Gleb, so I just did a trace of KVM MMU to try to understand why L2 is stuck with shadow on EPT Ensure, EPT is enabled on L0 & disabled on L1 On L0: --------- $ cat /sys/module/kvm_intel/parameters/ept Y On L1 --------- $ cat /sys/module/kvm_intel/parameters/ept N Build and install trace-cmd on L1: $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/trace-cmd.git trace-cmd $ make && sudo make-install Run trace command (on L1) to capture kvmmmu event: $ trace-cmd record -b 2000 -e kvmmmu /sys/kernel/debug/tracing/events/kvmmmu/filter /sys/kernel/debug/tracing/events/*/kvmmmu/filter Hit Ctrl^C to stop recording Boot L2 guest: $ virsh start nguest-01 --console After a minute or two, ctl-C the trace-cmd, generate the report: $ trace-cmd report version = 6 trace-cmd: No such file or directory function is_writable_pte not defined CPU 1 is empty CPU 2 is empty CPU 3 is empty cpus=4 qemu-system-x86-2554 [000] 90667.995345: kvm_mmu_invalidate_zap_all_pages: kvm-mmu-valid-gen 0 used_pages 0 qemu-system-x86-2557 [000] 90668.078978: kvm_mmu_get_page: new sp gfn 0 0/2 q0 direct --- !pge !nxe root 0 sync qemu-system-x86-2557 [000] 90668.078980: kvm_mmu_get_page: new sp gfn 40000 0/2 q0 direct --- !pge !nxe root 0 sync qemu-system-x86-2557 [000] 90668.078980: kvm_mmu_get_page: new sp gfn 80000 0/2 q0 direct --- !pge !nxe root 0 sync qemu-system-x86-2557 [000] 90668.078981: kvm_mmu_get_page: new sp gfn c0000 0/2 q0 direct --- !pge !nxe root 0 sync qemu-system-x86-2557 [000] 90668.079025: kvm_mmu_get_page: new sp gfn 0 0/1 q0 direct --- !pge !nxe root 0 sync Side question: I wonder why would trace-cmd say "trace-cmd: No such file or directory"? /kashyap -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html