xref: /freebsd/sys/vm/uma_core.c (revision 7cc42f6d)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2002-2019 Jeffrey Roberson <jeff@FreeBSD.org>
5  * Copyright (c) 2004, 2005 Bosko Milekic <bmilekic@FreeBSD.org>
6  * Copyright (c) 2004-2006 Robert N. M. Watson
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice unmodified, this list of conditions, and the following
14  *    disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 /*
32  * uma_core.c  Implementation of the Universal Memory allocator
33  *
34  * This allocator is intended to replace the multitude of similar object caches
35  * in the standard FreeBSD kernel.  The intent is to be flexible as well as
36  * efficient.  A primary design goal is to return unused memory to the rest of
37  * the system.  This will make the system as a whole more flexible due to the
38  * ability to move memory to subsystems which most need it instead of leaving
39  * pools of reserved memory unused.
40  *
41  * The basic ideas stem from similar slab/zone based allocators whose algorithms
42  * are well known.
43  *
44  */
45 
46 /*
47  * TODO:
48  *	- Improve memory usage for large allocations
49  *	- Investigate cache size adjustments
50  */
51 
52 #include <sys/cdefs.h>
53 __FBSDID("$FreeBSD$");
54 
55 #include "opt_ddb.h"
56 #include "opt_param.h"
57 #include "opt_vm.h"
58 
59 #include <sys/param.h>
60 #include <sys/systm.h>
61 #include <sys/bitset.h>
62 #include <sys/domainset.h>
63 #include <sys/eventhandler.h>
64 #include <sys/kernel.h>
65 #include <sys/types.h>
66 #include <sys/limits.h>
67 #include <sys/queue.h>
68 #include <sys/malloc.h>
69 #include <sys/ktr.h>
70 #include <sys/lock.h>
71 #include <sys/sysctl.h>
72 #include <sys/mutex.h>
73 #include <sys/proc.h>
74 #include <sys/random.h>
75 #include <sys/rwlock.h>
76 #include <sys/sbuf.h>
77 #include <sys/sched.h>
78 #include <sys/sleepqueue.h>
79 #include <sys/smp.h>
80 #include <sys/smr.h>
81 #include <sys/taskqueue.h>
82 #include <sys/vmmeter.h>
83 
84 #include <vm/vm.h>
85 #include <vm/vm_domainset.h>
86 #include <vm/vm_object.h>
87 #include <vm/vm_page.h>
88 #include <vm/vm_pageout.h>
89 #include <vm/vm_param.h>
90 #include <vm/vm_phys.h>
91 #include <vm/vm_pagequeue.h>
92 #include <vm/vm_map.h>
93 #include <vm/vm_kern.h>
94 #include <vm/vm_extern.h>
95 #include <vm/uma.h>
96 #include <vm/uma_int.h>
97 #include <vm/uma_dbg.h>
98 
99 #include <ddb/ddb.h>
100 
101 #ifdef DEBUG_MEMGUARD
102 #include <vm/memguard.h>
103 #endif
104 
105 #include <machine/md_var.h>
106 
107 #ifdef INVARIANTS
108 #define	UMA_ALWAYS_CTORDTOR	1
109 #else
110 #define	UMA_ALWAYS_CTORDTOR	0
111 #endif
112 
113 /*
114  * This is the zone and keg from which all zones are spawned.
115  */
116 static uma_zone_t kegs;
117 static uma_zone_t zones;
118 
119 /*
120  * On INVARIANTS builds, the slab contains a second bitset of the same size,
121  * "dbg_bits", which is laid out immediately after us_free.
122  */
123 #ifdef INVARIANTS
124 #define	SLAB_BITSETS	2
125 #else
126 #define	SLAB_BITSETS	1
127 #endif
128 
129 /*
130  * These are the two zones from which all offpage uma_slab_ts are allocated.
131  *
132  * One zone is for slab headers that can represent a larger number of items,
133  * making the slabs themselves more efficient, and the other zone is for
134  * headers that are smaller and represent fewer items, making the headers more
135  * efficient.
136  */
137 #define	SLABZONE_SIZE(setsize)					\
138     (sizeof(struct uma_hash_slab) + BITSET_SIZE(setsize) * SLAB_BITSETS)
139 #define	SLABZONE0_SETSIZE	(PAGE_SIZE / 16)
140 #define	SLABZONE1_SETSIZE	SLAB_MAX_SETSIZE
141 #define	SLABZONE0_SIZE	SLABZONE_SIZE(SLABZONE0_SETSIZE)
142 #define	SLABZONE1_SIZE	SLABZONE_SIZE(SLABZONE1_SETSIZE)
143 static uma_zone_t slabzones[2];
144 
145 /*
146  * The initial hash tables come out of this zone so they can be allocated
147  * prior to malloc coming up.
148  */
149 static uma_zone_t hashzone;
150 
151 /* The boot-time adjusted value for cache line alignment. */
152 int uma_align_cache = 64 - 1;
153 
154 static MALLOC_DEFINE(M_UMAHASH, "UMAHash", "UMA Hash Buckets");
155 static MALLOC_DEFINE(M_UMA, "UMA", "UMA Misc");
156 
157 /*
158  * Are we allowed to allocate buckets?
159  */
160 static int bucketdisable = 1;
161 
162 /* Linked list of all kegs in the system */
163 static LIST_HEAD(,uma_keg) uma_kegs = LIST_HEAD_INITIALIZER(uma_kegs);
164 
165 /* Linked list of all cache-only zones in the system */
166 static LIST_HEAD(,uma_zone) uma_cachezones =
167     LIST_HEAD_INITIALIZER(uma_cachezones);
168 
169 /* This RW lock protects the keg list */
170 static struct rwlock_padalign __exclusive_cache_line uma_rwlock;
171 
172 /*
173  * First available virual address for boot time allocations.
174  */
175 static vm_offset_t bootstart;
176 static vm_offset_t bootmem;
177 
178 static struct sx uma_reclaim_lock;
179 
180 /*
181  * kmem soft limit, initialized by uma_set_limit().  Ensure that early
182  * allocations don't trigger a wakeup of the reclaim thread.
183  */
184 unsigned long uma_kmem_limit = LONG_MAX;
185 SYSCTL_ULONG(_vm, OID_AUTO, uma_kmem_limit, CTLFLAG_RD, &uma_kmem_limit, 0,
186     "UMA kernel memory soft limit");
187 unsigned long uma_kmem_total;
188 SYSCTL_ULONG(_vm, OID_AUTO, uma_kmem_total, CTLFLAG_RD, &uma_kmem_total, 0,
189     "UMA kernel memory usage");
190 
191 /* Is the VM done starting up? */
192 static enum {
193 	BOOT_COLD,
194 	BOOT_KVA,
195 	BOOT_PCPU,
196 	BOOT_RUNNING,
197 	BOOT_SHUTDOWN,
198 } booted = BOOT_COLD;
199 
200 /*
201  * This is the handle used to schedule events that need to happen
202  * outside of the allocation fast path.
203  */
204 static struct callout uma_callout;
205 #define	UMA_TIMEOUT	20		/* Seconds for callout interval. */
206 
207 /*
208  * This structure is passed as the zone ctor arg so that I don't have to create
209  * a special allocation function just for zones.
210  */
211 struct uma_zctor_args {
212 	const char *name;
213 	size_t size;
214 	uma_ctor ctor;
215 	uma_dtor dtor;
216 	uma_init uminit;
217 	uma_fini fini;
218 	uma_import import;
219 	uma_release release;
220 	void *arg;
221 	uma_keg_t keg;
222 	int align;
223 	uint32_t flags;
224 };
225 
226 struct uma_kctor_args {
227 	uma_zone_t zone;
228 	size_t size;
229 	uma_init uminit;
230 	uma_fini fini;
231 	int align;
232 	uint32_t flags;
233 };
234 
235 struct uma_bucket_zone {
236 	uma_zone_t	ubz_zone;
237 	const char	*ubz_name;
238 	int		ubz_entries;	/* Number of items it can hold. */
239 	int		ubz_maxsize;	/* Maximum allocation size per-item. */
240 };
241 
242 /*
243  * Compute the actual number of bucket entries to pack them in power
244  * of two sizes for more efficient space utilization.
245  */
246 #define	BUCKET_SIZE(n)						\
247     (((sizeof(void *) * (n)) - sizeof(struct uma_bucket)) / sizeof(void *))
248 
249 #define	BUCKET_MAX	BUCKET_SIZE(256)
250 #define	BUCKET_MIN	2
251 
252 struct uma_bucket_zone bucket_zones[] = {
253 	/* Literal bucket sizes. */
254 	{ NULL, "2 Bucket", 2, 4096 },
255 	{ NULL, "4 Bucket", 4, 3072 },
256 	{ NULL, "8 Bucket", 8, 2048 },
257 	{ NULL, "16 Bucket", 16, 1024 },
258 	/* Rounded down power of 2 sizes for efficiency. */
259 	{ NULL, "32 Bucket", BUCKET_SIZE(32), 512 },
260 	{ NULL, "64 Bucket", BUCKET_SIZE(64), 256 },
261 	{ NULL, "128 Bucket", BUCKET_SIZE(128), 128 },
262 	{ NULL, "256 Bucket", BUCKET_SIZE(256), 64 },
263 	{ NULL, NULL, 0}
264 };
265 
266 /*
267  * Flags and enumerations to be passed to internal functions.
268  */
269 enum zfreeskip {
270 	SKIP_NONE =	0,
271 	SKIP_CNT =	0x00000001,
272 	SKIP_DTOR =	0x00010000,
273 	SKIP_FINI =	0x00020000,
274 };
275 
276 /* Prototypes.. */
277 
278 void	uma_startup1(vm_offset_t);
279 void	uma_startup2(void);
280 
281 static void *noobj_alloc(uma_zone_t, vm_size_t, int, uint8_t *, int);
282 static void *page_alloc(uma_zone_t, vm_size_t, int, uint8_t *, int);
283 static void *pcpu_page_alloc(uma_zone_t, vm_size_t, int, uint8_t *, int);
284 static void *startup_alloc(uma_zone_t, vm_size_t, int, uint8_t *, int);
285 static void *contig_alloc(uma_zone_t, vm_size_t, int, uint8_t *, int);
286 static void page_free(void *, vm_size_t, uint8_t);
287 static void pcpu_page_free(void *, vm_size_t, uint8_t);
288 static uma_slab_t keg_alloc_slab(uma_keg_t, uma_zone_t, int, int, int);
289 static void cache_drain(uma_zone_t);
290 static void bucket_drain(uma_zone_t, uma_bucket_t);
291 static void bucket_cache_reclaim(uma_zone_t zone, bool);
292 static int keg_ctor(void *, int, void *, int);
293 static void keg_dtor(void *, int, void *);
294 static int zone_ctor(void *, int, void *, int);
295 static void zone_dtor(void *, int, void *);
296 static inline void item_dtor(uma_zone_t zone, void *item, int size,
297     void *udata, enum zfreeskip skip);
298 static int zero_init(void *, int, int);
299 static void zone_free_bucket(uma_zone_t zone, uma_bucket_t bucket, void *udata,
300     int itemdomain, bool ws);
301 static void zone_foreach(void (*zfunc)(uma_zone_t, void *), void *);
302 static void zone_foreach_unlocked(void (*zfunc)(uma_zone_t, void *), void *);
303 static void zone_timeout(uma_zone_t zone, void *);
304 static int hash_alloc(struct uma_hash *, u_int);
305 static int hash_expand(struct uma_hash *, struct uma_hash *);
306 static void hash_free(struct uma_hash *hash);
307 static void uma_timeout(void *);
308 static void uma_shutdown(void);
309 static void *zone_alloc_item(uma_zone_t, void *, int, int);
310 static void zone_free_item(uma_zone_t, void *, void *, enum zfreeskip);
311 static int zone_alloc_limit(uma_zone_t zone, int count, int flags);
312 static void zone_free_limit(uma_zone_t zone, int count);
313 static void bucket_enable(void);
314 static void bucket_init(void);
315 static uma_bucket_t bucket_alloc(uma_zone_t zone, void *, int);
316 static void bucket_free(uma_zone_t zone, uma_bucket_t, void *);
317 static void bucket_zone_drain(void);
318 static uma_bucket_t zone_alloc_bucket(uma_zone_t, void *, int, int);
319 static void *slab_alloc_item(uma_keg_t keg, uma_slab_t slab);
320 static void slab_free_item(uma_zone_t zone, uma_slab_t slab, void *item);
321 static uma_keg_t uma_kcreate(uma_zone_t zone, size_t size, uma_init uminit,
322     uma_fini fini, int align, uint32_t flags);
323 static int zone_import(void *, void **, int, int, int);
324 static void zone_release(void *, void **, int);
325 static bool cache_alloc(uma_zone_t, uma_cache_t, void *, int);
326 static bool cache_free(uma_zone_t, uma_cache_t, void *, void *, int);
327 
328 static int sysctl_vm_zone_count(SYSCTL_HANDLER_ARGS);
329 static int sysctl_vm_zone_stats(SYSCTL_HANDLER_ARGS);
330 static int sysctl_handle_uma_zone_allocs(SYSCTL_HANDLER_ARGS);
331 static int sysctl_handle_uma_zone_frees(SYSCTL_HANDLER_ARGS);
332 static int sysctl_handle_uma_zone_flags(SYSCTL_HANDLER_ARGS);
333 static int sysctl_handle_uma_slab_efficiency(SYSCTL_HANDLER_ARGS);
334 static int sysctl_handle_uma_zone_items(SYSCTL_HANDLER_ARGS);
335 
336 static uint64_t uma_zone_get_allocs(uma_zone_t zone);
337 
338 static SYSCTL_NODE(_vm, OID_AUTO, debug, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
339     "Memory allocation debugging");
340 
341 #ifdef INVARIANTS
342 static uint64_t uma_keg_get_allocs(uma_keg_t zone);
343 static inline struct noslabbits *slab_dbg_bits(uma_slab_t slab, uma_keg_t keg);
344 
345 static bool uma_dbg_kskip(uma_keg_t keg, void *mem);
346 static bool uma_dbg_zskip(uma_zone_t zone, void *mem);
347 static void uma_dbg_free(uma_zone_t zone, uma_slab_t slab, void *item);
348 static void uma_dbg_alloc(uma_zone_t zone, uma_slab_t slab, void *item);
349 
350 static u_int dbg_divisor = 1;
351 SYSCTL_UINT(_vm_debug, OID_AUTO, divisor,
352     CTLFLAG_RDTUN | CTLFLAG_NOFETCH, &dbg_divisor, 0,
353     "Debug & thrash every this item in memory allocator");
354 
355 static counter_u64_t uma_dbg_cnt = EARLY_COUNTER;
356 static counter_u64_t uma_skip_cnt = EARLY_COUNTER;
357 SYSCTL_COUNTER_U64(_vm_debug, OID_AUTO, trashed, CTLFLAG_RD,
358     &uma_dbg_cnt, "memory items debugged");
359 SYSCTL_COUNTER_U64(_vm_debug, OID_AUTO, skipped, CTLFLAG_RD,
360     &uma_skip_cnt, "memory items skipped, not debugged");
361 #endif
362 
363 SYSCTL_NODE(_vm, OID_AUTO, uma, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
364     "Universal Memory Allocator");
365 
366 SYSCTL_PROC(_vm, OID_AUTO, zone_count, CTLFLAG_RD|CTLFLAG_MPSAFE|CTLTYPE_INT,
367     0, 0, sysctl_vm_zone_count, "I", "Number of UMA zones");
368 
369 SYSCTL_PROC(_vm, OID_AUTO, zone_stats, CTLFLAG_RD|CTLFLAG_MPSAFE|CTLTYPE_STRUCT,
370     0, 0, sysctl_vm_zone_stats, "s,struct uma_type_header", "Zone Stats");
371 
372 static int zone_warnings = 1;
373 SYSCTL_INT(_vm, OID_AUTO, zone_warnings, CTLFLAG_RWTUN, &zone_warnings, 0,
374     "Warn when UMA zones becomes full");
375 
376 static int multipage_slabs = 1;
377 TUNABLE_INT("vm.debug.uma_multipage_slabs", &multipage_slabs);
378 SYSCTL_INT(_vm_debug, OID_AUTO, uma_multipage_slabs,
379     CTLFLAG_RDTUN | CTLFLAG_NOFETCH, &multipage_slabs, 0,
380     "UMA may choose larger slab sizes for better efficiency");
381 
382 /*
383  * Select the slab zone for an offpage slab with the given maximum item count.
384  */
385 static inline uma_zone_t
386 slabzone(int ipers)
387 {
388 
389 	return (slabzones[ipers > SLABZONE0_SETSIZE]);
390 }
391 
392 /*
393  * This routine checks to see whether or not it's safe to enable buckets.
394  */
395 static void
396 bucket_enable(void)
397 {
398 
399 	KASSERT(booted >= BOOT_KVA, ("Bucket enable before init"));
400 	bucketdisable = vm_page_count_min();
401 }
402 
403 /*
404  * Initialize bucket_zones, the array of zones of buckets of various sizes.
405  *
406  * For each zone, calculate the memory required for each bucket, consisting
407  * of the header and an array of pointers.
408  */
409 static void
410 bucket_init(void)
411 {
412 	struct uma_bucket_zone *ubz;
413 	int size;
414 
415 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++) {
416 		size = roundup(sizeof(struct uma_bucket), sizeof(void *));
417 		size += sizeof(void *) * ubz->ubz_entries;
418 		ubz->ubz_zone = uma_zcreate(ubz->ubz_name, size,
419 		    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
420 		    UMA_ZONE_MTXCLASS | UMA_ZFLAG_BUCKET |
421 		    UMA_ZONE_FIRSTTOUCH);
422 	}
423 }
424 
425 /*
426  * Given a desired number of entries for a bucket, return the zone from which
427  * to allocate the bucket.
428  */
429 static struct uma_bucket_zone *
430 bucket_zone_lookup(int entries)
431 {
432 	struct uma_bucket_zone *ubz;
433 
434 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++)
435 		if (ubz->ubz_entries >= entries)
436 			return (ubz);
437 	ubz--;
438 	return (ubz);
439 }
440 
441 static struct uma_bucket_zone *
442 bucket_zone_max(uma_zone_t zone, int nitems)
443 {
444 	struct uma_bucket_zone *ubz;
445 	int bpcpu;
446 
447 	bpcpu = 2;
448 	if ((zone->uz_flags & UMA_ZONE_FIRSTTOUCH) != 0)
449 		/* Count the cross-domain bucket. */
450 		bpcpu++;
451 
452 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++)
453 		if (ubz->ubz_entries * bpcpu * mp_ncpus > nitems)
454 			break;
455 	if (ubz == &bucket_zones[0])
456 		ubz = NULL;
457 	else
458 		ubz--;
459 	return (ubz);
460 }
461 
462 static int
463 bucket_select(int size)
464 {
465 	struct uma_bucket_zone *ubz;
466 
467 	ubz = &bucket_zones[0];
468 	if (size > ubz->ubz_maxsize)
469 		return MAX((ubz->ubz_maxsize * ubz->ubz_entries) / size, 1);
470 
471 	for (; ubz->ubz_entries != 0; ubz++)
472 		if (ubz->ubz_maxsize < size)
473 			break;
474 	ubz--;
475 	return (ubz->ubz_entries);
476 }
477 
478 static uma_bucket_t
479 bucket_alloc(uma_zone_t zone, void *udata, int flags)
480 {
481 	struct uma_bucket_zone *ubz;
482 	uma_bucket_t bucket;
483 
484 	/*
485 	 * Don't allocate buckets early in boot.
486 	 */
487 	if (__predict_false(booted < BOOT_KVA))
488 		return (NULL);
489 
490 	/*
491 	 * To limit bucket recursion we store the original zone flags
492 	 * in a cookie passed via zalloc_arg/zfree_arg.  This allows the
493 	 * NOVM flag to persist even through deep recursions.  We also
494 	 * store ZFLAG_BUCKET once we have recursed attempting to allocate
495 	 * a bucket for a bucket zone so we do not allow infinite bucket
496 	 * recursion.  This cookie will even persist to frees of unused
497 	 * buckets via the allocation path or bucket allocations in the
498 	 * free path.
499 	 */
500 	if ((zone->uz_flags & UMA_ZFLAG_BUCKET) == 0)
501 		udata = (void *)(uintptr_t)zone->uz_flags;
502 	else {
503 		if ((uintptr_t)udata & UMA_ZFLAG_BUCKET)
504 			return (NULL);
505 		udata = (void *)((uintptr_t)udata | UMA_ZFLAG_BUCKET);
506 	}
507 	if (((uintptr_t)udata & UMA_ZONE_VM) != 0)
508 		flags |= M_NOVM;
509 	ubz = bucket_zone_lookup(zone->uz_bucket_size);
510 	if (ubz->ubz_zone == zone && (ubz + 1)->ubz_entries != 0)
511 		ubz++;
512 	bucket = uma_zalloc_arg(ubz->ubz_zone, udata, flags);
513 	if (bucket) {
514 #ifdef INVARIANTS
515 		bzero(bucket->ub_bucket, sizeof(void *) * ubz->ubz_entries);
516 #endif
517 		bucket->ub_cnt = 0;
518 		bucket->ub_entries = ubz->ubz_entries;
519 		bucket->ub_seq = SMR_SEQ_INVALID;
520 		CTR3(KTR_UMA, "bucket_alloc: zone %s(%p) allocated bucket %p",
521 		    zone->uz_name, zone, bucket);
522 	}
523 
524 	return (bucket);
525 }
526 
527 static void
528 bucket_free(uma_zone_t zone, uma_bucket_t bucket, void *udata)
529 {
530 	struct uma_bucket_zone *ubz;
531 
532 	if (bucket->ub_cnt != 0)
533 		bucket_drain(zone, bucket);
534 
535 	KASSERT(bucket->ub_cnt == 0,
536 	    ("bucket_free: Freeing a non free bucket."));
537 	KASSERT(bucket->ub_seq == SMR_SEQ_INVALID,
538 	    ("bucket_free: Freeing an SMR bucket."));
539 	if ((zone->uz_flags & UMA_ZFLAG_BUCKET) == 0)
540 		udata = (void *)(uintptr_t)zone->uz_flags;
541 	ubz = bucket_zone_lookup(bucket->ub_entries);
542 	uma_zfree_arg(ubz->ubz_zone, bucket, udata);
543 }
544 
545 static void
546 bucket_zone_drain(void)
547 {
548 	struct uma_bucket_zone *ubz;
549 
550 	for (ubz = &bucket_zones[0]; ubz->ubz_entries != 0; ubz++)
551 		uma_zone_reclaim(ubz->ubz_zone, UMA_RECLAIM_DRAIN);
552 }
553 
554 /*
555  * Acquire the domain lock and record contention.
556  */
557 static uma_zone_domain_t
558 zone_domain_lock(uma_zone_t zone, int domain)
559 {
560 	uma_zone_domain_t zdom;
561 	bool lockfail;
562 
563 	zdom = ZDOM_GET(zone, domain);
564 	lockfail = false;
565 	if (ZDOM_OWNED(zdom))
566 		lockfail = true;
567 	ZDOM_LOCK(zdom);
568 	/* This is unsynchronized.  The counter does not need to be precise. */
569 	if (lockfail && zone->uz_bucket_size < zone->uz_bucket_size_max)
570 		zone->uz_bucket_size++;
571 	return (zdom);
572 }
573 
574 /*
575  * Search for the domain with the least cached items and return it if it
576  * is out of balance with the preferred domain.
577  */
578 static __noinline int
579 zone_domain_lowest(uma_zone_t zone, int pref)
580 {
581 	long least, nitems, prefitems;
582 	int domain;
583 	int i;
584 
585 	prefitems = least = LONG_MAX;
586 	domain = 0;
587 	for (i = 0; i < vm_ndomains; i++) {
588 		nitems = ZDOM_GET(zone, i)->uzd_nitems;
589 		if (nitems < least) {
590 			domain = i;
591 			least = nitems;
592 		}
593 		if (domain == pref)
594 			prefitems = nitems;
595 	}
596 	if (prefitems < least * 2)
597 		return (pref);
598 
599 	return (domain);
600 }
601 
602 /*
603  * Search for the domain with the most cached items and return it or the
604  * preferred domain if it has enough to proceed.
605  */
606 static __noinline int
607 zone_domain_highest(uma_zone_t zone, int pref)
608 {
609 	long most, nitems;
610 	int domain;
611 	int i;
612 
613 	if (ZDOM_GET(zone, pref)->uzd_nitems > BUCKET_MAX)
614 		return (pref);
615 
616 	most = 0;
617 	domain = 0;
618 	for (i = 0; i < vm_ndomains; i++) {
619 		nitems = ZDOM_GET(zone, i)->uzd_nitems;
620 		if (nitems > most) {
621 			domain = i;
622 			most = nitems;
623 		}
624 	}
625 
626 	return (domain);
627 }
628 
629 /*
630  * Safely subtract cnt from imax.
631  */
632 static void
633 zone_domain_imax_sub(uma_zone_domain_t zdom, int cnt)
634 {
635 	long new;
636 	long old;
637 
638 	old = zdom->uzd_imax;
639 	do {
640 		if (old <= cnt)
641 			new = 0;
642 		else
643 			new = old - cnt;
644 	} while (atomic_fcmpset_long(&zdom->uzd_imax, &old, new) == 0);
645 }
646 
647 /*
648  * Set the maximum imax value.
649  */
650 static void
651 zone_domain_imax_set(uma_zone_domain_t zdom, int nitems)
652 {
653 	long old;
654 
655 	old = zdom->uzd_imax;
656 	do {
657 		if (old >= nitems)
658 			break;
659 	} while (atomic_fcmpset_long(&zdom->uzd_imax, &old, nitems) == 0);
660 }
661 
662 /*
663  * Attempt to satisfy an allocation by retrieving a full bucket from one of the
664  * zone's caches.  If a bucket is found the zone is not locked on return.
665  */
666 static uma_bucket_t
667 zone_fetch_bucket(uma_zone_t zone, uma_zone_domain_t zdom, bool reclaim)
668 {
669 	uma_bucket_t bucket;
670 	int i;
671 	bool dtor = false;
672 
673 	ZDOM_LOCK_ASSERT(zdom);
674 
675 	if ((bucket = STAILQ_FIRST(&zdom->uzd_buckets)) == NULL)
676 		return (NULL);
677 
678 	/* SMR Buckets can not be re-used until readers expire. */
679 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0 &&
680 	    bucket->ub_seq != SMR_SEQ_INVALID) {
681 		if (!smr_poll(zone->uz_smr, bucket->ub_seq, false))
682 			return (NULL);
683 		bucket->ub_seq = SMR_SEQ_INVALID;
684 		dtor = (zone->uz_dtor != NULL) || UMA_ALWAYS_CTORDTOR;
685 		if (STAILQ_NEXT(bucket, ub_link) != NULL)
686 			zdom->uzd_seq = STAILQ_NEXT(bucket, ub_link)->ub_seq;
687 	}
688 	MPASS(zdom->uzd_nitems >= bucket->ub_cnt);
689 	STAILQ_REMOVE_HEAD(&zdom->uzd_buckets, ub_link);
690 	zdom->uzd_nitems -= bucket->ub_cnt;
691 
692 	/*
693 	 * Shift the bounds of the current WSS interval to avoid
694 	 * perturbing the estimate.
