---
name: "vm_map_protect"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/vm_map_protect"
---

# vm\_map\_protect(9)

apply protection bits to a virtual memory region

## NAME

**vm\_map\_protect** – apply protection bits to a virtual memory region

## SYNOPSIS

**#include \<sys/param.h\>**

**#include \<vm/vm.h\>**

**#include \<vm/vm\_map.h\>**

*int*\

**vm\_map\_protect**(*vm\_map\_t map*, *vm\_offset\_t start*, *vm\_offset\_t end*, *vm\_prot\_t new\_prot*, *vm\_prot\_t new\_maxprot*, *int flags*);

## DESCRIPTION

The **vm\_map\_protect**() function sets the protection bits and maximum protection bits of the address region bounded by *start* and *end* within the map *map*.

If the *flags* argument has the VM\_MAP\_PROTECT\_SET\_PROT bit set, then the effective protection is set to *new\_prot*.

If the *flags* argument has the VM\_MAP\_PROTECT\_SET\_MAXPROT bit set, then the maximum protection is set to *new\_maxprot*. Protection bits not included into *new\_maxprot* will be cleared from existing entries.

The values specified by *new\_prot* and *new\_maxprot* are not allowed to include any protection bits that are not set in existing *max\_protection* on every entry within the range. The operation will fail if this condition is violated. For instance, this prevents upgrading a shared mapping of a read-only file from read-only to read-write.

The specified range must not contain sub-maps.

## IMPLEMENTATION NOTES

The function acquires a lock on the *map* for the duration, by calling [vm\_map\_lock(9)](/vm_map_lock/9.md). Also, any in-progress wiring operation on the map affecting the specified range will cause **vm\_map\_protect** to sleep, waiting for completion.

## RETURN VALUES

- KERN\_SUCCESS

  The specified protection bits were set successfully.

- KERN\_INVALID\_ARGUMENT

  A sub-map entry was encountered in the range,

- KERN\_PROTECTION\_FAILURE

  The value of *new\_prot* or *new\_maxprot* exceed *max\_protection* for an entry within the range.

- KERN\_PROTECTION\_FAILURE

  The map does not allow simultaneous setting of write and execute permissions, but *new\_prot* has both VM\_PROT\_WRITE and VM\_PROT\_EXECUTE set.

- KERN\_RESOURCE\_SHORTAGE

  A copy-on-write mapping is transitioned from read-only to read-write, and not enough swap space is available to back the copied pages.

- KERN\_OUT\_OF\_BOUNDS

  Both new protection and new maximum protection updates were requested, but the specified *new\_prot* is not a subset of *new\_maxprot*.

## SEE ALSO

[vm\_map(9)](/vm_map/9.md)

## AUTHORS

This manual page was written by Bruce M Simpson ⟨*bms@spc.org*⟩.