14731 clean malloc/free shims from bhyve

Reviewed by: Andy Fiddaman <andy@omnios.org>
Reviewed by: Dan Cross <cross@oxidecomputer.com>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>

19 files changed, 125 insertions, 225 deletions

diff --git a/usr/src/compat/bhyve/sys/malloc.h b/usr/src/compat/bhyve/sys/malloc.h
deleted file mode 100644
index 341d57b807..0000000000
--- a/usr/src/compat/bhyve/sys/malloc.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * This file and its contents are supplied under the terms of the
- * Common Development and Distribution License ("CDDL"), version 1.0.
- * You may only use this file in accordance with the terms of version
- * 1.0 of the CDDL.
- *
- * A full copy of the text of the CDDL should have accompanied this
- * source.  A copy of the CDDL is also available via the Internet at
- * http://www.illumos.org/license/CDDL.
- */
-
-/*
- * Copyright 2013 Pluribus Networks Inc.
- */
-
-#ifndef _COMPAT_FREEBSD_SYS_MALLOC_H_
-#define	_COMPAT_FREEBSD_SYS_MALLOC_H_
-
-/*
- * flags to malloc.
- */
-#define	M_NOWAIT	0x0001		/* do not block */
-#define	M_WAITOK	0x0002		/* ok to block */
-#define	M_ZERO		0x0100		/* bzero the allocation */
-
-struct malloc_type {
-	const char	*ks_shortdesc;	/* Printable type name. */
-};
-
-#ifdef	_KERNEL
-#define	MALLOC_DEFINE(type, shortdesc, longdesc)			\
-	struct malloc_type type[1] = {					\
-		{ shortdesc }						\
-	}
-
-#define	MALLOC_DECLARE(type)						\
-	extern struct malloc_type type[1]
-
-void	free(void *addr, struct malloc_type *type);
-void	*malloc(unsigned long size, struct malloc_type *type, int flags);
-void	*old_malloc(unsigned long size, struct malloc_type *type , int flags);
-void	*contigmalloc(unsigned long, struct malloc_type *, int, vm_paddr_t,
-    vm_paddr_t, unsigned long, vm_paddr_t);
-void	contigfree(void *, unsigned long, struct malloc_type *);
-
-
-#endif	/* _KERNEL */
-
-#endif	/* _COMPAT_FREEBSD_SYS_MALLOC_H_ */
diff --git a/usr/src/uts/intel/io/vmm/amd/svm.c b/usr/src/uts/intel/io/vmm/amd/svm.c
index d6b271a75c..b699d57991 100644
--- a/usr/src/uts/intel/io/vmm/amd/svm.c
+++ b/usr/src/uts/intel/io/vmm/amd/svm.c
@@ -46,7 +46,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/pcpu.h>
 #include <sys/proc.h>
 #include <sys/sysctl.h>
@@ -112,9 +112,6 @@ static uint32_t vmcb_clean = VMCB_CACHE_DEFAULT;
 SYSCTL_INT(_hw_vmm_svm, OID_AUTO, vmcb_clean, CTLFLAG_RDTUN, &vmcb_clean,
     0, NULL);
 
-static MALLOC_DEFINE(M_SVM, "svm", "svm");
-static MALLOC_DEFINE(M_SVM_VLAPIC, "svm-vlapic", "svm-vlapic");
-
 /* SVM features advertised by CPUID.8000000AH:EDX */
 static uint32_t svm_feature = ~0U;	/* AMD SVM features. */
 
@@ -427,16 +424,13 @@ svm_vminit(struct vm *vm)
 	int i;
 	uint16_t maxcpus;
 
-	svm_sc = malloc(sizeof (*svm_sc), M_SVM, M_WAITOK | M_ZERO);
-	if (((uintptr_t)svm_sc & PAGE_MASK) != 0)
-		panic("malloc of svm_softc not aligned on page boundary");
+	svm_sc = kmem_zalloc(sizeof (*svm_sc), KM_SLEEP);
+	VERIFY3U(((uintptr_t)svm_sc & PAGE_MASK),  ==,  0);
 
-	svm_sc->msr_bitmap = contigmalloc(SVM_MSR_BITMAP_SIZE, M_SVM,
-	    M_WAITOK, 0, ~(vm_paddr_t)0, PAGE_SIZE, 0);
+	svm_sc->msr_bitmap = vmm_contig_alloc(SVM_MSR_BITMAP_SIZE);
 	if (svm_sc->msr_bitmap == NULL)
 		panic("contigmalloc of SVM MSR bitmap failed");
-	svm_sc->iopm_bitmap = contigmalloc(SVM_IO_BITMAP_SIZE, M_SVM,
-	    M_WAITOK, 0, ~(vm_paddr_t)0, PAGE_SIZE, 0);
+	svm_sc->iopm_bitmap = vmm_contig_alloc(SVM_IO_BITMAP_SIZE);
 	if (svm_sc->iopm_bitmap == NULL)
 		panic("contigmalloc of SVM IO bitmap failed");
 
