 @@ -1,14 +1,14 @@
-/*	$NetBSD: pmap.c,v 1.211.2.16 2010/10/30 08:41:06 uebayasi Exp $	*/
+/*	$NetBSD: pmap.c,v 1.211.2.17 2010/10/31 03:43:02 uebayasi Exp $	*/
 /*
  * Copyright 2003 Wasabi Systems, Inc.
  * All rights reserved.
+ *
  * Written by Steve C. Woodford for Wasabi Systems, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -202,27 +202,27 @@
 #include <sys/pool.h>
 #include <sys/cdefs.h>
 #include <sys/cpu.h>
 #include <sys/sysctl.h>
 #include <uvm/uvm.h>
 #include <machine/bus.h>
 #include <machine/pmap.h>
 #include <machine/pcb.h>
 #include <machine/param.h>
 #include <arm/arm32/katelib.h>
-__KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.211.2.16 2010/10/30 08:41:06 uebayasi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.211.2.17 2010/10/31 03:43:02 uebayasi Exp $");
 #ifdef PMAP_DEBUG
 /* XXX need to get rid of all refs to this */
 int pmap_debug_level = 0;
 /*
  * for switching to potentially finer grained debugging
  */
 #define	PDB_FOLLOW	0x0001
 #define	PDB_INIT	0x0002
 #define	PDB_ENTER	0x0004
 #define	PDB_REMOVE	0x0008
 @@ -653,40 +653,40 @@ static void		pmap_use_l1(pmap_t);
 static struct l2_bucket *pmap_get_l2_bucket(pmap_t, vaddr_t);
 static struct l2_bucket *pmap_alloc_l2_bucket(pmap_t, vaddr_t);
 static void		pmap_free_l2_bucket(pmap_t, struct l2_bucket *, u_int);
 static int		pmap_l2ptp_ctor(void *, void *, int);
 static int		pmap_l2dtable_ctor(void *, void *, int);
 static void		pmap_vac_me_harder(struct vm_page_md *, paddr_t, pmap_t, vaddr_t);
 #ifdef PMAP_CACHE_VIVT
 static void		pmap_vac_me_kpmap(struct vm_page_md *, paddr_t, pmap_t, vaddr_t);
 static void		pmap_vac_me_user(struct vm_page_md *, paddr_t, pmap_t, vaddr_t);
 #endif
-static void		pmap_clearbit(struct vm_page *, u_int);
+static void		pmap_clearbit(struct vm_page_md *, paddr_t, u_int);
 #ifdef PMAP_CACHE_VIVT
 static int		pmap_clean_page(struct pv_entry *, bool);
 #endif
 #ifdef PMAP_CACHE_VIPT
 static void		pmap_syncicache_page(struct vm_page_md *, paddr_t);
 enum pmap_flush_op {
 	PMAP_FLUSH_PRIMARY,
 	PMAP_FLUSH_SECONDARY,
 	PMAP_CLEAN_PRIMARY
 };
 static void		pmap_flush_page(struct vm_page_md *, paddr_t, enum pmap_flush_op);
 #endif
-static void		pmap_page_remove(struct vm_page *);
+static void		pmap_page_remove(struct vm_page_md *, paddr_t);
 static void		pmap_init_l1(struct l1_ttable *, pd_entry_t *);
 static vaddr_t		kernel_pt_lookup(paddr_t);
 /*
  * External function prototypes
  */
 extern void bzero_page(vaddr_t);
 extern void bcopy_page(vaddr_t, vaddr_t);
 /*
  * Misc variables
 @@ -964,27 +964,27 @@ static struct pv_entry *
 pmap_remove_pv(struct vm_page_md *md, paddr_t pa, pmap_t pm, vaddr_t va)
+{
 	struct pv_entry *pv, **prevptr;
 	NPDEBUG(PDB_PVDUMP,
 	    printf("pmap_remove_pv: pm %p, md %p, va 0x%08lx\n", pm, md, va));
 	prevptr = &SLIST_FIRST(&md->pvh_list); /* prev pv_entry ptr */
 	pv = *prevptr;
 	while (pv) {
 		if (pv->pv_pmap == pm && pv->pv_va == va) {	/* match? */
 			NPDEBUG(PDB_PVDUMP, printf("pmap_remove_pv: pm %p, md "
-			    "%p\n", pm, md));
+			    "%p, flags 0x%x\n", pm, md, pv->pv_flags));
 			if (pv->pv_flags & PVF_WIRED) {
 				--pm->pm_stats.wired_count;
+			}
 			*prevptr = SLIST_NEXT(pv, pv_link);	/* remove it! */
 			if (pm == pmap_kernel()) {
 				PMAPCOUNT(kernel_unmappings);
 				if (pv->pv_flags & PVF_WRITE)
 					md->krw_mappings--;
 				else
 					md->kro_mappings--;
 			} else {
 				if (pv->pv_flags & PVF_WRITE)
 					md->urw_mappings--;
 @@ -2111,45 +2111,44 @@ pmap_vac_me_harder(struct vm_page_md *md
 		*ptep = pte;
 		PTE_SYNC_CURRENT(pv->pv_pmap, ptep);
+	}
+}
 #endif	/* PMAP_CACHE_VIPT */
 /*
  * Modify pte bits for all ptes corresponding to the given physical address.
