xref: /freebsd/sys/vm/uma_core.c (revision 098ca2bda93c701c5331d4e6aace072495b4caaa)
1 /*
2  * Copyright (c) 2004, 2005,
3  *     Bosko Milekic <bmilekic@freebsd.org>
4  * Copyright (c) 2002, 2003, 2004, 2005,
5  *     Jeffrey Roberson <jeff@freebsd.org>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice unmodified, this list of conditions, and the following
12  *    disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * uma_core.c  Implementation of the Universal Memory allocator
31  *
32  * This allocator is intended to replace the multitude of similar object caches
33  * in the standard FreeBSD kernel.  The intent is to be flexible as well as
34  * effecient.  A primary design goal is to return unused memory to the rest of
35  * the system.  This will make the system as a whole more flexible due to the
36  * ability to move memory to subsystems which most need it instead of leaving
37  * pools of reserved memory unused.
38  *
39  * The basic ideas stem from similar slab/zone based allocators whose algorithms
40  * are well known.
41  *
42  */
43 
44 /*
45  * TODO:
46  *	- Improve memory usage for large allocations
47  *	- Investigate cache size adjustments
48  */
49 
50 #include <sys/cdefs.h>
51 __FBSDID("$FreeBSD$");
52 
53 /* I should really use ktr.. */
54 /*
55 #define UMA_DEBUG 1
56 #define UMA_DEBUG_ALLOC 1
57 #define UMA_DEBUG_ALLOC_1 1
58 */
59 
60 #include "opt_param.h"
61 #include <sys/param.h>
62 #include <sys/systm.h>
63 #include <sys/kernel.h>
64 #include <sys/types.h>
65 #include <sys/queue.h>
66 #include <sys/malloc.h>
67 #include <sys/ktr.h>
68 #include <sys/lock.h>
69 #include <sys/sysctl.h>
70 #include <sys/mutex.h>
71 #include <sys/proc.h>
72 #include <sys/smp.h>
73 #include <sys/vmmeter.h>
74 
75 #include <vm/vm.h>
76 #include <vm/vm_object.h>
77 #include <vm/vm_page.h>
78 #include <vm/vm_param.h>
79 #include <vm/vm_map.h>
80 #include <vm/vm_kern.h>
81 #include <vm/vm_extern.h>
82 #include <vm/uma.h>
83 #include <vm/uma_int.h>
84 #include <vm/uma_dbg.h>
85 
86 #include <machine/vmparam.h>
87 
88 /*
89  * This is the zone and keg from which all zones are spawned.  The idea is that
90  * even the zone & keg heads are allocated from the allocator, so we use the
91  * bss section to bootstrap us.
92  */
93 static struct uma_keg masterkeg;
94 static struct uma_zone masterzone_k;
95 static struct uma_zone masterzone_z;
96 static uma_zone_t kegs = &masterzone_k;
97 static uma_zone_t zones = &masterzone_z;
98 
99 /* This is the zone from which all of uma_slab_t's are allocated. */
100 static uma_zone_t slabzone;
101 static uma_zone_t slabrefzone;	/* With refcounters (for UMA_ZONE_REFCNT) */
102 
103 /*
104  * The initial hash tables come out of this zone so they can be allocated
105  * prior to malloc coming up.
106  */
107 static uma_zone_t hashzone;
108 
109 static MALLOC_DEFINE(M_UMAHASH, "UMAHash", "UMA Hash Buckets");
110 
111 /*
112  * Are we allowed to allocate buckets?
113  */
114 static int bucketdisable = 1;
115 
116 /* Linked list of all kegs in the system */
117 static LIST_HEAD(,uma_keg) uma_kegs = LIST_HEAD_INITIALIZER(&uma_kegs);
118 
119 /* This mutex protects the keg list */
120 static struct mtx uma_mtx;
121 
122 /* These are the pcpu cache locks */
123 static struct mtx uma_pcpu_mtx[MAXCPU];
124 
125 /* Linked list of boot time pages */
126 static LIST_HEAD(,uma_slab) uma_boot_pages =
127     LIST_HEAD_INITIALIZER(&uma_boot_pages);
128 
129 /* Count of free boottime pages */
130 static int uma_boot_free = 0;
131 
132 /* Is the VM done starting up? */
133 static int booted = 0;
134 
135 /* Maximum number of allowed items-per-slab if the slab header is OFFPAGE */
136 static u_int uma_max_ipers;
137 static u_int uma_max_ipers_ref;
138 
139 /*
140  * This is the handle used to schedule events that need to happen
141  * outside of the allocation fast path.
142  */
143 static struct callout uma_callout;
144 #define	UMA_TIMEOUT	20		/* Seconds for callout interval. */
145 
146 /*
147  * This structure is passed as the zone ctor arg so that I don't have to create
148  * a special allocation function just for zones.
149  */
150 struct uma_zctor_args {
151 	char *name;
152 	size_t size;
153 	uma_ctor ctor;
154 	uma_dtor dtor;
155 	uma_init uminit;
156 	uma_fini fini;
157 	uma_keg_t keg;
158 	int align;
159 	u_int16_t flags;
160 };
161 
162 struct uma_kctor_args {
163 	uma_zone_t zone;
164 	size_t size;
165 	uma_init uminit;
166 	uma_fini fini;
167 	int align;
168 	u_int16_t flags;
169 };
170 
171 struct uma_bucket_zone {
172 	uma_zone_t	ubz_zone;
173 	char		*ubz_name;
174 	int		ubz_entries;
175 };
176 
177 #define	BUCKET_MAX	128
178 
179 struct uma_bucket_zone bucket_zones[] = {
180 	{ NULL, "16 Bucket", 16 },
181 	{ NULL, "32 Bucket", 32 },
182 	{ NULL, "64 Bucket", 64 },
183 	{ NULL, "128 Bucket", 128 },
184 	{ NULL, NULL, 0}
185 };
186 
187 #define	BUCKET_SHIFT	4
188 #define	BUCKET_ZONES	((BUCKET_MAX >> BUCKET_SHIFT) + 1)
189 
190 /*
191  * bucket_size[] maps requested bucket sizes to zones that allocate a bucket
192  * of approximately the right size.
193  */
194 static uint8_t bucket_size[BUCKET_ZONES];
195 
196 enum zfreeskip { SKIP_NONE, SKIP_DTOR, SKIP_FINI };
197 
198 /* Prototypes.. */
199 
200 static void *obj_alloc(uma_zone_t, int, u_int8_t *, int);
201 static void *page_alloc(uma_zone_t, int, u_int8_t *, int);
202 static void *startup_alloc(uma_zone_t, int, u_int8_t *, int);
203 static void page_free(void *, int, u_int8_t);
204 static uma_slab_t slab_zalloc(uma_zone_t, int);
205 static void cache_drain(uma_zone_t);
206 static void bucket_drain(uma_zone_t, uma_bucket_t);
207 static void bucket_cache_drain(uma_zone_t zone);
208 static int keg_ctor(void *, int, void *, int);
209 static void keg_dtor(void *, int, void *);
210 static int zone_ctor(void *, int, void *, int);
211 static void zone_dtor(void *, int, void *);
212 static int zero_init(void *, int, int);
213 static void zone_small_init(uma_zone_t zone);
214 static void zone_large_init(uma_zone_t zone);
215 static void zone_foreach(void (*zfunc)(uma_zone_t));
216 static void zone_timeout(uma_zone_t zone);
217 static int hash_alloc(struct uma_hash *);
218 static int hash_expand(struct uma_hash *, struct uma_hash *);
219 static void hash_free(struct uma_hash *hash);
220 static void uma_timeout(void *);
221 static void uma_startup3(void);
222 static void *uma_zalloc_internal(uma_zone_t, void *, int);
223 static void uma_zfree_internal(uma_zone_t, void *, void *, enum zfreeskip);
224 static void bucket_enable(void);
225 static void bucket_init(void);
226 static uma_bucket_t bucket_alloc(int, int);
227 static void bucket_free(uma_bucket_t);
228 static void bucket_zone_drain(void);
229 static int uma_zalloc_bucket(uma_zone_t zone, int flags);
230 static uma_slab_t uma_zone_slab(uma_zone_t zone, int flags);
231 static void *uma_slab_alloc(uma_zone_t zone, uma_slab_t slab);
232 static void zone_drain(uma_zone_t);
233 static uma_zone_t uma_kcreate(uma_zone_t zone, size_t size, uma_init uminit,
234     uma_fini fini, int align, u_int16_t flags);
235 
236 void uma_print_zone(uma_zone_t);
237 void uma_print_stats(void);
238 static int sysctl_vm_zone(SYSCTL_HANDLER_ARGS);
239 
240 #ifdef WITNESS
241 static int nosleepwithlocks = 1;
242 SYSCTL_INT(_debug, OID_AUTO, nosleepwithlocks, CTLFLAG_RW, &nosleepwithlocks,
243     0, "Convert M_WAITOK to M_NOWAIT to avoid lock-held-across-sleep paths");
244 #else
245 static int nosleepwithlocks = 0;
246 SYSCTL_INT(_debug, OID_AUTO, nosleepwithlocks, CTLFLAG_RW, &nosleepwithlocks,
247     0, "Convert M_WAITOK to M_NOWAIT to avoid lock-held-across-sleep paths");
248 #endif
249 SYSCTL_OID(_vm, OID_AUTO, zone, CTLTYPE_STRING|CTLFLAG_RD,
250     NULL, 0, sysctl_vm_zone, "A", "Zone Info");
251 SYSINIT(uma_startup3, SI_SUB_VM_CONF, SI_ORDER_SECOND, uma_startup3, NULL);
252 
253 /*
254  * This routine checks to see whether or not it's safe to enable buckets.
255  */
256 
257 static void
258 bucket_enable(void)
259 {
260 	if (cnt.v_free_count < cnt.v_free_min)
261 		bucketdisable = 1;
262 	else
263 		bucketdisable = 0;
264 }
265 
266 /*
267  * Initialize bucket_zones, the array of zones of buckets of various sizes.
268  *
269  * For each zone, calculate the memory required for each bucket, consisting
270  * of the header and an array of pointers.  Initialize bucket_size[] to point
271  * the range of appropriate bucket sizes at the zone.
272  */
273 static void
274 bucket_init(void)
275 {
276 	struct uma_bucket_zone *ubz;
277 	int i;
278 	int j;
279 
280 	for (i = 0, j = 0; bucket_zones[j].ubz_entries != 0; j++) {
281 		int size;
282 
283 		ubz = &bucket_zones[j];
284 		size = roundup(sizeof(struct uma_bucket), sizeof(void *));
285 		size += sizeof(void *) * ubz->ubz_entries;
286 		ubz->ubz_zone = uma_zcreate(ubz->ubz_name, size,
287 		    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
288 		for (; i <= ubz->ubz_entries; i += (1 << BUCKET_SHIFT))
289 			bucket_size[i >> BUCKET_SHIFT] = j;
290 	}
291 }
292 
293 /*
294  * Given a desired number of entries for a bucket, return the zone from which
295  * to allocate the bucket.
296  */
297 static struct uma_bucket_zone *
298 bucket_zone_lookup(int entries)
299 {
300 	int idx;
301 
302 	idx = howmany(entries, 1 << BUCKET_SHIFT);
303 	return (&bucket_zones[bucket_size[idx]]);
304 }
305 
306 static uma_bucket_t
307 bucket_alloc(int entries, int bflags)
308 {
309 	struct uma_bucket_zone *ubz;
310 	uma_bucket_t bucket;
311 
312 	/*
313 	 * This is to stop us from allocating per cpu buckets while we're
314 	 * running out of UMA_BOOT_PAGES.  Otherwise, we would exhaust the
315 	 * boot pages.  This also prevents us from allocating buckets in
316 	 * low memory situations.
317 	 */
318 	if (bucketdisable)
319 		return (NULL);
320 
321 	ubz = bucket_zone_lookup(entries);
322 	bucket = uma_zalloc_internal(ubz->ubz_zone, NULL, bflags);
323 	if (bucket) {
324 #ifdef INVARIANTS
325 		bzero(bucket->ub_bucket, sizeof(void *) * ubz->ubz_entries);
326 #endif
327 		bucket->ub_cnt = 0;
328 		bucket->ub_entries = ubz->ubz_entries;
329 	}
330 
331 	return (bucket);
332 }
333 
334 static void
335 bucket_free(uma_bucket_t bucket)
336 {
337 	struct uma_bucket_zone *ubz;
338 
339 	ubz = bucket_zone_lookup(bucket->ub_entries);
340 	uma_zfree_internal(ubz->ubz_zone, bucket, NULL, SKIP_NONE);
341 }
342 
343 static void
344 bucket_zone_drain(void)
345 {
346 	struct uma_bucket_zone *ubz;
347 
348 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++)
349 		zone_drain(ubz->ubz_zone);
350 }
351 
352 
353 /*
354  * Routine called by timeout which is used to fire off some time interval
355  * based calculations.  (stats, hash size, etc.)
356  *
357  * Arguments:
358  *	arg   Unused
359  *
360  * Returns:
361  *	Nothing
362  */
363 static void
364 uma_timeout(void *unused)
365 {
366 	bucket_enable();
367 	zone_foreach(zone_timeout);
368 
369 	/* Reschedule this event */
370 	callout_reset(&uma_callout, UMA_TIMEOUT * hz, uma_timeout, NULL);
371 }
372 
373 /*
374  * Routine to perform timeout driven calculations.  This expands the
375  * hashes and does per cpu statistics aggregation.
