Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160712' into staging

MIPS patches 2016-07-12

Changes:
* support 10-bit ASIDs
* MIPS64R6-generic renamed to I6400
* initial GIC support
* implement RESET_BASE register in CM GCR

# gpg: Signature made Tue 12 Jul 2016 11:49:50 BST
# gpg:                using RSA key 0x52118E3C0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
# Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

* remotes/lalrae/tags/mips-20160712:
  target-mips: enable 10-bit ASIDs in I6400 CPU
  target-mips: support CP0.Config4.AE bit
  target-mips: change ASID type to hold more than 8 bits
  target-mips: add ASID mask field and replace magic values
  target-mips: replace MIPS64R6-generic with the real I6400 CPU model
  hw/mips_cmgcr: implement RESET_BASE register in CM GCR
  hw/mips_cpc: make VP correctly start from the reset vector
  target-mips: add exception base to MIPS CPU
  hw/mips/cps: create GIC block inside CPS
  hw/mips: implement Global Interrupt Controller
  hw/mips: implement GIC Interval Timer

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

18 files changed, 1059 insertions, 56 deletions

diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index 530df2eba6..05ec21b21e 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -37,3 +37,4 @@ obj-$(CONFIG_S390_FLIC) += s390_flic.o
 obj-$(CONFIG_S390_FLIC_KVM) += s390_flic_kvm.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_vic.o
 obj-$(CONFIG_ARM_GIC) += arm_gicv3_cpuif.o
+obj-$(CONFIG_MIPS_CPS) += mips_gic.o
diff --git a/hw/intc/mips_gic.c b/hw/intc/mips_gic.c
new file mode 100644
index 0000000000..6e257730f8
--- /dev/null
+++ b/hw/intc/mips_gic.c
@@ -0,0 +1,460 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2012  MIPS Technologies, Inc.  All rights reserved.
+ * Authors: Sanjay Lal <sanjayl@kymasys.com>
+ *
+ * Copyright (C) 2016 Imagination Technologies
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "exec/memory.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
+#include "kvm_mips.h"
+#include "hw/intc/mips_gic.h"
+
+static void mips_gic_set_vp_irq(MIPSGICState *gic, int vp, int pin, int level)
+{
+    int ored_level = level;
+    int i;
+
+    /* ORing pending registers sharing same pin */
+    if (!ored_level) {
+        for (i = 0; i < gic->num_irq; i++) {
+            if ((gic->irq_state[i].map_pin & GIC_MAP_MSK) == pin &&
+                    gic->irq_state[i].map_vp == vp &&
+                    gic->irq_state[i].enabled) {
+                ored_level |= gic->irq_state[i].pending;
+            }
+            if (ored_level) {
+                /* no need to iterate all interrupts */
+                break;
+            }
+        }
+        if (((gic->vps[vp].compare_map & GIC_MAP_MSK) == pin) &&
+                (gic->vps[vp].mask & GIC_VP_MASK_CMP_MSK)) {
+            /* ORing with local pending register (count/compare) */
+            ored_level |= (gic->vps[vp].pend & GIC_VP_MASK_CMP_MSK) >>
+                          GIC_VP_MASK_CMP_SHF;
+        }
+    }
+    if (kvm_enabled())  {
+        kvm_mips_set_ipi_interrupt(mips_env_get_cpu(gic->vps[vp].env),
+                                   pin + GIC_CPU_PIN_OFFSET,
+                                   ored_level);
+    } else {
+        qemu_set_irq(gic->vps[vp].env->irq[pin + GIC_CPU_PIN_OFFSET],
+                     ored_level);
+    }
+}
+
+static void gic_set_irq(void *opaque, int n_IRQ, int level)
+{
+    MIPSGICState *gic = (MIPSGICState *) opaque;
+    int vp = gic->irq_state[n_IRQ].map_vp;
+    int pin = gic->irq_state[n_IRQ].map_pin & GIC_MAP_MSK;
+
+    gic->irq_state[n_IRQ].pending = (uint8_t) level;
+    if (!gic->irq_state[n_IRQ].enabled) {
+        /* GIC interrupt source disabled */
+        return;
+    }
+    if (vp < 0 || vp >= gic->num_vps) {
+        return;
+    }
+    mips_gic_set_vp_irq(gic, vp, pin, level);
+}
+
+#define OFFSET_CHECK(c)                         \
+    do {                                        \
+        if (!(c)) {                             \
+            goto bad_offset;                    \
+        }                                       \
+    } while (0)
+
+/* GIC Read VP Local/Other Registers */
+static uint64_t gic_read_vp(MIPSGICState *gic, uint32_t vp_index, hwaddr addr,
+                            unsigned size)
+{
+    switch (addr) {
+    case GIC_VP_CTL_OFS:
+        return gic->vps[vp_index].ctl;
+    case GIC_VP_PEND_OFS:
+        mips_gictimer_get_sh_count(gic->gic_timer);
+        return gic->vps[vp_index].pend;
+    case GIC_VP_MASK_OFS:
+        return gic->vps[vp_index].mask;
+    case GIC_VP_COMPARE_MAP_OFS:
+        return gic->vps[vp_index].compare_map;
+    case GIC_VP_OTHER_ADDR_OFS:
+        return gic->vps[vp_index].other_addr;
+    case GIC_VP_IDENT_OFS:
+        return vp_index;
+    case GIC_VP_COMPARE_LO_OFS:
+        return mips_gictimer_get_vp_compare(gic->gic_timer, vp_index);
+    case GIC_VP_COMPARE_HI_OFS:
+        return 0;
+    default:
+        qemu_log_mask(LOG_UNIMP, "Read %d bytes at GIC offset LOCAL/OTHER 0x%"
+                      PRIx64 "\n", size, addr);
+        break;
+    }
+    return 0;
+}
+
+static uint64_t gic_read(void *opaque, hwaddr addr, unsigned size)
+{
+    MIPSGICState *gic = (MIPSGICState *) opaque;
+    uint32_t vp_index = current_cpu->cpu_index;
+    uint64_t ret = 0;
+    int i, base, irq_src;
+    uint32_t other_index;
+
+    switch (addr) {
+    case GIC_SH_CONFIG_OFS:
+        ret = gic->sh_config | (mips_gictimer_get_countstop(gic->gic_timer) <<
+                               GIC_SH_CONFIG_COUNTSTOP_SHF);
+        break;
+    case GIC_SH_COUNTERLO_OFS:
+        ret = mips_gictimer_get_sh_count(gic->gic_timer);
+        break;
+    case GIC_SH_COUNTERHI_OFS:
+        ret = 0;
+        break;
+    case GIC_SH_PEND_OFS ... GIC_SH_PEND_LAST_OFS:
+        /* each bit represents pending status for an interrupt pin */
+        base = (addr - GIC_SH_PEND_OFS) * 8;
+        OFFSET_CHECK((base + size * 8) <= gic->num_irq);
+        for (i = 0; i < size * 8; i++) {
+            ret |= (uint64_t) (gic->irq_state[base + i].pending) << i;
+        }
+        break;
+    case GIC_SH_MASK_OFS ... GIC_SH_MASK_LAST_OFS:
+        /* each bit represents status for an interrupt pin */
+        base = (addr - GIC_SH_MASK_OFS) * 8;
+        OFFSET_CHECK((base + size * 8) <= gic->num_irq);
+        for (i = 0; i < size * 8; i++) {
+            ret |= (uint64_t) (gic->irq_state[base + i].enabled) << i;
+        }
+        break;
+    case GIC_SH_MAP0_PIN_OFS ... GIC_SH_MAP255_PIN_OFS:
+        /* 32 bits per a pin */
+        irq_src = (addr - GIC_SH_MAP0_PIN_OFS) / 4;
+        OFFSET_CHECK(irq_src < gic->num_irq);
+        ret = gic->irq_state[irq_src].map_pin;
+        break;
+    case GIC_SH_MAP0_VP_OFS ... GIC_SH_MAP255_VP_LAST_OFS:
+        /* up to 32 bytes per a pin */
+        irq_src = (addr - GIC_SH_MAP0_VP_OFS) / 32;
+        OFFSET_CHECK(irq_src < gic->num_irq);
+        if ((gic->irq_state[irq_src].map_vp) >= 0) {
+            ret = (uint64_t) 1 << (gic->irq_state[irq_src].map_vp);
+        } else {
+            ret = 0;
+        }
+        break;
+    /* VP-Local Register */
+    case VP_LOCAL_SECTION_OFS ... (VP_LOCAL_SECTION_OFS + GIC_VL_BRK_GROUP):
+        ret = gic_read_vp(gic, vp_index, addr - VP_LOCAL_SECTION_OFS, size);
+        break;
+    /* VP-Other Register */
+    case VP_OTHER_SECTION_OFS ... (VP_OTHER_SECTION_OFS + GIC_VL_BRK_GROUP):
+        other_index = gic->vps[vp_index].other_addr;
+        ret = gic_read_vp(gic, other_index, addr - VP_OTHER_SECTION_OFS, size);
+        break;
+    /* User-Mode Visible section */
+    case USM_VISIBLE_SECTION_OFS + GIC_USER_MODE_COUNTERLO:
+        ret = mips_gictimer_get_sh_count(gic->gic_timer);
+        break;
+    case USM_VISIBLE_SECTION_OFS + GIC_USER_MODE_COUNTERHI:
+        ret = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "Read %d bytes at GIC offset 0x%" PRIx64 "\n",
+                      size, addr);
+        break;
+    }
+    return ret;
+bad_offset:
+    qemu_log_mask(LOG_GUEST_ERROR, "Wrong GIC offset at 0x%" PRIx64 "\n", addr);
+    return 0;
+}
+
+static void gic_timer_expire_cb(void *opaque, uint32_t vp_index)
+{
+    MIPSGICState *gic = opaque;
+
+    gic->vps[vp_index].pend |= (1 << GIC_LOCAL_INT_COMPARE);
+    if (gic->vps[vp_index].pend &
+            (gic->vps[vp_index].mask & GIC_VP_MASK_CMP_MSK)) {
+        if (gic->vps[vp_index].compare_map & GIC_MAP_TO_PIN_MSK) {
+            /* it is safe to set the irq high regardless of other GIC IRQs */
+            uint32_t pin = (gic->vps[vp_index].compare_map & GIC_MAP_MSK);
+            qemu_irq_raise(gic->vps[vp_index].env->irq
+                           [pin + GIC_CPU_PIN_OFFSET]);
+        }
+    }
+}
+
+static void gic_timer_store_vp_compare(MIPSGICState *gic, uint32_t vp_index,
+                                       uint64_t compare)
+{
+    gic->vps[vp_index].pend &= ~(1 << GIC_LOCAL_INT_COMPARE);
+    if (gic->vps[vp_index].compare_map & GIC_MAP_TO_PIN_MSK) {
