diff -ruN kozos27/Makefile kozos28/Makefile
--- kozos27/Makefile	Wed Dec 12 13:19:43 2007
+++ kozos28/Makefile	Wed Dec 12 14:51:45 2007
@@ -1,4 +1,4 @@
-OBJS += thread.o syscall.o outlog.o extintr.o idle.o
+OBJS += thread.o syscall.o memory.o outlog.o extintr.o idle.o
 OBJS += stubd.o stublib.o i386-stub.o
 OBJS += main.o clock.o telnetd.o httpd.o
 TARGET ?= koz
diff -ruN kozos27/clock.c kozos28/clock.c
--- kozos27/clock.c	Wed Dec 12 13:19:43 2007
+++ kozos28/clock.c	Wed Dec 12 14:56:14 2007
@@ -17,7 +17,7 @@
     kz_recv(NULL, NULL);
 
     t = time(NULL);
-    p = kz_memalloc(128);
+    p = kz_kmalloc(128);
     strcpy(p, ctime(&t));
     kz_send(outlog_id, 0, p);
   }
diff -ruN kozos27/extintr.c kozos28/extintr.c
--- kozos27/extintr.c	Wed Dec 12 13:19:43 2007
+++ kozos28/extintr.c	Wed Dec 12 15:10:44 2007
@@ -10,7 +10,7 @@
 #include "kozos.h"
 #include "thread.h"
 
-#define BUFFER_SIZE 2048
+#define BUFFER_SIZE 1024
 
 int extintr_id;
 
@@ -96,12 +96,12 @@
       FD_CLR(fd, &readfds);
       ibp = *ibpp;
       *ibpp = (*ibpp)->next;
-      kz_memfree(ibp);
+      kz_kmfree(ibp);
       return -1;
     }
   }
 
-  ibp = kz_memalloc(sizeof(*ibp));
+  ibp = kz_kmalloc(sizeof(*ibp));
   ibp->next = NULL;
   ibp->fd = fd;
   ibp->id = id;
@@ -154,7 +154,7 @@
 		kz_send(ibp->id, s, NULL);
 	      break;
 	    case INTR_TYPE_READ:
-	      buffer = kz_memalloc(BUFFER_SIZE);
+	      buffer = kz_kmalloc(BUFFER_SIZE);
 	      size = read(ibp->fd, buffer, BUFFER_SIZE);
 	      if (size >= 0)
 		kz_send(ibp->id, size, buffer);
diff -ruN kozos27/httpd.c kozos28/httpd.c
--- kozos27/httpd.c	Wed Dec 12 13:19:43 2007
+++ kozos28/httpd.c	Wed Dec 12 14:56:28 2007
@@ -37,7 +37,7 @@
       break;
     }
     memcpy(buffer + len, p, size);
-    kz_memfree(p);
+    kz_kmfree(p);
     len += size;
     buffer[len] = '\0';
   } while (strchr(buffer, '\n') == NULL);
diff -ruN kozos27/kozos.h kozos28/kozos.h
--- kozos27/kozos.h	Wed Dec 12 13:19:43 2007
+++ kozos28/kozos.h	Wed Dec 12 14:58:53 2007
@@ -19,11 +19,14 @@
 int kz_pending();
 int kz_setsig(int signo);
 int kz_debug(int sockt);
+void *kz_kmalloc(int size);
+int kz_kmfree(void *p);
 void *kz_memalloc(int size);
 int kz_memfree(void *p);
 
 /* library */
 void kz_start(kz_func func, char *name, int pri, int argc, char *argv[]);
+void kz_sysdown();
 void kz_trap();
 void kz_break();
 
diff -ruN kozos27/main.c kozos28/main.c
--- kozos27/main.c	Wed Dec 12 13:19:43 2007
+++ kozos28/main.c	Wed Dec 12 15:01:34 2007
@@ -1,61 +1,17 @@
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include "kozos.h"
 
