[Zrouter-src-freebsd] ZRouter.org: push to FreeBSD HEAD tree

zrouter-src-freebsd at zrouter.org zrouter-src-freebsd at zrouter.org
Fri Jan 13 14:00:52 UTC 2012


details:   http://zrouter.org/hg/FreeBSD/head//rev/1750de5b0399
changeset: 279:1750de5b0399
user:      ray at terran.dlink.ua
date:      Fri Jan 13 15:51:01 2012 +0200
description:
FreeBSD HEAD @svn r230009.

diffstat:

 head/Makefile.inc1                                                |      7 +-
 head/UPDATING                                                     |      9 +-
 head/bin/ps/ps.c                                                  |      4 +-
 head/contrib/gcc/config/freebsd.h                                 |      3 +-
 head/contrib/groff/tmac/doc-syms                                  |      4 +-
 head/contrib/groff/tmac/groff_mdoc.man                            |      4 +-
 head/contrib/pf/pfctl/pfctl.8                                     |      4 +-
 head/etc/mac.conf                                                 |      4 +-
 head/etc/namedb/named.conf                                        |      4 +-
 head/etc/network.subr                                             |      4 +-
 head/etc/rc.d/auditd                                              |      4 +-
 head/etc/rc.d/bgfsck                                              |      4 +-
 head/etc/rc.d/dhclient                                            |     11 +-
 head/etc/rc.d/hostname                                            |      4 +-
 head/etc/rc.d/pfsync                                              |      9 +-
 head/etc/rc.firewall                                              |     12 +-
 head/etc/rc.initdiskless                                          |      8 +-
 head/etc/rc.subr                                                  |      9 +-
 head/etc/services                                                 |     10 +-
 head/gnu/usr.bin/cvs/lib/config.h.proto                           |      4 +-
 head/include/arpa/nameser_compat.h                                |      6 +-
 head/include/complex.h                                            |     10 +-
 head/include/dlfcn.h                                              |      3 +-
 head/include/gssapi/gssapi.h                                      |      6 +-
 head/include/resolv.h                                             |      4 +-
 head/include/rpc/svc.h                                            |      4 +-
 head/include/rpcsvc/mount.x                                       |      6 +-
 head/include/rpcsvc/nfs_prot.x                                    |      6 +-
 head/include/rpcsvc/nis.x                                         |      6 +-
 head/include/stdlib.h                                             |      7 +-
 head/include/tgmath.h                                             |     47 +-
 head/lib/libc/gen/Makefile.inc                                    |      6 +-
 head/lib/libc/gen/Symbol.map                                      |      3 +-
 head/lib/libc/gen/dlfcn.c                                         |     11 +-
 head/lib/libc/gen/dlopen.3                                        |     38 +-
 head/lib/libc/gen/getnetgrent.c                                   |      2 +-
 head/lib/libc/net/getaddrinfo.c                                   |      5 +-
 head/lib/libc/powerpc/SYS.h                                       |     17 +-
 head/lib/libc/powerpc/gen/setjmp.S                                |      5 +-
 head/lib/libc/powerpc64/SYS.h                                     |     17 +-
 head/lib/libc/powerpc64/gen/setjmp.S                              |      7 +-
 head/lib/libc/stdlib/Makefile.inc                                 |      9 +-
 head/lib/libc/stdlib/Symbol.map                                   |      9 +-
 head/lib/libc/stdlib/aligned_alloc.3                              |    126 +
 head/lib/libc/stdlib/malloc.c                                     |     16 +-
 head/lib/libc/stdlib/posix_memalign.3                             |     96 -
 head/lib/libdevstat/devstat.c                                     |     42 +-
 head/lib/libgssapi/gss_display_status.c                           |      6 +-
 head/lib/libgssapi/gss_pseudo_random.c                            |      6 +-
 head/lib/libgssapi/gss_release_oid.c                              |      4 +-
 head/lib/libopie/config.h                                         |      4 +-
 head/lib/libstdthreads/thrd_create.3                              |      6 +-
 head/lib/libutil/Makefile                                         |      5 +-
 head/lib/libutil/flopen.3                                         |      4 +-
 head/lib/libutil/kld.3                                            |      4 +-
 head/lib/libutil/libutil.h                                        |    103 +-
 head/lib/libutil/pidfile.3                                        |     38 +-
 head/lib/libutil/pidfile.c                                        |     18 +-
 head/lib/libvgl/bitmap.c                                          |      4 +-
 head/lib/libvgl/keyboard.c                                        |      4 +-
 head/lib/libvgl/main.c                                            |      4 +-
 head/lib/libvgl/mouse.c                                           |      4 +-
 head/lib/libvgl/simple.c                                          |      4 +-
 head/lib/libvgl/text.c                                            |      4 +-
 head/lib/libvgl/vgl.3                                             |      5 +-
 head/lib/libvgl/vgl.h                                             |      4 +-
 head/lib/msun/src/s_fabsl.c                                       |      4 +-
 head/libexec/bootpd/bootpd.c                                      |      6 +-
 head/libexec/bootpd/bootpgw/bootpgw.c                             |      4 +-
 head/libexec/bootpd/hash.h                                        |      4 +-
 head/libexec/bootpd/tools/bootptest/bootptest.c                   |      4 +-
 head/libexec/bootpd/tools/bootptest/print-bootp.c                 |      4 +-
 head/libexec/ftpd/ftpcmd.y                                        |      4 +-
 head/libexec/getty/init.c                                         |      4 +-
 head/libexec/lukemftpd/nbsd_pidfile.h                             |      4 +-
 head/libexec/rbootd/parseconf.c                                   |      8 +-
 head/libexec/rbootd/rbootd.c                                      |      4 +-
 head/libexec/rbootd/rmpproto.c                                    |      6 +-
 head/libexec/revnetgroup/parse_netgroup.c                         |      6 +-
 head/libexec/rshd/rshd.8                                          |      4 +-
 head/libexec/rtld-aout/shlib.c                                    |      4 +-
 head/libexec/rtld-elf/Symbol.map                                  |      6 +-
 head/libexec/rtld-elf/mips/reloc.c                                |      4 +-
 head/libexec/rtld-elf/rtld.c                                      |    114 +-
 head/libexec/rtld-elf/rtld.h                                      |      4 +-
 head/libexec/rtld-elf/sparc64/reloc.c                             |     12 +-
 head/libexec/tftpd/tftp-io.c                                      |      8 +-
 head/libexec/tftpd/tftp-utils.h                                   |      6 +-
 head/release/doc/en_US.ISO8859-1/hardware/article.sgml            |      5 +-
 head/release/doc/en_US.ISO8859-1/relnotes/article.sgml            |      4 +-
 head/release/doc/share/misc/dev.archlist.txt                      |      3 +-
 head/release/picobsd/tinyware/passwd/local_passwd.c               |      4 +-
 head/release/picobsd/tinyware/passwd/pw_copy.c                    |      4 +-
 head/release/picobsd/tinyware/simple_httpd/README                 |     12 +-
 head/sbin/bsdlabel/bsdlabel.c                                     |     12 +-
 head/sbin/camcontrol/camcontrol.c                                 |      9 +-
 head/sbin/camcontrol/modeedit.c                                   |      4 +-
 head/sbin/devd/devd.cc                                            |      3 +-
 head/sbin/devfs/rule.c                                            |      4 +-
 head/sbin/dhclient/dhclient-script.8                              |      4 +-
 head/sbin/dhclient/options.c                                      |      6 +-
 head/sbin/fsck_ffs/fsck.h                                         |      4 +-
 head/sbin/fsck_ffs/fsutil.c                                       |      4 +-
 head/sbin/fsck_ffs/gjournal.c                                     |      5 +-
 head/sbin/fsirand/fsirand.c                                       |      5 +-
 head/sbin/geom/class/part/geom_part.c                             |      5 +-
 head/sbin/geom/class/part/gpart.8                                 |     25 +-
 head/sbin/geom/class/raid/graid.8                                 |      4 +-
 head/sbin/gvinum/gvinum.c                                         |      9 +-
 head/sbin/hastctl/hastctl.8                                       |      4 +-
 head/sbin/hastctl/hastctl.c                                       |     20 +-
 head/sbin/hastd/activemap.c                                       |      6 +-
 head/sbin/hastd/control.c                                         |     18 +-
 head/sbin/hastd/ebuf.c                                            |      6 +-
 head/sbin/hastd/event.c                                           |     10 +-
 head/sbin/hastd/hast_compression.c                                |      4 +-
 head/sbin/hastd/hast_proto.c                                      |     16 +-
 head/sbin/hastd/hastd.c                                           |     86 +-
 head/sbin/hastd/hooks.c                                           |     12 +-
 head/sbin/hastd/lzf.h                                             |      4 +-
 head/sbin/hastd/metadata.c                                        |     12 +-
 head/sbin/hastd/nv.c                                              |     14 +-
 head/sbin/hastd/primary.c                                         |     82 +-
 head/sbin/hastd/proto.c                                           |     12 +-
 head/sbin/hastd/proto_common.c                                    |      6 +-
 head/sbin/hastd/proto_socketpair.c                                |      4 +-
 head/sbin/hastd/proto_tcp.c                                       |     18 +-
 head/sbin/hastd/proto_uds.c                                       |     14 +-
 head/sbin/hastd/secondary.c                                       |     36 +-
 head/sbin/hastd/subr.c                                            |     12 +-
 head/sbin/hastd/subr.h                                            |      4 +-
 head/sbin/ifconfig/ifieee80211.c                                  |      7 +-
 head/sbin/ipfw/ipfw2.c                                            |     10 +-
 head/sbin/ipfw/main.c                                             |      4 +-
 head/sbin/mdmfs/mdmfs.c                                           |      4 +-
 head/sbin/mount_nfs/mount_nfs.c                                   |      4 +-
 head/sbin/newfs/mkfs.c                                            |      4 +-
 head/sbin/ping6/ping6.c                                           |      7 +-
 head/sbin/reboot/nextboot.8                                       |      4 +-
 head/sbin/recoverdisk/recoverdisk.1                               |     22 +-
 head/sbin/route/route.c                                           |     11 +-
 head/sbin/routed/main.c                                           |      8 +-
 head/sbin/routed/radix.c                                          |      8 +-
 head/sbin/routed/table.c                                          |      6 +-
 head/sbin/tunefs/tunefs.c                                         |      5 +-
 head/share/examples/diskless/README.TEMPLATING                    |      7 +-
 head/share/examples/ppp/ppp.linkdown.sample                       |      4 +-
 head/share/examples/printing/hpvf                                 |      4 +-
 head/share/examples/scsi_target/scsi_cmds.c                       |      4 +-
 head/share/man/man3/ATOMIC_VAR_INIT.3                             |      6 +-
 head/share/man/man3/tgmath.3                                      |      6 +-
 head/share/man/man4/apic.4                                        |      4 +-
 head/share/man/man4/bce.4                                         |      4 +-
 head/share/man/man4/carp.4                                        |      4 +-
 head/share/man/man4/ng_ksocket.4                                  |     12 +-
 head/share/man/man5/ar.5                                          |      6 +-
 head/share/man/man8/rc.subr.8                                     |     20 +-
 head/share/mk/bsd.crunchgen.mk                                    |      7 +-
 head/sys/amd64/conf/GENERIC                                       |      5 +-
 head/sys/arm/conf/KB920X                                          |      5 +-
 head/sys/boot/common/loader.8                                     |     41 +-
 head/sys/boot/forth/loader.4th                                    |     17 +-
 head/sys/cam/cam_periph.c                                         |     81 +-
 head/sys/cam/cam_periph.h                                         |      4 +-
 head/sys/cam/cam_xpt.c                                            |    124 +-
 head/sys/cam/ctl/README.ctl.txt                                   |    449 +
 head/sys/cam/ctl/ctl.c                                            |  13082 ++++++++++
 head/sys/cam/ctl/ctl.h                                            |    216 +
 head/sys/cam/ctl/ctl_backend.c                                    |    177 +
 head/sys/cam/ctl/ctl_backend.h                                    |    288 +
 head/sys/cam/ctl/ctl_backend_block.c                              |   2213 +
 head/sys/cam/ctl/ctl_backend_block.h                              |     72 +
 head/sys/cam/ctl/ctl_backend_ramdisk.c                            |    835 +
 head/sys/cam/ctl/ctl_cmd_table.c                                  |    984 +
 head/sys/cam/ctl/ctl_debug.h                                      |     52 +
 head/sys/cam/ctl/ctl_error.c                                      |    811 +
 head/sys/cam/ctl/ctl_error.h                                      |     92 +
 head/sys/cam/ctl/ctl_frontend.c                                   |    187 +
 head/sys/cam/ctl/ctl_frontend.h                                   |    295 +
 head/sys/cam/ctl/ctl_frontend_cam_sim.c                           |    866 +
 head/sys/cam/ctl/ctl_frontend_internal.c                          |   1782 +
 head/sys/cam/ctl/ctl_frontend_internal.h                          |    154 +
 head/sys/cam/ctl/ctl_ha.h                                         |    270 +
 head/sys/cam/ctl/ctl_io.h                                         |    474 +
 head/sys/cam/ctl/ctl_ioctl.h                                      |    604 +
 head/sys/cam/ctl/ctl_mem_pool.c                                   |    192 +
 head/sys/cam/ctl/ctl_mem_pool.h                                   |     83 +
 head/sys/cam/ctl/ctl_private.h                                    |    493 +
 head/sys/cam/ctl/ctl_scsi_all.c                                   |    227 +
 head/sys/cam/ctl/ctl_scsi_all.h                                   |     52 +
 head/sys/cam/ctl/ctl_ser_table.c                                  |     81 +
 head/sys/cam/ctl/ctl_util.c                                       |    843 +
 head/sys/cam/ctl/ctl_util.h                                       |    119 +
 head/sys/cam/ctl/scsi_ctl.c                                       |   2049 +
 head/sys/cam/scsi/scsi_all.c                                      |     11 +-
 head/sys/cam/scsi/scsi_all.h                                      |     54 +-
 head/sys/cam/scsi/scsi_da.c                                       |     43 +-
 head/sys/cam/scsi/scsi_da.h                                       |     52 +-
 head/sys/cam/scsi/scsi_sg.c                                       |     10 +-
 head/sys/cam/scsi/scsi_targ_bh.c                                  |      4 +-
 head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c         |      8 +-
 head/sys/conf/NOTES                                               |      3 +-
 head/sys/conf/files                                               |     52 +-
 head/sys/conf/files.amd64                                         |      3 +-
 head/sys/contrib/dev/acpica/changes.txt                           |     54 +-
 head/sys/contrib/dev/acpica/common/adfile.c                       |      2 +-
 head/sys/contrib/dev/acpica/common/adisasm.c                      |     57 +-
 head/sys/contrib/dev/acpica/common/adwalk.c                       |      2 +-
 head/sys/contrib/dev/acpica/common/dmextern.c                     |      2 +-
 head/sys/contrib/dev/acpica/common/dmrestag.c                     |      2 +-
 head/sys/contrib/dev/acpica/common/dmtable.c                      |      5 +-
 head/sys/contrib/dev/acpica/common/dmtbdump.c                     |      2 +-
 head/sys/contrib/dev/acpica/common/dmtbinfo.c                     |    229 +-
 head/sys/contrib/dev/acpica/common/getopt.c                       |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslanalyze.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslbtypes.c                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslcodegen.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslcompile.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslcompiler.h                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslcompiler.l                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslcompiler.y                |      2 +-
 head/sys/contrib/dev/acpica/compiler/asldefine.h                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslerror.c                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslfiles.c                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslfold.c                    |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslglobal.h                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/asllength.c                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/asllisting.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslload.c                    |      2 +-
 head/sys/contrib/dev/acpica/compiler/asllookup.c                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslmain.c                    |      6 +-
 head/sys/contrib/dev/acpica/compiler/aslmap.c                     |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslmessages.h                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslopcodes.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/asloperands.c                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslopt.c                     |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslpredef.c                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslresource.c                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype1.c                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype1i.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype2.c                |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype2d.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype2e.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype2q.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype2s.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslrestype2w.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslstartup.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslstubs.c                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/asltransform.c               |      2 +-
 head/sys/contrib/dev/acpica/compiler/asltree.c                    |      2 +-
 head/sys/contrib/dev/acpica/compiler/asltypes.h                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslutils.c                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/asluuid.c                    |      2 +-
 head/sys/contrib/dev/acpica/compiler/aslwalks.c                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtcompile.c                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtcompiler.h                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtexpress.c                  |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtfield.c                    |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtio.c                       |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtparser.l                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtparser.y                   |      2 +-
 head/sys/contrib/dev/acpica/compiler/dtsubtable.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/dttable.c                    |      6 +-
 head/sys/contrib/dev/acpica/compiler/dttemplate.c                 |      2 +-
 head/sys/contrib/dev/acpica/compiler/dttemplate.h                 |     15 +-
 head/sys/contrib/dev/acpica/compiler/dtutils.c                    |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbcmds.c                     |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbdisply.c                   |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbexec.c                     |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbfileio.c                   |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbhistry.c                   |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbinput.c                    |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbmethod.c                   |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbnames.c                    |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbstats.c                    |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbutils.c                    |      2 +-
 head/sys/contrib/dev/acpica/debugger/dbxface.c                    |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmbuffer.c               |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmnames.c                |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmobject.c               |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmopcode.c               |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmresrc.c                |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmresrcl.c               |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmresrcl2.c              |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmresrcs.c               |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmutils.c                |      2 +-
 head/sys/contrib/dev/acpica/disassembler/dmwalk.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsargs.c                   |     10 +-
 head/sys/contrib/dev/acpica/dispatcher/dscontrol.c                |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsfield.c                  |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsinit.c                   |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsmethod.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsmthdat.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsobject.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsopcode.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dsutils.c                  |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dswexec.c                  |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dswload.c                  |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dswload2.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dswscope.c                 |      2 +-
 head/sys/contrib/dev/acpica/dispatcher/dswstate.c                 |      2 +-
 head/sys/contrib/dev/acpica/events/evevent.c                      |      2 +-
 head/sys/contrib/dev/acpica/events/evglock.c                      |      2 +-
 head/sys/contrib/dev/acpica/events/evgpe.c                        |      2 +-
 head/sys/contrib/dev/acpica/events/evgpeblk.c                     |      2 +-
 head/sys/contrib/dev/acpica/events/evgpeinit.c                    |      2 +-
 head/sys/contrib/dev/acpica/events/evgpeutil.c                    |      2 +-
 head/sys/contrib/dev/acpica/events/evmisc.c                       |      2 +-
 head/sys/contrib/dev/acpica/events/evregion.c                     |      2 +-
 head/sys/contrib/dev/acpica/events/evrgnini.c                     |      2 +-
 head/sys/contrib/dev/acpica/events/evsci.c                        |      2 +-
 head/sys/contrib/dev/acpica/events/evxface.c                      |      2 +-
 head/sys/contrib/dev/acpica/events/evxfevnt.c                     |      2 +-
 head/sys/contrib/dev/acpica/events/evxfgpe.c                      |      2 +-
 head/sys/contrib/dev/acpica/events/evxfregn.c                     |      2 +-
 head/sys/contrib/dev/acpica/executer/exconfig.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exconvrt.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/excreate.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exdebug.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exdump.c                     |      2 +-
 head/sys/contrib/dev/acpica/executer/exfield.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exfldio.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exmisc.c                     |      2 +-
 head/sys/contrib/dev/acpica/executer/exmutex.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exnames.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exoparg1.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exoparg2.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exoparg3.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exoparg6.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exprep.c                     |      2 +-
 head/sys/contrib/dev/acpica/executer/exregion.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exresnte.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exresolv.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exresop.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exstore.c                    |      2 +-
 head/sys/contrib/dev/acpica/executer/exstoren.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exstorob.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exsystem.c                   |      2 +-
 head/sys/contrib/dev/acpica/executer/exutils.c                    |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwacpi.c                     |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwgpe.c                      |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwpci.c                      |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwregs.c                     |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwsleep.c                    |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwtimer.c                    |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwvalid.c                    |      2 +-
 head/sys/contrib/dev/acpica/hardware/hwxface.c                    |      2 +-
 head/sys/contrib/dev/acpica/include/acapps.h                      |      4 +-
 head/sys/contrib/dev/acpica/include/accommon.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acconfig.h                    |      6 +-
 head/sys/contrib/dev/acpica/include/acdebug.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/acdisasm.h                    |      4 +-
 head/sys/contrib/dev/acpica/include/acdispat.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acevents.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acexcep.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/acglobal.h                    |      3 +-
 head/sys/contrib/dev/acpica/include/achware.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/acinterp.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/aclocal.h                     |     13 +-
 head/sys/contrib/dev/acpica/include/acmacros.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acnames.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/acnamesp.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acobject.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acopcode.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acoutput.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acparser.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acpi.h                        |      2 +-
 head/sys/contrib/dev/acpica/include/acpiosxf.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acpixf.h                      |     11 +-
 head/sys/contrib/dev/acpica/include/acpredef.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acresrc.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/acrestyp.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/acstruct.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/actables.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/actbl.h                       |     16 +-
 head/sys/contrib/dev/acpica/include/actbl1.h                      |      2 +-
 head/sys/contrib/dev/acpica/include/actbl2.h                      |      2 +-
 head/sys/contrib/dev/acpica/include/actbl3.h                      |      2 +-
 head/sys/contrib/dev/acpica/include/actypes.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/acutils.h                     |     33 +-
 head/sys/contrib/dev/acpica/include/amlcode.h                     |      2 +-
 head/sys/contrib/dev/acpica/include/amlresrc.h                    |      2 +-
 head/sys/contrib/dev/acpica/include/platform/acenv.h              |      2 +-
 head/sys/contrib/dev/acpica/include/platform/acfreebsd.h          |      2 +-
 head/sys/contrib/dev/acpica/include/platform/acgcc.h              |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsaccess.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsalloc.c                   |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsdump.c                    |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsdumpdv.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nseval.c                    |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsinit.c                    |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsload.c                    |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsnames.c                   |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsobject.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsparse.c                   |      2 +-
 head/sys/contrib/dev/acpica/namespace/nspredef.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsrepair.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsrepair2.c                 |      2 +-
 head/sys/contrib/dev/acpica/namespace/nssearch.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsutils.c                   |      2 +-
 head/sys/contrib/dev/acpica/namespace/nswalk.c                    |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsxfeval.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsxfname.c                  |      2 +-
 head/sys/contrib/dev/acpica/namespace/nsxfobj.c                   |      2 +-
 head/sys/contrib/dev/acpica/os_specific/service_layers/osunixxf.c |      2 +-
 head/sys/contrib/dev/acpica/parser/psargs.c                       |      2 +-
 head/sys/contrib/dev/acpica/parser/psloop.c                       |      2 +-
 head/sys/contrib/dev/acpica/parser/psopcode.c                     |      2 +-
 head/sys/contrib/dev/acpica/parser/psparse.c                      |      2 +-
 head/sys/contrib/dev/acpica/parser/psscope.c                      |      2 +-
 head/sys/contrib/dev/acpica/parser/pstree.c                       |      2 +-
 head/sys/contrib/dev/acpica/parser/psutils.c                      |      2 +-
 head/sys/contrib/dev/acpica/parser/pswalk.c                       |      2 +-
 head/sys/contrib/dev/acpica/parser/psxface.c                      |      2 +-
 head/sys/contrib/dev/acpica/resources/rsaddr.c                    |      2 +-
 head/sys/contrib/dev/acpica/resources/rscalc.c                    |      2 +-
 head/sys/contrib/dev/acpica/resources/rscreate.c                  |      2 +-
 head/sys/contrib/dev/acpica/resources/rsdump.c                    |      2 +-
 head/sys/contrib/dev/acpica/resources/rsinfo.c                    |      2 +-
 head/sys/contrib/dev/acpica/resources/rsio.c                      |      2 +-
 head/sys/contrib/dev/acpica/resources/rsirq.c                     |      2 +-
 head/sys/contrib/dev/acpica/resources/rslist.c                    |      2 +-
 head/sys/contrib/dev/acpica/resources/rsmemory.c                  |      2 +-
 head/sys/contrib/dev/acpica/resources/rsmisc.c                    |      2 +-
 head/sys/contrib/dev/acpica/resources/rsserial.c                  |      2 +-
 head/sys/contrib/dev/acpica/resources/rsutils.c                   |      2 +-
 head/sys/contrib/dev/acpica/resources/rsxface.c                   |      2 +-
 head/sys/contrib/dev/acpica/tables/tbfadt.c                       |     15 +-
 head/sys/contrib/dev/acpica/tables/tbfind.c                       |      2 +-
 head/sys/contrib/dev/acpica/tables/tbinstal.c                     |      2 +-
 head/sys/contrib/dev/acpica/tables/tbutils.c                      |      2 +-
 head/sys/contrib/dev/acpica/tables/tbxface.c                      |      2 +-
 head/sys/contrib/dev/acpica/tables/tbxfroot.c                     |      2 +-
 head/sys/contrib/dev/acpica/utilities/utaddress.c                 |    322 +
 head/sys/contrib/dev/acpica/utilities/utalloc.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/utcache.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/utcopy.c                    |      2 +-
 head/sys/contrib/dev/acpica/utilities/utdebug.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/utdecode.c                  |      2 +-
 head/sys/contrib/dev/acpica/utilities/utdelete.c                  |     12 +-
 head/sys/contrib/dev/acpica/utilities/uteval.c                    |      2 +-
 head/sys/contrib/dev/acpica/utilities/utglobal.c                  |      9 +-
 head/sys/contrib/dev/acpica/utilities/utids.c                     |      2 +-
 head/sys/contrib/dev/acpica/utilities/utinit.c                    |      3 +-
 head/sys/contrib/dev/acpica/utilities/utlock.c                    |      2 +-
 head/sys/contrib/dev/acpica/utilities/utmath.c                    |      2 +-
 head/sys/contrib/dev/acpica/utilities/utmisc.c                    |     40 +-
 head/sys/contrib/dev/acpica/utilities/utmutex.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/utobject.c                  |      2 +-
 head/sys/contrib/dev/acpica/utilities/utosi.c                     |      2 +-
 head/sys/contrib/dev/acpica/utilities/utresrc.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/utstate.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/uttrack.c                   |      2 +-
 head/sys/contrib/dev/acpica/utilities/utxface.c                   |     47 +-
 head/sys/contrib/dev/acpica/utilities/utxferror.c                 |      2 +-
 head/sys/contrib/dev/acpica/utilities/utxfmutex.c                 |      2 +-
 head/sys/contrib/pf/net/if_pfsync.c                               |    438 +-
 head/sys/contrib/pf/net/pf.c                                      |     20 +-
 head/sys/contrib/pf/net/pf_ioctl.c                                |     97 +-
 head/sys/contrib/pf/net/pfvar.h                                   |     11 +-
 head/sys/contrib/rdma/ib_addr.h                                   |      4 +-
 head/sys/dev/ahci/ahci.c                                          |      3 +-
 head/sys/dev/an/if_an.c                                           |      3 +-
 head/sys/dev/ata/ata-pci.h                                        |      3 +-
 head/sys/dev/ata/atapi-cam.c                                      |      7 +-
 head/sys/dev/ata/chipsets/ata-intel.c                             |      3 +-
 head/sys/dev/ath/ath_hal/ah_desc.h                                |     15 +-
 head/sys/dev/ath/ath_hal/ah_internal.h                            |      6 +-
 head/sys/dev/ath/if_ath.c                                         |      9 +-
 head/sys/dev/ath/if_ath_tx.c                                      |    110 +-
 head/sys/dev/bfe/if_bfe.c                                         |      3 +-
 head/sys/dev/bm/if_bm.c                                           |      3 +-
 head/sys/dev/bxe/if_bxe.c                                         |     11 +-
 head/sys/dev/ciss/ciss.c                                          |      4 +-
 head/sys/dev/e1000/if_em.c                                        |     38 +-
 head/sys/dev/e1000/if_igb.c                                       |     14 +-
 head/sys/dev/e1000/if_lem.c                                       |     24 +-
 head/sys/dev/ep/if_ep.c                                           |      3 +-
 head/sys/dev/et/if_et.c                                           |    116 +-
 head/sys/dev/ex/if_ex.c                                           |      3 +-
 head/sys/dev/firewire/if_fwe.c                                    |      3 +-
 head/sys/dev/ichwd/ichwd.c                                        |     32 +-
 head/sys/dev/ichwd/ichwd.h                                        |      8 +-
 head/sys/dev/ie/if_ie.c                                           |      3 +-
 head/sys/dev/if_ndis/if_ndis.c                                    |      3 +-
 head/sys/dev/ixgb/if_ixgb.c                                       |      3 +-
 head/sys/dev/ixgbe/ixgbe.c                                        |     15 +-
 head/sys/dev/ixgbe/ixv.c                                          |      3 +-
 head/sys/dev/lge/if_lge.c                                         |      3 +-
 head/sys/dev/msk/if_msk.c                                         |      3 +-
 head/sys/dev/my/if_my.c                                           |      3 +-
 head/sys/dev/netmap/if_em_netmap.h                                |     18 +-
 head/sys/dev/netmap/if_igb_netmap.h                               |     18 +-
 head/sys/dev/netmap/if_lem_netmap.h                               |     18 +-
 head/sys/dev/netmap/if_re_netmap.h                                |     31 +-
 head/sys/dev/netmap/ixgbe_netmap.h                                |     20 +-
 head/sys/dev/netmap/netmap.c                                      |     76 +-
 head/sys/dev/netmap/netmap_kern.h                                 |     28 +-
 head/sys/dev/nfe/if_nfe.c                                         |      3 +-
 head/sys/dev/null/null.c                                          |     50 +-
 head/sys/dev/nve/if_nve.c                                         |      3 +-
 head/sys/dev/pst/pst-pci.c                                        |      4 +-
 head/sys/dev/qlxgb/qla_os.c                                       |      7 +-
 head/sys/dev/random/probe.c                                       |      6 +-
 head/sys/dev/rt/if_rt.c                                           |      3 +-
 head/sys/dev/sfxge/sfxge_port.c                                   |     10 +-
 head/sys/dev/sis/if_sis.c                                         |      3 +-
 head/sys/dev/sk/if_sk.c                                           |      5 +-
 head/sys/dev/sn/if_sn.c                                           |      3 +-
 head/sys/dev/snc/dp83932.c                                        |      3 +-
 head/sys/dev/sound/pci/emu10k1.c                                  |      6 +-
 head/sys/dev/sound/pci/emu10kx-midi.c                             |     32 +-
 head/sys/dev/sound/pci/emu10kx-pcm.c                              |    100 +-
 head/sys/dev/sound/pci/emu10kx.c                                  |    467 +-
 head/sys/dev/sound/pci/emu10kx.h                                  |     10 +-
 head/sys/dev/sound/pci/emuxkireg.h                                |     10 +-
 head/sys/dev/stge/if_stge.c                                       |      3 +-
 head/sys/dev/tl/if_tl.c                                           |      3 +-
 head/sys/dev/tsec/if_tsec.c                                       |      3 +-
 head/sys/dev/uart/uart_bus_pci.c                                  |      4 +-
 head/sys/dev/usb/net/usb_ethernet.c                               |      5 +-
 head/sys/dev/vx/if_vx.c                                           |      3 +-
 head/sys/dev/vxge/vxge.c                                          |      3 +-
 head/sys/dev/wb/if_wb.c                                           |      3 +-
 head/sys/dev/wtap/if_medium.c                                     |    120 +
 head/sys/dev/wtap/if_medium.h                                     |     72 +
 head/sys/dev/wtap/if_wtap.c                                       |    904 +
 head/sys/dev/wtap/if_wtap_module.c                                |    186 +
 head/sys/dev/wtap/if_wtapioctl.h                                  |    180 +
 head/sys/dev/wtap/if_wtapvar.h                                    |    163 +
 head/sys/dev/wtap/plugins/visibility.c                            |    241 +
 head/sys/dev/wtap/plugins/visibility.h                            |     56 +
 head/sys/dev/wtap/plugins/visibility_ioctl.h                      |     51 +
 head/sys/dev/wtap/plugins/wtap_plugin.h                           |     48 +
 head/sys/dev/wtap/wtap_hal/hal.c                                  |    213 +
 head/sys/dev/wtap/wtap_hal/hal.h                                  |     55 +
 head/sys/dev/wtap/wtap_hal/handler.h                              |     50 +
 head/sys/dev/xen/netback/netback.c                                |      3 +-
 head/sys/dev/xen/netfront/netfront.c                              |      3 +-
 head/sys/fs/nfs/nfs_commonkrpc.c                                  |      3 +-
 head/sys/fs/nfs/nfs_commonport.c                                  |      3 +-
 head/sys/fs/nfs/nfs_commonsubs.c                                  |      4 +-
 head/sys/fs/nfsclient/nfs_clkrpc.c                                |      3 +-
 head/sys/fs/nfsclient/nfs_clport.c                                |      3 +-
 head/sys/fs/nfsclient/nfs_clrpcops.c                              |      4 +-
 head/sys/fs/nullfs/null_subr.c                                    |      4 +-
 head/sys/fs/pseudofs/pseudofs_vnops.c                             |     26 +-
 head/sys/fs/tmpfs/tmpfs_subr.c                                    |     80 +-
 head/sys/geom/raid/md_intel.c                                     |    173 +-
 head/sys/gnu/dev/sound/pci/emu10k1-alsa.h                         |   1601 -
 head/sys/gnu/dev/sound/pci/p16v-alsa.h                            |    301 -
 head/sys/gnu/dev/sound/pci/p17v-alsa.h                            |    113 -
 head/sys/i386/conf/GENERIC                                        |      5 +-
 head/sys/i386/conf/PAE                                            |      5 +-
 head/sys/i386/conf/XEN                                            |      6 +-
 head/sys/ia64/conf/GENERIC                                        |     14 +-
 head/sys/kern/kern_prot.c                                         |      4 +-
 head/sys/kern/kern_resource.c                                     |      4 +-
 head/sys/kern/kern_shutdown.c                                     |      4 +-
 head/sys/kern/kern_uuid.c                                         |      8 +-
 head/sys/kern/subr_witness.c                                      |      6 +-
 head/sys/kern/uipc_shm.c                                          |    103 +-
 head/sys/kern/vfs_subr.c                                          |      6 +-
 head/sys/kern/vfs_syscalls.c                                      |     19 +-
 head/sys/kern/vnode_if.src                                        |     29 +-
 head/sys/mips/atheros/ar724x_pci.c                                |      4 +-
 head/sys/mips/cavium/cryptocteon/cavium_crypto.c                  |     88 +-
 head/sys/mips/cavium/files.octeon1                                |      4 +-
 head/sys/mips/cavium/octeon_cop2.S                                |    225 +
 head/sys/mips/cavium/octeon_cop2.h                                |    210 +
 head/sys/mips/include/cpuregs.h                                   |      3 +-
 head/sys/mips/include/frame.h                                     |      7 +-
 head/sys/mips/include/octeon_cop2.h                               |    215 +
 head/sys/mips/include/proc.h                                      |     14 +-
 head/sys/mips/mips/db_disasm.c                                    |      3 +-
 head/sys/mips/mips/elf_machdep.c                                  |    101 +-
 head/sys/mips/mips/exception.S                                    |     16 +-
 head/sys/mips/mips/genassym.c                                     |     73 +-
 head/sys/mips/mips/locore.S                                       |      6 +-
 head/sys/mips/mips/octeon_cop2.c                                  |     62 +
 head/sys/mips/mips/octeon_cop2_swtch.S                            |    246 +
 head/sys/mips/mips/pm_machdep.c                                   |      4 +-
 head/sys/mips/mips/swtch.S                                        |     57 +-
 head/sys/mips/mips/trap.c                                         |     85 +-
 head/sys/mips/mips/vm_machdep.c                                   |     51 +-
 head/sys/modules/acpi/acpi/Makefile                               |      9 +-
 head/sys/modules/random/Makefile                                  |      4 +-
 head/sys/modules/sound/driver/emu10kx/Makefile                    |     27 +-
 head/sys/modules/wtap/Makefile                                    |     30 +
 head/sys/net/bpf.c                                                |     57 +-
 head/sys/net/if.c                                                 |    108 +-
 head/sys/net/if_llatbl.c                                          |      5 +-
 head/sys/net/if_media.h                                           |     10 +-
 head/sys/net/if_var.h                                             |     23 +-
 head/sys/net/if_vlan.c                                            |      9 +-
 head/sys/net/rtsock.c                                             |     23 +-
 head/sys/net80211/ieee80211_ioctl.c                               |     13 +-
 head/sys/net80211/ieee80211_output.c                              |      4 +-
 head/sys/net80211/ieee80211_radiotap.c                            |      6 +-
 head/sys/net80211/ieee80211_radiotap.h                            |      4 +-
 head/sys/netatalk/aarp.c                                          |      8 +-
 head/sys/netatalk/at_control.c                                    |     10 +-
 head/sys/netinet/if_ether.c                                       |     39 +-
 head/sys/netinet/if_ether.h                                       |      4 +-
 head/sys/netinet/igmp.c                                           |     26 +-
 head/sys/netinet/in.c                                             |     24 +-
 head/sys/netinet/in_mcast.c                                       |     16 +-
 head/sys/netinet/in_pcb.c                                         |     20 +-
 head/sys/netinet/in_proto.c                                       |     22 +-
 head/sys/netinet/in_var.h                                         |      7 +-
 head/sys/netinet/ip_carp.c                                        |     26 +-
 head/sys/netinet/ip_icmp.c                                        |     22 +-
 head/sys/netinet/ip_input.c                                       |     10 +-
 head/sys/netinet/sctp_bsd_addr.c                                  |      6 +-
 head/sys/netinet/sctp_input.c                                     |    257 +-
 head/sys/netinet/sctp_sysctl.c                                    |     14 +-
 head/sys/netinet/sctp_sysctl.h                                    |     15 +-
 head/sys/netinet/sctputil.c                                       |     15 +-
 head/sys/netinet/tcp_input.c                                      |      5 +-
 head/sys/netinet/tcp_timewait.c                                   |     10 +-
 head/sys/netinet/tcp_usrreq.c                                     |      6 +-
 head/sys/netinet6/icmp6.c                                         |     12 +-
 head/sys/netinet6/in6.c                                           |     42 +-
 head/sys/netinet6/in6_ifattach.c                                  |     34 +-
 head/sys/netinet6/in6_mcast.c                                     |     16 +-
 head/sys/netinet6/in6_var.h                                       |      6 +-
 head/sys/netinet6/ip6_input.c                                     |      6 +-
 head/sys/netinet6/mld6.c                                          |     34 +-
 head/sys/netinet6/nd6.c                                           |     18 +-
 head/sys/netinet6/nd6_rtr.c                                       |     14 +-
 head/sys/netinet6/sctp6_usrreq.c                                  |     11 +-
 head/sys/netipx/ipx.c                                             |     10 +-
 head/sys/pc98/conf/GENERIC                                        |      6 +-
 head/sys/powerpc/conf/GENERIC                                     |      6 +-
 head/sys/powerpc/conf/GENERIC64                                   |      6 +-
 head/sys/powerpc/powerpc/busdma_machdep.c                         |      5 +-
 head/sys/sparc64/conf/GENERIC                                     |      3 +-
 head/sys/ufs/ufs/ufs_quota.c                                      |     23 +-
 head/sys/vm/vm_object.h                                           |      4 +-
 head/tools/bsdbox/Makefile                                        |    115 +
 head/tools/bsdbox/Makefile.base                                   |     55 +
 head/tools/bsdbox/Makefile.fs                                     |     17 +
 head/tools/bsdbox/Makefile.hostapd                                |     15 +
 head/tools/bsdbox/Makefile.kld                                    |      6 +
 head/tools/bsdbox/Makefile.login                                  |      9 +
 head/tools/bsdbox/Makefile.net                                    |     32 +
 head/tools/bsdbox/Makefile.telnetd                                |     14 +
 head/tools/bsdbox/Makefile.textproc                               |     20 +
 head/tools/bsdbox/README                                          |     12 +
 head/tools/regression/bin/sh/builtins/getopts1.0                  |      8 +-
 head/tools/regression/msdosfs/msdosfstest-3.sh                    |      8 +-
 head/tools/regression/msdosfs/msdosfstest-4.sh                    |     10 +-
 head/tools/regression/msdosfs/msdosfstest-5.sh                    |     14 +-
 head/tools/regression/msdosfs/msdosfstest-6.sh                    |     11 +-
 head/tools/tools/nanobsd/pcengines/Files/root/.cshrc              |      4 +-
 head/tools/tools/wtap/wtap/Makefile                               |      9 +
 head/tools/tools/wtap/wtap/wtap.c                                 |     82 +
 head/usr.bin/Makefile                                             |      3 +-
 head/usr.bin/brandelf/brandelf.c                                  |      6 +-
 head/usr.bin/bsdiff/bsdiff/bsdiff.c                               |      4 +-
 head/usr.bin/ctlstat/Makefile                                     |      8 +
 head/usr.bin/ctlstat/ctlstat.8                                    |    122 +
 head/usr.bin/ctlstat/ctlstat.c                                    |    730 +
 head/usr.bin/hexdump/parse.c                                      |     33 +-
 head/usr.bin/locate/locate/util.c                                 |      8 +-
 head/usr.bin/mail/main.c                                          |      4 +-
 head/usr.bin/mail/util.c                                          |      4 +-
 head/usr.bin/ncplist/ncplist.c                                    |      9 +-
 head/usr.bin/netstat/if.c                                         |      4 +-
 head/usr.bin/newgrp/newgrp.c                                      |     12 +-
 head/usr.bin/split/split.c                                        |      5 +-
 head/usr.sbin/Makefile                                            |      3 +-
 head/usr.sbin/acpi/acpidb/Makefile                                |     11 +-
 head/usr.sbin/acpi/iasl/Makefile                                  |     10 +-
 head/usr.sbin/bluetooth/sdpd/server.c                             |      4 +-
 head/usr.sbin/bsnmpd/modules/snmp_wlan/BEGEMOT-WIRELESS-MIB.txt   |      5 +-
 head/usr.sbin/bsnmpd/modules/snmp_wlan/wlan_tree.def              |      6 +-
 head/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.1                  |     21 +-
 head/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c                  |     50 +-
 head/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c             |     19 +-
 head/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.h             |      6 +-
 head/usr.sbin/ctladm/Makefile                                     |     21 +
 head/usr.sbin/ctladm/ctladm.8                                     |    963 +
 head/usr.sbin/ctladm/ctladm.c                                     |   4005 +++
 head/usr.sbin/ctladm/ctladm.h                                     |     50 +
 head/usr.sbin/ctladm/util.c                                       |    156 +
 head/usr.sbin/daemon/daemon.c                                     |      8 +-
 head/usr.sbin/mlxcontrol/interface.c                              |      4 +-
 head/usr.sbin/newsyslog/newsyslog.c                               |     18 +-
 head/usr.sbin/pkg_install/add/main.c                              |      4 +-
 head/usr.sbin/pkg_install/lib/plist.c                             |      4 +-
 head/usr.sbin/tzsetup/tzsetup.c                                   |     36 +-
 692 files changed, 42765 insertions(+), 5275 deletions(-)

diffs (63828 lines):

diff -r ebe87ce4d7dd -r 1750de5b0399 head/Makefile.inc1
--- a/head/Makefile.inc1	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/Makefile.inc1	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 #
-# $FreeBSD: head/Makefile.inc1 228801 2011-12-22 15:03:48Z dim $
+# $FreeBSD: head/Makefile.inc1 229673 2012-01-06 00:34:27Z adrian $
 #
 # Make command line options:
 #	-DNO_CLEANDIR run ${MAKE} clean, instead of ${MAKE} cleandir
@@ -15,6 +15,8 @@
 #	-DNO_WWWUPDATE do not update www in ${MAKE} update
 #	-DNO_CTF do not run the DTrace CTF conversion tools on built objects
 #	LOCAL_DIRS="list of dirs" to add additional dirs to the SUBDIR list
+#	LOCAL_TOOL_DIRS="list of dirs" to add additional dirs to the build-tools
+#	    list
 #	TARGET="machine" to crossbuild world for a different machine type
 #	TARGET_ARCH= may be required when a TARGET supports multiple endians
 
@@ -105,6 +107,8 @@
 CLEANDIR=	cleandir
 .endif
 
+LOCAL_TOOL_DIRS?=
+
 CVS?=		cvs
 CVSFLAGS?=	-A -P -d -I!
 SVN?=		svn
@@ -1118,6 +1122,7 @@
     bin/csh \
     bin/sh \
     ${_rescue} \
+    ${LOCAL_TOOL_DIRS} \
     lib/ncurses/ncurses \
     lib/ncurses/ncursesw \
     ${_share} \
diff -r ebe87ce4d7dd -r 1750de5b0399 head/UPDATING
--- a/head/UPDATING	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/UPDATING	Fri Jan 13 15:51:01 2012 +0200
@@ -22,6 +22,13 @@
 	machines to maximize performance.  (To disable malloc debugging, run
 	ln -s aj /etc/malloc.conf.)
 
+20120109:
+	panic(9) now stops other CPUs in the SMP systems, disables interrupts
+	on the current CPU and prevents other threads from running.
+	This behavior can be reverted using the kern.stop_scheduler_on_panic
+	tunable/sysctl.
+	The new behavior can be incompatible with kern.sync_on_panic.
+
 20111215:
 	The carp(4) facility has been changed significantly. Configuration
 	of the CARP protocol via ifconfig(8) has changed, as well as format
@@ -1534,4 +1541,4 @@
 Contact Warner Losh if you have any questions about your use of
 this document.
 
-$FreeBSD: head/UPDATING 228571 2011-12-16 12:16:56Z glebius $
+$FreeBSD: head/UPDATING 229854 2012-01-09 12:06:09Z avg $
diff -r ebe87ce4d7dd -r 1750de5b0399 head/bin/ps/ps.c
--- a/head/bin/ps/ps.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/bin/ps/ps.c	Fri Jan 13 15:51:01 2012 +0200
@@ -47,7 +47,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/bin/ps/ps.c 227840 2011-11-22 21:14:46Z trociny $");
+__FBSDID("$FreeBSD: head/bin/ps/ps.c 229782 2012-01-07 16:10:23Z uqs $");
 
 #include <sys/param.h>
 #include <sys/proc.h>
@@ -625,7 +625,7 @@
 
 			ks = STAILQ_FIRST(&kinfo[i].ki_ks);
 			STAILQ_REMOVE_HEAD(&kinfo[i].ki_ks, ks_next);
-			/* Truncate rightmost column if neccessary.  */
+			/* Truncate rightmost column if necessary.  */
 			if (STAILQ_NEXT(vent, next_ve) == NULL &&
 			   termwidth != UNLIMITED && ks->ks_str != NULL) {
 				left = termwidth - linelen;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/contrib/gcc/config/freebsd.h
--- a/head/contrib/gcc/config/freebsd.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/contrib/gcc/config/freebsd.h	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
    Further work by David O'Brien <obrien at FreeBSD.org> and
    Loren J. Rittle <ljrittle at acm.org>.  */
 
-/* $FreeBSD$ */
+/* $FreeBSD: head/contrib/gcc/config/freebsd.h 229715 2012-01-06 18:37:49Z andreast $ */
 
 /* In case we need to know.  */
 #define USING_CONFIG_FREEBSD 1
@@ -63,6 +63,7 @@
 /* All FreeBSD Architectures support the ELF object file format.  */
 #undef  OBJECT_FORMAT_ELF
 #define OBJECT_FORMAT_ELF	1
+#undef  TARGET_ELF
 #define TARGET_ELF		1
 
 /* Don't assume anything about the header files.  */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/contrib/groff/tmac/doc-syms
--- a/head/contrib/groff/tmac/doc-syms	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/contrib/groff/tmac/doc-syms	Fri Jan 13 15:51:01 2012 +0200
@@ -605,6 +605,8 @@
 .ds doc-str-St--isoC           \*[doc-Tn-font-size]ISO/IEC\*[doc-str-St] 9899:1990
 .as doc-str-St--isoC           " (\*[Lq]\*[doc-Tn-font-size]ISO\~C\^90\*[doc-str-St]\*[Rq])
 .als doc-str-St--isoC-90 doc-str-St--isoC
+.ds doc-str-St--isoC-2011      \*[doc-Tn-font-size]ISO/IEC\*[doc-str-St] 9899:2011
+.as doc-str-St--isoC-2011      " (\*[Lq]\*[doc-Tn-font-size]ISO\~C\^11\*[doc-str-St]\*[Rq])
 .ds doc-str-St--isoC-99        \*[doc-Tn-font-size]ISO/IEC\*[doc-str-St] 9899:1999
 .as doc-str-St--isoC-99        " (\*[Lq]\*[doc-Tn-font-size]ISO\~C\^99\*[doc-str-St]\*[Rq])
 .ds doc-str-St--isoC-amd1       \*[doc-Tn-font-size]ISO/IEC\*[doc-str-St] 9899/AMD1:1995
@@ -613,8 +615,6 @@
 .as doc-str-St--isoC-tcor1      " (\*[Lq]\*[doc-Tn-font-size]ISO\~C\^90\*[doc-str-St], Technical Corrigendum 1\*[Rq])
 .ds doc-str-St--isoC-tcor2      \*[doc-Tn-font-size]ISO/IEC\*[doc-str-St] 9899/TCOR2:1995
 .as doc-str-St--isoC-tcor2      " (\*[Lq]\*[doc-Tn-font-size]ISO\~C\^90\*[doc-str-St], Technical Corrigendum 2\*[Rq])
-.ds doc-str-St--isoC-11        \*[doc-Tn-font-size]ISO/IEC\*[doc-str-St] 9899:2011
-.as doc-str-St--isoC-11        " (\*[Lq]\*[doc-Tn-font-size]ISO\~C\^11\*[doc-str-St]\*[Rq])
 .
 .\" POSIX Part 1: System API
 .ds doc-str-St--p1003.1        \*[doc-Tn-font-size]\%IEEE\*[doc-str-St] Std 1003.1
diff -r ebe87ce4d7dd -r 1750de5b0399 head/contrib/groff/tmac/groff_mdoc.man
--- a/head/contrib/groff/tmac/groff_mdoc.man	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/contrib/groff/tmac/groff_mdoc.man	Fri Jan 13 15:51:01 2012 +0200
@@ -2038,8 +2038,8 @@
 .St -isoC-90
 .It Li \-isoC\-99
 .St -isoC-99
-.It Li \-isoC\-11
-.St -isoC-11
+.It Li \-isoC\-2011
+.St -isoC-2011
 .El
 .Pp
 .
diff -r ebe87ce4d7dd -r 1750de5b0399 head/contrib/pf/pfctl/pfctl.8
--- a/head/contrib/pf/pfctl/pfctl.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/contrib/pf/pfctl/pfctl.8	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/contrib/pf/pfctl/pfctl.8 223637 2011-06-28 11:57:25Z bz $
+.\" $FreeBSD: head/contrib/pf/pfctl/pfctl.8 229669 2012-01-05 23:11:05Z rwatson $
 .\"
 .Dd June 21, 2011
 .Dt PFCTL 8
@@ -88,7 +88,7 @@
 is set to
 .Dv YES
 in
-.Xr rc.conf.local 8 ,
+.Xr rc.conf 5 ,
 the rule file specified with the variable
 .Va pf_rules
 is loaded automatically by the
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/mac.conf
--- a/head/etc/mac.conf	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/mac.conf	Fri Jan 13 15:51:01 2012 +0200
@@ -1,9 +1,9 @@
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/mac.conf 229783 2012-01-07 16:10:32Z uqs $
 #
 # TrustedBSD MAC userland policy configuration file.  Kernel modules
 # export label information, and mac.conf indicates to userland
-# applications what defaults they should use in the absense of any
+# applications what defaults they should use in the absence of any
 # other user-provided information.
 #
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/namedb/named.conf
--- a/head/etc/namedb/named.conf	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/namedb/named.conf	Fri Jan 13 15:51:01 2012 +0200
@@ -1,4 +1,4 @@
-// $FreeBSD: head/etc/namedb/named.conf 224125 2011-07-17 06:20:47Z dougb $
+// $FreeBSD: head/etc/namedb/named.conf 229783 2012-01-07 16:10:32Z uqs $
 //
 // Refer to the named.conf(5) and named(8) man pages, and the documentation
 // in /usr/share/doc/bind9 for more details.
@@ -94,7 +94,7 @@
 
 	As documented at http://dns.icann.org/services/axfr/ these zones:
 	"." (the root), ARPA, IN-ADDR.ARPA, IP6.ARPA, and ROOT-SERVERS.NET
-	are availble for AXFR from these servers on IPv4 and IPv6:
+	are available for AXFR from these servers on IPv4 and IPv6:
 	xfr.lax.dns.icann.org, xfr.cjr.dns.icann.org
 */
 /*
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/network.subr
--- a/head/etc/network.subr	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/network.subr	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $FreeBSD: head/etc/network.subr 228472 2011-12-13 14:36:04Z glebius $
+# $FreeBSD: head/etc/network.subr 229783 2012-01-07 16:10:32Z uqs $
 #
 
 #
@@ -139,7 +139,7 @@
 			_cfg=0
 		fi
 
-		# backward compatiblity: $ipv6_ifconfig_IF
+		# backward compatibility: $ipv6_ifconfig_IF
 		ifconfig_args=`get_if_var $1 ipv6_ifconfig_IF`
 		if [ -n "${ifconfig_args}" ]; then
 			warn "\$ipv6_ifconfig_$1 is obsolete." \
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.d/auditd
--- a/head/etc/rc.d/auditd	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.d/auditd	Fri Jan 13 15:51:01 2012 +0200
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/rc.d/auditd 229701 2012-01-06 14:00:31Z pjd $
 #
 # Start up for the Audit daemon.
 #
@@ -8,7 +8,7 @@
 # PROVIDE: auditd
 # REQUIRE: syslogd
 # BEFORE:  DAEMON
-# KEYWORD: shutdown
+# KEYWORD: nojail shutdown
 
 . /etc/rc.subr
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.d/bgfsck
--- a/head/etc/rc.d/bgfsck	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.d/bgfsck	Fri Jan 13 15:51:01 2012 +0200
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/rc.d/bgfsck 229783 2012-01-07 16:10:32Z uqs $
 #
 
 # PROVIDE: bgfsck
@@ -22,7 +22,7 @@
 		background_fsck_delay=0
 	fi
 	if [ ${background_fsck_delay} -lt 0 ]; then
-		echo "Background file system checks delayed indefinitly"
+		echo "Background file system checks delayed indefinitely"
 		return 0
 	fi
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.d/dhclient
--- a/head/etc/rc.d/dhclient	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.d/dhclient	Fri Jan 13 15:51:01 2012 +0200
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $FreeBSD: head/etc/rc.d/dhclient 226879 2011-10-28 06:03:38Z rea $
+# $FreeBSD: head/etc/rc.d/dhclient 230007 2012-01-12 06:48:11Z rea $
 #
 
 # PROVIDE: dhclient
@@ -22,7 +22,14 @@
 dhclient_pre_check()
 {
 	if [ -z "${rc_force}" ] && ! dhcpif $ifn; then
-		err 1 "'$ifn' is not a DHCP-enabled interface"
+		local msg
+		msg="'$ifn' is not a DHCP-enabled interface"
+		if [ -z "${rc_quiet}" ]; then
+			err 1 "$msg"
+		else
+			debug "$msg"
+			exit 1
+		fi
 	fi
 }
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.d/hostname
--- a/head/etc/rc.d/hostname	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.d/hostname	Fri Jan 13 15:51:01 2012 +0200
@@ -23,7 +23,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/rc.d/hostname 229822 2012-01-08 20:25:29Z dougb $
 #
 
 # PROVIDE: hostname
@@ -65,7 +65,7 @@
 		# Null hostname is probably OK if DHCP is in use.
 		#
 		if [ -z "`list_net_interfaces dhcp`" ]; then
-			warn "\$hostname is not set -- see ${rcvar_manpage}."
+			warn "\$hostname is not set -- see rc.conf(5)."
 		fi
 		return
 	fi
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.d/pfsync
--- a/head/etc/rc.d/pfsync	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.d/pfsync	Fri Jan 13 15:51:01 2012 +0200
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/rc.d/pfsync 229850 2012-01-09 08:50:22Z glebius $
 #
 
 # PROVIDE: pfsync
@@ -18,13 +18,6 @@
 
 pfsync_prestart()
 {
-	# XXX Currently pfsync cannot be a module as it must register
-	# a network protocol in a static kernel table.
-	if ! kldstat -q -m pfsync; then
-		warn "pfsync(4) must be statically compiled in the kernel."
-		return 1
-	fi
-
 	case "$pfsync_syncdev" in
 	'')
 		warn "pfsync_syncdev is not set."
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.firewall
--- a/head/etc/rc.firewall	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.firewall	Fri Jan 13 15:51:01 2012 +0200
@@ -23,7 +23,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/rc.firewall 229783 2012-01-07 16:10:32Z uqs $
 #
 
 #
@@ -46,7 +46,7 @@
 #   client      - will try to protect just this machine
 #   simple      - will try to protect a whole network
 #   closed      - totally disables IP services except via lo0 interface
-#   workstation - will try to protect just this machine using statefull
+#   workstation - will try to protect just this machine using stateful
 #		  firewalling. See below for rc.conf variables used
 #   UNKNOWN     - disables the loading of firewall rules.
 #   filename    - will load the rules in the given filename (full path required)
@@ -105,7 +105,7 @@
 	${fwcmd} add pass ipv6-icmp from fe80::/10 to fe80::/10
 	${fwcmd} add pass ipv6-icmp from fe80::/10 to ff02::/16
 
-	# Allow ICMPv6 destination unreach
+	# Allow ICMPv6 destination unreachable
 	${fwcmd} add pass ipv6-icmp from any to any icmp6types 1
 
 	# Allow NS/NA/toobig (don't filter it out)
@@ -437,7 +437,7 @@
 	#				 default denied packets should be
 	#				 logged (in /var/log/security).
 	#  firewall_nologports:		List of TCP/UDP ports for which
-	#				 denied incomming packets are not
+	#				 denied incoming packets are not
 	#				 logged.
 
 	# Allow packets for which a state has been built.
@@ -505,7 +505,7 @@
 	  ${fwcmd} add deny { tcp or udp } from any to any $i in
 	done
 
-	# Broadcasts and muticasts
+	# Broadcasts and multicasts
 	${fwcmd} add deny ip  from any to 255.255.255.255
 	${fwcmd} add deny ip  from any to 224.0.0.0/24 in	# XXX
 
@@ -513,7 +513,7 @@
 	${fwcmd} add deny udp from any to any 520 in
 
 	# Noise from webbrowsing.
-	# The statefull filter is a bit agressive, and will cause some
+	# The stateful filter is a bit aggressive, and will cause some
 	#  connection teardowns to be logged.
 	${fwcmd} add deny tcp from any 80,443 to any 1024-65535 in
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.initdiskless
--- a/head/etc/rc.initdiskless	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.initdiskless	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/rc.initdiskless 229783 2012-01-07 16:10:32Z uqs $
 
 # On entry to this script the entire system consists of a read-only root
 # mounted via NFS. The kernel has run BOOTP and configured an interface
@@ -46,16 +46,16 @@
 #  bcast/${ipba} same as above
 #  ${class}	where ${class} is a list of directories supplied by
 #		bootp/dhcp through the T134 option.
-#		${ipba} and ${class} are typicall used to configure features
+#		${ipba} and ${class} are typically used to configure features
 #		for group of diskless clients, or even individual features;
 #  ${ip}	where ${ip} is the machine's assigned IP address, typically
 #		used to set host-specific features;
 #  ip/${ip}	same as above
 #
 # Template directories are scanned in the order they are listed above,
-# with each sucessive directory overriding (merged into) the previous one;
+# with each successive directory overriding (merged into) the previous one;
 # non-existing directories are ignored.  The subdirectory forms exist to
-# help keep the top level /conf managable in large installations.
+# help keep the top level /conf manageable in large installations.
 #
 # The existence of a directory /conf/T/M causes this script to create a
 # memory filesystem mounted as /M on the client.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/rc.subr
--- a/head/etc/rc.subr	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/rc.subr	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 # $NetBSD: rc.subr,v 1.67 2006/10/07 11:25:15 elad Exp $
-# $FreeBSD: head/etc/rc.subr 227366 2011-11-08 23:02:32Z jilles $
+# $FreeBSD: head/etc/rc.subr 230007 2012-01-12 06:48:11Z rea $
 #
 # Copyright (c) 1997-2004 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -32,7 +32,6 @@
 #	functions used by various rc scripts
 #
 
-: ${rcvar_manpage:='rc.conf(5)'}
 : ${RC_PID:=$$}; export RC_PID
 
 #
@@ -152,7 +151,7 @@
 		return 1
 		;;
 	*)
-		warn "\$${1} is not set properly - see ${rcvar_manpage}."
+		warn "\$${1} is not set properly - see rc.conf(5)."
 		return 1
 		;;
 	esac
@@ -1117,7 +1116,7 @@
 #
 rc_usage()
 {
-	echo -n 1>&2 "Usage: $0 [fast|force|one]("
+	echo -n 1>&2 "Usage: $0 [fast|force|one|quiet]("
 
 	_sep=
 	for _elem; do
@@ -1280,7 +1279,7 @@
 #	Make a symbolic link 'link' to src from basedir. If the
 #	directory in which link is to be created does not exist
 #	a warning will be displayed and an error will be returned.
-#	Returns 0 on sucess, 1 otherwise.
+#	Returns 0 on success, 1 otherwise.
 #
 make_symlink()
 {
diff -r ebe87ce4d7dd -r 1750de5b0399 head/etc/services
--- a/head/etc/services	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/etc/services	Fri Jan 13 15:51:01 2012 +0200
@@ -16,7 +16,7 @@
 # Kerberos services are for Kerberos v4, and are unofficial.  Sites running
 # v5 should uncomment v5 entries and comment v4 entries.
 #
-# $FreeBSD$
+# $FreeBSD: head/etc/services 229783 2012-01-07 16:10:32Z uqs $
 #	From: @(#)services	5.8 (Berkeley) 5/9/91
 #
 # WELL KNOWN PORT NUMBERS
@@ -795,7 +795,7 @@
 kpasswd5	464/tcp	   # Kerberos (v5)
 kpasswd5	464/udp	   # Kerberos (v5)
 #PROBLEMS!==============================================================
-# IANA has offically assigned these two ports as ``kpasswd''
+# IANA has officially assigned these two ports as ``kpasswd''
 #kpasswd	464/tcp	   # Kerberos (v5)
 #kpasswd	464/udp	   # Kerberos (v5)
 #PROBLEMS!==============================================================
@@ -1275,8 +1275,8 @@
 hcp-wismar      686/udp    #Hardware Control Protocol Wismar
 asipregistry	687/tcp
 asipregistry	687/udp
-realm-rusd      688/tcp    #ApplianceWare managment protocol
-realm-rusd      688/udp    #ApplianceWare managment protocol
+realm-rusd      688/tcp    #ApplianceWare management protocol
+realm-rusd      688/udp    #ApplianceWare management protocol
 nmap            689/tcp
 nmap            689/udp
 vatp            690/tcp    #Velazquez Application Transfer Protocol
@@ -2392,7 +2392,7 @@
 xdsxdm		6558/udp
 sane-port	6566/tcp   #Scanner Access Now Easy (SANE) Control Port
 sane-port	6566/udp   #Scanner Access Now Easy (SANE) Control Port
-ircd		6667/tcp   #Internet Relay Chat (unoffical)
+ircd		6667/tcp   #Internet Relay Chat (unofficial)
 frc-hp		6704/sctp  #ForCES HP (High Priority) channel
 frc-mp		6705/sctp  #ForCES MP (Medium Priority) channel
 frc-lp		6706/sctp  #ForCES LP (Low priority) channel
diff -r ebe87ce4d7dd -r 1750de5b0399 head/gnu/usr.bin/cvs/lib/config.h.proto
--- a/head/gnu/usr.bin/cvs/lib/config.h.proto	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/gnu/usr.bin/cvs/lib/config.h.proto	Fri Jan 13 15:51:01 2012 +0200
@@ -1,4 +1,4 @@
-/* $FreeBSD$ */
+/* $FreeBSD: head/gnu/usr.bin/cvs/lib/config.h.proto 229809 2012-01-08 12:38:41Z ed $ */
 
 /* config.h.  Generated from config.h.in by configure.  */
 /* config.h.in.  Generated from configure.in by autoheader.  */
@@ -324,7 +324,7 @@
 #define HAVE_SYS_STAT_H 1
 
 /* Define to 1 if you have the <sys/timeb.h> header file. */
-#define HAVE_SYS_TIMEB_H 1
+/* #undef HAVE_SYS_TIMEB_H */
 
 /* Define to 1 if you have the <sys/time.h> header file. */
 #define HAVE_SYS_TIME_H 1
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/arpa/nameser_compat.h
--- a/head/include/arpa/nameser_compat.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/arpa/nameser_compat.h	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
 /*%
  *      from nameser.h	8.1 (Berkeley) 6/2/93
  *	$Id: nameser_compat.h,v 1.5.18.3 2006/05/19 02:36:00 marka Exp $
- * $FreeBSD$
+ * $FreeBSD: head/include/arpa/nameser_compat.h 229781 2012-01-07 16:10:15Z uqs $
  */
 
 #ifndef _ARPA_NAMESER_COMPAT_
@@ -63,7 +63,7 @@
 			/* fields in third byte */
 	unsigned	qr: 1;		/*%< response flag */
 	unsigned	opcode: 4;	/*%< purpose of message */
-	unsigned	aa: 1;		/*%< authoritive answer */
+	unsigned	aa: 1;		/*%< authoritative answer */
 	unsigned	tc: 1;		/*%< truncated message */
 	unsigned	rd: 1;		/*%< recursion desired */
 			/* fields in fourth byte */
@@ -77,7 +77,7 @@
 			/* fields in third byte */
 	unsigned	rd :1;		/*%< recursion desired */
 	unsigned	tc :1;		/*%< truncated message */
-	unsigned	aa :1;		/*%< authoritive answer */
+	unsigned	aa :1;		/*%< authoritative answer */
 	unsigned	opcode :4;	/*%< purpose of message */
 	unsigned	qr :1;		/*%< response flag */
 			/* fields in fourth byte */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/complex.h
--- a/head/include/complex.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/complex.h	Fri Jan 13 15:51:01 2012 +0200
@@ -23,24 +23,26 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/include/complex.h 226458 2011-10-17 05:41:03Z das $
+ * $FreeBSD: head/include/complex.h 229594 2012-01-05 12:09:39Z ed $
  */
 
 #ifndef _COMPLEX_H
 #define	_COMPLEX_H
 
+#include <sys/cdefs.h>
+
 #ifdef __GNUC__
 #if __STDC_VERSION__ < 199901
 #define	_Complex	__complex__
 #endif
-#define	_Complex_I	1.0fi
+#define	_Complex_I	((float _Complex)1.0i)
+_Static_assert(__generic(_Complex_I, float _Complex, 1, 0),
+    "_Complex_I must be of type float _Complex");
 #endif
 
 #define	complex		_Complex
 #define	I		_Complex_I
 
-#include <sys/cdefs.h>
-
 __BEGIN_DECLS
 
 double		cabs(double complex);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/dlfcn.h
--- a/head/include/dlfcn.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/dlfcn.h	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/include/dlfcn.h 229768 2012-01-07 10:33:01Z kib $
  */
 
 #ifndef _DLFCN_H_
@@ -118,6 +118,7 @@
 void	*dlsym(void * __restrict, const char * __restrict);
 
 #if __BSD_VISIBLE
+void	*fdlopen(int, int);
 int	 dladdr(const void * __restrict, Dl_info * __restrict);
 dlfunc_t dlfunc(void * __restrict, const char * __restrict);
 int	 dlinfo(void * __restrict, int, void * __restrict);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/gssapi/gssapi.h
--- a/head/include/gssapi/gssapi.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/gssapi/gssapi.h	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  * HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
  * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/include/gssapi/gssapi.h 229781 2012-01-07 16:10:15Z uqs $
  */
 
 #ifndef _GSSAPI_GSSAPI_H_
@@ -756,11 +756,11 @@
 OM_uint32 gss_decapsulate_token
 	      (const gss_buffer_t,  /* mechanism independent token */
 	       gss_OID,		 /* desired mechanism */
-	       gss_buffer_t	 /* decapsulated mechanism dependant token */
+	       gss_buffer_t	 /* decapsulated mechanism dependent token */
 	      );
 
 OM_uint32 gss_encapsulate_token
-	      (const gss_buffer_t,  /* mechanism dependant token */
+	      (const gss_buffer_t,  /* mechanism dependent token */
 	       gss_OID,		 /* desired mechanism */
 	       gss_buffer_t	 /* encapsulated mechanism independent token */
 	      );
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/resolv.h
--- a/head/include/resolv.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/resolv.h	Fri Jan 13 15:51:01 2012 +0200
@@ -47,7 +47,7 @@
 /*%
  *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
  *	$Id: resolv.h,v 1.19.18.4 2008/04/03 23:15:15 marka Exp $
- * $FreeBSD$
+ * $FreeBSD: head/include/resolv.h 229781 2012-01-07 16:10:15Z uqs $
  */
 
 #ifndef _RESOLV_H_
@@ -184,7 +184,7 @@
 			u_int16_t		nscount;
 			u_int16_t		nstimes[MAXNS];	/*%< ms. */
 			int			nssocks[MAXNS];
-			struct __res_state_ext *ext;	/*%< extention for IPv6 */
+			struct __res_state_ext *ext;	/*%< extension for IPv6 */
 		} _ext;
 	} _u;
 };
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/rpc/svc.h
--- a/head/include/rpc/svc.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/rpc/svc.h	Fri Jan 13 15:51:01 2012 +0200
@@ -30,7 +30,7 @@
  *
  *	from: @(#)svc.h 1.35 88/12/17 SMI
  *	from: @(#)svc.h      1.27    94/04/25 SMI
- * $FreeBSD$
+ * $FreeBSD: head/include/rpc/svc.h 229781 2012-01-07 16:10:15Z uqs $
  */
 
 /*
@@ -314,7 +314,7 @@
  * Somebody has to wait for incoming requests and then call the correct
  * service routine.  The routine svc_run does infinite waiting; i.e.,
  * svc_run never returns.
- * Since another (co-existant) package may wish to selectively wait for
+ * Since another (co-existent) package may wish to selectively wait for
  * incoming calls or other events outside of the rpc architecture, the
  * routine svc_getreq is provided.  It must be passed readfds, the
  * "in-place" results of a select system call (see select, section 2).
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/rpcsvc/mount.x
--- a/head/include/rpcsvc/mount.x	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/rpcsvc/mount.x	Fri Jan 13 15:51:01 2012 +0200
@@ -37,7 +37,7 @@
 %/*static char sccsid[] = "from: @(#)mount.x	2.1 88/08/01 4.0 RPCSRC";*/
 %#endif /* not lint */
 %#include <sys/cdefs.h>
-%__FBSDID("$FreeBSD$");
+%__FBSDID("$FreeBSD: head/include/rpcsvc/mount.x 229781 2012-01-07 16:10:15Z uqs $");
 #endif
 
 const MNTPATHLEN = 1024;	/* maximum bytes in a pathname argument */
@@ -150,7 +150,7 @@
 	version MOUNTVERS {
 		/*
 		 * Does no work. It is made available in all RPC services
-		 * to allow server reponse testing and timing
+		 * to allow server response testing and timing
 		 */
 		void
 		MOUNTPROC_NULL(void) = 0;
@@ -205,7 +205,7 @@
 	version MOUNTVERS3 {
 		/*
 		 * Does no work. It is made available in all RPC services
-		 * to allow server reponse testing and timing
+		 * to allow server response testing and timing
 		 */
 		void
 		MOUNTPROC_NULL(void) = 0;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/rpcsvc/nfs_prot.x
--- a/head/include/rpcsvc/nfs_prot.x	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/rpcsvc/nfs_prot.x	Fri Jan 13 15:51:01 2012 +0200
@@ -33,7 +33,7 @@
 %/*static char sccsid[] = "from: @(#)nfs_prot.x	2.1 88/08/01 4.0 RPCSRC";*/
 %#endif /* not lint */
 %#include <sys/cdefs.h>
-%__FBSDID("$FreeBSD$");
+%__FBSDID("$FreeBSD: head/include/rpcsvc/nfs_prot.x 229781 2012-01-07 16:10:15Z uqs $");
 #endif
 
 const NFS_PORT          = 2049;
@@ -121,7 +121,7 @@
 	unsigned uid;		/* owner user id */
 	unsigned gid;		/* owner group id */
 	unsigned size;		/* file size in bytes */
-	unsigned blocksize;	/* prefered block size */
+	unsigned blocksize;	/* preferred block size */
 	unsigned rdev;		/* special device # */
 	unsigned blocks;	/* Kb of disk used by file */
 	unsigned fsid;		/* device # */
@@ -402,7 +402,7 @@
 	uid3	uid;		/* owner user id */
 	gid3	gid;		/* owner group id */
 	size3	size;		/* file size in bytes */
-	size3	used;		/* prefered block size */
+	size3	used;		/* preferred block size */
 	specdata3 rdev;		/* special device # */
 	uint64 fsid;		/* device # */
 	fileid3	fileid;		/* inode # */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/rpcsvc/nis.x
--- a/head/include/rpcsvc/nis.x	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/rpcsvc/nis.x	Fri Jan 13 15:51:01 2012 +0200
@@ -30,7 +30,7 @@
 
 #ifndef RPC_HDR
 %#include <sys/cdefs.h>
-%__FBSDID("$FreeBSD$");
+%__FBSDID("$FreeBSD: head/include/rpcsvc/nis.x 229781 2012-01-07 16:10:15Z uqs $");
 #endif
 
 /* 
@@ -192,8 +192,8 @@
  * note that modifications will appear as two entries, for names, they have
  * an "OLD" entry followed by a "NEW" entry. For entries in tables, there
  * is a remove followed by an add. It is done this way so that we can read
- * the log backwards to back out transactions and forwards to propogate
- * updated.
+ * the log backwards to back out transactions and forwards to propagate
+ * updates.
  */
 enum log_entry_t {
 	LOG_NOP = 0,
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/stdlib.h
--- a/head/include/stdlib.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/stdlib.h	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)stdlib.h	8.5 (Berkeley) 5/19/95
- * $FreeBSD: head/include/stdlib.h 228901 2011-12-26 18:55:37Z ed $
+ * $FreeBSD: head/include/stdlib.h 229848 2012-01-09 06:36:28Z ed $
  */
 
 #ifndef _STDLIB_H_
@@ -149,12 +149,13 @@
 #endif /* __ISO_C_VISIBLE >= 1999 */
 
 /*
- * If we're in a mode greater than C99, expose C1x functions.
+ * If we're in a mode greater than C99, expose C11 functions.
  */
 #if __ISO_C_VISIBLE >= 2011
+void *	aligned_alloc(size_t, size_t);
+int	at_quick_exit(void (*)(void));
 _Noreturn void
 	quick_exit(int);
-int	at_quick_exit(void (*)(void));
 #endif /* __ISO_C_VISIBLE >= 2011 */
 /*
  * Extensions made by POSIX relative to C.  We don't know yet which edition
diff -r ebe87ce4d7dd -r 1750de5b0399 head/include/tgmath.h
--- a/head/include/tgmath.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/include/tgmath.h	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/include/tgmath.h 229575 2012-01-05 10:46:22Z ed $
+ * $FreeBSD: head/include/tgmath.h 229716 2012-01-06 19:04:59Z ed $
  */
 
 #ifndef _TGMATH_H_
@@ -54,21 +54,40 @@
  * because the return type of the whole expression would incorrectly be long
  * double complex regardless of the argument types.
  *
- * The _Complex_I distinction should not be needed, but due to a bug in
- * GCC 4.2, _Complex_I is not of type float _Complex.
+ * The structure of the C11 implementation of these macros can in
+ * principle be reused for non-C11 compilers, but due to an integer
+ * promotion bug for complex types in GCC 4.2, simply let non-C11
+ * compilers use an inefficient yet reliable version.
  */
 
-#ifndef __generic
-#error "<tgmath.h> not implemented for this compiler"
-#endif
-
+#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
+#define	__tg_generic(x, cfnl, cfn, cfnf, fnl, fn, fnf)			\
+	_Generic(x,							\
+		long double _Complex: cfnl,				\
+		double _Complex: cfn,					\
+		float _Complex: cfnf,					\
+		long double: fnl,					\
+		default: fn,						\
+		float: fnf						\
+	)
+#define	__tg_type(x)							\
+	__tg_generic(x, (long double _Complex)0, (double _Complex)0,	\
+	    (float _Complex)0, (long double)0, (double)0, (float)0)
+#define	__tg_impl_simple(x, y, z, fnl, fn, fnf, ...)			\
+	__tg_generic(							\
+	    __tg_type(x) + __tg_type(y) + __tg_type(z),			\
+	    fnl, fn, fnf, fnl, fn, fnf)(__VA_ARGS__)
+#define	__tg_impl_full(x, y, cfnl, cfn, cfnf, fnl, fn, fnf, ...)	\
+	__tg_generic(							\
+	    __tg_type(x) + __tg_type(y),				\
+	    cfnl, cfn, cfnf, fnl, fn, fnf)(__VA_ARGS__)
+#elif defined(__generic)
 #define	__tg_generic_simple(x, fnl, fn, fnf)				\
 	__generic(x, long double _Complex, fnl,				\
 	    __generic(x, double _Complex, fn,				\
 	        __generic(x, float _Complex, fnf,			\
-	            __generic(x, __typeof(_Complex_I), fnf,		\
-	                __generic(x, long double, fnl,			\
-	                    __generic(x, float, fnf, fn))))))
+	            __generic(x, long double, fnl,			\
+	                __generic(x, float, fnf, fn)))))
 #define	__tg_impl_simple(x, y, z, fnl, fn, fnf, ...)			\
 	__tg_generic_simple(x,						\
 	    __tg_generic_simple(y,					\
@@ -87,9 +106,8 @@
 	__generic(x, long double _Complex, cfnl,			\
 	    __generic(x, double _Complex, cfn,				\
 	        __generic(x, float _Complex, cfnf,			\
-	            __generic(x, __typeof(_Complex_I), cfnf,		\
-	                __generic(x, long double, fnl,			\
-	                    __generic(x, float, fnf, fn))))))
+	            __generic(x, long double, fnl,			\
+	                __generic(x, float, fnf, fn)))))
 #define	__tg_impl_full(x, y, cfnl, cfn, cfnf, fnl, fn, fnf, ...)	\
 	__tg_generic_full(x,						\
 	    __tg_generic_full(y, cfnl, cfnl, cfnl, cfnl, cfnl, cfnl),	\
@@ -99,6 +117,9 @@
 	    __tg_generic_full(y, cfnl, cfn , cfn , fnl , fn  , fn  ),	\
 	    __tg_generic_full(y, cfnl, cfn , cfnf, fnl , fn  , fnf ))	\
 	    (__VA_ARGS__)
+#else
+#error "<tgmath.h> not implemented for this compiler"
+#endif
 
 /* Macros to save lots of repetition below */
 #define	__tg_simple(x, fn)						\
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/gen/Makefile.inc
--- a/head/lib/libc/gen/Makefile.inc	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/gen/Makefile.inc	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 #	@(#)Makefile.inc	8.6 (Berkeley) 5/4/95
-# $FreeBSD: head/lib/libc/gen/Makefile.inc 228843 2011-12-23 15:00:37Z cperciva $
+# $FreeBSD: head/lib/libc/gen/Makefile.inc 229768 2012-01-07 10:33:01Z kib $
 
 # machine-independent gen sources
 .PATH: ${.CURDIR}/${LIBC_ARCH}/gen ${.CURDIR}/gen
@@ -95,8 +95,8 @@
 	directory.3 fdopendir.3 \
 	directory.3 readdir.3 directory.3 readdir_r.3 directory.3 rewinddir.3 \
 	directory.3 seekdir.3 directory.3 telldir.3
-MLINKS+=dlopen.3 dlclose.3 dlopen.3 dlerror.3 dlopen.3 dlfunc.3 \
-	dlopen.3 dlsym.3
+MLINKS+=dlopen.3 fdlopen.3 dlopen.3 dlclose.3 dlopen.3 dlerror.3 \
+	dlopen.3 dlfunc.3 dlopen.3 dlsym.3
 MLINKS+=err.3 err_set_exit.3 err.3 err_set_file.3 err.3 errc.3 err.3 errx.3 \
 	err.3 verr.3 err.3 verrc.3 err.3 verrx.3 err.3 vwarn.3 err.3 vwarnc.3 \
 	err.3 vwarnx.3 err.3 warnc.3 err.3 warn.3 err.3 warnx.3
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/gen/Symbol.map
--- a/head/lib/libc/gen/Symbol.map	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/gen/Symbol.map	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*
- * $FreeBSD: head/lib/libc/gen/Symbol.map 228843 2011-12-23 15:00:37Z cperciva $
+ * $FreeBSD: head/lib/libc/gen/Symbol.map 229768 2012-01-07 10:33:01Z kib $
  */
 
 FBSD_1.0 {
@@ -382,6 +382,7 @@
 };
 
 FBSD_1.3 {
+	 fdlopen;
 	__FreeBSD_libc_enter_restricted_mode;
 };
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/gen/dlfcn.c
--- a/head/lib/libc/gen/dlfcn.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/gen/dlfcn.c	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libc/gen/dlfcn.c 229768 2012-01-07 10:33:01Z kib $");
 
 /*
  * Linkage to services provided by the dynamic linker.
@@ -147,6 +147,15 @@
 	return 0;
 }
 
+#pragma weak fdlopen
+void *
+fdlopen(int fd, int mode)
+{
+
+	_rtld_error(sorry);
+	return NULL;
+}
+
 #pragma weak _rtld_atfork_pre
 void
 _rtld_atfork_pre(int *locks)
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/gen/dlopen.3
--- a/head/lib/libc/gen/dlopen.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/gen/dlopen.3	Fri Jan 13 15:51:01 2012 +0200
@@ -30,13 +30,14 @@
 .\" Copyright (c) 1991 Sun Microsystems, Inc.
 .\"
 .\" @(#) dlopen.3 1.6 90/01/31 SMI
-.\" $FreeBSD$
+.\" $FreeBSD: head/lib/libc/gen/dlopen.3 229768 2012-01-07 10:33:01Z kib $
 .\"
-.Dd July 7, 2009
+.Dd December 21, 2011
 .Dt DLOPEN 3
 .Os
 .Sh NAME
 .Nm dlopen ,
+.Nm fdlopen ,
 .Nm dlsym ,
 .Nm dlfunc ,
 .Nm dlerror ,
@@ -49,6 +50,8 @@
 .Ft void *
 .Fn dlopen "const char *path" "int mode"
 .Ft void *
+.Fn fdlopen "int fd" "int mode"
+.Ft void *
 .Fn dlsym "void * restrict handle" "const char * restrict symbol"
 .Ft dlfunc_t
 .Fn dlfunc "void * restrict handle" "const char * restrict symbol"
@@ -164,6 +167,36 @@
 .Fn dlerror .
 .Pp
 The
+.Fn fdlopen
+function is similar to
+.Fn dlopen ,
+but it takes the file descriptor argument
+.Fa fd ,
+which is used for the file operations needed to load an object
+into the address space.
+The file descriptor
+.Fa fd
+is not closed by the function regardless a result of execution,
+but a duplicate of the file descriptor is.
+This may be important if a
+.Xr lockf 3
+lock is held on the passed descriptor.
+The
+.Fa fd
+argument -1 is interpreted as a reference to the main
+executable of the process, similar to
+.Va NULL
+value for the
+.Fa name
+argument to
+.Fn dlopen .
+The
+.Fn fdlopen
+function can be used by the code that needs to perform
+additional checks on the loaded objects, to prevent races with
+symlinking or renames.
+.Pp
+The
 .Fn dlsym
 function
 returns the address binding of the symbol described in the null-terminated
@@ -354,6 +387,7 @@
 .Sh ERRORS
 The
 .Fn dlopen ,
+.Fn fdlopen ,
 .Fn dlsym ,
 and
 .Fn dlfunc
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/gen/getnetgrent.c
--- a/head/lib/libc/gen/getnetgrent.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/gen/getnetgrent.c	Fri Jan 13 15:51:01 2012 +0200
@@ -34,7 +34,7 @@
 static char sccsid[] = "@(#)getnetgrent.c	8.2 (Berkeley) 4/27/95";
 #endif /* LIBC_SCCS and not lint */
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libc/gen/getnetgrent.c 229938 2012-01-10 19:54:53Z ghelmer $");
 
 #include <ctype.h>
 #include <stdio.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/net/getaddrinfo.c
--- a/head/lib/libc/net/getaddrinfo.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/net/getaddrinfo.c	Fri Jan 13 15:51:01 2012 +0200
@@ -54,7 +54,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libc/net/getaddrinfo.c 229766 2012-01-07 09:01:19Z ume $");
 
 #include "namespace.h"
 #include <sys/types.h>
@@ -1576,7 +1576,8 @@
 	if (*scope == '\0')
 		return -1;
 
-	if (IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6)) {
+	if (IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6) ||
+	    IN6_IS_ADDR_MC_NODELOCAL(a6)) {
 		/*
 		 * We currently assume a one-to-one mapping between links
 		 * and interfaces, so we simply use interface indices for
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/powerpc/SYS.h
--- a/head/lib/libc/powerpc/SYS.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/powerpc/SYS.h	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  * SUCH DAMAGE.
  *
  *	$NetBSD: SYS.h,v 1.8 2002/01/14 00:55:56 thorpej Exp $
- * $FreeBSD$
+ * $FreeBSD: head/lib/libc/powerpc/SYS.h 229693 2012-01-06 09:21:40Z andreast $
  */
 
 #include <sys/syscall.h>
@@ -44,10 +44,8 @@
 	.align 2;						\
 2:	b	PIC_PLT(CNAME(HIDENAME(cerror)));		\
 ENTRY(__CONCAT(__sys_,x));					\
-	.weak	CNAME(x);					\
-	.set	CNAME(x),CNAME(__CONCAT(__sys_,x));		\
-	.weak	CNAME(__CONCAT(_,x));				\
-	.set	CNAME(__CONCAT(_,x)),CNAME(__CONCAT(__sys_,x));	\
+	WEAK_ALIAS(x,__CONCAT(__sys_,x));			\
+	WEAK_ALIAS(__CONCAT(_,x),__CONCAT(__sys_,x));		\
 	_SYSCALL(x);						\
 	bso	2b
 
@@ -55,8 +53,7 @@
 	.text;							\
 	.align 2;						\
 ENTRY(__CONCAT(__sys_,x));					\
-	.weak	CNAME(__CONCAT(_,x));				\
-	.set	CNAME(__CONCAT(_,x)),CNAME(__CONCAT(__sys_,x));	\
+	WEAK_ALIAS(__CONCAT(_,x),__CONCAT(__sys_,x));		\
 	_SYSCALL(x);						\
 	bnslr;							\
 	b	PIC_PLT(CNAME(HIDENAME(cerror)))
@@ -66,10 +63,8 @@
 	.align 2;						\
 2:	b	PIC_PLT(CNAME(HIDENAME(cerror)));		\
 ENTRY(__CONCAT(__sys_,x));					\
-	.weak	CNAME(x);					\
-	.set	CNAME(x),CNAME(__CONCAT(__sys_,x));		\
-	.weak	CNAME(__CONCAT(_,x));				\
-	.set	CNAME(__CONCAT(_,x)),CNAME(__CONCAT(__sys_,x));	\
+	WEAK_ALIAS(x,__CONCAT(__sys_,x));			\
+	WEAK_ALIAS(__CONCAT(_,x), __CONCAT(__sys_,x));		\
 	_SYSCALL(x);						\
 	bnslr;							\
 	b	PIC_PLT(CNAME(HIDENAME(cerror)))
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/powerpc/gen/setjmp.S
--- a/head/lib/libc/powerpc/gen/setjmp.S	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/powerpc/gen/setjmp.S	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
 /*      $NetBSD: setjmp.S,v 1.3 1998/10/03 12:30:38 tsubai Exp $        */
 
 #include <machine/asm.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libc/powerpc/gen/setjmp.S 229806 2012-01-08 11:57:38Z andreast $");
 
 #include <sys/syscall.h>
 	
@@ -69,8 +69,7 @@
 	li	%r3,0			/* return (0) */
 	blr
 
-	.weak CNAME(longjmp)
-	.set CNAME(longjmp),CNAME(__longjmp)
+	WEAK_ALIAS(longjmp, __longjmp)
 ENTRY(__longjmp)
 	lmw	%r9,20(%r3)		/* restore regs */
 	mr	%r6,%r4			/* save val param */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/powerpc64/SYS.h
--- a/head/lib/libc/powerpc64/SYS.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/powerpc64/SYS.h	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  * SUCH DAMAGE.
  *
  *	$NetBSD: SYS.h,v 1.8 2002/01/14 00:55:56 thorpej Exp $
- * $FreeBSD$
+ * $FreeBSD: head/lib/libc/powerpc64/SYS.h 229693 2012-01-06 09:21:40Z andreast $
  */
 
 #include <sys/syscall.h>
@@ -52,10 +52,8 @@
 	mtlr	%r0;						\
 	blr;							\
 ENTRY(__CONCAT(__sys_,x));					\
-	.weak	CNAME(x);					\
-	.set	CNAME(x),CNAME(__CONCAT(__sys_,x));		\
-	.weak	CNAME(__CONCAT(_,x));				\
-	.set	CNAME(__CONCAT(_,x)),CNAME(__CONCAT(__sys_,x));	\
+	WEAK_ALIAS(x,__CONCAT(__sys_,x));			\
+	WEAK_ALIAS(__CONCAT(_,x),__CONCAT(__sys_,x));		\
 	_SYSCALL(x);						\
 	bso	2b
 
@@ -63,8 +61,7 @@
 	.text;							\
 	.align 2;						\
 ENTRY(__CONCAT(__sys_,x));					\
-	.weak	CNAME(__CONCAT(_,x));				\
-	.set	CNAME(__CONCAT(_,x)),CNAME(__CONCAT(__sys_,x));	\
+	WEAK_ALIAS(__CONCAT(_,x),__CONCAT(__sys_,x));		\
 	_SYSCALL(x);						\
 	bnslr;							\
 	mflr	%r0;						\
@@ -81,10 +78,8 @@
 	.text;							\
 	.align 2;						\
 ENTRY(__CONCAT(__sys_,x));					\
-	.weak	CNAME(x);					\
-	.set	CNAME(x),CNAME(__CONCAT(__sys_,x));		\
-	.weak	CNAME(__CONCAT(_,x));				\
-	.set	CNAME(__CONCAT(_,x)),CNAME(__CONCAT(__sys_,x));	\
+	WEAK_ALIAS(x,__CONCAT(__sys_,x));			\
+	WEAK_ALIAS(__CONCAT(_,x), __CONCAT(__sys_,x));		\
 	_SYSCALL(x);						\
 	bnslr;							\
 								\
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/powerpc64/gen/setjmp.S
--- a/head/lib/libc/powerpc64/gen/setjmp.S	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/powerpc64/gen/setjmp.S	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
 /*      $NetBSD: setjmp.S,v 1.3 1998/10/03 12:30:38 tsubai Exp $        */
 
 #include <machine/asm.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libc/powerpc64/gen/setjmp.S 229806 2012-01-08 11:57:38Z andreast $");
 
 #include <sys/syscall.h>
 	
@@ -93,10 +93,7 @@
 	li	%r3,0			/* return (0) */
 	blr
 
-	.weak CNAME(longjmp)
-	.set CNAME(longjmp),CNAME(__longjmp)
-	.weak CNAME(.longjmp)
-	.set CNAME(.longjmp),CNAME(.__longjmp)
+	WEAK_ALIAS(longjmp, __longjmp)
 ENTRY(__longjmp)
 	ld	%r9,40 + 0*8(%r3)
 	ld	%r10,40 + 1*8(%r3)
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/stdlib/Makefile.inc
--- a/head/lib/libc/stdlib/Makefile.inc	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/stdlib/Makefile.inc	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 #	from @(#)Makefile.inc	8.3 (Berkeley) 2/4/95
-# $FreeBSD: head/lib/libc/stdlib/Makefile.inc 228322 2011-12-07 15:25:48Z theraven $
+# $FreeBSD: head/lib/libc/stdlib/Makefile.inc 229848 2012-01-09 06:36:28Z ed $
 
 # machine-independent stdlib sources
 .PATH: ${.CURDIR}/${LIBC_ARCH}/stdlib ${.CURDIR}/stdlib
@@ -18,17 +18,18 @@
 # machine-dependent stdlib sources
 .sinclude "${.CURDIR}/${LIBC_ARCH}/stdlib/Makefile.inc"
 
-MAN+=	a64l.3 abort.3 abs.3 alloca.3 atexit.3 atof.3 atoi.3 atol.3 \
-	at_quick_exit.3 bsearch.3 \
+MAN+=	a64l.3 abort.3 abs.3 aligned_alloc.3 alloca.3 atexit.3 atof.3 \
+	atoi.3 atol.3 at_quick_exit.3 bsearch.3 \
 	div.3 exit.3 getenv.3 getopt.3 getopt_long.3 getsubopt.3 \
 	hcreate.3 imaxabs.3 imaxdiv.3 insque.3 labs.3 ldiv.3 llabs.3 lldiv.3 \
-	lsearch.3 malloc.3 memory.3 posix_memalign.3 ptsname.3 qsort.3 \
+	lsearch.3 malloc.3 memory.3 ptsname.3 qsort.3 \
 	quick_exit.3 \
 	radixsort.3 rand.3 random.3 \
 	realpath.3 strfmon.3 strtod.3 strtol.3 strtonum.3 strtoul.3 system.3 \
 	tsearch.3
 
 MLINKS+=a64l.3 l64a.3 a64l.3 l64a_r.3
+MLINKS+=aligned_alloc.3 posix_memalign.3
 MLINKS+=atol.3 atoll.3
 MLINKS+=exit.3 _Exit.3
 MLINKS+=getenv.3 putenv.3 getenv.3 setenv.3 getenv.3 unsetenv.3
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/stdlib/Symbol.map
--- a/head/lib/libc/stdlib/Symbol.map	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/stdlib/Symbol.map	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*
- * $FreeBSD: head/lib/libc/stdlib/Symbol.map 228322 2011-12-07 15:25:48Z theraven $
+ * $FreeBSD: head/lib/libc/stdlib/Symbol.map 229848 2012-01-09 06:36:28Z ed $
  */
 
 FBSD_1.0 {
@@ -93,18 +93,19 @@
 };
 
 FBSD_1.3 {
+	aligned_alloc;
+	at_quick_exit;
 	atof_l;
 	atoi_l;
 	atol_l;
 	atoll_l;
-	at_quick_exit;
 	quick_exit;
 	strtod_l;
-	strtol_l;
-	strtoll_l;
 	strtof_l;
 	strtoimax_l;
+	strtol_l;
 	strtold_l;
+	strtoll_l;
 	strtoq_l;
 	strtoul_l;
 	strtoull_l;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/stdlib/aligned_alloc.3
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/lib/libc/stdlib/aligned_alloc.3	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,126 @@
+.\" Copyright (C) 2006 Jason Evans <jasone at FreeBSD.org>.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice(s), this list of conditions and the following disclaimer as
+.\"    the first lines of this file unmodified other than the possible
+.\"    addition of one or more copyright notices.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice(s), this list of conditions and the following disclaimer in
+.\"    the documentation and/or other materials provided with the
+.\"    distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER(S) ``AS IS'' AND ANY
+.\" EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) BE
+.\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+.\" BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+.\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+.\" OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+.\" EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.\" $FreeBSD: head/lib/libc/stdlib/aligned_alloc.3 229848 2012-01-09 06:36:28Z ed $
+.\"
+.Dd January 7, 2011
+.Dt ALIGNED_ALLOC 3
+.Os
+.Sh NAME
+.Nm aligned_alloc ,
+.Nm posix_memalign
+.Nd aligned memory allocation
+.Sh LIBRARY
+.Lb libc
+.Sh SYNOPSIS
+.In stdlib.h
+.Ft void *
+.Fn aligned_alloc "size_t alignment" "size_t size"
+.Ft int
+.Fn posix_memalign "void **ptr" "size_t alignment" "size_t size"
+.Sh DESCRIPTION
+The
+.Fn aligned_alloc
+and
+.Fn posix_memalign
+functions allocate
+.Fa size
+bytes of memory such that the allocation's base address is an even multiple of
+.Fa alignment .
+The
+.Fn aligned_alloc
+function returns the allocation, while the
+.Fn posix_memalign
+function stores the allocation in the value pointed to by
+.Fa ptr .
+.Pp
+The requested
+.Fa alignment
+must be a power of 2 at least as large as
+.Fn sizeof "void *" .
+.Pp
+Memory that is allocated via
+.Fn aligned_alloc
+and
+.Fn posix_memalign
+can be used as an argument in subsequent calls to
+.Xr realloc 3 ,
+.Xr reallocf 3 ,
+and
+.Xr free 3 .
+.Sh RETURN VALUES
+The
+.Fn aligned_alloc
+function returns a pointer to the allocation if successful; otherwise a
+NULL pointer is returned and
+.Va errno
+is set to an error value.
+.Pp
+The
+.Fn posix_memalign
+function returns the value 0 if successful; otherwise it returns an error value.
+.Sh ERRORS
+The
+.Fn aligned_alloc
+and
+.Fn posix_memalign
+functions will fail if:
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The
+.Fa alignment
+parameter is not a power of 2 at least as large as
+.Fn sizeof "void *" .
+.It Bq Er ENOMEM
+Memory allocation error.
+.El
+.Sh SEE ALSO
+.Xr free 3 ,
+.Xr malloc 3 ,
+.Xr realloc 3 ,
+.Xr reallocf 3 ,
+.Xr valloc 3
+.Sh STANDARDS
+The
+.Fn aligned_alloc
+function conforms to
+.St -isoC-2011 .
+.Pp
+The
+.Fn posix_memalign
+function conforms to
+.St -p1003.1-2001 .
+.Sh HISTORY
+The
+.Fn posix_memalign
+function first appeared in
+.Fx 7.0 .
+.Pp
+The
+.Fn aligned_alloc
+function first appeared in
+.Fx 10.0 .
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/stdlib/malloc.c
--- a/head/lib/libc/stdlib/malloc.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libc/stdlib/malloc.c	Fri Jan 13 15:51:01 2012 +0200
@@ -158,7 +158,7 @@
 #define	MALLOC_DSS
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/lib/libc/stdlib/malloc.c 228540 2011-12-15 20:40:11Z dim $");
+__FBSDID("$FreeBSD: head/lib/libc/stdlib/malloc.c 229848 2012-01-09 06:36:28Z ed $");
 
 #include "libc_private.h"
 #ifdef MALLOC_DEBUG
@@ -6043,6 +6043,20 @@
 }
 
 void *
+aligned_alloc(size_t alignment, size_t size)
+{
+	void *memptr;
+	int ret;
+
+	ret = posix_memalign(&memptr, alignment, size);
+	if (ret != 0) {
+		errno = ret;
+		return (NULL);
+	}
+	return (memptr);
+}
+
+void *
 calloc(size_t num, size_t size)
 {
 	void *ret;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libc/stdlib/posix_memalign.3
--- a/head/lib/libc/stdlib/posix_memalign.3	Fri Jan 13 00:58:58 2012 +0200
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,96 +0,0 @@
-.\" Copyright (C) 2006 Jason Evans <jasone at FreeBSD.org>.
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice(s), this list of conditions and the following disclaimer as
-.\"    the first lines of this file unmodified other than the possible
-.\"    addition of one or more copyright notices.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice(s), this list of conditions and the following disclaimer in
-.\"    the documentation and/or other materials provided with the
-.\"    distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER(S) ``AS IS'' AND ANY
-.\" EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) BE
-.\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
-.\" BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-.\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-.\" OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
-.\" EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.\" $FreeBSD$
-.\"
-.Dd January 11, 2006
-.Dt POSIX_MEMALIGN 3
-.Os
-.Sh NAME
-.Nm posix_memalign
-.Nd aligned memory allocation
-.Sh LIBRARY
-.Lb libc
-.Sh SYNOPSIS
-.In stdlib.h
-.Ft int
-.Fn posix_memalign "void **ptr" "size_t alignment" "size_t size"
-.Sh DESCRIPTION
-The
-.Fn posix_memalign
-function allocates
-.Fa size
-bytes of memory such that the allocation's base address is an even multiple of
-.Fa alignment ,
-and returns the allocation in the value pointed to by
-.Fa ptr .
-.Pp
-The requested
-.Fa alignment
-must be a power of 2 at least as large as
-.Fn sizeof "void *" .
-.Pp
-Memory that is allocated via
-.Fn posix_memalign
-can be used as an argument in subsequent calls to
-.Xr realloc 3 ,
-.Xr reallocf 3 ,
-and
-.Xr free 3 .
-.Sh RETURN VALUES
-The
-.Fn posix_memalign
-function returns the value 0 if successful; otherwise it returns an error value.
-.Sh ERRORS
-The
-.Fn posix_memalign
-function will fail if:
-.Bl -tag -width Er
-.It Bq Er EINVAL
-The
-.Fa alignment
-parameter is not a power of 2 at least as large as
-.Fn sizeof "void *" .
-.It Bq Er ENOMEM
-Memory allocation error.
-.El
-.Sh SEE ALSO
-.Xr free 3 ,
-.Xr malloc 3 ,
-.Xr realloc 3 ,
-.Xr reallocf 3 ,
-.Xr valloc 3
-.Sh STANDARDS
-The
-.Fn posix_memalign
-function conforms to
-.St -p1003.1-2001 .
-.Sh HISTORY
-The
-.Fn posix_memalign
-function first appeared in
-.Fx 7.0 .
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libdevstat/devstat.c
--- a/head/lib/libdevstat/devstat.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libdevstat/devstat.c	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/lib/libdevstat/devstat.c 220319 2011-04-04 09:25:27Z pluknet $");
+__FBSDID("$FreeBSD: head/lib/libdevstat/devstat.c 229735 2012-01-06 21:28:29Z ghelmer $");
 
 #include <sys/types.h>
 #include <sys/sysctl.h>
@@ -365,6 +365,12 @@
 			dssize = (dinfo->numdevs * sizeof(struct devstat)) +
 				 sizeof(long);
 			dinfo->mem_ptr = (u_int8_t *)malloc(dssize);
+			if (dinfo->mem_ptr == NULL) {
+				snprintf(devstat_errbuf, sizeof(devstat_errbuf),
+					 "%s: Cannot allocate memory for mem_ptr element",
+					 __func__);
+				return(-1);
+			}
 		} else
 			dssize = (dinfo->numdevs * sizeof(struct devstat)) +
 				 sizeof(long);
@@ -567,7 +573,7 @@
 	 * either enlarge or reduce the size of the device selection list.
 	 */
 	} else if (*num_selections != numdevs) {
-		*dev_select = (struct device_selection *)realloc(*dev_select,
+		*dev_select = (struct device_selection *)reallocf(*dev_select,
 			numdevs * sizeof(struct device_selection));
 		*select_generation = current_generation;
 		init_selections = 1;
@@ -581,6 +587,13 @@
 		init_selections = 1;
 	}
 
+	if (*dev_select == NULL) {
+		snprintf(devstat_errbuf, sizeof(devstat_errbuf),
+			 "%s: Cannot (re)allocate memory for dev_select argument",
+			 __func__);
+		return(-1);
+	}
+
 	/*
 	 * If we're in "only" mode, we want to clear out the selected
 	 * variable since we're going to select exactly what the user wants
@@ -608,6 +621,12 @@
 	 || (perf_select != 0)) && (changed == 0)){
 		old_dev_select = (struct device_selection *)malloc(
 		    *num_selections * sizeof(struct device_selection));
+		if (old_dev_select == NULL) {
+			snprintf(devstat_errbuf, sizeof(devstat_errbuf),
+				 "%s: Cannot allocate memory for selection list backup",
+				 __func__);
+			return(-1);
+		}
 		old_num_selections = *num_selections;
 		bcopy(*dev_select, old_dev_select, 
 		    sizeof(struct device_selection) * *num_selections);
@@ -1028,16 +1047,17 @@
 		return(-1);
 	}
 
-	/*
-	 * Since you can't realloc a pointer that hasn't been malloced
-	 * first, we malloc first and then realloc.
-	 */
 	if (*num_matches == 0)
-		*matches = (struct devstat_match *)malloc(
-			   sizeof(struct devstat_match));
-	else
-		*matches = (struct devstat_match *)realloc(*matches,
-			  sizeof(struct devstat_match) * (*num_matches + 1));
+		*matches = NULL;
+
+	*matches = (struct devstat_match *)reallocf(*matches,
+		  sizeof(struct devstat_match) * (*num_matches + 1));
+
+	if (*matches == NULL) {
+		snprintf(devstat_errbuf, sizeof(devstat_errbuf),
+			 "%s: Cannot allocate memory for matches list", __func__);
+		return(-1);
+	}
 			  
 	/* Make sure the current entry is clear */
 	bzero(&matches[0][*num_matches], sizeof(struct devstat_match));
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libgssapi/gss_display_status.c
--- a/head/lib/libgssapi/gss_display_status.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libgssapi/gss_display_status.c	Fri Jan 13 15:51:01 2012 +0200
@@ -23,10 +23,10 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$FreeBSD$
+ *	$FreeBSD: head/lib/libgssapi/gss_display_status.c 229784 2012-01-07 16:13:56Z uqs $
  */
 /*
- * Copyright (c) 1998 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1998 - 2005 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -58,7 +58,7 @@
  * SUCH DAMAGE. 
  */
 /*
- * Copyright (c) 1998 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1998 - 2005 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libgssapi/gss_pseudo_random.c
--- a/head/lib/libgssapi/gss_pseudo_random.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libgssapi/gss_pseudo_random.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2007 Kungliga Tekniska Högskolan
+/*-
+ * Copyright (c) 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
  * SUCH DAMAGE. 
  */
-/* $FreeBSD$ */
+/* $FreeBSD: head/lib/libgssapi/gss_pseudo_random.c 229784 2012-01-07 16:13:56Z uqs $ */
 /* $Id: gss_pseudo_random.c 20053 2007-01-24 01:31:35Z lha $ */
 
 #include <gssapi/gssapi.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libgssapi/gss_release_oid.c
--- a/head/lib/libgssapi/gss_release_oid.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libgssapi/gss_release_oid.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
  * SUCH DAMAGE. 
  */
-/* $FreeBSD$ */
+/* $FreeBSD: head/lib/libgssapi/gss_release_oid.c 229784 2012-01-07 16:13:56Z uqs $ */
 
 #include <gssapi/gssapi.h>
 #include <stdlib.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libopie/config.h
--- a/head/lib/libopie/config.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libopie/config.h	Fri Jan 13 15:51:01 2012 +0200
@@ -1,4 +1,4 @@
-/* $FreeBSD$ */
+/* $FreeBSD: head/lib/libopie/config.h 229831 2012-01-09 00:48:19Z eadler $ */
 /* config.h.  Generated automatically by configure.  */
 /* config.h.in.  Generated automatically from configure.in by autoheader.  */
 
@@ -54,7 +54,7 @@
 /* #undef DOANONYMOUS */
 
 /* The default value of the PATH environment variable */
-#define DEFAULT_PATH "/usr/bin:/bin:/usr/sbin:/sbin:/usr/X11R6/bin"
+#define DEFAULT_PATH "/usr/bin:/bin:/usr/sbin:/sbin"
 
 /* Defined if the file /etc/default/login exists 
    (and, presumably, should be looked at by login) */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libstdthreads/thrd_create.3
--- a/head/lib/libstdthreads/thrd_create.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libstdthreads/thrd_create.3	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/lib/libstdthreads/thrd_create.3 228904 2011-12-26 21:51:53Z ed $
+.\" $FreeBSD: head/lib/libstdthreads/thrd_create.3 229651 2012-01-05 21:36:12Z uqs $
 .\"
 .Dd December 26, 2011
 .Dt THRD_CREATE 3
@@ -110,7 +110,7 @@
 .Fn tss_set "tss_t key" "void *val"
 .Sh DESCRIPTION
 As of
-.St -isoC-11 ,
+.St -isoC-2011 ,
 the C standard includes an API for writing multithreaded applications.
 Since POSIX.1 already includes a threading API that is used by virtually
 any multithreaded application, the interface provided by the C standard
@@ -252,7 +252,7 @@
 .Xr pthread 3
 .Sh STANDARDS
 These functions are expected to conform to
-.St -isoC-11 .
+.St -isoC-2011 .
 .Sh HISTORY
 These functions appeared in
 .Fx 10.0 .
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libutil/Makefile
--- a/head/lib/libutil/Makefile	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libutil/Makefile	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 #	@(#)Makefile	8.1 (Berkeley) 6/4/93
-#	$FreeBSD: head/lib/libutil/Makefile 221807 2011-05-12 10:11:39Z stas $
+#	$FreeBSD: head/lib/libutil/Makefile 229943 2012-01-10 22:22:35Z ghelmer $
 
 SHLIBDIR?= /lib
 
@@ -58,7 +58,8 @@
 MLINKS+=pidfile.3 pidfile_open.3 \
 	pidfile.3 pidfile_write.3 \
 	pidfile.3 pidfile_close.3 \
-	pidfile.3 pidfile_remove.3
+	pidfile.3 pidfile_remove.3 \
+	pidfile.3 pidfile_fileno.3
 MLINKS+=quotafile.3 quota_open.3 \
 	quotafile.3 quota_fsname.3 \
 	quotafile.3 quota_qfname.3 \
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libutil/flopen.3
--- a/head/lib/libutil/flopen.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libutil/flopen.3	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 .\"-
-.\" Copyright (c) 2007 Dag-Erling Coïdan Smørgrav
+.\" Copyright (c) 2007 Dag-Erling Coïdan Smørgrav
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/lib/libutil/flopen.3 229784 2012-01-07 16:13:56Z uqs $
 .\"
 .Dd June 6, 2009
 .Dt FLOPEN 3
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libutil/kld.3
--- a/head/lib/libutil/kld.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libutil/kld.3	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 .\"-
-.\" Copyright (c) 2006 Dag-Erling Coïdan Smørgrav
+.\" Copyright (c) 2006 Dag-Erling Coïdan Smørgrav
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/lib/libutil/kld.3 229784 2012-01-07 16:13:56Z uqs $
 .\"
 .Dd February 18, 2006
 .Dt KLD 3
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libutil/libutil.h
--- a/head/lib/libutil/libutil.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libutil/libutil.h	Fri Jan 13 15:51:01 2012 +0200
@@ -33,7 +33,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/lib/libutil/libutil.h 229572 2012-01-05 10:40:24Z bapt $
+ * $FreeBSD: head/lib/libutil/libutil.h 229988 2012-01-11 22:45:15Z ghelmer $
  */
 
 #ifndef _LIBUTIL_H_
@@ -84,45 +84,27 @@
 #endif
 
 /* Avoid pulling in all the include files for no need */
-struct termios;
-struct winsize;
 struct in_addr;
 struct kinfo_file;
 struct kinfo_proc;
 struct kinfo_vmentry;
+struct sockaddr;
+struct termios;
+struct winsize;
 
 __BEGIN_DECLS
+char	*auth_getval(const char *_name);
 void	clean_environment(const char * const *_white,
 	    const char * const *_more_white);
+int	expand_number(const char *_buf, uint64_t *_num);
 int	extattr_namespace_to_string(int _attrnamespace, char **_string);
 int	extattr_string_to_namespace(const char *_string, int *_attrnamespace);
 int	flopen(const char *_path, int _flags, ...);
-void	hexdump(const void *ptr, int length, const char *hdr, int flags);
-int	login_tty(int _fd);
-void	trimdomain(char *_fullhost, int _hostsize);
-int	openpty(int *_amaster, int *_aslave, char *_name,
-		     struct termios *_termp, struct winsize *_winp);
 int	forkpty(int *_amaster, char *_name,
-		     struct termios *_termp, struct winsize *_winp);
+	    struct termios *_termp, struct winsize *_winp);
+void	hexdump(const void *_ptr, int _length, const char *_hdr, int _flags);
 int	humanize_number(char *_buf, size_t _len, int64_t _number,
 	    const char *_suffix, int _scale, int _flags);
-int	expand_number(const char *_buf, uint64_t *_num);
-const char *uu_lockerr(int _uu_lockresult);
-int	uu_lock(const char *_ttyname);
-int	uu_unlock(const char *_ttyname);
-int	uu_lock_txfr(const char *_ttyname, pid_t _pid);
-int	_secure_path(const char *_path, uid_t _uid, gid_t _gid);
-properties properties_read(int fd);
-void	properties_free(properties list);
-char	*property_find(properties list, const char *name);
-char	*auth_getval(const char *name);
-int	realhostname(char *host, size_t hsize, const struct in_addr *ip);
-struct sockaddr;
-int	realhostname_sa(char *host, size_t hsize, struct sockaddr *addr,
-			     int addrlen);
-
-int	kld_isloaded(const char *name);
-int	kld_load(const char *name);
 struct kinfo_file *
 	kinfo_getfile(pid_t _pid, int *_cntp);
 struct kinfo_vmentry *
@@ -131,9 +113,29 @@
 	kinfo_getallproc(int *_cntp);
 struct kinfo_proc *
 	kinfo_getproc(pid_t _pid);
+int	kld_isloaded(const char *_name);
+int	kld_load(const char *_name);
+int	login_tty(int _fd);
+int	openpty(int *_amaster, int *_aslave, char *_name,
+	    struct termios *_termp, struct winsize *_winp);
+void	properties_free(properties _list);
+char	*property_find(properties _list, const char *_name);
+properties
+	properties_read(int fd);
+int	realhostname(char *_host, size_t _hsize, const struct in_addr *_ip);
+int	realhostname_sa(char *_host, size_t _hsize, struct sockaddr *_addr,
+	    int _addrlen);
+int	_secure_path(const char *_path, uid_t _uid, gid_t _gid);
+void	trimdomain(char *_fullhost, int _hostsize);
+const char *
+	uu_lockerr(int _uu_lockresult);
+int	uu_lock(const char *_ttyname);
+int	uu_unlock(const char *_ttyname);
+int	uu_lock_txfr(const char *_ttyname, pid_t _pid);
 
 #ifdef _STDIO_H_	/* avoid adding new includes */
-char   *fparseln(FILE *, size_t *, size_t *, const char[3], int);
+char	*fparseln(FILE *_fp, size_t *_len, size_t *_lineno,
+	    const char _delim[3], int _flags);
 #endif
 
 #ifdef _PWD_H_
@@ -154,39 +156,44 @@
 
 #ifdef _GRP_H_
 int 	gr_copy(int __ffd, int _tfd, const struct group *_gr, struct group *_old_gr);
-struct group *gr_dup(const struct group *gr);
-int	gr_equal(const struct group *gr1, const struct group *gr2);
+struct group *gr_dup(const struct group *_gr);
+int	gr_equal(const struct group *_gr1, const struct group *_gr2);
 void	gr_fini(void);
 int	gr_init(const char *_dir, const char *_master);
 int	gr_lock(void);
-char	*gr_make(const struct group *gr);
+char	*gr_make(const struct group *_gr);
 int	gr_mkdb(void);
+struct group *gr_scan(const char *_line);
 int	gr_tmp(int _mdf);
-struct group *gr_scan(const char *line);
 #endif
 
 #ifdef _SYS_PARAM_H_
-struct pidfh *pidfile_open(const char *path, mode_t mode, pid_t *pidptr);
-int pidfile_write(struct pidfh *pfh);
-int pidfile_close(struct pidfh *pfh);
-int pidfile_remove(struct pidfh *pfh);
+int	pidfile_close(struct pidfh *_pfh);
+int	pidfile_fileno(const struct pidfh *_pfh);
+struct pidfh *
+	pidfile_open(const char *_path, mode_t _mode, pid_t *_pidptr);
+int	pidfile_remove(struct pidfh *_pfh);
+int	pidfile_write(struct pidfh *_pfh);
 #endif
 
 #ifdef _UFS_UFS_QUOTA_H_
+struct fstab;
 struct quotafile;
-struct fstab;
-struct quotafile *quota_open(struct fstab *, int, int);
-void quota_close(struct quotafile *);
-int quota_on(struct quotafile *);
-int quota_off(struct quotafile *);
-const char *quota_fsname(const struct quotafile *);
-const char *quota_qfname(const struct quotafile *);
-int quota_maxid(struct quotafile *);
-int quota_check_path(const struct quotafile *, const char *path);
-int quota_read(struct quotafile *, struct dqblk *, int);
-int quota_write_limits(struct quotafile *, struct dqblk *, int);
-int quota_write_usage(struct quotafile *, struct dqblk *, int);
-int quota_convert(struct quotafile *, int);
+int	quota_check_path(const struct quotafile *_qf, const char *_path);
+void	quota_close(struct quotafile *_qf);
+int	quota_convert(struct quotafile *_qf, int _wordsize);
+const char *
+	quota_fsname(const struct quotafile *_qf);
+int	quota_maxid(struct quotafile *_qf);
+int	quota_off(struct quotafile *_qf);
+int	quota_on(struct quotafile *_qf);
+struct quotafile *
+	quota_open(struct fstab *_fs, int _quotatype, int _openflags);
+const char *
+	quota_qfname(const struct quotafile *_qf);
+int	quota_read(struct quotafile *_qf, struct dqblk *_dqb, int _id);
+int	quota_write_limits(struct quotafile *_qf, struct dqblk *_dqb, int _id);
+int	quota_write_usage(struct quotafile *_qf, struct dqblk *_dqb, int _id);
 #endif
 
 __END_DECLS
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libutil/pidfile.3
--- a/head/lib/libutil/pidfile.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libutil/pidfile.3	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/lib/libutil/pidfile.3 226450 2011-10-16 21:30:15Z pjd $
+.\" $FreeBSD: head/lib/libutil/pidfile.3 229942 2012-01-10 21:47:58Z ghelmer $
 .\"
 .Dd October 16, 2011
 .Dt PIDFILE 3
@@ -46,6 +46,8 @@
 .Fn pidfile_close "struct pidfh *pfh"
 .Ft int
 .Fn pidfile_remove "struct pidfh *pfh"
+.Ft int
+.Fn pidfile_fileno "struct pidfh *pfh"
 .Sh DESCRIPTION
 The
 .Nm pidfile
@@ -77,6 +79,9 @@
 .Dv NULL ,
 .Pa /var/run/ Ns Ao Va progname Ac Ns Pa .pid
 file will be used.
+The
+.Fn pidfile_open
+function sets the FD_CLOEXEC close-on-exec flag on the open file descriptor.
 .Pp
 The
 .Fn pidfile_write
@@ -92,6 +97,10 @@
 The
 .Fn pidfile_remove
 function closes and removes a pidfile.
+.Pp
+The
+.Fn pidfile_fileno
+function returns the file descriptor for the open pidfile.
 .Sh RETURN VALUES
 The
 .Fn pidfile_open
@@ -105,15 +114,27 @@
 will be set.
 .Pp
 .Rv -std pidfile_write pidfile_close pidfile_remove
+.Pp
+The
+.Fn pidfile_fileno
+function returns the low-level file descriptor.
+It returns
+.Li -1
+and sets
+.Va errno
+if a NULL
+.Vt pidfh
+is specified, or if the pidfile is no longer open.
 .Sh EXAMPLES
 The following example shows in which order these functions should be used.
 Note that it is safe to pass
 .Dv NULL
 to
 .Fn pidfile_write ,
-.Fn pidfile_remove
+.Fn pidfile_remove ,
+.Fn pidfile_close
 and
-.Fn pidfile_close
+.Fn pidfile_fileno
 functions.
 .Bd -literal
 struct pidfh *pfh;
@@ -184,6 +205,7 @@
 function may also fail and set
 .Va errno
 for any errors specified for the
+.Xr fcntl 2 ,
 .Xr fstat 2 ,
 .Xr open 2 ,
 and
@@ -244,6 +266,16 @@
 system calls and the
 .Xr flopen 3
 library function.
+.Pp
+The
+.Fn pidfile_fileno
+function will fail if:
+.Bl -tag -width Er
+.It Bq Er EDOOFUS
+Improper function use.
+Probably called not from the process which used
+.Fn pidfile_open .
+.El
 .Sh SEE ALSO
 .Xr open 2 ,
 .Xr daemon 3 ,
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libutil/pidfile.c
--- a/head/lib/libutil/pidfile.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libutil/pidfile.c	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/lib/libutil/pidfile.c 226450 2011-10-16 21:30:15Z pjd $");
+__FBSDID("$FreeBSD: head/lib/libutil/pidfile.c 229966 2012-01-11 16:35:26Z ghelmer $");
 
 #include <sys/param.h>
 #include <sys/file.h>
@@ -44,7 +44,7 @@
 static int _pidfile_remove(struct pidfh *pfh, int freeit);
 
 static int
-pidfile_verify(struct pidfh *pfh)
+pidfile_verify(const struct pidfh *pfh)
 {
 	struct stat sb;
 
@@ -117,7 +117,7 @@
 	 * pidfile_write() can be called multiple times.
 	 */
 	fd = flopen(pfh->pf_path,
-	    O_WRONLY | O_CREAT | O_TRUNC | O_NONBLOCK, mode);
+	    O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC | O_NONBLOCK, mode);
 	if (fd == -1) {
 		if (errno == EWOULDBLOCK && pidptr != NULL) {
 			count = 20;
@@ -137,6 +137,7 @@
 		free(pfh);
 		return (NULL);
 	}
+
 	/*
 	 * Remember file information, so in pidfile_write() we are sure we write
 	 * to the proper descriptor.
@@ -252,3 +253,14 @@
 
 	return (_pidfile_remove(pfh, 1));
 }
+
+int
+pidfile_fileno(const struct pidfh *pfh)
+{
+
+	if (pfh == NULL || pfh->pf_fd == -1) {
+		errno = EDOOFUS;
+		return (-1);
+	}
+	return (pfh->pf_fd);
+}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/bitmap.c
--- a/head/lib/libvgl/bitmap.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/bitmap.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1991-1997 Søren Schmidt
+ * Copyright (c) 1991-1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libvgl/bitmap.c 229784 2012-01-07 16:13:56Z uqs $");
 
 #include <sys/types.h>
 #include <signal.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/keyboard.c
--- a/head/lib/libvgl/keyboard.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/keyboard.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1997 Søren Schmidt
+ * Copyright (c) 1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libvgl/keyboard.c 229784 2012-01-07 16:13:56Z uqs $");
 
 #include <stdio.h>
 #include <sys/types.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/main.c
--- a/head/lib/libvgl/main.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/main.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1991-1997 Søren Schmidt
+ * Copyright (c) 1991-1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libvgl/main.c 229784 2012-01-07 16:13:56Z uqs $");
 
 #include <stdio.h>
 #include <sys/types.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/mouse.c
--- a/head/lib/libvgl/mouse.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/mouse.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1991-1997 Søren Schmidt
+ * Copyright (c) 1991-1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libvgl/mouse.c 229784 2012-01-07 16:13:56Z uqs $");
 
 #include <stdio.h>
 #include <sys/types.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/simple.c
--- a/head/lib/libvgl/simple.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/simple.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1991-1997 Søren Schmidt
+ * Copyright (c) 1991-1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/lib/libvgl/simple.c 229516 2012-01-04 20:05:38Z pfg $");
+__FBSDID("$FreeBSD: head/lib/libvgl/simple.c 229784 2012-01-07 16:13:56Z uqs $");
 
 #include <signal.h>
 #include <sys/fbio.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/text.c
--- a/head/lib/libvgl/text.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/text.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1991-1997 Søren Schmidt
+ * Copyright (c) 1991-1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/lib/libvgl/text.c 229784 2012-01-07 16:13:56Z uqs $");
 
 #include <stdio.h>
 #include <sys/fbio.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/vgl.3
--- a/head/lib/libvgl/vgl.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/vgl.3	Fri Jan 13 15:51:01 2012 +0200
@@ -1,4 +1,5 @@
-.\" Copyright (c) 1997 Søren Schmidt
+.\"-
+.\" Copyright (c) 1997 Søren Schmidt
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -24,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/lib/libvgl/vgl.3 229784 2012-01-07 16:13:56Z uqs $
 .Dd November 7, 1999
 .Dt VGL 3
 .Os
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/libvgl/vgl.h
--- a/head/lib/libvgl/vgl.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/libvgl/vgl.h	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1991-1997 Søren Schmidt
+ * Copyright (c) 1991-1997 Søren Schmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,7 +25,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/lib/libvgl/vgl.h 229784 2012-01-07 16:13:56Z uqs $
  */
 
 #ifndef _VGL_H_
diff -r ebe87ce4d7dd -r 1750de5b0399 head/lib/msun/src/s_fabsl.c
--- a/head/lib/msun/src/s_fabsl.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/lib/msun/src/s_fabsl.c	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2003 Dag-Erling Coïdan Smørgrav
+ * Copyright (c) 2003 Dag-Erling Coïdan Smørgrav
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -25,7 +25,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/lib/msun/src/s_fabsl.c 229784 2012-01-07 16:13:56Z uqs $
  */
 
 #include <math.h>
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/bootpd/bootpd.c
--- a/head/libexec/bootpd/bootpd.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/bootpd/bootpd.c	Fri Jan 13 15:51:01 2012 +0200
@@ -38,7 +38,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/libexec/bootpd/bootpd.c 229780 2012-01-07 16:09:54Z uqs $");
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -663,7 +663,7 @@
 	bp->bp_op = BOOTREPLY;
 	if (bp->bp_ciaddr.s_addr == 0) {
 		/*
-		 * client doesnt know his IP address,
+		 * client doesn't know his IP address,
 		 * search by hardware address.
 		 */
 		if (debug > 1) {
@@ -1119,7 +1119,7 @@
 
 /*
  * This call checks read access to a file.  It returns 0 if the file given
- * by "path" exists and is publically readable.  A value of -1 is returned if
+ * by "path" exists and is publicly readable.  A value of -1 is returned if
  * access is not permitted or an error occurs.  Successful calls also
  * return the file size in bytes using the long pointer "filesize".
  *
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/bootpd/bootpgw/bootpgw.c
--- a/head/libexec/bootpd/bootpgw/bootpgw.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/bootpd/bootpgw/bootpgw.c	Fri Jan 13 15:51:01 2012 +0200
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/libexec/bootpd/bootpgw/bootpgw.c 228581 2011-12-16 15:38:11Z dim $");
+__FBSDID("$FreeBSD: head/libexec/bootpd/bootpgw/bootpgw.c 229780 2012-01-07 16:09:54Z uqs $");
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -534,7 +534,7 @@
 	/* Has this packet hopped too many times? */
 	hops = bp->bp_hops;
 	if (++hops > maxhops) {
-		report(LOG_NOTICE, "reqest from %s reached hop limit",
+		report(LOG_NOTICE, "request from %s reached hop limit",
 			   inet_ntoa(recv_addr.sin_addr));
 		return;
 	}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/bootpd/hash.h
--- a/head/libexec/bootpd/hash.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/bootpd/hash.h	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
 
 /*
  * Generalized hash table ADT
- * $FreeBSD$
+ * $FreeBSD: head/libexec/bootpd/hash.h 229780 2012-01-07 16:09:54Z uqs $
  *
  * Provides multiple, dynamically-allocated, variable-sized hash tables on
  * various data and keys.
@@ -81,7 +81,7 @@
  *
  *	    A generalized hash function, hash_HashFunction(), is included
  *	    with this package to make things a little easier.  It is not
- *	    guarenteed to use the best hash algorithm in existence. . . .
+ *	    guaranteed to use the best hash algorithm in existence. . . .
  */
 
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/bootpd/tools/bootptest/bootptest.c
--- a/head/libexec/bootpd/tools/bootptest/bootptest.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/bootpd/tools/bootptest/bootptest.c	Fri Jan 13 15:51:01 2012 +0200
@@ -34,7 +34,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/libexec/bootpd/tools/bootptest/bootptest.c 229780 2012-01-07 16:09:54Z uqs $");
 
 char *usage = "bootptest [-h] server-name [vendor-data-template-file]";
 
@@ -186,7 +186,7 @@
 			break;
 		switch (argv[0][1]) {
 
-		case 'f':				/* File name to reqest. */
+		case 'f':				/* File name to request. */
 			if (argc < 2)
 				goto error;
 			argc--; argv++;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/bootpd/tools/bootptest/print-bootp.c
--- a/head/libexec/bootpd/tools/bootptest/print-bootp.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/bootpd/tools/bootptest/print-bootp.c	Fri Jan 13 15:51:01 2012 +0200
@@ -23,7 +23,7 @@
  * This file was copied from tcpdump-2.1.1 and modified.
  * There is an e-mail list for tcpdump: <tcpdump at ee.lbl.gov>
  *
- * $FreeBSD: head/libexec/bootpd/tools/bootptest/print-bootp.c 228584 2011-12-16 15:55:43Z dim $
+ * $FreeBSD: head/libexec/bootpd/tools/bootptest/print-bootp.c 229780 2012-01-07 16:09:54Z uqs $
  */
 
 #include <stdio.h>
@@ -187,7 +187,7 @@
 
 /*
  * Option description data follows.
- * These are decribed in: RFC-1048, RFC-1395, RFC-1497, RFC-1533
+ * These are described in: RFC-1048, RFC-1395, RFC-1497, RFC-1533
  *
  * The first char of each option string encodes the data format:
  * ?: unknown
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/ftpd/ftpcmd.y
--- a/head/libexec/ftpd/ftpcmd.y	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/ftpd/ftpcmd.y	Fri Jan 13 15:51:01 2012 +0200
@@ -47,7 +47,7 @@
 #endif /* not lint */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/libexec/ftpd/ftpcmd.y 229780 2012-01-07 16:09:54Z uqs $");
 
 #include <sys/param.h>
 #include <sys/socket.h>
@@ -1718,7 +1718,7 @@
  * Avoid expanding to a pathname including '\r' or '\n' in order to
  * not disrupt the FTP protocol.
  * The expansion found must be unique.
- * Return the result as a malloced string, or NULL if an error occured.
+ * Return the result as a malloced string, or NULL if an error occurred.
  *
  * Problem: this production is used for all pathname
  * processing, but only gives a 550 error reply.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/getty/init.c
--- a/head/libexec/getty/init.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/getty/init.c	Fri Jan 13 15:51:01 2012 +0200
@@ -36,7 +36,7 @@
 static char sccsid[] = "@(#)from: init.c	8.1 (Berkeley) 6/4/93";
 #endif
 static const char rcsid[] =
-  "$FreeBSD$";
+  "$FreeBSD: head/libexec/getty/init.c 229780 2012-01-07 16:09:54Z uqs $";
 #endif /* not lint */
 
 /*
@@ -64,7 +64,7 @@
 	{ "et", &omode.c_cc[VEOF] },	/* eof chatacter (eot) */
 	{ "pc", nullstr },		/* pad character */
 	{ "tt" },			/* terminal type */
-	{ "ev" },			/* enviroment */
+	{ "ev" },			/* environment */
 	{ "lo", loginprg },		/* login program */
 	{ "hn", hostname },		/* host name */
 	{ "he" },			/* host name edit */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/lukemftpd/nbsd_pidfile.h
--- a/head/libexec/lukemftpd/nbsd_pidfile.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/lukemftpd/nbsd_pidfile.h	Fri Jan 13 15:51:01 2012 +0200
@@ -1,4 +1,4 @@
-/* $FreeBSD$ */
+/* $FreeBSD: head/libexec/lukemftpd/nbsd_pidfile.h 229780 2012-01-07 16:09:54Z uqs $ */
 
 #include <sys/stdint.h>
 #include <sysexits.h>
@@ -10,7 +10,7 @@
 	pid_t otherpid, childpid;
 
 	if (basename != NULL) {
-		errx(EX_USAGE, "Need to impliment NetBSD semantics.");
+		errx(EX_USAGE, "Need to implement NetBSD semantics.");
 	}
 
 	pfh = pidfile_open(basename, 0644, &otherpid);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rbootd/parseconf.c
--- a/head/libexec/rbootd/parseconf.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rbootd/parseconf.c	Fri Jan 13 15:51:01 2012 +0200
@@ -49,7 +49,7 @@
 static const char sccsid[] = "@(#)parseconf.c	8.1 (Berkeley) 6/4/93";
 #endif
 static const char rcsid[] =
-  "$FreeBSD$";
+  "$FreeBSD: head/libexec/rbootd/parseconf.c 229780 2012-01-07 16:09:54Z uqs $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -145,7 +145,7 @@
 		 */
 		if ((addr = ParseAddr(bcp)) == NULL) {
 			syslog(LOG_ERR,
-			       "ParseConfig: line %d: cant parse <%s>",
+			       "ParseConfig: line %d: can't parse <%s>",
 			       linecnt, bcp);
 			continue;
 		}
@@ -193,7 +193,7 @@
 			/*
 			 *  Restricted list of boot files were spec'd,
 			 *  however, none of them were found.  Since we
-			 *  apparently cant let them boot "just anything",
+			 *  apparently can't let them boot "just anything",
 			 *  the entire record is invalidated.
 			 */
 			if (i == 0) {
@@ -355,7 +355,7 @@
 
 	(void) closedir(dfd);			/* close BootDir */
 
-	if (i == 0)				/* cant find any boot files */
+	if (i == 0)				/* can't find any boot files */
 		syslog(LOG_ERR, "GetBootFiles: no boot files (%s)\n", BootDir);
 
 	return(i);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rbootd/rbootd.c
--- a/head/libexec/rbootd/rbootd.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rbootd/rbootd.c	Fri Jan 13 15:51:01 2012 +0200
@@ -56,7 +56,7 @@
 #endif
 #endif /* not lint */
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/libexec/rbootd/rbootd.c 229780 2012-01-07 16:09:54Z uqs $");
 
 #include <sys/param.h>
 #include <sys/time.h>
@@ -231,7 +231,7 @@
 
 		r = rset;
 
-		if (RmpConns == NULL) {		/* timeout isnt necessary */
+		if (RmpConns == NULL) {		/* timeout isn't necessary */
 			nsel = select(maxfds, &r, NULL, NULL, NULL);
 		} else {
 			timeout.tv_sec = RMP_TIMEOUT;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rbootd/rmpproto.c
--- a/head/libexec/rbootd/rmpproto.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rbootd/rmpproto.c	Fri Jan 13 15:51:01 2012 +0200
@@ -49,7 +49,7 @@
 static const char sccsid[] = "@(#)rmpproto.c	8.1 (Berkeley) 6/4/93";
 #endif
 static const char rcsid[] =
-  "$FreeBSD$";
+  "$FreeBSD: head/libexec/rbootd/rmpproto.c 229780 2012-01-07 16:09:54Z uqs $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -401,7 +401,7 @@
 	int madeconn = 0;
 
 	/*
-	 *  Find the old connection.  If one doesnt exist, create one only
+	 *  Find the old connection.  If one doesn't exist, create one only
 	 *  to return the error code.
 	 */
 	if ((oldconn = FindConn(rconn)) == NULL) {
@@ -515,7 +515,7 @@
 	struct rmp_packet *rpl;
 
 	/*
-	 *  If we cant find the connection, ignore the request.
+	 *  If we can't find the connection, ignore the request.
 	 */
 	if ((oldconn = FindConn(rconn)) == NULL) {
 		syslog(LOG_ERR, "BootDone: no existing connection (%s)",
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/revnetgroup/parse_netgroup.c
--- a/head/libexec/revnetgroup/parse_netgroup.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/revnetgroup/parse_netgroup.c	Fri Jan 13 15:51:01 2012 +0200
@@ -36,7 +36,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-  "$FreeBSD$";
+  "$FreeBSD: head/libexec/revnetgroup/parse_netgroup.c 229780 2012-01-07 16:09:54Z uqs $";
 #endif /* not lint */
 
 /*
@@ -199,8 +199,8 @@
 	if (lp->l_parsed) {
 #ifdef DEBUG
 		/*
-		 * This error message is largely superflous since the
-		 * code handles the error condition sucessfully, and
+		 * This error message is largely superfluous since the
+		 * code handles the error condition successfully, and
 		 * spewing it out from inside libc can actually hose
 		 * certain programs.
 		 */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rshd/rshd.8
--- a/head/libexec/rshd/rshd.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rshd/rshd.8	Fri Jan 13 15:51:01 2012 +0200
@@ -30,7 +30,7 @@
 .\" SUCH DAMAGE.
 .\"
 .\"     @(#)rshd.8	8.1 (Berkeley) 6/4/93
-.\" $FreeBSD$
+.\" $FreeBSD: head/libexec/rshd/rshd.8 229780 2012-01-07 16:09:54Z uqs $
 .\"
 .Dd June 4, 1993
 .Dt RSHD 8
@@ -148,7 +148,7 @@
 The options are as follows:
 .Bl -tag -width indent
 .It Fl a
-This flag is ignored, and is present for compatability purposes.
+This flag is ignored, and is present for compatibility purposes.
 .It Fl D
 Sets the TCP_NODELAY socket option, which improves the performance
 of small back-to-back writes at the expense of additional network
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rtld-aout/shlib.c
--- a/head/libexec/rtld-aout/shlib.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rtld-aout/shlib.c	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/libexec/rtld-aout/shlib.c 229780 2012-01-07 16:09:54Z uqs $
  */
 
 #include <sys/param.h>
@@ -159,7 +159,7 @@
 	if (i == n2)
 		return 1;
 
-	errx(1, "cmpndewey: cant happen");
+	errx(1, "cmpndewey: can't happen");
 	return 0;
 }
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rtld-elf/Symbol.map
--- a/head/libexec/rtld-elf/Symbol.map	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rtld-elf/Symbol.map	Fri Jan 13 15:51:01 2012 +0200
@@ -1,5 +1,5 @@
 /*
- * $FreeBSD$
+ * $FreeBSD: head/libexec/rtld-elf/Symbol.map 229768 2012-01-07 10:33:01Z kib $
  */
 
 FBSD_1.0 {
@@ -18,6 +18,10 @@
     __tls_get_addr;
 };
 
+FBSD_1.3 {
+    fdlopen;
+};
+
 FBSDprivate_1.0 {
     _rtld_thread_init;
     _rtld_allocate_tls;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rtld-elf/mips/reloc.c
--- a/head/libexec/rtld-elf/mips/reloc.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rtld-elf/mips/reloc.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/libexec/rtld-elf/mips/reloc.c 228435 2011-12-12 11:03:14Z kib $");
+__FBSDID("$FreeBSD: head/libexec/rtld-elf/mips/reloc.c 229780 2012-01-07 16:09:54Z uqs $");
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -358,7 +358,7 @@
 			def = find_symdef(i, obj, &defobj, false, NULL,
 			    lockstate);
 			if (def == NULL) {
-				dbg("Warning4, cant find symbole %d", i);
+				dbg("Warning4, can't find symbole %d", i);
 				return -1;
 			}
 			*got = def->st_value + (Elf_Addr)defobj->relocbase;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rtld-elf/rtld.c
--- a/head/libexec/rtld-elf/rtld.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rtld-elf/rtld.c	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD: head/libexec/rtld-elf/rtld.c 229508 2012-01-04 17:17:11Z kib $
+ * $FreeBSD: head/libexec/rtld-elf/rtld.c 229768 2012-01-07 10:33:01Z kib $
  */
 
 /*
@@ -83,7 +83,7 @@
 static void digest_dynamic(Obj_Entry *, int);
 static Obj_Entry *digest_phdr(const Elf_Phdr *, int, caddr_t, const char *);
 static Obj_Entry *dlcheck(void *);
-static Obj_Entry *dlopen_object(const char *name, Obj_Entry *refobj,
+static Obj_Entry *dlopen_object(const char *name, int fd, Obj_Entry *refobj,
     int lo_flags, int mode);
 static Obj_Entry *do_load_object(int, const char *, char *, struct stat *, int);
 static int do_search_info(const Obj_Entry *obj, int, struct dl_serinfo *);
@@ -103,7 +103,7 @@
 static void unload_filtees(Obj_Entry *);
 static int load_needed_objects(Obj_Entry *, int);
 static int load_preload_objects(void);
-static Obj_Entry *load_object(const char *, const Obj_Entry *, int);
+static Obj_Entry *load_object(const char *, int fd, const Obj_Entry *, int);
 static void map_stacks_exec(RtldLockState *);
 static Obj_Entry *obj_from_addr(const void *);
 static void objlist_call_fini(Objlist *, Obj_Entry *, RtldLockState *);
@@ -120,6 +120,7 @@
     RtldLockState *lockstate);
 static int rtld_dirname(const char *, char *);
 static int rtld_dirname_abs(const char *, char *);
+static void *rtld_dlopen(const char *name, int fd, int mode);
 static void rtld_exit(void);
 static char *search_library_path(const char *, const char *);
 static const void **get_program_var_addr(const char *, RtldLockState *);
@@ -1544,7 +1545,7 @@
 {
 
     for (; needed != NULL; needed = needed->next) {
-	needed->obj = dlopen_object(obj->strtab + needed->name, obj,
+	needed->obj = dlopen_object(obj->strtab + needed->name, -1, obj,
 	  flags, ((ld_loadfltr || obj->z_loadfltr) ? RTLD_NOW : RTLD_LAZY) |
 	  RTLD_LOCAL);
     }
@@ -1568,7 +1569,7 @@
     Obj_Entry *obj1;
 
     for (; needed != NULL; needed = needed->next) {
-	obj1 = needed->obj = load_object(obj->strtab + needed->name, obj,
+	obj1 = needed->obj = load_object(obj->strtab + needed->name, -1, obj,
 	  flags & ~RTLD_LO_NOLOAD);
 	if (obj1 == NULL && !ld_tracing && (flags & RTLD_LO_FILTEES) == 0)
 	    return (-1);
@@ -1615,7 +1616,7 @@
 
 	savech = p[len];
 	p[len] = '\0';
-	if (load_object(p, NULL, 0) == NULL)
+	if (load_object(p, -1, NULL, 0) == NULL)
 	    return -1;	/* XXX - cleanup */
 	p[len] = savech;
 	p += len;
@@ -1625,43 +1626,68 @@
     return 0;
 }
 
+static const char *
+printable_path(const char *path)
+{
+
+	return (path == NULL ? "<unknown>" : path);
+}
+
 /*
- * Load a shared object into memory, if it is not already loaded.
+ * Load a shared object into memory, if it is not already loaded.  The
+ * object may be specified by name or by user-supplied file descriptor
+ * fd_u. In the later case, the fd_u descriptor is not closed, but its
+ * duplicate is.
  *
  * Returns a pointer to the Obj_Entry for the object.  Returns NULL
  * on failure.
  */
 static Obj_Entry *
-load_object(const char *name, const Obj_Entry *refobj, int flags)
+load_object(const char *name, int fd_u, const Obj_Entry *refobj, int flags)
 {
     Obj_Entry *obj;
-    int fd = -1;
+    int fd;
     struct stat sb;
     char *path;
 
-    for (obj = obj_list->next;  obj != NULL;  obj = obj->next)
-	if (object_match_name(obj, name))
-	    return obj;
-
-    path = find_library(name, refobj);
-    if (path == NULL)
-	return NULL;
+    if (name != NULL) {
+	for (obj = obj_list->next;  obj != NULL;  obj = obj->next) {
+	    if (object_match_name(obj, name))
+		return (obj);
+	}
+
+	path = find_library(name, refobj);
+	if (path == NULL)
+	    return (NULL);
+    } else
+	path = NULL;
 
     /*
-     * If we didn't find a match by pathname, open the file and check
-     * again by device and inode.  This avoids false mismatches caused
-     * by multiple links or ".." in pathnames.
+     * If we didn't find a match by pathname, or the name is not
+     * supplied, open the file and check again by device and inode.
+     * This avoids false mismatches caused by multiple links or ".."
+     * in pathnames.
      *
      * To avoid a race, we open the file and use fstat() rather than
      * using stat().
      */
-    if ((fd = open(path, O_RDONLY)) == -1) {
-	_rtld_error("Cannot open \"%s\"", path);
-	free(path);
-	return NULL;
+    fd = -1;
+    if (fd_u == -1) {
+	if ((fd = open(path, O_RDONLY)) == -1) {
+	    _rtld_error("Cannot open \"%s\"", path);
+	    free(path);
+	    return (NULL);
+	}
+    } else {
+	fd = dup(fd_u);
+	if (fd == -1) {
+	    _rtld_error("Cannot dup fd");
+	    free(path);
+	    return (NULL);
+	}
     }
     if (fstat(fd, &sb) == -1) {
-	_rtld_error("Cannot fstat \"%s\"", path);
+	_rtld_error("Cannot fstat \"%s\"", printable_path(path));
 	close(fd);
 	free(path);
 	return NULL;
@@ -1669,7 +1695,7 @@
     for (obj = obj_list->next;  obj != NULL;  obj = obj->next)
 	if (obj->ino == sb.st_ino && obj->dev == sb.st_dev)
 	    break;
-    if (obj != NULL) {
+    if (obj != NULL && name != NULL) {
 	object_add_name(obj, name);
 	free(path);
 	close(fd);
@@ -1703,20 +1729,25 @@
      */
     if (dangerous_ld_env) {
 	if (fstatfs(fd, &fs) != 0) {
-	    _rtld_error("Cannot fstatfs \"%s\"", path);
-		return NULL;
+	    _rtld_error("Cannot fstatfs \"%s\"", printable_path(path));
+	    return NULL;
 	}
 	if (fs.f_flags & MNT_NOEXEC) {
 	    _rtld_error("Cannot execute objects on %s\n", fs.f_mntonname);
 	    return NULL;
 	}
     }
-    dbg("loading \"%s\"", path);
-    obj = map_object(fd, path, sbp);
+    dbg("loading \"%s\"", printable_path(path));
+    obj = map_object(fd, printable_path(path), sbp);
     if (obj == NULL)
         return NULL;
 
-    object_add_name(obj, name);
+    /*
+     * If DT_SONAME is present in the object, digest_dynamic2 already
+     * added it to the object names.
+     */
+    if (name != NULL)
+	object_add_name(obj, name);
     obj->path = path;
     digest_dynamic(obj, 0);
     if (obj->z_noopen && (flags & (RTLD_LO_DLOPEN | RTLD_LO_TRACE)) ==
@@ -2212,6 +2243,20 @@
 void *
 dlopen(const char *name, int mode)
 {
+
+	return (rtld_dlopen(name, -1, mode));
+}
+
+void *
+fdlopen(int fd, int mode)
+{
+
+	return (rtld_dlopen(NULL, fd, mode));
+}
+
+static void *
+rtld_dlopen(const char *name, int fd, int mode)
+{
     RtldLockState lockstate;
     int lo_flags;
 
@@ -2232,7 +2277,7 @@
     if (ld_tracing != NULL)
 	    lo_flags |= RTLD_LO_TRACE;
 
-    return (dlopen_object(name, obj_main, lo_flags,
+    return (dlopen_object(name, fd, obj_main, lo_flags,
       mode & (RTLD_MODEMASK | RTLD_GLOBAL)));
 }
 
@@ -2247,7 +2292,8 @@
 }
 
 static Obj_Entry *
-dlopen_object(const char *name, Obj_Entry *refobj, int lo_flags, int mode)
+dlopen_object(const char *name, int fd, Obj_Entry *refobj, int lo_flags,
+    int mode)
 {
     Obj_Entry **old_obj_tail;
     Obj_Entry *obj;
@@ -2262,11 +2308,11 @@
 
     old_obj_tail = obj_tail;
     obj = NULL;
-    if (name == NULL) {
+    if (name == NULL && fd == -1) {
 	obj = obj_main;
 	obj->refcount++;
     } else {
-	obj = load_object(name, refobj, lo_flags);
+	obj = load_object(name, fd, refobj, lo_flags);
     }
 
     if (obj) {
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rtld-elf/rtld.h
--- a/head/libexec/rtld-elf/rtld.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rtld-elf/rtld.h	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD: head/libexec/rtld-elf/rtld.h 228435 2011-12-12 11:03:14Z kib $
+ * $FreeBSD: head/libexec/rtld-elf/rtld.h 229780 2012-01-07 16:09:54Z uqs $
  */
 
 #ifndef RTLD_H /* { */
@@ -238,7 +238,7 @@
     Objlist dagmembers;		/* DAG has these members (%) */
     dev_t dev;			/* Object's filesystem's device */
     ino_t ino;			/* Object's inode number */
-    void *priv;			/* Platform-dependant */
+    void *priv;			/* Platform-dependent */
 } Obj_Entry;
 
 #define RTLD_MAGIC	0xd550b87a
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/rtld-elf/sparc64/reloc.c
--- a/head/libexec/rtld-elf/sparc64/reloc.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/rtld-elf/sparc64/reloc.c	Fri Jan 13 15:51:01 2012 +0200
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/libexec/rtld-elf/sparc64/reloc.c 228435 2011-12-12 11:03:14Z kib $");
+__FBSDID("$FreeBSD: head/libexec/rtld-elf/sparc64/reloc.c 229780 2012-01-07 16:09:54Z uqs $");
 
 #include <sys/param.h>
 #include <sys/mman.h>
@@ -623,7 +623,7 @@
 			flush(where, 4);
 		} else if (target >= 0 && target < (1L<<32)) {
 			/*
-			 * We're withing 32-bits of address zero.
+			 * We're within 32-bits of address zero.
 			 *
 			 * The resulting code in the jump slot is:
 			 *
@@ -643,7 +643,7 @@
 			flush(where, 4);
 		} else if (target <= 0 && target > -(1L<<32)) {
 			/*
-			 * We're withing 32-bits of address -1.
+			 * We're within 32-bits of address -1.
 			 *
 			 * The resulting code in the jump slot is:
 			 *
@@ -665,7 +665,7 @@
 			flush(where, 4);
 		} else if (offset <= (1L<<32) && offset >= -((1L<<32) - 4)) {
 			/*
-			 * We're withing 32-bits -- we can use a direct call
+			 * We're within 32-bits -- we can use a direct call
 			 * insn
 			 *
 			 * The resulting code in the jump slot is:
@@ -688,7 +688,7 @@
 			flush(where, 4);
 		} else if (offset >= 0 && offset < (1L<<44)) {
 			/*
-			 * We're withing 44 bits.  We can generate this
+			 * We're within 44 bits.  We can generate this
 			 * pattern:
 			 *
 			 * The resulting code in the jump slot is:
@@ -713,7 +713,7 @@
 			flush(where, 4);
 		} else if (offset < 0 && offset > -(1L<<44)) {
 			/*
-			 * We're withing 44 bits.  We can generate this
+			 * We're within 44 bits.  We can generate this
 			 * pattern:
 			 *
 			 * The resulting code in the jump slot is:
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/tftpd/tftp-io.c
--- a/head/libexec/tftpd/tftp-io.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/tftpd/tftp-io.c	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/libexec/tftpd/tftp-io.c 222326 2011-05-26 20:32:33Z rodrigc $");
+__FBSDID("$FreeBSD: head/libexec/tftpd/tftp-io.c 229904 2012-01-10 02:55:35Z eadler $");
 
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -72,13 +72,13 @@
 #define DROPPACKET(s)							\
 	if (packetdroppercentage != 0 &&				\
 	    random()%100 < packetdroppercentage) {			\
-		tftp_log(LOG_DEBUG, "Artifical packet drop in %s", s);	\
+		tftp_log(LOG_DEBUG, "Artificial packet drop in %s", s);	\
 		return;							\
 	}
 #define DROPPACKETn(s,n)						\
 	if (packetdroppercentage != 0 &&				\
 	    random()%100 < packetdroppercentage) {			\
-		tftp_log(LOG_DEBUG, "Artifical packet drop in %s", s);	\
+		tftp_log(LOG_DEBUG, "Artificial packet drop in %s", s);	\
 		return (n);						\
 	}
 
@@ -323,7 +323,6 @@
 {
 	struct tftphdr *tp;
 	int size;
-	char *bp;
 	char buf[MAXPKTSIZE];
 
 	if (debug&DEBUG_PACKETS)
@@ -332,7 +331,6 @@
 	DROPPACKETn("send_ack", 0);
 
 	tp = (struct tftphdr *)buf;
-	bp = buf + 2;
 	size = sizeof(buf) - 2;
 	tp->th_opcode = htons((u_short)ACK);
 	tp->th_block = htons((u_short)block);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/libexec/tftpd/tftp-utils.h
--- a/head/libexec/tftpd/tftp-utils.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/libexec/tftpd/tftp-utils.h	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/libexec/tftpd/tftp-utils.h 229780 2012-01-07 16:09:54Z uqs $");
 
 /*
  */
@@ -36,11 +36,11 @@
 #define	MAXPKTSIZE	(MAXSEGSIZE + 4) /* Maximum size of the packet */
 
 /* For the blksize option */
-#define BLKSIZE_MIN	8		/* Minumum size of the data segment */
+#define BLKSIZE_MIN	8		/* Minimum size of the data segment */
 #define BLKSIZE_MAX	MAXSEGSIZE	/* Maximum size of the data segment */
 
 /* For the timeout option */
-#define TIMEOUT_MIN	0		/* Minumum timeout value */
+#define TIMEOUT_MIN	0		/* Minimum timeout value */
 #define TIMEOUT_MAX	255		/* Maximum timeout value */
 #define MIN_TIMEOUTS	3
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/release/doc/en_US.ISO8859-1/hardware/article.sgml
--- a/head/release/doc/en_US.ISO8859-1/hardware/article.sgml	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/release/doc/en_US.ISO8859-1/hardware/article.sgml	Fri Jan 13 15:51:01 2012 +0200
@@ -17,7 +17,7 @@
 
     <corpauthor>The &os; Documentation Project</corpauthor>
 
-    <pubdate>$FreeBSD: head/release/doc/en_US.ISO8859-1/hardware/article.sgml 228028 2011-11-27 16:50:13Z marius $</pubdate>
+    <pubdate>$FreeBSD: head/release/doc/en_US.ISO8859-1/hardware/article.sgml 229977 2012-01-11 18:38:52Z brueffer $</pubdate>
 
     <copyright>
       <year>2000</year>
@@ -32,6 +32,7 @@
       <year>2009</year>
       <year>2010</year>
       <year>2011</year>
+      <year>2012</year>
       <holder role="mailto:doc at FreeBSD.org">The &os; Documentation Project</holder>
     </copyright>
 
@@ -773,6 +774,8 @@
 
       &hwlist.esp;
 
+      &hwlist.hpt27xx;
+
       &hwlist.hptiop;
 
       &hwlist.hptmv;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/release/doc/en_US.ISO8859-1/relnotes/article.sgml
--- a/head/release/doc/en_US.ISO8859-1/relnotes/article.sgml	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/release/doc/en_US.ISO8859-1/relnotes/article.sgml	Fri Jan 13 15:51:01 2012 +0200
@@ -17,7 +17,7 @@
 
   <corpauthor>The &os; Project</corpauthor>
 
-  <pubdate>$FreeBSD: head/release/doc/en_US.ISO8859-1/relnotes/article.sgml 228877 2011-12-25 18:15:31Z eadler $</pubdate>
+  <pubdate>$FreeBSD: head/release/doc/en_US.ISO8859-1/relnotes/article.sgml 229779 2012-01-07 16:09:43Z uqs $</pubdate>
 
   <copyright>
     <year>2000</year>
@@ -339,7 +339,7 @@
       with the same semantics as (for example)
       &man.chmod.1;.</para>
 
-    <para>For compatiblity with other implementations, &man.cp.1; now
+    <para>For compatibility with other implementations, &man.cp.1; now
       supports a <option>-a</option> flag, which is equivalent to
       specifying the <option>-RrP</option> flags.</para>
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/release/doc/share/misc/dev.archlist.txt
--- a/head/release/doc/share/misc/dev.archlist.txt	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/release/doc/share/misc/dev.archlist.txt	Fri Jan 13 15:51:01 2012 +0200
@@ -23,7 +23,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $FreeBSD: head/release/doc/share/misc/dev.archlist.txt 227666 2011-11-18 16:54:22Z brueffer $
+# $FreeBSD: head/release/doc/share/misc/dev.archlist.txt 229977 2012-01-11 18:38:52Z brueffer $
 #
 
 #
@@ -72,6 +72,7 @@
 fe	i386,pc98,amd64
 fwohci	i386,sparc64,ia64,amd64,powerpc
 hifn	i386,pc98,amd64
+hpt27xx	i386,amd64
 hptiop	i386,amd64
 hptmv	i386,amd64
 hptrr	i386,amd64
diff -r ebe87ce4d7dd -r 1750de5b0399 head/release/picobsd/tinyware/passwd/local_passwd.c
--- a/head/release/picobsd/tinyware/passwd/local_passwd.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/release/picobsd/tinyware/passwd/local_passwd.c	Fri Jan 13 15:51:01 2012 +0200
@@ -36,7 +36,7 @@
 #endif /* not lint */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/release/picobsd/tinyware/passwd/local_passwd.c 229779 2012-01-07 16:09:43Z uqs $");
 
 #include <sys/types.h>
 #include <sys/time.h>
@@ -172,7 +172,7 @@
 	to64(&salt[5], random(), 4);
 	salt[9] = '\0';
 #else
-	/* Make a good size salt for algoritms that can use it. */
+	/* Make a good size salt for algorithms that can use it. */
 	gettimeofday(&tv,0);
 #ifdef LOGIN_CAP
 	if (login_setcryptfmt(lc, "md5", NULL) == NULL)
diff -r ebe87ce4d7dd -r 1750de5b0399 head/release/picobsd/tinyware/passwd/pw_copy.c
--- a/head/release/picobsd/tinyware/passwd/pw_copy.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/release/picobsd/tinyware/passwd/pw_copy.c	Fri Jan 13 15:51:01 2012 +0200
@@ -36,7 +36,7 @@
 #endif /* not lint */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/release/picobsd/tinyware/passwd/pw_copy.c 229779 2012-01-07 16:09:43Z uqs $");
 
 /*
  * This module is used to copy the master password file, replacing a single
@@ -193,7 +193,7 @@
  * by default, warning for IDs greater than USHRT_MAX.
  *
  * If pw_big_ids_warning is anything other than -1 on entry to pw_scan()
- * it will be set based on the existance of PW_SCAN_BIG_IDS in the
+ * it will be set based on the existence of PW_SCAN_BIG_IDS in the
  * environment.
  */
 int     pw_big_ids_warning = -1;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/release/picobsd/tinyware/simple_httpd/README
--- a/head/release/picobsd/tinyware/simple_httpd/README	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/release/picobsd/tinyware/simple_httpd/README	Fri Jan 13 15:51:01 2012 +0200
@@ -21,14 +21,14 @@
 
 The "fetch" mode supports file transfer over httpd.  This 
 is best thought of as mate for fetch(1).  This feature can be
-usefull to transfer a file from one host to another.
+useful to transfer a file from one host to another.
 
