From 3c256f5395aa9a667c4e86ca172f78ace86a3e55 Mon Sep 17 00:00:00 2001
From: David Greenman <dg@FreeBSD.org>
Date: Mon, 6 Jun 1994 14:54:41 +0000
Subject: [PATCH] trap.c: Vastly improved trap.c from me. This rewritten
 version has a variety of features, amoung them: higher performance and much
 higher code quality.

support.s, cpufunc.h:
No longer use gs override to enforce range limits - compare directly
against VM_MAXUSER_ADDRESS instead. The old way caused problems in
preserving the gs selector...and this method is just as fast or faster.
---
 sys/amd64/amd64/support.S   | 114 +++--
 sys/amd64/amd64/support.s   | 114 +++--
 sys/amd64/amd64/trap.c      | 869 +++++++++++++++++-------------------
 sys/amd64/include/cpufunc.h |   9 +-
 sys/i386/i386/support.s     | 114 +++--
 sys/i386/i386/trap.c        | 869 +++++++++++++++++-------------------
 sys/i386/include/cpufunc.h  |   9 +-
 sys/kern/subr_trap.c        | 869 +++++++++++++++++-------------------
 8 files changed, 1489 insertions(+), 1478 deletions(-)

diff --git a/sys/amd64/amd64/support.S b/sys/amd64/amd64/support.S
index 9634069e2e8a..32ba9b62896a 100644
--- a/sys/amd64/amd64/support.S
+++ b/sys/amd64/amd64/support.S
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: support.s,v 1.6 1994/04/02 07:00:29 davidg Exp $
+ *	$Id: support.s,v 1.10 1994/06/06 14:23:49 davidg Exp $
  */
 
 #include "assym.s"				/* system definitions */
@@ -616,15 +616,22 @@ ENTRY(copyin)
 	movl	16(%esp),%edi			/* caddr_t to */
 	movl	20(%esp),%ecx			/* size_t  len */
 
+	/*
+	 * make sure address is valid
+	 */
+	movl	%esi,%edx
+	addl	%ecx,%edx
+	jc	copyin_fault
+	cmpl	$VM_MAXUSER_ADDRESS,%edx
+	ja	copyin_fault
+
 	movb	%cl,%al
 	shrl	$2,%ecx				/* copy longword-wise */
 	cld
-	gs
 	rep
 	movsl
 	movb	%al,%cl
 	andb	$3,%cl				/* copy remaining bytes */
-	gs
 	rep
 	movsb
 
@@ -651,8 +658,11 @@ ALTENTRY(fuiword)
 ENTRY(fuword)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
-	movl	4(%esp),%edx
-	gs
+	movl	4(%esp),%edx			/* from */
+
+	cmpl	$VM_MAXUSER_ADDRESS-4,%edx	/* verify address is valid */
+	ja	fusufault
+
 	movl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -672,7 +682,10 @@ ENTRY(fusword)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
 	movl	4(%esp),%edx
-	gs
+
+	cmpl	$VM_MAXUSER_ADDRESS-2,%edx
+	ja	fusufault
+
 	movzwl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -682,7 +695,10 @@ ENTRY(fubyte)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
 	movl	4(%esp),%edx
-	gs
+
+	cmpl	$VM_MAXUSER_ADDRESS-1,%eax
+	ja	fusufault
+
 	movzbl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -732,8 +748,10 @@ ENTRY(suword)
 #endif
 
 2:	
+	cmpl	$VM_MAXUSER_ADDRESS-4,%edx	/* verify address validity */
+	ja	fusufault
+
 	movl	8(%esp),%eax
-	gs
 	movl	%eax,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -772,8 +790,10 @@ ENTRY(susword)
 #endif
 
 2:
+	cmpl	$VM_MAXUSER_ADDRESS-2,%edx	/* verify address validity */
+	ja	fusufault
+
 	movw	8(%esp),%ax
-	gs
 	movw	%ax,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -812,8 +832,10 @@ ENTRY(subyte)
 #endif
 
 2:
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edx	/* verify address validity */
+	ja	fusufault
+
 	movb	8(%esp),%al
-	gs
 	movb	%al,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -849,8 +871,8 @@ ENTRY(copyoutstr)
 	 * we look at a page at a time and the end address is on a page
 	 * boundary.
 	 */
-	cmpl	$VM_MAXUSER_ADDRESS,%edi
-	jae	cpystrflt
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edi
+	ja	cpystrflt
 
 	movl	%edi,%eax
 	shrl	$IDXSHIFT,%eax
@@ -908,13 +930,11 @@ ENTRY(copyoutstr)
 	decl	%edx
 	jz	2f
 	/*
-	 * gs override doesn't work for stosb.  Use the same explicit check
-	 * as in copyout().  It's much slower now because it is per-char.
-	 * XXX - however, it would be faster to rewrite this function to use
+	 * XXX - would be faster to rewrite this function to use
 	 * strlen() and copyout().
 	 */
-	cmpl	$VM_MAXUSER_ADDRESS,%edi
-	jae	cpystrflt
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edi
+	ja	cpystrflt
 
 	lodsb
 	stosb
@@ -932,6 +952,24 @@ ENTRY(copyoutstr)
 
 #endif /* I486_CPU || I586_CPU */
 
+cpystrflt:
+	movl	$EFAULT,%eax
+cpystrflt_x:
+	/* set *lencopied and return %eax */
+	movl	_curpcb,%ecx
+	movl	$0,PCB_ONFAULT(%ecx)
+	movl	20(%esp),%ecx
+	subl	%edx,%ecx
+	movl	24(%esp),%edx
+	orl	%edx,%edx
+	jz	1f
+	movl	%ecx,(%edx)
+1:
+	popl	%edi
+	popl	%esi
+	ret
+
+
 /*
  * copyinstr(from, to, maxlen, int *lencopied)
  *	copy a string from from to to, stop when a 0 character is reached.
@@ -943,16 +981,18 @@ ENTRY(copyinstr)
 	pushl	%esi
 	pushl	%edi
 	movl	_curpcb,%ecx
-	movl	$cpystrflt,PCB_ONFAULT(%ecx)
+	movl	$copyinstr_fault,PCB_ONFAULT(%ecx)
 
 	movl	12(%esp),%esi			/* %esi = from */
 	movl	16(%esp),%edi			/* %edi = to */
 	movl	20(%esp),%edx			/* %edx = maxlen */
+	pushl	%gs
+	movl	__udatasel,%eax
+	movl	%ax,%gs
 	incl	%edx
-
 1:
 	decl	%edx
-	jz	4f
+	jz	2f
 	gs
 	lodsb
 	stosb
@@ -962,26 +1002,26 @@ ENTRY(copyinstr)
 	/* Success -- 0 byte reached */
 	decl	%edx
 	xorl	%eax,%eax
-	jmp	6f
-4:
+	jmp	3f
+2:
 	/* edx is zero -- return ENAMETOOLONG */
 	movl	$ENAMETOOLONG,%eax
-	jmp	6f
+	jmp	3f
 
-cpystrflt:
+copyinstr_fault:
 	movl	$EFAULT,%eax
-cpystrflt_x:
-6:
+3:
 	/* set *lencopied and return %eax */
 	movl	_curpcb,%ecx
 	movl	$0,PCB_ONFAULT(%ecx)
-	movl	20(%esp),%ecx
+	movl	24(%esp),%ecx
 	subl	%edx,%ecx
-	movl	24(%esp),%edx
+	movl	28(%esp),%edx
 	orl	%edx,%edx
-	jz	7f
+	jz	4f
 	movl	%ecx,(%edx)
-7:
+4:
+	popl	%gs
 	popl	%edi
 	popl	%esi
 	ret
@@ -1097,15 +1137,6 @@ ENTRY(ssdtosd)
 	popl	%ebx
 	ret
 
-#if 0
-/* tlbflush() */
-ENTRY(tlbflush)
-	movl	%cr3,%eax
-	orl	$I386_CR3PAT,%eax
-	movl	%eax,%cr3
-	ret
-#endif
-
 /* load_cr0(cr0) */
 ENTRY(load_cr0)
 	movl	4(%esp),%eax
@@ -1117,11 +1148,6 @@ ENTRY(rcr0)
 	movl	%cr0,%eax
 	ret
 
-/* rcr2() */
-ENTRY(rcr2)
-	movl	%cr2,%eax
-	ret
-
 /* rcr3() */
 ENTRY(rcr3)
 	movl	%cr3,%eax
diff --git a/sys/amd64/amd64/support.s b/sys/amd64/amd64/support.s
index 9634069e2e8a..32ba9b62896a 100644
--- a/sys/amd64/amd64/support.s
+++ b/sys/amd64/amd64/support.s
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: support.s,v 1.6 1994/04/02 07:00:29 davidg Exp $
+ *	$Id: support.s,v 1.10 1994/06/06 14:23:49 davidg Exp $
  */
 
 #include "assym.s"				/* system definitions */
@@ -616,15 +616,22 @@ ENTRY(copyin)
 	movl	16(%esp),%edi			/* caddr_t to */
 	movl	20(%esp),%ecx			/* size_t  len */
 
+	/*
+	 * make sure address is valid
+	 */
+	movl	%esi,%edx
+	addl	%ecx,%edx
+	jc	copyin_fault
+	cmpl	$VM_MAXUSER_ADDRESS,%edx
+	ja	copyin_fault
+
 	movb	%cl,%al
 	shrl	$2,%ecx				/* copy longword-wise */
 	cld
-	gs
 	rep
 	movsl
 	movb	%al,%cl
 	andb	$3,%cl				/* copy remaining bytes */
-	gs
 	rep
 	movsb
 
@@ -651,8 +658,11 @@ ALTENTRY(fuiword)
 ENTRY(fuword)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
-	movl	4(%esp),%edx
-	gs
+	movl	4(%esp),%edx			/* from */
+
+	cmpl	$VM_MAXUSER_ADDRESS-4,%edx	/* verify address is valid */
+	ja	fusufault
+
 	movl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -672,7 +682,10 @@ ENTRY(fusword)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
 	movl	4(%esp),%edx
-	gs
+
+	cmpl	$VM_MAXUSER_ADDRESS-2,%edx
+	ja	fusufault
+
 	movzwl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -682,7 +695,10 @@ ENTRY(fubyte)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
 	movl	4(%esp),%edx
-	gs
+
+	cmpl	$VM_MAXUSER_ADDRESS-1,%eax
+	ja	fusufault
+
 	movzbl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -732,8 +748,10 @@ ENTRY(suword)
 #endif
 
 2:	
+	cmpl	$VM_MAXUSER_ADDRESS-4,%edx	/* verify address validity */
+	ja	fusufault
+
 	movl	8(%esp),%eax
-	gs
 	movl	%eax,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -772,8 +790,10 @@ ENTRY(susword)
 #endif
 
 2:
+	cmpl	$VM_MAXUSER_ADDRESS-2,%edx	/* verify address validity */
+	ja	fusufault
+
 	movw	8(%esp),%ax
-	gs
 	movw	%ax,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -812,8 +832,10 @@ ENTRY(subyte)
 #endif
 
 2:
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edx	/* verify address validity */
+	ja	fusufault
+
 	movb	8(%esp),%al
-	gs
 	movb	%al,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -849,8 +871,8 @@ ENTRY(copyoutstr)
 	 * we look at a page at a time and the end address is on a page
 	 * boundary.
 	 */
-	cmpl	$VM_MAXUSER_ADDRESS,%edi
-	jae	cpystrflt
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edi
+	ja	cpystrflt
 
 	movl	%edi,%eax
 	shrl	$IDXSHIFT,%eax
@@ -908,13 +930,11 @@ ENTRY(copyoutstr)
 	decl	%edx
 	jz	2f
 	/*
-	 * gs override doesn't work for stosb.  Use the same explicit check
-	 * as in copyout().  It's much slower now because it is per-char.
-	 * XXX - however, it would be faster to rewrite this function to use
+	 * XXX - would be faster to rewrite this function to use
 	 * strlen() and copyout().
 	 */
-	cmpl	$VM_MAXUSER_ADDRESS,%edi
-	jae	cpystrflt
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edi
+	ja	cpystrflt
 
 	lodsb
 	stosb
@@ -932,6 +952,24 @@ ENTRY(copyoutstr)
 
 #endif /* I486_CPU || I586_CPU */
 
+cpystrflt:
+	movl	$EFAULT,%eax
+cpystrflt_x:
+	/* set *lencopied and return %eax */
+	movl	_curpcb,%ecx
+	movl	$0,PCB_ONFAULT(%ecx)
+	movl	20(%esp),%ecx
+	subl	%edx,%ecx
+	movl	24(%esp),%edx
+	orl	%edx,%edx
+	jz	1f
+	movl	%ecx,(%edx)
+1:
+	popl	%edi
+	popl	%esi
+	ret
+
+
 /*
  * copyinstr(from, to, maxlen, int *lencopied)
  *	copy a string from from to to, stop when a 0 character is reached.
@@ -943,16 +981,18 @@ ENTRY(copyinstr)
 	pushl	%esi
 	pushl	%edi
 	movl	_curpcb,%ecx
-	movl	$cpystrflt,PCB_ONFAULT(%ecx)
+	movl	$copyinstr_fault,PCB_ONFAULT(%ecx)
 
 	movl	12(%esp),%esi			/* %esi = from */
 	movl	16(%esp),%edi			/* %edi = to */
 	movl	20(%esp),%edx			/* %edx = maxlen */
+	pushl	%gs
+	movl	__udatasel,%eax
+	movl	%ax,%gs
 	incl	%edx
-
 1:
 	decl	%edx
-	jz	4f
+	jz	2f
 	gs
 	lodsb
 	stosb
@@ -962,26 +1002,26 @@ ENTRY(copyinstr)
 	/* Success -- 0 byte reached */
 	decl	%edx
 	xorl	%eax,%eax
-	jmp	6f
-4:
+	jmp	3f
+2:
 	/* edx is zero -- return ENAMETOOLONG */
 	movl	$ENAMETOOLONG,%eax
-	jmp	6f
+	jmp	3f
 