+        uint32_t pin = (gic->vps[vp_index].compare_map & GIC_MAP_MSK);
+        mips_gic_set_vp_irq(gic, vp_index, pin, 0);
+    }
+    mips_gictimer_store_vp_compare(gic->gic_timer, vp_index, compare);
+}
+
+/* GIC Write VP Local/Other Registers */
+static void gic_write_vp(MIPSGICState *gic, uint32_t vp_index, hwaddr addr,
+                              uint64_t data, unsigned size)
+{
+    switch (addr) {
+    case GIC_VP_CTL_OFS:
+        /* EIC isn't supported */
+        break;
+    case GIC_VP_RMASK_OFS:
+        gic->vps[vp_index].mask &= ~(data & GIC_VP_SET_RESET_MSK) &
+                                   GIC_VP_SET_RESET_MSK;
+        break;
+    case GIC_VP_SMASK_OFS:
+        gic->vps[vp_index].mask |= data & GIC_VP_SET_RESET_MSK;
+        break;
+    case GIC_VP_COMPARE_MAP_OFS:
+        /* EIC isn't supported */
+        OFFSET_CHECK((data & GIC_MAP_MSK) <= GIC_CPU_INT_MAX);
+        gic->vps[vp_index].compare_map = data & GIC_MAP_TO_PIN_REG_MSK;
+        break;
+    case GIC_VP_OTHER_ADDR_OFS:
+        OFFSET_CHECK(data < gic->num_vps);
+        gic->vps[vp_index].other_addr = data;
+        break;
+    case GIC_VP_COMPARE_LO_OFS:
+        gic_timer_store_vp_compare(gic, vp_index, data);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "Write %d bytes at GIC offset LOCAL/OTHER "
+                      "0x%" PRIx64" 0x%08" PRIx64 "\n", size, addr, data);
+        break;
+    }
+    return;
+bad_offset:
+    qemu_log_mask(LOG_GUEST_ERROR, "Wrong GIC offset at 0x%" PRIx64 "\n", addr);
+    return;
+}
+
+static void gic_write(void *opaque, hwaddr addr, uint64_t data, unsigned size)
+{
+    int intr;
+    MIPSGICState *gic = (MIPSGICState *) opaque;
+    uint32_t vp_index = current_cpu->cpu_index;
+    int i, base, irq_src;
+    uint32_t other_index;
+
+    switch (addr) {
+    case GIC_SH_CONFIG_OFS:
+        {
+            uint32_t pre_cntstop = mips_gictimer_get_countstop(gic->gic_timer);
+            uint32_t new_cntstop = (data & GIC_SH_CONFIG_COUNTSTOP_MSK) >>
+                                   GIC_SH_CONFIG_COUNTSTOP_SHF;
+            if (pre_cntstop != new_cntstop) {
+                if (new_cntstop == 1) {
+                    mips_gictimer_stop_count(gic->gic_timer);
+                } else {
+                    mips_gictimer_start_count(gic->gic_timer);
+                }
+            }
+        }
+        break;
+    case GIC_SH_COUNTERLO_OFS:
+        if (mips_gictimer_get_countstop(gic->gic_timer)) {
+            mips_gictimer_store_sh_count(gic->gic_timer, data);
+        }
+        break;
+    case GIC_SH_RMASK_OFS ... GIC_SH_RMASK_LAST_OFS:
+        /* up to 64 bits per a pin */
+        base = (addr - GIC_SH_RMASK_OFS) * 8;
+        OFFSET_CHECK((base + size * 8) <= gic->num_irq);
+        for (i = 0; i < size * 8; i++) {
+            gic->irq_state[base + i].enabled &= !((data >> i) & 1);
+        }
+        break;
+    case GIC_SH_WEDGE_OFS:
+        /* Figure out which VP/HW Interrupt this maps to */
+        intr = data & ~GIC_SH_WEDGE_RW_MSK;
+        /* Mask/Enabled Checks */
+        OFFSET_CHECK(intr < gic->num_irq);
+        if (data & GIC_SH_WEDGE_RW_MSK) {
+            gic_set_irq(gic, intr, 1);
+        } else {
+            gic_set_irq(gic, intr, 0);
+        }
+        break;
+    case GIC_SH_SMASK_OFS ... GIC_SH_SMASK_LAST_OFS:
+        /* up to 64 bits per a pin */
+        base = (addr - GIC_SH_SMASK_OFS) * 8;
+        OFFSET_CHECK((base + size * 8) <= gic->num_irq);
+        for (i = 0; i < size * 8; i++) {
+            gic->irq_state[base + i].enabled |= (data >> i) & 1;
+        }
+        break;
+    case GIC_SH_MAP0_PIN_OFS ... GIC_SH_MAP255_PIN_OFS:
+        /* 32 bits per a pin */
+        irq_src = (addr - GIC_SH_MAP0_PIN_OFS) / 4;
+        OFFSET_CHECK(irq_src < gic->num_irq);
+        /* EIC isn't supported */
+        OFFSET_CHECK((data & GIC_MAP_MSK) <= GIC_CPU_INT_MAX);
+        gic->irq_state[irq_src].map_pin = data & GIC_MAP_TO_PIN_REG_MSK;
+        break;
+    case GIC_SH_MAP0_VP_OFS ... GIC_SH_MAP255_VP_LAST_OFS:
+        /* up to 32 bytes per a pin */
+        irq_src = (addr - GIC_SH_MAP0_VP_OFS) / 32;
+        OFFSET_CHECK(irq_src < gic->num_irq);
+        data = data ? ctz64(data) : -1;
+        OFFSET_CHECK(data < gic->num_vps);
+        gic->irq_state[irq_src].map_vp = data;
+        break;
+    case VP_LOCAL_SECTION_OFS ... (VP_LOCAL_SECTION_OFS + GIC_VL_BRK_GROUP):
+        gic_write_vp(gic, vp_index, addr - VP_LOCAL_SECTION_OFS, data, size);
+        break;
+    case VP_OTHER_SECTION_OFS ... (VP_OTHER_SECTION_OFS + GIC_VL_BRK_GROUP):
+        other_index = gic->vps[vp_index].other_addr;
+        gic_write_vp(gic, other_index, addr - VP_OTHER_SECTION_OFS, data, size);
+        break;
+    case USM_VISIBLE_SECTION_OFS + GIC_USER_MODE_COUNTERLO:
+    case USM_VISIBLE_SECTION_OFS + GIC_USER_MODE_COUNTERHI:
+        /* do nothing. Read-only section */
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "Write %d bytes at GIC offset 0x%" PRIx64
+                      " 0x%08" PRIx64 "\n", size, addr, data);
+        break;
+    }
+    return;
+bad_offset:
+    qemu_log_mask(LOG_GUEST_ERROR, "Wrong GIC offset at 0x%" PRIx64 "\n", addr);
+}
+
+static void gic_reset(void *opaque)
+{
+    int i;
+    MIPSGICState *gic = (MIPSGICState *) opaque;
+    int numintrs = (gic->num_irq / 8) - 1;
+
+    gic->sh_config = /* COUNTSTOP = 0 it is accessible via MIPSGICTimer*/
+                     /* CounterHi not implemented */
+                     (0            << GIC_SH_CONFIG_COUNTBITS_SHF) |
+                     (numintrs     << GIC_SH_CONFIG_NUMINTRS_SHF)  |
+                     (gic->num_vps << GIC_SH_CONFIG_PVPS_SHF);
+    for (i = 0; i < gic->num_vps; i++) {
+        gic->vps[i].ctl         = 0x0;
+        gic->vps[i].pend        = 0x0;
+        /* PERFCNT, TIMER and WD not implemented */
+        gic->vps[i].mask        = 0x32;
+        gic->vps[i].compare_map = GIC_MAP_TO_PIN_MSK;
+        mips_gictimer_store_vp_compare(gic->gic_timer, i, 0xffffffff);
+        gic->vps[i].other_addr  = 0x0;
+    }
+    for (i = 0; i < gic->num_irq; i++) {
+        gic->irq_state[i].enabled = 0;
+        gic->irq_state[i].pending = 0;
+        gic->irq_state[i].map_pin = GIC_MAP_TO_PIN_MSK;
+        gic->irq_state[i].map_vp  = -1;
+    }
+    mips_gictimer_store_sh_count(gic->gic_timer, 0);
+    /* COUNTSTOP = 0 */
+    mips_gictimer_start_count(gic->gic_timer);
+}
+
+static const MemoryRegionOps gic_ops = {
+    .read = gic_read,
+    .write = gic_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .max_access_size = 8,
+    },
+};
+
+static void mips_gic_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    MIPSGICState *s = MIPS_GIC(obj);
+
+    memory_region_init_io(&s->mr, OBJECT(s), &gic_ops, s,
+                          "mips-gic", GIC_ADDRSPACE_SZ);
+    sysbus_init_mmio(sbd, &s->mr);
+    qemu_register_reset(gic_reset, s);
+}
+
+static void mips_gic_realize(DeviceState *dev, Error **errp)
+{
+    MIPSGICState *s = MIPS_GIC(dev);
+    CPUState *cs = first_cpu;
+    int i;
+
+    if (s->num_vps > GIC_MAX_VPS) {
+        error_setg(errp, "Exceeded maximum CPUs %d", s->num_vps);
+        return;
+    }
+    if ((s->num_irq > GIC_MAX_INTRS) || (s->num_irq % 8) || (s->num_irq <= 0)) {
+        error_setg(errp, "GIC supports up to %d external interrupts in "
+                   "multiples of 8 : %d", GIC_MAX_INTRS, s->num_irq);
+        return;
+    }
+    s->vps = g_new(MIPSGICVPState, s->num_vps);
+    s->irq_state = g_new(MIPSGICIRQState, s->num_irq);
+    /* Register the env for all VPs with the GIC */
+    for (i = 0; i < s->num_vps; i++) {
+        if (cs != NULL) {
+            s->vps[i].env = cs->env_ptr;
+            cs = CPU_NEXT(cs);
+        } else {
+            error_setg(errp,
+               "Unable to initialize GIC, CPUState for CPU#%d not valid.", i);
+            return;
+        }
+    }
+    s->gic_timer = mips_gictimer_init(s, s->num_vps, gic_timer_expire_cb);
+    qdev_init_gpio_in(dev, gic_set_irq, s->num_irq);
+    for (i = 0; i < s->num_irq; i++) {
+        s->irq_state[i].irq = qdev_get_gpio_in(dev, i);
+    }
+}
+
+static Property mips_gic_properties[] = {
+    DEFINE_PROP_INT32("num-vp", MIPSGICState, num_vps, 1),
+    DEFINE_PROP_INT32("num-irq", MIPSGICState, num_irq, 256),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void mips_gic_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->props = mips_gic_properties;
+    dc->realize = mips_gic_realize;
+}
+
+static const TypeInfo mips_gic_info = {
+    .name          = TYPE_MIPS_GIC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(MIPSGICState),
+    .instance_init = mips_gic_init,
+    .class_init    = mips_gic_class_init,
+};
+
+static void mips_gic_register_types(void)
+{
+    type_register_static(&mips_gic_info);
+}
+
+type_init(mips_gic_register_types)
diff --git a/hw/mips/cps.c b/hw/mips/cps.c
index 61208f8c69..77c621797a 100644
--- a/hw/mips/cps.c
+++ b/hw/mips/cps.c
@@ -26,13 +26,8 @@
 
