More AP / SP bits for the 34K, the Malta bits and things. Still wants

a little polishing.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

6 files changed, 1890 insertions, 17 deletions

diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index 0867417032f2..0f527063a8a8 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -34,12 +34,16 @@ obj-$(CONFIG_CPU_R6000)		+= r6000_fpu.o r4k_switch.o
 
 obj-$(CONFIG_SMP)               += smp.o
 
+obj-$(CONFIG_MIPS_VPE_LOADER)   += vpe.o
+obj-$(CONFIG_MIPS_VPE_APSP_API) += rtlx.o
+
 obj-$(CONFIG_NO_ISA)            += dma-no-isa.o
 obj-$(CONFIG_I8259)             += i8259.o
 obj-$(CONFIG_IRQ_CPU)           += irq_cpu.o
 obj-$(CONFIG_IRQ_CPU_RM7K)      += irq-rm7000.o
 obj-$(CONFIG_IRQ_CPU_RM9K)      += irq-rm9000.o
 obj-$(CONFIG_IRQ_MV64340)       += irq-mv6434x.o
+obj-$(CONFIG_MIPS_BOARDS_GEN)   += irq-msc01.o
 
 obj-$(CONFIG_32BIT)             += scall32-o32.o
 obj-$(CONFIG_64BIT)             += scall64-64.o
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 349ec301168f..fd904d1e4190 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -148,6 +148,38 @@ NESTED(except_vec_ejtag_debug, 0, sp)
         __FINIT
 
 /*
+ * Vectored interrupt handler.
+ * This prototype is copied to ebase + n*IntCtl.VS and patched
+ * to invoke the handler
+ */
+NESTED(except_vec_vi, 0, sp)
+        SAVE_SOME
+        SAVE_AT
+        .set    push
+        .set    noreorder
+EXPORT(except_vec_vi_lui)
+        lui     v0, 0           /* Patched */
+        j       except_vec_vi_handler
+EXPORT(except_vec_vi_ori)
+         ori    v0, 0           /* Patched */
+        .set    pop
+        END(except_vec_vi)
+EXPORT(except_vec_vi_end)
+
+/*
+ * Common Vectored Interrupt code
+ * Complete the register saves and invoke the handler which is passed in $v0
+ */
+NESTED(except_vec_vi_handler, 0, sp)
+        SAVE_TEMP
+        SAVE_STATIC
+        CLI
+        move    a0, sp
+        jalr    v0
+        j       ret_from_irq
+        END(except_vec_vi_handler)
+
+/*
  * EJTAG debug exception handler.
  */
 NESTED(ejtag_debug_handler, PT_SIZE, sp)
diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
index bf759e33c5ef..3f653c7cfbf3 100644
--- a/arch/mips/kernel/irq-msc01.c
+++ b/arch/mips/kernel/irq-msc01.c
@@ -74,7 +74,7 @@ static void disable_msc_irq(unsigned int irq)
 static void level_mask_and_ack_msc_irq(unsigned int irq)
 {
         mask_msc_irq(irq);
-        if (!cpu_has_ei)
+        if (!cpu_has_veic)
                 MSCIC_WRITE(MSC01_IC_EOI, 0);
 }
 
