diff --git a/.cirrus.yml b/.cirrus.yml
index a4f8bf778db..8052ce0adb2 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -26,19 +26,20 @@ task:
       TARGET_ARCH: aarch64
   timeout_in: 120m
   install_script:
-  - sh .cirrus-ci/pkg-install.sh qemu llvm11
+  - sh .cirrus-ci/pkg-install.sh qemu llvm13
   setup_script:
   - uname -a
   - df -m
+  - pkg --version
   - pw useradd user
   - mkdir -p /usr/obj/$(pwd -P)
   - chown user:user /usr/obj/$(pwd -P)
   script:
-  - su user -c "make -j$(sysctl -n hw.ncpu) CROSS_TOOLCHAIN=llvm11 WITHOUT_TOOLCHAIN=yes buildworld buildkernel"
+  - su user -c "make -j$(sysctl -n hw.ncpu) CROSS_TOOLCHAIN=llvm13 WITHOUT_TOOLCHAIN=yes buildworld buildkernel"
   package_script:
-  - su user -c "make CROSS_TOOLCHAIN=llvm11 WITHOUT_TOOLCHAIN=yes PKG_FORMAT=tar packages"
+  - su user -c "make CROSS_TOOLCHAIN=llvm13 WITHOUT_TOOLCHAIN=yes PKG_FORMAT=tar packages"
   test_script:
   - sh tools/boot/ci-qemu-test.sh
   post_script:
   - df -m
-  - du -m -s /usr/obj
\ No newline at end of file
+  - du -m -s /usr/obj
diff --git a/Makefile.inc1 b/Makefile.inc1
index 1726ae046d7..86f78a1ae20 100644
--- a/Makefile.inc1
+++ b/Makefile.inc1
@@ -2341,7 +2341,8 @@ _gensnmptree=	usr.sbin/bsnmpd/gensnmptree
 _clang_tblgen= \
 	lib/clang/libllvmminimal \
 	usr.bin/clang/llvm-tblgen
-.if ${MK_CLANG_BOOTSTRAP} != "no" || ${MK_CLANG} != "no"
+.if ${MK_CLANG_BOOTSTRAP} != "no" || ${MK_CLANG} != "no" || \
+    ${MK_LLDB} != "no"
 _clang_tblgen+=	usr.bin/clang/clang-tblgen
 .endif
 .if ${MK_LLDB} != "no"
diff --git a/bin/echo/echo.c b/bin/echo/echo.c
index f56bd5b976d..46796ad1a27 100644
--- a/bin/echo/echo.c
+++ b/bin/echo/echo.c
@@ -55,23 +55,6 @@ __FBSDID("$FreeBSD$");
 #include <string.h>
 #include <unistd.h>
 
-/*
- * Report an error and exit.
- * Use it instead of err(3) to avoid linking-in stdio.
- */
-static __dead2 void
-errexit(const char *prog, const char *reason)
-{
-	char *errstr = strerror(errno);
-	write(STDERR_FILENO, prog, strlen(prog));
-	write(STDERR_FILENO, ": ", 2);
-	write(STDERR_FILENO, reason, strlen(reason));
-	write(STDERR_FILENO, ": ", 2);
-	write(STDERR_FILENO, errstr, strlen(errstr));
-	write(STDERR_FILENO, "\n", 1);
-	exit(1);
-}
-
 int
 main(int argc, char *argv[])
 {
@@ -80,7 +63,6 @@ main(int argc, char *argv[])
 	struct iovec *iov, *vp; /* Elements to write, current element. */
 	char space[] = " ";
 	char newline[] = "\n";
-	char *progname = argv[0];
 
 	if (caph_limit_stdio() < 0 || caph_enter() < 0)
 		err(1, "capsicum");
@@ -96,7 +78,7 @@ main(int argc, char *argv[])
 	veclen = (argc >= 2) ? (argc - 2) * 2 + 1 : 0;
 
 	if ((vp = iov = malloc((veclen + 1) * sizeof(struct iovec))) == NULL)
-		errexit(progname, "malloc");
+		err(1, "malloc");
 
 	while (argv[0] != NULL) {
 		size_t len;
@@ -135,7 +117,7 @@ main(int argc, char *argv[])
 
 		nwrite = (veclen > IOV_MAX) ? IOV_MAX : veclen;
 		if (writev(STDOUT_FILENO, iov, nwrite) == -1)
-			errexit(progname, "write");
+			err(1, "write");
 		iov += nwrite;
 		veclen -= nwrite;
 	}
diff --git a/cddl/contrib/opensolaris/tools/ctf/cvt/dwarf.c b/cddl/contrib/opensolaris/tools/ctf/cvt/dwarf.c
index 32c993e1e52..2d686e53fed 100644
--- a/cddl/contrib/opensolaris/tools/ctf/cvt/dwarf.c
+++ b/cddl/contrib/opensolaris/tools/ctf/cvt/dwarf.c
@@ -1123,8 +1123,16 @@ die_sou_resolve(tdesc_t *tdp, tdesc_t **tdpp __unused, void *private)
 			 */
 			if (mt->t_members == NULL)
 				continue;
-			if (mt->t_type == ARRAY && mt->t_ardef->ad_nelems == 0)
-				continue;
+			if (mt->t_type == ARRAY) {
+				if (mt->t_ardef->ad_nelems == 0)
+					continue;
+				mt = tdesc_basetype(mt->t_ardef->ad_contents);
+				if ((mt->t_flags & TDESC_F_RESOLVED) != 0 &&
+				    (mt->t_type == STRUCT ||
+				    mt->t_type == UNION) &&
+				    mt->t_members == NULL)
+					continue;
+			}
 			if ((mt->t_flags & TDESC_F_RESOLVED) != 0 &&
 			    (mt->t_type == STRUCT || mt->t_type == UNION))
 				continue;
diff --git a/lib/clang/Makefile b/lib/clang/Makefile
index df4aa01a265..cbb2c2a7175 100644
--- a/lib/clang/Makefile
+++ b/lib/clang/Makefile
@@ -4,7 +4,7 @@
 
 # These have to be built in order.
 SUBDIR=		libllvm
-.if ${MK_CLANG} != "no"
+.if ${MK_CLANG} != "no" || ${MK_LLDB} != "no"
 SUBDIR+=	libclang
 SUBDIR+=	headers
 .endif
diff --git a/sbin/ifconfig/ifconfig.c b/sbin/ifconfig/ifconfig.c
index 0423b359350..9e7d38d4c2a 100644
--- a/sbin/ifconfig/ifconfig.c
+++ b/sbin/ifconfig/ifconfig.c
@@ -1243,6 +1243,9 @@ setifcap(const char *vname, int value, int s, const struct afswtch *afp)
 	} else
 		flags |= value;
 	flags &= ifr.ifr_reqcap;
+	/* Check for no change in capabilities. */
+	if (ifr.ifr_curcap == flags)
+		return;
 	ifr.ifr_reqcap = flags;
 	if (ioctl(s, SIOCSIFCAP, (caddr_t)&ifr) < 0)
 		Perror(vname);
diff --git a/sbin/kldstat/kldstat.c b/sbin/kldstat/kldstat.c
index 38918890b87..b8e4fd6e4b5 100644
--- a/sbin/kldstat/kldstat.c
+++ b/sbin/kldstat/kldstat.c
@@ -29,177 +29,183 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#include <err.h>
-#include <libutil.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/module.h>
 #include <sys/linker.h>
-#include <strings.h>
 
-#define	POINTER_WIDTH	((int)(sizeof(void *) * 2 + 2))
+#include <err.h>
+#include <libutil.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <unistd.h>
+
+#define	PTR_WIDTH ((int)(sizeof(void *) * 2 + 2))
+
+static void printmod(int);
+static void printfile(int, int, int);
+static void usage(void) __dead2;
 
 static int showdata = 0;
 
 static void
 printmod(int modid)
 {
-    struct module_stat stat;
+	struct module_stat stat;
 
-    bzero(&stat, sizeof(stat));
-    stat.version = sizeof(struct module_stat);
-    if (modstat(modid, &stat) < 0)
-	warn("can't stat module id %d", modid);
-    else
-	if (showdata) {
-	    printf("\t\t%3d %s (%d, %u, 0x%lx)\n", stat.id, stat.name, 
-	        stat.data.intval, stat.data.uintval, stat.data.ulongval);
-	} else {
-		printf("\t\t%3d %s\n", stat.id, stat.name);
+	bzero(&stat, sizeof(stat));
+	stat.version = sizeof(struct module_stat);
+	if (modstat(modid, &stat) < 0) {
+		warn("can't stat module id %d", modid);
+		return;
 	}
+	if (showdata) {
+		printf("\t\t%3d %s (%d, %u, 0x%lx)\n", stat.id,
+		    stat.name, stat.data.intval, stat.data.uintval,
+		    stat.data.ulongval);
+	} else
+		printf("\t\t%3d %s\n", stat.id, stat.name);
 }
 
 static void
 printfile(int fileid, int verbose, int humanized)
 {
-    struct kld_file_stat stat;
-    int modid;
-    char buf[5];
+	struct kld_file_stat stat;
+	int modid;
+	char buf[5];
 
-    stat.version = sizeof(struct kld_file_stat);
-    if (kldstat(fileid, &stat) < 0) {
-	err(1, "can't stat file id %d", fileid);
-    } else {
+	stat.version = sizeof(struct kld_file_stat);
+	if (kldstat(fileid, &stat) < 0)
+		err(1, "can't stat file id %d", fileid);
 	if (humanized) {
 		humanize_number(buf, sizeof(buf), stat.size,
 		    "", HN_AUTOSCALE, HN_DECIMAL | HN_NOSPACE);
 
 		printf("%2d %4d %*p %5s %s",
-		    stat.id, stat.refs, POINTER_WIDTH, stat.address, buf,
-		    stat.name);
+		    stat.id, stat.refs, PTR_WIDTH, stat.address,
+		    buf, stat.name);
 	} else {
 		printf("%2d %4d %*p %8zx %s",
-		    stat.id, stat.refs, POINTER_WIDTH, stat.address, stat.size,
-		    stat.name);
+		    stat.id, stat.refs, PTR_WIDTH, stat.address,
+		    stat.size, stat.name);
 	}
-    }
 
-    if (verbose) {
-	printf(" (%s)\n", stat.pathname);
-	printf("\tContains modules:\n");
-	printf("\t\t Id Name\n");
-	for (modid = kldfirstmod(fileid); modid > 0;
-	     modid = modfnext(modid))
-	    printmod(modid);
-    } else
-	printf("\n");
+	if (verbose) {
+		printf(" (%s)\n", stat.pathname);
+		printf("\tContains modules:\n");
+		printf("\t\t Id Name\n");
+		for (modid = kldfirstmod(fileid); modid > 0; modid = modfnext(modid))
+			printmod(modid);
+	} else
+		printf("\n");
 }
 
-static void
+static void __dead2
 usage(void)
 {
-    fprintf(stderr, "usage: kldstat [-d] [-h] [-q] [-v] [-i id] [-n filename]\n");
-    fprintf(stderr, "       kldstat [-d] [-q] [-m modname]\n");
-    exit(1);
+	fprintf(stderr, "usage: %1$s [-dhqv] [-i id] [-n filename]\n"
+	    "       %1$s [-dq] [-m modname]\n", getprogname());
+	exit(1);
 }
 
 int
-main(int argc, char** argv)
+main(int argc, char *argv[])
 {
-    int c;
-    int humanized = 0;
-    int verbose = 0;
-    int fileid = 0;
-    int quiet = 0;
-    char* filename = NULL;
-    char* modname = NULL;
-    char* p;
-
-    while ((c = getopt(argc, argv, "dhi:m:n:qv")) != -1)
-	switch (c) {
-	case 'd':
-	    showdata = 1;
-	    break;
-	case 'h':
-	    humanized = 1;
-	    break;
-	case 'i':
-	    fileid = (int)strtoul(optarg, &p, 10);
-	    if (*p != '\0')
-		usage();
-	    break;
-	case 'm':
-	    modname = optarg;
-	    break;
-	case 'n':
-	    filename = optarg;
-	    break;
-	case 'q':
-	    quiet = 1;
-	    break;
-	case 'v':
-	    verbose = 1;
-	    break;
-	default:
-	    usage();
-	}
-    argc -= optind;
-    argv += optind;
-
-    if (argc != 0)
-	usage();
-
-    if (modname != NULL) {
-	int modid;
 	struct module_stat stat;
+	int humanized = 0;
+	int verbose = 0;
+	int fileid = 0;
+	int quiet = 0;
+	int c, modid;
+	char *filename = NULL;
+	char *modname = NULL;
+	char *p;
 
-	if ((modid = modfind(modname)) < 0) {
-	    if (!quiet)
-		warn("can't find module %s", modname);
-	    return 1;
-	} else if (quiet) {
-	    return 0;
-	}
-
-	stat.version = sizeof(struct module_stat);
-	if (modstat(modid, &stat) < 0)
-	    warn("can't stat module id %d", modid);
-	else {
-		if (showdata) {
-		    printf("Id  Refs Name data..(int, uint, ulong)\n");
-		    printf("%3d %4d %s (%d, %u, 0x%lx)\n", stat.id, stat.refs, stat.name, 
-		        stat.data.intval, stat.data.uintval, stat.data.ulongval);
-		} else {
-		    printf("Id  Refs Name\n");
-		    printf("%3d %4d %s\n", stat.id, stat.refs, stat.name);
+	while ((c = getopt(argc, argv, "dhi:m:n:qv")) != -1) {
+		switch (c) {
+		case 'd':
+			showdata = 1;
+			break;
+		case 'h':
+			humanized = 1;
+			break;
+		case 'i':
+			fileid = (int)strtoul(optarg, &p, 10);
+			if (*p != '\0')
+				usage();
+			break;
+		case 'm':
+			modname = optarg;
+			break;
+		case 'n':
+			filename = optarg;
+			break;
+		case 'q':
+			quiet = 1;
+			break;
+		case 'v':
+			verbose = 1;
+			break;
+		default:
+			usage();
 		}
 	}
+	argc -= optind;
+	argv += optind;
 
-	return 0;
-    }
+	if (argc != 0)
+		usage();
 
-    if (filename != NULL) {
-	if ((fileid = kldfind(filename)) < 0) {
-	    if (!quiet)
-		warn("can't find file %s", filename);
-	    return 1;
-	} else if (quiet) {
-	    return 0;
+	if (modname != NULL) {
+		if ((modid = modfind(modname)) < 0) {
+			if (!quiet)
+				warn("can't find module %s", modname);
+			return (1);
+		} else if (quiet)
+			return (0);
+
+		stat.version = sizeof(struct module_stat);
+		if (modstat(modid, &stat) < 0)
+			warn("can't stat module id %d", modid);
+		else {
+			if (showdata) {
+				printf("Id  Refs Name data..(int, uint, ulong)\n");
+				printf("%3d %4d %s (%d, %u, 0x%lx)\n",
+				    stat.id, stat.refs, stat.name,
+				    stat.data.intval, stat.data.uintval,
+				    stat.data.ulongval);
+			} else {
+				printf("Id  Refs Name\n");
+				printf("%3d %4d %s\n", stat.id, stat.refs,
+				    stat.name);
+			}
+		}
+
+		return (0);
 	}
-    }
 
-    if (humanized)
-	    printf("Id Refs Address%*c %5s Name\n", POINTER_WIDTH - 7, ' ', "Size");
-    else
-	    printf("Id Refs Address%*c %8s Name\n", POINTER_WIDTH - 7, ' ', "Size");
-    if (fileid != 0)
-	printfile(fileid, verbose, humanized);
-    else
-	for (fileid = kldnext(0); fileid > 0; fileid = kldnext(fileid))
-	    printfile(fileid, verbose, humanized);
+	if (filename != NULL) {
+		if ((fileid = kldfind(filename)) < 0) {
+			if (!quiet)
+				warn("can't find file %s", filename);
+			return (1);
+		} else if (quiet)
+			return (0);
+	}
 
