D23110.id66577.diff
No OneTemporary
Actions

Size

176 KB

Referenced Files

None

Subscribers

None

D23110.id66577.diff
View Options

	Index: sys/amd64/amd64/efirt_machdep.c
	===================================================================
	--- sys/amd64/amd64/efirt_machdep.c
	+++ sys/amd64/amd64/efirt_machdep.c
	@@ -325,5 +325,7 @@
	return (error);
	}

	-SYSCTL_PROC(_debug, OID_AUTO, efi_time, CTLTYPE_INT \| CTLFLAG_RW, NULL, 0,
	- efi_time_sysctl_handler, "I", "");
	+SYSCTL_PROC(_debug, OID_AUTO, efi_time,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, efi_time_sysctl_handler, "I",
	+ "");
	Index: sys/amd64/amd64/machdep.c
	===================================================================
	--- sys/amd64/amd64/machdep.c
	+++ sys/amd64/amd64/machdep.c
	@@ -1960,8 +1960,10 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_machdep, OID_AUTO, smap, CTLTYPE_OPAQUE\|CTLFLAG_RD, NULL, 0,
	- smap_sysctl_handler, "S,bios_smap_xattr", "Raw BIOS SMAP data");
	+SYSCTL_PROC(_machdep, OID_AUTO, smap,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, smap_sysctl_handler, "S,bios_smap_xattr",
	+ "Raw BIOS SMAP data");

	static int
	efi_map_sysctl_handler(SYSCTL_HANDLER_ARGS)
	@@ -1980,8 +1982,10 @@
	efisize = ((uint32_t )efihdr - 1);
	return (SYSCTL_OUT(req, efihdr, efisize));
	}
	-SYSCTL_PROC(_machdep, OID_AUTO, efi_map, CTLTYPE_OPAQUE\|CTLFLAG_RD, NULL, 0,
	- efi_map_sysctl_handler, "S,efi_map_header", "Raw EFI Memory Map");
	+SYSCTL_PROC(_machdep, OID_AUTO, efi_map,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, efi_map_sysctl_handler, "S,efi_map_header",
	+ "Raw EFI Memory Map");

	void
	spinlock_enter(void)
	Index: sys/amd64/amd64/prof_machdep.c
	===================================================================
	--- sys/amd64/amd64/prof_machdep.c
	+++ sys/amd64/amd64/prof_machdep.c
	@@ -262,8 +262,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, cputime_clock, CTLTYPE_INT \| CTLFLAG_RW,
	- 0, sizeof(u_int), sysctl_machdep_cputime_clock, "I", "");
	+SYSCTL_PROC(_machdep, OID_AUTO, cputime_clock,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(u_int), sysctl_machdep_cputime_clock, "I",
	+ "");

	/*
	* The start and stop routines need not be here since we turn off profiling
	Index: sys/amd64/vmm/vmm_dev.c
	===================================================================
	--- sys/amd64/vmm/vmm_dev.c
	+++ sys/amd64/vmm/vmm_dev.c
	@@ -962,8 +962,9 @@
	return (error);
	}
	SYSCTL_PROC(_hw_vmm, OID_AUTO, destroy,
	- CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_PRISON,
	- NULL, 0, sysctl_vmm_destroy, "A", NULL);
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_PRISON \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_vmm_destroy, "A",
	+ "");

	static struct cdevsw vmmdevsw = {
	.d_name = "vmmdev",
	@@ -1045,8 +1046,9 @@
	return (error);
	}
	SYSCTL_PROC(_hw_vmm, OID_AUTO, create,
	- CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_PRISON,
	- NULL, 0, sysctl_vmm_create, "A", NULL);
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_PRISON \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_vmm_create, "A",
	+ "");

	void
	vmmdev_init(void)
	Index: sys/arm/xilinx/zy7_devcfg.c
	===================================================================
	--- sys/arm/xilinx/zy7_devcfg.c
	+++ sys/arm/xilinx/zy7_devcfg.c
	@@ -105,8 +105,10 @@
	"Xilinx Zynq-7000 PL (FPGA) section");

	static int zy7_devcfg_sysctl_pl_done(SYSCTL_HANDLER_ARGS);
	-SYSCTL_PROC(_hw_fpga, OID_AUTO, pl_done, CTLTYPE_INT \| CTLFLAG_RD, NULL, 0,
	- zy7_devcfg_sysctl_pl_done, "I", "PL section config DONE signal");
	+SYSCTL_PROC(_hw_fpga, OID_AUTO, pl_done,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, zy7_devcfg_sysctl_pl_done, "I",
	+ "PL section config DONE signal");

	static int zy7_en_level_shifters = 1;
	SYSCTL_INT(_hw_fpga, OID_AUTO, en_level_shifters, CTLFLAG_RW,
	@@ -119,9 +121,9 @@

	static int zy7_devcfg_fclk_sysctl_level_shifters(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_hw_fpga, OID_AUTO, level_shifters,
	- CTLFLAG_RW \| CTLTYPE_INT,
	- NULL, 0, zy7_devcfg_fclk_sysctl_level_shifters,
	- "I", "Enable/disable level shifters");
	+ CTLFLAG_RW \| CTLTYPE_INT \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, zy7_devcfg_fclk_sysctl_level_shifters, "I",
	+ "Enable/disable level shifters");

	/* cdev entry points. */
	static int zy7_devcfg_open(struct cdev , int, int, struct thread );
	Index: sys/cam/scsi/scsi_all.c
	===================================================================
	--- sys/cam/scsi/scsi_all.c
	+++ sys/cam/scsi/scsi_all.c
	@@ -9234,7 +9234,8 @@
	return (error);
	return (set_scsi_delay(delay));
	}
	-SYSCTL_PROC(_kern_cam, OID_AUTO, scsi_delay, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_kern_cam, OID_AUTO, scsi_delay,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_scsi_delay, "I",
	"Delay to allow devices to settle after a SCSI bus reset (ms)");

	Index: sys/cam/scsi/scsi_da.c
	===================================================================
	--- sys/cam/scsi/scsi_da.c
	+++ sys/cam/scsi/scsi_da.c
	@@ -1538,7 +1538,8 @@
	"Disable detection of write-protected disks");

	SYSCTL_PROC(_kern_cam_da, OID_AUTO, default_softtimeout,
	- CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0, dasysctlsofttimeout, "I",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, dasysctlsofttimeout, "I",
	"Soft I/O timeout (ms)");
	TUNABLE_INT64("kern.cam.da.default_softtimeout", &da_default_softtimeout);

	Index: sys/cam/scsi/scsi_xpt.c
	===================================================================
	--- sys/cam/scsi/scsi_xpt.c
	+++ sys/cam/scsi/scsi_xpt.c
	@@ -80,8 +80,9 @@

	static int cam_srch_hi = 0;
	static int sysctl_cam_search_luns(SYSCTL_HANDLER_ARGS);
	-SYSCTL_PROC(_kern_cam, OID_AUTO, cam_srch_hi, CTLTYPE_INT \| CTLFLAG_RWTUN, 0, 0,
	- sysctl_cam_search_luns, "I",
	+SYSCTL_PROC(_kern_cam, OID_AUTO, cam_srch_hi,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_cam_search_luns, "I",
	"allow search above LUN 7 for SCSI3 and greater devices");

	#define CAM_SCSI2_MAXLUN 8
	Index: sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
	===================================================================
	--- sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
	+++ sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
	@@ -435,11 +435,16 @@
	TUNABLE_INT("vfs.zfs.arc_grow_retry", &zfs_arc_grow_retry);
	TUNABLE_INT("vfs.zfs.arc_no_grow_shift", &zfs_arc_no_grow_shift);
	SYSCTL_DECL(_vfs_zfs);
	-SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_max, CTLTYPE_U64 \| CTLFLAG_RWTUN,
	- 0, sizeof(uint64_t), sysctl_vfs_zfs_arc_max, "QU", "Maximum ARC size");
	-SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_min, CTLTYPE_U64 \| CTLFLAG_RWTUN,
	- 0, sizeof(uint64_t), sysctl_vfs_zfs_arc_min, "QU", "Minimum ARC size");
	-SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_no_grow_shift, CTLTYPE_U32 \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_max,
	+ CTLTYPE_U64 \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(uint64_t), sysctl_vfs_zfs_arc_max, "QU",
	+ "Maximum ARC size");
	+SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_min,
	+ CTLTYPE_U64 \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(uint64_t), sysctl_vfs_zfs_arc_min, "QU",
	+ "Minimum ARC size");
	+SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_no_grow_shift,
	+ CTLTYPE_U32 \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(uint32_t), sysctl_vfs_zfs_arc_no_grow_shift, "U",
	"log2(fraction of ARC which must be free to allow growing)");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, arc_average_blocksize, CTLFLAG_RDTUN,
	Index: sys/cddl/dev/dtrace/dtrace_sysctl.c
	===================================================================
	--- sys/cddl/dev/dtrace/dtrace_sysctl.c
	+++ sys/cddl/dev/dtrace/dtrace_sysctl.c
	@@ -75,8 +75,10 @@

	SYSCTL_NODE(_debug, OID_AUTO, dtrace, CTLFLAG_RD, 0, "DTrace debug parameters");

	-SYSCTL_PROC(_debug_dtrace, OID_AUTO, providers, CTLTYPE_STRING \| CTLFLAG_RD,
	- 0, 0, sysctl_dtrace_providers, "A", "available DTrace providers");
	+SYSCTL_PROC(_debug_dtrace, OID_AUTO, providers,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_dtrace_providers, "A",
	+ "available DTrace providers");

	SYSCTL_NODE(_kern, OID_AUTO, dtrace, CTLFLAG_RD, 0, "DTrace parameters");

	Index: sys/cddl/dev/dtrace/dtrace_test.c
	===================================================================
	--- sys/cddl/dev/dtrace/dtrace_test.c
	+++ sys/cddl/dev/dtrace/dtrace_test.c
	@@ -77,7 +77,8 @@

	static SYSCTL_NODE(_debug, OID_AUTO, dtracetest, CTLFLAG_RD, 0, "");

	-SYSCTL_PROC(_debug_dtracetest, OID_AUTO, sdttest, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_debug_dtracetest, OID_AUTO, sdttest,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, dtrace_test_sdttest, "I", "Trigger the SDT test probe");

	static int
	Index: sys/compat/ndis/subr_ntoskrnl.c
	===================================================================
	--- sys/compat/ndis/subr_ntoskrnl.c
	+++ sys/compat/ndis/subr_ntoskrnl.c
	@@ -82,7 +82,8 @@
	#ifdef NTOSKRNL_DEBUG_TIMERS
	static int sysctl_show_timers(SYSCTL_HANDLER_ARGS);

	-SYSCTL_PROC(_debug, OID_AUTO, ntoskrnl_timers, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_debug, OID_AUTO, ntoskrnl_timers,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_show_timers, "I",
	"Show ntoskrnl timer stats");
	#endif
	Index: sys/ddb/db_capture.c
	===================================================================
	--- sys/ddb/db_capture.c
	+++ sys/ddb/db_capture.c
	@@ -165,7 +165,8 @@

	return (0);
	}
	-SYSCTL_PROC(_debug_ddb_capture, OID_AUTO, bufsize, CTLTYPE_UINT\|CTLFLAG_RW,
	+SYSCTL_PROC(_debug_ddb_capture, OID_AUTO, bufsize,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_debug_ddb_capture_bufsize, "IU",
	"Size of DDB capture buffer");

	@@ -191,8 +192,10 @@
	ch = '\0';
	return (SYSCTL_OUT(req, &ch, sizeof(ch)));
	}
	-SYSCTL_PROC(_debug_ddb_capture, OID_AUTO, data, CTLTYPE_STRING \| CTLFLAG_RD,
	- NULL, 0, sysctl_debug_ddb_capture_data, "A", "DDB capture data");
	+SYSCTL_PROC(_debug_ddb_capture, OID_AUTO, data,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_debug_ddb_capture_data, "A",
	+ "DDB capture data");

	/*
	* Routines for capturing DDB output into a fixed-size buffer. These are
	Index: sys/ddb/db_script.c
	===================================================================
	--- sys/ddb/db_script.c
	+++ sys/ddb/db_script.c
	@@ -495,8 +495,9 @@
	free(buffer, M_TEMP);
	return (error);
	}
	-SYSCTL_PROC(_debug_ddb_scripting, OID_AUTO, scripts, CTLTYPE_STRING \|
	- CTLFLAG_RD, 0, 0, sysctl_debug_ddb_scripting_scripts, "A",
	+SYSCTL_PROC(_debug_ddb_scripting, OID_AUTO, scripts,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_debug_ddb_scripting_scripts, "A",
	"List of defined scripts");

	static int
	@@ -532,8 +533,9 @@
	free(buffer, M_TEMP);
	return (error);
	}
	-SYSCTL_PROC(_debug_ddb_scripting, OID_AUTO, script, CTLTYPE_STRING \|
	- CTLFLAG_RW, 0, 0, sysctl_debug_ddb_scripting_script, "A",
	+SYSCTL_PROC(_debug_ddb_scripting, OID_AUTO, script,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_debug_ddb_scripting_script, "A",
	"Set a script");

	/*
	Index: sys/dev/acpica/acpi.c
	===================================================================
	--- sys/dev/acpica/acpi.c
	+++ sys/dev/acpica/acpi.c
	@@ -269,7 +269,8 @@
	static int acpi_debug_objects;
	TUNABLE_INT("debug.acpi.enable_debug_objects", &acpi_debug_objects);
	SYSCTL_PROC(_debug_acpi, OID_AUTO, enable_debug_objects,
	- CTLFLAG_RW \| CTLTYPE_INT, NULL, 0, acpi_debug_objects_sysctl, "I",
	+ CTLFLAG_RW \| CTLTYPE_INT \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, acpi_debug_objects_sysctl, "I",
	"Enable Debug objects");

	/* Allow the interpreter to ignore common mistakes in BIOS. */
	@@ -4125,10 +4126,14 @@
	return (error);
	}

	-SYSCTL_PROC(_debug_acpi, OID_AUTO, layer, CTLFLAG_RW \| CTLTYPE_STRING,
	- "debug.acpi.layer", 0, acpi_debug_sysctl, "A", "");
	-SYSCTL_PROC(_debug_acpi, OID_AUTO, level, CTLFLAG_RW \| CTLTYPE_STRING,
	- "debug.acpi.level", 0, acpi_debug_sysctl, "A", "");
	+SYSCTL_PROC(_debug_acpi, OID_AUTO, layer,
	+ CTLFLAG_RW \| CTLTYPE_STRING \| CTLFLAG_NEEDGIANT,
	+ "debug.acpi.layer", 0, acpi_debug_sysctl, "A",
	+ "");
	+SYSCTL_PROC(_debug_acpi, OID_AUTO, level,
	+ CTLFLAG_RW \| CTLTYPE_STRING \| CTLFLAG_NEEDGIANT,
	+ "debug.acpi.level", 0, acpi_debug_sysctl, "A",
	+ "");
	#endif /* ACPI_DEBUG */

	static int
	Index: sys/dev/acpica/acpi_timer.c
	===================================================================
	--- sys/dev/acpica/acpi_timer.c
	+++ sys/dev/acpica/acpi_timer.c
	@@ -368,8 +368,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, acpi_timer_freq, CTLTYPE_INT \| CTLFLAG_RW,
	- 0, sizeof(u_int), acpi_timer_sysctl_freq, "I", "ACPI timer frequency");
	+SYSCTL_PROC(_machdep, OID_AUTO, acpi_timer_freq,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(u_int), acpi_timer_sysctl_freq, "I",
	+ "ACPI timer frequency");

	/*
	* Some ACPI timers are known or believed to suffer from implementation
	Index: sys/dev/amd_ecc_inject/ecc_inject.c
	===================================================================
	--- sys/dev/amd_ecc_inject/ecc_inject.c
	+++ sys/dev/amd_ecc_inject/ecc_inject.c
	@@ -133,17 +133,17 @@
	CTLTYPE_UINT \| CTLFLAG_RW, &delay_ms, 0,
	"Delay in milliseconds between error injections");
	SYSCTL_PROC(_hw_error_injection_dram_ecc, OID_AUTO, quadrant,
	- CTLTYPE_UINT \| CTLFLAG_RW, &quadrant, QUADRANT_MASK,
	- sysctl_int_with_max, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &quadrant, QUADRANT_MASK, sysctl_int_with_max, "IU",
	"Index of 16-byte quadrant within 64-byte line where errors "
	"should be injected");
	SYSCTL_PROC(_hw_error_injection_dram_ecc, OID_AUTO, word_mask,
	- CTLTYPE_UINT \| CTLFLAG_RW, &word_mask, INJ_WORD_MASK,
	- sysctl_nonzero_int_with_max, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &word_mask, INJ_WORD_MASK, sysctl_nonzero_int_with_max, "IU",
	"9-bit mask of words where errors should be injected (8 data + 1 ECC)");
	SYSCTL_PROC(_hw_error_injection_dram_ecc, OID_AUTO, bit_mask,
	- CTLTYPE_UINT \| CTLFLAG_RW, &bit_mask, INJ_VECTOR_MASK,
	- sysctl_nonzero_int_with_max, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &bit_mask, INJ_VECTOR_MASK, sysctl_nonzero_int_with_max, "IU",
	"16-bit mask of bits within each selected word where errors "
	"should be injected");
	SYSCTL_PROC(_hw_error_injection_dram_ecc, OID_AUTO, inject,
	Index: sys/dev/an/if_an.c
	===================================================================
	--- sys/dev/an/if_an.c
	+++ sys/dev/an/if_an.c
	@@ -266,8 +266,10 @@
	return error;
	}

	-SYSCTL_PROC(_hw_an, OID_AUTO, an_dump, CTLTYPE_STRING \| CTLFLAG_RW,
	- 0, sizeof(an_conf), sysctl_an_dump, "A", "");
	+SYSCTL_PROC(_hw_an, OID_AUTO, an_dump,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(an_conf), sysctl_an_dump, "A",
	+ "");

	static int
	sysctl_an_cache_mode(SYSCTL_HANDLER_ARGS)
	@@ -302,8 +304,10 @@
	return error;
	}

	-SYSCTL_PROC(_hw_an, OID_AUTO, an_cache_mode, CTLTYPE_STRING \| CTLFLAG_RW,
	- 0, sizeof(an_conf_cache), sysctl_an_cache_mode, "A", "");
	+SYSCTL_PROC(_hw_an, OID_AUTO, an_cache_mode,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(an_conf_cache), sysctl_an_cache_mode, "A",
	+ "");

	/*
	* We probe for an Aironet 4500/4800 card by attempting to
	Index: sys/dev/ath/ah_osdep.c
	===================================================================
	--- sys/dev/ath/ah_osdep.c
	+++ sys/dev/ath/ah_osdep.c
	@@ -236,8 +236,10 @@
	else
	return (ath_hal_setlogging(enable));
	}
	-SYSCTL_PROC(_hw_ath_hal, OID_AUTO, alq, CTLTYPE_INT\|CTLFLAG_RW,
	- 0, 0, sysctl_hw_ath_hal_log, "I", "Enable HAL register logging");
	+SYSCTL_PROC(_hw_ath_hal, OID_AUTO, alq,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_hw_ath_hal_log, "I",
	+ "Enable HAL register logging");
	SYSCTL_INT(_hw_ath_hal, OID_AUTO, alq_size, CTLFLAG_RW,
	&ath_hal_alq_qsize, 0, "In-memory log size (#records)");
	SYSCTL_INT(_hw_ath_hal, OID_AUTO, alq_lost, CTLFLAG_RW,
	Index: sys/dev/hwpmc/hwpmc_mod.c
	===================================================================
	--- sys/dev/hwpmc/hwpmc_mod.c
	+++ sys/dev/hwpmc/hwpmc_mod.c
	@@ -313,8 +313,9 @@
	TUNABLE_STR(PMC_SYSCTL_NAME_PREFIX "debugflags", pmc_debugstr,
	sizeof(pmc_debugstr));
	SYSCTL_PROC(_kern_hwpmc, OID_AUTO, debugflags,
	- CTLTYPE_STRING \| CTLFLAG_RWTUN \| CTLFLAG_NOFETCH,
	- 0, 0, pmc_debugflags_sysctl_handler, "A", "debug flags");
	+ CTLTYPE_STRING \| CTLFLAG_RWTUN \| CTLFLAG_NOFETCH \| CTLFLAG_NEEDGIANT,
	+ 0, 0, pmc_debugflags_sysctl_handler, "A",
	+ "debug flags");
	#endif


	Index: sys/dev/hyperv/netvsc/if_hn.c
	===================================================================
	--- sys/dev/hyperv/netvsc/if_hn.c
	+++ sys/dev/hyperv/netvsc/if_hn.c
	@@ -576,12 +576,16 @@
	&hn_tx_agg_pkts, 0, "Packet transmission aggregation packet limit");

	/* VF list */
	-SYSCTL_PROC(_hw_hn, OID_AUTO, vflist, CTLFLAG_RD \| CTLTYPE_STRING,
	- 0, 0, hn_vflist_sysctl, "A", "VF list");
	+SYSCTL_PROC(_hw_hn, OID_AUTO, vflist,
	+ CTLFLAG_RD \| CTLTYPE_STRING \| CTLFLAG_NEEDGIANT,
	+ 0, 0, hn_vflist_sysctl, "A",
	+ "VF list");

	/* VF mapping */
	-SYSCTL_PROC(_hw_hn, OID_AUTO, vfmap, CTLFLAG_RD \| CTLTYPE_STRING,
	- 0, 0, hn_vfmap_sysctl, "A", "VF mapping");
	+SYSCTL_PROC(_hw_hn, OID_AUTO, vfmap,
	+ CTLFLAG_RD \| CTLTYPE_STRING \| CTLFLAG_NEEDGIANT,
	+ 0, 0, hn_vfmap_sysctl, "A",
	+ "VF mapping");

	/* Transparent VF */
	static int hn_xpnt_vf = 1;
	Index: sys/dev/ioat/ioat_test.c
	===================================================================
	--- sys/dev/ioat/ioat_test.c
	+++ sys/dev/ioat/ioat_test.c
	@@ -576,7 +576,8 @@
	enable_ioat_test(enabled);
	return (0);
	}
	-SYSCTL_PROC(_hw_ioat, OID_AUTO, enable_ioat_test, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_hw_ioat, OID_AUTO, enable_ioat_test,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_enable_ioat_test, "I",
	"Non-zero: Enable the /dev/ioat_test device");

	Index: sys/dev/ow/ow.c
	===================================================================
	--- sys/dev/ow/ow.c
	+++ sys/dev/ow/ow.c
	@@ -183,8 +183,8 @@
	return (0); \
	} \
	SYSCTL_PROC(_hw_ow_ ## mode, OID_AUTO, param, \
	- CTLTYPE_INT \| CTLFLAG_RWTUN, 0, sizeof(int), \
	- sysctl_ow_timing_ ## mode ## _ ## param, "I", \
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT, \
	+ 0, sizeof(int), sysctl_ow_timing_ ## mode ## _ ## param, "I", \
	"1-Wire timing parameter in microseconds (-1 resets to default)")

	#define OW_TIMING_SYSCTL(param) \
	Index: sys/dev/random/random_harvestq.c
	===================================================================
	--- sys/dev/random/random_harvestq.c
	+++ sys/dev/random/random_harvestq.c
	@@ -305,8 +305,10 @@
	(orig_value & user_immutable_mask);
	return (0);
	}
	-SYSCTL_PROC(_kern_random_harvest, OID_AUTO, mask, CTLTYPE_UINT \| CTLFLAG_RW,
	- NULL, 0, random_check_uint_harvestmask, "IU", "Entropy harvesting mask");
	+SYSCTL_PROC(_kern_random_harvest, OID_AUTO, mask,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, random_check_uint_harvestmask, "IU",
	+ "Entropy harvesting mask");

	/* ARGSUSED */
	static int
	@@ -326,7 +328,8 @@
	return (error);
	}
	SYSCTL_PROC(_kern_random_harvest, OID_AUTO, mask_bin,
	- CTLTYPE_STRING \| CTLFLAG_RD, NULL, 0, random_print_harvestmask, "A",
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, random_print_harvestmask, "A",
	"Entropy harvesting mask (printable)");

	static const char *random_source_descr[ENTROPYSOURCE] = {
	@@ -387,8 +390,9 @@
	return (error);
	}
	SYSCTL_PROC(_kern_random_harvest, OID_AUTO, mask_symbolic,
	- CTLTYPE_STRING \| CTLFLAG_RD, NULL, 0, random_print_harvestmask_symbolic,
	- "A", "Entropy harvesting mask (symbolic)");
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, random_print_harvestmask_symbolic, "A",
	+ "Entropy harvesting mask (symbolic)");

