mjhjmtu

When tried to boot up Kernel uImage of an i.MX6q based embedded device, it seems that QEMU crashes with "Unable to handle kernel NULL pointer dereference at virtual address 00000044". Before crashing it displays below errors.

mc16xsd200 spi32765.0: FSB triggered for switch 0
mc16xsd200 spi32765.0: switch 0 port[0] fault[0x0000]
mc16xsd200 spi32765.0: FSOB triggered for switch 0

On the actual device FSB(fault status) and FSOB (fail-safe output) are NOT triggered, boot sequence look like below on actual device.

mc16xsd200 spi32765.0: FSB not triggered for switch 0

/dev/mmcblk0p1: |===mc16xsd200 spi32765.0: FSOB not triggered for switch 0

Below command has been triggered to start the kernel with QEMU and attached is the full output, I m using latest version of QEMU 3.1.0-rc0. Is there a way to work around this problem ?

./qemu-3.1.0-rc0/arm-softmmu/qemu-system-arm -machine sabrelite,accel=kvm:tcg -kernel uImage -m 3840 -smp cpus=4 -serial mon:stdio -append "root=/dev/mmcblk0p1 rootfstype=ext2 rw,format=raw" -hda fullcardimage.img

WARNING: Image format was not specified for 'fullcardimage.img' and probing guessed raw.
 Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
 Specify the 'raw' format explicitly to remove the restrictions.
VNC server running on 127.0.0.1:5900
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 3.10.53 (build_team@u1004-swb02) (gcc version 4.7.3 20130102 (prerelease) (crosstool-NG 1.18.0) ) #1 SMP PREEMPT Tue Jun 13 16:03:05 PDT 2017
CPU: ARMv7 Processor [410fc090] revision 0 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: i.MX6q 
Truncating memory at 0x10000000 to fit in 32-bit physical address space
memblock reserved of f7fff000 <at> 8000000 for ion
memblock reserved for ramoops : Phys Address = 0xf7eff000, Size 1M
cma: CMA: reserved 512 MiB at 5e000000
Memory policy: ECC disabled, Data cache writealloc
PERCPU: Embedded 8 pages/cpu @f1e20000 s9728 r8192 d14848 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 946335
Kernel command line: root=/dev/ram0 rw console=ttymxc0,9600 ramdisk_start=0x0 ip=off consoleblank=0 vmalloc=192M enable_wait_mode=off max_loop=64 dmfc=3 earlyprintk
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 262144 (order: 8, 1048576 bytes)
Inode-cache hash table entries: 131072 (order: 7, 524288 bytes)
Memory: 3710MB = 3710MB total
Memory: 3207368k/3207368k available, 724788k reserved, 1915900K highmem
Virtual kernel memory layout:
 vector : 0xffff0000 - 0xffff1000 ( 4 kB)
 fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
 vmalloc : 0xf3800000 - 0xff000000 ( 184 MB)
 lowmem : 0x80000000 - 0xf3000000 (1840 MB)
 pkmap : 0x7fe00000 - 0x80000000 ( 2 MB)
 modules : 0x7f000000 - 0x7fe00000 ( 14 MB)
 .text : 0x80008000 - 0x80bef39c (12189 kB)
 .init : 0x80bf0000 - 0x82097600 (21150 kB)
 .data : 0x82098000 - 0x821571d0 ( 765 kB)
 .bss : 0x821571d0 - 0x821f5e1c ( 636 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Preemptible hierarchical RCU implementation.
NR_IRQS:16 nr_irqs:16 16
L2x0 series cache controller enabled
l2x0: 8 ways, CACHE_ID 0x00000000, AUX_CTRL 0x00000000, Cache size: 65536 B
VPU 352M is enabled!
sched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 1431655ms
CPU identified as i.MX6Q, silicon rev 1.0
Console: colour dummy device 80x30
Calibrating delay loop... 30.92 BogoMIPS (lpj=154624)
pid_max: default: 32768 minimum: 301
Security Framework initialized
SELinux: Initializing.
Mount-cache hash table entries: 512
Initializing cgroup subsys debug
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x80874930 - 0x80874988