@@ -84,7 +84,7 @@ static void level_mask_and_ack_msc_irq(unsigned int irq)
 static void edge_mask_and_ack_msc_irq(unsigned int irq)
 {
         mask_msc_irq(irq);
-        if (!cpu_has_ei)
+        if (!cpu_has_veic)
                 MSCIC_WRITE(MSC01_IC_EOI, 0);
         else {
                 u32 r;
@@ -166,14 +166,14 @@ void __init init_msc_irqs(unsigned int base, msc_irqmap_t *imp, int nirq)
                 switch (imp->im_type) {
                 case MSC01_IRQ_EDGE:
                         irq_desc[base+n].handler = &msc_edgeirq_type;
-                        if (cpu_has_ei)
+                        if (cpu_has_veic)
                                 MSCIC_WRITE(MSC01_IC_SUP+n*8, MSC01_IC_SUP_EDGE_BIT);
                         else
                                 MSCIC_WRITE(MSC01_IC_SUP+n*8, MSC01_IC_SUP_EDGE_BIT | imp->im_lvl);
                         break;
                 case MSC01_IRQ_LEVEL:
                         irq_desc[base+n].handler = &msc_levelirq_type;
-                        if (cpu_has_ei)
+                        if (cpu_has_veic)
                                 MSCIC_WRITE(MSC01_IC_SUP+n*8, 0);
                         else
                                 MSCIC_WRITE(MSC01_IC_SUP+n*8, imp->im_lvl);
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
new file mode 100644
index 000000000000..8c81f3cb4e2d
--- /dev/null
+++ b/arch/mips/kernel/rtlx.c
@@ -0,0 +1,341 @@
+/*
+ * Copyright (C) 2005 MIPS Technologies, Inc.  All rights reserved.
+ *
+ *  This program is free software; you can distribute it and/or modify it
+ *  under the terms of the GNU General Public License (Version 2) as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <asm/uaccess.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/vmalloc.h>
+#include <linux/elf.h>
+#include <linux/seq_file.h>
+#include <linux/syscalls.h>
+#include <linux/moduleloader.h>
+#include <linux/interrupt.h>
+#include <linux/poll.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <asm/mipsmtregs.h>
+#include <asm/cacheflush.h>
+#include <asm/atomic.h>
+#include <asm/cpu.h>
+#include <asm/processor.h>
+#include <asm/system.h>
+#include <asm/rtlx.h>
+
+#define RTLX_MAJOR 64
+#define RTLX_TARG_VPE 1
+
+struct rtlx_info *rtlx;
+static int major;
+static char module_name[] = "rtlx";
+static inline int spacefree(int read, int write, int size);
+
+static struct chan_waitqueues {
+        wait_queue_head_t rt_queue;
+        wait_queue_head_t lx_queue;
+} channel_wqs[RTLX_CHANNELS];
+
+static struct irqaction irq;
+static int irq_num;
+
+extern void *vpe_get_shared(int index);
+
+static void rtlx_dispatch(struct pt_regs *regs)
+{
+        do_IRQ(MIPSCPU_INT_BASE + MIPS_CPU_RTLX_IRQ, regs);
+}
+
+irqreturn_t rtlx_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        irqreturn_t r = IRQ_HANDLED;
+        int i;
+
+        for (i = 0; i < RTLX_CHANNELS; i++) {
+                struct rtlx_channel *chan = &rtlx->channel[i];
+
+                if (chan->lx_read != chan->lx_write)
+                        wake_up_interruptible(&channel_wqs[i].lx_queue);
+        }
+
+        return r;
+}
+
+void dump_rtlx(void)
+{
+        int i;
+
+        printk("id 0x%lx state %d\n", rtlx->id, rtlx->state);
+
+        for (i = 0; i < RTLX_CHANNELS; i++) {
+                struct rtlx_channel *chan = &rtlx->channel[i];
+
+                printk(" rt_state %d lx_state %d buffer_size %d\n",
+                       chan->rt_state, chan->lx_state, chan->buffer_size);
+
+                printk(" rt_read %d rt_write %d\n",
+                       chan->rt_read, chan->rt_write);
+
+                printk(" lx_read %d lx_write %d\n",
+                       chan->lx_read, chan->lx_write);
+
+                printk(" rt_buffer <%s>\n", chan->rt_buffer);
+                printk(" lx_buffer <%s>\n", chan->lx_buffer);
+        }
+}
+
+/* call when we have the address of the shared structure from the SP side. */
+static int rtlx_init(struct rtlx_info *rtlxi)
+{
+        int i;
+
+        if (rtlxi->id != RTLX_ID) {
+                printk(KERN_WARNING "no valid RTLX id at 0x%p\n", rtlxi);
+                return (-ENOEXEC);
+        }
+
+        /* initialise the wait queues */
+        for (i = 0; i < RTLX_CHANNELS; i++) {
+                init_waitqueue_head(&channel_wqs[i].rt_queue);
+                init_waitqueue_head(&channel_wqs[i].lx_queue);
+        }
+
+        /* set up for interrupt handling */
+        memset(&irq, 0, sizeof(struct irqaction));
+
+        if (cpu_has_vint) {
+                set_vi_handler(MIPS_CPU_RTLX_IRQ, rtlx_dispatch);
+        }
+
+        irq_num = MIPSCPU_INT_BASE + MIPS_CPU_RTLX_IRQ;
+        irq.handler = rtlx_interrupt;
+        irq.flags = SA_INTERRUPT;
+        irq.name = "RTLX";
+        irq.dev_id = rtlx;
+        setup_irq(irq_num, &irq);
+
+        rtlx = rtlxi;
+        return (0);
+}
+
+/* only allow one open process at a time to open each channel */
+static int rtlx_open(struct inode *inode, struct file *filp)
+{
+        int minor, ret;
+        struct rtlx_channel *chan;
+
+        /* assume only 1 device at the mo. */
+        minor = MINOR(inode->i_rdev);
+
+        if (rtlx == NULL) {
+                struct rtlx_info **p;
+                if( (p = vpe_get_shared(RTLX_TARG_VPE)) == NULL) {
+                        printk(" vpe_get_shared is NULL. Has an SP program been loaded?\n");
+                        return (-EFAULT);
+                }
+
+                if (*p == NULL) {
+                        printk(" vpe_shared %p %p\n", p, *p);
+                        return (-EFAULT);
+                }
+
+                if ((ret = rtlx_init(*p)) < 0)
+                        return (ret);
+        }
+
+        chan = &rtlx->channel[minor];
+
+        /* already open? */
+        if (chan->lx_state == RTLX_STATE_OPENED)
+                return (-EBUSY);
+
+        chan->lx_state = RTLX_STATE_OPENED;
+        return (0);
+}
+
+static int rtlx_release(struct inode *inode, struct file *filp)
+{
+        int minor;
+
+        minor = MINOR(inode->i_rdev);
+        rtlx->channel[minor].lx_state = RTLX_STATE_UNUSED;
+        return (0);
+}
+
+static unsigned int rtlx_poll(struct file *file, poll_table * wait)
+{
+        int minor;
+        unsigned int mask = 0;
+        struct rtlx_channel *chan;
+
+        minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        chan = &rtlx->channel[minor];
+
+        poll_wait(file, &channel_wqs[minor].rt_queue, wait);
+        poll_wait(file, &channel_wqs[minor].lx_queue, wait);
+
+        /* data available to read? */
+        if (chan->lx_read != chan->lx_write)
+                mask |= POLLIN | POLLRDNORM;
+
+        /* space to write */
+        if (spacefree(chan->rt_read, chan->rt_write, chan->buffer_size))
+                mask |= POLLOUT | POLLWRNORM;
+
+        return (mask);
+}
+
+static ssize_t rtlx_read(struct file *file, char __user * buffer, size_t count,
+                         loff_t * ppos)
+{
+        size_t fl = 0L;
+        int minor;
+        struct rtlx_channel *lx;
+        DECLARE_WAITQUEUE(wait, current);
+
+        minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        lx = &rtlx->channel[minor];
+
+        /* data available? */
+        if (lx->lx_write == lx->lx_read) {
+                if (file->f_flags & O_NONBLOCK)
+                        return (0);     // -EAGAIN makes cat whinge
+
+                /* go to sleep */
+                add_wait_queue(&channel_wqs[minor].lx_queue, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                while (lx->lx_write == lx->lx_read)
+                        schedule();
+
+                set_current_state(TASK_RUNNING);
+                remove_wait_queue(&channel_wqs[minor].lx_queue, &wait);
+
+                /* back running */
+        }
+
+        /* find out how much in total */
+        count = min( count,
+                     (size_t)(lx->lx_write + lx->buffer_size - lx->lx_read) % lx->buffer_size);
+
+        /* then how much from the read pointer onwards */
+        fl = min( count, (size_t)lx->buffer_size - lx->lx_read);
+
+        copy_to_user (buffer, &lx->lx_buffer[lx->lx_read], fl);
+
+        /* and if there is anything left at the beginning of the buffer */
+        if ( count - fl )
+                copy_to_user (buffer + fl, lx->lx_buffer, count - fl);
+
+        /* update the index */
+        lx->lx_read += count;
+        lx->lx_read %= lx->buffer_size;
+
+        return (count);
+}
+
+static inline int spacefree(int read, int write, int size)
+{
+        if (read == write) {
+                /* never fill the buffer completely, so indexes are always equal if empty
+                   and only empty, or !equal if data available */
+                return (size - 1);
+        }
+
+        return ((read + size - write) % size) - 1;
+}
+
+static ssize_t rtlx_write(struct file *file, const char __user * buffer,
+                          size_t count, loff_t * ppos)
+{
+        int minor;
+        struct rtlx_channel *rt;
+        size_t fl;
+        DECLARE_WAITQUEUE(wait, current);
+
+        minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        rt = &rtlx->channel[minor];
+
+        /* any space left... */
+        if (!spacefree(rt->rt_read, rt->rt_write, rt->buffer_size)) {
+
+                if (file->f_flags & O_NONBLOCK)
+                        return (-EAGAIN);
+
+                add_wait_queue(&channel_wqs[minor].rt_queue, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                while (!spacefree(rt->rt_read, rt->rt_write, rt->buffer_size))
+                        schedule();
+
+                set_current_state(TASK_RUNNING);
+                remove_wait_queue(&channel_wqs[minor].rt_queue, &wait);
+        }
+
+        /* total number of bytes to copy */
+        count = min( count, (size_t)spacefree(rt->rt_read, rt->rt_write, rt->buffer_size) );
+
+        /* first bit from write pointer to the end of the buffer, or count */
+        fl = min(count, (size_t) rt->buffer_size - rt->rt_write);
+
+        copy_from_user(&rt->rt_buffer[rt->rt_write], buffer, fl);
+
+        /* if there's any left copy to the beginning of the buffer */
+        if( count - fl )
+                copy_from_user(rt->rt_buffer, buffer + fl, count - fl);
+
+        rt->rt_write += count;
+        rt->rt_write %= rt->buffer_size;
+
+        return(count);
+}
+
+static struct file_operations rtlx_fops = {
+        .owner = THIS_MODULE,
+        .open = rtlx_open,
+        .release = rtlx_release,
+        .write = rtlx_write,
+        .read = rtlx_read,
+        .poll = rtlx_poll
+};
+
+static int rtlx_module_init(void)
+{
+        if ((major = register_chrdev(RTLX_MAJOR, module_name, &rtlx_fops)) < 0) {
+                printk("rtlx_module_init: unable to register device\n");
+                return (-EBUSY);
+        }
+
+        if (major == 0)
+                major = RTLX_MAJOR;
+
+        return (0);
+}
+
+static void rtlx_module_exit(void)
+{
+        unregister_chrdev(major, module_name);
+}
+
+module_init(rtlx_module_init);
+module_exit(rtlx_module_exit);
+MODULE_DESCRIPTION("MIPS RTLX");
+MODULE_AUTHOR("Elizabeth Clarke, MIPS Technologies, Inc");
+MODULE_LICENSE("GPL");
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index b2fa607eeeb8..0a3969aa8dc6 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -20,6 +20,7 @@
 #include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/kallsyms.h>
+#include <linux/bootmem.h>
 
 #include <asm/bootinfo.h>
 #include <asm/branch.h>
@@ -64,6 +65,9 @@ extern int fpu_emulator_cop1Handler(int xcptno, struct pt_regs *xcp,
 
 void (*board_be_init)(void);
 int (*board_be_handler)(struct pt_regs *regs, int is_fixup);
+void (*board_nmi_handler_setup)(void);
+void (*board_ejtag_handler_setup)(void);
+void (*board_bind_eic_interrupt)(int irq, int regset);
 
 /*
  * These constant is for searching for possible module text segments.
@@ -813,6 +817,12 @@ asmlinkage void do_reserved(struct pt_regs *regs)
               (regs->cp0_cause & 0x7f) >> 2);
 }
 
+asmlinkage void do_default_vi(struct pt_regs *regs)
+{
+        show_regs(regs);
+        panic("Caught unexpected vectored interrupt.");
+}
+
 /*
  * Some MIPS CPUs can enable/disable for cache parity detection, but do
  * it different ways.
@@ -921,7 +931,11 @@ void nmi_exception_handler(struct pt_regs *regs)
         while(1) ;
 }
 
+#define VECTORSPACING 0x100     /* for EI/VI mode */
+
+unsigned long ebase;
 unsigned long exception_handlers[32];
+unsigned long vi_handlers[64];
 