	/* ARGSUSED */
	static void
	Index: sys/dev/safe/safe.c
	===================================================================
	--- sys/dev/safe/safe.c
	+++ sys/dev/safe/safe.c
	@@ -2162,6 +2162,8 @@
	}
	return error;
	}
	-SYSCTL_PROC(_hw_safe, OID_AUTO, dump, CTLTYPE_STRING \| CTLFLAG_RW,
	- 0, 0, sysctl_hw_safe_dump, "A", "Dump driver state");
	+SYSCTL_PROC(_hw_safe, OID_AUTO, dump,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_hw_safe_dump, "A",
	+ "Dump driver state");
	#endif /* SAFE_DEBUG */
	Index: sys/dev/sound/clone.c
	===================================================================
	--- sys/dev/sound/clone.c
	+++ sys/dev/sound/clone.c
	@@ -158,7 +158,8 @@

	return (err);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, timestamp_precision, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_hw_snd, OID_AUTO, timestamp_precision,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_hw_snd_timestamp_precision, "I",
	"timestamp precision (0=s 1=hz 2=us 3=ns)");
	#endif
	Index: sys/dev/sound/pcm/channel.c
	===================================================================
	--- sys/dev/sound/pcm/channel.c
	+++ sys/dev/sound/pcm/channel.c
	@@ -68,9 +68,10 @@

	return err;
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, latency, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- 0, sizeof(int), sysctl_hw_snd_latency, "I",
	- "buffering latency (0=low ... 10=high)");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, latency,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_latency, "I",
	+ "buffering latency (0=low ... 10=high)");

	int chn_latency_profile = CHN_LATENCY_PROFILE_DEFAULT;

	@@ -90,9 +91,10 @@

	return err;
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, latency_profile, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- 0, sizeof(int), sysctl_hw_snd_latency_profile, "I",
	- "buffering latency profile (0=aggressive 1=safe)");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, latency_profile,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_latency_profile, "I",
	+ "buffering latency profile (0=aggressive 1=safe)");

	static int chn_timeout = CHN_TIMEOUT;

	@@ -112,9 +114,10 @@

	return err;
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, timeout, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- 0, sizeof(int), sysctl_hw_snd_timeout, "I",
	- "interrupt timeout (1 - 10) seconds");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, timeout,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_timeout, "I",
	+ "interrupt timeout (1 - 10) seconds");

	static int chn_vpc_autoreset = 1;
	SYSCTL_INT(_hw_snd, OID_AUTO, vpc_autoreset, CTLFLAG_RWTUN,
	@@ -166,9 +169,10 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, vpc_0db, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- 0, sizeof(int), sysctl_hw_snd_vpc_0db, "I",
	- "0db relative level");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, vpc_0db,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_vpc_0db, "I",
	+ "0db relative level");

	static int
	sysctl_hw_snd_vpc_reset(SYSCTL_HANDLER_ARGS)
	@@ -185,9 +189,10 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, vpc_reset, CTLTYPE_INT \| CTLFLAG_RW,
	- 0, sizeof(int), sysctl_hw_snd_vpc_reset, "I",
	- "reset volume on all channels");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, vpc_reset,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_vpc_reset, "I",
	+ "reset volume on all channels");

	static int chn_usefrags = 0;
	static int chn_syncdelay = -1;
	Index: sys/dev/sound/pcm/feeder_rate.c
	===================================================================
	--- sys/dev/sound/pcm/feeder_rate.c
	+++ sys/dev/sound/pcm/feeder_rate.c
	@@ -185,7 +185,8 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_min, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_min,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_hw_snd_feeder_rate_min, "I",
	"minimum allowable rate");

	@@ -207,7 +208,8 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_max, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_max,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_hw_snd_feeder_rate_max, "I",
	"maximum allowable rate");

	@@ -229,7 +231,8 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_round, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_round,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_hw_snd_feeder_rate_round, "I",
	"sample rate converter rounding threshold");

	@@ -281,7 +284,8 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_quality, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_quality,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_hw_snd_feeder_rate_quality, "I",
	"sample rate converter quality ("__XSTRING(Z_QUALITY_MIN)"=low .. "
	__XSTRING(Z_QUALITY_MAX)"=high)");
	Index: sys/dev/sound/pcm/sndstat.c
	===================================================================
	--- sys/dev/sound/pcm/sndstat.c
	+++ sys/dev/sound/pcm/sndstat.c
	@@ -100,8 +100,10 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, verbose, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- 0, sizeof(int), sysctl_hw_sndverbose, "I", "verbosity level");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, verbose,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_sndverbose, "I",
	+ "verbosity level");

	static int
	sndstat_open(struct cdev i_dev, int flags, int mode, struct thread td)
	Index: sys/dev/sound/pcm/sound.c
	===================================================================
	--- sys/dev/sound/pcm/sound.c
	+++ sys/dev/sound/pcm/sound.c
	@@ -443,9 +443,9 @@
	}
	/* XXX: do we need a way to let the user change the default unit? */
	SYSCTL_PROC(_hw_snd, OID_AUTO, default_unit,
	- CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_ANYBODY,
	- 0, sizeof(int), sysctl_hw_snd_default_unit, "I",
	- "default sound device");
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_ANYBODY \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_default_unit, "I",
	+ "default sound device");

	static int
	sysctl_hw_snd_maxautovchans(SYSCTL_HANDLER_ARGS)
	@@ -473,8 +473,10 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, maxautovchans, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- 0, sizeof(int), sysctl_hw_snd_maxautovchans, "I", "maximum virtual channel");
	+SYSCTL_PROC(_hw_snd, OID_AUTO, maxautovchans,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_hw_snd_maxautovchans, "I",
	+ "maximum virtual channel");

	struct pcm_channel *
	pcm_chn_create(struct snddev_info d, struct pcm_channel parent, kobj_class_t cls, int dir, int num, void *devinfo)
	@@ -1007,7 +1009,8 @@

	return (err);
	}
	-SYSCTL_PROC(_hw_snd, OID_AUTO, clone_gc, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_snd, OID_AUTO, clone_gc,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_hw_snd_clone_gc, "I",
	"global clone garbage collector");
	#endif
	Index: sys/dev/sound/usb/uaudio.c
	===================================================================
	--- sys/dev/sound/usb/uaudio.c
	+++ sys/dev/sound/usb/uaudio.c
	@@ -133,7 +133,8 @@

	return (0);
	}
	-SYSCTL_PROC(_hw_usb_uaudio, OID_AUTO, buffer_ms, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_usb_uaudio, OID_AUTO, buffer_ms,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), uaudio_buffer_ms_sysctl, "I",
	"uaudio buffering delay from 2ms to 8ms");
	#else
	Index: sys/dev/usb/input/atp.c
	===================================================================
	--- sys/dev/usb/input/atp.c
	+++ sys/dev/usb/input/atp.c
	@@ -196,9 +196,11 @@

	static u_int atp_mickeys_scale_factor = ATP_SCALE_FACTOR;
	static int atp_sysctl_scale_factor_handler(SYSCTL_HANDLER_ARGS);
	-SYSCTL_PROC(_hw_usb_atp, OID_AUTO, scale_factor, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_usb_atp, OID_AUTO, scale_factor,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&atp_mickeys_scale_factor, sizeof(atp_mickeys_scale_factor),
	- atp_sysctl_scale_factor_handler, "IU", "movement scale factor");
	+ atp_sysctl_scale_factor_handler, "IU",
	+ "movement scale factor");

	static u_int atp_small_movement_threshold = ATP_SMALL_MOVEMENT_THRESHOLD;
	SYSCTL_UINT(_hw_usb_atp, OID_AUTO, small_movement, CTLFLAG_RWTUN,
	Index: sys/dev/usb/usb_debug.c
	===================================================================
	--- sys/dev/usb/usb_debug.c
	+++ sys/dev/usb/usb_debug.c
	@@ -79,36 +79,56 @@
	static SYSCTL_NODE(_hw_usb, OID_AUTO, timings, CTLFLAG_RW, 0, "Timings");
	static int usb_timings_sysctl_handler(SYSCTL_HANDLER_ARGS);

	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_reset_delay, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_reset_delay,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_port_reset_delay, sizeof(usb_port_reset_delay),
	- usb_timings_sysctl_handler, "IU", "Port Reset Delay");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_root_reset_delay, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Port Reset Delay");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_root_reset_delay,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_port_root_reset_delay, sizeof(usb_port_root_reset_delay),
	- usb_timings_sysctl_handler, "IU", "Root Port Reset Delay");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_reset_recovery, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Root Port Reset Delay");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_reset_recovery,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_port_reset_recovery, sizeof(usb_port_reset_recovery),
	- usb_timings_sysctl_handler, "IU", "Port Reset Recovery");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_powerup_delay, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Port Reset Recovery");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_powerup_delay,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_port_powerup_delay, sizeof(usb_port_powerup_delay),
	- usb_timings_sysctl_handler, "IU", "Port PowerUp Delay");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_resume_delay, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Port PowerUp Delay");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, port_resume_delay,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_port_resume_delay, sizeof(usb_port_resume_delay),
	- usb_timings_sysctl_handler, "IU", "Port Resume Delay");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, set_address_settle, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Port Resume Delay");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, set_address_settle,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_set_address_settle, sizeof(usb_set_address_settle),
	- usb_timings_sysctl_handler, "IU", "Set Address Settle");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, resume_delay, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Set Address Settle");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, resume_delay,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_resume_delay, sizeof(usb_resume_delay),
	- usb_timings_sysctl_handler, "IU", "Resume Delay");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, resume_wait, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Resume Delay");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, resume_wait,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_resume_wait, sizeof(usb_resume_wait),
	- usb_timings_sysctl_handler, "IU", "Resume Wait");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, resume_recovery, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Resume Wait");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, resume_recovery,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_resume_recovery, sizeof(usb_resume_recovery),
	- usb_timings_sysctl_handler, "IU", "Resume Recovery");
	-SYSCTL_PROC(_hw_usb_timings, OID_AUTO, extra_power_up_time, CTLTYPE_UINT \| CTLFLAG_RWTUN,
	+ usb_timings_sysctl_handler, "IU",
	+ "Resume Recovery");
	+SYSCTL_PROC(_hw_usb_timings, OID_AUTO, extra_power_up_time,
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	&usb_extra_power_up_time, sizeof(usb_extra_power_up_time),
	- usb_timings_sysctl_handler, "IU", "Extra PowerUp Time");
	+ usb_timings_sysctl_handler, "IU",
	+ "Extra PowerUp Time");
	#endif

	/------------------------------------------------------------------------
	Index: sys/fs/fuse/fuse_node.c
	===================================================================
	--- sys/fs/fuse/fuse_node.c
	+++ sys/fs/fuse/fuse_node.c
	@@ -124,7 +124,8 @@
	* The sysctl is retained primarily for use by jails supporting older FUSE
	* protocols. It may be removed entirely once FreeBSD 11.3 and 12.0 are EOL.
	*/
	-SYSCTL_PROC(_vfs_fusefs, OID_AUTO, data_cache_mode, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_vfs_fusefs, OID_AUTO, data_cache_mode,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&fuse_data_cache_mode, 0, sysctl_fuse_cache_mode, "I",
	"Zero: disable caching of FUSE file data; One: write-through caching "
	"(default); Two: write-back caching (generally unsafe)");
	Index: sys/fs/nfsclient/nfs_clnfsiod.c
	===================================================================
	--- sys/fs/nfsclient/nfs_clnfsiod.c
	+++ sys/fs/nfsclient/nfs_clnfsiod.c
	@@ -124,8 +124,9 @@
	NFSUNLOCKIOD();
	return (0);
	}
	-SYSCTL_PROC(_vfs_nfs, OID_AUTO, iodmin, CTLTYPE_UINT \| CTLFLAG_RW, 0,
	- sizeof (nfs_iodmin), sysctl_iodmin, "IU",
	+SYSCTL_PROC(_vfs_nfs, OID_AUTO, iodmin,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof (nfs_iodmin), sysctl_iodmin, "IU",
	"Min number of nfsiod kthreads to keep as spares");

	static int
	@@ -160,8 +161,9 @@
	NFSUNLOCKIOD();
	return (0);
	}
	-SYSCTL_PROC(_vfs_nfs, OID_AUTO, iodmax, CTLTYPE_UINT \| CTLFLAG_RW, 0,
	- sizeof (ncl_iodmax), sysctl_iodmax, "IU",
	+SYSCTL_PROC(_vfs_nfs, OID_AUTO, iodmax,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof (ncl_iodmax), sysctl_iodmax, "IU",
	"Max number of nfsiod kthreads");

	static int
	Index: sys/fs/nfsserver/nfs_nfsdcache.c
	===================================================================
	--- sys/fs/nfsserver/nfs_nfsdcache.c
	+++ sys/fs/nfsserver/nfs_nfsdcache.c
	@@ -187,8 +187,9 @@
	nfsrc_tcphighwater = newhighwater;
	return (0);
	}
	-SYSCTL_PROC(_vfs_nfsd, OID_AUTO, tcphighwater, CTLTYPE_UINT \| CTLFLAG_RW, 0,
	- sizeof(nfsrc_tcphighwater), sysctl_tcphighwater, "IU",
	+SYSCTL_PROC(_vfs_nfsd, OID_AUTO, tcphighwater,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(nfsrc_tcphighwater), sysctl_tcphighwater, "IU",
	"High water mark for TCP cache entries");

	static u_int nfsrc_udphighwater = NFSRVCACHE_UDPHIGHWATER;
	Index: sys/fs/nfsserver/nfs_nfsdport.c
	===================================================================
	--- sys/fs/nfsserver/nfs_nfsdport.c
	+++ sys/fs/nfsserver/nfs_nfsdport.c
	@@ -188,8 +188,9 @@
	nfsrv_dsdirsize = newdsdirsize;
	return (0);
	}
	-SYSCTL_PROC(_vfs_nfsd, OID_AUTO, dsdirsize, CTLTYPE_UINT \| CTLFLAG_RW, 0,
	- sizeof(nfsrv_dsdirsize), sysctl_dsdirsize, "IU",
	+SYSCTL_PROC(_vfs_nfsd, OID_AUTO, dsdirsize,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(nfsrv_dsdirsize), sysctl_dsdirsize, "IU",
	"Number of dsN subdirs on the DS servers");

	#define MAX_REORDERED_RPC 16
	Index: sys/fs/tmpfs/tmpfs_subr.c
	===================================================================
	--- sys/fs/tmpfs/tmpfs_subr.c
	+++ sys/fs/tmpfs/tmpfs_subr.c
	@@ -160,7 +160,8 @@
	return (0);
	}

	-SYSCTL_PROC(_vfs_tmpfs, OID_AUTO, memory_reserved, CTLTYPE_LONG\|CTLFLAG_RW,
	+SYSCTL_PROC(_vfs_tmpfs, OID_AUTO, memory_reserved,
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&tmpfs_pages_reserved, 0, sysctl_mem_reserved, "L",
	"Amount of available memory and swap below which tmpfs growth stops");

	Index: sys/geom/cache/g_cache.c
	===================================================================
	--- sys/geom/cache/g_cache.c
	+++ sys/geom/cache/g_cache.c
	@@ -84,10 +84,14 @@
	(u_int )arg1 = val;
	return (0);
	}
	-SYSCTL_PROC(_kern_geom_cache, OID_AUTO, used_lo, CTLTYPE_UINT\|CTLFLAG_RW,
	- &g_cache_used_lo, 0, sysctl_handle_pct, "IU", "");
	-SYSCTL_PROC(_kern_geom_cache, OID_AUTO, used_hi, CTLTYPE_UINT\|CTLFLAG_RW,
	- &g_cache_used_hi, 0, sysctl_handle_pct, "IU", "");
	+SYSCTL_PROC(_kern_geom_cache, OID_AUTO, used_lo,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &g_cache_used_lo, 0, sysctl_handle_pct, "IU",
	+ "");
	+SYSCTL_PROC(_kern_geom_cache, OID_AUTO, used_hi,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &g_cache_used_hi, 0, sysctl_handle_pct, "IU",
	+ "");


	static int g_cache_destroy(struct g_cache_softc *sc, boolean_t force);
	Index: sys/geom/geom_kern.c
	===================================================================
	--- sys/geom/geom_kern.c
	+++ sys/geom/geom_kern.c
	@@ -206,17 +206,20 @@

	SYSCTL_NODE(_kern, OID_AUTO, geom, CTLFLAG_RW, 0, "GEOMetry management");

	-SYSCTL_PROC(_kern_geom, OID_AUTO, confxml, CTLTYPE_STRING\|CTLFLAG_RD,
	- 0, 0, sysctl_kern_geom_confxml, "",
	- "Dump the GEOM config in XML");
	-
	-SYSCTL_PROC(_kern_geom, OID_AUTO, confdot, CTLTYPE_STRING\|CTLFLAG_RD,
	- 0, 0, sysctl_kern_geom_confdot, "",
	- "Dump the GEOM config in dot");
	-
	-SYSCTL_PROC(_kern_geom, OID_AUTO, conftxt, CTLTYPE_STRING\|CTLFLAG_RD,
	- 0, 0, sysctl_kern_geom_conftxt, "",
	- "Dump the GEOM config in txt");
	+SYSCTL_PROC(_kern_geom, OID_AUTO, confxml,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_geom_confxml, "",
	+ "Dump the GEOM config in XML");
	+
	+SYSCTL_PROC(_kern_geom, OID_AUTO, confdot,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_geom_confdot, "",
	+ "Dump the GEOM config in dot");
	+
	+SYSCTL_PROC(_kern_geom, OID_AUTO, conftxt,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_geom_conftxt, "",
	+ "Dump the GEOM config in txt");

	SYSCTL_INT(_kern_geom, OID_AUTO, debugflags, CTLFLAG_RWTUN,
	&g_debugflags, 0, "Set various trace levels for GEOM debugging");
	Index: sys/geom/journal/g_journal.c
	===================================================================
	--- sys/geom/journal/g_journal.c
	+++ sys/geom/journal/g_journal.c
	@@ -128,7 +128,8 @@
	return (0);
	}
	SYSCTL_PROC(_kern_geom_journal, OID_AUTO, record_entries,
	- CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0, g_journal_record_entries_sysctl, "I",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, g_journal_record_entries_sysctl, "I",
	"Maximum number of entires in one journal record");
	SYSCTL_UINT(_kern_geom_journal, OID_AUTO, optimize, CTLFLAG_RW,
	&g_journal_do_optimize, 0, "Try to combine bios on flush and copy");
	@@ -160,7 +161,8 @@
	return (0);
	}
	SYSCTL_PROC(_kern_geom_journal_cache, OID_AUTO, limit,
	- CTLTYPE_ULONG \| CTLFLAG_RWTUN, NULL, 0, g_journal_cache_limit_sysctl, "I",
	+ CTLTYPE_ULONG \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, g_journal_cache_limit_sysctl, "I",
	"Maximum number of allocated bytes");
	SYSCTL_UINT(_kern_geom_journal_cache, OID_AUTO, divisor, CTLFLAG_RDTUN,
	&g_journal_cache_divisor, 0,
	@@ -182,7 +184,8 @@
	return (0);
	}
	SYSCTL_PROC(_kern_geom_journal_cache, OID_AUTO, switch,
	- CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0, g_journal_cache_switch_sysctl, "I",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, g_journal_cache_switch_sysctl, "I",
	"Force switch when we hit this percent of cache use");
	SYSCTL_UINT(_kern_geom_journal_cache, OID_AUTO, misses, CTLFLAG_RW,
	&g_journal_cache_misses, 0, "Number of cache misses");
	Index: sys/geom/stripe/g_stripe.c
	===================================================================
	--- sys/geom/stripe/g_stripe.c
	+++ sys/geom/stripe/g_stripe.c
	@@ -88,8 +88,10 @@
	g_stripe_fast = fast;
	return (error);
	}
	-SYSCTL_PROC(_kern_geom_stripe, OID_AUTO, fast, CTLTYPE_INT \| CTLFLAG_RWTUN,
	- NULL, 0, g_sysctl_stripe_fast, "I", "Fast, but memory-consuming, mode");
	+SYSCTL_PROC(_kern_geom_stripe, OID_AUTO, fast,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, g_sysctl_stripe_fast, "I",
	+ "Fast, but memory-consuming, mode");
	static u_int g_stripe_maxmem = MAXPHYS * 100;
	SYSCTL_UINT(_kern_geom_stripe, OID_AUTO, maxmem, CTLFLAG_RDTUN, &g_stripe_maxmem,
	0, "Maximum memory that can be allocated in \"fast\" mode (in bytes)");
	Index: sys/geom/zero/g_zero.c
	===================================================================
	--- sys/geom/zero/g_zero.c
	+++ sys/geom/zero/g_zero.c
	@@ -49,8 +49,10 @@
	static SYSCTL_NODE(_kern_geom, OID_AUTO, zero, CTLFLAG_RW, 0,
	"GEOM_ZERO stuff");
	static int g_zero_clear = 1;
	-SYSCTL_PROC(_kern_geom_zero, OID_AUTO, clear, CTLTYPE_INT\|CTLFLAG_RW,
	- &g_zero_clear, 0, g_zero_clear_sysctl, "I", "Clear read data buffer");
	+SYSCTL_PROC(_kern_geom_zero, OID_AUTO, clear,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &g_zero_clear, 0, g_zero_clear_sysctl, "I",
	+ "Clear read data buffer");
	static int g_zero_byte = 0;
	SYSCTL_INT(_kern_geom_zero, OID_AUTO, byte, CTLFLAG_RW, &g_zero_byte, 0,
	"Byte (octet) value to clear the buffers with");
	Index: sys/gnu/gcov/gcov_subr.c
	===================================================================
	--- sys/gnu/gcov/gcov_subr.c
	+++ sys/gnu/gcov/gcov_subr.c
	@@ -163,7 +163,11 @@

	static SYSCTL_NODE(_debug, OID_AUTO, gcov, CTLFLAG_RD, NULL,
	"gcov code coverage");
	-SYSCTL_PROC(_debug_gcov, OID_AUTO, reset, CTLTYPE_INT \| CTLFLAG_RW,
	- NULL, 0, gcov_stats_reset_sysctl, "I", "Reset all profiling counts");
	-SYSCTL_PROC(_debug_gcov, OID_AUTO, enable, CTLTYPE_INT \| CTLFLAG_RW,
	- NULL, 0, gcov_stats_enable_sysctl, "I", "Enable code coverage");
	+SYSCTL_PROC(_debug_gcov, OID_AUTO, reset,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, gcov_stats_reset_sysctl, "I",
	+ "Reset all profiling counts");
	+SYSCTL_PROC(_debug_gcov, OID_AUTO, enable,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, gcov_stats_enable_sysctl, "I",
	+ "Enable code coverage");
	Index: sys/i386/i386/elan-mmcr.c
	===================================================================
	--- sys/i386/i386/elan-mmcr.c
	+++ sys/i386/i386/elan-mmcr.c
	@@ -321,8 +321,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, elan_freq, CTLTYPE_UINT \| CTLFLAG_RW,
	- 0, sizeof (u_int), sysctl_machdep_elan_freq, "IU", "");
	+SYSCTL_PROC(_machdep, OID_AUTO, elan_freq,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof (u_int), sysctl_machdep_elan_freq, "IU",
	+ "");

