Re: [BUG] sched/cache: "Make LLC id continuous" causes NULL cpumask dereference in build_sched_domains on POWER9

[Shrikanth Hegde <sshegde@linux.ibm.com>]

On 5/28/26 9:26 PM, Srikar Dronamraju wrote:
> * Shrikanth Hegde <sshegde@linux.ibm.com> [2026-05-28 16:57:54]:
> 
>>
>>
>> On 5/25/26 7:37 PM, Venkat Rao Bagalkote wrote:
>>> Greetings!!!
>>>
>>> I am seeing an early boot kernel panic due to NULL pointer dereference
>>> on a POWER9 (pSeries) system when testing linux-next (next-20260522).
>>>
>>
>> Hi Venkat, Ritesh,
>> Could you please try the below diff and see if it helps.
>> This helps to fix boot problem for SPLPAR for me.
>>
>> Hi Chenyu,
>> Let me know if I have to send the patch. Or
>> if you want to add more comments or change it feel free to pick it up and send it.
>> Either way is fine. Let me know.
>>
>> Hi Prateek, Srikar,
>> I hope the below diff makes sense. Please check.
>>
>> nit: llc_mask is still under CONFIG_SCHED_MC, for ppc it is set to true
>> always for SMP systems, and for others it is LLC domain. So not a concern i guess.
>> ---
>>
>>  From 10e9413cef063446d67dc02c2b44e1ea582e5d53 Mon Sep 17 00:00:00 2001
>> From: Shrikanth Hegde <sshegde@linux.ibm.com>
>> Date: Thu, 28 May 2026 06:16:44 -0400
>> Subject: [PATCH] topology: Provide arch_llc_mask for cache aware scheduling
>>
>> Venkat Reported a boot kernel panic next-20260522. Git bisect pointed to
>> b5ea300a17e3 ("sched/cache: Make LLC id continuous")
>>
>> Stacktrace points to llc_mask being null.
>>
>> NIP [c000000000e58504] _find_first_bit+0x44/0x130
>> LR [c000000000e58500] _find_first_bit+0x40/0x130
>> Call Trace:
>> build_sched_domains+0xad8/0xe50
>> sched_init_smp+0xa8/0x164
>> kernel_init_freeable+0x250/0x370
>> ret_from_kernel_user_thread+0x14/0x1c
>>
>> On powerpc, cpu_coregroup_mask is available only when the underlying
>> hardware support coregroup. In shared LPAR, QEMU guest or power9 etc
>> coregroup isn;t supported. In such cases llc_mask was being referrenced
>> when it was null leading to panic.
>>
>> on powerpc, LLC is at SMT core level. So assumption that coregroup(MC)
>> domain point to LLC is wrong. Provide a way for archs to say where its
>> LLC is if it not at MC domain.
>>
>> Fixes: b5ea300a17e3 ("sched/cache: Make LLC id continuous")
>> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
>> Closes: https://lore.kernel.org/all/51154de7-3700-4cb4-82f2-1b3a8fa427f7@linux.ibm.com/
>> Suggested-by: Chen, Yu C <yu.c.chen@intel.com>
>> Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com>
>> ---
>>   arch/powerpc/include/asm/topology.h |  3 +++
>>   arch/powerpc/kernel/smp.c           | 10 ++++++++++
>>   kernel/sched/topology.c             |  9 +++++++++
>>   3 files changed, 22 insertions(+)
>>
>> diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
>> index 66ed5fe1b718..bd1db3b1dbb0 100644
>> --- a/arch/powerpc/include/asm/topology.h
>> +++ b/arch/powerpc/include/asm/topology.h
>> @@ -131,6 +131,9 @@ static inline int cpu_to_coregroup_id(int cpu)
>>   #ifdef CONFIG_SMP
>>   #include <asm/cputable.h>
>> +const struct cpumask *arch_llc_mask(int cpu);
>> +#define arch_llc_mask	arch_llc_mask
>> +
>>   struct cpumask *cpu_coregroup_mask(int cpu);
>>   const struct cpumask *cpu_die_mask(int cpu);
>>   int cpu_die_id(int cpu);
>> diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
>> index 3467f86fd78f..cc8e87d6cae9 100644
>> --- a/arch/powerpc/kernel/smp.c
>> +++ b/arch/powerpc/kernel/smp.c
>> @@ -1101,6 +1101,16 @@ const struct cpumask *cpu_die_mask(int cpu)
>>   }
>>   EXPORT_SYMBOL_GPL(cpu_die_mask);
>> +const struct cpumask *arch_llc_mask(int cpu)
>> +{
>> +	/* Power9, CACHE domain is the LLC*/
>> +	if (shared_caches)
>> +		return cpu_l2_cache_mask(cpu);
>> +
>> +	/* For others, SMT domain is the LLC*/
>> +	return cpu_smt_mask(cpu);
>> +}
> 
> Why dont we do
> #define arch_llc_mask cpu_l2_cache_mask
> 

I would prefer to keep the abstraction. This leaves
room for implementation details.