  * We use `maskbits' rather than `clearbits' because we're always passing
  * constants and the latter would require an extra inversion at run-time.
  */
 static void
-pmap_clearbit(struct vm_page *pg, u_int maskbits)
+pmap_clearbit(struct vm_page_md *md, paddr_t pa, u_int maskbits)
+{
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	struct l2_bucket *l2b;
 	struct pv_entry *pv;
 	pt_entry_t *ptep, npte, opte;
 	pmap_t pm;
 	vaddr_t va;
 	u_int oflags;
 #ifdef PMAP_CACHE_VIPT
 	const bool want_syncicache = PV_IS_EXEC_P(md->pvh_attrs);
 	bool need_syncicache = false;
 	bool did_syncicache = false;
 	bool need_vac_me_harder = false;
 #endif
 	NPDEBUG(PDB_BITS,
-	    printf("pmap_clearbit: pg %p (0x%08lx) mask 0x%x\n",
+	    printf("pmap_clearbit: md %p mask 0x%x\n",
-	    pg, VM_PAGE_TO_PHYS(pg), maskbits));
+	    md, maskbits));
 	PMAP_HEAD_TO_MAP_LOCK();
 	simple_lock(&md->pvh_slock);
 #ifdef PMAP_CACHE_VIPT
 	/*
 	 * If we might want to sync the I-cache and we've modified it,
 	 * then we know we definitely need to sync or discard it.
 	 */
 	if (want_syncicache)
 		need_syncicache = md->pvh_attrs & PVF_MOD;
 #endif
 	/*
 @@ -2307,37 +2306,37 @@ pmap_clearbit(struct vm_page *pg, u_int
 		pmap_release_pmap_lock(pm);
 		NPDEBUG(PDB_BITS,
 		    printf("pmap_clearbit: pm %p va 0x%lx opte 0x%08x npte 0x%08x\n",
 		    pm, va, opte, npte));
+	}
 #ifdef PMAP_CACHE_VIPT
 	/*
 	 * If we need to sync the I-cache and we haven't done it yet, do it.
 	 */
 	if (need_syncicache && !did_syncicache) {
-		pmap_syncicache_page(md, VM_PAGE_TO_PHYS(pg));
+		pmap_syncicache_page(md, pa);
 		PMAPCOUNT(exec_synced_clearbit);
+	}
 	/*
 	 * If we are changing this to read-only, we need to call vac_me_harder
 	 * so we can change all the read-only pages to cacheable.  We pretend
 	 * this as a page deletion.
 	 */
 	if (need_vac_me_harder) {
 		if (md->pvh_attrs & PVF_NC)
-			pmap_vac_me_harder(md, VM_PAGE_TO_PHYS(pg), NULL, 0);
+			pmap_vac_me_harder(md, pa, NULL, 0);
+	}
 #endif
 	simple_unlock(&md->pvh_slock);
 	PMAP_HEAD_TO_MAP_UNLOCK();
+}
 /*
  * pmap_clean_page()
+ *
  * This is a local function used to work out the best strategy to clean
  * a single page referenced by its entry in the PV table. It's used by
  * pmap_copy_page, pmap_zero page and maybe some others later on.