	/*
	* Positively identifying the Elan can only be done through the PCI id of
	Index: sys/i386/i386/machdep.c
	===================================================================
	--- sys/i386/i386/machdep.c
	+++ sys/i386/i386/machdep.c
	@@ -2665,8 +2665,10 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_machdep, OID_AUTO, smap, CTLTYPE_OPAQUE\|CTLFLAG_RD, NULL, 0,
	- smap_sysctl_handler, "S,bios_smap_xattr", "Raw BIOS SMAP data");
	+SYSCTL_PROC(_machdep, OID_AUTO, smap,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, smap_sysctl_handler, "S,bios_smap_xattr",
	+ "Raw BIOS SMAP data");

	void
	spinlock_enter(void)
	Index: sys/i386/i386/mp_clock.c
	===================================================================
	--- sys/i386/i386/mp_clock.c
	+++ sys/i386/i386/mp_clock.c
	@@ -81,8 +81,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, piix_freq, CTLTYPE_INT \| CTLFLAG_RW,
	- 0, sizeof(u_int), sysctl_machdep_piix_freq, "I", "");
	+SYSCTL_PROC(_machdep, OID_AUTO, piix_freq,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(u_int), sysctl_machdep_piix_freq, "I",
	+ "");

	static unsigned
	piix_get_timecount(struct timecounter *tc)
	Index: sys/i386/i386/prof_machdep.c
	===================================================================
	--- sys/i386/i386/prof_machdep.c
	+++ sys/i386/i386/prof_machdep.c
	@@ -300,8 +300,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, cputime_clock, CTLTYPE_INT \| CTLFLAG_RW,
	- 0, sizeof(u_int), sysctl_machdep_cputime_clock, "I", "");
	+SYSCTL_PROC(_machdep, OID_AUTO, cputime_clock,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(u_int), sysctl_machdep_cputime_clock, "I",
	+ "");

	/*
	* The start and stop routines need not be here since we turn off profiling
	Index: sys/kern/kern_acct.c
	===================================================================
	--- sys/kern/kern_acct.c
	+++ sys/kern/kern_acct.c
	@@ -187,7 +187,8 @@
	acctchkfreq = value;
	return (0);
	}
	-SYSCTL_PROC(_kern, OID_AUTO, acct_chkfreq, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_kern, OID_AUTO, acct_chkfreq,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&acctchkfreq, 0, sysctl_acct_chkfreq, "I",
	"frequency for checking the free space");

	Index: sys/kern/kern_cons.c
	===================================================================
	--- sys/kern/kern_cons.c
	+++ sys/kern/kern_cons.c
	@@ -360,8 +360,10 @@
	return (error);
	}

	-SYSCTL_PROC(_kern, OID_AUTO, console, CTLTYPE_STRING\|CTLFLAG_RW,
	- 0, 0, sysctl_kern_console, "A", "Console device control");
	+SYSCTL_PROC(_kern, OID_AUTO, console,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_console, "A",
	+ "Console device control");

	/*
	* User has changed the state of the console muting.
	@@ -378,9 +380,10 @@
	return (error);
	}

	-SYSCTL_PROC(_kern, OID_AUTO, consmute, CTLTYPE_INT\|CTLFLAG_RW,
	- 0, sizeof(cn_mute), sysctl_kern_consmute, "I",
	- "State of the console muting");
	+SYSCTL_PROC(_kern, OID_AUTO, consmute,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(cn_mute), sysctl_kern_consmute, "I",
	+ "State of the console muting");

	void
	cngrab()
	Index: sys/kern/kern_ffclock.c
	===================================================================
	--- sys/kern/kern_ffclock.c
	+++ sys/kern/kern_ffclock.c
	@@ -191,7 +191,8 @@
	return (error);
	}

	-SYSCTL_PROC(_kern_sysclock, OID_AUTO, available, CTLTYPE_STRING \| CTLFLAG_RD,
	+SYSCTL_PROC(_kern_sysclock, OID_AUTO, available,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_kern_sysclock_available, "A",
	"List of available system clocks");

	@@ -231,7 +232,8 @@
	return (error);
	}

	-SYSCTL_PROC(_kern_sysclock, OID_AUTO, active, CTLTYPE_STRING \| CTLFLAG_RW,
	+SYSCTL_PROC(_kern_sysclock, OID_AUTO, active,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_kern_sysclock_active, "A",
	"Name of the active system clock which is currently serving time");

	Index: sys/kern/kern_fork.c
	===================================================================
	--- sys/kern/kern_fork.c
	+++ sys/kern/kern_fork.c
	@@ -236,8 +236,10 @@
	return (error);
	}

	-SYSCTL_PROC(_kern, OID_AUTO, randompid, CTLTYPE_INT\|CTLFLAG_RW,
	- 0, 0, sysctl_kern_randompid, "I", "Random PID modulus. Special values: 0: disable, 1: choose random value");
	+SYSCTL_PROC(_kern, OID_AUTO, randompid,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_randompid, "I",
	+ "Random PID modulus. Special values: 0: disable, 1: choose random value");

	extern bitstr_t proc_id_pidmap;
	extern bitstr_t proc_id_grpidmap;
	Index: sys/kern/kern_intr.c
	===================================================================
	--- sys/kern/kern_intr.c
	+++ sys/kern/kern_intr.c
	@@ -1574,8 +1574,10 @@
	return (sysctl_handle_opaque(oidp, intrnames, sintrnames, req));
	}

	-SYSCTL_PROC(_hw, OID_AUTO, intrnames, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	- NULL, 0, sysctl_intrnames, "", "Interrupt Names");
	+SYSCTL_PROC(_hw, OID_AUTO, intrnames,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_intrnames, "",
	+ "Interrupt Names");

	static int
	sysctl_intrcnt(SYSCTL_HANDLER_ARGS)
	@@ -1601,8 +1603,10 @@
	return (sysctl_handle_opaque(oidp, intrcnt, sintrcnt, req));
	}

	-SYSCTL_PROC(_hw, OID_AUTO, intrcnt, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	- NULL, 0, sysctl_intrcnt, "", "Interrupt Counts");
	+SYSCTL_PROC(_hw, OID_AUTO, intrcnt,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_intrcnt, "",
	+ "Interrupt Counts");

	#ifdef DDB
	/*
	Index: sys/kern/kern_ktr.c
	===================================================================
	--- sys/kern/kern_ktr.c
	+++ sys/kern/kern_ktr.c
	@@ -129,8 +129,8 @@
	return (error);
	}
	SYSCTL_PROC(_debug_ktr, OID_AUTO, cpumask,
	- CTLFLAG_RWTUN \| CTLFLAG_MPSAFE \| CTLTYPE_STRING, NULL, 0,
	- sysctl_debug_ktr_cpumask, "S",
	+ CTLFLAG_RWTUN \| CTLFLAG_MPSAFE \| CTLTYPE_STRING,
	+ NULL, 0, sysctl_debug_ktr_cpumask, "S",
	"Bitmask of CPUs on which KTR logging is enabled");

	static int
	@@ -150,8 +150,10 @@

	return (error);
	}
	-SYSCTL_PROC(_debug_ktr, OID_AUTO, clear, CTLTYPE_INT\|CTLFLAG_RW, 0, 0,
	- sysctl_debug_ktr_clear, "I", "Clear KTR Buffer");
	+SYSCTL_PROC(_debug_ktr, OID_AUTO, clear,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_debug_ktr_clear, "I",
	+ "Clear KTR Buffer");

	/*
	* This is a sysctl proc so that it is serialized as !MPSAFE along with
	@@ -171,8 +173,9 @@
	return (error);
	}

	-SYSCTL_PROC(_debug_ktr, OID_AUTO, mask, CTLTYPE_U64 \| CTLFLAG_RWTUN, 0, 0,
	- sysctl_debug_ktr_mask, "QU",
	+SYSCTL_PROC(_debug_ktr, OID_AUTO, mask,
	+ CTLTYPE_U64 \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_debug_ktr_mask, "QU",
	"Bitmask of KTR event classes for which logging is enabled");

	#if KTR_ENTRIES > KTR_BOOT_ENTRIES
	@@ -242,8 +245,10 @@
	return (error);
	}

	-SYSCTL_PROC(_debug_ktr, OID_AUTO, entries, CTLTYPE_INT\|CTLFLAG_RW, 0, 0,
	- sysctl_debug_ktr_entries, "I", "Number of entries in the KTR buffer");
	+SYSCTL_PROC(_debug_ktr, OID_AUTO, entries,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_debug_ktr_entries, "I",
	+ "Number of entries in the KTR buffer");

	#ifdef KTR_VERBOSE
	int ktr_verbose = KTR_VERBOSE;
	@@ -305,8 +310,9 @@
	return (error);
	}
	SYSCTL_PROC(_debug_ktr, OID_AUTO, alq_enable,
	- CTLTYPE_INT\|CTLFLAG_RW, 0, 0, sysctl_debug_ktr_alq_enable,
	- "I", "Enable KTR logging");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_debug_ktr_alq_enable, "I",
	+ "Enable KTR logging");
	#endif

	void
	Index: sys/kern/kern_ktrace.c
	===================================================================
	--- sys/kern/kern_ktrace.c
	+++ sys/kern/kern_ktrace.c
	@@ -233,7 +233,8 @@
	return (ENOSPC);
	return (0);
	}
	-SYSCTL_PROC(_kern_ktrace, OID_AUTO, request_pool, CTLTYPE_UINT\|CTLFLAG_RW,
	+SYSCTL_PROC(_kern_ktrace, OID_AUTO, request_pool,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ktr_requestpool, 0, sysctl_kern_ktrace_request_pool, "IU",
	"Pool buffer size for ktrace(1)");

	Index: sys/kern/kern_linker.c
	===================================================================
	--- sys/kern/kern_linker.c
	+++ sys/kern/kern_linker.c
	@@ -2259,5 +2259,7 @@
	return (SYSCTL_OUT(req, "", 1));
	}

	-SYSCTL_PROC(_kern, OID_AUTO, function_list, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	- NULL, 0, sysctl_kern_function_list, "", "kernel function list");
	+SYSCTL_PROC(_kern, OID_AUTO, function_list,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_kern_function_list, "",
	+ "kernel function list");
	Index: sys/kern/kern_malloc.c
	===================================================================
	--- sys/kern/kern_malloc.c
	+++ sys/kern/kern_malloc.c
	@@ -1225,7 +1225,8 @@
	return (error);
	}

	-SYSCTL_PROC(_kern, OID_AUTO, malloc_stats, CTLFLAG_RD\|CTLTYPE_STRUCT,
	+SYSCTL_PROC(_kern, OID_AUTO, malloc_stats,
	+ CTLFLAG_RD \| CTLTYPE_STRUCT \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_kern_malloc_stats, "s,malloc_type_ustats",
	"Return malloc types");

	Index: sys/kern/kern_mbuf.c
	===================================================================
	--- sys/kern/kern_mbuf.c
	+++ sys/kern/kern_mbuf.c
	@@ -193,8 +193,9 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbclusters, CTLTYPE_INT\|CTLFLAG_RW,
	-&nmbclusters, 0, sysctl_nmbclusters, "IU",
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbclusters,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &nmbclusters, 0, sysctl_nmbclusters, "IU",
	"Maximum number of mbuf clusters allowed");

	static int
	@@ -214,8 +215,9 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbop, CTLTYPE_INT\|CTLFLAG_RW,
	-&nmbjumbop, 0, sysctl_nmbjumbop, "IU",
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbop,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &nmbjumbop, 0, sysctl_nmbjumbop, "IU",
	"Maximum number of mbuf page size jumbo clusters allowed");

	static int
	@@ -235,8 +237,9 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbo9, CTLTYPE_INT\|CTLFLAG_RW,
	-&nmbjumbo9, 0, sysctl_nmbjumbo9, "IU",
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbo9,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &nmbjumbo9, 0, sysctl_nmbjumbo9, "IU",
	"Maximum number of mbuf 9k jumbo clusters allowed");

	static int
	@@ -256,8 +259,9 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbo16, CTLTYPE_INT\|CTLFLAG_RW,
	-&nmbjumbo16, 0, sysctl_nmbjumbo16, "IU",
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbo16,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &nmbjumbo16, 0, sysctl_nmbjumbo16, "IU",
	"Maximum number of mbuf 16k jumbo clusters allowed");

	static int
	@@ -277,8 +281,9 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbufs, CTLTYPE_INT\|CTLFLAG_RW,
	-&nmbufs, 0, sysctl_nmbufs, "IU",
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbufs,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &nmbufs, 0, sysctl_nmbufs, "IU",
	"Maximum number of mbufs allowed");

	/*
	Index: sys/kern/kern_mib.c
	===================================================================
	--- sys/kern/kern_mib.c
	+++ sys/kern/kern_mib.c
	@@ -182,7 +182,8 @@
	val = ctob(p);
	return (sysctl_handle_long(oidp, &val, 0, req));
	}
	-SYSCTL_PROC(_hw, HW_PHYSMEM, physmem, CTLTYPE_ULONG \| CTLFLAG_RD,
	+SYSCTL_PROC(_hw, HW_PHYSMEM, physmem,
	+ CTLTYPE_ULONG \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_hw_physmem, "LU",
	"Amount of physical memory (in bytes)");

	@@ -197,7 +198,8 @@
	val = ctob(p);
	return (sysctl_handle_long(oidp, &val, 0, req));
	}
	-SYSCTL_PROC(_hw, HW_REALMEM, realmem, CTLTYPE_ULONG \| CTLFLAG_RD,
	+SYSCTL_PROC(_hw, HW_REALMEM, realmem,
	+ CTLTYPE_ULONG \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_hw_realmem, "LU",
	"Amount of memory (in bytes) reported by the firmware");

	@@ -213,7 +215,8 @@
	val = ctob(p);
	return (sysctl_handle_long(oidp, &val, 0, req));
	}
	-SYSCTL_PROC(_hw, HW_USERMEM, usermem, CTLTYPE_ULONG \| CTLFLAG_RD,
	+SYSCTL_PROC(_hw, HW_USERMEM, usermem,
	+ CTLTYPE_ULONG \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_hw_usermem, "LU",
	"Amount of memory (in bytes) which is not wired");

	@@ -244,8 +247,10 @@
	error = SYSCTL_OUT(req, pagesizes, sizeof(pagesizes));
	return (error);
	}
	-SYSCTL_PROC(_hw, OID_AUTO, pagesizes, CTLTYPE_ULONG \| CTLFLAG_RD,
	- NULL, 0, sysctl_hw_pagesizes, "LU", "Supported page sizes");
	+SYSCTL_PROC(_hw, OID_AUTO, pagesizes,
	+ CTLTYPE_ULONG \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_hw_pagesizes, "LU",
	+ "Supported page sizes");

	#ifdef SCTL_MASK32
	int adaptive_machine_arch = 1;
	@@ -393,8 +398,9 @@
	}

	SYSCTL_PROC(_kern, KERN_SECURELVL, securelevel,
	- CTLTYPE_INT\|CTLFLAG_RW\|CTLFLAG_PRISON, 0, 0, sysctl_kern_securelvl,
	- "I", "Current secure level");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_PRISON \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_securelvl, "I",
	+ "Current secure level");

	#ifdef INCLUDE_CONFIG_FILE
	/* Actual kernel configuration options. */
	Index: sys/kern/kern_poll.c
	===================================================================
	--- sys/kern/kern_poll.c
	+++ sys/kern/kern_poll.c
	@@ -131,8 +131,10 @@

	return (0);
	}
	-SYSCTL_PROC(_kern_polling, OID_AUTO, burst_max, CTLTYPE_UINT \| CTLFLAG_RW,
	- 0, sizeof(uint32_t), poll_burst_max_sysctl, "I", "Max Polling burst size");
	+SYSCTL_PROC(_kern_polling, OID_AUTO, burst_max,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(uint32_t), poll_burst_max_sysctl, "I",
	+ "Max Polling burst size");

	static int poll_each_burst_sysctl(SYSCTL_HANDLER_ARGS)
	{
	@@ -155,9 +157,10 @@

	return (0);
	}
	-SYSCTL_PROC(_kern_polling, OID_AUTO, each_burst, CTLTYPE_UINT \| CTLFLAG_RW,
	- 0, sizeof(uint32_t), poll_each_burst_sysctl, "I",
	- "Max size of each burst");
	+SYSCTL_PROC(_kern_polling, OID_AUTO, each_burst,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(uint32_t), poll_each_burst_sysctl, "I",
	+ "Max size of each burst");

	static uint32_t poll_in_idle_loop=0; /* do we poll in idle loop ? */
	SYSCTL_UINT(_kern_polling, OID_AUTO, idle_poll, CTLFLAG_RW,
	@@ -181,9 +184,10 @@

	return (0);
	}
	-SYSCTL_PROC(_kern_polling, OID_AUTO, user_frac, CTLTYPE_UINT \| CTLFLAG_RW,
	- 0, sizeof(uint32_t), user_frac_sysctl, "I",
	- "Desired user fraction of cpu time");
	+SYSCTL_PROC(_kern_polling, OID_AUTO, user_frac,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(uint32_t), user_frac_sysctl, "I",
	+ "Desired user fraction of cpu time");

	static uint32_t reg_frac_count = 0;
	static uint32_t reg_frac = 20 ;
	@@ -206,9 +210,10 @@

	return (0);
	}
	-SYSCTL_PROC(_kern_polling, OID_AUTO, reg_frac, CTLTYPE_UINT \| CTLFLAG_RW,
	- 0, sizeof(uint32_t), reg_frac_sysctl, "I",
	- "Every this many cycles check registers");
	+SYSCTL_PROC(_kern_polling, OID_AUTO, reg_frac,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(uint32_t), reg_frac_sysctl, "I",
	+ "Every this many cycles check registers");

	static uint32_t short_ticks;
	SYSCTL_UINT(_kern_polling, OID_AUTO, short_ticks, CTLFLAG_RD,
	Index: sys/kern/kern_rctl.c
	===================================================================
	--- sys/kern/kern_rctl.c
	+++ sys/kern/kern_rctl.c
	@@ -104,19 +104,23 @@
	SYSCTL_UINT(_kern_racct_rctl, OID_AUTO, devctl_rate_limit, CTLFLAG_RWTUN,
	&rctl_devctl_rate_limit, 0, "Maximum number of devctl messages per second");
	SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_min,
	- CTLTYPE_UINT \| CTLFLAG_RWTUN, 0, 0, &rctl_throttle_min_sysctl, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, 0, &rctl_throttle_min_sysctl, "IU",
	"Shortest throttling duration, in hz");
	TUNABLE_INT("kern.racct.rctl.throttle_min", &rctl_throttle_min);
	SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_max,
	- CTLTYPE_UINT \| CTLFLAG_RWTUN, 0, 0, &rctl_throttle_max_sysctl, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, 0, &rctl_throttle_max_sysctl, "IU",
	"Longest throttling duration, in hz");
	TUNABLE_INT("kern.racct.rctl.throttle_max", &rctl_throttle_max);
	SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_pct,
	- CTLTYPE_UINT \| CTLFLAG_RWTUN, 0, 0, &rctl_throttle_pct_sysctl, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, 0, &rctl_throttle_pct_sysctl, "IU",
	"Throttling penalty for process consumption, in percent");
	TUNABLE_INT("kern.racct.rctl.throttle_pct", &rctl_throttle_pct);
	SYSCTL_PROC(_kern_racct_rctl, OID_AUTO, throttle_pct2,
	- CTLTYPE_UINT \| CTLFLAG_RWTUN, 0, 0, &rctl_throttle_pct2_sysctl, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ 0, 0, &rctl_throttle_pct2_sysctl, "IU",
	"Throttling penalty for container consumption, in percent");
	TUNABLE_INT("kern.racct.rctl.throttle_pct2", &rctl_throttle_pct2);

	Index: sys/kern/kern_sendfile.c
	===================================================================
	--- sys/kern/kern_sendfile.c
	+++ sys/kern/kern_sendfile.c
	@@ -125,8 +125,10 @@
	COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t));
	return (SYSCTL_OUT(req, &s, sizeof(s)));
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE \| CTLFLAG_RW,
	- NULL, 0, sfstat_sysctl, "I", "sendfile statistics");
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sfstat_sysctl, "I",
	+ "sendfile statistics");

	static void
	sendfile_free_mext(struct mbuf *m)
	Index: sys/kern/kern_shutdown.c
	===================================================================
	--- sys/kern/kern_shutdown.c
	+++ sys/kern/kern_shutdown.c
	@@ -733,8 +733,9 @@
	static int kassert_sysctl_kassert(SYSCTL_HANDLER_ARGS);

	SYSCTL_PROC(_debug_kassert, OID_AUTO, kassert,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE, NULL, 0,
	- kassert_sysctl_kassert, "I", "set to trigger a test kassert");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kassert_sysctl_kassert, "I",
	+ "set to trigger a test kassert");

	static int
	kassert_sysctl_kassert(SYSCTL_HANDLER_ARGS)
	@@ -1009,7 +1010,8 @@
	sbuf_delete(&sb);
	return (error);
	}
	-SYSCTL_PROC(_kern_shutdown, OID_AUTO, dumpdevname, CTLTYPE_STRING \| CTLFLAG_RD,
	+SYSCTL_PROC(_kern_shutdown, OID_AUTO, dumpdevname,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	&dumper_configs, 0, dumpdevname_sysctl_handler, "A",
	"Device(s) for kernel dumps");

	Index: sys/kern/kern_sig.c
	===================================================================
	--- sys/kern/kern_sig.c
	+++ sys/kern/kern_sig.c
	@@ -3310,9 +3310,10 @@
	num_cores = new_val;
	return (0);
	}
	-SYSCTL_PROC(_debug, OID_AUTO, ncores, CTLTYPE_INT\|CTLFLAG_RW,
	- 0, sizeof(int), sysctl_debug_num_cores_check, "I",
	- "Maximum number of generated process corefiles while using index format");
	+SYSCTL_PROC(_debug, OID_AUTO, ncores,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_debug_num_cores_check, "I",
	+ "Maximum number of generated process corefiles while using index format");

	#define GZIP_SUFFIX ".gz"
	#define ZSTD_SUFFIX ".zst"
	@@ -3333,7 +3334,8 @@
	compress_user_cores = val;
	return (error);
	}
	-SYSCTL_PROC(_kern, OID_AUTO, compress_user_cores, CTLTYPE_INT \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_kern, OID_AUTO, compress_user_cores,
	+ CTLTYPE_INT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_compress_user_cores, "I",
	"Enable compression of user corefiles ("
	__XSTRING(COMPRESS_GZIP) " = gzip, "
	Index: sys/kern/kern_switch.c
	===================================================================
	--- sys/kern/kern_switch.c
	+++ sys/kern/kern_switch.c
	@@ -142,8 +142,10 @@
	return (0);
	}

	-SYSCTL_PROC(_kern_sched_stats, OID_AUTO, reset, CTLTYPE_INT \| CTLFLAG_WR, NULL,
	- 0, sysctl_stats_reset, "I", "Reset scheduler statistics");
	+SYSCTL_PROC(_kern_sched_stats, OID_AUTO, reset,
	+ CTLTYPE_INT \| CTLFLAG_WR \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_stats_reset, "I",
	+ "Reset scheduler statistics");
	#endif

	/************************************************************************
	Index: sys/kern/kern_sysctl.c
	===================================================================
	--- sys/kern/kern_sysctl.c
	+++ sys/kern/kern_sysctl.c
	@@ -169,11 +169,17 @@
	SYSCTL_RUNLOCK(tracker);
	else
	SYSCTL_WUNLOCK();
	-
	- if (!(oid->oid_kind & CTLFLAG_MPSAFE))
	+
	+ /*
	+ * Temporary compatibilty with 3rd party software defining
	+ * CTLFLAG_MPSAFE and/or untill we decide to drop this flag.
	+ */
	+ if ((oid->oid_kind & CTLFLAG_NEEDGIANT) \|\|
	+ !(oid->oid_kind & CTLFLAG_MPSAFE))
	mtx_lock(&Giant);
	error = oid->oid_handler(oid, arg1, arg2, req);
	- if (!(oid->oid_kind & CTLFLAG_MPSAFE))
	+ if ((oid->oid_kind & CTLFLAG_NEEDGIANT) \|\|
	+ !(oid->oid_kind & CTLFLAG_MPSAFE))
	mtx_unlock(&Giant);

	KFAIL_POINT_ERROR(_debug_fail_point, sysctl_running, error);
	Index: sys/kern/kern_tc.c
	===================================================================
	--- sys/kern/kern_tc.c
	+++ sys/kern/kern_tc.c
	@@ -102,8 +102,10 @@
	volatile time_t time_uptime = 1;

	static int sysctl_kern_boottime(SYSCTL_HANDLER_ARGS);
	-SYSCTL_PROC(_kern, KERN_BOOTTIME, boottime, CTLTYPE_STRUCT\|CTLFLAG_RD,
	- NULL, 0, sysctl_kern_boottime, "S,timeval", "System boottime");
	+SYSCTL_PROC(_kern, KERN_BOOTTIME, boottime,
	+ CTLTYPE_STRUCT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_kern_boottime, "S,timeval",
	+ "System boottime");

