trap.c:

Vastly improved trap.c from me. This rewritten version has a variety of
features, amoung them: higher performance and much higher code quality.

support.s, cpufunc.h:
No longer use gs override to enforce range limits - compare directly
against VM_MAXUSER_ADDRESS instead. The old way caused problems in
preserving the gs selector...and this method is just as fast or faster.

1 files changed, 383 insertions, 410 deletions

diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c
index 382416f..406310b 100644
--- a/sys/kern/subr_trap.c
+++ b/sys/kern/subr_trap.c
@@ -1,6 +1,7 @@
 /*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
+ * Copyright (C) 1994, David Greenman
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
  *
  * This code is derived from software contributed to Berkeley by
  * the University of Utah, and William Jolitz.
@@ -34,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)trap.c	7.4 (Berkeley) 5/13/91
- *	$Id: trap.c,v 1.22 1994/04/07 10:51:00 davidg Exp $
+ *	$Id: trap.c,v 1.24 1994/05/25 08:55:18 rgrimes Exp $
  */
 
 /*
@@ -69,21 +70,8 @@
 #include "npx.h"
 #include "ddb.h"
 
-#ifdef	__GNUC__
-
-/*
- * The "r" contraint could be "rm" except for fatal bugs in gas.  As usual,
- * we omit the size from the mov instruction to avoid nonfatal bugs in gas.
- */
-#define	read_gs()	({ u_short gs; __asm("mov %%gs,%0" : "=r" (gs)); gs; })
-#define	write_gs(newgs)	__asm("mov %0,%%gs" : : "r" ((u_short) newgs))
-
-#else	/* not __GNUC__ */
-
-u_short	read_gs		__P((void));
-void	write_gs	__P((/* promoted u_short */ int gs));
-
-#endif	/* __GNUC__ */
+int	trap_pfault	__P((struct trapframe *, int));
+void	trap_fatal	__P((struct trapframe *));
 
 extern int grow(struct proc *,u_int);
 
@@ -101,7 +89,7 @@ char *trap_msg[] = {
 	"arithmetic trap",			/*  6 T_ARITHTRAP */
 	"system forced exception",		/*  7 T_ASTFLT */
 	"segmentation (limit) fault",		/*  8 T_SEGFLT */
-	"protection fault",			/*  9 T_PROTFLT */
+	"general protection fault",		/*  9 T_PROTFLT */
 	"trace trap",				/* 10 T_TRCTRAP */
 	"",					/* 11 unused */
 	"page fault",				/* 12 T_PAGEFLT */
@@ -122,15 +110,56 @@ char *trap_msg[] = {
 	"stack fault",				/* 27 T_STKFLT */
 };
 
-#define pde_v(v) (PTD[((v)>>PD_SHIFT)&1023].pd_v)
+static inline void
+userret(p, frame, oticks)
+	struct proc *p;
+	struct trapframe *frame;
+	u_quad_t oticks;
+{
+	int sig, s;
+
+	while (sig = CURSIG(p))
+		postsig(sig);
+	p->p_priority = p->p_usrpri;
+	if (want_resched) {
+		/*
+		 * Since we are curproc, clock will normally just change
+		 * our priority without moving us from one queue to another
+		 * (since the running process is not on a queue.)
+		 * If that happened after we setrunqueue ourselves but before we
+		 * mi_switch()'ed, we might not be on the queue indicated by
+		 * our priority.
+		 */
+		s = splclock();
+		setrunqueue(p);
+		p->p_stats->p_ru.ru_nivcsw++;
+		mi_switch();
+		splx(s);
+		while (sig = CURSIG(p))
+			postsig(sig);
+	}
+	if (p->p_stats->p_prof.pr_scale) {
+		u_quad_t ticks = p->p_sticks - oticks;
+
+		if (ticks) {
+#ifdef PROFTIMER
+			extern int profscale;
+			addupc(frame->tf_eip, &p->p_stats->p_prof,
+			    ticks * profscale);
+#else
+			addupc(frame->tf_eip, &p->p_stats->p_prof, ticks);
+#endif
+		}
+	}
+	curpriority = p->p_priority;
+}
 
 /*
  * trap(frame):
- *	Exception, fault, and trap interface to BSD kernel. This
- * common code is called from assembly language IDT gate entry
+ *	Exception, fault, and trap interface to the FreeBSD kernel.
+ * This common code is called from assembly language IDT gate entry
  * routines that prepare a suitable stack frame, and restore this
- * frame after the exception has been processed. Note that the
- * effect is as if the arguments were passed call by reference.
+ * frame after the exception has been processed.
  */
 
