rewrite the tlb miss handler and tlb dirty handler.

optimize for HVT usage (when compiled for proper cpu type).
drop hpt_* global variables, use info from control registers instead.
there are still ways to improve the tlb handlers tho.
machdep also prints cache and tlb coherence states (not related to the above).
You eat greenish muffin. --More-- You write real code.

3 files changed, 195 insertions, 156 deletions

diff --git a/sys/arch/hppa/hppa/locore.S b/sys/arch/hppa/hppa/locore.S
index ecfe967c072..55dec3f4cb7 100644
--- a/sys/arch/hppa/hppa/locore.S
+++ b/sys/arch/hppa/hppa/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.16 1999/07/18 04:42:28 mickey Exp $	*/
+/*	$OpenBSD: locore.S,v 1.17 1999/07/21 07:37:19 mickey Exp $	*/
 
 /*
  * Copyright (c) 1998,1999 Michael Shalayeff
@@ -72,6 +72,11 @@
 #endif
 #include "assym.h"
 
+
+	/* this macro determines when to use cr28 (ie HVT works) */
+#define	USECR28	((defined(HP7100LC_CPU) || defined(HP7300LC_CPU)) && \
+	!(defined(HP71000_CPU) || defined(HP7200_CPU) || defined(HP7300_CPU)))
+
 	.import	$global$, data
 	.import pdc, data
 	.import	boothowto, data
@@ -105,8 +110,7 @@ intr_stack_red
 
 
 /*
-
-	 * This is the starting location for the kernel
+ * This is the starting location for the kernel
  */
 ENTRY($start)
 /*
@@ -799,167 +803,160 @@ $sfu_emu
 	ldo	1(r0), ret0	/* none supported by now */
 
 	/* Compute the hpt entry ptr */
-#if 1
-#define	HPTENT ! \
-	extru	r9,19,20,r16  		/* r16 = (offset >> 12) */	! \
-	zdep	r8,26,16,r24	     	/* r24 = (space << 5) */	! \
-	mfctl	hptmask,r17		/* r17 = sizeof(HPT)-1 */	! \
-	xor	r16,r24,r24		/* r24 ^= r16 */		! \
-	and	r17,r24,r24		/* r24 &= r17 */		! \
-	mfctl	vtop,r16		/* r16 = address of HPT table */! \
-	zdep	r24,27,28,r17		/* r24 <<= 4 */			! \
-	add	r17,r16,r24		/* r24 = HPT entry */
-#else
 #define	HPTENT ! \
-	mfctl	cr28, r24
-#endif
+	extru	r9, 23, 24, r16  	/* r17 = (offset >> 8) */	! \
+	zdep	r8, 26, 16, r24	     	/* r24 = (space << 5) */	! \
+	mfctl	hptmask, r17		/* r17 = sizeof(HPT)-1 */	! \
+	xor	r16, r24, r24		/* r24 ^= r16 */		! \
+	and	r17, r24, r24		/* r24 &= r17 */		! \
+	mfctl	vtop, r16		/* r16 = address of HPT table */! \
+	or	r16, r24, r24		/* r24 = HPT entry */		! \
+	mtctl	r24, cr28
 
+	/* Construct the virtual address tag. */
+#define	VTAG ! \
+	extru	r9,14,15,r16		   /* r16 = off[0..14] */	! \
+	zdep	r16,15,15,r16		   /* r16 = tag[1..15] */	! \
+	dep	r8,31,16,r16		   /* put in the space id */	! \
+	depi	1,0,1,r16		   /* and set the valid bit */
+
+
+	.align	64
 	.export	TLABEL(tlbd), code
 TLABEL(tlbd)
 	mfctl	ior, r9		/* Offset */
 	mfctl	isr, r8		/* Space  */
+	depi    0, 31, 12, r9	/* Clear the byte offset into the page */
 