	SYSCTL_NODE(_kern, OID_AUTO, timecounter, CTLFLAG_RW, 0, "");
	static SYSCTL_NODE(_kern_timecounter, OID_AUTO, tc, CTLFLAG_RW, 0, "");
	@@ -1536,7 +1538,8 @@
	return (EINVAL);
	}

	-SYSCTL_PROC(_kern_timecounter, OID_AUTO, hardware, CTLTYPE_STRING \| CTLFLAG_RW,
	+SYSCTL_PROC(_kern_timecounter, OID_AUTO, hardware,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_kern_timecounter_hardware, "A",
	"Timecounter hardware selected");

	@@ -1560,8 +1563,10 @@
	return (error);
	}

	-SYSCTL_PROC(_kern_timecounter, OID_AUTO, choice, CTLTYPE_STRING \| CTLFLAG_RD,
	- 0, 0, sysctl_kern_timecounter_choice, "A", "Timecounter hardware detected");
	+SYSCTL_PROC(_kern_timecounter, OID_AUTO, choice,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_kern_timecounter_choice, "A",
	+ "Timecounter hardware detected");

	/*
	* RFC 2783 PPS-API implementation.
	Index: sys/kern/posix4_mib.c
	===================================================================
	--- sys/kern/posix4_mib.c
	+++ sys/kern/posix4_mib.c
	@@ -62,8 +62,10 @@
	SYSCTL_INT(_p1003_1b, num, name, CTLFLAG_RD \| CTLFLAG_CAPRD, \
	facility + num - 1, 0, "");
	#define P1B_SYSCTL_RW(num, name) \
	- SYSCTL_PROC(_p1003_1b, num, name, CTLTYPE_INT \| CTLFLAG_RW, NULL, num, \
	- p31b_sysctl_proc, "I", "");
	+ SYSCTL_PROC(_p1003_1b, num, name, \
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT, \
	+ NULL, num, p31b_sysctl_proc, "I", \
	+ "");

	#else

	Index: sys/kern/sched_4bsd.c
	===================================================================
	--- sys/kern/sched_4bsd.c
	+++ sys/kern/sched_4bsd.c
	@@ -213,7 +213,8 @@

	SYSCTL_STRING(_kern_sched, OID_AUTO, name, CTLFLAG_RD, "4BSD", 0,
	"Scheduler name");
	-SYSCTL_PROC(_kern_sched, OID_AUTO, quantum, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_kern_sched, OID_AUTO, quantum,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_kern_quantum, "I",
	"Quantum for timeshare threads in microseconds");
	SYSCTL_INT(_kern_sched, OID_AUTO, slice, CTLFLAG_RW, &sched_slice, 0,
	Index: sys/kern/sched_ule.c
	===================================================================
	--- sys/kern/sched_ule.c
	+++ sys/kern/sched_ule.c
	@@ -3080,7 +3080,8 @@
	SYSCTL_NODE(_kern, OID_AUTO, sched, CTLFLAG_RW, 0, "Scheduler");
	SYSCTL_STRING(_kern_sched, OID_AUTO, name, CTLFLAG_RD, "ULE", 0,
	"Scheduler name");
	-SYSCTL_PROC(_kern_sched, OID_AUTO, quantum, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_kern_sched, OID_AUTO, quantum,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_kern_quantum, "I",
	"Quantum for timeshare threads in microseconds");
	SYSCTL_INT(_kern_sched, OID_AUTO, slice, CTLFLAG_RW, &sched_slice, 0,
	Index: sys/kern/subr_devstat.c
	===================================================================
	--- sys/kern/subr_devstat.c
	+++ sys/kern/subr_devstat.c
	@@ -439,8 +439,10 @@
	static SYSCTL_NODE(_kern, OID_AUTO, devstat, CTLFLAG_RD, NULL,
	"Device Statistics");

	-SYSCTL_PROC(_kern_devstat, OID_AUTO, all, CTLFLAG_RD\|CTLTYPE_OPAQUE,
	- NULL, 0, sysctl_devstat, "S,devstat", "All devices in the devstat list");
	+SYSCTL_PROC(_kern_devstat, OID_AUTO, all,
	+ CTLFLAG_RD \| CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_devstat, "S,devstat",
	+ "All devices in the devstat list");
	/*
	* Export the number of devices in the system so that userland utilities
	* can determine how much memory to allocate to hold all the devices.
	Index: sys/kern/subr_kdb.c
	===================================================================
	--- sys/kern/subr_kdb.c
	+++ sys/kern/subr_kdb.c
	@@ -88,31 +88,40 @@

	static SYSCTL_NODE(_debug, OID_AUTO, kdb, CTLFLAG_RW, NULL, "KDB nodes");

	-SYSCTL_PROC(_debug_kdb, OID_AUTO, available, CTLTYPE_STRING \| CTLFLAG_RD, NULL,
	- 0, kdb_sysctl_available, "A", "list of available KDB backends");
	+SYSCTL_PROC(_debug_kdb, OID_AUTO, available,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_available, "A",
	+ "list of available KDB backends");

	-SYSCTL_PROC(_debug_kdb, OID_AUTO, current, CTLTYPE_STRING \| CTLFLAG_RW, NULL,
	- 0, kdb_sysctl_current, "A", "currently selected KDB backend");
	+SYSCTL_PROC(_debug_kdb, OID_AUTO, current,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_current, "A",
	+ "currently selected KDB backend");

	SYSCTL_PROC(_debug_kdb, OID_AUTO, enter,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE, NULL, 0,
	- kdb_sysctl_enter, "I", "set to enter the debugger");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_enter, "I",
	+ "set to enter the debugger");

	SYSCTL_PROC(_debug_kdb, OID_AUTO, panic,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE, NULL, 0,
	- kdb_sysctl_panic, "I", "set to panic the kernel");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_panic, "I",
	+ "set to panic the kernel");

	SYSCTL_PROC(_debug_kdb, OID_AUTO, trap,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE, NULL, 0,
	- kdb_sysctl_trap, "I", "set to cause a page fault via data access");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_trap, "I",
	+ "set to cause a page fault via data access");

	SYSCTL_PROC(_debug_kdb, OID_AUTO, trap_code,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE, NULL, 0,
	- kdb_sysctl_trap_code, "I", "set to cause a page fault via code access");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_trap_code, "I",
	+ "set to cause a page fault via code access");

	SYSCTL_PROC(_debug_kdb, OID_AUTO, stack_overflow,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE, NULL, 0,
	- kdb_sysctl_stack_overflow, "I", "set to cause a stack overflow");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, kdb_sysctl_stack_overflow, "I",
	+ "set to cause a stack overflow");

	SYSCTL_INT(_debug_kdb, OID_AUTO, break_to_debugger,
	CTLFLAG_RWTUN \| CTLFLAG_SECURE,
	Index: sys/kern/subr_lock.c
	===================================================================
	--- sys/kern/subr_lock.c
	+++ sys/kern/subr_lock.c
	@@ -733,11 +733,17 @@
	&lock_prof_skipcount, 0, "Sample approximately every N lock acquisitions.");
	SYSCTL_INT(_debug_lock_prof, OID_AUTO, rejected, CTLFLAG_RD,
	&lock_prof_rejected, 0, "Number of rejected profiling records");
	-SYSCTL_PROC(_debug_lock_prof, OID_AUTO, stats, CTLTYPE_STRING \| CTLFLAG_RD,
	- NULL, 0, dump_lock_prof_stats, "A", "Lock profiling statistics");
	-SYSCTL_PROC(_debug_lock_prof, OID_AUTO, reset, CTLTYPE_INT \| CTLFLAG_RW,
	- NULL, 0, reset_lock_prof_stats, "I", "Reset lock profiling statistics");
	-SYSCTL_PROC(_debug_lock_prof, OID_AUTO, enable, CTLTYPE_INT \| CTLFLAG_RW,
	- NULL, 0, enable_lock_prof, "I", "Enable lock profiling");
	+SYSCTL_PROC(_debug_lock_prof, OID_AUTO, stats,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, dump_lock_prof_stats, "A",
	+ "Lock profiling statistics");
	+SYSCTL_PROC(_debug_lock_prof, OID_AUTO, reset,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, reset_lock_prof_stats, "I",
	+ "Reset lock profiling statistics");
	+SYSCTL_PROC(_debug_lock_prof, OID_AUTO, enable,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, enable_lock_prof, "I",
	+ "Enable lock profiling");

	#endif
	Index: sys/kern/subr_param.c
	===================================================================
	--- sys/kern/subr_param.c
	+++ sys/kern/subr_param.c
	@@ -137,7 +137,8 @@
	"Maximum stack size");
	SYSCTL_ULONG(_kern, OID_AUTO, sgrowsiz, CTLFLAG_RWTUN \| CTLFLAG_NOFETCH, &sgrowsiz, 0,
	"Amount to grow stack on a stack fault");
	-SYSCTL_PROC(_kern, OID_AUTO, vm_guest, CTLFLAG_RD \| CTLTYPE_STRING,
	+SYSCTL_PROC(_kern, OID_AUTO, vm_guest,
	+ CTLFLAG_RD \| CTLTYPE_STRING \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_kern_vm_guest, "A",
	"Virtual machine guest detected?");

	Index: sys/kern/subr_rtc.c
	===================================================================
	--- sys/kern/subr_rtc.c
	+++ sys/kern/subr_rtc.c
	@@ -81,7 +81,8 @@
	"Enable debug printing of RTC clock I/O; 1=reads, 2=writes, 3=both.");

	static int sysctl_clock_do_io(SYSCTL_HANDLER_ARGS);
	-SYSCTL_PROC(_debug, OID_AUTO, clock_do_io, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_debug, OID_AUTO, clock_do_io,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_clock_do_io, "I",
	"Trigger one-time IO on RTC clocks; 1=read (and discard), 2=write");

	Index: sys/kern/subr_sleepqueue.c
	===================================================================
	--- sys/kern/subr_sleepqueue.c
	+++ sys/kern/subr_sleepqueue.c
	@@ -1427,13 +1427,18 @@
	return (error);
	}

	-SYSCTL_PROC(_debug_sleepq, OID_AUTO, stats, CTLTYPE_STRING \| CTLFLAG_RD,
	- NULL, 0, dump_sleepq_prof_stats, "A", "Sleepqueue profiling statistics");
	-SYSCTL_PROC(_debug_sleepq, OID_AUTO, reset, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_debug_sleepq, OID_AUTO, stats,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, dump_sleepq_prof_stats, "A",
	+ "Sleepqueue profiling statistics");
	+SYSCTL_PROC(_debug_sleepq, OID_AUTO, reset,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, reset_sleepq_prof_stats, "I",
	"Reset sleepqueue profiling statistics");
	-SYSCTL_PROC(_debug_sleepq, OID_AUTO, enable, CTLTYPE_INT \| CTLFLAG_RW,
	- NULL, 0, enable_sleepq_prof, "I", "Enable sleepqueue profiling");
	+SYSCTL_PROC(_debug_sleepq, OID_AUTO, enable,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, enable_sleepq_prof, "I",
	+ "Enable sleepqueue profiling");
	#endif

	#ifdef DDB
	Index: sys/kern/subr_stats.c
	===================================================================
	--- sys/kern/subr_stats.c
	+++ sys/kern/subr_stats.c
	@@ -3896,7 +3896,8 @@
	SYSCTL_NODE(_kern, OID_AUTO, stats, CTLFLAG_RW, NULL,
	"stats(9) MIB");

	-SYSCTL_PROC(_kern_stats, OID_AUTO, templates, CTLTYPE_STRING\|CTLFLAG_RD,
	+SYSCTL_PROC(_kern_stats, OID_AUTO, templates,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	NULL, 0, stats_tpl_list_available, "A",
	"list the name/hash of all available stats(9) templates");

	Index: sys/kern/subr_witness.c
	===================================================================
	--- sys/kern/subr_witness.c
	+++ sys/kern/subr_witness.c
	@@ -372,8 +372,10 @@
	* completely disabled.
	*/
	static int witness_watch = 1;
	-SYSCTL_PROC(_debug_witness, OID_AUTO, watch, CTLFLAG_RWTUN \| CTLTYPE_INT, NULL, 0,
	- sysctl_debug_witness_watch, "I", "witness is watching lock operations");
	+SYSCTL_PROC(_debug_witness, OID_AUTO, watch,
	+ CTLFLAG_RWTUN \| CTLTYPE_INT \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_debug_witness_watch, "I",
	+ "witness is watching lock operations");

	#ifdef KDB
	/*
	@@ -424,21 +426,26 @@
	};

	static enum witness_channel witness_channel = WITNESS_CONSOLE;
	-SYSCTL_PROC(_debug_witness, OID_AUTO, output_channel, CTLTYPE_STRING \|
	- CTLFLAG_RWTUN, NULL, 0, sysctl_debug_witness_channel, "A",
	+SYSCTL_PROC(_debug_witness, OID_AUTO, output_channel,
	+ CTLTYPE_STRING \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_debug_witness_channel, "A",
	"Output channel for warnings");

	/*
	* Call this to print out the relations between locks.
	*/
	-SYSCTL_PROC(_debug_witness, OID_AUTO, fullgraph, CTLTYPE_STRING \| CTLFLAG_RD,
	- NULL, 0, sysctl_debug_witness_fullgraph, "A", "Show locks relation graphs");
	+SYSCTL_PROC(_debug_witness, OID_AUTO, fullgraph,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_debug_witness_fullgraph, "A",
	+ "Show locks relation graphs");

	/*
	* Call this to print out the witness faulty stacks.
	*/
	-SYSCTL_PROC(_debug_witness, OID_AUTO, badstacks, CTLTYPE_STRING \| CTLFLAG_RD,
	- NULL, 0, sysctl_debug_witness_badstacks, "A", "Show bad witness stacks");
	+SYSCTL_PROC(_debug_witness, OID_AUTO, badstacks,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_debug_witness_badstacks, "A",
	+ "Show bad witness stacks");

	static struct mtx w_mtx;

	Index: sys/kern/uipc_mbuf.c
	===================================================================
	--- sys/kern/uipc_mbuf.c
	+++ sys/kern/uipc_mbuf.c
	@@ -2114,10 +2114,14 @@
	}


	-SYSCTL_PROC(_kern_ipc, OID_AUTO, mbufprofile, CTLTYPE_STRING\|CTLFLAG_RD,
	- NULL, 0, mbprof_handler, "A", "mbuf profiling statistics");
	-
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, mbufprofileclr, CTLTYPE_INT\|CTLFLAG_RW,
	- NULL, 0, mbprof_clr_handler, "I", "clear mbuf profiling statistics");
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, mbufprofile,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, mbprof_handler, "A",
	+ "mbuf profiling statistics");
	+
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, mbufprofileclr,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, mbprof_clr_handler, "I",
	+ "clear mbuf profiling statistics");
	#endif

	Index: sys/kern/uipc_socket.c
	===================================================================
	--- sys/kern/uipc_socket.c
	+++ sys/kern/uipc_socket.c
	@@ -235,11 +235,12 @@
	somaxconn = val;
	return (0);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, soacceptqueue, CTLTYPE_UINT \| CTLFLAG_RW,
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, soacceptqueue,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_somaxconn, "I",
	"Maximum listen socket pending connection accept queue size");
	SYSCTL_PROC(_kern_ipc, KIPC_SOMAXCONN, somaxconn,
	- CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_SKIP,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	0, sizeof(int), sysctl_somaxconn, "I",
	"Maximum listen socket pending connection accept queue size (compat)");

	@@ -369,7 +370,8 @@
	}
	return (error);
	}
	-SYSCTL_PROC(_kern_ipc, OID_AUTO, maxsockets, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_kern_ipc, OID_AUTO, maxsockets,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&maxsockets, 0, sysctl_maxsockets, "IU",
	"Maximum number of sockets available");

	Index: sys/kern/uipc_usrreq.c
	===================================================================
	--- sys/kern/uipc_usrreq.c
	+++ sys/kern/uipc_usrreq.c
	@@ -1900,14 +1900,16 @@
	return (error);
	}

	-SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	+SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	(void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
	"List of active local datagram sockets");
	-SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	+SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	(void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
	"List of active local stream sockets");
	SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
	- CTLTYPE_OPAQUE \| CTLFLAG_RD,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	(void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
	"List of active local seqpacket sockets");

	Index: sys/kern/vfs_subr.c
	===================================================================
	--- sys/kern/vfs_subr.c
	+++ sys/kern/vfs_subr.c
	@@ -2404,8 +2404,10 @@
	return (error);
	}

	-SYSCTL_PROC(_vfs, OID_AUTO, worklist_len, CTLTYPE_INT \| CTLFLAG_RD, NULL, 0,
	- sysctl_vfs_worklist_len, "I", "Syncer thread worklist length");
	+SYSCTL_PROC(_vfs, OID_AUTO, worklist_len,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_vfs_worklist_len, "I",
	+ "Syncer thread worklist length");

	static struct proc *updateproc;
	static void sched_sync(void);
	@@ -5467,7 +5469,8 @@
	return (error);
	}

	-SYSCTL_PROC(_vfs, OID_AUTO, ctl, CTLTYPE_OPAQUE \| CTLFLAG_WR,
	+SYSCTL_PROC(_vfs, OID_AUTO, ctl,
	+ CTLTYPE_OPAQUE \| CTLFLAG_WR \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_vfs_ctl, "",
	"Sysctl by fsid");

	Index: sys/libkern/iconv.c
	===================================================================
	--- sys/libkern/iconv.c
	+++ sys/libkern/iconv.c
	@@ -348,8 +348,10 @@
	return error;
	}

	-SYSCTL_PROC(_kern_iconv, OID_AUTO, drvlist, CTLFLAG_RD \| CTLTYPE_OPAQUE,
	- NULL, 0, iconv_sysctl_drvlist, "S,xlat", "registered converters");
	+SYSCTL_PROC(_kern_iconv, OID_AUTO, drvlist,
	+ CTLFLAG_RD \| CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, iconv_sysctl_drvlist, "S,xlat",
	+ "registered converters");

	/*
	* List all available charset pairs.
	@@ -379,8 +381,10 @@
	return error;
	}

	-SYSCTL_PROC(_kern_iconv, OID_AUTO, cslist, CTLFLAG_RD \| CTLTYPE_OPAQUE,
	- NULL, 0, iconv_sysctl_cslist, "S,xlat", "registered charset pairs");
	+SYSCTL_PROC(_kern_iconv, OID_AUTO, cslist,
	+ CTLFLAG_RD \| CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, iconv_sysctl_cslist, "S,xlat",
	+ "registered charset pairs");

	int
	iconv_add(const char converter, const char to, const char *from)
	@@ -446,8 +450,10 @@
	return error;
	}

	-SYSCTL_PROC(_kern_iconv, OID_AUTO, add, CTLFLAG_RW \| CTLTYPE_OPAQUE,
	- NULL, 0, iconv_sysctl_add, "S,xlat", "register charset pair");
	+SYSCTL_PROC(_kern_iconv, OID_AUTO, add,
	+ CTLFLAG_RW \| CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, iconv_sysctl_add, "S,xlat",
	+ "register charset pair");

	/*
	* Default stubs for converters
	Index: sys/mips/cavium/octeon_machdep.c
	===================================================================
	--- sys/mips/cavium/octeon_machdep.c
	+++ sys/mips/cavium/octeon_machdep.c
	@@ -446,7 +446,8 @@
	return (0);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, led_display, CTLTYPE_STRING \| CTLFLAG_WR,
	+SYSCTL_PROC(_machdep, OID_AUTO, led_display,
	+ CTLTYPE_STRING \| CTLFLAG_WR \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_machdep_led_display, "A",
	"String to display on LED display");

	Index: sys/mips/mips/tick.c
	===================================================================
	--- sys/mips/mips/tick.c
	+++ sys/mips/mips/tick.c
	@@ -178,7 +178,8 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, counter_freq, CTLTYPE_U64 \| CTLFLAG_RW,
	+SYSCTL_PROC(_machdep, OID_AUTO, counter_freq,
	+ CTLTYPE_U64 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_machdep_counter_freq, "QU",
	"Timecounter frequency in Hz");

	Index: sys/mips/nlm/cms.c
	===================================================================
	--- sys/mips/nlm/cms.c
	+++ sys/mips/nlm/cms.c
	@@ -493,5 +493,7 @@
	return (error);
	}

	-SYSCTL_PROC(_debug, OID_AUTO, msgring, CTLTYPE_STRING \| CTLFLAG_RD, 0, 0,
	- sys_print_debug, "A", "msgring debug info");
	+SYSCTL_PROC(_debug, OID_AUTO, msgring,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sys_print_debug, "A",
	+ "msgring debug info");
	Index: sys/mips/nlm/tick.c
	===================================================================
	--- sys/mips/nlm/tick.c
	+++ sys/mips/nlm/tick.c
	@@ -179,7 +179,8 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, counter_freq, CTLTYPE_U64 \| CTLFLAG_RW,
	+SYSCTL_PROC(_machdep, OID_AUTO, counter_freq,
	+ CTLTYPE_U64 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_machdep_counter_freq, "QU",
	"Timecounter frequency in Hz");

	Index: sys/net/if_bridge.c
	===================================================================
	--- sys/net/if_bridge.c
	+++ sys/net/if_bridge.c
	@@ -614,7 +614,7 @@
	return (error);
	}
	SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_VNET,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_VNET \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(pfil_ipfw), 0, &sysctl_pfil_ipfw, "I",
	"Layer2 filter with IPFW");

	Index: sys/net/if_epair.c
	===================================================================
	--- sys/net/if_epair.c
	+++ sys/net/if_epair.c
	@@ -132,7 +132,8 @@
	return (EINVAL);
	return (netisr_setqlimit(&epair_nh, qlimit));
	}
	-SYSCTL_PROC(_net_link_epair, OID_AUTO, netisr_maxqlen, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_link_epair, OID_AUTO, netisr_maxqlen,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_epair_netisr_maxqlen, "I",
	"Maximum if_epair(4) netisr \"hw\" queue length");

	Index: sys/net/netisr.c
	===================================================================
	--- sys/net/netisr.c
	+++ sys/net/netisr.c
	@@ -152,7 +152,8 @@
	#define NETISR_DISPATCH_POLICY_MAXSTR 20 /* Used for temporary buffers. */
	static u_int netisr_dispatch_policy = NETISR_DISPATCH_POLICY_DEFAULT;
	static int sysctl_netisr_dispatch_policy(SYSCTL_HANDLER_ARGS);
	-SYSCTL_PROC(_net_isr, OID_AUTO, dispatch, CTLTYPE_STRING \| CTLFLAG_RWTUN,
	+SYSCTL_PROC(_net_isr, OID_AUTO, dispatch,
	+ CTLTYPE_STRING \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_netisr_dispatch_policy, "A",
	"netisr dispatch policy");

	Index: sys/net/route.c
	===================================================================
	--- sys/net/route.c
	+++ sys/net/route.c
	@@ -179,8 +179,10 @@
	return (error);
	}

	-SYSCTL_PROC(_net, OID_AUTO, my_fibnum, CTLTYPE_INT\|CTLFLAG_RD,
	- NULL, 0, &sysctl_my_fibnum, "I", "default FIB of caller");
	+SYSCTL_PROC(_net, OID_AUTO, my_fibnum,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_my_fibnum, "I",
	+ "default FIB of caller");

	static __inline struct rib_head **
	rt_tables_get_rnh_ptr(int table, int fam)
	Index: sys/net/rss_config.c
	===================================================================
	--- sys/net/rss_config.c
	+++ sys/net/rss_config.c
	@@ -549,5 +549,6 @@
	return (error);
	}
	SYSCTL_PROC(_net_inet_rss, OID_AUTO, bucket_mapping,
	- CTLTYPE_STRING \| CTLFLAG_RD, NULL, 0,
	- sysctl_rss_bucket_mapping, "", "RSS bucket -> CPU mapping");
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_rss_bucket_mapping, "",
	+ "RSS bucket -> CPU mapping");
	Index: sys/net/rtsock.c
	===================================================================
	--- sys/net/rtsock.c
	+++ sys/net/rtsock.c
	@@ -211,7 +211,8 @@
	return (EINVAL);
	return (netisr_setqlimit(&rtsock_nh, qlimit));
	}
	-SYSCTL_PROC(_net_route, OID_AUTO, netisr_maxqlen, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_route, OID_AUTO, netisr_maxqlen,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_route_netisr_maxqlen, "I",
	"maximum routing socket dispatch queue length");

