diff --git a/.gitignore b/.gitignore
index 6372b6613fce1d365957091124da9f5e7fc01635..ebb81a74e5edae09f8b21f62af028b1bc0366321 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,6 @@ upload_update
 .idea
 build/
 pi4_upload_release
+*.img
+*.dts
+*.dtb
diff --git a/Makefile b/Makefile
index 61edf73955f3f1e3444f150bb18c39402b91d809..662cab545f230974acde0c51374ad5dd8fd68cf0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 # Path
-DISK = 
+DISK = vm0.img
 
 # Compile
 ARCH ?= aarch64
@@ -7,7 +7,7 @@ BUILD_STD = core,alloc
 
 # Toolchain
 TOOLCHAIN=aarch64-none-elf
-QEMU = /usr/share/qemu/bin/qemu-system-aarch64
+QEMU = qemu-system-aarch64
 GDB = ${TOOLCHAIN}-gdb
 OBJDUMP = ${TOOLCHAIN}-objdump
 
@@ -15,10 +15,12 @@ IMAGE=rust_shyper
 
 qemu_debug:
 	cargo build -Z build-std=${BUILD_STD} --target aarch64-qemu.json --features qemu
+	${TOOLCHAIN}-objcopy target/aarch64-qemu/debug/${IMAGE} -O binary target/aarch64-qemu/debug/${IMAGE}.bin
 	${OBJDUMP} --demangle -d target/aarch64-qemu/debug/${IMAGE} > target/aarch64-qemu/debug/t.txt
 
 qemu_release:
 	cargo build -Z build-std=${BUILD_STD} --target aarch64-qemu.json --features qemu --release
+	${TOOLCHAIN}-objcopy target/aarch64-qemu/release/${IMAGE} -O binary target/aarch64-qemu/release/${IMAGE}.bin
 	${OBJDUMP} --demangle -d target/aarch64-qemu/release/${IMAGE} > target/aarch64-qemu/release/t.txt
 
 tx2:
@@ -46,49 +48,31 @@ pi4_release:
 	bash pi4_upload_release
 	${OBJDUMP} --demangle -d target/aarch64-pi4/release/${IMAGE} > target/aarch64-pi4/release/t.txt
 
+
+QEMU_COMMON_OPTIONS = -machine virt,virtualization=on,gic-version=2\
+	-m 8g -cpu cortex-a57 -smp 4 -display none -global virtio-mmio.force-legacy=false
+
+QEMU_SERIAL_OPTIONS = -serial stdio #\
+	-serial telnet:localhost:12345,server
+
+QEMU_NETWORK_OPTIONS = -netdev user,id=n0,hostfwd=tcp::5555-:22 -device virtio-net-device,bus=virtio-mmio-bus.24,netdev=n0
+
+QEMU_DISK_OPTIONS = -drive file=${DISK},if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.25
+
 run:
-	${QEMU} \
-		-machine virt,virtualization=on,gic-version=2\
-		-drive file=${DISK},if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.0 \
-		-m 8g \
-		-cpu cortex-a57 \
-		-smp 8 \
-		-kernel target/aarch64/debug/${IMAGE} \
-		-global virtio-mmio.force-legacy=false \
-		-serial stdio \
-		-serial tcp:127.0.0.1:12345 \
-		-serial tcp:127.0.0.1:12346 \
-		-display none
+	${QEMU} ${QEMU_COMMON_OPTIONS} ${QEMU_SERIAL_OPTIONS} ${QEMU_NETWORK_OPTIONS} ${QEMU_DISK_OPTIONS} \
+		-kernel target/aarch64-qemu/debug/${IMAGE}.bin
 