-cpystrflt:
+copyinstr_fault:
 	movl	$EFAULT,%eax
-cpystrflt_x:
-6:
+3:
 	/* set *lencopied and return %eax */
 	movl	_curpcb,%ecx
 	movl	$0,PCB_ONFAULT(%ecx)
-	movl	20(%esp),%ecx
+	movl	24(%esp),%ecx
 	subl	%edx,%ecx
-	movl	24(%esp),%edx
+	movl	28(%esp),%edx
 	orl	%edx,%edx
-	jz	7f
+	jz	4f
 	movl	%ecx,(%edx)
-7:
+4:
+	popl	%gs
 	popl	%edi
 	popl	%esi
 	ret
@@ -1097,15 +1137,6 @@ ENTRY(ssdtosd)
 	popl	%ebx
 	ret
 
-#if 0
-/* tlbflush() */
-ENTRY(tlbflush)
-	movl	%cr3,%eax
-	orl	$I386_CR3PAT,%eax
-	movl	%eax,%cr3
-	ret
-#endif
-
 /* load_cr0(cr0) */
 ENTRY(load_cr0)
 	movl	4(%esp),%eax
@@ -1117,11 +1148,6 @@ ENTRY(rcr0)
 	movl	%cr0,%eax
 	ret
 
-/* rcr2() */
-ENTRY(rcr2)
-	movl	%cr2,%eax
-	ret
-
 /* rcr3() */
 ENTRY(rcr3)
 	movl	%cr3,%eax
diff --git a/sys/amd64/amd64/trap.c b/sys/amd64/amd64/trap.c
index 382416f06e3f..406310bc6521 100644
--- a/sys/amd64/amd64/trap.c
+++ b/sys/amd64/amd64/trap.c
@@ -1,6 +1,7 @@
 /*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
+ * Copyright (C) 1994, David Greenman
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
  *
  * This code is derived from software contributed to Berkeley by
  * the University of Utah, and William Jolitz.
@@ -34,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)trap.c	7.4 (Berkeley) 5/13/91
- *	$Id: trap.c,v 1.22 1994/04/07 10:51:00 davidg Exp $
+ *	$Id: trap.c,v 1.24 1994/05/25 08:55:18 rgrimes Exp $
  */
 
 /*
@@ -69,21 +70,8 @@
 #include "npx.h"
 #include "ddb.h"
 
-#ifdef	__GNUC__
-
-/*
- * The "r" contraint could be "rm" except for fatal bugs in gas.  As usual,
- * we omit the size from the mov instruction to avoid nonfatal bugs in gas.
- */
-#define	read_gs()	({ u_short gs; __asm("mov %%gs,%0" : "=r" (gs)); gs; })
-#define	write_gs(newgs)	__asm("mov %0,%%gs" : : "r" ((u_short) newgs))
-
-#else	/* not __GNUC__ */
-
-u_short	read_gs		__P((void));
-void	write_gs	__P((/* promoted u_short */ int gs));
-
-#endif	/* __GNUC__ */
+int	trap_pfault	__P((struct trapframe *, int));
+void	trap_fatal	__P((struct trapframe *));
 
 extern int grow(struct proc *,u_int);
 
@@ -101,7 +89,7 @@ char *trap_msg[] = {
 	"arithmetic trap",			/*  6 T_ARITHTRAP */
 	"system forced exception",		/*  7 T_ASTFLT */
 	"segmentation (limit) fault",		/*  8 T_SEGFLT */
-	"protection fault",			/*  9 T_PROTFLT */
+	"general protection fault",		/*  9 T_PROTFLT */
 	"trace trap",				/* 10 T_TRCTRAP */
 	"",					/* 11 unused */
 	"page fault",				/* 12 T_PAGEFLT */
@@ -122,366 +110,18 @@ char *trap_msg[] = {
 	"stack fault",				/* 27 T_STKFLT */
 };
 
-#define pde_v(v) (PTD[((v)>>PD_SHIFT)&1023].pd_v)
-
-/*
- * trap(frame):
- *	Exception, fault, and trap interface to BSD kernel. This
- * common code is called from assembly language IDT gate entry
- * routines that prepare a suitable stack frame, and restore this
- * frame after the exception has been processed. Note that the
- * effect is as if the arguments were passed call by reference.
- */
-
-/*ARGSUSED*/
-void
-trap(frame)
-	struct trapframe frame;
+static inline void
+userret(p, frame, oticks)
+	struct proc *p;
+	struct trapframe *frame;
+	u_quad_t oticks;
 {
-	register int i;
-	register struct proc *p = curproc;
-	u_quad_t sticks = 0;
-	int ucode, type, code, eva, fault_type;
+	int sig, s;
 
-	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
-	type = frame.tf_trapno;
-#if NDDB > 0
-	if (curpcb && curpcb->pcb_onfault) {
-		if (frame.tf_trapno == T_BPTFLT
-		    || frame.tf_trapno == T_TRCTRAP)
-			if (kdb_trap (type, 0, &frame))
-				return;
-	}
-#endif
-	
-	if (curpcb == 0 || curproc == 0)
-		goto skiptoswitch;
-	if (curpcb->pcb_onfault && frame.tf_trapno != T_PAGEFLT) {
-		extern int _udatasel;
-
-		if (read_gs() != (u_short) _udatasel)
-			/*
-			 * Some user has corrupted %gs but we depend on it in
-			 * copyout() etc.  Fix it up and retry.
-			 *
-			 * (We don't preserve %fs or %gs, so users can change
-			 * them to either _ucodesel, _udatasel or a not-present
-			 * selector, possibly ORed with 0 to 3, making them
-			 * volatile for other users.  Not preserving them saves
-			 * time and doesn't lose functionality or open security
-			 * holes.)
-			 */
-			write_gs(_udatasel);
-		else
-copyfault:
-			frame.tf_eip = (int)curpcb->pcb_onfault;
-		return;
-	}
-
-	if (ISPL(frame.tf_cs) == SEL_UPL) {
-		type |= T_USER;
-		p->p_md.md_regs = (int *)&frame;
-		sticks = p->p_sticks;
-	}
-
-skiptoswitch:
-	ucode=0;
-	eva = rcr2();
-	code = frame.tf_err;
-
-	if ((type & ~T_USER) == T_PAGEFLT)
-		goto pfault;
-
-	switch (type) {
-	case T_SEGNPFLT|T_USER:
-	case T_STKFLT|T_USER:
-	case T_PROTFLT|T_USER:		/* protection fault */
-		ucode = code + BUS_SEGM_FAULT ;
-		i = SIGBUS;
-		break;
-
-	case T_PRIVINFLT|T_USER:	/* privileged instruction fault */
-	case T_RESADFLT|T_USER:		/* reserved addressing fault */
-	case T_RESOPFLT|T_USER:		/* reserved operand fault */
-	case T_FPOPFLT|T_USER:		/* coprocessor operand fault */
-		ucode = type &~ T_USER;
-		i = SIGILL;
-		break;
-
-	case T_ASTFLT|T_USER:		/* Allow process switch */
-		astoff();
-		cnt.v_soft++;
-		if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
-			addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
-			p->p_flag &= ~P_OWEUPC;
-		}
-		goto out;
-
-	case T_DNA|T_USER:
-#if NNPX > 0
-		/* if a transparent fault (due to context switch "late") */
-		if (npxdna()) return;
-#endif	/* NNPX > 0 */
-#if   defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
-		i = math_emulate(&frame);
-		if (i == 0) return;
-#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		panic("trap: math emulation necessary!");
-#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		ucode = FPE_FPU_NP_TRAP;
-		break;
-
-	case T_BOUND|T_USER:
-		ucode = FPE_SUBRNG_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_OFLOW|T_USER:
-		ucode = FPE_INTOVF_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_DIVIDE|T_USER:
-		ucode = FPE_INTDIV_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_ARITHTRAP|T_USER:
-		ucode = code;
-		i = SIGFPE;
-		break;
-
-	pfault:
-	case T_PAGEFLT:			/* allow page faults in kernel mode */
-	case T_PAGEFLT|T_USER:		/* page fault */
-	    {
-		vm_offset_t va;
-		struct vmspace *vm;
-		vm_map_t map = 0;
-		int rv = 0, oldflags;
-		vm_prot_t ftype;
-		unsigned v;
-		extern vm_map_t kernel_map;
-
-		va = trunc_page((vm_offset_t)eva);
-
-		/*
-		 * Don't allow user-mode faults in kernel address space
-		 */
-		if ((type == (T_PAGEFLT|T_USER)) && (va >= KERNBASE)) {
-			goto nogo;
-		}
-
-		if ((p == 0) || (type == T_PAGEFLT && va >= KERNBASE)) {
-			vm = 0;
-			map = kernel_map;
-		} else {
-			vm = p->p_vmspace;
-			map = &vm->vm_map;
-		}
-
-		if (code & PGEX_W)
-			ftype = VM_PROT_READ | VM_PROT_WRITE;
-		else
-			ftype = VM_PROT_READ;
-
-		if (map != kernel_map) {
-			vm_offset_t pa;
-			vm_offset_t v = (vm_offset_t) vtopte(va);
-			vm_page_t ptepg;
-
-			/*
-			 * Keep swapout from messing with us during this
-			 *	critical time.
-			 */
-			++p->p_lock;
-
-			/*
-			 * Grow the stack if necessary
-			 */
-			if ((caddr_t)va > vm->vm_maxsaddr
-			    && (caddr_t)va < (caddr_t)USRSTACK) {
-				if (!grow(p, va)) {
-					rv = KERN_FAILURE;
-					--p->p_lock;
-					goto nogo;
-				}
-			}
-
-			/*
-			 * Check if page table is mapped, if not,
-			 *	fault it first
-			 */
-
-			/* Fault the pte only if needed: */
-			*(volatile char *)v += 0;	
-
-			ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
-			vm_page_hold(ptepg);
-
-			/* Fault in the user page: */
-			rv = vm_fault(map, va, ftype, FALSE);
-
-			vm_page_unhold(ptepg);
-
-			/*
-			 * page table pages don't need to be kept if they
-			 * are not held
-			 */
-			if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
-				pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
-					VM_PROT_NONE);
-				vm_page_free(ptepg);
-			}
-
-			--p->p_lock;
-		} else {
-			/*
-			 * Since we know that kernel virtual address addresses
-			 * always have pte pages mapped, we just have to fault
-			 * the page.
-			 */
-			rv = vm_fault(map, va, ftype, FALSE);
-		}
-
-		if (rv == KERN_SUCCESS) {
-			if (type == T_PAGEFLT)
-				return;
-			goto out;
-		}
-nogo:
-		if (type == T_PAGEFLT) {
-			if (curpcb->pcb_onfault)
-				goto copyfault;
-
-			goto we_re_toast;
-		}
-		i = (rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV;
-
-		/* kludge to pass faulting virtual address to sendsig */
-		ucode = type &~ T_USER;
-		frame.tf_err = eva;
-
-		break;
-	    }
-
-#if NDDB == 0
-	case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
-		frame.tf_eflags &= ~PSL_T;
-
-			/* Q: how do we turn it on again? */
-		return;
-#endif
-	
-	case T_BPTFLT|T_USER:		/* bpt instruction fault */
-	case T_TRCTRAP|T_USER:		/* trace trap */
-		frame.tf_eflags &= ~PSL_T;
-		i = SIGTRAP;
-		break;
-
-#if NISA > 0
-	case T_NMI:
-	case T_NMI|T_USER:
-#if NDDB > 0
-		/* NMI can be hooked up to a pushbutton for debugging */
-		printf ("NMI ... going to debugger\n");
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		/* machine/parity/power fail/"kitchen sink" faults */
-		if (isa_nmi(code) == 0) return;
-		/* FALL THROUGH */
-#endif
-	default:
-	we_re_toast:
-
-		fault_type = type & ~T_USER;
-#if NDDB > 0
-		if ((fault_type == T_BPTFLT) || (fault_type == T_TRCTRAP)) {
-			if (kdb_trap (type, 0, &frame))
-				return;
-		}
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			printf("\n\nFatal trap %d: %s while in %s mode\n",
-				fault_type, trap_msg[fault_type],
-				ISPL(frame.tf_cs) == SEL_UPL ? "user" : "kernel");
-		if (fault_type == T_PAGEFLT) {
-			printf("fault virtual address	= 0x%x\n", eva);
-			printf("fault code		= %s %s, %s\n",
-				code & PGEX_U ? "user" : "supervisor",
-				code & PGEX_W ? "write" : "read",
-				code & PGEX_P ? "protection violation" : "page not present");
-		}
-		printf("instruction pointer	= 0x%x\n", frame.tf_eip);
-		printf("processor eflags	= ");
-		if (frame.tf_eflags & EFL_TF)
-			printf("trace/trap, ");
-		if (frame.tf_eflags & EFL_IF)
-			printf("interrupt enabled, ");
-		if (frame.tf_eflags & EFL_NT)
-			printf("nested task, ");
-		if (frame.tf_eflags & EFL_RF)
-			printf("resume, ");
-		if (frame.tf_eflags & EFL_VM)
-			printf("vm86, ");
-		printf("IOPL = %d\n", (frame.tf_eflags & EFL_IOPL) >> 12);
-		printf("current process		= ");
-		if (curproc) {
-			printf("%d (%s)\n",
-			    curproc->p_pid, curproc->p_comm ?
-			    curproc->p_comm : "");
-		} else {
-			printf("Idle\n");
-		}
-		printf("interrupt mask		= ");
-		if ((cpl & net_imask) == net_imask)
-			printf("net ");
-		if ((cpl & tty_imask) == tty_imask)
-			printf("tty ");
-		if ((cpl & bio_imask) == bio_imask)
-			printf("bio ");
-		if (cpl == 0)
-			printf("none");
-		printf("\n");
-
-#ifdef KDB
-		if (kdb_trap(&psl))
-			return;
-#endif
-#if NDDB > 0
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			panic(trap_msg[fault_type]);
-		else
-			panic("unknown/reserved trap");
-
-		/* NOTREACHED */
-	}
-
-	trapsignal(p, i, ucode);
-	if ((type & T_USER) == 0)
-		return;
-
-#ifdef DIAGNOSTIC
-	fault_type = type & ~T_USER;
-	if (fault_type <= MAX_TRAP_MSG) {
-		uprintf("fatal process exception: %s", 
-			trap_msg[fault_type]);
-		if ((fault_type == T_PAGEFLT) || (fault_type == T_PROTFLT))
-			uprintf(", fault VA = 0x%x", eva);
-		uprintf("\n");
-	}
-#endif
-
-out:
-	while (i = CURSIG(p))
-		postsig(i);
+	while (sig = CURSIG(p))
+		postsig(sig);
 	p->p_priority = p->p_usrpri;
 	if (want_resched) {
-		int s;
 		/*
 		 * Since we are curproc, clock will normally just change
 		 * our priority without moving us from one queue to another
@@ -495,25 +135,390 @@ out:
 		p->p_stats->p_ru.ru_nivcsw++;
 		mi_switch();
 		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
+		while (sig = CURSIG(p))
+			postsig(sig);
 	}
 	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
+		u_quad_t ticks = p->p_sticks - oticks;
 
