diff --git a/Documentation/mainboard/emulation/qemu-riscv.md b/Documentation/mainboard/emulation/qemu-riscv.md
new file mode 100644
index 0000000000..3aad816855
--- /dev/null
+++ b/Documentation/mainboard/emulation/qemu-riscv.md
@@ -0,0 +1,8 @@
+# Qemu RISC-V emulator
+
+## Building coreboot and running it in Qemu
+
+- Configure coreboot and run `make` as usual
+- Run `util/riscv/make-spike-elf.sh build/coreboot.rom build/coreboot.elf` to
+  convert coreboot to an ELF that Qemu can load
+- Run `qemu-system-riscv64 -M virt -m 1024M -nographic -kernel build/coreboot.elf`
diff --git a/Documentation/mainboard/index.md b/Documentation/mainboard/index.md
index 93ee828a0a..d8d3b76fde 100644
--- a/Documentation/mainboard/index.md
+++ b/Documentation/mainboard/index.md
@@ -19,6 +19,7 @@ This section contains documentation about coreboot on specific mainboards.
 The boards in this section are not real mainboards, but emulators.
 
 - [Spike RISC-V emulator](emulation/spike-riscv.md)
+- [Qemu RISC-V emulator](emulation/qemu-riscv.md)
 
 ## Intel
 
diff --git a/src/mainboard/emulation/qemu-riscv/Kconfig b/src/mainboard/emulation/qemu-riscv/Kconfig
index 528b21e09b..ecaa76468b 100644
--- a/src/mainboard/emulation/qemu-riscv/Kconfig
+++ b/src/mainboard/emulation/qemu-riscv/Kconfig
@@ -13,7 +13,8 @@
 ## GNU General Public License for more details.
 
 # To execute, do:
-# qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom
+# util/riscv/make-spike-elf.sh build/coreboot.rom build/coreboot.elf
+# qemu-system-riscv64 -M virt -m 1024M -nographic -kernel build/coreboot.elf
 
 if BOARD_EMULATION_QEMU_RISCV
 
diff --git a/src/mainboard/emulation/qemu-riscv/Makefile.inc b/src/mainboard/emulation/qemu-riscv/Makefile.inc
index 1d882acc63..eb99544c35 100644
--- a/src/mainboard/emulation/qemu-riscv/Makefile.inc
+++ b/src/mainboard/emulation/qemu-riscv/Makefile.inc
@@ -14,7 +14,7 @@
 
 bootblock-y += uart.c
 bootblock-y += rom_media.c
-bootblock-y += mtime.c
+bootblock-y += clint.c
 
 romstage-y += romstage.c
 romstage-y += uart.c
@@ -22,8 +22,10 @@ romstage-y += rom_media.c
 
 ramstage-y += uart.c
 ramstage-y += rom_media.c
-ramstage-y += mtime.c
+ramstage-y += clint.c
 
 bootblock-y += memlayout.ld
 romstage-y += memlayout.ld
 ramstage-y += memlayout.ld
+
+CPPFLAGS_common += -I$(src)/mainboard/$(MAINBOARDDIR)/include
diff --git a/src/mainboard/emulation/qemu-riscv/mtime.c b/src/mainboard/emulation/qemu-riscv/clint.c
similarity index 77%
rename from src/mainboard/emulation/qemu-riscv/mtime.c
rename to src/mainboard/emulation/qemu-riscv/clint.c
index f8c2717563..367d48d4ae 100644
--- a/src/mainboard/emulation/qemu-riscv/mtime.c
+++ b/src/mainboard/emulation/qemu-riscv/clint.c
@@ -14,9 +14,12 @@
  */
 
 #include <mcall.h>
+#include <mainboard/addressmap.h>
 
-/* FIXME: This is an empty implementation, please improve */
 /* This function is used to initialize HLS()->time/HLS()->timecmp  */
 void mtime_init(void)
 {
+	long hart_id = read_csr(mhartid);
+	HLS()->time = (uint64_t *)(QEMU_VIRT_CLINT + 0xbff8);
+	HLS()->timecmp = (uint64_t *)(QEMU_VIRT_CLINT + 0x4000 + 8 * hart_id);
 }
diff --git a/src/mainboard/emulation/qemu-riscv/include/mainboard/addressmap.h b/src/mainboard/emulation/qemu-riscv/include/mainboard/addressmap.h
new file mode 100644
index 0000000000..fd8c136548
--- /dev/null
+++ b/src/mainboard/emulation/qemu-riscv/include/mainboard/addressmap.h
@@ -0,0 +1,20 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2018 Philipp Hug
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#define QEMU_VIRT_CLINT		0x02000000
+#define QEMU_VIRT_PLIC		0x0c000000
+#define QEMU_VIRT_UART0		0x10000000
+#define QEMU_VIRT_VIRTIO	0x10001000
+#define QEMU_VIRT_DRAM		0x80000000
diff --git a/src/mainboard/emulation/qemu-riscv/mainboard.c b/src/mainboard/emulation/qemu-riscv/mainboard.c
index 7061bcfd35..4b428aa486 100644
--- a/src/mainboard/emulation/qemu-riscv/mainboard.c
+++ b/src/mainboard/emulation/qemu-riscv/mainboard.c
@@ -16,6 +16,7 @@
 #include <console/console.h>
 #include <device/device.h>
 #include <cbmem.h>
+#include <symbols.h>
 