695 	 */
696 	if (reclaim) {
697 		zdom->uzd_imin -= lmin(zdom->uzd_imin, bucket->ub_cnt);
698 		zone_domain_imax_sub(zdom, bucket->ub_cnt);
699 	} else if (zdom->uzd_imin > zdom->uzd_nitems)
700 		zdom->uzd_imin = zdom->uzd_nitems;
701 
702 	ZDOM_UNLOCK(zdom);
703 	if (dtor)
704 		for (i = 0; i < bucket->ub_cnt; i++)
705 			item_dtor(zone, bucket->ub_bucket[i], zone->uz_size,
706 			    NULL, SKIP_NONE);
707 
708 	return (bucket);
709 }
710 
711 /*
712  * Insert a full bucket into the specified cache.  The "ws" parameter indicates
713  * whether the bucket's contents should be counted as part of the zone's working
714  * set.  The bucket may be freed if it exceeds the bucket limit.
715  */
716 static void
717 zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata,
718     const bool ws)
719 {
720 	uma_zone_domain_t zdom;
721 
722 	/* We don't cache empty buckets.  This can happen after a reclaim. */
723 	if (bucket->ub_cnt == 0)
724 		goto out;
725 	zdom = zone_domain_lock(zone, domain);
726 
727 	/*
728 	 * Conditionally set the maximum number of items.
729 	 */
730 	zdom->uzd_nitems += bucket->ub_cnt;
731 	if (__predict_true(zdom->uzd_nitems < zone->uz_bucket_max)) {
732 		if (ws)
733 			zone_domain_imax_set(zdom, zdom->uzd_nitems);
734 		if (STAILQ_EMPTY(&zdom->uzd_buckets))
735 			zdom->uzd_seq = bucket->ub_seq;
736 		STAILQ_INSERT_TAIL(&zdom->uzd_buckets, bucket, ub_link);
737 		ZDOM_UNLOCK(zdom);
738 		return;
739 	}
740 	zdom->uzd_nitems -= bucket->ub_cnt;
741 	ZDOM_UNLOCK(zdom);
742 out:
743 	bucket_free(zone, bucket, udata);
744 }
745 
746 /* Pops an item out of a per-cpu cache bucket. */
747 static inline void *
748 cache_bucket_pop(uma_cache_t cache, uma_cache_bucket_t bucket)
749 {
750 	void *item;
751 
752 	CRITICAL_ASSERT(curthread);
753 
754 	bucket->ucb_cnt--;
755 	item = bucket->ucb_bucket->ub_bucket[bucket->ucb_cnt];
756 #ifdef INVARIANTS
757 	bucket->ucb_bucket->ub_bucket[bucket->ucb_cnt] = NULL;
758 	KASSERT(item != NULL, ("uma_zalloc: Bucket pointer mangled."));
759 #endif
760 	cache->uc_allocs++;
761 
762 	return (item);
763 }
764 
765 /* Pushes an item into a per-cpu cache bucket. */
766 static inline void
767 cache_bucket_push(uma_cache_t cache, uma_cache_bucket_t bucket, void *item)
768 {
769 
770 	CRITICAL_ASSERT(curthread);
771 	KASSERT(bucket->ucb_bucket->ub_bucket[bucket->ucb_cnt] == NULL,
772 	    ("uma_zfree: Freeing to non free bucket index."));
773 
774 	bucket->ucb_bucket->ub_bucket[bucket->ucb_cnt] = item;
775 	bucket->ucb_cnt++;
776 	cache->uc_frees++;
777 }
778 
779 /*
780  * Unload a UMA bucket from a per-cpu cache.
781  */
782 static inline uma_bucket_t
783 cache_bucket_unload(uma_cache_bucket_t bucket)
784 {
785 	uma_bucket_t b;
786 
787 	b = bucket->ucb_bucket;
788 	if (b != NULL) {
789 		MPASS(b->ub_entries == bucket->ucb_entries);
790 		b->ub_cnt = bucket->ucb_cnt;
791 		bucket->ucb_bucket = NULL;
792 		bucket->ucb_entries = bucket->ucb_cnt = 0;
793 	}
794 
795 	return (b);
796 }
797 
798 static inline uma_bucket_t
799 cache_bucket_unload_alloc(uma_cache_t cache)
800 {
801 
802 	return (cache_bucket_unload(&cache->uc_allocbucket));
803 }
804 
805 static inline uma_bucket_t
806 cache_bucket_unload_free(uma_cache_t cache)
807 {
808 
809 	return (cache_bucket_unload(&cache->uc_freebucket));
810 }
811 
812 static inline uma_bucket_t
813 cache_bucket_unload_cross(uma_cache_t cache)
814 {
815 
816 	return (cache_bucket_unload(&cache->uc_crossbucket));
817 }
818 
819 /*
820  * Load a bucket into a per-cpu cache bucket.
821  */
822 static inline void
823 cache_bucket_load(uma_cache_bucket_t bucket, uma_bucket_t b)
824 {
825 
826 	CRITICAL_ASSERT(curthread);
827 	MPASS(bucket->ucb_bucket == NULL);
828 	MPASS(b->ub_seq == SMR_SEQ_INVALID);
829 
830 	bucket->ucb_bucket = b;
831 	bucket->ucb_cnt = b->ub_cnt;
832 	bucket->ucb_entries = b->ub_entries;
833 }
834 
835 static inline void
836 cache_bucket_load_alloc(uma_cache_t cache, uma_bucket_t b)
837 {
838 
839 	cache_bucket_load(&cache->uc_allocbucket, b);
840 }
841 
842 static inline void
843 cache_bucket_load_free(uma_cache_t cache, uma_bucket_t b)
844 {
845 
846 	cache_bucket_load(&cache->uc_freebucket, b);
847 }
848 
849 #ifdef NUMA
850 static inline void
851 cache_bucket_load_cross(uma_cache_t cache, uma_bucket_t b)
852 {
853 
854 	cache_bucket_load(&cache->uc_crossbucket, b);
855 }
856 #endif
857 
858 /*
859  * Copy and preserve ucb_spare.
860  */
861 static inline void
862 cache_bucket_copy(uma_cache_bucket_t b1, uma_cache_bucket_t b2)
863 {
864 
865 	b1->ucb_bucket = b2->ucb_bucket;
866 	b1->ucb_entries = b2->ucb_entries;
867 	b1->ucb_cnt = b2->ucb_cnt;
868 }
869 
870 /*
871  * Swap two cache buckets.
872  */
873 static inline void
874 cache_bucket_swap(uma_cache_bucket_t b1, uma_cache_bucket_t b2)
875 {
876 	struct uma_cache_bucket b3;
877 
878 	CRITICAL_ASSERT(curthread);
879 
880 	cache_bucket_copy(&b3, b1);
881 	cache_bucket_copy(b1, b2);
882 	cache_bucket_copy(b2, &b3);
883 }
884 
885 /*
886  * Attempt to fetch a bucket from a zone on behalf of the current cpu cache.
887  */
888 static uma_bucket_t
889 cache_fetch_bucket(uma_zone_t zone, uma_cache_t cache, int domain)
890 {
891 	uma_zone_domain_t zdom;
892 	uma_bucket_t bucket;
893 
894 	/*
895 	 * Avoid the lock if possible.
896 	 */
897 	zdom = ZDOM_GET(zone, domain);
898 	if (zdom->uzd_nitems == 0)
899 		return (NULL);
900 
901 	if ((cache_uz_flags(cache) & UMA_ZONE_SMR) != 0 &&
902 	    !smr_poll(zone->uz_smr, zdom->uzd_seq, false))
903 		return (NULL);
904 
905 	/*
906 	 * Check the zone's cache of buckets.
907 	 */
908 	zdom = zone_domain_lock(zone, domain);
909 	if ((bucket = zone_fetch_bucket(zone, zdom, false)) != NULL) {
910 		KASSERT(bucket->ub_cnt != 0,
911 		    ("cache_fetch_bucket: Returning an empty bucket."));
912 		return (bucket);
913 	}
914 	ZDOM_UNLOCK(zdom);
915 
916 	return (NULL);
917 }
918 
919 static void
920 zone_log_warning(uma_zone_t zone)
921 {
922 	static const struct timeval warninterval = { 300, 0 };
923 
924 	if (!zone_warnings || zone->uz_warning == NULL)
925 		return;
926 
927 	if (ratecheck(&zone->uz_ratecheck, &warninterval))
928 		printf("[zone: %s] %s\n", zone->uz_name, zone->uz_warning);
929 }
930 
931 static inline void
932 zone_maxaction(uma_zone_t zone)
933 {
934 
935 	if (zone->uz_maxaction.ta_func != NULL)
936 		taskqueue_enqueue(taskqueue_thread, &zone->uz_maxaction);
937 }
938 
939 /*
940  * Routine called by timeout which is used to fire off some time interval
941  * based calculations.  (stats, hash size, etc.)
942  *
943  * Arguments:
944  *	arg   Unused
945  *
946  * Returns:
947  *	Nothing
948  */
949 static void
950 uma_timeout(void *unused)
951 {
952 	bucket_enable();
953 	zone_foreach(zone_timeout, NULL);
954 
955 	/* Reschedule this event */
956 	callout_reset(&uma_callout, UMA_TIMEOUT * hz, uma_timeout, NULL);
957 }
958 
959 /*
960  * Update the working set size estimate for the zone's bucket cache.
961  * The constants chosen here are somewhat arbitrary.  With an update period of
962  * 20s (UMA_TIMEOUT), this estimate is dominated by zone activity over the
963  * last 100s.
964  */
965 static void
966 zone_domain_update_wss(uma_zone_domain_t zdom)
967 {
968 	long wss;
969 
970 	ZDOM_LOCK(zdom);
971 	MPASS(zdom->uzd_imax >= zdom->uzd_imin);
972 	wss = zdom->uzd_imax - zdom->uzd_imin;
973 	zdom->uzd_imax = zdom->uzd_imin = zdom->uzd_nitems;
974 	zdom->uzd_wss = (4 * wss + zdom->uzd_wss) / 5;
975 	ZDOM_UNLOCK(zdom);
976 }
977 
978 /*
979  * Routine to perform timeout driven calculations.  This expands the
980  * hashes and does per cpu statistics aggregation.
981  *
982  *  Returns nothing.
983  */
984 static void
985 zone_timeout(uma_zone_t zone, void *unused)
986 {
987 	uma_keg_t keg;
988 	u_int slabs, pages;
989 
990 	if ((zone->uz_flags & UMA_ZFLAG_HASH) == 0)
991 		goto update_wss;
992 
993 	keg = zone->uz_keg;
994 
995 	/*
996 	 * Hash zones are non-numa by definition so the first domain
997 	 * is the only one present.
998 	 */
999 	KEG_LOCK(keg, 0);
1000 	pages = keg->uk_domain[0].ud_pages;
1001 
1002 	/*
1003 	 * Expand the keg hash table.
1004 	 *
1005 	 * This is done if the number of slabs is larger than the hash size.
1006 	 * What I'm trying to do here is completely reduce collisions.  This
1007 	 * may be a little aggressive.  Should I allow for two collisions max?
1008 	 */
1009 	if ((slabs = pages / keg->uk_ppera) > keg->uk_hash.uh_hashsize) {
1010 		struct uma_hash newhash;
1011 		struct uma_hash oldhash;
1012 		int ret;
1013 
1014 		/*
1015 		 * This is so involved because allocating and freeing
1016 		 * while the keg lock is held will lead to deadlock.
1017 		 * I have to do everything in stages and check for
1018 		 * races.
1019 		 */
1020 		KEG_UNLOCK(keg, 0);
1021 		ret = hash_alloc(&newhash, 1 << fls(slabs));
1022 		KEG_LOCK(keg, 0);
1023 		if (ret) {
1024 			if (hash_expand(&keg->uk_hash, &newhash)) {
1025 				oldhash = keg->uk_hash;
1026 				keg->uk_hash = newhash;
1027 			} else
1028 				oldhash = newhash;
1029 
1030 			KEG_UNLOCK(keg, 0);
1031 			hash_free(&oldhash);
1032 			goto update_wss;
1033 		}
1034 	}
1035 	KEG_UNLOCK(keg, 0);
1036 
1037 update_wss:
1038 	for (int i = 0; i < vm_ndomains; i++)
1039 		zone_domain_update_wss(ZDOM_GET(zone, i));
1040 }
1041 
1042 /*
1043  * Allocate and zero fill the next sized hash table from the appropriate
1044  * backing store.
1045  *
1046  * Arguments:
1047  *	hash  A new hash structure with the old hash size in uh_hashsize
1048  *
1049  * Returns:
1050  *	1 on success and 0 on failure.
1051  */
1052 static int
1053 hash_alloc(struct uma_hash *hash, u_int size)
1054 {
1055 	size_t alloc;
1056 
1057 	KASSERT(powerof2(size), ("hash size must be power of 2"));
1058 	if (size > UMA_HASH_SIZE_INIT)  {
1059 		hash->uh_hashsize = size;
1060 		alloc = sizeof(hash->uh_slab_hash[0]) * hash->uh_hashsize;
1061 		hash->uh_slab_hash = malloc(alloc, M_UMAHASH, M_NOWAIT);
1062 	} else {
1063 		alloc = sizeof(hash->uh_slab_hash[0]) * UMA_HASH_SIZE_INIT;
1064 		hash->uh_slab_hash = zone_alloc_item(hashzone, NULL,
1065 		    UMA_ANYDOMAIN, M_WAITOK);
1066 		hash->uh_hashsize = UMA_HASH_SIZE_INIT;
1067 	}
1068 	if (hash->uh_slab_hash) {
1069 		bzero(hash->uh_slab_hash, alloc);
1070 		hash->uh_hashmask = hash->uh_hashsize - 1;
1071 		return (1);
1072 	}
1073 
1074 	return (0);
1075 }
1076 
1077 /*
1078  * Expands the hash table for HASH zones.  This is done from zone_timeout
1079  * to reduce collisions.  This must not be done in the regular allocation
1080  * path, otherwise, we can recurse on the vm while allocating pages.
1081  *
1082  * Arguments:
1083  *	oldhash  The hash you want to expand
1084  *	newhash  The hash structure for the new table
1085  *
1086  * Returns:
1087  *	Nothing
1088  *
1089  * Discussion:
1090  */
1091 static int
1092 hash_expand(struct uma_hash *oldhash, struct uma_hash *newhash)
1093 {
1094 	uma_hash_slab_t slab;
1095 	u_int hval;
1096 	u_int idx;
1097 
1098 	if (!newhash->uh_slab_hash)
1099 		return (0);
1100 
1101 	if (oldhash->uh_hashsize >= newhash->uh_hashsize)
1102 		return (0);
1103 
1104 	/*
1105 	 * I need to investigate hash algorithms for resizing without a
1106 	 * full rehash.
1107 	 */
1108 
1109 	for (idx = 0; idx < oldhash->uh_hashsize; idx++)
1110 		while (!LIST_EMPTY(&oldhash->uh_slab_hash[idx])) {
1111 			slab = LIST_FIRST(&oldhash->uh_slab_hash[idx]);
1112 			LIST_REMOVE(slab, uhs_hlink);
1113 			hval = UMA_HASH(newhash, slab->uhs_data);
1114 			LIST_INSERT_HEAD(&newhash->uh_slab_hash[hval],
1115 			    slab, uhs_hlink);
1116 		}
1117 
1118 	return (1);
1119 }
1120 
1121 /*
1122  * Free the hash bucket to the appropriate backing store.
1123  *
1124  * Arguments:
1125  *	slab_hash  The hash bucket we're freeing
1126  *	hashsize   The number of entries in that hash bucket
1127  *
1128  * Returns:
1129  *	Nothing
1130  */
1131 static void
1132 hash_free(struct uma_hash *hash)
1133 {
1134 	if (hash->uh_slab_hash == NULL)
1135 		return;
1136 	if (hash->uh_hashsize == UMA_HASH_SIZE_INIT)
1137 		zone_free_item(hashzone, hash->uh_slab_hash, NULL, SKIP_NONE);
1138 	else
1139 		free(hash->uh_slab_hash, M_UMAHASH);
1140 }
1141 
1142 /*
1143  * Frees all outstanding items in a bucket
1144  *
1145  * Arguments:
1146  *	zone   The zone to free to, must be unlocked.
1147  *	bucket The free/alloc bucket with items.
1148  *
1149  * Returns:
1150  *	Nothing
1151  */
1152 static void
1153 bucket_drain(uma_zone_t zone, uma_bucket_t bucket)
1154 {
1155 	int i;
1156 
1157 	if (bucket->ub_cnt == 0)
1158 		return;
1159 
1160 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0 &&
1161 	    bucket->ub_seq != SMR_SEQ_INVALID) {
1162 		smr_wait(zone->uz_smr, bucket->ub_seq);
1163 		bucket->ub_seq = SMR_SEQ_INVALID;
1164 		for (i = 0; i < bucket->ub_cnt; i++)
1165 			item_dtor(zone, bucket->ub_bucket[i],
1166 			    zone->uz_size, NULL, SKIP_NONE);
1167 	}
1168 	if (zone->uz_fini)
1169 		for (i = 0; i < bucket->ub_cnt; i++)
1170 			zone->uz_fini(bucket->ub_bucket[i], zone->uz_size);
1171 	zone->uz_release(zone->uz_arg, bucket->ub_bucket, bucket->ub_cnt);
1172 	if (zone->uz_max_items > 0)
1173 		zone_free_limit(zone, bucket->ub_cnt);
1174 #ifdef INVARIANTS
1175 	bzero(bucket->ub_bucket, sizeof(void *) * bucket->ub_cnt);
1176 #endif
1177 	bucket->ub_cnt = 0;
1178 }
1179 
1180 /*
1181  * Drains the per cpu caches for a zone.
1182  *
1183  * NOTE: This may only be called while the zone is being torn down, and not
1184  * during normal operation.  This is necessary in order that we do not have
1185  * to migrate CPUs to drain the per-CPU caches.
1186  *
1187  * Arguments:
1188  *	zone     The zone to drain, must be unlocked.
1189  *
1190  * Returns:
1191  *	Nothing
1192  */
1193 static void
1194 cache_drain(uma_zone_t zone)
1195 {
1196 	uma_cache_t cache;
1197 	uma_bucket_t bucket;
1198 	smr_seq_t seq;
1199 	int cpu;
1200 
1201 	/*
1202 	 * XXX: It is safe to not lock the per-CPU caches, because we're
1203 	 * tearing down the zone anyway.  I.e., there will be no further use
1204 	 * of the caches at this point.
1205 	 *
1206 	 * XXX: It would good to be able to assert that the zone is being
1207 	 * torn down to prevent improper use of cache_drain().
1208 	 */
1209 	seq = SMR_SEQ_INVALID;
1210 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0)
1211 		seq = smr_advance(zone->uz_smr);
1212 	CPU_FOREACH(cpu) {
1213 		cache = &zone->uz_cpu[cpu];
1214 		bucket = cache_bucket_unload_alloc(cache);
1215 		if (bucket != NULL)
1216 			bucket_free(zone, bucket, NULL);
1217 		bucket = cache_bucket_unload_free(cache);
1218 		if (bucket != NULL) {
1219 			bucket->ub_seq = seq;
1220 			bucket_free(zone, bucket, NULL);
1221 		}
1222 		bucket = cache_bucket_unload_cross(cache);
1223 		if (bucket != NULL) {
1224 			bucket->ub_seq = seq;
1225 			bucket_free(zone, bucket, NULL);
1226 		}
1227 	}
1228 	bucket_cache_reclaim(zone, true);
1229 }
1230 
1231 static void
1232 cache_shrink(uma_zone_t zone, void *unused)
1233 {
1234 
1235 	if (zone->uz_flags & UMA_ZFLAG_INTERNAL)
1236 		return;
1237 
1238 	zone->uz_bucket_size =
1239 	    (zone->uz_bucket_size_min + zone->uz_bucket_size) / 2;
1240 }
1241 
1242 static void
1243 cache_drain_safe_cpu(uma_zone_t zone, void *unused)
1244 {
1245 	uma_cache_t cache;
1246 	uma_bucket_t b1, b2, b3;
1247 	int domain;
1248 
1249 	if (zone->uz_flags & UMA_ZFLAG_INTERNAL)
1250 		return;
1251 
1252 	b1 = b2 = b3 = NULL;
1253 	critical_enter();
1254 	cache = &zone->uz_cpu[curcpu];
1255 	domain = PCPU_GET(domain);
1256 	b1 = cache_bucket_unload_alloc(cache);
1257 
1258 	/*
1259 	 * Don't flush SMR zone buckets.  This leaves the zone without a
1260 	 * bucket and forces every free to synchronize().
1261 	 */
1262 	if ((zone->uz_flags & UMA_ZONE_SMR) == 0) {
1263 		b2 = cache_bucket_unload_free(cache);
1264 		b3 = cache_bucket_unload_cross(cache);
1265 	}
1266 	critical_exit();
1267 
1268 	if (b1 != NULL)
1269 		zone_free_bucket(zone, b1, NULL, domain, false);
1270 	if (b2 != NULL)
1271 		zone_free_bucket(zone, b2, NULL, domain, false);
1272 	if (b3 != NULL) {
1273 		/* Adjust the domain so it goes to zone_free_cross. */
1274 		domain = (domain + 1) % vm_ndomains;
1275 		zone_free_bucket(zone, b3, NULL, domain, false);
1276 	}
1277 }
1278 
1279 /*
1280  * Safely drain per-CPU caches of a zone(s) to alloc bucket.
1281  * This is an expensive call because it needs to bind to all CPUs
1282  * one by one and enter a critical section on each of them in order
1283  * to safely access their cache buckets.
1284  * Zone lock must not be held on call this function.
1285  */
1286 static void
1287 pcpu_cache_drain_safe(uma_zone_t zone)
1288 {
1289 	int cpu;
1290 
1291 	/*
1292 	 * Polite bucket sizes shrinking was not enough, shrink aggressively.
1293 	 */
1294 	if (zone)
1295 		cache_shrink(zone, NULL);
1296 	else
1297 		zone_foreach(cache_shrink, NULL);
1298 
1299 	CPU_FOREACH(cpu) {
1300 		thread_lock(curthread);
1301 		sched_bind(curthread, cpu);
1302 		thread_unlock(curthread);
1303 
1304 		if (zone)
1305 			cache_drain_safe_cpu(zone, NULL);
1306 		else
1307 			zone_foreach(cache_drain_safe_cpu, NULL);
1308 	}
1309 	thread_lock(curthread);
1310 	sched_unbind(curthread);
1311 	thread_unlock(curthread);
1312 }
1313 
1314 /*
1315  * Reclaim cached buckets from a zone.  All buckets are reclaimed if the caller
1316  * requested a drain, otherwise the per-domain caches are trimmed to either
1317  * estimated working set size.
1318  */
1319 static void
1320 bucket_cache_reclaim(uma_zone_t zone, bool drain)
1321 {
1322 	uma_zone_domain_t zdom;
1323 	uma_bucket_t bucket;
1324 	long target;
1325 	int i;
1326 
1327 	/*
1328 	 * Shrink the zone bucket size to ensure that the per-CPU caches
1329 	 * don't grow too large.
1330 	 */
1331 	if (zone->uz_bucket_size > zone->uz_bucket_size_min)
1332 		zone->uz_bucket_size--;
1333 
1334 	for (i = 0; i < vm_ndomains; i++) {
1335 		/*
1336 		 * The cross bucket is partially filled and not part of
1337 		 * the item count.  Reclaim it individually here.
1338 		 */
1339 		zdom = ZDOM_GET(zone, i);
1340 		if ((zone->uz_flags & UMA_ZONE_SMR) == 0 || drain) {
1341 			ZONE_CROSS_LOCK(zone);
1342 			bucket = zdom->uzd_cross;
1343 			zdom->uzd_cross = NULL;
1344 			ZONE_CROSS_UNLOCK(zone);
1345 			if (bucket != NULL)
1346 				bucket_free(zone, bucket, NULL);
1347 		}
1348 
1349 		/*
1350 		 * If we were asked to drain the zone, we are done only once
1351 		 * this bucket cache is empty.  Otherwise, we reclaim items in
1352 		 * excess of the zone's estimated working set size.  If the
1353 		 * difference nitems - imin is larger than the WSS estimate,
1354 		 * then the estimate will grow at the end of this interval and
1355 		 * we ignore the historical average.
1356 		 */
1357 		ZDOM_LOCK(zdom);
1358 		target = drain ? 0 : lmax(zdom->uzd_wss, zdom->uzd_nitems -
1359 		    zdom->uzd_imin);
1360 		while (zdom->uzd_nitems > target) {
1361 			bucket = zone_fetch_bucket(zone, zdom, true);
1362 			if (bucket == NULL)
1363 				break;
1364 			bucket_free(zone, bucket, NULL);
1365 			ZDOM_LOCK(zdom);
1366 		}
1367 		ZDOM_UNLOCK(zdom);
1368 	}
1369 }
1370 
1371 static void
1372 keg_free_slab(uma_keg_t keg, uma_slab_t slab, int start)
1373 {
1374 	uint8_t *mem;
1375 	int i;
1376 	uint8_t flags;
1377 
1378 	CTR4(KTR_UMA, "keg_free_slab keg %s(%p) slab %p, returning %d bytes",
1379 	    keg->uk_name, keg, slab, PAGE_SIZE * keg->uk_ppera);
1380 
1381 	mem = slab_data(slab, keg);
1382 	flags = slab->us_flags;
1383 	i = start;
1384 	if (keg->uk_fini != NULL) {
1385 		for (i--; i > -1; i--)
1386 #ifdef INVARIANTS
1387 		/*
1388 		 * trash_fini implies that dtor was trash_dtor. trash_fini
1389 		 * would check that memory hasn't been modified since free,
1390 		 * which executed trash_dtor.
1391 		 * That's why we need to run uma_dbg_kskip() check here,
1392 		 * albeit we don't make skip check for other init/fini
1393 		 * invocations.
1394 		 */
1395 		if (!uma_dbg_kskip(keg, slab_item(slab, keg, i)) ||
1396 		    keg->uk_fini != trash_fini)
1397 #endif
1398 			keg->uk_fini(slab_item(slab, keg, i), keg->uk_size);
1399 	}
1400 	if (keg->uk_flags & UMA_ZFLAG_OFFPAGE)
1401 		zone_free_item(slabzone(keg->uk_ipers), slab_tohashslab(slab),
1402 		    NULL, SKIP_NONE);
1403 	keg->uk_freef(mem, PAGE_SIZE * keg->uk_ppera, flags);
1404 	uma_total_dec(PAGE_SIZE * keg->uk_ppera);
1405 }
1406 
1407 /*
1408  * Frees pages from a keg back to the system.  This is done on demand from
1409  * the pageout daemon.
1410  *
1411  * Returns nothing.
1412  */
1413 static void
1414 keg_drain(uma_keg_t keg)
1415 {
1416 	struct slabhead freeslabs;
1417 	uma_domain_t dom;
1418 	uma_slab_t slab, tmp;
1419 	int i, n;
1420 
1421 	if (keg->uk_flags & UMA_ZONE_NOFREE || keg->uk_freef == NULL)
1422 		return;
1423 
1424 	for (i = 0; i < vm_ndomains; i++) {
1425 		CTR4(KTR_UMA, "keg_drain %s(%p) domain %d free items: %u",
1426 		    keg->uk_name, keg, i, dom->ud_free_items);
1427 		dom = &keg->uk_domain[i];
1428 		LIST_INIT(&freeslabs);
1429 
1430 		KEG_LOCK(keg, i);
1431 		if ((keg->uk_flags & UMA_ZFLAG_HASH) != 0) {
1432 			LIST_FOREACH(slab, &dom->ud_free_slab, us_link)
1433 				UMA_HASH_REMOVE(&keg->uk_hash, slab);
1434 		}
1435 		n = dom->ud_free_slabs;
1436 		LIST_SWAP(&freeslabs, &dom->ud_free_slab, uma_slab, us_link);
1437 		dom->ud_free_slabs = 0;
1438 		dom->ud_free_items -= n * keg->uk_ipers;
1439 		dom->ud_pages -= n * keg->uk_ppera;
1440 		KEG_UNLOCK(keg, i);
1441 
1442 		LIST_FOREACH_SAFE(slab, &freeslabs, us_link, tmp)
1443 			keg_free_slab(keg, slab, keg->uk_ipers);
1444 	}
1445 }
1446 
1447 static void
1448 zone_reclaim(uma_zone_t zone, int waitok, bool drain)
1449 {
1450 
1451 	/*
1452 	 * Set draining to interlock with zone_dtor() so we can release our
1453 	 * locks as we go.  Only dtor() should do a WAITOK call since it
1454 	 * is the only call that knows the structure will still be available
1455 	 * when it wakes up.
