[PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[Karl Mehltretter]

Since commit bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for
non-overlapping affinities"), handle_percpu_devid_irq() only runs an
action whose affinity mask contains the current CPU. Only actions set up
through the percpu_devid request functions have such a mask.

handle_jcore_irq() passes every per-CPU interrupt to
handle_percpu_devid_irq(). The J2 IPI is not a percpu_devid interrupt.
j2_prepare_cpus() requests it with request_irq() and IRQF_PERCPU, so its
action has no affinity mask and cpumask_test_cpu() reads through a NULL
pointer. J2 has no MMU to catch this. The read returns whatever is at
address 0, the action is not found, and IPIs are dropped as spurious
("Spurious percpu IRQ20 on CPU1", printed once).

Pass only percpu_devid interrupts (the PIT) to handle_percpu_devid_irq()
and the other per-CPU interrupts to handle_percpu_irq() again, as before
commit d7e3fd658248f ("irqchip/jcore-aic, clocksource/drivers/jcore: Fix
jcore-pit interrupt request").

Found with a two-CPU J2 model simulated from the J-Core RTL. Without
this change the boot stalls with both CPUs idle shortly after
"smp: Brought up 1 node, 2 CPUs". With it, the boot reaches userspace.

Fixes: bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for non-overlapping affinities")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---

Notes:
    Tested on a two-CPU J2 model simulated from the J-Core RTL with
    Verilator (J2 CPUs, caches, bus mux and AIC1 from jcore-cpu/jcore-soc),
    kernel v7.3-rc4 j2_defconfig with SMP=y:
    
    - unpatched: "Spurious percpu IRQ20 on CPU1", pending IPI messages are
      never cleared (the message word of CPU1 grows to 0x6), boot stalls
      with both CPUs idle after SMP bring-up
    - patched: IPIs are handled, boot reaches userspace on both CPUs
    
    Not tested on J-Core hardware. Testing on real hardware is welcome.

 drivers/irqchip/irq-jcore-aic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
index 94c05cf974be8..b4fee02997eee 100644
--- a/drivers/irqchip/irq-jcore-aic.c
+++ b/drivers/irqchip/irq-jcore-aic.c
@@ -37,8 +37,10 @@ static struct irq_chip jcore_aic;
 
 static void handle_jcore_irq(struct irq_desc *desc)
 {
-	if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
+	if (irq_is_percpu_devid(irq_desc_get_irq(desc)))
 		handle_percpu_devid_irq(desc);
+	else if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
+		handle_percpu_irq(desc);
 	else
 		handle_simple_irq(desc);
 }
-- 
2.53.0

Re: [PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[John Paul Adrian Glaubitz]