-	mfsp	sr1, r25	/* Need a space reg, so save it in a shadow */
-	mtsp	r8, sr1		/* Put the space id where we can use it */
-
-	depi    0,31,12,r9	/* Clear the byte offset into the page */
-
-	HPTENT
-
-	/* Construct the virtual address tag. */
-	extru	r9,14,15,r16		   /* r16 = off[0..14] */
-	zdep	r16,15,15,r16		   /* r16 = tag[1..15] */
-	or	r16,r8,r16		   /* or in the space id */
-	depi	1,0,1,r16		   /* and set the valid bit */
-
-	mtctl	r16, tr6
-	mtctl	r24, tr5
+#if USECR28
+	mfctl	cr28, r24
+#else
+	HPTENT	/* will update cr28 */
+#endif
 	
 	/*
 	 * Chase the list of entries for this hash bucket until we find
 	 * the correct mapping or NULL.
 	 */
-	ldw	hpt_entry(r24),r24
+	ldw	hpt_entry(r24), r24
 $hash_loop_tlbd
-	comb,=	r0, r24, TLABEL(all)
-	mtsp	r25, sr1
-	ldw     pv_va(r24),r16
-	comb,<>,n r9,r16,$hash_loop_tlbd
-	ldw	pv_hash(r24),r24
-	ldw     pv_space(r24),r16
-	comb,<>,n r8,r16,$hash_loop_tlbd
-	ldw	pv_hash(r24),r24
-
-	/*
-	 * Set the dirty bit for this physical page.
-	 */
-	ldw	pv_tlbprot(r24), r16
+	comb,=,n r0, r24, TLABEL(all)
+	ldw     pv_va(r24), r25
+	ldw     pv_space(r24), r17
+	comb,<>,n r9, r25, $hash_loop_tlbd
+	ldw	pv_hash(r24), r24
+	comb,<>,n r8, r17, $hash_loop_tlbd
+	ldw	pv_hash(r24), r24
+
+#if ! USECR28
+	VTAG	/* (r8,r9) -> r16 */
+#endif
+	/* Set the dirty bit for this physical page. */
 	ldw	pv_tlbpage(r24), r17
-	depi	1,TLB_DIRTY_POS,1, r16
-
+	ldw	pv_tlbprot(r24), r25
 	b	$tlb_inshpt
-	stw	r16, pv_tlbprot(r24)
+	depi	1, TLB_DIRTY_POS, 1, r25
 	
-
+	.align	32
 	.export	TLABEL(itlb), code
 TLABEL(itlb)
 	mfctl	pcoq,r9		/* Offset */
-	b	$tlbmiss
 	mfctl	pcsq,r8		/* Space  */
+	depi    0,31,12,r9	/* Clear the byte offset into the page */
+
+#if USECR28
+	HPTENT	/* will update cr28 */
+#endif
+	b,n	$tlbmiss
 
+	.align	32
 	.export	TLABEL(dtlb), code
 TLABEL(dtlb)
 	mfctl	ior, r9		/* Offset */
 	mfctl	isr, r8		/* Space  */
+	depi    0,31,12,r9	/* Clear the byte offset into the page */
+
+#if USECR28
+	mfctl	cr28, r24
+#endif
 	/* FALL THROUGH */
 
 $tlbmiss
 	/* r1 is the trap type
 	 * r8 is the space of the address that had the TLB miss
 	 * r9 is the offset of the address that had the TLB miss
+	 * r24 is the correspondent HPT entry pointer
 	 */
 
-	mfsp	sr1, r25	/* Need a space reg, so save it in a shadow */
-	mtsp	r8, sr1		/* Put the space id where we can use it */
-
-	depi    0,31,12,r9	/* Clear the byte offset into the page */
-
-	HPTENT
-
-	/* Construct the virtual address tag. */
-	extru	r9,14,15,r16		   /* r16 = off[0..14] */
-	zdep	r16,15,15,r16		   /* r16 = tag[1..15] */
-	or	r16,r8,r16		   /* or in the space id */
-	depi	1,0,1,r16		   /* and set the valid bit */
+#if ! USECR28
+	HPTENT	/* will update cr28 */
+	
+	ldw	hpt_tag(r24),r17
+	VTAG	/* (r8,r9) -> r16 */
 
 	/* Compare the tag against the HPT entry.
 	   If it matches, then do the TLB insertion. */
-	ldw	hpt_tag(r24),r17
-	comb,=,n r16,r17,$tlb_gothpt
+	comb,<>,n r16, r17, $tlb_gottalook
 