1456 	 */
1457 	ZONE_LOCK(zone);
1458 	while (zone->uz_flags & UMA_ZFLAG_RECLAIMING) {
1459 		if (waitok == M_NOWAIT)
1460 			goto out;
1461 		msleep(zone, &ZDOM_GET(zone, 0)->uzd_lock, PVM, "zonedrain",
1462 		    1);
1463 	}
1464 	zone->uz_flags |= UMA_ZFLAG_RECLAIMING;
1465 	ZONE_UNLOCK(zone);
1466 	bucket_cache_reclaim(zone, drain);
1467 
1468 	/*
1469 	 * The DRAINING flag protects us from being freed while
1470 	 * we're running.  Normally the uma_rwlock would protect us but we
1471 	 * must be able to release and acquire the right lock for each keg.
1472 	 */
1473 	if ((zone->uz_flags & UMA_ZFLAG_CACHE) == 0)
1474 		keg_drain(zone->uz_keg);
1475 	ZONE_LOCK(zone);
1476 	zone->uz_flags &= ~UMA_ZFLAG_RECLAIMING;
1477 	wakeup(zone);
1478 out:
1479 	ZONE_UNLOCK(zone);
1480 }
1481 
1482 static void
1483 zone_drain(uma_zone_t zone, void *unused)
1484 {
1485 
1486 	zone_reclaim(zone, M_NOWAIT, true);
1487 }
1488 
1489 static void
1490 zone_trim(uma_zone_t zone, void *unused)
1491 {
1492 
1493 	zone_reclaim(zone, M_NOWAIT, false);
1494 }
1495 
1496 /*
1497  * Allocate a new slab for a keg and inserts it into the partial slab list.
1498  * The keg should be unlocked on entry.  If the allocation succeeds it will
1499  * be locked on return.
1500  *
1501  * Arguments:
1502  *	flags   Wait flags for the item initialization routine
1503  *	aflags  Wait flags for the slab allocation
1504  *
1505  * Returns:
1506  *	The slab that was allocated or NULL if there is no memory and the
1507  *	caller specified M_NOWAIT.
1508  */
1509 static uma_slab_t
1510 keg_alloc_slab(uma_keg_t keg, uma_zone_t zone, int domain, int flags,
1511     int aflags)
1512 {
1513 	uma_domain_t dom;
1514 	uma_alloc allocf;
1515 	uma_slab_t slab;
1516 	unsigned long size;
1517 	uint8_t *mem;
1518 	uint8_t sflags;
1519 	int i;
1520 
1521 	KASSERT(domain >= 0 && domain < vm_ndomains,
1522 	    ("keg_alloc_slab: domain %d out of range", domain));
1523 
1524 	allocf = keg->uk_allocf;
1525 	slab = NULL;
1526 	mem = NULL;
1527 	if (keg->uk_flags & UMA_ZFLAG_OFFPAGE) {
1528 		uma_hash_slab_t hslab;
1529 		hslab = zone_alloc_item(slabzone(keg->uk_ipers), NULL,
1530 		    domain, aflags);
1531 		if (hslab == NULL)
1532 			goto fail;
1533 		slab = &hslab->uhs_slab;
1534 	}
1535 
1536 	/*
1537 	 * This reproduces the old vm_zone behavior of zero filling pages the
1538 	 * first time they are added to a zone.
1539 	 *
1540 	 * Malloced items are zeroed in uma_zalloc.
1541 	 */
1542 
1543 	if ((keg->uk_flags & UMA_ZONE_MALLOC) == 0)
1544 		aflags |= M_ZERO;
1545 	else
1546 		aflags &= ~M_ZERO;
1547 
1548 	if (keg->uk_flags & UMA_ZONE_NODUMP)
1549 		aflags |= M_NODUMP;
1550 
1551 	/* zone is passed for legacy reasons. */
1552 	size = keg->uk_ppera * PAGE_SIZE;
1553 	mem = allocf(zone, size, domain, &sflags, aflags);
1554 	if (mem == NULL) {
1555 		if (keg->uk_flags & UMA_ZFLAG_OFFPAGE)
1556 			zone_free_item(slabzone(keg->uk_ipers),
1557 			    slab_tohashslab(slab), NULL, SKIP_NONE);
1558 		goto fail;
1559 	}
1560 	uma_total_inc(size);
1561 
1562 	/* For HASH zones all pages go to the same uma_domain. */
1563 	if ((keg->uk_flags & UMA_ZFLAG_HASH) != 0)
1564 		domain = 0;
1565 
1566 	/* Point the slab into the allocated memory */
1567 	if (!(keg->uk_flags & UMA_ZFLAG_OFFPAGE))
1568 		slab = (uma_slab_t )(mem + keg->uk_pgoff);
1569 	else
1570 		slab_tohashslab(slab)->uhs_data = mem;
1571 
1572 	if (keg->uk_flags & UMA_ZFLAG_VTOSLAB)
1573 		for (i = 0; i < keg->uk_ppera; i++)
1574 			vsetzoneslab((vm_offset_t)mem + (i * PAGE_SIZE),
1575 			    zone, slab);
1576 
1577 	slab->us_freecount = keg->uk_ipers;
1578 	slab->us_flags = sflags;
1579 	slab->us_domain = domain;
1580 
1581 	BIT_FILL(keg->uk_ipers, &slab->us_free);
1582 #ifdef INVARIANTS
1583 	BIT_ZERO(keg->uk_ipers, slab_dbg_bits(slab, keg));
1584 #endif
1585 
1586 	if (keg->uk_init != NULL) {
1587 		for (i = 0; i < keg->uk_ipers; i++)
1588 			if (keg->uk_init(slab_item(slab, keg, i),
1589 			    keg->uk_size, flags) != 0)
1590 				break;
1591 		if (i != keg->uk_ipers) {
1592 			keg_free_slab(keg, slab, i);
1593 			goto fail;
1594 		}
1595 	}
1596 	KEG_LOCK(keg, domain);
1597 
1598 	CTR3(KTR_UMA, "keg_alloc_slab: allocated slab %p for %s(%p)",
1599 	    slab, keg->uk_name, keg);
1600 
1601 	if (keg->uk_flags & UMA_ZFLAG_HASH)
1602 		UMA_HASH_INSERT(&keg->uk_hash, slab, mem);
1603 
1604 	/*
1605 	 * If we got a slab here it's safe to mark it partially used
1606 	 * and return.  We assume that the caller is going to remove
1607 	 * at least one item.
1608 	 */
1609 	dom = &keg->uk_domain[domain];
1610 	LIST_INSERT_HEAD(&dom->ud_part_slab, slab, us_link);
1611 	dom->ud_pages += keg->uk_ppera;
1612 	dom->ud_free_items += keg->uk_ipers;
1613 
1614 	return (slab);
1615 
1616 fail:
1617 	return (NULL);
1618 }
1619 
1620 /*
1621  * This function is intended to be used early on in place of page_alloc() so
1622  * that we may use the boot time page cache to satisfy allocations before
1623  * the VM is ready.
1624  */
1625 static void *
1626 startup_alloc(uma_zone_t zone, vm_size_t bytes, int domain, uint8_t *pflag,
1627     int wait)
1628 {
1629 	vm_paddr_t pa;
1630 	vm_page_t m;
1631 	void *mem;
1632 	int pages;
1633 	int i;
1634 
1635 	pages = howmany(bytes, PAGE_SIZE);
1636 	KASSERT(pages > 0, ("%s can't reserve 0 pages", __func__));
1637 
1638 	*pflag = UMA_SLAB_BOOT;
1639 	m = vm_page_alloc_contig_domain(NULL, 0, domain,
1640 	    malloc2vm_flags(wait) | VM_ALLOC_NOOBJ | VM_ALLOC_WIRED, pages,
1641 	    (vm_paddr_t)0, ~(vm_paddr_t)0, 1, 0, VM_MEMATTR_DEFAULT);
1642 	if (m == NULL)
1643 		return (NULL);
1644 
1645 	pa = VM_PAGE_TO_PHYS(m);
1646 	for (i = 0; i < pages; i++, pa += PAGE_SIZE) {
1647 #if defined(__aarch64__) || defined(__amd64__) || defined(__mips__) || \
1648     defined(__riscv) || defined(__powerpc64__)
1649 		if ((wait & M_NODUMP) == 0)
1650 			dump_add_page(pa);
1651 #endif
1652 	}
1653 	/* Allocate KVA and indirectly advance bootmem. */
1654 	mem = (void *)pmap_map(&bootmem, m->phys_addr,
1655 	    m->phys_addr + (pages * PAGE_SIZE), VM_PROT_READ | VM_PROT_WRITE);
1656         if ((wait & M_ZERO) != 0)
1657                 bzero(mem, pages * PAGE_SIZE);
1658 
1659         return (mem);
1660 }
1661 
1662 static void
1663 startup_free(void *mem, vm_size_t bytes)
1664 {
1665 	vm_offset_t va;
1666 	vm_page_t m;
1667 
1668 	va = (vm_offset_t)mem;
1669 	m = PHYS_TO_VM_PAGE(pmap_kextract(va));
1670 	pmap_remove(kernel_pmap, va, va + bytes);
1671 	for (; bytes != 0; bytes -= PAGE_SIZE, m++) {
1672 #if defined(__aarch64__) || defined(__amd64__) || defined(__mips__) || \
1673     defined(__riscv) || defined(__powerpc64__)
1674 		dump_drop_page(VM_PAGE_TO_PHYS(m));
1675 #endif
1676 		vm_page_unwire_noq(m);
1677 		vm_page_free(m);
1678 	}
1679 }
1680 
1681 /*
1682  * Allocates a number of pages from the system
1683  *
1684  * Arguments:
1685  *	bytes  The number of bytes requested
1686  *	wait  Shall we wait?
1687  *
1688  * Returns:
1689  *	A pointer to the alloced memory or possibly
1690  *	NULL if M_NOWAIT is set.
1691  */
1692 static void *
1693 page_alloc(uma_zone_t zone, vm_size_t bytes, int domain, uint8_t *pflag,
1694     int wait)
1695 {
1696 	void *p;	/* Returned page */
1697 
1698 	*pflag = UMA_SLAB_KERNEL;
1699 	p = (void *)kmem_malloc_domainset(DOMAINSET_FIXED(domain), bytes, wait);
1700 
1701 	return (p);
1702 }
1703 
1704 static void *
1705 pcpu_page_alloc(uma_zone_t zone, vm_size_t bytes, int domain, uint8_t *pflag,
1706     int wait)
1707 {
1708 	struct pglist alloctail;
1709 	vm_offset_t addr, zkva;
1710 	int cpu, flags;
1711 	vm_page_t p, p_next;
1712 #ifdef NUMA
1713 	struct pcpu *pc;
1714 #endif
1715 
1716 	MPASS(bytes == (mp_maxid + 1) * PAGE_SIZE);
1717 
1718 	TAILQ_INIT(&alloctail);
1719 	flags = VM_ALLOC_SYSTEM | VM_ALLOC_WIRED | VM_ALLOC_NOOBJ |
1720 	    malloc2vm_flags(wait);
1721 	*pflag = UMA_SLAB_KERNEL;
1722 	for (cpu = 0; cpu <= mp_maxid; cpu++) {
1723 		if (CPU_ABSENT(cpu)) {
1724 			p = vm_page_alloc(NULL, 0, flags);
1725 		} else {
1726 #ifndef NUMA
1727 			p = vm_page_alloc(NULL, 0, flags);
1728 #else
1729 			pc = pcpu_find(cpu);
1730 			if (__predict_false(VM_DOMAIN_EMPTY(pc->pc_domain)))
1731 				p = NULL;
1732 			else
1733 				p = vm_page_alloc_domain(NULL, 0,
1734 				    pc->pc_domain, flags);
1735 			if (__predict_false(p == NULL))
1736 				p = vm_page_alloc(NULL, 0, flags);
1737 #endif
1738 		}
1739 		if (__predict_false(p == NULL))
1740 			goto fail;
1741 		TAILQ_INSERT_TAIL(&alloctail, p, listq);
1742 	}
1743 	if ((addr = kva_alloc(bytes)) == 0)
1744 		goto fail;
1745 	zkva = addr;
1746 	TAILQ_FOREACH(p, &alloctail, listq) {
1747 		pmap_qenter(zkva, &p, 1);
1748 		zkva += PAGE_SIZE;
1749 	}
1750 	return ((void*)addr);
1751 fail:
1752 	TAILQ_FOREACH_SAFE(p, &alloctail, listq, p_next) {
1753 		vm_page_unwire_noq(p);
1754 		vm_page_free(p);
1755 	}
1756 	return (NULL);
1757 }
1758 
1759 /*
1760  * Allocates a number of pages from within an object
1761  *
1762  * Arguments:
1763  *	bytes  The number of bytes requested
1764  *	wait   Shall we wait?
1765  *
1766  * Returns:
1767  *	A pointer to the alloced memory or possibly
1768  *	NULL if M_NOWAIT is set.
1769  */
1770 static void *
1771 noobj_alloc(uma_zone_t zone, vm_size_t bytes, int domain, uint8_t *flags,
1772     int wait)
1773 {
1774 	TAILQ_HEAD(, vm_page) alloctail;
1775 	u_long npages;
1776 	vm_offset_t retkva, zkva;
1777 	vm_page_t p, p_next;
1778 	uma_keg_t keg;
1779 
1780 	TAILQ_INIT(&alloctail);
1781 	keg = zone->uz_keg;
1782 
1783 	npages = howmany(bytes, PAGE_SIZE);
1784 	while (npages > 0) {
1785 		p = vm_page_alloc_domain(NULL, 0, domain, VM_ALLOC_INTERRUPT |
1786 		    VM_ALLOC_WIRED | VM_ALLOC_NOOBJ |
1787 		    ((wait & M_WAITOK) != 0 ? VM_ALLOC_WAITOK :
1788 		    VM_ALLOC_NOWAIT));
1789 		if (p != NULL) {
1790 			/*
1791 			 * Since the page does not belong to an object, its
1792 			 * listq is unused.
1793 			 */
1794 			TAILQ_INSERT_TAIL(&alloctail, p, listq);
1795 			npages--;
1796 			continue;
1797 		}
1798 		/*
1799 		 * Page allocation failed, free intermediate pages and
1800 		 * exit.
1801 		 */
1802 		TAILQ_FOREACH_SAFE(p, &alloctail, listq, p_next) {
1803 			vm_page_unwire_noq(p);
1804 			vm_page_free(p);
1805 		}
1806 		return (NULL);
1807 	}
1808 	*flags = UMA_SLAB_PRIV;
1809 	zkva = keg->uk_kva +
1810 	    atomic_fetchadd_long(&keg->uk_offset, round_page(bytes));
1811 	retkva = zkva;
1812 	TAILQ_FOREACH(p, &alloctail, listq) {
1813 		pmap_qenter(zkva, &p, 1);
1814 		zkva += PAGE_SIZE;
1815 	}
1816 
1817 	return ((void *)retkva);
1818 }
1819 
1820 /*
1821  * Allocate physically contiguous pages.
1822  */
1823 static void *
1824 contig_alloc(uma_zone_t zone, vm_size_t bytes, int domain, uint8_t *pflag,
1825     int wait)
1826 {
1827 
1828 	*pflag = UMA_SLAB_KERNEL;
1829 	return ((void *)kmem_alloc_contig_domainset(DOMAINSET_FIXED(domain),
1830 	    bytes, wait, 0, ~(vm_paddr_t)0, 1, 0, VM_MEMATTR_DEFAULT));
1831 }
1832 
1833 /*
1834  * Frees a number of pages to the system
1835  *
1836  * Arguments:
1837  *	mem   A pointer to the memory to be freed
1838  *	size  The size of the memory being freed
1839  *	flags The original p->us_flags field
1840  *
1841  * Returns:
1842  *	Nothing
1843  */
1844 static void
1845 page_free(void *mem, vm_size_t size, uint8_t flags)
1846 {
1847 
1848 	if ((flags & UMA_SLAB_BOOT) != 0) {
1849 		startup_free(mem, size);
1850 		return;
1851 	}
1852 
1853 	KASSERT((flags & UMA_SLAB_KERNEL) != 0,
1854 	    ("UMA: page_free used with invalid flags %x", flags));
1855 
1856 	kmem_free((vm_offset_t)mem, size);
1857 }
1858 
1859 /*
1860  * Frees pcpu zone allocations
1861  *
1862  * Arguments:
1863  *	mem   A pointer to the memory to be freed
1864  *	size  The size of the memory being freed
1865  *	flags The original p->us_flags field
1866  *
1867  * Returns:
1868  *	Nothing
1869  */
1870 static void
1871 pcpu_page_free(void *mem, vm_size_t size, uint8_t flags)
1872 {
1873 	vm_offset_t sva, curva;
1874 	vm_paddr_t paddr;
1875 	vm_page_t m;
1876 
1877 	MPASS(size == (mp_maxid+1)*PAGE_SIZE);
1878 
1879 	if ((flags & UMA_SLAB_BOOT) != 0) {
1880 		startup_free(mem, size);
1881 		return;
1882 	}
1883 
1884 	sva = (vm_offset_t)mem;
1885 	for (curva = sva; curva < sva + size; curva += PAGE_SIZE) {
1886 		paddr = pmap_kextract(curva);
1887 		m = PHYS_TO_VM_PAGE(paddr);
1888 		vm_page_unwire_noq(m);
1889 		vm_page_free(m);
1890 	}
1891 	pmap_qremove(sva, size >> PAGE_SHIFT);
1892 	kva_free(sva, size);
1893 }
1894 
1895 /*
1896  * Zero fill initializer
1897  *
1898  * Arguments/Returns follow uma_init specifications
1899  */
1900 static int
1901 zero_init(void *mem, int size, int flags)
1902 {
1903 	bzero(mem, size);
1904 	return (0);
1905 }
1906 
1907 #ifdef INVARIANTS
1908 static struct noslabbits *
1909 slab_dbg_bits(uma_slab_t slab, uma_keg_t keg)
1910 {
1911 
1912 	return ((void *)((char *)&slab->us_free + BITSET_SIZE(keg->uk_ipers)));
1913 }
1914 #endif
1915 
1916 /*
1917  * Actual size of embedded struct slab (!OFFPAGE).
1918  */
1919 static size_t
1920 slab_sizeof(int nitems)
1921 {
1922 	size_t s;
1923 
1924 	s = sizeof(struct uma_slab) + BITSET_SIZE(nitems) * SLAB_BITSETS;
1925 	return (roundup(s, UMA_ALIGN_PTR + 1));
1926 }
1927 
1928 #define	UMA_FIXPT_SHIFT	31
1929 #define	UMA_FRAC_FIXPT(n, d)						\
1930 	((uint32_t)(((uint64_t)(n) << UMA_FIXPT_SHIFT) / (d)))
1931 #define	UMA_FIXPT_PCT(f)						\
1932 	((u_int)(((uint64_t)100 * (f)) >> UMA_FIXPT_SHIFT))
1933 #define	UMA_PCT_FIXPT(pct)	UMA_FRAC_FIXPT((pct), 100)
1934 #define	UMA_MIN_EFF	UMA_PCT_FIXPT(100 - UMA_MAX_WASTE)
1935 
1936 /*
1937  * Compute the number of items that will fit in a slab.  If hdr is true, the
1938  * item count may be limited to provide space in the slab for an inline slab
1939  * header.  Otherwise, all slab space will be provided for item storage.
1940  */
1941 static u_int
1942 slab_ipers_hdr(u_int size, u_int rsize, u_int slabsize, bool hdr)
1943 {
1944 	u_int ipers;
1945 	u_int padpi;
1946 
1947 	/* The padding between items is not needed after the last item. */
1948 	padpi = rsize - size;
1949 
1950 	if (hdr) {
1951 		/*
1952 		 * Start with the maximum item count and remove items until
1953 		 * the slab header first alongside the allocatable memory.
1954 		 */
1955 		for (ipers = MIN(SLAB_MAX_SETSIZE,
1956 		    (slabsize + padpi - slab_sizeof(1)) / rsize);
1957 		    ipers > 0 &&
1958 		    ipers * rsize - padpi + slab_sizeof(ipers) > slabsize;
1959 		    ipers--)
1960 			continue;
1961 	} else {
1962 		ipers = MIN((slabsize + padpi) / rsize, SLAB_MAX_SETSIZE);
1963 	}
1964 
1965 	return (ipers);
1966 }
1967 
1968 struct keg_layout_result {
1969 	u_int format;
1970 	u_int slabsize;
1971 	u_int ipers;
1972 	u_int eff;
1973 };
1974 
1975 static void
1976 keg_layout_one(uma_keg_t keg, u_int rsize, u_int slabsize, u_int fmt,
1977     struct keg_layout_result *kl)
1978 {
1979 	u_int total;
1980 
1981 	kl->format = fmt;
1982 	kl->slabsize = slabsize;
1983 
1984 	/* Handle INTERNAL as inline with an extra page. */
1985 	if ((fmt & UMA_ZFLAG_INTERNAL) != 0) {
1986 		kl->format &= ~UMA_ZFLAG_INTERNAL;
1987 		kl->slabsize += PAGE_SIZE;
1988 	}
1989 
1990 	kl->ipers = slab_ipers_hdr(keg->uk_size, rsize, kl->slabsize,
1991 	    (fmt & UMA_ZFLAG_OFFPAGE) == 0);
1992 
1993 	/* Account for memory used by an offpage slab header. */
1994 	total = kl->slabsize;
1995 	if ((fmt & UMA_ZFLAG_OFFPAGE) != 0)
1996 		total += slabzone(kl->ipers)->uz_keg->uk_rsize;
1997 
1998 	kl->eff = UMA_FRAC_FIXPT(kl->ipers * rsize, total);
1999 }
2000 
2001 /*
2002  * Determine the format of a uma keg.  This determines where the slab header
2003  * will be placed (inline or offpage) and calculates ipers, rsize, and ppera.
2004  *
2005  * Arguments
2006  *	keg  The zone we should initialize
2007  *
2008  * Returns
2009  *	Nothing
2010  */
2011 static void
2012 keg_layout(uma_keg_t keg)
2013 {
2014 	struct keg_layout_result kl = {}, kl_tmp;
2015 	u_int fmts[2];
2016 	u_int alignsize;
2017 	u_int nfmt;
2018 	u_int pages;
2019 	u_int rsize;
2020 	u_int slabsize;
2021 	u_int i, j;
2022 
2023 	KASSERT((keg->uk_flags & UMA_ZONE_PCPU) == 0 ||
2024 	    (keg->uk_size <= UMA_PCPU_ALLOC_SIZE &&
2025 	     (keg->uk_flags & UMA_ZONE_CACHESPREAD) == 0),
2026 	    ("%s: cannot configure for PCPU: keg=%s, size=%u, flags=0x%b",
2027 	     __func__, keg->uk_name, keg->uk_size, keg->uk_flags,
2028 	     PRINT_UMA_ZFLAGS));
2029 	KASSERT((keg->uk_flags & (UMA_ZFLAG_INTERNAL | UMA_ZONE_VM)) == 0 ||
2030 	    (keg->uk_flags & (UMA_ZONE_NOTOUCH | UMA_ZONE_PCPU)) == 0,
2031 	    ("%s: incompatible flags 0x%b", __func__, keg->uk_flags,
2032 	     PRINT_UMA_ZFLAGS));
2033 
2034 	alignsize = keg->uk_align + 1;
2035 
2036 	/*
2037 	 * Calculate the size of each allocation (rsize) according to
2038 	 * alignment.  If the requested size is smaller than we have
2039 	 * allocation bits for we round it up.
2040 	 */
2041 	rsize = MAX(keg->uk_size, UMA_SMALLEST_UNIT);
2042 	rsize = roundup2(rsize, alignsize);
2043 
2044 	if ((keg->uk_flags & UMA_ZONE_CACHESPREAD) != 0) {
2045 		/*
2046 		 * We want one item to start on every align boundary in a page.
2047 		 * To do this we will span pages.  We will also extend the item
2048 		 * by the size of align if it is an even multiple of align.
2049 		 * Otherwise, it would fall on the same boundary every time.
2050 		 */
2051 		if ((rsize & alignsize) == 0)
2052 			rsize += alignsize;
2053 		slabsize = rsize * (PAGE_SIZE / alignsize);
2054 		slabsize = MIN(slabsize, rsize * SLAB_MAX_SETSIZE);
2055 		slabsize = MIN(slabsize, UMA_CACHESPREAD_MAX_SIZE);
2056 		slabsize = round_page(slabsize);
2057 	} else {
2058 		/*
2059 		 * Start with a slab size of as many pages as it takes to
2060 		 * represent a single item.  We will try to fit as many
2061 		 * additional items into the slab as possible.
2062 		 */
2063 		slabsize = round_page(keg->uk_size);
2064 	}
2065 
2066 	/* Build a list of all of the available formats for this keg. */
2067 	nfmt = 0;
2068 
2069 	/* Evaluate an inline slab layout. */
2070 	if ((keg->uk_flags & (UMA_ZONE_NOTOUCH | UMA_ZONE_PCPU)) == 0)
2071 		fmts[nfmt++] = 0;
2072 
2073 	/* TODO: vm_page-embedded slab. */
2074 
2075 	/*
2076 	 * We can't do OFFPAGE if we're internal or if we've been
2077 	 * asked to not go to the VM for buckets.  If we do this we
2078 	 * may end up going to the VM for slabs which we do not want
2079 	 * to do if we're UMA_ZONE_VM, which clearly forbids it.
2080 	 * In those cases, evaluate a pseudo-format called INTERNAL
2081 	 * which has an inline slab header and one extra page to
2082 	 * guarantee that it fits.
2083 	 *
2084 	 * Otherwise, see if using an OFFPAGE slab will improve our
2085 	 * efficiency.
2086 	 */
2087 	if ((keg->uk_flags & (UMA_ZFLAG_INTERNAL | UMA_ZONE_VM)) != 0)
2088 		fmts[nfmt++] = UMA_ZFLAG_INTERNAL;
2089 	else
2090 		fmts[nfmt++] = UMA_ZFLAG_OFFPAGE;
2091 
2092 	/*
2093 	 * Choose a slab size and format which satisfy the minimum efficiency.
2094 	 * Prefer the smallest slab size that meets the constraints.
2095 	 *
2096 	 * Start with a minimum slab size, to accommodate CACHESPREAD.  Then,
2097 	 * for small items (up to PAGE_SIZE), the iteration increment is one
2098 	 * page; and for large items, the increment is one item.
