Hi. I'm using KVM guest page tracking API like, kvm_page_track_register_notifier/kvm_page_track_add_page for my project. https://lwn.net/Articles/675571/ But I can't catch some points about these API. So would anyone help me? My primary question is how track_write is called? track_write hook function seems to be called by kvm_page_track_write from emulator_write_phys. https://github.com/torvalds/linux/blob/3206e7d5e25ef94b5a29e2c81e6fb8d5fb48422f/arch/x86/kvm/x86.c#L4601 But page hook is set by removing write permission from spte. (assuming direct shadow paging case) When EPT violation happen due to writing this page, how is emulator_write_phys called? I can't fill the gap between 'EPT access violation' and 'write_emulate function'. Thx