>> (2) as the exec completes and the new process gets its arguments
>> copied into the top of it's stack, a fault is incurred, which gets
>> resolved by a 16 slot amap (see UVM_AMAP_CHUNK in uvm/uvm_amap.h)
>> being attached to a small map entry that gets carved off the "soft"
>> chunk. 
>> [...]
>
>Since you are the author of the "pmap" utility by some coincidence:-)

well...that was how i learned about uvm.  i wrote a program to rip it
apart and show me all the pieces.  besides, i figured it would be
really good to have a program that did that, much beyond the shear
hack value of it (in which it scored very highly, imho).

>It would be great if "pmap" could show which pages of a map entry
>are backed by anons. Currently it only shows (with -d) whether an
>amap got allocated at all.
>(would have saved me a lot of digging with gdb when I was PICifying
>some assembler code recently)

i have patches to pmap to do that.  for example, from my tcsh
instance's data segment:

% pmap -D104
...
vm_map_entry 0xcf7eb940 = { prev = 0xcf7eb8c0, next = 0xcf7eba40,
    start = 808b000, end = 808f000, object.uvm_obj/sub_map = 0xcf70547c,
    offset = 42000, etype = 5 < OBJ COW >, protection = 3,
    max_protection = 7, inheritance = 1, wired_count = 0,
    aref = { ar_pageoff = 0, ar_amap = 0xcf789e6c }, advice = 0,
    flags = 0 < > }
  amap 0xcf789e6c = { am_l = <struct simplelock>, am_ref = 1, am_flags = 0,
      am_maxslot = 4, am_nslot = 4, am_nused = 4, am_slots = 0xc0a32550,
      am_bckptr = 0xc0a32250, am_anon = 0xc0a32480, am_ppref = 0x0 }
 page# am_bckptr  am_slots     am_anon
     0         0         0  0xcf568720
     1         1         1  0xcf567920
     2         2         2  0xcf5454c0
     3         3         3  0xcf553ad0
0808B000     16K read/write        /usr/pkg/bin/tcsh
...
% pmap -D232
vm_map_entry 0xcf7eb940 = { prev = 0xcf7eb8c0, next = 0xcf7eba40,
    start = 808b000, end = 808f000, object.uvm_obj/sub_map = 0xcf70547c,
    offset = 42000, etype = 5 < OBJ COW >, protection = 3,
    max_protection = 7, inheritance = 1, wired_count = 0,
    aref = { ar_pageoff = 0, ar_amap = 0xcf789e6c }, advice = 0,
    flags = 0 < > }
  amap 0xcf789e6c = { am_l = <struct simplelock>, am_ref = 1, am_flags = 0,
      am_maxslot = 4, am_nslot = 4, am_nused = 4, am_slots = 0xc0a32550,
      am_bckptr = 0xc0a32250, am_anon = 0xc0a32480, am_ppref = 0x0 }
 page# am_bckptr  am_slots     am_anon
     0         0         0  0xcf568720 = { an_ref = 1, an_lock = <struct simplelock>, an_nxt/an_page = 0xc06b8bb0, an_swslot = 0 }
     1         1         1  0xcf567920 = { an_ref = 1, an_lock = <struct simplelock>, an_nxt/an_page = 0xc06b9674, an_swslot = 0 }
     2         2         2  0xcf5454c0 = { an_ref = 1, an_lock = <struct simplelock>, an_nxt/an_page = 0xc0745ac8, an_swslot = 0 }
     3         3         3  0xcf553ad0 = { an_ref = 1, an_lock = <struct simplelock>, an_nxt/an_page = 0xc0770750, an_swslot = 0 }
0808B000     16K read/write        /usr/pkg/bin/tcsh

as you can see, it starts to get really wide and unwieldy and the
attempts at reasonable "formatting" that i did all looked pretty
grotesque, so i just punted on that.  i've had them for a while (since
around when i started mucking with amaps, so about six months), but
i've been sitting on them, pending finishing other work.  i'll send
them to you under a separate cover.

note: i'm not sure what the "security considerations" of this might
be, since it digs pretty deeply into what a process is doing, though
it's neat to be able to run "cd /proc ; pmap -D232 [1-9]*" and use a
simple awk script to count swapped out pages.  :)

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."