Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/kern/uipc_socket.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/kern/uipc_socket.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.102
retrieving revision 1.135
diff -u -p -r1.102 -r1.135
--- src/sys/kern/uipc_socket.c	2004/05/22 22:52:13	1.102
+++ src/sys/kern/uipc_socket.c	2007/03/12 18:18:34	1.135
@@ -1,4 +1,4 @@
-/*	$NetBSD: uipc_socket.c,v 1.102 2004/05/22 22:52:13 jonathan Exp $	*/
+/*	$NetBSD: uipc_socket.c,v 1.135 2007/03/12 18:18:34 ad Exp $	*/
 
 /*-
  * Copyright (c) 2002 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.102 2004/05/22 22:52:13 jonathan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.135 2007/03/12 18:18:34 ad Exp $");
 
 #include "opt_sock_counters.h"
 #include "opt_sosend_loan.h"
@@ -91,10 +91,12 @@ __KERNEL_RCSID(0, "$NetBSD: uipc_socket.
 #include <sys/pool.h>
 #include <sys/event.h>
 #include <sys/poll.h>
+#include <sys/kauth.h>
 
 #include <uvm/uvm.h>
 
-POOL_INIT(socket_pool, sizeof(struct socket), 0, 0, 0, "sockpl", NULL);
+POOL_INIT(socket_pool, sizeof(struct socket), 0, 0, 0, "sockpl", NULL,
+    IPL_SOFTNET);
 
 MALLOC_DEFINE(M_SOOPTS, "soopts", "socket options");
 MALLOC_DEFINE(M_SONAME, "soname", "socket name");
@@ -105,13 +107,13 @@ int		somaxconn = SOMAXCONN;
 #ifdef SOSEND_COUNTERS
 #include <sys/device.h>
 
-struct evcnt sosend_loan_big = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
+static struct evcnt sosend_loan_big = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
     NULL, "sosend", "loan big");
-struct evcnt sosend_copy_big = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
+static struct evcnt sosend_copy_big = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
     NULL, "sosend", "copy big");
-struct evcnt sosend_copy_small = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
+static struct evcnt sosend_copy_small = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
     NULL, "sosend", "copy small");
-struct evcnt sosend_kvalimit = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
+static struct evcnt sosend_kvalimit = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
     NULL, "sosend", "kva limit");
 
 #define	SOSEND_COUNTER_INCR(ev)		(ev)->ev_count++
@@ -126,41 +128,30 @@ EVCNT_ATTACH_STATIC(sosend_kvalimit);
 
 #endif /* SOSEND_COUNTERS */
 
-void
-soinit(void)
-{
-
-	/* Set the initial adjusted socket buffer size. */
-	if (sb_max_set(sb_max))
-		panic("bad initial sb_max value: %lu\n", sb_max);
-
-}
+static struct callback_entry sokva_reclaimerentry;
 
 #ifdef SOSEND_NO_LOAN
-int use_sosend_loan = 0;
+int sock_loan_thresh = -1;
 #else
-int use_sosend_loan = 1;
+int sock_loan_thresh = 4096;
 #endif
 
-struct simplelock so_pendfree_slock = SIMPLELOCK_INITIALIZER;
-struct mbuf *so_pendfree;
+static struct simplelock so_pendfree_slock = SIMPLELOCK_INITIALIZER;
+static struct mbuf *so_pendfree;
 
 #ifndef SOMAXKVA
 #define	SOMAXKVA (16 * 1024 * 1024)
 #endif
 int somaxkva = SOMAXKVA;
-int socurkva;
-int sokvawaiters;
+static int socurkva;
+static int sokvawaiters;
 
-#define	SOCK_LOAN_THRESH	4096
 #define	SOCK_LOAN_CHUNK		65536
 
-static size_t sodopendfree(struct socket *);
-static size_t sodopendfreel(struct socket *);
-static __inline vsize_t sokvareserve(struct socket *, vsize_t);
-static __inline void sokvaunreserve(vsize_t);
+static size_t sodopendfree(void);
+static size_t sodopendfreel(void);
 
