xref: /freebsd/sys/vm/uma_core.c (revision e3e9c656c9003719ecd29ca5b28aff7671de9117)
1 /*-
2  * Copyright (c) 2002-2005, 2009, 2013 Jeffrey Roberson <jeff@FreeBSD.org>
3  * Copyright (c) 2004, 2005 Bosko Milekic <bmilekic@FreeBSD.org>
4  * Copyright (c) 2004-2006 Robert N. M. Watson
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice unmodified, this list of conditions, and the following
12  *    disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * uma_core.c  Implementation of the Universal Memory allocator
31  *
32  * This allocator is intended to replace the multitude of similar object caches
33  * in the standard FreeBSD kernel.  The intent is to be flexible as well as
34  * efficient.  A primary design goal is to return unused memory to the rest of
35  * the system.  This will make the system as a whole more flexible due to the
36  * ability to move memory to subsystems which most need it instead of leaving
37  * pools of reserved memory unused.
38  *
39  * The basic ideas stem from similar slab/zone based allocators whose algorithms
40  * are well known.
41  *
42  */
43 
44 /*
45  * TODO:
46  *	- Improve memory usage for large allocations
47  *	- Investigate cache size adjustments
48  */
49 
50 #include <sys/cdefs.h>
51 __FBSDID("$FreeBSD$");
52 
53 /* I should really use ktr.. */
54 /*
55 #define UMA_DEBUG 1
56 #define UMA_DEBUG_ALLOC 1
57 #define UMA_DEBUG_ALLOC_1 1
58 */
59 
60 #include "opt_ddb.h"
61 #include "opt_param.h"
62 #include "opt_vm.h"
63 
64 #include <sys/param.h>
65 #include <sys/systm.h>
66 #include <sys/bitset.h>
67 #include <sys/eventhandler.h>
68 #include <sys/kernel.h>
69 #include <sys/types.h>
70 #include <sys/queue.h>
71 #include <sys/malloc.h>
72 #include <sys/ktr.h>
73 #include <sys/lock.h>
74 #include <sys/sysctl.h>
75 #include <sys/mutex.h>
76 #include <sys/proc.h>
77 #include <sys/random.h>
78 #include <sys/rwlock.h>
79 #include <sys/sbuf.h>
80 #include <sys/sched.h>
81 #include <sys/smp.h>
82 #include <sys/taskqueue.h>
83 #include <sys/vmmeter.h>
84 
85 #include <vm/vm.h>
86 #include <vm/vm_object.h>
87 #include <vm/vm_page.h>
88 #include <vm/vm_pageout.h>
89 #include <vm/vm_param.h>
90 #include <vm/vm_map.h>
91 #include <vm/vm_kern.h>
92 #include <vm/vm_extern.h>
93 #include <vm/uma.h>
94 #include <vm/uma_int.h>
95 #include <vm/uma_dbg.h>
96 
97 #include <ddb/ddb.h>
98 
99 #ifdef DEBUG_MEMGUARD
100 #include <vm/memguard.h>
101 #endif
102 
103 /*
104  * This is the zone and keg from which all zones are spawned.  The idea is that
105  * even the zone & keg heads are allocated from the allocator, so we use the
106  * bss section to bootstrap us.
107  */
108 static struct uma_keg masterkeg;
109 static struct uma_zone masterzone_k;
110 static struct uma_zone masterzone_z;
111 static uma_zone_t kegs = &masterzone_k;
112 static uma_zone_t zones = &masterzone_z;
113 
114 /* This is the zone from which all of uma_slab_t's are allocated. */
115 static uma_zone_t slabzone;
116 
117 /*
118  * The initial hash tables come out of this zone so they can be allocated
119  * prior to malloc coming up.
120  */
121 static uma_zone_t hashzone;
122 
123 /* The boot-time adjusted value for cache line alignment. */
124 int uma_align_cache = 64 - 1;
125 
126 static MALLOC_DEFINE(M_UMAHASH, "UMAHash", "UMA Hash Buckets");
127 
128 /*
129  * Are we allowed to allocate buckets?
130  */
131 static int bucketdisable = 1;
132 
133 /* Linked list of all kegs in the system */
134 static LIST_HEAD(,uma_keg) uma_kegs = LIST_HEAD_INITIALIZER(uma_kegs);
135 
136 /* Linked list of all cache-only zones in the system */
137 static LIST_HEAD(,uma_zone) uma_cachezones =
138     LIST_HEAD_INITIALIZER(uma_cachezones);
139 
140 /* This RW lock protects the keg list */
141 static struct rwlock_padalign uma_rwlock;
142 
143 /* Linked list of boot time pages */
144 static LIST_HEAD(,uma_slab) uma_boot_pages =
145     LIST_HEAD_INITIALIZER(uma_boot_pages);
146 
147 /* This mutex protects the boot time pages list */
148 static struct mtx_padalign uma_boot_pages_mtx;
149 
150 static struct sx uma_drain_lock;
151 
152 /* Is the VM done starting up? */
153 static int booted = 0;
154 #define	UMA_STARTUP	1
155 #define	UMA_STARTUP2	2
156 
157 /*
158  * This is the handle used to schedule events that need to happen
159  * outside of the allocation fast path.
160  */
161 static struct callout uma_callout;
162 #define	UMA_TIMEOUT	20		/* Seconds for callout interval. */
163 
164 /*
165  * This structure is passed as the zone ctor arg so that I don't have to create
166  * a special allocation function just for zones.
167  */
168 struct uma_zctor_args {
169 	const char *name;
170 	size_t size;
171 	uma_ctor ctor;
172 	uma_dtor dtor;
173 	uma_init uminit;
174 	uma_fini fini;
175 	uma_import import;
176 	uma_release release;
177 	void *arg;
178 	uma_keg_t keg;
179 	int align;
180 	uint32_t flags;
181 };
182 
183 struct uma_kctor_args {
184 	uma_zone_t zone;
185 	size_t size;
186 	uma_init uminit;
187 	uma_fini fini;
188 	int align;
189 	uint32_t flags;
190 };
191 
192 struct uma_bucket_zone {
193 	uma_zone_t	ubz_zone;
194 	char		*ubz_name;
195 	int		ubz_entries;	/* Number of items it can hold. */
196 	int		ubz_maxsize;	/* Maximum allocation size per-item. */
197 };
198 
199 /*
200  * Compute the actual number of bucket entries to pack them in power
201  * of two sizes for more efficient space utilization.
202  */
203 #define	BUCKET_SIZE(n)						\
204     (((sizeof(void *) * (n)) - sizeof(struct uma_bucket)) / sizeof(void *))
205 
206 #define	BUCKET_MAX	BUCKET_SIZE(256)
207 
208 struct uma_bucket_zone bucket_zones[] = {
209 	{ NULL, "4 Bucket", BUCKET_SIZE(4), 4096 },
210 	{ NULL, "6 Bucket", BUCKET_SIZE(6), 3072 },
211 	{ NULL, "8 Bucket", BUCKET_SIZE(8), 2048 },
212 	{ NULL, "12 Bucket", BUCKET_SIZE(12), 1536 },
213 	{ NULL, "16 Bucket", BUCKET_SIZE(16), 1024 },
214 	{ NULL, "32 Bucket", BUCKET_SIZE(32), 512 },
215 	{ NULL, "64 Bucket", BUCKET_SIZE(64), 256 },
216 	{ NULL, "128 Bucket", BUCKET_SIZE(128), 128 },
217 	{ NULL, "256 Bucket", BUCKET_SIZE(256), 64 },
218 	{ NULL, NULL, 0}
219 };
220 
221 /*
222  * Flags and enumerations to be passed to internal functions.
223  */
224 enum zfreeskip { SKIP_NONE = 0, SKIP_DTOR, SKIP_FINI };
225 
226 /* Prototypes.. */
227 
228 static void *noobj_alloc(uma_zone_t, vm_size_t, uint8_t *, int);
229 static void *page_alloc(uma_zone_t, vm_size_t, uint8_t *, int);
230 static void *startup_alloc(uma_zone_t, vm_size_t, uint8_t *, int);
231 static void page_free(void *, vm_size_t, uint8_t);
232 static uma_slab_t keg_alloc_slab(uma_keg_t, uma_zone_t, int);
233 static void cache_drain(uma_zone_t);
234 static void bucket_drain(uma_zone_t, uma_bucket_t);
235 static void bucket_cache_drain(uma_zone_t zone);
236 static int keg_ctor(void *, int, void *, int);
237 static void keg_dtor(void *, int, void *);
238 static int zone_ctor(void *, int, void *, int);
239 static void zone_dtor(void *, int, void *);
240 static int zero_init(void *, int, int);
241 static void keg_small_init(uma_keg_t keg);
242 static void keg_large_init(uma_keg_t keg);
243 static void zone_foreach(void (*zfunc)(uma_zone_t));
244 static void zone_timeout(uma_zone_t zone);
245 static int hash_alloc(struct uma_hash *);
246 static int hash_expand(struct uma_hash *, struct uma_hash *);
247 static void hash_free(struct uma_hash *hash);
248 static void uma_timeout(void *);
249 static void uma_startup3(void);
250 static void *zone_alloc_item(uma_zone_t, void *, int);
251 static void zone_free_item(uma_zone_t, void *, void *, enum zfreeskip);
252 static void bucket_enable(void);
253 static void bucket_init(void);
254 static uma_bucket_t bucket_alloc(uma_zone_t zone, void *, int);
255 static void bucket_free(uma_zone_t zone, uma_bucket_t, void *);
256 static void bucket_zone_drain(void);
257 static uma_bucket_t zone_alloc_bucket(uma_zone_t zone, void *, int flags);
258 static uma_slab_t zone_fetch_slab(uma_zone_t zone, uma_keg_t last, int flags);
259 static uma_slab_t zone_fetch_slab_multi(uma_zone_t zone, uma_keg_t last, int flags);
260 static void *slab_alloc_item(uma_keg_t keg, uma_slab_t slab);
261 static void slab_free_item(uma_keg_t keg, uma_slab_t slab, void *item);
262 static uma_keg_t uma_kcreate(uma_zone_t zone, size_t size, uma_init uminit,
263     uma_fini fini, int align, uint32_t flags);
264 static int zone_import(uma_zone_t zone, void **bucket, int max, int flags);
265 static void zone_release(uma_zone_t zone, void **bucket, int cnt);
266 static void uma_zero_item(void *item, uma_zone_t zone);
267 
268 void uma_print_zone(uma_zone_t);
269 void uma_print_stats(void);
270 static int sysctl_vm_zone_count(SYSCTL_HANDLER_ARGS);
271 static int sysctl_vm_zone_stats(SYSCTL_HANDLER_ARGS);
272 
273 #ifdef INVARIANTS
274 static void uma_dbg_free(uma_zone_t zone, uma_slab_t slab, void *item);
275 static void uma_dbg_alloc(uma_zone_t zone, uma_slab_t slab, void *item);
276 #endif
277 
278 SYSINIT(uma_startup3, SI_SUB_VM_CONF, SI_ORDER_SECOND, uma_startup3, NULL);
279 
280 SYSCTL_PROC(_vm, OID_AUTO, zone_count, CTLFLAG_RD|CTLTYPE_INT,
281     0, 0, sysctl_vm_zone_count, "I", "Number of UMA zones");
282 
283 SYSCTL_PROC(_vm, OID_AUTO, zone_stats, CTLFLAG_RD|CTLTYPE_STRUCT,
284     0, 0, sysctl_vm_zone_stats, "s,struct uma_type_header", "Zone Stats");
285 
286 static int zone_warnings = 1;
287 SYSCTL_INT(_vm, OID_AUTO, zone_warnings, CTLFLAG_RWTUN, &zone_warnings, 0,
288     "Warn when UMA zones becomes full");
289 
290 /*
291  * This routine checks to see whether or not it's safe to enable buckets.
292  */
293 static void
294 bucket_enable(void)
295 {
296 	bucketdisable = vm_page_count_min();
297 }
298 
299 /*
300  * Initialize bucket_zones, the array of zones of buckets of various sizes.
301  *
302  * For each zone, calculate the memory required for each bucket, consisting
303  * of the header and an array of pointers.
304  */
305 static void
306 bucket_init(void)
307 {
308 	struct uma_bucket_zone *ubz;
309 	int size;
310 
311 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++) {
312 		size = roundup(sizeof(struct uma_bucket), sizeof(void *));
313 		size += sizeof(void *) * ubz->ubz_entries;
314 		ubz->ubz_zone = uma_zcreate(ubz->ubz_name, size,
315 		    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
316 		    UMA_ZONE_MTXCLASS | UMA_ZFLAG_BUCKET);
317 	}
318 }
319 
320 /*
321  * Given a desired number of entries for a bucket, return the zone from which
322  * to allocate the bucket.
323  */
324 static struct uma_bucket_zone *
325 bucket_zone_lookup(int entries)
326 {
327 	struct uma_bucket_zone *ubz;
328 
329 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++)
330 		if (ubz->ubz_entries >= entries)
331 			return (ubz);
332 	ubz--;
333 	return (ubz);
334 }
335 
336 static int
337 bucket_select(int size)
338 {
339 	struct uma_bucket_zone *ubz;
340 
341 	ubz = &bucket_zones[0];
342 	if (size > ubz->ubz_maxsize)
343 		return MAX((ubz->ubz_maxsize * ubz->ubz_entries) / size, 1);
344 
345 	for (; ubz->ubz_entries != 0; ubz++)
346 		if (ubz->ubz_maxsize < size)
347 			break;
348 	ubz--;
349 	return (ubz->ubz_entries);
350 }
351 
352 static uma_bucket_t
353 bucket_alloc(uma_zone_t zone, void *udata, int flags)
354 {
355 	struct uma_bucket_zone *ubz;
356 	uma_bucket_t bucket;
357 
358 	/*
359 	 * This is to stop us from allocating per cpu buckets while we're
360 	 * running out of vm.boot_pages.  Otherwise, we would exhaust the
361 	 * boot pages.  This also prevents us from allocating buckets in
362 	 * low memory situations.
363 	 */
364 	if (bucketdisable)
365 		return (NULL);
366 	/*
367 	 * To limit bucket recursion we store the original zone flags
368 	 * in a cookie passed via zalloc_arg/zfree_arg.  This allows the
369 	 * NOVM flag to persist even through deep recursions.  We also
370 	 * store ZFLAG_BUCKET once we have recursed attempting to allocate
371 	 * a bucket for a bucket zone so we do not allow infinite bucket
372 	 * recursion.  This cookie will even persist to frees of unused
373 	 * buckets via the allocation path or bucket allocations in the
374 	 * free path.
375 	 */
376 	if ((zone->uz_flags & UMA_ZFLAG_BUCKET) == 0)
377 		udata = (void *)(uintptr_t)zone->uz_flags;
378 	else {
379 		if ((uintptr_t)udata & UMA_ZFLAG_BUCKET)
380 			return (NULL);
381 		udata = (void *)((uintptr_t)udata | UMA_ZFLAG_BUCKET);
382 	}
383 	if ((uintptr_t)udata & UMA_ZFLAG_CACHEONLY)
384 		flags |= M_NOVM;
385 	ubz = bucket_zone_lookup(zone->uz_count);
386 	if (ubz->ubz_zone == zone && (ubz + 1)->ubz_entries != 0)
387 		ubz++;
388 	bucket = uma_zalloc_arg(ubz->ubz_zone, udata, flags);
389 	if (bucket) {
390 #ifdef INVARIANTS
391 		bzero(bucket->ub_bucket, sizeof(void *) * ubz->ubz_entries);
392 #endif
393 		bucket->ub_cnt = 0;
394 		bucket->ub_entries = ubz->ubz_entries;
395 	}
396 
397 	return (bucket);
398 }
399 
400 static void
401 bucket_free(uma_zone_t zone, uma_bucket_t bucket, void *udata)
402 {
403 	struct uma_bucket_zone *ubz;
404 
405 	KASSERT(bucket->ub_cnt == 0,
406 	    ("bucket_free: Freeing a non free bucket."));
407 	if ((zone->uz_flags & UMA_ZFLAG_BUCKET) == 0)
408 		udata = (void *)(uintptr_t)zone->uz_flags;
409 	ubz = bucket_zone_lookup(bucket->ub_entries);
410 	uma_zfree_arg(ubz->ubz_zone, bucket, udata);
411 }
412 
413 static void
414 bucket_zone_drain(void)
415 {
416 	struct uma_bucket_zone *ubz;
417 
418 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++)
419 		zone_drain(ubz->ubz_zone);
420 }
421 
422 static void
423 zone_log_warning(uma_zone_t zone)
424 {
425 	static const struct timeval warninterval = { 300, 0 };
426 
427 	if (!zone_warnings || zone->uz_warning == NULL)
428 		return;
429 
430 	if (ratecheck(&zone->uz_ratecheck, &warninterval))
431 		printf("[zone: %s] %s\n", zone->uz_name, zone->uz_warning);
432 }
433 
434 static inline void
435 zone_maxaction(uma_zone_t zone)
436 {
437 
438 	if (zone->uz_maxaction.ta_func != NULL)
439 		taskqueue_enqueue(taskqueue_thread, &zone->uz_maxaction);
440 }
441 
442 static void
443 zone_foreach_keg(uma_zone_t zone, void (*kegfn)(uma_keg_t))
444 {
445 	uma_klink_t klink;
446 
447 	LIST_FOREACH(klink, &zone->uz_kegs, kl_link)
448 		kegfn(klink->kl_keg);
449 }
450 
451 /*
452  * Routine called by timeout which is used to fire off some time interval
453  * based calculations.  (stats, hash size, etc.)
454  *
455  * Arguments:
456  *	arg   Unused
457  *
458  * Returns:
459  *	Nothing
460  */
461 static void
462 uma_timeout(void *unused)
463 {
464 	bucket_enable();
465 	zone_foreach(zone_timeout);
466 
467 	/* Reschedule this event */
468 	callout_reset(&uma_callout, UMA_TIMEOUT * hz, uma_timeout, NULL);
469 }
470 
471 /*
472  * Routine to perform timeout driven calculations.  This expands the
473  * hashes and does per cpu statistics aggregation.
