12 files changed, 396 insertions, 172 deletions

diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index 0b78fcbf044a..686249c5c328 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -121,7 +121,11 @@ FEXPORT(restore_partial)		# restore partial frame
         SAVE_AT
         SAVE_TEMP
         LONG_L  v0, PT_STATUS(sp)
-        and     v0, 1
+#if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
+        and     v0, ST0_IEP
+#else
+        and     v0, ST0_IE
+#endif
         beqz    v0, 1f
         jal     trace_hardirqs_on
         b       2f
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index aacd4a005c5f..297bd56c2347 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -128,6 +128,37 @@ handle_vcei:
 
         .align  5
 NESTED(handle_int, PT_SIZE, sp)
+#ifdef CONFIG_TRACE_IRQFLAGS
+        /*
+         * Check to see if the interrupted code has just disabled
+         * interrupts and ignore this interrupt for now if so.
+         *
+         * local_irq_disable() disables interrupts and then calls
+         * trace_hardirqs_off() to track the state. If an interrupt is taken
+         * after interrupts are disabled but before the state is updated
+         * it will appear to restore_all that it is incorrectly returning with
+         * interrupts disabled
+         */
+        .set    push
+        .set    noat
+        mfc0    k0, CP0_STATUS
+#if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
+        and     k0, ST0_IEP
+        bnez    k0, 1f
+
+        mfc0    k0, EP0_EPC
+        .set    noreorder
+        j       k0
+        rfe
+#else
+        and     k0, ST0_IE
+        bnez    k0, 1f
+
+        eret
+#endif
+1:
+        .set pop
+#endif
         SAVE_ALL
         CLI
         TRACE_IRQS_OFF
@@ -181,13 +212,13 @@ NESTED(except_vec_vi, 0, sp)
          * during service by SMTC kernel, we also want to
          * pass the IM value to be cleared.
          */
-EXPORT(except_vec_vi_mori)
+FEXPORT(except_vec_vi_mori)
         ori     a0, $0, 0
 #endif /* CONFIG_MIPS_MT_SMTC */
-EXPORT(except_vec_vi_lui)
+FEXPORT(except_vec_vi_lui)
         lui     v0, 0           /* Patched */
         j       except_vec_vi_handler
-EXPORT(except_vec_vi_ori)
+FEXPORT(except_vec_vi_ori)
          ori    v0, 0           /* Patched */
         .set    pop
         END(except_vec_vi)
@@ -220,7 +251,17 @@ NESTED(except_vec_vi_handler, 0, sp)
         _ehb
 #endif /* CONFIG_MIPS_MT_SMTC */
         CLI
+#ifdef CONFIG_TRACE_IRQFLAGS
+        move    s0, v0
+#ifdef CONFIG_MIPS_MT_SMTC
+        move    s1, a0
+#endif
         TRACE_IRQS_OFF
+#ifdef CONFIG_MIPS_MT_SMTC
+        move    a0, s1
+#endif
+        move    v0, s0
+#endif
 
         LONG_L  s0, TI_REGS($28)
         LONG_S  sp, TI_REGS($28)
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 5929f883e46b..29eadd404fa5 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -70,6 +70,7 @@ static int sp_stopping = 0;
 #define MTSP_SYSCALL_GETTIME    (MTSP_SYSCALL_BASE + 7)
 #define MTSP_SYSCALL_PIPEFREQ   (MTSP_SYSCALL_BASE + 8)
 #define MTSP_SYSCALL_GETTOD     (MTSP_SYSCALL_BASE + 9)
+#define MTSP_SYSCALL_IOCTL     (MTSP_SYSCALL_BASE + 10)
 
