Add GIANT_REQUIRED and WITNESS sleep warnings to uprintf() and tprintf(),

as they both interact with the tty code (!MPSAFE) and may sleep if the
tty buffer is full (per comment).

Modify all consumers of uprintf() and tprintf() to hold Giant around
calls into these functions.  In most cases, this means adding an
acquisition of Giant immediately around the function.  In some cases
(nfs_timer()), it means acquiring Giant higher up in the callout.

With these changes, UFS no longer panics on SMP when either blocks are
exhausted or inodes are exhausted under load due to races in the tty
code when running without Giant.

NB: Some reduction in calls to uprintf() in the svr4 code is probably
desirable.

NB: In the case of nfs_timer(), calling uprintf() while holding a mutex,
or even in a callout at all, is a bad idea, and will generate warnings
and potential upset.  This needs to be fixed, but was a problem before
this change.

NB: uprintf()/tprintf() sleeping is generally a bad ideas, as is having
non-MPSAFE tty code.

MFC after:	1 week

sys/alpha/alpha/trap.c

@@ -1046,12 +1046,14 @@ unaligned_fixup(va, opcode, reg, td)
 	 * If we're supposed to be noisy, squawk now.
 	 */
 	if (doprint) {
+		mtx_lock(&Giant);
 		uprintf(
 		"pid %d (%s): unaligned access: va=0x%lx pc=0x%lx ra=0x%lx op=",
 		    p->p_pid, p->p_comm, va, td->td_frame->tf_regs[FRAME_PC],
 		    td->td_frame->tf_regs[FRAME_RA]);
 		uprintf(type,opcode);
 		uprintf("\n");
+		mtx_unlock(&Giant);
 	}
 
 	/*

sys/alpha/osf1/osf1_ioctl.c

@@ -33,6 +33,8 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/systm.h>
 #include <sys/fcntl.h>
 #include <sys/filio.h>
@@ -110,9 +112,11 @@ osf1_ioctl(td, uap)
 		break;
 	}
 #ifdef IOCTL_DEBUG
+		mtx_lock(&Giant);
 		uprintf(
 		    "OSF/1 IOCTL: group = %c, cmd = %d, len = %d, dir = %s\n",
 		    group, cmd, len, dirstr);
+		mtx_unlock(&Giant);
 #endif
 
 	a.fd = uap->fd;

sys/alpha/osf1/osf1_misc.c

@@ -209,8 +209,10 @@ osf1_getsysinfo(td, uap)
 		rpb_size = (unsigned long)&hwrpb->rpb_tbhint -
 		    (unsigned long)hwrpb;
 		if(uap->nbytes < rpb_size){
+			mtx_lock(&Giant);
 			uprintf("nbytes = %ld, sizeof(struct rpb) = %ld\n",
 			    uap->nbytes, rpb_size);
+			mtx_unlock(&Giant);
 			error = EINVAL;
 		}
 		else {
@@ -254,7 +256,9 @@ osf1_setsysinfo(td, uap)
 		break;
 	}
 	default:
+		mtx_lock(&Giant);
 		uprintf("osf1_setsysinfo called with op=%ld\n", uap->op);
+		mtx_unlock(&Giant);
 		/*error = EINVAL;*/
 	}
 	return (error);

sys/alpha/osf1/osf1_signal.c

@@ -40,6 +40,8 @@ __FBSDID("$FreeBSD$");
 #endif
 
 #include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/signalvar.h>
@@ -145,9 +147,12 @@ osf1_to_bsd_sigaction(osa, bsa)
 {
 
 	bsa->sa_handler = osa->osa_handler;
-	if (osf1_sigdbg)
+	if (osf1_sigdbg) {
+		mtx_lock(&Giant);
 		uprintf("%s(%d): handler @0x%lx \n", __FILE__, __LINE__,
 			(unsigned long)osa->osa_handler);
+		mtx_unlock(&Giant);
+	}
 	osf1_to_bsd_sigset(&osa->osa_mask, &bsa->sa_mask);
 	bsa->sa_flags = 0;
 	if ((osa->osa_flags & OSF1_SA_ONSTACK) != 0)
@@ -225,9 +230,12 @@ osf1_sigaction(td, uap)
 	struct sigaction *nbsap;
 	int error;
 
