date based reversion of uvm to the 4th May.

We still have no idea why this stops the crashes. but it does.

a machine forced to 64mb of ram cycled 10GB through swap with this diff
and is still running as I type this. Other tests by ariane@ and thib@
also seem to show that it's alright.

ok deraadt@, thib@, ariane@

8 files changed, 81 insertions, 61 deletions

diff --git a/sys/uvm/uvm.h b/sys/uvm/uvm.h
index 57ae90fc894..0e4966bec1a 100644
--- a/sys/uvm/uvm.h
+++ b/sys/uvm/uvm.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm.h,v 1.36 2009/06/16 16:42:41 ariane Exp $	*/
+/*	$OpenBSD: uvm.h,v 1.37 2009/06/16 23:54:57 oga Exp $	*/
 /*	$NetBSD: uvm.h,v 1.24 2000/11/27 08:40:02 chs Exp $	*/
 
 /*
@@ -87,11 +87,13 @@ struct uvm {
 	boolean_t page_idle_zero;	/* TRUE if we should try to zero
 					   pages in the idle loop */
 
-	/* page daemon's pid, we sleep on the pointer to this. */
-	struct proc *pagedaemon_proc;
+		/* page daemon trigger */
+	int pagedaemon;			/* daemon sleeps on this */
+	struct proc *pagedaemon_proc;	/* daemon's pid */
 
-	/* aiodone daemon's pid, we sleep on the pointer to this. */
-	struct proc *aiodoned_proc;
+		/* aiodone daemon trigger */
+	int aiodoned;			/* daemon sleeps on this */
+	struct proc *aiodoned_proc;	/* daemon's pid */
 	struct mutex aiodoned_lock;
 
 		/* page hash */
diff --git a/sys/uvm/uvm_anon.c b/sys/uvm/uvm_anon.c
index b6d25514ab3..703822e55af 100644
--- a/sys/uvm/uvm_anon.c
+++ b/sys/uvm/uvm_anon.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_anon.c,v 1.33 2009/06/16 00:11:29 oga Exp $	*/
+/*	$OpenBSD: uvm_anon.c,v 1.34 2009/06/16 23:54:57 oga Exp $	*/
 /*	$NetBSD: uvm_anon.c,v 1.10 2000/11/25 06:27:59 chs Exp $	*/
 
 /*
@@ -128,8 +128,6 @@ uvm_anfree(struct vm_anon *anon)
 			pg->uanon = NULL;
 			uvm_unlock_pageq();
 			simple_unlock(&pg->uobject->vmobjlock);
-			/* not ours anymore */
-			anon->an_page = NULL;
 		} else {
 
 			/*
diff --git a/sys/uvm/uvm_aobj.c b/sys/uvm/uvm_aobj.c
index 11c0cc181bf..1bcc615fadc 100644
--- a/sys/uvm/uvm_aobj.c
+++ b/sys/uvm/uvm_aobj.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_aobj.c,v 1.44 2009/06/16 17:14:14 oga Exp $	*/
+/*	$OpenBSD: uvm_aobj.c,v 1.45 2009/06/16 23:54:57 oga Exp $	*/
 /*	$NetBSD: uvm_aobj.c,v 1.39 2001/02/18 21:19:08 chs Exp $	*/
 
 /*
@@ -167,16 +167,19 @@ struct pool uvm_aobj_pool;
  * local functions
  */
 
-struct uao_swhash_elt	*uao_find_swhash_elt(struct uvm_aobj *, int,
-			     boolean_t);
-static int		 uao_find_swslot(struct uvm_aobj *, int);
-boolean_t		 uao_flush(struct uvm_object *, voff_t, voff_t, int);
-void			 uao_free(struct uvm_aobj *);
-int			 uao_get(struct uvm_object *, voff_t, vm_page_t *,
-			     int *, int, vm_prot_t, int, int);
-boolean_t		 uao_releasepg(struct vm_page *, struct vm_page **);
-boolean_t		 uao_pagein(struct uvm_aobj *, int, int);
-boolean_t		 uao_pagein_page(struct uvm_aobj *, int);
+static struct uao_swhash_elt	*uao_find_swhash_elt(struct uvm_aobj *, int,
+				     boolean_t);
+static int			 uao_find_swslot(struct uvm_aobj *, int);
+static boolean_t		 uao_flush(struct uvm_object *, voff_t,
+				     voff_t, int);
+static void			 uao_free(struct uvm_aobj *);
+static int			 uao_get(struct uvm_object *, voff_t,
+				     vm_page_t *, int *, int, vm_prot_t,
+				     int, int);
+static boolean_t		 uao_releasepg(struct vm_page *,
+				     struct vm_page **);
+static boolean_t		 uao_pagein(struct uvm_aobj *, int, int);
+static boolean_t		 uao_pagein_page(struct uvm_aobj *, int);
 
