Index: kern/kern_exit.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_exit.c,v
retrieving revision 1.149
diff -u -p -r1.149 kern_exit.c
--- kern/kern_exit.c	14 Mar 2015 03:38:50 -0000	1.149
+++ kern/kern_exit.c	24 Apr 2015 05:16:29 -0000
@@ -438,6 +438,9 @@ reaper(void)
 		LIST_REMOVE(p, p_hash);
 		mtx_leave(&deadproc_mutex);
 
+		uvm_uarea_free(p->p_addr);
+		p->p_addr = NULL;
+
 		KERNEL_LOCK();
 
 		/*
@@ -445,7 +448,6 @@ reaper(void)
 		 * We must do this from a valid thread because doing
 		 * so may block.
 		 */
-		uvm_uarea_free(p);
 		p->p_vmspace = NULL;		/* zap the thread's copy */
 
 		if (p->p_flag & P_THREAD) {
Index: kern/kern_fork.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_fork.c,v
retrieving revision 1.180
diff -u -p -r1.180 kern_fork.c
--- kern/kern_fork.c	14 Mar 2015 07:33:42 -0000	1.180
+++ kern/kern_fork.c	24 Apr 2015 05:16:29 -0000
@@ -257,7 +257,7 @@ fork1(struct proc *curp, int flags, void
 	uid_t uid;
 	struct vmspace *vm;
 	int count;
-	vaddr_t uaddr;
+	struct user *uaddr;
 	int s;
 	struct  ptrace_state *newptstat = NULL;
 #if NSYSTRACE > 0
@@ -320,7 +320,7 @@ fork1(struct proc *curp, int flags, void
 	}
 
 	uaddr = uvm_uarea_alloc();
-	if (uaddr == 0) {
+	if (uaddr == NULL) {
 		if ((flags & FORK_THREAD) == 0) {
 			(void)chgproccnt(uid, -1);
 			nprocesses--;
@@ -399,7 +399,7 @@ fork1(struct proc *curp, int flags, void
 	if (pr->ps_emul->e_proc_fork)
 		(*pr->ps_emul->e_proc_fork)(p, curp);
 
-	p->p_addr = (struct user *)uaddr;
+	p->p_addr = uaddr;
 
 	/*
 	 * Finish creating the child thread.  cpu_fork() will copy
Index: uvm/uvm_extern.h
===================================================================
RCS file: /cvs/src/sys/uvm/uvm_extern.h,v
retrieving revision 1.131
diff -u -p -r1.131 uvm_extern.h
--- uvm/uvm_extern.h	7 Feb 2015 08:21:24 -0000	1.131
+++ uvm/uvm_extern.h	24 Apr 2015 05:16:32 -0000
@@ -289,8 +289,9 @@ int			uvm_fault(vm_map_t, vaddr_t, vm_fa
 #if defined(KGDB)
 void			uvm_chgkprot(caddr_t, size_t, int);
 #endif
-vaddr_t			uvm_uarea_alloc(void);
-void			uvm_uarea_free(struct proc *);
+void			uvm_uarea_init(void);
+void *			uvm_uarea_alloc(void);
+void			uvm_uarea_free(void *);
 void			uvm_exit(struct process *);
 void			uvm_init_limits(struct proc *);
 boolean_t		uvm_kernacc(caddr_t, size_t, int);
Index: uvm/uvm_glue.c
===================================================================
RCS file: /cvs/src/sys/uvm/uvm_glue.c,v
retrieving revision 1.69
diff -u -p -r1.69 uvm_glue.c
--- uvm/uvm_glue.c	15 Dec 2014 20:38:22 -0000	1.69
+++ uvm/uvm_glue.c	24 Apr 2015 05:16:32 -0000
@@ -76,9 +76,12 @@
 #include <sys/shm.h>
 #endif
 #include <sys/sched.h>
+#include <sys/pool.h>
 
 #include <uvm/uvm.h>
 
+struct pool uarea_pool;
+
 /*
  * uvm_kernacc: can the kernel access a region of memory
  *
@@ -287,22 +290,27 @@ uvm_vsunlock_device(struct proc *p, void
 	uvm_km_free(kernel_map, kva, sz);
 }
 
+void
+uvm_uarea_init(void)
+{
+	pool_init(&uarea_pool, USPACE, USPACE_ALIGN, 0,
+	    PR_WAITOK, "uarea", NULL);
+	pool_setipl(&uarea_pool, IPL_NONE);
+}
+
 /*
  * uvm_uarea_alloc: allocate the u-area for a new thread
  */
-vaddr_t
+void *
 uvm_uarea_alloc(void)
 {
-	vaddr_t uaddr;
+	void *uaddr;
 
-	uaddr = uvm_km_kmemalloc_pla(kernel_map, uvm.kernel_object, USPACE,
-	    USPACE_ALIGN, UVM_KMF_ZERO,
-	    no_constraint.ucr_low, no_constraint.ucr_high,
-	    0, 0, USPACE/PAGE_SIZE);
+	uaddr = pool_get(&uarea_pool, PR_WAITOK | PR_ZERO);
 
 #ifdef PMAP_UAREA
 	/* Tell the pmap this is a u-area mapping */
-	if (uaddr != 0)
+	if (uaddr != NULL)
 		PMAP_UAREA(uaddr);
 #endif
 
@@ -316,10 +324,9 @@ uvm_uarea_alloc(void)
  *   are running on a different context now (the reaper).
  */
 void
-uvm_uarea_free(struct proc *p)
+uvm_uarea_free(void *uarea)
 {
-	uvm_km_free(kernel_map, (vaddr_t)p->p_addr, USPACE);
-	p->p_addr = NULL;
+	pool_put(&uarea_pool, uarea);
 }
 
 /*
Index: uvm/uvm_init.c
===================================================================
RCS file: /cvs/src/sys/uvm/uvm_init.c,v
retrieving revision 1.39
diff -u -p -r1.39 uvm_init.c
--- uvm/uvm_init.c	14 Mar 2015 03:38:53 -0000	1.39
+++ uvm/uvm_init.c	24 Apr 2015 05:16:32 -0000
@@ -167,6 +167,11 @@ uvm_init(void)
 	 */
 	uvm_anon_init();
 
+	/*
+	 * init uarea systems
+	 */
+	uvm_uarea_init();
+
 #ifndef SMALL_KERNEL
 	/*
 	 * Switch kernel and kmem_map over to a best-fit allocator,