-	if (osf1_sigdbg && uap->sigtramp)
+	if (osf1_sigdbg && uap->sigtramp) {
+		mtx_lock(&Giant);
 		uprintf("osf1_sigaction: trampoline handler at %p\n",
 		    uap->sigtramp);
+		mtx_unlock(&Giant);
+	}
 	td->td_md.osf_sigtramp = uap->sigtramp;
 	if (uap->nsa != NULL) {
 		if ((error = copyin(uap->nsa, &osa, sizeof(osa))) != 0)
@@ -315,8 +323,10 @@ osf1_signal(td, uap)
 #endif
 			error = kern_sigaction(td, signum, &nbsa, &obsa, 0);
 			if (error != 0) {
+				mtx_lock(&Giant);
 				DPRINTF("signal: sigaction failed: %d\n",
 					 error);
+				mtx_unlock(&Giant);
 				td->td_retval[0] = -1;
 				return (error);
 			}
@@ -352,8 +362,11 @@ osf1_signal(td, uap)
 			SIGEMPTYSET(sa.sa_mask);
 			sa.sa_flags = 0;
 			error = kern_sigaction(td, signum, &sa, NULL, 0);
-			if (error != 0)
+			if (error != 0) {
+				mtx_lock(&Giant);
 				DPRINTF(("sigignore: sigaction failed\n"));
+				mtx_unlock(&Giant);
+			}
 			return (error);
 		}
 
@@ -544,8 +557,11 @@ osf1_sendsig(sig_t catcher, int sig, sigset_t *mask, u_long code)
 	/*
 	 * Set up the registers to return to sigcode.
 	 */
-	if (osf1_sigdbg)
+	if (osf1_sigdbg) {
+		mtx_lock(&Giant);
 		uprintf("attempting to call osf1 sigtramp\n");
+		mtx_unlock(&Giant);
+	}
 	frame->tf_regs[FRAME_PC] = (u_int64_t)td->td_md.osf_sigtramp;
 	frame->tf_regs[FRAME_A0] = sig;
 	frame->tf_regs[FRAME_A1] = code;
@@ -627,7 +643,9 @@ osf1_osigstack(td, uap)
 	} */ *uap;
 {
 
-/*	uprintf("osf1_osigstack: oss = %p, nss = %p",uap->oss, uap->nss);
-	uprintf(" stack ptr = %p\n",p->p_sigacts->ps_sigstk.ss_sp);*/
+/*	mtx_lock(&Giant);
+	uprintf("osf1_osigstack: oss = %p, nss = %p",uap->oss, uap->nss);
+	uprintf(" stack ptr = %p\n",p->p_sigacts->ps_sigstk.ss_sp);
+	mtx_unlock(&Giant); */
 	return(osigstack(td, (struct osigstack_args *)uap));
 }

sys/amd64/amd64/trap.c

@@ -486,11 +486,13 @@ trap(frame)
 
 #ifdef DEBUG
 	if (type <= MAX_TRAP_MSG) {
+		mtx_lock(&Giant);
 		uprintf("fatal process exception: %s",
 			trap_msg[type]);
 		if ((type == T_PAGEFLT) || (type == T_PROTFLT))
 			uprintf(", fault VA = 0x%lx", frame.tf_addr);
 		uprintf("\n");
+		mtx_unlock(&Giant);
 	}
 #endif
 

sys/compat/linux/linux_socket.c

@@ -1187,7 +1187,9 @@ linux_socketcall(struct thread *td, struct linux_socketcall_args *args)
 		return (linux_recvmsg(td, arg));
 	}
 
+	mtx_lock(&Giant);
 	uprintf("LINUX: 'socket' typ=%d not implemented\n", args->what);
+	mtx_unlock(&Giant);
 	return (ENOSYS);
 }
 #endif	/*!__alpha__*/

sys/compat/svr4/svr4_fcntl.c

@@ -377,8 +377,10 @@ svr4_sys_open(td, uap)
 	free(newpath, M_TEMP);
 
 	if (error) {
-	  /*	        uprintf("svr4_open(%s, 0x%0x, 0%o): %d\n", uap->path,
-			uap->flags, uap->mode, error);*/
+	  /*	        mtx_lock(&Giant);
+			uprintf("svr4_open(%s, 0x%0x, 0%o): %d\n", uap->path,
+			    uap->flags, uap->mode, error);
+			mtx_unlock(&Giant);*/
 		return error;
 	}
 