	Index: sys/net/vnet.h
	===================================================================
	--- sys/net/vnet.h
	+++ sys/net/vnet.h
	@@ -141,7 +141,8 @@
	sizeof(type) / sizeof(uint64_t)); \
	return (SYSCTL_OUT(req, &s, sizeof(type))); \
	} \
	-SYSCTL_PROC(parent, nbr, name, CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_RW, \
	+SYSCTL_PROC(parent, nbr, name, \
	+ CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT, \
	NULL, 0, array ## _sysctl, "I", desc)
	#endif /* SYSCTL_OID */

	Index: sys/net80211/ieee80211_alq.c
	===================================================================
	--- sys/net80211/ieee80211_alq.c
	+++ sys/net80211/ieee80211_alq.c
	@@ -111,8 +111,10 @@
	return (ieee80211_alq_setlogging(enable));
	}

	-SYSCTL_PROC(_net_wlan, OID_AUTO, alq, CTLTYPE_INT\|CTLFLAG_RW,
	- 0, 0, sysctl_ieee80211_alq_log, "I", "Enable net80211 alq logging");
	+SYSCTL_PROC(_net_wlan, OID_AUTO, alq,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_ieee80211_alq_log, "I",
	+ "Enable net80211 alq logging");
	SYSCTL_INT(_net_wlan, OID_AUTO, alq_size, CTLFLAG_RW,
	&ieee80211_alq_qsize, 0, "In-memory log size (bytes)");
	SYSCTL_INT(_net_wlan, OID_AUTO, alq_lost, CTLFLAG_RW,
	Index: sys/net80211/ieee80211_ht.c
	===================================================================
	--- sys/net80211/ieee80211_ht.c
	+++ sys/net80211/ieee80211_ht.c
	@@ -139,22 +139,25 @@
	};

	static int ieee80211_ampdu_age = -1; /* threshold for ampdu reorder q (ms) */
	-SYSCTL_PROC(_net_wlan, OID_AUTO, ampdu_age, CTLTYPE_INT \| CTLFLAG_RW,
	- &ieee80211_ampdu_age, 0, ieee80211_sysctl_msecs_ticks, "I",
	- "AMPDU max reorder age (ms)");
	+SYSCTL_PROC(_net_wlan, OID_AUTO, ampdu_age,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &ieee80211_ampdu_age, 0, ieee80211_sysctl_msecs_ticks, "I",
	+ "AMPDU max reorder age (ms)");

	static int ieee80211_recv_bar_ena = 1;
	SYSCTL_INT(_net_wlan, OID_AUTO, recv_bar, CTLFLAG_RW, &ieee80211_recv_bar_ena,
	0, "BAR frame processing (ena/dis)");

	static int ieee80211_addba_timeout = -1;/* timeout for ADDBA response */
	-SYSCTL_PROC(_net_wlan, OID_AUTO, addba_timeout, CTLTYPE_INT \| CTLFLAG_RW,
	- &ieee80211_addba_timeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	- "ADDBA request timeout (ms)");
	+SYSCTL_PROC(_net_wlan, OID_AUTO, addba_timeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &ieee80211_addba_timeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	+ "ADDBA request timeout (ms)");
	static int ieee80211_addba_backoff = -1;/* backoff after max ADDBA requests */
	-SYSCTL_PROC(_net_wlan, OID_AUTO, addba_backoff, CTLTYPE_INT \| CTLFLAG_RW,
	- &ieee80211_addba_backoff, 0, ieee80211_sysctl_msecs_ticks, "I",
	- "ADDBA request backoff (ms)");
	+SYSCTL_PROC(_net_wlan, OID_AUTO, addba_backoff,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &ieee80211_addba_backoff, 0, ieee80211_sysctl_msecs_ticks, "I",
	+ "ADDBA request backoff (ms)");
	static int ieee80211_addba_maxtries = 3;/* max ADDBA requests before backoff */
	SYSCTL_INT(_net_wlan, OID_AUTO, addba_maxtries, CTLFLAG_RW,
	&ieee80211_addba_maxtries, 0, "max ADDBA requests sent before backoff");
	Index: sys/net80211/ieee80211_hwmp.c
	===================================================================
	--- sys/net80211/ieee80211_hwmp.c
	+++ sys/net80211/ieee80211_hwmp.c
	@@ -160,33 +160,40 @@
	SYSCTL_INT(_net_wlan_hwmp, OID_AUTO, targetonly, CTLFLAG_RW,
	&ieee80211_hwmp_targetonly, 0, "Set TO bit on generated PREQs");
	static int ieee80211_hwmp_pathtimeout = -1;
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, pathlifetime, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, pathlifetime,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_hwmp_pathtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	"path entry lifetime (ms)");
	static int ieee80211_hwmp_maxpreq_retries = -1;
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, maxpreq_retries, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, maxpreq_retries,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_hwmp_maxpreq_retries, 0, ieee80211_sysctl_msecs_ticks, "I",
	"maximum number of preq retries");
	static int ieee80211_hwmp_net_diameter_traversaltime = -1;
	SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, net_diameter_traversal_time,
	- CTLTYPE_INT \| CTLFLAG_RW, &ieee80211_hwmp_net_diameter_traversaltime, 0,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &ieee80211_hwmp_net_diameter_traversaltime, 0,
	ieee80211_sysctl_msecs_ticks, "I",
	"estimate travelse time across the MBSS (ms)");
	static int ieee80211_hwmp_roottimeout = -1;
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, roottimeout, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, roottimeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_hwmp_roottimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	"root PREQ timeout (ms)");
	static int ieee80211_hwmp_rootint = -1;
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rootint, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rootint,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_hwmp_rootint, 0, ieee80211_sysctl_msecs_ticks, "I",
	"root interval (ms)");
	static int ieee80211_hwmp_rannint = -1;
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rannint, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rannint,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_hwmp_rannint, 0, ieee80211_sysctl_msecs_ticks, "I",
	"root announcement interval (ms)");
	static struct timeval ieee80211_hwmp_rootconfint = { 0, 0 };
	static int ieee80211_hwmp_rootconfint_internal = -1;
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rootconfint, CTLTYPE_INT \| CTLFLAG_RD,
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rootconfint,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	&ieee80211_hwmp_rootconfint_internal, 0, ieee80211_sysctl_msecs_ticks, "I",
	"root confirmation interval (ms) (read-only)");

	@@ -205,9 +212,10 @@
	.mpp_newstate = hwmp_newstate,
	.mpp_privlen = sizeof(struct ieee80211_hwmp_route),
	};
	-SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, inact, CTLTYPE_INT \| CTLFLAG_RW,
	- &mesh_proto_hwmp.mpp_inact, 0, ieee80211_sysctl_msecs_ticks, "I",
	- "mesh route inactivity timeout (ms)");
	+SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, inact,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &mesh_proto_hwmp.mpp_inact, 0, ieee80211_sysctl_msecs_ticks, "I",
	+ "mesh route inactivity timeout (ms)");


	static void
	Index: sys/net80211/ieee80211_mesh.c
	===================================================================
	--- sys/net80211/ieee80211_mesh.c
	+++ sys/net80211/ieee80211_mesh.c
	@@ -109,24 +109,29 @@
	static SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
	"IEEE 802.11s parameters");
	static int ieee80211_mesh_gateint = -1;
	-SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, gateint, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, gateint,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_mesh_gateint, 0, ieee80211_sysctl_msecs_ticks, "I",
	"mesh gate interval (ms)");
	static int ieee80211_mesh_retrytimeout = -1;
	-SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	"Retry timeout (msec)");
	static int ieee80211_mesh_holdingtimeout = -1;

	-SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	"Holding state timeout (msec)");
	static int ieee80211_mesh_confirmtimeout = -1;
	-SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	"Confirm state timeout (msec)");
	static int ieee80211_mesh_backofftimeout = -1;
	-SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, backofftimeout, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, backofftimeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&ieee80211_mesh_backofftimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
	"Backoff timeout (msec). This is to throutles peering forever when "
	"not receiving answer or is rejected by a neighbor");
	Index: sys/net80211/ieee80211_superg.c
	===================================================================
	--- sys/net80211/ieee80211_superg.c
	+++ sys/net80211/ieee80211_superg.c
	@@ -92,9 +92,10 @@
	SYSCTL_INT(_net_wlan, OID_AUTO, ffppsmin, CTLFLAG_RW,
	&ieee80211_ffppsmin, 0, "min packet rate before fast-frame staging");
	static int ieee80211_ffagemax = -1; /* max time frames held on stage q */
	-SYSCTL_PROC(_net_wlan, OID_AUTO, ffagemax, CTLTYPE_INT \| CTLFLAG_RW,
	- &ieee80211_ffagemax, 0, ieee80211_sysctl_msecs_ticks, "I",
	- "max hold time for fast-frame staging (ms)");
	+SYSCTL_PROC(_net_wlan, OID_AUTO, ffagemax,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &ieee80211_ffagemax, 0, ieee80211_sysctl_msecs_ticks, "I",
	+ "max hold time for fast-frame staging (ms)");

	static void
	ff_age_all(void *arg, int npending)
	Index: sys/netgraph/bluetooth/common/ng_bluetooth.c
	===================================================================
	--- sys/netgraph/bluetooth/common/ng_bluetooth.c
	+++ sys/netgraph/bluetooth/common/ng_bluetooth.c
	@@ -87,10 +87,10 @@
	} /* bluetooth_set_hci_command_timeout_value */

	SYSCTL_PROC(_net_bluetooth_hci, OID_AUTO, command_timeout,
	- CTLTYPE_INT \| CTLFLAG_RW,
	- &bluetooth_hci_command_timeout_value, 5,
	- bluetooth_set_hci_command_timeout_value,
	- "I", "HCI command timeout (sec)");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &bluetooth_hci_command_timeout_value, 5,
	+ bluetooth_set_hci_command_timeout_value, "I",
	+ "HCI command timeout (sec)");

	static int
	bluetooth_set_hci_connect_timeout_value(SYSCTL_HANDLER_ARGS)
	@@ -111,10 +111,10 @@
	} /* bluetooth_set_hci_connect_timeout_value */

	SYSCTL_PROC(_net_bluetooth_hci, OID_AUTO, connection_timeout,
	- CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&bluetooth_hci_connect_timeout_value, 60,
	- bluetooth_set_hci_connect_timeout_value,
	- "I", "HCI connect timeout (sec)");
	+ bluetooth_set_hci_connect_timeout_value, "I",
	+ "HCI connect timeout (sec)");

	SYSCTL_UINT(_net_bluetooth_hci, OID_AUTO, max_neighbor_age, CTLFLAG_RW,
	&bluetooth_hci_max_neighbor_age_value, 600,
	@@ -147,10 +147,10 @@
	} /* bluetooth_set_l2cap_rtx_timeout_value */

	SYSCTL_PROC(_net_bluetooth_l2cap, OID_AUTO, rtx_timeout,
	- CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&bluetooth_l2cap_rtx_timeout_value, 60,
	- bluetooth_set_l2cap_rtx_timeout_value,
	- "I", "L2CAP RTX timeout (sec)");
	+ bluetooth_set_l2cap_rtx_timeout_value, "I",
	+ "L2CAP RTX timeout (sec)");

	static int
	bluetooth_set_l2cap_ertx_timeout_value(SYSCTL_HANDLER_ARGS)
	@@ -171,10 +171,10 @@
	} /* bluetooth_set_l2cap_ertx_timeout_value */

	SYSCTL_PROC(_net_bluetooth_l2cap, OID_AUTO, ertx_timeout,
	- CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&bluetooth_l2cap_ertx_timeout_value, 300,
	- bluetooth_set_l2cap_ertx_timeout_value,
	- "I", "L2CAP ERTX timeout (sec)");
	+ bluetooth_set_l2cap_ertx_timeout_value, "I",
	+ "L2CAP ERTX timeout (sec)");

	/*
	* Return various sysctl values
	@@ -249,10 +249,10 @@
	} /* bluetooth_set_sco_rtx_timeout_value */

	SYSCTL_PROC(_net_bluetooth_sco, OID_AUTO, rtx_timeout,
	- CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&bluetooth_sco_rtx_timeout_value, 60,
	- bluetooth_set_sco_rtx_timeout_value,
	- "I", "SCO RTX timeout (sec)");
	+ bluetooth_set_sco_rtx_timeout_value, "I",
	+ "SCO RTX timeout (sec)");

	/*
	* Handle loading and unloading for this code.
	Index: sys/netgraph/ng_base.c
	===================================================================
	--- sys/netgraph/ng_base.c
	+++ sys/netgraph/ng_base.c
	@@ -3383,8 +3383,10 @@
	return (0);
	}

	-SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items, CTLTYPE_INT \| CTLFLAG_RW,
	- 0, sizeof(int), sysctl_debug_ng_dump_items, "I", "Number of allocated items");
	+SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, sizeof(int), sysctl_debug_ng_dump_items, "I",
	+ "Number of allocated items");
	#endif /* NETGRAPH_DEBUG */

	/***********************************************************************
	Index: sys/netinet/cc/cc.c
	===================================================================
	--- sys/netinet/cc/cc.c
	+++ sys/netinet/cc/cc.c
	@@ -321,10 +321,12 @@
	"Congestion control related settings");

	SYSCTL_PROC(_net_inet_tcp_cc, OID_AUTO, algorithm,
	- CTLFLAG_VNET \| CTLTYPE_STRING \| CTLFLAG_RW,
	- NULL, 0, cc_default_algo, "A", "Default congestion control algorithm");
	+ CTLFLAG_VNET \| CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, cc_default_algo, "A",
	+ "Default congestion control algorithm");

	-SYSCTL_PROC(_net_inet_tcp_cc, OID_AUTO, available, CTLTYPE_STRING\|CTLFLAG_RD,
	+SYSCTL_PROC(_net_inet_tcp_cc, OID_AUTO, available,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	NULL, 0, cc_list_available, "A",
	"List available congestion control algorithms");

	Index: sys/netinet/cc/cc_cdg.c
	===================================================================
	--- sys/netinet/cc/cc_cdg.c
	+++ sys/netinet/cc/cc_cdg.c
	@@ -683,19 +683,19 @@
	"alpha_inc RTTs during congestion avoidance mode.");

	SYSCTL_PROC(_net_inet_tcp_cc_cdg, OID_AUTO, beta_delay,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, &VNET_NAME(cdg_beta_delay), 70,
	- &cdg_beta_handler, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(cdg_beta_delay), 70, &cdg_beta_handler, "IU",
	"Delay-based window decrease factor as a percentage "
	"(on delay-based backoff, w = w * beta_delay / 100)");

	SYSCTL_PROC(_net_inet_tcp_cc_cdg, OID_AUTO, beta_loss,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, &VNET_NAME(cdg_beta_loss), 50,
	- &cdg_beta_handler, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(cdg_beta_loss), 50, &cdg_beta_handler, "IU",
	"Loss-based window decrease factor as a percentage "
	"(on loss-based backoff, w = w * beta_loss / 100)");

	SYSCTL_PROC(_net_inet_tcp_cc_cdg, OID_AUTO, exp_backoff_scale,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(cdg_exp_backoff_scale), 2, &cdg_exp_backoff_scale_handler, "IU",
	"Scaling parameter for the probabilistic exponential backoff");

	Index: sys/netinet/cc/cc_chd.c
	===================================================================
	--- sys/netinet/cc/cc_chd.c
	+++ sys/netinet/cc/cc_chd.c
	@@ -469,19 +469,19 @@
	"CAIA Hamilton delay-based congestion control related settings");

	SYSCTL_PROC(_net_inet_tcp_cc_chd, OID_AUTO, loss_fair,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- &VNET_NAME(chd_loss_fair), 1, &chd_loss_fair_handler,
	- "IU", "Flag to enable shadow window functionality.");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(chd_loss_fair), 1, &chd_loss_fair_handler, "IU",
	+ "Flag to enable shadow window functionality.");

	SYSCTL_PROC(_net_inet_tcp_cc_chd, OID_AUTO, pmax,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- &VNET_NAME(chd_pmax), 5, &chd_pmax_handler,
	- "IU", "Per RTT maximum backoff probability as a percentage");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(chd_pmax), 5, &chd_pmax_handler, "IU",
	+ "Per RTT maximum backoff probability as a percentage");

	SYSCTL_PROC(_net_inet_tcp_cc_chd, OID_AUTO, queue_threshold,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- &VNET_NAME(chd_qthresh), 20, &chd_qthresh_handler,
	- "IU", "Queueing congestion threshold in ticks");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(chd_qthresh), 20, &chd_qthresh_handler, "IU",
	+ "Queueing congestion threshold in ticks");

	SYSCTL_UINT(_net_inet_tcp_cc_chd, OID_AUTO, queue_min,
	CTLFLAG_VNET \| CTLFLAG_RW, &VNET_NAME(chd_qmin), 5,
	Index: sys/netinet/cc/cc_dctcp.c
	===================================================================
	--- sys/netinet/cc/cc_dctcp.c
	+++ sys/netinet/cc/cc_dctcp.c
	@@ -451,18 +451,18 @@
	"dctcp congestion control related settings");

	SYSCTL_PROC(_net_inet_tcp_cc_dctcp, OID_AUTO, alpha,
	- CTLFLAG_VNET\|CTLTYPE_UINT\|CTLFLAG_RW, &VNET_NAME(dctcp_alpha), 0,
	- &dctcp_alpha_handler,
	- "IU", "dctcp alpha parameter at start of session");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(dctcp_alpha), 0, &dctcp_alpha_handler, "IU",
	+ "dctcp alpha parameter at start of session");

	SYSCTL_PROC(_net_inet_tcp_cc_dctcp, OID_AUTO, shift_g,
	- CTLFLAG_VNET\|CTLTYPE_UINT\|CTLFLAG_RW, &VNET_NAME(dctcp_shift_g), 4,
	- &dctcp_shift_g_handler,
	- "IU", "dctcp shift parameter");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(dctcp_shift_g), 4, &dctcp_shift_g_handler, "IU",
	+ "dctcp shift parameter");

	SYSCTL_PROC(_net_inet_tcp_cc_dctcp, OID_AUTO, slowstart,
	- CTLFLAG_VNET\|CTLTYPE_UINT\|CTLFLAG_RW, &VNET_NAME(dctcp_slowstart), 0,
	- &dctcp_slowstart_handler,
	- "IU", "half CWND reduction after the first slow start");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(dctcp_slowstart), 0, &dctcp_slowstart_handler, "IU",
	+ "half CWND reduction after the first slow start");

	DECLARE_CC_MODULE(dctcp, &dctcp_cc_algo);
	Index: sys/netinet/cc/cc_hd.c
	===================================================================
	--- sys/netinet/cc/cc_hd.c
	+++ sys/netinet/cc/cc_hd.c
	@@ -236,17 +236,19 @@
	"Hamilton delay-based congestion control related settings");

	SYSCTL_PROC(_net_inet_tcp_cc_hd, OID_AUTO, queue_threshold,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, &VNET_NAME(hd_qthresh), 20,
	- &hd_qthresh_handler, "IU", "queueing congestion threshold (qth) in ticks");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(hd_qthresh), 20, &hd_qthresh_handler, "IU",
	+ "queueing congestion threshold (qth) in ticks");

	SYSCTL_PROC(_net_inet_tcp_cc_hd, OID_AUTO, pmax,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, &VNET_NAME(hd_pmax), 5,
	- &hd_pmax_handler, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(hd_pmax), 5, &hd_pmax_handler, "IU",
	"per packet maximum backoff probability as a percentage");

	SYSCTL_PROC(_net_inet_tcp_cc_hd, OID_AUTO, queue_min,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, &VNET_NAME(hd_qmin), 5,
	- &hd_qmin_handler, "IU", "minimum queueing delay threshold (qmin) in ticks");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(hd_qmin), 5, &hd_qmin_handler, "IU",
	+ "minimum queueing delay threshold (qmin) in ticks");

	DECLARE_CC_MODULE(hd, &hd_cc_algo);
	MODULE_DEPEND(hd, ertt, 1, 1, 1);
	Index: sys/netinet/cc/cc_newreno.c
	===================================================================
	--- sys/netinet/cc/cc_newreno.c
	+++ sys/netinet/cc/cc_newreno.c
	@@ -385,13 +385,13 @@
	"New Reno related settings");

	SYSCTL_PROC(_net_inet_tcp_cc_newreno, OID_AUTO, beta,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- &VNET_NAME(newreno_beta), 3, &newreno_beta_handler, "IU",
	- "New Reno beta, specified as number between 1 and 100");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(newreno_beta), 3, &newreno_beta_handler, "IU",
	+ "New Reno beta, specified as number between 1 and 100");

	SYSCTL_PROC(_net_inet_tcp_cc_newreno, OID_AUTO, beta_ecn,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- &VNET_NAME(newreno_beta_ecn), 3, &newreno_beta_handler, "IU",
	- "New Reno beta ecn, specified as number between 1 and 100");
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(newreno_beta_ecn), 3, &newreno_beta_handler, "IU",
	+ "New Reno beta ecn, specified as number between 1 and 100");

	DECLARE_CC_MODULE(newreno, &newreno_cc_algo);
	Index: sys/netinet/cc/cc_vegas.c
	===================================================================
	--- sys/netinet/cc/cc_vegas.c
	+++ sys/netinet/cc/cc_vegas.c
	@@ -290,12 +290,12 @@
	"Vegas related settings");

	SYSCTL_PROC(_net_inet_tcp_cc_vegas, OID_AUTO, alpha,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(vegas_alpha), 1, &vegas_alpha_handler, "IU",
	"vegas alpha, specified as number of \"buffers\" (0 < alpha < beta)");

	SYSCTL_PROC(_net_inet_tcp_cc_vegas, OID_AUTO, beta,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(vegas_beta), 3, &vegas_beta_handler, "IU",
	"vegas beta, specified as number of \"buffers\" (0 < alpha < beta)");

	Index: sys/netinet/in_pcb.c
	===================================================================
	--- sys/netinet/in_pcb.c
	+++ sys/netinet/in_pcb.c
	@@ -176,23 +176,29 @@
	"IP Ports");

	SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	- &VNET_NAME(ipport_lowfirstauto), 0, &sysctl_net_ipport_check, "I", "");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(ipport_lowfirstauto), 0, &sysctl_net_ipport_check, "I",
	+ "");
	SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	- &VNET_NAME(ipport_lowlastauto), 0, &sysctl_net_ipport_check, "I", "");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(ipport_lowlastauto), 0, &sysctl_net_ipport_check, "I",
	+ "");
	SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	- &VNET_NAME(ipport_firstauto), 0, &sysctl_net_ipport_check, "I", "");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(ipport_firstauto), 0, &sysctl_net_ipport_check, "I",
	+ "");
	SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	- &VNET_NAME(ipport_lastauto), 0, &sysctl_net_ipport_check, "I", "");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(ipport_lastauto), 0, &sysctl_net_ipport_check, "I",
	+ "");
	SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	- &VNET_NAME(ipport_hifirstauto), 0, &sysctl_net_ipport_check, "I", "");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(ipport_hifirstauto), 0, &sysctl_net_ipport_check, "I",
	+ "");
	SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	- &VNET_NAME(ipport_hilastauto), 0, &sysctl_net_ipport_check, "I", "");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(ipport_hilastauto), 0, &sysctl_net_ipport_check, "I",
	+ "");
	SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh,
	CTLFLAG_VNET \| CTLFLAG_RW \| CTLFLAG_SECURE,
	&VNET_NAME(ipport_reservedhigh), 0, "");
	Index: sys/netinet/ip_carp.c
	===================================================================
	--- sys/netinet/ip_carp.c
	+++ sys/netinet/ip_carp.c
	@@ -220,17 +220,19 @@