 		if (ticks) {
 #ifdef PROFTIMER
 			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
+			addupc(frame->tf_eip, &p->p_stats->p_prof,
 			    ticks * profscale);
 #else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
+			addupc(frame->tf_eip, &p->p_stats->p_prof, ticks);
 #endif
 		}
 	}
 	curpriority = p->p_priority;
 }
 
+/*
+ * trap(frame):
+ *	Exception, fault, and trap interface to the FreeBSD kernel.
+ * This common code is called from assembly language IDT gate entry
+ * routines that prepare a suitable stack frame, and restore this
+ * frame after the exception has been processed.
+ */
+
+/*ARGSUSED*/
+void
+trap(frame)
+	struct trapframe frame;
+{
+	struct proc *p = curproc;
+	u_quad_t sticks = 0;
+	int i = 0, ucode = 0, type, code, eva, fault_type;
+
+	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
+	type = frame.tf_trapno;
+	code = frame.tf_err;
+	
+	if (ISPL(frame.tf_cs) == SEL_UPL) {
+		/* user trap */
+
+		sticks = p->p_sticks;
+		p->p_md.md_regs = (int *)&frame;
+
+		switch (type) {
+		case T_RESADFLT:	/* reserved addressing fault */
+		case T_PRIVINFLT:	/* privileged instruction fault */
+		case T_RESOPFLT:	/* reserved operand fault */
+			ucode = type;
+			i = SIGILL;
+			break;
+
+		case T_BPTFLT:		/* bpt instruction fault */
+		case T_TRCTRAP:		/* trace trap */
+			frame.tf_eflags &= ~PSL_T;
+			i = SIGTRAP;
+			break;
+
+		case T_ARITHTRAP:	/* arithmetic trap */
+			ucode = code;
+			i = SIGFPE;
+			break;
+
+		case T_ASTFLT:		/* Allow process switch */
+			astoff();
+			cnt.v_soft++;
+			if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
+				addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
+				p->p_flag &= ~P_OWEUPC;
+			}
+			goto out;
+
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+		case T_STKFLT:		/* stack fault */
+			ucode = code + BUS_SEGM_FAULT ;
+			i = SIGBUS;
+			break;
+
+		case T_PAGEFLT:		/* page fault */
+			i = trap_pfault(&frame, TRUE);
+			if (i == 0)
+				goto out;
+
+			ucode = T_PAGEFLT;
+			break;
+
+		case T_DIVIDE:		/* integer divide fault */
+			ucode = FPE_INTDIV_TRAP;
+			i = SIGFPE;
+			break;
+
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
+
+		case T_OFLOW:		/* integer overflow fault */
+			ucode = FPE_INTOVF_TRAP;
+			i = SIGFPE;
+			break;
+
+		case T_BOUND:		/* bounds check fault */
+			ucode = FPE_SUBRNG_TRAP;
+			i = SIGFPE;
+			break;
+
+		case T_DNA:
+#if NNPX > 0
+			/* if a transparent fault (due to context switch "late") */
+			if (npxdna())
+				return;
+#endif	/* NNPX > 0 */
+
+#if defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
+			i = math_emulate(&frame);
+			if (i == 0) return;
+#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			panic("trap: math emulation necessary!");
+#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			ucode = FPE_FPU_NP_TRAP;
+			break;
+
+		case T_FPOPFLT:		/* FPU operand fetch fault */
+			ucode = T_FPOPFLT;
+			i = SIGILL;
+			break;
+
+		default:
+			trap_fatal(&frame);
+		}
+	} else {
+		/* kernel trap */
+
+		switch (type) {
+		case T_PAGEFLT:			/* page fault */
+			(void) trap_pfault(&frame, FALSE);
+			return;
+
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+			if (curpcb && curpcb->pcb_onfault) {
+				frame.tf_eip = (int)curpcb->pcb_onfault;
+				return;
+			}
+			break;
+
+#if NDDB > 0
+		case T_BPTFLT:
+		case T_TRCTRAP:
+			if (kdb_trap (type, 0, &frame))
+				return;
+			break;
+#else
+		case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
+			/* Q: how do we turn it on again? */
+			frame.tf_eflags &= ~PSL_T;
+			return;
+#endif
+	
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
+		}
+
+		trap_fatal(&frame);
+	}
+
+	trapsignal(p, i, ucode);
+
+#ifdef DIAGNOSTIC
+	eva = rcr2();
+	if (type <= MAX_TRAP_MSG) {
+		uprintf("fatal process exception: %s", 
+			trap_msg[type]);
+		if ((type == T_PAGEFLT) || (type == T_PROTFLT))
+			uprintf(", fault VA = 0x%x", eva);
+		uprintf("\n");
+	}
+#endif
+
+out:
+	userret(p, &frame, sticks);
+}
+
+int
+trap_pfault(frame, usermode)
+	struct trapframe *frame;
+	int usermode;
+{
+	vm_offset_t va;
+	struct vmspace *vm;
+	vm_map_t map = 0;
+	int rv = 0, oldflags;
+	vm_prot_t ftype;
+	extern vm_map_t kernel_map;
+	int eva;
+	struct proc *p = curproc;
+
+	eva = rcr2();
+	va = trunc_page((vm_offset_t)eva);
+
+	/*
+	 * Don't allow user-mode faults in kernel address space
+	 */
+	if (usermode && (va >= KERNBASE)) {
+        	goto nogo;
+	}
+
+	if ((p == 0) || (va >= KERNBASE)) {
+		vm = 0;
+		map = kernel_map;
+	} else {
+		vm = p->p_vmspace;
+		map = &vm->vm_map;
+	}
+
+	if (frame->tf_err & PGEX_W)
+		ftype = VM_PROT_READ | VM_PROT_WRITE;
+	else
+		ftype = VM_PROT_READ;
+
+	if (map != kernel_map) {
+		vm_offset_t pa;
+		vm_offset_t v = (vm_offset_t) vtopte(va);
+		vm_page_t ptepg;
+
+		/*
+		 * Keep swapout from messing with us during this
+		 *	critical time.
+		 */
+		++p->p_lock;
+
+		/*
+		 * Grow the stack if necessary
+		 */
+		if ((caddr_t)va > vm->vm_maxsaddr
+		    && (caddr_t)va < (caddr_t)USRSTACK) {
+			if (!grow(p, va)) {
+				rv = KERN_FAILURE;
+				--p->p_lock;
+				goto nogo;
+			}
+		}
+
+		/*
+		 * Check if page table is mapped, if not,
+		 *	fault it first
+		 */
+
+		/* Fault the pte only if needed: */
+		*(volatile char *)v += 0;	
+
+		ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
+		vm_page_hold(ptepg);
+
+		/* Fault in the user page: */
+		rv = vm_fault(map, va, ftype, FALSE);
+
+		vm_page_unhold(ptepg);
+
+		/*
+		 * page table pages don't need to be kept if they
+		 * are not held
+		 */
+		if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
+			pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
+				VM_PROT_NONE);
+			vm_page_free(ptepg);
+		}
+
+		--p->p_lock;
+	} else {
+		/*
+		 * Since we know that kernel virtual address addresses
+		 * always have pte pages mapped, we just have to fault
+		 * the page.
+		 */
+		rv = vm_fault(map, va, ftype, FALSE);
+	}
+
+	if (rv == KERN_SUCCESS)
+		return (0);
+nogo:
+	if (!usermode) {
+		if (curpcb->pcb_onfault) {
+			frame->tf_eip = (int)curpcb->pcb_onfault;
+			return (0);
+		}
+		trap_fatal(frame);
+	}
+
+	/* kludge to pass faulting virtual address to sendsig */
+	frame->tf_err = eva;
+
+	return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
+}
+
+void
+trap_fatal(frame)
+	struct trapframe *frame;
+{
+	int code, type, eva;
+
+	code = frame->tf_err;
+	type = frame->tf_trapno;
+	eva = rcr2();
+
+	if (type <= MAX_TRAP_MSG)
+		printf("\n\nFatal trap %d: %s while in %s mode\n",
+			type, trap_msg[type],
+			ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
+	if (type == T_PAGEFLT) {
+		printf("fault virtual address	= 0x%x\n", eva);
+		printf("fault code		= %s %s, %s\n",
+			code & PGEX_U ? "user" : "supervisor",
+			code & PGEX_W ? "write" : "read",
+			code & PGEX_P ? "protection violation" : "page not present");
+	}
+	printf("instruction pointer	= 0x%x\n", frame->tf_eip);
+	printf("processor eflags	= ");
+	if (frame->tf_eflags & EFL_TF)
+		printf("trace/trap, ");
+	if (frame->tf_eflags & EFL_IF)
+		printf("interrupt enabled, ");
+	if (frame->tf_eflags & EFL_NT)
+		printf("nested task, ");
+	if (frame->tf_eflags & EFL_RF)
+		printf("resume, ");
+	if (frame->tf_eflags & EFL_VM)
+		printf("vm86, ");
+	printf("IOPL = %d\n", (frame->tf_eflags & EFL_IOPL) >> 12);
+	printf("current process		= ");
+	if (curproc) {
+		printf("%d (%s)\n",
+		    curproc->p_pid, curproc->p_comm ?
+		    curproc->p_comm : "");
+	} else {
+		printf("Idle\n");
+	}
+	printf("interrupt mask		= ");
+	if ((cpl & net_imask) == net_imask)
+		printf("net ");
+	if ((cpl & tty_imask) == tty_imask)
+		printf("tty ");
+	if ((cpl & bio_imask) == bio_imask)
+		printf("bio ");
+	if (cpl == 0)
+		printf("none");
+	printf("\n");
+
+#ifdef KDB
+	if (kdb_trap(&psl))
+		return;
+#endif
+#if NDDB > 0
+	if (kdb_trap (type, 0, frame))
+		return;
+#endif
+	if (type <= MAX_TRAP_MSG)
+		panic(trap_msg[type]);
+	else
+		panic("unknown/reserved trap");
+}
+
 /*
  * Compensate for 386 brain damage (missing URKR).
  * This is a little simpler than the pagefault handler in trap() because
@@ -586,21 +591,17 @@ int trapwrite(addr)
 /*ARGSUSED*/
 void
 syscall(frame)
-	volatile struct trapframe frame;
+	struct trapframe frame;
 {
-	register int *locr0 = ((int *)&frame);
-	register caddr_t params;
-	register int i;
-	register struct sysent *callp;
-	register struct proc *p = curproc;
+	caddr_t params;
+	int i;
+	struct sysent *callp;
+	struct proc *p = curproc;
 	u_quad_t sticks;
 	int error, opc;
 	int args[8], rval[2];
 	u_int code;
 
