I'm obviously missing something basic here. Looking at stackframe.h, I see this code as a part of RESTORE_SOME mfc0 t0, CP0_STATUS; \ .set pop; \ ori t0, 0x1f; \ xori t0, 0x1f; \ mtc0 t0, CP0_STATUS; Here, we're explicitly clearing the IE bit (among others) in the status register, and we leave it cleared. The status register is not touched again until we do an eret. First, why do we explicitly clear the IE bit, when we're running with the EXL bit set? And where is the black magic that is re-enabling interrupts for the return to usermode? I must be missing something really fundamental here. Anyone care to point out my obvious gaps of knowledge? :) Thanks, Justin