Index: ext2fs/ext2fs_inode.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ext2fs/ext2fs_inode.c,v
retrieving revision 1.74
diff -u -p -r1.74 ext2fs_inode.c
--- ext2fs/ext2fs_inode.c	16 Jun 2011 09:21:03 -0000	1.74
+++ ext2fs/ext2fs_inode.c	27 Aug 2011 09:46:55 -0000
@@ -70,7 +70,7 @@ __KERNEL_RCSID(0, "$NetBSD: ext2fs_inode
 #include <sys/buf.h>
 #include <sys/vnode.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/trace.h>
 #include <sys/resourcevar.h>
 #include <sys/kauth.h>
@@ -499,7 +499,7 @@ ext2fs_indirtrunc(struct inode *ip, dadd
 	bap = (int32_t *)bp->b_data;	/* XXX ondisk32 */
 	if (lastbn >= 0) {
 		/* XXX ondisk32 */
-		copy = malloc(fs->e2fs_bsize, M_TEMP, M_WAITOK);
+		copy = kmem_alloc(fs->e2fs_bsize, KM_SLEEP);
 		memcpy((void *)copy, (void *)bap, (u_int)fs->e2fs_bsize);
 		memset((void *)&bap[last + 1], 0,
 			(u_int)(NINDIR(fs) - (last + 1)) * sizeof (uint32_t));
@@ -548,7 +548,7 @@ ext2fs_indirtrunc(struct inode *ip, dadd
 	}
 
 	if (copy != NULL) {
-		free(copy, M_TEMP);
+		kmem_free(copy, fs->e2fs_bsize);
 	} else {
 		brelse(bp, BC_INVAL);
 	}
Index: ext2fs/ext2fs_lookup.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ext2fs/ext2fs_lookup.c,v
retrieving revision 1.66
diff -u -p -r1.66 ext2fs_lookup.c
--- ext2fs/ext2fs_lookup.c	12 Jul 2011 16:59:48 -0000	1.66
+++ ext2fs/ext2fs_lookup.c	27 Aug 2011 09:46:56 -0000
@@ -57,6 +57,7 @@ __KERNEL_RCSID(0, "$NetBSD: ext2fs_looku
 #include <sys/file.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
+#include <sys/kmem.h>
 #include <sys/malloc.h>
 #include <sys/dirent.h>
 #include <sys/kauth.h>
@@ -167,15 +168,14 @@ ext2fs_readdir(void *v)
 	aiov.iov_len = e2fs_count;
 	auio.uio_resid = e2fs_count;
 	UIO_SETUP_SYSSPACE(&auio);
-	dirbuf = malloc(e2fs_count, M_TEMP, M_WAITOK);
-	dstd = malloc(sizeof(struct dirent), M_TEMP, M_WAITOK | M_ZERO);
+	dirbuf = kmem_zalloc(e2fs_count, KM_SLEEP);
+	dstd = kmem_zalloc(sizeof(struct dirent), KM_SLEEP);
 	if (ap->a_ncookies) {
 		nc = e2fs_count / _DIRENT_MINSIZE((struct dirent *)0);
 		ncookies = nc;
 		cookies = malloc(sizeof (off_t) * ncookies, M_TEMP, M_WAITOK);
 		*ap->a_cookies = cookies;
 	}
-	memset(dirbuf, 0, e2fs_count);
 	aiov.iov_base = dirbuf;
 
