src/qemu-rv/qemu_rv_start.c b/arch/risc-v/src/qemu-rv/qemu_rv_start.c
index 303fe217213bc..ce22df7cbb7ad 100644
--- a/arch/risc-v/src/qemu-rv/qemu_rv_start.c
+++ b/arch/risc-v/src/qemu-rv/qemu_rv_start.c
@@ -104,6 +104,7 @@ void qemu_rv_start(int mhartid)
 {
   /* Configure FPU */
 
+  *(volatile uint8_t *)0x10000000 = 'D';////
   riscv_fpuconfig();
 
   if (mhartid > 0)
@@ -112,15 +113,19 @@ void qemu_rv_start(int mhartid)
     }
 
 #ifndef CONFIG_BUILD_KERNEL
+  *(volatile uint8_t *)0x10000000 = 'E';////
   qemu_rv_clear_bss();
 #endif
 
+  *(volatile uint8_t *)0x10000000 = 'F';////
   showprogress('A');
 
 #ifdef USE_EARLYSERIALINIT
-  riscv_earlyserialinit();
+  *(volatile uint8_t *)0x10000000 = 'G';////
+  ////riscv_earlyserialinit();
 #endif
 
+  *(volatile uint8_t *)0x10000000 = 'H';////
   showprogress('B');
 
   /* Do board initialization */
@@ -135,14 +140,17 @@ void qemu_rv_start(int mhartid)
 
   /* Call nx_start() */
 
+  *(volatile uint8_t *)0x10000000 = 'I';////
   nx_start();
 
 cpux:
 
 #ifdef CONFIG_SMP
+  *(volatile uint8_t *)0x10000000 = 'J';////
   riscv_cpu_boot(mhartid);
 #endif
 
+  *(volatile uint8_t *)0x10000000 = 'K';////
   while (true)
     {
       asm("WFI");
@@ -157,6 +165,8 @@ void qemu_rv_start(int mhartid)
 
 void qemu_rv_start(int mhartid)
 {
+  qemu_rv_start_s(mhartid); ////
+#ifdef TODO ////
   /* NOTE: still in M-mode */
 
   if (0 == mhartid)
@@ -216,6 +226,7 @@ void qemu_rv_start(int mhartid)
       "mret \n"
       :: "r" (mhartid)
   );
+#endif //// TODO
 }
 #endif
 
diff --git a/boards/risc-v/qemu-rv/rv-virt/configs/knsh64/defconfig b/boards/risc-v/qemu-rv/rv-virt/configs/knsh64/defconfig
index 5500f7d76415c..da03c971932cc 100644
--- a/boards/risc-v/qemu-rv/rv-virt/configs/knsh64/defconfig
+++ b/boards/risc-v/qemu-rv/rv-virt/configs/knsh64/defconfig
@@ -31,9 +31,9 @@ CONFIG_ARCH_HEAP_VBASE=0xC0200000
 CONFIG_ARCH_INTERRUPTSTACK=2048
 CONFIG_ARCH_KERNEL_STACKSIZE=3072
 CONFIG_ARCH_PGPOOL_MAPPING=y
-CONFIG_ARCH_PGPOOL_PBASE=0x80400000
+CONFIG_ARCH_PGPOOL_PBASE=0x40600000
 CONFIG_ARCH_PGPOOL_SIZE=4194304
-CONFIG_ARCH_PGPOOL_VBASE=0x80400000
+CONFIG_ARCH_PGPOOL_VBASE=0x40600000
 CONFIG_ARCH_RISCV=y
 CONFIG_ARCH_STACKDUMP=y
 CONFIG_ARCH_TEXT_NPAGES=128
@@ -77,7 +77,7 @@ CONFIG_NSH_FILE_APPS=y
 CONFIG_NSH_READLINE=y
 CONFIG_PATH_INITIAL="/system/bin"
 CONFIG_RAM_SIZE=1048576
-CONFIG_RAM_START=0x80100000
+CONFIG_RAM_START=0x40200000
 CONFIG_READLINE_CMD_HISTORY=y
 CONFIG_RISCV_SEMIHOSTING_HOSTFS=y
 CONFIG_RR_INTERVAL=200
diff --git a/boards/risc-v/qemu-rv/rv-virt/configs/nsh64/defconfig b/boards/risc-v/qemu-rv/rv-virt/configs/nsh64/defconfig
index e7870d9c94bdb..a5260c5b20847 100644
--- a/boards/risc-v/qemu-rv/rv-virt/configs/nsh64/defconfig
+++ b/boards/risc-v/qemu-rv/rv-virt/configs/nsh64/defconfig
@@ -54,7 +54,7 @@ CONFIG_NSH_SYMTAB_ARRAYNAME="g_symtab"
 CONFIG_NSH_SYMTAB_COUNTNAME="g_nsymbols"
 CONFIG_PATH_INITIAL="/system/bin"
 CONFIG_RAM_SIZE=33554432
-CONFIG_RAM_START=0x80000000
+CONFIG_RAM_START=0x40200000
 CONFIG_READLINE_CMD_HISTORY=y
 CONFIG_RISCV_SEMIHOSTING_HOSTFS=y
 CONFIG_RR_INTERVAL=200
diff --git a/boards/risc-v/qemu-rv/rv-virt/scripts/ld-kernel64.script b/boards/risc-v/qemu-rv/rv-virt/scripts/ld-kernel64.script
index bfab060ee6845..d4ec5ef1320db 100644
--- a/boards/risc-v/qemu-rv/rv-virt/scripts/ld-kernel64.script
+++ b/boards/risc-v/qemu-rv/rv-virt/scripts/ld-kernel64.script
@@ -20,9 +20,12 @@
 