 Simple_httpd has the ability to run CGI scripts.  All CGI
 scripts must be located in ${DOCUMENT_ROOT}/cgi-bin.  The
-server currently only sets 3 enviroment variables before calling
+server currently only sets 3 environment variables before calling
 the script.
 
-CGI Enviroment variables are below:
+CGI Environment variables are below:
 
 SERVER_SOFTWARE = FreeBSD/PicoBSD
 REMOTE_HOST = client.canada_lower_taxes.com
@@ -61,7 +61,7 @@
 
 -D
 Do not daemonize.  The server will not run in the background.  It will
-stay attached to the tty.  This is usefull for debugging.  In this
+stay attached to the tty.  This is useful for debugging.  In this
 mode no log file is created.  Logging info is to stdout.
 
 This option is automatically selected if fetch option is selected.
@@ -139,7 +139,7 @@
 To Do
 =====
 
-Simple authentication would be very usefull[understatment].
+Simple authentication would be very useful [understatment].
 /etc/passwd or PAM would be nice.
 
 I think a netmask option would be good. Most internet appliances
@@ -164,4 +164,4 @@
 
 Major rewrite by William Lloyd <wlloyd at slap.net>
 
-$FreeBSD$
+$FreeBSD: head/release/picobsd/tinyware/simple_httpd/README 229779 2012-01-07 16:09:43Z uqs $
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/bsdlabel/bsdlabel.c
--- a/head/sbin/bsdlabel/bsdlabel.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/bsdlabel/bsdlabel.c	Fri Jan 13 15:51:01 2012 +0200
@@ -53,7 +53,7 @@
 #endif /* not lint */
 #endif
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/bsdlabel/bsdlabel.c 229403 2012-01-03 18:51:58Z ed $");
+__FBSDID("$FreeBSD: head/sbin/bsdlabel/bsdlabel.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/param.h>
 #include <stdint.h>
@@ -189,8 +189,8 @@
 				break;
 			case 'r':
 				/*
-				 * We accept and ignode -r for compatibility with
-				 * historically disklabel usage.
+				 * We accept and ignore -r for compatibility with
+				 * historical disklabel usage.
 				 */
 				break;
 			case 'w':
@@ -386,7 +386,7 @@
 	struct disklabel *lp = &lab;
 
 	if (disable_write) {
-		warnx("write to disk label supressed - label was as follows:");
+		warnx("write to disk label suppressed - label was as follows:");
 		display(stdout, NULL);
 		return (0);
 	}
@@ -1512,8 +1512,8 @@
 	loclab.d_secperunit = mediasize / secsize;
 
 	/*
-	 * Nobody in these enligthened days uses the CHS geometry for
-	 * anything, but nontheless try to get it right.  If we fail
+	 * Nobody in these enlightened days uses the CHS geometry for
+	 * anything, but nonetheless try to get it right.  If we fail
 	 * to get any good ideas from the device, construct something
 	 * which is IBM-PC friendly.
 	 */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/camcontrol/camcontrol.c
--- a/head/sbin/camcontrol/camcontrol.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/camcontrol/camcontrol.c	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/camcontrol/camcontrol.c 228602 2011-12-16 22:35:19Z dim $");
+__FBSDID("$FreeBSD: head/sbin/camcontrol/camcontrol.c 229919 2012-01-10 02:59:58Z eadler $");
 
 #include <sys/ioctl.h>
 #include <sys/stdint.h>
@@ -3412,7 +3412,6 @@
 		}
 		if (spi && syncrate != -1) {
 			int prelim_sync_period;
-			u_int freq;
 
 			if ((cpi.hba_inquiry & PI_SDTR_ABLE) == 0) {
 				warnx("HBA is not capable of changing "
@@ -3437,7 +3436,6 @@
 				prelim_sync_period = 10000000 / syncrate;
 			spi->sync_period =
 				scsi_calc_syncparam(prelim_sync_period);
-			freq = scsi_calc_syncsrate(spi->sync_period);
 			didsettings++;
 		}
 		if (sata && syncrate != -1) {
@@ -4030,13 +4028,12 @@
 					RPL_LUNDATA_LUN_LUN_MASK);
 				break;
 			case RPL_LUNDATA_ATYP_EXTLUN: {
-				int field_len, field_len_code, eam_code;
+				int field_len_code, eam_code;
 
 				eam_code = lundata->luns[i].lundata[j] &
 					RPL_LUNDATA_EXT_EAM_MASK;
 				field_len_code = (lundata->luns[i].lundata[j] &
 					RPL_LUNDATA_EXT_LEN_MASK) >> 4;
-				field_len = field_len_code * 2;
 
 				if ((eam_code == RPL_LUNDATA_EXT_EAM_WK)
 				 && (field_len_code == 0x00)) {
@@ -5732,7 +5729,7 @@
 "defects arguments:\n"
 "-f format         specify defect list format (block, bfi or phys)\n"
 "-G                get the grown defect list\n"
-"-P                get the permanant defect list\n"
+"-P                get the permanent defect list\n"
 "inquiry arguments:\n"
 "-D                get the standard inquiry data\n"
 "-S                get the serial number\n"
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/camcontrol/modeedit.c
--- a/head/sbin/camcontrol/modeedit.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/camcontrol/modeedit.c	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/camcontrol/modeedit.c 228407 2011-12-11 11:38:50Z ed $");
+__FBSDID("$FreeBSD: head/sbin/camcontrol/modeedit.c 229919 2012-01-10 02:59:58Z eadler $");
 
 #include <sys/queue.h>
 #include <sys/types.h>
@@ -869,7 +869,6 @@
 	  int retry_count, int timeout)
 {
 	u_int8_t data[MAX_COMMAND_SIZE];/* Buffer to hold sense data. */
-	u_int8_t *mode_pars;		/* Pointer to modepage params. */
 	struct scsi_mode_header_6 *mh;	/* Location of mode header. */
 	struct scsi_mode_page_header *mph;
 	struct pagename *nameentry;
@@ -895,7 +894,6 @@
 		/* Locate the next mode page header. */
 		mph = (struct scsi_mode_page_header *)
 		    ((intptr_t)mh + sizeof(*mh) + len);
-		mode_pars = MODE_PAGE_DATA(mph);
 
 		mph->page_code &= SMS_PAGE_CODE;
 		nameentry = nameentry_lookup(mph->page_code);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/devd/devd.cc
--- a/head/sbin/devd/devd.cc	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/devd/devd.cc	Fri Jan 13 15:51:01 2012 +0200
@@ -63,7 +63,7 @@
 //	  - devd.conf needs more details on the supported statements.
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/devd/devd.cc 226775 2011-10-26 02:11:28Z hrs $");
+__FBSDID("$FreeBSD: head/sbin/devd/devd.cc 229702 2012-01-06 15:01:05Z glebius $");
 
 #include <sys/param.h>
 #include <sys/socket.h>
@@ -298,7 +298,6 @@
 		{ IFM_FDDI,		"FDDI" },
 		{ IFM_IEEE80211,	"802.11" },
 		{ IFM_ATM,		"ATM" },
-		{ IFM_CARP,		"CARP" },
 		{ -1,			"unknown" },
 		{ 0, NULL },
 	};
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/devfs/rule.c
--- a/head/sbin/devfs/rule.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/devfs/rule.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/devfs/rule.c 227081 2011-11-04 13:36:02Z ed $");
+__FBSDID("$FreeBSD: head/sbin/devfs/rule.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/param.h>
 #include <sys/conf.h>
@@ -47,7 +47,7 @@
 
 #include "extern.h"
 
-static void rulespec_infp(FILE *fp, unsigned long reqest, devfs_rsnum rsnum);
+static void rulespec_infp(FILE *fp, unsigned long request, devfs_rsnum rsnum);
 static void rulespec_instr(struct devfs_rule *dr, const char *str,
     devfs_rsnum rsnum);
 static void rulespec_intok(struct devfs_rule *dr, int ac, char **av,
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/dhclient/dhclient-script.8
--- a/head/sbin/dhclient/dhclient-script.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/dhclient/dhclient-script.8	Fri Jan 13 15:51:01 2012 +0200
@@ -36,7 +36,7 @@
 .\" see ``http://www.isc.org/isc''.  To learn more about Vixie
 .\" Enterprises, see ``http://www.vix.com''.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/sbin/dhclient/dhclient-script.8 229778 2012-01-07 16:09:33Z uqs $
 .\"
 .Dd September 6, 2010
 .Dt DHCLIENT-SCRIPT 8
@@ -232,7 +232,7 @@
 .Pa /etc/dhclient-exit-hooks .
 If found, it will be sourced
 .Pq see Xr sh 1 .
-These hooks scripts can be used to dynamically modify the enviornment at
+These hooks scripts can be used to dynamically modify the environment at
 appropriate times during the DHCP negotiations.
 For example, if the administrator wishes to disable alias IP numbers on
 the DHCP interface, they might want to put the following in
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/dhclient/options.c
--- a/head/sbin/dhclient/options.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/dhclient/options.c	Fri Jan 13 15:51:01 2012 +0200
@@ -41,7 +41,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/dhclient/options.c 229000 2011-12-30 14:33:08Z dumbbell $");
+__FBSDID("$FreeBSD: head/sbin/dhclient/options.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <ctype.h>
 
@@ -284,8 +284,8 @@
 			    option->data[i + 1];
 			if (pointer >= *offset) {
 				/*
-				 * The pointer must indicates a prior
-				 * occurance.
+				 * The pointer must indicate a prior
+				 * occurrence.
 				 */
 				warning("Invalid forward pointer in DHCP "
 				    "Domain Search option compression.");
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/fsck_ffs/fsck.h
--- a/head/sbin/fsck_ffs/fsck.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/fsck_ffs/fsck.h	Fri Jan 13 15:51:01 2012 +0200
@@ -57,7 +57,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)fsck.h	8.4 (Berkeley) 5/9/95
- * $FreeBSD: head/sbin/fsck_ffs/fsck.h 228751 2011-12-20 20:39:00Z kib $
+ * $FreeBSD: head/sbin/fsck_ffs/fsck.h 229778 2012-01-07 16:09:33Z uqs $
  */
 
 #ifndef _FSCK_H_
@@ -220,7 +220,7 @@
  * To check if a block has been found as a duplicate it is only
  * necessary to search from duplist through muldup. To find the
  * total number of times that a block has been found as a duplicate
- * the entire list must be searched for occurences of the block
+ * the entire list must be searched for occurrences of the block
  * in question. The following diagram shows a sample list where
  * w (found twice), x (found once), y (found three times), and z
  * (found once) are duplicate block numbers:
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/fsck_ffs/fsutil.c
--- a/head/sbin/fsck_ffs/fsutil.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/fsck_ffs/fsutil.c	Fri Jan 13 15:51:01 2012 +0200
@@ -33,7 +33,7 @@
 #endif /* not lint */
 #endif
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/fsck_ffs/fsutil.c 221233 2011-04-29 23:00:23Z des $");
+__FBSDID("$FreeBSD: head/sbin/fsck_ffs/fsutil.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/param.h>
 #include <sys/time.h>
@@ -717,7 +717,7 @@
 #include <stdarg.h>
 
 /*
- * An unexpected inconsistency occured.
+ * An unexpected inconsistency occurred.
  * Die if preening or file system is running with soft dependency protocol,
  * otherwise just print message and continue.
  */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/fsck_ffs/gjournal.c
--- a/head/sbin/fsck_ffs/gjournal.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/fsck_ffs/gjournal.c	Fri Jan 13 15:51:01 2012 +0200
@@ -52,7 +52,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/fsck_ffs/gjournal.c 229918 2012-01-10 02:59:50Z eadler $");
 
 #include <sys/param.h>
 #include <sys/disklabel.h>
@@ -399,7 +399,7 @@
 	void *p;
 	struct cgchain *cgc;
 	struct cg *cgp;
-	uint8_t *inosused, *blksfree;
+	uint8_t *inosused;
 	ino_t cino, ino;
 	int cg, mode;
 
@@ -438,7 +438,6 @@
 		/* We don't want it to be freed in the meantime. */
 		busycg(cgc);
 		inosused = cg_inosused(cgp);
-		blksfree = cg_blksfree(cgp);
 		/*
 		 * Now go through the list of all inodes in this cylinder group
 		 * to find unreferenced ones.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/fsirand/fsirand.c
--- a/head/sbin/fsirand/fsirand.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/fsirand/fsirand.c	Fri Jan 13 15:51:01 2012 +0200
@@ -32,7 +32,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-  "$FreeBSD: head/sbin/fsirand/fsirand.c 227081 2011-11-04 13:36:02Z ed $";
+  "$FreeBSD: head/sbin/fsirand/fsirand.c 229917 2012-01-10 02:59:43Z eadler $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -115,7 +115,7 @@
 	caddr_t inodebuf;
 	ssize_t ibufsize;
 	struct fs *sblock;
-	ino_t inumber, maxino;
+	ino_t inumber;
 	ufs2_daddr_t sblockloc, dblk;
 	char sbuf[SBLOCKSIZE], sbuftmp[SBLOCKSIZE];
 	int i, devfd, n, cg;
@@ -165,7 +165,6 @@
 		fprintf(stderr, "Cannot find file system superblock\n");
 		return (1);
 	}
-	maxino = sblock->fs_ncg * sblock->fs_ipg;
 
 	if (sblock->fs_magic == FS_UFS1_MAGIC &&
 	    sblock->fs_old_inodefmt < FS_44INODEFMT) {
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/geom/class/part/geom_part.c
--- a/head/sbin/geom/class/part/geom_part.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/geom/class/part/geom_part.c	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/geom/class/part/geom_part.c 225445 2011-09-08 04:14:16Z ae $");
+__FBSDID("$FreeBSD: head/sbin/geom/class/part/geom_part.c 229916 2012-01-10 02:59:35Z eadler $");
 
 #include <sys/stat.h>
 #include <sys/vtoc.h>
@@ -718,7 +718,7 @@
 	struct ggeom *gp;
 	const char *s, *scheme;
 	off_t sector, end;
-	off_t length, secsz;
+	off_t length;
 	int error, i, windex, wblocks, wtype;
 
 	if (gctl_get_int(req, "nargs") != 1)
@@ -744,7 +744,6 @@
 	if (scheme == NULL)
 		abort();
 	pp = LIST_FIRST(&gp->lg_consumer)->lg_provider;
-	secsz = pp->lg_sectorsize;
 	s = find_geomcfg(gp, "last");
 	wblocks = strlen(s);
 	wtype = 0;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/geom/class/part/gpart.8
--- a/head/sbin/geom/class/part/gpart.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/geom/class/part/gpart.8	Fri Jan 13 15:51:01 2012 +0200
@@ -22,9 +22,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/sbin/geom/class/part/gpart.8 227800 2011-11-21 18:04:37Z wblock $
+.\" $FreeBSD: head/sbin/geom/class/part/gpart.8 229847 2012-01-09 05:51:33Z wblock $
 .\"
-.Dd November 21, 2011
+.Dd January 8, 2012
 .Dt GPART 8
 .Os
 .Sh NAME
@@ -33,7 +33,7 @@
 .Sh SYNOPSIS
 To add support for the disk partitioning GEOM class,
 place one or more of the following
-lines in your kernel configuration file:
+lines in the kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options GEOM_PART_APM"
 .Cd "options GEOM_PART_BSD"
@@ -48,7 +48,8 @@
 These options provide support for the various types of partitioning
 schemes supported by the
 .Ns Nm
-utility.  See
+utility.
+See
 .Sx "PARTITIONING SCHEMES"
 below for more details.
 .Pp
@@ -410,13 +411,13 @@
 .El
 .\" ==== RESTORE ====
 .It Cm restore
-Restore the partition table from backup previously created by
+Restore the partition table from a backup previously created by the
 .Cm backup
-action and given from standard input.
-Only partition table may be restored.
-This action does not affect content of partitions.
-This mean that you should copy your data from backup after restoring
-partition table and write bootcode again if it is needed.
+action and read from standard input.
+Only the partition table is restored.
+This action does not affect the content of partitions.
+After restoring the partition table and writing bootcode if needed,
+user data must be restored from backup.
 .Pp
 Additional options include:
 .Bl -tag -width 10n
@@ -502,8 +503,8 @@
 .Po
 This scheme can also be used as the sole partitioning method, without
 an MBR.
-Partition editing tools from other operating systems often do not 
-understand the bare disklabel partition layout, so this is sometimes 
+Partition editing tools from other operating systems often do not
+understand the bare disklabel partition layout, so this is sometimes
 called
 .Dq dangerously dedicated .
 .Pc
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/geom/class/raid/graid.8
--- a/head/sbin/geom/class/raid/graid.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/geom/class/raid/graid.8	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/sbin/geom/class/raid/graid.8 226816 2011-10-26 21:50:10Z mav $
+.\" $FreeBSD: head/sbin/geom/class/raid/graid.8 229886 2012-01-09 23:01:42Z jimharris $
 .\"
 .Dd October 26, 2011
 .Dt GRAID 8
@@ -251,7 +251,7 @@
 Do not run GEOM RAID class on migrating volumes under pain of possible data
 corruption!
 .Sh 2TiB BARRIERS
-Intel and Promise metadata formats do not support disks above 2TiB.
+Promise metadata format does not support disks above 2TiB.
 NVIDIA metadata format does not support volumes above 2TiB.
 .Sh EXIT STATUS
 Exit status is 0 on success, and non-zero if the command fails.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/gvinum/gvinum.c
--- a/head/sbin/gvinum/gvinum.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/gvinum/gvinum.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/sbin/gvinum/gvinum.c 227489 2011-11-13 17:06:33Z eadler $
+ * $FreeBSD: head/sbin/gvinum/gvinum.c 229915 2012-01-10 02:59:26Z eadler $
  */
 
 #include <sys/param.h>
@@ -937,14 +937,12 @@
 	struct gctl_req *req;
 	int flags, i;
 	const char *errstr;
-	char *op, *msg;
+	char *op;
 
 	if (rebuild) {
 		op = "rebuildparity";
-		msg = "Rebuilding";
 	} else {
 		op = "checkparity";
-		msg = "Checking";
 	}
 
 	optreset = 1;
@@ -1057,9 +1055,8 @@
 	struct gctl_req *req;
 	int flags, i, j;
 	const char *errstr;
-	char buf[20], *cmd;
+	char buf[20];
 
-	cmd = argv[0];
 	flags = 0;
 	optreset = 1;
 	optind = 1;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastctl/hastctl.8
--- a/head/sbin/hastctl/hastctl.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastctl/hastctl.8	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/sbin/hastctl/hastctl.8 220520 2011-04-10 15:07:54Z trociny $
+.\" $FreeBSD: head/sbin/hastctl/hastctl.8 229778 2012-01-07 16:09:33Z uqs $
 .\"
 .Dd April 10, 2011
 .Dt HASTCTL 8
@@ -97,7 +97,7 @@
 related to dirty map updates, which will degrade performance of the
 given resource.
 If extent size is too large, synchronization, even in case of short
-outage, can take a long time increasing the risk of loosing up-to-date
+outage, can take a long time increasing the risk of losing up-to-date
 node before synchronization process is completed.
 The default extent size is
 .Va 2MB .
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastctl/hastctl.c
--- a/head/sbin/hastctl/hastctl.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastctl/hastctl.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastctl/hastctl.c 225785 2011-09-27 08:21:00Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastctl/hastctl.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/param.h>
 #include <sys/disk.h>
@@ -104,7 +104,7 @@
 	ec = 0;
 	pjdlog_prefix_set("[%s] ", res->hr_name);
 
-	if (provinfo(res, true) < 0) {
+	if (provinfo(res, true) == -1) {
 		ec = EX_NOINPUT;
 		goto end;
 	}
@@ -146,7 +146,7 @@
 
 	res->hr_localoff = METADATA_SIZE + mapsize;
 
-	if (metadata_write(res) < 0) {
+	if (metadata_write(res) == -1) {
 		ec = EX_IOERR;
 		goto end;
 	}
@@ -401,15 +401,15 @@
 			debug++;
 			break;
 		case 'e':
-			if (expand_number(optarg, &extentsize) < 0)
+			if (expand_number(optarg, &extentsize) == -1)
 				errx(EX_USAGE, "Invalid extentsize");
 			break;
 		case 'k':
-			if (expand_number(optarg, &keepdirty) < 0)
+			if (expand_number(optarg, &keepdirty) == -1)
 				errx(EX_USAGE, "Invalid keepdirty");
 			break;
 		case 'm':
-			if (expand_number(optarg, &mediasize) < 0)
+			if (expand_number(optarg, &mediasize) == -1)
 				errx(EX_USAGE, "Invalid mediasize");
 			break;
 		case 'h':
@@ -479,13 +479,13 @@
 	}
 
 	/* Setup control connection... */
-	if (proto_client(NULL, cfg->hc_controladdr, &controlconn) < 0) {
+	if (proto_client(NULL, cfg->hc_controladdr, &controlconn) == -1) {
 		pjdlog_exit(EX_OSERR,
 		    "Unable to setup control connection to %s",
 		    cfg->hc_controladdr);
 	}
 	/* ...and connect to hastd. */
-	if (proto_connect(controlconn, HAST_TIMEOUT) < 0) {
+	if (proto_connect(controlconn, HAST_TIMEOUT) == -1) {
 		pjdlog_exit(EX_OSERR, "Unable to connect to hastd via %s",
 		    cfg->hc_controladdr);
 	}
@@ -494,14 +494,14 @@
 		exit(EX_CONFIG);
 
 	/* Send the command to the server... */
-	if (hast_proto_send(NULL, controlconn, nv, NULL, 0) < 0) {
+	if (hast_proto_send(NULL, controlconn, nv, NULL, 0) == -1) {
 		pjdlog_exit(EX_UNAVAILABLE,
 		    "Unable to send command to hastd via %s",
 		    cfg->hc_controladdr);
 	}
 	nv_free(nv);
 	/* ...and receive reply. */
-	if (hast_proto_recv_hdr(controlconn, &nv) < 0) {
+	if (hast_proto_recv_hdr(controlconn, &nv) == -1) {
 		pjdlog_exit(EX_UNAVAILABLE,
 		    "cannot receive reply from hastd via %s",
 		    cfg->hc_controladdr);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/activemap.c
--- a/head/sbin/hastd/activemap.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/activemap.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/activemap.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/activemap.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/param.h>	/* powerof2() */
 #include <sys/queue.h>
@@ -219,7 +219,7 @@
 	kd = keepdirty_find(amp, extent);
 	if (kd != NULL) {
 		/*
-		 * Only move element at the begining.
+		 * Only move element at the beginning.
 		 */
 		TAILQ_REMOVE(&amp->am_keepdirty, kd, kd_next);
 		TAILQ_INSERT_HEAD(&amp->am_keepdirty, kd, kd_next);
@@ -573,7 +573,7 @@
 		return;
 	}
 	/*
-	 * Mark that we want to start synchronization from the begining.
+	 * Mark that we want to start synchronization from the beginning.
 	 */
 	amp->am_syncoff = -1;
 }
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/control.c
--- a/head/sbin/hastd/control.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/control.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/control.c 228542 2011-12-15 22:01:34Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/control.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -115,7 +115,7 @@
 	 * doing that work.
 	 */
 	if (res->hr_workerpid != 0) {
-		if (kill(res->hr_workerpid, SIGTERM) < 0) {
+		if (kill(res->hr_workerpid, SIGTERM) == -1) {
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to kill worker process %u",
 			    (unsigned int)res->hr_workerpid);
@@ -167,7 +167,7 @@
 		    "Unable to prepare control header");
 		goto end;
 	}
-	if (hast_proto_send(res, res->hr_ctrl, cnvout, NULL, 0) < 0) {
+	if (hast_proto_send(res, res->hr_ctrl, cnvout, NULL, 0) == -1) {
 		error = errno;
 		pjdlog_errno(LOG_ERR, "Unable to send control header");
 		goto end;
@@ -176,7 +176,7 @@
 	/*
 	 * Receive response.
 	 */
-	if (hast_proto_recv_hdr(res->hr_ctrl, &cnvin) < 0) {
+	if (hast_proto_recv_hdr(res->hr_ctrl, &cnvin) == -1) {
 		error = errno;
 		pjdlog_errno(LOG_ERR, "Unable to receive control header");
 		goto end;
@@ -293,7 +293,7 @@
 	uint8_t cmd, role;
 	int error;
 
-	if (proto_accept(cfg->hc_controlconn, &conn) < 0) {
+	if (proto_accept(cfg->hc_controlconn, &conn) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to accept control connection");
 		return;
 	}
@@ -302,7 +302,7 @@
 	nvin = nvout = NULL;
 	role = HAST_ROLE_UNDEF;
 
-	if (hast_proto_recv_hdr(conn, &nvin) < 0) {
+	if (hast_proto_recv_hdr(conn, &nvin) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to receive control header");
 		nvin = NULL;
 		goto close;
@@ -395,7 +395,7 @@
 	if (error != 0)
 		nv_add_int16(nvout, error, "error");
 
-	if (hast_proto_send(NULL, conn, nvout, NULL, 0) < 0)
+	if (hast_proto_send(NULL, conn, nvout, NULL, 0) == -1)
 		pjdlog_errno(LOG_ERR, "Unable to send control response");
 close:
 	if (nvin != NULL)
@@ -417,7 +417,7 @@
 	uint8_t cmd;
 
 	for (;;) {
-		if (hast_proto_recv_hdr(res->hr_ctrl, &nvin) < 0) {
+		if (hast_proto_recv_hdr(res->hr_ctrl, &nvin) == -1) {
 			if (sigexit_received)
 				pthread_exit(NULL);
 			pjdlog_errno(LOG_ERR,
@@ -481,7 +481,7 @@
 			nv_free(nvout);
 			continue;
 		}
-		if (hast_proto_send(NULL, res->hr_ctrl, nvout, NULL, 0) < 0) {
+		if (hast_proto_send(NULL, res->hr_ctrl, nvout, NULL, 0) == -1) {
 			pjdlog_errno(LOG_ERR,
 			    "Unable to send reply to control message");
 		}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/ebuf.c
--- a/head/sbin/hastd/ebuf.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/ebuf.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/ebuf.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/ebuf.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/param.h>
 
@@ -116,7 +116,7 @@
 		 * We can't add more entries at the front, so we have to extend
 		 * our buffer.
 		 */
-		if (ebuf_head_extend(eb, size) < 0)
+		if (ebuf_head_extend(eb, size) == -1)
 			return (-1);
 	}
 	PJDLOG_ASSERT(size <= (size_t)(eb->eb_used - eb->eb_start));
@@ -143,7 +143,7 @@
 		 * We can't add more entries at the back, so we have to extend
 		 * our buffer.
 		 */
-		if (ebuf_tail_extend(eb, size) < 0)
+		if (ebuf_tail_extend(eb, size) == -1)
 			return (-1);
 	}
 	PJDLOG_ASSERT(size <=
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/event.c
--- a/head/sbin/hastd/event.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/event.c	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/event.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/event.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <errno.h>
 
@@ -61,11 +61,11 @@
 		    "Unable to prepare event header");
 		goto done;
 	}
-	if (hast_proto_send(res, res->hr_event, nvout, NULL, 0) < 0) {
+	if (hast_proto_send(res, res->hr_event, nvout, NULL, 0) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to send event header");
 		goto done;
 	}
-	if (hast_proto_recv_hdr(res->hr_event, &nvin) < 0) {
+	if (hast_proto_recv_hdr(res->hr_event, &nvin) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to receive event header");
 		goto done;
 	}
@@ -92,7 +92,7 @@
 
 	nvin = nvout = NULL;
 
-	if (hast_proto_recv_hdr(res->hr_event, &nvin) < 0) {
+	if (hast_proto_recv_hdr(res->hr_event, &nvin) == -1) {
 		/*
 		 * First error log as debug. This is because worker process
 		 * most likely exited.
@@ -145,7 +145,7 @@
 		    "Unable to prepare event header");
 		goto fail;
 	}
-	if (hast_proto_send(res, res->hr_event, nvout, NULL, 0) < 0) {
+	if (hast_proto_send(res, res->hr_event, nvout, NULL, 0) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to send event header");
 		goto fail;
 	}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/hast_compression.c
--- a/head/sbin/hastd/hast_compression.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/hast_compression.c	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/hastd/hast_compression.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/endian.h>
 
@@ -55,7 +55,7 @@
 	 * Because inside the loop we don't check at every step, we would
 	 * get an answer only after walking through entire buffer.
 	 * To return early if the buffer doesn't contain all zeros, we probe
-	 * 8 bytes at the begining, in the middle and at the end of the buffer
+	 * 8 bytes at the beginning, in the middle and at the end of the buffer
 	 * first.
 	 */
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/hast_proto.c
--- a/head/sbin/hastd/hast_proto.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/hast_proto.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/hast_proto.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/hast_proto.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/endian.h>
 
@@ -114,13 +114,13 @@
 
 	hdr.version = HAST_PROTO_VERSION;
 	hdr.size = htole32((uint32_t)ebuf_size(eb));
-	if (ebuf_add_head(eb, &hdr, sizeof(hdr)) < 0)
+	if (ebuf_add_head(eb, &hdr, sizeof(hdr)) == -1)
 		goto end;
 
 	hptr = ebuf_data(eb, &hsize);
-	if (proto_send(conn, hptr, hsize) < 0)
+	if (proto_send(conn, hptr, hsize) == -1)
 		goto end;
-	if (data != NULL && proto_send(conn, dptr, size) < 0)
+	if (data != NULL && proto_send(conn, dptr, size) == -1)
 		goto end;
 
 	ret = 0;
@@ -141,7 +141,7 @@
 	eb = NULL;
 	nv = NULL;
 
-	if (proto_recv(conn, &hdr, sizeof(hdr)) < 0)
+	if (proto_recv(conn, &hdr, sizeof(hdr)) == -1)
 		goto fail;
 
 	if (hdr.version != HAST_PROTO_VERSION) {
@@ -154,11 +154,11 @@
 	eb = ebuf_alloc(hdr.size);
 	if (eb == NULL)
 		goto fail;
-	if (ebuf_add_tail(eb, NULL, hdr.size) < 0)
+	if (ebuf_add_tail(eb, NULL, hdr.size) == -1)
 		goto fail;
 	hptr = ebuf_data(eb, NULL);
 	PJDLOG_ASSERT(hptr != NULL);
-	if (proto_recv(conn, hptr, hdr.size) < 0)
+	if (proto_recv(conn, hptr, hdr.size) == -1)
 		goto fail;
 	nv = nv_ntoh(eb);
 	if (nv == NULL)
@@ -196,7 +196,7 @@
 	} else if (dsize == 0) {
 		(void)nv_set_error(nv, 0);
 	} else {
-		if (proto_recv(conn, data, dsize) < 0)
+		if (proto_recv(conn, data, dsize) == -1)
 			goto end;
 		for (ii = sizeof(pipeline) / sizeof(pipeline[0]); ii > 0;
 		    ii--) {
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/hastd.c
--- a/head/sbin/hastd/hastd.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/hastd.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/hastd.c 226463 2011-10-17 12:22:09Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/hastd.c 229946 2012-01-10 22:41:09Z pjd $");
 
 #include <sys/param.h>
 #include <sys/linker.h>
@@ -68,6 +68,8 @@
 bool sigexit_received = false;
 /* PID file handle. */
 struct pidfh *pfh;
+/* Do we run in foreground? */
+static bool foreground;
 
 /* How often check for hooks running for too long. */
 #define	REPORT_INTERVAL	5
@@ -172,7 +174,7 @@
 	msg[0] = '\0';
 
 	maxfd = sysconf(_SC_OPEN_MAX);
-	if (maxfd < 0) {
+	if (maxfd == -1) {
 		pjdlog_init(pjdlogmode);
 		pjdlog_prefix_set("[%s] (%s) ", res->hr_name,
 		    role2str(res->hr_role));
@@ -450,7 +452,7 @@
 		pjdlog_error("Unable to allocate header for reload message.");
 		return;
 	}
-	if (hast_proto_send(res, res->hr_ctrl, nvout, NULL, 0) < 0) {
+	if (hast_proto_send(res, res->hr_ctrl, nvout, NULL, 0) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to send reload message");
 		nv_free(nvout);
 		return;
@@ -458,7 +460,7 @@
 	nv_free(nvout);
 
 	/* Receive response. */
-	if (hast_proto_recv_hdr(res->hr_ctrl, &nvin) < 0) {
+	if (hast_proto_recv_hdr(res->hr_ctrl, &nvin) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to receive reload reply");
 		return;
 	}
@@ -494,7 +496,7 @@
 	 */
 	if (strcmp(cfg->hc_controladdr, newcfg->hc_controladdr) != 0) {
 		if (proto_server(newcfg->hc_controladdr,
-		    &newcfg->hc_controlconn) < 0) {
+		    &newcfg->hc_controlconn) == -1) {
 			pjdlog_errno(LOG_ERR,
 			    "Unable to listen on control address %s",
 			    newcfg->hc_controladdr);
@@ -531,7 +533,7 @@
 	/*
 	 * Check if pidfile's path has changed.
 	 */
-	if (strcmp(cfg->hc_pidfile, newcfg->hc_pidfile) != 0) {
+	if (!foreground && strcmp(cfg->hc_pidfile, newcfg->hc_pidfile) != 0) {
 		newpfh = pidfile_open(newcfg->hc_pidfile, 0600, &otherpid);
 		if (newpfh == NULL) {
 			if (errno == EEXIST) {
@@ -543,7 +545,7 @@
 				    "Unable to open or create pidfile %s",
 				    newcfg->hc_pidfile);
 			}
-		} else if (pidfile_write(newpfh) < 0) {
+		} else if (pidfile_write(newpfh) == -1) {
 			/* Write PID to a file. */
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to write PID to file %s",
@@ -571,10 +573,14 @@
 	/*
 	 * Switch to new pidfile.
 	 */
-	(void)pidfile_remove(pfh);
-	pfh = newpfh;
-	(void)strlcpy(cfg->hc_pidfile, newcfg->hc_pidfile,
-	    sizeof(cfg->hc_pidfile));
+	if (newpfh != NULL) {
+		pjdlog_info("Pidfile changed from %s to %s.", cfg->hc_pidfile,
+		    newcfg->hc_pidfile);
+		(void)pidfile_remove(pfh);
+		pfh = newpfh;
+		(void)strlcpy(cfg->hc_pidfile, newcfg->hc_pidfile,
+		    sizeof(cfg->hc_pidfile));
+	}
 	/*
 	 * Switch to new listen addresses. Close all that were removed.
 	 */
@@ -742,7 +748,7 @@
 	proto_local_address(lst->hl_conn, laddr, sizeof(laddr));
 	pjdlog_debug(1, "Accepting connection to %s.", laddr);
 
-	if (proto_accept(lst->hl_conn, &conn) < 0) {
+	if (proto_accept(lst->hl_conn, &conn) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to accept connection %s", laddr);
 		return;
 	}
@@ -752,7 +758,7 @@
 	pjdlog_info("Connection from %s to %s.", raddr, laddr);
 
 	/* Error in setting timeout is not critical, but why should it fail? */
-	if (proto_timeout(conn, HAST_TIMEOUT) < 0)
+	if (proto_timeout(conn, HAST_TIMEOUT) == -1)
 		pjdlog_errno(LOG_WARNING, "Unable to set connection timeout");
 
 	nvin = nvout = nverr = NULL;
@@ -771,7 +777,7 @@
 	}
 	/* Ok, remote host can access at least one resource. */
 
-	if (hast_proto_recv_hdr(conn, &nvin) < 0) {
+	if (hast_proto_recv_hdr(conn, &nvin) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to receive header from %s",
 		    raddr);
 		goto close;
@@ -786,7 +792,7 @@
 	pjdlog_debug(2, "%s: resource=%s", raddr, resname);
 	token = nv_get_uint8_array(nvin, &size, "token");
 	/*
-	 * NULL token means that this is first conection.
+	 * NULL token means that this is first connection.
 	 */
 	if (token != NULL && size != sizeof(res->hr_token)) {
 		pjdlog_error("Received token of invalid size from %s (expected %zu, got %zu).",
@@ -859,7 +865,7 @@
 			    "Worker process exists (pid=%u), stopping it.",
 			    (unsigned int)res->hr_workerpid);
 			/* Stop child process. */
-			if (kill(res->hr_workerpid, SIGINT) < 0) {
+			if (kill(res->hr_workerpid, SIGINT) == -1) {
 				pjdlog_errno(LOG_ERR,
 				    "Unable to stop worker process (pid=%u)",
 				    (unsigned int)res->hr_workerpid);
@@ -909,7 +915,7 @@
 			    strerror(nv_error(nvout)));
 			goto fail;
 		}
-		if (hast_proto_send(NULL, conn, nvout, NULL, 0) < 0) {
+		if (hast_proto_send(NULL, conn, nvout, NULL, 0) == -1) {
 			int error = errno;
 
 			pjdlog_errno(LOG_ERR, "Unable to send response to %s",
@@ -938,7 +944,7 @@
 		    "Unable to prepare error header for %s", raddr);
 		goto close;
 	}
-	if (hast_proto_send(NULL, conn, nverr, NULL, 0) < 0) {
+	if (hast_proto_send(NULL, conn, nverr, NULL, 0) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to send error to %s", raddr);
 		goto close;
 	}
@@ -963,20 +969,20 @@
 
 	PJDLOG_ASSERT(res->hr_role == HAST_ROLE_PRIMARY);
 
-	if (proto_recv(res->hr_conn, &val, sizeof(val)) < 0) {
+	if (proto_recv(res->hr_conn, &val, sizeof(val)) == -1) {
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to receive connection command");
 		return;
 	}
 	if (proto_client(res->hr_sourceaddr[0] != '\0' ? res->hr_sourceaddr : NULL,
-	    res->hr_remoteaddr, &conn) < 0) {
+	    res->hr_remoteaddr, &conn) == -1) {
 		val = errno;
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to create outgoing connection to %s",
 		    res->hr_remoteaddr);
 		goto out;
 	}
-	if (proto_connect(conn, -1) < 0) {
+	if (proto_connect(conn, -1) == -1) {
 		val = errno;
 		pjdlog_errno(LOG_WARNING, "Unable to connect to %s",
 		    res->hr_remoteaddr);
@@ -985,11 +991,11 @@
 	}
 	val = 0;
 out:
-	if (proto_send(res->hr_conn, &val, sizeof(val)) < 0) {
+	if (proto_send(res->hr_conn, &val, sizeof(val)) == -1) {
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to send reply to connection request");
 	}
-	if (val == 0 && proto_connection_send(res->hr_conn, conn) < 0)
+	if (val == 0 && proto_connection_send(res->hr_conn, conn) == -1)
 		pjdlog_errno(LOG_WARNING, "Unable to send connection");
 
 	pjdlog_prefix_set("%s", "");
@@ -1155,7 +1161,6 @@
 	struct hastd_listen *lst;
 	const char *pidfile;
 	pid_t otherpid;
-	bool foreground;
 	int debuglevel;
 	sigset_t mask;
 
@@ -1220,16 +1225,23 @@
 			pjdlog_exitx(EX_CONFIG, "Pidfile path is too long.");
 		}
 	}
-	pfh = pidfile_open(cfg->hc_pidfile, 0600, &otherpid);
-	if (pfh == NULL) {
-		if (errno == EEXIST) {
-			pjdlog_exitx(EX_TEMPFAIL,
-			    "Another hastd is already running, pidfile: %s, pid: %jd.",
-			    cfg->hc_pidfile, (intmax_t)otherpid);
+
+	if (!foreground) {
+		pfh = pidfile_open(cfg->hc_pidfile, 0600, &otherpid);
+		if (pfh == NULL) {
+			if (errno == EEXIST) {
+				pjdlog_exitx(EX_TEMPFAIL,
+				    "Another hastd is already running, pidfile: %s, pid: %jd.",
+				    cfg->hc_pidfile, (intmax_t)otherpid);
+			}
+			/*
+			 * If we cannot create pidfile for other reasons,
+			 * only warn.
+			 */
+			pjdlog_errno(LOG_WARNING,
+			    "Unable to open or create pidfile %s",
+			    cfg->hc_pidfile);
 		}
-		/* If we cannot create pidfile for other reasons, only warn. */
-		pjdlog_errno(LOG_WARNING, "Unable to open or create pidfile %s",
-		    cfg->hc_pidfile);
 	}
 
 	/*
@@ -1253,14 +1265,14 @@
 	PJDLOG_VERIFY(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
 
 	/* Listen on control address. */
-	if (proto_server(cfg->hc_controladdr, &cfg->hc_controlconn) < 0) {
+	if (proto_server(cfg->hc_controladdr, &cfg->hc_controlconn) == -1) {
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR, "Unable to listen on control address %s",
 		    cfg->hc_controladdr);
 	}
 	/* Listen for remote connections. */
 	TAILQ_FOREACH(lst, &cfg->hc_listen, hl_next) {
-		if (proto_server(lst->hl_addr, &lst->hl_conn) < 0) {
+		if (proto_server(lst->hl_addr, &lst->hl_conn) == -1) {
 			KEEP_ERRNO((void)pidfile_remove(pfh));
 			pjdlog_exit(EX_OSERR, "Unable to listen on address %s",
 			    lst->hl_addr);
@@ -1268,7 +1280,7 @@
 	}
 
 	if (!foreground) {
-		if (daemon(0, 0) < 0) {
+		if (daemon(0, 0) == -1) {
 			KEEP_ERRNO((void)pidfile_remove(pfh));
 			pjdlog_exit(EX_OSERR, "Unable to daemonize");
 		}
@@ -1277,7 +1289,7 @@
 		pjdlog_mode_set(PJDLOG_MODE_SYSLOG);
 
 		/* Write PID to a file. */
-		if (pidfile_write(pfh) < 0) {
+		if (pidfile_write(pfh) == -1) {
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to write PID to a file %s",
 			    cfg->hc_pidfile);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/hooks.c
--- a/head/sbin/hastd/hooks.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/hooks.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/hooks.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/hooks.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/types.h>
 #include <sys/sysctl.h>
@@ -105,26 +105,26 @@
 	 * Redirect stdin, stdout and stderr to /dev/null.
 	 */
 	fd = open(_PATH_DEVNULL, O_RDONLY);
-	if (fd < 0) {
+	if (fd == -1) {
 		pjdlog_errno(LOG_WARNING, "Unable to open %s for reading",
 		    _PATH_DEVNULL);
 	} else if (fd != STDIN_FILENO) {
-		if (dup2(fd, STDIN_FILENO) < 0) {
+		if (dup2(fd, STDIN_FILENO) == -1) {
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to duplicate descriptor for stdin");
 		}
 		close(fd);
 	}
 	fd = open(_PATH_DEVNULL, O_WRONLY);
-	if (fd < 0) {
+	if (fd == -1) {
 		pjdlog_errno(LOG_WARNING, "Unable to open %s for writing",
 		    _PATH_DEVNULL);
 	} else {
-		if (fd != STDOUT_FILENO && dup2(fd, STDOUT_FILENO) < 0) {
+		if (fd != STDOUT_FILENO && dup2(fd, STDOUT_FILENO) == -1) {
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to duplicate descriptor for stdout");
 		}
-		if (fd != STDERR_FILENO && dup2(fd, STDERR_FILENO) < 0) {
+		if (fd != STDERR_FILENO && dup2(fd, STDERR_FILENO) == -1) {
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to duplicate descriptor for stderr");
 		}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/lzf.h
--- a/head/sbin/hastd/lzf.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/lzf.h	Fri Jan 13 15:51:01 2012 +0200
@@ -146,7 +146,7 @@
 
 /*
  * Avoid assigning values to errno variable? for some embedding purposes
- * (linux kernel for example), this is neccessary. NOTE: this breaks
+ * (linux kernel for example), this is necessary. NOTE: this breaks
  * the documentation in lzf.h.
  */
 #ifndef AVOID_ERRNO
@@ -167,7 +167,7 @@
  * and return EINVAL if the input stream has been corrupted. This
  * only shields against overflowing the input buffer and will not
  * detect most corrupted streams.
- * This check is not normally noticable on modern hardware
+ * This check is not normally noticeable on modern hardware
  * (<1% slowdown), but might slow down older cpus considerably.
  */
 #ifndef CHECK_INPUT
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/metadata.c
--- a/head/sbin/hastd/metadata.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/metadata.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/metadata.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/metadata.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <errno.h>
 #include <fcntl.h>
@@ -61,14 +61,14 @@
 	 * Is this first metadata_read() call for this resource?
 	 */
 	if (res->hr_localfd == -1) {
-		if (provinfo(res, openrw) < 0) {
+		if (provinfo(res, openrw) == -1) {
 			rerrno = errno;
 			goto fail;
 		}
 		opened_here = true;
 		pjdlog_debug(1, "Obtained info about %s.", res->hr_localpath);
 		if (openrw) {
-			if (flock(res->hr_localfd, LOCK_EX | LOCK_NB) < 0) {
+			if (flock(res->hr_localfd, LOCK_EX | LOCK_NB) == -1) {
 				rerrno = errno;
 				if (errno == EOPNOTSUPP) {
 					pjdlog_warning("Unable to lock %s (operation not supported), but continuing.",
@@ -91,7 +91,7 @@
 		    "Unable to allocate memory to read metadata");
 		goto fail;
 	}
-	if (ebuf_add_tail(eb, NULL, METADATA_SIZE) < 0) {
+	if (ebuf_add_tail(eb, NULL, METADATA_SIZE) == -1) {
 		rerrno = errno;
 		pjdlog_errno(LOG_ERR,
 		    "Unable to allocate memory to read metadata");
@@ -101,7 +101,7 @@
 	buf = ebuf_data(eb, NULL);
 	PJDLOG_ASSERT(buf != NULL);
 	done = pread(res->hr_localfd, buf, METADATA_SIZE, 0);
-	if (done < 0 || done != METADATA_SIZE) {
+	if (done == -1 || done != METADATA_SIZE) {
 		rerrno = errno;
 		pjdlog_errno(LOG_ERR, "Unable to read metadata");
 		ebuf_free(eb);
@@ -213,7 +213,7 @@
 	PJDLOG_ASSERT(size < METADATA_SIZE);
 	bcopy(ptr, buf, size);
 	done = pwrite(res->hr_localfd, buf, METADATA_SIZE, 0);
-	if (done < 0 || done != METADATA_SIZE) {
+	if (done == -1 || done != METADATA_SIZE) {
 		pjdlog_errno(LOG_ERR, "Unable to write metadata");
 		goto end;
 	}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/nv.c
--- a/head/sbin/hastd/nv.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/nv.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/nv.c 225787 2011-09-27 08:50:37Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/nv.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/param.h>
 #include <sys/endian.h>
@@ -385,7 +385,7 @@
 	nv->nv_ebuf = eb;
 	nv->nv_magic = NV_MAGIC;
 
-	if (nv_validate(nv, &extra) < 0) {
+	if (nv_validate(nv, &extra) == -1) {
 		rerrno = errno;
 		nv->nv_magic = 0;
 		free(nv);
@@ -480,7 +480,7 @@
 	ssize_t size;
 
 	size = vasprintf(&value, valuefmt, valueap);
-	if (size < 0) {
+	if (size == -1) {
 		if (nv->nv_error == 0)
 			nv->nv_error = ENOMEM;
 		return;
@@ -627,7 +627,7 @@
 	unsigned int ii;
 	bool swap;
 
-	if (nv_validate(nv, NULL) < 0) {
+	if (nv_validate(nv, NULL) == -1) {
 		printf("error: %d\n", errno);
 		return;
 	}
@@ -784,7 +784,7 @@
 	bcopy(name, nvh->nvh_name, namesize);
 
 	/* Add header first. */
-	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) < 0) {
+	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {
 		PJDLOG_ASSERT(errno != 0);
 		if (nv->nv_error == 0)
 			nv->nv_error = errno;
@@ -793,7 +793,7 @@
 	}
 	free(nvh);
 	/* Add the actual data. */
-	if (ebuf_add_tail(nv->nv_ebuf, value, vsize) < 0) {
+	if (ebuf_add_tail(nv->nv_ebuf, value, vsize) == -1) {
 		PJDLOG_ASSERT(errno != 0);
 		if (nv->nv_error == 0)
 			nv->nv_error = errno;
@@ -804,7 +804,7 @@
 	if (vsize == 0)
 		return;
 	PJDLOG_ASSERT(vsize > 0 && vsize <= sizeof(align));
-	if (ebuf_add_tail(nv->nv_ebuf, align, vsize) < 0) {
+	if (ebuf_add_tail(nv->nv_ebuf, align, vsize) == -1) {
 		PJDLOG_ASSERT(errno != 0);
 		if (nv->nv_error == 0)
 			nv->nv_error = errno;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/primary.c
--- a/head/sbin/hastd/primary.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/primary.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/primary.c 226859 2011-10-27 20:32:57Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/primary.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/types.h>
 #include <sys/time.h>
@@ -254,7 +254,7 @@
 		ggiod.gctl_version = G_GATE_VERSION;
 		ggiod.gctl_unit = res->hr_ggateunit;
 		ggiod.gctl_force = 1;
-		if (ioctl(res->hr_ggatefd, G_GATE_CMD_DESTROY, &ggiod) < 0) {
+		if (ioctl(res->hr_ggatefd, G_GATE_CMD_DESTROY, &ggiod) == -1) {
 			pjdlog_errno(LOG_WARNING,
 			    "Unable to destroy hast/%s device",
 			    res->hr_provname);
@@ -451,7 +451,7 @@
 		/* Initialize unique resource identifier. */
 		arc4random_buf(&res->hr_resuid, sizeof(res->hr_resuid));
 		mtx_unlock(&metadata_lock);
-		if (metadata_write(res) < 0)
+		if (metadata_write(res) == -1)
 			exit(EX_NOINPUT);
 		return (true);
 	}
@@ -463,19 +463,19 @@
 	unsigned char *buf;
 	size_t mapsize;
 
-	if (metadata_read(res, true) < 0)
+	if (metadata_read(res, true) == -1)
 		exit(EX_NOINPUT);
 	mtx_init(&res->hr_amp_lock);
 	if (activemap_init(&res->hr_amp, res->hr_datasize, res->hr_extentsize,
-	    res->hr_local_sectorsize, res->hr_keepdirty) < 0) {
+	    res->hr_local_sectorsize, res->hr_keepdirty) == -1) {
 		primary_exit(EX_TEMPFAIL, "Unable to create activemap");
 	}
 	mtx_init(&range_lock);
 	cv_init(&range_regular_cond);
-	if (rangelock_init(&range_regular) < 0)
+	if (rangelock_init(&range_regular) == -1)
 		primary_exit(EX_TEMPFAIL, "Unable to create regular range lock");
 	cv_init(&range_sync_cond);
-	if (rangelock_init(&range_sync) < 0)
+	if (rangelock_init(&range_sync) == -1)
 		primary_exit(EX_TEMPFAIL, "Unable to create sync range lock");
 	mapsize = activemap_ondisk_size(res->hr_amp);
 	buf = calloc(1, mapsize);
@@ -500,7 +500,7 @@
 	 */
 	res->hr_primary_localcnt = 0;
 	res->hr_primary_remotecnt = 0;
-	if (metadata_write(res) < 0)
+	if (metadata_write(res) == -1)
 		exit(EX_NOINPUT);
 }
 
@@ -511,11 +511,11 @@
 	int16_t val;
 
 	val = 1;
-	if (proto_send(res->hr_conn, &val, sizeof(val)) < 0) {
+	if (proto_send(res->hr_conn, &val, sizeof(val)) == -1) {
 		primary_exit(EX_TEMPFAIL,
 		    "Unable to send connection request to parent");
 	}
-	if (proto_recv(res->hr_conn, &val, sizeof(val)) < 0) {
+	if (proto_recv(res->hr_conn, &val, sizeof(val)) == -1) {
 		primary_exit(EX_TEMPFAIL,
 		    "Unable to receive reply to connection request from parent");
 	}
@@ -525,18 +525,18 @@
 		    res->hr_remoteaddr);
 		return (-1);
 	}
-	if (proto_connection_recv(res->hr_conn, true, &conn) < 0) {
+	if (proto_connection_recv(res->hr_conn, true, &conn) == -1) {
 		primary_exit(EX_TEMPFAIL,
 		    "Unable to receive connection from parent");
 	}
-	if (proto_connect_wait(conn, res->hr_timeout) < 0) {
+	if (proto_connect_wait(conn, res->hr_timeout) == -1) {
 		pjdlog_errno(LOG_WARNING, "Unable to connect to %s",
 		    res->hr_remoteaddr);
 		proto_close(conn);
 		return (-1);
 	}
 	/* Error in setting timeout is not critical, but why should it fail? */
-	if (proto_timeout(conn, res->hr_timeout) < 0)
+	if (proto_timeout(conn, res->hr_timeout) == -1)
 		pjdlog_errno(LOG_WARNING, "Unable to set connection timeout");
 
 	*connp = conn;
@@ -583,7 +583,7 @@
 		nv_free(nvout);
 		goto close;
 	}
-	if (hast_proto_send(res, out, nvout, NULL, 0) < 0) {
+	if (hast_proto_send(res, out, nvout, NULL, 0) == -1) {
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to send handshake header to %s",
 		    res->hr_remoteaddr);
@@ -591,7 +591,7 @@
 		goto close;
 	}
 	nv_free(nvout);
-	if (hast_proto_recv_hdr(out, &nvin) < 0) {
+	if (hast_proto_recv_hdr(out, &nvin) == -1) {
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to receive handshake header from %s",
 		    res->hr_remoteaddr);
@@ -655,7 +655,7 @@
 		nv_free(nvout);
 		goto close;
 	}
-	if (hast_proto_send(res, in, nvout, NULL, 0) < 0) {
+	if (hast_proto_send(res, in, nvout, NULL, 0) == -1) {
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to send handshake header to %s",
 		    res->hr_remoteaddr);
@@ -663,7 +663,7 @@
 		goto close;
 	}
 	nv_free(nvout);
-	if (hast_proto_recv_hdr(out, &nvin) < 0) {
+	if (hast_proto_recv_hdr(out, &nvin) == -1) {
 		pjdlog_errno(LOG_WARNING,
 		    "Unable to receive handshake header from %s",
 		    res->hr_remoteaddr);
@@ -726,7 +726,7 @@
 		 * download its activemap.
 		 */
 		if (hast_proto_recv_data(res, out, nvin, map,
-		    mapsize) < 0) {
+		    mapsize) == -1) {
 			pjdlog_errno(LOG_ERR,
 			    "Unable to receive remote activemap");
 			nv_free(nvin);
@@ -801,7 +801,7 @@
 	 * We communicate with ggate via /dev/ggctl. Open it.
 	 */
 	res->hr_ggatefd = open("/dev/" G_GATE_CTL_NAME, O_RDWR);
-	if (res->hr_ggatefd < 0)
+	if (res->hr_ggatefd == -1)
 		primary_exit(EX_OSFILE, "Unable to open /dev/" G_GATE_CTL_NAME);
 	/*
 	 * Create provider before trying to connect, as connection failure
@@ -859,7 +859,7 @@
 	 * Create communication channel for sending control commands from
 	 * parent to child.
 	 */
-	if (proto_client(NULL, "socketpair://", &res->hr_ctrl) < 0) {
+	if (proto_client(NULL, "socketpair://", &res->hr_ctrl) == -1) {
 		/* TODO: There's no need for this to be fatal error. */
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR,
@@ -868,7 +868,7 @@
 	/*
 	 * Create communication channel for sending events from child to parent.
 	 */
-	if (proto_client(NULL, "socketpair://", &res->hr_event) < 0) {
+	if (proto_client(NULL, "socketpair://", &res->hr_event) == -1) {
 		/* TODO: There's no need for this to be fatal error. */
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR,
@@ -878,7 +878,7 @@
 	 * Create communication channel for sending connection requests from
 	 * child to parent.
 	 */
-	if (proto_client(NULL, "socketpair://", &res->hr_conn) < 0) {
+	if (proto_client(NULL, "socketpair://", &res->hr_conn) == -1) {
 		/* TODO: There's no need for this to be fatal error. */
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR,
@@ -886,7 +886,7 @@
 	}
 
 	pid = fork();
-	if (pid < 0) {
+	if (pid == -1) {
 		/* TODO: There's no need for this to be fatal error. */
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_TEMPFAIL, "Unable to fork");
@@ -933,7 +933,7 @@
 
 	/*
 	 * Create the guard thread first, so we can handle signals from the
-	 * very begining.
+	 * very beginning.
 	 */
 	error = pthread_create(&td, NULL, guard_thread, res);
 	PJDLOG_ASSERT(error == 0);
@@ -1095,7 +1095,7 @@
 		mtx_unlock(&metadata_lock);
 	}
 	rw_unlock(&hio_remote_lock[ncomp]);
-	if (ioctl(res->hr_ggatefd, G_GATE_CMD_DONE, ggio) < 0)
+	if (ioctl(res->hr_ggatefd, G_GATE_CMD_DONE, ggio) == -1)
 		primary_exit(EX_OSERR, "G_GATE_CMD_DONE failed");
 	hio->hio_done = true;
 }
@@ -1133,7 +1133,7 @@
 		pjdlog_debug(2,
 		    "ggate_recv: (%p) Waiting for request from the kernel.",
 		    hio);
-		if (ioctl(res->hr_ggatefd, G_GATE_CMD_START, ggio) < 0) {
+		if (ioctl(res->hr_ggatefd, G_GATE_CMD_START, ggio) == -1) {
 			if (sigexit_received)
 				pthread_exit(NULL);
 			primary_exit(EX_OSERR, "G_GATE_CMD_START failed");
@@ -1225,7 +1225,7 @@
 					continue;
 				}
 				if (rangelock_add(range_regular,
-				    ggio->gctl_offset, ggio->gctl_length) < 0) {
+				    ggio->gctl_offset, ggio->gctl_length) == -1) {
 					mtx_unlock(&range_lock);
 					pjdlog_debug(2,
 					    "regular: Range offset=%jd length=%zu is already locked, waiting.",
@@ -1296,7 +1296,7 @@
 				/*
 				 * If READ failed, try to read from remote node.
 				 */
-				if (ret < 0) {
+				if (ret == -1) {
 					reqlog(LOG_WARNING, 0, ggio,
 					    "Local request failed (%s), trying remote node. ",
 					    strerror(errno));
@@ -1313,7 +1313,7 @@
 			ret = pwrite(res->hr_localfd, ggio->gctl_data,
 			    ggio->gctl_length,
 			    ggio->gctl_offset + res->hr_localoff);
-			if (ret < 0) {
+			if (ret == -1) {
 				hio->hio_errors[ncomp] = errno;
 				reqlog(LOG_WARNING, 0, ggio,
 				    "Local request failed (%s): ",
@@ -1336,7 +1336,7 @@
 			ret = g_delete(res->hr_localfd,
 			    ggio->gctl_offset + res->hr_localoff,
 			    ggio->gctl_length);
-			if (ret < 0) {
+			if (ret == -1) {
 				hio->hio_errors[ncomp] = errno;
 				reqlog(LOG_WARNING, 0, ggio,
 				    "Local request failed (%s): ",
@@ -1352,7 +1352,7 @@
 				break;
 			}
 			ret = g_flush(res->hr_localfd);
-			if (ret < 0) {
+			if (ret == -1) {
 				if (errno == EOPNOTSUPP)
 					res->hr_localflush = false;
 				hio->hio_errors[ncomp] = errno;
@@ -1406,7 +1406,7 @@
 		    "keepalive_send: Unable to prepare header to send.");
 		return;
 	}
-	if (hast_proto_send(res, res->hr_remoteout, nv, NULL, 0) < 0) {
+	if (hast_proto_send(res, res->hr_remoteout, nv, NULL, 0) == -1) {
 		rw_unlock(&hio_remote_lock[ncomp]);
 		pjdlog_common(LOG_DEBUG, 1, errno,
 		    "keepalive_send: Unable to send request");
@@ -1520,7 +1520,7 @@
 		TAILQ_INSERT_TAIL(&hio_recv_list[ncomp], hio, hio_next[ncomp]);
 		mtx_unlock(&hio_recv_list_lock[ncomp]);
 		if (hast_proto_send(res, res->hr_remoteout, nv, data,
-		    data != NULL ? length : 0) < 0) {
+		    data != NULL ? length : 0) == -1) {
 			hio->hio_errors[ncomp] = errno;
 			rw_unlock(&hio_remote_lock[ncomp]);
 			pjdlog_debug(2,
@@ -1617,7 +1617,7 @@
 			mtx_unlock(&hio_recv_list_lock[ncomp]);
 			goto done_queue;
 		}
-		if (hast_proto_recv_hdr(res->hr_remotein, &nv) < 0) {
+		if (hast_proto_recv_hdr(res->hr_remotein, &nv) == -1) {
 			pjdlog_errno(LOG_ERR,
 			    "Unable to receive reply header");
 			rw_unlock(&hio_remote_lock[ncomp]);
@@ -1665,7 +1665,7 @@
 				goto done_queue;
 			}
 			if (hast_proto_recv_data(res, res->hr_remotein, nv,
-			    ggio->gctl_data, ggio->gctl_length) < 0) {
+			    ggio->gctl_data, ggio->gctl_length) == -1) {
 				hio->hio_errors[ncomp] = errno;
 				pjdlog_errno(LOG_ERR,
 				    "Unable to receive reply data");
@@ -1766,7 +1766,7 @@
 			if (!hio->hio_done)
 				write_complete(res, hio);
 		} else {
-			if (ioctl(res->hr_ggatefd, G_GATE_CMD_DONE, ggio) < 0) {
+			if (ioctl(res->hr_ggatefd, G_GATE_CMD_DONE, ggio) == -1) {
 				primary_exit(EX_OSERR,
 				    "G_GATE_CMD_DONE failed");
 			}
@@ -1834,7 +1834,7 @@
 		mtx_unlock(&res->hr_amp_lock);
 		if (dorewind) {
 			dorewind = false;
-			if (offset < 0)
+			if (offset == -1)
 				pjdlog_info("Nodes are in sync.");
 			else {
 				pjdlog_info("Synchronization started. %NB to go.",
@@ -1844,7 +1844,7 @@
 				gettimeofday(&tstart, NULL);
 			}
 		}
-		if (offset < 0) {
+		if (offset == -1) {
 			sync_stop();
 			pjdlog_debug(1, "Nothing to synchronize.");
 			/*
@@ -1903,7 +1903,7 @@
 				mtx_unlock(&range_lock);
 				continue;
 			}
-			if (rangelock_add(range_sync, offset, length) < 0) {
+			if (rangelock_add(range_sync, offset, length) == -1) {
 				mtx_unlock(&range_lock);
 				pjdlog_debug(2,
 				    "sync: Range offset=%jd length=%jd is already locked, waiting.",
@@ -2124,12 +2124,12 @@
 			}
 			rw_unlock(&hio_remote_lock[ii]);
 			if (proto_timeout(gres->hr_remotein,
-			    gres->hr_timeout) < 0) {
+			    gres->hr_timeout) == -1) {
 				pjdlog_errno(LOG_WARNING,
 				    "Unable to set connection timeout");
 			}
 			if (proto_timeout(gres->hr_remoteout,
-			    gres->hr_timeout) < 0) {
+			    gres->hr_timeout) == -1) {
 				pjdlog_errno(LOG_WARNING,
 				    "Unable to set connection timeout");
 			}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/proto.c
--- a/head/sbin/hastd/proto.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/proto.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/hastd/proto.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/types.h>
 #include <sys/queue.h>
@@ -131,7 +131,7 @@
 		/*
 		 * ret == 0  - success
 		 * ret == -1 - dstaddr is not for this protocol
-		 * ret > 0   - right protocol, but an error occured
+		 * ret > 0   - right protocol, but an error occurred
 		 */
 		if (ret >= 0)
 			break;
@@ -142,7 +142,7 @@
 		return (-1);
 	}
 	if (ret > 0) {
-		/* An error occured. */
+		/* An error occurred. */
 		errno = ret;
 		return (-1);
 	}
@@ -419,14 +419,14 @@
 	PJDLOG_ASSERT(conn->pc_proto != NULL);
 
 	fd = proto_descriptor(conn);
-	if (fd < 0)
+	if (fd == -1)
 		return (-1);
 
 	tv.tv_sec = timeout;
 	tv.tv_usec = 0;
-	if (setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)) < 0)
+	if (setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)) == -1)
 		return (-1);
-	if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) < 0)
+	if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) == -1)
 		return (-1);
 
 	return (0);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/proto_common.c
--- a/head/sbin/hastd/proto_common.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/proto_common.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/proto_common.c 223143 2011-06-16 08:31:06Z sobomax $");
+__FBSDID("$FreeBSD: head/sbin/hastd/proto_common.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -116,7 +116,7 @@
 		done = send(sock, data, sendsize, MSG_NOSIGNAL);
 		if (done == 0) {
 			return (ENOTCONN);
-		} else if (done < 0) {
+		} else if (done == -1) {
 			if (errno == EINTR)
 				continue;
 			if (errno == ENOBUFS) {
@@ -215,7 +215,7 @@
 	} while (done == -1 && errno == EINTR);
 	if (done == 0) {
 		return (ENOTCONN);
-	} else if (done < 0) {
+	} else if (done == -1) {
 		/*
 		 * If this is blocking socket and we got EAGAIN, this
 		 * means the request timed out. Translate errno to
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/proto_socketpair.c
--- a/head/sbin/hastd/proto_socketpair.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/proto_socketpair.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/hastd/proto_socketpair.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -70,7 +70,7 @@
 	if (spctx == NULL)
 		return (errno);
 
-	if (socketpair(PF_UNIX, SOCK_STREAM, 0, spctx->sp_fd) < 0) {
+	if (socketpair(PF_UNIX, SOCK_STREAM, 0, spctx->sp_fd) == -1) {
 		ret = errno;
 		free(spctx);
 		return (ret);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/proto_tcp.c
--- a/head/sbin/hastd/proto_tcp.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/proto_tcp.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/proto_tcp.c 225781 2011-09-27 07:52:39Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/proto_tcp.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/param.h>	/* MAXHOSTNAMELEN */
 #include <sys/socket.h>
@@ -151,7 +151,7 @@
 		/* Port not given, use the default. */
 		port = defport;
 	} else {
-		if (numfromstr(pp + 1, 1, 65535, &port) < 0)
+		if (numfromstr(pp + 1, 1, 65535, &port) == -1)
 			return (errno);
 	}
 	(void)snprintf(portstr, sizeof(portstr), "%jd", (intmax_t)port);
@@ -275,7 +275,7 @@
 		tcp_close(tctx);
 		return (ret);
 	}
-	if (bind(tctx->tc_fd, (struct sockaddr *)&sa, sa.ss_len) < 0) {
+	if (bind(tctx->tc_fd, (struct sockaddr *)&sa, sa.ss_len) == -1) {
 		ret = errno;
 		tcp_close(tctx);
 		return (ret);
@@ -423,12 +423,12 @@
 	PJDLOG_ASSERT(tctx->tc_sa.ss_family != AF_UNSPEC);
 
 	if (bind(tctx->tc_fd, (struct sockaddr *)&tctx->tc_sa,
-	    tctx->tc_sa.ss_len) < 0) {
+	    tctx->tc_sa.ss_len) == -1) {
 		ret = errno;
 		tcp_close(tctx);
 		return (ret);
 	}
-	if (listen(tctx->tc_fd, 8) < 0) {
+	if (listen(tctx->tc_fd, 8) == -1) {
 		ret = errno;
 		tcp_close(tctx);
 		return (ret);
@@ -458,7 +458,7 @@
 	fromlen = tctx->tc_sa.ss_len;
 	newtctx->tc_fd = accept(tctx->tc_fd, (struct sockaddr *)&tctx->tc_sa,
 	    &fromlen);
-	if (newtctx->tc_fd < 0) {
+	if (newtctx->tc_fd == -1) {
 		ret = errno;
 		free(newtctx);
 		return (ret);
@@ -530,7 +530,7 @@
 		return (false);
 
 	salen = sizeof(sa2);
-	if (getpeername(tctx->tc_fd, (struct sockaddr *)&sa2, &salen) < 0)
+	if (getpeername(tctx->tc_fd, (struct sockaddr *)&sa2, &salen) == -1)
 		return (false);
 
 	if (sa1.ss_family != sa2.ss_family || sa1.ss_len != sa2.ss_len)
@@ -573,7 +573,7 @@
 	PJDLOG_ASSERT(tctx->tc_magic == TCP_CTX_MAGIC);
 
 	salen = sizeof(sa);
-	if (getsockname(tctx->tc_fd, (struct sockaddr *)&sa, &salen) < 0) {
+	if (getsockname(tctx->tc_fd, (struct sockaddr *)&sa, &salen) == -1) {
 		PJDLOG_VERIFY(strlcpy(addr, "N/A", size) < size);
 		return;
 	}
@@ -591,7 +591,7 @@
 	PJDLOG_ASSERT(tctx->tc_magic == TCP_CTX_MAGIC);
 
 	salen = sizeof(sa);
-	if (getpeername(tctx->tc_fd, (struct sockaddr *)&sa, &salen) < 0) {
+	if (getpeername(tctx->tc_fd, (struct sockaddr *)&sa, &salen) == -1) {
 		PJDLOG_VERIFY(strlcpy(addr, "N/A", size) < size);
 		return;
 	}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/proto_uds.c
--- a/head/sbin/hastd/proto_uds.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/proto_uds.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/hastd/proto_uds.c 229945 2012-01-10 22:39:07Z pjd $");
 
 /* UDS - UNIX Domain Socket */
 
@@ -144,7 +144,7 @@
 	PJDLOG_ASSERT(timeout >= -1);
 
 	if (connect(uctx->uc_fd, (struct sockaddr *)&uctx->uc_sun,
-	    sizeof(uctx->uc_sun)) < 0) {
+	    sizeof(uctx->uc_sun)) == -1) {
 		return (errno);
 	}
 
@@ -179,13 +179,13 @@
 
 	(void)unlink(uctx->uc_sun.sun_path);
 	if (bind(uctx->uc_fd, (struct sockaddr *)&uctx->uc_sun,
-	    sizeof(uctx->uc_sun)) < 0) {
+	    sizeof(uctx->uc_sun)) == -1) {
 		ret = errno;
 		uds_close(uctx);
 		return (ret);
 	}
 	uctx->uc_owner = getpid();
-	if (listen(uctx->uc_fd, 8) < 0) {
+	if (listen(uctx->uc_fd, 8) == -1) {
 		ret = errno;
 		uds_close(uctx);
 		return (ret);
@@ -214,7 +214,7 @@
 	fromlen = sizeof(newuctx->uc_sun);
 	newuctx->uc_fd = accept(uctx->uc_fd,
 	    (struct sockaddr *)&newuctx->uc_sun, &fromlen);
-	if (newuctx->uc_fd < 0) {
+	if (newuctx->uc_fd == -1) {
 		ret = errno;
 		free(newuctx);
 		return (ret);
@@ -274,7 +274,7 @@
 	PJDLOG_ASSERT(addr != NULL);
 
 	sunlen = sizeof(sun);
-	if (getsockname(uctx->uc_fd, (struct sockaddr *)&sun, &sunlen) < 0) {
+	if (getsockname(uctx->uc_fd, (struct sockaddr *)&sun, &sunlen) == -1) {
 		PJDLOG_VERIFY(strlcpy(addr, "N/A", size) < size);
 		return;
 	}
@@ -298,7 +298,7 @@
 	PJDLOG_ASSERT(addr != NULL);
 
 	sunlen = sizeof(sun);
-	if (getpeername(uctx->uc_fd, (struct sockaddr *)&sun, &sunlen) < 0) {
+	if (getpeername(uctx->uc_fd, (struct sockaddr *)&sun, &sunlen) == -1) {
 		PJDLOG_VERIFY(strlcpy(addr, "N/A", size) < size);
 		return;
 	}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/secondary.c
--- a/head/sbin/hastd/secondary.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/secondary.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/secondary.c 228544 2011-12-15 22:05:23Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/secondary.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #include <sys/param.h>
 #include <sys/time.h>
@@ -181,7 +181,7 @@
 init_local(struct hast_resource *res)
 {
 
-	if (metadata_read(res, true) < 0)
+	if (metadata_read(res, true) == -1)
 		exit(EX_NOINPUT);
 }
 
@@ -262,7 +262,7 @@
 		 */
 		PJDLOG_ASSERT(res->hr_secondary_localcnt == 0);
 		res->hr_resuid = resuid;
-		if (metadata_write(res) < 0)
+		if (metadata_write(res) == -1)
 			exit(EX_NOINPUT);
 		if (nv_exists(nvin, "virgin")) {
 			free(map);
@@ -282,7 +282,7 @@
 		    (uintmax_t)resuid, (uintmax_t)res->hr_resuid);
 		pjdlog_error("%s", errmsg);
 		nv_add_string(nvout, errmsg, "errmsg");
-		if (hast_proto_send(res, res->hr_remotein, nvout, NULL, 0) < 0) {
+		if (hast_proto_send(res, res->hr_remotein, nvout, NULL, 0) == -1) {
 			pjdlog_exit(EX_TEMPFAIL, "Unable to send response to %s",
 			    res->hr_remoteaddr);
 		}
@@ -327,7 +327,7 @@
 		free(map);
 		pjdlog_error("Split-brain detected, exiting.");
 		nv_add_string(nvout, "Split-brain condition!", "errmsg");
-		if (hast_proto_send(res, res->hr_remotein, nvout, NULL, 0) < 0) {
+		if (hast_proto_send(res, res->hr_remotein, nvout, NULL, 0) == -1) {
 			pjdlog_exit(EX_TEMPFAIL, "Unable to send response to %s",
 			    res->hr_remoteaddr);
 		}
@@ -361,7 +361,7 @@
 		    (uintmax_t)res->hr_secondary_remotecnt);
 	}
 	nv_add_uint32(nvout, (uint32_t)mapsize, "mapsize");
-	if (hast_proto_send(res, res->hr_remotein, nvout, map, mapsize) < 0) {
+	if (hast_proto_send(res, res->hr_remotein, nvout, map, mapsize) == -1) {
 		pjdlog_exit(EX_TEMPFAIL, "Unable to send activemap to %s",
 		    res->hr_remoteaddr);
 	}
@@ -386,7 +386,7 @@
 	/*
 	 * Create communication channel between parent and child.
 	 */
-	if (proto_client(NULL, "socketpair://", &res->hr_ctrl) < 0) {
+	if (proto_client(NULL, "socketpair://", &res->hr_ctrl) == -1) {
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR,
 		    "Unable to create control sockets between parent and child");
@@ -394,14 +394,14 @@
 	/*
 	 * Create communication channel between child and parent.
 	 */
-	if (proto_client(NULL, "socketpair://", &res->hr_event) < 0) {
+	if (proto_client(NULL, "socketpair://", &res->hr_event) == -1) {
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR,
 		    "Unable to create event sockets between child and parent");
 	}
 
 	pid = fork();
-	if (pid < 0) {
+	if (pid == -1) {
 		KEEP_ERRNO((void)pidfile_remove(pfh));
 		pjdlog_exit(EX_OSERR, "Unable to fork");
 	}
@@ -441,9 +441,9 @@
 	PJDLOG_VERIFY(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
 
 	/* Error in setting timeout is not critical, but why should it fail? */
-	if (proto_timeout(res->hr_remotein, 2 * HAST_KEEPALIVE) < 0)
+	if (proto_timeout(res->hr_remotein, 2 * HAST_KEEPALIVE) == -1)
 		pjdlog_errno(LOG_WARNING, "Unable to set connection timeout");
-	if (proto_timeout(res->hr_remoteout, res->hr_timeout) < 0)
+	if (proto_timeout(res->hr_remoteout, res->hr_timeout) == -1)
 		pjdlog_errno(LOG_WARNING, "Unable to set connection timeout");
 
 	init_local(res);
@@ -623,7 +623,7 @@
 		pjdlog_debug(2, "recv: Taking free request.");
 		QUEUE_TAKE(free, hio);
 		pjdlog_debug(2, "recv: (%p) Got request.", hio);
-		if (hast_proto_recv_hdr(res->hr_remotein, &nv) < 0) {
+		if (hast_proto_recv_hdr(res->hr_remotein, &nv) == -1) {
 			secondary_exit(EX_TEMPFAIL,
 			    "Unable to receive request header");
 		}
@@ -666,7 +666,7 @@
 			continue;
 		} else if (hio->hio_cmd == HIO_WRITE) {
 			if (hast_proto_recv_data(res, res->hr_remotein, nv,
-			    hio->hio_data, MAXPHYS) < 0) {
+			    hio->hio_data, MAXPHYS) == -1) {
 				secondary_exit(EX_TEMPFAIL,
 				    "Unable to receive request data");
 			}
@@ -735,7 +735,7 @@
 			ret = pread(res->hr_localfd, hio->hio_data,
 			    hio->hio_length,
 			    hio->hio_offset + res->hr_localoff);
-			if (ret < 0)
+			if (ret == -1)
 				hio->hio_error = errno;
 			else if (ret != (int64_t)hio->hio_length)
 				hio->hio_error = EIO;
@@ -746,7 +746,7 @@
 			ret = pwrite(res->hr_localfd, hio->hio_data,
 			    hio->hio_length,
 			    hio->hio_offset + res->hr_localoff);
-			if (ret < 0)
+			if (ret == -1)
 				hio->hio_error = errno;
 			else if (ret != (int64_t)hio->hio_length)
 				hio->hio_error = EIO;
@@ -757,7 +757,7 @@
 			ret = g_delete(res->hr_localfd,
 			    hio->hio_offset + res->hr_localoff,
 			    hio->hio_length);
-			if (ret < 0)
+			if (ret == -1)
 				hio->hio_error = errno;
 			else
 				hio->hio_error = 0;
@@ -770,7 +770,7 @@
 				break;
 			}
 			ret = g_flush(res->hr_localfd);
-			if (ret < 0) {
+			if (ret == -1) {
 				if (errno == EOPNOTSUPP)
 					res->hr_localflush = false;
 				hio->hio_error = errno;
@@ -837,7 +837,7 @@
 		if (hio->hio_error != 0)
 			nv_add_int16(nvout, hio->hio_error, "error");
 		if (hast_proto_send(res, res->hr_remoteout, nvout, data,
-		    length) < 0) {
+		    length) == -1) {
 			secondary_exit(EX_TEMPFAIL, "Unable to send reply.");
 		}
 		nv_free(nvout);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/subr.c
--- a/head/sbin/hastd/subr.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/subr.c	Fri Jan 13 15:51:01 2012 +0200
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/hastd/subr.c 225781 2011-09-27 07:52:39Z pjd $");
+__FBSDID("$FreeBSD: head/sbin/hastd/subr.c 229945 2012-01-10 22:39:07Z pjd $");
 
 #ifdef HAVE_CAPSICUM
 #include <sys/capability.h>
@@ -86,13 +86,13 @@
 	if (res->hr_localfd == -1) {
 		res->hr_localfd = open(res->hr_localpath,
 		    dowrite ? O_RDWR : O_RDONLY);
-		if (res->hr_localfd < 0) {
+		if (res->hr_localfd == -1) {
 			pjdlog_errno(LOG_ERR, "Unable to open %s",
 			    res->hr_localpath);
 			return (-1);
 		}
 	}
-	if (fstat(res->hr_localfd, &sb) < 0) {
+	if (fstat(res->hr_localfd, &sb) == -1) {
 		pjdlog_errno(LOG_ERR, "Unable to stat %s", res->hr_localpath);
 		return (-1);
 	}
@@ -101,14 +101,14 @@
 		 * If this is character device, it is most likely GEOM provider.
 		 */
 		if (ioctl(res->hr_localfd, DIOCGMEDIASIZE,
-		    &res->hr_local_mediasize) < 0) {
+		    &res->hr_local_mediasize) == -1) {
 			pjdlog_errno(LOG_ERR,
 			    "Unable obtain provider %s mediasize",
 			    res->hr_localpath);
 			return (-1);
 		}
 		if (ioctl(res->hr_localfd, DIOCGSECTORSIZE,
-		    &res->hr_local_sectorsize) < 0) {
+		    &res->hr_local_sectorsize) == -1) {
 			pjdlog_errno(LOG_ERR,
 			    "Unable obtain provider %s sectorsize",
 			    res->hr_localpath);
@@ -149,7 +149,7 @@
 }
 
 int
-drop_privs(struct hast_resource *res)
+drop_privs(const struct hast_resource *res)
 {
 	char jailhost[sizeof(res->hr_name) * 2];
 	struct jail jailst;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/hastd/subr.h
--- a/head/sbin/hastd/subr.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/hastd/subr.h	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/sbin/hastd/subr.h 221899 2011-05-14 17:02:03Z pjd $
+ * $FreeBSD: head/sbin/hastd/subr.h 229699 2012-01-06 12:27:17Z pjd $
  */
 
 #ifndef	_SUBR_H_
@@ -51,6 +51,6 @@
 
 int provinfo(struct hast_resource *res, bool dowrite);
 const char *role2str(int role);
-int drop_privs(struct hast_resource *res);
+int drop_privs(const struct hast_resource *res);
 
 #endif	/* !_SUBR_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/ifconfig/ifieee80211.c
--- a/head/sbin/ifconfig/ifieee80211.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/ifconfig/ifieee80211.c	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/sbin/ifconfig/ifieee80211.c 227336 2011-11-08 14:22:40Z adrian $
+ * $FreeBSD: head/sbin/ifconfig/ifieee80211.c 229914 2012-01-10 02:59:18Z eadler $
  */
 
 /*-
@@ -884,7 +884,7 @@
 }
 
 /*
- * This function is purely a NetBSD compatability interface.  The NetBSD
+ * This function is purely a NetBSD compatibility interface.  The NetBSD
  * interface is too inflexible, but it's there so we'll support it since
  * it's not all that hard.
  */
@@ -4383,7 +4383,6 @@
 
 	if (get80211val(s, IEEE80211_IOC_WEP, &wepmode) != -1 &&
 	    wepmode != IEEE80211_WEP_NOSUP) {
-		int firstkey;
 
 		switch (wepmode) {
 		case IEEE80211_WEP_OFF:
@@ -4419,7 +4418,6 @@
 			goto end;
 		}
 
-		firstkey = 1;
 		for (i = 0; i < num; i++) {
 			struct ieee80211req_key ik;
 
@@ -4433,7 +4431,6 @@
 				if (verbose)
 					LINE_BREAK();
 				printkey(&ik);
-				firstkey = 0;
 			}
 		}
 end:
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/ipfw/ipfw2.c
--- a/head/sbin/ipfw/ipfw2.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/ipfw/ipfw2.c	Fri Jan 13 15:51:01 2012 +0200
@@ -17,7 +17,7 @@
  *
  * NEW command line interface for IP firewall facility
  *
- * $FreeBSD: head/sbin/ipfw/ipfw2.c 225044 2011-08-20 17:05:11Z bz $
+ * $FreeBSD: head/sbin/ipfw/ipfw2.c 229778 2012-01-07 16:09:33Z uqs $
  */
 
 #include <sys/types.h>
@@ -454,8 +454,8 @@
  * of the first.  A warning is printed to stderr in the case that the
  * first string does not match the third.
  *
- * This function exists to warn about the bizzare construction
- * strncmp(str, "by", 2) which is used to allow people to use a shotcut
+ * This function exists to warn about the bizarre construction
+ * strncmp(str, "by", 2) which is used to allow people to use a shortcut
  * for "bytes".  The problem is that in addition to accepting "by",
  * "byt", "byte", and "bytes", it also excepts "by_rabid_dogs" and any
  * other string beginning with "by".
@@ -2866,9 +2866,9 @@
 			((struct sockaddr_in*)&result)->sin_addr.s_addr =
 			    INADDR_ANY;
 		} else {
-			/* 
+			/*
 			 * Resolve the host name or address to a family and a
-			 * network representation of the addres.
+			 * network representation of the address.
 			 */
 			if (getaddrinfo(*av, NULL, NULL, &res))
 				errx(EX_DATAERR, NULL);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/ipfw/main.c
--- a/head/sbin/ipfw/main.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/ipfw/main.c	Fri Jan 13 15:51:01 2012 +0200
@@ -17,7 +17,7 @@
  *
  * Command line interface for IP firewall facility
  *
- * $FreeBSD: head/sbin/ipfw/main.c 229403 2012-01-03 18:51:58Z ed $
+ * $FreeBSD: head/sbin/ipfw/main.c 229778 2012-01-07 16:09:33Z uqs $
  */
 
 #include <sys/wait.h>
@@ -167,7 +167,7 @@
 					i++;
 				bcopy(arg+j, av_p, i-j);
 				av[ac] = av_p;
-				av_p += i-j;	/* the lenght of the string */
+				av_p += i-j;	/* the length of the string */
 				*av_p++ = '\0';
 				ac++;
 				j = i + 1;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/mdmfs/mdmfs.c
--- a/head/sbin/mdmfs/mdmfs.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/mdmfs/mdmfs.c	Fri Jan 13 15:51:01 2012 +0200
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/mdmfs/mdmfs.c 225534 2011-09-13 20:16:11Z kib $");
+__FBSDID("$FreeBSD: head/sbin/mdmfs/mdmfs.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/param.h>
 #include <sys/mdioctl.h>
@@ -632,7 +632,7 @@
 		 * loop.
 		 */
 		(void)fprintf(stderr, "DEBUG: running:");
-		/* Should be equivilent to 'cmd' (before strsep, of course). */
+		/* Should be equivalent to 'cmd' (before strsep, of course). */
 		for (i = 0; argv[i] != NULL; i++)
 			(void)fprintf(stderr, " %s", argv[i]);
 		(void)fprintf(stderr, "\n");
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/mount_nfs/mount_nfs.c
--- a/head/sbin/mount_nfs/mount_nfs.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/mount_nfs/mount_nfs.c	Fri Jan 13 15:51:01 2012 +0200
@@ -42,7 +42,7 @@
 #endif /* not lint */
 #endif
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/mount_nfs/mount_nfs.c 227507 2011-11-14 18:52:07Z jhb $");
+__FBSDID("$FreeBSD: head/sbin/mount_nfs/mount_nfs.c 229778 2012-01-07 16:09:33Z uqs $");
 
 #include <sys/param.h>
 #include <sys/linker.h>
@@ -788,7 +788,7 @@
 	for (;;) {
 		/*
 		 * Try each entry returned by getaddrinfo(). Note the
-		 * occurence of remote errors by setting `remoteerr'.
+		 * occurrence of remote errors by setting `remoteerr'.
 		 */
 		remoteerr = 0;
 		for (ai = ai_nfs; ai != NULL; ai = ai->ai_next) {
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/newfs/mkfs.c
--- a/head/sbin/newfs/mkfs.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/newfs/mkfs.c	Fri Jan 13 15:51:01 2012 +0200
@@ -42,7 +42,7 @@
 #endif /* not lint */
 #endif
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/newfs/mkfs.c 227081 2011-11-04 13:36:02Z ed $");
+__FBSDID("$FreeBSD: head/sbin/newfs/mkfs.c 229913 2012-01-10 02:59:09Z eadler $");
 
 #include <sys/param.h>
 #include <sys/disklabel.h>
@@ -989,9 +989,7 @@
 iput(union dinode *ip, ino_t ino)
 {
 	ufs2_daddr_t d;
-	int c;
 
-	c = ino_to_cg(&sblock, ino);
 	bread(&disk, part_ofs + fsbtodb(&sblock, cgtod(&sblock, 0)), (char *)&acg,
 	    sblock.fs_cgsize);
 	if (acg.cg_magic != CG_MAGIC) {
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/ping6/ping6.c
--- a/head/sbin/ping6/ping6.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/ping6/ping6.c	Fri Jan 13 15:51:01 2012 +0200
@@ -76,7 +76,7 @@
 #endif /* not lint */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/ping6/ping6.c 229912 2012-01-10 02:59:01Z eadler $");
 
 /*
  * Using the InterNet Control Message Protocol (ICMP) "ECHO" facility,
@@ -1166,7 +1166,7 @@
 
 			/*
 			 * receive control messages only. Process the
-			 * exceptions (currently the only possiblity is
+			 * exceptions (currently the only possibility is
 			 * a path MTU notification.)
 			 */
 			if ((mtu = get_pathmtu(&m)) > 0) {
@@ -1812,7 +1812,7 @@
 	struct ip6_hbh *ext;
 	int currentlen;
 	u_int8_t type;
-	socklen_t extlen, len, origextlen;
+	socklen_t extlen, len;
 	void *databuf;
 	size_t offset;
 	u_int16_t value2;
@@ -1828,7 +1828,6 @@
 	 *     subtract the size of a cmsg structure from the buffer size.
 	 */
 	if (bufsize < (extlen  + CMSG_SPACE(0))) {
-		origextlen = extlen;
 		extlen = bufsize - CMSG_SPACE(0);
 		warnx("options truncated, showing only %u (total=%u)",
 		    (unsigned int)(extlen / 8 - 1),
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/reboot/nextboot.8
--- a/head/sbin/reboot/nextboot.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/reboot/nextboot.8	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/sbin/reboot/nextboot.8 229778 2012-01-07 16:09:33Z uqs $
 .\"
 .Dd November 4, 2002
 .Dt NEXTBOOT 8
@@ -117,7 +117,7 @@
 .Nm
 code is implemented in the
 .Xr loader 8 .
-It is not the most throughly tested code.
+It is not the most thoroughly tested code.
 It is also my first attempt to write in Forth.
 .Pp
 Finally, it does some evil things like writing to the file system before it
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/recoverdisk/recoverdisk.1
--- a/head/sbin/recoverdisk/recoverdisk.1	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/recoverdisk/recoverdisk.1	Fri Jan 13 15:51:01 2012 +0200
@@ -22,9 +22,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/sbin/recoverdisk/recoverdisk.1 221304 2011-05-01 20:14:10Z uqs $
+.\" $FreeBSD: head/sbin/recoverdisk/recoverdisk.1 229697 2012-01-06 11:42:03Z uqs $
 .\"
-.Dd May 1, 2011
+.Dd January 5, 2012
 .Dt RECOVERDISK 1
 .Os
 .Sh NAME
@@ -124,7 +124,11 @@
 
 .Ed
 .Sh SEE ALSO
-.Xr dd 1
+.Xr dd 1 ,
+.Xr ada 4,
+.Xr cam 4,
+.Xr cd 4,
+.Xr da 4
 .Sh HISTORY
 The
 .Nm
@@ -149,6 +153,18 @@
 This is harmless and can be avoided by setting
 .Fl b
 to no more than 128kB.
+.Pp
+.Nm
+needs to know about read errors as fast as possible, i.e. retries by lower
+layers will usually slow down the operation.
+When using
+.Xr cam 4
+attached drives, you may want to set kern.cam.XX.retry_count to zero, e.g.:
+.Bd -literal
+# sysctl kern.cam.ada.retry_count=0
+# sysctl kern.cam.cd.retry_count=0
+# sysctl kern.cam.da.retry_count=0
+.Ed
 .\".Pp
 .\"When reading from optical media, a bug in the GEOM framework will
 .\"prevent it from seeing that the media has been removed.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/route/route.c
--- a/head/sbin/route/route.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/route/route.c	Fri Jan 13 15:51:01 2012 +0200
@@ -40,7 +40,7 @@
 #endif /* not lint */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: head/sbin/route/route.c 229766 2012-01-07 09:01:19Z ume $");
 
 #include <sys/param.h>
 #include <sys/file.h>
@@ -375,7 +375,8 @@
 #ifdef __KAME__
 		if (sa->sa_len == sizeof(struct sockaddr_in6) &&
 		    (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr) ||
-		     IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr)) &&
+		     IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr) ||
+		     IN6_IS_ADDR_MC_NODELOCAL(&sin6.sin6_addr)) &&
 		    sin6.sin6_scope_id == 0) {
 			sin6.sin6_scope_id =
 			    ntohs(*(u_int16_t *)&sin6.sin6_addr.s6_addr[2]);
@@ -500,7 +501,8 @@
 #ifdef __KAME__
 		if (sa->sa_len == sizeof(struct sockaddr_in6) &&
 		    (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr) ||
-		     IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr)) &&
+		     IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr) ||
+		     IN6_IS_ADDR_MC_NODELOCAL(&sin6.sin6_addr)) &&
 		    sin6.sin6_scope_id == 0) {
 			sin6.sin6_scope_id =
 			    ntohs(*(u_int16_t *)&sin6.sin6_addr.s6_addr[2]);
@@ -1002,7 +1004,8 @@
 		memcpy(&su->sin6, res->ai_addr, sizeof(su->sin6));
 #ifdef __KAME__
 		if ((IN6_IS_ADDR_LINKLOCAL(&su->sin6.sin6_addr) ||
-		     IN6_IS_ADDR_MC_LINKLOCAL(&su->sin6.sin6_addr)) &&
+		     IN6_IS_ADDR_MC_LINKLOCAL(&su->sin6.sin6_addr) ||
+		     IN6_IS_ADDR_MC_NODELOCAL(&su->sin6.sin6_addr)) &&
 		    su->sin6.sin6_scope_id) {
 			*(u_int16_t *)&su->sin6.sin6_addr.s6_addr[2] =
 				htons(su->sin6.sin6_scope_id);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/routed/main.c
--- a/head/sbin/routed/main.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/routed/main.c	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/sbin/routed/main.c 229778 2012-01-07 16:09:33Z uqs $
  */
 
 #include "defs.h"
@@ -45,7 +45,7 @@
 __RCSID("$NetBSD$");
 #include <util.h>
 #elif defined(__FreeBSD__)
-__RCSID("$FreeBSD$");
+__RCSID("$FreeBSD: head/sbin/routed/main.c 229778 2012-01-07 16:09:33Z uqs $");
 #else
 __RCSID("$Revision: 2.31 $");
 #ident "$Revision: 2.31 $"
@@ -414,7 +414,7 @@
 			continue;
 		}
 
-		/* Check the kernel table occassionally for mysteriously
+		/* Check the kernel table occasionally for mysteriously
 		 * evaporated routes
 		 */
 		timevalsub(&t2, &flush_kern_timer, &now);
@@ -446,7 +446,7 @@
 				 * the previous update was finished.
 				 * Even if we just started after discovering
 				 * a 2nd interface or were otherwise delayed,
-				 * pick a 30-second aniversary of the
+				 * pick a 30-second anniversary of the
 				 * original broadcast time.
 				 */
 				n = 1 + (0-t2.tv_sec)/SUPPLY_INTERVAL;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/routed/radix.c
--- a/head/sbin/routed/radix.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/routed/radix.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  *
  *	@(#)radix.c	8.4 (Berkeley) 11/2/94
  *
- * $FreeBSD$
+ * $FreeBSD: head/sbin/routed/radix.c 229778 2012-01-07 16:09:33Z uqs $
  */
 
 /*
@@ -40,7 +40,7 @@
 #ifdef __NetBSD__
 __RCSID("$NetBSD$");
 #elif defined(__FreeBSD__)
-__RCSID("$FreeBSD$");
+__RCSID("$FreeBSD: head/sbin/routed/radix.c 229778 2012-01-07 16:09:33Z uqs $");
 #else
 __RCSID("$Revision: 2.23 $");
 #ident "$Revision: 2.23 $"
@@ -97,7 +97,7 @@
  * node as high in the tree as we can go.
  *
  * The present version of the code makes use of normal routes in short-
- * circuiting an explict mask and compare operation when testing whether
+ * circuiting an explicit mask and compare operation when testing whether
  * a key satisfies a normal route, and also in remembering the unique leaf
  * that governs a subtree.
  */
@@ -247,7 +247,7 @@
 	 *
 	 * In this case, we have a complete match of the key.  Unless
 	 * the node is one of the roots, we are finished.
-	 * If it is the zeros root, then take what we have, prefering
+	 * If it is the zeros root, then take what we have, preferring
 	 * any real data.
 	 * If it is the ones root, then pretend the target key was followed
 	 * by a byte of zeros.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/routed/table.c
--- a/head/sbin/routed/table.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/routed/table.c	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD$
+ * $FreeBSD: head/sbin/routed/table.c 229778 2012-01-07 16:09:33Z uqs $
  */
 
 #include "defs.h"
@@ -34,7 +34,7 @@
 #ifdef __NetBSD__
 __RCSID("$NetBSD$");
 #elif defined(__FreeBSD__)
-__RCSID("$FreeBSD$");
+__RCSID("$FreeBSD: head/sbin/routed/table.c 229778 2012-01-07 16:09:33Z uqs $");
 #else
 __RCSID("$Revision: 2.27 $");
 #ident "$Revision: 2.27 $"
@@ -2071,7 +2071,7 @@
 	/* try to switch to an alternative */
 	rtswitch(RT, 0);
 
-	/* Delete a dead route after it has been publically mourned. */
+	/* Delete a dead route after it has been publicly mourned. */
 	if (now_garbage > RT->rt_time) {
 		rtdelete(RT);
 		return 0;
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sbin/tunefs/tunefs.c
--- a/head/sbin/tunefs/tunefs.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sbin/tunefs/tunefs.c	Fri Jan 13 15:51:01 2012 +0200
@@ -39,7 +39,7 @@
 #endif /* not lint */
 #endif
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sbin/tunefs/tunefs.c 227081 2011-11-04 13:36:02Z ed $");
+__FBSDID("$FreeBSD: head/sbin/tunefs/tunefs.c 229911 2012-01-10 02:58:52Z eadler $");
 
 /*
  * tunefs: change layout parameters to an existing file system.
@@ -90,7 +90,7 @@
 	int Aflag, aflag, eflag, evalue, fflag, fvalue, jflag, Jflag, Lflag;
 	int lflag, mflag, mvalue, Nflag, nflag, oflag, ovalue, pflag, sflag;
 	int tflag;
-	int svalue, Sflag, Svalue;
+	int svalue, Svalue;
 	int ch, found_arg, i;
 	const char *chg[2];
 	struct ufs_args args;
@@ -269,7 +269,6 @@
 			if (Svalue < SUJ_MIN)
 				errx(10, "%s must be >= %d (was %s)",
 				    name, SUJ_MIN, optarg);
-			Sflag = 1;
 			break;
 
 		case 't':
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/examples/diskless/README.TEMPLATING
--- a/head/share/examples/diskless/README.TEMPLATING	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/examples/diskless/README.TEMPLATING	Fri Jan 13 15:51:01 2012 +0200
@@ -11,7 +11,7 @@
 and the /usr/share/examples/diskless/clone_root script which can
 be useful to set up clients and server for diskless boot.
 
---- $FreeBSD: head/share/examples/diskless/README.TEMPLATING 222179 2011-05-22 14:23:48Z uqs $ ---
+--- $FreeBSD: head/share/examples/diskless/README.TEMPLATING 229831 2012-01-09 00:48:19Z eadler $ ---
 ------------------------------------------------------------------------
 
 		      TEMPLATING machine configurations
@@ -94,8 +94,8 @@
 	/usr/ports	( note 5 )
 	/usr/src	( note 5 )
 	/usr/local/crack ( note 5 )
-	/usr/X11R6/lib/X11/xdm/xdm-errors ( note 6 )
-	/usr/X11R6/lib/X11/xdm/xdm-pid 	  ( note 6 )
+	/usr/local/lib/X11/xdm/xdm-errors ( note 6 )
+	/usr/local/lib/X11/xdm/xdm-pid 	  ( note 6 )
 	/usr/local/etc/ssh_host_key	  ( note 6 )
 	/usr/local/etc/ssh_host_key.pub	  ( note 6 )
 	/usr/local/etc/ssh_random_seed	  ( note 6 )
@@ -120,7 +120,7 @@
 		do not want to template such directories.
 
 	note 6: Note that you can solve the problem of xdm and sshd creating
-		files in /usr.  With xdm, edit /usr/X11R6/lib/xdm/xdm-config
+		files in /usr.  With xdm, edit /usr/local/lib/xdm/xdm-config
 		and change the errorLogFile and pidFile config lines.
 