	SYSCTL_NODE(_net_inet, IPPROTO_CARP, carp, CTLFLAG_RW, 0, "CARP");
	SYSCTL_PROC(_net_inet_carp, OID_AUTO, allow,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW, 0, 0, carp_allow_sysctl, "I",
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, carp_allow_sysctl, "I",
	"Accept incoming CARP packets");
	SYSCTL_PROC(_net_inet_carp, OID_AUTO, dscp,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW, 0, 0, carp_dscp_sysctl, "I",
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, carp_dscp_sysctl, "I",
	"DSCP value for carp packets");
	SYSCTL_INT(_net_inet_carp, OID_AUTO, preempt, CTLFLAG_VNET \| CTLFLAG_RW,
	&VNET_NAME(carp_preempt), 0, "High-priority backup preemption mode");
	SYSCTL_INT(_net_inet_carp, OID_AUTO, log, CTLFLAG_VNET \| CTLFLAG_RW,
	&VNET_NAME(carp_log), 0, "CARP log level");
	SYSCTL_PROC(_net_inet_carp, OID_AUTO, demotion,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, carp_demote_adj_sysctl, "I",
	"Adjust demotion factor (skew of advskew)");
	SYSCTL_INT(_net_inet_carp, OID_AUTO, senderr_demotion_factor,
	Index: sys/netinet/ip_divert.c
	===================================================================
	--- sys/netinet/ip_divert.c
	+++ sys/netinet/ip_divert.c
	@@ -694,8 +694,10 @@
	#ifdef SYSCTL_NODE
	static SYSCTL_NODE(_net_inet, IPPROTO_DIVERT, divert, CTLFLAG_RW, 0,
	"IPDIVERT");
	-SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	- NULL, 0, div_pcblist, "S,xinpcb", "List of active divert sockets");
	+SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, div_pcblist, "S,xinpcb",
	+ "List of active divert sockets");
	#endif

	struct pr_usrreqs div_usrreqs = {
	Index: sys/netinet/ip_id.c
	===================================================================
	--- sys/netinet/ip_id.c
	+++ sys/netinet/ip_id.c
	@@ -137,14 +137,14 @@

	SYSCTL_DECL(_net_inet_ip);
	SYSCTL_PROC(_net_inet_ip, OID_AUTO, random_id,
	- CTLTYPE_INT \| CTLFLAG_VNET \| CTLFLAG_RW,
	+ CTLTYPE_INT \| CTLFLAG_VNET \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(ip_do_randomid), 0, sysctl_ip_randomid, "IU",
	"Assign random ip_id values");
	SYSCTL_INT(_net_inet_ip, OID_AUTO, rfc6864, CTLFLAG_VNET \| CTLFLAG_RW,
	&VNET_NAME(ip_rfc6864), 0,
	"Use constant IP ID for atomic datagrams");
	SYSCTL_PROC(_net_inet_ip, OID_AUTO, random_id_period,
	- CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_VNET,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_VNET \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(array_size), 0, sysctl_ip_id_change, "IU", "IP ID Array size");
	SYSCTL_INT(_net_inet_ip, OID_AUTO, random_id_collisions,
	CTLFLAG_RD \| CTLFLAG_VNET,
	Index: sys/netinet/ip_input.c
	===================================================================
	--- sys/netinet/ip_input.c
	+++ sys/netinet/ip_input.c
	@@ -230,7 +230,8 @@
	return (netisr_setqlimit(&ip_nh, qlimit));
	}
	SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen,
	- CTLTYPE_INT\|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_queue_maxlen, "I",
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_netinet_intr_queue_maxlen, "I",
	"Maximum size of the IP input queue");

	static int
	@@ -251,7 +252,8 @@
	}

	SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops,
	- CTLTYPE_INT\|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_queue_drops, "I",
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_netinet_intr_queue_drops, "I",
	"Number of packets dropped from the IP input queue");

	#ifdef RSS
	@@ -269,8 +271,9 @@
	return (netisr_setqlimit(&ip_direct_nh, qlimit));
	}
	SYSCTL_PROC(_net_inet_ip, IPCTL_INTRDQMAXLEN, intr_direct_queue_maxlen,
	- CTLTYPE_INT\|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_direct_queue_maxlen,
	- "I", "Maximum size of the IP direct input queue");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_netinet_intr_direct_queue_maxlen, "I",
	+ "Maximum size of the IP direct input queue");

	static int
	sysctl_netinet_intr_direct_queue_drops(SYSCTL_HANDLER_ARGS)
	@@ -290,7 +293,8 @@
	}

	SYSCTL_PROC(_net_inet_ip, IPCTL_INTRDQDROPS, intr_direct_queue_drops,
	- CTLTYPE_INT\|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_direct_queue_drops, "I",
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_netinet_intr_direct_queue_drops, "I",
	"Number of packets dropped from the IP direct input queue");
	#endif /* RSS */

	Index: sys/netinet/ip_reass.c
	===================================================================
	--- sys/netinet/ip_reass.c
	+++ sys/netinet/ip_reass.c
	@@ -147,8 +147,9 @@

	VNET_DEFINE_STATIC(uma_zone_t, ipq_zone);
	#define V_ipq_zone VNET(ipq_zone)
	-SYSCTL_PROC(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_VNET \|
	- CTLTYPE_INT \| CTLFLAG_RW, NULL, 0, sysctl_maxfragpackets, "I",
	+SYSCTL_PROC(_net_inet_ip, OID_AUTO, maxfragpackets,
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_maxfragpackets, "I",
	"Maximum number of IPv4 fragment reassembly queue entries");
	SYSCTL_UMA_CUR(_net_inet_ip, OID_AUTO, fragpackets, CTLFLAG_VNET,
	&VNET_NAME(ipq_zone),
	Index: sys/netinet/libalias/alias_sctp.c
	===================================================================
	--- sys/netinet/libalias/alias_sctp.c
	+++ sys/netinet/libalias/alias_sctp.c
	@@ -369,42 +369,67 @@

	static SYSCTL_NODE(_net_inet_ip_alias, OID_AUTO, sctp, CTLFLAG_RW, NULL,
	"SCTP NAT");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, log_level, CTLTYPE_UINT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, log_level,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_log_level, 0, sysctl_chg_loglevel, "IU",
	- "Level of detail (0 - default, 1 - event, 2 - info, 3 - detail, 4 - debug, 5 - max debug)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, init_timer, CTLTYPE_UINT \| CTLFLAG_RW,
	+ "Level of detail (0 - default, 1 - event, 2 - info, 3 - detail, 4 - debug, "
	+ "5 - max debug)");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, init_timer,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_init_timer, 0, sysctl_chg_timer, "IU",
	"Timeout value (s) while waiting for (INIT-ACK\|AddIP-ACK)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, up_timer, CTLTYPE_UINT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, up_timer,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_up_timer, 0, sysctl_chg_timer, "IU",
	"Timeout value (s) to keep an association up with no traffic");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, shutdown_timer, CTLTYPE_UINT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, shutdown_timer,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_shutdown_timer, 0, sysctl_chg_timer, "IU",
	"Timeout value (s) while waiting for SHUTDOWN-COMPLETE");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, holddown_timer, CTLTYPE_UINT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, holddown_timer,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_holddown_timer, 0, sysctl_chg_timer, "IU",
	- "Hold association in table for this many seconds after receiving a SHUTDOWN-COMPLETE");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, hashtable_size, CTLTYPE_UINT \| CTLFLAG_RW,
	+ "Hold association in table for this many seconds after receiving a "
	+ "SHUTDOWN-COMPLETE");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, hashtable_size,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_hashtable_size, 0, sysctl_chg_hashtable_size, "IU",
	"Size of hash tables used for NAT lookups (100 < prime_number > 1000001)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, error_on_ootb, CTLTYPE_UINT \| CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, error_on_ootb,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_error_on_ootb, 0, sysctl_chg_error_on_ootb, "IU",
	- "ErrorM sent on receipt of ootb packet:\n\t0 - none,\n\t1 - to local only,\n\t2 - to local and global if a partial association match,\n\t3 - to local and global (DoS risk)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, accept_global_ootb_addip, CTLTYPE_UINT \| CTLFLAG_RW,
	- &sysctl_accept_global_ootb_addip, 0, sysctl_chg_accept_global_ootb_addip, "IU",
	- "NAT response to receipt of global OOTB AddIP:\n\t0 - No response,\n\t1 - NAT will accept OOTB global AddIP messages for processing (Security risk)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, initialising_chunk_proc_limit, CTLTYPE_UINT \| CTLFLAG_RW,
	- &sysctl_initialising_chunk_proc_limit, 0, sysctl_chg_initialising_chunk_proc_limit, "IU",
	- "Number of chunks that should be processed if there is no current association found:\n\t > 0 (A high value is a DoS risk)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, chunk_proc_limit, CTLTYPE_UINT \| CTLFLAG_RW,
	+ "ErrorM sent on receipt of ootb packet:\n\t0 - none,\n\t1 - to local only,"
	+ "\n\t2 - to local and global if a partial association match,\n\t3 - to "
	+ "local and global (DoS risk)");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, accept_global_ootb_addip,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &sysctl_accept_global_ootb_addip, 0, sysctl_chg_accept_global_ootb_addip,
	+ "IU",
	+ "NAT response to receipt of global OOTB AddIP:\n\t0 - No response,\n\t"
	+ "1 - NAT will accept OOTB global AddIP messages for processing (Security "
	+ "risk)");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, initialising_chunk_proc_limit,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &sysctl_initialising_chunk_proc_limit, 0,
	+ sysctl_chg_initialising_chunk_proc_limit, "IU",
	+ "Number of chunks that should be processed if there is no current "
	+ "association found:\n\t > 0 (A high value is a DoS risk)");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, chunk_proc_limit,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_chunk_proc_limit, 0, sysctl_chg_chunk_proc_limit, "IU",
	- "Number of chunks that should be processed to find key chunk:\n\t>= initialising_chunk_proc_limit (A high value is a DoS risk)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, param_proc_limit, CTLTYPE_UINT \| CTLFLAG_RW,
	+ "Number of chunks that should be processed to find key chunk:\n\t"
	+ ">= initialising_chunk_proc_limit (A high value is a DoS risk)");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, param_proc_limit,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_param_proc_limit, 0, sysctl_chg_param_proc_limit, "IU",
	- "Number of parameters (in a chunk) that should be processed to find key parameters:\n\t> 1 (A high value is a DoS risk)");
	-SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, track_global_addresses, CTLTYPE_UINT \| CTLFLAG_RW,
	+ "Number of parameters (in a chunk) that should be processed to find key "
	+ "parameters:\n\t> 1 (A high value is a DoS risk)");
	+SYSCTL_PROC(_net_inet_ip_alias_sctp, OID_AUTO, track_global_addresses,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&sysctl_track_global_addresses, 0, sysctl_chg_track_global_addresses, "IU",
	- "Configures the global address tracking option within the NAT:\n\t0 - Global tracking is disabled,\n\t> 0 - enables tracking but limits the number of global IP addresses to this value");
	+ "Configures the global address tracking option within the NAT:\n\t"
	+ "0 - Global tracking is disabled,\n\t> 0 - enables tracking but limits "
	+ "the number of global IP addresses to this value");

	#endif /* SYSCTL_NODE */

	Index: sys/netinet/netdump/netdump_client.c
	===================================================================
	--- sys/netinet/netdump/netdump_client.c
	+++ sys/netinet/netdump/netdump_client.c
	@@ -138,8 +138,10 @@
	SYSCTL_INT(_net_netdump, OID_AUTO, debug, CTLFLAG_RWTUN,
	&nd_debug, 0,
	"Debug message verbosity");
	-SYSCTL_PROC(_net_netdump, OID_AUTO, enabled, CTLFLAG_RD \| CTLTYPE_INT, NULL, 0,
	- netdump_enabled_sysctl, "I", "netdump configuration status");
	+SYSCTL_PROC(_net_netdump, OID_AUTO, enabled,
	+ CTLFLAG_RD \| CTLTYPE_INT \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, netdump_enabled_sysctl, "I",
	+ "netdump configuration status");
	static char nd_path[MAXPATHLEN];
	SYSCTL_STRING(_net_netdump, OID_AUTO, path, CTLFLAG_RW,
	nd_path, sizeof(nd_path),
	Index: sys/netinet/raw_ip.c
	===================================================================
	--- sys/netinet/raw_ip.c
	+++ sys/netinet/raw_ip.c
	@@ -1132,8 +1132,9 @@
	}

	SYSCTL_PROC(_net_inet_raw, OID_AUTO/XXX/, pcblist,
	- CTLTYPE_OPAQUE \| CTLFLAG_RD, NULL, 0,
	- rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, rip_pcblist, "S,xinpcb",
	+ "List of active raw IP sockets");

	#ifdef INET
	struct pr_usrreqs rip_usrreqs = {
	Index: sys/netinet/sctp_sysctl.c
	===================================================================
	--- sys/netinet/sctp_sysctl.c
	+++ sys/netinet/sctp_sysctl.c
	@@ -861,8 +861,9 @@
	return (error); \
	} \
	SYSCTL_PROC(_net_inet_sctp, OID_AUTO, mib_name, \
	- CTLFLAG_VNET\|CTLTYPE_UINT\|CTLFLAG_RW, NULL, 0, \
	- sctp_sysctl_handle_##mib_name, "UI", prefix##_DESC);
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT, \
	+ NULL, 0, sctp_sysctl_handle_##mib_name, "UI", \
	+ prefix##_DESC);

	/*
	* sysctl definitions
	@@ -873,10 +874,14 @@
	SCTP_UINT_SYSCTL(auto_asconf, sctp_auto_asconf, SCTPCTL_AUTOASCONF)
	SCTP_UINT_SYSCTL(ecn_enable, sctp_ecn_enable, SCTPCTL_ECN_ENABLE)
	SCTP_UINT_SYSCTL(pr_enable, sctp_pr_enable, SCTPCTL_PR_ENABLE)
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, auth_enable, CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- NULL, 0, sctp_sysctl_handle_auth, "IU", SCTPCTL_AUTH_ENABLE_DESC);
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, asconf_enable, CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- NULL, 0, sctp_sysctl_handle_asconf, "IU", SCTPCTL_ASCONF_ENABLE_DESC);
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, auth_enable,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_auth, "IU",
	+ SCTPCTL_AUTH_ENABLE_DESC);
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, asconf_enable,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_asconf, "IU",
	+ SCTPCTL_ASCONF_ENABLE_DESC);
	SCTP_UINT_SYSCTL(reconfig_enable, sctp_reconfig_enable, SCTPCTL_RECONFIG_ENABLE)
	SCTP_UINT_SYSCTL(nrsack_enable, sctp_nrsack_enable, SCTPCTL_NRSACK_ENABLE)
	SCTP_UINT_SYSCTL(pktdrop_enable, sctp_pktdrop_enable, SCTPCTL_PKTDROP_ENABLE)
	@@ -926,13 +931,19 @@
	SCTP_UINT_SYSCTL(mobility_base, sctp_mobility_base, SCTPCTL_MOBILITY_BASE)
	SCTP_UINT_SYSCTL(mobility_fasthandoff, sctp_mobility_fasthandoff, SCTPCTL_MOBILITY_FASTHANDOFF)
	#if defined(SCTP_LOCAL_TRACE_BUF)
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, log, CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_RD,
	- NULL, 0, sctp_sysctl_handle_trace_log, "S,sctplog", "SCTP logging (struct sctp_log)");
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, clear_trace, CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- NULL, 0, sctp_sysctl_handle_trace_log_clear, "IU", "Clear SCTP Logging buffer");
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, log,
	+ CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_trace_log, "S,sctplog",
	+ "SCTP logging (struct sctp_log)");
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, clear_trace,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_trace_log_clear, "IU",
	+ "Clear SCTP Logging buffer");
	#endif
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, udp_tunneling_port, CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	- NULL, 0, sctp_sysctl_handle_udp_tunneling, "IU", SCTPCTL_UDP_TUNNELING_PORT_DESC);
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, udp_tunneling_port,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_udp_tunneling, "IU",
	+ SCTPCTL_UDP_TUNNELING_PORT_DESC);
	SCTP_UINT_SYSCTL(enable_sack_immediately, sctp_enable_sack_immediately, SCTPCTL_SACK_IMMEDIATELY_ENABLE)
	SCTP_UINT_SYSCTL(nat_friendly_init, sctp_inits_include_nat_friendly, SCTPCTL_NAT_FRIENDLY_INITS)
	SCTP_UINT_SYSCTL(vtag_time_wait, sctp_vtag_time_wait, SCTPCTL_TIME_WAIT)
	@@ -952,7 +963,11 @@
	#if defined(__APPLE__) \|\| defined(SCTP_SO_LOCK_TESTING)
	SCTP_UINT_SYSCTL(output_unlocked, sctp_output_unlocked, SCTPCTL_OUTPUT_UNLOCKED)
	#endif
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, stats, CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_RW,
	- NULL, 0, sctp_sysctl_handle_stats, "S,sctpstat", "SCTP statistics (struct sctp_stat)");
	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, assoclist, CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_RD,
	- NULL, 0, sctp_sysctl_handle_assoclist, "S,xassoc", "List of active SCTP associations");
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, stats,
	+ CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_stats, "S,sctpstat",
	+ "SCTP statistics (struct sctp_stat)");
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, assoclist,
	+ CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sctp_sysctl_handle_assoclist, "S,xassoc",
	+ "List of active SCTP associations");
	Index: sys/netinet/sctp_usrreq.c
	===================================================================
	--- sys/netinet/sctp_usrreq.c
	+++ sys/netinet/sctp_usrreq.c
	@@ -421,8 +421,10 @@
	return (error);
	}

	-SYSCTL_PROC(_net_inet_sctp, OID_AUTO, getcred, CTLTYPE_OPAQUE \| CTLFLAG_RW,
	- 0, 0, sctp_getcred, "S,ucred", "Get the ucred of a SCTP connection");
	+SYSCTL_PROC(_net_inet_sctp, OID_AUTO, getcred,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sctp_getcred, "S,ucred",
	+ "Get the ucred of a SCTP connection");


	#ifdef INET
	Index: sys/netinet/siftr.c
	===================================================================
	--- sys/netinet/siftr.c
	+++ sys/netinet/siftr.c
	@@ -303,13 +303,16 @@
	SYSCTL_NODE(_net_inet, OID_AUTO, siftr, CTLFLAG_RW, NULL,
	"siftr related settings");

	-SYSCTL_PROC(_net_inet_siftr, OID_AUTO, enabled, CTLTYPE_UINT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_siftr, OID_AUTO, enabled,
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&siftr_enabled, 0, &siftr_sysctl_enabled_handler, "IU",
	"switch siftr module operations on/off");

	-SYSCTL_PROC(_net_inet_siftr, OID_AUTO, logfile, CTLTYPE_STRING\|CTLFLAG_RW,
	- &siftr_logfile_shadow, sizeof(siftr_logfile_shadow), &siftr_sysctl_logfile_name_handler,
	- "A", "file to save siftr log messages to");
	+SYSCTL_PROC(_net_inet_siftr, OID_AUTO, logfile,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &siftr_logfile_shadow, sizeof(siftr_logfile_shadow),
	+ &siftr_sysctl_logfile_name_handler, "A",
	+ "file to save siftr log messages to");

	SYSCTL_UINT(_net_inet_siftr, OID_AUTO, ppl, CTLFLAG_RW,
	&siftr_pkts_per_log, 1,
	Index: sys/netinet/tcp_fastopen.c
	===================================================================
	--- sys/netinet/tcp_fastopen.c
	+++ sys/netinet/tcp_fastopen.c
	@@ -267,14 +267,14 @@
	#define V_tcp_fastopen_autokey VNET(tcp_fastopen_autokey)
	static int sysctl_net_inet_tcp_fastopen_autokey(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, autokey,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_autokey, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_autokey, "IU",
	"Number of seconds between auto-generation of a new key; zero disables");

	static int sysctl_net_inet_tcp_fastopen_ccache_bucket_limit(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, ccache_bucket_limit,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RWTUN, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_ccache_bucket_limit, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RWTUN \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_ccache_bucket_limit, "IU",
	"Max entries per bucket in client cookie cache");

	VNET_DEFINE_STATIC(unsigned int, tcp_fastopen_ccache_buckets) =
	@@ -287,8 +287,8 @@
	VNET_DEFINE(unsigned int, tcp_fastopen_client_enable) = 1;
	static int sysctl_net_inet_tcp_fastopen_client_enable(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, client_enable,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_client_enable, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_client_enable, "IU",
	"Enable/disable TCP Fast Open client functionality");

	SYSCTL_INT(_net_inet_tcp_fastopen, OID_AUTO, keylen,
	@@ -326,33 +326,33 @@
	#define V_tcp_fastopen_psk_enable VNET(tcp_fastopen_psk_enable)
	static int sysctl_net_inet_tcp_fastopen_psk_enable(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, psk_enable,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_psk_enable, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_psk_enable, "IU",
	"Enable/disable TCP Fast Open server pre-shared key mode");

	VNET_DEFINE(unsigned int, tcp_fastopen_server_enable) = 0;
	static int sysctl_net_inet_tcp_fastopen_server_enable(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, server_enable,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_server_enable, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_server_enable, "IU",
	"Enable/disable TCP Fast Open server functionality");

	static int sysctl_net_inet_tcp_fastopen_setkey(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, setkey,
	- CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_WR, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_setkey, "",
	+ CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_WR \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_setkey, "",
	"Install a new key");

	static int sysctl_net_inet_tcp_fastopen_setpsk(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, setpsk,
	- CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_WR, NULL, 0,
	- &sysctl_net_inet_tcp_fastopen_setpsk, "",
	+ CTLFLAG_VNET \| CTLTYPE_OPAQUE \| CTLFLAG_WR \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, &sysctl_net_inet_tcp_fastopen_setpsk, "",
	"Install a new pre-shared key");

	static int sysctl_net_inet_tcp_fastopen_ccache_list(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_net_inet_tcp_fastopen, OID_AUTO, ccache_list,
	- CTLFLAG_VNET \| CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_SKIP, NULL, 0,
	- sysctl_net_inet_tcp_fastopen_ccache_list, "A",
	+ CTLFLAG_VNET \| CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_net_inet_tcp_fastopen_ccache_list, "A",
	"List of all client cookie cache entries");

	VNET_DEFINE_STATIC(struct rmlock, tcp_fastopen_keylock);
	Index: sys/netinet/tcp_hostcache.c
	===================================================================
	--- sys/netinet/tcp_hostcache.c
	+++ sys/netinet/tcp_hostcache.c
	@@ -163,12 +163,14 @@
	"Expire all entires on next purge run");

	SYSCTL_PROC(_net_inet_tcp_hostcache, OID_AUTO, list,
	- CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_SKIP, 0, 0,
	- sysctl_tcp_hc_list, "A", "List of all hostcache entries");
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_tcp_hc_list, "A",
	+ "List of all hostcache entries");

	SYSCTL_PROC(_net_inet_tcp_hostcache, OID_AUTO, purgenow,
	- CTLTYPE_INT \| CTLFLAG_RW, NULL, 0,
	- sysctl_tcp_hc_purgenow, "I", "Immediately purge all entries");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_tcp_hc_purgenow, "I",
	+ "Immediately purge all entries");

	static MALLOC_DEFINE(M_HOSTCACHE, "hostcache", "TCP hostcache");

	Index: sys/netinet/tcp_hpts.c
	===================================================================
	--- sys/netinet/tcp_hpts.c
	+++ sys/netinet/tcp_hpts.c
	@@ -293,9 +293,8 @@
	}

	SYSCTL_PROC(_net_inet_tcp_hpts, OID_AUTO, maxsleep,
	- CTLTYPE_UINT \| CTLFLAG_RW,
	- &hpts_sleep_max, 0,
	- &sysctl_net_inet_tcp_hpts_max_sleep, "IU",
	+ CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &hpts_sleep_max, 0, &sysctl_net_inet_tcp_hpts_max_sleep, "IU",
	"Maximum time hpts will sleep");

	SYSCTL_INT(_net_inet_tcp_hpts, OID_AUTO, minsleep, CTLFLAG_RW,
	Index: sys/netinet/tcp_stats.c
	===================================================================
	--- sys/netinet/tcp_stats.c
	+++ sys/netinet/tcp_stats.c
	@@ -79,8 +79,9 @@
	"Enable per-connection TCP stats gathering; 1 enables for all connections, "
	"2 enables random sampling across log id connection groups");
	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, perconn_stats_sample_rates,
	- CTLTYPE_STRING \| CTLFLAG_RW, tcp_stats_tpl_sr_cb,
	- sizeof(struct rm_priotracker), stats_tpl_sample_rates, "A",
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ tcp_stats_tpl_sr_cb, sizeof(struct rm_priotracker),
	+ stats_tpl_sample_rates, "A",
	"TCP stats per template random sampling rates, in CSV tpl_spec=percent "
	"key-value pairs (see stats(9) for template spec details)");
	#endif /* _KERNEL */
	Index: sys/netinet/tcp_subr.c
	===================================================================
	--- sys/netinet/tcp_subr.c
	+++ sys/netinet/tcp_subr.c
	@@ -209,8 +209,8 @@
	}

	SYSCTL_PROC(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW, &VNET_NAME(tcp_mssdflt), 0,
	- &sysctl_net_inet_tcp_mss_check, "I",
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(tcp_mssdflt), 0, &sysctl_net_inet_tcp_mss_check, "I",
	"Default TCP Maximum Segment Size");