 run_release:
-	${QEMU} \
-		-machine virt,virtualization=on,gic-version=2\
-		-drive file=${DISK},if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.0 \
-		-m 8g \
-		-cpu cortex-a57 \
-		-smp 8 \
-		-kernel target/aarch64/release/${IMAGE} \
-		-global virtio-mmio.force-legacy=false \
-		-serial stdio \
-		-serial tcp:127.0.0.1:12345 \
-		-serial tcp:127.0.0.1:12346 \
-		-display none
+	${QEMU} ${QEMU_COMMON_OPTIONS} ${QEMU_SERIAL_OPTIONS} ${QEMU_NETWORK_OPTIONS} ${QEMU_DISK_OPTIONS} \
+		-kernel target/aarch64-qemu/release/${IMAGE}.bin
 
 debug:
-	${QEMU} \
-		-machine virt,virtualization=on,gic-version=2\
-		-drive file=${DISK},if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.0 \
-		-m 8g \
-		-cpu cortex-a57 \
-		-smp 8 \
-		-kernel target/aarch64/debug/${IMAGE} \
-		-global virtio-mmio.force-legacy=false \
-		-serial stdio \
-		-serial tcp:127.0.0.1:12345 \
-		-serial tcp:127.0.0.1:12346 \
-		-display none \
+	${QEMU} ${QEMU_COMMON_OPTIONS} ${QEMU_SERIAL_OPTIONS} ${QEMU_NETWORK_OPTIONS} ${QEMU_DISK_OPTIONS} \
+		-kernel target/aarch64-qemu/debug/${IMAGE}.bin \
 		-s -S
 
+.PHONY: gdb clean
 
 gdb:
 	${GDB} -x gdb/aarch64.gdb
diff --git a/README.ch.md b/README.ch.md
index 52bf18dd3ad1651d391b5abe740b24004d024798..7b5594a36f4da26788bb950b014538f4a67148ec 100644
--- a/README.ch.md
+++ b/README.ch.md
@@ -17,7 +17,7 @@ Rust-Shyper是由北航计算机学院操作系统研究团队，在华为技术
 **aarch64**
 - [x] NVIDIA Jetson TX2
 - [x] Raspberry Pi 4 Model B
-- [ ] QEMU (still work in progress)
+- [x] QEMU (note that VM migration and Hypervisor Live-update is not supported on QEMU)
 
 ## 如何编译
 
diff --git a/README.md b/README.md
index ea068527bd4c89aacd4b64b9a6d2d0857e6f8e09..09f12c5282abcf928313b89f9030a14bbbfd6ddc 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ The list of supported (and work in progress) platforms is presented below:
 **aarch64**
 - [x] NVIDIA Jetson TX2
 - [x] Raspberry Pi 4 Model B
-- [ ] QEMU (still work in progress)
+- [x] QEMU (note that VM migration and Hypervisor Live-update is not supported on QEMU)
 
 ## How to Build
 
diff --git a/aarch64-qemu.json b/aarch64-qemu.json
index cb1fff6bc0a0161d51fcca774bca288dd03c6279..0763cc97b1693095e6ef893447c4f56e90435409 100644
--- a/aarch64-qemu.json
+++ b/aarch64-qemu.json
@@ -1,12 +1,4 @@
 {
-  "abi-blacklist": [
-    "stdcall",
-    "fastcall",
-    "vectorcall",
-    "thiscall",
-    "win64",
-    "sysv64"
-  ],
   "arch": "aarch64",
   "data-layout": "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128",
   "disable-redzone": true,
diff --git a/gdb/aarch64.gdb b/gdb/aarch64.gdb
new file mode 100644
index 0000000000000000000000000000000000000000..c0df4c0bfb32a20f67ea813fe92bbddec3f8d65f
--- /dev/null
+++ b/gdb/aarch64.gdb
@@ -0,0 +1,7 @@
+target remote 127.0.0.1:1234
+file target/aarch64-qemu/debug/rust_shyper
+break *0x40080000
+display/i $pc
+set confirm off
+display/i $pc
+set print asm-demangle on
diff --git a/src/arch/aarch64/mmu.rs b/src/arch/aarch64/mmu.rs
index 048c792330d0a5383a34e7bdf247b90dfd238c48..ed14b9e4415d1af675a85df0de25e1449afecd48 100644
--- a/src/arch/aarch64/mmu.rs
+++ b/src/arch/aarch64/mmu.rs
@@ -210,7 +210,18 @@ pub extern "C" fn pt_populate(lvl1_pt: &mut PageTables, lvl2_pt: &mut PageTables
     }
     #[cfg(feature = "qemu")]
     {
-        todo!()
+        use crate::arch::LVL2_SHIFT;
+        for index in 0..PLATFORM_PHYSICAL_LIMIT_GB {
+            let pa = index << LVL1_SHIFT;
+            lvl1_pt.lvl1[index] = BlockDescriptor::new(pa, pa < PLAT_DESC.mem_desc.base);
+        }
+        lvl1_pt.lvl1[32] = BlockDescriptor::table(lvl2_base);
+        for (index, pa) in (0..PLAT_DESC.mem_desc.base).step_by(1 << LVL2_SHIFT).enumerate() {
+            if index >= 512 {
+                break;
+            }
+            lvl2_pt.lvl1[index] = BlockDescriptor::new(pa, true);
+        }
     }
 }
 
