Change Details

There are really four patches. 1. create_pagetables(): Fully fill the last kernel placeholder page table page. If it is ever demoted, we store wrong content in the pm_root radix. 2. pmap_init(): Initialize vm_page_array elements for the kernel page tables with expected wire count. Wire count 1 works by chance, IMO, pmap_demote_pde_locked() uses wire_count == 1 as a check that the page table page is newly allocated and re-fills it. 3. pmap_enter_pde(). Kernel submap might get a mapping instantiated with superpage from the start, e.g. by means of vm_fault_quick_soft(). In this case corresponding page table page is zero, which breaks the demotion invariants because demotion expect that the page from radix i usable. 4. pmap_demote_pde_locked(). This is only code restructuring and making the DIAGNOSTIC check verify all ptes in the page from radix, not just first pte. Reported and tested by: pho

In particular, - Move the code to handle failure to allocate page table page into helper - After the previous item is done, it is possible to distinguish !PG_A case and case of missed page, in the control flow. - Make the variable to indicate that in-kernel mapping is demoted. - Assert that missed page table page can only happen for in-kernel mapping when demoting direct map. - If DIAGNOSTIC is enabled, and the page table page should be already filled, check all ptes instead of only first one.

There are really four patches.In particular, 1. create_pagetables(): Fully fill the last kernel placeholder page table page. If it is ever demoted, we store wrong content in the pm_root radix.- Move the code to handle failure to allocate page table page into helper 2.- After the previous item is done, pmap_init(): Initialize vm_page_array elements for the kernel page tables with expected wire count. Wire count 1 works by chance, IMOit is possible to distinguish !PG_A case and case of missed page, pmap_demote_pde_locked() uses wire_count == 1 as a check that the page table page is newly allocated and re-fills itin the control flow. 3. pmap_enter_pde(). Kernel submap might get a mapping instantiated with superpage from the start, e.g. by means of vm_fault_quick_soft(). In this case corresponding page table page is zero, which breaks the demotion invariants because demotion expect that the page from radix i usable- Make the variable to indicate that in-kernel mapping is demoted. 4. pmap_demote_pde_locked(). This is only code restructuring and making the DIAGNOSTIC check verify all ptes in the page from radix- Assert that missed page table page can only happen for in-kernel mapping when demoting direct map. - If DIAGNOSTIC is enabled, not just first pte. Reported and tested by: phoand the page table page should be already filled, check all ptes instead of only first one.