CPU1: Booted secondary processor
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
CPU2: Booted secondary processor
CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
CPU3: Booted secondary processor
CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
Brought up 4 CPUs
SMP: Total of 4 processors activated (8922.52 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
pinctrl core: initialized pinctrl subsystem
regulator-dummy: no parameters
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Use WDOG1 as reset source
syscon 20c8000.anatop: regmap [mem 0x020c8000-0x020c8fff] registered
vdd1p1: 800 <--> 1375 mV at 1100 mV
vdd3p0: 2800 <--> 3150 mV at 3000 mV
vdd2p5: 2000 <--> 2750 mV at 2400 mV
cpu: 725 <--> 1450 mV at 1100 mV
vddpu: 725 <--> 1450 mV at 1100 mV
vddsoc: 725 <--> 1450 mV at 1100 mV
mxs_phy 20c9000.usbphy: using default TX PHY Transmitter Control
mxs_phy 20ca000.usbphy: using default TX PHY Transmitter Control
syscon 20e0000.iomuxc-gpr: regmap [mem 0x020e0000-0x020e0037] registered
imx_mmdc_probe: failed to enable automatic power saving
imx-mmdc: probe of 21b0000.mmdc failed with error -16
syscon 21bc000.ocotp-ctrl: regmap [mem 0x021bc000-0x021bffff] registered
failed to find fsl,imx6sx-romcp regmap
LRU ID = 0
hw-breakpoint: debug architecture 0x4 unsupported.
imx6q-pinctrl 20e0000.iomuxc: initialized IMX pinctrl driver
bio: create slab <bio-0> at 0
stmp_reset_block(f3858000): module reset timeout
mxs-dma: probe of 110000.dma-apbh failed with error -110
tlv320aic3x-supply: no parameters
ov564x-supply: no parameters
vgaarb: loaded
i2c-core: driver [max17135] using legacy suspend method
i2c-core: driver [max17135] using legacy resume method
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
i2c i2c-0: IMX I2C adapter registered
i2c i2c-1: IMX I2C adapter registered
i2c i2c-2: <i2c_imx_trx_complete> Wait Timeout
pca953x 2-0022: failed reading register
pca953x: probe of 2-0022 failed with error -110
i2c i2c-2: IMX I2C adapter registered
Linux video capture interface: v2.00
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
imx-ipuv3 2400000.ipu: IPU DMFC ONLY-DP HIGH RESOLUTION: 5B(0~3), 5F(4~7)
imx-ipuv3 2800000.ipu: IPU DMFC ONLY-DP HIGH RESOLUTION: 5B(0~3), 5F(4~7)
imx-ipuv3 2800000.ipu: Registered IPU ID: 1
MIPI CSI2 driver module loaded
Advanced Linux Sound Architecture Driver Initialized.
Bluetooth: Core ver 2.16
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
cfg80211: Calling CRDA to update world regulatory domain
pureg-dummy: no parameters
Switching to clocksource mxc_timer1
usb_pacusb_init: PACUSB driver version 2.29
usbcore: registered new interface driver pacusb
gpio-wdt: watchdog gpio (9) allocated
gpio-wdt: hwtick timer started, period = 2 secs
NET: Registered protocol family 2
TCP established hash table entries: 16384 (order: 5, 131072 bytes)
TCP bind hash table entries: 16384 (order: 5, 131072 bytes)
TCP: Hash tables configured (established 16384 bind 16384)
TCP: reno registered
UDP hash table entries: 1024 (order: 3, 32768 bytes)
UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
hw perfevents: enabled with ARMv7 Cortex-A9 PMU driver, 1 counters available
mxc_epit: probe of 20d0000.epit failed with error -22
mxc_epit: probe of 20d4000.epit failed with error -22
console [pstore-1] enabled
ramoops: attached 0x100000@0xf7eff000, ecc: 0/0
mxc_ramoops device success loaded
futex hash table entries: 1024 (order: 4, 65536 bytes)
audit: initializing netlink socket (disabled)
type=2000 audit(67.620:1): initialized
bounce pool size: 64 pages
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
