Index: arch/ppc32/include/asm.h
===================================================================
--- arch/ppc32/include/asm.h	(revision 5ca586a12b3700df6bee38c12a8d522873270874)
+++ arch/ppc32/include/asm.h	(revision 9ea6cc566be012266a2a040129f53230cff1e316)
@@ -141,5 +141,4 @@
 void cpu_halt(void);
 void asm_delay_loop(__u32 t);
-void invalidate_bat(void);
 
 extern void userspace_asm(__address uspace_uarg, __address stack, __address entry);
Index: arch/ppc32/src/asm.S
===================================================================
--- arch/ppc32/src/asm.S	(revision 5ca586a12b3700df6bee38c12a8d522873270874)
+++ arch/ppc32/src/asm.S	(revision 9ea6cc566be012266a2a040129f53230cff1e316)
@@ -34,5 +34,4 @@
 .global iret
 .global iret_syscall
-.global invalidate_bat
 .global memsetb
 .global memcpy
@@ -195,36 +194,4 @@
 	rfi
 	
-invalidate_bat:
-	
-	# invalidate block address translation registers
-	
-	li r14, 0
-	
-	mtspr ibat0u, r14
-	mtspr ibat0l, r14
-	
-	mtspr ibat1u, r14
-	mtspr ibat1l, r14
-	
-	mtspr ibat2u, r14
-	mtspr ibat2l, r14
-	
-	mtspr ibat3u, r14
-	mtspr ibat3l, r14
-	
-	mtspr dbat0u, r14
-	mtspr dbat0l, r14
-	
-	mtspr dbat1u, r14
-	mtspr dbat1l, r14
-	
-	mtspr dbat2u, r14
-	mtspr dbat2l, r14
-	
-	mtspr dbat3u, r14
-	mtspr dbat3l, r14
-	
-	blr
-	
 memsetb:
 	rlwimi r5, r5, 8, 16, 23
Index: arch/ppc32/src/mm/page.c
===================================================================
--- arch/ppc32/src/mm/page.c	(revision 5ca586a12b3700df6bee38c12a8d522873270874)
+++ arch/ppc32/src/mm/page.c	(revision 9ea6cc566be012266a2a040129f53230cff1e316)
@@ -50,6 +50,6 @@
  *
  * @param badvaddr Faulting virtual address.
- * @param istate Pointer to interrupted state.
- * @param pfrc Pointer to variable where as_page_fault() return code will be stored.
+ * @param istate   Pointer to interrupted state.
+ * @param pfrc     Pointer to variable where as_page_fault() return code will be stored.
  * @return         PTE on success, NULL otherwise.
  *
@@ -115,4 +115,5 @@
 }
 
+
 static void pht_insert(const __address vaddr, const pfn_t pfn)
 {
@@ -131,14 +132,30 @@
 	
 	__u32 i;
+	bool found = false;
 	/* Find unused PTE in PTEG */
 	for (i = 0; i < 8; i++) {
-		if (!phte[hash + i].v)
+		if (!phte[hash + i].v) {
+			found = true;
 			break;
-	}
-	
-	// TODO: Check access/change bits, secondary hash
-	
-	if (i == 8) 
-		i = page % 8;
+		}
+	}
+	
+	if (!found) {
+		/* Secondary hash (not) */
+		hash = ~hash;
+		
+		/* Find unused PTE in PTEG */
+		for (i = 0; i < 8; i++) {
+			if (!phte[hash + i].v) {
+				found = true;
+				break;
+			}
+		}
+		
+		if (!found) {
+			// TODO: A/C precedence groups
+			i = page % 8;
+		}
+	}
 	
 	phte[hash + i].v = 1;
@@ -184,17 +201,16 @@
 	if (!pte) {
 		switch (pfcr) {
-		case AS_PF_FAULT:
-			goto fail;
-			break;
-		case AS_PF_DEFER:
-			/*
-		 	 * The page fault came during copy_from_uspace()
-			 * or copy_to_uspace().
-			 */
-			page_table_unlock(AS, true);
-			return;
-		default:
-			panic("Unexpected pfrc (%d)\n", pfcr);
-			break;
+			case AS_PF_FAULT:
+				goto fail;
+				break;
+			case AS_PF_DEFER:
+				/*
+		 		 * The page fault came during copy_from_uspace()
+				 * or copy_to_uspace().
+				 */
+				page_table_unlock(AS, true);
+				return;
+			default:
+				panic("Unexpected pfrc (%d)\n", pfcr);
 		}
 	}
@@ -215,13 +231,4 @@
 {
 	memsetb((__address) phte, 1 << PHT_BITS, 0);
-	
-	/* Insert global kernel mapping */
-	
-	__address cur;
-	for (cur = 0; cur < last_frame; cur += FRAME_SIZE) {
-		pte_t *pte = page_mapping_find(AS_KERNEL, PA2KA(cur));
-		if ((pte) && (pte->p) && (pte->g))
-			pht_insert(PA2KA(cur), pte->pfn);
-	}
 }
 
@@ -257,8 +264,4 @@
 			: "r" ((__address) physical_phte)
 		);
-		
-		/* Invalidate block address translation registers,
-		   thus remove the temporary mapping */
-//		invalidate_bat();
-	}
-}
+	}
+}