-	/*
-	 * Okay, so we missed in the HPT cache. Stash away the HPT entry
-	 * pointer and the virtual tag for later ...
-	 *
-	 * Switch r24 to point to the corresponding VTOP table entry so
-	 * we can move onto chasing the hash chain.
-	 */
-	mtctl	r16, tr6
-	mtctl	r24, tr5
+	ldw	hpt_tlbpage(r24), r17
+	b	$tlb_gothpt
+	ldw	hpt_tlbprot(r24), r25
 
+$tlb_gottalook
+#endif
 	/*
 	 * Chase the list of entries for this hash bucket until we find
 	 * the correct mapping or NULL.
 	 */
 	ldw	hpt_entry(r24),r24
 $hash_loop
-	comb,=	r0, r24, TLABEL(all)
-	mtsp	r25, sr1
-	ldw     pv_va(r24),r16
-	comb,<>,n r9,r16,$hash_loop
+	comb,=,n r0, r24, TLABEL(all)
+	ldw     pv_va(r24),r25
+	ldw     pv_space(r24),r17
+	comb,<>,n r9,r25,$hash_loop
 	ldw	pv_hash(r24),r24
-	ldw     pv_space(r24),r16
-	comb,<>,n r8,r16,$hash_loop
+	comb,<>,n r8,r17,$hash_loop
 	ldw	pv_hash(r24),r24
 
 	/* Now set things up to enter the real mapping that we want */
-	ldw	pv_tlbprot(r24),r16
-	depi	1,TLB_REF_POS,1,r16
-	stw	r16, pv_tlbprot(r24)
 	ldw	pv_tlbpage(r24),r17
+	ldw	pv_tlbprot(r24),r25
+	depi	1, TLB_REF_POS, 1, r25
 
 	/*
 	 * Load the HPT cache with the miss information for the next time.
-	 * The HTP entry address and virtual tag were saved above in
-	 * control registers.
+	 * The HPT entry address was saved by the HPTENT
 	 */
 $tlb_inshpt
-	mfctl	tr6, r8
-	mfctl	tr5, r24
+	stw	r25, pv_tlbprot(r24)
+#if USECR28
+	VTAG	/* (r8,r9) -> r16 */
+#endif
+	mfctl	cr28, r24
 
-	stw	r16,hpt_tlbprot(r24)
-	stw	r17,hpt_tlbpage(r24)
-	b	$tlb_gothptld
-	stw	r8,hpt_tag(r24)
+	stw	r16, hpt_tag(r24)
+	stw	r25, hpt_tlbprot(r24)
+	stw	r17, hpt_tlbpage(r24)
 
 $tlb_gothpt
-	ldw	hpt_tlbpage(r24),r17
-	ldw	hpt_tlbprot(r24),r16
+	mfsp	sr1, r16
+	mtsp	r8, sr1
+	
+	comib,=,n T_ITLBMISS, r1, $itlb
 
-$tlb_gothptld
-	comib,=,n T_ITLBMISS,r1,$itlb
 	idtlba	r17,(sr1, r9)
 	b	$tlbret
-	idtlbp	r16,(sr1, r9)
+	idtlbp	r25,(sr1, r9)
 $itlb
 	iitlba	r17,(sr1, r9)
-	iitlbp	r16,(sr1, r9)
+	iitlbp	r25,(sr1, r9)
 
 	/* And return ... */
 $tlbret
-	mtsp	r25, sr1
+	mtsp	r16, sr1
 	rfir
-	mfctl	tr7, r1
+	nop
+$tlb_missend
 
 	.export	TLABEL(ibreak), code
 TLABEL(ibreak)
@@ -1031,7 +1028,7 @@ TLABEL(all)
 	 *	trap number in r1 (old r1 is saved in tr7)
 	 */
 
-	mtctl	sp, tr4
+	mtctl	sp, tr3	/* do not overwrite cr28 */
 	mtctl	t1, tr5
 	mtctl	t2, tr6
 