 /*
  * As a side effect of the way this is implemented we're limited
@@ -935,13 +949,156 @@ void *set_except_vector(int n, void *addr)
 
         exception_handlers[n] = handler;
         if (n == 0 && cpu_has_divec) {
-                *(volatile u32 *)(CAC_BASE + 0x200) = 0x08000000 |
+                *(volatile u32 *)(ebase + 0x200) = 0x08000000 |
                                                  (0x03ffffff & (handler >> 2));
-                flush_icache_range(CAC_BASE + 0x200, CAC_BASE + 0x204);
+                flush_icache_range(ebase + 0x200, ebase + 0x204);
+        }
+        return (void *)old_handler;
+}
+
+#ifdef CONFIG_CPU_MIPSR2
+/*
+ * Shadow register allocation
+ * FIXME: SMP...
+ */
+
+/* MIPSR2 shadow register sets */
+struct shadow_registers {
+        spinlock_t sr_lock;     /*  */
+        int sr_supported;       /* Number of shadow register sets supported */
+        int sr_allocated;       /* Bitmap of allocated shadow registers */
+} shadow_registers;
+
+void mips_srs_init(void)
+{
+#ifdef CONFIG_CPU_MIPSR2_SRS
+        shadow_registers.sr_supported = ((read_c0_srsctl() >> 26) & 0x0f) + 1;
+        printk ("%d MIPSR2 register sets available\n", shadow_registers.sr_supported);
+#else
+        shadow_registers.sr_supported = 1;
+#endif
+        shadow_registers.sr_allocated = 1;      /* Set 0 used by kernel */
+        spin_lock_init(&shadow_registers.sr_lock);
+}
+
+int mips_srs_max(void)
+{
+        return shadow_registers.sr_supported;
+}
+
+int mips_srs_alloc (void)
+{
+        struct shadow_registers *sr = &shadow_registers;
+        unsigned long flags;
+        int set;
+
+        spin_lock_irqsave(&sr->sr_lock, flags);
+
+        for (set = 0; set < sr->sr_supported; set++) {
+                if ((sr->sr_allocated & (1 << set)) == 0) {
+                        sr->sr_allocated |= 1 << set;
+                        spin_unlock_irqrestore(&sr->sr_lock, flags);
+                        return set;
+                }
+        }
+
+        /* None available */
+        spin_unlock_irqrestore(&sr->sr_lock, flags);
+        return -1;
+}
+
+void mips_srs_free (int set)
+{
+        struct shadow_registers *sr = &shadow_registers;
+        unsigned long flags;
+
+        spin_lock_irqsave(&sr->sr_lock, flags);
+        sr->sr_allocated &= ~(1 << set);
+        spin_unlock_irqrestore(&sr->sr_lock, flags);
+}
+
+void *set_vi_srs_handler (int n, void *addr, int srs)
+{
+        unsigned long handler;
+        unsigned long old_handler = vi_handlers[n];
+        u32 *w;
+        unsigned char *b;
+
+        if (!cpu_has_veic && !cpu_has_vint)
+                BUG();
+
+        if (addr == NULL) {
+                handler = (unsigned long) do_default_vi;
+                srs = 0;
+        }
+        else
+                handler = (unsigned long) addr;
+        vi_handlers[n] = (unsigned long) addr;
+
+        b = (unsigned char *)(ebase + 0x200 + n*VECTORSPACING);
+
+        if (srs >= mips_srs_max())
+                panic("Shadow register set %d not supported", srs);
+
+        if (cpu_has_veic) {
+                if (board_bind_eic_interrupt)
+                        board_bind_eic_interrupt (n, srs);
+        }
+        else if (cpu_has_vint) {
+                /* SRSMap is only defined if shadow sets are implemented */
+                if (mips_srs_max() > 1)
+                        change_c0_srsmap (0xf << n*4, srs << n*4);
+        }
+
+        if (srs == 0) {
+                /*
+                 * If no shadow set is selected then use the default handler
+                 * that does normal register saving and a standard interrupt exit
+                 */
+
+                extern char except_vec_vi, except_vec_vi_lui;
+                extern char except_vec_vi_ori, except_vec_vi_end;
+                const int handler_len = &except_vec_vi_end - &except_vec_vi;
+                const int lui_offset = &except_vec_vi_lui - &except_vec_vi;
+                const int ori_offset = &except_vec_vi_ori - &except_vec_vi;
+
+                if (handler_len > VECTORSPACING) {
+                        /*
+                         * Sigh... panicing won't help as the console
+                         * is probably not configured :(
+                         */
+                        panic ("VECTORSPACING too small");
+                }
+
+                memcpy (b, &except_vec_vi, handler_len);
+                w = (u32 *)(b + lui_offset);
+                *w = (*w & 0xffff0000) | (((u32)handler >> 16) & 0xffff);
+                w = (u32 *)(b + ori_offset);
+                *w = (*w & 0xffff0000) | ((u32)handler & 0xffff);
+                flush_icache_range((unsigned long)b, (unsigned long)(b+handler_len));
+        }
+        else {
+                /*
+                 * In other cases jump directly to the interrupt handler
+                 *
+                 * It is the handlers responsibility to save registers if required
+                 * (eg hi/lo) and return from the exception using "eret"
+                 */
+                w = (u32 *)b;
+                *w++ = 0x08000000 | (((u32)handler >> 2) & 0x03fffff); /* j handler */
+                *w = 0;
+                flush_icache_range((unsigned long)b, (unsigned long)(b+8));
         }
+
         return (void *)old_handler;
 }
 
+void *set_vi_handler (int n, void *addr)
+{
+        return set_vi_srs_handler (n, addr, 0);
+}
+#endif
+
 /*
  * This is used by native signal handling
  */
@@ -1016,10 +1173,18 @@ void __init per_cpu_trap_init(void)
         if (cpu_has_dsp)
                 set_c0_status(ST0_MX);
 
+#ifdef CONFIG_CPU_MIPSR2
+        write_c0_hwrena (0x0000000f); /* Allow rdhwr to all registers */
+#endif
+
         /*
-         * Some MIPS CPUs have a dedicated interrupt vector which reduces the
-         * interrupt processing overhead.  Use it where available.
+         * Interrupt handling.
          */
+        if (cpu_has_veic || cpu_has_vint) {
+                write_c0_ebase (ebase);
+                /* Setting vector spacing enables EI/VI mode  */
+                change_c0_intctl (0x3e0, VECTORSPACING);
+        }
         if (cpu_has_divec)
                 set_c0_cause(CAUSEF_IV);
 
@@ -1035,13 +1200,41 @@ void __init per_cpu_trap_init(void)
         tlb_init();
 }
 
+/* Install CPU exception handler */
+void __init set_handler (unsigned long offset, void *addr, unsigned long size)
+{
+        memcpy((void *)(ebase + offset), addr, size);
+        flush_icache_range(ebase + offset, ebase + offset + size);
+}
+
+/* Install uncached CPU exception handler */
+void __init set_uncached_handler (unsigned long offset, void *addr, unsigned long size)
+{
+#ifdef CONFIG_32BIT
+        unsigned long uncached_ebase = KSEG1ADDR(ebase);
+#endif
+#ifdef CONFIG_64BIT
+        unsigned long uncached_ebase = TO_UNCAC(ebase);
+#endif
+
+        memcpy((void *)(uncached_ebase + offset), addr, size);
+}
+
 void __init trap_init(void)
 {
         extern char except_vec3_generic, except_vec3_r4000;
-        extern char except_vec_ejtag_debug;
         extern char except_vec4;
         unsigned long i;
 
+        if (cpu_has_veic || cpu_has_vint)
+                ebase = (unsigned long) alloc_bootmem_low_pages (0x200 + VECTORSPACING*64);
+        else
+                ebase = CAC_BASE;
+
+#ifdef CONFIG_CPU_MIPSR2
+        mips_srs_init();
+#endif
+
         per_cpu_trap_init();
 
         /*
@@ -1049,7 +1242,7 @@ void __init trap_init(void)
          * This will be overriden later as suitable for a particular
          * configuration.
          */
-        memcpy((void *)(CAC_BASE + 0x180), &except_vec3_generic, 0x80);
+        set_handler(0x180, &except_vec3_generic, 0x80);
 
         /*
          * Setup default vectors
@@ -1061,8 +1254,8 @@ void __init trap_init(void)
          * Copy the EJTAG debug exception vector handler code to it's final
          * destination.
          */
-        if (cpu_has_ejtag)
-                memcpy((void *)(CAC_BASE + 0x300), &except_vec_ejtag_debug, 0x80);
+        if (cpu_has_ejtag && board_ejtag_handler_setup)
+                board_ejtag_handler_setup ();
 
         /*
          * Only some CPUs have the watch exceptions.
@@ -1071,11 +1264,15 @@ void __init trap_init(void)
                 set_except_vector(23, handle_watch);
 