376  *
377  *  Arguments:
378  *	zone  The zone to operate on
379  *
380  *  Returns:
381  *	Nothing
382  */
383 static void
384 zone_timeout(uma_zone_t zone)
385 {
386 	uma_keg_t keg;
387 	uma_cache_t cache;
388 	u_int64_t alloc;
389 	int cpu;
390 
391 	keg = zone->uz_keg;
392 	alloc = 0;
393 
394 	/*
395 	 * Aggregate per cpu cache statistics back to the zone.
396 	 *
397 	 * XXX This should be done in the sysctl handler.
398 	 *
399 	 * I may rewrite this to set a flag in the per cpu cache instead of
400 	 * locking.  If the flag is not cleared on the next round I will have
401 	 * to lock and do it here instead so that the statistics don't get too
402 	 * far out of sync.
403 	 */
404 	if (!(keg->uk_flags & UMA_ZFLAG_INTERNAL)) {
405 		for (cpu = 0; cpu <= mp_maxid; cpu++) {
406 			if (CPU_ABSENT(cpu))
407 				continue;
408 			CPU_LOCK(cpu);
409 			cache = &zone->uz_cpu[cpu];
410 			/* Add them up, and reset */
411 			alloc += cache->uc_allocs;
412 			cache->uc_allocs = 0;
413 			CPU_UNLOCK(cpu);
414 		}
415 	}
416 
417 	/* Now push these stats back into the zone.. */
418 	ZONE_LOCK(zone);
419 	zone->uz_allocs += alloc;
420 
421 	/*
422 	 * Expand the zone hash table.
423 	 *
424 	 * This is done if the number of slabs is larger than the hash size.
425 	 * What I'm trying to do here is completely reduce collisions.  This
426 	 * may be a little aggressive.  Should I allow for two collisions max?
427 	 */
428 
429 	if (keg->uk_flags & UMA_ZONE_HASH &&
430 	    keg->uk_pages / keg->uk_ppera >= keg->uk_hash.uh_hashsize) {
431 		struct uma_hash newhash;
432 		struct uma_hash oldhash;
433 		int ret;
434 
435 		/*
436 		 * This is so involved because allocating and freeing
437 		 * while the zone lock is held will lead to deadlock.
438 		 * I have to do everything in stages and check for
439 		 * races.
440 		 */
441 		newhash = keg->uk_hash;
442 		ZONE_UNLOCK(zone);
443 		ret = hash_alloc(&newhash);
444 		ZONE_LOCK(zone);
445 		if (ret) {
446 			if (hash_expand(&keg->uk_hash, &newhash)) {
447 				oldhash = keg->uk_hash;
448 				keg->uk_hash = newhash;
449 			} else
450 				oldhash = newhash;
451 
452 			ZONE_UNLOCK(zone);
453 			hash_free(&oldhash);
454 			ZONE_LOCK(zone);
455 		}
456 	}
457 	ZONE_UNLOCK(zone);
458 }
459 
460 /*
461  * Allocate and zero fill the next sized hash table from the appropriate
462  * backing store.
463  *
464  * Arguments:
465  *	hash  A new hash structure with the old hash size in uh_hashsize
466  *
467  * Returns:
468  *	1 on sucess and 0 on failure.
469  */
470 static int
471 hash_alloc(struct uma_hash *hash)
472 {
473 	int oldsize;
474 	int alloc;
475 
476 	oldsize = hash->uh_hashsize;
477 
478 	/* We're just going to go to a power of two greater */
479 	if (oldsize)  {
480 		hash->uh_hashsize = oldsize * 2;
481 		alloc = sizeof(hash->uh_slab_hash[0]) * hash->uh_hashsize;
482 		hash->uh_slab_hash = (struct slabhead *)malloc(alloc,
483 		    M_UMAHASH, M_NOWAIT);
484 	} else {
485 		alloc = sizeof(hash->uh_slab_hash[0]) * UMA_HASH_SIZE_INIT;
486 		hash->uh_slab_hash = uma_zalloc_internal(hashzone, NULL,
487 		    M_WAITOK);
488 		hash->uh_hashsize = UMA_HASH_SIZE_INIT;
489 	}
490 	if (hash->uh_slab_hash) {
491 		bzero(hash->uh_slab_hash, alloc);
492 		hash->uh_hashmask = hash->uh_hashsize - 1;
493 		return (1);
494 	}
495 
496 	return (0);
497 }
498 
499 /*
500  * Expands the hash table for HASH zones.  This is done from zone_timeout
501  * to reduce collisions.  This must not be done in the regular allocation
502  * path, otherwise, we can recurse on the vm while allocating pages.
503  *
504  * Arguments:
505  *	oldhash  The hash you want to expand
506  *	newhash  The hash structure for the new table
507  *
508  * Returns:
509  *	Nothing
510  *
511  * Discussion:
512  */
513 static int
514 hash_expand(struct uma_hash *oldhash, struct uma_hash *newhash)
515 {
516 	uma_slab_t slab;
517 	int hval;
518 	int i;
519 
520 	if (!newhash->uh_slab_hash)
521 		return (0);
522 
523 	if (oldhash->uh_hashsize >= newhash->uh_hashsize)
524 		return (0);
525 
526 	/*
527 	 * I need to investigate hash algorithms for resizing without a
528 	 * full rehash.
529 	 */
530 
531 	for (i = 0; i < oldhash->uh_hashsize; i++)
532 		while (!SLIST_EMPTY(&oldhash->uh_slab_hash[i])) {
533 			slab = SLIST_FIRST(&oldhash->uh_slab_hash[i]);
534 			SLIST_REMOVE_HEAD(&oldhash->uh_slab_hash[i], us_hlink);
535 			hval = UMA_HASH(newhash, slab->us_data);
536 			SLIST_INSERT_HEAD(&newhash->uh_slab_hash[hval],
537 			    slab, us_hlink);
538 		}
539 
540 	return (1);
541 }
542 
543 /*
544  * Free the hash bucket to the appropriate backing store.
545  *
546  * Arguments:
547  *	slab_hash  The hash bucket we're freeing
548  *	hashsize   The number of entries in that hash bucket
549  *
550  * Returns:
551  *	Nothing
552  */
553 static void
554 hash_free(struct uma_hash *hash)
555 {
556 	if (hash->uh_slab_hash == NULL)
557 		return;
558 	if (hash->uh_hashsize == UMA_HASH_SIZE_INIT)
559 		uma_zfree_internal(hashzone,
560 		    hash->uh_slab_hash, NULL, SKIP_NONE);
561 	else
562 		free(hash->uh_slab_hash, M_UMAHASH);
563 }
564 
565 /*
566  * Frees all outstanding items in a bucket
567  *
568  * Arguments:
569  *	zone   The zone to free to, must be unlocked.
570  *	bucket The free/alloc bucket with items, cpu queue must be locked.
571  *
572  * Returns:
573  *	Nothing
574  */
575 
576 static void
577 bucket_drain(uma_zone_t zone, uma_bucket_t bucket)
578 {
579 	uma_slab_t slab;
580 	int mzone;
581 	void *item;
582 
583 	if (bucket == NULL)
584 		return;
585 
586 	slab = NULL;
587 	mzone = 0;
588 
589 	/* We have to lookup the slab again for malloc.. */
590 	if (zone->uz_keg->uk_flags & UMA_ZONE_MALLOC)
591 		mzone = 1;
592 
593 	while (bucket->ub_cnt > 0)  {
594 		bucket->ub_cnt--;
595 		item = bucket->ub_bucket[bucket->ub_cnt];
596 #ifdef INVARIANTS
597 		bucket->ub_bucket[bucket->ub_cnt] = NULL;
598 		KASSERT(item != NULL,
599 		    ("bucket_drain: botched ptr, item is NULL"));
600 #endif
601 		/*
602 		 * This is extremely inefficient.  The slab pointer was passed
603 		 * to uma_zfree_arg, but we lost it because the buckets don't
604 		 * hold them.  This will go away when free() gets a size passed
605 		 * to it.
606 		 */
607 		if (mzone)
608 			slab = vtoslab((vm_offset_t)item & (~UMA_SLAB_MASK));
609 		uma_zfree_internal(zone, item, slab, SKIP_DTOR);
610 	}
611 }
612 
613 /*
614  * Drains the per cpu caches for a zone.
615  *
616  * Arguments:
617  *	zone     The zone to drain, must be unlocked.
618  *
619  * Returns:
620  *	Nothing
621  */
622 static void
623 cache_drain(uma_zone_t zone)
624 {
625 	uma_cache_t cache;
626 	int cpu;
627 
628 	/*
629 	 * We have to lock each cpu cache before locking the zone
630 	 */
631 	for (cpu = 0; cpu <= mp_maxid; cpu++) {
632 		if (CPU_ABSENT(cpu))
633 			continue;
634 		CPU_LOCK(cpu);
635 		cache = &zone->uz_cpu[cpu];
636 		bucket_drain(zone, cache->uc_allocbucket);
637 		bucket_drain(zone, cache->uc_freebucket);
638 		if (cache->uc_allocbucket != NULL)
639 			bucket_free(cache->uc_allocbucket);
640 		if (cache->uc_freebucket != NULL)
641 			bucket_free(cache->uc_freebucket);
642 		cache->uc_allocbucket = cache->uc_freebucket = NULL;
643 	}
644 	ZONE_LOCK(zone);
645 	bucket_cache_drain(zone);
646 	ZONE_UNLOCK(zone);
647 	for (cpu = 0; cpu <= mp_maxid; cpu++) {
648 		if (CPU_ABSENT(cpu))
649 			continue;
650 		CPU_UNLOCK(cpu);
651 	}
652 }
653 
654 /*
655  * Drain the cached buckets from a zone.  Expects a locked zone on entry.
656  */
657 static void
658 bucket_cache_drain(uma_zone_t zone)
659 {
660 	uma_bucket_t bucket;
661 
662 	/*
663 	 * Drain the bucket queues and free the buckets, we just keep two per
664 	 * cpu (alloc/free).
665 	 */
666 	while ((bucket = LIST_FIRST(&zone->uz_full_bucket)) != NULL) {
667 		LIST_REMOVE(bucket, ub_link);
668 		ZONE_UNLOCK(zone);
669 		bucket_drain(zone, bucket);
670 		bucket_free(bucket);
671 		ZONE_LOCK(zone);
672 	}
673 
674 	/* Now we do the free queue.. */
675 	while ((bucket = LIST_FIRST(&zone->uz_free_bucket)) != NULL) {
676 		LIST_REMOVE(bucket, ub_link);
677 		bucket_free(bucket);
678 	}
679 }
680 
681 /*
682  * Frees pages from a zone back to the system.  This is done on demand from
683  * the pageout daemon.
684  *
685  * Arguments:
686  *	zone  The zone to free pages from
687  *	 all  Should we drain all items?
688  *
689  * Returns:
690  *	Nothing.
691  */
692 static void
693 zone_drain(uma_zone_t zone)
694 {
695 	struct slabhead freeslabs = {};
696 	uma_keg_t keg;
697 	uma_slab_t slab;
698 	uma_slab_t n;
699 	u_int8_t flags;
700 	u_int8_t *mem;
701 	int i;
702 
703 	keg = zone->uz_keg;
704 
705 	/*
706 	 * We don't want to take pages from statically allocated zones at this
707 	 * time
708 	 */
709 	if (keg->uk_flags & UMA_ZONE_NOFREE || keg->uk_freef == NULL)
710 		return;
711 
712 	ZONE_LOCK(zone);
713 
714 #ifdef UMA_DEBUG
715 	printf("%s free items: %u\n", zone->uz_name, keg->uk_free);
716 #endif
717 	bucket_cache_drain(zone);
718 	if (keg->uk_free == 0)
719 		goto finished;
720 
721 	slab = LIST_FIRST(&keg->uk_free_slab);
722 	while (slab) {
723 		n = LIST_NEXT(slab, us_link);
724 
725 		/* We have no where to free these to */
726 		if (slab->us_flags & UMA_SLAB_BOOT) {
727 			slab = n;
728 			continue;
729 		}
730 
731 		LIST_REMOVE(slab, us_link);
732 		keg->uk_pages -= keg->uk_ppera;
733 		keg->uk_free -= keg->uk_ipers;
734 
735 		if (keg->uk_flags & UMA_ZONE_HASH)
736 			UMA_HASH_REMOVE(&keg->uk_hash, slab, slab->us_data);
737 
738 		SLIST_INSERT_HEAD(&freeslabs, slab, us_hlink);
739 
740 		slab = n;
741 	}
742 finished:
743 	ZONE_UNLOCK(zone);
744 
745 	while ((slab = SLIST_FIRST(&freeslabs)) != NULL) {
746 		SLIST_REMOVE(&freeslabs, slab, uma_slab, us_hlink);
747 		if (keg->uk_fini)
748 			for (i = 0; i < keg->uk_ipers; i++)
749 				keg->uk_fini(
750 				    slab->us_data + (keg->uk_rsize * i),
751 				    keg->uk_size);
752 		flags = slab->us_flags;
753 		mem = slab->us_data;
754 
755 		if ((keg->uk_flags & UMA_ZONE_MALLOC) ||
756 		    (keg->uk_flags & UMA_ZONE_REFCNT)) {
757 			vm_object_t obj;
758 
759 			if (flags & UMA_SLAB_KMEM)
760 				obj = kmem_object;
761 			else
762 				obj = NULL;
763 			for (i = 0; i < keg->uk_ppera; i++)
764 				vsetobj((vm_offset_t)mem + (i * PAGE_SIZE),
765 				    obj);
766 		}
767 		if (keg->uk_flags & UMA_ZONE_OFFPAGE)
768 			uma_zfree_internal(keg->uk_slabzone, slab, NULL,
769 			    SKIP_NONE);
770 #ifdef UMA_DEBUG
771 		printf("%s: Returning %d bytes.\n",
772 		    zone->uz_name, UMA_SLAB_SIZE * keg->uk_ppera);
773 #endif
774 		keg->uk_freef(mem, UMA_SLAB_SIZE * keg->uk_ppera, flags);
775 	}
776 }
777 
778 /*
779  * Allocate a new slab for a zone.  This does not insert the slab onto a list.