 /*ARGSUSED*/
@@ -138,380 +167,356 @@ void
 trap(frame)
 	struct trapframe frame;
 {
-	register int i;
-	register struct proc *p = curproc;
+	struct proc *p = curproc;
 	u_quad_t sticks = 0;
-	int ucode, type, code, eva, fault_type;
+	int i = 0, ucode = 0, type, code, eva, fault_type;
 
 	frame.tf_eflags &= ~PSL_NT;	/* clear nested trap XXX */
 	type = frame.tf_trapno;
-#if NDDB > 0
-	if (curpcb && curpcb->pcb_onfault) {
-		if (frame.tf_trapno == T_BPTFLT
-		    || frame.tf_trapno == T_TRCTRAP)
-			if (kdb_trap (type, 0, &frame))
-				return;
-	}
-#endif
+	code = frame.tf_err;
 	
-	if (curpcb == 0 || curproc == 0)
-		goto skiptoswitch;
-	if (curpcb->pcb_onfault && frame.tf_trapno != T_PAGEFLT) {
-		extern int _udatasel;
-
-		if (read_gs() != (u_short) _udatasel)
-			/*
-			 * Some user has corrupted %gs but we depend on it in
-			 * copyout() etc.  Fix it up and retry.
-			 *
-			 * (We don't preserve %fs or %gs, so users can change
-			 * them to either _ucodesel, _udatasel or a not-present
-			 * selector, possibly ORed with 0 to 3, making them
-			 * volatile for other users.  Not preserving them saves
-			 * time and doesn't lose functionality or open security
-			 * holes.)
-			 */
-			write_gs(_udatasel);
-		else
-copyfault:
-			frame.tf_eip = (int)curpcb->pcb_onfault;
-		return;
-	}
-
 	if (ISPL(frame.tf_cs) == SEL_UPL) {
-		type |= T_USER;
-		p->p_md.md_regs = (int *)&frame;
-		sticks = p->p_sticks;
-	}
-
-skiptoswitch:
-	ucode=0;
-	eva = rcr2();
-	code = frame.tf_err;
+		/* user trap */
 
-	if ((type & ~T_USER) == T_PAGEFLT)
-		goto pfault;
+		sticks = p->p_sticks;
+		p->p_md.md_regs = (int *)&frame;
 
-	switch (type) {
-	case T_SEGNPFLT|T_USER:
-	case T_STKFLT|T_USER:
-	case T_PROTFLT|T_USER:		/* protection fault */
-		ucode = code + BUS_SEGM_FAULT ;
-		i = SIGBUS;
-		break;
+		switch (type) {
+		case T_RESADFLT:	/* reserved addressing fault */
+		case T_PRIVINFLT:	/* privileged instruction fault */
+		case T_RESOPFLT:	/* reserved operand fault */
+			ucode = type;
+			i = SIGILL;
+			break;
+
+		case T_BPTFLT:		/* bpt instruction fault */
+		case T_TRCTRAP:		/* trace trap */
+			frame.tf_eflags &= ~PSL_T;
+			i = SIGTRAP;
+			break;
+
+		case T_ARITHTRAP:	/* arithmetic trap */
+			ucode = code;
+			i = SIGFPE;
+			break;
+
+		case T_ASTFLT:		/* Allow process switch */
+			astoff();
+			cnt.v_soft++;
+			if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
+				addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
+				p->p_flag &= ~P_OWEUPC;
+			}
+			goto out;
 
-	case T_PRIVINFLT|T_USER:	/* privileged instruction fault */
-	case T_RESADFLT|T_USER:		/* reserved addressing fault */
-	case T_RESOPFLT|T_USER:		/* reserved operand fault */
-	case T_FPOPFLT|T_USER:		/* coprocessor operand fault */
-		ucode = type &~ T_USER;
-		i = SIGILL;
-		break;
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+		case T_STKFLT:		/* stack fault */
+			ucode = code + BUS_SEGM_FAULT ;
+			i = SIGBUS;
+			break;
 