 		With sshd, add 'HostKey' and 'RandomSeed' directives to specify
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/examples/ppp/ppp.linkdown.sample
--- a/head/share/examples/ppp/ppp.linkdown.sample	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/examples/ppp/ppp.linkdown.sample	Fri Jan 13 15:51:01 2012 +0200
@@ -12,7 +12,7 @@
 #  3) If no label has been found, use MYADDR if it exists.
 #
 #
-# $FreeBSD$
+# $FreeBSD: head/share/examples/ppp/ppp.linkdown.sample 229831 2012-01-09 00:48:19Z eadler $
 #
 #########################################################################
 
@@ -23,7 +23,7 @@
 # ``auplay'' (assuming NAS is installed and configured).
 #
 MYADDR:
- !bg /usr/X11R6/bin/auplay /etc/ppp/linkdown.au
+ !bg /usr/local/bin/auplay /etc/ppp/linkdown.au
 
 # If you're running ``ppp -auto -nat dynamic-nat-auto'', and are
 # assigned a dynamic IP number by the peer, this may be worth while
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/examples/printing/hpvf
--- a/head/share/examples/printing/hpvf	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/examples/printing/hpvf	Fri Jan 13 15:51:01 2012 +0200
@@ -1,10 +1,10 @@
 #!/bin/sh
 #
+# $FreeBSD: head/share/examples/printing/hpvf 229831 2012-01-09 00:48:19Z eadler $
+#
 #  hpvf - Convert GIF files into HP/PCL, then print
 #  Installed in /usr/local/libexec/hpvf
 
-PATH=/usr/X11R6/bin:$PATH; export PATH
-
 giftopnm | ppmtopgm | pgmtopbm | pbmtolj -resolution 300 \
     && exit 0 \
     || exit 2
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/examples/scsi_target/scsi_cmds.c
--- a/head/share/examples/scsi_target/scsi_cmds.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/examples/scsi_target/scsi_cmds.c	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/share/examples/scsi_target/scsi_cmds.c 228462 2011-12-13 11:13:28Z mav $
+ * $FreeBSD: head/share/examples/scsi_target/scsi_cmds.c 229997 2012-01-12 00:34:33Z ken $
  */
 
 #include <stdio.h>
@@ -328,7 +328,7 @@
 		bcopy(&inq_data, ctio->data_ptr, sizeof(inq_data));
 		ctio->dxfer_len = inq_data.additional_length + 4;
 		ctio->dxfer_len = min(ctio->dxfer_len,
-				      SCSI_CDB6_LEN(inq->length));
+				      scsi_2btoul(inq->length));
 		ctio->ccb_h.flags |= CAM_DIR_IN | CAM_SEND_STATUS;
 		ctio->scsi_status = SCSI_STATUS_OK;
 	}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man3/ATOMIC_VAR_INIT.3
--- a/head/share/man/man3/ATOMIC_VAR_INIT.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man3/ATOMIC_VAR_INIT.3	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/share/man/man3/ATOMIC_VAR_INIT.3 228920 2011-12-27 22:14:35Z ed $
+.\" $FreeBSD: head/share/man/man3/ATOMIC_VAR_INIT.3 229651 2012-01-05 21:36:12Z uqs $
 .\"
 .Dd December 27, 2011
 .Dt ATOMIC_VAR_INIT 3
@@ -274,7 +274,7 @@
 .Dv memory_order_seq_cst .
 .Pp
 Instead of using the atomic operations provided by this interface,
-.St -isoC-11
+.St -isoC-2011
 allows the atomic variables to be modified directly using built-in
 language operators.
 This behaviour cannot be emulated for older compilers.
@@ -292,7 +292,7 @@
 .Xr atomic 9
 .Sh STANDARDS
 These macros attempt to conform to
-.St -isoC-11 .
+.St -isoC-2011 .
 .Sh HISTORY
 These macros appeared in
 .Fx 10.0 .
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man3/tgmath.3
--- a/head/share/man/man3/tgmath.3	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man3/tgmath.3	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/share/man/man3/tgmath.3 229575 2012-01-05 10:46:22Z ed $
+.\" $FreeBSD: head/share/man/man3/tgmath.3 229651 2012-01-05 21:36:12Z uqs $
 .\"
 .Dd January 4, 2012
 .Dt TGMATH 3
@@ -141,13 +141,13 @@
 .Fx 5.3 .
 .Sh COMPILER SUPPORT
 Before
-.St -isoC-11 ,
+.St -isoC-2011 ,
 the header
 .In tgmath.h
 could not be implemented with strictly conforming C code and needed
 special compiler support.
 As of
-.St -isoC-11 ,
+.St -isoC-2011 ,
 this header file can be implemented using the
 .Fn _Generic
 language keyword.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man4/apic.4
--- a/head/share/man/man4/apic.4	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man4/apic.4	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/share/man/man4/apic.4 228739 2011-12-20 15:19:33Z mav $
+.\" $FreeBSD: head/share/man/man4/apic.4 229657 2012-01-05 21:43:33Z uqs $
 .\"
 .Dd December 20, 2011
 .Dt APIC 4
@@ -61,7 +61,7 @@
 I/O APICs contain a redirection table, which is used to route the interrupts
 they receive from peripheral buses to one or more local APICs.
 .Pp
-Each local APIC includes one 32-bit programable timer.
+Each local APIC includes one 32-bit programmable timer.
 This driver uses them to supply kernel with one event timer named "LAPIC".
 Event timer provided by the driver supports both one-shot an periodic modes.
 Because of local APIC nature it is per-CPU.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man4/bce.4
--- a/head/share/man/man4/bce.4	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man4/bce.4	Fri Jan 13 15:51:01 2012 +0200
@@ -26,7 +26,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/share/man/man4/bce.4 229585 2012-01-05 11:16:42Z brueffer $
 .\"
 .Dd October 7, 2009
 .Dt BCE 4
@@ -251,7 +251,7 @@
 .It "bce%d: Could not allocate status block DMA memory!"
 The driver could not allocate DMA addressable memory for the controller's
 status block.
-.It "bce_d: Could not map status block DMA memory!"
+.It "bce%d: Could not map status block DMA memory!"
 The driver could not map the status block memory into the controller's DMA
 address space.
 .It "bce%d: Could not allocate statistics block DMA tag!"
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man4/carp.4
--- a/head/share/man/man4/carp.4	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man4/carp.4	Fri Jan 13 15:51:01 2012 +0200
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/share/man/man4/carp.4 228736 2011-12-20 13:53:31Z glebius $
+.\" $FreeBSD: head/share/man/man4/carp.4 229657 2012-01-05 21:43:33Z uqs $
 .\"
 .Dd December 20, 2011
 .Dt CARP 4
@@ -193,7 +193,7 @@
 hooks.
 Master/slave events are signalled under system
 .Dv CARP .
-Subsystem specifies vhid and name of interface, where event occured.
+Subsystem specifies vhid and name of interface, where event occurred.
 Type of the message displays new state of vhid.
 Please see
 .Xr devd.conf 5
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man4/ng_ksocket.4
--- a/head/share/man/man4/ng_ksocket.4	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man4/ng_ksocket.4	Fri Jan 13 15:51:01 2012 +0200
@@ -32,9 +32,9 @@
 .\"
 .\" Author: Archie Cobbs <archie at FreeBSD.org>
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/share/man/man4/ng_ksocket.4 229930 2012-01-10 12:45:24Z melifaro $
 .\"
-.Dd October 28, 2005
+.Dd January 09, 2012
 .Dt NG_KSOCKET 4
 .Os
 .Sh NAME
@@ -199,7 +199,7 @@
 the address is the pathname as a doubly quoted string.
 .Pp
 Examples:
-.Bl -tag -width XXXXXXXXXX
+.Bl -tag -width "PF_LOCAL"
 .It Dv PF_LOCAL
 local/"/tmp/foo.socket"
 .It Dv PF_INET
@@ -215,6 +215,12 @@
 form for that structure is used.
 In the future, more
 convenient encoding of the more common socket options may be supported.
+.Pp
+Setting socket options example:
+.Bl -tag -width "PF_LOCAL"
+.It Set FIB 2 for a socket (SOL_SOCKET, SO_SETFIB):
+.Dv "setopt \&{ level=0xffff name=0x1014 data=[ 2 ] \&}"
+.El
 .Sh SHUTDOWN
 This node shuts down upon receipt of a
 .Dv NGM_SHUTDOWN
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man5/ar.5
--- a/head/share/man/man5/ar.5	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man5/ar.5	Fri Jan 13 15:51:01 2012 +0200
@@ -21,7 +21,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/share/man/man5/ar.5 221594 2011-05-07 10:44:08Z kaiw $
+.\" $FreeBSD: head/share/man/man5/ar.5 229657 2012-01-05 21:43:33Z uqs $
 .\"
 .Dd November 28, 2010
 .Os
@@ -126,7 +126,7 @@
 names for members.
 .Bl -tag -width "SVR4/GNU"
 .It "BSD"
-File names that are upto 16 bytes long and which do not contain
+File names that are up to 16 bytes long and which do not contain
 embedded spaces are stored directly in the
 .Ar ar_name
 field of the archive header.
@@ -164,7 +164,7 @@
 .Dq "A BC D"
 .Pc .
 .It "SVR4/GNU"
-File names that are upto 15 characters long are stored directly in the
+File names that are up to 15 characters long are stored directly in the
 .Ar ar_name
 field of the header, terminated by a
 .Dq Li /
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/man/man8/rc.subr.8
--- a/head/share/man/man8/rc.subr.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/man/man8/rc.subr.8	Fri Jan 13 15:51:01 2012 +0200
@@ -27,7 +27,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $FreeBSD$
+.\" $FreeBSD: head/share/man/man8/rc.subr.8 230007 2012-01-12 06:48:11Z rea $
 .\"
 .Dd May 18, 2007
 .Dt RC.SUBR 8
@@ -339,7 +339,7 @@
 being the list of valid arguments
 prefixed by
 .Sm off
-.Dq Bq Li fast | force | one .
+.Dq Bq Li fast | force | one | quiet .
 .Sm on
 .It Ic reverse_list Ar item ...
 Print the list of
@@ -427,6 +427,22 @@
 being set to
 .Dq Li YES ,
 but performs all the other prerequisite tests.
+.It Li quiet
+Inhibits some verbose diagnostics.
+Currently, this includes messages
+.Qq Starting ${name}
+(as checked by
+.Ic check_startmsgs
+inside
+.Nm )
+and errors about usage of services that are not enabled in
+.Xr rc.conf 5 .
+This prefix also sets
+.Va rc_quiet Ns = Ns Li YES .
+.Em Please, note:
+.Va rc_quiet
+is not intended to completely mask all debug and warning messages,
+but only certain small classes of them.
 .El
 .Pp
 .Ic run_rc_command
diff -r ebe87ce4d7dd -r 1750de5b0399 head/share/mk/bsd.crunchgen.mk
--- a/head/share/mk/bsd.crunchgen.mk	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/share/mk/bsd.crunchgen.mk	Fri Jan 13 15:51:01 2012 +0200
@@ -22,8 +22,10 @@
 # Specific links can be suppressed by setting
 # CRUNCH_SUPPRESS_LINK_$(NAME) to 1.
 #
+# If CRUNCH_GENERATE_LINKS is set to no, no links will be generated.
+#
 
-# $FreeBSD$
+# $FreeBSD: head/share/mk/bsd.crunchgen.mk 229658 2012-01-05 21:49:43Z adrian $
 
 ##################################################################
 #  The following is pretty nearly a generic crunchgen-handling makefile
@@ -39,6 +41,7 @@
 .else
 CANONICALOBJDIR:= /usr/obj${.CURDIR}
 .endif
+CRUNCH_GENERATE_LINKS?=	yes
 
 CLEANFILES+= $(CONF) *.o *.lo *.c *.mk *.cache *.a *.h
 
@@ -51,6 +54,7 @@
 .else
 $(OUTPUTS): $(.CURDIR)/../../$(D)/$(P)/Makefile
 .endif
+.if ${CRUNCH_GENERATE_LINKS} == "yes"
 .ifndef CRUNCH_SUPPRESS_LINK_${P}
 LINKS+= $(BINDIR)/$(PROG) $(BINDIR)/$(P)
 .endif
@@ -59,6 +63,7 @@
 LINKS+= $(BINDIR)/$(PROG) $(BINDIR)/$(A)
 .endif
 .endfor
+.endif
 .endfor
 .endfor
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/amd64/conf/GENERIC
--- a/head/sys/amd64/conf/GENERIC	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/amd64/conf/GENERIC	Fri Jan 13 15:51:01 2012 +0200
@@ -16,7 +16,7 @@
 # If you are in doubt as to the purpose or necessity of a line, check first
 # in NOTES.
 #
-# $FreeBSD: head/sys/amd64/conf/GENERIC 228973 2011-12-29 22:48:36Z rwatson $
+# $FreeBSD: head/sys/amd64/conf/GENERIC 229997 2012-01-12 00:34:33Z ken $
 
 cpu		HAMMER
 ident		GENERIC
@@ -131,7 +131,8 @@
 device		sa		# Sequential Access (tape etc)
 device		cd		# CD
 device		pass		# Passthrough device (direct ATA/SCSI access)
-device		ses		# SCSI Environmental Services (and SAF-TE)
+device		ses		# Enclosure Services (SES and SAF-TE)
+device		ctl		# CAM Target Layer
 
 # RAID controllers interfaced to the SCSI subsystem
 device		amr		# AMI MegaRAID
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/arm/conf/KB920X
--- a/head/sys/arm/conf/KB920X	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/arm/conf/KB920X	Fri Jan 13 15:51:01 2012 +0200
@@ -16,7 +16,7 @@
 # If you are in doubt as to the purpose or necessity of a line, check first 
 # in NOTES.
 #
-# $FreeBSD: head/sys/arm/conf/KB920X 225482 2011-09-11 17:39:51Z brueffer $
+# $FreeBSD: head/sys/arm/conf/KB920X 229639 2012-01-05 20:18:01Z adrian $
 
 ident		KB920X
 
@@ -138,3 +138,6 @@
 device		wlan_ccmp	# 802.11 CCMP support
 device		wlan_tkip	# 802.11 TKIP support
 device		wlan_amrr	# AMRR transmit rate control algorithm
+options		IEEE80211_SUPPORT_MESH
+
+options		AH_SUPPORT_AR5416
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/boot/common/loader.8
--- a/head/sys/boot/common/loader.8	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/boot/common/loader.8	Fri Jan 13 15:51:01 2012 +0200
@@ -22,9 +22,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $FreeBSD: head/sys/boot/common/loader.8 228916 2011-12-27 15:59:51Z pluknet $
+.\" $FreeBSD: head/sys/boot/common/loader.8 229771 2012-01-07 11:16:23Z kib $
 .\"
-.Dd December 27, 2011
+.Dd January 7, 2012
 .Dt LOADER 8
 .Os
 .Sh NAME
@@ -419,6 +419,43 @@
 Changes to the
 .Va comconsole_speed
 variable take effect immediately.
+.It Va comconsole_port
+Defines the base i/o port used to access console UART
+(i386 and amd64 only).
+If the variable is not set, its assumed value is 0x3F8, which
+corresponds to PC port COM1, unless overriden by
+.Va BOOT_COMCONSOLE_PORT
+variable during the compilation of
+.Nm .
+Setting the
+.Va comconsole_port
+variable automatically set
+.Va hw.uart.console
+environment variable to provide a hint to kernel for location of the console.
+Loader console is changed immediately after variable
+.Va comconsole_port
+is set.
+.It Va comconsole_pcidev
+Defines the location of a PCI device of the 'simple communication'
+class to be used as the serial console UART (i386 and amd64 only).
+The syntax of the variable is
+.Li 'bus:device:function[:bar]' ,
+where all members must be numeric, with possible
+.Li 0x
+prefix to indicate a hexadecimal value.
+The
+.Va bar
+member is optional and assumed to be 0x10 if omitted.
+The bar must decode i/o space.
+Setting the variable
+.Va comconsole_pcidev
+automatically sets the variable
+.Va comconsole_port
+to the base of the selected bar, and hint
+.Va hw.uart.console .
+Loader console is changed immediately after variable
+.Va comconsole_pcidev
+is set.
 .It Va console
 Defines the current console or consoles.
 Multiple consoles may be specified.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/boot/forth/loader.4th
--- a/head/sys/boot/forth/loader.4th	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/boot/forth/loader.4th	Fri Jan 13 15:51:01 2012 +0200
@@ -22,7 +22,7 @@
 \ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 \ SUCH DAMAGE.
 \
-\ $FreeBSD: head/sys/boot/forth/loader.4th 228985 2011-12-30 06:24:59Z pluknet $
+\ $FreeBSD: head/sys/boot/forth/loader.4th 229881 2012-01-09 20:25:14Z pluknet $
 
 s" arch-i386" environment? [if] [if]
 	s" loader_version" environment?  [if]
@@ -44,9 +44,20 @@
 only forth also support-functions also builtins definitions
 
 : try-menu-unset
+  \ menu-unset may not be present
+  s" beastie_disable" getenv
+  dup -1 <> if
+    s" YES" compare-insensitive 0= if
+      exit
+    then
+  else
+    drop
+  then
   s" menu-unset"
-  ['] evaluate catch if
-    2drop
+  sfind if
+    execute
+  else
+    drop
   then
 ;
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/cam_periph.c
--- a/head/sys/cam/cam_periph.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/cam/cam_periph.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/cam/cam_periph.c 227293 2011-11-07 06:44:47Z ed $");
+__FBSDID("$FreeBSD: head/sys/cam/cam_periph.c 230000 2012-01-12 00:41:48Z ken $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -171,14 +171,16 @@
 			return (CAM_REQ_INPROG);
 		} else {
 			printf("cam_periph_alloc: attempt to re-allocate "
-			       "valid device %s%d rejected\n",
-			       periph->periph_name, periph->unit_number);
+			       "valid device %s%d rejected flags %#x "
+			       "refcount %d\n", periph->periph_name,
+			       periph->unit_number, periph->flags,
+			       periph->refcount);
 		}
 		return (CAM_REQ_INVALID);
 	}
 	
 	periph = (struct cam_periph *)malloc(sizeof(*periph), M_CAMPERIPH,
-					     M_NOWAIT);
+					     M_NOWAIT|M_ZERO);
 
 	if (periph == NULL)
 		return (CAM_RESRC_UNAVAIL);
@@ -190,7 +192,6 @@
 	path_id = xpt_path_path_id(path);
 	target_id = xpt_path_target_id(path);
 	lun_id = xpt_path_lun_id(path);
-	bzero(periph, sizeof(*periph));
 	cam_init_pinfo(&periph->pinfo);
 	periph->periph_start = periph_start;
 	periph->periph_dtor = periph_dtor;
@@ -305,17 +306,20 @@
 }
 
 /*
- * Find a peripheral structure with the specified path, target, lun, 
- * and (optionally) type.  If the name is NULL, this function will return
- * the first peripheral driver that matches the specified path.
+ * Find peripheral driver instances attached to the specified path.
  */
 int
 cam_periph_list(struct cam_path *path, struct sbuf *sb)
 {
+	struct sbuf local_sb;
 	struct periph_driver **p_drv;
 	struct cam_periph *periph;
 	int count;
+	int sbuf_alloc_len;
 
+	sbuf_alloc_len = 16;
+retry:
+	sbuf_new(&local_sb, NULL, sbuf_alloc_len, SBUF_FIXEDLEN);
 	count = 0;
 	xpt_lock_buses();
 	for (p_drv = periph_drivers; *p_drv != NULL; p_drv++) {
@@ -324,30 +328,60 @@
 			if (xpt_path_comp(periph->path, path) != 0)
 				continue;
 
-			if (sbuf_len(sb) != 0)
-				sbuf_cat(sb, ",");
+			if (sbuf_len(&local_sb) != 0)
+				sbuf_cat(&local_sb, ",");
 
-			sbuf_printf(sb, "%s%d", periph->periph_name,
+			sbuf_printf(&local_sb, "%s%d", periph->periph_name,
 				    periph->unit_number);
+
+			if (sbuf_error(&local_sb) == ENOMEM) {
+				sbuf_alloc_len *= 2;
+				xpt_unlock_buses();
+				sbuf_delete(&local_sb);
+				goto retry;
+			}
 			count++;
 		}
 	}
 	xpt_unlock_buses();
+	sbuf_finish(&local_sb);
+	sbuf_cpy(sb, sbuf_data(&local_sb));
+	sbuf_delete(&local_sb);
 	return (count);
 }
 
 cam_status
 cam_periph_acquire(struct cam_periph *periph)
 {
+	cam_status status;
 
+	status = CAM_REQ_CMP_ERR;
 	if (periph == NULL)
-		return(CAM_REQ_CMP_ERR);
+		return (status);
 
 	xpt_lock_buses();
-	periph->refcount++;
+	if ((periph->flags & CAM_PERIPH_INVALID) == 0) {
+		periph->refcount++;
+		status = CAM_REQ_CMP;
+	}
 	xpt_unlock_buses();
 
-	return(CAM_REQ_CMP);
+	return (status);
+}
+
+void
+cam_periph_release_locked_buses(struct cam_periph *periph)
+{
+	if (periph->refcount != 0) {
+		periph->refcount--;
+	} else {
+		panic("%s: release of %p when refcount is zero\n ", __func__,
+		      periph);
+	}
+	if (periph->refcount == 0
+	    && (periph->flags & CAM_PERIPH_INVALID)) {
+		camperiphfree(periph);
+	}
 }
 
 void
@@ -358,15 +392,7 @@
 		return;
 
 	xpt_lock_buses();
-	if (periph->refcount != 0) {
-		periph->refcount--;
-	} else {
-		xpt_print(periph->path, "%s: release %p when refcount is zero\n ", __func__, periph);
-	}
-	if (periph->refcount == 0
-	    && (periph->flags & CAM_PERIPH_INVALID)) {
-		camperiphfree(periph);
-	}
+	cam_periph_release_locked_buses(periph);
 	xpt_unlock_buses();
 }
 
@@ -1812,9 +1838,6 @@
 		error = EIO;
 		break;
 	case CAM_SEL_TIMEOUT:
-	{
-		struct cam_path *newpath;
-
 		if ((camflags & CAM_RETRY_SELTO) != 0) {
 			if (ccb->ccb_h.retry_count > 0 &&
 			    (periph->flags & CAM_PERIPH_INVALID) == 0) {
@@ -1837,6 +1860,11 @@
 			}
 			action_string = "Retries exhausted";
 		}
+		/* FALLTHROUGH */
+	case CAM_DEV_NOT_THERE:
+	{
+		struct cam_path *newpath;
+
 		error = ENXIO;
 		/* Should we do more if we can't create the path?? */
 		if (xpt_create_path(&newpath, periph,
@@ -1855,7 +1883,6 @@
 	}
 	case CAM_REQ_INVALID:
 	case CAM_PATH_INVALID:
-	case CAM_DEV_NOT_THERE:
 	case CAM_NO_HBA:
 	case CAM_PROVIDE_FAIL:
 	case CAM_REQ_TOO_BIG:
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/cam_periph.h
--- a/head/sys/cam/cam_periph.h	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/cam/cam_periph.h	Fri Jan 13 15:51:01 2012 +0200
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: head/sys/cam/cam_periph.h 223081 2011-06-14 14:53:17Z gibbs $
+ * $FreeBSD: head/sys/cam/cam_periph.h 230000 2012-01-12 00:41:48Z ken $
  */
 
 #ifndef _CAM_CAM_PERIPH_H
@@ -119,6 +119,7 @@
 #define CAM_PERIPH_NEW_DEV_FOUND	0x10
 #define CAM_PERIPH_RECOVERY_INPROG	0x20
 #define CAM_PERIPH_SENSE_INPROG		0x40
+#define CAM_PERIPH_FREE			0x80
 	u_int32_t		 immediate_priority;
 	u_int32_t		 refcount;
 	SLIST_HEAD(, ccb_hdr)	 ccb_list;	/* For "immediate" requests */
@@ -146,6 +147,7 @@
 cam_status	cam_periph_acquire(struct cam_periph *periph);
 void		cam_periph_release(struct cam_periph *periph);
 void		cam_periph_release_locked(struct cam_periph *periph);
+void		cam_periph_release_locked_buses(struct cam_periph *periph);
 int		cam_periph_hold(struct cam_periph *periph, int priority);
 void		cam_periph_unhold(struct cam_periph *periph);
 void		cam_periph_invalidate(struct cam_periph *periph);
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/cam_xpt.c
--- a/head/sys/cam/cam_xpt.c	Fri Jan 13 00:58:58 2012 +0200
+++ b/head/sys/cam/cam_xpt.c	Fri Jan 13 15:51:01 2012 +0200
@@ -28,7 +28,7 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/cam/cam_xpt.c 228027 2011-11-27 16:22:19Z marius $");
+__FBSDID("$FreeBSD: head/sys/cam/cam_xpt.c 230000 2012-01-12 00:41:48Z ken $");
 
 #include <sys/param.h>
 #include <sys/bus.h>
@@ -2026,12 +2026,24 @@
 	for (bus = (start_bus ? start_bus : TAILQ_FIRST(&xsoftc.xpt_busses));
 	     bus != NULL;
 	     bus = next_bus) {
-		next_bus = TAILQ_NEXT(bus, links);
-
+
+		bus->refcount++;
+
+		/*
+		 * XXX The locking here is obviously very complex.  We
+		 * should work to simplify it.
+		 */
 		mtx_unlock(&xsoftc.xpt_topo_lock);
 		CAM_SIM_LOCK(bus->sim);
 		retval = tr_func(bus, arg);
 		CAM_SIM_UNLOCK(bus->sim);
+
+		mtx_lock(&xsoftc.xpt_topo_lock);
+		next_bus = TAILQ_NEXT(bus, links);
+		mtx_unlock(&xsoftc.xpt_topo_lock);
+
+		xpt_release_bus(bus);
+
 		if (retval == 0)
 			return(retval);
 		mtx_lock(&xsoftc.xpt_topo_lock);
@@ -2086,9 +2098,13 @@
 		       TAILQ_FIRST(&bus->et_entries));
 	     target != NULL; target = next_target) {
 
+		target->refcount++;
+
+		retval = tr_func(target, arg);
+
 		next_target = TAILQ_NEXT(target, links);
 
-		retval = tr_func(target, arg);
+		xpt_release_target(target);
 
 		if (retval == 0)
 			return(retval);
@@ -2110,9 +2126,21 @@
 	     device != NULL;
 	     device = next_device) {
 
+		/*
+		 * Hold a reference so the current device does not go away
+		 * on us.
+		 */
+		device->refcount++;
+
+		retval = tr_func(device, arg);
+
+		/*
+		 * Grab our next pointer before we release the current
+		 * device.
+		 */
 		next_device = TAILQ_NEXT(device, links);
 
-		retval = tr_func(device, arg);
+		xpt_release_device(device);
 
 		if (retval == 0)
 			return(retval);
@@ -2130,18 +2158,57 @@
 
 	retval = 1;
 
+	xpt_lock_buses();
 	for (periph = (start_periph ? start_periph :
 		       SLIST_FIRST(&device->periphs));
 	     periph != NULL;
 	     periph = next_periph) {
 
+
+		/*
+		 * In this case, we want to show peripherals that have been
+		 * invalidated, but not peripherals that are scheduled to
+		 * be freed.  So instead of calling cam_periph_acquire(),
+		 * which will fail if the periph has been invalidated, we
+		 * just check for the free flag here.  If it is free, we
+		 * skip to the next periph.
+		 */
+		if (periph->flags & CAM_PERIPH_FREE) {
+			next_periph = SLIST_NEXT(periph, periph_links);
+			continue;
+		}
+
+		/*
+		 * Acquire a reference to this periph while we call the
+		 * traversal function, so it can't go away.
+		 */
+		periph->refcount++;
+
+		xpt_unlock_buses();
+
+		retval = tr_func(periph, arg);
+
+		/*
+		 * We need the lock for list traversal.
+		 */
+		xpt_lock_buses();
+
+		/*
+		 * Grab the next peripheral before we release this one, so
+		 * our next pointer is still valid.
+		 */
 		next_periph = SLIST_NEXT(periph, periph_links);
 
-		retval = tr_func(periph, arg);
+		cam_periph_release_locked_buses(periph);
+
 		if (retval == 0)
-			return(retval);
+			goto bailout_done;
 	}
 
+bailout_done:
+
+	xpt_unlock_buses();
+
 	return(retval);
 }
 
@@ -2188,15 +2255,48 @@
 	     TAILQ_FIRST(&(*pdrv)->units)); periph != NULL;
 	     periph = next_periph) {
 
+
+		/*
+		 * In this case, we want to show peripherals that have been
+		 * invalidated, but not peripherals that are scheduled to
+		 * be freed.  So instead of calling cam_periph_acquire(),
+		 * which will fail if the periph has been invalidated, we
+		 * just check for the free flag here.  If it is free, we
+		 * skip to the next periph.
+		 */
+		if (periph->flags & CAM_PERIPH_FREE) {
+			next_periph = TAILQ_NEXT(periph, unit_links);
+			continue;
+		}
+
+		/*
+		 * Acquire a reference to this periph while we call the
+		 * traversal function, so it can't go away.
+		 */
+		periph->refcount++;
+
+		/*
+		 * XXX KDM we have the toplogy lock here, but in
+		 * xptperiphtraverse(), we drop it before calling the
+		 * traversal function.  Which is correct?
+		 */
+		retval = tr_func(periph, arg);
+
+		/*
+		 * Grab the next peripheral before we release this one, so
+		 * our next pointer is still valid.
+		 */
 		next_periph = TAILQ_NEXT(periph, unit_links);
 
-		retval = tr_func(periph, arg);
-		if (retval == 0) {
-			xpt_unlock_buses();
-			return(retval);
-		}
+		cam_periph_release_locked_buses(periph);
+
+		if (retval == 0)
+			goto bailout_done;
 	}
+bailout_done:
+
 	xpt_unlock_buses();
+
 	return(retval);
 }
 