 #define MTSP_O_RDONLY           0x0000
 #define MTSP_O_WRONLY           0x0001
@@ -110,7 +111,8 @@ struct apsp_table syscall_command_table[] = {
         { MTSP_SYSCALL_CLOSE, __NR_close },
         { MTSP_SYSCALL_READ, __NR_read },
         { MTSP_SYSCALL_WRITE, __NR_write },
-        { MTSP_SYSCALL_LSEEK32, __NR_lseek }
+        { MTSP_SYSCALL_LSEEK32, __NR_lseek },
+        { MTSP_SYSCALL_IOCTL, __NR_ioctl }
 };
 
 static int sp_syscall(int num, int arg0, int arg1, int arg2, int arg3)
@@ -189,6 +191,8 @@ void sp_work_handle_request(void)
         struct mtsp_syscall_generic generic;
         struct mtsp_syscall_ret ret;
         struct kspd_notifications *n;
+        unsigned long written;
+        mm_segment_t old_fs;
         struct timeval tv;
         struct timezone tz;
         int cmd;
@@ -199,7 +203,11 @@ void sp_work_handle_request(void)
 
         ret.retval = -1;
 
-        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall), 0)) {
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+
+        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall))) {
+                set_fs(old_fs);
                 printk(KERN_ERR "Expected request but nothing to read\n");
                 return;
         }
@@ -207,7 +215,8 @@ void sp_work_handle_request(void)
         size = sc.size;
 
         if (size) {
-                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size, 0)) {
+                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size)) {
+                        set_fs(old_fs);
                         printk(KERN_ERR "Expected request but nothing to read\n");
                         return;
                 }
@@ -280,8 +289,11 @@ void sp_work_handle_request(void)
         if (vpe_getuid(SP_VPE))
                 sp_setfsuidgid( 0, 0);
 
-        if ((rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(struct mtsp_syscall_ret), 0))
-            < sizeof(struct mtsp_syscall_ret))
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+        written = rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(ret));
+        set_fs(old_fs);
+        if (written < sizeof(ret))
                 printk("KSPD: sp_work_handle_request failed to send to SP\n");
 }
 
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 1df544c1f966..37849edd0645 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -311,6 +311,8 @@ asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
         return ret;
 }
 
+#ifdef CONFIG_SYSVIPC
+
 asmlinkage long
 sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 {
@@ -368,6 +370,16 @@ sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
         return err;
 }
 
+#else
+
+asmlinkage long
+sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
+{
+        return -ENOSYS;
+}
+
+#endif /* CONFIG_SYSVIPC */
+
 #ifdef CONFIG_MIPS32_N32
 asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
 {
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 59c1577ecbb3..dbd42adc52ed 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -114,14 +114,6 @@ LEAF(_save_fp_context32)
  */
 LEAF(_restore_fp_context)
         EX      lw t0, SC_FPC_CSR(a0)
-
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
-
 #ifdef CONFIG_64BIT
         EX      ldc1 $f1, SC_FPREGS+8(a0)
         EX      ldc1 $f3, SC_FPREGS+24(a0)
@@ -165,14 +157,6 @@ LEAF(_restore_fp_context)
 LEAF(_restore_fp_context32)
         /* Restore an o32 sigcontext.  */
         EX      lw t0, SC32_FPC_CSR(a0)
-
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
-
         EX      ldc1 $f0, SC32_FPREGS+0(a0)
         EX      ldc1 $f2, SC32_FPREGS+16(a0)
         EX      ldc1 $f4, SC32_FPREGS+32(a0)
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index e14ae09eda2b..e6e3047151a6 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -54,6 +54,7 @@ static struct chan_waitqueues {
         wait_queue_head_t rt_queue;
         wait_queue_head_t lx_queue;
         atomic_t in_open;
+        struct mutex mutex;
 } channel_wqs[RTLX_CHANNELS];
 
 static struct irqaction irq;
@@ -146,7 +147,7 @@ static void stopping(int vpe)
 
 int rtlx_open(int index, int can_sleep)
 {
-        volatile struct rtlx_info **p;
+        struct rtlx_info **p;
         struct rtlx_channel *chan;
         enum rtlx_state state;
         int ret = 0;
@@ -179,13 +180,24 @@ int rtlx_open(int index, int can_sleep)
                         }
                 }
 