	#ifdef INET6
	@@ -231,8 +231,8 @@
	}

	SYSCTL_PROC(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW, &VNET_NAME(tcp_v6mssdflt), 0,
	- &sysctl_net_inet_tcp_mss_v6_check, "I",
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(tcp_v6mssdflt), 0, &sysctl_net_inet_tcp_mss_v6_check, "I",
	"Default TCP Maximum Segment Size for IPv6");
	#endif /* INET6 */

	@@ -311,7 +311,7 @@
	return (error);
	}
	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, map_limit,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(tcp_map_entries_limit), 0,
	&sysctl_net_inet_tcp_map_limit_check, "IU",
	"Total sendmap entries limit");
	@@ -532,9 +532,9 @@
	}

	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, functions_default,
	- CTLTYPE_STRING \| CTLFLAG_RW,
	- NULL, 0, sysctl_net_inet_default_tcp_functions, "A",
	- "Set/get the default TCP functions");
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_net_inet_default_tcp_functions, "A",
	+ "Set/get the default TCP functions");

	static int
	sysctl_net_inet_list_available(SYSCTL_HANDLER_ARGS)
	@@ -588,9 +588,9 @@
	}

	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, functions_available,
	- CTLTYPE_STRING\|CTLFLAG_RD,
	- NULL, 0, sysctl_net_inet_list_available, "A",
	- "list available TCP Function sets");
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_net_inet_list_available, "A",
	+ "list available TCP Function sets");

	/*
	* Exports one (struct tcp_function_info) for each alias/name.
	@@ -2311,8 +2311,9 @@
	}

	SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist,
	- CTLTYPE_OPAQUE \| CTLFLAG_RD, NULL, 0,
	- tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, tcp_pcblist, "S,xtcpcb",
	+ "List of active TCP connections");

	#ifdef INET
	static int
	@@ -2350,8 +2351,9 @@
	}

	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, getcred,
	- CTLTYPE_OPAQUE\|CTLFLAG_RW\|CTLFLAG_PRISON, 0, 0,
	- tcp_getcred, "S,xucred", "Get the xucred of a TCP connection");
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_PRISON \| CTLFLAG_NEEDGIANT,
	+ 0, 0, tcp_getcred, "S,xucred",
	+ "Get the xucred of a TCP connection");
	#endif /* INET */

	#ifdef INET6
	@@ -2417,8 +2419,9 @@
	}

	SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred,
	- CTLTYPE_OPAQUE\|CTLFLAG_RW\|CTLFLAG_PRISON, 0, 0,
	- tcp6_getcred, "S,xucred", "Get the xucred of a TCP6 connection");
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_PRISON \| CTLFLAG_NEEDGIANT,
	+ 0, 0, tcp6_getcred, "S,xucred",
	+ "Get the xucred of a TCP6 connection");
	#endif /* INET6 */


	@@ -3149,8 +3152,9 @@
	}

	SYSCTL_PROC(_net_inet_tcp, TCPCTL_DROP, drop,
	- CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_WR \| CTLFLAG_SKIP, NULL,
	- 0, sysctl_drop, "", "Drop TCP connection");
	+ CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_WR \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_drop, "",
	+ "Drop TCP connection");

	#ifdef KERN_TLS
	static int
	@@ -3259,11 +3263,13 @@
	}

	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, switch_to_sw_tls,
	- CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_WR \| CTLFLAG_SKIP, NULL,
	- 0, sysctl_switch_tls, "", "Switch TCP connection to SW TLS");
	+ CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_WR \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_switch_tls, "",
	+ "Switch TCP connection to SW TLS");
	SYSCTL_PROC(_net_inet_tcp, OID_AUTO, switch_to_ifnet_tls,
	- CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_WR \| CTLFLAG_SKIP, NULL,
	- 1, sysctl_switch_tls, "", "Switch TCP connection to ifnet TLS");
	+ CTLFLAG_VNET \| CTLTYPE_STRUCT \| CTLFLAG_WR \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	+ NULL, 1, sysctl_switch_tls, "",
	+ "Switch TCP connection to ifnet TLS");
	#endif

	/*
	Index: sys/netinet/tcp_syncache.c
	===================================================================
	--- sys/netinet/tcp_syncache.c
	+++ sys/netinet/tcp_syncache.c
	@@ -208,7 +208,7 @@
	}

	SYSCTL_PROC(_net_inet_tcp_syncache, OID_AUTO, rexmtlimit,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(tcp_syncache.rexmt_limit), 0,
	sysctl_net_inet_tcp_syncache_rexmtlimit_check, "UI",
	"Limit on SYN/ACK retransmissions");
	Index: sys/netinet/tcp_timer.c
	===================================================================
	--- sys/netinet/tcp_timer.c
	+++ sys/netinet/tcp_timer.c
	@@ -82,46 +82,62 @@
	#endif

	int tcp_persmin;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmin, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_persmin, 0, sysctl_msec_to_ticks, "I", "minimum persistence interval");
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmin,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_persmin, 0, sysctl_msec_to_ticks, "I",
	+ "minimum persistence interval");

	int tcp_persmax;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmax, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_persmax, 0, sysctl_msec_to_ticks, "I", "maximum persistence interval");
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, persmax,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_persmax, 0, sysctl_msec_to_ticks, "I",
	+ "maximum persistence interval");

	int tcp_keepinit;
	-SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_keepinit, 0, sysctl_msec_to_ticks, "I", "time to establish connection");
	+SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_keepinit, 0, sysctl_msec_to_ticks, "I",
	+ "time to establish connection");

	int tcp_keepidle;
	-SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_keepidle, 0, sysctl_msec_to_ticks, "I", "time before keepalive probes begin");
	+SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_keepidle, 0, sysctl_msec_to_ticks, "I",
	+ "time before keepalive probes begin");

	int tcp_keepintvl;
	-SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I", "time between keepalive probes");
	+SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I",
	+ "time between keepalive probes");

	int tcp_delacktime;
	-SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
	"Time before a delayed ACK is sent");

	int tcp_msl;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_msl, 0, sysctl_msec_to_ticks, "I", "Maximum segment lifetime");
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_msl, 0, sysctl_msec_to_ticks, "I",
	+ "Maximum segment lifetime");

	int tcp_rexmit_initial;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_initial, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_initial,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&tcp_rexmit_initial, 0, sysctl_msec_to_ticks, "I",
	"Initial Retransmission Timeout");

	int tcp_rexmit_min;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
	"Minimum Retransmission Timeout");

	int tcp_rexmit_slop;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
	"Retransmission Timer Slop");

	@@ -136,8 +152,10 @@
	"Recycle closed FIN_WAIT_2 connections faster");

	int tcp_finwait2_timeout;
	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout, CTLTYPE_INT\|CTLFLAG_RW,
	- &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I", "FIN-WAIT2 timeout");
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I",
	+ "FIN-WAIT2 timeout");

	int tcp_keepcnt = TCPTV_KEEPCNT;
	SYSCTL_INT(_net_inet_tcp, OID_AUTO, keepcnt, CTLFLAG_RW, &tcp_keepcnt, 0,
	Index: sys/netinet/tcp_timewait.c
	===================================================================
	--- sys/netinet/tcp_timewait.c
	+++ sys/netinet/tcp_timewait.c
	@@ -169,7 +169,8 @@
	return (error);
	}

	-SYSCTL_PROC(_net_inet_tcp, OID_AUTO, maxtcptw, CTLTYPE_INT\|CTLFLAG_RW,
	+SYSCTL_PROC(_net_inet_tcp, OID_AUTO, maxtcptw,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&maxtcptw, 0, sysctl_maxtcptw, "IU",
	"Maximum number of compressed TCP TIME_WAIT entries");

	Index: sys/netinet/udp_usrreq.c
	===================================================================
	--- sys/netinet/udp_usrreq.c
	+++ sys/netinet/udp_usrreq.c
	@@ -916,8 +916,9 @@
	}

	SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
	- CTLTYPE_OPAQUE \| CTLFLAG_RD, NULL, 0,
	- udp_pcblist, "S,xinpcb", "List of active UDP sockets");
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, udp_pcblist, "S,xinpcb",
	+ "List of active UDP sockets");

	#ifdef INET
	static int
	@@ -957,8 +958,9 @@
	}

	SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred,
	- CTLTYPE_OPAQUE\|CTLFLAG_RW\|CTLFLAG_PRISON, 0, 0,
	- udp_getcred, "S,xucred", "Get the xucred of a UDP connection");
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_PRISON \| CTLFLAG_NEEDGIANT,
	+ 0, 0, udp_getcred, "S,xucred",
	+ "Get the xucred of a UDP connection");
	#endif /* INET */

	int
	Index: sys/netinet6/frag6.c
	===================================================================
	--- sys/netinet6/frag6.c
	+++ sys/netinet6/frag6.c
	@@ -197,8 +197,8 @@
	return (0);
	}
	SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGPACKETS, maxfragpackets,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW, NULL, 0,
	- sysctl_ip6_maxfragpackets, "I",
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_ip6_maxfragpackets, "I",
	"Default maximum number of outstanding fragmented IPv6 packets. "
	"A value of 0 means no fragmented packets will be accepted, while a "
	"a value of -1 means no limit");
	Index: sys/netinet6/in6_proto.c
	===================================================================
	--- sys/netinet6/in6_proto.c
	+++ sys/netinet6/in6_proto.c
	@@ -528,11 +528,11 @@
	CTLFLAG_VNET \| CTLFLAG_RW, &VNET_NAME(ip6_use_tempaddr), 0,
	"Create RFC3041 temporary addresses for autoconfigured addresses");
	SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_TEMPPLTIME, temppltime,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_ip6_temppltime, "I",
	"Maximum preferred lifetime for temporary addresses");
	SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_TEMPVLTIME, tempvltime,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_ip6_tempvltime, "I",
	"Maximum valid lifetime for temporary addresses");
	SYSCTL_INT(_net_inet6_ip6, IPV6CTL_V6ONLY, v6only,
	Index: sys/netinet6/ip6_input.c
	===================================================================
	--- sys/netinet6/ip6_input.c
	+++ sys/netinet6/ip6_input.c
	@@ -159,7 +159,8 @@
	}
	SYSCTL_DECL(_net_inet6_ip6);
	SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_INTRQMAXLEN, intr_queue_maxlen,
	- CTLTYPE_INT\|CTLFLAG_RW, 0, 0, sysctl_netinet6_intr_queue_maxlen, "I",
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_netinet6_intr_queue_maxlen, "I",
	"Maximum size of the IPv6 input queue");

	#ifdef RSS
	@@ -186,7 +187,8 @@
	return (netisr_setqlimit(&ip6_direct_nh, qlimit));
	}
	SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_INTRDQMAXLEN, intr_direct_queue_maxlen,
	- CTLTYPE_INT\|CTLFLAG_RW, 0, 0, sysctl_netinet6_intr_direct_queue_maxlen,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_netinet6_intr_direct_queue_maxlen,
	"I", "Maximum size of the IPv6 direct input queue");

	#endif
	Index: sys/netinet6/ip6_mroute.c
	===================================================================
	--- sys/netinet6/ip6_mroute.c
	+++ sys/netinet6/ip6_mroute.c
	@@ -222,7 +222,8 @@
	free(out, M_TEMP);
	return (error);
	}
	-SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, mif6table, CTLTYPE_OPAQUE \| CTLFLAG_RD,
	+SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, mif6table,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	NULL, 0, sysctl_mif6table, "S,mif6_sctl[MAXMIFS]",
	"IPv6 Multicast Interfaces (struct mif6_sctl[MAXMIFS], "
	"netinet6/ip6_mroute.h)");
	Index: sys/netinet6/sctp6_usrreq.c
	===================================================================
	--- sys/netinet6/sctp6_usrreq.c
	+++ sys/netinet6/sctp6_usrreq.c
	@@ -472,9 +472,10 @@
	return (error);
	}

	-SYSCTL_PROC(_net_inet6_sctp6, OID_AUTO, getcred, CTLTYPE_OPAQUE \| CTLFLAG_RW,
	- 0, 0,
	- sctp6_getcred, "S,ucred", "Get the ucred of a SCTP6 connection");
	+SYSCTL_PROC(_net_inet6_sctp6, OID_AUTO, getcred,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sctp6_getcred, "S,ucred",
	+ "Get the ucred of a SCTP6 connection");


	/* This is the same as the sctp_abort() could be made common */
	Index: sys/netinet6/udp6_usrreq.c
	===================================================================
	--- sys/netinet6/udp6_usrreq.c
	+++ sys/netinet6/udp6_usrreq.c
	@@ -682,8 +682,10 @@
	return (error);
	}

	-SYSCTL_PROC(_net_inet6_udp6, OID_AUTO, getcred, CTLTYPE_OPAQUE\|CTLFLAG_RW, 0,
	- 0, udp6_getcred, "S,xucred", "Get the xucred of a UDP6 connection");
	+SYSCTL_PROC(_net_inet6_udp6, OID_AUTO, getcred,
	+ CTLTYPE_OPAQUE \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, udp6_getcred, "S,xucred",
	+ "Get the xucred of a UDP6 connection");

	static int
	udp6_output(struct socket so, int flags_arg, struct mbuf m,
	Index: sys/netipsec/ipsec.c
	===================================================================
	--- sys/netipsec/ipsec.c
	+++ sys/netipsec/ipsec.c
	@@ -175,7 +175,8 @@

	/* net.inet.ipsec */
	SYSCTL_PROC(_net_inet_ipsec, IPSECCTL_DEF_POLICY, def_policy,
	- CTLTYPE_INT \| CTLFLAG_VNET \| CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
	+ CTLTYPE_INT \| CTLFLAG_VNET \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_def_policy, "I",
	"IPsec default policy.");
	SYSCTL_INT(_net_inet_ipsec, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
	CTLFLAG_VNET \| CTLFLAG_RW, &VNET_NAME(ip4_esp_trans_deflev), 0,
	@@ -261,7 +262,8 @@

	/* net.inet6.ipsec6 */
	SYSCTL_PROC(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy,
	- CTLTYPE_INT \| CTLFLAG_VNET \| CTLFLAG_RW, 0, 0, sysctl_def_policy, "I",
	+ CTLTYPE_INT \| CTLFLAG_VNET \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_def_policy, "I",
	"IPsec default policy.");
	SYSCTL_INT(_net_inet6_ipsec6, IPSECCTL_DEF_ESP_TRANSLEV, esp_trans_deflev,
	CTLFLAG_VNET \| CTLFLAG_RW, &VNET_NAME(ip6_esp_trans_deflev), 0,
	Index: sys/netpfil/ipfw/dn_aqm_codel.c
	===================================================================
	--- sys/netpfil/ipfw/dn_aqm_codel.c
	+++ sys/netpfil/ipfw/dn_aqm_codel.c
	@@ -123,12 +123,14 @@

	#ifdef SYSCTL_NODE
	SYSCTL_PROC(_net_inet_ip_dummynet_codel, OID_AUTO, target,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,codel_sysctl_target_handler, "L",
	- "CoDel target in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0,codel_sysctl_target_handler, "L",
	+ "CoDel target in microsecond");

	SYSCTL_PROC(_net_inet_ip_dummynet_codel, OID_AUTO, interval,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0, codel_sysctl_interval_handler, "L",
	- "CoDel interval in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, codel_sysctl_interval_handler, "L",
	+ "CoDel interval in microsecond");
	#endif

	/* This function computes codel_interval/sqrt(count)
	Index: sys/netpfil/ipfw/dn_aqm_pie.c
	===================================================================
	--- sys/netpfil/ipfw/dn_aqm_pie.c
	+++ sys/netpfil/ipfw/dn_aqm_pie.c
	@@ -167,31 +167,31 @@

	#ifdef SYSCTL_NODE
	SYSCTL_PROC(_net_inet_ip_dummynet_pie, OID_AUTO, target,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- pie_sysctl_target_tupdate_maxb_handler, "L",
	- "queue target in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, pie_sysctl_target_tupdate_maxb_handler, "L",
	+ "queue target in microsecond");
	SYSCTL_PROC(_net_inet_ip_dummynet_pie, OID_AUTO, tupdate,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- pie_sysctl_target_tupdate_maxb_handler, "L",
	- "the frequency of drop probability calculation in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, pie_sysctl_target_tupdate_maxb_handler, "L",
	+ "the frequency of drop probability calculation in microsecond");
	SYSCTL_PROC(_net_inet_ip_dummynet_pie, OID_AUTO, max_burst,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- pie_sysctl_target_tupdate_maxb_handler, "L",
	- "Burst allowance interval in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, pie_sysctl_target_tupdate_maxb_handler, "L",
	+ "Burst allowance interval in microsecond");

	SYSCTL_PROC(_net_inet_ip_dummynet_pie, OID_AUTO, max_ecnth,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- pie_sysctl_max_ecnth_handler, "L",
	- "ECN safeguard threshold scaled by 1000");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, pie_sysctl_max_ecnth_handler, "L",
	+ "ECN safeguard threshold scaled by 1000");

	SYSCTL_PROC(_net_inet_ip_dummynet_pie, OID_AUTO, alpha,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- pie_sysctl_alpha_beta_handler, "L",
	- "PIE alpha scaled by 1000");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, pie_sysctl_alpha_beta_handler, "L",
	+ "PIE alpha scaled by 1000");
	SYSCTL_PROC(_net_inet_ip_dummynet_pie, OID_AUTO, beta,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- pie_sysctl_alpha_beta_handler, "L",
	- "beta scaled by 1000");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, pie_sysctl_alpha_beta_handler, "L",
	+ "beta scaled by 1000");
	#endif


	Index: sys/netpfil/ipfw/dn_sched_fq_codel.c
	===================================================================
	--- sys/netpfil/ipfw/dn_sched_fq_codel.c
	+++ sys/netpfil/ipfw/dn_sched_fq_codel.c
	@@ -135,11 +135,13 @@
	#ifdef SYSCTL_NODE

	SYSCTL_PROC(_net_inet_ip_dummynet_fqcodel, OID_AUTO, target,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0, fqcodel_sysctl_target_handler, "L",
	- "FQ_CoDel target in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqcodel_sysctl_target_handler, "L",
	+ "FQ_CoDel target in microsecond");
	SYSCTL_PROC(_net_inet_ip_dummynet_fqcodel, OID_AUTO, interval,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0, fqcodel_sysctl_interval_handler, "L",
	- "FQ_CoDel interval in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqcodel_sysctl_interval_handler, "L",
	+ "FQ_CoDel interval in microsecond");

	SYSCTL_UINT(_net_inet_ip_dummynet_fqcodel, OID_AUTO, quantum,
	CTLFLAG_RW, &fq_codel_sysctl.quantum, 1514, "FQ_CoDel quantum");
	Index: sys/netpfil/ipfw/dn_sched_fq_pie.c
	===================================================================
	--- sys/netpfil/ipfw/dn_sched_fq_pie.c
	+++ sys/netpfil/ipfw/dn_sched_fq_pie.c
	@@ -243,32 +243,34 @@
	#ifdef SYSCTL_NODE

	SYSCTL_PROC(_net_inet_ip_dummynet_fqpie, OID_AUTO, target,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- fqpie_sysctl_target_tupdate_maxb_handler, "L",
	- "queue target in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqpie_sysctl_target_tupdate_maxb_handler, "L",
	+ "queue target in microsecond");

	SYSCTL_PROC(_net_inet_ip_dummynet_fqpie, OID_AUTO, tupdate,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- fqpie_sysctl_target_tupdate_maxb_handler, "L",
	- "the frequency of drop probability calculation in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqpie_sysctl_target_tupdate_maxb_handler, "L",
	+ "the frequency of drop probability calculation in microsecond");

	SYSCTL_PROC(_net_inet_ip_dummynet_fqpie, OID_AUTO, max_burst,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- fqpie_sysctl_target_tupdate_maxb_handler, "L",
	- "Burst allowance interval in microsecond");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqpie_sysctl_target_tupdate_maxb_handler, "L",
	+ "Burst allowance interval in microsecond");

	SYSCTL_PROC(_net_inet_ip_dummynet_fqpie, OID_AUTO, max_ecnth,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- fqpie_sysctl_max_ecnth_handler, "L",
	- "ECN safeguard threshold scaled by 1000");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqpie_sysctl_max_ecnth_handler, "L",
	+ "ECN safeguard threshold scaled by 1000");

	SYSCTL_PROC(_net_inet_ip_dummynet_fqpie, OID_AUTO, alpha,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- fqpie_sysctl_alpha_beta_handler, "L", "PIE alpha scaled by 1000");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqpie_sysctl_alpha_beta_handler, "L",
	+ "PIE alpha scaled by 1000");

	SYSCTL_PROC(_net_inet_ip_dummynet_fqpie, OID_AUTO, beta,
	- CTLTYPE_LONG \| CTLFLAG_RW, NULL, 0,
	- fqpie_sysctl_alpha_beta_handler, "L", "beta scaled by 1000");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, fqpie_sysctl_alpha_beta_handler, "L",
	+ "beta scaled by 1000");

	SYSCTL_UINT(_net_inet_ip_dummynet_fqpie, OID_AUTO, quantum,
	CTLFLAG_RW, &fq_pie_sysctl.quantum, 1514, "quantum for FQ_PIE");
	Index: sys/netpfil/ipfw/ip_dn_io.c
	===================================================================
	--- sys/netpfil/ipfw/ip_dn_io.c
	+++ sys/netpfil/ipfw/ip_dn_io.c
	@@ -171,16 +171,19 @@


	SYSCTL_PROC(_net_inet_ip_dummynet, OID_AUTO, hash_size,
	- CTLTYPE_INT \| CTLFLAG_RW, 0, 0, sysctl_hash_size,
	- "I", "Default hash table size");
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_hash_size, "I",
	+ "Default hash table size");


	SYSCTL_PROC(_net_inet_ip_dummynet, OID_AUTO, pipe_slot_limit,
	- CTLTYPE_LONG \| CTLFLAG_RW, 0, 1, sysctl_limits,
	- "L", "Upper limit in slots for pipe queue.");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 1, sysctl_limits, "L",
	+ "Upper limit in slots for pipe queue.");
	SYSCTL_PROC(_net_inet_ip_dummynet, OID_AUTO, pipe_byte_limit,
	- CTLTYPE_LONG \| CTLFLAG_RW, 0, 0, sysctl_limits,
	- "L", "Upper limit in bytes for pipe queue.");
	+ CTLTYPE_LONG \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_limits, "L",
	+ "Upper limit in bytes for pipe queue.");
	SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, io_fast,
	CTLFLAG_RW, DC(io_fast), 0, "Enable fast dummynet io.");
	SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, debug,
	Index: sys/netpfil/ipfw/ip_fw2.c
	===================================================================
	--- sys/netpfil/ipfw/ip_fw2.c
	+++ sys/netpfil/ipfw/ip_fw2.c
	@@ -196,10 +196,11 @@
	&dummy_def, 0,
	"The default/max possible rule number.");
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, tables_max,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW, 0, 0, sysctl_ipfw_table_num, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_ipfw_table_num, "IU",
	"Maximum number of concurrently used tables");
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, tables_sets,
	- CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW,
	+ CTLFLAG_VNET \| CTLTYPE_UINT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, 0, sysctl_ipfw_tables_sets, "IU",
	"Use per-set namespace for tables");
	SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, default_to_accept, CTLFLAG_RDTUN,
	Index: sys/netpfil/ipfw/ip_fw_dynamic.c
	===================================================================
	--- sys/netpfil/ipfw/ip_fw_dynamic.c
	+++ sys/netpfil/ipfw/ip_fw_dynamic.c
	@@ -453,14 +453,17 @@
	CTLFLAG_VNET \| CTLFLAG_RD, &VNET_NAME(curr_max_length), 0,
	"Current maximum length of states chains in hash buckets.");
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_buckets,
	- CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW, 0, 0, sysctl_dyn_buckets,
	- "IU", "Max number of buckets for dynamic states hash table.");
	+ CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_dyn_buckets, "IU",
	+ "Max number of buckets for dynamic states hash table.");
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_max,
	- CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW, 0, 0, sysctl_dyn_max,
	- "IU", "Max number of dynamic states.");
	+ CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_dyn_max, "IU",
	+ "Max number of dynamic states.");
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_parent_max,
	- CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW, 0, 0, sysctl_dyn_parent_max,
	- "IU", "Max number of parent dynamic states.");
	+ CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_dyn_parent_max, "IU",
	+ "Max number of parent dynamic states.");
	SYSCTL_U32(_net_inet_ip_fw, OID_AUTO, dyn_ack_lifetime,
	CTLFLAG_VNET \| CTLFLAG_RW, &VNET_NAME(dyn_ack_lifetime), 0,
	"Lifetime of dynamic states for TCP ACK.");
	Index: sys/netpfil/ipfw/ip_fw_pfil.c
	===================================================================
	--- sys/netpfil/ipfw/ip_fw_pfil.c
	+++ sys/netpfil/ipfw/ip_fw_pfil.c
	@@ -93,18 +93,20 @@