 qemu_irq get_cps_irq(MIPSCPSState *s, int pin_number)
 {
-    MIPSCPU *cpu = MIPS_CPU(first_cpu);
-    CPUMIPSState *env = &cpu->env;
-
     assert(pin_number < s->num_irq);
-
-    /* TODO: return GIC pins once implemented */
-    return env->irq[pin_number];
+    return s->gic.irq_state[pin_number].irq;
 }
 
 static void mips_cps_init(Object *obj)
@@ -130,6 +125,21 @@ static void mips_cps_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(&s->container, 0,
                             sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpc), 0));
 
+    /* Global Interrupt Controller */
+    object_initialize(&s->gic, sizeof(s->gic), TYPE_MIPS_GIC);
+    qdev_set_parent_bus(DEVICE(&s->gic), sysbus_get_default());
+
+    object_property_set_int(OBJECT(&s->gic), s->num_vp, "num-vp", &err);
+    object_property_set_int(OBJECT(&s->gic), 128, "num-irq", &err);
+    object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    memory_region_add_subregion(&s->container, 0,
+                            sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->gic), 0));
+
     /* Global Configuration Registers */
     gcr_base = env->CP0_CMGCRBase << 4;
 
@@ -139,6 +149,7 @@ static void mips_cps_realize(DeviceState *dev, Error **errp)
     object_property_set_int(OBJECT(&s->gcr), s->num_vp, "num-vp", &err);
     object_property_set_int(OBJECT(&s->gcr), 0x800, "gcr-rev", &err);
     object_property_set_int(OBJECT(&s->gcr), gcr_base, "gcr-base", &err);
+    object_property_set_link(OBJECT(&s->gcr), OBJECT(&s->gic.mr), "gic", &err);
     object_property_set_link(OBJECT(&s->gcr), OBJECT(&s->cpc.mr), "cpc", &err);
     object_property_set_bool(OBJECT(&s->gcr), true, "realized", &err);
     if (err != NULL) {
@@ -152,7 +163,7 @@ static void mips_cps_realize(DeviceState *dev, Error **errp)
 
 static Property mips_cps_properties[] = {
     DEFINE_PROP_UINT32("num-vp", MIPSCPSState, num_vp, 1),
-    DEFINE_PROP_UINT32("num-irq", MIPSCPSState, num_irq, 8),
+    DEFINE_PROP_UINT32("num-irq", MIPSCPSState, num_irq, 256),
     DEFINE_PROP_STRING("cpu-model", MIPSCPSState, cpu_model),
     DEFINE_PROP_END_OF_LIST()
 };
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 5c8ba44c62..34d41ef44a 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -955,9 +955,7 @@ static void create_cps(MaltaState *s, const char *cpu_model,
 
     sysbus_mmio_map_overlap(SYS_BUS_DEVICE(s->cps), 0, 0, 1);
 
-    /* FIXME: When GIC is present then we should use GIC's IRQ 3.
-       Until then CPS exposes CPU's IRQs thus use the default IRQ 2. */
-    *i8259_irq = get_cps_irq(s->cps, 2);
+    *i8259_irq = get_cps_irq(s->cps, 3);
     *cbus_irq = NULL;
 }
 
diff --git a/hw/misc/mips_cmgcr.c b/hw/misc/mips_cmgcr.c
index 40f34643e3..b3ba16694e 100644
--- a/hw/misc/mips_cmgcr.c
+++ b/hw/misc/mips_cmgcr.c
@@ -17,12 +17,18 @@
 #include "sysemu/sysemu.h"
 #include "hw/misc/mips_cmgcr.h"
 #include "hw/misc/mips_cpc.h"
+#include "hw/intc/mips_gic.h"
 
 static inline bool is_cpc_connected(MIPSGCRState *s)
 {
     return s->cpc_mr != NULL;
 }
 
+static inline bool is_gic_connected(MIPSGCRState *s)
+{
+    return s->gic_mr != NULL;
+}
+
 static inline void update_cpc_base(MIPSGCRState *gcr, uint64_t val)
 {
     if (is_cpc_connected(gcr)) {
@@ -36,10 +42,25 @@ static inline void update_cpc_base(MIPSGCRState *gcr, uint64_t val)
     }
 }
 
+static inline void update_gic_base(MIPSGCRState *gcr, uint64_t val)
+{
+    if (is_gic_connected(gcr)) {
+        gcr->gic_base = val & GCR_GIC_BASE_MSK;
+        memory_region_transaction_begin();
+        memory_region_set_address(gcr->gic_mr,
+                                  gcr->gic_base & GCR_GIC_BASE_GICBASE_MSK);
+        memory_region_set_enabled(gcr->gic_mr,
+                                  gcr->gic_base & GCR_GIC_BASE_GICEN_MSK);
+        memory_region_transaction_commit();
+    }
+}
+
 /* Read GCR registers */
 static uint64_t gcr_read(void *opaque, hwaddr addr, unsigned size)
 {
     MIPSGCRState *gcr = (MIPSGCRState *) opaque;
+    MIPSGCRVPState *current_vps = &gcr->vps[current_cpu->cpu_index];
+    MIPSGCRVPState *other_vps = &gcr->vps[current_vps->other];
 
     switch (addr) {
     /* Global Control Block Register */
@@ -50,8 +71,12 @@ static uint64_t gcr_read(void *opaque, hwaddr addr, unsigned size)
         return gcr->gcr_base;
     case GCR_REV_OFS:
         return gcr->gcr_rev;
+    case GCR_GIC_BASE_OFS:
+        return gcr->gic_base;
     case GCR_CPC_BASE_OFS:
         return gcr->cpc_base;
+    case GCR_GIC_STATUS_OFS:
+        return is_gic_connected(gcr);
     case GCR_CPC_STATUS_OFS:
         return is_cpc_connected(gcr);
     case GCR_L2_CONFIG_OFS:
@@ -62,8 +87,14 @@ static uint64_t gcr_read(void *opaque, hwaddr addr, unsigned size)
     case MIPS_COCB_OFS + GCR_CL_CONFIG_OFS:
         /* Set PVP to # of VPs - 1 */
         return gcr->num_vps - 1;
+    case MIPS_CLCB_OFS + GCR_CL_RESETBASE_OFS:
+        return current_vps->reset_base;
+    case MIPS_COCB_OFS + GCR_CL_RESETBASE_OFS:
+        return other_vps->reset_base;
     case MIPS_CLCB_OFS + GCR_CL_OTHER_OFS:
-        return 0;
+        return current_vps->other;
+    case MIPS_COCB_OFS + GCR_CL_OTHER_OFS:
+        return other_vps->other;
     default:
         qemu_log_mask(LOG_UNIMP, "Read %d bytes at GCR offset 0x%" HWADDR_PRIx
                       "\n", size, addr);
@@ -72,15 +103,46 @@ static uint64_t gcr_read(void *opaque, hwaddr addr, unsigned size)
     return 0;
 }
 