Hi Karl,

On Mon, 2026-09-28 at 05:54 +0200, Karl Mehltretter wrote:
> Since commit bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for
> non-overlapping affinities"), handle_percpu_devid_irq() only runs an
> action whose affinity mask contains the current CPU. Only actions set up
> through the percpu_devid request functions have such a mask.
> 
> handle_jcore_irq() passes every per-CPU interrupt to
> handle_percpu_devid_irq(). The J2 IPI is not a percpu_devid interrupt.
> j2_prepare_cpus() requests it with request_irq() and IRQF_PERCPU, so its
> action has no affinity mask and cpumask_test_cpu() reads through a NULL
> pointer. J2 has no MMU to catch this. The read returns whatever is at
> address 0, the action is not found, and IPIs are dropped as spurious
> ("Spurious percpu IRQ20 on CPU1", printed once).
> 
> Pass only percpu_devid interrupts (the PIT) to handle_percpu_devid_irq()
> and the other per-CPU interrupts to handle_percpu_irq() again, as before
> commit d7e3fd658248f ("irqchip/jcore-aic, clocksource/drivers/jcore: Fix
> jcore-pit interrupt request").
> 
> Found with a two-CPU J2 model simulated from the J-Core RTL. Without
> this change the boot stalls with both CPUs idle shortly after
> "smp: Brought up 1 node, 2 CPUs". With it, the boot reaches userspace.
> 
> Fixes: bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for non-overlapping affinities")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> 
> Notes:
>     Tested on a two-CPU J2 model simulated from the J-Core RTL with
>     Verilator (J2 CPUs, caches, bus mux and AIC1 from jcore-cpu/jcore-soc),
>     kernel v7.3-rc4 j2_defconfig with SMP=y:
>     
>     - unpatched: "Spurious percpu IRQ20 on CPU1", pending IPI messages are
>       never cleared (the message word of CPU1 grows to 0x6), boot stalls
>       with both CPUs idle after SMP bring-up
>     - patched: IPIs are handled, boot reaches userspace on both CPUs
>     
>     Not tested on J-Core hardware. Testing on real hardware is welcome.
> 
>  drivers/irqchip/irq-jcore-aic.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
> index 94c05cf974be8..b4fee02997eee 100644
> --- a/drivers/irqchip/irq-jcore-aic.c
> +++ b/drivers/irqchip/irq-jcore-aic.c
> @@ -37,8 +37,10 @@ static struct irq_chip jcore_aic;
>  
>  static void handle_jcore_irq(struct irq_desc *desc)
>  {
> -	if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
> +	if (irq_is_percpu_devid(irq_desc_get_irq(desc)))
>  		handle_percpu_devid_irq(desc);
> +	else if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
> +		handle_percpu_irq(desc);
>  	else
>  		handle_simple_irq(desc);
>  }

Can you tell me what toolchain you used to build the kernel for J2?

Last time I tried to use the one provided by Rob Landley, the build
failed due to an internal compiler error so I couldn't actually build
a kernel to test it on my J2 Turtleboard.

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[Karl Mehltretter]

On Mon, Sep 28, 2026 at 07:57:27AM +0100, John Paul Adrian Glaubitz wrote:
> Can you tell me what toolchain you used to build the kernel for J2?
> 
> Last time I tried to use the one provided by Rob Landley, the build
> failed due to an internal compiler error so I couldn't actually build
> a kernel to test it on my J2 Turtleboard.
> 

Hi Adrian,

musl.cc's sh2eb-linux-muslfdpic toolchain (GCC 11.2.1, binutils 2.37):

  https://musl.cc/sh2eb-linux-muslfdpic-cross.tgz

Your ICE is probably the one in kernel/nstree.c. Since listns() went in
(v6.19), every GCC I tried ICEs there with j2_defconfig. The 64-bit
put_user() asm prints %T (address + 4) of an "m" operand, and GCC can
pick an indexed address that cannot be offset. The asm needs "o".
GCC should still error out instead of crashing, so I filed a GCC bug
too:

  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127639

Fix below, formal patch follows. With it, j2_defconfig with SMP=y
builds fine with the musl.cc toolchain.

Would be great if you could test on your Turtleboard!

Karl

-- >8 --
diff --git a/arch/sh/include/asm/uaccess_32.h b/arch/sh/include/asm/uaccess_32.h
index 5d7ddc092afd7..879d262489219 100644
--- a/arch/sh/include/asm/uaccess_32.h
+++ b/arch/sh/include/asm/uaccess_32.h
@@ -92,7 +92,7 @@ __asm__ __volatile__( \
 	".long	1b + 2, 3b\n\t" \
 	".previous" \
 	:"=&r" (err), "=&r" (x) \
-	:"m" (__m(addr)), "i" (-EFAULT), "0" (err)); })
+	: "o" (__m(addr)), "i" (-EFAULT), "0" (err)); })
 #else
 #define __get_user_u64(x, addr, err) \
 ({ \
@@ -116,7 +116,7 @@ __asm__ __volatile__( \
 	".long	1b + 2, 3b\n\t" \
 	".previous" \
 	:"=&r" (err), "=&r" (x) \
-	:"m" (__m(addr)), "i" (-EFAULT), "0" (err)); })
+	: "o" (__m(addr)), "i" (-EFAULT), "0" (err)); })
 #endif
 