diff --git a/src/arch/aarch64/start_qemu.S b/src/arch/aarch64/start_qemu.S
index a55c1d30910de34f78e96f3c3fea39cc4243714b..f2a4213db24f2cca6ab885ac86e90cc1062aef65 100644
--- a/src/arch/aarch64/start_qemu.S
+++ b/src/arch/aarch64/start_qemu.S
@@ -4,13 +4,13 @@
 _start:
     mov x20, x0
 // #ifdef PLATFORM_TX2
-    mrs x0, mpidr_el1
-    and x1, x0, #0x100
-    cbz x1, 1f
-    and x0, x0, #3
-    b   2f
-1:  wfe
-    b   1b
+//     mrs x0, mpidr_el1
+//     and x1, x0, #0x100
+//     cbz x1, 1f
+//     and x0, x0, #3
+//     b   2f
+// 1:  wfe
+//     b   1b
 
 // #endif
 // #ifdef PLATFORM_QEMU
@@ -47,7 +47,6 @@ _start:
     adrp x1, boot_stack
     mov x2, (4096 * 2)
     mul x3, x0, x2
-    add x1, x1, x2
     add x1, x1, x3
 
     mov sp, x1
diff --git a/src/board/pi4/platform.rs b/src/board/pi4/platform.rs
index 833d30f79f699a3da480f596c5dee376389dd433..731f147635cd6164508ea80645d5f72289c97a5e 100644
--- a/src/board/pi4/platform.rs
+++ b/src/board/pi4/platform.rs
@@ -16,8 +16,6 @@ use crate::device::ARM_CORTEX_A57;
 #[allow(unused_imports)]
 use crate::device::ARM_NVIDIA_DENVER;
 
-pub const KERNEL_ENTRY: usize = 0xF0080000;
-
 // pub const TIMER_FREQUENCY: usize = 62500000;
 
 pub const UART_0_ADDR: usize = 0xFE201000;
@@ -144,8 +142,11 @@ pub fn platform_cpu_shutdown() {
 }
 
 pub fn platform_power_on_secondary_cores() {
+    extern "C" {
+        fn _image_start();
+    }
     for i in 1..PLAT_DESC.cpu_desc.num {
-        platform_cpu_on(PLAT_DESC.cpu_desc.mpidr_list[i], KERNEL_ENTRY, 0);
+        platform_cpu_on(PLAT_DESC.cpu_desc.mpidr_list[i], _image_start as usize, 0);
     }
 }
 
diff --git a/src/board/qemu/platform.rs b/src/board/qemu/platform.rs
index fcb648af764f12c4cff89f258cead6316b294861..df83e07c7d7be8d11abcb89f2a529c487c017077 100644
--- a/src/board/qemu/platform.rs
+++ b/src/board/qemu/platform.rs
@@ -16,9 +16,7 @@ use crate::board::SchedRule::{self, RoundRobin};
 use crate::device::ARM_CORTEX_A57;
 use crate::driver::{read, write};
 
