Kernel stack can be swapped. This means that stuff that's on the stack

should never be referenced outside the context of the process to which
this stack belongs unless we do the PHOLD/PRELE dance. Loads of code
doesn't follow the rules here. Instead of trying to track down all
offenders and fix this hairy situation, it makes much more sense
to not swap kernel stacks.

From art@, tested by many some time ago.

25 files changed, 64 insertions, 351 deletions

diff --git a/sys/arch/alpha/alpha/pmap.c b/sys/arch/alpha/alpha/pmap.c
index bd49bee76d3..f39ff355ac1 100644
--- a/sys/arch/alpha/alpha/pmap.c
+++ b/sys/arch/alpha/alpha/pmap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pmap.c,v 1.47 2006/04/13 14:41:08 brad Exp $ */
+/* $OpenBSD: pmap.c,v 1.48 2006/11/29 12:24:15 miod Exp $ */
 /* $NetBSD: pmap.c,v 1.154 2000/12/07 22:18:55 thorpej Exp $ */
 
 /*-
@@ -2867,9 +2867,8 @@ pmap_emulate_reference(struct proc *p, vaddr_t v, int user, int type)
 		panic("pmap_emulate_reference: invalid pte");
 #if 0
 	/*
-	 * Can't do these, because cpu_fork and cpu_swapin call
-	 * pmap_emulate_reference(), and the bits aren't guaranteed,
-	 * for them...
+	 * Can't do these, because cpu_fork call pmap_emulate_reference(),
+	 * and the bits aren't guaranteed, for them...
 	 */
 	if (type == ALPHA_MMCSR_FOW) {
 		if (!(*pte & (user ? PG_UWE : PG_UWE | PG_KWE)))
diff --git a/sys/arch/amd64/amd64/fpu.c b/sys/arch/amd64/amd64/fpu.c
index e2dd39a2d31..cc19b095f2d 100644
--- a/sys/arch/amd64/amd64/fpu.c
+++ b/sys/arch/amd64/amd64/fpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fpu.c,v 1.11 2006/04/19 15:51:22 mickey Exp $	*/
+/*	$OpenBSD: fpu.c,v 1.12 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: fpu.c,v 1.1 2003/04/26 18:39:28 fvdl Exp $	*/
 
 /*-
@@ -301,7 +301,6 @@ fpusave_proc(struct proc *p, int save)
 	struct cpu_info *oci;
 
 	KDASSERT(p->p_addr != NULL);
-	KDASSERT(p->p_flag & P_INMEM);
 
 	oci = p->p_addr->u_pcb.pcb_fpcpu;
 	if (oci == NULL)
diff --git a/sys/arch/arm/arm/db_trace.c b/sys/arch/arm/arm/db_trace.c
index 00206ef7efc..1f82b9420f8 100644
--- a/sys/arch/arm/arm/db_trace.c
+++ b/sys/arch/arm/arm/db_trace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: db_trace.c,v 1.2 2004/05/19 03:17:07 drahn Exp $	*/
+/*	$OpenBSD: db_trace.c,v 1.3 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: db_trace.c,v 1.8 2003/01/17 22:28:48 thorpej Exp $	*/
 
 /* 
@@ -113,10 +113,6 @@ db_stack_trace_print(addr, have_addr, count, modif, pr)
 				(*pr)("not found\n");
 				return;
 			}	
-			if (!(p->p_flag & P_INMEM)) {
-				(*pr)("swapped out\n");
-				return;
-			}
 			u = p->p_addr;
 #ifdef acorn26
 			frame = (u_int32_t *)(u->u_pcb.pcb_sf->sf_r11);
diff --git a/sys/arch/sparc/dev/fd.c b/sys/arch/sparc/dev/fd.c
index 3642726a299..9f1977266a1 100644
--- a/sys/arch/sparc/dev/fd.c
+++ b/sys/arch/sparc/dev/fd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fd.c,v 1.45 2006/09/26 23:33:04 krw Exp $	*/
+/*	$OpenBSD: fd.c,v 1.46 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: fd.c,v 1.51 1997/05/24 20:16:19 pk Exp $	*/
 
 /*-
@@ -1895,7 +1895,6 @@ fdformat(dev, finfo, p)
 	if (bp == 0)
 		return (ENOBUFS);
 
-	PHOLD(p);
 	bzero((void *)bp, sizeof(struct buf));
 	bp->b_flags = B_BUSY | B_PHYS | B_FORMAT;
 	bp->b_proc = p;
@@ -1942,7 +1941,6 @@ fdformat(dev, finfo, p)
 
 	/* ...and wait for it to complete */
 	rv = biowait(bp);
-	PRELE(p);
 	free(bp, M_TEMP);
 	return (rv);
 }
diff --git a/sys/arch/sparc64/dev/fd.c b/sys/arch/sparc64/dev/fd.c
index 04f71364c2c..2aaa9286441 100644
--- a/sys/arch/sparc64/dev/fd.c
+++ b/sys/arch/sparc64/dev/fd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fd.c,v 1.7 2006/09/26 23:33:04 krw Exp $	*/
+/*	$OpenBSD: fd.c,v 1.8 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: fd.c,v 1.112 2003/08/07 16:29:35 agc Exp $	*/
 
 /*-
@@ -1944,7 +1944,6 @@ fdformat(dev, finfo, p)
 	if (bp == NULL)
 		return (ENOBUFS);
 
-	PHOLD(p);
 	bzero((void *)bp, sizeof(struct buf));
 	bp->b_flags = B_BUSY | B_PHYS | B_FORMAT;
 	bp->b_proc = p;
@@ -1991,7 +1990,6 @@ fdformat(dev, finfo, p)
 
 	/* ...and wait for it to complete */
 	rv = biowait(bp);
-	PRELE(p);
 	free(bp, M_TEMP);
 	return (rv);
 }
diff --git a/sys/arch/sparc64/sparc64/db_trace.c b/sys/arch/sparc64/sparc64/db_trace.c
index dd25eee69f2..2bb07cffee2 100644
--- a/sys/arch/sparc64/sparc64/db_trace.c
+++ b/sys/arch/sparc64/sparc64/db_trace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: db_trace.c,v 1.7 2002/10/09 21:10:48 deraadt Exp $	*/
+/*	$OpenBSD: db_trace.c,v 1.8 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: db_trace.c,v 1.23 2001/07/10 06:06:16 eeh Exp $ */
 