-static __inline vsize_t
+static vsize_t
 sokvareserve(struct socket *so, vsize_t len)
 {
 	int s;
@@ -175,7 +166,7 @@ sokvareserve(struct socket *so, vsize_t 
 		 * try to do pendfree.
 		 */
 
-		freed = sodopendfreel(so);
+		freed = sodopendfreel();
 
 		/*
 		 * if some kva was freed, try again.
@@ -200,7 +191,7 @@ sokvareserve(struct socket *so, vsize_t 
 	return len;
 }
 
-static __inline void
+static void
 sokvaunreserve(vsize_t len)
 {
 	int s;
@@ -234,7 +225,7 @@ sokvaalloc(vsize_t len, struct socket *s
 	 * allocate kva.
 	 */
 
-	lva = uvm_km_valloc_wait(kernel_map, len);
+	lva = uvm_km_alloc(kernel_map, len, 0, UVM_KMF_VAONLY | UVM_KMF_WAITVA);
 	if (lva == 0) {
 		sokvaunreserve(len);
 		return (0);
@@ -255,7 +246,7 @@ sokvafree(vaddr_t sva, vsize_t len)
 	 * free kva.
 	 */
 
-	uvm_km_free(kernel_map, sva, len);
+	uvm_km_free(kernel_map, sva, len, UVM_KMF_VAONLY);
 
 	/*
 	 * unreserve kva.
@@ -265,7 +256,7 @@ sokvafree(vaddr_t sva, vsize_t len)
 }
 
 static void
-sodoloanfree(struct vm_page **pgs, caddr_t buf, size_t size)
+sodoloanfree(struct vm_page **pgs, void *buf, size_t size)
 {
 	vaddr_t va, sva, eva;
 	vsize_t len;
@@ -281,7 +272,7 @@ sodoloanfree(struct vm_page **pgs, caddr
 		pgs = alloca(npgs * sizeof(*pgs));
 
 		for (i = 0, va = sva; va < eva; i++, va += PAGE_SIZE) {
-			if (pmap_extract(pmap_kernel(), va, &pa) == FALSE)
+			if (pmap_extract(pmap_kernel(), va, &pa) == false)
 				panic("sodoloanfree: va 0x%lx not mapped", va);
 			pgs[i] = PHYS_TO_VM_PAGE(pa);
 		}
@@ -294,14 +285,14 @@ sodoloanfree(struct vm_page **pgs, caddr
 }
 
 static size_t
-sodopendfree(struct socket *so)
+sodopendfree()
 {
 	int s;
 	size_t rv;
 
 	s = splvm();
 	simple_lock(&so_pendfree_slock);
-	rv = sodopendfreel(so);
+	rv = sodopendfreel();
 	simple_unlock(&so_pendfree_slock);
 	splx(s);
 
@@ -317,7 +308,7 @@ sodopendfree(struct socket *so)
  */
 
 static size_t
-sodopendfreel(struct socket *so)
+sodopendfreel()
 {
 	size_t rv = 0;
 
@@ -352,7 +343,7 @@ sodopendfreel(struct socket *so)
 }
 
 void
-soloanfree(struct mbuf *m, caddr_t buf, size_t size, void *arg)
+soloanfree(struct mbuf *m, void *buf, size_t size, void *arg)
 {
 	int s;
 
@@ -392,7 +383,7 @@ sosend_loan(struct socket *so, struct ui
 	vaddr_t lva, va;
 	int npgs, i, error;
 
-	if (uio->uio_segflg != UIO_USERSPACE)
+	if (VMSPACE_IS_KERNEL_P(uio->uio_vmspace))
 		return (0);
 
 	if (iov->iov_len < (size_t) space)
@@ -407,13 +398,12 @@ sosend_loan(struct socket *so, struct ui
 