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/README.ctl.txt
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/README.ctl.txt	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,449 @@
+/* $FreeBSD: head/sys/cam/ctl/README.ctl.txt 229997 2012-01-12 00:34:33Z ken $ */
+
+CTL - CAM Target Layer Description
+
+Revision 1.4 (December 29th, 2011)
+Ken Merry <ken at FreeBSD.org>
+
+Table of Contents:
+=================
+
+Introduction
+Features
+Configuring and Running CTL
+Revision 1.N Changes
+To Do List
+Code Roadmap
+Userland Commands
+
+Introduction:
+============
+
+CTL is a disk and processor device emulation subsystem originally written
+for Copan Systems under Linux starting in 2003.  It has been shipping in
+Copan (now SGI) products since 2005.
+
+It was ported to FreeBSD in 2008, and thanks to an agreement between SGI
+(who acquired Copan's assets in 2010) and Spectra Logic in 2010, CTL is
+available under a BSD-style license.  The intent behind the agreement was
+that Spectra would work to get CTL into the FreeBSD tree.
+
+Features:
+========
+
+ - Disk and processor device emulation.
+ - Tagged queueing
+ - SCSI task attribute support (ordered, head of queue, simple tags)
+ - SCSI implicit command ordering support.  (e.g. if a read follows a mode
+   select, the read will be blocked until the mode select completes.)
+ - Full task management support (abort, LUN reset, target reset, etc.)
+ - Support for multiple ports
+ - Support for multiple simultaneous initiators
+ - Support for multiple simultaneous backing stores
+ - Persistent reservation support
+ - Mode sense/select support
+ - Error injection support
+ - High Availability support (1)
+ - All I/O handled in-kernel, no userland context switch overhead.
+
+(1) HA Support is just an API stub, and needs much more to be fully
+    functional.  See the to-do list below.
+
+Configuring and Running CTL:
+===========================
+
+ - After applying the CTL patchset to your tree, build world and install it
+   on your target system.
+
+ - Add 'device ctl' to your kernel configuration file.
+
+ - If you're running with a 8Gb or 4Gb Qlogic FC board, add
+   'options ISP_TARGET_MODE' to your kernel config file.  Keep in mind that
+   the isp(4) driver can run in target or initiator mode, but not both on
+   the same machine.  'device ispfw' or loading the ispfw module is also
+   recommended.
+
+ - Rebuild and install a new kernel.
+
+ - Reboot with the new kernel.
+
+ - To add a LUN with the RAM disk backend:
+
+	ctladm create -b ramdisk -s 10485760000000000000
+	ctladm port -o on
+
+ - You should now see the CTL disk LUN through camcontrol devlist:
+
+scbus6 on ctl2cam0 bus 0:
+<FREEBSD CTLDISK 0001>             at scbus6 target 1 lun 0 (da24,pass32)
+<>                                 at scbus6 target -1 lun -1 ()
+
+   This is visible through the CTL CAM SIM.  This allows using CTL without
+   any physical hardware.  You should be able to issue any normal SCSI
+   commands to the device via the pass(4)/da(4) devices.
+
+   If any target-capable HBAs are in the system (e.g. isp(4)), and have
+   target mode enabled, you should now also be able to see the CTL LUNs via
+   that target interface.
+
+   Note that all CTL LUNs are presented to all frontends.  There is no
+   LUN masking, or separate, per-port configuration.
+
+ - Note that the ramdisk backend is a "fake" ramdisk.  That is, it is
+   backed by a small amount of RAM that is used for all I/O requests.  This
+   is useful for performance testing, but not for any data integrity tests.
+
+ - To add a LUN with the block/file backend:
+
+	truncate -s +1T myfile
+	ctladm create -b block -o file=myfile
+	ctladm port -o on
+
+ - You can also see a list of LUNs and their backends like this:
+
+# ctladm devlist
+LUN Backend       Size (Blocks)   BS Serial Number    Device ID       
+  0 block            2147483648  512 MYSERIAL   0     MYDEVID   0     
+  1 block            2147483648  512 MYSERIAL   1     MYDEVID   1     
+  2 block            2147483648  512 MYSERIAL   2     MYDEVID   2     
+  3 block            2147483648  512 MYSERIAL   3     MYDEVID   3     
+  4 block            2147483648  512 MYSERIAL   4     MYDEVID   4     
+  5 block            2147483648  512 MYSERIAL   5     MYDEVID   5     
+  6 block            2147483648  512 MYSERIAL   6     MYDEVID   6     
+  7 block            2147483648  512 MYSERIAL   7     MYDEVID   7     
+  8 block            2147483648  512 MYSERIAL   8     MYDEVID   8     
+  9 block            2147483648  512 MYSERIAL   9     MYDEVID   9     
+ 10 block            2147483648  512 MYSERIAL  10     MYDEVID  10     
+ 11 block            2147483648  512 MYSERIAL  11     MYDEVID  11    
+
+ - You can see the LUN type and backing store for block/file backend LUNs
+   like this:
+
+# ctladm devlist -v
+LUN Backend       Size (Blocks)   BS Serial Number    Device ID       
+  0 block            2147483648  512 MYSERIAL   0     MYDEVID   0     
+      lun_type=0
+      num_threads=14
+      file=testdisk0
+  1 block            2147483648  512 MYSERIAL   1     MYDEVID   1     
+      lun_type=0
+      num_threads=14
+      file=testdisk1
+  2 block            2147483648  512 MYSERIAL   2     MYDEVID   2     
+      lun_type=0
+      num_threads=14
+      file=testdisk2
+  3 block            2147483648  512 MYSERIAL   3     MYDEVID   3     
+      lun_type=0
+      num_threads=14
+      file=testdisk3
+  4 block            2147483648  512 MYSERIAL   4     MYDEVID   4     
+      lun_type=0
+      num_threads=14
+      file=testdisk4
+  5 block            2147483648  512 MYSERIAL   5     MYDEVID   5     
+      lun_type=0
+      num_threads=14
+      file=testdisk5
+  6 block            2147483648  512 MYSERIAL   6     MYDEVID   6     
+      lun_type=0
+      num_threads=14
+      file=testdisk6
+  7 block            2147483648  512 MYSERIAL   7     MYDEVID   7     
+      lun_type=0
+      num_threads=14
+      file=testdisk7
+  8 block            2147483648  512 MYSERIAL   8     MYDEVID   8     
+      lun_type=0
+      num_threads=14
+      file=testdisk8
+  9 block            2147483648  512 MYSERIAL   9     MYDEVID   9     
+      lun_type=0
+      num_threads=14
+      file=testdisk9
+ 10 ramdisk                   0    0 MYSERIAL   0     MYDEVID   0     
+      lun_type=3
+ 11 ramdisk     204800000000000  512 MYSERIAL   1     MYDEVID   1     
+      lun_type=0
+
+
+Revision 1.4 Changes
+====================
+ - Added in the second HA mode (where CTL does the data transfers instead
+   of having data transfers done below CTL), and abstracted out the Copan
+   HA API.
+
+ - Fixed the phantom device problem in the CTL CAM SIM and improved the
+   CAM SIM to automatically trigger a rescan when the port is enabled and
+   disabled.
+ 
+ - Made the number of threads in the block backend configurable via sysctl,
+   loader tunable and the ctladm command line.  (You can now specify
+   -o num_threads=4 when creating a LUN with ctladm create.)
+
+ - Fixed some LUN selection issues in ctlstat(8) and allowed for selection
+   of LUN numbers up to 1023.
+
+ - General cleanup.
+
+ - This version intended for public release.
+
+Revision 1.3 Changes
+====================
+ - Added descriptor sense support to CTL.  It can be enabled through the
+   control mode page (10), but is disabled by default.
+
+ - Improved error injection support.  The number of errors that can be
+   injected with 'ctladm inject' has been increased, and any arbitrary
+   sense data may now be injected as well.
+
+ - The port infrastructure has been revamped.  Individual ports and types
+   of ports may now be enabled and disabled from the command line.  ctladm
+   now has the ability to set the WWNN and WWPN for each port.
+
+ - The block backend can now send multiple I/Os to backing files.  Multiple
+   writes are only allowed for ZFS, but multiple readers are allowed for
+   any filesystem.
+
+ - The block and ramdisk backends now support setting the LUN blocksize.
+   There are some restrictions when the backing device is a block device,
+   but otherwise the blocksize may be set to anything.
+
+Revision 1.2 Changes
+====================
+
+ - CTL initialization process has been revamped.  Instead of using an
+   ad-hoc method, it is now sequenced through SYSINIT() calls.
+
+ - A block/file backend has been added.  This allows using arbitrary files
+   or block devices as a backing store.
+
+ - The userland LUN configuration interface has been completely rewritten.
+   Configuration is now done out of band.
+
+ - The ctladm(8) command line interface has been revamped, and is now
+   similar to camcontrol(8).
+
+To Do List:
+==========
+
+ - Make CTL buildable as a module.  Work needs to be done on initialization,
+   and on freeing resources and LUNs when it is built as a module.
+
+ - Use devstat(9) for CTL's statistics collection.  CTL uses a home-grown
+   statistics collection system that is similar to devstat(9).  ctlstat
+   should be retired in favor of iostat, etc., once aggregation modes are
+   available in iostat to match the behavior of ctlstat -t and dump modes
+   are available to match the behavior of ctlstat -d/ctlstat -J.
+
+ - ZFS ARC backend for CTL.  Since ZFS copies all I/O into the ARC
+   (Adaptive Replacement Cache), running the block/file backend on top of a
+   ZFS-backed zdev or file will involve an extra set of copies.  The
+   optimal solution for backing targets served by CTL with ZFS would be to
+   allocate buffers out of the ARC directly, and DMA to/from them directly.
+   That would eliminate an extra data buffer allocation and copy.
+
+ - Switch CTL over to using CAM CCBs instead of its own union ctl_io.  This
+   will likely require a significant amount of work, but will eliminate
+   another data structure in the stack, more memory allocations, etc.  This
+   will also require changes to the CAM CCB structure to support CTL.
+
+ - Full-featured High Availability support.  The HA API that is in ctl_ha.h
+   is essentially a renamed version of Copan's HA API.  There is no
+   substance to it, but it remains in CTL to show what needs to be done to
+   implement active/active HA from a CTL standpoint.  The things that would
+   need to be done include:
+	- A kernel level software API for message passing as well as DMA
+	  between at least two nodes.
+	- Hardware support and drivers for inter-node communication.  This
+	  could be as simples as ethernet hardware and drivers.
+	- A "supervisor", or startup framework to control and coordinate
+	  HA startup, failover (going from active/active to single mode),
+	  and failback (going from single mode to active/active).
+	- HA support in other components of the stack.  The goal behind HA
+	  is that one node can fail and another node can seamlessly take
+	  over handling I/O requests.  This requires support from pretty
+	  much every component in the storage stack, from top to bottom.
+	  CTL is one piece of it, but you also need support in the RAID
+	  stack/filesystem/backing store.  You also need full configuration
+	  mirroring, and all peer nodes need to be able to talk to the
+	  underlying storage hardware.
+
+Code Roadmap:
+============
+
+CTL has the concept of pluggable frontend ports and backends.  All
+frontends and backends can be active at the same time.  You can have a
+ramdisk-backed LUN present along side a file backed LUN.
+
+ctl.c:
+-----
+
+This is the core of CTL, where all of the command handlers and a lot of
+other things live.  Yes, it is large.  It started off small and grew to its
+current size over time.  Perhaps it can be split into more files at some
+point.
+
+Here is a roadmap of some of the primary functions in ctl.c.  Starting here
+and following the various leaf functions will show the command flow.
+
+ctl_queue() 		This is where commands from the frontend ports come
+			in.
+
+ctl_queue_sense()	This is only used for non-packetized SCSI.  i.e.
+			parallel SCSI prior to U320 and perhaps U160.
+
+ctl_work_thread() 	This is the primary work thread, and everything gets
+			executed from there.
+
+ctl_scsiio_precheck() 	This where all of the initial checks are done, and I/O
+			is either queued for execution or blocked.
+
+ctl_scsiio() 		This is where the command handler is actually
+			executed.  (See ctl_cmd_table.c for the mapping of
+			SCSI opcode to command handler function.)
+
+ctl_done()		This is the routine called (or ctl_done_lock()) to
+			initiate the command completion process.
+
+ctl_process_done()	This is where command completion actually happens.
+
+ctl.h:
+-----
+
+Basic function declarations and data structures.
+
+ctl_backend.c,
+ctl_backend.h:
+-------------
+
+These files define the basic CTL backend API.  The comments in the header
+explain the API.
+
+ctl_backend_block.c
+ctl_backend_block.h:
+-------------------
+
+The block and file backend.  This allows for using a disk or a file as the
+backing store for a LUN.  Multiple threads are started to do I/O to the
+backing device, primarily because the VFS API requires that to get any
+concurrency.
+
+ctl_backend_ramdisk.c:
+---------------------
+
+A "fake" ramdisk backend.  It only allocates a small amount of memory to
+act as a source and sink for reads and writes from an initiator.  Therefore
+it cannot be used for any real data, but it can be used to test for
+throughput.  It can also be used to test initiators' support for extremely
+large LUNs.
+
+ctl_cmd_table.c:
+---------------
+
+This is a table with all 256 possible SCSI opcodes, and command handler
+functions defined for supported opcodes.  It is included in ctl.c.
+
+ctl_debug.h:
+-----------
+
+Simplistic debugging support.
+
+ctl_error.c,
+ctl_error.h:
+-----------
+
+CTL-specific wrappers around the CAM sense building functions.
+
+ctl_frontend.c,
+ctl_frontend.h:
+--------------
+
+These files define the basic CTL frontend port API.  The comments in the
+header explain the API.
+
+ctl_frontend_cam_sim.c:
+----------------------
+
+This is a CTL frontend port that is also a CAM SIM.  The idea is that this
+frontend allows for using CTL without any target-capable hardware.  So any
+LUNs you create in CTL are visible via this port.
+
+
+ctl_frontend_internal.c
+ctl_frontend_internal.h:
+-----------------------
+
+This is a frontend port written for Copan to do some system-specific tasks
+that required sending commands into CTL from inside the kernel.  This isn't
+entirely relevant to FreeBSD in general, but can perhaps be repurposed or
+removed later.
+
+ctl_ha.h:
+--------
+
+This is a stubbed-out High Availability API.  See the comments in the
+header and the description of what is needed as far as HA support above.
+
+ctl_io.h:
+--------
+
+This defines most of the core CTL I/O structures.  union ctl_io is
+conceptually very similar to CAM's union ccb.  
+
+ctl_ioctl.h:
+-----------
+
+This defines all ioctls available through the CTL character device, and
+the data structures needed for those ioctls.
+
+ctl_mem_pool.c
+ctl_mem_pool.h:
+--------------
+
+Generic memory pool implementation.  This is currently only used by the
+internal frontend.  The internal frontend can probably be rewritten to use
+UMA zones and this can be removed.
+
+ctl_private.h:
+-------------
+
+Private data structres (e.g. CTL softc) and function prototypes.  This also
+includes the SCSI vendor and product names used by CTL.
+
+ctl_scsi_all.c
+ctl_scsi_all.h:
+--------------
+
+CTL wrappers around CAM sense printing functions.
+
+ctl_ser_table.c:
+---------------
+
+Command serialization table.  This defines what happens when one type of
+command is followed by another type of command.  e.g., what do you do when
+you have a mode select followed by a write?  You block the write until the
+mode select is complete.  That is defined in this table.
+
+ctl_util.c
+ctl_util.h:
+----------
+
+CTL utility functions, primarily designed to be used from userland.  See
+ctladm for the primary consumer of these functions.  These include CDB
+building functions.
+
+scsi_ctl.c:
+----------
+
+CAM target peripheral driver and CTL frontend port.  This is the path into
+CTL for commands from target-capable hardware/SIMs.
+
+Userland Commands:
+=================
+
+ctladm(8) fills a role similar to camcontrol(8).  It allow configuring LUNs,
+issuing commands, injecting errors and various other control functions.
+
+ctlstat(8) fills a role similar to iostat(8).  It reports I/O statistics
+for CTL.
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,13082 @@
+/*-
+ * Copyright (c) 2003-2009 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl.c#8 $
+ */
+/*
+ * CAM Target Layer, a SCSI device emulation subsystem.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#define _CTL_C
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/kthread.h>
+#include <sys/bio.h>
+#include <sys/fcntl.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/malloc.h>
+#include <sys/conf.h>
+#include <sys/ioccom.h>
+#include <sys/queue.h>
+#include <sys/sbuf.h>
+#include <sys/endian.h>
+#include <sys/sysctl.h>
+
+#include <cam/cam.h>
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_util.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_ha.h>
+#include <cam/ctl/ctl_private.h>
+#include <cam/ctl/ctl_debug.h>
+#include <cam/ctl/ctl_scsi_all.h>
+#include <cam/ctl/ctl_error.h>
+
+struct ctl_softc *control_softc = NULL;
+
+/*
+ * The default is to run with CTL_DONE_THREAD turned on.  Completed
+ * transactions are queued for processing by the CTL work thread.  When
+ * CTL_DONE_THREAD is not defined, completed transactions are processed in
+ * the caller's context.
+ */
+#define CTL_DONE_THREAD
+
+/*
+ *  * Use the serial number and device ID provided by the backend, rather than
+ *   * making up our own.
+ *    */
+#define CTL_USE_BACKEND_SN
+
+/*
+ * Size and alignment macros needed for Copan-specific HA hardware.  These
+ * can go away when the HA code is re-written, and uses busdma for any
+ * hardware.
+ */
+#define	CTL_ALIGN_8B(target, source, type)				\
+	if (((uint32_t)source & 0x7) != 0)				\
+		target = (type)(source + (0x8 - ((uint32_t)source & 0x7)));\
+	else								\
+		target = (type)source;
+
+#define	CTL_SIZE_8B(target, size)					\
+	if ((size & 0x7) != 0)						\
+		target = size + (0x8 - (size & 0x7));			\
+	else								\
+		target = size;
+
+#define CTL_ALIGN_8B_MARGIN	16
+
+/*
+ * Template mode pages.
+ */
+
+/*
+ * Note that these are default values only.  The actual values will be
+ * filled in when the user does a mode sense.
+ */
+static struct copan_power_subpage power_page_default = {
+	/*page_code*/ PWR_PAGE_CODE | SMPH_SPF,
+	/*subpage*/ PWR_SUBPAGE_CODE,
+	/*page_length*/ {(sizeof(struct copan_power_subpage) - 4) & 0xff00,
+			 (sizeof(struct copan_power_subpage) - 4) & 0x00ff},
+	/*page_version*/ PWR_VERSION,
+	/* total_luns */ 26,
+	/* max_active_luns*/ PWR_DFLT_MAX_LUNS,
+	/*reserved*/ {0, 0, 0, 0, 0, 0, 0, 0, 0,
+		      0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		      0, 0, 0, 0, 0, 0}
+};
+
+static struct copan_power_subpage power_page_changeable = {
+	/*page_code*/ PWR_PAGE_CODE | SMPH_SPF,
+	/*subpage*/ PWR_SUBPAGE_CODE,
+	/*page_length*/ {(sizeof(struct copan_power_subpage) - 4) & 0xff00,
+			 (sizeof(struct copan_power_subpage) - 4) & 0x00ff},
+	/*page_version*/ 0,
+	/* total_luns */ 0,
+	/* max_active_luns*/ 0,
+	/*reserved*/ {0, 0, 0, 0, 0, 0, 0, 0, 0,
+		      0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		      0, 0, 0, 0, 0, 0}
+};
+
+static struct copan_aps_subpage aps_page_default = {
+	APS_PAGE_CODE | SMPH_SPF, //page_code
+	APS_SUBPAGE_CODE, //subpage
+	{(sizeof(struct copan_aps_subpage) - 4) & 0xff00,
+	 (sizeof(struct copan_aps_subpage) - 4) & 0x00ff}, //page_length
+	APS_VERSION, //page_version
+	0, //lock_active
+	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0} //reserved
+};
+
+static struct copan_aps_subpage aps_page_changeable = {
+	APS_PAGE_CODE | SMPH_SPF, //page_code
+	APS_SUBPAGE_CODE, //subpage
+	{(sizeof(struct copan_aps_subpage) - 4) & 0xff00,
+	 (sizeof(struct copan_aps_subpage) - 4) & 0x00ff}, //page_length
+	0, //page_version
+	0, //lock_active
+	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0} //reserved
+};
+
+static struct copan_debugconf_subpage debugconf_page_default = {
+	DBGCNF_PAGE_CODE | SMPH_SPF,	/* page_code */
+	DBGCNF_SUBPAGE_CODE,		/* subpage */
+	{(sizeof(struct copan_debugconf_subpage) - 4) >> 8,
+	 (sizeof(struct copan_debugconf_subpage) - 4) >> 0}, /* page_length */
+	DBGCNF_VERSION,			/* page_version */
+	{CTL_TIME_IO_DEFAULT_SECS>>8,
+	 CTL_TIME_IO_DEFAULT_SECS>>0},	/* ctl_time_io_secs */
+};
+
+static struct copan_debugconf_subpage debugconf_page_changeable = {
+	DBGCNF_PAGE_CODE | SMPH_SPF,	/* page_code */
+	DBGCNF_SUBPAGE_CODE,		/* subpage */
+	{(sizeof(struct copan_debugconf_subpage) - 4) >> 8,
+	 (sizeof(struct copan_debugconf_subpage) - 4) >> 0}, /* page_length */
+	0,				/* page_version */
+	{0xff,0xff},			/* ctl_time_io_secs */
+};
+
+static struct scsi_format_page format_page_default = {
+	/*page_code*/SMS_FORMAT_DEVICE_PAGE,
+	/*page_length*/sizeof(struct scsi_format_page) - 2,
+	/*tracks_per_zone*/ {0, 0},
+	/*alt_sectors_per_zone*/ {0, 0},
+	/*alt_tracks_per_zone*/ {0, 0},
+	/*alt_tracks_per_lun*/ {0, 0},
+	/*sectors_per_track*/ {(CTL_DEFAULT_SECTORS_PER_TRACK >> 8) & 0xff,
+			        CTL_DEFAULT_SECTORS_PER_TRACK & 0xff},
+	/*bytes_per_sector*/ {0, 0},
+	/*interleave*/ {0, 0},
+	/*track_skew*/ {0, 0},
+	/*cylinder_skew*/ {0, 0},
+	/*flags*/ SFP_HSEC,
+	/*reserved*/ {0, 0, 0}
+};
+
+static struct scsi_format_page format_page_changeable = {
+	/*page_code*/SMS_FORMAT_DEVICE_PAGE,
+	/*page_length*/sizeof(struct scsi_format_page) - 2,
+	/*tracks_per_zone*/ {0, 0},
+	/*alt_sectors_per_zone*/ {0, 0},
+	/*alt_tracks_per_zone*/ {0, 0},
+	/*alt_tracks_per_lun*/ {0, 0},
+	/*sectors_per_track*/ {0, 0},
+	/*bytes_per_sector*/ {0, 0},
+	/*interleave*/ {0, 0},
+	/*track_skew*/ {0, 0},
+	/*cylinder_skew*/ {0, 0},
+	/*flags*/ 0,
+	/*reserved*/ {0, 0, 0}
+};
+
+static struct scsi_rigid_disk_page rigid_disk_page_default = {
+	/*page_code*/SMS_RIGID_DISK_PAGE,
+	/*page_length*/sizeof(struct scsi_rigid_disk_page) - 2,
+	/*cylinders*/ {0, 0, 0},
+	/*heads*/ CTL_DEFAULT_HEADS,
+	/*start_write_precomp*/ {0, 0, 0},
+	/*start_reduced_current*/ {0, 0, 0},
+	/*step_rate*/ {0, 0},
+	/*landing_zone_cylinder*/ {0, 0, 0},
+	/*rpl*/ SRDP_RPL_DISABLED,
+	/*rotational_offset*/ 0,
+	/*reserved1*/ 0,
+	/*rotation_rate*/ {(CTL_DEFAULT_ROTATION_RATE >> 8) & 0xff,
+			   CTL_DEFAULT_ROTATION_RATE & 0xff},
+	/*reserved2*/ {0, 0}
+};
+
+static struct scsi_rigid_disk_page rigid_disk_page_changeable = {
+	/*page_code*/SMS_RIGID_DISK_PAGE,
+	/*page_length*/sizeof(struct scsi_rigid_disk_page) - 2,
+	/*cylinders*/ {0, 0, 0},
+	/*heads*/ 0,
+	/*start_write_precomp*/ {0, 0, 0},
+	/*start_reduced_current*/ {0, 0, 0},
+	/*step_rate*/ {0, 0},
+	/*landing_zone_cylinder*/ {0, 0, 0},
+	/*rpl*/ 0,
+	/*rotational_offset*/ 0,
+	/*reserved1*/ 0,
+	/*rotation_rate*/ {0, 0},
+	/*reserved2*/ {0, 0}
+};
+
+static struct scsi_caching_page caching_page_default = {
+	/*page_code*/SMS_CACHING_PAGE,
+	/*page_length*/sizeof(struct scsi_caching_page) - 2,
+	/*flags1*/ SCP_DISC | SCP_WCE,
+	/*ret_priority*/ 0,
+	/*disable_pf_transfer_len*/ {0xff, 0xff},
+	/*min_prefetch*/ {0, 0},
+	/*max_prefetch*/ {0xff, 0xff},
+	/*max_pf_ceiling*/ {0xff, 0xff},
+	/*flags2*/ 0,
+	/*cache_segments*/ 0,
+	/*cache_seg_size*/ {0, 0},
+	/*reserved*/ 0,
+	/*non_cache_seg_size*/ {0, 0, 0}
+};
+
+static struct scsi_caching_page caching_page_changeable = {
+	/*page_code*/SMS_CACHING_PAGE,
+	/*page_length*/sizeof(struct scsi_caching_page) - 2,
+	/*flags1*/ 0,
+	/*ret_priority*/ 0,
+	/*disable_pf_transfer_len*/ {0, 0},
+	/*min_prefetch*/ {0, 0},
+	/*max_prefetch*/ {0, 0},
+	/*max_pf_ceiling*/ {0, 0},
+	/*flags2*/ 0,
+	/*cache_segments*/ 0,
+	/*cache_seg_size*/ {0, 0},
+	/*reserved*/ 0,
+	/*non_cache_seg_size*/ {0, 0, 0}
+};
+
+static struct scsi_control_page control_page_default = {
+	/*page_code*/SMS_CONTROL_MODE_PAGE,
+	/*page_length*/sizeof(struct scsi_control_page) - 2,
+	/*rlec*/0,
+	/*queue_flags*/0,
+	/*eca_and_aen*/0,
+	/*reserved*/0,
+	/*aen_holdoff_period*/{0, 0}
+};
+
+static struct scsi_control_page control_page_changeable = {
+	/*page_code*/SMS_CONTROL_MODE_PAGE,
+	/*page_length*/sizeof(struct scsi_control_page) - 2,
+	/*rlec*/SCP_DSENSE,
+	/*queue_flags*/0,
+	/*eca_and_aen*/0,
+	/*reserved*/0,
+	/*aen_holdoff_period*/{0, 0}
+};
+
+SYSCTL_NODE(_kern_cam, OID_AUTO, ctl, CTLFLAG_RD, 0, "CAM Target Layer");
+
+/*
+ * XXX KDM move these into the softc.
+ */
+static int rcv_sync_msg;
+static int persis_offset;
+static uint8_t ctl_pause_rtr;
+static int     ctl_is_single;
+static int     index_to_aps_page;
+
+
+/*
+ * Serial number (0x80), device id (0x83), and supported pages (0x00)
+ */
+#define SCSI_EVPD_NUM_SUPPORTED_PAGES	3
+
+static void ctl_isc_event_handler(ctl_ha_channel chanel, ctl_ha_event event,
+				  int param);
+static void ctl_copy_sense_data(union ctl_ha_msg *src, union ctl_io *dest);
+static void ctl_init(void);
+void ctl_shutdown(void);
+static int ctl_open(struct cdev *dev, int flags, int fmt, struct thread *td);
+static int ctl_close(struct cdev *dev, int flags, int fmt, struct thread *td);
+static void ctl_ioctl_online(void *arg);
+static void ctl_ioctl_offline(void *arg);
+static int ctl_ioctl_targ_enable(void *arg, struct ctl_id targ_id);
+static int ctl_ioctl_targ_disable(void *arg, struct ctl_id targ_id);
+static int ctl_ioctl_lun_enable(void *arg, struct ctl_id targ_id, int lun_id);
+static int ctl_ioctl_lun_disable(void *arg, struct ctl_id targ_id, int lun_id);
+static int ctl_ioctl_do_datamove(struct ctl_scsiio *ctsio);
+static int ctl_serialize_other_sc_cmd(struct ctl_scsiio *ctsio, int have_lock);
+static int ctl_ioctl_submit_wait(union ctl_io *io);
+static void ctl_ioctl_datamove(union ctl_io *io);
+static void ctl_ioctl_done(union ctl_io *io);
+static void ctl_ioctl_hard_startstop_callback(void *arg,
+					      struct cfi_metatask *metatask);
+static void ctl_ioctl_bbrread_callback(void *arg,struct cfi_metatask *metatask);
+static int ctl_ioctl_fill_ooa(struct ctl_lun *lun, uint32_t *cur_fill_num,
+			      struct ctl_ooa *ooa_hdr);
+static int ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
+		     struct thread *td);
+uint32_t ctl_get_resindex(struct ctl_nexus *nexus);
+uint32_t ctl_port_idx(int port_num);
+#ifdef unused
+static union ctl_io *ctl_malloc_io(ctl_io_type io_type, uint32_t targ_port,
+				   uint32_t targ_target, uint32_t targ_lun,
+				   int can_wait);
+static void ctl_kfree_io(union ctl_io *io);
+#endif /* unused */
+static void ctl_free_io_internal(union ctl_io *io, int have_lock);
+static int ctl_alloc_lun(struct ctl_softc *ctl_softc, struct ctl_lun *lun,
+			 struct ctl_be_lun *be_lun, struct ctl_id target_id);
+static int ctl_free_lun(struct ctl_lun *lun);
+static void ctl_create_lun(struct ctl_be_lun *be_lun);
+/**
+static void ctl_failover_change_pages(struct ctl_softc *softc,
+				      struct ctl_scsiio *ctsio, int master);
+**/
+
+static int ctl_do_mode_select(union ctl_io *io);
+static int ctl_pro_preempt(struct ctl_softc *softc, struct ctl_lun *lun,
+			   uint64_t res_key, uint64_t sa_res_key,
+			   uint8_t type, uint32_t residx,
+			   struct ctl_scsiio *ctsio,
+			   struct scsi_per_res_out *cdb,
+			   struct scsi_per_res_out_parms* param);
+static void ctl_pro_preempt_other(struct ctl_lun *lun,
+				  union ctl_ha_msg *msg);
+static void ctl_hndl_per_res_out_on_other_sc(union ctl_ha_msg *msg);
+static int ctl_inquiry_evpd_supported(struct ctl_scsiio *ctsio, int alloc_len);
+static int ctl_inquiry_evpd_serial(struct ctl_scsiio *ctsio, int alloc_len);
+static int ctl_inquiry_evpd_devid(struct ctl_scsiio *ctsio, int alloc_len);
+static int ctl_inquiry_evpd(struct ctl_scsiio *ctsio);
+static int ctl_inquiry_std(struct ctl_scsiio *ctsio);
+static int ctl_get_lba_len(union ctl_io *io, uint64_t *lba, uint32_t *len);
+static ctl_action ctl_extent_check(union ctl_io *io1, union ctl_io *io2);
+static ctl_action ctl_check_for_blockage(union ctl_io *pending_io,
+					 union ctl_io *ooa_io);
+static ctl_action ctl_check_ooa(struct ctl_lun *lun, union ctl_io *pending_io,
+				union ctl_io *starting_io);
+static int ctl_check_blocked(struct ctl_lun *lun);
+static int ctl_scsiio_lun_check(struct ctl_softc *ctl_softc,
+				struct ctl_lun *lun,
+				struct ctl_cmd_entry *entry,
+				struct ctl_scsiio *ctsio);
+//static int ctl_check_rtr(union ctl_io *pending_io, struct ctl_softc *softc);
+static void ctl_failover(void);
+static int ctl_scsiio_precheck(struct ctl_softc *ctl_softc,
+			       struct ctl_scsiio *ctsio);
+static int ctl_scsiio(struct ctl_scsiio *ctsio);
+
+static int ctl_bus_reset(struct ctl_softc *ctl_softc, union ctl_io *io);
+static int ctl_target_reset(struct ctl_softc *ctl_softc, union ctl_io *io,
+			    ctl_ua_type ua_type);
+static int ctl_lun_reset(struct ctl_lun *lun, union ctl_io *io,
+			 ctl_ua_type ua_type);
+static int ctl_abort_task(union ctl_io *io);
+static void ctl_run_task_queue(struct ctl_softc *ctl_softc);
+#ifdef CTL_IO_DELAY
+static void ctl_datamove_timer_wakeup(void *arg);
+static void ctl_done_timer_wakeup(void *arg);
+#endif /* CTL_IO_DELAY */
+
+static void ctl_send_datamove_done(union ctl_io *io, int have_lock);
+static void ctl_datamove_remote_write_cb(struct ctl_ha_dt_req *rq);
+static int ctl_datamove_remote_dm_write_cb(union ctl_io *io);
+static void ctl_datamove_remote_write(union ctl_io *io);
+static int ctl_datamove_remote_dm_read_cb(union ctl_io *io);
+static void ctl_datamove_remote_read_cb(struct ctl_ha_dt_req *rq);
+static int ctl_datamove_remote_sgl_setup(union ctl_io *io);
+static int ctl_datamove_remote_xfer(union ctl_io *io, unsigned command,
+				    ctl_ha_dt_cb callback);
+static void ctl_datamove_remote_read(union ctl_io *io);
+static void ctl_datamove_remote(union ctl_io *io);
+static int ctl_process_done(union ctl_io *io, int have_lock);
+static void ctl_work_thread(void *arg);
+
+/*
+ * Load the serialization table.  This isn't very pretty, but is probably
+ * the easiest way to do it.
+ */
+#include "ctl_ser_table.c"
+
+/*
+ * We only need to define open, close and ioctl routines for this driver.
+ */
+static struct cdevsw ctl_cdevsw = {
+	.d_version =	D_VERSION,
+	.d_flags =	0,
+	.d_open =	ctl_open,
+	.d_close =	ctl_close,
+	.d_ioctl =	ctl_ioctl,
+	.d_name =	"ctl",
+};
+
+
+MALLOC_DEFINE(M_CTL, "ctlmem", "Memory used for CTL");
+
+/*
+ * If we have the CAM SIM, we may or may not have another SIM that will
+ * cause CTL to get initialized.  If not, we need to initialize it.
+ */
+SYSINIT(ctl_init, SI_SUB_CONFIGURE, SI_ORDER_THIRD, ctl_init, NULL);
+
+static void
+ctl_isc_handler_finish_xfer(struct ctl_softc *ctl_softc,
+			    union ctl_ha_msg *msg_info)
+{
+	struct ctl_scsiio *ctsio;
+
+	if (msg_info->hdr.original_sc == NULL) {
+		printf("%s: original_sc == NULL!\n", __func__);
+		/* XXX KDM now what? */
+		return;
+	}
+
+	ctsio = &msg_info->hdr.original_sc->scsiio;
+	ctsio->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
+	ctsio->io_hdr.msg_type = CTL_MSG_FINISH_IO;
+	ctsio->io_hdr.status = msg_info->hdr.status;
+	ctsio->scsi_status = msg_info->scsi.scsi_status;
+	ctsio->sense_len = msg_info->scsi.sense_len;
+	ctsio->sense_residual = msg_info->scsi.sense_residual;
+	ctsio->residual = msg_info->scsi.residual;
+	memcpy(&ctsio->sense_data, &msg_info->scsi.sense_data,
+	       sizeof(ctsio->sense_data));
+	memcpy(&ctsio->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
+	       &msg_info->scsi.lbalen, sizeof(msg_info->scsi.lbalen));;
+	STAILQ_INSERT_TAIL(&ctl_softc->isc_queue, &ctsio->io_hdr, links);
+	ctl_wakeup_thread();
+}
+
+static void
+ctl_isc_handler_finish_ser_only(struct ctl_softc *ctl_softc,
+				union ctl_ha_msg *msg_info)
+{
+	struct ctl_scsiio *ctsio;
+
+	if (msg_info->hdr.serializing_sc == NULL) {
+		printf("%s: serializing_sc == NULL!\n", __func__);
+		/* XXX KDM now what? */
+		return;
+	}
+
+	ctsio = &msg_info->hdr.serializing_sc->scsiio;
+#if 0
+	/*
+	 * Attempt to catch the situation where an I/O has
+	 * been freed, and we're using it again.
+	 */
+	if (ctsio->io_hdr.io_type == 0xff) {
+		union ctl_io *tmp_io;
+		tmp_io = (union ctl_io *)ctsio;
+		printf("%s: %p use after free!\n", __func__,
+		       ctsio);
+		printf("%s: type %d msg %d cdb %x iptl: "
+		       "%d:%d:%d:%d tag 0x%04x "
+		       "flag %#x status %x\n",
+			__func__,
+			tmp_io->io_hdr.io_type,
+			tmp_io->io_hdr.msg_type,
+			tmp_io->scsiio.cdb[0],
+			tmp_io->io_hdr.nexus.initid.id,
+			tmp_io->io_hdr.nexus.targ_port,
+			tmp_io->io_hdr.nexus.targ_target.id,
+			tmp_io->io_hdr.nexus.targ_lun,
+			(tmp_io->io_hdr.io_type ==
+			CTL_IO_TASK) ?
+			tmp_io->taskio.tag_num :
+			tmp_io->scsiio.tag_num,
+		        tmp_io->io_hdr.flags,
+			tmp_io->io_hdr.status);
+	}
+#endif
+	ctsio->io_hdr.msg_type = CTL_MSG_FINISH_IO;
+	STAILQ_INSERT_TAIL(&ctl_softc->isc_queue, &ctsio->io_hdr, links);
+	ctl_wakeup_thread();
+}
+
+/*
+ * ISC (Inter Shelf Communication) event handler.  Events from the HA
+ * subsystem come in here.
+ */
+static void
+ctl_isc_event_handler(ctl_ha_channel channel, ctl_ha_event event, int param)
+{
+	struct ctl_softc *ctl_softc;
+	union ctl_io *io;
+	struct ctl_prio *presio;
+	ctl_ha_status isc_status;
+
+	ctl_softc = control_softc;
+	io = NULL;
+
+
+#if 0
+	printf("CTL: Isc Msg event %d\n", event);
+#endif
+	if (event == CTL_HA_EVT_MSG_RECV) {
+		union ctl_ha_msg msg_info;
+
+		isc_status = ctl_ha_msg_recv(CTL_HA_CHAN_CTL, &msg_info,
+					     sizeof(msg_info), /*wait*/ 0);
+#if 0
+		printf("CTL: msg_type %d\n", msg_info.msg_type);
+#endif
+		if (isc_status != 0) {
+			printf("Error receiving message, status = %d\n",
+			       isc_status);
+			return;
+		}
+		mtx_lock(&ctl_softc->ctl_lock);
+
+		switch (msg_info.hdr.msg_type) {
+		case CTL_MSG_SERIALIZE:
+#if 0
+			printf("Serialize\n");
+#endif
+			io = ctl_alloc_io((void *)ctl_softc->othersc_pool);
+			if (io == NULL) {
+				printf("ctl_isc_event_handler: can't allocate "
+				       "ctl_io!\n");
+				/* Bad Juju */
+				/* Need to set busy and send msg back */
+				mtx_unlock(&ctl_softc->ctl_lock);
+				msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
+				msg_info.hdr.status = CTL_SCSI_ERROR;
+				msg_info.scsi.scsi_status = SCSI_STATUS_BUSY;
+				msg_info.scsi.sense_len = 0;
+			        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+				    sizeof(msg_info), 0) > CTL_HA_STATUS_SUCCESS){
+				}
+				goto bailout;
+			}
+			ctl_zero_io(io);
+			// populate ctsio from msg_info
+			io->io_hdr.io_type = CTL_IO_SCSI;
+			io->io_hdr.msg_type = CTL_MSG_SERIALIZE;
+			io->io_hdr.original_sc = msg_info.hdr.original_sc;
+#if 0
+			printf("pOrig %x\n", (int)msg_info.original_sc);
+#endif
+			io->io_hdr.flags |= CTL_FLAG_FROM_OTHER_SC |
+					    CTL_FLAG_IO_ACTIVE;
+			/*
+			 * If we're in serialization-only mode, we don't
+			 * want to go through full done processing.  Thus
+			 * the COPY flag.
+			 *
+			 * XXX KDM add another flag that is more specific.
+			 */
+			if (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)
+				io->io_hdr.flags |= CTL_FLAG_INT_COPY;
+			io->io_hdr.nexus = msg_info.hdr.nexus;
+#if 0
+			printf("targ %d, port %d, iid %d, lun %d\n",
+			       io->io_hdr.nexus.targ_target.id,
+			       io->io_hdr.nexus.targ_port,
+			       io->io_hdr.nexus.initid.id,
+			       io->io_hdr.nexus.targ_lun);
+#endif
+			io->scsiio.tag_num = msg_info.scsi.tag_num;
+			io->scsiio.tag_type = msg_info.scsi.tag_type;
+			memcpy(io->scsiio.cdb, msg_info.scsi.cdb,
+			       CTL_MAX_CDBLEN);
+			if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
+				struct ctl_cmd_entry *entry;
+				uint8_t opcode;
+
+				opcode = io->scsiio.cdb[0];
+				entry = &ctl_cmd_table[opcode];
+				io->io_hdr.flags &= ~CTL_FLAG_DATA_MASK;
+				io->io_hdr.flags |=
+					entry->flags & CTL_FLAG_DATA_MASK;
+			}
+			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
+					   &io->io_hdr, links);
+			ctl_wakeup_thread();
+			break;
+
+		/* Performed on the Originating SC, XFER mode only */
+		case CTL_MSG_DATAMOVE: {
+			struct ctl_sg_entry *sgl;
+			int i, j;
+
+			io = msg_info.hdr.original_sc;
+			if (io == NULL) {
+				printf("%s: original_sc == NULL!\n", __func__);
+				/* XXX KDM do something here */
+				break;
+			}
+			io->io_hdr.msg_type = CTL_MSG_DATAMOVE;
+			io->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
+			/*
+			 * Keep track of this, we need to send it back over
+			 * when the datamove is complete.
+			 */
+			io->io_hdr.serializing_sc = msg_info.hdr.serializing_sc;
+
+			if (msg_info.dt.sg_sequence == 0) {
+				/*
+				 * XXX KDM we use the preallocated S/G list
+				 * here, but we'll need to change this to
+				 * dynamic allocation if we need larger S/G
+				 * lists.
+				 */
+				if (msg_info.dt.kern_sg_entries >
+				    sizeof(io->io_hdr.remote_sglist) /
+				    sizeof(io->io_hdr.remote_sglist[0])) {
+					printf("%s: number of S/G entries "
+					    "needed %u > allocated num %zd\n",
+					    __func__,
+					    msg_info.dt.kern_sg_entries,
+					    sizeof(io->io_hdr.remote_sglist)/
+					    sizeof(io->io_hdr.remote_sglist[0]));
+				
+					/*
+					 * XXX KDM send a message back to
+					 * the other side to shut down the
+					 * DMA.  The error will come back
+					 * through via the normal channel.
+					 */
+					break;
+				}
+				sgl = io->io_hdr.remote_sglist;
+				memset(sgl, 0,
+				       sizeof(io->io_hdr.remote_sglist));
+
+				io->scsiio.kern_data_ptr = (uint8_t *)sgl;
+
+				io->scsiio.kern_sg_entries =
+					msg_info.dt.kern_sg_entries;
+				io->scsiio.rem_sg_entries =
+					msg_info.dt.kern_sg_entries;
+				io->scsiio.kern_data_len =
+					msg_info.dt.kern_data_len;
+				io->scsiio.kern_total_len =
+					msg_info.dt.kern_total_len;
+				io->scsiio.kern_data_resid =
+					msg_info.dt.kern_data_resid;
+				io->scsiio.kern_rel_offset =
+					msg_info.dt.kern_rel_offset;
+				/*
+				 * Clear out per-DMA flags.
+				 */
+				io->io_hdr.flags &= ~CTL_FLAG_RDMA_MASK;
+				/*
+				 * Add per-DMA flags that are set for this
+				 * particular DMA request.
+				 */
+				io->io_hdr.flags |= msg_info.dt.flags &
+						    CTL_FLAG_RDMA_MASK;
+			} else
+				sgl = (struct ctl_sg_entry *)
+					io->scsiio.kern_data_ptr;
+
+			for (i = msg_info.dt.sent_sg_entries, j = 0;
+			     i < (msg_info.dt.sent_sg_entries +
+			     msg_info.dt.cur_sg_entries); i++, j++) {
+				sgl[i].addr = msg_info.dt.sg_list[j].addr;
+				sgl[i].len = msg_info.dt.sg_list[j].len;
+
+#if 0
+				printf("%s: L: %p,%d -> %p,%d j=%d, i=%d\n",
+				       __func__,
+				       msg_info.dt.sg_list[j].addr,
+				       msg_info.dt.sg_list[j].len,
+				       sgl[i].addr, sgl[i].len, j, i);
+#endif
+			}
+#if 0
+			memcpy(&sgl[msg_info.dt.sent_sg_entries],
+			       msg_info.dt.sg_list,
+			       sizeof(*sgl) * msg_info.dt.cur_sg_entries);
+#endif
+
+			/*
+			 * If this is the last piece of the I/O, we've got
+			 * the full S/G list.  Queue processing in the thread.
+			 * Otherwise wait for the next piece.
+			 */
+			if (msg_info.dt.sg_last != 0) {
+				STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
+						   &io->io_hdr, links);
+				ctl_wakeup_thread();
+			}
+			break;
+		}
+		/* Performed on the Serializing (primary) SC, XFER mode only */
+		case CTL_MSG_DATAMOVE_DONE: {
+			if (msg_info.hdr.serializing_sc == NULL) {
+				printf("%s: serializing_sc == NULL!\n",
+				       __func__);
+				/* XXX KDM now what? */
+				break;
+			}
+			/*
+			 * We grab the sense information here in case
+			 * there was a failure, so we can return status
+			 * back to the initiator.
+			 */
+			io = msg_info.hdr.serializing_sc;
+			io->io_hdr.msg_type = CTL_MSG_DATAMOVE_DONE;
+			io->io_hdr.status = msg_info.hdr.status;
+			io->scsiio.scsi_status = msg_info.scsi.scsi_status;
+			io->scsiio.sense_len = msg_info.scsi.sense_len;
+			io->scsiio.sense_residual =msg_info.scsi.sense_residual;
+			io->io_hdr.port_status = msg_info.scsi.fetd_status;
+			io->scsiio.residual = msg_info.scsi.residual;
+			memcpy(&io->scsiio.sense_data,&msg_info.scsi.sense_data,
+			       sizeof(io->scsiio.sense_data));
+
+			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
+					   &io->io_hdr, links);
+			ctl_wakeup_thread();
+			break;
+		}
+
+		/* Preformed on Originating SC, SER_ONLY mode */
+		case CTL_MSG_R2R:
+			io = msg_info.hdr.original_sc;
+			if (io == NULL) {
+				printf("%s: Major Bummer\n", __func__);
+				mtx_unlock(&ctl_softc->ctl_lock);
+				return;
+			} else {
+#if 0
+				printf("pOrig %x\n",(int) ctsio);
+#endif
+			}
+			io->io_hdr.msg_type = CTL_MSG_R2R;
+			io->io_hdr.serializing_sc = msg_info.hdr.serializing_sc;
+			STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
+					   &io->io_hdr, links);
+			ctl_wakeup_thread();
+			break;
+
+		/*
+		 * Performed on Serializing(i.e. primary SC) SC in SER_ONLY
+		 * mode.
+		 * Performed on the Originating (i.e. secondary) SC in XFER
+		 * mode
+		 */
+		case CTL_MSG_FINISH_IO:
+			if (ctl_softc->ha_mode == CTL_HA_MODE_XFER)
+				ctl_isc_handler_finish_xfer(ctl_softc,
+							    &msg_info);
+			else
+				ctl_isc_handler_finish_ser_only(ctl_softc,
+								&msg_info);
+			break;
+
+		/* Preformed on Originating SC */
+		case CTL_MSG_BAD_JUJU:
+			io = msg_info.hdr.original_sc;
+			if (io == NULL) {
+				printf("%s: Bad JUJU!, original_sc is NULL!\n",
+				       __func__);
+				break;
+			}
+			ctl_copy_sense_data(&msg_info, io);
+			/*
+			 * IO should have already been cleaned up on other
+			 * SC so clear this flag so we won't send a message
+			 * back to finish the IO there.
+			 */
+			io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
+			io->io_hdr.flags |= CTL_FLAG_IO_ACTIVE;
+
+			/* io = msg_info.hdr.serializing_sc; */
+			io->io_hdr.msg_type = CTL_MSG_BAD_JUJU;
+		        STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
+					   &io->io_hdr, links);
+			ctl_wakeup_thread();
+			break;
+
+		/* Handle resets sent from the other side */
+		case CTL_MSG_MANAGE_TASKS: {
+			struct ctl_taskio *taskio;
+			taskio = (struct ctl_taskio *)ctl_alloc_io(
+				(void *)ctl_softc->othersc_pool);
+			if (taskio == NULL) {
+				printf("ctl_isc_event_handler: can't allocate "
+				       "ctl_io!\n");
+				/* Bad Juju */
+				/* should I just call the proper reset func
+				   here??? */
+				mtx_unlock(&ctl_softc->ctl_lock);
+				goto bailout;
+			}
+			ctl_zero_io((union ctl_io *)taskio);
+			taskio->io_hdr.io_type = CTL_IO_TASK;
+			taskio->io_hdr.flags |= CTL_FLAG_FROM_OTHER_SC;
+			taskio->io_hdr.nexus = msg_info.hdr.nexus;
+			taskio->task_action = msg_info.task.task_action;
+			taskio->tag_num = msg_info.task.tag_num;
+			taskio->tag_type = msg_info.task.tag_type;
+#ifdef CTL_TIME_IO
+			taskio->io_hdr.start_time = time_uptime;
+			getbintime(&taskio->io_hdr.start_bt);
+#if 0
+			cs_prof_gettime(&taskio->io_hdr.start_ticks);
+#endif
+#endif /* CTL_TIME_IO */
+		        STAILQ_INSERT_TAIL(&ctl_softc->task_queue,
+					   &taskio->io_hdr, links);
+			ctl_softc->flags |= CTL_FLAG_TASK_PENDING;
+			ctl_wakeup_thread();
+			break;
+		}
+		/* Persistent Reserve action which needs attention */
+		case CTL_MSG_PERS_ACTION:
+			presio = (struct ctl_prio *)ctl_alloc_io(
+				(void *)ctl_softc->othersc_pool);
+			if (presio == NULL) {
+				printf("ctl_isc_event_handler: can't allocate "
+				       "ctl_io!\n");
+				/* Bad Juju */
+				/* Need to set busy and send msg back */
+				mtx_unlock(&ctl_softc->ctl_lock);
+				goto bailout;
+			}
+			ctl_zero_io((union ctl_io *)presio);
+			presio->io_hdr.msg_type = CTL_MSG_PERS_ACTION;
+			presio->pr_msg = msg_info.pr;
+		        STAILQ_INSERT_TAIL(&ctl_softc->isc_queue,
+					   &presio->io_hdr, links);
+			ctl_wakeup_thread();
+			break;
+		case CTL_MSG_SYNC_FE:
+			rcv_sync_msg = 1;
+			break;
+		case CTL_MSG_APS_LOCK: {
+			// It's quicker to execute this then to
+			// queue it.
+			struct ctl_lun *lun;
+			struct ctl_page_index *page_index;
+			struct copan_aps_subpage *current_sp;
+
+			lun = ctl_softc->ctl_luns[msg_info.hdr.nexus.targ_lun];
+			page_index = &lun->mode_pages.index[index_to_aps_page];
+			current_sp = (struct copan_aps_subpage *)
+				     (page_index->page_data +
+				     (page_index->page_len * CTL_PAGE_CURRENT));
+
+			current_sp->lock_active = msg_info.aps.lock_flag;
+		        break;
+		}
+		default:
+		        printf("How did I get here?\n");
+		}
+		mtx_unlock(&ctl_softc->ctl_lock);
+	} else if (event == CTL_HA_EVT_MSG_SENT) {
+		if (param != CTL_HA_STATUS_SUCCESS) {
+			printf("Bad status from ctl_ha_msg_send status %d\n",
+			       param);
+		}
+		return;
+	} else if (event == CTL_HA_EVT_DISCONNECT) {
+		printf("CTL: Got a disconnect from Isc\n");
+		return;
+	} else {
+		printf("ctl_isc_event_handler: Unknown event %d\n", event);
+		return;
+	}
+
+bailout:
+	return;
+}
+
+static void
+ctl_copy_sense_data(union ctl_ha_msg *src, union ctl_io *dest)
+{
+	struct scsi_sense_data *sense;
+
+	sense = &dest->scsiio.sense_data;
+	bcopy(&src->scsi.sense_data, sense, sizeof(*sense));
+	dest->scsiio.scsi_status = src->scsi.scsi_status;
+	dest->scsiio.sense_len = src->scsi.sense_len;
+	dest->io_hdr.status = src->hdr.status;
+}
+
+static void
+ctl_init(void)
+{
+	struct ctl_softc *softc;
+	struct ctl_io_pool *internal_pool, *emergency_pool, *other_pool;
+	struct ctl_frontend *fe;
+	struct ctl_lun *lun;
+        uint8_t sc_id =0;
+#if 0
+	int i;
+#endif
+	int retval;
+	//int isc_retval;
+
+	retval = 0;
+	ctl_pause_rtr = 0;
+        rcv_sync_msg = 0;
+
+	control_softc = malloc(sizeof(*control_softc), M_DEVBUF, M_WAITOK);
+	softc = control_softc;
+
+	memset(softc, 0, sizeof(*softc));
+
+	softc->dev = make_dev(&ctl_cdevsw, 0, UID_ROOT, GID_OPERATOR, 0600,
+			      "cam/ctl");
+
+	softc->dev->si_drv1 = softc;
+
+	mtx_init(&softc->ctl_lock, "CTL mutex", NULL, MTX_DEF);
+	softc->open_count = 0;
+
+	/*
+	 * Default to actually sending a SYNCHRONIZE CACHE command down to
+	 * the drive.
+	 */
+	softc->flags = CTL_FLAG_REAL_SYNC;
+
+	/*
+	 * In Copan's HA scheme, the "master" and "slave" roles are
+	 * figured out through the slot the controller is in.  Although it
+	 * is an active/active system, someone has to be in charge.
+ 	 */
+#ifdef NEEDTOPORT
+        scmicro_rw(SCMICRO_GET_SHELF_ID, &sc_id);
+#endif
+
+        if (sc_id == 0) {
+		softc->flags |= CTL_FLAG_MASTER_SHELF;
+		persis_offset = 0;
+	} else
+		persis_offset = CTL_MAX_INITIATORS;
+
+	/*
+	 * XXX KDM need to figure out where we want to get our target ID
+	 * and WWID.  Is it different on each port?
+	 */
+	softc->target.id = 0;
+	softc->target.wwid[0] = 0x12345678;
+	softc->target.wwid[1] = 0x87654321;
+	STAILQ_INIT(&softc->lun_list);
+	STAILQ_INIT(&softc->pending_lun_queue);
+	STAILQ_INIT(&softc->task_queue);
+	STAILQ_INIT(&softc->incoming_queue);
+	STAILQ_INIT(&softc->rtr_queue);
+	STAILQ_INIT(&softc->done_queue);
+	STAILQ_INIT(&softc->isc_queue);
+	STAILQ_INIT(&softc->fe_list);
+	STAILQ_INIT(&softc->be_list);
+	STAILQ_INIT(&softc->io_pools);
+
+	lun = &softc->lun;
+
+	/*
+	 * We don't bother calling these with ctl_lock held here, because,
+	 * in theory, no one else can try to do anything while we're in our
+	 * module init routine.
+	 */
+	if (ctl_pool_create(softc, CTL_POOL_INTERNAL, CTL_POOL_ENTRIES_INTERNAL,
+			    &internal_pool)!= 0){
+		printf("ctl: can't allocate %d entry internal pool, "
+		       "exiting\n", CTL_POOL_ENTRIES_INTERNAL);
+		return;
+	}
+
+	if (ctl_pool_create(softc, CTL_POOL_EMERGENCY,
+			    CTL_POOL_ENTRIES_EMERGENCY, &emergency_pool) != 0) {
+		printf("ctl: can't allocate %d entry emergency pool, "
+		       "exiting\n", CTL_POOL_ENTRIES_EMERGENCY);
+		ctl_pool_free(softc, internal_pool);
+		return;
+	}
+
+	if (ctl_pool_create(softc, CTL_POOL_4OTHERSC, CTL_POOL_ENTRIES_OTHER_SC,
+	                    &other_pool) != 0)
+	{
+		printf("ctl: can't allocate %d entry other SC pool, "
+		       "exiting\n", CTL_POOL_ENTRIES_OTHER_SC);
+		ctl_pool_free(softc, internal_pool);
+		ctl_pool_free(softc, emergency_pool);
+		return;
+	}
+
+	softc->internal_pool = internal_pool;
+	softc->emergency_pool = emergency_pool;
+	softc->othersc_pool = other_pool;
+
+	ctl_pool_acquire(internal_pool);
+	ctl_pool_acquire(emergency_pool);
+	ctl_pool_acquire(other_pool);
+
+	/*
+	 * We used to allocate a processor LUN here.  The new scheme is to
+	 * just let the user allocate LUNs as he sees fit.
+	 */
+#if 0
+	mtx_lock(&softc->ctl_lock);
+	ctl_alloc_lun(softc, lun, /*be_lun*/NULL, /*target*/softc->target);
+	mtx_unlock(&softc->ctl_lock);
+#endif
+
+	if (kproc_create(ctl_work_thread, softc, &softc->work_thread, 0, 0,
+			 "ctl_thrd") != 0) {
+		printf("error creating CTL work thread!\n");
+		ctl_free_lun(lun);
+		ctl_pool_free(softc, internal_pool);
+		ctl_pool_free(softc, emergency_pool);
+		ctl_pool_free(softc, other_pool);
+		return;
+	}
+	printf("ctl: CAM Target Layer loaded\n");
+
+	/*
+	 * Initialize the initiator and portname mappings
+	 */
+	memset(softc->wwpn_iid, 0, sizeof(softc->wwpn_iid));
+
+	/*
+	 * Initialize the ioctl front end.
+	 */
+	fe = &softc->ioctl_info.fe;
+	sprintf(softc->ioctl_info.port_name, "CTL ioctl");
+	fe->port_type = CTL_PORT_IOCTL;
+	fe->num_requested_ctl_io = 100;
+	fe->port_name = softc->ioctl_info.port_name;
+	fe->port_online = ctl_ioctl_online;
+	fe->port_offline = ctl_ioctl_offline;
+	fe->onoff_arg = &softc->ioctl_info;
+	fe->targ_enable = ctl_ioctl_targ_enable;
+	fe->targ_disable = ctl_ioctl_targ_disable;
+	fe->lun_enable = ctl_ioctl_lun_enable;
+	fe->lun_disable = ctl_ioctl_lun_disable;
+	fe->targ_lun_arg = &softc->ioctl_info;
+	fe->fe_datamove = ctl_ioctl_datamove;
+	fe->fe_done = ctl_ioctl_done;
+	fe->max_targets = 15;
+	fe->max_target_id = 15;
+
+	if (ctl_frontend_register(&softc->ioctl_info.fe,
+	                  (softc->flags & CTL_FLAG_MASTER_SHELF)) != 0) {
+		printf("ctl: ioctl front end registration failed, will "
+		       "continue anyway\n");
+	}
+
+#ifdef CTL_IO_DELAY
+	if (sizeof(struct callout) > CTL_TIMER_BYTES) {
+		printf("sizeof(struct callout) %zd > CTL_TIMER_BYTES %zd\n",
+		       sizeof(struct callout), CTL_TIMER_BYTES);
+		return;
+	}
+#endif /* CTL_IO_DELAY */
+
+}
+
+void
+ctl_shutdown(void)
+{
+	struct ctl_softc *softc;
+	struct ctl_lun *lun, *next_lun;
+	struct ctl_io_pool *pool, *next_pool;
+
+	softc = (struct ctl_softc *)control_softc;
+
+	if (ctl_frontend_deregister(&softc->ioctl_info.fe) != 0)
+		printf("ctl: ioctl front end deregistration failed\n");
+
+	mtx_lock(&softc->ctl_lock);
+
+	/*
+	 * Free up each LUN.
+	 */
+	for (lun = STAILQ_FIRST(&softc->lun_list); lun != NULL; lun = next_lun){
+		next_lun = STAILQ_NEXT(lun, links);
+		ctl_free_lun(lun);
+	}
+
+	/*
+	 * This will rip the rug out from under any FETDs or anyone else
+	 * that has a pool allocated.  Since we increment our module
+	 * refcount any time someone outside the main CTL module allocates
+	 * a pool, we shouldn't have any problems here.  The user won't be
+	 * able to unload the CTL module until client modules have
+	 * successfully unloaded.
+	 */
+	for (pool = STAILQ_FIRST(&softc->io_pools); pool != NULL;
+	     pool = next_pool) {
+		next_pool = STAILQ_NEXT(pool, links);
+		ctl_pool_free(softc, pool);
+	}
+
+	mtx_unlock(&softc->ctl_lock);
+
+#if 0
+	ctl_shutdown_thread(softc->work_thread);
+#endif
+
+	mtx_destroy(&softc->ctl_lock);
+
+	destroy_dev(softc->dev);
+
+	printf("ctl: CAM Target Layer unloaded\n");
+}
+
+/*
+ * XXX KDM should we do some access checks here?  Bump a reference count to
+ * prevent a CTL module from being unloaded while someone has it open?
+ */
+static int
+ctl_open(struct cdev *dev, int flags, int fmt, struct thread *td)
+{
+	return (0);
+}
+
+static int
+ctl_close(struct cdev *dev, int flags, int fmt, struct thread *td)
+{
+	return (0);
+}
+
+int
+ctl_port_enable(ctl_port_type port_type)
+{
+	struct ctl_softc *softc;
+	struct ctl_frontend *fe;
+
+	if (ctl_is_single == 0) {
+		union ctl_ha_msg msg_info;
+		int isc_retval;
+
+#if 0
+		printf("%s: HA mode, synchronizing frontend enable\n",
+		        __func__);
+#endif
+		msg_info.hdr.msg_type = CTL_MSG_SYNC_FE;
+	        if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+		        sizeof(msg_info), 1 )) > CTL_HA_STATUS_SUCCESS) {
+			printf("Sync msg send error retval %d\n", isc_retval);
+		}
+		if (!rcv_sync_msg) {
+			isc_retval=ctl_ha_msg_recv(CTL_HA_CHAN_CTL, &msg_info,
+			        sizeof(msg_info), 1);
+		}
+#if 0
+        	printf("CTL:Frontend Enable\n");
+	} else {
+		printf("%s: single mode, skipping frontend synchronization\n",
+		        __func__);
+#endif
+	}
+
+	softc = control_softc;
+
+	STAILQ_FOREACH(fe, &softc->fe_list, links) {
+		if (port_type & fe->port_type)
+		{
+#if 0
+			printf("port %d\n", fe->targ_port);
+#endif
+			ctl_frontend_online(fe);
+		}
+	}
+
+	return (0);
+}
+
+int
+ctl_port_disable(ctl_port_type port_type)
+{
+	struct ctl_softc *softc;
+	struct ctl_frontend *fe;
+
+	softc = control_softc;
+
+	STAILQ_FOREACH(fe, &softc->fe_list, links) {
+		if (port_type & fe->port_type)
+			ctl_frontend_offline(fe);
+	}
+
+	return (0);
+}
+
+/*
+ * Returns 0 for success, 1 for failure.
+ * Currently the only failure mode is if there aren't enough entries
+ * allocated.  So, in case of a failure, look at num_entries_dropped,
+ * reallocate and try again.
+ */
+int
+ctl_port_list(struct ctl_port_entry *entries, int num_entries_alloced,
+	      int *num_entries_filled, int *num_entries_dropped,
+	      ctl_port_type port_type, int no_virtual)
+{
+	struct ctl_softc *softc;
+	struct ctl_frontend *fe;
+	int entries_dropped, entries_filled;
+	int retval;
+	int i;
+
+	softc = control_softc;
+
+	retval = 0;
+	entries_filled = 0;
+	entries_dropped = 0;
+
+	i = 0;
+	mtx_lock(&softc->ctl_lock);
+	STAILQ_FOREACH(fe, &softc->fe_list, links) {
+		struct ctl_port_entry *entry;
+
+		if ((fe->port_type & port_type) == 0)
+			continue;
+
+		if ((no_virtual != 0)
+		 && (fe->virtual_port != 0))
+			continue;
+
+		if (entries_filled >= num_entries_alloced) {
+			entries_dropped++;
+			continue;
+		}
+		entry = &entries[i];
+
+		entry->port_type = fe->port_type;
+		strlcpy(entry->port_name, fe->port_name,
+			sizeof(entry->port_name));
+		entry->physical_port = fe->physical_port;
+		entry->virtual_port = fe->virtual_port;
+		entry->wwnn = fe->wwnn;
+		entry->wwpn = fe->wwpn;
+
+		i++;
+		entries_filled++;
+	}
+
+	mtx_unlock(&softc->ctl_lock);
+
+	if (entries_dropped > 0)
+		retval = 1;
+
+	*num_entries_dropped = entries_dropped;
+	*num_entries_filled = entries_filled;
+
+	return (retval);
+}
+
+static void
+ctl_ioctl_online(void *arg)
+{
+	struct ctl_ioctl_info *ioctl_info;
+
+	ioctl_info = (struct ctl_ioctl_info *)arg;
+
+	ioctl_info->flags |= CTL_IOCTL_FLAG_ENABLED;
+}
+
+static void
+ctl_ioctl_offline(void *arg)
+{
+	struct ctl_ioctl_info *ioctl_info;
+
+	ioctl_info = (struct ctl_ioctl_info *)arg;
+
+	ioctl_info->flags &= ~CTL_IOCTL_FLAG_ENABLED;
+}
+
+/*
+ * Remove an initiator by port number and initiator ID.
+ * Returns 0 for success, 1 for failure.
+ * Assumes the caller does NOT hold the CTL lock.
+ */
+int
+ctl_remove_initiator(int32_t targ_port, uint32_t iid)
+{
+	struct ctl_softc *softc;
+
+	softc = control_softc;
+
+	if ((targ_port < 0)
+	 || (targ_port > CTL_MAX_PORTS)) {
+		printf("%s: invalid port number %d\n", __func__, targ_port);
+		return (1);
+	}
+	if (iid > CTL_MAX_INIT_PER_PORT) {
+		printf("%s: initiator ID %u > maximun %u!\n",
+		       __func__, iid, CTL_MAX_INIT_PER_PORT);
+		return (1);
+	}
+
+	mtx_lock(&softc->ctl_lock);
+
+	softc->wwpn_iid[targ_port][iid].in_use = 0;
+
+	mtx_unlock(&softc->ctl_lock);
+
+	return (0);
+}
+
+/*
+ * Add an initiator to the initiator map.
+ * Returns 0 for success, 1 for failure.
+ * Assumes the caller does NOT hold the CTL lock.
+ */
+int
+ctl_add_initiator(uint64_t wwpn, int32_t targ_port, uint32_t iid)
+{
+	struct ctl_softc *softc;
+	int retval;
+
+	softc = control_softc;
+
+	retval = 0;
+
+	if ((targ_port < 0)
+	 || (targ_port > CTL_MAX_PORTS)) {
+		printf("%s: invalid port number %d\n", __func__, targ_port);
+		return (1);
+	}
+	if (iid > CTL_MAX_INIT_PER_PORT) {
+		printf("%s: WWPN %#jx initiator ID %u > maximun %u!\n",
+		       __func__, wwpn, iid, CTL_MAX_INIT_PER_PORT);
+		return (1);
+	}
+
+	mtx_lock(&softc->ctl_lock);
+
+	if (softc->wwpn_iid[targ_port][iid].in_use != 0) {
+		/*
+		 * We don't treat this as an error.
+		 */
+		if (softc->wwpn_iid[targ_port][iid].wwpn == wwpn) {
+			printf("%s: port %d iid %u WWPN %#jx arrived again?\n",
+			       __func__, targ_port, iid, (uintmax_t)wwpn);
+			goto bailout;
+		}
+
+		/*
+		 * This is an error, but what do we do about it?  The
+		 * driver is telling us we have a new WWPN for this
+		 * initiator ID, so we pretty much need to use it.
+		 */
+		printf("%s: port %d iid %u WWPN %#jx arrived, WWPN %#jx is "
+		       "still at that address\n", __func__, targ_port, iid,
+		       (uintmax_t)wwpn,
+		       (uintmax_t)softc->wwpn_iid[targ_port][iid].wwpn);
+
+		/*
+		 * XXX KDM clear have_ca and ua_pending on each LUN for
+		 * this initiator.
+		 */
+	}
+	softc->wwpn_iid[targ_port][iid].in_use = 1;
+	softc->wwpn_iid[targ_port][iid].iid = iid;
+	softc->wwpn_iid[targ_port][iid].wwpn = wwpn;
+	softc->wwpn_iid[targ_port][iid].port = targ_port;
+
+bailout:
+
+	mtx_unlock(&softc->ctl_lock);
+
+	return (retval);
+}
+
+/*
+ * XXX KDM should we pretend to do something in the target/lun
+ * enable/disable functions?
+ */
+static int
+ctl_ioctl_targ_enable(void *arg, struct ctl_id targ_id)
+{
+	return (0);
+}
+
+static int
+ctl_ioctl_targ_disable(void *arg, struct ctl_id targ_id)
+{
+	return (0);
+}
+
+static int
+ctl_ioctl_lun_enable(void *arg, struct ctl_id targ_id, int lun_id)
+{
+	return (0);
+}
+
+static int
+ctl_ioctl_lun_disable(void *arg, struct ctl_id targ_id, int lun_id)
+{
+	return (0);
+}
+
+/*
+ * Data movement routine for the CTL ioctl frontend port.
+ */
+static int
+ctl_ioctl_do_datamove(struct ctl_scsiio *ctsio)
+{
+	struct ctl_sg_entry *ext_sglist, *kern_sglist;
+	struct ctl_sg_entry ext_entry, kern_entry;
+	int ext_sglen, ext_sg_entries, kern_sg_entries;
+	int ext_sg_start, ext_offset;
+	int len_to_copy, len_copied;
+	int kern_watermark, ext_watermark;
+	int ext_sglist_malloced;
+	int i, j;
+
+	ext_sglist_malloced = 0;
+	ext_sg_start = 0;
+	ext_offset = 0;
+
+	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove\n"));
+
+	/*
+	 * If this flag is set, fake the data transfer.
+	 */
+	if (ctsio->io_hdr.flags & CTL_FLAG_NO_DATAMOVE) {
+		ctsio->ext_data_filled = ctsio->ext_data_len;
+		goto bailout;
+	}
+
+	/*
+	 * To simplify things here, if we have a single buffer, stick it in
+	 * a S/G entry and just make it a single entry S/G list.
+	 */
+	if (ctsio->io_hdr.flags & CTL_FLAG_EDPTR_SGLIST) {
+		int len_seen;
+
+		ext_sglen = ctsio->ext_sg_entries * sizeof(*ext_sglist);
+
+		ext_sglist = (struct ctl_sg_entry *)malloc(ext_sglen, M_CTL,
+							   M_WAITOK);
+		if (ext_sglist == NULL) {
+			ctl_set_internal_failure(ctsio,
+						 /*sks_valid*/ 0,
+						 /*retry_count*/ 0);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		ext_sglist_malloced = 1;
+		if (copyin(ctsio->ext_data_ptr, ext_sglist,
+				   ext_sglen) != 0) {
+			ctl_set_internal_failure(ctsio,
+						 /*sks_valid*/ 0,
+						 /*retry_count*/ 0);
+			goto bailout;
+		}
+		ext_sg_entries = ctsio->ext_sg_entries;
+		len_seen = 0;
+		for (i = 0; i < ext_sg_entries; i++) {
+			if ((len_seen + ext_sglist[i].len) >=
+			     ctsio->ext_data_filled) {
+				ext_sg_start = i;
+				ext_offset = ctsio->ext_data_filled - len_seen;
+				break;
+			}
+			len_seen += ext_sglist[i].len;
+		}
+	} else {
+		ext_sglist = &ext_entry;
+		ext_sglist->addr = ctsio->ext_data_ptr;
+		ext_sglist->len = ctsio->ext_data_len;
+		ext_sg_entries = 1;
+		ext_sg_start = 0;
+		ext_offset = ctsio->ext_data_filled;
+	}
+
+	if (ctsio->kern_sg_entries > 0) {
+		kern_sglist = (struct ctl_sg_entry *)ctsio->kern_data_ptr;
+		kern_sg_entries = ctsio->kern_sg_entries;
+	} else {
+		kern_sglist = &kern_entry;
+		kern_sglist->addr = ctsio->kern_data_ptr;
+		kern_sglist->len = ctsio->kern_data_len;
+		kern_sg_entries = 1;
+	}
+
+
+	kern_watermark = 0;
+	ext_watermark = ext_offset;
+	len_copied = 0;
+	for (i = ext_sg_start, j = 0;
+	     i < ext_sg_entries && j < kern_sg_entries;) {
+		uint8_t *ext_ptr, *kern_ptr;
+
+		len_to_copy = ctl_min(ext_sglist[i].len - ext_watermark,
+				      kern_sglist[j].len - kern_watermark);
+
+		ext_ptr = (uint8_t *)ext_sglist[i].addr;
+		ext_ptr = ext_ptr + ext_watermark;
+		if (ctsio->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
+			/*
+			 * XXX KDM fix this!
+			 */
+			panic("need to implement bus address support");
+#if 0
+			kern_ptr = bus_to_virt(kern_sglist[j].addr);
+#endif
+		} else
+			kern_ptr = (uint8_t *)kern_sglist[j].addr;
+		kern_ptr = kern_ptr + kern_watermark;
+
+		kern_watermark += len_to_copy;
+		ext_watermark += len_to_copy;
+
+		if ((ctsio->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
+		     CTL_FLAG_DATA_IN) {
+			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: copying %d "
+					 "bytes to user\n", len_to_copy));
+			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: from %p "
+					 "to %p\n", kern_ptr, ext_ptr));
+			if (copyout(kern_ptr, ext_ptr, len_to_copy) != 0) {
+				ctl_set_internal_failure(ctsio,
+							 /*sks_valid*/ 0,
+							 /*retry_count*/ 0);
+				goto bailout;
+			}
+		} else {
+			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: copying %d "
+					 "bytes from user\n", len_to_copy));
+			CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: from %p "
+					 "to %p\n", ext_ptr, kern_ptr));
+			if (copyin(ext_ptr, kern_ptr, len_to_copy)!= 0){
+				ctl_set_internal_failure(ctsio,
+							 /*sks_valid*/ 0,
+							 /*retry_count*/0);
+				goto bailout;
+			}
+		}
+
+		len_copied += len_to_copy;
+
+		if (ext_sglist[i].len == ext_watermark) {
+			i++;
+			ext_watermark = 0;
+		}
+
+		if (kern_sglist[j].len == kern_watermark) {
+			j++;
+			kern_watermark = 0;
+		}
+	}
+
+	ctsio->ext_data_filled += len_copied;
+
+	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: ext_sg_entries: %d, "
+			 "kern_sg_entries: %d\n", ext_sg_entries,
+			 kern_sg_entries));
+	CTL_DEBUG_PRINT(("ctl_ioctl_do_datamove: ext_data_len = %d, "
+			 "kern_data_len = %d\n", ctsio->ext_data_len,
+			 ctsio->kern_data_len));
+
+
+	/* XXX KDM set residual?? */
+bailout:
+
+	if (ext_sglist_malloced != 0)
+		free(ext_sglist, M_CTL);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * Serialize a command that went down the "wrong" side, and so was sent to
+ * this controller for execution.  The logic is a little different than the
+ * standard case in ctl_scsiio_precheck().  Errors in this case need to get
+ * sent back to the other side, but in the success case, we execute the
+ * command on this side (XFER mode) or tell the other side to execute it
+ * (SER_ONLY mode).
+ */
+static int
+ctl_serialize_other_sc_cmd(struct ctl_scsiio *ctsio, int have_lock)
+{
+	struct ctl_softc *ctl_softc;
+	union ctl_ha_msg msg_info;
+	struct ctl_lun *lun;
+	int retval = 0;
+
+	ctl_softc = control_softc;
+	if (have_lock == 0)
+		mtx_lock(&ctl_softc->ctl_lock);
+
+	lun = ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun];
+	if (lun==NULL)
+	{
+		/*
+		 * Why isn't LUN defined? The other side wouldn't
+		 * send a cmd if the LUN is undefined.
+		 */
+		printf("%s: Bad JUJU!, LUN is NULL!\n", __func__);
+
+		/* "Logical unit not supported" */
+		ctl_set_sense_data(&msg_info.scsi.sense_data,
+				   lun,
+				   /*sense_format*/SSD_TYPE_NONE,
+				   /*current_error*/ 1,
+				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+				   /*asc*/ 0x25,
+				   /*ascq*/ 0x00,
+				   SSD_ELEM_NONE);
+
+		msg_info.scsi.sense_len = SSD_FULL_SIZE;
+		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
+		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
+		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
+		msg_info.hdr.serializing_sc = NULL;
+		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
+	        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+				sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
+		}
+		if (have_lock == 0)
+			mtx_unlock(&ctl_softc->ctl_lock);
+		return(1);
+
+	}
+
+    	TAILQ_INSERT_TAIL(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
+
+	switch (ctl_check_ooa(lun, (union ctl_io *)ctsio,
+		(union ctl_io *)TAILQ_PREV(&ctsio->io_hdr, ctl_ooaq,
+		 ooa_links))) {
+	case CTL_ACTION_BLOCK:
+		ctsio->io_hdr.flags |= CTL_FLAG_BLOCKED;
+		TAILQ_INSERT_TAIL(&lun->blocked_queue, &ctsio->io_hdr,
+				  blocked_links);
+		break;
+	case CTL_ACTION_PASS:
+	case CTL_ACTION_SKIP:
+		if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
+			ctsio->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
+			STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
+					   &ctsio->io_hdr, links);
+		} else {
+
+			/* send msg back to other side */
+			msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
+			msg_info.hdr.serializing_sc = (union ctl_io *)ctsio;
+			msg_info.hdr.msg_type = CTL_MSG_R2R;
+#if 0
+			printf("2. pOrig %x\n", (int)msg_info.hdr.original_sc);
+#endif
+		        if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+			    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
+			}
+		}
+		break;
+	case CTL_ACTION_OVERLAP:
+		/* OVERLAPPED COMMANDS ATTEMPTED */
+		ctl_set_sense_data(&msg_info.scsi.sense_data,
+				   lun,
+				   /*sense_format*/SSD_TYPE_NONE,
+				   /*current_error*/ 1,
+				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+				   /*asc*/ 0x4E,
+				   /*ascq*/ 0x00,
+				   SSD_ELEM_NONE);
+
+		msg_info.scsi.sense_len = SSD_FULL_SIZE;
+		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
+		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
+		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
+		msg_info.hdr.serializing_sc = NULL;
+		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
+#if 0
+		printf("BAD JUJU:Major Bummer Overlap\n");
+#endif
+		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
+		retval = 1;
+		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
+		}
+		break;
+	case CTL_ACTION_OVERLAP_TAG:
+		/* TAGGED OVERLAPPED COMMANDS (NN = QUEUE TAG) */
+		ctl_set_sense_data(&msg_info.scsi.sense_data,
+				   lun,
+				   /*sense_format*/SSD_TYPE_NONE,
+				   /*current_error*/ 1,
+				   /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+				   /*asc*/ 0x4D,
+				   /*ascq*/ ctsio->tag_num & 0xff,
+				   SSD_ELEM_NONE);
+
+		msg_info.scsi.sense_len = SSD_FULL_SIZE;
+		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
+		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
+		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
+		msg_info.hdr.serializing_sc = NULL;
+		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
+#if 0
+		printf("BAD JUJU:Major Bummer Overlap Tag\n");
+#endif
+		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
+		retval = 1;
+		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
+		}
+		break;
+	case CTL_ACTION_ERROR:
+	default:
+		/* "Internal target failure" */
+		ctl_set_sense_data(&msg_info.scsi.sense_data,
+				   lun,
+				   /*sense_format*/SSD_TYPE_NONE,
+				   /*current_error*/ 1,
+				   /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
+				   /*asc*/ 0x44,
+				   /*ascq*/ 0x00,
+				   SSD_ELEM_NONE);
+
+		msg_info.scsi.sense_len = SSD_FULL_SIZE;
+		msg_info.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
+		msg_info.hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
+		msg_info.hdr.original_sc = ctsio->io_hdr.original_sc;
+		msg_info.hdr.serializing_sc = NULL;
+		msg_info.hdr.msg_type = CTL_MSG_BAD_JUJU;
+#if 0
+		printf("BAD JUJU:Major Bummer HW Error\n");
+#endif
+		TAILQ_REMOVE(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
+		retval = 1;
+		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_info,
+		    sizeof(msg_info), 0 ) > CTL_HA_STATUS_SUCCESS) {
+		}
+		break;
+	}
+	if (have_lock == 0)
+		mtx_unlock(&ctl_softc->ctl_lock);
+	return (retval);
+}
+
+static int
+ctl_ioctl_submit_wait(union ctl_io *io)
+{
+	struct ctl_fe_ioctl_params params;
+	ctl_fe_ioctl_state last_state;
+	int done, retval;
+
+	retval = 0;
+
+	bzero(&params, sizeof(params));
+
+	mtx_init(&params.ioctl_mtx, "ctliocmtx", NULL, MTX_DEF);
+	cv_init(&params.sem, "ctlioccv");
+	params.state = CTL_IOCTL_INPROG;
+	last_state = params.state;
+
+	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = ¶ms;
+
+	CTL_DEBUG_PRINT(("ctl_ioctl_submit_wait\n"));
+
+	/* This shouldn't happen */
+	if ((retval = ctl_queue(io)) != CTL_RETVAL_COMPLETE)
+		return (retval);
+
+	done = 0;
+
+	do {
+		mtx_lock(&params.ioctl_mtx);
+		/*
+		 * Check the state here, and don't sleep if the state has
+		 * already changed (i.e. wakeup has already occured, but we
+		 * weren't waiting yet).
+		 */
+		if (params.state == last_state) {
+			/* XXX KDM cv_wait_sig instead? */
+			cv_wait(&params.sem, &params.ioctl_mtx);
+		}
+		last_state = params.state;
+
+		switch (params.state) {
+		case CTL_IOCTL_INPROG:
+			/* Why did we wake up? */
+			/* XXX KDM error here? */
+			mtx_unlock(&params.ioctl_mtx);
+			break;
+		case CTL_IOCTL_DATAMOVE:
+			CTL_DEBUG_PRINT(("got CTL_IOCTL_DATAMOVE\n"));
+
+			/*
+			 * change last_state back to INPROG to avoid
+			 * deadlock on subsequent data moves.
+			 */
+			params.state = last_state = CTL_IOCTL_INPROG;
+
+			mtx_unlock(&params.ioctl_mtx);
+			ctl_ioctl_do_datamove(&io->scsiio);
+			/*
+			 * Note that in some cases, most notably writes,
+			 * this will queue the I/O and call us back later.
+			 * In other cases, generally reads, this routine
+			 * will immediately call back and wake us up,
+			 * probably using our own context.
+			 */
+			io->scsiio.be_move_done(io);
+			break;
+		case CTL_IOCTL_DONE:
+			mtx_unlock(&params.ioctl_mtx);
+			CTL_DEBUG_PRINT(("got CTL_IOCTL_DONE\n"));
+			done = 1;
+			break;
+		default:
+			mtx_unlock(&params.ioctl_mtx);
+			/* XXX KDM error here? */
+			break;
+		}
+	} while (done == 0);
+
+	mtx_destroy(&params.ioctl_mtx);
+	cv_destroy(&params.sem);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+static void
+ctl_ioctl_datamove(union ctl_io *io)
+{
+	struct ctl_fe_ioctl_params *params;
+
+	params = (struct ctl_fe_ioctl_params *)
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+
+	mtx_lock(&params->ioctl_mtx);
+	params->state = CTL_IOCTL_DATAMOVE;
+	cv_broadcast(&params->sem);
+	mtx_unlock(&params->ioctl_mtx);
+}
+
+static void
+ctl_ioctl_done(union ctl_io *io)
+{
+	struct ctl_fe_ioctl_params *params;
+
+	params = (struct ctl_fe_ioctl_params *)
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+
+	mtx_lock(&params->ioctl_mtx);
+	params->state = CTL_IOCTL_DONE;
+	cv_broadcast(&params->sem);
+	mtx_unlock(&params->ioctl_mtx);
+}
+
+static void
+ctl_ioctl_hard_startstop_callback(void *arg, struct cfi_metatask *metatask)
+{
+	struct ctl_fe_ioctl_startstop_info *sd_info;
+
+	sd_info = (struct ctl_fe_ioctl_startstop_info *)arg;
+
+	sd_info->hs_info.status = metatask->status;
+	sd_info->hs_info.total_luns = metatask->taskinfo.startstop.total_luns;
+	sd_info->hs_info.luns_complete =
+		metatask->taskinfo.startstop.luns_complete;
+	sd_info->hs_info.luns_failed = metatask->taskinfo.startstop.luns_failed;
+
+	cv_broadcast(&sd_info->sem);
+}
+
+static void
+ctl_ioctl_bbrread_callback(void *arg, struct cfi_metatask *metatask)
+{
+	struct ctl_fe_ioctl_bbrread_info *fe_bbr_info;
+
+	fe_bbr_info = (struct ctl_fe_ioctl_bbrread_info *)arg;
+
+	mtx_lock(fe_bbr_info->lock);
+	fe_bbr_info->bbr_info->status = metatask->status;
+	fe_bbr_info->bbr_info->bbr_status = metatask->taskinfo.bbrread.status;
+	fe_bbr_info->wakeup_done = 1;
+	mtx_unlock(fe_bbr_info->lock);
+
+	cv_broadcast(&fe_bbr_info->sem);
+}
+
+/*
+ * Must be called with the ctl_lock held.
+ * Returns 0 for success, errno for failure.
+ */
+static int
+ctl_ioctl_fill_ooa(struct ctl_lun *lun, uint32_t *cur_fill_num,
+		   struct ctl_ooa *ooa_hdr)
+{
+	union ctl_io *io;
+	int retval;
+
+	retval = 0;
+
+	for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); (io != NULL);
+	     (*cur_fill_num)++, io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,
+	     ooa_links)) {
+		struct ctl_ooa_entry *cur_entry, entry;
+
+		/*
+		 * If we've got more than we can fit, just count the
+		 * remaining entries.
+		 */
+		if (*cur_fill_num >= ooa_hdr->alloc_num)
+			continue;
+
+		cur_entry = &ooa_hdr->entries[*cur_fill_num];
+
+		bzero(&entry, sizeof(entry));
+
+		entry.tag_num = io->scsiio.tag_num;
+		entry.lun_num = lun->lun;
+#ifdef CTL_TIME_IO
+		entry.start_bt = io->io_hdr.start_bt;
+#endif
+		bcopy(io->scsiio.cdb, entry.cdb, io->scsiio.cdb_len);
+		entry.cdb_len = io->scsiio.cdb_len;
+		if (io->io_hdr.flags & CTL_FLAG_BLOCKED)
+			entry.cmd_flags |= CTL_OOACMD_FLAG_BLOCKED;
+
+		if (io->io_hdr.flags & CTL_FLAG_DMA_INPROG)
+			entry.cmd_flags |= CTL_OOACMD_FLAG_DMA;
+
+		if (io->io_hdr.flags & CTL_FLAG_ABORT)
+			entry.cmd_flags |= CTL_OOACMD_FLAG_ABORT;
+
+		if (io->io_hdr.flags & CTL_FLAG_IS_WAS_ON_RTR)
+			entry.cmd_flags |= CTL_OOACMD_FLAG_RTR;
+
+		if (io->io_hdr.flags & CTL_FLAG_DMA_QUEUED)
+			entry.cmd_flags |= CTL_OOACMD_FLAG_DMA_QUEUED;
+
+		retval = copyout(&entry, cur_entry, sizeof(entry));
+
+		if (retval != 0)
+			break;
+	}
+
+	return (retval);
+}
+
+static void *
+ctl_copyin_alloc(void *user_addr, int len, char *error_str,
+		 size_t error_str_len)
+{
+	void *kptr;
+
+	kptr = malloc(len, M_CTL, M_WAITOK | M_ZERO);
+	if (kptr == NULL) {
+		snprintf(error_str, error_str_len, "Cannot allocate %d bytes",
+			 len);
+		return (NULL);
+	}
+
+	if (copyin(user_addr, kptr, len) != 0) {
+		snprintf(error_str, error_str_len, "Error copying %d bytes "
+			 "from user address %p to kernel address %p", len,
+			 user_addr, kptr);
+		free(kptr, M_CTL);
+		return (NULL);
+	}
+
+	return (kptr);
+}
+
+static void
+ctl_free_args(int num_be_args, struct ctl_be_arg *be_args)
+{
+	int i;
+
+	if (be_args == NULL)
+		return;
+
+	for (i = 0; i < num_be_args; i++) {
+		free(be_args[i].kname, M_CTL);
+		free(be_args[i].kvalue, M_CTL);
+	}
+
+	free(be_args, M_CTL);
+}
+
+static struct ctl_be_arg *
+ctl_copyin_args(int num_be_args, struct ctl_be_arg *be_args,
+		char *error_str, size_t error_str_len)
+{
+	struct ctl_be_arg *args;
+	int i;
+
+	args = ctl_copyin_alloc(be_args, num_be_args * sizeof(*be_args),
+				error_str, error_str_len);
+
+	if (args == NULL)
+		goto bailout;
+
+	for (i = 0; i < num_be_args; i++) {
+		uint8_t *tmpptr;
+
+		args[i].kname = ctl_copyin_alloc(args[i].name,
+			args[i].namelen, error_str, error_str_len);
+		if (args[i].kname == NULL)
+			goto bailout;
+
+		if (args[i].kname[args[i].namelen - 1] != '\0') {
+			snprintf(error_str, error_str_len, "Argument %d "
+				 "name is not NUL-terminated", i);
+			goto bailout;
+		}
+
+		args[i].kvalue = NULL;
+
+		tmpptr = ctl_copyin_alloc(args[i].value,
+			args[i].vallen, error_str, error_str_len);
+		if (tmpptr == NULL)
+			goto bailout;
+
+		args[i].kvalue = tmpptr;
+
+		if ((args[i].flags & CTL_BEARG_ASCII)
+		 && (tmpptr[args[i].vallen - 1] != '\0')) {
+			snprintf(error_str, error_str_len, "Argument %d "
+				 "value is not NUL-terminated", i);
+			goto bailout;
+		}
+	}
+
+	return (args);
+bailout:
+
+	ctl_free_args(num_be_args, args);
+
+	return (NULL);
+}
+
+/*
+ * Escape characters that are illegal or not recommended in XML.
+ */
+int
+ctl_sbuf_printf_esc(struct sbuf *sb, char *str)
+{
+	int retval;
+
+	retval = 0;
+
+	for (; *str; str++) {
+		switch (*str) {
+		case '&':
+			retval = sbuf_printf(sb, "&");
+			break;
+		case '>':
+			retval = sbuf_printf(sb, ">");
+			break;
+		case '<':
+			retval = sbuf_printf(sb, "<");
+			break;
+		default:
+			retval = sbuf_putc(sb, *str);
+			break;
+		}
+
+		if (retval != 0)
+			break;
+
+	}
+
+	return (retval);
+}
+
+static int
+ctl_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
+	  struct thread *td)
+{
+	struct ctl_softc *softc;
+	int retval;
+
+	softc = control_softc;
+
+	retval = 0;
+
+	switch (cmd) {
+	case CTL_IO: {
+		union ctl_io *io;
+		void *pool_tmp;
+
+		/*
+		 * If we haven't been "enabled", don't allow any SCSI I/O
+		 * to this FETD.
+		 */
+		if ((softc->ioctl_info.flags & CTL_IOCTL_FLAG_ENABLED) == 0) {
+			retval = -EPERM;
+			break;
+		}
+
+		io = ctl_alloc_io(softc->ioctl_info.fe.ctl_pool_ref);
+		if (io == NULL) {
+			printf("ctl_ioctl: can't allocate ctl_io!\n");
+			retval = -ENOSPC;
+			break;
+		}
+
+		/*
+		 * Need to save the pool reference so it doesn't get
+		 * spammed by the user's ctl_io.
+		 */
+		pool_tmp = io->io_hdr.pool;
+
+		memcpy(io, (void *)addr, sizeof(*io));
+
+		io->io_hdr.pool = pool_tmp;
+		/*
+		 * No status yet, so make sure the status is set properly.
+		 */
+		io->io_hdr.status = CTL_STATUS_NONE;
+
+		/*
+		 * The user sets the initiator ID, target and LUN IDs.
+		 */
+		io->io_hdr.nexus.targ_port = softc->ioctl_info.fe.targ_port;
+		io->io_hdr.flags |= CTL_FLAG_USER_REQ;
+		if ((io->io_hdr.io_type == CTL_IO_SCSI)
+		 && (io->scsiio.tag_type != CTL_TAG_UNTAGGED))
+			io->scsiio.tag_num = softc->ioctl_info.cur_tag_num++;
+
+		retval = ctl_ioctl_submit_wait(io);
+
+		if (retval != 0) {
+			ctl_free_io(io);
+			break;
+		}
+
+		memcpy((void *)addr, io, sizeof(*io));
+
+		/* return this to our pool */
+		ctl_free_io(io);
+
+		break;
+	}
+	case CTL_ENABLE_PORT:
+	case CTL_DISABLE_PORT:
+	case CTL_SET_PORT_WWNS: {
+		struct ctl_frontend *fe;
+		struct ctl_port_entry *entry;
+
+		entry = (struct ctl_port_entry *)addr;
+		
+		mtx_lock(&softc->ctl_lock);
+		STAILQ_FOREACH(fe, &softc->fe_list, links) {
+			int action, done;
+
+			action = 0;
+			done = 0;
+
+			if ((entry->port_type == CTL_PORT_NONE)
+			 && (entry->targ_port == fe->targ_port)) {
+				/*
+				 * If the user only wants to enable or
+				 * disable or set WWNs on a specific port,
+				 * do the operation and we're done.
+				 */
+				action = 1;
+				done = 1;
+			} else if (entry->port_type & fe->port_type) {
+				/*
+				 * Compare the user's type mask with the
+				 * particular frontend type to see if we
+				 * have a match.
+				 */
+				action = 1;
+				done = 0;
+
+				/*
+				 * Make sure the user isn't trying to set
+				 * WWNs on multiple ports at the same time.
+				 */
+				if (cmd == CTL_SET_PORT_WWNS) {
+					printf("%s: Can't set WWNs on "
+					       "multiple ports\n", __func__);
+					retval = EINVAL;
+					break;
+				}
+			}
+			if (action != 0) {
+				/*
+				 * XXX KDM we have to drop the lock here,
+				 * because the online/offline operations
+				 * can potentially block.  We need to
+				 * reference count the frontends so they
+				 * can't go away,
+				 */
+				mtx_unlock(&softc->ctl_lock);
+
+				if (cmd == CTL_ENABLE_PORT)
+					ctl_frontend_online(fe);
+				else if (cmd == CTL_DISABLE_PORT)
+					ctl_frontend_offline(fe);
+
+				mtx_lock(&softc->ctl_lock);
+
+				if (cmd == CTL_SET_PORT_WWNS)
+					ctl_frontend_set_wwns(fe,
+					    (entry->flags & CTL_PORT_WWNN_VALID) ?
+					    1 : 0, entry->wwnn,
+					    (entry->flags & CTL_PORT_WWPN_VALID) ?
+					    1 : 0, entry->wwpn);
+			}
+			if (done != 0)
+				break;
+		}
+		mtx_unlock(&softc->ctl_lock);
+		break;
+	}
+	case CTL_GET_PORT_LIST: {
+		struct ctl_frontend *fe;
+		struct ctl_port_list *list;
+		int i;
+
+		list = (struct ctl_port_list *)addr;
+
+		if (list->alloc_len != (list->alloc_num *
+		    sizeof(struct ctl_port_entry))) {
+			printf("%s: CTL_GET_PORT_LIST: alloc_len %u != "
+			       "alloc_num %u * sizeof(struct ctl_port_entry) "
+			       "%zu\n", __func__, list->alloc_len,
+			       list->alloc_num, sizeof(struct ctl_port_entry));
+			retval = EINVAL;
+			break;
+		}
+		list->fill_len = 0;
+		list->fill_num = 0;
+		list->dropped_num = 0;
+		i = 0;
+		mtx_lock(&softc->ctl_lock);
+		STAILQ_FOREACH(fe, &softc->fe_list, links) {
+			struct ctl_port_entry entry, *list_entry;
+
+			if (list->fill_num >= list->alloc_num) {
+				list->dropped_num++;
+				continue;
+			}
+
+			entry.port_type = fe->port_type;
+			strlcpy(entry.port_name, fe->port_name,
+				sizeof(entry.port_name));
+			entry.targ_port = fe->targ_port;
+			entry.physical_port = fe->physical_port;
+			entry.virtual_port = fe->virtual_port;
+			entry.wwnn = fe->wwnn;
+			entry.wwpn = fe->wwpn;
+			if (fe->status & CTL_PORT_STATUS_ONLINE)
+				entry.online = 1;
+			else
+				entry.online = 0;
+
+			list_entry = &list->entries[i];
+
+			retval = copyout(&entry, list_entry, sizeof(entry));
+			if (retval != 0) {
+				printf("%s: CTL_GET_PORT_LIST: copyout "
+				       "returned %d\n", __func__, retval);
+				break;
+			}
+			i++;
+			list->fill_num++;
+			list->fill_len += sizeof(entry);
+		}
+		mtx_unlock(&softc->ctl_lock);
+
+		/*
+		 * If this is non-zero, we had a copyout fault, so there's
+		 * probably no point in attempting to set the status inside
+		 * the structure.
+		 */
+		if (retval != 0)
+			break;
+
+		if (list->dropped_num > 0)
+			list->status = CTL_PORT_LIST_NEED_MORE_SPACE;
+		else
+			list->status = CTL_PORT_LIST_OK;
+		break;
+	}
+	case CTL_DUMP_OOA: {
+		struct ctl_lun *lun;
+		union ctl_io *io;
+		char printbuf[128];
+		struct sbuf sb;
+
+		mtx_lock(&softc->ctl_lock);
+		printf("Dumping OOA queues:\n");
+		STAILQ_FOREACH(lun, &softc->lun_list, links) {
+			for (io = (union ctl_io *)TAILQ_FIRST(
+			     &lun->ooa_queue); io != NULL;
+			     io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,
+			     ooa_links)) {
+				sbuf_new(&sb, printbuf, sizeof(printbuf),
+					 SBUF_FIXEDLEN);
+				sbuf_printf(&sb, "LUN %jd tag 0x%04x%s%s%s%s: ",
+					    (intmax_t)lun->lun,
+					    io->scsiio.tag_num,
+					    (io->io_hdr.flags &
+					    CTL_FLAG_BLOCKED) ? "" : " BLOCKED",
+					    (io->io_hdr.flags &
+					    CTL_FLAG_DMA_INPROG) ? " DMA" : "",
+					    (io->io_hdr.flags &
+					    CTL_FLAG_ABORT) ? " ABORT" : "",
+			                    (io->io_hdr.flags &
+		                        CTL_FLAG_IS_WAS_ON_RTR) ? " RTR" : "");
+				ctl_scsi_command_string(&io->scsiio, NULL, &sb);
+				sbuf_finish(&sb);
+				printf("%s\n", sbuf_data(&sb));
+			}
+		}
+		printf("OOA queues dump done\n");
+		mtx_unlock(&softc->ctl_lock);
+		break;
+	}
+	case CTL_GET_OOA: {
+		struct ctl_lun *lun;
+		struct ctl_ooa *ooa_hdr;
+		uint32_t cur_fill_num;
+
+		ooa_hdr = (struct ctl_ooa *)addr;
+
+		if ((ooa_hdr->alloc_len == 0)
+		 || (ooa_hdr->alloc_num == 0)) {
+			printf("%s: CTL_GET_OOA: alloc len %u and alloc num %u "
+			       "must be non-zero\n", __func__,
+			       ooa_hdr->alloc_len, ooa_hdr->alloc_num);
+			retval = EINVAL;
+			break;
+		}
+
+		if (ooa_hdr->alloc_len != (ooa_hdr->alloc_num *
+		    sizeof(struct ctl_ooa_entry))) {
+			printf("%s: CTL_GET_OOA: alloc len %u must be alloc "
+			       "num %d * sizeof(struct ctl_ooa_entry) %zd\n",
+			       __func__, ooa_hdr->alloc_len,
+			       ooa_hdr->alloc_num,sizeof(struct ctl_ooa_entry));
+			retval = EINVAL;
+			break;
+		}
+
+		mtx_lock(&softc->ctl_lock);
+		if (((ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) == 0)
+		 && ((ooa_hdr->lun_num > CTL_MAX_LUNS)
+		  || (softc->ctl_luns[ooa_hdr->lun_num] == NULL))) {
+			mtx_unlock(&softc->ctl_lock);
+			printf("%s: CTL_GET_OOA: invalid LUN %ju\n",
+			       __func__, (uintmax_t)ooa_hdr->lun_num);
+			retval = EINVAL;
+			break;
+		}
+
+		cur_fill_num = 0;
+
+		if (ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) {
+			STAILQ_FOREACH(lun, &softc->lun_list, links) {
+				retval = ctl_ioctl_fill_ooa(lun, &cur_fill_num,
+					ooa_hdr);
+				if (retval != 0)
+					break;
+			}
+			if (retval != 0) {
+				mtx_unlock(&softc->ctl_lock);
+				break;
+			}
+		} else {
+			lun = softc->ctl_luns[ooa_hdr->lun_num];
+
+			retval = ctl_ioctl_fill_ooa(lun, &cur_fill_num,ooa_hdr);
+		}
+		mtx_unlock(&softc->ctl_lock);
+
+		ooa_hdr->fill_num = min(cur_fill_num, ooa_hdr->alloc_num);
+		ooa_hdr->fill_len = ooa_hdr->fill_num *
+			sizeof(struct ctl_ooa_entry);
+
+		getbintime(&ooa_hdr->cur_bt);
+
+		if (cur_fill_num > ooa_hdr->alloc_num) {
+			ooa_hdr->dropped_num = cur_fill_num -ooa_hdr->alloc_num;
+			ooa_hdr->status = CTL_OOA_NEED_MORE_SPACE;
+		} else {
+			ooa_hdr->dropped_num = 0;
+			ooa_hdr->status = CTL_OOA_OK;
+		}
+		break;
+	}
+	case CTL_CHECK_OOA: {
+		union ctl_io *io;
+		struct ctl_lun *lun;
+		struct ctl_ooa_info *ooa_info;
+
+
+		ooa_info = (struct ctl_ooa_info *)addr;
+
+		if (ooa_info->lun_id >= CTL_MAX_LUNS) {
+			ooa_info->status = CTL_OOA_INVALID_LUN;
+			break;
+		}
+		mtx_lock(&softc->ctl_lock);
+		lun = softc->ctl_luns[ooa_info->lun_id];
+		if (lun == NULL) {
+			mtx_unlock(&softc->ctl_lock);
+			ooa_info->status = CTL_OOA_INVALID_LUN;
+			break;
+		}
+
+		ooa_info->num_entries = 0;
+		for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
+		     io != NULL; io = (union ctl_io *)TAILQ_NEXT(
+		     &io->io_hdr, ooa_links)) {
+			ooa_info->num_entries++;
+		}
+
+		mtx_unlock(&softc->ctl_lock);
+		ooa_info->status = CTL_OOA_SUCCESS;
+
+		break;
+	}
+	case CTL_HARD_START:
+	case CTL_HARD_STOP: {
+		struct ctl_fe_ioctl_startstop_info ss_info;
+		struct cfi_metatask *metatask;
+		struct mtx hs_mtx;
+
+		mtx_init(&hs_mtx, "HS Mutex", NULL, MTX_DEF);
+
+		cv_init(&ss_info.sem, "hard start/stop cv" );
+
+		metatask = cfi_alloc_metatask(/*can_wait*/ 1);
+		if (metatask == NULL) {
+			retval = ENOMEM;
+			mtx_destroy(&hs_mtx);
+			break;
+		}
+
+		if (cmd == CTL_HARD_START)
+			metatask->tasktype = CFI_TASK_STARTUP;
+		else
+			metatask->tasktype = CFI_TASK_SHUTDOWN;
+
+		metatask->callback = ctl_ioctl_hard_startstop_callback;
+		metatask->callback_arg = &ss_info;
+
+		cfi_action(metatask);
+
+		/* Wait for the callback */
+		mtx_lock(&hs_mtx);
+		cv_wait_sig(&ss_info.sem, &hs_mtx);
+		mtx_unlock(&hs_mtx);
+
+		/*
+		 * All information has been copied from the metatask by the
+		 * time cv_broadcast() is called, so we free the metatask here.
+		 */
+		cfi_free_metatask(metatask);
+
+		memcpy((void *)addr, &ss_info.hs_info, sizeof(ss_info.hs_info));
+
+		mtx_destroy(&hs_mtx);
+		break;
+	}
+	case CTL_BBRREAD: {
+		struct ctl_bbrread_info *bbr_info;
+		struct ctl_fe_ioctl_bbrread_info fe_bbr_info;
+		struct mtx bbr_mtx;
+		struct cfi_metatask *metatask;
+
+		bbr_info = (struct ctl_bbrread_info *)addr;
+
+		bzero(&fe_bbr_info, sizeof(fe_bbr_info));
+
+		bzero(&bbr_mtx, sizeof(bbr_mtx));
+		mtx_init(&bbr_mtx, "BBR Mutex", NULL, MTX_DEF);
+
+		fe_bbr_info.bbr_info = bbr_info;
+		fe_bbr_info.lock = &bbr_mtx;
+
+		cv_init(&fe_bbr_info.sem, "BBR read cv");
+		metatask = cfi_alloc_metatask(/*can_wait*/ 1);
+
+		if (metatask == NULL) {
+			mtx_destroy(&bbr_mtx);
+			cv_destroy(&fe_bbr_info.sem);
+			retval = ENOMEM;
+			break;
+		}
+		metatask->tasktype = CFI_TASK_BBRREAD;
+		metatask->callback = ctl_ioctl_bbrread_callback;
+		metatask->callback_arg = &fe_bbr_info;
+		metatask->taskinfo.bbrread.lun_num = bbr_info->lun_num;
+		metatask->taskinfo.bbrread.lba = bbr_info->lba;
+		metatask->taskinfo.bbrread.len = bbr_info->len;
+
+		cfi_action(metatask);
+
+		mtx_lock(&bbr_mtx);
+		while (fe_bbr_info.wakeup_done == 0)
+			cv_wait_sig(&fe_bbr_info.sem, &bbr_mtx);
+		mtx_unlock(&bbr_mtx);
+
+		bbr_info->status = metatask->status;
+		bbr_info->bbr_status = metatask->taskinfo.bbrread.status;
+		bbr_info->scsi_status = metatask->taskinfo.bbrread.scsi_status;
+		memcpy(&bbr_info->sense_data,
+		       &metatask->taskinfo.bbrread.sense_data,
+		       ctl_min(sizeof(bbr_info->sense_data),
+			       sizeof(metatask->taskinfo.bbrread.sense_data)));
+
+		cfi_free_metatask(metatask);
+
+		mtx_destroy(&bbr_mtx);
+		cv_destroy(&fe_bbr_info.sem);
+
+		break;
+	}
+	case CTL_DELAY_IO: {
+		struct ctl_io_delay_info *delay_info;
+#ifdef CTL_IO_DELAY
+		struct ctl_lun *lun;
+#endif /* CTL_IO_DELAY */
+
+		delay_info = (struct ctl_io_delay_info *)addr;
+
+#ifdef CTL_IO_DELAY
+		mtx_lock(&softc->ctl_lock);
+
+		if ((delay_info->lun_id > CTL_MAX_LUNS)
+		 || (softc->ctl_luns[delay_info->lun_id] == NULL)) {
+			delay_info->status = CTL_DELAY_STATUS_INVALID_LUN;
+		} else {
+			lun = softc->ctl_luns[delay_info->lun_id];
+
+			delay_info->status = CTL_DELAY_STATUS_OK;
+
+			switch (delay_info->delay_type) {
+			case CTL_DELAY_TYPE_CONT:
+				break;
+			case CTL_DELAY_TYPE_ONESHOT:
+				break;
+			default:
+				delay_info->status =
+					CTL_DELAY_STATUS_INVALID_TYPE;
+				break;
+			}
+
+			switch (delay_info->delay_loc) {
+			case CTL_DELAY_LOC_DATAMOVE:
+				lun->delay_info.datamove_type =
+					delay_info->delay_type;
+				lun->delay_info.datamove_delay =
+					delay_info->delay_secs;
+				break;
+			case CTL_DELAY_LOC_DONE:
+				lun->delay_info.done_type =
+					delay_info->delay_type;
+				lun->delay_info.done_delay =
+					delay_info->delay_secs;
+				break;
+			default:
+				delay_info->status =
+					CTL_DELAY_STATUS_INVALID_LOC;
+				break;
+			}
+		}
+
+		mtx_unlock(&softc->ctl_lock);
+#else
+		delay_info->status = CTL_DELAY_STATUS_NOT_IMPLEMENTED;
+#endif /* CTL_IO_DELAY */
+		break;
+	}
+	case CTL_REALSYNC_SET: {
+		int *syncstate;
+
+		syncstate = (int *)addr;
+
+		mtx_lock(&softc->ctl_lock);
+		switch (*syncstate) {
+		case 0:
+			softc->flags &= ~CTL_FLAG_REAL_SYNC;
+			break;
+		case 1:
+			softc->flags |= CTL_FLAG_REAL_SYNC;
+			break;
+		default:
+			retval = -EINVAL;
+			break;
+		}
+		mtx_unlock(&softc->ctl_lock);
+		break;
+	}
+	case CTL_REALSYNC_GET: {
+		int *syncstate;
+
+		syncstate = (int*)addr;
+
+		mtx_lock(&softc->ctl_lock);
+		if (softc->flags & CTL_FLAG_REAL_SYNC)
+			*syncstate = 1;
+		else
+			*syncstate = 0;
+		mtx_unlock(&softc->ctl_lock);
+
+		break;
+	}
+	case CTL_SETSYNC:
+	case CTL_GETSYNC: {
+		struct ctl_sync_info *sync_info;
+		struct ctl_lun *lun;
+
+		sync_info = (struct ctl_sync_info *)addr;
+
+		mtx_lock(&softc->ctl_lock);
+		lun = softc->ctl_luns[sync_info->lun_id];
+		if (lun == NULL) {
+			mtx_unlock(&softc->ctl_lock);
+			sync_info->status = CTL_GS_SYNC_NO_LUN;
+		}
+		/*
+		 * Get or set the sync interval.  We're not bounds checking
+		 * in the set case, hopefully the user won't do something
+		 * silly.
+		 */
+		if (cmd == CTL_GETSYNC)
+			sync_info->sync_interval = lun->sync_interval;
+		else
+			lun->sync_interval = sync_info->sync_interval;
+
+		mtx_unlock(&softc->ctl_lock);
+
+		sync_info->status = CTL_GS_SYNC_OK;
+
+		break;
+	}
+	case CTL_GETSTATS: {
+		struct ctl_stats *stats;
+		struct ctl_lun *lun;
+		int i;
+
+		stats = (struct ctl_stats *)addr;
+
+		if ((sizeof(struct ctl_lun_io_stats) * softc->num_luns) >
+		     stats->alloc_len) {
+			stats->status = CTL_SS_NEED_MORE_SPACE;
+			stats->num_luns = softc->num_luns;
+			break;
+		}
+		/*
+		 * XXX KDM no locking here.  If the LUN list changes,
+		 * things can blow up.
+		 */
+		for (i = 0, lun = STAILQ_FIRST(&softc->lun_list); lun != NULL;
+		     i++, lun = STAILQ_NEXT(lun, links)) {
+			retval = copyout(&lun->stats, &stats->lun_stats[i],
+					 sizeof(lun->stats));
+			if (retval != 0)
+				break;
+		}
+		stats->num_luns = softc->num_luns;
+		stats->fill_len = sizeof(struct ctl_lun_io_stats) *
+				 softc->num_luns;
+		stats->status = CTL_SS_OK;
+#ifdef CTL_TIME_IO
+		stats->flags = CTL_STATS_FLAG_TIME_VALID;
+#else
+		stats->flags = CTL_STATS_FLAG_NONE;
+#endif
+		getnanouptime(&stats->timestamp);
+		break;
+	}
+	case CTL_ERROR_INJECT: {
+		struct ctl_error_desc *err_desc, *new_err_desc;
+		struct ctl_lun *lun;
+
+		err_desc = (struct ctl_error_desc *)addr;
+
+		new_err_desc = malloc(sizeof(*new_err_desc), M_CTL,
+				      M_WAITOK | M_ZERO);
+		if (new_err_desc == NULL) {
+			printf("%s: CTL_ERROR_INJECT: error allocating %zu "
+			       "bytes\n", __func__, sizeof(*new_err_desc));
+			retval = ENOMEM;
+			break;
+		}
+		bcopy(err_desc, new_err_desc, sizeof(*new_err_desc));
+
+		mtx_lock(&softc->ctl_lock);
+		lun = softc->ctl_luns[err_desc->lun_id];
+		if (lun == NULL) {
+			mtx_unlock(&softc->ctl_lock);
+			printf("%s: CTL_ERROR_INJECT: invalid LUN %ju\n",
+			       __func__, (uintmax_t)err_desc->lun_id);
+			retval = EINVAL;
+			break;
+		}
+
+		/*
+		 * We could do some checking here to verify the validity
+		 * of the request, but given the complexity of error
+		 * injection requests, the checking logic would be fairly
+		 * complex.
+		 *
+		 * For now, if the request is invalid, it just won't get
+		 * executed and might get deleted.
+		 */
+		STAILQ_INSERT_TAIL(&lun->error_list, new_err_desc, links);
+
+		/*
+		 * XXX KDM check to make sure the serial number is unique,
+		 * in case we somehow manage to wrap.  That shouldn't
+		 * happen for a very long time, but it's the right thing to
+		 * do.
+		 */
+		new_err_desc->serial = lun->error_serial;
+		err_desc->serial = lun->error_serial;
+		lun->error_serial++;
+
+		mtx_unlock(&softc->ctl_lock);
+		break;
+	}
+	case CTL_ERROR_INJECT_DELETE: {
+		struct ctl_error_desc *delete_desc, *desc, *desc2;
+		struct ctl_lun *lun;
+		int delete_done;
+
+		delete_desc = (struct ctl_error_desc *)addr;
+		delete_done = 0;
+
+		mtx_lock(&softc->ctl_lock);
+		lun = softc->ctl_luns[delete_desc->lun_id];
+		if (lun == NULL) {
+			mtx_unlock(&softc->ctl_lock);
+			printf("%s: CTL_ERROR_INJECT_DELETE: invalid LUN %ju\n",
+			       __func__, (uintmax_t)delete_desc->lun_id);
+			retval = EINVAL;
+			break;
+		}
+		STAILQ_FOREACH_SAFE(desc, &lun->error_list, links, desc2) {
+			if (desc->serial != delete_desc->serial)
+				continue;
+
+			STAILQ_REMOVE(&lun->error_list, desc, ctl_error_desc,
+				      links);
+			free(desc, M_CTL);
+			delete_done = 1;
+		}
+		mtx_unlock(&softc->ctl_lock);
+		if (delete_done == 0) {
+			printf("%s: CTL_ERROR_INJECT_DELETE: can't find "
+			       "error serial %ju on LUN %u\n", __func__, 
+			       delete_desc->serial, delete_desc->lun_id);
+			retval = EINVAL;
+			break;
+		}
+		break;
+	}
+	case CTL_DUMP_STRUCTS: {
+		int i, j, k;
+		struct ctl_frontend *fe;
+
+		printf("CTL IID to WWPN map start:\n");
+		for (i = 0; i < CTL_MAX_PORTS; i++) {
+			for (j = 0; j < CTL_MAX_INIT_PER_PORT; j++) {
+				if (softc->wwpn_iid[i][j].in_use == 0)
+					continue;
+
+				printf("port %d iid %u WWPN %#jx\n",
+				       softc->wwpn_iid[i][j].port,
+				       softc->wwpn_iid[i][j].iid, 
+				       (uintmax_t)softc->wwpn_iid[i][j].wwpn);
+			}
+		}
+		printf("CTL IID to WWPN map end\n");
+		printf("CTL Persistent Reservation information start:\n");
+		for (i = 0; i < CTL_MAX_LUNS; i++) {
+			struct ctl_lun *lun;
+
+			lun = softc->ctl_luns[i];
+
+			if ((lun == NULL)
+			 || ((lun->flags & CTL_LUN_DISABLED) != 0))
+				continue;
+
+			for (j = 0; j < (CTL_MAX_PORTS * 2); j++) {
+				for (k = 0; k < CTL_MAX_INIT_PER_PORT; k++){
+					if (lun->per_res[j+k].registered == 0)
+						continue;
+					printf("LUN %d port %d iid %d key "
+					       "%#jx\n", i, j, k,
+					       (uintmax_t)scsi_8btou64(
+					       lun->per_res[j+k].res_key.key));
+				}
+			}
+		}
+		printf("CTL Persistent Reservation information end\n");
+		printf("CTL Frontends:\n");
+		/*
+		 * XXX KDM calling this without a lock.  We'd likely want
+		 * to drop the lock before calling the frontend's dump
+		 * routine anyway.
+		 */
+		STAILQ_FOREACH(fe, &softc->fe_list, links) {
+			printf("Frontend %s Type %u pport %d vport %d WWNN "
+			       "%#jx WWPN %#jx\n", fe->port_name, fe->port_type,
+			       fe->physical_port, fe->virtual_port,
+			       (uintmax_t)fe->wwnn, (uintmax_t)fe->wwpn);
+
+			/*
+			 * Frontends are not required to support the dump
+			 * routine.
+			 */
+			if (fe->fe_dump == NULL)
+				continue;
+
+			fe->fe_dump();
+		}
+		printf("CTL Frontend information end\n");
+		break;
+	}
+	case CTL_LUN_REQ: {
+		struct ctl_lun_req *lun_req;
+		struct ctl_backend_driver *backend;
+
+		lun_req = (struct ctl_lun_req *)addr;
+
+		backend = ctl_backend_find(lun_req->backend);
+		if (backend == NULL) {
+			lun_req->status = CTL_LUN_ERROR;
+			snprintf(lun_req->error_str,
+				 sizeof(lun_req->error_str),
+				 "Backend \"%s\" not found.",
+				 lun_req->backend);
+			break;
+		}
+		if (lun_req->num_be_args > 0) {
+			lun_req->kern_be_args = ctl_copyin_args(
+				lun_req->num_be_args,
+				lun_req->be_args,
+				lun_req->error_str,
+				sizeof(lun_req->error_str));
+			if (lun_req->kern_be_args == NULL) {
+				lun_req->status = CTL_LUN_ERROR;
+				break;
+			}
+		}
+
+		retval = backend->ioctl(dev, cmd, addr, flag, td);
+
+		if (lun_req->num_be_args > 0) {
+			ctl_free_args(lun_req->num_be_args,
+				      lun_req->kern_be_args);
+		}
+		break;
+	}
+	case CTL_LUN_LIST: {
+		struct sbuf *sb;
+		struct ctl_lun *lun;
+		struct ctl_lun_list *list;
+
+		list = (struct ctl_lun_list *)addr;
+
+		/*
+		 * Allocate a fixed length sbuf here, based on the length
+		 * of the user's buffer.  We could allocate an auto-extending
+		 * buffer, and then tell the user how much larger our
+		 * amount of data is than his buffer, but that presents
+		 * some problems:
+		 *
+		 * 1.  The sbuf(9) routines use a blocking malloc, and so
+		 *     we can't hold a lock while calling them with an
+		 *     auto-extending buffer.
+ 		 *
+		 * 2.  There is not currently a LUN reference counting
+		 *     mechanism, outside of outstanding transactions on
+		 *     the LUN's OOA queue.  So a LUN could go away on us
+		 *     while we're getting the LUN number, backend-specific
+		 *     information, etc.  Thus, given the way things
+		 *     currently work, we need to hold the CTL lock while
+		 *     grabbing LUN information.
+		 *
+		 * So, from the user's standpoint, the best thing to do is
+		 * allocate what he thinks is a reasonable buffer length,
+		 * and then if he gets a CTL_LUN_LIST_NEED_MORE_SPACE error,
+		 * double the buffer length and try again.  (And repeat
+		 * that until he succeeds.)
+		 */
+		sb = sbuf_new(NULL, NULL, list->alloc_len, SBUF_FIXEDLEN);
+		if (sb == NULL) {
+			list->status = CTL_LUN_LIST_ERROR;
+			snprintf(list->error_str, sizeof(list->error_str),
+				 "Unable to allocate %d bytes for LUN list",
+				 list->alloc_len);
+			break;
+		}
+
+		sbuf_printf(sb, "<ctllunlist>\n");
+
+		mtx_lock(&softc->ctl_lock);
+
+		STAILQ_FOREACH(lun, &softc->lun_list, links) {
+			retval = sbuf_printf(sb, "<lun id=\"%ju\">\n",
+					     (uintmax_t)lun->lun);
+
+			/*
+			 * Bail out as soon as we see that we've overfilled
+			 * the buffer.
+			 */
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "<backend_type>%s"
+					     "</backend_type>\n",
+					     (lun->backend == NULL) ?  "none" :
+					     lun->backend->name);
+
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "<lun_type>%d</lun_type>\n",
+					     lun->be_lun->lun_type);
+
+			if (retval != 0)
+				break;
+
+			if (lun->backend == NULL) {
+				retval = sbuf_printf(sb, "</lun>\n");
+				if (retval != 0)
+					break;
+				continue;
+			}
+
+			retval = sbuf_printf(sb, "<size>%ju</size>\n",
+					     (lun->be_lun->maxlba > 0) ?
+					     lun->be_lun->maxlba + 1 : 0);
+
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "<blocksize>%u</blocksize>\n",
+					     lun->be_lun->blocksize);
+
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "<serial_number>");
+
+			if (retval != 0)
+				break;
+
+			retval = ctl_sbuf_printf_esc(sb,
+						     lun->be_lun->serial_num);
+
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "</serial_number>\n");
+		
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "<device_id>");
+
+			if (retval != 0)
+				break;
+
+			retval = ctl_sbuf_printf_esc(sb,lun->be_lun->device_id);
+
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "</device_id>\n");
+
+			if (retval != 0)
+				break;
+
+			if (lun->backend->lun_info == NULL) {
+				retval = sbuf_printf(sb, "</lun>\n");
+				if (retval != 0)
+					break;
+				continue;
+			}
+
+			retval =lun->backend->lun_info(lun->be_lun->be_lun, sb);
+
+			if (retval != 0)
+				break;
+
+			retval = sbuf_printf(sb, "</lun>\n");
+
+			if (retval != 0)
+				break;
+		}
+		mtx_unlock(&softc->ctl_lock);
+
+		if ((retval != 0)
+		 || ((retval = sbuf_printf(sb, "</ctllunlist>\n")) != 0)) {
+			retval = 0;
+			sbuf_delete(sb);
+			list->status = CTL_LUN_LIST_NEED_MORE_SPACE;
+			snprintf(list->error_str, sizeof(list->error_str),
+				 "Out of space, %d bytes is too small",
+				 list->alloc_len);
+			break;
+		}
+
+		sbuf_finish(sb);
+
+		retval = copyout(sbuf_data(sb), list->lun_xml,
+				 sbuf_len(sb) + 1);
+
+		list->fill_len = sbuf_len(sb) + 1;
+		list->status = CTL_LUN_LIST_OK;
+		sbuf_delete(sb);
+		break;
+	}
+	default: {
+		/* XXX KDM should we fix this? */
+#if 0
+		struct ctl_backend_driver *backend;
+		unsigned int type;
+		int found;
+
+		found = 0;
+
+		/*
+		 * We encode the backend type as the ioctl type for backend
+		 * ioctls.  So parse it out here, and then search for a
+		 * backend of this type.
+		 */
+		type = _IOC_TYPE(cmd);
+
+		STAILQ_FOREACH(backend, &softc->be_list, links) {
+			if (backend->type == type) {
+				found = 1;
+				break;
+			}
+		}
+		if (found == 0) {
+			printf("ctl: unknown ioctl command %#lx or backend "
+			       "%d\n", cmd, type);
+			retval = -EINVAL;
+			break;
+		}
+		retval = backend->ioctl(dev, cmd, addr, flag, td);
+#endif
+		retval = ENOTTY;
+		break;
+	}
+	}
+	return (retval);
+}
+
+uint32_t
+ctl_get_initindex(struct ctl_nexus *nexus)
+{
+	if (nexus->targ_port < CTL_MAX_PORTS)
+		return (nexus->initid.id +
+			(nexus->targ_port * CTL_MAX_INIT_PER_PORT));
+	else
+		return (nexus->initid.id +
+		       ((nexus->targ_port - CTL_MAX_PORTS) *
+			CTL_MAX_INIT_PER_PORT));
+}
+
+uint32_t
+ctl_get_resindex(struct ctl_nexus *nexus)
+{
+	return (nexus->initid.id + (nexus->targ_port * CTL_MAX_INIT_PER_PORT));
+}
+
+uint32_t
+ctl_port_idx(int port_num)
+{
+	if (port_num < CTL_MAX_PORTS)
+		return(port_num);
+	else
+		return(port_num - CTL_MAX_PORTS);
+}
+
+/*
+ * Note:  This only works for bitmask sizes that are at least 32 bits, and
+ * that are a power of 2.
+ */
+int
+ctl_ffz(uint32_t *mask, uint32_t size)
+{
+	uint32_t num_chunks, num_pieces;
+	int i, j;
+
+	num_chunks = (size >> 5);
+	if (num_chunks == 0)
+		num_chunks++;
+	num_pieces = ctl_min((sizeof(uint32_t) * 8), size);
+
+	for (i = 0; i < num_chunks; i++) {
+		for (j = 0; j < num_pieces; j++) {
+			if ((mask[i] & (1 << j)) == 0)
+				return ((i << 5) + j);
+		}
+	}
+
+	return (-1);
+}
+
+int
+ctl_set_mask(uint32_t *mask, uint32_t bit)
+{
+	uint32_t chunk, piece;
+
+	chunk = bit >> 5;
+	piece = bit % (sizeof(uint32_t) * 8);
+
+	if ((mask[chunk] & (1 << piece)) != 0)
+		return (-1);
+	else
+		mask[chunk] |= (1 << piece);
+
+	return (0);
+}
+
+int
+ctl_clear_mask(uint32_t *mask, uint32_t bit)
+{
+	uint32_t chunk, piece;
+
+	chunk = bit >> 5;
+	piece = bit % (sizeof(uint32_t) * 8);
+
+	if ((mask[chunk] & (1 << piece)) == 0)
+		return (-1);
+	else
+		mask[chunk] &= ~(1 << piece);
+
+	return (0);
+}
+
+int
+ctl_is_set(uint32_t *mask, uint32_t bit)
+{
+	uint32_t chunk, piece;
+
+	chunk = bit >> 5;
+	piece = bit % (sizeof(uint32_t) * 8);
+
+	if ((mask[chunk] & (1 << piece)) == 0)
+		return (0);
+	else
+		return (1);
+}
+
+#ifdef unused
+/*
+ * The bus, target and lun are optional, they can be filled in later.
+ * can_wait is used to determine whether we can wait on the malloc or not.
+ */
+union ctl_io*
+ctl_malloc_io(ctl_io_type io_type, uint32_t targ_port, uint32_t targ_target,
+	      uint32_t targ_lun, int can_wait)
+{
+	union ctl_io *io;
+
+	if (can_wait)
+		io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_WAITOK);
+	else
+		io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_NOWAIT);
+
+	if (io != NULL) {
+		io->io_hdr.io_type = io_type;
+		io->io_hdr.targ_port = targ_port;
+		/*
+		 * XXX KDM this needs to change/go away.  We need to move
+		 * to a preallocated pool of ctl_scsiio structures.
+		 */
+		io->io_hdr.nexus.targ_target.id = targ_target;
+		io->io_hdr.nexus.targ_lun = targ_lun;
+	}
+
+	return (io);
+}
+
+void
+ctl_kfree_io(union ctl_io *io)
+{
+	free(io, M_CTL);
+}
+#endif /* unused */
+
+/*
+ * ctl_softc, pool_type, total_ctl_io are passed in.
+ * npool is passed out.
+ */
+int
+ctl_pool_create(struct ctl_softc *ctl_softc, ctl_pool_type pool_type,
+		uint32_t total_ctl_io, struct ctl_io_pool **npool)
+{
+	uint32_t i;
+	union ctl_io *cur_io, *next_io;
+	struct ctl_io_pool *pool;
+	int retval;
+
+	retval = 0;
+
+	pool = (struct ctl_io_pool *)malloc(sizeof(*pool), M_CTL, M_NOWAIT);
+	if (pool == NULL) {
+		retval = -ENOMEM;
+		goto bailout;
+	}
+
+	memset(pool, 0, sizeof(*pool));
+
+	pool->type = pool_type;
+	pool->ctl_softc = ctl_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	pool->id = ctl_softc->cur_pool_id++;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	pool->flags = CTL_POOL_FLAG_NONE;
+	STAILQ_INIT(&pool->free_queue);
+
+	/*
+	 * XXX KDM other options here:
+	 * - allocate a page at a time
+	 * - allocate one big chunk of memory.
+	 * Page allocation might work well, but would take a little more
+	 * tracking.
+	 */
+	for (i = 0; i < total_ctl_io; i++) {
+		cur_io = (union ctl_io *)malloc(sizeof(*cur_io), M_CTL,
+						M_NOWAIT);
+		if (cur_io == NULL) {
+			retval = ENOMEM;
+			break;
+		}
+		cur_io->io_hdr.pool = pool;
+		STAILQ_INSERT_TAIL(&pool->free_queue, &cur_io->io_hdr, links);
+		pool->total_ctl_io++;
+		pool->free_ctl_io++;
+	}
+
+	if (retval != 0) {
+		for (cur_io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
+		     cur_io != NULL; cur_io = next_io) {
+			next_io = (union ctl_io *)STAILQ_NEXT(&cur_io->io_hdr,
+							      links);
+			STAILQ_REMOVE(&pool->free_queue, &cur_io->io_hdr,
+				      ctl_io_hdr, links);
+			free(cur_io, M_CTL);
+		}
+
+		free(pool, M_CTL);
+		goto bailout;
+	}
+	mtx_lock(&ctl_softc->ctl_lock);
+	ctl_softc->num_pools++;
+	STAILQ_INSERT_TAIL(&ctl_softc->io_pools, pool, links);
+	/*
+	 * Increment our usage count if this is an external consumer, so we
+	 * can't get unloaded until the external consumer (most likely a
+	 * FETD) unloads and frees his pool.
+	 *
+	 * XXX KDM will this increment the caller's module use count, or
+	 * mine?
+	 */
+#if 0
+	if ((pool_type != CTL_POOL_EMERGENCY)
+	 && (pool_type != CTL_POOL_INTERNAL)
+	 && (pool_type != CTL_POOL_IOCTL)
+	 && (pool_type != CTL_POOL_4OTHERSC))
+		MOD_INC_USE_COUNT;
+#endif
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	*npool = pool;
+
+bailout:
+
+	return (retval);
+}
+
+/*
+ * Caller must hold ctl_softc->ctl_lock.
+ */
+int
+ctl_pool_acquire(struct ctl_io_pool *pool)
+{
+	if (pool == NULL)
+		return (-EINVAL);
+
+	if (pool->flags & CTL_POOL_FLAG_INVALID)
+		return (-EINVAL);
+
+	pool->refcount++;
+
+	return (0);
+}
+
+/*
+ * Caller must hold ctl_softc->ctl_lock.
+ */
+int
+ctl_pool_invalidate(struct ctl_io_pool *pool)
+{
+	if (pool == NULL)
+		return (-EINVAL);
+
+	pool->flags |= CTL_POOL_FLAG_INVALID;
+
+	return (0);
+}
+
+/*
+ * Caller must hold ctl_softc->ctl_lock.
+ */
+int
+ctl_pool_release(struct ctl_io_pool *pool)
+{
+	if (pool == NULL)
+		return (-EINVAL);
+
+	if ((--pool->refcount == 0)
+	 && (pool->flags & CTL_POOL_FLAG_INVALID)) {
+		ctl_pool_free(pool->ctl_softc, pool);
+	}
+
+	return (0);
+}
+
+/*
+ * Must be called with ctl_softc->ctl_lock held.
+ */
+void
+ctl_pool_free(struct ctl_softc *ctl_softc, struct ctl_io_pool *pool)
+{
+	union ctl_io *cur_io, *next_io;
+
+	for (cur_io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
+	     cur_io != NULL; cur_io = next_io) {
+		next_io = (union ctl_io *)STAILQ_NEXT(&cur_io->io_hdr,
+						      links);
+		STAILQ_REMOVE(&pool->free_queue, &cur_io->io_hdr, ctl_io_hdr,
+			      links);
+		free(cur_io, M_CTL);
+	}
+
+	STAILQ_REMOVE(&ctl_softc->io_pools, pool, ctl_io_pool, links);
+	ctl_softc->num_pools--;
+
+	/*
+	 * XXX KDM will this decrement the caller's usage count or mine?
+	 */
+#if 0
+	if ((pool->type != CTL_POOL_EMERGENCY)
+	 && (pool->type != CTL_POOL_INTERNAL)
+	 && (pool->type != CTL_POOL_IOCTL))
+		MOD_DEC_USE_COUNT;
+#endif
+
+	free(pool, M_CTL);
+}
+
+/*
+ * This routine does not block (except for spinlocks of course).
+ * It tries to allocate a ctl_io union from the caller's pool as quickly as
+ * possible.
+ */
+union ctl_io *
+ctl_alloc_io(void *pool_ref)
+{
+	union ctl_io *io;
+	struct ctl_softc *ctl_softc;
+	struct ctl_io_pool *pool, *npool;
+	struct ctl_io_pool *emergency_pool;
+
+	pool = (struct ctl_io_pool *)pool_ref;
+
+	if (pool == NULL) {
+		printf("%s: pool is NULL\n", __func__);
+		return (NULL);
+	}
+
+	emergency_pool = NULL;
+
+	ctl_softc = pool->ctl_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	/*
+	 * First, try to get the io structure from the user's pool.
+	 */
+	if (ctl_pool_acquire(pool) == 0) {
+		io = (union ctl_io *)STAILQ_FIRST(&pool->free_queue);
+		if (io != NULL) {
+			STAILQ_REMOVE_HEAD(&pool->free_queue, links);
+			pool->total_allocated++;
+			pool->free_ctl_io--;
+			mtx_unlock(&ctl_softc->ctl_lock);
+			return (io);
+		} else
+			ctl_pool_release(pool);
+	}
+	/*
+	 * If he doesn't have any io structures left, search for an
+	 * emergency pool and grab one from there.
+	 */
+	STAILQ_FOREACH(npool, &ctl_softc->io_pools, links) {
+		if (npool->type != CTL_POOL_EMERGENCY)
+			continue;
+
+		if (ctl_pool_acquire(npool) != 0)
+			continue;
+
+		emergency_pool = npool;
+
+		io = (union ctl_io *)STAILQ_FIRST(&npool->free_queue);
+		if (io != NULL) {
+			STAILQ_REMOVE_HEAD(&npool->free_queue, links);
+			npool->total_allocated++;
+			npool->free_ctl_io--;
+			mtx_unlock(&ctl_softc->ctl_lock);
+			return (io);
+		} else
+			ctl_pool_release(npool);
+	}
+
+	/* Drop the spinlock before we malloc */
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	/*
+	 * The emergency pool (if it exists) didn't have one, so try an
+	 * atomic (i.e. nonblocking) malloc and see if we get lucky.
+	 */
+	io = (union ctl_io *)malloc(sizeof(*io), M_CTL, M_NOWAIT);
+	if (io != NULL) {
+		/*
+		 * If the emergency pool exists but is empty, add this
+		 * ctl_io to its list when it gets freed.
+		 */
+		if (emergency_pool != NULL) {
+			mtx_lock(&ctl_softc->ctl_lock);
+			if (ctl_pool_acquire(emergency_pool) == 0) {
+				io->io_hdr.pool = emergency_pool;
+				emergency_pool->total_ctl_io++;
+				/*
+				 * Need to bump this, otherwise
+				 * total_allocated and total_freed won't
+				 * match when we no longer have anything
+				 * outstanding.
+				 */
+				emergency_pool->total_allocated++;
+			}
+			mtx_unlock(&ctl_softc->ctl_lock);
+		} else
+			io->io_hdr.pool = NULL;
+	}
+
+	return (io);
+}
+
+static void
+ctl_free_io_internal(union ctl_io *io, int have_lock)
+{
+	if (io == NULL)
+		return;
+
+	/*
+	 * If this ctl_io has a pool, return it to that pool.
+	 */
+	if (io->io_hdr.pool != NULL) {
+		struct ctl_io_pool *pool;
+#if 0
+		struct ctl_softc *ctl_softc;
+		union ctl_io *tmp_io;
+		unsigned long xflags;
+		int i;
+
+		ctl_softc = control_softc;
+#endif
+
+		pool = (struct ctl_io_pool *)io->io_hdr.pool;
+
+		if (have_lock == 0)
+			mtx_lock(&pool->ctl_softc->ctl_lock);
+#if 0
+		save_flags(xflags);
+
+		for (i = 0, tmp_io = (union ctl_io *)STAILQ_FIRST(
+		     &ctl_softc->task_queue); tmp_io != NULL; i++,
+		     tmp_io = (union ctl_io *)STAILQ_NEXT(&tmp_io->io_hdr,
+		     links)) {
+			if (tmp_io == io) {
+				printf("%s: %p is still on the task queue!\n",
+				       __func__, tmp_io);
+				printf("%s: (%d): type %d "
+				       "msg %d cdb %x iptl: "
+				       "%d:%d:%d:%d tag 0x%04x "
+				       "flg %#lx\n",
+					__func__, i,
+					tmp_io->io_hdr.io_type,
+					tmp_io->io_hdr.msg_type,
+					tmp_io->scsiio.cdb[0],
+					tmp_io->io_hdr.nexus.initid.id,
+					tmp_io->io_hdr.nexus.targ_port,
+					tmp_io->io_hdr.nexus.targ_target.id,
+					tmp_io->io_hdr.nexus.targ_lun,
+					(tmp_io->io_hdr.io_type ==
+					CTL_IO_TASK) ?
+					tmp_io->taskio.tag_num :
+					tmp_io->scsiio.tag_num,
+					xflags);
+				panic("I/O still on the task queue!");
+			}
+		}
+#endif
+		io->io_hdr.io_type = 0xff;
+		STAILQ_INSERT_TAIL(&pool->free_queue, &io->io_hdr, links);
+		pool->total_freed++;
+		pool->free_ctl_io++;
+		ctl_pool_release(pool);
+		if (have_lock == 0)
+			mtx_unlock(&pool->ctl_softc->ctl_lock);
+	} else {
+		/*
+		 * Otherwise, just free it.  We probably malloced it and
+		 * the emergency pool wasn't available.
+		 */
+		free(io, M_CTL);
+	}
+
+}
+
+void
+ctl_free_io(union ctl_io *io)
+{
+	ctl_free_io_internal(io, /*have_lock*/ 0);
+}
+
+void
+ctl_zero_io(union ctl_io *io)
+{
+	void *pool_ref;
+
+	if (io == NULL)
+		return;
+
+	/*
+	 * May need to preserve linked list pointers at some point too.
+	 */
+	pool_ref = io->io_hdr.pool;
+
+	memset(io, 0, sizeof(*io));
+
+	io->io_hdr.pool = pool_ref;
+}
+
+/*
+ * This routine is currently used for internal copies of ctl_ios that need
+ * to persist for some reason after we've already returned status to the
+ * FETD.  (Thus the flag set.)
+ *
+ * XXX XXX
+ * Note that this makes a blind copy of all fields in the ctl_io, except
+ * for the pool reference.  This includes any memory that has been
+ * allocated!  That memory will no longer be valid after done has been
+ * called, so this would be VERY DANGEROUS for command that actually does
+ * any reads or writes.  Right now (11/7/2005), this is only used for immediate
+ * start and stop commands, which don't transfer any data, so this is not a
+ * problem.  If it is used for anything else, the caller would also need to
+ * allocate data buffer space and this routine would need to be modified to
+ * copy the data buffer(s) as well.
+ */
+void
+ctl_copy_io(union ctl_io *src, union ctl_io *dest)
+{
+	void *pool_ref;
+
+	if ((src == NULL)
+	 || (dest == NULL))
+		return;
+
+	/*
+	 * May need to preserve linked list pointers at some point too.
+	 */
+	pool_ref = dest->io_hdr.pool;
+
+	memcpy(dest, src, ctl_min(sizeof(*src), sizeof(*dest)));
+
+	dest->io_hdr.pool = pool_ref;
+	/*
+	 * We need to know that this is an internal copy, and doesn't need
+	 * to get passed back to the FETD that allocated it.
+	 */
+	dest->io_hdr.flags |= CTL_FLAG_INT_COPY;
+}
+
+#ifdef NEEDTOPORT
+static void
+ctl_update_power_subpage(struct copan_power_subpage *page)
+{
+	int num_luns, num_partitions, config_type;
+	struct ctl_softc *softc;
+	cs_BOOL_t aor_present, shelf_50pct_power;
+	cs_raidset_personality_t rs_type;
+	int max_active_luns;
+
+	softc = control_softc;
+
+	/* subtract out the processor LUN */
+	num_luns = softc->num_luns - 1;
+	/*
+	 * Default to 7 LUNs active, which was the only number we allowed
+	 * in the past.
+	 */
+	max_active_luns = 7;
+
+	num_partitions = config_GetRsPartitionInfo();
+	config_type = config_GetConfigType();
+	shelf_50pct_power = config_GetShelfPowerMode();
+	aor_present = config_IsAorRsPresent();
+
+	rs_type = ddb_GetRsRaidType(1);
+	if ((rs_type != CS_RAIDSET_PERSONALITY_RAID5)
+	 && (rs_type != CS_RAIDSET_PERSONALITY_RAID1)) {
+		EPRINT(0, "Unsupported RS type %d!", rs_type);
+	}
+
+
+	page->total_luns = num_luns;
+
+	switch (config_type) {
+	case 40:
+		/*
+		 * In a 40 drive configuration, it doesn't matter what DC
+		 * cards we have, whether we have AOR enabled or not,
+		 * partitioning or not, or what type of RAIDset we have.
+		 * In that scenario, we can power up every LUN we present
+		 * to the user.
+		 */
+		max_active_luns = num_luns;
+
+		break;
+	case 64:
+		if (shelf_50pct_power == CS_FALSE) {
+			/* 25% power */
+			if (aor_present == CS_TRUE) {
+				if (rs_type ==
+				     CS_RAIDSET_PERSONALITY_RAID5) {
+					max_active_luns = 7;
+				} else if (rs_type ==
+					 CS_RAIDSET_PERSONALITY_RAID1){
+					max_active_luns = 14;
+				} else {
+					/* XXX KDM now what?? */
+				}
+			} else {
+				if (rs_type ==
+				     CS_RAIDSET_PERSONALITY_RAID5) {
+					max_active_luns = 8;
+				} else if (rs_type ==
+					 CS_RAIDSET_PERSONALITY_RAID1){
+					max_active_luns = 16;
+				} else {
+					/* XXX KDM now what?? */
+				}
+			}
+		} else {
+			/* 50% power */
+			/*
+			 * With 50% power in a 64 drive configuration, we
+			 * can power all LUNs we present.
+			 */
+			max_active_luns = num_luns;
+		}
+		break;
+	case 112:
+		if (shelf_50pct_power == CS_FALSE) {
+			/* 25% power */
+			if (aor_present == CS_TRUE) {
+				if (rs_type ==
+				     CS_RAIDSET_PERSONALITY_RAID5) {
+					max_active_luns = 7;
+				} else if (rs_type ==
+					 CS_RAIDSET_PERSONALITY_RAID1){
+					max_active_luns = 14;
+				} else {
+					/* XXX KDM now what?? */
+				}
+			} else {
+				if (rs_type ==
+				     CS_RAIDSET_PERSONALITY_RAID5) {
+					max_active_luns = 8;
+				} else if (rs_type ==
+					 CS_RAIDSET_PERSONALITY_RAID1){
+					max_active_luns = 16;
+				} else {
+					/* XXX KDM now what?? */
+				}
+			}
+		} else {
+			/* 50% power */
+			if (aor_present == CS_TRUE) {
+				if (rs_type ==
+				     CS_RAIDSET_PERSONALITY_RAID5) {
+					max_active_luns = 14;
+				} else if (rs_type ==
+					 CS_RAIDSET_PERSONALITY_RAID1){
+					/*
+					 * We're assuming here that disk
+					 * caching is enabled, and so we're
+					 * able to power up half of each
+					 * LUN, and cache all writes.
+					 */
+					max_active_luns = num_luns;
+				} else {
+					/* XXX KDM now what?? */
+				}
+			} else {
+				if (rs_type ==
+				     CS_RAIDSET_PERSONALITY_RAID5) {
+					max_active_luns = 15;
+				} else if (rs_type ==
+					 CS_RAIDSET_PERSONALITY_RAID1){
+					max_active_luns = 30;
+				} else {
+					/* XXX KDM now what?? */
+				}
+			}
+		}
+		break;
+	default:
+		/*
+		 * In this case, we have an unknown configuration, so we
+		 * just use the default from above.
+		 */
+		break;
+	}
+
+	page->max_active_luns = max_active_luns;
+#if 0
+	printk("%s: total_luns = %d, max_active_luns = %d\n", __func__,
+	       page->total_luns, page->max_active_luns);
+#endif
+}
+#endif /* NEEDTOPORT */
+
+/*
+ * This routine could be used in the future to load default and/or saved
+ * mode page parameters for a particuar lun.
+ */
+static int
+ctl_init_page_index(struct ctl_lun *lun)
+{
+	int i;
+	struct ctl_page_index *page_index;
+	struct ctl_softc *softc;
+
+	memcpy(&lun->mode_pages.index, page_index_template,
+	       sizeof(page_index_template));
+
+	softc = lun->ctl_softc;
+
+	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+
+		page_index = &lun->mode_pages.index[i];
+		/*
+		 * If this is a disk-only mode page, there's no point in
+		 * setting it up.  For some pages, we have to have some
+		 * basic information about the disk in order to calculate the
+		 * mode page data.
+		 */
+		if ((lun->be_lun->lun_type != T_DIRECT)
+		 && (page_index->page_flags & CTL_PAGE_FLAG_DISK_ONLY))
+			continue;
+
+		switch (page_index->page_code & SMPH_PC_MASK) {
+		case SMS_FORMAT_DEVICE_PAGE: {
+			struct scsi_format_page *format_page;
+
+			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
+				panic("subpage is incorrect!");
+
+			/*
+			 * Sectors per track are set above.  Bytes per
+			 * sector need to be set here on a per-LUN basis.
+			 */
+			memcpy(&lun->mode_pages.format_page[CTL_PAGE_CURRENT],
+			       &format_page_default,
+			       sizeof(format_page_default));
+			memcpy(&lun->mode_pages.format_page[
+			       CTL_PAGE_CHANGEABLE], &format_page_changeable,
+			       sizeof(format_page_changeable));
+			memcpy(&lun->mode_pages.format_page[CTL_PAGE_DEFAULT],
+			       &format_page_default,
+			       sizeof(format_page_default));
+			memcpy(&lun->mode_pages.format_page[CTL_PAGE_SAVED],
+			       &format_page_default,
+			       sizeof(format_page_default));
+
+			format_page = &lun->mode_pages.format_page[
+				CTL_PAGE_CURRENT];
+			scsi_ulto2b(lun->be_lun->blocksize,
+				    format_page->bytes_per_sector);
+
+			format_page = &lun->mode_pages.format_page[
+				CTL_PAGE_DEFAULT];
+			scsi_ulto2b(lun->be_lun->blocksize,
+				    format_page->bytes_per_sector);
+
+			format_page = &lun->mode_pages.format_page[
+				CTL_PAGE_SAVED];
+			scsi_ulto2b(lun->be_lun->blocksize,
+				    format_page->bytes_per_sector);
+
+			page_index->page_data =
+				(uint8_t *)lun->mode_pages.format_page;
+			break;
+		}
+		case SMS_RIGID_DISK_PAGE: {
+			struct scsi_rigid_disk_page *rigid_disk_page;
+			uint32_t sectors_per_cylinder;
+			uint64_t cylinders;
+#ifndef	__XSCALE__
+			int shift;
+#endif /* !__XSCALE__ */
+
+			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
+				panic("invalid subpage value %d",
+				      page_index->subpage);
+
+			/*
+			 * Rotation rate and sectors per track are set
+			 * above.  We calculate the cylinders here based on
+			 * capacity.  Due to the number of heads and
+			 * sectors per track we're using, smaller arrays
+			 * may turn out to have 0 cylinders.  Linux and
+			 * FreeBSD don't pay attention to these mode pages
+			 * to figure out capacity, but Solaris does.  It
+			 * seems to deal with 0 cylinders just fine, and
+			 * works out a fake geometry based on the capacity.
+			 */
+			memcpy(&lun->mode_pages.rigid_disk_page[
+			       CTL_PAGE_CURRENT], &rigid_disk_page_default,
+			       sizeof(rigid_disk_page_default));
+			memcpy(&lun->mode_pages.rigid_disk_page[
+			       CTL_PAGE_CHANGEABLE],&rigid_disk_page_changeable,
+			       sizeof(rigid_disk_page_changeable));
+			memcpy(&lun->mode_pages.rigid_disk_page[
+			       CTL_PAGE_DEFAULT], &rigid_disk_page_default,
+			       sizeof(rigid_disk_page_default));
+			memcpy(&lun->mode_pages.rigid_disk_page[
+			       CTL_PAGE_SAVED], &rigid_disk_page_default,
+			       sizeof(rigid_disk_page_default));
+
+			sectors_per_cylinder = CTL_DEFAULT_SECTORS_PER_TRACK *
+				CTL_DEFAULT_HEADS;
+
+			/*
+			 * The divide method here will be more accurate,
+			 * probably, but results in floating point being
+			 * used in the kernel on i386 (__udivdi3()).  On the
+			 * XScale, though, __udivdi3() is implemented in
+			 * software.
+			 *
+			 * The shift method for cylinder calculation is
+			 * accurate if sectors_per_cylinder is a power of
+			 * 2.  Otherwise it might be slightly off -- you
+			 * might have a bit of a truncation problem.
+			 */
+#ifdef	__XSCALE__
+			cylinders = (lun->be_lun->maxlba + 1) /
+				sectors_per_cylinder;
+#else
+			for (shift = 31; shift > 0; shift--) {
+				if (sectors_per_cylinder & (1 << shift))
+					break;
+			}
+			cylinders = (lun->be_lun->maxlba + 1) >> shift;
+#endif
+
+			/*
+			 * We've basically got 3 bytes, or 24 bits for the
+			 * cylinder size in the mode page.  If we're over,
+			 * just round down to 2^24.
+			 */
+			if (cylinders > 0xffffff)
+				cylinders = 0xffffff;
+
+			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
+				CTL_PAGE_CURRENT];
+			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
+
+			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
+				CTL_PAGE_DEFAULT];
+			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
+
+			rigid_disk_page = &lun->mode_pages.rigid_disk_page[
+				CTL_PAGE_SAVED];
+			scsi_ulto3b(cylinders, rigid_disk_page->cylinders);
+
+			page_index->page_data =
+				(uint8_t *)lun->mode_pages.rigid_disk_page;
+			break;
+		}
+		case SMS_CACHING_PAGE: {
+
+			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
+				panic("invalid subpage value %d",
+				      page_index->subpage);
+			/*
+			 * Defaults should be okay here, no calculations
+			 * needed.
+			 */
+			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_CURRENT],
+			       &caching_page_default,
+			       sizeof(caching_page_default));
+			memcpy(&lun->mode_pages.caching_page[
+			       CTL_PAGE_CHANGEABLE], &caching_page_changeable,
+			       sizeof(caching_page_changeable));
+			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_DEFAULT],
+			       &caching_page_default,
+			       sizeof(caching_page_default));
+			memcpy(&lun->mode_pages.caching_page[CTL_PAGE_SAVED],
+			       &caching_page_default,
+			       sizeof(caching_page_default));
+			page_index->page_data =
+				(uint8_t *)lun->mode_pages.caching_page;
+			break;
+		}
+		case SMS_CONTROL_MODE_PAGE: {
+
+			if (page_index->subpage != SMS_SUBPAGE_PAGE_0)
+				panic("invalid subpage value %d",
+				      page_index->subpage);
+
+			/*
+			 * Defaults should be okay here, no calculations
+			 * needed.
+			 */
+			memcpy(&lun->mode_pages.control_page[CTL_PAGE_CURRENT],
+			       &control_page_default,
+			       sizeof(control_page_default));
+			memcpy(&lun->mode_pages.control_page[
+			       CTL_PAGE_CHANGEABLE], &control_page_changeable,
+			       sizeof(control_page_changeable));
+			memcpy(&lun->mode_pages.control_page[CTL_PAGE_DEFAULT],
+			       &control_page_default,
+			       sizeof(control_page_default));
+			memcpy(&lun->mode_pages.control_page[CTL_PAGE_SAVED],
+			       &control_page_default,
+			       sizeof(control_page_default));
+			page_index->page_data =
+				(uint8_t *)lun->mode_pages.control_page;
+			break;
+
+		}
+		case SMS_VENDOR_SPECIFIC_PAGE:{
+			switch (page_index->subpage) {
+			case PWR_SUBPAGE_CODE: {
+				struct copan_power_subpage *current_page,
+							   *saved_page;
+
+				memcpy(&lun->mode_pages.power_subpage[
+				       CTL_PAGE_CURRENT],
+				       &power_page_default,
+				       sizeof(power_page_default));
+				memcpy(&lun->mode_pages.power_subpage[
+				       CTL_PAGE_CHANGEABLE],
+				       &power_page_changeable,
+				       sizeof(power_page_changeable));
+				memcpy(&lun->mode_pages.power_subpage[
+				       CTL_PAGE_DEFAULT],
+				       &power_page_default,
+				       sizeof(power_page_default));
+				memcpy(&lun->mode_pages.power_subpage[
+				       CTL_PAGE_SAVED],
+				       &power_page_default,
+				       sizeof(power_page_default));
+				page_index->page_data =
+				    (uint8_t *)lun->mode_pages.power_subpage;
+
+				current_page = (struct copan_power_subpage *)
+					(page_index->page_data +
+					 (page_index->page_len *
+					  CTL_PAGE_CURRENT));
+			        saved_page = (struct copan_power_subpage *)
+				        (page_index->page_data +
+					 (page_index->page_len *
+					  CTL_PAGE_SAVED));
+				break;
+			}
+			case APS_SUBPAGE_CODE: {
+				struct copan_aps_subpage *current_page,
+							 *saved_page;
+
+				// This gets set multiple times but
+				// it should always be the same. It's
+				// only done during init so who cares.
+				index_to_aps_page = i;
+
+				memcpy(&lun->mode_pages.aps_subpage[
+				       CTL_PAGE_CURRENT],
+				       &aps_page_default,
+				       sizeof(aps_page_default));
+				memcpy(&lun->mode_pages.aps_subpage[
+				       CTL_PAGE_CHANGEABLE],
+				       &aps_page_changeable,
+				       sizeof(aps_page_changeable));
+				memcpy(&lun->mode_pages.aps_subpage[
+				       CTL_PAGE_DEFAULT],
+				       &aps_page_default,
+				       sizeof(aps_page_default));
+				memcpy(&lun->mode_pages.aps_subpage[
+				       CTL_PAGE_SAVED],
+				       &aps_page_default,
+				       sizeof(aps_page_default));
+				page_index->page_data =
+					(uint8_t *)lun->mode_pages.aps_subpage;
+
+				current_page = (struct copan_aps_subpage *)
+					(page_index->page_data +
+					 (page_index->page_len *
+					  CTL_PAGE_CURRENT));
+				saved_page = (struct copan_aps_subpage *)
+					(page_index->page_data +
+					 (page_index->page_len *
+					  CTL_PAGE_SAVED));
+				break;
+			}
+			case DBGCNF_SUBPAGE_CODE: {
+				struct copan_debugconf_subpage *current_page,
+							       *saved_page;
+
+				memcpy(&lun->mode_pages.debugconf_subpage[
+				       CTL_PAGE_CURRENT],
+				       &debugconf_page_default,
+				       sizeof(debugconf_page_default));
+				memcpy(&lun->mode_pages.debugconf_subpage[
+				       CTL_PAGE_CHANGEABLE],
+				       &debugconf_page_changeable,
+				       sizeof(debugconf_page_changeable));
+				memcpy(&lun->mode_pages.debugconf_subpage[
+				       CTL_PAGE_DEFAULT],
+				       &debugconf_page_default,
+				       sizeof(debugconf_page_default));
+				memcpy(&lun->mode_pages.debugconf_subpage[
+				       CTL_PAGE_SAVED],
+				       &debugconf_page_default,
+				       sizeof(debugconf_page_default));
+				page_index->page_data =
+					(uint8_t *)lun->mode_pages.debugconf_subpage;
+
+				current_page = (struct copan_debugconf_subpage *)
+					(page_index->page_data +
+					 (page_index->page_len *
+					  CTL_PAGE_CURRENT));
+				saved_page = (struct copan_debugconf_subpage *)
+					(page_index->page_data +
+					 (page_index->page_len *
+					  CTL_PAGE_SAVED));
+				break;
+			}
+			default:
+				panic("invalid subpage value %d",
+				      page_index->subpage);
+				break;
+			}
+   			break;
+		}
+		default:
+			panic("invalid page value %d",
+			      page_index->page_code & SMPH_PC_MASK);
+			break;
+    	}
+	}
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * LUN allocation.
+ *
+ * Requirements:
+ * - caller allocates and zeros LUN storage, or passes in a NULL LUN if he
+ *   wants us to allocate the LUN and he can block.
+ * - ctl_softc is always set
+ * - be_lun is set if the LUN has a backend (needed for disk LUNs)
+ *
+ * Returns 0 for success, non-zero (errno) for failure.
+ */
+static int
+ctl_alloc_lun(struct ctl_softc *ctl_softc, struct ctl_lun *ctl_lun,
+	      struct ctl_be_lun *const be_lun, struct ctl_id target_id)
+{
+	struct ctl_lun *nlun, *lun;
+	struct ctl_frontend *fe;
+	int lun_number, i;
+
+	if (be_lun == NULL)
+		return (EINVAL);
+
+	/*
+	 * We currently only support Direct Access or Processor LUN types.
+	 */
+	switch (be_lun->lun_type) {
+	case T_DIRECT:
+		break;
+	case T_PROCESSOR:
+		break;
+	case T_SEQUENTIAL:
+	case T_CHANGER:
+	default:
+		be_lun->lun_config_status(be_lun->be_lun,
+					  CTL_LUN_CONFIG_FAILURE);
+		break;
+	}
+	if (ctl_lun == NULL) {
+		lun = malloc(sizeof(*lun), M_CTL, M_WAITOK);
+		if (lun == NULL) {
+			be_lun->lun_config_status(lun->be_lun->be_lun,
+						  CTL_LUN_CONFIG_FAILURE);
+			return (-ENOMEM);
+		}
+		lun->flags = CTL_LUN_MALLOCED;
+	} else
+		lun = ctl_lun;
+
+	memset(lun, 0, sizeof(*lun));
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	/*
+	 * See if the caller requested a particular LUN number.  If so, see
+	 * if it is available.  Otherwise, allocate the first available LUN.
+	 */
+	if (be_lun->flags & CTL_LUN_FLAG_ID_REQ) {
+		if ((be_lun->req_lun_id > (CTL_MAX_LUNS - 1))
+		 || (ctl_is_set(ctl_softc->ctl_lun_mask, be_lun->req_lun_id))) {
+			mtx_unlock(&ctl_softc->ctl_lock);
+			if (be_lun->req_lun_id > (CTL_MAX_LUNS - 1)) {
+				printf("ctl: requested LUN ID %d is higher "
+				       "than CTL_MAX_LUNS - 1 (%d)\n",
+				       be_lun->req_lun_id, CTL_MAX_LUNS - 1);
+			} else {
+				/*
+				 * XXX KDM return an error, or just assign
+				 * another LUN ID in this case??
+				 */
+				printf("ctl: requested LUN ID %d is already "
+				       "in use\n", be_lun->req_lun_id);
+			}
+			if (lun->flags & CTL_LUN_MALLOCED)
+				free(lun, M_CTL);
+			be_lun->lun_config_status(be_lun->be_lun,
+						  CTL_LUN_CONFIG_FAILURE);
+			return (ENOSPC);
+		}
+		lun_number = be_lun->req_lun_id;
+	} else {
+		lun_number = ctl_ffz(ctl_softc->ctl_lun_mask, CTL_MAX_LUNS);
+		if (lun_number == -1) {
+			mtx_unlock(&ctl_softc->ctl_lock);
+			printf("ctl: can't allocate LUN on target %ju, out of "
+			       "LUNs\n", (uintmax_t)target_id.id);
+			if (lun->flags & CTL_LUN_MALLOCED)
+				free(lun, M_CTL);
+			be_lun->lun_config_status(be_lun->be_lun,
+						  CTL_LUN_CONFIG_FAILURE);
+			return (ENOSPC);
+		}
+	}
+	ctl_set_mask(ctl_softc->ctl_lun_mask, lun_number);
+
+	lun->target = target_id;
+	lun->lun = lun_number;
+	lun->be_lun = be_lun;
+	/*
+	 * The processor LUN is always enabled.  Disk LUNs come on line
+	 * disabled, and must be enabled by the backend.
+	 */
+	lun->flags = CTL_LUN_DISABLED;
+	lun->backend = be_lun->be;
+	be_lun->ctl_lun = lun;
+	be_lun->lun_id = lun_number;
+	atomic_add_int(&be_lun->be->num_luns, 1);
+	if (be_lun->flags & CTL_LUN_FLAG_POWERED_OFF)
+		lun->flags |= CTL_LUN_STOPPED;
+
+	if (be_lun->flags & CTL_LUN_FLAG_INOPERABLE)
+		lun->flags |= CTL_LUN_INOPERABLE;
+
+	if (be_lun->flags & CTL_LUN_FLAG_PRIMARY)
+		lun->flags |= CTL_LUN_PRIMARY_SC;
+
+	lun->ctl_softc = ctl_softc;
+	TAILQ_INIT(&lun->ooa_queue);
+	TAILQ_INIT(&lun->blocked_queue);
+	STAILQ_INIT(&lun->error_list);
+
+	/*
+	 * Initialize the mode page index.
+	 */
+	ctl_init_page_index(lun);
+
+	/*
+	 * Set the poweron UA for all initiators on this LUN only.
+	 */
+	for (i = 0; i < CTL_MAX_INITIATORS; i++)
+		lun->pending_sense[i].ua_pending = CTL_UA_POWERON;
+
+	/*
+	 * Now, before we insert this lun on the lun list, set the lun
+	 * inventory changed UA for all other luns.
+	 */
+	STAILQ_FOREACH(nlun, &ctl_softc->lun_list, links) {
+		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+			nlun->pending_sense[i].ua_pending |= CTL_UA_LUN_CHANGE;
+		}
+	}
+
+	STAILQ_INSERT_TAIL(&ctl_softc->lun_list, lun, links);
+
+	ctl_softc->ctl_luns[lun_number] = lun;
+
+	ctl_softc->num_luns++;
+
+	/* Setup statistics gathering */
+	lun->stats.device_type = be_lun->lun_type;
+	lun->stats.lun_number = lun_number;
+	if (lun->stats.device_type == T_DIRECT)
+		lun->stats.blocksize = be_lun->blocksize;
+	else
+		lun->stats.flags = CTL_LUN_STATS_NO_BLOCKSIZE;
+	for (i = 0;i < CTL_MAX_PORTS;i++)
+		lun->stats.ports[i].targ_port = i;
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	lun->be_lun->lun_config_status(lun->be_lun->be_lun, CTL_LUN_CONFIG_OK);
+
+	/*
+	 * Run through each registered FETD and bring it online if it isn't
+	 * already.  Enable the target ID if it hasn't been enabled, and
+	 * enable this particular LUN.
+	 */
+	STAILQ_FOREACH(fe, &ctl_softc->fe_list, links) {
+		int retval;
+
+		/*
+		 * XXX KDM this only works for ONE TARGET ID.  We'll need
+		 * to do things differently if we go to a multiple target
+		 * ID scheme.
+		 */
+		if ((fe->status & CTL_PORT_STATUS_TARG_ONLINE) == 0) {
+
+			retval = fe->targ_enable(fe->targ_lun_arg, target_id);
+			if (retval != 0) {
+				printf("ctl_alloc_lun: FETD %s port %d "
+				       "returned error %d for targ_enable on "
+				       "target %ju\n", fe->port_name,
+				       fe->targ_port, retval,
+				       (uintmax_t)target_id.id);
+			} else