-    return 0;
+	if (humanized) {
+		printf("Id Refs Address%*c %5s Name\n", PTR_WIDTH - 7,
+		    ' ', "Size");
+	} else {
+		printf("Id Refs Address%*c %8s Name\n", PTR_WIDTH - 7,
+		    ' ', "Size");
+	}
+	if (fileid != 0)
+		printfile(fileid, verbose, humanized);
+	else
+		for (fileid = kldnext(0); fileid > 0; fileid = kldnext(fileid))
+			printfile(fileid, verbose, humanized);
+
+	return (0);
 }
diff --git a/share/man/man4/iwlwifi.4 b/share/man/man4/iwlwifi.4
index 5d96b263c9e..1f79319aad6 100644
--- a/share/man/man4/iwlwifi.4
+++ b/share/man/man4/iwlwifi.4
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd October 27, 2021
+.Dd January 1, 2022
 .Dt iwlwifi 4
 .Os
 .Sh NAME
@@ -35,14 +35,21 @@
 .Nd Intel IEEE 802.11a/b/g/n/ac/ax wireless network driver
 .Sh SYNOPSIS
 To load the driver as a module at boot time, place the following lines in
-.Xr loader.conf 5 :
+.Xr rc.conf 5 :
 .Bd -literal -offset indent
-if_iwlwifi_load="YES"
+kld_list="${kld_list} if_iwlwifi"
 .Ed
 .Pp
 The driver should automatically load any
 .Xr iwlwififw 4
-firmware needed for the particular chipset.
+firmware needed for the particular chipset in that case.
+.Pp
+It is anticipated that the driver will support auto-loading via
+.Xr devmatch 8
+in the future and will need no configuration at all.
+.Pp
+It is discouraged to load the driver from
+.Xr loader 8 .
 .Sh DESCRIPTION
 The
 .Nm
@@ -50,12 +57,14 @@ driver is derived from Intel's Linux iwlwifi driver and provides support for
 all chipsets supported by the
 .Em mvm
 part of that driver.
-This superseeds the
+.\" XXX-BZ find way to add full list of chipsets automatically
+.Nm
+will be a successor to
 .Xr iwm 4
-driver which provided support for a subset of these chipsets and still
-complements the
+and may superseed that driver in the future.
+It still complements the
 .Xr iwn 4
-driver supporting older chipsets.
+driver which supports older chipsets.
 .Pp
 The driver uses the
 .\" No LinuxKPI man pages so no .Xr here.
@@ -63,7 +72,9 @@ The driver uses the
 and
 .Em linuxkpi
 compat framework to bridge between the Linux and
-native FreeBSD driver code.
+native FreeBSD driver code as well as to the native
+.Xr net80211 4
+wireless stack.
 .Pp
 While
 .Nm
diff --git a/share/man/man4/iwlwififw.4 b/share/man/man4/iwlwififw.4
index 81daaa02817..d38d38f2869 100644
--- a/share/man/man4/iwlwififw.4
+++ b/share/man/man4/iwlwififw.4
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd November 30, 2021
+.Dd January 1, 2022
 .Dt iwlwififw 4
 .Os
 .Sh NAME
@@ -37,6 +37,8 @@
 The
 .Xr iwlwifi 4
 driver should auto-load any firmware needed.
+It is discouraged to load the driver or firmware manually from
+.Xr loader 8 .
 .Sh DESCRIPTION
 Multiple modules provide access to firmware for the various chipset
 models supported by the
diff --git a/sys/arm/arm/fusu.S b/sys/arm/arm/fusu.S
index 1a77377cb14..fd366542b28 100644
--- a/sys/arm/arm/fusu.S
+++ b/sys/arm/arm/fusu.S
@@ -212,6 +212,35 @@ fusupcbfaulttext:
 	.align	2
 #endif
 
+/*
+ * suword16(caddr_t uaddr, int x);
+ * Store an uint16_t in the user's address space.
+ */
+
+ENTRY(suword16)
+	ldr	r3, =(VM_MAXUSER_ADDRESS-3)
+	cmp	r0, r3
+	mvncs	r0, #0
+	RETc(cs)
+
+	GET_PCB(r2)
+	ldr	r2, [r2]
+
+#ifdef DIAGNOSTIC
+	teq	r2, #0x00000000
+	beq	.Lfusupcbfault
+#endif
+
+	adr	r3, .Lfusufault
+	str	r3, [r2, #PCB_ONFAULT]
+
+	strht	r1, [r0], #0
+
+	mov	r0, #0x00000000
+	str	r0, [r2, #PCB_ONFAULT]
+	RET
+END(suword16)
+
 /*
  * suword(caddr_t uaddr, int x);
  * Store an int in the user's address space.
diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c
index f3899722518..5df10458f3d 100644
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -786,7 +786,7 @@ lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int
 	{
 		int i, count;
 
-		for (i = 3; i > 0; i++) {
+		for (i = 3 * (hw->queues + 1); i > 0; i--) {
 			struct lkpi_txq *ltxq;
 			int tid;
 
@@ -815,7 +815,7 @@ lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int
 				ic_printf(vap->iv_ic, "%s: waiting for %d quuees "
 				    "to be allocated by driver\n", __func__, count);
 #endif
-			DELAY(100);
+			pause("lkpi80211txq", hz/10);
 		}
 #ifdef LINUXKPI_DEBUG_80211
 		if (count > 0)
diff --git a/sys/contrib/dev/iwlwififw/iwlwifi-3160-17.ucode b/sys/contrib/dev/iwlwififw/iwlwifi-3160-17.ucode
new file mode 100644
index 00000000000..95b26df9d56
Binary files /dev/null and b/sys/contrib/dev/iwlwififw/iwlwifi-3160-17.ucode differ
diff --git a/sys/contrib/dev/iwlwififw/iwlwifi-3160-9.ucode b/sys/contrib/dev/iwlwififw/iwlwifi-3160-9.ucode
deleted file mode 100644
index 287a3a5f183..00000000000
Binary files a/sys/contrib/dev/iwlwififw/iwlwifi-3160-9.ucode and /dev/null differ
diff --git a/sys/contrib/dev/iwlwififw/iwlwifi-7260-17.ucode b/sys/contrib/dev/iwlwififw/iwlwifi-7260-17.ucode
new file mode 100644
index 00000000000..b1a87d52cdd
Binary files /dev/null and b/sys/contrib/dev/iwlwififw/iwlwifi-7260-17.ucode differ
diff --git a/sys/contrib/dev/iwlwififw/iwlwifi-7260-9.ucode b/sys/contrib/dev/iwlwififw/iwlwifi-7260-9.ucode
deleted file mode 100644
index b271e861111..00000000000
Binary files a/sys/contrib/dev/iwlwififw/iwlwifi-7260-9.ucode and /dev/null differ
diff --git a/sys/contrib/dev/iwlwififw/iwlwifi-7265-17.ucode b/sys/contrib/dev/iwlwififw/iwlwifi-7265-17.ucode
new file mode 100644
index 00000000000..f4a549cce6e
Binary files /dev/null and b/sys/contrib/dev/iwlwififw/iwlwifi-7265-17.ucode differ
diff --git a/sys/contrib/dev/iwlwififw/iwlwifi-7265-9.ucode b/sys/contrib/dev/iwlwififw/iwlwifi-7265-9.ucode
deleted file mode 100644
index bbca2fe4494..00000000000
Binary files a/sys/contrib/dev/iwlwififw/iwlwifi-7265-9.ucode and /dev/null differ
diff --git a/sys/contrib/ipfilter/netinet/fil.c b/sys/contrib/ipfilter/netinet/fil.c
index 701cde74035..36fab549ae4 100644
--- a/sys/contrib/ipfilter/netinet/fil.c
+++ b/sys/contrib/ipfilter/netinet/fil.c
@@ -9330,6 +9330,11 @@ ipf_main_soft_create(arg)
 	softc->ipf_icmpminfragmtu = 68;
 	softc->ipf_flags = IPF_LOGGING;
 
+#ifdef LARGE_NAT
+	softc->ipf_large_nat = 1;
+#endif
+	ipf_fbsd_kenv_get(softc);
+
 	return softc;
 }
 
diff --git a/sys/contrib/ipfilter/netinet/ip_fil.h b/sys/contrib/ipfilter/netinet/ip_fil.h
index be8e023ac0b..a01bd28e727 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil.h
+++ b/sys/contrib/ipfilter/netinet/ip_fil.h
@@ -1551,6 +1551,7 @@ typedef struct ipf_main_softc_s {
 	u_int		ipf_icmptimeout;
 	u_int		ipf_icmpacktimeout;
 	u_int		ipf_iptimeout;
+	u_int		ipf_large_nat;
 	u_long		ipf_ticks;
 	u_long		ipf_userifqs;
 	u_long		ipf_rb_no_mem;
@@ -1657,6 +1658,7 @@ extern	int	ipf_pfil_hook(void);
 extern	int	ipf_pfil_unhook(void);
 extern	void	ipf_event_reg(void);
 extern	void	ipf_event_dereg(void);
+extern	void	ipf_fbsd_kenv_get(ipf_main_softc_t *);
 # endif
 
 # if defined(INSTANCES)
diff --git a/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c b/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
index 15381dfcc57..7e0ac4bc292 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
+++ b/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
@@ -1488,3 +1488,10 @@ ipf_pcksum6(m, ip6, off, len)
 #endif
 }
 #endif
+
+void
+ipf_fbsd_kenv_get(ipf_main_softc_t *softc)
+{
+	TUNABLE_INT_FETCH("net.inet.ipf.large_nat",
+		&softc->ipf_large_nat);
+}
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c
index 6b48543d611..0475a438607 100644
--- a/sys/contrib/ipfilter/netinet/ip_nat.c
+++ b/sys/contrib/ipfilter/netinet/ip_nat.c
@@ -321,11 +321,19 @@ ipf_nat_soft_create(softc)
 
 	softn->ipf_nat_list_tail = &softn->ipf_nat_list;
 
-	softn->ipf_nat_table_max = NAT_TABLE_MAX;
-	softn->ipf_nat_table_sz = NAT_TABLE_SZ;
-	softn->ipf_nat_maprules_sz = NAT_SIZE;
-	softn->ipf_nat_rdrrules_sz = RDR_SIZE;
-	softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE;
+	if (softc->ipf_large_nat) {
+	softn->ipf_nat_table_max = NAT_TABLE_MAX_LARGE;
+	softn->ipf_nat_table_sz = NAT_TABLE_SZ_LARGE;
+	softn->ipf_nat_maprules_sz = NAT_SIZE_LARGE;
+	softn->ipf_nat_rdrrules_sz = RDR_SIZE_LARGE;
+	softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_LARGE;
+	} else {
+	softn->ipf_nat_table_max = NAT_TABLE_MAX_NORMAL;
+	softn->ipf_nat_table_sz = NAT_TABLE_SZ_NORMAL;
+	softn->ipf_nat_maprules_sz = NAT_SIZE_NORMAL;
+	softn->ipf_nat_rdrrules_sz = RDR_SIZE_NORMAL;
+	softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_NORMAL;
+	}
 	softn->ipf_nat_doflush = 0;
 #ifdef  IPFILTER_LOG
 	softn->ipf_nat_logging = 1;
@@ -492,10 +500,8 @@ ipf_nat_soft_init(softc, arg)
 	for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
 		if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
 			tq->ifq_ttl = softn->ipf_nat_deficmpage;
-#ifdef LARGE_NAT
-		else if (tq->ifq_ttl > softn->ipf_nat_defage)
+		else if (tq->ifq_ttl > softn->ipf_nat_defage && softc->ipf_large_nat)
 			tq->ifq_ttl = softn->ipf_nat_defage;
-#endif
 	}
 
 	/*
@@ -6139,10 +6145,8 @@ ipf_nat_log(softc, softn, nat, action)
 	u_int action;
 {
 #ifdef	IPFILTER_LOG
-# ifndef LARGE_NAT
 	struct ipnat *np;
 	int rulen;
-# endif
 	struct natlog natl;
 	void *items[1];
 	size_t sizes[1];
@@ -6178,8 +6182,7 @@ ipf_nat_log(softc, softn, nat, action)
 	bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
 	      sizeof(nat->nat_ifnames[1]));
 
-# ifndef LARGE_NAT
-	if (nat->nat_ptr != NULL) {
+	if (softc->ipf_large_nat && nat->nat_ptr != NULL) {
 		for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
 		     np = np->in_next, rulen++)
 			if (np == nat->nat_ptr) {
@@ -6187,7 +6190,6 @@ ipf_nat_log(softc, softn, nat, action)
 				break;
 			}
 	}
-# endif
 	items[0] = &natl;
 	sizes[0] = sizeof(natl);
 	types[0] = 0;
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.h b/sys/contrib/ipfilter/netinet/ip_nat.h
index bcec72f21f8..aac8c326aa0 100644
--- a/sys/contrib/ipfilter/netinet/ip_nat.h
+++ b/sys/contrib/ipfilter/netinet/ip_nat.h
@@ -34,44 +34,44 @@
 			 * appropriate sizes.  The figures below were used for
 			 * a setup with 1000-2000 networks to NAT.
 			 */
-#ifndef NAT_SIZE
-# ifdef LARGE_NAT
-#  define	NAT_SIZE	2047
-# else
-#  define	NAT_SIZE	127
-# endif
+#ifdef NAT_SIZE
+# define	NAT_SIZE_LARGE		NAT_SIZE
+# define	NAT_SIZE_NORMAL		NAT_SIZE
+#else
+# define	NAT_SIZE_LARGE		2047
+# define	NAT_SIZE_NORMAL		127
 #endif
-#ifndef RDR_SIZE
-# ifdef LARGE_NAT
-#  define	RDR_SIZE	2047
-# else
-#  define	RDR_SIZE	127
-# endif
+#ifdef RDR_SIZE
+# define	RDR_SIZE_LARGE		RDR_SIZE
+# define	RDR_SIZE_NORMAL		RDR_SIZE
+#else
+# define	RDR_SIZE_LARGE		2047
+# define	RDR_SIZE_NORMAL		127
 #endif
-#ifndef HOSTMAP_SIZE
-# ifdef LARGE_NAT
-#  define	HOSTMAP_SIZE	8191
-# else
-#  define	HOSTMAP_SIZE	2047
-# endif
+#ifdef HOSTMAP_SIZE
+# define	HOSTMAP_SIZE_LARGE	HOSTMAP_SIZE
+# define	HOSTMAP_SIZE_NORMAL	HOSTMAP_SIZE
+#else
+# define	HOSTMAP_SIZE_LARGE	8191
+# define	HOSTMAP_SIZE_NORMAL	2047
 #endif
-#ifndef NAT_TABLE_MAX
 /*
  * This is newly introduced and for the sake of "least surprise", the numbers
  * present aren't what we'd normally use for creating a proper hash table.
  */
-# ifdef	LARGE_NAT
-#  define	NAT_TABLE_MAX	180000
-# else
-#  define	NAT_TABLE_MAX	30000
-# endif
+#ifdef NAT_TABLE_MAX
+# define	NAT_TABLE_MAX_LARGE	NAT_TABLE_MAX
+# define	NAT_TABLE_MAX_NORMAL	NAT_TABLE_MAX
+#else
+# define	NAT_TABLE_MAX_LARGE	180000
+# define	NAT_TABLE_MAX_NORMAL	30000
 #endif
-#ifndef NAT_TABLE_SZ
-# ifdef LARGE_NAT
-#  define	NAT_TABLE_SZ	16383
-# else
-#  define	NAT_TABLE_SZ	2047
-# endif
+#ifdef NAT_TABLE_SZ
+# define	NAT_TABLE_SZ_LARGE	NAT_TABLE_SZ
+# define	NAT_TABLE_SZ_NORMAL	NAT_TABLE_SZ
+#else
+# define	NAT_TABLE_SZ_LARGE	16383
+# define	NAT_TABLE_SZ_NORMAL	2047
 #endif
 #ifndef	APR_LABELLEN
 #define	APR_LABELLEN	16
diff --git a/sys/contrib/ipfilter/netinet/mlfk_ipl.c b/sys/contrib/ipfilter/netinet/mlfk_ipl.c
index 57b6ce541be..8d9cb780b9e 100644
--- a/sys/contrib/ipfilter/netinet/mlfk_ipl.c
+++ b/sys/contrib/ipfilter/netinet/mlfk_ipl.c
@@ -80,6 +80,11 @@ static	int	ipfread(dev_t, struct uio *, int);
 static	int	ipfwrite(dev_t, struct uio *, int);
 #endif
 