780  *
781  * Arguments:
782  *	zone  The zone to allocate slabs for
783  *	wait  Shall we wait?
784  *
785  * Returns:
786  *	The slab that was allocated or NULL if there is no memory and the
787  *	caller specified M_NOWAIT.
788  */
789 static uma_slab_t
790 slab_zalloc(uma_zone_t zone, int wait)
791 {
792 	uma_slabrefcnt_t slabref;
793 	uma_slab_t slab;
794 	uma_keg_t keg;
795 	u_int8_t *mem;
796 	u_int8_t flags;
797 	int i;
798 
799 	slab = NULL;
800 	keg = zone->uz_keg;
801 
802 #ifdef UMA_DEBUG
803 	printf("slab_zalloc:  Allocating a new slab for %s\n", zone->uz_name);
804 #endif
805 	ZONE_UNLOCK(zone);
806 
807 	if (keg->uk_flags & UMA_ZONE_OFFPAGE) {
808 		slab = uma_zalloc_internal(keg->uk_slabzone, NULL, wait);
809 		if (slab == NULL) {
810 			ZONE_LOCK(zone);
811 			return NULL;
812 		}
813 	}
814 
815 	/*
816 	 * This reproduces the old vm_zone behavior of zero filling pages the
817 	 * first time they are added to a zone.
818 	 *
819 	 * Malloced items are zeroed in uma_zalloc.
820 	 */
821 
822 	if ((keg->uk_flags & UMA_ZONE_MALLOC) == 0)
823 		wait |= M_ZERO;
824 	else
825 		wait &= ~M_ZERO;
826 
827 	mem = keg->uk_allocf(zone, keg->uk_ppera * UMA_SLAB_SIZE,
828 	    &flags, wait);
829 	if (mem == NULL) {
830 		if (keg->uk_flags & UMA_ZONE_OFFPAGE)
831 			uma_zfree_internal(keg->uk_slabzone, slab, NULL, 0);
832 		ZONE_LOCK(zone);
833 		return (NULL);
834 	}
835 
836 	/* Point the slab into the allocated memory */
837 	if (!(keg->uk_flags & UMA_ZONE_OFFPAGE))
838 		slab = (uma_slab_t )(mem + keg->uk_pgoff);
839 
840 	if ((keg->uk_flags & UMA_ZONE_MALLOC) ||
841 	    (keg->uk_flags & UMA_ZONE_REFCNT))
842 		for (i = 0; i < keg->uk_ppera; i++)
843 			vsetslab((vm_offset_t)mem + (i * PAGE_SIZE), slab);
844 
845 	slab->us_keg = keg;
846 	slab->us_data = mem;
847 	slab->us_freecount = keg->uk_ipers;
848 	slab->us_firstfree = 0;
849 	slab->us_flags = flags;
850 
851 	if (keg->uk_flags & UMA_ZONE_REFCNT) {
852 		slabref = (uma_slabrefcnt_t)slab;
853 		for (i = 0; i < keg->uk_ipers; i++) {
854 			slabref->us_freelist[i].us_refcnt = 0;
855 			slabref->us_freelist[i].us_item = i+1;
856 		}
857 	} else {
858 		for (i = 0; i < keg->uk_ipers; i++)
859 			slab->us_freelist[i].us_item = i+1;
860 	}
861 
862 	if (keg->uk_init != NULL) {
863 		for (i = 0; i < keg->uk_ipers; i++)
864 			if (keg->uk_init(slab->us_data + (keg->uk_rsize * i),
865 			    keg->uk_size, wait) != 0)
866 				break;
867 		if (i != keg->uk_ipers) {
868 			if (keg->uk_fini != NULL) {
869 				for (i--; i > -1; i--)
870 					keg->uk_fini(slab->us_data +
871 					    (keg->uk_rsize * i),
872 					    keg->uk_size);
873 			}
874 			if ((keg->uk_flags & UMA_ZONE_MALLOC) ||
875 			    (keg->uk_flags & UMA_ZONE_REFCNT))
876 				for (i = 0; i < keg->uk_ppera; i++)
877 					vsetobj((vm_offset_t)mem +
878 					    (i * PAGE_SIZE), NULL);
879 			if (keg->uk_flags & UMA_ZONE_OFFPAGE)
880 				uma_zfree_internal(keg->uk_slabzone, slab,
881 				    NULL, SKIP_NONE);
882 			keg->uk_freef(mem, UMA_SLAB_SIZE * keg->uk_ppera,
883 			    flags);
884 			ZONE_LOCK(zone);
885 			return (NULL);
886 		}
887 	}
888 	ZONE_LOCK(zone);
889 
890 	if (keg->uk_flags & UMA_ZONE_HASH)
891 		UMA_HASH_INSERT(&keg->uk_hash, slab, mem);
892 
893 	keg->uk_pages += keg->uk_ppera;
894 	keg->uk_free += keg->uk_ipers;
895 
896 	return (slab);
897 }
898 
899 /*
900  * This function is intended to be used early on in place of page_alloc() so
901  * that we may use the boot time page cache to satisfy allocations before
902  * the VM is ready.
903  */
904 static void *
905 startup_alloc(uma_zone_t zone, int bytes, u_int8_t *pflag, int wait)
906 {
907 	uma_keg_t keg;
908 
909 	keg = zone->uz_keg;
910 
911 	/*
912 	 * Check our small startup cache to see if it has pages remaining.
913 	 */
914 	mtx_lock(&uma_mtx);
915 	if (uma_boot_free != 0) {
916 		uma_slab_t tmps;
917 
918 		tmps = LIST_FIRST(&uma_boot_pages);
919 		LIST_REMOVE(tmps, us_link);
920 		uma_boot_free--;
921 		mtx_unlock(&uma_mtx);
922 		*pflag = tmps->us_flags;
923 		return (tmps->us_data);
924 	}
925 	mtx_unlock(&uma_mtx);
926 	if (booted == 0)
927 		panic("UMA: Increase UMA_BOOT_PAGES");
928 	/*
929 	 * Now that we've booted reset these users to their real allocator.
930 	 */
931 #ifdef UMA_MD_SMALL_ALLOC
932 	keg->uk_allocf = uma_small_alloc;
933 #else
934 	keg->uk_allocf = page_alloc;
935 #endif
936 	return keg->uk_allocf(zone, bytes, pflag, wait);
937 }
938 
939 /*
940  * Allocates a number of pages from the system
941  *
942  * Arguments:
943  *	zone  Unused
944  *	bytes  The number of bytes requested
945  *	wait  Shall we wait?
946  *
947  * Returns:
948  *	A pointer to the alloced memory or possibly
949  *	NULL if M_NOWAIT is set.
950  */
951 static void *
952 page_alloc(uma_zone_t zone, int bytes, u_int8_t *pflag, int wait)
953 {
954 	void *p;	/* Returned page */
955 
956 	*pflag = UMA_SLAB_KMEM;
957 	p = (void *) kmem_malloc(kmem_map, bytes, wait);
958 
959 	return (p);
960 }
961 
962 /*
963  * Allocates a number of pages from within an object
964  *
965  * Arguments:
966  *	zone   Unused
967  *	bytes  The number of bytes requested
968  *	wait   Shall we wait?
969  *
970  * Returns:
971  *	A pointer to the alloced memory or possibly
972  *	NULL if M_NOWAIT is set.
973  */
974 static void *
975 obj_alloc(uma_zone_t zone, int bytes, u_int8_t *flags, int wait)
976 {
977 	vm_object_t object;
978 	vm_offset_t retkva, zkva;
979 	vm_page_t p;
980 	int pages, startpages;
981 
982 	object = zone->uz_keg->uk_obj;
983 	retkva = 0;
984 
985 	/*
986 	 * This looks a little weird since we're getting one page at a time.
987 	 */
988 	VM_OBJECT_LOCK(object);
989 	p = TAILQ_LAST(&object->memq, pglist);
990 	pages = p != NULL ? p->pindex + 1 : 0;
991 	startpages = pages;
992 	zkva = zone->uz_keg->uk_kva + pages * PAGE_SIZE;
993 	for (; bytes > 0; bytes -= PAGE_SIZE) {
994 		p = vm_page_alloc(object, pages,
995 		    VM_ALLOC_INTERRUPT | VM_ALLOC_WIRED);
996 		if (p == NULL) {
997 			if (pages != startpages)
998 				pmap_qremove(retkva, pages - startpages);
999 			while (pages != startpages) {
1000 				pages--;
1001 				p = TAILQ_LAST(&object->memq, pglist);
1002 				vm_page_lock_queues();
1003 				vm_page_unwire(p, 0);
1004 				vm_page_free(p);
1005 				vm_page_unlock_queues();
1006 			}
1007 			retkva = 0;
1008 			goto done;
1009 		}
1010 		pmap_qenter(zkva, &p, 1);
1011 		if (retkva == 0)
1012 			retkva = zkva;
1013 		zkva += PAGE_SIZE;
1014 		pages += 1;
1015 	}
1016 done:
1017 	VM_OBJECT_UNLOCK(object);
1018 	*flags = UMA_SLAB_PRIV;
1019 
1020 	return ((void *)retkva);
1021 }
1022 
1023 /*
1024  * Frees a number of pages to the system
1025  *
1026  * Arguments:
1027  *	mem   A pointer to the memory to be freed
1028  *	size  The size of the memory being freed
1029  *	flags The original p->us_flags field
1030  *
1031  * Returns:
1032  *	Nothing
1033  */
1034 static void
1035 page_free(void *mem, int size, u_int8_t flags)
1036 {
1037 	vm_map_t map;
1038 
1039 	if (flags & UMA_SLAB_KMEM)
1040 		map = kmem_map;
1041 	else
1042 		panic("UMA: page_free used with invalid flags %d\n", flags);
1043 
1044 	kmem_free(map, (vm_offset_t)mem, size);
1045 }
1046 
1047 /*
1048  * Zero fill initializer
1049  *
1050  * Arguments/Returns follow uma_init specifications
1051  */
1052 static int
1053 zero_init(void *mem, int size, int flags)
1054 {
1055 	bzero(mem, size);
1056 	return (0);
1057 }
1058 
1059 /*
1060  * Finish creating a small uma zone.  This calculates ipers, and the zone size.
1061  *
1062  * Arguments
1063  *	zone  The zone we should initialize
1064  *
1065  * Returns
1066  *	Nothing
1067  */
1068 static void
1069 zone_small_init(uma_zone_t zone)
1070 {
1071 	uma_keg_t keg;
1072 	u_int rsize;
1073 	u_int memused;
1074 	u_int wastedspace;
1075 	u_int shsize;
1076 
1077 	keg = zone->uz_keg;
1078 	KASSERT(keg != NULL, ("Keg is null in zone_small_init"));
1079 	rsize = keg->uk_size;
1080 
1081 	if (rsize < UMA_SMALLEST_UNIT)
1082 		rsize = UMA_SMALLEST_UNIT;
1083 	if (rsize & keg->uk_align)
1084 		rsize = (rsize & ~keg->uk_align) + (keg->uk_align + 1);
1085 
1086 	keg->uk_rsize = rsize;
1087 	keg->uk_ppera = 1;
1088 
1089 	if (keg->uk_flags & UMA_ZONE_REFCNT) {
1090 		rsize += UMA_FRITMREF_SZ;	/* linkage & refcnt */
1091 		shsize = sizeof(struct uma_slab_refcnt);
1092 	} else {
1093 		rsize += UMA_FRITM_SZ;	/* Account for linkage */
1094 		shsize = sizeof(struct uma_slab);
1095 	}
1096 
1097 	keg->uk_ipers = (UMA_SLAB_SIZE - shsize) / rsize;
1098 	KASSERT(keg->uk_ipers != 0, ("zone_small_init: ipers is 0"));
1099 	memused = keg->uk_ipers * rsize + shsize;
1100 	wastedspace = UMA_SLAB_SIZE - memused;
1101 
1102 	/*
1103 	 * We can't do OFFPAGE if we're internal or if we've been
1104 	 * asked to not go to the VM for buckets.  If we do this we
1105 	 * may end up going to the VM (kmem_map) for slabs which we
1106 	 * do not want to do if we're UMA_ZFLAG_CACHEONLY as a
1107 	 * result of UMA_ZONE_VM, which clearly forbids it.
1108 	 */
1109 	if ((keg->uk_flags & UMA_ZFLAG_INTERNAL) ||
1110 	    (keg->uk_flags & UMA_ZFLAG_CACHEONLY))
1111 		return;
1112 
1113 	if ((wastedspace >= UMA_MAX_WASTE) &&
1114 	    (keg->uk_ipers < (UMA_SLAB_SIZE / keg->uk_rsize))) {
1115 		keg->uk_ipers = UMA_SLAB_SIZE / keg->uk_rsize;
1116 		KASSERT(keg->uk_ipers <= 255,
1117 		    ("zone_small_init: keg->uk_ipers too high!"));
1118 #ifdef UMA_DEBUG
1119 		printf("UMA decided we need offpage slab headers for "
1120 		    "zone: %s, calculated wastedspace = %d, "
1121 		    "maximum wasted space allowed = %d, "
1122 		    "calculated ipers = %d, "
1123 		    "new wasted space = %d\n", zone->uz_name, wastedspace,
1124 		    UMA_MAX_WASTE, keg->uk_ipers,
1125 		    UMA_SLAB_SIZE - keg->uk_ipers * keg->uk_rsize);
1126 #endif
1127 		keg->uk_flags |= UMA_ZONE_OFFPAGE;
1128 		if ((keg->uk_flags & UMA_ZONE_MALLOC) == 0)
1129 			keg->uk_flags |= UMA_ZONE_HASH;
1130 	}
1131 }
1132 
1133 /*
1134  * Finish creating a large (> UMA_SLAB_SIZE) uma zone.  Just give in and do
1135  * OFFPAGE for now.  When I can allow for more dynamic slab sizes this will be
1136  * more complicated.