474  *
475  *  Returns nothing.
476  */
477 static void
478 keg_timeout(uma_keg_t keg)
479 {
480 
481 	KEG_LOCK(keg);
482 	/*
483 	 * Expand the keg hash table.
484 	 *
485 	 * This is done if the number of slabs is larger than the hash size.
486 	 * What I'm trying to do here is completely reduce collisions.  This
487 	 * may be a little aggressive.  Should I allow for two collisions max?
488 	 */
489 	if (keg->uk_flags & UMA_ZONE_HASH &&
490 	    keg->uk_pages / keg->uk_ppera >= keg->uk_hash.uh_hashsize) {
491 		struct uma_hash newhash;
492 		struct uma_hash oldhash;
493 		int ret;
494 
495 		/*
496 		 * This is so involved because allocating and freeing
497 		 * while the keg lock is held will lead to deadlock.
498 		 * I have to do everything in stages and check for
499 		 * races.
500 		 */
501 		newhash = keg->uk_hash;
502 		KEG_UNLOCK(keg);
503 		ret = hash_alloc(&newhash);
504 		KEG_LOCK(keg);
505 		if (ret) {
506 			if (hash_expand(&keg->uk_hash, &newhash)) {
507 				oldhash = keg->uk_hash;
508 				keg->uk_hash = newhash;
509 			} else
510 				oldhash = newhash;
511 
512 			KEG_UNLOCK(keg);
513 			hash_free(&oldhash);
514 			return;
515 		}
516 	}
517 	KEG_UNLOCK(keg);
518 }
519 
520 static void
521 zone_timeout(uma_zone_t zone)
522 {
523 
524 	zone_foreach_keg(zone, &keg_timeout);
525 }
526 
527 /*
528  * Allocate and zero fill the next sized hash table from the appropriate
529  * backing store.
530  *
531  * Arguments:
532  *	hash  A new hash structure with the old hash size in uh_hashsize
533  *
534  * Returns:
535  *	1 on success and 0 on failure.
536  */
537 static int
538 hash_alloc(struct uma_hash *hash)
539 {
540 	int oldsize;
541 	int alloc;
542 
543 	oldsize = hash->uh_hashsize;
544 
545 	/* We're just going to go to a power of two greater */
546 	if (oldsize)  {
547 		hash->uh_hashsize = oldsize * 2;
548 		alloc = sizeof(hash->uh_slab_hash[0]) * hash->uh_hashsize;
549 		hash->uh_slab_hash = (struct slabhead *)malloc(alloc,
550 		    M_UMAHASH, M_NOWAIT);
551 	} else {
552 		alloc = sizeof(hash->uh_slab_hash[0]) * UMA_HASH_SIZE_INIT;
553 		hash->uh_slab_hash = zone_alloc_item(hashzone, NULL,
554 		    M_WAITOK);
555 		hash->uh_hashsize = UMA_HASH_SIZE_INIT;
556 	}
557 	if (hash->uh_slab_hash) {
558 		bzero(hash->uh_slab_hash, alloc);
559 		hash->uh_hashmask = hash->uh_hashsize - 1;
560 		return (1);
561 	}
562 
563 	return (0);
564 }
565 
566 /*
567  * Expands the hash table for HASH zones.  This is done from zone_timeout
568  * to reduce collisions.  This must not be done in the regular allocation
569  * path, otherwise, we can recurse on the vm while allocating pages.
570  *
571  * Arguments:
572  *	oldhash  The hash you want to expand
573  *	newhash  The hash structure for the new table
574  *
575  * Returns:
576  *	Nothing
577  *
578  * Discussion:
579  */
580 static int
581 hash_expand(struct uma_hash *oldhash, struct uma_hash *newhash)
582 {
583 	uma_slab_t slab;
584 	int hval;
585 	int i;
586 
587 	if (!newhash->uh_slab_hash)
588 		return (0);
589 
590 	if (oldhash->uh_hashsize >= newhash->uh_hashsize)
591 		return (0);
592 
593 	/*
594 	 * I need to investigate hash algorithms for resizing without a
595 	 * full rehash.
596 	 */
597 
598 	for (i = 0; i < oldhash->uh_hashsize; i++)
599 		while (!SLIST_EMPTY(&oldhash->uh_slab_hash[i])) {
600 			slab = SLIST_FIRST(&oldhash->uh_slab_hash[i]);
601 			SLIST_REMOVE_HEAD(&oldhash->uh_slab_hash[i], us_hlink);
602 			hval = UMA_HASH(newhash, slab->us_data);
603 			SLIST_INSERT_HEAD(&newhash->uh_slab_hash[hval],
604 			    slab, us_hlink);
605 		}
606 
607 	return (1);
608 }
609 
610 /*
611  * Free the hash bucket to the appropriate backing store.
612  *
613  * Arguments:
614  *	slab_hash  The hash bucket we're freeing
615  *	hashsize   The number of entries in that hash bucket
616  *
617  * Returns:
618  *	Nothing
619  */
620 static void
621 hash_free(struct uma_hash *hash)
622 {
623 	if (hash->uh_slab_hash == NULL)
624 		return;
625 	if (hash->uh_hashsize == UMA_HASH_SIZE_INIT)
626 		zone_free_item(hashzone, hash->uh_slab_hash, NULL, SKIP_NONE);
627 	else
628 		free(hash->uh_slab_hash, M_UMAHASH);
629 }
630 
631 /*
632  * Frees all outstanding items in a bucket
633  *
634  * Arguments:
635  *	zone   The zone to free to, must be unlocked.
636  *	bucket The free/alloc bucket with items, cpu queue must be locked.
637  *
638  * Returns:
639  *	Nothing
640  */
641 
642 static void
643 bucket_drain(uma_zone_t zone, uma_bucket_t bucket)
644 {
645 	int i;
646 
647 	if (bucket == NULL)
648 		return;
649 
650 	if (zone->uz_fini)
651 		for (i = 0; i < bucket->ub_cnt; i++)
652 			zone->uz_fini(bucket->ub_bucket[i], zone->uz_size);
653 	zone->uz_release(zone->uz_arg, bucket->ub_bucket, bucket->ub_cnt);
654 	bucket->ub_cnt = 0;
655 }
656 
657 /*
658  * Drains the per cpu caches for a zone.
659  *
660  * NOTE: This may only be called while the zone is being turn down, and not
661  * during normal operation.  This is necessary in order that we do not have
662  * to migrate CPUs to drain the per-CPU caches.
663  *
664  * Arguments:
665  *	zone     The zone to drain, must be unlocked.
666  *
667  * Returns:
668  *	Nothing
669  */
670 static void
671 cache_drain(uma_zone_t zone)
672 {
673 	uma_cache_t cache;
674 	int cpu;
675 
676 	/*
677 	 * XXX: It is safe to not lock the per-CPU caches, because we're
678 	 * tearing down the zone anyway.  I.e., there will be no further use
679 	 * of the caches at this point.
680 	 *
681 	 * XXX: It would good to be able to assert that the zone is being
682 	 * torn down to prevent improper use of cache_drain().
683 	 *
684 	 * XXX: We lock the zone before passing into bucket_cache_drain() as
685 	 * it is used elsewhere.  Should the tear-down path be made special
686 	 * there in some form?
687 	 */
688 	CPU_FOREACH(cpu) {
689 		cache = &zone->uz_cpu[cpu];
690 		bucket_drain(zone, cache->uc_allocbucket);
691 		bucket_drain(zone, cache->uc_freebucket);
692 		if (cache->uc_allocbucket != NULL)
693 			bucket_free(zone, cache->uc_allocbucket, NULL);
694 		if (cache->uc_freebucket != NULL)
695 			bucket_free(zone, cache->uc_freebucket, NULL);
696 		cache->uc_allocbucket = cache->uc_freebucket = NULL;
697 	}
698 	ZONE_LOCK(zone);
699 	bucket_cache_drain(zone);
700 	ZONE_UNLOCK(zone);
701 }
702 
703 static void
704 cache_shrink(uma_zone_t zone)
705 {
706 
707 	if (zone->uz_flags & UMA_ZFLAG_INTERNAL)
708 		return;
709 
710 	ZONE_LOCK(zone);
711 	zone->uz_count = (zone->uz_count_min + zone->uz_count) / 2;
712 	ZONE_UNLOCK(zone);
713 }
714 
715 static void
716 cache_drain_safe_cpu(uma_zone_t zone)
717 {
718 	uma_cache_t cache;
719 	uma_bucket_t b1, b2;
720 
721 	if (zone->uz_flags & UMA_ZFLAG_INTERNAL)
722 		return;
723 
724 	b1 = b2 = NULL;
725 	ZONE_LOCK(zone);
726 	critical_enter();
727 	cache = &zone->uz_cpu[curcpu];
728 	if (cache->uc_allocbucket) {
729 		if (cache->uc_allocbucket->ub_cnt != 0)
730 			LIST_INSERT_HEAD(&zone->uz_buckets,
731 			    cache->uc_allocbucket, ub_link);
732 		else
733 			b1 = cache->uc_allocbucket;
734 		cache->uc_allocbucket = NULL;
735 	}
736 	if (cache->uc_freebucket) {
737 		if (cache->uc_freebucket->ub_cnt != 0)
738 			LIST_INSERT_HEAD(&zone->uz_buckets,
739 			    cache->uc_freebucket, ub_link);
740 		else
741 			b2 = cache->uc_freebucket;
742 		cache->uc_freebucket = NULL;
743 	}
744 	critical_exit();
745 	ZONE_UNLOCK(zone);
746 	if (b1)
747 		bucket_free(zone, b1, NULL);
748 	if (b2)
749 		bucket_free(zone, b2, NULL);
750 }
751 
752 /*
753  * Safely drain per-CPU caches of a zone(s) to alloc bucket.
754  * This is an expensive call because it needs to bind to all CPUs
755  * one by one and enter a critical section on each of them in order
756  * to safely access their cache buckets.
757  * Zone lock must not be held on call this function.
758  */
759 static void
760 cache_drain_safe(uma_zone_t zone)
761 {
762 	int cpu;
763 
764 	/*
765 	 * Polite bucket sizes shrinking was not enouth, shrink aggressively.
766 	 */
767 	if (zone)
768 		cache_shrink(zone);
769 	else
770 		zone_foreach(cache_shrink);
771 
772 	CPU_FOREACH(cpu) {
773 		thread_lock(curthread);
774 		sched_bind(curthread, cpu);
775 		thread_unlock(curthread);
776 
777 		if (zone)
778 			cache_drain_safe_cpu(zone);
779 		else
780 			zone_foreach(cache_drain_safe_cpu);
781 	}
782 	thread_lock(curthread);
783 	sched_unbind(curthread);
784 	thread_unlock(curthread);
785 }
786 
787 /*
788  * Drain the cached buckets from a zone.  Expects a locked zone on entry.
789  */
790 static void
791 bucket_cache_drain(uma_zone_t zone)
792 {
793 	uma_bucket_t bucket;
794 
795 	/*
796 	 * Drain the bucket queues and free the buckets, we just keep two per
797 	 * cpu (alloc/free).
798 	 */
799 	while ((bucket = LIST_FIRST(&zone->uz_buckets)) != NULL) {
800 		LIST_REMOVE(bucket, ub_link);
801 		ZONE_UNLOCK(zone);
802 		bucket_drain(zone, bucket);
803 		bucket_free(zone, bucket, NULL);
804 		ZONE_LOCK(zone);
805 	}
806 
807 	/*
808 	 * Shrink further bucket sizes.  Price of single zone lock collision
809 	 * is probably lower then price of global cache drain.
810 	 */
811 	if (zone->uz_count > zone->uz_count_min)
812 		zone->uz_count--;
813 }
814 
815 static void
816 keg_free_slab(uma_keg_t keg, uma_slab_t slab, int start)
817 {
818 	uint8_t *mem;
819 	int i;
820 	uint8_t flags;
821 
822 	mem = slab->us_data;
823 	flags = slab->us_flags;
824 	i = start;
825 	if (keg->uk_fini != NULL) {
826 		for (i--; i > -1; i--)
827 			keg->uk_fini(slab->us_data + (keg->uk_rsize * i),
828 			    keg->uk_size);
829 	}
830 	if (keg->uk_flags & UMA_ZONE_OFFPAGE)
831 		zone_free_item(keg->uk_slabzone, slab, NULL, SKIP_NONE);
832 #ifdef UMA_DEBUG
833 	printf("%s: Returning %d bytes.\n", keg->uk_name,
834 	    PAGE_SIZE * keg->uk_ppera);
835 #endif
836 	keg->uk_freef(mem, PAGE_SIZE * keg->uk_ppera, flags);
837 }
838 
839 /*
840  * Frees pages from a keg back to the system.  This is done on demand from
841  * the pageout daemon.
842  *
843  * Returns nothing.
844  */
845 static void
846 keg_drain(uma_keg_t keg)
847 {
848 	struct slabhead freeslabs = { 0 };
849 	uma_slab_t slab, tmp;
850 
851 	/*
852 	 * We don't want to take pages from statically allocated kegs at this
853 	 * time
854 	 */
855 	if (keg->uk_flags & UMA_ZONE_NOFREE || keg->uk_freef == NULL)
856 		return;
857 
858 #ifdef UMA_DEBUG
859 	printf("%s free items: %u\n", keg->uk_name, keg->uk_free);
860 #endif
861 	KEG_LOCK(keg);
862 	if (keg->uk_free == 0)
863 		goto finished;
864 
865 	LIST_FOREACH_SAFE(slab, &keg->uk_free_slab, us_link, tmp) {
866 		/* We have nowhere to free these to. */
867 		if (slab->us_flags & UMA_SLAB_BOOT)
868 			continue;
869 
870 		LIST_REMOVE(slab, us_link);
871 		keg->uk_pages -= keg->uk_ppera;
872 		keg->uk_free -= keg->uk_ipers;
873 
874 		if (keg->uk_flags & UMA_ZONE_HASH)
875 			UMA_HASH_REMOVE(&keg->uk_hash, slab, slab->us_data);
876 
877 		SLIST_INSERT_HEAD(&freeslabs, slab, us_hlink);
878 	}
879 finished:
880 	KEG_UNLOCK(keg);
881 
882 	while ((slab = SLIST_FIRST(&freeslabs)) != NULL) {
883 		SLIST_REMOVE(&freeslabs, slab, uma_slab, us_hlink);
884 		keg_free_slab(keg, slab, keg->uk_ipers);
885 	}
886 }
887 
888 static void
889 zone_drain_wait(uma_zone_t zone, int waitok)
890 {
891 
892 	/*
893 	 * Set draining to interlock with zone_dtor() so we can release our
894 	 * locks as we go.  Only dtor() should do a WAITOK call since it
895 	 * is the only call that knows the structure will still be available
896 	 * when it wakes up.
897 	 */
898 	ZONE_LOCK(zone);
899 	while (zone->uz_flags & UMA_ZFLAG_DRAINING) {
900 		if (waitok == M_NOWAIT)
901 			goto out;
902 		msleep(zone, zone->uz_lockptr, PVM, "zonedrain", 1);
903 	}
904 	zone->uz_flags |= UMA_ZFLAG_DRAINING;
905 	bucket_cache_drain(zone);
906 	ZONE_UNLOCK(zone);
907 	/*
908 	 * The DRAINING flag protects us from being freed while
909 	 * we're running.  Normally the uma_rwlock would protect us but we
910 	 * must be able to release and acquire the right lock for each keg.
911 	 */
912 	zone_foreach_keg(zone, &keg_drain);
913 	ZONE_LOCK(zone);
914 	zone->uz_flags &= ~UMA_ZFLAG_DRAINING;
915 	wakeup(zone);
916 out:
917 	ZONE_UNLOCK(zone);
918 }
919 
920 void
921 zone_drain(uma_zone_t zone)
922 {
923 
924 	zone_drain_wait(zone, M_NOWAIT);
925 }
926 
927 /*
928  * Allocate a new slab for a keg.  This does not insert the slab onto a list.
929  *
930  * Arguments:
931  *	wait  Shall we wait?
932  *
933  * Returns:
934  *	The slab that was allocated or NULL if there is no memory and the
935  *	caller specified M_NOWAIT.
936  */
937 static uma_slab_t
938 keg_alloc_slab(uma_keg_t keg, uma_zone_t zone, int wait)
939 {
940 	uma_alloc allocf;
941 	uma_slab_t slab;
942 	uint8_t *mem;
943 	uint8_t flags;
944 	int i;
945 
946 	mtx_assert(&keg->uk_lock, MA_OWNED);
947 	slab = NULL;
948 	mem = NULL;
949 
950 #ifdef UMA_DEBUG
951 	printf("alloc_slab:  Allocating a new slab for %s\n", keg->uk_name);
952 #endif
953 	allocf = keg->uk_allocf;
954 	KEG_UNLOCK(keg);
955 
956 	if (keg->uk_flags & UMA_ZONE_OFFPAGE) {
957 		slab = zone_alloc_item(keg->uk_slabzone, NULL, wait);
958 		if (slab == NULL)
959 			goto out;
960 	}
961 
962 	/*
963 	 * This reproduces the old vm_zone behavior of zero filling pages the
964 	 * first time they are added to a zone.
965 	 *
966 	 * Malloced items are zeroed in uma_zalloc.