+                smp_rmb();
                 if (*p == NULL) {
                         if (can_sleep) {
-                                __wait_event_interruptible(channel_wqs[index].lx_queue,
-                                                           *p != NULL,
-                                                           ret);
-                                if (ret)
+                                DEFINE_WAIT(wait);
+
+                                for (;;) {
+                                        prepare_to_wait(&channel_wqs[index].lx_queue, &wait, TASK_INTERRUPTIBLE);
+                                        smp_rmb();
+                                        if (*p != NULL)
+                                                break;
+                                        if (!signal_pending(current)) {
+                                                schedule();
+                                                continue;
+                                        }
+                                        ret = -ERESTARTSYS;
                                         goto out_fail;
+                                }
+                                finish_wait(&channel_wqs[index].lx_queue, &wait);
                         } else {
                                 printk(" *vpe_get_shared is NULL. "
                                        "Has an SP program been loaded?\n");
@@ -277,56 +289,52 @@ unsigned int rtlx_write_poll(int index)
         return write_spacefree(chan->rt_read, chan->rt_write, chan->buffer_size);
 }
 
-static inline void copy_to(void *dst, void *src, size_t count, int user)
-{
-        if (user)
-                copy_to_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-
-static inline void copy_from(void *dst, void *src, size_t count, int user)
+ssize_t rtlx_read(int index, void __user *buff, size_t count, int user)
 {
-        if (user)
-                copy_from_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-
-ssize_t rtlx_read(int index, void *buff, size_t count, int user)
-{
-        size_t fl = 0L;
+        size_t lx_write, fl = 0L;
         struct rtlx_channel *lx;
+        unsigned long failed;
 
         if (rtlx == NULL)
                 return -ENOSYS;
 
         lx = &rtlx->channel[index];
 
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        lx_write = lx->lx_write;
+
         /* find out how much in total */
         count = min(count,
-                     (size_t)(lx->lx_write + lx->buffer_size - lx->lx_read)
+                     (size_t)(lx_write + lx->buffer_size - lx->lx_read)
                      % lx->buffer_size);
 
         /* then how much from the read pointer onwards */
-        fl = min( count, (size_t)lx->buffer_size - lx->lx_read);
+        fl = min(count, (size_t)lx->buffer_size - lx->lx_read);
 
-        copy_to(buff, &lx->lx_buffer[lx->lx_read], fl, user);
+        failed = copy_to_user(buff, lx->lx_buffer + lx->lx_read, fl);
+        if (failed)
+                goto out;
 
         /* and if there is anything left at the beginning of the buffer */
-        if ( count - fl )
-                copy_to (buff + fl, lx->lx_buffer, count - fl, user);
+        if (count - fl)
+                failed = copy_to_user(buff + fl, lx->lx_buffer, count - fl);
 
-        /* update the index */
-        lx->lx_read += count;
-        lx->lx_read %= lx->buffer_size;
+out:
+        count -= failed;
+
+        smp_wmb();
+        lx->lx_read = (lx->lx_read + count) % lx->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
 
         return count;
 }
 
-ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
+ssize_t rtlx_write(int index, const void __user *buffer, size_t count, int user)
 {
         struct rtlx_channel *rt;
+        size_t rt_read;
         size_t fl;
 
         if (rtlx == NULL)
@@ -334,24 +342,35 @@ ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
 
         rt = &rtlx->channel[index];
 
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        rt_read = rt->rt_read;
+
         /* total number of bytes to copy */
         count = min(count,
-                    (size_t)write_spacefree(rt->rt_read, rt->rt_write,
-                                            rt->buffer_size));
+                    (size_t)write_spacefree(rt_read, rt->rt_write, rt->buffer_size));
 