-	case T_ASTFLT|T_USER:		/* Allow process switch */
-		astoff();
-		cnt.v_soft++;
-		if ((p->p_flag & P_OWEUPC) && p->p_stats->p_prof.pr_scale) {
-			addupc(frame.tf_eip, &p->p_stats->p_prof, 1);
-			p->p_flag &= ~P_OWEUPC;
-		}
-		goto out;
+		case T_PAGEFLT:		/* page fault */
+			i = trap_pfault(&frame, TRUE);
+			if (i == 0)
+				goto out;
 
-	case T_DNA|T_USER:
-#if NNPX > 0
-		/* if a transparent fault (due to context switch "late") */
-		if (npxdna()) return;
-#endif	/* NNPX > 0 */
-#if   defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
-		i = math_emulate(&frame);
-		if (i == 0) return;
-#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		panic("trap: math emulation necessary!");
-#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
-		ucode = FPE_FPU_NP_TRAP;
-		break;
+			ucode = T_PAGEFLT;
+			break;
 
-	case T_BOUND|T_USER:
-		ucode = FPE_SUBRNG_TRAP;
-		i = SIGFPE;
-		break;
+		case T_DIVIDE:		/* integer divide fault */
+			ucode = FPE_INTDIV_TRAP;
+			i = SIGFPE;
+			break;
 
-	case T_OFLOW|T_USER:
-		ucode = FPE_INTOVF_TRAP;
-		i = SIGFPE;
-		break;
+#if NISA > 0
+		case T_NMI:
+#if NDDB > 0
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
+			if (kdb_trap (type, 0, &frame))
+				return;
+#endif
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
+#endif
 
-	case T_DIVIDE|T_USER:
-		ucode = FPE_INTDIV_TRAP;
-		i = SIGFPE;
-		break;
+		case T_OFLOW:		/* integer overflow fault */
+			ucode = FPE_INTOVF_TRAP;
+			i = SIGFPE;
+			break;
 
-	case T_ARITHTRAP|T_USER:
-		ucode = code;
-		i = SIGFPE;
-		break;
+		case T_BOUND:		/* bounds check fault */
+			ucode = FPE_SUBRNG_TRAP;
+			i = SIGFPE;
+			break;
 
-	pfault:
-	case T_PAGEFLT:			/* allow page faults in kernel mode */
-	case T_PAGEFLT|T_USER:		/* page fault */
-	    {
-		vm_offset_t va;
-		struct vmspace *vm;
-		vm_map_t map = 0;
-		int rv = 0, oldflags;
-		vm_prot_t ftype;
-		unsigned v;
-		extern vm_map_t kernel_map;
+		case T_DNA:
+#if NNPX > 0
+			/* if a transparent fault (due to context switch "late") */
+			if (npxdna())
+				return;
+#endif	/* NNPX > 0 */
 
-		va = trunc_page((vm_offset_t)eva);
+#if defined(MATH_EMULATE) || defined(GPL_MATH_EMULATE) 
+			i = math_emulate(&frame);
+			if (i == 0) return;
+#else	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			panic("trap: math emulation necessary!");
+#endif	/* MATH_EMULATE || GPL_MATH_EMULATE */
+			ucode = FPE_FPU_NP_TRAP;
+			break;
 
-		/*
-		 * Don't allow user-mode faults in kernel address space
-		 */
-		if ((type == (T_PAGEFLT|T_USER)) && (va >= KERNBASE)) {
-			goto nogo;
-		}
+		case T_FPOPFLT:		/* FPU operand fetch fault */
+			ucode = T_FPOPFLT;
+			i = SIGILL;
+			break;
 
-		if ((p == 0) || (type == T_PAGEFLT && va >= KERNBASE)) {
-			vm = 0;
-			map = kernel_map;
-		} else {
-			vm = p->p_vmspace;
-			map = &vm->vm_map;
+		default:
+			trap_fatal(&frame);
 		}
+	} else {
+		/* kernel trap */
 