+				fe->status |= CTL_PORT_STATUS_TARG_ONLINE;
+		}
+
+		retval = fe->lun_enable(fe->targ_lun_arg, target_id,lun_number);
+		if (retval != 0) {
+			printf("ctl_alloc_lun: FETD %s port %d returned error "
+			       "%d for lun_enable on target %ju lun %d\n",
+			       fe->port_name, fe->targ_port, retval,
+			       (uintmax_t)target_id.id, lun_number);
+		} else
+			fe->status |= CTL_PORT_STATUS_LUN_ONLINE;
+	}
+	return (0);
+}
+
+/*
+ * Delete a LUN.
+ * Assumptions:
+ * - caller holds ctl_softc->ctl_lock.
+ * - LUN has already been marked invalid and any pending I/O has been taken
+ *   care of.
+ */
+static int
+ctl_free_lun(struct ctl_lun *lun)
+{
+	struct ctl_softc *softc;
+#if 0
+	struct ctl_frontend *fe;
+#endif
+	struct ctl_lun *nlun;
+	union ctl_io *io, *next_io;
+	int i;
+
+	softc = lun->ctl_softc;
+
+	STAILQ_REMOVE(&softc->lun_list, lun, ctl_lun, links);
+
+	ctl_clear_mask(softc->ctl_lun_mask, lun->lun);
+
+	softc->ctl_luns[lun->lun] = NULL;
+
+	if (TAILQ_FIRST(&lun->ooa_queue) != NULL) {
+		printf("ctl_free_lun: aieee!! freeing a LUN with "
+		       "outstanding I/O!!\n");
+	}
+
+	/*
+	 * If we have anything pending on the RtR queue, remove it.
+	 */
+	for (io = (union ctl_io *)STAILQ_FIRST(&softc->rtr_queue); io != NULL;
+	     io = next_io) {
+		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
+		if ((io->io_hdr.nexus.targ_target.id == lun->target.id)
+		 && (io->io_hdr.nexus.targ_lun == lun->lun))
+			STAILQ_REMOVE(&softc->rtr_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+	}
+
+	/*
+	 * Then remove everything from the blocked queue.
+	 */
+	for (io = (union ctl_io *)TAILQ_FIRST(&lun->blocked_queue); io != NULL;
+	     io = next_io) {
+		next_io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr,blocked_links);
+		TAILQ_REMOVE(&lun->blocked_queue, &io->io_hdr, blocked_links);
+		io->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
+	}
+
+	/*
+	 * Now clear out the OOA queue, and free all the I/O.
+	 * XXX KDM should we notify the FETD here?  We probably need to
+	 * quiesce the LUN before deleting it.
+	 */
+	for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); io != NULL;
+	     io = next_io) {
+		next_io = (union ctl_io *)TAILQ_NEXT(&io->io_hdr, ooa_links);
+		TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr, ooa_links);
+		ctl_free_io_internal(io, /*have_lock*/ 1);
+	}
+
+	softc->num_luns--;
+
+	/*
+	 * XXX KDM this scheme only works for a single target/multiple LUN
+	 * setup.  It needs to be revamped for a multiple target scheme.
+	 *
+	 * XXX KDM this results in fe->lun_disable() getting called twice,
+	 * once when ctl_disable_lun() is called, and a second time here.
+	 * We really need to re-think the LUN disable semantics.  There
+	 * should probably be several steps/levels to LUN removal:
+	 *  - disable
+	 *  - invalidate
+	 *  - free
+ 	 *
+	 * Right now we only have a disable method when communicating to
+	 * the front end ports, at least for individual LUNs.
+	 */
+#if 0
+	STAILQ_FOREACH(fe, &softc->fe_list, links) {
+		int retval;
+
+		retval = fe->lun_disable(fe->targ_lun_arg, lun->target,
+					 lun->lun);
+		if (retval != 0) {
+			printf("ctl_free_lun: FETD %s port %d returned error "
+			       "%d for lun_disable on target %ju lun %jd\n",
+			       fe->port_name, fe->targ_port, retval,
+			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
+		}
+
+		if (STAILQ_FIRST(&softc->lun_list) == NULL) {
+			fe->status &= ~CTL_PORT_STATUS_LUN_ONLINE;
+
+			retval = fe->targ_disable(fe->targ_lun_arg,lun->target);
+			if (retval != 0) {
+				printf("ctl_free_lun: FETD %s port %d "
+				       "returned error %d for targ_disable on "
+				       "target %ju\n", fe->port_name,
+				       fe->targ_port, retval,
+				       (uintmax_t)lun->target.id);
+			} else
+				fe->status &= ~CTL_PORT_STATUS_TARG_ONLINE;
+
+			if ((fe->status & CTL_PORT_STATUS_TARG_ONLINE) != 0)
+				continue;
+
+#if 0
+			fe->port_offline(fe->onoff_arg);
+			fe->status &= ~CTL_PORT_STATUS_ONLINE;
+#endif
+		}
+	}
+#endif
+
+	/*
+	 * Tell the backend to free resources, if this LUN has a backend.
+	 */
+	atomic_subtract_int(&lun->be_lun->be->num_luns, 1);
+	lun->be_lun->lun_shutdown(lun->be_lun->be_lun);
+
+	if (lun->flags & CTL_LUN_MALLOCED)
+		free(lun, M_CTL);
+
+	STAILQ_FOREACH(nlun, &softc->lun_list, links) {
+		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+			nlun->pending_sense[i].ua_pending |= CTL_UA_LUN_CHANGE;
+		}
+	}
+
+	return (0);
+}
+
+static void
+ctl_create_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+
+	ctl_softc = control_softc;
+
+	/*
+	 * ctl_alloc_lun() should handle all potential failure cases.
+	 */
+	ctl_alloc_lun(ctl_softc, NULL, be_lun, ctl_softc->target);
+}
+
+int
+ctl_add_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+
+	ctl_softc = control_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	STAILQ_INSERT_TAIL(&ctl_softc->pending_lun_queue, be_lun, links);
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctl_wakeup_thread();
+
+	return (0);
+}
+
+int
+ctl_enable_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_frontend *fe, *nfe;
+	struct ctl_lun *lun;
+	int retval;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	if ((lun->flags & CTL_LUN_DISABLED) == 0) {
+		/*
+		 * eh?  Why did we get called if the LUN is already
+		 * enabled?
+		 */
+		mtx_unlock(&ctl_softc->ctl_lock);
+		return (0);
+	}
+	lun->flags &= ~CTL_LUN_DISABLED;
+
+	for (fe = STAILQ_FIRST(&ctl_softc->fe_list); fe != NULL; fe = nfe) {
+		nfe = STAILQ_NEXT(fe, links);
+
+		/*
+		 * Drop the lock while we call the FETD's enable routine.
+		 * This can lead to a callback into CTL (at least in the
+		 * case of the internal initiator frontend.
+		 */
+		mtx_unlock(&ctl_softc->ctl_lock);
+		retval = fe->lun_enable(fe->targ_lun_arg, lun->target,lun->lun);
+		mtx_lock(&ctl_softc->ctl_lock);
+		if (retval != 0) {
+			printf("%s: FETD %s port %d returned error "
+			       "%d for lun_enable on target %ju lun %jd\n",
+			       __func__, fe->port_name, fe->targ_port, retval,
+			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
+		}
+#if 0
+		 else {
+            /* NOTE:  TODO:  why does lun enable affect port status? */
+			fe->status |= CTL_PORT_STATUS_LUN_ONLINE;
+		}
+#endif
+	}
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_disable_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_frontend *fe;
+	struct ctl_lun *lun;
+	int retval;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	if (lun->flags & CTL_LUN_DISABLED) {
+		mtx_unlock(&ctl_softc->ctl_lock);
+		return (0);
+	}
+	lun->flags |= CTL_LUN_DISABLED;
+
+	STAILQ_FOREACH(fe, &ctl_softc->fe_list, links) {
+		mtx_unlock(&ctl_softc->ctl_lock);
+		/*
+		 * Drop the lock before we call the frontend's disable
+		 * routine, to avoid lock order reversals.
+		 *
+		 * XXX KDM what happens if the frontend list changes while
+		 * we're traversing it?  It's unlikely, but should be handled.
+		 */
+		retval = fe->lun_disable(fe->targ_lun_arg, lun->target,
+					 lun->lun);
+		mtx_lock(&ctl_softc->ctl_lock);
+		if (retval != 0) {
+			printf("ctl_alloc_lun: FETD %s port %d returned error "
+			       "%d for lun_disable on target %ju lun %jd\n",
+			       fe->port_name, fe->targ_port, retval,
+			       (uintmax_t)lun->target.id, (intmax_t)lun->lun);
+		}
+	}
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_start_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags &= ~CTL_LUN_STOPPED;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_stop_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags |= CTL_LUN_STOPPED;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_lun_offline(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags |= CTL_LUN_OFFLINE;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_lun_online(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags &= ~CTL_LUN_OFFLINE;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_invalidate_lun(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	/*
+	 * The LUN needs to be disabled before it can be marked invalid.
+	 */
+	if ((lun->flags & CTL_LUN_DISABLED) == 0) {
+		mtx_unlock(&ctl_softc->ctl_lock);
+		return (-1);
+	}
+	/*
+	 * Mark the LUN invalid.
+	 */
+	lun->flags |= CTL_LUN_INVALID;
+
+	/*
+	 * If there is nothing in the OOA queue, go ahead and free the LUN.
+	 * If we have something in the OOA queue, we'll free it when the
+	 * last I/O completes.
+	 */
+	if (TAILQ_FIRST(&lun->ooa_queue) == NULL)
+		ctl_free_lun(lun);
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_lun_inoperable(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags |= CTL_LUN_INOPERABLE;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_lun_operable(struct ctl_be_lun *be_lun)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	ctl_softc = control_softc;
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags &= ~CTL_LUN_INOPERABLE;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_lun_power_lock(struct ctl_be_lun *be_lun, struct ctl_nexus *nexus,
+		   int lock)
+{
+	struct ctl_softc *softc;
+	struct ctl_lun *lun;
+	struct copan_aps_subpage *current_sp;
+	struct ctl_page_index *page_index;
+	int i;
+
+	softc = control_softc;
+
+	mtx_lock(&softc->ctl_lock);
+
+	lun = (struct ctl_lun *)be_lun->ctl_lun;
+
+	page_index = NULL;
+	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+		if ((lun->mode_pages.index[i].page_code & SMPH_PC_MASK) !=
+		     APS_PAGE_CODE)
+			continue;
+
+		if (lun->mode_pages.index[i].subpage != APS_SUBPAGE_CODE)
+			continue;
+		page_index = &lun->mode_pages.index[i];
+	}
+
+	if (page_index == NULL) {
+		mtx_unlock(&softc->ctl_lock);
+		printf("%s: APS subpage not found for lun %ju!\n", __func__,
+		       (uintmax_t)lun->lun);
+		return (1);
+	}
+#if 0
+	if ((softc->aps_locked_lun != 0)
+	 && (softc->aps_locked_lun != lun->lun)) {
+		printf("%s: attempt to lock LUN %llu when %llu is already "
+		       "locked\n");
+		mtx_unlock(&softc->ctl_lock);
+		return (1);
+	}
+#endif
+
+	current_sp = (struct copan_aps_subpage *)(page_index->page_data +
+		(page_index->page_len * CTL_PAGE_CURRENT));
+
+	if (lock != 0) {
+		current_sp->lock_active = APS_LOCK_ACTIVE;
+		softc->aps_locked_lun = lun->lun;
+	} else {
+		current_sp->lock_active = 0;
+		softc->aps_locked_lun = 0;
+	}
+
+
+	/*
+	 * If we're in HA mode, try to send the lock message to the other
+	 * side.
+	 */
+	if (ctl_is_single == 0) {
+		int isc_retval;
+		union ctl_ha_msg lock_msg;
+
+		lock_msg.hdr.nexus = *nexus;
+		lock_msg.hdr.msg_type = CTL_MSG_APS_LOCK;
+		if (lock != 0)
+			lock_msg.aps.lock_flag = 1;
+		else
+			lock_msg.aps.lock_flag = 0;
+		isc_retval = ctl_ha_msg_send(CTL_HA_CHAN_CTL, &lock_msg,
+					 sizeof(lock_msg), 0);
+		if (isc_retval > CTL_HA_STATUS_SUCCESS) {
+			printf("%s: APS (lock=%d) error returned from "
+			       "ctl_ha_msg_send: %d\n", __func__, lock, isc_retval);
+			mtx_unlock(&softc->ctl_lock);
+			return (1);
+		}
+	}
+
+	mtx_unlock(&softc->ctl_lock);
+
+	return (0);
+}
+
+/*
+ * Backend "memory move is complete" callback for requests that never
+ * make it down to say RAIDCore's configuration code.
+ */
+int
+ctl_config_move_done(union ctl_io *io)
+{
+	int retval;
+
+	retval = CTL_RETVAL_COMPLETE;
+
+
+	CTL_DEBUG_PRINT(("ctl_config_move_done\n"));
+	/*
+	 * XXX KDM this shouldn't happen, but what if it does?
+	 */
+	if (io->io_hdr.io_type != CTL_IO_SCSI)
+		panic("I/O type isn't CTL_IO_SCSI!");
+
+	if ((io->io_hdr.port_status == 0)
+	 && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
+	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE))
+		io->io_hdr.status = CTL_SUCCESS;
+	else if ((io->io_hdr.port_status != 0)
+	      && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
+	      && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)){
+		/*
+		 * For hardware error sense keys, the sense key
+		 * specific value is defined to be a retry count,
+		 * but we use it to pass back an internal FETD
+		 * error code.  XXX KDM  Hopefully the FETD is only
+		 * using 16 bits for an error code, since that's
+		 * all the space we have in the sks field.
+		 */
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 1,
+					 /*retry_count*/
+					 io->io_hdr.port_status);
+		free(io->scsiio.kern_data_ptr, M_CTL);
+		ctl_done(io);
+		goto bailout;
+	}
+
+	if (((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN)
+	 || ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
+	 || ((io->io_hdr.flags & CTL_FLAG_ABORT) != 0)) {
+		/*
+		 * XXX KDM just assuming a single pointer here, and not a
+		 * S/G list.  If we start using S/G lists for config data,
+		 * we'll need to know how to clean them up here as well.
+		 */
+		free(io->scsiio.kern_data_ptr, M_CTL);
+		/* Hopefully the user has already set the status... */
+		ctl_done(io);
+	} else {
+		/*
+		 * XXX KDM now we need to continue data movement.  Some
+		 * options:
+		 * - call ctl_scsiio() again?  We don't do this for data
+		 *   writes, because for those at least we know ahead of
+		 *   time where the write will go and how long it is.  For
+		 *   config writes, though, that information is largely
+		 *   contained within the write itself, thus we need to
+		 *   parse out the data again.
+		 *
+		 * - Call some other function once the data is in?
+		 */
+
+		/*
+		 * XXX KDM call ctl_scsiio() again for now, and check flag
+		 * bits to see whether we're allocated or not.
+		 */
+		retval = ctl_scsiio(&io->scsiio);
+	}
+bailout:
+	return (retval);
+}
+
+/*
+ * This gets called by a backend driver when it is done with a
+ * configuration write.
+ */
+void
+ctl_config_write_done(union ctl_io *io)
+{
+	/*
+	 * If the IO_CONT flag is set, we need to call the supplied
+	 * function to continue processing the I/O, instead of completing
+	 * the I/O just yet.
+	 *
+	 * If there is an error, though, we don't want to keep processing.
+	 * Instead, just send status back to the initiator.
+	 */
+	if ((io->io_hdr.flags & CTL_FLAG_IO_CONT)
+	 && (((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)
+	  || ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS))) {
+		io->scsiio.io_cont(io);
+		return;
+	}
+	/*
+	 * Since a configuration write can be done for commands that actually
+	 * have data allocated, like write buffer, and commands that have
+	 * no data, like start/stop unit, we need to check here.
+	 */
+	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_OUT)
+		free(io->scsiio.kern_data_ptr, M_CTL);
+	ctl_done(io);
+}
+
+/*
+ * SCSI release command.
+ */
+int
+ctl_scsi_release(struct ctl_scsiio *ctsio)
+{
+	int length, longid, thirdparty_id, resv_id;
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	length = 0;
+	resv_id = 0;
+
+	CTL_DEBUG_PRINT(("ctl_scsi_release\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	ctl_softc = control_softc;
+
+	switch (ctsio->cdb[0]) {
+	case RELEASE: {
+		struct scsi_release *cdb;
+
+		cdb = (struct scsi_release *)ctsio->cdb;
+		if ((cdb->byte2 & 0x1f) != 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 1,
+					      /*bit_valid*/ 0,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		break;
+	}
+	case RELEASE_10: {
+		struct scsi_release_10 *cdb;
+
+		cdb = (struct scsi_release_10 *)ctsio->cdb;
+
+		if ((cdb->byte2 & SR10_EXTENT) != 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 1,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+
+		}
+
+		if ((cdb->byte2 & SR10_3RDPTY) != 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 1,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 4);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+
+		if (cdb->byte2 & SR10_LONGID)
+			longid = 1;
+		else
+			thirdparty_id = cdb->thirdparty_id;
+
+		resv_id = cdb->resv_id;
+		length = scsi_2btoul(cdb->length);
+		break;
+	}
+	}
+
+
+	/*
+	 * XXX KDM right now, we only support LUN reservation.  We don't
+	 * support 3rd party reservations, or extent reservations, which
+	 * might actually need the parameter list.  If we've gotten this
+	 * far, we've got a LUN reservation.  Anything else got kicked out
+	 * above.  So, according to SPC, ignore the length.
+	 */
+	length = 0;
+
+	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
+	 && (length > 0)) {
+		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
+		if (ctsio->kern_data_ptr == NULL) {
+			ctsio->io_hdr.status = CTL_SCSI_ERROR;
+			ctsio->io_hdr.status = SCSI_STATUS_BUSY;
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		ctsio->kern_data_len = length;
+		ctsio->kern_total_len = length;
+		ctsio->kern_data_resid = 0;
+		ctsio->kern_rel_offset = 0;
+		ctsio->kern_sg_entries = 0;
+		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	if (length > 0)
+		thirdparty_id = scsi_8btou64(ctsio->kern_data_ptr);
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	/*
+	 * According to SPC, it is not an error for an intiator to attempt
+	 * to release a reservation on a LUN that isn't reserved, or that
+	 * is reserved by another initiator.  The reservation can only be
+	 * released, though, by the initiator who made it or by one of
+	 * several reset type events.
+	 */
+	if (lun->flags & CTL_LUN_RESERVED) {
+		if ((ctsio->io_hdr.nexus.initid.id == lun->rsv_nexus.initid.id)
+		 && (ctsio->io_hdr.nexus.targ_port == lun->rsv_nexus.targ_port)
+		 && (ctsio->io_hdr.nexus.targ_target.id ==
+		     lun->rsv_nexus.targ_target.id)) {
+			lun->flags &= ~CTL_LUN_RESERVED;
+		}
+	}
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+	ctsio->io_hdr.status = CTL_SUCCESS;
+
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctl_done((union ctl_io *)ctsio);
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_scsi_reserve(struct ctl_scsiio *ctsio)
+{
+	int extent, thirdparty, longid;
+	int resv_id, length;
+	uint64_t thirdparty_id;
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+
+	extent = 0;
+	thirdparty = 0;
+	longid = 0;
+	resv_id = 0;
+	length = 0;
+	thirdparty_id = 0;
+
+	CTL_DEBUG_PRINT(("ctl_reserve\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	ctl_softc = control_softc;
+
+	switch (ctsio->cdb[0]) {
+	case RESERVE: {
+		struct scsi_reserve *cdb;
+
+		cdb = (struct scsi_reserve *)ctsio->cdb;
+		if ((cdb->byte2 & 0x1f) != 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 1,
+					      /*bit_valid*/ 0,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		resv_id = cdb->resv_id;
+		length = scsi_2btoul(cdb->length);
+		break;
+	}
+	case RESERVE_10: {
+		struct scsi_reserve_10 *cdb;
+
+		cdb = (struct scsi_reserve_10 *)ctsio->cdb;
+
+		if ((cdb->byte2 & SR10_EXTENT) != 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 1,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		if ((cdb->byte2 & SR10_3RDPTY) != 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 1,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 4);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		if (cdb->byte2 & SR10_LONGID)
+			longid = 1;
+		else
+			thirdparty_id = cdb->thirdparty_id;
+
+		resv_id = cdb->resv_id;
+		length = scsi_2btoul(cdb->length);
+		break;
+	}
+	}
+
+	/*
+	 * XXX KDM right now, we only support LUN reservation.  We don't
+	 * support 3rd party reservations, or extent reservations, which
+	 * might actually need the parameter list.  If we've gotten this
+	 * far, we've got a LUN reservation.  Anything else got kicked out
+	 * above.  So, according to SPC, ignore the length.
+	 */
+	length = 0;
+
+	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
+	 && (length > 0)) {
+		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
+		if (ctsio->kern_data_ptr == NULL) {
+			ctsio->io_hdr.status = CTL_SCSI_ERROR;
+			ctsio->io_hdr.status = SCSI_STATUS_BUSY;
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		ctsio->kern_data_len = length;
+		ctsio->kern_total_len = length;
+		ctsio->kern_data_resid = 0;
+		ctsio->kern_rel_offset = 0;
+		ctsio->kern_sg_entries = 0;
+		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	if (length > 0)
+		thirdparty_id = scsi_8btou64(ctsio->kern_data_ptr);
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	if (lun->flags & CTL_LUN_RESERVED) {
+		if ((ctsio->io_hdr.nexus.initid.id != lun->rsv_nexus.initid.id)
+		 || (ctsio->io_hdr.nexus.targ_port != lun->rsv_nexus.targ_port)
+		 || (ctsio->io_hdr.nexus.targ_target.id !=
+		     lun->rsv_nexus.targ_target.id)) {
+			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
+			ctsio->io_hdr.status = CTL_SCSI_ERROR;
+			goto bailout;
+		}
+	}
+
+	lun->flags |= CTL_LUN_RESERVED;
+	lun->rsv_nexus = ctsio->io_hdr.nexus;
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+	ctsio->io_hdr.status = CTL_SUCCESS;
+
+bailout:
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctl_done((union ctl_io *)ctsio);
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_start_stop(struct ctl_scsiio *ctsio)
+{
+	struct scsi_start_stop_unit *cdb;
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	int retval;
+
+	CTL_DEBUG_PRINT(("ctl_start_stop\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	ctl_softc = control_softc;
+	retval = 0;
+
+	cdb = (struct scsi_start_stop_unit *)ctsio->cdb;
+
+	/*
+	 * XXX KDM
+	 * We don't support the immediate bit on a stop unit.  In order to
+	 * do that, we would need to code up a way to know that a stop is
+	 * pending, and hold off any new commands until it completes, one
+	 * way or another.  Then we could accept or reject those commands
+	 * depending on its status.  We would almost need to do the reverse
+	 * of what we do below for an immediate start -- return the copy of
+	 * the ctl_io to the FETD with status to send to the host (and to
+	 * free the copy!) and then free the original I/O once the stop
+	 * actually completes.  That way, the OOA queue mechanism can work
+	 * to block commands that shouldn't proceed.  Another alternative
+	 * would be to put the copy in the queue in place of the original,
+	 * and return the original back to the caller.  That could be
+	 * slightly safer..
+	 */
+	if ((cdb->byte2 & SSS_IMMED)
+	 && ((cdb->how & SSS_START) == 0)) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * We don't support the power conditions field.  We need to check
+	 * this prior to checking the load/eject and start/stop bits.
+	 */
+	if ((cdb->how & SSS_PC_MASK) != SSS_PC_START_VALID) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 4,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 4);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Media isn't removable, so we can't load or eject it.
+	 */
+	if ((cdb->how & SSS_LOEJ) != 0) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 4,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 1);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	if ((lun->flags & CTL_LUN_PR_RESERVED)
+	 && ((cdb->how & SSS_START)==0)) {
+		uint32_t residx;
+
+		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
+		if (!lun->per_res[residx].registered
+		 || (lun->pr_res_idx!=residx && lun->res_type < 4)) {
+
+			ctl_set_reservation_conflict(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+	}
+
+	/*
+	 * If there is no backend on this device, we can't start or stop
+	 * it.  In theory we shouldn't get any start/stop commands in the
+	 * first place at this level if the LUN doesn't have a backend.
+	 * That should get stopped by the command decode code.
+	 */
+	if (lun->backend == NULL) {
+		ctl_set_invalid_opcode(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * XXX KDM Copan-specific offline behavior.
+	 * Figure out a reasonable way to port this?
+	 */
+#ifdef NEEDTOPORT
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	if (((cdb->byte2 & SSS_ONOFFLINE) == 0)
+	 && (lun->flags & CTL_LUN_OFFLINE)) {
+		/*
+		 * If the LUN is offline, and the on/offline bit isn't set,
+		 * reject the start or stop.  Otherwise, let it through.
+		 */
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_set_lun_not_ready(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+	} else {
+		mtx_unlock(&ctl_softc->ctl_lock);
+#endif /* NEEDTOPORT */
+		/*
+		 * This could be a start or a stop when we're online,
+		 * or a stop/offline or start/online.  A start or stop when
+		 * we're offline is covered in the case above.
+		 */
+		/*
+		 * In the non-immediate case, we send the request to
+		 * the backend and return status to the user when
+		 * it is done.
+		 *
+		 * In the immediate case, we allocate a new ctl_io
+		 * to hold a copy of the request, and send that to
+		 * the backend.  We then set good status on the
+		 * user's request and return it immediately.
+		 */
+		if (cdb->byte2 & SSS_IMMED) {
+			union ctl_io *new_io;
+
+			new_io = ctl_alloc_io(ctsio->io_hdr.pool);
+			if (new_io == NULL) {
+				ctl_set_busy(ctsio);
+				ctl_done((union ctl_io *)ctsio);
+			} else {
+				ctl_copy_io((union ctl_io *)ctsio,
+					    new_io);
+				retval = lun->backend->config_write(new_io);
+				ctl_set_success(ctsio);
+				ctl_done((union ctl_io *)ctsio);
+			}
+		} else {
+			retval = lun->backend->config_write(
+				(union ctl_io *)ctsio);
+		}
+#ifdef NEEDTOPORT
+	}
+#endif
+	return (retval);
+}
+
+/*
+ * We support the SYNCHRONIZE CACHE command (10 and 16 byte versions), but
+ * we don't really do anything with the LBA and length fields if the user
+ * passes them in.  Instead we'll just flush out the cache for the entire
+ * LUN.
+ */
+int
+ctl_sync_cache(struct ctl_scsiio *ctsio)
+{
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	uint64_t starting_lba;
+	uint32_t block_count;
+	int reladr, immed;
+	int retval;
+
+	CTL_DEBUG_PRINT(("ctl_sync_cache\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	ctl_softc = control_softc;
+	retval = 0;
+	reladr = 0;
+	immed = 0;
+
+	switch (ctsio->cdb[0]) {
+	case SYNCHRONIZE_CACHE: {
+		struct scsi_sync_cache *cdb;
+		cdb = (struct scsi_sync_cache *)ctsio->cdb;
+
+		if (cdb->byte2 & SSC_RELADR)
+			reladr = 1;
+
+		if (cdb->byte2 & SSC_IMMED)
+			immed = 1;
+
+		starting_lba = scsi_4btoul(cdb->begin_lba);
+		block_count = scsi_2btoul(cdb->lb_count);
+		break;
+	}
+	case SYNCHRONIZE_CACHE_16: {
+		struct scsi_sync_cache_16 *cdb;
+		cdb = (struct scsi_sync_cache_16 *)ctsio->cdb;
+
+		if (cdb->byte2 & SSC_RELADR)
+			reladr = 1;
+
+		if (cdb->byte2 & SSC_IMMED)
+			immed = 1;
+
+		starting_lba = scsi_8btou64(cdb->begin_lba);
+		block_count = scsi_4btoul(cdb->lb_count);
+		break;
+	}
+	default:
+		ctl_set_invalid_opcode(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+		break; /* NOTREACHED */
+	}
+
+	if (immed) {
+		/*
+		 * We don't support the immediate bit.  Since it's in the
+		 * same place for the 10 and 16 byte SYNCHRONIZE CACHE
+		 * commands, we can just return the same error in either
+		 * case.
+		 */
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 1);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	}
+
+	if (reladr) {
+		/*
+		 * We don't support the reladr bit either.  It can only be
+		 * used with linked commands, and we don't support linked
+		 * commands.  Since the bit is in the same place for the
+		 * 10 and 16 byte SYNCHRONIZE CACHE * commands, we can
+		 * just return the same error in either case.
+		 */
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	}
+
+	/*
+	 * We check the LBA and length, but don't do anything with them.
+	 * A SYNCHRONIZE CACHE will cause the entire cache for this lun to
+	 * get flushed.  This check will just help satisfy anyone who wants
+	 * to see an error for an out of range LBA.
+	 */
+	if ((starting_lba + block_count) > (lun->be_lun->maxlba + 1)) {
+		ctl_set_lba_out_of_range(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	}
+
+	/*
+	 * If this LUN has no backend, we can't flush the cache anyway.
+	 */
+	if (lun->backend == NULL) {
+		ctl_set_invalid_opcode(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	}
+
+	/*
+	 * Check to see whether we're configured to send the SYNCHRONIZE
+	 * CACHE command directly to the back end.
+	 */
+	mtx_lock(&ctl_softc->ctl_lock);
+	if ((ctl_softc->flags & CTL_FLAG_REAL_SYNC)
+	 && (++(lun->sync_count) >= lun->sync_interval)) {
+		lun->sync_count = 0;
+		mtx_unlock(&ctl_softc->ctl_lock);
+		retval = lun->backend->config_write((union ctl_io *)ctsio);
+	} else {
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_set_success(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+	}
+
+bailout:
+
+	return (retval);
+}
+
+int
+ctl_format(struct ctl_scsiio *ctsio)
+{
+	struct scsi_format *cdb;
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	int length, defect_list_len;
+
+	CTL_DEBUG_PRINT(("ctl_format\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	ctl_softc = control_softc;
+
+	cdb = (struct scsi_format *)ctsio->cdb;
+
+	length = 0;
+	if (cdb->byte2 & SF_FMTDATA) {
+		if (cdb->byte2 & SF_LONGLIST)
+			length = sizeof(struct scsi_format_header_long);
+		else
+			length = sizeof(struct scsi_format_header_short);
+	}
+
+	if (((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0)
+	 && (length > 0)) {
+		ctsio->kern_data_ptr = malloc(length, M_CTL, M_WAITOK);
+		if (ctsio->kern_data_ptr == NULL) {
+			ctsio->io_hdr.status = CTL_SCSI_ERROR;
+			ctsio->io_hdr.status = SCSI_STATUS_BUSY;
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		ctsio->kern_data_len = length;
+		ctsio->kern_total_len = length;
+		ctsio->kern_data_resid = 0;
+		ctsio->kern_rel_offset = 0;
+		ctsio->kern_sg_entries = 0;
+		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	defect_list_len = 0;
+
+	if (cdb->byte2 & SF_FMTDATA) {
+		if (cdb->byte2 & SF_LONGLIST) {
+			struct scsi_format_header_long *header;
+
+			header = (struct scsi_format_header_long *)
+				ctsio->kern_data_ptr;
+
+			defect_list_len = scsi_4btoul(header->defect_list_len);
+			if (defect_list_len != 0) {
+				ctl_set_invalid_field(ctsio,
+						      /*sks_valid*/ 1,
+						      /*command*/ 0,
+						      /*field*/ 2,
+						      /*bit_valid*/ 0,
+						      /*bit*/ 0);
+				goto bailout;
+			}
+		} else {
+			struct scsi_format_header_short *header;
+
+			header = (struct scsi_format_header_short *)
+				ctsio->kern_data_ptr;
+
+			defect_list_len = scsi_2btoul(header->defect_list_len);
+			if (defect_list_len != 0) {
+				ctl_set_invalid_field(ctsio,
+						      /*sks_valid*/ 1,
+						      /*command*/ 0,
+						      /*field*/ 2,
+						      /*bit_valid*/ 0,
+						      /*bit*/ 0);
+				goto bailout;
+			}
+		}
+	}
+
+	/*
+	 * The format command will clear out the "Medium format corrupted"
+	 * status if set by the configuration code.  That status is really
+	 * just a way to notify the host that we have lost the media, and
+	 * get them to issue a command that will basically make them think
+	 * they're blowing away the media.
+	 */
+	mtx_lock(&ctl_softc->ctl_lock);
+	lun->flags &= ~CTL_LUN_INOPERABLE;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+	ctsio->io_hdr.status = CTL_SUCCESS;
+bailout:
+
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
+
+	ctl_done((union ctl_io *)ctsio);
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_write_buffer(struct ctl_scsiio *ctsio)
+{
+	struct scsi_write_buffer *cdb;
+	struct copan_page_header *header;
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	int buffer_offset, len;
+	int retval;
+
+	header = NULL;
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	CTL_DEBUG_PRINT(("ctl_write_buffer\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	ctl_softc = control_softc;
+	cdb = (struct scsi_write_buffer *)ctsio->cdb;
+
+	if ((cdb->byte2 & RWB_MODE) != RWB_MODE_DATA) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 4);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	if (cdb->buffer_id != 0) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 2,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	len = scsi_3btoul(cdb->length);
+	buffer_offset = scsi_3btoul(cdb->offset);
+
+	if (len > sizeof(lun->write_buffer)) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 6,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	if (buffer_offset != 0) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 3,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * If we've got a kernel request that hasn't been malloced yet,
+	 * malloc it and tell the caller the data buffer is here.
+	 */
+	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
+		ctsio->kern_data_ptr = lun->write_buffer;
+		ctsio->kern_data_len = len;
+		ctsio->kern_total_len = len;
+		ctsio->kern_data_resid = 0;
+		ctsio->kern_rel_offset = 0;
+		ctsio->kern_sg_entries = 0;
+		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	ctl_done((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * Note that this function currently doesn't actually do anything inside
+ * CTL to enforce things if the DQue bit is turned on.
+ *
+ * Also note that this function can't be used in the default case, because
+ * the DQue bit isn't set in the changeable mask for the control mode page
+ * anyway.  This is just here as an example for how to implement a page
+ * handler, and a placeholder in case we want to allow the user to turn
+ * tagged queueing on and off.
+ *
+ * The D_SENSE bit handling is functional, however, and will turn
+ * descriptor sense on and off for a given LUN.
+ */
+int
+ctl_control_page_handler(struct ctl_scsiio *ctsio,
+			 struct ctl_page_index *page_index, uint8_t *page_ptr)
+{
+	struct scsi_control_page *current_cp, *saved_cp, *user_cp;
+	struct ctl_lun *lun;
+	struct ctl_softc *softc;
+	int set_ua;
+	uint32_t initidx;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
+	set_ua = 0;
+
+	user_cp = (struct scsi_control_page *)page_ptr;
+	current_cp = (struct scsi_control_page *)
+		(page_index->page_data + (page_index->page_len *
+		CTL_PAGE_CURRENT));
+	saved_cp = (struct scsi_control_page *)
+		(page_index->page_data + (page_index->page_len *
+		CTL_PAGE_SAVED));
+
+	softc = control_softc;
+
+	mtx_lock(&softc->ctl_lock);
+	if (((current_cp->rlec & SCP_DSENSE) == 0)
+	 && ((user_cp->rlec & SCP_DSENSE) != 0)) {
+		/*
+		 * Descriptor sense is currently turned off and the user
+		 * wants to turn it on.
+		 */
+		current_cp->rlec |= SCP_DSENSE;
+		saved_cp->rlec |= SCP_DSENSE;
+		lun->flags |= CTL_LUN_SENSE_DESC;
+		set_ua = 1;
+	} else if (((current_cp->rlec & SCP_DSENSE) != 0)
+		&& ((user_cp->rlec & SCP_DSENSE) == 0)) {
+		/*
+		 * Descriptor sense is currently turned on, and the user
+		 * wants to turn it off.
+		 */
+		current_cp->rlec &= ~SCP_DSENSE;
+		saved_cp->rlec &= ~SCP_DSENSE;
+		lun->flags &= ~CTL_LUN_SENSE_DESC;
+		set_ua = 1;
+	}
+	if (current_cp->queue_flags & SCP_QUEUE_DQUE) {
+		if (user_cp->queue_flags & SCP_QUEUE_DQUE) {
+#ifdef NEEDTOPORT
+			csevent_log(CSC_CTL | CSC_SHELF_SW |
+				    CTL_UNTAG_TO_UNTAG,
+				    csevent_LogType_Trace,
+				    csevent_Severity_Information,
+				    csevent_AlertLevel_Green,
+				    csevent_FRU_Firmware,
+				    csevent_FRU_Unknown,
+				    "Received untagged to untagged transition");
+#endif /* NEEDTOPORT */
+		} else {
+#ifdef NEEDTOPORT
+			csevent_log(CSC_CTL | CSC_SHELF_SW |
+				    CTL_UNTAG_TO_TAG,
+				    csevent_LogType_ConfigChange,
+				    csevent_Severity_Information,
+				    csevent_AlertLevel_Green,
+				    csevent_FRU_Firmware,
+				    csevent_FRU_Unknown,
+				    "Received untagged to tagged "
+				    "queueing transition");
+#endif /* NEEDTOPORT */
+
+			current_cp->queue_flags &= ~SCP_QUEUE_DQUE;
+			saved_cp->queue_flags &= ~SCP_QUEUE_DQUE;
+			set_ua = 1;
+		}
+	} else {
+		if (user_cp->queue_flags & SCP_QUEUE_DQUE) {
+#ifdef NEEDTOPORT
+			csevent_log(CSC_CTL | CSC_SHELF_SW |
+				    CTL_TAG_TO_UNTAG,
+				    csevent_LogType_ConfigChange,
+				    csevent_Severity_Warning,
+				    csevent_AlertLevel_Yellow,
+				    csevent_FRU_Firmware,
+				    csevent_FRU_Unknown,
+				    "Received tagged queueing to untagged "
+				    "transition");
+#endif /* NEEDTOPORT */
+
+			current_cp->queue_flags |= SCP_QUEUE_DQUE;
+			saved_cp->queue_flags |= SCP_QUEUE_DQUE;
+			set_ua = 1;
+		} else {
+#ifdef NEEDTOPORT
+			csevent_log(CSC_CTL | CSC_SHELF_SW |
+				    CTL_TAG_TO_TAG,
+				    csevent_LogType_Trace,
+				    csevent_Severity_Information,
+				    csevent_AlertLevel_Green,
+				    csevent_FRU_Firmware,
+				    csevent_FRU_Unknown,
+				    "Received tagged queueing to tagged "
+				    "queueing transition");
+#endif /* NEEDTOPORT */
+		}
+	}
+	if (set_ua != 0) {
+		int i;
+		/*
+		 * Let other initiators know that the mode
+		 * parameters for this LUN have changed.
+		 */
+		for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+			if (i == initidx)
+				continue;
+
+			lun->pending_sense[i].ua_pending |=
+				CTL_UA_MODE_CHANGE;
+		}
+	}
+	mtx_unlock(&softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_power_sp_handler(struct ctl_scsiio *ctsio,
+		     struct ctl_page_index *page_index, uint8_t *page_ptr)
+{
+	return (0);
+}
+
+int
+ctl_power_sp_sense_handler(struct ctl_scsiio *ctsio,
+			   struct ctl_page_index *page_index, int pc)
+{
+	struct copan_power_subpage *page;
+
+	page = (struct copan_power_subpage *)page_index->page_data +
+		(page_index->page_len * pc);
+
+	switch (pc) {
+	case SMS_PAGE_CTRL_CHANGEABLE >> 6:
+		/*
+		 * We don't update the changable bits for this page.
+		 */
+		break;
+	case SMS_PAGE_CTRL_CURRENT >> 6:
+	case SMS_PAGE_CTRL_DEFAULT >> 6:
+	case SMS_PAGE_CTRL_SAVED >> 6:
+#ifdef NEEDTOPORT
+		ctl_update_power_subpage(page);
+#endif
+		break;
+	default:
+#ifdef NEEDTOPORT
+		EPRINT(0, "Invalid PC %d!!", pc);
+#endif
+		break;
+	}
+	return (0);
+}
+
+
+int
+ctl_aps_sp_handler(struct ctl_scsiio *ctsio,
+		   struct ctl_page_index *page_index, uint8_t *page_ptr)
+{
+	struct copan_aps_subpage *user_sp;
+	struct copan_aps_subpage *current_sp;
+	union ctl_modepage_info *modepage_info;
+	struct ctl_softc *softc;
+	struct ctl_lun *lun;
+	int retval;
+
+	retval = CTL_RETVAL_COMPLETE;
+	current_sp = (struct copan_aps_subpage *)(page_index->page_data +
+		     (page_index->page_len * CTL_PAGE_CURRENT));
+	softc = control_softc;
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	user_sp = (struct copan_aps_subpage *)page_ptr;
+
+	modepage_info = (union ctl_modepage_info *)
+		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
+
+	modepage_info->header.page_code = page_index->page_code & SMPH_PC_MASK;
+	modepage_info->header.subpage = page_index->subpage;
+	modepage_info->aps.lock_active = user_sp->lock_active;
+
+	mtx_lock(&softc->ctl_lock);
+
+	/*
+	 * If there is a request to lock the LUN and another LUN is locked
+	 * this is an error. If the requested LUN is already locked ignore
+	 * the request. If no LUN is locked attempt to lock it.
+	 * if there is a request to unlock the LUN and the LUN is currently
+	 * locked attempt to unlock it. Otherwise ignore the request. i.e.
+	 * if another LUN is locked or no LUN is locked.
+	 */
+	if (user_sp->lock_active & APS_LOCK_ACTIVE) {
+		if (softc->aps_locked_lun == lun->lun) {
+			/*
+			 * This LUN is already locked, so we're done.
+			 */
+			retval = CTL_RETVAL_COMPLETE;
+		} else if (softc->aps_locked_lun == 0) {
+			/*
+			 * No one has the lock, pass the request to the
+			 * backend.
+			 */
+			retval = lun->backend->config_write(
+				(union ctl_io *)ctsio);
+		} else {
+			/*
+			 * Someone else has the lock, throw out the request.
+			 */
+			ctl_set_already_locked(ctsio);
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_done((union ctl_io *)ctsio);
+
+			/*
+			 * Set the return value so that ctl_do_mode_select()
+			 * won't try to complete the command.  We already
+			 * completed it here.
+			 */
+			retval = CTL_RETVAL_ERROR;
+		}
+	} else if (softc->aps_locked_lun == lun->lun) {
+		/*
+		 * This LUN is locked, so pass the unlock request to the
+		 * backend.
+		 */
+		retval = lun->backend->config_write((union ctl_io *)ctsio);
+	}
+	mtx_unlock(&softc->ctl_lock);
+
+	return (retval);
+}
+
+int
+ctl_debugconf_sp_select_handler(struct ctl_scsiio *ctsio,
+				struct ctl_page_index *page_index,
+				uint8_t *page_ptr)
+{
+	uint8_t *c;
+	int i;
+
+	c = ((struct copan_debugconf_subpage *)page_ptr)->ctl_time_io_secs;
+	ctl_time_io_secs =
+		(c[0] << 8) |
+		(c[1] << 0) |
+		0;
+	CTL_DEBUG_PRINT(("set ctl_time_io_secs to %d\n", ctl_time_io_secs));
+	printf("set ctl_time_io_secs to %d\n", ctl_time_io_secs);
+	printf("page data:");
+	for (i=0; i<8; i++)
+		printf(" %.2x",page_ptr[i]);
+	printf("\n");
+	return (0);
+}
+
+int
+ctl_debugconf_sp_sense_handler(struct ctl_scsiio *ctsio,
+			       struct ctl_page_index *page_index,
+			       int pc)
+{
+	struct copan_debugconf_subpage *page;
+
+	page = (struct copan_debugconf_subpage *)page_index->page_data +
+		(page_index->page_len * pc);
+
+	switch (pc) {
+	case SMS_PAGE_CTRL_CHANGEABLE >> 6:
+	case SMS_PAGE_CTRL_DEFAULT >> 6:
+	case SMS_PAGE_CTRL_SAVED >> 6:
+		/*
+		 * We don't update the changable or default bits for this page.
+		 */
+		break;
+	case SMS_PAGE_CTRL_CURRENT >> 6:
+		page->ctl_time_io_secs[0] = ctl_time_io_secs >> 8;
+		page->ctl_time_io_secs[1] = ctl_time_io_secs >> 0;
+		break;
+	default:
+#ifdef NEEDTOPORT
+		EPRINT(0, "Invalid PC %d!!", pc);
+#endif /* NEEDTOPORT */
+		break;
+	}
+	return (0);
+}
+
+
+static int
+ctl_do_mode_select(union ctl_io *io)
+{
+	struct scsi_mode_page_header *page_header;
+	struct ctl_page_index *page_index;
+	struct ctl_scsiio *ctsio;
+	int control_dev, page_len;
+	int page_len_offset, page_len_size;
+	union ctl_modepage_info *modepage_info;
+	struct ctl_lun *lun;
+	int *len_left, *len_used;
+	int retval, i;
+
+	ctsio = &io->scsiio;
+	page_index = NULL;
+	page_len = 0;
+	retval = CTL_RETVAL_COMPLETE;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	if (lun->be_lun->lun_type != T_DIRECT)
+		control_dev = 1;
+	else
+		control_dev = 0;
+
+	modepage_info = (union ctl_modepage_info *)
+		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
+	len_left = &modepage_info->header.len_left;
+	len_used = &modepage_info->header.len_used;
+
+do_next_page:
+
+	page_header = (struct scsi_mode_page_header *)
+		(ctsio->kern_data_ptr + *len_used);
+
+	if (*len_left == 0) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_set_success(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	} else if (*len_left < sizeof(struct scsi_mode_page_header)) {
+
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_set_param_len_error(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+
+	} else if ((page_header->page_code & SMPH_SPF)
+		&& (*len_left < sizeof(struct scsi_mode_page_header_sp))) {
+
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_set_param_len_error(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+
+	/*
+	 * XXX KDM should we do something with the block descriptor?
+	 */
+	for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+
+		if ((control_dev != 0)
+		 && (lun->mode_pages.index[i].page_flags &
+		     CTL_PAGE_FLAG_DISK_ONLY))
+			continue;
+
+		if ((lun->mode_pages.index[i].page_code & SMPH_PC_MASK) !=
+		    (page_header->page_code & SMPH_PC_MASK))
+			continue;
+
+		/*
+		 * If neither page has a subpage code, then we've got a
+		 * match.
+		 */
+		if (((lun->mode_pages.index[i].page_code & SMPH_SPF) == 0)
+		 && ((page_header->page_code & SMPH_SPF) == 0)) {
+			page_index = &lun->mode_pages.index[i];
+			page_len = page_header->page_length;
+			break;
+		}
+
+		/*
+		 * If both pages have subpages, then the subpage numbers
+		 * have to match.
+		 */
+		if ((lun->mode_pages.index[i].page_code & SMPH_SPF)
+		  && (page_header->page_code & SMPH_SPF)) {
+			struct scsi_mode_page_header_sp *sph;
+
+			sph = (struct scsi_mode_page_header_sp *)page_header;
+
+			if (lun->mode_pages.index[i].subpage ==
+			    sph->subpage) {
+				page_index = &lun->mode_pages.index[i];
+				page_len = scsi_2btoul(sph->page_length);
+				break;
+			}
+		}
+	}
+
+	/*
+	 * If we couldn't find the page, or if we don't have a mode select
+	 * handler for it, send back an error to the user.
+	 */
+	if ((page_index == NULL)
+	 || (page_index->select_handler == NULL)) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 0,
+				      /*field*/ *len_used,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	if (page_index->page_code & SMPH_SPF) {
+		page_len_offset = 2;
+		page_len_size = 2;
+	} else {
+		page_len_size = 1;
+		page_len_offset = 1;
+	}
+
+	/*
+	 * If the length the initiator gives us isn't the one we specify in
+	 * the mode page header, or if they didn't specify enough data in
+	 * the CDB to avoid truncating this page, kick out the request.
+	 */
+	if ((page_len != (page_index->page_len - page_len_offset -
+			  page_len_size))
+	 || (*len_left < page_index->page_len)) {
+
+
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 0,
+				      /*field*/ *len_used + page_len_offset,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Run through the mode page, checking to make sure that the bits
+	 * the user changed are actually legal for him to change.
+	 */
+	for (i = 0; i < page_index->page_len; i++) {
+		uint8_t *user_byte, *change_mask, *current_byte;
+		int bad_bit;
+		int j;
+
+		user_byte = (uint8_t *)page_header + i;
+		change_mask = page_index->page_data +
+			      (page_index->page_len * CTL_PAGE_CHANGEABLE) + i;
+		current_byte = page_index->page_data +
+			       (page_index->page_len * CTL_PAGE_CURRENT) + i;
+
+		/*
+		 * Check to see whether the user set any bits in this byte
+		 * that he is not allowed to set.
+		 */
+		if ((*user_byte & ~(*change_mask)) ==
+		    (*current_byte & ~(*change_mask)))
+			continue;
+
+		/*
+		 * Go through bit by bit to determine which one is illegal.
+		 */
+		bad_bit = 0;
+		for (j = 7; j >= 0; j--) {
+			if ((((1 << i) & ~(*change_mask)) & *user_byte) !=
+			    (((1 << i) & ~(*change_mask)) & *current_byte)) {
+				bad_bit = i;
+				break;
+			}
+		}
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 0,
+				      /*field*/ *len_used + i,
+				      /*bit_valid*/ 1,
+				      /*bit*/ bad_bit);
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Decrement these before we call the page handler, since we may
+	 * end up getting called back one way or another before the handler
+	 * returns to this context.
+	 */
+	*len_left -= page_index->page_len;
+	*len_used += page_index->page_len;
+
+	retval = page_index->select_handler(ctsio, page_index,
+					    (uint8_t *)page_header);
+
+	/*
+	 * If the page handler returns CTL_RETVAL_QUEUED, then we need to
+	 * wait until this queued command completes to finish processing
+	 * the mode page.  If it returns anything other than
+	 * CTL_RETVAL_COMPLETE (e.g. CTL_RETVAL_ERROR), then it should have
+	 * already set the sense information, freed the data pointer, and
+	 * completed the io for us.
+	 */
+	if (retval != CTL_RETVAL_COMPLETE)
+		goto bailout_no_done;
+
+	/*
+	 * If the initiator sent us more than one page, parse the next one.
+	 */
+	if (*len_left > 0)
+		goto do_next_page;
+
+	ctl_set_success(ctsio);
+	free(ctsio->kern_data_ptr, M_CTL);
+	ctl_done((union ctl_io *)ctsio);
+
+bailout_no_done:
+
+	return (CTL_RETVAL_COMPLETE);
+
+}
+
+int
+ctl_mode_select(struct ctl_scsiio *ctsio)
+{
+	int param_len, pf, sp;
+	int header_size, bd_len;
+	int len_left, len_used;
+	struct ctl_page_index *page_index;
+	struct ctl_lun *lun;
+	int control_dev, page_len;
+	union ctl_modepage_info *modepage_info;
+	int retval;
+
+	pf = 0;
+	sp = 0;
+	page_len = 0;
+	len_used = 0;
+	len_left = 0;
+	retval = 0;
+	bd_len = 0;
+	page_index = NULL;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	if (lun->be_lun->lun_type != T_DIRECT)
+		control_dev = 1;
+	else
+		control_dev = 0;
+
+	switch (ctsio->cdb[0]) {
+	case MODE_SELECT_6: {
+		struct scsi_mode_select_6 *cdb;
+
+		cdb = (struct scsi_mode_select_6 *)ctsio->cdb;
+
+		pf = (cdb->byte2 & SMS_PF) ? 1 : 0;
+		sp = (cdb->byte2 & SMS_SP) ? 1 : 0;
+
+		param_len = cdb->length;
+		header_size = sizeof(struct scsi_mode_header_6);
+		break;
+	}
+	case MODE_SELECT_10: {
+		struct scsi_mode_select_10 *cdb;
+
+		cdb = (struct scsi_mode_select_10 *)ctsio->cdb;
+
+		pf = (cdb->byte2 & SMS_PF) ? 1 : 0;
+		sp = (cdb->byte2 & SMS_SP) ? 1 : 0;
+
+		param_len = scsi_2btoul(cdb->length);
+		header_size = sizeof(struct scsi_mode_header_10);
+		break;
+	}
+	default:
+		ctl_set_invalid_opcode(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+		break; /* NOTREACHED */
+	}
+
+	/*
+	 * From SPC-3:
+	 * "A parameter list length of zero indicates that the Data-Out Buffer
+	 * shall be empty. This condition shall not be considered as an error."
+	 */
+	if (param_len == 0) {
+		ctl_set_success(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Since we'll hit this the first time through, prior to
+	 * allocation, we don't need to free a data buffer here.
+	 */
+	if (param_len < header_size) {
+		ctl_set_param_len_error(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Allocate the data buffer and grab the user's data.  In theory,
+	 * we shouldn't have to sanity check the parameter list length here
+	 * because the maximum size is 64K.  We should be able to malloc
+	 * that much without too many problems.
+	 */
+	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
+		ctsio->kern_data_ptr = malloc(param_len, M_CTL, M_WAITOK);
+		if (ctsio->kern_data_ptr == NULL) {
+			ctl_set_busy(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		ctsio->kern_data_len = param_len;
+		ctsio->kern_total_len = param_len;
+		ctsio->kern_data_resid = 0;
+		ctsio->kern_rel_offset = 0;
+		ctsio->kern_sg_entries = 0;
+		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	switch (ctsio->cdb[0]) {
+	case MODE_SELECT_6: {
+		struct scsi_mode_header_6 *mh6;
+
+		mh6 = (struct scsi_mode_header_6 *)ctsio->kern_data_ptr;
+		bd_len = mh6->blk_desc_len;
+		break;
+	}
+	case MODE_SELECT_10: {
+		struct scsi_mode_header_10 *mh10;
+
+		mh10 = (struct scsi_mode_header_10 *)ctsio->kern_data_ptr;
+		bd_len = scsi_2btoul(mh10->blk_desc_len);
+		break;
+	}
+	default:
+		panic("Invalid CDB type %#x", ctsio->cdb[0]);
+		break;
+	}
+
+	if (param_len < (header_size + bd_len)) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_set_param_len_error(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Set the IO_CONT flag, so that if this I/O gets passed to
+	 * ctl_config_write_done(), it'll get passed back to
+	 * ctl_do_mode_select() for further processing, or completion if
+	 * we're all done.
+	 */
+	ctsio->io_hdr.flags |= CTL_FLAG_IO_CONT;
+	ctsio->io_cont = ctl_do_mode_select;
+
+	modepage_info = (union ctl_modepage_info *)
+		ctsio->io_hdr.ctl_private[CTL_PRIV_MODEPAGE].bytes;
+
+	memset(modepage_info, 0, sizeof(*modepage_info));
+
+	len_left = param_len - header_size - bd_len;
+	len_used = header_size + bd_len;
+
+	modepage_info->header.len_left = len_left;
+	modepage_info->header.len_used = len_used;
+
+	return (ctl_do_mode_select((union ctl_io *)ctsio));
+}
+
+int
+ctl_mode_sense(struct ctl_scsiio *ctsio)
+{
+	struct ctl_lun *lun;
+	int pc, page_code, dbd, llba, subpage;
+	int alloc_len, page_len, header_len, total_len;
+	struct scsi_mode_block_descr *block_desc;
+	struct ctl_page_index *page_index;
+	int control_dev;
+
+	dbd = 0;
+	llba = 0;
+	block_desc = NULL;
+	page_index = NULL;
+
+	CTL_DEBUG_PRINT(("ctl_mode_sense\n"));
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	if (lun->be_lun->lun_type != T_DIRECT)
+		control_dev = 1;
+	else
+		control_dev = 0;
+
+	switch (ctsio->cdb[0]) {
+	case MODE_SENSE_6: {
+		struct scsi_mode_sense_6 *cdb;
+
+		cdb = (struct scsi_mode_sense_6 *)ctsio->cdb;
+
+		header_len = sizeof(struct scsi_mode_hdr_6);
+		if (cdb->byte2 & SMS_DBD)
+			dbd = 1;
+		else
+			header_len += sizeof(struct scsi_mode_block_descr);
+
+		pc = (cdb->page & SMS_PAGE_CTRL_MASK) >> 6;
+		page_code = cdb->page & SMS_PAGE_CODE;
+		subpage = cdb->subpage;
+		alloc_len = cdb->length;
+		break;
+	}
+	case MODE_SENSE_10: {
+		struct scsi_mode_sense_10 *cdb;
+
+		cdb = (struct scsi_mode_sense_10 *)ctsio->cdb;
+
+		header_len = sizeof(struct scsi_mode_hdr_10);
+
+		if (cdb->byte2 & SMS_DBD)
+			dbd = 1;
+		else
+			header_len += sizeof(struct scsi_mode_block_descr);
+		if (cdb->byte2 & SMS10_LLBAA)
+			llba = 1;
+		pc = (cdb->page & SMS_PAGE_CTRL_MASK) >> 6;
+		page_code = cdb->page & SMS_PAGE_CODE;
+		subpage = cdb->subpage;
+		alloc_len = scsi_2btoul(cdb->length);
+		break;
+	}
+	default:
+		ctl_set_invalid_opcode(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+		break; /* NOTREACHED */
+	}
+
+	/*
+	 * We have to make a first pass through to calculate the size of
+	 * the pages that match the user's query.  Then we allocate enough
+	 * memory to hold it, and actually copy the data into the buffer.
+	 */
+	switch (page_code) {
+	case SMS_ALL_PAGES_PAGE: {
+		int i;
+
+		page_len = 0;
+
+		/*
+		 * At the moment, values other than 0 and 0xff here are
+		 * reserved according to SPC-3.
+		 */
+		if ((subpage != SMS_SUBPAGE_PAGE_0)
+		 && (subpage != SMS_SUBPAGE_ALL)) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 3,
+					      /*bit_valid*/ 0,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+
+		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+			if ((control_dev != 0)
+			 && (lun->mode_pages.index[i].page_flags &
+			     CTL_PAGE_FLAG_DISK_ONLY))
+				continue;
+
+			/*
+			 * We don't use this subpage if the user didn't
+			 * request all subpages.
+			 */
+			if ((lun->mode_pages.index[i].subpage != 0)
+			 && (subpage == SMS_SUBPAGE_PAGE_0))
+				continue;
+
+#if 0
+			printf("found page %#x len %d\n",
+			       lun->mode_pages.index[i].page_code &
+			       SMPH_PC_MASK,
+			       lun->mode_pages.index[i].page_len);
+#endif
+			page_len += lun->mode_pages.index[i].page_len;
+		}
+		break;
+	}
+	default: {
+		int i;
+
+		page_len = 0;
+
+		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+			/* Look for the right page code */
+			if ((lun->mode_pages.index[i].page_code &
+			     SMPH_PC_MASK) != page_code)
+				continue;
+
+			/* Look for the right subpage or the subpage wildcard*/
+			if ((lun->mode_pages.index[i].subpage != subpage)
+			 && (subpage != SMS_SUBPAGE_ALL))
+				continue;
+
+			/* Make sure the page is supported for this dev type */
+			if ((control_dev != 0)
+			 && (lun->mode_pages.index[i].page_flags &
+			     CTL_PAGE_FLAG_DISK_ONLY))
+				continue;
+
+#if 0
+			printf("found page %#x len %d\n",
+			       lun->mode_pages.index[i].page_code &
+			       SMPH_PC_MASK,
+			       lun->mode_pages.index[i].page_len);
+#endif
+
+			page_len += lun->mode_pages.index[i].page_len;
+		}
+
+		if (page_len == 0) {
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 2,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 5);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		break;
+	}
+	}
+
+	total_len = header_len + page_len;
+#if 0
+	printf("header_len = %d, page_len = %d, total_len = %d\n",
+	       header_len, page_len, total_len);
+#endif
+
+	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	ctsio->kern_sg_entries = 0;
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	if (total_len < alloc_len) {
+		ctsio->residual = alloc_len - total_len;
+		ctsio->kern_data_len = total_len;
+		ctsio->kern_total_len = total_len;
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	memset(ctsio->kern_data_ptr, 0, total_len);
+
+	switch (ctsio->cdb[0]) {
+	case MODE_SENSE_6: {
+		struct scsi_mode_hdr_6 *header;
+
+		header = (struct scsi_mode_hdr_6 *)ctsio->kern_data_ptr;
+
+		header->datalen = ctl_min(total_len - 1, 254);
+
+		if (dbd)
+			header->block_descr_len = 0;
+		else
+			header->block_descr_len =
+				sizeof(struct scsi_mode_block_descr);
+		block_desc = (struct scsi_mode_block_descr *)&header[1];
+		break;
+	}
+	case MODE_SENSE_10: {
+		struct scsi_mode_hdr_10 *header;
+		int datalen;
+
+		header = (struct scsi_mode_hdr_10 *)ctsio->kern_data_ptr;
+
+		datalen = ctl_min(total_len - 2, 65533);
+		scsi_ulto2b(datalen, header->datalen);
+		if (dbd)
+			scsi_ulto2b(0, header->block_descr_len);
+		else
+			scsi_ulto2b(sizeof(struct scsi_mode_block_descr),
+				    header->block_descr_len);
+		block_desc = (struct scsi_mode_block_descr *)&header[1];
+		break;
+	}
+	default:
+		panic("invalid CDB type %#x", ctsio->cdb[0]);
+		break; /* NOTREACHED */
+	}
+
+	/*
+	 * If we've got a disk, use its blocksize in the block
+	 * descriptor.  Otherwise, just set it to 0.
+	 */
+	if (dbd == 0) {
+		if (control_dev != 0)
+			scsi_ulto3b(lun->be_lun->blocksize,
+				    block_desc->block_len);
+		else
+			scsi_ulto3b(0, block_desc->block_len);
+	}
+
+	switch (page_code) {
+	case SMS_ALL_PAGES_PAGE: {
+		int i, data_used;
+
+		data_used = header_len;
+		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+			struct ctl_page_index *page_index;
+
+			page_index = &lun->mode_pages.index[i];
+
+			if ((control_dev != 0)
+			 && (page_index->page_flags &
+			    CTL_PAGE_FLAG_DISK_ONLY))
+				continue;
+
+			/*
+			 * We don't use this subpage if the user didn't
+			 * request all subpages.  We already checked (above)
+			 * to make sure the user only specified a subpage
+			 * of 0 or 0xff in the SMS_ALL_PAGES_PAGE case.
+			 */
+			if ((page_index->subpage != 0)
+			 && (subpage == SMS_SUBPAGE_PAGE_0))
+				continue;
+
+			/*
+			 * Call the handler, if it exists, to update the
+			 * page to the latest values.
+			 */
+			if (page_index->sense_handler != NULL)
+				page_index->sense_handler(ctsio, page_index,pc);
+
+			memcpy(ctsio->kern_data_ptr + data_used,
+			       page_index->page_data +
+			       (page_index->page_len * pc),
+			       page_index->page_len);
+			data_used += page_index->page_len;
+		}
+		break;
+	}
+	default: {
+		int i, data_used;
+
+		data_used = header_len;
+
+		for (i = 0; i < CTL_NUM_MODE_PAGES; i++) {
+			struct ctl_page_index *page_index;
+
+			page_index = &lun->mode_pages.index[i];
+
+			/* Look for the right page code */
+			if ((page_index->page_code & SMPH_PC_MASK) != page_code)
+				continue;
+
+			/* Look for the right subpage or the subpage wildcard*/
+			if ((page_index->subpage != subpage)
+			 && (subpage != SMS_SUBPAGE_ALL))
+				continue;
+
+			/* Make sure the page is supported for this dev type */
+			if ((control_dev != 0)
+			 && (page_index->page_flags &
+			     CTL_PAGE_FLAG_DISK_ONLY))
+				continue;
+
+			/*
+			 * Call the handler, if it exists, to update the
+			 * page to the latest values.
+			 */
+			if (page_index->sense_handler != NULL)
+				page_index->sense_handler(ctsio, page_index,pc);
+
+			memcpy(ctsio->kern_data_ptr + data_used,
+			       page_index->page_data +
+			       (page_index->page_len * pc),
+			       page_index->page_len);
+			data_used += page_index->page_len;
+		}
+		break;
+	}
+	}
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_read_capacity(struct ctl_scsiio *ctsio)
+{
+	struct scsi_read_capacity *cdb;
+	struct scsi_read_capacity_data *data;
+	struct ctl_lun *lun;
+	uint32_t lba;
+
+	CTL_DEBUG_PRINT(("ctl_read_capacity\n"));
+
+	cdb = (struct scsi_read_capacity *)ctsio->cdb;
+
+	lba = scsi_4btoul(cdb->addr);
+	if (((cdb->pmi & SRC_PMI) == 0)
+	 && (lba != 0)) {
+		ctl_set_invalid_field(/*ctsio*/ ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 2,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	ctsio->kern_data_ptr = malloc(sizeof(*data), M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	data = (struct scsi_read_capacity_data *)ctsio->kern_data_ptr;
+	ctsio->residual = 0;
+	ctsio->kern_data_len = sizeof(*data);
+	ctsio->kern_total_len = sizeof(*data);
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	memset(data, 0, sizeof(*data));
+
+	/*
+	 * If the maximum LBA is greater than 0xfffffffe, the user must
+	 * issue a SERVICE ACTION IN (16) command, with the read capacity
+	 * serivce action set.
+	 */
+	if (lun->be_lun->maxlba > 0xfffffffe)
+		scsi_ulto4b(0xffffffff, data->addr);
+	else
+		scsi_ulto4b(lun->be_lun->maxlba, data->addr);
+
+	/*
+	 * XXX KDM this may not be 512 bytes...
+	 */
+	scsi_ulto4b(lun->be_lun->blocksize, data->length);
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+static int
+ctl_read_capacity_16(struct ctl_scsiio *ctsio)
+{
+	struct scsi_read_capacity_16 *cdb;
+	struct scsi_read_capacity_data_long *data;
+	struct ctl_lun *lun;
+	uint64_t lba;
+	uint32_t alloc_len;
+
+	CTL_DEBUG_PRINT(("ctl_read_capacity_16\n"));
+
+	cdb = (struct scsi_read_capacity_16 *)ctsio->cdb;
+
+	alloc_len = scsi_4btoul(cdb->alloc_len);
+	lba = scsi_8btou64(cdb->addr);
+
+	if ((cdb->reladr & SRC16_PMI)
+	 && (lba != 0)) {
+		ctl_set_invalid_field(/*ctsio*/ ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 2,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	ctsio->kern_data_ptr = malloc(sizeof(*data), M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	data = (struct scsi_read_capacity_data_long *)ctsio->kern_data_ptr;
+
+	if (sizeof(*data) < alloc_len) {
+		ctsio->residual = alloc_len - sizeof(*data);
+		ctsio->kern_data_len = sizeof(*data);
+		ctsio->kern_total_len = sizeof(*data);
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	memset(data, 0, sizeof(*data));
+
+	scsi_u64to8b(lun->be_lun->maxlba, data->addr);
+	/* XXX KDM this may not be 512 bytes... */
+	scsi_ulto4b(lun->be_lun->blocksize, data->length);
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_service_action_in(struct ctl_scsiio *ctsio)
+{
+	struct scsi_service_action_in *cdb;
+	int retval;
+
+	CTL_DEBUG_PRINT(("ctl_service_action_in\n"));
+
+	cdb = (struct scsi_service_action_in *)ctsio->cdb;
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	switch (cdb->service_action) {
+	case SRC16_SERVICE_ACTION:
+		retval = ctl_read_capacity_16(ctsio);
+		break;
+	default:
+		ctl_set_invalid_field(/*ctsio*/ ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 4);
+		ctl_done((union ctl_io *)ctsio);
+		break;
+	}
+
+	return (retval);
+}
+
+int
+ctl_maintenance_in(struct ctl_scsiio *ctsio)
+{
+	struct scsi_maintenance_in *cdb;
+	int retval;
+	int alloc_len, total_len = 0;
+	int num_target_port_groups;
+	struct ctl_lun *lun;
+	struct ctl_softc *softc;
+	struct scsi_target_group_data *rtg_ptr;
+	struct scsi_target_port_group_descriptor *tpg_desc_ptr1, *tpg_desc_ptr2;
+	struct scsi_target_port_descriptor  *tp_desc_ptr1_1, *tp_desc_ptr1_2,
+	                                    *tp_desc_ptr2_1, *tp_desc_ptr2_2;
+
+	CTL_DEBUG_PRINT(("ctl_maintenance_in\n"));
+
+	cdb = (struct scsi_maintenance_in *)ctsio->cdb;
+	softc = control_softc;
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	retval = CTL_RETVAL_COMPLETE;
+	mtx_lock(&softc->ctl_lock);
+
+	if ((cdb->byte2 & SERVICE_ACTION_MASK) != SA_RPRT_TRGT_GRP) {
+		ctl_set_invalid_field(/*ctsio*/ ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 4);
+		ctl_done((union ctl_io *)ctsio);
+		return(retval);
+	}
+
+	if (ctl_is_single)
+        	num_target_port_groups = NUM_TARGET_PORT_GROUPS - 1;
+	else
+        	num_target_port_groups = NUM_TARGET_PORT_GROUPS;
+
+	total_len = sizeof(struct scsi_target_group_data) +
+		sizeof(struct scsi_target_port_group_descriptor) *
+		num_target_port_groups +
+		sizeof(struct scsi_target_port_descriptor) *
+		NUM_PORTS_PER_GRP * num_target_port_groups;
+
+	alloc_len = scsi_4btoul(cdb->length);
+
+	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	memset(ctsio->kern_data_ptr, 0, total_len);
+
+	ctsio->kern_sg_entries = 0;
+
+	if (total_len < alloc_len) {
+		ctsio->residual = alloc_len - total_len;
+		ctsio->kern_data_len = total_len;
+		ctsio->kern_total_len = total_len;
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+
+	rtg_ptr = (struct scsi_target_group_data *)ctsio->kern_data_ptr;
+
+	tpg_desc_ptr1 = &rtg_ptr->groups[0];
+	tp_desc_ptr1_1 = &tpg_desc_ptr1->descriptors[0];
+	tp_desc_ptr1_2 = (struct scsi_target_port_descriptor *)
+	        &tp_desc_ptr1_1->desc_list[0];
+
+
+
+	if (ctl_is_single == 0) {
+		tpg_desc_ptr2 = (struct scsi_target_port_group_descriptor *)
+	                &tp_desc_ptr1_2->desc_list[0];
+		tp_desc_ptr2_1 = &tpg_desc_ptr2->descriptors[0];
+		tp_desc_ptr2_2 = (struct scsi_target_port_descriptor *)
+	        	&tp_desc_ptr2_1->desc_list[0];
+        } else {
+		tpg_desc_ptr2 = NULL;
+		tp_desc_ptr2_1 = NULL;
+		tp_desc_ptr2_2 = NULL;
+	}
+
+	scsi_ulto4b(total_len - 4, rtg_ptr->length);
+	if (ctl_is_single == 0) {
+        	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS) {
+			if (lun->flags & CTL_LUN_PRIMARY_SC) {
+				tpg_desc_ptr1->pref_state = TPG_PRIMARY;
+				tpg_desc_ptr2->pref_state =
+					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
+			} else {
+				tpg_desc_ptr1->pref_state =
+					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
+				tpg_desc_ptr2->pref_state = TPG_PRIMARY;
+			}
+		} else {
+			if (lun->flags & CTL_LUN_PRIMARY_SC) {
+				tpg_desc_ptr1->pref_state =
+					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
+				tpg_desc_ptr2->pref_state = TPG_PRIMARY;
+			} else {
+				tpg_desc_ptr1->pref_state = TPG_PRIMARY;
+				tpg_desc_ptr2->pref_state =
+					TPG_ASYMMETRIC_ACCESS_NONOPTIMIZED;
+			}
+		}
+	} else {
+		tpg_desc_ptr1->pref_state = TPG_PRIMARY;
+	}
+	tpg_desc_ptr1->support = 0;
+	tpg_desc_ptr1->target_port_group[1] = 1;
+	tpg_desc_ptr1->status = TPG_IMPLICIT;
+	tpg_desc_ptr1->target_port_count= NUM_PORTS_PER_GRP;
+
+	if (ctl_is_single == 0) {
+		tpg_desc_ptr2->support = 0;
+		tpg_desc_ptr2->target_port_group[1] = 2;
+		tpg_desc_ptr2->status = TPG_IMPLICIT;
+		tpg_desc_ptr2->target_port_count = NUM_PORTS_PER_GRP;
+
+		tp_desc_ptr1_1->relative_target_port_identifier[1] = 1;
+		tp_desc_ptr1_2->relative_target_port_identifier[1] = 2;
+
+		tp_desc_ptr2_1->relative_target_port_identifier[1] = 9;
+		tp_desc_ptr2_2->relative_target_port_identifier[1] = 10;
+	} else {
+        	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS) {
+			tp_desc_ptr1_1->relative_target_port_identifier[1] = 1;
+			tp_desc_ptr1_2->relative_target_port_identifier[1] = 2;
+		} else {
+			tp_desc_ptr1_1->relative_target_port_identifier[1] = 9;
+			tp_desc_ptr1_2->relative_target_port_identifier[1] = 10;
+		}
+	}
+
+	mtx_unlock(&softc->ctl_lock);
+
+	ctsio->be_move_done = ctl_config_move_done;
+
+	CTL_DEBUG_PRINT(("buf = %x %x %x %x %x %x %x %x\n",
+			 ctsio->kern_data_ptr[0], ctsio->kern_data_ptr[1],
+			 ctsio->kern_data_ptr[2], ctsio->kern_data_ptr[3],
+			 ctsio->kern_data_ptr[4], ctsio->kern_data_ptr[5],
+			 ctsio->kern_data_ptr[6], ctsio->kern_data_ptr[7]));
+
+	ctl_datamove((union ctl_io *)ctsio);
+	return(retval);
+}
+
+int
+ctl_persistent_reserve_in(struct ctl_scsiio *ctsio)
+{
+	struct scsi_per_res_in *cdb;
+	int alloc_len, total_len = 0;
+	/* struct scsi_per_res_in_rsrv in_data; */
+	struct ctl_lun *lun;
+	struct ctl_softc *softc;
+
+	CTL_DEBUG_PRINT(("ctl_persistent_reserve_in\n"));
+
+	softc = control_softc;
+
+	cdb = (struct scsi_per_res_in *)ctsio->cdb;
+
+	alloc_len = scsi_2btoul(cdb->length);
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+retry:
+	mtx_lock(&softc->ctl_lock);
+	switch (cdb->action) {
+	case SPRI_RK: /* read keys */
+		total_len = sizeof(struct scsi_per_res_in_keys) +
+			lun->pr_key_count *
+			sizeof(struct scsi_per_res_key);
+		break;
+	case SPRI_RR: /* read reservation */
+		if (lun->flags & CTL_LUN_PR_RESERVED)
+			total_len = sizeof(struct scsi_per_res_in_rsrv);
+		else
+			total_len = sizeof(struct scsi_per_res_in_header);
+		break;
+	case SPRI_RC: /* report capabilities */
+		total_len = sizeof(struct scsi_per_res_cap);
+		break;
+	case SPRI_RS: /* read full status */
+	default:
+		mtx_unlock(&softc->ctl_lock);
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+		break; /* NOTREACHED */
+	}
+	mtx_unlock(&softc->ctl_lock);
+
+	ctsio->kern_data_ptr = malloc(total_len, M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	if (total_len < alloc_len) {
+		ctsio->residual = alloc_len - total_len;
+		ctsio->kern_data_len = total_len;
+		ctsio->kern_total_len = total_len;
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	memset(ctsio->kern_data_ptr, 0, total_len);
+
+	mtx_lock(&softc->ctl_lock);
+	switch (cdb->action) {
+	case SPRI_RK: { // read keys
+        struct scsi_per_res_in_keys *res_keys;
+		int i, key_count;
+
+		res_keys = (struct scsi_per_res_in_keys*)ctsio->kern_data_ptr;
+
+		/*
+		 * We had to drop the lock to allocate our buffer, which
+		 * leaves time for someone to come in with another
+		 * persistent reservation.  (That is unlikely, though,
+		 * since this should be the only persistent reservation
+		 * command active right now.)
+		 */
+		if (total_len != (sizeof(struct scsi_per_res_in_keys) +
+		    (lun->pr_key_count *
+		     sizeof(struct scsi_per_res_key)))){
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			printf("%s: reservation length changed, retrying\n",
+			       __func__);
+			goto retry;
+		}
+
+		scsi_ulto4b(lun->PRGeneration, res_keys->header.generation);
+
+		scsi_ulto4b(sizeof(struct scsi_per_res_key) *
+			     lun->pr_key_count, res_keys->header.length);
+
+		for (i = 0, key_count = 0; i < 2*CTL_MAX_INITIATORS; i++) {
+			if (!lun->per_res[i].registered)
+				continue;
+
+			/*
+			 * We used lun->pr_key_count to calculate the
+			 * size to allocate.  If it turns out the number of
+			 * initiators with the registered flag set is
+			 * larger than that (i.e. they haven't been kept in
+			 * sync), we've got a problem.
+			 */
+			if (key_count >= lun->pr_key_count) {
+#ifdef NEEDTOPORT
+				csevent_log(CSC_CTL | CSC_SHELF_SW |
+					    CTL_PR_ERROR,
+					    csevent_LogType_Fault,
+					    csevent_AlertLevel_Yellow,
+					    csevent_FRU_ShelfController,
+					    csevent_FRU_Firmware,
+				        csevent_FRU_Unknown,
+					    "registered keys %d >= key "
+					    "count %d", key_count,
+					    lun->pr_key_count);
+#endif
+				key_count++;
+				continue;
+			}
+			memcpy(res_keys->keys[key_count].key,
+			       lun->per_res[i].res_key.key,
+			       ctl_min(sizeof(res_keys->keys[key_count].key),
+			       sizeof(lun->per_res[i].res_key)));
+			key_count++;
+		}
+		break;
+	}
+	case SPRI_RR: { // read reservation
+		struct scsi_per_res_in_rsrv *res;
+		int tmp_len, header_only;
+
+		res = (struct scsi_per_res_in_rsrv *)ctsio->kern_data_ptr;
+
+		scsi_ulto4b(lun->PRGeneration, res->header.generation);
+
+		if (lun->flags & CTL_LUN_PR_RESERVED)
+		{
+			tmp_len = sizeof(struct scsi_per_res_in_rsrv);
+			scsi_ulto4b(sizeof(struct scsi_per_res_in_rsrv_data),
+				    res->header.length);
+			header_only = 0;
+		} else {
+			tmp_len = sizeof(struct scsi_per_res_in_header);
+			scsi_ulto4b(0, res->header.length);
+			header_only = 1;
+		}
+
+		/*
+		 * We had to drop the lock to allocate our buffer, which
+		 * leaves time for someone to come in with another
+		 * persistent reservation.  (That is unlikely, though,
+		 * since this should be the only persistent reservation
+		 * command active right now.)
+		 */
+		if (tmp_len != total_len) {
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			printf("%s: reservation status changed, retrying\n",
+			       __func__);
+			goto retry;
+		}
+
+		/*
+		 * No reservation held, so we're done.
+		 */
+		if (header_only != 0)
+			break;
+
+		/*
+		 * If the registration is an All Registrants type, the key
+		 * is 0, since it doesn't really matter.
+		 */
+		if (lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS) {
+			memcpy(res->data.reservation,
+			       &lun->per_res[lun->pr_res_idx].res_key,
+			       sizeof(struct scsi_per_res_key));
+		}
+		res->data.scopetype = lun->res_type;
+		break;
+	}
+	case SPRI_RC:     //report capabilities
+	{
+		struct scsi_per_res_cap *res_cap;
+		uint16_t type_mask;
+
+		res_cap = (struct scsi_per_res_cap *)ctsio->kern_data_ptr;
+		scsi_ulto2b(sizeof(*res_cap), res_cap->length);
+		res_cap->flags2 |= SPRI_TMV;
+		type_mask = SPRI_TM_WR_EX_AR |
+			    SPRI_TM_EX_AC_RO |
+			    SPRI_TM_WR_EX_RO |
+			    SPRI_TM_EX_AC |
+			    SPRI_TM_WR_EX |
+			    SPRI_TM_EX_AC_AR;
+		scsi_ulto2b(type_mask, res_cap->type_mask);
+		break;
+	}
+	case SPRI_RS: //read full status
+	default:
+		/*
+		 * This is a bug, because we just checked for this above,
+		 * and should have returned an error.
+		 */
+		panic("Invalid PR type %x", cdb->action);
+		break; /* NOTREACHED */
+	}
+	mtx_unlock(&softc->ctl_lock);
+
+	ctsio->be_move_done = ctl_config_move_done;
+
+	CTL_DEBUG_PRINT(("buf = %x %x %x %x %x %x %x %x\n",
+			 ctsio->kern_data_ptr[0], ctsio->kern_data_ptr[1],
+			 ctsio->kern_data_ptr[2], ctsio->kern_data_ptr[3],
+			 ctsio->kern_data_ptr[4], ctsio->kern_data_ptr[5],
+			 ctsio->kern_data_ptr[6], ctsio->kern_data_ptr[7]));
+
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * Returns 0 if ctl_persistent_reserve_out() should continue, non-zero if
+ * it should return.
+ */
+static int
+ctl_pro_preempt(struct ctl_softc *softc, struct ctl_lun *lun, uint64_t res_key,
+		uint64_t sa_res_key, uint8_t type, uint32_t residx,
+		struct ctl_scsiio *ctsio, struct scsi_per_res_out *cdb,
+		struct scsi_per_res_out_parms* param)
+{
+	union ctl_ha_msg persis_io;
+	int retval, i;
+	int isc_retval;
+
+	retval = 0;
+
+	if (sa_res_key == 0) {
+		mtx_lock(&softc->ctl_lock);
+		if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
+			/* validate scope and type */
+			if ((cdb->scope_type & SPR_SCOPE_MASK) !=
+			     SPR_LU_SCOPE) {
+				mtx_unlock(&softc->ctl_lock);
+				ctl_set_invalid_field(/*ctsio*/ ctsio,
+						      /*sks_valid*/ 1,
+						      /*command*/ 1,
+						      /*field*/ 2,
+						      /*bit_valid*/ 1,
+						      /*bit*/ 4);
+				ctl_done((union ctl_io *)ctsio);
+				return (1);
+			}
+
+		        if (type>8 || type==2 || type==4 || type==0) {
+				mtx_unlock(&softc->ctl_lock);
+				ctl_set_invalid_field(/*ctsio*/ ctsio,
+       	           				      /*sks_valid*/ 1,
+						      /*command*/ 1,
+						      /*field*/ 2,
+						      /*bit_valid*/ 1,
+						      /*bit*/ 0);
+				ctl_done((union ctl_io *)ctsio);
+				return (1);
+		        }
+
+			/* temporarily unregister this nexus */
+			lun->per_res[residx].registered = 0;
+
+			/*
+			 * Unregister everybody else and build UA for
+			 * them
+			 */
+			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+				if (lun->per_res[i].registered == 0)
+					continue;
+
+				if (!persis_offset
+				 && i <CTL_MAX_INITIATORS)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				else if (persis_offset
+				      && i >= persis_offset)
+					lun->pending_sense[i-persis_offset
+						].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				lun->per_res[i].registered = 0;
+				memset(&lun->per_res[i].res_key, 0,
+				       sizeof(struct scsi_per_res_key));
+			}
+			lun->per_res[residx].registered = 1;
+			lun->pr_key_count = 1;
+			lun->res_type = type;
+			if (lun->res_type != SPR_TYPE_WR_EX_AR
+			 && lun->res_type != SPR_TYPE_EX_AC_AR)
+				lun->pr_res_idx = residx;
+
+			mtx_unlock(&softc->ctl_lock);
+			/* send msg to other side */
+			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
+			persis_io.pr.pr_info.residx = lun->pr_res_idx;
+			persis_io.pr.pr_info.res_type = type;
+			memcpy(persis_io.pr.pr_info.sa_res_key,
+			       param->serv_act_res_key,
+			       sizeof(param->serv_act_res_key));
+			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+			     &persis_io, sizeof(persis_io), 0)) >
+			     CTL_HA_STATUS_SUCCESS) {
+				printf("CTL:Persis Out error returned "
+				       "from ctl_ha_msg_send %d\n",
+				       isc_retval);
+			}
+		} else {
+			/* not all registrants */
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 0,
+					      /*field*/ 8,
+					      /*bit_valid*/ 0,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (1);
+		}
+	} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS
+		|| !(lun->flags & CTL_LUN_PR_RESERVED)) {
+		int found = 0;
+
+		mtx_lock(&softc->ctl_lock);
+		if (res_key == sa_res_key) {
+			/* special case */
+			/*
+			 * The spec implies this is not good but doesn't
+			 * say what to do. There are two choices either
+			 * generate a res conflict or check condition
+			 * with illegal field in parameter data. Since
+			 * that is what is done when the sa_res_key is
+			 * zero I'll take that approach since this has
+			 * to do with the sa_res_key.
+			 */
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 0,
+					      /*field*/ 8,
+					      /*bit_valid*/ 0,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (1);
+		}
+
+		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+			if (lun->per_res[i].registered
+			 && memcmp(param->serv_act_res_key,
+			    lun->per_res[i].res_key.key,
+			    sizeof(struct scsi_per_res_key)) != 0)
+				continue;
+
+			found = 1;
+			lun->per_res[i].registered = 0;
+			memset(&lun->per_res[i].res_key, 0,
+			       sizeof(struct scsi_per_res_key));
+			lun->pr_key_count--;
+
+			if (!persis_offset
+			 && i < CTL_MAX_INITIATORS)
+				lun->pending_sense[i].ua_pending |=
+					CTL_UA_REG_PREEMPT;
+			else if (persis_offset
+			      && i >= persis_offset)
+				lun->pending_sense[i-persis_offset].ua_pending|=
+					CTL_UA_REG_PREEMPT;
+		}
+		mtx_unlock(&softc->ctl_lock);
+		if (!found) {
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_reservation_conflict(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		/* send msg to other side */
+		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+		persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
+		persis_io.pr.pr_info.residx = lun->pr_res_idx;
+		persis_io.pr.pr_info.res_type = type;
+		memcpy(persis_io.pr.pr_info.sa_res_key,
+		       param->serv_act_res_key,
+		       sizeof(param->serv_act_res_key));
+		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+		     &persis_io, sizeof(persis_io), 0)) >
+		     CTL_HA_STATUS_SUCCESS) {
+			printf("CTL:Persis Out error returned from "
+			       "ctl_ha_msg_send %d\n", isc_retval);
+		}
+	} else {
+		/* Reserved but not all registrants */
+		/* sa_res_key is res holder */
+		if (memcmp(param->serv_act_res_key,
+                   lun->per_res[lun->pr_res_idx].res_key.key,
+                   sizeof(struct scsi_per_res_key)) == 0) {
+			/* validate scope and type */
+			if ((cdb->scope_type & SPR_SCOPE_MASK) !=
+			     SPR_LU_SCOPE) {
+				ctl_set_invalid_field(/*ctsio*/ ctsio,
+						      /*sks_valid*/ 1,
+						      /*command*/ 1,
+						      /*field*/ 2,
+						      /*bit_valid*/ 1,
+						      /*bit*/ 4);
+				ctl_done((union ctl_io *)ctsio);
+				return (1);
+			}
+
+			if (type>8 || type==2 || type==4 || type==0) {
+				ctl_set_invalid_field(/*ctsio*/ ctsio,
+						      /*sks_valid*/ 1,
+						      /*command*/ 1,
+						      /*field*/ 2,
+						      /*bit_valid*/ 1,
+						      /*bit*/ 0);
+				ctl_done((union ctl_io *)ctsio);
+				return (1);
+			}
+
+			/*
+			 * Do the following:
+			 * if sa_res_key != res_key remove all
+			 * registrants w/sa_res_key and generate UA
+			 * for these registrants(Registrations
+			 * Preempted) if it wasn't an exclusive
+			 * reservation generate UA(Reservations
+			 * Preempted) for all other registered nexuses
+			 * if the type has changed. Establish the new
+			 * reservation and holder. If res_key and
+			 * sa_res_key are the same do the above
+			 * except don't unregister the res holder.
+			 */
+
+			/*
+			 * Temporarily unregister so it won't get
+			 * removed or UA generated
+			 */
+			lun->per_res[residx].registered = 0;
+			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+				if (lun->per_res[i].registered == 0)
+					continue;
+
+				if (memcmp(param->serv_act_res_key,
+				    lun->per_res[i].res_key.key,
+				    sizeof(struct scsi_per_res_key)) == 0) {
+					lun->per_res[i].registered = 0;
+					memset(&lun->per_res[i].res_key,
+					       0,
+					       sizeof(struct scsi_per_res_key));
+					lun->pr_key_count--;
+
+					if (!persis_offset
+					 && i < CTL_MAX_INITIATORS)
+						lun->pending_sense[i
+							].ua_pending |=
+							CTL_UA_REG_PREEMPT;
+					else if (persis_offset
+					      && i >= persis_offset)
+						lun->pending_sense[
+						  i-persis_offset].ua_pending |=
+						  CTL_UA_REG_PREEMPT;
+				} else if (type != lun->res_type
+					&& (lun->res_type == SPR_TYPE_WR_EX_RO
+					 || lun->res_type ==SPR_TYPE_EX_AC_RO)){
+						if (!persis_offset
+						 && i < CTL_MAX_INITIATORS)
+							lun->pending_sense[i
+							].ua_pending |=
+							CTL_UA_RES_RELEASE;
+						else if (persis_offset
+						      && i >= persis_offset)
+							lun->pending_sense[
+							i-persis_offset
+							].ua_pending |=
+							CTL_UA_RES_RELEASE;
+				}
+			}
+			lun->per_res[residx].registered = 1;
+			lun->res_type = type;
+			if (lun->res_type != SPR_TYPE_WR_EX_AR
+			 && lun->res_type != SPR_TYPE_EX_AC_AR)
+				lun->pr_res_idx = residx;
+			else
+				lun->pr_res_idx =
+					CTL_PR_ALL_REGISTRANTS;
+
+			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
+			persis_io.pr.pr_info.residx = lun->pr_res_idx;
+			persis_io.pr.pr_info.res_type = type;
+			memcpy(persis_io.pr.pr_info.sa_res_key,
+			       param->serv_act_res_key,
+			       sizeof(param->serv_act_res_key));
+			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+			     &persis_io, sizeof(persis_io), 0)) >
+			     CTL_HA_STATUS_SUCCESS) {
+				printf("CTL:Persis Out error returned "
+				       "from ctl_ha_msg_send %d\n",
+				       isc_retval);
+			}
+		} else {
+			/*
+			 * sa_res_key is not the res holder just
+			 * remove registrants
+			 */
+			int found=0;
+			mtx_lock(&softc->ctl_lock);
+
+			for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+				if (memcmp(param->serv_act_res_key,
+				    lun->per_res[i].res_key.key,
+				    sizeof(struct scsi_per_res_key)) != 0)
+					continue;
+
+				found = 1;
+				lun->per_res[i].registered = 0;
+				memset(&lun->per_res[i].res_key, 0,
+				       sizeof(struct scsi_per_res_key));
+				lun->pr_key_count--;
+
+				if (!persis_offset
+				 && i < CTL_MAX_INITIATORS)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				else if (persis_offset
+				      && i >= persis_offset)
+					lun->pending_sense[
+						i-persis_offset].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+			}
+
+			if (!found) {
+				mtx_unlock(&softc->ctl_lock);
+				free(ctsio->kern_data_ptr, M_CTL);
+				ctl_set_reservation_conflict(ctsio);
+				ctl_done((union ctl_io *)ctsio);
+		        	return (1);
+			}
+			mtx_unlock(&softc->ctl_lock);
+			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+			persis_io.pr.pr_info.action = CTL_PR_PREEMPT;
+			persis_io.pr.pr_info.residx = lun->pr_res_idx;
+			persis_io.pr.pr_info.res_type = type;
+			memcpy(persis_io.pr.pr_info.sa_res_key,
+			       param->serv_act_res_key,
+			       sizeof(param->serv_act_res_key));
+			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+			     &persis_io, sizeof(persis_io), 0)) >
+			     CTL_HA_STATUS_SUCCESS) {
+				printf("CTL:Persis Out error returned "
+				       "from ctl_ha_msg_send %d\n",
+				isc_retval);
+			}
+		}
+	}
+
+	lun->PRGeneration++;
+
+	return (retval);
+}
+
+static void
+ctl_pro_preempt_other(struct ctl_lun *lun, union ctl_ha_msg *msg)
+{
+	int i;
+
+	if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS
+	 || lun->pr_res_idx == CTL_PR_NO_RESERVATION
+	 || memcmp(&lun->per_res[lun->pr_res_idx].res_key,
+		   msg->pr.pr_info.sa_res_key,
+		   sizeof(struct scsi_per_res_key)) != 0) {
+		uint64_t sa_res_key;
+		sa_res_key = scsi_8btou64(msg->pr.pr_info.sa_res_key);
+
+		if (sa_res_key == 0) {
+			/* temporarily unregister this nexus */
+			lun->per_res[msg->pr.pr_info.residx].registered = 0;
+
+			/*
+			 * Unregister everybody else and build UA for
+			 * them
+			 */
+			for(i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+				if (lun->per_res[i].registered == 0)
+					continue;
+
+				if (!persis_offset
+				 && i < CTL_MAX_INITIATORS)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				else if (persis_offset && i >= persis_offset)
+					lun->pending_sense[i -
+						persis_offset].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				lun->per_res[i].registered = 0;
+				memset(&lun->per_res[i].res_key, 0,
+				       sizeof(struct scsi_per_res_key));
+			}
+
+			lun->per_res[msg->pr.pr_info.residx].registered = 1;
+			lun->pr_key_count = 1;
+			lun->res_type = msg->pr.pr_info.res_type;
+			if (lun->res_type != SPR_TYPE_WR_EX_AR
+			 && lun->res_type != SPR_TYPE_EX_AC_AR)
+				lun->pr_res_idx = msg->pr.pr_info.residx;
+		} else {
+		        for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+				if (memcmp(msg->pr.pr_info.sa_res_key,
+		                   lun->per_res[i].res_key.key,
+		                   sizeof(struct scsi_per_res_key)) != 0)
+					continue;
+
+				lun->per_res[i].registered = 0;
+				memset(&lun->per_res[i].res_key, 0,
+				       sizeof(struct scsi_per_res_key));
+				lun->pr_key_count--;
+
+				if (!persis_offset
+				 && i < persis_offset)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				else if (persis_offset
+				      && i >= persis_offset)
+					lun->pending_sense[i -
+						persis_offset].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+			}
+		}
+	} else {
+		/*
+		 * Temporarily unregister so it won't get removed
+		 * or UA generated
+		 */
+		lun->per_res[msg->pr.pr_info.residx].registered = 0;
+		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+			if (lun->per_res[i].registered == 0)
+				continue;
+
+			if (memcmp(msg->pr.pr_info.sa_res_key,
+	                   lun->per_res[i].res_key.key,
+	                   sizeof(struct scsi_per_res_key)) == 0) {
+				lun->per_res[i].registered = 0;
+				memset(&lun->per_res[i].res_key, 0,
+				       sizeof(struct scsi_per_res_key));
+				lun->pr_key_count--;
+				if (!persis_offset
+				 && i < CTL_MAX_INITIATORS)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+				else if (persis_offset
+				      && i >= persis_offset)
+					lun->pending_sense[i -
+						persis_offset].ua_pending |=
+						CTL_UA_REG_PREEMPT;
+			} else if (msg->pr.pr_info.res_type != lun->res_type
+				&& (lun->res_type == SPR_TYPE_WR_EX_RO
+				 || lun->res_type == SPR_TYPE_EX_AC_RO)) {
+					if (!persis_offset
+					 && i < persis_offset)
+						lun->pending_sense[i
+							].ua_pending |=
+							CTL_UA_RES_RELEASE;
+					else if (persis_offset
+					      && i >= persis_offset)
+					lun->pending_sense[i -
+						persis_offset].ua_pending |=
+						CTL_UA_RES_RELEASE;
+			}
+		}
+		lun->per_res[msg->pr.pr_info.residx].registered = 1;
+		lun->res_type = msg->pr.pr_info.res_type;
+		if (lun->res_type != SPR_TYPE_WR_EX_AR
+		 && lun->res_type != SPR_TYPE_EX_AC_AR)
+			lun->pr_res_idx = msg->pr.pr_info.residx;
+		else
+			lun->pr_res_idx = CTL_PR_ALL_REGISTRANTS;
+	}
+	lun->PRGeneration++;
+
+}
+
+
+int
+ctl_persistent_reserve_out(struct ctl_scsiio *ctsio)
+{
+	int retval;
+	int isc_retval;
+	u_int32_t param_len;
+	struct scsi_per_res_out *cdb;
+	struct ctl_lun *lun;
+	struct scsi_per_res_out_parms* param;
+	struct ctl_softc *softc;
+	uint32_t residx;
+	uint64_t res_key, sa_res_key;
+	uint8_t type;
+	union ctl_ha_msg persis_io;
+	int    i;
+
+	CTL_DEBUG_PRINT(("ctl_persistent_reserve_out\n"));
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	softc = control_softc;
+
+	cdb = (struct scsi_per_res_out *)ctsio->cdb;
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	/*
+	 * We only support whole-LUN scope.  The scope & type are ignored for
+	 * register, register and ignore existing key and clear.
+	 * We sometimes ignore scope and type on preempts too!!
+	 * Verify reservation type here as well.
+	 */
+	type = cdb->scope_type & SPR_TYPE_MASK;
+	if ((cdb->action == SPRO_RESERVE)
+	 || (cdb->action == SPRO_RELEASE)) {
+		if ((cdb->scope_type & SPR_SCOPE_MASK) != SPR_LU_SCOPE) {
+			ctl_set_invalid_field(/*ctsio*/ ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 2,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 4);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+
+		if (type>8 || type==2 || type==4 || type==0) {
+			ctl_set_invalid_field(/*ctsio*/ ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 1,
+					      /*field*/ 2,
+					      /*bit_valid*/ 1,
+					      /*bit*/ 0);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+	}
+
+	switch (cdb->action & SPRO_ACTION_MASK) {
+	case SPRO_REGISTER:
+	case SPRO_RESERVE:
+	case SPRO_RELEASE:
+	case SPRO_CLEAR:
+	case SPRO_PREEMPT:
+	case SPRO_REG_IGNO:
+		break;
+	case SPRO_REG_MOVE:
+	case SPRO_PRE_ABO:
+	default:
+		ctl_set_invalid_field(/*ctsio*/ ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+		break; /* NOTREACHED */
+	}
+
+	param_len = scsi_4btoul(cdb->length);
+
+	if ((ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) == 0) {
+		ctsio->kern_data_ptr = malloc(param_len, M_CTL, M_WAITOK);
+		if (ctsio->kern_data_ptr == NULL) {
+			ctl_set_busy(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		ctsio->kern_data_len = param_len;
+		ctsio->kern_total_len = param_len;
+		ctsio->kern_data_resid = 0;
+		ctsio->kern_rel_offset = 0;
+		ctsio->kern_sg_entries = 0;
+		ctsio->io_hdr.flags |= CTL_FLAG_ALLOCATED;
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	param = (struct scsi_per_res_out_parms *)ctsio->kern_data_ptr;
+
+	residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
+	res_key = scsi_8btou64(param->res_key.key);
+	sa_res_key = scsi_8btou64(param->serv_act_res_key);
+
+	/*
+	 * Validate the reservation key here except for SPRO_REG_IGNO
+	 * This must be done for all other service actions
+	 */
+	if ((cdb->action & SPRO_ACTION_MASK) != SPRO_REG_IGNO) {
+		mtx_lock(&softc->ctl_lock);
+		if (lun->per_res[residx].registered) {
+		    if (memcmp(param->res_key.key,
+			       lun->per_res[residx].res_key.key,
+			       ctl_min(sizeof(param->res_key),
+			       sizeof(lun->per_res[residx].res_key))) != 0) {
+				/*
+				 * The current key passed in doesn't match
+				 * the one the initiator previously
+				 * registered.
+				 */
+				mtx_unlock(&softc->ctl_lock);
+				free(ctsio->kern_data_ptr, M_CTL);
+				ctl_set_reservation_conflict(ctsio);
+				ctl_done((union ctl_io *)ctsio);
+				return (CTL_RETVAL_COMPLETE);
+			}
+		} else if ((cdb->action & SPRO_ACTION_MASK) != SPRO_REGISTER) {
+		    /*
+			 * We are not registered
+			 */
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_reservation_conflict(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		} else if (res_key != 0) {
+			/*
+			 * We are not registered and trying to register but
+			 * the register key isn't zero.
+			 */
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_reservation_conflict(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		mtx_unlock(&softc->ctl_lock);
+	}
+
+	switch (cdb->action & SPRO_ACTION_MASK) {
+	case SPRO_REGISTER:
+	case SPRO_REG_IGNO: {
+
+#if 0
+		printf("Registration received\n");
+#endif
+
+		/*
+		 * We don't support any of these options, as we report in
+		 * the read capabilities request (see
+		 * ctl_persistent_reserve_in(), above).
+		 */
+		if ((param->flags & SPR_SPEC_I_PT)
+		 || (param->flags & SPR_ALL_TG_PT)
+		 || (param->flags & SPR_APTPL)) {
+			int bit_ptr;
+
+			if (param->flags & SPR_APTPL)
+				bit_ptr = 0;
+			else if (param->flags & SPR_ALL_TG_PT)
+				bit_ptr = 2;
+			else /* SPR_SPEC_I_PT */
+				bit_ptr = 3;
+
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_invalid_field(ctsio,
+					      /*sks_valid*/ 1,
+					      /*command*/ 0,
+					      /*field*/ 20,
+					      /*bit_valid*/ 1,
+					      /*bit*/ bit_ptr);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+
+		mtx_lock(&softc->ctl_lock);
+
+		/*
+		 * The initiator wants to clear the
+		 * key/unregister.
+		 */
+		if (sa_res_key == 0) {
+			if ((res_key == 0
+			  && (cdb->action & SPRO_ACTION_MASK) == SPRO_REGISTER)
+			 || ((cdb->action & SPRO_ACTION_MASK) == SPRO_REG_IGNO
+			  && !lun->per_res[residx].registered)) {
+				mtx_unlock(&softc->ctl_lock);
+				goto done;
+			}
+
+			lun->per_res[residx].registered = 0;
+			memset(&lun->per_res[residx].res_key,
+			       0, sizeof(lun->per_res[residx].res_key));
+			lun->pr_key_count--;
+
+			if (residx == lun->pr_res_idx) {
+				lun->flags &= ~CTL_LUN_PR_RESERVED;
+				lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+
+				if ((lun->res_type == SPR_TYPE_WR_EX_RO
+				  || lun->res_type == SPR_TYPE_EX_AC_RO)
+				 && lun->pr_key_count) {
+					/*
+					 * If the reservation is a registrants
+					 * only type we need to generate a UA
+					 * for other registered inits.  The
+					 * sense code should be RESERVATIONS
+					 * RELEASED
+					 */
+
+					for (i = 0; i < CTL_MAX_INITIATORS;i++){
+						if (lun->per_res[
+						    i+persis_offset].registered
+						    == 0)
+							continue;
+						lun->pending_sense[i
+							].ua_pending |=
+							CTL_UA_RES_RELEASE;
+					}
+				}
+				lun->res_type = 0;
+			} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
+				if (lun->pr_key_count==0) {
+					lun->flags &= ~CTL_LUN_PR_RESERVED;
+					lun->res_type = 0;
+					lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+				}
+			}
+			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+			persis_io.pr.pr_info.action = CTL_PR_UNREG_KEY;
+			persis_io.pr.pr_info.residx = residx;
+			if ((isc_retval = ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+			     &persis_io, sizeof(persis_io), 0 )) >
+			     CTL_HA_STATUS_SUCCESS) {
+				printf("CTL:Persis Out error returned from "
+				       "ctl_ha_msg_send %d\n", isc_retval);
+			}
+			mtx_unlock(&softc->ctl_lock);
+		} else /* sa_res_key != 0 */ {
+
+			/*
+			 * If we aren't registered currently then increment
+			 * the key count and set the registered flag.
+			 */
+			if (!lun->per_res[residx].registered) {
+				lun->pr_key_count++;
+				lun->per_res[residx].registered = 1;
+			}
+
+			memcpy(&lun->per_res[residx].res_key,
+			       param->serv_act_res_key,
+			       ctl_min(sizeof(param->serv_act_res_key),
+			       sizeof(lun->per_res[residx].res_key)));
+
+			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+			persis_io.pr.pr_info.action = CTL_PR_REG_KEY;
+			persis_io.pr.pr_info.residx = residx;
+			memcpy(persis_io.pr.pr_info.sa_res_key,
+			       param->serv_act_res_key,
+			       sizeof(param->serv_act_res_key));
+			mtx_unlock(&softc->ctl_lock);
+			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+			     &persis_io, sizeof(persis_io), 0)) >
+			     CTL_HA_STATUS_SUCCESS) {
+				printf("CTL:Persis Out error returned from "
+				       "ctl_ha_msg_send %d\n", isc_retval);
+			}
+		}
+		lun->PRGeneration++;
+
+		break;
+	}
+	case SPRO_RESERVE:
+#if 0
+                printf("Reserve executed type %d\n", type);
+#endif
+		mtx_lock(&softc->ctl_lock);
+		if (lun->flags & CTL_LUN_PR_RESERVED) {
+			/*
+			 * if this isn't the reservation holder and it's
+			 * not a "all registrants" type or if the type is
+			 * different then we have a conflict
+			 */
+			if ((lun->pr_res_idx != residx
+			  && lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS)
+			 || lun->res_type != type) {
+				mtx_unlock(&softc->ctl_lock);
+				free(ctsio->kern_data_ptr, M_CTL);
+				ctl_set_reservation_conflict(ctsio);
+				ctl_done((union ctl_io *)ctsio);
+				return (CTL_RETVAL_COMPLETE);
+			}
+		} else /* create a reservation */ {
+			/*
+			 * If it's not an "all registrants" type record
+			 * reservation holder
+			 */
+			if (type != SPR_TYPE_WR_EX_AR
+			 && type != SPR_TYPE_EX_AC_AR)
+				lun->pr_res_idx = residx; /* Res holder */
+			else
+				lun->pr_res_idx = CTL_PR_ALL_REGISTRANTS;
+
+			lun->flags |= CTL_LUN_PR_RESERVED;
+			lun->res_type = type;
+
+			mtx_unlock(&softc->ctl_lock);
+
+			/* send msg to other side */
+			persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+			persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+			persis_io.pr.pr_info.action = CTL_PR_RESERVE;
+			persis_io.pr.pr_info.residx = lun->pr_res_idx;
+			persis_io.pr.pr_info.res_type = type;
+			if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+			     &persis_io, sizeof(persis_io), 0)) >
+			     CTL_HA_STATUS_SUCCESS) {
+				printf("CTL:Persis Out error returned from "
+				       "ctl_ha_msg_send %d\n", isc_retval);
+			}
+		}
+		break;
+
+	case SPRO_RELEASE:
+		mtx_lock(&softc->ctl_lock);
+		if ((lun->flags & CTL_LUN_PR_RESERVED) == 0) {
+			/* No reservation exists return good status */
+			mtx_unlock(&softc->ctl_lock);
+			goto done;
+		}
+		/*
+		 * Is this nexus a reservation holder?
+		 */
+		if (lun->pr_res_idx != residx
+		 && lun->pr_res_idx != CTL_PR_ALL_REGISTRANTS) {
+			/*
+			 * not a res holder return good status but
+			 * do nothing
+			 */
+			mtx_unlock(&softc->ctl_lock);
+			goto done;
+		}
+
+		if (lun->res_type != type) {
+			mtx_unlock(&softc->ctl_lock);
+			free(ctsio->kern_data_ptr, M_CTL);
+			ctl_set_illegal_pr_release(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+		}
+
+		/* okay to release */
+		lun->flags &= ~CTL_LUN_PR_RESERVED;
+		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+		lun->res_type = 0;
+
+		/*
+		 * if this isn't an exclusive access
+		 * res generate UA for all other
+		 * registrants.
+		 */
+		if (type != SPR_TYPE_EX_AC
+		 && type != SPR_TYPE_WR_EX) {
+			/*
+			 * temporarily unregister so we don't generate UA
+			 */
+			lun->per_res[residx].registered = 0;
+
+			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+				if (lun->per_res[i+persis_offset].registered
+				    == 0)
+					continue;
+				lun->pending_sense[i].ua_pending |=
+					CTL_UA_RES_RELEASE;
+			}
+
+			lun->per_res[residx].registered = 1;
+		}
+		mtx_unlock(&softc->ctl_lock);
+		/* Send msg to other side */
+		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+		persis_io.pr.pr_info.action = CTL_PR_RELEASE;
+		if ((isc_retval=ctl_ha_msg_send( CTL_HA_CHAN_CTL, &persis_io,
+		     sizeof(persis_io), 0)) > CTL_HA_STATUS_SUCCESS) {
+			printf("CTL:Persis Out error returned from "
+			       "ctl_ha_msg_send %d\n", isc_retval);
+		}
+		break;
+
+	case SPRO_CLEAR:
+		/* send msg to other side */
+
+		mtx_lock(&softc->ctl_lock);
+		lun->flags &= ~CTL_LUN_PR_RESERVED;
+		lun->res_type = 0;
+		lun->pr_key_count = 0;
+		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+
+
+		memset(&lun->per_res[residx].res_key,
+		       0, sizeof(lun->per_res[residx].res_key));
+		lun->per_res[residx].registered = 0;
+
+		for (i=0; i < 2*CTL_MAX_INITIATORS; i++)
+			if (lun->per_res[i].registered) {
+				if (!persis_offset && i < CTL_MAX_INITIATORS)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_RES_PREEMPT;
+				else if (persis_offset && i >= persis_offset)
+					lun->pending_sense[i-persis_offset
+					    ].ua_pending |= CTL_UA_RES_PREEMPT;
+
+				memset(&lun->per_res[i].res_key,
+				       0, sizeof(struct scsi_per_res_key));
+				lun->per_res[i].registered = 0;
+			}
+		lun->PRGeneration++;
+		mtx_unlock(&softc->ctl_lock);
+		persis_io.hdr.nexus = ctsio->io_hdr.nexus;
+		persis_io.hdr.msg_type = CTL_MSG_PERS_ACTION;
+		persis_io.pr.pr_info.action = CTL_PR_CLEAR;
+		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL, &persis_io,
+		     sizeof(persis_io), 0)) > CTL_HA_STATUS_SUCCESS) {
+			printf("CTL:Persis Out error returned from "
+			       "ctl_ha_msg_send %d\n", isc_retval);
+		}
+		break;
+
+	case SPRO_PREEMPT: {
+		int nretval;
+
+		nretval = ctl_pro_preempt(softc, lun, res_key, sa_res_key, type,
+					  residx, ctsio, cdb, param);
+		if (nretval != 0)
+			return (CTL_RETVAL_COMPLETE);
+		break;
+	}
+	case SPRO_REG_MOVE:
+	case SPRO_PRE_ABO:
+	default:
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctl_set_invalid_field(/*ctsio*/ ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+		break; /* NOTREACHED */
+	}
+
+done:
+	free(ctsio->kern_data_ptr, M_CTL);
+	ctl_set_success(ctsio);
+	ctl_done((union ctl_io *)ctsio);
+
+	return (retval);
+}
+
+/*
+ * This routine is for handling a message from the other SC pertaining to
+ * persistent reserve out. All the error checking will have been done
+ * so only perorming the action need be done here to keep the two
+ * in sync.
+ */
+static void
+ctl_hndl_per_res_out_on_other_sc(union ctl_ha_msg *msg)
+{
+	struct ctl_lun *lun;
+	struct ctl_softc *softc;
+	int i;
+
+	softc = control_softc;
+
+	mtx_lock(&softc->ctl_lock);
+
+	lun = softc->ctl_luns[msg->hdr.nexus.targ_lun];
+	switch(msg->pr.pr_info.action) {
+	case CTL_PR_REG_KEY:
+		if (!lun->per_res[msg->pr.pr_info.residx].registered) {
+			lun->per_res[msg->pr.pr_info.residx].registered = 1;
+			lun->pr_key_count++;
+		}
+		lun->PRGeneration++;
+		memcpy(&lun->per_res[msg->pr.pr_info.residx].res_key,
+		       msg->pr.pr_info.sa_res_key,
+		       sizeof(struct scsi_per_res_key));
+		break;
+
+	case CTL_PR_UNREG_KEY:
+		lun->per_res[msg->pr.pr_info.residx].registered = 0;
+		memset(&lun->per_res[msg->pr.pr_info.residx].res_key,
+		       0, sizeof(struct scsi_per_res_key));
+		lun->pr_key_count--;
+
+		/* XXX Need to see if the reservation has been released */
+		/* if so do we need to generate UA? */
+		if (msg->pr.pr_info.residx == lun->pr_res_idx) {
+			lun->flags &= ~CTL_LUN_PR_RESERVED;
+			lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+
+			if ((lun->res_type == SPR_TYPE_WR_EX_RO
+			  || lun->res_type == SPR_TYPE_EX_AC_RO)
+			 && lun->pr_key_count) {
+				/*
+				 * If the reservation is a registrants
+				 * only type we need to generate a UA
+				 * for other registered inits.  The
+				 * sense code should be RESERVATIONS
+				 * RELEASED
+				 */
+
+				for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+					if (lun->per_res[i+
+					    persis_offset].registered == 0)
+						continue;
+
+					lun->pending_sense[i
+						].ua_pending |=
+						CTL_UA_RES_RELEASE;
+				}
+			}
+			lun->res_type = 0;
+		} else if (lun->pr_res_idx == CTL_PR_ALL_REGISTRANTS) {
+			if (lun->pr_key_count==0) {
+				lun->flags &= ~CTL_LUN_PR_RESERVED;
+				lun->res_type = 0;
+				lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+			}
+		}
+		lun->PRGeneration++;
+		break;
+
+	case CTL_PR_RESERVE:
+		lun->flags |= CTL_LUN_PR_RESERVED;
+		lun->res_type = msg->pr.pr_info.res_type;
+		lun->pr_res_idx = msg->pr.pr_info.residx;
+
+		break;
+
+	case CTL_PR_RELEASE:
+		/*
+		 * if this isn't an exclusive access res generate UA for all
+		 * other registrants.
+		 */
+		if (lun->res_type != SPR_TYPE_EX_AC
+		 && lun->res_type != SPR_TYPE_WR_EX) {
+			for (i = 0; i < CTL_MAX_INITIATORS; i++)
+				if (lun->per_res[i+persis_offset].registered)
+					lun->pending_sense[i].ua_pending |=
+						CTL_UA_RES_RELEASE;
+		}
+
+		lun->flags &= ~CTL_LUN_PR_RESERVED;
+		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+		lun->res_type = 0;
+		break;
+
+	case CTL_PR_PREEMPT:
+		ctl_pro_preempt_other(lun, msg);
+		break;
+	case CTL_PR_CLEAR:
+		lun->flags &= ~CTL_LUN_PR_RESERVED;
+		lun->res_type = 0;
+		lun->pr_key_count = 0;
+		lun->pr_res_idx = CTL_PR_NO_RESERVATION;
+
+		for (i=0; i < 2*CTL_MAX_INITIATORS; i++) {
+			if (lun->per_res[i].registered == 0)
+				continue;
+			if (!persis_offset
+			 && i < CTL_MAX_INITIATORS)
+				lun->pending_sense[i].ua_pending |=
+					CTL_UA_RES_PREEMPT;
+			else if (persis_offset
+			      && i >= persis_offset)
+   				lun->pending_sense[i-persis_offset].ua_pending|=
+					CTL_UA_RES_PREEMPT;
+			memset(&lun->per_res[i].res_key, 0,
+			       sizeof(struct scsi_per_res_key));
+			lun->per_res[i].registered = 0;
+		}
+		lun->PRGeneration++;
+		break;
+	}
+
+	mtx_unlock(&softc->ctl_lock);
+}
+
+int
+ctl_read_write(struct ctl_scsiio *ctsio)
+{
+	struct ctl_lun *lun;
+	struct ctl_lba_len lbalen;
+	uint64_t lba;
+	uint32_t num_blocks;
+	int reladdr, fua, dpo, ebp;
+	int retval;
+	int isread;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	CTL_DEBUG_PRINT(("ctl_read_write: command: %#x\n", ctsio->cdb[0]));
+
+	reladdr = 0;
+	fua = 0;
+	dpo = 0;
+	ebp = 0;
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	isread = ctsio->cdb[0] == READ_6  || ctsio->cdb[0] == READ_10
+	      || ctsio->cdb[0] == READ_12 || ctsio->cdb[0] == READ_16;
+	if (lun->flags & CTL_LUN_PR_RESERVED && isread) {
+		uint32_t residx;
+
+		/*
+		 * XXX KDM need a lock here.
+		 */
+		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
+		if ((lun->res_type == SPR_TYPE_EX_AC
+		  && residx != lun->pr_res_idx)
+		 || ((lun->res_type == SPR_TYPE_EX_AC_RO
+		   || lun->res_type == SPR_TYPE_EX_AC_AR)
+		  && !lun->per_res[residx].registered)) {
+			ctl_set_reservation_conflict(ctsio);
+			ctl_done((union ctl_io *)ctsio);
+			return (CTL_RETVAL_COMPLETE);
+	        }
+	}
+
+	switch (ctsio->cdb[0]) {
+	case READ_6:
+	case WRITE_6: {
+		struct scsi_rw_6 *cdb;
+
+		cdb = (struct scsi_rw_6 *)ctsio->cdb;
+
+		lba = scsi_3btoul(cdb->addr);
+		/* only 5 bits are valid in the most significant address byte */
+		lba &= 0x1fffff;
+		num_blocks = cdb->length;
+		/*
+		 * This is correct according to SBC-2.
+		 */
+		if (num_blocks == 0)
+			num_blocks = 256;
+		break;
+	}
+	case READ_10:
+	case WRITE_10: {
+		struct scsi_rw_10 *cdb;
+
+		cdb = (struct scsi_rw_10 *)ctsio->cdb;
+
+		if (cdb->byte2 & SRW10_RELADDR)
+			reladdr = 1;
+		if (cdb->byte2 & SRW10_FUA)
+			fua = 1;
+		if (cdb->byte2 & SRW10_DPO)
+			dpo = 1;
+
+		if ((cdb->opcode == WRITE_10)
+		 && (cdb->byte2 & SRW10_EBP))
+			ebp = 1;
+
+		lba = scsi_4btoul(cdb->addr);
+		num_blocks = scsi_2btoul(cdb->length);
+		break;
+	}
+	case WRITE_VERIFY_10: {
+		struct scsi_write_verify_10 *cdb;
+
+		cdb = (struct scsi_write_verify_10 *)ctsio->cdb;
+
+		/*
+		 * XXX KDM we should do actual write verify support at some
+		 * point.  This is obviously fake, we're just translating
+		 * things to a write.  So we don't even bother checking the
+		 * BYTCHK field, since we don't do any verification.  If
+		 * the user asks for it, we'll just pretend we did it.
+		 */
+		if (cdb->byte2 & SWV_DPO)
+			dpo = 1;
+
+		lba = scsi_4btoul(cdb->addr);
+		num_blocks = scsi_2btoul(cdb->length);
+		break;
+	}
+	case READ_12:
+	case WRITE_12: {
+		struct scsi_rw_12 *cdb;
+
+		cdb = (struct scsi_rw_12 *)ctsio->cdb;
+
+		if (cdb->byte2 & SRW12_RELADDR)
+			reladdr = 1;
+		if (cdb->byte2 & SRW12_FUA)
+			fua = 1;
+		if (cdb->byte2 & SRW12_DPO)
+			dpo = 1;
+		lba = scsi_4btoul(cdb->addr);
+		num_blocks = scsi_4btoul(cdb->length);
+		break;
+	}
+	case WRITE_VERIFY_12: {
+		struct scsi_write_verify_12 *cdb;
+
+		cdb = (struct scsi_write_verify_12 *)ctsio->cdb;
+
+		if (cdb->byte2 & SWV_DPO)
+			dpo = 1;
+		
+		lba = scsi_4btoul(cdb->addr);
+		num_blocks = scsi_4btoul(cdb->length);
+
+		break;
+	}
+	case READ_16:
+	case WRITE_16: {
+		struct scsi_rw_16 *cdb;
+
+		cdb = (struct scsi_rw_16 *)ctsio->cdb;
+
+		if (cdb->byte2 & SRW12_RELADDR)
+			reladdr = 1;
+		if (cdb->byte2 & SRW12_FUA)
+			fua = 1;
+		if (cdb->byte2 & SRW12_DPO)
+			dpo = 1;
+
+		lba = scsi_8btou64(cdb->addr);
+		num_blocks = scsi_4btoul(cdb->length);
+		break;
+	}
+	case WRITE_VERIFY_16: {
+		struct scsi_write_verify_16 *cdb;
+
+		cdb = (struct scsi_write_verify_16 *)ctsio->cdb;
+
+		if (cdb->byte2 & SWV_DPO)
+			dpo = 1;
+
+		lba = scsi_8btou64(cdb->addr);
+		num_blocks = scsi_4btoul(cdb->length);
+		break;
+	}
+	default:
+		/*
+		 * We got a command we don't support.  This shouldn't
+		 * happen, commands should be filtered out above us.
+		 */
+		ctl_set_invalid_opcode(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+		break; /* NOTREACHED */
+	}
+
+	/*
+	 * XXX KDM what do we do with the DPO and FUA bits?  FUA might be
+	 * interesting for us, but if RAIDCore is in write-back mode,
+	 * getting it to do write-through for a particular transaction may
+	 * not be possible.
+	 */
+	/*
+	 * We don't support relative addressing.  That also requires
+	 * supporting linked commands, which we don't do.
+	 */
+	if (reladdr != 0) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * The first check is to make sure we're in bounds, the second
+	 * check is to catch wrap-around problems.  If the lba + num blocks
+	 * is less than the lba, then we've wrapped around and the block
+	 * range is invalid anyway.
+	 */
+	if (((lba + num_blocks) > (lun->be_lun->maxlba + 1))
+	 || ((lba + num_blocks) < lba)) {
+		ctl_set_lba_out_of_range(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * According to SBC-3, a transfer length of 0 is not an error.
+	 * Note that this cannot happen with WRITE(6) or READ(6), since 0
+	 * translates to 256 blocks for those commands.
+	 */
+	if (num_blocks == 0) {
+		ctl_set_success(ctsio);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	lbalen.lba = lba;
+	lbalen.len = num_blocks;
+	memcpy(ctsio->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes, &lbalen,
+	       sizeof(lbalen));
+
+	CTL_DEBUG_PRINT(("ctl_read_write: calling data_submit()\n"));
+
+	retval = lun->backend->data_submit((union ctl_io *)ctsio);
+
+	return (retval);
+}
+
+int
+ctl_report_luns(struct ctl_scsiio *ctsio)
+{
+	struct scsi_report_luns *cdb;
+	struct scsi_report_luns_data *lun_data;
+	struct ctl_lun *lun, *request_lun;
+	int num_luns, retval;
+	uint32_t alloc_len, lun_datalen;
+	int num_filled, well_known;
+	uint32_t initidx;
+
+	retval = CTL_RETVAL_COMPLETE;
+	well_known = 0;
+
+	cdb = (struct scsi_report_luns *)ctsio->cdb;
+
+	CTL_DEBUG_PRINT(("ctl_report_luns\n"));
+
+	mtx_lock(&control_softc->ctl_lock);
+	num_luns = control_softc->num_luns;
+	mtx_unlock(&control_softc->ctl_lock);
+
+	switch (cdb->select_report) {
+	case RPL_REPORT_DEFAULT:
+	case RPL_REPORT_ALL:
+		break;
+	case RPL_REPORT_WELLKNOWN:
+		well_known = 1;
+		num_luns = 0;
+		break;
+	default:
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 2,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (retval);
+		break; /* NOTREACHED */
+	}
+
+	alloc_len = scsi_4btoul(cdb->length);
+	/*
+	 * The initiator has to allocate at least 16 bytes for this request,
+	 * so he can at least get the header and the first LUN.  Otherwise
+	 * we reject the request (per SPC-3 rev 14, section 6.21).
+	 */
+	if (alloc_len < (sizeof(struct scsi_report_luns_data) +
+	    sizeof(struct scsi_report_luns_lundata))) {
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 6,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		return (retval);
+	}
+
+	request_lun = (struct ctl_lun *)
+		ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	lun_datalen = sizeof(*lun_data) +
+		(num_luns * sizeof(struct scsi_report_luns_lundata));
+
+	ctsio->kern_data_ptr = malloc(lun_datalen, M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	lun_data = (struct scsi_report_luns_data *)ctsio->kern_data_ptr;
+	ctsio->kern_sg_entries = 0;
+
+	if (lun_datalen < alloc_len) {
+		ctsio->residual = alloc_len - lun_datalen;
+		ctsio->kern_data_len = lun_datalen;
+		ctsio->kern_total_len = lun_datalen;
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
+
+	memset(lun_data, 0, lun_datalen);
+
+	/*
+	 * We set this to the actual data length, regardless of how much
+	 * space we actually have to return results.  If the user looks at
+	 * this value, he'll know whether or not he allocated enough space
+	 * and reissue the command if necessary.  We don't support well
+	 * known logical units, so if the user asks for that, return none.
+	 */
+	scsi_ulto4b(lun_datalen - 8, lun_data->length);
+
+	mtx_lock(&control_softc->ctl_lock);
+	for (num_filled = 0, lun = STAILQ_FIRST(&control_softc->lun_list);
+	     (lun != NULL) && (num_filled < num_luns);
+	     lun = STAILQ_NEXT(lun, links)) {
+
+		if (lun->lun <= 0xff) {
+			/*
+			 * Peripheral addressing method, bus number 0.
+			 */
+			lun_data->luns[num_filled].lundata[0] =
+				RPL_LUNDATA_ATYP_PERIPH;
+			lun_data->luns[num_filled].lundata[1] = lun->lun;
+			num_filled++;
+		} else if (lun->lun <= 0x3fff) {
+			/*
+			 * Flat addressing method.
+			 */
+			lun_data->luns[num_filled].lundata[0] =
+				RPL_LUNDATA_ATYP_FLAT |
+				(lun->lun & RPL_LUNDATA_FLAT_LUN_MASK);
+#ifdef OLDCTLHEADERS
+				(SRLD_ADDR_FLAT << SRLD_ADDR_SHIFT) |
+				(lun->lun & SRLD_BUS_LUN_MASK);
+#endif
+			lun_data->luns[num_filled].lundata[1] =
+#ifdef OLDCTLHEADERS
+				lun->lun >> SRLD_BUS_LUN_BITS;
+#endif
+				lun->lun >> RPL_LUNDATA_FLAT_LUN_BITS;
+			num_filled++;
+		} else {
+			printf("ctl_report_luns: bogus LUN number %jd, "
+			       "skipping\n", (intmax_t)lun->lun);
+		}
+		/*
+		 * According to SPC-3, rev 14 section 6.21:
+		 *
+		 * "The execution of a REPORT LUNS command to any valid and
+		 * installed logical unit shall clear the REPORTED LUNS DATA
+		 * HAS CHANGED unit attention condition for all logical
+		 * units of that target with respect to the requesting
+		 * initiator. A valid and installed logical unit is one
+		 * having a PERIPHERAL QUALIFIER of 000b in the standard
+		 * INQUIRY data (see 6.4.2)."
+		 *
+		 * If request_lun is NULL, the LUN this report luns command
+		 * was issued to is either disabled or doesn't exist. In that
+		 * case, we shouldn't clear any pending lun change unit
+		 * attention.
+		 */
+		if (request_lun != NULL)
+			lun->pending_sense[initidx].ua_pending &=
+				~CTL_UA_LUN_CHANGE;
+	}
+	mtx_unlock(&control_softc->ctl_lock);
+
+	/*
+	 * We can only return SCSI_STATUS_CHECK_COND when we can't satisfy
+	 * this request.
+	 */
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (retval);
+}
+
+int
+ctl_request_sense(struct ctl_scsiio *ctsio)
+{
+	struct scsi_request_sense *cdb;
+	struct scsi_sense_data *sense_ptr;
+	struct ctl_lun *lun;
+	uint32_t initidx;
+	int have_error;
+	ctl_sense_format sense_format;
+
+	cdb = (struct scsi_request_sense *)ctsio->cdb;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	CTL_DEBUG_PRINT(("ctl_request_sense\n"));
+
+	/*
+	 * Determine which sense format the user wants.
+	 */
+	if (cdb->byte2 & SRS_DESC)
+		sense_format = CTL_SENSE_DESCRIPTOR;
+	else
+		sense_format = CTL_SENSE_FIXED;
+
+	ctsio->kern_data_ptr = malloc(sizeof(*sense_ptr), M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	sense_ptr = (struct scsi_sense_data *)ctsio->kern_data_ptr;
+	ctsio->kern_sg_entries = 0;
+
+	/*
+	 * struct scsi_sense_data, which is currently set to 256 bytes, is
+	 * larger than the largest allowed value for the length field in the
+	 * REQUEST SENSE CDB, which is 252 bytes as of SPC-4.
+	 */
+	ctsio->residual = 0;
+	ctsio->kern_data_len = cdb->length;
+	ctsio->kern_total_len = cdb->length;
+
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	/*
+	 * If we don't have a LUN, we don't have any pending sense.
+	 */
+	if (lun == NULL)
+		goto no_sense;
+
+	have_error = 0;
+	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
+	/*
+	 * Check for pending sense, and then for pending unit attentions.
+	 * Pending sense gets returned first, then pending unit attentions.
+	 */
+	mtx_lock(&lun->ctl_softc->ctl_lock);
+	if (ctl_is_set(lun->have_ca, initidx)) {
+		ctl_sense_format stored_format;
+
+		/*
+		 * Check to see which sense format was used for the stored
+		 * sense data.
+		 */
+		stored_format = ctl_get_sense_format(
+		    &lun->pending_sense[initidx].sense);
+
+		/*
+		 * If the user requested a different sense format than the
+		 * one we stored, then we need to convert it to the other
+		 * format.  If we're going from descriptor to fixed format
+		 * sense data, we may lose things in translation, depending
+		 * on what options were used.
+		 */
+		if ((stored_format == CTL_SENSE_FIXED)
+		 && (sense_format == CTL_SENSE_DESCRIPTOR))
+			ctl_sense_to_desc((struct scsi_sense_data_fixed *)
+			    &lun->pending_sense[initidx].sense,
+			    (struct scsi_sense_data_desc *)sense_ptr);
+		else if ((stored_format == CTL_SENSE_DESCRIPTOR)
+		      && (sense_format == CTL_SENSE_FIXED))
+			ctl_sense_to_fixed((struct scsi_sense_data_desc *)
+			    &lun->pending_sense[initidx].sense,
+			    (struct scsi_sense_data_fixed *)sense_ptr);
+		else
+			memcpy(sense_ptr, &lun->pending_sense[initidx].sense,
+			       ctl_min(sizeof(*sense_ptr),
+			       sizeof(lun->pending_sense[initidx].sense)));
+
+		ctl_clear_mask(lun->have_ca, initidx);
+		have_error = 1;
+	} else if (lun->pending_sense[initidx].ua_pending != CTL_UA_NONE) {
+		ctl_ua_type ua_type;
+
+		ua_type = ctl_build_ua(lun->pending_sense[initidx].ua_pending,
+				       sense_ptr, sense_format);
+		if (ua_type != CTL_UA_NONE) {
+			have_error = 1;
+			/* We're reporting this UA, so clear it */
+			lun->pending_sense[initidx].ua_pending &= ~ua_type;
+		}
+	}
+	mtx_unlock(&lun->ctl_softc->ctl_lock);
+
+	/*
+	 * We already have a pending error, return it.
+	 */
+	if (have_error != 0) {
+		/*
+		 * We report the SCSI status as OK, since the status of the
+		 * request sense command itself is OK.
+		 */
+		ctsio->scsi_status = SCSI_STATUS_OK;
+
+		/*
+		 * We report 0 for the sense length, because we aren't doing
+		 * autosense in this case.  We're reporting sense as
+		 * parameter data.
+		 */
+		ctsio->sense_len = 0;
+
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+no_sense:
+
+	/*
+	 * No sense information to report, so we report that everything is
+	 * okay.
+	 */
+	ctl_set_sense_data(sense_ptr,
+			   lun,
+			   sense_format,
+			   /*current_error*/ 1,
+			   /*sense_key*/ SSD_KEY_NO_SENSE,
+			   /*asc*/ 0x00,
+			   /*ascq*/ 0x00,
+			   SSD_ELEM_NONE);
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	/*
+	 * We report 0 for the sense length, because we aren't doing
+	 * autosense in this case.  We're reporting sense as parameter data.
+	 */
+	ctsio->sense_len = 0;
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_tur(struct ctl_scsiio *ctsio)
+{
+	struct ctl_lun *lun;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	CTL_DEBUG_PRINT(("ctl_tur\n"));
+
+	if (lun == NULL)
+		return (-EINVAL);
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+	ctsio->io_hdr.status = CTL_SUCCESS;
+
+	ctl_done((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+#ifdef notyet
+static int
+ctl_cmddt_inquiry(struct ctl_scsiio *ctsio)
+{
+
+}
+#endif
+
+static int
+ctl_inquiry_evpd_supported(struct ctl_scsiio *ctsio, int alloc_len)
+{
+	struct scsi_vpd_supported_pages *pages;
+	int sup_page_size;
+	struct ctl_lun *lun;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	sup_page_size = sizeof(struct scsi_vpd_supported_pages) +
+		SCSI_EVPD_NUM_SUPPORTED_PAGES;
+	/*
+	 * XXX KDM GFP_???  We probably don't want to wait here,
+	 * unless we end up having a process/thread context.
+	 */
+	ctsio->kern_data_ptr = malloc(sup_page_size, M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	pages = (struct scsi_vpd_supported_pages *)ctsio->kern_data_ptr;
+	ctsio->kern_sg_entries = 0;
+
+	if (sup_page_size < alloc_len) {
+		ctsio->residual = alloc_len - sup_page_size;
+		ctsio->kern_data_len = sup_page_size;
+		ctsio->kern_total_len = sup_page_size;
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	memset(pages, 0, sup_page_size);
+
+	/*
+	 * The control device is always connected.  The disk device, on the
+	 * other hand, may not be online all the time.  Need to change this
+	 * to figure out whether the disk device is actually online or not.
+	 */
+	if (lun != NULL)
+		pages->device = (SID_QUAL_LU_CONNECTED << 5) |
+				lun->be_lun->lun_type;
+	else
+		pages->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
+
+	pages->length = SCSI_EVPD_NUM_SUPPORTED_PAGES;
+	/* Supported VPD pages */
+	pages->page_list[0] = SVPD_SUPPORTED_PAGES;
+	/* Serial Number */
+	pages->page_list[1] = SVPD_UNIT_SERIAL_NUMBER;
+	/* Device Identification */
+	pages->page_list[2] = SVPD_DEVICE_ID;
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+static int
+ctl_inquiry_evpd_serial(struct ctl_scsiio *ctsio, int alloc_len)
+{
+	struct scsi_vpd_unit_serial_number *sn_ptr;
+	struct ctl_lun *lun;
+#ifndef CTL_USE_BACKEND_SN
+	char tmpstr[32];
+#endif
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	/* XXX KDM which malloc flags here?? */
+	ctsio->kern_data_ptr = malloc(sizeof(*sn_ptr), M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	sn_ptr = (struct scsi_vpd_unit_serial_number *)ctsio->kern_data_ptr;
+	ctsio->kern_sg_entries = 0;
+
+	if (sizeof(*sn_ptr) < alloc_len) {
+		ctsio->residual = alloc_len - sizeof(*sn_ptr);
+		ctsio->kern_data_len = sizeof(*sn_ptr);
+		ctsio->kern_total_len = sizeof(*sn_ptr);
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	memset(sn_ptr, 0, sizeof(*sn_ptr));
+
+	/*
+	 * The control device is always connected.  The disk device, on the
+	 * other hand, may not be online all the time.  Need to change this
+	 * to figure out whether the disk device is actually online or not.
+	 */
+	if (lun != NULL)
+		sn_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
+				  lun->be_lun->lun_type;
+	else
+		sn_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
+
+	sn_ptr->page_code = SVPD_UNIT_SERIAL_NUMBER;
+	sn_ptr->length = ctl_min(sizeof(*sn_ptr) - 4, CTL_SN_LEN);
+#ifdef CTL_USE_BACKEND_SN
+	/*
+	 * If we don't have a LUN, we just leave the serial number as
+	 * all spaces.
+	 */
+	memset(sn_ptr->serial_num, 0x20, sizeof(sn_ptr->serial_num));
+	if (lun != NULL) {
+		strncpy((char *)sn_ptr->serial_num,
+			(char *)lun->be_lun->serial_num, CTL_SN_LEN);
+	}
+#else
+	/*
+	 * Note that we're using a non-unique serial number here,
+	 */
+	snprintf(tmpstr, sizeof(tmpstr), "MYSERIALNUMIS000");
+	memset(sn_ptr->serial_num, 0x20, sizeof(sn_ptr->serial_num));
+	strncpy(sn_ptr->serial_num, tmpstr, ctl_min(CTL_SN_LEN,
+		ctl_min(sizeof(tmpstr), sizeof(*sn_ptr) - 4)));
+#endif
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+
+static int
+ctl_inquiry_evpd_devid(struct ctl_scsiio *ctsio, int alloc_len)
+{
+	struct scsi_vpd_device_id *devid_ptr;
+	struct scsi_vpd_id_descriptor *desc, *desc1;
+	struct scsi_vpd_id_descriptor *desc2, *desc3; /* for types 4h and 5h */
+	struct scsi_vpd_id_t10 *t10id;
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+	struct ctl_frontend *fe;
+#ifndef CTL_USE_BACKEND_SN
+	char tmpstr[32];
+#endif /* CTL_USE_BACKEND_SN */
+	int devid_len;
+
+	ctl_softc = control_softc;
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	devid_len = sizeof(struct scsi_vpd_device_id) +
+		sizeof(struct scsi_vpd_id_descriptor) +
+		sizeof(struct scsi_vpd_id_t10) + CTL_DEVID_LEN +
+		sizeof(struct scsi_vpd_id_descriptor) + CTL_WWPN_LEN +
+		sizeof(struct scsi_vpd_id_descriptor) +
+		sizeof(struct scsi_vpd_id_rel_trgt_port_id) +
+		sizeof(struct scsi_vpd_id_descriptor) +
+		sizeof(struct scsi_vpd_id_trgt_port_grp_id);
+
+	/* XXX KDM which malloc flags here ?? */
+	ctsio->kern_data_ptr = malloc(devid_len, M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	devid_ptr = (struct scsi_vpd_device_id *)ctsio->kern_data_ptr;
+	ctsio->kern_sg_entries = 0;
+
+	if (devid_len < alloc_len) {
+		ctsio->residual = alloc_len - devid_len;
+		ctsio->kern_data_len = devid_len;
+		ctsio->kern_total_len = devid_len;
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+	ctsio->kern_sg_entries = 0;
+
+	desc = (struct scsi_vpd_id_descriptor *)devid_ptr->desc_list;
+	t10id = (struct scsi_vpd_id_t10 *)&desc->identifier[0];
+	desc1 = (struct scsi_vpd_id_descriptor *)(&desc->identifier[0] +
+		sizeof(struct scsi_vpd_id_t10) + CTL_DEVID_LEN);
+	desc2 = (struct scsi_vpd_id_descriptor *)(&desc1->identifier[0] +
+	          CTL_WWPN_LEN);
+	desc3 = (struct scsi_vpd_id_descriptor *)(&desc2->identifier[0] +
+	         sizeof(struct scsi_vpd_id_rel_trgt_port_id));
+	memset(devid_ptr, 0, devid_len);
+
+	/*
+	 * The control device is always connected.  The disk device, on the
+	 * other hand, may not be online all the time.
+	 */
+	if (lun != NULL)
+		devid_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
+				     lun->be_lun->lun_type;
+	else
+		devid_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
+
+	devid_ptr->page_code = SVPD_DEVICE_ID;
+
+	scsi_ulto2b(devid_len - 4, devid_ptr->length);
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	fe = ctl_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)];
+
+	/*
+	 * For Fibre channel,
+	 */
+	if (fe->port_type == CTL_PORT_FC)
+	{
+		desc->proto_codeset = (SCSI_PROTO_FC << 4) |
+				      SVPD_ID_CODESET_ASCII;
+        	desc1->proto_codeset = (SCSI_PROTO_FC << 4) |
+		              SVPD_ID_CODESET_BINARY;
+	}
+	else
+	{
+		desc->proto_codeset = (SCSI_PROTO_SPI << 4) |
+				      SVPD_ID_CODESET_ASCII;
+        	desc1->proto_codeset = (SCSI_PROTO_SPI << 4) |
+		              SVPD_ID_CODESET_BINARY;
+	}
+	desc2->proto_codeset = desc3->proto_codeset = desc1->proto_codeset;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	/*
+	 * We're using a LUN association here.  i.e., this device ID is a
+	 * per-LUN identifier.
+	 */
+	desc->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_LUN | SVPD_ID_TYPE_T10;
+	desc->length = sizeof(*t10id) + CTL_DEVID_LEN;
+	strncpy((char *)t10id->vendor, CTL_VENDOR, sizeof(t10id->vendor));
+
+	/*
+	 * desc1 is for the WWPN which is a port asscociation.
+	 */
+	desc1->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT | SVPD_ID_TYPE_NAA;
+	desc1->length = CTL_WWPN_LEN;
+	/* XXX Call Reggie's get_WWNN func here then add port # to the end */
+	/* For testing just create the WWPN */
+#if 0
+	ddb_GetWWNN((char *)desc1->identifier);
+
+	/* NOTE: if the port is 0 or 8 we don't want to subtract 1 */
+	/* This is so Copancontrol will return something sane */
+	if (ctsio->io_hdr.nexus.targ_port!=0 &&
+	    ctsio->io_hdr.nexus.targ_port!=8)
+		desc1->identifier[7] += ctsio->io_hdr.nexus.targ_port-1;
+	else
+		desc1->identifier[7] += ctsio->io_hdr.nexus.targ_port;
+#endif
+
+	be64enc(desc1->identifier, fe->wwpn);
+
+	/*
+	 * desc2 is for the Relative Target Port(type 4h) identifier
+	 */
+	desc2->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT
+	                 | SVPD_ID_TYPE_RELTARG;
+	desc2->length = 4;
+//#if 0
+	/* NOTE: if the port is 0 or 8 we don't want to subtract 1 */
+	/* This is so Copancontrol will return something sane */
+	if (ctsio->io_hdr.nexus.targ_port!=0 &&
+	    ctsio->io_hdr.nexus.targ_port!=8)
+		desc2->identifier[3] = ctsio->io_hdr.nexus.targ_port - 1;
+	else
+	        desc2->identifier[3] = ctsio->io_hdr.nexus.targ_port;
+//#endif
+
+	/*
+	 * desc3 is for the Target Port Group(type 5h) identifier
+	 */
+	desc3->id_type = SVPD_ID_PIV | SVPD_ID_ASSOC_PORT
+	                 | SVPD_ID_TYPE_TPORTGRP;
+	desc3->length = 4;
+	if (ctsio->io_hdr.nexus.targ_port < CTL_MAX_PORTS || ctl_is_single)
+		desc3->identifier[3] = 1;
+	else
+		desc3->identifier[3] = 2;
+
+#ifdef CTL_USE_BACKEND_SN
+	/*
+	 * If we've actually got a backend, copy the device id from the
+	 * per-LUN data.  Otherwise, set it to all spaces.
+	 */
+	if (lun != NULL) {
+		/*
+		 * Copy the backend's LUN ID.
+		 */
+		strncpy((char *)t10id->vendor_spec_id,
+			(char *)lun->be_lun->device_id, CTL_DEVID_LEN);
+	} else {
+		/*
+		 * No backend, set this to spaces.
+		 */
+		memset(t10id->vendor_spec_id, 0x20, CTL_DEVID_LEN);
+	}
+#else
+	snprintf(tmpstr, sizeof(tmpstr), "MYDEVICEIDIS%4d",
+		 (lun != NULL) ?  (int)lun->lun : 0);
+	strncpy(t10id->vendor_spec_id, tmpstr, ctl_min(CTL_DEVID_LEN,
+		sizeof(tmpstr)));
+#endif
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+
+	ctsio->be_move_done = ctl_config_move_done;
+	ctl_datamove((union ctl_io *)ctsio);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+static int
+ctl_inquiry_evpd(struct ctl_scsiio *ctsio)
+{
+	struct scsi_inquiry *cdb;
+	int alloc_len, retval;
+
+	cdb = (struct scsi_inquiry *)ctsio->cdb;
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	alloc_len = scsi_2btoul(cdb->length);
+
+	switch (cdb->page_code) {
+	case SVPD_SUPPORTED_PAGES:
+		retval = ctl_inquiry_evpd_supported(ctsio, alloc_len);
+		break;
+	case SVPD_UNIT_SERIAL_NUMBER:
+		retval = ctl_inquiry_evpd_serial(ctsio, alloc_len);
+		break;
+	case SVPD_DEVICE_ID:
+		retval = ctl_inquiry_evpd_devid(ctsio, alloc_len);
+		break;
+	default:
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 2,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done((union ctl_io *)ctsio);
+		retval = CTL_RETVAL_COMPLETE;
+		break;
+	}
+
+	return (retval);
+}
+
+static int
+ctl_inquiry_std(struct ctl_scsiio *ctsio)
+{
+	struct scsi_inquiry_data *inq_ptr;
+	struct scsi_inquiry *cdb;
+	struct ctl_softc *ctl_softc;
+	struct ctl_lun *lun;
+	uint32_t alloc_len;
+	int is_fc;
+
+	ctl_softc = control_softc;
+
+	/*
+	 * Figure out whether we're talking to a Fibre Channel port or not.
+	 * We treat the ioctl front end, and any SCSI adapters, as packetized
+	 * SCSI front ends.
+	 */
+	mtx_lock(&ctl_softc->ctl_lock);
+	if (ctl_softc->ctl_ports[ctl_port_idx(ctsio->io_hdr.nexus.targ_port)]->port_type !=
+	    CTL_PORT_FC)
+		is_fc = 0;
+	else
+		is_fc = 1;
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	lun = ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	cdb = (struct scsi_inquiry *)ctsio->cdb;
+	alloc_len = scsi_2btoul(cdb->length);
+
+	/*
+	 * We malloc the full inquiry data size here and fill it
+	 * in.  If the user only asks for less, we'll give him
+	 * that much.
+	 */
+	/* XXX KDM what malloc flags should we use here?? */
+	ctsio->kern_data_ptr = malloc(sizeof(*inq_ptr), M_CTL, M_WAITOK);
+	if (ctsio->kern_data_ptr == NULL) {
+		ctsio->io_hdr.status = CTL_SCSI_ERROR;
+		ctsio->scsi_status = SCSI_STATUS_BUSY;
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	inq_ptr = (struct scsi_inquiry_data *)ctsio->kern_data_ptr;
+	ctsio->kern_sg_entries = 0;
+	ctsio->kern_data_resid = 0;
+	ctsio->kern_rel_offset = 0;
+
+	if (sizeof(*inq_ptr) < alloc_len) {
+		ctsio->residual = alloc_len - sizeof(*inq_ptr);
+		ctsio->kern_data_len = sizeof(*inq_ptr);
+		ctsio->kern_total_len = sizeof(*inq_ptr);
+	} else {
+		ctsio->residual = 0;
+		ctsio->kern_data_len = alloc_len;
+		ctsio->kern_total_len = alloc_len;
+	}
+
+	memset(inq_ptr, 0, sizeof(*inq_ptr));
+
+	/*
+	 * The control device is always connected.  The disk device, on the
+	 * other hand, may not be online all the time.  If we don't have a
+	 * LUN mapping, we'll just say it's offline.
+	 */
+	if (lun != NULL)
+		inq_ptr->device = (SID_QUAL_LU_CONNECTED << 5) |
+				  lun->be_lun->lun_type;
+	else
+		inq_ptr->device = (SID_QUAL_LU_OFFLINE << 5) | T_DIRECT;
+
+	/* RMB in byte 2 is 0 */
+	inq_ptr->version = SCSI_REV_SPC3;
+
+	/*
+	 * According to SAM-3, even if a device only supports a single
+	 * level of LUN addressing, it should still set the HISUP bit:
+	 *
+	 * 4.9.1 Logical unit numbers overview
+	 *
+	 * All logical unit number formats described in this standard are
+	 * hierarchical in structure even when only a single level in that
+	 * hierarchy is used. The HISUP bit shall be set to one in the
+	 * standard INQUIRY data (see SPC-2) when any logical unit number
+	 * format described in this standard is used.  Non-hierarchical
+	 * formats are outside the scope of this standard.
+	 *
+	 * Therefore we set the HiSup bit here.
+	 *
+	 * The reponse format is 2, per SPC-3.
+	 */
+	inq_ptr->response_format = SID_HiSup | 2;
+
+	inq_ptr->additional_length = sizeof(*inq_ptr) - 4;
+	CTL_DEBUG_PRINT(("additional_length = %d\n",
+			 inq_ptr->additional_length));
+
+	inq_ptr->spc3_flags = SPC3_SID_TPGS_IMPLICIT;
+	/* 16 bit addressing */
+	if (is_fc == 0)
+		inq_ptr->spc2_flags = SPC2_SID_ADDR16;
+	/* XXX set the SID_MultiP bit here if we're actually going to
+	   respond on multiple ports */
+	inq_ptr->spc2_flags |= SPC2_SID_MultiP;
+
+	/* 16 bit data bus, synchronous transfers */
+	/* XXX these flags don't apply for FC */
+	if (is_fc == 0)
+		inq_ptr->flags = SID_WBus16 | SID_Sync;
+	/*
+	 * XXX KDM do we want to support tagged queueing on the control
+	 * device at all?
+	 */
+	if ((lun == NULL)
+	 || (lun->be_lun->lun_type != T_PROCESSOR))
+		inq_ptr->flags |= SID_CmdQue;
+	/*
+	 * Per SPC-3, unused bytes in ASCII strings are filled with spaces.
+	 * We have 8 bytes for the vendor name, and 16 bytes for the device
+	 * name and 4 bytes for the revision.
+	 */
+	strncpy(inq_ptr->vendor, CTL_VENDOR, sizeof(inq_ptr->vendor));
+	if (lun == NULL) {
+		strcpy(inq_ptr->product, CTL_DIRECT_PRODUCT);
+	} else {
+		switch (lun->be_lun->lun_type) {
+		case T_DIRECT:
+			strcpy(inq_ptr->product, CTL_DIRECT_PRODUCT);
+			break;
+		case T_PROCESSOR:
+			strcpy(inq_ptr->product, CTL_PROCESSOR_PRODUCT);
+			break;
+		default:
+			strcpy(inq_ptr->product, CTL_UNKNOWN_PRODUCT);
+			break;
+		}
+	}
+
+	/*
+	 * XXX make this a macro somewhere so it automatically gets
+	 * incremented when we make changes.
+	 */
+	strncpy(inq_ptr->revision, "0001", sizeof(inq_ptr->revision));
+
+	/*
+	 * For parallel SCSI, we support double transition and single
+	 * transition clocking.  We also support QAS (Quick Arbitration
+	 * and Selection) and Information Unit transfers on both the
+	 * control and array devices.
+	 */
+	if (is_fc == 0)
+		inq_ptr->spi3data = SID_SPI_CLOCK_DT_ST | SID_SPI_QAS |
+				    SID_SPI_IUS;
+
+	/* SAM-3 */
+	scsi_ulto2b(0x0060, inq_ptr->version1);
+	/* SPC-3 (no version claimed) XXX should we claim a version? */
+	scsi_ulto2b(0x0300, inq_ptr->version2);
+	if (is_fc) {
+		/* FCP-2 ANSI INCITS.350:2003 */
+		scsi_ulto2b(0x0917, inq_ptr->version3);
+	} else {
+		/* SPI-4 ANSI INCITS.362:200x */
+		scsi_ulto2b(0x0B56, inq_ptr->version3);
+	}
+
+	if (lun == NULL) {
+		/* SBC-2 (no version claimed) XXX should we claim a version? */
+		scsi_ulto2b(0x0320, inq_ptr->version4);
+	} else {
+		switch (lun->be_lun->lun_type) {
+		case T_DIRECT:
+			/*
+			 * SBC-2 (no version claimed) XXX should we claim a
+			 * version?
+			 */
+			scsi_ulto2b(0x0320, inq_ptr->version4);
+			break;
+		case T_PROCESSOR:
+		default:
+			break;
+		}
+	}
+	sprintf((char *)inq_ptr->vendor_specific1, "Copyright (C) 2004, COPAN "
+		"Systems, Inc.  All Rights Reserved.");
+
+	ctsio->scsi_status = SCSI_STATUS_OK;
+	if (ctsio->kern_data_len > 0) {
+		ctsio->be_move_done = ctl_config_move_done;
+		ctl_datamove((union ctl_io *)ctsio);
+	} else {
+		ctsio->io_hdr.status = CTL_SUCCESS;
+		ctl_done((union ctl_io *)ctsio);
+	}
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+int
+ctl_inquiry(struct ctl_scsiio *ctsio)
+{
+	struct scsi_inquiry *cdb;
+	int retval;
+
+	cdb = (struct scsi_inquiry *)ctsio->cdb;
+
+	retval = 0;
+
+	CTL_DEBUG_PRINT(("ctl_inquiry\n"));
+
+	/*
+	 * Right now, we don't support the CmdDt inquiry information.
+	 * This would be nice to support in the future.  When we do
+	 * support it, we should change this test so that it checks to make
