The 2.6.28 kernel dies in memcpy when called from set_vi_srs_handler on a 24K processor. The problem is that ebase has an invalid value. The original value of ebase comes from a bootmem allocation, but the following code in set_uncached_handler takes a perfectly good kseg0 address and turns it into an invalid kseg1 address. if (cpu_has_mips_r2) ebase += (read_c0_ebase() & 0x3ffff000); This code was added in commit 566f74f6b2f8b85d5b8d6caaf97e5672cecd3e3e. I have no idea why ebase needs to be modified at all, so I have no patch to offer. When I removed these two lines, my kernel booted to a shell prompt. -- David VomLehn, dvomlehn@xxxxxxxxx