@@ -2035,9 +2029,9 @@ svm_vmcleanup(void *arg)
 {
 	struct svm_softc *sc = arg;
 
-	contigfree(sc->iopm_bitmap, SVM_IO_BITMAP_SIZE, M_SVM);
-	contigfree(sc->msr_bitmap, SVM_MSR_BITMAP_SIZE, M_SVM);
-	free(sc, M_SVM);
+	vmm_contig_free(sc->iopm_bitmap, SVM_IO_BITMAP_SIZE);
+	vmm_contig_free(sc->msr_bitmap, SVM_MSR_BITMAP_SIZE);
+	kmem_free(sc, sizeof (*sc));
 }
 
 static uint64_t *
@@ -2400,8 +2394,7 @@ svm_vlapic_init(void *arg, int vcpuid)
 	struct vlapic *vlapic;
 
 	svm_sc = arg;
-	vlapic = malloc(sizeof (struct vlapic), M_SVM_VLAPIC,
-	    M_WAITOK | M_ZERO);
+	vlapic = kmem_zalloc(sizeof (struct vlapic), KM_SLEEP);
 	vlapic->vm = svm_sc->vm;
 	vlapic->vcpuid = vcpuid;
 	vlapic->apic_page = (struct LAPIC *)&svm_sc->apic_page[vcpuid];
@@ -2415,7 +2408,7 @@ static void
 svm_vlapic_cleanup(void *arg, struct vlapic *vlapic)
 {
 	vlapic_cleanup(vlapic);
-	free(vlapic, M_SVM_VLAPIC);
+	kmem_free(vlapic, sizeof (struct vlapic));
 }
 
 static void
diff --git a/usr/src/uts/intel/io/vmm/intel/vmx.c b/usr/src/uts/intel/io/vmm/intel/vmx.c
index 4699168af1..360cec1056 100644
--- a/usr/src/uts/intel/io/vmm/intel/vmx.c
+++ b/usr/src/uts/intel/io/vmm/intel/vmx.c
@@ -49,7 +49,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/pcpu.h>
 #include <sys/proc.h>
 #include <sys/sysctl.h>
@@ -162,9 +162,6 @@ __FBSDID("$FreeBSD$");
 #define	HANDLED		1
 #define	UNHANDLED	0
 
-static MALLOC_DEFINE(M_VMX, "vmx", "vmx");
-static MALLOC_DEFINE(M_VLAPIC, "vlapic", "vlapic");
-
 SYSCTL_DECL(_hw_vmm);
 SYSCTL_NODE(_hw_vmm, OID_AUTO, vmx, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
     NULL);
@@ -694,13 +691,10 @@ vmx_vminit(struct vm *vm)
 	uint32_t proc_ctls, proc2_ctls, pin_ctls;
 	uint64_t apic_access_pa = UINT64_MAX;
 
-	vmx = malloc(sizeof (struct vmx), M_VMX, M_WAITOK | M_ZERO);
-	if ((uintptr_t)vmx & PAGE_MASK) {
-		panic("malloc of struct vmx not aligned on %d byte boundary",
-		    PAGE_SIZE);
-	}
-	vmx->vm = vm;
+	vmx = kmem_zalloc(sizeof (struct vmx), KM_SLEEP);
+	VERIFY3U((uintptr_t)vmx & PAGE_MASK, ==, 0);
 
+	vmx->vm = vm;
 	vmx->eptp = vmspace_table_root(vm_get_vmspace(vm));
 
 	/*
@@ -2937,7 +2931,7 @@ vmx_vmcleanup(void *arg)
 	for (i = 0; i < maxcpus; i++)
 		vpid_free(vmx->state[i].vpid);
 
-	free(vmx, M_VMX);
+	kmem_free(vmx, sizeof (*vmx));
 }
 
 static uint64_t *
@@ -3628,22 +3622,19 @@ vmx_tpr_shadow_exit(struct vlapic *vlapic)
 static struct vlapic *
 vmx_vlapic_init(void *arg, int vcpuid)
 {
-	struct vmx *vmx;
-	struct vlapic *vlapic;
+	struct vmx *vmx = arg;
 	struct vlapic_vtx *vlapic_vtx;
+	struct vlapic *vlapic;
 
-	vmx = arg;
+	vlapic_vtx = kmem_zalloc(sizeof (struct vlapic_vtx), KM_SLEEP);
+	vlapic_vtx->pir_desc = &vmx->pir_desc[vcpuid];
+	vlapic_vtx->vmx = vmx;
 
-	vlapic = malloc(sizeof (struct vlapic_vtx), M_VLAPIC,
-	    M_WAITOK | M_ZERO);
+	vlapic = &vlapic_vtx->vlapic;
 	vlapic->vm = vmx->vm;
 	vlapic->vcpuid = vcpuid;
 	vlapic->apic_page = (struct LAPIC *)&vmx->apic_page[vcpuid];
 