+#ifdef LARGE_NAT
+#define IPF_LARGE_NAT	1
+#else
+#define IPF_LARGE_NAT	0
+#endif
 
 SYSCTL_DECL(_net_inet);
 #define SYSCTL_IPF(parent, nbr, name, access, ptr, val, descr) \
@@ -132,6 +137,7 @@ SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_running, CTLFLAG_RD,
 	   &VNET_NAME(ipfmain.ipf_running), 0, "IPF is running");
 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_chksrc, CTLFLAG_RW, &VNET_NAME(ipfmain.ipf_chksrc), 0, "");
 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_minttl, CTLFLAG_RW, &VNET_NAME(ipfmain.ipf_minttl), 0, "");
+SYSCTL_IPF(_net_inet_ipf, OID_AUTO, large_nat, CTLFLAG_RD, &VNET_NAME(ipfmain.ipf_large_nat), 0, "large_nat");
 
 #define CDEV_MAJOR 79
 #include <sys/poll.h>
@@ -644,4 +650,3 @@ ipf_fbsd_sysctl_destroy(void)
 	}
 	return 0;
 }
-
diff --git a/sys/dev/acpi_support/acpi_asus.c b/sys/dev/acpi_support/acpi_asus.c
index aa9f41cd6cd..4f7ebdcf3c8 100644
--- a/sys/dev/acpi_support/acpi_asus.c
+++ b/sys/dev/acpi_support/acpi_asus.c
@@ -737,13 +737,13 @@ acpi_asus_attach(device_t dev)
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_asus_sysctls[i].name,
 			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_ANYBODY |
-			    CTLFLAG_NEEDGIANT, sc, i, acpi_asus_sysctl, "I",
+			    CTLFLAG_MPSAFE, sc, i, acpi_asus_sysctl, "I",
 			    acpi_asus_sysctls[i].description);
 		} else {
 			SYSCTL_ADD_PROC(&sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_asus_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 			    sc, i, acpi_asus_sysctl, "I",
 			    acpi_asus_sysctls[i].description);
 		}
diff --git a/sys/dev/acpi_support/acpi_asus_wmi.c b/sys/dev/acpi_support/acpi_asus_wmi.c
index 0f67d65ec87..b675bb3a7ff 100644
--- a/sys/dev/acpi_support/acpi_asus_wmi.c
+++ b/sys/dev/acpi_support/acpi_asus_wmi.c
@@ -428,14 +428,14 @@ next:
 			SYSCTL_ADD_PROC(sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_asus_wmi_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    sc, i, acpi_asus_wmi_sysctl, "I",
 			    acpi_asus_wmi_sysctls[i].description);
 		} else {
 			SYSCTL_ADD_PROC(sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_asus_wmi_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 			    sc, i, acpi_asus_wmi_sysctl, "I",
 			    acpi_asus_wmi_sysctls[i].description);
 		}
diff --git a/sys/dev/acpi_support/acpi_fujitsu.c b/sys/dev/acpi_support/acpi_fujitsu.c
index ebfe00bdca9..8d0f2c5a8d2 100644
--- a/sys/dev/acpi_support/acpi_fujitsu.c
+++ b/sys/dev/acpi_support/acpi_fujitsu.c
@@ -417,7 +417,7 @@ acpi_fujitsu_init(struct acpi_fujitsu_softc *sc)
 		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 		    sysctl_table[i].name,
 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_ANYBODY |
-		    CTLFLAG_NEEDGIANT, sc, i, acpi_fujitsu_sysctl, "I",
+		    CTLFLAG_MPSAFE, sc, i, acpi_fujitsu_sysctl, "I",
 		    sysctl_table[i].description);
 	}
 
diff --git a/sys/dev/acpi_support/acpi_hp.c b/sys/dev/acpi_support/acpi_hp.c
index 0b77475a6ba..d22c9844638 100644
--- a/sys/dev/acpi_support/acpi_hp.c
+++ b/sys/dev/acpi_support/acpi_hp.c
@@ -593,14 +593,14 @@ acpi_hp_attach(device_t dev)
 			SYSCTL_ADD_PROC(sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_hp_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    sc, i, acpi_hp_sysctl, "I",
 			    acpi_hp_sysctls[i].description);
 		} else {
 			SYSCTL_ADD_PROC(sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_hp_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 			    sc, i, acpi_hp_sysctl, "I",
 			    acpi_hp_sysctls[i].description);
 		}
diff --git a/sys/dev/acpi_support/acpi_ibm.c b/sys/dev/acpi_support/acpi_ibm.c
index 99df9efd252..84b17dbe9bd 100644
--- a/sys/dev/acpi_support/acpi_ibm.c
+++ b/sys/dev/acpi_support/acpi_ibm.c
@@ -546,14 +546,14 @@ acpi_ibm_attach(device_t dev)
 			SYSCTL_ADD_PROC(sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_ibm_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    sc, i, acpi_ibm_sysctl, "I",
 			    acpi_ibm_sysctls[i].description);
 		} else {
 			SYSCTL_ADD_PROC(sc->sysctl_ctx,
 			    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 			    acpi_ibm_sysctls[i].name,
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 			    sc, i, acpi_ibm_sysctl, "I",
 			    acpi_ibm_sysctls[i].description);
 		}
@@ -563,7 +563,7 @@ acpi_ibm_attach(device_t dev)
 	if (acpi_ibm_sysctl_init(sc, ACPI_IBM_METHOD_THERMAL)) {
 		SYSCTL_ADD_PROC(sc->sysctl_ctx,
 		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "thermal",
-		    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT, sc, 0,
+		    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, sc, 0,
 		    acpi_ibm_thermal_sysctl, "I", "Thermal zones");
 	}
 
@@ -571,7 +571,7 @@ acpi_ibm_attach(device_t dev)
 	if (acpi_ibm_sysctl_init(sc, ACPI_IBM_METHOD_HANDLEREVENTS)) {
 		SYSCTL_ADD_PROC(sc->sysctl_ctx,
 		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "handlerevents",
-		    CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
+		    CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE, sc, 0,
 		    acpi_ibm_handlerevents_sysctl, "I",
 		    "devd(8) events handled by acpi_ibm");
 	}
diff --git a/sys/dev/acpi_support/acpi_panasonic.c b/sys/dev/acpi_support/acpi_panasonic.c
index 2dd5bf19d7d..9c32ab9fad2 100644
--- a/sys/dev/acpi_support/acpi_panasonic.c
+++ b/sys/dev/acpi_support/acpi_panasonic.c
@@ -174,7 +174,7 @@ acpi_panasonic_attach(device_t dev)
 		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 		    sysctl_table[i].name,
 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_ANYBODY |
-		    CTLFLAG_NEEDGIANT, sc, i, acpi_panasonic_sysctl, "I", "");
+		    CTLFLAG_MPSAFE, sc, i, acpi_panasonic_sysctl, "I", "");
 	}
 
 #if 0
diff --git a/sys/dev/acpi_support/acpi_rapidstart.c b/sys/dev/acpi_support/acpi_rapidstart.c
index 0724abdefca..eb47f347785 100644
--- a/sys/dev/acpi_support/acpi_rapidstart.c
+++ b/sys/dev/acpi_support/acpi_rapidstart.c
@@ -89,14 +89,14 @@ acpi_rapidstart_attach(device_t dev)
 			SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 			    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
 			    i, acpi_rapidstart_oids[i].nodename,
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 			    dev, i, sysctl_acpi_rapidstart_gen_handler, "I",
 			    acpi_rapidstart_oids[i].comment);
 		} else {
 			SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 			    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
 			    i, acpi_rapidstart_oids[i].nodename,
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    dev, i, sysctl_acpi_rapidstart_gen_handler, "I",
 			    acpi_rapidstart_oids[i].comment);
 		}
diff --git a/sys/dev/acpi_support/acpi_sony.c b/sys/dev/acpi_support/acpi_sony.c
index 0cfb312b552..724f04a3630 100644
--- a/sys/dev/acpi_support/acpi_sony.c
+++ b/sys/dev/acpi_support/acpi_sony.c
@@ -137,14 +137,14 @@ acpi_sony_attach(device_t dev)
 			SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 			    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
 			    i, acpi_sony_oids[i].nodename ,
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 			    dev, i, sysctl_acpi_sony_gen_handler, "I",
 			    acpi_sony_oids[i].comment);
 		} else {
 			SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 			    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
 			    i, acpi_sony_oids[i].nodename ,
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    dev, i, sysctl_acpi_sony_gen_handler, "I",
 			    acpi_sony_oids[i].comment);
 		}
diff --git a/sys/dev/acpi_support/acpi_toshiba.c b/sys/dev/acpi_support/acpi_toshiba.c
index a9b537edf99..c5233579d56 100644
--- a/sys/dev/acpi_support/acpi_toshiba.c
+++ b/sys/dev/acpi_support/acpi_toshiba.c
@@ -254,7 +254,7 @@ acpi_toshiba_attach(device_t dev)
 		    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO,
 		    sysctl_table[i].name,
 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_ANYBODY |
-		    CTLFLAG_NEEDGIANT, sc, i, acpi_toshiba_sysctl, "I", "");
+		    CTLFLAG_MPSAFE, sc, i, acpi_toshiba_sysctl, "I", "");
 	}
 
 	if (enable_fn_keys != 0) {
diff --git a/sys/dev/acpi_support/atk0110.c b/sys/dev/acpi_support/atk0110.c
index 202421120e6..3aac4562408 100644
--- a/sys/dev/acpi_support/atk0110.c
+++ b/sys/dev/acpi_support/atk0110.c
@@ -234,7 +234,7 @@ aibs_sensor_added(struct aibs_softc *sc, struct sysctl_oid *so,
 #endif
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(sc->sc_dev),
 	    SYSCTL_CHILDREN(so), idx, sysctl_name,
-	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT, sc, (uintptr_t)sensor,
+	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, sc, (uintptr_t)sensor,
 	    sc->sc_ggrp_method ? aibs_sysctl_ggrp : aibs_sysctl,
 	    sensor->t == AIBS_SENS_TYPE_TEMP ? "IK" : "I", descr);
 }
diff --git a/sys/dev/acpica/acpi.c b/sys/dev/acpica/acpi.c
index 18623a6ab24..c5c0a38e300 100644
--- a/sys/dev/acpica/acpi.c
+++ b/sys/dev/acpica/acpi.c
@@ -273,7 +273,7 @@ TUNABLE_STR("hw.acpi.remove_interface", acpi_remove_interface,
 static int acpi_debug_objects;
 TUNABLE_INT("debug.acpi.enable_debug_objects", &acpi_debug_objects);
 SYSCTL_PROC(_debug_acpi, OID_AUTO, enable_debug_objects,
-    CTLFLAG_RW | CTLTYPE_INT | CTLFLAG_NEEDGIANT, NULL, 0,
+    CTLFLAG_RW | CTLTYPE_INT | CTLFLAG_MPSAFE, NULL, 0,
     acpi_debug_objects_sysctl, "I",
     "Enable Debug objects");
 
@@ -559,31 +559,31 @@ acpi_attach(device_t dev)
 	CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "");
     SYSCTL_ADD_PROC(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "supported_sleep_state",
-	CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+	CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	0, 0, acpi_supported_sleep_state_sysctl, "A",
 	"List supported ACPI sleep states.");
     SYSCTL_ADD_PROC(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "power_button_state",
-	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	&sc->acpi_power_button_sx, 0, acpi_sleep_state_sysctl, "A",
 	"Power button ACPI sleep state.");
     SYSCTL_ADD_PROC(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "sleep_button_state",
-	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	&sc->acpi_sleep_button_sx, 0, acpi_sleep_state_sysctl, "A",
 	"Sleep button ACPI sleep state.");
     SYSCTL_ADD_PROC(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "lid_switch_state",
-	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	&sc->acpi_lid_switch_sx, 0, acpi_sleep_state_sysctl, "A",
 	"Lid ACPI sleep state. Set to S3 if you want to suspend your laptop when close the Lid.");
     SYSCTL_ADD_PROC(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "standby_state",
-	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	&sc->acpi_standby_sx, 0, acpi_sleep_state_sysctl, "A", "");
     SYSCTL_ADD_PROC(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "suspend_state",
-	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	&sc->acpi_suspend_sx, 0, acpi_sleep_state_sysctl, "A", "");
     SYSCTL_ADD_INT(&sc->acpi_sysctl_ctx, SYSCTL_CHILDREN(sc->acpi_sysctl_tree),
 	OID_AUTO, "sleep_delay", CTLFLAG_RW, &sc->acpi_sleep_delay, 0,
@@ -4199,11 +4199,11 @@ acpi_debug_sysctl(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_debug_acpi, OID_AUTO, layer,
-    CTLFLAG_RW | CTLTYPE_STRING | CTLFLAG_NEEDGIANT, "debug.acpi.layer", 0,
+    CTLFLAG_RW | CTLTYPE_STRING | CTLFLAG_MPSAFE, "debug.acpi.layer", 0,
     acpi_debug_sysctl, "A",
     "");
 SYSCTL_PROC(_debug_acpi, OID_AUTO, level,
-    CTLFLAG_RW | CTLTYPE_STRING | CTLFLAG_NEEDGIANT, "debug.acpi.level", 0,
+    CTLFLAG_RW | CTLTYPE_STRING | CTLFLAG_MPSAFE, "debug.acpi.level", 0,
     acpi_debug_sysctl, "A",
     "");
 #endif /* ACPI_DEBUG */
diff --git a/sys/dev/acpica/acpi_acad.c b/sys/dev/acpica/acpi_acad.c
index 7f4d025b55f..ac7ff131573 100644
--- a/sys/dev/acpica/acpi_acad.c
+++ b/sys/dev/acpica/acpi_acad.c
@@ -173,7 +173,7 @@ acpi_acad_attach(device_t dev)
 	acpi_sc = acpi_device_get_parent_softc(dev);
 	SYSCTL_ADD_PROC(&acpi_sc->acpi_sysctl_ctx,
 	    SYSCTL_CHILDREN(acpi_sc->acpi_sysctl_tree), OID_AUTO, "acline",
-	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT, &sc->status, 0,
+	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, dev, 0,
 	    acpi_acad_sysctl, "I", "");
     }
 
@@ -219,14 +219,13 @@ acpi_acad_ioctl(u_long cmd, caddr_t addr, void *arg)
 static int
 acpi_acad_sysctl(SYSCTL_HANDLER_ARGS)
 {
-    int val, error;
+    device_t dev = oidp->oid_arg1;
+    struct acpi_acad_softc *sc = device_get_softc(dev);
+    int val;
 
-    if (acpi_acad_get_acline(&val) != 0)
-	return (ENXIO);
-
-    val = *(u_int *)oidp->oid_arg1;
-    error = sysctl_handle_int(oidp, &val, 0, req);
-    return (error);
+    acpi_acad_get_status(dev);
+    val = sc->status;
+    return (sysctl_handle_int(oidp, &val, 0, req));
 }
 
 static void
diff --git a/sys/dev/acpica/acpi_cpu.c b/sys/dev/acpica/acpi_cpu.c
index aac25af830e..3cff973ef21 100644
--- a/sys/dev/acpica/acpi_cpu.c
+++ b/sys/dev/acpica/acpi_cpu.c
@@ -973,7 +973,7 @@ acpi_cpu_startup(void *arg)
 
     /* Add a sysctl handler to handle global Cx lowest setting */
     SYSCTL_ADD_PROC(&cpu_sysctl_ctx, SYSCTL_CHILDREN(cpu_sysctl_tree),
-	OID_AUTO, "cx_lowest", CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	OID_AUTO, "cx_lowest", CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	NULL, 0, acpi_cpu_global_cx_lowest_sysctl, "A",
 	"Global lowest Cx sleep state to use");
 