2099 	 */
2100 	i = (slabsize + rsize - keg->uk_size) / MAX(PAGE_SIZE, rsize);
2101 	KASSERT(i >= 1, ("keg %s(%p) flags=0x%b slabsize=%u, rsize=%u, i=%u",
2102 	    keg->uk_name, keg, keg->uk_flags, PRINT_UMA_ZFLAGS, slabsize,
2103 	    rsize, i));
2104 	for ( ; ; i++) {
2105 		slabsize = (rsize <= PAGE_SIZE) ? ptoa(i) :
2106 		    round_page(rsize * (i - 1) + keg->uk_size);
2107 
2108 		for (j = 0; j < nfmt; j++) {
2109 			/* Only if we have no viable format yet. */
2110 			if ((fmts[j] & UMA_ZFLAG_INTERNAL) != 0 &&
2111 			    kl.ipers > 0)
2112 				continue;
2113 
2114 			keg_layout_one(keg, rsize, slabsize, fmts[j], &kl_tmp);
2115 			if (kl_tmp.eff <= kl.eff)
2116 				continue;
2117 
2118 			kl = kl_tmp;
2119 
2120 			CTR6(KTR_UMA, "keg %s layout: format %#x "
2121 			    "(ipers %u * rsize %u) / slabsize %#x = %u%% eff",
2122 			    keg->uk_name, kl.format, kl.ipers, rsize,
2123 			    kl.slabsize, UMA_FIXPT_PCT(kl.eff));
2124 
2125 			/* Stop when we reach the minimum efficiency. */
2126 			if (kl.eff >= UMA_MIN_EFF)
2127 				break;
2128 		}
2129 
2130 		if (kl.eff >= UMA_MIN_EFF || !multipage_slabs ||
2131 		    slabsize >= SLAB_MAX_SETSIZE * rsize ||
2132 		    (keg->uk_flags & (UMA_ZONE_PCPU | UMA_ZONE_CONTIG)) != 0)
2133 			break;
2134 	}
2135 
2136 	pages = atop(kl.slabsize);
2137 	if ((keg->uk_flags & UMA_ZONE_PCPU) != 0)
2138 		pages *= mp_maxid + 1;
2139 
2140 	keg->uk_rsize = rsize;
2141 	keg->uk_ipers = kl.ipers;
2142 	keg->uk_ppera = pages;
2143 	keg->uk_flags |= kl.format;
2144 
2145 	/*
2146 	 * How do we find the slab header if it is offpage or if not all item
2147 	 * start addresses are in the same page?  We could solve the latter
2148 	 * case with vaddr alignment, but we don't.
2149 	 */
2150 	if ((keg->uk_flags & UMA_ZFLAG_OFFPAGE) != 0 ||
2151 	    (keg->uk_ipers - 1) * rsize >= PAGE_SIZE) {
2152 		if ((keg->uk_flags & UMA_ZONE_NOTPAGE) != 0)
2153 			keg->uk_flags |= UMA_ZFLAG_HASH;
2154 		else
2155 			keg->uk_flags |= UMA_ZFLAG_VTOSLAB;
2156 	}
2157 
2158 	CTR6(KTR_UMA, "%s: keg=%s, flags=%#x, rsize=%u, ipers=%u, ppera=%u",
2159 	    __func__, keg->uk_name, keg->uk_flags, rsize, keg->uk_ipers,
2160 	    pages);
2161 	KASSERT(keg->uk_ipers > 0 && keg->uk_ipers <= SLAB_MAX_SETSIZE,
2162 	    ("%s: keg=%s, flags=0x%b, rsize=%u, ipers=%u, ppera=%u", __func__,
2163 	     keg->uk_name, keg->uk_flags, PRINT_UMA_ZFLAGS, rsize,
2164 	     keg->uk_ipers, pages));
2165 }
2166 
2167 /*
2168  * Keg header ctor.  This initializes all fields, locks, etc.  And inserts
2169  * the keg onto the global keg list.
2170  *
2171  * Arguments/Returns follow uma_ctor specifications
2172  *	udata  Actually uma_kctor_args
2173  */
2174 static int
2175 keg_ctor(void *mem, int size, void *udata, int flags)
2176 {
2177 	struct uma_kctor_args *arg = udata;
2178 	uma_keg_t keg = mem;
2179 	uma_zone_t zone;
2180 	int i;
2181 
2182 	bzero(keg, size);
2183 	keg->uk_size = arg->size;
2184 	keg->uk_init = arg->uminit;
2185 	keg->uk_fini = arg->fini;
2186 	keg->uk_align = arg->align;
2187 	keg->uk_reserve = 0;
2188 	keg->uk_flags = arg->flags;
2189 
2190 	/*
2191 	 * We use a global round-robin policy by default.  Zones with
2192 	 * UMA_ZONE_FIRSTTOUCH set will use first-touch instead, in which
2193 	 * case the iterator is never run.
2194 	 */
2195 	keg->uk_dr.dr_policy = DOMAINSET_RR();
2196 	keg->uk_dr.dr_iter = 0;
2197 
2198 	/*
2199 	 * The primary zone is passed to us at keg-creation time.
2200 	 */
2201 	zone = arg->zone;
2202 	keg->uk_name = zone->uz_name;
2203 
2204 	if (arg->flags & UMA_ZONE_ZINIT)
2205 		keg->uk_init = zero_init;
2206 
2207 	if (arg->flags & UMA_ZONE_MALLOC)
2208 		keg->uk_flags |= UMA_ZFLAG_VTOSLAB;
2209 
2210 #ifndef SMP
2211 	keg->uk_flags &= ~UMA_ZONE_PCPU;
2212 #endif
2213 
2214 	keg_layout(keg);
2215 
2216 	/*
2217 	 * Use a first-touch NUMA policy for kegs that pmap_extract() will
2218 	 * work on.  Use round-robin for everything else.
2219 	 *
2220 	 * Zones may override the default by specifying either.
2221 	 */
2222 #ifdef NUMA
2223 	if ((keg->uk_flags &
2224 	    (UMA_ZONE_ROUNDROBIN | UMA_ZFLAG_CACHE | UMA_ZONE_NOTPAGE)) == 0)
2225 		keg->uk_flags |= UMA_ZONE_FIRSTTOUCH;
2226 	else if ((keg->uk_flags & UMA_ZONE_FIRSTTOUCH) == 0)
2227 		keg->uk_flags |= UMA_ZONE_ROUNDROBIN;
2228 #endif
2229 
2230 	/*
2231 	 * If we haven't booted yet we need allocations to go through the
2232 	 * startup cache until the vm is ready.
2233 	 */
2234 #ifdef UMA_MD_SMALL_ALLOC
2235 	if (keg->uk_ppera == 1)
2236 		keg->uk_allocf = uma_small_alloc;
2237 	else
2238 #endif
2239 	if (booted < BOOT_KVA)
2240 		keg->uk_allocf = startup_alloc;
2241 	else if (keg->uk_flags & UMA_ZONE_PCPU)
2242 		keg->uk_allocf = pcpu_page_alloc;
2243 	else if ((keg->uk_flags & UMA_ZONE_CONTIG) != 0 && keg->uk_ppera > 1)
2244 		keg->uk_allocf = contig_alloc;
2245 	else
2246 		keg->uk_allocf = page_alloc;
2247 #ifdef UMA_MD_SMALL_ALLOC
2248 	if (keg->uk_ppera == 1)
2249 		keg->uk_freef = uma_small_free;
2250 	else
2251 #endif
2252 	if (keg->uk_flags & UMA_ZONE_PCPU)
2253 		keg->uk_freef = pcpu_page_free;
2254 	else
2255 		keg->uk_freef = page_free;
2256 
2257 	/*
2258 	 * Initialize keg's locks.
2259 	 */
2260 	for (i = 0; i < vm_ndomains; i++)
2261 		KEG_LOCK_INIT(keg, i, (arg->flags & UMA_ZONE_MTXCLASS));
2262 
2263 	/*
2264 	 * If we're putting the slab header in the actual page we need to
2265 	 * figure out where in each page it goes.  See slab_sizeof
2266 	 * definition.
2267 	 */
2268 	if (!(keg->uk_flags & UMA_ZFLAG_OFFPAGE)) {
2269 		size_t shsize;
2270 
2271 		shsize = slab_sizeof(keg->uk_ipers);
2272 		keg->uk_pgoff = (PAGE_SIZE * keg->uk_ppera) - shsize;
2273 		/*
2274 		 * The only way the following is possible is if with our
2275 		 * UMA_ALIGN_PTR adjustments we are now bigger than
2276 		 * UMA_SLAB_SIZE.  I haven't checked whether this is
2277 		 * mathematically possible for all cases, so we make
2278 		 * sure here anyway.
2279 		 */
2280 		KASSERT(keg->uk_pgoff + shsize <= PAGE_SIZE * keg->uk_ppera,
2281 		    ("zone %s ipers %d rsize %d size %d slab won't fit",
2282 		    zone->uz_name, keg->uk_ipers, keg->uk_rsize, keg->uk_size));
2283 	}
2284 
2285 	if (keg->uk_flags & UMA_ZFLAG_HASH)
2286 		hash_alloc(&keg->uk_hash, 0);
2287 
2288 	CTR3(KTR_UMA, "keg_ctor %p zone %s(%p)", keg, zone->uz_name, zone);
2289 
2290 	LIST_INSERT_HEAD(&keg->uk_zones, zone, uz_link);
2291 
2292 	rw_wlock(&uma_rwlock);
2293 	LIST_INSERT_HEAD(&uma_kegs, keg, uk_link);
2294 	rw_wunlock(&uma_rwlock);
2295 	return (0);
2296 }
2297 
2298 static void
2299 zone_kva_available(uma_zone_t zone, void *unused)
2300 {
2301 	uma_keg_t keg;
2302 
2303 	if ((zone->uz_flags & UMA_ZFLAG_CACHE) != 0)
2304 		return;
2305 	KEG_GET(zone, keg);
2306 
2307 	if (keg->uk_allocf == startup_alloc) {
2308 		/* Switch to the real allocator. */
2309 		if (keg->uk_flags & UMA_ZONE_PCPU)
2310 			keg->uk_allocf = pcpu_page_alloc;
2311 		else if ((keg->uk_flags & UMA_ZONE_CONTIG) != 0 &&
2312 		    keg->uk_ppera > 1)
2313 			keg->uk_allocf = contig_alloc;
2314 		else
2315 			keg->uk_allocf = page_alloc;
2316 	}
2317 }
2318 
2319 static void
2320 zone_alloc_counters(uma_zone_t zone, void *unused)
2321 {
2322 
2323 	zone->uz_allocs = counter_u64_alloc(M_WAITOK);
2324 	zone->uz_frees = counter_u64_alloc(M_WAITOK);
2325 	zone->uz_fails = counter_u64_alloc(M_WAITOK);
2326 	zone->uz_xdomain = counter_u64_alloc(M_WAITOK);
2327 }
2328 
2329 static void
2330 zone_alloc_sysctl(uma_zone_t zone, void *unused)
2331 {
2332 	uma_zone_domain_t zdom;
2333 	uma_domain_t dom;
2334 	uma_keg_t keg;
2335 	struct sysctl_oid *oid, *domainoid;
2336 	int domains, i, cnt;
2337 	static const char *nokeg = "cache zone";
2338 	char *c;
2339 
2340 	/*
2341 	 * Make a sysctl safe copy of the zone name by removing
2342 	 * any special characters and handling dups by appending
2343 	 * an index.
2344 	 */
2345 	if (zone->uz_namecnt != 0) {
2346 		/* Count the number of decimal digits and '_' separator. */
2347 		for (i = 1, cnt = zone->uz_namecnt; cnt != 0; i++)
2348 			cnt /= 10;
2349 		zone->uz_ctlname = malloc(strlen(zone->uz_name) + i + 1,
2350 		    M_UMA, M_WAITOK);
2351 		sprintf(zone->uz_ctlname, "%s_%d", zone->uz_name,
2352 		    zone->uz_namecnt);
2353 	} else
2354 		zone->uz_ctlname = strdup(zone->uz_name, M_UMA);
2355 	for (c = zone->uz_ctlname; *c != '\0'; c++)
2356 		if (strchr("./\\ -", *c) != NULL)
2357 			*c = '_';
2358 
2359 	/*
2360 	 * Basic parameters at the root.
2361 	 */
2362 	zone->uz_oid = SYSCTL_ADD_NODE(NULL, SYSCTL_STATIC_CHILDREN(_vm_uma),
2363 	    OID_AUTO, zone->uz_ctlname, CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2364 	oid = zone->uz_oid;
2365 	SYSCTL_ADD_U32(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2366 	    "size", CTLFLAG_RD, &zone->uz_size, 0, "Allocation size");
2367 	SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2368 	    "flags", CTLFLAG_RD | CTLTYPE_STRING | CTLFLAG_MPSAFE,
2369 	    zone, 0, sysctl_handle_uma_zone_flags, "A",
2370 	    "Allocator configuration flags");
2371 	SYSCTL_ADD_U16(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2372 	    "bucket_size", CTLFLAG_RD, &zone->uz_bucket_size, 0,
2373 	    "Desired per-cpu cache size");
2374 	SYSCTL_ADD_U16(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2375 	    "bucket_size_max", CTLFLAG_RD, &zone->uz_bucket_size_max, 0,
2376 	    "Maximum allowed per-cpu cache size");
2377 
2378 	/*
2379 	 * keg if present.
2380 	 */
2381 	if ((zone->uz_flags & UMA_ZFLAG_HASH) == 0)
2382 		domains = vm_ndomains;
2383 	else
2384 		domains = 1;
2385 	oid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(zone->uz_oid), OID_AUTO,
2386 	    "keg", CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2387 	keg = zone->uz_keg;
2388 	if ((zone->uz_flags & UMA_ZFLAG_CACHE) == 0) {
2389 		SYSCTL_ADD_CONST_STRING(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2390 		    "name", CTLFLAG_RD, keg->uk_name, "Keg name");
2391 		SYSCTL_ADD_U32(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2392 		    "rsize", CTLFLAG_RD, &keg->uk_rsize, 0,
2393 		    "Real object size with alignment");
2394 		SYSCTL_ADD_U16(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2395 		    "ppera", CTLFLAG_RD, &keg->uk_ppera, 0,
2396 		    "pages per-slab allocation");
2397 		SYSCTL_ADD_U16(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2398 		    "ipers", CTLFLAG_RD, &keg->uk_ipers, 0,
2399 		    "items available per-slab");
2400 		SYSCTL_ADD_U32(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2401 		    "align", CTLFLAG_RD, &keg->uk_align, 0,
2402 		    "item alignment mask");
2403 		SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2404 		    "efficiency", CTLFLAG_RD | CTLTYPE_INT | CTLFLAG_MPSAFE,
2405 		    keg, 0, sysctl_handle_uma_slab_efficiency, "I",
2406 		    "Slab utilization (100 - internal fragmentation %)");
2407 		domainoid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(oid),
2408 		    OID_AUTO, "domain", CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2409 		for (i = 0; i < domains; i++) {
2410 			dom = &keg->uk_domain[i];
2411 			oid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(domainoid),
2412 			    OID_AUTO, VM_DOMAIN(i)->vmd_name,
2413 			    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2414 			SYSCTL_ADD_U32(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2415 			    "pages", CTLFLAG_RD, &dom->ud_pages, 0,
2416 			    "Total pages currently allocated from VM");
2417 			SYSCTL_ADD_U32(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2418 			    "free_items", CTLFLAG_RD, &dom->ud_free_items, 0,
2419 			    "items free in the slab layer");
2420 		}
2421 	} else
2422 		SYSCTL_ADD_CONST_STRING(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2423 		    "name", CTLFLAG_RD, nokeg, "Keg name");
2424 
2425 	/*
2426 	 * Information about zone limits.
2427 	 */
2428 	oid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(zone->uz_oid), OID_AUTO,
2429 	    "limit", CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2430 	SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2431 	    "items", CTLFLAG_RD | CTLTYPE_U64 | CTLFLAG_MPSAFE,
2432 	    zone, 0, sysctl_handle_uma_zone_items, "QU",
2433 	    "current number of allocated items if limit is set");
2434 	SYSCTL_ADD_U64(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2435 	    "max_items", CTLFLAG_RD, &zone->uz_max_items, 0,
2436 	    "Maximum number of cached items");
2437 	SYSCTL_ADD_U32(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2438 	    "sleepers", CTLFLAG_RD, &zone->uz_sleepers, 0,
2439 	    "Number of threads sleeping at limit");
2440 	SYSCTL_ADD_U64(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2441 	    "sleeps", CTLFLAG_RD, &zone->uz_sleeps, 0,
2442 	    "Total zone limit sleeps");
2443 	SYSCTL_ADD_U64(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2444 	    "bucket_max", CTLFLAG_RD, &zone->uz_bucket_max, 0,
2445 	    "Maximum number of items in each domain's bucket cache");
2446 
2447 	/*
2448 	 * Per-domain zone information.
2449 	 */
2450 	domainoid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(zone->uz_oid),
2451 	    OID_AUTO, "domain", CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2452 	for (i = 0; i < domains; i++) {
2453 		zdom = ZDOM_GET(zone, i);
2454 		oid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(domainoid),
2455 		    OID_AUTO, VM_DOMAIN(i)->vmd_name,
2456 		    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2457 		SYSCTL_ADD_LONG(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2458 		    "nitems", CTLFLAG_RD, &zdom->uzd_nitems,
2459 		    "number of items in this domain");
2460 		SYSCTL_ADD_LONG(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2461 		    "imax", CTLFLAG_RD, &zdom->uzd_imax,
2462 		    "maximum item count in this period");
2463 		SYSCTL_ADD_LONG(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2464 		    "imin", CTLFLAG_RD, &zdom->uzd_imin,
2465 		    "minimum item count in this period");
2466 		SYSCTL_ADD_LONG(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2467 		    "wss", CTLFLAG_RD, &zdom->uzd_wss,
2468 		    "Working set size");
2469 	}
2470 
2471 	/*
2472 	 * General statistics.
2473 	 */
2474 	oid = SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(zone->uz_oid), OID_AUTO,
2475 	    "stats", CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
2476 	SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2477 	    "current", CTLFLAG_RD | CTLTYPE_INT | CTLFLAG_MPSAFE,
2478 	    zone, 1, sysctl_handle_uma_zone_cur, "I",
2479 	    "Current number of allocated items");
2480 	SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2481 	    "allocs", CTLFLAG_RD | CTLTYPE_U64 | CTLFLAG_MPSAFE,
2482 	    zone, 0, sysctl_handle_uma_zone_allocs, "QU",
2483 	    "Total allocation calls");
2484 	SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2485 	    "frees", CTLFLAG_RD | CTLTYPE_U64 | CTLFLAG_MPSAFE,
2486 	    zone, 0, sysctl_handle_uma_zone_frees, "QU",
2487 	    "Total free calls");
2488 	SYSCTL_ADD_COUNTER_U64(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2489 	    "fails", CTLFLAG_RD, &zone->uz_fails,
2490 	    "Number of allocation failures");
2491 	SYSCTL_ADD_COUNTER_U64(NULL, SYSCTL_CHILDREN(oid), OID_AUTO,
2492 	    "xdomain", CTLFLAG_RD, &zone->uz_xdomain,
2493 	    "Free calls from the wrong domain");
2494 }
2495 
2496 struct uma_zone_count {
2497 	const char	*name;
2498 	int		count;
2499 };
2500 
2501 static void
2502 zone_count(uma_zone_t zone, void *arg)
2503 {
2504 	struct uma_zone_count *cnt;
2505 
2506 	cnt = arg;
2507 	/*
2508 	 * Some zones are rapidly created with identical names and
2509 	 * destroyed out of order.  This can lead to gaps in the count.
2510 	 * Use one greater than the maximum observed for this name.
2511 	 */
2512 	if (strcmp(zone->uz_name, cnt->name) == 0)
2513 		cnt->count = MAX(cnt->count,
2514 		    zone->uz_namecnt + 1);
2515 }
2516 
2517 static void
2518 zone_update_caches(uma_zone_t zone)
2519 {
2520 	int i;
2521 
2522 	for (i = 0; i <= mp_maxid; i++) {
2523 		cache_set_uz_size(&zone->uz_cpu[i], zone->uz_size);
2524 		cache_set_uz_flags(&zone->uz_cpu[i], zone->uz_flags);
2525 	}
2526 }
2527 
2528 /*
2529  * Zone header ctor.  This initializes all fields, locks, etc.
2530  *
2531  * Arguments/Returns follow uma_ctor specifications
2532  *	udata  Actually uma_zctor_args
2533  */
2534 static int
2535 zone_ctor(void *mem, int size, void *udata, int flags)
2536 {
2537 	struct uma_zone_count cnt;
2538 	struct uma_zctor_args *arg = udata;
2539 	uma_zone_domain_t zdom;
2540 	uma_zone_t zone = mem;
2541 	uma_zone_t z;
2542 	uma_keg_t keg;
2543 	int i;
2544 
2545 	bzero(zone, size);
2546 	zone->uz_name = arg->name;
2547 	zone->uz_ctor = arg->ctor;
2548 	zone->uz_dtor = arg->dtor;
2549 	zone->uz_init = NULL;
2550 	zone->uz_fini = NULL;
2551 	zone->uz_sleeps = 0;
2552 	zone->uz_bucket_size = 0;
2553 	zone->uz_bucket_size_min = 0;
2554 	zone->uz_bucket_size_max = BUCKET_MAX;
2555 	zone->uz_flags = (arg->flags & UMA_ZONE_SMR);
2556 	zone->uz_warning = NULL;
2557 	/* The domain structures follow the cpu structures. */
2558 	zone->uz_bucket_max = ULONG_MAX;
2559 	timevalclear(&zone->uz_ratecheck);
2560 
2561 	/* Count the number of duplicate names. */
2562 	cnt.name = arg->name;
2563 	cnt.count = 0;
2564 	zone_foreach(zone_count, &cnt);
2565 	zone->uz_namecnt = cnt.count;
2566 	ZONE_CROSS_LOCK_INIT(zone);
2567 
2568 	for (i = 0; i < vm_ndomains; i++) {
2569 		zdom = ZDOM_GET(zone, i);
2570 		ZDOM_LOCK_INIT(zone, zdom, (arg->flags & UMA_ZONE_MTXCLASS));
2571 		STAILQ_INIT(&zdom->uzd_buckets);
2572 	}
2573 
2574 #ifdef INVARIANTS
2575 	if (arg->uminit == trash_init && arg->fini == trash_fini)
2576 		zone->uz_flags |= UMA_ZFLAG_TRASH | UMA_ZFLAG_CTORDTOR;
2577 #endif
2578 
2579 	/*
2580 	 * This is a pure cache zone, no kegs.
2581 	 */
2582 	if (arg->import) {
2583 		KASSERT((arg->flags & UMA_ZFLAG_CACHE) != 0,
2584 		    ("zone_ctor: Import specified for non-cache zone."));
2585 		zone->uz_flags = arg->flags;
2586 		zone->uz_size = arg->size;
2587 		zone->uz_import = arg->import;
2588 		zone->uz_release = arg->release;
2589 		zone->uz_arg = arg->arg;
2590 #ifdef NUMA
2591 		/*
2592 		 * Cache zones are round-robin unless a policy is
2593 		 * specified because they may have incompatible
2594 		 * constraints.
2595 		 */
2596 		if ((zone->uz_flags & UMA_ZONE_FIRSTTOUCH) == 0)
2597 			zone->uz_flags |= UMA_ZONE_ROUNDROBIN;
2598 #endif
2599 		rw_wlock(&uma_rwlock);
2600 		LIST_INSERT_HEAD(&uma_cachezones, zone, uz_link);
2601 		rw_wunlock(&uma_rwlock);
2602 		goto out;
2603 	}
2604 
2605 	/*
2606 	 * Use the regular zone/keg/slab allocator.
2607 	 */
2608 	zone->uz_import = zone_import;
2609 	zone->uz_release = zone_release;
2610 	zone->uz_arg = zone;
2611 	keg = arg->keg;
2612 
2613 	if (arg->flags & UMA_ZONE_SECONDARY) {
2614 		KASSERT((zone->uz_flags & UMA_ZONE_SECONDARY) == 0,
2615 		    ("Secondary zone requested UMA_ZFLAG_INTERNAL"));
2616 		KASSERT(arg->keg != NULL, ("Secondary zone on zero'd keg"));
2617 		zone->uz_init = arg->uminit;
2618 		zone->uz_fini = arg->fini;
2619 		zone->uz_flags |= UMA_ZONE_SECONDARY;
2620 		rw_wlock(&uma_rwlock);
2621 		ZONE_LOCK(zone);
2622 		LIST_FOREACH(z, &keg->uk_zones, uz_link) {
2623 			if (LIST_NEXT(z, uz_link) == NULL) {
2624 				LIST_INSERT_AFTER(z, zone, uz_link);
2625 				break;
2626 			}
2627 		}
2628 		ZONE_UNLOCK(zone);
2629 		rw_wunlock(&uma_rwlock);
2630 	} else if (keg == NULL) {
2631 		if ((keg = uma_kcreate(zone, arg->size, arg->uminit, arg->fini,
2632 		    arg->align, arg->flags)) == NULL)
2633 			return (ENOMEM);
2634 	} else {
2635 		struct uma_kctor_args karg;
2636 		int error;
2637 
2638 		/* We should only be here from uma_startup() */
2639 		karg.size = arg->size;
2640 		karg.uminit = arg->uminit;
2641 		karg.fini = arg->fini;
2642 		karg.align = arg->align;
2643 		karg.flags = (arg->flags & ~UMA_ZONE_SMR);
2644 		karg.zone = zone;
2645 		error = keg_ctor(arg->keg, sizeof(struct uma_keg), &karg,
2646 		    flags);
2647 		if (error)
2648 			return (error);
2649 	}
2650 
2651 	/* Inherit properties from the keg. */
2652 	zone->uz_keg = keg;
2653 	zone->uz_size = keg->uk_size;
2654 	zone->uz_flags |= (keg->uk_flags &
2655 	    (UMA_ZONE_INHERIT | UMA_ZFLAG_INHERIT));
2656 
2657 out:
2658 	if (booted >= BOOT_PCPU) {
2659 		zone_alloc_counters(zone, NULL);
2660 		if (booted >= BOOT_RUNNING)
2661 			zone_alloc_sysctl(zone, NULL);
2662 	} else {
2663 		zone->uz_allocs = EARLY_COUNTER;
2664 		zone->uz_frees = EARLY_COUNTER;
2665 		zone->uz_fails = EARLY_COUNTER;
2666 	}
2667 
2668 	/* Caller requests a private SMR context. */
2669 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0)
2670 		zone->uz_smr = smr_create(zone->uz_name, 0, 0);
2671 
2672 	KASSERT((arg->flags & (UMA_ZONE_MAXBUCKET | UMA_ZONE_NOBUCKET)) !=
2673 	    (UMA_ZONE_MAXBUCKET | UMA_ZONE_NOBUCKET),
2674 	    ("Invalid zone flag combination"));
2675 	if (arg->flags & UMA_ZFLAG_INTERNAL)
2676 		zone->uz_bucket_size_max = zone->uz_bucket_size = 0;
2677 	if ((arg->flags & UMA_ZONE_MAXBUCKET) != 0)
2678 		zone->uz_bucket_size = BUCKET_MAX;
2679 	else if ((arg->flags & UMA_ZONE_MINBUCKET) != 0)
2680 		zone->uz_bucket_size_max = zone->uz_bucket_size = BUCKET_MIN;
2681 	else if ((arg->flags & UMA_ZONE_NOBUCKET) != 0)
2682 		zone->uz_bucket_size = 0;
2683 	else
2684 		zone->uz_bucket_size = bucket_select(zone->uz_size);
2685 	zone->uz_bucket_size_min = zone->uz_bucket_size;
2686 	if (zone->uz_dtor != NULL || zone->uz_ctor != NULL)
2687 		zone->uz_flags |= UMA_ZFLAG_CTORDTOR;
2688 	zone_update_caches(zone);
2689 
2690 	return (0);
2691 }
2692 
2693 /*
2694  * Keg header dtor.  This frees all data, destroys locks, frees the hash
2695  * table and removes the keg from the global list.
