Index: kernel/arch/mips32/src/exception.c
===================================================================
--- kernel/arch/mips32/src/exception.c	(revision 2277e03b97a6950736870a381ad825874af27449)
+++ kernel/arch/mips32/src/exception.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -165,10 +165,21 @@
 static void interrupt_exception(unsigned int n, istate_t *istate)
 {
+	uint32_t ip;
+	uint32_t im;
+
 	/* Decode interrupt number and process the interrupt */
-	uint32_t cause = (cp0_cause_read() >> 8) & 0xff;
+	ip = (cp0_cause_read() & cp0_cause_ip_mask) >> cp0_cause_ip_shift;
+	im = (cp0_status_read() & cp0_status_im_mask) >> cp0_status_im_shift;
 	
 	unsigned int i;
 	for (i = 0; i < 8; i++) {
-		if (cause & (1 << i)) {
+
+		/*
+		 * The interrupt could only occur if it is unmasked in the
+		 * status register. On the other hand, an interrupt can be
+		 * apparently pending even if it is masked, so we need to
+		 * check both the masked and pending interrupts.
+		 */
+		if (im & ip & (1 << i)) {
 			irq_t *irq = irq_dispatch_and_lock(i);
 			if (irq) {
Index: kernel/arch/mips32/src/interrupt.c
===================================================================
--- kernel/arch/mips32/src/interrupt.c	(revision 2277e03b97a6950736870a381ad825874af27449)
+++ kernel/arch/mips32/src/interrupt.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -45,9 +45,15 @@
 #define IRQ_COUNT   8
 #define TIMER_IRQ   7
+
+#ifdef MACHINE_msim
 #define DORDER_IRQ  5
+#endif
 
 function virtual_timer_fnc = NULL;
 static irq_t timer_irq;
+
+#ifdef MACHINE_msim
 static irq_t dorder_irq;
+#endif
 
 // TODO: This is SMP unsafe!!!
@@ -151,4 +157,5 @@
 }
 
+#ifdef MACHINE_msim
 static irq_ownership_t dorder_claim(irq_t *irq)
 {
@@ -160,4 +167,5 @@
 	dorder_ipi_ack(1 << dorder_cpuid());
 }
+#endif
 
 /* Initialize basic tables for exception dispatching */
@@ -176,4 +184,5 @@
 	cp0_unmask_int(TIMER_IRQ);
 	
+#ifdef MACHINE_msim
 	irq_initialize(&dorder_irq);
 	dorder_irq.devno = device_assign_devno();
@@ -184,4 +193,5 @@
 	