         /*
-         * Some MIPS CPUs have a dedicated interrupt vector which reduces the
-         * interrupt processing overhead.  Use it where available.
+         * Initialise interrupt handlers
          */
-        if (cpu_has_divec)
-                memcpy((void *)(CAC_BASE + 0x200), &except_vec4, 0x8);
+        if (cpu_has_veic || cpu_has_vint) {
+                int nvec = cpu_has_veic ? 64 : 8;
+                for (i = 0; i < nvec; i++)
+                        set_vi_handler (i, NULL);
+        }
+        else if (cpu_has_divec)
+                set_handler(0x200, &except_vec4, 0x8);
 
         /*
          * Some CPUs can enable/disable for cache parity detection, but does
@@ -1122,6 +1319,10 @@ void __init trap_init(void)
                 //set_except_vector(15, handle_ndc);
         }
 
+
+        if (board_nmi_handler_setup)
+                board_nmi_handler_setup();
+
         if (cpu_has_fpu && !cpu_has_nofpuex)
                 set_except_vector(15, handle_fpe);
 
@@ -1146,5 +1347,5 @@ void __init trap_init(void)
         signal32_init();
 #endif
 
-        flush_icache_range(CAC_BASE, CAC_BASE + 0x400);
+        flush_icache_range(ebase, ebase + 0x400);
 }
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
new file mode 100644
index 000000000000..6bf42ba08f09
--- /dev/null
+++ b/arch/mips/kernel/vpe.c
@@ -0,0 +1,1295 @@
+/*
+ * Copyright (C) 2004, 2005 MIPS Technologies, Inc.  All rights reserved.
+ *
+ *  This program is free software; you can distribute it and/or modify it
+ *  under the terms of the GNU General Public License (Version 2) as
+ *  published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+ *
+ */
+
+/*
+ * VPE support module
+ *
+ * Provides support for loading a MIPS SP program on VPE1.
+ * The SP enviroment is rather simple, no tlb's.  It needs to be relocatable
+ * (or partially linked). You should initialise your stack in the startup
+ * code. This loader looks for the symbol __start and sets up
+ * execution to resume from there. The MIPS SDE kit contains suitable examples.
+ *
+ * To load and run, simply cat a SP 'program file' to /dev/vpe1.
+ * i.e cat spapp >/dev/vpe1.
+ *
+ * You'll need to have the following device files.
+ * mknod /dev/vpe0 c 63 0
+ * mknod /dev/vpe1 c 63 1
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <asm/uaccess.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/vmalloc.h>
+#include <linux/elf.h>
+#include <linux/seq_file.h>
+#include <linux/syscalls.h>
+#include <linux/moduleloader.h>
+#include <linux/interrupt.h>
+#include <linux/poll.h>
+#include <linux/bootmem.h>
+#include <asm/mipsregs.h>
+#include <asm/cacheflush.h>
+#include <asm/atomic.h>
+#include <asm/cpu.h>
+#include <asm/processor.h>
+#include <asm/system.h>
+
+typedef void *vpe_handle;
+
+// defined here because the kernel module loader doesn't have
+// anything to do with it.
+#define SHN_MIPS_SCOMMON 0xff03
+
+#ifndef ARCH_SHF_SMALL
+#define ARCH_SHF_SMALL 0
+#endif
+
+/* If this is set, the section belongs in the init part of the module */
+#define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
+
+// temp number,
+#define VPE_MAJOR 63
+
+static char module_name[] = "vpe";
+static int major = 0;
+
+/* grab the likely amount of memory we will need. */
+#ifdef CONFIG_MIPS_VPE_LOADER_TOM
+#define P_SIZE (2 * 1024 * 1024)
+#else
+/* add an overhead to the max kmalloc size for non-striped symbols/etc */
+#define P_SIZE (256 * 1024)
+#endif
+
+#define MAX_VPES 16
+
+enum vpe_state {
+        VPE_STATE_UNUSED = 0,
+        VPE_STATE_INUSE,
+        VPE_STATE_RUNNING
+};
+
+enum tc_state {
+        TC_STATE_UNUSED = 0,
+        TC_STATE_INUSE,
+        TC_STATE_RUNNING,
+        TC_STATE_DYNAMIC
+};
+
+struct vpe;
+typedef struct tc {
+        enum tc_state state;
+        int index;
+
+        /* parent VPE */
+        struct vpe *pvpe;
+
+        /* The list of TC's with this VPE */
+        struct list_head tc;
+
+        /* The global list of tc's */
+        struct list_head list;
+} tc_t;
+
+typedef struct vpe {
+        enum vpe_state state;
+
+        /* (device) minor associated with this vpe */
+        int minor;
+
+        /* elfloader stuff */
+        void *load_addr;
+        u32 len;
+        char *pbuffer;
+        u32 plen;
+
+        unsigned long __start;
+
+        /* tc's associated with this vpe */
+        struct list_head tc;
+
+        /* The list of vpe's */
+        struct list_head list;
+
+        /* shared symbol address */
+        void *shared_ptr;
+} vpe_t;
+
+struct vpecontrol_ {
+        /* Virtual processing elements */
+        struct list_head vpe_list;
+
+        /* Thread contexts */
+        struct list_head tc_list;
+} vpecontrol;
+
+static void release_progmem(void *ptr);
+static void dump_vpe(vpe_t * v);
+extern void save_gp_address(unsigned int secbase, unsigned int rel);
+
+/* get the vpe associated with this minor */
+struct vpe *get_vpe(int minor)
+{
+        struct vpe *v;
+
+        list_for_each_entry(v, &vpecontrol.vpe_list, list) {
+                if (v->minor == minor)
+                        return v;
+        }
+
+        printk(KERN_DEBUG "VPE: get_vpe minor %d not found\n", minor);
+        return NULL;
+}
+
+/* get the vpe associated with this minor */
+struct tc *get_tc(int index)
+{
+        struct tc *t;
+
+        list_for_each_entry(t, &vpecontrol.tc_list, list) {
+                if (t->index == index)
+                        return t;
+        }
+
+        printk(KERN_DEBUG "VPE: get_tc index %d not found\n", index);
+
+        return NULL;
+}
+
+struct tc *get_tc_unused(void)
+{
+        struct tc *t;
+
+        list_for_each_entry(t, &vpecontrol.tc_list, list) {
+                if (t->state == TC_STATE_UNUSED)
+                        return t;
+        }
+
+        printk(KERN_DEBUG "VPE: All TC's are in use\n");
+
+        return NULL;
+}
+
+/* allocate a vpe and associate it with this minor (or index) */
+struct vpe *alloc_vpe(int minor)
+{
+        struct vpe *v;
+
+        if ((v = kmalloc(sizeof(struct vpe), GFP_KERNEL)) == NULL) {
+                printk(KERN_WARNING "VPE: alloc_vpe no mem\n");
+                return NULL;
+        }
+
+        memset(v, 0, sizeof(struct vpe));
+
+        INIT_LIST_HEAD(&v->tc);
+        list_add_tail(&v->list, &vpecontrol.vpe_list);
+
+        v->minor = minor;
+        return v;
+}
+
+/* allocate a tc. At startup only tc0 is running, all other can be halted. */
+struct tc *alloc_tc(int index)
+{
+        struct tc *t;
+
+        if ((t = kmalloc(sizeof(struct tc), GFP_KERNEL)) == NULL) {
+                printk(KERN_WARNING "VPE: alloc_tc no mem\n");
+                return NULL;
+        }
+
+        memset(t, 0, sizeof(struct tc));
+
+        INIT_LIST_HEAD(&t->tc);
+        list_add_tail(&t->list, &vpecontrol.tc_list);
+
+        t->index = index;
+
+        return t;
+}
+
+/* clean up and free everything */
+void release_vpe(struct vpe *v)
+{
+        list_del(&v->list);
+        if (v->load_addr)
+                release_progmem(v);
+        kfree(v);
+}
+
+void dump_mtregs(void)
+{
+        unsigned long val;
+
+        val = read_c0_config3();
+        printk("config3 0x%lx MT %ld\n", val,
+               (val & CONFIG3_MT) >> CONFIG3_MT_SHIFT);
+
+        val = read_c0_mvpconf0();
+        printk("mvpconf0 0x%lx, PVPE %ld PTC %ld M %ld\n", val,
+               (val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT,
+               val & MVPCONF0_PTC, (val & MVPCONF0_M) >> MVPCONF0_M_SHIFT);
+
+        val = read_c0_mvpcontrol();
+        printk("MVPControl 0x%lx, STLB %ld VPC %ld EVP %ld\n", val,
+               (val & MVPCONTROL_STLB) >> MVPCONTROL_STLB_SHIFT,
+               (val & MVPCONTROL_VPC) >> MVPCONTROL_VPC_SHIFT,
+               (val & MVPCONTROL_EVP));
+
+        val = read_c0_vpeconf0();
+        printk("VPEConf0 0x%lx MVP %ld\n", val,
+               (val & VPECONF0_MVP) >> VPECONF0_MVP_SHIFT);
+}
+
+/* Find some VPE program space  */
+static void *alloc_progmem(u32 len)
+{
+#ifdef CONFIG_MIPS_VPE_LOADER_TOM
+        /* this means you must tell linux to use less memory than you physically have */
+        return (void *)((max_pfn * PAGE_SIZE) + KSEG0);
+#else
+        // simple grab some mem for now
+        return kmalloc(len, GFP_KERNEL);
+#endif
+}
+
+static void release_progmem(void *ptr)
+{
