diff --git a/sys/arch/aarch64/aarch64/copyinout.S b/sys/arch/aarch64/aarch64/copyinout.S
index fe30feaf21a4..6900685eaee0 100644
--- a/sys/arch/aarch64/aarch64/copyinout.S
+++ b/sys/arch/aarch64/aarch64/copyinout.S
@@ -1,4 +1,4 @@
-/* $NetBSD: copyinout.S,v 1.13 2020/08/03 06:29:59 ryo Exp $ */
+/* $NetBSD: copyinout.S,v 1.14 2020/08/06 06:49:55 ryo Exp $ */
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -33,7 +33,7 @@
 #include <aarch64/asm.h>
 #include "assym.h"
 
-RCSID("$NetBSD: copyinout.S,v 1.13 2020/08/03 06:29:59 ryo Exp $");
+RCSID("$NetBSD: copyinout.S,v 1.14 2020/08/06 06:49:55 ryo Exp $");
 
 #ifdef ARMV81_PAN
 #define PAN_ENABLE	\
@@ -63,7 +63,7 @@ RCSID("$NetBSD: copyinout.S,v 1.13 2020/08/03 06:29:59 ryo Exp $");
 	mov	x19, x0			/* x19 = arg0 */
 	mov	x20, x1			/* x20 = arg1 */
 
-	/* if (cpu_set_onfault(fb) != 0) return error */
+	/* if (cpu_set_onfault(fb) != 0) return -1 */
 	sub	sp, sp, #FB_T_SIZE	/* allocate struct faultbuf */
 	mov	x0, sp			/* x0 = faultbuf */
 	stp	x2, x3, [sp, #-16]!	/* save x2, x3 */
@@ -79,8 +79,10 @@ RCSID("$NetBSD: copyinout.S,v 1.13 2020/08/03 06:29:59 ryo Exp $");
 	.endm
 
 	.macro exit_cpu_onfault
-	bl	cpu_unset_onfault
-	mov	x8, xzr
+	/* curlwp->l_md.md_onfault = NULL */
+	mrs	x0, tpidr_el1			/* curcpu */
+	ldr	x0, [x0, #CI_CURLWP]		/* x0 = curlwp */
+	str	xzr, [x0, #L_MD_ONFAULT]	/* lwp->l_md_onfault = NULL */
 9:
 	PAN_ENABLE				/* enable PAN */
 	add	sp, sp, #FB_T_SIZE		/* pop stack */
diff --git a/sys/arch/aarch64/aarch64/cpuswitch.S b/sys/arch/aarch64/aarch64/cpuswitch.S
index d32bad888547..34e158f4d1b7 100644
--- a/sys/arch/aarch64/aarch64/cpuswitch.S
+++ b/sys/arch/aarch64/aarch64/cpuswitch.S
@@ -1,4 +1,4 @@
-/* $NetBSD: cpuswitch.S,v 1.23 2020/08/03 05:56:50 ryo Exp $ */
+/* $NetBSD: cpuswitch.S,v 1.24 2020/08/06 06:49:55 ryo Exp $ */
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -38,7 +38,7 @@
 #include "opt_ddb.h"
 #include "opt_kasan.h"
 
-RCSID("$NetBSD: cpuswitch.S,v 1.23 2020/08/03 05:56:50 ryo Exp $")
+RCSID("$NetBSD: cpuswitch.S,v 1.24 2020/08/06 06:49:55 ryo Exp $")
 
 	ARMV8_DEFINE_OPTIONS
 
@@ -447,39 +447,21 @@ END(cpu_Debugger)
  */
 ENTRY_NP(cpu_set_onfault)
 	mrs	x3, tpidr_el1
-	ldr	x2, [x3, #CI_CURLWP]	/* x2 = curcpu()->ci_curlwp */
-	ldr	x1, [x2, #L_MD_ONFAULT]
-	str	x1, [x0, #FB_OLD]	/* fb->fb_old = curlwp->l_md.md_onfault */
-	ldr	w1, [x3, #CI_INTR_DEPTH]
-	str	w1, [x0, #FB_IDEPTH]	/* fb->fb_idepth = curcpu()->ci_intr_depth */
+	ldr	x2, [x3, #CI_CURLWP]	/* curlwp = curcpu()->ci_curlwp */
 	str	x0, [x2, #L_MD_ONFAULT] /* l_md.md_onfault = fb */
 
-	stp	x19, x20, [x0, #FB_REG_X19]
-	stp	x21, x22, [x0, #FB_REG_X21]
-	stp	x23, x24, [x0, #FB_REG_X23]
-	stp	x25, x26, [x0, #FB_REG_X25]
-	stp	x27, x28, [x0, #FB_REG_X27]
-	stp	x29, x30, [x0, #FB_REG_X29]
+	stp	x19, x20, [x0, #(FB_X19 * 8)]
+	stp	x21, x22, [x0, #(FB_X21 * 8)]
+	stp	x23, x24, [x0, #(FB_X23 * 8)]
+	stp	x25, x26, [x0, #(FB_X25 * 8)]
+	stp	x27, x28, [x0, #(FB_X27 * 8)]
+	stp	x29, x30, [x0, #(FB_X29 * 8)]
 	mov	x1, sp
-	str	x1, [x0, #FB_REG_SP]
+	str	x1, [x0, #(FB_SP * 8)]
 	mov	x0, #0
 	ret
 END(cpu_set_onfault)
 