@@ -1064,7 +1061,7 @@ $trap_trap
 	copy	r1, arg0
 	mfctl	tr7, r1
 
-	mfctl	tr4,t1
+	mfctl	tr3,t1
 	stw	t1,TF_R30(t2)
 
 	mfctl	tr5,t1
@@ -1285,6 +1282,9 @@ $trapnowvirt
 
 	mfctl	vtop, t1
 	stw	t1, TF_CR25(t2)
+
+	mfctl	cr28, t1
+	stw	t1, TF_CR28(t2)
 #endif
 
 	/*
diff --git a/sys/arch/hppa/hppa/machdep.c b/sys/arch/hppa/hppa/machdep.c
index 530a939cedf..37253f2b5f3 100644
--- a/sys/arch/hppa/hppa/machdep.c
+++ b/sys/arch/hppa/hppa/machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: machdep.c,v 1.10 1999/07/12 18:16:46 mickey Exp $	*/
+/*	$OpenBSD: machdep.c,v 1.11 1999/07/21 07:37:20 mickey Exp $	*/
 
 /*
  * Copyright (c) 1998,1999 Michael Shalayeff
@@ -79,6 +79,8 @@
  * 	Utah $Hdr: model_dep.c 1.34 94/12/14$
  */
 
+#undef	BTLBDEBUG
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/signalvar.h>
@@ -220,6 +222,7 @@ int bus_mem_add_mapping __P((bus_addr_t bpa, bus_size_t size, int cacheable,
 /* wide used hardware params */
 struct pdc_hwtlb pdc_hwtlb PDC_ALIGNMENT;
 struct pdc_coproc pdc_coproc PDC_ALIGNMENT;
+struct pdc_coherence pdc_coherence PDC_ALIGNMENT;
 
 void
 hppa_init(start)
@@ -253,6 +256,18 @@ hppa_init(start)
 	icache_stride = pdc_cache.ic_stride;
 
 	/*
+	 * get cache coherence parameters
+	 */
+	pdcerr = pdc_call((iodcio_t)pdc, 0, PDC_CACHE, PDC_CACHE_SETCS,
+			  &pdc_coherence, 1, 1, 1, 1);
+#ifdef DEBUG
+	printf ("PDC_CACHE_SETCS: %d, %d, %d, %d (%d)\n",
+		pdc_coherence.ia_cst, pdc_coherence.da_cst,
+		pdc_coherence.ita_cst, pdc_coherence.dta_cst,
+		pdcerr);
+#endif
+
+	/*
 	 * Fetch BTLB params
 	 */
 	if ((pdcerr = pdc_call((iodcio_t)pdc, 0, PDC_BLOCK_TLB,
@@ -306,8 +321,8 @@ hppa_init(start)
 	}
 
 	/* calculate HPT size */
-	hpt_hashsize = totalphysmem;
-	mtctl(hpt_hashsize - 1, CR_HPTMASK);
+	for (usehpt = 1; usehpt < totalphysmem; usehpt *= 2);
+	mtctl(usehpt - 1, CR_HPTMASK);
 
 	/*
 	 * If we want to use the HW TLB support, ensure that it exists.
@@ -317,19 +332,18 @@ hppa_init(start)
 		printf("WARNING: no HW tlb walker\n");
 		usehpt = 0;
 	} else {
-		usehpt = 1;
 #ifdef PMAPDEBUG
 		printf("hwtlb: %u-%u, %u/",
-		       pdc_hwtlb.min_size, pdc_hwtlb.max_size, hpt_hashsize);
+		       pdc_hwtlb.min_size, pdc_hwtlb.max_size, usehpt);
 #endif
-		if (hpt_hashsize > pdc_hwtlb.max_size)
-			hpt_hashsize = pdc_hwtlb.max_size;
-		else if (hpt_hashsize < pdc_hwtlb.min_size)
-			hpt_hashsize = pdc_hwtlb.min_size;
+		if (usehpt > pdc_hwtlb.max_size)
+			usehpt = pdc_hwtlb.max_size;
+		else if (usehpt < pdc_hwtlb.min_size)
+			usehpt = pdc_hwtlb.min_size;
 #ifdef PMAPDEBUG
-		printf("%u (0x%x)\n", hpt_hashsize,
-		       hpt_hashsize * sizeof(struct hpt_entry));
+		printf("%u\n", usehpt);
 #endif
+		mtctl(usehpt - 1, CR_HPTMASK);
 	}
 	
