MFC r260666:
In the nested TLB fault handler, for a direct-mapped address, make
sure to clear the lower 12 bits.
MFC r260914:
In pmap_set_pte(), make sure to enforce ordering by inserting a memory fence.