-#ifdef lint
-	r0 = 0; r0 = r0; r1 = 0; r1 = r1;
-#endif
 	sticks = p->p_sticks;
 	if (ISPL(frame.tf_cs) != SEL_UPL)
 		panic("syscall");
@@ -638,13 +639,11 @@ syscall(frame)
 
 	if ((i = callp->sy_narg * sizeof (int)) &&
 	    (error = copyin(params, (caddr_t)args, (u_int)i))) {
-		frame.tf_eax = error;
-		frame.tf_eflags |= PSL_C;	/* carry bit */
 #ifdef KTRACE
 		if (KTRPOINT(p, KTR_SYSCALL))
 			ktrsyscall(p->p_tracep, code, callp->sy_narg, args);
 #endif
-		goto done;
+		goto bad;
 	}
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSCALL))
@@ -652,64 +651,38 @@ syscall(frame)
 #endif
 	rval[0] = 0;
 	rval[1] = frame.tf_edx;
-/*pg("%d. s %d\n", p->p_pid, code);*/
-	error = (*callp->sy_call)(p, args, rval);
-	if (error == ERESTART)
-		frame.tf_eip = opc;
-	else if (error != EJUSTRETURN) {
-		if (error) {
-/*pg("error %d", error);*/
-			frame.tf_eax = error;
-			frame.tf_eflags |= PSL_C;	/* carry bit */
-		} else {
-			frame.tf_eax = rval[0];
-			frame.tf_edx = rval[1];
-			frame.tf_eflags &= ~PSL_C;	/* carry bit */
-		}
-	}
-	/* else if (error == EJUSTRETURN) */
-		/* nothing to do */
-done:
-	/*
-	 * Reinitialize proc pointer `p' as it may be different
-	 * if this is a child returning from fork syscall.
-	 */
-	p = curproc;
-	while (i = CURSIG(p))
-		postsig(i);
-	p->p_priority = p->p_usrpri;
-	if (want_resched) {
-		int s;
-		/*
-		 * Since we are curproc, clock will normally just change
-		 * our priority without moving us from one queue to another
-		 * (since the running process is not on a queue.)
-		 * If that happened after we setrunqueue ourselves but before we
-		 * swtch()'ed, we might not be on the queue indicated by
-		 * our priority.
-		 */
-		s = splclock();
-		setrunqueue(p);
-		p->p_stats->p_ru.ru_nivcsw++;
-		mi_switch();
-		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
-	}
-	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
 
-		if (ticks) {
-#ifdef PROFTIMER
-			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
-			    ticks * profscale);
-#else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
-#endif
-		}
+	error = (*callp->sy_call)(p, args, rval);
+
+	switch (error) {
+
+	case 0:
+		/*
+		 * Reinitialize proc pointer `p' as it may be different
+		 * if this is a child returning from fork syscall.
+		 */
+		p = curproc;
+		frame.tf_eax = rval[0];
+		frame.tf_edx = rval[1];
+		frame.tf_eflags &= ~PSL_C;	/* carry bit */
+		break;
+
+	case ERESTART:
+		frame.tf_eip = opc;
+		break;
+
+	case EJUSTRETURN:
+		break;
+
+	default:
+	bad:
+		frame.tf_eax = error;
+		frame.tf_eflags |= PSL_C;	/* carry bit */
+		break;
 	}
-	curpriority = p->p_priority;
+
+	userret(p, &frame, sticks);
+
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSRET))
 		ktrsysret(p->p_tracep, code, error, rval[0]);
diff --git a/sys/amd64/include/cpufunc.h b/sys/amd64/include/cpufunc.h
index 729a5c06ccf8..df871cbc0b6c 100644
--- a/sys/amd64/include/cpufunc.h
+++ b/sys/amd64/include/cpufunc.h
@@ -71,6 +71,14 @@ tlbflush()
 	__asm __volatile("movl %%cr3, %%eax; movl %%eax, %%cr3" : : : "ax");
 }
 
+static inline u_long
+rcr2()
+{
+	u_long data;
+	__asm __volatile("movl %%cr2,%%eax" : "=a" (data));
+	return data;
+}
+
 #else /* not __GNUC__ */
 extern	void insque __P((void *, void *));
 extern	void remque __P((void *));
@@ -87,7 +95,6 @@ void	load_cr0	__P((u_int cr0));
 u_int	rcr0	__P((void));
 void load_cr3(u_long);
 u_long rcr3(void);
-u_long rcr2(void);
 
 void	setidt	__P((int, void (*)(), int, int));
 extern u_long kvtop(void *);
diff --git a/sys/i386/i386/support.s b/sys/i386/i386/support.s
index 9634069e2e8a..32ba9b62896a 100644
--- a/sys/i386/i386/support.s
+++ b/sys/i386/i386/support.s
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: support.s,v 1.6 1994/04/02 07:00:29 davidg Exp $
+ *	$Id: support.s,v 1.10 1994/06/06 14:23:49 davidg Exp $
  */
 
 #include "assym.s"				/* system definitions */
@@ -616,15 +616,22 @@ ENTRY(copyin)
 	movl	16(%esp),%edi			/* caddr_t to */
 	movl	20(%esp),%ecx			/* size_t  len */
 
+	/*
+	 * make sure address is valid
+	 */
+	movl	%esi,%edx
+	addl	%ecx,%edx
+	jc	copyin_fault
+	cmpl	$VM_MAXUSER_ADDRESS,%edx
+	ja	copyin_fault
+
 	movb	%cl,%al
 	shrl	$2,%ecx				/* copy longword-wise */
 	cld
-	gs
 	rep
 	movsl
 	movb	%al,%cl
 	andb	$3,%cl				/* copy remaining bytes */
-	gs
 	rep
 	movsb
 
@@ -651,8 +658,11 @@ ALTENTRY(fuiword)
 ENTRY(fuword)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
-	movl	4(%esp),%edx
-	gs
+	movl	4(%esp),%edx			/* from */
+
+	cmpl	$VM_MAXUSER_ADDRESS-4,%edx	/* verify address is valid */
+	ja	fusufault
+
 	movl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -672,7 +682,10 @@ ENTRY(fusword)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
 	movl	4(%esp),%edx
-	gs
+
+	cmpl	$VM_MAXUSER_ADDRESS-2,%edx
+	ja	fusufault
+
 	movzwl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -682,7 +695,10 @@ ENTRY(fubyte)
 	movl	_curpcb,%ecx
 	movl	$fusufault,PCB_ONFAULT(%ecx)
 	movl	4(%esp),%edx
-	gs
+
+	cmpl	$VM_MAXUSER_ADDRESS-1,%eax
+	ja	fusufault
+
 	movzbl	(%edx),%eax
 	movl	$0,PCB_ONFAULT(%ecx)
 	ret
@@ -732,8 +748,10 @@ ENTRY(suword)
 #endif
 
 2:	
+	cmpl	$VM_MAXUSER_ADDRESS-4,%edx	/* verify address validity */
+	ja	fusufault
+
 	movl	8(%esp),%eax
-	gs
 	movl	%eax,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -772,8 +790,10 @@ ENTRY(susword)
 #endif
 
 2:
+	cmpl	$VM_MAXUSER_ADDRESS-2,%edx	/* verify address validity */
+	ja	fusufault
+
 	movw	8(%esp),%ax
-	gs
 	movw	%ax,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -812,8 +832,10 @@ ENTRY(subyte)
 #endif
 
 2:
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edx	/* verify address validity */
+	ja	fusufault
+
 	movb	8(%esp),%al
-	gs
 	movb	%al,(%edx)
 	xorl	%eax,%eax
 	movl	%eax,PCB_ONFAULT(%ecx)
@@ -849,8 +871,8 @@ ENTRY(copyoutstr)
 	 * we look at a page at a time and the end address is on a page
 	 * boundary.
 	 */
-	cmpl	$VM_MAXUSER_ADDRESS,%edi
-	jae	cpystrflt
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edi
+	ja	cpystrflt
 
 	movl	%edi,%eax
 	shrl	$IDXSHIFT,%eax
@@ -908,13 +930,11 @@ ENTRY(copyoutstr)
 	decl	%edx
 	jz	2f
 	/*
-	 * gs override doesn't work for stosb.  Use the same explicit check
-	 * as in copyout().  It's much slower now because it is per-char.
-	 * XXX - however, it would be faster to rewrite this function to use
+	 * XXX - would be faster to rewrite this function to use
 	 * strlen() and copyout().
 	 */
-	cmpl	$VM_MAXUSER_ADDRESS,%edi
-	jae	cpystrflt
+	cmpl	$VM_MAXUSER_ADDRESS-1,%edi
+	ja	cpystrflt
 
 	lodsb
 	stosb
@@ -932,6 +952,24 @@ ENTRY(copyoutstr)
 
 #endif /* I486_CPU || I586_CPU */
 
+cpystrflt:
+	movl	$EFAULT,%eax
+cpystrflt_x:
+	/* set *lencopied and return %eax */
+	movl	_curpcb,%ecx
+	movl	$0,PCB_ONFAULT(%ecx)
+	movl	20(%esp),%ecx
+	subl	%edx,%ecx
+	movl	24(%esp),%edx
+	orl	%edx,%edx
+	jz	1f
+	movl	%ecx,(%edx)
+1:
+	popl	%edi
+	popl	%esi
+	ret
+
+
 /*
  * copyinstr(from, to, maxlen, int *lencopied)
  *	copy a string from from to to, stop when a 0 character is reached.
@@ -943,16 +981,18 @@ ENTRY(copyinstr)
 	pushl	%esi
 	pushl	%edi
 	movl	_curpcb,%ecx
-	movl	$cpystrflt,PCB_ONFAULT(%ecx)
+	movl	$copyinstr_fault,PCB_ONFAULT(%ecx)
 
 	movl	12(%esp),%esi			/* %esi = from */
 	movl	16(%esp),%edi			/* %edi = to */
 	movl	20(%esp),%edx			/* %edx = maxlen */
+	pushl	%gs
+	movl	__udatasel,%eax
+	movl	%ax,%gs
 	incl	%edx
-
 1:
 	decl	%edx
-	jz	4f
+	jz	2f
 	gs
 	lodsb
 	stosb
@@ -962,26 +1002,26 @@ ENTRY(copyinstr)
 	/* Success -- 0 byte reached */
 	decl	%edx
 	xorl	%eax,%eax
-	jmp	6f
-4:
+	jmp	3f
+2:
 	/* edx is zero -- return ENAMETOOLONG */
 	movl	$ENAMETOOLONG,%eax
-	jmp	6f
+	jmp	3f
 
-cpystrflt:
+copyinstr_fault:
 	movl	$EFAULT,%eax
-cpystrflt_x:
-6:
+3:
 	/* set *lencopied and return %eax */
 	movl	_curpcb,%ecx
 	movl	$0,PCB_ONFAULT(%ecx)
-	movl	20(%esp),%ecx
+	movl	24(%esp),%ecx
 	subl	%edx,%ecx
-	movl	24(%esp),%edx
+	movl	28(%esp),%edx
 	orl	%edx,%edx
-	jz	7f
+	jz	4f
 	movl	%ecx,(%edx)
-7:
+4:
+	popl	%gs
 	popl	%edi
 	popl	%esi
 	ret
@@ -1097,15 +1137,6 @@ ENTRY(ssdtosd)
 	popl	%ebx
 	ret
 
-#if 0
-/* tlbflush() */
-ENTRY(tlbflush)
-	movl	%cr3,%eax
-	orl	$I386_CR3PAT,%eax
-	movl	%eax,%cr3
-	ret
-#endif
-
 /* load_cr0(cr0) */
 ENTRY(load_cr0)
 	movl	4(%esp),%eax
@@ -1117,11 +1148,6 @@ ENTRY(rcr0)
 	movl	%cr0,%eax
 	ret
 
-/* rcr2() */
-ENTRY(rcr2)
-	movl	%cr2,%eax
-	ret
-
 /* rcr3() */
 ENTRY(rcr3)
 	movl	%cr3,%eax
diff --git a/sys/i386/i386/trap.c b/sys/i386/i386/trap.c
index 382416f06e3f..406310bc6521 100644
--- a/sys/i386/i386/trap.c
+++ b/sys/i386/i386/trap.c
@@ -1,6 +1,7 @@
 /*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
+ * Copyright (C) 1994, David Greenman
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
  *
  * This code is derived from software contributed to Berkeley by
  * the University of Utah, and William Jolitz.
@@ -34,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)trap.c	7.4 (Berkeley) 5/13/91
- *	$Id: trap.c,v 1.22 1994/04/07 10:51:00 davidg Exp $
+ *	$Id: trap.c,v 1.24 1994/05/25 08:55:18 rgrimes Exp $
  */
 
 /*
@@ -69,21 +70,8 @@
 #include "npx.h"
 #include "ddb.h"
 
-#ifdef	__GNUC__
-
-/*
- * The "r" contraint could be "rm" except for fatal bugs in gas.  As usual,
- * we omit the size from the mov instruction to avoid nonfatal bugs in gas.
- */
-#define	read_gs()	({ u_short gs; __asm("mov %%gs,%0" : "=r" (gs)); gs; })
-#define	write_gs(newgs)	__asm("mov %0,%%gs" : : "r" ((u_short) newgs))
-
-#else	/* not __GNUC__ */
-
-u_short	read_gs		__P((void));
-void	write_gs	__P((/* promoted u_short */ int gs));
-
-#endif	/* __GNUC__ */
+int	trap_pfault	__P((struct trapframe *, int));
+void	trap_fatal	__P((struct trapframe *));
 
 extern int grow(struct proc *,u_int);
 
@@ -101,7 +89,7 @@ char *trap_msg[] = {
 	"arithmetic trap",			/*  6 T_ARITHTRAP */
 	"system forced exception",		/*  7 T_ASTFLT */
 	"segmentation (limit) fault",		/*  8 T_SEGFLT */
-	"protection fault",			/*  9 T_PROTFLT */
+	"general protection fault",		/*  9 T_PROTFLT */
 	"trace trap",				/* 10 T_TRCTRAP */
 	"",					/* 11 unused */
 	"page fault",				/* 12 T_PAGEFLT */
@@ -122,366 +110,18 @@ char *trap_msg[] = {
 	"stack fault",				/* 27 T_STKFLT */
 };
 