 #define __put_user_size(x,ptr,size,retval)		\
@@ -196,7 +196,7 @@ __asm__ __volatile__( \
 	".long	1b, 3b\n\t" \
 	".previous" \
 	: "=r" (retval) \
-	: "r" (val), "m" (__m(addr)), "i" (-EFAULT), "0" (retval) \
+	: "r" (val), "o" (__m(addr)), "i" (-EFAULT), "0" (retval) \
         : "memory"); })
 #else
 #define __put_user_u64(val,addr,retval) \
@@ -218,7 +218,7 @@ __asm__ __volatile__( \
 	".long	1b, 3b\n\t" \
 	".previous" \
 	: "=r" (retval) \
-	: "r" (val), "m" (__m(addr)), "i" (-EFAULT), "0" (retval) \
+	: "r" (val), "o" (__m(addr)), "i" (-EFAULT), "0" (retval) \
         : "memory"); })
 #endif
 

Re: [PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[John Paul Adrian Glaubitz]

Hi Karl,

On Mon, 2026-09-28 at 08:07 +0200, Karl Mehltretter wrote:
> On Mon, Sep 28, 2026 at 07:57:27AM +0100, John Paul Adrian Glaubitz wrote:
> > Can you tell me what toolchain you used to build the kernel for J2?
> > 
> > Last time I tried to use the one provided by Rob Landley, the build
> > failed due to an internal compiler error so I couldn't actually build
> > a kernel to test it on my J2 Turtleboard.
> > 
> 
> musl.cc's sh2eb-linux-muslfdpic toolchain (GCC 11.2.1, binutils 2.37):
> 
>   https://musl.cc/sh2eb-linux-muslfdpic-cross.tgz
> 
> Your ICE is probably the one in kernel/nstree.c. Since listns() went in
> (v6.19), every GCC I tried ICEs there with j2_defconfig. The 64-bit
> put_user() asm prints %T (address + 4) of an "m" operand, and GCC can
> pick an indexed address that cannot be offset. The asm needs "o".
> GCC should still error out instead of crashing, so I filed a GCC bug
> too:
> 
>   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127639
> 
> Fix below, formal patch follows. With it, j2_defconfig with SMP=y
> builds fine with the musl.cc toolchain.

Oh, I think Florian (CC'ed) already sent a patch for that. I will
look into that one today and pick it up for 7.4 if it fixes the
problem.

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[John Paul Adrian Glaubitz]