967 	 */
968 
969 	if ((keg->uk_flags & UMA_ZONE_MALLOC) == 0)
970 		wait |= M_ZERO;
971 	else
972 		wait &= ~M_ZERO;
973 
974 	if (keg->uk_flags & UMA_ZONE_NODUMP)
975 		wait |= M_NODUMP;
976 
977 	/* zone is passed for legacy reasons. */
978 	mem = allocf(zone, keg->uk_ppera * PAGE_SIZE, &flags, wait);
979 	if (mem == NULL) {
980 		if (keg->uk_flags & UMA_ZONE_OFFPAGE)
981 			zone_free_item(keg->uk_slabzone, slab, NULL, SKIP_NONE);
982 		slab = NULL;
983 		goto out;
984 	}
985 
986 	/* Point the slab into the allocated memory */
987 	if (!(keg->uk_flags & UMA_ZONE_OFFPAGE))
988 		slab = (uma_slab_t )(mem + keg->uk_pgoff);
989 
990 	if (keg->uk_flags & UMA_ZONE_VTOSLAB)
991 		for (i = 0; i < keg->uk_ppera; i++)
992 			vsetslab((vm_offset_t)mem + (i * PAGE_SIZE), slab);
993 
994 	slab->us_keg = keg;
995 	slab->us_data = mem;
996 	slab->us_freecount = keg->uk_ipers;
997 	slab->us_flags = flags;
998 	BIT_FILL(SLAB_SETSIZE, &slab->us_free);
999 #ifdef INVARIANTS
1000 	BIT_ZERO(SLAB_SETSIZE, &slab->us_debugfree);
1001 #endif
1002 
1003 	if (keg->uk_init != NULL) {
1004 		for (i = 0; i < keg->uk_ipers; i++)
1005 			if (keg->uk_init(slab->us_data + (keg->uk_rsize * i),
1006 			    keg->uk_size, wait) != 0)
1007 				break;
1008 		if (i != keg->uk_ipers) {
1009 			keg_free_slab(keg, slab, i);
1010 			slab = NULL;
1011 			goto out;
1012 		}
1013 	}
1014 out:
1015 	KEG_LOCK(keg);
1016 
1017 	if (slab != NULL) {
1018 		if (keg->uk_flags & UMA_ZONE_HASH)
1019 			UMA_HASH_INSERT(&keg->uk_hash, slab, mem);
1020 
1021 		keg->uk_pages += keg->uk_ppera;
1022 		keg->uk_free += keg->uk_ipers;
1023 	}
1024 
1025 	return (slab);
1026 }
1027 
1028 /*
1029  * This function is intended to be used early on in place of page_alloc() so
1030  * that we may use the boot time page cache to satisfy allocations before
1031  * the VM is ready.
1032  */
1033 static void *
1034 startup_alloc(uma_zone_t zone, vm_size_t bytes, uint8_t *pflag, int wait)
1035 {
1036 	uma_keg_t keg;
1037 	uma_slab_t tmps;
1038 	int pages, check_pages;
1039 
1040 	keg = zone_first_keg(zone);
1041 	pages = howmany(bytes, PAGE_SIZE);
1042 	check_pages = pages - 1;
1043 	KASSERT(pages > 0, ("startup_alloc can't reserve 0 pages\n"));
1044 
1045 	/*
1046 	 * Check our small startup cache to see if it has pages remaining.
1047 	 */
1048 	mtx_lock(&uma_boot_pages_mtx);
1049 
1050 	/* First check if we have enough room. */
1051 	tmps = LIST_FIRST(&uma_boot_pages);
1052 	while (tmps != NULL && check_pages-- > 0)
1053 		tmps = LIST_NEXT(tmps, us_link);
1054 	if (tmps != NULL) {
1055 		/*
1056 		 * It's ok to lose tmps references.  The last one will
1057 		 * have tmps->us_data pointing to the start address of
1058 		 * "pages" contiguous pages of memory.
1059 		 */
1060 		while (pages-- > 0) {
1061 			tmps = LIST_FIRST(&uma_boot_pages);
1062 			LIST_REMOVE(tmps, us_link);
1063 		}
1064 		mtx_unlock(&uma_boot_pages_mtx);
1065 		*pflag = tmps->us_flags;
1066 		return (tmps->us_data);
1067 	}
1068 	mtx_unlock(&uma_boot_pages_mtx);
1069 	if (booted < UMA_STARTUP2)
1070 		panic("UMA: Increase vm.boot_pages");
1071 	/*
1072 	 * Now that we've booted reset these users to their real allocator.
1073 	 */
1074 #ifdef UMA_MD_SMALL_ALLOC
1075 	keg->uk_allocf = (keg->uk_ppera > 1) ? page_alloc : uma_small_alloc;
1076 #else
1077 	keg->uk_allocf = page_alloc;
1078 #endif
1079 	return keg->uk_allocf(zone, bytes, pflag, wait);
1080 }
1081 
1082 /*
1083  * Allocates a number of pages from the system
1084  *
1085  * Arguments:
1086  *	bytes  The number of bytes requested
1087  *	wait  Shall we wait?
1088  *
1089  * Returns:
1090  *	A pointer to the alloced memory or possibly
1091  *	NULL if M_NOWAIT is set.
1092  */
1093 static void *
1094 page_alloc(uma_zone_t zone, vm_size_t bytes, uint8_t *pflag, int wait)
1095 {
1096 	void *p;	/* Returned page */
1097 
1098 	*pflag = UMA_SLAB_KMEM;
1099 	p = (void *) kmem_malloc(kmem_arena, bytes, wait);
1100 
1101 	return (p);
1102 }
1103 
1104 /*
1105  * Allocates a number of pages from within an object
1106  *
1107  * Arguments:
1108  *	bytes  The number of bytes requested
1109  *	wait   Shall we wait?
1110  *
1111  * Returns:
1112  *	A pointer to the alloced memory or possibly
1113  *	NULL if M_NOWAIT is set.
1114  */
1115 static void *
1116 noobj_alloc(uma_zone_t zone, vm_size_t bytes, uint8_t *flags, int wait)
1117 {
1118 	TAILQ_HEAD(, vm_page) alloctail;
1119 	u_long npages;
1120 	vm_offset_t retkva, zkva;
1121 	vm_page_t p, p_next;
1122 	uma_keg_t keg;
1123 
1124 	TAILQ_INIT(&alloctail);
1125 	keg = zone_first_keg(zone);
1126 
1127 	npages = howmany(bytes, PAGE_SIZE);
1128 	while (npages > 0) {
1129 		p = vm_page_alloc(NULL, 0, VM_ALLOC_INTERRUPT |
1130 		    VM_ALLOC_WIRED | VM_ALLOC_NOOBJ);
1131 		if (p != NULL) {
1132 			/*
1133 			 * Since the page does not belong to an object, its
1134 			 * listq is unused.
1135 			 */
1136 			TAILQ_INSERT_TAIL(&alloctail, p, listq);
1137 			npages--;
1138 			continue;
1139 		}
1140 		if (wait & M_WAITOK) {
1141 			VM_WAIT;
1142 			continue;
1143 		}
1144 
1145 		/*
1146 		 * Page allocation failed, free intermediate pages and
1147 		 * exit.
1148 		 */
1149 		TAILQ_FOREACH_SAFE(p, &alloctail, listq, p_next) {
1150 			vm_page_unwire(p, PQ_NONE);
1151 			vm_page_free(p);
1152 		}
1153 		return (NULL);
1154 	}
1155 	*flags = UMA_SLAB_PRIV;
1156 	zkva = keg->uk_kva +
1157 	    atomic_fetchadd_long(&keg->uk_offset, round_page(bytes));
1158 	retkva = zkva;
1159 	TAILQ_FOREACH(p, &alloctail, listq) {
1160 		pmap_qenter(zkva, &p, 1);
1161 		zkva += PAGE_SIZE;
1162 	}
1163 
1164 	return ((void *)retkva);
1165 }
1166 
1167 /*
1168  * Frees a number of pages to the system
1169  *
1170  * Arguments:
1171  *	mem   A pointer to the memory to be freed
1172  *	size  The size of the memory being freed
1173  *	flags The original p->us_flags field
1174  *
1175  * Returns:
1176  *	Nothing
1177  */
1178 static void
1179 page_free(void *mem, vm_size_t size, uint8_t flags)
1180 {
1181 	struct vmem *vmem;
1182 
1183 	if (flags & UMA_SLAB_KMEM)
1184 		vmem = kmem_arena;
1185 	else if (flags & UMA_SLAB_KERNEL)
1186 		vmem = kernel_arena;
1187 	else
1188 		panic("UMA: page_free used with invalid flags %x", flags);
1189 
1190 	kmem_free(vmem, (vm_offset_t)mem, size);
1191 }
1192 
1193 /*
1194  * Zero fill initializer
1195  *
1196  * Arguments/Returns follow uma_init specifications
1197  */
1198 static int
1199 zero_init(void *mem, int size, int flags)
1200 {
1201 	bzero(mem, size);
1202 	return (0);
1203 }
1204 
1205 /*
1206  * Finish creating a small uma keg.  This calculates ipers, and the keg size.
1207  *
1208  * Arguments
1209  *	keg  The zone we should initialize
1210  *
1211  * Returns
1212  *	Nothing
1213  */
1214 static void
1215 keg_small_init(uma_keg_t keg)
1216 {
1217 	u_int rsize;
1218 	u_int memused;
1219 	u_int wastedspace;
1220 	u_int shsize;
1221 	u_int slabsize;
1222 
1223 	if (keg->uk_flags & UMA_ZONE_PCPU) {
1224 		u_int ncpus = (mp_maxid + 1) ? (mp_maxid + 1) : MAXCPU;
1225 
1226 		slabsize = sizeof(struct pcpu);
1227 		keg->uk_ppera = howmany(ncpus * sizeof(struct pcpu),
1228 		    PAGE_SIZE);
1229 	} else {
1230 		slabsize = UMA_SLAB_SIZE;
1231 		keg->uk_ppera = 1;
1232 	}
1233 
1234 	/*
1235 	 * Calculate the size of each allocation (rsize) according to
1236 	 * alignment.  If the requested size is smaller than we have
1237 	 * allocation bits for we round it up.
1238 	 */
1239 	rsize = keg->uk_size;
1240 	if (rsize < slabsize / SLAB_SETSIZE)
1241 		rsize = slabsize / SLAB_SETSIZE;
1242 	if (rsize & keg->uk_align)
1243 		rsize = (rsize & ~keg->uk_align) + (keg->uk_align + 1);
1244 	keg->uk_rsize = rsize;
1245 
1246 	KASSERT((keg->uk_flags & UMA_ZONE_PCPU) == 0 ||
1247 	    keg->uk_rsize < sizeof(struct pcpu),
1248 	    ("%s: size %u too large", __func__, keg->uk_rsize));
1249 
1250 	if (keg->uk_flags & UMA_ZONE_OFFPAGE)
1251 		shsize = 0;
1252 	else
1253 		shsize = sizeof(struct uma_slab);
1254 
1255 	keg->uk_ipers = (slabsize - shsize) / rsize;
1256 	KASSERT(keg->uk_ipers > 0 && keg->uk_ipers <= SLAB_SETSIZE,
1257 	    ("%s: keg->uk_ipers %u", __func__, keg->uk_ipers));
1258 
1259 	memused = keg->uk_ipers * rsize + shsize;
1260 	wastedspace = slabsize - memused;
1261 
1262 	/*
1263 	 * We can't do OFFPAGE if we're internal or if we've been
1264 	 * asked to not go to the VM for buckets.  If we do this we
1265 	 * may end up going to the VM  for slabs which we do not
1266 	 * want to do if we're UMA_ZFLAG_CACHEONLY as a result
1267 	 * of UMA_ZONE_VM, which clearly forbids it.
1268 	 */
1269 	if ((keg->uk_flags & UMA_ZFLAG_INTERNAL) ||
1270 	    (keg->uk_flags & UMA_ZFLAG_CACHEONLY))
1271 		return;
1272 
1273 	/*
1274 	 * See if using an OFFPAGE slab will limit our waste.  Only do
1275 	 * this if it permits more items per-slab.
1276 	 *
1277 	 * XXX We could try growing slabsize to limit max waste as well.
1278 	 * Historically this was not done because the VM could not
1279 	 * efficiently handle contiguous allocations.
1280 	 */
1281 	if ((wastedspace >= slabsize / UMA_MAX_WASTE) &&
1282 	    (keg->uk_ipers < (slabsize / keg->uk_rsize))) {
1283 		keg->uk_ipers = slabsize / keg->uk_rsize;
1284 		KASSERT(keg->uk_ipers > 0 && keg->uk_ipers <= SLAB_SETSIZE,
1285 		    ("%s: keg->uk_ipers %u", __func__, keg->uk_ipers));
1286 #ifdef UMA_DEBUG
1287 		printf("UMA decided we need offpage slab headers for "
1288 		    "keg: %s, calculated wastedspace = %d, "
1289 		    "maximum wasted space allowed = %d, "
1290 		    "calculated ipers = %d, "
1291 		    "new wasted space = %d\n", keg->uk_name, wastedspace,
1292 		    slabsize / UMA_MAX_WASTE, keg->uk_ipers,
1293 		    slabsize - keg->uk_ipers * keg->uk_rsize);
1294 #endif
1295 		keg->uk_flags |= UMA_ZONE_OFFPAGE;
1296 	}
1297 
1298 	if ((keg->uk_flags & UMA_ZONE_OFFPAGE) &&
1299 	    (keg->uk_flags & UMA_ZONE_VTOSLAB) == 0)
1300 		keg->uk_flags |= UMA_ZONE_HASH;
1301 }
1302 
1303 /*
1304  * Finish creating a large (> UMA_SLAB_SIZE) uma kegs.  Just give in and do
1305  * OFFPAGE for now.  When I can allow for more dynamic slab sizes this will be
1306  * more complicated.
1307  *
1308  * Arguments
1309  *	keg  The keg we should initialize
1310  *
1311  * Returns
1312  *	Nothing
1313  */
1314 static void
1315 keg_large_init(uma_keg_t keg)
1316 {
1317 	u_int shsize;
1318 
1319 	KASSERT(keg != NULL, ("Keg is null in keg_large_init"));
1320 	KASSERT((keg->uk_flags & UMA_ZFLAG_CACHEONLY) == 0,
1321 	    ("keg_large_init: Cannot large-init a UMA_ZFLAG_CACHEONLY keg"));
1322 	KASSERT((keg->uk_flags & UMA_ZONE_PCPU) == 0,
1323 	    ("%s: Cannot large-init a UMA_ZONE_PCPU keg", __func__));
1324 
1325 	keg->uk_ppera = howmany(keg->uk_size, PAGE_SIZE);
1326 	keg->uk_ipers = 1;
1327 	keg->uk_rsize = keg->uk_size;
1328 
1329 	/* We can't do OFFPAGE if we're internal, bail out here. */
1330 	if (keg->uk_flags & UMA_ZFLAG_INTERNAL)
1331 		return;
1332 
1333 	/* Check whether we have enough space to not do OFFPAGE. */
1334 	if ((keg->uk_flags & UMA_ZONE_OFFPAGE) == 0) {
1335 		shsize = sizeof(struct uma_slab);
1336 		if (shsize & UMA_ALIGN_PTR)
1337 			shsize = (shsize & ~UMA_ALIGN_PTR) +
1338 			    (UMA_ALIGN_PTR + 1);
1339 
1340 		if ((PAGE_SIZE * keg->uk_ppera) - keg->uk_rsize < shsize)
1341 			keg->uk_flags |= UMA_ZONE_OFFPAGE;
1342 	}
1343 
1344 	if ((keg->uk_flags & UMA_ZONE_OFFPAGE) &&
1345 	    (keg->uk_flags & UMA_ZONE_VTOSLAB) == 0)
1346 		keg->uk_flags |= UMA_ZONE_HASH;
1347 }
1348 
1349 static void
1350 keg_cachespread_init(uma_keg_t keg)
1351 {
1352 	int alignsize;
1353 	int trailer;
1354 	int pages;
1355 	int rsize;
1356 
1357 	KASSERT((keg->uk_flags & UMA_ZONE_PCPU) == 0,
1358 	    ("%s: Cannot cachespread-init a UMA_ZONE_PCPU keg", __func__));
1359 
1360 	alignsize = keg->uk_align + 1;
1361 	rsize = keg->uk_size;
1362 	/*
1363 	 * We want one item to start on every align boundary in a page.  To
1364 	 * do this we will span pages.  We will also extend the item by the
1365 	 * size of align if it is an even multiple of align.  Otherwise, it
1366 	 * would fall on the same boundary every time.
1367 	 */
1368 	if (rsize & keg->uk_align)
1369 		rsize = (rsize & ~keg->uk_align) + alignsize;
1370 	if ((rsize & alignsize) == 0)
1371 		rsize += alignsize;
1372 	trailer = rsize - keg->uk_size;
1373 	pages = (rsize * (PAGE_SIZE / alignsize)) / PAGE_SIZE;
1374 	pages = MIN(pages, (128 * 1024) / PAGE_SIZE);
1375 	keg->uk_rsize = rsize;
1376 	keg->uk_ppera = pages;
1377 	keg->uk_ipers = ((pages * PAGE_SIZE) + trailer) / rsize;
1378 	keg->uk_flags |= UMA_ZONE_OFFPAGE | UMA_ZONE_VTOSLAB;
1379 	KASSERT(keg->uk_ipers <= SLAB_SETSIZE,
1380 	    ("%s: keg->uk_ipers too high(%d) increase max_ipers", __func__,
1381 	    keg->uk_ipers));
1382 }
1383 
1384 /*
1385  * Keg header ctor.  This initializes all fields, locks, etc.  And inserts
1386  * the keg onto the global keg list.
1387  *
1388  * Arguments/Returns follow uma_ctor specifications
1389  *	udata  Actually uma_kctor_args
1390  */
1391 static int
1392 keg_ctor(void *mem, int size, void *udata, int flags)
1393 {
1394 	struct uma_kctor_args *arg = udata;
1395 	uma_keg_t keg = mem;
1396 	uma_zone_t zone;
1397 
1398 	bzero(keg, size);
1399 	keg->uk_size = arg->size;
1400 	keg->uk_init = arg->uminit;
1401 	keg->uk_fini = arg->fini;
1402 	keg->uk_align = arg->align;
1403 	keg->uk_free = 0;
1404 	keg->uk_reserve = 0;
1405 	keg->uk_pages = 0;
1406 	keg->uk_flags = arg->flags;
1407 	keg->uk_allocf = page_alloc;
1408 	keg->uk_freef = page_free;
1409 	keg->uk_slabzone = NULL;
1410 
1411 	/*
1412 	 * The master zone is passed to us at keg-creation time.