-pub const KERNEL_ENTRY: usize = 0x43000000;
-
-pub const TIMER_FREQUENCY: usize = 62500000;
+// pub const TIMER_FREQUENCY: usize = 62500000;
 
 pub const UART_0_ADDR: usize = 0x9000000;
 pub const UART_1_ADDR: usize = 0x9100000;
@@ -66,7 +64,7 @@ pub static PLAT_DESC: PlatformConfig = PlatformConfig {
         regions: [
             PlatMemRegion {
                 base: 0x40000000,
-                size: 0x10000000,
+                size: 0x08000000,
             },
             PlatMemRegion {
                 base: 0x50000000,
@@ -116,8 +114,11 @@ pub fn platform_cpu_shutdown() {
 }
 
 pub fn platform_power_on_secondary_cores() {
+    extern "C" {
+        fn _image_start();
+    }
     for i in 1..PLAT_DESC.cpu_desc.num {
-        platform_cpu_on(PLAT_DESC.cpu_desc.mpidr_list[i], KERNEL_ENTRY, 0);
+        platform_cpu_on(PLAT_DESC.cpu_desc.mpidr_list[i], _image_start as usize, 0);
     }
 }
 
diff --git a/src/board/tx2/platform.rs b/src/board/tx2/platform.rs
index 01a311e925bff2451145eaf6f8dc3e1a5f5e84c3..542f68e53998f72613e6371669e63ffd2bc7e1b6 100644
--- a/src/board/tx2/platform.rs
+++ b/src/board/tx2/platform.rs
@@ -16,8 +16,6 @@ use crate::device::ARM_CORTEX_A57;
 #[allow(unused_imports)]
 use crate::device::ARM_NVIDIA_DENVER;
 
-pub const KERNEL_ENTRY: usize = 0x83000000;
-
 // pub const TIMER_FREQUENCY: usize = 62500000;
 
 pub const UART_0_ADDR: usize = 0x3100000;
@@ -137,8 +135,11 @@ pub fn platform_cpu_shutdown() {
 }
 
 pub fn platform_power_on_secondary_cores() {
+    extern "C" {
+        fn _image_start();
+    }
     for i in 1..PLAT_DESC.cpu_desc.num {
-        platform_cpu_on(PLAT_DESC.cpu_desc.mpidr_list[i], KERNEL_ENTRY, 0);
+        platform_cpu_on(PLAT_DESC.cpu_desc.mpidr_list[i], _image_start as usize, 0);
     }
 }
 
diff --git a/src/config/qemu_def.rs b/src/config/qemu_def.rs
index 4780e0c5dfb6826b367b0dc8d0bc632ae0a96ef9..a8e1d7f3f4238c698420a17361337276a5424dc3 100644
--- a/src/config/qemu_def.rs
+++ b/src/config/qemu_def.rs
@@ -19,9 +19,9 @@ use crate::device::EmuDeviceType;
 use crate::kernel::{HVC_IRQ, VmType};
 
 use super::{
-    DEF_VM_CONFIG_TABLE, VmConfigEntry, VmConfigTable, VmCpuConfig, VmEmulatedDeviceConfig, VmImageConfig,
-    VmMemoryConfig, VmPassthroughDeviceConfig, VmRegion, vm_cfg_set_config_name, PassthroughRegion,
-    vm_cfg_add_vm_entry, VmEmulatedDeviceConfigList, VMDtbDevConfigList,
+    VmConfigEntry, VmCpuConfig, VmEmulatedDeviceConfig, VmImageConfig, VmMemoryConfig, VmPassthroughDeviceConfig,
+    VmRegion, vm_cfg_set_config_name, PassthroughRegion, vm_cfg_add_vm_entry, VmEmulatedDeviceConfigList,
+    VMDtbDevConfigList,
 };
 