@@ -1018,23 +1018,23 @@ acpi_cpu_startup_cx(struct acpi_cpu_softc *sc)
 		      "Cx/microsecond values for supported Cx states");
     SYSCTL_ADD_PROC(&sc->cpu_sysctl_ctx,
         SYSCTL_CHILDREN(device_get_sysctl_tree(sc->cpu_dev)), OID_AUTO,
-	"cx_lowest", CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	"cx_lowest", CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	(void *)sc, 0, acpi_cpu_cx_lowest_sysctl, "A",
 	"lowest Cx sleep state to use");
     SYSCTL_ADD_PROC(&sc->cpu_sysctl_ctx,
         SYSCTL_CHILDREN(device_get_sysctl_tree(sc->cpu_dev)), OID_AUTO,
-	"cx_usage", CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+	"cx_usage", CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	(void *)sc, 0, acpi_cpu_usage_sysctl, "A",
 	"percent usage for each Cx state");
     SYSCTL_ADD_PROC(&sc->cpu_sysctl_ctx,
         SYSCTL_CHILDREN(device_get_sysctl_tree(sc->cpu_dev)), OID_AUTO,
-	"cx_usage_counters", CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+	"cx_usage_counters", CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	(void *)sc, 0, acpi_cpu_usage_counters_sysctl, "A",
 	"Cx sleep state counters");
 #if defined(__i386__) || defined(__amd64__)
     SYSCTL_ADD_PROC(&sc->cpu_sysctl_ctx,
         SYSCTL_CHILDREN(device_get_sysctl_tree(sc->cpu_dev)), OID_AUTO,
-	"cx_method", CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+	"cx_method", CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	(void *)sc, 0, acpi_cpu_method_sysctl, "A", "Cx entrance methods");
 #endif
 
@@ -1339,33 +1339,29 @@ acpi_cpu_quirks_piix4(void)
 static int
 acpi_cpu_usage_sysctl(SYSCTL_HANDLER_ARGS)
 {
-    struct acpi_cpu_softc *sc;
-    struct sbuf	 sb;
-    char	 buf[128];
-    int		 i;
-    uintmax_t	 fract, sum, whole;
+	struct acpi_cpu_softc *sc = (struct acpi_cpu_softc *)arg1;
+	struct sbuf	 sb;
+	char		 buf[128];
+	int		 error, i;
+	uintmax_t	 fract, sum, whole;
 
-    sc = (struct acpi_cpu_softc *) arg1;
-    sum = 0;
-    for (i = 0; i < sc->cpu_cx_count; i++)
-	sum += sc->cpu_cx_stats[i];
-    sbuf_new(&sb, buf, sizeof(buf), SBUF_FIXEDLEN);
-    for (i = 0; i < sc->cpu_cx_count; i++) {
-	if (sum > 0) {
-	    whole = (uintmax_t)sc->cpu_cx_stats[i] * 100;
-	    fract = (whole % sum) * 100;
-	    sbuf_printf(&sb, "%u.%02u%% ", (u_int)(whole / sum),
-		(u_int)(fract / sum));
-	} else
-	    sbuf_printf(&sb, "0.00%% ");
-    }
-    sbuf_printf(&sb, "last %dus", sc->cpu_prev_sleep);
-    sbuf_trim(&sb);
-    sbuf_finish(&sb);
-    sysctl_handle_string(oidp, sbuf_data(&sb), sbuf_len(&sb), req);
-    sbuf_delete(&sb);
-
-    return (0);
+	sbuf_new_for_sysctl(&sb, buf, sizeof(buf), req);
+	sum = 0;
+	for (i = 0; i < sc->cpu_cx_count; i++)
+		sum += sc->cpu_cx_stats[i];
+	for (i = 0; i < sc->cpu_cx_count; i++) {
+		if (sum > 0) {
+			whole = (uintmax_t)sc->cpu_cx_stats[i] * 100;
+			fract = (whole % sum) * 100;
+			sbuf_printf(&sb, "%u.%02u%% ", (u_int)(whole / sum),
+			    (u_int)(fract / sum));
+		} else
+			sbuf_printf(&sb, "0.00%% ");
+	}
+	sbuf_printf(&sb, "last %dus", sc->cpu_prev_sleep);
+	error = sbuf_finish(&sb);
+	sbuf_delete(&sb);
+	return (error);
 }
 
 /*
@@ -1375,42 +1371,37 @@ acpi_cpu_usage_sysctl(SYSCTL_HANDLER_ARGS)
 static int
 acpi_cpu_usage_counters_sysctl(SYSCTL_HANDLER_ARGS)
 {
-    struct acpi_cpu_softc *sc;
-    struct sbuf	 sb;
-    char	 buf[128];
-    int		 i;
+	struct acpi_cpu_softc *sc = (struct acpi_cpu_softc *)arg1;
+	struct sbuf	 sb;
+	char		 buf[128];
+	int		 error, i;
 
-    sc = (struct acpi_cpu_softc *) arg1;
-
-    /* Print out the raw counters */
-    sbuf_new(&sb, buf, sizeof(buf), SBUF_FIXEDLEN);
-
-    for (i = 0; i < sc->cpu_cx_count; i++) {
-        sbuf_printf(&sb, "%u ", sc->cpu_cx_stats[i]);
-    }
-
-    sbuf_trim(&sb);
-    sbuf_finish(&sb);
-    sysctl_handle_string(oidp, sbuf_data(&sb), sbuf_len(&sb), req);
-    sbuf_delete(&sb);
-
-    return (0);
+	sbuf_new_for_sysctl(&sb, buf, sizeof(buf), req);
+	for (i = 0; i < sc->cpu_cx_count; i++) {
+		if (i > 0)
+			sbuf_putc(&sb, ' ');
+		sbuf_printf(&sb, "%u", sc->cpu_cx_stats[i]);
+	}
+	error = sbuf_finish(&sb);
+	sbuf_delete(&sb);
+	return (error);
 }
 
 #if defined(__i386__) || defined(__amd64__)
 static int
 acpi_cpu_method_sysctl(SYSCTL_HANDLER_ARGS)
 {
-	struct acpi_cpu_softc *sc;
+	struct acpi_cpu_softc *sc = (struct acpi_cpu_softc *)arg1;
 	struct acpi_cx *cx;
 	struct sbuf sb;
 	char buf[128];
-	int i;
+	int error, i;
 
-	sc = (struct acpi_cpu_softc *)arg1;
-	sbuf_new(&sb, buf, sizeof(buf), SBUF_FIXEDLEN);
+	sbuf_new_for_sysctl(&sb, buf, sizeof(buf), req);
 	for (i = 0; i < sc->cpu_cx_count; i++) {
 		cx = &sc->cpu_cx_states[i];
+		if (i > 0)
+			sbuf_putc(&sb, ' ');
 		sbuf_printf(&sb, "C%d/", i + 1);
 		if (cx->do_mwait) {
 			sbuf_cat(&sb, "mwait");
@@ -1425,13 +1416,10 @@ acpi_cpu_method_sysctl(SYSCTL_HANDLER_ARGS)
 		}
 		if (cx->type == ACPI_STATE_C1 && cx->p_lvlx != NULL)
 			sbuf_cat(&sb, "/iohlt");
-		sbuf_putc(&sb, ' ');
 	}
-	sbuf_trim(&sb);
-	sbuf_finish(&sb);
-	sysctl_handle_string(oidp, sbuf_data(&sb), sbuf_len(&sb), req);
+	error = sbuf_finish(&sb);
 	sbuf_delete(&sb);
-	return (0);
+	return (error);
 }
 #endif
 
diff --git a/sys/dev/acpica/acpi_dock.c b/sys/dev/acpica/acpi_dock.c
index 4c1b1e7c317..21199464003 100644
--- a/sys/dev/acpica/acpi_dock.c
+++ b/sys/dev/acpica/acpi_dock.c
@@ -517,7 +517,7 @@ acpi_dock_attach(device_t dev)
 	SYSCTL_ADD_PROC(sc->sysctl_ctx,
 		SYSCTL_CHILDREN(sc->sysctl_tree),
 		OID_AUTO, "status",
-		CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, dev, 0,
+		CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, dev, 0,
 		acpi_dock_status_sysctl, "I",
 		"Dock/Undock operation");
 
diff --git a/sys/dev/acpica/acpi_thermal.c b/sys/dev/acpica/acpi_thermal.c
index cd2024be00d..9ff86ae8d82 100644
--- a/sys/dev/acpica/acpi_thermal.c
+++ b/sys/dev/acpica/acpi_thermal.c
@@ -263,15 +263,15 @@ acpi_tz_attach(device_t dev)
         SYSCTL_CHILDREN(acpi_tz_sysctl_tree), OID_AUTO, oidname,
 	CTLFLAG_RD | CTLFLAG_MPSAFE, 0, "", "thermal_zone");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "temperature", CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+        OID_AUTO, "temperature", CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	&sc->tz_temperature, 0, sysctl_handle_int, "IK",
 	"current thermal zone temperature");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "active", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "active", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	0, acpi_tz_active_sysctl, "I", "cooling is active");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
         OID_AUTO, "passive_cooling",
-	CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
+	CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc, 0,
 	acpi_tz_cooling_sysctl, "I",
 	"enable passive (speed reduction) cooling");
 
@@ -279,31 +279,31 @@ acpi_tz_attach(device_t dev)
 		   OID_AUTO, "thermal_flags", CTLFLAG_RD,
 		   &sc->tz_thflags, 0, "thermal zone flags");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_PSV", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "_PSV", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	offsetof(struct acpi_tz_softc, tz_zone.psv), acpi_tz_temp_sysctl, "IK",
 	"passive cooling temp setpoint");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_HOT", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "_HOT", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	offsetof(struct acpi_tz_softc, tz_zone.hot), acpi_tz_temp_sysctl, "IK",
 	"too hot temp setpoint (suspend now)");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_CRT", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "_CRT", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	offsetof(struct acpi_tz_softc, tz_zone.crt), acpi_tz_temp_sysctl, "IK",
 	"critical temp setpoint (shutdown now)");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_ACx", CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+        OID_AUTO, "_ACx", CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	&sc->tz_zone.ac, sizeof(sc->tz_zone.ac), sysctl_handle_opaque, "IK",
 	"");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_TC1", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "_TC1", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	offsetof(struct acpi_tz_softc, tz_zone.tc1), acpi_tz_passive_sysctl,
 	"I", "thermal constant 1 for passive cooling");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_TC2", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "_TC2", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	offsetof(struct acpi_tz_softc, tz_zone.tc2), acpi_tz_passive_sysctl,
 	"I", "thermal constant 2 for passive cooling");
     SYSCTL_ADD_PROC(&sc->tz_sysctl_ctx, SYSCTL_CHILDREN(sc->tz_sysctl_tree),
-        OID_AUTO, "_TSP", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc,
+        OID_AUTO, "_TSP", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc,
 	offsetof(struct acpi_tz_softc, tz_zone.tsp), acpi_tz_passive_sysctl,
 	"I", "thermal sampling period for passive cooling");
 
diff --git a/sys/dev/acpica/acpi_timer.c b/sys/dev/acpica/acpi_timer.c
index e9e488f9022..0acb1761a1e 100644
--- a/sys/dev/acpica/acpi_timer.c
+++ b/sys/dev/acpica/acpi_timer.c
@@ -374,7 +374,7 @@ acpi_timer_sysctl_freq(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_machdep, OID_AUTO, acpi_timer_freq,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, 0, sizeof(u_int),
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 0,
     acpi_timer_sysctl_freq, "I",
     "ACPI timer frequency");
 
diff --git a/sys/dev/acpica/acpi_video.c b/sys/dev/acpica/acpi_video.c
index 917c6548f3a..cbe31d3a66c 100644
--- a/sys/dev/acpica/acpi_video.c
+++ b/sys/dev/acpica/acpi_video.c
@@ -650,33 +650,33 @@ acpi_video_vo_init(UINT32 adr)
 			SYSCTL_ADD_PROC(&vo->vo_sysctl_ctx,
 			    SYSCTL_CHILDREN(vo->vo_sysctl_tree),
 			    OID_AUTO, "active",
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, vo,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, vo,
 			    0, acpi_video_vo_active_sysctl, "I",
 			    "current activity of this device");
 			SYSCTL_ADD_PROC(&vo->vo_sysctl_ctx,
 			    SYSCTL_CHILDREN(vo->vo_sysctl_tree),
 			    OID_AUTO, "brightness",
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, vo,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, vo,
 			    0, acpi_video_vo_bright_sysctl, "I",
 			    "current brightness level");
 			SYSCTL_ADD_PROC(&vo->vo_sysctl_ctx,
 			    SYSCTL_CHILDREN(vo->vo_sysctl_tree),
 			    OID_AUTO, "fullpower",
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, vo,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, vo,
 			    POWER_PROFILE_PERFORMANCE,
 			    acpi_video_vo_presets_sysctl, "I",
 			    "preset level for full power mode");
 			SYSCTL_ADD_PROC(&vo->vo_sysctl_ctx,
 			    SYSCTL_CHILDREN(vo->vo_sysctl_tree),
 			    OID_AUTO, "economy",
-			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, vo,
+			    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, vo,
 			    POWER_PROFILE_ECONOMY,
 			    acpi_video_vo_presets_sysctl, "I",
 			    "preset level for economy mode");
 			SYSCTL_ADD_PROC(&vo->vo_sysctl_ctx,
 			    SYSCTL_CHILDREN(vo->vo_sysctl_tree),
 			    OID_AUTO, "levels",
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT, vo,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, vo,
 			    0, acpi_video_vo_levels_sysctl, "I",
 			    "supported brightness levels");
 		} else
diff --git a/sys/dev/amdtemp/amdtemp.c b/sys/dev/amdtemp/amdtemp.c
index 21227a47c51..493f619c042 100644
--- a/sys/dev/amdtemp/amdtemp.c
+++ b/sys/dev/amdtemp/amdtemp.c
@@ -41,7 +41,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 #include <sys/conf.h>
 #include <sys/kernel.h>
+#include <sys/lock.h>
 #include <sys/module.h>
+#include <sys/mutex.h>
 #include <sys/sysctl.h>
 #include <sys/systm.h>
 
@@ -86,6 +88,7 @@ struct amdtemp_softc {
 	struct sysctl_oid *sc_sysctl_cpu[MAXCPU];
 	struct intr_config_hook sc_ich;
 	device_t	sc_smn;
+	struct mtx	sc_lock;
 };
 
 /*
@@ -479,6 +482,7 @@ amdtemp_attach(device_t dev)
 	if (sc->sc_ncores > MAXCPU)
 		return (ENXIO);
 
+	mtx_init(&sc->sc_lock, "amdtemp", NULL, MTX_DEF);
 	if (erratum319)
 		device_printf(dev,
 		    "Erratum 319: temperature measurement may be inaccurate\n");
@@ -506,7 +510,7 @@ amdtemp_attach(device_t dev)
 	SYSCTL_ADD_PROC(sysctlctx,
 	    SYSCTL_CHILDREN(sysctlnode),
 	    OID_AUTO, "sensor0",
-	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+	    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	    dev, CORE0_SENSOR0, amdtemp_sysctl, "IK",
 	    "Core 0 / Sensor 0 temperature");
 
@@ -518,7 +522,7 @@ amdtemp_attach(device_t dev)
 		SYSCTL_ADD_PROC(sysctlctx,
 		    SYSCTL_CHILDREN(sysctlnode),
 		    OID_AUTO, "sensor1",
-		    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+		    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 		    dev, CORE0_SENSOR1, amdtemp_sysctl, "IK",
 		    "Core 0 / Sensor 1 temperature");
 
@@ -531,14 +535,14 @@ amdtemp_attach(device_t dev)
 			SYSCTL_ADD_PROC(sysctlctx,
 			    SYSCTL_CHILDREN(sysctlnode),
 			    OID_AUTO, "sensor0",
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    dev, CORE1_SENSOR0, amdtemp_sysctl, "IK",
 			    "Core 1 / Sensor 0 temperature");
 
 			SYSCTL_ADD_PROC(sysctlctx,
 			    SYSCTL_CHILDREN(sysctlnode),
 			    OID_AUTO, "sensor1",
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    dev, CORE1_SENSOR1, amdtemp_sysctl, "IK",
 			    "Core 1 / Sensor 1 temperature");
 		}
@@ -591,7 +595,7 @@ amdtemp_intrhook(void *arg)
 			sc->sc_sysctl_cpu[i] = SYSCTL_ADD_PROC(sysctlctx,
 			    SYSCTL_CHILDREN(device_get_sysctl_tree(cpu)),
 			    OID_AUTO, "temperature",
-			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+			    CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 			    dev, sensor, amdtemp_sysctl, "IK",
 			    "Current temparature");
 		}
@@ -612,6 +616,7 @@ amdtemp_detach(device_t dev)
 