1137  *
1138  * Arguments
1139  *	zone  The zone we should initialize
1140  *
1141  * Returns
1142  *	Nothing
1143  */
1144 static void
1145 zone_large_init(uma_zone_t zone)
1146 {
1147 	uma_keg_t keg;
1148 	int pages;
1149 
1150 	keg = zone->uz_keg;
1151 
1152 	KASSERT(keg != NULL, ("Keg is null in zone_large_init"));
1153 	KASSERT((keg->uk_flags & UMA_ZFLAG_CACHEONLY) == 0,
1154 	    ("zone_large_init: Cannot large-init a UMA_ZFLAG_CACHEONLY zone"));
1155 
1156 	pages = keg->uk_size / UMA_SLAB_SIZE;
1157 
1158 	/* Account for remainder */
1159 	if ((pages * UMA_SLAB_SIZE) < keg->uk_size)
1160 		pages++;
1161 
1162 	keg->uk_ppera = pages;
1163 	keg->uk_ipers = 1;
1164 
1165 	keg->uk_flags |= UMA_ZONE_OFFPAGE;
1166 	if ((keg->uk_flags & UMA_ZONE_MALLOC) == 0)
1167 		keg->uk_flags |= UMA_ZONE_HASH;
1168 
1169 	keg->uk_rsize = keg->uk_size;
1170 }
1171 
1172 /*
1173  * Keg header ctor.  This initializes all fields, locks, etc.  And inserts
1174  * the keg onto the global keg list.
1175  *
1176  * Arguments/Returns follow uma_ctor specifications
1177  *	udata  Actually uma_kctor_args
1178  */
1179 static int
1180 keg_ctor(void *mem, int size, void *udata, int flags)
1181 {
1182 	struct uma_kctor_args *arg = udata;
1183 	uma_keg_t keg = mem;
1184 	uma_zone_t zone;
1185 
1186 	bzero(keg, size);
1187 	keg->uk_size = arg->size;
1188 	keg->uk_init = arg->uminit;
1189 	keg->uk_fini = arg->fini;
1190 	keg->uk_align = arg->align;
1191 	keg->uk_free = 0;
1192 	keg->uk_pages = 0;
1193 	keg->uk_flags = arg->flags;
1194 	keg->uk_allocf = page_alloc;
1195 	keg->uk_freef = page_free;
1196 	keg->uk_recurse = 0;
1197 	keg->uk_slabzone = NULL;
1198 
1199 	/*
1200 	 * The master zone is passed to us at keg-creation time.
1201 	 */
1202 	zone = arg->zone;
1203 	zone->uz_keg = keg;
1204 
1205 	if (arg->flags & UMA_ZONE_VM)
1206 		keg->uk_flags |= UMA_ZFLAG_CACHEONLY;
1207 
1208 	if (arg->flags & UMA_ZONE_ZINIT)
1209 		keg->uk_init = zero_init;
1210 
1211 	/*
1212 	 * The +UMA_FRITM_SZ added to uk_size is to account for the
1213 	 * linkage that is added to the size in zone_small_init().  If
1214 	 * we don't account for this here then we may end up in
1215 	 * zone_small_init() with a calculated 'ipers' of 0.
1216 	 */
1217 	if (keg->uk_flags & UMA_ZONE_REFCNT) {
1218 		if ((keg->uk_size+UMA_FRITMREF_SZ) >
1219 		    (UMA_SLAB_SIZE - sizeof(struct uma_slab_refcnt)))
1220 			zone_large_init(zone);
1221 		else
1222 			zone_small_init(zone);
1223 	} else {
1224 		if ((keg->uk_size+UMA_FRITM_SZ) >
1225 		    (UMA_SLAB_SIZE - sizeof(struct uma_slab)))
1226 			zone_large_init(zone);
1227 		else
1228 			zone_small_init(zone);
1229 	}
1230 
1231 	if (keg->uk_flags & UMA_ZONE_OFFPAGE) {
1232 		if (keg->uk_flags & UMA_ZONE_REFCNT)
1233 			keg->uk_slabzone = slabrefzone;
1234 		else
1235 			keg->uk_slabzone = slabzone;
1236 	}
1237 
1238 	/*
1239 	 * If we haven't booted yet we need allocations to go through the
1240 	 * startup cache until the vm is ready.
1241 	 */
1242 	if (keg->uk_ppera == 1) {
1243 #ifdef UMA_MD_SMALL_ALLOC
1244 		keg->uk_allocf = uma_small_alloc;
1245 		keg->uk_freef = uma_small_free;
1246 #endif
1247 		if (booted == 0)
1248 			keg->uk_allocf = startup_alloc;
1249 	}
1250 
1251 	/*
1252 	 * Initialize keg's lock (shared among zones) through
1253 	 * Master zone
1254 	 */
1255 	zone->uz_lock = &keg->uk_lock;
1256 	if (arg->flags & UMA_ZONE_MTXCLASS)
1257 		ZONE_LOCK_INIT(zone, 1);
1258 	else
1259 		ZONE_LOCK_INIT(zone, 0);
1260 
1261 	/*
1262 	 * If we're putting the slab header in the actual page we need to
1263 	 * figure out where in each page it goes.  This calculates a right
1264 	 * justified offset into the memory on an ALIGN_PTR boundary.
1265 	 */
1266 	if (!(keg->uk_flags & UMA_ZONE_OFFPAGE)) {
1267 		u_int totsize;
1268 
1269 		/* Size of the slab struct and free list */
1270 		if (keg->uk_flags & UMA_ZONE_REFCNT)
1271 			totsize = sizeof(struct uma_slab_refcnt) +
1272 			    keg->uk_ipers * UMA_FRITMREF_SZ;
1273 		else
1274 			totsize = sizeof(struct uma_slab) +
1275 			    keg->uk_ipers * UMA_FRITM_SZ;
1276 
1277 		if (totsize & UMA_ALIGN_PTR)
1278 			totsize = (totsize & ~UMA_ALIGN_PTR) +
1279 			    (UMA_ALIGN_PTR + 1);
1280 		keg->uk_pgoff = UMA_SLAB_SIZE - totsize;
1281 
1282 		if (keg->uk_flags & UMA_ZONE_REFCNT)
1283 			totsize = keg->uk_pgoff + sizeof(struct uma_slab_refcnt)
1284 			    + keg->uk_ipers * UMA_FRITMREF_SZ;
1285 		else
1286 			totsize = keg->uk_pgoff + sizeof(struct uma_slab)
1287 			    + keg->uk_ipers * UMA_FRITM_SZ;
1288 
1289 		/*
1290 		 * The only way the following is possible is if with our
1291 		 * UMA_ALIGN_PTR adjustments we are now bigger than
1292 		 * UMA_SLAB_SIZE.  I haven't checked whether this is
1293 		 * mathematically possible for all cases, so we make
1294 		 * sure here anyway.
1295 		 */
1296 		if (totsize > UMA_SLAB_SIZE) {
1297 			printf("zone %s ipers %d rsize %d size %d\n",
1298 			    zone->uz_name, keg->uk_ipers, keg->uk_rsize,
1299 			    keg->uk_size);
1300 			panic("UMA slab won't fit.\n");
1301 		}
1302 	}
1303 
1304 	if (keg->uk_flags & UMA_ZONE_HASH)
1305 		hash_alloc(&keg->uk_hash);
1306 
1307 #ifdef UMA_DEBUG
1308 	printf("%s(%p) size = %d ipers = %d ppera = %d pgoff = %d\n",
1309 	    zone->uz_name, zone,
1310 	    keg->uk_size, keg->uk_ipers,
1311 	    keg->uk_ppera, keg->uk_pgoff);
1312 #endif
1313 
1314 	LIST_INSERT_HEAD(&keg->uk_zones, zone, uz_link);
1315 
1316 	mtx_lock(&uma_mtx);
1317 	LIST_INSERT_HEAD(&uma_kegs, keg, uk_link);
1318 	mtx_unlock(&uma_mtx);
1319 	return (0);
1320 }
1321 
1322 /*
1323  * Zone header ctor.  This initializes all fields, locks, etc.
1324  *
1325  * Arguments/Returns follow uma_ctor specifications
1326  *	udata  Actually uma_zctor_args
1327  */
1328 
1329 static int
1330 zone_ctor(void *mem, int size, void *udata, int flags)
1331 {
1332 	struct uma_zctor_args *arg = udata;
1333 	uma_zone_t zone = mem;
1334 	uma_zone_t z;
1335 	uma_keg_t keg;
1336 
1337 	bzero(zone, size);
1338 	zone->uz_name = arg->name;
1339 	zone->uz_ctor = arg->ctor;
1340 	zone->uz_dtor = arg->dtor;
1341 	zone->uz_init = NULL;
1342 	zone->uz_fini = NULL;
1343 	zone->uz_allocs = 0;
1344 	zone->uz_fills = zone->uz_count = 0;
1345 
1346 	if (arg->flags & UMA_ZONE_SECONDARY) {
1347 		KASSERT(arg->keg != NULL, ("Secondary zone on zero'd keg"));
1348 		keg = arg->keg;
1349 		zone->uz_keg = keg;
1350 		zone->uz_init = arg->uminit;
1351 		zone->uz_fini = arg->fini;
1352 		zone->uz_lock = &keg->uk_lock;
1353 		mtx_lock(&uma_mtx);
1354 		ZONE_LOCK(zone);
1355 		keg->uk_flags |= UMA_ZONE_SECONDARY;
1356 		LIST_FOREACH(z, &keg->uk_zones, uz_link) {
1357 			if (LIST_NEXT(z, uz_link) == NULL) {
1358 				LIST_INSERT_AFTER(z, zone, uz_link);
1359 				break;
1360 			}
1361 		}
1362 		ZONE_UNLOCK(zone);
1363 		mtx_unlock(&uma_mtx);
1364 	} else if (arg->keg == NULL) {
1365 		if (uma_kcreate(zone, arg->size, arg->uminit, arg->fini,
1366 		    arg->align, arg->flags) == NULL)
1367 			return (ENOMEM);
1368 	} else {
1369 		struct uma_kctor_args karg;
1370 		int error;
1371 
1372 		/* We should only be here from uma_startup() */
1373 		karg.size = arg->size;
1374 		karg.uminit = arg->uminit;
1375 		karg.fini = arg->fini;
1376 		karg.align = arg->align;
1377 		karg.flags = arg->flags;
1378 		karg.zone = zone;
1379 		error = keg_ctor(arg->keg, sizeof(struct uma_keg), &karg,
1380 		    flags);
1381 		if (error)
1382 			return (error);
1383 	}
1384 	keg = zone->uz_keg;
1385 	zone->uz_lock = &keg->uk_lock;
1386 
1387 	/*
1388 	 * Some internal zones don't have room allocated for the per cpu
1389 	 * caches.  If we're internal, bail out here.
1390 	 */
1391 	if (keg->uk_flags & UMA_ZFLAG_INTERNAL) {
1392 		KASSERT((keg->uk_flags & UMA_ZONE_SECONDARY) == 0,
1393 		    ("Secondary zone requested UMA_ZFLAG_INTERNAL"));
1394 		return (0);
1395 	}
1396 
1397 	if (keg->uk_flags & UMA_ZONE_MAXBUCKET)
1398 		zone->uz_count = BUCKET_MAX;
1399 	else if (keg->uk_ipers <= BUCKET_MAX)
1400 		zone->uz_count = keg->uk_ipers;
1401 	else
1402 		zone->uz_count = BUCKET_MAX;
1403 	return (0);
1404 }
1405 
1406 /*
1407  * Keg header dtor.  This frees all data, destroys locks, frees the hash
1408  * table and removes the keg from the global list.
1409  *
1410  * Arguments/Returns follow uma_dtor specifications
1411  *	udata  unused
1412  */
1413 static void
1414 keg_dtor(void *arg, int size, void *udata)
1415 {
1416 	uma_keg_t keg;
1417 
1418 	keg = (uma_keg_t)arg;
1419 	mtx_lock(&keg->uk_lock);
1420 	if (keg->uk_free != 0) {
1421 		printf("Freed UMA keg was not empty (%d items). "
1422 		    " Lost %d pages of memory.\n",
1423 		    keg->uk_free, keg->uk_pages);
1424 	}
1425 	mtx_unlock(&keg->uk_lock);
1426 
1427 	if (keg->uk_flags & UMA_ZONE_HASH)
1428 		hash_free(&keg->uk_hash);
1429 
1430 	mtx_destroy(&keg->uk_lock);
1431 }
1432 
1433 /*
1434  * Zone header dtor.