Hi Karl,

On Mon, 2026-09-28 at 08:07 +0200, Karl Mehltretter wrote:
> On Mon, Sep 28, 2026 at 07:57:27AM +0100, John Paul Adrian Glaubitz wrote:
> > Can you tell me what toolchain you used to build the kernel for J2?
> > 
> > Last time I tried to use the one provided by Rob Landley, the build
> > failed due to an internal compiler error so I couldn't actually build
> > a kernel to test it on my J2 Turtleboard.
> > 
> 
> Hi Adrian,
> 
> musl.cc's sh2eb-linux-muslfdpic toolchain (GCC 11.2.1, binutils 2.37):
> 
>   https://musl.cc/sh2eb-linux-muslfdpic-cross.tgz
> 
> Your ICE is probably the one in kernel/nstree.c. Since listns() went in
> (v6.19), every GCC I tried ICEs there with j2_defconfig. The 64-bit
> put_user() asm prints %T (address + 4) of an "m" operand, and GCC can
> pick an indexed address that cannot be offset. The asm needs "o".
> GCC should still error out instead of crashing, so I filed a GCC bug
> too:
> 
>   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127639
> 
> Fix below, formal patch follows. With it, j2_defconfig with SMP=y
> builds fine with the musl.cc toolchain.
> 
> Would be great if you could test on your Turtleboard!
> 
> Karl
> 
> -- >8 --
> diff --git a/arch/sh/include/asm/uaccess_32.h b/arch/sh/include/asm/uaccess_32.h
> index 5d7ddc092afd7..879d262489219 100644
> --- a/arch/sh/include/asm/uaccess_32.h
> +++ b/arch/sh/include/asm/uaccess_32.h
> @@ -92,7 +92,7 @@ __asm__ __volatile__( \
>  	".long	1b + 2, 3b\n\t" \
>  	".previous" \
>  	:"=&r" (err), "=&r" (x) \
> -	:"m" (__m(addr)), "i" (-EFAULT), "0" (err)); })
> +	: "o" (__m(addr)), "i" (-EFAULT), "0" (err)); })
>  #else
>  #define __get_user_u64(x, addr, err) \
>  ({ \
> @@ -116,7 +116,7 @@ __asm__ __volatile__( \
>  	".long	1b + 2, 3b\n\t" \
>  	".previous" \
>  	:"=&r" (err), "=&r" (x) \
> -	:"m" (__m(addr)), "i" (-EFAULT), "0" (err)); })
> +	: "o" (__m(addr)), "i" (-EFAULT), "0" (err)); })
>  #endif
>  
>  #define __put_user_size(x,ptr,size,retval)		\
> @@ -196,7 +196,7 @@ __asm__ __volatile__( \
>  	".long	1b, 3b\n\t" \
>  	".previous" \
>  	: "=r" (retval) \
> -	: "r" (val), "m" (__m(addr)), "i" (-EFAULT), "0" (retval) \
> +	: "r" (val), "o" (__m(addr)), "i" (-EFAULT), "0" (retval) \
>          : "memory"); })
>  #else
>  #define __put_user_u64(val,addr,retval) \
> @@ -218,7 +218,7 @@ __asm__ __volatile__( \
>  	".long	1b, 3b\n\t" \
>  	".previous" \
>  	: "=r" (retval) \
> -	: "r" (val), "m" (__m(addr)), "i" (-EFAULT), "0" (retval) \
> +	: "r" (val), "o" (__m(addr)), "i" (-EFAULT), "0" (retval) \
>          : "memory"); })
>  #endif
>  

That patch indeed fixes the build issue and the ICE and I can finally
build a kernel image using Toybox for my J2 board again. Let me see
if the kernel also boots.

Unless your patch is identical to Florian's, you can post yours later.