 /*
@@ -87,10 +87,6 @@ db_stack_trace_print(addr, have_addr, count, modif, pr)
 				(*pr)("not found\n");
 				return;
 			}	
-			if ((p->p_flag & P_INMEM) == 0) {
-				(*pr)("swapped out\n");
-				return;
-			}
 			u = p->p_addr;
 			frame = (vaddr_t)u->u_pcb.pcb_sp;
 			(*pr)("at %p\n", frame);
diff --git a/sys/dev/i2o/iop.c b/sys/dev/i2o/iop.c
index dd38ba203dd..3fb786f8c72 100644
--- a/sys/dev/i2o/iop.c
+++ b/sys/dev/i2o/iop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: iop.c,v 1.28 2006/03/07 20:46:46 brad Exp $	*/
+/*	$OpenBSD: iop.c,v 1.29 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: iop.c,v 1.12 2001/03/21 14:27:05 ad Exp $	*/
 
 /*-
@@ -594,9 +594,7 @@ iop_reconf_thread(void *cookie)
 		DPRINTF(("%s: async reconfig: requested 0x%08x\n",
 		    sc->sc_dv.dv_xname, chgind));
 
-		PHOLD(sc->sc_reconf_proc);
 		rv = iop_lct_get0(sc, &lct, sizeof(lct), chgind);
-		PRELE(sc->sc_reconf_proc);
 
 		DPRINTF(("%s: async reconfig: notified (0x%08x, %d)\n",
 		    sc->sc_dv.dv_xname, letoh32(lct.changeindicator), rv));
@@ -1076,9 +1074,7 @@ iop_hrt_get(struct iop_softc *sc)
 	size_t size;
 	int rv;
 
-	PHOLD(curproc);
 	rv = iop_hrt_get0(sc, &hrthdr, sizeof(hrthdr));
-	PRELE(curproc);
 	if (rv != 0)
 		return (rv);
 
@@ -1236,17 +1232,11 @@ iop_param_op(struct iop_softc *sc, int tid, struct iop_initiator *ii,
 	pgop->oat.fieldcount = htole16(0xffff);
 	pgop->oat.group = htole16(group);
 
-	if (ii == NULL)
-		PHOLD(curproc);
-
 	memset(buf, 0, size);
 	iop_msg_map(sc, im, mb, pgop, sizeof(*pgop), 1);
 	iop_msg_map(sc, im, mb, buf, size, write);
 	rv = iop_msg_post(sc, im, mb, (ii == NULL ? 30000 : 0));
 
-	if (ii == NULL)
-		PRELE(curproc);
-
 	/* Detect errors; let partial transfers to count as success. */
 	if (ii == NULL && rv == 0) {
 		if (rf->reqstatus == I2O_STATUS_ERROR_PARTIAL_XFER &&
@@ -1350,14 +1340,12 @@ iop_systab_set(struct iop_softc *sc)
 		}
 	}
 
-	PHOLD(curproc);
 	iop_msg_map(sc, im, mb, iop_systab, iop_systab_size, 1);
 	iop_msg_map(sc, im, mb, mema, sizeof(mema), 1);
 	iop_msg_map(sc, im, mb, ioa, sizeof(ioa), 1);
 	rv = iop_msg_post(sc, im, mb, 5000);
 	iop_msg_unmap(sc, im);
 	iop_msg_free(sc, im);
-	PRELE(curproc);
 	return (rv);
 }
 
diff --git a/sys/dev/isa/fd.c b/sys/dev/isa/fd.c
index 8b584f0eb97..558ce1137a3 100644
--- a/sys/dev/isa/fd.c
+++ b/sys/dev/isa/fd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fd.c,v 1.56 2006/09/26 23:33:04 krw Exp $	*/
+/*	$OpenBSD: fd.c,v 1.57 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: fd.c,v 1.90 1996/05/12 23:12:03 mycroft Exp $	*/
 
 /*-
@@ -1068,7 +1068,6 @@ fdformat(dev, finfo, p)
         if (bp == NULL)
                 return ENOBUFS;
 
-	PHOLD(p);
         bzero((void *)bp, sizeof(struct buf));
         bp->b_flags = B_BUSY | B_PHYS | B_FORMAT;
         bp->b_proc = p;
@@ -1093,7 +1092,6 @@ fdformat(dev, finfo, p)
 
         /* ...and wait for it to complete */
 	rv = biowait(bp);
-	PRELE(p);
         free(bp, M_TEMP);
         return (rv);
 }
diff --git a/sys/kern/init_main.c b/sys/kern/init_main.c
index 3ebb901b5cc..5e69f2e3748 100644
--- a/sys/kern/init_main.c
+++ b/sys/kern/init_main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: init_main.c,v 1.131 2006/11/14 18:00:27 jmc Exp $	*/
+/*	$OpenBSD: init_main.c,v 1.132 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: init_main.c,v 1.84.4.1 1996/06/02 09:08:06 mrg Exp $	*/
 
 /*
@@ -273,7 +273,7 @@ main(void *framep)
 	p->p_thrparent = p;
 	LIST_INIT(&p->p_thrchildren);
 
-	p->p_flag = P_INMEM | P_SYSTEM | P_NOCLDWAIT;
+	p->p_flag = P_SYSTEM | P_NOCLDWAIT;
 	p->p_stat = SONPROC;
 	p->p_nice = NZERO;
 	p->p_emul = &emul_native;
diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index a68f5b09815..3c8d6f3c011 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_fork.c,v 1.84 2006/04/30 15:37:07 kettenis Exp $	*/
+/*	$OpenBSD: kern_fork.c,v 1.85 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: kern_fork.c,v 1.29 1996/02/09 18:59:34 christos Exp $	*/
 
 /*
@@ -191,10 +191,7 @@ fork1(struct proc *p1, int exitsig, int flags, void *stack, size_t stacksize,
 		return (EAGAIN);
 	}
 
