arm64 pmap: demote L3C pages in pmap_clear_modify()HEADmain

When pmap_clear_modify() demotes a dirty L2 block mapping, it write
protects the L3 entry that maps "m", so that a subsequent write access
may repromote.  However, since fd6cb031f577, the L3 entries created by
pmap_demote_l2_locked() may have ATTR_CONTIGUOUS set, and
pmap_clear_modify() was write protecting one L3 entry within an L3C page
while leaving the page's other L3 entries writeable with ATTR_CONTIGUOUS
still set.  A TLB entry that a processor creates from any of those other
L3 entries may translate "m"'s virtual address and permit writes to "m"
without a fault.  To fix this issue, as in pmap_remove_write(), demote
the L3C page before write protecting the L3 entry.

Found by:	Claude Code (Opus 5.5)
Fixes:	fd6cb031f577 "arm64 pmap: Add ATTR_CONTIGUOUS support [Part 1]"
MFC after:	1 week

0 files changed, 0 insertions, 0 deletions