+#ifndef CONFIG_MIPS_VPE_LOADER_TOM
+        kfree(ptr);
+#endif
+}
+
+/* Update size with this section: return offset. */
+static long get_offset(unsigned long *size, Elf_Shdr * sechdr)
+{
+        long ret;
+
+        ret = ALIGN(*size, sechdr->sh_addralign ? : 1);
+        *size = ret + sechdr->sh_size;
+        return ret;
+}
+
+/* Lay out the SHF_ALLOC sections in a way not dissimilar to how ld
+   might -- code, read-only data, read-write data, small data.  Tally
+   sizes, and place the offsets into sh_entsize fields: high bit means it
+   belongs in init. */
+static void layout_sections(struct module *mod, const Elf_Ehdr * hdr,
+                            Elf_Shdr * sechdrs, const char *secstrings)
+{
+        static unsigned long const masks[][2] = {
+                /* NOTE: all executable code must be the first section
+                 * in this array; otherwise modify the text_size
+                 * finder in the two loops below */
+                {SHF_EXECINSTR | SHF_ALLOC, ARCH_SHF_SMALL},
+                {SHF_ALLOC, SHF_WRITE | ARCH_SHF_SMALL},
+                {SHF_WRITE | SHF_ALLOC, ARCH_SHF_SMALL},
+                {ARCH_SHF_SMALL | SHF_ALLOC, 0}
+        };
+        unsigned int m, i;
+
+        for (i = 0; i < hdr->e_shnum; i++)
+                sechdrs[i].sh_entsize = ~0UL;
+
+        for (m = 0; m < ARRAY_SIZE(masks); ++m) {
+                for (i = 0; i < hdr->e_shnum; ++i) {
+                        Elf_Shdr *s = &sechdrs[i];
+
+                        //  || strncmp(secstrings + s->sh_name, ".init", 5) == 0)
+                        if ((s->sh_flags & masks[m][0]) != masks[m][0]
+                            || (s->sh_flags & masks[m][1])
+                            || s->sh_entsize != ~0UL)
+                                continue;
+                        s->sh_entsize = get_offset(&mod->core_size, s);
+                }
+
+                if (m == 0)
+                        mod->core_text_size = mod->core_size;
+
+        }
+}
+
+
+/* from module-elf32.c, but subverted a little */
+
+struct mips_hi16 {
+        struct mips_hi16 *next;
+        Elf32_Addr *addr;
+        Elf32_Addr value;
+};
+
+static struct mips_hi16 *mips_hi16_list;
+static unsigned int gp_offs, gp_addr;
+
+static int apply_r_mips_none(struct module *me, uint32_t *location,
+                             Elf32_Addr v)
+{
+        return 0;
+}
+
+static int apply_r_mips_gprel16(struct module *me, uint32_t *location,
+                                Elf32_Addr v)
+{
+        int rel;
+
+        if( !(*location & 0xffff) ) {
+                rel = (int)v - gp_addr;
+        }
+        else {
+                /* .sbss + gp(relative) + offset */
+                /* kludge! */
+                rel =  (int)(short)((int)v + gp_offs +
+                                    (int)(short)(*location & 0xffff) - gp_addr);
+        }
+
+        if( (rel > 32768) || (rel < -32768) ) {
+                printk(KERN_ERR
+                       "apply_r_mips_gprel16: relative address out of range 0x%x %d\n",
+                       rel, rel);
+                return -ENOEXEC;
+        }
+
+        *location = (*location & 0xffff0000) | (rel & 0xffff);
+
+        return 0;
+}
+
+static int apply_r_mips_pc16(struct module *me, uint32_t *location,
+                             Elf32_Addr v)
+{
+        int rel;
+        rel = (((unsigned int)v - (unsigned int)location));
+        rel >>= 2;              // because the offset is in _instructions_ not bytes.
+        rel -= 1;               // and one instruction less due to the branch delay slot.
+
+        if( (rel > 32768) || (rel < -32768) ) {
+                printk(KERN_ERR
+                       "apply_r_mips_pc16: relative address out of range 0x%x\n", rel);
+                return -ENOEXEC;
+        }
+
+        *location = (*location & 0xffff0000) | (rel & 0xffff);
+
+        return 0;
+}
+
+static int apply_r_mips_32(struct module *me, uint32_t *location,
+                           Elf32_Addr v)
+{
+        *location += v;
+
+        return 0;
+}
+
+static int apply_r_mips_26(struct module *me, uint32_t *location,
+                           Elf32_Addr v)
+{
+        if (v % 4) {
+                printk(KERN_ERR "module %s: dangerous relocation mod4\n", me->name);
+                return -ENOEXEC;
+        }
+
+/* Not desperately convinced this is a good check of an overflow condition
+   anyway. But it gets in the way of handling undefined weak symbols which
+   we want to set to zero.
+   if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
+   printk(KERN_ERR
+   "module %s: relocation overflow\n",
+   me->name);
+   return -ENOEXEC;
+   }
+*/
+
+        *location = (*location & ~0x03ffffff) |
+                ((*location + (v >> 2)) & 0x03ffffff);
+        return 0;
+}
+
+static int apply_r_mips_hi16(struct module *me, uint32_t *location,
+                             Elf32_Addr v)
+{
+        struct mips_hi16 *n;
+
+        /*
+         * We cannot relocate this one now because we don't know the value of
+         * the carry we need to add.  Save the information, and let LO16 do the
+         * actual relocation.
+         */
+        n = kmalloc(sizeof *n, GFP_KERNEL);
+        if (!n)
+                return -ENOMEM;
+
+        n->addr = location;
+        n->value = v;
+        n->next = mips_hi16_list;
+        mips_hi16_list = n;
+
+        return 0;
+}
+
+static int apply_r_mips_lo16(struct module *me, uint32_t *location,
+                             Elf32_Addr v)
+{
+        unsigned long insnlo = *location;
+        Elf32_Addr val, vallo;
+
+        /* Sign extend the addend we extract from the lo insn.  */
+        vallo = ((insnlo & 0xffff) ^ 0x8000) - 0x8000;
+
+        if (mips_hi16_list != NULL) {
+                struct mips_hi16 *l;
+
+                l = mips_hi16_list;
+                while (l != NULL) {
+                        struct mips_hi16 *next;
+                        unsigned long insn;
+
+                        /*
+                         * The value for the HI16 had best be the same.
+                         */
+                        if (v != l->value) {
+                                printk("%d != %d\n", v, l->value);
+                                goto out_danger;
+                        }
+
+
+                        /*
+                         * Do the HI16 relocation.  Note that we actually don't
+                         * need to know anything about the LO16 itself, except
+                         * where to find the low 16 bits of the addend needed
+                         * by the LO16.
+                         */
+                        insn = *l->addr;
+                        val = ((insn & 0xffff) << 16) + vallo;
+                        val += v;
+
+                        /*
+                         * Account for the sign extension that will happen in
+                         * the low bits.
+                         */
+                        val = ((val >> 16) + ((val & 0x8000) != 0)) & 0xffff;
+
+                        insn = (insn & ~0xffff) | val;
+                        *l->addr = insn;
+
+                        next = l->next;
+                        kfree(l);
+                        l = next;
+                }
+
+                mips_hi16_list = NULL;
+        }
+
+        /*
+         * Ok, we're done with the HI16 relocs.  Now deal with the LO16.
+         */
+        val = v + vallo;
+        insnlo = (insnlo & ~0xffff) | (val & 0xffff);
+        *location = insnlo;
+
+        return 0;
+
+out_danger:
+        printk(KERN_ERR "module %s: dangerous " "relocation\n", me->name);
+
+        return -ENOEXEC;
+}
+
+static int (*reloc_handlers[]) (struct module *me, uint32_t *location,
+                                Elf32_Addr v) = {
+        [R_MIPS_NONE]   = apply_r_mips_none,
+        [R_MIPS_32]     = apply_r_mips_32,
+        [R_MIPS_26]     = apply_r_mips_26,
+        [R_MIPS_HI16]   = apply_r_mips_hi16,
+        [R_MIPS_LO16]   = apply_r_mips_lo16,
+        [R_MIPS_GPREL16] = apply_r_mips_gprel16,
+        [R_MIPS_PC16] = apply_r_mips_pc16
+};
+
+
+int apply_relocations(Elf32_Shdr *sechdrs,
+                      const char *strtab,
+                      unsigned int symindex,
+                      unsigned int relsec,
+                      struct module *me)
+{