 @@ -2557,39 +2556,37 @@ pmap_flush_page(struct vm_page_md *md, p
 		pmap_tlb_flushID_SE(pmap_kernel(), cdstp + va_offset);
+	}
+}
 #endif /* PMAP_CACHE_VIPT */
 /*
  * Routine:	pmap_page_remove
  * Function:
  *		Removes this physical page from
  *		all physical maps in which it resides.
  *		Reflects back modify bits to the pager.
  */
 static void
-pmap_page_remove(struct vm_page *pg)
+pmap_page_remove(struct vm_page_md *md, paddr_t pa)
+{
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
 	struct l2_bucket *l2b;
 	struct pv_entry *pv, *npv, **pvp;
 	pmap_t pm;
 	pt_entry_t *ptep;
 	bool flush;
 	u_int flags;
 	NPDEBUG(PDB_FOLLOW,
-	    printf("pmap_page_remove: pg %p (0x%08lx)\n", pg,
+	    printf("pmap_page_remove: md %p (0x%08lx)\n", md,
 	    pa));
 	PMAP_HEAD_TO_MAP_LOCK();
 	simple_lock(&md->pvh_slock);
 	pv = SLIST_FIRST(&md->pvh_list);
 	if (pv == NULL) {
 #ifdef PMAP_CACHE_VIPT
 		/*
 		 * We *know* the page contents are about to be replaced.
 		 * Discard the exec contents
 		 */
 		if (PV_IS_EXEC_P(md->pvh_attrs))
 @@ -2886,29 +2883,27 @@ pmap_enter(pmap_t pm, vaddr_t va, paddr_
 			if (pm->pm_cstate.cs_cache_d &&
 			    (oflags & PVF_NC) == 0 &&
 			    l2pte_writable_p(opte) &&
 			    (prot & VM_PROT_WRITE) == 0)
 				cpu_dcache_wb_range(va, PAGE_SIZE);
 #endif
 		} else {
 			/*
 			 * New mapping, or changing the backing page
 			 * of an existing mapping.
 			 */
 			if (opg) {
 				struct vm_page_md *omd = VM_PAGE_TO_MD(opg);
-				paddr_t opa;
+				paddr_t opa = VM_PAGE_TO_PHYS(opg);
 				opa = VM_PAGE_TO_PHYS(opg);
 				/*
 				 * Replacing an existing mapping with a new one.
 				 * It is part of our managed memory so we
 				 * must remove it from the PV list
 				 */
 				simple_lock(&omd->pvh_slock);
 				pv = pmap_remove_pv(omd, opa, pm, va);
 				pmap_vac_me_harder(omd, opa, pm, 0);
 				simple_unlock(&omd->pvh_slock);
 				oflags = pv->pv_flags;
 #ifdef PMAP_CACHE_VIVT
 @@ -2935,53 +2930,55 @@ pmap_enter(pmap_t pm, vaddr_t va, paddr_
 			if ((pv = pool_get(&pmap_pv_pool, PR_NOWAIT)) == NULL){
 				if ((flags & PMAP_CANFAIL) == 0)
 					panic("pmap_enter: no pv entries");
 				if (pm != pmap_kernel())
 					pmap_free_l2_bucket(pm, l2b, 0);
 				pmap_release_pmap_lock(pm);
 				PMAP_MAP_TO_HEAD_UNLOCK();
 				NPDEBUG(PDB_ENTER,
 				    printf("pmap_enter: ENOMEM\n"));
 				return (ENOMEM);
+			}
-			pmap_enter_pv(md, VM_PAGE_TO_PHYS(pg), pv, pm, va, nflags);
+			pmap_enter_pv(md, pa, pv, pm, va, nflags);
+		}
 	} else {
 		/*
 		 * We're mapping an unmanaged page.
 		 * These are always readable, and possibly writable, from
 		 * the get go as we don't need to track ref/mod status.
 		 */
 		npte |= l2pte_set_readonly(L2_S_PROTO);
 		if (prot & VM_PROT_WRITE)
 			npte = l2pte_set_writable(npte);
 		/*
 		 * Make sure the vector table is mapped cacheable
 		 */
 		if (pm != pmap_kernel() && va == vector_page)
 			npte |= pte_l2_s_cache_mode;
 		if (opg) {
 			/*
 			 * Looks like there's an existing 'managed' mapping
 			 * at this address.
