diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index cee54cebbc6592505e0ff2046a7cc94d2b792c15..a504c65d999022f9b39a79a12f7ccc61a82c6d17 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -121,10 +121,14 @@ ENTRY(_ex_icplb_miss)
 	(R7:6,P5:4) = [sp++];
 	ASTAT = [sp++];
 	SAVE_ALL_SYS
-	DEBUG_HWTRACE_SAVE(p5, r7)
 #ifdef CONFIG_MPU
+	/* We must load R1 here, _before_ DEBUG_HWTRACE_SAVE, since that
+	 * will change the stack pointer.  */
 	R0 = SEQSTAT;
 	R1 = SP;
+#endif
+	DEBUG_HWTRACE_SAVE(p5, r7)
+#ifdef CONFIG_MPU
 	sp += -12;
 	call _cplb_hdr;
 	sp += 12;
@@ -191,6 +195,7 @@ ENTRY(_bfin_return_from_exception)
 ENDPROC(_bfin_return_from_exception)
 
 ENTRY(_handle_bad_cplb)
+	DEBUG_HWTRACE_RESTORE(p5, r7)
 	/* To get here, we just tried and failed to change a CPLB
 	 * so, handle things in trap_c (C code), by lowering to
 	 * IRQ5, just like we normally do. Since this is not a
diff --git a/include/asm-blackfin/trace.h b/include/asm-blackfin/trace.h
index ef18afbc2101061b23118dfacb8f0880daf9f897..312b596b9731f477ac1c2238ef7ad92478c626dd 100644
--- a/include/asm-blackfin/trace.h
+++ b/include/asm-blackfin/trace.h
@@ -62,14 +62,14 @@ extern unsigned long software_trace_buff[];
 	preg.L = LO(TBUFCTL); \
 	preg.H = HI(TBUFCTL); \
 	dreg = [preg]; \
-	[sp++] = dreg; \
+	[--sp] = dreg; \
 	dreg = 0x1; \
 	[preg] = dreg;
 
 #define trace_buffer_restore(preg, dreg) \
 	preg.L = LO(TBUFCTL); \
 	preg.H = HI(TBUFCTL); \
-	dreg = [sp--]; \
+	dreg = [sp++]; \
 	[preg] = dreg;
 
 #else /* CONFIG_DEBUG_BFIN_HWTRACE_ON */