-/*
- * void cpu_unset_onfault(void)
- */
-ENTRY_NP(cpu_unset_onfault)
-	mrs	x3, tpidr_el1
-	ldr	x2, [x3, #CI_CURLWP]	/* curlwp = curcpu()->ci_curlwp */
-	ldr	x0, [x2, #L_MD_ONFAULT]	/* x0 = curlwp->l_md.md_onfault */
-	cbz	x0, 1f
-	ldr	x0, [x0, #FB_OLD]	/* restore old faultbuf */
-	str	x0, [x2, #L_MD_ONFAULT]
-1:
-	ret
-END(cpu_unset_onfault)
-
 /*
  * setjmp(9)
  * int setjmp(label_t *label);
diff --git a/sys/arch/aarch64/aarch64/fault.c b/sys/arch/aarch64/aarch64/fault.c
index ac33cc8c1599..e00b4d33d514 100644
--- a/sys/arch/aarch64/aarch64/fault.c
+++ b/sys/arch/aarch64/aarch64/fault.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: fault.c,v 1.16 2020/08/03 05:56:50 ryo Exp $	*/
+/*	$NetBSD: fault.c,v 1.17 2020/08/06 06:49:55 ryo Exp $	*/
 
 /*
  * Copyright (c) 2017 Ryo Shimizu <ryo@nerv.org>
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.16 2020/08/03 05:56:50 ryo Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.17 2020/08/06 06:49:55 ryo Exp $");
 
 #include "opt_compat_netbsd32.h"
 #include "opt_ddb.h"
@@ -220,18 +220,11 @@ data_abort_handler(struct trapframe *tf, uint32_t eclass)
 		return;
 	}
 
+
  do_fault:
 	/* faultbail path? */
-	fb = l->l_md.md_onfault;
-	if (fb != NULL && fb->fb_idepth == curcpu()->ci_intr_depth) {
-		cpu_unset_onfault();
-#ifdef DEBUG_DUMP_ON_FAULTBAIL
-		printf("fault in failtbail[%p]: "
-		    "fb_sp=%016lx, fb_lr=%016lx, fb_idepth=%u, fb_old=%p\n",
-		    fb, fb->fb_reg[FB_SP], fb->fb_reg[FB_LR],
-		    fb->fb_idepth, fb->fb_old);
-		dump_trapframe(tf, printf);
-#endif
+	fb = cpu_disable_onfault();
+	if (fb != NULL) {
 		cpu_jump_onfault(tf, fb, EFAULT);
 		return;
 	}
diff --git a/sys/arch/aarch64/aarch64/fusu.S b/sys/arch/aarch64/aarch64/fusu.S
index 187c9cff2b14..fcd3d2ad5606 100644
--- a/sys/arch/aarch64/aarch64/fusu.S
+++ b/sys/arch/aarch64/aarch64/fusu.S
@@ -1,4 +1,4 @@
-/*	$NetBSD: fusu.S,v 1.8 2020/08/03 05:56:50 ryo Exp $	*/
+/*	$NetBSD: fusu.S,v 1.9 2020/08/06 06:49:55 ryo Exp $	*/
 
 /*-
  * Copyright (c) 2014, 2019 The NetBSD Foundation, Inc.
@@ -32,7 +32,7 @@
 #include <aarch64/asm.h>
 #include "assym.h"
 
-RCSID("$NetBSD: fusu.S,v 1.8 2020/08/03 05:56:50 ryo Exp $");
+RCSID("$NetBSD: fusu.S,v 1.9 2020/08/06 06:49:55 ryo Exp $");
 
 #ifdef ARMV81_PAN
 #define PAN_ENABLE	\
@@ -72,8 +72,10 @@ RCSID("$NetBSD: fusu.S,v 1.8 2020/08/03 05:56:50 ryo Exp $");
 	.endm
 