-#define pde_v(v) (PTD[((v)>>PD_SHIFT)&1023].pd_v)
-
-/*
- * trap(frame):
- *	Exception, fault, and trap interface to BSD kernel. This
- * common code is called from assembly language IDT gate entry
- * routines that prepare a suitable stack frame, and restore this
- * frame after the exception has been processed. Note that the
- * effect is as if the arguments were passed call by reference.
- */
-
-/*ARGSUSED*/
-void
-trap(frame)
-	struct trapframe frame;
+static inline void
+userret(p, frame, oticks)
+	struct proc *p;
+	struct trapframe *frame;
+	u_quad_t oticks;
 {
-	register int i;
-	register struct proc *p = curproc;
-	u_quad_t sticks = 0;
-	int ucode, type, code, eva, fault_type;
+	int sig, s;
 
-	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
-	type = frame.tf_trapno;
-#if NDDB > 0
-	if (curpcb && curpcb->pcb_onfault) {
-		if (frame.tf_trapno == T_BPTFLT
-		    || frame.tf_trapno == T_TRCTRAP)
-			if (kdb_trap (type, 0, &frame))
-				return;
-	}
-#endif
-	
-	if (curpcb == 0 || curproc == 0)
-		goto skiptoswitch;
-	if (curpcb->pcb_onfault && frame.tf_trapno != T_PAGEFLT) {
-		extern int _udatasel;
-
-		if (read_gs() != (u_short) _udatasel)
-			/*
-			 * Some user has corrupted %gs but we depend on it in
-			 * copyout() etc.  Fix it up and retry.
-			 *
-			 * (We don't preserve %fs or %gs, so users can change
-			 * them to either _ucodesel, _udatasel or a not-present
-			 * selector, possibly ORed with 0 to 3, making them
-			 * volatile for other users.  Not preserving them saves
-			 * time and doesn't lose functionality or open security
-			 * holes.)
-			 */
-			write_gs(_udatasel);
-		else
-copyfault:
-			frame.tf_eip = (int)curpcb->pcb_onfault;
-		return;
-	}
-
-	if (ISPL(frame.tf_cs) == SEL_UPL) {
-		type |= T_USER;
-		p->p_md.md_regs = (int *)&frame;
-		sticks = p->p_sticks;
-	}
-
-skiptoswitch:
-	ucode=0;
-	eva = rcr2();
-	code = frame.tf_err;
-
-	if ((type & ~T_USER) == T_PAGEFLT)
-		goto pfault;
-
-	switch (type) {
-	case T_SEGNPFLT|T_USER:
-	case T_STKFLT|T_USER:
-	case T_PROTFLT|T_USER:		/* protection fault */
-		ucode = code + BUS_SEGM_FAULT ;
-		i = SIGBUS;
-		break;
-
-	case T_PRIVINFLT|T_USER:	/* privileged instruction fault */
-	case T_RESADFLT|T_USER:		/* reserved addressing fault */
-	case T_RESOPFLT|T_USER:		/* reserved operand fault */
-	case T_FPOPFLT|T_USER:		/* coprocessor operand fault */
-		ucode = type &~ T_USER;
-		i = SIGILL;
-		break;
-
-	case T_ASTFLT|T_USER:		/* Allow process switch */
-		astoff();
-		cnt.v_soft++;
-		if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
-			addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
-			p->p_flag &= ~P_OWEUPC;
-		}
-		goto out;
-
-	case T_DNA|T_USER:
-#if NNPX > 0
-		/* if a transparent fault (due to context switch "late") */
-		if (npxdna()) return;
-#endif	/* NNPX > 0 */
-#if   defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
-		i = math_emulate(&frame);
-		if (i == 0) return;
-#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		panic("trap: math emulation necessary!");
-#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		ucode = FPE_FPU_NP_TRAP;
-		break;
-
-	case T_BOUND|T_USER:
-		ucode = FPE_SUBRNG_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_OFLOW|T_USER:
-		ucode = FPE_INTOVF_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_DIVIDE|T_USER:
-		ucode = FPE_INTDIV_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_ARITHTRAP|T_USER:
-		ucode = code;
-		i = SIGFPE;
-		break;
-
-	pfault:
-	case T_PAGEFLT:			/* allow page faults in kernel mode */
-	case T_PAGEFLT|T_USER:		/* page fault */
-	    {
-		vm_offset_t va;
-		struct vmspace *vm;
-		vm_map_t map = 0;
-		int rv = 0, oldflags;
-		vm_prot_t ftype;
-		unsigned v;
-		extern vm_map_t kernel_map;
-
-		va = trunc_page((vm_offset_t)eva);
-
-		/*
-		 * Don't allow user-mode faults in kernel address space
-		 */
-		if ((type == (T_PAGEFLT|T_USER)) && (va >= KERNBASE)) {
-			goto nogo;
-		}
-
-		if ((p == 0) || (type == T_PAGEFLT && va >= KERNBASE)) {
-			vm = 0;
-			map = kernel_map;
-		} else {
-			vm = p->p_vmspace;
-			map = &vm->vm_map;
-		}
-
-		if (code & PGEX_W)
-			ftype = VM_PROT_READ | VM_PROT_WRITE;
-		else
-			ftype = VM_PROT_READ;
-
-		if (map != kernel_map) {
-			vm_offset_t pa;
-			vm_offset_t v = (vm_offset_t) vtopte(va);
-			vm_page_t ptepg;
-
-			/*
-			 * Keep swapout from messing with us during this
-			 *	critical time.
-			 */
-			++p->p_lock;
-
-			/*
-			 * Grow the stack if necessary
-			 */
-			if ((caddr_t)va > vm->vm_maxsaddr
-			    && (caddr_t)va < (caddr_t)USRSTACK) {
-				if (!grow(p, va)) {
-					rv = KERN_FAILURE;
-					--p->p_lock;
-					goto nogo;
-				}
-			}
-
-			/*
-			 * Check if page table is mapped, if not,
-			 *	fault it first
-			 */
-
-			/* Fault the pte only if needed: */
-			*(volatile char *)v += 0;	
-
-			ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
-			vm_page_hold(ptepg);
-
-			/* Fault in the user page: */
-			rv = vm_fault(map, va, ftype, FALSE);
-
-			vm_page_unhold(ptepg);
-
-			/*
-			 * page table pages don't need to be kept if they
-			 * are not held
-			 */
-			if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
-				pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
-					VM_PROT_NONE);
-				vm_page_free(ptepg);
-			}
-
-			--p->p_lock;
-		} else {
-			/*
-			 * Since we know that kernel virtual address addresses
-			 * always have pte pages mapped, we just have to fault
-			 * the page.
-			 */
-			rv = vm_fault(map, va, ftype, FALSE);
-		}
-
-		if (rv == KERN_SUCCESS) {
-			if (type == T_PAGEFLT)
-				return;
-			goto out;
-		}
-nogo:
-		if (type == T_PAGEFLT) {
-			if (curpcb->pcb_onfault)
-				goto copyfault;
-
-			goto we_re_toast;
-		}
-		i = (rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV;
-
-		/* kludge to pass faulting virtual address to sendsig */
-		ucode = type &~ T_USER;
-		frame.tf_err = eva;
-
-		break;
-	    }
-
-#if NDDB == 0
-	case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
-		frame.tf_eflags &= ~PSL_T;
-
-			/* Q: how do we turn it on again? */
-		return;
-#endif
-	
-	case T_BPTFLT|T_USER:		/* bpt instruction fault */
-	case T_TRCTRAP|T_USER:		/* trace trap */
-		frame.tf_eflags &= ~PSL_T;
-		i = SIGTRAP;
-		break;
-
-#if NISA > 0
-	case T_NMI:
-	case T_NMI|T_USER:
-#if NDDB > 0
-		/* NMI can be hooked up to a pushbutton for debugging */
-		printf ("NMI ... going to debugger\n");
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		/* machine/parity/power fail/"kitchen sink" faults */
-		if (isa_nmi(code) == 0) return;
-		/* FALL THROUGH */
-#endif
-	default:
-	we_re_toast:
-
-		fault_type = type & ~T_USER;
-#if NDDB > 0
-		if ((fault_type == T_BPTFLT) || (fault_type == T_TRCTRAP)) {
-			if (kdb_trap (type, 0, &frame))
-				return;
-		}
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			printf("\n\nFatal trap %d: %s while in %s mode\n",
-				fault_type, trap_msg[fault_type],
-				ISPL(frame.tf_cs) == SEL_UPL ? "user" : "kernel");
-		if (fault_type == T_PAGEFLT) {
-			printf("fault virtual address	= 0x%x\n", eva);
-			printf("fault code		= %s %s, %s\n",
-				code & PGEX_U ? "user" : "supervisor",
-				code & PGEX_W ? "write" : "read",
-				code & PGEX_P ? "protection violation" : "page not present");
-		}
-		printf("instruction pointer	= 0x%x\n", frame.tf_eip);
-		printf("processor eflags	= ");
-		if (frame.tf_eflags & EFL_TF)
-			printf("trace/trap, ");
-		if (frame.tf_eflags & EFL_IF)
-			printf("interrupt enabled, ");
-		if (frame.tf_eflags & EFL_NT)
-			printf("nested task, ");
-		if (frame.tf_eflags & EFL_RF)
-			printf("resume, ");
-		if (frame.tf_eflags & EFL_VM)
-			printf("vm86, ");
-		printf("IOPL = %d\n", (frame.tf_eflags & EFL_IOPL) >> 12);
-		printf("current process		= ");
-		if (curproc) {
-			printf("%d (%s)\n",
-			    curproc->p_pid, curproc->p_comm ?
-			    curproc->p_comm : "");
-		} else {
-			printf("Idle\n");
-		}
-		printf("interrupt mask		= ");
-		if ((cpl & net_imask) == net_imask)
-			printf("net ");
-		if ((cpl & tty_imask) == tty_imask)
-			printf("tty ");
-		if ((cpl & bio_imask) == bio_imask)
-			printf("bio ");
-		if (cpl == 0)
-			printf("none");
-		printf("\n");
-
-#ifdef KDB
-		if (kdb_trap(&psl))
-			return;
-#endif
-#if NDDB > 0
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			panic(trap_msg[fault_type]);
-		else
-			panic("unknown/reserved trap");
-
-		/* NOTREACHED */
-	}
-
-	trapsignal(p, i, ucode);
-	if ((type & T_USER) == 0)
-		return;
-
-#ifdef DIAGNOSTIC
-	fault_type = type & ~T_USER;
-	if (fault_type <= MAX_TRAP_MSG) {
-		uprintf("fatal process exception: %s", 
-			trap_msg[fault_type]);
-		if ((fault_type == T_PAGEFLT) || (fault_type == T_PROTFLT))
-			uprintf(", fault VA = 0x%x", eva);
-		uprintf("\n");
-	}
-#endif
-
-out:
-	while (i = CURSIG(p))
-		postsig(i);
+	while (sig = CURSIG(p))
+		postsig(sig);
 	p->p_priority = p->p_usrpri;
 	if (want_resched) {
-		int s;
 		/*
 		 * Since we are curproc, clock will normally just change
 		 * our priority without moving us from one queue to another
@@ -495,25 +135,390 @@ out:
 		p->p_stats->p_ru.ru_nivcsw++;
 		mi_switch();
 		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
+		while (sig = CURSIG(p))
+			postsig(sig);
 	}
 	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
+		u_quad_t ticks = p->p_sticks - oticks;
 
 		if (ticks) {
 #ifdef PROFTIMER
 			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
+			addupc(frame->tf_eip, &p->p_stats->p_prof,
 			    ticks * profscale);
 #else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
+			addupc(frame->tf_eip, &p->p_stats->p_prof, ticks);
 #endif
 		}
 	}
 	curpriority = p->p_priority;
 }
 