 	/* NewBus removes the dev.amdtemp.N tree by itself. */
 
+	mtx_destroy(&sc->sc_lock);
 	return (0);
 }
 
@@ -652,6 +657,8 @@ amdtemp_gettemp0f(device_t dev, amdsensor_t sensor)
 	struct amdtemp_softc *sc = device_get_softc(dev);
 	uint32_t mask, offset, temp;
 
+	mtx_lock(&sc->sc_lock);
+
 	/* Set Sensor/Core selector. */
 	temp = pci_read_config(dev, AMDTEMP_THERMTP_STAT, 1);
 	temp &= ~(AMDTEMP_TTSR_SELCORE | AMDTEMP_TTSR_SELSENSOR);
@@ -683,6 +690,7 @@ amdtemp_gettemp0f(device_t dev, amdsensor_t sensor)
 	temp = ((temp >> 14) & mask) * 5 / 2;
 	temp += AMDTEMP_ZERO_C_TO_K + (sc->sc_offset - offset) * 10;
 
+	mtx_unlock(&sc->sc_lock);
 	return (temp);
 }
 
diff --git a/sys/dev/hwpmc/hwpmc_mod.c b/sys/dev/hwpmc/hwpmc_mod.c
index 8d5d0183d3a..3a5fee9ba15 100644
--- a/sys/dev/hwpmc/hwpmc_mod.c
+++ b/sys/dev/hwpmc/hwpmc_mod.c
@@ -314,7 +314,7 @@ char	pmc_debugstr[PMC_DEBUG_STRSIZE];
 TUNABLE_STR(PMC_SYSCTL_NAME_PREFIX "debugflags", pmc_debugstr,
     sizeof(pmc_debugstr));
 SYSCTL_PROC(_kern_hwpmc, OID_AUTO, debugflags,
-    CTLTYPE_STRING | CTLFLAG_RWTUN | CTLFLAG_NOFETCH | CTLFLAG_NEEDGIANT,
+    CTLTYPE_STRING | CTLFLAG_RWTUN | CTLFLAG_NOFETCH | CTLFLAG_MPSAFE,
     0, 0, pmc_debugflags_sysctl_handler, "A",
     "debug flags");
 #endif
diff --git a/sys/dev/pccbb/pccbb.c b/sys/dev/pccbb/pccbb.c
index c518551e1b4..cc733d6b798 100644
--- a/sys/dev/pccbb/pccbb.c
+++ b/sys/dev/pccbb/pccbb.c
@@ -603,11 +603,7 @@ cbb_func_filt(void *arg)
 		return (FILTER_HANDLED);
 	}
 
-	/*
-	 * nb: don't have to check for giant or not, since that's done in the
-	 * ISR dispatch and one can't hold Giant in a filter anyway...
-	 */
-	return ((*ih->filt)(ih->arg));	
+	return ((*ih->filt)(ih->arg));
 }
 
 static void
@@ -638,11 +634,6 @@ cbb_func_intr(void *arg)
 		}
 	}
 
-	/*
-	 * Call the registered ithread interrupt handler.  This entire routine
-	 * will be called with Giant if this isn't an MP safe driver, or not
-	 * if it is.  Either way, we don't have to worry.
-	 */
 	ih->intr(ih->arg);
 }
 
diff --git a/sys/dev/sound/clone.c b/sys/dev/sound/clone.c
index 3ded510eae5..7d3148750a1 100644
--- a/sys/dev/sound/clone.c
+++ b/sys/dev/sound/clone.c
@@ -99,71 +99,6 @@ struct snd_clone {
 #define SND_CLONE_ASSERT(...)		KASSERT(__VA_ARGS__)
 #endif
 
-/*
- * Shamelessly ripped off from vfs_subr.c
- * We need at least 1/HZ precision as default timestamping.
- */
-enum { SND_TSP_SEC, SND_TSP_HZ, SND_TSP_USEC, SND_TSP_NSEC };
-
-static int snd_timestamp_precision = SND_TSP_HZ;
-TUNABLE_INT("hw.snd.timestamp_precision", &snd_timestamp_precision);
-
-void
-snd_timestamp(struct timespec *tsp)
-{
-	struct timeval tv;
-
-	switch (snd_timestamp_precision) {
-	case SND_TSP_SEC:
-		tsp->tv_sec = time_second;
-		tsp->tv_nsec = 0;
-		break;
-	case SND_TSP_HZ:
-		getnanouptime(tsp);
-		break;
-	case SND_TSP_USEC:
-		microuptime(&tv);
-		TIMEVAL_TO_TIMESPEC(&tv, tsp);
-		break;
-	case SND_TSP_NSEC:
-		nanouptime(tsp);
-		break;
-	default:
-		snd_timestamp_precision = SND_TSP_HZ;
-		getnanouptime(tsp);
-		break;
-	}
-}
-
-#if defined(SND_DIAGNOSTIC) || defined(SND_DEBUG)
-static int
-sysctl_hw_snd_timestamp_precision(SYSCTL_HANDLER_ARGS)
-{
-	int err, val;
-
-	val = snd_timestamp_precision;
-	err = sysctl_handle_int(oidp, &val, 0, req);
-	if (err == 0 && req->newptr != NULL) {
-		switch (val) {
-		case SND_TSP_SEC:
-		case SND_TSP_HZ:
-		case SND_TSP_USEC:
-		case SND_TSP_NSEC:
-			snd_timestamp_precision = val;
-			break;
-		default:
-			break;
-		}
-	}
-
-	return (err);
-}
-SYSCTL_PROC(_hw_snd, OID_AUTO, timestamp_precision,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, 0, sizeof(int),
-    sysctl_hw_snd_timestamp_precision, "I",
-    "timestamp precision (0=s 1=hz 2=us 3=ns)");
-#endif
-
 /*
  * snd_clone_create() : Return opaque allocated clone manager.
  */
@@ -189,7 +124,7 @@ snd_clone_create(int typemask, int maxunit, int deadline, uint32_t flags)
 	    maxunit;
 	c->deadline = deadline;
 	c->flags = flags;
-	snd_timestamp(&c->tsp);
+	getnanouptime(&c->tsp);
 	TAILQ_INIT(&c->head);
 
 	return (c);
@@ -296,17 +231,6 @@ snd_clone_setdeadline(struct snd_clone *c, int deadline)
 	return (c->deadline);
 }
 
-int
-snd_clone_gettime(struct snd_clone *c, struct timespec *tsp)
-{
-	SND_CLONE_ASSERT(c != NULL, ("NULL snd_clone"));
-	SND_CLONE_ASSERT(tsp != NULL, ("NULL timespec"));
-
-	*tsp = c->tsp;
-
-	return (0);
-}
-
 uint32_t
 snd_clone_getflags(struct snd_clone *c)
 {
@@ -327,25 +251,6 @@ snd_clone_setflags(struct snd_clone *c, uint32_t flags)
 	return (c->flags);
 }
 
-int
-snd_clone_getdevtime(struct cdev *dev, struct timespec *tsp)
-{
-	struct snd_clone_entry *ce;
-
-	SND_CLONE_ASSERT(dev != NULL, ("NULL dev"));
-	SND_CLONE_ASSERT(tsp != NULL, ("NULL timespec"));
-
-	ce = dev->si_drv2;
-	if (ce == NULL)
-		return (ENODEV);
-
-	SND_CLONE_ASSERT(ce->parent != NULL, ("NULL parent"));
-
-	*tsp = ce->tsp;
-
-	return (0);
-}
-
 uint32_t
 snd_clone_getdevflags(struct cdev *dev)
 {
@@ -411,7 +316,7 @@ snd_clone_gc(struct snd_clone *c)
 	if (!(c->flags & SND_CLONE_GC_ENABLE) || c->size == 0)
 		return (0);
 
-	snd_timestamp(&now);
+	getnanouptime(&now);
 
 	/*
 	 * Bail out if the last clone handler was invoked below the deadline
@@ -642,7 +547,7 @@ snd_clone_alloc(struct snd_clone *c, struct cdev **dev, int *unit, int tmask)
 	allocunit = (*unit == -1) ? 0 : *unit;
 	curpid = curthread->td_proc->p_pid;
 
-	snd_timestamp(&now);
+	getnanouptime(&now);
 
 	TAILQ_FOREACH(ce, &c->head, link) {
 		/*
diff --git a/sys/dev/sound/clone.h b/sys/dev/sound/clone.h
index 54b26e31c8b..bcfa504ad00 100644
--- a/sys/dev/sound/clone.h
+++ b/sys/dev/sound/clone.h
@@ -99,8 +99,6 @@ struct snd_clone;
 
 #define SND_CLONE_DEVMASK	SND_CLONE_ALLOC
 
-void snd_timestamp(struct timespec *);
-
 struct snd_clone *snd_clone_create(int, int, int, uint32_t);
 int snd_clone_busy(struct snd_clone *);
 int snd_clone_enable(struct snd_clone *);
@@ -110,10 +108,8 @@ int snd_clone_getmaxunit(struct snd_clone *);
 int snd_clone_setmaxunit(struct snd_clone *, int);
 int snd_clone_getdeadline(struct snd_clone *);
 int snd_clone_setdeadline(struct snd_clone *, int);
-int snd_clone_gettime(struct snd_clone *, struct timespec *);
 uint32_t snd_clone_getflags(struct snd_clone *);
 uint32_t snd_clone_setflags(struct snd_clone *, uint32_t);
-int snd_clone_getdevtime(struct cdev *, struct timespec *);
 uint32_t snd_clone_getdevflags(struct cdev *);
 uint32_t snd_clone_setdevflags(struct cdev *, uint32_t);
 int snd_clone_gc(struct snd_clone *);
diff --git a/sys/dev/sound/pci/emu10kx.c b/sys/dev/sound/pci/emu10kx.c
index 5ae76084500..784fd7e27ae 100644
--- a/sys/dev/sound/pci/emu10kx.c
+++ b/sys/dev/sound/pci/emu10kx.c
@@ -1569,7 +1569,7 @@ emu_addefxmixer(struct emu_sc_info *sc, const char *mix_name, const int mix_id,
 		snprintf(sysctl_name, 32, "_%s", mix_name);
 		SYSCTL_ADD_PROC(sc->ctx,
 		    SYSCTL_CHILDREN(sc->root), OID_AUTO, sysctl_name,
-		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, mix_id,
+		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, sc, mix_id,
 		    sysctl_emu_mixer_control, "I", "");
 	}
 
@@ -1609,7 +1609,7 @@ emu_digitalswitch(struct emu_sc_info *sc)
 {
 	/* XXX temporary? */
 	SYSCTL_ADD_PROC(sc->ctx, SYSCTL_CHILDREN(sc->root), OID_AUTO,
-	    "_digital", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+	    "_digital", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 	    sc, 0, sysctl_emu_digitalswitch_control, "I",
 	    "Enable digital output");
 
diff --git a/sys/dev/sound/pcm/channel.c b/sys/dev/sound/pcm/channel.c
index 9574697f865..065bf6ee2c5 100644
--- a/sys/dev/sound/pcm/channel.c
+++ b/sys/dev/sound/pcm/channel.c
@@ -69,7 +69,7 @@ sysctl_hw_snd_latency(SYSCTL_HANDLER_ARGS)
 	return err;
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, latency,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_snd_latency, "I",
     "buffering latency (0=low ... 10=high)");
 
@@ -92,7 +92,7 @@ sysctl_hw_snd_latency_profile(SYSCTL_HANDLER_ARGS)
 	return err;
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, latency_profile,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_snd_latency_profile, "I",
     "buffering latency profile (0=aggressive 1=safe)");
 
@@ -115,7 +115,7 @@ sysctl_hw_snd_timeout(SYSCTL_HANDLER_ARGS)
 	return err;
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, timeout,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_snd_timeout, "I",
     "interrupt timeout (1 - 10) seconds");
 
diff --git a/sys/dev/sound/pcm/feeder_rate.c b/sys/dev/sound/pcm/feeder_rate.c
index 88a58461b1e..f6bb1836089 100644
--- a/sys/dev/sound/pcm/feeder_rate.c
+++ b/sys/dev/sound/pcm/feeder_rate.c
@@ -186,7 +186,7 @@ sysctl_hw_snd_feeder_rate_min(SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_min,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_snd_feeder_rate_min, "I",
     "minimum allowable rate");
 
@@ -209,7 +209,7 @@ sysctl_hw_snd_feeder_rate_max(SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_max,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_snd_feeder_rate_max, "I",
     "maximum allowable rate");
 
@@ -232,7 +232,7 @@ sysctl_hw_snd_feeder_rate_round(SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, feeder_rate_round,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_snd_feeder_rate_round, "I",
     "sample rate converter rounding threshold");
 
diff --git a/sys/dev/sound/pcm/sndstat.c b/sys/dev/sound/pcm/sndstat.c
index 31c4a1b14a7..7eb21c6840e 100644
--- a/sys/dev/sound/pcm/sndstat.c
+++ b/sys/dev/sound/pcm/sndstat.c
@@ -101,7 +101,7 @@ sysctl_hw_sndverbose(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_hw_snd, OID_AUTO, verbose,
-    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_hw_sndverbose, "I",
     "verbosity level");
 
diff --git a/sys/dev/sound/pcm/sound.c b/sys/dev/sound/pcm/sound.c
index 663ec84f93b..dcc2180fe88 100644
--- a/sys/dev/sound/pcm/sound.c
+++ b/sys/dev/sound/pcm/sound.c
@@ -1045,7 +1045,7 @@ pcm_sysinit(device_t dev)
             OID_AUTO, "buffersize", CTLFLAG_RD, &d->bufsz, 0, "allocated buffer size");
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
-	    "bitperfect", CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, d,
+	    "bitperfect", CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, d,
 	    sizeof(d), sysctl_dev_pcm_bitperfect, "I",
 	    "bit-perfect playback/recording (0=disable, 1=enable)");
 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
@@ -1056,18 +1056,18 @@ pcm_sysinit(device_t dev)
 #ifdef SND_DEBUG
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
-	    "clone_flags", CTLTYPE_UINT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT,
+	    "clone_flags", CTLTYPE_UINT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE,
 	    d, sizeof(d), sysctl_dev_pcm_clone_flags, "IU",
 	    "clone flags");
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
-	    "clone_deadline", CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT,
+	    "clone_deadline", CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE,
 	    d, sizeof(d), sysctl_dev_pcm_clone_deadline, "I",
 	    "clone expiration deadline (ms)");
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
 	    "clone_gc",
-	    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, d, sizeof(d),
+	    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, d, sizeof(d),
 	    sysctl_dev_pcm_clone_gc, "I", "clone garbage collector");
 #endif
 	if (d->flags & SD_F_AUTOVCHAN)
diff --git a/sys/dev/sound/usb/uaudio.c b/sys/dev/sound/usb/uaudio.c
index bc5b0d04c02..9f2708abcd0 100644
--- a/sys/dev/sound/usb/uaudio.c
+++ b/sys/dev/sound/usb/uaudio.c
@@ -6021,7 +6021,7 @@ umidi_probe(device_t dev)
 		error = usb_fifo_attach(sc->sc_udev, chan, &chan->mtx,
 		    &umidi_fifo_methods, &sub->fifo, unit, n,
 		    chan->iface_index,
-		    UID_ROOT, GID_OPERATOR, 0644);
+		    UID_ROOT, GID_OPERATOR, 0666);
 		if (error) {
 			goto detach;
 		}
diff --git a/sys/dev/uart/uart_core.c b/sys/dev/uart/uart_core.c
index 89201f3d946..338c091d8c3 100644
--- a/sys/dev/uart/uart_core.c
+++ b/sys/dev/uart/uart_core.c
@@ -209,7 +209,7 @@ uart_pps_init(struct uart_softc *sc)
 #endif
 	TUNABLE_INT_FETCH("hw.uart.pps_mode", &sc->sc_pps_mode);
 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO, "pps_mode",
-	    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, sc, 0, 
+	    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, sc, 0,
 	    uart_pps_mode_sysctl, "I", "pulse mode: 0/1/2=disabled/CTS/DCD; "
 	    "add 0x10 to invert, 0x20 for narrow pulse");
 
diff --git a/sys/fs/msdosfs/msdosfs_vfsops.c b/sys/fs/msdosfs/msdosfs_vfsops.c
index 0f6d41b3c77..939badf458f 100644
--- a/sys/fs/msdosfs/msdosfs_vfsops.c
+++ b/sys/fs/msdosfs/msdosfs_vfsops.c
@@ -456,14 +456,14 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	b710 = (struct byte_bpb710 *)bsp->bs710.bsBPB;
 