         /* first bit from write pointer to the end of the buffer, or count */
         fl = min(count, (size_t) rt->buffer_size - rt->rt_write);
 
-        copy_from (&rt->rt_buffer[rt->rt_write], buffer, fl, user);
+        failed = copy_from_user(rt->rt_buffer + rt->rt_write, buffer, fl);
+        if (failed)
+                goto out;
 
         /* if there's any left copy to the beginning of the buffer */
-        if( count - fl )
-                copy_from (rt->rt_buffer, buffer + fl, count - fl, user);
+        if (count - fl) {
+                failed = copy_from_user(rt->rt_buffer, buffer + fl, count - fl);
+        }
+
+out:
+        count -= cailed;
 
-        rt->rt_write += count;
-        rt->rt_write %= rt->buffer_size;
+        smp_wmb();
+        rt->rt_write = (rt->rt_write + count) % rt->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
 
-        return(count);
+        return count;
 }
 
 
@@ -403,7 +422,7 @@ static ssize_t file_read(struct file *file, char __user * buffer, size_t count,
                 return 0;       // -EAGAIN makes cat whinge
         }
 
-        return rtlx_read(minor, buffer, count, 1);
+        return rtlx_read(minor, buffer, count);
 }
 
 static ssize_t file_write(struct file *file, const char __user * buffer,
@@ -429,7 +448,7 @@ static ssize_t file_write(struct file *file, const char __user * buffer,
                         return ret;
         }
 
-        return rtlx_write(minor, (void *)buffer, count, 1);
+        return rtlx_write(minor, buffer, count);
 }
 
 static const struct file_operations rtlx_fops = {
@@ -468,6 +487,7 @@ static int rtlx_module_init(void)
                 init_waitqueue_head(&channel_wqs[i].rt_queue);
                 init_waitqueue_head(&channel_wqs[i].lx_queue);
                 atomic_set(&channel_wqs[i].in_open, 0);
+                mutex_init(&channel_wqs[i].mutex);
 
                 dev = device_create(mt_class, NULL, MKDEV(major, i),
                                     "%s%d", module_name, i);
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index fdbdbdc65b54..c0faabd52010 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -31,4 +31,16 @@ extern void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
  */
 extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
 
+/* Check and clear pending FPU exceptions in saved CSR */
+extern int fpcsr_pending(unsigned int __user *fpcsr);
+
+/* Make sure we will not lose FPU ownership */
+#ifdef CONFIG_PREEMPT
+#define lock_fpu_owner()        preempt_disable()
+#define unlock_fpu_owner()      preempt_enable()
+#else
+#define lock_fpu_owner()        pagefault_disable()
+#define unlock_fpu_owner()      pagefault_enable()
+#endif
+
 #endif  /* __SIGNAL_COMMON_H */
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index f091786187a6..07d67309451a 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -20,6 +20,7 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -27,7 +28,6 @@
 #include <asm/cacheflush.h>
 #include <asm/fpu.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/cpu-features.h>
 #include <asm/war.h>
@@ -78,10 +78,51 @@ struct rt_sigframe {
 /*
  * Helper routines
  */
+static int protected_save_fp_context(struct sigcontext __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         int err = 0;
         int i;
+        unsigned int used_math;
 
         err |= __put_user(regs->cp0_epc, &sc->sc_pc);
 
@@ -104,24 +145,48 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                 err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
         }
 
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
 
-        if (used_math()) {
+        if (used_math) {
                 /*
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                preempt_disable();
+                err |= protected_save_fp_context(sc);
+        }
+        return err;
+}
 
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
-                err |= save_fp_context(sc);
+int fpcsr_pending(unsigned int __user *fpcsr)
+{
+        int err, sig = 0;
+        unsigned int csr, enabled;
 