1413 	 */
1414 	zone = arg->zone;
1415 	keg->uk_name = zone->uz_name;
1416 
1417 	if (arg->flags & UMA_ZONE_VM)
1418 		keg->uk_flags |= UMA_ZFLAG_CACHEONLY;
1419 
1420 	if (arg->flags & UMA_ZONE_ZINIT)
1421 		keg->uk_init = zero_init;
1422 
1423 	if (arg->flags & UMA_ZONE_MALLOC)
1424 		keg->uk_flags |= UMA_ZONE_VTOSLAB;
1425 
1426 	if (arg->flags & UMA_ZONE_PCPU)
1427 #ifdef SMP
1428 		keg->uk_flags |= UMA_ZONE_OFFPAGE;
1429 #else
1430 		keg->uk_flags &= ~UMA_ZONE_PCPU;
1431 #endif
1432 
1433 	if (keg->uk_flags & UMA_ZONE_CACHESPREAD) {
1434 		keg_cachespread_init(keg);
1435 	} else {
1436 		if (keg->uk_size > (UMA_SLAB_SIZE - sizeof(struct uma_slab)))
1437 			keg_large_init(keg);
1438 		else
1439 			keg_small_init(keg);
1440 	}
1441 
1442 	if (keg->uk_flags & UMA_ZONE_OFFPAGE)
1443 		keg->uk_slabzone = slabzone;
1444 
1445 	/*
1446 	 * If we haven't booted yet we need allocations to go through the
1447 	 * startup cache until the vm is ready.
1448 	 */
1449 	if (keg->uk_ppera == 1) {
1450 #ifdef UMA_MD_SMALL_ALLOC
1451 		keg->uk_allocf = uma_small_alloc;
1452 		keg->uk_freef = uma_small_free;
1453 
1454 		if (booted < UMA_STARTUP)
1455 			keg->uk_allocf = startup_alloc;
1456 #else
1457 		if (booted < UMA_STARTUP2)
1458 			keg->uk_allocf = startup_alloc;
1459 #endif
1460 	} else if (booted < UMA_STARTUP2 &&
1461 	    (keg->uk_flags & UMA_ZFLAG_INTERNAL))
1462 		keg->uk_allocf = startup_alloc;
1463 
1464 	/*
1465 	 * Initialize keg's lock
1466 	 */
1467 	KEG_LOCK_INIT(keg, (arg->flags & UMA_ZONE_MTXCLASS));
1468 
1469 	/*
1470 	 * If we're putting the slab header in the actual page we need to
1471 	 * figure out where in each page it goes.  This calculates a right
1472 	 * justified offset into the memory on an ALIGN_PTR boundary.
1473 	 */
1474 	if (!(keg->uk_flags & UMA_ZONE_OFFPAGE)) {
1475 		u_int totsize;
1476 
1477 		/* Size of the slab struct and free list */
1478 		totsize = sizeof(struct uma_slab);
1479 
1480 		if (totsize & UMA_ALIGN_PTR)
1481 			totsize = (totsize & ~UMA_ALIGN_PTR) +
1482 			    (UMA_ALIGN_PTR + 1);
1483 		keg->uk_pgoff = (PAGE_SIZE * keg->uk_ppera) - totsize;
1484 
1485 		/*
1486 		 * The only way the following is possible is if with our
1487 		 * UMA_ALIGN_PTR adjustments we are now bigger than
1488 		 * UMA_SLAB_SIZE.  I haven't checked whether this is
1489 		 * mathematically possible for all cases, so we make
1490 		 * sure here anyway.
1491 		 */
1492 		totsize = keg->uk_pgoff + sizeof(struct uma_slab);
1493 		if (totsize > PAGE_SIZE * keg->uk_ppera) {
1494 			printf("zone %s ipers %d rsize %d size %d\n",
1495 			    zone->uz_name, keg->uk_ipers, keg->uk_rsize,
1496 			    keg->uk_size);
1497 			panic("UMA slab won't fit.");
1498 		}
1499 	}
1500 
1501 	if (keg->uk_flags & UMA_ZONE_HASH)
1502 		hash_alloc(&keg->uk_hash);
1503 
1504 #ifdef UMA_DEBUG
1505 	printf("UMA: %s(%p) size %d(%d) flags %#x ipers %d ppera %d out %d free %d\n",
1506 	    zone->uz_name, zone, keg->uk_size, keg->uk_rsize, keg->uk_flags,
1507 	    keg->uk_ipers, keg->uk_ppera,
1508 	    (keg->uk_pages / keg->uk_ppera) * keg->uk_ipers - keg->uk_free,
1509 	    keg->uk_free);
1510 #endif
1511 
1512 	LIST_INSERT_HEAD(&keg->uk_zones, zone, uz_link);
1513 
1514 	rw_wlock(&uma_rwlock);
1515 	LIST_INSERT_HEAD(&uma_kegs, keg, uk_link);
1516 	rw_wunlock(&uma_rwlock);
1517 	return (0);
1518 }
1519 
1520 /*
1521  * Zone header ctor.  This initializes all fields, locks, etc.
1522  *
1523  * Arguments/Returns follow uma_ctor specifications
1524  *	udata  Actually uma_zctor_args
1525  */
1526 static int
1527 zone_ctor(void *mem, int size, void *udata, int flags)
1528 {
1529 	struct uma_zctor_args *arg = udata;
1530 	uma_zone_t zone = mem;
1531 	uma_zone_t z;
1532 	uma_keg_t keg;
1533 
1534 	bzero(zone, size);
1535 	zone->uz_name = arg->name;
1536 	zone->uz_ctor = arg->ctor;
1537 	zone->uz_dtor = arg->dtor;
1538 	zone->uz_slab = zone_fetch_slab;
1539 	zone->uz_init = NULL;
1540 	zone->uz_fini = NULL;
1541 	zone->uz_allocs = 0;
1542 	zone->uz_frees = 0;
1543 	zone->uz_fails = 0;
1544 	zone->uz_sleeps = 0;
1545 	zone->uz_count = 0;
1546 	zone->uz_count_min = 0;
1547 	zone->uz_flags = 0;
1548 	zone->uz_warning = NULL;
1549 	timevalclear(&zone->uz_ratecheck);
1550 	keg = arg->keg;
1551 
1552 	ZONE_LOCK_INIT(zone, (arg->flags & UMA_ZONE_MTXCLASS));
1553 
1554 	/*
1555 	 * This is a pure cache zone, no kegs.
1556 	 */
1557 	if (arg->import) {
1558 		if (arg->flags & UMA_ZONE_VM)
1559 			arg->flags |= UMA_ZFLAG_CACHEONLY;
1560 		zone->uz_flags = arg->flags;
1561 		zone->uz_size = arg->size;
1562 		zone->uz_import = arg->import;
1563 		zone->uz_release = arg->release;
1564 		zone->uz_arg = arg->arg;
1565 		zone->uz_lockptr = &zone->uz_lock;
1566 		rw_wlock(&uma_rwlock);
1567 		LIST_INSERT_HEAD(&uma_cachezones, zone, uz_link);
1568 		rw_wunlock(&uma_rwlock);
1569 		goto out;
1570 	}
1571 
1572 	/*
1573 	 * Use the regular zone/keg/slab allocator.
1574 	 */
1575 	zone->uz_import = (uma_import)zone_import;
1576 	zone->uz_release = (uma_release)zone_release;
1577 	zone->uz_arg = zone;
1578 
1579 	if (arg->flags & UMA_ZONE_SECONDARY) {
1580 		KASSERT(arg->keg != NULL, ("Secondary zone on zero'd keg"));
1581 		zone->uz_init = arg->uminit;
1582 		zone->uz_fini = arg->fini;
1583 		zone->uz_lockptr = &keg->uk_lock;
1584 		zone->uz_flags |= UMA_ZONE_SECONDARY;
1585 		rw_wlock(&uma_rwlock);
1586 		ZONE_LOCK(zone);
1587 		LIST_FOREACH(z, &keg->uk_zones, uz_link) {
1588 			if (LIST_NEXT(z, uz_link) == NULL) {
1589 				LIST_INSERT_AFTER(z, zone, uz_link);
1590 				break;
1591 			}
1592 		}
1593 		ZONE_UNLOCK(zone);
1594 		rw_wunlock(&uma_rwlock);
1595 	} else if (keg == NULL) {
1596 		if ((keg = uma_kcreate(zone, arg->size, arg->uminit, arg->fini,
1597 		    arg->align, arg->flags)) == NULL)
1598 			return (ENOMEM);
1599 	} else {
1600 		struct uma_kctor_args karg;
1601 		int error;
1602 
1603 		/* We should only be here from uma_startup() */
1604 		karg.size = arg->size;
1605 		karg.uminit = arg->uminit;
1606 		karg.fini = arg->fini;
1607 		karg.align = arg->align;
1608 		karg.flags = arg->flags;
1609 		karg.zone = zone;
1610 		error = keg_ctor(arg->keg, sizeof(struct uma_keg), &karg,
1611 		    flags);
1612 		if (error)
1613 			return (error);
1614 	}
1615 
1616 	/*
1617 	 * Link in the first keg.
1618 	 */
1619 	zone->uz_klink.kl_keg = keg;
1620 	LIST_INSERT_HEAD(&zone->uz_kegs, &zone->uz_klink, kl_link);
1621 	zone->uz_lockptr = &keg->uk_lock;
1622 	zone->uz_size = keg->uk_size;
1623 	zone->uz_flags |= (keg->uk_flags &
1624 	    (UMA_ZONE_INHERIT | UMA_ZFLAG_INHERIT));
1625 
1626 	/*
1627 	 * Some internal zones don't have room allocated for the per cpu
1628 	 * caches.  If we're internal, bail out here.
1629 	 */
1630 	if (keg->uk_flags & UMA_ZFLAG_INTERNAL) {
1631 		KASSERT((zone->uz_flags & UMA_ZONE_SECONDARY) == 0,
1632 		    ("Secondary zone requested UMA_ZFLAG_INTERNAL"));
1633 		return (0);
1634 	}
1635 
1636 out:
1637 	if ((arg->flags & UMA_ZONE_MAXBUCKET) == 0)
1638 		zone->uz_count = bucket_select(zone->uz_size);
1639 	else
1640 		zone->uz_count = BUCKET_MAX;
1641 	zone->uz_count_min = zone->uz_count;
1642 
1643 	return (0);
1644 }
1645 
1646 /*
1647  * Keg header dtor.  This frees all data, destroys locks, frees the hash
1648  * table and removes the keg from the global list.
1649  *
1650  * Arguments/Returns follow uma_dtor specifications
1651  *	udata  unused
1652  */
1653 static void
1654 keg_dtor(void *arg, int size, void *udata)
1655 {
1656 	uma_keg_t keg;
1657 
1658 	keg = (uma_keg_t)arg;
1659 	KEG_LOCK(keg);
1660 	if (keg->uk_free != 0) {
1661 		printf("Freed UMA keg (%s) was not empty (%d items). "
1662 		    " Lost %d pages of memory.\n",
1663 		    keg->uk_name ? keg->uk_name : "",
1664 		    keg->uk_free, keg->uk_pages);
1665 	}
1666 	KEG_UNLOCK(keg);
1667 
1668 	hash_free(&keg->uk_hash);
1669 
1670 	KEG_LOCK_FINI(keg);
1671 }
1672 
1673 /*
1674  * Zone header dtor.
1675  *
1676  * Arguments/Returns follow uma_dtor specifications
1677  *	udata  unused
1678  */
1679 static void
1680 zone_dtor(void *arg, int size, void *udata)
1681 {
1682 	uma_klink_t klink;
1683 	uma_zone_t zone;
1684 	uma_keg_t keg;
1685 
1686 	zone = (uma_zone_t)arg;
1687 	keg = zone_first_keg(zone);
1688 
1689 	if (!(zone->uz_flags & UMA_ZFLAG_INTERNAL))
1690 		cache_drain(zone);
1691 
1692 	rw_wlock(&uma_rwlock);
1693 	LIST_REMOVE(zone, uz_link);
1694 	rw_wunlock(&uma_rwlock);
1695 	/*
1696 	 * XXX there are some races here where
1697 	 * the zone can be drained but zone lock
1698 	 * released and then refilled before we
1699 	 * remove it... we dont care for now
1700 	 */
1701 	zone_drain_wait(zone, M_WAITOK);
1702 	/*
1703 	 * Unlink all of our kegs.
1704 	 */
1705 	while ((klink = LIST_FIRST(&zone->uz_kegs)) != NULL) {
1706 		klink->kl_keg = NULL;
1707 		LIST_REMOVE(klink, kl_link);
1708 		if (klink == &zone->uz_klink)
1709 			continue;
1710 		free(klink, M_TEMP);
1711 	}
1712 	/*
1713 	 * We only destroy kegs from non secondary zones.
1714 	 */
1715 	if (keg != NULL && (zone->uz_flags & UMA_ZONE_SECONDARY) == 0)  {
1716 		rw_wlock(&uma_rwlock);
1717 		LIST_REMOVE(keg, uk_link);
1718 		rw_wunlock(&uma_rwlock);
1719 		zone_free_item(kegs, keg, NULL, SKIP_NONE);
1720 	}
1721 	ZONE_LOCK_FINI(zone);
1722 }
1723 
1724 /*
1725  * Traverses every zone in the system and calls a callback
1726  *
1727  * Arguments:
1728  *	zfunc  A pointer to a function which accepts a zone
1729  *		as an argument.
1730  *
1731  * Returns:
1732  *	Nothing
1733  */
1734 static void
1735 zone_foreach(void (*zfunc)(uma_zone_t))
1736 {
1737 	uma_keg_t keg;
1738 	uma_zone_t zone;
1739 
1740 	rw_rlock(&uma_rwlock);
1741 	LIST_FOREACH(keg, &uma_kegs, uk_link) {
1742 		LIST_FOREACH(zone, &keg->uk_zones, uz_link)
1743 			zfunc(zone);
1744 	}
1745 	rw_runlock(&uma_rwlock);
1746 }
1747 
1748 /* Public functions */
1749 /* See uma.h */
1750 void
1751 uma_startup(void *bootmem, int boot_pages)
1752 {
1753 	struct uma_zctor_args args;
1754 	uma_slab_t slab;
1755 	int i;
1756 
1757 #ifdef UMA_DEBUG
1758 	printf("Creating uma keg headers zone and keg.\n");
1759 #endif
1760 	rw_init(&uma_rwlock, "UMA lock");
1761 
1762 	/* "manually" create the initial zone */
1763 	memset(&args, 0, sizeof(args));
1764 	args.name = "UMA Kegs";
1765 	args.size = sizeof(struct uma_keg);
1766 	args.ctor = keg_ctor;
1767 	args.dtor = keg_dtor;
1768 	args.uminit = zero_init;
1769 	args.fini = NULL;
1770 	args.keg = &masterkeg;
1771 	args.align = 32 - 1;
1772 	args.flags = UMA_ZFLAG_INTERNAL;
1773 	/* The initial zone has no Per cpu queues so it's smaller */
1774 	zone_ctor(kegs, sizeof(struct uma_zone), &args, M_WAITOK);
1775 
1776 #ifdef UMA_DEBUG
1777 	printf("Filling boot free list.\n");
1778 #endif
1779 	for (i = 0; i < boot_pages; i++) {
1780 		slab = (uma_slab_t)((uint8_t *)bootmem + (i * UMA_SLAB_SIZE));
1781 		slab->us_data = (uint8_t *)slab;
1782 		slab->us_flags = UMA_SLAB_BOOT;
1783 		LIST_INSERT_HEAD(&uma_boot_pages, slab, us_link);
1784 	}
1785 	mtx_init(&uma_boot_pages_mtx, "UMA boot pages", NULL, MTX_DEF);
1786 
1787 #ifdef UMA_DEBUG
1788 	printf("Creating uma zone headers zone and keg.\n");
1789 #endif
1790 	args.name = "UMA Zones";
1791 	args.size = sizeof(struct uma_zone) +
1792 	    (sizeof(struct uma_cache) * (mp_maxid + 1));
1793 	args.ctor = zone_ctor;
1794 	args.dtor = zone_dtor;
1795 	args.uminit = zero_init;
1796 	args.fini = NULL;
1797 	args.keg = NULL;
1798 	args.align = 32 - 1;
1799 	args.flags = UMA_ZFLAG_INTERNAL;
1800 	/* The initial zone has no Per cpu queues so it's smaller */
1801 	zone_ctor(zones, sizeof(struct uma_zone), &args, M_WAITOK);
1802 
1803 #ifdef UMA_DEBUG
1804 	printf("Creating slab and hash zones.\n");
1805 #endif
1806 
1807 	/* Now make a zone for slab headers */
1808 	slabzone = uma_zcreate("UMA Slabs",
1809 				sizeof(struct uma_slab),
1810 				NULL, NULL, NULL, NULL,
1811 				UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
1812 
1813 	hashzone = uma_zcreate("UMA Hash",
1814 	    sizeof(struct slabhead *) * UMA_HASH_SIZE_INIT,
1815 	    NULL, NULL, NULL, NULL,
1816 	    UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
1817 
1818 	bucket_init();
1819 
1820 	booted = UMA_STARTUP;
1821 
1822 #ifdef UMA_DEBUG
1823 	printf("UMA startup complete.\n");
1824 #endif
1825 }
1826 
1827 /* see uma.h */
1828 void
1829 uma_startup2(void)
1830 {
1831 	booted = UMA_STARTUP2;
1832 	bucket_enable();
1833 	sx_init(&uma_drain_lock, "umadrain");
1834 #ifdef UMA_DEBUG
1835 	printf("UMA startup2 complete.\n");
1836 #endif
1837 }
1838 
1839 /*
1840  * Initialize our callout handle
1841  *
1842  */
1843 
1844 static void
1845 uma_startup3(void)
1846 {
1847 #ifdef UMA_DEBUG
1848 	printf("Starting callout.\n");
1849 #endif
1850 	callout_init(&uma_callout, 1);
1851 	callout_reset(&uma_callout, UMA_TIMEOUT * hz, uma_timeout, NULL);
1852 #ifdef UMA_DEBUG
1853 	printf("UMA startup3 complete.\n");
1854 #endif
1855 }
1856 
1857 static uma_keg_t
1858 uma_kcreate(uma_zone_t zone, size_t size, uma_init uminit, uma_fini fini,
1859 		int align, uint32_t flags)
1860 {
1861 	struct uma_kctor_args args;
1862 
1863 	args.size = size;
1864 	args.uminit = uminit;
1865 	args.fini = fini;
1866 	args.align = (align == UMA_ALIGN_CACHE) ? uma_align_cache : align;
1867 	args.flags = flags;
1868 	args.zone = zone;
1869 	return (zone_alloc_item(kegs, &args, M_WAITOK));
1870 }
1871 
1872 /* See uma.h */
1873 void
1874 uma_set_align(int align)
1875 {
1876 
1877 	if (align != UMA_ALIGN_CACHE)
1878 		uma_align_cache = align;
1879 }
1880 
1881 /* See uma.h */
1882 uma_zone_t
1883 uma_zcreate(const char *name, size_t size, uma_ctor ctor, uma_dtor dtor,
1884 		uma_init uminit, uma_fini fini, int align, uint32_t flags)
1885 
1886 {
1887 	struct uma_zctor_args args;
1888 	uma_zone_t res;
1889 	bool locked;
1890 
1891 	/* This stuff is essential for the zone ctor */
1892 	memset(&args, 0, sizeof(args));
1893 	args.name = name;
1894 	args.size = size;
1895 	args.ctor = ctor;
1896 	args.dtor = dtor;
1897 	args.uminit = uminit;
1898 	args.fini = fini;
1899 #ifdef  INVARIANTS
1900 	/*
1901 	 * If a zone is being created with an empty constructor and
1902 	 * destructor, pass UMA constructor/destructor which checks for
1903 	 * memory use after free.
