Unable to run linux 3.10(mips) on qemu 2.5

I want to run linux 3.10 with mips64r2 on qemu. But it fails, the boot log as follows,

I compile the kernel with the gcc 4.9.3 which is modified by loongson.

The kernel config file is the malta_defconfig and i change it to mips64r2 cpu and 64 bit kernel.

The qemu 2.5 is the default application on the ubuntu 16.04.

zlp@lab302i-ES:~/projs/linux-3.10$ qemu-system-mips64el -M malta -m 1G -cpu 5KEf -kernel vmlinux -nographic
Linux version 3.10.0 (zlp@lab302i-ES) (gcc version 4.9.3 20150626 (Red Hat 4.9.3-2) (GCC) ) #8 SMP Tue Nov 19 19:16:32 CST 2019
Config serial console: console=ttyS0,38400n8r
bootconsole [early0] enabled
CPU revision is: 00018900 (MIPS 5KE)
FPU revision is: 00738900
Checking for the multiply/shift bug... no.
Checking for the daddiu bug... no.
Software DMA cache coherency enabled
Determined physical RAM map:
 memory: 0000000000001000 @ 0000000000000000 (reserved)
 memory: 00000000000ef000 @ 0000000000001000 (ROM data)
 memory: 0000000000539000 @ 00000000000f0000 (reserved)
 memory: 000000000f9d7000 @ 0000000000629000 (usable)
Wasting 88312 bytes for tracking 1577 unused pages
Zone ranges:
  DMA      [mem 0x00000000-0x00ffffff]
  Normal   [mem 0x01000000-0x0fffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x0fffffff]
Primary instruction cache 8kB, VIPT, 2-way, linesize 32 bytes.
Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 32 bytes
PERCPU: Embedded 10 pages/cpu @9800000001384000 s10816 r8192 d21952 u40960
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 64640
Kernel command line:  console=ttyS0,38400n8r
PID hash table entries: 1024 (order: 1, 8192 bytes)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode-cache hash table entries: 16384 (order: 5, 131072 bytes)
Cache parity protection disabled
Memory: 251796k/255836k available (3695k kernel code, 4040k reserved, 1150k data, 272k init, 0k highmem)
Hierarchical RCU implementation.
    CONFIG_RCU_FANOUT set to non-default value of 32
    RCU restricting CPUs from NR_CPUS=2 to nr_cpu_ids=1.
NR_IRQS:256
CPU frequency 200.00 MHz
Console: colour dummy device 80x25
Calibrating delay loop... 1076.42 BogoMIPS (lpj=5382144)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 256
Checking for the daddi bug... no.
Brought up 1 CPUs
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
vgaarb: loaded
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10000000-0x17ffffff]
pci_bus 0000:00: root bus resource [io  0x2000-0x1fffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:0a.3: no compatible bridge window for [io  0x1100-0x110f]
vgaarb: device added: PCI:0000:00:12.0,decodes=io+mem,owns=none,locks=none
pci 0000:00:0a.3: BAR 8: [io  0x1100-0x110f] has bogus alignment
pci 0000:00:12.0: BAR 0: assigned [mem 0x10000000-0x11ffffff pref]
pci 0000:00:0b.0: BAR 6: assigned [mem 0x12000000-0x1203ffff pref]
pci 0000:00:12.0: BAR 6: assigned [mem 0x12040000-0x1204ffff pref]
pci 0000:00:12.0: BAR 1: assigned [mem 0x12050000-0x12050fff]
pci 0000:00:0a.2: BAR 4: assigned [io  0x2000-0x201f]
pci 0000:00:0b.0: BAR 0: assigned [io  0x2020-0x203f]
pci 0000:00:0b.0: BAR 1: assigned [mem 0x12051000-0x1205101f]
pci 0000:00:0a.1: BAR 4: assigned [io  0x2040-0x204f]
Switching to clocksource pit
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 3, 32768 bytes)
TCP bind hash table entries: 2048 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