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [PATCH] irqchip/jcore-aic: Fix lost IPIs on SMP

[John Paul Adrian Glaubitz]

Hi Karl,

On Mon, 2026-09-28 at 05:54 +0200, Karl Mehltretter wrote:
> Since commit bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for
> non-overlapping affinities"), handle_percpu_devid_irq() only runs an
> action whose affinity mask contains the current CPU. Only actions set up
> through the percpu_devid request functions have such a mask.
> 
> handle_jcore_irq() passes every per-CPU interrupt to
> handle_percpu_devid_irq(). The J2 IPI is not a percpu_devid interrupt.
> j2_prepare_cpus() requests it with request_irq() and IRQF_PERCPU, so its
> action has no affinity mask and cpumask_test_cpu() reads through a NULL
> pointer. J2 has no MMU to catch this. The read returns whatever is at
> address 0, the action is not found, and IPIs are dropped as spurious
> ("Spurious percpu IRQ20 on CPU1", printed once).
> 
> Pass only percpu_devid interrupts (the PIT) to handle_percpu_devid_irq()
> and the other per-CPU interrupts to handle_percpu_irq() again, as before
> commit d7e3fd658248f ("irqchip/jcore-aic, clocksource/drivers/jcore: Fix
> jcore-pit interrupt request").
> 
> Found with a two-CPU J2 model simulated from the J-Core RTL. Without
> this change the boot stalls with both CPUs idle shortly after
> "smp: Brought up 1 node, 2 CPUs". With it, the boot reaches userspace.
> 
> Fixes: bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for non-overlapping affinities")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> 
> Notes:
>     Tested on a two-CPU J2 model simulated from the J-Core RTL with
>     Verilator (J2 CPUs, caches, bus mux and AIC1 from jcore-cpu/jcore-soc),
>     kernel v7.3-rc4 j2_defconfig with SMP=y:
>     
>     - unpatched: "Spurious percpu IRQ20 on CPU1", pending IPI messages are
>       never cleared (the message word of CPU1 grows to 0x6), boot stalls
>       with both CPUs idle after SMP bring-up
>     - patched: IPIs are handled, boot reaches userspace on both CPUs
>     
>     Not tested on J-Core hardware. Testing on real hardware is welcome.
> 
>  drivers/irqchip/irq-jcore-aic.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
> index 94c05cf974be8..b4fee02997eee 100644
> --- a/drivers/irqchip/irq-jcore-aic.c
> +++ b/drivers/irqchip/irq-jcore-aic.c
> @@ -37,8 +37,10 @@ static struct irq_chip jcore_aic;
>  
>  static void handle_jcore_irq(struct irq_desc *desc)
>  {
> -	if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
> +	if (irq_is_percpu_devid(irq_desc_get_irq(desc)))
>  		handle_percpu_devid_irq(desc);
> +	else if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
> +		handle_percpu_irq(desc);
>  	else
>  		handle_simple_irq(desc);
>  }