+        Elf32_Rel *rel = (void *) sechdrs[relsec].sh_addr;
+        Elf32_Sym *sym;
+        uint32_t *location;
+        unsigned int i;
+        Elf32_Addr v;
+        int res;
+
+        for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
+                Elf32_Word r_info = rel[i].r_info;
+
+                /* This is where to make the change */
+                location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
+                        + rel[i].r_offset;
+                /* This is the symbol it is referring to */
+                sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
+                        + ELF32_R_SYM(r_info);
+
+                if (!sym->st_value) {
+                        printk(KERN_DEBUG "%s: undefined weak symbol %s\n",
+                               me->name, strtab + sym->st_name);
+                        /* just print the warning, dont barf */
+                }
+
+                v = sym->st_value;
+
+                res = reloc_handlers[ELF32_R_TYPE(r_info)](me, location, v);
+                if( res ) {
+                        printk(KERN_DEBUG
+                               "relocation error 0x%x sym refer <%s> value 0x%x "
+                               "type 0x%x r_info 0x%x\n",
+                               (unsigned int)location, strtab + sym->st_name, v,
+                               r_info, ELF32_R_TYPE(r_info));
+                }
+
+                if (res)
+                        return res;
+        }
+
+        return 0;
+}
+
+void save_gp_address(unsigned int secbase, unsigned int rel)
+{
+        gp_addr = secbase + rel;
+        gp_offs = gp_addr - (secbase & 0xffff0000);
+}
+/* end module-elf32.c */
+
+
+
+/* Change all symbols so that sh_value encodes the pointer directly. */
+static int simplify_symbols(Elf_Shdr * sechdrs,
+                            unsigned int symindex,
+                            const char *strtab,
+                            const char *secstrings,
+                            unsigned int nsecs, struct module *mod)
+{
+        Elf_Sym *sym = (void *)sechdrs[symindex].sh_addr;
+        unsigned long secbase, bssbase = 0;
+        unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+        int ret = 0, size;
+
+        /* find the .bss section for COMMON symbols */
+        for (i = 0; i < nsecs; i++) {
+                if (strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) == 0)
+                        bssbase = sechdrs[i].sh_addr;
+        }
+
+        for (i = 1; i < n; i++) {
+                switch (sym[i].st_shndx) {
+                case SHN_COMMON:
+                        /* Allocate space for the symbol in the .bss section. st_value is currently size.
+                           We want it to have the address of the symbol. */
+
+                        size = sym[i].st_value;
+                        sym[i].st_value = bssbase;
+
+                        bssbase += size;
+                        break;
+
+                case SHN_ABS:
+                        /* Don't need to do anything */
+                        break;
+
+                case SHN_UNDEF:
+                        /* ret = -ENOENT; */
+                        break;
+
+                case SHN_MIPS_SCOMMON:
+
+                        printk(KERN_DEBUG
+                               "simplify_symbols: ignoring SHN_MIPS_SCOMMON symbol <%s> st_shndx %d\n",
+                               strtab + sym[i].st_name, sym[i].st_shndx);
+
+                        // .sbss section
+                        break;
+
+                default:
+                        secbase = sechdrs[sym[i].st_shndx].sh_addr;
+
+                        if (strncmp(strtab + sym[i].st_name, "_gp", 3) == 0) {
+                                save_gp_address(secbase, sym[i].st_value);
+                        }
+
+                        sym[i].st_value += secbase;
+                        break;
+                }
+
+        }
+
+        return ret;
+}
+
+#ifdef DEBUG_ELFLOADER
+static void dump_elfsymbols(Elf_Shdr * sechdrs, unsigned int symindex,
+                            const char *strtab, struct module *mod)
+{
+        Elf_Sym *sym = (void *)sechdrs[symindex].sh_addr;
+        unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+
+        printk(KERN_DEBUG "dump_elfsymbols: n %d\n", n);
+        for (i = 1; i < n; i++) {
+                printk(KERN_DEBUG " i %d name <%s> 0x%x\n", i,
+                       strtab + sym[i].st_name, sym[i].st_value);
+        }
+}
+#endif
+
+static void dump_tc(struct tc *t)
+{
+        printk(KERN_WARNING "VPE: TC index %d TCStatus 0x%lx halt 0x%lx\n",
+               t->index, read_tc_c0_tcstatus(), read_tc_c0_tchalt());
+        printk(KERN_WARNING "VPE: tcrestart 0x%lx\n", read_tc_c0_tcrestart());
+}
+
+static void dump_tclist(void)
+{
+        struct tc *t;
+
+        list_for_each_entry(t, &vpecontrol.tc_list, list) {
+                dump_tc(t);
+        }
+}
+
+/* We are prepared so configure and start the VPE... */
+int vpe_run(vpe_t * v)
+{
+        unsigned long val;
+        struct tc *t;
+
+        /* check we are the Master VPE */
+        val = read_c0_vpeconf0();
+        if (!(val & VPECONF0_MVP)) {
+                printk(KERN_WARNING
+                       "VPE: only Master VPE's are allowed to configure MT\n");
+                return -1;
+        }
+
+        /* disable MT (using dvpe) */
+        dvpe();
+
+        /* Put MVPE's into 'configuration state' */
+        write_c0_mvpcontrol(read_c0_mvpcontrol() | MVPCONTROL_VPC);
+
+        if (!list_empty(&v->tc)) {
+                if ((t = list_entry(v->tc.next, struct tc, tc)) == NULL) {
+                        printk(KERN_WARNING "VPE: TC %d is already in use.\n",
+                               t->index);
+                        return -ENOEXEC;
+                }
+        } else {
+                printk(KERN_WARNING "VPE: No TC's associated with VPE %d\n",
+                       v->minor);
+                return -ENOEXEC;
+        }
+
+        settc(t->index);
+
+        val = read_vpe_c0_vpeconf0();
+
+        /* should check it is halted, and not activated */
+        if ((read_tc_c0_tcstatus() & TCSTATUS_A) || !(read_tc_c0_tchalt() & TCHALT_H)) {
+                printk(KERN_WARNING "VPE: TC %d is already doing something!\n",
+                       t->index);
+
+                dump_tclist();
+                return -ENOEXEC;
+        }
+
+        /* Write the address we want it to start running from in the TCPC register. */
+        write_tc_c0_tcrestart((unsigned long)v->__start);
+
+        /* write the sivc_info address to tccontext */
+        write_tc_c0_tccontext((unsigned long)0);
+
+        /* Set up the XTC bit in vpeconf0 to point at our tc */
+        write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() | (t->index << VPECONF0_XTC_SHIFT));
+
+        /* mark the TC as activated, not interrupt exempt and not dynamically allocatable */
+        val = read_tc_c0_tcstatus();
+        val = (val & ~(TCSTATUS_DA | TCSTATUS_IXMT)) | TCSTATUS_A;
+        write_tc_c0_tcstatus(val);
+
+        write_tc_c0_tchalt(read_tc_c0_tchalt() & ~TCHALT_H);
+
+        /* set up VPE1 */
+        write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() & ~VPECONTROL_TE);     // no multiple TC's
+        write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() | VPECONF0_VPA);   // enable this VPE
+
+        /*
+         * The sde-kit passes 'memsize' to __start in $a3, so set something
+         * here...
+         * Or set $a3 (register 7) to zero and define DFLT_STACK_SIZE and
+         * DFLT_HEAP_SIZE when you compile your program
+         */
+
+        mttgpr(7, 0);
+
+        /* set config to be the same as vpe0, particularly kseg0 coherency alg */
+        write_vpe_c0_config(read_c0_config());
+
+        /* clear out any left overs from a previous program */
+        write_vpe_c0_cause(0);
+
+        /* take system out of configuration state */
+        write_c0_mvpcontrol(read_c0_mvpcontrol() & ~MVPCONTROL_VPC);
+
+        /* clear interrupts enabled IE, ERL, EXL, and KSU from c0 status */
+        write_vpe_c0_status(read_vpe_c0_status() & ~(ST0_ERL | ST0_KSU | ST0_IE | ST0_EXL));
+
+        /* set it running */
+        evpe(EVPE_ENABLE);
+
+        return 0;
+}
+