 MEMORY
 {
-    kflash (rx) : ORIGIN = 0x80000000, LENGTH = 2048K   /* w/ cache */
-    ksram (rwx) : ORIGIN = 0x80200000, LENGTH = 2048K   /* w/ cache */
-    pgram (rwx) : ORIGIN = 0x80400000, LENGTH = 4096K   /* w/ cache */
+    /* Previously 0x80000000 */
+    kflash (rx) : ORIGIN = 0x40200000, LENGTH = 2048K   /* w/ cache */
+    /* Previously 0x80200000 */
+    ksram (rwx) : ORIGIN = 0x40400000, LENGTH = 2048K   /* w/ cache */
+    /* Previously 0x80400000 */
+    pgram (rwx) : ORIGIN = 0x40600000, LENGTH = 4096K   /* w/ cache */
 }
 
 OUTPUT_ARCH("riscv")
@@ -42,7 +45,8 @@ __pgheap_size = LENGTH(pgram);
 
 SECTIONS
 {
-  . = 0x80000000;
+  /* Previously 0x80000000 */
+  . = 0x40200000;
 
   .text :
     {
diff --git a/boards/risc-v/qemu-rv/rv-virt/scripts/ld.script b/boards/risc-v/qemu-rv/rv-virt/scripts/ld.script
index 664bbb178f1d7..fb83dd0ad8e4f 100644
--- a/boards/risc-v/qemu-rv/rv-virt/scripts/ld.script
+++ b/boards/risc-v/qemu-rv/rv-virt/scripts/ld.script
@@ -20,7 +20,8 @@
 
 SECTIONS
 {
-  . = 0x80000000;
+  /* Previously 0x80000000 */
+  . = 0x40200000;
 
   .text :
     {
diff --git a/drivers/serial/uart_16550.c b/drivers/serial/uart_16550.c
index 3d5175617c5d6..98067123d5069 100644
--- a/drivers/serial/uart_16550.c
+++ b/drivers/serial/uart_16550.c
@@ -702,9 +702,10 @@ static inline uint32_t u16550_divisor(FAR struct u16550_s *priv)
 
 static int u16550_setup(FAR struct uart_dev_s *dev)
 {
+  *(volatile uint8_t *)0x10000000 = 'c';////
 #ifndef CONFIG_16550_SUPRESS_CONFIG
   FAR struct u16550_s *priv = (FAR struct u16550_s *)dev->priv;
-  uint16_t div;
+  ////uint16_t div;
   uint32_t lcr;
 #if defined(CONFIG_SERIAL_IFLOWCONTROL) || defined(CONFIG_SERIAL_OFLOWCONTROL)
   uint32_t mcr;
@@ -712,17 +713,22 @@ static int u16550_setup(FAR struct uart_dev_s *dev)
 
   /* Clear fifos */
 
+  *(volatile uint8_t *)0x10000000 = 'd';////
   u16550_serialout(priv, UART_FCR_OFFSET,
                    (UART_FCR_RXRST | UART_FCR_TXRST));
 
+#ifdef TODO ////
   /* Set trigger */
 
+  *(volatile uint8_t *)0x10000000 = 'e';////
   u16550_serialout(priv, UART_FCR_OFFSET,
                    (UART_FCR_FIFOEN | UART_FCR_RXTRIGGER_8));
 
   /* Set up the IER */
 
+  *(volatile uint8_t *)0x10000000 = 'f';////
   priv->ier = u16550_serialin(priv, UART_IER_OFFSET);
+#endif //// TODO
 
   /* Set up the LCR */
 
@@ -761,8 +767,10 @@ static int u16550_setup(FAR struct uart_dev_s *dev)
       lcr |= (UART_LCR_PEN | UART_LCR_EPS);
     }
 
+#ifdef TODO ////
   /* Enter DLAB=1 */
 
+  *(volatile uint8_t *)0x10000000 = 'g';////
   u16550_serialout(priv, UART_LCR_OFFSET, (lcr | UART_LCR_DLAB));
 
