I quickly review the TVM code and have a question. In current implementation, the PT_AREA pages are read only for supervisor. Although you handle all the writes into PT_area at the software layer, but hardware will also update the PT_AREA (e.g., D/A bit set by MMU), have can you handle this?