 #[rustfmt::skip]
@@ -32,22 +32,22 @@ pub fn mvm_config_init() {
     let mut emu_dev_config: Vec<VmEmulatedDeviceConfig> = Vec::new();
     emu_dev_config.push(VmEmulatedDeviceConfig {
         name: Some(String::from("vgicd")),
-        base_ipa: 0x8000000,
+        base_ipa: PLATFORM_GICD_BASE,
         length: 0x1000,
         irq_id: 0,
         cfg_list: Vec::new(),
         emu_type: EmuDeviceType::EmuDeviceTGicd,
         mediated: false,
     });
-    emu_dev_config.push(VmEmulatedDeviceConfig {
-        name: Some(String::from("virtio-blk0")),
-        base_ipa: 0xa000000,
-        length: 0x1000,
-        irq_id: 32 + 0x10,
-        cfg_list: vec![DISK_PARTITION_1_START, DISK_PARTITION_1_SIZE],
-        emu_type: EmuDeviceType::EmuDeviceTVirtioBlk,
-        mediated: false,
-    });
+    // emu_dev_config.push(VmEmulatedDeviceConfig {
+    //     name: Some(String::from("virtio-blk0")),
+    //     base_ipa: 0xa000000,
+    //     length: 0x1000,
+    //     irq_id: 32 + 0x10,
+    //     cfg_list: vec![DISK_PARTITION_1_START, DISK_PARTITION_1_SIZE],
+    //     emu_type: EmuDeviceType::EmuDeviceTVirtioBlk,
+    //     mediated: false,
+    // });
     emu_dev_config.push(VmEmulatedDeviceConfig {
         name: Some(String::from("virtio-nic0")),
         base_ipa: 0xa001000,
@@ -70,12 +70,13 @@ pub fn mvm_config_init() {
     // vm0 passthrough
     let mut pt_dev_config: VmPassthroughDeviceConfig = VmPassthroughDeviceConfig::default();
     pt_dev_config.regions = vec![
-        PassthroughRegion { ipa: 0x9000000, pa: UART_1_ADDR, length: 0x1000, dev_property: true },
+        PassthroughRegion { ipa: UART_0_ADDR, pa: UART_0_ADDR, length: 0x1000, dev_property: true },
         PassthroughRegion { ipa: PLATFORM_GICC_BASE, pa: PLATFORM_GICV_BASE, length: 0x2000, dev_property: true },
+        // pass-througn virtio blk/net
         PassthroughRegion { ipa: 0x0a003000, pa: 0x0a003000, length: 0x1000, dev_property: true },
     ];
-    pt_dev_config.irqs = vec![UART_1_INT, 27, 32 + 0x2e];
-    pt_dev_config.streams_ids = vec![]; // TODO
+    pt_dev_config.irqs = vec![33, 27, 32 + 0x28, 32 + 0x29];
+    pt_dev_config.streams_ids = vec![];
     // pt_dev_config.push(VmPassthroughDeviceConfig {
     //     name: Some(String::from("serial0")),
     //     base_pa: UART_1_ADDR,
@@ -112,21 +113,22 @@ pub fn mvm_config_init() {
         id: 0,
         name: Some(String::from("supervisor")),
         os_type: VmType::VmTOs,
-        cmdline: String::from(""), // TODO
+        cmdline: String::from("earlycon console=ttyAMA0 root=/dev/vda rw audit=0 default_hugepagesz=32M hugepagesz=32M hugepages=4\0"),
         image: Arc::new(Mutex::new(VmImageConfig {
             kernel_img_name: Some("Image"),
-            kernel_load_ipa: 0x58080000,
+            kernel_load_ipa: 0x80080000,
             kernel_load_pa: 0,
-            kernel_entry_point: 0x58080000,
+            kernel_entry_point: 0x80080000,
             // device_tree_filename: Some("qemu1.bin"),
-            device_tree_load_ipa: 0x52000000,
+            device_tree_load_ipa: 0x80000000,
             // ramdisk_filename: Some("initrd.gz"),
-            ramdisk_load_ipa: 0x53000000,
+            // ramdisk_load_ipa: 0x53000000,
+            ramdisk_load_ipa: 0,
             mediated_block_index: None,
         })),
         cpu: Arc::new(Mutex::new(VmCpuConfig {
             num: 4,
-            allocate_bitmap: 0b0001,
+            allocate_bitmap: 0b1111,
             master: -1,
         })),
         memory: Arc::new(Mutex::new(VmMemoryConfig {
diff --git a/src/device/device_tree.rs b/src/device/device_tree.rs
index 576775876b1d6925de2704f254059035300ebef8..31483afa64ec048bbf9ef2b63a8a09cd4e13d8cd 100644
--- a/src/device/device_tree.rs
+++ b/src/device/device_tree.rs
@@ -96,6 +96,64 @@ pub fn init_vm0_dtb(dtb: *mut fdt::myctypes::c_void) {
         let slice = core::slice::from_raw_parts(pi_fdt as *const u8, len as usize);
         SYSTEM_FDT.call_once(|| slice.to_vec());
     }
+    #[cfg(feature = "qemu")]
+    unsafe {
+        use fdt::*;
+        println!("fdt orignal size {}, ptr {dtb:#p}", fdt_size(dtb));
+        fdt_pack(dtb);
+        fdt_enlarge(dtb);
+        fdt_clear_initrd(dtb);
+        assert_eq!(fdt_disable_node(dtb, "/platform@c000000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/fw-cfg@9020000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/memory@40000000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000200\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000400\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000600\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000800\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000a00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000c00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a000e00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001200\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001400\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001600\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001800\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001a00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001c00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a001e00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002200\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002400\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002600\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002800\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002a00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002c00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a002e00\0".as_ptr()), 0);
+        // keep a003000 & a003200 for passthrough blk/net
+        // assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003000\0".as_ptr()), 0);
+        // assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003200\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003400\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003600\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003800\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003a00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003c00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/virtio_mmio@a003e00\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/gpio-keys\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/pl061@9030000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/pcie@10000000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/pl031@9010000\0".as_ptr()), 0);
+        // pass through the only one uart on qemu-system-aarch64
+        // assert_eq!(fdt_remove_node(dtb, "/pl011@9000000\0".as_ptr()), 0);
+
+        assert_eq!(fdt_remove_node(dtb, "/intc@8000000/v2m@8020000\0".as_ptr()), 0);
+        assert_eq!(fdt_remove_node(dtb, "/flash@0\0".as_ptr()), 0);
+
+        let len = fdt_size(dtb) as usize;
+        println!("fdt patched size {}", len);
+        let slice = core::slice::from_raw_parts(dtb as *const u8, len);
+        SYSTEM_FDT.call_once(|| slice.to_vec());
+    }
 }
 