+static inline target_ulong get_exception_base(MIPSGCRVPState *vps)
+{
+    /* TODO: BEV_BASE and SELECT_BEV */
+    return (int32_t)(vps->reset_base & GCR_CL_RESET_BASE_RESETBASE_MSK);
+}
+
 /* Write GCR registers */
 static void gcr_write(void *opaque, hwaddr addr, uint64_t data, unsigned size)
 {
     MIPSGCRState *gcr = (MIPSGCRState *)opaque;
+    MIPSGCRVPState *current_vps = &gcr->vps[current_cpu->cpu_index];
+    MIPSGCRVPState *other_vps = &gcr->vps[current_vps->other];
 
     switch (addr) {
+    case GCR_GIC_BASE_OFS:
+        update_gic_base(gcr, data);
+        break;
     case GCR_CPC_BASE_OFS:
         update_cpc_base(gcr, data);
         break;
+    case MIPS_CLCB_OFS + GCR_CL_RESETBASE_OFS:
+        current_vps->reset_base = data & GCR_CL_RESET_BASE_MSK;
+        cpu_set_exception_base(current_cpu->cpu_index,
+                               get_exception_base(current_vps));
+        break;
+    case MIPS_COCB_OFS + GCR_CL_RESETBASE_OFS:
+        other_vps->reset_base = data & GCR_CL_RESET_BASE_MSK;
+        cpu_set_exception_base(current_vps->other,
+                               get_exception_base(other_vps));
+        break;
+    case MIPS_CLCB_OFS + GCR_CL_OTHER_OFS:
+        if ((data & GCR_CL_OTHER_MSK) < gcr->num_vps) {
+            current_vps->other = data & GCR_CL_OTHER_MSK;
+        }
+        break;
+    case MIPS_COCB_OFS + GCR_CL_OTHER_OFS:
+        if ((data & GCR_CL_OTHER_MSK) < gcr->num_vps) {
+            other_vps->other = data & GCR_CL_OTHER_MSK;
+        }
+        break;
     default:
         qemu_log_mask(LOG_UNIMP, "Write %d bytes at GCR offset 0x%" HWADDR_PRIx
                       " 0x%" PRIx64 "\n", size, addr, data);
@@ -102,6 +164,12 @@ static void mips_gcr_init(Object *obj)
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     MIPSGCRState *s = MIPS_GCR(obj);
 
+    object_property_add_link(obj, "gic", TYPE_MEMORY_REGION,
+                             (Object **)&s->gic_mr,
+                             qdev_prop_allow_set_link_before_realize,
+                             OBJ_PROP_LINK_UNREF_ON_RELEASE,
+                             &error_abort);
+
     object_property_add_link(obj, "cpc", TYPE_MEMORY_REGION,
                              (Object **)&s->cpc_mr,
                              qdev_prop_allow_set_link_before_realize,
@@ -116,8 +184,16 @@ static void mips_gcr_init(Object *obj)
 static void mips_gcr_reset(DeviceState *dev)
 {
     MIPSGCRState *s = MIPS_GCR(dev);
+    int i;
 
+    update_gic_base(s, 0);
     update_cpc_base(s, 0);
+
+    for (i = 0; i < s->num_vps; i++) {
+        s->vps[i].other = 0;
+        s->vps[i].reset_base = 0xBFC00000 & GCR_CL_RESET_BASE_MSK;
+        cpu_set_exception_base(i, get_exception_base(&s->vps[i]));
+    }
 }
 
 static const VMStateDescription vmstate_mips_gcr = {
@@ -137,12 +213,21 @@ static Property mips_gcr_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static void mips_gcr_realize(DeviceState *dev, Error **errp)
+{
+    MIPSGCRState *s = MIPS_GCR(dev);
+
+    /* Create local set of registers for each VP */
+    s->vps = g_new(MIPSGCRVPState, s->num_vps);
+}
+
 static void mips_gcr_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     dc->props = mips_gcr_properties;
     dc->vmsd = &vmstate_mips_gcr;
     dc->reset = mips_gcr_reset;
+    dc->realize = mips_gcr_realize;
 }
 
 static const TypeInfo mips_gcr_info = {
diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c
index e6a35dd6a0..6d345745f6 100644
--- a/hw/misc/mips_cpc.c
+++ b/hw/misc/mips_cpc.c
@@ -37,7 +37,7 @@ static void cpc_run_vp(MIPSCPCState *cpc, uint64_t vp_run)
     CPU_FOREACH(cs) {
         uint64_t i = 1ULL << cs->cpu_index;
         if (i & vp_run & ~cpc->vp_running) {
-            cpu_interrupt(cs, CPU_INTERRUPT_WAKE);
+            cpu_reset(cs);
             cpc->vp_running |= i;
         }
     }
@@ -50,8 +50,7 @@ static void cpc_stop_vp(MIPSCPCState *cpc, uint64_t vp_stop)
     CPU_FOREACH(cs) {
         uint64_t i = 1ULL << cs->cpu_index;
         if (i & vp_stop & cpc->vp_running) {
-            cs->halted = 1;
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_WAKE);
+            cpu_interrupt(cs, CPU_INTERRUPT_HALT);
             cpc->vp_running &= ~i;
         }
     }
diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
index 003c14fa26..7ba8c23c75 100644
--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -26,6 +26,7 @@ obj-$(CONFIG_OMAP) += omap_synctimer.o
 obj-$(CONFIG_PXA2XX) += pxa2xx_timer.o
 obj-$(CONFIG_SH4) += sh_timer.o
 obj-$(CONFIG_DIGIC) += digic-timer.o
+obj-$(CONFIG_MIPS_CPS) += mips_gictimer.o
 
 obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
 
diff --git a/hw/timer/mips_gictimer.c b/hw/timer/mips_gictimer.c
new file mode 100644
index 0000000000..3698889475
--- /dev/null
+++ b/hw/timer/mips_gictimer.c
@@ -0,0 +1,142 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2016 Imagination Technologies
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+#include "hw/timer/mips_gictimer.h"
+
+#define TIMER_PERIOD 10 /* 10 ns period for 100 Mhz frequency */
+
+static void gic_vptimer_update(MIPSGICTimerState *gictimer,
+                                   uint32_t vp_index, uint64_t now)
+{
+    uint64_t next;
+    uint32_t wait;
+
+    wait = gictimer->vptimers[vp_index].comparelo - gictimer->sh_counterlo -
+           (uint32_t)(now / TIMER_PERIOD);
+    next = now + (uint64_t)wait * TIMER_PERIOD;
+
+    timer_mod(gictimer->vptimers[vp_index].qtimer, next);
+}
+
+static void gic_vptimer_expire(MIPSGICTimerState *gictimer, uint32_t vp_index,
+                               uint64_t now)
+{
+    if (gictimer->countstop) {
+        /* timer stopped */
+        return;
+    }
+    gictimer->cb(gictimer->opaque, vp_index);
+    gic_vptimer_update(gictimer, vp_index, now);
+}
+
+static void gic_vptimer_cb(void *opaque)
+{
+    MIPSGICTimerVPState *vptimer = opaque;
+    MIPSGICTimerState *gictimer = vptimer->gictimer;
+    gic_vptimer_expire(gictimer, vptimer->vp_index,
+                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+}
+
+uint32_t mips_gictimer_get_sh_count(MIPSGICTimerState *gictimer)
+{
+    int i;
+    if (gictimer->countstop) {
+        return gictimer->sh_counterlo;
+    } else {
+        uint64_t now;
+        now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        for (i = 0; i < gictimer->num_vps; i++) {
+            if (timer_pending(gictimer->vptimers[i].qtimer)
+                && timer_expired(gictimer->vptimers[i].qtimer, now)) {
+                /* The timer has already expired.  */
+                gic_vptimer_expire(gictimer, i, now);
+            }
+        }
+        return gictimer->sh_counterlo + (uint32_t)(now / TIMER_PERIOD);
+    }
+}
+
+void mips_gictimer_store_sh_count(MIPSGICTimerState *gictimer, uint64_t count)
+{
+    int i;
+    uint64_t now;
+
+    if (gictimer->countstop || !gictimer->vptimers[0].qtimer) {
+        gictimer->sh_counterlo = count;
+    } else {
+        /* Store new count register */
+        now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        gictimer->sh_counterlo = count - (uint32_t)(now / TIMER_PERIOD);
+        /* Update timer timer */
+        for (i = 0; i < gictimer->num_vps; i++) {
+            gic_vptimer_update(gictimer, i, now);
+        }
+    }
+}
+
+uint32_t mips_gictimer_get_vp_compare(MIPSGICTimerState *gictimer,
+                                      uint32_t vp_index)
+{
+    return gictimer->vptimers[vp_index].comparelo;
+}
+
+void mips_gictimer_store_vp_compare(MIPSGICTimerState *gictimer,
+                                    uint32_t vp_index, uint64_t compare)
+{
+    gictimer->vptimers[vp_index].comparelo = (uint32_t) compare;
+    gic_vptimer_update(gictimer, vp_index,
+                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+}
+
+uint8_t mips_gictimer_get_countstop(MIPSGICTimerState *gictimer)
+{
+    return gictimer->countstop;
+}
+
+void mips_gictimer_start_count(MIPSGICTimerState *gictimer)
+{
+    gictimer->countstop = 0;
+    mips_gictimer_store_sh_count(gictimer, gictimer->sh_counterlo);
+}
+
+void mips_gictimer_stop_count(MIPSGICTimerState *gictimer)
+{
+    int i;
+
+    gictimer->countstop = 1;
+    /* Store the current value */
+    gictimer->sh_counterlo +=
+        (uint32_t)(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / TIMER_PERIOD);
+    for (i = 0; i < gictimer->num_vps; i++) {
+        timer_del(gictimer->vptimers[i].qtimer);
+    }
+}
+
+MIPSGICTimerState *mips_gictimer_init(void *opaque, uint32_t nvps,
+                                      MIPSGICTimerCB *cb)
+{
+    int i;
+    MIPSGICTimerState *gictimer = g_new(MIPSGICTimerState, 1);
+    gictimer->vptimers = g_new(MIPSGICTimerVPState, nvps);
+    gictimer->countstop = 1;
+    gictimer->num_vps = nvps;
+    gictimer->opaque = opaque;
+    gictimer->cb = cb;
+    for (i = 0; i < nvps; i++) {
+        gictimer->vptimers[i].gictimer = gictimer;
+        gictimer->vptimers[i].vp_index = i;
+        gictimer->vptimers[i].qtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                            &gic_vptimer_cb,
+                                            &gictimer->vptimers[i]);
+    }
+    return gictimer;
+}
diff --git a/include/hw/intc/mips_gic.h b/include/hw/intc/mips_gic.h
new file mode 100644
index 0000000000..dd6d44d731
--- /dev/null
+++ b/include/hw/intc/mips_gic.h
@@ -0,0 +1,216 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2000, 07 MIPS Technologies, Inc.
+ * Copyright (C) 2016 Imagination Technologies
+ *
+ */
+
+#ifndef _MIPS_GIC_H
+#define _MIPS_GIC_H
+
+#include "hw/timer/mips_gictimer.h"
+#include "cpu.h"
+/*
+ * GIC Specific definitions
+ */
+
+/* The MIPS default location */
+#define GIC_BASE_ADDR           0x1bdc0000ULL
+#define GIC_ADDRSPACE_SZ        (128 * 1024)
+
+/* Constants */
+#define GIC_POL_POS     1
+#define GIC_POL_NEG     0
+#define GIC_TRIG_EDGE   1
+#define GIC_TRIG_LEVEL  0
+
+#define MSK(n)              ((1ULL << (n)) - 1)
+
+/* GIC Address Space */
+#define SHARED_SECTION_OFS          0x0000
+#define SHARED_SECTION_SIZE         0x8000
+#define VP_LOCAL_SECTION_OFS        0x8000
+#define VP_LOCAL_SECTION_SIZE       0x4000
+#define VP_OTHER_SECTION_OFS        0xc000
+#define VP_OTHER_SECTION_SIZE       0x4000
+#define USM_VISIBLE_SECTION_OFS     0x10000
+#define USM_VISIBLE_SECTION_SIZE    0x10000
+
+/* Register Map for Shared Section */
+
+#define GIC_SH_CONFIG_OFS           0x0000
+
+/* Shared Global Counter */
+#define GIC_SH_COUNTERLO_OFS        0x0010
+#define GIC_SH_COUNTERHI_OFS        0x0014
+#define GIC_SH_REVISIONID_OFS       0x0020
+
+/* Set/Clear corresponding bit in Edge Detect Register */
+#define GIC_SH_WEDGE_OFS            0x0280
+
+/* Reset Mask - Disables Interrupt */
+#define GIC_SH_RMASK_OFS            0x0300
+#define GIC_SH_RMASK_LAST_OFS       0x031c
+
+/* Set Mask (WO) - Enables Interrupt */
+#define GIC_SH_SMASK_OFS            0x0380
+#define GIC_SH_SMASK_LAST_OFS       0x039c
+
+/* Global Interrupt Mask Register (RO) - Bit Set == Interrupt enabled */
+#define GIC_SH_MASK_OFS             0x0400
+#define GIC_SH_MASK_LAST_OFS        0x041c
+
+/* Pending Global Interrupts (RO) */
+#define GIC_SH_PEND_OFS             0x0480
+#define GIC_SH_PEND_LAST_OFS        0x049c
+
+#define GIC_SH_MAP0_PIN_OFS         0x0500
+#define GIC_SH_MAP255_PIN_OFS       0x08fc
+
+#define GIC_SH_MAP0_VP_OFS          0x2000
+#define GIC_SH_MAP255_VP_LAST_OFS   0x3fe4
+
+/* Register Map for Local Section */
+#define GIC_VP_CTL_OFS              0x0000
+#define GIC_VP_PEND_OFS             0x0004
+#define GIC_VP_MASK_OFS             0x0008
+#define GIC_VP_RMASK_OFS            0x000c
+#define GIC_VP_SMASK_OFS            0x0010
+#define GIC_VP_WD_MAP_OFS           0x0040
+#define GIC_VP_COMPARE_MAP_OFS      0x0044
+#define GIC_VP_TIMER_MAP_OFS        0x0048
+#define GIC_VP_FDC_MAP_OFS          0x004c
+#define GIC_VP_PERFCTR_MAP_OFS      0x0050
+#define GIC_VP_SWINT0_MAP_OFS       0x0054
+#define GIC_VP_SWINT1_MAP_OFS       0x0058
+#define GIC_VP_OTHER_ADDR_OFS       0x0080
+#define GIC_VP_IDENT_OFS            0x0088
+#define GIC_VP_WD_CONFIG0_OFS       0x0090
+#define GIC_VP_WD_COUNT0_OFS        0x0094
+#define GIC_VP_WD_INITIAL0_OFS      0x0098
+#define GIC_VP_COMPARE_LO_OFS       0x00a0
+#define GIC_VP_COMPARE_HI_OFS       0x00a4
+#define GIC_VL_BRK_GROUP            0x3080
+
+/* User-Mode Visible Section Register */
+/* Read-only alias for GIC Shared CounterLo */
+#define GIC_USER_MODE_COUNTERLO     0x0000
+/* Read-only alias for GIC Shared CounterHi */
+#define GIC_USER_MODE_COUNTERHI     0x0004
+
+/* Masks */
+#define GIC_SH_CONFIG_COUNTSTOP_SHF     28
+#define GIC_SH_CONFIG_COUNTSTOP_MSK     (MSK(1) << GIC_SH_CONFIG_COUNTSTOP_SHF)
+#define GIC_SH_CONFIG_COUNTBITS_SHF     24
+#define GIC_SH_CONFIG_COUNTBITS_MSK     (MSK(4) << GIC_SH_CONFIG_COUNTBITS_SHF)
+#define GIC_SH_CONFIG_NUMINTRS_SHF      16
+#define GIC_SH_CONFIG_NUMINTRS_MSK      (MSK(8) << GIC_SH_CONFIG_NUMINTRS_SHF)
+#define GIC_SH_CONFIG_PVPS_SHF          0
+#define GIC_SH_CONFIG_PVPS_MSK          (MSK(8) << GIC_SH_CONFIG_NUMVPS_SHF)
+
+#define GIC_SH_WEDGE_RW_SHF             31
+#define GIC_SH_WEDGE_RW_MSK             (MSK(1) << GIC_SH_WEDGE_RW_SHF)
+
+#define GIC_MAP_TO_PIN_SHF              31
+#define GIC_MAP_TO_PIN_MSK              (MSK(1) << GIC_MAP_TO_PIN_SHF)
+#define GIC_MAP_TO_NMI_SHF              30
+#define GIC_MAP_TO_NMI_MSK              (MSK(1) << GIC_MAP_TO_NMI_SHF)
+#define GIC_MAP_TO_YQ_SHF               29
+#define GIC_MAP_TO_YQ_MSK               (MSK(1) << GIC_MAP_TO_YQ_SHF)
+#define GIC_MAP_SHF                     0
+#define GIC_MAP_MSK                     (MSK(6) << GIC_MAP_SHF)
+#define GIC_MAP_TO_PIN_REG_MSK          \
+    (GIC_MAP_TO_PIN_MSK | GIC_MAP_TO_NMI_MSK | GIC_MAP_TO_YQ_MSK | GIC_MAP_MSK)
+
+/* GIC_VP_CTL Masks */
+#define GIC_VP_CTL_FDC_RTBL_SHF         4
+#define GIC_VP_CTL_FDC_RTBL_MSK         (MSK(1) << GIC_VP_CTL_FDC_RTBL_SHF)
+#define GIC_VP_CTL_SWINT_RTBL_SHF       3
+#define GIC_VP_CTL_SWINT_RTBL_MSK       (MSK(1) << GIC_VP_CTL_SWINT_RTBL_SHF)
+#define GIC_VP_CTL_PERFCNT_RTBL_SHF     2
+#define GIC_VP_CTL_PERFCNT_RTBL_MSK     (MSK(1) << GIC_VP_CTL_PERFCNT_RTBL_SHF)
+#define GIC_VP_CTL_TIMER_RTBL_SHF       1
+#define GIC_VP_CTL_TIMER_RTBL_MSK       (MSK(1) << GIC_VP_CTL_TIMER_RTBL_SHF)
+#define GIC_VP_CTL_EIC_MODE_SHF         0
+#define GIC_VP_CTL_EIC_MODE_MSK         (MSK(1) << GIC_VP_CTL_EIC_MODE_SHF)
+
+/* GIC_VP_MASK Masks */
+#define GIC_VP_MASK_FDC_SHF         6
+#define GIC_VP_MASK_FDC_MSK         (MSK(1) << GIC_VP_MASK_FDC_SHF)
+#define GIC_VP_MASK_SWINT1_SHF      5
+#define GIC_VP_MASK_SWINT1_MSK      (MSK(1) << GIC_VP_MASK_SWINT1_SHF)
+#define GIC_VP_MASK_SWINT0_SHF      4
+#define GIC_VP_MASK_SWINT0_MSK      (MSK(1) << GIC_VP_MASK_SWINT0_SHF)
+#define GIC_VP_MASK_PERFCNT_SHF     3
+#define GIC_VP_MASK_PERFCNT_MSK     (MSK(1) << GIC_VP_MASK_PERFCNT_SHF)
+#define GIC_VP_MASK_TIMER_SHF       2
+#define GIC_VP_MASK_TIMER_MSK       (MSK(1) << GIC_VP_MASK_TIMER_SHF)
+#define GIC_VP_MASK_CMP_SHF         1
+#define GIC_VP_MASK_CMP_MSK         (MSK(1) << GIC_VP_MASK_CMP_SHF)
+#define GIC_VP_MASK_WD_SHF          0
+#define GIC_VP_MASK_WD_MSK          (MSK(1) << GIC_VP_MASK_WD_SHF)
+#define GIC_VP_SET_RESET_MSK        (MSK(7) << GIC_VP_MASK_WD_SHF)
+
+#define GIC_CPU_INT_MAX             5 /* Core Interrupt 7 */
+#define GIC_CPU_PIN_OFFSET          2
+
+/* Local GIC interrupts. */
+#define GIC_NUM_LOCAL_INTRS     7
+#define GIC_LOCAL_INT_FDC       6 /* CPU fast debug channel */
+#define GIC_LOCAL_INT_SWINT1    5 /* CPU software interrupt 1 */
+#define GIC_LOCAL_INT_SWINT0    4 /* CPU software interrupt 0 */
+#define GIC_LOCAL_INT_PERFCTR   3 /* CPU performance counter */
+#define GIC_LOCAL_INT_TIMER     2 /* CPU timer interrupt */
+#define GIC_LOCAL_INT_COMPARE   1 /* GIC count and compare timer */
+#define GIC_LOCAL_INT_WD        0 /* GIC watchdog */
+
+#define TYPE_MIPS_GIC "mips-gic"
+#define MIPS_GIC(obj) OBJECT_CHECK(MIPSGICState, (obj), TYPE_MIPS_GIC)
+
+/* Support up to 32 VPs and 256 IRQs */
+#define GIC_MAX_VPS             32
+#define GIC_MAX_INTRS           256
+
+typedef struct MIPSGICState MIPSGICState;
+typedef struct MIPSGICIRQState MIPSGICIRQState;
+typedef struct MIPSGICVPState MIPSGICVPState;
+
+struct MIPSGICIRQState {
+    uint8_t enabled;
+    uint8_t pending;
+    uint32_t map_pin;
+    int32_t map_vp;
+    qemu_irq irq;
+};
+
+struct MIPSGICVPState {
+    uint32_t ctl;
+    uint32_t pend;
+    uint32_t mask;
+    uint32_t compare_map;
+    uint32_t other_addr;
+    CPUMIPSState *env;
+};
+
+struct MIPSGICState {
+    SysBusDevice parent_obj;
+    MemoryRegion mr;
+
+    /* Shared Section Registers */
+    uint32_t sh_config;
+    MIPSGICIRQState *irq_state;
+
+    /* VP Local/Other Section Registers */
+    MIPSGICVPState *vps;
+
+    /* GIC VP Timer */
+    MIPSGICTimerState *gic_timer;
+
+    int32_t num_vps;
+    int32_t num_irq;
+};
+
+#endif /* _MIPS_GIC_H */
diff --git a/include/hw/mips/cps.h b/include/hw/mips/cps.h
index 4dbae9c8c9..526b8d0b11 100644
--- a/include/hw/mips/cps.h
+++ b/include/hw/mips/cps.h
@@ -22,6 +22,7 @@
 