-static char *outnum[] = { "ABCDEFGHIJ", "abcdefghij", "0123456789" };
-
-static int sample_main(int argc, char *argv[])
-{
-  int i, count;
-  char buf[128];
-  char *p = buf;
-
-#define INTERVAL 5 /* CPU能力に応じて調整してください */
-  while (1) {
-    count = 0;
-    kz_timer(INTERVAL - argc);
-    kz_recv(NULL, NULL);
-    p[0] = '[';
-    p[1] = '0' + argc;
-    p[2] = ']';
-    p[3] = '\0';
-    write(2, buf, 3);
-    for (i = 0; i < 70; i++) {
-      p[0] = outnum[argc][(count++) % 10];
-      p[1] = '\0';
-      write(2, buf, 1);
-    }
-    p[0] = '\n';
-    p[1] = '\0';
-    write(2, buf, 1);
-  }
-  return 0;
-}
-
 int mainfunc(int argc, char *argv[])
 {
-  int sample1_id;
-  int sample2_id;
-  int sample3_id;
-
   extintr_id  = kz_run(extintr_main,  "extintr",   1, 0, NULL);
-#if 0
   stubd_id    = kz_run(stubd_main,    "stubd",     2, 0, NULL);
-#endif
   outlog_id   = kz_run(outlog_main,   "outlog",    3, 0, NULL);
   idle_id     = kz_run(idle_main,     "idle",     31, 0, NULL);
-#if 0
   clock_id    = kz_run(clock_main,    "clock",     7, 0, NULL);
   telnetd_id  = kz_run(telnetd_main,  "telnetd",   8, 0, NULL);
   httpd_id    = kz_run(httpd_main,    "httpd",     9, 0, NULL);
-#endif
-  httpd_id    = kz_run(httpd_main,    "httpd",     9, 0, NULL);
-
-  sample1_id  = kz_run(sample_main,   "sample1",  10, 0, NULL);
-  sample2_id  = kz_run(sample_main,   "sample2",  10, 1, NULL);
-  sample3_id  = kz_run(sample_main,   "sample3",  10, 2, NULL);
 
   return 0;
 }
diff -ruN kozos27/memory.c kozos28/memory.c
--- kozos27/memory.c	Thu Jan  1 09:00:00 1970
+++ kozos28/memory.c	Wed Dec 12 15:18:32 2007
@@ -0,0 +1,109 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "kozos.h"
+#include "memory.h"
+
+#define MEMORY_AREA1_SIZE 128
+#define MEMORY_AREA1_NUM  100
+#define MEMORY_AREA2_SIZE 512
+#define MEMORY_AREA2_NUM  50
+#define MEMORY_AREA3_SIZE 2048
+#define MEMORY_AREA3_NUM  20
+
+static char memory_area_1[MEMORY_AREA1_SIZE * MEMORY_AREA1_NUM];
+static char memory_area_2[MEMORY_AREA2_SIZE * MEMORY_AREA2_NUM];
+static char memory_area_3[MEMORY_AREA3_SIZE * MEMORY_AREA3_NUM];
+
+typedef struct _kzmem {
+  struct _kzmem *next;
+  int size;
+  int dummy[2];
+} kzmem;
+
+typedef struct _kzmem_pool {
+  char *area;
+  int size;
+  int num;
+  kzmem *free;
+} kzmem_pool;
+
+static kzmem_pool pool[] = {
+  { memory_area_1, MEMORY_AREA1_SIZE, MEMORY_AREA1_NUM, NULL },
+  { memory_area_2, MEMORY_AREA2_SIZE, MEMORY_AREA2_NUM, NULL },
+  { memory_area_3, MEMORY_AREA3_SIZE, MEMORY_AREA3_NUM, NULL },
+};
+
+#define MEMORY_AREA_NUM (sizeof(pool) / sizeof(*pool))
+
+static int kzmem_init_pool(kzmem_pool *p)
+{
+  int i;
+  kzmem *mp;
+  kzmem **mpp;
+
+  mp = (kzmem *)p->area;
+  mpp = &p->free;
+  for (i = 0; i < p->num; i++) {
+    *mpp = mp;
+    memset(mp, 0, sizeof(*mp));
+    mp->size = p->size;
+    mpp = &(mp->next);
+    mp = (kzmem *)((char *)mp + p->size);
+  }
+
+  return 0;
+}
+
+int kzmem_init()
+{
+  int i;
+  for (i = 0; i < MEMORY_AREA_NUM; i++) {
+    kzmem_init_pool(&pool[i]);
+  }
+  return 0;
+}
+
+void *kzmem_alloc(int size)
+{
+  int i;
+  kzmem *mp;
+  kzmem_pool *p;
+
+  for (i = 0; i < MEMORY_AREA_NUM; i++) {
+    p = &pool[i];
+    if (size <= p->size - sizeof(kzmem)) {
+      if (p->free == NULL) {
+	kz_sysdown();
+      }
+      mp = p->free;
+      p->free = p->free->next;
+      mp->next = NULL;
+      return (char *)mp + sizeof(kzmem);
+    }
+  }
+
+  kz_sysdown();
+  return NULL;
+}
+
+void kzmem_free(void *mem)
+{
+  int i;
+  kzmem *mp;
+  kzmem_pool *p;
+
+  mp = (kzmem *)((char *)mem - sizeof(kzmem));
+
+  for (i = 0; i < MEMORY_AREA_NUM; i++) {
+    p = &pool[i];
+    if (mp->size == p->size) {
+      mp->next = p->free;
+      p->free = mp;
+      return;
+    }
+  }
+
+  kz_sysdown();
+}
diff -ruN kozos27/memory.h kozos28/memory.h
--- kozos27/memory.h	Thu Jan  1 09:00:00 1970
+++ kozos28/memory.h	Wed Dec 12 15:17:33 2007
@@ -0,0 +1,8 @@
+#ifndef _KOZOS_MEMORY_H_INCLUDED_
+#define _KOZOS_MEMORY_H_INCLUDED_
+
+int kzmem_init();
+void *kzmem_alloc(int size);
+void kzmem_free(void *mem);
+
+#endif
diff -ruN kozos27/outlog.c kozos28/outlog.c
--- kozos27/outlog.c	Wed Dec 12 13:19:43 2007
+++ kozos28/outlog.c	Wed Dec 12 14:56:38 2007
@@ -11,6 +11,6 @@
   while (1) {
     kz_recv(NULL, &p);
     fprintf(stderr, "%s", p);
-    kz_memfree(p);
+    kz_kmfree(p);
   }
 }
diff -ruN kozos27/stubd.c kozos28/stubd.c
--- kozos27/stubd.c	Wed Dec 12 13:19:43 2007
+++ kozos28/stubd.c	Wed Dec 12 14:56:52 2007
@@ -81,7 +81,7 @@
 	fprintf(stderr, "\'%c\'", p[i]);
       }
     }
-    kz_memfree(p);
+    kz_kmfree(p);
   }
 