sys/compat/svr4/svr4_ioctl.c

@@ -30,6 +30,8 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>

sys/compat/svr4/svr4_ipc.c

@@ -77,7 +77,9 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
 #include <sys/ipc.h>
+#include <sys/lock.h>
 #include <sys/msg.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/sem.h>
 #include <sys/shm.h>

sys/compat/svr4/svr4_misc.c

@@ -485,7 +485,9 @@ svr4_sys_getdents(td, uap)
 			panic("svr4_sys_getdents64: bad reclen");
 		off = *cookie++;	/* each entry points to the next */
 		if ((off >> 32) != 0) {
+			mtx_lock(&Giant);
 			uprintf("svr4_sys_getdents64: dir offset too large for emulated program");
+			mtx_unlock(&Giant);
 			error = EINVAL;
 			goto out;
 		}

sys/compat/svr4/svr4_signal.c

@@ -238,8 +238,11 @@ svr4_to_bsd_sigaltstack(sss, bss)
 		bss->ss_flags |= SS_DISABLE;
 	if ((sss->ss_flags & SVR4_SS_ONSTACK) != 0)
 		bss->ss_flags |= SS_ONSTACK;
-	if ((sss->ss_flags & ~SVR4_SS_ALLBITS) != 0)
+	if ((sss->ss_flags & ~SVR4_SS_ALLBITS) != 0) {
+		mtx_lock(&Giant);
 	  /*XXX*/ uprintf("svr4_to_bsd_sigaltstack: extra bits ignored\n");
+		mtx_unlock(&Giant);
+	}
 }
 
 void

sys/compat/svr4/svr4_stat.c

@@ -30,6 +30,8 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/systm.h>
 #include <sys/proc.h>
 #include <sys/stat.h>

sys/compat/svr4/svr4_stream.c

@@ -378,6 +378,8 @@ bufprint(buf, len)
 {
 	size_t i;
 
+	GIANT_REQUIRED;
+
 	uprintf("\n\t");
 	for (i = 0; i < len; i++) {
 		uprintf("%x ", buf[i]);
@@ -395,6 +397,8 @@ show_ioc(str, ioc)
 	int len;
 	int error;
 
+	GIANT_REQUIRED;
+
 	len = ioc->len;
 	if (len > 1024)
 		len = 1024;
@@ -430,6 +434,8 @@ show_strbuf(str)
 	int maxlen = str->maxlen;
 	int len = str->len;
 
+	GIANT_REQUIRED;
+
 	if (maxlen > 8192)
 		maxlen = 8192;
 
@@ -473,6 +479,8 @@ show_msg(str, fd, ctl, dat, flags)
 	struct svr4_strbuf	buf;
 	int error;
 
+	GIANT_REQUIRED;
+
 	uprintf("%s(%d", str, fd);
 	if (ctl != NULL) {
 		if ((error = copyin(ctl, &buf, sizeof(buf))) != 0)
@@ -1407,8 +1415,12 @@ i_str(fp, td, retval, fd, cmd, dat)
 		return error;
 
 #ifdef DEBUG_SVR4
-	if ((error = show_ioc(">", &ioc)) != 0)
+	mtx_lock(&Giant);
+	if ((error = show_ioc(">", &ioc)) != 0) {
+		mtx_unlock(&Giant);
 		return error;
+	}
+	mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 
 	switch (ioc.cmd & 0xff00) {
@@ -1429,8 +1441,12 @@ i_str(fp, td, retval, fd, cmd, dat)
 	}
 
 #ifdef DEBUG_SVR4
-	if ((error = show_ioc("<", &ioc)) != 0)
+	mtx_lock(&Giant);
+	if ((error = show_ioc("<", &ioc)) != 0) {
+		mtx_lock(&Giant);
 		return error;
+	}
+	mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 	return copyout(&ioc, dat, sizeof(ioc));
 }
@@ -1550,7 +1566,9 @@ svr4_stream_ioctl(fp, td, retval, fd, cmd, dat)
 	case SVR4_I_PUSH:
 		DPRINTF(("I_PUSH %p\n", dat));
 #if defined(DEBUG_SVR4)
+		mtx_lock(&Giant);
 		show_strbuf((struct svr4_strbuf *)dat);
+		mtx_unlock(&Giant);
 #endif
 		return 0;
 
@@ -1743,8 +1761,10 @@ svr4_do_putmsg(td, uap, fp)
 	retval = td->td_retval;
 