 #ifndef MSDOSFS_NOCHECKSIG
-	if (bsp->bs50.bsBootSectSig0 != BOOTSIG0
-	    || bsp->bs50.bsBootSectSig1 != BOOTSIG1) {
+	if (bsp->bs50.bsBootSectSig0 != BOOTSIG0 ||
+	    bsp->bs50.bsBootSectSig1 != BOOTSIG1) {
 		error = EINVAL;
 		goto error_exit;
 	}
 #endif
 
-	pmp = malloc(sizeof *pmp, M_MSDOSFSMNT, M_WAITOK | M_ZERO);
+	pmp = malloc(sizeof(*pmp), M_MSDOSFSMNT, M_WAITOK | M_ZERO);
 	pmp->pm_mountp = mp;
 	pmp->pm_cp = cp;
 	pmp->pm_bo = bo;
@@ -509,7 +509,7 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	 * use these anyway, so we're unaffected if they are
 	 * invalid.
 	 */
-	if (!pmp->pm_BytesPerSec || !SecPerClust) {
+	if (pmp->pm_BytesPerSec == 0 || SecPerClust == 0) {
 		error = EINVAL;
 		goto error_exit;
 	}
@@ -523,8 +523,7 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	}
 
 	if (pmp->pm_RootDirEnts == 0) {
-		if (pmp->pm_FATsecs
-		    || getushort(b710->bpbFSVers)) {
+		if (pmp->pm_FATsecs != 0 || getushort(b710->bpbFSVers) != 0) {
 			error = EINVAL;
 #ifdef MSDOSFS_DEBUG
 			printf("mountmsdosfs(): bad FAT32 filesystem\n");
@@ -535,7 +534,7 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 		pmp->pm_fatmult = 4;
 		pmp->pm_fatdiv = 1;
 		pmp->pm_FATsecs = getulong(b710->bpbBigFATsecs);
-		if (getushort(b710->bpbExtFlags) & FATMIRROR)
+		if ((getushort(b710->bpbExtFlags) & FATMIRROR) != 0)
 			pmp->pm_curfat = getushort(b710->bpbExtFlags) & FATNUM;
 		else
 			pmp->pm_flags |= MSDOSFS_FATMIRROR;
@@ -549,14 +548,11 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	 * - number of sectors:   >= 1, <= size of partition
 	 * - number of FAT sectors: >= 1
 	 */
-	if ( (SecPerClust == 0)
-	  || (SecPerClust & (SecPerClust - 1))
-	  || (pmp->pm_BytesPerSec < DEV_BSIZE)
-	  || (pmp->pm_BytesPerSec & (pmp->pm_BytesPerSec - 1))
-	  || (pmp->pm_HugeSectors == 0)
-	  || (pmp->pm_FATsecs == 0)
-	  || (SecPerClust * pmp->pm_BlkPerSec > MAXBSIZE / DEV_BSIZE)
-	) {
+	if (SecPerClust == 0 || (SecPerClust & (SecPerClust - 1)) != 0 ||
+	    pmp->pm_BytesPerSec < DEV_BSIZE ||
+	    (pmp->pm_BytesPerSec & (pmp->pm_BytesPerSec - 1)) != 0 ||
+	    pmp->pm_HugeSectors == 0 || pmp->pm_FATsecs == 0 ||
+	    SecPerClust * pmp->pm_BlkPerSec > MAXBSIZE / DEV_BSIZE) {
 		error = EINVAL;
 		goto error_exit;
 	}
@@ -570,14 +566,14 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 
 	if (FAT32(pmp)) {
 		pmp->pm_rootdirblk = getulong(b710->bpbRootClust);
-		pmp->pm_firstcluster = pmp->pm_fatblk
-			+ (pmp->pm_FATs * pmp->pm_FATsecs);
+		pmp->pm_firstcluster = pmp->pm_fatblk +
+		    pmp->pm_FATs * pmp->pm_FATsecs;
 		pmp->pm_fsinfo = getushort(b710->bpbFSInfo) * pmp->pm_BlkPerSec;
 	} else {
 		pmp->pm_rootdirblk = pmp->pm_fatblk +
-			(pmp->pm_FATs * pmp->pm_FATsecs);
+		    pmp->pm_FATs * pmp->pm_FATsecs;
 		pmp->pm_rootdirsize = howmany(pmp->pm_RootDirEnts *
-			sizeof(struct direntry), DEV_BSIZE); /* in blocks */
+		    sizeof(struct direntry), DEV_BSIZE); /* in blocks */
 		pmp->pm_firstcluster = pmp->pm_rootdirblk + pmp->pm_rootdirsize;
 	}
 
@@ -586,8 +582,8 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	pmp->pm_fatsize = pmp->pm_FATsecs * DEV_BSIZE;	/* XXX not used? */
 
 	if (pmp->pm_fatmask == 0) {
-		if (pmp->pm_maxcluster
-		    <= ((CLUST_RSRVD - CLUST_FIRST) & FAT12_MASK)) {
+		if (pmp->pm_maxcluster <= ((CLUST_RSRVD - CLUST_FIRST) &
+		    FAT12_MASK)) {
 			/*
 			 * This will usually be a floppy disk. This size makes
 			 * sure that one FAT entry will not be split across
@@ -633,7 +629,7 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	 * Check for valid cluster size
 	 * must be a power of 2
 	 */
-	if (pmp->pm_bpcluster ^ (1 << pmp->pm_cnshift)) {
+	if ((pmp->pm_bpcluster ^ (1 << pmp->pm_cnshift)) != 0) {
 		error = EINVAL;
 		goto error_exit;
 	}
@@ -657,9 +653,9 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 		    NOCRED, &bp)) != 0)
 			goto error_exit;
 		fp = (struct fsinfo *)bp->b_data;
-		if (!bcmp(fp->fsisig1, "RRaA", 4)
-		    && !bcmp(fp->fsisig2, "rrAa", 4)
-		    && !bcmp(fp->fsisig3, "\0\0\125\252", 4)) {
+		if (!bcmp(fp->fsisig1, "RRaA", 4) &&
+		    !bcmp(fp->fsisig2, "rrAa", 4) &&
+		    !bcmp(fp->fsisig3, "\0\0\125\252", 4)) {
 			pmp->pm_nxtfree = getulong(fp->fsinxtfree);
 			if (pmp->pm_nxtfree > pmp->pm_maxcluster)
 				pmp->pm_nxtfree = CLUST_FIRST;
@@ -683,9 +679,8 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	 * Allocate memory for the bitmap of allocated clusters, and then
 	 * fill it in.
 	 */
-	pmp->pm_inusemap = malloc(howmany(pmp->pm_maxcluster + 1, N_INUSEBITS)
-				  * sizeof(*pmp->pm_inusemap),
-				  M_MSDOSFSFAT, M_WAITOK);
+	pmp->pm_inusemap = malloc(howmany(pmp->pm_maxcluster + 1,
+	    N_INUSEBITS) * sizeof(*pmp->pm_inusemap), M_MSDOSFSFAT, M_WAITOK);
 
 	/*
 	 * fillinusemap() needs pm_devvp.
@@ -732,14 +727,14 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp)
 	return (0);
 
 error_exit:
-	if (bp)
+	if (bp != NULL)
 		brelse(bp);
 	if (cp != NULL) {
 		g_topology_lock();
 		g_vfs_close(cp);
 		g_topology_unlock();
 	}
-	if (pmp) {
+	if (pmp != NULL) {
 		lockdestroy(&pmp->pm_fatlock);
 		lockdestroy(&pmp->pm_checkpath_lock);
 		free(pmp->pm_inusemap, M_MSDOSFSFAT);
diff --git a/sys/i386/i386/minidump_machdep_base.c b/sys/i386/i386/minidump_machdep_base.c
index a3f09228fa2..ce26e339d2b 100644
--- a/sys/i386/i386/minidump_machdep_base.c
+++ b/sys/i386/i386/minidump_machdep_base.c
@@ -162,7 +162,7 @@ cpu_minidumpsys(struct dumperinfo *di, const struct minidumpstate *state)
 	uint64_t pa;
 	pd_entry_t *pd, pde;
 	pt_entry_t *pt, pte;
-	int j, k;
+	int k;
 	struct minidumphdr mdhdr;
 	struct msgbuf *mbp;
 
@@ -184,7 +184,6 @@ cpu_minidumpsys(struct dumperinfo *di, const struct minidumpstate *state)
 		 */
 		ptesize += PAGE_SIZE;
 		pd = IdlePTD;	/* always mapped! */
-		j = va >> PDRSHIFT;
 		pde = pte_load(&pd[va >> PDRSHIFT]);
 		if ((pde & (PG_PS | PG_V)) == (PG_PS | PG_V))  {
 			/* This is an entire 2M page. */
diff --git a/sys/i386/i386/pmap.c b/sys/i386/i386/pmap.c
index 52008969308..af5b5ac73ce 100644
--- a/sys/i386/i386/pmap.c
+++ b/sys/i386/i386/pmap.c
@@ -619,7 +619,7 @@ static void
 __CONCAT(PMTYPE, bootstrap)(vm_paddr_t firstaddr)
 {
 	vm_offset_t va;
-	pt_entry_t *pte, *unused;
+	pt_entry_t *pte, *unused __unused;
 	struct pcpu *pc;
 	u_long res;
 	int i;
@@ -3493,7 +3493,7 @@ pmap_promote_pde(pmap_t pmap, pd_entry_t *pde, vm_offset_t va)
 {
 	pd_entry_t newpde;
 	pt_entry_t *firstpte, oldpte, pa, *pte;
-	vm_offset_t oldpteva;
+	vm_offset_t oldpteva __diagused;
 	vm_page_t mpte;
 
 	PMAP_LOCK_ASSERT(pmap, MA_OWNED);
@@ -6252,7 +6252,6 @@ __CONCAT(PMTYPE, sysctl_kmaps)(SYSCTL_HANDLER_ARGS)
 	pd_entry_t pde;
 	pt_entry_t *pt, pte;
 	vm_offset_t sva;
-	vm_paddr_t pa;
 	int error;
 	u_int i, k;
 
@@ -6289,7 +6288,6 @@ __CONCAT(PMTYPE, sysctl_kmaps)(SYSCTL_HANDLER_ARGS)
 			i += NPTEPG;
 			continue;
 		}
-		pa = pde & PG_FRAME;
 		if ((pde & PG_PS) != 0) {
 			sysctl_kmaps_check(sb, &range, sva, pde, 0);
 			range.pdes++;
diff --git a/sys/kern/kern_acct.c b/sys/kern/kern_acct.c
index ad272676083..2a8d2f89280 100644
--- a/sys/kern/kern_acct.c
+++ b/sys/kern/kern_acct.c
@@ -187,7 +187,7 @@ sysctl_acct_chkfreq(SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_kern, OID_AUTO, acct_chkfreq,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &acctchkfreq, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &acctchkfreq, 0,
     sysctl_acct_chkfreq, "I",
     "frequency for checking the free space");
 
diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c
index 3a389e1f2fd..997ad16b211 100644
--- a/sys/kern/kern_mbuf.c
+++ b/sys/kern/kern_mbuf.c
@@ -223,7 +223,7 @@ sysctl_nmbclusters(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbclusters,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &nmbclusters, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &nmbclusters, 0,
     sysctl_nmbclusters, "IU",
     "Maximum number of mbuf clusters allowed");
 
@@ -245,7 +245,7 @@ sysctl_nmbjumbop(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbop,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &nmbjumbop, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &nmbjumbop, 0,
     sysctl_nmbjumbop, "IU",
     "Maximum number of mbuf page size jumbo clusters allowed");
 
@@ -267,7 +267,7 @@ sysctl_nmbjumbo9(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbo9,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &nmbjumbo9, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &nmbjumbo9, 0,
     sysctl_nmbjumbo9, "IU",
     "Maximum number of mbuf 9k jumbo clusters allowed");
 
@@ -289,7 +289,7 @@ sysctl_nmbjumbo16(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbjumbo16,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &nmbjumbo16, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &nmbjumbo16, 0,
     sysctl_nmbjumbo16, "IU",
     "Maximum number of mbuf 16k jumbo clusters allowed");
 
@@ -311,7 +311,7 @@ sysctl_nmbufs(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, nmbufs,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
     &nmbufs, 0, sysctl_nmbufs, "IU",
     "Maximum number of mbufs allowed");
 
diff --git a/sys/kern/kern_sendfile.c b/sys/kern/kern_sendfile.c
index d3043d16f4e..e724a28487d 100644
--- a/sys/kern/kern_sendfile.c
+++ b/sys/kern/kern_sendfile.c
@@ -158,7 +158,7 @@ sfstat_sysctl(SYSCTL_HANDLER_ARGS)
 	return (SYSCTL_OUT(req, &s, sizeof(s)));
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat,
-    CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_NEEDGIANT, NULL, 0,
+    CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0,
     sfstat_sysctl, "I",
     "sendfile statistics");
 
diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c
index 0c5e9f41f15..6f656ba9210 100644
--- a/sys/kern/kern_sig.c
+++ b/sys/kern/kern_sig.c
@@ -3577,7 +3577,7 @@ sysctl_debug_num_cores_check (SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_debug, OID_AUTO, ncores,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_debug_num_cores_check, "I",
     "Maximum number of generated process corefiles while using index format");
 
diff --git a/sys/kern/kern_switch.c b/sys/kern/kern_switch.c
index d8b735ccda7..aec3b3d10e0 100644
--- a/sys/kern/kern_switch.c
+++ b/sys/kern/kern_switch.c
@@ -143,7 +143,7 @@ sysctl_stats_reset(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_kern_sched_stats, OID_AUTO, reset,
-    CTLTYPE_INT | CTLFLAG_WR | CTLFLAG_NEEDGIANT, NULL, 0,
+    CTLTYPE_INT | CTLFLAG_WR | CTLFLAG_MPSAFE, NULL, 0,
     sysctl_stats_reset, "I",
     "Reset scheduler statistics");
 #endif
diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c
index 185a39cdb0e..84333535dbf 100644
--- a/sys/kern/subr_bus.c
+++ b/sys/kern/subr_bus.c
@@ -246,7 +246,7 @@ devclass_sysctl_init(devclass_t dc)
 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
 	SYSCTL_ADD_PROC(&dc->sysctl_ctx, SYSCTL_CHILDREN(dc->sysctl_tree),
 	    OID_AUTO, "%parent",
-	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
 	    dc, DEVCLASS_SYSCTL_PARENT, devclass_sysctl_handler, "A",
 	    "parent class");
 }
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index 4fa94fb3019..d78bddb284f 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -50,6 +50,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/protosw.h>
 #include <sys/uio.h>
 #include <sys/vmmeter.h>
+#include <sys/sbuf.h>
 #include <sys/sdt.h>
 #include <vm/vm.h>
 #include <vm/vm_pageout.h>
@@ -2118,16 +2119,6 @@ struct mbufprofile {
 	uintmax_t segments[MP_BUCKETS];
 } mbprof;
 
-#define MP_MAXDIGITS 21	/* strlen("16,000,000,000,000,000,000") == 21 */
-#define MP_NUMLINES 6
-#define MP_NUMSPERLINE 16
-#define MP_EXTRABYTES 64	/* > strlen("used:\nwasted:\nsegments:\n") */
-/* work out max space needed and add a bit of spare space too */
-#define MP_MAXLINE ((MP_MAXDIGITS+1) * MP_NUMSPERLINE)
-#define MP_BUFSIZE ((MP_MAXLINE * MP_NUMLINES) + 1 + MP_EXTRABYTES)
-
-char mbprofbuf[MP_BUFSIZE];
-
 void
 m_profile(struct mbuf *m)
 {
@@ -2163,16 +2154,18 @@ m_profile(struct mbuf *m)
 	mbprof.wasted[fls(wasted)]++;
 }
 
-static void
-mbprof_textify(void)
+static int
+mbprof_handler(SYSCTL_HANDLER_ARGS)
 {
-	int offset;
-	char *c;
+	char buf[256];
+	struct sbuf sb;
+	int error;
 	uint64_t *p;
 
