kexec to switch to another kernel on ppc64 failed

This is my first time to ask a question, good luck for myself to get answers. question description (cpu:t104x, ppc64 kernel configed with CONFIG_KEXEC):

I boot the first kernel with bootargs below:

setenv bootargs root=/dev/$bdev ro crashkernel=128M@32M \ 
   console=$consoledev,$baudrate earlyprintk=ttyS0 $othbootargs;

then execute the following to load vmlinux successfully:

./kexec -p ./vmlinux -t elf-ppc64  --dtb=./dtb.t104x \
--command-line="root=/dev/mtdblock9 ro crashkernel=128M@32M console=ttyS0,115200 earlyprintk=ttyS0" \
  -d --mem-min=0x2000000 --mem-max=0xa000000

then got the prints:

Try gzip decompression.
kernel: 0xeeb3b008 kernel_size: 0x8f49140
0000000000000000-0000000100000000 : 0
get base memory ranges:1
usable memory rgns size:1 base:0 size:a000000
exclude_range sorted exclude_range[0] start:0, end:188c000
setup_memory_ranges memory_range[0] start:188c001, end:30000000
get memory ranges:1
CRASH MEMORY RANGES
0000000000000000-0000000000010000
0000000000010000-0000000002000000
000000000a000000-0000000100000000
get_crash_notes_per_cpu: crash_notes addr = ffe0a1b4, size = 536
Elf header: p_type = 4, p_offset = 0xffe0a1b4 p_paddr = 0xffe0a1b4 p_vaddr = 0x0 p_filesz = 0x218 p_memsz = 0x218
get_crash_notes_per_cpu: crash_notes addr = ffe4a1b4, size = 536
Elf header: p_type = 4, p_offset = 0xffe4a1b4 p_paddr = 0xffe4a1b4 p_vaddr = 0x0 p_filesz = 0x218 p_memsz = 0x218
get_crash_notes_per_cpu: crash_notes addr = ffe8a1b4, size = 536
Elf header: p_type = 4, p_offset = 0xffe8a1b4 p_paddr = 0xffe8a1b4 p_vaddr = 0x0 p_filesz = 0x218 p_memsz = 0x218
get_crash_notes_per_cpu: crash_notes addr = ffeca1b4, size = 536
Elf header: p_type = 4, p_offset = 0xffeca1b4 p_paddr = 0xffeca1b4 p_vaddr = 0x0 p_filesz = 0x218 p_memsz = 0x218
vmcoreinfo header: p_type = 4, p_offset = 0x178dd48 p_paddr = 0x178dd48 p_vaddr = 0x0 p_filesz = 0x1024 p_memsz = 0x1024
Elf header: p_type = 1, p_offset = 0x3888000 p_paddr = 0x0 p_vaddr = 0x0 p_filesz = 0x10000 p_memsz = 0x10000
Elf header: p_type = 1, p_offset = 0x10000 p_paddr = 0x10000 p_vaddr = 0x10000 p_filesz = 0x1ff0000 p_memsz = 0x1ff0000
Elf header: p_type = 1, p_offset = 0xa000000 p_paddr = 0xa000000 p_vaddr = 0xa000000 p_filesz = 0xf6000000 p_memsz = 0xf6000000
Command line after adding elfcorehdr: root=/dev/mtdblock9 ro crashkernel=128M@32M console=ttyS0,115200 earlyprintk=ttyS0 1 maxcpus=1 noirqdistrib reset_devices elfcorehdr=57952K
sym: _savegpr0_27 info: 10 other: 00 shndx: 1 value: 970 size: 0
sym: _savegpr0_27 value: 3899970 addr: 3899004
sym:      .data info: 03 other: 00 shndx: 4 value: 0 size: 0
.........
.........
sym: backup_start value: 389cc48 addr: 389cf08
info->entry is 0x3899600
kernel is 2000000
dt_offset is 9fe6000
run_at_load flag is 1
panic_kernel is 1
backup_start is 3888000
stack is 38a1000
toc_addr is 38a4f00
purgatory size is 23888
debug is 0
opal_base is 0
opal_entry is 0
kexec_load: entry = 0x3899600 flags = 0x150001
nr_segments = 5
segment[0].buf   = 0xeeb4b008
segment[0].bufsz = 0x1757700
segment[0].mem   = 0x2000000
segment[0].memsz = 0x1888000
segment[1].buf   = 0x10050fb8
segment[1].bufsz = 0x10000
segment[1].mem   = 0x3888000
segment[1].memsz = 0x10000
segment[2].buf   = 0x10041108
segment[2].bufsz = 0x400
segment[2].mem   = 0x3898000
segment[2].memsz = 0x1000
segment[3].buf   = 0x10042c10
segment[3].bufsz = 0x3f10
segment[3].mem   = 0x3899000
segment[3].memsz = 0x4000
segment[4].buf   = 0x10060fc0
segment[4].bufsz = 0x19e68
segment[4].mem   = 0x9fe6000
segment[4].memsz = 0x1a000