   close(s);
diff -ruN kozos27/syscall.c kozos28/syscall.c
--- kozos27/syscall.c	Wed Dec 12 13:19:43 2007
+++ kozos28/syscall.c	Wed Dec 12 14:58:54 2007
@@ -120,6 +120,22 @@
   return param.un.debug.ret;
 }
 
+void *kz_kmalloc(int size)
+{
+  kz_syscall_param_t param;
+  param.un.kmalloc.size = size;
+  kz_syscall(KZ_SYSCALL_TYPE_KMALLOC, &param);
+  return param.un.kmalloc.ret;
+}
+
+int kz_kmfree(void *p)
+{
+  kz_syscall_param_t param;
+  param.un.kmfree.p = p;
+  kz_syscall(KZ_SYSCALL_TYPE_KMFREE, &param);
+  return param.un.kmfree.ret;
+}
+
 void *kz_memalloc(int size)
 {
   kz_syscall_param_t param;
diff -ruN kozos27/syscall.h kozos28/syscall.h
--- kozos27/syscall.h	Wed Dec 12 13:19:43 2007
+++ kozos28/syscall.h	Wed Dec 12 14:51:32 2007
@@ -17,6 +17,8 @@
   KZ_SYSCALL_TYPE_PENDING,
   KZ_SYSCALL_TYPE_SETSIG,
   KZ_SYSCALL_TYPE_DEBUG,
+  KZ_SYSCALL_TYPE_KMALLOC,
+  KZ_SYSCALL_TYPE_KMFREE,
   KZ_SYSCALL_TYPE_MEMALLOC,
   KZ_SYSCALL_TYPE_MEMFREE,
 } kz_syscall_type_t;
@@ -77,6 +79,14 @@
       int sockt;
       int ret;
     } debug;
+    struct {
+      int size;
+      void *ret;
+    } kmalloc;
+    struct {
+      char *p;
+      int ret;
+    } kmfree;
     struct {
       int size;
       void *ret;
diff -ruN kozos27/telnetd.c kozos28/telnetd.c
--- kozos27/telnetd.c	Wed Dec 12 13:19:43 2007
+++ kozos28/telnetd.c	Wed Dec 12 14:57:04 2007
@@ -43,7 +43,7 @@
 	|| memchr(p, 0xff, size) /* Ctrl-C対応 */
 	) break;
     memcpy(buffer + len, p, size);
-    kz_memfree(p);
+    kz_kmfree(p);
     len += size;
     buffer[len] = '\0';
 
diff -ruN kozos27/thread.c kozos28/thread.c
--- kozos27/thread.c	Wed Dec 12 13:19:43 2007
+++ kozos28/thread.c	Wed Dec 12 15:00:50 2007
@@ -8,6 +8,7 @@
 