-	/*
-	 * Allocate a pcb and kernel stack for the process
-	 */
-	uaddr = uvm_km_valloc_align(kernel_map, USPACE, USPACE_ALIGN);
+	uaddr = uvm_km_alloc1(kernel_map, USPACE, USPACE_ALIGN, 1);
 	if (uaddr == 0) {
 		chgproccnt(uid, -1);
 		nprocs--;
@@ -237,7 +234,7 @@ fork1(struct proc *p1, int exitsig, int flags, void *stack, size_t stacksize,
 	 * Increase reference counts on shared objects.
 	 * The p_stats and p_sigacts substructs are set in vm_fork.
 	 */
-	p2->p_flag = P_INMEM;
+	p2->p_flag = 0;
 	p2->p_emul = p1->p_emul;
 	if (p1->p_flag & P_PROFIL)
 		startprofclock(p2);
@@ -331,11 +328,6 @@ fork1(struct proc *p1, int exitsig, int flags, void *stack, size_t stacksize,
 	 */
 	if (p2->p_emul->e_proc_fork)
 		(*p2->p_emul->e_proc_fork)(p2, p1);
-	/*
-	 * This begins the section where we must prevent the parent
-	 * from being swapped.
-	 */
-	PHOLD(p1);
 
 	p2->p_addr = (struct user *)uaddr;
 
@@ -407,11 +399,6 @@ fork1(struct proc *p1, int exitsig, int flags, void *stack, size_t stacksize,
 	SCHED_UNLOCK(s);
 
 	/*
-	 * Now can be swapped.
-	 */
-	PRELE(p1);
-
-	/*
 	 * Notify any interested parties about the new process.
 	 */
 	KNOTE(&p1->p_klist, NOTE_FORK | p2->p_pid);
diff --git a/sys/kern/kern_kthread.c b/sys/kern/kern_kthread.c
index 7f8e60b7141..e60176d611d 100644
--- a/sys/kern/kern_kthread.c
+++ b/sys/kern/kern_kthread.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_kthread.c,v 1.25 2005/12/03 18:09:08 tedu Exp $	*/
+/*	$OpenBSD: kern_kthread.c,v 1.26 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: kern_kthread.c,v 1.3 1998/12/22 21:21:36 kleink Exp $	*/
 
 /*-
@@ -81,10 +81,9 @@ kthread_create(void (*func)(void *), void *arg,
 		return (error);
 
 	/*
-	 * Mark it as a system process and not a candidate for
-	 * swapping.
+	 * Mark it as a system process.
 	 */
-	p2->p_flag |= P_INMEM | P_SYSTEM;	/* XXX */
+	p2->p_flag |= P_SYSTEM;
 
 	/* Name it as specified. */
 	va_start(ap, fmt);
diff --git a/sys/kern/kern_physio.c b/sys/kern/kern_physio.c
index 436436be615..a6489286910 100644
--- a/sys/kern/kern_physio.c
+++ b/sys/kern/kern_physio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_physio.c,v 1.25 2006/11/15 17:25:40 jmc Exp $	*/
+/*	$OpenBSD: kern_physio.c,v 1.26 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: kern_physio.c,v 1.28 1997/05/19 10:43:28 pk Exp $	*/
 
 /*-
@@ -157,7 +157,6 @@ physio(void (*strategy)(struct buf *), struct buf *bp, dev_t dev, int flags,
 			 * saves it in b_saveaddr.  However, vunmapbuf()
 			 * restores it.
 			 */
-			PHOLD(p);
 			error = uvm_vslock(p, bp->b_data, todo,
 			    (flags & B_READ) ?
 			    VM_PROT_READ | VM_PROT_WRITE : VM_PROT_READ);
@@ -198,7 +197,6 @@ physio(void (*strategy)(struct buf *), struct buf *bp, dev_t dev, int flags,
 			vunmapbuf(bp, todo);
 			uvm_vsunlock(p, bp->b_data, todo);
 after_unlock:
-			PRELE(p);
 
 			/* remember error value (save a splbio/splx pair) */
 			if (bp->b_flags & B_ERROR)
diff --git a/sys/kern/kern_synch.c b/sys/kern/kern_synch.c
index 83ddbe84d60..ae237fb2c92 100644
--- a/sys/kern/kern_synch.c
+++ b/sys/kern/kern_synch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_synch.c,v 1.74 2006/10/21 02:18:00 tedu Exp $	*/
+/*	$OpenBSD: kern_synch.c,v 1.75 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*
@@ -336,17 +336,13 @@ restart:
 				 * XXXSMP See affinity comment in
 				 * resched_proc().
 				 */
-				if ((p->p_flag & P_INMEM) != 0) {
-					setrunqueue(p);
+				setrunqueue(p);
 #ifdef __HAVE_CPUINFO
-					KASSERT(p->p_cpu != NULL);
-					need_resched(p->p_cpu);
+				KASSERT(p->p_cpu != NULL);
+				need_resched(p->p_cpu);
 #else
-					need_resched(NULL);
+				need_resched(NULL);
 #endif
-				} else {
-					wakeup(&proc0);
-				}
 				/* END INLINE EXPANSION */
 
 				if (n != 0)
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 343fdf1c15f..d6085b8c3f4 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sysctl.c,v 1.142 2006/05/28 19:41:42 dlg Exp $	*/
+/*	$OpenBSD: kern_sysctl.c,v 1.143 2006/11/29 12:24:17 miod Exp $	*/
 /*	$NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $	*/
 
 /*-
@@ -1159,14 +1159,12 @@ fill_eproc(struct proc *p, struct eproc *ep)
 	} else {
 		struct vmspace *vm = p->p_vmspace;
 