+static unsigned long find_vpe_symbols(vpe_t * v, Elf_Shdr * sechdrs,
+                                      unsigned int symindex, const char *strtab,
+                                      struct module *mod)
+{
+        Elf_Sym *sym = (void *)sechdrs[symindex].sh_addr;
+        unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+
+        for (i = 1; i < n; i++) {
+                if (strcmp(strtab + sym[i].st_name, "__start") == 0) {
+                        v->__start = sym[i].st_value;
+                }
+
+                if (strcmp(strtab + sym[i].st_name, "vpe_shared") == 0) {
+                        v->shared_ptr = (void *)sym[i].st_value;
+                }
+        }
+
+        return 0;
+}
+
+/* Allocates a VPE with some program code space(the load address), copies the contents
+   of the program (p)buffer performing relocatations/etc, free's it when finished.
+*/
+int vpe_elfload(vpe_t * v)
+{
+        Elf_Ehdr *hdr;
+        Elf_Shdr *sechdrs;
+        long err = 0;
+        char *secstrings, *strtab = NULL;
+        unsigned int len, i, symindex = 0, strindex = 0;
+
+        struct module mod;      // so we can re-use the relocations code
+
+        memset(&mod, 0, sizeof(struct module));
+        strcpy(mod.name, "VPE dummy prog module");
+
+        hdr = (Elf_Ehdr *) v->pbuffer;
+        len = v->plen;
+
+        /* Sanity checks against insmoding binaries or wrong arch,
+           weird elf version */
+        if (memcmp(hdr->e_ident, ELFMAG, 4) != 0
+            || hdr->e_type != ET_REL || !elf_check_arch(hdr)
+            || hdr->e_shentsize != sizeof(*sechdrs)) {
+                printk(KERN_WARNING
+                       "VPE program, wrong arch or weird elf version\n");
+
+                return -ENOEXEC;
+        }
+
+        if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) {
+                printk(KERN_ERR "VPE program length %u truncated\n", len);
+                return -ENOEXEC;
+        }
+
+        /* Convenience variables */
+        sechdrs = (void *)hdr + hdr->e_shoff;
+        secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
+        sechdrs[0].sh_addr = 0;
+
+        /* And these should exist, but gcc whinges if we don't init them */
+        symindex = strindex = 0;
+
+        for (i = 1; i < hdr->e_shnum; i++) {
+
+                if (sechdrs[i].sh_type != SHT_NOBITS
+                    && len < sechdrs[i].sh_offset + sechdrs[i].sh_size) {
+                        printk(KERN_ERR "VPE program length %u truncated\n",
+                               len);
+                        return -ENOEXEC;
+                }
+
+                /* Mark all sections sh_addr with their address in the
+                   temporary image. */
+                sechdrs[i].sh_addr = (size_t) hdr + sechdrs[i].sh_offset;
+
+                /* Internal symbols and strings. */
+                if (sechdrs[i].sh_type == SHT_SYMTAB) {
+                        symindex = i;
+                        strindex = sechdrs[i].sh_link;
+                        strtab = (char *)hdr + sechdrs[strindex].sh_offset;
+                }
+        }
+
+        layout_sections(&mod, hdr, sechdrs, secstrings);
+
+        v->load_addr = alloc_progmem(mod.core_size);
+        memset(v->load_addr, 0, mod.core_size);
+
+        printk("VPE elf_loader: loading to %p\n", v->load_addr);
+
+        for (i = 0; i < hdr->e_shnum; i++) {
+                void *dest;
+
+                if (!(sechdrs[i].sh_flags & SHF_ALLOC))
+                        continue;
+
+                dest = v->load_addr + sechdrs[i].sh_entsize;
+
+                if (sechdrs[i].sh_type != SHT_NOBITS)
+                        memcpy(dest, (void *)sechdrs[i].sh_addr,
+                               sechdrs[i].sh_size);
+                /* Update sh_addr to point to copy in image. */
+                sechdrs[i].sh_addr = (unsigned long)dest;
+        }
+
+        /* Fix up syms, so that st_value is a pointer to location. */
+        err =
+                simplify_symbols(sechdrs, symindex, strtab, secstrings,
+                                 hdr->e_shnum, &mod);
+        if (err < 0) {
+                printk(KERN_WARNING "VPE: unable to simplify symbols\n");
+                goto cleanup;
+        }
+
+        /* Now do relocations. */
+        for (i = 1; i < hdr->e_shnum; i++) {
+                const char *strtab = (char *)sechdrs[strindex].sh_addr;
+                unsigned int info = sechdrs[i].sh_info;
+
+                /* Not a valid relocation section? */
+                if (info >= hdr->e_shnum)
+                        continue;
+
+                /* Don't bother with non-allocated sections */
+                if (!(sechdrs[info].sh_flags & SHF_ALLOC))
+                        continue;
+
+                if (sechdrs[i].sh_type == SHT_REL)
+                        err =
+                                apply_relocations(sechdrs, strtab, symindex, i, &mod);
+                else if (sechdrs[i].sh_type == SHT_RELA)
+                        err = apply_relocate_add(sechdrs, strtab, symindex, i,
+                                                 &mod);
+                if (err < 0) {
+                        printk(KERN_WARNING
+                               "vpe_elfload: error in relocations err %ld\n",
+                               err);
+                        goto cleanup;
+                }
+        }
+
+        /* make sure it's physically written out */
+        flush_icache_range((unsigned long)v->load_addr,
+                           (unsigned long)v->load_addr + v->len);
+
+        if ((find_vpe_symbols(v, sechdrs, symindex, strtab, &mod)) < 0) {
+
+                printk(KERN_WARNING
+                       "VPE: program doesn't contain __start or vpe_shared symbols\n");
+                err = -ENOEXEC;
+        }
+
+        printk(" elf loaded\n");
+
+cleanup:
+        return err;
+}
+
+static void dump_vpe(vpe_t * v)
+{
+        struct tc *t;
+
+        printk(KERN_DEBUG "VPEControl 0x%lx\n", read_vpe_c0_vpecontrol());
+        printk(KERN_DEBUG "VPEConf0 0x%lx\n", read_vpe_c0_vpeconf0());
+
+        list_for_each_entry(t, &vpecontrol.tc_list, list) {
+                dump_tc(t);
+        }
+}
+
+/* checks for VPE is unused and gets ready to load program       */
+static int vpe_open(struct inode *inode, struct file *filp)
+{
+        int minor;
+        vpe_t *v;
+
+        /* assume only 1 device at the mo. */
+        if ((minor = MINOR(inode->i_rdev)) != 1) {
+                printk(KERN_WARNING "VPE: only vpe1 is supported\n");
+                return -ENODEV;
+        }
+
+        if ((v = get_vpe(minor)) == NULL) {
+                printk(KERN_WARNING "VPE: unable to get vpe\n");
+                return -ENODEV;
+        }
+
+        if (v->state != VPE_STATE_UNUSED) {
+                unsigned long tmp;
+                struct tc *t;
+
+                printk(KERN_WARNING "VPE: device %d already in use\n", minor);
+
+                dvpe();
+                dump_vpe(v);
+
+                printk(KERN_WARNING "VPE: re-initialising %d\n", minor);
+
+                release_progmem(v->load_addr);
+
+                t = get_tc(minor);
+                settc(minor);
+                tmp = read_tc_c0_tcstatus();
+
+                /* mark not allocated and not dynamically allocatable */
+                tmp &= ~(TCSTATUS_A | TCSTATUS_DA);
+                tmp |= TCSTATUS_IXMT;   /* interrupt exempt */
+                write_tc_c0_tcstatus(tmp);
+
+                write_tc_c0_tchalt(TCHALT_H);
+
+        }
+
+        // allocate it so when we get write ops we know it's expected.
+        v->state = VPE_STATE_INUSE;
+
+        /* this of-course trashes what was there before... */
+        v->pbuffer = vmalloc(P_SIZE);
+        v->plen = P_SIZE;
+        v->load_addr = NULL;
+        v->len = 0;
+
+        return 0;
+}
+
+static int vpe_release(struct inode *inode, struct file *filp)
+{
+        int minor, ret = 0;
+        vpe_t *v;
+        Elf_Ehdr *hdr;
+
+        minor = MINOR(inode->i_rdev);
+        if ((v = get_vpe(minor)) == NULL)
+                return -ENODEV;
+
+        // simple case of fire and forget, so tell the VPE to run...
+
+        hdr = (Elf_Ehdr *) v->pbuffer;
+        if (memcmp(hdr->e_ident, ELFMAG, 4) == 0) {
+                if (vpe_elfload(v) >= 0)
+                        vpe_run(v);