 			 */
 			struct vm_page_md *omd = VM_PAGE_TO_MD(opg);
 			paddr_t opa = VM_PAGE_TO_PHYS(opg);
 			simple_lock(&omd->pvh_slock);
-			pv = pmap_remove_pv(omd, VM_PAGE_TO_PHYS(opg), pm, va);
+			pv = pmap_remove_pv(omd, opa, pm, va);
-			pmap_vac_me_harder(omd, VM_PAGE_TO_PHYS(opg), pm, 0);
+			pmap_vac_me_harder(omd, opa, pm, 0);
 			simple_unlock(&omd->pvh_slock);
 			oflags = pv->pv_flags;
 #ifdef PMAP_CACHE_VIVT
 			if ((oflags & PVF_NC) == 0 && l2pte_valid(opte)) {
 				if (PV_BEEN_EXECD(oflags))
 					pmap_idcache_wbinv_range(pm, va,
 					    PAGE_SIZE);
 				else
 				if (PV_BEEN_REFD(oflags))
 					pmap_dcache_wb_range(pm, va, PAGE_SIZE,
 					    true, (oflags & PVF_WRITE) == 0);
+			}
 @@ -3042,34 +3039,36 @@ pmap_enter(pmap_t pm, vaddr_t va, paddr_
 		if (PV_BEEN_EXECD(oflags))
 			pmap_tlb_flushID_SE(pm, va);
 		else
 		if (PV_BEEN_REFD(oflags))
 			pmap_tlb_flushD_SE(pm, va);
 		NPDEBUG(PDB_ENTER,
 		    printf("pmap_enter: is_cached %d cs 0x%08x\n",
 		    is_cached, pm->pm_cstate.cs_all));
 		if (pg != NULL) {
 			struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 			simple_lock(&md->pvh_slock);
-			pmap_vac_me_harder(md, VM_PAGE_TO_PHYS(pg), pm, va);
+			pmap_vac_me_harder(md, pa, pm, va);
 			simple_unlock(&md->pvh_slock);
+		}
+	}
 #if defined(PMAP_CACHE_VIPT) && defined(DIAGNOSTIC)
 	if (pg) {
 		struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 		simple_lock(&md->pvh_slock);
 		KASSERT((md->pvh_attrs & PVF_DMOD) == 0 || (md->pvh_attrs & (PVF_DIRTY|PVF_NC)));
 		KASSERT(((md->pvh_attrs & PVF_WRITE) == 0) == (md->urw_mappings + md->krw_mappings == 0));
 		simple_unlock(&md->pvh_slock);
+	}
 #endif
 	pmap_release_pmap_lock(pm);
 	PMAP_MAP_TO_HEAD_UNLOCK();
 	return (0);
+}
 @@ -3156,29 +3155,30 @@ pmap_remove(pmap_t pm, vaddr_t sva, vadd
 			pa = l2pte_pa(pte);
 			is_exec = 0;
 			is_refd = 1;
 			/*
 			 * Update flags. In a number of circumstances,
 			 * we could cluster a lot of these and do a
 			 * number of sequential pages in one go.
 			 */
 			if ((pg = PHYS_TO_VM_PAGE(pa)) != NULL) {
 				struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 				struct pv_entry *pv;
 				simple_lock(&md->pvh_slock);
-				pv = pmap_remove_pv(md, VM_PAGE_TO_PHYS(pg), pm, sva);
+				pv = pmap_remove_pv(md, pa, pm, sva);
-				pmap_vac_me_harder(md, VM_PAGE_TO_PHYS(pg), pm, 0);
+				pmap_vac_me_harder(md, pa, pm, 0);
 				simple_unlock(&md->pvh_slock);
 				if (pv != NULL) {
 					if (pm->pm_remove_all == false) {
 						is_exec =
 						   PV_BEEN_EXECD(pv->pv_flags);
 						is_refd =
 						   PV_BEEN_REFD(pv->pv_flags);
+					}
 					pool_put(&pmap_pv_pool, pv);
+				}
+			}
 			mappings++;
 @@ -3280,52 +3280,53 @@ pmap_remove(pmap_t pm, vaddr_t sva, vadd
 		pmap_free_l2_bucket(pm, l2b, mappings);
 		pm->pm_stats.resident_count -= mappings;
+	}
 	pmap_release_pmap_lock(pm);
 	PMAP_MAP_TO_HEAD_UNLOCK();
+}
 #ifdef PMAP_CACHE_VIPT
 static struct pv_entry *
 pmap_kremove_pg(struct vm_page *pg, vaddr_t va)
+{
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
 	struct pv_entry *pv;
 	simple_lock(&md->pvh_slock);
 	KASSERT(arm_cache_prefer_mask == 0 || md->pvh_attrs & (PVF_COLORED|PVF_NC));
 	KASSERT((md->pvh_attrs & PVF_KMPAGE) == 0);
-	pv = pmap_remove_pv(md, VM_PAGE_TO_PHYS(pg), pmap_kernel(), va);
+	pv = pmap_remove_pv(md, pa, pmap_kernel(), va);
 	KASSERT(pv);
 	KASSERT(pv->pv_flags & PVF_KENTRY);
 	/*
 	 * If we are removing a writeable mapping to a cached exec page,
 	 * if it's the last mapping then clear it execness other sync
 	 * the page to the icache.