-                preempt_enable();
+        err = __get_user(csr, fpcsr);
+        enabled = FPU_CSR_UNI_X | ((csr & FPU_CSR_ALL_E) << 5);
+        /*
+         * If the signal handler set some FPU exceptions, clear it and
+         * send SIGFPE.
+         */
+        if (csr & enabled) {
+                csr &= ~enabled;
+                err |= __put_user(csr, fpcsr);
+                sig = SIGFPE;
         }
-        return err;
+        return err ?: sig;
+}
+
+static int
+check_and_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, sig;
+
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= protected_restore_fp_context(sc);
+        return err ?: sig;
 }
 
 int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
@@ -157,19 +222,15 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
         err |= __get_user(used_math, &sc->sc_used_math);
         conditional_used_math(used_math);
 
-        preempt_disable();
-
-        if (used_math()) {
+        if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu();
-                err |= restore_fp_context(sc);
+                if (!err)
+                        err = check_and_restore_fp_context(sc);
         } else {
                 /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
         }
 
-        preempt_enable();
-
         return err;
 }
 
@@ -332,6 +393,7 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct sigframe __user *frame;
         sigset_t blocked;
+        int sig;
 
         frame = (struct sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -345,8 +407,11 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->sf_sc))
+        sig = restore_sigcontext(&regs, &frame->sf_sc);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /*
          * Don't let your children do this ...
@@ -368,6 +433,7 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         struct rt_sigframe __user *frame;
         sigset_t set;
         stack_t st;
+        int sig;
 
         frame = (struct rt_sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -381,8 +447,11 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         if (__copy_from_user(&st, &frame->rs_uc.uc_stack, sizeof(st)))
                 goto badframe;
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 19bbef001959..b9a014411f83 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -22,6 +22,7 @@
 #include <linux/compat.h>
 #include <linux/suspend.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -29,7 +30,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/system.h>
 #include <asm/fpu.h>
@@ -176,11 +176,52 @@ struct rt_sigframe32 {
 /*
  * sigcontext handlers
  */
+static int protected_save_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 static int setup_sigcontext32(struct pt_regs *regs,
                               struct sigcontext32 __user *sc)
 {
         int err = 0;
         int i;
+        u32 used_math;
 
         err |= __put_user(regs->cp0_epc, &sc->sc_pc);
 
@@ -200,26 +241,31 @@ static int setup_sigcontext32(struct pt_regs *regs,
                 err |= __put_user(mflo3(), &sc->sc_lo3);
         }
 
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
 
-        if (used_math()) {
+        if (used_math) {
                 /*
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                preempt_disable();
-
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
-                err |= save_fp_context32(sc);
-
-                preempt_enable();
+                err |= protected_save_fp_context32(sc);
         }
         return err;
 }
 
+static int
+check_and_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, sig;
+
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= protected_restore_fp_context32(sc);
+        return err ?: sig;
+}
+
 static int restore_sigcontext32(struct pt_regs *regs,
                                 struct sigcontext32 __user *sc)
 {
@@ -250,19 +296,15 @@ static int restore_sigcontext32(struct pt_regs *regs,
         err |= __get_user(used_math, &sc->sc_used_math);
         conditional_used_math(used_math);
 
-        preempt_disable();
-
-        if (used_math()) {
+        if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu();
-                err |= restore_fp_context32(sc);
+                if (!err)
+                        err = check_and_restore_fp_context32(sc);
         } else {
                 /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
         }
 
-        preempt_enable();
-
         return err;
 }
 
@@ -508,6 +550,7 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct sigframe32 __user *frame;
         sigset_t blocked;
+        int sig;
 
         frame = (struct sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -521,8 +564,11 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext32(&regs, &frame->sf_sc))
+        sig = restore_sigcontext32(&regs, &frame->sf_sc);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /*
          * Don't let your children do this ...
@@ -545,6 +591,7 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         sigset_t set;
         stack_t st;
         s32 sp;
+        int sig;
 
         frame = (struct rt_sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -558,8 +605,11 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ecf1f7ecaad9..a9202fa95987 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -127,6 +127,7 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         sigset_t set;
         stack_t st;
         s32 sp;
+        int sig;
 
         frame = (struct rt_sigframe_n32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -140,8 +141,11 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index f253eda27fa3..5dcfab6b288e 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
+#include <linux/kernel_stat.h>
 #include <linux/module.h>
 