+	 * sure SI_EVPD and SI_CMDDT aren't both set at the same time.
+	 */
+#ifdef notyet
+	if (((cdb->byte2 & SI_EVPD)
+	 && (cdb->byte2 & SI_CMDDT)))
+#endif
+	if (cdb->byte2 & SI_CMDDT) {
+		/*
+		 * Point to the SI_CMDDT bit.  We might change this
+		 * when we support SI_CMDDT, but since both bits would be
+		 * "wrong", this should probably just stay as-is then.
+		 */
+		ctl_set_invalid_field(ctsio,
+				      /*sks_valid*/ 1,
+				      /*command*/ 1,
+				      /*field*/ 1,
+				      /*bit_valid*/ 1,
+				      /*bit*/ 1);
+		ctl_done((union ctl_io *)ctsio);
+		return (CTL_RETVAL_COMPLETE);
+	}
+	if (cdb->byte2 & SI_EVPD)
+		retval = ctl_inquiry_evpd(ctsio);
+#ifdef notyet
+	else if (cdb->byte2 & SI_CMDDT)
+		retval = ctl_inquiry_cmddt(ctsio);
+#endif
+	else
+		retval = ctl_inquiry_std(ctsio);
+
+	return (retval);
+}
+
+/*
+ * For known CDB types, parse the LBA and length.
+ */
+static int
+ctl_get_lba_len(union ctl_io *io, uint64_t *lba, uint32_t *len)
+{
+	if (io->io_hdr.io_type != CTL_IO_SCSI)
+		return (1);
+
+	switch (io->scsiio.cdb[0]) {
+	case READ_6:
+	case WRITE_6: {
+		struct scsi_rw_6 *cdb;
+
+		cdb = (struct scsi_rw_6 *)io->scsiio.cdb;
+
+		*lba = scsi_3btoul(cdb->addr);
+		/* only 5 bits are valid in the most significant address byte */
+		*lba &= 0x1fffff;
+		*len = cdb->length;
+		break;
+	}
+	case READ_10:
+	case WRITE_10: {
+		struct scsi_rw_10 *cdb;
+
+		cdb = (struct scsi_rw_10 *)io->scsiio.cdb;
+
+		*lba = scsi_4btoul(cdb->addr);
+		*len = scsi_2btoul(cdb->length);
+		break;
+	}
+	case WRITE_VERIFY_10: {
+		struct scsi_write_verify_10 *cdb;
+
+		cdb = (struct scsi_write_verify_10 *)io->scsiio.cdb;
+
+		*lba = scsi_4btoul(cdb->addr);
+		*len = scsi_2btoul(cdb->length);
+		break;
+	}
+	case READ_12:
+	case WRITE_12: {
+		struct scsi_rw_12 *cdb;
+
+		cdb = (struct scsi_rw_12 *)io->scsiio.cdb;
+
+		*lba = scsi_4btoul(cdb->addr);
+		*len = scsi_4btoul(cdb->length);
+		break;
+	}
+	case WRITE_VERIFY_12: {
+		struct scsi_write_verify_12 *cdb;
+
+		cdb = (struct scsi_write_verify_12 *)io->scsiio.cdb;
+
+		*lba = scsi_4btoul(cdb->addr);
+		*len = scsi_4btoul(cdb->length);
+		break;
+	}
+	case READ_16:
+	case WRITE_16: {
+		struct scsi_rw_16 *cdb;
+
+		cdb = (struct scsi_rw_16 *)io->scsiio.cdb;
+
+		*lba = scsi_8btou64(cdb->addr);
+		*len = scsi_4btoul(cdb->length);
+		break;
+	}
+	case WRITE_VERIFY_16: {
+		struct scsi_write_verify_16 *cdb;
+
+		cdb = (struct scsi_write_verify_16 *)io->scsiio.cdb;
+
+		
+		*lba = scsi_8btou64(cdb->addr);
+		*len = scsi_4btoul(cdb->length);
+		break;
+	}
+	default:
+		return (1);
+		break; /* NOTREACHED */
+	}
+
+	return (0);
+}
+
+static ctl_action
+ctl_extent_check_lba(uint64_t lba1, uint32_t len1, uint64_t lba2, uint32_t len2)
+{
+	uint64_t endlba1, endlba2;
+
+	endlba1 = lba1 + len1 - 1;
+	endlba2 = lba2 + len2 - 1;
+
+	if ((endlba1 < lba2)
+	 || (endlba2 < lba1))
+		return (CTL_ACTION_PASS);
+	else
+		return (CTL_ACTION_BLOCK);
+}
+
+static ctl_action
+ctl_extent_check(union ctl_io *io1, union ctl_io *io2)
+{
+	uint64_t lba1, lba2;
+	uint32_t len1, len2;
+	int retval;
+
+	retval = ctl_get_lba_len(io1, &lba1, &len1);
+	if (retval != 0)
+		return (CTL_ACTION_ERROR);
+
+	retval = ctl_get_lba_len(io2, &lba2, &len2);
+	if (retval != 0)
+		return (CTL_ACTION_ERROR);
+
+	return (ctl_extent_check_lba(lba1, len1, lba2, len2));
+}
+
+static ctl_action
+ctl_check_for_blockage(union ctl_io *pending_io, union ctl_io *ooa_io)
+{
+	struct ctl_cmd_entry *pending_entry, *ooa_entry;
+	ctl_serialize_action *serialize_row;
+
+	/*
+	 * The initiator attempted multiple untagged commands at the same
+	 * time.  Can't do that.
+	 */
+	if ((pending_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
+	 && (ooa_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
+	 && ((pending_io->io_hdr.nexus.targ_port ==
+	      ooa_io->io_hdr.nexus.targ_port)
+	  && (pending_io->io_hdr.nexus.initid.id ==
+	      ooa_io->io_hdr.nexus.initid.id))
+	 && ((ooa_io->io_hdr.flags & CTL_FLAG_ABORT) == 0))
+		return (CTL_ACTION_OVERLAP);
+
+	/*
+	 * The initiator attempted to send multiple tagged commands with
+	 * the same ID.  (It's fine if different initiators have the same
+	 * tag ID.)
+	 *
+	 * Even if all of those conditions are true, we don't kill the I/O
+	 * if the command ahead of us has been aborted.  We won't end up
+	 * sending it to the FETD, and it's perfectly legal to resend a
+	 * command with the same tag number as long as the previous
+	 * instance of this tag number has been aborted somehow.
+	 */
+	if ((pending_io->scsiio.tag_type != CTL_TAG_UNTAGGED)
+	 && (ooa_io->scsiio.tag_type != CTL_TAG_UNTAGGED)
+	 && (pending_io->scsiio.tag_num == ooa_io->scsiio.tag_num)
+	 && ((pending_io->io_hdr.nexus.targ_port ==
+	      ooa_io->io_hdr.nexus.targ_port)
+	  && (pending_io->io_hdr.nexus.initid.id ==
+	      ooa_io->io_hdr.nexus.initid.id))
+	 && ((ooa_io->io_hdr.flags & CTL_FLAG_ABORT) == 0))
+		return (CTL_ACTION_OVERLAP_TAG);
+
+	/*
+	 * If we get a head of queue tag, SAM-3 says that we should
+	 * immediately execute it.
+	 *
+	 * What happens if this command would normally block for some other
+	 * reason?  e.g. a request sense with a head of queue tag
+	 * immediately after a write.  Normally that would block, but this
+	 * will result in its getting executed immediately...
+	 *
+	 * We currently return "pass" instead of "skip", so we'll end up
+	 * going through the rest of the queue to check for overlapped tags.
+	 *
+	 * XXX KDM check for other types of blockage first??
+	 */
+	if (pending_io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE)
+		return (CTL_ACTION_PASS);
+
+	/*
+	 * Ordered tags have to block until all items ahead of them
+	 * have completed.  If we get called with an ordered tag, we always
+	 * block, if something else is ahead of us in the queue.
+	 */
+	if (pending_io->scsiio.tag_type == CTL_TAG_ORDERED)
+		return (CTL_ACTION_BLOCK);
+
+	/*
+	 * Simple tags get blocked until all head of queue and ordered tags
+	 * ahead of them have completed.  I'm lumping untagged commands in
+	 * with simple tags here.  XXX KDM is that the right thing to do?
+	 */
+	if (((pending_io->scsiio.tag_type == CTL_TAG_UNTAGGED)
+	  || (pending_io->scsiio.tag_type == CTL_TAG_SIMPLE))
+	 && ((ooa_io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE)
+	  || (ooa_io->scsiio.tag_type == CTL_TAG_ORDERED)))
+		return (CTL_ACTION_BLOCK);
+
+	pending_entry = &ctl_cmd_table[pending_io->scsiio.cdb[0]];
+	ooa_entry = &ctl_cmd_table[ooa_io->scsiio.cdb[0]];
+
+	serialize_row = ctl_serialize_table[ooa_entry->seridx];
+
+	switch (serialize_row[pending_entry->seridx]) {
+	case CTL_SER_BLOCK:
+		return (CTL_ACTION_BLOCK);
+		break; /* NOTREACHED */
+	case CTL_SER_EXTENT:
+		return (ctl_extent_check(pending_io, ooa_io));
+		break; /* NOTREACHED */
+	case CTL_SER_PASS:
+		return (CTL_ACTION_PASS);
+		break; /* NOTREACHED */
+	case CTL_SER_SKIP:
+		return (CTL_ACTION_SKIP);
+		break;
+	default:
+		panic("invalid serialization value %d",
+		      serialize_row[pending_entry->seridx]);
+		break; /* NOTREACHED */
+	}
+
+	return (CTL_ACTION_ERROR);
+}
+
+/*
+ * Check for blockage or overlaps against the OOA (Order Of Arrival) queue.
+ * Assumptions:
+ * - caller holds ctl_lock
+ * - pending_io is generally either incoming, or on the blocked queue
+ * - starting I/O is the I/O we want to start the check with.
+ */
+static ctl_action
+ctl_check_ooa(struct ctl_lun *lun, union ctl_io *pending_io,
+	      union ctl_io *starting_io)
+{
+	union ctl_io *ooa_io;
+	ctl_action action;
+
+	/*
+	 * Run back along the OOA queue, starting with the current
+	 * blocked I/O and going through every I/O before it on the
+	 * queue.  If starting_io is NULL, we'll just end up returning
+	 * CTL_ACTION_PASS.
+	 */
+	for (ooa_io = starting_io; ooa_io != NULL;
+	     ooa_io = (union ctl_io *)TAILQ_PREV(&ooa_io->io_hdr, ctl_ooaq,
+	     ooa_links)){
+
+		/*
+		 * This routine just checks to see whether
+		 * cur_blocked is blocked by ooa_io, which is ahead
+		 * of it in the queue.  It doesn't queue/dequeue
+		 * cur_blocked.
+		 */
+		action = ctl_check_for_blockage(pending_io, ooa_io);
+		switch (action) {
+		case CTL_ACTION_BLOCK:
+		case CTL_ACTION_OVERLAP:
+		case CTL_ACTION_OVERLAP_TAG:
+		case CTL_ACTION_SKIP:
+		case CTL_ACTION_ERROR:
+			return (action);
+			break; /* NOTREACHED */
+		case CTL_ACTION_PASS:
+			break;
+		default:
+			panic("invalid action %d", action);
+			break;  /* NOTREACHED */
+		}
+	}
+
+	return (CTL_ACTION_PASS);
+}
+
+/*
+ * Assumptions:
+ * - An I/O has just completed, and has been removed from the per-LUN OOA
+ *   queue, so some items on the blocked queue may now be unblocked.
+ * - The caller holds ctl_softc->ctl_lock
+ */
+static int
+ctl_check_blocked(struct ctl_lun *lun)
+{
+	union ctl_io *cur_blocked, *next_blocked;
+
+	/*
+	 * Run forward from the head of the blocked queue, checking each
+	 * entry against the I/Os prior to it on the OOA queue to see if
+	 * there is still any blockage.
+	 *
+	 * We cannot use the TAILQ_FOREACH() macro, because it can't deal
+	 * with our removing a variable on it while it is traversing the
+	 * list.
+	 */
+	for (cur_blocked = (union ctl_io *)TAILQ_FIRST(&lun->blocked_queue);
+	     cur_blocked != NULL; cur_blocked = next_blocked) {
+		union ctl_io *prev_ooa;
+		ctl_action action;
+
+		next_blocked = (union ctl_io *)TAILQ_NEXT(&cur_blocked->io_hdr,
+							  blocked_links);
+
+		prev_ooa = (union ctl_io *)TAILQ_PREV(&cur_blocked->io_hdr,
+						      ctl_ooaq, ooa_links);
+
+		/*
+		 * If cur_blocked happens to be the first item in the OOA
+		 * queue now, prev_ooa will be NULL, and the action
+		 * returned will just be CTL_ACTION_PASS.
+		 */
+		action = ctl_check_ooa(lun, cur_blocked, prev_ooa);
+
+		switch (action) {
+		case CTL_ACTION_BLOCK:
+			/* Nothing to do here, still blocked */
+			break;
+		case CTL_ACTION_OVERLAP:
+		case CTL_ACTION_OVERLAP_TAG:
+			/*
+			 * This shouldn't happen!  In theory we've already
+			 * checked this command for overlap...
+			 */
+			break;
+		case CTL_ACTION_PASS:
+		case CTL_ACTION_SKIP: {
+			struct ctl_softc *softc;
+			struct ctl_cmd_entry *entry;
+			uint32_t initidx;
+			uint8_t opcode;
+			int isc_retval;
+
+			/*
+			 * The skip case shouldn't happen, this transaction
+			 * should have never made it onto the blocked queue.
+			 */
+			/*
+			 * This I/O is no longer blocked, we can remove it
+			 * from the blocked queue.  Since this is a TAILQ
+			 * (doubly linked list), we can do O(1) removals
+			 * from any place on the list.
+			 */
+			TAILQ_REMOVE(&lun->blocked_queue, &cur_blocked->io_hdr,
+				     blocked_links);
+			cur_blocked->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
+
+			if (cur_blocked->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC){
+				/*
+				 * Need to send IO back to original side to
+				 * run
+				 */
+				union ctl_ha_msg msg_info;
+
+				msg_info.hdr.original_sc =
+					cur_blocked->io_hdr.original_sc;
+				msg_info.hdr.serializing_sc = cur_blocked;
+				msg_info.hdr.msg_type = CTL_MSG_R2R;
+				if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+				     &msg_info, sizeof(msg_info), 0)) >
+				     CTL_HA_STATUS_SUCCESS) {
+					printf("CTL:Check Blocked error from "
+					       "ctl_ha_msg_send %d\n",
+					       isc_retval);
+				}
+				break;
+			}
+			opcode = cur_blocked->scsiio.cdb[0];
+			entry = &ctl_cmd_table[opcode];
+			softc = control_softc;
+
+			initidx = ctl_get_initindex(&cur_blocked->io_hdr.nexus);
+
+			/*
+			 * Check this I/O for LUN state changes that may
+			 * have happened while this command was blocked.
+			 * The LUN state may have been changed by a command
+			 * ahead of us in the queue, so we need to re-check
+			 * for any states that can be caused by SCSI
+			 * commands.
+			 */
+			if (ctl_scsiio_lun_check(softc, lun, entry,
+						 &cur_blocked->scsiio) == 0) {
+				cur_blocked->io_hdr.flags |=
+				                      CTL_FLAG_IS_WAS_ON_RTR;
+				STAILQ_INSERT_TAIL(&lun->ctl_softc->rtr_queue,
+						   &cur_blocked->io_hdr, links);
+				/*
+				 * In the non CTL_DONE_THREAD case, we need
+				 * to wake up the work thread here.  When
+				 * we're processing completed requests from
+				 * the work thread context, we'll pop back
+				 * around and end up pulling things off the
+				 * RtR queue.  When we aren't processing
+				 * things from the work thread context,
+				 * though, we won't ever check the RtR queue.
+				 * So we need to wake up the thread to clear
+				 * things off the queue.  Otherwise this
+				 * transaction will just sit on the RtR queue
+				 * until a new I/O comes in.  (Which may or
+				 * may not happen...)
+				 */
+#ifndef CTL_DONE_THREAD
+				ctl_wakeup_thread();
+#endif
+			} else
+				ctl_done_lock(cur_blocked, /*have_lock*/ 1);
+			break;
+		}
+		default:
+			/*
+			 * This probably shouldn't happen -- we shouldn't
+			 * get CTL_ACTION_ERROR, or anything else.
+			 */
+			break;
+		}
+	}
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * This routine (with one exception) checks LUN flags that can be set by
+ * commands ahead of us in the OOA queue.  These flags have to be checked
+ * when a command initially comes in, and when we pull a command off the
+ * blocked queue and are preparing to execute it.  The reason we have to
+ * check these flags for commands on the blocked queue is that the LUN
+ * state may have been changed by a command ahead of us while we're on the
+ * blocked queue.
+ *
+ * Ordering is somewhat important with these checks, so please pay
+ * careful attention to the placement of any new checks.
+ */
+static int
+ctl_scsiio_lun_check(struct ctl_softc *ctl_softc, struct ctl_lun *lun,
+		     struct ctl_cmd_entry *entry, struct ctl_scsiio *ctsio)
+{
+	int retval;
+
+	retval = 0;
+
+	/*
+	 * If this shelf is a secondary shelf controller, we have to reject
+	 * any media access commands.
+	 */
+#if 0
+	/* No longer needed for HA */
+	if (((ctl_softc->flags & CTL_FLAG_MASTER_SHELF) == 0)
+	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_SECONDARY) == 0)) {
+		ctl_set_lun_standby(ctsio);
+		retval = 1;
+		goto bailout;
+	}
+#endif
+
+	/*
+	 * Check for a reservation conflict.  If this command isn't allowed
+	 * even on reserved LUNs, and if this initiator isn't the one who
+	 * reserved us, reject the command with a reservation conflict.
+	 */
+	if ((lun->flags & CTL_LUN_RESERVED)
+	 && ((entry->flags & CTL_CMD_FLAG_ALLOW_ON_RESV) == 0)) {
+		if ((ctsio->io_hdr.nexus.initid.id != lun->rsv_nexus.initid.id)
+		 || (ctsio->io_hdr.nexus.targ_port != lun->rsv_nexus.targ_port)
+		 || (ctsio->io_hdr.nexus.targ_target.id !=
+		     lun->rsv_nexus.targ_target.id)) {
+			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
+			ctsio->io_hdr.status = CTL_SCSI_ERROR;
+			retval = 1;
+			goto bailout;
+		}
+	}
+
+	if ( (lun->flags & CTL_LUN_PR_RESERVED)
+	 && ((entry->flags & CTL_CMD_FLAG_ALLOW_ON_PR_RESV) == 0)) {
+		uint32_t residx;
+
+		residx = ctl_get_resindex(&ctsio->io_hdr.nexus);
+		/*
+		 * if we aren't registered or it's a res holder type
+		 * reservation and this isn't the res holder then set a
+		 * conflict.
+		 * NOTE: Commands which might be allowed on write exclusive
+		 * type reservations are checked in the particular command
+		 * for a conflict. Read and SSU are the only ones.
+		 */
+		if (!lun->per_res[residx].registered
+		 || (residx != lun->pr_res_idx && lun->res_type < 4)) {
+			ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
+			ctsio->io_hdr.status = CTL_SCSI_ERROR;
+			retval = 1;
+			goto bailout;
+		}
+
+	}
+
+	if ((lun->flags & CTL_LUN_OFFLINE)
+	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_OFFLINE) == 0)) {
+		ctl_set_lun_not_ready(ctsio);
+		retval = 1;
+		goto bailout;
+	}
+
+	/*
+	 * If the LUN is stopped, see if this particular command is allowed
+	 * for a stopped lun.  Otherwise, reject it with 0x04,0x02.
+	 */
+	if ((lun->flags & CTL_LUN_STOPPED)
+	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_STOPPED) == 0)) {
+		/* "Logical unit not ready, initializing cmd. required" */
+		ctl_set_lun_stopped(ctsio);
+		retval = 1;
+		goto bailout;
+	}
+
+	if ((lun->flags & CTL_LUN_INOPERABLE)
+	 && ((entry->flags & CTL_CMD_FLAG_OK_ON_INOPERABLE) == 0)) {
+		/* "Medium format corrupted" */
+		ctl_set_medium_format_corrupted(ctsio);
+		retval = 1;
+		goto bailout;
+	}
+
+bailout:
+	return (retval);
+
+}
+
+static void
+ctl_failover_io(union ctl_io *io, int have_lock)
+{
+	ctl_set_busy(&io->scsiio);
+	ctl_done_lock(io, have_lock);
+}
+
+static void
+ctl_failover(void)
+{
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	union ctl_io *next_io, *pending_io;
+	union ctl_io *io;
+	int lun_idx;
+	int i;
+
+	ctl_softc = control_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	/*
+	 * Remove any cmds from the other SC from the rtr queue.  These
+	 * will obviously only be for LUNs for which we're the primary.
+	 * We can't send status or get/send data for these commands.
+	 * Since they haven't been executed yet, we can just remove them.
+	 * We'll either abort them or delete them below, depending on
+	 * which HA mode we're in.
+	 */
+	for (io = (union ctl_io *)STAILQ_FIRST(&ctl_softc->rtr_queue);
+	     io != NULL; io = next_io) {
+		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
+		if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
+			STAILQ_REMOVE(&ctl_softc->rtr_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+	}
+
+	for (lun_idx=0; lun_idx < ctl_softc->num_luns; lun_idx++) {
+		lun = ctl_softc->ctl_luns[lun_idx];
+		if (lun==NULL)
+			continue;
+
+		/*
+		 * Processor LUNs are primary on both sides.
+		 * XXX will this always be true?
+		 */
+		if (lun->be_lun->lun_type == T_PROCESSOR)
+			continue;
+
+		if ((lun->flags & CTL_LUN_PRIMARY_SC)
+		 && (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)) {
+			printf("FAILOVER: primary lun %d\n", lun_idx);
+		        /*
+			 * Remove all commands from the other SC. First from the
+			 * blocked queue then from the ooa queue. Once we have
+			 * removed them. Call ctl_check_blocked to see if there
+			 * is anything that can run.
+			 */
+			for (io = (union ctl_io *)TAILQ_FIRST(
+			     &lun->blocked_queue); io != NULL; io = next_io) {
+
+		        	next_io = (union ctl_io *)TAILQ_NEXT(
+				    &io->io_hdr, blocked_links);
+
+				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC) {
+					TAILQ_REMOVE(&lun->blocked_queue,
+						     &io->io_hdr,blocked_links);
+					io->io_hdr.flags &= ~CTL_FLAG_BLOCKED;
+					TAILQ_REMOVE(&lun->ooa_queue,
+						     &io->io_hdr, ooa_links);
+
+					ctl_free_io_internal(io, 1);
+				}
+			}
+
+			for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
+	     		     io != NULL; io = next_io) {
+
+		        	next_io = (union ctl_io *)TAILQ_NEXT(
+				    &io->io_hdr, ooa_links);
+
+				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC) {
+
+					TAILQ_REMOVE(&lun->ooa_queue,
+						&io->io_hdr,
+					     	ooa_links);
+
+					ctl_free_io_internal(io, 1);
+				}
+			}
+			ctl_check_blocked(lun);
+		} else if ((lun->flags & CTL_LUN_PRIMARY_SC)
+			&& (ctl_softc->ha_mode == CTL_HA_MODE_XFER)) {
+
+			printf("FAILOVER: primary lun %d\n", lun_idx);
+			/*
+			 * Abort all commands from the other SC.  We can't
+			 * send status back for them now.  These should get
+			 * cleaned up when they are completed or come out
+			 * for a datamove operation.
+			 */
+			for (io = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue);
+	     		     io != NULL; io = next_io) {
+		        	next_io = (union ctl_io *)TAILQ_NEXT(
+					&io->io_hdr, ooa_links);
+
+				if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
+					io->io_hdr.flags |= CTL_FLAG_ABORT;
+			}
+		} else if (((lun->flags & CTL_LUN_PRIMARY_SC) == 0)
+			&& (ctl_softc->ha_mode == CTL_HA_MODE_XFER)) {
+
+			printf("FAILOVER: secondary lun %d\n", lun_idx);
+
+			lun->flags |= CTL_LUN_PRIMARY_SC;
+
+			/*
+			 * We send all I/O that was sent to this controller
+			 * and redirected to the other side back with
+			 * busy status, and have the initiator retry it.
+			 * Figuring out how much data has been transferred,
+			 * etc. and picking up where we left off would be 
+			 * very tricky.
+			 *
+			 * XXX KDM need to remove I/O from the blocked
+			 * queue as well!
+			 */
+			for (pending_io = (union ctl_io *)TAILQ_FIRST(
+			     &lun->ooa_queue); pending_io != NULL;
+			     pending_io = next_io) {
+
+				next_io =  (union ctl_io *)TAILQ_NEXT(
+					&pending_io->io_hdr, ooa_links);
+
+				pending_io->io_hdr.flags &=
+					~CTL_FLAG_SENT_2OTHER_SC;
+
+				if (pending_io->io_hdr.flags &
+				    CTL_FLAG_IO_ACTIVE) {
+					pending_io->io_hdr.flags |=
+						CTL_FLAG_FAILOVER;
+				} else {
+					ctl_set_busy(&pending_io->scsiio);
+					ctl_done_lock(pending_io,
+						      /*have_lock*/1);
+				}
+			}
+
+			/*
+			 * Build Unit Attention
+			 */
+			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+				lun->pending_sense[i].ua_pending |=
+				                     CTL_UA_ASYM_ACC_CHANGE;
+			}
+		} else if (((lun->flags & CTL_LUN_PRIMARY_SC) == 0)
+			&& (ctl_softc->ha_mode == CTL_HA_MODE_SER_ONLY)) {
+			printf("FAILOVER: secondary lun %d\n", lun_idx);
+			/*
+			 * if the first io on the OOA is not on the RtR queue
+			 * add it.
+			 */
+			lun->flags |= CTL_LUN_PRIMARY_SC;
+
+			pending_io = (union ctl_io *)TAILQ_FIRST(
+			    &lun->ooa_queue);
+			if (pending_io==NULL) {
+				printf("Nothing on OOA queue\n");
+				continue;
+			}
+
+			pending_io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
+			if ((pending_io->io_hdr.flags &
+			     CTL_FLAG_IS_WAS_ON_RTR) == 0) {
+				pending_io->io_hdr.flags |=
+				    CTL_FLAG_IS_WAS_ON_RTR;
+				STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
+						   &pending_io->io_hdr, links);
+			}
+#if 0
+			else
+			{
+				printf("Tag 0x%04x is running\n",
+				      pending_io->scsiio.tag_num);
+			}
+#endif
+
+			next_io = (union ctl_io *)TAILQ_NEXT(
+			    &pending_io->io_hdr, ooa_links);
+			for (pending_io=next_io; pending_io != NULL;
+			     pending_io = next_io) {
+				pending_io->io_hdr.flags &=
+				    ~CTL_FLAG_SENT_2OTHER_SC;
+				next_io = (union ctl_io *)TAILQ_NEXT(
+					&pending_io->io_hdr, ooa_links);
+				if (pending_io->io_hdr.flags &
+				    CTL_FLAG_IS_WAS_ON_RTR) {
+#if 0
+				        printf("Tag 0x%04x is running\n",
+				      		pending_io->scsiio.tag_num);
+#endif
+					continue;
+				}
+
+				switch (ctl_check_ooa(lun, pending_io,
+			            (union ctl_io *)TAILQ_PREV(
+				    &pending_io->io_hdr, ctl_ooaq,
+				    ooa_links))) {
+
+				case CTL_ACTION_BLOCK:
+					TAILQ_INSERT_TAIL(&lun->blocked_queue,
+							  &pending_io->io_hdr,
+							  blocked_links);
+					pending_io->io_hdr.flags |=
+					    CTL_FLAG_BLOCKED;
+					break;
+				case CTL_ACTION_PASS:
+				case CTL_ACTION_SKIP:
+					pending_io->io_hdr.flags |=
+					    CTL_FLAG_IS_WAS_ON_RTR;
+					STAILQ_INSERT_TAIL(
+					    &ctl_softc->rtr_queue,
+					    &pending_io->io_hdr, links);
+					break;
+				case CTL_ACTION_OVERLAP:
+					ctl_set_overlapped_cmd(
+					    (struct ctl_scsiio *)pending_io);
+					ctl_done_lock(pending_io,
+						      /*have_lock*/ 1);
+					break;
+				case CTL_ACTION_OVERLAP_TAG:
+					ctl_set_overlapped_tag(
+					    (struct ctl_scsiio *)pending_io,
+					    pending_io->scsiio.tag_num & 0xff);
+					ctl_done_lock(pending_io,
+						      /*have_lock*/ 1);
+					break;
+				case CTL_ACTION_ERROR:
+				default:
+					ctl_set_internal_failure(
+						(struct ctl_scsiio *)pending_io,
+						0,  // sks_valid
+						0); //retry count
+					ctl_done_lock(pending_io,
+						      /*have_lock*/ 1);
+					break;
+				}
+			}
+
+			/*
+			 * Build Unit Attention
+			 */
+			for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+				lun->pending_sense[i].ua_pending |=
+				                     CTL_UA_ASYM_ACC_CHANGE;
+			}
+		} else {
+			panic("Unhandled HA mode failover, LUN flags = %#x, "
+			      "ha_mode = #%x", lun->flags, ctl_softc->ha_mode);
+		}
+	}
+	ctl_pause_rtr = 0;
+	mtx_unlock(&ctl_softc->ctl_lock);
+}
+
+static int
+ctl_scsiio_precheck(struct ctl_softc *ctl_softc, struct ctl_scsiio *ctsio)
+{
+	struct ctl_lun *lun;
+	struct ctl_cmd_entry *entry;
+	uint8_t opcode;
+	uint32_t initidx;
+	int retval;
+
+	retval = 0;
+
+	lun = NULL;
+
+	opcode = ctsio->cdb[0];
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	if ((ctsio->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
+	 && (ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun] != NULL)) {
+		lun = ctl_softc->ctl_luns[ctsio->io_hdr.nexus.targ_lun];
+		/*
+		 * If the LUN is invalid, pretend that it doesn't exist.
+		 * It will go away as soon as all pending I/O has been
+		 * completed.
+		 */
+		if (lun->flags & CTL_LUN_DISABLED) {
+			lun = NULL;
+		} else {
+			ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr = lun;
+			ctsio->io_hdr.ctl_private[CTL_PRIV_BACKEND_LUN].ptr =
+				lun->be_lun;
+			if (lun->be_lun->lun_type == T_PROCESSOR) {
+				ctsio->io_hdr.flags |= CTL_FLAG_CONTROL_DEV;
+			}
+		}
+	} else {
+		ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr = NULL;
+		ctsio->io_hdr.ctl_private[CTL_PRIV_BACKEND_LUN].ptr = NULL;
+	}
+
+	entry = &ctl_cmd_table[opcode];
+
+	ctsio->io_hdr.flags &= ~CTL_FLAG_DATA_MASK;
+	ctsio->io_hdr.flags |= entry->flags & CTL_FLAG_DATA_MASK;
+
+	/*
+	 * Check to see whether we can send this command to LUNs that don't
+	 * exist.  This should pretty much only be the case for inquiry
+	 * and request sense.  Further checks, below, really require having
+	 * a LUN, so we can't really check the command anymore.  Just put
+	 * it on the rtr queue.
+	 */
+	if (lun == NULL) {
+		if (entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
+			goto queue_rtr;
+
+		ctl_set_unsupported_lun(ctsio);
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	} else {
+		/*
+		 * Every I/O goes into the OOA queue for a particular LUN, and
+		 * stays there until completion.
+		 */
+		TAILQ_INSERT_TAIL(&lun->ooa_queue, &ctsio->io_hdr, ooa_links);
+
+		/*
+		 * Make sure we support this particular command on this LUN.
+		 * e.g., we don't support writes to the control LUN.
+		 */
+		switch (lun->be_lun->lun_type) {
+		case T_PROCESSOR:
+		 	if (((entry->flags & CTL_CMD_FLAG_OK_ON_PROC) == 0)
+			 && ((entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
+			      == 0)) {
+				ctl_set_invalid_opcode(ctsio);
+				mtx_unlock(&ctl_softc->ctl_lock);
+				ctl_done((union ctl_io *)ctsio);
+				goto bailout;
+			}
+			break;
+		case T_DIRECT:
+			if (((entry->flags & CTL_CMD_FLAG_OK_ON_SLUN) == 0)
+			 && ((entry->flags & CTL_CMD_FLAG_OK_ON_ALL_LUNS)
+			      == 0)){
+				ctl_set_invalid_opcode(ctsio);
+				mtx_unlock(&ctl_softc->ctl_lock);
+				ctl_done((union ctl_io *)ctsio);
+				goto bailout;
+			}
+			break;
+		default:
+			printf("Unsupported CTL LUN type %d\n",
+			       lun->be_lun->lun_type);
+			panic("Unsupported CTL LUN type %d\n",
+			      lun->be_lun->lun_type);
+			break; /* NOTREACHED */
+		}
+	}
+
+	initidx = ctl_get_initindex(&ctsio->io_hdr.nexus);
+
+	/*
+	 * If we've got a request sense, it'll clear the contingent
+	 * allegiance condition.  Otherwise, if we have a CA condition for
+	 * this initiator, clear it, because it sent down a command other
+	 * than request sense.
+	 */
+	if ((opcode != REQUEST_SENSE)
+	 && (ctl_is_set(lun->have_ca, initidx)))
+		ctl_clear_mask(lun->have_ca, initidx);
+
+	/*
+	 * If the command has this flag set, it handles its own unit
+	 * attention reporting, we shouldn't do anything.  Otherwise we
+	 * check for any pending unit attentions, and send them back to the
+	 * initiator.  We only do this when a command initially comes in,
+	 * not when we pull it off the blocked queue.
+	 *
+	 * According to SAM-3, section 5.3.2, the order that things get
+	 * presented back to the host is basically unit attentions caused
+	 * by some sort of reset event, busy status, reservation conflicts
+	 * or task set full, and finally any other status.
+	 *
+	 * One issue here is that some of the unit attentions we report
+	 * don't fall into the "reset" category (e.g. "reported luns data
+	 * has changed").  So reporting it here, before the reservation
+	 * check, may be technically wrong.  I guess the only thing to do
+	 * would be to check for and report the reset events here, and then
+	 * check for the other unit attention types after we check for a
+	 * reservation conflict.
+	 *
+	 * XXX KDM need to fix this
+	 */
+	if ((entry->flags & CTL_CMD_FLAG_NO_SENSE) == 0) {
+		ctl_ua_type ua_type;
+
+		ua_type = lun->pending_sense[initidx].ua_pending;
+		if (ua_type != CTL_UA_NONE) {
+			ctl_sense_format sense_format;
+
+			if (lun != NULL)
+				sense_format = (lun->flags &
+				    CTL_LUN_SENSE_DESC) ? CTL_SENSE_DESCRIPTOR :
+				    CTL_SENSE_FIXED;
+			else
+				sense_format = CTL_SENSE_FIXED;
+
+			ua_type = ctl_build_ua(ua_type, &ctsio->sense_data,
+					       sense_format);
+			if (ua_type != CTL_UA_NONE) {
+				ctsio->scsi_status = SCSI_STATUS_CHECK_COND;
+				ctsio->io_hdr.status = CTL_SCSI_ERROR |
+						       CTL_AUTOSENSE;
+				ctsio->sense_len = SSD_FULL_SIZE;
+				lun->pending_sense[initidx].ua_pending &=
+					~ua_type;
+				mtx_unlock(&ctl_softc->ctl_lock);
+				ctl_done((union ctl_io *)ctsio);
+				goto bailout;
+			}
+		}
+	}
+
+
+	if (ctl_scsiio_lun_check(ctl_softc, lun, entry, ctsio) != 0) {
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	}
+
+	/*
+	 * XXX CHD this is where we want to send IO to other side if
+	 * this LUN is secondary on this SC. We will need to make a copy
+	 * of the IO and flag the IO on this side as SENT_2OTHER and the flag
+	 * the copy we send as FROM_OTHER.
+	 * We also need to stuff the address of the original IO so we can
+	 * find it easily. Something similar will need be done on the other
+	 * side so when we are done we can find the copy.
+	 */
+	if ((lun->flags & CTL_LUN_PRIMARY_SC) == 0) {
+		union ctl_ha_msg msg_info;
+		int isc_retval;
+
+		ctsio->io_hdr.flags |= CTL_FLAG_SENT_2OTHER_SC;
+
+		msg_info.hdr.msg_type = CTL_MSG_SERIALIZE;
+		msg_info.hdr.original_sc = (union ctl_io *)ctsio;
+#if 0
+		printf("1. ctsio %p\n", ctsio);
+#endif
+		msg_info.hdr.serializing_sc = NULL;
+		msg_info.hdr.nexus = ctsio->io_hdr.nexus;
+		msg_info.scsi.tag_num = ctsio->tag_num;
+		msg_info.scsi.tag_type = ctsio->tag_type;
+		memcpy(msg_info.scsi.cdb, ctsio->cdb, CTL_MAX_CDBLEN);
+
+		ctsio->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
+
+		if ((isc_retval=ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+		    (void *)&msg_info, sizeof(msg_info), 0)) >
+		    CTL_HA_STATUS_SUCCESS) {
+			printf("CTL:precheck, ctl_ha_msg_send returned %d\n",
+			       isc_retval);
+			printf("CTL:opcode is %x\n",opcode);
+		} else {
+#if 0
+			printf("CTL:Precheck sent msg, opcode is %x\n",opcode);
+#endif
+		}
+
+		/*
+		 * XXX KDM this I/O is off the incoming queue, but hasn't
+		 * been inserted on any other queue.  We may need to come
+		 * up with a holding queue while we wait for serialization
+		 * so that we have an idea of what we're waiting for from
+		 * the other side.
+		 */
+		goto bailout_unlock;
+	}
+
+	switch (ctl_check_ooa(lun, (union ctl_io *)ctsio,
+			      (union ctl_io *)TAILQ_PREV(&ctsio->io_hdr,
+			      ctl_ooaq, ooa_links))) {
+	case CTL_ACTION_BLOCK:
+		ctsio->io_hdr.flags |= CTL_FLAG_BLOCKED;
+		TAILQ_INSERT_TAIL(&lun->blocked_queue, &ctsio->io_hdr,
+				  blocked_links);
+		goto bailout_unlock;
+		break; /* NOTREACHED */
+	case CTL_ACTION_PASS:
+	case CTL_ACTION_SKIP:
+		goto queue_rtr;
+		break; /* NOTREACHED */
+	case CTL_ACTION_OVERLAP:
+		ctl_set_overlapped_cmd(ctsio);
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+		break; /* NOTREACHED */
+	case CTL_ACTION_OVERLAP_TAG:
+		ctl_set_overlapped_tag(ctsio, ctsio->tag_num & 0xff);
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+		break; /* NOTREACHED */
+	case CTL_ACTION_ERROR:
+	default:
+		ctl_set_internal_failure(ctsio,
+					 /*sks_valid*/ 0,
+					 /*retry_count*/ 0);
+		mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+		break; /* NOTREACHED */
+	}
+
+	goto bailout_unlock;
+
+queue_rtr:
+	ctsio->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
+	STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue, &ctsio->io_hdr, links);
+
+bailout_unlock:
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+bailout:
+	return (retval);
+}
+
+static int
+ctl_scsiio(struct ctl_scsiio *ctsio)
+{
+	int retval;
+	struct ctl_cmd_entry *entry;
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	CTL_DEBUG_PRINT(("ctl_scsiio cdb[0]=%02X\n", ctsio->cdb[0]));
+
+	entry = &ctl_cmd_table[ctsio->cdb[0]];
+
+	/*
+	 * If this I/O has been aborted, just send it straight to
+	 * ctl_done() without executing it.
+	 */
+	if (ctsio->io_hdr.flags & CTL_FLAG_ABORT) {
+		ctl_done((union ctl_io *)ctsio);
+		goto bailout;
+	}
+
+	/*
+	 * All the checks should have been handled by ctl_scsiio_precheck().
+	 * We should be clear now to just execute the I/O.
+	 */
+	retval = entry->execute(ctsio);
+
+bailout:
+	return (retval);
+}
+
+/*
+ * Since we only implement one target right now, a bus reset simply resets
+ * our single target.
+ */
+static int
+ctl_bus_reset(struct ctl_softc *ctl_softc, union ctl_io *io)
+{
+	return(ctl_target_reset(ctl_softc, io, CTL_UA_BUS_RESET));
+}
+
+static int
+ctl_target_reset(struct ctl_softc *ctl_softc, union ctl_io *io,
+		 ctl_ua_type ua_type)
+{
+	struct ctl_lun *lun;
+	int retval;
+
+	if (!(io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
+		union ctl_ha_msg msg_info;
+
+		io->io_hdr.flags |= CTL_FLAG_SENT_2OTHER_SC;
+		msg_info.hdr.nexus = io->io_hdr.nexus;
+		if (ua_type==CTL_UA_TARG_RESET)
+			msg_info.task.task_action = CTL_TASK_TARGET_RESET;
+		else
+			msg_info.task.task_action = CTL_TASK_BUS_RESET;
+		msg_info.hdr.msg_type = CTL_MSG_MANAGE_TASKS;
+		msg_info.hdr.original_sc = NULL;
+		msg_info.hdr.serializing_sc = NULL;
+		if (CTL_HA_STATUS_SUCCESS != ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+		    (void *)&msg_info, sizeof(msg_info), 0)) {
+		}
+	}
+	retval = 0;
+
+	STAILQ_FOREACH(lun, &ctl_softc->lun_list, links)
+		retval += ctl_lun_reset(lun, io, ua_type);
+
+	return (retval);
+}
+
+/*
+ * The LUN should always be set.  The I/O is optional, and is used to
+ * distinguish between I/Os sent by this initiator, and by other
+ * initiators.  We set unit attention for initiators other than this one.
+ * SAM-3 is vague on this point.  It does say that a unit attention should
+ * be established for other initiators when a LUN is reset (see section
+ * 5.7.3), but it doesn't specifically say that the unit attention should
+ * be established for this particular initiator when a LUN is reset.  Here
+ * is the relevant text, from SAM-3 rev 8:
+ *
+ * 5.7.2 When a SCSI initiator port aborts its own tasks
+ *
+ * When a SCSI initiator port causes its own task(s) to be aborted, no
+ * notification that the task(s) have been aborted shall be returned to
+ * the SCSI initiator port other than the completion response for the
+ * command or task management function action that caused the task(s) to
+ * be aborted and notification(s) associated with related effects of the
+ * action (e.g., a reset unit attention condition).
+ *
+ * XXX KDM for now, we're setting unit attention for all initiators.
+ */
+static int
+ctl_lun_reset(struct ctl_lun *lun, union ctl_io *io, ctl_ua_type ua_type)
+{
+	union ctl_io *xio;
+#if 0
+	uint32_t initindex;
+#endif
+	int i;
+
+	/*
+	 * Run through the OOA queue and abort each I/O.
+	 */
+#if 0
+	TAILQ_FOREACH((struct ctl_io_hdr *)xio, &lun->ooa_queue, ooa_links) {
+#endif
+	for (xio = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); xio != NULL;
+	     xio = (union ctl_io *)TAILQ_NEXT(&xio->io_hdr, ooa_links)) {
+		xio->io_hdr.flags |= CTL_FLAG_ABORT;
+	}
+
+	/*
+	 * This version sets unit attention for every
+	 */
+#if 0
+	initindex = ctl_get_initindex(&io->io_hdr.nexus);
+	for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+		if (initindex == i)
+			continue;
+		lun->pending_sense[i].ua_pending |= ua_type;
+	}
+#endif
+
+	/*
+	 * A reset (any kind, really) clears reservations established with
+	 * RESERVE/RELEASE.  It does not clear reservations established
+	 * with PERSISTENT RESERVE OUT, but we don't support that at the
+	 * moment anyway.  See SPC-2, section 5.6.  SPC-3 doesn't address
+	 * reservations made with the RESERVE/RELEASE commands, because
+	 * those commands are obsolete in SPC-3.
+	 */
+	lun->flags &= ~CTL_LUN_RESERVED;
+
+	for (i = 0; i < CTL_MAX_INITIATORS; i++) {
+		ctl_clear_mask(lun->have_ca, i);
+		lun->pending_sense[i].ua_pending |= ua_type;
+	}
+
+	return (0);
+}
+
+static int
+ctl_abort_task(union ctl_io *io)
+{
+	union ctl_io *xio;
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+#if 0
+	struct sbuf sb;
+	char printbuf[128];
+#endif
+	int found;
+
+	ctl_softc = control_softc;
+	found = 0;
+
+	/*
+	 * Look up the LUN.
+	 */
+	if ((io->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
+	 && (ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun] != NULL))
+		lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
+	else
+		goto bailout;
+
+#if 0
+	printf("ctl_abort_task: called for lun %lld, tag %d type %d\n",
+	       lun->lun, io->taskio.tag_num, io->taskio.tag_type);
+#endif
+
+	/*
+	 * Run through the OOA queue and attempt to find the given I/O.
+	 * The target port, initiator ID, tag type and tag number have to
+	 * match the values that we got from the initiator.  If we have an
+	 * untagged command to abort, simply abort the first untagged command
+	 * we come to.  We only allow one untagged command at a time of course.
+	 */
+#if 0
+	TAILQ_FOREACH((struct ctl_io_hdr *)xio, &lun->ooa_queue, ooa_links) {
+#endif
+	for (xio = (union ctl_io *)TAILQ_FIRST(&lun->ooa_queue); xio != NULL;
+	     xio = (union ctl_io *)TAILQ_NEXT(&xio->io_hdr, ooa_links)) {
+#if 0
+		sbuf_new(&sb, printbuf, sizeof(printbuf), SBUF_FIXEDLEN);
+
+		sbuf_printf(&sb, "LUN %lld tag %d type %d%s%s%s%s: ",
+			    lun->lun, xio->scsiio.tag_num,
+			    xio->scsiio.tag_type,
+			    (xio->io_hdr.blocked_links.tqe_prev
+			    == NULL) ? "" : " BLOCKED",
+			    (xio->io_hdr.flags &
+			    CTL_FLAG_DMA_INPROG) ? " DMA" : "",
+			    (xio->io_hdr.flags &
+			    CTL_FLAG_ABORT) ? " ABORT" : ""),
+			    (xio->io_hdr.flags &
+			    CTL_FLAG_IS_WAS_ON_RTR ? " RTR" : "");
+		ctl_scsi_command_string(&xio->scsiio, NULL, &sb);
+		sbuf_finish(&sb);
+		printf("%s\n", sbuf_data(&sb));
+#endif
+
+		if ((xio->io_hdr.nexus.targ_port == io->io_hdr.nexus.targ_port)
+		 && (xio->io_hdr.nexus.initid.id ==
+		     io->io_hdr.nexus.initid.id)) {
+			/*
+			 * If the abort says that the task is untagged, the
+			 * task in the queue must be untagged.  Otherwise,
+			 * we just check to see whether the tag numbers
+			 * match.  This is because the QLogic firmware
+			 * doesn't pass back the tag type in an abort
+			 * request.
+			 */
+#if 0
+			if (((xio->scsiio.tag_type == CTL_TAG_UNTAGGED)
+			  && (io->taskio.tag_type == CTL_TAG_UNTAGGED))
+			 || (xio->scsiio.tag_num == io->taskio.tag_num)) {
+#endif
+			/*
+			 * XXX KDM we've got problems with FC, because it
+			 * doesn't send down a tag type with aborts.  So we
+			 * can only really go by the tag number...
+			 * This may cause problems with parallel SCSI.
+			 * Need to figure that out!!
+			 */
+			if (xio->scsiio.tag_num == io->taskio.tag_num) {
+				xio->io_hdr.flags |= CTL_FLAG_ABORT;
+				found = 1;
+				if ((io->io_hdr.flags &
+				     CTL_FLAG_FROM_OTHER_SC) == 0 &&
+				    !(lun->flags & CTL_LUN_PRIMARY_SC)) {
+					union ctl_ha_msg msg_info;
+
+					io->io_hdr.flags |=
+					                CTL_FLAG_SENT_2OTHER_SC;
+					msg_info.hdr.nexus = io->io_hdr.nexus;
+					msg_info.task.task_action =
+						CTL_TASK_ABORT_TASK;
+					msg_info.task.tag_num =
+						io->taskio.tag_num;
+					msg_info.task.tag_type =
+						io->taskio.tag_type;
+					msg_info.hdr.msg_type =
+						CTL_MSG_MANAGE_TASKS;
+					msg_info.hdr.original_sc = NULL;
+					msg_info.hdr.serializing_sc = NULL;
+#if 0
+					printf("Sent Abort to other side\n");
+#endif
+					if (CTL_HA_STATUS_SUCCESS !=
+					        ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+		    				(void *)&msg_info,
+						sizeof(msg_info), 0)) {
+					}
+				}
+#if 0
+				printf("ctl_abort_task: found I/O to abort\n");
+#endif
+				break;
+			}
+		}
+	}
+
+bailout:
+
+	if (found == 0) {
+		/*
+		 * This isn't really an error.  It's entirely possible for
+		 * the abort and command completion to cross on the wire.
+		 * This is more of an informative/diagnostic error.
+		 */
+#if 0
+		printf("ctl_abort_task: ABORT sent for nonexistent I/O: "
+		       "%d:%d:%d:%d tag %d type %d\n",
+		       io->io_hdr.nexus.initid.id,
+		       io->io_hdr.nexus.targ_port,
+		       io->io_hdr.nexus.targ_target.id,
+		       io->io_hdr.nexus.targ_lun, io->taskio.tag_num,
+		       io->taskio.tag_type);
+#endif
+		return (1);
+	} else
+		return (0);
+}
+
+/*
+ * Assumptions:  caller holds ctl_softc->ctl_lock
+ *
+ * This routine cannot block!  It must be callable from an interrupt
+ * handler as well as from the work thread.
+ */
+static void
+ctl_run_task_queue(struct ctl_softc *ctl_softc)
+{
+	union ctl_io *io, *next_io;
+
+	CTL_DEBUG_PRINT(("ctl_run_task_queue\n"));
+
+	for (io = (union ctl_io *)STAILQ_FIRST(&ctl_softc->task_queue);
+	     io != NULL; io = next_io) {
+		int retval;
+		const char *task_desc;
+
+		next_io = (union ctl_io *)STAILQ_NEXT(&io->io_hdr, links);
+
+		retval = 0;
+
+		switch (io->io_hdr.io_type) {
+		case CTL_IO_TASK: {
+			task_desc = ctl_scsi_task_string(&io->taskio);
+			if (task_desc != NULL) {
+#ifdef NEEDTOPORT
+				csevent_log(CSC_CTL | CSC_SHELF_SW |
+					    CTL_TASK_REPORT,
+					    csevent_LogType_Trace,
+					    csevent_Severity_Information,
+					    csevent_AlertLevel_Green,
+					    csevent_FRU_Firmware,
+					    csevent_FRU_Unknown,
+					    "CTL: received task: %s",task_desc);
+#endif
+			} else {
+#ifdef NEEDTOPORT
+				csevent_log(CSC_CTL | CSC_SHELF_SW |
+					    CTL_TASK_REPORT,
+					    csevent_LogType_Trace,
+					    csevent_Severity_Information,
+					    csevent_AlertLevel_Green,
+					    csevent_FRU_Firmware,
+					    csevent_FRU_Unknown,
+					    "CTL: received unknown task "
+					    "type: %d (%#x)",
+					    io->taskio.task_action,
+					    io->taskio.task_action);
+#endif
+			}
+			switch (io->taskio.task_action) {
+			case CTL_TASK_ABORT_TASK:
+				retval = ctl_abort_task(io);
+				break;
+			case CTL_TASK_ABORT_TASK_SET:
+				break;
+			case CTL_TASK_CLEAR_ACA:
+				break;
+			case CTL_TASK_CLEAR_TASK_SET:
+				break;
+			case CTL_TASK_LUN_RESET: {
+				struct ctl_lun *lun;
+				uint32_t targ_lun;
+				int retval;
+
+				targ_lun = io->io_hdr.nexus.targ_lun;
+
+				if ((targ_lun < CTL_MAX_LUNS)
+				 && (ctl_softc->ctl_luns[targ_lun] != NULL))
+					lun = ctl_softc->ctl_luns[targ_lun];
+				else {
+					retval = 1;
+					break;
+				}
+
+				if (!(io->io_hdr.flags &
+				    CTL_FLAG_FROM_OTHER_SC)) {
+					union ctl_ha_msg msg_info;
+
+					io->io_hdr.flags |=
+						CTL_FLAG_SENT_2OTHER_SC;
+					msg_info.hdr.msg_type =
+						CTL_MSG_MANAGE_TASKS;
+					msg_info.hdr.nexus = io->io_hdr.nexus;
+					msg_info.task.task_action =
+						CTL_TASK_LUN_RESET;
+					msg_info.hdr.original_sc = NULL;
+					msg_info.hdr.serializing_sc = NULL;
+					if (CTL_HA_STATUS_SUCCESS !=
+					    ctl_ha_msg_send(CTL_HA_CHAN_CTL,
+					    (void *)&msg_info,
+					    sizeof(msg_info), 0)) {
+					}
+				}
+
+				retval = ctl_lun_reset(lun, io,
+						       CTL_UA_LUN_RESET);
+				break;
+			}
+			case CTL_TASK_TARGET_RESET:
+				retval = ctl_target_reset(ctl_softc, io,
+							  CTL_UA_TARG_RESET);
+				break;
+			case CTL_TASK_BUS_RESET:
+				retval = ctl_bus_reset(ctl_softc, io);
+				break;
+			case CTL_TASK_PORT_LOGIN:
+				break;
+			case CTL_TASK_PORT_LOGOUT:
+				break;
+			default:
+				printf("ctl_run_task_queue: got unknown task "
+				       "management event %d\n",
+				       io->taskio.task_action);
+				break;
+			}
+			if (retval == 0)
+				io->io_hdr.status = CTL_SUCCESS;
+			else
+				io->io_hdr.status = CTL_ERROR;
+
+			STAILQ_REMOVE(&ctl_softc->task_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+			/*
+			 * This will queue this I/O to the done queue, but the
+			 * work thread won't be able to process it until we
+			 * return and the lock is released.
+			 */
+			ctl_done_lock(io, /*have_lock*/ 1);
+			break;
+		}
+		default: {
+
+			printf("%s: invalid I/O type %d msg %d cdb %x"
+			       " iptl: %ju:%d:%ju:%d tag 0x%04x\n",
+			       __func__, io->io_hdr.io_type,
+			       io->io_hdr.msg_type, io->scsiio.cdb[0],
+			       (uintmax_t)io->io_hdr.nexus.initid.id,
+			       io->io_hdr.nexus.targ_port,
+			       (uintmax_t)io->io_hdr.nexus.targ_target.id,
+			       io->io_hdr.nexus.targ_lun,
+			       (io->io_hdr.io_type == CTL_IO_TASK) ?
+			       io->taskio.tag_num : io->scsiio.tag_num);
+			STAILQ_REMOVE(&ctl_softc->task_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+			ctl_free_io_internal(io, 1);
+			break;
+		}
+		}
+	}
+
+	ctl_softc->flags &= ~CTL_FLAG_TASK_PENDING;
+}
+
+/*
+ * For HA operation.  Handle commands that come in from the other
+ * controller.
+ */
+static void
+ctl_handle_isc(union ctl_io *io)
+{
+	int free_io;
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+
+	ctl_softc = control_softc;
+
+	lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
+
+	switch (io->io_hdr.msg_type) {
+	case CTL_MSG_SERIALIZE:
+		free_io = ctl_serialize_other_sc_cmd(&io->scsiio,
+						     /*have_lock*/ 0);
+		break;
+	case CTL_MSG_R2R: {
+		uint8_t opcode;
+		struct ctl_cmd_entry *entry;
+
+		/*
+		 * This is only used in SER_ONLY mode.
+		 */
+		free_io = 0;
+		opcode = io->scsiio.cdb[0];
+		entry = &ctl_cmd_table[opcode];
+		mtx_lock(&ctl_softc->ctl_lock);
+		if (ctl_scsiio_lun_check(ctl_softc, lun,
+		    entry, (struct ctl_scsiio *)io) != 0) {
+			ctl_done_lock(io, /*have_lock*/ 1);
+			mtx_unlock(&ctl_softc->ctl_lock);
+			break;
+		}
+		io->io_hdr.flags |= CTL_FLAG_IS_WAS_ON_RTR;
+		STAILQ_INSERT_TAIL(&ctl_softc->rtr_queue,
+				   &io->io_hdr, links);
+		mtx_unlock(&ctl_softc->ctl_lock);
+		break;
+	}
+	case CTL_MSG_FINISH_IO:
+		if (ctl_softc->ha_mode == CTL_HA_MODE_XFER) {
+			free_io = 0;
+			ctl_done_lock(io, /*have_lock*/ 0);
+		} else {
+			free_io = 1;
+			mtx_lock(&ctl_softc->ctl_lock);
+			TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr,
+				     ooa_links);
+			STAILQ_REMOVE(&ctl_softc->task_queue,
+				      &io->io_hdr, ctl_io_hdr, links);
+			ctl_check_blocked(lun);
+			mtx_unlock(&ctl_softc->ctl_lock);
+		}
+		break;
+	case CTL_MSG_PERS_ACTION:
+		ctl_hndl_per_res_out_on_other_sc(
+			(union ctl_ha_msg *)&io->presio.pr_msg);
+		free_io = 1;
+		break;
+	case CTL_MSG_BAD_JUJU:
+		free_io = 0;
+		ctl_done_lock(io, /*have_lock*/ 0);
+		break;
+	case CTL_MSG_DATAMOVE:
+		/* Only used in XFER mode */
+		free_io = 0;
+		ctl_datamove_remote(io);
+		break;
+	case CTL_MSG_DATAMOVE_DONE:
+		/* Only used in XFER mode */
+		free_io = 0;
+		io->scsiio.be_move_done(io);
+		break;
+	default:
+		free_io = 1;
+		printf("%s: Invalid message type %d\n",
+		       __func__, io->io_hdr.msg_type);
+		break;
+	}
+	if (free_io)
+		ctl_free_io_internal(io, 0);
+
+}
+
+
+/*
+ * Returns the match type in the case of a match, or CTL_LUN_PAT_NONE if
+ * there is no match.
+ */
+static ctl_lun_error_pattern
+ctl_cmd_pattern_match(struct ctl_scsiio *ctsio, struct ctl_error_desc *desc)
+{
+	struct ctl_cmd_entry *entry;
+	ctl_lun_error_pattern filtered_pattern, pattern;
+	uint8_t opcode;
+
+	pattern = desc->error_pattern;
+
+	/*
+	 * XXX KDM we need more data passed into this function to match a
+	 * custom pattern, and we actually need to implement custom pattern
+	 * matching.
+	 */
+	if (pattern & CTL_LUN_PAT_CMD)
+		return (CTL_LUN_PAT_CMD);
+
+	if ((pattern & CTL_LUN_PAT_MASK) == CTL_LUN_PAT_ANY)
+		return (CTL_LUN_PAT_ANY);
+
+	opcode = ctsio->cdb[0];
+	entry = &ctl_cmd_table[opcode];
+
+	filtered_pattern = entry->pattern & pattern;
+
+	/*
+	 * If the user requested specific flags in the pattern (e.g.
+	 * CTL_LUN_PAT_RANGE), make sure the command supports all of those
+	 * flags.
+	 *
+	 * If the user did not specify any flags, it doesn't matter whether
+	 * or not the command supports the flags.
+	 */
+	if ((filtered_pattern & ~CTL_LUN_PAT_MASK) !=
+	     (pattern & ~CTL_LUN_PAT_MASK))
+		return (CTL_LUN_PAT_NONE);
+
+	/*
+	 * If the user asked for a range check, see if the requested LBA
+	 * range overlaps with this command's LBA range.
+	 */
+	if (filtered_pattern & CTL_LUN_PAT_RANGE) {
+		uint64_t lba1;
+		uint32_t len1;
+		ctl_action action;
+		int retval;
+
+		retval = ctl_get_lba_len((union ctl_io *)ctsio, &lba1, &len1);
+		if (retval != 0)
+			return (CTL_LUN_PAT_NONE);
+
+		action = ctl_extent_check_lba(lba1, len1, desc->lba_range.lba,
+					      desc->lba_range.len);
+		/*
+		 * A "pass" means that the LBA ranges don't overlap, so
+		 * this doesn't match the user's range criteria.
+		 */
+		if (action == CTL_ACTION_PASS)
+			return (CTL_LUN_PAT_NONE);
+	}
+
+	return (filtered_pattern);
+}
+
+/*
+ * Called with the CTL lock held.
+ */
+static void
+ctl_inject_error(struct ctl_lun *lun, union ctl_io *io)
+{
+	struct ctl_error_desc *desc, *desc2;
+
+	STAILQ_FOREACH_SAFE(desc, &lun->error_list, links, desc2) {
+		ctl_lun_error_pattern pattern;
+		/*
+		 * Check to see whether this particular command matches
+		 * the pattern in the descriptor.
+		 */
+		pattern = ctl_cmd_pattern_match(&io->scsiio, desc);
+		if ((pattern & CTL_LUN_PAT_MASK) == CTL_LUN_PAT_NONE)
+			continue;
+
+		switch (desc->lun_error & CTL_LUN_INJ_TYPE) {
+		case CTL_LUN_INJ_ABORTED:
+			ctl_set_aborted(&io->scsiio);
+			break;
+		case CTL_LUN_INJ_MEDIUM_ERR:
+			ctl_set_medium_error(&io->scsiio);
+			break;
+		case CTL_LUN_INJ_UA:
+			/* 29h/00h  POWER ON, RESET, OR BUS DEVICE RESET
+			 * OCCURRED */
+			ctl_set_ua(&io->scsiio, 0x29, 0x00);
+			break;
+		case CTL_LUN_INJ_CUSTOM:
+			/*
+			 * We're assuming the user knows what he is doing.
+			 * Just copy the sense information without doing
+			 * checks.
+			 */
+			bcopy(&desc->custom_sense, &io->scsiio.sense_data,
+			      ctl_min(sizeof(desc->custom_sense),
+				      sizeof(io->scsiio.sense_data)));
+			io->scsiio.scsi_status = SCSI_STATUS_CHECK_COND;
+			io->scsiio.sense_len = SSD_FULL_SIZE;
+			io->io_hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
+			break;
+		case CTL_LUN_INJ_NONE:
+		default:
+			/*
+			 * If this is an error injection type we don't know
+			 * about, clear the continuous flag (if it is set)
+			 * so it will get deleted below.
+			 */
+			desc->lun_error &= ~CTL_LUN_INJ_CONTINUOUS;
+			break;
+		}
+		/*
+		 * By default, each error injection action is a one-shot
+		 */
+		if (desc->lun_error & CTL_LUN_INJ_CONTINUOUS)
+			continue;
+
+		STAILQ_REMOVE(&lun->error_list, desc, ctl_error_desc, links);
+
+		free(desc, M_CTL);
+	}
+}
+
+#ifdef CTL_IO_DELAY
+static void
+ctl_datamove_timer_wakeup(void *arg)
+{
+	union ctl_io *io;
+
+	io = (union ctl_io *)arg;
+
+	ctl_datamove(io);
+}
+#endif /* CTL_IO_DELAY */
+
+/*
+ * Assumption:  caller does NOT hold ctl_lock
+ */
+void
+ctl_datamove(union ctl_io *io)
+{
+	void (*fe_datamove)(union ctl_io *io);
+
+	CTL_DEBUG_PRINT(("ctl_datamove\n"));
+
+#ifdef CTL_TIME_IO
+	if ((time_uptime - io->io_hdr.start_time) > ctl_time_io_secs) {
+		char str[256];
+		char path_str[64];
+		struct sbuf sb;
+
+		ctl_scsi_path_string(io, path_str, sizeof(path_str));
+		sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
+
+		sbuf_cat(&sb, path_str);
+		switch (io->io_hdr.io_type) {
+		case CTL_IO_SCSI:
+			ctl_scsi_command_string(&io->scsiio, NULL, &sb);
+			sbuf_printf(&sb, "\n");
+			sbuf_cat(&sb, path_str);
+			sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
+				    io->scsiio.tag_num, io->scsiio.tag_type);
+			break;
+		case CTL_IO_TASK:
+			sbuf_printf(&sb, "Task I/O type: %d, Tag: 0x%04x, "
+				    "Tag Type: %d\n", io->taskio.task_action,
+				    io->taskio.tag_num, io->taskio.tag_type);
+			break;
+		default:
+			printf("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
+			panic("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
+			break;
+		}
+		sbuf_cat(&sb, path_str);
+		sbuf_printf(&sb, "ctl_datamove: %jd seconds\n",
+			    (intmax_t)time_uptime - io->io_hdr.start_time);
+		sbuf_finish(&sb);
+		printf("%s", sbuf_data(&sb));
+	}
+#endif /* CTL_TIME_IO */
+
+	mtx_lock(&control_softc->ctl_lock);
+#ifdef CTL_IO_DELAY
+	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
+		struct ctl_lun *lun;
+
+		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
+	} else {
+		struct ctl_lun *lun;
+
+		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+		if ((lun != NULL)
+		 && (lun->delay_info.datamove_delay > 0)) {
+			struct callout *callout;
+
+			callout = (struct callout *)&io->io_hdr.timer_bytes;
+			callout_init(callout, /*mpsafe*/ 1);
+			io->io_hdr.flags |= CTL_FLAG_DELAY_DONE;
+			callout_reset(callout,
+				      lun->delay_info.datamove_delay * hz,
+				      ctl_datamove_timer_wakeup, io);
+			if (lun->delay_info.datamove_type ==
+			    CTL_DELAY_TYPE_ONESHOT)
+				lun->delay_info.datamove_delay = 0;
+			mtx_unlock(&control_softc->ctl_lock);
+			return;
+		}
+	}
+#endif
+	/*
+	 * If we have any pending task management commands, process them
+	 * first.  This is necessary to eliminate a race condition with the
+	 * FETD:
+	 *
+	 * - FETD submits a task management command, like an abort.
+	 * - Back end calls fe_datamove() to move the data for the aborted
+	 *   command.  The FETD can't really accept it, but if it did, it
+	 *   would end up transmitting data for a command that the initiator
+	 *   told us to abort.
+	 *
+	 * We close the race by processing all pending task management
+	 * commands here (we can't block!), and then check this I/O to see
+	 * if it has been aborted.  If so, return it to the back end with
+	 * bad status, so the back end can say return an error to the back end
+	 * and then when the back end returns an error, we can return the
+	 * aborted command to the FETD, so it can clean up its resources.
+	 */
+	if (control_softc->flags & CTL_FLAG_TASK_PENDING)
+		ctl_run_task_queue(control_softc);
+
+	/*
+	 * This command has been aborted.  Set the port status, so we fail
+	 * the data move.
+	 */
+	if (io->io_hdr.flags & CTL_FLAG_ABORT) {
+		printf("ctl_datamove: tag 0x%04x on (%ju:%d:%ju:%d) aborted\n",
+		       io->scsiio.tag_num,(uintmax_t)io->io_hdr.nexus.initid.id,
+		       io->io_hdr.nexus.targ_port,
+		       (uintmax_t)io->io_hdr.nexus.targ_target.id,
+		       io->io_hdr.nexus.targ_lun);
+		io->io_hdr.status = CTL_CMD_ABORTED;
+		io->io_hdr.port_status = 31337;
+		mtx_unlock(&control_softc->ctl_lock);
+		/*
+		 * Note that the backend, in this case, will get the
+		 * callback in its context.  In other cases it may get
+		 * called in the frontend's interrupt thread context.
+		 */
+		io->scsiio.be_move_done(io);
+		return;
+	}
+
+	/*
+	 * If we're in XFER mode and this I/O is from the other shelf
+	 * controller, we need to send the DMA to the other side to
+	 * actually transfer the data to/from the host.  In serialize only
+	 * mode the transfer happens below CTL and ctl_datamove() is only
+	 * called on the machine that originally received the I/O.
+	 */
+	if ((control_softc->ha_mode == CTL_HA_MODE_XFER)
+	 && (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
+		union ctl_ha_msg msg;
+		uint32_t sg_entries_sent;
+		int do_sg_copy;
+		int i;
+
+		memset(&msg, 0, sizeof(msg));
+		msg.hdr.msg_type = CTL_MSG_DATAMOVE;
+		msg.hdr.original_sc = io->io_hdr.original_sc;
+		msg.hdr.serializing_sc = io;
+		msg.hdr.nexus = io->io_hdr.nexus;
+		msg.dt.flags = io->io_hdr.flags;
+		/*
+		 * We convert everything into a S/G list here.  We can't
+		 * pass by reference, only by value between controllers.
+		 * So we can't pass a pointer to the S/G list, only as many
+		 * S/G entries as we can fit in here.  If it's possible for
+		 * us to get more than CTL_HA_MAX_SG_ENTRIES S/G entries,
+		 * then we need to break this up into multiple transfers.
+		 */
+		if (io->scsiio.kern_sg_entries == 0) {
+			msg.dt.kern_sg_entries = 1;
+			/*
+			 * If this is in cached memory, flush the cache
+			 * before we send the DMA request to the other
+			 * controller.  We want to do this in either the
+			 * read or the write case.  The read case is
+			 * straightforward.  In the write case, we want to
+			 * make sure nothing is in the local cache that
+			 * could overwrite the DMAed data.
+			 */
+			if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
+				/*
+				 * XXX KDM use bus_dmamap_sync() here.
+				 */
+			}
+
+			/*
+			 * Convert to a physical address if this is a
+			 * virtual address.
+			 */
+			if (io->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
+				msg.dt.sg_list[0].addr =
+					io->scsiio.kern_data_ptr;
+			} else {
+				/*
+				 * XXX KDM use busdma here!
+				 */
+#if 0
+				msg.dt.sg_list[0].addr = (void *)
+					vtophys(io->scsiio.kern_data_ptr);
+#endif
+			}
+
+			msg.dt.sg_list[0].len = io->scsiio.kern_data_len;
+			do_sg_copy = 0;
+		} else {
+			struct ctl_sg_entry *sgl;
+
+			do_sg_copy = 1;
+			msg.dt.kern_sg_entries = io->scsiio.kern_sg_entries;
+			sgl = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
+			if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
+				/*
+				 * XXX KDM use bus_dmamap_sync() here.
+				 */
+			}
+		}
+
+		msg.dt.kern_data_len = io->scsiio.kern_data_len;
+		msg.dt.kern_total_len = io->scsiio.kern_total_len;
+		msg.dt.kern_data_resid = io->scsiio.kern_data_resid;
+		msg.dt.kern_rel_offset = io->scsiio.kern_rel_offset;
+		msg.dt.sg_sequence = 0;
+
+		/*
+		 * Loop until we've sent all of the S/G entries.  On the
+		 * other end, we'll recompose these S/G entries into one
+		 * contiguous list before passing it to the
+		 */
+		for (sg_entries_sent = 0; sg_entries_sent <
+		     msg.dt.kern_sg_entries; msg.dt.sg_sequence++) {
+			msg.dt.cur_sg_entries = ctl_min((sizeof(msg.dt.sg_list)/
+				sizeof(msg.dt.sg_list[0])),
+				msg.dt.kern_sg_entries - sg_entries_sent);
+
+			if (do_sg_copy != 0) {
+				struct ctl_sg_entry *sgl;
+				int j;
+
+				sgl = (struct ctl_sg_entry *)
+					io->scsiio.kern_data_ptr;
+				/*
+				 * If this is in cached memory, flush the cache
+				 * before we send the DMA request to the other
+				 * controller.  We want to do this in either
+				 * the * read or the write case.  The read
+				 * case is straightforward.  In the write
+				 * case, we want to make sure nothing is
+				 * in the local cache that could overwrite
+				 * the DMAed data.
+				 */
+
+				for (i = sg_entries_sent, j = 0;
+				     i < msg.dt.cur_sg_entries; i++, j++) {
+					if ((io->io_hdr.flags &
+					     CTL_FLAG_NO_DATASYNC) == 0) {
+						/*
+						 * XXX KDM use bus_dmamap_sync()
+						 */
+					}
+					if ((io->io_hdr.flags &
+					     CTL_FLAG_BUS_ADDR) == 0) {
+						/*
+						 * XXX KDM use busdma.
+						 */
+#if 0
+						msg.dt.sg_list[j].addr =(void *)
+						       vtophys(sgl[i].addr);
+#endif
+					} else {
+						msg.dt.sg_list[j].addr =
+							sgl[i].addr;
+					}
+					msg.dt.sg_list[j].len = sgl[i].len;
+				}
+			}
+
+			sg_entries_sent += msg.dt.cur_sg_entries;
+			if (sg_entries_sent >= msg.dt.kern_sg_entries)
+				msg.dt.sg_last = 1;
+			else
+				msg.dt.sg_last = 0;
+
+			/*
+			 * XXX KDM drop and reacquire the lock here?
+			 */
+			if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg,
+			    sizeof(msg), 0) > CTL_HA_STATUS_SUCCESS) {
+				/*
+				 * XXX do something here.
+				 */
+			}
+
+			msg.dt.sent_sg_entries = sg_entries_sent;
+		}
+		io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
+		if (io->io_hdr.flags & CTL_FLAG_FAILOVER)
+			ctl_failover_io(io, /*have_lock*/ 1);
+
+	} else {
+
+		/*
+		 * Lookup the fe_datamove() function for this particular
+		 * front end.
+		 */
+		fe_datamove =
+		    control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
+		mtx_unlock(&control_softc->ctl_lock);
+
+		fe_datamove(io);
+	}
+}
+
+static void
+ctl_send_datamove_done(union ctl_io *io, int have_lock)
+{
+	union ctl_ha_msg msg;
+	int isc_status;
+
+	memset(&msg, 0, sizeof(msg));
+
+	msg.hdr.msg_type = CTL_MSG_DATAMOVE_DONE;
+	msg.hdr.original_sc = io;
+	msg.hdr.serializing_sc = io->io_hdr.serializing_sc;
+	msg.hdr.nexus = io->io_hdr.nexus;
+	msg.hdr.status = io->io_hdr.status;
+	msg.scsi.tag_num = io->scsiio.tag_num;
+	msg.scsi.tag_type = io->scsiio.tag_type;
+	msg.scsi.scsi_status = io->scsiio.scsi_status;
+	memcpy(&msg.scsi.sense_data, &io->scsiio.sense_data,
+	       sizeof(io->scsiio.sense_data));
+	msg.scsi.sense_len = io->scsiio.sense_len;
+	msg.scsi.sense_residual = io->scsiio.sense_residual;
+	msg.scsi.fetd_status = io->io_hdr.port_status;
+	msg.scsi.residual = io->scsiio.residual;
+	io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
+
+	if (io->io_hdr.flags & CTL_FLAG_FAILOVER) {
+		ctl_failover_io(io, /*have_lock*/ have_lock);
+		return;
+	}
+
+	isc_status = ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg, sizeof(msg), 0);
+	if (isc_status > CTL_HA_STATUS_SUCCESS) {
+		/* XXX do something if this fails */
+	}
+
+}
+
+/*
+ * The DMA to the remote side is done, now we need to tell the other side
+ * we're done so it can continue with its data movement.
+ */
+static void
+ctl_datamove_remote_write_cb(struct ctl_ha_dt_req *rq)
+{
+	union ctl_io *io;
+
+	io = rq->context;
+
+	if (rq->ret != CTL_HA_STATUS_SUCCESS) {
+		printf("%s: ISC DMA write failed with error %d", __func__,
+		       rq->ret);
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 1,
+					 /*retry_count*/ rq->ret);
+	}
+
+	ctl_dt_req_free(rq);
+
+	/*
+	 * In this case, we had to malloc the memory locally.  Free it.
+	 */
+	if ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0) {
+		int i;
+		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
+			free(io->io_hdr.local_sglist[i].addr, M_CTL);
+	}
+	/*
+	 * The data is in local and remote memory, so now we need to send
+	 * status (good or back) back to the other side.
+	 */
+	ctl_send_datamove_done(io, /*have_lock*/ 0);
+}
+
+/*
+ * We've moved the data from the host/controller into local memory.  Now we
+ * need to push it over to the remote controller's memory.
+ */
+static int
+ctl_datamove_remote_dm_write_cb(union ctl_io *io)
+{
+	int retval;
+
+	retval = 0;
+
+	retval = ctl_datamove_remote_xfer(io, CTL_HA_DT_CMD_WRITE,
+					  ctl_datamove_remote_write_cb);
+
+	return (retval);
+}
+
+static void
+ctl_datamove_remote_write(union ctl_io *io)
+{
+	int retval;
+	void (*fe_datamove)(union ctl_io *io);
+
+	/*
+	 * - Get the data from the host/HBA into local memory.
+	 * - DMA memory from the local controller to the remote controller.
+	 * - Send status back to the remote controller.
+	 */
+
+	retval = ctl_datamove_remote_sgl_setup(io);
+	if (retval != 0)
+		return;
+
+	/* Switch the pointer over so the FETD knows what to do */
+	io->scsiio.kern_data_ptr = (uint8_t *)io->io_hdr.local_sglist;
+
+	/*
+	 * Use a custom move done callback, since we need to send completion
+	 * back to the other controller, not to the backend on this side.
+	 */
+	io->scsiio.be_move_done = ctl_datamove_remote_dm_write_cb;
+
+	fe_datamove = control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
+
+	fe_datamove(io);
+
+	return;
+
+}
+
+static int
+ctl_datamove_remote_dm_read_cb(union ctl_io *io)
+{
+#if 0
+	char str[256];
+	char path_str[64];
+	struct sbuf sb;
+#endif
+
+	/*
+	 * In this case, we had to malloc the memory locally.  Free it.
+	 */
+	if ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0) {
+		int i;
+		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
+			free(io->io_hdr.local_sglist[i].addr, M_CTL);
+	}
+
+#if 0
+	scsi_path_string(io, path_str, sizeof(path_str));
+	sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
+	sbuf_cat(&sb, path_str);
+	scsi_command_string(&io->scsiio, NULL, &sb);
+	sbuf_printf(&sb, "\n");
+	sbuf_cat(&sb, path_str);
+	sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
+		    io->scsiio.tag_num, io->scsiio.tag_type);
+	sbuf_cat(&sb, path_str);
+	sbuf_printf(&sb, "%s: flags %#x, status %#x\n", __func__,
+		    io->io_hdr.flags, io->io_hdr.status);
+	sbuf_finish(&sb);
+	printk("%s", sbuf_data(&sb));
+#endif
+
+
+	/*
+	 * The read is done, now we need to send status (good or bad) back
+	 * to the other side.
+	 */
+	ctl_send_datamove_done(io, /*have_lock*/ 0);
+
+	return (0);
+}
+
+static void
+ctl_datamove_remote_read_cb(struct ctl_ha_dt_req *rq)
+{
+	union ctl_io *io;
+	void (*fe_datamove)(union ctl_io *io);
+
+	io = rq->context;
+
+	if (rq->ret != CTL_HA_STATUS_SUCCESS) {
+		printf("%s: ISC DMA read failed with error %d", __func__,
+		       rq->ret);
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 1,
+					 /*retry_count*/ rq->ret);
+	}
+
+	ctl_dt_req_free(rq);
+
+	/* Switch the pointer over so the FETD knows what to do */
+	io->scsiio.kern_data_ptr = (uint8_t *)io->io_hdr.local_sglist;
+
+	/*
+	 * Use a custom move done callback, since we need to send completion
+	 * back to the other controller, not to the backend on this side.
+	 */
+	io->scsiio.be_move_done = ctl_datamove_remote_dm_read_cb;
+
+	/* XXX KDM add checks like the ones in ctl_datamove? */
+
+	fe_datamove = control_softc->ctl_ports[ctl_port_idx(io->io_hdr.nexus.targ_port)]->fe_datamove;
+
+	fe_datamove(io);
+}
+
+static int
+ctl_datamove_remote_sgl_setup(union ctl_io *io)
+{
+	struct ctl_sg_entry *local_sglist, *remote_sglist;
+	struct ctl_sg_entry *local_dma_sglist, *remote_dma_sglist;
+	struct ctl_softc *softc;
+	int retval;
+	int i;
+
+	retval = 0;
+	softc = control_softc;
+
+	local_sglist = io->io_hdr.local_sglist;
+	local_dma_sglist = io->io_hdr.local_dma_sglist;
+	remote_sglist = io->io_hdr.remote_sglist;
+	remote_dma_sglist = io->io_hdr.remote_dma_sglist;
+
+	if (io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) {
+		for (i = 0; i < io->scsiio.kern_sg_entries; i++) {
+			local_sglist[i].len = remote_sglist[i].len;
+
+			/*
+			 * XXX Detect the situation where the RS-level I/O
+			 * redirector on the other side has already read the
+			 * data off of the AOR RS on this side, and
+			 * transferred it to remote (mirror) memory on the
+			 * other side.  Since we already have the data in
+			 * memory here, we just need to use it.
+			 *
+			 * XXX KDM this can probably be removed once we
+			 * get the cache device code in and take the
+			 * current AOR implementation out.
+			 */
+#ifdef NEEDTOPORT
+			if ((remote_sglist[i].addr >=
+			     (void *)vtophys(softc->mirr->addr))
+			 && (remote_sglist[i].addr <
+			     ((void *)vtophys(softc->mirr->addr) +
+			     CacheMirrorOffset))) {
+				local_sglist[i].addr = remote_sglist[i].addr -
+					CacheMirrorOffset;
+				if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
+				     CTL_FLAG_DATA_IN)
+					io->io_hdr.flags |= CTL_FLAG_REDIR_DONE;
+			} else {
+				local_sglist[i].addr = remote_sglist[i].addr +
+					CacheMirrorOffset;
+			}
+#endif
+#if 0
+			printf("%s: local %p, remote %p, len %d\n",
+			       __func__, local_sglist[i].addr,
+			       remote_sglist[i].addr, local_sglist[i].len);
+#endif
+		}
+	} else {
+		uint32_t len_to_go;
+
+		/*
+		 * In this case, we don't have automatically allocated
+		 * memory for this I/O on this controller.  This typically
+		 * happens with internal CTL I/O -- e.g. inquiry, mode
+		 * sense, etc.  Anything coming from RAIDCore will have
+		 * a mirror area available.
+		 */
+		len_to_go = io->scsiio.kern_data_len;
+
+		/*
+		 * Clear the no datasync flag, we have to use malloced
+		 * buffers.
+		 */
+		io->io_hdr.flags &= ~CTL_FLAG_NO_DATASYNC;
+
+		/*
+		 * The difficult thing here is that the size of the various
+		 * S/G segments may be different than the size from the
+		 * remote controller.  That'll make it harder when DMAing
+		 * the data back to the other side.
+		 */
+		for (i = 0; (i < sizeof(io->io_hdr.remote_sglist) /
+		     sizeof(io->io_hdr.remote_sglist[0])) &&
+		     (len_to_go > 0); i++) {
+			local_sglist[i].len = ctl_min(len_to_go, 131072);
+			CTL_SIZE_8B(local_dma_sglist[i].len,
+				    local_sglist[i].len);
+			local_sglist[i].addr =
+				malloc(local_dma_sglist[i].len, M_CTL,M_WAITOK);
+
+			local_dma_sglist[i].addr = local_sglist[i].addr;
+
+			if (local_sglist[i].addr == NULL) {
+				int j;
+
+				printf("malloc failed for %zd bytes!",
+				       local_dma_sglist[i].len);
+				for (j = 0; j < i; j++) {
+					free(local_sglist[j].addr, M_CTL);
+				}
+				ctl_set_internal_failure(&io->scsiio,
+							 /*sks_valid*/ 1,
+							 /*retry_count*/ 4857);
+				retval = 1;
+				goto bailout_error;
+				
+			}
+			/* XXX KDM do we need a sync here? */
+
+			len_to_go -= local_sglist[i].len;
+		}
+		/*
+		 * Reset the number of S/G entries accordingly.  The
+		 * original number of S/G entries is available in
+		 * rem_sg_entries.
+		 */
+		io->scsiio.kern_sg_entries = i;
+
+#if 0
+		printf("%s: kern_sg_entries = %d\n", __func__,
+		       io->scsiio.kern_sg_entries);
+		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
+			printf("%s: sg[%d] = %p, %d (DMA: %d)\n", __func__, i,
+			       local_sglist[i].addr, local_sglist[i].len,
+			       local_dma_sglist[i].len);
+#endif
+	}
+
+
+	return (retval);
+
+bailout_error:
+
+	ctl_send_datamove_done(io, /*have_lock*/ 0);
+
+	return (retval);
+}
+
+static int
+ctl_datamove_remote_xfer(union ctl_io *io, unsigned command,
+			 ctl_ha_dt_cb callback)
+{
+	struct ctl_ha_dt_req *rq;
+	struct ctl_sg_entry *remote_sglist, *local_sglist;
+	struct ctl_sg_entry *remote_dma_sglist, *local_dma_sglist;
+	uint32_t local_used, remote_used, total_used;
+	int retval;
+	int i, j;
+
+	retval = 0;
+
+	rq = ctl_dt_req_alloc();
+
+	/*
+	 * If we failed to allocate the request, and if the DMA didn't fail
+	 * anyway, set busy status.  This is just a resource allocation
+	 * failure.
+	 */
+	if ((rq == NULL)
+	 && ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE))
+		ctl_set_busy(&io->scsiio);
+
+	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE) {
+
+		if (rq != NULL)
+			ctl_dt_req_free(rq);
+
+		/*
+		 * The data move failed.  We need to return status back
+		 * to the other controller.  No point in trying to DMA
+		 * data to the remote controller.
+		 */
+
+		ctl_send_datamove_done(io, /*have_lock*/ 0);
+
+		retval = 1;
+
+		goto bailout;
+	}
+
+	local_sglist = io->io_hdr.local_sglist;
+	local_dma_sglist = io->io_hdr.local_dma_sglist;
+	remote_sglist = io->io_hdr.remote_sglist;
+	remote_dma_sglist = io->io_hdr.remote_dma_sglist;
+	local_used = 0;
+	remote_used = 0;
+	total_used = 0;
+
+	if (io->io_hdr.flags & CTL_FLAG_REDIR_DONE) {
+		rq->ret = CTL_HA_STATUS_SUCCESS;
+		rq->context = io;
+		callback(rq);
+		goto bailout;
+	}
+
+	/*
+	 * Pull/push the data over the wire from/to the other controller.
+	 * This takes into account the possibility that the local and
+	 * remote sglists may not be identical in terms of the size of
+	 * the elements and the number of elements.
+	 *
+	 * One fundamental assumption here is that the length allocated for
+	 * both the local and remote sglists is identical.  Otherwise, we've
+	 * essentially got a coding error of some sort.
+	 */
+	for (i = 0, j = 0; total_used < io->scsiio.kern_data_len; ) {
+		int isc_ret;
+		uint32_t cur_len, dma_length;
+		uint8_t *tmp_ptr;
+
+		rq->id = CTL_HA_DATA_CTL;
+		rq->command = command;
+		rq->context = io;
+
+		/*
+		 * Both pointers should be aligned.  But it is possible
+		 * that the allocation length is not.  They should both
+		 * also have enough slack left over at the end, though,
+		 * to round up to the next 8 byte boundary.
+		 */
+		cur_len = ctl_min(local_sglist[i].len - local_used,
+				  remote_sglist[j].len - remote_used);
+
+		/*
+		 * In this case, we have a size issue and need to decrease
+		 * the size, except in the case where we actually have less
+		 * than 8 bytes left.  In that case, we need to increase
+		 * the DMA length to get the last bit.
+		 */
+		if ((cur_len & 0x7) != 0) {
+			if (cur_len > 0x7) {
+				cur_len = cur_len - (cur_len & 0x7);
+				dma_length = cur_len;
+			} else {
+				CTL_SIZE_8B(dma_length, cur_len);
+			}
+
+		} else
+			dma_length = cur_len;
+
+		/*
+		 * If we had to allocate memory for this I/O, instead of using
+		 * the non-cached mirror memory, we'll need to flush the cache
+		 * before trying to DMA to the other controller.
+		 *
+		 * We could end up doing this multiple times for the same
+		 * segment if we have a larger local segment than remote
+		 * segment.  That shouldn't be an issue.
+		 */
+		if ((io->io_hdr.flags & CTL_FLAG_NO_DATASYNC) == 0) {
+			/*
+			 * XXX KDM use bus_dmamap_sync() here.
+			 */
+		}
+
+		rq->size = dma_length;
+
+		tmp_ptr = (uint8_t *)local_sglist[i].addr;
+		tmp_ptr += local_used;
+
+		/* Use physical addresses when talking to ISC hardware */
+		if ((io->io_hdr.flags & CTL_FLAG_BUS_ADDR) == 0) {
+			/* XXX KDM use busdma */
+#if 0
+			rq->local = vtophys(tmp_ptr);
+#endif
+		} else
+			rq->local = tmp_ptr;
+
+		tmp_ptr = (uint8_t *)remote_sglist[j].addr;
+		tmp_ptr += remote_used;
+		rq->remote = tmp_ptr;
+
+		rq->callback = NULL;
+
+		local_used += cur_len;
+		if (local_used >= local_sglist[i].len) {
+			i++;
+			local_used = 0;
+		}
+
+		remote_used += cur_len;
+		if (remote_used >= remote_sglist[j].len) {
+			j++;
+			remote_used = 0;
+		}
+		total_used += cur_len;
+
+		if (total_used >= io->scsiio.kern_data_len)
+			rq->callback = callback;
+
+		if ((rq->size & 0x7) != 0) {
+			printf("%s: warning: size %d is not on 8b boundary\n",
+			       __func__, rq->size);
+		}
+		if (((uintptr_t)rq->local & 0x7) != 0) {
+			printf("%s: warning: local %p not on 8b boundary\n",
+			       __func__, rq->local);
+		}
+		if (((uintptr_t)rq->remote & 0x7) != 0) {
+			printf("%s: warning: remote %p not on 8b boundary\n",
+			       __func__, rq->local);
+		}
+#if 0
+		printf("%s: %s: local %#x remote %#x size %d\n", __func__,
+		       (command == CTL_HA_DT_CMD_WRITE) ? "WRITE" : "READ",
+		       rq->local, rq->remote, rq->size);
+#endif
+
+		isc_ret = ctl_dt_single(rq);
+		if (isc_ret == CTL_HA_STATUS_WAIT)
+			continue;
+
+		if (isc_ret == CTL_HA_STATUS_DISCONNECT) {
+			rq->ret = CTL_HA_STATUS_SUCCESS;
+		} else {
+			rq->ret = isc_ret;
+		}
+		callback(rq);
+		goto bailout;
+	}
+
+bailout:
+	return (retval);
+
+}
+
+static void
+ctl_datamove_remote_read(union ctl_io *io)
+{
+	int retval;
+	int i;
+
+	/*
+	 * This will send an error to the other controller in the case of a
+	 * failure.
+	 */
+	retval = ctl_datamove_remote_sgl_setup(io);
+	if (retval != 0)
+		return;
+
+	retval = ctl_datamove_remote_xfer(io, CTL_HA_DT_CMD_READ,
+					  ctl_datamove_remote_read_cb);
+	if ((retval != 0)
+	 && ((io->io_hdr.flags & CTL_FLAG_AUTO_MIRROR) == 0)) {
+		/*
+		 * Make sure we free memory if there was an error..  The
+		 * ctl_datamove_remote_xfer() function will send the
+		 * datamove done message, or call the callback with an
+		 * error if there is a problem.
+		 */
+		for (i = 0; i < io->scsiio.kern_sg_entries; i++)
+			free(io->io_hdr.local_sglist[i].addr, M_CTL);
+	}
+
+	return;
+}
+
+/*
+ * Process a datamove request from the other controller.  This is used for
+ * XFER mode only, not SER_ONLY mode.  For writes, we DMA into local memory
+ * first.  Once that is complete, the data gets DMAed into the remote
+ * controller's memory.  For reads, we DMA from the remote controller's
+ * memory into our memory first, and then move it out to the FETD.
+ *
+ * Should be called without the ctl_lock held.
+ */
+static void
+ctl_datamove_remote(union ctl_io *io)
+{
+	struct ctl_softc *softc;
+
+	softc = control_softc;
+
+	/*
+	 * Note that we look for an aborted I/O here, but don't do some of
+	 * the other checks that ctl_datamove() normally does.  We don't
+	 * need to run the task queue, because this I/O is on the ISC
+	 * queue, which is executed by the work thread after the task queue.
+	 * We don't need to run the datamove delay code, since that should
+	 * have been done if need be on the other controller.
+	 */
+	mtx_lock(&softc->ctl_lock);
+
+	if (io->io_hdr.flags & CTL_FLAG_ABORT) {
+
+		printf("%s: tag 0x%04x on (%d:%d:%d:%d) aborted\n", __func__,
+		       io->scsiio.tag_num, io->io_hdr.nexus.initid.id,
+		       io->io_hdr.nexus.targ_port,
+		       io->io_hdr.nexus.targ_target.id,
+		       io->io_hdr.nexus.targ_lun);
+		io->io_hdr.status = CTL_CMD_ABORTED;
+		io->io_hdr.port_status = 31338;
+
+		mtx_unlock(&softc->ctl_lock);
+
+		ctl_send_datamove_done(io, /*have_lock*/ 0);
+
+		return;
+	}
+
+	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_OUT) {
+		mtx_unlock(&softc->ctl_lock);
+		ctl_datamove_remote_write(io);
+	} else if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN){
+		mtx_unlock(&softc->ctl_lock);
+		ctl_datamove_remote_read(io);
+	} else {
+		union ctl_ha_msg msg;
+		struct scsi_sense_data *sense;
+		uint8_t sks[3];
+		int retry_count;
+
+		memset(&msg, 0, sizeof(msg));
+
+		msg.hdr.msg_type = CTL_MSG_BAD_JUJU;
+		msg.hdr.status = CTL_SCSI_ERROR;
+		msg.scsi.scsi_status = SCSI_STATUS_CHECK_COND;
+
+		retry_count = 4243;
+
+		sense = &msg.scsi.sense_data;
+		sks[0] = SSD_SCS_VALID;
+		sks[1] = (retry_count >> 8) & 0xff;
+		sks[2] = retry_count & 0xff;
+
+		/* "Internal target failure" */
+		scsi_set_sense_data(sense,
+				    /*sense_format*/ SSD_TYPE_NONE,
+				    /*current_error*/ 1,
+				    /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
+				    /*asc*/ 0x44,
+				    /*ascq*/ 0x00,
+				    /*type*/ SSD_ELEM_SKS,
+				    /*size*/ sizeof(sks),
+				    /*data*/ sks,
+				    SSD_ELEM_NONE);
+
+		io->io_hdr.flags &= ~CTL_FLAG_IO_ACTIVE;
+		if (io->io_hdr.flags & CTL_FLAG_FAILOVER) {
+			ctl_failover_io(io, /*have_lock*/ 1);
+			mtx_unlock(&softc->ctl_lock);
+			return;
+		}
+
+		mtx_unlock(&softc->ctl_lock);
+
+		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg, sizeof(msg), 0) >
+		    CTL_HA_STATUS_SUCCESS) {
+			/* XXX KDM what to do if this fails? */
+		}
+		return;
+	}
+	
+}
+
+static int
+ctl_process_done(union ctl_io *io, int have_lock)
+{
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	void (*fe_done)(union ctl_io *io);
+	uint32_t targ_port = ctl_port_idx(io->io_hdr.nexus.targ_port);
+
+	CTL_DEBUG_PRINT(("ctl_process_done\n"));
+
+	fe_done =
+	    control_softc->ctl_ports[targ_port]->fe_done;
+
+#ifdef CTL_TIME_IO
+	if ((time_uptime - io->io_hdr.start_time) > ctl_time_io_secs) {
+		char str[256];
+		char path_str[64];
+		struct sbuf sb;
+
+		ctl_scsi_path_string(io, path_str, sizeof(path_str));
+		sbuf_new(&sb, str, sizeof(str), SBUF_FIXEDLEN);
+
+		sbuf_cat(&sb, path_str);
+		switch (io->io_hdr.io_type) {
+		case CTL_IO_SCSI:
+			ctl_scsi_command_string(&io->scsiio, NULL, &sb);
+			sbuf_printf(&sb, "\n");
+			sbuf_cat(&sb, path_str);
+			sbuf_printf(&sb, "Tag: 0x%04x, type %d\n",
+				    io->scsiio.tag_num, io->scsiio.tag_type);
+			break;
+		case CTL_IO_TASK:
+			sbuf_printf(&sb, "Task I/O type: %d, Tag: 0x%04x, "
+				    "Tag Type: %d\n", io->taskio.task_action,
+				    io->taskio.tag_num, io->taskio.tag_type);
+			break;
+		default:
+			printf("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
+			panic("Invalid CTL I/O type %d\n", io->io_hdr.io_type);
+			break;
+		}
+		sbuf_cat(&sb, path_str);
+		sbuf_printf(&sb, "ctl_process_done: %jd seconds\n",
+			    (intmax_t)time_uptime - io->io_hdr.start_time);
+		sbuf_finish(&sb);
+		printf("%s", sbuf_data(&sb));
+	}
+#endif /* CTL_TIME_IO */
+
+	switch (io->io_hdr.io_type) {
+	case CTL_IO_SCSI:
+		break;
+	case CTL_IO_TASK:
+		ctl_io_error_print(io, NULL);
+		if (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)
+			ctl_free_io_internal(io, /*have_lock*/ 0);
+		else
+			fe_done(io);
+		return (CTL_RETVAL_COMPLETE);
+		break;
+	default:
+		printf("ctl_process_done: invalid io type %d\n",
+		       io->io_hdr.io_type);
+		panic("ctl_process_done: invalid io type %d\n",
+		      io->io_hdr.io_type);
+		break; /* NOTREACHED */
+	}
+
+	lun = (struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+	if (lun == NULL) {
+		CTL_DEBUG_PRINT(("NULL LUN for lun %d\n",
+				 io->io_hdr.nexus.targ_lun));
+		fe_done(io);
+		goto bailout;
+	}
+	ctl_softc = lun->ctl_softc;
+
+	/*
+	 * Remove this from the OOA queue.
+	 */
+	if (have_lock == 0)
+		mtx_lock(&ctl_softc->ctl_lock);
+
+	/*
+	 * Check to see if we have any errors to inject here.  We only
+	 * inject errors for commands that don't already have errors set.
+	 */
+	if ((STAILQ_FIRST(&lun->error_list) != NULL)
+	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS))
+		ctl_inject_error(lun, io);
+
+	/*
+	 * XXX KDM how do we treat commands that aren't completed
+	 * successfully?
+	 *
+	 * XXX KDM should we also track I/O latency?
+	 */
+	if ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS) {
+		uint32_t blocksize;
+#ifdef CTL_TIME_IO
+		struct bintime cur_bt;
+#endif
+
+		if ((lun->be_lun != NULL)
+		 && (lun->be_lun->blocksize != 0))
+			blocksize = lun->be_lun->blocksize;
+		else
+			blocksize = 512;
+
+		switch (io->io_hdr.io_type) {
+		case CTL_IO_SCSI: {
+			int isread;
+			struct ctl_lba_len lbalen;
+
+			isread = 0;
+			switch (io->scsiio.cdb[0]) {
+			case READ_6:
+			case READ_10:
+			case READ_12:
+			case READ_16:
+				isread = 1;
+				/* FALLTHROUGH */
+			case WRITE_6:
+			case WRITE_10:
+			case WRITE_12:
+			case WRITE_16:
+			case WRITE_VERIFY_10:
+			case WRITE_VERIFY_12:
+			case WRITE_VERIFY_16:
+				memcpy(&lbalen, io->io_hdr.ctl_private[
+				       CTL_PRIV_LBA_LEN].bytes, sizeof(lbalen));
+
+				if (isread) {
+					lun->stats.ports[targ_port].bytes[CTL_STATS_READ] +=
+						lbalen.len * blocksize;
+					lun->stats.ports[targ_port].operations[CTL_STATS_READ]++;
+
+#ifdef CTL_TIME_IO
+					bintime_add(
+					   &lun->stats.ports[targ_port].dma_time[CTL_STATS_READ],
+					   &io->io_hdr.dma_bt);
+					lun->stats.ports[targ_port].num_dmas[CTL_STATS_READ] +=
+						io->io_hdr.num_dmas;
+					getbintime(&cur_bt);
+					bintime_sub(&cur_bt,
+						    &io->io_hdr.start_bt);
+
+					bintime_add(
+					    &lun->stats.ports[targ_port].time[CTL_STATS_READ],
+					    &cur_bt);
+
+#if 0
+					cs_prof_gettime(&cur_ticks);
+					lun->stats.time[CTL_STATS_READ] +=
+						cur_ticks -
+						io->io_hdr.start_ticks;
+#endif
+#if 0
+					lun->stats.time[CTL_STATS_READ] +=
+						jiffies - io->io_hdr.start_time;
+#endif
+#endif /* CTL_TIME_IO */
+				} else {
+					lun->stats.ports[targ_port].bytes[CTL_STATS_WRITE] +=
+						lbalen.len * blocksize;
+					lun->stats.ports[targ_port].operations[
+						CTL_STATS_WRITE]++;
+
+#ifdef CTL_TIME_IO
+					bintime_add(
+					  &lun->stats.ports[targ_port].dma_time[CTL_STATS_WRITE],
+					  &io->io_hdr.dma_bt);
+					lun->stats.ports[targ_port].num_dmas[CTL_STATS_WRITE] +=
+						io->io_hdr.num_dmas;
+					getbintime(&cur_bt);
+					bintime_sub(&cur_bt,
+						    &io->io_hdr.start_bt);
+
+					bintime_add(
+					    &lun->stats.ports[targ_port].time[CTL_STATS_WRITE],
+					    &cur_bt);
+#if 0
+					cs_prof_gettime(&cur_ticks);
+					lun->stats.ports[targ_port].time[CTL_STATS_WRITE] +=
+						cur_ticks -
+						io->io_hdr.start_ticks;
+					lun->stats.ports[targ_port].time[CTL_STATS_WRITE] +=
+						jiffies - io->io_hdr.start_time;
+#endif
+#endif /* CTL_TIME_IO */
+				}
+				break;
+			default:
+				lun->stats.ports[targ_port].operations[CTL_STATS_NO_IO]++;
+
+#ifdef CTL_TIME_IO
+				bintime_add(
+				  &lun->stats.ports[targ_port].dma_time[CTL_STATS_NO_IO],
+				  &io->io_hdr.dma_bt);
+				lun->stats.ports[targ_port].num_dmas[CTL_STATS_NO_IO] +=
+					io->io_hdr.num_dmas;
+				getbintime(&cur_bt);
+				bintime_sub(&cur_bt, &io->io_hdr.start_bt);
+
+				bintime_add(&lun->stats.ports[targ_port].time[CTL_STATS_NO_IO],
+					    &cur_bt);
+
+#if 0
+				cs_prof_gettime(&cur_ticks);
+				lun->stats.ports[targ_port].time[CTL_STATS_NO_IO] +=
+					cur_ticks -
+					io->io_hdr.start_ticks;
+				lun->stats.ports[targ_port].time[CTL_STATS_NO_IO] +=
+					jiffies - io->io_hdr.start_time;
+#endif
+#endif /* CTL_TIME_IO */
+				break;
+			}
+			break;
+		}
+		default:
+			break;
+		}
+	}
+
+	TAILQ_REMOVE(&lun->ooa_queue, &io->io_hdr, ooa_links);
+
+	/*
+	 * Run through the blocked queue on this LUN and see if anything
+	 * has become unblocked, now that this transaction is done.
+	 */
+	ctl_check_blocked(lun);
+
+	/*
+	 * If the LUN has been invalidated, free it if there is nothing
+	 * left on its OOA queue.
+	 */
+	if ((lun->flags & CTL_LUN_INVALID)
+	 && (TAILQ_FIRST(&lun->ooa_queue) == NULL))
+		ctl_free_lun(lun);
+
+	/*
+	 * If this command has been aborted, make sure we set the status
+	 * properly.  The FETD is responsible for freeing the I/O and doing
+	 * whatever it needs to do to clean up its state.
+	 */
+	if (io->io_hdr.flags & CTL_FLAG_ABORT)
+		io->io_hdr.status = CTL_CMD_ABORTED;
+
+	/*
+	 * We print out status for every task management command.  For SCSI
+	 * commands, we filter out any unit attention errors; they happen
+	 * on every boot, and would clutter up the log.  Note:  task
+	 * management commands aren't printed here, they are printed above,
+	 * since they should never even make it down here.
+	 */
+	switch (io->io_hdr.io_type) {
+	case CTL_IO_SCSI: {
+		int error_code, sense_key, asc, ascq;
+
+		sense_key = 0;
+
+		if (((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SCSI_ERROR)
+		 && (io->scsiio.scsi_status == SCSI_STATUS_CHECK_COND)) {
+			/*
+			 * Since this is just for printing, no need to
+			 * show errors here.
+			 */
+			scsi_extract_sense_len(&io->scsiio.sense_data,
+					       io->scsiio.sense_len,
+					       &error_code,
+					       &sense_key,
+					       &asc,
+					       &ascq,
+					       /*show_errors*/ 0);
+		}
+
+		if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
+		 && (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SCSI_ERROR)
+		  || (io->scsiio.scsi_status != SCSI_STATUS_CHECK_COND)
+		  || (sense_key != SSD_KEY_UNIT_ATTENTION))) {
+
+			if ((time_uptime - ctl_softc->last_print_jiffies) <= 0){
+				ctl_softc->skipped_prints++;
+				if (have_lock == 0)
+					mtx_unlock(&ctl_softc->ctl_lock);
+			} else {
+				uint32_t skipped_prints;
+
+				skipped_prints = ctl_softc->skipped_prints;
+
+				ctl_softc->skipped_prints = 0;
+				ctl_softc->last_print_jiffies = time_uptime;
+
+				if (have_lock == 0)
+					mtx_unlock(&ctl_softc->ctl_lock);
+				if (skipped_prints > 0) {
+#ifdef NEEDTOPORT
+					csevent_log(CSC_CTL | CSC_SHELF_SW |
+					    CTL_ERROR_REPORT,
+					    csevent_LogType_Trace,
+					    csevent_Severity_Information,
+					    csevent_AlertLevel_Green,
+					    csevent_FRU_Firmware,
+					    csevent_FRU_Unknown,
+					    "High CTL error volume, %d prints "
+					    "skipped", skipped_prints);
+#endif
+				}
+				ctl_io_error_print(io, NULL);
+			}
+		} else {
+			if (have_lock == 0)
+				mtx_unlock(&ctl_softc->ctl_lock);
+		}
+		break;
+	}
+	case CTL_IO_TASK:
+		if (have_lock == 0)
+			mtx_unlock(&ctl_softc->ctl_lock);
+		ctl_io_error_print(io, NULL);
+		break;
+	default:
+		if (have_lock == 0)
+			mtx_unlock(&ctl_softc->ctl_lock);
+		break;
+	}
+
+	/*
+	 * Tell the FETD or the other shelf controller we're done with this
+	 * command.  Note that only SCSI commands get to this point.  Task
+	 * management commands are completed above.
+	 *
+	 * We only send status to the other controller if we're in XFER
+	 * mode.  In SER_ONLY mode, the I/O is done on the controller that
+	 * received the I/O (from CTL's perspective), and so the status is
+	 * generated there.
+	 * 
+	 * XXX KDM if we hold the lock here, we could cause a deadlock
+	 * if the frontend comes back in in this context to queue
+	 * something.
+	 */
+	if ((ctl_softc->ha_mode == CTL_HA_MODE_XFER)
+	 && (io->io_hdr.flags & CTL_FLAG_FROM_OTHER_SC)) {
+		union ctl_ha_msg msg;
+
+		memset(&msg, 0, sizeof(msg));
+		msg.hdr.msg_type = CTL_MSG_FINISH_IO;
+		msg.hdr.original_sc = io->io_hdr.original_sc;
+		msg.hdr.nexus = io->io_hdr.nexus;
+		msg.hdr.status = io->io_hdr.status;
+		msg.scsi.scsi_status = io->scsiio.scsi_status;
+		msg.scsi.tag_num = io->scsiio.tag_num;
+		msg.scsi.tag_type = io->scsiio.tag_type;
+		msg.scsi.sense_len = io->scsiio.sense_len;
+		msg.scsi.sense_residual = io->scsiio.sense_residual;
+		msg.scsi.residual = io->scsiio.residual;
+		memcpy(&msg.scsi.sense_data, &io->scsiio.sense_data,
+		       sizeof(io->scsiio.sense_data));
+		/*
+		 * We copy this whether or not this is an I/O-related
+		 * command.  Otherwise, we'd have to go and check to see
+		 * whether it's a read/write command, and it really isn't
+		 * worth it.
+		 */
+		memcpy(&msg.scsi.lbalen,
+		       &io->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
+		       sizeof(msg.scsi.lbalen));;
+
+		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg,
+				sizeof(msg), 0) > CTL_HA_STATUS_SUCCESS) {
+			/* XXX do something here */
+		}
+
+		ctl_free_io_internal(io, /*have_lock*/ 0);
+	} else 
+		fe_done(io);
+
+bailout:
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * Front end should call this if it doesn't do autosense.  When the request
+ * sense comes back in from the initiator, we'll dequeue this and send it.
+ */
+int
+ctl_queue_sense(union ctl_io *io)
+{
+	struct ctl_lun *lun;
+	struct ctl_softc *ctl_softc;
+	uint32_t initidx;
+
+	ctl_softc = control_softc;
+
+	CTL_DEBUG_PRINT(("ctl_queue_sense\n"));
+
+	/*
+	 * LUN lookup will likely move to the ctl_work_thread() once we
+	 * have our new queueing infrastructure (that doesn't put things on
+	 * a per-LUN queue initially).  That is so that we can handle
+	 * things like an INQUIRY to a LUN that we don't have enabled.  We
+	 * can't deal with that right now.
+	 */
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	/*
+	 * If we don't have a LUN for this, just toss the sense
+	 * information.
+	 */
+	if ((io->io_hdr.nexus.targ_lun < CTL_MAX_LUNS)
+	 && (ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun] != NULL))
+		lun = ctl_softc->ctl_luns[io->io_hdr.nexus.targ_lun];
+	else
+		goto bailout;
+
+	initidx = ctl_get_initindex(&io->io_hdr.nexus);
+
+	/*
+	 * Already have CA set for this LUN...toss the sense information.
+	 */
+	if (ctl_is_set(lun->have_ca, initidx))
+		goto bailout;
+
+	memcpy(&lun->pending_sense[initidx].sense, &io->scsiio.sense_data,
+	       ctl_min(sizeof(lun->pending_sense[initidx].sense),
+	       sizeof(io->scsiio.sense_data)));
+	ctl_set_mask(lun->have_ca, initidx);
+
+bailout:
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctl_free_io(io);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+/*
+ * Primary command inlet from frontend ports.  All SCSI and task I/O
+ * requests must go through this function.
+ */
+int
+ctl_queue(union ctl_io *io)
+{
+	struct ctl_softc *ctl_softc;
+
+	CTL_DEBUG_PRINT(("ctl_queue cdb[0]=%02X\n", io->scsiio.cdb[0]));
+
+	ctl_softc = control_softc;
+
+#ifdef CTL_TIME_IO
+	io->io_hdr.start_time = time_uptime;
+	getbintime(&io->io_hdr.start_bt);
+#endif /* CTL_TIME_IO */
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	switch (io->io_hdr.io_type) {
+	case CTL_IO_SCSI:
+		STAILQ_INSERT_TAIL(&ctl_softc->incoming_queue, &io->io_hdr,
+				   links);
+		break;
+	case CTL_IO_TASK:
+		STAILQ_INSERT_TAIL(&ctl_softc->task_queue, &io->io_hdr, links);
+		/*
+		 * Set the task pending flag.  This is necessary to close a
+		 * race condition with the FETD:
+		 *
+		 * - FETD submits a task management command, like an abort.
+		 * - Back end calls fe_datamove() to move the data for the
+		 *   aborted command.  The FETD can't really accept it, but
+		 *   if it did, it would end up transmitting data for a
+		 *   command that the initiator told us to abort.
+		 *
+		 * We close the race condition by setting the flag here,
+		 * and checking it in ctl_datamove(), before calling the
+		 * FETD's fe_datamove routine.  If we've got a task
+		 * pending, we run the task queue and then check to see
+		 * whether our particular I/O has been aborted.
+		 */
+		ctl_softc->flags |= CTL_FLAG_TASK_PENDING;
+		break;
+	default:
+		mtx_unlock(&ctl_softc->ctl_lock);
+		printf("ctl_queue: unknown I/O type %d\n", io->io_hdr.io_type);
+		return (-EINVAL);
+		break; /* NOTREACHED */
+	}
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctl_wakeup_thread();
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+#ifdef CTL_IO_DELAY
+static void
+ctl_done_timer_wakeup(void *arg)
+{
+	union ctl_io *io;
+
+	io = (union ctl_io *)arg;
+	ctl_done_lock(io, /*have_lock*/ 0);
+}
+#endif /* CTL_IO_DELAY */
+
+void
+ctl_done_lock(union ctl_io *io, int have_lock)
+{
+	struct ctl_softc *ctl_softc;
+#ifndef CTL_DONE_THREAD
+	union ctl_io *xio;
+#endif /* !CTL_DONE_THREAD */
+
+	ctl_softc = control_softc;
+
+	if (have_lock == 0)
+		mtx_lock(&ctl_softc->ctl_lock);
+
+	/*
+	 * Enable this to catch duplicate completion issues.
+	 */
+#if 0
+	if (io->io_hdr.flags & CTL_FLAG_ALREADY_DONE) {
+		printf("%s: type %d msg %d cdb %x iptl: "
+		       "%d:%d:%d:%d tag 0x%04x "
+		       "flag %#x status %x\n",
+			__func__,
+			io->io_hdr.io_type,
+			io->io_hdr.msg_type,
+			io->scsiio.cdb[0],
+			io->io_hdr.nexus.initid.id,
+			io->io_hdr.nexus.targ_port,
+			io->io_hdr.nexus.targ_target.id,
+			io->io_hdr.nexus.targ_lun,
+			(io->io_hdr.io_type ==
+			CTL_IO_TASK) ?
+			io->taskio.tag_num :
+			io->scsiio.tag_num,
+		        io->io_hdr.flags,
+			io->io_hdr.status);
+	} else
+		io->io_hdr.flags |= CTL_FLAG_ALREADY_DONE;
+#endif
+
+	/*
+	 * This is an internal copy of an I/O, and should not go through
+	 * the normal done processing logic.
+	 */
+	if (io->io_hdr.flags & CTL_FLAG_INT_COPY) {
+		if (have_lock == 0)
+			mtx_unlock(&ctl_softc->ctl_lock);
+		return;
+	}
+
+	/*
+	 * We need to send a msg to the serializing shelf to finish the IO
+	 * as well.  We don't send a finish message to the other shelf if
+	 * this is a task management command.  Task management commands
+	 * aren't serialized in the OOA queue, but rather just executed on
+	 * both shelf controllers for commands that originated on that
+	 * controller.
+	 */
+	if ((io->io_hdr.flags & CTL_FLAG_SENT_2OTHER_SC)
+	 && (io->io_hdr.io_type != CTL_IO_TASK)) {
+		union ctl_ha_msg msg_io;
+
+		msg_io.hdr.msg_type = CTL_MSG_FINISH_IO;
+		msg_io.hdr.serializing_sc = io->io_hdr.serializing_sc;
+		if (ctl_ha_msg_send(CTL_HA_CHAN_CTL, &msg_io,
+		    sizeof(msg_io), 0 ) != CTL_HA_STATUS_SUCCESS) {
+		}
+		/* continue on to finish IO */
+	}
+#ifdef CTL_IO_DELAY
+	if (io->io_hdr.flags & CTL_FLAG_DELAY_DONE) {
+		struct ctl_lun *lun;
+
+		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+		io->io_hdr.flags &= ~CTL_FLAG_DELAY_DONE;
+	} else {
+		struct ctl_lun *lun;
+
+		lun =(struct ctl_lun *)io->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+		if ((lun != NULL)
+		 && (lun->delay_info.done_delay > 0)) {
+			struct callout *callout;
+
+			callout = (struct callout *)&io->io_hdr.timer_bytes;
+			callout_init(callout, /*mpsafe*/ 1);
+			io->io_hdr.flags |= CTL_FLAG_DELAY_DONE;
+			callout_reset(callout,
+				      lun->delay_info.done_delay * hz,
+				      ctl_done_timer_wakeup, io);
+			if (lun->delay_info.done_type == CTL_DELAY_TYPE_ONESHOT)
+				lun->delay_info.done_delay = 0;
+			if (have_lock == 0)
+				mtx_unlock(&ctl_softc->ctl_lock);
+			return;
+		}
+	}
+#endif /* CTL_IO_DELAY */
+
+	STAILQ_INSERT_TAIL(&ctl_softc->done_queue, &io->io_hdr, links);
+
+#ifdef CTL_DONE_THREAD
+	if (have_lock == 0)
+		mtx_unlock(&ctl_softc->ctl_lock);
+
+	ctl_wakeup_thread();
+#else /* CTL_DONE_THREAD */
+	for (xio = (union ctl_io *)STAILQ_FIRST(&ctl_softc->done_queue);
+	     xio != NULL;
+	     xio =(union ctl_io *)STAILQ_FIRST(&ctl_softc->done_queue)) {
+
+		STAILQ_REMOVE_HEAD(&ctl_softc->done_queue, links);
+
+		ctl_process_done(xio, /*have_lock*/ 1);
+	}
+	if (have_lock == 0)
+		mtx_unlock(&ctl_softc->ctl_lock);
+#endif /* CTL_DONE_THREAD */
+}
+
+void
+ctl_done(union ctl_io *io)
+{
+	ctl_done_lock(io, /*have_lock*/ 0);
+}
+
+int
+ctl_isc(struct ctl_scsiio *ctsio)
+{
+	struct ctl_lun *lun;
+	int retval;
+
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	CTL_DEBUG_PRINT(("ctl_isc: command: %02x\n", ctsio->cdb[0]));
+
+	CTL_DEBUG_PRINT(("ctl_isc: calling data_submit()\n"));
+
+	retval = lun->backend->data_submit((union ctl_io *)ctsio);
+
+	return (retval);
+}
+
+
+static void
+ctl_work_thread(void *arg)
+{
+	struct ctl_softc *softc;
+	union ctl_io *io;
+	struct ctl_be_lun *be_lun;
+	int retval;
+
+	CTL_DEBUG_PRINT(("ctl_work_thread starting\n"));
+
+	softc = (struct ctl_softc *)arg;
+	if (softc == NULL)
+		return;
+
+	mtx_lock(&softc->ctl_lock);
+	for (;;) {
+		retval = 0;
+
+		/*
+		 * We handle the queues in this order:
+		 * - task management
+		 * - ISC
+		 * - done queue (to free up resources, unblock other commands)
+		 * - RtR queue
+		 * - incoming queue
+		 *
+		 * If those queues are empty, we break out of the loop and
+		 * go to sleep.
+		 */
+		io = (union ctl_io *)STAILQ_FIRST(&softc->task_queue);
+		if (io != NULL) {
+			ctl_run_task_queue(softc);
+			continue;
+		}
+		io = (union ctl_io *)STAILQ_FIRST(&softc->isc_queue);
+		if (io != NULL) {
+			STAILQ_REMOVE_HEAD(&softc->isc_queue, links);
+			ctl_handle_isc(io);
+			continue;
+		}
+		io = (union ctl_io *)STAILQ_FIRST(&softc->done_queue);
+		if (io != NULL) {
+			STAILQ_REMOVE_HEAD(&softc->done_queue, links);
+			/* clear any blocked commands, call fe_done */
+			mtx_unlock(&softc->ctl_lock);
+			/*
+			 * XXX KDM
+			 * Call this without a lock for now.  This will
+			 * depend on whether there is any way the FETD can
+			 * sleep or deadlock if called with the CTL lock
+			 * held.
+			 */
+			retval = ctl_process_done(io, /*have_lock*/ 0);
+			mtx_lock(&softc->ctl_lock);
+			continue;
+		}
+		if (!ctl_pause_rtr) {
+			io = (union ctl_io *)STAILQ_FIRST(&softc->rtr_queue);
+			if (io != NULL) {
+				STAILQ_REMOVE_HEAD(&softc->rtr_queue, links);
+				mtx_unlock(&softc->ctl_lock);
+				goto execute;
+			}
+		}
+		io = (union ctl_io *)STAILQ_FIRST(&softc->incoming_queue);
+		if (io != NULL) {
+			STAILQ_REMOVE_HEAD(&softc->incoming_queue, links);
+			mtx_unlock(&softc->ctl_lock);
+			ctl_scsiio_precheck(softc, &io->scsiio);
+			mtx_lock(&softc->ctl_lock);
+			continue;
+		}
+		/*
+		 * We might want to move this to a separate thread, so that
+		 * configuration requests (in this case LUN creations)
+		 * won't impact the I/O path.
+		 */
+		be_lun = STAILQ_FIRST(&softc->pending_lun_queue);
+		if (be_lun != NULL) {
+			STAILQ_REMOVE_HEAD(&softc->pending_lun_queue, links);
+			mtx_unlock(&softc->ctl_lock);
+			ctl_create_lun(be_lun);
+			mtx_lock(&softc->ctl_lock);
+			continue;
+		}
+
+		/* XXX KDM use the PDROP flag?? */
+		/* Sleep until we have something to do. */
+		mtx_sleep(softc, &softc->ctl_lock, PRIBIO, "ctl_work", 0);
+
+		/* Back to the top of the loop to see what woke us up. */
+		continue;
+
+execute:
+		retval = ctl_scsiio(&io->scsiio);
+		switch (retval) {
+		case CTL_RETVAL_COMPLETE:
+			break;
+		default:
+			/*
+			 * Probably need to make sure this doesn't happen.
+			 */
+			break;
+		}
+		mtx_lock(&softc->ctl_lock);
+	}
+}
+
+void
+ctl_wakeup_thread()
+{
+	struct ctl_softc *softc;
+
+	softc = control_softc;
+
+	wakeup(softc);
+}
+
+/* Initialization and failover */
+
+void
+ctl_init_isc_msg(void)
+{
+	printf("CTL: Still calling this thing\n");
+}
+
+/*
+ * Init component
+ * 	Initializes component into configuration defined by bootMode
+ *	(see hasc-sv.c)
+ *  	returns hasc_Status:
+ * 		OK
+ *		ERROR - fatal error
+ */
+static ctl_ha_comp_status
+ctl_isc_init(struct ctl_ha_component *c)
+{
+	ctl_ha_comp_status ret = CTL_HA_COMP_STATUS_OK;
+
+	c->status = ret;
+	return ret;
+}
+
+/* Start component
+ * 	Starts component in state requested. If component starts successfully,
+ *	it must set its own state to the requestrd state
+ *	When requested state is HASC_STATE_HA, the component may refine it
+ * 	by adding _SLAVE or _MASTER flags.
+ *	Currently allowed state transitions are:
+ *	UNKNOWN->HA		- initial startup
+ *	UNKNOWN->SINGLE - initial startup when no parter detected
+ *	HA->SINGLE		- failover
+ * returns ctl_ha_comp_status:
+ * 		OK	- component successfully started in requested state
+ *		FAILED  - could not start the requested state, failover may
+ * 			  be possible
+ *		ERROR	- fatal error detected, no future startup possible
+ */
+static ctl_ha_comp_status
+ctl_isc_start(struct ctl_ha_component *c, ctl_ha_state state)
+{
+	ctl_ha_comp_status ret = CTL_HA_COMP_STATUS_OK;
+
+	// UNKNOWN->HA or UNKNOWN->SINGLE (bootstrap)
+	if (c->state == CTL_HA_STATE_UNKNOWN ) {
+		ctl_is_single = 0;
+		if (ctl_ha_msg_create(CTL_HA_CHAN_CTL, ctl_isc_event_handler)
+		    != CTL_HA_STATUS_SUCCESS) {
+			printf("ctl_isc_start: ctl_ha_msg_create failed.\n");
+			ret = CTL_HA_COMP_STATUS_ERROR;
+		}
+	} else if (CTL_HA_STATE_IS_HA(c->state)
+		&& CTL_HA_STATE_IS_SINGLE(state)){
+		// HA->SINGLE transition
+	        ctl_failover();
+		ctl_is_single = 1;
+	} else {
+		printf("ctl_isc_start:Invalid state transition %X->%X\n",
+		       c->state, state);
+		ret = CTL_HA_COMP_STATUS_ERROR;
+	}
+	if (CTL_HA_STATE_IS_SINGLE(state))
+		ctl_is_single = 1;
+
+	c->state = state;
+	c->status = ret;
+	return ret;
+}
+
+/*
+ * Quiesce component
+ * The component must clear any error conditions (set status to OK) and
+ * prepare itself to another Start call
+ * returns ctl_ha_comp_status:
+ * 	OK
+ *	ERROR
+ */
+static ctl_ha_comp_status
+ctl_isc_quiesce(struct ctl_ha_component *c)
+{
+	int ret = CTL_HA_COMP_STATUS_OK;
+
+	ctl_pause_rtr = 1;
+	c->status = ret;
+	return ret;
+}
+
+struct ctl_ha_component ctl_ha_component_ctlisc =
+{
+	.name = "CTL ISC",
+	.state = CTL_HA_STATE_UNKNOWN,
+	.init = ctl_isc_init,
+	.start = ctl_isc_start,
+	.quiesce = ctl_isc_quiesce
+};
+
+/*
+ *  vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,216 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl.h#5 $
+ * $FreeBSD: head/sys/cam/ctl/ctl.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * Function definitions used both within CTL and potentially in various CTL
+ * clients.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_H_
+#define	_CTL_H_
+
+#define	ctl_min(x,y)	(((x) < (y)) ? (x) : (y))
+#define	CTL_RETVAL_COMPLETE	0
+#define	CTL_RETVAL_QUEUED	1
+#define	CTL_RETVAL_ALLOCATED	2
+#define	CTL_RETVAL_ERROR	3
+
+typedef enum {
+	CTL_PORT_NONE		= 0x00,
+	CTL_PORT_FC		= 0x01,
+	CTL_PORT_SCSI		= 0x02,
+	CTL_PORT_IOCTL		= 0x04,
+	CTL_PORT_INTERNAL	= 0x08,
+	CTL_PORT_ALL		= 0xff,
+	CTL_PORT_ISC		= 0x100 // FC port for inter-shelf communication
+} ctl_port_type;
+
+struct ctl_port_entry {
+	ctl_port_type		port_type;
+	char			port_name[64];
+	int32_t			targ_port;
+	int			physical_port;
+	int			virtual_port;
+	u_int			flags;
+#define	CTL_PORT_WWNN_VALID	0x01
+#define	CTL_PORT_WWPN_VALID	0x02
+	uint64_t		wwnn;
+	uint64_t		wwpn;
+	int			online;
+};
+
+struct ctl_modepage_header {
+	uint8_t page_code;
+	uint8_t subpage;
+	int32_t len_used;
+	int32_t len_left;
+};
+
+struct ctl_modepage_aps {
+	struct ctl_modepage_header header;
+	uint8_t lock_active;
+};
+
+union ctl_modepage_info {
+	struct ctl_modepage_header header;
+	struct ctl_modepage_aps aps;
+};
+
+/*
+ * Serial number length, for VPD page 0x80.
+ */
+#define	CTL_SN_LEN	16
+
+/*
+ * Device ID length, for VPD page 0x83.
+ */
+#define	CTL_DEVID_LEN	16
+/*
+ * WWPN length, for VPD page 0x83.
+ */
+#define CTL_WWPN_LEN   8
+
+/*
+ * Unit attention types. ASC/ASCQ values for these should be placed in
+ * ctl_build_ua.  These are also listed in order of reporting priority.
+ * i.e. a poweron UA is reported first, bus reset second, etc.
+ */
+typedef enum {
+	CTL_UA_NONE		= 0x0000,
+	CTL_UA_POWERON		= 0x0001,
+	CTL_UA_BUS_RESET	= 0x0002,
+	CTL_UA_TARG_RESET	= 0x0004,
+	CTL_UA_LUN_RESET	= 0x0008,
+	CTL_UA_LUN_CHANGE	= 0x0010,
+	CTL_UA_MODE_CHANGE	= 0x0020,
+	CTL_UA_LOG_CHANGE	= 0x0040,
+	CTL_UA_LVD		= 0x0080,
+	CTL_UA_SE		= 0x0100,
+	CTL_UA_RES_PREEMPT	= 0x0200,
+	CTL_UA_RES_RELEASE	= 0x0400,
+	CTL_UA_REG_PREEMPT  	= 0x0800,
+	CTL_UA_ASYM_ACC_CHANGE  = 0x1000
+} ctl_ua_type;
+
+#ifdef	_KERNEL
+
+MALLOC_DECLARE(M_CTL);
+
+typedef enum {
+	CTL_THREAD_NONE		= 0x00,
+	CTL_THREAD_WAKEUP	= 0x01
+} ctl_thread_flags;
+
+struct ctl_thread {
+	void			(*thread_func)(void *arg);
+	void			*arg;
+	struct cv		wait_queue;
+	const char		*thread_name;
+	ctl_thread_flags	thread_flags;
+	struct completion	*thread_event;
+	struct task_struct	*task;
+};
+
+struct ctl_page_index;
+
+#ifdef SYSCTL_DECL	/* from sysctl.h */
+SYSCTL_DECL(_kern_cam_ctl);
+#endif
+
+/*
+ * Call these routines to enable or disable front end ports.
+ */
+int ctl_port_enable(ctl_port_type port_type);
+int ctl_port_disable(ctl_port_type port_type);
+/*
+ * This routine grabs a list of frontend ports.
+ */
+int ctl_port_list(struct ctl_port_entry *entries, int num_entries_alloced,
+		  int *num_entries_filled, int *num_entries_dropped,
+		  ctl_port_type port_type, int no_virtual);
+
+/*
+ * Put a string into an sbuf, escaping characters that are illegal or not
+ * recommended in XML.  Note this doesn't escape everything, just > < and &.
+ */
+int ctl_sbuf_printf_esc(struct sbuf *sb, char *str);
+
+int ctl_ffz(uint32_t *mask, uint32_t size);
+int ctl_set_mask(uint32_t *mask, uint32_t bit);
+int ctl_clear_mask(uint32_t *mask, uint32_t bit);
+int ctl_is_set(uint32_t *mask, uint32_t bit);
+int ctl_control_page_handler(struct ctl_scsiio *ctsio,
+			     struct ctl_page_index *page_index,
+			     uint8_t *page_ptr);
+/**
+int ctl_failover_sp_handler(struct ctl_scsiio *ctsio,
+			    struct ctl_page_index *page_index,
+			    uint8_t *page_ptr);
+**/
+int ctl_power_sp_handler(struct ctl_scsiio *ctsio,
+			 struct ctl_page_index *page_index, uint8_t *page_ptr);
+int ctl_power_sp_sense_handler(struct ctl_scsiio *ctsio,
+			       struct ctl_page_index *page_index, int pc);
+int ctl_aps_sp_handler(struct ctl_scsiio *ctsio,
+		       struct ctl_page_index *page_index, uint8_t *page_ptr);
+int ctl_debugconf_sp_sense_handler(struct ctl_scsiio *ctsio,
+				   struct ctl_page_index *page_index,
+				   int pc);
+int ctl_debugconf_sp_select_handler(struct ctl_scsiio *ctsio,
+				    struct ctl_page_index *page_index,
+				    uint8_t *page_ptr);
+int ctl_config_move_done(union ctl_io *io);
+void ctl_datamove(union ctl_io *io);
+void ctl_done(union ctl_io *io);
+void ctl_config_write_done(union ctl_io *io);
+#if 0
+int ctl_thread(void *arg);
+#endif
+void ctl_wakeup_thread(void);
+#if 0
+struct ctl_thread *ctl_create_thread(void (*thread_func)
+	(void *thread_arg), void *thread_arg, const char *thread_name);
+void ctl_signal_thread(struct ctl_thread *thread);
+void ctl_shutdown_thread(struct ctl_thread *thread);
+#endif
+void ctl_portDB_changed(int portnum);
+void ctl_init_isc_msg(void);
+
+#endif	/* _KERNEL */
+
+#endif	/* _CTL_H_ */
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_backend.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_backend.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,177 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_backend.c#3 $
+ */
+/*
+ * CTL backend driver registration routines
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_backend.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/queue.h>
+
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_ha.h>
+#include <cam/ctl/ctl_private.h>
+#include <cam/ctl/ctl_debug.h>
+
+extern struct ctl_softc *control_softc;
+
+int
+ctl_backend_register(struct ctl_backend_driver *be)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_backend_driver *be_tmp;
+
+	ctl_softc = control_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	/*
+	 * Sanity check, make sure this isn't a duplicate registration.
+	 */
+	STAILQ_FOREACH(be_tmp, &ctl_softc->be_list, links) {
+		if (strcmp(be_tmp->name, be->name) == 0) {
+			mtx_unlock(&ctl_softc->ctl_lock);
+			return (-1);
+		}
+	}
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	/*
+	 * Call the backend's initialization routine.
+	 */
+	be->init();
+
+	mtx_lock(&ctl_softc->ctl_lock);
+	
+	STAILQ_INSERT_TAIL(&ctl_softc->be_list, be, links);
+
+	ctl_softc->num_backends++;
+
+	/*
+	 * Don't want to increment the usage count for internal consumers,
+	 * we won't be able to unload otherwise.
+	 */
+	/* XXX KDM find a substitute for this? */
+#if 0
+	if ((be->flags & CTL_BE_FLAG_INTERNAL) == 0)
+		MOD_INC_USE_COUNT;
+#endif
+
+#ifdef CS_BE_CONFIG_MOVE_DONE_IS_NOT_USED
+	be->config_move_done = ctl_config_move_done;
+#endif
+	/* XXX KDM fix this! */
+	be->num_luns = 0;
+#if 0
+	atomic_set(&be->num_luns, 0);
+#endif
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+int
+ctl_backend_deregister(struct ctl_backend_driver *be)
+{
+	struct ctl_softc *ctl_softc;
+
+	ctl_softc = control_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+#if 0
+	if (atomic_read(&be->num_luns) != 0) {
+#endif
+	/* XXX KDM fix this! */
+	if (be->num_luns != 0) {
+		mtx_unlock(&ctl_softc->ctl_lock);
+		return (-1);
+	}
+
+	STAILQ_REMOVE(&ctl_softc->be_list, be, ctl_backend_driver, links);
+
+	ctl_softc->num_backends--;
+
+	/* XXX KDM find a substitute for this? */
+#if 0
+	if ((be->flags & CTL_BE_FLAG_INTERNAL) == 0)
+		MOD_DEC_USE_COUNT;
+#endif
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (0);
+}
+
+struct ctl_backend_driver *
+ctl_backend_find(char *backend_name)
+{
+	struct ctl_softc *ctl_softc;
+	struct ctl_backend_driver *be_tmp;
+
+	ctl_softc = control_softc;
+
+	mtx_lock(&ctl_softc->ctl_lock);
+
+	STAILQ_FOREACH(be_tmp, &ctl_softc->be_list, links) {
+		if (strcmp(be_tmp->name, backend_name) == 0) {
+			mtx_unlock(&ctl_softc->ctl_lock);
+			return (be_tmp);
+		}
+	}
+
+	mtx_unlock(&ctl_softc->ctl_lock);
+
+	return (NULL);
+}
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_backend.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_backend.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,288 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_backend.h#2 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_backend.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CTL backend driver definitions
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_BACKEND_H_
+#define	_CTL_BACKEND_H_
+
+/*
+ * XXX KDM move this to another header file?
+ */
+#define	CTL_BE_NAME_LEN		32
+
+/*
+ * The ID_REQ flag is used to say that the caller has requested a
+ * particular LUN ID in the req_lun_id field.  If we cannot allocate that
+ * LUN ID, the ctl_add_lun() call will fail.
+ *
+ * The POWERED_OFF flag tells us that the LUN should default to the powered
+ * off state.  It will return 0x04,0x02 until it is powered up.  ("Logical
+ * unit not ready, initializing command required.")
+ *
+ * The INOPERABLE flag tells us that this LUN is not operable for whatever
+ * reason.  This means that user data may have been (or has been?) lost.
+ * We will return 0x31,0x00 ("Medium format corrupted") until the host
+ * issues a FORMAT UNIT command to clear the error.
+ *
+ * The PRIMARY flag tells us that this LUN is registered as a Primary LUN
+ * which is accessible via the Master shelf controller in an HA. This flag
+ * being set indicates a Primary LUN. This flag being reset represents a
+ * Secondary LUN controlled by the Secondary controller in an HA
+ * configuration. Flag is applicable at this time to T_DIRECT types. 
+ *
+ * The SERIAL_NUM flag tells us that the serial_num field is filled in and
+ * valid for use in SCSI INQUIRY VPD page 0x80.
+ *
+ * The DEVID flag tells us that the device_id field is filled in and
+ * valid for use in SCSI INQUIRY VPD page 0x83.
+ *
+ * The DEV_TYPE flag tells us that the device_type field is filled in.
+ */
+typedef enum {
+	CTL_LUN_FLAG_ID_REQ		= 0x01,
+	CTL_LUN_FLAG_POWERED_OFF	= 0x02,
+	CTL_LUN_FLAG_INOPERABLE		= 0x04,
+	CTL_LUN_FLAG_PRIMARY		= 0x08,
+	CTL_LUN_FLAG_SERIAL_NUM		= 0x10,
+	CTL_LUN_FLAG_DEVID		= 0x20,
+	CTL_LUN_FLAG_DEV_TYPE		= 0x40
+} ctl_backend_lun_flags;
+
+#ifdef _KERNEL
+
+#define CTL_BACKEND_DECLARE(name, driver) \
+	static int name ## _modevent(module_t mod, int type, void *data) \
+	{ \
+		switch (type) { \
+		case MOD_LOAD: \
+			ctl_backend_register( \
+				(struct ctl_backend_driver *)data); \
+			break; \
+		case MOD_UNLOAD: \
+			printf(#name " module unload - not possible for this module type\n"); \
+			return EINVAL; \
+		default: \
+			return EOPNOTSUPP; \
+		} \
+		return 0; \
+	} \
+	static moduledata_t name ## _mod = { \
+		#name, \
+		name ## _modevent, \
+		(void *)&driver \
+	}; \
+	DECLARE_MODULE(name, name ## _mod, SI_SUB_CONFIGURE, SI_ORDER_FOURTH); \
+	MODULE_DEPEND(name, ctl, 1, 1, 1); \
+	MODULE_DEPEND(name, cam, 1, 1, 1)
+
+
+typedef enum {
+	CTL_LUN_CONFIG_OK,
+	CTL_LUN_CONFIG_FAILURE
+} ctl_lun_config_status;
+
+typedef void (*be_callback_t)(void *be_lun);
+typedef void (*be_lun_config_t)(void *be_lun,
+				ctl_lun_config_status status);
+
+/*
+ * The lun_type field is the SCSI device type of this particular LUN.  In
+ * general, this should be T_DIRECT, although backends will want to create
+ * a processor LUN, typically at LUN 0.  See scsi_all.h for the defines for
+ * the various SCSI device types.
+ *
+ * The flags are described above.
+ *
+ * The be_lun field is the backend driver's own context that will get
+ * passsed back so that it can tell which LUN CTL is referencing.
+ *
+ * maxlba is the maximum accessible LBA on the LUN.  Note that this is
+ * different from the capacity of the array.  capacity = maxlba + 1
+ *
+ * blocksize is the size, in bytes, of each LBA on the LUN.  In general
+ * this should be 512.  In theory CTL should be able to handle other block
+ * sizes.  Host application software may not deal with it very well, though.
+ *
+ * req_lun_id is the requested LUN ID.  CTL only pays attention to this
+ * field if the CTL_LUN_FLAG_ID_REQ flag is set.  If the requested LUN ID is
+ * not available, the LUN addition will fail.  If a particular LUN ID isn't
+ * requested, the first available LUN ID will be allocated.
+ *
+ * serial_num is the device serial number returned in the SCSI INQUIRY VPD
+ * page 0x80.  This should be a unique, per-shelf value.  The data inside
+ * this field should be ASCII only, left aligned, and any unused space
+ * should be padded out with ASCII spaces.  This field should NOT be NULL
+ * terminated.
+ *
+ * device_id is the T10 device identifier returned in the SCSI INQUIRY VPD
+ * page 0x83.  This should be a unique, per-LUN value.  The data inside
+ * this field should be ASCII only, left aligned, and any unused space
+ * should be padded with ASCII spaces.  This field should NOT be NULL
+ * terminated.
+ *
+ * The lun_shutdown() method is the callback for the ctl_invalidate_lun()
+ * call.  It is called when all outstanding I/O for that LUN has been
+ * completed and CTL has deleted the resources for that LUN.  When the CTL
+ * backend gets this call, it can safely free its per-LUN resources.
+ *
+ * The lun_config_status() method is the callback for the ctl_add_lun()
+ * call.  It is called when the LUN is successfully added, or when LUN
+ * addition fails.  If the LUN is successfully added, the backend may call
+ * the ctl_enable_lun() method to enable the LUN.
+ *
+ * The be field is a pointer to the ctl_backend_driver structure, which
+ * contains the backend methods to be called by CTL.
+ *
+ * The ctl_lun field is for CTL internal use only, and should not be used
+ * by the backend.
+ *
+ * The links field is for CTL internal use only, and should not be used by
+ * the backend.
+ */
+struct ctl_be_lun {
+	uint8_t			lun_type;	/* passed to CTL */
+	ctl_backend_lun_flags	flags;		/* passed to CTL */
+	void			*be_lun;	/* passed to CTL */
+	uint64_t		maxlba;		/* passed to CTL */
+	uint32_t		blocksize;	/* passed to CTL */
+	uint32_t		req_lun_id;	/* passed to CTL */
+	uint32_t		lun_id;		/* returned from CTL */
+	uint8_t			serial_num[CTL_SN_LEN];	 /* passed to CTL */
+	uint8_t			device_id[CTL_DEVID_LEN];/* passed to CTL */
+	be_callback_t		lun_shutdown;	/* passed to CTL */
+	be_lun_config_t		lun_config_status; /* passed to CTL */
+	struct ctl_backend_driver *be;		/* passed to CTL */
+	void			*ctl_lun;	/* used by CTL */
+	STAILQ_ENTRY(ctl_be_lun) links;		/* used by CTL */
+};
+
+typedef enum {
+	CTL_BE_FLAG_NONE	= 0x00,	/* no flags */
+	CTL_BE_FLAG_HAS_CONFIG	= 0x01,	/* can do config reads, writes */
+	CTL_BE_FLAG_INTERNAL	= 0x02	/* don't inc mod refcount */
+} ctl_backend_flags;
+
+typedef int (*be_init_t)(void);
+typedef int (*be_func_t)(union ctl_io *io);
+typedef void (*be_vfunc_t)(union ctl_io *io);
+typedef int (*be_ioctl_t)(struct cdev *dev, u_long cmd, caddr_t addr, int flag,
+			  struct thread *td);
+typedef int (*be_luninfo_t)(void *be_lun, struct sbuf *sb);
+
+struct ctl_backend_driver {
+	char		  name[CTL_BE_NAME_LEN]; /* passed to CTL */
+	ctl_backend_flags flags;	         /* passed to CTL */
+	be_init_t	  init;			 /* passed to CTL */
+	be_func_t	  data_submit;		 /* passed to CTL */
+	be_func_t	  data_move_done;	 /* passed to CTL */
+	be_func_t	  config_read;		 /* passed to CTL */
+	be_func_t	  config_write;		 /* passed to CTL */
+	be_ioctl_t	  ioctl;		 /* passed to CTL */
+	be_luninfo_t	  lun_info;		 /* passed to CTL */
+#ifdef CS_BE_CONFIG_MOVE_DONE_IS_NOT_USED
+	be_func_t	  config_move_done;	 /* passed to backend */
+#endif
+#if 0
+	be_vfunc_t	  config_write_done;	 /* passed to backend */
+#endif
+	u_int		  num_luns;		 /* used by CTL */
+	STAILQ_ENTRY(ctl_backend_driver) links;	 /* used by CTL */
+};
+
+int ctl_backend_register(struct ctl_backend_driver *be);
+int ctl_backend_deregister(struct ctl_backend_driver *be);
+struct ctl_backend_driver *ctl_backend_find(char *backend_name);
+
+/*
+ * To add a LUN, first call ctl_add_lun().  You will get the lun_config_status()
+ * callback when the LUN addition has either succeeded or failed.
+ *
+ * Once you get that callback, you can then call ctl_enable_lun() to enable
+ * the LUN.
+ */
+int ctl_add_lun(struct ctl_be_lun *be_lun);
+int ctl_enable_lun(struct ctl_be_lun *be_lun);
+
+/*
+ * To delete a LUN, first call ctl_disable_lun(), then
+ * ctl_invalidate_lun().  You will get the lun_shutdown() callback when all
+ * I/O to the LUN has completed and the LUN has been deleted.
+ */
+int ctl_disable_lun(struct ctl_be_lun *be_lun);
+int ctl_invalidate_lun(struct ctl_be_lun *be_lun);
+
+/*
+ * To start a LUN (transition from powered off to powered on state) call
+ * ctl_start_lun().  To stop a LUN (transition from powered on to powered
+ * off state) call ctl_stop_lun().
+ */
+int ctl_start_lun(struct ctl_be_lun *be_lun);
+int ctl_stop_lun(struct ctl_be_lun *be_lun);
+
+/*
+ * If a LUN is inoperable, call ctl_lun_inoperable().  Generally the LUN
+ * will become operable once again when the user issues the SCSI FORMAT UNIT
+ * command.  (CTL will automatically clear the inoperable flag.)  If we
+ * need to re-enable the LUN, we can call ctl_lun_operable() to enable it
+ * without a SCSI command.
+ */
+int ctl_lun_inoperable(struct ctl_be_lun *be_lun);
+int ctl_lun_operable(struct ctl_be_lun *be_lun);
+
+/*
+ * If a LUN is locked on or unlocked from a power/APS standpoint, call
+ * ctl_lun_power_lock() to update the current status in CTL's APS subpage.
+ * Set the lock flag to 1 to lock the LUN, set it to 0 to unlock the LUN.
+ */
+int ctl_lun_power_lock(struct ctl_be_lun *be_lun, struct ctl_nexus *nexus,
+		       int lock);
+
+/*
+ * To take a LUN offline, call ctl_lun_offline().  Generally the LUN will
+ * be online again once the user sends a SCSI START STOP UNIT command with
+ * the start and on/offline bits set.  The backend can bring the LUN back
+ * online via the ctl_lun_online() function, if necessary.
+ */
+int ctl_lun_offline(struct ctl_be_lun *be_lun);
+int ctl_lun_online(struct ctl_be_lun *be_lun);
+
+#endif /* _KERNEL */
+#endif /* _CTL_BACKEND_H_ */
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_backend_block.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_backend_block.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,2213 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * Copyright (c) 2009-2011 Spectra Logic Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_backend_block.c#5 $
+ */
+/*
+ * CAM Target Layer driver backend for block devices.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_backend_block.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <opt_kdtrace.h>
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/kthread.h>
+#include <sys/bio.h>
+#include <sys/fcntl.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/malloc.h>
+#include <sys/conf.h>
+#include <sys/ioccom.h>
+#include <sys/queue.h>
+#include <sys/sbuf.h>
+#include <sys/endian.h>
+#include <sys/uio.h>
+#include <sys/buf.h>
+#include <sys/taskqueue.h>
+#include <sys/vnode.h>
+#include <sys/namei.h>
+#include <sys/mount.h>
+#include <sys/disk.h>
+#include <sys/fcntl.h>
+#include <sys/filedesc.h>
+#include <sys/proc.h>
+#include <sys/pcpu.h>
+#include <sys/module.h>
+#include <sys/sdt.h>
+#include <sys/devicestat.h>
+#include <sys/sysctl.h>
+
+#include <geom/geom.h>
+
+#include <cam/cam.h>
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_scsi_all.h>
+#include <cam/ctl/ctl_error.h>
+
+/*
+ * The idea here is that we'll allocate enough S/G space to hold a 16MB
+ * I/O.  If we get an I/O larger than that, we'll reject it.
+ */
+#define	CTLBLK_MAX_IO_SIZE	(16 * 1024 * 1024)
+#define	CTLBLK_MAX_SEGS		(CTLBLK_MAX_IO_SIZE / MAXPHYS) + 1
+
+#ifdef CTLBLK_DEBUG
+#define DPRINTF(fmt, args...) \
+    printf("cbb(%s:%d): " fmt, __FUNCTION__, __LINE__, ##args)
+#else
+#define DPRINTF(fmt, args...) do {} while(0)
+#endif
+
+SDT_PROVIDER_DEFINE(cbb);
+
+typedef enum {
+	CTL_BE_BLOCK_LUN_UNCONFIGURED	= 0x01,
+	CTL_BE_BLOCK_LUN_CONFIG_ERR	= 0x02,
+	CTL_BE_BLOCK_LUN_WAITING	= 0x04,
+	CTL_BE_BLOCK_LUN_MULTI_THREAD	= 0x08
+} ctl_be_block_lun_flags;
+
+typedef enum {
+	CTL_BE_BLOCK_NONE,
+	CTL_BE_BLOCK_DEV,
+	CTL_BE_BLOCK_FILE
+} ctl_be_block_type;
+
+struct ctl_be_block_devdata {
+	struct cdev *cdev;
+	struct cdevsw *csw;
+	int dev_ref;
+};
+
+struct ctl_be_block_filedata {
+	struct ucred *cred;
+};
+
+union ctl_be_block_bedata {
+	struct ctl_be_block_devdata dev;
+	struct ctl_be_block_filedata file;
+};
+
+struct ctl_be_block_io;
+struct ctl_be_block_lun;
+
+typedef void (*cbb_dispatch_t)(struct ctl_be_block_lun *be_lun,
+			       struct ctl_be_block_io *beio);
+
+/*
+ * Backend LUN structure.  There is a 1:1 mapping between a block device
+ * and a backend block LUN, and between a backend block LUN and a CTL LUN.
+ */
+struct ctl_be_block_lun {
+	struct ctl_block_disk *disk;
+	char lunname[32];
+	char *dev_path;
+	ctl_be_block_type dev_type;
+	struct vnode *vn;
+	union ctl_be_block_bedata backend;
+	cbb_dispatch_t dispatch;
+	cbb_dispatch_t lun_flush;
+	struct mtx lock;
+	uma_zone_t lun_zone;
+	uint64_t size_blocks;
+	uint64_t size_bytes;
+	uint32_t blocksize;
+	int blocksize_shift;
+	struct ctl_be_block_softc *softc;
+	struct devstat *disk_stats;
+	ctl_be_block_lun_flags flags;
+	STAILQ_ENTRY(ctl_be_block_lun) links;
+	struct ctl_be_lun ctl_be_lun;
+	struct taskqueue *io_taskqueue;
+	struct task io_task;
+	int num_threads;
+	STAILQ_HEAD(, ctl_io_hdr) input_queue;
+	STAILQ_HEAD(, ctl_io_hdr) config_write_queue;
+	STAILQ_HEAD(, ctl_io_hdr) datamove_queue;
+};
+
+/*
+ * Overall softc structure for the block backend module.
+ */
+struct ctl_be_block_softc {
+	STAILQ_HEAD(, ctl_be_block_io)   beio_free_queue;
+	struct mtx			 lock;
+	int				 prealloc_beio;
+	int				 num_disks;
+	STAILQ_HEAD(, ctl_block_disk)	 disk_list;
+	int				 num_luns;
+	STAILQ_HEAD(, ctl_be_block_lun)	 lun_list;
+};
+
+static struct ctl_be_block_softc backend_block_softc;
+
+/*
+ * Per-I/O information.
+ */
+struct ctl_be_block_io {
+	union ctl_io			*io;
+	struct ctl_sg_entry		sg_segs[CTLBLK_MAX_SEGS];
+	struct iovec			xiovecs[CTLBLK_MAX_SEGS];
+	int				bio_cmd;
+	int				bio_flags;
+	int				num_segs;
+	int				num_bios_sent;
+	int				num_bios_done;
+	int				send_complete;
+	int				num_errors;
+	struct bintime			ds_t0;
+	devstat_tag_type		ds_tag_type;
+	devstat_trans_flags		ds_trans_type;
+	uint64_t			io_len;
+	uint64_t			io_offset;
+	struct ctl_be_block_softc	*softc;
+	struct ctl_be_block_lun		*lun;
+	STAILQ_ENTRY(ctl_be_block_io)	links;
+};
+
+static int cbb_num_threads = 14;
+TUNABLE_INT("kern.cam.ctl.block.num_threads", &cbb_num_threads);
+SYSCTL_NODE(_kern_cam_ctl, OID_AUTO, block, CTLFLAG_RD, 0,
+	    "CAM Target Layer Block Backend");
+SYSCTL_INT(_kern_cam_ctl_block, OID_AUTO, num_threads, CTLFLAG_RW,
+           &cbb_num_threads, 0, "Number of threads per backing file");
+
+static struct ctl_be_block_io *ctl_alloc_beio(struct ctl_be_block_softc *softc);
+static void ctl_free_beio(struct ctl_be_block_io *beio);
+static int ctl_grow_beio(struct ctl_be_block_softc *softc, int count);
+#if 0
+static void ctl_shrink_beio(struct ctl_be_block_softc *softc);
+#endif
+static void ctl_complete_beio(struct ctl_be_block_io *beio);
+static int ctl_be_block_move_done(union ctl_io *io);
+static void ctl_be_block_biodone(struct bio *bio);
+static void ctl_be_block_flush_file(struct ctl_be_block_lun *be_lun,
+				    struct ctl_be_block_io *beio);
+static void ctl_be_block_dispatch_file(struct ctl_be_block_lun *be_lun,
+				       struct ctl_be_block_io *beio);
+static void ctl_be_block_flush_dev(struct ctl_be_block_lun *be_lun,
+				   struct ctl_be_block_io *beio);
+static void ctl_be_block_dispatch_dev(struct ctl_be_block_lun *be_lun,
+				      struct ctl_be_block_io *beio);
+static void ctl_be_block_cw_dispatch(struct ctl_be_block_lun *be_lun,
+				    union ctl_io *io);
+static void ctl_be_block_dispatch(struct ctl_be_block_lun *be_lun,
+				  union ctl_io *io);
+static void ctl_be_block_worker(void *context, int pending);
+static int ctl_be_block_submit(union ctl_io *io);
+static int ctl_be_block_ioctl(struct cdev *dev, u_long cmd, caddr_t addr,
+				   int flag, struct thread *td);
+static int ctl_be_block_open_file(struct ctl_be_block_lun *be_lun,
+				  struct ctl_lun_req *req);
+static int ctl_be_block_open_dev(struct ctl_be_block_lun *be_lun,
+				 struct ctl_lun_req *req);
+static int ctl_be_block_close(struct ctl_be_block_lun *be_lun);
+static int ctl_be_block_open(struct ctl_be_block_softc *softc,
+			     struct ctl_be_block_lun *be_lun,
+			     struct ctl_lun_req *req);
+static int ctl_be_block_create(struct ctl_be_block_softc *softc,
+			       struct ctl_lun_req *req);
+static int ctl_be_block_rm(struct ctl_be_block_softc *softc,
+			   struct ctl_lun_req *req);
+static void ctl_be_block_lun_shutdown(void *be_lun);
+static void ctl_be_block_lun_config_status(void *be_lun,
+					   ctl_lun_config_status status);
+static int ctl_be_block_config_write(union ctl_io *io);
+static int ctl_be_block_config_read(union ctl_io *io);
+static int ctl_be_block_lun_info(void *be_lun, struct sbuf *sb);
+int ctl_be_block_init(void);
+
+static struct ctl_backend_driver ctl_be_block_driver = 
+{
+	name: "block",
+	flags: CTL_BE_FLAG_HAS_CONFIG,
+	init: ctl_be_block_init,
+	data_submit: ctl_be_block_submit,
+	data_move_done: ctl_be_block_move_done,
+	config_read: ctl_be_block_config_read,
+	config_write: ctl_be_block_config_write,
+	ioctl: ctl_be_block_ioctl,
+	lun_info: ctl_be_block_lun_info
+};
+
+MALLOC_DEFINE(M_CTLBLK, "ctlblk", "Memory used for CTL block backend");
+CTL_BACKEND_DECLARE(cbb, ctl_be_block_driver);
+
+static struct ctl_be_block_io *
+ctl_alloc_beio(struct ctl_be_block_softc *softc)
+{
+	struct ctl_be_block_io *beio;
+	int count;
+
+	mtx_lock(&softc->lock);
+
+	beio = STAILQ_FIRST(&softc->beio_free_queue);
+	if (beio != NULL) {
+		STAILQ_REMOVE(&softc->beio_free_queue, beio,
+			      ctl_be_block_io, links);
+	}
+	mtx_unlock(&softc->lock);
+
+	if (beio != NULL) {
+		bzero(beio, sizeof(*beio));
+		beio->softc = softc;
+		return (beio);
+	}
+
+	for (;;) {
+
+		count = ctl_grow_beio(softc, /*count*/ 10);
+
+		/*
+		 * This shouldn't be possible, since ctl_grow_beio() uses a
+		 * blocking malloc.
+		 */
+		if (count == 0)
+			return (NULL);
+
+		/*
+		 * Since we have to drop the lock when we're allocating beio
+		 * structures, it's possible someone else can come along and
+		 * allocate the beio's we've just allocated.
+		 */
+		mtx_lock(&softc->lock);
+		beio = STAILQ_FIRST(&softc->beio_free_queue);
+		if (beio != NULL) {
+			STAILQ_REMOVE(&softc->beio_free_queue, beio,
+				      ctl_be_block_io, links);
+		}
+		mtx_unlock(&softc->lock);
+
+		if (beio != NULL) {
+			bzero(beio, sizeof(*beio));
+			beio->softc = softc;
+			break;
+		}
+	}
+	return (beio);
+}
+
+static void
+ctl_free_beio(struct ctl_be_block_io *beio)
+{
+	struct ctl_be_block_softc *softc;
+	int duplicate_free;
+	int i;
+
+	softc = beio->softc;
+	duplicate_free = 0;
+
+	for (i = 0; i < beio->num_segs; i++) {
+		if (beio->sg_segs[i].addr == NULL)
+			duplicate_free++;
+
+		uma_zfree(beio->lun->lun_zone, beio->sg_segs[i].addr);
+		beio->sg_segs[i].addr = NULL;
+	}
+
+	if (duplicate_free > 0) {
+		printf("%s: %d duplicate frees out of %d segments\n", __func__,
+		       duplicate_free, beio->num_segs);
+	}
+	mtx_lock(&softc->lock);
+	STAILQ_INSERT_TAIL(&softc->beio_free_queue, beio, links);
+	mtx_unlock(&softc->lock);
+}
+
+static int
+ctl_grow_beio(struct ctl_be_block_softc *softc, int count)
+{
+	int i;
+
+	for (i = 0; i < count; i++) {
+		struct ctl_be_block_io *beio;
+
+		beio = (struct ctl_be_block_io *)malloc(sizeof(*beio),
+							   M_CTLBLK,
+							   M_WAITOK | M_ZERO);
+		if (beio == NULL)
+			break;
+
+		bzero(beio, sizeof(*beio));
+		beio->softc = softc;
+		mtx_lock(&softc->lock);
+		STAILQ_INSERT_TAIL(&softc->beio_free_queue, beio, links);
+		mtx_unlock(&softc->lock);
+	}
+
+	return (i);
+}
+
+#if 0
+static void
+ctl_shrink_beio(struct ctl_be_block_softc *softc)
+{
+	struct ctl_be_block_io *beio, *beio_tmp;
+
+	mtx_lock(&softc->lock);
+	STAILQ_FOREACH_SAFE(beio, &softc->beio_free_queue, links, beio_tmp) {
+		STAILQ_REMOVE(&softc->beio_free_queue, beio,
+			      ctl_be_block_io, links);
+		free(beio, M_CTLBLK);
+	}
+	mtx_unlock(&softc->lock);
+}
+#endif
+
+static void
+ctl_complete_beio(struct ctl_be_block_io *beio)
+{
+	union ctl_io *io;
+	int io_len;
+
+	io = beio->io;
+
+	if ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS)
+		io_len = beio->io_len;
+	else
+		io_len = 0;
+
+	devstat_end_transaction(beio->lun->disk_stats,
+				/*bytes*/ io_len,
+				beio->ds_tag_type,
+				beio->ds_trans_type,
+				/*now*/ NULL,
+				/*then*/&beio->ds_t0);
+
+	ctl_free_beio(beio);
+	ctl_done(io);
+}
+
+static int
+ctl_be_block_move_done(union ctl_io *io)
+{
+	struct ctl_be_block_io *beio;
+	struct ctl_be_block_lun *be_lun;
+#ifdef CTL_TIME_IO
+	struct bintime cur_bt;
+#endif  
+
+	beio = (struct ctl_be_block_io *)
+		io->io_hdr.ctl_private[CTL_PRIV_BACKEND].ptr;
+
+	be_lun = beio->lun;
+
+	DPRINTF("entered\n");
+
+#ifdef CTL_TIME_IO
+	getbintime(&cur_bt);
+	bintime_sub(&cur_bt, &io->io_hdr.dma_start_bt);
+	bintime_add(&io->io_hdr.dma_bt, &cur_bt);
+	io->io_hdr.num_dmas++;
+#endif  
+
+	/*
+	 * We set status at this point for read commands, and write
+	 * commands with errors.
+	 */
+	if ((beio->bio_cmd == BIO_READ)
+	 && (io->io_hdr.port_status == 0)
+	 && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
+	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE))
+		ctl_set_success(&io->scsiio);
+	else if ((io->io_hdr.port_status != 0)
+	      && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
+	      && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)) {
+		/*
+		 * For hardware error sense keys, the sense key
+		 * specific value is defined to be a retry count,
+		 * but we use it to pass back an internal FETD
+		 * error code.  XXX KDM  Hopefully the FETD is only
+		 * using 16 bits for an error code, since that's
+		 * all the space we have in the sks field.
+		 */
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 1,
+					 /*retry_count*/
+					 io->io_hdr.port_status);
+	}
+
+	/*
+	 * If this is a read, or a write with errors, it is done.
+	 */
+	if ((beio->bio_cmd == BIO_READ)
+	 || ((io->io_hdr.flags & CTL_FLAG_ABORT) != 0)
+	 || ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE)) {
+		ctl_complete_beio(beio);
+		return (0);
+	}
+
+	/*
+	 * At this point, we have a write and the DMA completed
+	 * successfully.  We now have to queue it to the task queue to
+	 * execute the backend I/O.  That is because we do blocking
+	 * memory allocations, and in the file backing case, blocking I/O.
+	 * This move done routine is generally called in the SIM's
+	 * interrupt context, and therefore we cannot block.
+	 */
+	mtx_lock(&be_lun->lock);
+	/*
+	 * XXX KDM make sure that links is okay to use at this point.
+	 * Otherwise, we either need to add another field to ctl_io_hdr,
+	 * or deal with resource allocation here.
+	 */
+	STAILQ_INSERT_TAIL(&be_lun->datamove_queue, &io->io_hdr, links);
+	mtx_unlock(&be_lun->lock);
+
+	taskqueue_enqueue(be_lun->io_taskqueue, &be_lun->io_task);
+
+	return (0);
+}
+
+static void
+ctl_be_block_biodone(struct bio *bio)
+{
+	struct ctl_be_block_io *beio;
+	struct ctl_be_block_lun *be_lun;
+	union ctl_io *io;
+
+	beio = bio->bio_caller1;
+	be_lun = beio->lun;
+	io = beio->io;
+
+	DPRINTF("entered\n");
+
+	mtx_lock(&be_lun->lock);
+	if (bio->bio_error != 0)
+		beio->num_errors++;
+
+	beio->num_bios_done++;
+
+	/*
+	 * XXX KDM will this cause WITNESS to complain?  Holding a lock
+	 * during the free might cause it to complain.
+	 */
+	g_destroy_bio(bio);
+
+	/*
+	 * If the send complete bit isn't set, or we aren't the last I/O to
+	 * complete, then we're done.
+	 */