 	vstart = hppa_round_page(start);
@@ -387,16 +401,18 @@ hppa_init(start)
 #endif
 	/* Turn on the HW TLB assist */
 	if (usehpt) {
+		int hpt, hptsize;
+		mfctl(CR_VTOP, hpt);
+		mfctl(CR_HPTMASK, hptsize);
+		hptsize++;
 		if ((pdcerr = pdc_call((iodcio_t)pdc, 0, PDC_TLB,
-				       PDC_TLB_CONFIG, &pdc_hwtlb, hpt_table,
-				       sizeof(struct hpt_entry) * hpt_hashsize,
-				       PDC_TLB_WORD3)) < 0) {
+				       PDC_TLB_CONFIG, &pdc_hwtlb, hpt,
+				       hptsize, PDC_TLB_CURRPDE)) < 0) {
 			printf("Warning: HW TLB init failed (%d), disabled\n",
 			       pdcerr);
-			usehpt = 0;
 		} else
 			printf("HW TLB(%d entries at 0x%x) initialized (%d)\n",
-			       hpt_hashsize, hpt_table, pdcerr);
+			       hptsize / sizeof(struct hpt_entry), hpt, pdcerr);
 	}
 
         /*
@@ -906,7 +922,7 @@ bus_mem_add_mapping(bpa, size, cacheable, bshp)
 					    	pmap_prot(kernel_pmap,
 							  VM_PROT_ALL)) < 0)
 					return -1;
-				pa = spa += len - 1;
+				pa = spa + len - 1;
 #ifdef BTLBDEBUG
 				printf ("------ %d/%d, %qx, %qx-%qx",
 					flex, HPPA_FLEX(pa), pa, spa, epa);
@@ -918,6 +934,7 @@ bus_mem_add_mapping(bpa, size, cacheable, bshp)
 #endif
 					bmm[flex / 8] |= (1 << (flex & 3));
 				}
+				spa = pa;
 			}
 #ifdef BTLBDEBUG
 			printf ("\n");
diff --git a/sys/arch/hppa/hppa/pmap.c b/sys/arch/hppa/hppa/pmap.c
index adcc98b5e3a..7e068a29224 100644
--- a/sys/arch/hppa/hppa/pmap.c
+++ b/sys/arch/hppa/hppa/pmap.c
@@ -1,7 +1,7 @@
-/*	$OpenBSD: pmap.c,v 1.16 1999/06/30 18:59:06 mickey Exp $	*/
+/*	$OpenBSD: pmap.c,v 1.17 1999/07/21 07:37:20 mickey Exp $	*/
 
 /*
- * Copyright (c) 1998 Michael Shalayeff
+ * Copyright (c) 1998,1999 Michael Shalayeff
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -119,6 +119,12 @@
  *		improvement may be achieved should we use smth else
  *	protection id (pid) allocation should be done in a pid_t fashion
  */
+/*
+ * References:
+ * 1. PA7100LC ERS, Hewlett-Packard, March 30 1999, Public version 1.0
+ * 2. PA7300LC ERS, Hewlett-Packard, March 18 1996, Version 1.0
+ *
+ */
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -160,7 +166,7 @@ int pmapdebug = 0
 	| PDB_FOLLOW
 /*	| PDB_VA */
 /*	| PDB_PV */
-/* 	| PDB_INIT */
+/*	| PDB_INIT */
 /*	| PDB_ENTER */
 /*	| PDB_REMOVE */
 /*	| PDB_STEAL */
@@ -175,13 +181,6 @@ struct pmap	kernel_pmap_store;
 pmap_t		kernel_pmap;
 boolean_t	pmap_initialized = FALSE;
 