 	 */
 	if ((md->pvh_attrs & (PVF_NC|PVF_EXEC)) == PVF_EXEC
 	    && (pv->pv_flags & PVF_WRITE) != 0) {
 		if (SLIST_EMPTY(&md->pvh_list)) {
 			md->pvh_attrs &= ~PVF_EXEC;
 			PMAPCOUNT(exec_discarded_kremove);
 		} else {
-			pmap_syncicache_page(md, VM_PAGE_TO_PHYS(pg));
+			pmap_syncicache_page(md, pa);
 			PMAPCOUNT(exec_synced_kremove);
+		}
+	}
-	pmap_vac_me_harder(md, VM_PAGE_TO_PHYS(pg), pmap_kernel(), 0);
+	pmap_vac_me_harder(md, pa, pmap_kernel(), 0);
 	simple_unlock(&md->pvh_slock);
 	return pv;
+}
 #endif /* PMAP_CACHE_VIPT */
 /*
  * pmap_kenter_pa: enter an unmanaged, wired kernel mapping
+ *
  * We assume there is already sufficient KVM space available
  * to do this, as we can't allocate L2 descriptor tables/metadata
  * from here.
  */
 @@ -3335,28 +3336,28 @@ pmap_kenter_pa(vaddr_t va, paddr_t pa, v
 	struct l2_bucket *l2b;
 	pt_entry_t *ptep, opte;
 #ifdef PMAP_CACHE_VIVT
 	struct vm_page *pg = (flags & PMAP_KMPAGE) ? PHYS_TO_VM_PAGE(pa) : NULL;
 #endif
 #ifdef PMAP_CACHE_VIPT
 	struct vm_page *pg = PHYS_TO_VM_PAGE(pa);
 	struct vm_page *opg;
 	struct pv_entry *pv = NULL;
 #endif
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	NPDEBUG(PDB_KENTER,
-	    printf("pmap_kenter_pa: va 0x%08lx, pa 0x%08lx, prot 0x%x pg %p md %p\n",
+	    printf("pmap_kenter_pa: va 0x%08lx, pa 0x%08lx, prot 0x%x\n",
-	    va, pa, prot, pg, md));
+	    va, pa, prot));
 	l2b = pmap_get_l2_bucket(pmap_kernel(), va);
 	KDASSERT(l2b != NULL);
 	ptep = &l2b->l2b_kva[l2pte_index(va)];
 	opte = *ptep;
 	if (opte == 0) {
 		PMAPCOUNT(kenter_mappings);
 		l2b->l2b_occupancy++;
 	} else {
 		PMAPCOUNT(kenter_remappings);
 #ifdef PMAP_CACHE_VIPT
 @@ -3389,60 +3390,60 @@ pmap_kenter_pa(vaddr_t va, paddr_t pa, v
 			simple_lock(&md->pvh_slock);
 			KASSERT(md->urw_mappings == 0);
 			KASSERT(md->uro_mappings == 0);
 			KASSERT(md->krw_mappings == 0);
 			KASSERT(md->kro_mappings == 0);
 #ifdef PMAP_CACHE_VIPT
 			KASSERT(pv == NULL);
 			KASSERT(arm_cache_prefer_mask == 0 || (va & PVF_COLORED) == 0);
 			KASSERT((md->pvh_attrs & PVF_NC) == 0);
 			/* if there is a color conflict, evict from cache. */
 			if (pmap_is_page_colored_p(md)
 			    && ((va ^ md->pvh_attrs) & arm_cache_prefer_mask)) {
 				PMAPCOUNT(vac_color_change);
-				pmap_flush_page(md, VM_PAGE_TO_PHYS(pg), PMAP_FLUSH_PRIMARY);
+				pmap_flush_page(md, pa, PMAP_FLUSH_PRIMARY);
 			} else if (md->pvh_attrs & PVF_MULTCLR) {
 				/*
 				 * If this page has multiple colors, expunge
 				 * them.