+	sbuf_new_for_sysctl(&sb, buf, sizeof(buf), req);
+
 	p = &mbprof.wasted[0];
-	c = mbprofbuf;
-	offset = snprintf(c, MP_MAXLINE + 10,
+	sbuf_printf(&sb,
 	    "wasted:\n"
 	    "%ju %ju %ju %ju %ju %ju %ju %ju "
 	    "%ju %ju %ju %ju %ju %ju %ju %ju\n",
@@ -2180,16 +2173,14 @@ mbprof_textify(void)
 	    p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
 #ifdef BIG_ARRAY
 	p = &mbprof.wasted[16];
-	c += offset;
-	offset = snprintf(c, MP_MAXLINE,
+	sbuf_printf(&sb,
 	    "%ju %ju %ju %ju %ju %ju %ju %ju "
 	    "%ju %ju %ju %ju %ju %ju %ju %ju\n",
 	    p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],
 	    p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
 #endif
 	p = &mbprof.used[0];
-	c += offset;
-	offset = snprintf(c, MP_MAXLINE + 10,
+	sbuf_printf(&sb,
 	    "used:\n"
 	    "%ju %ju %ju %ju %ju %ju %ju %ju "
 	    "%ju %ju %ju %ju %ju %ju %ju %ju\n",
@@ -2197,16 +2188,14 @@ mbprof_textify(void)
 	    p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
 #ifdef BIG_ARRAY
 	p = &mbprof.used[16];
-	c += offset;
-	offset = snprintf(c, MP_MAXLINE,
+	sbuf_printf(&sb,
 	    "%ju %ju %ju %ju %ju %ju %ju %ju "
 	    "%ju %ju %ju %ju %ju %ju %ju %ju\n",
 	    p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],
 	    p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
 #endif
 	p = &mbprof.segments[0];
-	c += offset;
-	offset = snprintf(c, MP_MAXLINE + 10,
+	sbuf_printf(&sb,
 	    "segments:\n"
 	    "%ju %ju %ju %ju %ju %ju %ju %ju "
 	    "%ju %ju %ju %ju %ju %ju %ju %ju\n",
@@ -2214,22 +2203,15 @@ mbprof_textify(void)
 	    p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
 #ifdef BIG_ARRAY
 	p = &mbprof.segments[16];
-	c += offset;
-	offset = snprintf(c, MP_MAXLINE,
+	sbuf_printf(&sb,
 	    "%ju %ju %ju %ju %ju %ju %ju %ju "
 	    "%ju %ju %ju %ju %ju %ju %ju %jju",
 	    p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],
 	    p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
 #endif
-}
 
-static int
-mbprof_handler(SYSCTL_HANDLER_ARGS)
-{
-	int error;
-
-	mbprof_textify();
-	error = SYSCTL_OUT(req, mbprofbuf, strlen(mbprofbuf) + 1);
+	error = sbuf_finish(&sb);
+	sbuf_delete(&sb);
 	return (error);
 }
 
@@ -2251,12 +2233,12 @@ mbprof_clr_handler(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_kern_ipc, OID_AUTO, mbufprofile,
-    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT, NULL, 0,
+    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
     mbprof_handler, "A",
     "mbuf profiling statistics");
 
 SYSCTL_PROC(_kern_ipc, OID_AUTO, mbufprofileclr,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, NULL, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0,
     mbprof_clr_handler, "I",
     "clear mbuf profiling statistics");
 #endif
diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c
index bb179043682..d4db1959839 100644
--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -1784,7 +1784,7 @@ sbtoxsockbuf(struct sockbuf *sb, struct xsockbuf *xsb)
 static int dummy;
 SYSCTL_INT(_kern, KERN_DUMMY, dummy, CTLFLAG_RW | CTLFLAG_SKIP, &dummy, 0, "");
 SYSCTL_OID(_kern_ipc, KIPC_MAXSOCKBUF, maxsockbuf,
-    CTLTYPE_ULONG | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &sb_max, 0,
+    CTLTYPE_ULONG | CTLFLAG_RW | CTLFLAG_MPSAFE, &sb_max, 0,
     sysctl_handle_sb_max, "LU",
     "Maximum socket buffer size");
 SYSCTL_ULONG(_kern_ipc, KIPC_SOCKBUF_WASTE, sockbuf_waste_factor, CTLFLAG_RW,
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 92ee7e1f97d..1fd63640988 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -238,11 +238,11 @@ sysctl_somaxconn(SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, soacceptqueue,
-    CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_somaxconn, "I",
     "Maximum listen socket pending connection accept queue size");
 SYSCTL_PROC(_kern_ipc, KIPC_SOMAXCONN, somaxconn,
-    CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_SKIP | CTLFLAG_NEEDGIANT, 0,
+    CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_SKIP | CTLFLAG_MPSAFE, 0,
     sizeof(int), sysctl_somaxconn, "I",
     "Maximum listen socket pending connection accept queue size (compat)");
 
@@ -374,7 +374,7 @@ sysctl_maxsockets(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_kern_ipc, OID_AUTO, maxsockets,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, &maxsockets, 0,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, &maxsockets, 0,
     sysctl_maxsockets, "IU",
     "Maximum number of sockets available");
 
@@ -2115,7 +2115,6 @@ dontblock:
 			else
 				m_freem(cm);
 			if (controlp != NULL) {
-				orig_resid = 0;
 				while (*controlp != NULL)
 					controlp = &(*controlp)->m_next;
 			}
diff --git a/sys/mips/mips/support.S b/sys/mips/mips/support.S
index 13a2d32a156..cfcdc27b1d0 100644
--- a/sys/mips/mips/support.S
+++ b/sys/mips/mips/support.S
@@ -272,6 +272,19 @@ LEAF(fubyte)
 	PTR_S	zero, U_PCB_ONFAULT(v1)
 END(fubyte)
 
+LEAF(suword16)
+	PTR_LA	v0, fswberr
+	blt	a0, zero, fswberr	# make sure address is in user space
+	nop
+	GET_CPU_PCPU(v1)
+	PTR_L	v1, PC_CURPCB(v1)
+	PTR_S	v0, U_PCB_ONFAULT(v1)
+	sh	a1, 0(a0)		# store short
+	PTR_S	zero, U_PCB_ONFAULT(v1)
+	j	ra
+	move	v0, zero
+END(suword16)
+
 LEAF(suword32)
 #ifndef __mips_n64
 XLEAF(suword)
diff --git a/sys/modules/iwlwififw/iwlwifi-3160-fw/Makefile b/sys/modules/iwlwififw/iwlwifi-3160-fw/Makefile
index f55bc1a8080..5528a9f269c 100644
--- a/sys/modules/iwlwififw/iwlwifi-3160-fw/Makefile
+++ b/sys/modules/iwlwififw/iwlwifi-3160-fw/Makefile
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
-FWVERSION=	9
+FWVERSION=	17
 NAME=		3160
 
 .include <bsd.kmod.mk>
diff --git a/sys/modules/iwlwififw/iwlwifi-7260-fw/Makefile b/sys/modules/iwlwififw/iwlwifi-7260-fw/Makefile
index fa2d9d067e8..5f43dcd6c07 100644
--- a/sys/modules/iwlwififw/iwlwifi-7260-fw/Makefile
+++ b/sys/modules/iwlwififw/iwlwifi-7260-fw/Makefile
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
-FWVERSION=	9
+FWVERSION=	17
 NAME=		7260
 
 .include <bsd.kmod.mk>
diff --git a/sys/modules/iwlwififw/iwlwifi-7265-fw/Makefile b/sys/modules/iwlwififw/iwlwifi-7265-fw/Makefile
index 69fc2849cda..7893353a88c 100644
--- a/sys/modules/iwlwififw/iwlwifi-7265-fw/Makefile
+++ b/sys/modules/iwlwififw/iwlwifi-7265-fw/Makefile
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
-FWVERSION=	9
+FWVERSION=	17
 NAME=		7265
 
 .include <bsd.kmod.mk>
diff --git a/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c b/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
index a79a8cd4850..dee82933633 100644
--- a/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
+++ b/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
@@ -152,6 +152,11 @@ static ng_disconnect_t	ng_ubt_disconnect;
 static ng_rcvmsg_t	ng_ubt_rcvmsg;
 static ng_rcvdata_t	ng_ubt_rcvdata;
 
+static int ng_usb_isoc_enable = 1;
+
+SYSCTL_INT(_net_bluetooth, OID_AUTO, usb_isoc_enable, CTLFLAG_RWTUN | CTLFLAG_MPSAFE,
+    &ng_usb_isoc_enable, 0, "enable isochronous transfers");
+
 /* Queue length */
 static const struct ng_parse_struct_field	ng_ubt_node_qlen_type_fields[] =
 {
@@ -742,8 +747,9 @@ ubt_attach(device_t dev)
 	}
 
 	/* Setup transfers for both interfaces */
-	if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer,
-			ubt_config, UBT_N_TRANSFER, sc, &sc->sc_if_mtx)) {
+	if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer, ubt_config,
+			ng_usb_isoc_enable ? UBT_N_TRANSFER : UBT_IF_1_ISOC_DT_RD1,
+			sc, &sc->sc_if_mtx)) {
 		UBT_ALERT(sc, "could not allocate transfers\n");
 		goto detach;
 	}
@@ -2007,5 +2013,6 @@ DRIVER_MODULE(ng_ubt, uhub, ubt_driver, ubt_devclass, ubt_modevent, 0);
 MODULE_VERSION(ng_ubt, NG_BLUETOOTH_VERSION);
 MODULE_DEPEND(ng_ubt, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
 MODULE_DEPEND(ng_ubt, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
+MODULE_DEPEND(ng_ubt, ng_bluetooth, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
 MODULE_DEPEND(ng_ubt, usb, 1, 1, 1);
 USB_PNP_HOST_INFO(ubt_devs);
diff --git a/sys/netgraph/ng_base.c b/sys/netgraph/ng_base.c
index 7f3b103aeae..5006b08c965 100644
--- a/sys/netgraph/ng_base.c
+++ b/sys/netgraph/ng_base.c
@@ -3390,7 +3390,7 @@ sysctl_debug_ng_dump_items(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, 0, sizeof(int),
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 0, sizeof(int),
     sysctl_debug_ng_dump_items, "I",
     "Number of allocated items");
 #endif	/* NETGRAPH_DEBUG */
diff --git a/sys/netinet/libalias/alias.c b/sys/netinet/libalias/alias.c
index 39e9b060623..37f5bd5a1db 100644
--- a/sys/netinet/libalias/alias.c
+++ b/sys/netinet/libalias/alias.c
@@ -721,21 +721,37 @@ ProtoAliasOut(struct libalias *la, struct ip *pip,
 	return (PKT_ALIAS_IGNORED);
 }
 
+#define MF_ISSET(_pip) (ntohs((_pip)->ip_off) & IP_MF)
+#define FRAG_NO_HDR(_pip) (ntohs((_pip)->ip_off) & IP_OFFMASK)
+
+static struct udphdr *
+ValidateUdpLength(struct ip *pip)
+{
+	struct udphdr *ud;
+	size_t dlen;
+
+#ifdef _KERNEL
+	KASSERT(!FRAG_NO_HDR(pip), ("header-less fragment isn't expected here"));
+#endif
+	dlen = ntohs(pip->ip_len) - (pip->ip_hl << 2);
+	if (dlen < sizeof(struct udphdr))
+		return (NULL);
+	ud = (struct udphdr *)ip_next(pip);
+	if (!MF_ISSET(pip) && dlen < ntohs(ud->uh_ulen))
+		return (NULL);
+	return (ud);
+}
+
 static int
 UdpAliasIn(struct libalias *la, struct ip *pip)
 {
 	struct udphdr *ud;
 	struct alias_link *lnk;
-	size_t dlen;
 
 	LIBALIAS_LOCK_ASSERT(la);
 
-	dlen = ntohs(pip->ip_len) - (pip->ip_hl << 2);
-	if (dlen < sizeof(struct udphdr))
-		return (PKT_ALIAS_IGNORED);
-
-	ud = (struct udphdr *)ip_next(pip);
-	if (dlen < ntohs(ud->uh_ulen))
+	ud = ValidateUdpLength(pip);
+	if (ud == NULL)
 		return (PKT_ALIAS_IGNORED);
 
 	lnk = FindUdpTcpIn(la, pip->ip_src, pip->ip_dst,
@@ -828,19 +844,14 @@ UdpAliasOut(struct libalias *la, struct ip *pip, int maxpacketsize, int create)
 	u_short proxy_server_port;
 	int proxy_type;
 	int error;
-	size_t dlen;
 
 	LIBALIAS_LOCK_ASSERT(la);
 
+	ud = ValidateUdpLength(pip);
+	if (ud == NULL)
+		return (PKT_ALIAS_IGNORED);
+
 	/* Return if proxy-only mode is enabled and not proxyrule found.*/
-	dlen = ntohs(pip->ip_len) - (pip->ip_hl << 2);
-	if (dlen < sizeof(struct udphdr))
-		return (PKT_ALIAS_IGNORED);
-
-	ud = (struct udphdr *)ip_next(pip);
-	if (dlen < ntohs(ud->uh_ulen))
-		return (PKT_ALIAS_IGNORED);
-
 	proxy_type = ProxyCheck(la, &proxy_server_address, &proxy_server_port,
 	    pip->ip_src, pip->ip_dst, ud->uh_dport, pip->ip_p);
 	if (proxy_type == 0 && (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY))
@@ -1339,64 +1350,65 @@ LibAliasInLocked(struct libalias *la, struct ip *pip, int maxpacketsize)
 		goto getout;
 	}
 
-	iresult = PKT_ALIAS_IGNORED;
-	if ((ntohs(pip->ip_off) & IP_OFFMASK) == 0) {
-		switch (pip->ip_p) {
-		case IPPROTO_ICMP:
-			iresult = IcmpAliasIn(la, pip);
-			break;
-		case IPPROTO_UDP:
-			iresult = UdpAliasIn(la, pip);
-			break;
-		case IPPROTO_TCP:
-			iresult = TcpAliasIn(la, pip);
-			break;
-#ifdef _KERNEL
-		case IPPROTO_SCTP:
-			iresult = SctpAlias(la, pip, SN_TO_LOCAL);
-			break;
-#endif
-		case IPPROTO_GRE: {
-			int error;
-			struct alias_data ad = {
-				.lnk = NULL,
-				.oaddr = NULL,
-				.aaddr = NULL,
-				.aport = NULL,
-				.sport = NULL,
-				.dport = NULL,
-				.maxpktsize = 0
-			};
-
-			/* Walk out chain. */
-			error = find_handler(IN, IP, la, pip, &ad);
-			if (error == 0)
-				iresult = PKT_ALIAS_OK;
-			else
-				iresult = ProtoAliasIn(la, pip->ip_src,
-				    pip, pip->ip_p, &pip->ip_sum);
-			break;
-		}
-		default:
-			iresult = ProtoAliasIn(la, pip->ip_src, pip,
-			    pip->ip_p, &pip->ip_sum);
-			break;
-		}
-
-		if (ntohs(pip->ip_off) & IP_MF) {
-			struct alias_link *lnk;
-
-			lnk = FindFragmentIn1(la, pip->ip_src, alias_addr, pip->ip_id);
-			if (lnk != NULL) {
-				iresult = PKT_ALIAS_FOUND_HEADER_FRAGMENT;
-				SetFragmentAddr(lnk, pip->ip_dst);
-			} else {
-				iresult = PKT_ALIAS_ERROR;
-			}
-		}
-	} else {
+	if (FRAG_NO_HDR(pip)) {
 		iresult = FragmentIn(la, pip->ip_src, pip, pip->ip_id,
 		    &pip->ip_sum);
+		goto getout;
+	}
+
+	iresult = PKT_ALIAS_IGNORED;
+	switch (pip->ip_p) {
+	case IPPROTO_ICMP:
+		iresult = IcmpAliasIn(la, pip);
+		break;
+	case IPPROTO_UDP:
+		iresult = UdpAliasIn(la, pip);
+		break;
+	case IPPROTO_TCP:
+		iresult = TcpAliasIn(la, pip);
+		break;
+#ifdef _KERNEL
+	case IPPROTO_SCTP:
+		iresult = SctpAlias(la, pip, SN_TO_LOCAL);
+		break;
+#endif
+	case IPPROTO_GRE: {
+		int error;
+		struct alias_data ad = {
+			.lnk = NULL,
+			.oaddr = NULL,
+			.aaddr = NULL,
+			.aport = NULL,
+			.sport = NULL,
+			.dport = NULL,
+			.maxpktsize = 0
+		};
+
+		/* Walk out chain. */
+		error = find_handler(IN, IP, la, pip, &ad);
+		if (error == 0)
+			iresult = PKT_ALIAS_OK;
+		else
+			iresult = ProtoAliasIn(la, pip->ip_src,
+			    pip, pip->ip_p, &pip->ip_sum);
+		break;
+	}
+	default:
+		iresult = ProtoAliasIn(la, pip->ip_src, pip,
+		    pip->ip_p, &pip->ip_sum);
+		break;
+	}
+
+	if (MF_ISSET(pip)) {
+		struct alias_link *lnk;
+
+		lnk = FindFragmentIn1(la, pip->ip_src, alias_addr, pip->ip_id);
+		if (lnk != NULL) {
+			iresult = PKT_ALIAS_FOUND_HEADER_FRAGMENT;
+			SetFragmentAddr(lnk, pip->ip_dst);
+		} else {
+			iresult = PKT_ALIAS_ERROR;
+		}
 	}
 