+                else {
+                        printk(KERN_WARNING "VPE: ELF load failed.\n");
+                        ret = -ENOEXEC;
+                }
+        } else {
+                printk(KERN_WARNING "VPE: only elf files are supported\n");
+                ret = -ENOEXEC;
+        }
+
+        // cleanup any temp buffers
+        if (v->pbuffer)
+                vfree(v->pbuffer);
+        v->plen = 0;
+        return ret;
+}
+
+static ssize_t vpe_write(struct file *file, const char __user * buffer,
+                         size_t count, loff_t * ppos)
+{
+        int minor;
+        size_t ret = count;
+        vpe_t *v;
+
+        minor = MINOR(file->f_dentry->d_inode->i_rdev);
+        if ((v = get_vpe(minor)) == NULL)
+                return -ENODEV;
+
+        if (v->pbuffer == NULL) {
+                printk(KERN_ERR "vpe_write: no pbuffer\n");
+                return -ENOMEM;
+        }
+
+        if ((count + v->len) > v->plen) {
+                printk(KERN_WARNING
+                       "VPE Loader: elf size too big. Perhaps strip uneeded symbols\n");
+                return -ENOMEM;
+        }
+
+        count -= copy_from_user(v->pbuffer + v->len, buffer, count);
+        if (!count) {
+                printk("vpe_write: copy_to_user failed\n");
+                return -EFAULT;
+        }
+
+        v->len += count;
+        return ret;
+}
+
+static struct file_operations vpe_fops = {
+        .owner = THIS_MODULE,
+        .open = vpe_open,
+        .release = vpe_release,
+        .write = vpe_write
+};
+
+/* module wrapper entry points */
+/* give me a vpe */
+vpe_handle vpe_alloc(void)
+{
+        int i;
+        struct vpe *v;
+
+        /* find a vpe */
+        for (i = 1; i < MAX_VPES; i++) {
+                if ((v = get_vpe(i)) != NULL) {
+                        v->state = VPE_STATE_INUSE;
+                        return v;
+                }
+        }
+        return NULL;
+}
+
+EXPORT_SYMBOL(vpe_alloc);
+
+/* start running from here */
+int vpe_start(vpe_handle vpe, unsigned long start)
+{
+        struct vpe *v = vpe;
+
+        v->__start = start;
+        return vpe_run(v);
+}
+
+EXPORT_SYMBOL(vpe_start);
+
+/* halt it for now */
+int vpe_stop(vpe_handle vpe)
+{
+        struct vpe *v = vpe;
+        struct tc *t;
+        unsigned int evpe_flags;
+
+        evpe_flags = dvpe();
+
+        if ((t = list_entry(v->tc.next, struct tc, tc)) != NULL) {
+
+                settc(t->index);
+                write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() & ~VPECONF0_VPA);
+        }
+
+        evpe(evpe_flags);
+
+        return 0;
+}
+
+EXPORT_SYMBOL(vpe_stop);
+
+/* I've done with it thank you */
+int vpe_free(vpe_handle vpe)
+{
+        struct vpe *v = vpe;
+        struct tc *t;
+        unsigned int evpe_flags;
+
+        if ((t = list_entry(v->tc.next, struct tc, tc)) == NULL) {
+                return -ENOEXEC;
+        }
+
+        evpe_flags = dvpe();
+
+        /* Put MVPE's into 'configuration state' */
+        write_c0_mvpcontrol(read_c0_mvpcontrol() | MVPCONTROL_VPC);
+
+        settc(t->index);
+        write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() & ~VPECONF0_VPA);
+
+        /* mark the TC unallocated and halt'ed */
+        write_tc_c0_tcstatus(read_tc_c0_tcstatus() & ~TCSTATUS_A);
+        write_tc_c0_tchalt(TCHALT_H);
+
+        v->state = VPE_STATE_UNUSED;
+
+        write_c0_mvpcontrol(read_c0_mvpcontrol() & ~MVPCONTROL_VPC);
+        evpe(evpe_flags);
+
+        return 0;
+}
+
+EXPORT_SYMBOL(vpe_free);
+
+void *vpe_get_shared(int index)
+{
+        struct vpe *v;
+
+        if ((v = get_vpe(index)) == NULL) {
+                printk(KERN_WARNING "vpe: invalid vpe index %d\n", index);
+                return NULL;
+        }
+
+        return v->shared_ptr;
+}
+
+EXPORT_SYMBOL(vpe_get_shared);
+
+static int __init vpe_module_init(void)
+{
+        struct vpe *v = NULL;
+        struct tc *t;
+        unsigned long val;
+        int i;
+
+        if (!cpu_has_mipsmt) {
+                printk("VPE loader: not a MIPS MT capable processor\n");
+                return -ENODEV;
+        }
+
+        if ((major = register_chrdev(VPE_MAJOR, module_name, &vpe_fops) < 0)) {
+                printk("VPE loader: unable to register character device\n");
+                return -EBUSY;
+        }
+
+        if (major == 0)
+                major = VPE_MAJOR;
+
+        dmt();
+        dvpe();
+
+        /* Put MVPE's into 'configuration state' */
+        write_c0_mvpcontrol(read_c0_mvpcontrol() | MVPCONTROL_VPC);
+
+        /* dump_mtregs(); */
+
+        INIT_LIST_HEAD(&vpecontrol.vpe_list);
+        INIT_LIST_HEAD(&vpecontrol.tc_list);
+
+        val = read_c0_mvpconf0();
+        for (i = 0; i < ((val & MVPCONF0_PTC) + 1); i++) {
+                t = alloc_tc(i);
+
+                /* VPE's */
+                if (i < ((val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT) + 1) {
+                        settc(i);
+
+                        if ((v = alloc_vpe(i)) == NULL) {
+                                printk(KERN_WARNING "VPE: unable to allocate VPE\n");
+                                return -ENODEV;
+                        }
+
+                        list_add(&t->tc, &v->tc);       /* add the tc to the list of this vpe's tc's. */
+
+                        /* deactivate all but vpe0 */
+                        if (i != 0) {
+                                unsigned long tmp = read_vpe_c0_vpeconf0();
+
+                                tmp &= ~VPECONF0_VPA;
+
+                                /* master VPE */
+                                tmp |= VPECONF0_MVP;
+                                write_vpe_c0_vpeconf0(tmp);
+                        }
+
+                        /* disable multi-threading with TC's */
+                        write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() & ~VPECONTROL_TE);
+
+                        if (i != 0) {
+                                write_vpe_c0_status((read_c0_status() &
+                                                     ~(ST0_IM | ST0_IE | ST0_KSU))
+                                                    | ST0_CU0);
+
+                                /* set config to be the same as vpe0, particularly kseg0 coherency alg */
+                                write_vpe_c0_config(read_c0_config());
+                        }
+
+                }
+
+                /* TC's */
+                t->pvpe = v;    /* set the parent vpe */
+
+                if (i != 0) {
+                        unsigned long tmp;
+
+                        /* tc 0 will of course be running.... */
+                        if (i == 0)
+                                t->state = TC_STATE_RUNNING;
+
+                        settc(i);
+
+                        /* bind a TC to each VPE, May as well put all excess TC's
+                           on the last VPE */
+                        if (i >= (((val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT) + 1))
+                                write_tc_c0_tcbind(read_tc_c0_tcbind() |
+                                                   ((val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT));
+                        else
+                                write_tc_c0_tcbind(read_tc_c0_tcbind() | i);
+
+                        tmp = read_tc_c0_tcstatus();
+
+                        /* mark not allocated and not dynamically allocatable */
+                        tmp &= ~(TCSTATUS_A | TCSTATUS_DA);
+                        tmp |= TCSTATUS_IXMT;   /* interrupt exempt */
+                        write_tc_c0_tcstatus(tmp);
+
+                        write_tc_c0_tchalt(TCHALT_H);
+                }
+        }
+
+        /* release config state */
+        write_c0_mvpcontrol(read_c0_mvpcontrol() & ~MVPCONTROL_VPC);
+
+        return 0;
+}
+
+static void __exit vpe_module_exit(void)
+{
+        struct vpe *v, *n;
+
+        list_for_each_entry_safe(v, n, &vpecontrol.vpe_list, list) {
+                if (v->state != VPE_STATE_UNUSED) {
+                        release_vpe(v);
+                }
+        }
+
+        unregister_chrdev(major, module_name);
+}
+
+module_init(vpe_module_init);
+module_exit(vpe_module_exit);
+MODULE_DESCRIPTION("MIPS VPE Loader");
+MODULE_AUTHOR("Elizabeth Clarke, MIPS Technologies, Inc");
+MODULE_LICENSE("GPL");