 /*
  * aobj_pager
@@ -220,7 +223,7 @@ static simple_lock_data_t uao_list_lock;
  * => the object should be locked by the caller
  */
 
-struct uao_swhash_elt *
+static struct uao_swhash_elt *
 uao_find_swhash_elt(struct uvm_aobj *aobj, int pageidx, boolean_t create)
 {
 	struct uao_swhash *swhash;
@@ -258,7 +261,7 @@ uao_find_swhash_elt(struct uvm_aobj *aobj, int pageidx, boolean_t create)
  *
  * => object must be locked by caller 
  */
-static __inline int
+__inline static int
 uao_find_swslot(struct uvm_aobj *aobj, int pageidx)
 {
 
@@ -375,7 +378,7 @@ uao_set_swslot(struct uvm_object *uobj, int pageidx, int slot)
  *
  * => the aobj should be dead
  */
-void
+static void
 uao_free(struct uvm_aobj *aobj)
 {
 
@@ -926,7 +929,7 @@ uao_flush(struct uvm_object *uobj, voff_t start, voff_t stop, int flags)
  * => NOTE: offset is the offset of pps[0], _NOT_ pps[centeridx]
  * => NOTE: caller must check for released pages!!
  */
-int
+static int
 uao_get(struct uvm_object *uobj, voff_t offset, struct vm_page **pps,
     int *npagesp, int centeridx, vm_prot_t access_type, int advice, int flags)
 {
@@ -1228,7 +1231,7 @@ uao_get(struct uvm_object *uobj, voff_t offset, struct vm_page **pps,
  * => we kill the aobj if it is not referenced and we are suppose to
  *      kill it ("KILLME").
  */
-boolean_t
+static boolean_t
 uao_releasepg(struct vm_page *pg, struct vm_page **nextpgp /* OUT */)
 {
 	struct uvm_aobj *aobj = (struct uvm_aobj *) pg->uobject;
@@ -1367,7 +1370,7 @@ restart:
  * => aobj must be locked and is returned locked.
  * => returns TRUE if pagein was aborted due to lack of memory.
  */
-boolean_t
+static boolean_t
 uao_pagein(struct uvm_aobj *aobj, int startslot, int endslot)
 {
 	boolean_t rv;
@@ -1441,7 +1444,7 @@ restart:
  *
  * => aobj must be locked and is returned locked.
  */
-boolean_t
+static boolean_t
 uao_pagein_page(struct uvm_aobj *aobj, int pageidx)
 {
 	struct vm_page *pg;
diff --git a/sys/uvm/uvm_aobj.h b/sys/uvm/uvm_aobj.h
index b97281011dd..c567a181473 100644
--- a/sys/uvm/uvm_aobj.h
+++ b/sys/uvm/uvm_aobj.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_aobj.h,v 1.10 2009/06/16 17:14:15 oga Exp $	*/
+/*	$OpenBSD: uvm_aobj.h,v 1.11 2009/06/16 23:54:57 oga Exp $	*/
 /*	$NetBSD: uvm_aobj.h,v 1.10 2000/01/11 06:57:49 chs Exp $	*/
 
 /*
diff --git a/sys/uvm/uvm_device.c b/sys/uvm/uvm_device.c
index 26b6976b266..53b28c095e5 100644
--- a/sys/uvm/uvm_device.c
+++ b/sys/uvm/uvm_device.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_device.c,v 1.34 2009/06/16 00:11:29 oga Exp $	*/
+/*	$OpenBSD: uvm_device.c,v 1.35 2009/06/16 23:54:57 oga Exp $	*/
 /*	$NetBSD: uvm_device.c,v 1.30 2000/11/25 06:27:59 chs Exp $	*/
 
 /*
@@ -55,25 +55,29 @@
  * we keep a list of active device objects in the system.
  */
 
-LIST_HEAD(udvlist, uvm_device) udv_list = LIST_HEAD_INITIALIZER(udv_list);
-struct mutex udv_lock = MUTEX_INITIALIZER(IPL_NONE);
+LIST_HEAD(udv_list_struct, uvm_device);
+static struct udv_list_struct udv_list;
+static simple_lock_data_t udv_lock;
 