 	error = VOP_READ(ap->a_vp, &auio, 0, ap->a_cred);
@@ -209,8 +209,8 @@ ext2fs_readdir(void *v)
 		/* we need to correct uio_offset */
 		uio->uio_offset = off;
 	}
-	free(dirbuf, M_TEMP);
-	free(dstd, M_TEMP);
+	kmem_free(dirbuf, e2fs_count);
+	kmem_free(dstd, sizeof(*dstd));
 	*ap->a_eofflag = ext2fs_size(VTOI(ap->a_vp)) <= uio->uio_offset;
 	if (ap->a_ncookies) {
 		if (error) {
Index: ffs/ffs_inode.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ffs/ffs_inode.c,v
retrieving revision 1.107
diff -u -p -r1.107 ffs_inode.c
--- ffs/ffs_inode.c	16 Jun 2011 09:21:03 -0000	1.107
+++ ffs/ffs_inode.c	27 Aug 2011 09:46:56 -0000
@@ -75,7 +75,7 @@ __KERNEL_RCSID(0, "$NetBSD: ffs_inode.c,
 #include <sys/fstrans.h>
 #include <sys/kauth.h>
 #include <sys/kernel.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
 #include <sys/resourcevar.h>
@@ -618,7 +618,7 @@ ffs_indirtrunc(struct inode *ip, daddr_t
 	else
 		bap2 = (int64_t *)bp->b_data;
 	if (lastbn >= 0) {
-		copy = malloc(fs->fs_bsize, M_TEMP, M_WAITOK);
+		copy = kmem_alloc(fs->fs_bsize, KM_SLEEP);
 		memcpy((void *)copy, bp->b_data, (u_int)fs->fs_bsize);
 		for (i = last + 1; i < NINDIR(fs); i++)
 			BAP_ASSIGN(ip, i, 0);
@@ -673,7 +673,7 @@ ffs_indirtrunc(struct inode *ip, daddr_t
 	}
 
 	if (copy != NULL) {
-		free(copy, M_TEMP);
+		kmem_free(copy, fs->fs_bsize);
 	} else {
 		brelse(bp, BC_INVAL);
 	}
Index: ffs/ffs_vfsops.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ffs/ffs_vfsops.c,v
retrieving revision 1.268
diff -u -p -r1.268 ffs_vfsops.c
--- ffs/ffs_vfsops.c	17 Jun 2011 14:23:52 -0000	1.268
+++ ffs/ffs_vfsops.c	27 Aug 2011 09:46:57 -0000
@@ -84,7 +84,7 @@ __KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c
 #include <sys/disklabel.h>
 #include <sys/ioctl.h>
 #include <sys/errno.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/pool.h>
 #include <sys/lock.h>
 #include <sys/sysctl.h>
@@ -645,7 +645,7 @@ ffs_reload(struct mount *mp, kauth_cred_
 		brelse(bp, 0);
 		return (error);
 	}
-	newfs = malloc(fs->fs_sbsize, M_UFSMNT, M_WAITOK);
+	newfs = kmem_alloc(fs->fs_sbsize, KM_SLEEP);
 	memcpy(newfs, bp->b_data, fs->fs_sbsize);
 #ifdef FFS_EI
 	if (ump->um_flags & UFS_NEEDSWAP) {
@@ -659,7 +659,7 @@ ffs_reload(struct mount *mp, kauth_cred_
 	     newfs->fs_bsize > MAXBSIZE ||
 	     newfs->fs_bsize < sizeof(struct fs)) {
 		brelse(bp, 0);
-		free(newfs, M_UFSMNT);
+		kmem_free(newfs, fs->fs_sbsize);
 		return (EIO);		/* XXX needs translation */
 	}
 	/* Store off old fs_sblockloc for fs_oldfscompat_read. */
@@ -676,7 +676,7 @@ ffs_reload(struct mount *mp, kauth_cred_
 	newfs->fs_active = fs->fs_active;
 	memcpy(fs, newfs, (u_int)fs->fs_sbsize);
 	brelse(bp, 0);
-	free(newfs, M_UFSMNT);
+	kmem_free(newfs, fs->fs_sbsize);
 
 	/* Recheck for apple UFS filesystem */
 	ump->um_flags &= ~UFS_ISAPPLEUFS;
@@ -864,6 +864,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 	int32_t *lp;
 	kauth_cred_t cred;
 	u_int32_t sbsize = 8192;	/* keep gcc happy*/
+	u_int32_t allocsbsize;
 	int32_t fsbsize;
 
 	dev = devvp->v_rdev;
@@ -888,7 +889,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 	if (error)
 		return error;
 
-	ump = malloc(sizeof *ump, M_UFSMNT, M_WAITOK);
+	ump = kmem_alloc(sizeof(*ump), KM_SLEEP);
 	memset(ump, 0, sizeof *ump);
 	mutex_init(&ump->um_lock, MUTEX_DEFAULT, IPL_NONE);
 	error = ffs_snapshot_init(ump);
@@ -985,7 +986,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 		break;
 	}
 
-	fs = malloc((u_long)sbsize, M_UFSMNT, M_WAITOK);
+	fs = kmem_alloc((u_long)sbsize, KM_SLEEP);
 	memcpy(fs, bp->b_data, sbsize);
 	ump->um_fs = fs;
 