1435  *
1436  * Arguments/Returns follow uma_dtor specifications
1437  *	udata  unused
1438  */
1439 static void
1440 zone_dtor(void *arg, int size, void *udata)
1441 {
1442 	uma_zone_t zone;
1443 	uma_keg_t keg;
1444 
1445 	zone = (uma_zone_t)arg;
1446 	keg = zone->uz_keg;
1447 
1448 	if (!(keg->uk_flags & UMA_ZFLAG_INTERNAL))
1449 		cache_drain(zone);
1450 
1451 	mtx_lock(&uma_mtx);
1452 	zone_drain(zone);
1453 	if (keg->uk_flags & UMA_ZONE_SECONDARY) {
1454 		LIST_REMOVE(zone, uz_link);
1455 		/*
1456 		 * XXX there are some races here where
1457 		 * the zone can be drained but zone lock
1458 		 * released and then refilled before we
1459 		 * remove it... we dont care for now
1460 		 */
1461 		ZONE_LOCK(zone);
1462 		if (LIST_EMPTY(&keg->uk_zones))
1463 			keg->uk_flags &= ~UMA_ZONE_SECONDARY;
1464 		ZONE_UNLOCK(zone);
1465 		mtx_unlock(&uma_mtx);
1466 	} else {
1467 		LIST_REMOVE(keg, uk_link);
1468 		LIST_REMOVE(zone, uz_link);
1469 		mtx_unlock(&uma_mtx);
1470 		uma_zfree_internal(kegs, keg, NULL, SKIP_NONE);
1471 	}
1472 	zone->uz_keg = NULL;
1473 }
1474 
1475 /*
1476  * Traverses every zone in the system and calls a callback
1477  *
1478  * Arguments:
1479  *	zfunc  A pointer to a function which accepts a zone
1480  *		as an argument.
1481  *
1482  * Returns:
1483  *	Nothing
1484  */
1485 static void
1486 zone_foreach(void (*zfunc)(uma_zone_t))
1487 {
1488 	uma_keg_t keg;
1489 	uma_zone_t zone;
1490 
1491 	mtx_lock(&uma_mtx);
1492 	LIST_FOREACH(keg, &uma_kegs, uk_link) {
1493 		LIST_FOREACH(zone, &keg->uk_zones, uz_link)
1494 			zfunc(zone);
1495 	}
1496 	mtx_unlock(&uma_mtx);
1497 }
1498 
1499 /* Public functions */
1500 /* See uma.h */
1501 void
1502 uma_startup(void *bootmem)
1503 {
1504 	struct uma_zctor_args args;
1505 	uma_slab_t slab;
1506 	u_int slabsize;
1507 	u_int objsize, totsize, wsize;
1508 	int i;
1509 
1510 #ifdef UMA_DEBUG
1511 	printf("Creating uma keg headers zone and keg.\n");
1512 #endif
1513 	/*
1514 	 * The general UMA lock is a recursion-allowed lock because
1515 	 * there is a code path where, while we're still configured
1516 	 * to use startup_alloc() for backend page allocations, we
1517 	 * may end up in uma_reclaim() which calls zone_foreach(zone_drain),
1518 	 * which grabs uma_mtx, only to later call into startup_alloc()
1519 	 * because while freeing we needed to allocate a bucket.  Since
1520 	 * startup_alloc() also takes uma_mtx, we need to be able to
1521 	 * recurse on it.
1522 	 */
1523 	mtx_init(&uma_mtx, "UMA lock", NULL, MTX_DEF | MTX_RECURSE);
1524 
1525 	/*
1526 	 * Figure out the maximum number of items-per-slab we'll have if
1527 	 * we're using the OFFPAGE slab header to track free items, given
1528 	 * all possible object sizes and the maximum desired wastage
1529 	 * (UMA_MAX_WASTE).
1530 	 *
1531 	 * We iterate until we find an object size for
1532 	 * which the calculated wastage in zone_small_init() will be
1533 	 * enough to warrant OFFPAGE.  Since wastedspace versus objsize
1534 	 * is an overall increasing see-saw function, we find the smallest
1535 	 * objsize such that the wastage is always acceptable for objects
1536 	 * with that objsize or smaller.  Since a smaller objsize always
1537 	 * generates a larger possible uma_max_ipers, we use this computed
1538 	 * objsize to calculate the largest ipers possible.  Since the
1539 	 * ipers calculated for OFFPAGE slab headers is always larger than
1540 	 * the ipers initially calculated in zone_small_init(), we use
1541 	 * the former's equation (UMA_SLAB_SIZE / keg->uk_rsize) to
1542 	 * obtain the maximum ipers possible for offpage slab headers.
1543 	 *
1544 	 * It should be noted that ipers versus objsize is an inversly
1545 	 * proportional function which drops off rather quickly so as
1546 	 * long as our UMA_MAX_WASTE is such that the objsize we calculate
1547 	 * falls into the portion of the inverse relation AFTER the steep
1548 	 * falloff, then uma_max_ipers shouldn't be too high (~10 on i386).
1549 	 *
1550 	 * Note that we have 8-bits (1 byte) to use as a freelist index
1551 	 * inside the actual slab header itself and this is enough to
1552 	 * accomodate us.  In the worst case, a UMA_SMALLEST_UNIT sized
1553 	 * object with offpage slab header would have ipers =
1554 	 * UMA_SLAB_SIZE / UMA_SMALLEST_UNIT (currently = 256), which is
1555 	 * 1 greater than what our byte-integer freelist index can
1556 	 * accomodate, but we know that this situation never occurs as
1557 	 * for UMA_SMALLEST_UNIT-sized objects, we will never calculate
1558 	 * that we need to go to offpage slab headers.  Or, if we do,
1559 	 * then we trap that condition below and panic in the INVARIANTS case.
1560 	 */
1561 	wsize = UMA_SLAB_SIZE - sizeof(struct uma_slab) - UMA_MAX_WASTE;
1562 	totsize = wsize;
1563 	objsize = UMA_SMALLEST_UNIT;
1564 	while (totsize >= wsize) {
1565 		totsize = (UMA_SLAB_SIZE - sizeof(struct uma_slab)) /
1566 		    (objsize + UMA_FRITM_SZ);
1567 		totsize *= (UMA_FRITM_SZ + objsize);
1568 		objsize++;
1569 	}
1570 	if (objsize > UMA_SMALLEST_UNIT)
1571 		objsize--;
1572 	uma_max_ipers = UMA_SLAB_SIZE / objsize;
1573 
1574 	wsize = UMA_SLAB_SIZE - sizeof(struct uma_slab_refcnt) - UMA_MAX_WASTE;
1575 	totsize = wsize;
1576 	objsize = UMA_SMALLEST_UNIT;
1577 	while (totsize >= wsize) {
1578 		totsize = (UMA_SLAB_SIZE - sizeof(struct uma_slab_refcnt)) /
1579 		    (objsize + UMA_FRITMREF_SZ);
1580 		totsize *= (UMA_FRITMREF_SZ + objsize);
1581 		objsize++;
1582 	}
1583 	if (objsize > UMA_SMALLEST_UNIT)
1584 		objsize--;
1585 	uma_max_ipers_ref = UMA_SLAB_SIZE / objsize;
1586 
1587 	KASSERT((uma_max_ipers_ref <= 255) && (uma_max_ipers <= 255),
1588 	    ("uma_startup: calculated uma_max_ipers values too large!"));
1589 
1590 #ifdef UMA_DEBUG
1591 	printf("Calculated uma_max_ipers (for OFFPAGE) is %d\n", uma_max_ipers);
1592 	printf("Calculated uma_max_ipers_slab (for OFFPAGE) is %d\n",
1593 	    uma_max_ipers_ref);
1594 #endif
1595 
1596 	/* "manually" create the initial zone */
1597 	args.name = "UMA Kegs";
1598 	args.size = sizeof(struct uma_keg);
1599 	args.ctor = keg_ctor;
1600 	args.dtor = keg_dtor;
1601 	args.uminit = zero_init;
1602 	args.fini = NULL;
1603 	args.keg = &masterkeg;
1604 	args.align = 32 - 1;
1605 	args.flags = UMA_ZFLAG_INTERNAL;
1606 	/* The initial zone has no Per cpu queues so it's smaller */
1607 	zone_ctor(kegs, sizeof(struct uma_zone), &args, M_WAITOK);
1608 
1609 #ifdef UMA_DEBUG
1610 	printf("Filling boot free list.\n");
1611 #endif
1612 	for (i = 0; i < UMA_BOOT_PAGES; i++) {
1613 		slab = (uma_slab_t)((u_int8_t *)bootmem + (i * UMA_SLAB_SIZE));
1614 		slab->us_data = (u_int8_t *)slab;
1615 		slab->us_flags = UMA_SLAB_BOOT;
1616 		LIST_INSERT_HEAD(&uma_boot_pages, slab, us_link);
1617 		uma_boot_free++;
1618 	}
1619 
1620 #ifdef UMA_DEBUG
1621 	printf("Creating uma zone headers zone and keg.\n");
1622 #endif
1623 	args.name = "UMA Zones";
1624 	args.size = sizeof(struct uma_zone) +
1625 	    (sizeof(struct uma_cache) * (mp_maxid + 1));
1626 	args.ctor = zone_ctor;
1627 	args.dtor = zone_dtor;
1628 	args.uminit = zero_init;
1629 	args.fini = NULL;
1630 	args.keg = NULL;
1631 	args.align = 32 - 1;
1632 	args.flags = UMA_ZFLAG_INTERNAL;
1633 	/* The initial zone has no Per cpu queues so it's smaller */
1634 	zone_ctor(zones, sizeof(struct uma_zone), &args, M_WAITOK);
1635 
1636 #ifdef UMA_DEBUG
1637 	printf("Initializing pcpu cache locks.\n");
1638 #endif
1639 	/* Initialize the pcpu cache lock set once and for all */
1640 	for (i = 0; i <= mp_maxid; i++)
1641 		CPU_LOCK_INIT(i);
1642 
1643 #ifdef UMA_DEBUG
1644 	printf("Creating slab and hash zones.\n");
1645 #endif
1646 
1647 	/*
1648 	 * This is the max number of free list items we'll have with
1649 	 * offpage slabs.
1650 	 */
1651 	slabsize = uma_max_ipers * UMA_FRITM_SZ;
1652 	slabsize += sizeof(struct uma_slab);
1653 
1654 	/* Now make a zone for slab headers */
1655 	slabzone = uma_zcreate("UMA Slabs",
1656 				slabsize,
1657 				NULL, NULL, NULL, NULL,
1658 				UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
1659 
1660 	/*
1661 	 * We also create a zone for the bigger slabs with reference
1662 	 * counts in them, to accomodate UMA_ZONE_REFCNT zones.