 #ifdef DEBUG_SVR4
+	mtx_lock(&Giant);
 	show_msg(">putmsg", uap->fd, uap->ctl,
 		 uap->dat, uap->flags);
+	mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 
 	FILE_LOCK_ASSERT(fp, MA_NOTOWNED);
@@ -1940,8 +1960,10 @@ svr4_do_getmsg(td, uap, fp)
 	memset(&sc, 0, sizeof(sc));
 
 #ifdef DEBUG_SVR4
+	mtx_lock(&Giant);
 	show_msg(">getmsg", uap->fd, uap->ctl,
 		 uap->dat, 0);
+	mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 
 	if (uap->ctl != NULL) {
@@ -2249,8 +2271,10 @@ svr4_do_getmsg(td, uap, fp)
 	*retval = 0;
 
 #ifdef DEBUG_SVR4
+	mtx_lock(&Giant);
 	show_msg("<getmsg", uap->fd, uap->ctl,
 		 uap->dat, fl);
+	mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 	return error;
 }

sys/compat/svr4/svr4_termios.c

@@ -30,6 +30,8 @@
 __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/file.h>
@@ -156,6 +158,9 @@ print_bsd_termios(bt)
 	const struct termios *bt;
 {
 	int i;
+
+	GIANT_REQUIRED;
+
 	uprintf("BSD\niflag=%o oflag=%o cflag=%o lflag=%o\n",
 	    bt->c_iflag, bt->c_oflag, bt->c_cflag, bt->c_lflag);
 	uprintf("cc: ");
@@ -508,7 +513,9 @@ svr4_term_ioctl(fp, td, retval, fd, cmd, data)
 		bsd_to_svr4_termios(&bt, &st);
 
 #ifdef DEBUG_SVR4
+		mtx_lock(&Giant);
 		print_bsd_termios(&bt);
+		mtx_unlock(&Giant);
 		print_svr4_termios(&st);
 #endif /* DEBUG_SVR4 */
 
@@ -576,7 +583,9 @@ svr4_term_ioctl(fp, td, retval, fd, cmd, data)
 		}
 
 #ifdef DEBUG_SVR4
+		mtx_lock(&Giant);
 		print_bsd_termios(&bt);
+		mtx_unlock(&Giant);
 		print_svr4_termios(&st);
 #endif /* DEBUG_SVR4 */
 

sys/compat/svr4/svr4_ttold.c

@@ -32,6 +32,8 @@ __FBSDID("$FreeBSD$");
 #ifndef BURN_BRIDGES
 
 #include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/file.h>
@@ -69,6 +71,8 @@ print_svr4_sgttyb(str, ss)
 	struct svr4_sgttyb *ss;
 {
 