@@ -1022,7 +1023,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 			/* Force a re-read of the superblock */
 			brelse(bp, BC_INVAL);
 			bp = NULL;
-			free(fs, M_UFSMNT);
+			kmem_free(fs, sbsize);
 			fs = NULL;
 			goto sbagain;
 		}
@@ -1150,7 +1151,8 @@ ffs_mountfs(struct vnode *devvp, struct 
 	if (fs->fs_contigsumsize > 0)
 		bsize += fs->fs_ncg * sizeof(int32_t);
 	bsize += fs->fs_ncg * sizeof(*fs->fs_contigdirs);
-	space = malloc((u_long)bsize, M_UFSMNT, M_WAITOK);
+	allocsbsize = bsize;
+	space = kmem_alloc((u_long)allocsbsize, KM_SLEEP);
 	fs->fs_csp = space;
 	for (i = 0; i < blks; i += fs->fs_frag) {
 		bsize = fs->fs_bsize;
@@ -1159,7 +1161,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 		error = bread(devvp, fsbtodb(fs, fs->fs_csaddr + i), bsize,
 			      cred, 0, &bp);
 		if (error) {
-			free(fs->fs_csp, M_UFSMNT);
+			kmem_free(fs->fs_csp, allocsbsize);
 			goto out;
 		}
 #ifdef FFS_EI
@@ -1243,7 +1245,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 
 		error = ffs_wapbl_start(mp);
 		if (error) {
-			free(fs->fs_csp, M_UFSMNT);
+			kmem_free(fs->fs_csp, allocsbsize);
 			goto out;
 		}
 	}
@@ -1252,7 +1254,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 #ifdef QUOTA2
 		error = ffs_quota2_mount(mp);
 		if (error) {
-			free(fs->fs_csp, M_UFSMNT);
+			kmem_free(fs->fs_csp, allocsbsize);
 			goto out;
 		}
 #else
@@ -1263,7 +1265,7 @@ ffs_mountfs(struct vnode *devvp, struct 
 			    (mp->mnt_flag & MNT_FORCE) ? "" : ", not mounting");
 			if ((mp->mnt_flag & MNT_FORCE) == 0) {
 				error = EINVAL;
-				free(fs->fs_csp, M_UFSMNT);
+				kmem_free(fs->fs_csp, allocsbsize);
 				goto out;
 			}
 		}
@@ -1290,15 +1292,15 @@ out:
 
 	fstrans_unmount(mp);
 	if (fs)
-		free(fs, M_UFSMNT);
+		kmem_free(fs, fs->fs_sbsize);
 	devvp->v_specmountpoint = NULL;
 	if (bp)
 		brelse(bp, bset);
 	if (ump) {
 		if (ump->um_oldfscompat)
-			free(ump->um_oldfscompat, M_UFSMNT);
+			kmem_free(ump->um_oldfscompat, 512 + 3*sizeof(int32_t));
 		mutex_destroy(&ump->um_lock);
-		free(ump, M_UFSMNT);
+		kmem_free(ump, sizeof(*ump));
 		mp->mnt_data = NULL;
 	}
 	return (error);
@@ -1322,8 +1324,8 @@ ffs_oldfscompat_read(struct fs *fs, stru
 		return;
 
 	if (!ump->um_oldfscompat)
-		ump->um_oldfscompat = malloc(512 + 3*sizeof(int32_t),
-		    M_UFSMNT, M_WAITOK);
+		ump->um_oldfscompat = kmem_alloc(512 + 3*sizeof(int32_t),
+		    KM_SLEEP);
 