 	cp0_unmask_int(DORDER_IRQ);
+#endif
 }
 
Index: kernel/arch/mips32/src/mach/malta/malta.c
===================================================================
--- kernel/arch/mips32/src/mach/malta/malta.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
+++ kernel/arch/mips32/src/mach/malta/malta.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2013 Jakub Jermar
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in the
+ *   documentation and/or other materials provided with the distribution.
+ * - The name of the author may not be used to endorse or promote products
+ *   derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/** @addtogroup mips32 
+ * @{
+ */
+/** @file
+ *  @brief MIPS Malta platform driver.
+ */
+
+#include <arch/mach/malta/malta.h>
+#include <console/console.h>
+#include <console/chardev.h>
+#include <arch/mm/page.h>
+
+static void malta_init(void);
+static void malta_cpu_halt(void);
+static void malta_get_memory_extents(uintptr_t *, size_t *);
+static void malta_frame_init(void);
+static void malta_output_init(void);
+static void malta_input_init(void);
+static const char *malta_get_platform_name(void);
+
+struct mips32_machine_ops malta_machine_ops = {
+	.machine_init = malta_init,
+	.machine_cpu_halt = malta_cpu_halt,
+	.machine_get_memory_extents = malta_get_memory_extents,
+	.machine_frame_init = malta_frame_init,
+	.machine_output_init = malta_output_init,
+	.machine_input_init = malta_input_init,
+	.machine_get_platform_name = malta_get_platform_name	
+};
+
+void malta_init(void)
+{
+}
+
+void malta_cpu_halt(void)
+{
+}
+
+void malta_get_memory_extents(uintptr_t *start, size_t *size)
+{
+}
+
+void malta_frame_init(void)
+{
+}
+
+#define YAMON_SUBR_BASE         PA2KA(0x1fc00500)
+#define YAMON_SUBR_PRINT_COUNT  (YAMON_SUBR_BASE + 0x4)
+
+typedef void (**yamon_print_count_ptr_t)(uint32_t, const char *, uint32_t);
+
+yamon_print_count_ptr_t yamon_print_count =
+    (yamon_print_count_ptr_t) YAMON_SUBR_PRINT_COUNT;
+
+static void yamon_putchar(outdev_t *dev, const wchar_t wch)
+{
+
+        const char ch = (char) wch;
+
+        (*yamon_print_count)(0, &ch, 1);
+}
+
+static outdev_t yamon_outdev;
+static outdev_operations_t yamon_outdev_ops = {
+	.write = yamon_putchar,
+	.redraw = NULL
+};
+
+void malta_output_init(void)
+{
+	outdev_initialize("yamon", &yamon_outdev, &yamon_outdev_ops);
+	stdout_wire(&yamon_outdev);
+}
+
+void malta_input_init(void)
+{
+}
+
+const char *malta_get_platform_name(void)
+{
+	return "malta";
+}
+
+/** @}
+ */
Index: kernel/arch/mips32/src/mach/msim/msim.c
===================================================================
--- kernel/arch/mips32/src/mach/msim/msim.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
+++ kernel/arch/mips32/src/mach/msim/msim.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2013 Jakub Jermar
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in the
+ *   documentation and/or other materials provided with the distribution.
+ * - The name of the author may not be used to endorse or promote products
+ *   derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/** @addtogroup mips32 
+ * @{
+ */
+/** @file
+ *  @brief msim platform driver.
+ */
+
+#include <arch/mach/msim/msim.h>
+#include <console/console.h>
+#include <sysinfo/sysinfo.h>
+#include <arch/drivers/msim.h>
+#include <genarch/drivers/dsrln/dsrlnin.h>
+#include <genarch/drivers/dsrln/dsrlnout.h>
+#include <genarch/srln/srln.h>
+
+static void msim_init(void);
+static void msim_cpu_halt(void);
+static void msim_get_memory_extents(uintptr_t *, size_t *);
+static void msim_frame_init(void);
+static void msim_output_init(void);
+static void msim_input_init(void);
+static const char *msim_get_platform_name(void);
+
+struct mips32_machine_ops msim_machine_ops = {
+	.machine_init = msim_init,
+	.machine_cpu_halt = msim_cpu_halt,
+	.machine_get_memory_extents = msim_get_memory_extents,
+	.machine_frame_init = msim_frame_init,
+	.machine_output_init = msim_output_init,
+	.machine_input_init = msim_input_init,
+	.machine_get_platform_name = msim_get_platform_name	
+};
+
+void msim_init(void)
+{
+}
+
+void msim_cpu_halt(void)
+{
+}
+
+void msim_get_memory_extents(uintptr_t *start, size_t *size)
+{
+}
+
+void msim_frame_init(void)
+{
+}
+
+void msim_output_init(void)
+{
+#ifdef CONFIG_MSIM_PRN