 				 */
 				PMAPCOUNT(vac_flush_lots2);
-				pmap_flush_page(md, VM_PAGE_TO_PHYS(pg), PMAP_FLUSH_SECONDARY);
+				pmap_flush_page(md, pa, PMAP_FLUSH_SECONDARY);
+			}
 			md->pvh_attrs &= PAGE_SIZE - 1;
 			md->pvh_attrs |= PVF_KMPAGE
 			    | PVF_COLORED | PVF_DIRTY
 			    | (va & arm_cache_prefer_mask);
 #endif
 #ifdef PMAP_CACHE_VIVT
 			md->pvh_attrs |= PVF_KMPAGE;
 #endif
 			pmap_kmpages++;
 			simple_unlock(&md->pvh_slock);
 #ifdef PMAP_CACHE_VIPT
 		} else {
 			if (pv == NULL) {
 				pv = pool_get(&pmap_pv_pool, PR_NOWAIT);
 				KASSERT(pv != NULL);
+			}
-			pmap_enter_pv(md, VM_PAGE_TO_PHYS(pg), pv, pmap_kernel(), va,
+			pmap_enter_pv(md, pa, pv, pmap_kernel(), va,
 			    PVF_WIRED | PVF_KENTRY
 			    | (prot & VM_PROT_WRITE ? PVF_WRITE : 0));
 			if ((prot & VM_PROT_WRITE)
 			    && !(md->pvh_attrs & PVF_NC))
 				md->pvh_attrs |= PVF_DIRTY;
 			KASSERT((prot & VM_PROT_WRITE) == 0 || (md->pvh_attrs & (PVF_DIRTY|PVF_NC)));
 			simple_lock(&md->pvh_slock);
-			pmap_vac_me_harder(md, VM_PAGE_TO_PHYS(pg), pmap_kernel(), va);
+			pmap_vac_me_harder(md, pa, pmap_kernel(), va);
 			simple_unlock(&md->pvh_slock);
 #endif
+		}
 #ifdef PMAP_CACHE_VIPT
 	} else {
 		if (pv != NULL)
 			pool_put(&pmap_pv_pool, pv);
 #endif
+	}
+}
 void
 pmap_kremove(vaddr_t va, vsize_t len)
 @@ -3466,26 +3467,27 @@ pmap_kremove(vaddr_t va, vsize_t len)
 			next_bucket = eva;
 		l2b = pmap_get_l2_bucket(pmap_kernel(), va);
 		KDASSERT(l2b != NULL);
 		sptep = ptep = &l2b->l2b_kva[l2pte_index(va)];
 		mappings = 0;
 		while (va < next_bucket) {
 			opte = *ptep;
 			opg = PHYS_TO_VM_PAGE(l2pte_pa(opte));
 			if (opg) {
 				struct vm_page_md *omd = VM_PAGE_TO_MD(opg);
 				if (omd->pvh_attrs & PVF_KMPAGE) {
 					simple_lock(&omd->pvh_slock);
 					KASSERT(omd->urw_mappings == 0);
 					KASSERT(omd->uro_mappings == 0);
 					KASSERT(omd->krw_mappings == 0);
 					KASSERT(omd->kro_mappings == 0);
 					omd->pvh_attrs &= ~PVF_KMPAGE;
 #ifdef PMAP_CACHE_VIPT
 					omd->pvh_attrs &= ~PVF_WRITE;
 #endif
 					pmap_kmpages--;
 					simple_unlock(&omd->pvh_slock);
 #ifdef PMAP_CACHE_VIPT
 @@ -3642,30 +3644,32 @@ pmap_protect(pmap_t pm, vaddr_t sva, vad
 				 * active, write-back the page.