Key type id_resolver registered
Key type id_legacy registered
NTFS driver 2.1.30 [Flags: R/W DEBUG].
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
msgmni has been set to 3546
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
mxc_sdc_fb fb.20: registered mxc display driver lcd_tc358766
imx-ipuv3 2400000.ipu: Unsupported burst size 1
imx-sdma 20ec000.sdma: no iram assigned, using external mem
imx-sdma 20ec000.sdma: Timeout waiting for CH0 ready
imx-sdma 20ec000.sdma: loaded firmware 1.1
imx-sdma 20ec000.sdma: initialized
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
pfuze100-regulator 0-0008: unrecognized pfuze chip ID!
pfuze100-regulator: probe of 0-0008 failed with error -110
Serial: IMX driver
2020000.serial: ttymxc0 at MMIO 0x2020000 (irq = 58) is a IMX
console [ttymxc0] enabled
serial: Freescale lpuart driver
imx sema4 driver is registered.
[drm] Initialized drm 1.1.0 20060810
[drm] Initialized vivante 1.0.0 20120216 on minor 0
brd: module loaded
loop: module loaded
at24 0-0054: 256 byte 24c02 EEPROM, writable, 1 bytes/write
at24 0-0055: 256 byte 24c02 EEPROM, writable, 1 bytes/write
at24 0-0056: 256 byte 24c02 EEPROM, writable, 1 bytes/write
at24 0-0057: 256 byte 24c02 EEPROM, writable, 1 bytes/write
at24 2-0050: 128 byte 24c01 EEPROM, writable, 1 bytes/write
imx-sdma 20ec000.sdma: Timeout waiting for CH0 ready
spi_imx 2008000.ecspi: error in TX dma configuration.
spi_imx 2008000.ecspi: dma setup error,use pio instead
m25p80 spi32766.0: found sst25vf016b, expected w25q64
m25p80 spi32766.0: sst25vf016b (2048 Kbytes)
3 ofpart partitions found on MTD device spi32766.0
Creating 3 MTD partitions on "spi32766.0":
0x000000000000-0x000000040000 : "bootloader"
0x000000040000-0x000000041000 : "config"
0x000000041000-0x000000800000 : "minikernel"
mtd: partition "minikernel" extends beyond the end of device "spi32766.0" -- size truncated to 0x1bf000
spi_imx 2008000.ecspi: probed
imx-sdma 20ec000.sdma: Timeout waiting for CH0 ready
spi_imx 200c000.ecspi: error in TX dma configuration.
spi_imx 200c000.ecspi: dma setup error,use pio instead
spi_imx 200c000.ecspi: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
fec 2188000.ethernet eth0: registered PHC device 0
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver cdc_subset
usbcore: registered new interface driver zaurus
usbcore: registered new interface driver cdc_ncm
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-pci: EHCI PCI platform driver
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usb-storage
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver option
usbserial: USB Serial support registered for GSM modem (1-port)
stmp_reset_block(f380e030): module reset timeout
ci_hdrc ci_hdrc.0: unable to init phy: -110
ci_hdrc: probe of ci_hdrc.0 failed with error -110
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver xpad
usbcore: registered new interface driver usb_acecad
usbcore: registered new interface driver aiptek
usbcore: registered new interface driver gtco
usbcore: registered new interface driver hanwang
usbcore: registered new interface driver kbtab
usbcore: registered new interface driver wacom
i2c-core: driver [isl29023] using legacy suspend method
i2c-core: driver [isl29023] using legacy resume method
snvs_rtc 20cc034.snvs-rtc-lp: rtc core: registered 20cc034.snvs-rtc-lp as rtc0
i2c /dev entries driver
IR NEC protocol handler initialized
IR RC5(x) protocol handler initialized
IR RC6 protocol handler initialized
IR JVC protocol handler initialized
IR Sony protocol handler initialized
IR RC5 (streamzap) protocol handler initialized