 	/* XXX KDASSERT */
 	KASSERT(npgs <= M_EXT_MAXPAGES);
-	KASSERT(uio->uio_procp != NULL);
 
 	lva = sokvaalloc(len, so);
 	if (lva == 0)
 		return 0;
 
-	error = uvm_loan(&uio->uio_procp->p_vmspace->vm_map, sva, len,
+	error = uvm_loan(&uio->uio_vmspace->vm_map, sva, len,
 	    m->m_ext.ext_pgs, UVM_LOAN_TOPAGE);
 	if (error) {
 		sokvafree(lva, len);
@@ -427,12 +417,12 @@ sosend_loan(struct socket *so, struct ui
 
 	lva += (vaddr_t) iov->iov_base & PAGE_MASK;
 
-	MEXTADD(m, (caddr_t) lva, space, M_MBUF, soloanfree, so);
+	MEXTADD(m, (void *) lva, space, M_MBUF, soloanfree, so);
 	m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
 
 	uio->uio_resid -= space;
 	/* uio_offset not updated, not set/used for write(2) */
-	uio->uio_iov->iov_base = (caddr_t) uio->uio_iov->iov_base + space;
+	uio->uio_iov->iov_base = (char *)uio->uio_iov->iov_base + space;
 	uio->uio_iov->iov_len -= space;
 	if (uio->uio_iov->iov_len == 0) {
 		uio->uio_iov++;
@@ -442,6 +432,32 @@ sosend_loan(struct socket *so, struct ui
 	return (space);
 }
 
+static int
+sokva_reclaim_callback(struct callback_entry *ce, void *obj, void *arg)
+{
+
+	KASSERT(ce == &sokva_reclaimerentry);
+	KASSERT(obj == NULL);
+
+	sodopendfree();
+	if (!vm_map_starved_p(kernel_map)) {
+		return CALLBACK_CHAIN_ABORT;
+	}
+	return CALLBACK_CHAIN_CONTINUE;
+}
+
+void
+soinit(void)
+{
+
+	/* Set the initial adjusted socket buffer size. */
+	if (sb_max_set(sb_max))
+		panic("bad initial sb_max value: %lu", sb_max);
+
+	callback_register(&vm_map_to_kernel(kernel_map)->vmk_reclaim_callback,
+	    &sokva_reclaimerentry, NULL, sokva_reclaim_callback);
+}
+
 /*
  * Socket operation routines.
  * These routines are called by the routines in
@@ -451,23 +467,39 @@ sosend_loan(struct socket *so, struct ui
  */
 /*ARGSUSED*/
 int
-socreate(int dom, struct socket **aso, int type, int proto, struct proc *p)
+socreate(int dom, struct socket **aso, int type, int proto, struct lwp *l)
 {
 	const struct protosw	*prp;
 	struct socket	*so;
+	uid_t		uid;
 	int		error, s;
 
+	error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_SOCKET,
+	    KAUTH_REQ_NETWORK_SOCKET_OPEN, KAUTH_ARG(dom), KAUTH_ARG(type),
+	    KAUTH_ARG(proto));
+	if (error)
+		return (error);
+
 	if (proto)
 		prp = pffindproto(dom, proto, type);
 	else
 		prp = pffindtype(dom, type);
-	if (prp == 0 || prp->pr_usrreq == 0)
+	if (prp == 0) {
+		/* no support for domain */
+		if (pffinddomain(dom) == 0)
+			return (EAFNOSUPPORT);
+		/* no support for socket type */
+		if (proto == 0 && type != 0)
+			return (EPROTOTYPE);
+		return (EPROTONOSUPPORT);
+	}
+	if (prp->pr_usrreq == 0)
 		return (EPROTONOSUPPORT);
 	if (prp->pr_type != type)
 		return (EPROTOTYPE);
 	s = splsoftnet();
 	so = pool_get(&socket_pool, PR_WAITOK);
-	memset((caddr_t)so, 0, sizeof(*so));
+	memset((void *)so, 0, sizeof(*so));
 	TAILQ_INIT(&so->so_q0);
 	TAILQ_INIT(&so->so_q);
 	so->so_type = type;
@@ -479,12 +511,14 @@ socreate(int dom, struct socket **aso, i
 	so->so_snd.sb_mowner = &prp->pr_domain->dom_mowner;
 	so->so_mowner = &prp->pr_domain->dom_mowner;
 #endif
-	if (p != 0)
-		so->so_uid = p->p_ucred->cr_uid;
-	else
-		so->so_uid = UID_MAX;
+	if (l != NULL) {
+		uid = kauth_cred_geteuid(l->l_cred);
+	} else {
+		uid = 0;
+	}
+	so->so_uidinfo = uid_find(uid);
 	error = (*prp->pr_usrreq)(so, PRU_ATTACH, (struct mbuf *)0,
-	    (struct mbuf *)(long)proto, (struct mbuf *)0, p);
+	    (struct mbuf *)(long)proto, (struct mbuf *)0, l);
 	if (error) {
 		so->so_state |= SS_NOFDREF;
 		sofree(so);
@@ -497,13 +531,13 @@ socreate(int dom, struct socket **aso, i
 }
 