 getout:
@@ -1492,52 +1504,55 @@ LibAliasOutLocked(struct libalias *la,
 	} else if (la->packetAliasMode & PKT_ALIAS_PROXY_ONLY) {
 		SetDefaultAliasAddress(la, pip->ip_src);
 	}
-	iresult = PKT_ALIAS_IGNORED;
-	if ((ntohs(pip->ip_off) & IP_OFFMASK) == 0) {
-		switch (pip->ip_p) {
-		case IPPROTO_ICMP:
-			iresult = IcmpAliasOut(la, pip, create);
-			break;
-		case IPPROTO_UDP:
-			iresult = UdpAliasOut(la, pip, maxpacketsize, create);
-			break;
-		case IPPROTO_TCP:
-			iresult = TcpAliasOut(la, pip, maxpacketsize, create);
-			break;
-#ifdef _KERNEL
-		case IPPROTO_SCTP:
-			iresult = SctpAlias(la, pip, SN_TO_GLOBAL);
-			break;
-#endif
-		case IPPROTO_GRE: {
-			int error;
-			struct alias_data ad = {
-				.lnk = NULL,
-				.oaddr = NULL,
-				.aaddr = NULL,
-				.aport = NULL,
-				.sport = NULL,
-				.dport = NULL,
-				.maxpktsize = 0
-			};
-			/* Walk out chain. */
-			error = find_handler(OUT, IP, la, pip, &ad);
-			if (error == 0)
-				iresult = PKT_ALIAS_OK;
-			else
-				iresult = ProtoAliasOut(la, pip,
-				    pip->ip_dst, pip->ip_p, &pip->ip_sum, create);
-			break;
-		}
-		default:
-			iresult = ProtoAliasOut(la, pip,
-			    pip->ip_dst, pip->ip_p, &pip->ip_sum, create);
-			break;
-		}
-	} else {
+
+	if (FRAG_NO_HDR(pip)) {
 		iresult = FragmentOut(la, pip, &pip->ip_sum);
+		goto getout_restore;
 	}
 
+	iresult = PKT_ALIAS_IGNORED;
+	switch (pip->ip_p) {
+	case IPPROTO_ICMP:
+		iresult = IcmpAliasOut(la, pip, create);
+		break;
+	case IPPROTO_UDP:
+		iresult = UdpAliasOut(la, pip, maxpacketsize, create);
+		break;
+	case IPPROTO_TCP:
+		iresult = TcpAliasOut(la, pip, maxpacketsize, create);
+		break;
+#ifdef _KERNEL
+	case IPPROTO_SCTP:
+		iresult = SctpAlias(la, pip, SN_TO_GLOBAL);
+		break;
+#endif
+	case IPPROTO_GRE: {
+		int error;
+		struct alias_data ad = {
+			.lnk = NULL,
+			.oaddr = NULL,
+			.aaddr = NULL,
+			.aport = NULL,
+			.sport = NULL,
+			.dport = NULL,
+			.maxpktsize = 0
+		};
+		/* Walk out chain. */
+		error = find_handler(OUT, IP, la, pip, &ad);
+		if (error == 0)
+			iresult = PKT_ALIAS_OK;
+		else
+			iresult = ProtoAliasOut(la, pip,
+			    pip->ip_dst, pip->ip_p, &pip->ip_sum, create);
+		break;
+		}
+	default:
+		iresult = ProtoAliasOut(la, pip,
+		    pip->ip_dst, pip->ip_p, &pip->ip_sum, create);
+		break;
+	}
+
+getout_restore:
 	SetDefaultAliasAddress(la, addr_save);
 getout:
 	return (iresult);
diff --git a/sys/powerpc/powerpc/copyinout.c b/sys/powerpc/powerpc/copyinout.c
index 1528accc0e0..f6720e8ba09 100644
--- a/sys/powerpc/powerpc/copyinout.c
+++ b/sys/powerpc/powerpc/copyinout.c
@@ -99,6 +99,8 @@ int copyout_remap(const void *kaddr, void *udaddr, size_t len);
 int copyout_direct(const void *kaddr, void *udaddr, size_t len);
 int copyin_remap(const void *uaddr, void *kaddr, size_t len);
 int copyin_direct(const void *uaddr, void *kaddr, size_t len);
+int suword16_remap(volatile void *addr, int word);
+int suword16_direct(volatile void *addr, int word);
 int suword32_remap(volatile void *addr, int word);
 int suword32_direct(volatile void *addr, int word);
 int suword_remap(volatile void *addr, long word);
@@ -139,6 +141,7 @@ DEFINE_COPY_FUNC(int, copyinstr, (const void *, void *, size_t, size_t *))
 DEFINE_COPY_FUNC(int, copyin, (const void *, void *, size_t))
 DEFINE_COPY_FUNC(int, copyout, (const void *, void *, size_t))
 DEFINE_COPY_FUNC(int, suword, (volatile void *, long))
+DEFINE_COPY_FUNC(int, suword16, (volatile void *, int))
 DEFINE_COPY_FUNC(int, suword32, (volatile void *, int))
 DEFINE_COPY_FUNC(int, suword64, (volatile void *, int64_t))
 DEFINE_COPY_FUNC(int, fubyte, (volatile const void *))
@@ -314,6 +317,34 @@ REMAP(subyte)(volatile void *addr, int byte)
 	return (0);
 }
 
+int
+REMAP(suword16)(volatile void *addr, int word)
+{
+	struct		thread *td;
+	pmap_t		pm;
+	jmp_buf		env;
+	int16_t		*p;
+
+	td = curthread;
+	pm = &td->td_proc->p_vmspace->vm_pmap;
+
+	td->td_pcb->pcb_onfault = &env;
+	if (setjmp(env)) {
+		td->td_pcb->pcb_onfault = NULL;
+		return (-1);
+	}
+
+	if (pmap_map_user_ptr(pm, addr, (void **)&p, sizeof(*p), NULL)) {
+		td->td_pcb->pcb_onfault = NULL;
+		return (-1);
+	}
+
+	*p = (int16_t)word;
+
+	td->td_pcb->pcb_onfault = NULL;
+	return (0);
+}
+
 #ifdef __powerpc64__
 int
 REMAP(suword32)(volatile void *addr, int word)
diff --git a/sys/powerpc/powerpc/support.S b/sys/powerpc/powerpc/support.S
index 10d3192972d..89dccd55801 100644
--- a/sys/powerpc/powerpc/support.S
+++ b/sys/powerpc/powerpc/support.S
@@ -401,6 +401,14 @@ ENTRY_DIRECT(suword)
 END_DIRECT(suword)
 #endif	
 
+ENTRY_DIRECT(suword16)
+	PROLOGUE
+	SET_FUSUFAULT(%r3, %r7)
+	sth  %r4, 0(%r3)
+	CLEAR_FAULT(%r7)
+	EPILOGUE
+END_DIRECT(suword16)
+
 ENTRY_DIRECT(suword32)
 	PROLOGUE
 	SET_FUSUFAULT(%r3, %r7)
diff --git a/sys/x86/cpufreq/hwpstate_intel.c b/sys/x86/cpufreq/hwpstate_intel.c
index 1ed1056024c..ae63cc6a6ef 100644
--- a/sys/x86/cpufreq/hwpstate_intel.c
+++ b/sys/x86/cpufreq/hwpstate_intel.c
@@ -506,12 +506,12 @@ intel_hwpstate_attach(device_t dev)
 
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 	    SYSCTL_STATIC_CHILDREN(_debug), OID_AUTO, device_get_nameunit(dev),
-	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_NEEDGIANT,
+	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE,
 	    sc, 0, intel_hwp_dump_sysctl_handler, "A", "");
 
 	SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev),
 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
-	    "epp", CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_NEEDGIANT, dev, 0,
+	    "epp", CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, dev, 0,
 	    sysctl_epp_select, "I",
 	    "Efficiency/Performance Preference "
 	    "(range from 0, most performant, through 100, most efficient)");
diff --git a/sys/x86/isa/clock.c b/sys/x86/isa/clock.c
index 51317462689..1178d35979c 100644
--- a/sys/x86/isa/clock.c
+++ b/sys/x86/isa/clock.c
@@ -460,7 +460,7 @@ sysctl_machdep_i8254_freq(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_machdep, OID_AUTO, i8254_freq,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
     0, sizeof(u_int), sysctl_machdep_i8254_freq, "IU",
     "i8254 timer frequency");
 
diff --git a/sys/x86/x86/cpu_machdep.c b/sys/x86/x86/cpu_machdep.c
index 518152a5961..c0011a3bc72 100644
--- a/sys/x86/x86/cpu_machdep.c
+++ b/sys/x86/x86/cpu_machdep.c
@@ -740,7 +740,7 @@ idle_sysctl_available(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_machdep, OID_AUTO, idle_available,
-    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_NEEDGIANT,
+    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE,
     0, 0, idle_sysctl_available, "A",
     "list of available idle functions");
 
@@ -787,7 +787,7 @@ cpu_idle_sysctl(SYSCTL_HANDLER_ARGS)
 }
 
 SYSCTL_PROC(_machdep, OID_AUTO, idle,
-    CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+    CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE,
     0, 0, cpu_idle_sysctl, "A",
     "currently selected idle function");
 
diff --git a/sys/x86/x86/mp_watchdog.c b/sys/x86/x86/mp_watchdog.c
index 018139b049c..0823f90d060 100644
--- a/sys/x86/x86/mp_watchdog.c
+++ b/sys/x86/x86/mp_watchdog.c
@@ -150,7 +150,7 @@ sysctl_watchdog(SYSCTL_HANDLER_ARGS)
 	return (0);
 }
 SYSCTL_PROC(_debug, OID_AUTO, watchdog,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
     0, 0, sysctl_watchdog, "I",
     "");
 
diff --git a/sys/x86/x86/tsc.c b/sys/x86/x86/tsc.c
index 3a1377ff427..b752ad18f05 100644
--- a/sys/x86/x86/tsc.c
+++ b/sys/x86/x86/tsc.c
@@ -858,7 +858,7 @@ sysctl_machdep_tsc_freq(SYSCTL_HANDLER_ARGS)
 	return (error);
 }
 SYSCTL_PROC(_machdep, OID_AUTO, tsc_freq,
-    CTLTYPE_U64 | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
+    CTLTYPE_U64 | CTLFLAG_RW | CTLFLAG_MPSAFE,
     0, 0, sysctl_machdep_tsc_freq, "QU",
     "Time Stamp Counter frequency");
 
diff --git a/usr.sbin/bhyve/pci_passthru.c b/usr.sbin/bhyve/pci_passthru.c
index bf99c646c48..436091cbe8e 100644
--- a/usr.sbin/bhyve/pci_passthru.c
+++ b/usr.sbin/bhyve/pci_passthru.c
@@ -420,7 +420,7 @@ msix_table_write(struct vmctx *ctx, int vcpu, struct passthru_softc *sc,
 }
 
 static int
-init_msix_table(struct vmctx *ctx, struct passthru_softc *sc, uint64_t base)
+init_msix_table(struct vmctx *ctx, struct passthru_softc *sc)
 {
 	struct pci_devinst *pi = sc->psc_pi;
 	struct pci_bar_mmap pbm;
@@ -444,7 +444,7 @@ init_msix_table(struct vmctx *ctx, struct passthru_softc *sc, uint64_t base)
 	memset(&pbm, 0, sizeof(pbm));
 	pbm.pbm_sel = sc->psc_sel;
 	pbm.pbm_flags = PCIIO_BAR_MMAP_RW;
-	pbm.pbm_reg = PCIR_BAR(pi->pi_msix.pba_bar);
+	pbm.pbm_reg = PCIR_BAR(pi->pi_msix.table_bar);
 	pbm.pbm_memattr = VM_MEMATTR_DEVICE;
 
 	if (ioctl(pcifd, PCIOCBARMMAP, &pbm) != 0) {
@@ -462,7 +462,7 @@ init_msix_table(struct vmctx *ctx, struct passthru_softc *sc, uint64_t base)
 	table_size = roundup2(table_size, 4096);
 
 	/*
-	 * Unmap any pages not covered by the table, we do not need to emulate
+	 * Unmap any pages not containing the table, we do not need to emulate
 	 * accesses to them.  Avoid releasing address space to help ensure that
 	 * a buggy out-of-bounds access causes a crash.
 	 */
@@ -471,7 +471,8 @@ init_msix_table(struct vmctx *ctx, struct passthru_softc *sc, uint64_t base)
 		    PROT_NONE) != 0)
 			warn("Failed to unmap MSI-X table BAR region");
 	if (table_offset + table_size != pi->pi_msix.mapped_size)
-		if (mprotect(pi->pi_msix.mapped_addr,
+		if (mprotect(
+		    pi->pi_msix.mapped_addr + table_offset + table_size,
 		    pi->pi_msix.mapped_size - (table_offset + table_size),
 		    PROT_NONE) != 0)
 			warn("Failed to unmap MSI-X table BAR region");
@@ -537,13 +538,6 @@ cfginitbar(struct vmctx *ctx, struct passthru_softc *sc)
 		if (error)
 			return (-1);
 
-		/* The MSI-X table needs special handling */
-		if (i == pci_msix_table_bar(pi)) {
-			error = init_msix_table(ctx, sc, base);
-			if (error) 
-				return (-1);
-		}
-
 		/*
 		 * 64-bit BAR takes up two slots so skip the next one.
 		 */
@@ -585,6 +579,20 @@ cfginit(struct vmctx *ctx, struct pci_devinst *pi, int bus, int slot, int func)
 	pci_set_cfgdata16(pi, PCIR_COMMAND, read_config(&sc->psc_sel,
 	    PCIR_COMMAND, 2));
 
+	/*
+	 * We need to do this after PCIR_COMMAND got possibly updated, e.g.,
+	 * a BAR was enabled, as otherwise the PCIOCBARMMAP might fail on us.
+	 */
+	if (pci_msix_table_bar(pi) >= 0) {
+		error = init_msix_table(ctx, sc);
+		if (error != 0) {
+			warnx(
+			    "failed to initialize MSI-X table for PCI %d/%d/%d: %d",
+			    bus, slot, func, error);
+			goto done;
+		}
+	}
+
 	error = 0;				/* success */
 done:
 	return (error);
diff --git a/usr.sbin/service/service.8 b/usr.sbin/service/service.8
index 329bcb823f1..9902ae3c857 100644
--- a/usr.sbin/service/service.8
+++ b/usr.sbin/service/service.8
@@ -24,7 +24,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd January 16, 2021
+.Dd November 9, 2021
 .Dt SERVICE 8
 .Os
 .Sh NAME
@@ -138,7 +138,7 @@ complete service 'c/-/(e l r v)/' 'p/1/`service -l`/' \e
 		 status rcvar onestart onestop)/'
 .Ed
 .Pp
-The following programmable completion entry can be use in
+The following programmable completion entry can be used in
 .Xr bash 1
 for the names of the rc.d scripts:
 .Bd -literal -offset -ident