+	outdev_t *dsrlndev = dsrlnout_init((ioport8_t *) MSIM_KBD_ADDRESS);
+	if (dsrlndev)
+		stdout_wire(dsrlndev);
+#endif
+}
+
+void msim_input_init(void)
+{
+#ifdef CONFIG_MSIM_KBD
+	/*
+	 * Initialize the msim keyboard port. Then initialize the serial line
+	 * module and connect it to the msim keyboard. Enable keyboard
+	 * interrupts.
+	 */
+	dsrlnin_instance_t *dsrlnin_instance
+	    = dsrlnin_init((dsrlnin_t *) MSIM_KBD_ADDRESS, MSIM_KBD_IRQ);
+	if (dsrlnin_instance) {
+		srln_instance_t *srln_instance = srln_init();
+		if (srln_instance) {
+			indev_t *sink = stdin_wire();
+			indev_t *srln = srln_wire(srln_instance, sink);
+			dsrlnin_wire(dsrlnin_instance, srln);
+			cp0_unmask_int(MSIM_KBD_IRQ);
+		}
+	}
+	
+	/*
+	 * This is the necessary evil until the userspace driver is entirely
+	 * self-sufficient.
+	 */
+	sysinfo_set_item_val("kbd", NULL, true);
+	sysinfo_set_item_val("kbd.inr", NULL, MSIM_KBD_IRQ);
+	sysinfo_set_item_val("kbd.address.physical", NULL,
+	    PA2KA(MSIM_KBD_ADDRESS));
+#endif
+}
+
+const char *msim_get_platform_name(void)
+{
+	return "msim";
+}
+
+/** @}
+ */
Index: kernel/arch/mips32/src/machine_func.c
===================================================================
--- kernel/arch/mips32/src/machine_func.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
+++ kernel/arch/mips32/src/machine_func.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2009 Vineeth Pillai
+ * Copyright (c) 2012 Jakub Jermar
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ *   notice, this list of conditions and the following disclaimer.
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in the
+ *   documentation and/or other materials provided with the distribution.
+ * - The name of the author may not be used to endorse or promote products
+ *   derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/** @addtogroup mips32
+ * @{
+ */
+/** @file
+ *  @brief Definitions of machine specific functions.
+ *
+ *  These functions allow us to support various kinds of mips32 machines
+ *  in a unified way.
+ */
+
+#include <arch/machine_func.h>
+#if defined(MACHINE_msim)
+#include <arch/mach/msim/msim.h>
+#elif defined(MACHINE_lmalta) || defined(MACHINE_bmalta)
+#include <arch/mach/malta/malta.h>
+#endif
+
+/** Pointer to machine_ops structure being used. */
+struct mips32_machine_ops *machine_ops;
+
+/** Initialize machine_ops pointer. */
+void machine_ops_init(void)
+{
+#if defined(MACHINE_msim)
+	machine_ops = &msim_machine_ops;
+#elif defined(MACHINE_lmalta) || defined(MACHINE_bmalta)
+	machine_ops = &malta_machine_ops;
+#else
+#error Machine type not defined.
+#endif
+}
+
+void machine_init(void)
+{
+	(machine_ops->machine_init)();
+}
+
+
+/** Halts CPU. */
+void machine_cpu_halt(void)
+{
+	(machine_ops->machine_cpu_halt)();
+}
+
+/** Get extents of available memory.
+ *
+ * @param start		Place to store memory start address.
+ * @param size		Place to store memory size.
+ */
+void machine_get_memory_extents(uintptr_t *start, size_t *size)
+{
+	(machine_ops->machine_get_memory_extents)(start, size);
+}
+
+/*
+ * Machine specific frame initialization
+ */
+void machine_frame_init(void)
+{
+	(machine_ops->machine_frame_init)();
+}
+
+/*
+ * configure the output device.
+ */
+void machine_output_init(void)
+{
+	(machine_ops->machine_output_init)();
+}
+
+/*
+ * configure the input device.
+ */
+void machine_input_init(void)
+{
+	(machine_ops->machine_input_init)();
+}
+
+const char *machine_get_platform_name(void)
+{
+	if (machine_ops->machine_get_platform_name)
+		return machine_ops->machine_get_platform_name();
+	return NULL;
+}
+
+/** @}
+ */
Index: kernel/arch/mips32/src/mips32.c
===================================================================
--- kernel/arch/mips32/src/mips32.c	(revision 2277e03b97a6950736870a381ad825874af27449)
+++ kernel/arch/mips32/src/mips32.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -41,14 +41,9 @@
 #include <memstr.h>
 #include <userspace.h>
-#include <console/console.h>
 #include <syscall/syscall.h>
 #include <sysinfo/sysinfo.h>
 #include <arch/debug.h>
 #include <arch/debugger.h>
-#include <arch/drivers/msim.h>
-#include <genarch/fb/fb.h>
-#include <genarch/drivers/dsrln/dsrlnin.h>
-#include <genarch/drivers/dsrln/dsrlnout.h>
-#include <genarch/srln/srln.h>
+#include <arch/machine_func.h>
 