-		PHOLD(p);	/* need for pstats */
 		ep->e_vm.vm_rssize = vm_resident_count(vm);
 		ep->e_vm.vm_tsize = vm->vm_tsize;
 		ep->e_vm.vm_dsize = vm->vm_dused;
 		ep->e_vm.vm_ssize = vm->vm_ssize;
 		ep->e_pstats = *p->p_stats;
 		ep->e_pstats_valid = 1;
-		PRELE(p);
 	}
 	if (p->p_pptr)
 		ep->e_ppid = p->p_pptr->p_pid;
@@ -1220,7 +1218,7 @@ fill_kproc2(struct proc *p, struct kinfo_proc2 *ki)
 
 	ki->p_eflag = 0;
 	ki->p_exitsig = p->p_exitsig;
-	ki->p_flag = p->p_flag;
+	ki->p_flag = p->p_flag | P_INMEM;
 
 	ki->p_pid = p->p_pid;
 	if (p->p_pptr)
@@ -1308,7 +1306,7 @@ fill_kproc2(struct proc *p, struct kinfo_proc2 *ki)
 #else
 		ki->p_schedflags = p->p_schedflags;
 #endif
-		ki->p_holdcnt = p->p_holdcnt;
+		ki->p_holdcnt = 1;
 		ki->p_priority = p->p_priority;
 		ki->p_usrpri = p->p_usrpri;
 		if (p->p_wmesg)
@@ -1330,7 +1328,6 @@ fill_kproc2(struct proc *p, struct kinfo_proc2 *ki)
 	} else {
 		ki->p_uvalid = 1;
 
-		PHOLD(p);	/* need for pstats */
 		ki->p_ustart_sec = p->p_stats->p_start.tv_sec;
 		ki->p_ustart_usec = p->p_stats->p_start.tv_usec;
 
@@ -1364,7 +1361,6 @@ fill_kproc2(struct proc *p, struct kinfo_proc2 *ki)
 		if (p->p_cpu != NULL)
 			ki->p_cpuid = CPU_INFO_UNIT(p->p_cpu);
 #endif
-		PRELE(p);
 	}
 }
 
diff --git a/sys/kern/sched_bsd.c b/sys/kern/sched_bsd.c
index 45c76eb7a3a..a62c5248b86 100644
--- a/sys/kern/sched_bsd.c
+++ b/sys/kern/sched_bsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched_bsd.c,v 1.8 2006/11/15 17:25:40 jmc Exp $	*/
+/*	$OpenBSD: sched_bsd.c,v 1.9 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*-
@@ -310,7 +310,6 @@ schedcpu(void *arg)
 		if (p->p_priority >= PUSER) {
 			if ((p != curproc) &&
 			    p->p_stat == SRUN &&
-			    (p->p_flag & P_INMEM) &&
 			    (p->p_priority / PPQ) != (p->p_usrpri / PPQ)) {
 				remrunqueue(p);
 				p->p_priority = p->p_usrpri;
@@ -618,15 +617,11 @@ setrunnable(struct proc *p)
 		break;
 	}
 	p->p_stat = SRUN;
-	if (p->p_flag & P_INMEM)
-		setrunqueue(p);
+	setrunqueue(p);
 	if (p->p_slptime > 1)
 		updatepri(p);
 	p->p_slptime = 0;
-	if ((p->p_flag & P_INMEM) == 0)
-		wakeup(&proc0);
-	else
-		resched_proc(p, p->p_priority);
+	resched_proc(p, p->p_priority);
 }
 
 /*
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index 55554087a5a..e60ff8b7ef7 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_process.c,v 1.36 2006/07/19 18:38:42 grunk Exp $	*/
+/*	$OpenBSD: sys_process.c,v 1.37 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
 
 /*-
@@ -322,7 +322,6 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
 			return (EINVAL);
 
-		PHOLD(t);
 		/* If the address parameter is not (int *)1, set the pc. */
 		if ((int *)SCARG(uap, addr) != (int *)1)
 			if ((error = process_set_pc(t, SCARG(uap, addr))) != 0)
@@ -336,7 +335,6 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		if (error)
 			goto relebad;
 #endif
-		PRELE(t);
 		goto sendsig;
 
 	case  PT_DETACH:
@@ -356,7 +354,6 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
 			return (EINVAL);
 
-		PHOLD(t);
 #ifdef PT_STEP
 		/*
 		 * Arrange for a single-step, if that's requested and possible.
@@ -365,7 +362,6 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		if (error)
 			goto relebad;
 #endif
-		PRELE(t);
 
 		/* give process back to original parent or init */
 		if (t->p_oppid != t->p_pptr->p_pid) {
@@ -395,7 +391,6 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		return (0);
 
 	relebad:
-		PRELE(t);
 		return (error);
 
 	case  PT_KILL:
@@ -451,9 +446,7 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		regs = malloc(sizeof(*regs), M_TEMP, M_WAITOK);
 		error = copyin(SCARG(uap, addr), regs, sizeof(*regs));
 		if (error == 0) {
-			PHOLD(p);
 			error = process_write_regs(t, regs);
-			PRELE(p);
 		}
 		free(regs, M_TEMP);
 		return (error);
@@ -463,9 +456,7 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 			return (error);
 
 		regs = malloc(sizeof(*regs), M_TEMP, M_WAITOK);
-		PHOLD(p);
 		error = process_read_regs(t, regs);
-		PRELE(p);
 		if (error == 0)
 			error = copyout(regs,
 			    SCARG(uap, addr), sizeof (*regs));
@@ -480,9 +471,7 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		fpregs = malloc(sizeof(*fpregs), M_TEMP, M_WAITOK);
 		error = copyin(SCARG(uap, addr), fpregs, sizeof(*fpregs));
 		if (error == 0) {
-			PHOLD(p);
 			error = process_write_fpregs(t, fpregs);
-			PRELE(p);
 		}
 		free(fpregs, M_TEMP);
 		return (error);
@@ -494,9 +483,7 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 			return (error);
 
 		fpregs = malloc(sizeof(*fpregs), M_TEMP, M_WAITOK);
-		PHOLD(p);
 		error = process_read_fpregs(t, fpregs);
-		PRELE(p);
 		if (error == 0)
 			error = copyout(fpregs,
 			    SCARG(uap, addr), sizeof(*fpregs));
@@ -512,9 +499,7 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 		xmmregs = malloc(sizeof(*xmmregs), M_TEMP, M_WAITOK);
 		error = copyin(SCARG(uap, addr), xmmregs, sizeof(*xmmregs));
 		if (error == 0) {
-			PHOLD(p);
 			error = process_write_xmmregs(t, xmmregs);
-			PRELE(p);
 		}
 		free(xmmregs, M_TEMP);
 		return (error);
@@ -526,9 +511,7 @@ sys_ptrace(struct proc *p, void *v, register_t *retval)
 			return (error);
 