-	vlapic_vtx = (struct vlapic_vtx *)vlapic;
-	vlapic_vtx->pir_desc = &vmx->pir_desc[vcpuid];
-	vlapic_vtx->vmx = vmx;
-
 	if (vmx_cap_en(vmx, VMX_CAP_TPR_SHADOW)) {
 		vlapic->ops.enable_x2apic_mode = vmx_enable_x2apic_mode_ts;
 	}
@@ -3666,9 +3657,8 @@ vmx_vlapic_init(void *arg, int vcpuid)
 static void
 vmx_vlapic_cleanup(void *arg, struct vlapic *vlapic)
 {
-
 	vlapic_cleanup(vlapic);
-	free(vlapic, M_VLAPIC);
+	kmem_free(vlapic, sizeof (struct vlapic_vtx));
 }
 
 static void
diff --git a/usr/src/uts/intel/io/vmm/intel/vtd.c b/usr/src/uts/intel/io/vmm/intel/vtd.c
index d32143aa07..6f5e6626c8 100644
--- a/usr/src/uts/intel/io/vmm/intel/vtd.c
+++ b/usr/src/uts/intel/io/vmm/intel/vtd.c
@@ -34,7 +34,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/systm.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 
 #include <dev/pci/pcireg.h>
 
@@ -131,8 +131,6 @@ static dev_info_t	*vtddips[DRHD_MAX_UNITS];
 static uint64_t root_table[PAGE_SIZE / sizeof (uint64_t)] __aligned(4096);
 static uint64_t ctx_tables[256][PAGE_SIZE / sizeof (uint64_t)] __aligned(4096);
 
-static MALLOC_DEFINE(M_VTD, "vtd", "vtd");
-
 static int
 vtd_max_domains(struct vtdmap *vtdmap)
 {
@@ -666,7 +664,7 @@ vtd_update_mapping(void *arg, vm_paddr_t gpa, vm_paddr_t hpa, uint64_t len,
 		 * to it from the current page table.
 		 */
 		if (ptp[ptpindex] == 0) {
-			void *nlp = malloc(PAGE_SIZE, M_VTD, M_WAITOK | M_ZERO);
+			void *nlp = vmm_ptp_alloc();
 			ptp[ptpindex] = vtophys(nlp)| VTD_PTE_RD | VTD_PTE_WR;
 		}
 
@@ -779,12 +777,12 @@ vtd_create_domain(vm_paddr_t maxaddr)
 		    tmp, agaw);
 	}
 
-	dom = malloc(sizeof (struct domain), M_VTD, M_ZERO | M_WAITOK);
+	dom = kmem_zalloc(sizeof (struct domain), KM_SLEEP);
 	dom->pt_levels = pt_levels;
 	dom->addrwidth = addrwidth;
 	dom->id = domain_id();
 	dom->maxaddr = maxaddr;
-	dom->ptp = malloc(PAGE_SIZE, M_VTD, M_ZERO | M_WAITOK);
+	dom->ptp = vmm_ptp_alloc();
 	if ((uintptr_t)dom->ptp & PAGE_MASK)
 		panic("vtd_create_domain: ptp (%p) not page aligned", dom->ptp);
 
@@ -846,8 +844,7 @@ vtd_free_ptp(uint64_t *ptp, int level)
 		}
 	}
 
-	bzero(ptp, PAGE_SIZE);
-	free(ptp, M_VTD);
+	vmm_ptp_free(ptp);
 }
 
 static void
@@ -859,7 +856,7 @@ vtd_destroy_domain(void *arg)
 
 	SLIST_REMOVE(&domhead, dom, domain, next);
 	vtd_free_ptp(dom->ptp, dom->pt_levels);
-	free(dom, M_VTD);
+	kmem_free(dom, sizeof (*dom));
 }
 
 const struct iommu_ops iommu_ops_intel = {
diff --git a/usr/src/uts/intel/io/vmm/io/iommu.h b/usr/src/uts/intel/io/vmm/io/iommu.h
index a5e9448b4e..0d1c4b1ee2 100644
--- a/usr/src/uts/intel/io/vmm/io/iommu.h
+++ b/usr/src/uts/intel/io/vmm/io/iommu.h
@@ -73,4 +73,9 @@ void	iommu_remove_mapping(void *dom, vm_paddr_t gpa, size_t len);
 void	iommu_add_device(void *dom, uint16_t rid);
 void	iommu_remove_device(void *dom, uint16_t rid);
 void	iommu_invalidate_tlb(void *domain);
+
+/* Glue functions used by iommu provider(s) */
+void *vmm_ptp_alloc(void);
+void vmm_ptp_free(void *);
+
 #endif
diff --git a/usr/src/uts/intel/io/vmm/io/ppt.c b/usr/src/uts/intel/io/vmm/io/ppt.c
index 7c0efec709..3492603d38 100644
--- a/usr/src/uts/intel/io/vmm/io/ppt.c
+++ b/usr/src/uts/intel/io/vmm/io/ppt.c
@@ -39,7 +39,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/module.h>
 #include <sys/bus.h>
 #include <sys/pciio.h>
diff --git a/usr/src/uts/intel/io/vmm/io/vatpic.c b/usr/src/uts/intel/io/vmm/io/vatpic.c
index 18da42aa60..2b4dc81b12 100644
--- a/usr/src/uts/intel/io/vmm/io/vatpic.c
+++ b/usr/src/uts/intel/io/vmm/io/vatpic.c
@@ -45,7 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/types.h>
 #include <sys/queue.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mutex.h>
 #include <sys/systm.h>
 
