Index: /branches/ia32/lisp-kernel/x86-spentry32.s
===================================================================
--- /branches/ia32/lisp-kernel/x86-spentry32.s	(revision 9624)
+++ /branches/ia32/lisp-kernel/x86-spentry32.s	(revision 9625)
@@ -2321,5 +2321,4 @@
 /* '%err-disp in %imm0.) */
 _spentry(ksignalerr)
-	__(int $3)
 	__(mov $nrs.errdisp,%imm0)
 	__(mov symbol.fcell(%imm0),%fn)
@@ -2564,5 +2563,29 @@
 
 _spentry(tcallnfngen)
-	__(int $3)
+	__(cmpl $nargregs*node_size,%nargs)
+	__(jbe 9f)
+	__(lea -nargregs*node_size(%esp,%nargs),%imm0)
+	__(movd %nargs,%mm0)	/* stash nargs aka temp1 */
+	__(xorl %temp1,%temp1)
+	__(movl %temp0,%rcontext:tcr.save0)
+	/* It's OK to use %ra0 (%temp0) as an temp here, since the */
+	/* real return address is on the stack. */
+0:	__(movl -node_size(%imm0),%ra0)
+	__(movl %ra0,-node_size(%ebp,%temp1))
+	__(subl $node_size,%imm0)
+	__(subl $node_size,%temp1)
+	__(cmpl %imm0,%esp)
+	__(jne 0b)
+	__(movl %rcontext:tcr.save0,%fn)
+	__(movss %fpzero,%rcontext:tcr.save0)
+	__(lea (%ebp,%temp1),%esp)
+	__(movl lisp_frame.savera0(%ebp),%ra0)
+	__(movl lisp_frame.backlink(%ebp),%ebp)
+	__(push %ra0)
+	__(jmp *%fn)
+9:	/* All args in regs; exactly the same as the tcallnfnvsp case */
+	__(movl %temp0,%fn)
+	__(leave)
+	__(jmp *%fn)
 _endsubp(tcallnfngen)