 int
-sobind(struct socket *so, struct mbuf *nam, struct proc *p)
+sobind(struct socket *so, struct mbuf *nam, struct lwp *l)
 {
 	int	s, error;
 
 	s = splsoftnet();
 	error = (*so->so_proto->pr_usrreq)(so, PRU_BIND, (struct mbuf *)0,
-	    nam, (struct mbuf *)0, p);
+	    nam, (struct mbuf *)0, l);
 	splx(s);
 	return (error);
 }
@@ -515,7 +549,7 @@ solisten(struct socket *so, int backlog)
 
 	s = splsoftnet();
 	error = (*so->so_proto->pr_usrreq)(so, PRU_LISTEN, (struct mbuf *)0,
-	    (struct mbuf *)0, (struct mbuf *)0, (struct proc *)0);
+	    (struct mbuf *)0, (struct mbuf *)0, (struct lwp *)0);
 	if (error) {
 		splx(s);
 		return (error);
@@ -545,10 +579,10 @@ sofree(struct socket *so)
 			return;
 	}
 	if (so->so_rcv.sb_hiwat)
-		(void)chgsbsize(so->so_uid, &so->so_rcv.sb_hiwat, 0,
+		(void)chgsbsize(so->so_uidinfo, &so->so_rcv.sb_hiwat, 0,
 		    RLIM_INFINITY);
 	if (so->so_snd.sb_hiwat)
-		(void)chgsbsize(so->so_uid, &so->so_snd.sb_hiwat, 0,
+		(void)chgsbsize(so->so_uidinfo, &so->so_snd.sb_hiwat, 0,
 		    RLIM_INFINITY);
 	sbrelease(&so->so_snd, so);
 	sorflush(so);
@@ -591,7 +625,7 @@ soclose(struct socket *so)
 			    (so->so_state & SS_NBIO))
 				goto drop;
 			while (so->so_state & SS_ISCONNECTED) {
-				error = tsleep((caddr_t)&so->so_timeo,
+				error = tsleep((void *)&so->so_timeo,
 					       PSOCK | PCATCH, netcls,
 					       so->so_linger * hz);
 				if (error)
@@ -603,7 +637,7 @@ soclose(struct socket *so)
 	if (so->so_pcb) {
 		int error2 = (*so->so_proto->pr_usrreq)(so, PRU_DETACH,
 		    (struct mbuf *)0, (struct mbuf *)0, (struct mbuf *)0,
-		    (struct proc *)0);
+		    (struct lwp *)0);
 		if (error == 0)
 			error = error2;
 	}
@@ -624,7 +658,7 @@ soabort(struct socket *so)
 {
 
 	return (*so->so_proto->pr_usrreq)(so, PRU_ABORT, (struct mbuf *)0,
-	    (struct mbuf *)0, (struct mbuf *)0, (struct proc *)0);
+	    (struct mbuf *)0, (struct mbuf *)0, (struct lwp *)0);
 }
 