PCI: Enabling device 0000:00:0a.2 (0000 -> 0001)
CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff8016bef4, ra == ffffffff805c51a0
Oops[#1]:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.10.0 #8
task: 980000000fc433f0 ti: 980000000fc44000 task.ti: 980000000fc44000
$ 0   : 0000000000000000 0000000000000008 0000000000000000 0000000000000000
$ 4   : 980000000fc47de0 0000000000000000 0000000000000000 0000000000000000
$ 8   : 0000000000000000 980000000fd84e60 fffffffffffffffc ffffffff8061cd30
$12   : 0000000000000010 ffffffff802e3bd4 0000000000000000 000000000000001a
$16   : ffffffff80600000 ffffffff805c5184 0000000000000000 ffffffff80600000
$20   : ffffffff805e6368 ffffffff805e6338 ffffffff805bc1d8 ffffffff805e62f8
$24   : 0000000000000018 ffffffff803451b0                                  
$28   : 980000000fc44000 980000000fc47de0 ffffffff80600000 ffffffff805c51a0
Hi    : 0000000000000001
Lo    : 1111111111111112
epc   : ffffffff8016bef4 cmpxchg_futex_value_locked+0x2c/0x78
    Not tainted
ra    : ffffffff805c51a0 futex_init+0x1c/0x6c
Status: 1400a7e3    KX SX UX KERNEL EXL IE 
Cause : 00800008
BadVA : 0000000000000000
PrId  : 00018900 (MIPS 5KE)
Modules linked in:
Process swapper/0 (pid: 1, threadinfo=980000000fc44000, task=980000000fc433f0, tls=0000000000000000)
Stack : ffffffff805c4f3c 0000000000000000 ffffffff80600000 ffffffff801004f0
      ffffffff805e6368 0000000000000006 0000000000000030 ffffffff805f0a30
      ffffffff80600000 ffffffff805bca24 0000000000000066 0000000000000000
      ffffffff80494a48 0000000000000000 ffffffff80600000 0000000000000000
      0000000000000000 0000000000000000 0000000000000000 0000000000000000
      0000000000000000 ffffffff80494a64 ffffffff80494a48 0000000000000000
      0000000000000000 ffffffff80101f18 0000000000000000 0000000000000000
      0000000000000000 0000000000000000 0000000000000000 0000000000000000
      0000000000000000 0000000000000000 0000000000000000 0000000000000000
      0000000000000000 0000000000000000 0000000000000000 0000000000000000
      ...
Call Trace:
[<ffffffff8016bef4>] cmpxchg_futex_value_locked+0x2c/0x78
[<ffffffff805c51a0>] futex_init+0x1c/0x6c
[<ffffffff801004f0>] do_one_initcall+0xe0/0x160
[<ffffffff805bca24>] kernel_init_freeable+0x16c/0x220
[<ffffffff80494a64>] kernel_init+0x1c/0x160
[<ffffffff80101f18>] ret_from_kernel_thread+0x14/0x1c


Code: 00000000  0000102d  0000000f <c0a30000> 14660005  00000000  00e0082d  e0a10000  1020fff9 
---[ end trace 47a33b7db369802c ]---
note: swapper/0[1] exited with preempt_count 1
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Several possible issues here:

(1) QEMU 2.5 is now pretty old. You could retry with something more modern.

(2) You're building the kernel with "a gcc modified by loongson", but you're not actually running this on a Loongson CPU. Try using a stock gcc to build your kernel, and make sure that your kernel config matches the board model and CPU model you're asking QEMU to emulate. (The kernel log you give shows it crashing in a low level function which is going to try to do an atomic cmpxchg operation, and I have a vague recollection that this is an area where different MIPS CPUs have different sets of supported instructions, and in particular that Loongson might have made some changes here. So my first guess would be that your problem is here.)