 static void mainboard_enable(struct device *dev)
 {
@@ -24,7 +25,7 @@ static void mainboard_enable(struct device *dev)
 		die("No dev0; die\n");
 	}
 
-	ram_resource(dev, 0, 2048, 32768);
+	ram_resource(dev, 0, (uintptr_t)_dram / KiB, CONFIG_DRAM_SIZE_MB * KiB);
 	cbmem_recovery(0);
 }
 
diff --git a/src/mainboard/emulation/qemu-riscv/memlayout.ld b/src/mainboard/emulation/qemu-riscv/memlayout.ld
index 615d1f2b72..032fbddecf 100644
--- a/src/mainboard/emulation/qemu-riscv/memlayout.ld
+++ b/src/mainboard/emulation/qemu-riscv/memlayout.ld
@@ -14,15 +14,16 @@
  */
 
 #include <memlayout.h>
-
 #include <arch/header.ld>
 
+#define START 0x80000000
+
 SECTIONS
 {
-	DRAM_START(0x0)
-	BOOTBLOCK(0x0, 64K)
-	ROMSTAGE(0x20000, 128K)
-	STACK(0x40000, 0x3ff00)
-	PRERAM_CBMEM_CONSOLE(0x80000, 8K)
-	RAMSTAGE(0x100000, 16M)
+	DRAM_START(START)
+	BOOTBLOCK(START, 64K)
+	STACK(START + 4M, 4K)
+	ROMSTAGE(START + 4M + 64K, 128K)
+	PRERAM_CBMEM_CONSOLE(START + 4M + 192K, 8K)
+	RAMSTAGE(START + 4M + 200K, 16M)
 }
diff --git a/src/mainboard/emulation/qemu-riscv/rom_media.c b/src/mainboard/emulation/qemu-riscv/rom_media.c
index c1713074f9..bac19846c5 100644
--- a/src/mainboard/emulation/qemu-riscv/rom_media.c
+++ b/src/mainboard/emulation/qemu-riscv/rom_media.c
@@ -14,11 +14,12 @@
  * GNU General Public License for more details.
  */
 #include <boot_device.h>
+#include <symbols.h>
 
-/* This assumes that the CBFS resides at 0x0, which is true for the default
- * configuration. */
+/* This assumes that the CBFS resides at start of dram, which is true for the
+ * default configuration. */
 static const struct mem_region_device boot_dev =
-	MEM_REGION_DEV_RO_INIT(NULL, CONFIG_ROM_SIZE);
+	MEM_REGION_DEV_RO_INIT(_dram, CONFIG_ROM_SIZE);
 
 const struct region_device *boot_device_ro(void)
 {
diff --git a/src/mainboard/emulation/qemu-riscv/uart.c b/src/mainboard/emulation/qemu-riscv/uart.c
index 730ef3e0de..084362abcf 100644
--- a/src/mainboard/emulation/qemu-riscv/uart.c
+++ b/src/mainboard/emulation/qemu-riscv/uart.c
@@ -17,8 +17,9 @@
 #include <console/uart.h>
 #include <arch/io.h>
 #include <boot/coreboot_tables.h>
+#include <mainboard/addressmap.h>
 
-static uint8_t *buf = (void *)0x3f8;
+static uint8_t *buf = (void *)QEMU_VIRT_UART0;
 uintptr_t uart_platform_base(int idx)
 {
 	return (uintptr_t) buf;
@@ -47,7 +48,7 @@ void uart_fill_lb(void *data)
 {
 	struct lb_serial serial;
 	serial.type = LB_SERIAL_TYPE_MEMORY_MAPPED;
-	serial.baseaddr = 0x3f8;
+	serial.baseaddr = QEMU_VIRT_UART0;
 	serial.baud = 115200;
 	serial.regwidth = 1;
 	lb_add_serial(&serial, data);