Fix two XThead immediate decoding issues in the RISC-V disassembler, fix
vector immediate signedness handling, and make operand extraction more
explicit.

The first patch aligns th.srri decoding with target/riscv/xthead.decode:
th_srri uses bits 31:26 as 000100 and bit 25 as shamt[5], while the
disassembler switches on bits 31:25.

The second patch extracts the full 6-bit immediate field for
rv_codec_r2_imm6, which fixes the immediate printed for th.srri and
th.tst.

The third patch makes operand_vimm() return int32_t, matching the signed
5-bit vector immediate value it extracts.

The fourth patch decodes unsigned 5-bit vector immediates with a separate
codec, matching the target translator paths that zero-extend or truncate
those fields.

The fifth patch follows Richard's review suggestion by converting operand
helper bit extraction to extract32() or sextract32(). Signed immediates use
sextract32() on the sign-bearing field and combine it with the remaining
extract32() fields.

This series is based on Alistair's riscv-to-apply.next branch:
9afc75682112 ("hw/riscv/riscv-iommu.c: make FCTL.BE read only 0")

Testing:
- Applied and tested on top of Alistair's riscv-to-apply.next branch.
- Verified with an external test branch that adds unit coverage:
  https://github.com/LLyndra/qemu.git b4-disas-riscv-v2-tests

  The added tests cover XThead th.srri/th.tst immediate decoding,
  signed vector immediates, unsigned vector immediate operands, and
  signed base ISA I-immediate extraction.
- Commands run:
    ./configure --target-list=riscv64-softmmu --disable-docs \
        --prefix=/tmp/qemu-riscv-disas-test --cross-prefix=
    ninja -C build tests/unit/test-riscv-disas
    build/tests/unit/test-riscv-disas --tap -k
- Result:
    test-riscv-disas passed: 37/37 TAP tests ok.

---
Changes in v3:
- Updated the extract-helper cleanup patch to use sextract32() on the
  sign-bearing field directly, as suggested by Richard.
- Link to v2: https://lore.kernel.org/qemu-devel/20260701-b4-disas-xthead-fix-riscv-next-v2-0-e6e4ff5a7847@linux.alibaba.com

Changes in v2:
- Collected Reviewed-by tags from Daniel.
- Kept the 6-bit immediate fix as a minimal correctness change.
- Added a patch making the signed vector immediate helper return a signed
  type.
- Added a patch decoding unsigned vector immediates separately from signed
  vector immediates.
- Added a cleanup patch using extract32()/sextract32() for replaceable
  operand helper field extraction, including split immediates, as
  suggested by Richard.
- Link to v1: https://lore.kernel.org/qemu-devel/20260626-b4-disas-xthead-fix-riscv-next-v1-0-74228a3c1b21@linux.alibaba.com

---
TANG Tiancheng (5):
      disas/riscv: Fix th.srri decoding
      disas/riscv: Fix 6-bit immediate extraction
      disas/riscv: Use signed type for vector immediates
      disas/riscv: Decode unsigned vector immediates as unsigned
      disas/riscv: Use extract helpers for operand fields

 disas/riscv-xthead.c |   6 +-
 disas/riscv.c        | 263 +++++++++++++++++++++++++++------------------------
 disas/riscv.h        |   1 +
 3 files changed, 142 insertions(+), 128 deletions(-)
---
base-commit: 9afc756821123d0b9dfbf3c5673d82b048a6248a
change-id: 20260623-b4-disas-xthead-fix-riscv-next-c6af6a09d2dc

Best regards,
-- 
TANG Tiancheng <lyndra@linux.alibaba.com>