1904 	 */
1905 	if ((!(flags & (UMA_ZONE_ZINIT | UMA_ZONE_NOFREE))) &&
1906 	    ctor == NULL && dtor == NULL && uminit == NULL && fini == NULL) {
1907 		args.ctor = trash_ctor;
1908 		args.dtor = trash_dtor;
1909 		args.uminit = trash_init;
1910 		args.fini = trash_fini;
1911 	}
1912 #endif
1913 	args.align = align;
1914 	args.flags = flags;
1915 	args.keg = NULL;
1916 
1917 	if (booted < UMA_STARTUP2) {
1918 		locked = false;
1919 	} else {
1920 		sx_slock(&uma_drain_lock);
1921 		locked = true;
1922 	}
1923 	res = zone_alloc_item(zones, &args, M_WAITOK);
1924 	if (locked)
1925 		sx_sunlock(&uma_drain_lock);
1926 	return (res);
1927 }
1928 
1929 /* See uma.h */
1930 uma_zone_t
1931 uma_zsecond_create(char *name, uma_ctor ctor, uma_dtor dtor,
1932 		    uma_init zinit, uma_fini zfini, uma_zone_t master)
1933 {
1934 	struct uma_zctor_args args;
1935 	uma_keg_t keg;
1936 	uma_zone_t res;
1937 	bool locked;
1938 
1939 	keg = zone_first_keg(master);
1940 	memset(&args, 0, sizeof(args));
1941 	args.name = name;
1942 	args.size = keg->uk_size;
1943 	args.ctor = ctor;
1944 	args.dtor = dtor;
1945 	args.uminit = zinit;
1946 	args.fini = zfini;
1947 	args.align = keg->uk_align;
1948 	args.flags = keg->uk_flags | UMA_ZONE_SECONDARY;
1949 	args.keg = keg;
1950 
1951 	if (booted < UMA_STARTUP2) {
1952 		locked = false;
1953 	} else {
1954 		sx_slock(&uma_drain_lock);
1955 		locked = true;
1956 	}
1957 	/* XXX Attaches only one keg of potentially many. */
1958 	res = zone_alloc_item(zones, &args, M_WAITOK);
1959 	if (locked)
1960 		sx_sunlock(&uma_drain_lock);
1961 	return (res);
1962 }
1963 
1964 /* See uma.h */
1965 uma_zone_t
1966 uma_zcache_create(char *name, int size, uma_ctor ctor, uma_dtor dtor,
1967 		    uma_init zinit, uma_fini zfini, uma_import zimport,
1968 		    uma_release zrelease, void *arg, int flags)
1969 {
1970 	struct uma_zctor_args args;
1971 
1972 	memset(&args, 0, sizeof(args));
1973 	args.name = name;
1974 	args.size = size;
1975 	args.ctor = ctor;
1976 	args.dtor = dtor;
1977 	args.uminit = zinit;
1978 	args.fini = zfini;
1979 	args.import = zimport;
1980 	args.release = zrelease;
1981 	args.arg = arg;
1982 	args.align = 0;
1983 	args.flags = flags;
1984 
1985 	return (zone_alloc_item(zones, &args, M_WAITOK));
1986 }
1987 
1988 static void
1989 zone_lock_pair(uma_zone_t a, uma_zone_t b)
1990 {
1991 	if (a < b) {
1992 		ZONE_LOCK(a);
1993 		mtx_lock_flags(b->uz_lockptr, MTX_DUPOK);
1994 	} else {
1995 		ZONE_LOCK(b);
1996 		mtx_lock_flags(a->uz_lockptr, MTX_DUPOK);
1997 	}
1998 }
1999 
2000 static void
2001 zone_unlock_pair(uma_zone_t a, uma_zone_t b)
2002 {
2003 
2004 	ZONE_UNLOCK(a);
2005 	ZONE_UNLOCK(b);
2006 }
2007 
2008 int
2009 uma_zsecond_add(uma_zone_t zone, uma_zone_t master)
2010 {
2011 	uma_klink_t klink;
2012 	uma_klink_t kl;
2013 	int error;
2014 
2015 	error = 0;
2016 	klink = malloc(sizeof(*klink), M_TEMP, M_WAITOK | M_ZERO);
2017 
2018 	zone_lock_pair(zone, master);
2019 	/*
2020 	 * zone must use vtoslab() to resolve objects and must already be
2021 	 * a secondary.
2022 	 */
2023 	if ((zone->uz_flags & (UMA_ZONE_VTOSLAB | UMA_ZONE_SECONDARY))
2024 	    != (UMA_ZONE_VTOSLAB | UMA_ZONE_SECONDARY)) {
2025 		error = EINVAL;
2026 		goto out;
2027 	}
2028 	/*
2029 	 * The new master must also use vtoslab().
2030 	 */
2031 	if ((zone->uz_flags & UMA_ZONE_VTOSLAB) != UMA_ZONE_VTOSLAB) {
2032 		error = EINVAL;
2033 		goto out;
2034 	}
2035 
2036 	/*
2037 	 * The underlying object must be the same size.  rsize
2038 	 * may be different.
2039 	 */
2040 	if (master->uz_size != zone->uz_size) {
2041 		error = E2BIG;
2042 		goto out;
2043 	}
2044 	/*
2045 	 * Put it at the end of the list.
2046 	 */
2047 	klink->kl_keg = zone_first_keg(master);
2048 	LIST_FOREACH(kl, &zone->uz_kegs, kl_link) {
2049 		if (LIST_NEXT(kl, kl_link) == NULL) {
2050 			LIST_INSERT_AFTER(kl, klink, kl_link);
2051 			break;
2052 		}
2053 	}
2054 	klink = NULL;
2055 	zone->uz_flags |= UMA_ZFLAG_MULTI;
2056 	zone->uz_slab = zone_fetch_slab_multi;
2057 
2058 out:
2059 	zone_unlock_pair(zone, master);
2060 	if (klink != NULL)
2061 		free(klink, M_TEMP);
2062 
2063 	return (error);
2064 }
2065 
2066 
2067 /* See uma.h */
2068 void
2069 uma_zdestroy(uma_zone_t zone)
2070 {
2071 
2072 	sx_slock(&uma_drain_lock);
2073 	zone_free_item(zones, zone, NULL, SKIP_NONE);
2074 	sx_sunlock(&uma_drain_lock);
2075 }
2076 
2077 /* See uma.h */
2078 void *
2079 uma_zalloc_arg(uma_zone_t zone, void *udata, int flags)
2080 {
2081 	void *item;
2082 	uma_cache_t cache;
2083 	uma_bucket_t bucket;
2084 	int lockfail;
2085 	int cpu;
2086 
2087 	/* Enable entropy collection for RANDOM_ENABLE_UMA kernel option */
2088 	random_harvest_fast_uma(&zone, sizeof(zone), 1, RANDOM_UMA);
2089 
2090 	/* This is the fast path allocation */
2091 #ifdef UMA_DEBUG_ALLOC_1
2092 	printf("Allocating one item from %s(%p)\n", zone->uz_name, zone);
2093 #endif
2094 	CTR3(KTR_UMA, "uma_zalloc_arg thread %x zone %s flags %d", curthread,
2095 	    zone->uz_name, flags);
2096 
2097 	if (flags & M_WAITOK) {
2098 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
2099 		    "uma_zalloc_arg: zone \"%s\"", zone->uz_name);
2100 	}
2101 	KASSERT(curthread->td_critnest == 0 || SCHEDULER_STOPPED(),
2102 	    ("uma_zalloc_arg: called with spinlock or critical section held"));
2103 
2104 #ifdef DEBUG_MEMGUARD
2105 	if (memguard_cmp_zone(zone)) {
2106 		item = memguard_alloc(zone->uz_size, flags);
2107 		if (item != NULL) {
2108 			if (zone->uz_init != NULL &&
2109 			    zone->uz_init(item, zone->uz_size, flags) != 0)
2110 				return (NULL);
2111 			if (zone->uz_ctor != NULL &&
2112 			    zone->uz_ctor(item, zone->uz_size, udata,
2113 			    flags) != 0) {
2114 			    	zone->uz_fini(item, zone->uz_size);
2115 				return (NULL);
2116 			}
2117 			return (item);
2118 		}
2119 		/* This is unfortunate but should not be fatal. */
2120 	}
2121 #endif
2122 	/*
2123 	 * If possible, allocate from the per-CPU cache.  There are two
2124 	 * requirements for safe access to the per-CPU cache: (1) the thread
2125 	 * accessing the cache must not be preempted or yield during access,
2126 	 * and (2) the thread must not migrate CPUs without switching which
2127 	 * cache it accesses.  We rely on a critical section to prevent
2128 	 * preemption and migration.  We release the critical section in
2129 	 * order to acquire the zone mutex if we are unable to allocate from
2130 	 * the current cache; when we re-acquire the critical section, we
2131 	 * must detect and handle migration if it has occurred.
2132 	 */
2133 	critical_enter();
2134 	cpu = curcpu;
2135 	cache = &zone->uz_cpu[cpu];
2136 
2137 zalloc_start:
2138 	bucket = cache->uc_allocbucket;
2139 	if (bucket != NULL && bucket->ub_cnt > 0) {
2140 		bucket->ub_cnt--;
2141 		item = bucket->ub_bucket[bucket->ub_cnt];
2142 #ifdef INVARIANTS
2143 		bucket->ub_bucket[bucket->ub_cnt] = NULL;
2144 #endif
2145 		KASSERT(item != NULL, ("uma_zalloc: Bucket pointer mangled."));
2146 		cache->uc_allocs++;
2147 		critical_exit();
2148 		if (zone->uz_ctor != NULL &&
2149 		    zone->uz_ctor(item, zone->uz_size, udata, flags) != 0) {
2150 			atomic_add_long(&zone->uz_fails, 1);
2151 			zone_free_item(zone, item, udata, SKIP_DTOR);
2152 			return (NULL);
2153 		}
2154 #ifdef INVARIANTS
2155 		uma_dbg_alloc(zone, NULL, item);
2156 #endif
2157 		if (flags & M_ZERO)
2158 			uma_zero_item(item, zone);
2159 		return (item);
2160 	}
2161 
2162 	/*
2163 	 * We have run out of items in our alloc bucket.
2164 	 * See if we can switch with our free bucket.
2165 	 */
2166 	bucket = cache->uc_freebucket;
2167 	if (bucket != NULL && bucket->ub_cnt > 0) {
2168 #ifdef UMA_DEBUG_ALLOC
2169 		printf("uma_zalloc: Swapping empty with alloc.\n");
2170 #endif
2171 		cache->uc_freebucket = cache->uc_allocbucket;
2172 		cache->uc_allocbucket = bucket;
2173 		goto zalloc_start;
2174 	}
2175 
2176 	/*
2177 	 * Discard any empty allocation bucket while we hold no locks.
2178 	 */
2179 	bucket = cache->uc_allocbucket;
2180 	cache->uc_allocbucket = NULL;
2181 	critical_exit();
2182 	if (bucket != NULL)
2183 		bucket_free(zone, bucket, udata);
2184 
2185 	/* Short-circuit for zones without buckets and low memory. */
2186 	if (zone->uz_count == 0 || bucketdisable)
2187 		goto zalloc_item;
2188 
2189 	/*
2190 	 * Attempt to retrieve the item from the per-CPU cache has failed, so
2191 	 * we must go back to the zone.  This requires the zone lock, so we
2192 	 * must drop the critical section, then re-acquire it when we go back
2193 	 * to the cache.  Since the critical section is released, we may be
2194 	 * preempted or migrate.  As such, make sure not to maintain any
2195 	 * thread-local state specific to the cache from prior to releasing
2196 	 * the critical section.
2197 	 */
2198 	lockfail = 0;
2199 	if (ZONE_TRYLOCK(zone) == 0) {
2200 		/* Record contention to size the buckets. */
2201 		ZONE_LOCK(zone);
2202 		lockfail = 1;
2203 	}
2204 	critical_enter();
2205 	cpu = curcpu;
2206 	cache = &zone->uz_cpu[cpu];
2207 
2208 	/*
2209 	 * Since we have locked the zone we may as well send back our stats.
2210 	 */
2211 	atomic_add_long(&zone->uz_allocs, cache->uc_allocs);
2212 	atomic_add_long(&zone->uz_frees, cache->uc_frees);
2213 	cache->uc_allocs = 0;
2214 	cache->uc_frees = 0;
2215 
2216 	/* See if we lost the race to fill the cache. */
2217 	if (cache->uc_allocbucket != NULL) {
2218 		ZONE_UNLOCK(zone);
2219 		goto zalloc_start;
2220 	}
2221 
2222 	/*
2223 	 * Check the zone's cache of buckets.
2224 	 */
2225 	if ((bucket = LIST_FIRST(&zone->uz_buckets)) != NULL) {
2226 		KASSERT(bucket->ub_cnt != 0,
2227 		    ("uma_zalloc_arg: Returning an empty bucket."));
2228 
2229 		LIST_REMOVE(bucket, ub_link);
2230 		cache->uc_allocbucket = bucket;
2231 		ZONE_UNLOCK(zone);
2232 		goto zalloc_start;
2233 	}
2234 	/* We are no longer associated with this CPU. */
2235 	critical_exit();
2236 
2237 	/*
2238 	 * We bump the uz count when the cache size is insufficient to
2239 	 * handle the working set.
2240 	 */
2241 	if (lockfail && zone->uz_count < BUCKET_MAX)
2242 		zone->uz_count++;
2243 	ZONE_UNLOCK(zone);
2244 
2245 	/*
2246 	 * Now lets just fill a bucket and put it on the free list.  If that
2247 	 * works we'll restart the allocation from the beginning and it
2248 	 * will use the just filled bucket.
2249 	 */
2250 	bucket = zone_alloc_bucket(zone, udata, flags);
2251 	if (bucket != NULL) {
2252 		ZONE_LOCK(zone);
2253 		critical_enter();
2254 		cpu = curcpu;
2255 		cache = &zone->uz_cpu[cpu];
2256 		/*
2257 		 * See if we lost the race or were migrated.  Cache the
2258 		 * initialized bucket to make this less likely or claim
2259 		 * the memory directly.
2260 		 */
2261 		if (cache->uc_allocbucket == NULL)
2262 			cache->uc_allocbucket = bucket;
2263 		else
2264 			LIST_INSERT_HEAD(&zone->uz_buckets, bucket, ub_link);
2265 		ZONE_UNLOCK(zone);
2266 		goto zalloc_start;
2267 	}
2268 
2269 	/*
2270 	 * We may not be able to get a bucket so return an actual item.
2271 	 */
2272 #ifdef UMA_DEBUG
2273 	printf("uma_zalloc_arg: Bucketzone returned NULL\n");
2274 #endif
2275 
2276 zalloc_item:
2277 	item = zone_alloc_item(zone, udata, flags);
2278 
2279 	return (item);
2280 }
2281 
2282 static uma_slab_t
2283 keg_fetch_slab(uma_keg_t keg, uma_zone_t zone, int flags)
2284 {
2285 	uma_slab_t slab;
2286 	int reserve;
2287 
2288 	mtx_assert(&keg->uk_lock, MA_OWNED);
2289 	slab = NULL;
2290 	reserve = 0;
2291 	if ((flags & M_USE_RESERVE) == 0)
2292 		reserve = keg->uk_reserve;
2293 
2294 	for (;;) {
2295 		/*
2296 		 * Find a slab with some space.  Prefer slabs that are partially
2297 		 * used over those that are totally full.  This helps to reduce
2298 		 * fragmentation.
2299 		 */
2300 		if (keg->uk_free > reserve) {
2301 			if (!LIST_EMPTY(&keg->uk_part_slab)) {
2302 				slab = LIST_FIRST(&keg->uk_part_slab);
2303 			} else {
2304 				slab = LIST_FIRST(&keg->uk_free_slab);
2305 				LIST_REMOVE(slab, us_link);
2306 				LIST_INSERT_HEAD(&keg->uk_part_slab, slab,
2307 				    us_link);
2308 			}
2309 			MPASS(slab->us_keg == keg);
2310 			return (slab);
2311 		}
2312 
2313 		/*
2314 		 * M_NOVM means don't ask at all!