 /*
  * functions
  */
 
-void		udv_reference(struct uvm_object *);
-void		udv_detach(struct uvm_object *);
-boolean_t	udv_flush(struct uvm_object *, voff_t, voff_t, int);
-int		udv_fault(struct uvm_faultinfo *, vaddr_t, vm_page_t *,
-		    int, int, vm_fault_t, vm_prot_t, int);
+static void		udv_init(void);
+static void             udv_reference(struct uvm_object *);
+static void             udv_detach(struct uvm_object *);
+static int		udv_fault(struct uvm_faultinfo *, vaddr_t,
+				       vm_page_t *, int, int, vm_fault_t,
+				       vm_prot_t, int);
+static boolean_t        udv_flush(struct uvm_object *, voff_t, voff_t,
+				       int);
 
 /*
  * master pager structure
  */
 
 struct uvm_pagerops uvm_deviceops = {
-	NULL,		/* lock and list already initialized */
+	udv_init,
 	udv_reference,
 	udv_detach,
 	udv_fault,
@@ -85,6 +89,20 @@ struct uvm_pagerops uvm_deviceops = {
  */
 
 /*
+ * udv_init
+ *
+ * init pager private data structures.
+ */
+
+void
+udv_init(void)
+{
+
+	LIST_INIT(&udv_list);
+	simple_lock_init(&udv_lock);
+}
+
+/*
  * udv_attach
  *
  * get a VM object that is associated with a device.   allocate a new
@@ -146,7 +164,7 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
 		 * first, attempt to find it on the main list 
 		 */
 
-		mtx_enter(&udv_lock);
+		simple_lock(&udv_lock);
 		LIST_FOREACH(lcv, &udv_list, u_list) {
 			if (device == lcv->u_device)
 				break;
@@ -160,19 +178,19 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
 
 			/*
 			 * if someone else has a hold on it, sleep and start
-			 * over again. Else, we need the HOLD flag so we
-			 * don't have to re-order locking here.
+			 * over again.
 			 */
+
 			if (lcv->u_flags & UVM_DEVICE_HOLD) {
 				lcv->u_flags |= UVM_DEVICE_WANTED;
-				msleep(lcv, &udv_lock, PVM | PNORELOCK,
-				    "udv_attach", 0);
+				UVM_UNLOCK_AND_WAIT(lcv, &udv_lock, FALSE,
+				    "udv_attach",0);
 				continue;
 			}
 
 			/* we are now holding it */
 			lcv->u_flags |= UVM_DEVICE_HOLD;
-			mtx_leave(&udv_lock);
+			simple_unlock(&udv_lock);
 
 			/*
 			 * bump reference count, unhold, return.
@@ -182,11 +200,11 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
 			lcv->u_obj.uo_refs++;
 			simple_unlock(&lcv->u_obj.vmobjlock);
 
-			mtx_enter(&udv_lock);
+			simple_lock(&udv_lock);
 			if (lcv->u_flags & UVM_DEVICE_WANTED)
 				wakeup(lcv);
 			lcv->u_flags &= ~(UVM_DEVICE_WANTED|UVM_DEVICE_HOLD);
-			mtx_leave(&udv_lock);
+			simple_unlock(&udv_lock);
 			return(&lcv->u_obj);
 		}
 
@@ -194,10 +212,10 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
 		 * did not find it on main list.   need to malloc a new one.
 		 */
 
-		mtx_leave(&udv_lock);
+		simple_unlock(&udv_lock);
 		/* NOTE: we could sleep in the following malloc() */
 		udv = malloc(sizeof(*udv), M_TEMP, M_WAITOK);
-		mtx_enter(&udv_lock);
+		simple_lock(&udv_lock);
 
 		/*
 		 * now we have to double check to make sure no one added it
@@ -215,7 +233,7 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
 		 */
 
 		if (lcv) {
-			mtx_leave(&udv_lock);
+			simple_unlock(&udv_lock);
 			free(udv, M_TEMP);
 			continue;
 		}
@@ -233,7 +251,7 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
 		udv->u_flags = 0;
 		udv->u_device = device;
 		LIST_INSERT_HEAD(&udv_list, udv, u_list);
-		mtx_leave(&udv_lock);
+		simple_unlock(&udv_lock);
 		return(&udv->u_obj);
 	}
 	/*NOTREACHED*/
@@ -249,7 +267,7 @@ udv_attach(void *arg, vm_prot_t accessprot, voff_t off, vsize_t size)
  * => caller must call with object unlocked.
  */
 
-void
+static void
 udv_reference(struct uvm_object *uobj)
 {
 	UVMHIST_FUNC("udv_reference"); UVMHIST_CALLED(maphist);
@@ -269,7 +287,7 @@ udv_reference(struct uvm_object *uobj)
  * => caller must call with object unlocked and map locked.
  */
 