 	memcpy(ump->um_oldfscompat, &fs->fs_old_postbl_start, 512);
 	extrasave = ump->um_oldfscompat;
@@ -1429,6 +1431,7 @@ ffs_unmount(struct mount *mp, int mntfla
 	struct ufsmount *ump = VFSTOUFS(mp);
 	struct fs *fs = ump->um_fs;
 	int error, flags;
+	u_int32_t bsize;
 #ifdef WAPBL
 	extern int doforce;
 #endif
@@ -1475,13 +1478,19 @@ ffs_unmount(struct mount *mp, int mntfla
 	(void)VOP_CLOSE(ump->um_devvp, fs->fs_ronly ? FREAD : FREAD | FWRITE,
 		NOCRED);
 	vput(ump->um_devvp);
-	free(fs->fs_csp, M_UFSMNT);
-	free(fs, M_UFSMNT);
+
+	bsize = fs->fs_cssize;
+	if (fs->fs_contigsumsize > 0)
+		bsize += fs->fs_ncg * sizeof(int32_t);
+	bsize += fs->fs_ncg * sizeof(*fs->fs_contigdirs);
+	kmem_free(fs->fs_csp, bsize);
+
+	kmem_free(fs, fs->fs_sbsize);
 	if (ump->um_oldfscompat != NULL)
-		free(ump->um_oldfscompat, M_UFSMNT);
+		kmem_free(ump->um_oldfscompat, 512 + 3*sizeof(int32_t));
 	mutex_destroy(&ump->um_lock);
 	ffs_snapshot_fini(ump);
-	free(ump, M_UFSMNT);
+	kmem_free(ump, sizeof(*ump));
 	mp->mnt_data = NULL;
 	mp->mnt_flag &= ~MNT_LOCAL;
 	fstrans_unmount(mp);
Index: ufs/ufs_extattr.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ufs/ufs_extattr.c,v
retrieving revision 1.35
diff -u -p -r1.35 ufs_extattr.c
--- ufs/ufs_extattr.c	7 Jul 2011 14:56:45 -0000	1.35
+++ ufs/ufs_extattr.c	27 Aug 2011 09:46:58 -0000
@@ -60,7 +60,7 @@ __KERNEL_RCSID(0, "$NetBSD: ufs_extattr.
 #include <sys/kauth.h>
 #include <sys/kernel.h>
 #include <sys/namei.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/fcntl.h>
 #include <sys/lwp.h>
 #include <sys/vnode.h>
@@ -77,8 +77,6 @@ __KERNEL_RCSID(0, "$NetBSD: ufs_extattr.
 #include <ufs/ufs/ufs_bswap.h>
 #include <ufs/ufs/ufs_extern.h>
 
-static MALLOC_JUSTDEFINE(M_UFS_EXTATTR, "ufs_extattr","ufs extended attribute");
-
 int ufs_extattr_sync = 1;
 int ufs_extattr_autocreate = 1024;
 
@@ -506,7 +504,7 @@ ufs_extattr_iterate_directory(struct ufs
 	if (dvp->v_type != VDIR)
 		return (ENOTDIR);
 
-	dirbuf = malloc(DIRBLKSIZ, M_TEMP, M_WAITOK);
+	dirbuf = kmem_alloc(DIRBLKSIZ, KM_SLEEP);
 
 	auio.uio_iov = &aiov;
 	auio.uio_iovcnt = 1;
@@ -578,7 +576,7 @@ ufs_extattr_iterate_directory(struct ufs
 				break;
 		}
 	}
-	free(dirbuf, M_TEMP);
+	kmem_free(dirbuf, DIRBLKSIZ);
 	
 	return (0);
 }
@@ -736,8 +734,7 @@ ufs_extattr_enable(struct ufsmount *ump,
 	if (backing_vnode->v_type != VREG)
 		return (EINVAL);
 
-	attribute = malloc(sizeof(*attribute), M_UFS_EXTATTR,
-	    M_WAITOK | M_ZERO);
+	attribute = kmem_zalloc(sizeof(*attribute), KM_SLEEP);
 
 	if (!(ump->um_extattr.uepm_flags & UFS_EXTATTR_UEPM_STARTED)) {
 		error = EOPNOTSUPP;
@@ -818,7 +815,7 @@ ufs_extattr_enable(struct ufsmount *ump,
 	VOP_UNLOCK(backing_vnode);
 
  free_exit:
-	free(attribute, M_UFS_EXTATTR);
+	kmem_free(attribute, sizeof(*attribute));
 	return (error);
 }
 
@@ -844,7 +841,7 @@ ufs_extattr_disable(struct ufsmount *ump
 	error = vn_close(uele->uele_backing_vnode, FREAD|FWRITE,
 	    l->l_cred);
 