 		xmmregs = malloc(sizeof(*xmmregs), M_TEMP, M_WAITOK);
-		PHOLD(p);
 		error = process_read_xmmregs(t, xmmregs);
-		PRELE(p);
 		if (error == 0)
 			error = copyout(xmmregs,
 			    SCARG(uap, addr), sizeof(*xmmregs));
diff --git a/sys/miscfs/procfs/procfs_cmdline.c b/sys/miscfs/procfs/procfs_cmdline.c
index bd9d9c68e52..5e07d4fa122 100644
--- a/sys/miscfs/procfs/procfs_cmdline.c
+++ b/sys/miscfs/procfs/procfs_cmdline.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_cmdline.c,v 1.6 2005/12/11 21:30:31 miod Exp $	*/
+/*	$OpenBSD: procfs_cmdline.c,v 1.7 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: procfs_cmdline.c,v 1.3 1999/03/13 22:26:48 thorpej Exp $	*/
 
 /*
@@ -106,7 +106,6 @@ procfs_docmdline(curp, p, pfs, uio)
 		free(arg, M_TEMP);
 		return (EFAULT);
 	}
-	PHOLD(p);
 	p->p_vmspace->vm_refcnt++;	/* XXX */
 
 	/*
@@ -183,7 +182,6 @@ procfs_docmdline(curp, p, pfs, uio)
 
 
  bad:
-	PRELE(p);
 	uvmspace_free(p->p_vmspace);
 	free(arg, M_TEMP);
 	return (error);
diff --git a/sys/miscfs/procfs/procfs_ctl.c b/sys/miscfs/procfs/procfs_ctl.c
index d5ba6e0df87..917691eb0f9 100644
--- a/sys/miscfs/procfs/procfs_ctl.c
+++ b/sys/miscfs/procfs/procfs_ctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_ctl.c,v 1.18 2006/08/28 20:53:18 tsi Exp $	*/
+/*	$OpenBSD: procfs_ctl.c,v 1.19 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: procfs_ctl.c,v 1.14 1996/02/09 22:40:48 christos Exp $	*/
 
 /*
@@ -208,9 +208,7 @@ procfs_control(curp, p, op)
 	 */
 	case PROCFS_CTL_STEP:
 #ifdef PT_STEP
-		PHOLD(p);
 		error = process_sstep(p, 1);
-		PRELE(p);
 		if (error)
 			return (error);
 		break;
diff --git a/sys/miscfs/procfs/procfs_status.c b/sys/miscfs/procfs/procfs_status.c
index 0d1a117ffc0..0f26fbf9a52 100644
--- a/sys/miscfs/procfs/procfs_status.c
+++ b/sys/miscfs/procfs/procfs_status.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_status.c,v 1.8 2004/05/05 23:52:10 tedu Exp $	*/
+/*	$OpenBSD: procfs_status.c,v 1.9 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: procfs_status.c,v 1.11 1996/03/16 23:52:50 christos Exp $	*/
 
 /*
@@ -119,11 +119,8 @@ procfs_stat_gen(p, s, l)
 		COUNTORCAT(s, l, ps, n);
 	}
 
-	if (p->p_flag & P_INMEM)
-		snprintf(ps, sizeof(ps), " %ld,%ld",
-		    p->p_stats->p_start.tv_sec, p->p_stats->p_start.tv_usec);
-	else
-		snprintf(ps, sizeof(ps), " -1,-1");
+	snprintf(ps, sizeof(ps), " %ld,%ld",
+	    p->p_stats->p_start.tv_sec, p->p_stats->p_start.tv_usec);
 	COUNTORCAT(s, l, ps, n);
 
 	calcru(p, &ut, &st, (void *) 0);
diff --git a/sys/nfs/nfs_bio.c b/sys/nfs/nfs_bio.c
index 480fe1e76bd..9137c5e7ab8 100644
--- a/sys/nfs/nfs_bio.c
+++ b/sys/nfs/nfs_bio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_bio.c,v 1.43 2006/11/01 00:12:35 thib Exp $	*/
+/*	$OpenBSD: nfs_bio.c,v 1.44 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: nfs_bio.c,v 1.25.4.2 1996/07/08 20:47:04 jtc Exp $	*/
 
 /*
@@ -671,7 +671,6 @@ nfs_doio(bp, p)
 		    (np->n_mtime != np->n_vattr.va_mtime.tv_sec)) {
 			uprintf("Process killed due to text file modification\n");
 			psignal(p, SIGKILL);
-			p->p_holdcnt++;
 		}
 		break;
 	    case VLNK:
diff --git a/sys/nfs/nfs_syscalls.c b/sys/nfs/nfs_syscalls.c
index 584ab092e68..25e956d0f8c 100644
--- a/sys/nfs/nfs_syscalls.c
+++ b/sys/nfs/nfs_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_syscalls.c,v 1.49 2006/10/04 12:04:40 pedro Exp $	*/
+/*	$OpenBSD: nfs_syscalls.c,v 1.50 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: nfs_syscalls.c,v 1.19 1996/02/18 11:53:52 fvdl Exp $	*/
 