2696  *
2697  * Arguments/Returns follow uma_dtor specifications
2698  *	udata  unused
2699  */
2700 static void
2701 keg_dtor(void *arg, int size, void *udata)
2702 {
2703 	uma_keg_t keg;
2704 	uint32_t free, pages;
2705 	int i;
2706 
2707 	keg = (uma_keg_t)arg;
2708 	free = pages = 0;
2709 	for (i = 0; i < vm_ndomains; i++) {
2710 		free += keg->uk_domain[i].ud_free_items;
2711 		pages += keg->uk_domain[i].ud_pages;
2712 		KEG_LOCK_FINI(keg, i);
2713 	}
2714 	if (pages != 0)
2715 		printf("Freed UMA keg (%s) was not empty (%u items). "
2716 		    " Lost %u pages of memory.\n",
2717 		    keg->uk_name ? keg->uk_name : "",
2718 		    pages / keg->uk_ppera * keg->uk_ipers - free, pages);
2719 
2720 	hash_free(&keg->uk_hash);
2721 }
2722 
2723 /*
2724  * Zone header dtor.
2725  *
2726  * Arguments/Returns follow uma_dtor specifications
2727  *	udata  unused
2728  */
2729 static void
2730 zone_dtor(void *arg, int size, void *udata)
2731 {
2732 	uma_zone_t zone;
2733 	uma_keg_t keg;
2734 	int i;
2735 
2736 	zone = (uma_zone_t)arg;
2737 
2738 	sysctl_remove_oid(zone->uz_oid, 1, 1);
2739 
2740 	if (!(zone->uz_flags & UMA_ZFLAG_INTERNAL))
2741 		cache_drain(zone);
2742 
2743 	rw_wlock(&uma_rwlock);
2744 	LIST_REMOVE(zone, uz_link);
2745 	rw_wunlock(&uma_rwlock);
2746 	zone_reclaim(zone, M_WAITOK, true);
2747 
2748 	/*
2749 	 * We only destroy kegs from non secondary/non cache zones.
2750 	 */
2751 	if ((zone->uz_flags & (UMA_ZONE_SECONDARY | UMA_ZFLAG_CACHE)) == 0) {
2752 		keg = zone->uz_keg;
2753 		rw_wlock(&uma_rwlock);
2754 		LIST_REMOVE(keg, uk_link);
2755 		rw_wunlock(&uma_rwlock);
2756 		zone_free_item(kegs, keg, NULL, SKIP_NONE);
2757 	}
2758 	counter_u64_free(zone->uz_allocs);
2759 	counter_u64_free(zone->uz_frees);
2760 	counter_u64_free(zone->uz_fails);
2761 	counter_u64_free(zone->uz_xdomain);
2762 	free(zone->uz_ctlname, M_UMA);
2763 	for (i = 0; i < vm_ndomains; i++)
2764 		ZDOM_LOCK_FINI(ZDOM_GET(zone, i));
2765 	ZONE_CROSS_LOCK_FINI(zone);
2766 }
2767 
2768 static void
2769 zone_foreach_unlocked(void (*zfunc)(uma_zone_t, void *arg), void *arg)
2770 {
2771 	uma_keg_t keg;
2772 	uma_zone_t zone;
2773 
2774 	LIST_FOREACH(keg, &uma_kegs, uk_link) {
2775 		LIST_FOREACH(zone, &keg->uk_zones, uz_link)
2776 			zfunc(zone, arg);
2777 	}
2778 	LIST_FOREACH(zone, &uma_cachezones, uz_link)
2779 		zfunc(zone, arg);
2780 }
2781 
2782 /*
2783  * Traverses every zone in the system and calls a callback
2784  *
2785  * Arguments:
2786  *	zfunc  A pointer to a function which accepts a zone
2787  *		as an argument.
2788  *
2789  * Returns:
2790  *	Nothing
2791  */
2792 static void
2793 zone_foreach(void (*zfunc)(uma_zone_t, void *arg), void *arg)
2794 {
2795 
2796 	rw_rlock(&uma_rwlock);
2797 	zone_foreach_unlocked(zfunc, arg);
2798 	rw_runlock(&uma_rwlock);
2799 }
2800 
2801 /*
2802  * Initialize the kernel memory allocator.  This is done after pages can be
2803  * allocated but before general KVA is available.
2804  */
2805 void
2806 uma_startup1(vm_offset_t virtual_avail)
2807 {
2808 	struct uma_zctor_args args;
2809 	size_t ksize, zsize, size;
2810 	uma_keg_t primarykeg;
2811 	uintptr_t m;
2812 	int domain;
2813 	uint8_t pflag;
2814 
2815 	bootstart = bootmem = virtual_avail;
2816 
2817 	rw_init(&uma_rwlock, "UMA lock");
2818 	sx_init(&uma_reclaim_lock, "umareclaim");
2819 
2820 	ksize = sizeof(struct uma_keg) +
2821 	    (sizeof(struct uma_domain) * vm_ndomains);
2822 	ksize = roundup(ksize, UMA_SUPER_ALIGN);
2823 	zsize = sizeof(struct uma_zone) +
2824 	    (sizeof(struct uma_cache) * (mp_maxid + 1)) +
2825 	    (sizeof(struct uma_zone_domain) * vm_ndomains);
2826 	zsize = roundup(zsize, UMA_SUPER_ALIGN);
2827 
2828 	/* Allocate the zone of zones, zone of kegs, and zone of zones keg. */
2829 	size = (zsize * 2) + ksize;
2830 	for (domain = 0; domain < vm_ndomains; domain++) {
2831 		m = (uintptr_t)startup_alloc(NULL, size, domain, &pflag,
2832 		    M_NOWAIT | M_ZERO);
2833 		if (m != 0)
2834 			break;
2835 	}
2836 	zones = (uma_zone_t)m;
2837 	m += zsize;
2838 	kegs = (uma_zone_t)m;
2839 	m += zsize;
2840 	primarykeg = (uma_keg_t)m;
2841 
2842 	/* "manually" create the initial zone */
2843 	memset(&args, 0, sizeof(args));
2844 	args.name = "UMA Kegs";
2845 	args.size = ksize;
2846 	args.ctor = keg_ctor;
2847 	args.dtor = keg_dtor;
2848 	args.uminit = zero_init;
2849 	args.fini = NULL;
2850 	args.keg = primarykeg;
2851 	args.align = UMA_SUPER_ALIGN - 1;
2852 	args.flags = UMA_ZFLAG_INTERNAL;
2853 	zone_ctor(kegs, zsize, &args, M_WAITOK);
2854 
2855 	args.name = "UMA Zones";
2856 	args.size = zsize;
2857 	args.ctor = zone_ctor;
2858 	args.dtor = zone_dtor;
2859 	args.uminit = zero_init;
2860 	args.fini = NULL;
2861 	args.keg = NULL;
2862 	args.align = UMA_SUPER_ALIGN - 1;
2863 	args.flags = UMA_ZFLAG_INTERNAL;
2864 	zone_ctor(zones, zsize, &args, M_WAITOK);
2865 
2866 	/* Now make zones for slab headers */
2867 	slabzones[0] = uma_zcreate("UMA Slabs 0", SLABZONE0_SIZE,
2868 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
2869 	slabzones[1] = uma_zcreate("UMA Slabs 1", SLABZONE1_SIZE,
2870 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
2871 
2872 	hashzone = uma_zcreate("UMA Hash",
2873 	    sizeof(struct slabhead *) * UMA_HASH_SIZE_INIT,
2874 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZFLAG_INTERNAL);
2875 
2876 	bucket_init();
2877 	smr_init();
2878 }
2879 
2880 #ifndef UMA_MD_SMALL_ALLOC
2881 extern void vm_radix_reserve_kva(void);
2882 #endif
2883 
2884 /*
2885  * Advertise the availability of normal kva allocations and switch to
2886  * the default back-end allocator.  Marks the KVA we consumed on startup
2887  * as used in the map.
2888  */
2889 void
2890 uma_startup2(void)
2891 {
2892 
2893 	if (bootstart != bootmem) {
2894 		vm_map_lock(kernel_map);
2895 		(void)vm_map_insert(kernel_map, NULL, 0, bootstart, bootmem,
2896 		    VM_PROT_RW, VM_PROT_RW, MAP_NOFAULT);
2897 		vm_map_unlock(kernel_map);
2898 	}
2899 
2900 #ifndef UMA_MD_SMALL_ALLOC
2901 	/* Set up radix zone to use noobj_alloc. */
2902 	vm_radix_reserve_kva();
2903 #endif
2904 
2905 	booted = BOOT_KVA;
2906 	zone_foreach_unlocked(zone_kva_available, NULL);
2907 	bucket_enable();
2908 }
2909 
2910 /*
2911  * Allocate counters as early as possible so that boot-time allocations are
2912  * accounted more precisely.
2913  */
2914 static void
2915 uma_startup_pcpu(void *arg __unused)
2916 {
2917 
2918 	zone_foreach_unlocked(zone_alloc_counters, NULL);
2919 	booted = BOOT_PCPU;
2920 }
2921 SYSINIT(uma_startup_pcpu, SI_SUB_COUNTER, SI_ORDER_ANY, uma_startup_pcpu, NULL);
2922 
2923 /*
2924  * Finish our initialization steps.
2925  */
2926 static void
2927 uma_startup3(void *arg __unused)
2928 {
2929 
2930 #ifdef INVARIANTS
2931 	TUNABLE_INT_FETCH("vm.debug.divisor", &dbg_divisor);
2932 	uma_dbg_cnt = counter_u64_alloc(M_WAITOK);
2933 	uma_skip_cnt = counter_u64_alloc(M_WAITOK);
2934 #endif
2935 	zone_foreach_unlocked(zone_alloc_sysctl, NULL);
2936 	callout_init(&uma_callout, 1);
2937 	callout_reset(&uma_callout, UMA_TIMEOUT * hz, uma_timeout, NULL);
2938 	booted = BOOT_RUNNING;
2939 
2940 	EVENTHANDLER_REGISTER(shutdown_post_sync, uma_shutdown, NULL,
2941 	    EVENTHANDLER_PRI_FIRST);
2942 }
2943 SYSINIT(uma_startup3, SI_SUB_VM_CONF, SI_ORDER_SECOND, uma_startup3, NULL);
2944 
2945 static void
2946 uma_shutdown(void)
2947 {
2948 
2949 	booted = BOOT_SHUTDOWN;
2950 }
2951 
2952 static uma_keg_t
2953 uma_kcreate(uma_zone_t zone, size_t size, uma_init uminit, uma_fini fini,
2954 		int align, uint32_t flags)
2955 {
2956 	struct uma_kctor_args args;
2957 
2958 	args.size = size;
2959 	args.uminit = uminit;
2960 	args.fini = fini;
2961 	args.align = (align == UMA_ALIGN_CACHE) ? uma_align_cache : align;
2962 	args.flags = flags;
2963 	args.zone = zone;
2964 	return (zone_alloc_item(kegs, &args, UMA_ANYDOMAIN, M_WAITOK));
2965 }
2966 
2967 /* Public functions */
2968 /* See uma.h */
2969 void
2970 uma_set_align(int align)
2971 {
2972 
2973 	if (align != UMA_ALIGN_CACHE)
2974 		uma_align_cache = align;
2975 }
2976 
2977 /* See uma.h */
2978 uma_zone_t
2979 uma_zcreate(const char *name, size_t size, uma_ctor ctor, uma_dtor dtor,
2980 		uma_init uminit, uma_fini fini, int align, uint32_t flags)
2981 
2982 {
2983 	struct uma_zctor_args args;
2984 	uma_zone_t res;
2985 
2986 	KASSERT(powerof2(align + 1), ("invalid zone alignment %d for \"%s\"",
2987 	    align, name));
2988 
2989 	/* This stuff is essential for the zone ctor */
2990 	memset(&args, 0, sizeof(args));
2991 	args.name = name;
2992 	args.size = size;
2993 	args.ctor = ctor;
2994 	args.dtor = dtor;
2995 	args.uminit = uminit;
2996 	args.fini = fini;
2997 #ifdef  INVARIANTS
2998 	/*
2999 	 * Inject procedures which check for memory use after free if we are
3000 	 * allowed to scramble the memory while it is not allocated.  This
3001 	 * requires that: UMA is actually able to access the memory, no init
3002 	 * or fini procedures, no dependency on the initial value of the
3003 	 * memory, and no (legitimate) use of the memory after free.  Note,
3004 	 * the ctor and dtor do not need to be empty.
3005 	 */
3006 	if ((!(flags & (UMA_ZONE_ZINIT | UMA_ZONE_NOTOUCH |
3007 	    UMA_ZONE_NOFREE))) && uminit == NULL && fini == NULL) {
3008 		args.uminit = trash_init;
3009 		args.fini = trash_fini;
3010 	}
3011 #endif
3012 	args.align = align;
3013 	args.flags = flags;
3014 	args.keg = NULL;
3015 
3016 	sx_slock(&uma_reclaim_lock);
3017 	res = zone_alloc_item(zones, &args, UMA_ANYDOMAIN, M_WAITOK);
3018 	sx_sunlock(&uma_reclaim_lock);
3019 
3020 	return (res);
3021 }
3022 
3023 /* See uma.h */
3024 uma_zone_t
3025 uma_zsecond_create(const char *name, uma_ctor ctor, uma_dtor dtor,
3026     uma_init zinit, uma_fini zfini, uma_zone_t primary)
3027 {
3028 	struct uma_zctor_args args;
3029 	uma_keg_t keg;
3030 	uma_zone_t res;
3031 
3032 	keg = primary->uz_keg;
3033 	memset(&args, 0, sizeof(args));
3034 	args.name = name;
3035 	args.size = keg->uk_size;
3036 	args.ctor = ctor;
3037 	args.dtor = dtor;
3038 	args.uminit = zinit;
3039 	args.fini = zfini;
3040 	args.align = keg->uk_align;
3041 	args.flags = keg->uk_flags | UMA_ZONE_SECONDARY;
3042 	args.keg = keg;
3043 
3044 	sx_slock(&uma_reclaim_lock);
3045 	res = zone_alloc_item(zones, &args, UMA_ANYDOMAIN, M_WAITOK);
3046 	sx_sunlock(&uma_reclaim_lock);
3047 
3048 	return (res);
3049 }
3050 
3051 /* See uma.h */
3052 uma_zone_t
3053 uma_zcache_create(const char *name, int size, uma_ctor ctor, uma_dtor dtor,
3054     uma_init zinit, uma_fini zfini, uma_import zimport, uma_release zrelease,
3055     void *arg, int flags)
3056 {
3057 	struct uma_zctor_args args;
3058 
3059 	memset(&args, 0, sizeof(args));
3060 	args.name = name;
3061 	args.size = size;
3062 	args.ctor = ctor;
3063 	args.dtor = dtor;
3064 	args.uminit = zinit;
3065 	args.fini = zfini;
3066 	args.import = zimport;
3067 	args.release = zrelease;
3068 	args.arg = arg;
3069 	args.align = 0;
3070 	args.flags = flags | UMA_ZFLAG_CACHE;
3071 
3072 	return (zone_alloc_item(zones, &args, UMA_ANYDOMAIN, M_WAITOK));
3073 }
3074 
3075 /* See uma.h */
3076 void
3077 uma_zdestroy(uma_zone_t zone)
3078 {
3079 
3080 	/*
3081 	 * Large slabs are expensive to reclaim, so don't bother doing
3082 	 * unnecessary work if we're shutting down.
3083 	 */
3084 	if (booted == BOOT_SHUTDOWN &&
3085 	    zone->uz_fini == NULL && zone->uz_release == zone_release)
3086 		return;
3087 	sx_slock(&uma_reclaim_lock);
3088 	zone_free_item(zones, zone, NULL, SKIP_NONE);
3089 	sx_sunlock(&uma_reclaim_lock);
3090 }
3091 
3092 void
3093 uma_zwait(uma_zone_t zone)
3094 {
3095 
3096 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0)
3097 		uma_zfree_smr(zone, uma_zalloc_smr(zone, M_WAITOK));
3098 	else if ((zone->uz_flags & UMA_ZONE_PCPU) != 0)
3099 		uma_zfree_pcpu(zone, uma_zalloc_pcpu(zone, M_WAITOK));
3100 	else
3101 		uma_zfree(zone, uma_zalloc(zone, M_WAITOK));
3102 }
3103 
3104 void *
3105 uma_zalloc_pcpu_arg(uma_zone_t zone, void *udata, int flags)
3106 {
3107 	void *item, *pcpu_item;
3108 #ifdef SMP
3109 	int i;
3110 
3111 	MPASS(zone->uz_flags & UMA_ZONE_PCPU);
3112 #endif
3113 	item = uma_zalloc_arg(zone, udata, flags & ~M_ZERO);
3114 	if (item == NULL)
3115 		return (NULL);
3116 	pcpu_item = zpcpu_base_to_offset(item);
3117 	if (flags & M_ZERO) {
3118 #ifdef SMP
3119 		for (i = 0; i <= mp_maxid; i++)
3120 			bzero(zpcpu_get_cpu(pcpu_item, i), zone->uz_size);
3121 #else
3122 		bzero(item, zone->uz_size);
3123 #endif
3124 	}
3125 	return (pcpu_item);
3126 }
3127 
3128 /*
3129  * A stub while both regular and pcpu cases are identical.
3130  */
3131 void
3132 uma_zfree_pcpu_arg(uma_zone_t zone, void *pcpu_item, void *udata)
3133 {
3134 	void *item;
3135 
3136 #ifdef SMP
3137 	MPASS(zone->uz_flags & UMA_ZONE_PCPU);
3138 #endif
3139 	item = zpcpu_offset_to_base(pcpu_item);
3140 	uma_zfree_arg(zone, item, udata);
3141 }
3142 
3143 static inline void *
3144 item_ctor(uma_zone_t zone, int uz_flags, int size, void *udata, int flags,
3145     void *item)
3146 {
3147 #ifdef INVARIANTS
3148 	bool skipdbg;
3149 
3150 	skipdbg = uma_dbg_zskip(zone, item);
3151 	if (!skipdbg && (zone->uz_flags & UMA_ZFLAG_TRASH) != 0 &&
3152 	    zone->uz_ctor != trash_ctor)
3153 		trash_ctor(item, size, udata, flags);
3154 #endif
3155 	/* Check flags before loading ctor pointer. */
3156 	if (__predict_false((uz_flags & UMA_ZFLAG_CTORDTOR) != 0) &&
3157 	    __predict_false(zone->uz_ctor != NULL) &&
3158 	    zone->uz_ctor(item, size, udata, flags) != 0) {
3159 		counter_u64_add(zone->uz_fails, 1);
3160 		zone_free_item(zone, item, udata, SKIP_DTOR | SKIP_CNT);
3161 		return (NULL);
3162 	}
3163 #ifdef INVARIANTS
3164 	if (!skipdbg)
3165 		uma_dbg_alloc(zone, NULL, item);
3166 #endif
3167 	if (__predict_false(flags & M_ZERO))
3168 		return (memset(item, 0, size));
3169 
3170 	return (item);
3171 }
3172 
3173 static inline void
3174 item_dtor(uma_zone_t zone, void *item, int size, void *udata,
3175     enum zfreeskip skip)
3176 {
3177 #ifdef INVARIANTS
3178 	bool skipdbg;
3179 
3180 	skipdbg = uma_dbg_zskip(zone, item);
3181 	if (skip == SKIP_NONE && !skipdbg) {
3182 		if ((zone->uz_flags & UMA_ZONE_MALLOC) != 0)
3183 			uma_dbg_free(zone, udata, item);
3184 		else
3185 			uma_dbg_free(zone, NULL, item);
3186 	}
3187 #endif
3188 	if (__predict_true(skip < SKIP_DTOR)) {
3189 		if (zone->uz_dtor != NULL)
3190 			zone->uz_dtor(item, size, udata);
3191 #ifdef INVARIANTS
3192 		if (!skipdbg && (zone->uz_flags & UMA_ZFLAG_TRASH) != 0 &&
3193 		    zone->uz_dtor != trash_dtor)
3194 			trash_dtor(item, size, udata);
3195 #endif
3196 	}
3197 }
3198 
3199 #ifdef NUMA
3200 static int
3201 item_domain(void *item)
3202 {
3203 	int domain;
3204 
3205 	domain = _vm_phys_domain(vtophys(item));
3206 	KASSERT(domain >= 0 && domain < vm_ndomains,
3207 	    ("%s: unknown domain for item %p", __func__, item));
3208 	return (domain);
3209 }
3210 #endif
3211 
3212 #if defined(INVARIANTS) || defined(DEBUG_MEMGUARD) || defined(WITNESS)
3213 #define	UMA_ZALLOC_DEBUG
3214 static int
3215 uma_zalloc_debug(uma_zone_t zone, void **itemp, void *udata, int flags)
3216 {
3217 	int error;
3218 
3219 	error = 0;
3220 #ifdef WITNESS
3221 	if (flags & M_WAITOK) {
3222 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
3223 		    "uma_zalloc_debug: zone \"%s\"", zone->uz_name);
3224 	}
3225 #endif
3226 
3227 #ifdef INVARIANTS
3228 	KASSERT((flags & M_EXEC) == 0,
3229 	    ("uma_zalloc_debug: called with M_EXEC"));
3230 	KASSERT(curthread->td_critnest == 0 || SCHEDULER_STOPPED(),
3231 	    ("uma_zalloc_debug: called within spinlock or critical section"));
3232 	KASSERT((zone->uz_flags & UMA_ZONE_PCPU) == 0 || (flags & M_ZERO) == 0,
3233 	    ("uma_zalloc_debug: allocating from a pcpu zone with M_ZERO"));
3234 #endif
3235 
3236 #ifdef DEBUG_MEMGUARD
3237 	if ((zone->uz_flags & UMA_ZONE_SMR) == 0 && memguard_cmp_zone(zone)) {
3238 		void *item;
3239 		item = memguard_alloc(zone->uz_size, flags);
3240 		if (item != NULL) {
3241 			error = EJUSTRETURN;
3242 			if (zone->uz_init != NULL &&
3243 			    zone->uz_init(item, zone->uz_size, flags) != 0) {
3244 				*itemp = NULL;
3245 				return (error);
3246 			}
3247 			if (zone->uz_ctor != NULL &&
3248 			    zone->uz_ctor(item, zone->uz_size, udata,
3249 			    flags) != 0) {
3250 				counter_u64_add(zone->uz_fails, 1);
3251 			    	zone->uz_fini(item, zone->uz_size);
3252 				*itemp = NULL;
3253 				return (error);
3254 			}
3255 			*itemp = item;
3256 			return (error);
3257 		}
3258 		/* This is unfortunate but should not be fatal. */
3259 	}
3260 #endif
3261 	return (error);
3262 }
3263 
3264 static int
3265 uma_zfree_debug(uma_zone_t zone, void *item, void *udata)
3266 {
3267 	KASSERT(curthread->td_critnest == 0 || SCHEDULER_STOPPED(),
3268 	    ("uma_zfree_debug: called with spinlock or critical section held"));
3269 
3270 #ifdef DEBUG_MEMGUARD
3271 	if ((zone->uz_flags & UMA_ZONE_SMR) == 0 && is_memguard_addr(item)) {
3272 		if (zone->uz_dtor != NULL)
3273 			zone->uz_dtor(item, zone->uz_size, udata);
3274 		if (zone->uz_fini != NULL)
3275 			zone->uz_fini(item, zone->uz_size);
3276 		memguard_free(item);
3277 		return (EJUSTRETURN);
3278 	}
3279 #endif
3280 	return (0);
3281 }
3282 #endif
3283 
3284 static inline void *
3285 cache_alloc_item(uma_zone_t zone, uma_cache_t cache, uma_cache_bucket_t bucket,
3286     void *udata, int flags)
3287 {
3288 	void *item;
3289 	int size, uz_flags;
3290 
3291 	item = cache_bucket_pop(cache, bucket);
3292 	size = cache_uz_size(cache);
3293 	uz_flags = cache_uz_flags(cache);
3294 	critical_exit();
3295 	return (item_ctor(zone, uz_flags, size, udata, flags, item));
3296 }
3297 
3298 static __noinline void *
3299 cache_alloc_retry(uma_zone_t zone, uma_cache_t cache, void *udata, int flags)
3300 {
3301 	uma_cache_bucket_t bucket;
3302 	int domain;
3303 
3304 	while (cache_alloc(zone, cache, udata, flags)) {
3305 		cache = &zone->uz_cpu[curcpu];
3306 		bucket = &cache->uc_allocbucket;
3307 		if (__predict_false(bucket->ucb_cnt == 0))
3308 			continue;
3309 		return (cache_alloc_item(zone, cache, bucket, udata, flags));
3310 	}
3311 	critical_exit();
3312 
3313 	/*
3314 	 * We can not get a bucket so try to return a single item.
3315 	 */
3316 	if (zone->uz_flags & UMA_ZONE_FIRSTTOUCH)
3317 		domain = PCPU_GET(domain);
3318 	else
3319 		domain = UMA_ANYDOMAIN;
3320 	return (zone_alloc_item(zone, udata, domain, flags));
3321 }
3322 
3323 /* See uma.h */
3324 void *
3325 uma_zalloc_smr(uma_zone_t zone, int flags)
3326 {
3327 	uma_cache_bucket_t bucket;
3328 	uma_cache_t cache;
3329 
3330 #ifdef UMA_ZALLOC_DEBUG
3331 	void *item;
3332 
3333 	KASSERT((zone->uz_flags & UMA_ZONE_SMR) != 0,
3334 	    ("uma_zalloc_arg: called with non-SMR zone.\n"));
3335 	if (uma_zalloc_debug(zone, &item, NULL, flags) == EJUSTRETURN)
3336 		return (item);
3337 #endif
3338 
3339 	critical_enter();
3340 	cache = &zone->uz_cpu[curcpu];
3341 	bucket = &cache->uc_allocbucket;
3342 	if (__predict_false(bucket->ucb_cnt == 0))
3343 		return (cache_alloc_retry(zone, cache, NULL, flags));
3344 	return (cache_alloc_item(zone, cache, bucket, NULL, flags));
3345 }
3346 
3347 /* See uma.h */
3348 void *
3349 uma_zalloc_arg(uma_zone_t zone, void *udata, int flags)
3350 {
3351 	uma_cache_bucket_t bucket;
3352 	uma_cache_t cache;
3353 
3354 	/* Enable entropy collection for RANDOM_ENABLE_UMA kernel option */
3355 	random_harvest_fast_uma(&zone, sizeof(zone), RANDOM_UMA);
3356 
3357 	/* This is the fast path allocation */
3358 	CTR3(KTR_UMA, "uma_zalloc_arg zone %s(%p) flags %d", zone->uz_name,
3359 	    zone, flags);
3360 
3361 #ifdef UMA_ZALLOC_DEBUG
3362 	void *item;
3363 
3364 	KASSERT((zone->uz_flags & UMA_ZONE_SMR) == 0,
3365 	    ("uma_zalloc_arg: called with SMR zone.\n"));
3366 	if (uma_zalloc_debug(zone, &item, udata, flags) == EJUSTRETURN)
3367 		return (item);
3368 #endif
3369 
3370 	/*
3371 	 * If possible, allocate from the per-CPU cache.  There are two
3372 	 * requirements for safe access to the per-CPU cache: (1) the thread
3373 	 * accessing the cache must not be preempted or yield during access,
3374 	 * and (2) the thread must not migrate CPUs without switching which
3375 	 * cache it accesses.  We rely on a critical section to prevent
3376 	 * preemption and migration.  We release the critical section in
3377 	 * order to acquire the zone mutex if we are unable to allocate from
3378 	 * the current cache; when we re-acquire the critical section, we
3379 	 * must detect and handle migration if it has occurred.