+	if ((beio->send_complete == 0)
+	 || (beio->num_bios_done < beio->num_bios_sent)) {
+		mtx_unlock(&be_lun->lock);
+		return;
+	}
+
+	/*
+	 * At this point, we've verified that we are the last I/O to
+	 * complete, so it's safe to drop the lock.
+	 */
+	mtx_unlock(&be_lun->lock);
+
+	/*
+	 * If there are any errors from the backing device, we fail the
+	 * entire I/O with a medium error.
+	 */
+	if (beio->num_errors > 0) {
+		if (beio->bio_cmd == BIO_FLUSH) {
+			/* XXX KDM is there is a better error here? */
+			ctl_set_internal_failure(&io->scsiio,
+						 /*sks_valid*/ 1,
+						 /*retry_count*/ 0xbad2);
+		} else
+			ctl_set_medium_error(&io->scsiio);
+		ctl_complete_beio(beio);
+		return;
+	}
+
+	/*
+	 * If this is a write or a flush, we're all done.
+	 * If this is a read, we can now send the data to the user.
+	 */
+	if ((beio->bio_cmd == BIO_WRITE)
+	 || (beio->bio_cmd == BIO_FLUSH)) {
+		ctl_set_success(&io->scsiio);
+		ctl_complete_beio(beio);
+	} else {
+		io->scsiio.be_move_done = ctl_be_block_move_done;
+		io->scsiio.kern_data_ptr = (uint8_t *)beio->sg_segs;
+		io->scsiio.kern_data_len = beio->io_len;
+		io->scsiio.kern_total_len = beio->io_len;
+		io->scsiio.kern_rel_offset = 0;
+		io->scsiio.kern_data_resid = 0;
+		io->scsiio.kern_sg_entries = beio->num_segs;
+		io->io_hdr.flags |= CTL_FLAG_ALLOCATED | CTL_FLAG_KDPTR_SGLIST;
+#ifdef CTL_TIME_IO
+        	getbintime(&io->io_hdr.dma_start_bt);
+#endif  
+		ctl_datamove(io);
+	}
+}
+
+static void
+ctl_be_block_flush_file(struct ctl_be_block_lun *be_lun,
+			struct ctl_be_block_io *beio)
+{
+	union ctl_io *io;
+	struct mount *mountpoint;
+	int vfs_is_locked, error, lock_flags;
+
+	DPRINTF("entered\n");
+
+	io = beio->io;
+
+	vfs_is_locked = VFS_LOCK_GIANT(be_lun->vn->v_mount);
+
+       	(void) vn_start_write(be_lun->vn, &mountpoint, V_WAIT);
+
+	if (MNT_SHARED_WRITES(mountpoint)
+	 || ((mountpoint == NULL)
+	  && MNT_SHARED_WRITES(be_lun->vn->v_mount)))
+		lock_flags = LK_SHARED;
+	else
+		lock_flags = LK_EXCLUSIVE;
+
+	vn_lock(be_lun->vn, lock_flags | LK_RETRY);
+
+	binuptime(&beio->ds_t0);
+	devstat_start_transaction(beio->lun->disk_stats, &beio->ds_t0);
+
+	error = VOP_FSYNC(be_lun->vn, MNT_WAIT, curthread);
+	VOP_UNLOCK(be_lun->vn, 0);
+
+	vn_finished_write(mountpoint);
+
+	VFS_UNLOCK_GIANT(vfs_is_locked);
+
+	if (error == 0)
+		ctl_set_success(&io->scsiio);
+	else {
+		/* XXX KDM is there is a better error here? */
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 1,
+					 /*retry_count*/ 0xbad1);
+	}
+
+	ctl_complete_beio(beio);
+}
+
+SDT_PROBE_DEFINE1(cbb, kernel, read, file_start, file_start, "uint64_t");
+SDT_PROBE_DEFINE1(cbb, kernel, write, file_start, file_start, "uint64_t");
+SDT_PROBE_DEFINE1(cbb, kernel, read, file_done, file_done,"uint64_t");
+SDT_PROBE_DEFINE1(cbb, kernel, write, file_done, file_done, "uint64_t");
+
+static void
+ctl_be_block_dispatch_file(struct ctl_be_block_lun *be_lun,
+			   struct ctl_be_block_io *beio)
+{
+	struct ctl_be_block_filedata *file_data;
+	union ctl_io *io;
+	struct uio xuio;
+	struct iovec *xiovec;
+	int vfs_is_locked, flags;
+	int error, i;
+
+	DPRINTF("entered\n");
+
+	file_data = &be_lun->backend.file;
+	io = beio->io;
+	flags = beio->bio_flags;
+
+	if (beio->bio_cmd == BIO_READ) {
+		SDT_PROBE(cbb, kernel, read, file_start, 0, 0, 0, 0, 0);
+	} else {
+		SDT_PROBE(cbb, kernel, write, file_start, 0, 0, 0, 0, 0);
+	}
+
+	bzero(&xuio, sizeof(xuio));
+	if (beio->bio_cmd == BIO_READ)
+		xuio.uio_rw = UIO_READ;
+	else
+		xuio.uio_rw = UIO_WRITE;
+
+	xuio.uio_offset = beio->io_offset;
+	xuio.uio_resid = beio->io_len;
+	xuio.uio_segflg = UIO_SYSSPACE;
+	xuio.uio_iov = beio->xiovecs;
+	xuio.uio_iovcnt = beio->num_segs;
+	xuio.uio_td = curthread;
+
+	for (i = 0, xiovec = xuio.uio_iov; i < xuio.uio_iovcnt; i++, xiovec++) {
+		xiovec->iov_base = beio->sg_segs[i].addr;
+		xiovec->iov_len = beio->sg_segs[i].len;
+	}
+
+	vfs_is_locked = VFS_LOCK_GIANT(be_lun->vn->v_mount);
+	if (beio->bio_cmd == BIO_READ) {
+		vn_lock(be_lun->vn, LK_SHARED | LK_RETRY);
+
+		binuptime(&beio->ds_t0);
+		devstat_start_transaction(beio->lun->disk_stats, &beio->ds_t0);
+
+		/*
+		 * UFS pays attention to IO_DIRECT for reads.  If the
+		 * DIRECTIO option is configured into the kernel, it calls
+		 * ffs_rawread().  But that only works for single-segment
+		 * uios with user space addresses.  In our case, with a
+		 * kernel uio, it still reads into the buffer cache, but it
+		 * will just try to release the buffer from the cache later
+		 * on in ffs_read().
+		 *
+		 * ZFS does not pay attention to IO_DIRECT for reads.
+		 *
+		 * UFS does not pay attention to IO_SYNC for reads.
+		 *
+		 * ZFS pays attention to IO_SYNC (which translates into the
+		 * Solaris define FRSYNC for zfs_read()) for reads.  It
+		 * attempts to sync the file before reading.
+		 *
+		 * So, to attempt to provide some barrier semantics in the
+		 * BIO_ORDERED case, set both IO_DIRECT and IO_SYNC.
+		 */
+		error = VOP_READ(be_lun->vn, &xuio, (flags & BIO_ORDERED) ?
+				 (IO_DIRECT|IO_SYNC) : 0, file_data->cred);
+
+		VOP_UNLOCK(be_lun->vn, 0);
+	} else {
+		struct mount *mountpoint;
+		int lock_flags;
+
+		(void)vn_start_write(be_lun->vn, &mountpoint, V_WAIT);
+
+		if (MNT_SHARED_WRITES(mountpoint)
+		 || ((mountpoint == NULL)
+		  && MNT_SHARED_WRITES(be_lun->vn->v_mount)))
+			lock_flags = LK_SHARED;
+		else
+			lock_flags = LK_EXCLUSIVE;
+
+		vn_lock(be_lun->vn, lock_flags | LK_RETRY);
+
+		binuptime(&beio->ds_t0);
+		devstat_start_transaction(beio->lun->disk_stats, &beio->ds_t0);
+
+		/*
+		 * UFS pays attention to IO_DIRECT for writes.  The write
+		 * is done asynchronously.  (Normally the write would just
+		 * get put into cache.
+		 *
+		 * UFS pays attention to IO_SYNC for writes.  It will
+		 * attempt to write the buffer out synchronously if that
+		 * flag is set.
+		 *
+		 * ZFS does not pay attention to IO_DIRECT for writes.
+		 *
+		 * ZFS pays attention to IO_SYNC (a.k.a. FSYNC or FRSYNC)
+		 * for writes.  It will flush the transaction from the
+		 * cache before returning.
+		 *
+		 * So if we've got the BIO_ORDERED flag set, we want
+		 * IO_SYNC in either the UFS or ZFS case.
+		 */
+		error = VOP_WRITE(be_lun->vn, &xuio, (flags & BIO_ORDERED) ?
+				  IO_SYNC : 0, file_data->cred);
+		VOP_UNLOCK(be_lun->vn, 0);
+
+		vn_finished_write(mountpoint);
+        }
+        VFS_UNLOCK_GIANT(vfs_is_locked);
+
+	/*
+	 * If we got an error, set the sense data to "MEDIUM ERROR" and
+	 * return the I/O to the user.
+	 */
+	if (error != 0) {
+		char path_str[32];
+
+		ctl_scsi_path_string(io, path_str, sizeof(path_str));
+		/*
+		 * XXX KDM ZFS returns ENOSPC when the underlying
+		 * filesystem fills up.  What kind of SCSI error should we
+		 * return for that?
+		 */
+		printf("%s%s command returned errno %d\n", path_str,
+		       (beio->bio_cmd == BIO_READ) ? "READ" : "WRITE", error);
+		ctl_set_medium_error(&io->scsiio);
+		ctl_complete_beio(beio);
+		return;
+	}
+
+	/*
+	 * If this is a write, we're all done.
+	 * If this is a read, we can now send the data to the user.
+	 */
+	if (beio->bio_cmd == BIO_WRITE) {
+		ctl_set_success(&io->scsiio);
+		SDT_PROBE(cbb, kernel, write, file_done, 0, 0, 0, 0, 0);
+		ctl_complete_beio(beio);
+	} else {
+		SDT_PROBE(cbb, kernel, read, file_done, 0, 0, 0, 0, 0);
+		io->scsiio.be_move_done = ctl_be_block_move_done;
+		io->scsiio.kern_data_ptr = (uint8_t *)beio->sg_segs;
+		io->scsiio.kern_data_len = beio->io_len;
+		io->scsiio.kern_total_len = beio->io_len;
+		io->scsiio.kern_rel_offset = 0;
+		io->scsiio.kern_data_resid = 0;
+		io->scsiio.kern_sg_entries = beio->num_segs;
+		io->io_hdr.flags |= CTL_FLAG_ALLOCATED | CTL_FLAG_KDPTR_SGLIST;
+#ifdef CTL_TIME_IO
+        	getbintime(&io->io_hdr.dma_start_bt);
+#endif  
+		ctl_datamove(io);
+	}
+}
+
+static void
+ctl_be_block_flush_dev(struct ctl_be_block_lun *be_lun,
+		       struct ctl_be_block_io *beio)
+{
+	struct bio *bio;
+	union ctl_io *io;
+	struct ctl_be_block_devdata *dev_data;
+
+	dev_data = &be_lun->backend.dev;
+	io = beio->io;
+
+	DPRINTF("entered\n");
+
+	/* This can't fail, it's a blocking allocation. */
+	bio = g_alloc_bio();
+
+	bio->bio_cmd	    = BIO_FLUSH;
+	bio->bio_flags	   |= BIO_ORDERED;
+	bio->bio_dev	    = dev_data->cdev;
+	bio->bio_offset	    = 0;
+	bio->bio_data	    = 0;
+	bio->bio_done	    = ctl_be_block_biodone;
+	bio->bio_caller1    = beio;
+	bio->bio_pblkno	    = 0;
+
+	/*
+	 * We don't need to acquire the LUN lock here, because we are only
+	 * sending one bio, and so there is no other context to synchronize
+	 * with.
+	 */
+	beio->num_bios_sent = 1;
+	beio->send_complete = 1;
+
+	binuptime(&beio->ds_t0);
+	devstat_start_transaction(be_lun->disk_stats, &beio->ds_t0);
+
+	(*dev_data->csw->d_strategy)(bio);
+}
+
+static void
+ctl_be_block_dispatch_dev(struct ctl_be_block_lun *be_lun,
+			  struct ctl_be_block_io *beio)
+{
+	int i;
+	struct bio *bio;
+	struct ctl_be_block_devdata *dev_data;
+	off_t cur_offset;
+	int max_iosize;
+
+	DPRINTF("entered\n");
+
+	dev_data = &be_lun->backend.dev;
+
+	/*
+	 * We have to limit our I/O size to the maximum supported by the
+	 * backend device.  Hopefully it is MAXPHYS.  If the driver doesn't
+	 * set it properly, use DFLTPHYS.
+	 */
+	max_iosize = dev_data->cdev->si_iosize_max;
+	if (max_iosize < PAGE_SIZE)
+		max_iosize = DFLTPHYS;
+
+	cur_offset = beio->io_offset;
+
+	/*
+	 * XXX KDM need to accurately reflect the number of I/Os outstanding
+	 * to a device.
+	 */
+	binuptime(&beio->ds_t0);
+	devstat_start_transaction(be_lun->disk_stats, &beio->ds_t0);
+
+	for (i = 0; i < beio->num_segs; i++) {
+		size_t cur_size;
+		uint8_t *cur_ptr;
+
+		cur_size = beio->sg_segs[i].len;
+		cur_ptr = beio->sg_segs[i].addr;
+
+		while (cur_size > 0) {
+			/* This can't fail, it's a blocking allocation. */
+			bio = g_alloc_bio();
+
+			KASSERT(bio != NULL, ("g_alloc_bio() failed!\n"));
+
+			bio->bio_cmd = beio->bio_cmd;
+			bio->bio_flags |= beio->bio_flags;
+			bio->bio_dev = dev_data->cdev;
+			bio->bio_caller1 = beio;
+			bio->bio_length = min(cur_size, max_iosize);
+			bio->bio_offset = cur_offset;
+			bio->bio_data = cur_ptr;
+			bio->bio_done = ctl_be_block_biodone;
+			bio->bio_pblkno = cur_offset / be_lun->blocksize;
+
+			cur_offset += bio->bio_length;
+			cur_ptr += bio->bio_length;
+			cur_size -= bio->bio_length;
+
+			/*
+			 * Make sure we set the complete bit just before we
+			 * issue the last bio so we don't wind up with a
+			 * race.
+			 *
+			 * Use the LUN mutex here instead of a combination
+			 * of atomic variables for simplicity.
+			 *
+			 * XXX KDM we could have a per-IO lock, but that
+			 * would cause additional per-IO setup and teardown
+			 * overhead.  Hopefully there won't be too much
+			 * contention on the LUN lock.
+			 */
+			mtx_lock(&be_lun->lock);
+
+			beio->num_bios_sent++;
+
+			if ((i == beio->num_segs - 1)
+			 && (cur_size == 0))
+				beio->send_complete = 1;
+
+			mtx_unlock(&be_lun->lock);
+
+			(*dev_data->csw->d_strategy)(bio);
+		}
+	}
+}
+
+static void
+ctl_be_block_cw_dispatch(struct ctl_be_block_lun *be_lun,
+			 union ctl_io *io)
+{
+	struct ctl_be_block_io *beio;
+	struct ctl_be_block_softc *softc;
+
+	DPRINTF("entered\n");
+
+	softc = be_lun->softc;
+	beio = ctl_alloc_beio(softc);
+	if (beio == NULL) {
+		/*
+		 * This should not happen.  ctl_alloc_beio() will call
+		 * ctl_grow_beio() with a blocking malloc as needed.
+		 * A malloc with M_WAITOK should not fail.
+		 */
+		ctl_set_busy(&io->scsiio);
+		ctl_done(io);
+		return;
+	}
+
+	beio->io = io;
+	beio->softc = softc;
+	beio->lun = be_lun;
+	io->io_hdr.ctl_private[CTL_PRIV_BACKEND].ptr = beio;
+
+	switch (io->scsiio.cdb[0]) {
+	case SYNCHRONIZE_CACHE:
+	case SYNCHRONIZE_CACHE_16:
+		beio->ds_trans_type = DEVSTAT_NO_DATA;
+		beio->ds_tag_type = DEVSTAT_TAG_ORDERED;
+		beio->io_len = 0;
+		be_lun->lun_flush(be_lun, beio);
+		break;
+	default:
+		panic("Unhandled CDB type %#x", io->scsiio.cdb[0]);
+		break;
+	}
+}
+
+SDT_PROBE_DEFINE1(cbb, kernel, read, start, start, "uint64_t");
+SDT_PROBE_DEFINE1(cbb, kernel, write, start, start, "uint64_t");
+SDT_PROBE_DEFINE1(cbb, kernel, read, alloc_done, alloc_done, "uint64_t");
+SDT_PROBE_DEFINE1(cbb, kernel, write, alloc_done, alloc_done, "uint64_t");
+
+static void
+ctl_be_block_dispatch(struct ctl_be_block_lun *be_lun,
+			   union ctl_io *io)
+{
+	struct ctl_be_block_io *beio;
+	struct ctl_be_block_softc *softc;
+	struct ctl_lba_len lbalen;
+	uint64_t len_left, io_size_bytes;
+	int i;
+
+	softc = be_lun->softc;
+
+	DPRINTF("entered\n");
+
+	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN) {
+		SDT_PROBE(cbb, kernel, read, start, 0, 0, 0, 0, 0);
+	} else {
+		SDT_PROBE(cbb, kernel, write, start, 0, 0, 0, 0, 0);
+	}
+
+	memcpy(&lbalen, io->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
+	       sizeof(lbalen));
+
+	io_size_bytes = lbalen.len * be_lun->blocksize;
+
+	/*
+	 * XXX KDM this is temporary, until we implement chaining of beio
+	 * structures and multiple datamove calls to move all the data in
+	 * or out.
+	 */
+	if (io_size_bytes > CTLBLK_MAX_IO_SIZE) {
+		printf("%s: IO length %ju > max io size %u\n", __func__,
+		       io_size_bytes, CTLBLK_MAX_IO_SIZE);
+		ctl_set_invalid_field(&io->scsiio,
+				      /*sks_valid*/ 0,
+				      /*command*/ 1,
+				      /*field*/ 0,
+				      /*bit_valid*/ 0,
+				      /*bit*/ 0);
+		ctl_done(io);
+		return;
+	}
+
+	beio = ctl_alloc_beio(softc);
+	if (beio == NULL) {
+		/*
+		 * This should not happen.  ctl_alloc_beio() will call
+		 * ctl_grow_beio() with a blocking malloc as needed.
+		 * A malloc with M_WAITOK should not fail.
+		 */
+		ctl_set_busy(&io->scsiio);
+		ctl_done(io);
+		return;
+	}
+
+	beio->io = io;
+	beio->softc = softc;
+	beio->lun = be_lun;
+	io->io_hdr.ctl_private[CTL_PRIV_BACKEND].ptr = beio;
+
+	/*
+	 * If the I/O came down with an ordered or head of queue tag, set
+	 * the BIO_ORDERED attribute.  For head of queue tags, that's
+	 * pretty much the best we can do.
+	 *
+	 * XXX KDM we don't have a great way to easily know about the FUA
+	 * bit right now (it is decoded in ctl_read_write(), but we don't
+	 * pass that knowledge to the backend), and in any case we would
+	 * need to determine how to handle it.  
+	 */
+	if ((io->scsiio.tag_type == CTL_TAG_ORDERED)
+	 || (io->scsiio.tag_type == CTL_TAG_HEAD_OF_QUEUE))
+		beio->bio_flags = BIO_ORDERED;
+
+	switch (io->scsiio.tag_type) {
+	case CTL_TAG_ORDERED:
+		beio->ds_tag_type = DEVSTAT_TAG_ORDERED;
+		break;
+	case CTL_TAG_HEAD_OF_QUEUE:
+		beio->ds_tag_type = DEVSTAT_TAG_HEAD;
+		break;
+	case CTL_TAG_UNTAGGED:
+	case CTL_TAG_SIMPLE:
+	case CTL_TAG_ACA:
+	default:
+		beio->ds_tag_type = DEVSTAT_TAG_SIMPLE;
+		break;
+	}
+
+	/*
+	 * This path handles read and write only.  The config write path
+	 * handles flush operations.
+	 */
+	if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN) {
+		beio->bio_cmd = BIO_READ;
+		beio->ds_trans_type = DEVSTAT_READ;
+	} else {
+		beio->bio_cmd = BIO_WRITE;
+		beio->ds_trans_type = DEVSTAT_WRITE;
+	}
+
+	beio->io_len = lbalen.len * be_lun->blocksize;
+	beio->io_offset = lbalen.lba * be_lun->blocksize;
+
+	DPRINTF("%s at LBA %jx len %u\n",
+	       (beio->bio_cmd == BIO_READ) ? "READ" : "WRITE",
+	       (uintmax_t)lbalen.lba, lbalen.len);
+
+	for (i = 0, len_left = io_size_bytes; i < CTLBLK_MAX_SEGS &&
+	     len_left > 0; i++) {
+
+		/*
+		 * Setup the S/G entry for this chunk.
+		 */
+		beio->sg_segs[i].len = min(MAXPHYS, len_left);
+		beio->sg_segs[i].addr = uma_zalloc(be_lun->lun_zone, M_WAITOK);
+		/*
+		 * uma_zalloc() can in theory return NULL even with M_WAITOK
+		 * if it can't pull more memory into the zone.
+		 */
+		if (beio->sg_segs[i].addr == NULL) {
+			ctl_set_busy(&io->scsiio);
+			ctl_complete_beio(beio);
+			return;
+		}
+
+		DPRINTF("segment %d addr %p len %zd\n", i,
+			beio->sg_segs[i].addr, beio->sg_segs[i].len);
+
+		beio->num_segs++;
+		len_left -= beio->sg_segs[i].len;
+	}
+
+	/*
+	 * For the read case, we need to read the data into our buffers and
+	 * then we can send it back to the user.  For the write case, we
+	 * need to get the data from the user first.
+	 */
+	if (beio->bio_cmd == BIO_READ) {
+		SDT_PROBE(cbb, kernel, read, alloc_done, 0, 0, 0, 0, 0);
+		be_lun->dispatch(be_lun, beio);
+	} else {
+		SDT_PROBE(cbb, kernel, write, alloc_done, 0, 0, 0, 0, 0);
+		io->scsiio.be_move_done = ctl_be_block_move_done;
+		io->scsiio.kern_data_ptr = (uint8_t *)beio->sg_segs;
+		io->scsiio.kern_data_len = beio->io_len;
+		io->scsiio.kern_total_len = beio->io_len;
+		io->scsiio.kern_rel_offset = 0;
+		io->scsiio.kern_data_resid = 0;
+		io->scsiio.kern_sg_entries = beio->num_segs;
+		io->io_hdr.flags |= CTL_FLAG_ALLOCATED | CTL_FLAG_KDPTR_SGLIST;
+#ifdef CTL_TIME_IO
+        	getbintime(&io->io_hdr.dma_start_bt);
+#endif  
+		ctl_datamove(io);
+	}
+}
+
+static void
+ctl_be_block_worker(void *context, int pending)
+{
+	struct ctl_be_block_lun *be_lun;
+	struct ctl_be_block_softc *softc;
+	union ctl_io *io;
+
+	be_lun = (struct ctl_be_block_lun *)context;
+	softc = be_lun->softc;
+
+	DPRINTF("entered\n");
+
+	mtx_lock(&be_lun->lock);
+	for (;;) {
+		io = (union ctl_io *)STAILQ_FIRST(&be_lun->datamove_queue);
+		if (io != NULL) {
+			struct ctl_be_block_io *beio;
+
+			DPRINTF("datamove queue\n");
+
+			STAILQ_REMOVE(&be_lun->datamove_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+
+			mtx_unlock(&be_lun->lock);
+
+			beio = (struct ctl_be_block_io *)
+			    io->io_hdr.ctl_private[CTL_PRIV_BACKEND].ptr;
+
+			be_lun->dispatch(be_lun, beio);
+
+			mtx_lock(&be_lun->lock);
+			continue;
+		}
+		io = (union ctl_io *)STAILQ_FIRST(&be_lun->config_write_queue);
+		if (io != NULL) {
+
+			DPRINTF("config write queue\n");
+
+			STAILQ_REMOVE(&be_lun->config_write_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+
+			mtx_unlock(&be_lun->lock);
+
+			ctl_be_block_cw_dispatch(be_lun, io);
+
+			mtx_lock(&be_lun->lock);
+			continue;
+		}
+		io = (union ctl_io *)STAILQ_FIRST(&be_lun->input_queue);
+		if (io != NULL) {
+			DPRINTF("input queue\n");
+
+			STAILQ_REMOVE(&be_lun->input_queue, &io->io_hdr,
+				      ctl_io_hdr, links);
+			mtx_unlock(&be_lun->lock);
+
+			/*
+			 * We must drop the lock, since this routine and
+			 * its children may sleep.
+			 */
+			ctl_be_block_dispatch(be_lun, io);
+
+			mtx_lock(&be_lun->lock);
+			continue;
+		}
+
+		/*
+		 * If we get here, there is no work left in the queues, so
+		 * just break out and let the task queue go to sleep.
+		 */
+		break;
+	}
+	mtx_unlock(&be_lun->lock);
+}
+
+/*
+ * Entry point from CTL to the backend for I/O.  We queue everything to a
+ * work thread, so this just puts the I/O on a queue and wakes up the
+ * thread.
+ */
+static int
+ctl_be_block_submit(union ctl_io *io)
+{
+	struct ctl_be_block_lun *be_lun;
+	struct ctl_be_lun *ctl_be_lun;
+	int retval;
+
+	DPRINTF("entered\n");
+
+	retval = CTL_RETVAL_COMPLETE;
+
+	ctl_be_lun = (struct ctl_be_lun *)io->io_hdr.ctl_private[
+		CTL_PRIV_BACKEND_LUN].ptr;
+	be_lun = (struct ctl_be_block_lun *)ctl_be_lun->be_lun;
+
+	/*
+	 * Make sure we only get SCSI I/O.
+	 */
+	KASSERT(io->io_hdr.io_type == CTL_IO_SCSI, ("Non-SCSI I/O (type "
+		"%#x) encountered", io->io_hdr.io_type));
+
+	mtx_lock(&be_lun->lock);
+	/*
+	 * XXX KDM make sure that links is okay to use at this point.
+	 * Otherwise, we either need to add another field to ctl_io_hdr,
+	 * or deal with resource allocation here.
+	 */
+	STAILQ_INSERT_TAIL(&be_lun->input_queue, &io->io_hdr, links);
+	mtx_unlock(&be_lun->lock);
+
+	taskqueue_enqueue(be_lun->io_taskqueue, &be_lun->io_task);
+
+	return (retval);
+}
+
+static int
+ctl_be_block_ioctl(struct cdev *dev, u_long cmd, caddr_t addr,
+			int flag, struct thread *td)
+{
+	struct ctl_be_block_softc *softc;
+	int error;
+
+	softc = &backend_block_softc;
+
+	error = 0;
+
+	switch (cmd) {
+	case CTL_LUN_REQ: {
+		struct ctl_lun_req *lun_req;
+
+		lun_req = (struct ctl_lun_req *)addr;
+
+		switch (lun_req->reqtype) {
+		case CTL_LUNREQ_CREATE:
+			error = ctl_be_block_create(softc, lun_req);
+			break;
+		case CTL_LUNREQ_RM:
+			error = ctl_be_block_rm(softc, lun_req);
+			break;
+		default:
+			lun_req->status = CTL_LUN_ERROR;
+			snprintf(lun_req->error_str, sizeof(lun_req->error_str),
+				 "%s: invalid LUN request type %d", __func__,
+				 lun_req->reqtype);
+			break;
+		}
+		break;
+	}
+	default:
+		error = ENOTTY;
+		break;
+	}
+
+	return (error);
+}
+
+static int
+ctl_be_block_open_file(struct ctl_be_block_lun *be_lun, struct ctl_lun_req *req)
+{
+	struct ctl_be_block_filedata *file_data;
+	struct ctl_lun_create_params *params;
+	struct vattr		      vattr;
+	int			      error;
+
+	error = 0;
+	file_data = &be_lun->backend.file;
+	params = &req->reqdata.create;
+
+	be_lun->dev_type = CTL_BE_BLOCK_FILE;
+	be_lun->dispatch = ctl_be_block_dispatch_file;
+	be_lun->lun_flush = ctl_be_block_flush_file;
+
+	error = VOP_GETATTR(be_lun->vn, &vattr, curthread->td_ucred);
+	if (error != 0) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "error calling VOP_GETATTR() for file %s",
+			 be_lun->dev_path);
+		return (error);
+	}
+
+	/*
+	 * Verify that we have the ability to upgrade to exclusive
+	 * access on this file so we can trap errors at open instead
+	 * of reporting them during first access.
+	 */
+	if (VOP_ISLOCKED(be_lun->vn) != LK_EXCLUSIVE) {
+		vn_lock(be_lun->vn, LK_UPGRADE | LK_RETRY);
+		if (be_lun->vn->v_iflag & VI_DOOMED) {
+			error = EBADF;
+			snprintf(req->error_str, sizeof(req->error_str),
+				 "error locking file %s", be_lun->dev_path);
+			return (error);
+		}
+	}
+
+
+	file_data->cred = crhold(curthread->td_ucred);
+	be_lun->size_bytes = vattr.va_size;
+	/*
+	 * We set the multi thread flag for file operations because all
+	 * filesystems (in theory) are capable of allowing multiple readers
+	 * of a file at once.  So we want to get the maximum possible
+	 * concurrency.
+	 */
+	be_lun->flags |= CTL_BE_BLOCK_LUN_MULTI_THREAD;
+
+	/*
+	 * XXX KDM vattr.va_blocksize may be larger than 512 bytes here.
+	 * With ZFS, it is 131072 bytes.  Block sizes that large don't work
+	 * with disklabel and UFS on FreeBSD at least.  Large block sizes
+	 * may not work with other OSes as well.  So just export a sector
+	 * size of 512 bytes, which should work with any OS or
+	 * application.  Since our backing is a file, any block size will
+	 * work fine for the backing store.
+	 */
+#if 0
+	be_lun->blocksize= vattr.va_blocksize;
+#endif
+	if (params->blocksize_bytes != 0)
+		be_lun->blocksize = params->blocksize_bytes;
+	else
+		be_lun->blocksize = 512;
+
+	/*
+	 * Sanity check.  The media size has to be at least one
+	 * sector long.
+	 */
+	if (be_lun->size_bytes < be_lun->blocksize) {
+		error = EINVAL;
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "file %s size %ju < block size %u", be_lun->dev_path,
+			 (uintmax_t)be_lun->size_bytes, be_lun->blocksize);
+	}
+	return (error);
+}
+
+static int
+ctl_be_block_open_dev(struct ctl_be_block_lun *be_lun, struct ctl_lun_req *req)
+{
+	struct ctl_lun_create_params *params;
+	struct vattr		      vattr;
+	struct cdev		     *dev;
+	struct cdevsw		     *devsw;
+	int			      error;
+
+	params = &req->reqdata.create;
+
+	be_lun->dev_type = CTL_BE_BLOCK_DEV;
+	be_lun->dispatch = ctl_be_block_dispatch_dev;
+	be_lun->lun_flush = ctl_be_block_flush_dev;
+	be_lun->backend.dev.cdev = be_lun->vn->v_rdev;
+	be_lun->backend.dev.csw = dev_refthread(be_lun->backend.dev.cdev,
+					     &be_lun->backend.dev.dev_ref);
+	if (be_lun->backend.dev.csw == NULL)
+		panic("Unable to retrieve device switch");
+
+	error = VOP_GETATTR(be_lun->vn, &vattr, NOCRED);
+	if (error) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error getting vnode attributes for device %s",
+			 __func__, be_lun->dev_path);
+		return (error);
+	}
+
+	dev = be_lun->vn->v_rdev;
+	devsw = dev->si_devsw;
+	if (!devsw->d_ioctl) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: no d_ioctl for device %s!", __func__,
+			 be_lun->dev_path);
+		return (ENODEV);
+	}
+
+	error = devsw->d_ioctl(dev, DIOCGSECTORSIZE,
+			       (caddr_t)&be_lun->blocksize, FREAD,
+			       curthread);
+	if (error) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error %d returned for DIOCGSECTORSIZE ioctl "
+			 "on %s!", __func__, error, be_lun->dev_path);
+		return (error);
+	}
+
+	/*
+	 * If the user has asked for a blocksize that is greater than the
+	 * backing device's blocksize, we can do it only if the blocksize
+	 * the user is asking for is an even multiple of the underlying 
+	 * device's blocksize.
+	 */
+	if ((params->blocksize_bytes != 0)
+	 && (params->blocksize_bytes > be_lun->blocksize)) {
+		uint32_t bs_multiple, tmp_blocksize;
+
+		bs_multiple = params->blocksize_bytes / be_lun->blocksize;
+
+		tmp_blocksize = bs_multiple * be_lun->blocksize;
+
+		if (tmp_blocksize == params->blocksize_bytes) {
+			be_lun->blocksize = params->blocksize_bytes;
+		} else {
+			snprintf(req->error_str, sizeof(req->error_str),
+				 "%s: requested blocksize %u is not an even "
+				 "multiple of backing device blocksize %u",
+				 __func__, params->blocksize_bytes,
+				 be_lun->blocksize);
+			return (EINVAL);
+			
+		}
+	} else if ((params->blocksize_bytes != 0)
+		&& (params->blocksize_bytes != be_lun->blocksize)) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: requested blocksize %u < backing device "
+			 "blocksize %u", __func__, params->blocksize_bytes,
+			 be_lun->blocksize);
+		return (EINVAL);
+	}
+
+	error = devsw->d_ioctl(dev, DIOCGMEDIASIZE,
+			       (caddr_t)&be_lun->size_bytes, FREAD,
+			       curthread);
+	if (error) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error %d returned for DIOCGMEDIASIZE ioctl "
+			 "on %s!", __func__, error, be_lun->dev_path);
+		return (error);
+	}
+
+	return (0);
+
+}
+
+
+static int
+ctl_be_block_close(struct ctl_be_block_lun *be_lun)
+{
+	DROP_GIANT();
+	if (be_lun->vn) {
+		int flags = FREAD | FWRITE;
+		int vfs_is_locked = 0;
+
+		switch (be_lun->dev_type) {
+		case CTL_BE_BLOCK_DEV:
+			if (be_lun->backend.dev.csw) {
+				dev_relthread(be_lun->backend.dev.cdev,
+					      be_lun->backend.dev.dev_ref);
+				be_lun->backend.dev.csw  = NULL;
+				be_lun->backend.dev.cdev = NULL;
+			}
+			break;
+		case CTL_BE_BLOCK_FILE:
+			vfs_is_locked = VFS_LOCK_GIANT(be_lun->vn->v_mount);
+			break;
+		case CTL_BE_BLOCK_NONE:
+		default:
+			panic("Unexpected backend type.");
+			break;
+		}
+
+		(void)vn_close(be_lun->vn, flags, NOCRED, curthread);
+		be_lun->vn = NULL;
+
+		switch (be_lun->dev_type) {
+		case CTL_BE_BLOCK_DEV:
+			break;
+		case CTL_BE_BLOCK_FILE:
+			VFS_UNLOCK_GIANT(vfs_is_locked);
+			if (be_lun->backend.file.cred != NULL) {
+				crfree(be_lun->backend.file.cred);
+				be_lun->backend.file.cred = NULL;
+			}
+			break;
+		case CTL_BE_BLOCK_NONE:
+		default:
+			panic("Unexpected backend type.");
+			break;
+		}
+	}
+	PICKUP_GIANT();
+
+	return (0);
+}
+
+static int
+ctl_be_block_open(struct ctl_be_block_softc *softc,
+		       struct ctl_be_block_lun *be_lun, struct ctl_lun_req *req)
+{
+	struct nameidata nd;
+	int		 flags;
+	int		 error;
+	int		 vfs_is_locked;
+
+	/*
+	 * XXX KDM allow a read-only option?
+	 */
+	flags = FREAD | FWRITE;
+	error = 0;
+
+	if (rootvnode == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: Root filesystem is not mounted", __func__);
+		return (1);
+	}
+
+	if (!curthread->td_proc->p_fd->fd_cdir) {
+		curthread->td_proc->p_fd->fd_cdir = rootvnode;
+		VREF(rootvnode);
+	}
+	if (!curthread->td_proc->p_fd->fd_rdir) {
+		curthread->td_proc->p_fd->fd_rdir = rootvnode;
+		VREF(rootvnode);
+	}
+	if (!curthread->td_proc->p_fd->fd_jdir) {
+		curthread->td_proc->p_fd->fd_jdir = rootvnode;
+		VREF(rootvnode);
+	}
+
+ again:
+	NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, be_lun->dev_path, curthread);
+	error = vn_open(&nd, &flags, 0, NULL);
+	if (error) {
+		/*
+		 * This is the only reasonable guess we can make as far as
+		 * path if the user doesn't give us a fully qualified path.
+		 * If they want to specify a file, they need to specify the
+		 * full path.
+		 */
+		if (be_lun->dev_path[0] != '/') {
+			char *dev_path = "/dev/";
+			char *dev_name;
+
+			/* Try adding device path at beginning of name */
+			dev_name = malloc(strlen(be_lun->dev_path)
+					+ strlen(dev_path) + 1,
+					  M_CTLBLK, M_WAITOK);
+			if (dev_name) {
+				sprintf(dev_name, "%s%s", dev_path,
+					be_lun->dev_path);
+				free(be_lun->dev_path, M_CTLBLK);
+				be_lun->dev_path = dev_name;
+				goto again;
+			}
+		}
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error opening %s", __func__, be_lun->dev_path);
+		return (error);
+	}
+
+	vfs_is_locked = NDHASGIANT(&nd);
+
+	NDFREE(&nd, NDF_ONLY_PNBUF);
+		
+	be_lun->vn = nd.ni_vp;
+
+	/* We only support disks and files. */
+	if (vn_isdisk(be_lun->vn, &error)) {
+		error = ctl_be_block_open_dev(be_lun, req);
+	} else if (be_lun->vn->v_type == VREG) {
+		error = ctl_be_block_open_file(be_lun, req);
+	} else {
+		error = EINVAL;
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s is not a disk or file", be_lun->dev_path);
+	}
+	VOP_UNLOCK(be_lun->vn, 0);
+	VFS_UNLOCK_GIANT(vfs_is_locked);
+
+	if (error != 0) {
+		ctl_be_block_close(be_lun);
+		return (error);
+	}
+
+	be_lun->blocksize_shift = fls(be_lun->blocksize) - 1;
+	be_lun->size_blocks = be_lun->size_bytes >> be_lun->blocksize_shift;
+
+	return (0);
+
+}
+
+static int
+ctl_be_block_mem_ctor(void *mem, int size, void *arg, int flags)
+{
+	return (0);
+}
+
+static void
+ctl_be_block_mem_dtor(void *mem, int size, void *arg)
+{
+	bzero(mem, size);
+}
+
+static int
+ctl_be_block_create(struct ctl_be_block_softc *softc, struct ctl_lun_req *req)
+{
+	struct ctl_be_block_lun *be_lun;
+	struct ctl_lun_create_params *params;
+	struct ctl_be_arg *file_arg;
+	char tmpstr[32];
+	int retval, num_threads;
+	int i;
+
+	params = &req->reqdata.create;
+	retval = 0;
+
+	num_threads = cbb_num_threads;
+
+	file_arg = NULL;
+
+	be_lun = malloc(sizeof(*be_lun), M_CTLBLK, M_ZERO | M_WAITOK);
+
+	if (be_lun == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error allocating %zd bytes", __func__,
+			 sizeof(*be_lun));
+		goto bailout_error;
+	}
+
+	be_lun->softc = softc;
+	STAILQ_INIT(&be_lun->input_queue);
+	STAILQ_INIT(&be_lun->config_write_queue);
+	STAILQ_INIT(&be_lun->datamove_queue);
+	sprintf(be_lun->lunname, "cblk%d", softc->num_luns);
+	mtx_init(&be_lun->lock, be_lun->lunname, NULL, MTX_DEF);
+
+	be_lun->lun_zone = uma_zcreate(be_lun->lunname, MAXPHYS, 
+	    ctl_be_block_mem_ctor, ctl_be_block_mem_dtor, NULL, NULL,
+	    /*align*/ 0, /*flags*/0);
+
+	if (be_lun->lun_zone == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error allocating UMA zone", __func__);
+		goto bailout_error;
+	}
+
+	if (params->flags & CTL_LUN_FLAG_DEV_TYPE)
+		be_lun->ctl_be_lun.lun_type = params->device_type;
+	else
+		be_lun->ctl_be_lun.lun_type = T_DIRECT;
+
+	if (be_lun->ctl_be_lun.lun_type == T_DIRECT) {
+		for (i = 0; i < req->num_be_args; i++) {
+			if (strcmp(req->kern_be_args[i].name, "file") == 0) {
+				file_arg = &req->kern_be_args[i];
+				break;
+			}
+		}
+
+		if (file_arg == NULL) {
+			snprintf(req->error_str, sizeof(req->error_str),
+				 "%s: no file argument specified", __func__);
+			goto bailout_error;
+		}
+
+		be_lun->dev_path = malloc(file_arg->vallen, M_CTLBLK,
+					  M_WAITOK | M_ZERO);
+		if (be_lun->dev_path == NULL) {
+			snprintf(req->error_str, sizeof(req->error_str),
+				 "%s: error allocating %d bytes", __func__,
+				 file_arg->vallen);
+			goto bailout_error;
+		}
+
+		strlcpy(be_lun->dev_path, (char *)file_arg->value,
+			file_arg->vallen);
+
+		retval = ctl_be_block_open(softc, be_lun, req);
+		if (retval != 0) {
+			retval = 0;
+			goto bailout_error;
+		}
+
+		/*
+		 * Tell the user the size of the file/device.
+		 */
+		params->lun_size_bytes = be_lun->size_bytes;
+
+		/*
+		 * The maximum LBA is the size - 1.
+		 */
+		be_lun->ctl_be_lun.maxlba = be_lun->size_blocks - 1;
+	} else {
+		/*
+		 * For processor devices, we don't have any size.
+		 */
+		be_lun->blocksize = 0;
+		be_lun->size_blocks = 0;
+		be_lun->size_bytes = 0;
+		be_lun->ctl_be_lun.maxlba = 0;
+		params->lun_size_bytes = 0;
+
+		/*
+		 * Default to just 1 thread for processor devices.
+		 */
+		num_threads = 1;
+	}
+
+	/*
+	 * XXX This searching loop might be refactored to be combined with
+	 * the loop above,
+	 */
+	for (i = 0; i < req->num_be_args; i++) {
+		if (strcmp(req->kern_be_args[i].name, "num_threads") == 0) {
+			struct ctl_be_arg *thread_arg;
+			char num_thread_str[16];
+			int tmp_num_threads;
+
+
+			thread_arg = &req->kern_be_args[i];
+
+			strlcpy(num_thread_str, (char *)thread_arg->value,
+				min(thread_arg->vallen,
+				sizeof(num_thread_str)));
+
+			tmp_num_threads = strtol(num_thread_str, NULL, 0);
+
+			/*
+			 * We don't let the user specify less than one
+			 * thread, but hope he's clueful enough not to
+			 * specify 1000 threads.
+			 */
+			if (tmp_num_threads < 1) {
+				snprintf(req->error_str, sizeof(req->error_str),
+					 "%s: invalid number of threads %s",
+				         __func__, num_thread_str);
+				goto bailout_error;
+			}
+
+			num_threads = tmp_num_threads;
+		}
+	}
+
+	be_lun->flags = CTL_BE_BLOCK_LUN_UNCONFIGURED;
+	be_lun->ctl_be_lun.flags = CTL_LUN_FLAG_PRIMARY;
+	be_lun->ctl_be_lun.be_lun = be_lun;
+	be_lun->ctl_be_lun.blocksize = be_lun->blocksize;
+	/* Tell the user the blocksize we ended up using */
+	params->blocksize_bytes = be_lun->blocksize;
+	if (params->flags & CTL_LUN_FLAG_ID_REQ) {
+		be_lun->ctl_be_lun.req_lun_id = params->req_lun_id;
+		be_lun->ctl_be_lun.flags |= CTL_LUN_FLAG_ID_REQ;
+	} else
+		be_lun->ctl_be_lun.req_lun_id = 0;
+
+	be_lun->ctl_be_lun.lun_shutdown = ctl_be_block_lun_shutdown;
+	be_lun->ctl_be_lun.lun_config_status =
+		ctl_be_block_lun_config_status;
+	be_lun->ctl_be_lun.be = &ctl_be_block_driver;
+
+	if ((params->flags & CTL_LUN_FLAG_SERIAL_NUM) == 0) {
+		snprintf(tmpstr, sizeof(tmpstr), "MYSERIAL%4d",
+			 softc->num_luns);
+		strncpy((char *)be_lun->ctl_be_lun.serial_num, tmpstr,
+			ctl_min(sizeof(be_lun->ctl_be_lun.serial_num),
+			sizeof(tmpstr)));
+
+		/* Tell the user what we used for a serial number */
+		strncpy((char *)params->serial_num, tmpstr,
+			ctl_min(sizeof(params->serial_num), sizeof(tmpstr)));
+	} else { 
+		strncpy((char *)be_lun->ctl_be_lun.serial_num,
+			params->serial_num,
+			ctl_min(sizeof(be_lun->ctl_be_lun.serial_num),
+			sizeof(params->serial_num)));
+	}
+	if ((params->flags & CTL_LUN_FLAG_DEVID) == 0) {
+		snprintf(tmpstr, sizeof(tmpstr), "MYDEVID%4d", softc->num_luns);
+		strncpy((char *)be_lun->ctl_be_lun.device_id, tmpstr,
+			ctl_min(sizeof(be_lun->ctl_be_lun.device_id),
+			sizeof(tmpstr)));
+
+		/* Tell the user what we used for a device ID */
+		strncpy((char *)params->device_id, tmpstr,
+			ctl_min(sizeof(params->device_id), sizeof(tmpstr)));
+	} else {
+		strncpy((char *)be_lun->ctl_be_lun.device_id,
+			params->device_id,
+			ctl_min(sizeof(be_lun->ctl_be_lun.device_id),
+				sizeof(params->device_id)));
+	}
+
+	TASK_INIT(&be_lun->io_task, /*priority*/0, ctl_be_block_worker, be_lun);
+
+	be_lun->io_taskqueue = taskqueue_create(be_lun->lunname, M_WAITOK,
+	    taskqueue_thread_enqueue, /*context*/&be_lun->io_taskqueue);
+
+	if (be_lun->io_taskqueue == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: Unable to create taskqueue", __func__);
+		goto bailout_error;
+	}
+
+	/*
+	 * Note that we start the same number of threads by default for
+	 * both the file case and the block device case.  For the file
+	 * case, we need multiple threads to allow concurrency, because the
+	 * vnode interface is designed to be a blocking interface.  For the
+	 * block device case, ZFS zvols at least will block the caller's
+	 * context in many instances, and so we need multiple threads to
+	 * overcome that problem.  Other block devices don't need as many
+	 * threads, but they shouldn't cause too many problems.
+	 *
+	 * If the user wants to just have a single thread for a block
+	 * device, he can specify that when the LUN is created, or change
+	 * the tunable/sysctl to alter the default number of threads.
+	 */
+	retval = taskqueue_start_threads(&be_lun->io_taskqueue,
+					 /*num threads*/num_threads,
+					 /*priority*/PWAIT,
+					 /*thread name*/
+					 "%s taskq", be_lun->lunname);
+
+	if (retval != 0)
+		goto bailout_error;
+
+	be_lun->num_threads = num_threads;
+
+	mtx_lock(&softc->lock);
+	softc->num_luns++;
+	STAILQ_INSERT_TAIL(&softc->lun_list, be_lun, links);
+
+	mtx_unlock(&softc->lock);
+
+	retval = ctl_add_lun(&be_lun->ctl_be_lun);
+	if (retval != 0) {
+		mtx_lock(&softc->lock);
+		STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_block_lun,
+			      links);
+		softc->num_luns--;
+		mtx_unlock(&softc->lock);
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: ctl_add_lun() returned error %d, see dmesg for "
+			"details", __func__, retval);
+		retval = 0;
+		goto bailout_error;
+	}
+
+	mtx_lock(&softc->lock);
+
+	/*
+	 * Tell the config_status routine that we're waiting so it won't
+	 * clean up the LUN in the event of an error.
+	 */
+	be_lun->flags |= CTL_BE_BLOCK_LUN_WAITING;
+
+	while (be_lun->flags & CTL_BE_BLOCK_LUN_UNCONFIGURED) {
+		retval = msleep(be_lun, &softc->lock, PCATCH, "ctlblk", 0);
+		if (retval == EINTR)
+			break;
+	}
+	be_lun->flags &= ~CTL_BE_BLOCK_LUN_WAITING;
+
+	if (be_lun->flags & CTL_BE_BLOCK_LUN_CONFIG_ERR) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: LUN configuration error, see dmesg for details",
+			 __func__);
+		STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_block_lun,
+			      links);
+		softc->num_luns--;
+		mtx_unlock(&softc->lock);
+		goto bailout_error;
+	} else {
+		params->req_lun_id = be_lun->ctl_be_lun.lun_id;
+	}
+
+	mtx_unlock(&softc->lock);
+
+	be_lun->disk_stats = devstat_new_entry("cbb", params->req_lun_id,
+					       be_lun->blocksize,
+					       DEVSTAT_ALL_SUPPORTED,
+					       be_lun->ctl_be_lun.lun_type
+					       | DEVSTAT_TYPE_IF_OTHER,
+					       DEVSTAT_PRIORITY_OTHER);
+
+
+	req->status = CTL_LUN_OK;
+
+	return (retval);
+
+bailout_error:
+	req->status = CTL_LUN_ERROR;
+
+	ctl_be_block_close(be_lun);
+
+	free(be_lun->dev_path, M_CTLBLK);
+	free(be_lun, M_CTLBLK);
+
+	return (retval);
+}
+
+static int
+ctl_be_block_rm(struct ctl_be_block_softc *softc, struct ctl_lun_req *req)
+{
+	struct ctl_lun_rm_params *params;
+	struct ctl_be_block_lun *be_lun;
+	int retval;
+
+	params = &req->reqdata.rm;
+
+	mtx_lock(&softc->lock);
+
+	be_lun = NULL;
+
+	STAILQ_FOREACH(be_lun, &softc->lun_list, links) {
+		if (be_lun->ctl_be_lun.lun_id == params->lun_id)
+			break;
+	}
+	mtx_unlock(&softc->lock);
+
+	if (be_lun == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: LUN %u is not managed by the block backend",
+			 __func__, params->lun_id);
+		goto bailout_error;
+	}
+
+	retval = ctl_disable_lun(&be_lun->ctl_be_lun);
+
+	if (retval != 0) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error %d returned from ctl_disable_lun() for "
+			 "LUN %d", __func__, retval, params->lun_id);
+		goto bailout_error;
+
+	}
+
+	retval = ctl_invalidate_lun(&be_lun->ctl_be_lun);
+	if (retval != 0) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error %d returned from ctl_invalidate_lun() for "
+			 "LUN %d", __func__, retval, params->lun_id);
+		goto bailout_error;
+	}
+
+	mtx_lock(&softc->lock);
+
+	be_lun->flags |= CTL_BE_BLOCK_LUN_WAITING;
+
+	while ((be_lun->flags & CTL_BE_BLOCK_LUN_UNCONFIGURED) == 0) {
+                retval = msleep(be_lun, &softc->lock, PCATCH, "ctlblk", 0);
+                if (retval == EINTR)
+                        break;
+        }
+
+	be_lun->flags &= ~CTL_BE_BLOCK_LUN_WAITING;
+
+	if ((be_lun->flags & CTL_BE_BLOCK_LUN_UNCONFIGURED) == 0) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: interrupted waiting for LUN to be freed", 
+			 __func__);
+		mtx_unlock(&softc->lock);
+		goto bailout_error;
+	}
+
+	STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_block_lun, links);
+
+	softc->num_luns--;
+	mtx_unlock(&softc->lock);
+
+	taskqueue_drain(be_lun->io_taskqueue, &be_lun->io_task);
+
+	taskqueue_free(be_lun->io_taskqueue);
+
+	ctl_be_block_close(be_lun);
+
+	if (be_lun->disk_stats != NULL)
+		devstat_remove_entry(be_lun->disk_stats);
+
+	uma_zdestroy(be_lun->lun_zone);
+
+	free(be_lun->dev_path, M_CTLBLK);
+
+	free(be_lun, M_CTLBLK);
+
+	req->status = CTL_LUN_OK;
+
+	return (0);
+
+bailout_error:
+
+	req->status = CTL_LUN_ERROR;
+
+	return (0);
+}
+
+static void
+ctl_be_block_lun_shutdown(void *be_lun)
+{
+	struct ctl_be_block_lun *lun;
+	struct ctl_be_block_softc *softc;
+
+	lun = (struct ctl_be_block_lun *)be_lun;
+
+	softc = lun->softc;
+
+	mtx_lock(&softc->lock);
+	lun->flags |= CTL_BE_BLOCK_LUN_UNCONFIGURED;
+	if (lun->flags & CTL_BE_BLOCK_LUN_WAITING)
+		wakeup(lun);
+	mtx_unlock(&softc->lock);
+
+}
+
+static void
+ctl_be_block_lun_config_status(void *be_lun, ctl_lun_config_status status)
+{
+	struct ctl_be_block_lun *lun;
+	struct ctl_be_block_softc *softc;
+
+	lun = (struct ctl_be_block_lun *)be_lun;
+	softc = lun->softc;
+
+	if (status == CTL_LUN_CONFIG_OK) {
+		mtx_lock(&softc->lock);
+		lun->flags &= ~CTL_BE_BLOCK_LUN_UNCONFIGURED;
+		if (lun->flags & CTL_BE_BLOCK_LUN_WAITING)
+			wakeup(lun);
+		mtx_unlock(&softc->lock);
+
+		/*
+		 * We successfully added the LUN, attempt to enable it.
+		 */
+		if (ctl_enable_lun(&lun->ctl_be_lun) != 0) {
+			printf("%s: ctl_enable_lun() failed!\n", __func__);
+			if (ctl_invalidate_lun(&lun->ctl_be_lun) != 0) {
+				printf("%s: ctl_invalidate_lun() failed!\n",
+				       __func__);
+			}
+		}
+
+		return;
+	}
+
+
+	mtx_lock(&softc->lock);
+	lun->flags &= ~CTL_BE_BLOCK_LUN_UNCONFIGURED;
+	lun->flags |= CTL_BE_BLOCK_LUN_CONFIG_ERR;
+	wakeup(lun);
+	mtx_unlock(&softc->lock);
+}
+
+
+static int
+ctl_be_block_config_write(union ctl_io *io)
+{
+	struct ctl_be_block_lun *be_lun;
+	struct ctl_be_lun *ctl_be_lun;
+	int retval;
+
+	retval = 0;
+
+	DPRINTF("entered\n");
+
+	ctl_be_lun = (struct ctl_be_lun *)io->io_hdr.ctl_private[
+		CTL_PRIV_BACKEND_LUN].ptr;
+	be_lun = (struct ctl_be_block_lun *)ctl_be_lun->be_lun;
+
+	switch (io->scsiio.cdb[0]) {
+	case SYNCHRONIZE_CACHE:
+	case SYNCHRONIZE_CACHE_16:
+		/*
+		 * The upper level CTL code will filter out any CDBs with
+		 * the immediate bit set and return the proper error.
+		 *
+		 * We don't really need to worry about what LBA range the
+		 * user asked to be synced out.  When they issue a sync
+		 * cache command, we'll sync out the whole thing.
+		 */
+		mtx_lock(&be_lun->lock);
+		STAILQ_INSERT_TAIL(&be_lun->config_write_queue, &io->io_hdr,
+				   links);
+		mtx_unlock(&be_lun->lock);
+		taskqueue_enqueue(be_lun->io_taskqueue, &be_lun->io_task);
+		break;
+	case START_STOP_UNIT: {
+		struct scsi_start_stop_unit *cdb;
+
+		cdb = (struct scsi_start_stop_unit *)io->scsiio.cdb;
+
+		if (cdb->how & SSS_START)
+			retval = ctl_start_lun(ctl_be_lun);
+		else {
+			retval = ctl_stop_lun(ctl_be_lun);
+			/*
+			 * XXX KDM Copan-specific offline behavior.
+			 * Figure out a reasonable way to port this?
+			 */
+#ifdef NEEDTOPORT
+			if ((retval == 0)
+			 && (cdb->byte2 & SSS_ONOFFLINE))
+				retval = ctl_lun_offline(ctl_be_lun);
+#endif
+		}
+
+		/*
+		 * In general, the above routines should not fail.  They
+		 * just set state for the LUN.  So we've got something
+		 * pretty wrong here if we can't start or stop the LUN.
+		 */
+		if (retval != 0) {
+			ctl_set_internal_failure(&io->scsiio,
+						 /*sks_valid*/ 1,
+						 /*retry_count*/ 0xf051);
+			retval = CTL_RETVAL_COMPLETE;
+		} else {
+			ctl_set_success(&io->scsiio);
+		}
+		ctl_config_write_done(io);
+		break;
+	}
+	default:
+		ctl_set_invalid_opcode(&io->scsiio);
+		ctl_config_write_done(io);
+		retval = CTL_RETVAL_COMPLETE;
+		break;
+	}
+
+	return (retval);
+
+}
+
+static int
+ctl_be_block_config_read(union ctl_io *io)
+{
+	return (0);
+}
+
+static int
+ctl_be_block_lun_info(void *be_lun, struct sbuf *sb)
+{
+	struct ctl_be_block_lun *lun;
+	int retval;
+
+	lun = (struct ctl_be_block_lun *)be_lun;
+	retval = 0;
+
+	retval = sbuf_printf(sb, "<num_threads>");
+
+	if (retval != 0)
+		goto bailout;
+
+	retval = sbuf_printf(sb, "%d", lun->num_threads);
+
+	if (retval != 0)
+		goto bailout;
+
+	retval = sbuf_printf(sb, "</num_threads>");
+
+	/*
+	 * For processor devices, we don't have a path variable.
+	 */
+	if ((retval != 0)
+	 || (lun->dev_path == NULL))
+		goto bailout;
+
+	retval = sbuf_printf(sb, "<file>");
+
+	if (retval != 0)
+		goto bailout;
+
+	retval = ctl_sbuf_printf_esc(sb, lun->dev_path);
+
+	if (retval != 0)
+		goto bailout;
+
+	retval = sbuf_printf(sb, "</file>\n");
+
+bailout:
+
+	return (retval);
+}
+
+int
+ctl_be_block_init(void)
+{
+	struct ctl_be_block_softc *softc;
+	int retval;
+
+	softc = &backend_block_softc;
+	retval = 0;
+
+	mtx_init(&softc->lock, "ctlblk", NULL, MTX_DEF);
+	STAILQ_INIT(&softc->beio_free_queue);
+	STAILQ_INIT(&softc->disk_list);
+	STAILQ_INIT(&softc->lun_list);
+	ctl_grow_beio(softc, 200);
+
+	return (retval);
+}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_backend_block.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_backend_block.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,72 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_backend_block.h#1 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_backend_block.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer driver backend interface for block devices.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_BACKEND_BLOCK_H_
+#define	_CTL_BACKEND_BLOCK_H_
+
+struct ctl_block_disk {
+	uint32_t   version;	/* interface version */
+	uint32_t   disknum;	/* returned device number */
+	STAILQ_ENTRY(ctl_block_disk) links;  /* linked list pointer */
+	char	   disk_name[MAXPATHLEN]; /* name of this device */
+	int        allocated;	/* disk is allocated to a LUN */
+	uint64_t   size_blocks; /* disk size in blocks */
+	uint64_t   size_bytes;  /* disk size in bytes */
+};
+
+typedef enum {
+	CTL_BLOCK_DEVLIST_MORE,
+	CTL_BLOCK_DEVLIST_DONE
+} ctl_block_devlist_status;
+
+struct ctl_block_devlist {
+	uint32_t		version;	/* interface version */
+	uint32_t		buf_len;	/* passed in, buffer length */
+	uint32_t		ctl_disk_size;	/* size of adddev, passed in */
+	struct ctl_block_disk	*devbuf;	/* buffer passed in/filled out*/
+	uint32_t		num_bufs;	/* number passed out */
+	uint32_t		buf_used;	/* bytes passed out */
+	uint32_t		total_disks;	/* number of disks in system */
+	ctl_block_devlist_status status;	/* did we get the whole list? */
+};
+
+#define	CTL_BLOCK_ADDDEV	_IOWR(COPAN_ARRAY_BE_BLOCK, 0x00, struct ctl_block_disk)
+#define	CTL_BLOCK_DEVLIST	_IOWR(COPAN_ARRAY_BE_BLOCK, 0x01, struct ctl_block_devlist)
+#define	CTL_BLOCK_RMDEV		_IOW(COPAN_ARRAY_BE_BLOCK, 0x02, struct ctl_block_disk)
+
+#endif	/* _CTL_BACKEND_BLOCK_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_backend_ramdisk.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_backend_ramdisk.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,835 @@
+/*-
+ * Copyright (c) 2003, 2008 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_backend_ramdisk.c#3 $
+ */
+/*
+ * CAM Target Layer backend for a "fake" ramdisk.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_backend_ramdisk.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/condvar.h>
+#include <sys/types.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/malloc.h>
+#include <sys/time.h>
+#include <sys/queue.h>
+#include <sys/conf.h>
+#include <sys/ioccom.h>
+#include <sys/module.h>
+
+#include <cam/scsi/scsi_all.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_util.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_debug.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_error.h>
+
+typedef enum {
+	CTL_BE_RAMDISK_LUN_UNCONFIGURED	= 0x01,
+	CTL_BE_RAMDISK_LUN_CONFIG_ERR	= 0x02,
+	CTL_BE_RAMDISK_LUN_WAITING	= 0x04
+} ctl_be_ramdisk_lun_flags;
+
+struct ctl_be_ramdisk_lun {
+	uint64_t size_bytes;
+	uint64_t size_blocks;
+	struct ctl_be_ramdisk_softc *softc;
+	ctl_be_ramdisk_lun_flags flags;
+	STAILQ_ENTRY(ctl_be_ramdisk_lun) links;
+	struct ctl_be_lun ctl_be_lun;
+};
+
+struct ctl_be_ramdisk_softc {
+	struct mtx lock;
+	int rd_size;
+#ifdef CTL_RAMDISK_PAGES
+	uint8_t **ramdisk_pages;
+	int num_pages;
+#else
+	uint8_t *ramdisk_buffer;
+#endif
+	int num_luns;
+	STAILQ_HEAD(, ctl_be_ramdisk_lun) lun_list;
+};
+
+static struct ctl_be_ramdisk_softc rd_softc;
+
+int ctl_backend_ramdisk_init(void);
+void ctl_backend_ramdisk_shutdown(void);
+static int ctl_backend_ramdisk_move_done(union ctl_io *io);
+static int ctl_backend_ramdisk_submit(union ctl_io *io);
+static int ctl_backend_ramdisk_ioctl(struct cdev *dev, u_long cmd,
+				     caddr_t addr, int flag, struct thread *td);
+static int ctl_backend_ramdisk_rm(struct ctl_be_ramdisk_softc *softc,
+				  struct ctl_lun_req *req);
+static int ctl_backend_ramdisk_create(struct ctl_be_ramdisk_softc *softc,
+				      struct ctl_lun_req *req, int do_wait);
+static void ctl_backend_ramdisk_lun_shutdown(void *be_lun);
+static void ctl_backend_ramdisk_lun_config_status(void *be_lun,
+						  ctl_lun_config_status status);
+static int ctl_backend_ramdisk_config_write(union ctl_io *io);
+static int ctl_backend_ramdisk_config_read(union ctl_io *io);
+
+static struct ctl_backend_driver ctl_be_ramdisk_driver = 
+{
+	name: "ramdisk",
+	flags: CTL_BE_FLAG_HAS_CONFIG,
+	init: ctl_backend_ramdisk_init,
+	data_submit: ctl_backend_ramdisk_submit,
+	data_move_done: ctl_backend_ramdisk_move_done,
+	config_read: ctl_backend_ramdisk_config_read,
+	config_write: ctl_backend_ramdisk_config_write,
+	ioctl: ctl_backend_ramdisk_ioctl
+};
+
+MALLOC_DEFINE(M_RAMDISK, "ramdisk", "Memory used for CTL RAMdisk");
+CTL_BACKEND_DECLARE(cbr, ctl_be_ramdisk_driver);
+
+int
+ctl_backend_ramdisk_init(void)
+{
+	struct ctl_be_ramdisk_softc *softc;
+#ifdef CTL_RAMDISK_PAGES
+	int i, j;
+#endif
+
+
+	softc = &rd_softc;
+
+	memset(softc, 0, sizeof(*softc));
+
+	mtx_init(&softc->lock, "ramdisk", NULL, MTX_DEF);
+
+	STAILQ_INIT(&softc->lun_list);
+	softc->rd_size = 4 * 1024 * 1024;
+#ifdef CTL_RAMDISK_PAGES
+	softc->num_pages = softc->rd_size / PAGE_SIZE;
+	softc->ramdisk_pages = (uint8_t **)malloc(sizeof(uint8_t *) *
+						  softc->num_pages, M_RAMDISK,
+						  M_WAITOK);
+	for (i = 0; i < softc->num_pages; i++) {
+		softc->ramdisk_pages[i] = malloc(PAGE_SIZE, M_RAMDISK,M_WAITOK);
+		if (softc->ramdisk_pages[i] == NULL) {
+			for (j = 0; j < i; j++) {
+				free(softc->ramdisk_pages[j], M_RAMDISK);
+			}
+			free(softc->ramdisk_pages, M_RAMDISK);
+			panic("RAMDisk initialization failed\n");
+			return (1); /* NOTREACHED */
+		}
+	}
+#else
+	softc->ramdisk_buffer = (uint8_t *)malloc(softc->rd_size, M_RAMDISK,
+						  M_WAITOK);
+#endif
+
+	return (0);
+}
+
+void
+ctl_backend_ramdisk_shutdown(void)
+{
+	struct ctl_be_ramdisk_softc *softc;
+	struct ctl_be_ramdisk_lun *lun, *next_lun;
+#ifdef CTL_RAMDISK_PAGES
+	int i;
+#endif
+
+	softc = &rd_softc;
+
+	mtx_lock(&softc->lock);
+	for (lun = STAILQ_FIRST(&softc->lun_list); lun != NULL; lun = next_lun){
+		/*
+		 * Grab the next LUN.  The current LUN may get removed by
+		 * ctl_invalidate_lun(), which will call our LUN shutdown
+		 * routine, if there is no outstanding I/O for this LUN.
+		 */
+		next_lun = STAILQ_NEXT(lun, links);
+
+		/*
+		 * Drop our lock here.  Since ctl_invalidate_lun() can call
+		 * back into us, this could potentially lead to a recursive
+		 * lock of the same mutex, which would cause a hang.
+		 */
+		mtx_unlock(&softc->lock);
+		ctl_disable_lun(&lun->ctl_be_lun);
+		ctl_invalidate_lun(&lun->ctl_be_lun);
+		mtx_lock(&softc->lock);
+	}
+	mtx_unlock(&softc->lock);
+	
+#ifdef CTL_RAMDISK_PAGES
+	for (i = 0; i < softc->num_pages; i++)
+		free(softc->ramdisk_pages[i], M_RAMDISK);
+
+	free(softc->ramdisk_pages, M_RAMDISK);
+#else
+	free(softc->ramdisk_buffer, M_RAMDISK);
+#endif
+
+	if (ctl_backend_deregister(&ctl_be_ramdisk_driver) != 0) {
+		printf("ctl_backend_ramdisk_shutdown: "
+		       "ctl_backend_deregister() failed!\n");
+	}
+}
+
+static int
+ctl_backend_ramdisk_move_done(union ctl_io *io)
+{
+#ifdef CTL_TIME_IO
+	struct bintime cur_bt;
+#endif
+
+	CTL_DEBUG_PRINT(("ctl_backend_ramdisk_move_done\n"));
+	if ((io->io_hdr.port_status == 0)
+	 && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
+	 && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE))
+		io->io_hdr.status = CTL_SUCCESS;
+	else if ((io->io_hdr.port_status != 0)
+	      && ((io->io_hdr.flags & CTL_FLAG_ABORT) == 0)
+	      && ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_STATUS_NONE)){
+		/*
+		 * For hardware error sense keys, the sense key
+		 * specific value is defined to be a retry count,
+		 * but we use it to pass back an internal FETD
+		 * error code.  XXX KDM  Hopefully the FETD is only
+		 * using 16 bits for an error code, since that's
+		 * all the space we have in the sks field.
+		 */
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 1,
+					 /*retry_count*/
+					 io->io_hdr.port_status);
+	}
+#ifdef CTL_TIME_IO
+	getbintime(&cur_bt);
+	bintime_sub(&cur_bt, &io->io_hdr.dma_start_bt);
+	bintime_add(&io->io_hdr.dma_bt, &cur_bt);
+	io->io_hdr.num_dmas++;
+#endif
+
+	if (io->scsiio.kern_sg_entries > 0)
+		free(io->scsiio.kern_data_ptr, M_RAMDISK);
+	ctl_done(io);
+	return(0);
+}
+
+static int
+ctl_backend_ramdisk_submit(union ctl_io *io)
+{
+	struct ctl_lba_len lbalen;
+#ifdef CTL_RAMDISK_PAGES
+	struct ctl_sg_entry *sg_entries;
+	int len_filled;
+	int i;
+#endif
+	int num_sg_entries, len;
+	struct ctl_be_ramdisk_softc *softc;
+	struct ctl_be_lun *ctl_be_lun;
+	struct ctl_be_ramdisk_lun *be_lun;
+
+	softc = &rd_softc;
+	
+	ctl_be_lun = (struct ctl_be_lun *)io->io_hdr.ctl_private[
+		CTL_PRIV_BACKEND_LUN].ptr;
+	be_lun = (struct ctl_be_ramdisk_lun *)ctl_be_lun->be_lun;
+
+	memcpy(&lbalen, io->io_hdr.ctl_private[CTL_PRIV_LBA_LEN].bytes,
+	       sizeof(lbalen));
+
+	len = lbalen.len * ctl_be_lun->blocksize;
+
+	/*
+	 * Kick out the request if it's bigger than we can handle.
+	 */
+	if (len > softc->rd_size) {
+		ctl_set_internal_failure(&io->scsiio,
+					 /*sks_valid*/ 0,
+					 /*retry_count*/ 0);
+		ctl_done(io);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+	/*
+	 * Kick out the request if it's larger than the device size that
+	 * the user requested.
+	 */
+	if (((lbalen.lba * ctl_be_lun->blocksize) + len) > be_lun->size_bytes) {
+		ctl_set_lba_out_of_range(&io->scsiio);
+		ctl_done(io);
+		return (CTL_RETVAL_COMPLETE);
+	}
+
+#ifdef CTL_RAMDISK_PAGES
+	num_sg_entries = len >> PAGE_SHIFT;
+	if ((len & (PAGE_SIZE - 1)) != 0)
+		num_sg_entries++;
+
+	if (num_sg_entries > 1) {
+		io->scsiio.kern_data_ptr = malloc(sizeof(struct ctl_sg_entry) *
+						  num_sg_entries, M_RAMDISK,
+						  M_WAITOK);
+		if (io->scsiio.kern_data_ptr == NULL) {
+			ctl_set_internal_failure(&io->scsiio,
+						 /*sks_valid*/ 0,
+						 /*retry_count*/ 0);
+			ctl_done(io);
+			return (CTL_RETVAL_COMPLETE);
+		}
+		sg_entries = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
+		for (i = 0, len_filled = 0; i < num_sg_entries;
+		     i++, len_filled += PAGE_SIZE) {
+			sg_entries[i].addr = softc->ramdisk_pages[i];
+			sg_entries[i].len = ctl_min(PAGE_SIZE,
+						    len - len_filled);
+		}
+	} else {
+#endif /* CTL_RAMDISK_PAGES */
+		/*
+		 * If this is less than 1 page, don't bother allocating a
+		 * scatter/gather list for it.  This saves time/overhead.
+		 */
+		num_sg_entries = 0;
+#ifdef CTL_RAMDISK_PAGES
+		io->scsiio.kern_data_ptr = softc->ramdisk_pages[0];
+#else
+		io->scsiio.kern_data_ptr = softc->ramdisk_buffer;
+#endif
+#ifdef CTL_RAMDISK_PAGES
+	}
+#endif
+
+	io->scsiio.be_move_done = ctl_backend_ramdisk_move_done;
+	io->scsiio.kern_data_len = len;
+	io->scsiio.kern_total_len = len;
+	io->scsiio.kern_rel_offset = 0;
+	io->scsiio.kern_data_resid = 0;
+	io->scsiio.kern_sg_entries = num_sg_entries;
+	io->io_hdr.flags |= CTL_FLAG_ALLOCATED | CTL_FLAG_KDPTR_SGLIST;
+#ifdef CTL_TIME_IO
+	getbintime(&io->io_hdr.dma_start_bt);
+#endif
+	ctl_datamove(io);
+
+	return (CTL_RETVAL_COMPLETE);
+}
+
+static int
+ctl_backend_ramdisk_ioctl(struct cdev *dev, u_long cmd, caddr_t addr,
+			  int flag, struct thread *td)
+{
+	struct ctl_be_ramdisk_softc *softc;
+	int retval;
+
+	retval = 0;
+	softc = &rd_softc;
+
+	switch (cmd) {
+	case CTL_LUN_REQ: {
+		struct ctl_lun_req *lun_req;
+
+		lun_req = (struct ctl_lun_req *)addr;
+
+		switch (lun_req->reqtype) {
+		case CTL_LUNREQ_CREATE:
+			retval = ctl_backend_ramdisk_create(softc, lun_req,
+							    /*do_wait*/ 1);
+			break;
+		case CTL_LUNREQ_RM:
+			retval = ctl_backend_ramdisk_rm(softc, lun_req);
+			break;
+		default:
+			lun_req->status = CTL_LUN_ERROR;
+			snprintf(lun_req->error_str, sizeof(lun_req->error_str),
+				 "%s: invalid LUN request type %d", __func__,
+				 lun_req->reqtype);
+			break;
+		}
+		break;
+	}
+	default:
+		retval = ENOTTY;
+		break;
+	}
+
+	return (retval);
+}
+
+static int
+ctl_backend_ramdisk_rm(struct ctl_be_ramdisk_softc *softc,
+		       struct ctl_lun_req *req)
+{
+	struct ctl_be_ramdisk_lun *be_lun;
+	struct ctl_lun_rm_params *params;
+	int retval;
+
+
+	retval = 0;
+	params = &req->reqdata.rm;
+
+	be_lun = NULL;
+
+	mtx_lock(&softc->lock);
+
+	STAILQ_FOREACH(be_lun, &softc->lun_list, links) {
+		if (be_lun->ctl_be_lun.lun_id == params->lun_id)
+			break;
+	}
+	mtx_unlock(&softc->lock);
+
+	if (be_lun == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: LUN %u is not managed by the ramdisk backend",
+			 __func__, params->lun_id);
+		goto bailout_error;
+	}
+
+	retval = ctl_disable_lun(&be_lun->ctl_be_lun);
+
+	if (retval != 0) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error %d returned from ctl_disable_lun() for "
+			 "LUN %d", __func__, retval, params->lun_id);
+		goto bailout_error;
+	}
+
+	/*
+	 * Set the waiting flag before we invalidate the LUN.  Our shutdown
+	 * routine can be called any time after we invalidate the LUN,
+	 * and can be called from our context.
+	 *
+	 * This tells the shutdown routine that we're waiting, or we're
+	 * going to wait for the shutdown to happen.
+	 */
+	mtx_lock(&softc->lock);
+	be_lun->flags |= CTL_BE_RAMDISK_LUN_WAITING;
+	mtx_unlock(&softc->lock);
+
+	retval = ctl_invalidate_lun(&be_lun->ctl_be_lun);
+	if (retval != 0) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error %d returned from ctl_invalidate_lun() for "
+			 "LUN %d", __func__, retval, params->lun_id);
+		goto bailout_error;
+	}
+
+	mtx_lock(&softc->lock);
+
+	while ((be_lun->flags & CTL_BE_RAMDISK_LUN_UNCONFIGURED) == 0) {
+		retval = msleep(be_lun, &softc->lock, PCATCH, "ctlram", 0);
+ 		if (retval == EINTR)   
+			break;
+	}
+	be_lun->flags &= ~CTL_BE_RAMDISK_LUN_WAITING;
+
+	/*
+	 * We only remove this LUN from the list and free it (below) if
+	 * retval == 0.  If the user interrupted the wait, we just bail out
+	 * without actually freeing the LUN.  We let the shutdown routine
+	 * free the LUN if that happens.
+	 */
+	if (retval == 0) {
+		STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_ramdisk_lun,
+			      links);
+		softc->num_luns--;
+	}
+
+	mtx_unlock(&softc->lock);
+
+	if (retval == 0)
+		free(be_lun, M_RAMDISK);
+
+	req->status = CTL_LUN_OK;
+
+	return (retval);
+
+bailout_error:
+
+	/*
+	 * Don't leave the waiting flag set.
+	 */
+	mtx_lock(&softc->lock);
+	be_lun->flags &= ~CTL_BE_RAMDISK_LUN_WAITING;
+	mtx_unlock(&softc->lock);
+
+	req->status = CTL_LUN_ERROR;
+
+	return (0);
+}
+
+static int
+ctl_backend_ramdisk_create(struct ctl_be_ramdisk_softc *softc,
+			   struct ctl_lun_req *req, int do_wait)
+{
+	struct ctl_be_ramdisk_lun *be_lun;
+	struct ctl_lun_create_params *params;
+	uint32_t blocksize;
+	char tmpstr[32];
+	int retval;
+
+	retval = 0;
+	params = &req->reqdata.create;
+	if (params->blocksize_bytes != 0)
+		blocksize = params->blocksize_bytes;
+	else
+		blocksize = 512;
+
+	be_lun = malloc(sizeof(*be_lun), M_RAMDISK, M_ZERO | (do_wait ?
+			M_WAITOK : M_NOWAIT));
+
+	if (be_lun == NULL) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: error allocating %zd bytes", __func__,
+			 sizeof(*be_lun));
+		goto bailout_error;
+	}
+
+	if (params->flags & CTL_LUN_FLAG_DEV_TYPE)
+		be_lun->ctl_be_lun.lun_type = params->device_type;
+	else
+		be_lun->ctl_be_lun.lun_type = T_DIRECT;
+
+	if (be_lun->ctl_be_lun.lun_type == T_DIRECT) {
+
+		if (params->lun_size_bytes < blocksize) {
+			snprintf(req->error_str, sizeof(req->error_str),
+				 "%s: LUN size %ju < blocksize %u", __func__,
+				 params->lun_size_bytes, blocksize);
+			goto bailout_error;
+		}
+
+		be_lun->size_blocks = params->lun_size_bytes / blocksize;
+		be_lun->size_bytes = be_lun->size_blocks * blocksize;
+
+		be_lun->ctl_be_lun.maxlba = be_lun->size_blocks - 1;
+	} else {
+		be_lun->ctl_be_lun.maxlba = 0;
+		blocksize = 0;
+		be_lun->size_bytes = 0;
+		be_lun->size_blocks = 0;
+	}
+
+	be_lun->ctl_be_lun.blocksize = blocksize;
+
+	/* Tell the user the blocksize we ended up using */
+	params->blocksize_bytes = blocksize;
+
+	/* Tell the user the exact size we ended up using */
+	params->lun_size_bytes = be_lun->size_bytes;
+
+	be_lun->softc = softc;
+
+	be_lun->flags = CTL_BE_RAMDISK_LUN_UNCONFIGURED;
+	be_lun->ctl_be_lun.flags = CTL_LUN_FLAG_PRIMARY;
+	be_lun->ctl_be_lun.be_lun = be_lun;
+
+	if (params->flags & CTL_LUN_FLAG_ID_REQ) {
+		be_lun->ctl_be_lun.req_lun_id = params->req_lun_id;
+		be_lun->ctl_be_lun.flags |= CTL_LUN_FLAG_ID_REQ;
+	} else
+		be_lun->ctl_be_lun.req_lun_id = 0;
+
+	be_lun->ctl_be_lun.lun_shutdown = ctl_backend_ramdisk_lun_shutdown;
+	be_lun->ctl_be_lun.lun_config_status =
+		ctl_backend_ramdisk_lun_config_status;
+	be_lun->ctl_be_lun.be = &ctl_be_ramdisk_driver;
+	if ((params->flags & CTL_LUN_FLAG_SERIAL_NUM) == 0) {
+		snprintf(tmpstr, sizeof(tmpstr), "MYSERIAL%4d",
+			 softc->num_luns);
+		strncpy((char *)be_lun->ctl_be_lun.serial_num, tmpstr,
+			ctl_min(sizeof(be_lun->ctl_be_lun.serial_num),
+			sizeof(tmpstr)));
+
+		/* Tell the user what we used for a serial number */
+		strncpy((char *)params->serial_num, tmpstr,
+			ctl_min(sizeof(params->serial_num), sizeof(tmpstr)));
+	} else { 
+		strncpy((char *)be_lun->ctl_be_lun.serial_num,
+			params->serial_num,
+			ctl_min(sizeof(be_lun->ctl_be_lun.serial_num),
+			sizeof(params->serial_num)));
+	}
+	if ((params->flags & CTL_LUN_FLAG_DEVID) == 0) {
+		snprintf(tmpstr, sizeof(tmpstr), "MYDEVID%4d", softc->num_luns);
+		strncpy((char *)be_lun->ctl_be_lun.device_id, tmpstr,
+			ctl_min(sizeof(be_lun->ctl_be_lun.device_id),
+			sizeof(tmpstr)));
+
+		/* Tell the user what we used for a device ID */
+		strncpy((char *)params->device_id, tmpstr,
+			ctl_min(sizeof(params->device_id), sizeof(tmpstr)));
+	} else {
+		strncpy((char *)be_lun->ctl_be_lun.device_id,
+			params->device_id,
+			ctl_min(sizeof(be_lun->ctl_be_lun.device_id),
+				sizeof(params->device_id)));
+	}
+
+	mtx_lock(&softc->lock);
+	softc->num_luns++;
+	STAILQ_INSERT_TAIL(&softc->lun_list, be_lun, links);
+
+	mtx_unlock(&softc->lock);
+
+	retval = ctl_add_lun(&be_lun->ctl_be_lun);
+	if (retval != 0) {
+		mtx_lock(&softc->lock);
+		STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_ramdisk_lun,
+			      links);
+		softc->num_luns--;
+		mtx_unlock(&softc->lock);
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: ctl_add_lun() returned error %d, see dmesg for "
+			"details", __func__, retval);
+		retval = 0;
+		goto bailout_error;
+	}
+
+	if (do_wait == 0)
+		return (retval);
+
+	mtx_lock(&softc->lock);
+
+	/*
+	 * Tell the config_status routine that we're waiting so it won't
+	 * clean up the LUN in the event of an error.
+	 */
+	be_lun->flags |= CTL_BE_RAMDISK_LUN_WAITING;
+
+	while (be_lun->flags & CTL_BE_RAMDISK_LUN_UNCONFIGURED) {
+		retval = msleep(be_lun, &softc->lock, PCATCH, "ctlram", 0);
+		if (retval == EINTR)
+			break;
+	}
+	be_lun->flags &= ~CTL_BE_RAMDISK_LUN_WAITING;
+
+	if (be_lun->flags & CTL_BE_RAMDISK_LUN_CONFIG_ERR) {
+		snprintf(req->error_str, sizeof(req->error_str),
+			 "%s: LUN configuration error, see dmesg for details",
+			 __func__);
+		STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_ramdisk_lun,
+			      links);
+		softc->num_luns--;
+		mtx_unlock(&softc->lock);
+		goto bailout_error;
+	} else {
+		params->req_lun_id = be_lun->ctl_be_lun.lun_id;
+	}
+	mtx_unlock(&softc->lock);
+
+	req->status = CTL_LUN_OK;
+
+	return (retval);
+
+bailout_error:
+	req->status = CTL_LUN_ERROR;
+	free(be_lun, M_RAMDISK);
+
+	return (retval);
+}
+
+static void
+ctl_backend_ramdisk_lun_shutdown(void *be_lun)
+{
+	struct ctl_be_ramdisk_lun *lun;
+	struct ctl_be_ramdisk_softc *softc;
+	int do_free;
+
+	lun = (struct ctl_be_ramdisk_lun *)be_lun;
+	softc = lun->softc;
+	do_free = 0;
+
+	mtx_lock(&softc->lock);
+
+	lun->flags |= CTL_BE_RAMDISK_LUN_UNCONFIGURED;
+
+	if (lun->flags & CTL_BE_RAMDISK_LUN_WAITING) {
+		wakeup(lun);
+	} else {
+		STAILQ_REMOVE(&softc->lun_list, be_lun, ctl_be_ramdisk_lun,
+			      links);
+		softc->num_luns--;
+		do_free = 1;
+	}
+
+	mtx_unlock(&softc->lock);
+
+	if (do_free != 0)
+		free(be_lun, M_RAMDISK);
+}
+
+static void
+ctl_backend_ramdisk_lun_config_status(void *be_lun,
+				      ctl_lun_config_status status)
+{
+	struct ctl_be_ramdisk_lun *lun;
+	struct ctl_be_ramdisk_softc *softc;
+
+	lun = (struct ctl_be_ramdisk_lun *)be_lun;
+	softc = lun->softc;
+
+	if (status == CTL_LUN_CONFIG_OK) {
+		mtx_lock(&softc->lock);
+		lun->flags &= ~CTL_BE_RAMDISK_LUN_UNCONFIGURED;
+		if (lun->flags & CTL_BE_RAMDISK_LUN_WAITING)
+			wakeup(lun);
+		mtx_unlock(&softc->lock);
+
+		/*
+		 * We successfully added the LUN, attempt to enable it.
+		 */
+		if (ctl_enable_lun(&lun->ctl_be_lun) != 0) {
+			printf("%s: ctl_enable_lun() failed!\n", __func__);
+			if (ctl_invalidate_lun(&lun->ctl_be_lun) != 0) {
+				printf("%s: ctl_invalidate_lun() failed!\n",
+				       __func__);
+			}
+		}
+
+		return;
+	}
+
+
+	mtx_lock(&softc->lock);
+	lun->flags &= ~CTL_BE_RAMDISK_LUN_UNCONFIGURED;
+
+	/*
+	 * If we have a user waiting, let him handle the cleanup.  If not,
+	 * clean things up here.
+	 */
+	if (lun->flags & CTL_BE_RAMDISK_LUN_WAITING) {
+		lun->flags |= CTL_BE_RAMDISK_LUN_CONFIG_ERR;
+		wakeup(lun);
+	} else {
+		STAILQ_REMOVE(&softc->lun_list, lun, ctl_be_ramdisk_lun,
+			      links);
+		softc->num_luns--;
+		free(lun, M_RAMDISK);
+	}
+	mtx_unlock(&softc->lock);
+}
+
+static int
+ctl_backend_ramdisk_config_write(union ctl_io *io)
+{
+	struct ctl_be_ramdisk_softc *softc;
+	int retval;
+
+	retval = 0;
+	softc = &rd_softc;
+
+	switch (io->scsiio.cdb[0]) {
+	case SYNCHRONIZE_CACHE:
+	case SYNCHRONIZE_CACHE_16:
+		/*
+		 * The upper level CTL code will filter out any CDBs with
+		 * the immediate bit set and return the proper error.  It
+		 * will also not allow a sync cache command to go to a LUN
+		 * that is powered down.
+		 *
+		 * We don't really need to worry about what LBA range the
+		 * user asked to be synced out.  When they issue a sync
+		 * cache command, we'll sync out the whole thing.
+		 *
+		 * This is obviously just a stubbed out implementation.
+		 * The real implementation will be in the RAIDCore/CTL
+		 * interface, and can only really happen when RAIDCore
+		 * implements a per-array cache sync.
+		 */
+		ctl_set_success(&io->scsiio);
+		ctl_config_write_done(io);
+		break;
+	case START_STOP_UNIT: {
+		struct scsi_start_stop_unit *cdb;
+		struct ctl_be_lun *ctl_be_lun;
+		struct ctl_be_ramdisk_lun *be_lun;
+
+		cdb = (struct scsi_start_stop_unit *)io->scsiio.cdb;
+
+		ctl_be_lun = (struct ctl_be_lun *)io->io_hdr.ctl_private[
+			CTL_PRIV_BACKEND_LUN].ptr;
+		be_lun = (struct ctl_be_ramdisk_lun *)ctl_be_lun->be_lun;
+
+		if (cdb->how & SSS_START)
+			retval = ctl_start_lun(ctl_be_lun);
+		else {
+			retval = ctl_stop_lun(ctl_be_lun);
+#ifdef NEEDTOPORT
+			if ((retval == 0)
+			 && (cdb->byte2 & SSS_ONOFFLINE))
+				retval = ctl_lun_offline(ctl_be_lun);
+#endif
+		}
+
+		/*
+		 * In general, the above routines should not fail.  They
+		 * just set state for the LUN.  So we've got something
+		 * pretty wrong here if we can't start or stop the LUN.
+		 */
+		if (retval != 0) {
+			ctl_set_internal_failure(&io->scsiio,
+						 /*sks_valid*/ 1,
+						 /*retry_count*/ 0xf051);
+			retval = CTL_RETVAL_COMPLETE;
+		} else {
+			ctl_set_success(&io->scsiio);
+		}
+		ctl_config_write_done(io);
+		break;
+	}
+	default:
+		ctl_set_invalid_opcode(&io->scsiio);
+		ctl_config_write_done(io);
+		retval = CTL_RETVAL_COMPLETE;
+		break;
+	}
+
+	return (retval);
+}
+
+static int
+ctl_backend_ramdisk_config_read(union ctl_io *io)
+{
+	/*
+	 * XXX KDM need to implement!!
+	 */
+	return (0);
+}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_cmd_table.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_cmd_table.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,984 @@
+/*-
+ * Copyright (c) 2003, 2004, 2005, 2009 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_cmd_table.c#4 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_cmd_table.c 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer command table.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>, Kim Le
+ */
+
+#include <sys/cdefs.h>
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/condvar.h>
+#include <sys/queue.h>
+
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_ha.h>
+#include <cam/ctl/ctl_private.h>
+
+/*
+ * Whenever support for a new command is added, it should be added to this
+ * table.
+ */
+struct ctl_cmd_entry ctl_cmd_table[] =
+{
+/* 00 TEST UNIT READY */
+{ctl_tur, CTL_SERIDX_TUR, CTL_CMD_FLAG_OK_ON_BOTH |
+			  CTL_FLAG_DATA_NONE |
+			  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_TUR},
+
+/* 01 REWIND */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 02 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 03 REQUEST SENSE */
+{ctl_request_sense, CTL_SERIDX_RQ_SNS, CTL_FLAG_DATA_IN |
+				       CTL_CMD_FLAG_OK_ON_ALL_LUNS |
+				       CTL_CMD_FLAG_ALLOW_ON_RESV |
+				       CTL_CMD_FLAG_NO_SENSE |
+				       CTL_CMD_FLAG_OK_ON_STOPPED |
+				       CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				       CTL_CMD_FLAG_OK_ON_OFFLINE |
+				       CTL_CMD_FLAG_OK_ON_SECONDARY |
+				       CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_NONE},
+
+/* 04 FORMAT UNIT */
+{ctl_format, CTL_SERIDX_FORMAT, CTL_CMD_FLAG_OK_ON_SLUN |
+				CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 05 READ BLOCK LIMITS */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 06 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 07 REASSIGN BLOCKS */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 08 READ(6) */
+{ctl_read_write, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_SLUN |
+				  CTL_FLAG_DATA_IN |
+				  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_READ | CTL_LUN_PAT_RANGE},
+
+/* 09 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 0A WRITE(6) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN |
+				   CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* 0B SEEK(6) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 0C */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 0D */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 0E */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 0F READ REVERSE(6) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 10 WRITE FILEMARKS(6) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 11 SPACE(6) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 12 INQUIRY */
+{ctl_inquiry, CTL_SERIDX_INQ, CTL_CMD_FLAG_OK_ON_ALL_LUNS |
+			      CTL_CMD_FLAG_ALLOW_ON_RESV |
+			      CTL_CMD_FLAG_NO_SENSE |
+			      CTL_CMD_FLAG_OK_ON_STOPPED |
+			      CTL_CMD_FLAG_OK_ON_INOPERABLE |
+			      CTL_CMD_FLAG_OK_ON_OFFLINE |
+			      CTL_CMD_FLAG_OK_ON_SECONDARY |
+			      CTL_FLAG_DATA_IN |
+			      CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_NONE},
+
+/* 13 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 14 RECOVER BUFFERED DATA */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 15 MODE SELECT(6) */
+{ctl_mode_select, CTL_SERIDX_MD_SEL, CTL_CMD_FLAG_OK_ON_BOTH |
+				     CTL_CMD_FLAG_OK_ON_STOPPED |
+				     CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				     CTL_CMD_FLAG_OK_ON_SECONDARY |
+				     CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 16 RESERVE(6) */
+{ctl_scsi_reserve, CTL_SERIDX_RESV, CTL_CMD_FLAG_ALLOW_ON_RESV |
+				    CTL_CMD_FLAG_OK_ON_BOTH |
+				    CTL_CMD_FLAG_OK_ON_STOPPED |
+				    CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				    CTL_CMD_FLAG_OK_ON_SECONDARY |
+				    CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 17 RELEASE(6) */
+{ctl_scsi_release, CTL_SERIDX_REL, CTL_CMD_FLAG_ALLOW_ON_RESV |
+				   CTL_CMD_FLAG_OK_ON_BOTH |
+				   CTL_CMD_FLAG_OK_ON_STOPPED |
+				   CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				   CTL_CMD_FLAG_OK_ON_SECONDARY |
+				   CTL_FLAG_DATA_NONE,
+ CTL_LUN_PAT_NONE},
+
+/* 18 COPY */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 19 ERASE(6) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 1A MODE SENSE(6) */
+{ctl_mode_sense, CTL_SERIDX_MD_SNS, CTL_CMD_FLAG_OK_ON_BOTH |
+				    CTL_CMD_FLAG_OK_ON_STOPPED |
+				    CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				    CTL_CMD_FLAG_OK_ON_SECONDARY |
+				    CTL_FLAG_DATA_IN,
+ CTL_LUN_PAT_NONE},
+
+/* 1B START STOP UNIT */
+{ctl_start_stop, CTL_SERIDX_START, CTL_CMD_FLAG_OK_ON_SLUN |
+				   CTL_CMD_FLAG_OK_ON_STOPPED |
+				   CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				   CTL_CMD_FLAG_OK_ON_OFFLINE |
+				   CTL_FLAG_DATA_NONE |
+				   CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_NONE},
+
+/* 1C RECEIVE DIAGNOSTIC RESULTS */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 1D SEND DIAGNOSTIC */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 1E PREVENT ALLOW MEDIUM REMOVAL */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 1F */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 20 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 21 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 22 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 23 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 24 SET WINDOW */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 25 READ CAPACITY(10) */
+{ctl_read_capacity, CTL_SERIDX_RD_CAP, CTL_CMD_FLAG_OK_ON_SLUN|
+				       CTL_CMD_FLAG_OK_ON_STOPPED |
+				       CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				       CTL_CMD_FLAG_OK_ON_SECONDARY |
+				       CTL_FLAG_DATA_IN |
+				       CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_READCAP},
+
+/* 26 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 27 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 28 READ(10) */
+{ctl_read_write, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_SLUN |
+				  CTL_FLAG_DATA_IN |
+				  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_READ | CTL_LUN_PAT_RANGE},
+
+/* 29 READ GENERATION */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 2A WRITE(10) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN| CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* 2B SEEK(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 2C ERASE(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 2D READ UPDATED BLOCK */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 2E WRITE AND VERIFY(10) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN| CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* 2F VERIFY(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 30 SEARCH DATA HIGH(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 31 SEARCH DATA EQUAL(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 32 SEARCH DATA LOW(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 33 SET LIMITS(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 34 PRE-FETCH(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 35 SYNCHRONIZE CACHE(10) */
+{ctl_sync_cache, CTL_SERIDX_START, CTL_CMD_FLAG_OK_ON_SLUN |
+				   CTL_FLAG_DATA_NONE,
+ CTL_LUN_PAT_NONE},
+
+/* 36 LOCK UNLOCK CACHE(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 37 READ DEFECT DATA(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 38 MEDIUM SCAN */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 39 COMPARE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 3A COPY AND VERIFY */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 3B WRITE BUFFER */
+{ctl_write_buffer, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_PROC |
+				     CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 3C READ BUFFER */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 3D UPDATE BLOCK */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 3E READ LONG */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 3F WRITE LONG */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 40 CHANGE DEFINITION */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 41 WRITE SAME(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 42 READ SUB-CHANNEL */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 43 READ TOC/PMA/ATIP */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 44 REPORT DENSITY SUPPORT */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 45 PLAY AUDIO(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 46 GET CONFIGURATION */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 47 PLAY AUDIO MSF */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 48 PLAY AUDIO TRACK INDEX */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 49 PLAY TRACK RELATIVE(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 4A GET EVENT STATUS NOTIFICATION */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 4B PAUSE/RESUME */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 4C LOG SELECT */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 4D LOG SENSE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 4E STOP PLAY/SCAN */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 4F */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 50 XDWRITE(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 51 XPWRITE(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 52 XDREAD(10) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 53 RESERVE TRACK */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 54 SEND OPC INFORMATION */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 55 MODE SELECT(10) */
+{ctl_mode_select, CTL_SERIDX_MD_SEL, CTL_CMD_FLAG_OK_ON_BOTH |
+				     CTL_CMD_FLAG_OK_ON_STOPPED |
+				     CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				     CTL_CMD_FLAG_OK_ON_SECONDARY |
+				     CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 56 RESERVE(10) */
+{ctl_scsi_reserve, CTL_SERIDX_RESV, CTL_CMD_FLAG_ALLOW_ON_RESV |
+				    CTL_CMD_FLAG_OK_ON_BOTH |
+				    CTL_CMD_FLAG_OK_ON_STOPPED |
+				    CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				    CTL_CMD_FLAG_OK_ON_SECONDARY |
+				    CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 57 RELEASE(10) */
+{ctl_scsi_release, CTL_SERIDX_REL, CTL_CMD_FLAG_ALLOW_ON_RESV |
+				   CTL_CMD_FLAG_OK_ON_BOTH |
+				   CTL_CMD_FLAG_OK_ON_STOPPED |
+				   CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				   CTL_CMD_FLAG_OK_ON_SECONDARY |
+				   CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* 58 REPAIR TRACK */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 59 READ MASTER CUE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 5A MODE SENSE(10) */
+{ctl_mode_sense, CTL_SERIDX_MD_SNS, CTL_CMD_FLAG_OK_ON_BOTH |
+				    CTL_CMD_FLAG_OK_ON_STOPPED |
+				    CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				    CTL_CMD_FLAG_OK_ON_SECONDARY |
+				    CTL_FLAG_DATA_IN,
+ CTL_LUN_PAT_NONE},
+
+/* 5B CLOSE TRACK/SESSION */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 5C READ BUFFER CAPACITY */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 5D SEND CUE SHEET */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 5E PERSISTENT RESERVE IN */
+{ctl_persistent_reserve_in, CTL_SERIDX_PRES_IN, CTL_CMD_FLAG_ALLOW_ON_RESV |
+						CTL_CMD_FLAG_OK_ON_BOTH |
+						CTL_CMD_FLAG_OK_ON_STOPPED |
+						CTL_CMD_FLAG_OK_ON_INOPERABLE |
+						CTL_CMD_FLAG_OK_ON_SECONDARY |
+						CTL_FLAG_DATA_IN |
+						CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_NONE},
+
+//{ctl_persistent_reserve_in, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE},
+
+/* 5F PERSISTENT RESERVE OUT */
+{ctl_persistent_reserve_out, CTL_SERIDX_PRES_OUT, CTL_CMD_FLAG_ALLOW_ON_RESV |
+						  CTL_CMD_FLAG_OK_ON_BOTH |
+						  CTL_CMD_FLAG_OK_ON_STOPPED |
+						  CTL_CMD_FLAG_OK_ON_INOPERABLE|
+						  CTL_CMD_FLAG_OK_ON_SECONDARY |
+						  CTL_FLAG_DATA_OUT |
+						  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_NONE},
+
+//{ctl_persistent_reserve_out, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE},
+
+/* 60 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 61 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 62 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 63 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 64 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 65 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 66 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 67 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 68 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 69 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 6A */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 6B */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 6C */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 6D */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 6E */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 6F */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 70 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 71 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 72 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 73 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 74 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 75 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 76 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 77 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 78 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 79 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 7A */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 7B */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 7C */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 7D */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 7E */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 7F */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 80 XDWRITE EXTENDED(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 81 REBUILD(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 82 REGENERATE(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 83 EXTENDED COPY */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 84 RECEIVE COPY RESULTS */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 85 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 86 ACCESS CONTROL IN */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 87 ACCESS CONTROL OUT */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 88 READ(16) */
+{ctl_read_write, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_SLUN | CTL_FLAG_DATA_IN |
+                                  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_READ | CTL_LUN_PAT_RANGE},
+
+/* 89 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 8A WRITE(16) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN| CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* 8B */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 8C READ ATTRIBUTE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 8D WRITE ATTRIBUTE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 8E WRITE AND VERIFY(16) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN| CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* 8F VERIFY(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 90 PRE-FETCH(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 91 SYNCHRONIZE CACHE(16) */
+{ctl_sync_cache, CTL_SERIDX_START, CTL_CMD_FLAG_OK_ON_SLUN |
+				   CTL_FLAG_DATA_NONE,
+ CTL_LUN_PAT_NONE},
+
+/* 92 LOCK UNLOCK CACHE(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 93 WRITE SAME(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 94 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 95 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 96 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 97 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 98 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 99 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 9A */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 9B */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 9C */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 9D */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* 9E SERVICE ACTION IN(16) */
+/* XXX KDM not all service actions will be read capacity!! */
+{ctl_service_action_in, CTL_SERIDX_RD_CAP, CTL_CMD_FLAG_OK_ON_SLUN |
+					   CTL_CMD_FLAG_OK_ON_STOPPED |
+					   CTL_CMD_FLAG_OK_ON_INOPERABLE |
+					   CTL_CMD_FLAG_OK_ON_SECONDARY |
+					   CTL_FLAG_DATA_IN |
+					   CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_READCAP},
+
+/* 9F SERVICE ACTION OUT(16) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A0 REPORT LUNS */
+{ctl_report_luns, CTL_SERIDX_INQ, CTL_CMD_FLAG_OK_ON_ALL_LUNS |
+				  CTL_CMD_FLAG_ALLOW_ON_RESV |
+				  CTL_CMD_FLAG_NO_SENSE |
+				  CTL_CMD_FLAG_OK_ON_STOPPED |
+				  CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				  CTL_CMD_FLAG_OK_ON_OFFLINE |
+				  CTL_CMD_FLAG_OK_ON_SECONDARY |
+				  CTL_FLAG_DATA_IN |
+				  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_NONE},
+
+/* A1 BLANK */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A2 SEND EVENT */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A3 MAINTENANCE (IN) Service Action - (0A) REPORT TARGET PORT GROUP */
+{ctl_maintenance_in, CTL_SERIDX_MAIN_IN, CTL_CMD_FLAG_OK_ON_BOTH |
+				         CTL_CMD_FLAG_OK_ON_STOPPED |
+				         CTL_CMD_FLAG_OK_ON_INOPERABLE |
+				         CTL_CMD_FLAG_OK_ON_SECONDARY |
+				         CTL_FLAG_DATA_IN,
+ CTL_LUN_PAT_NONE},
+
+/* A4 MAINTENANCE (OUT) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A5 MOVE MEDIUM */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A6 EXCHANGE MEDIUM */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A7 MOVE MEDIUM ATTACHED */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* A8 READ(12) */
+{ctl_read_write, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_SLUN | CTL_FLAG_DATA_IN |
+                                  CTL_CMD_FLAG_ALLOW_ON_PR_RESV,
+ CTL_LUN_PAT_READ | CTL_LUN_PAT_RANGE},
+
+/* A9 PLAY TRACK RELATIVE(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* AA WRITE(12) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN| CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* AB SERVICE ACTION IN(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* AC ERASE(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* AD READ DVD STRUCTURE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* AE WRITE AND VERIFY(12) */
+{ctl_read_write, CTL_SERIDX_WRITE, CTL_CMD_FLAG_OK_ON_SLUN| CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_WRITE | CTL_LUN_PAT_RANGE},
+
+/* AF VERIFY(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B0 SEARCH DATA HIGH(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B1 SEARCH DATA EQUAL(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B2 SEARCH DATA LOW(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B3 SET LIMITS(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B4 READ ELEMENT STATUS ATTACHED */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B5 REQUEST VOLUME ELEMENT ADDRESS */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B6 SEND VOLUME TAG */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B7 READ DEFECT DATA(12) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B8 READ ELEMENT STATUS */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* B9 READ CD MSF */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* BA REDUNDANCY GROUP (IN) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* BB REDUNDANCY GROUP (OUT) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* BC SPARE (IN) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* BD SPARE (OUT) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* BE VOLUME SET (IN) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* BF VOLUME SET (OUT) */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* C0 - ISC_SEND_MSG_SHORT */
+//{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE},
+{ctl_isc, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_PROC | CTL_FLAG_DATA_NONE,
+ CTL_LUN_PAT_NONE},
+
+/* C1 - ISC_SEND_MSG */
+//{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE},
+{ctl_isc, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_PROC | CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* C2 - ISC_WRITE */
+//{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE},
+{ctl_isc, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_PROC | CTL_FLAG_DATA_OUT,
+ CTL_LUN_PAT_NONE},
+
+/* C3 - ISC_READ */
+//{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE},
+{ctl_isc, CTL_SERIDX_READ, CTL_CMD_FLAG_OK_ON_PROC | CTL_FLAG_DATA_IN,
+ CTL_LUN_PAT_NONE},
+
+/* C4 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* C5 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* C6 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* C7 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* C8 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* C9 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* CA */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* CB */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* CC */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* CD */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* CE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* CF */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D0 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D1 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D2 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D3 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D4 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D5 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D6 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D7 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D8 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* D9 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* DA */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* DB */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* DC */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* DD */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* DE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* DF */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E0 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E1 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E2 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E3 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E4 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E5 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E6 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E7 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E8 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* E9 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* EA */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* EB */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* EC */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* ED */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* EE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* EF */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F0 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F1 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F2 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F3 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F4 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F5 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F6 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F7 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F8 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* F9 */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* FA */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* FB */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* FC */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* FD */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* FE */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE},
+
+/* FF */
+{NULL, CTL_SERIDX_INVLD, CTL_CMD_FLAG_NONE, CTL_LUN_PAT_NONE}
+
+};
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_debug.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_debug.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,52 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_debug.h#2 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_debug.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer debugging interface.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_DEBUG_H_
+#define	_CTL_DEBUG_H_
+
+#ifdef	CAM_CTL_DEBUG
+#define	CTL_DEBUG_PRINT(X)		\
+	do {				\
+		printf("ctl_debug: ");	\
+		printf X;		\
+	} while (0)
+#else /* CAM_CTL_DEBUG */
+#define	CTL_DEBUG_PRINT(X)
+#endif /* CAM_CTL_DEBUG */
+
+#endif	/* _CTL_DEBUG_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_error.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_error.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,811 @@
+/*-
+ * Copyright (c) 2003-2009 Silicon Graphics International Corp.
+ * Copyright (c) 2011 Spectra Logic Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_error.c#2 $
+ */
+/*
+ * CAM Target Layer error reporting routines.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_error.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/stddef.h>
+#include <sys/ctype.h>
+#include <machine/stdarg.h>
+
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_error.h>
+#include <cam/ctl/ctl_ha.h>
+#include <cam/ctl/ctl_private.h>
+
+void
+ctl_set_sense_data_va(struct scsi_sense_data *sense_data, void *lunptr,
+		      scsi_sense_data_type sense_format, int current_error,
+		      int sense_key, int asc, int ascq, va_list ap) 
+{
+	struct ctl_lun *lun;
+
+	lun = (struct ctl_lun *)lunptr;
+
+	/*
+	 * Determine whether to return fixed or descriptor format sense
+	 * data.
+	 */
+	if (sense_format == SSD_TYPE_NONE) {
+		/*
+		 * If the format isn't specified, we only return descriptor
+		 * sense if the LUN exists and descriptor sense is turned
+		 * on for that LUN.
+		 */
+		if ((lun != NULL)
+		 && (lun->flags & CTL_LUN_SENSE_DESC))
+			sense_format = SSD_TYPE_DESC;
+		else
+			sense_format = SSD_TYPE_FIXED;
+	}
+
+	scsi_set_sense_data_va(sense_data, sense_format, current_error,
+			       sense_key, asc, ascq, ap);
+}
+
+void
+ctl_set_sense_data(struct scsi_sense_data *sense_data, void *lunptr,
+		   scsi_sense_data_type sense_format, int current_error,
+		   int sense_key, int asc, int ascq, ...) 
+{
+	va_list ap;
+
+	va_start(ap, ascq);
+	ctl_set_sense_data_va(sense_data, lunptr, sense_format, current_error,
+			      sense_key, asc, ascq, ap);
+	va_end(ap);
+}
+
+void
+ctl_set_sense(struct ctl_scsiio *ctsio, int current_error, int sense_key,
+	      int asc, int ascq, ...)
+{
+	va_list ap;
+	struct ctl_lun *lun;
+
+	/*
+	 * The LUN can't go away until all of the commands have been
+	 * completed.  Therefore we can safely access the LUN structure and
+	 * flags without the lock.
+	 */
+	lun = (struct ctl_lun *)ctsio->io_hdr.ctl_private[CTL_PRIV_LUN].ptr;
+
+	va_start(ap, ascq);
+	ctl_set_sense_data_va(&ctsio->sense_data,
+			      lun,
+			      SSD_TYPE_NONE,
+			      current_error,
+			      sense_key,
+			      asc,
+			      ascq,
+			      ap);
+	va_end(ap);
+
+	ctsio->scsi_status = SCSI_STATUS_CHECK_COND;
+	ctsio->sense_len = SSD_FULL_SIZE;
+	ctsio->io_hdr.status = CTL_SCSI_ERROR | CTL_AUTOSENSE;
+}
+
+/*
+ * Transform fixed sense data into descriptor sense data.
+ * 
+ * For simplicity's sake, we assume that both sense structures are
+ * SSD_FULL_SIZE.  Otherwise, the logic gets more complicated.
+ */
+void
+ctl_sense_to_desc(struct scsi_sense_data_fixed *sense_src,
+		  struct scsi_sense_data_desc *sense_dest)
+{
+	struct scsi_sense_stream stream_sense;
+	int current_error;
+	uint8_t stream_bits;
+
+	bzero(sense_dest, sizeof(*sense_dest));
+
+	if ((sense_src->error_code & SSD_ERRCODE) == SSD_DEFERRED_ERROR)
+		current_error = 0;
+	else
+		current_error = 1;
+
+	bzero(&stream_sense, sizeof(stream_sense));
+
+	/*
+	 * Check to see whether any of the tape-specific bits are set.  If
+	 * so, we'll need a stream sense descriptor.
+	 */
+	if (sense_src->flags & (SSD_ILI|SSD_EOM|SSD_FILEMARK))
+		stream_bits = sense_src->flags & ~SSD_KEY;
+	else
+		stream_bits = 0;
+
+	/*
+	 * Utilize our sense setting routine to do the transform.  If a
+	 * value is set in the fixed sense data, set it in the descriptor
+	 * data.  Otherwise, skip it.
+	 */
+	ctl_set_sense_data((struct scsi_sense_data *)sense_dest,
+			   /*lun*/ NULL,
+			   /*sense_format*/ SSD_TYPE_DESC,
+			   current_error,
+			   /*sense_key*/ sense_src->flags & SSD_KEY,
+			   /*asc*/ sense_src->add_sense_code,
+			   /*ascq*/ sense_src->add_sense_code_qual,
+
+			   /* Information Bytes */ 
+			   (scsi_4btoul(sense_src->info) != 0) ?
+			   SSD_ELEM_INFO : SSD_ELEM_SKIP,
+			   sizeof(sense_src->info),
+			   sense_src->info,
+
+			   /* Command specific bytes */
+			   (scsi_4btoul(sense_src->cmd_spec_info) != 0) ?
+			   SSD_ELEM_COMMAND : SSD_ELEM_SKIP,
+			   sizeof(sense_src->cmd_spec_info),
+			   sense_src->cmd_spec_info,
+
+			   /* FRU */
+			   (sense_src->fru != 0) ?
+			   SSD_ELEM_FRU : SSD_ELEM_SKIP,
+			   sizeof(sense_src->fru),
+			   &sense_src->fru,
+
+			   /* Sense Key Specific */
+			   (sense_src->sense_key_spec[0] & SSD_SCS_VALID) ?
+			   SSD_ELEM_SKS : SSD_ELEM_SKIP,
+			   sizeof(sense_src->sense_key_spec),
+			   sense_src->sense_key_spec,
+
+			   /* Tape bits */
+			   (stream_bits != 0) ?
+			   SSD_ELEM_STREAM : SSD_ELEM_SKIP,
+			   sizeof(stream_bits),
+			   &stream_bits,
+
+			   SSD_ELEM_NONE);
+}
+
+/*
+ * Transform descriptor format sense data into fixed sense data.
+ *
+ * Some data may be lost in translation, because there are descriptors
+ * thant can't be represented as fixed sense data.
+ *
+ * For simplicity's sake, we assume that both sense structures are
+ * SSD_FULL_SIZE.  Otherwise, the logic gets more complicated.
+ */
+void
+ctl_sense_to_fixed(struct scsi_sense_data_desc *sense_src,
+		   struct scsi_sense_data_fixed *sense_dest)
+{
+	int current_error;
+	uint8_t *info_ptr = NULL, *cmd_ptr = NULL, *fru_ptr = NULL;
+	uint8_t *sks_ptr = NULL, *stream_ptr = NULL;
+	int info_size = 0, cmd_size = 0, fru_size = 0;
+	int sks_size = 0, stream_size = 0;
+	int pos;
+
+	if ((sense_src->error_code & SSD_ERRCODE) == SSD_DESC_CURRENT_ERROR)
+		current_error = 1;
+	else
+		current_error = 0;
+
+	for (pos = 0; pos < (int)(sense_src->extra_len - 1);) {
+		struct scsi_sense_desc_header *header;
+
+		header = (struct scsi_sense_desc_header *)
+		    &sense_src->sense_desc[pos];
+
+		/*
+		 * See if this record goes past the end of the sense data.
+		 * It shouldn't, but check just in case.
+		 */
+		if ((pos + header->length + sizeof(*header)) >
+		     sense_src->extra_len)
+			break;
+
+		switch (sense_src->sense_desc[pos]) {
+		case SSD_DESC_INFO: {
+			struct scsi_sense_info *info;
+
+			info = (struct scsi_sense_info *)header;
+
+			info_ptr = info->info;
+			info_size = sizeof(info->info);
+
+			pos += info->length +
+			    sizeof(struct scsi_sense_desc_header);
+			break;
+		}
+		case SSD_DESC_COMMAND: {
+			struct scsi_sense_command *cmd;
+
+			cmd = (struct scsi_sense_command *)header;
+			cmd_ptr = cmd->command_info;
+			cmd_size = sizeof(cmd->command_info);
+
+			pos += cmd->length + 
+			    sizeof(struct scsi_sense_desc_header);
+			break;
+		}
+		case SSD_DESC_FRU: {
+			struct scsi_sense_fru *fru;
+
+			fru = (struct scsi_sense_fru *)header;
+			fru_ptr = &fru->fru;
+			fru_size = sizeof(fru->fru);
+			pos += fru->length +
+			    sizeof(struct scsi_sense_desc_header);
+			break;
+		}
+		case SSD_DESC_SKS: {
+			struct scsi_sense_sks *sks;
+
+			sks = (struct scsi_sense_sks *)header;
+			sks_ptr = sks->sense_key_spec;
+			sks_size = sizeof(sks->sense_key_spec);
+
+			pos = sks->length +
+			    sizeof(struct scsi_sense_desc_header);
+			break;
+		}
+		case SSD_DESC_STREAM: {
+			struct scsi_sense_stream *stream_sense;
+
+			stream_sense = (struct scsi_sense_stream *)header;
+			stream_ptr = &stream_sense->byte3;
+			stream_size = sizeof(stream_sense->byte3);
+			pos = stream_sense->length +
+			    sizeof(struct scsi_sense_desc_header);
+			break;
+		}
+		default:
+			/*
+			 * We don't recognize this particular sense
+			 * descriptor type, so just skip it.
+			 */
+			pos += sizeof(*header) + header->length;
+			break;
+		}
+	}
+
+	ctl_set_sense_data((struct scsi_sense_data *)sense_dest,
+			   /*lun*/ NULL,
+			   /*sense_format*/ SSD_TYPE_FIXED,
+			   current_error,
+			   /*sense_key*/ sense_src->sense_key & SSD_KEY,
+			   /*asc*/ sense_src->add_sense_code,
+			   /*ascq*/ sense_src->add_sense_code_qual,
+
+			   /* Information Bytes */ 
+			   (info_ptr != NULL) ? SSD_ELEM_INFO : SSD_ELEM_SKIP,
+			   info_size,
+			   info_ptr,
+
+			   /* Command specific bytes */
+			   (cmd_ptr != NULL) ? SSD_ELEM_COMMAND : SSD_ELEM_SKIP,
+			   cmd_size,
+			   cmd_ptr,
+
+			   /* FRU */
+			   (fru_ptr != NULL) ? SSD_ELEM_FRU : SSD_ELEM_SKIP,
+			   fru_size,
+			   fru_ptr,
+
+			   /* Sense Key Specific */
+			   (sks_ptr != NULL) ? SSD_ELEM_SKS : SSD_ELEM_SKIP,
+			   sks_size,
+			   sks_ptr,
+
+			   /* Tape bits */
+			   (stream_ptr != NULL) ? SSD_ELEM_STREAM : SSD_ELEM_SKIP,
+			   stream_size,
+			   stream_ptr,
+
+			   SSD_ELEM_NONE);
+}
+
+ctl_sense_format
+ctl_get_sense_format(struct scsi_sense_data *sense_data)
+{
+	switch (sense_data->error_code & SSD_ERRCODE) {
+	case SSD_DESC_CURRENT_ERROR:
+	case SSD_DESC_DEFERRED_ERROR:
+		return (SSD_TYPE_DESC);
+	case SSD_CURRENT_ERROR:
+	case SSD_DEFERRED_ERROR:
+	default:
+		return (SSD_TYPE_FIXED);
+		break;
+	}
+}
+
+void
+ctl_set_ua(struct ctl_scsiio *ctsio, int asc, int ascq)
+{
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_UNIT_ATTENTION,
+		      asc,
+		      ascq,
+		      SSD_ELEM_NONE);
+}
+
+ctl_ua_type
+ctl_build_ua(ctl_ua_type ua_type, struct scsi_sense_data *sense,
+	     ctl_sense_format sense_format)
+{
+	ctl_ua_type ua_to_build;
+	int i, asc, ascq;
+
+	if (ua_type == CTL_UA_NONE)
+		return (ua_type);
+
+	ua_to_build = CTL_UA_NONE;
+
+	for (i = 0; i < (sizeof(ua_type) * 8); i++) {
+		if (ua_type & (1 << i)) {
+			ua_to_build = 1 << i;
+			break;
+		}
+	}
+
+	switch (ua_to_build) {
+	case CTL_UA_POWERON:
+		/* 29h/01h  POWER ON OCCURRED */
+		asc = 0x29;
+		ascq = 0x01;
+		break;
+	case CTL_UA_BUS_RESET:
+		/* 29h/02h  SCSI BUS RESET OCCURRED */
+		asc = 0x29;
+		ascq = 0x02;
+		break;
+	case CTL_UA_TARG_RESET:
+		/* 29h/03h  BUS DEVICE RESET FUNCTION OCCURRED*/
+		asc = 0x29;
+		ascq = 0x03;
+		break;
+	case CTL_UA_LUN_RESET:
+		/* 29h/00h  POWER ON, RESET, OR BUS DEVICE RESET OCCURRED */
+		/*
+		 * Since we don't have a specific ASC/ASCQ pair for a LUN
+		 * reset, just return the generic reset code.
+		 */
+		asc = 0x29;
+		ascq = 0x00;
+		break;
+	case CTL_UA_LUN_CHANGE:
+		/* 3Fh/0Eh  REPORTED LUNS DATA HAS CHANGED */
+		asc = 0x3F;
+		ascq = 0x0E;
+		break;
+	case CTL_UA_MODE_CHANGE:
+		/* 2Ah/01h  MODE PARAMETERS CHANGED */
+		asc = 0x2A;
+		ascq = 0x01;
+		break;
+	case CTL_UA_LOG_CHANGE:
+		/* 2Ah/02h  LOG PARAMETERS CHANGED */
+		asc = 0x2A;
+		ascq = 0x02;
+		break;
+	case CTL_UA_LVD:
+		/* 29h/06h  TRANSCEIVER MODE CHANGED TO LVD */
+		asc = 0x29;
+		ascq = 0x06;
+		break;
+	case CTL_UA_SE:
+		/* 29h/05h  TRANSCEIVER MODE CHANGED TO SINGLE-ENDED */
+		asc = 0x29;
+		ascq = 0x05;
+		break;
+	case CTL_UA_RES_PREEMPT:
+		/* 2Ah/03h  RESERVATIONS PREEMPTED */
+		asc = 0x2A;
+		ascq = 0x03;
+		break;
+	case CTL_UA_RES_RELEASE:
+		/* 2Ah/04h  RESERVATIONS RELEASED */
+		asc = 0x2A;
+		ascq = 0x04;
+		break;
+	case CTL_UA_REG_PREEMPT:
+		/* 2Ah/05h  REGISTRATIONS PREEMPTED */
+		asc = 0x2A;
+		ascq = 0x05;
+		break;
+	case CTL_UA_ASYM_ACC_CHANGE:
+	        /* 2Ah/06n  ASYMMETRIC ACCESS STATE CHANGED */
+		asc = 0x2A;
+		ascq = 0x06;
+		break;
+	default:
+		ua_to_build = CTL_UA_NONE;
+		return (ua_to_build);
+		break; /* NOTREACHED */
+	}
+
+	ctl_set_sense_data(sense,
+			   /*lun*/ NULL,
+			   sense_format,
+			   /*current_error*/ 1,
+			   /*sense_key*/ SSD_KEY_UNIT_ATTENTION,
+			   asc,
+			   ascq,
+			   SSD_ELEM_NONE);
+
+	return (ua_to_build);
+}
+
+void
+ctl_set_overlapped_cmd(struct ctl_scsiio *ctsio)
+{
+	/* OVERLAPPED COMMANDS ATTEMPTED */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x4E,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_overlapped_tag(struct ctl_scsiio *ctsio, uint8_t tag)
+{
+	/* TAGGED OVERLAPPED COMMANDS (NN = QUEUE TAG) */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x4D,
+		      /*ascq*/ tag,
+		      SSD_ELEM_NONE);
+}
+
+/*
+ * Tell the user that there was a problem with the command or data he sent.
+ */
+void
+ctl_set_invalid_field(struct ctl_scsiio *ctsio, int sks_valid, int command,
+		      int field, int bit_valid, int bit)
+{
+	uint8_t sks[3];
+	int asc;
+
+	if (command != 0) {
+		/* "Invalid field in CDB" */
+		asc = 0x24;
+	} else {
+		/* "Invalid field in parameter list" */
+		asc = 0x26;
+	}
+
+	if (sks_valid) {
+		sks[0] = SSD_SCS_VALID;
+		if (command)
+			sks[0] |= SSD_FIELDPTR_CMD;
+		scsi_ulto2b(field, &sks[1]);
+
+		if (bit_valid)
+			sks[0] |= SSD_BITPTR_VALID | bit;
+	}
+
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      asc,
+		      /*ascq*/ 0x00,
+		      /*type*/ (sks_valid != 0) ? SSD_ELEM_SKS : SSD_ELEM_SKIP,
+		      /*size*/ sizeof(sks),
+		      /*data*/ sks,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_invalid_opcode(struct ctl_scsiio *ctsio)
+{
+	struct scsi_sense_data *sense;
+	uint8_t sks[3];
+
+	sense = &ctsio->sense_data;
+
+	sks[0] = SSD_SCS_VALID | SSD_FIELDPTR_CMD;
+	scsi_ulto2b(0, &sks[1]);
+
+	/* "Invalid command operation code" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x20,
+		      /*ascq*/ 0x00,
+		      /*type*/ SSD_ELEM_SKS,
+		      /*size*/ sizeof(sks),
+		      /*data*/ sks,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_param_len_error(struct ctl_scsiio *ctsio)
+{
+	/* "Parameter list length error" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x1a,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_already_locked(struct ctl_scsiio *ctsio)
+{
+	/* Vendor unique "Somebody already is locked" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x81,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_unsupported_lun(struct ctl_scsiio *ctsio)
+{
+	/* "Logical unit not supported" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x25,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_internal_failure(struct ctl_scsiio *ctsio, int sks_valid,
+			 uint16_t retry_count)
+{
+	uint8_t sks[3];
+
+	if (sks_valid) {
+		sks[0] = SSD_SCS_VALID;
+		sks[1] = (retry_count >> 8) & 0xff;
+		sks[2] = retry_count & 0xff;
+	}
+
+	/* "Internal target failure" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_HARDWARE_ERROR,
+		      /*asc*/ 0x44,
+		      /*ascq*/ 0x00,
+		      /*type*/ (sks_valid != 0) ? SSD_ELEM_SKS : SSD_ELEM_SKIP,
+		      /*size*/ sizeof(sks),
+		      /*data*/ sks,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_medium_error(struct ctl_scsiio *ctsio)
+{
+	if ((ctsio->io_hdr.flags & CTL_FLAG_DATA_MASK) == CTL_FLAG_DATA_IN) {
+		/* "Unrecovered read error" */
+		ctl_set_sense(ctsio,
+			      /*current_error*/ 1,
+			      /*sense_key*/ SSD_KEY_MEDIUM_ERROR,
+			      /*asc*/ 0x11,
+			      /*ascq*/ 0x00,
+			      SSD_ELEM_NONE);
+	} else {
+		/* "Write error - auto reallocation failed" */
+		ctl_set_sense(ctsio,
+			      /*current_error*/ 1,
+			      /*sense_key*/ SSD_KEY_MEDIUM_ERROR,
+			      /*asc*/ 0x0C,
+			      /*ascq*/ 0x02,
+			      SSD_ELEM_NONE);
+	}
+}
+
+void
+ctl_set_aborted(struct ctl_scsiio *ctsio)
+{
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ABORTED_COMMAND,
+		      /*asc*/ 0x45,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_lba_out_of_range(struct ctl_scsiio *ctsio)
+{
+	/* "Logical block address out of range" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x21,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_lun_stopped(struct ctl_scsiio *ctsio)
+{
+	/* "Logical unit not ready, initializing cmd. required" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_NOT_READY,
+		      /*asc*/ 0x04,
+		      /*ascq*/ 0x02,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_lun_not_ready(struct ctl_scsiio *ctsio)
+{
+	/* "Logical unit not ready, manual intervention required" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_NOT_READY,
+		      /*asc*/ 0x04,
+		      /*ascq*/ 0x05,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_illegal_pr_release(struct ctl_scsiio *ctsio)
+{
+	/* "Invalid release of persistent reservation" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
+		      /*asc*/ 0x26,
+		      /*ascq*/ 0x04,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_lun_standby(struct ctl_scsiio *ctsio)
+{
+	/* "Logical unit not ready, target port in standby state" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_NOT_READY,
+		      /*asc*/ 0x04,
+		      /*ascq*/ 0x0b,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_medium_format_corrupted(struct ctl_scsiio *ctsio)
+{
+	/* "Medium format corrupted" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_MEDIUM_ERROR,
+		      /*asc*/ 0x31,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_medium_magazine_inaccessible(struct ctl_scsiio *ctsio)
+{
+	/* "Medium magazine not accessible" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_NOT_READY,
+		      /*asc*/ 0x3b,
+		      /*ascq*/ 0x11,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_data_phase_error(struct ctl_scsiio *ctsio)
+{
+	/* "Data phase error" */
+	ctl_set_sense(ctsio,
+		      /*current_error*/ 1,
+		      /*sense_key*/ SSD_KEY_NOT_READY,
+		      /*asc*/ 0x4b,
+		      /*ascq*/ 0x00,
+		      SSD_ELEM_NONE);
+}
+
+void
+ctl_set_reservation_conflict(struct ctl_scsiio *ctsio)
+{
+	struct scsi_sense_data *sense;
+
+	sense = &ctsio->sense_data;
+	memset(sense, 0, sizeof(*sense));
+	ctsio->scsi_status = SCSI_STATUS_RESERV_CONFLICT;
+	ctsio->sense_len = 0;
+	ctsio->io_hdr.status = CTL_SCSI_ERROR;
+}
+
+void
+ctl_set_queue_full(struct ctl_scsiio *ctsio)
+{
+	struct scsi_sense_data *sense;
+
+	sense = &ctsio->sense_data;
+	memset(sense, 0, sizeof(*sense));
+	ctsio->scsi_status = SCSI_STATUS_QUEUE_FULL;
+	ctsio->sense_len = 0;
+	ctsio->io_hdr.status = CTL_SCSI_ERROR;
+}
+
+void
+ctl_set_busy(struct ctl_scsiio *ctsio)
+{
+	struct scsi_sense_data *sense;
+
+	sense = &ctsio->sense_data;
+	memset(sense, 0, sizeof(*sense));
+	ctsio->scsi_status = SCSI_STATUS_BUSY;
+	ctsio->sense_len = 0;
+	ctsio->io_hdr.status = CTL_SCSI_ERROR;
+}
+
+void
+ctl_set_success(struct ctl_scsiio *ctsio)
+{
+	struct scsi_sense_data *sense;
+
+	sense = &ctsio->sense_data;
+	memset(sense, 0, sizeof(*sense));
+	ctsio->scsi_status = SCSI_STATUS_OK;
+	ctsio->sense_len = 0;
+	ctsio->io_hdr.status = CTL_SUCCESS;
+}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_error.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_error.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,92 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_error.h#1 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_error.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * Function definitions for various error reporting routines used both
+ * within CTL and various CTL clients.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <machine/stdarg.h>
+
+#ifndef	_CTL_ERROR_H_
+#define	_CTL_ERROR_H_
+
+typedef enum {
+	CTL_SENSE_NOT_SPECIFIED,
+	CTL_SENSE_FIXED,
+	CTL_SENSE_DESCRIPTOR
+} ctl_sense_format;
+
+void ctl_set_sense_data_va(struct scsi_sense_data *sense_data, void *lun,
+			   scsi_sense_data_type sense_format, int current_error,
+			   int sense_key, int asc, int ascq, va_list ap); 
+void ctl_set_sense_data(struct scsi_sense_data *sense_data, void *lun,
+			scsi_sense_data_type sense_format, int current_error,
+			int sense_key, int asc, int ascq, ...); 
+void ctl_set_sense(struct ctl_scsiio *ctsio, int current_error, int sense_key,
+		   int asc, int ascq, ...);
+void ctl_sense_to_desc(struct scsi_sense_data_fixed *sense_src,
+		      struct scsi_sense_data_desc *sense_dest);
+void ctl_sense_to_fixed(struct scsi_sense_data_desc *sense_src,
+			struct scsi_sense_data_fixed *sense_dest);
+ctl_sense_format ctl_get_sense_format(struct scsi_sense_data *sense_data);
+void ctl_set_ua(struct ctl_scsiio *ctsio, int asc, int ascq);
+ctl_ua_type ctl_build_ua(ctl_ua_type ua_type, struct scsi_sense_data *sense,
+			 ctl_sense_format sense_format);
+void ctl_set_overlapped_cmd(struct ctl_scsiio *ctsio);
+void ctl_set_overlapped_tag(struct ctl_scsiio *ctsio, uint8_t tag);
+void ctl_set_invalid_field(struct ctl_scsiio *ctsio, int sks_valid, int command,
+			   int field, int bit_valid, int bit);
+void ctl_set_invalid_opcode(struct ctl_scsiio *ctsio);
+void ctl_set_param_len_error(struct ctl_scsiio *ctsio);
+void ctl_set_already_locked(struct ctl_scsiio *ctsio);
+void ctl_set_unsupported_lun(struct ctl_scsiio *ctsio);
+void ctl_set_lun_standby(struct ctl_scsiio *ctsio);
+void ctl_set_internal_failure(struct ctl_scsiio *ctsio, int sks_valid,
+			      uint16_t retry_count);
+void ctl_set_medium_error(struct ctl_scsiio *ctsio);
+void ctl_set_aborted(struct ctl_scsiio *ctsio);
+void ctl_set_lba_out_of_range(struct ctl_scsiio *ctsio);
+void ctl_set_lun_stopped(struct ctl_scsiio *ctsio);
+void ctl_set_lun_not_ready(struct ctl_scsiio *ctsio);
+void ctl_set_illegal_pr_release(struct ctl_scsiio *ctsio);
+void ctl_set_medium_format_corrupted(struct ctl_scsiio *ctsio);
+void ctl_set_medium_magazine_inaccessible(struct ctl_scsiio *ctsio);
+void ctl_set_data_phase_error(struct ctl_scsiio *ctsio);
+void ctl_set_reservation_conflict(struct ctl_scsiio *ctsio);
+void ctl_set_queue_full(struct ctl_scsiio *ctsio);
+void ctl_set_busy(struct ctl_scsiio *ctsio);
+void ctl_set_success(struct ctl_scsiio *ctsio);
+
+#endif	/* _CTL_ERROR_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_frontend.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_frontend.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,187 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_frontend.c#4 $
+ */
+/*
+ * CAM Target Layer front end interface code
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_frontend.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/endian.h>
+#include <sys/queue.h>
+
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_backend.h>
+/* XXX KDM move defines from ctl_ioctl.h to somewhere else */
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_ha.h>
+#include <cam/ctl/ctl_private.h>
+#include <cam/ctl/ctl_debug.h>
+
+extern struct ctl_softc *control_softc;
+
+int
+ctl_frontend_register(struct ctl_frontend *fe, int master_shelf)
+{
+	struct ctl_io_pool *pool;
+	int port_num;
+	int retval;
+
+	retval = 0;
+
+	KASSERT(control_softc != NULL, ("CTL is not initialized"));
+
+	mtx_lock(&control_softc->ctl_lock);
+	port_num = ctl_ffz(&control_softc->ctl_port_mask, CTL_MAX_PORTS);
+	if ((port_num == -1)
+	 || (ctl_set_mask(&control_softc->ctl_port_mask, port_num) == -1)) {
+		fe->targ_port = -1;
+		mtx_unlock(&control_softc->ctl_lock);
+		return (1);
+	}
+	control_softc->num_frontends++;
+
+	mtx_unlock(&control_softc->ctl_lock);
+	/*
+	 * We add 20 to whatever the caller requests, so he doesn't get
+	 * burned by queueing things back to the pending sense queue.  In
+	 * theory, there should probably only be one outstanding item, at
+	 * most, on the pending sense queue for a LUN.  We'll clear the
+	 * pending sense queue on the next command, whether or not it is
+	 * a REQUEST SENSE.
+	 */
+	retval = ctl_pool_create(control_softc,
+				 (fe->port_type != CTL_PORT_IOCTL) ?
+				 CTL_POOL_FETD : CTL_POOL_IOCTL,
+				 fe->num_requested_ctl_io + 20, &pool);
+	if (retval != 0) {
+		fe->targ_port = -1;
+		mtx_lock(&control_softc->ctl_lock);
+		ctl_clear_mask(&control_softc->ctl_port_mask, port_num);
+		mtx_unlock(&control_softc->ctl_lock);
+		return (retval);
+	}
+
+	mtx_lock(&control_softc->ctl_lock);
+
+	/* For now assume master shelf */
+	//fe->targ_port = port_num;
+	fe->targ_port = port_num + (master_shelf!=0 ? 0 : CTL_MAX_PORTS);
+	fe->max_initiators = CTL_MAX_INIT_PER_PORT;
+	STAILQ_INSERT_TAIL(&control_softc->fe_list, fe, links);
+	ctl_pool_acquire(pool);
+	control_softc->ctl_ports[port_num] = fe;
+
+	mtx_unlock(&control_softc->ctl_lock);
+
+	fe->ctl_pool_ref = pool;
+
+	return (retval);
+}
+
+int
+ctl_frontend_deregister(struct ctl_frontend *fe)
+{
+	struct ctl_io_pool *pool;
+	int port_num;
+	int retval;
+
+	retval = 0;
+
+	pool = (struct ctl_io_pool *)fe->ctl_pool_ref;
+
+	if (fe->targ_port == -1) {
+		retval = 1;
+		goto bailout;
+	}
+
+	mtx_lock(&control_softc->ctl_lock);
+
+	ctl_pool_invalidate(pool);
+	ctl_pool_release(pool);
+
+	STAILQ_REMOVE(&control_softc->fe_list, fe, ctl_frontend, links);
+	control_softc->num_frontends--;
+	port_num = (fe->targ_port < CTL_MAX_PORTS) ? fe->targ_port :
+	                                             fe->targ_port - CTL_MAX_PORTS;
+	ctl_clear_mask(&control_softc->ctl_port_mask, port_num);
+	control_softc->ctl_ports[port_num] = NULL;
+	mtx_unlock(&control_softc->ctl_lock);
+bailout:
+	return (retval);
+}
+
+void
+ctl_frontend_set_wwns(struct ctl_frontend *fe, int wwnn_valid, uint64_t wwnn,
+		      int wwpn_valid, uint64_t wwpn)
+{
+	if (wwnn_valid)
+		fe->wwnn = wwnn;
+
+	if (wwpn_valid)
+		fe->wwpn = wwpn;
+}
+
+void
+ctl_frontend_online(struct ctl_frontend *fe)
+{
+	fe->port_online(fe->onoff_arg);
+	/* XXX KDM need a lock here? */
+	fe->status |= CTL_PORT_STATUS_ONLINE;
+}
+
+void
+ctl_frontend_offline(struct ctl_frontend *fe)
+{
+	fe->port_offline(fe->onoff_arg);
+	/* XXX KDM need a lock here? */
+	fe->status &= ~CTL_PORT_STATUS_ONLINE;
+}
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_frontend.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_frontend.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,295 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_frontend.h#2 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_frontend.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer front end registration hooks
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_FRONTEND_H_
+#define	_CTL_FRONTEND_H_
+
+typedef enum {
+	CTL_PORT_STATUS_NONE		= 0x00,
+	CTL_PORT_STATUS_ONLINE		= 0x01,
+	CTL_PORT_STATUS_TARG_ONLINE	= 0x02,
+	CTL_PORT_STATUS_LUN_ONLINE	= 0x04
+} ctl_port_status;
+
+typedef void (*port_func_t)(void *onoff_arg);
+typedef int (*targ_func_t)(void *arg, struct ctl_id targ_id);
+typedef	int (*lun_func_t)(void *arg, struct ctl_id targ_id, int lun_id);
+
+/*
+ * The ctl_frontend structure is the registration mechanism between a FETD
+ * (Front End Target Driver) and the CTL layer.  Here is a description of
+ * the fields:
+ *
+ * port_type:		  This field tells CTL what kind of front end it is
+ *                        dealing with.  This field serves two purposes.
+ *                        The first is to let CTL know whether the frontend
+ *                        in question is inside the main CTL module (i.e.
+ *                        the ioctl front end), and therefore its module
+ *                        reference count shouldn't be incremented.  The
+ *                        CTL ioctl front end should continue to use the
+ *                        CTL_PORT_IOCTL argument as long as it is part of
+ *                        the main CTL module.  The second is to let CTL
+ *                        know what kind of front end it is dealing with, so
+ *                        it can return the proper inquiry data for that
+ *                        particular port.
+ *
+ * num_requested_ctl_io:  This is the number of ctl_io structures that the
+ *			  front end needs for its pool.  This should
+ * 			  generally be the maximum number of outstanding
+ *			  transactions that the FETD can handle.  The CTL
+ *			  layer will add a few to this to account for
+ *			  ctl_io buffers queued for pending sense data.
+ *			  (Pending sense only gets queued if the FETD
+ * 			  doesn't support autosense.  e.g. non-packetized
+ * 			  parallel SCSI doesn't support autosense.)
+ *
+ * port_name:		  A string describing the FETD.  e.g. "LSI 1030T U320"
+ *			  or whatever you want to use to describe the driver.
+ *
+ *
+ * physical_port:	  This is the physical port number of this
+ * 			  particular port within the driver/hardware.  This
+ * 			  number is hardware/driver specific.
+ * virtual_port:	  This is the virtual port number of this
+ * 			  particular port.  This is for things like NP-IV.
+ * 
+ * port_online():	  This function is called, with onoff_arg as its
+ *			  argument, by the CTL layer when it wants the FETD
+ *			  to start responding to selections on the specified
+ * 			  target ID.  (targ_target)
+ *
+ * port_offline():	  This function is called, with onoff_arg as its
+ *			  argument, by the CTL layer when it wants the FETD
+ * 			  to stop responding to selection on the specified
+ * 			  target ID.  (targ_target)
+ *
+ * onoff_arg:		  This is supplied as an argument to port_online()
+ *			  and port_offline().  This is specified by the
+ *			  FETD.
+ *
+ * targ_enable():	  This function is called, with targ_lun_arg and a
+ * 			  target ID as its arguments, by CTL when it wants
+ *			  the FETD to enable a particular target.  targ_enable()
+ *			  will always be called for a particular target ID
+ * 			  before any LUN is enabled for that target.  If the
+ *			  FETD does not support enabling targets, but rather
+ *			  LUNs, it should ignore this call and return 0.  If
+ *			  the FETD does support enabling targets, it should
+ *			  return 0 for success and non-zero if it cannot
+ *			  enable the given target.
+ *
+ *			  TODO:  Add the ability to specify a WWID here.
+ *
+ * targ_disable():	  This function is called, with targ_lun_arg and a
+ *			  target ID as its arguments, by CTL when it wants
+ *			  the FETD to disable a particular target.
+ *			  targ_disable() will always be called for a
+ *			  particular target ID after all LUNs are disabled
+ *			  on that particular target.  If the FETD does not
+ *			  support enabling targets, it should ignore this
+ *			  call and return 0.  If the FETD does support
+ *			  enabling targets, it should return 0 for success,
+ *			  and non-zero if it cannot disable the given target.
+ *
+ * lun_enable():	  This function is called, with targ_lun_arg, a target
+ *			  ID and a LUN ID as its arguments, by CTL when it
+ *			  wants the FETD to enable a particular LUN.  If the
+ *			  FETD doesn't really know about LUNs, it should
+ *			  just ignore this call and return 0.  If the FETD
+ *			  cannot enable the requested LUN for some reason, the
+ *			  FETD should return non-zero status.
+ *
+ * lun_disable():	  This function is called, with targ_lun_arg, a target
+ *			  ID and LUN ID as its arguments, by CTL when it
+ *			  wants the FETD to disable a particular LUN.  If the
+ *			  FETD doesn't really know about LUNs, it should just
+ *			  ignore this call and return 0.  If the FETD cannot
+ *			  disable the requested LUN for some reason, the
+ *			  FETD should return non-zero status.
+ *
+ * targ_lun_arg:	  This is supplied as an argument to the targ/lun
+ *			  enable/disable() functions.  This is specified by
+ *			  the FETD.
+ *
+ * fe_datamove():	  This function is called one or more times per I/O
+ *			  by the CTL layer to tell the FETD to initiate a
+ *			  DMA to or from the data buffer(s) specified by
+ * 			  the passed-in ctl_io structure.
+ *
+ * fe_done():	  	  This function is called by the CTL layer when a
+ *			  particular SCSI I/O or task management command has
+ * 			  completed.  For SCSI I/O requests (CTL_IO_SCSI),
+ *			  sense data is always supplied if the status is
+ *			  CTL_SCSI_ERROR and the SCSI status byte is
+ *			  SCSI_STATUS_CHECK_COND.  If the FETD doesn't
+ *			  support autosense, the sense should be queued
+ *			  back to the CTL layer via ctl_queue_sense().
+ *
+ * fe_dump():		  This function, if it exists, is called by CTL
+ *			  to request a dump of any debugging information or
+ *			  state to the console.
+ *
+ * max_targets:		  The maximum number of targets that we can create
+ *			  per-port.
+ *
+ * max_target_id:	  The highest target ID that we can use.
+ *
+ * targ_port:		  The CTL layer assigns a "port number" to every
+ *			  FETD.  This port number should be passed back in
+ *			  in the header of every ctl_io that is queued to
+ *			  the CTL layer.  This enables us to determine
+ *			  which bus the command came in on.
+ *
+ * ctl_pool_ref:	  Memory pool reference used by the FETD in calls to
+ * 			  ctl_alloc_io().
+ *
+ * max_initiators:	  Maximum number of initiators that the FETD is
+ *			  allowed to have.  Initiators should be numbered
+ *			  from 0 to max_initiators - 1.  This value will
+ * 			  typically be 16, and thus not a problem for
+ * 			  parallel SCSI.  This may present issues for Fibre
+ *			  Channel.
+ *
+ * wwnn			  World Wide Node Name to be used by the FETD.
+ *			  Note that this is set *after* registration.  It
+ * 			  will be set prior to the online function getting
+ * 			  called.
+ *
+ * wwpn			  World Wide Port Name to be used by the FETD.
+ *			  Note that this is set *after* registration.  It
+ * 			  will be set prior to the online function getting
+ * 			  called.
+ *
+ * status:		  Used by CTL to keep track of per-FETD state.
+ *
+ * links:		  Linked list pointers, used by CTL.  The FETD
+ *			  shouldn't touch this field.
+ */
+struct ctl_frontend {
+	ctl_port_type	port_type;		/* passed to CTL */
+	int		num_requested_ctl_io;	/* passed to CTL */
+	char		*port_name;		/* passed to CTL */
+	int		physical_port;		/* passed to CTL */
+	int		virtual_port;		/* passed to CTL */
+	port_func_t	port_online;		/* passed to CTL */
+	port_func_t	port_offline;		/* passed to CTL */
+	void		*onoff_arg;		/* passed to CTL */
+	targ_func_t	targ_enable;		/* passed to CTL */
+	targ_func_t	targ_disable;		/* passed to CTL */
+	lun_func_t	lun_enable;		/* passed to CTL */
+	lun_func_t	lun_disable;		/* passed to CTL */
+	void		*targ_lun_arg;		/* passed to CTL */
+	void		(*fe_datamove)(union ctl_io *io); /* passed to CTL */
+	void		(*fe_done)(union ctl_io *io); /* passed to CTL */
+	void		(*fe_dump)(void);	/* passed to CTL */
+	int		max_targets;		/* passed to CTL */
+	int		max_target_id;		/* passed to CTL */
+	int32_t		targ_port;		/* passed back to FETD */
+	void		*ctl_pool_ref;		/* passed back to FETD */
+	uint32_t	max_initiators;		/* passed back to FETD */
+	uint64_t	wwnn;			/* set by CTL before online */
+	uint64_t	wwpn;			/* set by CTL before online */
+	ctl_port_status	status;			/* used by CTL */
+	STAILQ_ENTRY(ctl_frontend) links;	/* used by CTL */
+};
+
+/*
+ * This may block until resources are allocated.  Called at FETD module load
+ * time. Returns 0 for success, non-zero for failure.
+ */
+int ctl_frontend_register(struct ctl_frontend *fe, int master_SC);
+
+/*
+ * Called at FETD module unload time.
+ * Returns 0 for success, non-zero for failure.
+ */
+int ctl_frontend_deregister(struct ctl_frontend *fe);
+
+/*
+ * Called to set the WWNN and WWPN for a particular frontend.
+ */
+void ctl_frontend_set_wwns(struct ctl_frontend *fe, int wwnn_valid,
+			   uint64_t wwnn, int wwpn_valid, uint64_t wwpn);
+
+/*
+ * Called to bring a particular frontend online.
+ */
+void ctl_frontend_online(struct ctl_frontend *fe);
+
+/*
+ * Called to take a particular frontend offline.
+ */
+void ctl_frontend_offline(struct ctl_frontend *fe);
+
+/*
+ * This routine queues I/O and task management requests from the FETD to the
+ * CTL layer.  Returns immediately.  Returns 0 for success, non-zero for
+ * failure.
+ */
+int ctl_queue(union ctl_io *io);
+
+/*
+ * This routine is used if the front end interface doesn't support
+ * autosense (e.g. non-packetized parallel SCSI).  This will queue the
+ * scsiio structure back to a per-lun pending sense queue.  This MUST be
+ * called BEFORE any request sense can get queued to the CTL layer -- I
+ * need it in the queue in order to service the request.  The scsiio
+ * structure passed in here will be freed by the CTL layer when sense is
+ * retrieved by the initiator.  Returns 0 for success, non-zero for failure.
+ */
+int ctl_queue_sense(union ctl_io *io);
+
+/*
+ * This routine adds an initiator to CTL's port database.  The WWPN should
+ * be the FC WWPN, if available.  The targ_port field should be the same as
+ * the targ_port passed back from CTL in the ctl_frontend structure above.
+ * The iid field should be the same as the iid passed in the nexus of each
+ * ctl_io from this initiator.
+ */
+int ctl_add_initiator(uint64_t wwpn, int32_t targ_port, uint32_t iid);
+
+/*
+ * This routine will remove an initiator from CTL's port database.  The
+ * targ_port field should be the same as the targ_port passed back in the
+ * ctl_frontend structure above.  The iid field should be the same as the
+ * iid passed in the nexus of each ctl_io from this initiator.
+ */
+int
+ctl_remove_initiator(int32_t targ_port, uint32_t iid);
+
+#endif	/* _CTL_FRONTEND_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_frontend_cam_sim.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_frontend_cam_sim.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,866 @@
+/*-
+ * Copyright (c) 2009 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_frontend_cam_sim.c#4 $
+ */
+/*
+ * CTL frontend to CAM SIM interface.  This allows access to CTL LUNs via
+ * the da(4) and pass(4) drivers from inside the system.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_frontend_cam_sim.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/queue.h>
+#include <sys/bus.h>
+#include <sys/sysctl.h>
+#include <machine/bus.h>
+#include <sys/sbuf.h>
+
+#include <cam/cam.h>
+#include <cam/cam_ccb.h>
+#include <cam/cam_sim.h>
+#include <cam/cam_xpt_sim.h>
+#include <cam/cam_xpt.h>
+#include <cam/cam_periph.h>
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_message.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_mem_pool.h>
+#include <cam/ctl/ctl_debug.h>
+
+#define	io_ptr		spriv_ptr1
+
+struct cfcs_io {
+	union ccb *ccb;
+};
+
+struct cfcs_softc {
+	struct ctl_frontend fe;
+	char port_name[32];
+	struct cam_sim *sim;
+	struct cam_devq *devq;
+	struct cam_path *path;
+	struct mtx lock;
+	char lock_desc[32];
+	uint64_t wwnn;
+	uint64_t wwpn;
+	uint32_t cur_tag_num;
+	int online;
+};
+
+/*
+ * We can't handle CCBs with these flags.  For the most part, we just don't
+ * handle physical addresses yet.  That would require mapping things in
+ * order to do the copy.
+ */
+#define	CFCS_BAD_CCB_FLAGS (CAM_DATA_PHYS | CAM_SG_LIST_PHYS | \
+	CAM_MSG_BUF_PHYS | CAM_SNS_BUF_PHYS | CAM_CDB_PHYS | CAM_SENSE_PTR |\
+	CAM_SENSE_PHYS)
+
+int cfcs_init(void);
+void cfcs_shutdown(void);
+static void cfcs_poll(struct cam_sim *sim);
+static void cfcs_online(void *arg);
+static void cfcs_offline(void *arg);
+static int cfcs_targ_enable(void *arg, struct ctl_id targ_id);
+static int cfcs_targ_disable(void *arg, struct ctl_id targ_id);
+static int cfcs_lun_enable(void *arg, struct ctl_id target_id, int lun_id);
+static int cfcs_lun_disable(void *arg, struct ctl_id target_id, int lun_id);
+static void cfcs_datamove(union ctl_io *io);
+static void cfcs_done(union ctl_io *io);
+void cfcs_action(struct cam_sim *sim, union ccb *ccb);
+static void cfcs_async(void *callback_arg, uint32_t code,
+		       struct cam_path *path, void *arg);
+
+struct cfcs_softc cfcs_softc;
+/*
+ * This is primarly intended to allow for error injection to test the CAM
+ * sense data and sense residual handling code.  This sets the maximum
+ * amount of SCSI sense data that we will report to CAM.
+ */
+static int cfcs_max_sense = sizeof(struct scsi_sense_data);
+
+SYSINIT(cfcs_init, SI_SUB_CONFIGURE, SI_ORDER_FOURTH, cfcs_init, NULL);
+SYSCTL_NODE(_kern_cam, OID_AUTO, ctl2cam, CTLFLAG_RD, 0,
+	    "CAM Target Layer SIM frontend");
+SYSCTL_INT(_kern_cam_ctl2cam, OID_AUTO, max_sense, CTLFLAG_RW,
+           &cfcs_max_sense, 0, "Maximum sense data size");
+
+
+int
+cfcs_init(void)
+{
+	struct cfcs_softc *softc;
+	struct ccb_setasync csa;
+	struct ctl_frontend *fe;
+#ifdef NEEDTOPORT
+	char wwnn[8];
+#endif
+	int retval;
+
+	softc = &cfcs_softc;
+	retval = 0;
+	bzero(softc, sizeof(*softc));
+	sprintf(softc->lock_desc, "ctl2cam");
+	mtx_init(&softc->lock, softc->lock_desc, NULL, MTX_DEF);
+	fe = &softc->fe;
+
+	fe->port_type = CTL_PORT_INTERNAL;
+	/* XXX KDM what should the real number be here? */
+	fe->num_requested_ctl_io = 4096;
+	snprintf(softc->port_name, sizeof(softc->port_name), "ctl2cam");
+	fe->port_name = softc->port_name;
+	fe->port_online = cfcs_online;
+	fe->port_offline = cfcs_offline;
+	fe->onoff_arg = softc;
+	fe->targ_enable = cfcs_targ_enable;