+/*
+ * trap(frame):
+ *	Exception, fault, and trap interface to the FreeBSD kernel.
+ * This common code is called from assembly language IDT gate entry
+ * routines that prepare a suitable stack frame, and restore this
+ * frame after the exception has been processed.
+ */
+
+/*ARGSUSED*/
+void
+trap(frame)
+	struct trapframe frame;
+{
+	struct proc *p = curproc;
+	u_quad_t sticks = 0;
+	int i = 0, ucode = 0, type, code, eva, fault_type;
+
+	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
+	type = frame.tf_trapno;
+	code = frame.tf_err;
+	
+	if (ISPL(frame.tf_cs) == SEL_UPL) {
+		/* user trap */
+
+		sticks = p->p_sticks;
+		p->p_md.md_regs = (int *)&frame;
+
+		switch (type) {
+		case T_RESADFLT:	/* reserved addressing fault */
+		case T_PRIVINFLT:	/* privileged instruction fault */
+		case T_RESOPFLT:	/* reserved operand fault */
+			ucode = type;
+			i = SIGILL;
+			break;
+
+		case T_BPTFLT:		/* bpt instruction fault */
+		case T_TRCTRAP:		/* trace trap */
+			frame.tf_eflags &= ~PSL_T;
+			i = SIGTRAP;
+			break;
+
+		case T_ARITHTRAP:	/* arithmetic trap */
+			ucode = code;
+			i = SIGFPE;
+			break;
+
+		case T_ASTFLT:		/* Allow process switch */
+			astoff();
+			cnt.v_soft++;
+			if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
+				addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
+				p->p_flag &= ~P_OWEUPC;
+			}
+			goto out;
+
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+		case T_STKFLT:		/* stack fault */
+			ucode = code + BUS_SEGM_FAULT ;
+			i = SIGBUS;
+			break;
+
+		case T_PAGEFLT:		/* page fault */
+			i = trap_pfault(&frame, TRUE);
+			if (i == 0)
+				goto out;
+
+			ucode = T_PAGEFLT;
+			break;
+
+		case T_DIVIDE:		/* integer divide fault */
+			ucode = FPE_INTDIV_TRAP;
+			i = SIGFPE;
+			break;
+
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
+
+		case T_OFLOW:		/* integer overflow fault */
+			ucode = FPE_INTOVF_TRAP;
+			i = SIGFPE;
+			break;
+
+		case T_BOUND:		/* bounds check fault */
+			ucode = FPE_SUBRNG_TRAP;
+			i = SIGFPE;
+			break;
+
+		case T_DNA:
+#if NNPX > 0
+			/* if a transparent fault (due to context switch "late") */
+			if (npxdna())
+				return;
+#endif	/* NNPX > 0 */
+
+#if defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
+			i = math_emulate(&frame);
+			if (i == 0) return;
+#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			panic("trap: math emulation necessary!");
+#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			ucode = FPE_FPU_NP_TRAP;
+			break;
+
+		case T_FPOPFLT:		/* FPU operand fetch fault */
+			ucode = T_FPOPFLT;
+			i = SIGILL;
+			break;
+
+		default:
+			trap_fatal(&frame);
+		}
+	} else {
+		/* kernel trap */
+
+		switch (type) {
+		case T_PAGEFLT:			/* page fault */
+			(void) trap_pfault(&frame, FALSE);
+			return;
+
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+			if (curpcb && curpcb->pcb_onfault) {
+				frame.tf_eip = (int)curpcb->pcb_onfault;
+				return;
+			}
+			break;
+
+#if NDDB > 0
+		case T_BPTFLT:
+		case T_TRCTRAP:
+			if (kdb_trap (type, 0, &frame))
+				return;
+			break;
+#else
+		case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
+			/* Q: how do we turn it on again? */
+			frame.tf_eflags &= ~PSL_T;
+			return;
+#endif
+	
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
+		}
+
+		trap_fatal(&frame);
+	}
+
+	trapsignal(p, i, ucode);
+
+#ifdef DIAGNOSTIC
+	eva = rcr2();
+	if (type <= MAX_TRAP_MSG) {
+		uprintf("fatal process exception: %s", 
+			trap_msg[type]);
+		if ((type == T_PAGEFLT) || (type == T_PROTFLT))
+			uprintf(", fault VA = 0x%x", eva);
+		uprintf("\n");
+	}
+#endif
+
+out:
+	userret(p, &frame, sticks);
+}
+
+int
+trap_pfault(frame, usermode)
+	struct trapframe *frame;
+	int usermode;
+{
+	vm_offset_t va;
+	struct vmspace *vm;
+	vm_map_t map = 0;
+	int rv = 0, oldflags;
+	vm_prot_t ftype;
+	extern vm_map_t kernel_map;
+	int eva;
+	struct proc *p = curproc;
+
+	eva = rcr2();
+	va = trunc_page((vm_offset_t)eva);
+
+	/*
+	 * Don't allow user-mode faults in kernel address space
+	 */
+	if (usermode && (va >= KERNBASE)) {
+        	goto nogo;
+	}
+
+	if ((p == 0) || (va >= KERNBASE)) {
+		vm = 0;
+		map = kernel_map;
+	} else {
+		vm = p->p_vmspace;
+		map = &vm->vm_map;
+	}
+
+	if (frame->tf_err & PGEX_W)
+		ftype = VM_PROT_READ | VM_PROT_WRITE;
+	else
+		ftype = VM_PROT_READ;
+
+	if (map != kernel_map) {
+		vm_offset_t pa;
+		vm_offset_t v = (vm_offset_t) vtopte(va);
+		vm_page_t ptepg;
+
+		/*
+		 * Keep swapout from messing with us during this
+		 *	critical time.
+		 */
+		++p->p_lock;
+
+		/*
+		 * Grow the stack if necessary
+		 */
+		if ((caddr_t)va > vm->vm_maxsaddr
+		    && (caddr_t)va < (caddr_t)USRSTACK) {
+			if (!grow(p, va)) {
+				rv = KERN_FAILURE;
+				--p->p_lock;
+				goto nogo;
+			}
+		}
+
+		/*
+		 * Check if page table is mapped, if not,
+		 *	fault it first
+		 */
+
+		/* Fault the pte only if needed: */
+		*(volatile char *)v += 0;	
+
+		ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
+		vm_page_hold(ptepg);
+
+		/* Fault in the user page: */
+		rv = vm_fault(map, va, ftype, FALSE);
+
+		vm_page_unhold(ptepg);
+
+		/*
+		 * page table pages don't need to be kept if they
+		 * are not held
+		 */
+		if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
+			pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
+				VM_PROT_NONE);
+			vm_page_free(ptepg);
+		}
+
+		--p->p_lock;
+	} else {
+		/*
+		 * Since we know that kernel virtual address addresses
+		 * always have pte pages mapped, we just have to fault
+		 * the page.
+		 */
+		rv = vm_fault(map, va, ftype, FALSE);
+	}
+
+	if (rv == KERN_SUCCESS)
+		return (0);
+nogo:
+	if (!usermode) {
+		if (curpcb->pcb_onfault) {
+			frame->tf_eip = (int)curpcb->pcb_onfault;
+			return (0);
+		}
+		trap_fatal(frame);
+	}
+
+	/* kludge to pass faulting virtual address to sendsig */
+	frame->tf_err = eva;
+
+	return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
+}
+
+void
+trap_fatal(frame)
+	struct trapframe *frame;
+{
+	int code, type, eva;
+
+	code = frame->tf_err;
+	type = frame->tf_trapno;
+	eva = rcr2();
+
+	if (type <= MAX_TRAP_MSG)
+		printf("\n\nFatal trap %d: %s while in %s mode\n",
+			type, trap_msg[type],
+			ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
+	if (type == T_PAGEFLT) {
+		printf("fault virtual address	= 0x%x\n", eva);
+		printf("fault code		= %s %s, %s\n",
+			code & PGEX_U ? "user" : "supervisor",
+			code & PGEX_W ? "write" : "read",
+			code & PGEX_P ? "protection violation" : "page not present");
+	}
+	printf("instruction pointer	= 0x%x\n", frame->tf_eip);
+	printf("processor eflags	= ");
+	if (frame->tf_eflags & EFL_TF)
+		printf("trace/trap, ");
+	if (frame->tf_eflags & EFL_IF)
+		printf("interrupt enabled, ");
+	if (frame->tf_eflags & EFL_NT)
+		printf("nested task, ");
+	if (frame->tf_eflags & EFL_RF)
+		printf("resume, ");
+	if (frame->tf_eflags & EFL_VM)
+		printf("vm86, ");
+	printf("IOPL = %d\n", (frame->tf_eflags & EFL_IOPL) >> 12);
+	printf("current process		= ");
+	if (curproc) {
+		printf("%d (%s)\n",
+		    curproc->p_pid, curproc->p_comm ?
+		    curproc->p_comm : "");
+	} else {
+		printf("Idle\n");
+	}
+	printf("interrupt mask		= ");
+	if ((cpl & net_imask) == net_imask)
+		printf("net ");
+	if ((cpl & tty_imask) == tty_imask)
+		printf("tty ");
+	if ((cpl & bio_imask) == bio_imask)
+		printf("bio ");
+	if (cpl == 0)
+		printf("none");
+	printf("\n");
+
+#ifdef KDB
+	if (kdb_trap(&psl))
+		return;
+#endif
+#if NDDB > 0
+	if (kdb_trap (type, 0, frame))
+		return;
+#endif
+	if (type <= MAX_TRAP_MSG)
+		panic(trap_msg[type]);
+	else
+		panic("unknown/reserved trap");
+}
+
 /*
  * Compensate for 386 brain damage (missing URKR).
  * This is a little simpler than the pagefault handler in trap() because
@@ -586,21 +591,17 @@ int trapwrite(addr)
 /*ARGSUSED*/
 void
 syscall(frame)
-	volatile struct trapframe frame;
+	struct trapframe frame;
 {
-	register int *locr0 = ((int *)&frame);
-	register caddr_t params;
-	register int i;
-	register struct sysent *callp;
-	register struct proc *p = curproc;
+	caddr_t params;
+	int i;
+	struct sysent *callp;
+	struct proc *p = curproc;
 	u_quad_t sticks;
 	int error, opc;
 	int args[8], rval[2];
 	u_int code;
 
-#ifdef lint
-	r0 = 0; r0 = r0; r1 = 0; r1 = r1;
-#endif
 	sticks = p->p_sticks;
 	if (ISPL(frame.tf_cs) != SEL_UPL)
 		panic("syscall");
@@ -638,13 +639,11 @@ syscall(frame)
 
 	if ((i = callp->sy_narg * sizeof (int)) &&
 	    (error = copyin(params, (caddr_t)args, (u_int)i))) {
-		frame.tf_eax = error;
-		frame.tf_eflags |= PSL_C;	/* carry bit */
 #ifdef KTRACE
 		if (KTRPOINT(p, KTR_SYSCALL))
 			ktrsyscall(p->p_tracep, code, callp->sy_narg, args);
 #endif
-		goto done;
+		goto bad;
 	}
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSCALL))
@@ -652,64 +651,38 @@ syscall(frame)
 #endif
 	rval[0] = 0;
 	rval[1] = frame.tf_edx;
-/*pg("%d. s %d\n", p->p_pid, code);*/
-	error = (*callp->sy_call)(p, args, rval);
-	if (error == ERESTART)
-		frame.tf_eip = opc;
-	else if (error != EJUSTRETURN) {
-		if (error) {
-/*pg("error %d", error);*/
-			frame.tf_eax = error;
-			frame.tf_eflags |= PSL_C;	/* carry bit */
-		} else {
-			frame.tf_eax = rval[0];
-			frame.tf_edx = rval[1];
-			frame.tf_eflags &= ~PSL_C;	/* carry bit */
-		}
-	}
-	/* else if (error == EJUSTRETURN) */
-		/* nothing to do */
-done:
-	/*
-	 * Reinitialize proc pointer `p' as it may be different
-	 * if this is a child returning from fork syscall.
-	 */
-	p = curproc;
-	while (i = CURSIG(p))
-		postsig(i);
-	p->p_priority = p->p_usrpri;
-	if (want_resched) {
-		int s;
-		/*
-		 * Since we are curproc, clock will normally just change
-		 * our priority without moving us from one queue to another
-		 * (since the running process is not on a queue.)
-		 * If that happened after we setrunqueue ourselves but before we
-		 * swtch()'ed, we might not be on the queue indicated by
-		 * our priority.
-		 */
-		s = splclock();
-		setrunqueue(p);
-		p->p_stats->p_ru.ru_nivcsw++;
-		mi_switch();
-		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
-	}
-	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
 
-		if (ticks) {
-#ifdef PROFTIMER
-			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
-			    ticks * profscale);
-#else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
-#endif
-		}
+	error = (*callp->sy_call)(p, args, rval);
+
+	switch (error) {
+
+	case 0:
+		/*
+		 * Reinitialize proc pointer `p' as it may be different
+		 * if this is a child returning from fork syscall.
+		 */
+		p = curproc;
+		frame.tf_eax = rval[0];
+		frame.tf_edx = rval[1];
+		frame.tf_eflags &= ~PSL_C;	/* carry bit */
+		break;
+
+	case ERESTART:
+		frame.tf_eip = opc;
+		break;
+
+	case EJUSTRETURN:
+		break;
+
+	default:
+	bad:
+		frame.tf_eax = error;
+		frame.tf_eflags |= PSL_C;	/* carry bit */
+		break;
 	}
-	curpriority = p->p_priority;
+
+	userret(p, &frame, sticks);
+
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSRET))
 		ktrsysret(p->p_tracep, code, error, rval[0]);
diff --git a/sys/i386/include/cpufunc.h b/sys/i386/include/cpufunc.h
index 729a5c06ccf8..df871cbc0b6c 100644
--- a/sys/i386/include/cpufunc.h
+++ b/sys/i386/include/cpufunc.h
@@ -71,6 +71,14 @@ tlbflush()
 	__asm __volatile("movl %%cr3, %%eax; movl %%eax, %%cr3" : : : "ax");
 }
 
+static inline u_long
+rcr2()
+{
+	u_long data;
+	__asm __volatile("movl %%cr2,%%eax" : "=a" (data));
+	return data;
+}
+
 #else /* not __GNUC__ */
 extern	void insque __P((void *, void *));
 extern	void remque __P((void *));
@@ -87,7 +95,6 @@ void	load_cr0	__P((u_int cr0));
 u_int	rcr0	__P((void));
 void load_cr3(u_long);
 u_long rcr3(void);
-u_long rcr2(void);
 
 void	setidt	__P((int, void (*)(), int, int));
 extern u_long kvtop(void *);
diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c
index 382416f06e3f..406310bc6521 100644
--- a/sys/kern/subr_trap.c
+++ b/sys/kern/subr_trap.c
@@ -1,6 +1,7 @@
 /*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
+ * Copyright (C) 1994, David Greenman
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
  *
  * This code is derived from software contributed to Berkeley by
  * the University of Utah, and William Jolitz.
@@ -34,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)trap.c	7.4 (Berkeley) 5/13/91
- *	$Id: trap.c,v 1.22 1994/04/07 10:51:00 davidg Exp $
+ *	$Id: trap.c,v 1.24 1994/05/25 08:55:18 rgrimes Exp $
  */
 
