---
name: "PAGEMAP_SCAN"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/PAGEMAP_SCAN"
---

# PAGEMAP\_SCAN(2const)

get and/or clear page flags

## NAME

PAGEMAP\_SCAN - get and/or clear page flags

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/fs.h>  /* Definition of PAGE* and PM_* constants */
#include <sys/ioctl.h>
```

**int ioctl(int** *pagemap\_fd***, PAGEMAP\_SCAN, struct pm\_scan\_arg \****arg***);**

**#include \<linux/fs.h\>**

```
struct pm_scan_arg {
    __u64  size;
    __u64  flags;
    __u64  start;
    __u64  end;
    __u64  walk_end;
    __u64  vec;
    __u64  vec_len;
    __u64  max_pages;
    __u64  category_inverted;
    __u64  category_mask;
    __u64  category_anyof_mask;
    __u64  return_mask;
};
```

**struct page\_region {**     **\_\_u64  start;**     **\_\_u64  end;**     **\_\_u64  categories;** **};**

## DESCRIPTION

This [**ioctl**(2)](/ioctl/2.md) is used to get and optionally clear some specific flags from page table entries. The information is returned with **PAGE\_SIZE** granularity.

To start tracking the written state (flag) of a page or range of memory, the **UFFD\_FEATURE\_WP\_ASYNC** must be enabled by **UFFDIO\_API** [**ioctl**(2)](/ioctl/2.md) on **userfaultfd** and memory range must be registered with **UFFDIO\_REGISTER** [**ioctl**(2)](/ioctl/2.md) in **UFFDIO\_REGISTER\_MODE\_WP** mode.

### Supported page flags

The following page table entry flags are supported:

- **PAGE\_IS\_WPALLOWED**

  The page has asynchronous write-protection enabled.

- **PAGE\_IS\_WRITTEN**

  The page has been written to from the time it was write protected.

- **PAGE\_IS\_FILE**

  The page is file backed.

- **PAGE\_IS\_PRESENT**

  The page is present in the memory.

- **PAGE\_IS\_SWAPPED**

  The page is swapped.

- **PAGE\_IS\_PFNZERO**

  The page has zero PFN.

- **PAGE\_IS\_HUGE**

  The page is THP or Hugetlb backed.

### Supported operations

The get operation is always performed if the output buffer is specified. The other operations are as following:

- **PM\_SCAN\_WP\_MATCHING**

  Write protect the matched pages.

- **PM\_SCAN\_CHECK\_WPASYNC**

  Abort the scan when a page is found which doesn't have the Userfaultfd Asynchronous Write protection enabled.

### The *struct pm\_scan\_arg* argument

- **size**

  This field should be set to the size of the structure in bytes, as in *sizeof(struct pm\_scan\_arg)*.

- **flags**

  The operations to be performed are specified in it.

- **start**

  The starting address of the scan is specified in it.

- **end**

  The ending address of the scan is specified in it.

- **walk\_end**

  The kernel returns the scan's ending address in it. The *walk\_end* equal to *end* means that scan has completed on the entire range.

- **vec**

  The address of *page\_region* array for output.

- **vec\_len**

  The length of the *page\_region* struct array.

- **max\_pages**

  It is the optional limit for the number of output pages required.

- **category\_inverted**

  **PAGE\_IS\_***\** categories which values match if 0 instead of 1.

- **category\_mask**

  Skip pages for which any **PAGE\_IS\_***\** category doesn't match.

- **category\_anyof\_mask**

  Skip pages for which no **PAGE\_IS\_***\** category matches.

- **return\_mask**

  **PAGE\_IS\_***\** categories that are to be reported in *page\_region*.

## RETURN VALUE

On error, -1 is returned, and *errno* is set to indicate the error.

## ERRORS

Error codes can be one of, but are not limited to, the following:

- **EINVAL**

  Invalid arguments i.e., invalid *size* of the argument, invalid *flags*, invalid *categories*, the *start* address isn't aligned with **PAGE\_SIZE**, or *vec\_len* is specified when *vec* is NULL.

- **EFAULT**

  Invalid *arg* pointer, invalid *vec* pointer, or invalid address range specified by *start* and *end*.

- **ENOMEM**

  No memory is available.

- **EINTR**

  Fatal signal is pending.

## STANDARDS

Linux.

## HISTORY

Linux 6.7.

## SEE ALSO

[**ioctl**(2)](/ioctl/2.md)