-		if (code & PGEX_W)
-			ftype = VM_PROT_READ | VM_PROT_WRITE;
-		else
-			ftype = VM_PROT_READ;
-
-		if (map != kernel_map) {
-			vm_offset_t pa;
-			vm_offset_t v = (vm_offset_t) vtopte(va);
-			vm_page_t ptepg;
-
-			/*
-			 * Keep swapout from messing with us during this
-			 *	critical time.
-			 */
-			++p->p_lock;
-
-			/*
-			 * Grow the stack if necessary
-			 */
-			if ((caddr_t)va > vm->vm_maxsaddr
-			    && (caddr_t)va < (caddr_t)USRSTACK) {
-				if (!grow(p, va)) {
-					rv = KERN_FAILURE;
-					--p->p_lock;
-					goto nogo;
-				}
-			}
-
-			/*
-			 * Check if page table is mapped, if not,
-			 *	fault it first
-			 */
-
-			/* Fault the pte only if needed: */
-			*(volatile char *)v += 0;	
-
-			ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
-			vm_page_hold(ptepg);
-
-			/* Fault in the user page: */
-			rv = vm_fault(map, va, ftype, FALSE);
-
-			vm_page_unhold(ptepg);
+		switch (type) {
+		case T_PAGEFLT:			/* page fault */
+			(void) trap_pfault(&frame, FALSE);
+			return;
 
-			/*
-			 * page table pages don't need to be kept if they
-			 * are not held
-			 */
-			if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
-				pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
-					VM_PROT_NONE);
-				vm_page_free(ptepg);
+		case T_PROTFLT:		/* general protection fault */
+		case T_SEGNPFLT:	/* segment not present fault */
+			if (curpcb && curpcb->pcb_onfault) {
+				frame.tf_eip = (int)curpcb->pcb_onfault;
+				return;
 			}
+			break;
 
-			--p->p_lock;
-		} else {
-			/*
-			 * Since we know that kernel virtual address addresses
-			 * always have pte pages mapped, we just have to fault
-			 * the page.
-			 */
-			rv = vm_fault(map, va, ftype, FALSE);
-		}
-
-		if (rv == KERN_SUCCESS) {
-			if (type == T_PAGEFLT)
+#if NDDB > 0
+		case T_BPTFLT:
+		case T_TRCTRAP:
+			if (kdb_trap (type, 0, &frame))
 				return;
-			goto out;
-		}
-nogo:
-		if (type == T_PAGEFLT) {
-			if (curpcb->pcb_onfault)
-				goto copyfault;
-
-			goto we_re_toast;
-		}
-		i = (rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV;
-
-		/* kludge to pass faulting virtual address to sendsig */
-		ucode = type &~ T_USER;
-		frame.tf_err = eva;
-
-		break;
-	    }
-
-#if NDDB == 0
-	case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
-		frame.tf_eflags &= ~PSL_T;
-
+			break;
+#else
+		case T_TRCTRAP:	 /* trace trap -- someone single stepping lcall's */
 			/* Q: how do we turn it on again? */
-		return;
+			frame.tf_eflags &= ~PSL_T;
+			return;
 #endif
 	
-	case T_BPTFLT|T_USER:		/* bpt instruction fault */
-	case T_TRCTRAP|T_USER:		/* trace trap */
-		frame.tf_eflags &= ~PSL_T;
-		i = SIGTRAP;
-		break;
-
 #if NISA > 0
-	case T_NMI:
-	case T_NMI|T_USER:
+		case T_NMI:
 #if NDDB > 0
-		/* NMI can be hooked up to a pushbutton for debugging */
-		printf ("NMI ... going to debugger\n");
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		/* machine/parity/power fail/"kitchen sink" faults */
-		if (isa_nmi(code) == 0) return;
-		/* FALL THROUGH */
-#endif
-	default:
-	we_re_toast:
-
-		fault_type = type & ~T_USER;
-#if NDDB > 0
-		if ((fault_type == T_BPTFLT) || (fault_type == T_TRCTRAP)) {
+			/* NMI can be hooked up to a pushbutton for debugging */
+			printf ("NMI ... going to debugger\n");
 			if (kdb_trap (type, 0, &frame))
 				return;
-		}
 #endif
-		if (fault_type <= MAX_TRAP_MSG)
-			printf("\n\nFatal trap %d: %s while in %s mode\n",
-				fault_type, trap_msg[fault_type],
-				ISPL(frame.tf_cs) == SEL_UPL ? "user" : "kernel");
-		if (fault_type == T_PAGEFLT) {
-			printf("fault virtual address	= 0x%x\n", eva);
-			printf("fault code		= %s %s, %s\n",
-				code & PGEX_U ? "user" : "supervisor",
-				code & PGEX_W ? "write" : "read",
-				code & PGEX_P ? "protection violation" : "page not present");
-		}
-		printf("instruction pointer	= 0x%x\n", frame.tf_eip);
-		printf("processor eflags	= ");
-		if (frame.tf_eflags & EFL_TF)
-			printf("trace/trap, ");
-		if (frame.tf_eflags & EFL_IF)
-			printf("interrupt enabled, ");
-		if (frame.tf_eflags & EFL_NT)
-			printf("nested task, ");
-		if (frame.tf_eflags & EFL_RF)
-			printf("resume, ");
-		if (frame.tf_eflags & EFL_VM)
-			printf("vm86, ");
-		printf("IOPL = %d\n", (frame.tf_eflags & EFL_IOPL) >> 12);
-		printf("current process		= ");
-		if (curproc) {
-			printf("%d (%s)\n",
-			    curproc->p_pid, curproc->p_comm ?
-			    curproc->p_comm : "");
-		} else {
-			printf("Idle\n");
-		}
-		printf("interrupt mask		= ");
-		if ((cpl & net_imask) == net_imask)
-			printf("net ");
-		if ((cpl & tty_imask) == tty_imask)
-			printf("tty ");
-		if ((cpl & bio_imask) == bio_imask)
-			printf("bio ");
-		if (cpl == 0)
-			printf("none");
-		printf("\n");
-
-#ifdef KDB
-		if (kdb_trap(&psl))
-			return;
+			/* machine/parity/power fail/"kitchen sink" faults */
+			if (isa_nmi(code) == 0) return;
+			/* FALL THROUGH */
 #endif
-#if NDDB > 0
-		if (kdb_trap (type, 0, &frame))
-			return;
-#endif
-		if (fault_type <= MAX_TRAP_MSG)
-			panic(trap_msg[fault_type]);
-		else
-			panic("unknown/reserved trap");
+		}
 