 /*
@@ -69,21 +70,8 @@
 #include "npx.h"
 #include "ddb.h"
 
-#ifdef	__GNUC__
-
-/*
- * The "r" contraint could be "rm" except for fatal bugs in gas.  As usual,
- * we omit the size from the mov instruction to avoid nonfatal bugs in gas.
- */
-#define	read_gs()	({ u_short gs; __asm("mov %%gs,%0" : "=r" (gs)); gs; })
-#define	write_gs(newgs)	__asm("mov %0,%%gs" : : "r" ((u_short) newgs))
-
-#else	/* not __GNUC__ */
-
-u_short	read_gs		__P((void));
-void	write_gs	__P((/* promoted u_short */ int gs));
-
-#endif	/* __GNUC__ */
+int	trap_pfault	__P((struct trapframe *, int));
+void	trap_fatal	__P((struct trapframe *));
 
 extern int grow(struct proc *,u_int);
 
@@ -101,7 +89,7 @@ char *trap_msg[] = {
 	"arithmetic trap",			/*  6 T_ARITHTRAP */
 	"system forced exception",		/*  7 T_ASTFLT */
 	"segmentation (limit) fault",		/*  8 T_SEGFLT */
-	"protection fault",			/*  9 T_PROTFLT */
+	"general protection fault",		/*  9 T_PROTFLT */
 	"trace trap",				/* 10 T_TRCTRAP */
 	"",					/* 11 unused */
 	"page fault",				/* 12 T_PAGEFLT */
@@ -122,366 +110,18 @@ char *trap_msg[] = {
 	"stack fault",				/* 27 T_STKFLT */
 };
 
-#define pde_v(v) (PTD[((v)>>PD_SHIFT)&1023].pd_v)
-
-/*
- * trap(frame):
- *	Exception, fault, and trap interface to BSD kernel. This
- * common code is called from assembly language IDT gate entry
- * routines that prepare a suitable stack frame, and restore this
- * frame after the exception has been processed. Note that the
- * effect is as if the arguments were passed call by reference.
- */
-
-/*ARGSUSED*/
-void
-trap(frame)
-	struct trapframe frame;
+static inline void
+userret(p, frame, oticks)
+	struct proc *p;
+	struct trapframe *frame;
+	u_quad_t oticks;
 {
-	register int i;
-	register struct proc *p = curproc;
-	u_quad_t sticks = 0;
-	int ucode, type, code, eva, fault_type;
+	int sig, s;
 
-	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
-	type = frame.tf_trapno;
-#if NDDB > 0
-	if (curpcb && curpcb->pcb_onfault) {
-		if (frame.tf_trapno == T_BPTFLT
-		    || frame.tf_trapno == T_TRCTRAP)
-			if (kdb_trap (type, 0, &frame))
-				return;
-	}
-#endif
-	
-	if (curpcb == 0 || curproc == 0)
-		goto skiptoswitch;
-	if (curpcb->pcb_onfault && frame.tf_trapno != T_PAGEFLT) {
-		extern int _udatasel;
-
-		if (read_gs() != (u_short) _udatasel)
-			/*
-			 * Some user has corrupted %gs but we depend on it in
-			 * copyout() etc.  Fix it up and retry.
-			 *
-			 * (We don't preserve %fs or %gs, so users can change
-			 * them to either _ucodesel, _udatasel or a not-present
-			 * selector, possibly ORed with 0 to 3, making them
-			 * volatile for other users.  Not preserving them saves
-			 * time and doesn't lose functionality or open security
-			 * holes.)
-			 */
-			write_gs(_udatasel);
-		else
-copyfault:
-			frame.tf_eip = (int)curpcb->pcb_onfault;
-		return;
-	}
-
-	if (ISPL(frame.tf_cs) == SEL_UPL) {
-		type |= T_USER;
-		p->p_md.md_regs = (int *)&frame;
-		sticks = p->p_sticks;
-	}
-
-skiptoswitch:
-	ucode=0;
-	eva = rcr2();
-	code = frame.tf_err;
-
-	if ((type & ~T_USER) == T_PAGEFLT)
-		goto pfault;
-
-	switch (type) {
-	case T_SEGNPFLT|T_USER:
-	case T_STKFLT|T_USER:
-	case T_PROTFLT|T_USER:		/* protection fault */
-		ucode = code + BUS_SEGM_FAULT ;
-		i = SIGBUS;
-		break;
-
-	case T_PRIVINFLT|T_USER:	/* privileged instruction fault */
-	case T_RESADFLT|T_USER:		/* reserved addressing fault */
-	case T_RESOPFLT|T_USER:		/* reserved operand fault */
-	case T_FPOPFLT|T_USER:		/* coprocessor operand fault */
-		ucode = type &~ T_USER;
-		i = SIGILL;
-		break;
-
-	case T_ASTFLT|T_USER:		/* Allow process switch */
-		astoff();
-		cnt.v_soft++;
-		if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
-			addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
-			p->p_flag &= ~P_OWEUPC;
-		}
-		goto out;
-
-	case T_DNA|T_USER:
-#if NNPX > 0
-		/* if a transparent fault (due to context switch "late") */
-		if (npxdna()) return;
-#endif	/* NNPX > 0 */
-#if   defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
-		i = math_emulate(&frame);
-		if (i == 0) return;
-#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		panic("trap: math emulation necessary!");
-#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		ucode = FPE_FPU_NP_TRAP;
-		break;
-
-	case T_BOUND|T_USER:
-		ucode = FPE_SUBRNG_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_OFLOW|T_USER:
-		ucode = FPE_INTOVF_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_DIVIDE|T_USER:
-		ucode = FPE_INTDIV_TRAP;
-		i = SIGFPE;
-		break;
-
-	case T_ARITHTRAP|T_USER:
-		ucode = code;
-		i = SIGFPE;
-		break;
-
-	pfault:
-	case T_PAGEFLT:			/* allow page faults in kernel mode */
-	case T_PAGEFLT|T_USER:		/* page fault */
-	    {
-		vm_offset_t va;
-		struct vmspace *vm;
-		vm_map_t map = 0;
-		int rv = 0, oldflags;
-		vm_prot_t ftype;
-		unsigned v;
-		extern vm_map_t kernel_map;
-
-		va = trunc_page((vm_offset_t)eva);
-
-		/*
-		 * Don't allow user-mode faults in kernel address space
-		 */
-		if ((type == (T_PAGEFLT|T_USER)) && (va >= KERNBASE)) {
-			goto nogo;
-		}
-
-		if ((p == 0) || (type == T_PAGEFLT && va >= KERNBASE)) {
-			vm = 0;
-			map = kernel_map;
-		} else {
-			vm = p->p_vmspace;
-			map = &vm->vm_map;
-		}
-
-		if (code & PGEX_W)
-			ftype = VM_PROT_READ | VM_PROT_WRITE;
-		else
-			ftype = VM_PROT_READ;
-
-		if (map != kernel_map) {
-			vm_offset_t pa;
-			vm_offset_t v = (vm_offset_t) vtopte(va);
-			vm_page_t ptepg;
-
-			/*
-			 * Keep swapout from messing with us during this
-			 *	critical time.
-			 */
-			++p->p_lock;
-
-			/*
-			 * Grow the stack if necessary
-			 */
-			if ((caddr_t)va > vm->vm_maxsaddr
-			    && (caddr_t)va < (caddr_t)USRSTACK) {
-				if (!grow(p, va)) {
-					rv = KERN_FAILURE;
-					--p->p_lock;
-					goto nogo;
-				}
-			}
-
-			/*
-			 * Check if page table is mapped, if not,
-			 *	fault it first
-			 */
-
-			/* Fault the pte only if needed: */
-			*(volatile char *)v += 0;	
-
-			ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
-			vm_page_hold(ptepg);
-
-			/* Fault in the user page: */
-			rv = vm_fault(map, va, ftype, FALSE);
-
-			vm_page_unhold(ptepg);
-
-			/*
-			 * page table pages don't need to be kept if they
-			 * are not held
-			 */
-			if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
-				pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
-					VM_PROT_NONE);
-				vm_page_free(ptepg);
-			}
-
-			--p->p_lock;
-		} else {
-			/*
-			 * Since we know that kernel virtual address addresses
-			 * always have pte pages mapped, we just have to fault
-			 * the page.
-			 */
-			rv = vm_fault(map, va, ftype, FALSE);
-		}
-
-		if (rv == KERN_SUCCESS) {
-			if (type == T_PAGEFLT)
-				return;
-			goto out;
-		}
-nogo:
-		if (type == T_PAGEFLT) {
-			if (curpcb->pcb_onfault)
-				goto copyfault;
-
-			goto we_re_toast;
-		}
-		i = (rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV;
-
-		/* kludge to pass faulting virtual address to sendsig */
-		ucode = type &~ T_USER;
-		frame.tf_err = eva;
-
-		break;
-	    }
-
-#if NDDB == 0
-	case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
-		frame.tf_eflags &= ~PSL_T;
-
-			/* Q: how do we turn it on again? */
-		return;
-#endif
-	
-	case T_BPTFLT|T_USER:		/* bpt instruction fault */
-	case T_TRCTRAP|T_USER:		/* trace trap */
-		frame.tf_eflags &= ~PSL_T;
-		i = SIGTRAP;
-		break;
-
-#if NISA > 0
-	case T_NMI:
-	case T_NMI|T_USER:
-#if NDDB > 0
-		/* NMI can be hooked up to a pushbutton for debugging */
-		printf ("NMI ... going to debugger\n");
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		/* machine/parity/power fail/"kitchen sink" faults */
-		if (isa_nmi(code) == 0) return;
-		/* FALL THROUGH */
-#endif
-	default:
-	we_re_toast:
-
-		fault_type = type & ~T_USER;
-#if NDDB > 0
-		if ((fault_type == T_BPTFLT) || (fault_type == T_TRCTRAP)) {
-			if (kdb_trap (type, 0, &frame))
-				return;
-		}
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			printf("\n\nFatal trap %d: %s while in %s mode\n",
-				fault_type, trap_msg[fault_type],
-				ISPL(frame.tf_cs) == SEL_UPL ? "user" : "kernel");
-		if (fault_type == T_PAGEFLT) {
-			printf("fault virtual address	= 0x%x\n", eva);
-			printf("fault code		= %s %s, %s\n",
-				code & PGEX_U ? "user" : "supervisor",
-				code & PGEX_W ? "write" : "read",
-				code & PGEX_P ? "protection violation" : "page not present");
-		}
-		printf("instruction pointer	= 0x%x\n", frame.tf_eip);
-		printf("processor eflags	= ");
-		if (frame.tf_eflags & EFL_TF)
-			printf("trace/trap, ");
-		if (frame.tf_eflags & EFL_IF)
-			printf("interrupt enabled, ");
-		if (frame.tf_eflags & EFL_NT)
-			printf("nested task, ");
-		if (frame.tf_eflags & EFL_RF)
-			printf("resume, ");
-		if (frame.tf_eflags & EFL_VM)
-			printf("vm86, ");
-		printf("IOPL = %d\n", (frame.tf_eflags & EFL_IOPL) >> 12);
-		printf("current process		= ");
-		if (curproc) {
-			printf("%d (%s)\n",
-			    curproc->p_pid, curproc->p_comm ?
-			    curproc->p_comm : "");
-		} else {
-			printf("Idle\n");
-		}
-		printf("interrupt mask		= ");
-		if ((cpl & net_imask) == net_imask)
-			printf("net ");
-		if ((cpl & tty_imask) == tty_imask)
-			printf("tty ");
-		if ((cpl & bio_imask) == bio_imask)
-			printf("bio ");
-		if (cpl == 0)
-			printf("none");
-		printf("\n");
-
-#ifdef KDB
-		if (kdb_trap(&psl))
-			return;
-#endif
-#if NDDB > 0
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			panic(trap_msg[fault_type]);
-		else
-			panic("unknown/reserved trap");
-
-		/* NOTREACHED */
-	}
-
-	trapsignal(p, i, ucode);
-	if ((type & T_USER) == 0)
-		return;
-
-#ifdef DIAGNOSTIC
-	fault_type = type & ~T_USER;
-	if (fault_type <= MAX_TRAP_MSG) {
-		uprintf("fatal process exception: %s", 
-			trap_msg[fault_type]);
-		if ((fault_type == T_PAGEFLT) || (fault_type == T_PROTFLT))
-			uprintf(", fault VA = 0x%x", eva);
-		uprintf("\n");
-	}
-#endif
-
-out:
-	while (i = CURSIG(p))
-		postsig(i);
+	while (sig = CURSIG(p))
+		postsig(sig);
 	p->p_priority = p->p_usrpri;
 	if (want_resched) {
-		int s;
 		/*
 		 * Since we are curproc, clock will normally just change
 		 * our priority without moving us from one queue to another
@@ -495,25 +135,390 @@ out:
 		p->p_stats->p_ru.ru_nivcsw++;
 		mi_switch();
 		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
+		while (sig = CURSIG(p))
+			postsig(sig);
 	}
 	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
+		u_quad_t ticks = p->p_sticks - oticks;
 
 		if (ticks) {
 #ifdef PROFTIMER
 			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
+			addupc(frame->tf_eip, &p->p_stats->p_prof,
 			    ticks * profscale);
 #else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
+			addupc(frame->tf_eip, &p->p_stats->p_prof, ticks);
 #endif
 		}
 	}
 	curpriority = p->p_priority;
 }
 