 int
@@ -640,7 +674,7 @@ soaccept(struct socket *so, struct mbuf 
 	if ((so->so_state & SS_ISDISCONNECTED) == 0 ||
 	    (so->so_proto->pr_flags & PR_ABRTACPTDIS) == 0)
 		error = (*so->so_proto->pr_usrreq)(so, PRU_ACCEPT,
-		    (struct mbuf *)0, nam, (struct mbuf *)0, (struct proc *)0);
+		    (struct mbuf *)0, nam, (struct mbuf *)0, (struct lwp *)0);
 	else
 		error = ECONNABORTED;
 
@@ -649,7 +683,7 @@ soaccept(struct socket *so, struct mbuf 
 }
 
 int
-soconnect(struct socket *so, struct mbuf *nam, struct proc *p)
+soconnect(struct socket *so, struct mbuf *nam, struct lwp *l)
 {
 	int		s, error;
 
@@ -668,7 +702,7 @@ soconnect(struct socket *so, struct mbuf
 		error = EISCONN;
 	else
 		error = (*so->so_proto->pr_usrreq)(so, PRU_CONNECT,
-		    (struct mbuf *)0, nam, (struct mbuf *)0, p);
+		    (struct mbuf *)0, nam, (struct mbuf *)0, l);
 	splx(s);
 	return (error);
 }
@@ -681,7 +715,7 @@ soconnect2(struct socket *so1, struct so
 	s = splsoftnet();
 	error = (*so1->so_proto->pr_usrreq)(so1, PRU_CONNECT2,
 	    (struct mbuf *)0, (struct mbuf *)so2, (struct mbuf *)0,
-	    (struct proc *)0);
+	    (struct lwp *)0);
 	splx(s);
 	return (error);
 }
@@ -702,10 +736,10 @@ sodisconnect(struct socket *so)
 	}
 	error = (*so->so_proto->pr_usrreq)(so, PRU_DISCONNECT,
 	    (struct mbuf *)0, (struct mbuf *)0, (struct mbuf *)0,
-	    (struct proc *)0);
+	    (struct lwp *)0);
  bad:
 	splx(s);
-	sodopendfree(so);
+	sodopendfree();
 	return (error);
 }
 
@@ -729,13 +763,15 @@ sodisconnect(struct socket *so)
  */
 int
 sosend(struct socket *so, struct mbuf *addr, struct uio *uio, struct mbuf *top,
-	struct mbuf *control, int flags, struct proc *p)
+	struct mbuf *control, int flags, struct lwp *l)
 {
 	struct mbuf	**mp, *m;
+	struct proc	*p;
 	long		space, len, resid, clen, mlen;
 	int		error, s, dontroute, atomic;
 
-	sodopendfree(so);
+	p = l->l_proc;
+	sodopendfree();
 
 	clen = 0;
 	atomic = sosendallatonce(so) || top;
@@ -823,9 +859,9 @@ sosend(struct socket *so, struct mbuf *a
 					mlen = MLEN;
 				}
 				MCLAIM(m, so->so_snd.sb_mowner);
-				if (use_sosend_loan &&
-				    uio->uio_iov->iov_len >= SOCK_LOAN_THRESH &&
-				    space >= SOCK_LOAN_THRESH &&
+				if (sock_loan_thresh >= 0 &&
+				    uio->uio_iov->iov_len >= sock_loan_thresh &&
+				    space >= sock_loan_thresh &&
 				    (len = sosend_loan(so, uio, m,
 						       space)) != 0) {
 					SOSEND_COUNTER_INCR(&sosend_loan_big);
@@ -857,7 +893,7 @@ sosend(struct socket *so, struct mbuf *a
 					if (atomic && top == 0 && len < mlen)
 						MH_ALIGN(m, len);
 				}
-				error = uiomove(mtod(m, caddr_t), (int)len,
+				error = uiomove(mtod(m, void *), (int)len,
 				    uio);
  have_data:
 				resid = uio->uio_resid;
@@ -873,7 +909,7 @@ sosend(struct socket *so, struct mbuf *a
 					break;
 				}
 			} while (space > 0 && atomic);
-			
+
 			s = splsoftnet();
 