 // create vm1 fdt demo
diff --git a/src/driver/aarch64/uart.rs b/src/driver/aarch64/uart.rs
index 787d05f17ac5110f7c6767364092a29fedf9fc9f..d0fd3e73299284f4ca92af9e447a221110d62132 100644
--- a/src/driver/aarch64/uart.rs
+++ b/src/driver/aarch64/uart.rs
@@ -11,14 +11,15 @@
 use core::ptr;
 
 pub fn putc(byte: u8) {
-    use crate::board::UART_1_ADDR;
     #[cfg(feature = "qemu")]
     unsafe {
-        ptr::write_volatile(UART_1_ADDR as *mut u8, byte);
+        use crate::board::UART_0_ADDR;
+        ptr::write_volatile(UART_0_ADDR as *mut u8, byte);
     }
     // ns16550
     #[cfg(feature = "tx2")]
     unsafe {
+        use crate::board::UART_1_ADDR;
         if byte == '\n' as u8 {
             putc('\r' as u8);
         }
diff --git a/src/linkers/aarch64-qemu.ld b/src/linkers/aarch64-qemu.ld
index 87580e25088dd5c76716ff2da41f51f7596f520b..b2108f3d19718af7058a1ab515a9cb14321f4982 100644
--- a/src/linkers/aarch64-qemu.ld
+++ b/src/linkers/aarch64-qemu.ld
@@ -1,7 +1,7 @@
 ENTRY(_start)
 SECTIONS
 {
-    . = 0x43000000;
+    . = 0x40080000;
 