2315 		 */
2316 		if (flags & M_NOVM)
2317 			break;
2318 
2319 		if (keg->uk_maxpages && keg->uk_pages >= keg->uk_maxpages) {
2320 			keg->uk_flags |= UMA_ZFLAG_FULL;
2321 			/*
2322 			 * If this is not a multi-zone, set the FULL bit.
2323 			 * Otherwise slab_multi() takes care of it.
2324 			 */
2325 			if ((zone->uz_flags & UMA_ZFLAG_MULTI) == 0) {
2326 				zone->uz_flags |= UMA_ZFLAG_FULL;
2327 				zone_log_warning(zone);
2328 				zone_maxaction(zone);
2329 			}
2330 			if (flags & M_NOWAIT)
2331 				break;
2332 			zone->uz_sleeps++;
2333 			msleep(keg, &keg->uk_lock, PVM, "keglimit", 0);
2334 			continue;
2335 		}
2336 		slab = keg_alloc_slab(keg, zone, flags);
2337 		/*
2338 		 * If we got a slab here it's safe to mark it partially used
2339 		 * and return.  We assume that the caller is going to remove
2340 		 * at least one item.
2341 		 */
2342 		if (slab) {
2343 			MPASS(slab->us_keg == keg);
2344 			LIST_INSERT_HEAD(&keg->uk_part_slab, slab, us_link);
2345 			return (slab);
2346 		}
2347 		/*
2348 		 * We might not have been able to get a slab but another cpu
2349 		 * could have while we were unlocked.  Check again before we
2350 		 * fail.
2351 		 */
2352 		flags |= M_NOVM;
2353 	}
2354 	return (slab);
2355 }
2356 
2357 static uma_slab_t
2358 zone_fetch_slab(uma_zone_t zone, uma_keg_t keg, int flags)
2359 {
2360 	uma_slab_t slab;
2361 
2362 	if (keg == NULL) {
2363 		keg = zone_first_keg(zone);
2364 		KEG_LOCK(keg);
2365 	}
2366 
2367 	for (;;) {
2368 		slab = keg_fetch_slab(keg, zone, flags);
2369 		if (slab)
2370 			return (slab);
2371 		if (flags & (M_NOWAIT | M_NOVM))
2372 			break;
2373 	}
2374 	KEG_UNLOCK(keg);
2375 	return (NULL);
2376 }
2377 
2378 /*
2379  * uma_zone_fetch_slab_multi:  Fetches a slab from one available keg.  Returns
2380  * with the keg locked.  On NULL no lock is held.
2381  *
2382  * The last pointer is used to seed the search.  It is not required.
2383  */
2384 static uma_slab_t
2385 zone_fetch_slab_multi(uma_zone_t zone, uma_keg_t last, int rflags)
2386 {
2387 	uma_klink_t klink;
2388 	uma_slab_t slab;
2389 	uma_keg_t keg;
2390 	int flags;
2391 	int empty;
2392 	int full;
2393 
2394 	/*
2395 	 * Don't wait on the first pass.  This will skip limit tests
2396 	 * as well.  We don't want to block if we can find a provider
2397 	 * without blocking.
2398 	 */
2399 	flags = (rflags & ~M_WAITOK) | M_NOWAIT;
2400 	/*
2401 	 * Use the last slab allocated as a hint for where to start
2402 	 * the search.
2403 	 */
2404 	if (last != NULL) {
2405 		slab = keg_fetch_slab(last, zone, flags);
2406 		if (slab)
2407 			return (slab);
2408 		KEG_UNLOCK(last);
2409 	}
2410 	/*
2411 	 * Loop until we have a slab incase of transient failures
2412 	 * while M_WAITOK is specified.  I'm not sure this is 100%
2413 	 * required but we've done it for so long now.
2414 	 */
2415 	for (;;) {
2416 		empty = 0;
2417 		full = 0;
2418 		/*
2419 		 * Search the available kegs for slabs.  Be careful to hold the
2420 		 * correct lock while calling into the keg layer.
2421 		 */
2422 		LIST_FOREACH(klink, &zone->uz_kegs, kl_link) {
2423 			keg = klink->kl_keg;
2424 			KEG_LOCK(keg);
2425 			if ((keg->uk_flags & UMA_ZFLAG_FULL) == 0) {
2426 				slab = keg_fetch_slab(keg, zone, flags);
2427 				if (slab)
2428 					return (slab);
2429 			}
2430 			if (keg->uk_flags & UMA_ZFLAG_FULL)
2431 				full++;
2432 			else
2433 				empty++;
2434 			KEG_UNLOCK(keg);
2435 		}
2436 		if (rflags & (M_NOWAIT | M_NOVM))
2437 			break;
2438 		flags = rflags;
2439 		/*
2440 		 * All kegs are full.  XXX We can't atomically check all kegs
2441 		 * and sleep so just sleep for a short period and retry.
2442 		 */
2443 		if (full && !empty) {
2444 			ZONE_LOCK(zone);
2445 			zone->uz_flags |= UMA_ZFLAG_FULL;
2446 			zone->uz_sleeps++;
2447 			zone_log_warning(zone);
2448 			zone_maxaction(zone);
2449 			msleep(zone, zone->uz_lockptr, PVM,
2450 			    "zonelimit", hz/100);
2451 			zone->uz_flags &= ~UMA_ZFLAG_FULL;
2452 			ZONE_UNLOCK(zone);
2453 			continue;
2454 		}
2455 	}
2456 	return (NULL);
2457 }
2458 
2459 static void *
2460 slab_alloc_item(uma_keg_t keg, uma_slab_t slab)
2461 {
2462 	void *item;
2463 	uint8_t freei;
2464 
2465 	MPASS(keg == slab->us_keg);
2466 	mtx_assert(&keg->uk_lock, MA_OWNED);
2467 
2468 	freei = BIT_FFS(SLAB_SETSIZE, &slab->us_free) - 1;
2469 	BIT_CLR(SLAB_SETSIZE, freei, &slab->us_free);
2470 	item = slab->us_data + (keg->uk_rsize * freei);
2471 	slab->us_freecount--;
2472 	keg->uk_free--;
2473 
2474 	/* Move this slab to the full list */
2475 	if (slab->us_freecount == 0) {
2476 		LIST_REMOVE(slab, us_link);
2477 		LIST_INSERT_HEAD(&keg->uk_full_slab, slab, us_link);
2478 	}
2479 
2480 	return (item);
2481 }
2482 
2483 static int
2484 zone_import(uma_zone_t zone, void **bucket, int max, int flags)
2485 {
2486 	uma_slab_t slab;
2487 	uma_keg_t keg;
2488 	int i;
2489 
2490 	slab = NULL;
2491 	keg = NULL;
2492 	/* Try to keep the buckets totally full */
2493 	for (i = 0; i < max; ) {
2494 		if ((slab = zone->uz_slab(zone, keg, flags)) == NULL)
2495 			break;
2496 		keg = slab->us_keg;
2497 		while (slab->us_freecount && i < max) {
2498 			bucket[i++] = slab_alloc_item(keg, slab);
2499 			if (keg->uk_free <= keg->uk_reserve)
2500 				break;
2501 		}
2502 		/* Don't grab more than one slab at a time. */
2503 		flags &= ~M_WAITOK;
2504 		flags |= M_NOWAIT;
2505 	}
2506 	if (slab != NULL)
2507 		KEG_UNLOCK(keg);
2508 
2509 	return i;
2510 }
2511 
2512 static uma_bucket_t
2513 zone_alloc_bucket(uma_zone_t zone, void *udata, int flags)
2514 {
2515 	uma_bucket_t bucket;
2516 	int max;
2517 
2518 	/* Don't wait for buckets, preserve caller's NOVM setting. */
2519 	bucket = bucket_alloc(zone, udata, M_NOWAIT | (flags & M_NOVM));
2520 	if (bucket == NULL)
2521 		return (NULL);
2522 
2523 	max = MIN(bucket->ub_entries, zone->uz_count);
2524 	bucket->ub_cnt = zone->uz_import(zone->uz_arg, bucket->ub_bucket,
2525 	    max, flags);
2526 
2527 	/*
2528 	 * Initialize the memory if necessary.
2529 	 */
2530 	if (bucket->ub_cnt != 0 && zone->uz_init != NULL) {
2531 		int i;
2532 
2533 		for (i = 0; i < bucket->ub_cnt; i++)
2534 			if (zone->uz_init(bucket->ub_bucket[i], zone->uz_size,
2535 			    flags) != 0)
2536 				break;
2537 		/*
2538 		 * If we couldn't initialize the whole bucket, put the
2539 		 * rest back onto the freelist.
2540 		 */
2541 		if (i != bucket->ub_cnt) {
2542 			zone->uz_release(zone->uz_arg, &bucket->ub_bucket[i],
2543 			    bucket->ub_cnt - i);
2544 #ifdef INVARIANTS
2545 			bzero(&bucket->ub_bucket[i],
2546 			    sizeof(void *) * (bucket->ub_cnt - i));
2547 #endif
2548 			bucket->ub_cnt = i;
2549 		}
2550 	}
2551 
2552 	if (bucket->ub_cnt == 0) {
2553 		bucket_free(zone, bucket, udata);
2554 		atomic_add_long(&zone->uz_fails, 1);
2555 		return (NULL);
2556 	}
2557 
2558 	return (bucket);
2559 }
2560 
2561 /*
2562  * Allocates a single item from a zone.
2563  *
2564  * Arguments
2565  *	zone   The zone to alloc for.
2566  *	udata  The data to be passed to the constructor.
2567  *	flags  M_WAITOK, M_NOWAIT, M_ZERO.
2568  *
2569  * Returns
2570  *	NULL if there is no memory and M_NOWAIT is set
2571  *	An item if successful
2572  */
2573 
2574 static void *
2575 zone_alloc_item(uma_zone_t zone, void *udata, int flags)
2576 {
2577 	void *item;
2578 
2579 	item = NULL;
2580 
2581 #ifdef UMA_DEBUG_ALLOC
2582 	printf("INTERNAL: Allocating one item from %s(%p)\n", zone->uz_name, zone);
2583 #endif
2584 	if (zone->uz_import(zone->uz_arg, &item, 1, flags) != 1)
2585 		goto fail;
2586 	atomic_add_long(&zone->uz_allocs, 1);
2587 
2588 	/*
2589 	 * We have to call both the zone's init (not the keg's init)
2590 	 * and the zone's ctor.  This is because the item is going from
2591 	 * a keg slab directly to the user, and the user is expecting it
2592 	 * to be both zone-init'd as well as zone-ctor'd.
2593 	 */
2594 	if (zone->uz_init != NULL) {
2595 		if (zone->uz_init(item, zone->uz_size, flags) != 0) {
2596 			zone_free_item(zone, item, udata, SKIP_FINI);
2597 			goto fail;
2598 		}
2599 	}
2600 	if (zone->uz_ctor != NULL) {
2601 		if (zone->uz_ctor(item, zone->uz_size, udata, flags) != 0) {
2602 			zone_free_item(zone, item, udata, SKIP_DTOR);
2603 			goto fail;
2604 		}
2605 	}
2606 #ifdef INVARIANTS
2607 	uma_dbg_alloc(zone, NULL, item);
2608 #endif
2609 	if (flags & M_ZERO)
2610 		uma_zero_item(item, zone);
2611 
2612 	return (item);
2613 
2614 fail:
2615 	atomic_add_long(&zone->uz_fails, 1);
2616 	return (NULL);
2617 }
2618 
2619 /* See uma.h */
2620 void
2621 uma_zfree_arg(uma_zone_t zone, void *item, void *udata)
2622 {
2623 	uma_cache_t cache;
2624 	uma_bucket_t bucket;
2625 	int lockfail;
2626 	int cpu;
2627 
2628 	/* Enable entropy collection for RANDOM_ENABLE_UMA kernel option */
2629 	random_harvest_fast_uma(&zone, sizeof(zone), 1, RANDOM_UMA);
2630 
2631 #ifdef UMA_DEBUG_ALLOC_1
2632 	printf("Freeing item %p to %s(%p)\n", item, zone->uz_name, zone);
2633 #endif
2634 	CTR2(KTR_UMA, "uma_zfree_arg thread %x zone %s", curthread,
2635 	    zone->uz_name);
2636 
2637 	KASSERT(curthread->td_critnest == 0 || SCHEDULER_STOPPED(),
2638 	    ("uma_zfree_arg: called with spinlock or critical section held"));
2639 
2640         /* uma_zfree(..., NULL) does nothing, to match free(9). */
2641         if (item == NULL)
2642                 return;
2643 #ifdef DEBUG_MEMGUARD
2644 	if (is_memguard_addr(item)) {
2645 		if (zone->uz_dtor != NULL)
2646 			zone->uz_dtor(item, zone->uz_size, udata);
2647 		if (zone->uz_fini != NULL)
2648 			zone->uz_fini(item, zone->uz_size);
2649 		memguard_free(item);
2650 		return;
2651 	}
2652 #endif
2653 #ifdef INVARIANTS
2654 	if (zone->uz_flags & UMA_ZONE_MALLOC)
2655 		uma_dbg_free(zone, udata, item);
2656 	else
2657 		uma_dbg_free(zone, NULL, item);
2658 #endif
2659 	if (zone->uz_dtor != NULL)
2660 		zone->uz_dtor(item, zone->uz_size, udata);
2661 
2662 	/*
2663 	 * The race here is acceptable.  If we miss it we'll just have to wait
2664 	 * a little longer for the limits to be reset.
2665 	 */
2666 	if (zone->uz_flags & UMA_ZFLAG_FULL)
2667 		goto zfree_item;
2668 
2669 	/*
2670 	 * If possible, free to the per-CPU cache.  There are two
2671 	 * requirements for safe access to the per-CPU cache: (1) the thread
2672 	 * accessing the cache must not be preempted or yield during access,
2673 	 * and (2) the thread must not migrate CPUs without switching which
2674 	 * cache it accesses.  We rely on a critical section to prevent
2675 	 * preemption and migration.  We release the critical section in
2676 	 * order to acquire the zone mutex if we are unable to free to the
2677 	 * current cache; when we re-acquire the critical section, we must
2678 	 * detect and handle migration if it has occurred.
2679 	 */
2680 zfree_restart:
2681 	critical_enter();
2682 	cpu = curcpu;
2683 	cache = &zone->uz_cpu[cpu];
2684 
2685 zfree_start:
2686 	/*
2687 	 * Try to free into the allocbucket first to give LIFO ordering
2688 	 * for cache-hot datastructures.  Spill over into the freebucket
2689 	 * if necessary.  Alloc will swap them if one runs dry.
2690 	 */
2691 	bucket = cache->uc_allocbucket;
2692 	if (bucket == NULL || bucket->ub_cnt >= bucket->ub_entries)
2693 		bucket = cache->uc_freebucket;
2694 	if (bucket != NULL && bucket->ub_cnt < bucket->ub_entries) {
2695 		KASSERT(bucket->ub_bucket[bucket->ub_cnt] == NULL,
2696 		    ("uma_zfree: Freeing to non free bucket index."));
2697 		bucket->ub_bucket[bucket->ub_cnt] = item;
2698 		bucket->ub_cnt++;
2699 		cache->uc_frees++;
2700 		critical_exit();
2701 		return;
2702 	}
2703 
2704 	/*
2705 	 * We must go back the zone, which requires acquiring the zone lock,
2706 	 * which in turn means we must release and re-acquire the critical
2707 	 * section.  Since the critical section is released, we may be
2708 	 * preempted or migrate.  As such, make sure not to maintain any
2709 	 * thread-local state specific to the cache from prior to releasing
2710 	 * the critical section.
2711 	 */
2712 	critical_exit();
2713 	if (zone->uz_count == 0 || bucketdisable)
2714 		goto zfree_item;
2715 
2716 	lockfail = 0;
2717 	if (ZONE_TRYLOCK(zone) == 0) {
2718 		/* Record contention to size the buckets. */
2719 		ZONE_LOCK(zone);
2720 		lockfail = 1;
2721 	}
2722 	critical_enter();
2723 	cpu = curcpu;
2724 	cache = &zone->uz_cpu[cpu];
2725 
2726 	/*
2727 	 * Since we have locked the zone we may as well send back our stats.
2728 	 */
2729 	atomic_add_long(&zone->uz_allocs, cache->uc_allocs);
2730 	atomic_add_long(&zone->uz_frees, cache->uc_frees);
2731 	cache->uc_allocs = 0;
2732 	cache->uc_frees = 0;
2733 
2734 	bucket = cache->uc_freebucket;
2735 	if (bucket != NULL && bucket->ub_cnt < bucket->ub_entries) {
2736 		ZONE_UNLOCK(zone);
2737 		goto zfree_start;
2738 	}
2739 	cache->uc_freebucket = NULL;
2740 	/* We are no longer associated with this CPU. */
2741 	critical_exit();
2742 
2743 	/* Can we throw this on the zone full list? */
2744 	if (bucket != NULL) {
2745 #ifdef UMA_DEBUG_ALLOC
2746 		printf("uma_zfree: Putting old bucket on the free list.\n");
2747 #endif
2748 		/* ub_cnt is pointing to the last free item */
2749 		KASSERT(bucket->ub_cnt != 0,
2750 		    ("uma_zfree: Attempting to insert an empty bucket onto the full list.\n"));
2751 		LIST_INSERT_HEAD(&zone->uz_buckets, bucket, ub_link);
2752 	}
2753 
2754 	/*
2755 	 * We bump the uz count when the cache size is insufficient to
2756 	 * handle the working set.