-void
+static void
 udv_detach(struct uvm_object *uobj)
 {
 	struct uvm_device *udv = (struct uvm_device *)uobj;
@@ -291,14 +309,13 @@ again:
 
 	/*
 	 * is it being held?   if so, wait until others are done.
-	 * It is probably about to be referenced.
 	 */
 
-	mtx_enter(&udv_lock);
+	simple_lock(&udv_lock);
 	if (udv->u_flags & UVM_DEVICE_HOLD) {
 		udv->u_flags |= UVM_DEVICE_WANTED;
 		simple_unlock(&uobj->vmobjlock);
-		msleep(udv, &udv_lock, PVM | PNORELOCK, "udv_detach", 0);
+		UVM_UNLOCK_AND_WAIT(udv, &udv_lock, FALSE, "udv_detach",0);
 		goto again;
 	}
 
@@ -309,7 +326,7 @@ again:
 	LIST_REMOVE(udv, u_list);
 	if (udv->u_flags & UVM_DEVICE_WANTED)
 		wakeup(udv);
-	mtx_leave(&udv_lock);
+	simple_unlock(&udv_lock);
 	simple_unlock(&uobj->vmobjlock);
 	free(udv, M_TEMP);
 	UVMHIST_LOG(maphist," <- done, freed uobj=%p", uobj,0,0,0);
@@ -322,7 +339,7 @@ again:
  * flush pages out of a uvm object.   a no-op for devices.
  */
 
-boolean_t
+static boolean_t
 udv_flush(struct uvm_object *uobj, voff_t start, voff_t stop, int flags)
 {
 
@@ -345,7 +362,7 @@ udv_flush(struct uvm_object *uobj, voff_t start, voff_t stop, int flags)
  * => NOTE: vaddr is the VA of pps[0] in ufi->entry, _NOT_ pps[centeridx]
  */
 
-int
+static int
 udv_fault(struct uvm_faultinfo *ufi, vaddr_t vaddr, vm_page_t *pps, int npages,
     int centeridx, vm_fault_t fault_type, vm_prot_t access_type, int flags)
 {
diff --git a/sys/uvm/uvm_extern.h b/sys/uvm/uvm_extern.h
index de7dbb06b3b..3754a927046 100644
--- a/sys/uvm/uvm_extern.h
+++ b/sys/uvm/uvm_extern.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_extern.h,v 1.80 2009/06/16 16:42:41 ariane Exp $	*/
+/*	$OpenBSD: uvm_extern.h,v 1.81 2009/06/16 23:54:58 oga Exp $	*/
 /*	$NetBSD: uvm_extern.h,v 1.57 2001/03/09 01:02:12 chs Exp $	*/
 
 /*
diff --git a/sys/uvm/uvm_fault.c b/sys/uvm/uvm_fault.c
index 0c7f05b6459..a10fd054e84 100644
--- a/sys/uvm/uvm_fault.c
+++ b/sys/uvm/uvm_fault.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_fault.c,v 1.56 2009/06/16 00:11:29 oga Exp $	*/
+/*	$OpenBSD: uvm_fault.c,v 1.57 2009/06/16 23:54:58 oga Exp $	*/
 /*	$NetBSD: uvm_fault.c,v 1.51 2000/08/06 00:22:53 thorpej Exp $	*/
 
 /*
@@ -175,7 +175,7 @@ static struct uvm_advice uvmadvice[] = {
  * private prototypes
  */
 
-void uvmfault_amapcopy(struct uvm_faultinfo *);
+static void uvmfault_amapcopy(struct uvm_faultinfo *);
 static __inline void uvmfault_anonflush(struct vm_anon **, int);
 void	uvmfault_unlockmaps(struct uvm_faultinfo *, boolean_t);
 
@@ -228,7 +228,7 @@ uvmfault_anonflush(struct vm_anon **anons, int n)
  * => if we are out of RAM we sleep (waiting for more)
  */
 
-void
+static void
 uvmfault_amapcopy(struct uvm_faultinfo *ufi)
 {
 
diff --git a/sys/uvm/uvm_init.c b/sys/uvm/uvm_init.c
index 0c4244eec76..76931227928 100644
--- a/sys/uvm/uvm_init.c
+++ b/sys/uvm/uvm_init.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_init.c,v 1.23 2009/06/16 00:11:29 oga Exp $	*/
+/*	$OpenBSD: uvm_init.c,v 1.24 2009/06/16 23:54:58 oga Exp $	*/
 /*	$NetBSD: uvm_init.c,v 1.14 2000/06/27 17:29:23 mrg Exp $	*/
 
 /*