	SYSCTL_DECL(_net_inet_ip_fw);
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, enable,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE3,
	- &VNET_NAME(fw_enable), 0, ipfw_chg_hook, "I", "Enable ipfw");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE3 \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(fw_enable), 0, ipfw_chg_hook, "I",
	+ "Enable ipfw");
	#ifdef INET6
	SYSCTL_DECL(_net_inet6_ip6_fw);
	SYSCTL_PROC(_net_inet6_ip6_fw, OID_AUTO, enable,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE3,
	- &VNET_NAME(fw6_enable), 0, ipfw_chg_hook, "I", "Enable ipfw+6");
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE3 \| CTLFLAG_NEEDGIANT,
	+ &VNET_NAME(fw6_enable), 0, ipfw_chg_hook, "I",
	+ "Enable ipfw+6");
	#endif /* INET6 */

	SYSCTL_DECL(_net_link_ether);
	SYSCTL_PROC(_net_link_ether, OID_AUTO, ipfw,
	- CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE3,
	+ CTLFLAG_VNET \| CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_SECURE3 \| CTLFLAG_NEEDGIANT,
	&VNET_NAME(fwlink_enable), 0, ipfw_chg_hook, "I",
	"Pass ether pkts through firewall");

	Index: sys/netpfil/ipfw/nat64/ip_fw_nat64.c
	===================================================================
	--- sys/netpfil/ipfw/nat64/ip_fw_nat64.c
	+++ sys/netpfil/ipfw/nat64/ip_fw_nat64.c
	@@ -72,7 +72,8 @@
	return (0);
	}
	SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, nat64_direct_output,
	- CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW, 0, 0, sysctl_direct_output, "IU",
	+ CTLFLAG_VNET \| CTLTYPE_U32 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_direct_output, "IU",
	"Use if_output directly instead of deffered netisr-based processing");

	static int
	Index: sys/netsmb/smb_conn.c
	===================================================================
	--- sys/netsmb/smb_conn.c
	+++ sys/netsmb/smb_conn.c
	@@ -69,8 +69,10 @@

	static int smb_sysctl_treedump(SYSCTL_HANDLER_ARGS);

	-SYSCTL_PROC(_net_smb, OID_AUTO, treedump, CTLFLAG_RD \| CTLTYPE_OPAQUE,
	- NULL, 0, smb_sysctl_treedump, "S,treedump", "Requester tree");
	+SYSCTL_PROC(_net_smb, OID_AUTO, treedump,
	+ CTLFLAG_RD \| CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, smb_sysctl_treedump, "S,treedump",
	+ "Requester tree");

	int
	smb_sm_init(void)
	Index: sys/ofed/drivers/infiniband/ulp/sdp/sdp_main.c
	===================================================================
	--- sys/ofed/drivers/infiniband/ulp/sdp/sdp_main.c
	+++ sys/ofed/drivers/infiniband/ulp/sdp/sdp_main.c
	@@ -1884,7 +1884,8 @@
	SYSCTL_NODE(_net_inet, -1, sdp, CTLFLAG_RW, 0, "SDP");

	SYSCTL_PROC(_net_inet_sdp, TCPCTL_PCBLIST, pcblist,
	- CTLFLAG_RD \| CTLTYPE_STRUCT, 0, 0, sdp_pcblist, "S,xtcpcb",
	+ CTLFLAG_RD \| CTLTYPE_STRUCT \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sdp_pcblist, "S,xtcpcb",
	"List of active SDP connections");

	static void
	Index: sys/powerpc/powerpc/cpu.c
	===================================================================
	--- sys/powerpc/powerpc/cpu.c
	+++ sys/powerpc/powerpc/cpu.c
	@@ -259,11 +259,14 @@
	#endif

	/* Provide some user-friendly aliases for bits in cpu_features */
	-SYSCTL_PROC(_hw, OID_AUTO, floatingpoint, CTLTYPE_INT \| CTLFLAG_RD,
	+SYSCTL_PROC(_hw, OID_AUTO, floatingpoint,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	0, PPC_FEATURE_HAS_FPU, cpu_feature_bit, "I",
	"Floating point instructions executed in hardware");
	-SYSCTL_PROC(_hw, OID_AUTO, altivec, CTLTYPE_INT \| CTLFLAG_RD,
	- 0, PPC_FEATURE_HAS_ALTIVEC, cpu_feature_bit, "I", "CPU supports Altivec");
	+SYSCTL_PROC(_hw, OID_AUTO, altivec,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, PPC_FEATURE_HAS_ALTIVEC, cpu_feature_bit, "I",
	+ "CPU supports Altivec");

	/*
	* Phase 1 (early) CPU setup. Setup the cpu_features/cpu_features2 variables,
	Index: sys/security/mac_portacl/mac_portacl.c
	===================================================================
	--- sys/security/mac_portacl/mac_portacl.c
	+++ sys/security/mac_portacl/mac_portacl.c
	@@ -372,7 +372,9 @@
	}

	SYSCTL_PROC(_security_mac_portacl, OID_AUTO, rules,
	- CTLTYPE_STRING\|CTLFLAG_RW, 0, 0, sysctl_rules, "A", "Rules");
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_rules, "A",
	+ "Rules");

	static int
	rules_check(struct ucred *cred, int family, int type, u_int16_t port)
	Index: sys/security/mac_veriexec/mac_veriexec.c
	===================================================================
	--- sys/security/mac_veriexec/mac_veriexec.c
	+++ sys/security/mac_veriexec/mac_veriexec.c
	@@ -85,11 +85,13 @@

	static int mac_veriexec_state;
	SYSCTL_PROC(_security_mac_veriexec, OID_AUTO, state,
	- CTLTYPE_STRING \| CTLFLAG_RD, 0, 0, sysctl_mac_veriexec_state, "A",
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_mac_veriexec_state, "A",
	"Verified execution subsystem state");

	SYSCTL_PROC(_security_mac_veriexec, OID_AUTO, db,
	- CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_SKIP, 0, 0, sysctl_mac_veriexec_db,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_SKIP \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_mac_veriexec_db,
	"A", "Verified execution fingerprint database");

	static int mac_veriexec_slot;
	Index: sys/security/mac_veriexec/veriexec_fingerprint.c
	===================================================================
	--- sys/security/mac_veriexec/veriexec_fingerprint.c
	+++ sys/security/mac_veriexec/veriexec_fingerprint.c
	@@ -64,7 +64,8 @@
	static int sysctl_mac_veriexec_algorithms(SYSCTL_HANDLER_ARGS);

	SYSCTL_PROC(_security_mac_veriexec, OID_AUTO, algorithms,
	- CTLTYPE_STRING \| CTLFLAG_RD, 0, 0, sysctl_mac_veriexec_algorithms, "A",
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_mac_veriexec_algorithms, "A",
	"Verified execution supported hashing algorithms");

	static int
	Index: sys/sys/sysctl.h
	===================================================================
	--- sys/sys/sysctl.h
	+++ sys/sys/sysctl.h
	@@ -105,6 +105,7 @@
	#define CTLFLAG_STATS 0x00002000 /* Statistics, not a tuneable */
	#define CTLFLAG_NOFETCH 0x00001000 /* Don't fetch tunable from getenv() */
	#define CTLFLAG_CAPRW (CTLFLAG_CAPRD\|CTLFLAG_CAPWR)
	+#define CTLFLAG_NEEDGIANT 0x00000800 /* Handler require Giant */

	/*
	* Secure level. Note that CTLFLAG_SECURE == CTLFLAG_SECURE1.
	@@ -340,7 +341,8 @@

	/* Oid for a string. len can be 0 to indicate '\0' termination. */
	#define SYSCTL_STRING(parent, nbr, name, access, arg, len, descr) \
	- SYSCTL_OID(parent, nbr, name, CTLTYPE_STRING\|(access), \
	+ SYSCTL_OID(parent, nbr, name, \
	+ CTLTYPE_STRING \| CTLFLAG_NEEDGIANT \| (access), \
	arg, len, sysctl_handle_string, "A", descr); \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	((access) & SYSCTL_CT_ASSERT_MASK) == CTLTYPE_STRING)
	@@ -350,14 +352,16 @@
	char *__arg = (arg); \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	((access) & SYSCTL_CT_ASSERT_MASK) == CTLTYPE_STRING); \
	- sysctl_add_oid(ctx, parent, nbr, name, CTLTYPE_STRING\|(access), \
	+ sysctl_add_oid(ctx, parent, nbr, name, \
	+ CTLTYPE_STRING \| CTLFLAG_NEEDGIANT \| (access), \
	__arg, len, sysctl_handle_string, "A", __DESCR(descr), \
	NULL); \
	})

	/* Oid for a constant '\0' terminated string. */
	#define SYSCTL_CONST_STRING(parent, nbr, name, access, arg, descr) \
	- SYSCTL_OID(parent, nbr, name, CTLTYPE_STRING\|(access), \
	+ SYSCTL_OID(parent, nbr, name, \
	+ CTLTYPE_STRING \| CTLFLAG_NEEDGIANT \| (access), \
	__DECONST(char *, arg), 0, sysctl_handle_string, "A", descr); \
	CTASSERT(!(access & CTLFLAG_WR)); \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	@@ -369,7 +373,8 @@
	CTASSERT(!(access & CTLFLAG_WR)); \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	((access) & SYSCTL_CT_ASSERT_MASK) == CTLTYPE_STRING); \
	- sysctl_add_oid(ctx, parent, nbr, name, CTLTYPE_STRING\|(access), \
	+ sysctl_add_oid(ctx, parent, nbr, name, \
	+ CTLTYPE_STRING \| CTLFLAG_NEEDGIANT \| (access), \
	__arg, 0, sysctl_handle_string, "A", __DESCR(descr), \
	NULL); \
	})
	@@ -741,7 +746,8 @@

	/* Oid for an opaque object. Specified by a pointer and a length. */
	#define SYSCTL_OPAQUE(parent, nbr, name, access, ptr, len, fmt, descr) \
	- SYSCTL_OID(parent, nbr, name, CTLTYPE_OPAQUE\|(access), \
	+ SYSCTL_OID(parent, nbr, name, \
	+ CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT \| (access), \
	ptr, len, sysctl_handle_opaque, fmt, descr); \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	((access) & SYSCTL_CT_ASSERT_MASK) == CTLTYPE_OPAQUE)
	@@ -750,13 +756,15 @@
	({ \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	((access) & SYSCTL_CT_ASSERT_MASK) == CTLTYPE_OPAQUE); \
	- sysctl_add_oid(ctx, parent, nbr, name, CTLTYPE_OPAQUE\|(access), \
	+ sysctl_add_oid(ctx, parent, nbr, name, \
	+ CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT \| (access), \
	ptr, len, sysctl_handle_opaque, fmt, __DESCR(descr), NULL); \
	})

	/* Oid for a struct. Specified by a pointer and a type. */
	#define SYSCTL_STRUCT(parent, nbr, name, access, ptr, type, descr) \
	- SYSCTL_OID(parent, nbr, name, CTLTYPE_OPAQUE\|(access), \
	+ SYSCTL_OID(parent, nbr, name, \
	+ CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT \| (access), \
	ptr, sizeof(struct type), sysctl_handle_opaque, \
	"S," #type, descr); \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	@@ -766,7 +774,8 @@
	({ \
	CTASSERT(((access) & CTLTYPE) == 0 \|\| \
	((access) & SYSCTL_CT_ASSERT_MASK) == CTLTYPE_OPAQUE); \
	- sysctl_add_oid(ctx, parent, nbr, name, CTLTYPE_OPAQUE\|(access), \
	+ sysctl_add_oid(ctx, parent, nbr, name, \
	+ CTLTYPE_OPAQUE \| CTLFLAG_NEEDGIANT \| (access), \
	(ptr), sizeof(struct type), \
	sysctl_handle_opaque, "S," #type, __DESCR(descr), NULL); \
	})
	Index: sys/tests/epoch/epoch_test.c
	===================================================================
	--- sys/tests/epoch/epoch_test.c
	+++ sys/tests/epoch/epoch_test.c
	@@ -186,8 +186,10 @@
	}

	SYSCTL_NODE(_kern, OID_AUTO, epochtest, CTLFLAG_RW, 0, "Epoch Test Framework");
	-SYSCTL_PROC(_kern_epochtest, OID_AUTO, runtest, (CTLTYPE_INT \| CTLFLAG_RW),
	- 0, 0, epochtest_execute, "I", "Execute an epoch test");
	+SYSCTL_PROC(_kern_epochtest, OID_AUTO, runtest,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, epochtest_execute, "I",
	+ "Execute an epoch test");

	static int
	epoch_test_module_event_handler(module_t mod, int what, void *arg __unused)
	Index: sys/tests/framework/kern_testfrwk.c
	===================================================================
	--- sys/tests/framework/kern_testfrwk.c
	+++ sys/tests/framework/kern_testfrwk.c
	@@ -167,8 +167,10 @@
	static int kerntest_execute(SYSCTL_HANDLER_ARGS);

	SYSCTL_NODE(_kern, OID_AUTO, testfrwk, CTLFLAG_RW, 0, "Kernel Test Framework");
	-SYSCTL_PROC(_kern_testfrwk, OID_AUTO, runtest, (CTLTYPE_STRUCT \| CTLFLAG_RW),
	- 0, 0, kerntest_execute, "IU", "Execute a kernel test");
	+SYSCTL_PROC(_kern_testfrwk, OID_AUTO, runtest,
	+ CTLTYPE_STRUCT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, kerntest_execute, "IU",
	+ "Execute a kernel test");

	int
	kerntest_execute(SYSCTL_HANDLER_ARGS)
	Index: sys/ufs/ffs/ffs_alloc.c
	===================================================================
	--- sys/ufs/ffs/ffs_alloc.c
	+++ sys/ufs/ffs/ffs_alloc.c
	@@ -3101,8 +3101,9 @@

	static int sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS);

	-SYSCTL_PROC(_vfs_ffs, FFS_ADJ_REFCNT, adjrefcnt, CTLFLAG_WR\|CTLTYPE_STRUCT,
	- 0, 0, sysctl_ffs_fsck, "S,fsck", "Adjust Inode Reference Count");
	+SYSCTL_PROC(_vfs_ffs, FFS_ADJ_REFCNT, adjrefcnt,
	+ CTLFLAG_WR \| CTLTYPE_STRUCT \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_ffs_fsck, "S,fsck", "Adjust Inode Reference Count");

	static SYSCTL_NODE(_vfs_ffs, FFS_ADJ_BLKCNT, adjblkcnt, CTLFLAG_WR,
	sysctl_ffs_fsck, "Adjust Inode Used Blocks Count");
	Index: sys/ufs/ufs/ufs_dirhash.c
	===================================================================
	--- sys/ufs/ufs/ufs_dirhash.c
	+++ sys/ufs/ufs/ufs_dirhash.c
	@@ -90,7 +90,8 @@
	static int ufs_dirhashreclaimpercent = 10;
	static int ufsdirhash_set_reclaimpercent(SYSCTL_HANDLER_ARGS);
	SYSCTL_PROC(_vfs_ufs, OID_AUTO, dirhash_reclaimpercent,
	- CTLTYPE_INT \| CTLFLAG_RW, 0, 0, ufsdirhash_set_reclaimpercent, "I",
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, ufsdirhash_set_reclaimpercent, "I",
	"set percentage of dirhash cache to be removed in low VM events");


	Index: sys/vm/uma_core.c
	===================================================================
	--- sys/vm/uma_core.c
	+++ sys/vm/uma_core.c
	@@ -325,11 +325,15 @@

	SYSCTL_NODE(_vm, OID_AUTO, uma, CTLFLAG_RW, 0, "Universal Memory Allocator");

	-SYSCTL_PROC(_vm, OID_AUTO, zone_count, CTLFLAG_RD\|CTLTYPE_INT,
	- 0, 0, sysctl_vm_zone_count, "I", "Number of UMA zones");
	-
	-SYSCTL_PROC(_vm, OID_AUTO, zone_stats, CTLFLAG_RD\|CTLTYPE_STRUCT,
	- 0, 0, sysctl_vm_zone_stats, "s,struct uma_type_header", "Zone Stats");
	+SYSCTL_PROC(_vm, OID_AUTO, zone_count,
	+ CTLFLAG_RD \| CTLTYPE_INT \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_vm_zone_count, "I",
	+ "Number of UMA zones");
	+
	+SYSCTL_PROC(_vm, OID_AUTO, zone_stats,
	+ CTLFLAG_RD \| CTLTYPE_STRUCT \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_vm_zone_stats, "s,struct uma_type_header",
	+ "Zone Stats");

	static int zone_warnings = 1;
	SYSCTL_INT(_vm, OID_AUTO, zone_warnings, CTLFLAG_RWTUN, &zone_warnings, 0,
	Index: sys/vm/vm_glue.c
	===================================================================
	--- sys/vm/vm_glue.c
	+++ sys/vm/vm_glue.c
	@@ -281,9 +281,10 @@
	uma_zone_set_maxcache(kstack_cache, kstack_cache_size);
	return (error);
	}
	-SYSCTL_PROC(_vm, OID_AUTO, kstack_cache_size, CTLTYPE_INT\|CTLFLAG_RW,
	- &kstack_cache_size, 0, sysctl_kstack_cache_size, "IU",
	- "Maximum number of cached kernel stacks");
	+SYSCTL_PROC(_vm, OID_AUTO, kstack_cache_size,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ &kstack_cache_size, 0, sysctl_kstack_cache_size, "IU",
	+ "Maximum number of cached kernel stacks");

	/*
	* Create the kernel stack (including pcb for i386) for a new thread.
	Index: sys/vm/vm_kern.c
	===================================================================
	--- sys/vm/vm_kern.c
	+++ sys/vm/vm_kern.c
	@@ -880,5 +880,7 @@
	return (0);
	}

	-SYSCTL_PROC(_debug, OID_AUTO, vm_lowmem, CTLTYPE_INT \| CTLFLAG_RW, 0, 0,
	- debug_vm_lowmem, "I", "set to trigger vm_lowmem event with given flags");
	+SYSCTL_PROC(_debug, OID_AUTO, vm_lowmem,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, debug_vm_lowmem, "I",
	+ "set to trigger vm_lowmem event with given flags");
	Index: sys/vm/vm_reserv.c
	===================================================================
	--- sys/vm/vm_reserv.c
	+++ sys/vm/vm_reserv.c
	@@ -273,8 +273,10 @@

	static int sysctl_vm_reserv_fullpop(SYSCTL_HANDLER_ARGS);

	-SYSCTL_PROC(_vm_reserv, OID_AUTO, fullpop, CTLTYPE_INT \| CTLFLAG_RD, NULL, 0,
	- sysctl_vm_reserv_fullpop, "I", "Current number of full reservations");
	+SYSCTL_PROC(_vm_reserv, OID_AUTO, fullpop,
	+ CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ NULL, 0, sysctl_vm_reserv_fullpop, "I",
	+ "Current number of full reservations");

	static int sysctl_vm_reserv_partpopq(SYSCTL_HANDLER_ARGS);

	Index: sys/vm/vnode_pager.c
	===================================================================
	--- sys/vm/vnode_pager.c
	+++ sys/vm/vnode_pager.c
	@@ -119,7 +119,8 @@

	static struct domainset *vnode_domainset = NULL;

	-SYSCTL_PROC(_debug, OID_AUTO, vnode_domainset, CTLTYPE_STRING \| CTLFLAG_RW,
	+SYSCTL_PROC(_debug, OID_AUTO, vnode_domainset,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	&vnode_domainset, 0, sysctl_handle_domainset, "A",
	"Default vnode NUMA policy");

	Index: sys/x86/isa/clock.c
	===================================================================
	--- sys/x86/isa/clock.c
	+++ sys/x86/isa/clock.c
	@@ -473,7 +473,8 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, i8254_freq, CTLTYPE_INT \| CTLFLAG_RW,
	+SYSCTL_PROC(_machdep, OID_AUTO, i8254_freq,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	0, sizeof(u_int), sysctl_machdep_i8254_freq, "IU",
	"i8254 timer frequency");

	Index: sys/x86/x86/cpu_machdep.c
	===================================================================
	--- sys/x86/x86/cpu_machdep.c
	+++ sys/x86/x86/cpu_machdep.c
	@@ -741,8 +741,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, idle_available, CTLTYPE_STRING \| CTLFLAG_RD,
	- 0, 0, idle_sysctl_available, "A", "list of available idle functions");
	+SYSCTL_PROC(_machdep, OID_AUTO, idle_available,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, idle_sysctl_available, "A",
	+ "list of available idle functions");

	static bool
	cpu_idle_selector(const char *new_idle_name)
	@@ -786,8 +788,10 @@
	return (cpu_idle_selector(buf) ? 0 : EINVAL);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, idle, CTLTYPE_STRING \| CTLFLAG_RW, 0, 0,
	- cpu_idle_sysctl, "A", "currently selected idle function");
	+SYSCTL_PROC(_machdep, OID_AUTO, idle,
	+ CTLTYPE_STRING \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, cpu_idle_sysctl, "A",
	+ "currently selected idle function");

	static void
	cpu_idle_tun(void *unused __unused)
	Index: sys/x86/x86/intr_machdep.c
	===================================================================
	--- sys/x86/x86/intr_machdep.c
	+++ sys/x86/x86/intr_machdep.c
	@@ -750,8 +750,10 @@
	sbuf_delete(&sbuf);
	return (error);
	}
	-SYSCTL_PROC(_hw, OID_AUTO, intrs, CTLTYPE_STRING \| CTLFLAG_RD,
	- 0, 0, sysctl_hw_intrs, "A", "interrupt:number @cpu: count");
	+SYSCTL_PROC(_hw, OID_AUTO, intrs,
	+ CTLTYPE_STRING \| CTLFLAG_RD \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_hw_intrs, "A",
	+ "interrupt:number @cpu: count");

	/*
	* Compare two, possibly NULL, entries in the interrupt source array
	Index: sys/x86/x86/mp_watchdog.c
	===================================================================
	--- sys/x86/x86/mp_watchdog.c
	+++ sys/x86/x86/mp_watchdog.c
	@@ -149,8 +149,10 @@
	watchdog_change(temp);
	return (0);
	}
	-SYSCTL_PROC(_debug, OID_AUTO, watchdog, CTLTYPE_INT\|CTLFLAG_RW, 0, 0,
	- sysctl_watchdog, "I", "");
	+SYSCTL_PROC(_debug, OID_AUTO, watchdog,
	+ CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_watchdog, "I",
	+ "");

	/*
	* Drop into the debugger by sending an IPI NMI to the boot processor.
	Index: sys/x86/x86/tsc.c
	===================================================================
	--- sys/x86/x86/tsc.c
	+++ sys/x86/x86/tsc.c
	@@ -751,8 +751,10 @@
	return (error);
	}

	-SYSCTL_PROC(_machdep, OID_AUTO, tsc_freq, CTLTYPE_U64 \| CTLFLAG_RW,
	- 0, 0, sysctl_machdep_tsc_freq, "QU", "Time Stamp Counter frequency");
	+SYSCTL_PROC(_machdep, OID_AUTO, tsc_freq,
	+ CTLTYPE_U64 \| CTLFLAG_RW \| CTLFLAG_NEEDGIANT,
	+ 0, 0, sysctl_machdep_tsc_freq, "QU",
	+ "Time Stamp Counter frequency");

	static u_int
	tsc_get_timecount(struct timecounter *tc __unused)

File Metadata

Mime Type: text/plain
Expires: Sun, Jun 21, 6:26 PM (10 h, 19 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 34157458
Default Alt Text: D23110.id66577.diff (176 KB)

D23110.id66577.diffNo OneTemporaryActions

D23110.id66577.diffView Options

File Metadata

Event Timeline

D23110.id66577.diff
No OneTemporary
Actions

D23110.id66577.diff
View Options