@@ -58,8 +58,6 @@ __FBSDID("$FreeBSD$");
 #include "vioapic.h"
 #include "vatpic.h"
 
-static MALLOC_DEFINE(M_VATPIC, "atpic", "bhyve virtual atpic (8259)");
-
 #define	VATPIC_LOCK(vatpic)		mutex_enter(&((vatpic)->lock))
 #define	VATPIC_UNLOCK(vatpic)		mutex_exit(&((vatpic)->lock))
 #define	VATPIC_LOCKED(vatpic)		MUTEX_HELD(&((vatpic)->lock))
@@ -781,7 +779,7 @@ vatpic_init(struct vm *vm)
 {
 	struct vatpic *vatpic;
 
-	vatpic = malloc(sizeof (struct vatpic), M_VATPIC, M_WAITOK | M_ZERO);
+	vatpic = kmem_zalloc(sizeof (struct vatpic), KM_SLEEP);
 	vatpic->vm = vm;
 
 	mutex_init(&vatpic->lock, NULL, MUTEX_ADAPTIVE, NULL);
@@ -793,5 +791,5 @@ void
 vatpic_cleanup(struct vatpic *vatpic)
 {
 	mutex_destroy(&vatpic->lock);
-	free(vatpic, M_VATPIC);
+	kmem_free(vatpic, sizeof (*vatpic));
 }
diff --git a/usr/src/uts/intel/io/vmm/io/vatpit.c b/usr/src/uts/intel/io/vmm/io/vatpit.c
index 3efd5b6ab0..9bf6c01ff4 100644
--- a/usr/src/uts/intel/io/vmm/io/vatpit.c
+++ b/usr/src/uts/intel/io/vmm/io/vatpit.c
@@ -34,7 +34,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/types.h>
 #include <sys/queue.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mutex.h>
 #include <sys/systm.h>
 
@@ -44,8 +44,6 @@ __FBSDID("$FreeBSD$");
 #include "vioapic.h"
 #include "vatpit.h"
 
-static MALLOC_DEFINE(M_VATPIT, "atpit", "bhyve virtual atpit (8254)");
-
 #define	VATPIT_LOCK(vatpit)		mutex_enter(&((vatpit)->lock))
 #define	VATPIT_UNLOCK(vatpit)		mutex_exit(&((vatpit)->lock))
 
@@ -447,7 +445,7 @@ vatpit_init(struct vm *vm)
 	struct vatpit_callout_arg *arg;
 	int i;
 
-	vatpit = malloc(sizeof (struct vatpit), M_VATPIT, M_WAITOK | M_ZERO);
+	vatpit = kmem_zalloc(sizeof (struct vatpit), KM_SLEEP);
 	vatpit->vm = vm;
 
 	mutex_init(&vatpit->lock, NULL, MUTEX_ADAPTIVE, NULL);
@@ -471,7 +469,7 @@ vatpit_cleanup(struct vatpit *vatpit)
 		callout_drain(&vatpit->channel[i].callout);
 
 	mutex_destroy(&vatpit->lock);
-	free(vatpit, M_VATPIT);
+	kmem_free(vatpit, sizeof (*vatpit));
 }
 
 void
diff --git a/usr/src/uts/intel/io/vmm/io/vhpet.c b/usr/src/uts/intel/io/vmm/io/vhpet.c
index e57bca9770..cab4f54458 100644
--- a/usr/src/uts/intel/io/vmm/io/vhpet.c
+++ b/usr/src/uts/intel/io/vmm/io/vhpet.c
@@ -39,7 +39,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/mutex.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/systm.h>
 
 #include <dev/acpica/acpi_hpet.h>
@@ -52,7 +52,6 @@ __FBSDID("$FreeBSD$");
 #include "vioapic.h"
 #include "vhpet.h"
 
-static MALLOC_DEFINE(M_VHPET, "vhpet", "bhyve virtual hpet");
 
 #define	HPET_FREQ	16777216		/* 16.7 (2^24) Mhz */
 #define	FS_PER_S	1000000000000000ul
@@ -682,7 +681,7 @@ vhpet_init(struct vm *vm)
 	uint64_t allowed_irqs;
 	struct vhpet_callout_arg *arg;
 
-	vhpet = malloc(sizeof (struct vhpet), M_VHPET, M_WAITOK | M_ZERO);
+	vhpet = kmem_zalloc(sizeof (struct vhpet), KM_SLEEP);
 	vhpet->vm = vm;
 	mutex_init(&vhpet->lock, NULL, MUTEX_ADAPTIVE, NULL);
 
