When we use mprotect to change the page prot, I find "__P001" and "__P011" are the same. So how we detect the write/read? pgprot_t protection_map[16] = { __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111, __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111 }; pgprot_t vm_get_page_prot(unsigned long vm_flags) { return __pgprot(pgprot_val(protection_map[vm_flags & (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) | pgprot_val(arch_vm_get_page_prot(vm_flags))); } #define __P001 PAGE_READONLY #define __P011 PAGE_COPY #define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \ _PAGE_ACCESSED | _PAGE_NX) #define PAGE_COPY PAGE_COPY_NOEXEC #define PAGE_READONLY __pgprot(_PAGE_PRESENT | _PAGE_USER | \ _PAGE_ACCESSED | _PAGE_NX) Thanks, Xishi Qiu -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx"> email@xxxxxxxxx </a>