2757 	 */
2758 	if (lockfail && zone->uz_count < BUCKET_MAX)
2759 		zone->uz_count++;
2760 	ZONE_UNLOCK(zone);
2761 
2762 #ifdef UMA_DEBUG_ALLOC
2763 	printf("uma_zfree: Allocating new free bucket.\n");
2764 #endif
2765 	bucket = bucket_alloc(zone, udata, M_NOWAIT);
2766 	if (bucket) {
2767 		critical_enter();
2768 		cpu = curcpu;
2769 		cache = &zone->uz_cpu[cpu];
2770 		if (cache->uc_freebucket == NULL) {
2771 			cache->uc_freebucket = bucket;
2772 			goto zfree_start;
2773 		}
2774 		/*
2775 		 * We lost the race, start over.  We have to drop our
2776 		 * critical section to free the bucket.
2777 		 */
2778 		critical_exit();
2779 		bucket_free(zone, bucket, udata);
2780 		goto zfree_restart;
2781 	}
2782 
2783 	/*
2784 	 * If nothing else caught this, we'll just do an internal free.
2785 	 */
2786 zfree_item:
2787 	zone_free_item(zone, item, udata, SKIP_DTOR);
2788 
2789 	return;
2790 }
2791 
2792 static void
2793 slab_free_item(uma_keg_t keg, uma_slab_t slab, void *item)
2794 {
2795 	uint8_t freei;
2796 
2797 	mtx_assert(&keg->uk_lock, MA_OWNED);
2798 	MPASS(keg == slab->us_keg);
2799 
2800 	/* Do we need to remove from any lists? */
2801 	if (slab->us_freecount+1 == keg->uk_ipers) {
2802 		LIST_REMOVE(slab, us_link);
2803 		LIST_INSERT_HEAD(&keg->uk_free_slab, slab, us_link);
2804 	} else if (slab->us_freecount == 0) {
2805 		LIST_REMOVE(slab, us_link);
2806 		LIST_INSERT_HEAD(&keg->uk_part_slab, slab, us_link);
2807 	}
2808 
2809 	/* Slab management. */
2810 	freei = ((uintptr_t)item - (uintptr_t)slab->us_data) / keg->uk_rsize;
2811 	BIT_SET(SLAB_SETSIZE, freei, &slab->us_free);
2812 	slab->us_freecount++;
2813 
2814 	/* Keg statistics. */
2815 	keg->uk_free++;
2816 }
2817 
2818 static void
2819 zone_release(uma_zone_t zone, void **bucket, int cnt)
2820 {
2821 	void *item;
2822 	uma_slab_t slab;
2823 	uma_keg_t keg;
2824 	uint8_t *mem;
2825 	int clearfull;
2826 	int i;
2827 
2828 	clearfull = 0;
2829 	keg = zone_first_keg(zone);
2830 	KEG_LOCK(keg);
2831 	for (i = 0; i < cnt; i++) {
2832 		item = bucket[i];
2833 		if (!(zone->uz_flags & UMA_ZONE_VTOSLAB)) {
2834 			mem = (uint8_t *)((uintptr_t)item & (~UMA_SLAB_MASK));
2835 			if (zone->uz_flags & UMA_ZONE_HASH) {
2836 				slab = hash_sfind(&keg->uk_hash, mem);
2837 			} else {
2838 				mem += keg->uk_pgoff;
2839 				slab = (uma_slab_t)mem;
2840 			}
2841 		} else {
2842 			slab = vtoslab((vm_offset_t)item);
2843 			if (slab->us_keg != keg) {
2844 				KEG_UNLOCK(keg);
2845 				keg = slab->us_keg;
2846 				KEG_LOCK(keg);
2847 			}
2848 		}
2849 		slab_free_item(keg, slab, item);
2850 		if (keg->uk_flags & UMA_ZFLAG_FULL) {
2851 			if (keg->uk_pages < keg->uk_maxpages) {
2852 				keg->uk_flags &= ~UMA_ZFLAG_FULL;
2853 				clearfull = 1;
2854 			}
2855 
2856 			/*
2857 			 * We can handle one more allocation. Since we're
2858 			 * clearing ZFLAG_FULL, wake up all procs blocked
2859 			 * on pages. This should be uncommon, so keeping this
2860 			 * simple for now (rather than adding count of blocked
2861 			 * threads etc).
2862 			 */
2863 			wakeup(keg);
2864 		}
2865 	}
2866 	KEG_UNLOCK(keg);
2867 	if (clearfull) {
2868 		ZONE_LOCK(zone);
2869 		zone->uz_flags &= ~UMA_ZFLAG_FULL;
2870 		wakeup(zone);
2871 		ZONE_UNLOCK(zone);
2872 	}
2873 
2874 }
2875 
2876 /*
2877  * Frees a single item to any zone.
2878  *
2879  * Arguments:
2880  *	zone   The zone to free to
2881  *	item   The item we're freeing
2882  *	udata  User supplied data for the dtor
2883  *	skip   Skip dtors and finis
2884  */
2885 static void
2886 zone_free_item(uma_zone_t zone, void *item, void *udata, enum zfreeskip skip)
2887 {
2888 
2889 #ifdef INVARIANTS
2890 	if (skip == SKIP_NONE) {
2891 		if (zone->uz_flags & UMA_ZONE_MALLOC)
2892 			uma_dbg_free(zone, udata, item);
2893 		else
2894 			uma_dbg_free(zone, NULL, item);
2895 	}
2896 #endif
2897 	if (skip < SKIP_DTOR && zone->uz_dtor)
2898 		zone->uz_dtor(item, zone->uz_size, udata);
2899 
2900 	if (skip < SKIP_FINI && zone->uz_fini)
2901 		zone->uz_fini(item, zone->uz_size);
2902 
2903 	atomic_add_long(&zone->uz_frees, 1);
2904 	zone->uz_release(zone->uz_arg, &item, 1);
2905 }
2906 
2907 /* See uma.h */
2908 int
2909 uma_zone_set_max(uma_zone_t zone, int nitems)
2910 {
2911 	uma_keg_t keg;
2912 
2913 	keg = zone_first_keg(zone);
2914 	if (keg == NULL)
2915 		return (0);
2916 	KEG_LOCK(keg);
2917 	keg->uk_maxpages = (nitems / keg->uk_ipers) * keg->uk_ppera;
2918 	if (keg->uk_maxpages * keg->uk_ipers < nitems)
2919 		keg->uk_maxpages += keg->uk_ppera;
2920 	nitems = (keg->uk_maxpages / keg->uk_ppera) * keg->uk_ipers;
2921 	KEG_UNLOCK(keg);
2922 
2923 	return (nitems);
2924 }
2925 
2926 /* See uma.h */
2927 int
2928 uma_zone_get_max(uma_zone_t zone)
2929 {
2930 	int nitems;
2931 	uma_keg_t keg;
2932 
2933 	keg = zone_first_keg(zone);
2934 	if (keg == NULL)
2935 		return (0);
2936 	KEG_LOCK(keg);
2937 	nitems = (keg->uk_maxpages / keg->uk_ppera) * keg->uk_ipers;
2938 	KEG_UNLOCK(keg);
2939 
2940 	return (nitems);
2941 }
2942 
2943 /* See uma.h */
2944 void
2945 uma_zone_set_warning(uma_zone_t zone, const char *warning)
2946 {
2947 
2948 	ZONE_LOCK(zone);
2949 	zone->uz_warning = warning;
2950 	ZONE_UNLOCK(zone);
2951 }
2952 
2953 /* See uma.h */
2954 void
2955 uma_zone_set_maxaction(uma_zone_t zone, uma_maxaction_t maxaction)
2956 {
2957 
2958 	ZONE_LOCK(zone);
2959 	TASK_INIT(&zone->uz_maxaction, 0, (task_fn_t *)maxaction, zone);
2960 	ZONE_UNLOCK(zone);
2961 }
2962 
2963 /* See uma.h */
2964 int
2965 uma_zone_get_cur(uma_zone_t zone)
2966 {
2967 	int64_t nitems;
2968 	u_int i;
2969 
2970 	ZONE_LOCK(zone);
2971 	nitems = zone->uz_allocs - zone->uz_frees;
2972 	CPU_FOREACH(i) {
2973 		/*
2974 		 * See the comment in sysctl_vm_zone_stats() regarding the
2975 		 * safety of accessing the per-cpu caches. With the zone lock
2976 		 * held, it is safe, but can potentially result in stale data.
2977 		 */
2978 		nitems += zone->uz_cpu[i].uc_allocs -
2979 		    zone->uz_cpu[i].uc_frees;
2980 	}
2981 	ZONE_UNLOCK(zone);
2982 
2983 	return (nitems < 0 ? 0 : nitems);
2984 }
2985 
2986 /* See uma.h */
2987 void
2988 uma_zone_set_init(uma_zone_t zone, uma_init uminit)
2989 {
2990 	uma_keg_t keg;
2991 
2992 	keg = zone_first_keg(zone);
2993 	KASSERT(keg != NULL, ("uma_zone_set_init: Invalid zone type"));
2994 	KEG_LOCK(keg);
2995 	KASSERT(keg->uk_pages == 0,
2996 	    ("uma_zone_set_init on non-empty keg"));
2997 	keg->uk_init = uminit;
2998 	KEG_UNLOCK(keg);
2999 }
3000 
3001 /* See uma.h */
3002 void
3003 uma_zone_set_fini(uma_zone_t zone, uma_fini fini)
3004 {
3005 	uma_keg_t keg;
3006 
3007 	keg = zone_first_keg(zone);
3008 	KASSERT(keg != NULL, ("uma_zone_set_fini: Invalid zone type"));
3009 	KEG_LOCK(keg);
3010 	KASSERT(keg->uk_pages == 0,
3011 	    ("uma_zone_set_fini on non-empty keg"));
3012 	keg->uk_fini = fini;
3013 	KEG_UNLOCK(keg);
3014 }
3015 
3016 /* See uma.h */
3017 void
3018 uma_zone_set_zinit(uma_zone_t zone, uma_init zinit)
3019 {
3020 
3021 	ZONE_LOCK(zone);
3022 	KASSERT(zone_first_keg(zone)->uk_pages == 0,
3023 	    ("uma_zone_set_zinit on non-empty keg"));
3024 	zone->uz_init = zinit;
3025 	ZONE_UNLOCK(zone);
3026 }
3027 
3028 /* See uma.h */
3029 void
3030 uma_zone_set_zfini(uma_zone_t zone, uma_fini zfini)
3031 {
3032 
3033 	ZONE_LOCK(zone);
3034 	KASSERT(zone_first_keg(zone)->uk_pages == 0,
3035 	    ("uma_zone_set_zfini on non-empty keg"));
3036 	zone->uz_fini = zfini;
3037 	ZONE_UNLOCK(zone);
3038 }
3039 
3040 /* See uma.h */
3041 /* XXX uk_freef is not actually used with the zone locked */
3042 void
3043 uma_zone_set_freef(uma_zone_t zone, uma_free freef)
3044 {
3045 	uma_keg_t keg;
3046 
3047 	keg = zone_first_keg(zone);
3048 	KASSERT(keg != NULL, ("uma_zone_set_freef: Invalid zone type"));
3049 	KEG_LOCK(keg);
3050 	keg->uk_freef = freef;
3051 	KEG_UNLOCK(keg);
3052 }
3053 
3054 /* See uma.h */
3055 /* XXX uk_allocf is not actually used with the zone locked */
3056 void
3057 uma_zone_set_allocf(uma_zone_t zone, uma_alloc allocf)
3058 {
3059 	uma_keg_t keg;
3060 
3061 	keg = zone_first_keg(zone);
3062 	KEG_LOCK(keg);
3063 	keg->uk_allocf = allocf;
3064 	KEG_UNLOCK(keg);
3065 }
3066 
3067 /* See uma.h */
3068 void
3069 uma_zone_reserve(uma_zone_t zone, int items)
3070 {
3071 	uma_keg_t keg;
3072 
3073 	keg = zone_first_keg(zone);
3074 	if (keg == NULL)
3075 		return;
3076 	KEG_LOCK(keg);
3077 	keg->uk_reserve = items;
3078 	KEG_UNLOCK(keg);
3079 
3080 	return;
3081 }
3082 
3083 /* See uma.h */
3084 int
3085 uma_zone_reserve_kva(uma_zone_t zone, int count)
3086 {
3087 	uma_keg_t keg;
3088 	vm_offset_t kva;
3089 	u_int pages;
3090 
3091 	keg = zone_first_keg(zone);
3092 	if (keg == NULL)
3093 		return (0);
3094 	pages = count / keg->uk_ipers;
3095 
3096 	if (pages * keg->uk_ipers < count)
3097 		pages++;
3098 	pages *= keg->uk_ppera;
3099 
3100 #ifdef UMA_MD_SMALL_ALLOC
3101 	if (keg->uk_ppera > 1) {
3102 #else
3103 	if (1) {
3104 #endif
3105 		kva = kva_alloc((vm_size_t)pages * PAGE_SIZE);
3106 		if (kva == 0)
3107 			return (0);
3108 	} else
3109 		kva = 0;
3110 	KEG_LOCK(keg);
3111 	keg->uk_kva = kva;
3112 	keg->uk_offset = 0;
3113 	keg->uk_maxpages = pages;
3114 #ifdef UMA_MD_SMALL_ALLOC
3115 	keg->uk_allocf = (keg->uk_ppera > 1) ? noobj_alloc : uma_small_alloc;
3116 #else
3117 	keg->uk_allocf = noobj_alloc;
3118 #endif
3119 	keg->uk_flags |= UMA_ZONE_NOFREE;
3120 	KEG_UNLOCK(keg);
3121 
3122 	return (1);
3123 }
3124 
3125 /* See uma.h */
3126 void
3127 uma_prealloc(uma_zone_t zone, int items)
3128 {
3129 	int slabs;
3130 	uma_slab_t slab;
3131 	uma_keg_t keg;
3132 
3133 	keg = zone_first_keg(zone);
3134 	if (keg == NULL)
3135 		return;
3136 	KEG_LOCK(keg);
3137 	slabs = items / keg->uk_ipers;
3138 	if (slabs * keg->uk_ipers < items)
3139 		slabs++;
3140 	while (slabs > 0) {
3141 		slab = keg_alloc_slab(keg, zone, M_WAITOK);
3142 		if (slab == NULL)
3143 			break;
3144 		MPASS(slab->us_keg == keg);
3145 		LIST_INSERT_HEAD(&keg->uk_free_slab, slab, us_link);
3146 		slabs--;
3147 	}
3148 	KEG_UNLOCK(keg);
3149 }
3150 
3151 /* See uma.h */
3152 static void
3153 uma_reclaim_locked(bool kmem_danger)
3154 {
3155 
3156 #ifdef UMA_DEBUG
3157 	printf("UMA: vm asked us to release pages!\n");
3158 #endif
3159 	sx_assert(&uma_drain_lock, SA_XLOCKED);
3160 	bucket_enable();
3161 	zone_foreach(zone_drain);
3162 	if (vm_page_count_min() || kmem_danger) {
3163 		cache_drain_safe(NULL);
3164 		zone_foreach(zone_drain);
3165 	}
3166 	/*
3167 	 * Some slabs may have been freed but this zone will be visited early
3168 	 * we visit again so that we can free pages that are empty once other
3169 	 * zones are drained.  We have to do the same for buckets.