@@ -722,7 +721,7 @@ vhpet_cleanup(struct vhpet *vhpet)
 		callout_drain(&vhpet->timer[i].callout);
 
 	mutex_destroy(&vhpet->lock);
-	free(vhpet, M_VHPET);
+	kmem_free(vhpet, sizeof (*vhpet));
 }
 
 int
diff --git a/usr/src/uts/intel/io/vmm/io/vioapic.c b/usr/src/uts/intel/io/vmm/io/vioapic.c
index cf09c3adae..8222fd33e3 100644
--- a/usr/src/uts/intel/io/vmm/io/vioapic.c
+++ b/usr/src/uts/intel/io/vmm/io/vioapic.c
@@ -51,7 +51,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mutex.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/cpuset.h>
 
 #include <x86/apicreg.h>
@@ -95,7 +95,6 @@ struct vioapic {
 #define	VIOAPIC_UNLOCK(vioapic)		mutex_exit(&((vioapic)->lock))
 #define	VIOAPIC_LOCKED(vioapic)		MUTEX_HELD(&((vioapic)->lock))
 
-static MALLOC_DEFINE(M_VIOAPIC, "vioapic", "bhyve virtual ioapic");
 
 static void
 vioapic_send_intr(struct vioapic *vioapic, int pin)
@@ -427,7 +426,7 @@ vioapic_init(struct vm *vm)
 	int i;
 	struct vioapic *vioapic;
 
-	vioapic = malloc(sizeof (struct vioapic), M_VIOAPIC, M_WAITOK | M_ZERO);
+	vioapic = kmem_zalloc(sizeof (struct vioapic), KM_SLEEP);
 
 	vioapic->vm = vm;
 	mutex_init(&vioapic->lock, NULL, MUTEX_ADAPTIVE, NULL);
@@ -443,7 +442,7 @@ void
 vioapic_cleanup(struct vioapic *vioapic)
 {
 	mutex_destroy(&vioapic->lock);
-	free(vioapic, M_VIOAPIC);
+	kmem_free(vioapic, sizeof (*vioapic));
 }
 
 int
diff --git a/usr/src/uts/intel/io/vmm/io/vlapic.c b/usr/src/uts/intel/io/vmm/io/vlapic.c
index b3767367ba..50964a9c4c 100644
--- a/usr/src/uts/intel/io/vmm/io/vlapic.c
+++ b/usr/src/uts/intel/io/vmm/io/vlapic.c
@@ -48,7 +48,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mutex.h>
 #include <sys/systm.h>
 #include <sys/cpuset.h>
diff --git a/usr/src/uts/intel/io/vmm/io/vpmtmr.c b/usr/src/uts/intel/io/vmm/io/vpmtmr.c
index 9a7d7d4253..930aa2d237 100644
--- a/usr/src/uts/intel/io/vmm/io/vpmtmr.c
+++ b/usr/src/uts/intel/io/vmm/io/vpmtmr.c
@@ -44,7 +44,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/queue.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/systm.h>
 
 #include <machine/vmm.h>
@@ -67,14 +67,12 @@ struct vpmtmr {
 	hrtime_t	base_time;
 };
 
-static MALLOC_DEFINE(M_VPMTMR, "vpmtmr", "bhyve virtual acpi timer");
-
 struct vpmtmr *
 vpmtmr_init(struct vm *vm)
 {
 	struct vpmtmr *vpmtmr;
 
-	vpmtmr = malloc(sizeof (struct vpmtmr), M_VPMTMR, M_WAITOK | M_ZERO);
+	vpmtmr = kmem_zalloc(sizeof (struct vpmtmr), KM_SLEEP);
 	vpmtmr->vm = vm;
 	vpmtmr->base_time = gethrtime();
 
@@ -111,7 +109,7 @@ vpmtmr_cleanup(struct vpmtmr *vpmtmr)
 	err = vpmtmr_detach_ioport(vpmtmr);
 	VERIFY3P(err, ==, 0);
 
-	free(vpmtmr, M_VPMTMR);
+	kmem_free(vpmtmr, sizeof (*vpmtmr));
 }
 
 int
diff --git a/usr/src/uts/intel/io/vmm/io/vrtc.c b/usr/src/uts/intel/io/vmm/io/vrtc.c
index 8ee724810e..4c74cd7922 100644
--- a/usr/src/uts/intel/io/vmm/io/vrtc.c
+++ b/usr/src/uts/intel/io/vmm/io/vrtc.c
@@ -37,7 +37,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/queue.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mutex.h>
 #include <sys/clock.h>
 #include <sys/sysctl.h>
@@ -105,8 +105,6 @@ struct vrtc {
 static void vrtc_callout_handler(void *arg);
 static void vrtc_set_reg_c(struct vrtc *vrtc, uint8_t newval);
 
-static MALLOC_DEFINE(M_VRTC, "vrtc", "bhyve virtual rtc");
-
 SYSCTL_DECL(_hw_vmm);
 SYSCTL_NODE(_hw_vmm, OID_AUTO, vrtc, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
     NULL);
@@ -927,7 +925,7 @@ vrtc_init(struct vm *vm)
 	time_t curtime;
 	int error;
 