 #include "hw/sysbus.h"
 #include "hw/misc/mips_cmgcr.h"
+#include "hw/intc/mips_gic.h"
 #include "hw/misc/mips_cpc.h"
 #include "hw/misc/mips_itu.h"
 
@@ -37,6 +38,7 @@ typedef struct MIPSCPSState {
 
     MemoryRegion container;
     MIPSGCRState gcr;
+    MIPSGICState gic;
     MIPSCPCState cpc;
     MIPSITUState itu;
 } MIPSCPSState;
diff --git a/include/hw/misc/mips_cmgcr.h b/include/hw/misc/mips_cmgcr.h
index cc60eefa53..690e1d6221 100644
--- a/include/hw/misc/mips_cmgcr.h
+++ b/include/hw/misc/mips_cmgcr.h
@@ -26,23 +26,45 @@
 #define GCR_CONFIG_OFS      0x0000
 #define GCR_BASE_OFS        0x0008
 #define GCR_REV_OFS         0x0030
+#define GCR_GIC_BASE_OFS    0x0080
 #define GCR_CPC_BASE_OFS    0x0088
+#define GCR_GIC_STATUS_OFS  0x00D0
 #define GCR_CPC_STATUS_OFS  0x00F0
 #define GCR_L2_CONFIG_OFS   0x0130
 
 /* Core Local and Core Other Block Register Map */
 #define GCR_CL_CONFIG_OFS   0x0010
 #define GCR_CL_OTHER_OFS    0x0018
+#define GCR_CL_RESETBASE_OFS 0x0020
 
 /* GCR_L2_CONFIG register fields */
 #define GCR_L2_CONFIG_BYPASS_SHF    20
 #define GCR_L2_CONFIG_BYPASS_MSK    ((0x1ULL) << GCR_L2_CONFIG_BYPASS_SHF)
 
+/* GCR_GIC_BASE register fields */
+#define GCR_GIC_BASE_GICEN_MSK   1
+#define GCR_GIC_BASE_GICBASE_MSK 0xFFFFFFFE0000ULL
+#define GCR_GIC_BASE_MSK (GCR_GIC_BASE_GICEN_MSK | GCR_GIC_BASE_GICBASE_MSK)
+
 /* GCR_CPC_BASE register fields */
 #define GCR_CPC_BASE_CPCEN_MSK   1
 #define GCR_CPC_BASE_CPCBASE_MSK 0xFFFFFFFF8000ULL
 #define GCR_CPC_BASE_MSK (GCR_CPC_BASE_CPCEN_MSK | GCR_CPC_BASE_CPCBASE_MSK)
 
+/* GCR_CL_OTHER_OFS register fields */
+#define GCR_CL_OTHER_VPOTHER_MSK 0x7
+#define GCR_CL_OTHER_MSK GCR_CL_OTHER_VPOTHER_MSK
+
+/* GCR_CL_RESETBASE_OFS register fields */
+#define GCR_CL_RESET_BASE_RESETBASE_MSK 0xFFFFF000U
+#define GCR_CL_RESET_BASE_MSK GCR_CL_RESET_BASE_RESETBASE_MSK
+
+typedef struct MIPSGCRVPState MIPSGCRVPState;
+struct MIPSGCRVPState {
+    uint32_t other;
+    uint64_t reset_base;
+};
+
 typedef struct MIPSGCRState MIPSGCRState;
 struct MIPSGCRState {
     SysBusDevice parent_obj;
@@ -52,8 +74,13 @@ struct MIPSGCRState {
     hwaddr gcr_base;
     MemoryRegion iomem;
     MemoryRegion *cpc_mr;
+    MemoryRegion *gic_mr;
 
     uint64_t cpc_base;
+    uint64_t gic_base;
+
+    /* VP Local/Other Registers */
+    MIPSGCRVPState *vps;
 };
 
 #endif /* _MIPS_GCR_H */
diff --git a/include/hw/timer/mips_gictimer.h b/include/hw/timer/mips_gictimer.h
new file mode 100644
index 0000000000..e3ca45c533
--- /dev/null
+++ b/include/hw/timer/mips_gictimer.h
@@ -0,0 +1,46 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2016 Imagination Technologies
+ *
+ */
+
+#ifndef _MIPS_GICTIMER_H_
+#define _MIPS_GICTIMER_H_
+
+typedef struct MIPSGICTimerVPState MIPSGICTimerVPState;
+typedef struct MIPSGICTimerState MIPSGICTimerState;
+
+typedef void MIPSGICTimerCB(void *opaque, uint32_t vp_index);
+
+struct MIPSGICTimerVPState {
+    QEMUTimer *qtimer;
+    uint32_t vp_index;
+    uint32_t comparelo;
+    MIPSGICTimerState *gictimer;
+};
+
+struct MIPSGICTimerState {
+    void *opaque;
+    uint8_t countstop;
+    uint32_t sh_counterlo;
+    int32_t num_vps;
+    MIPSGICTimerVPState *vptimers;
+    MIPSGICTimerCB *cb;
+};
+
+uint32_t mips_gictimer_get_sh_count(MIPSGICTimerState *gic);
+void mips_gictimer_store_sh_count(MIPSGICTimerState *gic, uint64_t count);
+uint32_t mips_gictimer_get_vp_compare(MIPSGICTimerState *gictimer,
+                                      uint32_t vp_index);
+void mips_gictimer_store_vp_compare(MIPSGICTimerState *gic, uint32_t vp_index,
+                                    uint64_t compare);
+uint8_t mips_gictimer_get_countstop(MIPSGICTimerState *gic);
+void mips_gictimer_start_count(MIPSGICTimerState *gic);
+void mips_gictimer_stop_count(MIPSGICTimerState *gic);
+MIPSGICTimerState *mips_gictimer_init(void *opaque, uint32_t nvps,
+                                      MIPSGICTimerCB *cb);
+
+#endif /* _MIPS_GICTIMER_H_ */
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 1037f9b7eb..2c4583931c 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -19,7 +19,7 @@ typedef struct r4k_tlb_t r4k_tlb_t;
 struct r4k_tlb_t {
     target_ulong VPN;
     uint32_t PageMask;
-    uint8_t ASID;
+    uint16_t ASID;
     unsigned int G:1;
     unsigned int C0:3;
     unsigned int C1:3;
@@ -343,6 +343,7 @@ struct CPUMIPSState {
     int32_t CP0_Count;
     target_ulong CP0_EntryHi;
 #define CP0EnHi_EHINV 10
+    target_ulong CP0_EntryHi_ASID_mask;
     int32_t CP0_Compare;
     int32_t CP0_Status;
 #define CP0St_CU3   31
@@ -467,6 +468,7 @@ struct CPUMIPSState {
     int32_t CP0_Config4_rw_bitmask;
 #define CP0C4_M    31
 #define CP0C4_IE   29
+#define CP0C4_AE   28
 #define CP0C4_KScrExist 16
 #define CP0C4_MMUExtDef 14
 #define CP0C4_FTLBPageSize 8
@@ -503,6 +505,7 @@ struct CPUMIPSState {
     int CP0_LLAddr_shift;
     target_ulong CP0_WatchLo[8];
     int32_t CP0_WatchHi[8];
+#define CP0WH_ASID 16
     target_ulong CP0_XContext;
     int32_t CP0_Framemask;
     int32_t CP0_Debug;
@@ -616,6 +619,7 @@ struct CPUMIPSState {
     void *irq[8];
     QEMUTimer *timer; /* Internal timer */
     MemoryRegion *itc_tag; /* ITC Configuration Tags */
+    target_ulong exception_base; /* ExceptionBase input to the core */
 };
 