-		/* NOTREACHED */
+		trap_fatal(&frame);
 	}
 
 	trapsignal(p, i, ucode);
-	if ((type & T_USER) == 0)
-		return;
 
 #ifdef DIAGNOSTIC
-	fault_type = type & ~T_USER;
-	if (fault_type <= MAX_TRAP_MSG) {
+	eva = rcr2();
+	if (type <= MAX_TRAP_MSG) {
 		uprintf("fatal process exception: %s", 
-			trap_msg[fault_type]);
-		if ((fault_type == T_PAGEFLT) || (fault_type == T_PROTFLT))
+			trap_msg[type]);
+		if ((type == T_PAGEFLT) || (type == T_PROTFLT))
 			uprintf(", fault VA = 0x%x", eva);
 		uprintf("\n");
 	}
 #endif
 
 out:
-	while (i = CURSIG(p))
-		postsig(i);
-	p->p_priority = p->p_usrpri;
-	if (want_resched) {
-		int s;
+	userret(p, &frame, sticks);
+}
+
+int
+trap_pfault(frame, usermode)
+	struct trapframe *frame;
+	int usermode;
+{
+	vm_offset_t va;
+	struct vmspace *vm;
+	vm_map_t map = 0;
+	int rv = 0, oldflags;
+	vm_prot_t ftype;
+	extern vm_map_t kernel_map;
+	int eva;
+	struct proc *p = curproc;
+
+	eva = rcr2();
+	va = trunc_page((vm_offset_t)eva);
+
+	/*
+	 * Don't allow user-mode faults in kernel address space
+	 */
+	if (usermode && (va >= KERNBASE)) {
+        	goto nogo;
+	}
+
+	if ((p == 0) || (va >= KERNBASE)) {
+		vm = 0;
+		map = kernel_map;
+	} else {
+		vm = p->p_vmspace;
+		map = &vm->vm_map;
+	}
+
+	if (frame->tf_err & PGEX_W)
+		ftype = VM_PROT_READ | VM_PROT_WRITE;
+	else
+		ftype = VM_PROT_READ;
+
+	if (map != kernel_map) {
+		vm_offset_t pa;
+		vm_offset_t v = (vm_offset_t) vtopte(va);
+		vm_page_t ptepg;
+
 		/*
-		 * Since we are curproc, clock will normally just change
-		 * our priority without moving us from one queue to another
-		 * (since the running process is not on a queue.)
-		 * If that happened after we setrunqueue ourselves but before we
-		 * mi_switch()'ed, we might not be on the queue indicated by
-		 * our priority.
+		 * Keep swapout from messing with us during this
+		 *	critical time.
 		 */
-		s = splclock();
-		setrunqueue(p);
-		p->p_stats->p_ru.ru_nivcsw++;
-		mi_switch();
-		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
+		++p->p_lock;
+
+		/*
+		 * Grow the stack if necessary
+		 */
+		if ((caddr_t)va > vm->vm_maxsaddr
+		    && (caddr_t)va < (caddr_t)USRSTACK) {
+			if (!grow(p, va)) {
+				rv = KERN_FAILURE;
+				--p->p_lock;
+				goto nogo;
+			}
+		}
+
+		/*
+		 * Check if page table is mapped, if not,
+		 *	fault it first
+		 */
+
+		/* Fault the pte only if needed: */
+		*(volatile char *)v += 0;	
+
+		ptepg = (vm_page_t) pmap_pte_vm_page(vm_map_pmap(map), v);
+		vm_page_hold(ptepg);
+
+		/* Fault in the user page: */
+		rv = vm_fault(map, va, ftype, FALSE);
+
+		vm_page_unhold(ptepg);
+
+		/*
+		 * page table pages don't need to be kept if they
+		 * are not held
+		 */
+		if( ptepg->hold_count == 0 && ptepg->wire_count == 0) {
+			pmap_page_protect( VM_PAGE_TO_PHYS(ptepg),
+				VM_PROT_NONE);
+			vm_page_free(ptepg);
+		}
+
+		--p->p_lock;
+	} else {
+		/*
+		 * Since we know that kernel virtual address addresses
+		 * always have pte pages mapped, we just have to fault
+		 * the page.
+		 */
+		rv = vm_fault(map, va, ftype, FALSE);
 	}
-	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
 
