diff -r 5271608211c5 -r 198d94fd1223 sys/arch/mips/mips/mipsX_subr.S
--- a/sys/arch/mips/mips/mipsX_subr.S	Mon Apr 14 02:13:34 2025 +0000
+++ b/sys/arch/mips/mips/mipsX_subr.S	Mon Apr 14 21:09:01 2025 +0000
@@ -1301,53 +1301,42 @@
 NESTED_NOPROFILE(MIPSX(user_reserved_insn), CALLFRAME_SIZ, ra)
 	.set	noat
 	.mask	0x80000000, -4
-	/*
-	 * Save a minimum of registers to see if this is rdhwr $3,$29
-	 */
 	KERN_ENTRY_ERRATA
 	/* K1 already has CURLWP */
 	PTR_L	k0, L_PCB(k1)			# XXXuvm_lwp_getuarea
-	PTR_ADDU k0, USPACE - TF_SIZ - CALLFRAME_SIZ
-
-	/* Need two working registers */
-	REG_S	AT, CALLFRAME_SIZ+TF_REG_AST(k0)
-	REG_S	v0, CALLFRAME_SIZ+TF_REG_V0(k0)
 
 	/* If this was in a branch delay slot, take the slow path. */
-	mfc0	v0, MIPS_COP_0_CAUSE
+	mfc0	v1, MIPS_COP_0_CAUSE
 	MFC0_HAZARD
-	bltz	v0, MIPSX(user_gen_exception_common)
+	bltz	v1, MIPSX(user_gen_exception_common)
 	 nop
 
 	/*
 	 * Get exception PC and fetch the instruction.  We know we can do
 	 * this since the instruction actually got read.
 	 */
-	_MFC0	v0, MIPS_COP_0_EXC_PC
+	_MFC0	v1, MIPS_COP_0_EXC_PC
 	MFC0_HAZARD
-	INT_L	AT, 0(v0)
+	INT_L	k0, 0(v1)
 
 	/*
 	 * Was this rdhwr $3,$29?
 	 */
-	lui	v0, %hi(0x7c03e83b)	# 0x7c03e83b => rdhwr $3,$29
-	addiu	v0, %lo(0x7c03e83b)	#        or ... rdhwr v1,ulr
-	bne	AT, v0, MIPSX(user_gen_exception_common)
+	lui	v1, %hi(0x7c03e83b)	# 0x7c03e83b => rdhwr $3,$29
+	addiu	v1, %lo(0x7c03e83b)	#        or ... rdhwr v1,ulr
+	bne	k0, v1, MIPSX(user_gen_exception_common)
 	 nop
 
 	/*
 	 * Advance the PC (don't want to restart at the rdhwr).
 	 */
-	_MFC0	v0, MIPS_COP_0_EXC_PC
+	_MFC0	v1, MIPS_COP_0_EXC_PC
 	MFC0_HAZARD
-	PTR_ADDIU v0, 4
-	_MTC0	v0, MIPS_COP_0_EXC_PC
+	PTR_ADDIU v1, 4
+	_MTC0	v1, MIPS_COP_0_EXC_PC
 	COP0_SYNC
 
 	PTR_L	v1, L_PRIVATE(k1)		# rdhwr $3,$29 updates v1
-
-	REG_L	AT, CALLFRAME_SIZ+TF_REG_AST(k0)# restore reg
-	REG_L	v0, CALLFRAME_SIZ+TF_REG_V0(k0) # restore reg
 	eret
 END(MIPSX(user_reserved_insn))