> 
> stackargs = (caddr_t) &frame->tf_r1;
> regparms = 3 * sizeof(int);
> callp = p->p_emul->e_sysent;

Yes... I don't have the source available....
Does lose a register arg though.

Could the syscall number be passed in the user r12?
It is available - unless the SWI entry code already trashes it.
> > 
> > Actually I think the following will work (provided 16bit syscall numbers
> > are adequate).
> 
> They aren't.

Ok - make the thumb code:
    .balign  4
    .short   syscall & 0xffff
entry:
    swi      syscall >> 16
    bcs      __cerror
    ret

And do a 32 bit load from pc-4 (as in the current ARM version).
The linker should honour the alignment rule.

Getting the syscall number into a register either requires several
instructions (especially on thumb or if the syscall number is > 1024),
or a PC relative load (killing a d-cache line, the same as if the
kernel read the swi instruction).

    David