IR SANYO protocol handler initialized
IR MCE Keyboard/mouse protocol handler initialized
ov5640 2-003c: no sensor pwdn pin available
mxc_v4l2_output v4l2_out.17: V4L2 device registered as video16
mxc_v4l2_output v4l2_out.17: V4L2 device registered as video17
usbcore: registered new interface driver uvcvideo
USB Video Class driver (1.1.1)
gspca_main: v2.14.0 registered
Driver for 1-wire Dallas network protocol.
w1-gpio onewire.15: unable to select pin group
i2c i2c-2: <i2c_imx_trx_complete> Wait Timeout
ads1015 2-0048: failed to read i2c client
ads1015: probe of 2-0048 failed with error -110
i2c i2c-2: <i2c_imx_trx_complete> Wait Timeout
lm75: probe of 2-004e failed with error -110
device-mapper: uevent: version 1.0.3
device-mapper: ioctl: 4.24.0-ioctl (2013-01-15) initialised: dm-devel@redhat.com
cpuidle: using governor ladder
cpuidle: using governor menu
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
mmc0: no vqmmc regulator found
mmc0: no vmmc regulator found
mmc0: SDHCI controller on 2190000.usdhc [2190000.usdhc] using ADMA
mmc2: no vqmmc regulator found
mmc2: no vmmc regulator found
mmc2: SDHCI controller on 2198000.usdhc [2198000.usdhc] using ADMA
mxc_vdoa 21e4000.vdoa: i.MX Video Data Order Adapter(VDOA) driver probed
mxc_asrc 2034000.asrc: mxc_asrc registered
mxc_vpu 2040000.vpu: VPU initialized
hidraw: raw HID events driver (C) Jiri Kosina
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
ashmem: initialized
logger: created 256K log 'log_main'
logger: created 256K log 'log_events'
logger: created 256K log 'log_radio'
logger: created 256K log 'log_system'
usbcore: registered new interface driver snd-usb-audio
tlv320aic3x-codec 0-0019: ASoC: mux Right Line1L Mux has no paths
tlv320aic3x-codec 0-0019: ASoC: mux Left Line1R Mux has no paths
imx-tlv320aic3x sound.25: tlv320aic3x-hifi <-> 202c000.ssi mapping ok
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
input: cpuimxaudiob Headphone Jack b as /devices/soc0/sound.25/sound/card0/input0
Microchip ICSP driver initialized
Unknown LRU SUBTYPE for Unit Id = 0
Silicon Labs C2 port support v. 0.51.0 - (C) 2007 Rodolfo Giometti
input: proximity_io as /devices/virtual/input/input1
Initialized proximity_io driver
input: tricolorled_io as /devices/virtual/input/input2
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
Initialized tricolorled_io driver
tps61195 WLED driver
tps61195: no chip?
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
mma8453: probe of 0-001c failed with error -22
mma8453_init : no chip?
bh1730: ALS driver
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
bh1730: no chips??
ltc3350: High Current Supercapacitor Backup Controller and System Monitor Driver
ltc3350: no chips??
retract_mech: Retractable Monitor Mechanism Controller Driver (supporting firmware 00.01.0.11)
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
retract_mech: no chips??
mc16xsd200 spi32765.0: skipping open load detection for switch 0
mc16xsd200 spi32765.0: probed
tc358766_probe started
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
i2c i2c-0: <i2c_imx_trx_complete> Wait Timeout
mc16xsd200 spi32765.0: FSB triggered for switch 0
mc16xsd200 spi32765.0: switch 0 port[0] fault[0x0000]
mc16xsd200 spi32765.0: FSOB triggered for switch 0
Unable to handle kernel NULL pointer dereference at virtual address 00000044
pgd = 80004000
[00000044] *pgd=00000000
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 3 PID: 21 Comm: kworker/3:0 Not tainted 3.10.53 #1
Workqueue: events mc16xsd200_fsob_irq_work_func
task: f209f300 ti: f20f6000 task.ti: f20f6000