 /*
@@ -520,7 +520,6 @@ nfssvc_nfsd(nsd, argp, p)
 		TAILQ_INSERT_TAIL(&nfsd_head, nfsd, nfsd_chain);
 		nfs_numnfsd++;
 	}
-	PHOLD(p);
 	/*
 	 * Loop getting rpc requests until SIGKILL.
 	 */
@@ -622,7 +621,6 @@ nfssvc_nfsd(nsd, argp, p)
 			    !copyout(nfsd->nfsd_verfstr, nsd->nsd_verfstr,
 				nfsd->nfsd_verflen) &&
 			    !copyout((caddr_t)nsd, argp, sizeof (*nsd))) {
-			    PRELE(p);
 			    return (ENEEDAUTH);
 			}
 			cacherep = RC_DROPIT;
@@ -747,7 +745,6 @@ nfssvc_nfsd(nsd, argp, p)
 		}
 	}
 done:
-	PRELE(p);
 	TAILQ_REMOVE(&nfsd_head, nfsd, nfsd_chain);
 	splx(s);
 	free((caddr_t)nfsd, M_NFSD);
@@ -934,7 +931,6 @@ nfssvc_iod(p)
 		return (EBUSY);
 	nfs_asyncdaemon[myiod] = p;
 	nfs_numasync++;
-	PHOLD(p);
 	/*
 	 * Just loop around doin our stuff until SIGKILL
 	 */
@@ -982,7 +978,6 @@ nfssvc_iod(p)
 		} while ((bp = nbp) != NULL);
 	    }
 	    if (error) {
-		PRELE(p);
 		nfs_asyncdaemon[myiod] = NULL;
 		nfs_numasync--;
 		return (error);
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 507c48ce3e7..65ad8c42bf4 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.88 2006/06/28 14:17:07 mickey Exp $	*/
+/*	$OpenBSD: proc.h,v 1.89 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -202,7 +202,6 @@ struct	proc {
 
 	struct	vnode *p_textvp;	/* Vnode of executable. */
 
-	int	p_holdcnt;		/* If non-zero, don't swap. */
 	struct	emul *p_emul;		/* Emulation information */
 	void	*p_emuldata;		/* Per-process emulation data, or */
 					/* NULL. Malloc type M_EMULDATA */
@@ -258,7 +257,7 @@ struct	proc {
 /* These flags are kept in p_flag. */
 #define	P_ADVLOCK	0x000001	/* Proc may hold a POSIX adv. lock. */
 #define	P_CONTROLT	0x000002	/* Has a controlling terminal. */
-#define	P_INMEM		0x000004	/* Loaded into memory. */
+#define	P_INMEM		0x000004	/* Loaded into memory. UNUSED */
 #define	P_NOCLDSTOP	0x000008	/* No SIGCHLD when children stop. */
 #define	P_PPWAIT	0x000010	/* Parent waits for child exec/exit. */
 #define	P_PROFIL	0x000020	/* Has started profiling. */
@@ -285,17 +284,16 @@ struct	proc {
 #define P_INEXEC	0x200000	/* Process is doing an exec right now */
 #define P_SYSTRACE	0x400000	/* Process system call tracing active*/
 #define P_CONTINUED	0x800000	/* Proc has continued from a stopped state. */
-#define P_SWAPIN	0x1000000	/* Swapping in right now */
 #define P_BIGLOCK	0x2000000	/* Process needs kernel "big lock" to run */
 #define	P_THREAD	0x4000000	/* Only a thread, not a real process */
 #define	P_IGNEXITRV	0x8000000	/* For thread kills */
 #define	P_SOFTDEP	0x10000000	/* Stuck processing softdep worklist */
 
 #define	P_BITS \
-    ("\20\01ADVLOCK\02CTTY\03INMEM\04NOCLDSTOP\05PPWAIT\06PROFIL\07SELECT" \
+    ("\20\01ADVLOCK\02CTTY\04NOCLDSTOP\05PPWAIT\06PROFIL\07SELECT" \
      "\010SINTR\011SUGID\012SYSTEM\013TIMEOUT\014TRACED\015WAITED\016WEXIT" \
      "\017EXEC\020PWEUPC\022SSTEP\023SUGIDEXEC\024NOCLDWAIT" \
-     "\025NOZOMBIE\026INEXEC\027SYSTRACE\030CONTINUED\031SWAPIN\032BIGLOCK" \
+     "\025NOZOMBIE\026INEXEC\027SYSTRACE\030CONTINUED\032BIGLOCK" \
      "\033THREAD\034IGNEXITRV\035SOFTDEP")
 
 /* Macro to compute the exit signal to be delivered. */
@@ -355,12 +353,6 @@ struct uidinfo *uid_find(uid_t);
 		pool_put(&session_pool, s);				\
 }
 
-#define	PHOLD(p) {							\
-	if ((p)->p_holdcnt++ == 0 && ((p)->p_flag & P_INMEM) == 0)	\
-		uvm_swapin(p);						\
-}
-#define	PRELE(p)	(--(p)->p_holdcnt)
-
 /*
  * Flags to fork1().
  */
@@ -440,7 +432,6 @@ void	setrunnable(struct proc *);
 #if !defined(setrunqueue)
 void	setrunqueue(struct proc *);
 #endif
-void	uvm_swapin(struct proc *);  /* XXX: uvm_extern.h? */
 int	ltsleep(void *chan, int pri, const char *wmesg, int timo,
 	    volatile struct simplelock *);
 #define tsleep(chan, pri, wmesg, timo) ltsleep(chan, pri, wmesg, timo, NULL)
@@ -476,3 +467,4 @@ int proc_isunder(struct proc *, struct proc *);
 
 #endif	/* _KERNEL */
 #endif	/* !_SYS_PROC_H_ */
+
diff --git a/sys/uvm/uvm_extern.h b/sys/uvm/uvm_extern.h
index c800b34331f..299ae7a8176 100644
--- a/sys/uvm/uvm_extern.h
+++ b/sys/uvm/uvm_extern.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_extern.h,v 1.60 2006/11/29 12:17:33 miod Exp $	*/
+/*	$OpenBSD: uvm_extern.h,v 1.61 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: uvm_extern.h,v 1.57 2001/03/09 01:02:12 chs Exp $	*/
 
 /*
@@ -480,7 +480,7 @@ void			uvm_exit(struct proc *);
 void			uvm_init_limits(struct proc *);
 boolean_t		uvm_kernacc(caddr_t, size_t, int);
 __dead void		uvm_scheduler(void);
-void			uvm_swapin(struct proc *);
+
 int			uvm_vslock(struct proc *, caddr_t, size_t,
 			    vm_prot_t);
 void			uvm_vsunlock(struct proc *, caddr_t, size_t);
diff --git a/sys/uvm/uvm_glue.c b/sys/uvm/uvm_glue.c
index c7bfa5e21ab..2445a64c641 100644
--- a/sys/uvm/uvm_glue.c
+++ b/sys/uvm/uvm_glue.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_glue.c,v 1.44 2006/05/25 22:42:22 miod Exp $	*/
+/*	$OpenBSD: uvm_glue.c,v 1.45 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: uvm_glue.c,v 1.44 2001/02/06 19:54:44 eeh Exp $	*/
 