-		if (ticks) {
-#ifdef PROFTIMER
-			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
-			    ticks * profscale);
-#else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
-#endif
+	if (rv == KERN_SUCCESS)
+		return (0);
+nogo:
+	if (!usermode) {
+		if (curpcb->pcb_onfault) {
+			frame->tf_eip = (int)curpcb->pcb_onfault;
+			return (0);
 		}
+		trap_fatal(frame);
 	}
-	curpriority = p->p_priority;
+
+	/* kludge to pass faulting virtual address to sendsig */
+	frame->tf_err = eva;
+
+	return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
+}
+
+void
+trap_fatal(frame)
+	struct trapframe *frame;
+{
+	int code, type, eva;
+
+	code = frame->tf_err;
+	type = frame->tf_trapno;
+	eva = rcr2();
+
+	if (type <= MAX_TRAP_MSG)
+		printf("\n\nFatal trap %d: %s while in %s mode\n",
+			type, trap_msg[type],
+			ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
+	if (type == T_PAGEFLT) {
+		printf("fault virtual address	= 0x%x\n", eva);
+		printf("fault code		= %s %s, %s\n",
+			code & PGEX_U ? "user" : "supervisor",
+			code & PGEX_W ? "write" : "read",
+			code & PGEX_P ? "protection violation" : "page not present");
+	}
+	printf("instruction pointer	= 0x%x\n", frame->tf_eip);
+	printf("processor eflags	= ");
+	if (frame->tf_eflags & EFL_TF)
+		printf("trace/trap, ");
+	if (frame->tf_eflags & EFL_IF)
+		printf("interrupt enabled, ");
+	if (frame->tf_eflags & EFL_NT)
+		printf("nested task, ");
+	if (frame->tf_eflags & EFL_RF)
+		printf("resume, ");
+	if (frame->tf_eflags & EFL_VM)
+		printf("vm86, ");
+	printf("IOPL = %d\n", (frame->tf_eflags & EFL_IOPL) >> 12);
+	printf("current process		= ");
+	if (curproc) {
+		printf("%d (%s)\n",
+		    curproc->p_pid, curproc->p_comm ?
+		    curproc->p_comm : "");
+	} else {
+		printf("Idle\n");
+	}
+	printf("interrupt mask		= ");
+	if ((cpl & net_imask) == net_imask)
+		printf("net ");
+	if ((cpl & tty_imask) == tty_imask)
+		printf("tty ");
+	if ((cpl & bio_imask) == bio_imask)
+		printf("bio ");
+	if (cpl == 0)
+		printf("none");
+	printf("\n");
+
+#ifdef KDB
+	if (kdb_trap(&psl))
+		return;
+#endif
+#if NDDB > 0
+	if (kdb_trap (type, 0, frame))
+		return;
+#endif
+	if (type <= MAX_TRAP_MSG)
+		panic(trap_msg[type]);
+	else
+		panic("unknown/reserved trap");
 }
 
