Ok, I won't argue about too many of the specifics of context switch
code, but I will point out another problem that must be solved for
clean VM86 mode support:

VM86 mode operates in the low megabyte of the process virtual address
space; the emulator in the process should not have its private code or
data structures in that chunk of memory.  You can dispense with this
for preliminary testing, of course, but it really needs to get fixed
for "production".

If you want a "real" DOS box, the protected-mode code really wants to
be linked for and mapped in somewhere higher up in VA space, rather
than at a virtual address close to zero.

a.out doesn't really have a concept of a "load address"; it's implicit
in the format.  There are any number of ways around this, of course..
you can add Yet Another Magic Number (e.g., ZMAGIC2M: zmagic, with
text starting at USRTEXT+2meg rather than USRTEXT), steal some bits
out of the entry point address to imply a load address (e.g.
(execp->a_entry & ~0xffffff) + USRTEXT is the load address..), or change
to an object format which supports a load address, or have user space code
relocate itself up to the new address.

					- Bill