Index: sys/riscv/riscv/pmap.c
===================================================================
--- sys/riscv/riscv/pmap.c
+++ sys/riscv/riscv/pmap.c
@@ -2296,10 +2296,7 @@
 	struct spglist free;
 	vm_paddr_t phys;
 	pd_entry_t *l2;
-	pt_entry_t *l3;
-	vm_paddr_t pa;
-	pt_entry_t entry;
-	pn_t pn;
+	pt_entry_t *l3, newl3;
 
 	KASSERT(va < kmi.clean_sva || va >= kmi.clean_eva ||
 	    (m->oflags & VPO_UNMANAGED) != 0,
@@ -2384,19 +2381,14 @@
 	 */
 	pmap_resident_count_inc(pmap, 1);
 
-	pa = VM_PAGE_TO_PHYS(m);
-	pn = (pa / PAGE_SIZE);
-
-	entry = PTE_V | PTE_R;
-	if (prot & VM_PROT_EXECUTE)
-		entry |= PTE_X;
-	entry |= (pn << PTE_PPN0_S);
-
-	/*
-	 * Now validate mapping with RO protection
-	 */
+	newl3 = ((VM_PAGE_TO_PHYS(m) / PAGE_SIZE) << PTE_PPN0_S) |
+	    PTE_V | PTE_R;
+	if ((prot & VM_PROT_EXECUTE) != 0)
+		newl3 |= PTE_X;
 	if ((m->oflags & VPO_UNMANAGED) == 0)
-		entry |= PTE_SW_MANAGED;
+		newl3 |= PTE_SW_MANAGED;
+	if (va < VM_MAX_USER_ADDRESS)
+		newl3 |= PTE_U;
 
 	/*
 	 * Sync the i-cache on all harts before updating the PTE
@@ -2405,7 +2397,7 @@
 	if (prot & VM_PROT_EXECUTE)
 		pmap_sync_icache(pmap, va, PAGE_SIZE);
 
-	pmap_store(l3, entry);
+	pmap_store(l3, newl3);
 
 	pmap_invalidate_page(pmap, va);
 	return (mpte);