 			if (so->so_state & SS_CANTSENDMORE)
@@ -885,7 +921,7 @@ sosend(struct socket *so, struct mbuf *a
 				so->so_state |= SS_MORETOCOME;
 			error = (*so->so_proto->pr_usrreq)(so,
 			    (flags & MSG_OOB) ? PRU_SENDOOB : PRU_SEND,
-			    top, addr, control, p);
+			    top, addr, control, curlwp);	/* XXX */
 			if (dontroute)
 				so->so_options &= ~SO_DONTROUTE;
 			if (resid > 0)
@@ -931,7 +967,7 @@ int
 soreceive(struct socket *so, struct mbuf **paddr, struct uio *uio,
 	struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
 {
-	struct proc * p;
+	struct lwp *l = curlwp;
 	struct mbuf	*m, **mp;
 	int		flags, len, error, s, offset, moff, type, orig_resid;
 	const struct protosw	*pr;
@@ -942,7 +978,6 @@ soreceive(struct socket *so, struct mbuf
 	mp = mp0;
 	type = 0;
 	orig_resid = uio->uio_resid;
-	p = uio->uio_procp;
 
 	if (paddr)
 		*paddr = 0;
@@ -954,17 +989,17 @@ soreceive(struct socket *so, struct mbuf
 		flags = 0;
 
 	if ((flags & MSG_DONTWAIT) == 0)
-		sodopendfree(so);
+		sodopendfree();
 
 	if (flags & MSG_OOB) {
 		m = m_get(M_WAIT, MT_DATA);
 		error = (*pr->pr_usrreq)(so, PRU_RCVOOB, m,
 		    (struct mbuf *)(long)(flags & MSG_PEEK),
-		    (struct mbuf *)0, p);
+		    (struct mbuf *)0, l);
 		if (error)
 			goto bad;
 		do {
-			error = uiomove(mtod(m, caddr_t),
+			error = uiomove(mtod(m, void *),
 			    (int) min(uio->uio_resid, m->m_len), uio);
 			m = m_free(m);
 		} while (uio->uio_resid && error == 0 && m);
@@ -977,7 +1012,7 @@ soreceive(struct socket *so, struct mbuf
 		*mp = (struct mbuf *)0;
 	if (so->so_state & SS_ISCONFIRMING && uio->uio_resid)
 		(*pr->pr_usrreq)(so, PRU_RCVD, (struct mbuf *)0,
-		    (struct mbuf *)0, (struct mbuf *)0, p);
+		    (struct mbuf *)0, (struct mbuf *)0, l);
 