-	vrtc = malloc(sizeof (struct vrtc), M_VRTC, M_WAITOK | M_ZERO);
+	vrtc = kmem_zalloc(sizeof (struct vrtc), KM_SLEEP);
 	vrtc->vm = vm;
 	mutex_init(&vrtc->lock, NULL, MUTEX_ADAPTIVE, NULL);
 	callout_init(&vrtc->callout, 1);
@@ -962,7 +960,7 @@ vrtc_cleanup(struct vrtc *vrtc)
 {
 	callout_drain(&vrtc->callout);
 	mutex_destroy(&vrtc->lock);
-	free(vrtc, M_VRTC);
+	kmem_free(vrtc, sizeof (*vrtc));
 }
 
 void
diff --git a/usr/src/uts/intel/io/vmm/sys/vmm_kernel.h b/usr/src/uts/intel/io/vmm/sys/vmm_kernel.h
index ccc76b29bf..29e90e3a1e 100644
--- a/usr/src/uts/intel/io/vmm/sys/vmm_kernel.h
+++ b/usr/src/uts/intel/io/vmm/sys/vmm_kernel.h
@@ -377,6 +377,9 @@ typedef enum vm_msr_result {
 void vmm_sol_glue_init(void);
 void vmm_sol_glue_cleanup(void);
 
+void *vmm_contig_alloc(size_t);
+void vmm_contig_free(void *, size_t);
+
 int vmm_mod_load(void);
 int vmm_mod_unload(void);
 
diff --git a/usr/src/uts/intel/io/vmm/vmm.c b/usr/src/uts/intel/io/vmm/vmm.c
index aca181814f..800ae4d8ee 100644
--- a/usr/src/uts/intel/io/vmm/vmm.c
+++ b/usr/src/uts/intel/io/vmm/vmm.c
@@ -51,7 +51,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/module.h>
 #include <sys/sysctl.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/pcpu.h>
 #include <sys/mutex.h>
 #include <sys/proc.h>
@@ -272,8 +272,6 @@ static vmm_pte_ops_t *pte_ops = NULL;
 
 SDT_PROVIDER_DEFINE(vmm);
 
-static MALLOC_DEFINE(M_VM, "vm", "vm");
-
 SYSCTL_NODE(_hw, OID_AUTO, vmm, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
     NULL);
 
@@ -536,7 +534,7 @@ vm_create(uint64_t flags, struct vm **retvm)
 	if (vmspace == NULL)
 		return (ENOMEM);
 
-	vm = malloc(sizeof (struct vm), M_VM, M_WAITOK | M_ZERO);
+	vm = kmem_zalloc(sizeof (struct vm), KM_SLEEP);
 
 	vm->vmspace = vmspace;
 	vm->mem_transient = (flags & VCF_RESERVOIR_MEM) == 0;
@@ -657,7 +655,7 @@ void
 vm_destroy(struct vm *vm)
 {
 	vm_cleanup(vm, true);
-	free(vm, M_VM);
+	kmem_free(vm, sizeof (*vm));
 }
 
 int
diff --git a/usr/src/uts/intel/io/vmm/vmm_gpt.c b/usr/src/uts/intel/io/vmm/vmm_gpt.c
index 586b994d56..a542dba055 100644
--- a/usr/src/uts/intel/io/vmm/vmm_gpt.c
+++ b/usr/src/uts/intel/io/vmm/vmm_gpt.c
@@ -15,7 +15,6 @@
  */
 
 #include <sys/types.h>
-#include <sys/malloc.h>
 #include <sys/atomic.h>
 #include <sys/kmem.h>
 #include <sys/sysmacros.h>
diff --git a/usr/src/uts/intel/io/vmm/vmm_sol_glue.c b/usr/src/uts/intel/io/vmm/vmm_sol_glue.c
index 81c3ea0ea9..6e3173581f 100644
--- a/usr/src/uts/intel/io/vmm/vmm_sol_glue.c
+++ b/usr/src/uts/intel/io/vmm/vmm_sol_glue.c
@@ -44,7 +44,7 @@
 #include <sys/archsystm.h>
 #include <sys/cpuset.h>
 #include <sys/fp.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/queue.h>
 #include <sys/spl.h>
 #include <sys/systm.h>
@@ -146,138 +146,117 @@ cpusetobj_ffs(const cpuset_t *set)
 	return (small + 1);
 }
 
-struct kmem_item {
-	void			*addr;
-	size_t			size;
+struct vmm_ptp_item {
+	void *vpi_vaddr;
 };
-static kmutex_t kmem_items_lock;
+static kmutex_t vmm_ptp_lock;
 
-static mod_hash_t *vmm_alloc_hash;
-uint_t vmm_alloc_hash_nchains = 16381;
-uint_t vmm_alloc_hash_size = PAGESIZE;
+static mod_hash_t *vmm_ptp_hash;
+uint_t vmm_ptp_hash_nchains = 16381;
+uint_t vmm_ptp_hash_size = PAGESIZE;
 
 static void
-vmm_alloc_hash_valdtor(mod_hash_val_t val)
+vmm_ptp_hash_valdtor(mod_hash_val_t val)
 {
-	struct kmem_item *i = (struct kmem_item *)val;
+	struct vmm_ptp_item *i = (struct vmm_ptp_item *)val;
 