 				 */
 				pmap_dcache_wb_range(pm, sva, PAGE_SIZE,
 				    false, false);
 #endif
 				pg = PHYS_TO_VM_PAGE(l2pte_pa(pte));
 				pte = l2pte_set_readonly(pte);
 				*ptep = pte;
 				PTE_SYNC(ptep);
 				if (pg != NULL) {
 					struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 					paddr_t pa = VM_PAGE_TO_PHYS(pg);
 					simple_lock(&md->pvh_slock);
-					f = pmap_modify_pv(md, VM_PAGE_TO_PHYS(pg), pm, sva,
+					f = pmap_modify_pv(md, pa, pm, sva,
 					    clr_mask, 0);
-					pmap_vac_me_harder(md, VM_PAGE_TO_PHYS(pg), pm, sva);
+					pmap_vac_me_harder(md, pa, pm, sva);
 					simple_unlock(&md->pvh_slock);
 				} else
 					f = PVF_REF | PVF_EXEC;
 				if (flush >= 0) {
 					flush++;
 					flags |= f;
 				} else
 				if (PV_BEEN_EXECD(f))
 					pmap_tlb_flushID_SE(pm, sva);
 				else
 				if (PV_BEEN_REFD(f))
 					pmap_tlb_flushD_SE(pm, sva);
 @@ -3721,98 +3725,102 @@ pmap_icache_sync_range(pmap_t pm, vaddr_
 				cpu_icache_sync_range(sva,
 				    min(page_size, eva - sva));
+			}
+		}
+	}
 	pmap_release_pmap_lock(pm);
 	PMAP_MAP_TO_HEAD_UNLOCK();
+}
 void
 pmap_page_protect(struct vm_page *pg, vm_prot_t prot)
+{
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
 	NPDEBUG(PDB_PROTECT,
-	    printf("pmap_page_protect: pg %p (0x%08lx), prot 0x%x\n",
+	    printf("pmap_page_protect: md %p (0x%08lx), prot 0x%x\n",
-	    pg, VM_PAGE_TO_PHYS(pg), prot));
+	    md, pa, prot));
 	switch(prot) {
 	case VM_PROT_READ|VM_PROT_WRITE:
 #if defined(PMAP_CHECK_VIPT) && defined(PMAP_APX)
-		pmap_clearbit(pg, PVF_EXEC);
+		pmap_clearbit(md, pa, PVF_EXEC);
 		break;
 #endif
 	case VM_PROT_READ|VM_PROT_WRITE|VM_PROT_EXECUTE:
 		break;
 	case VM_PROT_READ:
 #if defined(PMAP_CHECK_VIPT) && defined(PMAP_APX)
-		pmap_clearbit(pg, PVF_WRITE|PVF_EXEC);
+		pmap_clearbit(md, pa, PVF_WRITE|PVF_EXEC);
 		break;
 #endif
 	case VM_PROT_READ|VM_PROT_EXECUTE:
-		pmap_clearbit(pg, PVF_WRITE);
+		pmap_clearbit(md, pa, PVF_WRITE);
 		break;
 	default:
-		pmap_page_remove(pg);
+		pmap_page_remove(md, pa);
 		break;
+	}
+}
 /*
  * pmap_clear_modify:
+ *
  *	Clear the "modified" attribute for a page.
  */
 bool
 pmap_clear_modify(struct vm_page *pg)
+{
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
 	bool rv;
 	if (md->pvh_attrs & PVF_MOD) {
 		rv = true;
 #ifdef PMAP_CACHE_VIPT
 		/*
 		 * If we are going to clear the modified bit and there are
 		 * no other modified bits set, flush the page to memory and
 		 * mark it clean.
 		 */
 		if ((md->pvh_attrs & (PVF_DMOD|PVF_NC)) == PVF_MOD)
-			pmap_flush_page(md, VM_PAGE_TO_PHYS(pg), PMAP_CLEAN_PRIMARY);
+			pmap_flush_page(md, pa, PMAP_CLEAN_PRIMARY);
 #endif
-		pmap_clearbit(pg, PVF_MOD);
+		pmap_clearbit(md, pa, PVF_MOD);
 	} else
 		rv = false;
 	return (rv);
+}
 /*
  * pmap_clear_reference:
+ *
  *	Clear the "referenced" attribute for a page.
