On Mon, May 20, 2019 at 10:56:57AM +1000, Nicholas Piggin wrote: > Signed-off-by: Nicholas Piggin <npiggin@xxxxxxxxx> Comment below... > diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c > index 6035d24f1d1d..5ae7f8359368 100644 > --- a/arch/powerpc/kvm/book3s_hv_builtin.c > +++ b/arch/powerpc/kvm/book3s_hv_builtin.c > @@ -758,6 +758,53 @@ void kvmhv_p9_restore_lpcr(struct kvm_split_mode *sip) > local_paca->kvm_hstate.kvm_split_mode = NULL; > } > > +static void kvmppc_end_cede(struct kvm_vcpu *vcpu) > +{ > + vcpu->arch.ceded = 0; > + if (vcpu->arch.timer_running) { > + hrtimer_try_to_cancel(&vcpu->arch.dec_timer); So now we're potentially calling hrtimer_try_to_cancel in real mode. Are you absolutely sure that nothing in the hrtimer code accesses anything that is vmalloc'd? I'm not. Maybe you can prove that when called in real mode, vcpu->arch.timer_running will always be false, but it seems fragile to me. Paul.