diff --git a/sys/arch/sun3/sun3/genassym.c b/sys/arch/sun3/sun3/genassym.c
index ff76a16c2aa6..a8f40b82db9b 100644
--- a/sys/arch/sun3/sun3/genassym.c
+++ b/sys/arch/sun3/sun3/genassym.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: genassym.c,v 1.30 1996/02/02 19:43:09 mycroft Exp $	*/
+/*	$NetBSD: genassym.c,v 1.31 1996/02/16 23:36:52 gwr Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995 Gordon W. Ross
@@ -169,6 +169,7 @@ main()
 	def("FR_SP", &fp->f_regs[15]);
 	def("FR_HW", &fp->f_sr);
 	def("FR_ADJ", &fp->f_stackadj);
+	def("FR_SIZE", sizeof(struct trapframe));
 
 	/* FP frame offsets */
 	def("FPF_REGS", &fpf->fpf_regs[0]);
diff --git a/sys/arch/sun3/sun3/locore.s b/sys/arch/sun3/sun3/locore.s
index c065371bd3a2..a94c5a9b1533 100644
--- a/sys/arch/sun3/sun3/locore.s
+++ b/sys/arch/sun3/sun3/locore.s
@@ -1,4 +1,4 @@
-/*	$NetBSD: locore.s,v 1.36 1996/02/16 18:06:11 gwr Exp $	*/
+/*	$NetBSD: locore.s,v 1.37 1996/02/16 23:36:54 gwr Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995 Gordon W. Ross
@@ -437,69 +437,16 @@ _trap0:
 	jra	rei			| all done
 
 /*
- * Our native 4.3 implementation uses trap 1 as sigreturn() and trap 2
- * as a breakpoint trap.
+ * Trap 1 is either:
+ * sigreturn (native NetBSD executable)
+ * breakpoint (HPUX executable)
  */
 _trap1:
-	jra	sigreturn
-
-_trap2:
-	jra	_trace
-
-/*
- * Trap 12 is the entry point for the cachectl "syscall"
- *	cachectl(command, addr, length)
- * command in d0, addr in a1, length in d1
- */
-	.globl	_cachectl
-_trap12:
-	movl	d1,sp@-			| push length
-	movl	a1,sp@-			| push addr
-	movl	d0,sp@-			| push command
-	jbsr	_cachectl		| do it
-	lea	sp@(12),sp		| pop args
-	jra	rei			| all done
-
-/*
- * Trap 15 is used for:
- *	- KGDB traps
- *	- trace traps for SUN binaries (not fully supported yet)
- * We just pass it on and let trap() sort it all out
- */
-_trap15:
-	clrl	sp@-
-	moveml	#0xFFFF,sp@-
-#ifdef KGDB
-	moveq	#T_TRAP15,d0
-	movw	sp@(FR_HW),d1		| get PSW
-	andw	#PSL_S,d1		| from user mode?
-	jeq	fault			| yes, just a regular fault
-	movl	d0,sp@-
-	.globl	_kgdb_trap_glue
-	jbsr	_kgdb_trap_glue		| returns if no debugger
-	addl	#4,sp
+#if 0 /* COMPAT_HPUX */
+	/* If process is HPUX, this is a user breakpoint. */
+	jne	trap15
 #endif
-	moveq	#T_TRAP15,d0
-	jra	fault
-
-/*
- * Hit a breakpoint (trap 1 or 2) instruction.
- * Push the code and treat as a normal fault.
- */
-_trace:
-	clrl	sp@-
-	moveml	#0xFFFF,sp@-
-#ifdef KGDB
-	moveq	#T_TRACE,d0
-	movw	sp@(FR_HW),d1		| get SSW
-	andw	#PSL_S,d1		| from user mode?
-	jeq	fault			| no, regular fault
-	movl	d0,sp@-
-	jbsr	_kgdb_trap_glue		| returns if no debugger
-	addl	#4,sp
-#endif
-	moveq	#T_TRACE,d0
-	jra	fault
+	/* fall into sigreturn */
 