1663 	 */
1664 	slabsize = uma_max_ipers_ref * UMA_FRITMREF_SZ;
1665 	slabsize += sizeof(struct uma_slab_refcnt);
1666 	slabrefzone = uma_zcreate("UMA RCntSlabs",
1667 				  slabsize,
1668 				  NULL, NULL, NULL, NULL,
1669 				  UMA_ALIGN_PTR,
1670 				  UMA_ZFLAG_INTERNAL);
1671 
1672 	hashzone = uma_zcreate("UMA Hash",
1673 	    sizeof(struct slabhead *) * UMA_HASH_SIZE_INIT,
1674 	    NULL, NULL, NULL, NULL,
1675 	    UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
1676 
1677 	bucket_init();
1678 
1679 #ifdef UMA_MD_SMALL_ALLOC
1680 	booted = 1;
1681 #endif
1682 
1683 #ifdef UMA_DEBUG
1684 	printf("UMA startup complete.\n");
1685 #endif
1686 }
1687 
1688 /* see uma.h */
1689 void
1690 uma_startup2(void)
1691 {
1692 	booted = 1;
1693 	bucket_enable();
1694 #ifdef UMA_DEBUG
1695 	printf("UMA startup2 complete.\n");
1696 #endif
1697 }
1698 
1699 /*
1700  * Initialize our callout handle
1701  *
1702  */
1703 
1704 static void
1705 uma_startup3(void)
1706 {
1707 #ifdef UMA_DEBUG
1708 	printf("Starting callout.\n");
1709 #endif
1710 	callout_init(&uma_callout, CALLOUT_MPSAFE);
1711 	callout_reset(&uma_callout, UMA_TIMEOUT * hz, uma_timeout, NULL);
1712 #ifdef UMA_DEBUG
1713 	printf("UMA startup3 complete.\n");
1714 #endif
1715 }
1716 
1717 static uma_zone_t
1718 uma_kcreate(uma_zone_t zone, size_t size, uma_init uminit, uma_fini fini,
1719 		int align, u_int16_t flags)
1720 {
1721 	struct uma_kctor_args args;
1722 
1723 	args.size = size;
1724 	args.uminit = uminit;
1725 	args.fini = fini;
1726 	args.align = align;
1727 	args.flags = flags;
1728 	args.zone = zone;
1729 	return (uma_zalloc_internal(kegs, &args, M_WAITOK));
1730 }
1731 
1732 /* See uma.h */
1733 uma_zone_t
1734 uma_zcreate(char *name, size_t size, uma_ctor ctor, uma_dtor dtor,
1735 		uma_init uminit, uma_fini fini, int align, u_int16_t flags)
1736 
1737 {
1738 	struct uma_zctor_args args;
1739 
1740 	/* This stuff is essential for the zone ctor */
1741 	args.name = name;
1742 	args.size = size;
1743 	args.ctor = ctor;
1744 	args.dtor = dtor;
1745 	args.uminit = uminit;
1746 	args.fini = fini;
1747 	args.align = align;
1748 	args.flags = flags;
1749 	args.keg = NULL;
1750 
1751 	return (uma_zalloc_internal(zones, &args, M_WAITOK));
1752 }
1753 
1754 /* See uma.h */
1755 uma_zone_t
1756 uma_zsecond_create(char *name, uma_ctor ctor, uma_dtor dtor,
1757 		    uma_init zinit, uma_fini zfini, uma_zone_t master)
1758 {
1759 	struct uma_zctor_args args;
1760 
1761 	args.name = name;
1762 	args.size = master->uz_keg->uk_size;
1763 	args.ctor = ctor;
1764 	args.dtor = dtor;
1765 	args.uminit = zinit;
1766 	args.fini = zfini;
1767 	args.align = master->uz_keg->uk_align;
1768 	args.flags = master->uz_keg->uk_flags | UMA_ZONE_SECONDARY;
1769 	args.keg = master->uz_keg;
1770 
1771 	return (uma_zalloc_internal(zones, &args, M_WAITOK));
1772 }
1773 
1774 /* See uma.h */
1775 void
1776 uma_zdestroy(uma_zone_t zone)
1777 {
1778 	uma_zfree_internal(zones, zone, NULL, SKIP_NONE);
1779 }
1780 
1781 /* See uma.h */
1782 void *
1783 uma_zalloc_arg(uma_zone_t zone, void *udata, int flags)
1784 {
1785 	void *item;
1786 	uma_cache_t cache;
1787 	uma_bucket_t bucket;
1788 	int cpu;
1789 	int badness;
1790 
1791 	/* This is the fast path allocation */
1792 #ifdef UMA_DEBUG_ALLOC_1
1793 	printf("Allocating one item from %s(%p)\n", zone->uz_name, zone);
1794 #endif
1795 	CTR3(KTR_UMA, "uma_zalloc_arg thread %x zone %s flags %d", curthread,
1796 	    zone->uz_name, flags);
1797 
1798 	if (!(flags & M_NOWAIT)) {
1799 		KASSERT(curthread->td_intr_nesting_level == 0,
1800 		   ("malloc(M_WAITOK) in interrupt context"));
1801 		if (nosleepwithlocks) {
1802 #ifdef WITNESS
1803 			badness = WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK,
1804 			    NULL,
1805 			    "malloc(M_WAITOK) of \"%s\", forcing M_NOWAIT",
1806 			    zone->uz_name);
1807 #else
1808 			badness = 1;
1809 #endif
1810 		} else {
1811 			badness = 0;
1812 #ifdef WITNESS
1813 			WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1814 			    "malloc(M_WAITOK) of \"%s\"", zone->uz_name);
1815 #endif
1816 		}
1817 		if (badness) {
1818 			flags &= ~M_WAITOK;
1819 			flags |= M_NOWAIT;
1820 		}
1821 	}
1822 
1823 zalloc_restart:
1824 	cpu = PCPU_GET(cpuid);
1825 	CPU_LOCK(cpu);
1826 	cache = &zone->uz_cpu[cpu];
1827 
1828 zalloc_start:
1829 	bucket = cache->uc_allocbucket;
1830 
1831 	if (bucket) {
1832 		if (bucket->ub_cnt > 0) {
1833 			bucket->ub_cnt--;
1834 			item = bucket->ub_bucket[bucket->ub_cnt];
1835 #ifdef INVARIANTS
1836 			bucket->ub_bucket[bucket->ub_cnt] = NULL;
1837 #endif
1838 			KASSERT(item != NULL,
1839 			    ("uma_zalloc: Bucket pointer mangled."));
1840 			cache->uc_allocs++;
1841 #ifdef INVARIANTS
1842 			ZONE_LOCK(zone);
1843 			uma_dbg_alloc(zone, NULL, item);
1844 			ZONE_UNLOCK(zone);
1845 #endif
1846 			CPU_UNLOCK(cpu);
1847 			if (zone->uz_ctor != NULL) {
1848 				if (zone->uz_ctor(item, zone->uz_keg->uk_size,
1849 				    udata, flags) != 0) {
1850 					uma_zfree_internal(zone, item, udata,
1851 					    SKIP_DTOR);
1852 					return (NULL);
1853 				}
1854 			}
1855 			if (flags & M_ZERO)
1856 				bzero(item, zone->uz_keg->uk_size);
1857 			return (item);
1858 		} else if (cache->uc_freebucket) {
1859 			/*
1860 			 * We have run out of items in our allocbucket.
1861 			 * See if we can switch with our free bucket.
1862 			 */
1863 			if (cache->uc_freebucket->ub_cnt > 0) {
1864 #ifdef UMA_DEBUG_ALLOC
1865 				printf("uma_zalloc: Swapping empty with"
1866 				    " alloc.\n");
1867 #endif
1868 				bucket = cache->uc_freebucket;
1869 				cache->uc_freebucket = cache->uc_allocbucket;
1870 				cache->uc_allocbucket = bucket;
1871 
1872 				goto zalloc_start;
1873 			}
1874 		}
1875 	}
1876 	ZONE_LOCK(zone);
1877 	/* Since we have locked the zone we may as well send back our stats */
1878 	zone->uz_allocs += cache->uc_allocs;
1879 	cache->uc_allocs = 0;
1880 
1881 	/* Our old one is now a free bucket */
1882 	if (cache->uc_allocbucket) {
1883 		KASSERT(cache->uc_allocbucket->ub_cnt == 0,
1884 		    ("uma_zalloc_arg: Freeing a non free bucket."));
1885 		LIST_INSERT_HEAD(&zone->uz_free_bucket,
1886 		    cache->uc_allocbucket, ub_link);
1887 		cache->uc_allocbucket = NULL;
1888 	}
1889 
1890 	/* Check the free list for a new alloc bucket */
1891 	if ((bucket = LIST_FIRST(&zone->uz_full_bucket)) != NULL) {
1892 		KASSERT(bucket->ub_cnt != 0,
1893 		    ("uma_zalloc_arg: Returning an empty bucket."));
1894 
1895 		LIST_REMOVE(bucket, ub_link);
1896 		cache->uc_allocbucket = bucket;
1897 		ZONE_UNLOCK(zone);
1898 		goto zalloc_start;
1899 	}
1900 	/* We are no longer associated with this cpu!!! */
1901 	CPU_UNLOCK(cpu);
1902 
1903 	/* Bump up our uz_count so we get here less */
1904 	if (zone->uz_count < BUCKET_MAX)
1905 		zone->uz_count++;
1906 
1907 	/*
1908 	 * Now lets just fill a bucket and put it on the free list.  If that
1909 	 * works we'll restart the allocation from the begining.
1910 	 */
1911 	if (uma_zalloc_bucket(zone, flags)) {
1912 		ZONE_UNLOCK(zone);
1913 		goto zalloc_restart;
1914 	}
1915 	ZONE_UNLOCK(zone);
1916 	/*
1917 	 * We may not be able to get a bucket so return an actual item.
1918 	 */
1919 #ifdef UMA_DEBUG
1920 	printf("uma_zalloc_arg: Bucketzone returned NULL\n");
1921 #endif
1922 
1923 	return (uma_zalloc_internal(zone, udata, flags));
1924 }
1925 
1926 static uma_slab_t
1927 uma_zone_slab(uma_zone_t zone, int flags)
1928 {
1929 	uma_slab_t slab;
1930 	uma_keg_t keg;
1931 
1932 	keg = zone->uz_keg;
1933 
1934 	/*
1935 	 * This is to prevent us from recursively trying to allocate
1936 	 * buckets.  The problem is that if an allocation forces us to
1937 	 * grab a new bucket we will call page_alloc, which will go off
1938 	 * and cause the vm to allocate vm_map_entries.  If we need new
1939 	 * buckets there too we will recurse in kmem_alloc and bad
1940 	 * things happen.  So instead we return a NULL bucket, and make
1941 	 * the code that allocates buckets smart enough to deal with it
1942 	 */
1943 	if (keg->uk_flags & UMA_ZFLAG_INTERNAL && keg->uk_recurse != 0)
1944 		return (NULL);
1945 
1946 	slab = NULL;
1947 
1948 	for (;;) {
1949 		/*
1950 		 * Find a slab with some space.  Prefer slabs that are partially
1951 		 * used over those that are totally full.  This helps to reduce
1952 		 * fragmentation.
1953 		 */
1954 		if (keg->uk_free != 0) {
1955 			if (!LIST_EMPTY(&keg->uk_part_slab)) {
1956 				slab = LIST_FIRST(&keg->uk_part_slab);
1957 			} else {
1958 				slab = LIST_FIRST(&keg->uk_free_slab);
1959 				LIST_REMOVE(slab, us_link);
1960 				LIST_INSERT_HEAD(&keg->uk_part_slab, slab,
1961 				    us_link);
1962 			}
1963 			return (slab);
1964 		}
1965 
1966 		/*
1967 		 * M_NOVM means don't ask at all!
1968 		 */
1969 		if (flags & M_NOVM)
1970 			break;
1971 
1972 		if (keg->uk_maxpages &&
1973 		    keg->uk_pages >= keg->uk_maxpages) {
1974 			keg->uk_flags |= UMA_ZFLAG_FULL;
1975 
1976 			if (flags & M_NOWAIT)
1977 				break;
1978 			else
1979 				msleep(keg, &keg->uk_lock, PVM,
1980 				    "zonelimit", 0);
1981 			continue;
1982 		}
1983 		keg->uk_recurse++;
1984 		slab = slab_zalloc(zone, flags);
1985 		keg->uk_recurse--;
1986 
1987 		/*
1988 		 * If we got a slab here it's safe to mark it partially used
1989 		 * and return.  We assume that the caller is going to remove
1990 		 * at least one item.
1991 		 */
1992 		if (slab) {
1993 			LIST_INSERT_HEAD(&keg->uk_part_slab, slab, us_link);
1994 			return (slab);
1995 		}
1996 		/*
1997 		 * We might not have been able to get a slab but another cpu
1998 		 * could have while we were unlocked.  Check again before we
1999 		 * fail.
2000 		 */
2001 		if (flags & M_NOWAIT)
2002 			flags |= M_NOVM;
2003 	}
2004 	return (slab);
2005 }
2006 
2007 static void *
2008 uma_slab_alloc(uma_zone_t zone, uma_slab_t slab)
2009 {
2010 	uma_keg_t keg;
2011 	uma_slabrefcnt_t slabref;
2012 	void *item;
2013 	u_int8_t freei;
2014 
2015 	keg = zone->uz_keg;
2016 
2017 	freei = slab->us_firstfree;
2018 	if (keg->uk_flags & UMA_ZONE_REFCNT) {
2019 		slabref = (uma_slabrefcnt_t)slab;
2020 		slab->us_firstfree = slabref->us_freelist[freei].us_item;
2021 	} else {
2022 		slab->us_firstfree = slab->us_freelist[freei].us_item;
2023 	}
2024 	item = slab->us_data + (keg->uk_rsize * freei);
2025 
2026 	slab->us_freecount--;
2027 	keg->uk_free--;
2028 #ifdef INVARIANTS
2029 	uma_dbg_alloc(zone, slab, item);
2030 #endif
2031 	/* Move this slab to the full list */
2032 	if (slab->us_freecount == 0) {
2033 		LIST_REMOVE(slab, us_link);
2034 		LIST_INSERT_HEAD(&keg->uk_full_slab, slab, us_link);
2035 	}
2036 
2037 	return (item);
2038 }
2039 
2040 static int
2041 uma_zalloc_bucket(uma_zone_t zone, int flags)
2042 {
2043 	uma_bucket_t bucket;
2044 	uma_slab_t slab;
2045 	int16_t saved;
2046 	int max, origflags = flags;
2047 
2048 	/*
2049 	 * Try this zone's free list first so we don't allocate extra buckets.
2050 	 */
2051 	if ((bucket = LIST_FIRST(&zone->uz_free_bucket)) != NULL) {
2052 		KASSERT(bucket->ub_cnt == 0,
2053 		    ("uma_zalloc_bucket: Bucket on free list is not empty."));
2054 		LIST_REMOVE(bucket, ub_link);
2055 	} else {
2056 		int bflags;
2057 
2058 		bflags = (flags & ~M_ZERO);
2059 		if (zone->uz_keg->uk_flags & UMA_ZFLAG_CACHEONLY)
2060 			bflags |= M_NOVM;
2061 
2062 		ZONE_UNLOCK(zone);
2063 		bucket = bucket_alloc(zone->uz_count, bflags);
2064 		ZONE_LOCK(zone);
2065 	}
2066 
2067 	if (bucket == NULL)
2068 		return (0);
2069 
2070 #ifdef SMP
2071 	/*
2072 	 * This code is here to limit the number of simultaneous bucket fills
2073 	 * for any given zone to the number of per cpu caches in this zone. This
2074 	 * is done so that we don't allocate more memory than we really need.
2075 	 */
2076 	if (zone->uz_fills >= mp_ncpus)
2077 		goto done;
2078 
2079 #endif
2080 	zone->uz_fills++;
2081 
2082 	max = MIN(bucket->ub_entries, zone->uz_count);
2083 	/* Try to keep the buckets totally full */
2084 	saved = bucket->ub_cnt;
2085 	while (bucket->ub_cnt < max &&
2086 	    (slab = uma_zone_slab(zone, flags)) != NULL) {
2087 		while (slab->us_freecount && bucket->ub_cnt < max) {
2088 			bucket->ub_bucket[bucket->ub_cnt++] =
2089 			    uma_slab_alloc(zone, slab);
2090 		}
2091 
2092 		/* Don't block on the next fill */
2093 		flags |= M_NOWAIT;
2094 	}
2095 
2096 	/*
2097 	 * We unlock here because we need to call the zone's init.
2098 	 * It should be safe to unlock because the slab dealt with
2099 	 * above is already on the appropriate list within the keg
2100 	 * and the bucket we filled is not yet on any list, so we
2101 	 * own it.
2102 	 */
2103 	if (zone->uz_init != NULL) {
2104 		int i;
2105 
2106 		ZONE_UNLOCK(zone);
2107 		for (i = saved; i < bucket->ub_cnt; i++)
2108 			if (zone->uz_init(bucket->ub_bucket[i],
2109 			    zone->uz_keg->uk_size, origflags) != 0)
2110 				break;
2111 		/*
2112 		 * If we couldn't initialize the whole bucket, put the
2113 		 * rest back onto the freelist.