 /**
@@ -807,6 +811,7 @@ int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
 
 #define cpu_init(cpu_model) CPU(cpu_mips_init(cpu_model))
 bool cpu_supports_cps_smp(const char *cpu_model);
+void cpu_set_exception_base(int vp_index, target_ulong address);
 
 /* TODO QOM'ify CPU reset and remove */
 void cpu_state_reset(CPUMIPSState *s);
diff --git a/target-mips/helper.c b/target-mips/helper.c
index 65fbef0050..9fbca26d41 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -67,7 +67,7 @@ int fixed_mmu_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
 int r4k_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
                      target_ulong address, int rw, int access_type)
 {
-    uint8_t ASID = env->CP0_EntryHi & 0xFF;
+    uint16_t ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     int i;
 
     for (i = 0; i < env->tlb->tlb_in_use; i++) {
@@ -249,7 +249,7 @@ void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu, int tc)
     cu = (v >> CP0St_CU0) & 0xf;
     mx = (v >> CP0St_MX) & 0x1;
     ksu = (v >> CP0St_KSU) & 0x3;
-    asid = env->CP0_EntryHi & 0xff;
+    asid = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
 
     tcstatus = cu << CP0TCSt_TCU0;
     tcstatus |= mx << CP0TCSt_TMX;
@@ -395,8 +395,8 @@ static void raise_mmu_exception(CPUMIPSState *env, target_ulong address,
     env->CP0_BadVAddr = address;
     env->CP0_Context = (env->CP0_Context & ~0x007fffff) |
                        ((address >> 9) & 0x007ffff0);
-    env->CP0_EntryHi =
-        (env->CP0_EntryHi & 0xFF) | (address & (TARGET_PAGE_MASK << 1));
+    env->CP0_EntryHi = (env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask) |
+                       (address & (TARGET_PAGE_MASK << 1));
 #if defined(TARGET_MIPS64)
     env->CP0_EntryHi &= env->SEGMask;
     env->CP0_XContext =
@@ -640,7 +640,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
         /* EJTAG probe trap enable is not implemented... */
         if (!(env->CP0_Status & (1 << CP0St_EXL)))
             env->CP0_Cause &= ~(1U << CP0Ca_BD);
-        env->active_tc.PC = (int32_t)0xBFC00480;
+        env->active_tc.PC = env->exception_base + 0x480;
         set_hflags_for_handler(env);
         break;
     case EXCP_RESET:
@@ -667,7 +667,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
         env->hflags &= ~(MIPS_HFLAG_KSU);
         if (!(env->CP0_Status & (1 << CP0St_EXL)))
             env->CP0_Cause &= ~(1U << CP0Ca_BD);
-        env->active_tc.PC = (int32_t)0xBFC00000;
+        env->active_tc.PC = env->exception_base;
         set_hflags_for_handler(env);
         break;
     case EXCP_EXT_INTERRUPT:
@@ -849,7 +849,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
         }
         env->hflags &= ~MIPS_HFLAG_BMASK;
         if (env->CP0_Status & (1 << CP0St_BEV)) {
-            env->active_tc.PC = (int32_t)0xBFC00200;
+            env->active_tc.PC = env->exception_base + 0x200;
         } else {
             env->active_tc.PC = (int32_t)(env->CP0_EBase & ~0x3ff);
         }
@@ -898,7 +898,7 @@ void r4k_invalidate_tlb (CPUMIPSState *env, int idx, int use_extra)
     r4k_tlb_t *tlb;
     target_ulong addr;
     target_ulong end;
-    uint8_t ASID = env->CP0_EntryHi & 0xFF;
+    uint16_t ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     target_ulong mask;
 
     tlb = &env->tlb->mmu.r4k.tlb[idx];
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 7314cfe8c7..a27f2f156d 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -132,7 +132,7 @@ static int get_tlb(QEMUFile *f, void *pv, size_t size)
 
     qemu_get_betls(f, &v->VPN);
     qemu_get_be32s(f, &v->PageMask);
-    qemu_get_8s(f, &v->ASID);
+    qemu_get_be16s(f, &v->ASID);
     qemu_get_be16s(f, &flags);
     v->G = (flags >> 10) & 1;
     v->C0 = (flags >> 7) & 3;
@@ -156,7 +156,7 @@ static void put_tlb(QEMUFile *f, void *pv, size_t size)
 {
     r4k_tlb_t *v = pv;
 
-    uint8_t asid = v->ASID;
+    uint16_t asid = v->ASID;
     uint16_t flags = ((v->EHINV << 15) |
                       (v->RI1 << 14) |
                       (v->RI0 << 13) |
@@ -172,7 +172,7 @@ static void put_tlb(QEMUFile *f, void *pv, size_t size)
 
     qemu_put_betls(f, &v->VPN);
     qemu_put_be32s(f, &v->PageMask);
-    qemu_put_8s(f, &asid);
+    qemu_put_be16s(f, &asid);
     qemu_put_be16s(f, &flags);
     qemu_put_be64s(f, &v->PFN[0]);
     qemu_put_be64s(f, &v->PFN[1]);
@@ -192,8 +192,8 @@ const VMStateInfo vmstate_info_tlb = {
 
 const VMStateDescription vmstate_tlb = {
     .name = "cpu/tlb",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(nb_tlb, CPUMIPSTLBContext),
         VMSTATE_UINT32(tlb_in_use, CPUMIPSTLBContext),
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 69daade24e..31c85f9aee 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -679,7 +679,7 @@ static void sync_c0_tcstatus(CPUMIPSState *cpu, int tc,
 
     tcu = (v >> CP0TCSt_TCU0) & 0xf;
     tmx = (v >> CP0TCSt_TMX) & 0x1;
-    tasid = v & 0xff;
+    tasid = v & cpu->CP0_EntryHi_ASID_mask;
     tksu = (v >> CP0TCSt_TKSU) & 0x3;
 
     status = tcu << CP0St_CU0;
@@ -690,7 +690,7 @@ static void sync_c0_tcstatus(CPUMIPSState *cpu, int tc,
     cpu->CP0_Status |= status;
 
     /* Sync the TASID with EntryHi.  */
-    cpu->CP0_EntryHi &= ~0xff;
+    cpu->CP0_EntryHi &= ~cpu->CP0_EntryHi_ASID_mask;
     cpu->CP0_EntryHi |= tasid;
 
     compute_hflags(cpu);
@@ -702,7 +702,7 @@ static void sync_c0_entryhi(CPUMIPSState *cpu, int tc)
     int32_t *tcst;
     uint32_t asid, v = cpu->CP0_EntryHi;
 
-    asid = v & 0xff;
+    asid = v & cpu->CP0_EntryHi_ASID_mask;
 
     if (tc == cpu->current_tc) {
         tcst = &cpu->active_tc.CP0_TCStatus;
@@ -710,7 +710,7 @@ static void sync_c0_entryhi(CPUMIPSState *cpu, int tc)
         tcst = &cpu->tcs[tc].CP0_TCStatus;
     }
 
-    *tcst &= ~0xff;
+    *tcst &= ~cpu->CP0_EntryHi_ASID_mask;
     *tcst |= asid;
 }
 
@@ -1403,7 +1403,7 @@ void helper_mtc0_count(CPUMIPSState *env, target_ulong arg1)
 void helper_mtc0_entryhi(CPUMIPSState *env, target_ulong arg1)
 {
     target_ulong old, val, mask;
-    mask = (TARGET_PAGE_MASK << 1) | 0xFF;
+    mask = (TARGET_PAGE_MASK << 1) | env->CP0_EntryHi_ASID_mask;
     if (((env->CP0_Config4 >> CP0C4_IE) & 0x3) >= 2) {
         mask |= 1 << CP0EnHi_EHINV;
     }
@@ -1429,8 +1429,10 @@ void helper_mtc0_entryhi(CPUMIPSState *env, target_ulong arg1)
         sync_c0_entryhi(env, env->current_tc);
     }
     /* If the ASID changes, flush qemu's TLB.  */
-    if ((old & 0xFF) != (val & 0xFF))
+    if ((old & env->CP0_EntryHi_ASID_mask) !=
+        (val & env->CP0_EntryHi_ASID_mask)) {
         cpu_mips_tlb_flush(env, 1);
+    }
 }
 
 void helper_mttc0_entryhi(CPUMIPSState *env, target_ulong arg1)
@@ -1631,7 +1633,8 @@ void helper_mtc0_watchlo(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
 
 void helper_mtc0_watchhi(CPUMIPSState *env, target_ulong arg1, uint32_t sel)
 {
-    env->CP0_WatchHi[sel] = (arg1 & 0x40FF0FF8);
+    int mask = 0x40000FF8 | (env->CP0_EntryHi_ASID_mask << CP0WH_ASID);
+    env->CP0_WatchHi[sel] = arg1 & mask;
     env->CP0_WatchHi[sel] &= ~(env->CP0_WatchHi[sel] & arg1 & 0x7);
 }
 