 /*
@@ -586,21 +591,17 @@ int trapwrite(addr)
 /*ARGSUSED*/
 void
 syscall(frame)
-	volatile struct trapframe frame;
+	struct trapframe frame;
 {
-	register int *locr0 = ((int *)&frame);
-	register caddr_t params;
-	register int i;
-	register struct sysent *callp;
-	register struct proc *p = curproc;
+	caddr_t params;
+	int i;
+	struct sysent *callp;
+	struct proc *p = curproc;
 	u_quad_t sticks;
 	int error, opc;
 	int args[8], rval[2];
 	u_int code;
 
-#ifdef lint
-	r0 = 0; r0 = r0; r1 = 0; r1 = r1;
-#endif
 	sticks = p->p_sticks;
 	if (ISPL(frame.tf_cs) != SEL_UPL)
 		panic("syscall");
@@ -638,13 +639,11 @@ syscall(frame)
 
 	if ((i = callp->sy_narg * sizeof (int)) &&
 	    (error = copyin(params, (caddr_t)args, (u_int)i))) {
-		frame.tf_eax = error;
-		frame.tf_eflags |= PSL_C;	/* carry bit */
 #ifdef KTRACE
 		if (KTRPOINT(p, KTR_SYSCALL))
 			ktrsyscall(p->p_tracep, code, callp->sy_narg, args);
 #endif
-		goto done;
+		goto bad;
 	}
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSCALL))
@@ -652,64 +651,38 @@ syscall(frame)
 #endif
 	rval[0] = 0;
 	rval[1] = frame.tf_edx;
-/*pg("%d. s %d\n", p->p_pid, code);*/
+
 	error = (*callp->sy_call)(p, args, rval);
-	if (error == ERESTART)
-		frame.tf_eip = opc;
-	else if (error != EJUSTRETURN) {
-		if (error) {
-/*pg("error %d", error);*/
-			frame.tf_eax = error;
-			frame.tf_eflags |= PSL_C;	/* carry bit */
-		} else {
-			frame.tf_eax = rval[0];
-			frame.tf_edx = rval[1];
-			frame.tf_eflags &= ~PSL_C;	/* carry bit */
-		}
-	}
-	/* else if (error == EJUSTRETURN) */
-		/* nothing to do */
-done:
-	/*
-	 * Reinitialize proc pointer `p' as it may be different
-	 * if this is a child returning from fork syscall.
-	 */
-	p = curproc;
-	while (i = CURSIG(p))
-		postsig(i);
-	p->p_priority = p->p_usrpri;
-	if (want_resched) {
-		int s;
+
+	switch (error) {
+
+	case 0:
 		/*
-		 * Since we are curproc, clock will normally just change
-		 * our priority without moving us from one queue to another
-		 * (since the running process is not on a queue.)
-		 * If that happened after we setrunqueue ourselves but before we
-		 * swtch()'ed, we might not be on the queue indicated by
-		 * our priority.
+		 * Reinitialize proc pointer `p' as it may be different
+		 * if this is a child returning from fork syscall.
 		 */
-		s = splclock();
-		setrunqueue(p);
-		p->p_stats->p_ru.ru_nivcsw++;
-		mi_switch();
-		splx(s);
-		while (i = CURSIG(p))
-			postsig(i);
-	}
-	if (p->p_stats->p_prof.pr_scale) {
-		u_quad_t ticks = p->p_sticks - sticks;
+		p = curproc;
+		frame.tf_eax = rval[0];
+		frame.tf_edx = rval[1];
+		frame.tf_eflags &= ~PSL_C;	/* carry bit */
+		break;
 
-		if (ticks) {
-#ifdef PROFTIMER
-			extern int profscale;
-			addupc(frame.tf_eip, &p->p_stats->p_prof,
-			    ticks * profscale);
-#else
-			addupc(frame.tf_eip, &p->p_stats->p_prof, ticks);
-#endif
-		}
+	case ERESTART:
+		frame.tf_eip = opc;
+		break;
+
+	case EJUSTRETURN:
+		break;
+
+	default:
+	bad:
+		frame.tf_eax = error;
+		frame.tf_eflags |= PSL_C;	/* carry bit */
+		break;
 	}
-	curpriority = p->p_priority;
+
+	userret(p, &frame, sticks);
+
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSRET))
 		ktrsysret(p->p_tracep, code, error, rval[0]);