 #include <asm/cpu.h>
@@ -14,6 +15,7 @@
 #include <asm/hazards.h>
 #include <asm/mmu_context.h>
 #include <asm/smp.h>
+#include <asm/mips-boards/maltaint.h>
 #include <asm/mipsregs.h>
 #include <asm/cacheflush.h>
 #include <asm/time.h>
@@ -75,7 +77,7 @@ static struct smtc_ipi_q freeIPIq;
 
 void ipi_decode(struct smtc_ipi *);
 static void post_direct_ipi(int cpu, struct smtc_ipi *pipi);
-static void setup_cross_vpe_interrupts(void);
+static void setup_cross_vpe_interrupts(unsigned int nvpe);
 void init_smtc_stats(void);
 
 /* Global SMTC Status */
@@ -168,7 +170,10 @@ __setup("tintq=", tintq);
 
 int imstuckcount[2][8];
 /* vpemask represents IM/IE bits of per-VPE Status registers, low-to-high */
-int vpemask[2][8] = {{0,1,1,0,0,0,0,1},{0,1,0,0,0,0,0,1}};
+int vpemask[2][8] = {
+        {0, 0, 1, 0, 0, 0, 0, 1},
+        {0, 0, 0, 0, 0, 0, 0, 1}
+};
 int tcnoprog[NR_CPUS];
 static atomic_t idle_hook_initialized = {0};
 static int clock_hang_reported[NR_CPUS];
@@ -501,8 +506,7 @@ void mipsmt_prepare_cpus(void)
 
         /* If we have multiple VPEs running, set up the cross-VPE interrupt */
 
-        if (nvpe > 1)
-                setup_cross_vpe_interrupts();
+        setup_cross_vpe_interrupts(nvpe);
 
         /* Set up queue of free IPI "messages". */
         nipi = NR_CPUS * IPIBUF_PER_CPU;
@@ -607,7 +611,12 @@ void smtc_cpus_done(void)
 int setup_irq_smtc(unsigned int irq, struct irqaction * new,
                         unsigned long hwmask)
 {
+        unsigned int vpe = current_cpu_data.vpe_id;
+
         irq_hwmask[irq] = hwmask;
+#ifdef CONFIG_SMTC_IDLE_HOOK_DEBUG
+        vpemask[vpe][irq - MIPSCPU_INT_BASE] = 1;
+#endif
 
         return setup_irq(irq, new);
 }
@@ -812,12 +821,15 @@ void ipi_decode(struct smtc_ipi *pipi)
         smtc_ipi_nq(&freeIPIq, pipi);
         switch (type_copy) {
         case SMTC_CLOCK_TICK:
+                irq_enter();
+                kstat_this_cpu.irqs[MIPSCPU_INT_BASE + MIPSCPU_INT_CPUCTR]++;
                 /* Invoke Clock "Interrupt" */
                 ipi_timer_latch[dest_copy] = 0;
 #ifdef CONFIG_SMTC_IDLE_HOOK_DEBUG
                 clock_hang_reported[dest_copy] = 0;
 #endif /* CONFIG_SMTC_IDLE_HOOK_DEBUG */
                 local_timer_interrupt(0, NULL);
+                irq_exit();
                 break;
         case LINUX_SMP_IPI:
                 switch ((int)arg_copy) {
@@ -965,8 +977,11 @@ static void ipi_irq_dispatch(void)
 
 static struct irqaction irq_ipi;
 