 /* 
@@ -87,12 +87,6 @@
 #include <machine/cpu.h>
 
 /*
- * local prototypes
- */
-
-static void uvm_swapout(struct proc *);
-
-/*
  * XXXCDC: do these really belong here?
  */
 
@@ -254,7 +248,6 @@ uvm_fork(p1, p2, shared, stack, stacksize, func, arg)
 	void *arg;
 {
 	struct user *up = p2->p_addr;
-	int rv;
 
 	if (shared == TRUE) {
 		p2->p_vmspace = NULL;
@@ -262,20 +255,6 @@ uvm_fork(p1, p2, shared, stack, stacksize, func, arg)
 	} else
 		p2->p_vmspace = uvmspace_fork(p1->p_vmspace); /* fork vmspace */
 
-	/*
-	 * Wire down the U-area for the process, which contains the PCB
-	 * and the kernel stack.  Wired state is stored in p->p_flag's
-	 * P_INMEM bit rather than in the vm_map_entry's wired count
-	 * to prevent kernel_map fragmentation.
-	 *
-	 * Note the kernel stack gets read/write accesses right off
-	 * the bat.
-	 */
-	rv = uvm_fault_wire(kernel_map, (vaddr_t)up,
-	    (vaddr_t)up + USPACE, VM_PROT_READ | VM_PROT_WRITE);
-	if (rv != KERN_SUCCESS)
-		panic("uvm_fork: uvm_fault_wire failed: %d", rv);
-
 #ifdef PMAP_UAREA
 	/* Tell the pmap this is a u-area mapping */
 	PMAP_UAREA((vaddr_t)up);
@@ -312,15 +291,10 @@ uvm_fork(p1, p2, shared, stack, stacksize, func, arg)
  *   of the dead process may block.
  */
 void
-uvm_exit(p)
-	struct proc *p;
+uvm_exit(struct proc *p)
 {
-	vaddr_t va = (vaddr_t)p->p_addr;
-
 	uvmspace_free(p->p_vmspace);
-	p->p_flag &= ~P_INMEM;
-	uvm_fault_unwire(kernel_map, va, va + USPACE);
-	uvm_km_free(kernel_map, va, USPACE);
+	uvm_km_free(kernel_map, (vaddr_t)p->p_addr, USPACE);
 	p->p_addr = NULL;
 }
 
@@ -330,8 +304,7 @@ uvm_exit(p)
  * - called for process 0 and then inherited by all others.
  */
 void
-uvm_init_limits(p)
-	struct proc *p;
+uvm_init_limits(struct proc *p)
 {
 
 	/*
@@ -357,123 +330,19 @@ int	swapdebug = 0;
 #endif
 
 /*
- * uvm_swapin: swap in a process's u-area.
- */
-
-void
-uvm_swapin(p)
-	struct proc *p;
-{
-	vaddr_t addr;
-	int rv, s;
-
-	s = splstatclock();
-	if (p->p_flag & P_SWAPIN) {
-		splx(s);
-		return;
-	}
-	p->p_flag |= P_SWAPIN;
-	splx(s);
-
-	addr = (vaddr_t)p->p_addr;
-	/* make P_INMEM true */
-	if ((rv = uvm_fault_wire(kernel_map, addr, addr + USPACE,
-	    VM_PROT_READ | VM_PROT_WRITE)) != KERN_SUCCESS)
-		panic("uvm_swapin: uvm_fault_wire failed: %d", rv);
-
-	/*
-	 * Some architectures need to be notified when the user area has
-	 * moved to new physical page(s) (e.g.  see mips/mips/vm_machdep.c).
-	 */
-	cpu_swapin(p);
-	SCHED_LOCK(s);
-	if (p->p_stat == SRUN)
-		setrunqueue(p);
-	p->p_flag |= P_INMEM;
-	p->p_flag &= ~P_SWAPIN;
-	p->p_swtime = 0;
-	SCHED_UNLOCK(s);
-	++uvmexp.swapins;
-}
-
-/*
  * uvm_scheduler: process zero main loop
  *
- * - attempt to swapin every swaped-out, runnable process in order of
- *	priority.
  * - if not enough memory, wake the pagedaemon and let it clear space.
  */
 
 void
-uvm_scheduler()
+uvm_scheduler(void)
 {
-	struct proc *p;
-	int pri;
-	struct proc *pp;
-	int ppri;
-
-loop:
-#ifdef DEBUG
-	while (!enableswap)
-		tsleep(&proc0, PVM, "noswap", 0);
-#endif
-	pp = NULL;		/* process to choose */
-	ppri = INT_MIN;	/* its priority */
-	LIST_FOREACH(p, &allproc, p_list) {
-
-		/* is it a runnable swapped out process? */
-		if (p->p_stat == SRUN && (p->p_flag & P_INMEM) == 0) {
-			pri = p->p_swtime + p->p_slptime -
-			    (p->p_nice - NZERO) * 8;
-			if (pri > ppri) {   /* higher priority?  remember it. */
-				pp = p;
-				ppri = pri;
-			}
-		}
-	}
-
-#ifdef DEBUG
-	if (swapdebug & SDB_FOLLOW)
-		printf("scheduler: running, procp %p pri %d\n", pp, ppri);
-#endif
 	/*
 	 * Nothing to do, back to sleep
 	 */
-	if ((p = pp) == NULL) {
-		tsleep(&proc0, PVM, "scheduler", 0);
-		goto loop;
-	}
-
-	/*
-	 * we have found swapped out process which we would like to bring
-	 * back in.
-	 *
-	 * XXX: this part is really bogus because we could deadlock on memory
-	 * despite our feeble check
-	 */
-	if (uvmexp.free > atop(USPACE)) {
-#ifdef DEBUG
-		if (swapdebug & SDB_SWAPIN)
-			printf("swapin: pid %d(%s)@%p, pri %d free %d\n",
-	     p->p_pid, p->p_comm, p->p_addr, ppri, uvmexp.free);
-#endif
-		uvm_swapin(p);
-		goto loop;
-	}
-	/*
-	 * not enough memory, jab the pageout daemon and wait til the coast
-	 * is clear
-	 */
-#ifdef DEBUG
-	if (swapdebug & SDB_FOLLOW)
-		printf("scheduler: no room for pid %d(%s), free %d\n",
-	   p->p_pid, p->p_comm, uvmexp.free);
-#endif
-	uvm_wait("schedpwait");
-#ifdef DEBUG
-	if (swapdebug & SDB_FOLLOW)
-		printf("scheduler: room again, free %d\n", uvmexp.free);
-#endif
+loop:
+	tsleep(&proc0, PVM, "scheduler", 0);
 	goto loop;
 }
 