-	free(uele, M_UFS_EXTATTR);
+	kmem_free(uele, sizeof(*uele));
 
 	return (error);
 }
@@ -1540,12 +1537,10 @@ void
 ufs_extattr_init(void)
 {
 
-	malloc_type_attach(M_UFS_EXTATTR);
 }
 
 void
 ufs_extattr_done(void)
 {
 
-	malloc_type_detach(M_UFS_EXTATTR);
 }
Index: ufs/ufs_vfsops.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ufs/ufs_vfsops.c,v
retrieving revision 1.42
diff -u -p -r1.42 ufs_vfsops.c
--- ufs/ufs_vfsops.c	24 Mar 2011 17:05:46 -0000	1.42
+++ ufs/ufs_vfsops.c	27 Aug 2011 09:46:58 -0000
@@ -50,7 +50,7 @@ __KERNEL_RCSID(0, "$NetBSD: ufs_vfsops.c
 #include <sys/proc.h>
 #include <sys/buf.h>
 #include <sys/vnode.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/kauth.h>
 
 #include <miscfs/specfs/specdev.h>
Index: ufs/ufs_vnops.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ufs/ufs_vnops.c,v
retrieving revision 1.202
diff -u -p -r1.202 ufs_vnops.c
--- ufs/ufs_vnops.c	3 Aug 2011 10:03:51 -0000	1.202
+++ ufs/ufs_vnops.c	27 Aug 2011 09:46:59 -0000
@@ -84,6 +84,7 @@ __KERNEL_RCSID(0, "$NetBSD: ufs_vnops.c,
 #include <sys/proc.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
+#include <sys/kmem.h>
 #include <sys/malloc.h>
 #include <sys/dirent.h>
 #include <sys/lockf.h>
@@ -2319,7 +2320,7 @@ ufs_readdir(void *v)
 	struct uio	auio, *uio;
 	struct iovec	aiov;
 	int		error;
-	size_t		count, ccount, rcount;
+	size_t		count, ccount, rcount, cdbufsz, ndbufsz;
 	off_t		off, *ccp;
 	off_t		startoff;
 	size_t		skipbytes;
@@ -2347,12 +2348,13 @@ ufs_readdir(void *v)
 	auio.uio_resid = rcount;
 	UIO_SETUP_SYSSPACE(&auio);
 	auio.uio_rw = UIO_READ;
-	cdbuf = malloc(rcount, M_TEMP, M_WAITOK);
+	cdbufsz = rcount;
+	cdbuf = kmem_alloc(cdbufsz, KM_SLEEP);
 	aiov.iov_base = cdbuf;
 	aiov.iov_len = rcount;
 	error = VOP_READ(vp, &auio, 0, ap->a_cred);
 	if (error != 0) {
-		free(cdbuf, M_TEMP);
+		kmem_free(cdbuf, cdbufsz);
 		return error;
 	}
 
@@ -2361,7 +2363,8 @@ ufs_readdir(void *v)
 	cdp = (struct direct *)(void *)cdbuf;
 	ecdp = (struct direct *)(void *)&cdbuf[rcount];
 
-	ndbuf = malloc(count, M_TEMP, M_WAITOK);
+	ndbufsz = count;
+	ndbuf = kmem_alloc(ndbufsz, KM_SLEEP);
 	ndp = (struct dirent *)(void *)ndbuf;
 	endp = &ndbuf[count];
 
@@ -2435,8 +2438,8 @@ out:
 		}
 	}
 	uio->uio_offset = off;
-	free(ndbuf, M_TEMP);
-	free(cdbuf, M_TEMP);
+	kmem_free(ndbuf, ndbufsz);
+	kmem_free(cdbuf, cdbufsz);
 	*ap->a_eofflag = VTOI(vp)->i_size <= uio->uio_offset;
 	return error;
 }
Index: ufs/ufs_wapbl.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ufs/ufs_wapbl.c,v
retrieving revision 1.22
diff -u -p -r1.22 ufs_wapbl.c
--- ufs/ufs_wapbl.c	18 Jul 2011 06:46:05 -0000	1.22
+++ ufs/ufs_wapbl.c	27 Aug 2011 09:46:59 -0000
@@ -79,7 +79,6 @@ __KERNEL_RCSID(0, "$NetBSD: ufs_wapbl.c,
 #include <sys/proc.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
-#include <sys/malloc.h>
 #include <sys/dirent.h>
 #include <sys/lockf.h>
 #include <sys/kauth.h>