-static void setup_cross_vpe_interrupts(void)
+static void setup_cross_vpe_interrupts(unsigned int nvpe)
 {
+        if (nvpe < 1)
+                return;
+
         if (!cpu_has_vint)
                 panic("SMTC Kernel requires Vectored Interupt support");
 
@@ -984,10 +999,17 @@ static void setup_cross_vpe_interrupts(void)
 
 /*
  * SMTC-specific hacks invoked from elsewhere in the kernel.
+ *
+ * smtc_ipi_replay is called from raw_local_irq_restore which is only ever
+ * called with interrupts disabled.  We do rely on interrupts being disabled
+ * here because using spin_lock_irqsave()/spin_unlock_irqrestore() would
+ * result in a recursive call to raw_local_irq_restore().
  */
 
-void smtc_ipi_replay(void)
+static void __smtc_ipi_replay(void)
 {
+        unsigned int cpu = smp_processor_id();
+
         /*
          * To the extent that we've ever turned interrupts off,
          * we may have accumulated deferred IPIs.  This is subtle.
@@ -1002,17 +1024,30 @@ void smtc_ipi_replay(void)
          * is clear, and we'll handle it as a real pseudo-interrupt
          * and not a pseudo-pseudo interrupt.
          */
-        if (IPIQ[smp_processor_id()].depth > 0) {
-                struct smtc_ipi *pipi;
-                extern void self_ipi(struct smtc_ipi *);
+        if (IPIQ[cpu].depth > 0) {
+                while (1) {
+                        struct smtc_ipi_q *q = &IPIQ[cpu];
+                        struct smtc_ipi *pipi;
+                        extern void self_ipi(struct smtc_ipi *);
+
+                        spin_lock(&q->lock);
+                        pipi = __smtc_ipi_dq(q);
+                        spin_unlock(&q->lock);
+                        if (!pipi)
+                                break;
 
-                while ((pipi = smtc_ipi_dq(&IPIQ[smp_processor_id()]))) {
                         self_ipi(pipi);
-                        smtc_cpu_stats[smp_processor_id()].selfipis++;
+                        smtc_cpu_stats[cpu].selfipis++;
                 }
         }
 }
 
+void smtc_ipi_replay(void)
+{
+        raw_local_irq_disable();
+        __smtc_ipi_replay();
+}
+
 EXPORT_SYMBOL(smtc_ipi_replay);
 
 void smtc_idle_loop_hook(void)
@@ -1117,7 +1152,13 @@ void smtc_idle_loop_hook(void)
          * is in use, there should never be any.
          */
 #ifndef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
-        smtc_ipi_replay();
+        {
+                unsigned long flags;
+
+                local_irq_save(flags);
+                __smtc_ipi_replay();
+                local_irq_restore(flags);
+        }
 #endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
 }
 
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 18f56a9dbcfa..493cb29b8a42 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -610,16 +610,6 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
         if (fcr31 & FPU_CSR_UNI_X) {
                 int sig;
 
-                preempt_disable();
-
-#ifdef CONFIG_PREEMPT
-                if (!is_fpu_owner()) {
-                        /* We might lose fpu before disabling preempt... */
-                        own_fpu();
-                        BUG_ON(!used_math());
-                        restore_fp(current);
-                }
-#endif
                 /*
                  * Unimplemented operation exception.  If we've got the full
                  * software emulator on-board, let's use it...
@@ -630,18 +620,12 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                  * register operands before invoking the emulator, which seems
                  * a bit extreme for what should be an infrequent event.
                  */
-                save_fp(current);
                 /* Ensure 'resume' not overwrite saved fp context again. */
-                lose_fpu();
-
-                preempt_enable();
+                lose_fpu(1);
 
                 /* Run the emulator */
                 sig = fpu_emulator_cop1Handler (regs, &current->thread.fpu, 1);
 
-                preempt_disable();
-
-                own_fpu();      /* Using the FPU again.  */
                 /*
                  * We can't allow the emulated instruction to leave any of
                  * the cause bit set in $fcr31.
@@ -649,9 +633,7 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
 