3380 	 */
3381 	critical_enter();
3382 	cache = &zone->uz_cpu[curcpu];
3383 	bucket = &cache->uc_allocbucket;
3384 	if (__predict_false(bucket->ucb_cnt == 0))
3385 		return (cache_alloc_retry(zone, cache, udata, flags));
3386 	return (cache_alloc_item(zone, cache, bucket, udata, flags));
3387 }
3388 
3389 /*
3390  * Replenish an alloc bucket and possibly restore an old one.  Called in
3391  * a critical section.  Returns in a critical section.
3392  *
3393  * A false return value indicates an allocation failure.
3394  * A true return value indicates success and the caller should retry.
3395  */
3396 static __noinline bool
3397 cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags)
3398 {
3399 	uma_bucket_t bucket;
3400 	int curdomain, domain;
3401 	bool new;
3402 
3403 	CRITICAL_ASSERT(curthread);
3404 
3405 	/*
3406 	 * If we have run out of items in our alloc bucket see
3407 	 * if we can switch with the free bucket.
3408 	 *
3409 	 * SMR Zones can't re-use the free bucket until the sequence has
3410 	 * expired.
3411 	 */
3412 	if ((cache_uz_flags(cache) & UMA_ZONE_SMR) == 0 &&
3413 	    cache->uc_freebucket.ucb_cnt != 0) {
3414 		cache_bucket_swap(&cache->uc_freebucket,
3415 		    &cache->uc_allocbucket);
3416 		return (true);
3417 	}
3418 
3419 	/*
3420 	 * Discard any empty allocation bucket while we hold no locks.
3421 	 */
3422 	bucket = cache_bucket_unload_alloc(cache);
3423 	critical_exit();
3424 
3425 	if (bucket != NULL) {
3426 		KASSERT(bucket->ub_cnt == 0,
3427 		    ("cache_alloc: Entered with non-empty alloc bucket."));
3428 		bucket_free(zone, bucket, udata);
3429 	}
3430 
3431 	/*
3432 	 * Attempt to retrieve the item from the per-CPU cache has failed, so
3433 	 * we must go back to the zone.  This requires the zdom lock, so we
3434 	 * must drop the critical section, then re-acquire it when we go back
3435 	 * to the cache.  Since the critical section is released, we may be
3436 	 * preempted or migrate.  As such, make sure not to maintain any
3437 	 * thread-local state specific to the cache from prior to releasing
3438 	 * the critical section.
3439 	 */
3440 	domain = PCPU_GET(domain);
3441 	if ((cache_uz_flags(cache) & UMA_ZONE_ROUNDROBIN) != 0 ||
3442 	    VM_DOMAIN_EMPTY(domain))
3443 		domain = zone_domain_highest(zone, domain);
3444 	bucket = cache_fetch_bucket(zone, cache, domain);
3445 	if (bucket == NULL && zone->uz_bucket_size != 0 && !bucketdisable) {
3446 		bucket = zone_alloc_bucket(zone, udata, domain, flags);
3447 		new = true;
3448 	} else {
3449 		new = false;
3450 	}
3451 
3452 	CTR3(KTR_UMA, "uma_zalloc: zone %s(%p) bucket zone returned %p",
3453 	    zone->uz_name, zone, bucket);
3454 	if (bucket == NULL) {
3455 		critical_enter();
3456 		return (false);
3457 	}
3458 
3459 	/*
3460 	 * See if we lost the race or were migrated.  Cache the
3461 	 * initialized bucket to make this less likely or claim
3462 	 * the memory directly.
3463 	 */
3464 	critical_enter();
3465 	cache = &zone->uz_cpu[curcpu];
3466 	if (cache->uc_allocbucket.ucb_bucket == NULL &&
3467 	    ((cache_uz_flags(cache) & UMA_ZONE_FIRSTTOUCH) == 0 ||
3468 	    (curdomain = PCPU_GET(domain)) == domain ||
3469 	    VM_DOMAIN_EMPTY(curdomain))) {
3470 		if (new)
3471 			atomic_add_long(&ZDOM_GET(zone, domain)->uzd_imax,
3472 			    bucket->ub_cnt);
3473 		cache_bucket_load_alloc(cache, bucket);
3474 		return (true);
3475 	}
3476 
3477 	/*
3478 	 * We lost the race, release this bucket and start over.
3479 	 */
3480 	critical_exit();
3481 	zone_put_bucket(zone, domain, bucket, udata, false);
3482 	critical_enter();
3483 
3484 	return (true);
3485 }
3486 
3487 void *
3488 uma_zalloc_domain(uma_zone_t zone, void *udata, int domain, int flags)
3489 {
3490 
3491 	/* Enable entropy collection for RANDOM_ENABLE_UMA kernel option */
3492 	random_harvest_fast_uma(&zone, sizeof(zone), RANDOM_UMA);
3493 
3494 	/* This is the fast path allocation */
3495 	CTR4(KTR_UMA, "uma_zalloc_domain zone %s(%p) domain %d flags %d",
3496 	    zone->uz_name, zone, domain, flags);
3497 
3498 	if (flags & M_WAITOK) {
3499 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
3500 		    "uma_zalloc_domain: zone \"%s\"", zone->uz_name);
3501 	}
3502 	KASSERT(curthread->td_critnest == 0 || SCHEDULER_STOPPED(),
3503 	    ("uma_zalloc_domain: called with spinlock or critical section held"));
3504 
3505 	return (zone_alloc_item(zone, udata, domain, flags));
3506 }
3507 
3508 /*
3509  * Find a slab with some space.  Prefer slabs that are partially used over those
3510  * that are totally full.  This helps to reduce fragmentation.
3511  *
3512  * If 'rr' is 1, search all domains starting from 'domain'.  Otherwise check
3513  * only 'domain'.
3514  */
3515 static uma_slab_t
3516 keg_first_slab(uma_keg_t keg, int domain, bool rr)
3517 {
3518 	uma_domain_t dom;
3519 	uma_slab_t slab;
3520 	int start;
3521 
3522 	KASSERT(domain >= 0 && domain < vm_ndomains,
3523 	    ("keg_first_slab: domain %d out of range", domain));
3524 	KEG_LOCK_ASSERT(keg, domain);
3525 
3526 	slab = NULL;
3527 	start = domain;
3528 	do {
3529 		dom = &keg->uk_domain[domain];
3530 		if ((slab = LIST_FIRST(&dom->ud_part_slab)) != NULL)
3531 			return (slab);
3532 		if ((slab = LIST_FIRST(&dom->ud_free_slab)) != NULL) {
3533 			LIST_REMOVE(slab, us_link);
3534 			dom->ud_free_slabs--;
3535 			LIST_INSERT_HEAD(&dom->ud_part_slab, slab, us_link);
3536 			return (slab);
3537 		}
3538 		if (rr)
3539 			domain = (domain + 1) % vm_ndomains;
3540 	} while (domain != start);
3541 
3542 	return (NULL);
3543 }
3544 
3545 /*
3546  * Fetch an existing slab from a free or partial list.  Returns with the
3547  * keg domain lock held if a slab was found or unlocked if not.
3548  */
3549 static uma_slab_t
3550 keg_fetch_free_slab(uma_keg_t keg, int domain, bool rr, int flags)
3551 {
3552 	uma_slab_t slab;
3553 	uint32_t reserve;
3554 
3555 	/* HASH has a single free list. */
3556 	if ((keg->uk_flags & UMA_ZFLAG_HASH) != 0)
3557 		domain = 0;
3558 
3559 	KEG_LOCK(keg, domain);
3560 	reserve = (flags & M_USE_RESERVE) != 0 ? 0 : keg->uk_reserve;
3561 	if (keg->uk_domain[domain].ud_free_items <= reserve ||
3562 	    (slab = keg_first_slab(keg, domain, rr)) == NULL) {
3563 		KEG_UNLOCK(keg, domain);
3564 		return (NULL);
3565 	}
3566 	return (slab);
3567 }
3568 
3569 static uma_slab_t
3570 keg_fetch_slab(uma_keg_t keg, uma_zone_t zone, int rdomain, const int flags)
3571 {
3572 	struct vm_domainset_iter di;
3573 	uma_slab_t slab;
3574 	int aflags, domain;
3575 	bool rr;
3576 
3577 restart:
3578 	/*
3579 	 * Use the keg's policy if upper layers haven't already specified a
3580 	 * domain (as happens with first-touch zones).
3581 	 *
3582 	 * To avoid races we run the iterator with the keg lock held, but that
3583 	 * means that we cannot allow the vm_domainset layer to sleep.  Thus,
3584 	 * clear M_WAITOK and handle low memory conditions locally.
3585 	 */
3586 	rr = rdomain == UMA_ANYDOMAIN;
3587 	if (rr) {
3588 		aflags = (flags & ~M_WAITOK) | M_NOWAIT;
3589 		vm_domainset_iter_policy_ref_init(&di, &keg->uk_dr, &domain,
3590 		    &aflags);
3591 	} else {
3592 		aflags = flags;
3593 		domain = rdomain;
3594 	}
3595 
3596 	for (;;) {
3597 		slab = keg_fetch_free_slab(keg, domain, rr, flags);
3598 		if (slab != NULL)
3599 			return (slab);
3600 
3601 		/*
3602 		 * M_NOVM means don't ask at all!
3603 		 */
3604 		if (flags & M_NOVM)
3605 			break;
3606 
3607 		slab = keg_alloc_slab(keg, zone, domain, flags, aflags);
3608 		if (slab != NULL)
3609 			return (slab);
3610 		if (!rr && (flags & M_WAITOK) == 0)
3611 			break;
3612 		if (rr && vm_domainset_iter_policy(&di, &domain) != 0) {
3613 			if ((flags & M_WAITOK) != 0) {
3614 				vm_wait_doms(&keg->uk_dr.dr_policy->ds_mask, 0);
3615 				goto restart;
3616 			}
3617 			break;
3618 		}
3619 	}
3620 
3621 	/*
3622 	 * We might not have been able to get a slab but another cpu
3623 	 * could have while we were unlocked.  Check again before we
3624 	 * fail.
3625 	 */
3626 	if ((slab = keg_fetch_free_slab(keg, domain, rr, flags)) != NULL)
3627 		return (slab);
3628 
3629 	return (NULL);
3630 }
3631 
3632 static void *
3633 slab_alloc_item(uma_keg_t keg, uma_slab_t slab)
3634 {
3635 	uma_domain_t dom;
3636 	void *item;
3637 	int freei;
3638 
3639 	KEG_LOCK_ASSERT(keg, slab->us_domain);
3640 
3641 	dom = &keg->uk_domain[slab->us_domain];
3642 	freei = BIT_FFS(keg->uk_ipers, &slab->us_free) - 1;
3643 	BIT_CLR(keg->uk_ipers, freei, &slab->us_free);
3644 	item = slab_item(slab, keg, freei);
3645 	slab->us_freecount--;
3646 	dom->ud_free_items--;
3647 
3648 	/*
3649 	 * Move this slab to the full list.  It must be on the partial list, so
3650 	 * we do not need to update the free slab count.  In particular,
3651 	 * keg_fetch_slab() always returns slabs on the partial list.
3652 	 */
3653 	if (slab->us_freecount == 0) {
3654 		LIST_REMOVE(slab, us_link);
3655 		LIST_INSERT_HEAD(&dom->ud_full_slab, slab, us_link);
3656 	}
3657 
3658 	return (item);
3659 }
3660 
3661 static int
3662 zone_import(void *arg, void **bucket, int max, int domain, int flags)
3663 {
3664 	uma_domain_t dom;
3665 	uma_zone_t zone;
3666 	uma_slab_t slab;
3667 	uma_keg_t keg;
3668 #ifdef NUMA
3669 	int stripe;
3670 #endif
3671 	int i;
3672 
3673 	zone = arg;
3674 	slab = NULL;
3675 	keg = zone->uz_keg;
3676 	/* Try to keep the buckets totally full */
3677 	for (i = 0; i < max; ) {
3678 		if ((slab = keg_fetch_slab(keg, zone, domain, flags)) == NULL)
3679 			break;
3680 #ifdef NUMA
3681 		stripe = howmany(max, vm_ndomains);
3682 #endif
3683 		dom = &keg->uk_domain[slab->us_domain];
3684 		while (slab->us_freecount && i < max) {
3685 			bucket[i++] = slab_alloc_item(keg, slab);
3686 			if (dom->ud_free_items <= keg->uk_reserve)
3687 				break;
3688 #ifdef NUMA
3689 			/*
3690 			 * If the zone is striped we pick a new slab for every
3691 			 * N allocations.  Eliminating this conditional will
3692 			 * instead pick a new domain for each bucket rather
3693 			 * than stripe within each bucket.  The current option
3694 			 * produces more fragmentation and requires more cpu
3695 			 * time but yields better distribution.
3696 			 */
3697 			if ((zone->uz_flags & UMA_ZONE_ROUNDROBIN) != 0 &&
3698 			    vm_ndomains > 1 && --stripe == 0)
3699 				break;
3700 #endif
3701 		}
3702 		KEG_UNLOCK(keg, slab->us_domain);
3703 		/* Don't block if we allocated any successfully. */
3704 		flags &= ~M_WAITOK;
3705 		flags |= M_NOWAIT;
3706 	}
3707 
3708 	return i;
3709 }
3710 
3711 static int
3712 zone_alloc_limit_hard(uma_zone_t zone, int count, int flags)
3713 {
3714 	uint64_t old, new, total, max;
3715 
3716 	/*
3717 	 * The hard case.  We're going to sleep because there were existing
3718 	 * sleepers or because we ran out of items.  This routine enforces
3719 	 * fairness by keeping fifo order.
3720 	 *
3721 	 * First release our ill gotten gains and make some noise.
3722 	 */
3723 	for (;;) {
3724 		zone_free_limit(zone, count);
3725 		zone_log_warning(zone);
3726 		zone_maxaction(zone);
3727 		if (flags & M_NOWAIT)
3728 			return (0);
3729 
3730 		/*
3731 		 * We need to allocate an item or set ourself as a sleeper
3732 		 * while the sleepq lock is held to avoid wakeup races.  This
3733 		 * is essentially a home rolled semaphore.
3734 		 */
3735 		sleepq_lock(&zone->uz_max_items);
3736 		old = zone->uz_items;
3737 		do {
3738 			MPASS(UZ_ITEMS_SLEEPERS(old) < UZ_ITEMS_SLEEPERS_MAX);
3739 			/* Cache the max since we will evaluate twice. */
3740 			max = zone->uz_max_items;
3741 			if (UZ_ITEMS_SLEEPERS(old) != 0 ||
3742 			    UZ_ITEMS_COUNT(old) >= max)
3743 				new = old + UZ_ITEMS_SLEEPER;
3744 			else
3745 				new = old + MIN(count, max - old);
3746 		} while (atomic_fcmpset_64(&zone->uz_items, &old, new) == 0);
3747 
3748 		/* We may have successfully allocated under the sleepq lock. */
3749 		if (UZ_ITEMS_SLEEPERS(new) == 0) {
3750 			sleepq_release(&zone->uz_max_items);
3751 			return (new - old);
3752 		}
3753 
3754 		/*
3755 		 * This is in a different cacheline from uz_items so that we
3756 		 * don't constantly invalidate the fastpath cacheline when we
3757 		 * adjust item counts.  This could be limited to toggling on
3758 		 * transitions.
3759 		 */
3760 		atomic_add_32(&zone->uz_sleepers, 1);
3761 		atomic_add_64(&zone->uz_sleeps, 1);
3762 
3763 		/*
3764 		 * We have added ourselves as a sleeper.  The sleepq lock
3765 		 * protects us from wakeup races.  Sleep now and then retry.
3766 		 */
3767 		sleepq_add(&zone->uz_max_items, NULL, "zonelimit", 0, 0);
3768 		sleepq_wait(&zone->uz_max_items, PVM);
3769 
3770 		/*
3771 		 * After wakeup, remove ourselves as a sleeper and try
3772 		 * again.  We no longer have the sleepq lock for protection.
3773 		 *
3774 		 * Subract ourselves as a sleeper while attempting to add
3775 		 * our count.
3776 		 */
3777 		atomic_subtract_32(&zone->uz_sleepers, 1);
3778 		old = atomic_fetchadd_64(&zone->uz_items,
3779 		    -(UZ_ITEMS_SLEEPER - count));
3780 		/* We're no longer a sleeper. */
3781 		old -= UZ_ITEMS_SLEEPER;
3782 
3783 		/*
3784 		 * If we're still at the limit, restart.  Notably do not
3785 		 * block on other sleepers.  Cache the max value to protect
3786 		 * against changes via sysctl.
3787 		 */
3788 		total = UZ_ITEMS_COUNT(old);
3789 		max = zone->uz_max_items;
3790 		if (total >= max)
3791 			continue;
3792 		/* Truncate if necessary, otherwise wake other sleepers. */
3793 		if (total + count > max) {
3794 			zone_free_limit(zone, total + count - max);
3795 			count = max - total;
3796 		} else if (total + count < max && UZ_ITEMS_SLEEPERS(old) != 0)
3797 			wakeup_one(&zone->uz_max_items);
3798 
3799 		return (count);
3800 	}
3801 }
3802 
3803 /*
3804  * Allocate 'count' items from our max_items limit.  Returns the number
3805  * available.  If M_NOWAIT is not specified it will sleep until at least
3806  * one item can be allocated.
3807  */
3808 static int
3809 zone_alloc_limit(uma_zone_t zone, int count, int flags)
3810 {
3811 	uint64_t old;
3812 	uint64_t max;
3813 
3814 	max = zone->uz_max_items;
3815 	MPASS(max > 0);
3816 
3817 	/*
3818 	 * We expect normal allocations to succeed with a simple
3819 	 * fetchadd.
3820 	 */
3821 	old = atomic_fetchadd_64(&zone->uz_items, count);
3822 	if (__predict_true(old + count <= max))
3823 		return (count);
3824 
3825 	/*
3826 	 * If we had some items and no sleepers just return the
3827 	 * truncated value.  We have to release the excess space
3828 	 * though because that may wake sleepers who weren't woken
3829 	 * because we were temporarily over the limit.
3830 	 */
3831 	if (old < max) {
3832 		zone_free_limit(zone, (old + count) - max);
3833 		return (max - old);
3834 	}
3835 	return (zone_alloc_limit_hard(zone, count, flags));
3836 }
3837 
3838 /*
3839  * Free a number of items back to the limit.
3840  */
3841 static void
3842 zone_free_limit(uma_zone_t zone, int count)
3843 {
3844 	uint64_t old;
3845 
3846 	MPASS(count > 0);
3847 
3848 	/*
3849 	 * In the common case we either have no sleepers or
3850 	 * are still over the limit and can just return.
3851 	 */
3852 	old = atomic_fetchadd_64(&zone->uz_items, -count);
3853 	if (__predict_true(UZ_ITEMS_SLEEPERS(old) == 0 ||
3854 	   UZ_ITEMS_COUNT(old) - count >= zone->uz_max_items))
3855 		return;
3856 
3857 	/*
3858 	 * Moderate the rate of wakeups.  Sleepers will continue
3859 	 * to generate wakeups if necessary.
3860 	 */
3861 	wakeup_one(&zone->uz_max_items);
3862 }
3863 
3864 static uma_bucket_t
3865 zone_alloc_bucket(uma_zone_t zone, void *udata, int domain, int flags)
3866 {
3867 	uma_bucket_t bucket;
3868 	int maxbucket, cnt;
3869 
3870 	CTR3(KTR_UMA, "zone_alloc_bucket zone %s(%p) domain %d", zone->uz_name,
3871 	    zone, domain);
3872 
3873 	/* Avoid allocs targeting empty domains. */
3874 	if (domain != UMA_ANYDOMAIN && VM_DOMAIN_EMPTY(domain))
3875 		domain = UMA_ANYDOMAIN;
3876 	else if ((zone->uz_flags & UMA_ZONE_ROUNDROBIN) != 0)
3877 		domain = UMA_ANYDOMAIN;
3878 
3879 	if (zone->uz_max_items > 0)
3880 		maxbucket = zone_alloc_limit(zone, zone->uz_bucket_size,
3881 		    M_NOWAIT);
3882 	else
3883 		maxbucket = zone->uz_bucket_size;
3884 	if (maxbucket == 0)
3885 		return (false);
3886 
3887 	/* Don't wait for buckets, preserve caller's NOVM setting. */
3888 	bucket = bucket_alloc(zone, udata, M_NOWAIT | (flags & M_NOVM));
3889 	if (bucket == NULL) {
3890 		cnt = 0;
3891 		goto out;
3892 	}
3893 
3894 	bucket->ub_cnt = zone->uz_import(zone->uz_arg, bucket->ub_bucket,
3895 	    MIN(maxbucket, bucket->ub_entries), domain, flags);
3896 
3897 	/*
3898 	 * Initialize the memory if necessary.
3899 	 */
3900 	if (bucket->ub_cnt != 0 && zone->uz_init != NULL) {
3901 		int i;
3902 
3903 		for (i = 0; i < bucket->ub_cnt; i++)
3904 			if (zone->uz_init(bucket->ub_bucket[i], zone->uz_size,
3905 			    flags) != 0)
3906 				break;
3907 		/*
3908 		 * If we couldn't initialize the whole bucket, put the
3909 		 * rest back onto the freelist.
3910 		 */
3911 		if (i != bucket->ub_cnt) {
3912 			zone->uz_release(zone->uz_arg, &bucket->ub_bucket[i],
3913 			    bucket->ub_cnt - i);
3914 #ifdef INVARIANTS
3915 			bzero(&bucket->ub_bucket[i],
3916 			    sizeof(void *) * (bucket->ub_cnt - i));
3917 #endif
3918 			bucket->ub_cnt = i;
3919 		}
3920 	}
3921 
3922 	cnt = bucket->ub_cnt;
3923 	if (bucket->ub_cnt == 0) {
3924 		bucket_free(zone, bucket, udata);
3925 		counter_u64_add(zone->uz_fails, 1);
3926 		bucket = NULL;
3927 	}
3928 out:
3929 	if (zone->uz_max_items > 0 && cnt < maxbucket)
3930 		zone_free_limit(zone, maxbucket - cnt);
3931 
3932 	return (bucket);
3933 }
3934 
3935 /*
3936  * Allocates a single item from a zone.
3937  *
3938  * Arguments
3939  *	zone   The zone to alloc for.
3940  *	udata  The data to be passed to the constructor.
3941  *	domain The domain to allocate from or UMA_ANYDOMAIN.
3942  *	flags  M_WAITOK, M_NOWAIT, M_ZERO.
3943  *
3944  * Returns
3945  *	NULL if there is no memory and M_NOWAIT is set
3946  *	An item if successful
3947  */
3948 
3949 static void *
3950 zone_alloc_item(uma_zone_t zone, void *udata, int domain, int flags)
3951 {
3952 	void *item;
3953 
3954 	if (zone->uz_max_items > 0 && zone_alloc_limit(zone, 1, flags) == 0) {
3955 		counter_u64_add(zone->uz_fails, 1);
3956 		return (NULL);
3957 	}
3958 
3959 	/* Avoid allocs targeting empty domains. */
3960 	if (domain != UMA_ANYDOMAIN && VM_DOMAIN_EMPTY(domain))
3961 		domain = UMA_ANYDOMAIN;
3962 
3963 	if (zone->uz_import(zone->uz_arg, &item, 1, domain, flags) != 1)
3964 		goto fail_cnt;
3965 
3966 	/*
3967 	 * We have to call both the zone's init (not the keg's init)
3968 	 * and the zone's ctor.  This is because the item is going from
3969 	 * a keg slab directly to the user, and the user is expecting it
3970 	 * to be both zone-init'd as well as zone-ctor'd.
3971 	 */
3972 	if (zone->uz_init != NULL) {
3973 		if (zone->uz_init(item, zone->uz_size, flags) != 0) {
3974 			zone_free_item(zone, item, udata, SKIP_FINI | SKIP_CNT);
3975 			goto fail_cnt;
3976 		}
3977 	}
3978 	item = item_ctor(zone, zone->uz_flags, zone->uz_size, udata, flags,
3979 	    item);
3980 	if (item == NULL)
3981 		goto fail;
3982 
3983 	counter_u64_add(zone->uz_allocs, 1);
3984 	CTR3(KTR_UMA, "zone_alloc_item item %p from %s(%p)", item,
3985 	    zone->uz_name, zone);
3986 
3987 	return (item);
3988 
3989 fail_cnt:
3990 	counter_u64_add(zone->uz_fails, 1);
3991 fail:
3992 	if (zone->uz_max_items > 0)
3993 		zone_free_limit(zone, 1);
3994 	CTR2(KTR_UMA, "zone_alloc_item failed from %s(%p)",
3995 	    zone->uz_name, zone);
3996 
3997 	return (NULL);
3998 }
3999 
4000 /* See uma.h */
4001 void
4002 uma_zfree_smr(uma_zone_t zone, void *item)
4003 {
4004 	uma_cache_t cache;
4005 	uma_cache_bucket_t bucket;
4006 	int itemdomain, uz_flags;
4007 
4008 #ifdef UMA_ZALLOC_DEBUG
4009 	KASSERT((zone->uz_flags & UMA_ZONE_SMR) != 0,
4010 	    ("uma_zfree_smr: called with non-SMR zone.\n"));
4011 	KASSERT(item != NULL, ("uma_zfree_smr: Called with NULL pointer."));
4012 	SMR_ASSERT_NOT_ENTERED(zone->uz_smr);
4013 	if (uma_zfree_debug(zone, item, NULL) == EJUSTRETURN)
4014 		return;
4015 #endif
4016 	cache = &zone->uz_cpu[curcpu];
4017 	uz_flags = cache_uz_flags(cache);
4018 	itemdomain = 0;
4019 #ifdef NUMA
4020 	if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0)
4021 		itemdomain = item_domain(item);
4022 #endif
4023 	critical_enter();
4024 	do {
4025 		cache = &zone->uz_cpu[curcpu];
4026 		/* SMR Zones must free to the free bucket. */
4027 		bucket = &cache->uc_freebucket;
4028 #ifdef NUMA
4029 		if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0 &&
4030 		    PCPU_GET(domain) != itemdomain) {
4031 			bucket = &cache->uc_crossbucket;
4032 		}
4033 #endif
4034 		if (__predict_true(bucket->ucb_cnt < bucket->ucb_entries)) {
4035 			cache_bucket_push(cache, bucket, item);
4036 			critical_exit();
4037 			return;
4038 		}
4039 	} while (cache_free(zone, cache, NULL, item, itemdomain));
4040 	critical_exit();
4041 
4042 	/*
4043 	 * If nothing else caught this, we'll just do an internal free.
4044 	 */
4045 	zone_free_item(zone, item, NULL, SKIP_NONE);
4046 }
4047 
4048 /* See uma.h */
4049 void
4050 uma_zfree_arg(uma_zone_t zone, void *item, void *udata)
4051 {
4052 	uma_cache_t cache;
4053 	uma_cache_bucket_t bucket;
4054 	int itemdomain, uz_flags;
4055 
4056 	/* Enable entropy collection for RANDOM_ENABLE_UMA kernel option */
4057 	random_harvest_fast_uma(&zone, sizeof(zone), RANDOM_UMA);
4058 
4059 	CTR2(KTR_UMA, "uma_zfree_arg zone %s(%p)", zone->uz_name, zone);
4060 
4061 #ifdef UMA_ZALLOC_DEBUG
4062 	KASSERT((zone->uz_flags & UMA_ZONE_SMR) == 0,
4063 	    ("uma_zfree_arg: called with SMR zone.\n"));
4064 	if (uma_zfree_debug(zone, item, udata) == EJUSTRETURN)
4065 		return;
4066 #endif
4067         /* uma_zfree(..., NULL) does nothing, to match free(9). */
4068         if (item == NULL)
4069                 return;
4070 
4071 	/*
4072 	 * We are accessing the per-cpu cache without a critical section to
4073 	 * fetch size and flags.  This is acceptable, if we are preempted we
4074 	 * will simply read another cpu's line.