  restart:
 	if ((error = sblock(&so->so_rcv, SBLOCKWAIT(flags))) != 0)
@@ -1050,10 +1085,8 @@ soreceive(struct socket *so, struct mbuf
 	 * While we process the initial mbufs containing address and control
 	 * info, we save a copy of m->m_nextpkt into nextrecord.
 	 */
-#ifdef notyet /* XXXX */
-	if (p)
-		p->p_stats->p_ru.ru_msgrcv++;
-#endif
+	if (l)
+		l->l_proc->p_stats->p_ru.ru_msgrcv++;
 	KASSERT(m == so->so_rcv.sb_mb);
 	SBLASTRECORDCHK(&so->so_rcv, "soreceive 1");
 	SBLASTMBUFCHK(&so->so_rcv, "soreceive 1");
@@ -1092,15 +1125,22 @@ soreceive(struct socket *so, struct mbuf
 			mbuf_removed = 1;
 			if (controlp) {
 				struct domain *dom = pr->pr_domain;
-				if (dom->dom_externalize && p &&
+				if (dom->dom_externalize && l &&
 				    mtod(m, struct cmsghdr *)->cmsg_type ==
 				    SCM_RIGHTS)
-					error = (*dom->dom_externalize)(m, p);
+					error = (*dom->dom_externalize)(m, l);
 				*controlp = m;
 				so->so_rcv.sb_mb = m->m_next;
 				m->m_next = 0;
 				m = so->so_rcv.sb_mb;
 			} else {
+				/*
+				 * Dispose of any SCM_RIGHTS message that went
+				 * through the read path rather than recv.
+				 */
+				if (pr->pr_domain->dom_dispose &&
+				    mtod(m, struct cmsghdr *)->cmsg_type == SCM_RIGHTS)
+					(*pr->pr_domain->dom_dispose)(m);
 				MFREE(m, so->so_rcv.sb_mb);
 				m = so->so_rcv.sb_mb;
 			}
@@ -1173,7 +1213,7 @@ soreceive(struct socket *so, struct mbuf
 			SBLASTRECORDCHK(&so->so_rcv, "soreceive uiomove");
 			SBLASTMBUFCHK(&so->so_rcv, "soreceive uiomove");
 			splx(s);
-			error = uiomove(mtod(m, caddr_t) + moff, (int)len, uio);
+			error = uiomove(mtod(m, char *) + moff, (int)len, uio);
 			s = splsoftnet();
 			if (error) {
 				/*
@@ -1281,7 +1321,7 @@ soreceive(struct socket *so, struct mbuf
 				(*pr->pr_usrreq)(so, PRU_RCVD,
 				    (struct mbuf *)0,
 				    (struct mbuf *)(long)flags,
-				    (struct mbuf *)0, p);
+				    (struct mbuf *)0, l);
 			SBLASTRECORDCHK(&so->so_rcv, "soreceive sbwait 2");
 			SBLASTMBUFCHK(&so->so_rcv, "soreceive sbwait 2");
 			error = sbwait(&so->so_rcv);
@@ -1318,7 +1358,7 @@ soreceive(struct socket *so, struct mbuf
 		SBLASTMBUFCHK(&so->so_rcv, "soreceive 4");
 		if (pr->pr_flags & PR_WANTRCVD && so->so_pcb)
 			(*pr->pr_usrreq)(so, PRU_RCVD, (struct mbuf *)0,
-			    (struct mbuf *)(long)flags, (struct mbuf *)0, p);
+			    (struct mbuf *)(long)flags, (struct mbuf *)0, l);
 	}
 	if (orig_resid == uio->uio_resid && orig_resid &&
 	    (flags & MSG_EOR) == 0 && (so->so_state & SS_CANTRCVMORE) == 0) {
@@ -1326,7 +1366,7 @@ soreceive(struct socket *so, struct mbuf
 		splx(s);
 		goto restart;
 	}
-		
+
 	if (flagsp)
 		*flagsp |= flags;
  release:
@@ -1348,7 +1388,7 @@ soshutdown(struct socket *so, int how)
 		sorflush(so);
 	if (how == SHUT_WR || how == SHUT_RDWR)
 		return (*pr->pr_usrreq)(so, PRU_SHUTDOWN, (struct mbuf *)0,
-		    (struct mbuf *)0, (struct mbuf *)0, (struct proc *)0);
+		    (struct mbuf *)0, (struct mbuf *)0, (struct lwp *)0);
 	return (0);
 }
 
@@ -1384,6 +1424,7 @@ sosetopt(struct socket *so, int level, i
 {
 	int		error;
 	struct mbuf	*m;
+	struct linger	*l;
 
 	error = 0;
 	m = m0;
@@ -1400,8 +1441,18 @@ sosetopt(struct socket *so, int level, i
 				error = EINVAL;
 				goto bad;
 			}
-			so->so_linger = mtod(m, struct linger *)->l_linger;
-			/* fall thru... */
+			l = mtod(m, struct linger *);
+			if (l->l_linger < 0 || l->l_linger > USHRT_MAX ||
+			    l->l_linger > (INT_MAX / hz)) {
+				error = EDOM;
+				goto bad;
+			}
+			so->so_linger = l->l_linger;
+			if (l->l_onoff)
+				so->so_options |= SO_LINGER;
+			else
+				so->so_options &= ~SO_LINGER;
+			break;
 
