*** 26,45 ****
  #include <sys/asm_linkage.h>
  #include <sys/asm_misc.h>
  #include <sys/regset.h>
  #include <sys/privregs.h>
  #include <sys/psw.h>
- #include <sys/machbrand.h>
  
  #if defined(__lint)
  
  #include <sys/types.h>
  #include <sys/thread.h>
  #include <sys/systm.h>
  
  #else   /* __lint */
  
  #include <sys/segments.h>
  #include <sys/pcb.h>
  #include <sys/trap.h>
  #include <sys/ftrace.h>
  #include <sys/traptrace.h>
--- 26,45 ----
  #include <sys/asm_linkage.h>
  #include <sys/asm_misc.h>
  #include <sys/regset.h>
  #include <sys/privregs.h>
  #include <sys/psw.h>
  
  #if defined(__lint)
  
  #include <sys/types.h>
  #include <sys/thread.h>
  #include <sys/systm.h>
  
  #else   /* __lint */
  
+ #include <sys/machbrand.h>
  #include <sys/segments.h>
  #include <sys/pcb.h>
  #include <sys/trap.h>
  #include <sys/ftrace.h>
  #include <sys/traptrace.h>
*** 529,554 ****
          subq    $8, %rsp        /* align stack for call to C */
          call    *%rdi
          addq    $8, %rsp
  
          /*
!          * If the alternate handler returns non-zero, the normal system call
!          * processing is resumed.
           */
          testl   %eax, %eax
          popq    %rax
!         jnz     _syscall_no_brand
  
-         /*
-          * For branded syscalls which were handled in-kernel, shuffle the
-          * register state as would be done by the native handler before jumping
-          * to the post-syscall logic.
-          */
-         movq    REGOFF_RAX(%rsp), %r12
-         movq    REGOFF_RDX(%rsp), %r13
-         jmp     _syscall_after_brand
- 
  _syscall_no_brand:
          movw    %ax, T_SYSNUM(%r15)
          movzbl  T_PRE_SYS(%r15), %ebx
          ORL_SYSCALLTRACE(%ebx)
          testl   %ebx, %ebx
--- 529,545 ----
          subq    $8, %rsp        /* align stack for call to C */
          call    *%rdi
          addq    $8, %rsp
  
          /*
!          * If the alternate handler returns 0, we skip straight to the return to
!          * usermode.  Otherwise, we resume regular system call processing.
           */
          testl   %eax, %eax
          popq    %rax
!         jz      _syscall_after_brand
  
  _syscall_no_brand:
          movw    %ax, T_SYSNUM(%r15)
          movzbl  T_PRE_SYS(%r15), %ebx
          ORL_SYSCALLTRACE(%ebx)
          testl   %ebx, %ebx
*** 838,862 ****
  
          movb    $LWP_SYS, LWP_STATE(%r14)
          call    *%rax
  
          /*
!          * If the alternate handler returns non-zero, the normal system call
!          * processing is resumed.
           */
          testl   %eax, %eax
!         jnz     _syscall32_no_brand
  
-         /*
-          * For branded syscalls which were handled in-kernel, shuffle the
-          * register state as would be done by the native handler before jumping
-          * to the post-syscall logic.
-          */
-         movl    REGOFF_RAX(%rsp), %r12d
-         movl    REGOFF_RDX(%rsp), %r13d
-         jmp     _syscall32_after_brand
- 
  _syscall32_no_brand:
          /*
           * Make some space for MAXSYSARGS (currently 8) 32-bit args placed
           * into 64-bit (long) arg slots, maintaining 16 byte alignment.  Or
           * more succinctly:
--- 829,844 ----
  
          movb    $LWP_SYS, LWP_STATE(%r14)
          call    *%rax
  
          /*
!          * If the alternate handler returns 0, we skip straight to the return
!          * to usermode.  Otherwise, we resume regular system call processing.
           */
          testl   %eax, %eax
!         jz      _syscall32_after_brand
  
  _syscall32_no_brand:
          /*
           * Make some space for MAXSYSARGS (currently 8) 32-bit args placed
           * into 64-bit (long) arg slots, maintaining 16 byte alignment.  Or
           * more succinctly:
*** 1253,1263 ****
  #else   /* __lint */
  
          ENTRY_NP(brand_sys_int80)
          SWAPGS                          /* kernel gsbase */
          XPV_TRAP_POP
-         call    smap_enable
  
          /*
           * We first attempt to call the "b_int80" handler from the "struct
           * brand_mach_ops" for this brand.  If no handler function is installed
           * for this brand, the BRAND_CALLBACK() macro returns here and we
--- 1235,1244 ----
*** 1292,1302 ****
           * code and fake a GP fault. Note on 64-bit hypervisor we need
           * to undo the XPV_TRAP_POP and push rcx and r11 back on the stack
           * because gptrap will pop them again with its own XPV_TRAP_POP.
           */
          XPV_TRAP_POP
-         call    smap_enable
  nopop_int80:
          subq    $2, (%rsp)      /* int insn 2-bytes */
          pushq   $_CONST(_MUL(T_INT80, GATE_DESC_SIZE) + 2)
  #if defined(__xpv)
          push    %r11
--- 1273,1282 ----