-/*
- * Hashed (Hardware) Page Table, for use as a software cache, or as a
- * hardware accessible cache on machines with hardware TLB walkers.
- */
-struct hpt_entry *hpt_table;
-u_int hpt_hashsize;
-
 TAILQ_HEAD(, pmap)	pmap_freelist;	/* list of free pmaps */
 u_int pmap_nfree;
 struct simplelock pmap_freelock;	/* and lock */
@@ -219,13 +218,33 @@ u_int	kern_prot[8], user_prot[8];
 #define	pmap_sid(pmap, va) \
 	(((va & 0xc0000000) != 0xc0000000)? pmap->pmap_space : HPPA_SID_KERNEL)
 
+/*
+ * This hash function is the one used by the hardware TLB walker on the 7100LC.
+ */
+static __inline__ struct hpt_entry *
+pmap_hash(pa_space_t sp, vaddr_t va)
+{
+	register struct hpt_entry *hpt;
+	__asm __volatile (
+		"extru	%2, 23, 20, %%r22\n\t"	/* r22 = (va >> 8) */
+		"zdep	%1, 26, 16, %%r23\n\t"	/* r23 = (sp << 5) */
+		"dep	%%r0, 31, 4, %%r22\n\t"	/* r22 &= ~0xf */
+		"xor	%%r22,%%r23, %%r23\n\t"	/* r23 ^= r22 */
+		"mfctl	%%cr24, %%r22\n\t"	/* r22 = sizeof(HPT)-1 */
+		"and	%%r22,%%r23, %%r23\n\t"	/* r23 &= r22 */
+		"mfctl	%%cr25, %%r22\n\t"	/* r22 = addr of HPT table */
+		"or	%%r23, %%r22, %0"	/* %0 = HPT entry */
+		: "=r" (hpt) : "r" (sp), "r" (va) : "r22", "r23");
+	return hpt;
+}
+
 static __inline void
 pmap_enter_va(space, va, pv)
 	pa_space_t space;
 	vaddr_t va;
 	struct pv_entry *pv;
 {
-	register struct hpt_entry *hpt = &hpt_table[pmap_hash(space, va)];
+	register struct hpt_entry *hpt = pmap_hash(space, va);
 #if defined(PMAPDEBUG) || defined(DIAGNOSTIC)
 	register struct pv_entry *pvp =	hpt->hpt_entry;
 #endif
@@ -251,8 +270,7 @@ pmap_find_va(space, va)
 	pa_space_t space;
 	vaddr_t va;
 {
-	register struct pv_entry *pvp =
-		hpt_table[pmap_hash(space, va)].hpt_entry;
+	register struct pv_entry *pvp =	pmap_hash(space, va)->hpt_entry;
 
 #ifdef PMAPDEBUG
 	if (pmapdebug & PDB_FOLLOW && pmapdebug & PDB_VA)
@@ -269,8 +287,7 @@ static __inline void
 pmap_remove_va(pv)
 	struct pv_entry *pv;
 {
-	register struct hpt_entry *hpt =
-		&hpt_table[pmap_hash(pv->pv_space, pv->pv_va)];
+	register struct hpt_entry *hpt = pmap_hash(pv->pv_space, pv->pv_va);
 	register struct pv_entry **pvp = (struct pv_entry **)&hpt->hpt_entry;
 
 #ifdef PMAPDEBUG
@@ -305,10 +322,10 @@ pmap_clear_va(space, va)
 	pa_space_t space;
 	vaddr_t va;
 {
-	register int hash = pmap_hash(space, va);
+	register struct hpt_entry *hpt = pmap_hash(space, va);
 
-	hpt_table[hash].hpt_valid = 0;
-	hpt_table[hash].hpt_space = -1;
+	hpt->hpt_valid = 0;
+	hpt->hpt_space = -1;
 }
 
 static __inline void
@@ -630,6 +647,7 @@ pmap_bootstrap(vstart, vend)
 	vaddr_t addr;
 	vm_size_t size;
 	struct pv_page *pvp;
+	struct hpt_entry *hptp;
 	int i;
 #ifdef PMAPDEBUG
 	if (pmapdebug & PDB_FOLLOW)
@@ -679,39 +697,39 @@ pmap_bootstrap(vstart, vend)
 	/*
 	 * Allocate various tables and structures.
 	 */
-	addr = *vstart;
+	addr = hppa_round_page(*vstart);
 	virtual_end = *vend;
-	pvp = (struct pv_page *)cache_align(addr);
+	pvp = (struct pv_page *)addr;
 
