Hi Liu, I could trace the illegal instruction during qemu startup down to this function in cpu-all.h cpu_get_real_ticks(void) which is using the time base registers - the crash is during vm_start - cpu_enable_ticks which calls cpu_get_real_ticks. I believe e500 is using SPR's for this purpose and not dedicated time base registers - am I missing a patch to this file? This is what I have in cpu_get_real_ticks - ( _ARCH_PPC is defined and not ARCH_PPC64) __asm__ __volatile__ ( "mftbu %1\n\t" "mftb %L0\n\t" "mftbu %0\n\t" "cmpw %0,%1\n\t" "bne $-16" : "=r" (retval), "=r" (junk)); I did try to short circuit this by borrowing this from the code below to see if I can avoid the crash which I could do so - static int64_t ticks = 0; return ticks++ qemu does boot up and goes to the qemu prompt when I telnet to the boardip/port but I don't seem to get any login prompt for the VM - bear with me..but I am fiddling with this - sending this out anyway for suggestions.. On my 8548 CDS board /bin # ./qemu-system-ppcemb -enable-kvm -m 64 -nographic -M mpc8544ds -kernel /tmp/uImage.8544 -initrd /tmp/rootfs.ext2.gz.small -L /usr/local/share/qemu -append "root=/dev/ram rw console=ttyS0,115200" -serial tcp::4444,server << goes to qemu prompt when I telnet to board ip / port >> (qemu) (qemu) info version 0.9.1 (qemu) info network VLAN 0 devices: user.0: virtio.0: model=virtio,macaddr=52:54:00:12:34:56 (qemu) info kvm kvm support: enabled (qemu) info status VM status: running On the telnet session: $ telnet 10.11.224.180 4444 Trying 10.11.224.180... Connected to 10.11.224.180 (10.11.224.180). Escape character is '^]'. << nothing here >> i'd appreciate your reply.. Thanks, Rahul -- To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html