   /* Set the BAUD divisor */
@@ -777,13 +785,16 @@ static int u16550_setup(FAR struct uart_dev_s *dev)
 
   /* Configure the FIFOs */
 
+  *(volatile uint8_t *)0x10000000 = 'h';////
   u16550_serialout(priv, UART_FCR_OFFSET,
                    (UART_FCR_RXTRIGGER_8 | UART_FCR_TXRST | UART_FCR_RXRST |
                     UART_FCR_FIFOEN));
+#endif //// TODO
 
   /* Set up the auto flow control */
 
 #if defined(CONFIG_SERIAL_IFLOWCONTROL) || defined(CONFIG_SERIAL_OFLOWCONTROL)
+  *(volatile uint8_t *)0x10000000 = 'i';////
   mcr = u16550_serialin(priv, UART_MCR_OFFSET);
   if (priv->flow)
     {
@@ -796,16 +807,19 @@ static int u16550_setup(FAR struct uart_dev_s *dev)
 
   mcr |= UART_MCR_RTS;
 
+  *(volatile uint8_t *)0x10000000 = 'j';////
   u16550_serialout(priv, UART_MCR_OFFSET, mcr);
 #endif /* defined(CONFIG_SERIAL_IFLOWCONTROL) || defined(CONFIG_SERIAL_OFLOWCONTROL) */
 
   /* Reconfigure DMA Rx timeout value */
 
 #ifdef HAVE_16550_UART_DMA
+  *(volatile uint8_t *)0x10000000 = 'k';////
   u16550_dmarxconfig(dev);
 #endif
 
 #endif
+  *(volatile uint8_t *)0x10000000 = 'l';////
   return OK;
 }
 
@@ -1602,8 +1616,9 @@ static void u16550_txint(struct uart_dev_s *dev, bool enable)
 
 static bool u16550_txready(struct uart_dev_s *dev)
 {
-  FAR struct u16550_s *priv = (FAR struct u16550_s *)dev->priv;
-  return ((u16550_serialin(priv, UART_LSR_OFFSET) & UART_LSR_THRE) != 0);
+  return true;
+  ////FAR struct u16550_s *priv = (FAR struct u16550_s *)dev->priv;
+  ////return ((u16550_serialin(priv, UART_LSR_OFFSET) & UART_LSR_THRE) != 0);
 }
 
 /****************************************************************************
@@ -1631,7 +1646,7 @@ static bool u16550_txempty(struct uart_dev_s *dev)
 #ifdef HAVE_16550_CONSOLE
 static void u16550_putc(FAR struct u16550_s *priv, int ch)
 {
-  while ((u16550_serialin(priv, UART_LSR_OFFSET) & UART_LSR_THRE) == 0);
+  ////while ((u16550_serialin(priv, UART_LSR_OFFSET) & UART_LSR_THRE) == 0);
   u16550_serialout(priv, UART_THR_OFFSET, (uart_datawidth_t)ch);
 }
 #endif
@@ -1655,6 +1670,7 @@ static void u16550_putc(FAR struct u16550_s *priv, int ch)
 
 void u16550_earlyserialinit(void)
 {
+  *(volatile uint8_t *)0x10000000 = 'a';////
   /* Configuration whichever one is the console */
 
 #ifdef CONSOLE_DEV
@@ -1663,6 +1679,7 @@ void u16550_earlyserialinit(void)
   u16550_setup(&CONSOLE_DEV);
 #endif
 #endif
+  *(volatile uint8_t *)0x10000000 = 'b';////
 }
 
 /****************************************************************************
diff --git a/tools/Unix.mk b/tools/Unix.mk
index 62f74b8c6f870..879ec7b865e6b 100644
--- a/tools/Unix.mk
+++ b/tools/Unix.mk
@@ -250,7 +250,7 @@ tools/mkconfig$(HOSTEXEEXT):
 include/nuttx/config.h: $(TOPDIR)/.config tools/mkconfig$(HOSTEXEEXT)
 	$(Q) grep -v "CONFIG_BASE_DEFCONFIG" "$(TOPDIR)/.config" > "$(TOPDIR)/.config.tmp"
 	$(Q) if ! cmp -s "$(TOPDIR)/.config.tmp" "$(TOPDIR)/.config.orig" ; then \
-		sed -i.bak "/CONFIG_BASE_DEFCONFIG/ { /-dirty/! s/\"$$/-dirty\"/ }" "$(TOPDIR)/.config"; \
+		sed -i.bak "/CONFIG_BASE_DEFCONFIG/s/\"$$/-dirty\"/" "$(TOPDIR)/.config"; \
 	else \
 		sed -i.bak "s/-dirty//g" "$(TOPDIR)/.config"; \
 	fi