+	GIANT_REQUIRED;
+
 	uprintf("%s\nispeed=%o ospeed=%o ", str, ss->sg_ispeed, ss->sg_ospeed);
 	uprintf("erase=%o kill=%o flags=%o\n", ss->sg_erase, ss->sg_kill,
 	    ss->sg_flags);
@@ -79,6 +83,9 @@ print_svr4_tchars(str, st)
 	const char *str;
 	struct svr4_tchars *st;
 {
+
+	GIANT_REQUIRED;
+
 	uprintf("%s\nintrc=%o quitc=%o ", str, st->t_intrc, st->t_quitc);
 	uprintf("startc=%o stopc=%o eofc=%o brkc=%o\n", st->t_startc,
 	    st->t_stopc, st->t_eofc, st->t_brkc);
@@ -89,6 +96,9 @@ print_svr4_ltchars(str, sl)
 	const char *str;
 	struct svr4_ltchars *sl;
 {
+
+	GIANT_REQUIRED;
+
 	uprintf("%s\nsuspc=%o dsuspc=%o ", str, sl->t_suspc, sl->t_dsuspc);
 	uprintf("rprntc=%o flushc=%o werasc=%o lnextc=%o\n", sl->t_rprntc,
 	    sl->t_flushc, sl->t_werasc, sl->t_lnextc);
@@ -231,7 +241,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			return copyout(&pid, data, sizeof(pid));
 #else
+			mtx_lock(&Giant);
 			uprintf("ioctl(TIOCGSID) for pid %d unsupported\n", td->td_proc->p_pid);
+			mtx_unlock(&Giant);
 			return EINVAL;
 #endif
 		}
@@ -248,7 +260,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			bsd_sgttyb_to_svr4_sgttyb(&bs, &ss);
 #ifdef DEBUG_SVR4
+			mtx_lock(&Giant);
 			print_svr4_sgttyb("SVR4_TIOCGETP", &ss);
+			mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 			return copyout(&ss, data, sizeof(ss));
 		}
@@ -264,7 +278,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			svr4_sgttyb_to_bsd_sgttyb(&ss, &bs);
 #ifdef DEBUG_SVR4
+			mtx_lock(&Giant);
 			print_svr4_sgttyb("SVR4_TIOCSET{P,N}", &ss);
+			mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 			cmd = (cmd == SVR4_TIOCSETP) ? TIOCSETP : TIOCSETN;
 			return fo_ioctl(fp, cmd, (caddr_t) &bs,
@@ -283,7 +299,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			bsd_tchars_to_svr4_tchars(&bt, &st);
 #ifdef DEBUG_SVR4
+			mtx_lock(&Giant);
 			print_svr4_tchars("SVR4_TIOCGETC", &st);
+			mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 			return copyout(&st, data, sizeof(st));
 		}
@@ -298,7 +316,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			svr4_tchars_to_bsd_tchars(&st, &bt);
 #ifdef DEBUG_SVR4
+			mtx_lock(&Giant);
 			print_svr4_tchars("SVR4_TIOCSETC", &st);
+			mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 			return fo_ioctl(fp, TIOCSETC, (caddr_t) &bt,
 			    td->td_ucred, td);
@@ -316,7 +336,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			bsd_ltchars_to_svr4_ltchars(&bl, &sl);
 #ifdef DEBUG_SVR4
+			mtx_lock(&Giant);
 			print_svr4_ltchars("SVR4_TIOCGLTC", &sl);
+			mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 			return copyout(&sl, data, sizeof(sl));
 		}
@@ -331,7 +353,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			svr4_ltchars_to_bsd_ltchars(&sl, &bl);
 #ifdef DEBUG_SVR4
+			mtx_lock(&Giant);
 			print_svr4_ltchars("SVR4_TIOCSLTC", &sl);
+			mtx_unlock(&Giant);
 #endif /* DEBUG_SVR4 */
 			return fo_ioctl(fp, TIOCSLTC, (caddr_t) &bl,
 			    td->td_ucred, td);

sys/compat/svr4/svr4_util.h

@@ -42,7 +42,10 @@
 #include <sys/uio.h>
 
 #ifdef DEBUG_SVR4
-#define DPRINTF(a)	uprintf a;
+#define DPRINTF(a) do {							\
+	mtx_lock(&Giant);						\
+	uprintf a;							\
+} while (0)
 #else
 #define DPRINTF(a)
 #endif

sys/gnu/fs/ext2fs/ext2_alloc.c

@@ -165,6 +165,7 @@ ext2_alloc(ip, lbn, bpref, size, cred, bnp)
 	}
 nospace:
 	ext2_fserr(fs, cred->cr_uid, "file system full");
+	GIANT_REQUIRED;	/* uprintf */
 	uprintf("\n%s: write failed, file system is full\n", fs->fs_fsmnt);
 	return (ENOSPC);
 }
@@ -411,6 +412,7 @@ printf("ext2_valloc: allocated inode %d\n", ino);
 	return (0);
 noinodes:
 	ext2_fserr(fs, cred->cr_uid, "out of inodes");
+	GIANT_REQUIRED;	/* uprintf */
 	uprintf("\n%s: create/symlink failed, no inodes free\n", fs->fs_fsmnt);
 	return (ENOSPC);
 }

sys/i386/i386/trap.c

@@ -648,11 +648,13 @@ trap(frame)
 