 /* Size of the code jumping to the exception handler code
@@ -70,4 +65,8 @@
 
 size_t cpu_count = 0;
+
+#if defined(MACHINE_lmalta) || defined(MACHINE_bmalta)
+size_t sdram_size = 0;
+#endif
 
 /** Performs mips32-specific initialization before main_bsp() is called. */
@@ -88,4 +87,11 @@
 			cpu_count++;
 	}
+
+#if defined(MACHINE_lmalta) || defined(MACHINE_bmalta)
+	sdram_size = bootinfo->sdram_size;
+#endif
+
+	/* Initialize machine_ops pointer. */
+	machine_ops_init();
 }
 
@@ -124,26 +130,7 @@
 {
 	interrupt_init();
-	
-#ifdef CONFIG_FB
-	/* GXemul framebuffer */
-	fb_properties_t gxemul_prop = {
-		.addr = 0x12000000,
-		.offset = 0,
-		.x = 640,
-		.y = 480,
-		.scan = 1920,
-		.visual = VISUAL_RGB_8_8_8,
-	};
-	
-	outdev_t *fbdev = fb_init(&gxemul_prop);
-	if (fbdev)
-		stdout_wire(fbdev);
-#endif
-
-#ifdef CONFIG_MIPS_PRN
-	outdev_t *dsrlndev = dsrlnout_init((ioport8_t *) MSIM_KBD_ADDRESS);
-	if (dsrlndev)
-		stdout_wire(dsrlndev);
-#endif
+
+	machine_init();
+	machine_output_init();
 }
 
@@ -158,45 +145,10 @@
 void arch_post_smp_init(void)
 {
-	static const char *platform;
-
 	/* Set platform name. */
-#ifdef MACHINE_msim
-	platform = "msim";
-#endif
-#ifdef MACHINE_bgxemul
-	platform = "gxemul";
-#endif
-#ifdef MACHINE_lgxemul
-	platform = "gxemul";
-#endif
-	sysinfo_set_item_data("platform", NULL, (void *) platform,
-	    str_size(platform));
-
-#ifdef CONFIG_MIPS_KBD
-	/*
-	 * Initialize the msim/GXemul keyboard port. Then initialize the serial line
-	 * module and connect it to the msim/GXemul keyboard. Enable keyboard interrupts.
-	 */
-	dsrlnin_instance_t *dsrlnin_instance
-	    = dsrlnin_init((dsrlnin_t *) MSIM_KBD_ADDRESS, MSIM_KBD_IRQ);
-	if (dsrlnin_instance) {
-		srln_instance_t *srln_instance = srln_init();
-		if (srln_instance) {
-			indev_t *sink = stdin_wire();
-			indev_t *srln = srln_wire(srln_instance, sink);
-			dsrlnin_wire(dsrlnin_instance, srln);
-			cp0_unmask_int(MSIM_KBD_IRQ);
-		}
-	}
-	
-	/*
-	 * This is the necessary evil until the userspace driver is entirely
-	 * self-sufficient.
-	 */
-	sysinfo_set_item_val("kbd", NULL, true);
-	sysinfo_set_item_val("kbd.inr", NULL, MSIM_KBD_IRQ);
-	sysinfo_set_item_val("kbd.address.physical", NULL,
-	    PA2KA(MSIM_KBD_ADDRESS));
-#endif
+	sysinfo_set_item_data("platform", NULL,
+	    (void *) machine_get_platform_name(),
+	    str_size(machine_get_platform_name()));
+
+	machine_input_init();
 }
 
