subpage_prot(2)

💖 subpage_prot(2) — the girlies' guide to subpage protection 💖

okay so bestie, this one lives in the System Calls Manual section 2, and it's genuinely one of the most niche-but-iconic syscalls out there. it's subpage_prot(2) and it's giving PowerPC main character energy. let's get into it 🦋

---

✨ NAME ✨

subpage_prot — define a subpage protection for an address range

---

🎀 LIBRARY 🎀

Standard C library (libc, -lc)

---

🌸 SYNOPSIS 🌸

#include <sys/syscall.h>      /* Definition of SYS_* constants */
#include <unistd.h>

int syscall(SYS_subpage_prot, unsigned long addr, unsigned long size,
            uint32_t *map);

heads up bestie: glibc provides no wrapper for subpage_prot(), so you literally have no choice but to go through syscall(2). no shortcuts, no cozy little libc hug. it's giving raw-dogging the syscall interface 💅

---

💜 DESCRIPTION 💜

The PowerPC-specific subpage_prot() system call is the girl that lets you control access permissions on individual 4 kB subpages — but only on systems configured with a page size of 64 kB. so like, tiny granularity on top of chunky pages. obsessed.

The protection map gets applied to the memory pages in the region starting at addr and continuing for size bytes. and no cap, both of these arguments must be aligned to a 64-kB boundary. non-negotiable.

The protection map itself is specified in the buffer pointed to by map. here's the tea:

• the map has 2 bits per 4 kB subpage
• so each 32-bit word specifies the protections of 16 4 kB subpages inside a 64 kB page (which means the number of 32-bit words pointed to by map should equate to the number of 64-kB pages specified by size)
• each 2-bit field in the protection map is:
  • 0 to allow any access
  • 1 to prevent writes
  • 2 or 3 to prevent all accesses

like, two bits doing all that work?? underrated fr fr 🫶

---

🔥 RETURN VALUE 🔥

On success, subpage_prot() returns 0. Otherwise, one of the error codes specified below is returned. slay when it works, 💀 when it doesn't.

---

😭 ERRORS 😭

• EFAULT — The buffer referred to by map is not accessible. (she's not there bestie, the pointer is reaching into the void 🙈)
• EINVAL — The addr or size arguments are incorrect. Both of these arguments must be aligned to a multiple of the system page size, and they must not refer to a region outside of the address space of the process or to a region that consists of huge pages.
• ENOMEM — Out of memory. the classic. the eternal. ✨

---

🌈 STANDARDS 🌈

Linux.

---

👑 HISTORY 👑

Linux 2.6.25 (PowerPC).

The system call is provided only if the kernel is configured with CONFIG_PPC_64K_PAGES. so if your kernel didn't opt in, this call literally does not exist for you. vibe check failed, sorry babe 💔

---

🧚 NOTES 🧚

Normal page protections (at the 64-kB page level) also apply. the subpage protection mechanism is an additional constraint, not an override. so putting 0 in a 2-bit field won't allow writes to a page that is otherwise write-protected.

important!! do not read that as "0 means anything goes". it means "this layer says yes, but the layer above might still say no". stacking rules, bestie. permissions are an intersection, not a replacement 💅

🦋 Rationale 🦋

This system call is provided to assist writing emulators that operate using 64-kB pages on PowerPC systems. when emulating systems such as x86, which uses a smaller page size, the emulator can no longer use the memory-management unit (MMU) and normal system calls for controlling page protections. (the emulator could emulate the MMU by checking and possibly remapping the address for each memory access in software, but that is slow. like, painfully slow. not the move. 😭)

So the idea is that the emulator supplies an array of protection masks to apply to a specified range of virtual addresses. These masks are applied at the level where hardware page-table entries (PTEs) are inserted into the hardware page table based on the Linux PTEs — so the Linux PTEs are not affected. ✨

Implicit in this is that the regions of the address space that are protected are switched to use 4-kB hardware pages rather than 64-kB hardware pages (on machines with hardware 64-kB page support). the girl is literally shapeshifting the page size behind the scenes, and honestly? iconic. 🔥

---

💖 SEE ALSO 💖

• mprotect(2)
• syscall(2)
• Documentation/admin-guide/mm/hugetlbpage.rst in the Linux kernel source tree

---

aaaand that's the whole page bestie!! this one came from Linux man-pages 6.20, dated 2026-02-08, and it's the subpage_prot(2) entry, periodt. go forth and protect your subpages responsibly, ily 🫶💖✨