Your code can change MSR[IP]; there is also a strapping pin that is sampled on HRESET (and copied to MSR[IP]).Wouldn't this mean that when the reset is issued by hardware, MSR[IP] is always 1 (to boot from ROM) but with software reset it can take software defined values?
Yes, that is what it means.
I think now QEMU ignores MSR[IP].
Fix it :-) Segher