+	fe->targ_disable = cfcs_targ_disable;
+	fe->lun_enable = cfcs_lun_enable;
+	fe->lun_disable = cfcs_lun_disable;
+	fe->targ_lun_arg = softc;
+	fe->fe_datamove = cfcs_datamove;
+	fe->fe_done = cfcs_done;
+
+	/* XXX KDM what should we report here? */
+	/* XXX These should probably be fetched from CTL. */
+	fe->max_targets = 1;
+	fe->max_target_id = 15;
+
+	retval = ctl_frontend_register(fe, /*master_SC*/ 1);
+	if (retval != 0) {
+		printf("%s: ctl_frontend_register() failed with error %d!\n",
+		       __func__, retval);
+		retval = 1;
+		goto bailout;
+	}
+
+	/*
+	 * Get the WWNN out of the database, and create a WWPN as well.
+	 */
+#ifdef NEEDTOPORT
+	ddb_GetWWNN((char *)wwnn);
+	softc->wwnn = be64dec(wwnn);
+	softc->wwpn = softc->wwnn + (softc->fe.targ_port & 0xff);
+#endif
+
+	/*
+	 * If the CTL frontend didn't tell us what our WWNN/WWPN is, go
+	 * ahead and set something random.
+	 */
+	if (fe->wwnn == 0) {
+		uint64_t random_bits;
+
+		arc4rand(&random_bits, sizeof(random_bits), 0);
+		softc->wwnn = (random_bits & 0x0000000fffffff00ULL) |
+			/* Company ID */ 0x5000000000000000ULL |
+			/* NL-Port */    0x0300;
+		softc->wwpn = softc->wwnn + fe->targ_port + 1;
+		fe->wwnn = softc->wwnn;
+		fe->wwpn = softc->wwpn;
+	} else {
+		softc->wwnn = fe->wwnn;
+		softc->wwpn = fe->wwpn;
+	}
+
+
+	softc->devq = cam_simq_alloc(fe->num_requested_ctl_io);
+	if (softc->devq == NULL) {
+		printf("%s: error allocating devq\n", __func__);
+		retval = ENOMEM;
+		goto bailout;
+	}
+
+	softc->sim = cam_sim_alloc(cfcs_action, cfcs_poll, softc->port_name,
+				   softc, /*unit*/ 0, &softc->lock, 1,
+				   fe->num_requested_ctl_io, softc->devq);
+	if (softc->sim == NULL) {
+		printf("%s: error allocating SIM\n", __func__);
+		retval = ENOMEM;
+		goto bailout;
+	}
+
+	mtx_lock(&softc->lock);
+	if (xpt_bus_register(softc->sim, NULL, 0) != CAM_SUCCESS) {
+		printf("%s: error registering SIM\n", __func__);
+		retval = ENOMEM;
+		goto bailout;
+	}
+
+	if (xpt_create_path(&softc->path, /*periph*/NULL,
+			    cam_sim_path(softc->sim),
+			    CAM_TARGET_WILDCARD,
+			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
+		printf("%s: error creating path\n", __func__);
+		xpt_bus_deregister(cam_sim_path(softc->sim));
+		retval = 1;
+		goto bailout;
+	}
+
+	mtx_unlock(&softc->lock);
+
+	xpt_setup_ccb(&csa.ccb_h, softc->path, /*priority*/ 5);
+	csa.ccb_h.func_code = XPT_SASYNC_CB;
+	csa.event_enable = AC_LOST_DEVICE;
+	csa.callback = cfcs_async;
+        csa.callback_arg = softc->sim;
+        xpt_action((union ccb *)&csa);
+
+	return (retval);
+
+bailout:
+	if (softc->sim)
+		cam_sim_free(softc->sim, /*free_devq*/ TRUE);
+	else if (softc->devq)
+		cam_simq_free(softc->devq);
+
+	mtx_unlock(&softc->lock);
+
+	return (retval);
+}
+
+static void
+cfcs_poll(struct cam_sim *sim)
+{
+
+}
+
+void
+cfcs_shutdown(void)
+{
+
+}
+
+static void
+cfcs_online(void *arg)
+{
+	struct cfcs_softc *softc;
+	union ccb *ccb;
+
+	softc = (struct cfcs_softc *)arg;
+
+	mtx_lock(&softc->lock);
+	softc->online = 1;
+	mtx_unlock(&softc->lock);
+
+	ccb = xpt_alloc_ccb_nowait();
+	if (ccb == NULL) {
+		printf("%s: unable to allocate CCB for rescan\n", __func__);
+		return;
+	}
+
+	if (xpt_create_path(&ccb->ccb_h.path, xpt_periph,
+			    cam_sim_path(softc->sim), CAM_TARGET_WILDCARD,
+			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
+		printf("%s: can't allocate path for rescan\n", __func__);
+		xpt_free_ccb(ccb);
+		return;
+	}
+	xpt_rescan(ccb);
+}
+
+static void
+cfcs_offline(void *arg)
+{
+	struct cfcs_softc *softc;
+	union ccb *ccb;
+
+	softc = (struct cfcs_softc *)arg;
+
+	mtx_lock(&softc->lock);
+	softc->online = 0;
+	mtx_unlock(&softc->lock);
+
+	ccb = xpt_alloc_ccb_nowait();
+	if (ccb == NULL) {
+		printf("%s: unable to allocate CCB for rescan\n", __func__);
+		return;
+	}
+
+	if (xpt_create_path(&ccb->ccb_h.path, xpt_periph,
+			    cam_sim_path(softc->sim), CAM_TARGET_WILDCARD,
+			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
+		printf("%s: can't allocate path for rescan\n", __func__);
+		xpt_free_ccb(ccb);
+		return;
+	}
+	xpt_rescan(ccb);
+}
+
+static int
+cfcs_targ_enable(void *arg, struct ctl_id targ_id)
+{
+	return (0);
+}
+
+static int
+cfcs_targ_disable(void *arg, struct ctl_id targ_id)
+{
+	return (0);
+}
+
+static int
+cfcs_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
+{
+	return (0);
+}
+static int
+cfcs_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
+{
+	return (0);
+}
+
+/*
+ * This function is very similar to ctl_ioctl_do_datamove().  Is there a
+ * way to combine the functionality?
+ *
+ * XXX KDM may need to move this into a thread.  We're doing a bcopy in the
+ * caller's context, which will usually be the backend.  That may not be a
+ * good thing.
+ */
+static void
+cfcs_datamove(union ctl_io *io)
+{
+	union ccb *ccb;
+	bus_dma_segment_t cam_sg_entry, *cam_sglist;
+	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
+	int cam_sg_count, ctl_sg_count, cam_sg_start;
+	int cam_sg_offset;
+	int len_to_copy, len_copied;
+	int ctl_watermark, cam_watermark;
+	int i, j;
+
+
+	cam_sg_offset = 0;
+	cam_sg_start = 0;
+
+	ccb = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+
+	/*
+	 * Note that we have a check in cfcs_action() to make sure that any
+	 * CCBs with "bad" flags are returned with CAM_REQ_INVALID.  This
+	 * is just to make sure no one removes that check without updating
+	 * this code to provide the additional functionality necessary to
+	 * support those modes of operation.
+	 */
+	KASSERT(((ccb->ccb_h.flags & CFCS_BAD_CCB_FLAGS) == 0), ("invalid "
+		  "CAM flags %#x", (ccb->ccb_h.flags & CFCS_BAD_CCB_FLAGS)));
+
+	/*
+	 * Simplify things on both sides by putting single buffers into a
+	 * single entry S/G list.
+	 */
+	if (ccb->ccb_h.flags & CAM_SCATTER_VALID) {
+		if (ccb->ccb_h.flags & CAM_SG_LIST_PHYS) {
+			/* We should filter this out on entry */
+			panic("%s: physical S/G list, should not get here",
+			      __func__);
+		} else {
+			int len_seen;
+
+			cam_sglist = (bus_dma_segment_t *)ccb->csio.data_ptr;
+			cam_sg_count = ccb->csio.sglist_cnt;
+
+			for (i = 0, len_seen = 0; i < cam_sg_count; i++) {
+				if ((len_seen + cam_sglist[i].ds_len) >=
+				     io->scsiio.kern_rel_offset) {
+					cam_sg_start = i;
+					cam_sg_offset =
+						io->scsiio.kern_rel_offset -
+						len_seen;
+					break;
+				}
+				len_seen += cam_sglist[i].ds_len;
+			}
+		}
+	} else {
+		cam_sglist = &cam_sg_entry;
+		cam_sglist[0].ds_len = ccb->csio.dxfer_len;
+		cam_sglist[0].ds_addr = (bus_addr_t)ccb->csio.data_ptr;
+		cam_sg_count = 1;
+		cam_sg_start = 0;
+		cam_sg_offset = io->scsiio.kern_rel_offset;
+	}
+
+	if (io->scsiio.kern_sg_entries > 0) {
+		ctl_sglist = (struct ctl_sg_entry *)io->scsiio.kern_data_ptr;
+		ctl_sg_count = io->scsiio.kern_sg_entries;
+	} else {
+		ctl_sglist = &ctl_sg_entry;
+		ctl_sglist->addr = io->scsiio.kern_data_ptr;
+		ctl_sglist->len = io->scsiio.kern_data_len;
+		ctl_sg_count = 1;
+	}
+
+	ctl_watermark = 0;
+	cam_watermark = cam_sg_offset;
+	len_copied = 0;
+	for (i = cam_sg_start, j = 0;
+	     i < cam_sg_count && j < ctl_sg_count;) {
+		uint8_t *cam_ptr, *ctl_ptr;
+
+		len_to_copy = ctl_min(cam_sglist[i].ds_len - cam_watermark,
+				      ctl_sglist[j].len - ctl_watermark);
+
+		cam_ptr = (uint8_t *)cam_sglist[i].ds_addr;
+		cam_ptr = cam_ptr + cam_watermark;
+		if (io->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
+			/*
+			 * XXX KDM fix this!
+			 */
+			panic("need to implement bus address support");
+#if 0
+			kern_ptr = bus_to_virt(kern_sglist[j].addr);
+#endif
+		} else
+			ctl_ptr = (uint8_t *)ctl_sglist[j].addr;
+		ctl_ptr = ctl_ptr + ctl_watermark;
+
+		ctl_watermark += len_to_copy;
+		cam_watermark += len_to_copy;
+
+		if ((io->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
+		     CTL_FLAG_DATA_IN) {
+			CTL_DEBUG_PRINT(("%s: copying %d bytes to CAM\n",
+					 __func__, len_to_copy));
+			CTL_DEBUG_PRINT(("%s: from %p to %p\n", ctl_ptr,
+					 __func__, cam_ptr));
+			bcopy(ctl_ptr, cam_ptr, len_to_copy);
+		} else {
+			CTL_DEBUG_PRINT(("%s: copying %d bytes from CAM\n",
+					 __func__, len_to_copy));
+			CTL_DEBUG_PRINT(("%s: from %p to %p\n", cam_ptr,
+					 __func__, ctl_ptr));
+			bcopy(cam_ptr, ctl_ptr, len_to_copy);
+		}
+
+		len_copied += len_to_copy;
+
+		if (cam_sglist[i].ds_len == cam_watermark) {
+			i++;
+			cam_watermark = 0;
+		}
+
+		if (ctl_sglist[j].len == ctl_watermark) {
+			j++;
+			ctl_watermark = 0;
+		}
+	}
+
+	io->scsiio.ext_data_filled += len_copied;
+
+	io->scsiio.be_move_done(io);
+}
+
+static void
+cfcs_done(union ctl_io *io)
+{
+	union ccb *ccb;
+	struct cfcs_softc *softc;
+	struct cam_sim *sim;
+
+	ccb = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+
+	sim = xpt_path_sim(ccb->ccb_h.path);
+	softc = (struct cfcs_softc *)cam_sim_softc(sim);
+
+	/*
+	 * At this point we should have status.  If we don't, that's a bug.
+	 */
+	KASSERT(((io->io_hdr.status & CTL_STATUS_MASK) != CTL_STATUS_NONE),
+		("invalid CTL status %#x", io->io_hdr.status));
+
+	/*
+	 * Translate CTL status to CAM status.
+	 */
+	switch (io->io_hdr.status & CTL_STATUS_MASK) {
+	case CTL_SUCCESS:
+		ccb->ccb_h.status = CAM_REQ_CMP;
+		break;
+	case CTL_SCSI_ERROR:
+		ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR | CAM_AUTOSNS_VALID;
+		ccb->csio.scsi_status = io->scsiio.scsi_status;
+		bcopy(&io->scsiio.sense_data, &ccb->csio.sense_data,
+		      min(io->scsiio.sense_len, ccb->csio.sense_len));
+		if (ccb->csio.sense_len > io->scsiio.sense_len)
+			ccb->csio.sense_resid = ccb->csio.sense_len -
+						io->scsiio.sense_len;
+		else
+			ccb->csio.sense_resid = 0;
+		if ((ccb->csio.sense_len - ccb->csio.sense_resid) >
+		     cfcs_max_sense) {
+			ccb->csio.sense_resid = ccb->csio.sense_len -
+						cfcs_max_sense;
+		}
+		break;
+	case CTL_CMD_ABORTED:
+		ccb->ccb_h.status = CAM_REQ_ABORTED;
+		break;
+	case CTL_ERROR:
+	default:
+		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
+		break;
+	}
+
+	mtx_lock(sim->mtx);
+	xpt_done(ccb);
+	mtx_unlock(sim->mtx);
+
+	ctl_free_io(io);
+}
+
+void
+cfcs_action(struct cam_sim *sim, union ccb *ccb)
+{
+	struct cfcs_softc *softc;
+	int err;
+
+	softc = (struct cfcs_softc *)cam_sim_softc(sim);
+	mtx_assert(&softc->lock, MA_OWNED);
+
+	switch (ccb->ccb_h.func_code) {
+	case XPT_SCSI_IO: {
+		union ctl_io *io;
+		struct ccb_scsiio *csio;
+
+		csio = &ccb->csio;
+
+		/*
+		 * Catch CCB flags, like physical address flags, that
+	 	 * indicate situations we currently can't handle.
+		 */
+		if (ccb->ccb_h.flags & CFCS_BAD_CCB_FLAGS) {
+			ccb->ccb_h.status = CAM_REQ_INVALID;
+			printf("%s: bad CCB flags %#x (all flags %#x)\n",
+			       __func__, ccb->ccb_h.flags & CFCS_BAD_CCB_FLAGS,
+			       ccb->ccb_h.flags);
+			xpt_done(ccb);
+			return;
+		}
+
+		/*
+		 * If we aren't online, there are no devices to see.
+		 */
+		if (softc->online == 0) {
+			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+			xpt_done(ccb);
+			return;
+		}
+
+		io = ctl_alloc_io(softc->fe.ctl_pool_ref);
+		if (io == NULL) {
+			printf("%s: can't allocate ctl_io\n", __func__);
+			ccb->ccb_h.status = CAM_BUSY | CAM_DEV_QFRZN;
+			xpt_freeze_devq(ccb->ccb_h.path, 1);
+			xpt_done(ccb);
+			return;
+		}
+		ctl_zero_io(io);
+		/* Save pointers on both sides */
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = ccb;
+		ccb->ccb_h.io_ptr = io;
+
+		/*
+		 * Only SCSI I/O comes down this path, resets, etc. come
+		 * down via the XPT_RESET_BUS/LUN CCBs below.
+		 */
+		io->io_hdr.io_type = CTL_IO_SCSI;
+		io->io_hdr.nexus.initid.id = 1;
+		io->io_hdr.nexus.targ_port = softc->fe.targ_port;
+		/*
+		 * XXX KDM how do we handle target IDs?
+		 */
+		io->io_hdr.nexus.targ_target.id = ccb->ccb_h.target_id;
+		io->io_hdr.nexus.targ_lun = ccb->ccb_h.target_lun;
+		/*
+		 * This tag scheme isn't the best, since we could in theory
+		 * have a very long-lived I/O and tag collision, especially
+		 * in a high I/O environment.  But it should work well
+		 * enough for now.  Since we're using unsigned ints,
+		 * they'll just wrap around.
+		 */
+		io->scsiio.tag_num = softc->cur_tag_num++;
+		csio->tag_id = io->scsiio.tag_num;
+		switch (csio->tag_action) {
+		case CAM_TAG_ACTION_NONE:
+			io->scsiio.tag_type = CTL_TAG_UNTAGGED;
+			break;
+		case MSG_SIMPLE_TASK:
+			io->scsiio.tag_type = CTL_TAG_SIMPLE;
+			break;
+		case MSG_HEAD_OF_QUEUE_TASK:
+        		io->scsiio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
+			break;
+		case MSG_ORDERED_TASK:
+        		io->scsiio.tag_type = CTL_TAG_ORDERED;
+			break;
+		case MSG_ACA_TASK:
+			io->scsiio.tag_type = CTL_TAG_ACA;
+			break;
+		default:
+			io->scsiio.tag_type = CTL_TAG_UNTAGGED;
+			printf("%s: unhandled tag type %#x!!\n", __func__,
+			       csio->tag_action);
+			break;
+		}
+		if (csio->cdb_len > sizeof(io->scsiio.cdb)) {
+			printf("%s: WARNING: CDB len %d > ctl_io space %zd\n",
+			       __func__, csio->cdb_len, sizeof(io->scsiio.cdb));
+		}
+		io->scsiio.cdb_len = min(csio->cdb_len, sizeof(io->scsiio.cdb));
+		bcopy(csio->cdb_io.cdb_bytes, io->scsiio.cdb,
+		      io->scsiio.cdb_len);
+
+		err = ctl_queue(io);
+		if (err != CTL_RETVAL_COMPLETE) {
+			printf("%s: func %d: error %d returned by "
+			       "ctl_queue()!\n", __func__,
+			       ccb->ccb_h.func_code, err);
+			ctl_free_io(io);
+		} else {
+			ccb->ccb_h.status |= CAM_SIM_QUEUED;
+		}
+		break;
+	}
+	case XPT_ABORT: {
+		union ctl_io *io;
+		union ccb *abort_ccb;
+
+		abort_ccb = ccb->cab.abort_ccb;
+
+		if (abort_ccb->ccb_h.func_code != XPT_SCSI_IO) {
+			ccb->ccb_h.status = CAM_REQ_INVALID;
+			xpt_done(ccb);
+		}
+
+		/*
+		 * If we aren't online, there are no devices to talk to.
+		 */
+		if (softc->online == 0) {
+			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+			xpt_done(ccb);
+			return;
+		}
+
+		io = ctl_alloc_io(softc->fe.ctl_pool_ref);
+		if (io == NULL) {
+			ccb->ccb_h.status = CAM_BUSY | CAM_DEV_QFRZN;
+			xpt_freeze_devq(ccb->ccb_h.path, 1);
+			xpt_done(ccb);
+			return;
+		}
+
+		ctl_zero_io(io);
+		/* Save pointers on both sides */
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = ccb;
+		ccb->ccb_h.io_ptr = io;
+
+		io->io_hdr.io_type = CTL_IO_TASK;
+		io->io_hdr.nexus.initid.id = 1;
+		io->io_hdr.nexus.targ_port = softc->fe.targ_port;
+		io->io_hdr.nexus.targ_target.id = ccb->ccb_h.target_id;
+		io->io_hdr.nexus.targ_lun = ccb->ccb_h.target_lun;
+		io->taskio.task_action = CTL_TASK_ABORT_TASK;
+		io->taskio.tag_num = abort_ccb->csio.tag_id;
+		switch (abort_ccb->csio.tag_action) {
+		case CAM_TAG_ACTION_NONE:
+			io->taskio.tag_type = CTL_TAG_UNTAGGED;
+			break;
+		case MSG_SIMPLE_TASK:
+			io->taskio.tag_type = CTL_TAG_SIMPLE;
+			break;
+		case MSG_HEAD_OF_QUEUE_TASK:
+        		io->taskio.tag_type = CTL_TAG_HEAD_OF_QUEUE;
+			break;
+		case MSG_ORDERED_TASK:
+        		io->taskio.tag_type = CTL_TAG_ORDERED;
+			break;
+		case MSG_ACA_TASK:
+			io->taskio.tag_type = CTL_TAG_ACA;
+			break;
+		default:
+			io->taskio.tag_type = CTL_TAG_UNTAGGED;
+			printf("%s: unhandled tag type %#x!!\n", __func__,
+			       abort_ccb->csio.tag_action);
+			break;
+		}
+		err = ctl_queue(io);
+		if (err != CTL_RETVAL_COMPLETE) {
+			printf("%s func %d: error %d returned by "
+			       "ctl_queue()!\n", __func__,
+			       ccb->ccb_h.func_code, err);
+			ctl_free_io(io);
+		}
+		break;
+	}
+	case XPT_GET_TRAN_SETTINGS: {
+		struct ccb_trans_settings *cts;
+		struct ccb_trans_settings_scsi *scsi;
+		struct ccb_trans_settings_fc *fc;
+
+		cts = &ccb->cts;
+		scsi = &cts->proto_specific.scsi;
+		fc = &cts->xport_specific.fc;
+
+		
+		cts->protocol = PROTO_SCSI;
+		cts->protocol_version = SCSI_REV_SPC2;
+		cts->transport = XPORT_FC;
+		cts->transport_version = 0;
+
+		scsi->valid = CTS_SCSI_VALID_TQ;
+		scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
+		fc->valid = CTS_FC_VALID_SPEED;
+		fc->bitrate = 800000;
+		fc->wwnn = softc->wwnn;
+		fc->wwpn = softc->wwpn;
+       		fc->port = softc->fe.targ_port;
+		fc->valid |= CTS_FC_VALID_WWNN | CTS_FC_VALID_WWPN |
+			CTS_FC_VALID_PORT; 
+		ccb->ccb_h.status = CAM_REQ_CMP;
+		break;
+	}
+	case XPT_SET_TRAN_SETTINGS:
+		/* XXX KDM should we actually do something here? */
+		ccb->ccb_h.status = CAM_REQ_CMP;
+		break;
+	case XPT_RESET_BUS:
+	case XPT_RESET_DEV: {
+		union ctl_io *io;
+
+		/*
+		 * If we aren't online, there are no devices to talk to.
+		 */
+		if (softc->online == 0) {
+			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+			xpt_done(ccb);
+			return;
+		}
+
+		io = ctl_alloc_io(softc->fe.ctl_pool_ref);
+		if (io == NULL) {
+			ccb->ccb_h.status = CAM_BUSY | CAM_DEV_QFRZN;
+			xpt_freeze_devq(ccb->ccb_h.path, 1);
+			xpt_done(ccb);
+			return;
+		}
+
+		ctl_zero_io(io);
+		/* Save pointers on both sides */
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = ccb;
+		ccb->ccb_h.io_ptr = io;
+
+		io->io_hdr.io_type = CTL_IO_TASK;
+		io->io_hdr.nexus.initid.id = 0;
+		io->io_hdr.nexus.targ_port = softc->fe.targ_port;
+		io->io_hdr.nexus.targ_target.id = ccb->ccb_h.target_id;
+		io->io_hdr.nexus.targ_lun = ccb->ccb_h.target_lun;
+		if (ccb->ccb_h.func_code == XPT_RESET_BUS)
+			io->taskio.task_action = CTL_TASK_BUS_RESET;
+		else
+			io->taskio.task_action = CTL_TASK_LUN_RESET;
+
+		err = ctl_queue(io);
+		if (err != CTL_RETVAL_COMPLETE) {
+			printf("%s func %d: error %d returned by "
+			      "ctl_queue()!\n", __func__,
+			      ccb->ccb_h.func_code, err);
+			ctl_free_io(io);
+		}
+		break;
+	}
+	case XPT_CALC_GEOMETRY:
+		cam_calc_geometry(&ccb->ccg, 1);
+		xpt_done(ccb);
+		break;
+	case XPT_PATH_INQ: {
+		struct ccb_pathinq *cpi;
+
+		cpi = &ccb->cpi;
+
+		cpi->version_num = 0;
+		cpi->hba_inquiry = PI_TAG_ABLE;
+		cpi->target_sprt = 0;
+		cpi->hba_misc = 0;
+		cpi->hba_eng_cnt = 0;
+		cpi->max_target = 1;
+		cpi->max_lun = 1024;
+		/* Do we really have a limit? */
+		cpi->maxio = 1024 * 1024;
+		cpi->async_flags = 0;
+		cpi->hpath_id = 0;
+		cpi->initiator_id = 0;
+
+		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
+		strncpy(cpi->hba_vid, "FreeBSD", HBA_IDLEN);
+		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
+		cpi->unit_number = 0;
+		cpi->bus_id = 0;
+		cpi->base_transfer_speed = 800000;
+		cpi->protocol = PROTO_SCSI;
+		cpi->protocol_version = SCSI_REV_SPC2;
+		/*
+		 * Pretend to be Fibre Channel.
+		 */
+		cpi->transport = XPORT_FC;
+		cpi->transport_version = 0;
+		cpi->xport_specific.fc.wwnn = softc->wwnn;
+		cpi->xport_specific.fc.wwpn = softc->wwpn;
+		cpi->xport_specific.fc.port = softc->fe.targ_port;
+		cpi->xport_specific.fc.bitrate = 8 * 1000 * 1000;
+		cpi->ccb_h.status = CAM_REQ_CMP;
+		break;
+	}
+	default:
+		ccb->ccb_h.status = CAM_PROVIDE_FAIL;
+		printf("%s: unsupported CCB type %#x\n", __func__,
+		       ccb->ccb_h.func_code);
+		xpt_done(ccb);
+		break;
+	}
+}
+
+static void
+cfcs_async(void *callback_arg, uint32_t code, struct cam_path *path, void *arg)
+{
+
+}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_frontend_internal.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_frontend_internal.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,1782 @@
+/*-
+ * Copyright (c) 2004, 2005 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_frontend_internal.c#5 $
+ */
+/*
+ * CTL kernel internal frontend target driver.  This allows kernel-level
+ * clients to send commands into CTL.
+ *
+ * This has elements of a FETD (e.g. it has to set tag numbers, initiator,
+ * port, target, and LUN) and elements of an initiator (LUN discovery and
+ * probing, error recovery, command initiation).  Even though this has some
+ * initiator type elements, this is not intended to be a full fledged
+ * initiator layer.  It is only intended to send a limited number of
+ * commands to a well known target layer.
+ *
+ * To be able to fulfill the role of a full initiator layer, it would need
+ * a whole lot more functionality.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ *
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_frontend_internal.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/queue.h>
+#include <sys/sbuf.h>
+#include <cam/scsi/scsi_all.h>
+#include <cam/scsi/scsi_da.h>
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl.h>
+#include <cam/ctl/ctl_frontend.h>
+#include <cam/ctl/ctl_frontend_internal.h>
+#include <cam/ctl/ctl_backend.h>
+#include <cam/ctl/ctl_ioctl.h>
+#include <cam/ctl/ctl_util.h>
+#include <cam/ctl/ctl_ha.h>
+#include <cam/ctl/ctl_private.h>
+#include <cam/ctl/ctl_mem_pool.h>
+#include <cam/ctl/ctl_debug.h>
+#include <cam/ctl/ctl_scsi_all.h>
+#include <cam/ctl/ctl_error.h>
+
+/*
+ * Task structure:
+ *  - overall metatask, different potential metatask types (e.g. forced
+ *    shutdown, gentle shutdown)
+ *  - forced shutdown metatask:
+ *     - states:  report luns, pending, done?
+ *     - list of luns pending, with the relevant I/O for that lun attached.
+ *       This would allow moving ahead on LUNs with no errors, and going
+ *       into error recovery on LUNs with problems.  Per-LUN states might
+ *       include inquiry, stop/offline, done.
+ *
+ * Use LUN enable for LUN list instead of getting it manually?  We'd still
+ * need inquiry data for each LUN.
+ *
+ * How to handle processor LUN w.r.t. found/stopped counts?
+ */
+#ifdef oldapi
+typedef enum {
+	CFI_TASK_NONE,
+	CFI_TASK_SHUTDOWN,
+	CFI_TASK_STARTUP
+} cfi_tasktype;
+
+struct cfi_task_startstop {
+	int total_luns;
+	int luns_complete;
+	int luns_failed;
+	cfi_cb_t callback;
+	void *callback_arg;
+	/* XXX KDM add more fields here */
+};
+
+union cfi_taskinfo {
+	struct cfi_task_startstop startstop;
+};
+
+struct cfi_metatask {
+	cfi_tasktype		tasktype;
+	cfi_mt_status		status;
+	union cfi_taskinfo	taskinfo;
+	struct ctl_mem_element	*element;
+	void			*cfi_context;
+	STAILQ_ENTRY(cfi_metatask) links;
+};
+#endif
+
+typedef enum {
+	CFI_ERR_RETRY		= 0x000,
+	CFI_ERR_FAIL		= 0x001,
+	CFI_ERR_LUN_RESET	= 0x002,
+	CFI_ERR_MASK		= 0x0ff,
+	CFI_ERR_NO_DECREMENT	= 0x100
+} cfi_error_action;
+
+typedef enum {
+	CFI_ERR_SOFT,
+	CFI_ERR_HARD
+} cfi_error_policy;
+
+typedef enum {
+	CFI_LUN_INQUIRY,
+	CFI_LUN_READCAPACITY,
+	CFI_LUN_READCAPACITY_16,
+	CFI_LUN_READY
+} cfi_lun_state;
+
+struct cfi_lun {
+	struct ctl_id target_id;
+	int lun_id;
+	struct scsi_inquiry_data inq_data;
+	uint64_t num_blocks;
+	uint32_t blocksize;
+	int blocksize_powerof2;
+	uint32_t cur_tag_num;
+	cfi_lun_state state;
+	struct ctl_mem_element *element;
+	struct cfi_softc *softc;
+	STAILQ_HEAD(, cfi_lun_io) io_list;
+	STAILQ_ENTRY(cfi_lun) links;
+};
+
+struct cfi_lun_io {
+	struct cfi_lun *lun;
+	struct cfi_metatask *metatask;
+	cfi_error_policy policy;
+	void (*done_function)(union ctl_io *io);
+	union ctl_io *ctl_io;
+	struct cfi_lun_io *orig_lun_io;
+	STAILQ_ENTRY(cfi_lun_io) links;
+};
+
+typedef enum {
+	CFI_NONE	= 0x00,
+	CFI_ONLINE	= 0x01,
+} cfi_flags;
+
+struct cfi_softc {
+	struct ctl_frontend fe;
+	char fe_name[40];
+	struct mtx lock;
+	cfi_flags flags;
+	STAILQ_HEAD(, cfi_lun) lun_list;
+	STAILQ_HEAD(, cfi_metatask) metatask_list;
+	struct ctl_mem_pool lun_pool;
+	struct ctl_mem_pool metatask_pool;
+};
+
+MALLOC_DEFINE(M_CTL_CFI, "ctlcfi", "CTL CFI");
+
+static struct cfi_softc fetd_internal_softc;
+
+void cfi_init(void);
+void cfi_shutdown(void) __unused;
+static void cfi_online(void *arg);
+static void cfi_offline(void *arg);
+static int cfi_targ_enable(void *arg, struct ctl_id targ_id);
+static int cfi_targ_disable(void *arg, struct ctl_id targ_id);
+static int cfi_lun_enable(void *arg, struct ctl_id target_id, int lun_id);
+static int cfi_lun_disable(void *arg, struct ctl_id target_id, int lun_id);
+static void cfi_datamove(union ctl_io *io);
+static cfi_error_action cfi_checkcond_parse(union ctl_io *io,
+					    struct cfi_lun_io *lun_io);
+static cfi_error_action cfi_error_parse(union ctl_io *io,
+					struct cfi_lun_io *lun_io);
+static void cfi_init_io(union ctl_io *io, struct cfi_lun *lun,
+			struct cfi_metatask *metatask, cfi_error_policy policy,
+			int retries, struct cfi_lun_io *orig_lun_io,
+			void (*done_function)(union ctl_io *io));
+static void cfi_done(union ctl_io *io);
+static void cfi_lun_probe_done(union ctl_io *io);
+static void cfi_lun_probe(struct cfi_lun *lun, int have_lock);
+static void cfi_metatask_done(struct cfi_softc *softc,
+			      struct cfi_metatask *metatask);
+static void cfi_metatask_bbr_errorparse(struct cfi_metatask *metatask,
+					union ctl_io *io);
+static void cfi_metatask_io_done(union ctl_io *io);
+static void cfi_err_recovery_done(union ctl_io *io);
+static void cfi_lun_io_done(union ctl_io *io);
+
+SYSINIT(cfi_init, SI_SUB_CONFIGURE, SI_ORDER_FOURTH, cfi_init, NULL);
+
+void
+cfi_init(void)
+{
+	struct cfi_softc *softc;
+	struct ctl_frontend *fe;
+	int retval;
+
+	softc = &fetd_internal_softc;
+
+	fe = &softc->fe;
+
+	retval = 0;
+
+	if (sizeof(struct cfi_lun_io) > CTL_PORT_PRIV_SIZE) {
+		printf("%s: size of struct cfi_lun_io %zd > "
+		       "CTL_PORT_PRIV_SIZE %d\n", __func__,
+		       sizeof(struct cfi_lun_io),
+		       CTL_PORT_PRIV_SIZE);
+	}
+	memset(softc, 0, sizeof(softc));
+
+	mtx_init(&softc->lock, "CTL frontend mutex", NULL, MTX_DEF);
+	softc->flags |= CTL_FLAG_MASTER_SHELF;
+
+	STAILQ_INIT(&softc->lun_list);
+	STAILQ_INIT(&softc->metatask_list);
+	sprintf(softc->fe_name, "CTL internal");
+	fe->port_type = CTL_PORT_INTERNAL;
+	fe->num_requested_ctl_io = 100;
+	fe->port_name = softc->fe_name;
+	fe->port_online = cfi_online;
+	fe->port_offline = cfi_offline;
+	fe->onoff_arg = softc;
+	fe->targ_enable = cfi_targ_enable;
+	fe->targ_disable = cfi_targ_disable;
+	fe->lun_enable = cfi_lun_enable;
+	fe->lun_disable = cfi_lun_disable;
+	fe->targ_lun_arg = softc;
+	fe->fe_datamove = cfi_datamove;
+	fe->fe_done = cfi_done;
+	fe->max_targets = 15;
+	fe->max_target_id = 15;
+
+	if (ctl_frontend_register(fe, (softc->flags & CTL_FLAG_MASTER_SHELF)) != 0) 
+	{
+		printf("%s: internal frontend registration failed\n", __func__);
+		retval = 1;
+		goto bailout;
+	}
+
+	if (ctl_init_mem_pool(&softc->lun_pool,
+			      sizeof(struct cfi_lun),
+			      CTL_MEM_POOL_PERM_GROW, /*grow_inc*/ 3,
+			      /* initial_pool_size */ CTL_MAX_LUNS) != 0) {
+		printf("%s: can't initialize LUN memory pool\n", __func__);
+		retval = 1;
+		goto bailout_error;
+	}
+
+	if (ctl_init_mem_pool(&softc->metatask_pool,
+			      sizeof(struct cfi_metatask),
+			      CTL_MEM_POOL_PERM_GROW, /*grow_inc*/ 3,
+			      /*initial_pool_size*/ 10) != 0) {
+		printf("%s: can't initialize metatask memory pool\n", __func__);
+		retval = 2;
+		goto bailout_error;
+	}
+bailout:
+
+	return;
+
+bailout_error:
+
+	switch (retval) {
+	case 3:
+		ctl_shrink_mem_pool(&softc->metatask_pool);
+		/* FALLTHROUGH */
+	case 2:
+		ctl_shrink_mem_pool(&softc->lun_pool);
+		/* FALLTHROUGH */
+	case 1:
+		ctl_frontend_deregister(fe);
+		break;
+	default:
+		break;
+	}
+}
+
+void
+cfi_shutdown(void)
+{
+	struct cfi_softc *softc;
+
+	softc = &fetd_internal_softc;
+
+	/*
+	 * XXX KDM need to clear out any I/O pending on each LUN.
+	 */
+	if (ctl_frontend_deregister(&softc->fe) != 0)
+		printf("%s: ctl_frontend_deregister() failed\n", __func__);
+
+	if (ctl_shrink_mem_pool(&softc->lun_pool) != 0)
+		printf("%s: error shrinking LUN pool\n", __func__);
+
+	if (ctl_shrink_mem_pool(&softc->metatask_pool) != 0)
+		printf("%s: error shrinking LUN pool\n", __func__);
+}
+
+static void
+cfi_online(void *arg)
+{
+	struct cfi_softc *softc;
+	struct cfi_lun *lun;
+
+	softc = (struct cfi_softc *)arg;
+
+	softc->flags |= CFI_ONLINE;
+
+	/*
+	 * Go through and kick off the probe for each lun.  Should we check
+	 * the LUN flags here to determine whether or not to probe it?
+	 */
+	mtx_lock(&softc->lock);
+	STAILQ_FOREACH(lun, &softc->lun_list, links)
+		cfi_lun_probe(lun, /*have_lock*/ 1);
+	mtx_unlock(&softc->lock);
+}
+
+static void
+cfi_offline(void *arg)
+{
+	struct cfi_softc *softc;
+
+	softc = (struct cfi_softc *)arg;
+
+	softc->flags &= ~CFI_ONLINE;
+}
+
+static int
+cfi_targ_enable(void *arg, struct ctl_id targ_id)
+{
+	return (0);
+}
+
+static int
+cfi_targ_disable(void *arg, struct ctl_id targ_id)
+{
+	return (0);
+}
+
+static int
+cfi_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
+{
+	struct ctl_mem_element *element;
+	struct cfi_softc *softc;
+	struct cfi_lun *lun;
+	int found;
+
+	softc = (struct cfi_softc *)arg;
+
+	found = 0;
+	mtx_lock(&softc->lock);
+	STAILQ_FOREACH(lun, &softc->lun_list, links) {
+		if ((lun->target_id.id == target_id.id)
+		 && (lun->lun_id == lun_id)) {
+			found = 1;
+			break;
+		}
+	}
+	mtx_unlock(&softc->lock);
+
+	/*
+	 * If we already have this target/LUN, there is no reason to add
+	 * it to our lists again.
+	 */
+	if (found != 0)
+		return (0);
+
+	element = ctl_alloc_mem_element(&softc->lun_pool, /*can_wait*/ 0);
+
+	if (element == NULL) {
+		printf("%s: unable to allocate LUN structure\n", __func__);
+		return (1);
+	}
+
+	lun = (struct cfi_lun *)element->bytes;
+
+	lun->element = element;
+	lun->target_id = target_id;
+	lun->lun_id = lun_id;
+	lun->cur_tag_num = 0;
+	lun->state = CFI_LUN_INQUIRY;
+	lun->softc = softc;
+	STAILQ_INIT(&lun->io_list);
+
+	mtx_lock(&softc->lock);
+	STAILQ_INSERT_TAIL(&softc->lun_list, lun, links);
+	mtx_unlock(&softc->lock);
+
+	cfi_lun_probe(lun, /*have_lock*/ 0);
+
+	return (0);
+}
+
+static int
+cfi_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
+{
+	struct cfi_softc *softc;
+	struct cfi_lun *lun;
+	int found;
+
+	softc = (struct cfi_softc *)arg;
+
+	found = 0;
+
+	/*
+	 * XXX KDM need to do an invalidate and then a free when any
+	 * pending I/O has completed.  Or do we?  CTL won't free a LUN
+	 * while any I/O is pending.  So we won't get this notification
+	 * unless any I/O we have pending on a LUN has completed.
+	 */
+	mtx_lock(&softc->lock);
+	STAILQ_FOREACH(lun, &softc->lun_list, links) {
+		if ((lun->target_id.id == target_id.id)
+		 && (lun->lun_id == lun_id)) {
+			found = 1;
+			break;
+		}
+	}
+	if (found != 0)
+		STAILQ_REMOVE(&softc->lun_list, lun, cfi_lun, links);
+
+	mtx_unlock(&softc->lock);
+
+	if (found == 0) {
+		printf("%s: can't find target %ju lun %d\n", __func__,
+		       (uintmax_t)target_id.id, lun_id);
+		return (1);
+	}
+
+	ctl_free_mem_element(lun->element);
+
+	return (0);
+}
+
+/*
+ * XXX KDM run this inside a thread, or inside the caller's context?
+ */
+static void
+cfi_datamove(union ctl_io *io)
+{
+	struct ctl_sg_entry *ext_sglist, *kern_sglist;
+	struct ctl_sg_entry ext_entry, kern_entry;
+	int ext_sglen, ext_sg_entries, kern_sg_entries;
+	int ext_sg_start, ext_offset;
+	int len_to_copy, len_copied;
+	int kern_watermark, ext_watermark;
+	int ext_sglist_malloced;
+	struct ctl_scsiio *ctsio;
+	int i, j;
+
+	ext_sglist_malloced = 0;
+	ext_sg_start = 0;
+	ext_offset = 0;
+	ext_sglist = NULL;
+
+	CTL_DEBUG_PRINT(("%s\n", __func__));
+
+	ctsio = &io->scsiio;
+
+	/*
+	 * If this is the case, we're probably doing a BBR read and don't
+	 * actually need to transfer the data.  This will effectively
+	 * bit-bucket the data.
+	 */
+	if (ctsio->ext_data_ptr == NULL)
+		goto bailout;
+
+	/*
+	 * To simplify things here, if we have a single buffer, stick it in
+	 * a S/G entry and just make it a single entry S/G list.
+	 */
+	if (ctsio->io_hdr.flags & CTL_FLAG_EDPTR_SGLIST) {
+		int len_seen;
+
+		ext_sglen = ctsio->ext_sg_entries * sizeof(*ext_sglist);
+
+		/*
+		 * XXX KDM GFP_KERNEL, don't know what the caller's context
+		 * is.  Need to figure that out.
+		 */
+		ext_sglist = (struct ctl_sg_entry *)malloc(ext_sglen, M_CTL_CFI,
+							   M_WAITOK);
+		if (ext_sglist == NULL) {
+			ctl_set_internal_failure(ctsio,
+						 /*sks_valid*/ 0,
+						 /*retry_count*/ 0);
+			return;
+		}
+		ext_sglist_malloced = 1;
+		if (memcpy(ext_sglist, ctsio->ext_data_ptr, ext_sglen) != 0) {
+			ctl_set_internal_failure(ctsio,
+						 /*sks_valid*/ 0,
+						 /*retry_count*/ 0);
+			goto bailout;
+		}
+		ext_sg_entries = ctsio->ext_sg_entries;
+		len_seen = 0;
+		for (i = 0; i < ext_sg_entries; i++) {
+			if ((len_seen + ext_sglist[i].len) >=
+			     ctsio->ext_data_filled) {
+				ext_sg_start = i;
+				ext_offset = ctsio->ext_data_filled - len_seen;
+				break;
+			}
+			len_seen += ext_sglist[i].len;
+		}
+	} else {
+		ext_sglist = &ext_entry;
+		ext_sglist->addr = ctsio->ext_data_ptr;
+		ext_sglist->len = ctsio->ext_data_len;
+		ext_sg_entries = 1;
+		ext_sg_start = 0;
+		ext_offset = ctsio->ext_data_filled;
+	}
+
+	if (ctsio->kern_sg_entries > 0) {
+		kern_sglist = (struct ctl_sg_entry *)ctsio->kern_data_ptr;
+		kern_sg_entries = ctsio->kern_sg_entries;
+	} else {
+		kern_sglist = &kern_entry;
+		kern_sglist->addr = ctsio->kern_data_ptr;
+		kern_sglist->len = ctsio->kern_data_len;
+		kern_sg_entries = 1;
+	}
+
+
+	kern_watermark = 0;
+	ext_watermark = ext_offset;
+	len_copied = 0;
+	for (i = ext_sg_start, j = 0;
+	     i < ext_sg_entries && j < kern_sg_entries;) {
+		uint8_t *ext_ptr, *kern_ptr;
+
+		len_to_copy = ctl_min(ext_sglist[i].len - ext_watermark,
+				      kern_sglist[j].len - kern_watermark);
+
+		ext_ptr = (uint8_t *)ext_sglist[i].addr;
+		ext_ptr = ext_ptr + ext_watermark;
+		if (io->io_hdr.flags & CTL_FLAG_BUS_ADDR) {
+			/*
+			 * XXX KDM fix this!
+			 */
+			panic("need to implement bus address support");
+#if 0
+			kern_ptr = bus_to_virt(kern_sglist[j].addr);
+#endif
+		} else
+			kern_ptr = (uint8_t *)kern_sglist[j].addr;
+		kern_ptr = kern_ptr + kern_watermark;
+
+		kern_watermark += len_to_copy;
+		ext_watermark += len_to_copy;
+		
+		if ((ctsio->io_hdr.flags & CTL_FLAG_DATA_MASK) ==
+		     CTL_FLAG_DATA_IN) {
+			CTL_DEBUG_PRINT(("%s: copying %d bytes to user\n",
+					 __func__, len_to_copy));
+			CTL_DEBUG_PRINT(("%s: from %p to %p\n", __func__,
+					 kern_ptr, ext_ptr));
+			memcpy(ext_ptr, kern_ptr, len_to_copy);
+		} else {
+			CTL_DEBUG_PRINT(("%s: copying %d bytes from user\n",
+					 __func__, len_to_copy));
+			CTL_DEBUG_PRINT(("%s: from %p to %p\n", __func__,
+					 ext_ptr, kern_ptr));
+			memcpy(kern_ptr, ext_ptr, len_to_copy);
+		}
+
+		len_copied += len_to_copy;
+
+		if (ext_sglist[i].len == ext_watermark) {
+			i++;
+			ext_watermark = 0;
+		}
+
+		if (kern_sglist[j].len == kern_watermark) {
+			j++;
+			kern_watermark = 0;
+		}
+	}
+
+	ctsio->ext_data_filled += len_copied;
+
+	CTL_DEBUG_PRINT(("%s: ext_sg_entries: %d, kern_sg_entries: %d\n",
+			 __func__, ext_sg_entries, kern_sg_entries));
+	CTL_DEBUG_PRINT(("%s: ext_data_len = %d, kern_data_len = %d\n",
+			 __func__, ctsio->ext_data_len, ctsio->kern_data_len));
+	
+
+	/* XXX KDM set residual?? */
+bailout:
+
+	if (ext_sglist_malloced != 0)
+		free(ext_sglist, M_CTL_CFI);
+
+	io->scsiio.be_move_done(io);
+
+	return;
+}
+
+/*
+ * For any sort of check condition, busy, etc., we just retry.  We do not
+ * decrement the retry count for unit attention type errors.  These are
+ * normal, and we want to save the retry count for "real" errors.  Otherwise,
+ * we could end up with situations where a command will succeed in some
+ * situations and fail in others, depending on whether a unit attention is
+ * pending.  Also, some of our error recovery actions, most notably the
+ * LUN reset action, will cause a unit attention.
+ *
+ * We can add more detail here later if necessary.
+ */
+static cfi_error_action
+cfi_checkcond_parse(union ctl_io *io, struct cfi_lun_io *lun_io)
+{
+	cfi_error_action error_action;
+	int error_code, sense_key, asc, ascq;
+
+	/*
+	 * Default to retrying the command.
+	 */
+	error_action = CFI_ERR_RETRY;
+
+	scsi_extract_sense_len(&io->scsiio.sense_data,
+			       io->scsiio.sense_len,
+			       &error_code,
+			       &sense_key,
+			       &asc,
+			       &ascq,
+			       /*show_errors*/ 1);
+
+	switch (error_code) {
+	case SSD_DEFERRED_ERROR:
+	case SSD_DESC_DEFERRED_ERROR:
+		error_action |= CFI_ERR_NO_DECREMENT;
+		break;
+	case SSD_CURRENT_ERROR:
+	case SSD_DESC_CURRENT_ERROR:
+	default: {
+		switch (sense_key) {
+		case SSD_KEY_UNIT_ATTENTION:
+			error_action |= CFI_ERR_NO_DECREMENT;
+			break;
+		case SSD_KEY_HARDWARE_ERROR:
+			/*
+			 * This is our generic "something bad happened"
+			 * error code.  It often isn't recoverable.
+			 */
+			if ((asc == 0x44) && (ascq == 0x00))
+				error_action = CFI_ERR_FAIL;
+			break;
+		case SSD_KEY_NOT_READY:
+			/*
+			 * If the LUN is powered down, there likely isn't
+			 * much point in retrying right now.
+			 */
+			if ((asc == 0x04) && (ascq == 0x02))
+				error_action = CFI_ERR_FAIL;
+			/*
+			 * If the LUN is offline, there probably isn't much
+			 * point in retrying, either.
+			 */
+			if ((asc == 0x04) && (ascq == 0x03))
+				error_action = CFI_ERR_FAIL;
+			break;
+		}
+	}
+	}
+
+	return (error_action);
+}
+
+static cfi_error_action
+cfi_error_parse(union ctl_io *io, struct cfi_lun_io *lun_io)
+{
+	cfi_error_action error_action;
+
+	error_action = CFI_ERR_RETRY;
+
+	switch (io->io_hdr.io_type) {
+	case CTL_IO_SCSI:
+		switch (io->io_hdr.status & CTL_STATUS_MASK) {
+		case CTL_SCSI_ERROR:
+			switch (io->scsiio.scsi_status) {
+			case SCSI_STATUS_RESERV_CONFLICT:
+				/*
+				 * For a reservation conflict, we'll usually
+				 * want the hard error recovery policy, so
+				 * we'll reset the LUN.
+				 */
+				if (lun_io->policy == CFI_ERR_HARD)
+					error_action =
+						CFI_ERR_LUN_RESET;
+				else
+					error_action = 
+						CFI_ERR_RETRY;
+				break;
+			case SCSI_STATUS_CHECK_COND:
+			default:
+				error_action = cfi_checkcond_parse(io, lun_io);
+				break;
+			}
+			break;
+		default:
+			error_action = CFI_ERR_RETRY;
+			break;
+		}
+		break;
+	case CTL_IO_TASK:
+		/*
+		 * In theory task management commands shouldn't fail...
+		 */
+		error_action = CFI_ERR_RETRY;
+		break;
+	default:
+		printf("%s: invalid ctl_io type %d\n", __func__,
+		       io->io_hdr.io_type);
+		panic("%s: invalid ctl_io type %d\n", __func__,
+		      io->io_hdr.io_type);
+		break;
+	}
+
+	return (error_action);
+}
+
+static void
+cfi_init_io(union ctl_io *io, struct cfi_lun *lun,
+	    struct cfi_metatask *metatask, cfi_error_policy policy, int retries,
+	    struct cfi_lun_io *orig_lun_io,
+	    void (*done_function)(union ctl_io *io))
+{
+	struct cfi_lun_io *lun_io;
+
+	io->io_hdr.nexus.initid.id = 7;
+	io->io_hdr.nexus.targ_port = lun->softc->fe.targ_port;
+	io->io_hdr.nexus.targ_target.id = lun->target_id.id;
+	io->io_hdr.nexus.targ_lun = lun->lun_id;
+	io->io_hdr.retries = retries;
+	lun_io = (struct cfi_lun_io *)io->io_hdr.port_priv;
+	io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = lun_io;
+	lun_io->lun = lun;
+	lun_io->metatask = metatask;
+	lun_io->ctl_io = io;
+	lun_io->policy = policy;
+	lun_io->orig_lun_io = orig_lun_io;
+	lun_io->done_function = done_function;
+	/*
+	 * We only set the tag number for SCSI I/Os.  For task management
+	 * commands, the tag number is only really needed for aborts, so
+	 * the caller can set it if necessary.
+	 */
+	switch (io->io_hdr.io_type) {
+	case CTL_IO_SCSI:
+		io->scsiio.tag_num = lun->cur_tag_num++;
+		break;
+	case CTL_IO_TASK:
+	default:
+		break;
+	}
+}
+
+static void
+cfi_done(union ctl_io *io)
+{
+	struct cfi_lun_io *lun_io;
+	struct cfi_softc *softc;
+	struct cfi_lun *lun;
+
+	lun_io = (struct cfi_lun_io *)
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+
+	lun = lun_io->lun;
+	softc = lun->softc;
+
+	/*
+	 * Very minimal retry logic.  We basically retry if we got an error
+	 * back, and the retry count is greater than 0.  If we ever want
+	 * more sophisticated initiator type behavior, the CAM error
+	 * recovery code in ../common might be helpful.
+	 */
+	if (((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS)
+	 && (io->io_hdr.retries > 0)) {
+		ctl_io_status old_status;
+		cfi_error_action error_action;
+
+		error_action = cfi_error_parse(io, lun_io);
+
+		switch (error_action & CFI_ERR_MASK) {
+		case CFI_ERR_FAIL:
+			goto done;
+			break; /* NOTREACHED */
+		case CFI_ERR_LUN_RESET: {
+			union ctl_io *new_io;
+			struct cfi_lun_io *new_lun_io;
+
+			new_io = ctl_alloc_io(softc->fe.ctl_pool_ref);
+			if (new_io == NULL) {
+				printf("%s: unable to allocate ctl_io for "
+				       "error recovery\n", __func__);
+				goto done;
+			}
+			ctl_zero_io(new_io);
+
+			new_io->io_hdr.io_type = CTL_IO_TASK;
+			new_io->taskio.task_action = CTL_TASK_LUN_RESET;
+
+			cfi_init_io(new_io,
+				    /*lun*/ lun_io->lun,
+				    /*metatask*/ NULL,
+				    /*policy*/ CFI_ERR_SOFT,
+				    /*retries*/ 0,
+				    /*orig_lun_io*/lun_io,
+				    /*done_function*/ cfi_err_recovery_done);
+			
+
+			new_lun_io = (struct cfi_lun_io *)
+				new_io->io_hdr.port_priv;
+
+			mtx_lock(&lun->softc->lock);
+			STAILQ_INSERT_TAIL(&lun->io_list, new_lun_io, links);
+			mtx_unlock(&lun->softc->lock);
+
+			io = new_io;
+			break;
+		}
+		case CFI_ERR_RETRY:
+		default:
+			if ((error_action & CFI_ERR_NO_DECREMENT) == 0)
+				io->io_hdr.retries--;
+			break;
+		}
+
+		old_status = io->io_hdr.status;
+		io->io_hdr.status = CTL_STATUS_NONE;
+#if 0
+		io->io_hdr.flags &= ~CTL_FLAG_ALREADY_DONE;
+#endif
+		io->io_hdr.flags &= ~CTL_FLAG_ABORT;
+		io->io_hdr.flags &= ~CTL_FLAG_SENT_2OTHER_SC;
+
+		if (ctl_queue(io) != CTL_RETVAL_COMPLETE) {
+			printf("%s: error returned from ctl_queue()!\n",
+			       __func__);
+			io->io_hdr.status = old_status;
+		} else
+			return;
+	}
+done:
+	lun_io->done_function(io);
+}
+
+static void
+cfi_lun_probe_done(union ctl_io *io)
+{
+	struct cfi_lun *lun;
+	struct cfi_lun_io *lun_io;
+
+	lun_io = (struct cfi_lun_io *)
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+	lun = lun_io->lun;
+
+	switch (lun->state) {
+	case CFI_LUN_INQUIRY: {
+		if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS) {
+			/* print out something here?? */
+			printf("%s: LUN %d probe failed because inquiry "
+			       "failed\n", __func__, lun->lun_id);
+			ctl_io_error_print(io, NULL);
+		} else {
+
+			if (SID_TYPE(&lun->inq_data) != T_DIRECT) {
+				char path_str[40];
+
+				lun->state = CFI_LUN_READY;
+				ctl_scsi_path_string(io, path_str,
+						     sizeof(path_str));
+				printf("%s", path_str);
+				scsi_print_inquiry(&lun->inq_data);
+			} else {
+				lun->state = CFI_LUN_READCAPACITY;
+				cfi_lun_probe(lun, /*have_lock*/ 0);
+			}
+		}
+		mtx_lock(&lun->softc->lock);
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		mtx_unlock(&lun->softc->lock);
+		ctl_free_io(io);
+		break;
+	}
+	case CFI_LUN_READCAPACITY:
+	case CFI_LUN_READCAPACITY_16: {
+		uint64_t maxlba;
+		uint32_t blocksize;
+
+		maxlba = 0;
+		blocksize = 0;
+
+		if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SUCCESS) {
+			printf("%s: LUN %d probe failed because READ CAPACITY "
+			       "failed\n", __func__, lun->lun_id);
+			ctl_io_error_print(io, NULL);
+		} else {
+
+			if (lun->state == CFI_LUN_READCAPACITY) {
+				struct scsi_read_capacity_data *rdcap;
+
+				rdcap = (struct scsi_read_capacity_data *)
+					io->scsiio.ext_data_ptr;
+
+				maxlba = scsi_4btoul(rdcap->addr);
+				blocksize = scsi_4btoul(rdcap->length);
+				if (blocksize == 0) {
+					printf("%s: LUN %d has invalid "
+					       "blocksize 0, probe aborted\n",
+					       __func__, lun->lun_id);
+				} else if (maxlba == 0xffffffff) {
+					lun->state = CFI_LUN_READCAPACITY_16;
+					cfi_lun_probe(lun, /*have_lock*/ 0);
+				} else
+					lun->state = CFI_LUN_READY;
+			} else {
+				struct scsi_read_capacity_data_long *rdcap_long;
+
+				rdcap_long = (struct
+					scsi_read_capacity_data_long *)
+					io->scsiio.ext_data_ptr;
+				maxlba = scsi_8btou64(rdcap_long->addr);
+				blocksize = scsi_4btoul(rdcap_long->length);
+
+				if (blocksize == 0) {
+					printf("%s: LUN %d has invalid "
+					       "blocksize 0, probe aborted\n",
+					       __func__, lun->lun_id);
+				} else
+					lun->state = CFI_LUN_READY;
+			}
+		}
+
+		if (lun->state == CFI_LUN_READY) {
+			char path_str[40];
+
+			lun->num_blocks = maxlba + 1;
+			lun->blocksize = blocksize;
+
+			/*
+			 * If this is true, the blocksize is a power of 2.
+			 * We already checked for 0 above.
+			 */
+			if (((blocksize - 1) & blocksize) == 0) {
+				int i;
+
+				for (i = 0; i < 32; i++) {
+					if ((blocksize & (1 << i)) != 0) {
+						lun->blocksize_powerof2 = i;
+						break;
+					}
+				}
+			}
+			ctl_scsi_path_string(io, path_str,sizeof(path_str));
+			printf("%s", path_str);
+			scsi_print_inquiry(&lun->inq_data);
+			printf("%s %ju blocks, blocksize %d\n", path_str,
+			       (uintmax_t)maxlba + 1, blocksize);
+		}
+		mtx_lock(&lun->softc->lock);
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		mtx_unlock(&lun->softc->lock);
+		free(io->scsiio.ext_data_ptr, M_CTL_CFI);
+		ctl_free_io(io);
+		break;
+	}
+	case CFI_LUN_READY:
+	default:
+		mtx_lock(&lun->softc->lock);
+		/* How did we get here?? */
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		mtx_unlock(&lun->softc->lock);
+		ctl_free_io(io);
+		break;
+	}
+}
+
+static void
+cfi_lun_probe(struct cfi_lun *lun, int have_lock)
+{
+
+	if (have_lock == 0)
+		mtx_lock(&lun->softc->lock);
+	if ((lun->softc->flags & CFI_ONLINE) == 0) {
+		if (have_lock == 0)
+			mtx_unlock(&lun->softc->lock);
+		return;
+	}
+	if (have_lock == 0)
+		mtx_unlock(&lun->softc->lock);
+
+	switch (lun->state) {
+	case CFI_LUN_INQUIRY: {
+		struct cfi_lun_io *lun_io;
+		union ctl_io *io;
+
+		io = ctl_alloc_io(lun->softc->fe.ctl_pool_ref);
+		if (io == NULL) {
+			printf("%s: unable to alloc ctl_io for target %ju "
+			       "lun %d probe\n", __func__,
+			       (uintmax_t)lun->target_id.id, lun->lun_id);
+			return;
+		}
+		ctl_scsi_inquiry(io,
+				 /*data_ptr*/(uint8_t *)&lun->inq_data,
+				 /*data_len*/ sizeof(lun->inq_data),
+				 /*byte2*/ 0,
+				 /*page_code*/ 0,
+				 /*tag_type*/ CTL_TAG_SIMPLE,
+				 /*control*/ 0);
+
+		cfi_init_io(io,
+			    /*lun*/ lun,
+			    /*metatask*/ NULL,
+			    /*policy*/ CFI_ERR_SOFT,
+			    /*retries*/ 5,
+			    /*orig_lun_io*/ NULL,
+			    /*done_function*/
+			    cfi_lun_probe_done);
+
+		lun_io = (struct cfi_lun_io *)io->io_hdr.port_priv;
+
+		if (have_lock == 0)
+			mtx_lock(&lun->softc->lock);
+		STAILQ_INSERT_TAIL(&lun->io_list, lun_io, links);
+		if (have_lock == 0)
+			mtx_unlock(&lun->softc->lock);
+
+		if (ctl_queue(io) != CTL_RETVAL_COMPLETE) {
+			printf("%s: error returned from ctl_queue()!\n",
+			       __func__);
+			STAILQ_REMOVE(&lun->io_list, lun_io,
+				      cfi_lun_io, links);
+			ctl_free_io(io);
+		}
+		break;
+	}
+	case CFI_LUN_READCAPACITY:
+	case CFI_LUN_READCAPACITY_16: {
+		struct cfi_lun_io *lun_io;
+		uint8_t *dataptr;
+		union ctl_io *io;
+
+		io = ctl_alloc_io(lun->softc->fe.ctl_pool_ref);
+		if (io == NULL) {
+			printf("%s: unable to alloc ctl_io for target %ju "
+			       "lun %d probe\n", __func__,
+			       (uintmax_t)lun->target_id.id, lun->lun_id);
+			return;
+		}
+
+		dataptr = malloc(sizeof(struct scsi_read_capacity_data_long),
+				 M_CTL_CFI, M_NOWAIT);
+		if (dataptr == NULL) {
+			printf("%s: unable to allocate SCSI read capacity "
+			       "buffer for target %ju lun %d\n", __func__,
+			       (uintmax_t)lun->target_id.id, lun->lun_id);
+			return;
+		}
+		if (lun->state == CFI_LUN_READCAPACITY) {
+			ctl_scsi_read_capacity(io,
+				/*data_ptr*/ dataptr,
+				/*data_len*/
+				sizeof(struct scsi_read_capacity_data_long),
+				/*addr*/ 0,
+				/*reladr*/ 0,
+				/*pmi*/ 0,
+				/*tag_type*/ CTL_TAG_SIMPLE,
+				/*control*/ 0);
+		} else {
+			ctl_scsi_read_capacity_16(io,
+				/*data_ptr*/ dataptr,
+				/*data_len*/
+				sizeof(struct scsi_read_capacity_data_long),
+				/*addr*/ 0,
+				/*reladr*/ 0,
+				/*pmi*/ 0,
+				/*tag_type*/ CTL_TAG_SIMPLE,
+				/*control*/ 0);
+		}
+		cfi_init_io(io,
+			    /*lun*/ lun,
+			    /*metatask*/ NULL,
+			    /*policy*/ CFI_ERR_SOFT,
+			    /*retries*/ 7,
+			    /*orig_lun_io*/ NULL,
+			    /*done_function*/ cfi_lun_probe_done);
+
+		lun_io = (struct cfi_lun_io *)io->io_hdr.port_priv;
+
+		if (have_lock == 0)
+			mtx_lock(&lun->softc->lock);
+		STAILQ_INSERT_TAIL(&lun->io_list, lun_io, links);
+		if (have_lock == 0)
+			mtx_unlock(&lun->softc->lock);
+
+		if (ctl_queue(io) != CTL_RETVAL_COMPLETE) {
+			printf("%s: error returned from ctl_queue()!\n",
+			       __func__);
+			STAILQ_REMOVE(&lun->io_list, lun_io,
+				      cfi_lun_io, links);
+			free(dataptr, M_CTL_CFI);
+			ctl_free_io(io);
+		}
+		break;
+	}
+	case CFI_LUN_READY:
+	default:
+		/* Why were we called? */
+		break;
+	}
+}
+
+static void
+cfi_metatask_done(struct cfi_softc *softc, struct cfi_metatask *metatask)
+{
+	mtx_lock(&softc->lock);
+	STAILQ_REMOVE(&softc->metatask_list, metatask, cfi_metatask, links);
+	mtx_unlock(&softc->lock);
+
+	/*
+	 * Return status to the caller.  Caller allocated storage, and is
+	 * responsible for calling cfi_free_metatask to release it once
+	 * they've seen the status.
+	 */
+	metatask->callback(metatask->callback_arg, metatask);
+}
+
+static void
+cfi_metatask_bbr_errorparse(struct cfi_metatask *metatask, union ctl_io *io)
+{
+	int error_code, sense_key, asc, ascq;
+
+	if (metatask->tasktype != CFI_TASK_BBRREAD)
+		return;
+
+	if ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS) {
+		metatask->status = CFI_MT_SUCCESS;
+		metatask->taskinfo.bbrread.status = CFI_BBR_SUCCESS;
+		return;
+	}
+
+	if ((io->io_hdr.status & CTL_STATUS_MASK) != CTL_SCSI_ERROR) {
+		metatask->status = CFI_MT_ERROR;
+		metatask->taskinfo.bbrread.status = CFI_BBR_ERROR;
+		return;
+	}
+
+	metatask->taskinfo.bbrread.scsi_status = io->scsiio.scsi_status;
+	memcpy(&metatask->taskinfo.bbrread.sense_data, &io->scsiio.sense_data,
+	       ctl_min(sizeof(metatask->taskinfo.bbrread.sense_data),
+		       sizeof(io->scsiio.sense_data)));
+
+	if (io->scsiio.scsi_status == SCSI_STATUS_RESERV_CONFLICT) {
+		metatask->status = CFI_MT_ERROR;
+		metatask->taskinfo.bbrread.status = CFI_BBR_RESERV_CONFLICT;
+		return;
+	}
+
+	if (io->scsiio.scsi_status != SCSI_STATUS_CHECK_COND) {
+		metatask->status = CFI_MT_ERROR;
+		metatask->taskinfo.bbrread.status = CFI_BBR_SCSI_ERROR;
+		return;
+	}
+
+	scsi_extract_sense_len(&io->scsiio.sense_data,
+			       io->scsiio.sense_len,
+			       &error_code,
+			       &sense_key,
+			       &asc,
+			       &ascq,
+			       /*show_errors*/ 1);
+
+	switch (error_code) {
+	case SSD_DEFERRED_ERROR:
+	case SSD_DESC_DEFERRED_ERROR:
+		metatask->status = CFI_MT_ERROR;
+		metatask->taskinfo.bbrread.status = CFI_BBR_SCSI_ERROR;
+		break;
+	case SSD_CURRENT_ERROR:
+	case SSD_DESC_CURRENT_ERROR:
+	default: {
+		struct scsi_sense_data *sense;
+
+		sense = &io->scsiio.sense_data;
+
+		if ((asc == 0x04) && (ascq == 0x02)) {
+			metatask->status = CFI_MT_ERROR;
+			metatask->taskinfo.bbrread.status = CFI_BBR_LUN_STOPPED;
+		} else if ((asc == 0x04) && (ascq == 0x03)) {
+			metatask->status = CFI_MT_ERROR;
+			metatask->taskinfo.bbrread.status =
+				CFI_BBR_LUN_OFFLINE_CTL;
+		} else if ((asc == 0x44) && (ascq == 0x00)) {
+#ifdef NEEDTOPORT
+			if (sense->sense_key_spec[0] & SSD_SCS_VALID) {
+				uint16_t retry_count;
+
+				retry_count = sense->sense_key_spec[1] << 8 |
+					      sense->sense_key_spec[2];
+				if (((retry_count & 0xf000) == CSC_RAIDCORE)
+				 && ((retry_count & 0x0f00) == CSC_SHELF_SW)
+				 && ((retry_count & 0xff) ==
+				      RC_STS_DEVICE_OFFLINE)) {
+					metatask->status = CFI_MT_ERROR;
+					metatask->taskinfo.bbrread.status =
+						CFI_BBR_LUN_OFFLINE_RC;
+				} else {
+					metatask->status = CFI_MT_ERROR;
+					metatask->taskinfo.bbrread.status =
+						CFI_BBR_SCSI_ERROR;
+				}
+			} else {
+#endif /* NEEDTOPORT */
+				metatask->status = CFI_MT_ERROR;
+				metatask->taskinfo.bbrread.status =
+					CFI_BBR_SCSI_ERROR;
+#ifdef NEEDTOPORT
+			}
+#endif
+		} else {
+			metatask->status = CFI_MT_ERROR;
+			metatask->taskinfo.bbrread.status = CFI_BBR_SCSI_ERROR;
+		}
+		break;
+	}
+	}
+}
+
+static void
+cfi_metatask_io_done(union ctl_io *io)
+{
+	struct cfi_lun_io *lun_io;
+	struct cfi_metatask *metatask;
+	struct cfi_softc *softc;
+	struct cfi_lun *lun;
+
+	lun_io = (struct cfi_lun_io *)
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+
+	lun = lun_io->lun;
+	softc = lun->softc;
+
+	metatask = lun_io->metatask;
+
+	switch (metatask->tasktype) {
+	case CFI_TASK_STARTUP:
+	case CFI_TASK_SHUTDOWN: {
+		int failed, done, is_start;
+
+		failed = 0;
+		done = 0;
+		if (metatask->tasktype == CFI_TASK_STARTUP)
+			is_start = 1;
+		else
+			is_start = 0;
+
+		mtx_lock(&softc->lock);
+		if ((io->io_hdr.status & CTL_STATUS_MASK) == CTL_SUCCESS)
+			metatask->taskinfo.startstop.luns_complete++;
+		else {
+			metatask->taskinfo.startstop.luns_failed++;
+			failed = 1;
+		}
+		if ((metatask->taskinfo.startstop.luns_complete +
+		     metatask->taskinfo.startstop.luns_failed) >=
+		     metatask->taskinfo.startstop.total_luns)
+			done = 1;
+
+		mtx_unlock(&softc->lock);
+
+		if (failed != 0) {
+			printf("%s: LUN %d %s request failed\n", __func__,
+			       lun_io->lun->lun_id, (is_start == 1) ? "start" :
+			       "stop");
+			ctl_io_error_print(io, &lun_io->lun->inq_data);
+		}
+		if (done != 0) {
+			if (metatask->taskinfo.startstop.luns_failed > 0)
+				metatask->status = CFI_MT_ERROR;
+			else
+				metatask->status = CFI_MT_SUCCESS;
+			cfi_metatask_done(softc, metatask);
+		}
+		mtx_lock(&softc->lock);
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		mtx_unlock(&softc->lock);
+
+		ctl_free_io(io);
+		break;
+	}
+	case CFI_TASK_BBRREAD: {
+		/*
+		 * Translate the SCSI error into an enumeration.
+		 */
+		cfi_metatask_bbr_errorparse(metatask, io);
+
+		mtx_lock(&softc->lock);
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		mtx_unlock(&softc->lock);
+
+		ctl_free_io(io);
+
+		cfi_metatask_done(softc, metatask);
+		break;
+	}
+	default:
+		/*
+		 * This shouldn't happen.
+		 */
+		mtx_lock(&softc->lock);
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		mtx_unlock(&softc->lock);
+
+		ctl_free_io(io);
+		break;
+	}
+}
+
+static void
+cfi_err_recovery_done(union ctl_io *io)
+{
+	struct cfi_lun_io *lun_io, *orig_lun_io;
+	struct cfi_lun *lun;
+	union ctl_io *orig_io;
+
+	lun_io = (struct cfi_lun_io *)io->io_hdr.port_priv;
+	orig_lun_io = lun_io->orig_lun_io;
+	orig_io = orig_lun_io->ctl_io;
+	lun = lun_io->lun;
+
+	if (io->io_hdr.status != CTL_SUCCESS) {
+		printf("%s: error recovery action failed.  Original "
+		       "error:\n", __func__);
+
+		ctl_io_error_print(orig_lun_io->ctl_io, &lun->inq_data);
+
+		printf("%s: error from error recovery action:\n", __func__);
+
+		ctl_io_error_print(io, &lun->inq_data);
+
+		printf("%s: trying original command again...\n", __func__);
+	}
+
+	mtx_lock(&lun->softc->lock);
+	STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+	mtx_unlock(&lun->softc->lock);
+	ctl_free_io(io);
+
+	orig_io->io_hdr.retries--;
+	orig_io->io_hdr.status = CTL_STATUS_NONE;
+
+	if (ctl_queue(orig_io) != CTL_RETVAL_COMPLETE) {
+		printf("%s: error returned from ctl_queue()!\n", __func__);
+		STAILQ_REMOVE(&lun->io_list, orig_lun_io,
+			      cfi_lun_io, links);
+		ctl_free_io(orig_io);
+	}
+}
+
+static void
+cfi_lun_io_done(union ctl_io *io)
+{
+	struct cfi_lun *lun;
+	struct cfi_lun_io *lun_io;
+
+	lun_io = (struct cfi_lun_io *)
+		io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr;
+	lun = lun_io->lun;
+
+	if (lun_io->metatask == NULL) {
+		printf("%s: I/O has no metatask pointer, discarding\n",
+		       __func__);
+		STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+		ctl_free_io(io);
+		return;
+	}
+	cfi_metatask_io_done(io);
+}
+
+void
+cfi_action(struct cfi_metatask *metatask)
+{
+	struct cfi_softc *softc;
+
+	softc = &fetd_internal_softc;
+
+	mtx_lock(&softc->lock);
+
+	STAILQ_INSERT_TAIL(&softc->metatask_list, metatask, links);
+
+	if ((softc->flags & CFI_ONLINE) == 0) {
+		mtx_unlock(&softc->lock);
+		metatask->status = CFI_MT_PORT_OFFLINE;
+		cfi_metatask_done(softc, metatask);
+		return;
+	} else
+		mtx_unlock(&softc->lock);
+
+	switch (metatask->tasktype) {
+	case CFI_TASK_STARTUP:
+	case CFI_TASK_SHUTDOWN: {
+		union ctl_io *io;
+		int da_luns, ios_allocated, do_start;
+		struct cfi_lun *lun;
+		STAILQ_HEAD(, ctl_io_hdr) tmp_io_list;
+
+		da_luns = 0;
+		ios_allocated = 0;
+		STAILQ_INIT(&tmp_io_list);
+
+		if (metatask->tasktype == CFI_TASK_STARTUP)
+			do_start = 1;
+		else
+			do_start = 0;
+
+		mtx_lock(&softc->lock);
+		STAILQ_FOREACH(lun, &softc->lun_list, links) {
+			if (lun->state != CFI_LUN_READY)
+				continue;
+
+			if (SID_TYPE(&lun->inq_data) != T_DIRECT)
+				continue;
+			da_luns++;
+			io = ctl_alloc_io(softc->fe.ctl_pool_ref);
+			if (io != NULL) {
+				ios_allocated++;
+				STAILQ_INSERT_TAIL(&tmp_io_list, &io->io_hdr,
+						   links);
+			}
+		}
+
+		if (ios_allocated < da_luns) {
+			printf("%s: error allocating ctl_io for %s\n",
+			       __func__, (do_start == 1) ? "startup" :
+			       "shutdown");
+			da_luns = ios_allocated;
+		}
+
+		metatask->taskinfo.startstop.total_luns = da_luns;
+
+		STAILQ_FOREACH(lun, &softc->lun_list, links) {
+			struct cfi_lun_io *lun_io;
+
+			if (lun->state != CFI_LUN_READY)
+				continue;
+
+			if (SID_TYPE(&lun->inq_data) != T_DIRECT)
+				continue;
+
+			io = (union ctl_io *)STAILQ_FIRST(&tmp_io_list);
+			if (io == NULL)
+				break;
+
+			STAILQ_REMOVE(&tmp_io_list, &io->io_hdr, ctl_io_hdr,
+				      links);
+
+			ctl_scsi_start_stop(io,
+					    /*start*/ do_start,
+					    /*load_eject*/ 0,
+					    /*immediate*/ 0,
+					    /*power_conditions*/
+					    SSS_PC_START_VALID,
+					    /*onoffline*/ 1,
+					    /*ctl_tag_type*/ CTL_TAG_ORDERED,
+					    /*control*/ 0);
+
+			cfi_init_io(io,
+				    /*lun*/ lun,
+				    /*metatask*/ metatask,
+				    /*policy*/ CFI_ERR_HARD,
+				    /*retries*/ 3,
+				    /*orig_lun_io*/ NULL,
+				    /*done_function*/ cfi_lun_io_done);
+
+			lun_io = (struct cfi_lun_io *) io->io_hdr.port_priv;
+
+			STAILQ_INSERT_TAIL(&lun->io_list, lun_io, links);
+
+			if (ctl_queue(io) != CTL_RETVAL_COMPLETE) {
+				printf("%s: error returned from ctl_queue()!\n",
+				       __func__);
+				STAILQ_REMOVE(&lun->io_list, lun_io,
+					      cfi_lun_io, links);
+				ctl_free_io(io);
+				metatask->taskinfo.startstop.total_luns--;
+			}
+		}
+
+		if (STAILQ_FIRST(&tmp_io_list) != NULL) {
+			printf("%s: error: tmp_io_list != NULL\n", __func__);
+			for (io = (union ctl_io *)STAILQ_FIRST(&tmp_io_list);
+			     io != NULL;
+			     io = (union ctl_io *)STAILQ_FIRST(&tmp_io_list)) {
+				STAILQ_REMOVE(&tmp_io_list, &io->io_hdr,
+					      ctl_io_hdr, links);
+				ctl_free_io(io);
+			}
+		}
+		mtx_unlock(&softc->lock);
+
+		break;
+	}
+	case CFI_TASK_BBRREAD: {
+		union ctl_io *io;
+		struct cfi_lun *lun;
+		struct cfi_lun_io *lun_io;
+		cfi_bbrread_status status;
+		int req_lun_num;
+		uint32_t num_blocks;
+
+		status = CFI_BBR_SUCCESS;
+
+		req_lun_num = metatask->taskinfo.bbrread.lun_num;
+
+		mtx_lock(&softc->lock);
+		STAILQ_FOREACH(lun, &softc->lun_list, links) {
+			if (lun->lun_id != req_lun_num)
+				continue;
+			if (lun->state != CFI_LUN_READY) {
+				status = CFI_BBR_LUN_UNCONFIG;
+				break;
+			} else
+				break;
+		}
+
+		if (lun == NULL)
+			status = CFI_BBR_NO_LUN;
+
+		if (status != CFI_BBR_SUCCESS) {
+			metatask->status = CFI_MT_ERROR;
+			metatask->taskinfo.bbrread.status = status;
+			mtx_unlock(&softc->lock);
+			cfi_metatask_done(softc, metatask);
+			break;
+		}
+
+		/*
+		 * Convert the number of bytes given into blocks and check
+		 * that the number of bytes is a multiple of the blocksize.
+		 * CTL will verify that the LBA is okay.
+		 */
+		if (lun->blocksize_powerof2 != 0) {
+			if ((metatask->taskinfo.bbrread.len &
+			    (lun->blocksize - 1)) != 0) {
+				metatask->status = CFI_MT_ERROR;
+				metatask->taskinfo.bbrread.status =
+					CFI_BBR_BAD_LEN;
+				cfi_metatask_done(softc, metatask);
+				break;
+			}
+
+			num_blocks = metatask->taskinfo.bbrread.len >>
+				lun->blocksize_powerof2;
+		} else {
+			/*
+			 * XXX KDM this could result in floating point
+			 * division, which isn't supported in the kernel on
+			 * x86 at least.
+			 */
+			if ((metatask->taskinfo.bbrread.len %
+			     lun->blocksize) != 0) {
+				metatask->status = CFI_MT_ERROR;
+				metatask->taskinfo.bbrread.status =
+					CFI_BBR_BAD_LEN;
+				cfi_metatask_done(softc, metatask);
+				break;
+			}
+
+			/*
+			 * XXX KDM this could result in floating point
+			 * division in some cases.
+			 */
+			num_blocks = metatask->taskinfo.bbrread.len /
+				lun->blocksize;
+
+		}
+
+		io = ctl_alloc_io(softc->fe.ctl_pool_ref);
+		if (io == NULL) {
+			metatask->status = CFI_MT_ERROR;
+			metatask->taskinfo.bbrread.status = CFI_BBR_NO_MEM;
+			mtx_unlock(&softc->lock);
+			cfi_metatask_done(softc, metatask);
+			break;
+		}
+
+		/*
+		 * XXX KDM need to do a read capacity to get the blocksize
+		 * for this device.
+		 */
+		ctl_scsi_read_write(io,
+				    /*data_ptr*/ NULL,
+				    /*data_len*/ metatask->taskinfo.bbrread.len,
+				    /*read_op*/ 1,
+				    /*byte2*/ 0,
+				    /*minimum_cdb_size*/ 0,
+				    /*lba*/ metatask->taskinfo.bbrread.lba,
+				    /*num_blocks*/ num_blocks,
+				    /*tag_type*/ CTL_TAG_SIMPLE,
+				    /*control*/ 0);
+
+		cfi_init_io(io,
+			    /*lun*/ lun,
+			    /*metatask*/ metatask,
+			    /*policy*/ CFI_ERR_SOFT,
+			    /*retries*/ 3,
+			    /*orig_lun_io*/ NULL,
+			    /*done_function*/ cfi_lun_io_done);
+
+		lun_io = (struct cfi_lun_io *)io->io_hdr.port_priv;
+
+		STAILQ_INSERT_TAIL(&lun->io_list, lun_io, links);
+
+		if (ctl_queue(io) != CTL_RETVAL_COMPLETE) {
+			printf("%s: error returned from ctl_queue()!\n",
+			       __func__);
+			STAILQ_REMOVE(&lun->io_list, lun_io, cfi_lun_io, links);
+			ctl_free_io(io);
+			metatask->status = CFI_MT_ERROR;
+			metatask->taskinfo.bbrread.status = CFI_BBR_ERROR;
+			mtx_unlock(&softc->lock);
+			cfi_metatask_done(softc, metatask);
+			break;
+		}
+
+		mtx_unlock(&softc->lock);
+		break;
+	}
+	default:
+		panic("invalid metatask type %d", metatask->tasktype);
+		break; /* NOTREACHED */
+	}
+}
+
+#ifdef oldapi
+void
+cfi_shutdown_shelf(cfi_cb_t callback, void *callback_arg)
+{
+	struct ctl_mem_element *element;
+	struct cfi_softc *softc;
+	struct cfi_metatask *metatask;
+
+	softc = &fetd_internal_softc;
+
+	element = ctl_alloc_mem_element(&softc->metatask_pool, /*can_wait*/ 0);
+	if (element == NULL) {
+		callback(callback_arg,
+			 /*status*/ CFI_MT_ERROR,
+			 /*sluns_found*/ 0,
+			 /*sluns_complete*/ 0,
+			 /*sluns_failed*/ 0);
+		return;
+	}
+
+	metatask = (struct cfi_metatask *)element->bytes;
+
+	memset(metatask, 0, sizeof(*metatask));
+	metatask->tasktype = CFI_TASK_SHUTDOWN;
+	metatask->status = CFI_MT_NONE;
+	metatask->taskinfo.startstop.callback = callback;
+	metatask->taskinfo.startstop.callback_arg = callback_arg;
+	metatask->element = element;
+
+	cfi_action(softc, metatask);
+
+	/*
+	 * - send a report luns to lun 0, get LUN list.
+	 * - send an inquiry to each lun
+	 * - send a stop/offline to each direct access LUN
+	 *    - if we get a reservation conflict, reset the LUN and then
+	 *      retry sending the stop/offline
+	 * - return status back to the caller
+	 */
+}
+
+void
+cfi_start_shelf(cfi_cb_t callback, void *callback_arg)
+{
+	struct ctl_mem_element *element;
+	struct cfi_softc *softc;
+	struct cfi_metatask *metatask;
+
+	softc = &fetd_internal_softc;
+
+	element = ctl_alloc_mem_element(&softc->metatask_pool, /*can_wait*/ 0);
+	if (element == NULL) {
+		callback(callback_arg,
+			 /*status*/ CFI_MT_ERROR,
+			 /*sluns_found*/ 0,
+			 /*sluns_complete*/ 0,
+			 /*sluns_failed*/ 0);
+		return;
+	}
+
+	metatask = (struct cfi_metatask *)element->bytes;
+
+	memset(metatask, 0, sizeof(*metatask));
+	metatask->tasktype = CFI_TASK_STARTUP;
+	metatask->status = CFI_MT_NONE;
+	metatask->taskinfo.startstop.callback = callback;
+	metatask->taskinfo.startstop.callback_arg = callback_arg;
+	metatask->element = element;
+
+	cfi_action(softc, metatask);
+
+	/*
+	 * - send a report luns to lun 0, get LUN list.
+	 * - send an inquiry to each lun
+	 * - send a stop/offline to each direct access LUN
+	 *    - if we get a reservation conflict, reset the LUN and then
+	 *      retry sending the stop/offline
+	 * - return status back to the caller
+	 */
+}
+
+#endif
+
+struct cfi_metatask *
+cfi_alloc_metatask(int can_wait)
+{
+	struct ctl_mem_element *element;
+	struct cfi_metatask *metatask;
+	struct cfi_softc *softc;
+
+	softc = &fetd_internal_softc;
+
+	element = ctl_alloc_mem_element(&softc->metatask_pool, can_wait);
+	if (element == NULL)
+		return (NULL);
+
+	metatask = (struct cfi_metatask *)element->bytes;
+	memset(metatask, 0, sizeof(*metatask));
+	metatask->status = CFI_MT_NONE;
+	metatask->element = element;
+
+	return (metatask);
+}
+
+void
+cfi_free_metatask(struct cfi_metatask *metatask)
+{
+	ctl_free_mem_element(metatask->element);
+}
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_frontend_internal.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_frontend_internal.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,154 @@
+/*-
+ * Copyright (c) 2004 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_frontend_internal.h#1 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_frontend_internal.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CTL kernel internal frontend target driver.  This allows kernel-level
+ * clients to send commands into CTL.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_FRONTEND_INTERNAL_H_
+#define	_CTL_FRONTEND_INTERNAL_H_
+
+/*
+ * These are general metatask error codes.  If the error code is CFI_MT_ERROR, 
+ * check any metatask-specific status codes for more detail on the problem.
+ */
+typedef enum {
+	CFI_MT_NONE,
+	CFI_MT_PORT_OFFLINE,
+	CFI_MT_ERROR,
+	CFI_MT_SUCCESS
+} cfi_mt_status;
+
+typedef enum {
+	CFI_TASK_NONE,
+	CFI_TASK_SHUTDOWN,
+	CFI_TASK_STARTUP,
+	CFI_TASK_BBRREAD
+} cfi_tasktype;
+
+struct cfi_task_startstop {
+	int total_luns;
+	int luns_complete;
+	int luns_failed;
+};
+
+/*
+ * Error code description:
+ * CFI_BBR_SUCCESS          - the read was successful
+ * CFI_BBR_LUN_UNCONFIG     - CFI probe for this lun hasn't completed
+ * CFI_BBR_NO_LUN           - this lun doesn't exist, as far as CFI knows
+ * CFI_BBR_NO_MEM           - memory allocation error
+ * CFI_BBR_BAD_LEN          - data length isn't a multiple of the blocksize
+ * CFI_BBR_RESERV_CONFLICT  - another initiator has this lun reserved, so
+ *                            we can't issue I/O at all.
+ * CFI_BBR_LUN_STOPPED      - the lun is powered off.
+ * CFI_BBR_LUN_OFFLINE_CTL  - the lun is offline from a CTL standpoint
+ * CFI_BBR_LUN_OFFLINE_RC   - the lun is offline from a RAIDCore standpoint.
+ *                            This is bad, because it basically means we've
+ *                            had a double failure on the LUN.
+ * CFI_BBR_SCSI_ERROR       - generic SCSI error, see status byte and sense
+ *                            data for more resolution if you want it.
+ * CFI_BBR_ERROR            - the catch-all error code.
+ */
+typedef enum {
+	CFI_BBR_SUCCESS,
+	CFI_BBR_LUN_UNCONFIG,
+	CFI_BBR_NO_LUN,
+	CFI_BBR_NO_MEM,
+	CFI_BBR_BAD_LEN,
+	CFI_BBR_RESERV_CONFLICT,
+	CFI_BBR_LUN_STOPPED,
+	CFI_BBR_LUN_OFFLINE_CTL,
+	CFI_BBR_LUN_OFFLINE_RC,
+	CFI_BBR_SCSI_ERROR,
+	CFI_BBR_ERROR,
+} cfi_bbrread_status;
+
+struct cfi_task_bbrread {
+	int			lun_num;      /* lun number */
+	uint64_t		lba;          /* logical block address */
+	int			len;          /* length in bytes */
+	cfi_bbrread_status	status;       /* BBR status */
+	uint8_t			scsi_status;  /* SCSI status */
+	struct scsi_sense_data	sense_data;   /* SCSI sense data */
+};
+
+union cfi_taskinfo {
+	struct cfi_task_startstop startstop;
+	struct cfi_task_bbrread bbrread;
+};
+
+struct cfi_metatask;
+
+typedef void (*cfi_cb_t)(void *arg, struct cfi_metatask *metatask);
+
+struct cfi_metatask {
+	cfi_tasktype		tasktype;	/* passed to CFI */
+	cfi_mt_status		status;		/* returned from CFI */
+	union cfi_taskinfo	taskinfo;	/* returned from CFI */
+	struct ctl_mem_element	*element;	/* used by CFI, don't touch*/
+	cfi_cb_t		callback;	/* passed to CFI */
+	void			*callback_arg;	/* passed to CFI */
+	STAILQ_ENTRY(cfi_metatask) links;	/* used by CFI, don't touch*/
+};
+
+#ifdef _KERNEL
+
+MALLOC_DECLARE(M_CTL_CFI);
+
+/*
+ * This is the API for sending meta commands (commands that are sent to more
+ * than one LUN) to the internal frontend:
+ *  - Allocate a metatask using cfi_alloc_metatask().  can_wait == 0 means
+ *    that you're calling from an interrupt context.  can_wait == 1 means
+ *    that you're calling from a thread context and don't mind waiting to
+ *    allocate memory.
+ *  - Setup the task type, callback and callback argument.
+ *  - Call cfi_action().
+ *  - When the callback comes, note the status and any per-command status
+ *    (see the taskinfo union) and then free the metatask with
+ *    cfi_free_metatask().
+ */
+struct cfi_metatask *cfi_alloc_metatask(int can_wait);
+void cfi_free_metatask(struct cfi_metatask *metatask);
+void cfi_action(struct cfi_metatask *metatask);
+
+#endif /* _KERNEL */
+
+#endif	/* _CTL_FRONTEND_INTERNAL_H_ */
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_ha.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_ha.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,270 @@
+/*-
+ * Copyright (c) 2003-2009 Silicon Graphics International Corp.
+ * Copyright (c) 2011 Spectra Logic Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_ha.h#1 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_ha.h 229997 2012-01-12 00:34:33Z ken $
+ */
+
+#ifndef _CTL_HA_H_
+#define	_CTL_HA_H_
+
+/*
+ * CTL High Availability Modes:
+ *
+ * CTL_HA_MODE_SER_ONLY:  Commands are serialized to the other side.  Write
+ *			  mirroring and read re-direction are assumed to
+ * 			  happen in the back end.
+ * CTL_HA_MODE_XFER:	  Commands are serialized and data is transferred
+ *			  for write mirroring and read re-direction.
+ */
+
+typedef enum {
+	CTL_HA_MODE_SER_ONLY,
+	CTL_HA_MODE_XFER
+} ctl_ha_mode;
+
+
+/*
+ * This is a stubbed out High Availability interface.  It assumes two nodes
+ * staying in sync.
+ *
+ * The reason this interface is here, and stubbed out, is that CTL was
+ * originally written with support for Copan's (now SGI) high availability
+ * framework.  That framework was not released by SGI, and would not have
+ * been generally applicable to FreeBSD anyway.
+ *
+ * The idea here is to show the kind of API that would need to be in place
+ * in a HA framework to work with CTL's HA hooks.  This API is very close
+ * to the Copan/SGI API, so that the code using it could stay in place
+ * as-is.
+ *
+ * So, in summary, this is a shell without real substance, and much more
+ * work would be needed to actually make HA work.  The implementation
+ * inside CTL will also need to change to fit the eventual implementation.
+ * The additional pieces we would need are:
+ *
+ *  - HA "Supervisor" framework that can startup the components of the
+ *    system, and initiate failover (i.e. active/active to single mode)
+ *    and failback (single to active/active mode) state transitions.
+ *    This framework would be able to recognize when an event happens
+ *    that requires it to initiate state transitions in the components it
+ *    manages.
+ *
+ *  - HA communication framework.  This framework should have the following
+ *    features:
+ *	- Separate channels for separate system components.  The CTL
+ *	  instance on one node should communicate with the CTL instance
+ *	  on another node.
+ *	- Short message passing.  These messages would be fixed length, so
+ *	  they could be preallocated and easily passed between the nodes.
+ *	  i.e. conceptually like an ethernet packet.
+ *	- DMA/large buffer capability.  This would require some negotiation
+ *	  with the other node to define the destination.  It could
+ *	  allow for "push" (i.e. initiated by the requesting node) DMA or
+ * 	  "pull" (i.e. initiated by the target controller) DMA or both.
+ *	- Communication channel status change notification.
+ *  - HA capability in other portions of the storage stack.  Having two CTL
+ *    instances communicate is just one part of an overall HA solution.
+ *    State needs to be synchronized at multiple levels of the system in
+ *    order for failover to actually work.  For instance, if CTL is using a
+ *    file on a ZFS filesystem as its backing store, the ZFS array state
+ *    should be synchronized with the other node, so that the other node
+ *    can immediately take over if the node that is primary for a particular
+ *    array fails.
+ */
+
+/*
+ * Communication channel IDs for various system components.  This is to
+ * make sure one CTL instance talks with another, one ZFS instance talks
+ * with another, etc.
+ */
+typedef enum {
+	CTL_HA_CHAN_NONE,
+	CTL_HA_CHAN_CTL,
+	CTL_HA_CHAN_ZFS,
+	CTL_HA_CHAN_MAX
+} ctl_ha_channel;
+
+/*
+ * HA communication event notification.  These are events generated by the
+ * HA communication subsystem.
+ *
+ * CTL_HA_EVT_MSG_RECV:		Message received by the other node.
+ * CTL_HA_EVT_MSG_SENT:		Message sent to the other node.
+ * CTL_HA_EVT_DISCONNECT:	Communication channel disconnected.
+ * CTL_HA_EVT_DMA_SENT:		DMA successfully sent to other node (push).
+ * CTL_HA_EVT_DMA_RECEIVED:	DMA successfully received by other node (pull).
+ */
+typedef enum {
+	CTL_HA_EVT_NONE,
+	CTL_HA_EVT_MSG_RECV,
+	CTL_HA_EVT_MSG_SENT,
+	CTL_HA_EVT_DISCONNECT,
+	CTL_HA_EVT_DMA_SENT,
+	CTL_HA_EVT_DMA_RECEIVED,
+	CTL_HA_EVT_MAX
+} ctl_ha_event;
+
+typedef enum {
+	CTL_HA_STATUS_WAIT,
+	CTL_HA_STATUS_SUCCESS,
+	CTL_HA_STATUS_ERROR,
+	CTL_HA_STATUS_INVALID,
+	CTL_HA_STATUS_DISCONNECT,
+	CTL_HA_STATUS_BUSY,
+	CTL_HA_STATUS_MAX
+} ctl_ha_status;
+
+typedef enum {
+	CTL_HA_DATA_CTL,
+	CTL_HA_DATA_ZFS,
+	CTL_HA_DATA_MAX
+} ctl_ha_dtid;
+
+typedef enum {
+	CTL_HA_DT_CMD_READ,
+	CTL_HA_DT_CMD_WRITE,
+} ctl_ha_dt_cmd;
+
+struct ctl_ha_dt_req;
+
+typedef void (*ctl_ha_dt_cb)(struct ctl_ha_dt_req *);
+
+struct ctl_ha_dt_req {
+	ctl_ha_dt_cmd	command;
+	void		*context;
+	ctl_ha_dt_cb	callback;
+	ctl_ha_dtid	id;
+	int		ret;
+	uint32_t	size;
+	uint8_t		*local;
+	uint8_t		*remote;
+};
+
+typedef void (*ctl_evt_handler)(ctl_ha_channel channel, ctl_ha_event event,
+				int param);
+void ctl_ha_register_evthandler(ctl_ha_channel channel,
+				ctl_evt_handler handler);
+
+static inline ctl_ha_status
+ctl_ha_msg_create(ctl_ha_channel channel, ctl_evt_handler handler)
+{
+	return (CTL_HA_STATUS_SUCCESS);
+}
+
+/*
+ * Receive a message of the specified size.
+ */
+static inline ctl_ha_status
+ctl_ha_msg_recv(ctl_ha_channel channel, void *buffer, unsigned int size,
+		int wait)
+{
+	return (CTL_HA_STATUS_SUCCESS);
+}
+
+/*
+ * Send a message of the specified size.
+ */
+static inline ctl_ha_status
+ctl_ha_msg_send(ctl_ha_channel channel, void *buffer, unsigned int size,
+		int wait)
+{
+	return (CTL_HA_STATUS_SUCCESS);
+}
+
+/*
+ * Allocate a data transfer request structure.
+ */
+static inline struct ctl_ha_dt_req *
+ctl_dt_req_alloc(void)
+{
+	return (NULL);
+}
+
+/*
+ * Free a data transfer request structure.
+ */
+static inline void
+ctl_dt_req_free(struct ctl_ha_dt_req *req)
+{
+	return;
+}
+
+/*
+ * Issue a DMA request for a single buffer.
+ */
+static inline ctl_ha_status
+ctl_dt_single(struct ctl_ha_dt_req *req)
+{
+	return (CTL_HA_STATUS_WAIT);
+}
+
+/*
+ * SINGLE:	   One node
+ * HA:		   Two nodes (Active/Active implied)
+ * SLAVE/MASTER:   The component can set these flags to indicate which side
+ *		   is in control.  It has no effect on the HA framework.
+ */
+typedef enum {
+	CTL_HA_STATE_UNKNOWN	= 0x00,
+	CTL_HA_STATE_SINGLE	= 0x01,
+	CTL_HA_STATE_HA		= 0x02,
+	CTL_HA_STATE_MASK	= 0x0F,
+	CTL_HA_STATE_SLAVE	= 0x10,
+	CTL_HA_STATE_MASTER	= 0x20
+} ctl_ha_state;
+
+typedef enum {
+	CTL_HA_COMP_STATUS_OK,
+	CTL_HA_COMP_STATUS_FAILED,
+	CTL_HA_COMP_STATUS_ERROR
+} ctl_ha_comp_status;
+
+struct ctl_ha_component;
+
+typedef ctl_ha_comp_status (*ctl_hacmp_init_t)(struct ctl_ha_component *);
+typedef ctl_ha_comp_status (*ctl_hacmp_start_t)(struct ctl_ha_component *,
+						ctl_ha_state);
+
+struct ctl_ha_component {
+	char			*name;
+	ctl_ha_state 		state;
+	ctl_ha_comp_status	status;
+	ctl_hacmp_init_t	init;
+	ctl_hacmp_start_t	start;
+	ctl_hacmp_init_t	quiesce;
+};
+
+#define	CTL_HA_STATE_IS_SINGLE(state)	((state & CTL_HA_STATE_MASK) == \
+					  CTL_HA_STATE_SINGLE)
+#define	CTL_HA_STATE_IS_HA(state)	((state & CTL_HA_STATE_MASK) == \
+					  CTL_HA_STATE_HA)
+
+#endif /* _CTL_HA_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_io.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_io.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,474 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_io.h#5 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_io.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer data movement structures/interface.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_IO_H_
+#define	_CTL_IO_H_
+
+#ifdef _CTL_C
+#define EXTERN(__var,__val) __var = __val
+#else
+#define EXTERN(__var,__val) extern __var
+#endif
+
+#define	CTL_MAX_CDBLEN	32
+/*
+ * Uncomment this next line to enable printing out times for I/Os
+ * that take longer than CTL_TIME_IO_SECS seconds to get to the datamove
+ * and/or done stage.
+ */
+#define	CTL_TIME_IO
+#ifdef  CTL_TIME_IO
+#define	CTL_TIME_IO_DEFAULT_SECS	90
+EXTERN(int ctl_time_io_secs, CTL_TIME_IO_DEFAULT_SECS);
+#endif
+
+/*
+ * Uncomment these next two lines to enable the CTL I/O delay feature.  You
+ * can delay I/O at two different points -- datamove and done.  This is
+ * useful for diagnosing abort conditions (for hosts that send an abort on a
+ * timeout), and for determining how long a host's timeout is.
+ */
+#define	CTL_IO_DELAY
+#define	CTL_TIMER_BYTES		sizeof(struct callout)
+
+typedef enum {
+	CTL_STATUS_NONE,	/* No status */
+	CTL_SUCCESS,		/* Transaction completed successfully */
+	CTL_CMD_TIMEOUT,	/* Command timed out, shouldn't happen here */
+	CTL_SEL_TIMEOUT,	/* Selection timeout, shouldn't happen here */
+	CTL_ERROR,		/* General CTL error XXX expand on this? */
+	CTL_SCSI_ERROR,		/* SCSI error, look at status byte/sense data */
+	CTL_CMD_ABORTED,	/* Command aborted, don't return status */
+	CTL_STATUS_MASK = 0xfff,/* Mask off any status flags */
+	CTL_AUTOSENSE = 0x1000	/* Autosense performed */
+} ctl_io_status;
+
+/*
+ * WARNING:  Keep the data in/out/none flags where they are.  They're used
+ * in conjuction with ctl_cmd_flags.  See comment above ctl_cmd_flags
+ * definition in ctl_private.h.
+ */
+typedef enum {
+	CTL_FLAG_NONE		= 0x00000000,	/* no flags */
+	CTL_FLAG_DATA_IN	= 0x00000001,	/* DATA IN */
+	CTL_FLAG_DATA_OUT	= 0x00000002,	/* DATA OUT */
+	CTL_FLAG_DATA_NONE	= 0x00000003,	/* no data */
+	CTL_FLAG_DATA_MASK	= 0x00000003,
+	CTL_FLAG_KDPTR_SGLIST	= 0x00000008, 	/* kern_data_ptr is S/G list*/
+	CTL_FLAG_EDPTR_SGLIST	= 0x00000010,	/* ext_data_ptr is S/G list */
+	CTL_FLAG_DO_AUTOSENSE	= 0x00000020,	/* grab sense info */
+	CTL_FLAG_USER_REQ	= 0x00000040,	/* request came from userland */
+	CTL_FLAG_CONTROL_DEV	= 0x00000080,	/* processor device */
+	CTL_FLAG_ALLOCATED	= 0x00000100,	/* data space allocated */
+	CTL_FLAG_BLOCKED	= 0x00000200,	/* on the blocked queue */
+	CTL_FLAG_ABORT		= 0x00000800,	/* this I/O should be aborted */
+	CTL_FLAG_DMA_INPROG	= 0x00001000,	/* DMA in progress */
+	CTL_FLAG_NO_DATASYNC	= 0x00002000,	/* don't cache flush data */
+	CTL_FLAG_DELAY_DONE	= 0x00004000,	/* delay injection done */
+	CTL_FLAG_INT_COPY	= 0x00008000,	/* internal copy, no done call*/
+	CTL_FLAG_SENT_2OTHER_SC	= 0x00010000,
+	CTL_FLAG_FROM_OTHER_SC	= 0x00020000,
+	CTL_FLAG_IS_WAS_ON_RTR  = 0x00040000,	/* Don't rerun cmd on failover*/
+	CTL_FLAG_BUS_ADDR	= 0x00080000,	/* ctl_sglist contains BUS
+						   addresses, not virtual ones*/
+	CTL_FLAG_IO_CONT	= 0x00100000,	/* Continue I/O instead of
+						   completing */
+	CTL_FLAG_AUTO_MIRROR	= 0x00200000,	/* Automatically use memory
+						   from the RC cache mirrored
+						   address area. */
+#if 0
+	CTL_FLAG_ALREADY_DONE	= 0x00200000	/* I/O already completed */
+#endif
+	CTL_FLAG_NO_DATAMOVE	= 0x00400000,
+	CTL_FLAG_DMA_QUEUED	= 0x00800000,	/* DMA queued but not started*/
+	CTL_FLAG_STATUS_QUEUED	= 0x01000000,	/* Status queued but not sent*/
+
+	CTL_FLAG_REDIR_DONE	= 0x02000000,	/* Redirection has already
+						   been done. */
+	CTL_FLAG_FAILOVER	= 0x04000000,	/* Killed by a failover */
+	CTL_FLAG_IO_ACTIVE	= 0x08000000,	/* I/O active on this SC */
+	CTL_FLAG_RDMA_MASK	= CTL_FLAG_NO_DATASYNC | CTL_FLAG_BUS_ADDR |
+				  CTL_FLAG_AUTO_MIRROR | CTL_FLAG_REDIR_DONE
+						/* Flags we care about for
+						   remote DMA */
+} ctl_io_flags;
+
+
+struct ctl_lba_len {
+	uint64_t lba;
+	uint32_t len;
+};
+
+union ctl_priv {
+	uint8_t		bytes[sizeof(uint64_t) * 2];
+	uint64_t	integer;
+	void		*ptr;
+};
+
+/*
+ * Number of CTL private areas.
+ */
+#define	CTL_NUM_PRIV	6
+
+/*
+ * Which private area are we using for a particular piece of data?
+ */
+#define	CTL_PRIV_LUN		0	/* CTL LUN pointer goes here */
+#define	CTL_PRIV_LBA_LEN	1	/* Decoded LBA/len for read/write*/
+#define	CTL_PRIV_MODEPAGE	1	/* Modepage info for config write */
+#define	CTL_PRIV_BACKEND	2	/* Reserved for block, RAIDCore */
+#define	CTL_PRIV_BACKEND_LUN	3	/* Backend LUN pointer */
+#define	CTL_PRIV_FRONTEND	4	/* LSI driver, ioctl front end */
+#define	CTL_PRIV_USER		5	/* Userland use */
+
+#define CTL_INVALID_PORTNAME 0xFF
+#define CTL_UNMAPPED_IID     0xFF
+/*
+ * XXX KDM this size is for the port_priv variable in struct ctl_io_hdr
+ * below.  This should be defined in terms of the size of struct
+ * ctlfe_lun_cmd_info at the moment:
+ * struct ctlfe_lun_cmd_info {
+ *	int cur_transfer_index;
+ * 	ctlfe_cmd_flags flags;
+ * 	bus_dma_segment_t cam_sglist[32];
+ * };
+ *
+ * This isn't really the way I'd prefer to do it, but it does make some
+ * sense, AS LONG AS we can guarantee that there will always only be one
+ * outstanding DMA request per ctl_io.  If that assumption isn't valid,
+ * then we've got problems.
+ *
+ * At some point it may be nice switch CTL over to using CCBs for
+ * everything.  At that point we can probably use the ATIO/CTIO model, so
+ * that multiple simultaneous DMAs per command will just work.
+ *
+ * Also note that the current size, 600, is appropriate for 64-bit
+ * architectures, but is overkill for 32-bit architectures.  Need a way to
+ * figure out the size at compile time, or just get rid of this altogether.
+ */
+#define	CTL_PORT_PRIV_SIZE	600
+
+struct ctl_sg_entry {
+	void	*addr;
+	size_t	len;
+};
+
+struct ctl_id {
+	uint32_t		id;
+	uint64_t		wwid[2];
+};
+
+typedef enum {
+	CTL_IO_NONE,
+	CTL_IO_SCSI,
+	CTL_IO_TASK,
+} ctl_io_type;
+
+struct ctl_nexus {
+	struct ctl_id initid;		/* Initiator ID */
+	uint32_t targ_port;		/* Target port, filled in by PORT */
+	struct ctl_id targ_target;	/* Destination target */
+	uint32_t targ_lun;		/* Destination lun */
+};
+
+typedef enum {
+	CTL_MSG_SERIALIZE,
+	CTL_MSG_R2R,
+	CTL_MSG_FINISH_IO,
+	CTL_MSG_BAD_JUJU,
+	CTL_MSG_MANAGE_TASKS,
+	CTL_MSG_PERS_ACTION,
+	CTL_MSG_SYNC_FE,
+	CTL_MSG_APS_LOCK,
+	CTL_MSG_DATAMOVE,
+	CTL_MSG_DATAMOVE_DONE
+} ctl_msg_type;
+
+struct ctl_scsiio;
+
+#define	CTL_NUM_SG_ENTRIES	9
+
+struct ctl_io_hdr {
+	uint32_t	  version;	/* interface version XXX */
+	ctl_io_type	  io_type;	/* task I/O, SCSI I/O, etc. */
+	ctl_msg_type	  msg_type;
+	struct ctl_nexus  nexus;	/* Initiator, port, target, lun */
+	uint32_t	  iid_indx;	/* the index into the iid mapping */
+	uint32_t	  flags;	/* transaction flags */
+	uint32_t	  status;	/* transaction status */
+	uint32_t	  port_status;	/* trans status, set by PORT, 0 = good*/
+	uint32_t	  timeout;	/* timeout in ms */
+	uint32_t	  retries;	/* retry count */
+#ifdef CTL_IO_DELAY
+	uint8_t		  timer_bytes[CTL_TIMER_BYTES]; /* timer kludge */
+#endif /* CTL_IO_DELAY */
+#ifdef CTL_TIME_IO
+	time_t		  start_time;	/* I/O start time */
+	struct bintime	  start_bt;	/* Timer start ticks */
+	struct bintime	  dma_start_bt;	/* DMA start ticks */
+	struct bintime	  dma_bt;	/* DMA total ticks */
+	uint32_t	  num_dmas;	/* Number of DMAs */
+#endif /* CTL_TIME_IO */
+	union ctl_io	  *original_sc;
+	union ctl_io	  *serializing_sc;
+	void		  *pool;	/* I/O pool */
+	union ctl_priv	  ctl_private[CTL_NUM_PRIV];/* CTL private area */
+	uint8_t		  port_priv[CTL_PORT_PRIV_SIZE];/* PORT private area*/
+	struct ctl_sg_entry remote_sglist[CTL_NUM_SG_ENTRIES];
+	struct ctl_sg_entry remote_dma_sglist[CTL_NUM_SG_ENTRIES];
+	struct ctl_sg_entry local_sglist[CTL_NUM_SG_ENTRIES];
+	struct ctl_sg_entry local_dma_sglist[CTL_NUM_SG_ENTRIES];
+	STAILQ_ENTRY(ctl_io_hdr) links;	/* linked list pointer */
+	TAILQ_ENTRY(ctl_io_hdr) ooa_links;
+	TAILQ_ENTRY(ctl_io_hdr) blocked_links;
+};
+
+typedef enum {
+	CTL_TAG_UNTAGGED,
+	CTL_TAG_SIMPLE,
+	CTL_TAG_ORDERED,
+	CTL_TAG_HEAD_OF_QUEUE,
+	CTL_TAG_ACA
+} ctl_tag_type;
+
+union ctl_io;
+
+/*
+ * SCSI passthrough I/O structure for the CAM Target Layer.  Note
+ * that some of these fields are here for completeness, but they aren't
+ * used in the CTL implementation.  e.g., timeout and retries won't be
+ * used.
+ *
+ * Note:  Make sure the io_hdr is *always* the first element in this
+ * structure.
+ */
+struct ctl_scsiio {
+	struct ctl_io_hdr io_hdr;	/* common to all I/O types */
+	uint32_t   ext_sg_entries;	/* 0 = no S/G list, > 0 = num entries */
+	uint8_t	   *ext_data_ptr;	/* data buffer or S/G list */
+	uint32_t   ext_data_len;	/* Data transfer length */
+	uint32_t   ext_data_filled;	/* Amount of data filled so far */
+	uint32_t   kern_sg_entries;	/* 0 = no S/G list, > 0 = num entries */
+	uint32_t   rem_sg_entries;	/* 0 = no S/G list, > 0 = num entries */
+	uint8_t    *kern_data_ptr;	/* data buffer or S/G list */
+	uint32_t   kern_data_len;	/* Length of this S/G list/buffer */
+	uint32_t   kern_total_len;	/* Total length of this transaction */
+	uint32_t   kern_data_resid;	/* Length left to transfer after this*/
+	uint32_t   kern_rel_offset;	/* Byte Offset of this transfer */
+	struct     scsi_sense_data sense_data;	/* sense data */
+	uint8_t	   sense_len;		/* Returned sense length */
+	uint8_t	   scsi_status;		/* SCSI status byte */
+	uint8_t	   sense_residual;	/* sense residual length */
+	uint32_t   residual;		/* data residual length */
+	uint32_t   tag_num;		/* tag number */
+	ctl_tag_type tag_type;		/* simple, ordered, head of queue,etc.*/
+	uint8_t    cdb_len;		/* CDB length */
+	uint8_t	   cdb[CTL_MAX_CDBLEN];	/* CDB */
+	int	   (*be_move_done)(union ctl_io *io); /* called by fe */
+	int        (*io_cont)(union ctl_io *io); /* to continue processing */
+};
+
+typedef enum {
+	CTL_TASK_ABORT_TASK,
+	CTL_TASK_ABORT_TASK_SET,
+	CTL_TASK_CLEAR_ACA,
+	CTL_TASK_CLEAR_TASK_SET,
+	CTL_TASK_LUN_RESET,
+	CTL_TASK_TARGET_RESET,
+	CTL_TASK_BUS_RESET,
+	CTL_TASK_PORT_LOGIN,
+	CTL_TASK_PORT_LOGOUT
+} ctl_task_type;
+
+/*
+ * Task management I/O structure.  Aborts, bus resets, etc., are sent using
+ * this structure.
+ *
+ * Note:  Make sure the io_hdr is *always* the first element in this
+ * structure.
+ */
+struct ctl_taskio {
+	struct ctl_io_hdr	io_hdr;      /* common to all I/O types */
+	ctl_task_type		task_action; /* Target Reset, Abort, etc.  */
+	uint32_t		tag_num;     /* tag number */
+	ctl_tag_type		tag_type;    /* simple, ordered, etc. */
+};
+
+typedef enum {
+	CTL_PR_REG_KEY,
+	CTL_PR_UNREG_KEY,
+	CTL_PR_PREEMPT,
+	CTL_PR_CLEAR,
+	CTL_PR_RESERVE,
+	CTL_PR_RELEASE
+} ctl_pr_action;
+
+/*
+ * The PR info is specifically for sending Persistent Reserve actions
+ * to the other SC which it must also act on.
+ *
+ * Note:  Make sure the io_hdr is *always* the first element in this
+ * structure.
+ */
+struct ctl_pr_info {
+	ctl_pr_action        action;
+	uint8_t              sa_res_key[8];
+	uint8_t              res_type;
+	uint16_t             residx;
+};
+
+struct ctl_ha_msg_hdr {
+	ctl_msg_type		msg_type;
+	union ctl_io		*original_sc;
+	union ctl_io		*serializing_sc;
+	struct ctl_nexus	nexus;	     /* Initiator, port, target, lun */
+	uint32_t		status;	     /* transaction status */
+	TAILQ_ENTRY(ctl_ha_msg_hdr) links;
+};
+
+#define	CTL_HA_MAX_SG_ENTRIES	16
+
+/*
+ * Used for CTL_MSG_APS_LOCK.
+ */
+struct ctl_ha_msg_aps {
+	struct ctl_ha_msg_hdr	hdr;
+	uint8_t			lock_flag;
+};
+
+/*
+ * Used for CTL_MSG_PERS_ACTION.
+ */
+struct ctl_ha_msg_pr {
+	struct ctl_ha_msg_hdr	hdr;
+	struct ctl_pr_info	pr_info;
+};
+
+/*
+ * The S/G handling here is a little different than the standard ctl_scsiio
+ * structure, because we can't pass data by reference in between controllers.
+ * The S/G list in the ctl_scsiio struct is normally passed in the
+ * kern_data_ptr field.  So kern_sg_entries here will always be non-zero,
+ * even if there is only one entry.
+ *
+ * Used for CTL_MSG_DATAMOVE.
+ */
+struct ctl_ha_msg_dt {
+	struct ctl_ha_msg_hdr	hdr;
+	ctl_io_flags		flags;  /* Only I/O flags are used here */
+	uint32_t		sg_sequence;     /* S/G portion number  */
+	uint8_t			sg_last;         /* last S/G batch = 1 */
+	uint32_t		sent_sg_entries; /* previous S/G count */
+	uint32_t		cur_sg_entries;  /* current S/G entries */
+	uint32_t		kern_sg_entries; /* total S/G entries */
+	uint32_t		kern_data_len;   /* Length of this S/G list */
+	uint32_t		kern_total_len;  /* Total length of this
+						    transaction */
+	uint32_t		kern_data_resid; /* Length left to transfer
+						    after this*/
+	uint32_t		kern_rel_offset; /* Byte Offset of this
+						    transfer */
+	struct ctl_sg_entry	sg_list[CTL_HA_MAX_SG_ENTRIES];
+};
+
+/*
+ * Used for CTL_MSG_SERIALIZE, CTL_MSG_FINISH_IO, CTL_MSG_BAD_JUJU.
+ */
+struct ctl_ha_msg_scsi {
+	struct ctl_ha_msg_hdr	hdr;
+	uint8_t			cdb[CTL_MAX_CDBLEN];	/* CDB */
+	uint32_t		tag_num;     /* tag number */
+	ctl_tag_type		tag_type;    /* simple, ordered, etc. */
+	uint8_t			scsi_status; /* SCSI status byte */
+	struct scsi_sense_data	sense_data;  /* sense data */
+	uint8_t			sense_len;   /* Returned sense length */
+	uint8_t			sense_residual;	/* sense residual length */
+	uint32_t		residual;    /* data residual length */
+	uint32_t		fetd_status; /* trans status, set by FETD,
+						0 = good*/
+	struct ctl_lba_len	lbalen;      /* used for stats */
+};
+
+/* 
+ * Used for CTL_MSG_MANAGE_TASKS.
+ */
+struct ctl_ha_msg_task {
+	struct ctl_ha_msg_hdr	hdr;
+	ctl_task_type		task_action; /* Target Reset, Abort, etc.  */
+	uint32_t		tag_num;     /* tag number */
+	ctl_tag_type		tag_type;    /* simple, ordered, etc. */
+};
+
+union ctl_ha_msg {
+	struct ctl_ha_msg_hdr	hdr;
+	struct ctl_ha_msg_task	task;
+	struct ctl_ha_msg_scsi	scsi;
+	struct ctl_ha_msg_dt	dt;
+	struct ctl_ha_msg_pr	pr;
+	struct ctl_ha_msg_aps	aps;
+};
+
+
+struct ctl_prio {
+	struct ctl_io_hdr  io_hdr;
+	struct ctl_ha_msg_pr pr_msg;
+};
+
+
+
+union ctl_io {
+	struct ctl_io_hdr io_hdr;	/* common to all I/O types */
+	struct ctl_scsiio scsiio;	/* Normal SCSI commands */
+	struct ctl_taskio taskio;	/* SCSI task management/reset */
+	struct ctl_prio   presio;	/* update per. res info on other SC */
+};
+
+#ifdef _KERNEL
+
+union ctl_io *ctl_alloc_io(void *pool_ref);
+void ctl_free_io(union ctl_io *io);
+void ctl_zero_io(union ctl_io *io);
+void ctl_copy_io(union ctl_io *src, union ctl_io *dest);
+
+#endif /* _KERNEL */
+
+#endif	/* _CTL_IO_H_ */
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_ioctl.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_ioctl.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,604 @@
+/*-
+ * Copyright (c) 2003 Silicon Graphics International Corp.
+ * Copyright (c) 2011 Spectra Logic Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_ioctl.h#4 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_ioctl.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer ioctl interface.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_IOCTL_H_
+#define	_CTL_IOCTL_H_
+
+#define	CTL_DEFAULT_DEV		"/dev/cam/ctl"
+/*
+ * Maximum number of targets we support.
+ */
+#define	CTL_MAX_TARGETS		1
+
+/*
+ * Maximum target ID we support.
+ */
+#define	CTL_MAX_TARGID		15
+
+/*
+ * Maximum number of LUNs we support at the moment.  MUST be a power of 2.
+ */
+#define	CTL_MAX_LUNS		256
+
+/*
+ * Maximum number of initiators per port.
+ */
+#define	CTL_MAX_INIT_PER_PORT	2048 // Was 16
+
+/*
+ * Maximum number of ports registered at one time.
+ */
+#define	CTL_MAX_PORTS		32
+
+/*
+ * Maximum number of initiators we support.
+ */
+#define	CTL_MAX_INITIATORS	(CTL_MAX_INIT_PER_PORT * CTL_MAX_PORTS)
+
+/* Hopefully this won't conflict with new misc devices that pop up */
+#define	CTL_MINOR	225
+
+typedef enum {
+	CTL_OOA_INVALID_LUN,
+	CTL_OOA_SUCCESS
+} ctl_ooa_status;
+
+struct ctl_ooa_info {
+	uint32_t target_id;	/* Passed in to CTL */
+	uint32_t lun_id;	/* Passed in to CTL */
+	uint32_t num_entries;	/* Returned from CTL */
+	ctl_ooa_status status;	/* Returned from CTL */
+};
+
+struct ctl_hard_startstop_info {
+	cfi_mt_status status;
+	int total_luns;
+	int luns_complete;
+	int luns_failed;
+};
+
+struct ctl_bbrread_info {
+	int			lun_num;	/* Passed in to CTL */
+	uint64_t		lba;		/* Passed in to CTL */
+	int			len;		/* Passed in to CTL */
+	cfi_mt_status		status;		/* Returned from CTL */
+	cfi_bbrread_status	bbr_status;	/* Returned from CTL */
+	uint8_t			scsi_status;	/* Returned from CTL */
+	struct scsi_sense_data	sense_data;	/* Returned from CTL */
+};
+
+typedef enum {
+	CTL_DELAY_TYPE_NONE,
+	CTL_DELAY_TYPE_CONT,
+	CTL_DELAY_TYPE_ONESHOT
+} ctl_delay_type;
+
+typedef enum {
+	CTL_DELAY_LOC_NONE,
+	CTL_DELAY_LOC_DATAMOVE,
+	CTL_DELAY_LOC_DONE,
+} ctl_delay_location;
+
+typedef enum {
+	CTL_DELAY_STATUS_NONE,
+	CTL_DELAY_STATUS_OK,
+	CTL_DELAY_STATUS_INVALID_LUN,
+	CTL_DELAY_STATUS_INVALID_TYPE,
+	CTL_DELAY_STATUS_INVALID_LOC,
+	CTL_DELAY_STATUS_NOT_IMPLEMENTED
+} ctl_delay_status;
+
+struct ctl_io_delay_info {
+	uint32_t		target_id;
+	uint32_t		lun_id;
+	ctl_delay_type		delay_type;
+	ctl_delay_location	delay_loc;
+	uint32_t		delay_secs;
+	ctl_delay_status	status;
+};
+
+typedef enum {
+	CTL_GS_SYNC_NONE,
+	CTL_GS_SYNC_OK,
+	CTL_GS_SYNC_NO_LUN
+} ctl_gs_sync_status;
+
+/*
+ * The target and LUN id specify which device to modify.  The sync interval
+ * means that we will let through every N SYNCHRONIZE CACHE commands.
+ */
+struct ctl_sync_info {
+	uint32_t		target_id;	/* passed to kernel */
+	uint32_t		lun_id;		/* passed to kernel */
+	int			sync_interval;	/* depends on whether get/set */
+	ctl_gs_sync_status	status;		/* passed from kernel */
+};
+
+typedef enum {
+	CTL_STATS_NO_IO,
+	CTL_STATS_READ,
+	CTL_STATS_WRITE
+} ctl_stat_types;
+#define	CTL_STATS_NUM_TYPES	3
+
+typedef enum {
+	CTL_LUN_STATS_NO_BLOCKSIZE	= 0x01
+} ctl_lun_stats_flags;
+
+struct ctl_lun_io_port_stats {
+	uint32_t			targ_port;
+	uint64_t			bytes[CTL_STATS_NUM_TYPES];
+	uint64_t			operations[CTL_STATS_NUM_TYPES];
+	struct bintime			time[CTL_STATS_NUM_TYPES];
+	uint64_t			num_dmas[CTL_STATS_NUM_TYPES];
+	struct bintime			dma_time[CTL_STATS_NUM_TYPES];
+};
+
+struct ctl_lun_io_stats {
+	uint8_t				device_type;
+	uint64_t			lun_number;
+	uint32_t			blocksize;
+	ctl_lun_stats_flags		flags;
+	struct ctl_lun_io_port_stats	ports[CTL_MAX_PORTS];
+};
+
+typedef enum {
+	CTL_SS_OK,
+	CTL_SS_NEED_MORE_SPACE,
+	CTL_SS_ERROR
+} ctl_stats_status;
+
+typedef enum {
+	CTL_STATS_FLAG_NONE		= 0x00,
+	CTL_STATS_FLAG_TIME_VALID	= 0x01
+} ctl_stats_flags;
+
+struct ctl_stats {
+	int			alloc_len;	/* passed to kernel */
+	struct ctl_lun_io_stats	*lun_stats;	/* passed to/from kernel */
+	int			fill_len;	/* passed to userland */
+	int			num_luns;	/* passed to userland */
+	ctl_stats_status	status;		/* passed to userland */
+	ctl_stats_flags		flags;		/* passed to userland */
+	struct timespec		timestamp;	/* passed to userland */
+};
+
+/*
+ * The types of errors that can be injected:
+ *
+ * NONE:	No error specified.
+ * ABORTED:	SSD_KEY_ABORTED_COMMAND, 0x45, 0x00
+ * MEDIUM_ERR:	Medium error, different asc/ascq depending on read/write.
+ * UA:		Unit attention.
+ * CUSTOM:	User specifies the sense data.
+ * TYPE:	Mask to use with error types.
+ *
+ * Flags that affect injection behavior:
+ * CONTINUOUS:	This error will stay around until explicitly cleared.
+ * DESCRIPTOR:	Use descriptor sense instead of fixed sense.
+ */
+typedef enum {
+	CTL_LUN_INJ_NONE		= 0x000,
+	CTL_LUN_INJ_ABORTED		= 0x001,
+	CTL_LUN_INJ_MEDIUM_ERR		= 0x002,
+	CTL_LUN_INJ_UA			= 0x003,
+	CTL_LUN_INJ_CUSTOM		= 0x004,
+	CTL_LUN_INJ_TYPE		= 0x0ff,
+	CTL_LUN_INJ_CONTINUOUS		= 0x100,
+	CTL_LUN_INJ_DESCRIPTOR		= 0x200
+} ctl_lun_error;
+
+/*
+ * Flags to specify what type of command the given error pattern will
+ * execute on.  The first group of types can be ORed together.
+ *
+ * READ:	Any read command.
+ * WRITE:	Any write command.
+ * READWRITE:	Any read or write command.
+ * READCAP:	Any read capacity command.
+ * TUR:		Test Unit Ready.
+ * ANY:		Any command.
+ * MASK:	Mask for basic command patterns.
+ *
+ * Special types:
+ *
+ * CMD:		The CDB to act on is specified in struct ctl_error_desc_cmd.
+ * RANGE:	For read/write commands, act when the LBA is in the
+ *		specified range.
+ */
+typedef enum {
+	CTL_LUN_PAT_NONE	= 0x000,
+	CTL_LUN_PAT_READ	= 0x001,
+	CTL_LUN_PAT_WRITE	= 0x002,
+	CTL_LUN_PAT_READWRITE	= CTL_LUN_PAT_READ | CTL_LUN_PAT_WRITE,
+	CTL_LUN_PAT_READCAP	= 0x004,
+	CTL_LUN_PAT_TUR		= 0x008,
+	CTL_LUN_PAT_ANY		= 0x0ff,
+	CTL_LUN_PAT_MASK	= 0x0ff,
+	CTL_LUN_PAT_CMD		= 0x100,
+	CTL_LUN_PAT_RANGE	= 0x200
+} ctl_lun_error_pattern;
+
+/*
+ * This structure allows the user to specify a particular CDB pattern to
+ * look for.
+ *
+ * cdb_pattern:		Fill in the relevant bytes to look for in the CDB.
+ * cdb_valid_bytes:	Bitmask specifying valid bytes in the cdb_pattern.
+ * flags:		Specify any command flags (see ctl_io_flags) that
+ *			should be set.
+ */
+struct ctl_error_desc_cmd {
+	uint8_t		cdb_pattern[CTL_MAX_CDBLEN];
+	uint32_t	cdb_valid_bytes;
+	uint32_t	flags;
+};
+
+/*
+ * Error injection descriptor.
+ *
+ * target_id:	   Target ID to act on.
+ * lun_id	   LUN to act on.
+ * lun_error:	   The type of error to inject.  See above for descriptions.
+ * error_pattern:  What kind of command to act on.  See above.
+ * cmd_desc:	   For CTL_LUN_PAT_CMD only.
+ * lba_range:	   For CTL_LUN_PAT_RANGE only.
+ * custom_sense:   Specify sense.  For CTL_LUN_INJ_CUSTOM only.
+ * serial:	   Serial number returned by the kernel.  Use for deletion.
+ * links:	   Kernel use only.
+ */
+struct ctl_error_desc {
+	uint32_t			target_id;	/* To kernel */
+	uint32_t			lun_id;		/* To kernel */
+	ctl_lun_error			lun_error;	/* To kernel */
+	ctl_lun_error_pattern		error_pattern;	/* To kernel */
+	struct ctl_error_desc_cmd	cmd_desc;	/* To kernel */
+	struct ctl_lba_len		lba_range;	/* To kernel */
+	struct scsi_sense_data		custom_sense;	/* To kernel */
+	uint64_t			serial;		/* From kernel */
+	STAILQ_ENTRY(ctl_error_desc)	links;		/* Kernel use only */
+};
+
+typedef enum {
+	CTL_OOA_FLAG_NONE	= 0x00,
+	CTL_OOA_FLAG_ALL_LUNS	= 0x01
+} ctl_ooa_flags;
+
+typedef enum {
+	CTL_OOA_OK,
+	CTL_OOA_NEED_MORE_SPACE,
+	CTL_OOA_ERROR
+} ctl_get_ooa_status;
+
+typedef enum {
+	CTL_OOACMD_FLAG_NONE		= 0x00,
+	CTL_OOACMD_FLAG_DMA		= 0x01,
+	CTL_OOACMD_FLAG_BLOCKED		= 0x02,
+	CTL_OOACMD_FLAG_ABORT		= 0x04,
+	CTL_OOACMD_FLAG_RTR		= 0x08,
+	CTL_OOACMD_FLAG_DMA_QUEUED	= 0x10
+} ctl_ooa_cmd_flags;
+
+struct ctl_ooa_entry {
+	ctl_ooa_cmd_flags	cmd_flags;
+	uint8_t			cdb[CTL_MAX_CDBLEN];
+	uint8_t			cdb_len;
+	uint32_t		tag_num;
+	uint32_t		lun_num;
+	struct bintime		start_bt;
+};
+
+struct ctl_ooa {
+	ctl_ooa_flags		flags;		/* passed to kernel */
+	uint64_t		lun_num;	/* passed to kernel */
+	uint32_t		alloc_len;	/* passed to kernel */
+	uint32_t		alloc_num;	/* passed to kernel */
+	struct ctl_ooa_entry	*entries;	/* filled in kernel */
+	uint32_t		fill_len;	/* passed to userland */
+	uint32_t		fill_num;	/* passed to userland */
+	uint32_t		dropped_num;	/* passed to userland */
+	struct bintime		cur_bt;		/* passed to userland */
+	ctl_get_ooa_status	status;		/* passed to userland */
+};
+
+typedef enum {
+	CTL_PORT_LIST_NONE,
+	CTL_PORT_LIST_OK,
+	CTL_PORT_LIST_NEED_MORE_SPACE,
+	CTL_PORT_LIST_ERROR
+} ctl_port_list_status;
+
+struct ctl_port_list {
+	uint32_t		alloc_len;	/* passed to kernel */
+	uint32_t		alloc_num;	/* passed to kernel */
+	struct ctl_port_entry   *entries;	/* filled in kernel */
+	uint32_t		fill_len;	/* passed to userland */
+	uint32_t		fill_num;	/* passed to userland */
+	uint32_t		dropped_num;	/* passed to userland */
+	ctl_port_list_status	status;		/* passed to userland */
+};
+
+typedef enum {
+	CTL_LUN_NOSTATUS,
+	CTL_LUN_OK,
+	CTL_LUN_ERROR
+} ctl_lun_status;
+
+#define	CTL_ERROR_STR_LEN	160
+
+#define	CTL_BEARG_RD		0x01
+#define	CTL_BEARG_WR		0x02
+#define	CTL_BEARG_RW		(CTL_BEARG_RD|CTL_BEARG_WR)
+#define	CTL_BEARG_ASCII		0x04
+
+/*
+ * Backend Argument:
+ *
+ * namelen:	Length of the name field, including the terminating NUL.
+ *
+ * name:	Name of the paramter.  This must be NUL-terminated.
+ *
+ * flags:	Flags for the parameter, see above for values.
+ *
+ * vallen:	Length of the value in bytes.
+ *
+ * value:	Value to be set/fetched.
+ *
+ * kname:	For kernel use only.
+ *
+ * kvalue:	For kernel use only.
+ */
+struct ctl_be_arg {
+	int	namelen;
+	char	*name;
+	int	flags;
+	int	vallen;
+	void	*value;
+
+	char	*kname;
+	void	*kvalue;
+};
+
+typedef enum {
+	CTL_LUNREQ_CREATE,
+	CTL_LUNREQ_RM
+} ctl_lunreq_type;
+
+
+/*
+ * LUN creation parameters:
+ *
+ * flags:		Various LUN flags, see ctl_backend.h for a
+ *			description of the flag values and meanings.
+ *
+ * device_type:		The SCSI device type.  e.g. 0 for Direct Access,
+ *			3 for Processor, etc.  Only certain backends may
+ *			support setting this field.  The CTL_LUN_FLAG_DEV_TYPE
+ *			flag should be set in the flags field if the device
+ *			type is set.
+ *
+ * lun_size_bytes:	The size of the LUN in bytes.  For some backends
+ *			this is relevant (e.g. ramdisk), for others, it may
+ *			be ignored in favor of using the properties of the
+ *			backing store.  If specified, this should be a
+ *			multiple of the blocksize.
+ *
+ *			The actual size of the LUN is returned in this
+ *			field.
+ *
+ * blocksize_bytes:	The LUN blocksize in bytes.  For some backends this
+ *			is relevant, for others it may be ignored in
+ *			favor of using the properties of the backing store. 
+ *
+ *			The actual blocksize of the LUN is returned in this
+ *			field.
+ *
+ * req_lun_id:		The requested LUN ID.  The CTL_LUN_FLAG_ID_REQ flag
+ *			should be set if this is set.  The request will be
+ *			granted if the LUN number is available, otherwise
+ * 			the LUN addition request will fail.
+ *
+ *			The allocated LUN number is returned in this field.
+ *
+ * serial_num:		This is the value returned in SCSI INQUIRY VPD page
+ *			0x80.  If it is specified, the CTL_LUN_FLAG_SERIAL_NUM
+ *			flag should be set.
+ *
+ *			The serial number value used is returned in this
+ *			field.
+ *
+ * device_id:		This is the value returned in the T10 vendor ID
+ *			based DESIGNATOR field in the SCSI INQUIRY VPD page
+ *			0x83 data.  If it is specified, the CTL_LUN_FLAG_DEVID
+ *			flag should be set.
+ *
+ *			The device id value used is returned in this field.
+ */
+struct ctl_lun_create_params {
+	ctl_backend_lun_flags	flags;
+	uint8_t			device_type;
+	uint64_t		lun_size_bytes;
+	uint32_t		blocksize_bytes;
+	uint32_t		req_lun_id;
+	uint8_t			serial_num[CTL_SN_LEN];
+	uint8_t			device_id[CTL_DEVID_LEN];
+};
+
+/*
+ * LUN removal parameters:
+ *
+ * lun_id:		The number of the LUN to delete.  This must be set.
+ *			The LUN must be backed by the given backend.
+ */
+struct ctl_lun_rm_params {
+	uint32_t		lun_id;
+};
+
+/*
+ * Union of request type data.  Fill in the appropriate union member for
+ * the request type.
+ */
+union ctl_lunreq_data {
+	struct ctl_lun_create_params	create;
+	struct ctl_lun_rm_params	rm;
+};
+
+/*
+ * LUN request interface:
+ *
+ * backend:		This is required, and is NUL-terminated a string
+ *			that is the name of the backend, like "ramdisk" or
+ *			"block".
+ *
+ * reqtype:		The type of request, CTL_LUNREQ_CREATE to create a
+ *			LUN, CTL_LUNREQ_RM to delete a LUN.
+ *
+ * reqdata:		Request type-specific information.  See the
+ *			description of individual the union members above
+ *			for more information.
+ *
+ * num_be_args:		This is the number of backend-specific arguments
+ *			in the be_args array.
+ *
+ * be_args:		This is an array of backend-specific arguments.
+ *			See above for a description of the fields in this
+ *			structure.
+ *
+ * status:		Status of the LUN request.
+ *
+ * error_str:		If the status is CTL_LUN_ERROR, this will
+ *			contain a string describing the error.
+ *
+ * kern_be_args:	For kernel use only.
+ */
+struct ctl_lun_req {
+	char			backend[CTL_BE_NAME_LEN];
+	ctl_lunreq_type		reqtype;
+	union ctl_lunreq_data	reqdata;
+	int			num_be_args;
+	struct ctl_be_arg	*be_args;
+	ctl_lun_status		status;
+	char			error_str[CTL_ERROR_STR_LEN];
+	struct ctl_be_arg	*kern_be_args;
+};
+
+/*
+ * LUN list status:
+ *
+ * NONE:		No status.
+ *
+ * OK:			Request completed successfully.
+ *
+ * NEED_MORE_SPACE:	The allocated length of the entries field is too
+ * 			small for the available data.
+ *
+ * ERROR:		An error occured, look at the error string for a
+ *			description of the error.
+ */
+typedef enum {
+	CTL_LUN_LIST_NONE,
+	CTL_LUN_LIST_OK,
+	CTL_LUN_LIST_NEED_MORE_SPACE,
+	CTL_LUN_LIST_ERROR
+} ctl_lun_list_status;
+
+/*
+ * LUN list interface
+ *
+ * backend_name:	This is a NUL-terminated string.  If the string
+ *			length is 0, then all LUNs on all backends will
+ *			be enumerated.  Otherwise this is the name of the
+ *			backend to be enumerated, like "ramdisk" or "block".
+ *
+ * alloc_len:		The length of the data buffer allocated for entries.
+ *			In order to properly size the buffer, make one call
+ *			with alloc_len set to 0, and then use the returned
+ *			dropped_len as the buffer length to allocate and
+ *			pass in on a subsequent call.
+ *
+ * lun_xml:		XML-formatted information on the requested LUNs.
+ *
+ * fill_len:		The amount of data filled in the storage for entries.
+ *
+ * status:		The status of the request.  See above for the 
+ *			description of the values of this field.
+ *
+ * error_str:		If the status indicates an error, this string will
+ *			be filled in to describe the error.
+ */
+struct ctl_lun_list {
+	char			backend[CTL_BE_NAME_LEN]; /* passed to kernel*/
+	uint32_t		alloc_len;	/* passed to kernel */
+	char                   *lun_xml;	/* filled in kernel */
+	uint32_t		fill_len;	/* passed to userland */
+	ctl_lun_list_status	status;		/* passed to userland */
+	char			error_str[CTL_ERROR_STR_LEN];
+						/* passed to userland */
+};
+
+#define	CTL_IO			_IOWR(CTL_MINOR, 0x00, union ctl_io)
+#define	CTL_ENABLE_PORT		_IOW(CTL_MINOR, 0x04, struct ctl_port_entry)
+#define	CTL_DISABLE_PORT	_IOW(CTL_MINOR, 0x05, struct ctl_port_entry)
+#define	CTL_DUMP_OOA		_IO(CTL_MINOR, 0x06)
+#define	CTL_CHECK_OOA		_IOWR(CTL_MINOR, 0x07, struct ctl_ooa_info)
+#define	CTL_HARD_STOP		_IOR(CTL_MINOR, 0x08, \
+				     struct ctl_hard_startstop_info)
+#define	CTL_HARD_START		_IOR(CTL_MINOR, 0x09, \
+				     struct ctl_hard_startstop_info)
+#define	CTL_DELAY_IO		_IOWR(CTL_MINOR, 0x10, struct ctl_io_delay_info)
+#define	CTL_REALSYNC_GET	_IOR(CTL_MINOR, 0x11, int)
+#define	CTL_REALSYNC_SET	_IOW(CTL_MINOR, 0x12, int)
+#define	CTL_SETSYNC		_IOWR(CTL_MINOR, 0x13, struct ctl_sync_info)
+#define	CTL_GETSYNC		_IOWR(CTL_MINOR, 0x14, struct ctl_sync_info)
+#define	CTL_GETSTATS		_IOWR(CTL_MINOR, 0x15, struct ctl_stats)
+#define	CTL_ERROR_INJECT	_IOWR(CTL_MINOR, 0x16, struct ctl_error_desc)
+#define	CTL_BBRREAD		_IOWR(CTL_MINOR, 0x17, struct ctl_bbrread_info)
+#define	CTL_GET_OOA		_IOWR(CTL_MINOR, 0x18, struct ctl_ooa)
+#define	CTL_DUMP_STRUCTS	_IO(CTL_MINOR, 0x19)
+#define	CTL_GET_PORT_LIST	_IOWR(CTL_MINOR, 0x20, struct ctl_port_list)
+#define	CTL_LUN_REQ		_IOWR(CTL_MINOR, 0x21, struct ctl_lun_req)
+#define	CTL_LUN_LIST		_IOWR(CTL_MINOR, 0x22, struct ctl_lun_list)
+#define	CTL_ERROR_INJECT_DELETE	_IOW(CTL_MINOR, 0x23, struct ctl_error_desc)
+#define	CTL_SET_PORT_WWNS	_IOW(CTL_MINOR, 0x24, struct ctl_port_entry)
+
+#endif /* _CTL_IOCTL_H_ */
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_mem_pool.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_mem_pool.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,192 @@
+/*-
+ * Copyright (c) 2003, 2004 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_mem_pool.c#1 $
+ */
+/*
+ * CAM Target Layer memory pool code.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_mem_pool.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/queue.h>
+
+#include <cam/ctl/ctl_mem_pool.h>
+
+MALLOC_DEFINE(M_CTL_POOL, "ctlpool", "CTL memory pool");
+
+int
+ctl_init_mem_pool(struct ctl_mem_pool *pool, int chunk_size,
+		  ctl_mem_pool_flags flags, int grow_inc,
+		  int initial_pool_size)
+{
+	pool->flags = flags;
+	pool->chunk_size = chunk_size;
+	pool->grow_inc = grow_inc;
+	mtx_init(&pool->lock, "Pool mutex", NULL, MTX_DEF);
+	STAILQ_INIT(&pool->free_mem_list);
+	cv_init(&pool->wait_mem, "CTL mem pool");
+
+	if (ctl_grow_mem_pool(pool, initial_pool_size, /*can_wait*/ 1) !=
+	    initial_pool_size)
+		return (1);
+	else
+		return (0);
+}
+
+struct ctl_mem_element *
+ctl_alloc_mem_element(struct ctl_mem_pool *pool, int can_wait)
+{
+	struct ctl_mem_element *mem;
+
+	for (;;) {
+		mtx_lock(&pool->lock);
+
+		mem = STAILQ_FIRST(&pool->free_mem_list);
+		if (mem != NULL) {
+			STAILQ_REMOVE(&pool->free_mem_list, mem,
+				      ctl_mem_element, links);
+			mem->flags = CTL_MEM_ELEMENT_PREALLOC;
+		}
+		mtx_unlock(&pool->lock);
+
+		if (mem != NULL)
+			return (mem);
+
+		/*
+		 * Grow the pool permanantly by the requested increment
+		 * instead of temporarily.  This has the effect that
+		 * whatever the high water mark of transactions is for
+		 * this pool, we'll keep that much memory around.
+		 */
+		if (pool->flags & CTL_MEM_POOL_PERM_GROW) {
+			if (ctl_grow_mem_pool(pool, pool->grow_inc,
+					      can_wait) != 0)
+				continue;
+		}
+		mem = (struct ctl_mem_element *)malloc(sizeof(*mem),
+			M_CTL_POOL, can_wait ? M_WAITOK : M_NOWAIT);
+
+		if (mem != NULL) {
+			mem->flags = CTL_MEM_ELEMENT_NONE;
+			mem->pool = pool;
+
+			mem->bytes = malloc(pool->chunk_size, M_CTL_POOL,
+				can_wait ?  M_WAITOK : M_NOWAIT);
+			if (mem->bytes == NULL) {
+				free(mem, M_CTL_POOL);
+				mem = NULL;
+			} else {
+				return (mem);
+			}
+		}
+
+		if (can_wait == 0)
+			return (NULL);
+
+		cv_wait_unlock(&pool->wait_mem, &pool->lock);
+	}
+}
+
+void
+ctl_free_mem_element(struct ctl_mem_element *mem)
+{
+	struct ctl_mem_pool *pool;
+
+	pool = mem->pool;
+
+	if (mem->flags & CTL_MEM_ELEMENT_PREALLOC) {
+		mtx_lock(&pool->lock);
+		STAILQ_INSERT_TAIL(&pool->free_mem_list, mem, links);
+		mtx_unlock(&pool->lock);
+		cv_broadcast(&pool->wait_mem);
+	} else
+		free(mem, M_CTL_POOL);
+}
+
+int
+ctl_grow_mem_pool(struct ctl_mem_pool *pool, int count, int can_wait)
+{
+	int i;
+
+	for (i = 0; i < count; i++) {
+		struct ctl_mem_element *mem;
+
+		mem = (struct ctl_mem_element *)malloc(sizeof(*mem),
+			M_CTL_POOL, can_wait ? M_WAITOK : M_NOWAIT);
+
+		if (mem == NULL)
+			break;
+
+		mem->bytes = malloc(pool->chunk_size, M_CTL_POOL, can_wait ?
+				     M_WAITOK : M_NOWAIT);
+		if (mem->bytes == NULL) {
+			free(mem, M_CTL_POOL);
+			break;
+		}
+		mem->flags = CTL_MEM_ELEMENT_PREALLOC;
+		mem->pool = pool;
+		mtx_lock(&pool->lock);
+		STAILQ_INSERT_TAIL(&pool->free_mem_list, mem, links);
+		mtx_unlock(&pool->lock);
+	}
+
+	return (i);
+}
+
+int
+ctl_shrink_mem_pool(struct ctl_mem_pool *pool)
+{
+	struct ctl_mem_element *mem, *mem_next;
+
+	mtx_lock(&pool->lock);
+	for (mem = STAILQ_FIRST(&pool->free_mem_list); mem != NULL;
+	     mem = mem_next) {
+		mem_next = STAILQ_NEXT(mem, links);
+
+		STAILQ_REMOVE(&pool->free_mem_list, mem, ctl_mem_element,
+			      links);
+		free(mem->bytes, M_CTL_POOL);
+		free(mem, M_CTL_POOL);
+	}
+	mtx_unlock(&pool->lock);
+
+	return (0);
+}
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_mem_pool.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_mem_pool.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,83 @@
+/*-
+ * Copyright (c) 2003, 2004 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_mem_pool.h#1 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_mem_pool.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer memory pool code.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_MEMPOOL_H_
+#define	_CTL_MEMPOOL_H_
+
+typedef enum {
+	CTL_MEM_POOL_NONE,
+	CTL_MEM_POOL_PERM_GROW
+} ctl_mem_pool_flags;
+
+struct ctl_mem_pool {
+	ctl_mem_pool_flags flags;
+	int chunk_size;
+	int grow_inc;
+	struct mtx lock;
+        struct cv wait_mem;
+	STAILQ_HEAD(, ctl_mem_element) free_mem_list;
+};
+
+typedef enum {
+	CTL_MEM_ELEMENT_NONE,
+	CTL_MEM_ELEMENT_PREALLOC
+} ctl_mem_element_flags;
+
+struct ctl_mem_element {
+	ctl_mem_element_flags flags;
+	struct ctl_mem_pool *pool;
+	uint8_t *bytes;
+	STAILQ_ENTRY(ctl_mem_element) links;
+};
+
+#ifdef	_KERNEL
+
+MALLOC_DECLARE(M_CTL_POOL);
+
+int ctl_init_mem_pool(struct ctl_mem_pool *pool, int chunk_size,
+		      ctl_mem_pool_flags flags, int grow_inc,
+		      int initial_pool_size);
+struct ctl_mem_element *ctl_alloc_mem_element(struct ctl_mem_pool *pool,
+					      int can_wait);
+void ctl_free_mem_element(struct ctl_mem_element *mem);
+int ctl_grow_mem_pool(struct ctl_mem_pool *pool, int count,
+		      int can_wait);
+int ctl_shrink_mem_pool(struct ctl_mem_pool *pool);
+#endif	/* _KERNEL */
+
+#endif	/* _CTL_MEMPOOL_H_ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_private.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_private.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,493 @@
+/*-
+ * Copyright (c) 2003, 2004, 2005, 2008 Silicon Graphics International Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_private.h#7 $
+ * $FreeBSD: head/sys/cam/ctl/ctl_private.h 229997 2012-01-12 00:34:33Z ken $
+ */
+/*
+ * CAM Target Layer driver private data structures/definitions.
+ *
+ * Author: Ken Merry <ken at FreeBSD.org>
+ */
+
+#ifndef	_CTL_PRIVATE_H_
+#define	_CTL_PRIVATE_H_
+
+/*
+ * SCSI vendor and product names.
+ */
+#define	CTL_VENDOR		"FREEBSD "
+#define	CTL_DIRECT_PRODUCT	"CTLDISK         "
+#define	CTL_PROCESSOR_PRODUCT	"CTLPROCESSOR    "
+#define	CTL_UNKNOWN_PRODUCT	"CTLDEVICE       "
+
+struct ctl_fe_ioctl_startstop_info {
+	struct cv			sem;
+	struct ctl_hard_startstop_info	hs_info;
+};
+
+struct ctl_fe_ioctl_bbrread_info {
+	struct cv			sem;
+	struct ctl_bbrread_info		*bbr_info;
+	int				wakeup_done;
+	struct mtx			*lock;
+};
+
+typedef enum {
+	CTL_IOCTL_INPROG,
+	CTL_IOCTL_DATAMOVE,
+	CTL_IOCTL_DONE
+} ctl_fe_ioctl_state;
+
+struct ctl_fe_ioctl_params {
+	struct cv		sem;
+	struct mtx		ioctl_mtx;
+	ctl_fe_ioctl_state	state;
+};
+
+#define	CTL_POOL_ENTRIES_INTERNAL	200
+#define	CTL_POOL_ENTRIES_EMERGENCY	300
+#define CTL_POOL_ENTRIES_OTHER_SC   200
+
+typedef enum {
+	CTL_POOL_INTERNAL,
+	CTL_POOL_FETD,
+	CTL_POOL_EMERGENCY,
+	CTL_POOL_IOCTL,
+	CTL_POOL_4OTHERSC
+} ctl_pool_type;
+
+typedef enum {
+	CTL_POOL_FLAG_NONE	= 0x00,
+	CTL_POOL_FLAG_INVALID	= 0x01
+} ctl_pool_flags;
+
+struct ctl_io_pool {
+	ctl_pool_type			type;
+	ctl_pool_flags			flags;
+	uint32_t			id;
+	struct ctl_softc		*ctl_softc;
+	uint32_t			refcount;
+	uint64_t			total_allocated;
+	uint64_t			total_freed;
+	int32_t				total_ctl_io;
+	int32_t				free_ctl_io;
+	STAILQ_HEAD(, ctl_io_hdr)	free_queue;
+	STAILQ_ENTRY(ctl_io_pool)	links;
+};
+
+typedef enum {
+	CTL_IOCTL_FLAG_NONE	= 0x00,
+	CTL_IOCTL_FLAG_ENABLED	= 0x01
+} ctl_ioctl_flags;
+
+struct ctl_ioctl_info {
+	ctl_ioctl_flags		flags;
+	uint32_t		cur_tag_num;
+	struct ctl_frontend	fe;
+	char			port_name[24];
+};
+
+typedef enum {
+	CTL_SER_BLOCK,
+	CTL_SER_EXTENT,
+	CTL_SER_PASS,
+	CTL_SER_SKIP
+} ctl_serialize_action;
+
+typedef enum {
+	CTL_ACTION_BLOCK,
+	CTL_ACTION_OVERLAP,
+	CTL_ACTION_OVERLAP_TAG,
+	CTL_ACTION_PASS,
+	CTL_ACTION_SKIP,
+	CTL_ACTION_ERROR
+} ctl_action;
+
+/*
+ * WARNING:  Keep the bottom nibble here free, we OR in the data direction
+ * flags for each command.
+ *
+ * Note:  "OK_ON_ALL_LUNS" == we don't have to have a lun configured
+ *        "OK_ON_BOTH"     == we have to have a lun configured
+ */
+typedef enum {
+	CTL_CMD_FLAG_NONE		= 0x0000,
+	CTL_CMD_FLAG_NO_SENSE		= 0x0010,
+	CTL_CMD_FLAG_OK_ON_ALL_LUNS	= 0x0020,
+	CTL_CMD_FLAG_ALLOW_ON_RESV	= 0x0040,
+	CTL_CMD_FLAG_OK_ON_PROC		= 0x0100,
+	CTL_CMD_FLAG_OK_ON_SLUN		= 0x0200,
+	CTL_CMD_FLAG_OK_ON_BOTH		= 0x0300,
+	CTL_CMD_FLAG_OK_ON_STOPPED	= 0x0400,
+	CTL_CMD_FLAG_OK_ON_INOPERABLE	= 0x0800,
+	CTL_CMD_FLAG_OK_ON_OFFLINE	= 0x1000,
+	CTL_CMD_FLAG_OK_ON_SECONDARY	= 0x2000,
+	CTL_CMD_FLAG_ALLOW_ON_PR_RESV   = 0x4000
+} ctl_cmd_flags;
+
+typedef enum {
+	CTL_SERIDX_TUR	= 0,
+	CTL_SERIDX_READ,
+	CTL_SERIDX_WRITE,
+	CTL_SERIDX_MD_SNS,
+	CTL_SERIDX_MD_SEL,
+	CTL_SERIDX_RQ_SNS,
+	CTL_SERIDX_INQ,
+	CTL_SERIDX_RD_CAP,
+	CTL_SERIDX_RESV,
+	CTL_SERIDX_REL,
+	CTL_SERIDX_LOG_SNS,
+	CTL_SERIDX_FORMAT,
+	CTL_SERIDX_START,
+	CTL_SERIDX_PRES_IN,
+	CTL_SERIDX_PRES_OUT,
+	CTL_SERIDX_MAIN_IN,
+	/* TBD: others to be filled in as needed */
+	CTL_SERIDX_COUNT, /* LAST, not a normal code, provides # codes */
+	CTL_SERIDX_INVLD = CTL_SERIDX_COUNT
+} ctl_seridx;
+
+typedef int	ctl_opfunc(struct ctl_scsiio *ctsio);
+
+struct ctl_cmd_entry {
+	ctl_opfunc		*execute;
+	ctl_seridx		seridx;
+	ctl_cmd_flags		flags;
+	ctl_lun_error_pattern	pattern;
+};
+
+typedef enum {
+	CTL_LUN_NONE		= 0x000,
+	CTL_LUN_CONTROL		= 0x001,
+	CTL_LUN_RESERVED	= 0x002,
+	CTL_LUN_INVALID		= 0x004,
+	CTL_LUN_DISABLED	= 0x008,
+	CTL_LUN_MALLOCED	= 0x010,
+	CTL_LUN_STOPPED		= 0x020,
+	CTL_LUN_INOPERABLE	= 0x040,
+	CTL_LUN_OFFLINE		= 0x080,
+	CTL_LUN_PR_RESERVED	= 0x100,
+	CTL_LUN_PRIMARY_SC	= 0x200,
+	CTL_LUN_SENSE_DESC	= 0x400
+} ctl_lun_flags;
+
+typedef enum {
+	CTLBLOCK_FLAG_NONE	= 0x00,
+	CTLBLOCK_FLAG_INVALID	= 0x01
+} ctlblock_flags;
+
+union ctl_softcs {
+	struct ctl_softc	*ctl_softc;
+	struct ctlblock_softc	*ctlblock_softc;
+};
+
+/*
+ * Mode page defaults.
+ */
+#if 0
+/*
+ * These values make Solaris trim off some of the capacity.
+ */
+#define	CTL_DEFAULT_SECTORS_PER_TRACK	63
+#define	CTL_DEFAULT_HEADS		255
+/*
+ * These values seem to work okay.
+ */
+#define	CTL_DEFAULT_SECTORS_PER_TRACK	63
+#define	CTL_DEFAULT_HEADS		16
+/*
+ * These values work reasonably well.
+ */
+#define	CTL_DEFAULT_SECTORS_PER_TRACK	512
+#define	CTL_DEFAULT_HEADS		64
+#endif
+
+/*
+ * Solaris is somewhat picky about how many heads and sectors per track you
+ * have defined in mode pages 3 and 4.  These values seem to cause Solaris
+ * to get the capacity more or less right when you run the format tool.
+ * They still have problems when dealing with devices larger than 1TB,
+ * but there isn't anything we can do about that.
+ *
+ * For smaller LUN sizes, this ends up causing the number of cylinders to
+ * work out to 0.  Solaris actually recognizes that and comes up with its
+ * own bogus geometry to fit the actual capacity of the drive.  They really
+ * should just give up on geometry and stick to the read capacity
+ * information alone for modern disk drives.
+ *
+ * One thing worth mentioning about Solaris' mkfs command is that it
+ * doesn't like sectors per track values larger than 256.  512 seems to
+ * work okay for format, but causes problems when you try to make a
+ * filesystem.
+ *
+ * Another caveat about these values:  the product of these two values
+ * really should be a power of 2.  This is because of the simplistic
+ * shift-based calculation that we have to use on the i386 platform to
+ * calculate the number of cylinders here.  (If you use a divide, you end
+ * up calling __udivdi3(), which is a hardware FP call on the PC.  On the
+ * XScale, it is done in software, so you can do that from inside the
+ * kernel.)
+ *
+ * So for the current values (256 S/T, 128 H), we get 32768, which works
+ * very nicely for calculating cylinders.
+ *
+ * If you want to change these values so that their product is no longer a
+ * power of 2, re-visit the calculation in ctl_init_page_index().  You may
+ * need to make it a bit more complicated to get the number of cylinders
+ * right.
+ */
+#define	CTL_DEFAULT_SECTORS_PER_TRACK	256
+#define	CTL_DEFAULT_HEADS		128
+
+#define	CTL_DEFAULT_ROTATION_RATE	10000
+
+struct ctl_page_index;
+
+typedef int	ctl_modesen_handler(struct ctl_scsiio *ctsio,
+				    struct ctl_page_index *page_index,
+				    int pc);
+typedef int	ctl_modesel_handler(struct ctl_scsiio *ctsio,
+				    struct ctl_page_index *page_index,
+				    uint8_t *page_ptr);
+
+typedef enum {
+	CTL_PAGE_FLAG_NONE	 = 0x00,
+	CTL_PAGE_FLAG_DISK_ONLY	 = 0x01
+} ctl_page_flags;
+
+struct ctl_page_index {
+	uint8_t			page_code;
+	uint8_t			subpage;
+	uint16_t		page_len;
+	uint8_t			*page_data;
+	ctl_page_flags		page_flags;
+	ctl_modesen_handler	*sense_handler;
+	ctl_modesel_handler	*select_handler;
+};
+
+#define	CTL_PAGE_CURRENT	0x00
+#define	CTL_PAGE_CHANGEABLE	0x01
+#define	CTL_PAGE_DEFAULT	0x02
+#define	CTL_PAGE_SAVED		0x03
+
+static struct ctl_page_index page_index_template[] = {
+	{SMS_FORMAT_DEVICE_PAGE, 0, sizeof(struct scsi_format_page), NULL,
+	 CTL_PAGE_FLAG_DISK_ONLY, NULL, NULL},
+	{SMS_RIGID_DISK_PAGE, 0, sizeof(struct scsi_rigid_disk_page), NULL,
+	 CTL_PAGE_FLAG_DISK_ONLY, NULL, NULL},
+	{SMS_CACHING_PAGE, 0, sizeof(struct scsi_caching_page), NULL,
+	 CTL_PAGE_FLAG_DISK_ONLY, NULL, NULL},
+	{SMS_CONTROL_MODE_PAGE, 0, sizeof(struct scsi_control_page), NULL,
+	 CTL_PAGE_FLAG_NONE, NULL, ctl_control_page_handler},
+   	{SMS_VENDOR_SPECIFIC_PAGE | SMPH_SPF, PWR_SUBPAGE_CODE,
+	 sizeof(struct copan_power_subpage), NULL, CTL_PAGE_FLAG_NONE,
+	 ctl_power_sp_sense_handler, ctl_power_sp_handler},
+	{SMS_VENDOR_SPECIFIC_PAGE | SMPH_SPF, APS_SUBPAGE_CODE,
+	 sizeof(struct copan_aps_subpage), NULL, CTL_PAGE_FLAG_NONE,
+	 NULL, ctl_aps_sp_handler},
+	{SMS_VENDOR_SPECIFIC_PAGE | SMPH_SPF, DBGCNF_SUBPAGE_CODE,
+	 sizeof(struct copan_debugconf_subpage), NULL, CTL_PAGE_FLAG_NONE,
+	 ctl_debugconf_sp_sense_handler, ctl_debugconf_sp_select_handler},
+};
+
+#define	CTL_NUM_MODE_PAGES sizeof(page_index_template)/   \
+			   sizeof(page_index_template[0])
+
+struct ctl_mode_pages {
+	struct scsi_format_page		format_page[4];
+	struct scsi_rigid_disk_page	rigid_disk_page[4];
+	struct scsi_caching_page	caching_page[4];
+	struct scsi_control_page	control_page[4];
+	struct copan_power_subpage	power_subpage[4];
+	struct copan_aps_subpage	aps_subpage[4];
+	struct copan_debugconf_subpage	debugconf_subpage[4];
+	struct ctl_page_index		index[CTL_NUM_MODE_PAGES];
+};
+
+struct ctl_pending_sense {
+	ctl_ua_type		ua_pending;
+	struct scsi_sense_data	sense;
+};
+
+struct ctl_lun_delay_info {
+	ctl_delay_type		datamove_type;
+	uint32_t		datamove_delay;
+	ctl_delay_type		done_type;
+	uint32_t		done_delay;
+};
+
+typedef enum {
+	CTL_ERR_INJ_NONE	= 0x00,
+	CTL_ERR_INJ_ABORTED	= 0x01
+} ctl_err_inject_flags;
+
+typedef enum {
+	CTL_PR_FLAG_NONE	= 0x00,
+	CTL_PR_FLAG_REGISTERED	= 0x01,
+	CTL_PR_FLAG_ACTIVE_RES	= 0x02
+} ctl_per_res_flags;
+
+struct ctl_per_res_info {
+	struct scsi_per_res_key res_key;
+	uint8_t  registered;
+};
+
+#define CTL_PR_ALL_REGISTRANTS  0xFFFF
+#define CTL_PR_NO_RESERVATION   0xFFF0
+
+/*
+ * For report target port groups.
+ */
+#define NUM_TARGET_PORT_GROUPS	2
+#define NUM_PORTS_PER_GRP	2
+
+struct ctl_lun {
+	struct mtx			lun_lock;
+	struct ctl_id			target;
+	uint64_t			lun;
+	ctl_lun_flags			flags;
+	STAILQ_HEAD(,ctl_error_desc)	error_list;
+	uint64_t			error_serial;
+	struct ctl_softc		*ctl_softc;
+	struct ctl_be_lun		*be_lun;
+	struct ctl_backend_driver	*backend;
+	int				io_count;
+	struct ctl_lun_delay_info	delay_info;
+	int				sync_interval;
+	int				sync_count;
+	TAILQ_HEAD(ctl_ooaq, ctl_io_hdr)  ooa_queue;
+	TAILQ_HEAD(ctl_blockq,ctl_io_hdr) blocked_queue;
+	STAILQ_ENTRY(ctl_lun)		links;
+	STAILQ_ENTRY(ctl_lun)		run_links;
+	struct ctl_nexus		rsv_nexus;
+	uint32_t			have_ca[CTL_MAX_INITIATORS >> 5];
+	struct ctl_pending_sense	pending_sense[CTL_MAX_INITIATORS];
+	struct ctl_mode_pages		mode_pages;
+	struct ctl_lun_io_stats		stats;
+	struct ctl_per_res_info		per_res[2*CTL_MAX_INITIATORS];
+	unsigned int			PRGeneration;
+	int				pr_key_count;
+	uint16_t        		pr_res_idx;
+	uint8_t				res_type;
+	uint8_t				write_buffer[524288];
+};
+
+typedef enum {
+	CTL_FLAG_TASK_PENDING	= 0x01,
+	CTL_FLAG_REAL_SYNC	= 0x02,
+	CTL_FLAG_MASTER_SHELF	= 0x04
+} ctl_gen_flags;
+
+struct ctl_wwpn_iid {
+	int in_use;
+	uint64_t wwpn;
+	uint32_t iid;
+	int32_t port;
+};
+
+struct ctl_softc {
+	struct mtx ctl_lock;
+	struct cdev *dev;
+	int open_count;
+	struct ctl_id target;
+	int num_disks;
+	int num_luns;
+	ctl_gen_flags flags;
+	ctl_ha_mode ha_mode;
+	struct ctl_ioctl_info ioctl_info;
+	struct ctl_lun lun;
+	struct ctl_io_pool *internal_pool;
+	struct ctl_io_pool *emergency_pool;
+	struct ctl_io_pool *othersc_pool;
+	struct proc *work_thread;
+	int targ_online;
+	uint32_t ctl_lun_mask[CTL_MAX_LUNS >> 5];
+	struct ctl_lun *ctl_luns[CTL_MAX_LUNS];
+	struct ctl_wwpn_iid wwpn_iid[CTL_MAX_PORTS][CTL_MAX_INIT_PER_PORT];
+	uint32_t ctl_port_mask;
+	uint64_t aps_locked_lun;
+	STAILQ_HEAD(, ctl_lun) lun_list;
+	STAILQ_HEAD(, ctl_be_lun) pending_lun_queue;
+	STAILQ_HEAD(, ctl_io_hdr) task_queue;
+	STAILQ_HEAD(, ctl_io_hdr) incoming_queue;
+	STAILQ_HEAD(, ctl_io_hdr) rtr_queue;
+	STAILQ_HEAD(, ctl_io_hdr) done_queue;
+	STAILQ_HEAD(, ctl_io_hdr) isc_queue;
+	uint32_t num_frontends;
+	STAILQ_HEAD(, ctl_frontend) fe_list;
+	struct ctl_frontend *ctl_ports[CTL_MAX_PORTS];
+	uint32_t num_backends;
+	STAILQ_HEAD(, ctl_backend_driver) be_list;
+	uint32_t num_pools;
+	uint32_t cur_pool_id;
+	STAILQ_HEAD(, ctl_io_pool) io_pools;
+	time_t last_print_jiffies;
+	uint32_t skipped_prints;
+};
+
+#ifdef _KERNEL
+
+extern struct ctl_cmd_entry ctl_cmd_table[];
+
+uint32_t ctl_get_initindex(struct ctl_nexus *nexus);
+int ctl_pool_create(struct ctl_softc *ctl_softc, ctl_pool_type pool_type,
+		    uint32_t total_ctl_io, struct ctl_io_pool **npool);
+int ctl_pool_acquire(struct ctl_io_pool *pool);
+int ctl_pool_invalidate(struct ctl_io_pool *pool);
+int ctl_pool_release(struct ctl_io_pool *pool);
+void ctl_pool_free(struct ctl_softc *ctl_softc, struct ctl_io_pool *pool);
+int ctl_scsi_release(struct ctl_scsiio *ctsio);
+int ctl_scsi_reserve(struct ctl_scsiio *ctsio);
+int ctl_start_stop(struct ctl_scsiio *ctsio);
+int ctl_sync_cache(struct ctl_scsiio *ctsio);
+int ctl_format(struct ctl_scsiio *ctsio);
+int ctl_write_buffer(struct ctl_scsiio *ctsio);
+int ctl_mode_select(struct ctl_scsiio *ctsio);
+int ctl_mode_sense(struct ctl_scsiio *ctsio);
+int ctl_read_capacity(struct ctl_scsiio *ctsio);
+int ctl_service_action_in(struct ctl_scsiio *ctsio);
+int ctl_read_write(struct ctl_scsiio *ctsio);
+int ctl_report_luns(struct ctl_scsiio *ctsio);
+int ctl_request_sense(struct ctl_scsiio *ctsio);
+int ctl_tur(struct ctl_scsiio *ctsio);
+int ctl_inquiry(struct ctl_scsiio *ctsio);
+int ctl_persistent_reserve_in(struct ctl_scsiio *ctsio);
+int ctl_persistent_reserve_out(struct ctl_scsiio *ctsio);
+int ctl_maintenance_in(struct ctl_scsiio *ctsio);
+void ctl_done_lock(union ctl_io *io, int have_lock);
+int ctl_isc(struct ctl_scsiio *ctsio);
+
+#endif	/* _KERNEL */
+
+#endif	/* _CTL_PRIVATE_H_ */
+
+/*
+ * vim: ts=8
+ */
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_scsi_all.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_scsi_all.c	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,227 @@
+/*-
+ * Implementation of Utility functions for all SCSI device types.
+ *
+ * Copyright (c) 1997, 1998, 1999 Justin T. Gibbs.
+ * Copyright (c) 1997, 1998, 2003 Kenneth D. Merry.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification, immediately at the beginning of the file.
+ * 2. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_scsi_all.c#2 $
+ */
+
+#include <sys/param.h>
+
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_scsi_all.c 229997 2012-01-12 00:34:33Z ken $");
+
+#include <sys/types.h>
+#ifdef _KERNEL
+#include <sys/systm.h>
+#include <sys/libkern.h>
+#include <sys/kernel.h>
+#include <sys/sysctl.h>
+#else
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <inttypes.h>
+#endif
+
+#include <cam/cam.h>
+#include <cam/cam_ccb.h>
+#include <cam/cam_queue.h>
+#include <cam/cam_xpt.h>
+#include <cam/scsi/scsi_all.h>
+
+#include <cam/ctl/ctl_io.h>
+#include <cam/ctl/ctl_scsi_all.h>
+#include <sys/sbuf.h>
+#ifndef _KERNEL
+#include <camlib.h>
+#endif
+
+const char *
+ctl_scsi_status_string(struct ctl_scsiio *ctsio)
+{
+	switch(ctsio->scsi_status) {
+	case SCSI_STATUS_OK:
+		return("OK");
+	case SCSI_STATUS_CHECK_COND:
+		return("Check Condition");
+	case SCSI_STATUS_BUSY:
+		return("Busy");
+	case SCSI_STATUS_INTERMED:
+		return("Intermediate");
+	case SCSI_STATUS_INTERMED_COND_MET:
+		return("Intermediate-Condition Met");
+	case SCSI_STATUS_RESERV_CONFLICT:
+		return("Reservation Conflict");
+	case SCSI_STATUS_CMD_TERMINATED:
+		return("Command Terminated");
+	case SCSI_STATUS_QUEUE_FULL:
+		return("Queue Full");
+	case SCSI_STATUS_ACA_ACTIVE:
+		return("ACA Active");
+	case SCSI_STATUS_TASK_ABORTED:
+		return("Task Aborted");
+	default: {
+		static char unkstr[64];
+		snprintf(unkstr, sizeof(unkstr), "Unknown %#x",
+			 ctsio->scsi_status);
+		return(unkstr);
+	}
+	}
+}
+
+/*
+ * scsi_command_string() returns 0 for success and -1 for failure.
+ */
+int
+ctl_scsi_command_string(struct ctl_scsiio *ctsio,
+			struct scsi_inquiry_data *inq_data, struct sbuf *sb)
+{
+	char cdb_str[(SCSI_MAX_CDBLEN * 3) + 1];
+
+	sbuf_printf(sb, "%s. CDB: %s",
+		    scsi_op_desc(ctsio->cdb[0], inq_data),
+		    scsi_cdb_string(ctsio->cdb, cdb_str, sizeof(cdb_str)));
+
+	return(0);
+}
+
+void
+ctl_scsi_path_string(union ctl_io *io, char *path_str, int len)
+{
+	if (io->io_hdr.nexus.targ_target.wwid[0] == 0) {
+		snprintf(path_str, len, "(%ju:%d:%ju:%d): ",
+			 (uintmax_t)io->io_hdr.nexus.initid.id,
+			 io->io_hdr.nexus.targ_port,
+			 (uintmax_t)io->io_hdr.nexus.targ_target.id,
+			 io->io_hdr.nexus.targ_lun);
+	} else {
+		/*
+		 * XXX KDM find a better way to display FC WWIDs.
+		 */
+#ifdef _KERNEL
+		snprintf(path_str, len, "(%ju:%d:%#jx,%#jx:%d): ",
+			 (uintmax_t)io->io_hdr.nexus.initid.id,
+			 io->io_hdr.nexus.targ_port,
+			 (intmax_t)io->io_hdr.nexus.targ_target.wwid[0],
+			 (intmax_t)io->io_hdr.nexus.targ_target.wwid[1],
+			 io->io_hdr.nexus.targ_lun);
+#else /* _KERNEL */
+		snprintf(path_str, len, "(%ju:%d:%#jx,%#jx:%d): ",
+			 (uintmax_t)io->io_hdr.nexus.initid.id,
+			 io->io_hdr.nexus.targ_port,
+			 (intmax_t)io->io_hdr.nexus.targ_target.wwid[0],
+			 (intmax_t)io->io_hdr.nexus.targ_target.wwid[1],
+			 io->io_hdr.nexus.targ_lun);
+#endif /* _KERNEL */
+	}
+}
+
+/*
+ * ctl_scsi_sense_sbuf() returns 0 for success and -1 for failure.
+ */
+int
+ctl_scsi_sense_sbuf(struct ctl_scsiio *ctsio,
+		    struct scsi_inquiry_data *inq_data, struct sbuf *sb,
+		    scsi_sense_string_flags flags)
+{
+	char	  path_str[64];
+
+	if ((ctsio == NULL) || (sb == NULL))
+		return(-1);
+
+	ctl_scsi_path_string((union ctl_io *)ctsio, path_str, sizeof(path_str));
+
+	if (flags & SSS_FLAG_PRINT_COMMAND) {
+
+		sbuf_cat(sb, path_str);
+
+		ctl_scsi_command_string(ctsio, inq_data, sb);
+
+		sbuf_printf(sb, "\n");
+	}
+
+	scsi_sense_only_sbuf(&ctsio->sense_data, ctsio->sense_len, sb,
+			     path_str, inq_data, ctsio->cdb, ctsio->cdb_len);
+
+	return(0);
+}
+
+char *
+ctl_scsi_sense_string(struct ctl_scsiio *ctsio,
+		      struct scsi_inquiry_data *inq_data, char *str,
+		      int str_len)
+{
+	struct sbuf sb;
+
+	sbuf_new(&sb, str, str_len, 0);
+
+	ctl_scsi_sense_sbuf(ctsio, inq_data, &sb, SSS_FLAG_PRINT_COMMAND);
+
+	sbuf_finish(&sb);
+
+	return(sbuf_data(&sb));
+}
+
+#ifdef _KERNEL
+void 
+ctl_scsi_sense_print(struct ctl_scsiio *ctsio,
+		     struct scsi_inquiry_data *inq_data)
+{
+	struct sbuf sb;
+	char str[512];
+
+	sbuf_new(&sb, str, sizeof(str), 0);
+
+	ctl_scsi_sense_sbuf(ctsio, inq_data, &sb, SSS_FLAG_PRINT_COMMAND);
+
+	sbuf_finish(&sb);
+
+	printf("%s", sbuf_data(&sb));
+}
+
+#else /* _KERNEL */
+void
+ctl_scsi_sense_print(struct ctl_scsiio *ctsio,
+		     struct scsi_inquiry_data *inq_data, FILE *ofile)
+{
+	struct sbuf sb;
+	char str[512];
+
+	if ((ctsio == NULL) || (ofile == NULL))
+		return;
+
+	sbuf_new(&sb, str, sizeof(str), 0);
+
+	ctl_scsi_sense_sbuf(ctsio, inq_data, &sb, SSS_FLAG_PRINT_COMMAND);
+
+	sbuf_finish(&sb);
+
+	fprintf(ofile, "%s", sbuf_data(&sb));
+}
+
+#endif /* _KERNEL */
+
diff -r ebe87ce4d7dd -r 1750de5b0399 head/sys/cam/ctl/ctl_scsi_all.h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/head/sys/cam/ctl/ctl_scsi_all.h	Fri Jan 13 15:51:01 2012 +0200
@@ -0,0 +1,52 @@
+/*-
+ * Copyright (c) 1997, 1998, 1999 Justin T. Gibbs.
+ * Copyright (c) 1997, 1998, 2003 Kenneth D. Merry.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification, immediately at the beginning of the file.
+ * 2. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: //depot/users/kenm/FreeBSD-test2/sys/cam/ctl/ctl_scsi_all.h#2 $
+ */
+
+__FBSDID("$FreeBSD: head/sys/cam/ctl/ctl_scsi_all.h 229997 2012-01-12 00:34:33Z ken $");
+
+__BEGIN_DECLS
+const char *	ctl_scsi_status_string(struct ctl_scsiio *ctsio);
+#ifdef _KERNEL
+void		ctl_scsi_sense_print(struct ctl_scsiio *ctsio,
+				     struct scsi_inquiry_data *inq_data);
+#else /* _KERNEL */
+void		ctl_scsi_sense_print(struct ctl_scsiio *ctsio,
+				     struct scsi_inquiry_data *inq_data,
+				     FILE *ofile);
+#endif /* _KERNEL */
+int ctl_scsi_command_string(struct ctl_scsiio *ctsio,
+			    struct scsi_inquiry_data *inq_data,struct sbuf *sb);
+int ctl_scsi_sense_sbuf(struct ctl_scsiio *ctsio,
+			struct scsi_inquiry_data *inq_data, struct sbuf *sb,
+			scsi_sense_string_flags flags);
+void ctl_scsi_path_string(union ctl_io *io, char *path_str, int strlen);
+char *ctl_scsi_sense_string(struct ctl_scsiio *ctsio,
+			    struct scsi_inquiry_data *inq_data, char *str,
+			    int str_len);
+
+__END_DECLS
diff -r ebe87ce