riscv: handle superpage in pmap_enter_quick_locked()

Previously, if pmap_enter_l2() was asked to re-map an existing superpage
(the result of madvise(MADV_WILLNEED) on a mapped range), it could
'fail' to do so, falling back to trying pmap_enter_quick_locked() for
each 4K virtual page. Because this function does not check if the l2
entry it finds is a superpage, it would proceed, sometimes resulting in
the creation of false PV entries.

If the relevant range was later munmap'ed, the system would panic during
the process' exit in pmap_remove_pages(), while attempting to clean up
the PV entries for mappings which no longer exist.

Instead, we should return early in the presence of an existing
superpage, as is done in other pmaps.

PR:             266108
Reviewed by:	markj, alc
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D36563

(cherry picked from commit 9d1aef84021f4e99d37f4e9149a8799c3d9e5e03)

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/riscv/riscv/pmap.c b/sys/riscv/riscv/pmap.c
index 9ca06968b1d6..d72b989f8f38 100644
--- a/sys/riscv/riscv/pmap.c
+++ b/sys/riscv/riscv/pmap.c
@@ -3383,6 +3383,8 @@ pmap_enter_quick_locked(pmap_t pmap, vm_offset_t va, vm_page_t m,
 			 * attempt fails, we don't retry.  Instead, we give up.
 			 */
 			if (l2 != NULL && pmap_load(l2) != 0) {
+				if ((pmap_load(l2) & PTE_RWX) != 0)
+					return (NULL);
 				phys = PTE_TO_PHYS(pmap_load(l2));
 				mpte = PHYS_TO_VM_PAGE(phys);
 				mpte->ref_count++;