  */
 bool
 pmap_clear_reference(struct vm_page *pg)
+{
 	struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
 	bool rv;
 	if (md->pvh_attrs & PVF_REF) {
 		rv = true;
-		pmap_clearbit(pg, PVF_REF);
+		pmap_clearbit(md, pa, PVF_REF);
 	} else
 		rv = false;
 	return (rv);
+}
 /*
  * pmap_is_modified:
+ *
  *	Test if a page has the "modified" attribute.
  */
 /* See <arm/arm32/pmap.h> */
 @@ -3900,27 +3908,27 @@ pmap_fault_fixup(pmap_t pm, vaddr_t va,
 		 * Do the flags say this page is writable? If not then it
 		 * is a genuine write fault. If yes then the write fault is
 		 * our fault as we did not reflect the write access in the
 		 * PTE. Now we know a write has occurred we can correct this
 		 * and also set the modified bit
 		 */
 		if ((pv->pv_flags & PVF_WRITE) == 0) {
 		    	simple_unlock(&md->pvh_slock);
 			goto out;
+		}
 		NPDEBUG(PDB_FOLLOW,
 		    printf("pmap_fault_fixup: mod emul. pm %p, va 0x%08lx, pa 0x%08lx\n",
-		    pm, va, VM_PAGE_TO_PHYS(pg)));
+		    pm, va, pa));
 		md->pvh_attrs |= PVF_REF | PVF_MOD;
 		pv->pv_flags |= PVF_REF | PVF_MOD;
 #ifdef PMAP_CACHE_VIPT
 		/*
 		 * If there are cacheable mappings for this page, mark it dirty.
 		 */
 		if ((md->pvh_attrs & PVF_NC) == 0)
 			md->pvh_attrs |= PVF_DIRTY;
 #endif
 		simple_unlock(&md->pvh_slock);
 		/*
 @@ -3953,27 +3961,27 @@ pmap_fault_fixup(pmap_t pm, vaddr_t va,
 		pv = pmap_find_pv(md, pm, va);
 		if (pv == NULL) {
 	    		simple_unlock(&md->pvh_slock);
 			goto out;
+		}
 		md->pvh_attrs |= PVF_REF;
 		pv->pv_flags |= PVF_REF;
 		simple_unlock(&md->pvh_slock);
 		NPDEBUG(PDB_FOLLOW,
 		    printf("pmap_fault_fixup: ref emul. pm %p, va 0x%08lx, pa 0x%08lx\n",
-		    pm, va, VM_PAGE_TO_PHYS(pg)));
+		    pm, va, pa));
 		*ptep = l2pte_set_readonly((pte & ~L2_TYPE_MASK) | L2_S_PROTO);
 		PTE_SYNC(ptep);
 		rv = 1;
+	}
 	/*
 	 * We know there is a valid mapping here, so simply
 	 * fix up the L1 if necessary.
 	 */
 	pl1pd = &pm->pm_l1->l1_kva[l1idx];
 	l1pd = l2b->l2b_phys | L1_C_DOM(pm->pm_domain) | L1_C_PROTO;
 	if (*pl1pd != l1pd) {
 @@ -4101,28 +4109,29 @@ pmap_unwire(pmap_t pm, vaddr_t va)
 	l2b = pmap_get_l2_bucket(pm, va);
 	KDASSERT(l2b != NULL);
 	ptep = &l2b->l2b_kva[l2pte_index(va)];
 	pte = *ptep;
 	/* Extract the physical address of the page */
 	pa = l2pte_pa(pte);
 	if ((pg = PHYS_TO_VM_PAGE(pa)) != NULL) {
 		/* Update the wired bit in the pv entry for this page. */
 		struct vm_page_md *md = VM_PAGE_TO_MD(pg);
 		simple_lock(&md->pvh_slock);
-		(void) pmap_modify_pv(md, VM_PAGE_TO_PHYS(pg), pm, va, PVF_WIRED, 0);
+		(void) pmap_modify_pv(md, pa, pm, va, PVF_WIRED, 0);
 		simple_unlock(&md->pvh_slock);
+	}
 	pmap_release_pmap_lock(pm);
 	PMAP_MAP_TO_HEAD_UNLOCK();
+}
 void
 pmap_activate(struct lwp *l)
+{
 	extern int block_userspace_access;
 	pmap_t opm, npm, rpm;
 	uint32_t odacr, ndacr;