2114 		 */
2115 		if (i != bucket->ub_cnt) {
2116 			int j;
2117 
2118 			for (j = i; j < bucket->ub_cnt; j++) {
2119 				uma_zfree_internal(zone, bucket->ub_bucket[j],
2120 				    NULL, SKIP_FINI);
2121 #ifdef INVARIANTS
2122 				bucket->ub_bucket[j] = NULL;
2123 #endif
2124 			}
2125 			bucket->ub_cnt = i;
2126 		}
2127 		ZONE_LOCK(zone);
2128 	}
2129 
2130 	zone->uz_fills--;
2131 	if (bucket->ub_cnt != 0) {
2132 		LIST_INSERT_HEAD(&zone->uz_full_bucket,
2133 		    bucket, ub_link);
2134 		return (1);
2135 	}
2136 #ifdef SMP
2137 done:
2138 #endif
2139 	bucket_free(bucket);
2140 
2141 	return (0);
2142 }
2143 /*
2144  * Allocates an item for an internal zone
2145  *
2146  * Arguments
2147  *	zone   The zone to alloc for.
2148  *	udata  The data to be passed to the constructor.
2149  *	flags  M_WAITOK, M_NOWAIT, M_ZERO.
2150  *
2151  * Returns
2152  *	NULL if there is no memory and M_NOWAIT is set
2153  *	An item if successful
2154  */
2155 
2156 static void *
2157 uma_zalloc_internal(uma_zone_t zone, void *udata, int flags)
2158 {
2159 	uma_keg_t keg;
2160 	uma_slab_t slab;
2161 	void *item;
2162 
2163 	item = NULL;
2164 	keg = zone->uz_keg;
2165 
2166 #ifdef UMA_DEBUG_ALLOC
2167 	printf("INTERNAL: Allocating one item from %s(%p)\n", zone->uz_name, zone);
2168 #endif
2169 	ZONE_LOCK(zone);
2170 
2171 	slab = uma_zone_slab(zone, flags);
2172 	if (slab == NULL) {
2173 		ZONE_UNLOCK(zone);
2174 		return (NULL);
2175 	}
2176 
2177 	item = uma_slab_alloc(zone, slab);
2178 
2179 	ZONE_UNLOCK(zone);
2180 
2181 	/*
2182 	 * We have to call both the zone's init (not the keg's init)
2183 	 * and the zone's ctor.  This is because the item is going from
2184 	 * a keg slab directly to the user, and the user is expecting it
2185 	 * to be both zone-init'd as well as zone-ctor'd.
2186 	 */
2187 	if (zone->uz_init != NULL) {
2188 		if (zone->uz_init(item, keg->uk_size, flags) != 0) {
2189 			uma_zfree_internal(zone, item, udata, SKIP_FINI);
2190 			return (NULL);
2191 		}
2192 	}
2193 	if (zone->uz_ctor != NULL) {
2194 		if (zone->uz_ctor(item, keg->uk_size, udata, flags) != 0) {
2195 			uma_zfree_internal(zone, item, udata, SKIP_DTOR);
2196 			return (NULL);
2197 		}
2198 	}
2199 	if (flags & M_ZERO)
2200 		bzero(item, keg->uk_size);
2201 
2202 	return (item);
2203 }
2204 
2205 /* See uma.h */
2206 void
2207 uma_zfree_arg(uma_zone_t zone, void *item, void *udata)
2208 {
2209 	uma_keg_t keg;
2210 	uma_cache_t cache;
2211 	uma_bucket_t bucket;
2212 	int bflags;
2213 	int cpu;
2214 	enum zfreeskip skip;
2215 
2216 	/* This is the fast path free */
2217 	skip = SKIP_NONE;
2218 	keg = zone->uz_keg;
2219 
2220 #ifdef UMA_DEBUG_ALLOC_1
2221 	printf("Freeing item %p to %s(%p)\n", item, zone->uz_name, zone);
2222 #endif
2223 	CTR2(KTR_UMA, "uma_zfree_arg thread %x zone %s", curthread,
2224 	    zone->uz_name);
2225 
2226 	/*
2227 	 * The race here is acceptable.  If we miss it we'll just have to wait
2228 	 * a little longer for the limits to be reset.
2229 	 */
2230 
2231 	if (keg->uk_flags & UMA_ZFLAG_FULL)
2232 		goto zfree_internal;
2233 
2234 	if (zone->uz_dtor) {
2235 		zone->uz_dtor(item, keg->uk_size, udata);
2236 		skip = SKIP_DTOR;
2237 	}
2238 
2239 zfree_restart:
2240 	cpu = PCPU_GET(cpuid);
2241 	CPU_LOCK(cpu);
2242 	cache = &zone->uz_cpu[cpu];
2243 
2244 zfree_start:
2245 	bucket = cache->uc_freebucket;
2246 
2247 	if (bucket) {
2248 		/*
2249 		 * Do we have room in our bucket? It is OK for this uz count
2250 		 * check to be slightly out of sync.
2251 		 */
2252 
2253 		if (bucket->ub_cnt < bucket->ub_entries) {
2254 			KASSERT(bucket->ub_bucket[bucket->ub_cnt] == NULL,
2255 			    ("uma_zfree: Freeing to non free bucket index."));
2256 			bucket->ub_bucket[bucket->ub_cnt] = item;
2257 			bucket->ub_cnt++;
2258 #ifdef INVARIANTS
2259 			ZONE_LOCK(zone);
2260 			if (keg->uk_flags & UMA_ZONE_MALLOC)
2261 				uma_dbg_free(zone, udata, item);
2262 			else
2263 				uma_dbg_free(zone, NULL, item);
2264 			ZONE_UNLOCK(zone);
2265 #endif
2266 			CPU_UNLOCK(cpu);
2267 			return;
2268 		} else if (cache->uc_allocbucket) {
2269 #ifdef UMA_DEBUG_ALLOC
2270 			printf("uma_zfree: Swapping buckets.\n");
2271 #endif
2272 			/*
2273 			 * We have run out of space in our freebucket.
2274 			 * See if we can switch with our alloc bucket.
2275 			 */
2276 			if (cache->uc_allocbucket->ub_cnt <
2277 			    cache->uc_freebucket->ub_cnt) {
2278 				bucket = cache->uc_freebucket;
2279 				cache->uc_freebucket = cache->uc_allocbucket;
2280 				cache->uc_allocbucket = bucket;
2281 				goto zfree_start;
2282 			}
2283 		}
2284 	}
2285 	/*
2286 	 * We can get here for two reasons:
2287 	 *
2288 	 * 1) The buckets are NULL
2289 	 * 2) The alloc and free buckets are both somewhat full.
2290 	 */
2291 
2292 	ZONE_LOCK(zone);
2293 
2294 	bucket = cache->uc_freebucket;
2295 	cache->uc_freebucket = NULL;
2296 
2297 	/* Can we throw this on the zone full list? */
2298 	if (bucket != NULL) {
2299 #ifdef UMA_DEBUG_ALLOC
2300 		printf("uma_zfree: Putting old bucket on the free list.\n");
2301 #endif
2302 		/* ub_cnt is pointing to the last free item */
2303 		KASSERT(bucket->ub_cnt != 0,
2304 		    ("uma_zfree: Attempting to insert an empty bucket onto the full list.\n"));
2305 		LIST_INSERT_HEAD(&zone->uz_full_bucket,
2306 		    bucket, ub_link);
2307 	}
2308 	if ((bucket = LIST_FIRST(&zone->uz_free_bucket)) != NULL) {
2309 		LIST_REMOVE(bucket, ub_link);
2310 		ZONE_UNLOCK(zone);
2311 		cache->uc_freebucket = bucket;
2312 		goto zfree_start;
2313 	}
2314 	/* We're done with this CPU now */
2315 	CPU_UNLOCK(cpu);
2316 
2317 	/* And the zone.. */
2318 	ZONE_UNLOCK(zone);
2319 
2320 #ifdef UMA_DEBUG_ALLOC
2321 	printf("uma_zfree: Allocating new free bucket.\n");
2322 #endif
2323 	bflags = M_NOWAIT;
2324 
2325 	if (keg->uk_flags & UMA_ZFLAG_CACHEONLY)
2326 		bflags |= M_NOVM;
2327 	bucket = bucket_alloc(zone->uz_count, bflags);
2328 	if (bucket) {
2329 		ZONE_LOCK(zone);
2330 		LIST_INSERT_HEAD(&zone->uz_free_bucket,
2331 		    bucket, ub_link);
2332 		ZONE_UNLOCK(zone);
2333 		goto zfree_restart;
2334 	}
2335 
2336 	/*
2337 	 * If nothing else caught this, we'll just do an internal free.
2338 	 */
2339 
2340 zfree_internal:
2341 
2342 #ifdef INVARIANTS
2343 	/*
2344 	 * If we need to skip the dtor and the uma_dbg_free in
2345 	 * uma_zfree_internal because we've already called the dtor
2346 	 * above, but we ended up here, then we need to make sure
2347 	 * that we take care of the uma_dbg_free immediately.
2348 	 */
2349 	if (skip) {
2350 		ZONE_LOCK(zone);
2351 		if (keg->uk_flags & UMA_ZONE_MALLOC)
2352 			uma_dbg_free(zone, udata, item);
2353 		else
2354 			uma_dbg_free(zone, NULL, item);
2355 		ZONE_UNLOCK(zone);
2356 	}
2357 #endif
2358 	uma_zfree_internal(zone, item, udata, skip);
2359 
2360 	return;
2361 }
2362 
2363 /*
2364  * Frees an item to an INTERNAL zone or allocates a free bucket
2365  *
2366  * Arguments:
2367  *	zone   The zone to free to
2368  *	item   The item we're freeing
2369  *	udata  User supplied data for the dtor
2370  *	skip   Skip dtors and finis
2371  */
2372 static void
2373 uma_zfree_internal(uma_zone_t zone, void *item, void *udata,
2374     enum zfreeskip skip)
2375 {
2376 	uma_slab_t slab;
2377 	uma_slabrefcnt_t slabref;
2378 	uma_keg_t keg;
2379 	u_int8_t *mem;
2380 	u_int8_t freei;
2381 
2382 	keg = zone->uz_keg;
2383 
2384 	if (skip < SKIP_DTOR && zone->uz_dtor)
2385 		zone->uz_dtor(item, keg->uk_size, udata);
2386 	if (skip < SKIP_FINI && zone->uz_fini)
2387 		zone->uz_fini(item, keg->uk_size);
2388 
2389 	ZONE_LOCK(zone);
2390 
2391 	if (!(keg->uk_flags & UMA_ZONE_MALLOC)) {
2392 		mem = (u_int8_t *)((unsigned long)item & (~UMA_SLAB_MASK));
2393 		if (keg->uk_flags & UMA_ZONE_HASH)
2394 			slab = hash_sfind(&keg->uk_hash, mem);
2395 		else {
2396 			mem += keg->uk_pgoff;
2397 			slab = (uma_slab_t)mem;
2398 		}
2399 	} else {
2400 		slab = (uma_slab_t)udata;
2401 	}
2402 
2403 	/* Do we need to remove from any lists? */
2404 	if (slab->us_freecount+1 == keg->uk_ipers) {
2405 		LIST_REMOVE(slab, us_link);
2406 		LIST_INSERT_HEAD(&keg->uk_free_slab, slab, us_link);
2407 	} else if (slab->us_freecount == 0) {
2408 		LIST_REMOVE(slab, us_link);
2409 		LIST_INSERT_HEAD(&keg->uk_part_slab, slab, us_link);
2410 	}
2411 
2412 	/* Slab management stuff */
2413 	freei = ((unsigned long)item - (unsigned long)slab->us_data)
2414 		/ keg->uk_rsize;
2415 
2416 #ifdef INVARIANTS
2417 	if (!skip)
2418 		uma_dbg_free(zone, slab, item);
2419 #endif
2420 
2421 	if (keg->uk_flags & UMA_ZONE_REFCNT) {
2422 		slabref = (uma_slabrefcnt_t)slab;
2423 		slabref->us_freelist[freei].us_item = slab->us_firstfree;
2424 	} else {
2425 		slab->us_freelist[freei].us_item = slab->us_firstfree;
2426 	}
2427 	slab->us_firstfree = freei;
2428 	slab->us_freecount++;
2429 
2430 	/* Zone statistics */
2431 	keg->uk_free++;
2432 
2433 	if (keg->uk_flags & UMA_ZFLAG_FULL) {
2434 		if (keg->uk_pages < keg->uk_maxpages)
2435 			keg->uk_flags &= ~UMA_ZFLAG_FULL;
2436 
2437 		/* We can handle one more allocation */
2438 		wakeup_one(keg);
2439 	}
2440 
2441 	ZONE_UNLOCK(zone);
2442 }
2443 
2444 /* See uma.h */
2445 void
2446 uma_zone_set_max(uma_zone_t zone, int nitems)
2447 {
2448 	uma_keg_t keg;
2449 
2450 	keg = zone->uz_keg;
2451 	ZONE_LOCK(zone);
2452 	if (keg->uk_ppera > 1)
2453 		keg->uk_maxpages = nitems * keg->uk_ppera;
2454 	else
2455 		keg->uk_maxpages = nitems / keg->uk_ipers;
2456 
