Could somebody explain to me the way under NetBSD that the TLB is 
managed for ppc405.

I am currently porting to 405ep, which requires very little change from
the current evbppc/* ports for 405gp - some UART fussing for
selecting the clock generation speed - different interrupts - a
bunch of DCR things to bring out of reset. (PS ibm4xx/pxi/pchb.c
is more 405gp centric then its name would suggest) However my port
is a little unusual in that my kernel lives at 8MB and is
a ~24MB ramdisk (required to be tftpbooted or extracted from
a Disk-on-Chip) for an embedded app. I don't use openBIOS.
I am running current-2003-10-21 and the kernel works fine
if loaded low and small, but if loaded  high and big
fails during uvm_* routines.
   The code in walnut_start.S and ibm4xx/openbios/locore.s
sets up 3 TLB entries to cover 1-16MB 16Mb-32MB and the
UARTS. I needed to add 32Mb to 48Mb. Since translation is
turned on before pmapbootstrap, I assume all that is required
is to map the TLB vectors and their handlers. I notice pmap_find_victim
does not replace the lower TLB_NRESERVED entries. How do these
slots get filled? If I take a kernel DTLB miss to physical memory
this will be added, but not to the reserved slots. Are these
only the entries set up in locore? if so shouldn't TLB_NRESERVED
be 3? Since I seem to having problems in kernel text above 16Mb
what is significance of the user start address of 0x180000?
Is the kernel text expected to be be below this so that a
virtual address can be used in ITLB miss to distinguish its source?
In the mean time I'll be digging through the source.

Thanks in advance

-Derek