Without this patch, the kernel gets stuck after bringing up both cores:

GDB Stub for HSCPU tests passed                                                                                                       
GDB Stub for HS-2J0 SH2 ROM                                                                                                           
revision: v0.47a-55-873868e6e9ae
build: Mon Dec  9 20:32:25 EST 2019
Booting
SD:start
SD:init good
Storage device initialized
Open vmlinux OK
Use bootloader's DTB
RUN program
Linux version 7.3.0-rc5 (glaubitz@node54.cloud.suse.de) (sh2eb-linux-muslfdpic-gcc (GCC) 9.4.0, GNU ld (GNU Binutils) 2.33.1) #1 SMP Mon Sep 28 13:39:06 UTC 2026
Boot params:
... MOUNT_ROOT_RDONLY - 00000001
... RAMDISK_FLAGS     - 00000000
... ORIG_ROOT_DEV     - 00000200
... LOADER_TYPE       - 00000001
... INITRD_START      - 00000000
... INITRD_SIZE       - 00000000
earlycon: uartlite_a0 MMIO:0xabcd0100 (options '')
printk: legacy bootconsole [uartlite_a0] enabled
Booting machvec: devicetree
OF: reserved mem: Reserved memory: No reserved-memory node in the DT
initrd disabled
SH generic board support: scanning for cpus
CPU enable method: jcore,spin-table
Zone ranges:
  Normal   [mem 0x0000000010000000-0x0000000017ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000010000000-0x0000000017ffffff]
Initmem setup node 0 [mem 0x0000000010000000-0x0000000017ffffff]                                                                      
percpu: max_distance=0x14000 too large for vmalloc space 0x0                                                                          
percpu: Embedded 10 pages/cpu s17852 r0 d23108 u40960                                                                                 
percpu: wasting 12 pages per chunk                                                                                                    
Kernel command line: console=ttyUL0 earlycon                                                                                          
printk: log buffer data + meta data: 131072 + 409600 = 540672 bytes
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
Sorting __ex_table...
Built 1 zonelists, mobility grouping on.  Total pages: 32768
mem auto-init: stack:off, heap alloc:off, heap free:off
Initial J2 CCR is 80000003
I-cache : n_ways=1 n_sets=256 way_incr=0
I-cache : entry_mask=0xffffffe0 alias_mask=0x00000000 n_aliases=0
D-cache : n_ways=1 n_sets=256 way_incr=0
D-cache : entry_mask=0xffffffe0 alias_mask=0x00000000 n_aliases=0
virtual kernel memory layout:
    fixmap  : 0xdffef000 - 0xdffff000   (  64 kB)
    vmalloc : 0xc0000000 - 0xdffed000   ( 511 MB)
    lowmem  : 0x10000000 - 0x18000000   ( 128 MB) (cached)
      .init : 0x1054b000 - 0x1060c000   ( 772 kB)
      .data : 0x103f6844 - 0x1054a314   (1358 kB)
      .text : 0x10001000 - 0x103f6844   (4054 kB)
SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
rcu: Hierarchical RCU implementation.
rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
SH generic board support: scanning for interrupt controllers
Initializing J-Core AIC
rcu: srcu_init: Setting srcu_struct sizes based on contention.
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
Initializing J-Core PIT at (ptrval) IRQ 16
clocksource: jcore_pit_cs: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446 ns
sched_clock: 32 bits at 1000MHz, resolution 1ns, wraps every 2147483647ns
Local J-Core PIT init on cpu 0
SH generic board support: scanning for clk providers
Console: colour dummy device 80x25
Calibrating delay loop... 28.54 BogoMIPS (lpj=57088)
CPU: J2
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
VFS: Finished mounting rootfs on nullfs
rcu: Hierarchical SRCU implementation.
rcu:    Max phase no-delay instances is 1000.
Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
smp: Bringing up secondary CPUs ...
J2 SMP: requested start of cpu 1
Local J-Core PIT init on cpu 1
Spurious percpu IRQ20 on CPU0
smp: Brought up 1 node, 2 CPUs
SMP: Total of 2 processors activated (85.88 BogoMIPS).
Memory: 122512K/131072K available (4050K kernel code, 546K rwdata, 812K rodata, 772K init, 191K bss, 7600K reserved, 0K cma-reserved)
random: crng init done
devtmpfs: initialized
posixtimers hash table entries: 1024 (order: 1, 8192 bytes, linear)
futex hash table entries: 512 (8192 bytes on 1 NUMA nodes, total 8 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
clocksource: Switched to clocksource jcore_pit_cs