3170 	 */
3171 	zone_drain(slabzone);
3172 	bucket_zone_drain();
3173 }
3174 
3175 void
3176 uma_reclaim(void)
3177 {
3178 
3179 	sx_xlock(&uma_drain_lock);
3180 	uma_reclaim_locked(false);
3181 	sx_xunlock(&uma_drain_lock);
3182 }
3183 
3184 static int uma_reclaim_needed;
3185 
3186 void
3187 uma_reclaim_wakeup(void)
3188 {
3189 
3190 	uma_reclaim_needed = 1;
3191 	wakeup(&uma_reclaim_needed);
3192 }
3193 
3194 void
3195 uma_reclaim_worker(void *arg __unused)
3196 {
3197 
3198 	sx_xlock(&uma_drain_lock);
3199 	for (;;) {
3200 		sx_sleep(&uma_reclaim_needed, &uma_drain_lock, PVM,
3201 		    "umarcl", 0);
3202 		if (uma_reclaim_needed) {
3203 			uma_reclaim_needed = 0;
3204 			sx_xunlock(&uma_drain_lock);
3205 			EVENTHANDLER_INVOKE(vm_lowmem, VM_LOW_KMEM);
3206 			sx_xlock(&uma_drain_lock);
3207 			uma_reclaim_locked(true);
3208 		}
3209 	}
3210 }
3211 
3212 /* See uma.h */
3213 int
3214 uma_zone_exhausted(uma_zone_t zone)
3215 {
3216 	int full;
3217 
3218 	ZONE_LOCK(zone);
3219 	full = (zone->uz_flags & UMA_ZFLAG_FULL);
3220 	ZONE_UNLOCK(zone);
3221 	return (full);
3222 }
3223 
3224 int
3225 uma_zone_exhausted_nolock(uma_zone_t zone)
3226 {
3227 	return (zone->uz_flags & UMA_ZFLAG_FULL);
3228 }
3229 
3230 void *
3231 uma_large_malloc(vm_size_t size, int wait)
3232 {
3233 	void *mem;
3234 	uma_slab_t slab;
3235 	uint8_t flags;
3236 
3237 	slab = zone_alloc_item(slabzone, NULL, wait);
3238 	if (slab == NULL)
3239 		return (NULL);
3240 	mem = page_alloc(NULL, size, &flags, wait);
3241 	if (mem) {
3242 		vsetslab((vm_offset_t)mem, slab);
3243 		slab->us_data = mem;
3244 		slab->us_flags = flags | UMA_SLAB_MALLOC;
3245 		slab->us_size = size;
3246 	} else {
3247 		zone_free_item(slabzone, slab, NULL, SKIP_NONE);
3248 	}
3249 
3250 	return (mem);
3251 }
3252 
3253 void
3254 uma_large_free(uma_slab_t slab)
3255 {
3256 
3257 	page_free(slab->us_data, slab->us_size, slab->us_flags);
3258 	zone_free_item(slabzone, slab, NULL, SKIP_NONE);
3259 }
3260 
3261 static void
3262 uma_zero_item(void *item, uma_zone_t zone)
3263 {
3264 	int i;
3265 
3266 	if (zone->uz_flags & UMA_ZONE_PCPU) {
3267 		CPU_FOREACH(i)
3268 			bzero(zpcpu_get_cpu(item, i), zone->uz_size);
3269 	} else
3270 		bzero(item, zone->uz_size);
3271 }
3272 
3273 void
3274 uma_print_stats(void)
3275 {
3276 	zone_foreach(uma_print_zone);
3277 }
3278 
3279 static void
3280 slab_print(uma_slab_t slab)
3281 {
3282 	printf("slab: keg %p, data %p, freecount %d\n",
3283 		slab->us_keg, slab->us_data, slab->us_freecount);
3284 }
3285 
3286 static void
3287 cache_print(uma_cache_t cache)
3288 {
3289 	printf("alloc: %p(%d), free: %p(%d)\n",
3290 		cache->uc_allocbucket,
3291 		cache->uc_allocbucket?cache->uc_allocbucket->ub_cnt:0,
3292 		cache->uc_freebucket,
3293 		cache->uc_freebucket?cache->uc_freebucket->ub_cnt:0);
3294 }
3295 
3296 static void
3297 uma_print_keg(uma_keg_t keg)
3298 {
3299 	uma_slab_t slab;
3300 
3301 	printf("keg: %s(%p) size %d(%d) flags %#x ipers %d ppera %d "
3302 	    "out %d free %d limit %d\n",
3303 	    keg->uk_name, keg, keg->uk_size, keg->uk_rsize, keg->uk_flags,
3304 	    keg->uk_ipers, keg->uk_ppera,
3305 	    (keg->uk_pages / keg->uk_ppera) * keg->uk_ipers - keg->uk_free,
3306 	    keg->uk_free, (keg->uk_maxpages / keg->uk_ppera) * keg->uk_ipers);
3307 	printf("Part slabs:\n");
3308 	LIST_FOREACH(slab, &keg->uk_part_slab, us_link)
3309 		slab_print(slab);
3310 	printf("Free slabs:\n");
3311 	LIST_FOREACH(slab, &keg->uk_free_slab, us_link)
3312 		slab_print(slab);
3313 	printf("Full slabs:\n");
3314 	LIST_FOREACH(slab, &keg->uk_full_slab, us_link)
3315 		slab_print(slab);
3316 }
3317 
3318 void
3319 uma_print_zone(uma_zone_t zone)
3320 {
3321 	uma_cache_t cache;
3322 	uma_klink_t kl;
3323 	int i;
3324 
3325 	printf("zone: %s(%p) size %d flags %#x\n",
3326 	    zone->uz_name, zone, zone->uz_size, zone->uz_flags);
3327 	LIST_FOREACH(kl, &zone->uz_kegs, kl_link)
3328 		uma_print_keg(kl->kl_keg);
3329 	CPU_FOREACH(i) {
3330 		cache = &zone->uz_cpu[i];
3331 		printf("CPU %d Cache:\n", i);
3332 		cache_print(cache);
3333 	}
3334 }
3335 
3336 #ifdef DDB
3337 /*
3338  * Generate statistics across both the zone and its per-cpu cache's.  Return
3339  * desired statistics if the pointer is non-NULL for that statistic.
3340  *
3341  * Note: does not update the zone statistics, as it can't safely clear the
3342  * per-CPU cache statistic.
3343  *
3344  * XXXRW: Following the uc_allocbucket and uc_freebucket pointers here isn't
3345  * safe from off-CPU; we should modify the caches to track this information
3346  * directly so that we don't have to.
3347  */
3348 static void
3349 uma_zone_sumstat(uma_zone_t z, int *cachefreep, uint64_t *allocsp,
3350     uint64_t *freesp, uint64_t *sleepsp)
3351 {
3352 	uma_cache_t cache;
3353 	uint64_t allocs, frees, sleeps;
3354 	int cachefree, cpu;
3355 
3356 	allocs = frees = sleeps = 0;
3357 	cachefree = 0;
3358 	CPU_FOREACH(cpu) {
3359 		cache = &z->uz_cpu[cpu];
3360 		if (cache->uc_allocbucket != NULL)
3361 			cachefree += cache->uc_allocbucket->ub_cnt;
3362 		if (cache->uc_freebucket != NULL)
3363 			cachefree += cache->uc_freebucket->ub_cnt;
3364 		allocs += cache->uc_allocs;
3365 		frees += cache->uc_frees;
3366 	}
3367 	allocs += z->uz_allocs;
3368 	frees += z->uz_frees;
3369 	sleeps += z->uz_sleeps;
3370 	if (cachefreep != NULL)
3371 		*cachefreep = cachefree;
3372 	if (allocsp != NULL)
3373 		*allocsp = allocs;
3374 	if (freesp != NULL)
3375 		*freesp = frees;
3376 	if (sleepsp != NULL)
3377 		*sleepsp = sleeps;
3378 }
3379 #endif /* DDB */
3380 
3381 static int
3382 sysctl_vm_zone_count(SYSCTL_HANDLER_ARGS)
3383 {
3384 	uma_keg_t kz;
3385 	uma_zone_t z;
3386 	int count;
3387 
3388 	count = 0;
3389 	rw_rlock(&uma_rwlock);
3390 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
3391 		LIST_FOREACH(z, &kz->uk_zones, uz_link)
3392 			count++;
3393 	}
3394 	rw_runlock(&uma_rwlock);
3395 	return (sysctl_handle_int(oidp, &count, 0, req));
3396 }
3397 
3398 static int
3399 sysctl_vm_zone_stats(SYSCTL_HANDLER_ARGS)
3400 {
3401 	struct uma_stream_header ush;
3402 	struct uma_type_header uth;
3403 	struct uma_percpu_stat ups;
3404 	uma_bucket_t bucket;
3405 	struct sbuf sbuf;
3406 	uma_cache_t cache;
3407 	uma_klink_t kl;
3408 	uma_keg_t kz;
3409 	uma_zone_t z;
3410 	uma_keg_t k;
3411 	int count, error, i;
3412 
3413 	error = sysctl_wire_old_buffer(req, 0);
3414 	if (error != 0)
3415 		return (error);
3416 	sbuf_new_for_sysctl(&sbuf, NULL, 128, req);
3417 	sbuf_clear_flags(&sbuf, SBUF_INCLUDENUL);
3418 
3419 	count = 0;
3420 	rw_rlock(&uma_rwlock);
3421 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
3422 		LIST_FOREACH(z, &kz->uk_zones, uz_link)
3423 			count++;
3424 	}
3425 
3426 	/*
3427 	 * Insert stream header.
3428 	 */
3429 	bzero(&ush, sizeof(ush));
3430 	ush.ush_version = UMA_STREAM_VERSION;
3431 	ush.ush_maxcpus = (mp_maxid + 1);
3432 	ush.ush_count = count;
3433 	(void)sbuf_bcat(&sbuf, &ush, sizeof(ush));
3434 
3435 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
3436 		LIST_FOREACH(z, &kz->uk_zones, uz_link) {
3437 			bzero(&uth, sizeof(uth));
3438 			ZONE_LOCK(z);
3439 			strlcpy(uth.uth_name, z->uz_name, UTH_MAX_NAME);
3440 			uth.uth_align = kz->uk_align;
3441 			uth.uth_size = kz->uk_size;
3442 			uth.uth_rsize = kz->uk_rsize;
3443 			LIST_FOREACH(kl, &z->uz_kegs, kl_link) {
3444 				k = kl->kl_keg;
3445 				uth.uth_maxpages += k->uk_maxpages;
3446 				uth.uth_pages += k->uk_pages;
3447 				uth.uth_keg_free += k->uk_free;
3448 				uth.uth_limit = (k->uk_maxpages / k->uk_ppera)
3449 				    * k->uk_ipers;
3450 			}
3451 
3452 			/*
3453 			 * A zone is secondary is it is not the first entry
3454 			 * on the keg's zone list.
3455 			 */
3456 			if ((z->uz_flags & UMA_ZONE_SECONDARY) &&
3457 			    (LIST_FIRST(&kz->uk_zones) != z))
3458 				uth.uth_zone_flags = UTH_ZONE_SECONDARY;
3459 
3460 			LIST_FOREACH(bucket, &z->uz_buckets, ub_link)
3461 				uth.uth_zone_free += bucket->ub_cnt;
3462 			uth.uth_allocs = z->uz_allocs;
3463 			uth.uth_frees = z->uz_frees;
3464 			uth.uth_fails = z->uz_fails;
3465 			uth.uth_sleeps = z->uz_sleeps;
3466 			(void)sbuf_bcat(&sbuf, &uth, sizeof(uth));
3467 			/*
3468 			 * While it is not normally safe to access the cache
3469 			 * bucket pointers while not on the CPU that owns the
3470 			 * cache, we only allow the pointers to be exchanged
3471 			 * without the zone lock held, not invalidated, so
3472 			 * accept the possible race associated with bucket
3473 			 * exchange during monitoring.
3474 			 */
3475 			for (i = 0; i < (mp_maxid + 1); i++) {
3476 				bzero(&ups, sizeof(ups));
3477 				if (kz->uk_flags & UMA_ZFLAG_INTERNAL)
3478 					goto skip;
3479 				if (CPU_ABSENT(i))
3480 					goto skip;
3481 				cache = &z->uz_cpu[i];
3482 				if (cache->uc_allocbucket != NULL)
3483 					ups.ups_cache_free +=
3484 					    cache->uc_allocbucket->ub_cnt;
3485 				if (cache->uc_freebucket != NULL)
3486 					ups.ups_cache_free +=
3487 					    cache->uc_freebucket->ub_cnt;
3488 				ups.ups_allocs = cache->uc_allocs;
3489 				ups.ups_frees = cache->uc_frees;
3490 skip:
3491 				(void)sbuf_bcat(&sbuf, &ups, sizeof(ups));
3492 			}
3493 			ZONE_UNLOCK(z);
3494 		}
3495 	}
3496 	rw_runlock(&uma_rwlock);
3497 	error = sbuf_finish(&sbuf);
3498 	sbuf_delete(&sbuf);
3499 	return (error);
3500 }
3501 
3502 int
3503 sysctl_handle_uma_zone_max(SYSCTL_HANDLER_ARGS)
3504 {
3505 	uma_zone_t zone = *(uma_zone_t *)arg1;
3506 	int error, max;
3507 
3508 	max = uma_zone_get_max(zone);
3509 	error = sysctl_handle_int(oidp, &max, 0, req);
3510 	if (error || !req->newptr)
3511 		return (error);
3512 
3513 	uma_zone_set_max(zone, max);
3514 
3515 	return (0);
3516 }
3517 
3518 int
3519 sysctl_handle_uma_zone_cur(SYSCTL_HANDLER_ARGS)
3520 {
3521 	uma_zone_t zone = *(uma_zone_t *)arg1;
3522 	int cur;
3523 
3524 	cur = uma_zone_get_cur(zone);
3525 	return (sysctl_handle_int(oidp, &cur, 0, req));
3526 }
3527 
3528 #ifdef INVARIANTS
3529 static uma_slab_t
3530 uma_dbg_getslab(uma_zone_t zone, void *item)
3531 {
3532 	uma_slab_t slab;
3533 	uma_keg_t keg;
3534 	uint8_t *mem;
3535 
3536 	mem = (uint8_t *)((uintptr_t)item & (~UMA_SLAB_MASK));
3537 	if (zone->uz_flags & UMA_ZONE_VTOSLAB) {
3538 		slab = vtoslab((vm_offset_t)mem);
3539 	} else {
3540 		/*
3541 		 * It is safe to return the slab here even though the
3542 		 * zone is unlocked because the item's allocation state
3543 		 * essentially holds a reference.
3544 		 */
3545 		ZONE_LOCK(zone);
3546 		keg = LIST_FIRST(&zone->uz_kegs)->kl_keg;
3547 		if (keg->uk_flags & UMA_ZONE_HASH)
3548 			slab = hash_sfind(&keg->uk_hash, mem);
3549 		else
3550 			slab = (uma_slab_t)(mem + keg->uk_pgoff);
3551 		ZONE_UNLOCK(zone);
3552 	}
3553 
3554 	return (slab);
3555 }
3556 
3557 /*
3558  * Set up the slab's freei data such that uma_dbg_free can function.
3559  *
3560  */
3561 static void
3562 uma_dbg_alloc(uma_zone_t zone, uma_slab_t slab, void *item)
3563 {
3564 	uma_keg_t keg;
3565 	int freei;
3566 
3567 	if (zone_first_keg(zone) == NULL)
3568 		return;
3569 	if (slab == NULL) {
3570 		slab = uma_dbg_getslab(zone, item);
3571 		if (slab == NULL)
3572 			panic("uma: item %p did not belong to zone %s\n",
3573 			    item, zone->uz_name);
3574 	}
3575 	keg = slab->us_keg;
3576 	freei = ((uintptr_t)item - (uintptr_t)slab->us_data) / keg->uk_rsize;
3577 
3578 	if (BIT_ISSET(SLAB_SETSIZE, freei, &slab->us_debugfree))
3579 		panic("Duplicate alloc of %p from zone %p(%s) slab %p(%d)\n",
3580 		    item, zone, zone->uz_name, slab, freei);
3581 	BIT_SET_ATOMIC(SLAB_SETSIZE, freei, &slab->us_debugfree);
3582 
3583 	return;
3584 }
3585 
3586 /*
3587  * Verifies freed addresses.  Checks for alignment, valid slab membership
3588  * and duplicate frees.
3589  *
3590  */
3591 static void
3592 uma_dbg_free(uma_zone_t zone, uma_slab_t slab, void *item)
3593 {
3594 	uma_keg_t keg;
3595 	int freei;
3596 
3597 	if (zone_first_keg(zone) == NULL)
3598 		return;
3599 	if (slab == NULL) {
3600 		slab = uma_dbg_getslab(zone, item);
3601 		if (slab == NULL)
3602 			panic("uma: Freed item %p did not belong to zone %s\n",
3603 			    item, zone->uz_name);
3604 	}
3605 	keg = slab->us_keg;
3606 	freei = ((uintptr_t)item - (uintptr_t)slab->us_data) / keg->uk_rsize;
3607 
3608 	if (freei >= keg->uk_ipers)
3609 		panic("Invalid free of %p from zone %p(%s) slab %p(%d)\n",
3610 		    item, zone, zone->uz_name, slab, freei);
3611 
3612 	if (((freei * keg->uk_rsize) + slab->us_data) != item)
3613 		panic("Unaligned free of %p from zone %p(%s) slab %p(%d)\n",
3614 		    item, zone, zone->uz_name, slab, freei);
3615 
3616 	if (!BIT_ISSET(SLAB_SETSIZE, freei, &slab->us_debugfree))
3617 		panic("Duplicate free of %p from zone %p(%s) slab %p(%d)\n",
3618 		    item, zone, zone->uz_name, slab, freei);
3619 
3620 	BIT_CLR_ATOMIC(SLAB_SETSIZE, freei, &slab->us_debugfree);
3621 }
3622 #endif /* INVARIANTS */
3623 
3624 #ifdef DDB
3625 DB_SHOW_COMMAND(uma, db_show_uma)
3626 {
3627 	uint64_t allocs, frees, sleeps;
3628 	uma_bucket_t bucket;
3629 	uma_keg_t kz;
3630 	uma_zone_t z;
3631 	int cachefree;
3632 
3633 	db_printf("%18s %8s %8s %8s %12s %8s %8s\n", "Zone", "Size", "Used",
3634 	    "Free", "Requests", "Sleeps", "Bucket");
3635 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
3636 		LIST_FOREACH(z, &kz->uk_zones, uz_link) {
3637 			if (kz->uk_flags & UMA_ZFLAG_INTERNAL) {
3638 				allocs = z->uz_allocs;
3639 				frees = z->uz_frees;
3640 				sleeps = z->uz_sleeps;
3641 				cachefree = 0;
3642 			} else
3643 				uma_zone_sumstat(z, &cachefree, &allocs,
3644 				    &frees, &sleeps);
3645 			if (!((z->uz_flags & UMA_ZONE_SECONDARY) &&
3646 			    (LIST_FIRST(&kz->uk_zones) != z)))
3647 				cachefree += kz->uk_free;
3648 			LIST_FOREACH(bucket, &z->uz_buckets, ub_link)
3649 				cachefree += bucket->ub_cnt;
3650 			db_printf("%18s %8ju %8jd %8d %12ju %8ju %8u\n",
3651 			    z->uz_name, (uintmax_t)kz->uk_size,
3652 			    (intmax_t)(allocs - frees), cachefree,
3653 			    (uintmax_t)allocs, sleeps, z->uz_count);
3654 			if (db_pager_quit)
3655 				return;
3656 		}
3657 	}
3658 }
3659 
3660 DB_SHOW_COMMAND(umacache, db_show_umacache)
3661 {
3662 	uint64_t allocs, frees;
3663 	uma_bucket_t bucket;
3664 	uma_zone_t z;
3665 	int cachefree;
3666 
3667 	db_printf("%18s %8s %8s %8s %12s %8s\n", "Zone", "Size", "Used", "Free",
3668 	    "Requests", "Bucket");
3669 	LIST_FOREACH(z, &uma_cachezones, uz_link) {
3670 		uma_zone_sumstat(z, &cachefree, &allocs, &frees, NULL);
3671 		LIST_FOREACH(bucket, &z->uz_buckets, ub_link)
3672 			cachefree += bucket->ub_cnt;
3673 		db_printf("%18s %8ju %8jd %8d %12ju %8u\n",
3674 		    z->uz_name, (uintmax_t)z->uz_size,
3675 		    (intmax_t)(allocs - frees), cachefree,
3676 		    (uintmax_t)allocs, z->uz_count);
3677 		if (db_pager_quit)
3678 			return;
3679 	}
3680 }
3681 #endif	/* DDB */
3682