4075 	 */
4076 	cache = &zone->uz_cpu[curcpu];
4077 	uz_flags = cache_uz_flags(cache);
4078 	if (UMA_ALWAYS_CTORDTOR ||
4079 	    __predict_false((uz_flags & UMA_ZFLAG_CTORDTOR) != 0))
4080 		item_dtor(zone, item, cache_uz_size(cache), udata, SKIP_NONE);
4081 
4082 	/*
4083 	 * The race here is acceptable.  If we miss it we'll just have to wait
4084 	 * a little longer for the limits to be reset.
4085 	 */
4086 	if (__predict_false(uz_flags & UMA_ZFLAG_LIMIT)) {
4087 		if (zone->uz_sleepers > 0)
4088 			goto zfree_item;
4089 	}
4090 
4091 	/*
4092 	 * If possible, free to the per-CPU cache.  There are two
4093 	 * requirements for safe access to the per-CPU cache: (1) the thread
4094 	 * accessing the cache must not be preempted or yield during access,
4095 	 * and (2) the thread must not migrate CPUs without switching which
4096 	 * cache it accesses.  We rely on a critical section to prevent
4097 	 * preemption and migration.  We release the critical section in
4098 	 * order to acquire the zone mutex if we are unable to free to the
4099 	 * current cache; when we re-acquire the critical section, we must
4100 	 * detect and handle migration if it has occurred.
4101 	 */
4102 	itemdomain = 0;
4103 #ifdef NUMA
4104 	if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0)
4105 		itemdomain = item_domain(item);
4106 #endif
4107 	critical_enter();
4108 	do {
4109 		cache = &zone->uz_cpu[curcpu];
4110 		/*
4111 		 * Try to free into the allocbucket first to give LIFO
4112 		 * ordering for cache-hot datastructures.  Spill over
4113 		 * into the freebucket if necessary.  Alloc will swap
4114 		 * them if one runs dry.
4115 		 */
4116 		bucket = &cache->uc_allocbucket;
4117 #ifdef NUMA
4118 		if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0 &&
4119 		    PCPU_GET(domain) != itemdomain) {
4120 			bucket = &cache->uc_crossbucket;
4121 		} else
4122 #endif
4123 		if (bucket->ucb_cnt == bucket->ucb_entries &&
4124 		   cache->uc_freebucket.ucb_cnt <
4125 		   cache->uc_freebucket.ucb_entries)
4126 			cache_bucket_swap(&cache->uc_freebucket,
4127 			    &cache->uc_allocbucket);
4128 		if (__predict_true(bucket->ucb_cnt < bucket->ucb_entries)) {
4129 			cache_bucket_push(cache, bucket, item);
4130 			critical_exit();
4131 			return;
4132 		}
4133 	} while (cache_free(zone, cache, udata, item, itemdomain));
4134 	critical_exit();
4135 
4136 	/*
4137 	 * If nothing else caught this, we'll just do an internal free.
4138 	 */
4139 zfree_item:
4140 	zone_free_item(zone, item, udata, SKIP_DTOR);
4141 }
4142 
4143 #ifdef NUMA
4144 /*
4145  * sort crossdomain free buckets to domain correct buckets and cache
4146  * them.
4147  */
4148 static void
4149 zone_free_cross(uma_zone_t zone, uma_bucket_t bucket, void *udata)
4150 {
4151 	struct uma_bucketlist fullbuckets;
4152 	uma_zone_domain_t zdom;
4153 	uma_bucket_t b;
4154 	smr_seq_t seq;
4155 	void *item;
4156 	int domain;
4157 
4158 	CTR3(KTR_UMA,
4159 	    "uma_zfree: zone %s(%p) draining cross bucket %p",
4160 	    zone->uz_name, zone, bucket);
4161 
4162 	/*
4163 	 * It is possible for buckets to arrive here out of order so we fetch
4164 	 * the current smr seq rather than accepting the bucket's.
4165 	 */
4166 	seq = SMR_SEQ_INVALID;
4167 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0)
4168 		seq = smr_advance(zone->uz_smr);
4169 
4170 	/*
4171 	 * To avoid having ndomain * ndomain buckets for sorting we have a
4172 	 * lock on the current crossfree bucket.  A full matrix with
4173 	 * per-domain locking could be used if necessary.
4174 	 */
4175 	STAILQ_INIT(&fullbuckets);
4176 	ZONE_CROSS_LOCK(zone);
4177 	while (bucket->ub_cnt > 0) {
4178 		item = bucket->ub_bucket[bucket->ub_cnt - 1];
4179 		domain = item_domain(item);
4180 		zdom = ZDOM_GET(zone, domain);
4181 		if (zdom->uzd_cross == NULL) {
4182 			zdom->uzd_cross = bucket_alloc(zone, udata, M_NOWAIT);
4183 			if (zdom->uzd_cross == NULL)
4184 				break;
4185 		}
4186 		b = zdom->uzd_cross;
4187 		b->ub_bucket[b->ub_cnt++] = item;
4188 		b->ub_seq = seq;
4189 		if (b->ub_cnt == b->ub_entries) {
4190 			STAILQ_INSERT_HEAD(&fullbuckets, b, ub_link);
4191 			zdom->uzd_cross = NULL;
4192 		}
4193 		bucket->ub_cnt--;
4194 	}
4195 	ZONE_CROSS_UNLOCK(zone);
4196 	if (bucket->ub_cnt == 0)
4197 		bucket->ub_seq = SMR_SEQ_INVALID;
4198 	bucket_free(zone, bucket, udata);
4199 
4200 	while ((b = STAILQ_FIRST(&fullbuckets)) != NULL) {
4201 		STAILQ_REMOVE_HEAD(&fullbuckets, ub_link);
4202 		domain = item_domain(b->ub_bucket[0]);
4203 		zone_put_bucket(zone, domain, b, udata, true);
4204 	}
4205 }
4206 #endif
4207 
4208 static void
4209 zone_free_bucket(uma_zone_t zone, uma_bucket_t bucket, void *udata,
4210     int itemdomain, bool ws)
4211 {
4212 
4213 #ifdef NUMA
4214 	/*
4215 	 * Buckets coming from the wrong domain will be entirely for the
4216 	 * only other domain on two domain systems.  In this case we can
4217 	 * simply cache them.  Otherwise we need to sort them back to
4218 	 * correct domains.
4219 	 */
4220 	if ((zone->uz_flags & UMA_ZONE_FIRSTTOUCH) != 0 &&
4221 	    vm_ndomains > 2 && PCPU_GET(domain) != itemdomain) {
4222 		zone_free_cross(zone, bucket, udata);
4223 		return;
4224 	}
4225 #endif
4226 
4227 	/*
4228 	 * Attempt to save the bucket in the zone's domain bucket cache.
4229 	 */
4230 	CTR3(KTR_UMA,
4231 	    "uma_zfree: zone %s(%p) putting bucket %p on free list",
4232 	    zone->uz_name, zone, bucket);
4233 	/* ub_cnt is pointing to the last free item */
4234 	if ((zone->uz_flags & UMA_ZONE_ROUNDROBIN) != 0)
4235 		itemdomain = zone_domain_lowest(zone, itemdomain);
4236 	zone_put_bucket(zone, itemdomain, bucket, udata, ws);
4237 }
4238 
4239 /*
4240  * Populate a free or cross bucket for the current cpu cache.  Free any
4241  * existing full bucket either to the zone cache or back to the slab layer.
4242  *
4243  * Enters and returns in a critical section.  false return indicates that
4244  * we can not satisfy this free in the cache layer.  true indicates that
4245  * the caller should retry.
4246  */
4247 static __noinline bool
4248 cache_free(uma_zone_t zone, uma_cache_t cache, void *udata, void *item,
4249     int itemdomain)
4250 {
4251 	uma_cache_bucket_t cbucket;
4252 	uma_bucket_t newbucket, bucket;
4253 
4254 	CRITICAL_ASSERT(curthread);
4255 
4256 	if (zone->uz_bucket_size == 0)
4257 		return false;
4258 
4259 	cache = &zone->uz_cpu[curcpu];
4260 	newbucket = NULL;
4261 
4262 	/*
4263 	 * FIRSTTOUCH domains need to free to the correct zdom.  When
4264 	 * enabled this is the zdom of the item.   The bucket is the
4265 	 * cross bucket if the current domain and itemdomain do not match.
4266 	 */
4267 	cbucket = &cache->uc_freebucket;
4268 #ifdef NUMA
4269 	if ((cache_uz_flags(cache) & UMA_ZONE_FIRSTTOUCH) != 0) {
4270 		if (PCPU_GET(domain) != itemdomain) {
4271 			cbucket = &cache->uc_crossbucket;
4272 			if (cbucket->ucb_cnt != 0)
4273 				counter_u64_add(zone->uz_xdomain,
4274 				    cbucket->ucb_cnt);
4275 		}
4276 	}
4277 #endif
4278 	bucket = cache_bucket_unload(cbucket);
4279 	KASSERT(bucket == NULL || bucket->ub_cnt == bucket->ub_entries,
4280 	    ("cache_free: Entered with non-full free bucket."));
4281 
4282 	/* We are no longer associated with this CPU. */
4283 	critical_exit();
4284 
4285 	/*
4286 	 * Don't let SMR zones operate without a free bucket.  Force
4287 	 * a synchronize and re-use this one.  We will only degrade
4288 	 * to a synchronize every bucket_size items rather than every
4289 	 * item if we fail to allocate a bucket.
4290 	 */
4291 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0) {
4292 		if (bucket != NULL)
4293 			bucket->ub_seq = smr_advance(zone->uz_smr);
4294 		newbucket = bucket_alloc(zone, udata, M_NOWAIT);
4295 		if (newbucket == NULL && bucket != NULL) {
4296 			bucket_drain(zone, bucket);
4297 			newbucket = bucket;
4298 			bucket = NULL;
4299 		}
4300 	} else if (!bucketdisable)
4301 		newbucket = bucket_alloc(zone, udata, M_NOWAIT);
4302 
4303 	if (bucket != NULL)
4304 		zone_free_bucket(zone, bucket, udata, itemdomain, true);
4305 
4306 	critical_enter();
4307 	if ((bucket = newbucket) == NULL)
4308 		return (false);
4309 	cache = &zone->uz_cpu[curcpu];
4310 #ifdef NUMA
4311 	/*
4312 	 * Check to see if we should be populating the cross bucket.  If it
4313 	 * is already populated we will fall through and attempt to populate
4314 	 * the free bucket.
4315 	 */
4316 	if ((cache_uz_flags(cache) & UMA_ZONE_FIRSTTOUCH) != 0) {
4317 		if (PCPU_GET(domain) != itemdomain &&
4318 		    cache->uc_crossbucket.ucb_bucket == NULL) {
4319 			cache_bucket_load_cross(cache, bucket);
4320 			return (true);
4321 		}
4322 	}
4323 #endif
4324 	/*
4325 	 * We may have lost the race to fill the bucket or switched CPUs.
4326 	 */
4327 	if (cache->uc_freebucket.ucb_bucket != NULL) {
4328 		critical_exit();
4329 		bucket_free(zone, bucket, udata);
4330 		critical_enter();
4331 	} else
4332 		cache_bucket_load_free(cache, bucket);
4333 
4334 	return (true);
4335 }
4336 
4337 static void
4338 slab_free_item(uma_zone_t zone, uma_slab_t slab, void *item)
4339 {
4340 	uma_keg_t keg;
4341 	uma_domain_t dom;
4342 	int freei;
4343 
4344 	keg = zone->uz_keg;
4345 	KEG_LOCK_ASSERT(keg, slab->us_domain);
4346 
4347 	/* Do we need to remove from any lists? */
4348 	dom = &keg->uk_domain[slab->us_domain];
4349 	if (slab->us_freecount + 1 == keg->uk_ipers) {
4350 		LIST_REMOVE(slab, us_link);
4351 		LIST_INSERT_HEAD(&dom->ud_free_slab, slab, us_link);
4352 		dom->ud_free_slabs++;
4353 	} else if (slab->us_freecount == 0) {
4354 		LIST_REMOVE(slab, us_link);
4355 		LIST_INSERT_HEAD(&dom->ud_part_slab, slab, us_link);
4356 	}
4357 
4358 	/* Slab management. */
4359 	freei = slab_item_index(slab, keg, item);
4360 	BIT_SET(keg->uk_ipers, freei, &slab->us_free);
4361 	slab->us_freecount++;
4362 
4363 	/* Keg statistics. */
4364 	dom->ud_free_items++;
4365 }
4366 
4367 static void
4368 zone_release(void *arg, void **bucket, int cnt)
4369 {
4370 	struct mtx *lock;
4371 	uma_zone_t zone;
4372 	uma_slab_t slab;
4373 	uma_keg_t keg;
4374 	uint8_t *mem;
4375 	void *item;
4376 	int i;
4377 
4378 	zone = arg;
4379 	keg = zone->uz_keg;
4380 	lock = NULL;
4381 	if (__predict_false((zone->uz_flags & UMA_ZFLAG_HASH) != 0))
4382 		lock = KEG_LOCK(keg, 0);
4383 	for (i = 0; i < cnt; i++) {
4384 		item = bucket[i];
4385 		if (__predict_true((zone->uz_flags & UMA_ZFLAG_VTOSLAB) != 0)) {
4386 			slab = vtoslab((vm_offset_t)item);
4387 		} else {
4388 			mem = (uint8_t *)((uintptr_t)item & (~UMA_SLAB_MASK));
4389 			if ((zone->uz_flags & UMA_ZFLAG_HASH) != 0)
4390 				slab = hash_sfind(&keg->uk_hash, mem);
4391 			else
4392 				slab = (uma_slab_t)(mem + keg->uk_pgoff);
4393 		}
4394 		if (lock != KEG_LOCKPTR(keg, slab->us_domain)) {
4395 			if (lock != NULL)
4396 				mtx_unlock(lock);
4397 			lock = KEG_LOCK(keg, slab->us_domain);
4398 		}
4399 		slab_free_item(zone, slab, item);
4400 	}
4401 	if (lock != NULL)
4402 		mtx_unlock(lock);
4403 }
4404 
4405 /*
4406  * Frees a single item to any zone.
4407  *
4408  * Arguments:
4409  *	zone   The zone to free to
4410  *	item   The item we're freeing
4411  *	udata  User supplied data for the dtor
4412  *	skip   Skip dtors and finis
4413  */
4414 static __noinline void
4415 zone_free_item(uma_zone_t zone, void *item, void *udata, enum zfreeskip skip)
4416 {
4417 
4418 	/*
4419 	 * If a free is sent directly to an SMR zone we have to
4420 	 * synchronize immediately because the item can instantly
4421 	 * be reallocated. This should only happen in degenerate
4422 	 * cases when no memory is available for per-cpu caches.
4423 	 */
4424 	if ((zone->uz_flags & UMA_ZONE_SMR) != 0 && skip == SKIP_NONE)
4425 		smr_synchronize(zone->uz_smr);
4426 
4427 	item_dtor(zone, item, zone->uz_size, udata, skip);
4428 
4429 	if (skip < SKIP_FINI && zone->uz_fini)
4430 		zone->uz_fini(item, zone->uz_size);
4431 
4432 	zone->uz_release(zone->uz_arg, &item, 1);
4433 
4434 	if (skip & SKIP_CNT)
4435 		return;
4436 
4437 	counter_u64_add(zone->uz_frees, 1);
4438 
4439 	if (zone->uz_max_items > 0)
4440 		zone_free_limit(zone, 1);
4441 }
4442 
4443 /* See uma.h */
4444 int
4445 uma_zone_set_max(uma_zone_t zone, int nitems)
4446 {
4447 	struct uma_bucket_zone *ubz;
4448 	int count;
4449 
4450 	/*
4451 	 * XXX This can misbehave if the zone has any allocations with
4452 	 * no limit and a limit is imposed.  There is currently no
4453 	 * way to clear a limit.
4454 	 */
4455 	ZONE_LOCK(zone);
4456 	ubz = bucket_zone_max(zone, nitems);
4457 	count = ubz != NULL ? ubz->ubz_entries : 0;
4458 	zone->uz_bucket_size_max = zone->uz_bucket_size = count;
4459 	if (zone->uz_bucket_size_min > zone->uz_bucket_size_max)
4460 		zone->uz_bucket_size_min = zone->uz_bucket_size_max;
4461 	zone->uz_max_items = nitems;
4462 	zone->uz_flags |= UMA_ZFLAG_LIMIT;
4463 	zone_update_caches(zone);
4464 	/* We may need to wake waiters. */
4465 	wakeup(&zone->uz_max_items);
4466 	ZONE_UNLOCK(zone);
4467 
4468 	return (nitems);
4469 }
4470 
4471 /* See uma.h */
4472 void
4473 uma_zone_set_maxcache(uma_zone_t zone, int nitems)
4474 {
4475 	struct uma_bucket_zone *ubz;
4476 	int bpcpu;
4477 
4478 	ZONE_LOCK(zone);
4479 	ubz = bucket_zone_max(zone, nitems);
4480 	if (ubz != NULL) {
4481 		bpcpu = 2;
4482 		if ((zone->uz_flags & UMA_ZONE_FIRSTTOUCH) != 0)
4483 			/* Count the cross-domain bucket. */
4484 			bpcpu++;
4485 		nitems -= ubz->ubz_entries * bpcpu * mp_ncpus;
4486 		zone->uz_bucket_size_max = ubz->ubz_entries;
4487 	} else {
4488 		zone->uz_bucket_size_max = zone->uz_bucket_size = 0;
4489 	}
4490 	if (zone->uz_bucket_size_min > zone->uz_bucket_size_max)
4491 		zone->uz_bucket_size_min = zone->uz_bucket_size_max;
4492 	zone->uz_bucket_max = nitems / vm_ndomains;
4493 	ZONE_UNLOCK(zone);
4494 }
4495 
4496 /* See uma.h */
4497 int
4498 uma_zone_get_max(uma_zone_t zone)
4499 {
4500 	int nitems;
4501 
4502 	nitems = atomic_load_64(&zone->uz_max_items);
4503 
4504 	return (nitems);
4505 }
4506 
4507 /* See uma.h */
4508 void
4509 uma_zone_set_warning(uma_zone_t zone, const char *warning)
4510 {
4511 
4512 	ZONE_ASSERT_COLD(zone);
4513 	zone->uz_warning = warning;
4514 }
4515 
4516 /* See uma.h */
4517 void
4518 uma_zone_set_maxaction(uma_zone_t zone, uma_maxaction_t maxaction)
4519 {
4520 
4521 	ZONE_ASSERT_COLD(zone);
4522 	TASK_INIT(&zone->uz_maxaction, 0, (task_fn_t *)maxaction, zone);
4523 }
4524 
4525 /* See uma.h */
4526 int
4527 uma_zone_get_cur(uma_zone_t zone)
4528 {
4529 	int64_t nitems;
4530 	u_int i;
4531 
4532 	nitems = 0;
4533 	if (zone->uz_allocs != EARLY_COUNTER && zone->uz_frees != EARLY_COUNTER)
4534 		nitems = counter_u64_fetch(zone->uz_allocs) -
4535 		    counter_u64_fetch(zone->uz_frees);
4536 	CPU_FOREACH(i)
4537 		nitems += atomic_load_64(&zone->uz_cpu[i].uc_allocs) -
4538 		    atomic_load_64(&zone->uz_cpu[i].uc_frees);
4539 
4540 	return (nitems < 0 ? 0 : nitems);
4541 }
4542 
4543 static uint64_t
4544 uma_zone_get_allocs(uma_zone_t zone)
4545 {
4546 	uint64_t nitems;
4547 	u_int i;
4548 
4549 	nitems = 0;
4550 	if (zone->uz_allocs != EARLY_COUNTER)
4551 		nitems = counter_u64_fetch(zone->uz_allocs);
4552 	CPU_FOREACH(i)
4553 		nitems += atomic_load_64(&zone->uz_cpu[i].uc_allocs);
4554 
4555 	return (nitems);
4556 }
4557 
4558 static uint64_t
4559 uma_zone_get_frees(uma_zone_t zone)
4560 {
4561 	uint64_t nitems;
4562 	u_int i;
4563 
4564 	nitems = 0;
4565 	if (zone->uz_frees != EARLY_COUNTER)
4566 		nitems = counter_u64_fetch(zone->uz_frees);
4567 	CPU_FOREACH(i)
4568 		nitems += atomic_load_64(&zone->uz_cpu[i].uc_frees);
4569 
4570 	return (nitems);
4571 }
4572 
4573 #ifdef INVARIANTS
4574 /* Used only for KEG_ASSERT_COLD(). */
4575 static uint64_t
4576 uma_keg_get_allocs(uma_keg_t keg)
4577 {
4578 	uma_zone_t z;
4579 	uint64_t nitems;
4580 
4581 	nitems = 0;
4582 	LIST_FOREACH(z, &keg->uk_zones, uz_link)
4583 		nitems += uma_zone_get_allocs(z);
4584 
4585 	return (nitems);
4586 }
4587 #endif
4588 
4589 /* See uma.h */
4590 void
4591 uma_zone_set_init(uma_zone_t zone, uma_init uminit)
4592 {
4593 	uma_keg_t keg;
4594 
4595 	KEG_GET(zone, keg);
4596 	KEG_ASSERT_COLD(keg);
4597 	keg->uk_init = uminit;
4598 }
4599 
4600 /* See uma.h */
4601 void
4602 uma_zone_set_fini(uma_zone_t zone, uma_fini fini)
4603 {
4604 	uma_keg_t keg;
4605 
4606 	KEG_GET(zone, keg);
4607 	KEG_ASSERT_COLD(keg);
4608 	keg->uk_fini = fini;
4609 }
4610 
4611 /* See uma.h */
4612 void
4613 uma_zone_set_zinit(uma_zone_t zone, uma_init zinit)
4614 {
4615 
4616 	ZONE_ASSERT_COLD(zone);
4617 	zone->uz_init = zinit;
4618 }
4619 
4620 /* See uma.h */
4621 void
4622 uma_zone_set_zfini(uma_zone_t zone, uma_fini zfini)
4623 {
4624 
4625 	ZONE_ASSERT_COLD(zone);
4626 	zone->uz_fini = zfini;
4627 }
4628 
4629 /* See uma.h */
4630 void
4631 uma_zone_set_freef(uma_zone_t zone, uma_free freef)
4632 {
4633 	uma_keg_t keg;
4634 
4635 	KEG_GET(zone, keg);
4636 	KEG_ASSERT_COLD(keg);
4637 	keg->uk_freef = freef;
4638 }
4639 
4640 /* See uma.h */
4641 void
4642 uma_zone_set_allocf(uma_zone_t zone, uma_alloc allocf)
4643 {
4644 	uma_keg_t keg;
4645 
4646 	KEG_GET(zone, keg);
4647 	KEG_ASSERT_COLD(keg);
4648 	keg->uk_allocf = allocf;
4649 }
4650 
4651 /* See uma.h */
4652 void
4653 uma_zone_set_smr(uma_zone_t zone, smr_t smr)
4654 {
4655 
4656 	ZONE_ASSERT_COLD(zone);
4657 
4658 	KASSERT(smr != NULL, ("Got NULL smr"));
4659 	KASSERT((zone->uz_flags & UMA_ZONE_SMR) == 0,
4660 	    ("zone %p (%s) already uses SMR", zone, zone->uz_name));
4661 	zone->uz_flags |= UMA_ZONE_SMR;
4662 	zone->uz_smr = smr;
4663 	zone_update_caches(zone);
4664 }
4665 
4666 smr_t
4667 uma_zone_get_smr(uma_zone_t zone)
4668 {
4669 
4670 	return (zone->uz_smr);
4671 }
4672 
4673 /* See uma.h */
4674 void
4675 uma_zone_reserve(uma_zone_t zone, int items)
4676 {
4677 	uma_keg_t keg;
4678 
4679 	KEG_GET(zone, keg);
4680 	KEG_ASSERT_COLD(keg);
4681 	keg->uk_reserve = items;
4682 }
4683 
4684 /* See uma.h */
4685 int
4686 uma_zone_reserve_kva(uma_zone_t zone, int count)
4687 {
4688 	uma_keg_t keg;
4689 	vm_offset_t kva;
4690 	u_int pages;
4691 
4692 	KEG_GET(zone, keg);
4693 	KEG_ASSERT_COLD(keg);
4694 	ZONE_ASSERT_COLD(zone);
4695 
4696 	pages = howmany(count, keg->uk_ipers) * keg->uk_ppera;
4697 
4698 #ifdef UMA_MD_SMALL_ALLOC
4699 	if (keg->uk_ppera > 1) {
4700 #else
4701 	if (1) {
4702 #endif
4703 		kva = kva_alloc((vm_size_t)pages * PAGE_SIZE);
4704 		if (kva == 0)
4705 			return (0);
4706 	} else
4707 		kva = 0;
4708 
4709 	MPASS(keg->uk_kva == 0);
4710 	keg->uk_kva = kva;
4711 	keg->uk_offset = 0;
4712 	zone->uz_max_items = pages * keg->uk_ipers;
4713 #ifdef UMA_MD_SMALL_ALLOC
4714 	keg->uk_allocf = (keg->uk_ppera > 1) ? noobj_alloc : uma_small_alloc;
4715 #else
4716 	keg->uk_allocf = noobj_alloc;
4717 #endif
4718 	keg->uk_flags |= UMA_ZFLAG_LIMIT | UMA_ZONE_NOFREE;
4719 	zone->uz_flags |= UMA_ZFLAG_LIMIT | UMA_ZONE_NOFREE;
4720 	zone_update_caches(zone);
4721 
4722 	return (1);
4723 }
4724 
4725 /* See uma.h */
4726 void
4727 uma_prealloc(uma_zone_t zone, int items)
4728 {
4729 	struct vm_domainset_iter di;
4730 	uma_domain_t dom;
4731 	uma_slab_t slab;
4732 	uma_keg_t keg;
4733 	int aflags, domain, slabs;
4734 
4735 	KEG_GET(zone, keg);
4736 	slabs = howmany(items, keg->uk_ipers);
4737 	while (slabs-- > 0) {
4738 		aflags = M_NOWAIT;
4739 		vm_domainset_iter_policy_ref_init(&di, &keg->uk_dr, &domain,
4740 		    &aflags);
4741 		for (;;) {
4742 			slab = keg_alloc_slab(keg, zone, domain, M_WAITOK,
4743 			    aflags);
4744 			if (slab != NULL) {
4745 				dom = &keg->uk_domain[slab->us_domain];
4746 				/*
4747 				 * keg_alloc_slab() always returns a slab on the
4748 				 * partial list.
4749 				 */
4750 				LIST_REMOVE(slab, us_link);
4751 				LIST_INSERT_HEAD(&dom->ud_free_slab, slab,
4752 				    us_link);
4753 				dom->ud_free_slabs++;
4754 				KEG_UNLOCK(keg, slab->us_domain);
4755 				break;
4756 			}
4757 			if (vm_domainset_iter_policy(&di, &domain) != 0)
4758 				vm_wait_doms(&keg->uk_dr.dr_policy->ds_mask, 0);
4759 		}
4760 	}
4761 }
4762 
4763 /*
4764  * Returns a snapshot of memory consumption in bytes.
