* Give arch_vm_supports_protection a team_id argument (primarily to allow the kernel address space to be more restricted than user ones.) * Move invocation of arch_vm_supports_protection to a static method, and also call fix_protection from there. * Consolidate protection checks.