                 /* Restore the hardware register state */
-                restore_fp(current);
-
-                preempt_enable();
+                own_fpu(1);     /* Using the FPU again.  */
 
                 /* If something went wrong, signal */
                 if (sig)
@@ -668,7 +650,7 @@ asmlinkage void do_bp(struct pt_regs *regs)
         unsigned int opcode, bcode;
         siginfo_t info;
 
-        if (get_user(opcode, (unsigned int __user *) exception_epc(regs)))
+        if (__get_user(opcode, (unsigned int __user *) exception_epc(regs)))
                 goto out_sigsegv;
 
         /*
@@ -718,7 +700,7 @@ asmlinkage void do_tr(struct pt_regs *regs)
         unsigned int opcode, tcode = 0;
         siginfo_t info;
 
-        if (get_user(opcode, (unsigned int __user *) exception_epc(regs)))
+        if (__get_user(opcode, (unsigned int __user *) exception_epc(regs)))
                 goto out_sigsegv;
 
         /* Immediate versions don't provide a code.  */
@@ -791,21 +773,15 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                 break;
 
         case 1:
-                preempt_disable();
-
-                own_fpu();
-                if (used_math()) {      /* Using the FPU again.  */
-                        restore_fp(current);
-                } else {                        /* First time FPU user.  */
+                if (used_math())        /* Using the FPU again.  */
+                        own_fpu(1);
+                else {                  /* First time FPU user.  */
                         init_fpu();
                         set_used_math();
                 }
 
-                if (cpu_has_fpu) {
-                        preempt_enable();
-                } else {
+                if (!raw_cpu_has_fpu) {
                         int sig;
-                        preempt_enable();
                         sig = fpu_emulator_cop1Handler(regs,
                                                 &current->thread.fpu, 0);
                         if (sig)
@@ -846,7 +822,6 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 
         case 2:
         case 3:
-                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 break;
         }
 
@@ -1259,26 +1234,26 @@ static inline void mips_srs_init(void)
 /*
  * This is used by native signal handling
  */
-asmlinkage int (*save_fp_context)(struct sigcontext *sc);
-asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
+asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
 
-extern asmlinkage int _save_fp_context(struct sigcontext *sc);
-extern asmlinkage int _restore_fp_context(struct sigcontext *sc);
+extern asmlinkage int _save_fp_context(struct sigcontext __user *sc);
+extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
 
-extern asmlinkage int fpu_emulator_save_context(struct sigcontext *sc);
-extern asmlinkage int fpu_emulator_restore_context(struct sigcontext *sc);
+extern asmlinkage int fpu_emulator_save_context(struct sigcontext __user *sc);
+extern asmlinkage int fpu_emulator_restore_context(struct sigcontext __user *sc);
 
 #ifdef CONFIG_SMP
-static int smp_save_fp_context(struct sigcontext *sc)
+static int smp_save_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
                ? _save_fp_context(sc)
                : fpu_emulator_save_context(sc);
 }
 
-static int smp_restore_fp_context(struct sigcontext *sc)
+static int smp_restore_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
                ? _restore_fp_context(sc)
                : fpu_emulator_restore_context(sc);
 }
@@ -1306,14 +1281,14 @@ static inline void signal_init(void)
 /*
  * This is used by 32-bit signal stuff on the 64-bit kernel
  */
-asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
-asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
+asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 
-extern asmlinkage int _save_fp_context32(struct sigcontext32 *sc);
-extern asmlinkage int _restore_fp_context32(struct sigcontext32 *sc);
+extern asmlinkage int _save_fp_context32(struct sigcontext32 __user *sc);
+extern asmlinkage int _restore_fp_context32(struct sigcontext32 __user *sc);
 
-extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 *sc);
-extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 *sc);
+extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 __user *sc);
+extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 __user *sc);
 
 static inline void signal32_init(void)
 {