sys: do not allow entering vm_fault() on boot until VM is initialized

[kib]

Summary

On amd64, a hack sets td_critnest to 1 in hammer_time(), and then clear
it before returning from hammer_time(), which is too early.  Instead,
set TDP_NOFAULTING for thread0, and clear the flag after vm_init() finished.

Noted by:       adrian

[adrian]

thanks!

[kib]

Make this MI.

[markj]

To be clear, the point is to have an explicit panic rather than a boot hang because we end up spinning in an uninitialized trap handler?

sys/vm/vm_init.c

162

I'd add a comment pointing to where this flag is set.

[kib]

In D54768#1251863, @markj wrote:

To be clear, the point is to have an explicit panic rather than a boot hang because we end up spinning in an uninitialized trap handler?

It is not necessarily a hang. For instance, kernel_map is not yet initialized, so we are locking non-initialized sx because MAP_SYSTEM_MAP is not set (instead of locking uninitialized mutex). This triggers witness panics AFAIR from the report, but in non-debugging kernels might cause e.g. attempt to use uninitialized sleepqueues which would also fail somehow. So it might end up with anything, as should be for UB in its real sense.

[kib]

Add comment in vm_init.c

[kib]

Save file before diffing.