 		case SO_DEBUG:
 		case SO_KEEPALIVE:
@@ -1478,14 +1529,14 @@ sosetopt(struct socket *so, int level, i
 		case SO_RCVTIMEO:
 		    {
 			struct timeval *tv;
-			short val;
+			int val;
 
 			if (m == NULL || m->m_len < sizeof(*tv)) {
 				error = EINVAL;
 				goto bad;
 			}
 			tv = mtod(m, struct timeval *);
-			if (tv->tv_sec > (SHRT_MAX - tv->tv_usec / tick) / hz) {
+			if (tv->tv_sec > (INT_MAX - tv->tv_usec / tick) / hz) {
 				error = EDOM;
 				goto bad;
 			}
@@ -1541,7 +1592,7 @@ sogetopt(struct socket *so, int level, i
 		case SO_LINGER:
 			m->m_len = sizeof(struct linger);
 			mtod(m, struct linger *)->l_onoff =
-				so->so_options & SO_LINGER;
+			    (so->so_options & SO_LINGER) ? 1 : 0;
 			mtod(m, struct linger *)->l_linger = so->so_linger;
 			break;
 
@@ -1554,7 +1605,7 @@ sogetopt(struct socket *so, int level, i
 		case SO_BROADCAST:
 		case SO_OOBINLINE:
 		case SO_TIMESTAMP:
-			*mtod(m, int *) = so->so_options & optname;
+			*mtod(m, int *) = (so->so_options & optname) ? 1 : 0;
 			break;
 
 		case SO_TYPE:
@@ -1595,6 +1646,10 @@ sogetopt(struct socket *so, int level, i
 			break;
 		    }
 
+		case SO_OVERFLOWED:
+			*mtod(m, int *) = so->so_rcv.sb_overflowed;
+			break;
+
 		default:
 			(void)m_free(m);
 			return (ENOPROTOOPT);
@@ -1631,7 +1686,7 @@ filt_soread(struct knote *kn, long hint)
 	so = (struct socket *)kn->kn_fp->f_data;
 	kn->kn_data = so->so_rcv.sb_cc;
 	if (so->so_state & SS_CANTRCVMORE) {
-		kn->kn_flags |= EV_EOF; 
+		kn->kn_flags |= EV_EOF;
 		kn->kn_fflags = so->so_error;
 		return (1);
 	}
@@ -1662,7 +1717,7 @@ filt_sowrite(struct knote *kn, long hint
 	so = (struct socket *)kn->kn_fp->f_data;
 	kn->kn_data = sbspace(&so->so_snd);
 	if (so->so_state & SS_CANTSENDMORE) {
-		kn->kn_flags |= EV_EOF; 
+		kn->kn_flags |= EV_EOF;
 		kn->kn_fflags = so->so_error;
 		return (1);
 	}
@@ -1687,7 +1742,7 @@ filt_solisten(struct knote *kn, long hin
 	/*
 	 * Set kn_data to number of incoming connections, not
 	 * counting partial (incomplete) connections.
-	 */ 
+	 */
 	kn->kn_data = so->so_qlen;
 	return (kn->kn_data > 0);
 }
@@ -1773,7 +1828,9 @@ SYSCTL_SETUP(sysctl_kern_somaxkva_setup,
 
 	sysctl_createv(clog, 0, NULL, NULL,
 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
-		       CTLTYPE_INT, "somaxkva", NULL,
+		       CTLTYPE_INT, "somaxkva",
+		       SYSCTL_DESCR("Maximum amount of kernel memory to be "
+				    "used for socket buffers"),
 		       sysctl_kern_somaxkva, 0, NULL, 0,
 		       CTL_KERN, KERN_SOMAXKVA, CTL_EOL);
 }