 	_image_start = ABSOLUTE(.);
 
diff --git a/src/vmm/init.rs b/src/vmm/init.rs
index 586c053f02a552a70211e5988f2e32fa9faa635b..bf94d8a5ded0852ae4c9e120a392b08e2c8ff191 100644
--- a/src/vmm/init.rs
+++ b/src/vmm/init.rs
@@ -133,11 +133,19 @@ pub fn vmm_init_image(vm: Vm) -> bool {
                     warn!("Image {} is not supported", name);
                 }
                 #[cfg(feature = "pi4")]
-                vmm_load_image(vm.clone(), include_bytes!("../../image/Image_pi4_5.4.83_tlb"));
+                if name.is_empty() {
+                    panic!("kernel image name empty")
+                } else {
+                    vmm_load_image(vm.clone(), include_bytes!("../../image/Image_pi4_5.4.83_tlb"));
+                }
                 // vmm_load_image(vm.clone(), include_bytes!("../../image/Image_pi4_5.4.78"));
                 // vmm_load_image(vm.clone(), include_bytes!("../../image/Image_pi4"));
                 #[cfg(feature = "qemu")]
-                vmm_load_image(vm.clone(), include_bytes!("../../image/Image_vanilla"));
+                if name.is_empty() {
+                    panic!("kernel image name empty")
+                } else {
+                    vmm_load_image(vm.clone(), include_bytes!("../../image/Image_vanilla"));
+                }
             }
             None => {
                 // nothing to do, its a dynamic configuration
@@ -356,6 +364,8 @@ pub unsafe fn vmm_setup_fdt(vm: Vm) {
             fdt_set_memory(dtb, mr.len() as u64, mr.as_ptr(), "memory@90000000\0".as_ptr());
             #[cfg(feature = "pi4")]
             fdt_set_memory(dtb, mr.len() as u64, mr.as_ptr(), "memory@200000\0".as_ptr());
+            #[cfg(feature = "qemu")]
+            fdt_set_memory(dtb, mr.len() as u64, mr.as_ptr(), "memory@50000000\0".as_ptr());
             // FDT+TIMER
             fdt_add_timer(dtb, 0x8);
             // FDT+BOOTCMD
@@ -369,7 +379,7 @@ pub unsafe fn vmm_setup_fdt(vm: Vm) {
                 for emu_cfg in config.emulated_device_list() {
                     match emu_cfg.emu_type {
                         EmuDeviceTGicd => {
-                            #[cfg(feature = "tx2")]
+                            #[cfg(any(feature = "tx2", feature = "qemu"))]
                             fdt_setup_gic(
                                 dtb,
                                 PLATFORM_GICD_BASE as u64,
@@ -385,7 +395,7 @@ pub unsafe fn vmm_setup_fdt(vm: Vm) {
                             );
                         }
                         EmuDeviceTVirtioNet | EmuDeviceTVirtioConsole => {
-                            #[cfg(feature = "tx2")]
+                            #[cfg(any(feature = "tx2", feature = "qemu"))]
                             fdt_add_virtio(
                                 dtb,
                                 emu_cfg.name.unwrap().as_ptr(),
@@ -394,7 +404,7 @@ pub unsafe fn vmm_setup_fdt(vm: Vm) {
                             );
                         }
                         EmuDeviceTShyper => {
-                            #[cfg(feature = "tx2")]
+                            #[cfg(any(feature = "tx2", feature = "qemu"))]
                             fdt_add_vm_service(
                                 dtb,
                                 emu_cfg.irq_id as u32 - 0x20,