Index: kernel/arch/mips32/src/mm/frame.c
===================================================================
--- kernel/arch/mips32/src/mm/frame.c	(revision 2277e03b97a6950736870a381ad825874af27449)
+++ kernel/arch/mips32/src/mm/frame.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -40,5 +40,8 @@
 #include <mm/asid.h>
 #include <config.h>
+#ifdef MACHINE_msim
 #include <arch/drivers/msim.h>
+#endif
+#include <arch/arch.h>
 #include <print.h>
 
@@ -84,9 +87,7 @@
 		return false;
 #endif
-	
-#if defined(MACHINE_lgxemul) || defined(MACHINE_bgxemul)
-	/* gxemul devices */
-	if (overlaps(frame << ZERO_PAGE_WIDTH, ZERO_PAGE_SIZE,
-	    0x10000000, MiB2SIZE(256)))
+
+#if defined(MACHINE_lmalta) || defined(MACHINE_bmalta)
+	if (frame >= (sdram_size >> ZERO_PAGE_WIDTH))
 		return false;
 #endif
@@ -225,11 +226,4 @@
 					if (ZERO_PAGE_VALUE != 0xdeadbeef)
 						avail = false;
-#if defined(MACHINE_lgxemul) || defined(MACHINE_bgxemul)
-					else {
-						ZERO_PAGE_VALUE_KSEG1(frame) = 0xaabbccdd;
-						if (ZERO_PAGE_VALUE_KSEG1(frame) != 0xaabbccdd)
-							avail = false;
-					}
-#endif
 				}
 			}
@@ -247,4 +241,30 @@
 	/* Blacklist interrupt vector frame */
 	frame_mark_unavailable(0, 1);
+
+#if defined(MACHINE_lmalta) || defined(MACHINE_bmalta)
+	/* Blacklist memory regions used by YAMON.
+	 *
+	 * The YAMON User's Manual vaguely says the following physical addresses
+	 * are taken by YAMON:
+	 *
+	 * 0x1000	YAMON functions
+	 * 0x5000	YAMON code
+	 *
+	 * These addresses overlap with the beginning of the SDRAM so we need to
+	 * make sure they cannot be allocated.
+	 *
+	 * The User's Manual unfortunately does not say where does the SDRAM
+	 * portion used by YAMON end.
+	 *
+	 * Looking into the YAMON 02.21 sources, it looks like the first free
+	 * address is computed dynamically and depends on the size of the YAMON
+	 * image. From the YAMON binary, it appears to be 0xc0d50 or roughly
+	 * 772 KiB for that particular version.
+	 *
+	 * Linux is linked to 1MiB which seems to be a safe bet and a reasonable
+	 * upper bound for memory taken by YAMON. We will use it too.
+	 */
+	frame_mark_unavailable(0, 1024 * 1024 / FRAME_SIZE);
+#endif
 	
 	/* Cleanup */
Index: kernel/arch/mips32/src/mm/tlb.c
===================================================================
--- kernel/arch/mips32/src/mm/tlb.c	(revision 2277e03b97a6950736870a381ad825874af27449)
+++ kernel/arch/mips32/src/mm/tlb.c	(revision 2b95d13f98bfcaac3a7fb025f44c611b5d228c08)
@@ -48,5 +48,12 @@
 #include <symtab.h>
 