 /*
  * The sigreturn() syscall comes here.  It requires special handling
@@ -538,6 +485,103 @@ Lsigr1:
 	movl	sp@,sp			| and our SP
 	jra	rei			| all done
 
+/*
+ * Trap 2 is either
+ * badtrap (native NetBSD executable)
+ * sigreturn (HPUX executable)
+ */
+_trap2:
+#if 0 /* COMPAT_HPUX */
+	/* XXX:	If HPUX, this is a user breakpoint. */
+	jne	sigreturn
+#endif
+	jra	_badtrap
+
+/*
+ * Trace (single-step) trap.  Kernel-mode is special.
+ * User mode traps are passed simply passed to trap()
+ */
+_trace:
+	clrl	sp@-			| stack adjust count
+	moveml	#0xFFFF,sp@-
+	moveq	#T_TRACE,d0
+	movw	sp@(FR_HW),d1		| get PSW
+	andw	#PSL_S,d1		| from system mode?
+	jne	kbrkpt			| yes, kernel breakpoint
+	jra	fault			| no, user-mode fault
+
+/*
+ * Trap 15 is used for:
+ *	- GDB breakpoints (in user programs)
+ *	- KGDB breakpoints (in the kernel)
+ *	- trace traps for SUN binaries (not fully supported yet)
+ * User mode traps are passed simply passed to trap()
+ */
+_trap15:
+	clrl	sp@-			| stack adjust count
+	moveml	#0xFFFF,sp@-
+	moveq	#T_TRAP15,d0
+	movw	sp@(FR_HW),d1		| get PSW
+	andw	#PSL_S,d1		| from system mode?
+	jne	kbrkpt			| yes, kernel breakpoint
+	jra	fault			| no, user-mode fault
+
+kbrkpt:	| Kernel-mode breakpoint or trace trap.
+	| Save system sp rather than user sp.
+	lea	sp@(FR_SIZE),a6		| Save stack pointer
+	movl	a6,sp@(FR_SP)		|  from before trap
+
+	| If we are not on tmpstk switch to it.
+	| (allows debugger to frob the stack)
+	movl	a6,d1
+	cmpl	#tmpstk,d1
+	jls	Lbrkpt2 		| already on tmpstk
+	| Copy frame to the temporary stack
+	movl	sp,a0			| a0=src
+	lea	tmpstk-96,a1		| a1=dst
+	movl	a1,sp			| sp=new frame
+	moveq	#FR_SIZE,d1
+Lbrkpt1:
+	movl	a0@+,a1@+
+	subql	#4,d1
+	bgt	Lbrkpt1
+
+Lbrkpt2:
+	| Now call the trap handler as usual.
+	clrl	sp@-			| no VA arg
+	clrl	sp@-			| or code arg
+	movl	d0,sp@-			| push trap type
+	jbsr	_trap			| handle trap
+	lea	sp@(12),sp		| pop value args
+
+	| The stack pointer may have been modified, or
+	| data below it modified (by kgdb push call),
+	| so push the hardware frame at the current sp
+	| before restoring registers and returning.
+
+	movl	sp@(FR_SP),a0		| modified sp
+	lea	sp@(FR_SIZE),a1		| end of our frame
+	movl	a1@-,a0@-		| copy 2 longs with
+	movl	a1@-,a0@-		| ... predecrement
+	movl	a0,sp@(FR_SP)		| sp = h/w frame
+	moveml	sp@+,#0x7FFF		| restore all but sp
+	movl	sp@,sp			| ... and sp
+	rte				| all done
+
+/*
+ * Trap 12 is the entry point for the cachectl "syscall"
+ *	cachectl(command, addr, length)
+ * command in d0, addr in a1, length in d1
+ */
+	.globl	_cachectl
+_trap12:
+	movl	d1,sp@-			| push length
+	movl	a1,sp@-			| push addr
+	movl	d0,sp@-			| push command
+	jbsr	_cachectl		| do it
+	lea	sp@(12),sp		| pop args
+	jra	rei			| all done
+
 /*
  * Interrupt handlers.  Most are auto-vectored,
  * and hard-wired the same way on all sun3 models.