at last, trigger a panic:

echo c > /proc/sysrq-trigger

stopped here:

root@t104x:/media/emmc/image/kexec-cmd> echo c > /proc/sysrq-trigger
sysrq: SysRq : Trigger a crash
Unable to handle kernel paging request for data at address 0x00000000
Faulting instruction address: 0xc000000000603d90
Oops: Kernel access of bad area, sig: 11 [#1]
PREEMPT SMP NR_CPUS=4 CoreNet Generic
Modules linked in: uio_seville(O) nandsim mpc85xx_edac edac_core
CPU: 2 PID: 488 Comm: sh Tainted: G           O    4.1.18-WR8.0.0.3_standard #4
task: c0000000f1b38bc0 ti: c0000000f1f4c000 task.ti: c0000000f1f4c000
NIP: c000000000603d90 LR: c000000000604ccc CTR: c000000000603d64
REGS: c0000000f1f4f7a0 TRAP: 0300   Tainted: G           O     (4.1.18-WR8.0.0.3_standard)
MSR: 0000000080029000 <CE,EE,ME>  CR: 28242282  XER: 00000000
DEAR: 0000000000000000 ESR: 0000000000800000 SOFTE: 1 
GPR00: c000000000604ccc c0000000f1f4fa20 c00000000174b700 0000000000000063 
GPR04: c0000000ffe80828 c0000000ffe83e98 0000000000000285 c000000001774da8 
GPR08: c0000000f1f4c000 0000000000000001 0000000000000000 0000000000000002 
GPR12: 0000000042242484 c00000000fffed80 0000000028222482 000000001011217c 
GPR16: 0000000010128668 0000000010136bb0 0000000010128a60 00000000100f1520 
GPR20: 0000000010120a58 0000000000000000 000000001012c468 0000000010131fe0 
GPR24: 0000000000000000 0000000010103a58 c0000000015e7aa8 0000000000000004 
GPR28: c0000000015e7e90 0000000000000063 c000000001599e1c 0000000000000000 
NIP [c000000000603d90] .sysrq_handle_crash+0x2c/0x40
LR [c000000000604ccc] .__handle_sysrq+0xec/0x224
Call Trace:
[c0000000f1f4fa90] [c000000000604ccc] .__handle_sysrq+0xec/0x224
[c0000000f1f4fb40] [c000000000605404] .write_sysrq_trigger+0x70/0x8c
[c0000000f1f4fbc0] [c00000000026a1e8] .proc_reg_write+0xac/0xfc
[c0000000f1f4fc60] [c0000000001f09ec] .__vfs_write+0x68/0xd0
[c0000000f1f4fcf0] [c0000000001f15b0] .vfs_write+0xb8/0x1e8
[c0000000f1f4fd90] [c0000000001f23f4] .SyS_write+0x64/0xf4
[c0000000f1f4fe30] [c000000000000698] system_call+0x38/0xc4
Instruction dump:
4bffffac 7c0802a6 f8010010 f821ff91 60000000 60000000 3d220002 39499e5c 
39200001 912a0000 7c0004ac 39400000 <992a0000> 38210070 e8010010 7c0803a6 
---[ end trace 4ddc8f20f56a5689 ]---

Sending IPI to other CPUs
IPI complete

I have added some prints in the kernel. I'm sure it has jumped into the entry, but don't know why it stoped here.

When i changed the options as follow s(just without --dtb option, I don't know why yet), the problem was solved:

./kexec -p ./vmlinux -t elf-ppc64 --command-line="root=/dev/mtdblock9 ro \ 
    crashkernel=128M@32M console=ttyS0,115200 earlyprintk=ttyS0" -d \
    --mem-min=0x2000000 --mem-max=0xa000000