 #ifdef DEBUG
 	if (type <= MAX_TRAP_MSG) {
+		mtx_lock(&Giant);
 		uprintf("fatal process exception: %s",
 			trap_msg[type]);
 		if ((type == T_PAGEFLT) || (type == T_PROTFLT))
 			uprintf(", fault VA = 0x%lx", (u_long)eva);
 		uprintf("\n");
+		mtx_unlock(&Giant);
 	}
 #endif
 

sys/i386/i386/vm86.c

@@ -193,7 +193,9 @@ vm86_emulate(vmf)
 			vmf->vmf_eflags |= PSL_VIF;
 			vmf->vmf_ip += inc_ip;
 			if ((vmf->vmf_eflags & PSL_VIP) == 0) {
+				mtx_lock(&Giant);
 				uprintf("fatal sti\n");
+				mtx_unlock(&Giant);
 				return (SIGKILL);
 			}
 			break;

sys/ia64/ia64/unaligned.c

@@ -30,6 +30,8 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/sysctl.h>
 #include <vm/vm.h>
@@ -263,9 +265,11 @@ unaligned_fixup(struct trapframe *tf, struct thread *td)
 	    ((tf->tf_special.psr & IA64_PSR_RI) == IA64_PSR_RI_1) ? 1 : 2;
 
 	if (ia64_unaligned_print) {
+		mtx_lock(&Giant);
 		uprintf("pid %d (%s): unaligned access: va=0x%lx, pc=0x%lx\n",
 		    td->td_proc->p_pid, td->td_proc->p_comm,
 		    tf->tf_special.ifa, tf->tf_special.iip + slot);
+		mtx_unlock(&Giant);
 	}
 
 	/*

sys/kern/imgact_elf.c

@@ -380,7 +380,9 @@ __elfN(load_section)(struct proc *p, struct vmspace *vmspace,
 	 */
 	if ((off_t)filsz + offset > object->un_pager.vnp.vnp_size ||
 	    filsz > memsz) {
+		mtx_lock(&Giant);
 		uprintf("elf_load_section: truncated ELF file\n");
+		mtx_unlock(&Giant);
 		return (ENOEXEC);
 	}
 
@@ -698,8 +700,10 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
 
 	brand_info = __elfN(get_brandinfo)(hdr, interp);
 	if (brand_info == NULL) {
+		mtx_lock(&Giant);
 		uprintf("ELF binary type \"%u\" not known.\n",
 		    hdr->e_ident[EI_OSABI]);
+		mtx_unlock(&Giant);
 		error = ENOEXEC;
 		goto fail;
 	}
@@ -840,7 +844,9 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
 		error = __elfN(load_file)(imgp->proc, interp, &addr,
 		    &imgp->entry_addr, sv->sv_pagesize);
 		if (error != 0) {
+			mtx_lock(&Giant);
 			uprintf("ELF interpreter %s not found\n", interp);
+			mtx_unlock(&Giant);
 			goto fail;
 		}
 	}

sys/kern/subr_prf.c

@@ -129,6 +129,10 @@ uprintf(const char *fmt, ...)
 	struct putchar_arg pca;
 	int retval;
 
+	GIANT_REQUIRED;
+
+	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, "uprintf");
+
 	if (td == NULL || td == PCPU_GET(idlethread))
 		return (0);
 
@@ -165,6 +169,10 @@ tprintf(struct proc *p, int pri, const char *fmt, ...)
 	struct putchar_arg pca;
 	struct session *sess = NULL;
 
+	GIANT_REQUIRED;
+
+	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, "tprintf");
+
 	if (pri != -1)
 		flags |= TOLOG;
 	if (p != NULL) {

sys/nfsclient/nfs_socket.c

@@ -1060,8 +1060,11 @@ nfs_request(struct vnode *vp, struct mbuf *mrest, int procnum,
 	 * If there was a successful reply and a tprintf msg.
 	 * tprintf a response.
 	 */
-	if (!error)
+	if (!error) {
+		mtx_lock(&Giant);
 		nfs_up(rep, nmp, rep->r_td, "is alive again", NFSSTA_TIMEO);
+		mtx_unlock(&Giant);
+	}
 	mrep = rep->r_mrep;
 	md = rep->r_md;
 	dpos = rep->r_dpos;
@@ -1182,6 +1185,7 @@ nfs_timer(void *arg)
 
 	getmicrouptime(&now);
 	s = splnet();
+	mtx_lock(&Giant);	/* nfs_down -> tprintf */
 	mtx_lock(&nfs_reqq_mtx);
 	TAILQ_FOREACH(rep, &nfs_reqq, r_chain) {
 		nmp = rep->r_nmp;
@@ -1294,6 +1298,7 @@ nfs_timer(void *arg)
 		}
 	}
 	mtx_unlock(&nfs_reqq_mtx);
+	mtx_unlock(&Giant);	/* nfs_down -> tprintf */
 	splx(s);
 	callout_reset(&nfs_callout, nfs_ticks, nfs_timer, NULL);
 }
@@ -1625,6 +1630,8 @@ nfs_msg(struct thread *td, const char *server, const char *msg, int error)
 {
 	struct proc *p;
 