-	kmem_free(i->addr, i->size);
-	kmem_free(i, sizeof (struct kmem_item));
+	kmem_free(i->vpi_vaddr, PAGE_SIZE);
+	kmem_free(i, sizeof (*i));
 }
 
 static void
-vmm_alloc_init(void)
+vmm_ptp_init(void)
 {
-	vmm_alloc_hash = mod_hash_create_ptrhash("vmm_alloc_hash",
-	    vmm_alloc_hash_nchains, vmm_alloc_hash_valdtor,
-	    vmm_alloc_hash_size);
+	vmm_ptp_hash = mod_hash_create_ptrhash("vmm_ptp_hash",
+	    vmm_ptp_hash_nchains, vmm_ptp_hash_valdtor, vmm_ptp_hash_size);
 
-	VERIFY(vmm_alloc_hash != NULL);
+	VERIFY(vmm_ptp_hash != NULL);
 }
 
 static uint_t
-vmm_alloc_check(mod_hash_key_t key, mod_hash_val_t *val, void *unused)
+vmm_ptp_check(mod_hash_key_t key, mod_hash_val_t *val, void *unused)
 {
-	struct kmem_item *i = (struct kmem_item *)val;
+	struct vmm_ptp_item *i = (struct vmm_ptp_item *)val;
 
-	cmn_err(CE_PANIC, "!vmm_alloc_check: hash not empty: %p, %lu", i->addr,
-	    i->size);
+	cmn_err(CE_PANIC, "!vmm_ptp_check: hash not empty: %p", i->vpi_vaddr);
 
 	return (MH_WALK_TERMINATE);
 }
 
 static void
-vmm_alloc_cleanup(void)
+vmm_ptp_cleanup(void)
 {
-	mod_hash_walk(vmm_alloc_hash, vmm_alloc_check, NULL);
-	mod_hash_destroy_ptrhash(vmm_alloc_hash);
+	mod_hash_walk(vmm_ptp_hash, vmm_ptp_check, NULL);
+	mod_hash_destroy_ptrhash(vmm_ptp_hash);
 }
 
+/*
+ * The logic in VT-d uses both kernel-virtual and direct-mapped addresses when
+ * freeing PTP pages.  Until the consuming code is improved to better track the
+ * pages it allocates, we keep the kernel-virtual addresses to those pages in a
+ * hash table for when they are freed.
+ */
 void *
-malloc(unsigned long size, struct malloc_type *mtp, int flags)
+vmm_ptp_alloc(void)
 {
-	void			*p;
-	struct kmem_item	*i;
-	int			kmem_flag = KM_SLEEP;
+	void *p;
+	struct vmm_ptp_item *i;
 
-	if (flags & M_NOWAIT)
-		kmem_flag = KM_NOSLEEP;
-
-	if (flags & M_ZERO) {
-		p = kmem_zalloc(size, kmem_flag);
-	} else {
-		p = kmem_alloc(size, kmem_flag);
-	}
+	p = kmem_zalloc(PAGE_SIZE, KM_SLEEP);
+	i = kmem_alloc(sizeof (struct vmm_ptp_item), KM_SLEEP);
+	i->vpi_vaddr = p;
 
-	if (p == NULL)
-		return (NULL);
-
-	i = kmem_zalloc(sizeof (struct kmem_item), kmem_flag);
-
-	if (i == NULL) {
-		kmem_free(p, size);
-		return (NULL);
-	}
-
-	mutex_enter(&kmem_items_lock);
-	i->addr = p;
-	i->size = size;
-
-	VERIFY(mod_hash_insert(vmm_alloc_hash,
+	mutex_enter(&vmm_ptp_lock);
+	VERIFY(mod_hash_insert(vmm_ptp_hash,
 	    (mod_hash_key_t)PHYS_TO_DMAP(vtophys(p)), (mod_hash_val_t)i) == 0);
-
-	mutex_exit(&kmem_items_lock);
+	mutex_exit(&vmm_ptp_lock);
 
 	return (p);
 }
 
 void
-free(void *addr, struct malloc_type *mtp)
+vmm_ptp_free(void *addr)
 {
-	mutex_enter(&kmem_items_lock);
-	VERIFY(mod_hash_destroy(vmm_alloc_hash,
+	mutex_enter(&vmm_ptp_lock);
+	VERIFY(mod_hash_destroy(vmm_ptp_hash,
 	    (mod_hash_key_t)PHYS_TO_DMAP(vtophys(addr))) == 0);
-	mutex_exit(&kmem_items_lock);
+	mutex_exit(&vmm_ptp_lock);
 }
 
