Dave, Is there a reason why the default key; key-0, is not allowed to be explicitly associated with pages using pkey_mprotect()? I see valid usecases where an application may initially want to associate an address-range with some key and latter choose to revert to its initial state, by associating key-0. However our implementation (both x86 and power) do not allow pkey_mprotect() to be called with key-0. I do not see a reason why it must be blocked. Thoughts? RP