@@ -1989,7 +1992,7 @@ static void r4k_fill_tlb(CPUMIPSState *env, int idx)
 #if defined(TARGET_MIPS64)
     tlb->VPN &= env->SEGMask;
 #endif
-    tlb->ASID = env->CP0_EntryHi & 0xFF;
+    tlb->ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     tlb->PageMask = env->CP0_PageMask;
     tlb->G = env->CP0_EntryLo0 & env->CP0_EntryLo1 & 1;
     tlb->V0 = (env->CP0_EntryLo0 & 2) != 0;
@@ -2010,7 +2013,7 @@ void r4k_helper_tlbinv(CPUMIPSState *env)
 {
     int idx;
     r4k_tlb_t *tlb;
-    uint8_t ASID = env->CP0_EntryHi & 0xFF;
+    uint16_t ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
 
     for (idx = 0; idx < env->tlb->nb_tlb; idx++) {
         tlb = &env->tlb->mmu.r4k.tlb[idx];
@@ -2036,7 +2039,7 @@ void r4k_helper_tlbwi(CPUMIPSState *env)
     r4k_tlb_t *tlb;
     int idx;
     target_ulong VPN;
-    uint8_t ASID;
+    uint16_t ASID;
     bool G, V0, D0, V1, D1;
 
     idx = (env->CP0_Index & ~0x80000000) % env->tlb->nb_tlb;
@@ -2045,7 +2048,7 @@ void r4k_helper_tlbwi(CPUMIPSState *env)
 #if defined(TARGET_MIPS64)
     VPN &= env->SEGMask;
 #endif
-    ASID = env->CP0_EntryHi & 0xff;
+    ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     G = env->CP0_EntryLo0 & env->CP0_EntryLo1 & 1;
     V0 = (env->CP0_EntryLo0 & 2) != 0;
     D0 = (env->CP0_EntryLo0 & 4) != 0;
@@ -2078,10 +2081,10 @@ void r4k_helper_tlbp(CPUMIPSState *env)
     target_ulong mask;
     target_ulong tag;
     target_ulong VPN;
-    uint8_t ASID;
+    uint16_t ASID;
     int i;
 
-    ASID = env->CP0_EntryHi & 0xFF;
+    ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     for (i = 0; i < env->tlb->nb_tlb; i++) {
         tlb = &env->tlb->mmu.r4k.tlb[i];
         /* 1k pages are not supported. */
@@ -2133,10 +2136,10 @@ static inline uint64_t get_entrylo_pfn_from_tlb(uint64_t tlb_pfn)
 void r4k_helper_tlbr(CPUMIPSState *env)
 {
     r4k_tlb_t *tlb;
-    uint8_t ASID;
+    uint16_t ASID;
     int idx;
 
-    ASID = env->CP0_EntryHi & 0xFF;
+    ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask;
     idx = (env->CP0_Index & ~0x80000000) % env->tlb->nb_tlb;
     tlb = &env->tlb->mmu.r4k.tlb[idx];
 
diff --git a/target-mips/translate.c b/target-mips/translate.c
index cc321e9cce..bab52cb254 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -20169,6 +20169,7 @@ MIPSCPU *cpu_mips_init(const char *cpu_model)
     cpu = MIPS_CPU(object_new(TYPE_MIPS_CPU));
     env = &cpu->env;
     env->cpu_model = def;
+    env->exception_base = (int32_t)0xBFC00000;
 
 #ifndef CONFIG_USER_ONLY
     mmu_init(env, def);
@@ -20191,6 +20192,12 @@ bool cpu_supports_cps_smp(const char *cpu_model)
     return (def->CP0_Config3 & (1 << CP0C3_CMGCR)) != 0;
 }
 
+void cpu_set_exception_base(int vp_index, target_ulong address)
+{
+    MIPSCPU *vp = MIPS_CPU(qemu_get_cpu(vp_index));
+    vp->env.exception_base = address;
+}
+
 void cpu_state_reset(CPUMIPSState *env)
 {
     MIPSCPU *cpu = mips_env_get_cpu(env);
@@ -20281,7 +20288,7 @@ void cpu_state_reset(CPUMIPSState *env)
     } else {
         env->CP0_ErrorEPC = env->active_tc.PC;
     }
-    env->active_tc.PC = (int32_t)0xBFC00000;
+    env->active_tc.PC = env->exception_base;
     env->CP0_Random = env->tlb->nb_tlb - 1;
     env->tlb->tlb_in_use = env->tlb->nb_tlb;
     env->CP0_Wired = 0;
@@ -20295,6 +20302,8 @@ void cpu_state_reset(CPUMIPSState *env)
     if (env->CP0_Config3 & (1 << CP0C3_CMGCR)) {
         env->CP0_CMGCRBase = 0x1fbf8000 >> 4;
     }
+    env->CP0_EntryHi_ASID_mask = (env->CP0_Config4 & (1 << CP0C4_AE)) ?
+                                 0x3ff : 0xff;
     env->CP0_Status = (1 << CP0St_BEV) | (1 << CP0St_ERL);
     /* vectored interrupts not implemented, timer on int 7,
        no performance counters. */
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index b10284cc5d..39ed5c4c1b 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -671,26 +671,23 @@ static const mips_def_t mips_defs[] =
         .mmu_type = MMU_TYPE_R4000,
     },
     {
-        /* A generic CPU supporting MIPS64 Release 6 ISA.
-           FIXME: Support IEEE 754-2008 FP.
-                  Eventually this should be replaced by a real CPU model. */
-        .name = "MIPS64R6-generic",
-        .CP0_PRid = 0x00010000,
+        .name = "I6400",
+        .CP0_PRid = 0x1A900,
         .CP0_Config0 = MIPS_CONFIG0 | (0x2 << CP0C0_AR) | (0x2 << CP0C0_AT) |
                        (MMU_TYPE_R4000 << CP0C0_MT),
-        .CP0_Config1 = MIPS_CONFIG1 | (1 << CP0C1_FP) | (63 << CP0C1_MMU) |
-                       (2 << CP0C1_IS) | (4 << CP0C1_IL) | (3 << CP0C1_IA) |
-                       (2 << CP0C1_DS) | (4 << CP0C1_DL) | (3 << CP0C1_DA) |
+        .CP0_Config1 = MIPS_CONFIG1 | (1 << CP0C1_FP) | (15 << CP0C1_MMU) |
+                       (2 << CP0C1_IS) | (5 << CP0C1_IL) | (3 << CP0C1_IA) |
+                       (2 << CP0C1_DS) | (5 << CP0C1_DL) | (3 << CP0C1_DA) |
                        (0 << CP0C1_PC) | (1 << CP0C1_WR) | (1 << CP0C1_EP),
         .CP0_Config2 = MIPS_CONFIG2,
         .CP0_Config3 = MIPS_CONFIG3 | (1U << CP0C3_M) |
                        (1 << CP0C3_CMGCR) | (1 << CP0C3_MSAP) |
                        (1 << CP0C3_BP) | (1 << CP0C3_BI) | (1 << CP0C3_ULRI) |
-                       (1 << CP0C3_RXI) | (1 << CP0C3_LPA),
+                       (1 << CP0C3_RXI) | (1 << CP0C3_LPA) | (1 << CP0C3_VInt),
         .CP0_Config4 = MIPS_CONFIG4 | (1U << CP0C4_M) | (3 << CP0C4_IE) |
-                       (0xfc << CP0C4_KScrExist),
+                       (1 << CP0C4_AE) | (0xfc << CP0C4_KScrExist),
         .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_XNP) | (1 << CP0C5_VP) |
-                       (1 << CP0C5_LLB),
+                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP),
         .CP0_Config5_rw_bitmask = (1 << CP0C5_MSAEn) | (1 << CP0C5_SBRI) |
                                   (1 << CP0C5_FRE) | (1 << CP0C5_UFE),
         .CP0_LLAddr_rw_bitmask = 0,
@@ -703,9 +700,10 @@ static const mips_def_t mips_defs[] =
         .CP0_PageGrain_rw_bitmask = (1 << CP0PG_ELPA),
         .CP1_fcr0 = (1 << FCR0_FREP) | (1 << FCR0_HAS2008) | (1 << FCR0_F64) |
                     (1 << FCR0_L) | (1 << FCR0_W) | (1 << FCR0_D) |
-                    (1 << FCR0_S) | (0x00 << FCR0_PRID) | (0x0 << FCR0_REV),
+                    (1 << FCR0_S) | (0x03 << FCR0_PRID) | (0x0 << FCR0_REV),
         .CP1_fcr31 = (1 << FCR31_ABS2008) | (1 << FCR31_NAN2008),
         .CP1_fcr31_rw_bitmask = 0x0103FFFF,
+        .MSAIR = 0x03 << MSAIR_ProcID,
         .SEGBITS = 48,
         .PABITS = 48,
         .insn_flags = CPU_MIPS64R6 | ASE_MSA,