-static pte_t *find_mapping_and_check(uintptr_t, int, istate_t *);
+#define VPN_SHIFT	12	
+#define ADDR2VPN(a)	((a) >> VPN_SHIFT)
+#define ADDR2VPN2(a)	(ADDR2VPN((a)) >> 1)
+#define VPN2ADDR(vpn)	((vpn) << VPN_SHIFT)
+#define VPN22ADDR(vpn2)	(VPN2ADDR(vpn2) << 1)
+
+#define BANK_SELECT_BIT(a)	(((a) >> PAGE_WIDTH) & 1) 
+	
 
 /** Initialize TLB.
@@ -84,14 +91,11 @@
 {
 	entry_lo_t lo;
-	entry_hi_t hi;
-	asid_t asid;
 	uintptr_t badvaddr;
 	pte_t *pte;
 	
 	badvaddr = cp0_badvaddr_read();
-	asid = AS->asid;
-	
-	pte = find_mapping_and_check(badvaddr, PF_ACCESS_READ, istate);
-	if (pte) {
+
+	pte = page_mapping_find(AS, badvaddr, true);
+	if (pte && pte->p) {
 		/*
 		 * Record access to PTE.
@@ -99,5 +103,4 @@
 		pte->a = 1;
 
-		tlb_prepare_entry_hi(&hi, asid, badvaddr);
 		tlb_prepare_entry_lo(&lo, pte->g, pte->p, pte->d,
 		    pte->cacheable, pte->pfn);
@@ -106,6 +109,5 @@
 		 * New entry is to be inserted into TLB
 		 */
-		cp0_entry_hi_write(hi.value);
-		if ((badvaddr / PAGE_SIZE) % 2 == 0) {
+		if (BANK_SELECT_BIT(badvaddr) == 0) {
 			cp0_entry_lo0_write(lo.value);
 			cp0_entry_lo1_write(0);
@@ -116,5 +118,8 @@
 		cp0_pagemask_write(TLB_PAGE_MASK_16K);
 		tlbwr();
-	}
+		return;
+	}
+
+	(void) as_page_fault(badvaddr, PF_ACCESS_READ, istate);
 }
 
@@ -125,25 +130,33 @@
 void tlb_invalid(istate_t *istate)
 {
+	entry_lo_t lo;
 	tlb_index_t index;
 	uintptr_t badvaddr;
-	entry_lo_t lo;
-	entry_hi_t hi;
 	pte_t *pte;
-
-	badvaddr = cp0_badvaddr_read();
 
 	/*
 	 * Locate the faulting entry in TLB.
 	 */
-	hi.value = cp0_entry_hi_read();
-	tlb_prepare_entry_hi(&hi, hi.asid, badvaddr);
-	cp0_entry_hi_write(hi.value);
 	tlbp();
 	index.value = cp0_index_read();
 
+#if defined(PROCESSOR_4Kc)
+	/*
+	 * This can happen on a 4Kc when Status.EXL is 1 and there is a TLB miss.
+	 * EXL is 1 when interrupts are disabled. The combination of a TLB miss
+	 * and disabled interrupts is possible in copy_to/from_uspace().
+	 */
+	if (index.p) {
+		tlb_refill(istate);
+		return;
+	}
+#endif
+
 	ASSERT(!index.p);
 
-	pte = find_mapping_and_check(badvaddr, PF_ACCESS_READ, istate);
-	if (pte) {
+	badvaddr = cp0_badvaddr_read();
+
+	pte = page_mapping_find(AS, badvaddr, true);
+	if (pte && pte->p) {
 		/*
 		 * Read the faulting TLB entry.
@@ -162,11 +175,13 @@
 		 * The entry is to be updated in TLB.
 		 */
-		if ((badvaddr / PAGE_SIZE) % 2 == 0)
+		if (BANK_SELECT_BIT(badvaddr) == 0)
 			cp0_entry_lo0_write(lo.value);
 		else
 			cp0_entry_lo1_write(lo.value);
-		cp0_pagemask_write(TLB_PAGE_MASK_16K);
 		tlbwi();
-	}
+		return;
+	}
+
+	(void) as_page_fault(badvaddr, PF_ACCESS_READ, istate);
 }
 