 #include "kozos.h"
 #include "syscall.h"
+#include "memory.h"
 #include "thread.h"
 #include "stublib.h"
 
@@ -164,7 +165,7 @@
 
 static void recvmsg()
 {
-  kz_membuf *mp;
+  kz_msgbuf *mp;
 
   mp = current->messages.head;
   current->messages.head = mp->next;
@@ -177,16 +178,16 @@
     *(current->syscall.param->un.recv.idp) = mp->id;
   if (current->syscall.param->un.recv.pp)
     *(current->syscall.param->un.recv.pp)  = mp->p;
-  free(mp);
+  kzmem_free(mp);
 }
 
 static void sendmsg(kz_thread *thp, int id, int size, char *p)
 {
-  kz_membuf *mp;
+  kz_msgbuf *mp;
 
   current = thp;
 
-  mp = (kz_membuf *)malloc(sizeof(*mp));
+  mp = (kz_msgbuf *)kzmem_alloc(sizeof(*mp));
   if (mp == NULL) {
     fprintf(stderr, "cannot allocate memory.\n");
     exit(1);
@@ -238,7 +239,7 @@
   int diffmsec;
   struct itimerval itm;
 
-  tmp = malloc(sizeof(*tmp));
+  tmp = kzmem_alloc(sizeof(*tmp));
   tmp->next = NULL;
   tmp->thp = current;
 
@@ -286,7 +287,7 @@
   sendmsg(timers->thp, 0, 0, NULL);
   tmp = timers;
   timers = timers->next;
-  free(tmp);
+  kzmem_free(tmp);
   if (timers) {
     gettimeofday(&alarm_tm, NULL);
     itm.it_interval.tv_sec  = 0;
@@ -324,6 +325,19 @@
   return 0;
 }
 
+static void *thread_kmalloc(int size)
+{
+  putcurrent();
+  return kzmem_alloc(size);
+}
+
+static int thread_kmfree(char *p)
+{
+  kzmem_free(p);
+  putcurrent();
+  return 0;
+}
+
 static void *thread_memalloc(int size)
 {
   putcurrent();
@@ -386,6 +400,12 @@
   case KZ_SYSCALL_TYPE_DEBUG:
     p->un.debug.ret = thread_debug(p->un.debug.sockt);
     break;
+  case KZ_SYSCALL_TYPE_KMALLOC:
+    p->un.kmalloc.ret = thread_kmalloc(p->un.kmalloc.size);
+    break;
+  case KZ_SYSCALL_TYPE_KMFREE:
+    p->un.kmfree.ret = thread_kmfree(p->un.kmfree.p);
+    break;
   case KZ_SYSCALL_TYPE_MEMALLOC:
     p->un.memalloc.ret = thread_memalloc(p->un.memalloc.size);
     break;
@@ -512,6 +532,8 @@
 
 void kz_start(kz_func func, char *name, int pri, int argc, char *argv[])
 {
+  kzmem_init();
+
   sigemptyset(&block);
   sigaddset(&block, SIGSYS);
   sigaddset(&block, SIGHUP);
@@ -525,6 +547,11 @@
 
   /* ここには返ってこない */
   abort();
+}
+
+void kz_sysdown()
+{
+  kill(getpid(), SIGILL);
 }
 
 void kz_trap()
diff -ruN kozos27/thread.h kozos28/thread.h
--- kozos27/thread.h	Wed Dec 12 13:19:43 2007
+++ kozos28/thread.h	Wed Dec 12 15:00:49 2007
@@ -12,12 +12,12 @@
 #define PRI_NUM 32
 #define THREAD_NAME_SIZE 16
 
-typedef struct _kz_membuf {
-  struct _kz_membuf *next;
+typedef struct _kz_msgbuf {
+  struct _kz_msgbuf *next;
   int id;
   int size;
   char *p;
-} kz_membuf;
+} kz_msgbuf;
 
 typedef struct _kz_thread {
   struct _kz_thread *next;
@@ -35,8 +35,8 @@
   } syscall;
 
   struct {
-    kz_membuf *head;
-    kz_membuf *tail;
+    kz_msgbuf *head;
+    kz_msgbuf *tail;
   } messages;
 
   struct {