@@ -481,13 +350,10 @@ loop:
  * swappable: is process "p" swappable?
  */
 
-#define	swappable(p)							\
-	(((p)->p_flag & (P_SYSTEM | P_INMEM | P_WEXIT)) == P_INMEM &&	\
-	 (p)->p_holdcnt == 0)
+#define	swappable(p) (((p)->p_flag & (P_SYSTEM | P_WEXIT)) == 0)
 
 /*
- * swapout_threads: find threads that can be swapped and unwire their
- *	u-areas.
+ * swapout_threads: find threads that can be swapped
  *
  * - called by the pagedaemon
  * - try and swap at least one processs
@@ -496,7 +362,7 @@ loop:
  *   is swapped, otherwise the longest resident process...
  */
 void
-uvm_swapout_threads()
+uvm_swapout_threads(void)
 {
 	struct proc *p;
 	struct proc *outp, *outp2;
@@ -530,7 +396,7 @@ uvm_swapout_threads()
 		case SSLEEP:
 		case SSTOP:
 			if (p->p_slptime >= maxslp) {
-				uvm_swapout(p);
+				pmap_collect(p->p_vmspace->vm_map.pmap);
 				didswap++;
 			} else if (p->p_slptime > outpri) {
 				outp = p;
@@ -544,7 +410,7 @@ uvm_swapout_threads()
 	 * If we didn't get rid of any real duds, toss out the next most
 	 * likely sleeping/stopped or running candidate.  We only do this
 	 * if we are real low on memory since we don't gain much by doing
-	 * it (USPACE bytes).
+	 * it.
 	 */
 	if (didswap == 0 && uvmexp.free <= atop(round_page(USPACE))) {
 		if ((p = outp) == NULL)
@@ -554,58 +420,6 @@ uvm_swapout_threads()
 			printf("swapout_threads: no duds, try procp %p\n", p);
 #endif
 		if (p)
-			uvm_swapout(p);
-	}
-}
-
-/*
- * uvm_swapout: swap out process "p"
- *
- * - currently "swapout" means "unwire U-area" and "pmap_collect()" 
- *   the pmap.
- * - XXXCDC: should deactivate all process' private anonymous memory
- */
-
-static void
-uvm_swapout(p)
-	struct proc *p;
-{
-	vaddr_t addr;
-	int s;
-
-#ifdef DEBUG
-	if (swapdebug & SDB_SWAPOUT)
-		printf("swapout: pid %d(%s)@%p, stat %x pri %d free %d\n",
-		    p->p_pid, p->p_comm, p->p_addr, p->p_stat,
-		    p->p_slptime, uvmexp.free);
-#endif
-
-	/*
-	 * Mark it as (potentially) swapped out.
-	 */
-	SCHED_LOCK(s);
-	if (!(p->p_flag & P_INMEM)) {
-		SCHED_UNLOCK(s);
-		return;
+			pmap_collect(p->p_vmspace->vm_map.pmap);
 	}
-	p->p_flag &= ~P_INMEM;
-	if (p->p_stat == SRUN)
-		remrunqueue(p);
-	p->p_swtime = 0;
-	SCHED_UNLOCK(s);
-	++uvmexp.swapouts;
-
-	/*
-	 * Do any machine-specific actions necessary before swapout.
-	 * This can include saving floating point state, etc.
-	 */
-	cpu_swapout(p);
-
-	/*
-	 * Unwire the to-be-swapped process's user struct and kernel stack.
-	 */
-	addr = (vaddr_t)p->p_addr;
-	uvm_fault_unwire(kernel_map, addr, addr + USPACE); /* !P_INMEM */
-	pmap_collect(vm_map_pmap(&p->p_vmspace->vm_map));
 }
-
diff --git a/sys/uvm/uvm_meter.c b/sys/uvm/uvm_meter.c
index 938c9702506..143104c113d 100644
--- a/sys/uvm/uvm_meter.c
+++ b/sys/uvm/uvm_meter.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_meter.c,v 1.20 2004/06/21 23:50:38 tholo Exp $	*/
+/*	$OpenBSD: uvm_meter.c,v 1.21 2006/11/29 12:24:18 miod Exp $	*/
 /*	$NetBSD: uvm_meter.c,v 1.21 2001/07/14 06:36:03 matt Exp $	*/
 
 /*
@@ -251,13 +251,10 @@ uvm_total(totalp)
 
 		case SSLEEP:
 		case SSTOP:
-			if (p->p_flag & P_INMEM) {
-				if (p->p_priority <= PZERO)
-					totalp->t_dw++;
-				else if (p->p_slptime < maxslp)
-					totalp->t_sl++;
-			} else if (p->p_slptime < maxslp)
-				totalp->t_sw++;
+			if (p->p_priority <= PZERO)
+				totalp->t_dw++;
+			else if (p->p_slptime < maxslp)
+				totalp->t_sl++;
 			if (p->p_slptime >= maxslp)
 				continue;
 			break;
@@ -265,10 +262,7 @@ uvm_total(totalp)
 		case SRUN:
 		case SIDL:
 		case SONPROC:
-			if (p->p_flag & P_INMEM)
-				totalp->t_rq++;
-			else
-				totalp->t_sw++;
+			totalp->t_rq++;
 			if (p->p_stat == SIDL)
 				continue;
 			break;