@@ -177,18 +192,12 @@
 void tlb_modified(istate_t *istate)
 {
+	entry_lo_t lo;
 	tlb_index_t index;
 	uintptr_t badvaddr;
-	entry_lo_t lo;
-	entry_hi_t hi;
 	pte_t *pte;
-
-	badvaddr = cp0_badvaddr_read();
 
 	/*
 	 * Locate the faulting entry in TLB.
 	 */
-	hi.value = cp0_entry_hi_read();
-	tlb_prepare_entry_hi(&hi, hi.asid, badvaddr);
-	cp0_entry_hi_write(hi.value);
 	tlbp();
 	index.value = cp0_index_read();
@@ -199,6 +208,8 @@
 	ASSERT(!index.p);
 
-	pte = find_mapping_and_check(badvaddr, PF_ACCESS_WRITE, istate);
-	if (pte) {
+	badvaddr = cp0_badvaddr_read();
+
+	pte = page_mapping_find(AS, badvaddr, true);
+	if (pte && pte->p && pte->w) {
 		/*
 		 * Read the faulting TLB entry.
@@ -218,54 +229,13 @@
 		 * The entry is to be updated in TLB.
 		 */
-		if ((badvaddr / PAGE_SIZE) % 2 == 0)
+		if (BANK_SELECT_BIT(badvaddr) == 0)
 			cp0_entry_lo0_write(lo.value);
 		else
 			cp0_entry_lo1_write(lo.value);
-		cp0_pagemask_write(TLB_PAGE_MASK_16K);
 		tlbwi();
-	}
-}
-
-/** Try to find PTE for faulting address.
- *
- * @param badvaddr	Faulting virtual address.
- * @param access	Access mode that caused the fault.
- * @param istate	Pointer to interrupted state.
- *
- * @return		PTE on success, NULL otherwise.
- */
-pte_t *find_mapping_and_check(uintptr_t badvaddr, int access, istate_t *istate)
-{
-	entry_hi_t hi;
-	pte_t *pte;
-
-	hi.value = cp0_entry_hi_read();
-
-	ASSERT(hi.asid == AS->asid);
-
-	/*
-	 * Check if the mapping exists in page tables.
-	 */	
-	pte = page_mapping_find(AS, badvaddr, true);
-	if (pte && pte->p && (pte->w || access != PF_ACCESS_WRITE)) {
-		/*
-		 * Mapping found in page tables.
-		 * Immediately succeed.
-		 */
-		return pte;
-	}
-
-	/*
-	 * Mapping not found in page tables.
-	 * Resort to higher-level page fault handler.
-	 */
-	if (as_page_fault(badvaddr, access, istate) == AS_PF_OK) {
-		pte = page_mapping_find(AS, badvaddr, true);
-		ASSERT(pte && pte->p);
-		ASSERT(pte->w || access != PF_ACCESS_WRITE);
-		return pte;
-	}
-
-	return NULL;
+		return;
+	}
+
+	(void) as_page_fault(badvaddr, PF_ACCESS_WRITE, istate);
 }
 
@@ -284,5 +254,6 @@
 void tlb_prepare_entry_hi(entry_hi_t *hi, asid_t asid, uintptr_t addr)
 {
-	hi->value = ALIGN_DOWN(addr, PAGE_SIZE * 2);
+	hi->value = 0;
+	hi->vpn2 = ADDR2VPN2(ALIGN_DOWN(addr, PAGE_SIZE));
 	hi->asid = asid;
 }
@@ -291,12 +262,15 @@
 void tlb_print(void)
 {
-	page_mask_t mask;
-	entry_lo_t lo0, lo1;
+	page_mask_t mask, mask_save;
+	entry_lo_t lo0, lo0_save, lo1, lo1_save;
 	entry_hi_t hi, hi_save;
 	unsigned int i;
 
 	hi_save.value = cp0_entry_hi_read();
-	
-	printf("[nr] [asid] [vpn2] [mask] [gvdc] [pfn ]\n");
+	lo0_save.value = cp0_entry_lo0_read();
+	lo1_save.value = cp0_entry_lo1_read();
+	mask_save.value = cp0_pagemask_read();
+	
+	printf("[nr] [asid] [vpn2    ] [mask] [gvdc] [pfn     ]\n");
 	
 	for (i = 0; i < TLB_ENTRY_COUNT; i++) {
@@ -309,12 +283,15 @@
 		lo1.value = cp0_entry_lo1_read();
 		