+	GIANT_REQUIRED;	/* tprintf */
+
 	p = td ? td->td_proc : NULL;
 	if (error) {
 		tprintf(p, LOG_INFO, "nfs server %s: %s, error %d\n", server,
@@ -1644,6 +1651,8 @@ nfs_down(rep, nmp, td, msg, error, flags)
 	int error, flags;
 {
 
+	GIANT_REQUIRED;	/* nfs_msg */
+
 	if (nmp == NULL)
 		return;
 	if ((flags & NFSSTA_TIMEO) && !(nmp->nm_state & NFSSTA_TIMEO)) {
@@ -1671,6 +1680,9 @@ nfs_up(rep, nmp, td, msg, flags)
 	const char *msg;
 	int flags;
 {
+
+	GIANT_REQUIRED;	/* nfs_msg */
+
 	if (nmp == NULL)
 		return;
 	if ((rep == NULL) || (rep->r_flags & R_TPRINTFMSG) != 0)

sys/rpc/rpcclnt.c

@@ -1254,9 +1254,12 @@ rpcclnt_request(rpc, mrest, procnum, td, cred, reply)
 	 * If there was a successful reply and a tprintf msg. tprintf a
 	 * response.
 	 */
-	if (!error && (task->r_flags & R_TPRINTFMSG))
+	if (!error && (task->r_flags & R_TPRINTFMSG)) {
+		mtx_lock(&Giant);
 		rpcclnt_msg(task->r_td, rpc->rc_prog->prog_name,
 			    "is alive again");
+		mtx_unlock(&Giant);
+	}
 
 	/* free request header (leaving mrest) */
 	mheadend->m_next = NULL;
@@ -1390,6 +1393,7 @@ rpcclnt_timer(arg)
 #else
 	s = splnet();
 #endif
+	mtx_lock(&Giant);	/* rpc_msg -> tprintf */
 	TAILQ_FOREACH(rep, &rpctask_q, r_chain) {
 		rpc = rep->r_rpcclnt;
 		if (rep->r_mrep || (rep->r_flags & R_SOFTTERM))
@@ -1474,6 +1478,7 @@ rpcclnt_timer(arg)
 			}
 		}
 	}
+	mtx_unlock(&Giant);	/* rpc_msg -> tprintf */
 	splx(s);
 
 #ifdef __OpenBSD__
@@ -1775,6 +1780,8 @@ rpcclnt_msg(p, server, msg)
 	tprintf_close(tpr);
 	RPC_RETURN(0);
 #else
+	GIANT_REQUIRED;
+
 	tprintf(p ? p->td_proc : NULL, LOG_INFO,
 		"nfs server %s: %s\n", server, msg);
 	RPC_RETURN(0);

sys/ufs/ffs/ffs_alloc.c

@@ -201,7 +201,9 @@ ffs_alloc(ip, lbn, bpref, size, cred, bnp)
 	}
 	UFS_UNLOCK(ump);
 	ffs_fserr(fs, ip->i_number, "filesystem full");
+	mtx_lock(&Giant);
 	uprintf("\n%s: write failed, filesystem is full\n", fs->fs_fsmnt);
+	mtx_unlock(&Giant);
 	return (ENOSPC);
 }
 
@@ -399,7 +401,9 @@ ffs_realloccg(ip, lbprev, bprev, bpref, osize, nsize, cred, bpp)
 	if (bp)
 		brelse(bp);
 	ffs_fserr(fs, ip->i_number, "filesystem full");
+	mtx_lock(&Giant);
 	uprintf("\n%s: write failed, filesystem is full\n", fs->fs_fsmnt);
+	mtx_unlock(&Giant);
 	return (ENOSPC);
 }
 
@@ -954,7 +958,9 @@ ffs_valloc(pvp, mode, cred, vpp)
 noinodes:
 	UFS_UNLOCK(ump);
 	ffs_fserr(fs, pip->i_number, "out of inodes");
+	mtx_lock(&Giant);
 	uprintf("\n%s: create/symlink failed, no inodes free\n", fs->fs_fsmnt);
+	mtx_unlock(&Giant);
 	return (ENOSPC);
 }