4765  */
4766 size_t
4767 uma_zone_memory(uma_zone_t zone)
4768 {
4769 	size_t sz;
4770 	int i;
4771 
4772 	sz = 0;
4773 	if (zone->uz_flags & UMA_ZFLAG_CACHE) {
4774 		for (i = 0; i < vm_ndomains; i++)
4775 			sz += ZDOM_GET(zone, i)->uzd_nitems;
4776 		return (sz * zone->uz_size);
4777 	}
4778 	for (i = 0; i < vm_ndomains; i++)
4779 		sz += zone->uz_keg->uk_domain[i].ud_pages;
4780 
4781 	return (sz * PAGE_SIZE);
4782 }
4783 
4784 /* See uma.h */
4785 void
4786 uma_reclaim(int req)
4787 {
4788 
4789 	CTR0(KTR_UMA, "UMA: vm asked us to release pages!");
4790 	sx_xlock(&uma_reclaim_lock);
4791 	bucket_enable();
4792 
4793 	switch (req) {
4794 	case UMA_RECLAIM_TRIM:
4795 		zone_foreach(zone_trim, NULL);
4796 		break;
4797 	case UMA_RECLAIM_DRAIN:
4798 	case UMA_RECLAIM_DRAIN_CPU:
4799 		zone_foreach(zone_drain, NULL);
4800 		if (req == UMA_RECLAIM_DRAIN_CPU) {
4801 			pcpu_cache_drain_safe(NULL);
4802 			zone_foreach(zone_drain, NULL);
4803 		}
4804 		break;
4805 	default:
4806 		panic("unhandled reclamation request %d", req);
4807 	}
4808 
4809 	/*
4810 	 * Some slabs may have been freed but this zone will be visited early
4811 	 * we visit again so that we can free pages that are empty once other
4812 	 * zones are drained.  We have to do the same for buckets.
4813 	 */
4814 	zone_drain(slabzones[0], NULL);
4815 	zone_drain(slabzones[1], NULL);
4816 	bucket_zone_drain();
4817 	sx_xunlock(&uma_reclaim_lock);
4818 }
4819 
4820 static volatile int uma_reclaim_needed;
4821 
4822 void
4823 uma_reclaim_wakeup(void)
4824 {
4825 
4826 	if (atomic_fetchadd_int(&uma_reclaim_needed, 1) == 0)
4827 		wakeup(uma_reclaim);
4828 }
4829 
4830 void
4831 uma_reclaim_worker(void *arg __unused)
4832 {
4833 
4834 	for (;;) {
4835 		sx_xlock(&uma_reclaim_lock);
4836 		while (atomic_load_int(&uma_reclaim_needed) == 0)
4837 			sx_sleep(uma_reclaim, &uma_reclaim_lock, PVM, "umarcl",
4838 			    hz);
4839 		sx_xunlock(&uma_reclaim_lock);
4840 		EVENTHANDLER_INVOKE(vm_lowmem, VM_LOW_KMEM);
4841 		uma_reclaim(UMA_RECLAIM_DRAIN_CPU);
4842 		atomic_store_int(&uma_reclaim_needed, 0);
4843 		/* Don't fire more than once per-second. */
4844 		pause("umarclslp", hz);
4845 	}
4846 }
4847 
4848 /* See uma.h */
4849 void
4850 uma_zone_reclaim(uma_zone_t zone, int req)
4851 {
4852 
4853 	switch (req) {
4854 	case UMA_RECLAIM_TRIM:
4855 		zone_trim(zone, NULL);
4856 		break;
4857 	case UMA_RECLAIM_DRAIN:
4858 		zone_drain(zone, NULL);
4859 		break;
4860 	case UMA_RECLAIM_DRAIN_CPU:
4861 		pcpu_cache_drain_safe(zone);
4862 		zone_drain(zone, NULL);
4863 		break;
4864 	default:
4865 		panic("unhandled reclamation request %d", req);
4866 	}
4867 }
4868 
4869 /* See uma.h */
4870 int
4871 uma_zone_exhausted(uma_zone_t zone)
4872 {
4873 
4874 	return (atomic_load_32(&zone->uz_sleepers) > 0);
4875 }
4876 
4877 unsigned long
4878 uma_limit(void)
4879 {
4880 
4881 	return (uma_kmem_limit);
4882 }
4883 
4884 void
4885 uma_set_limit(unsigned long limit)
4886 {
4887 
4888 	uma_kmem_limit = limit;
4889 }
4890 
4891 unsigned long
4892 uma_size(void)
4893 {
4894 
4895 	return (atomic_load_long(&uma_kmem_total));
4896 }
4897 
4898 long
4899 uma_avail(void)
4900 {
4901 
4902 	return (uma_kmem_limit - uma_size());
4903 }
4904 
4905 #ifdef DDB
4906 /*
4907  * Generate statistics across both the zone and its per-cpu cache's.  Return
4908  * desired statistics if the pointer is non-NULL for that statistic.
4909  *
4910  * Note: does not update the zone statistics, as it can't safely clear the
4911  * per-CPU cache statistic.
4912  *
4913  */
4914 static void
4915 uma_zone_sumstat(uma_zone_t z, long *cachefreep, uint64_t *allocsp,
4916     uint64_t *freesp, uint64_t *sleepsp, uint64_t *xdomainp)
4917 {
4918 	uma_cache_t cache;
4919 	uint64_t allocs, frees, sleeps, xdomain;
4920 	int cachefree, cpu;
4921 
4922 	allocs = frees = sleeps = xdomain = 0;
4923 	cachefree = 0;
4924 	CPU_FOREACH(cpu) {
4925 		cache = &z->uz_cpu[cpu];
4926 		cachefree += cache->uc_allocbucket.ucb_cnt;
4927 		cachefree += cache->uc_freebucket.ucb_cnt;
4928 		xdomain += cache->uc_crossbucket.ucb_cnt;
4929 		cachefree += cache->uc_crossbucket.ucb_cnt;
4930 		allocs += cache->uc_allocs;
4931 		frees += cache->uc_frees;
4932 	}
4933 	allocs += counter_u64_fetch(z->uz_allocs);
4934 	frees += counter_u64_fetch(z->uz_frees);
4935 	xdomain += counter_u64_fetch(z->uz_xdomain);
4936 	sleeps += z->uz_sleeps;
4937 	if (cachefreep != NULL)
4938 		*cachefreep = cachefree;
4939 	if (allocsp != NULL)
4940 		*allocsp = allocs;
4941 	if (freesp != NULL)
4942 		*freesp = frees;
4943 	if (sleepsp != NULL)
4944 		*sleepsp = sleeps;
4945 	if (xdomainp != NULL)
4946 		*xdomainp = xdomain;
4947 }
4948 #endif /* DDB */
4949 
4950 static int
4951 sysctl_vm_zone_count(SYSCTL_HANDLER_ARGS)
4952 {
4953 	uma_keg_t kz;
4954 	uma_zone_t z;
4955 	int count;
4956 
4957 	count = 0;
4958 	rw_rlock(&uma_rwlock);
4959 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
4960 		LIST_FOREACH(z, &kz->uk_zones, uz_link)
4961 			count++;
4962 	}
4963 	LIST_FOREACH(z, &uma_cachezones, uz_link)
4964 		count++;
4965 
4966 	rw_runlock(&uma_rwlock);
4967 	return (sysctl_handle_int(oidp, &count, 0, req));
4968 }
4969 
4970 static void
4971 uma_vm_zone_stats(struct uma_type_header *uth, uma_zone_t z, struct sbuf *sbuf,
4972     struct uma_percpu_stat *ups, bool internal)
4973 {
4974 	uma_zone_domain_t zdom;
4975 	uma_cache_t cache;
4976 	int i;
4977 
4978 	for (i = 0; i < vm_ndomains; i++) {
4979 		zdom = ZDOM_GET(z, i);
4980 		uth->uth_zone_free += zdom->uzd_nitems;
4981 	}
4982 	uth->uth_allocs = counter_u64_fetch(z->uz_allocs);
4983 	uth->uth_frees = counter_u64_fetch(z->uz_frees);
4984 	uth->uth_fails = counter_u64_fetch(z->uz_fails);
4985 	uth->uth_xdomain = counter_u64_fetch(z->uz_xdomain);
4986 	uth->uth_sleeps = z->uz_sleeps;
4987 
4988 	for (i = 0; i < mp_maxid + 1; i++) {
4989 		bzero(&ups[i], sizeof(*ups));
4990 		if (internal || CPU_ABSENT(i))
4991 			continue;
4992 		cache = &z->uz_cpu[i];
4993 		ups[i].ups_cache_free += cache->uc_allocbucket.ucb_cnt;
4994 		ups[i].ups_cache_free += cache->uc_freebucket.ucb_cnt;
4995 		ups[i].ups_cache_free += cache->uc_crossbucket.ucb_cnt;
4996 		ups[i].ups_allocs = cache->uc_allocs;
4997 		ups[i].ups_frees = cache->uc_frees;
4998 	}
4999 }
5000 
5001 static int
5002 sysctl_vm_zone_stats(SYSCTL_HANDLER_ARGS)
5003 {
5004 	struct uma_stream_header ush;
5005 	struct uma_type_header uth;
5006 	struct uma_percpu_stat *ups;
5007 	struct sbuf sbuf;
5008 	uma_keg_t kz;
5009 	uma_zone_t z;
5010 	uint64_t items;
5011 	uint32_t kfree, pages;
5012 	int count, error, i;
5013 
5014 	error = sysctl_wire_old_buffer(req, 0);
5015 	if (error != 0)
5016 		return (error);
5017 	sbuf_new_for_sysctl(&sbuf, NULL, 128, req);
5018 	sbuf_clear_flags(&sbuf, SBUF_INCLUDENUL);
5019 	ups = malloc((mp_maxid + 1) * sizeof(*ups), M_TEMP, M_WAITOK);
5020 
5021 	count = 0;
5022 	rw_rlock(&uma_rwlock);
5023 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
5024 		LIST_FOREACH(z, &kz->uk_zones, uz_link)
5025 			count++;
5026 	}
5027 
5028 	LIST_FOREACH(z, &uma_cachezones, uz_link)
5029 		count++;
5030 
5031 	/*
5032 	 * Insert stream header.
5033 	 */
5034 	bzero(&ush, sizeof(ush));
5035 	ush.ush_version = UMA_STREAM_VERSION;
5036 	ush.ush_maxcpus = (mp_maxid + 1);
5037 	ush.ush_count = count;
5038 	(void)sbuf_bcat(&sbuf, &ush, sizeof(ush));
5039 
5040 	LIST_FOREACH(kz, &uma_kegs, uk_link) {
5041 		kfree = pages = 0;
5042 		for (i = 0; i < vm_ndomains; i++) {
5043 			kfree += kz->uk_domain[i].ud_free_items;
5044 			pages += kz->uk_domain[i].ud_pages;
5045 		}
5046 		LIST_FOREACH(z, &kz->uk_zones, uz_link) {
5047 			bzero(&uth, sizeof(uth));
5048 			strlcpy(uth.uth_name, z->uz_name, UTH_MAX_NAME);
5049 			uth.uth_align = kz->uk_align;
5050 			uth.uth_size = kz->uk_size;
5051 			uth.uth_rsize = kz->uk_rsize;
5052 			if (z->uz_max_items > 0) {
5053 				items = UZ_ITEMS_COUNT(z->uz_items);
5054 				uth.uth_pages = (items / kz->uk_ipers) *
5055 					kz->uk_ppera;
5056 			} else
5057 				uth.uth_pages = pages;
5058 			uth.uth_maxpages = (z->uz_max_items / kz->uk_ipers) *
5059 			    kz->uk_ppera;
5060 			uth.uth_limit = z->uz_max_items;
5061 			uth.uth_keg_free = kfree;
5062 
5063 			/*
5064 			 * A zone is secondary is it is not the first entry
5065 			 * on the keg's zone list.
5066 			 */
5067 			if ((z->uz_flags & UMA_ZONE_SECONDARY) &&
5068 			    (LIST_FIRST(&kz->uk_zones) != z))
5069 				uth.uth_zone_flags = UTH_ZONE_SECONDARY;
5070 			uma_vm_zone_stats(&uth, z, &sbuf, ups,
5071 			    kz->uk_flags & UMA_ZFLAG_INTERNAL);
5072 			(void)sbuf_bcat(&sbuf, &uth, sizeof(uth));
5073 			for (i = 0; i < mp_maxid + 1; i++)
5074 				(void)sbuf_bcat(&sbuf, &ups[i], sizeof(ups[i]));
5075 		}
5076 	}
5077 	LIST_FOREACH(z, &uma_cachezones, uz_link) {
5078 		bzero(&uth, sizeof(uth));
5079 		strlcpy(uth.uth_name, z->uz_name, UTH_MAX_NAME);
5080 		uth.uth_size = z->uz_size;
5081 		uma_vm_zone_stats(&uth, z, &sbuf, ups, false);
5082 		(void)sbuf_bcat(&sbuf, &uth, sizeof(uth));
5083 		for (i = 0; i < mp_maxid + 1; i++)
5084 			(void)sbuf_bcat(&sbuf, &ups[i], sizeof(ups[i]));
5085 	}
5086 
5087 	rw_runlock(&uma_rwlock);
5088 	error = sbuf_finish(&sbuf);
5089 	sbuf_delete(&sbuf);
5090 	free(ups, M_TEMP);
5091 	return (error);
5092 }
5093 
5094 int
5095 sysctl_handle_uma_zone_max(SYSCTL_HANDLER_ARGS)
5096 {
5097 	uma_zone_t zone = *(uma_zone_t *)arg1;
5098 	int error, max;
5099 
5100 	max = uma_zone_get_max(zone);
5101 	error = sysctl_handle_int(oidp, &max, 0, req);
5102 	if (error || !req->newptr)
5103 		return (error);
5104 
5105 	uma_zone_set_max(zone, max);
5106 
5107 	return (0);
5108 }
5109 
5110 int
5111 sysctl_handle_uma_zone_cur(SYSCTL_HANDLER_ARGS)
5112 {
5113 	uma_zone_t zone;
5114 	int cur;
5115 
5116 	/*
5117 	 * Some callers want to add sysctls for global zones that
5118 	 * may not yet exist so they pass a pointer to a pointer.
5119 	 */
5120 	if (arg2 == 0)
5121 		zone = *(uma_zone_t *)arg1;
5122 	else
5123 		zone = arg1;
5124 	cur = uma_zone_get_cur(zone);
5125 	return (sysctl_handle_int(oidp, &cur, 0, req));
5126 }
5127 
5128 static int
5129 sysctl_handle_uma_zone_allocs(SYSCTL_HANDLER_ARGS)
5130 {
5131 	uma_zone_t zone = arg1;
5132 	uint64_t cur;
5133 
5134 	cur = uma_zone_get_allocs(zone);
5135 	return (sysctl_handle_64(oidp, &cur, 0, req));
5136 }
5137 
5138 static int
5139 sysctl_handle_uma_zone_frees(SYSCTL_HANDLER_ARGS)
5140 {
5141 	uma_zone_t zone = arg1;
5142 	uint64_t cur;
5143 
5144 	cur = uma_zone_get_frees(zone);
5145 	return (sysctl_handle_64(oidp, &cur, 0, req));
5146 }
5147 
5148 static int
5149 sysctl_handle_uma_zone_flags(SYSCTL_HANDLER_ARGS)
5150 {
5151 	struct sbuf sbuf;
5152 	uma_zone_t zone = arg1;
5153 	int error;
5154 
5155 	sbuf_new_for_sysctl(&sbuf, NULL, 0, req);
5156 	if (zone->uz_flags != 0)
5157 		sbuf_printf(&sbuf, "0x%b", zone->uz_flags, PRINT_UMA_ZFLAGS);
5158 	else
5159 		sbuf_printf(&sbuf, "0");
5160 	error = sbuf_finish(&sbuf);
5161 	sbuf_delete(&sbuf);
5162 
5163 	return (error);
5164 }
5165 
5166 static int
5167 sysctl_handle_uma_slab_efficiency(SYSCTL_HANDLER_ARGS)
5168 {
5169 	uma_keg_t keg = arg1;
5170 	int avail, effpct, total;
5171 
5172 	total = keg->uk_ppera * PAGE_SIZE;
5173 	if ((keg->uk_flags & UMA_ZFLAG_OFFPAGE) != 0)
5174 		total += slabzone(keg->uk_ipers)->uz_keg->uk_rsize;
5175 	/*
5176 	 * We consider the client's requested size and alignment here, not the
5177 	 * real size determination uk_rsize, because we also adjust the real
5178 	 * size for internal implementation reasons (max bitset size).
5179 	 */
5180 	avail = keg->uk_ipers * roundup2(keg->uk_size, keg->uk_align + 1);
5181 	if ((keg->uk_flags & UMA_ZONE_PCPU) != 0)
5182 		avail *= mp_maxid + 1;
5183 	effpct = 100 * avail / total;
5184 	return (sysctl_handle_int(oidp, &effpct, 0, req));
5185 }
5186 
5187 static int
5188 sysctl_handle_uma_zone_items(SYSCTL_HANDLER_ARGS)
5189 {
5190 	uma_zone_t zone = arg1;
5191 	uint64_t cur;
5192 
5193 	cur = UZ_ITEMS_COUNT(atomic_load_64(&zone->uz_items));
5194 	return (sysctl_handle_64(oidp, &cur, 0, req));
5195 }
5196 
5197 #ifdef INVARIANTS
5198 static uma_slab_t
5199 uma_dbg_getslab(uma_zone_t zone, void *item)
5200 {
5201 	uma_slab_t slab;
5202 	uma_keg_t keg;
5203 	uint8_t *mem;
5204 
5205 	/*
5206 	 * It is safe to return the slab here even though the
5207 	 * zone is unlocked because the item's allocation state
5208 	 * essentially holds a reference.
5209 	 */
5210 	mem = (uint8_t *)((uintptr_t)item & (~UMA_SLAB_MASK));
5211 	if ((zone->uz_flags & UMA_ZFLAG_CACHE) != 0)
5212 		return (NULL);
5213 	if (zone->uz_flags & UMA_ZFLAG_VTOSLAB)
5214 		return (vtoslab((vm_offset_t)mem));
5215 	keg = zone->uz_keg;
5216 	if ((keg->uk_flags & UMA_ZFLAG_HASH) == 0)
5217 		return ((uma_slab_t)(mem + keg->uk_pgoff));
5218 	KEG_LOCK(keg, 0);
5219 	slab = hash_sfind(&keg->uk_hash, mem);
5220 	KEG_UNLOCK(keg, 0);
5221 
5222 	return (slab);
5223 }
5224 
5225 static bool
5226 uma_dbg_zskip(uma_zone_t zone, void *mem)
5227 {
5228 
5229 	if ((zone->uz_flags & UMA_ZFLAG_CACHE) != 0)
5230 		return (true);
5231 
5232 	return (uma_dbg_kskip(zone->uz_keg, mem));
5233 }
5234 
5235 static bool
5236 uma_dbg_kskip(uma_keg_t keg, void *mem)
5237 {
5238 	uintptr_t idx;
5239 
5240 	if (dbg_divisor == 0)
5241 		return (true);
5242 
5243 	if (dbg_divisor == 1)
5244 		return (false);
5245 
5246 	idx = (uintptr_t)mem >> PAGE_SHIFT;
5247 	if (keg->uk_ipers > 1) {
5248 		idx *= keg->uk_ipers;
5249 		idx += ((uintptr_t)mem & PAGE_MASK) / keg->uk_rsize;
5250 	}
5251 
5252 	if ((idx / dbg_divisor) * dbg_divisor != idx) {
5253 		counter_u64_add(uma_skip_cnt, 1);
5254 		return (true);
5255 	}
5256 	counter_u64_add(uma_dbg_cnt, 1);
5257 
5258 	return (false);
5259 }
5260 
5261 /*
5262  * Set up the slab's freei data such that uma_dbg_free can function.
5263  *
5264  */
5265 static void
5266 uma_dbg_alloc(uma_zone_t zone, uma_slab_t slab, void *item)
5267 {
5268 	uma_keg_t keg;
5269 	int freei;
5270 
5271 	if (slab == NULL) {
5272 		slab = uma_dbg_getslab(zone, item);
5273 		if (slab == NULL)
5274 			panic("uma: item %p did not belong to zone %s\n",
5275 			    item, zone->uz_name);
5276 	}
5277 	keg = zone->uz_keg;
5278 	freei = slab_item_index(slab, keg, item);
5279 
5280 	if (BIT_ISSET(keg->uk_ipers, freei, slab_dbg_bits(slab, keg)))
5281 		panic("Duplicate alloc of %p from zone %p(%s) slab %p(%d)\n",
5282 		    item, zone, zone->uz_name, slab, freei);
5283 	BIT_SET_ATOMIC(keg->uk_ipers, freei, slab_dbg_bits(slab, keg));
5284 }
5285 
5286 /*
5287  * Verifies freed addresses.  Checks for alignment, valid slab membership
5288  * and duplicate frees.
5289  *
5290  */
5291 static void
5292 uma_dbg_free(uma_zone_t zone, uma_slab_t slab, void *item)
5293 {
5294 	uma_keg_t keg;
5295 	int freei;
5296 
5297 	if (slab == NULL) {
5298 		slab = uma_dbg_getslab(zone, item);
5299 		if (slab == NULL)
5300 			panic("uma: Freed item %p did not belong to zone %s\n",
5301 			    item, zone->uz_name);
5302 	}
5303 	keg = zone->uz_keg;
5304 	freei = slab_item_index(slab, keg, item);
5305 
5306 	if (freei >= keg->uk_ipers)
5307 		panic("Invalid free of %p from zone %p(%s) slab %p(%d)\n",
5308 		    item, zone, zone->uz_name, slab, freei);
5309 
5310 	if (slab_item(slab, keg, freei) != item)
5311 		panic("Unaligned free of %p from zone %p(%s) slab %p(%d)\n",
5312 		    item, zone, zone->uz_name, slab, freei);
5313 
5314 	if (!BIT_ISSET(keg->uk_ipers, freei, slab_dbg_bits(slab, keg)))
5315 		panic("Duplicate free of %p from zone %p(%s) slab %p(%d)\n",
5316 		    item, zone, zone->uz_name, slab, freei);
5317 
5318 	BIT_CLR_ATOMIC(keg->uk_ipers, freei, slab_dbg_bits(slab, keg));
5319 }
5320 #endif /* INVARIANTS */
5321 
5322 #ifdef DDB
5323 static int64_t
5324 get_uma_stats(uma_keg_t kz, uma_zone_t z, uint64_t *allocs, uint64_t *used,
5325     uint64_t *sleeps, long *cachefree, uint64_t *xdomain)
5326 {
5327 	uint64_t frees;
5328 	int i;
5329 
5330 	if (kz->uk_flags & UMA_ZFLAG_INTERNAL) {
5331 		*allocs = counter_u64_fetch(z->uz_allocs);
5332 		frees = counter_u64_fetch(z->uz_frees);
5333 		*sleeps = z->uz_sleeps;
5334 		*cachefree = 0;
5335 		*xdomain = 0;
5336 	} else
5337 		uma_zone_sumstat(z, cachefree, allocs, &frees, sleeps,
5338 		    xdomain);
5339 	for (i = 0; i < vm_ndomains; i++) {
5340 		*cachefree += ZDOM_GET(z, i)->uzd_nitems;
5341 		if (!((z->uz_flags & UMA_ZONE_SECONDARY) &&
5342 		    (LIST_FIRST(&kz->uk_zones) != z)))
5343 			*cachefree += kz->uk_domain[i].ud_free_items;
5344 	}
5345 	*used = *allocs - frees;
5346 	return (((int64_t)*used + *cachefree) * kz->uk_size);
5347 }
5348 
5349 DB_SHOW_COMMAND(uma, db_show_uma)
5350 {
5351 	const char *fmt_hdr, *fmt_entry;
5352 	uma_keg_t kz;
5353 	uma_zone_t z;
5354 	uint64_t allocs, used, sleeps, xdomain;
5355 	long cachefree;
5356 	/* variables for sorting */
5357 	uma_keg_t cur_keg;
5358 	uma_zone_t cur_zone, last_zone;
5359 	int64_t cur_size, last_size, size;
5360 	int ties;
5361 
5362 	/* /i option produces machine-parseable CSV output */
5363 	if (modif[0] == 'i') {
5364 		fmt_hdr = "%s,%s,%s,%s,%s,%s,%s,%s,%s\n";
5365 		fmt_entry = "\"%s\",%ju,%jd,%ld,%ju,%ju,%u,%jd,%ju\n";
5366 	} else {
5367 		fmt_hdr = "%18s %6s %7s %7s %11s %7s %7s %10s %8s\n";
5368 		fmt_entry = "%18s %6ju %7jd %7ld %11ju %7ju %7u %10jd %8ju\n";
5369 	}
5370 
5371 	db_printf(fmt_hdr, "Zone", "Size", "Used", "Free", "Requests",
5372 	    "Sleeps", "Bucket", "Total Mem", "XFree");
5373 
5374 	/* Sort the zones with largest size first. */
5375 	last_zone = NULL;
5376 	last_size = INT64_MAX;
5377 	for (;;) {
5378 		cur_zone = NULL;
5379 		cur_size = -1;
5380 		ties = 0;
5381 		LIST_FOREACH(kz, &uma_kegs, uk_link) {
5382 			LIST_FOREACH(z, &kz->uk_zones, uz_link) {
5383 				/*
5384 				 * In the case of size ties, print out zones
5385 				 * in the order they are encountered.  That is,
5386 				 * when we encounter the most recently output
5387 				 * zone, we have already printed all preceding
5388 				 * ties, and we must print all following ties.
5389 				 */
5390 				if (z == last_zone) {
5391 					ties = 1;
5392 					continue;
5393 				}
5394 				size = get_uma_stats(kz, z, &allocs, &used,
5395 				    &sleeps, &cachefree, &xdomain);
5396 				if (size > cur_size && size < last_size + ties)
5397 				{
5398 					cur_size = size;
5399 					cur_zone = z;
5400 					cur_keg = kz;
5401 				}
5402 			}
5403 		}
5404 		if (cur_zone == NULL)
5405 			break;
5406 
5407 		size = get_uma_stats(cur_keg, cur_zone, &allocs, &used,
5408 		    &sleeps, &cachefree, &xdomain);
5409 		db_printf(fmt_entry, cur_zone->uz_name,
5410 		    (uintmax_t)cur_keg->uk_size, (intmax_t)used, cachefree,
5411 		    (uintmax_t)allocs, (uintmax_t)sleeps,
5412 		    (unsigned)cur_zone->uz_bucket_size, (intmax_t)size,
5413 		    xdomain);
5414 
5415 		if (db_pager_quit)
5416 			return;
5417 		last_zone = cur_zone;
5418 		last_size = cur_size;
5419 	}
5420 }
5421 
5422 DB_SHOW_COMMAND(umacache, db_show_umacache)
5423 {
5424 	uma_zone_t z;
5425 	uint64_t allocs, frees;
5426 	long cachefree;
5427 	int i;
5428 
5429 	db_printf("%18s %8s %8s %8s %12s %8s\n", "Zone", "Size", "Used", "Free",
5430 	    "Requests", "Bucket");
5431 	LIST_FOREACH(z, &uma_cachezones, uz_link) {
5432 		uma_zone_sumstat(z, &cachefree, &allocs, &frees, NULL, NULL);
5433 		for (i = 0; i < vm_ndomains; i++)
5434 			cachefree += ZDOM_GET(z, i)->uzd_nitems;
5435 		db_printf("%18s %8ju %8jd %8ld %12ju %8u\n",
5436 		    z->uz_name, (uintmax_t)z->uz_size,
5437 		    (intmax_t)(allocs - frees), cachefree,
5438 		    (uintmax_t)allocs, z->uz_bucket_size);
5439 		if (db_pager_quit)
5440 			return;
5441 	}
5442 }
5443 #endif	/* DDB */
5444