-	size = sizeof(struct hpt_entry) * hpt_hashsize;
-	addr = (addr + size-1) & ~(size-1); /* !!! hpt_hashsize is 2^n */
-	TAILQ_INIT(&pv_page_freelist);
+	mfctl(CR_HPTMASK, size);
+	addr = (addr + size) & ~(size);
 #ifdef PMAPDEBUG
 	if (pmapdebug & PDB_INIT)
 		printf("pmap_bootstrap: allocating %d pv_pages\n",
 		       (struct pv_page *)addr - pvp);
 #endif
+	TAILQ_INIT(&pv_page_freelist);
 	for (; pvp + 1 <= (struct pv_page *)addr; pvp++)
 		pmap_insert_pvp(pvp, 1);
 
 	/* Allocate the HPT */
-	hpt_table = (struct hpt_entry *) addr;
-	for (i = 0; i < hpt_hashsize; i++) {
-		hpt_table[i].hpt_valid   = 0;
-		hpt_table[i].hpt_vpn     = 0;
-		hpt_table[i].hpt_space   = -1;
-		hpt_table[i].hpt_tlbpage = 0;
-		hpt_table[i].hpt_tlbprot = 0;
-		hpt_table[i].hpt_entry   = NULL;
+	for (hptp = (struct hpt_entry *)addr;
+	     ((u_int)hptp - addr) <= size; hptp++) {
+		hptp->hpt_valid   = 0;
+		hptp->hpt_vpn     = 0;
+		hptp->hpt_space   = -1;
+		hptp->hpt_tlbpage = 0;
+		hptp->hpt_tlbprot = 0;
+		hptp->hpt_entry   = NULL;
 	}
 #ifdef PMAPDEBUG
 	if (pmapdebug & PDB_INIT)
-		printf("hpt_table: 0x%x @ %p\n", size, addr);
+		printf("hpt_table: 0x%x @ %p\n", size + 1, addr);
 #endif
-	addr += size;
 	/* load cr25 with the address of the HPT table
 	   NB: It sez CR_VTOP, but we (and the TLB handlers) know better ... */
-	mtctl(hpt_table, CR_VTOP);
+	mtctl(addr, CR_VTOP);
+	addr += size + 1;
 
 	/*
 	 * we know that btlb_insert() will round it up to the next
@@ -1558,20 +1576,24 @@ kvtop(va)
 void
 pmap_hptdump()
 {
-	register struct hpt_entry *hpt;
+	register struct hpt_entry *hpt, *ehpt;
 	register struct pv_entry *pv;
 
-	printf("HPT dump\n");
-	for (hpt = hpt_table; hpt < &hpt_table[hpt_hashsize]; hpt++)
+	mfctl(CR_HPTMASK, ehpt);
+	mfctl(CR_VTOP, hpt);
+	ehpt = (struct hpt_entry *)((int)hpt + (int)ehpt + 1);
+	printf("HPT dump %p-%p:\n", hpt, ehpt);
+	for (; hpt < ehpt; hpt++)
 		if (hpt->hpt_valid || hpt->hpt_entry) {
 			printf("hpt@%p: %x{%svalid,v=%x:%x}, prot=%x, pa=%x\n",
 			       hpt, *(u_int *)hpt, (hpt->hpt_valid?"":"in"),
 			       hpt->hpt_space, hpt->hpt_vpn,
 			       hpt->hpt_tlbprot, hpt->hpt_tlbpage);
 			for (pv = hpt->hpt_entry; pv; pv = pv->pv_hash)
-				printf("    pv={%p,%x:%x,%x,%x}\n",
+				printf("    pv={%p,%x:%x,%x,%x}->%p\n",
 				       pv->pv_pmap, pv->pv_space, pv->pv_va,
-				       pv->pv_tlbprot, pv->pv_tlbpage);
+				       pv->pv_tlbprot, pv->pv_tlbpage,
+				       pv->pv_hash);
 		}
 }
 #endif