2457 	if (keg->uk_maxpages * keg->uk_ipers < nitems)
2458 		keg->uk_maxpages++;
2459 
2460 	ZONE_UNLOCK(zone);
2461 }
2462 
2463 /* See uma.h */
2464 void
2465 uma_zone_set_init(uma_zone_t zone, uma_init uminit)
2466 {
2467 	ZONE_LOCK(zone);
2468 	KASSERT(zone->uz_keg->uk_pages == 0,
2469 	    ("uma_zone_set_init on non-empty keg"));
2470 	zone->uz_keg->uk_init = uminit;
2471 	ZONE_UNLOCK(zone);
2472 }
2473 
2474 /* See uma.h */
2475 void
2476 uma_zone_set_fini(uma_zone_t zone, uma_fini fini)
2477 {
2478 	ZONE_LOCK(zone);
2479 	KASSERT(zone->uz_keg->uk_pages == 0,
2480 	    ("uma_zone_set_fini on non-empty keg"));
2481 	zone->uz_keg->uk_fini = fini;
2482 	ZONE_UNLOCK(zone);
2483 }
2484 
2485 /* See uma.h */
2486 void
2487 uma_zone_set_zinit(uma_zone_t zone, uma_init zinit)
2488 {
2489 	ZONE_LOCK(zone);
2490 	KASSERT(zone->uz_keg->uk_pages == 0,
2491 	    ("uma_zone_set_zinit on non-empty keg"));
2492 	zone->uz_init = zinit;
2493 	ZONE_UNLOCK(zone);
2494 }
2495 
2496 /* See uma.h */
2497 void
2498 uma_zone_set_zfini(uma_zone_t zone, uma_fini zfini)
2499 {
2500 	ZONE_LOCK(zone);
2501 	KASSERT(zone->uz_keg->uk_pages == 0,
2502 	    ("uma_zone_set_zfini on non-empty keg"));
2503 	zone->uz_fini = zfini;
2504 	ZONE_UNLOCK(zone);
2505 }
2506 
2507 /* See uma.h */
2508 /* XXX uk_freef is not actually used with the zone locked */
2509 void
2510 uma_zone_set_freef(uma_zone_t zone, uma_free freef)
2511 {
2512 	ZONE_LOCK(zone);
2513 	zone->uz_keg->uk_freef = freef;
2514 	ZONE_UNLOCK(zone);
2515 }
2516 
2517 /* See uma.h */
2518 /* XXX uk_allocf is not actually used with the zone locked */
2519 void
2520 uma_zone_set_allocf(uma_zone_t zone, uma_alloc allocf)
2521 {
2522 	ZONE_LOCK(zone);
2523 	zone->uz_keg->uk_flags |= UMA_ZFLAG_PRIVALLOC;
2524 	zone->uz_keg->uk_allocf = allocf;
2525 	ZONE_UNLOCK(zone);
2526 }
2527 
2528 /* See uma.h */
2529 int
2530 uma_zone_set_obj(uma_zone_t zone, struct vm_object *obj, int count)
2531 {
2532 	uma_keg_t keg;
2533 	vm_offset_t kva;
2534 	int pages;
2535 
2536 	keg = zone->uz_keg;
2537 	pages = count / keg->uk_ipers;
2538 
2539 	if (pages * keg->uk_ipers < count)
2540 		pages++;
2541 
2542 	kva = kmem_alloc_nofault(kernel_map, pages * UMA_SLAB_SIZE);
2543 
2544 	if (kva == 0)
2545 		return (0);
2546 	if (obj == NULL) {
2547 		obj = vm_object_allocate(OBJT_DEFAULT,
2548 		    pages);
2549 	} else {
2550 		VM_OBJECT_LOCK_INIT(obj, "uma object");
2551 		_vm_object_allocate(OBJT_DEFAULT,
2552 		    pages, obj);
2553 	}
2554 	ZONE_LOCK(zone);
2555 	keg->uk_kva = kva;
2556 	keg->uk_obj = obj;
2557 	keg->uk_maxpages = pages;
2558 	keg->uk_allocf = obj_alloc;
2559 	keg->uk_flags |= UMA_ZONE_NOFREE | UMA_ZFLAG_PRIVALLOC;
2560 	ZONE_UNLOCK(zone);
2561 	return (1);
2562 }
2563 
2564 /* See uma.h */
2565 void
2566 uma_prealloc(uma_zone_t zone, int items)
2567 {
2568 	int slabs;
2569 	uma_slab_t slab;
2570 	uma_keg_t keg;
2571 
2572 	keg = zone->uz_keg;
2573 	ZONE_LOCK(zone);
2574 	slabs = items / keg->uk_ipers;
2575 	if (slabs * keg->uk_ipers < items)
2576 		slabs++;
2577 	while (slabs > 0) {
2578 		slab = slab_zalloc(zone, M_WAITOK);
2579 		LIST_INSERT_HEAD(&keg->uk_free_slab, slab, us_link);
2580 		slabs--;
2581 	}
2582 	ZONE_UNLOCK(zone);
2583 }
2584 
2585 /* See uma.h */
2586 u_int32_t *
2587 uma_find_refcnt(uma_zone_t zone, void *item)
2588 {
2589 	uma_slabrefcnt_t slabref;
2590 	uma_keg_t keg;
2591 	u_int32_t *refcnt;
2592 	int idx;
2593 
2594 	keg = zone->uz_keg;
2595 	slabref = (uma_slabrefcnt_t)vtoslab((vm_offset_t)item &
2596 	    (~UMA_SLAB_MASK));
2597 	KASSERT(slabref != NULL && slabref->us_keg->uk_flags & UMA_ZONE_REFCNT,
2598 	    ("uma_find_refcnt(): zone possibly not UMA_ZONE_REFCNT"));
2599 	idx = ((unsigned long)item - (unsigned long)slabref->us_data)
2600 	    / keg->uk_rsize;
2601 	refcnt = &slabref->us_freelist[idx].us_refcnt;
2602 	return refcnt;
2603 }
2604 
2605 /* See uma.h */
2606 void
2607 uma_reclaim(void)
2608 {
2609 #ifdef UMA_DEBUG
2610 	printf("UMA: vm asked us to release pages!\n");
2611 #endif
2612 	bucket_enable();
2613 	zone_foreach(zone_drain);
2614 	/*
2615 	 * Some slabs may have been freed but this zone will be visited early
2616 	 * we visit again so that we can free pages that are empty once other
2617 	 * zones are drained.  We have to do the same for buckets.
2618 	 */
2619 	zone_drain(slabzone);
2620 	zone_drain(slabrefzone);
2621 	bucket_zone_drain();
2622 }
2623 
2624 void *
2625 uma_large_malloc(int size, int wait)
2626 {
2627 	void *mem;
2628 	uma_slab_t slab;
2629 	u_int8_t flags;
2630 
2631 	slab = uma_zalloc_internal(slabzone, NULL, wait);
2632 	if (slab == NULL)
2633 		return (NULL);
2634 	mem = page_alloc(NULL, size, &flags, wait);
2635 	if (mem) {
2636 		vsetslab((vm_offset_t)mem, slab);
2637 		slab->us_data = mem;
2638 		slab->us_flags = flags | UMA_SLAB_MALLOC;
2639 		slab->us_size = size;
2640 	} else {
2641 		uma_zfree_internal(slabzone, slab, NULL, 0);
2642 	}
2643 
2644 	return (mem);
2645 }
2646 
2647 void
2648 uma_large_free(uma_slab_t slab)
2649 {
2650 	vsetobj((vm_offset_t)slab->us_data, kmem_object);
2651 	page_free(slab->us_data, slab->us_size, slab->us_flags);
2652 	uma_zfree_internal(slabzone, slab, NULL, 0);
2653 }
2654 
2655 void
2656 uma_print_stats(void)
2657 {
2658 	zone_foreach(uma_print_zone);
2659 }
2660 
2661 static void
2662 slab_print(uma_slab_t slab)
2663 {
2664 	printf("slab: keg %p, data %p, freecount %d, firstfree %d\n",
2665 		slab->us_keg, slab->us_data, slab->us_freecount,
2666 		slab->us_firstfree);
2667 }
2668 
2669 static void
2670 cache_print(uma_cache_t cache)
2671 {
2672 	printf("alloc: %p(%d), free: %p(%d)\n",
2673 		cache->uc_allocbucket,
2674 		cache->uc_allocbucket?cache->uc_allocbucket->ub_cnt:0,
2675 		cache->uc_freebucket,
2676 		cache->uc_freebucket?cache->uc_freebucket->ub_cnt:0);
2677 }
2678 
2679 void
2680 uma_print_zone(uma_zone_t zone)
2681 {
2682 	uma_cache_t cache;
2683 	uma_keg_t keg;
2684 	uma_slab_t slab;
2685 	int i;
2686 
2687 	keg = zone->uz_keg;
2688 	printf("%s(%p) size %d(%d) flags %d ipers %d ppera %d out %d free %d\n",
2689 	    zone->uz_name, zone, keg->uk_size, keg->uk_rsize, keg->uk_flags,
2690 	    keg->uk_ipers, keg->uk_ppera,
2691 	    (keg->uk_ipers * keg->uk_pages) - keg->uk_free, keg->uk_free);
2692 	printf("Part slabs:\n");
2693 	LIST_FOREACH(slab, &keg->uk_part_slab, us_link)
2694 		slab_print(slab);
2695 	printf("Free slabs:\n");
2696 	LIST_FOREACH(slab, &keg->uk_free_slab, us_link)
2697 		slab_print(slab);
2698 	printf("Full slabs:\n");
2699 	LIST_FOREACH(slab, &keg->uk_full_slab, us_link)
2700 		slab_print(slab);
2701 	for (i = 0; i <= mp_maxid; i++) {
2702 		if (CPU_ABSENT(i))
2703 			continue;
2704 		cache = &zone->uz_cpu[i];
2705 		printf("CPU %d Cache:\n", i);
2706 		cache_print(cache);
2707 	}
2708 }
2709 
2710 /*
2711  * Sysctl handler for vm.zone
2712  *
2713  * stolen from vm_zone.c
2714  */
2715 static int
2716 sysctl_vm_zone(SYSCTL_HANDLER_ARGS)
2717 {
2718 	int error, len, cnt;
2719 	const int linesize = 128;	/* conservative */
2720 	int totalfree;
2721 	char *tmpbuf, *offset;
2722 	uma_zone_t z;
2723 	uma_keg_t zk;
2724 	char *p;
2725 	int cpu;
2726 	int cachefree;
2727 	uma_bucket_t bucket;
2728 	uma_cache_t cache;
2729 
2730 	cnt = 0;
2731 	mtx_lock(&uma_mtx);
2732 	LIST_FOREACH(zk, &uma_kegs, uk_link) {
2733 		LIST_FOREACH(z, &zk->uk_zones, uz_link)
2734 			cnt++;
2735 	}
2736 	mtx_unlock(&uma_mtx);
2737 	MALLOC(tmpbuf, char *, (cnt == 0 ? 1 : cnt) * linesize,
2738 			M_TEMP, M_WAITOK);
2739 	len = snprintf(tmpbuf, linesize,
2740 	    "\nITEM            SIZE     LIMIT     USED    FREE  REQUESTS\n\n");
2741 	if (cnt == 0)
2742 		tmpbuf[len - 1] = '\0';
2743 	error = SYSCTL_OUT(req, tmpbuf, cnt == 0 ? len-1 : len);
2744 	if (error || cnt == 0)
2745 		goto out;
2746 	offset = tmpbuf;
2747 	mtx_lock(&uma_mtx);
2748 	LIST_FOREACH(zk, &uma_kegs, uk_link) {
2749 	  LIST_FOREACH(z, &zk->uk_zones, uz_link) {
2750 		if (cnt == 0)	/* list may have changed size */
2751 			break;
2752 		if (!(zk->uk_flags & UMA_ZFLAG_INTERNAL)) {
2753 			for (cpu = 0; cpu <= mp_maxid; cpu++) {
2754 				if (CPU_ABSENT(cpu))
2755 					continue;
2756 				CPU_LOCK(cpu);
2757 			}
2758 		}
2759 		ZONE_LOCK(z);
2760 		cachefree = 0;
2761 		if (!(zk->uk_flags & UMA_ZFLAG_INTERNAL)) {
2762 			for (cpu = 0; cpu <= mp_maxid; cpu++) {
2763 				if (CPU_ABSENT(cpu))
2764 					continue;
2765 				cache = &z->uz_cpu[cpu];
2766 				if (cache->uc_allocbucket != NULL)
2767 					cachefree += cache->uc_allocbucket->ub_cnt;
2768 				if (cache->uc_freebucket != NULL)
2769 					cachefree += cache->uc_freebucket->ub_cnt;
2770 				CPU_UNLOCK(cpu);
2771 			}
2772 		}
2773 		LIST_FOREACH(bucket, &z->uz_full_bucket, ub_link) {
2774 			cachefree += bucket->ub_cnt;
2775 		}
2776 		totalfree = zk->uk_free + cachefree;
2777 		len = snprintf(offset, linesize,
2778 		    "%-12.12s  %6.6u, %8.8u, %6.6u, %6.6u, %8.8llu\n",
2779 		    z->uz_name, zk->uk_size,
2780 		    zk->uk_maxpages * zk->uk_ipers,
2781 		    (zk->uk_ipers * (zk->uk_pages / zk->uk_ppera)) - totalfree,
2782 		    totalfree,
2783 		    (unsigned long long)z->uz_allocs);
2784 		ZONE_UNLOCK(z);
2785 		for (p = offset + 12; p > offset && *p == ' '; --p)
2786 			/* nothing */ ;
2787 		p[1] = ':';
2788 		cnt--;
2789 		offset += len;
2790 	  }
2791 	}
2792 	mtx_unlock(&uma_mtx);
2793 	*offset++ = '\0';
2794 	error = SYSCTL_OUT(req, tmpbuf, offset - tmpbuf);
2795 out:
2796 	FREE(tmpbuf, M_TEMP);
2797 	return (error);
2798 }
2799