+/* Reach into i86pc/os/ddi_impl.c for these */
 extern void *contig_alloc(size_t, ddi_dma_attr_t *, uintptr_t, int);
 extern void contig_free(void *, size_t);
 
 void *
-contigmalloc(unsigned long size, struct malloc_type *type, int flags,
-    vm_paddr_t low, vm_paddr_t high, unsigned long alignment,
-    vm_paddr_t boundary)
+vmm_contig_alloc(size_t size)
 {
 	ddi_dma_attr_t attr = {
 		/* Using fastboot_dma_attr as a guide... */
-		DMA_ATTR_V0,
-		low,			/* dma_attr_addr_lo */
-		high,			/* dma_attr_addr_hi */
-		0x00000000FFFFFFFFULL,	/* dma_attr_count_max */
-		alignment,		/* dma_attr_align */
-		1,			/* dma_attr_burstsize */
-		1,			/* dma_attr_minxfer */
-		0x00000000FFFFFFFFULL,	/* dma_attr_maxxfer */
-		0x00000000FFFFFFFFULL,	/* dma_attr_seg: any */
-		1,			/* dma_attr_sgllen */
-		alignment,		/* dma_attr_granular */
-		0,			/* dma_attr_flags */
+		.dma_attr_version	= DMA_ATTR_V0,
+		.dma_attr_addr_lo	= 0,
+		.dma_attr_addr_hi	= ~0UL,
+		.dma_attr_count_max	= 0x00000000FFFFFFFFULL,
+		.dma_attr_align		= PAGE_SIZE,
+		.dma_attr_burstsizes	= 1,
+		.dma_attr_minxfer	= 1,
+		.dma_attr_maxxfer	= 0x00000000FFFFFFFFULL,
+		.dma_attr_seg		= 0x00000000FFFFFFFFULL, /* any */
+		.dma_attr_sgllen	= 1,
+		.dma_attr_granular	= PAGE_SIZE,
+		.dma_attr_flags		= 0,
 	};
-	int cansleep = (flags & M_WAITOK);
-	void *result;
+	void *res;
 
-	ASSERT(alignment == PAGESIZE);
-
-	result = contig_alloc((size_t)size, &attr, alignment, cansleep);
-
-	if (result != NULL && (flags & M_ZERO) != 0) {
-		bzero(result, size);
+	res = contig_alloc(size, &attr, PAGE_SIZE, 1);
+	if (res != NULL) {
+		bzero(res, size);
 	}
-	return (result);
+
+	return (res);
 }
 
 void
-contigfree(void *addr, unsigned long size, struct malloc_type *type)
+vmm_contig_free(void *addr, size_t size)
 {
 	contig_free(addr, size);
 }
@@ -429,14 +408,14 @@ vmm_cpuid_init(void)
 void
 vmm_sol_glue_init(void)
 {
-	vmm_alloc_init();
+	vmm_ptp_init();
 	vmm_cpuid_init();
 }
 
 void
 vmm_sol_glue_cleanup(void)
 {
-	vmm_alloc_cleanup();
+	vmm_ptp_cleanup();
 }
 
 
diff --git a/usr/src/uts/intel/io/vmm/vmm_stat.c b/usr/src/uts/intel/io/vmm/vmm_stat.c
index 1d8644f48d..1a8128d330 100644
--- a/usr/src/uts/intel/io/vmm/vmm_stat.c
+++ b/usr/src/uts/intel/io/vmm/vmm_stat.c
@@ -34,7 +34,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/systm.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 
 #include <machine/vmm.h>
 #include "vmm_util.h"
@@ -51,8 +51,6 @@ __FBSDID("$FreeBSD$");
 static int vst_num_elems, vst_num_types;
 static struct vmm_stat_type *vsttab[MAX_VMM_STAT_ELEMS];
 
-static MALLOC_DEFINE(M_VMM_STAT, "vmm stat", "vmm stat");
-
 #define	vst_size	((size_t)vst_num_elems * sizeof (uint64_t))
 
 void
@@ -122,21 +120,19 @@ vmm_stat_copy(struct vm *vm, int vcpu, int index, int count, int *num_stats,
 void *
 vmm_stat_alloc(void)
 {
-
-	return (malloc(vst_size, M_VMM_STAT, M_WAITOK));
+	return (kmem_alloc(vst_size, KM_SLEEP));
 }
 
 void
 vmm_stat_init(void *vp)
 {
-
 	bzero(vp, vst_size);
 }
 
 void
 vmm_stat_free(void *vp)
 {
-	free(vp, M_VMM_STAT);
+	kmem_free(vp, vst_size);
 }
 
 int
diff --git a/usr/src/uts/intel/io/vmm/vmm_vm.c b/usr/src/uts/intel/io/vmm/vmm_vm.c
index 6e75e6bf87..42d963a53c 100644
--- a/usr/src/uts/intel/io/vmm/vmm_vm.c
+++ b/usr/src/uts/intel/io/vmm/vmm_vm.c
@@ -26,7 +26,6 @@
 #include <sys/sysmacros.h>
 #include <sys/machsystm.h>
 #include <sys/vmsystm.h>
-#include <sys/malloc.h>
 #include <sys/x86_archext.h>
 #include <vm/as.h>
 #include <vm/hat_i86.h>