After the patch, the kernel successfully boots to the shell prompt:

CPU tests passed
GDB Stub for HS-2J0 SH2 ROM
revision: v0.47a-55-873868e6e9ae
build: Mon Dec  9 20:32:25 EST 2019
Booting
SD:start                                                                                                                              
SD:init good                                                                                                                          
Storage device initialized                                                                                                            
Open vmlinux OK                                                                                                                       
Use bootloader's DTB                                                                                                                  
RUN program
Linux version 7.3.0-rc5 (glaubitz@node54.cloud.suse.de) (sh2eb-linux-muslfdpic-gcc (GCC) 9.4.0, GNU ld (GNU Binutils) 2.33.1) #1 SMP Mon Sep 28 13:56:24 UTC 2026
Boot params:
... MOUNT_ROOT_RDONLY - 00000001
... RAMDISK_FLAGS     - 00000000
... ORIG_ROOT_DEV     - 00000200
... LOADER_TYPE       - 00000001
... INITRD_START      - 00000000
... INITRD_SIZE       - 00000000
earlycon: uartlite_a0 MMIO:0xabcd0100 (options '')
printk: legacy bootconsole [uartlite_a0] enabled
Booting machvec: devicetree
OF: reserved mem: Reserved memory: No reserved-memory node in the DT
initrd disabled
SH generic board support: scanning for cpus
CPU enable method: jcore,spin-table
Zone ranges:
  Normal   [mem 0x0000000010000000-0x0000000017ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000010000000-0x0000000017ffffff]
Initmem setup node 0 [mem 0x0000000010000000-0x0000000017ffffff]
percpu: max_distance=0x14000 too large for vmalloc space 0x0
percpu: Embedded 10 pages/cpu s17852 r0 d23108 u40960
percpu: wasting 12 pages per chunk
Kernel command line: console=ttyUL0 earlycon
printk: log buffer data + meta data: 131072 + 409600 = 540672 bytes
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
Sorting __ex_table...
Built 1 zonelists, mobility grouping on.  Total pages: 32768
mem auto-init: stack:off, heap alloc:off, heap free:off
Initial J2 CCR is 80000003
I-cache : n_ways=1 n_sets=256 way_incr=0
I-cache : entry_mask=0xffffffe0 alias_mask=0x00000000 n_aliases=0
D-cache : n_ways=1 n_sets=256 way_incr=0
D-cache : entry_mask=0xffffffe0 alias_mask=0x00000000 n_aliases=0
virtual kernel memory layout:
    fixmap  : 0xdffef000 - 0xdffff000   (  64 kB)
    vmalloc : 0xc0000000 - 0xdffed000   ( 511 MB)
    lowmem  : 0x10000000 - 0x18000000   ( 128 MB) (cached)
      .init : 0x1054b000 - 0x1060c000   ( 772 kB)
      .data : 0x103f6874 - 0x1054a314   (1358 kB)
      .text : 0x10001000 - 0x103f6874   (4054 kB)
SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
rcu: Hierarchical RCU implementation.
rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
SH generic board support: scanning for interrupt controllers
Initializing J-Core AIC
rcu: srcu_init: Setting srcu_struct sizes based on contention.
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
Initializing J-Core PIT at (ptrval) IRQ 16
clocksource: jcore_pit_cs: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446 ns
sched_clock: 32 bits at 1000MHz, resolution 1ns, wraps every 2147483647ns
Local J-Core PIT init on cpu 0
SH generic board support: scanning for clk providers
Console: colour dummy device 80x25
Calibrating delay loop... 28.35 BogoMIPS (lpj=56704)
CPU: J2
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
VFS: Finished mounting rootfs on nullfs
rcu: Hierarchical SRCU implementation.
rcu:    Max phase no-delay instances is 1000.
Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
smp: Bringing up secondary CPUs ...
J2 SMP: requested start of cpu 1
Local J-Core PIT init on cpu 1
smp: Brought up 1 node, 2 CPUs
SMP: Total of 2 processors activated (85.69 BogoMIPS).
Memory: 122568K/131072K available (4050K kernel code, 546K rwdata, 812K rodata, 772K init, 191K bss, 7600K reserved, 0K cma-reserved)
devtmpfs: initialized
posixtimers hash table entries: 1024 (order: 1, 8192 bytes, linear)
futex hash table entries: 512 (8192 bytes on 1 NUMA nodes, total 8 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
clocksource: Switched to clocksource jcore_pit_cs
NET: Registered PF_INET protocol family
IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
TCP bind hash table entries: 1024 (order: 2, 16384 bytes, linear)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 2, 14336 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
workingset: timestamp_bits=30 (anon: 25) max_order=15 bucket_order=0 (anon: 0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse: init (API version 7.46)
abcd0100.serial: ttyUL0 MMIO:0xabcd0100 (irq = 18, base_baud = 0) is a uartlite
printk: legacy console [ttyUL0] enabled
printk: legacy console [ttyUL0] enabled
printk: legacy bootconsole [uartlite_a0] disabled
printk: legacy bootconsole [uartlite_a0] disabled
loop: module loaded
jcore_spi abcd0040.spi: Runtime PM disabled, clock forced on.
spi-nor spi0.1: unrecognized JEDEC id bytes: ff ff ff ff ff ff
mmc_spi spi0.0: SD/MMC host mmc0, no WP, no poweroff, cd polling
NET: Registered PF_INET6 protocol family
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
NET: Registered PF_PACKET protocol family
mmc0: host does not support reading read-only switch, assuming write-enable
mmc0: new SDHC card on SPI
mmcblk0: mmc0:0000 SL16G 14.8 GiB
 mmcblk0: p1 p2
netconsole: network logging started
clk: Disabling unused clocks
Warning: unable to open an initial console.
Freeing unused kernel image (initmem) memory: 772K
This architecture does not have kernel memory protection.
Run /init as init process
ifconfig: ioctl 8916: No such device
sntp: sendto: Network unreachable
sntp: time.google.com:123: Try again
Type exit when done.
$ uname -a
Linux (none) 7.3.0-rc5 #1 SMP Mon Sep 28 13:56:24 UTC 2026 sh2eb Toybox
$

Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913