-		printf("%-4u %-6u %#6x %#6x  %1u%1u%1u%1u  %#6x\n",
-		    i, hi.asid, hi.vpn2, mask.mask,
-		    lo0.g, lo0.v, lo0.d, lo0.c, lo0.pfn);
-		printf("                           %1u%1u%1u%1u  %#6x\n",
-		    lo1.g, lo1.v, lo1.d, lo1.c, lo1.pfn);
+		printf("%-4u %-6u %0#10x %-#6x  %1u%1u%1u%1u  %0#10x\n",
+		    i, hi.asid, VPN22ADDR(hi.vpn2), mask.mask,
+		    lo0.g, lo0.v, lo0.d, lo0.c, lo0.pfn << FRAME_WIDTH);
+		printf("                               %1u%1u%1u%1u  %0#10x\n",
+		    lo1.g, lo1.v, lo1.d, lo1.c, lo1.pfn << FRAME_WIDTH);
 	}
 	
 	cp0_entry_hi_write(hi_save.value);
+	cp0_entry_lo0_write(lo0_save.value);
+	cp0_entry_lo1_write(lo1_save.value);
+	cp0_pagemask_write(mask_save.value);
 }
 
@@ -322,11 +299,11 @@
 void tlb_invalidate_all(void)
 {
-	ipl_t ipl;
 	entry_lo_t lo0, lo1;
 	entry_hi_t hi_save;
 	int i;
 
+	ASSERT(interrupts_disabled());
+
 	hi_save.value = cp0_entry_hi_read();
-	ipl = interrupts_disable();
 
 	for (i = TLB_WIRED; i < TLB_ENTRY_COUNT; i++) {
@@ -346,5 +323,4 @@
 	}
 	
-	interrupts_restore(ipl);
 	cp0_entry_hi_write(hi_save.value);
 }
@@ -356,13 +332,12 @@
 void tlb_invalidate_asid(asid_t asid)
 {
-	ipl_t ipl;
 	entry_lo_t lo0, lo1;
 	entry_hi_t hi, hi_save;
 	int i;
 
+	ASSERT(interrupts_disabled());
 	ASSERT(asid != ASID_INVALID);
 
 	hi_save.value = cp0_entry_hi_read();
-	ipl = interrupts_disable();
 	
 	for (i = 0; i < TLB_ENTRY_COUNT; i++) {
@@ -386,5 +361,4 @@
 	}
 	
-	interrupts_restore(ipl);
 	cp0_entry_hi_write(hi_save.value);
 }
@@ -400,8 +374,9 @@
 {
 	unsigned int i;
-	ipl_t ipl;
 	entry_lo_t lo0, lo1;
 	entry_hi_t hi, hi_save;
 	tlb_index_t index;
+
+	ASSERT(interrupts_disabled());
 	
 	if (asid == ASID_INVALID)
@@ -409,8 +384,6 @@
 
 	hi_save.value = cp0_entry_hi_read();
-	ipl = interrupts_disable();
 
 	for (i = 0; i < cnt + 1; i += 2) {
-		hi.value = 0;
 		tlb_prepare_entry_hi(&hi, asid, page + i * PAGE_SIZE);
 		cp0_entry_hi_write(hi.value);
@@ -439,5 +412,4 @@
 	}
 	
-	interrupts_restore(ipl);
 	cp0_entry_hi_write(hi_save.value);
 }