+/*
+ * trap(frame):
+ *	Exception, fault, and trap interface to the FreeBSD kernel.
+ * This common code is called from assembly language IDT gate entry
+ * routines that prepare a suitable stack frame, and restore this
+ * frame after the exception has been processed.
+ */
+
+/*ARGSUSED*/
+void
+trap(frame)
+	struct trapframe frame;
+{
+	struct proc *p = curproc;
+	u_quad_t sticks = 0;
+	int i = 0, ucode = 0, type, code, eva, fault_type;
+
+	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
+	type = frame.tf_trapno;
+	code = frame.tf_err;
+	
+	if (ISPL(frame.tf_cs) == SEL_UPL) {
+		/* user trap */
+
+		sticks = p->p_sticks;
+		p->p_md.md_regs = (int *)&frame;
+
+		switch (type) {
+		case T_RESADFLT:	/* reserved addressing fault */
+		case T_PRIVINFLT:	/* privileged instruction fault */
+		case T_RESOPFLT:	/* reserved operand fault */
+			ucode = type;
+			i = SIGILL;
+			break;
+
+		case T_BPTFLT:		/* bpt instruction fault */
+		case T_TRCTRAP:		/* trace trap */
+			frame.tf_eflags &= ~PSL_T;
+			i = SIGTRAP;
+			break;
+
+		case T_ARITHTRAP:	/* arithmetic trap */
+			ucode = code;
+			i = SIGFPE;
+			break;
+
+		case T_ASTFLT:		/* Allow process switch */
+			astoff();
+			cnt.v_soft++;
+			if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
+				addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
+				p->p_flag &= ~P_OWEUPC;
+			}
+			goto out;
+
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+		case T_STKFLT:		/* stack fault */
+			ucode = code + BUS_SEGM_FAULT ;
+			i = SIGBUS;
+			break;
+
+		case T_PAGEFLT:		/* page fault */
+			i = trap_pfault(&frame, TRUE);
+			if (i == 0)
+				goto out;
+
+			ucode = T_PAGEFLT;
+			break;
+
+		case T_DIVIDE:		/* integer divide fault */
+			ucode = FPE_INTDIV_TRAP;
+			i = SIGFPE;
+			break;
+
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
+
+		case T_OFLOW:		/* integer overflow fault */
+			ucode = FPE_INTOVF_TRAP;
+			i = SIGFPE;
+			break;
+
+		case T_BOUND:		/* bounds check fault */
+			ucode = FPE_SUBRNG_TRAP;
+			i = SIGFPE;
+			break;
+
+		case T_DNA:
+#if NNPX > 0
+			/* if a transparent fault (due to context switch "late") */
+			if (npxdna())
+				return;
+#endif	/* NNPX > 0 */
+
+#if defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
+			i = math_emulate(&frame);
+			if (i == 0) return;
+#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			panic("trap: math emulation necessary!");
+#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			ucode = FPE_FPU_NP_TRAP;
+			break;
+
+		case T_FPOPFLT:		/* FPU operand fetch fault */
+			ucode = T_FPOPFLT;
+			i = SIGILL;
+			break;
+
+		default:
+			trap_fatal(&frame);
+		}
+	} else {
+		/* kernel trap */
+
+		switch (type) {
+		case T_PAGEFLT:			/* page fault */
+			(void) trap_pfault(&frame, FALSE);
+			return;
+
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+			if (curpcb && curpcb->pcb_onfault) {
+				frame.tf_eip = (int)curpcb->pcb_onfault;
+				return;
+			}
+			break;
+
+#if NDDB > 0
+		case T_BPTFLT:
+		case T_TRCTRAP:
+			if (kdb_trap (type, 0, &frame))
+				return;
+			break;
+#else
+		case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
+			/* Q: how do we turn it on again? */
+			frame.tf_eflags &= ~PSL_T;
+			return;
+#endif
+	
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
+		}
+
+		trap_fatal(&frame);
+	}
+
+	trapsignal(p, i, ucode);
+
+#ifdef DIAGNOSTIC
+	eva = rcr2();
+	if (type <= MAX_TRAP_MSG) {
+		uprintf("fatal process exception: %s", 
+			trap_msg[type]);
+		if ((type == T_PAGEFLT) || (type == T_PROTFLT))
+			uprintf(", fault VA = 0x%x", eva);
+		uprintf("\n");
+	}
+#endif
+
+out:
+	userret(p, &frame, sticks);
+}
+
+int
+trap_pfault(frame, usermode)
+	struct trapframe *frame;
+	int usermode;
+{
+	vm_offset_t va;
+	struct vmspace *vm;
+	vm_map_t map = 0;
+	int rv = 0, oldflags;
+	vm_prot_t ftype;
+	extern vm_map_t kernel_map;
+	int eva;
+	struct proc *p = curproc;
+
+	eva = rcr2();
+	va = trunc_page((vm_offset_t)eva);
+
+	/*
+	 * Don't allow user-mode faults in kernel address space
+	 */
+	if (usermode && (va >= KERNBASE)) {
+        	goto nogo;
+	}
+
+	if ((p == 0) || (va >= KERNBASE)) {
+		vm = 0;
+		map = kernel_map;
+	} else {
+		vm = p->p_vmspace;
+		map = &vm->vm_map;
+	}
+
+	if (frame->tf_err & PGEX_W)
+		ftype = VM_PROT_READ | VM_PROT_WRITE;
+	else
+		ftype = VM_PROT_READ;
+
+	if (map != kernel_map) {
+		vm_offset_t pa;
+		vm_offset_t v = (vm_offset_t) vtopte(va);
+		vm_page_t ptepg;
+
+		/*
+		 * Keep swapout from messing with us during this
+		 *	critical time.
+		 */
+		++p->p_lock;
+
+		/*
+		 * Grow the stack if necessary
+		 */
+		if ((caddr_t)va > vm->vm_maxsaddr
+		    && (caddr_t)va < (caddr_t)USRSTACK) {
+			if (!grow(p, va)) {
+				rv = KERN_FAILURE;
+				--p->p_lock;
+				goto nogo;
+			}
+		}
+
+		/*
+		 * Check if page table is mapped, if not,
+		 *	fault it first
+		 */
+
+		/* Fault the pte only if needed: */
+		*(volatile char *)v += 0;	
+
+		ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
+		vm_page_hold(ptepg);
+
+		/* Fault in the user page: */
+		rv = vm_fault(map, va, ftype, FALSE);
+
+		vm_page_unhold(ptepg);
+
+		/*
+		 * page table pages don't need to be kept if they
+		 * are not held
+		 */
+		if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
+			pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
+				VM_PROT_NONE);
+			vm_page_free(ptepg);
+		}
+
+		--p->p_lock;
+	} else {
+		/*
+		 * Since we know that kernel virtual address addresses
+		 * always have pte pages mapped, we just have to fault
+		 * the page.
+		 */
+		rv = vm_fault(map, va, ftype, FALSE);
+	}
+
+	if (rv == KERN_SUCCESS)
+		return (0);
+nogo:
+	if (!usermode) {
+		if (curpcb->pcb_onfault) {
+			frame->tf_eip = (int)curpcb->pcb_onfault;
+			return (0);
+		}
+		trap_fatal(frame);
+	}
+
+	/* kludge to pass faulting virtual address to sendsig */
+	frame->tf_err = eva;
+
+	return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
+}
+
+void
+trap_fatal(frame)
+	struct trapframe *frame;
+{
+	int code, type, eva;
+
+	code = frame->tf_err;
+	type = frame->tf_trapno;
+	eva = rcr2();
+
+	if (type <= MAX_TRAP_MSG)
+		printf("\n\nFatal trap %d: %s while in %s mode\n",
+			type, trap_msg[type],
+			ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
+	if (type == T_PAGEFLT) {
+		printf("fault virtual address	= 0x%x\n", eva);
+		printf("fault code		= %s %s, %s\n",
+			code & PGEX_U ? "user" : "supervisor",
+			code & PGEX_W ? "write" : "read",
+			code & PGEX_P ? "protection violation" : "page not present");
+	}
+	printf("instruction pointer	= 0x%x\n", frame->tf_eip);
+	printf("processor eflags	= ");
+	if (frame->tf_eflags & EFL_TF)
+		printf("trace/trap, ");
+	if (frame->tf_eflags & EFL_IF)
+		printf("interrupt enabled, ");
+	if (frame->tf_eflags & EFL_NT)
+		printf("nested task, ");
+	if (frame->tf_eflags & EFL_RF)
+		printf("resume, ");
+	if (frame->tf_eflags & EFL_VM)
+		printf("vm86, ");
+	printf("IOPL = %d\n", (frame->tf_eflags & EFL_IOPL) >> 12);
+	printf("current process		= ");
+	if (curproc) {
+		printf("%d (%s)\n",
+		    curproc->p_pid, curproc->p_comm ?
+		    curproc->p_comm : "");
+	} else {
+		printf("Idle\n");
+	}
+	printf("interrupt mask		= ");
+	if ((cpl & net_imask) == net_imask)
+		printf("net ");
+	if ((cpl & tty_imask) == tty_imask)
+		printf("tty ");
+	if ((cpl & bio_imask) == bio_imask)
+		printf("bio ");
+	if (cpl == 0)
+		printf("none");
+	printf("\n");
+
+#ifdef KDB
+	if (kdb_trap(&psl))
+		return;
+#endif
+#if NDDB > 0
+	if (kdb_trap (type, 0, frame))
+		return;
+#endif
+	if (type <= MAX_TRAP_MSG)
+		panic(trap_msg[type]);
+	else
+		panic("unknown/reserved trap");
+}
+
 /*
  * Compensate for 386 brain damage (missing URKR).
  * This is a little simpler than the pagefault handler in trap() because
@@ -586,21 +591,17 @@ int trapwrite(addr)
 /*ARGSUSED*/
 void
 syscall(frame)
-	volatile struct trapframe frame;
+	struct trapframe frame;
 {
-	register int *locr0 = ((int *)&frame);
-	register caddr_t params;
-	register int i;
-	register struct sysent *callp;
-	register struct proc *p = curproc;
+	caddr_t params;
+	int i;
+	struct sysent *callp;
+	struct proc *p = curproc;
 	u_quad_t sticks;
 	int error, opc;
 	int args[8], rval[2];
 	u_int code;
 
-#ifdef lint
-	r0 = 0; r0 = r0; r1 = 0; r1 = r1;
-#endif
 	sticks = p->p_sticks;
 	if (ISPL(frame.tf_cs) != SEL_UPL)
 		panic("syscall");
@@ -638,13 +639,11 @@ syscall(frame)
 
 	if ((i = callp->sy_narg * sizeof (int)) &&
 	    (error = copyin(params, (caddr_t)args, (u_int)i))) {
-		frame.tf_eax = error;
-		frame.tf_eflags |= PSL_C;	/* carry bit */
 #ifdef KTRACE
 		if (KTRPOINT(p, KTR_SYSCALL))
 			ktrsyscall(p->p_tracep, code, callp->sy_narg, args);
 #endif
-		goto done;
+		goto bad;
 	}
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSCALL))
@@ -652,64 +651,38 @@ syscall(frame)
 #endif
 	rval[0] = 0;
 	rval[1] = frame.tf_edx;
-/*pg("%d. s %d\n", p->p_pid, code);*/
-	error = (*callp->sy_call)(p, args, rval);
-	if (error == ERESTART)
-		frame.tf_eip = opc;
-	else if (error != EJUSTRETURN) {
-		if (error) {
-/*pg("error %d", error);*/
-			frame.tf_eax = error;
-			frame.tf_eflags |= PSL_C;	/* carry bit */
-		} else {
-			frame.tf_eax = rval[0];
-			frame.tf_edx = rval[1];
-			frame.tf_eflags &= ~PSL_C;	/* carry bit */
-		}
-	}
-	/* else if (error == EJUSTRETURN) */
-		/* nothing to do */
-done:
-	/*
-	 * Reinitialize proc pointer `p' as it may be different
-	 * if this is a child returning from fork syscall.
-	 */
-	p = curproc;
-	while (i = CURSIG(p))
-		postsig(i);
-	p->p_priority = p->p_usrpri;
-	if (want_resched) {
-		int s;
-		/*
-		 * Since we are curproc, clock will normally just change
-		 * our priority without moving us from one queue to another
-		 * (since the running process is not on a queue.)
-		 * If that happened after we setrunqueue ourselves but before we
-		 * swtch()'ed, we might not be on the queue indicated by
-		 * our priority.
-		 */
-		s = splclock();
-		setrunqueue(p);
-		p->p_stats->p_ru.ru_nivcsw++;
-		mi_switch();
-		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
-	}
-	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
 
-		if (ticks) {
-#ifdef PROFTIMER
-			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
-			    ticks * profscale);
-#else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
-#endif
-		}
+	error = (*callp->sy_call)(p, args, rval);
+
+	switch (error) {
+
+	case 0:
+		/*
+		 * Reinitialize proc pointer `p' as it may be different
+		 * if this is a child returning from fork syscall.
+		 */
+		p = curproc;
+		frame.tf_eax = rval[0];
+		frame.tf_edx = rval[1];
+		frame.tf_eflags &= ~PSL_C;	/* carry bit */
+		break;
+
+	case ERESTART:
+		frame.tf_eip = opc;
+		break;
+
+	case EJUSTRETURN:
+		break;
+
+	default:
+	bad:
+		frame.tf_eax = error;
+		frame.tf_eflags |= PSL_C;	/* carry bit */
+		break;
 	}
-	curpriority = p->p_priority;
+
+	userret(p, &frame, sticks);
+
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSRET))
 		ktrsysret(p->p_tracep, code, error, rval[0]);