 	.macro exit_cpu_onfault
-	bl	cpu_unset_onfault
-	mov	x0, xzr
+	/* curlwp->l_md.md_onfault = NULL */
+	mrs	x1, tpidr_el1			/* curcpu */
+	ldr	x1, [x1, #CI_CURLWP]		/* x1 = curlwp */
+	str	xzr, [x1, #L_MD_ONFAULT]	/* lwp->l_md_onfault = NULL */
 9:
 	PAN_ENABLE				/* enable PAN */
 	add	sp, sp, #FB_T_SIZE		/* pop stack */
diff --git a/sys/arch/aarch64/aarch64/genassym.cf b/sys/arch/aarch64/aarch64/genassym.cf
index 6fb538c8b18b..a4a81de3b868 100644
--- a/sys/arch/aarch64/aarch64/genassym.cf
+++ b/sys/arch/aarch64/aarch64/genassym.cf
@@ -1,4 +1,4 @@
-# $NetBSD: genassym.cf,v 1.28 2020/08/03 06:29:59 ryo Exp $
+# $NetBSD: genassym.cf,v 1.29 2020/08/06 06:49:55 ryo Exp $
 #-
 # Copyright (c) 2014 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -162,21 +162,20 @@ define	L_MD_DB_USER		offsetof(struct lwp, l_md.md_db_user)
 define	L_MD_GA_USER		offsetof(struct lwp, l_md.md_ga_user)
 define	LW_SYSTEM		LW_SYSTEM
 
-define	FB_REG_X19		offsetof(struct faultbuf, fb_reg[FB_X19])
-define	FB_REG_X20		offsetof(struct faultbuf, fb_reg[FB_X20])
-define	FB_REG_X21		offsetof(struct faultbuf, fb_reg[FB_X21])
-define	FB_REG_X22		offsetof(struct faultbuf, fb_reg[FB_X22])
-define	FB_REG_X23		offsetof(struct faultbuf, fb_reg[FB_X23])
-define	FB_REG_X24		offsetof(struct faultbuf, fb_reg[FB_X24])
-define	FB_REG_X25		offsetof(struct faultbuf, fb_reg[FB_X25])
-define	FB_REG_X26		offsetof(struct faultbuf, fb_reg[FB_X26])
-define	FB_REG_X27		offsetof(struct faultbuf, fb_reg[FB_X27])
-define	FB_REG_X28		offsetof(struct faultbuf, fb_reg[FB_X28])
-define	FB_REG_X29		offsetof(struct faultbuf, fb_reg[FB_X29])
-define	FB_REG_LR		offsetof(struct faultbuf, fb_reg[FB_LR])
-define	FB_REG_SP		offsetof(struct faultbuf, fb_reg[FB_SP])
-define	FB_OLD			offsetof(struct faultbuf, fb_old)
-define	FB_IDEPTH		offsetof(struct faultbuf, fb_idepth)
+define	FB_X19			FB_X19
+define	FB_X20			FB_X20
+define	FB_X21			FB_X21
+define	FB_X22			FB_X22
+define	FB_X23			FB_X23
+define	FB_X24			FB_X24
+define	FB_X25			FB_X25
+define	FB_X26			FB_X26
+define	FB_X27			FB_X27
+define	FB_X28			FB_X28
+define	FB_X29			FB_X29
+define	FB_LR			FB_LR
+define	FB_SP			FB_SP
+define	FB_MAX			FB_MAX
 define	FB_T_SIZE		roundup(sizeof(struct faultbuf), 16)
 
 define	LBL_X19			LBL_X19
diff --git a/sys/arch/aarch64/include/frame.h b/sys/arch/aarch64/include/frame.h
index 2d543553bcc1..ba490eee86a8 100644
--- a/sys/arch/aarch64/include/frame.h
+++ b/sys/arch/aarch64/include/frame.h
@@ -1,4 +1,4 @@
-/* $NetBSD: frame.h,v 1.4 2020/08/03 05:56:50 ryo Exp $ */
+/* $NetBSD: frame.h,v 1.5 2020/08/06 06:49:55 ryo Exp $ */
 
 /*-
  * Copyright (c) 2014 The NetBSD Foundation, Inc.
@@ -70,8 +70,6 @@ __CTASSERT((sizeof(struct trapframe) & 15) == 0);
 #define FB_MAX	13
 struct faultbuf {
 	register_t fb_reg[FB_MAX];
-	struct faultbuf *fb_old;
-	u_int fb_idepth;
 };
 
 #define	lwp_trapframe(l)		((l)->l_md.md_utf)
diff --git a/sys/arch/aarch64/include/machdep.h b/sys/arch/aarch64/include/machdep.h
index 902caccfaf79..f741252a659b 100644
--- a/sys/arch/aarch64/include/machdep.h
+++ b/sys/arch/aarch64/include/machdep.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: machdep.h,v 1.15 2020/08/03 05:56:50 ryo Exp $	*/
+/*	$NetBSD: machdep.h,v 1.16 2020/08/06 06:49:55 ryo Exp $	*/
 
 /*
  * Copyright (c) 2017 Ryo Shimizu <ryo@nerv.org>
@@ -113,10 +113,15 @@ void interrupt(struct trapframe *);
 
 /* cpu_onfault */
 int cpu_set_onfault(struct faultbuf *) __returns_twice;
-void cpu_unset_onfault(void);
 void cpu_jump_onfault(struct trapframe *, const struct faultbuf *, int);
 
 #if defined(_KERNEL)
+static inline void
+cpu_unset_onfault(void)
+{
+	curlwp->l_md.md_onfault = NULL;
+}
+
 static inline void
 cpu_enable_onfault(struct faultbuf *fb)
 {