Thank you very much for this explanation! For now, I use the generic loader and it could almost work now.
./qemu-system-arm -M mymachine -smp 2 \ -device loader,file=./scp_fast_model.elf,addr=0x0,cpu-num=0 \ -device loader,file=./mcp_fast_model.elf,addr=0x0,cpu-num=1 \ -serial stdio -serial tcp::5678,server=on,wait=off the 2 cpu(or SOC), one is called "*mcp*", the other is "*scp*" while there are still problems: *The ram size of "mcp" is 0x20000, and the ram size of "scp" is 0x40000 (In real machine)*. If I use the cmd above, QEMU will still abort: qemu-system-arm: ../target/arm/cpu.h:2396: arm_is_secure_below_el3: Assertion failed. When I used gdb to debug, I found that the "mcp" seem to be trying to access *0x3FFF0* of ram, which is out of its range. While the program of mcp is correct because I have run it in singly before( comment all the "scp" related code). And If I edit the ram size of "mcp" to 0x40000, then the programs of mcp and scp could all run well. the code to create rom and ram: create_ram(&scp_mem,0x00,"scp.rom",0x40000); create_ram(&scp_mem,0x20000000,"scp.ram",0x40000); create_ram(&mcp_mem,0x00,"mcp.rom",0x20000); create_ram(&mcp_mem,0x20000000,"mcp.ram",0x40000); static MemoryRegion *create_ram(MemoryRegion *mr,hwaddr addr, const char * name,uint64_t size){ MemoryRegion *mem = g_new(MemoryRegion, 1); memory_region_init_ram(mem, NULL, name,size, &error_fatal); memory_region_add_subregion(mr, addr, mem); return mem; } I have no idea what is wrong. Do you have any ideas?